Review & sign-off
Reviewed by rules, then signed off by a person.
Quality checks that never tire, an AI review with tiered findings, and a sign-off with a name on it.
Quality checks
Rules first. They never tire.
Tests, your own CI, secret scan, static analysis, dependency, architecture policy and change budget run on every change before a person sees it. A change that deletes, skips or weakens a test fails, whatever else is green. One check run on the pull request mirrors every verdict.
A check that fails goes straight back to the fixer with its report. A person is asked only once everything a machine can check has passed.
In the product:quality check → Deterministic Gatechange budget → Size Budgetsign-off → Reviewing Gateaudit trail → Evidence Bundle
AI review
A review whose findings are already sorted.
Findings are tiered — act on, consider, noted, dismissed — anchored to file and line with the rule cited, and only the act-on tier sends the change back. Three rounds at most; then once more on a stronger model; then a person is asked. A high-risk change is reviewed by a different model than wrote it. REVIEW.md in your repository is the reviewer’s rules. A reviewer whose findings keep getting dismissed loses the runs it was trusted with.
- Dismissedrecorded, with the reason
- Notedin the audit trail, nothing to do
- Considera finding a person weighs
- Act onthe only tier that sends the change back
Sign-off
Approval has a name on it.
You are asked once per change, after every machine check has passed, with one audit trail in front of you. Sign-off happens where your team already is, and every rule that makes it worth something is on by default.
- Approve or request changes, in Slack
A sign-off reaches Slack with Approve and Request changes, and the approval names the person who clicked.
- The approver is never the author
Organisation and project roles decide who may approve, and nobody approves their own change.
- Two approvals cannot both win
Compare-and-set: a sign-off is cleared once, by one person.
- Open threads hold it
A sign-off refuses while any review thread on the plan is open, and only a person resolves one.
- It asks before it guesses
An agent that needs an answer stops and asks, in Slack or on the plan.
- It can say it is blocked
An agent that cannot do the work as specified says so, with reasons, rather than wearing the tests down. A person re-scopes or unblocks it.
Every finding has a name, a line and an owner.
The review is posted under the app’s own identity, anchored to file and line. Approval and merge belong to a person — with the plan, the checks, the approvals and the spend in front of them.
How much review a change gets follows its change risk — computed from recorded signals, never set in a settings screen; a missing signal raises it; a change can be sent back a stage, against a budget; and an automation runs with fewer sign-offs only after its own record has earned them.
Put one pull request through both reviews.
The checks, the findings and the sign-off arrive on the pull request. A person merges.