The Reporter collects results from all layers into one structured PR comment. Rather than scattering findings across multiple bot comments, VCR produces a single, scannable summary that guides both human reviewers and automated workflows.
PR Comment Format
Every PR receives exactly one VCR comment. The format is consistent across all risk levels, so reviewers always know where to look.
## 🔍 Visdom Code Review | Risk: HIGH
### Summary
This PR modifies authentication middleware and adds a new API endpoint.
Layer 3 deep review was triggered (critical path + coverage drop).
### 🚨 Blocking (must fix)
| # | Severity | Category | File | Finding |
|---|----------|----------|------|---------|
| 1 | CRITICAL | Security | auth.ts:42 | SQL injection via unsanitized input |
| 2 | HIGH | Testing | - | No tests for new /api/reset endpoint |
### ⚠️ Recommendations (should fix)
| # | Severity | Category | File | Finding |
|---|----------|----------|------|---------|
| 3 | MEDIUM | Performance | users.ts:88 | N+1 query in loop |
| 4 | MEDIUM | Circular Test | auth.test.ts | Tests mirror implementation, don't verify spec |
### 💡 Suggestions (nice to have)
- Consider extracting validation logic to shared utility (auth.ts:30-45)
### 📊 Stats
- Files reviewed: 8 | Lines changed: +142 / -38
- Coverage delta: -2.3% (67.2% → 64.9%)
- Layers: L1 ✅ → L2 (HIGH) → L3 (Security, Performance, Testing, Architecture)
- AI-generated code detected: Yes (confidence: 0.82)
- TORS: 94% (2 flaky tests excluded from signal)
### 🧑💻 Reviewer Guidance
Focus your review on: **auth.ts** (security findings) and **test coverage gap**.
Suggested reviewer: @senior-krakow (top expertise for this module).Inline Comments
In addition to the summary comment, VCR posts inline comments on specific PR lines, directly where the problem is. Each inline comment includes category, severity, and a concrete fix suggestion.
⚠️ Hard Cap
Maximum 15 inline comments per PR (configurable via reporter.max_inline_comments).
This prevents notification flood and keeps signal-to-noise high.
Output Channels
VCR supports multiple output channels. All channels are configurable in
vcr-config.yaml.
| Channel | When | Format |
|---|---|---|
| PR Comment | Always | Markdown summary |
| PR Inline Comments | Always | Per-finding inline |
| GitHub Check | Always | Pass/Fail status check |
| Slack notification | Configurable | Summary + PR link |
| Metrics export | Always | JSON for dashboard/tracking |