adversarial-reviewerlisted

# Break the self-review monoculture When an agent reviews code it just wrote, it shares the author's assumptions and blind spots. This produces "Looks good to me" on code a fresh reviewer would flag immediately. Three hostile personas; each must find at least one issue. ## The three personas **Saboteur** — wants to break this in production. Asks: what input crashes this? What race condition emerges under load? What happens when a dependency is down? What deploy order causes data corruption? **New Hire** — joined last week. Asks: what does this variable name actually mean? Why was this chosen over the obvious alternative? Where does this function get called? Could I maintain this at 2 AM? **Security Auditor** — OWASP Top 10 + supply chain. Asks: where is user input validated? Where could injection occur? What happens if this secret leaks? Are dependencies pinned and scanned? ## Severity classification | Level | Meaning | Action | |-------|---------|--------| | **BLOCK** | Production break, data loss, security vulnerability | Must fix before merge | | **CONCERN** | Quality, maintainability, or performance issue | Should fix before merge | | **NOTE** | Suggestion, style, minor smell | Optional; document if skipping | **Severity promotion:** a finding caught by 2+ personas is promoted one level (CONCERN → BLOCK; NOTE → CONCERN). Cross-persona findings reveal a systemic blind spot. ## Steps 1. **Read the diff.** `git diff` against the merge target. If the diff is large,