The MAX Research Collective — Final Outcome Report

AI-first software development as a shop of one, and the PR-reviewer decision it forced

Programs: MAX3 (newellnarco/max3) · REEF (newellnarco/netsniff)

Compiled: 2026-07-16 (eve of the Gemini Code Assist 07-17 consumer sunset)

Companions: the first-phases engineering report "The bake-off" (Jason Newell, 2026-07-11) · PR_REVIEW_BAKEOFF.md (running ledger) · PR_REVIEW_REPLACEMENT.md (replacement design) · MODEL_COUNCIL.md (the free second voice) · the Qodo Competitive Analysis (2026-07-16) + its Netsniff/CodeRabbit Supplement

What this document is. The two most recent papers (the Competitive Analysis and its Supplement) closed the reviewer lane but read thinner than the first-phases bake-off engineering report — they carry the decision without re-carrying the evidence. This report restores that rigor and widens the frame: it states what the MAX Research Collective is actually building and proving (AI as a disciplined team member, not vibe-coding), what it produces per day in measured numbers, how that volume collides with a per-seat pricing model that was never written for it — including the ~$2,040/month figure and what it would have meant to buy — and it closes the reviewer decision with every supporting dataset reproduced in the appendices.

Provenance discipline. Every headline number here is either (a) measured by full enumeration of the GitHub PR lists, (b) verified against the live working trees of both repos on 2026-07-16, or (c) a secondary-sourced vendor price flagged for re-verification at signup. Where a figure comes from outside the repos (the vendor's $2,040/mo recommendation), it is labelled as such.

Part I — The thesis: what we are building, and what "AI-first, responsibly" means

The Collective is a deliberate experiment in a specific question: can one developer, with AI as a first-class member of the team, ship at team velocity without shipping team-velocity garbage? The failure mode everyone has seen — "vibe coding," "rave coding" — is AI used as an accelerant with the brakes removed: an MVP thrown together with no architecture, or an existing product wrecked by unreviewed, untested, unbounded change. The Collective's whole design is the opposite bet: the AI is held to the same discipline a good senior engineer is, and that discipline is encoded so it compounds.

The discipline, concretely:

• Architecture-first, not prompt-first. Every arc starts from a design doc; the code implements a decision that was reasoned about, not a vibe that was typed.
• Gated, always. Branch → PR → CI (a hard 10-minute gate) → review → merge. Nothing merges un-tested and un-reviewed. A model-council SPLIT (two independent AI voices disagree) blocks an auto-merge.
• Tested at three rings. Unit / integration / system on the backend; component tests on the frontend. A bug fix is not done until a regression test locks it.
• Reviewed by an independent voice. The AI that writes the code is not the only AI that judges it — a separate hosted reviewer (Gemini, then Qodo, now CodeRabbit in trial) plus an on-box ModelCouncil reads every diff.
• Honest about state. A status function that can't prove "green" must not report green (the single most-flagged bug class across both repos — see §V).
• Security- and performance-aware by default. SSRF fences, no-secret-egress boundaries, a voice-path latency floor that every change is measured against.
• Learning, not just fixing. Every recurring bug becomes a written rule (best_practices.md) that the review bots then enforce on the next PR — so a class of mistake is paid for once.

That last point is the engine. It is why this is a research collective and not just "a guy using Copilot": the process is instrumented, measured, and self-improving, and the two programs below are the proving grounds.

The two programs

REEF matters to this report for a second reason: it ran the same two-reviewer bake-off in parallel, under a different configuration, and independently replicated every finding (§V). Two repos, two configs, one conclusion is a far stronger claim than one repo.

Part II — What we actually produce (measured, not estimated)

All figures below are from full enumeration of the GitHub PR lists, not sampling.

MAX3 output

• Extrapolated monthly: ~405 PRs/month total, ~280 code PRs/month (~66 code/week).
• This corrects downward the earlier planning figures ("~700 PRs/mo", "~80 code/week") by ~40% and ~18% — the measured number is what the cost model uses, with 350/mo as the safety band.
• The .pr_agent.toml scoping (skip *.md, skip [auto]/docs/board titles) means the reviewer sees only the ~280 code PRs — the config already cut the billable surface ~31%.

REEF (netsniff) output — the fleet multiplier

• 101 PRs in the first 5 days (2026-07-11 → 16); 100 merged; median PR lifetime 7.2 minutes; 92/100 merged in under 30 minutes.
• Qodo reviewed 101/101 (no scoping config); Gemini reviewed 100/101 (its one miss: the open draft).

