Service Layer

async def process_pr_review(
    self, 
    payload: dict,           # GitHub webhook payload
    event: Event,            # Database event record
    db: AsyncSession,        # Database session
    github_token: str | None = None
) -> dict:

async def _read_file(self, path: str) -> str:
    content = await github_client.get_file_content(
        self.owner, self.repo, path, self.head_sha
    )
    if len(content) > 8000:
        content = content[:8000] + "\n# ... (truncated at 8,000 chars)"
    ext = path.rsplit(".", 1)[-1].lower()
    return f"### {path}\n```{ext}\n{content}\n```"

async def _get_file_history(self, paths: list[str]) -> str:
    experts, related = await asyncio.gather(
        graph_builder.get_file_experts(self.repo_full_name, paths[:10], top_k=5),
        graph_builder.get_related_prs(self.repo_full_name, paths[:10], top_k=5),
    )
    
    lines = []
    if experts:
        lines.append("File experts (most commits on these files):")
        for e in experts:
            lines.append(f"  @{e['login']} — {e['touch_count']} PRs")
    
    if related:
        lines.append("Related past PRs:")
        for p in related:
            lines.append(
                f"  PR #{p['number']} [{p['verdict']}] "
                f"by @{p['author']}: {p['title']}"
            )
    
    return "\n".join(lines)

_ISSUE_REF_PATTERN = re.compile(
    r"(?:^|(?<=\s))(?:fixes|closes|resolves)\s+#(\d+)",
    re.IGNORECASE | re.MULTILINE,
)

def _parse_issue_refs(pr_body: str, pr_title: str) -> list[int]:
    text = f"{pr_title or ''} {pr_body or ''}"
    matches = _ISSUE_REF_PATTERN.findall(text)
    return list(dict.fromkeys(int(m) for m in matches))

def _build_line_map(files: list[dict]) -> dict[str, dict[str, int]]:
    line_map = {}
    for f in files:
        patch = f.get("patch", "")
        filename = f.get("filename", "")
        mapping = {}
        
        for patch_line in patch.splitlines():
            if patch_line.startswith("@@"):
                # Parse hunk header: @@ -10,5 +12,7 @@
                m = re.search(r"\+(\d+)", patch_line)
                if m:
                    current_right_line = int(m.group(1)) - 1
            elif patch_line.startswith("+"):
                current_right_line += 1
                content = patch_line[1:]  # Strip leading '+'
                stripped = content.strip()
                if stripped:
                    mapping[content] = current_right_line
                    mapping[stripped] = current_right_line
                    mapping[_normalize_ws(stripped)] = current_right_line
        
        line_map[filename] = mapping
    return line_map

messages = [{"role": "user", "content": initial_prompt}]

for round_num in range(max_rounds):  # Safety cap at 8 rounds
    response = await self.client.messages.create(
        model=self.model,
        max_tokens=4000,
        tools=REVIEW_TOOLS,
        messages=messages,
    )
    
    if response.stop_reason == "end_turn":
        raw_text = "".join(b.text for b in response.content if hasattr(b, "text"))
        break
    
    if response.stop_reason == "tool_use":
        messages.append({"role": "assistant", "content": response.content})
        
        tool_results = []
        for block in response.content:
            if block.type != "tool_use":
                continue
            result = await tool_executor.execute(block.name, block.input)
            tool_results.append({
                "type": "tool_result",
                "tool_use_id": block.id,
                "content": result,
            })
        
        messages.append({"role": "user", "content": tool_results})
        continue

return self._parse_output(raw_text)

SECURITY_AGENT_PROMPT = """You are a specialized security code reviewer.
Focus EXCLUSIVELY on security issues:
- Injection vulnerabilities (SQL, command, path traversal, SSRF)
- Authentication and authorization flaws
- Secrets/credentials accidentally committed
- Input validation gaps at trust boundaries
- Cryptographic weaknesses

For each issue: severity (CRITICAL/HIGH/MEDIUM/LOW), file:line, risk, fix.
If no security issues: say "No security issues found"
"""

