We built an AI PR reviewer. The hard part was teaching it to say nothing.

What it is

An engineering writeup of IONIX's in-house agentic PR reviewer: a job in a shared CircleCI orb that reviews the diff and posts to Bitbucket, tuned to say nothing on a clean PR. The core design goal is that comments are rare enough a human reads every one. The reviewer runs OpenAI's Codex CLI pointed at a model self-hosted on Azure AI Foundry — deliberately a different stack from their AI authoring tools.

How it works

Two insights the summary doesn't carry:

• Adversarial context, not model choice, is the load-bearing idea. Asking the same Claude session that wrote the code to review it failed — it missed critical bugs confidently, because it had already reasoned itself into believing the code was correct. The reviewer must run from a context that was never told why the code is right: no design discussion, no ticket, no sunk cost. Its prompt opens: "You are an independent, senior code reviewer... You did NOT write this code and have no prior context on it."
• The prompt spends more words on suppression than detection. It reports only two things at critical/high severity: major exploitable security vulns (injection, auth/authz bypass, exposed secrets, SSRF, path traversal, unsafe deserialization, dangerous crypto misuse) and functional bugs (incorrect behaviour, crash, hang, data loss on plausible input). The hard-rule drop list: style, docs, test coverage, complexity/refactoring, and anything phrased as "consider", "might want to", "nit", or rated medium/low. "When in doubt, DROP IT."

The two-mode state machine reads the reviewer's own prior comments back off the PR, turning a re-push into a cheap re-check rather than a fresh second opinion.

What to do

If you're evaluating build-vs-buy for AI review, the transferable design rules:

• Run the reviewer from a fresh, empty context on a different toolchain than whatever wrote the code — shared context inherits the author's reasoning and blinds the review.
• Make the noise budget an explicit, editable artifact (a file/prompt), and weight it toward suppression; lenses as markdown.
• Self-host the model (per-deployment keys, quotas, spend alerts) if diffs+context leaving your network is unacceptable — relevant for anyone whose product touches attack surface.

Caveats

The post is explicit that this does not argue build beats buy in general — only that when the one dial you need is the one a product won't expose, price stops being the deciding factor. Claimed economics ("~80% of a commercial product's value for 20% of the cost") are the vendor's own, unquantified. The dropped alternatives were Atlassian Rovo and Claude Code's review module (cited at +$15–25); no accuracy benchmarks are given.