PRism: Pull Request Review with Evidence

The problem. Large PRs are reviewed faster than their effects can be traced. A PR description is often the only spec available. A change in one file can silently break a caller elsewhere. And AI review tools routinely produce plausible-sounding comments with no evidence behind them, which erodes trust faster than it helps. The solution. PRism is a review workbench built for maintainers and engineering leads reviewing PRs on active codebases. A user signs in with GitHub, connects a repo via a read-only GitHub App, and selects a PR or submits a raw diff directly. PRism pins the exact base/head commits, parses the patch into changed-line maps, and extracts Python import dependencies to trace downstream impact. Coverage (LCOV/Cobertura) is accepted only when tied to the exact PR head commit; anything else shows as unknown rather than guessed. How it works. Four review facets analyze the diff: requirements alignment against the PR description, downstream effects via the dependency graph, uncovered changed lines, and correctness/security/concurrency risk. An LLM proposes findings. A separate, deterministic evidence gate not another model call checks each finding's citations against the parsed diff, dependency edges, and accepted coverage before marking it verified. This separation of proposing from verifying is the core design bet: it's what stops PRism from being just another confidently wrong AI reviewer. What the user sees. A risk-ordered report with direct links to diff lines, coverage provenance, and reasoning per finding. Analysis streams live into the interface; completed reviews persist in history for later reference. PRism never executes code from submitted PRs. What's creative/unique. Most AI review tools optimize for finding more issues. PRism optimizes for knowing which issues are actually true treating unverified findings as first-class, visible output rather than hiding or discarding them, so reviewers get calibrated trust instead of false confidence. Validation. We built a synthetic payments/orders/notifications repo with six seeded PRs (spec errors, downstream breakage, an uncovered payout path, a transaction-ordering bug, tenant isolation, a concurrency race) as repeatable test cases.