You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Review polish and scale: PR reviews are now measurably less noisy and measurably less silent — nits consolidate into the sticky, deterministic rules cover what models miss, and an offline corpus harness replays real PRs so review-quality changes are adopted on evidence, not vibes.
What is now different:
Nit findings no longer crowd out real findings: they consolidate into a capped fold on the sticky (still counted, still in code-review.json), with review.nitsInline / nits-inline / ARGUS_NITS_INLINE as the opt-back-in. The comment cap can no longer let 14 low-value comments bury 2 real ones.
Two deterministic rules (dep-diff, missing-test) flag supply-chain and coverage gaps the model lane structurally ignores — eval-measured before adoption.
scripts/review-eval.mjs replays corpus entries (Argus dogfood PRs, AACR-Bench labeled PRs, six sibling repos weekly) through the production code-review path in temp worktrees, with precision/recall against labeled issues, stall/skip health, and run-compare deltas.
The dogfood action pin moves to v0.4.2 — the stale October pin was the actual root cause of the ~20-comment average: it predated the default exclude set.
Eval evidence (4-PR Argus corpus replay): pr126 2→4 comments, pr59 14→20 (cap engaged), noise class visible per-entry. AACR-Bench labeled replay showed model precision ~1.00 on 5/8 entries — the gap is recall (missed Java findings), so the reflection pass stays deferred per the plan's adopt-only-if-it-moves-the-number gate.
Review-hardening layer (11-reviewer pass over this branch): model-controlled text in folds now goes through sanitizeCommentText (links/mentions/</details> escape), corpus entries run under ARGUS_UNTRUSTED (fetched trees can never exec configs beside secrets), remote corpus SHAs must be full 40-hex, and skip-vs-clean is now distinguishable in every eval surface.
npm run typecheck / lint / build / check:parity — green
1,436 unit tests (90 files) — green, including new fold/rule/eval-harness coverage and golden pins
AACR-Bench + dogfood corpus replays executed through the production review path
Weekly dogfood-corpus workflow — first scheduled/dispatch run post-merge
Unapplied review findings
Recorded for follow-up (11-reviewer pass; several are pre-existing or eval-gated, not regressions):
cmdCodeReview remains a ~1,150-line function (pre-existing); extract runRulesLane/buildCodeReviewReport/resolveReviewDiff as a separate refactor.
buildScanMessages restates the findings-message contract inline — a shared FINDINGS_CONTRACT is deferred because prompt wording changes need eval evidence, not just dedup.
scanRepo buffers every walked file whole (pre-existing perf item, plan-listed candidate) and --no-index diffs untracked files serially (pre-existing).
a0-plugin-argus/helpers/argus.py comment grammar predates inline sentinels/KTD4 dedup — port at the next deliberate pin bump (downstream precondition).
dep-diff bare-mode edges: non-spec values (^2, latest, catalog:) miss; spec-shaped values deep in unlabeled non-dep blocks can still false-positive — tighten only after AACR measurement.
Path classification converged cheaply (*.generated.*, go.sum, npm-shrinkwrap); a single shared pathKind() in scope.ts remains the real fix for the four drifting classifiers.
4931-line cli.ts becomes a 117-line entrypoint (main, dispatch, script
guard, public re-exports) plus 12 modules under src/cli/: shared.ts
(ctx/deps/plumbing), review-shared.ts (review machinery + public types),
and one module per command. Zero behavior change — all public imports
from src/cli.js preserved via re-exports; no-emoji test allow-lists
retargeted to the new paths.
Generated by scripted statement-boundary split (mask-aware tokenizer for
comments/strings/templates/regex literals); verified: typecheck 0
errors, lint clean, build emits dist/cli/, 1409 tests pass.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…elegates to src/
The action's comment posting layer hand-copied ~30 symbols from
src/report/{comment,viewmodel}.ts and src/review/inline.ts — drift-prone
manual parity guarded only by contract tests. Now:
- action/parity-entry.mjs lists the shared leaf set
- npm run build:parity bundles it to action/parity.cjs (esbuild, node20 cjs)
- sticky-comment.cjs destructures the bundle; local copies deleted
- npm run check:parity regenerates + diffs — wired into CI after check:dist
- cell/code/bestFindingProof exported from comment.ts to feed the bundle
sticky-comment.cjs 1690 -> 1533 lines; every contract-pinned leaf
(dedup keys, body parsing, verdict math, glyphs) is now generated, so
divergence is structurally impossible. 160 contract/golden tests green.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…d extractUsageCost
Knip + codebase-memory graph cross-check found every flagged src/ export
had zero external importers — most were export-by-default rather than
deliberate surface. Demoted to module-internal across 45 files; deleted:
- contracts.ts re-exports of LANE_IDS/LaneId (consumers use manifest.js)
- pr.ts re-export of PrBodyInput + decisions.ts re-export of ProviderValue
- extractUsageCost in cost.ts (zero callers anywhere)
Public surface untouched: api.js exports and cli.ts re-exports unchanged.
