Deterministic checks
Your commands run in a real worktree, each with its own time limit. If you list none, review falls back to model judgement alone, so list at least one.
Governance
Your standards survive autonomy.
Colony reviews its own work the way your team would — your build and test commands first, your conventions second, your branch protection always. Agents cannot touch the paths you fence off, and spend stops at the ceilings you set. The gate stays human-defined; the pipeline does the legwork.
Review that holds
Commands first. Then a model. Then a person.
Every pull request runs your real build, test and lint commands before any model reads the diff — deterministic checks that cannot be talked around. Then the Inspector reviews the diff against your repository’s conventions. Then, by default, a person merges. Auto-merge is opt-in, per repository, and even then CI and branch protection still have the final vote. The Marshal merges through your protection rules, never around them.
Conventions review
The Inspector reads the diff with your conventions in context. If it finds problems, the PR goes back to the Builder. Review rounds are capped, then the issue goes to a person.
A person merges
By default the PR carries Colony’s review comments and waits for you. If you turn auto-merge on, Colony still waits for CI and merges through your branch protection.
The same review, for your team’s PRs
Point the review engine at human-authored code.
Colony can review your engineers’ pull requests with the same checks and conventions — on request, on ready-for-review, or automatically. A good place to start: value on day one, before a single autonomous change.
On request
Someone comments on the PR and Colony posts its review. Comment again after pushing for a fresh one.
On ready-for-review
Colony reviews when a PR leaves draft, and again when new commits land.
Automatically
Every qualifying PR gets reviewed, narrowed by the authors and labels you choose.
Colony never reviews its own pull requests through this path. Dependency updates can get their own lane: patch, minor and major updates each opt in separately.
Boundaries the agents cannot cross
Fence off paths. The tool call fails — not the prompt.
Mark paths forbidden or read-only and enforcement happens at the tool-call level: the agent gets a hard error, and the reviewer double-checks the final diff against the same lists. Secrets stay secrets; infrastructure stays untouched.
Forbidden
No read, no write. For secrets and credentials.
Read-only
Readable for context, not editable. For infrastructure, migrations and CI workflows.
Diff backstop
Shell-command detection is best-effort; the reviewer’s check of the actual diff is the reliable backstop.
Spend that stops
Two ceilings. No surprises.
Every issue runs under a cost cap; the whole pipeline carries a daily one. Hit the issue cap and that work stops, with the cost breakdown posted on the issue — not a warning, a stop. Hit the daily cap and no new work starts until midnight UTC. Because every dollar is attributed to an issue in the ledger, caps are enforceable facts, not aspirations. Colony Ledger
The conventions file
The other half of the contract.
Config says what the pipeline must enforce. Conventions say how new code should look. The agents read both before they touch the repo.
A versioned file (.colony/conventions.md) in each repository defines your stack, coding standards, naming conventions, testing approach, and forbidden patterns. The agents read it before they touch code. A well-maintained conventions file produces consistent, on-pattern output; a thin one produces output that needs more human correction.
It’s a living document. The most effective teams update it the first time they find themselves declining the same kind of PR twice — the convention you wished existed becomes the convention you can write down, and the next review checks it.
A review, replayed
What it looks like when review holds.
An illustrative trace of a PR that didn’t pass review the first time. The Inspector flagged it; the Builder reworked; the second attempt cleared. It follows the default path, with auto-merge off, so a person merges.
audit.issue(2843) · example
10:14:02Builderimplemented · webhook-retry-fix · 38 lines
10:14:55BuilderPR #2843 opened
10:15:11Inspectorchecks green · reading diff
10:16:02InspectorCHANGES REQUESTED · subprocess timeout path has no test
10:16:05Builderreceived rework request · re-analyzing
10:18:40Builderadded subprocess timeout test · re-pushed
10:19:12Inspectorapproved
10:19:13Inspectorauto-merge off · → human-review-ready
11:02:30Humanreviewed · branch protection satisfied · merged #2843
Bring your checks. We will run them.
Pilot setup includes a review of your review commands, path boundaries and spend caps, so day one starts with limits you chose.