AI coding workflow: implementation, review, and decisionsAI coding workflow: implementation, review, and decisions

This article describes a review workflow for coding with Claude and Codex, covering issue identification, impact analysis, and review after fixes. For tool settings, see Omnigate’s advanced Claude Code guide. Initial setup is covered in the quick-start guide and tool installation.

Implementation, review, and business decisions require different inputs and checks. In this workflow, Claude Opus 5 produces the code or plan and GPT-5.6 Sol reviews it independently. When findings are numerous or their impact is unclear, Claude Opus 5 helps explain them and compare options. The person responsible decides the scope of the fix.

The model tiers below are examples from this setup. Choose from the models available to your account:

Model IDs can be checked in the Omnigate model catalog.

Workflow overview

Stage one: independent code review with GPT-5.6 Sol

After the code or plan is complete and before merging, check correctness, edge cases, security, and whether it meets the requirements.

This stage focuses on issues that affect correctness. Refactoring, naming, style, and comments can be handled separately so the issue list has a clear scope.

Example review prompt

You are a senior security architect reviewing a plan or code written by another AI assistant.
Your job is to verify it independently.
 
Answer only the four questions below. Do not suggest refactors, renames, style changes,
or additional comments.
 
Review checklist:
1. Is the logic correct? Does the business flow actually work?
2. Are edge cases missing? Consider null values, concurrency, timeouts, and extreme inputs.
3. Are there security risks? Consider injection, broken authorization, sensitive-data leaks,
   and resource exhaustion.
4. Does it satisfy the stated requirements? Compare it with the original request and identify drift.
 
Output requirements:
- Report only definite bugs, logic errors, and security risks.
- Mark uncertain items as “questionable,” state what information is missing, and do not pretend certainty.
- Return the complete list in one response, ordered by severity.
- For every item, state the location (file/function/step), the behavior, and why it is wrong.

Execution steps

1. Give GPT-5.6 Sol the current diff, relevant files, or plan together with the original requirements.
2. Paste the role prompt above, then ask something like:

/goal Are there any remaining problems in the changes from this conversation?

3. After checking the issue list, request fixes:

/goal Resolve the issues you found.

Work through the list, then run another review. For unresolved findings, retain the missing information and any decision to accept the risk.

Keep the review scope clear

Handle refactoring and style discussions separately, and review unrelated pull requests on their own. Use the same set of changes and requirements in each pass so issues can be tracked through resolution.

Stage two: business decision support with Claude Opus 5

Add impact analysis when:

• Stage one finds many issues and their priorities need clarification.
• The technical logic is complex and the review findings need explanation.
• Whether and how to fix an issue depends on business impact and acceptable risk.

This stage explains the consequences and tradeoffs of the options to support the decision.

Example impact analysis prompt

The organizational comparison in this template is a way to discuss possible responses, not evidence of a particular company's process. Apply it using the current project's business impact and constraints.

You are an engineering director reviewing a technical proposal and its review findings.
 
Interaction requirements:
1. If I do not understand an issue, explain the core logic first in the simplest nontechnical language,
   then add the details.
2. Explain the concrete business impact of each issue, such as mismatched data, an unavailable API,
   incorrect billing, bypassed permissions, or exhausted resources.
3. Give me a decision reference: if the same issue appeared in a major production environment,
   how would the team most likely handle it? For example:
   - block the merge
   - require a design change before merging
   - merge behind monitoring, rate limits, or a feature flag
   - ship an emergency hotfix
   - record technical debt and schedule it later
4. Compare the tradeoffs of the available options and let me make the final decision.
   Do not choose the “most elegant” option for me.

Execution steps

Provide Claude Opus 5 with:

• the relevant code or proposal
• GPT-5.6 Sol's original issue list
• the business context: who uses it and how sensitive the money, data, or permissions are

Follow-up questions might include: "What would happen if issue three shipped?" or "Does this issue need to block the merge in the current project?"

The combined sequence

1. Use Claude Opus 5 to produce the code or plan.
2. Send the same changes to GPT-5.6 Sol with the stage-one prompt.
3. If findings are serious or their impact is unclear, give the issue list and code to Claude Opus 5 with the stage-two prompt.
4. Have the person responsible confirm what must be fixed, what can wait, and what is a false positive.
5. Return to GPT-5.6 Sol to apply the fixes: /goal Resolve the issues I confirmed.
6. Repeat steps two through five until the confirmed required fixes are complete.

Adjust review depth to the risk of the change:

• Start small changes with stage one, then use the findings to decide whether stage two is needed.
• Billing, authorization, multitenancy, and concurrency changes warrant a full review and clarification of uncertain findings before a decision.
• The models can use different keys and separate sessions. Keep implementation and review separate, and verify the changes against the original requirements during review.

Related articles and documentation

• Delegating across conversations and returning results: How does the result return to the original conversation? uses the DSH plugin to explain creation, reading, and acceptance.
• Cost, context, and /clear versus /compact: AI coding: context, verification, and cost
• Project-level constraints: Configuring CLAUDE.md: global conventions and project rules
• Claude Code switches and permissions: Omnigate’s settings.json guide
• Connecting tools to Omnigate: Install Claude Code and Install Codex CLI

These roles can be reused in clients that accept prompts and code, with execution adjusted to the client's capabilities.

Originally published in the Omnigate documentation.