HumanPR

Code review is the part of engineering that scales worst. The people qualified to review are also the people building the hardest features, so teams either let PRs sit (and watch velocity collapse), rubber-stamp them (and watch quality collapse), or burn senior hours on lint-level checks. Pointing a raw LLM at every diff sounds easy until the bill arrives, two workers race the same webhook and double-charge a customer, the chosen model is down, or a prompt leaks a secret a regex would have caught for free. The real problem was triage: deciding what deserves an LLM, what deserves a human, and what can be answered by a rule in a few milliseconds, while staying defensible enough that an admin can sign findings into a PR comment under their own name.

The orchestrator treats LLM calls as the expensive last resort. A deterministic rule engine runs first and filters out issues a regex can prove, so tokens are only spent on code that actually needs judgment. Surviving chunks are sized to each model's token budget, with Anthropic prompt caching reused across reviews on the same repo. Provider choice is per-organization, with LiteLLM and a self-hosted vLLM box reachable through a Cloudflare Tunnel as fallbacks. Concurrency is solved by an atomic claim: workers transition a job from PENDING_AI to AI_REVIEWING via a single conditional update, so only one worker proceeds and the rest exit cleanly. GitHub webhook signatures are verified before any payload-driven side effect. NextAuth v5 gates admin routes behind MFA, every admin mutation chains into a hash-verified audit log, and GDPR export and delete endpoints preserve that chain by anonymizing rather than dropping records.