app/worker findings excluded (sub-project knip can't resolve).
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…dist/
Measured baseline for the polish work: comment volume tracks diff size at
0.59 correlation, nit share runs 56-100% on recent PRs, dist/ gets
reviewed (no ignore list), and zero-comment PRs coincide with the
deepseek-stall window — silence is currently indistinguishable from clean.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
scripts/review-eval.mjs replays corpus entries (repo/base/head/labels)
via code-review --base in a temp worktree, reads code-review.json, and
emits per-entry metrics (findings/comments/severity/path-type/drops/
precision+recall when labels exist) plus a run file under
docs/audits/eval/. compare prints per-metric deltas between runs — the
adopt/reject gate for U3+ polish changes.
Corpus seeds with 4 own PRs spanning the noise spectrum (52-comment worst
case to docs-only). metricsFromReport unit-tested.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
….4.2
review.nitsInline (default false) keeps nit findings out of inline review
comments — they consolidate into a capped <details> fold on the sticky
instead, where findingsLine already counts them. Opt back in with
review.nitsInline: true. Mirrored in TS (comment.ts nitsFold) and the
action renderer (sticky-comment.cjs nitsFold), goldens regenerated.
The corpus audit found most observed noise traced to a stale action pin
(119cacd, Oct 1 — predates DEFAULT_REVIEW_EXCLUDE and the evidence-footer
fix). Both the action uses: and trusted-argus checkout ref now pin to
v0.4.2 (bc462fa); the contract test enforces they match.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
The TS head renderer is byte-locked to the action's first screen (parity
contract), so the consolidated nit fold belongs only in the CJS folds
section - rendering it in head() broke the golden parity test. Removed
the TS-side nitsFold; the fold lives in sticky-comment.cjs.
Eval harness: stalled column in run/compare tables driven by
exitCode/missing report - report.ok is the verdict flag (needs_changes
reads false), not health. Recorded post-U3 replay of the 4-entry corpus:
nit consolidation visible on pr126 (6 findings, 4 comments), comment cap
on pr59 (36 findings, 20 comments). pr173 stalled on a deepseek timeout -
model flake, the exact failure class the stalled column exists to expose.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- scripts/aacr-corpus.mjs converts the Apache-2.0 benchmark into eval
corpus entries: base = dataset pr_source_commit (base tip at capture),
head resolved live via gh api pulls/<n> .head.sha; entries whose head
cannot resolve are dropped rather than replaying target-branch drift.
- review-eval.mjs: URL repos init + SHA-fetch into a cache dir, deepen
per-SHA until merge-base exists (separate fetches - a multi-SHA deepen
raced .git/shadow rewrites), stalled = exit!=0 or missing report
(never report.ok, which is the verdict flag), per-entry reports kept
under docs/audits/eval/reports/.
- 10-PR labeled baseline: precision 1.00 on 5/8 completed entries; the
gap is recall - both Java elasticsearch PRs scored 0/0 on real diffs
with correctly-anchored labels.
…l-gated
Two rules that flag real events, not opinions, at nit severity so they
fold into the U3 consolidated section instead of adding inline noise:
- dep-diff: new deps and major version jumps in package.json. Tracks
deps-block membership on raw hunk lines; mid-block adds without a
visible opener still flag when the value is a version spec (real
failure: esbuild landed outside the +-3-line context window and was
missed until the spec gate). Minor/patch bumps are audit-records only.
- missing-test: one file-level nit on the highest-churn source file when
a diff changes code but touches no test path - an evidence ask, not a
mandate. Excludes test/script/data/generated paths.
