Review · first CodeBot capability
Code review that shows its work.
CodeBot reviews the exact head commit, publishes fewer findings, and acts only at the Comment, Review, or Merge authority your organization enables.
8d31a67c2bf4The persistent-429 path has no exit budget
src/retry-policy.ts:211 · high confidence
- Why it matters
- A provider that keeps returning 429 can hold a worker indefinitely and starve later reviews.
- Changed line
while (response.status === 429) retry(request)- How to verify
- Return 429 beyond the retry budget and assert that the job fails once with a bounded error.
Merge authority · blocking finding prevents approval and auto-merge
A finding earns its place.
The useful unit is not a comment. It is a falsifiable claim tied to code the pull request actually changed.
- 01
Collect the review boundary
Capture the exact head SHA, changed files, added right-side lines, repository rules, and available checks.
- 02
Generate candidates, not conclusions
Ask the model for structured risks, evidence locations, impact, and a concrete verification path.
- 03
Suppress weak output
Drop duplicates, low-confidence claims, invalid responses, and comments that cannot be anchored to a changed line.
- 04
Apply organization authority
Comment by default. When administrators enable Review or Merge, approve or request changes and schedule GitHub auto-merge only after the configured gates pass.
The review contract
A CodeBot finding exposes the context needed to challenge it. Confidence is a band, not a theatrical percentage.
- Exact commit
- Every review record names the head SHA it analyzed, so stale results can be superseded cleanly.
- Changed-line evidence
- Inline findings must map to an added line in the pull request diff and include the supporting excerpt.
- Calibrated confidence
- Only high and medium publishable findings reach the reviewer; suppressed candidates remain counted, not disguised.
- Organization authority
- Organization administrators choose Comment, Review, or Merge, with repository allowlists, exact-SHA checks, audit records, and emergency disable.
Authority is a settingComment is the safe default, not a product prohibition. Review and GitHub auto-merge become available only when the organization enables them and every gate passes.
Review is the first surface.
The longer product direction is an agentic engineering system across the software lifecycle, built capability by capability instead of presented as one vague autonomous agent.
GitHub-first analysis, grounded findings, repository rules, exact-SHA records, and auditable reviewer dispositions.
- Plan
- Implement
- Test
- Validate
- Publish
Evaluate CodeBot Review.
Tell us what your team reviews, where noise hurts, and which repository rules must remain visible.