The verifier: tests and AI review of a diff

What verification means here

A verifier stands between generated code and a pull request. It answers two questions: do the configured checks pass, and does a careful reader find problems in the change? DevFlow uses one role for both.

Tests first

Every executable check runs only the commands stored in the repository's test_commands rows. Nothing is guessed: a repository with no command configured is never built or tested, and the timeline records a skipped check rather than a pass.

Each command runs in a non-root container. The default caps are 4 CPUs, 4 GB of memory and 512 processes.

Then a review

The role may read, search and run commands, but it may not edit. Its tool list is Read, Bash, Grep and Glob. Findings are recorded per subtask, which is also what the model analytics use to compute a clean-verify rate for each implementer model.

Today every workspace runs one review pass at the end of a task rather than after each subtask. This holistic pass sees the cumulative diff of the branch.

Large changes

Up to 512 KB, the full branch diff goes into the prompt. Above that, the role gets a per-file diffstat and the base reference, and retrieves each file's diff on demand with git.

A very large task therefore degrades to file-by-file inspection instead of failing at the last gate.

Where the result goes

The outcome of each subtask feeds the merge evidence report attached to the pull request. It sits next to the build gates and the security scan summary.