reviews.unaddressed_feedback · always on
The finding somebody resolved without fixing.
Tool output is only worth what somebody does with it. CodeCapitan reads every review thread on the PR, works out who opened it and whether the flagged line actually changed in the diff, and treats a security tool's high-severity thread closed with no code change as a red.
That tier is deterministic and fail-closed: no model is consulted, so a persuasive comment body can't talk its way out of it. The agent layer is only ever allowed to narrow the set below, never to widen it or soften a severity.
- security tools → red tierGitHub Advanced Security · Snyk · Semgrep · SonarQube Cloud · SonarCloud · Trivy · GitGuardian
- review bots → weighted amberCodeRabbit · Sourcery — and their boilerplate is stripped before anything is read, so the badge rows and prompt blocks don't count as feedback
- closed_without_changeThread resolved or gone outdated while the line it flagged was never touched by the diff
- open_on_shippedThread still open on a file the PR is shipping
- identity from the login, never the textThe actor is GitHub's
author.login. Comment bodies are untrusted data, delimited as such, and never instructions - CI from both APIsCheck Runs and the legacy commit statuses, so Buildkite, Jenkins and Codecov count the same as a GitHub Action