async review(prNumber: number): Promise<ReviewResult> {
  // Fetch PR metadata (title, description, author, base/head branches)
  const pr = await this.github.getPR(this.repo.owner, this.repo.name, prNumber);
 
  // Fetch changed files with diffs
  const files = await this.github.getPRFiles(
    this.repo.owner,
    this.repo.name,
    prNumber
  );
 
  // Build review context
  const context = {
    pr,
    files,
    totalAdditions: files.reduce((sum, f) => sum + f.additions, 0),
    totalDeletions: files.reduce((sum, f) => sum + f.deletions, 0),
  };
 
  // Classify risk
  const risk = this.classifyRisk(context);
 
  // Send to Claude for analysis
  const analysis = await this.analyzeWithClaude(context);
 
  // Auto-approve if applicable
  if (this.canAutoApprove(risk)) {
    await this.approvePR(prNumber, analysis);
  }
 
  return { pr, risk, analysis };
}

classifyRisk(context: ReviewContext): RiskLevel {
  const { files, totalAdditions, totalDeletions } = context;
  const totalChanges = totalAdditions + totalDeletions;
  const fileCount = files.length;
 
  // High risk indicators
  if (fileCount > 10) return "high";
  if (totalChanges > 500) return "high";
  if (this.hasSensitivePatterns(files)) return "high";
 
  // Low risk indicators
  if (fileCount <= 3 && totalChanges < 100) return "low";
 
  // Everything else
  return "medium";
}

const SENSITIVE_PATTERNS = [
  /\.env/,              // Environment files
  /secret/i,            // Secret/credential references
  /auth/i,              // Authentication logic
  /security/i,          // Security configuration
  /migration/i,         // Database migrations
  /docker-compose/,     // Infrastructure config
  /\.github\/workflows/, // CI/CD pipelines
  /package\.json/,      // Dependency changes
  /Dockerfile/,         // Container definitions
];

async analyzeWithClaude(context: ReviewContext): Promise<ReviewAnalysis> {
  const response = await this.claudeBridge.analyze({
    system: `You are a senior code reviewer. Analyze this pull request
             and provide actionable feedback. Focus on:
             - Correctness and potential bugs
             - Security implications
             - Performance concerns
             - Code style and maintainability
             - Test coverage gaps`,
    content: formatPRForReview(context),
  });
 
  return {
    summary: response.summary,
    issues: response.issues,        // Specific problems found
    suggestions: response.suggestions, // Improvement ideas
    verdict: response.verdict,       // "approve" | "request_changes" | "comment"
  };
}

interface ReviewAnalysis {
  /** One-paragraph summary of the changes */
  summary: string;
 
  /** Specific issues that should be addressed */
  issues: Array<{
    file: string;
    line: number;
    severity: "error" | "warning" | "info";
    message: string;
  }>;
 
  /** Suggestions for improvement (non-blocking) */
  suggestions: Array<{
    file: string;
    line: number;
    message: string;
  }>;
 
  /** Overall verdict */
  verdict: "approve" | "request_changes" | "comment";
}

canAutoApprove(risk: RiskLevel): boolean {
  // Only auto-approve at L3+ and only for low-risk PRs
  if (this.autonomyLevel < 3) return false;
  if (risk !== "low") return false;
 
  return true;
}
 
async approvePR(prNumber: number, analysis: ReviewAnalysis): Promise<void> {
  await this.github.createReview({
    owner: this.repo.owner,
    repo: this.repo.name,
    pull_number: prNumber,
    event: "APPROVE",
    body: `Auto-approved by CodeSpar Review Agent.\n\n${analysis.summary}`,
  });
}

User: @codespar review PR #42

CodeSpar: 🔍 Reviewing PR #42: "Add retry logic to API client"

          📊 Risk: low (2 files, +47 -12 lines)

          ✅ Summary:
          Adds exponential backoff retry logic to the HTTP client.
          Clean implementation with configurable max retries.

          ⚠️ 1 suggestion:
          • src/http/client.ts:34 — Consider adding jitter to the
            backoff delay to prevent thundering herd on service recovery.

          Verdict: Approved
          (Auto-approved: low-risk, autonomy L3)

User: @codespar review PR #58

CodeSpar: 🔍 Reviewing PR #58: "Implement user data export"

          📊 Risk: high (12 files, +340 -89 lines, touches auth/)

          ❌ 2 issues found:

          1. src/export/handler.ts:23 [error]
             SQL query concatenates user input without parameterization.
             This is a SQL injection vulnerability.

          2. src/export/handler.ts:67 [warning]
             No rate limiting on the export endpoint.
             A user could trigger expensive queries repeatedly.

          💡 1 suggestion:
          • src/export/handler.ts:45 — Consider streaming large
            exports instead of loading everything into memory.

          Verdict: Changes requested
          (Manual review required: high-risk PR)