Measured on the u5-dep-bump corpus entry (87c8a39 replay): both rules
fired - 2 rule findings, dep flagged, missing-test nit on
action/parity-entry.mjs.
scripts/eval-corpus.dogfood.json holds one merged PR per repo
(orchestral, wisp, kurultai, OmaSeal, dayflow-linux, omarchy-plugins;
all public, unauthenticated fetch). The dogfood-corpus workflow runs the
eval harness from the checked-out default branch every Monday, so each
run measures the current review code with no action pin to drift -
the stale-pin lesson from the U3 audit applied to the harness itself.
Per-repo tallies land in the step summary; run JSON + per-entry reports
upload as artifacts for corpus curation (entries whose findings look
wrong graduate into eval-corpus.argus.json as regression fixtures).
Living comparison of Argus against CodeRabbit, Alibaba open-code-review,
TestDriver, PR-Agent, Greptile, cubic and Copilot review on the axes
that decide the roadmap: executes code, evidence artifacts, hosting,
cost model, trust boundary. Includes the adoption ledger pattern -
each borrowed mechanism lands only behind an eval-harness measurement.
…corpus validation
Code review of the polish-and-scale batch converged on real fixes:
- sanitizeCommentText shared via parity bundle; nit/findings folds now
defuse ]( links, @mentions, and </details> escapes (was the only
surface rendering model-controlled nit text).
- COLLAPSE_ORDER learned 'nits' so the lowest-value fold collapses
under the comment budget instead of staying expanded.
- review-eval: ARGUS_UNTRUSTED=1 on corpus children (fetched trees must
never exec configs beside secrets), remote entries require 40-hex
SHAs, leading-dash rejection, skipped reviews surface as 'skipped'
and count in the all-stall tally gate, incremental flush, fetch
timeouts, worktree prune, -dirty provenance + per-entry model,
tag-scoped kept reports, tag sanitization.
- ARGUS_NITS_INLINE env + nits-inline action input restore operator
override on untrusted lanes; nit fold renders only on serialized
nitsInline:false (no double-render on version-skew reports).
- rulesLaneScans shares the secretsScan skipped-reason chain between
code-review and scan; dep-diff tracks per-hunk block state and
rejects engines/tooling keys in bare mode; generated-path classifiers
converge on *.generated.*/go.sum/npm-shrinkwrap.
- aacr-corpus: strict canonical PR URL parsing (look-alike hosts and
http dropped), pr_target_commit never carried, resolveHead required.
- dogfood corpus: full 40-hex SHAs; workflow gets runner labels,
concurrency, 120min budget.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
AACR-Bench's pr_target_commit being target-branch drift (not PR head)
cost a real debug cycle; the verification rule generalizes to any
external dataset whose "commit" fields anchor replays. CONCEPTS.md
gains replay corpus entry, stalled entry, and drift commit.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This PR contains 122 files, which is 22 over the limit of 100.
To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.
Upgrade to a paid plan to raise the limit.
This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 8cf4c171-42de-457b-97e8-e5c0d96d60e3
📥 Commits
Reviewing files that changed from the base of the PR and between 1e499dd and d9f4ab1.
