AthenaDev

{
  "permissions": {
    "allow": [
      "Bash(npm:*)",
      "Bash(go test:*)",
      "Bash(git status)",
      "Bash(git diff:*)",
      "Bash(./scripts/dev-cli:*)"
    ],
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(git push --force:*)",
      "Bash(git push -f:*)",
      "Bash(psql:*drop*)",
      "Bash(make deploy:*)"
    ],
    "ask": [
      "Bash(git push:*)",
      "Bash(./scripts/migrate:*)"
    ]
  },
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [{
          "type": "command",
          "command": "./scripts/run-precommit.sh"
        }]
      }
    ]
  }
}

server.tool(
  "linear_search_issues",
  "Search Linear issues with the current user's permissions.",
  {
    query: z.string().describe("Linear search query syntax"),
    limit: z.number().int().min(1).max(50).default(20),
  },
  async ({ query, limit }, { session }) => {
    // session.linearToken is the user's OAuth token, not a service account.
    const client = new LinearClient({ accessToken: session.linearToken });
    const issues = await client.issues({ filter: parseQuery(query), first: limit });

    audit.log({
      tool: "linear_search_issues",
      userId: session.userId,
      query,
      resultCount: issues.nodes.length,
    });

    return issues.nodes.map((i) => ({
      id: i.identifier,
      title: i.title,
      state: i.state?.name,
      url: i.url,
    }));
  }
);

-- Single query: BM25 + dense vector + ACL.
-- :q_tsv = websearch_to_tsquery('russian', :user_query)
-- :q_emb = embedding(:user_query)
-- :user_clearance = associate | partner

WITH bm25 AS (
  SELECT chunk_id,
         ts_rank_cd(content_tsv, :q_tsv) AS bm25_score
  FROM chunks
  WHERE content_tsv @@ :q_tsv
    AND access_level <= :user_clearance
  ORDER BY bm25_score DESC
  LIMIT 100
),
dense AS (
  SELECT chunk_id,
         1 - (embedding <=> :q_emb) AS dense_score
  FROM chunks
  WHERE access_level <= :user_clearance
  ORDER BY embedding <=> :q_emb
  LIMIT 100
)
SELECT c.chunk_id, c.content, c.source_doc, c.page,
       COALESCE(b.bm25_score, 0) * 0.3 +
       COALESCE(d.dense_score, 0) * 0.7 AS hybrid_score
FROM chunks c
LEFT JOIN bm25 b USING (chunk_id)
LEFT JOIN dense d USING (chunk_id)
WHERE b.chunk_id IS NOT NULL OR d.chunk_id IS NOT NULL
ORDER BY hybrid_score DESC
LIMIT 20;

class Citation(BaseModel):
    chunk_id: str
    source_doc: str
    page: int
    quote: str = Field(min_length=10)

class RagAnswer(BaseModel):
    answer: str
    citations: list[Citation] = Field(min_length=1)
    confidence: Literal["high", "medium", "low"]

def validate_grounding(answer: RagAnswer, retrieved: set[str]) -> None:
    """Reject answers that cite chunks not in the retrieved set."""
    unknown = [c.chunk_id for c in answer.citations if c.chunk_id not in retrieved]
    if unknown:
        raise UngroundedResponseError(
            f"Citations refer to chunks not retrieved: {unknown}. "
            "Possible hallucination — refusing to surface to user."
        )

name: AI code review

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with: { node-version: "20" }

      - name: Classify risk tier
        id: tier
        run: node scripts/risk-tier.mjs >> "$GITHUB_OUTPUT"

      - name: Strip secrets from diff
        run: node scripts/scrub-secrets.mjs > /tmp/diff.txt

      - name: Run AI reviewer
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          RISK_TIER: ${{ steps.tier.outputs.tier }}
        run: node scripts/review.mjs /tmp/diff.txt

const HIGH_RISK_PATHS = [
  /^src\/auth\//,
  /^src\/billing\//,
  /^src\/payments\//,
  /^migrations\//,
  /\.env(\..+)?$/,
];

const LOW_RISK_PATHS = [
  /\.test\.tsx?$/,
  /^docs\//,
  /^\.github\/workflows\//,
];

export function classifyTier(changedFiles: string[]): "high" | "normal" | "low" {
  if (changedFiles.some((f) => HIGH_RISK_PATHS.some((re) => re.test(f)))) {
    return "high";
  }
  if (changedFiles.every((f) => LOW_RISK_PATHS.some((re) => re.test(f)))) {
    return "low";
  }
  return "normal";
}