Parsa Mohammadi

good catch, and it bites hardest when the upstream is already slow, since the retries pile onto the struggling dependency.

happy to! quickest way is to try it on a repo yourself. it plugs in wherever you already work. a GitHub App that reviews every PR, a plugin for VS Code, Cursor and Antigravity, an MCP integration so CodeRabbit can pull the scores into its reviews, and a one-off scan of any repo. each one takes about two minutes to set up, it’s all here https://tomosu.ai/docs

Spotify’s two incident questions are the best part. the first one is harder than it looks though, you need to know which change caused the incident, and most teams figure that out by hand. we looked at a Spotify outage from that angle at Tomosu, whether the risk was visible before it shipped. the PR looked reasonable on its own, the risk only showed up in how it interacted with the rest of production. that’s the gap we’re working on https://tomosu.ai

the omissions list is the useful part. missing timeouts and unhandled failure paths are easy to automate, which leaves the human review for the claims and the edges. that’s roughly the split we use at Tomosu, flagging the omissions on every PR so the reviewer starts from the parts that need judgment.

A static list goes stale fast. The module behind last quarter's incident often isn't on it yet. Scoring each change against what has actually broken before keeps that list current, and tells the human reviewer which PRs deserve a real comment instead of a click. The audit point lands too. "A check ran" is a timestamp. A verdict that records why a change was judged safe or not is something a person can stand behind. That's the gap Tomosu works on: a reliability score and merge verdict on every PR with the reasoning attached, using incident history once it's connected, and a human still making the call.