If you build anything that makes an LLM point at a location in a document, take the anchoring chain. Ask for a quote, resolve the position in code, drop the output when the match fails.
Never let a model guess a coordinate.
https://t.co/90YpxTP8dw
Alibaba open sourced their AI code reviewer.
The model inside it is never allowed to report a line number.
Full schema of the tool the agent calls to leave a comment:
~ content
~ existing_code
~ suggestion_code
~ thinking
~ category
~ severity
No start_line. No end_line.
The model quotes the code it is complaining about. Go matches that quote back into the diff and computes the line itself.
Finding the bug is the easy half. Pinning it to the right line is the half that breaks everything, and they solved it by never asking.
Six more things I found in the source π§΅
Every prompt in the project adds up to under 10 KB of markdown. The repo is 87 Go files.
Those files exist because the model fails in predictable ways.
Can't count lines -> match strings
Invents issues -> veto pass
Fills its window -> freeze, compress, active zone
The intelligence is rented per token. The harness is the product.
Loose receipts from the same repo:
README says 20 tool calls per file. Code says 30.
Max tokens per request: 58888. Nobody picks that by accident.
Default output language is Chinese.
The relocation prompt ends with /no_think, a Qwen control token, inside a tool advertised as OpenAI and Anthropic compatible.
The config loader greps your ~/.zshrc for API keys.
Then a second pass nobody documented: a fact checker that sees only the diff.
It never sees the files the agent read or the searches it ran.
So it gets exactly one power. Delete a comment the diff directly disproves. Anything it merely cannot verify goes through untouched.
The prompt says it in three words: falsify, not verify.
That fourth step has its own prompt file. Its only job is asking a model to copy lines out of a diff verbatim. No rewriting, no reformatting, no explanation. Output a code block or nothing.
An entire model call exists because step one fails often enough to need a rescue path.
Every AI-built website has the same tell.
Centered hero. Purple-to-blue gradient. Three rounded cards. Inter font. A pill button that says "Get Started." You can spot it in half a second, and so can everyone who lands on your page.
I ran a skill called Hallmark on my own site this week to see if that was fixable. It was.
Hallmark is an anti-slop design skill for Claude Code, Cursor, and Codex. Built by Together AI, sitting at 12.3k stars. The pitch is one sentence: refuse the defaults every model was trained into.
Most AI design tools stop at "make it look nice." Hallmark picks a macrostructure for the brief, dresses it in one of 20 themes, then runs 57 slop-test gates and a self-critique pass before it emits anything. It grades its own output against a slop checklist and rewrites whatever fails.
The result on my site: it didn't look generated.
Structure I wouldn't have picked. Type pairing I wouldn't have picked either. The color anchor fit the actual product instead of falling back to a gradient. Then I pushed a second brief through it and got a genuinely different page. Nothing carried over from the first.
That's the whole game. Two briefs, two fingerprints.
Audit is the underrated one. Point it at something you already shipped and it hands back a punch list of every slop pattern you left in.
The uncomfortable truth: AI sites look same-y because the model is average on purpose. It gives you the most probable design, and the most probable design is the one everyone else also got. Distinctive is improbable by definition. To get there you have to push the model off the center of the distribution, and a slop-gate ruleset is the thing that does the pushing.