infraweaver 0.3.7 → 0.3.9

package/src/mcp/reproveSuggestions.ts

@@ -0,0 +1,86 @@
+/**
+ * Re-proving the open, proven suggestions a later push made stale.
+ *
+ * A proof holds for the commit it was made on, so the apply command commits a
+ * suggestion only at that head. After a push, the review's restatement of the
+ * same finding is withheld as a duplicate of its open thread — so without this
+ * step a proven suggestion could never be applied again once anything else was
+ * pushed.
+ *
+ * Each such thread's OWN suggestion is re-proved, by the same prover, at the
+ * thread's current lines on the new head. When it still holds, the thread gets
+ * a reply carrying a `reproof` marker for this head and those lines, which is
+ * what the apply command honours. One that no longer holds gets no reply, and
+ * apply keeps refusing it.
+ */
+import type { OpenInfraweaverThread } from "#app/mcp/reviewComments";
+import { renderCommentMarker, suggestionText } from "#app/mcp/reviewMarkers";
+import type { SuggestionCandidate, SuggestionProof } from "#app/mcp/suggestionProver";
+import { findingKey, type GateDelta } from "#app/mcp/terraform/scanDelta";
+import { log } from "#app/utils/cli";
+import { APPLY_COMMAND } from "#app/utils/github/applyCommand";
+
+/** Returns how many threads were re-proved and replied to. */
+export async function reproveStaleSuggestions(input: {
+  threads: readonly OpenInfraweaverThread[];
+  delta: GateDelta;
+  /** the head the review is submitted at */
+  headSha: string;
+  prove: (candidates: SuggestionCandidate[]) => Promise<SuggestionProof[]>;
+  reply: (rootCommentId: number, body: string) => Promise<void>;
+}): Promise<number> {
+  const stale: { rootCommentId: number; candidate: SuggestionCandidate }[] = [];
+  for (const thread of input.threads) {
+    const marker = thread.marker;
+    if (marker?.kind !== "finding" || !marker.proven) continue;
+    // proved on this head already, or of unknown origin
+    if (!thread.rootCommit || thread.rootCommit === input.headSha) continue;
+    // outdated (no current lines), or not on the new code
+    if (thread.span?.side !== "RIGHT" || thread.rootCommentId === undefined) continue;
+    const suggestion = thread.rootBody ? suggestionText(thread.rootBody) : undefined;
+    if (suggestion === undefined) continue;
+    // a finding the PR no longer introduces has its thread resolved, not re-proved
+    const finding = input.delta.introduced.find((f) => findingKey(f) === marker.key);
+    if (!finding) continue;
+    stale.push({
+      rootCommentId: thread.rootCommentId,
+      candidate: {
+        index: stale.length,
+        path: thread.span.path,
+        startLine: thread.span.startLine,
+        line: thread.span.line,
+        side: "RIGHT",
+        suggestion,
+        finding,
+      },
+    });
+  }
+  if (stale.length === 0) return 0;
+
+  let reproved = 0;
+  for (const proof of await input.prove(stale.map((s) => s.candidate))) {
+    const entry = stale[proof.index];
+    log.info(
+      `» suggestion re-proof: thread ${entry?.rootCommentId ?? "?"} ${proof.proven ? "still proven" : "not proven"} — ${proof.reason}`,
+    );
+    if (!entry || !proof.proven) continue;
+    const marker = renderCommentMarker({
+      kind: "reproof",
+      head: input.headSha,
+      startLine: entry.candidate.startLine,
+      line: entry.candidate.line,
+    });
+    try {
+      await input.reply(
+        entry.rootCommentId,
+        `✅ Still proven by re-scan on \`${input.headSha.slice(0, 7)}\` — comment \`${APPLY_COMMAND}\` to commit it.\n\n${marker}`,
+      );
+      reproved += 1;
+    } catch (error) {
+      log.warning(
+        `» suggestion re-proof: could not reply on thread ${entry.rootCommentId} — ${error}`,
+      );
+    }
+  }
+  return reproved;
+}

