Code Analyzer

Local symbol graph for quality work: index first, then answer what changed, who is hit, what is untested, and where an error comes from.

There is no codexqa diff or codexqa review. Review a change with:

index --diff-base <ref>  →  change-groups  →  symbol-diff  →  callers / tests / entries

Pick the scenario before acting. Do not query or review a diff until an index exists. Do not run full-text search unless the user asked. README.md / README.zh-CN.md are human-facing. Do not load them at runtime.

Documents (load on demand)

Read this file first. Read another file only when the row below applies. Do not preload the whole tree.

File	Load when
SKILL.md (this file)	always: routing, report contract, reject conditions
references/playbook.md	entering a scenario (index health / change / defect / implementation / architecture)
references/diagrams.md	before drawing; copy init and classDef verbatim
references/cli.md	CLI missing, PATH, LLM, or maintenance
references/mcp.json	graph-query tool schema is needed
README.md, README.zh-CN.md	human-facing; not needed by the agent

Scenario routing

Open references/playbook.md and jump to the named section.

User is asking…	Playbook section
Review a PR / what changed / vs main	Review one change (index health first)
Who is hit / what to regression-test	Regression scope under that change section
Any unit tests / coverage gaps	Test gaps under that change section
Which HTTP / RPC / MQ path reaches this	Entry risk under that change section
Auth, payments, password, token	Sensitive paths under that change section
Logs, stack, error text, comments	Locate a defect
How does this function work / who calls it	Understand an implementation
Module ownership / wrong layer	Architecture drift
Results are empty / every change is default	Index health / Analysis blockers

Report contract

Deliver a Mermaid evidence report (graph conclusions + diagrams). Not a product review, and not Archify / interactive HTML. Read references/diagrams.md before drawing. A diagram that misses the quality bar fails the report.

Report body is only these blocks:

• Must-read groups (by risk)
• What changed (trust only symbol-diff / file-source vs file-base)
• Must-test callers / entries (must come from edges / reach / path / tagged)
• Test gaps (a tests directory is not a tests edge)
• Sensitive paths (write "none" if there are none)
• Diagrams: at least one, and it must pass the quality bar

Reject the whole report and rewrite if any of these hold:

• Written as a generic project review (product intro, use cases, scored pros/cons)
• Evidence comes from README / a website / guesswork, not this run of summary / imports / source / edges / reach / change-groups / symbol-diff
• Only names large files or high fan-in; never uses edges / reach to say who is hit
• Infers "covered" from a tests directory name; never checked tested_count or reach --direction in --edge-kinds tests
• Mermaid is missing the Claude paper init, the three classDef lines, or a core module that should be risk has no class ... risk
• Architecture subgraph titles are package names (Renderer / Compiler / Shared) instead of Entry → Application → Domain → Storage
• Interactive HTML / Archify canvas was generated (this skill does not ask for that)