Gitvora capabilities

Gitvora is AI code governance for GitHub pull requests. When a PR opens or someone runs a bot command, Gitvora fetches the cumulative diff (all commits vs base), routes it through Ollama or OpenRouter, scores risk, and posts findings back to GitHub.

1. Webhook, bot command, or dashboard triggers a review job
2. PR refreshed from GitHub — latest HEAD, files, and commits
3. AI routed local vs cloud; findings parsed and validated against the diff
4. Formatted PR comment + optional GitHub Check Run (open PRs only)
5. Dashboard shows live progress, findings (open/fixed), timestamps, audit trail

Install the GitHub App on your org or account. PR comments use @gitvora-bot.

When commands work

On-demand reviews always use the full PR diff at current HEAD — not a single commit. New pushes on an open PR are included when you re-run a review.

Enable/disable each type and assign models in Infrastructure. Trigger from GitHub comments or the PR detail page.

Bot comment format

• Summary table — verdict, risk, lines, files, commits, HEAD SHA, model, runtime, tokens
• Findings as markdown headings (severity · type · file:line)
• Collapsible review metadata block
• Note when hallucinated findings were dropped (wrong file/line)

Today Gitvora reviews are diff-first: the model sees patches, commits, and repo name. It infers framework from file extensions — not from package.json, path rules, or related files.

Reviews run in a background worker (BullMQ). The webhook returns immediately; inference is async so proxy timeouts do not block reviews.

Inference modes

Auto routing — decision order

When a review action's tier is Auto, conditions are evaluated top to bottom; first match wins:

Groq free-tier models

Full catalog with RPM / RPD / TPM / TPD lives in Infrastructure → model-catalog (DB-backed, refreshed on seed).

Cloud provider routing

Quality safeguards

• Findings validated against the diff — bogus line numbers dropped
• Temperature 0.1 for consistent JSON output
• Webhook dedup: same PR + type + HEAD SHA skips duplicate auto-review
• Pending duplicate review jobs cancelled when a newer one is queued
• Groq 429 rate limits retried up to 3× with Retry-After header

All models are configurable in Infrastructure. Nothing is hardcoded at runtime — use dropdowns or type any slug.

Ollama local (self-hosted)

Large PRs are split into multiple inference calls so each stays within model context and completes before proxy timeouts.

Multiple small files are batched into one chunk until the line/char budget is reached (avoids one API call per file). Large hunks split by class/function boundaries. Findings merge into one GitHub comment.

Long Ollama runs behind Cloudflare can hit 524 timeout when the origin sends no bytes until generation finishes. Gitvora avoids this with streaming.

Model Lab is a chat-style sandbox for testing inference without opening a PR. Power user role required.

• Auto — same routing logic as production reviews
• Local — pick any pulled Ollama model; compare 3b vs 7b quality
• Cloud — Groq models have no slash; OpenRouter models use provider/model format
• Stream off — single blocking response (still streams Ollama server-side when tier is Local)

Power users can toggle a repo off on the Repositories page. This pauses automatic reviews without uninstalling the GitHub App.

Admins can Remove a repo to fully deactivate it in Gitvora (reviews, bot commands, scans). Use Restore to re-enable after adding it back on GitHub.

Admins can deactivate resources from Gitvora. GitHub App install is unchanged until you also update GitHub settings. The dashboard shows next steps after each action.

Use Channels only — each Slack webhook has scope (global, org, repo, or pattern) and event checkboxes. Routing rules are for AI model routing, not Slack.

Channel Test sends immediately; live review events use the notify queue. If Test works but reviews do not alert, check Observability → notifications log. See docs: Slack Workflows (escalation, digests) and GitHub CI vs Gitvora checks.

Gitvora shows estimated review duration from model + diff size + recent audit history. Estimates refine as more reviews complete.

Heuristic baselines: 3b on CPU, 7b on GPU, Groq/OpenRouter vary by model. Large PRs are chunked — estimates account for chunk count.

Active prompts live in the database (PromptVersion). Package defaults are in packages/prompts/src/templates.ts.

Production reviews always use the active DB prompt, not the file directly.

After a review, developers may push fixes. Gitvora tracks whether prior findings were acted on when a re-review runs (auto on push if Re-review on push is enabled, or manual trigger).

What you see

“Fixed” is a heuristic from diff + re-review — not GitHub thread resolution. Existing findings default to OPEN until the next re-review reconciles them.

Without GitHub Team branch protection, a failed Gitvora Review check still signals blockers on free orgs. Optionally submits REQUEST_CHANGES on GitHub.

Admins issue a one-time override token from the PR detail page; developer posts @gitvora-bot override <token> (open PRs only).

Legacy redirects: /dashboard/ai → Infrastructure, /dashboard/audit → Observability.

GitHub App installers can be auto-approved and granted dashboard access so org admins see repos without manual contributor setup.

Full technical reference in the monorepo docs/ folder (same content as this guide, plus setup/deploy detail):

• SYSTEM.md— Master guide — how everything works (current + planned)
• CAPABILITIES.md— Product guide (markdown source)
• CONTEXT_AWARE_REVIEWS.md— Context gap & roadmap vs competitors
• SETUP.md— Install and first run
• ARCHITECTURE.md— Data flow and deployment
• GITHUB_APP.md— Permissions and webhooks
• BOT_COMMANDS.md— Bot reference
• ACCESS_CONTROL.md— Approvals and blocking
• ENV.md— Environment variables
• OBSERVABILITY.md— Health checks and logs