v2.2.0

What's Changed

Major release. Amazon Bedrock is now a first-class provider, agent provider/model can be changed from the dashboard without a redeploy, and per-PR review briefs are elevated into the review checklist and cited in findings. Cross-provider fallback has been removed — see the upgrade notes.

⚠️ Breaking / Upgrade Notes

• AGENT_FALLBACK_MODEL and cross-provider retry are removed (#194). Reviews no longer retry on a secondary model. Settings use extra="ignore", so a leftover value in your .env won't fail startup — it is silently ignored. Migration 009 drops the reviews.fallback_model column and deletes any stored agent_fallback_model runtime override.
• Provider selection is all-or-nothing (#194). AGENT_PROVIDER applies to every Baloo agent, and short model names (haiku / sonnet / opus) are provider-specific tiers. AGENT_MODEL now defaults to the portable sonnet tier alias, so switching provider is a one-variable change.
• Two new migrations to run: 008_add_runtime_settings and 009_remove_agent_fallback. Only relevant when DATABASE_ENABLED=true.

Features

• Amazon Bedrock provider support — amazon-bedrock via PI, with a per-provider model tier catalog. The sandbox passes AWS credentials (static keys, session tokens, AWS_PROFILE, IRSA, ECS/EC2 roles, AWS_BEARER_TOKEN_BEDROCK) and bind-mounts credential files read-only. Provider errors (auth, model access, throttling) are now captured into error_message and surfaced instead of degrading to "check server logs" (#194)
• DB-backed runtime settings overlay — change agent provider/model and related knobs without a redeploy. Allowlisted keys only, 30s cache TTL, precedence DB overlay → env → field default; secrets and infra settings are never overridable. Dashboard Settings becomes editable with Save / Revert to env and source badges (#192)
• Models in use + Test connection — dashboard summary of the resolved provider/model per role (primary, false-positive, thread, fidelity, docs), plus a PI smoke test that auto-runs after changing AGENT_PROVIDER / AGENT_MODEL (#192, #194)
• Per-PR review briefs elevated — a ## Review guidance for Baloo section in the PR body is extracted and injected as a dedicated review checklist step, so falsifiable checks are salient rather than buried in the description. Customer-repo hardcoding was dropped from the system prompt in favor of generic guidelines-driven wording (#193)
• Findings cite the review brief — a finding prompted by a brief check now cites it explicitly, and checks that hold are recorded as positive observations. The brief never narrows scope: issues it doesn't mention are still reported (#186)
• Missing review-brief section is flagged — when a repo's guidelines require a review-brief section and the PR description lacks it, Baloo emits a HIGH Guidelines finding (#181)

Fixes

• Emit the missing-brief-section finding as a general finding instead of anchoring it to a fabricated file:line, which could cause it to be dropped (#186)
• Unknown providers raise a clear configuration error instead of silently borrowing Anthropic model IDs (#194)
• Dashboard renders a role-level warning for model resolution errors rather than returning a 500 (#194)
• Keep tests deterministic when a developer has AGENT_PROVIDER exported (#194)

Docs

• New Amazon Bedrock Setup guide: auth methods, model tiers, verification, troubleshooting (#194)
• New how-to-get-the-most guide: how teams get high-signal reviews via conventions and per-PR briefs (#193)
• Refreshed configuration, models, dashboard, fidelity, and review-agent docs for the overlay and provider changes (#192, #193, #194)

Dependencies

• ~29 dependency and CI updates, including a consolidated batch (#210). Highlights: cryptography 49→50, fastapi 0.138→0.141.1, starlette 1.3.1→1.6.0, certifi, typescript 6→7, mypy 2.1→2.3, Python and Node base images, and GitHub Actions pins
• Restricted the Dependabot uv ecosystem to direct dependencies (#210)