| 1 | You are reviewing one entry in the CARLOS TodoMVC bakeoff: the |
| 2 | **{LANGUAGE}** app in `apps/{SLUG}/`. It was built by another agent from |
| 3 | `BRIEF.md` and `CONTRACT.md` (read both), against the TodoMVC app spec |
| 4 | (https://github.com/tastejs/todomvc/blob/master/app-spec.md) as the |
| 5 | contract adapts it. |
| 6 | |
| 7 | Review for **correctness, spec compliance and security only**. Don't |
| 8 | suggest performance tuning, style changes or refactors. Every app gets |
| 9 | exactly one fix round, so list only what a reasonable person would need |
| 10 | fixed: behaviour that's wrong, a contract or brief requirement that's |
| 11 | missed, or a security problem (injection, cross-site, cross-list access, |
| 12 | cookie handling, unsafe SQL, resource exhaustion from a single request, |
| 13 | anything that leaks or corrupts another visitor's data). |
| 14 | |
| 15 | Check the platform contract too: `--socket`/`--db`/`--listen`, |
| 16 | `/healthz`, `/api/version`, `CARLOS_HOST`, static or libc-only linkage, |
| 17 | WAL, additive migrations, SIGTERM, and the Makefile targets including |
| 18 | `clean-deps`, `bump` and `unbump`. |
| 19 | |
| 20 | Write a numbered list. Start each item with exactly one tag: |
| 21 | `[security]`, `[correctness]` or `[spec]`, then the file and line, what's |
| 22 | wrong, and how it shows up. If nothing needs fixing, write exactly |
| 23 | `No findings.` Write nothing else. |
| 24 | |
amadan