[smith-xyz]

Purpose

Add only .pr_agent.toml for advisory Qodo v2 review. No application code, tests, dependency pins, workflows or branch protections change. Opened as a draft for human review; do not auto-merge.

Branch policy

Overhaul/future-main policy: version the new architecture standards with development. The installed app still reads main until promotion; the paired main bootstrap supplies these development review instructions meanwhile. At cutover retain this version and retire the maintenance bootstrap; resolve any config add/add conflict accordingly.

Standards

• Evidence-based bugs: triggering input/state, affected line, wrong outcome and proposed regression; never fabricate test results.
• Repository-specific ownership rules, Python/Go patterns, resource cleanup, cancellation and idempotency.
• Correlated, meaningful boundary logging; sanitized errors; no secrets, SQL parameters, document bodies or raw identity/exception leakage.
• Test changes require explicit human attention; no weakening assertions or ratchets to obtain green CI.
• Both specialized agents receive profile routing independently; summaries should identify the profile used.

Advisory safety

Only /agentic_review runs automatically on published PRs and subsequent pushes. Summary-only output. Fixer agent, auto-fixes and committable suggestions explicitly disabled. No auto-description rewriting, approval or required Qodo check is introduced. Humans remain responsible for understanding the code.

Verification

All 12 section/key pairs checked against the live Qodo v2 reference. All 14 prepared configs passed TOML parsing, documented-key, profile/safety and whitespace checks. Commit signatures verified locally; existing commit/push hooks run without bypass. Live Qodo behavior remains unverified until activation.

Sources:

• https://docs.qodo.ai/configuration/configuration-and-command-reference
• https://docs.qodo.ai/configuration/configuration-file
• https://docs.qodo.ai/code-review/extra-instructions
• https://docs.qodo.ai/configuration/remediation

Portal prerequisites and smoke checks

• Enable Code review for this repository and Rule enforcement for standards findings.
• Ensure development is not excluded by target-branch filters; leave remediation/auto-fix off.
• After the main bootstrap merges, verify maintenance, development and cutover profile selection on representative PRs. Automatic draft reviews are intentionally off.
• Review any rules mined from legacy main history before applying them to the overhaul.

Changed tests

None; only .pr_agent.toml is added.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: smith-xyz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [smith-xyz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[smith-xyz]

Superseded by the shared organization-wide Qodo baseline in https://github.com/traust-security/pr-agent-settings/pull/1, now merged.

Closing this per-repository configuration proposal in favor of the central defaults. Repository-specific guidance stays with the owning repository; genuine configuration exceptions can be proposed as minimal overrides.