⛔ Files ignored due to path filters (97)
dist/cli.d.ts is excluded by !**/dist/**, !**/dist/**
dist/cli.js is excluded by !**/dist/**, !**/dist/**
dist/cli/cache.d.ts is excluded by !**/dist/**, !**/dist/**
dist/cli/cache.js is excluded by !**/dist/**, !**/dist/**
dist/cli/code-review.d.ts is excluded by !**/dist/**, !**/dist/**
dist/cli/code-review.js is excluded by !**/dist/**, !**/dist/**
dist/cli/delegate.d.ts is excluded by !**/dist/**, !**/dist/**
dist/cli/delegate.js is excluded by !**/dist/**, !**/dist/**
dist/cli/index.d.ts is excluded by !**/dist/**, !**/dist/**
dist/cli/index.js is excluded by !**/dist/**, !**/dist/**
dist/cli/init.d.ts is excluded by !**/dist/**, !**/dist/**
dist/cli/init.js is excluded by !**/dist/**, !**/dist/**
dist/cli/mention.d.ts is excluded by !**/dist/**, !**/dist/**
dist/cli/mention.js is excluded by !**/dist/**, !**/dist/**
dist/cli/record.d.ts is excluded by !**/dist/**, !**/dist/**
dist/cli/record.js is excluded by !**/dist/**, !**/dist/**
dist/cli/review-shared.d.ts is excluded by !**/dist/**, !**/dist/**
dist/cli/review-shared.js is excluded by !**/dist/**, !**/dist/**
dist/cli/run.d.ts is excluded by !**/dist/**, !**/dist/**
dist/cli/run.js is excluded by !**/dist/**, !**/dist/**
dist/cli/scan.d.ts is excluded by !**/dist/**, !**/dist/**
dist/cli/scan.js is excluded by !**/dist/**, !**/dist/**
dist/cli/shared.d.ts is excluded by !**/dist/**, !**/dist/**
dist/cli/shared.js is excluded by !**/dist/**, !**/dist/**
dist/cli/verify.d.ts is excluded by !**/dist/**, !**/dist/**
dist/cli/verify.js is excluded by !**/dist/**, !**/dist/**
dist/config.d.ts is excluded by !**/dist/**, !**/dist/**
dist/config.js is excluded by !**/dist/**, !**/dist/**
dist/detect.d.ts is excluded by !**/dist/**, !**/dist/**
dist/detect.js is excluded by !**/dist/**, !**/dist/**
dist/driver/browser.d.ts is excluded by !**/dist/**, !**/dist/**
dist/driver/browser.js is excluded by !**/dist/**, !**/dist/**
dist/engine/explore.d.ts is excluded by !**/dist/**, !**/dist/**
dist/engine/loop.d.ts is excluded by !**/dist/**, !**/dist/**
dist/engine/loop.js is excluded by !**/dist/**, !**/dist/**
dist/evidence/ci.d.ts is excluded by !**/dist/**, !**/dist/**
dist/evidence/ci.js is excluded by !**/dist/**, !**/dist/**
dist/evidence/link.d.ts is excluded by !**/dist/**, !**/dist/**
dist/executor/a0.d.ts is excluded by !**/dist/**, !**/dist/**
dist/executor/sandbox.d.ts is excluded by !**/dist/**, !**/dist/**
dist/executor/sandbox.js is excluded by !**/dist/**, !**/dist/**
dist/flow/writeback.d.ts is excluded by !**/dist/**, !**/dist/**
dist/github/apply-fixes.d.ts is excluded by !**/dist/**, !**/dist/**
dist/github/apply-fixes.js is excluded by !**/dist/**, !**/dist/**
dist/github/write-pr.d.ts is excluded by !**/dist/**, !**/dist/**
dist/index/scan.d.ts is excluded by !**/dist/**, !**/dist/**
dist/index/scan.js is excluded by !**/dist/**, !**/dist/**
dist/journal/schema.d.ts is excluded by !**/dist/**, !**/dist/**
dist/mention.d.ts is excluded by !**/dist/**, !**/dist/**
dist/onboarding/pr-content.d.ts is excluded by !**/dist/**, !**/dist/**
dist/onboarding/pr.d.ts is excluded by !**/dist/**, !**/dist/**
dist/onboarding/pr.js is excluded by !**/dist/**, !**/dist/**
dist/onboarding/scaffold.d.ts is excluded by !**/dist/**, !**/dist/**
dist/onboarding/scaffold.js is excluded by !**/dist/**, !**/dist/**
dist/pipeline/app.d.ts is excluded by !**/dist/**, !**/dist/**
dist/pipeline/app.js is excluded by !**/dist/**, !**/dist/**
dist/pipeline/contracts.d.ts is excluded by !**/dist/**, !**/dist/**
dist/pipeline/contracts.js is excluded by !**/dist/**, !**/dist/**
dist/pipeline/verify.d.ts is excluded by !**/dist/**, !**/dist/**
dist/pipeline/verify.js is excluded by !**/dist/**, !**/dist/**
dist/probe/author.d.ts is excluded by !**/dist/**, !**/dist/**
dist/probe/author.js is excluded by !**/dist/**, !**/dist/**
