Review the change. Keep the judgment.

uses: D4NZ-jpg/diffowl@v0

Open source on GitHub

Runs on GitHub Actions with your own provider keys

Evidence firstFindings carry repository evidence and explicit verification state.

Policy from the basePull requests cannot weaken the rules used to review themselves.

Humans decideDiffowl prepares the review. Your team makes the product decision.

Every finding shows its work.

A material finding is a claim with a location, an impact, repository evidence, and an explicit verification state. No evidence, no finding.

src/webhook-queue.ts:118verified

Deleting the retry guard drops queued webhooks on transient failures.

Transient provider errors now permanently discard events instead of requeueing them.

- if (err.retriable && attempt < MAX_RETRIES) {

- return this.requeue(event, attempt + 1);

- }

this.deadLetter.push(event);

Evidence: scoped diff

Validation: npm test failed on head

Example finding, shown as Diffowl publishes it to a review thread.

One review. Three safeguards.

Generation, challenge, and verification are separate roles, so confident language never counts as proof by itself.

ClassifyDiffowl classifies trust before it starts risky work.

ReviewThe reviewer grounds each candidate in the change and repository.

ChallengeThe challenger rejects weak evidence and low-materiality claims.

VerifySupported findings become a typed, auditable outcome.

diffowl review

{
  "type": "findings",
  "coverage": "completed_permitted",
  "materialFindings": ["1 finding"],
  "verification": { "validationAttempts": 1 }
}

The same review, on your machine.

The CLI runs the engine the Action runs. Reproduce a CI review locally, inspect the full report, and get the same typed outcome.

cleanfindingspartial_coveragetimeoutabstentionconfiguration_failure

Documentation

Quick start

Add base-branch policy, connect provider credentials, and install the GitHub Action in one sitting.

Open the guide →Project policy

Every field of .diffowl.json, with its security ceilings.

CLI referenceOptions, input schema, report shape, and exit codes.Review outcomesThe typed outcome union and the material finding shape.Durable stateGit-ref state, self-hosted directories, and the request router.

Automation stops. Human judgment starts.

A clean result means Diffowl found no material problems in what it was allowed to check. It is not proof the change is correct, and it is not an approval.

What Diffowl does and does not do