Skip to content

Examples

Overview

Starter files to copy into your repository. Each sets only what it needs; every setting it leaves out keeps its default. The Settings Reference lists every setting.

A Small Team's Defaults

.cloudaeye.config at the root. CloudAEye may approve a change on its own only within these limits, and names one reviewer when it does not.

## Ultrareview

### Limits
- Risk score: 40/100                 <!-- 0-100 -->
- AI slop score: 50/100              <!-- 0-100 -->
- Review severity: medium            <!-- medium | low -->

### Human review policy
- Max human reviewers to assign: 1   <!-- 1 | 2 | 3 -->

A Stricter Directory

A second .cloudaeye.config in services/payments/, beside the root file above. Changes under services/payments/ take these settings and everything else from the root. A change that touches both directories gets the stricter of each setting.

## Ultrareview

### Limits
- Risk score: 25/100                 <!-- 0-100 -->
- Review severity: low               <!-- medium | low -->

### Human review policy
- Max human reviewers to assign: 2   <!-- 1 | 2 | 3 -->
- Instructions: Every change here needs two humans, one of them from the Payments team.

## Review

### Severity floor
- Severity floor: low                <!-- all | critical | high | medium | low -->

Your Own LLM

At the root only. Each developer sets ANTHROPIC_API_KEY on their own machine, so the key itself never sits in the repository. Leave the API key line out to use the key saved in the console settings instead (LLM in the Settings UI section).

## Review

### LLM
- LLM: your own                      <!-- CloudAEye | your own -->
- Provider: anthropic                <!-- your own only -->
- Model: claude-sonnet-5-5
- API key: $ANTHROPIC_API_KEY        <!-- an environment variable that holds the key, or the key -->

A Faster Ultrareview

Turns off the architecture and control-flow checks. Bugs, Security, the AI slop score and the risk score stay on, so CloudAEye can still approve a change on its own.

## Ultrareview

### Checks
- Architecture: false                <!-- true | false -->
- Control flow: false                <!-- true | false -->

A Monorepo With Generated Code

Leaves generated and vendored code out of reviews before a commit, follows calls further, keeps the control-flow map inside this repository, and gives triage the team's key results.

## Review

### Paths never reviewed
- Skip: `**/generated/**`
- Skip: `**/*.pb.go`
- Skip: `vendor/`

## Control flow
- Effort: high                       <!-- low | medium | high -->
- Across repositories: false         <!-- true | false -->

## Triage PRs
- OKRs: `docs/okrs.md`

Review Rules

.cloudaeye.rules at the root, beside .cloudaeye.config. Rules synced from the console have an id for a heading; your own have a name. See Rules and Instructions.

# Review rules

## r12
Every API endpoint checks the caller's permissions before it reads or writes data.
- Applies to: `src/api/`

## No request bodies in logs
Never log a request or response body; log its size and the route instead.
- Applies to: `src/api/`