[BaaRai]

Summary

Adds a REA-based analysis of how a commercial AI PR-review check detects vulnerabilities, plus a phased plan to implement the same capability in ARTEX.

The analysis reconstructs the pipeline from:

• REA 6.7.0 static/runtime analysis of the authenticated client bundle (135 scripts)
• generated client wire schemas for scans, findings, PR checks, validation, fixes, and repo indexing
• the vendor's public documentation for config/gating, rules, feedback, and remediation

Key findings

• PR checks are webhook-triggered and policy-gated (drafts/forks skipped, 500 changed-file cap, repository config).
• Detection is layered: repo index + call graph, taint/data-flow findings (taint_path, CWE/OWASP), LLM reviewer agents, a validator producing verified/unverified claims, and optional dynamic sandbox verification.
• Checks are advisory by default; fail_on.severity enables blocking. Triage immediately recomputes the check.
• Findings carry a full triage lifecycle, dedup metadata, dynamic verdicts, and optional autofix runs with reproduction + regression-test verification.

Contents

• docs/ai-pr-review-technology.md — evidence, reconstructed pipeline, data model, pass/fail semantics, and an ARTEX integration blueprint (packages, DB tables, APIs, agent roles, phases, acceptance tests).

No vendor code, prompts, or assets are reproduced; this is behavioral analysis for interoperability and research.