Multi-Pass Code Review

Every change clears contract checking, blast-radius validation and signed ratification before it merges. Nothing reaches production on assertion alone.

Tier 1 · Contracts

Signatures checked before anything else runs

The cheapest pass goes first. Interface and type-level contracts are verified in a fifth of a second, so a broken signature never consumes a full review cycle.

tier 1 — contract
▶ contract check — 42 exported symbols
signature parity ok
nullability ok
consumer contracts 2 checked
✔ passed in 0.2s

Tier 2 · Coherence

Impact measured across the whole graph

The change is walked outward through its dependents to find what it actually touches — including the governance and QA structures attached to the code, not just the imports.

tier 2 — blast radius
files changed6
direct dependents14
second-hop31
architectural breaks0
schema drift1 warning

The passes

Three tiers, in cost order

Each tier is cheaper than the one after it, so the common failures are caught first and the expensive analysis only runs on changes that have earned it.

0.2s

Contract

Type and interface parity against every declared consumer.

0.4s

Coherence

Blast radius, cross-file side effects and regression cover.

Human

Ratification

A person rules on anything the first two tiers escalated.

Merge

Nonce

The signed record of what was checked, and by whom.

Ratification

Approval that can be replayed

Every merge carries a cryptographic nonce binding the diff to the checks that cleared it. Months later you can still show which gates ran and what they saw.

merge record
▶ tier 1 contract PASSED 0.2s
▶ tier 2 coherence PASSED 0.4s
▶ human ratification APPROVED
nonce 0x8f2a4c19b77e3d05…c91d
✔ merged to main
3

Review tiers

0.2s

Contract pass

0.4s

Coherence pass

100%

Merges nonce-stamped