Claude, Code Reviewer Sub-Agent: 5 questions answered.
How the Claude Code reviewer sub-agent flags Magento blockers: phpcs, PHPStan, EQP, security, n+1 queries, Marketplace gates.
What does the code-reviewer sub-agent actually check on a Magento PR?
Six layers. (1) Style: phpcs --standard=Magento2 on changed files. (2) Static analysis: phpstan --level=6. (3) EQP: no ObjectManager in non-setup code, no vendor edits, plugins over preferences, service contracts over direct model access, _isAllowed() on every admin controller. (4) Security: SQL concatenation, unescaped phtml output, missing CSRF, hardcoded secrets. (5) Performance: n+1 queries (look for ->load() in a foreach), missing indexes on new db_schema.xml tables, missing cache tags on blocks. (6) Marketplace: composer.json license, README presence, no GPL deps. Output is a categorised Markdown report, same shape as a GitHub review comment.
How do I invoke the reviewer mid-PR?
From inside Claude Code: /review or explicitly Task tool with subagent_type: code-reviewer and the diff URL or branch name. From CI: a GitHub Action that runs claude code -p "review this diff: $DIFF" --agent code-reviewer and posts the output as a PR comment. The agent reads the diff, the changed files in full context, and your CLAUDE.md, it does not read the entire repo, which keeps the cost predictable. Typical run: 30-60 seconds for a small PR (1-5 files), 2-3 minutes for a large one (20+ files).
How do I deal with false positives from the reviewer?
Treat the reviewer's report as a draft, not a verdict. Three calibration moves. (1) Add a ## Project conventions section to your CLAUDE.md listing exceptions ("ObjectManager is allowed in Test/Unit, mocks need it"). (2) For repeated false positives, add an .claude/agents/code-reviewer.md override that explicitly mentions the convention. (3) If a finding is genuinely wrong, reply in-thread, the reviewer will adjust within the session. After two weeks of use, the false-positive rate is < 5%; on day 1 it'll be 20%. Patience pays.
Can it actually predict Marketplace tech-review failures?
About 80% of them, yes, the deterministic ones. Things it catches reliably: vendor edits, raw SQL, deprecated APIs (anything in @deprecated blocks across vendor/magento/*), missing service contracts, hardcoded URLs, missing translations on user-facing strings, missing composer.json dependencies, license file mismatches. Things it can't predict: subjective UX issues, regional compliance flags (GDPR, ADA), and Marketplace-listing copy. For those you still need a human reviewer (hire one). But shipping a PR with zero deterministic findings means the human review is fast and pleasant instead of soul-crushing.
How do I extend the reviewer with my own org-specific rules?
Edit .claude/agents/code-reviewer.md. Add a ## Org-specific rules section with concrete prohibitions: "No new dependencies in composer.json without architecture-team approval. All new admin controllers must extend Vendor\Common\Controller\Adminhtml\Base. All new emails must use the Vendor_Email template loader, not Magento_Email." The agent treats these the same as the built-in EQP rules. For pattern-based rules (regex matches) that the model would miss, add a PostToolUse hook that runs a literal grep and feeds findings back. Treat the code-reviewer.md file as living documentation, it is the source of truth for what "shippable" means in your org.
Not answered above?
Send the question as a brief; the answer comes back in writing within 24 hours, with a quote if it needs work.