dist/probe/generate.d.ts is excluded by !**/dist/**, !**/dist/**
dist/probe/generate.js is excluded by !**/dist/**, !**/dist/**
dist/probe/queue.d.ts is excluded by !**/dist/**, !**/dist/**
dist/report/comment.d.ts is excluded by !**/dist/**, !**/dist/**
dist/report/comment.js is excluded by !**/dist/**, !**/dist/**
dist/report/html.d.ts is excluded by !**/dist/**, !**/dist/**
dist/report/html.js is excluded by !**/dist/**, !**/dist/**
dist/report/manifest.d.ts is excluded by !**/dist/**, !**/dist/**
dist/report/manifest.js is excluded by !**/dist/**, !**/dist/**
dist/report/run.d.ts is excluded by !**/dist/**, !**/dist/**
dist/report/scan.d.ts is excluded by !**/dist/**, !**/dist/**
dist/review/adjudicate.d.ts is excluded by !**/dist/**, !**/dist/**
dist/review/chunks.d.ts is excluded by !**/dist/**, !**/dist/**
dist/review/chunks.js is excluded by !**/dist/**, !**/dist/**
dist/review/difftext.d.ts is excluded by !**/dist/**, !**/dist/**
dist/review/difftext.js is excluded by !**/dist/**, !**/dist/**
dist/review/inline.d.ts is excluded by !**/dist/**, !**/dist/**
dist/review/inline.js is excluded by !**/dist/**, !**/dist/**
dist/review/rules.d.ts is excluded by !**/dist/**, !**/dist/**
dist/review/rules.js is excluded by !**/dist/**, !**/dist/**
dist/review/secrets.d.ts is excluded by !**/dist/**, !**/dist/**
dist/review/secrets.js is excluded by !**/dist/**, !**/dist/**
dist/review/triage.d.ts is excluded by !**/dist/**, !**/dist/**
dist/review/triage.js is excluded by !**/dist/**, !**/dist/**
dist/review/validate.d.ts is excluded by !**/dist/**, !**/dist/**
dist/review/validate.js is excluded by !**/dist/**, !**/dist/**
dist/ui/errors.d.ts is excluded by !**/dist/**, !**/dist/**
dist/ui/errors.js is excluded by !**/dist/**, !**/dist/**
dist/ui/summary.d.ts is excluded by !**/dist/**, !**/dist/**
dist/ui/summary.js is excluded by !**/dist/**, !**/dist/**
dist/vision/cost.d.ts is excluded by !**/dist/**, !**/dist/**
dist/vision/cost.js is excluded by !**/dist/**, !**/dist/**
dist/vision/decisions.d.ts is excluded by !**/dist/**, !**/dist/**
dist/vision/openrouter.d.ts is excluded by !**/dist/**, !**/dist/**
package-lock.json is excluded by !**/package-lock.json
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approved. This is a large review-pipeline, action, and workflow change that exceeds the medium approval threshold; Cursor Bugbot was not present after the first poll, and human review is needed. No reviewers were assigned.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Reviewed 90 of 217 changed files (127 excluded by review.exclude). Reviewed all 19 chunks (90 of 90 files). The changes introduce significant updates to the Argus reviewer, including new features, doc
Reviewed 90 of 217 changed files (127 excluded by review.exclude). Reviewed all 19 chunks (90 of 90 files). The changes introduce significant updates to the Argus reviewer, including new features, documentation improvements, and CI/CD pipeline enhancements. Key areas addressed include the handling of nits, improved documentation for concepts and contributions, and refinements to the review evaluation process. Several minor nits and convention issues were identified and should be addressed for better maintainability and clarity. There are also a few correctness and security concerns that need to be resolved. 3 finding(s) dropped: anchored outside the reviewed diff.
Severity
Proof
p
Category
Location
Finding
◈ risk
▰▱▱▱ suspected
0.63
convention
docs/audits/2026-10-07-review-corpus-audit.md:32
L32: 🟡 risk: 54 comments on dist/ indicate generated build output is being reviewed. Configure default ignore patterns for generated files to prevent this.
◆ bug
▰▱▱▱ suspected
0.70
correctness
docs/audits/2026-10-07-review-corpus-audit.md:36
L36: 🔴 bug: Hallucinated suggestion for os.constants.TMPDIR on PR #136. The suggestion referenced a nonexistent constant, which the reflection pass should catch.