Org reality (quotas bind at the git org, not the repo)

• 216 (MAX3) + 101 (REEF) = 317 PRs in 16 days ≈ 600+/month across the org, of which ~450 are reviewable code PRs after scoping both repos.
• This is the single most important fact for the pricing decision. A per-seat plan is priced for a human who opens a few PRs a week. One developer running AI agents opened 350 code PRs in a month on MAX3 alone, and ~600 across the org. The shop looks like a whale on volume and a hobbyist on headcount — and no plan on any price list is shaped for that.

Part III — The reviewer arc, in four acts

The forcing event: Gemini Code Assist, the free reviewer that had been catching real bugs, sunsets 2026-07-17. That made three questions concrete — what goes away, what the survivor covers, and what it costs to buy back coverage that had been free — and forced the bake-off.

Act 1 — Gemini alone (the solo baseline)

• Window: PRs #1084–#1157 (2026-07-02 → 04), 120 findings rated by hand.
• Rating scale: one rater, 1 (severe) → 5 (nothing-burger); actionable = 1–3.
• Result: Gemini's actionable rate was ~80% (→ 84% once documentation-only reviews are excluded), with 19 severity-1 catches in the paired window. This is the coverage that disappears on 07-17.

Act 2 — Gemini vs Qodo, out of the box (phase 1)

• Window: PRs #1158–#1268 (2026-07-05 → 11), 394 findings rated by hand across 110 PRs.
• The ugly headline: Qodo's actionable rate measured 27%. But that number was an artifact of our own configuration, not the tool: MAX3 opens every PR as a draft, and out-of-the-box Qodo skips drafts — so it was reviewing at ready-for-review, i.e. after Gemini's findings had already been applied. Qodo was being graded on already-fixed code (the "ordering confound").
• The durable finding from phase 1: reviewer overlap was ~2%. Gemini and Qodo almost never caught the same thing. They read different axes of the same file — the union was the value, not either alone.

Act 3 — The best-practices tweak (phase 2 tuning)

Phase 2 (declared 2026-07-13, PRs through #1295) is a different tool, because we changed the config, not the vendor. What changed and what it bought:

Act 4 — Tuned Qodo vs sunsetting Gemini (the head-to-head)

Findings that carried the decision (each a real bug both the author and the other bot missed):

• #1283 — Qodo caught a design-contradiction the author and Gemini both missed: a lock-read failure path fell back to "", erasing PID evidence and releasing foreground.lock despite the module's own degrade-toward-KEEP rule. Sev-high, applied; Qodo cited the precedent PRs (#1208/#1241) where the class was established.
• #1284 — 4 real (unbounded face-warm await that could wedge boot · COUNT(*) readiness probe → SELECT 1 · prewarm doc-drift · brittle roster regex), all applied.
• #1293 — 2 real availability bugs (an optional fetch inside Promise.all rejecting the whole loader, ×2), both applied; the shipped Settings.tsx carries a comment crediting "Qodo #1293".
• #1294 — a finding escalated our regex env-gate scan to a real AST scan, with bypass evidence attached.
• #1295 (open draft) — 7 findings, all 7 applied in-branch (status KeyError race, stale transports on reload, missing API tests, blocking reload, unbounded stdout queue, correlation_id loss, non-deterministic hash()).

The overlap held: ~2%, near-disjoint, purely additive. Gemini = fast correctness-on-the-diff; tuned Qodo = repo-rule grounding + robustness / race / lifecycle tails. Neither beats the other; the union is the whole value.

Part IV — Cross-repo replication: REEF ran its own trial in parallel

REEF ran the same two reviewers under a minimal config (drafts on, no scoping) but the same firm discipline — every bot bug → fix + regression test + KNOWN_ISSUES.md ledger row + a best_practices.md rule. It is an independent replication of every vector we watched on MAX3.

Live update — CodeRabbit is now a third production reviewer on BOTH repos (verified against the working trees, 2026-07-16): the situation has already moved past "keep Qodo, maybe fall back to CodeRabbit." CodeRabbit has been running in production for ~2 days on both MAX3 and REEF, and it is catching real bugs, not just being trialed:

