Did this change break the architecture you declared?
Ask before the pull request.
AI coding agents write changes faster than anyone can judge their architectural consequences. Vibgrate Review reads a change from your Vibgrate Graph, runs deterministic scanners, and gives one policy-owned decision — pass, needs review, fail, or undetermined — as a versioned receipt. On your machine. Source never leaves it.
vg review reads the change from the code map and gives one policy-owned decision — pass, needs review, fail, or undetermined — before the pull request.
Real output of the shipped CLI on our .NET Clean Architecture test solution. Replay the same run below.
Three questions a senior reviewer asks
A drift scan answers how far behind is the stack? Review answers a different question about the same repository — and answers it about one change, before it lands.
Did it move toward the architecture you declared?
Declare the target pattern — layered, clean, hexagonal, MVC — in .vibgrate/review.toml. A new dependency that skips a tier, or a controller that reaches persistence directly, is reported as a regression with the rule it breaks, not as a style nit.
Did it weaken a security control?
A guard removed from an entrypoint, a mutating route left unguarded where its peers are guarded, or a known-vulnerable dependency added. These findings are protected: while one is unresolved, policy cannot say pass — not through low confidence, not through an exception, not through anything a model says.
What did it not account for?
A changed file with no test reaching it. A data-access pattern that deviates from every peer. A duplicate of a function that already exists. And where Review could not observe something, it says so as an unknown — never a green tick nobody earned.
How it decides
Each stage owns exactly one thing. Findings never decide; a model never decides; policy decides once, and the receipt records which policy and which model.
- 01
Source + diff
The working tree and index against HEAD, or a branch against its merge-base — the same change set a pull request shows.
- 02
Vibgrate Graph + deterministic scanners
Roles, layers, edges, and peers come from the local code map. Every finding cites the evidence it rests on.
- 03
Analysis Capsule
A bounded evidence packet — a few thousand tokens — that never leaves your machine unless you opt in.
- 04
Optional local model
May add explanations and implications. It never decides, and a schema verifier rejects any output that invents evidence or a verdict.
- 05
Policy
The one layer that writes a decision, from a policy version you can read. Protected findings cannot be blessed into a pass.
- 06
Receipt
vg.review.receipt.v1: the decision, every finding with evidence ids, the policy and model versions, and content digests.
Protected findings
An unguarded entrypoint, a removed guard, and a known-vulnerable dependency are protected. While one is unresolved, the decision cannot be pass. The only way to stop a protected rule from gating is to turn it off in .vibgrate/review.toml — read from the trusted base branch on a pull request, so a change cannot weaken the policy applied to itself.
Decisions and exit codes
| pass | 0 | No material delta, or every finding is target-aligned |
| fail | 2 when gated | An unresolved protected finding, or a high-severity finding above the confidence threshold |
| needs review | 2 with --fail-on needs_review | Findings a human should look at |
| undetermined | 2 with --fail-on needs_review | Not enough evidence to decide — deliberately not a pass |
Gating is opt-in, as for vg scan: without --fail-on or enforcement in the policy file, every decision is reported and the process exits 0. A missing code map or model exits 6, which is never read as a pass.
The same review, everywhere you work
One binary, one policy, one receipt — whether it runs on a laptop, in the editor, or on a runner.
Vibgrate CLI
vg review on the working tree, --base for a branch, explain for one finding. Text for people; json, sarif (security findings only), and md for machines and pull requests.
Command reference →Vibgrate for VS Code
The Review panel lists your uncommitted changes, runs the same review, marks findings on the files, and shows the evidence behind any finding with every path one click from the editor.
The extension →In CI
The shipped GitHub Actions example runs the same binary against the merge-base, uploads the receipt, and writes the Markdown summary to the check. Gating is opt-in: --fail-on fail stops the build only on a fail decision.
CI integration →Vibgrate Cloud
--push sends the receipt — never the source — so a repository shows its review decisions commit by commit next to its DriftScore. Two numbers, two widgets, never blended.
Vibgrate Cloud →Review your next change
Install the Vibgrate CLI, make a change, and run one command. Review builds the code map if there is none, and on a first run writes a starter, advisory .vibgrate/review.toml seeded from the layering the repository already exhibits — after the review, so it never lands in the change set being reviewed.
npx @vibgrate/cli scanno install·Nothing is installed globally — ideal for CI or a one-off scan.
What it is not
- It is not a proof of security, and absence of findings is not a certification. Review reports change integrity against the architecture and controls you declared.
- It does not replace Semgrep, CodeQL, compilers, or tests. Dataflow (taint) analysis is not part of this slice: when a change touches an entrypoint, Review reports that as an unknown rather than pretending to have checked.
- It is not a majority vote. A dependency that skips a tier is a regression only when you declared a target pattern; otherwise it is a medium finding about the repository’s own habits, because a majority is not a decision.
- It is not DriftScore. DriftScore measures how far a stack has drifted from current versions; Review measures whether one change kept its promises. They are never combined.
See a real review run
A replay of the actual CLI reviewing a change to our .NET Clean Architecture test solution — the decision, the findings, the evidence behind one of them, and the Markdown summary. Nothing executes in your browser.
More from Vibgrate
Everything on this page is free and runs locally. Vibgrate Cloud adds the commit-by-commit timeline.