Skip to content

Calibrate Reviews to Your Project

A weekend prototype and a regulated payments service shouldn't get the same review. The prototype doesn't need to hear about missing metrics. The payments service shouldn't have an access-control slip rated as a minor issue.

The project block tells the reviewer which kind of repository it is looking at. lgtmaybe then adjusts both its defaults and the model's guidance to match.

Contents

The Shape of a Profile

provider: bedrock
model: us.anthropic.claude-sonnet-4-6

project:
  stage: regulated
  domain: payments
  notes: |
    PCI-scoped card flows live under payments/. Most traffic is nightly batch,
    so latency findings on the batch path matter less than correctness.
Field Required What it is
stage no prototype, production or regulated. Changes defaults and adds fixed guidance.
domain no A short label, up to 80 characters: payments, healthcare, internal tooling.
notes no Free text the reviewer should know, up to 1,000 characters. A longer value fails validation instead of being cut short.

Every field is optional. Leave the block out and the review is unchanged.

Pick a Stage

Stage Default it changes Guidance the model gets
prototype min_severity defaults to medium instead of low Report correctness and security problems, and skip hardening, observability, scalability and documentation polish it doesn't need yet.
production none Hold the change to the standard review bar.
regulated Any PR that isn't only docs and tests is at least medium risk, with a "regulated workload" reason Where the domain makes them material, rate data handling, auditability, access control and personal-data exposure one severity step higher.

production changes no settings. It lets a team state the stage explicitly. It also gives the guidance paragraph a stage to name alongside domain and notes.

The regulated risk floor stops at medium on purpose. Two distinct high reasons make a change critical. So a high floor would turn every change to a widely imported module into critical. A PR that only touches documentation and tests stays low in any stage.

Add Domain and Notes

domain and notes give the model context it can't infer from a diff. Keep notes to what changes how a finding should be judged:

  • where the sensitive code lives;
  • which paths are hot;
  • what the team has decided not to care about.

Some instructions only apply to part of the repo. For those, use directory_rules instead. It reaches only the lenses reviewing matching files.

What Your Settings Still Control

A stage only moves defaults. A value you set yourself always wins. It can come from .lgtmaybe.yml, the user config or a CLI flag:

project:
  stage: prototype
min_severity: low   # stays low: you set it, so the stage leaves it alone

lgtmaybe review --min-severity info   # beats the prototype default too

How the Profile Reaches the Model

The profile renders one short paragraph at the end of the system prompt that every review lens shares:

## Project context
From the reviewer configuration (trusted). Calibrate what you report and how
severe you rate it to this project:
This is a regulated workload: where the domain makes them material, rate data
handling, auditability, access control and personal-data exposure one severity
step higher than you otherwise would.
Domain: payments.
Notes from the maintainers: PCI-scoped card flows live under payments/. ...

It sits in the shared prompt. So providers with prompt caching pay for it once per run rather than once per lens.

Only the review lenses see it. The reflection pass does not. Nor does the change overview: its description, High Impact Areas and diagrams.

The stage's settings changes are deterministic. The guidance paragraph may or may not shift the severities a given model reports. That depends on the model, and the eval harness doesn't measure it yet.

Why Not Read AGENTS.md?

Many repositories already have an AGENTS.md, CLAUDE.md or SOUL.md. Reading one automatically looks like a shortcut. lgtmaybe deliberately doesn't, for three reasons:

  • Those files are written for coding agents: build commands, test runners, style rules, personas. Little of it tells a reviewer how strict to be, and all of it costs tokens on every call.
  • Context files share an eighth of max_input_tokens (12,500 tokens at the default of 100,000). A file over budget is skipped whole. The repositories with the most thorough agent docs are the ones whose file wouldn't fit.
  • A stage maps to settings changes that behave the same way every run. Free prose can't do that.

You may want one of those files in front of the reviewer anyway. Then name it in a directory_rules entry with no paths, which applies everywhere:

directory_rules:
  - context_files: [AGENTS.md]

Security: the Profile Is Trusted Configuration

The paragraph enters the system prompt as trusted content. So it must never come from a pull request's author. On the recommended pull_request_target trigger, .lgtmaybe.yml is read from the checked-out base branch, never the PR head.

lgtmaybe still neutralises prompt delimiters in notes and domain. So nothing in them can close a prompt block early.

See Also