From a scope to an inspectable finding.
A review has a defined scope, a review kind and recorded results. See how the steps fit together and which evidence remains available.
Independent statements.
A statement belongs to exactly one unit and one review kind. A project review and a file review are different statements; neither is computed from the other, and an aggregate never substitutes for a review at another level.
- Projectsystem shape
- Moduleboundaries
- Namespacecohesion
- Fileimplementation
- Functionbehavior
Correctness, clarity, maintainability. Architecture is an aspect of project and module code reviews, not a fourth kind.
Deterministic sensor evidence combined with agent judgment in one statement. A review workflow of its own inside the same package: separate files, prompts, runs, and grades.
Its own sweep and its own sidecars. Reviewing performance never refreshes code or security metadata.
The repository owns its review truth.
Every reviewed unit gets one small JSON document per kind, stored in the same feature folder as the code — .quality/reviews/files/file.<hash>.review-meta.code.json. Diffable, portable, and versioned like any other artifact. History is ordinary Git history; the score trend is reconstructed from commits, not from a report database.
// abridged from a real sidecar in this repository
{
"schemaVersion": 3,
"kind": "code",
"reviewedAt": "2026-09-01T08:01:34Z",
"reviewedHash": { "value": "17a45eef…" },
"grade": { "score": 74, "band": "C" },
"findings": [ 3 items, with anchors ],
"reviewer": {
"agent": "codex",
"usage": { "inputTokens": 23711, … }
}
}Staleness is a computed view of an immutable statement. Scanning or browsing never rewrites a meta file; the content hash makes drift self-evident.
freshthe reviewed hash still matches the working tree.stalecode changed — the statement describes an older version.policyDrifta guideline changed after the statement was written.missingnot reviewed. Shown as absence, never as an F.Sweeps with caps and a ledger.
A run covers one scope and one kind. The browser never launches an agent process: the API queues the run, executes agent CLIs, and reports progress per file. Fresh units are skipped; a token or cost cap stops the sweep at the next operation boundary.
A free preflight renders the real prompts and predicts tokens and cost against the model catalog — labeled as an estimate, not a promise.
Agent CLIs execute per unit with routed models. Terminal states are named explicitly: done, failed, cancelled, capped.
Each completed unit writes its sidecar; the run writes a canonical snapshot under .quality/reports/runs/.
Model, tokens, duration, and run identity land in the sidecar and in an append-only monthly ledger under .quality/usage/.
Model routing follows the synchronized Token Economy catalogs: capability tiers, supported thinking levels, and retirement status. Current prices and scores live in the dated Token Economy benchmark matrix. Provider quota is read as a presentation-safe snapshot — an empty answer means unavailable, never unlimited.
Change reviews cover one transition.
Standing metadata answers how a unit scores until its inputs change. A change review answers a different question: what one integration transition changed in that standing evidence. quality diff computes the deterministic delta first — grade movement, new and resolved findings by fingerprint, staleness caused, boundary changes — and only then asks an agent to judge risk, test evidence, scope discipline, and architecture drift on the diff alone.
Committed transitions
Each reviewed transition is one artifact under .quality/changes/, keyed by its merge commit — or by the transition's head commit when the integration has a single parent. A pure file move is recorded with no quality delta.
Measured economy
Change-set efficiency is retained as dated repository evidence rather than presented as a current model benchmark. For current model comparisons, use the Token Economy benchmark matrix.
Sensor evidence, then agent judgment.
Deterministic tools scan first; their results are handed to the review agent as prior facts and stored separately from its findings. The recorded code and performance grades remain reviewer assessments. For security reviews, a triage adjustment for excluded findings also respects the verdict-dependent caps.
Sensor registry
gitleaks (pinned and checksum-verified), roslyn, eslint, tsc, producer-neutral SARIF, dependency audits, coverage readers, and a boundary inventory of externally callable surfaces.
Unavailable is evidence
A missing tool or a failed scan is reported as an explicit unavailable state with its reason — never as a clean result, never as a pass.