95 findings on its own code

Reviewing Itself Shipped

The clearest evidence the pipeline works is what it found when pointed at the commit that built it.

A review of the project's own multi-provider review command returned 95 findings across 10 specialists and 2 models, spanning severity 14 to 92. The top finding was a genuine concurrency defect: parallel provider runs each opening a separate backend against the same database file, producing intermittent locking and order-dependent failures. Others included two new modules with zero test coverage, an unflagged rollout with no rollback path, and a privacy finding about sending diffs to multiple providers without explicit consent.

Corroboration in the raw

Three separate findings independently flagged the same defect — provider calls gathered with no timeout, able to hang indefinitely. That is exactly the signal the merge key is designed to collapse into one corroborated finding rather than three duplicates. At the other end of the range, the lowest-severity finding was an import placed inside a conditional block instead of at module top — the pass runs all the way down, not just to the headlines.