.coderabbit.yaml

# CodeRabbit configuration — https://docs.coderabbit.ai/guides/configure-coderabbit
# The CodeRabbit GitHub App is already installed on this repo and reviews every
# PR on creation. This file only tunes that behavior; it is not required for the
# bot to run.
#
# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
language: "en-US"
early_access: false

# The review voice: a panel of senior domain experts, not a linter.
# Brevity is a hard requirement (owner directive 2026-07-20): comment ONLY
# when a finding would change what gets merged.
tone_instructions: >-
  Comment only on findings that change what gets merged: a bug, a violated house rule, a real risk. Max three sentences each: failure mode, line, fix. No praise, no diff restating, no style nits, no emojis.

reviews:
  # "chill" keeps the bot from blocking merges — it comments, it does not gate.
  # Hard gating lives in CI (security.yml) and the constitution's human bar.
  profile: chill
  request_changes_workflow: false
  # Keep the walkthrough minimal: a short summary, no diagrams, no per-push
  # status chatter, collapsed by default (owner: no fluff on PRs).
  high_level_summary: true
  high_level_summary_instructions: >-
    Three sentences maximum: what changed, why, and any risk worth a human
    look. No diagrams, no sketches, no file-by-file narration.
  sequence_diagrams: false
  collapse_walkthrough: true
  review_status: false
  poem: false

  auto_review:
    enabled: true
    # Match the constitution: drafts are work-in-progress, don't burn review
    # cycles on them. PRs flip to ready → CodeRabbit reviews.
    drafts: false
    base_branches:
      - main

  # Skip generated / vendored / binary paths so the review stays high-signal.
  path_filters:
    - "!**/*.lock"
    - "!**/bun.lock"
    - "!**/uv.lock"
    - "!**/dist/**"
    - "!**/build/**"
    - "!frontend/src-tauri/target/**"
    - "!**/*.min.js"
    - "!**/*.svg"
    - "!**/*.png"
    - "!**/*.wav"
    - "!**/*.onnx"
    - "!tests/fixtures/**"

  # One expert lens per subsystem — encode what a passionate senior in each
  # domain would actually check, beyond what linters and CI already gate.
  path_instructions:
    - path: "**/*.{py,rs,js,jsx,ts,tsx}"
      instructions: >-
        OmniVoice is fully-local (no cloud, no API keys, no telemetry). Flag any
        new outbound network call that is not to github.com issues, a HuggingFace
        model download, or an explicitly opt-in endpoint. Flag any code that
        persists or logs values matching *TOKEN*/*KEY*/*SECRET* or absolute user
        home paths (/Users/<name>/, C:\\Users\\<name>\\).
    - path: "backend/services/**/*.py"
      instructions: >-
        Review as an ML-inference/audio engineer. Check: thread-safety of model
        and cache state across the GPU worker pool; device/dtype assumptions
        that break on one of CUDA/MPS/ROCm/CPU; VRAM lifecycle (load/unload,
        leaks on the error path); sample-rate, channel-count and tensor-shape
        assumptions at engine boundaries; blocking calls inside async paths;
        model download/cache behavior when offline. Engine code must stay
        backward-compatible with already-installed on-disk model state.
    - path: "backend/**/*.py"
      instructions: >-
        Default features must behave identically on macOS, Windows and Linux.
        Platform-specific implementation is allowed, but a divergent user-visible
        default is a P0 bug — flag it and suggest an opt-in (Settings/env/flag).
        Any DB schema change must go through an alembic migration with an upgrade
        path; flag direct schema edits. The backend serves loopback HTTP: treat
        every query/path/form param as hostile (path traversal, log injection,
        CSRF from a browser tab), and never route user-chosen filesystem
        destinations through HTTP — that authorization belongs in the Tauri
        process.
    - path: "frontend/src/**/*.{js,jsx,ts,tsx}"
      instructions: >-
        Review as a product-minded senior frontend engineer. Check: stale state
        and races (async results landing after unmount or after newer requests);
        every user-visible failure has an actionable, non-technical error
        message; loading/disabled states during long operations. Every new
        user-facing string must be an i18n t('...') key present in ALL 21
        frontend/src/i18n/locales/*.json files — flag hardcoded UI strings and
        keys missing from any locale.
    - path: "frontend/src-tauri/**/*.rs"
      instructions: >-
        Review as a desktop-systems engineer. Check: every #[tauri::command] is
        callable from the webview — validate inputs and scope filesystem/process
        access accordingly; window and webview lifecycle on all three OSes;
        child-process spawn/exit-code/stderr handling; no unwrap/expect on
        user-controlled input; platform cfg blocks keep user-visible defaults
        identical across macOS/Windows/Linux. The parity rule covers BEHAVIOUR,
        not PERFORMANCE: hardware acceleration is host-dependent by design
        (CUDA/MPS/DirectML, Triton availability, torch.compile), so an
        optimization skipped where it cannot work is NOT a parity violation and
        must not be reported as one.
    - path: "tests/**/*.py"
      instructions: >-
        Review as a test-infrastructure engineer. Check: the test would fail
        before the fix and pass after (no tautologies); no sleeps as
        synchronization; no module-level imports of app modules that go stale
        under sys.modules pollution (resolve at run time); TestClient instances
        are function-scoped and not lifespan-bound unless the test needs it;
        new functional CJK is allowlisted in tests/test_no_hardcoded_cjk.py with
        a justification.
    - path: ".github/workflows/**"
      instructions: >-
        Pin actions to a major version tag at minimum. Flag any workflow that
        grants write permissions it does not need.
    - path: "CHANGELOG.md"
      instructions: >-
        Hard rule (owner-restyled 2026-07-17): the Unreleased section is a
        short **Highlights** bullet list followed by ### Changed/Added/Docs/
        Fixed sections whose entries are each a SINGLE one-liner ending with
        the (#NNN) ref and, for community contributions, a "— thanks @user!"
        credit. Flag multi-line or bold-lead paragraph entries, missing refs,
        and missing credits.
    - path: "frontend/package.json"
      instructions: >-
        This is a bun workspace monorepo: any dependency change here requires
        regenerating the repo-root bun.lock in the same PR —
        deploy/Dockerfile runs `bun install --frozen-lockfile`, so CI-green
        does not imply Docker-green. Flag package.json dependency changes
        without a matching root bun.lock diff. Also: this file is the single
        source of truth for the app version — flag any version change not
        mirrored in pyproject.toml, frontend/src-tauri/Cargo.toml and
        backend/core/version.py in lockstep.