• REEF has it fully wired as "Phase 3 — CodeRabbit as the solo hosted reviewer after the 07-17 sunset." A committed .coderabbit.yaml + a docs/CODE_RABBIT_ONBOARDING.md, and 18 CodeRabbit-attributed rows in its ledger (PRs #104 / #105 / #107 / #111 / #114 …), catching exactly the highest-value class — fail-closed-on-degraded autoact, irreversible-action guards, a socket-leak on HTTPError. Its best_practices.md is now 717 lines (report 485 → supplement 526 → 717 — the file keeps growing, which is the flywheel).
• CodeRabbit corrected the supplement's own proposed config — by reviewing its own config PR (#102). The supplement's draft .coderabbit.yaml (reproduced in early drafts of this report) had two real bugs that CodeRabbit itself flagged: (1) path_filters are allowlist-flipping — a single positive include (best_practices.md) turns the whole list into an allowlist and skips all code; use negatives only. (2) CodeRabbit has no code_guidelines key — it rejects it as unrecognized; carry the standards through reviews.path_instructions instead. The corrected, live REEF config is in Appendix H. This is the review loop eating its own tail in the best way: the reviewer hardened the config that governs it.
• MAX3 has NO .coderabbit.yaml in its tree — so its ~2 days of CodeRabbit reviews are almost certainly running on defaults, which skip draft PRs (MAX3 opens every PR as a draft). That means MAX3's CodeRabbit is likely repeating Gemini's exact blind spot right now. Porting the corrected REEF .coderabbit.yaml to MAX3 is a live, high-value fix (action #9).

Part V — Was it actually better? Honest pros and cons

The point was never "which bot wins" — it was "what does each buy, and what does the union buy." The recurring, most-valuable bug class across both repos was false-green / dishonest-on-failure: a status/diagnostic/watch reporting alive/ok/"up to date" when the underlying check errored or couldn't run. It was flagged repeatedly on both repos and is now best_practices.md §1–2 on each. That is the shape of value: not lint, but reasoned correctness and honesty on the failure paths — exactly what a good reviewer catches and a fast diff-scanner misses.

Qodo (tuned) — ups

• 0 noise in phase 2 (vs 152 sev-4 rule-reminders out of 222 findings in phase 1). The tuning worked — and it's our tuning, portable to any engine.
• Repo-learned grounding: findings cite best_practices.md, KFP classes, rule IDs, and prior PRs where the class was accepted. The rule set visibly grew during the window (113 → 157 rules in the "Context used" header) — the learning loop is real.
• ✓ Resolved re-scan loop: re-reviews each push and flips findings resolved — the unattended session gets machine-checkable closure, not just prose.
• Agent-ready output: every finding ships a copyable "Agent prompt" that feeds a Claude session or the self-dev loop directly — low translation loss.
• Zero Actions minutes; no key in our repo.

Qodo — downs

• Pricing risk is the headline down (§VI). "Unlimited PRs" is a limited-time promotion over a documented 20 PRs/seat/month standard allocation. At 280–350 PRs/mo that is a 14–18× overshoot if ever enforced.
• 5.2-min median latency (2.4× Gemini) — fine for the merge gate, but it lost a race once (#1291 landed ~2.5 min after a 13.4-min-lived PR merged).
• Skips docs PRs by our config (deliberate; md-only mistakes are covered by docs:drift-lint, not the bot).
• Findings-cap semantics are loose; the stock platform rule pack still needs a portal-side prune.

Gemini — ups: 2.2-min median first response all window; 100% PR coverage incl. docs; 80–87% actionable; free.

Gemini — downs: dead tomorrow. Its docs reviews produced zero severe findings all window (the coverage we "lose" is the lowest-value slice — about ten severity-3 hygiene fixes a week, already partly duplicated by the post-merge doc propagator + session vetting). Its successor path is enterprise-only or a non-hosted CLI — the same consumer rug-pull the fallback ladder hedges against.

The carry-forward finding: two disjoint reviewers at ~2% overlap were purely additive. So the target state is not "the best single bot" — it is two cheap-or-free voices that read different axes, capped so attention (the scarce resource in a shop of one) is never the thing that gets overspent.

Part VI — The economics: daily production vs a pricing model that doesn't fit

The structural mismatch

Per-seat pricing assumes a human who opens a few PRs a week. One developer running agents opened ~350 code PRs in a month on MAX3, ~600 across the org. That breaks the model from both ends at once — whale on volume, hobbyist on headcount. There is a plan waiting to be written for the one-developer, high-volume, draft-first shop; nobody has written it yet. Apply this to a 2-10 developer start-up or a 200 developer large organization, moving to AI as an accelerator for engineering but with gated quality reviews using tooling is a non-starter for the CEO, CTO and CFO at this cost.