package/src/mcp/review.ts

@@ -20,9 +20,12 @@ import {
   claimsBlockingSeverity,
   FindingAudit,
   formatWithheldFindingsNote,
+  leadingMarker,
   type WithheldFinding,
 } from "#app/mcp/findingAudit";
+import { reproveStaleSuggestions } from "#app/mcp/reproveSuggestions";
 import { formatReanchoredNote, patchLinesBySide, reanchorComments } from "#app/mcp/reviewAnchor";
+import { formatOverflowNote, limitInlineComments } from "#app/mcp/reviewCommentLimit";
 import { listOpenInfraweaverThreads, type OpenInfraweaverThread } from "#app/mcp/reviewComments";
 import {
   type DuplicateComment,
@@ -34,7 +37,7 @@ import { renderCommentMarker } from "#app/mcp/reviewMarkers";
 import {
   type CommentKind,
   classifyComments,
-  Dismissal,
+  type Dismissal,
   provenanceLine,
   renderReviewSummarySection,
   renderReviewVerdict,
@@ -83,7 +86,7 @@ function getHttpStatus(err: unknown): number | undefined {
  */
 export function isTransientReviewError(err: unknown): boolean {
   if (getHttpStatus(err) !== 422) return false;
-  const msg = err instanceof Error ? err.message : String(err);
+  const msg = errorMessage(err);
   return /internal error occurred, please try again/i.test(msg);
 }
 
@@ -410,6 +413,64 @@ export function formatDroppedCommentsNote(dropped: DroppedComment[]): string {
   );
 }
 
