CrowdStrike / CrowdStrike/codestrike
[Feature Request] Multi-pass review with parallel persona analysis
@vpovarna-cs is already working on this.
Since Sep 9, 2026.
- Dominant language
- Go
- Stars
- 3
- Forks
- 0
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 9
Description
Problem
The current review pipeline makes a single LLM call with all context pre-assembled. This one-shot approach has several limitations:
- No self-correction — the LLM can't verify its own findings
- Hallucinated line numbers go undetected
- No understanding of PR intent before reviewing code
- A single generalist prompt spreads attention thin across security, correctness, and performance concerns
- False positive rate is higher than necessary
Proposal
Replace the single-call pipeline with a three-pass architecture that combines sequential refinement with parallel specialized analysis.
Pass 1: Summarize (single call, cheap)
Lightweight call with PR description + diffstat (file names and status only, no patches). The LLM produces a 2-3 sentence summary of what the PR does and why. This summary
feeds into Pass 2 as intent context.
- Input: PR title, description, file list with status
- Output: 2-3 sentence summary of intent
- Token cost: ~1k input, ~200 output
Pass 2: Parallel persona reviews
Run 2-3 specialized reviewers concurrently, each with the summary from Pass 1 plus the full file patches:
| Persona | Focus | Ignores |
|---|---|---|
| Correctness | Logic errors, edge cases, error handling, API misuse | Style, formatting |
| Security | Vulnerabilities, input validation, auth/authz, injection | Minor bugs, naming |
| Performance | Algorithmic complexity, resource leaks, unnecessary allocations | Style, minor correctness |
Each persona gets the full token budget for its domain — no competition between concerns. Personas run as goroutines for wall-clock parallelism.
The existing persona infrastructure (internal/config/assets/prompts/) already supports this — critical-strike.md is effectively the security persona.
Pass 3: Self-check and merge
All findings from Pass 2 are collected and sent to a final validation call:
- Deduplicate — remove findings flagged by multiple personas
- Verify — does each line number match the actual diff? Is the issue real given PR intent from Pass 1?
- Rate confidence — high / medium / low per finding
- Filter — post only high-confidence findings; medium with caveat; drop low
- Temperature: 0.1 (deterministic, conservative)
- This pass alone should eliminate 30-40% of false positives
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.