The ~$2,040/month recommendation — and what it would have meant to buy

The vendor's own recommended-plan quote landed at ~$2,040/month. That figure does not come from the repos — it is a vendor provided conversation, and the exact basis should be confirmed in writing — but its shape is exactly the mismatch above, and it is worth reconciling honestly:

• Under Qodo's documented 20-PR/seat/month standard allocation, our reviewable org volume (~450–600 code PRs/mo) implies roughly 23–30 "seats" if the promo unlimited term ever lapses; the raw, un-scoped org volume and the older ~700/mo planning figure push that higher still. At Teams/enterprise per-seat rates, that band is how a quote reaches four figures.
• In plain terms: a ~$2,040/mo recommendation is pricing one developer's agent output as if it were roughly two-to-five-dozen human reviewers. We would have been "buying" phantom headcount — seats for people who don't exist — to cover volume produced by one person and a fleet of agents. Nothing about the review quality changes across that spend; it is purely the seat model straining against agent velocity.

What we actually need to buy

The gap between ~$2,040/mo and ~$30/mo is the thesis of this whole exercise. The right price for reviewing one disciplined developer's high-volume agent output is a flat ~$30 (or $0 for the local voice) — not a seat count that scales with PR volume. Any tool whose price decouples from flat (promo expiry, per-PR enforcement, per-review billing) loses immediately to CodeRabbit on identical economics and to self-hosted PR-Agent on ~4× cheaper economics.

Full competitive landscape (verified mid-July 2026)

See Appendix E for the complete table (13 options). Normalized to $/reviewed code PR at our measured volume (Appendix F): PR-Agent $0.04–0.07 · CodeRabbit $0.09–0.11 · Qodo-promo $0.11–0.14 · Qodo-enforced ~$1.50 · Copilot/Greptile/Bugbot $0.50–1.50. There is no volume at which the per-review-priced tools fit an autonomous 280–600-PR/mo loop — they cost 10–20× flat-rate. The whole reviewer category is a rounding error next to the separate ~$250/mo CI Actions overage; the reviewer choice adds zero Actions minutes as long as we stay hosted.

Part VII — The decision, the options, and the fallback ladder

Reframe (2026-07-16): this is now a live 3-way, not a paper comparison. As of ~2 days ago we are running Gemini (until tomorrow) + Qodo + CodeRabbit on REEF, and Qodo + CodeRabbit (+ Gemini until 07-17) on MAX3. Phase 3 (CodeRabbit as hosted primary) is already partially executed — REEF has it wired as the designated post-sunset reviewer. So the decision is less "which do we buy sight-unseen" and more "which of two tools we are already running side by side do we pay for once Gemini is gone." What do we recommend to organizations from 2-10 or 150-200 in an AI-first focused technology development future?

Decision (conditional): keep tuned Qodo Merge as a paid hosted reviewer after Gemini's 07-17 shutdown — contingent on one contractual check: written confirmation that Teams ($30/user/mo annual) covers our org-level volume (~450–600 PRs/mo) without per-PR overage. If Qodo will not put unlimited (or ≥350–450/mo) in writing, CodeRabbit is already the running answer — it is live on both repos, its unlimited is standard (no promo cliff), and it has 2 days of real catches. Either way, the near-term is a two-voice hosted layer + the free on-box council.

The ladder:

• Now (before 07-17 / trial conversion): put the volume question to Qodo in writing, at the org level — "Teams, 1 seat, ~450–600 auto-reviewed PRs/month across MAX3 + netsniff: unlimited, yes or no, and for how long?" Simultaneously prune the stock platform rule pack (portal-side) and port MAX3's tuned scoping config to REEF so its docs PRs stop burning org quota.
• If unlimited confirmed → pay Qodo Teams, 1 seat (~$30/mo annual). Keep the tuned .pr_agent.toml + generated best_practices.md + the wiki auto-best-practices loop. Log a monthly 10-PR spot-check into the bake-off ledger so drift is caught.
• If not → CodeRabbit Pro (~$24–30/mo) as hosted primary — which is already running. REEF has it wired as the designated post-sunset reviewer; the standards port through path_instructions (not code_guidelines — see gotcha), it adds ast-grep structural rules Qodo lacks, integrates with Claude for the unattended loop, and its unlimited is standard (no cliff). The one setting that decides it — already handled on REEF, still missing on MAX3: CodeRabbit skips draft PRs by default, so reviews.auto_review.drafts: true is mandatory or it replicates Gemini's exact blind spot. Port the corrected REEF .coderabbit.yaml to MAX3 immediately (Appendix H is the live, working config — not the supplement's buggy draft).
• Break-glass (either branch): flip PR_AGENT_ENABLED + an Actions-secret key (~$15–35/mo, unlimited, Apache-2.0, sunset-proof) — same TOML, zero migration.

