{"type":"post","slug":"agent-builder-ops-adds-review-mocks-cost-controls-and-secure-workflows","title":"PR-AF turns code review into a planned multi-agent pass","description":"PR-AF builds a per-PR review plan, spawns focused reviewer agents, grounds findings in code evidence and challenges them — reporting 0.706 golden recall as the top open-source reviewer.","retrieval_nugget":"PR-AF builds a per-PR review plan, spawns focused reviewer agents, grounds findings in code evidence and challenges them — reporting 0.706 golden recall as the top open-source reviewer.","published_at":"2026-08-14","updated_at":"2026-09-12","record_date":"2026-08-14","date_kind":"discovered_at","topics":["coding-agents","evals","security"],"entities":["PR-AF","aimock","LangSmith","GitHub"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:agent-builder-ops-adds-review-mocks-cost-controls-and-secure-workflows","status":"published","source_urls":["https://github.com/Agent-Field/pr-af"],"visuals":[],"editorial_provenance":{"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:31aac59f304eeaf4c7b41b83043f0155ef5aa8c1e397d896ce53a5e61185229f","reviewed_at":"2026-09-12T10:00:00Z","source_evidence_count":1,"verified_claim_count":2,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":2,"implication_count":1,"watch_condition_count":1,"related_record_count":3},"analysis":{"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"PR-AF is an open-source code reviewer built around a pipeline rather than a prompt: turn each pull request into a task-specific review plan, spawn focused reviewer agents, ground findings in code evidence, then challenge the results.","observed_facts":[{"text":"PR-AF reports 0.706 golden recall, first among 42 compared tools, and 595 independently valid findings.","source_urls":["https://github.com/Agent-Field/pr-af"]},{"text":"It publishes public results, per-pull-request judge verdicts and reproduction scripts, and runs locally in Docker.","source_urls":["https://github.com/Agent-Field/pr-af"]}],"mechanism":"it maps model class to review stakes — DeepSeek-class models for routine pull requests, GLM-5.2 for deep open-model reviews, frontier Opus-class models for major ones","why_now":"The reported numbers are unusually specific for this category: 0.706 golden recall, described as first among 42 compared open-source and commercial tools, and 595 independently valid findings, roughly three times the leading commercial tools in an adjusted comparison.","implications":["Challenging your own findings is the part that matters, because an unchallenged reviewer optimises for volume and a human then pays for every false positive."],"evidence_boundary":"The benchmark is Code-Review-Bench and the results are self-reported by the tool's authors, with the adjusted comparison defined by them.","watch_conditions":["The condition to watch is whether an independent run reproduces the recall figure on unseen pull requests, because a reviewer evaluated on a public benchmark faces exactly the optimisation problem its own challenge step is meant to catch."],"related_records":[{"url":"https://newruntime.com/patterns/verification-bandwidth-is-the-scarce-resource","relation":"Existing pattern on review capacity as the constraint."},{"url":"https://newruntime.com/posts/a-three-person-team-shipping-hundreds-of-prs-moves-the-bottleneck-to-review","relation":"Prior coverage of the review bottleneck in practice."},{"url":"https://newruntime.com/topics/coding-agents","relation":"Topic hub for the code review layer."}]},"routes":{"html":"https://newruntime.com/posts/agent-builder-ops-adds-review-mocks-cost-controls-and-secure-workflows/","markdown":"https://newruntime.com/posts/agent-builder-ops-adds-review-mocks-cost-controls-and-secure-workflows.md","json":"https://newruntime.com/posts/agent-builder-ops-adds-review-mocks-cost-controls-and-secure-workflows.json"},"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"next_reads":[{"type":"topic","path":"/topics/coding-agents/","url":"https://newruntime.com/topics/coding-agents/","title":"Coding Agents","reason":"Explore the coding-agents topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/coding-agents.md","json_url":"https://newruntime.com/topics/coding-agents.json"},{"type":"topic","path":"/topics/evals/","url":"https://newruntime.com/topics/evals/","title":"Evals","reason":"Explore the evals topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/evals.md","json_url":"https://newruntime.com/topics/evals.json"},{"type":"topic","path":"/topics/security/","url":"https://newruntime.com/topics/security/","title":"Security","reason":"Explore the security topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/security.md","json_url":"https://newruntime.com/topics/security.json"},{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}