v0.8.0 — first release

Flaught v0.8.0

What it is

Flaught runs adversarial code review on every PR: a five-stage pipeline (context assembly → deterministic tools → LLM skeptical pass → test inversion → scope-creep detection) that produces a Markdown PR comment and a versioned JSON artifact. The reviewer is decoupled from the author — point it at any LLM provider, independent of whatever wrote the code, so the second opinion isn't an echo. Named for Monsignor Flaught, the devil's advocate in A Canticle for Leibowitz.

What works

• Deterministic tools — Semgrep, a linter, and a vuln scanner; every finding tagged source_type: "deterministic".
• LLM adversarial pass — structured skeptical review of security, architecture, scope-creep, and test quality; findings tagged source_type: "llm".
• Test inversion — runs the test suite on pre-change code and flags vacuous tests that pass on both sides.
• Scope-creep detection — heuristic + LLM; flags hunks unrelated to the PR's stated intent.
• Five providers — Groq (default), OpenAI, Gemini, Anthropic (native Messages API), Ollama (local + Ollama Cloud). Any OpenAI-compatible endpoint via base_url.
• Dismissals — persistent false-positive suppression via stable fingerprints (flaught dismiss / flaught dismissals).
• GitHub Actions — three ready-to-use workflows; this repo dogfoods itself on every PR.
• Dashboard — flaught dashboard renders a self-contained static HTML trends page across downloaded artifacts.
• Exit codes — 0 clean, 1 gated (blocks merge), 2 tool fault (warns, does not block).

What's experimental

• Refute / skeptic pass — every LLM finding is re-examined by a second model that tries to refute it (confirm / refute / uncertain). New; the skeptic counts are in the artifact but the cost/benefit is still being measured.
• Scope-creep LLM stage — the heuristic is stable; the LLM-assisted judgment is more subjective.
• Trends dashboard — the HTML output is stable, but the per-run column set may shift between minor versions.
• Ollama Cloud — supported via the Ollama adapter with base_url, but the hosted offering itself is new.

Changes since v0.7.2

• feat: add refute/skeptic pass and switch default model to gpt-oss-120b
• feat: add pre-commit hooks (husky) and fix dogfood findings
• fix: CI workflow builds from source instead of the published package, so PRs that change review logic are reflected in their own run
• fix: default model settled on openai/gpt-oss-20b (confirmed available on Groq) after churn through llama-3.3 and llama-4-maverick
• chore: remove unused deps, duplicate RefuteSchema; housekeeping

Honest caveat

The JSON artifact is evidence that scrutiny occurred, not evidence that findings are correct. LLM-asserted findings may include hallucinations. Deterministic-tool findings have their own false-positive rates. Treat this as a prompt for human review, not audit-truth.

Install

npm install -g @flaught/core

Published to npm as @flaught/core@0.8.0. Node 18+.