◆ bug
▰▱▱▱ suspected
0.78
correctness
scripts/review-eval.mjs:308
L308: 🔴 bug: entry.name is not validated for file system safe characters, potentially allowing directory traversal when constructing the keptReport path. Sanitize the name before joining.
◈ risk
▰▱▱▱ suspected
0.69
security
scripts/review-eval.mjs:197
L197: 🟡 risk: repo argument to resolveRepo is not validated for malicious input, potentially allowing command injection if a user provides a malicious path like `-v --mount=type=bind,src=/path,ds
◆ bug
▰▱▱▱ suspected
0.60
correctness
src/cli/mention.ts:138
L138: 🔴 bug: usageError is used for non-usage errors. Use ctx.err and return appropriate exit code instead.
◆ bug
▰▱▱▱ suspected
0.63
correctness
src/cli/mention.ts:167
L167: 🔴 bug: repo or token could be undefined, but fetchPrMeta is called unconditionally. Add checks.
◆ bug
▰▱▱▱ suspected
0.67
correctness
src/cli/mention.ts:217
L217: 🔴 bug: repo or token could be undefined, but postIssueComment is called. Add checks.
◆ bug
▰▱▱▱ suspected
0.62
correctness
src/cli/record.ts:67
L67: 🔴 bug: usageError is used for non-usage errors. Use ctx.err and return appropriate exit code instead.
◆ bug
▰▱▱▱ suspected
0.63
correctness
src/cli/record.ts:92
L92: 🔴 bug: usageError is used for non-usage errors. Use ctx.err and return appropriate exit code instead.
◆ bug
▰▱▱▱ suspected
0.73
correctness
src/cli/record.ts:151
L151: 🔴 bug: writeFile can throw an error, but it's not handled. Add try-catch.
◆ bug
▰▱▱▱ suspected
0.73
correctness
src/cli/record.ts:156
L156: 🔴 bug: writeFile can throw an error, but it's not handled. Add try-catch.
◆ bug
▰▱▱▱ suspected
0.69
correctness
src/cli/run.ts:548
L548: 🔴 bug: writebackHealsToPr might fail if wbPr is undefined and fetchPrMeta returns null. Add a check for wbPr before calling writebackHealsToPr or handle the case where wbBase remain
◈ risk
▰▱▱▱ suspected
0.52
correctness
src/cli/run.ts:536
L536: 🟡 risk: fetchPrMeta is called with potentially undefined wbPr if wbTrace?.pr is undefined and trustResult.pr is also undefined. This could lead to an unnecessary network call or error i
○ nit
▰▱▱▱ suspected
0.45
convention
action/sticky-comment.cjs:13
L13: 🔵 nit: Duplicate code from src/report/comment.ts is bundled into action/sticky-comment.cjs. While tests guard behavior, manual sync is error-prone. Consider generating CJS via esbuild from src/
L71: 🔵 nit: The audit notes that action/sticky-comment.cjs is a hand-maintained CJS reimplementation of src/report/comment.ts and parts of src/review/inline.ts. While tests guard behavior, this
○ nit
▰▱▱▱ suspected
0.27
convention
docs/audits/2026-10-07-review-corpus-audit.md:28
L28: 🔵 nit: Boilerplate footer *CI evidence: no repo index — run argus-reviewer index first* appended to every nit doubles visual weight. Footer belongs on the sticky summary once, not per-finding.
◈ risk
▰▱▱▱ suspected
0.27
usability
docs/audits/2026-10-07-review-corpus-audit.md:40
L40: 🟡 risk: Three recent zero-comment PRs during the deepseek stall window are indistinguishable from 'clean' PRs. This ambiguity can mislead readers about the review status.
○ nit
▰▱▱▱ suspected
0.26
convention
.github/workflows/argus-reviewer.yml:53
L53: 🔵 nit: workflow pin should point to a tag, not a commit sha. Use actions/checkout@v4 and reference tags.
○ nit
▰▱▱▱ suspected
0.29
convention
.github/workflows/argus-reviewer.yml:70
L70: 🔵 nit: workflow pin should point to a tag, not a commit sha. Use duketopceo/Argus/action@v0.4.2 and reference tags.
○ nit
▰▱▱▱ suspected
0.26
convention
.github/workflows/ci.yml:40
L40: 🔵 nit: add check for generated parity.cjs bundle. Run npm run check:parity.