  # Non-gating pre-merge audits of the project's hard rules (warning mode —
  # the human owner is the gate, these make the checklist visible per-PR).
  pre_merge_checks:
    title:
      mode: warning
      requirements: >-
        Conventional-commit style with scope, e.g. "fix(dub): …", and the issue
        reference in title or body. Never propose a version bump.
    issue_assessment:
      mode: warning
    custom_checks:
      - name: "Cross-platform default parity"
        mode: warning
        instructions: >-
          If the PR changes any default-mode (out-of-the-box) behavior, verify
          it behaves identically on macOS, Windows and Linux, or is moved behind
          an explicit opt-in (Settings toggle, env var, or CLI flag). A
          platform-divergent default is a P0 per CLAUDE.md — fail this check
          and say which platform diverges.
      - name: "i18n completeness (21 locales)"
        mode: warning
        instructions: >-
          For every new or changed t('...') key in frontend code, verify the
          key exists in all 21 files under frontend/src/i18n/locales/. List any
          locale files missing the key. Also flag hardcoded user-facing strings
          that bypass i18n entirely.
      - name: "Local-first guarantee"
        mode: warning
        instructions: >-
          Verify the PR adds no required cloud calls, accounts, API keys or
          telemetry. Outbound traffic is only allowed to GitHub Issues (opt-in
          bug reporting) and HuggingFace model downloads. The app must remain
          fully functional offline and with reporting disabled.
      - name: "Backward compatibility"
        mode: warning
        instructions: >-
          Verify existing omnivoice_data/ (voices, projects, settings) and
          already-installed engine model state keep working without manual
          migration. Any DB schema change must ship an alembic migration with
          an upgrade path. Flag anything that would force users to reinstall an
          engine or re-download model weights.

  finishing_touches:
    docstrings:
      enabled: false
    unit_tests:
      enabled: false

# Feed the bot the project constitution and docs, and let it accumulate
# learnings from review conversations ("@coderabbitai always/never …").
knowledge_base:
  code_guidelines:
    enabled: true
    filePatterns:
      - "CLAUDE.md"
      - "docs/**/*.md"
  learnings:
    scope: auto
  issues:
    scope: auto
  pull_requests:
    scope: auto

chat:
  auto_reply: true