# Adversarial AI Code Review

## How It Works

Every PR triggers an independent AI review. The reviewing AI is different
from the AI that wrote the code (segregation of duty).

The pipeline:
1. PR opened against main
2. CI extracts the Python diff
3. Diff sent to an OpenAI-compatible LLM endpoint
4. LLM reviews for: security, correctness, performance, style, causal reasoning
5. Structured review posted as a PR comment
6. Operator makes final merge decision

## Current State: DISABLED

Pipeline is built and ready. Activation requires:

1. Local LLM server running (vLLM, Ollama, or LM Studio)
2. GitHub repo > Settings > Secrets and variables > Actions:
   - Variable: `ADVERSARIAL_REVIEW_ENABLED` = `true`
   - Variable: `REVIEW_MODEL` = `deepseek-coder` (or your model)
   - Secret: `REVIEW_API_BASE` = `http://<server>:8000/v1`
   - Secret: `REVIEW_API_KEY` = `not-needed` (for local)
3. Connectivity: local server reachable from GitHub Actions via
   self-hosted runner, Tailscale tunnel, or Cloudflare tunnel.
   Alternative: use OpenAI/DeepSeek cloud API temporarily.

## What It Reviews

| Category | Examples |
|----------|----------|
| security | injection, hardcoded secrets, auth bypass |
| correctness | logic errors, race conditions, edge cases |
| performance | O(n^2) where O(n) suffices, missing caching |
| style | naming, dead code, complexity |
| causal_reasoning | invalid d-separation, missing confounders |

## When Local Hardware Arrives

1. Install vLLM: `pip install vllm`
2. Serve model: `vllm serve deepseek-ai/deepseek-coder-v2`
3. Set `REVIEW_API_BASE=http://localhost:8000/v1`
4. Install GitHub Actions self-hosted runner on local machine
5. Set `ADVERSARIAL_REVIEW_ENABLED=true` > reviews go live
