Changelog

First cut of the whole path — diff parsing, triage, multi-pass finding, evidence-grounded verification, fingerprint dedupe, ranking, and a batched GitHub review. Running against our own repositories only. No public sign-up, no published accuracy numbers yet: the benchmark methodology is published, the first run is not.

• AddedReview pipeline: triage → find (1–5 passes by profile) → vote → verify → dedupe → rank, with every stage independently replayable from a stored trace.
• AddedEvidence grounding: a finding whose quoted snippet does not appear in the diff or the file it claims to be in is dropped rather than posted with a caveat.
• AddedFingerprint matching (strong: content-addressed; weak: rule + path + line) so a resolved comment is not posted again on the next push.
• Added`.superdiffs.yaml` configuration: org → repo → directory layering, with file-count and comment caps where the lowest layer wins.
• AddedBot commands (`@superdiffs review`, `full-review`, `summary`, `resolve`, `pause`, `resume`, `ignore`, `config`, `help`), authorized by the actor’s repository permission rather than by the text of the comment.
• SecuritySandboxed execution with a default-deny egress policy. The only credential that crosses into the sandbox is a one-hour, single-repository, contents-read token that cannot post.
• SecurityTwo-way sanitization: invisible-character stripping and structural delimiting on everything a model reads; image, raw-HTML, and foreign-link stripping on everything we post.
• NoiseDefault profile is `balanced`: 3 find passes, minor-and-above posted, 20 comments maximum per review, nits collapsed into one section.