Semantic Diff Review: AI That Flags Behavioral Drift Only

# Prefer structural diffs when available
git diff --ignore-all-space origin/main...HEAD > /tmp/raw.diff
# Illustrative: emit changed symbols via scip / lsif / ts-morph
node tools/semantic-diff.js --base origin/main --out /tmp/semantic.json

// semantic-diff.js excerpt — focus on behavioral surface
import { Project } from "ts-morph";

export function changedExports(baseFiles: string[], headFiles: Map<string, string>) {
  const findings: { path: string; name: string; kind: string }[] = [];
  const project = new Project({ skipAddingFilesFromTsConfig: true });
  for (const [path, text] of headFiles) {
    const sf = project.createSourceFile(path, text, { overwrite: true });
    for (const [name, decls] of sf.getExportedDeclarations()) {
      findings.push({ path, name, kind: decls[0].getKindName() });
    }
  }
  return findings;
}

{
  "pr": 1842,
  "behavioral_diff": [
    {
      "symbol": "InvoiceService.create",
      "signature_before": "(input: CreateInvoice) => Promise<Invoice>",
      "signature_after": "(input: CreateInvoice, opts?: {skipTax?: boolean}) => Promise<Invoice>",
      "callers": ["CheckoutController.complete"],
      "tests": ["invoice.service.test.ts"]
    }
  ],
  "contracts": ["openapi.yaml#/paths/~1invoices/post"],
  "forbidden_nits": ["style", "naming-bike-shed", "import-order"]
}

You are a senior code reviewer. Only report:
1) contract/API breaks 2) authz/authn regressions 3) data-loss or idempotency bugs
4) obvious p99 performance cliffs 5) secret leakage.
Ignore formatting, naming taste, and optional refactors.
Severity: blocker|major|minor. Require file:line evidence.
If no behavioral risk, reply NO_FINDINGS.

# fail the review job if OpenAPI response schema drifted without changelog
import json, sys
before, after = json.load(open(sys.argv[1])), json.load(open(sys.argv[2]))
# illustrative: compare /invoices post 200 schema hash
assert before["paths"]["/invoices"]["post"]["responses"]["200"] == \
       after["paths"]["/invoices"]["post"]["responses"]["200"], "schema drift — require dual-run note"

# reviewer-config.yml
max_comments: 8
drop_severities: [nit]
block_on: [blocker, major]
ignore_paths:
  - "**/*.generated.*"
  - "**/pnpm-lock.yaml"
prompt_version: semantic-review@2026-09-11

# .github/workflows/semantic-review.yml — illustrative
name: semantic-review
on: pull_request
jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: node tools/semantic-diff.js --base origin/${{ github.base_ref }} --out semantic.json
      - run: node tools/run-reviewer.js --in semantic.json --prompt-version semantic-review@2026-09-11
        env:
          BEDROCK_MODEL: ${{ vars.REVIEW_MODEL }}
          BUDGET_PR_TOKENS: "200000"