Regardless of branch:

• Wire ModelCouncil onto PR diffs (the standing "say GO" item). It replaces Gemini's 2-min first-pass at $0 and restores a genuine second, near-disjoint voice — which the whole window proved is additive.
• Docs PRs stay reviewer-free by design; docs:drift-lint + docs:semantic-drift-watch own that surface at $0.
• Adopt the ≥15-minute (or review-arrived) merge gate for code-bearing PRs on both repos. At a 7-minute median merge cadence, half of any reviewer's output lands after the code is already on main, and won't be counted — or applied — fairly.

Cap the stack at two paid lanes + the local council. Rotate the second lane on a quarterly bake-off and let CodeRabbit, Copilot, and whatever ships next compete for it. A third paid lane is not free even when the invoice says $0 — the severity-4 tail is paid in attention, and attention is the scarce resource in a shop of one.

Remaining user actions

Part VIII — Limits of this measurement

• Qodo's phase-1 coverage numbers were measured under our configuration, not the product defaults — most of what looked like a Qodo limitation was a line in our own TOML.
• Severity is a working rating (one rater, from the seat of the person who had to decide whether to fix), not a vendor metric.
• Vendor pricing pages were proxy-blocked from direct fetch during research; prices are cross-verified via official docs + multiple 2026 secondary sources and must be re-verified at signup — the two decision-critical ones are Qodo Teams' PR-allocation terms and CodeRabbit Pro's monthly price.
• The ~$2,040/mo figure is a vendor recommendation from outside the repos; its exact basis (tier, seat count, term) should be confirmed (action #8).
• REEF figures verified against its live working tree on 2026-07-16; MAX3 figures from the enumerated PR list. REEF has moved past the earlier doc snapshots (best_practices 717 lines; CodeRabbit now in the ledger).

Appendices — full source data

Every table referenced above is reproduced here in full, labelled with the section it supports, so the underlying data survives independent of the prose. No values summarised or truncated. (Matches the parent report's appendix convention.)

Appendix A — MAX3 quantified usage (§II)

Derived: ~405 PRs/mo total · ~280 code PRs/mo · ~66 code/week · scoping cut billable surface ~31% · org total (MAX3+REEF) 317 PRs / 16 days ≈ 600+/mo (~450 reviewable after scoping).

Appendix B — Phase-2 head-to-head: tuned Qodo vs sunsetting Gemini (§III Act 4)

Solo baseline (Appendix D of the parent report): PRs #1084–#1157 (07-02→04), 120 findings rated, Gemini ~80% actionable (84% ex-docs), 19 sev-1 in the paired window. Paired window: PRs #1158–#1268 (07-05→11), 394 findings rated across 110 PRs. Phase-1 Qodo actionable 27% (draft/ordering confound). Reviewer overlap ~2% (near-disjoint, additive).

Appendix C — Cross-repo evidence: REEF / netsniff (§IV), verified 2026-07-16

Ledger evolution (verified against live REEF tree 07-16): best_practices.md = 717 lines (report 485 → supplement 526 → 717); ledger now credits CodeRabbit on #105/#107/#111/#114. REEF .pr_agent.toml = [github_app] feedback_on_draft_pr = true only (no scoping — confirming "reviews everything incl. docs").

Prior doc-snapshot vs verified counts (from the supplement's correction pass):

Appendix D — Tuning levers: what changed and what it bought (§III Act 3)

Appendix E — Competitive landscape & cost model (§VI), verified mid-July 2026

Profile: 1 seat, ~280 code PRs/mo measured (350 safety band), private repo, unattended hosted-App-or-Action required.

Copilot arithmetic (parent report Part XII): Pro $10 + 300 requests, 13 requests/review → 350×13 = 4,550, 4,250 over × $0.04 = $170 → ~$180/mo (+ Actions). Pro+ $39 + 1,500 → 3,050 over → ~$161/mo. Order at this volume: PR-Agent → Qodo → Copilot, gaps wide.

Appendix F — Normalized cost per reviewed code PR (§VI)

Org-scale (netsniff correction): at ~450 reviewable/mo, flat-rate lands ~$0.07–0.08/PR (Qodo-promo and CodeRabbit alike); the enforced-allocation scenario rises to ~22 seats ≈ $660/mo. PR-Agent at fleet volume ~$15–25/mo. Annual: Qodo Teams ≈ $360/yr · CodeRabbit Pro ≈ $288/yr · PR-Agent ≈ $120–300/yr.

