A repo-level standard, in the spirit of agents.md and Anthropic's CLAUDE.md

ADVERSARIAL_REVIEW.md

Green CI, listening ports, and passing tests are not proof that code is right — at most they show the code did what its author imagined testing. AI coding agents make the gap sharper: they produce plausible, polished output at a pace no human reviewer matches. Just as AGENTS.md gave the industry a shared file format for telling agents how to work in a repo, this site proposes a companion standard that tells agents how to review: ADVERSARIAL_REVIEW.md — a common format for adversarial review, so any agent in any repo can perform deep, evidence-backed, adversarial review against rules the repo itself declares. One file, dropped in a repo root, upgrades every agent that reads it from code generator to skeptical reviewer.

The idea

1. Drop an ADVERSARIAL_REVIEW.md in your repo root.
2. It tells any coding agent: your work here is expected to survive adversarial review — and here is how that review is done in this repo.
3. The agent reviews as an adversary, pass by pass, one lens at a time (security, correctness, spec-compliance, performance, abuse, operational, governance), with reproducible evidence for every finding and an explicit per-lens verdict.
4. Findings go back to the authoring agent; CRITICAL/HIGH items are fixed and the diff is re-reviewed before the work is called done.
5. You customize the repo-specific section; the protocol and its six core lenses stay portable. (Changing the rules is itself a change — see the governance process.)

Quickstart

curl -O https://raw.githubusercontent.com/awdemos/adversarial-review/v1.0.1/ADVERSARIAL_REVIEW.md
# read it, edit the "Repo-specific rules" section, commit

Pinned to the v1.0.1 tag for provenance; verify with git tag -v or the SHA-256 published in the CHANGELOG.

Why not just prompt for it?

• Persistence. A prompt is forgotten; a file in the repo binds every future session — provided the agent is configured to read repo convention files, exactly the mechanism that makes AGENTS.md work.
• Portability. Any agent that reads repo conventions picks it up with no integration; nothing about the standard is tied to one vendor's tool.
• Accountability. The protocol demands reproducible, severity-rated findings and explicit "checked and clean" verdicts per lens — the difference between a review and a vibe check.
• Repo-owned rules. The repo declares its own invariants, known weak spots, and required checks. Generic review becomes this codebase's review.

The standard

The canonical, versioned template lives in this repo:

• ADVERSARIAL_REVIEW.md — the file you copy into your repo.
• GitHub repository — issues, PRs, and the full governance process.

Governance

A standard about review discipline owes its own contributors the same discipline: issues are opened and accepted before any PR, every commit is cryptographically verified (SSH or GPG signed), and every merge to main carries an NCO signoff — a named non-commissioned officer of record who independently reviewed the change and takes responsibility for it. Full process: CONTRIBUTING.md.

Status

v1.0.1 — the protocol (lenses, severity taxonomy, evidence rule, output format) is stable under semantic versioning; template text may tighten in patch releases. v1.0.0 was battle-tested by a 347-agent adversarial review of this standard itself; its findings are in docs/review-2026-10-17.md. MIT License. Feedback and PRs are welcome under the governance process above.