Review Commands

This page describes the commands and workflows that produce review evidence. For the procedure used inside each file review, see Review Procedure.

File-Focused Review

Reviews are built from one or more file-focused inspections. For each selected file, the review uses that file as the focal point while the full package remains available for context.

This keeps inspections bounded and inspectable. When the review completes, the CLI bundles the file results and submits them to the server, which records the package version, reviewed files, findings, and public reviewer identity. That record lets Thirdpass share evidence across projects that use the same package files.

For more on how each inspection is conducted, see Review Procedure.

Campaign Reviews

Review campaigns group assigned work around a mission, such as broad open-source review evidence or bitcoin-only software review. List campaigns with:

thirdpass campaign list

Show one campaign:

thirdpass campaign show bitcoin-only

Review the next target from a campaign:

thirdpass review-any --campaign bitcoin-only

The review-all-oss campaign is the default server-selected review pool.

Assigned Reviews

The server keeps a prioritized queue of package versions that need review. The CLI can ask the server for a target from that queue:

thirdpass review-any

Nightshift mode repeats that process in a loop:

thirdpass review-any --nightshift

To focus assigned reviews on a registry, pass --registry:

thirdpass review-any --registry crates.io
thirdpass review-any --nightshift --registry pypi.org

To attribute an explicit package review to a campaign, pass --campaign:

thirdpass review SeedSigner/seedsigner --extension github --campaign bitcoin-only

After the server assigns a target, the CLI uses the configured ecosystem extension to resolve, cache, and extract the package archive for review.

Local Dependency Review

To review packages used by the project in the current directory, run:

thirdpass review-deps

The CLI asks enabled extensions to identify dependency files and resolve the reviewable package versions. It derives an ordered review plan from the current dependency files and existing evidence from local review storage and committed project reviews.

Those extensions retrieve selected package archives so Thirdpass can analyze their files and prepare review batches. Completed dependency reviews are also written under .thirdpass/reviews/ in the project checkout. When matching local reviews already exist on the machine, review-deps copies them into that project directory and skips the covered files.

The command continues through the plan until all review batches have matching evidence or the user stops it. If interrupted, run it again to resume; the CLI derives the plan again from the current dependency files, checks local pending and submitted reviews plus .thirdpass/reviews/, skips files that already have matching package artifact and file-hash evidence, and selects the next review batch with remaining files.