Appendix G — The ~$2,040/month reconciliation (§VI)

Vendor recommended-plan quote: ~$2,040/mo (basis to be confirmed — action #8; not sourced from the repos).

The reconciliation is the thesis in one row: the delta between ~$2,040 and ~$30 is entirely the seat model straining against agent velocity — not a difference in review quality.

Appendix H — CodeRabbit config: the LIVE, corrected REEF .coderabbit.yaml

This is the working config running on REEF (verified against the repo tree 2026-07-16), not the supplement's draft. The supplement's proposed config carried two real bugs that CodeRabbit itself caught reviewing config-PR #102; both are corrected below. This is the file to port to MAX3 (action #9).

The two CodeRabbit-specific gotchas (both caught on the first config PR):

• path_filters are allowlist-flipping. A single positive pattern (e.g. best_practices.md) turns the whole list into an allowlist — every file not matched by a positive is "included by none" and skipped (it skipped all of #102's code). Use negatives only. Consequence: you cannot carve one .md back in for review without excluding all code, so best_practices.md is not diff-reviewed — fine, it's the ruleset, carried via path_instructions.
• No code_guidelines key. Qodo auto-detects best_practices.md as its guideline file; CodeRabbit rejects code_guidelines as an unrecognized property. Carry the standards through reviews.path_instructions (name the specific rules inline) instead.

# .coderabbit.yaml — LIVE REEF config (phase 3: CodeRabbit as hosted primary)
language: en-US
reviews:
  profile: chill                    # low-noise — matches the 0-noise target
  high_level_summary: true
  poem: false
  request_changes_workflow: false
  auto_review:
    enabled: true
    drafts: true                    # CRITICAL: PRs open as drafts while CI runs;
                                     # without this CodeRabbit skips them (Gemini's blind spot)
    base_branches:
      - "^main$"
      - "^claude/.*"
    ignore_title_keywords:          # silent docs/board/[auto]/WIP bypass (by title)
      - "docs:"
      - "[docs]"
      - "board:"
      - "[auto]"
      - "[skip review]"
      - "WIP"
  path_filters:                     # NEGATIVES ONLY (positive = allowlist-flip, gotcha #1)
    - "!**/*.md"
    - "!web/node_modules/**"
    - "!web/.next/**"
  path_instructions:                # standards carried here, not code_guidelines (gotcha #2)
    - path: "reef/**/*.py"
      instructions: >
        Enforce best_practices.md. Prioritize: honest status — never a false green on an
        empty/failed/malformed read (§1); a watcher/daemon loop must LOG, not silently
        pass, its exceptions (§27); a file with more than one writer needs a lock AND
        atomic replace (§28); requests trust_env/verify/stream are Session attributes,
        not per-call kwargs (§19); caller-supplied path segments are validated +
        URL-encoded, never raw-interpolated (§24); API payloads omit optional fields
        rather than serializing null (§22). Every new `reef` CLI command ships unit +
        integration + system tests before activation (§3).
    - path: "web/**/*.{ts,tsx}"
      instructions: >
        Status/health UI components render from the usePoll state (loading/offline/error),
        not just envelope data, and fail closed — a dead or loading backend must never
        read as a green all-clear. Full-window overlays portal to document.body. Colors
        come from tokens, never hard-coded hex.
    - path: "tests/**/*.py"
      instructions: >
        Tests isolate real state (no live network/box; inject fakes) and assert the
        honest-failure path, not only the happy path.
  tools:
    gitleaks:
      enabled: true
knowledge_base:
  opt_out: false

(Porting to MAX3: swap reef//.py → backend/max3//*.py, web/ → frontend/*, and the rule numbers for MAX3's own best_practices.md/KFP classes; keep drafts: true and negatives-only filters verbatim.)

Eval measurement plan (run on the same PRs, apples-to-apples):

Tuned-Qodo-lever → CodeRabbit equivalent (carry-over is near-total):

Sources: full enumeration of the MAX3 + netsniff GitHub PR lists; the live working trees of both repos (2026-07-16); the parent engineering report "The bake-off" (Jason Newell, 2026-07-11, 394 rated findings); the Qodo Competitive Analysis + Netsniff/CodeRabbit Supplement (2026-07-16); CodeRabbit public GitHub org + docs; and 2026 secondary pricing sources. Vendor prices and the $2,040/mo quote basis to be re-verified before purchase.