Open Code Review

# MISSION: Scaffold "Open Code Review" Production Architecture
You are an expert Senior Staff Software Architect and Full-Stack Engineer. Your mission is to scaffold and implement a production-grade, highly reliable, and modular codebase following the proven architecture of **Open Code Review**.
---
## 1. PROJECT SPECIFICATIONS & BENCHMARK
- **Reference Architecture**: Open Code Review
- **What It Does**: Open Code Review is Alibaba's open-source AI code review CLI. It reads Git diffs, runs a deterministic pipeline plus a tool-using LLM agent, and produces line-level review comments for terminals, CI systems, IDEs and coding agents.
- **Domain & Category**: Hybrid Deterministic + LLM Agent Code Review Tool
- **Production Scale**: 20+ people
- **Development Mode**: HYBRID
- **Architectural Rationale**: A single static Go binary keeps the review engine fast and easy to distribute through npm, CI and IDE plugins. Putting deterministic diff/context analysis before a narrow LLM loop keeps reviews precise and cheap in tokens compared with general-purpose agents.
- **Live Website Reference**: https://open-codereview.ai
- **Source Repository**: https://github.com/alibaba/open-code-review
---
## 2. PRODUCTION TECH STACK
- **Full Stack Array**: Go, Cobra, Bubble Tea, OpenAI, Anthropic, Model Context Protocol, OpenTelemetry, Node.js, TypeScript, React, Kotlin, GitHub Actions
- **Primary Language(s)**: Go, JavaScript, TypeScript, Kotlin, CSS
- **License of the reference repo**: Apache-2.0
- **Frontend**: React — Landing and docs site in pages/ (React 18, webpack, three.js, mermaid); TypeScript — VS Code extension, Preact-based review webview (extensions/frontend) and OpenCode plugin; Kotlin — JetBrains IDE plugin under extensions/idea
- **Backend & APIs**: Go — The ocr CLI and review engine (cmd/opencodereview, internal/*), built as static CGO-free binaries; Cobra — Command tree and flags for the ocr CLI (review, scan and related subcommands); Bubble Tea — Terminal UI for interactive review sessions, with Bubbles and Lip Gloss components
- **Infrastructure & deploy**: Node.js — npm launcher (bin/ocr.js) that installs the matching per-platform Go binary on postinstall; OpenTelemetry — Traces and metrics exported over OTLP gRPC/HTTP from internal/telemetry; GitHub Actions — CI, CodeQL, releases, IDE extension builds and a reusable review Action (action.yml)
- **Tooling, testing & ops**: OpenAI — openai-go client for OpenAI-compatible model endpoints used by the review agent loop; Anthropic SDK — anthropic-sdk-go client for Claude models, with AWS SDK config for Bedrock-style credentials; Model Context Protocol — MCP Go SDK in internal/mcp lets agents such as Claude Code or Cursor call the reviewer as a tool; tiktoken-go — Token counting to budget how much diff and file context is sent to the model
---
## 3. KEY ARCHITECTURAL DECISIONS (audited from https://github.com/alibaba/open-code-review @ 486022d)
1. **Deterministic pipeline first, LLM agent second**: internal/diff, internal/gitcmd and internal/scan compute the change set and context deterministically before internal/agent and internal/llmloop run a tool-using review loop, which the README says trades some recall for higher precision and fewer tokens.
2. **One Go binary distributed through npm optional dependencies**: The root package.json lists @alibaba-group/ocr-<os>-<arch> packages under npm/ as optionalDependencies, and bin/ocr.js plus scripts/install.js pick the right CGO_ENABLED=0 binary built by the Makefile for six OS/arch targets.
3. **Provider-agnostic LLM layer with official SDKs**: internal/llm wraps both openai-go and anthropic-sdk-go, and the AWS SDK config is included for credential resolution, so teams point the reviewer at any OpenAI-compatible or Anthropic endpoint.
4. **Same engine exposed to CI, IDEs and coding agents**: action.yml and examples/ cover GitHub Actions, GitLab CI, Bitbucket, Gerrit and Codeup; extensions/ ships VS Code and JetBrains plugins; skills/, .claude-plugin and plugins/open-code-review package it for Claude Code, Kimi and OpenCode.
5. **Docs site isolated as its own Go module**: pages/go.mod exists only so go list ./... in the root module never walks into pages/node_modules, keeping go test, vet, govulncheck and the coverage gate clean without per-command filters.
---
## 4. NON-NEGOTIABLE ARCHITECTURAL GUARDRAILS
1. **Monorepo & Modular Separation**:
   - Structure as a Turborepo monorepo with strict package boundaries:
     - `apps/web`: Application UI, routing, layouts, and server endpoints.
     - `packages/ui`: Shared design tokens, CSS variables, and Radix UI primitive components.
     - `packages/db`: Database schemas, client singleton, declarative migrations, and seed scripts.
     - `packages/config`: Shared TypeScript, ESLint, and build configurations.
2. **Strict Type Safety & Zero `any` Policy**:
   - Enable `strict: true`, `noImplicitAny: true`, and `strictNullChecks: true`.
   - Validate ALL external inputs, API request bodies, and query parameters with **Zod** schemas before execution.
3. **Frontend & Rendering Guidelines**:
   - Isolate interactive UI state to leaf components. Keep core pages lightweight and performant.
4. **Design System & Aesthetics**:
   - Keep every color, radius, shadow and font in a single token file (CSS variables) and consume tokens everywhere; never hardcode hex values in components.
   - Prefer crisp 1px borders and one subtle shadow scale over blurry default shadows. Pair one sans-serif for body/headings with one monospace for tags, badges, metrics, and code.
5. **Data Layer & Reliability**:
   - Write declarative schema definitions with foreign keys, composite indexes on queried filters, and automated timestamp triggers.
   - Use connection pooling and prepared statements for serverless database execution.
---
## 5. STEP-BY-STEP SCAFFOLDING ROADMAP
- **Phase 1: Workspace & Root Config**: Initialize package manager, monorepo configuration (`turbo.json`, `tsconfig.base.json`, `package.json`).
- **Phase 2: Database Schema & Client**: Set up the data layer: client, connection pool, models, and migration scripts.
- **Phase 3: Design Tokens & UI Primitives**: Build accessible `Button`, `Input`, `Card`, `Badge`, and layout wrappers inside `packages/ui`.
- **Phase 4: Core Application Routes & Handlers**: Implement primary authentication, user session handling, and application routes.
- **Phase 5: Quality Assurance & Build Verification**: Run `tsc --noEmit`, ESLint, Prettier, and smoke test suites to ensure zero compilation or runtime errors.
---
## 6. EXECUTION INSTRUCTIONS
1. Review all specifications, architectural guardrails, and stack choices above.
2. Present the full monorepo directory tree structure.
3. Systematically generate the complete, production-ready codebase according to the 5-phase roadmap above — starting with the root workspace setup, followed by the database schema, UI design system package, and full-stack application routes until the repository is fully scaffolded and ready to run.