* style(ai-review): use double hyphens instead of em dashes
* fix(ai-review): size token budget for thinking models
Opus 5 and later think by default and `max_tokens` covers thinking plus
response text, so the 4000-token budget left the reviewer's JSON empty or
truncated. Raise it to 16k and cap thinking depth with `output_config.effort`,
gated to the models that accept it.
* fix(ai-review): report unusable reviewer output
A reviewer that answered with unparseable JSON resolved successfully, so the
run posted a two-model review that one model contributed nothing to. Flag it
on the PR comment, log the stop reason and raw response, and fall back to the
unmerged reviewer issues when synthesis itself is unusable.
* chore(ai-review): lower job timeout to 10 minutes
* feat(ci): add dual-model AI review orchestrator
Fetches the PR diff, runs Claude Sonnet 4.6 and GPT-5.3-Codex in
parallel, merges both reviews with Haiku 4.5 and posts the result
as an inline PR review. Dependency-free, Node 20+. Supports DRY_RUN=1.
* feat(ci): add ai-review tuning config
Calibration threshold (minor), ignore globs for lockfiles and
Payload-generated artifacts, AGENTS.md as review guidelines.
* ci: add /ai-review comment-triggered workflow
Collaborator-gated, review-only pilot. Before first use: add
ANTHROPIC_API_KEY and OPENAI_API_KEY repo secrets; triggers only
once merged to the default branch (develop).
* chore(ci): update ai-review models and pricing
Use claude-opus-4-8 / gpt-5.4; add their $/MTok prices and warn on models with no configured price so their cost is not silently counted as $0.
* feat(ci): guide reviewers on dependency versions
Tell reviewers not to flag or downgrade dependency versions newer than their knowledge cutoff, while still checking cross-package version coherence.
* feat(ci): gather AGENTS.md guidelines per touched dir
Prefer AGENTS.md as the guideline source and collect the root file plus any AGENTS.md in a directory the diff touches, instead of only the first match.
* feat(ci): add SKIP_GUIDELINES env var
When SKIP_GUIDELINES is truthy, run reviewers without loading any guideline files.
* style(ci): reflow codexReview fetch call
* fix(ci): run ai-review from default branch, not PR head
Checking out the PR head SHA ran the PR author's review.mjs and config
with the job's write token and secrets. Check out the default branch
instead; the diff is fetched via the GitHub API by PR number, so PR
changes are still reviewed while reviewer code/config stay trusted.
* chore(ci): drop unavailable /ai-review --fix prompt
The auto-fix feature is not implemented; remove its mention from the
posted review body and the workflow header.
* chore(ci): update ai models used for ai-review worflow
* fix(ci): skip traversal paths when collecting AGENTS.md
PR filenames are untrusted; ignore absolute paths and .. segments.
* docs(ci): document ai-review config replace semantics
Config keys fully replace defaults, lists are not merged; restate the
default ignore patterns in the pilot config so none are lost.
* fix(ci): surface unreviewable files, pack past over-budget ones
Track files GitHub returns without a patch and files over the token
budget; warn on the PR instead of dropping them silently. Use continue,
not break, so small files after a large one still get reviewed.
* fix(ci): sanitize inline comment line anchors
Anchor inline comments only on valid line numbers and list the rest in
the summary body; one bad anchor rejected the whole review. Compute the
non-critical count directly.
* feat(ci): degrade gracefully when a review provider fails
Synthesize with the OpenAI reviewer model when Anthropic is down, fall
back to a local merge if synthesis itself fails, and note the failed
model in the PR comment.
* fix(ci): fail fast on missing env vars
Validate GITHUB_TOKEN, REPO, PR_NUMBER and at least one API key at
startup; a single missing key still degrades to one reviewer.
* fix(ci): unquote scalar config values
Quoted values like min_severity_to_post: 'minor' kept their quotes and
silently fell back to the major threshold.
* fix(ci): try direct JSON parse before brace extraction
Brace-slicing on prose-wrapped output could produce malformed JSON and
silently drop an entire review.
* chore(ci): log which guideline files are used
Warn explicitly when none of the configured files exist instead of
silently reviewing without guidelines.
* chore(ci): drop ineffective prompt caching
The system prompt is far below the minimum cacheable prefix and the
call is one-shot, so cache_control never did anything.
* fix(ci): detect truncated GitHub file listings
Compare the PR's changed_files count with the files API results (capped
at 3,000) and warn on the PR when files are unlisted.
* fix(ci): pack smallest files first, report only packed files
Smallest-first packing fits the most files into the token budget, and
the returned file list (used for guideline collection) now reflects
what the reviewers actually saw.
* fix(ci): anchor inline comments only to reviewed diff lines
One out-of-diff line anchor made GitHub reject the whole review. Parse
hunks per file and demote issues outside them to the summary body; the
fallback flat list now keeps line numbers and suggested fixes.
* fix(ci): neutralize @mentions in posted model output
Model text derives from untrusted PR content; a zero-width space after
@ stops crafted diffs from pinging arbitrary users or teams.
* style(ci): apply prettier formatting, prune redundant comments
* chore: add Notion evaluation template
Use the evaluation template for intake-created Notion pages and document the helper module.
* ci: authenticate build-time GitHub API calls
Pass the Actions GITHUB_TOKEN to the web build (via turbo passThroughEnv)
so RFP fetches in generateStaticParams() avoid the unauthenticated
60 req/hr limit that intermittently 403s and fails the static export.
- Remove pinned pnpm 10.9.0 from pnpm/action-setup so it honors
packageManager (pnpm@11.1.0) — fixes ERR_PNPM_BAD_PM_VERSION.
- Regenerate pnpm-lock.yaml to restore the vitest peer-dep snapshot
resolved against @types/node@25.6.0 (civi-crm) — fixes
ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY on Vercel.
- Add scripts/__tests__/repo-health.test.mjs guarding against both
classes of failure: workflow pnpm version must match packageManager,
and pnpm-lock.yaml must satisfy --frozen-lockfile.
- Wire pnpm test:repo-health into test:release as the first step.
JulesFILIOT