Vigilant Guacamole

AI Code Review Agent (with Auto-Fix)

Connects to GitHub PRs, runs parallel Security / Performance / Test-coverage review agents (Claude + LangGraph), and opens a second PR with the actual fix applied — no back-and-forth comments.

Status

Step	What	State
1	FastAPI webhook receiver (HMAC verification, dedup, dispatch)	✅ Done
1a	Run-history persistence (SQLite) + dashboard UI	✅ Done
2	GitHub client: fetch PR diff, parse into hunks	✅ Done
3	LangGraph StateGraph: parallel Security/Performance/Test agents	✅ Done
4	Fix Agent: generate patch, open fix PR	✅ Done
5	Demo repo + seed script for the Instagram clip	✅ Done

All five steps are implemented. See [Known limitations](#known-limitations) for the gaps worth knowing about before relying on this beyond a demo.

Architecture

**Request flow** — a webhook comes in, gets validated and recorded, control returns to GitHub before any slow work happens, and the background task runs the full pipeline: fetch the diff (Step 2), review it with three parallel Claude agents (Step 3), and — if they found anything — generate and open a fix PR (Step 4):

sequenceDiagram
    participant GH as GitHub
    participant WH as Webhook handler
(app/webhooks)
    participant DB as SQLite
(runs.db)
    participant BG as Background task
    participant API as GitHub API
(PyGithub, worker thread)
    participant LG as LangGraph
(3 parallel agents)
    participant FIX as Fix agent

    GH->>WH: POST /webhooks/github (signed payload)
    WH->>WH: verify HMAC-SHA256 signature
    WH->>WH: dedup by X-GitHub-Delivery
    WH->>WH: filter: action type, draft PR
    WH->>DB: create_run() → status=queued
    WH->>BG: schedule run_review_pipeline()
    WH-->>GH: 202 Accepted {run_id}
    BG->>DB: update_run() → status=running
    BG->>API: fetch_pr_files() → per-file .patch
    API-->>BG: files (or DiffTooLargeError / GitHubAPIError)
    BG->>BG: parse_pa