Trying to understand why the poster's own comment was flagged and killed but the original article remains up.
However, the backend demo report seems longer and more complex than just reading the code. I’m trying to build something similar as well, and no one has quite nailed this yet.
The risk map / assisted review needs to be succinct and information dense, to guide your attention. My current philosophy is that we need to be annotating code, not replacing the entire code review interface with a bunch of text.
But the example PR... It said code generate with Claude, is it really still this bad? Last I was using SQLAlchemy with Claude was Opus 4.5, and it took some heavy coaching and skill gen not to generate code like this--but why even use SQLAlchemy at all if you're just going to use string interpolation jeez
https://github.com/erich-oliveira-winnin/full-stack-fastapi-...
owner = "" if current_user.is_superuser else f"WHERE owner_id = '{current_user.id}'"
query = f"SELECT status, count(*) FROM item {owner} GROUP BY status"
rows = session.execute(text(query)).all()
Yes, this is called SQLAlchemy Core: http://docs.sqlalchemy.org/en/latest/core/
You can also just use psycopg (the Postgres driver layer) directly, it’s surprisingly ergonomic in my (limited) experience.
Anecdata, datapoint of 1 personal experience: I had been using Opus 4.6 with no problems until yesterday, then it seemed like it was missing things constantly, introducing random bugs, forgetting basic stuff that was in its memory and skills and should never miss
Same thing happened on 2 separate sessions I had with Opus 4.6
Ended up switching to 5.5 and Fable, things improved instantly
This left me with a weird taste
I thought mono meant one.
There was a post here recently, "Using LLM for confidence scoring is a bad idea", my mind went immediately to using LLMs for scoring risk. Seems like a bad idea. If there's anything we still need a human for, it's assessing risk.
A trained human mind that is.
Your average human in any given topic will give confidently incorrect risk assessments just like an LLM.
But now that you asked, I recently had a similar experience with Codex, but on a shared repo. I also was using a slightly older model, and the all of a sudden it kinda stopped running tasks. I would ask it to do something and the it would just kind of do an analysis, then give me a recommendation of what to do. I had to tell it to execute the task, and then it would “be lazy”, like run one part then give me a recap and recommendation again instead of just going
Switched to a newer model, and the issue was instantly gone
ericholiveira•4h ago
AI agents now write a lot of our code, and AI reviewers catch a lot of the line-level problems. But someone still has to press "merge", and that person has the same question every time: how risky is this, and where should I spend my attention? A 40-file PR where 38 files are isolated is very different from a 3-file PR that changes a model used by 23 endpoints.
farol is a CLI (and a GitHub Action) that answers that statically:
- classifies the PR (global / touches-existing / isolated / unknown) and gives a 0-100 merge risk score - ranks the files by risk and says why: what each one reaches (routes, endpoints, jobs), contract breaks in API responses, dependency changes, security patterns - diff coverage from your existing coverage report, so "38% of the changed lines are tested" sits next to the risky files - an HTML report where you mark files as reviewed and the score and test plan follow; incremental mode for "what changed since my last review"; suggested reviewers from git blame
How: it uses the TypeScript compiler API for TS/React (React Router, Next.js, TanStack Router) and TS backends, a small go/types helper for Go, and Python's ast for FastAPI/Flask/Django and friends. No LLM, no network during analysis, and it never executes the analyzed repo's code. It's deterministic and informs only; it never blocks a merge.
Live demo (two reports from a real PR, nothing to install): https://winnin.github.io/farol/demo/
Try it on a branch: npx @winninjs/farol --help
Limitations: only TS, Go and Python for now, and the reachability is static, so dynamic dispatch and reflection make it fail closed ("unknown") rather than guess. I'd love feedback on the risk score and on false positives in your codebase.