Read the change before you ship it.
RepoMentor is a local, developer-first code-review workspace that turns a focused code excerpt into a plain-language learning loop. The web workbench places source and findings side by side; the API owns authentication, review lifecycle, persistence, quota boundaries, and the server-selected Luna review path.
The evidence boundary is intentional. Unauthenticated UI flows use visibly labeled deterministic fixtures, and the local Fake AI path demonstrates application flow only. Deterministic tests and local Compose checks do not prove external Luna/provider quality, deployment behavior, or production readiness.
Start with Deployment and operations for the local environment boundary, Compose setup, migrations, and runtime notes. The workspace scripts and package ownership are declared in the root package.json; use that file as the executable script index.
For a focused first pass:
- Read local deployment.
- Walk through the repository showcase.
- Use the testing strategy to interpret local and opt-in integration evidence.
Keep credentials in an untracked environment file named .env. Security and trust boundaries is the authority for secrets, cookies, source handling, and provider isolation.
| Product question | Documentation | Source or test owner |
|---|---|---|
| How does the review workbench behave? | Web visual foundation and showcase | ReviewWorkspace.tsx, web shell tests |
| Where is the API contract defined? | API design and API notes | review controller, shared contracts |
| How is AI kept behind a server boundary? | AI prompt design and security | AI review service, Luna adapter, AI tests |
| Where do data and quota rules live? | Database design and architecture | Prisma schema, usage controller |
| What does a passing check prove? | Testing strategy and CI evidence | API tests, web tests, live Compose harness |
The checked-in media is a real local capture of the web shell. It is useful for orientation, not as a live review result or deployment proof.
The showcase explains the media provenance, links the static representative frame, and walks through the safe/unsafe deterministic local scenario.
- Architecture map — system shape and ownership boundaries.
- Database and migrations — persistence model and forward-only migration policy.
- Security and trust boundaries — authentication, prompt-injection framing, transport hardening, and secret handling.
- Testing strategy — deterministic, live Compose, and browser evidence limits.
- Deployment and operations — local Compose, environment configuration, and CI workflow ownership.
- Release and artifact boundaries — tagged artifacts, publication evidence, and explicit non-claims.
- Contributing and commit/worktree strategy — focused changes and repository workflow.
The root package and workspace packages are private. No API key, credential, source submission, or provider response belongs in this repository.