Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by its vendor yet
Opt-in pull request reviewer on GitHub that combines Codacy's static analysis with a language model, reads the PR, linked Jira or Linear tickets and repository instructions, and posts a review with a verdict, a summary, test suggestions and inline comments with suggested fixes. It can run automatically on the first review of a PR or on demand (button or public API).
AI Reviewera product, as documented
SPECTRUM 0.2 BETA · Public tier · 2026-11-10
A1AutonomyAssistswith options on · as shipped not yet evidenced
DraftStage: Exploring (5 of 16)In productionBalanced
Standout. Reach 2 (Integrated): "It then reads the ticket from Jira or Linear:"
Next unlock. Control 1 (Stated): public evidence that a limit on it is a rule in prose would get there.
Trust.FACT-Ray: 11 facts: 11 π Moderate · found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it.
Standards constellation.36 provisions lit across 8 of 8 instruments.
The walk down from this card: each dimension, the indicators its level stands on (a link to the indicator's row), the public source of each answer (a link out; dashed means available, not default) the instruments its provisions sit in (a link to the instrument) and each provision itself (a link to its own page). A solid frame is evidenced; a dashed frame is not yet evidenced, which is not a no.
What each level rests on
Autonomy: what does A1 Assists rest on? 1 factI15 The person operates: every action is prompted and controlled by themReach: what does R2 Integrated rest on? 2 factsI10 It works across several domains or systemsI11 It connects to external tools or services across a trust boundaryOpenness: what does O2 Documented rest on? 2 factsI22 Its limits and known failure cases are documented for those who use itI58 The data it uses is described
Each path has its verbs on the edges; every node is a link, the source opens the page, a dashed box is an open question, not a no.
This card rates a product as its vendor documents it, not anyone's deployment of it. A feature the operator has to turn on counts, and is marked as available. Levels are computed from the evidence below by published rules. A dimension with no evidence reads "not yet evidenced".
Autonomy: level 1, Assists
What does the agent do on its own? Answers, drafts, summarises; a person does each step. This level holds with: Manual review. As shipped, with nothing turned on, it is not yet evidenced.
I15 The person operates: every action is prompted and controlled by them. In the Manually mode a person starts each review by clicking Run Reviewer in the pull request summary comment, or by a call to the public API. "to trigger a review on demand" Source (read, documented, available, captured 2026-11-10T17:49Z, sha256 1d7691aa3224a7ab) · π Moderate · S1·R5·A1 ×3
This evidence touches 1 provision: EAAMM.
Next unlock: level 2, Suggests. Public evidence that the agent suggests; the person reviews and approves each action.
Reach: level 2, Integrated
How connected is it? Documented connectors to common tools. This level holds with: Ai reviewer. As shipped, with nothing turned on, it is not yet evidenced.
I10 It works across several domains or systems. The reviewer combines GitHub pull request data, Codacy findings and a linked Jira or Linear ticket. "It then reads the ticket from Jira or Linear:" Source (read, documented, available, captured 2026-11-10T17:49Z, sha256 1ccd57719e29bac8) · π Moderate · S1·R5·A1 ×3
I11 It connects to external tools or services across a trust boundary. The reviewer sends pull request context to OpenAI models through Amazon Bedrock and reads tickets from Jira or Linear, services outside Codacy. "This feature leverages OpenAI models through Amazon Bedrock" Source (read, documented, available, captured 2026-11-10T17:49Z, sha256 1ccd57719e29bac8) · π Moderate · S1·R5·A1 ×3
This evidence touches 8 provisions: Salesforce, Microsoft, OWASP, NIST AI RMF.
Next unlock: level 3, Open protocol. Public evidence that there is a published protocol or communication layer between agents.
Control: not yet evidenced
Can people stay in command? Nothing public was found that meets a rule in this dimension. That is not a no.
Next unlock: level 1, Stated. Public evidence that a limit on it is a rule in prose.
Openness: level 2, Documented
Does it show its work? Public documents on how it works, its data, its models and its limits.
I22 Its limits and known failure cases are documented for those who use it. The limits page gives the reviewer's size limit (270,000 tokens or a 1 MB diff) and what it does above it; the Codacy AI docs page says it runs on GitHub only. "The AI Reviewer doesn't review pull requests whose changes" Source (read, documented, captured 2026-11-10T17:49Z, sha256 70910c1487249186) · π Moderate · S1·R5·A1 ×3
I58 The data it uses is described. The docs list the context sent to the model, what Codacy stores and does not store, and that secrets are redacted before sending. "To enrich the review, Codacy can send this context:" Source (read, documented, captured 2026-11-10T17:49Z, sha256 1ccd57719e29bac8) · π Moderate · S1·R5·A1 ×3
This evidence touches 7 provisions: NIST AI RMF, EU AI Act, AAGMM, EAAMM, Salesforce.
Next unlock: level 3, Measured. Public evidence that test or evaluation results are published.
How far to trust this card
Status: Draft. Draft means the facts were found in public pages and reviewed by agents. The company has not confirmed them and no customer has gone on record. FACT-Ray says how far each fact can be trusted: who says it (Source), how firmly it is recorded (Record) and who stands behind it (Accountability). It never changes a level.
The facts: 11 facts: 11 π Moderate. Each is written beside its evidence above.
The chain: found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it.
Who: produced by gamma.studio@web-summit.dinis; checked by gamma.review@web-summit.dinis and gamma.approve@web-summit.dinis. The actors.
What would raise it: the company's own file at /.well-known/fact-ray.json (Source 2), a customer's statement of use (Source 3), or a named person signing the card (how).
The standards constellation
One piece of public evidence can speak to several frameworks at once. "Touched" never means "complies". The share is of the provisions that can be read from outside.
Instrument
Provisions touched
Of those publicly readable
Salesforce
10
24
EAAMM
2
8
OWASP
2
18
MCP authorization
4
8
AAGMM
2
6
Microsoft
3
23
NIST AI RMF
12
20
EU AI Act
1
6
The 36 provisions lit
Each line item, with the facts that reach it. "Evidenced" is a link of the kind same: the fact is what the provision asks. "Partly" is a link of the kind part: the fact is one piece of it. "Its absence" points the other way. Each provision has its own page with its text and its place in the source.
Provision
Instrument
Reached by
How far
sf.a04 Level 0, how companies can advance from Level 0 to Level 1
The public card is the front door. The same evidence, read with the governance rules, is this agent's GAMMA-Ray rating: freedom, governance, the level held, the grant and a work order. That layer is written for an operator.
The vault
Every source behind this card was captured and hashed into a public sgit vault (u6a01jwq): captures.json lists each URL with the SHA-256 of what was fetched and when. Read key:
