{"_id":"@atmin.ai/review","name":"@atmin.ai/review","dist-tags":{"alpha":"0.1.0-alpha.2","latest":"0.1.0-alpha.2"},"versions":{"0.1.0-alpha.2":{"name":"@atmin.ai/review","version":"0.1.0-alpha.2","private":false,"type":"module","description":"atmin review — immutable review evidence and deterministic verdicts","engines":{"node":">=24.0.0"},"bin":{"atmin-review":"dist/cli.js","atmin-review-github":"dist/github/cli.js"},"scripts":{"build":"tsc","test":"npm run build && node --test test/*.test.mjs","typecheck":"tsc --noEmit"},"dependencies":{"ajv":"8.20.0","openai":"7.12.1"},"devDependencies":{"@types/node":"24.13.3","typescript":"5.9.3"},"license":"Apache-2.0","repository":{"type":"git","url":"git+https://github.com/atmin-ca/review.git"},"bugs":{"url":"https://github.com/atmin-ca/review/issues"},"homepage":"https://github.com/atmin-ca/review#readme","publishConfig":{"access":"public","tag":"alpha"},"_id":"@atmin.ai/review@0.1.0-alpha.2","_integrity":"sha512-xHHclVHnqMV0vN/WrY+C/Hf3/UIlmuT14yGt7WxcstZOzsUJKvieei1WLbmQKoT6NOEYbFf4hOQz3moMvz9u5w==","_resolved":"/tmp/atmin-review-alpha2/artifacts/atmin.ai-review-0.1.0-alpha.2.tgz","_from":"file:/tmp/atmin-review-alpha2/artifacts/atmin.ai-review-0.1.0-alpha.2.tgz","_nodeVersion":"25.2.1","_npmVersion":"11.6.2","dist":{"integrity":"sha512-xHHclVHnqMV0vN/WrY+C/Hf3/UIlmuT14yGt7WxcstZOzsUJKvieei1WLbmQKoT6NOEYbFf4hOQz3moMvz9u5w==","shasum":"76fb1258ff53cb795745f719f6a5c99a2687d990","tarball":"https://registry.npmjs.org/@atmin.ai/review/-/review-0.1.0-alpha.2.tgz","fileCount":48,"unpackedSize":182526,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQCVidrjj+7snIm//eJAF7GhdAnuV6GoGb1gxx2uReUyvwIhAMn/J5ojoLA+GorcLNwbGgipRJfC6GFI+0D1pNMW1924"}]},"_npmUser":{"name":"thxforum","email":"admin@atmin.ca"},"directories":{},"maintainers":[{"name":"thxforum","email":"admin@atmin.ca"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/review_0.1.0-alpha.2_1789063273701_0.9746305407472455"},"_hasShrinkwrap":false}},"time":{"created":"2026-09-10T18:01:13.327Z","0.1.0-alpha.2":"2026-09-10T18:01:13.859Z","modified":"2026-09-10T18:01:14.396Z"},"maintainers":[{"name":"thxforum","email":"admin@atmin.ca"}],"description":"atmin review — immutable review evidence and deterministic verdicts","homepage":"https://github.com/atmin-ca/review#readme","repository":{"type":"git","url":"git+https://github.com/atmin-ca/review.git"},"bugs":{"url":"https://github.com/atmin-ca/review/issues"},"license":"Apache-2.0","readme":"# atmin review\n\nSource code review with evidence, clear verdicts, and bounded model spending.\nRun the CLI yourself or operate the included GitHub App worker. Experimental\nalpha: model quality and severity calibration are still being measured.\n\n## Install the alpha\n\nRequires Node 24 or newer, Git, and an authenticated GitHub CLI (`gh auth login`).\nInstall the versioned release in a fresh directory:\n\n```sh\nnpm install @atmin.ai/review@0.1.0-alpha.2\nnpx atmin-review --help\ncp node_modules/@atmin.ai/review/profiles/smoke-openrouter-free.json ./review-profile.json\n```\n\nSet `OPENROUTER_API_KEY` in your environment, then review a PR:\n\n```sh\nnpx atmin-review review https://github.com/OWNER/REPO/pull/123 \\\n  --profile ./review-profile.json --out ./private-review\n```\n\nReplace the example URL with a repository you may access and send to the model\nprovider. The free profile enforces zero model pricing with no paid fallback;\navailability and rate limits depend on the provider. The bundled paid DeepSeek\nprofile caps a run at $2; copying it is an explicit choice to use paid inference.\nDirect OpenAI support uses `OPENAI_API_KEY` and an explicit profile.\n\nEach run captures immutable commits, reads changed files and relevant callers,\nrecords anchored findings, and renders a report. It never executes repository\nscripts. Keep snapshot directories private: they contain repository source.\nInterrupted or partial reviews exit with status 2. Errors exit with status 1.\n\nYou can also prepare, investigate, render, and inspect costs separately:\n\n```sh\nnpx atmin-review prepare https://github.com/OWNER/REPO/pull/123 --out ./private-review\nnpx atmin-review investigate ./private-review --profile ./review-profile.json\nnpx atmin-review render ./private-review --check-current\nnpx atmin-review cost ./private-review\n```\n\nA directory is investigated once, so previous spending reservations cannot be\nlost by rerunning it. Create a new snapshot for a new review. `--check-current`\nchecks live commits; rendering without it explicitly leaves freshness unverified.