○ nit
▰▱▱▱ suspected
0.28
convention
AGENTS.md:37
L37: 🔵 nit: document the parity check for action/parity.cjs. Run npm run build:parity and commit it.
○ nit
▰▱▱▱ suspected
0.24
convention
AGENTS.md:41
L41: 🔵 nit: document the two distinct eval surfaces. evals/ is judge-scored, scripts/review-eval.mjs is corpus-replay.
○ nit
▰▱▱▱ suspected
0.25
convention
AGENTS.md:46
L46: 🔵 nit: document what a "drift commit" is and why it's problematic for corpus builders.
○ nit
▰▱▱▱ suspected
0.25
convention
CONCEPTS.md:41
L41: 🔵 nit: define "Replay corpus entry" and clarify its distinction from the judge-scored corpus.
○ nit
▰▱▱▱ suspected
0.26
convention
CONCEPTS.md:46
L46: 🔵 nit: define "Stalled entry" and differentiate it from a clean-exit skip.
73 more findings in code-review.json
78 inline comments not posted: review.maxComments cap 20.
The v0.4.2 dogfood lane on PR #174 flagged that probe-authored content
reading process.env.AUTH_TOKEN / PASSWD slipped the secrets gate (the
API_KEY part of the finding was a false positive — \w*KEY already hit).
Widening the alternation is the safe direction for a gate that only
marks probe content as needing secret env.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Argus self-review triage (v0.4.2 lane on a9c63f2, 50 findings → 19 threads, all resolved):
Fixed (1):SECRET_ENV_RE missed AUTH*/PASSWD env reads in probe content → widened in 5dabefe. (The API_KEY part of the finding was a false positive — \w*KEY already matched.)
False positives (3):verify.ts keep-alive does pass --url; sticky-comment.cjsbestFindingProof/shortHash are live parity-bundle exports (contract tests green); scan.tstotalBytes is an approximate cap by design — JS has no torn writes, and exact accounting would serialize the 64-way reader.
N/A (2): two docs/audits findings are the reviewer flagging the audit doc's own documented follow-ups as code bugs.
Nit noise (rest): the 44 nits posted inline are exactly the class this PR's nitsInline fold consolidates — the lane runs the pinned v0.4.2 release, which predates the fold.
New head 5dabefe will re-run the lane; a needs_changes verdict there only stands up if new blocking-severity findings anchor.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approved. This is a large review-pipeline, action, and workflow change that exceeds the medium approval threshold; Cursor Bugbot was not present after the first poll, and human review is needed. No reviewers were assigned.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The v0.4.2 lane on #174 produced 3 findings against third-party code
embedded in docs/audits/eval/reports/*.json — captured AACR-Bench and
dogfood snapshots are data, not reviewable source. review.exclude
replaces DEFAULT_REVIEW_EXCLUDE, so the config restates the defaults
plus docs/audits/eval/**.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Round-2 triage (re-review on 5dabefe, 14 findings, all resolved):
Fixed root class: the 3 findings flagging third-party code inside docs/audits/eval/reports/*.json (captured AACR-Bench snapshots) → review.exclude now covers docs/audits/eval/** in d9f4ab1. The post-u3.json stall flag was eval data working as designed.
Already fixed: the SECRET_ENV_RE flag re-anchored the - side of the 5dabefe hunk — the widened regex is on this head.
By design:aacr-corpus.mjs will not fall back to pr_target_commit — that field is the target-branch drift tip, not the PR head (see docs/solutions/developer-experience/dataset-commit-fields-verify-against-live-api.md); using it produces wrong diffs. Transient gh api failures already retry once.
False positives:sticky-comment.cjs parity exports (contract tests green), check-parity.mjs stderr inherit (execFileSync throwing is the gate working), shared.ts usage-string/lazy-client anchors, run.ts writeback (PR write-back throwing fails loud; local path is the no-PR-config branch, not a fallback).
Nits (2): folded class — non-blocking.
New head d9f4ab1 re-runs the lane with the data files out of scope.
The reason will be displayed to describe this comment to others. Learn more.