+/**
+ * A dismissal as both review tools take it: one finding or several sharing a
+ * reason. Each tool accepts both forms, so a model that learnt one from the
+ * other is not rejected for it.
+ */
+const DismissalInput = type({
+  "finding_id?": type.string.describe("the `finding_id` from review_scan_delta"),
+  "finding_ids?": type.string
+    .array()
+    .describe("several `finding_id`s from review_scan_delta that share this reason"),
+  reason: type.string.describe(
+    "why this introduced finding needs no comment — e.g. mitigated by a named sibling resource, or a false positive for a stated reason. Shown to the author in the review summary.",
+  ),
+});
+
+/** One inline comment of a review, as `create_pull_request_review` and `stage_review` take it. */
+const ReviewComment = type({
+  path: type.string.describe(
+    "The file path to comment on (relative to repo root). Must be a file that appears in the PR diff.",
+  ),
+  line: type.number.describe(
+    "Line number to comment on. For multi-line ranges, this is the end line. Use NEW column from diff format. Must sit inside a `@@` hunk in the PR diff — anchors on context-only or untouched lines are dropped silently (the rest of the review still posts; dropped entries are reported under `droppedComments` in the response).",
+  ),
+  side: type
+    .enumerated("LEFT", "RIGHT")
+    .describe(
+      "Side of the diff: LEFT (old code, lines starting with -) or RIGHT (new code, lines starting with + or unchanged). Defaults to RIGHT.",
+    )
+    .optional(),
+  body: type.string
+    .describe("Explanatory comment text (optional if suggestion is provided)")
+    .optional(),
+  suggestion: type.string
+    .describe(
+      "Full replacement code for the line range [start_line, line]. MUST preserve the exact indentation of the original code.",
+    )
+    .optional(),
+  start_line: type.number
+    .describe(
+      "Start line for multi-line comment ranges. Omit for single-line comments. The range [start_line, line] defines which lines a suggestion replaces. Both `start_line` and `line` must sit inside the same `@@` hunk — a `start_line` outside the hunk causes the whole comment to be dropped even when `line` is valid. If you need to comment on context just above/below a hunk, shrink the range to a single line that is provably modified.",
+    )
+    .optional(),
+  existing_code: type.string
+    .describe(
+      "The exact text of the lines [start_line, line], copied verbatim from the diff. ALWAYS pass this: it is the recovery path for a wrong line number. If the anchor misses the diff, the comment is re-anchored to where this text occurs, so the finding posts instead of being dropped. Recovery needs the text to be unique in that file's diff; a snippet matching several places is ambiguous and drops as before.",
+    )
+    .optional(),
+  finding_id: type.string
+    .describe(
+      "Customer-PR reviews only: the `finding_id` of the introduced finding (from review_scan_delta) this comment explains. It makes the comment SCANNER-BACKED — the tool adds the scanner, rule and controls, and re-scans any `suggestion` before offering it as committable. Omit it for a finding the scanners did not raise; that comment is labelled a review judgement.",
+    )
+    .optional(),
+  audit: FindingAudit.describe(
+    "REQUIRED for any 🚨/⚠️ finding: the pre-post audit, filled from your verification pass. The tool computes the severity from these inputs and puts its marker (🚨 critical/high, ⚠️ medium, ℹ️ low) at the front of the comment — do not rely on the one you wrote. A finding that FAILS a coherence rule, or cites a resource the file does not declare, is withheld and listed in a collapsed block instead of posted. Omit for nits and ℹ️ notes.",
+  ).optional(),
+});
+type SubmittedComment = typeof ReviewComment.infer;
+
 // one-shot review tool
 const CreatePullRequestReview = type({
   pull_number: type.number.describe("The pull request number to review"),
