# under-engineering-review

_Audits existing code for depth, complexity and size._

> Source: https://fullstack.rocks/skills/under-engineering-review
> Code: https://github.com/Fullstack-Rocks/skills/tree/main/skills/under-engineering-review

under-engineering keeps new code small, but what about the code you already have? **under-engineering-review audits existing code** against the same limits, without changing a line of it.

The agent traces each root with `call-depth`, measures everything with parsers, and reports a table of checks plus the 10 worst findings. Every finding gets an ID, so your reply can be as short as *“do M1 and M2”*.

**Install**

Claude Code:

```shell
npx skills add Fullstack-Rocks/skills --skill under-engineering-review -a claude-code
```

Codex:

```shell
npx skills add Fullstack-Rocks/skills --skill under-engineering-review -a codex
```

Cursor:

```shell
npx skills add Fullstack-Rocks/skills --skill under-engineering-review -a cursor
```

Any agent:

```shell
npx skills add Fullstack-Rocks/skills --skill under-engineering-review
```

Prompt, to paste into your agent:

> Install the under-engineering-review and call-depth skills from https://github.com/Fullstack-Rocks/skills by running npx skills add Fullstack-Rocks/skills --skill under-engineering-review --skill call-depth, then review the code I name for depth and complexity.

Install it together with `call-depth`, which does all of its measuring.

**Try saying**

- Review the refund flow (POST /orders/{id}/refund) for depth and complexity.
- Audit app/services against the under-engineering limits.
- How traceable is this PR?

![Claude Code session: the agent reviews the refund flow, traces depth 7 with two memory hops, reports findings with IDs such as M2, S1 and S2, a fix-first recommendation, and two bugs it found while tracing](https://storage.googleapis.com/fullstack-rocks-media/skill-under-engineering-review-demo-poster.png)

_[▶ Watch the recording: claude · demo shop](https://storage.googleapis.com/fullstack-rocks-media/skill-under-engineering-review-demo.mp4) — A real Claude Code session on the demo shop, recorded as it happened. Long thinking stretches are sped up, everything else plays at its real pace._

Transcript:

```
> Review the refund flow (POST /orders/{id}/refund) for depth and complexity.
Deepest chain: refund_order → refund_service.refund → REFUND_HANDLERS[reason] → Ledger.record → getattr "_write_{kind}" → Database.insert. Depth 7, limit 3.
Findings: D1 call depth, M1 and M2 memory hops, S1 and S2 folders over 6 files.
Fix first: M1 and M2 together, which brings D1 within the limit.
Bugs found while tracing: the refund route is never registered, and a bad reason becomes a 500 instead of a 400.
I haven’t changed anything. Tell me which IDs to apply, for example “do M1 and M2”.
```

## How does it work?

The goal is one short report that you can decide from and an agent can act on. Since the code under review already exists, the skill only proposes fixes, and nothing changes unless you ask.

1. **Scope.** The request becomes a file list (paths, a package, or `git diff --name-only <ref>`) and a list of roots.
2. **Trace.** `call-depth` traces each root. Every file the trace reaches joins the scope, and the files on traced paths count as on-path.
3. **Measure.** `layout.py` and `call-depth`’s `scan.py` (length, complexity, memory hops) run over the file list. The raw output goes to a file in `/tmp`, so it never fills the agent’s context.
4. **Spot governance.** Policy enforced in code (allow-lists, retention, compliance gates, policy rate limits) gets noted as a candidate for infrastructure, without judging it.
5. **Report.** A table of checks against the limits for on-path code, the 10 worst findings, the governance items, and “fix first” (3 at most).

Here’s an excerpt of the report from the recording:

```
Deepest chain
root  refund_order                         app/api/refund_routes.py:7
  1   refund_service.refund                app/services/refund_service.py:16
  3   _refund_damaged | _refund_late       app/services/refund_service.py:5|9   [NOT LSP: REFUND_HANDLERS[reason]]
  4   Ledger.record                        app/services/ledger.py:8             <- over 3
  6   Ledger._write_refund | _write_credit app/services/ledger.py:12|16         [NOT LSP: getattr "_write_{kind}"]
  7   Database.insert                      app/db.py:19
depth 7 (calls 4, memory hops 2) · limit 3

ID  Check        Location              Measured                 Proposed fix
D1  Call depth   refund_order          7 (limit 3)              Apply M1 and M2 to get refund → record_refund/record_credit → db.insert (depth 3)
M1  Memory hop   refund_service.py:20  REFUND_HANDLERS[reason]  Replace the 2-entry dict with if reason == "damaged": … if reason == "late": …
S1  Folder size  app/services          11 files (limit 6)       Move to per-domain folders
```

```mermaid
flowchart TD
  S[Scope<br/>paths, package or git diff] --> T[Trace each root<br/>call-depth]
  T --> M[Measure<br/>layout.py + scan.py]
  M --> G[Spot governance]
  G --> R[Report: checks, 10 worst,<br/>fix first]:::hi
  classDef hi fill:var(--highlight),stroke:var(--highlight),color:var(--on-highlight)
```

_Every finding has an ID you can reply with, like “do M1 and M2”._

## But does it work?

**From the recording · Depth 7 on the refund route, limit 3**

Two memory hops, a dict registry and a getattr dispatch, add 4 of the 7 points. Fix M1 and M2 together and the route is back within the limit. The trace turned up two bugs on the way too: the refund route is never registered, and a bad reason becomes a 500 instead of a 400.

![The review of the refund flow: depth 7 against a limit of 3, two memory hops (M1 and M2) to fix first, and two folders over the size limit.](https://storage.googleapis.com/fullstack-rocks-media/skill-under-engineering-review-proof.svg)

## The other skills

**The other skills**

- [under-engineering](https://fullstack.rocks/skills/under-engineering)
- [um-maybe](https://fullstack.rocks/skills/um-maybe)
- [call-depth](https://fullstack.rocks/skills/call-depth)
- [code-standards](https://fullstack.rocks/skills/code-standards)