Finding tier (🎯 Actionable / 💡 Suggestion / 🔍 Nitpick)

A PR with 12 inline comments is intimidating. A PR with 12 inline comments — 2 🎯 Actionable, 3 💡 Suggestion, 7 🔍 Nitpick — is a triage list. The reviewer knows immediately: fix the two red ones, glance at the three yellow ones, ignore the seven grey ones if you're in a hurry.

Without tiering, every finding demands the same amount of reviewer attention. The 7 nitpicks drown out the 2 real problems. Tiering reverses that.

🎯 Actionable — critical or high severity. The finding describes something that will cause a bug, security incident, performance regression, or user-visible failure in production. The synthesizer's verdict weights these heaviest; a single Actionable finding is usually enough to Request Changes.

💡 Suggestion — medium severity. The finding describes a real improvement — a cleaner pattern, a more idiomatic API, a missing edge-case handler — but not something that blocks merge. Reviewer discretion.

🔍 Nitpick — low severity or informational. Style preferences, minor naming, opportunities for future refactor. Post-only; the synthesizer never Requests Changes on these alone.

Each finding's severity (critical / high / medium / low / info) maps deterministically to a tier: critical + high → 🎯 Actionable, medium → 💡 Suggestion, low + info → 🔍 Nitpick. The mapping is not LLM-decided — it's a fixed function of the severity field, which itself comes from the agent's structured output.

Security-agent findings carry an additional category from the 40-class vulnerability taxonomy (sql-injection, xss-reflected, jwt-alg-confusion, prompt-injection, etc.). Categories like sql-injection default to critical → Actionable; categories like weak-random-generator can be low → Nitpick depending on context.

The verdict logic is: any 🎯 Actionable finding → REQUEST_CHANGES. All 💡 Suggestion or below with no Actionable → COMMENT. All 🔍 Nitpick or below → APPROVE (or COMMENT if the PR asked for review). Confidence scores on top of that: an APPROVE with 8 Nitpicks reads different from an APPROVE with 0 Nitpicks; both surface on the dashboard.

The tier tag also gates the cross-agent dedup logic. When multiple agents flag the same line at different tiers, the highest tier wins — a bug-agent Actionable trumps a readability-agent Suggestion on the same expression.