Risk-Aware Code Review

Code review doesn't scale down. Enterprise teams have reviewers, linters, and CI gates catching problems before they ship. Solo developers and small teams building fast — the exact people shipping most AI-assisted prototypes — usually have none of that. They review their own code, tired, under deadline pressure, and the bugs that get through aren't exotic: missing null checks, unvalidated file uploads, temp files that collide under concurrent load. Ordinary mistakes that compound because nobody else is looking. Review Coach is an AI code review system built for that gap. Point it at a repository and it does three things a solo developer can't easily do alone: it runs IBM Bob in Agent mode to find real issues across the codebase; it combines those findings with actual static analysis of the import graph to compute which files matter most — not by severity label alone, but by blast radius (how many other files break if this one breaks) and exposure (is this file a direct entry point, like an HTTP server, reachable from outside the codebase); and it has Bob generate real, reviewable patches for the highest-priority findings, shown as actual diffs, not just prose suggestions. The target user is a solo developer or small team without the review infrastructure larger orgs take for granted. They open a dashboard, not a chat log: a risk map showing which files are actually dangerous, sized by a transparent formula (findings + blast radius × 2 + exposure × 3); a dependency graph showing the real import structure of their project, something no findings list can show; and a findings panel where each issue expands into Bob's explanation, its suggested fix, and — where generated — a real before/after patch. What makes this different from "chat with Bob about your code": the risk score isn't Bob's opinion restated with a colored badge. It's computed from real analysis Bob never saw — a from-scratch dependency graph scanner and an exposure detector — layered on top of Bob's findings. In our test run, this caught something a plain findings list would have missed entirely: the project's HTTP server file had zero internal dependents (nothing else in the codebase imports it), which would rank it lowest by pure blast-radius logic — but it's the actual attack surface, and the exposure signal correctly pushed it to the top of the risk ranking despite that. Beyond the dashboard, Review Coach also runs unattended: a Bob Shell hook fires automatically on every git commit, reviewing staged changes before they're even committed, catching issues (in testing, it caught a variable shadowing Node's built-in process global) that neither the IDE scan nor a human skim had flagged. That's the actual workflow improvement the hackathon theme asks for — not a one-time report, but Bob embedded in the commit loop itself, running automatically, at a cost of about 0.04 Bobcoins per check.