Code review that tries to disprove itself

A diff on its own is not reviewable. Catching a real defect means opening the files the diff touches, grepping for callers, tracing validation paths, checking the tests, work that only agentic tool use can do. But an agent that reads a repository re-sends its context every turn, and input is the overwhelming share of an agentic bill. Naive implementations land in one of two failure modes: good and unaffordable, or cheap and useless.

The same fragmentation breaks incident work. Engineering context is spread across source control, ticketing, observability, incident tooling, product analytics, and chat. A tool that reads a log line or a metric in isolation produces shallow answers, noisy review comments, and recommendations that cannot be traced back to how the system actually behaves.

The agentic reviewer runs on the Claude Agent SDK against Bedrock. Claude drives a tool loop over file read, grep, glob and bash, where every tool is an MCP server wired to an E2B sandbox, and the SDK's built-in filesystem tools are disallowed so the agent can only touch the sandbox.

Hooks carry the operational load. PreToolUse dedupes repeated work before it costs a call, Stop emits final-reason telemetry so a truncated run is distinguishable from a finished one, and max_budget_usd caps a run in dollars rather than turns, the unit the business actually cares about.

The review starts from the changed code plus its surrounding files, repository instructions, organisational guidelines, and lessons carried over from previous reviews. Claude generates candidate findings across correctness, security, performance, concurrency, API contracts, and error handling.

Then the system does the unusual part: instead of publishing those findings, it asks Claude to find evidence that would disprove them. The agent traces callers, validation paths, related implementations, tests, and cross-file behaviour. Findings that do not survive verification are dropped before a human ever sees them. Survivors are scored, deduplicated, and turned into concise comments with applicable code suggestions.

The metric that matters here is the ratio between findings generated and findings published. Comment volume going down while defect capture holds is the whole thesis.

The expensive part of a review is the part that never changes: the system prompt, the output schema, the file context. Those blocks carry cache_control: ephemeral, budgeted carefully against Anthropic's four-breakpoint cap so the breakpoints land on the boundaries that actually repeat.

Tool output is compressed before it reaches the model: ANSI stripped, repeated lines collapsed, bland middles elided while every severity line survives. The compression is deterministic, so the cached prefix stays byte-stable turn to turn. A non-deterministic compressor would invalidate the cache it was meant to protect.

Not every turn deserves a frontier model. A classifier scores task difficulty once per session, so a hard task starts high instead of grinding a cheap model into a loop, and a trivial one starts on Haiku. Structural signals like extended thinking, oversized context, or images in the request set a hard floor above that prediction.

The interesting rule is the last one: when recent tool results come back errored inside a tight window, the turn escalates. The cascade fires on evidence that the work is going wrong, not on a guess made before it started.

Claude also drives Incident Knowledge. A discovery agent analyses production errors, extracts distinct patterns, fingerprints them, and separates known incidents from newly emerging failures. Each new pattern gets a Sonnet 4.6 investigation agent that reads the relevant source, queries additional logs, traces request lifecycles, and searches related code paths.

The output is structured rather than prose: severity, root-cause category, blast radius, affected features, supporting code, confidence, and a recommended fix, shaped so the rest of the product can consume it. On Fix Now, the workflow moves into an isolated environment to edit the code, add a focused regression test, validate the result, push a branch, and open a pull request. It can then respond to review feedback on that PR and update the proposed fix.

Sonnet 4.6 also powers the Leader behind Ellie in Slack and scheduled Pulse reports, selecting from more than 55 connected tools. Straightforward questions resolve through direct tool calls; deeper investigations are delegated to specialised Claude agents that explore one domain iteratively and return evidence to the Leader.

That lets teams ask what caused delivery to slow this week, which changes introduced the current production errors, how much AI-generated work reached production, or which incidents connect to the latest release. None of it is answered from model memory. It is reasoning over current data pulled from the organisation's own systems.

The router is exposed as an Anthropic-compatible /v1/messages endpoint. A customer points Claude Code's ANTHROPIC_BASE_URL at Entelligence with their token, and every turn is authenticated, balance-gated, routed, relayed with streaming intact, and debited at provider cost plus markup. Bring-your-own-key customers get the same routing, constrained to the providers their own keys can reach.

Claude is not one call inside Entelligence. It is the reviewer, the router's fallback floor, the incident investigator, and the wire format the product speaks to its own customers. Prompt caching, tool use, streaming, and model tiering were not optimisations bolted on late. They are what made repo-scale review shippable at all.