Risk: high. Not approved. This is a large review-pipeline, action, and workflow change that exceeds the medium approval threshold; Cursor Bugbot was not present after the first poll, and human review is needed. No reviewers were assigned.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Round-3 triage (re-review on d9f4ab1, 98 findings — 84 nits inline, 14 blocking-severity, all resolved):
Zero code changes warranted. All 14 blocking findings were false positives (entry.name flows through the charset-stripping slug(), repo resolves to absolute paths or URLs — no - reaches git argv; wbPr is triple-guarded before fetchPrMeta), by-design (aacr-corpus won't fall back to the drift-tip pr_target_commit), pre-existing CLI conventions (usageError, writeback semantics), or doc prose flagged as code.
The real story is reviewer variance. Same v0.4.2 lane, same-size diff: 50 → 14 → 98 findings across three heads. The lane runs the pinned release (nitsInline absent in its report — the fold shipped on this branch). On a 121-file diff the pre-fold model will reliably anchor some bug-severity finding, so argus-reviewer stays red until the action pin bumps to a release carrying this branch's fold + precision work.
Conclusion: the red argus-reviewer status is expected pre-release noise — it is advisory, not a gate this branch can satisfy. Whether to merge over it (or hold for a release + pin bump) is the human call.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Summary
Review polish and scale: PR reviews are now measurably less noisy and measurably less silent — nits consolidate into the sticky, deterministic rules cover what models miss, and an offline corpus harness replays real PRs so review-quality changes are adopted on evidence, not vibes.
What is now different:
code-review.json), withreview.nitsInline/nits-inline/ARGUS_NITS_INLINEas the opt-back-in. The comment cap can no longer let 14 low-value comments bury 2 real ones.dep-diff,missing-test) flag supply-chain and coverage gaps the model lane structurally ignores — eval-measured before adoption.scripts/review-eval.mjsreplays corpus entries (Argus dogfood PRs, AACR-Bench labeled PRs, six sibling repos weekly) through the productioncode-reviewpath in temp worktrees, with precision/recall against labeled issues, stall/skip health, and run-compare deltas.v0.4.2— the stale October pin was the actual root cause of the ~20-comment average: it predated the default exclude set.Eval evidence (4-PR Argus corpus replay): pr126 2→4 comments, pr59 14→20 (cap engaged), noise class visible per-entry. AACR-Bench labeled replay showed model precision ~1.00 on 5/8 entries — the gap is recall (missed Java findings), so the reflection pass stays deferred per the plan's adopt-only-if-it-moves-the-number gate.
Review-hardening layer (11-reviewer pass over this branch): model-controlled text in folds now goes through
sanitizeCommentText(links/mentions/</details>escape), corpus entries run underARGUS_UNTRUSTED(fetched trees can never exec configs beside secrets), remote corpus SHAs must be full 40-hex, and skip-vs-clean is now distinguishable in every eval surface.Plan:
docs/plans/2026-10-07-1900-feat-review-polish-scale-plan.md(U1-U7; U4b eval-deferred).Test plan
npm run typecheck/lint/build/check:parity— greendogfood-corpusworkflow — first scheduled/dispatch run post-mergeUnapplied review findings
Recorded for follow-up (11-reviewer pass; several are pre-existing or eval-gated, not regressions):
cmdCodeReviewremains a ~1,150-line function (pre-existing); extractrunRulesLane/buildCodeReviewReport/resolveReviewDiffas a separate refactor.buildScanMessagesrestates the findings-message contract inline — a sharedFINDINGS_CONTRACTis deferred because prompt wording changes need eval evidence, not just dedup.scanRepobuffers every walked file whole (pre-existing perf item, plan-listed candidate) and--no-indexdiffs untracked files serially (pre-existing).a0-plugin-argus/helpers/argus.pycomment grammar predates inline sentinels/KTD4 dedup — port at the next deliberate pin bump (downstream precondition).^2,latest,catalog:) miss; spec-shaped values deep in unlabeled non-dep blocks can still false-positive — tighten only after AACR measurement.*.generated.*,go.sum,npm-shrinkwrap); a single sharedpathKind()inscope.tsremains the real fix for the four drifting classifiers.resolveRepo/ensureSha/tallypaths, hostile-message fold text, skipped-render coverage,ARGUS_UNTRUSTEDpinning.OPENROUTER_API_KEYsecret is the dedicated capped eval key; verify action pinbc462fastays reachable post-merge.Generated with Devin