PERFORMANCE_AGENT_PROMPT = """You are a specialized performance code reviewer.
Focus EXCLUSIVELY on performance issues:
- N+1 database queries (loop + individual queries)
- Missing indexes or inefficient query patterns
- Unbounded loops or O(n²)+ algorithms
- Memory leaks (unclosed resources, unbounded caches)
- Blocking I/O in async contexts

For each issue: impact (HIGH/MEDIUM/LOW), file:line, bottleneck, fix.
If no performance issues: say "No performance issues found"
"""

STYLE_AGENT_PROMPT = """You are a specialized code quality reviewer.
Focus EXCLUSIVELY on code quality, tests, and maintainability:
- Missing or inadequate test coverage
- Functions/methods that are too complex (>20 lines, deep nesting)
- Unclear variable/function naming
- Missing error handling
- Dead code, unused imports
- API contract breakages

For each issue: severity (HIGH/MEDIUM/LOW), file:line, issue, fix.
If no style issues: say "No style issues found"
"""

async def _synthesize_review(
    self,
    pr: dict,
    diff: str,
    files: list[dict],
    security_findings: str,
    performance_findings: str,
    style_findings: str,
    issue_refs: list[int] | None,
) -> dict:
    synthesis_prompt = f"""You are the final synthesizer.
    Three specialized agents analyzed PR #{pr['number']}.
    
    SECURITY: {security_findings}
    PERFORMANCE: {performance_findings}
    STYLE: {style_findings}
    
    Produce a unified review with:
    - verdict: "approved" | "changes_requested" | "comment"
    - summary: 2-3 sentence overall assessment
    - inline_comments: max 8, most impactful only
    
    Rules:
    - verdict = "changes_requested" if ANY critical/high security or performance issue
    - verdict = "approved" if only low/medium style issues
    - Deduplicate if multiple agents flagged the same issue
    """
    
    response = await self.client.messages.create(
        model=self.model,
        max_tokens=3000,
        messages=[{"role": "user", "content": synthesis_prompt}],
    )
    
    return json.loads(response.content[0].text)

def _parse_output(self, raw_text: str) -> PRReviewResult:
    # Extract suggestions
    suggestions_match = re.search(r"<suggestions>\s*(.*?)\s*</suggestions>", raw_text, re.DOTALL)
    inline_comments = []
    if suggestions_match:
        parsed = json.loads(suggestions_match.group(1))
        inline_comments = parsed[:6]  # Cap at 6
    
    # Extract semantic issues
    semantic_match = re.search(r"<semantic_issues>\s*(.*?)\s*</semantic_issues>", raw_text, re.DOTALL)
    semantic_issue_matches = []
    if semantic_match:
        parsed = json.loads(semantic_match.group(1))
        semantic_issue_matches = [
            m for m in parsed
            if m.get("confidence") in ("high", "medium")
        ][:5]
    
    # Strip tagged blocks from prose
    prose = re.sub(r"<suggestions>.*?</suggestions>", "", raw_text, flags=re.DOTALL)
    prose = re.sub(r"<semantic_issues>.*?</semantic_issues>", "", prose, flags=re.DOTALL).strip()
    
    # Extract verdict
    verdict = "NEEDS_DISCUSSION"
    if "**APPROVE**" in prose:
        verdict = "APPROVE"
    elif "**REQUEST_CHANGES**" in prose:
        verdict = "REQUEST_CHANGES"
    
    return PRReviewResult(
        summary=prose,
        verdict=verdict,
        inline_comments=inline_comments,
        semantic_issue_matches=semantic_issue_matches,
    )

PROJECT INTELLIGENCE:
- All auth routes require JWT middleware
- Use Pydantic for config, not raw env vars
- API responses must follow {data, error} shape

DEVELOPER CONTEXT (alice):
- Tends to forget error handling in edge cases
- Writes excellent docstrings
- Prefers functional patterns over OOP

FILE EXPERTS (developers who frequently touch these files):
- bob (12 PRs)
- alice (8 PRs)

RELATED PAST PRs (touched same files):
- PR #145 [APPROVE] by bob: Refactor JWT token validation
- PR #132 [REQUEST_CHANGES] by alice: Add token refresh endpoint

⚠️  OPEN PRs TOUCHING THE SAME FILES (potential conflicts):
- PR #167 by charlie: Update auth middleware — shared files: app/auth/jwt_utils.py