@@ -436,60 +497,108 @@ const CreatePullRequestReview = type({
       "Optional SHA of the commit being reviewed. Defaults to latest. Must be the FULL 40-character SHA — abbreviated SHAs are rejected by GitHub with `422 Unprocessable Entity`. The PR-synchronize event payload's `head_sha` is already full-length.",
     )
     .optional(),
-  comments: type({
-    path: type.string.describe(
-      "The file path to comment on (relative to repo root). Must be a file that appears in the PR diff.",
-    ),
-    line: type.number.describe(
-      "Line number to comment on. For multi-line ranges, this is the end line. Use NEW column from diff format. Must sit inside a `@@` hunk in the PR diff — anchors on context-only or untouched lines are dropped silently (the rest of the review still posts; dropped entries are reported under `droppedComments` in the response).",
-    ),
-    side: type
-      .enumerated("LEFT", "RIGHT")
-      .describe(
-        "Side of the diff: LEFT (old code, lines starting with -) or RIGHT (new code, lines starting with + or unchanged). Defaults to RIGHT.",
-      )
-      .optional(),
-    body: type.string
-      .describe("Explanatory comment text (optional if suggestion is provided)")
-      .optional(),
-    suggestion: type.string
-      .describe(
-        "Full replacement code for the line range [start_line, line]. MUST preserve the exact indentation of the original code.",
-      )
-      .optional(),
-    start_line: type.number
-      .describe(
-        "Start line for multi-line comment ranges. Omit for single-line comments. The range [start_line, line] defines which lines a suggestion replaces. Both `start_line` and `line` must sit inside the same `@@` hunk — a `start_line` outside the hunk causes the whole comment to be dropped even when `line` is valid. If you need to comment on context just above/below a hunk, shrink the range to a single line that is provably modified.",
-      )
-      .optional(),
-    existing_code: type.string
-      .describe(
-        "The exact text of the lines [start_line, line], copied verbatim from the diff. ALWAYS pass this: it is the recovery path for a wrong line number. If the anchor misses the diff, the comment is re-anchored to where this text occurs, so the finding posts instead of being dropped. Recovery needs the text to be unique in that file's diff; a snippet matching several places is ambiguous and drops as before.",
-      )
-      .optional(),
-    finding_id: type.string
-      .describe(
-        "Customer-PR reviews only: the `finding_id` of the introduced finding (from review_scan_delta) this comment explains. It makes the comment SCANNER-BACKED — the tool adds the scanner, rule and controls, and re-scans any `suggestion` before offering it as committable. Omit it for a finding the scanners did not raise; that comment is labelled a review judgement.",
-      )
-      .optional(),
-    audit: FindingAudit.describe(
-      "REQUIRED for any 🚨/⚠️ finding: the pre-post audit, filled from your verification pass. The tool computes the severity from these inputs and puts its marker (🚨 critical/high, ⚠️ medium, ℹ️ low) at the front of the comment — do not rely on the one you wrote. A finding that FAILS a coherence rule, or cites a resource the file does not declare, is withheld and listed in a collapsed block instead of posted. Omit for nits and ℹ️ notes.",
-    ).optional(),
-  })
-    .array()
+  comments: ReviewComment.array()
     .describe(
       "Inline comments on lines within diff hunks. Feedback about code outside the diff goes in 'body' instead.",
     )
     .optional(),
-  dismissed: Dismissal.array()
+  dismissed: DismissalInput.array()
     .describe(
       "Customer-PR reviews only: introduced findings (from review_scan_delta) you decided need no comment, each with the reason. Every introduced finding must be either cited by a comment's `finding_id` or listed here; the review summary shows the reasons to the author.",
     )
     .optional(),
 });
 
