Changelog

The six commands that parsed but answered "not live yet" now do the thing they name. `summary` rewrites the walkthrough without re-running the finder, `resolve` closes our threads and records them user-resolved so they stay closed, `pause`, `resume`, and `ignore` control automatic review per pull request (an `@superdiffs ignore` in the PR description works too), and `config` posts the effective configuration for the repository.

• AddedAll six remaining bot commands are live: `summary`, `resolve`, `pause`, `resume`, `ignore`, `config`.
• Added`@superdiffs ignore` may now be placed in the pull-request description — the one surface an outside author controls, and the one directive it may carry.
• Added`@superdiffs config` posts the resolved configuration with the source of each value, from the last-known-good cache a review records.
• ChangedThe help table no longer marks any command "coming soon"; the live list is now derived from the contract itself.
• FixedThe in-memory store (the keyless dev twin) stopped wiping a repository’s cached configuration on every webhook event, matching Postgres upsert semantics.

First cut of the whole path — diff parsing, triage, multi-pass finding, evidence-grounded verification, fingerprint dedupe, ranking, and a batched GitHub review. Running against our own repositories only. No public sign-up, no published accuracy numbers yet: the benchmark methodology is published, the first run is not.

• AddedReview pipeline: triage → find (1–5 passes by profile) → vote → verify → dedupe → rank, with every stage independently replayable from a stored trace.
• AddedEvidence grounding: a finding whose quoted snippet does not appear in the diff or the file it claims to be in is dropped rather than posted with a caveat.
• AddedFingerprint matching (strong: content-addressed; weak: rule + path + line) so a resolved comment is not posted again on the next push.
• Added`.superdiffs.yaml` configuration: org → repo → directory layering, with file-count and comment caps where the lowest layer wins.
• AddedBot commands (`@superdiffs review`, `full-review`, `summary`, `resolve`, `pause`, `resume`, `ignore`, `config`, `help`), authorized by the actor’s repository permission rather than by the text of the comment.
• SecuritySandboxed execution with a default-deny egress policy. The only credential that crosses into the sandbox is a one-hour, single-repository, contents-read token that cannot post.
• SecurityTwo-way sanitization: invisible-character stripping and structural delimiting on everything a model reads; image, raw-HTML, and foreign-link stripping on everything we post.
• NoiseDefault profile is `balanced`: 3 find passes, minor-and-above posted, 20 comments maximum per review, nits collapsed into one section.