roborev Code Review

Evidence supports least privilege and sensitive-data handling: local-only orchestration, proxy tokens injected from config rather than inherited shell env, proxy URLs rejecting embedded credentials with http limited to loopback, atomic config writes with 0600 global perms and masked secrets. Deductions are concrete: `roborev init` installs a post-commit hook, `agent-hook install` edits agent configs, and `refine` auto-commits in a worktree with no per-action confirmation; README discloses default-on anonymous PostHog telemetry (install ID, repo/review count buckets) with opt-out, so data-flow transparency is only partial; auto-fix commits rely on git for rollback rather than product-level recovery; source attribution rests on an MIT copyright line and an unverified publisher with no signing or provenance attestation.

Failure handling is well documented: read-only `roborev doctor`, daemon.log rotation with truncation markers, JSONL post-commit log, CI retry/backoff with error categorization, and fail-open hook callbacks. Self-consistency is mostly good (config precedence, export cursor contract, upgrade steps), but some facts require stitching across README and installation docs (Go install lacks browser assets, env stripping for claude-code), and the README telemetry section is truncated, so not full marks. Dependencies are public and version-pinned with CI actions pinned to SHAs, but no vulnerability scanning or SBOM evidence is present.

Audience and scenarios are broad (local CLI, TUI, browser UI, CI, many agents); capability boundaries are stated (no agent hook in Claude Desktop, no browser UI from Go install, no downgrade); trigger precision includes branch/commit exclusions, thresholds, and snooze. Deductions: reviewing every commit by default and the fully automated `refine` loop are high-impact defaults, and boundary notes are scattered across several documents.

Information architecture is strong: README plus installation, quickstart, configuration, and troubleshooting docs with command and config tables; install notes cover script, Homebrew, DEB/RPM, Go, and source builds with checksum and PATH details; LICENSE is complete MIT. Deductions: naming stability is weakened by breaking changes across 0.70/0.71/0.72 (renamed keys, changed command semantics); known limitations are scattered rather than consolidated; versioning appears only as upgrade subsections rather than a standalone changelog; maintenance responsibility cannot be confirmed because the publisher is unverified, leaving only in-repo CI and the copyright line as signals.

Output usability is solid: findings viewable in TUI/browser, copyable, exportable as JSON, severity-filtered, and feedable to agents, with `compact` filtering false positives. Marginal value is real (per-commit continuous review, cross-repo search) but requires at least one configured agent CLI and review quality depends on that external agent. Cost-benefit evidence is thin: cost export and budget settings are mentioned, but no token/expense magnitudes or comparisons are given, and automated loops can amplify agent spend, so only 1.

Verifiability is weak: most functional claims in README and docs have no linked tests or code references; telemetry, proxy routing, and export contracts are asserted in prose only; the CI workflow is present but truncated, so test coverage cannot be confirmed; facts and inferences are not clearly separated (e.g., 'issues in seconds' is unquantified). All three criteria scored 1.