+/** Comments and dismissals `stage_review` holds for the next submission on one PR. */
+export interface StagedReview {
+  pullNumber: number;
+  comments: SubmittedComment[];
+  dismissed: Dismissal[];
+}
+
+/** Each comment once, in the order first sent. */
+function uniqueComments(comments: SubmittedComment[]): SubmittedComment[] {
+  const seen = new Set<string>();
+  return comments.filter((c) => {
+    const key = JSON.stringify([
+      c.path,
+      c.line,
+      c.start_line,
+      c.side,
+      c.body,
+      c.suggestion,
+      c.finding_id,
+    ]);
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
+/**
+ * One dismissal per finding, a later reason replacing an earlier one; an entry
+ * naming several findings stands for one dismissal of each.
+ */
+function uniqueDismissals(dismissed: (typeof DismissalInput.infer)[]): Dismissal[] {
+  const each = dismissed.flatMap((d) =>
+    [...(d.finding_id ? [d.finding_id] : []), ...(d.finding_ids ?? [])].map((id) => ({
+      finding_id: id,
+      reason: d.reason,
+    })),
+  );
+  return [...new Map(each.map((d) => [d.finding_id, d])).values()];
+}
+
+const StageReview = type({
+  pull_number: type.number.describe("The pull request number the review is for"),
+  comments: ReviewComment.array()
+    .describe("Inline comments to add, exactly as create_pull_request_review takes them.")
+    .optional(),
+  dismissed: DismissalInput.array()
+    .describe(
+      "Customer-PR reviews only: introduced findings that need no comment. One entry can dismiss several findings with the same reason.",
+    )
+    .optional(),
+});
+
+export function StageReviewTool(ctx: GitHubWriteToolContext) {
+  return tool({
+    name: "stage_review",
+    description:
+      "Stage inline comments and dismissals for the review, in batches, before submitting it with create_pull_request_review. " +
+      "Use it whenever the review has more than about 10 comments or dismissals: send them in calls of up to 10, then call create_pull_request_review with the body — the staged items are submitted with it, so do not send them again. " +
+      "A malformed or rejected call then costs one batch, not the whole review. Nothing is posted until create_pull_request_review. " +
+      "Returns how many items are staged and, on a customer-PR review, the introduced findings still neither commented on nor dismissed.",
+    parameters: StageReview,
+    execute: execute(async ({ pull_number, comments = [], dismissed = [] }) => {
+      assertTargetInScope(ctx, pull_number, "stage a review on");
+      const current = ctx.toolState.stagedReview;
+      const staged: StagedReview =
+        current?.pullNumber === pull_number
+          ? current
+          : { pullNumber: pull_number, comments: [], dismissed: [] };
+      staged.comments = uniqueComments([...staged.comments, ...comments]);
+      staged.dismissed = uniqueDismissals([...staged.dismissed, ...dismissed]);
+      ctx.toolState.stagedReview = staged;
+      const delta = scanSessionOf(ctx.toolState).gateDelta;
+      const cited = staged.comments.flatMap((c) => (c.finding_id ? [c.finding_id] : []));
+      return {
+        success: true,
+        staged: { comments: staged.comments.length, dismissed: staged.dismissed.length },
+        ...(delta
+          ? {
+              unaddressed_finding_ids: unaddressedFindings(delta, cited, staged.dismissed).map(
+                (f) => f.concern.id,
+              ),
+            }
+          : {}),
+      };
+    }),
+  });
+}
+
 /** A review comment as submitted, with the kind a customer-PR review gives it. */
-type KindedComment = NonNullable<typeof CreatePullRequestReview.infer.comments>[number] & {
+type KindedComment = SubmittedComment & {
   provenance?: CommentKind;
 };
 