\n\n## Read the verdict\n\n**No issues found** means the completed source review reported no visible\nfindings. Required validation is separate. It does not mean the code is perfect\nor that tests passed. Incomplete or historical reviews never receive a clean\nheadline. A numerical average cannot cancel out a serious defect.\n\n| Priority | Meaning | Default check behavior |\n|---|---|---|\n| P0 | Critical, immediate intervention | Changes needed |\n| P1 | High-impact defect needing a prompt fix | Changes needed |\n| P2 | Material defect that should be fixed | Changes needed |\n| P3 | Minor defect with limited impact | Non-blocking suggestion |\n| P4 | Optional improvement | Hidden by default; non-blocking |\n\nPriority depends on a concrete trigger, impact, reachability and counterevidence.\nFindings cite immutable source. A model's reasoning is not proof of execution.\nThe target commit's `.atmin/review.json` may enable optional suggestions and name\nrequired validation checks; a PR cannot weaken its own policy:\n\n```json\n{\"schemaVersion\":1,\"rubricVersion\":\"1\",\"includeOptional\":false,\"requiredChecks\":[\"change-validation\"]}\n```\n\n## GitHub App worker\n\nThe worker receives signed webhooks, stores jobs in SQLite, updates one bot\nsummary per PR, and publishes an `atmin review` check. Maintainers can comment\n`/atmin review` to rerun. Use a dedicated host user; the pilot worker is not a\nsandbox for executing repository code or an isolation boundary for many tenants.\n\nRegister an App with repository Contents read, Pull requests write and Checks\nwrite. Subscribe to Pull request, Push and Issue comment events. Install it only\non the intended repository. Set its webhook to your HTTPS proxy's\n`/webhooks/github`, forwarding to the worker on loopback port 8787.\n\nSet `GITHUB_APP_ID`, `GITHUB_APP_PRIVATE_KEY_PATH`, `GITHUB_WEBHOOK_SECRET`\n(at least 32 bytes), and the selected model credential. Put actual repository\nand installation IDs in a local configuration:\n\n```json\n{\n  \"repository\":\"OWNER/REPO\",\n  \"repositoryId\":123,\n  \"installationId\":456,\n  \"profile\":\"./review-profile.json\",\n  \"stateDirectory\":\"./private-worker-state\",\n  \"host\":\"127.0.0.1\",\n  \"port\":8787,\n  \"maxReviewsPerDay\":6,\n  \"trustedChecks\":[{\"name\":\"change-validation\",\"appId\":15368}]\n}\n```\n\n`trustedChecks` is optional. Use the actual check name and producer App ID you\ntrust; check names must match the target policy's required checks. App 15368 is\nan illustrative configuration; verify the producer in your repository before\nusing it. The worker queries GitHub on the exact reviewed head. Only a unique\ncompleted success counts as a pass. Missing, skipped, ambiguous, cancelled or\nunavailable checks remain unverified. A check on a different merge commit is\nnot automatically treated as evidence for the head.\n\nProtect CI workflow changes according to your repository's policy: trusting an\nApp and check name is not verification of the workflow's code. This alpha reads\nCI at publication and explicit reconciliation; it does not subscribe to CI\ncompletion events or poll after publication.\n\n```sh\nnpx atmin-review-github check ./pilot.json\nnpx atmin-review-github serve ./pilot.json\n# In another terminal; a new worker starts paused:\nnpx atmin-review-github enable ./pilot.json\nnpx atmin-review-github status ./pilot.json\nnpx atmin-review-github reconcile ./pilot.json 123\nnpx atmin-review-github pause ./pilot.json\n```\n\nReconciliation refreshes the saved report and CI without new inference. Pausing\ncancels active work. Failed and cancelled starts count toward the rolling daily\nlimit. Stop the service before backups; retain the database and spending receipts.\nProvide snapshot retention and disk limits before widening access. Capture\nfetches repository history, so large repositories can exceed the pilot's capacity.\nNo hosted signup, billing, inline comments, or repository execution is included.\n\n## Develop\n\n```sh\nnpm ci\nnpm test\nnode packaging/verify.mjs\n```\n\nTests use local repositories, fake provider responses and temporary databases;\nthey do not consume model credits or establish model quality. Package verification\ninstalls the actual tarball in a clean directory and exercises both CLI entry\npoints and snapshot rendering. Apache-2.0; see LICENSE and NOTICE.\n","readmeFilename":"README.md","_rev":"1-31f2836d4cc51856a0581cdd3ac2080c"}