What It Does

  • Spawns independent verifier agent separate from the worker
  • Reviews code changes and provides evidence-based static analysis
  • Catches suspicious patterns, bugs, and security vulnerabilities
  • Flags suspicious claims in documentation and code comments
  • Provides detailed analysis with file and line references
  • Optimized prompts: Works effectively with 1B+ parameter models (qwen2.5:0.5b, gemma2:2b)

Automatic Triggers

  • Subagent changes 3+ files in a single operation
  • Any file matching patterns: *auth*, *secret*, *permission*, Dockerfile, *.env*
  • User explicitly requests verification with command or flag
  • Critical system configuration files modified

Verification Checklist

  • Correctness: Does the code actually do what was requested?
  • Bugs & Edge Cases: Regressions, unhandled errors, missed cases
  • Security: Vulnerabilities, exposed secrets, permission issues
  • Build: Are there obvious syntax errors or missing imports?
  • Facts: Do version numbers, imports, and references look plausible?

Verification Outcomes

✓ PASS

All checks passed with evidence. Code is ready for deployment.

✗ FAIL

Issues found with specifics. Blocks merge until developer addresses cited problems.

△ PARTIAL

Some checks passed, others unverifiable. User decides next action.

How It Works

1
Trigger Detection
Monitors file changes and security-sensitive patterns
2
Spawn Verifier
Creates independent agent with no knowledge of worker results
3
Review Changes
Analyzes code diff for security issues, bugs, and correctness
4
Report Verdict
Returns the verifier's PASS, FAIL, or PARTIAL with supporting evidence