@@ -509,17 +618,23 @@ export function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext) {
       "Example replacing lines 42-44 (3 lines) with 5 lines: " +
       `{ path: 'src/api.ts', start_line: 42, line: 44, suggestion: '    const result = await fetch(url);\\n    if (!result.ok) {\\n      log.error(result.status);\\n      throw new Error("request failed");\\n    }' }` +
       " CONSTRAINT: Inline comments can ONLY target files and lines that appear in the PR diff." +
-      " Comments anchored outside a diff hunk are dropped automatically (with a note appended to the review body) — the rest of the review still posts.",
+      " Comments anchored outside a diff hunk are dropped automatically (with a note appended to the review body) — the rest of the review still posts." +
+      " Never trim or merge comments to fit a comment limit: the tool applies the repo's `review_comment_limit` itself after you submit, keeping the most severe comments inline and listing the rest in the review body, so write every comment the review needs.",
     parameters: CreatePullRequestReview,
     execute: execute(async (reviewInput) => {
-      const {
-        pull_number,
-        approved,
-        request_changes,
-        commit_id,
-        comments = [],
-        dismissed = [],
-      } = reviewInput;
+      const { pull_number, approved, request_changes, commit_id } = reviewInput;
+      // what stage_review staged comes first; a comment or dismissal sent both
+      // ways is submitted once
+      const staged = ctx.toolState.stagedReview;
+      const fromStage = staged?.pullNumber === pull_number ? staged : undefined;
+      const comments = uniqueComments([
+        ...(fromStage?.comments ?? []),
+        ...(reviewInput.comments ?? []),
+      ]);
+      const dismissed = uniqueDismissals([
+        ...(fromStage?.dismissed ?? []),
+        ...(reviewInput.dismissed ?? []),
+      ]);
       // a customer-PR review: the engine scanned the PR's base and head before
       // the agent started. every comment is then scanner-backed or a judgement,
       // suggestions are re-scanned before they can be committed, and the body
@@ -797,7 +912,11 @@ export function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext) {
                 }
               : { kind: "judgement" },
           );
-          commentBody = `${commentBody}\n\n${provenanceLine(comment.provenance)}\n${marker}`;
+          const provenance = provenanceLine(comment.provenance, {
+            requiredControls: ctx.payload.requiredControls ?? [],
+            reviewerMarker: leadingMarker(comment.body ?? ""),
+          });
+          commentBody = `${commentBody}\n\n${provenance}\n${marker}`;
         }
         const side = comment.side || "RIGHT";
         const reviewComment: ReviewComment = {
@@ -820,6 +939,19 @@ export function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext) {
       // letting GitHub 422 and sink the whole review.
       let droppedComments: DroppedComment[] = [];
       let duplicateComments: DuplicateComment[] = [];
+      let overflowComments: ReviewComment[] = [];
+      // Fails SAFE: an open thread's lines are trusted only on a POSITIVE match.
+      // An unknown head, or no `checkoutSha` to compare it against (a run that
+      // never called `checkout_pr` and supplied its own `commit_id`), both mean
+      // we cannot prove the two numberings agree. The comments are numbered
+      // against the commit the review is SUBMITTED at, so a caller-supplied
+      // `commit_id` other than the head (e.g. an older `head_sha` from the event
+      // payload) is the same mismatch even when the checkout is current.
+      const anchorsAreCurrent =
+        latestHeadSha !== undefined &&
+        ctx.toolState.checkoutSha !== undefined &&
+        latestHeadSha === ctx.toolState.checkoutSha &&
+        params.commit_id === latestHeadSha;
       if (reviewComments.length > 0 && commentableMap) {
         const validation = validateInlineComments(reviewComments, commentableMap);
         droppedComments = validation.dropped;
@@ -845,21 +977,9 @@ export function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext) {
         // the same number means a different line, and a genuinely new finding
         // could be withheld as a duplicate of an unrelated thread. Suppressing a
         // real finding is the one outcome worse than a repeated comment, so on a
-        // mid-run push dedup stands down.
+        // mid-run push dedup stands down — withholding a real finding is worse
+        // than repeating one.
         let spans: ThreadSpan[] = [];
-        // Fails SAFE: dedup runs only on a POSITIVE match. An unknown head, or
-        // no `checkoutSha` to compare it against (a run that never called
-        // `checkout_pr` and supplied its own `commit_id`), both mean we cannot
-        // prove the two numberings agree — and withholding a real finding is
-        // worse than repeating one. The comments are numbered against the
-        // commit the review is SUBMITTED at, so a caller-supplied `commit_id`
-        // other than the head (e.g. an older `head_sha` from the event payload)
-        // is the same mismatch even when the checkout is current.
-        const anchorsAreCurrent =
-          latestHeadSha !== undefined &&
-          ctx.toolState.checkoutSha !== undefined &&
-          latestHeadSha === ctx.toolState.checkoutSha &&
-          params.commit_id === latestHeadSha;
         if (!anchorsAreCurrent) {
           log.info(
             "cannot confirm the reviewed diff matches the PR head — posting without duplicate suppression (open-thread line numbers may not line up with these comments)",
@@ -880,9 +1000,19 @@ export function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext) {
             `withholding ${duplicateComments.length}/${reviewComments.length} inline comment(s) that duplicate open review threads`,
           );
         }
+        // then the per-review limit: the most important comments stay inline,
+        // the rest are listed in the body (see reviewCommentLimit.ts). After
+        // dedup, so a withheld duplicate never takes a slot.
+        const limited = limitInlineComments(deduped.kept, ctx.payload.reviewCommentLimit);
+        overflowComments = limited.overflow;
+        if (overflowComments.length > 0) {
+          log.info(
+            `listing ${overflowComments.length} inline comment(s) in the review body — past review_comment_limit (${ctx.payload.reviewCommentLimit})`,
+          );
+        }
         // always reassign so all-dropped reviews leave params.comments empty
         // instead of carrying the original invalid set (which would 422).
-        params.comments = deduped.kept;
+        params.comments = limited.kept;
       }
 
