Code Review

Eridian Dev review is a job, not a single completion. The gateway extracts the diff, identifies affected modules from the index, retrieves related tests, then asks GPT or Gemini for findings. Engineers still approve the merge. The model does not merge.

Create a review

POST /v1/dev/reviews
Authorization: Bearer eridian_sk_...
Content-Type: application/json
Idempotency-Key: pr-4821-review-v1

{
  "project_id": "prj_dev_001",
  "repository_id": "repo_payments_core",
  "model": "auto",
  "routing_policy": "quality_optimized",
  "pull_request": {
    "host": "github",
    "number": 4821,
    "base_sha": "1a2b3c4d",
    "head_sha": "8f3a2b1c"
  },
  "checklist": ["correctness", "security", "tests", "residency"],
  "severity_floor": "medium"
}

Required scope: dev:write. You may pass a raw diff instead of pull_request for local CLI use. Max diff size is in Dev Limits.

Review object

{
  "id": "rev_4821_01",
  "object": "eridian.dev.review",
  "status": "completed",
  "model": "gpt",
  "summary": "Three findings. Highest: retry path posts without an Idempotency-Key.",
  "findings": [
    {
      "id": "fnd_01",
      "path": "src/ledger/posting.ts",
      "start_line": 198,
      "end_line": 220,
      "severity": "high",
      "category": "correctness",
      "title": "Unbalanced posting on retry",
      "body": "postEntry retries on 503 without a key. ledger.append is not idempotent.",
      "suggested_patch": "Require entry.idempotencyKey before append.",
      "citation": "src/ledger/posting.ts:198-220"
    }
  ],
  "test_gaps": [
    {
      "path": "src/ledger/posting.test.ts",
      "reason": "No case for 503 retry without a key"
    }
  ],
  "eridian": {
    "request_id": "axm_req_rev_4821",
    "route": "gpt",
    "rag_chunks": 12,
    "latency_ms": 12400,
    "cost_usd": 0.086,
    "region": "eu-west-1"
  }
}

status is queued, running, completed, or failed. Poll GET /v1/dev/reviews/rev_4821_01. Large reviews are asynchronous.

How the steps run

1. Diff extract. Binary files and generated globs are dropped.
2. Module map. Index retrieval finds callers, tests, and ownership CODEOWNERS.
3. Model pass. quality_optimized prefers GPT. Long diffs may hop to Gemini for context, then GPT for comments, recorded as eridian.route plus eridian.route_fallback.
4. Validate. Findings without a citation are discarded. The API never returns an uncited comment.
5. Audit. dev.review.completed includes finding counts, not source.

Post comments to the host

POST /v1/dev/reviews/rev_4821_01/publish
Authorization: Bearer eridian_sk_...

{
  "target": "github",
  "include_severities": ["high", "medium"],
  "as": "eridian-bot"
}

Publishing uses the Git app installation. It is a control-plane write. On Enterprise with evals_required, publishing a new review prompt template still needs dual control. The review job itself does not.

Severity

Tune severity_floor per repository. Do not use review as a linter. Point formatters at CI.

Eval before you require it

Require review as a CI check only after an eval suite passes. Attach metadata.workflow: code_review so Usage can split review spend from completion. See Evaluations and CI Pipelines.