gjalla-spec-review — Claude Code skill: review a spec before coding

What gjalla-spec-review does

The skill runs one document through separate review passes. Efficacy comes first: it restates the goal, then the mechanism, and asks whether they close the same gap. For goals about preventing something, it traces the cheapest route to the bad outcome — if that route avoids the code being changed, the goal may not be met at all. The architecture pass looks at layer boundaries, where new components land, and whether the design fits the wider system. It also tests for dead code that only becomes live after some other change ships, and suggests cutting it now.

Security sits inside the spec rather than in a later gate. The skill asks who the adversary is, follows their shortest path to the unwanted result, and checks what becomes newly reachable: new consumers of data, a crossed trust boundary, a surface exposed to the internet. It looks for authentication and authorization on new endpoints, cross-tenant leakage, and correct handling of PII and secrets. Two more passes cover test strategy and the feature as the user meets it. Governance closes the list: project rules, exceptions, and whether the change deserves an architecture decision record.

Each lens reports what passes, what is at risk, and what must change, with blocking concerns kept apart from recommendations. The architecture pass refers to the gjalla master spec, so without that document some of its questions have nothing to check against.