       // if we dropped comments, surface them in the review body so the
@@ -932,14 +1062,56 @@ export function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext) {
         const note = formatDuplicateCommentsNote(duplicateComments);
         body = body ? body + note : note.replace(/^\n\n/, "");
       }
+      if (overflowComments.length > 0) {
+        const note = formatOverflowNote(overflowComments, ctx.payload.reviewCommentLimit);
+        body = body ? body + note : note.replace(/^\n\n/, "");
+      }
 
       // a customer-PR review closes with the engine's own account of the delta:
       // the counts, the gate, the controls, and what the reviewer dismissed or
       // left unaddressed. written here, not by the agent, so it cannot drift
       // from what was scanned.
+      // proven suggestions a push made stale are re-proved at their threads'
+      // current lines, so the apply command can still take them — only when
+      // those lines are known to be this head's, for the same reason dedup
+      // needs that. Never fatal: the review goes out either way.
+      let reproved = 0;
+      if (delta && anchorsAreCurrent && params.commit_id) {
+        try {
+          reproved = await reproveStaleSuggestions({
+            threads: await openInfraweaverThreads(),
+            delta,
+            headSha: params.commit_id,
+            prove: (candidates) =>
+              proveSuggestions(
+                { repoCwd: process.cwd(), tmpdir: ctx.tmpdir, candidates },
+                { scan: (cwd, files) => scanForProof(ctx, cwd, files) },
+              ),
+            reply: async (commentId, replyBody) => {
+              await ctx.octokit.rest.pulls.createReplyForReviewComment({
+                owner: ctx.repo.owner,
+                repo: ctx.repo.name,
+                pull_number,
+                comment_id: commentId,
+                body: replyBody,
+              });
+            },
+          });
+        } catch (err) {
+          log.info(`could not re-prove earlier suggestions (${errorMessage(err)})`);
+        }
+      }
+
+      // a proof counts only for a comment that is posted: one withheld as a
+      // duplicate of an open thread, or dropped off the diff, offers nothing on
+      // this head for the apply command to commit.
+      const posted = new Set<unknown>(params.comments ?? []);
+      const postedProofs = [...proofs]
+        .filter(([index]) => !commentableMap || posted.has(reviewComments[index]))
+        .map(([, proof]) => proof);
       const suggestionCounts = {
-        proven: [...proofs.values()].filter((p) => p.proven).length,
-        unproven: [...proofs.values()].filter((p) => !p.proven).length,
+        proven: postedProofs.filter((p) => p.proven).length,
+        unproven: postedProofs.filter((p) => !p.proven).length,
       };
       if (delta) {
         const cited = auditedComments.flatMap((c) =>
@@ -953,9 +1125,10 @@ export function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext) {
             concerns: auditedComments.filter(
               (c) => c.provenance?.kind === "judgement" && claimsBlockingSeverity(c.body),
             ).length,
-            proven: suggestionCounts.proven,
+            proven: suggestionCounts.proven + reproved,
             applyCommand: APPLY_COMMAND,
             fixedThreads: ctx.toolState.fixedThreads,
+            requiredControls: ctx.payload.requiredControls ?? [],
           }) + body;
         body += renderReviewSummarySection({
           delta,
@@ -1079,6 +1252,7 @@ export function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext) {
         nodeId: reviewNodeId,
         reviewedSha: actuallyReviewedSha,
       };
+      ctx.toolState.stagedReview = undefined;
       if (delta) {
         ctx.toolState.reviewOutcome = {
           commentsPosted: params.comments?.length ?? 0,
@@ -1357,7 +1531,7 @@ function runDeltaCoveragePreflight(params: {
             `${f.concern.id} (${f.concern.rule_id} at ${f.concern.location.file}:${f.concern.location.line ?? "?"})`,
         )
         .join(", ") +
-      `. for each, either add an inline comment with that \`finding_id\` (and its \`audit\`), or list it in \`dismissed\` with the reason it needs no comment. ` +
+      `. for each, either add an inline comment with that \`finding_id\` (and its \`audit\`), or list it in \`dismissed\` with the reason it needs no comment — stage them with stage_review, without resending what is already staged. ` +
       `then call create_pull_request_review again. this is a one-time nudge — it will not block again in this review session.`,
   );
 }
@@ -1396,7 +1570,7 @@ async function proveReviewSuggestions(
   if (candidates.length === 0) return proofs;
   const results = await proveSuggestions(
     { repoCwd: process.cwd(), tmpdir: ctx.tmpdir, candidates },
-    { scan: (cwd) => scanForProof(ctx, cwd) },
+    { scan: (cwd, files) => scanForProof(ctx, cwd, files) },
   );
   for (const r of results) {
     proofs.set(r.index, r);

package/src/mcp/reviewAnchor.ts

@@ -1,4 +1,5 @@
 import type { CommentableLines } from "#app/toolState";
+import { parseDiffLines } from "#app/utils/unifiedDiff";
 
 /**
  * Deterministic re-anchoring for inline review comments.
@@ -44,30 +45,17 @@ export function normalizeAnchorLine(line: string, stripMarker = true): string {
 export function patchLinesBySide(patch: string): Record<"LEFT" | "RIGHT", PatchLine[]> {
   const right: PatchLine[] = [];
   const left: PatchLine[] = [];
-  let oldLine = 0;
-  let newLine = 0;
-  for (const line of patch.split("\n")) {
-    const hunk = line.match(/^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
-    if (hunk) {
-      oldLine = parseInt(hunk[1]!, 10);
-      newLine = parseInt(hunk[2]!, 10);
-      continue;
+  for (const line of parseDiffLines(patch)) {
+    if (line.kind === "add") {
+      right.push({ line: line.newLine, text: normalizeAnchorLine(line.raw) });
+    } else if (line.kind === "remove") {
+      left.push({ line: line.oldLine, text: normalizeAnchorLine(line.raw) });
+    } else if (line.kind === "context") {
+      const text = normalizeAnchorLine(line.raw);
+      right.push({ line: line.newLine, text });
+      left.push({ line: line.oldLine, text });
     }
-    const changeType = line[0];
-    const text = normalizeAnchorLine(line);
-    if (changeType === "+") {
-      right.push({ line: newLine, text });
-      newLine++;
-    } else if (changeType === "-") {
-      left.push({ line: oldLine, text });
-      oldLine++;
-    } else if (changeType === " ") {
-      right.push({ line: newLine, text });
-      left.push({ line: oldLine, text });
-      newLine++;
-      oldLine++;
-    }
-    // "\" (no newline marker) and anything else: not a content line
+    // hunk headers, "\" (no newline marker) and anything else: not a content line
   }
   return { LEFT: left, RIGHT: right };
 }

