Fix, plan, or sign off.
Findings sorted into needs work, constraints and SLA, under the architecture gaps that cause them. A failure with no recovery path never goes in SLA.
xailon-review review readinessCODE REVIEW, GRADED BY EVIDENCE
Review with
evidence.
Engineering reports on your codebase
where every claim says how it is known,
and every file reference is checked.
Runs on XailonCode / Read-only / Apple Silicon macOS preview
xailon-review — your-serviceEXAMPLE RUN
xailon-review review readiness --org "Platform team"
✓ Facts: 28 modules, 65 scanner findings, GitHub on
✓ 7 area reviewers in parallel, read-only
✓ Lead synthesis: needs work · constraints · SLA · gaps
✓ Citations checked: 76 / 76 resolved
A1 · needs work
− make([]byte, sz) from an unauthenticated wire length+ [observed] cluster/service.go:500-502, before auth at :533› xailon-review view
engine: XailonCode · jsonreport.pdf · report.html
Every finding has a tag, a citation, and a category.
HOW IT WORKS
Facts first, no model
/Every claim tagged
/Every citation checked
/Read-only on your code
FOUR REPORTS. ONE STANDARD.
Know what to fix.
Know what to sign.
Reports written the way a staff engineer
briefs a CTO: plain words, cited, sorted.
What your fixes closed.
Re-checks every item at the new commit: closed, mostly closed with what's left, or open. Credits the merged PR that fixed it, and reviews only what changed.
xailon-review review followup --prior latestHow it's built, in diagrams.
The system on one page, a code map drawn from your imports, one diagram per mechanism with ⚠ weak spots, and a table of the design bets: what each buys, what it costs.
xailon-review review whiteboardWhere you stand, cited.
A feature map, architectures compared, and what users say, from live web research. Your side is cited to your code, theirs to numbered sources. "Unknown" is never guessed as "no".
xailon-review competeEVIDENCE, NOT CONFIDENCE
Every claim says
how it is known.
Area reviewers read your code and cite path:line. Then, with no model involved, every citation is checked against the repository at that commit. A citation that doesn't resolve is marked †. An observed claim whose citations all fail is downgraded to inferred.
HOW WE KNOW
[observed]Read in the code, configuration or a merged PR at the reviewed commit.
[computed]Arithmetic on observed values. 4 MB × 1,000 connections = 4 GB.
[inferred]Reasoning from what was read. Not run against a live system.
76 citations resolved · 0 did not (†)
From the rqlite sample review below.
IN THE LOOP, EVERY DAY
Review every change.
Keep every decision.
The same standard, applied to pull requests,
AI-written code, and your architecture rules.
One review. No noise.
Static checks on added lines, then one focused pass over the diff and the code around it. Bugs, security, data loss and broken contracts, never style. It never repeats a comment on a re-run, and dry run is the default.
xailon-review pr 128 --postCatch plausible-looking code.
Imports of packages that aren't installed, swallowed errors, tests that can't fail, placeholders, debug leftovers, copy-paste. --deep judges the rest against patterns from respected open-source code.
xailon-review slop src/ --deepLearned from the best.
342 checkable rules from 24 respected projects across Go, TypeScript, Python, Rust and Java, including FHIR healthcare servers. Each has the mistake it prevents and a link to real lines.
xailon-review patterns search timeoutArchitecture that stays decided.
Decisions live in Markdown with machine-checkable rules: forbidden imports, layering, required patterns. Branch checks fail on violations, and a guard hook stops an agent's edit before it lands.
xailon-review check --base origin/mainINTERACTIVE VIEWER
Explore the report.
Ask it questions.
Click a chart to filter. Click a citation to see the code.
Ask, and XailonCode checks the code before it answers.
The viewer runs on 127.0.0.1 only. Questions run XailonCode read-only in your repository. --static writes one self-contained HTML file to share.
HOW A REVIEW IS MADE
Facts first.
Judgement second.
Deterministic where it can be.
Read-only everywhere.
- 01 · NO MODEL
Facts
Index, module graph from manifests and imports, secret and security scanners, churn hotspots, deploy files, GitHub PRs and issues.
- 02 · XAILONCODE
Area reviewers
Agents in parallel, one per area: largest modules, security, durability, operations. Each returns cited findings.
- 03 · XAILONCODE
Lead synthesis
Deduplicates, sorts into needs work, constraint and SLA, names the architecture gaps, writes next steps.
- 04 · NO MODEL
Verification
Every
path:linechecked at the commit. Failures marked †, unsupported claims downgraded. - 05 · NO MODEL
Render
Print-quality PDF and HTML, a deterministic code map, checked diagrams, and the interactive viewer.
xailon-review reads code; it does not run it. Runtime claims are tagged [inferred]. Your XailonCode models, privacy routing and spending limits apply to every review. Read the FAQ.
SAMPLE REPORTS
Read one before
you run one.
Both reports were generated by xailon-review on rqlite, an open-source distributed database (about 100k lines of Go), at commit 8b10e2d. They are unedited.
AI-generated. Findings are the tool's, not the rqlite maintainers'. Verify before acting.
PRODUCTION READINESS · PDF
rqlite: what needs work, what to plan around, what to sign
20 findings, 4 architecture gaps, code map, next steps.
Open the report ↗ WHITEBOARD TOUR · PDFrqlite: how it is built, in diagrams
9 sections with ⚠ weak spots, design bets, comparison with similar systems.
Open the tour ↗READY WHEN YOU ARE
One binary.
Your engine.
xailon-review is a single executable.
XailonCode does the reading.
xailon-review is in private preview. It needs XailonCode ↗ installed and signed in, on an Apple Silicon Mac. gh is optional, for PR facts and the PR bot. Chrome is optional, for PDF output.
Ask your Infinia Labs contact for access to the preview build.
Installation guidexailon-review engine checkConfirms XailonCode answers in JSON mode. Add --engine acp to check ACP.