package/src/mcp/reviewCommentLimit.ts

@@ -0,0 +1,79 @@
+/**
+ * How many inline comments one review posts.
+ *
+ * A review of forty inline comments is read by no one, and every one of them is
+ * a thread the author must resolve. Past the limit the most important comments
+ * still post inline — 🚨 before ⚠️ before the rest, a proven (one-click
+ * committable) fix ahead of an equal one without, otherwise in the order the
+ * reviewer wrote them — and the rest are listed in the review body, so nothing
+ * the review found is lost, only folded. The gate is not involved: it judges the
+ * scan delta, never the comments.
+ *
+ * The limit is a repo setting (`review_comment_limit`), read from the base
+ * branch on a pull request: lowering it moves findings out of the diff view,
+ * which is a way to make them easier to miss, so a PR does not get to set it for
+ * itself.
+ */
+import { leadingMarker } from "#app/mcp/findingAudit";
+import { gistOf } from "#app/mcp/reviewDedup";
+
+/** Lines the overflow note lists before counting the rest; keeps the body
+ *  clear of GitHub's ~65 KB limit, as the other review notes do. */
+const MAX_OVERFLOW_LINES = 50;
+
+/** what `renderSuggestion` writes under a suggestion a re-scan proved. */
+const PROVEN_MARK = "✅ **Proven by re-scan**";
+
+interface LimitableComment {
+  path: string;
+  line?: number | undefined;
+  body?: string | undefined;
+}
+
+function rank(c: LimitableComment): number {
+  const body = c.body ?? "";
+  const marker = leadingMarker(body);
+  const severity = marker === "🚨" ? 0 : marker === "⚠️" || marker === "⚠" ? 2 : 4;
+  return severity + (body.includes(PROVEN_MARK) ? 0 : 1);
+}
+
+/**
+ * Split `comments` into those posted inline and those folded into the body.
+ * `limit` 0 or undefined means no limit. Both halves keep the input order, so
+ * the posted review reads in the order the reviewer wrote it.
+ */
+export function limitInlineComments<T extends LimitableComment>(
+  comments: readonly T[],
+  limit: number | undefined,
+): { kept: T[]; overflow: T[] } {
+  if (!limit || comments.length <= limit) return { kept: [...comments], overflow: [] };
+  const keep = new Set(
+    comments
+      .map((c, i) => ({ i, r: rank(c) }))
+      .sort((a, b) => a.r - b.r || a.i - b.i)
+      .slice(0, limit)
+      .map(({ i }) => i),
+  );
+  return {
+    kept: comments.filter((_, i) => keep.has(i)),
+    overflow: comments.filter((_, i) => !keep.has(i)),
+  };
+}
+
+/** The review-body note listing the comments the limit folded, or "" for none. */
+export function formatOverflowNote(overflow: readonly LimitableComment[], limit: number): string {
+  if (overflow.length === 0) return "";
+  const shown = overflow.slice(0, MAX_OVERFLOW_LINES).map((c) => {
+    const where = c.line ? `${c.path}:${c.line}` : c.path;
+    const gist = gistOf(c.body);
+    return `- \`${where.replace(/`/g, "'")}\`${gist ? ` — ${gist}` : ""}`;
+  });
+  const rest = overflow.length - shown.length;
+  if (rest > 0) shown.push(`- …and ${rest} more not shown`);
+  return (
+    "\n\n---\n\n" +
+    `**Note:** this review posts at most ${limit} inline comments (\`review_comment_limit\`), ` +
+    `so ${overflow.length} more ${overflow.length === 1 ? "is" : "are"} listed here instead:\n` +
+    shown.join("\n")
+  );
+}