Replies and rechecks

Once a review is published, three things can happen to a finding: the owner replies in its thread, the owner defers it, or a push changes the code it points to. This page says who can do what, what it costs, and what Sigma posts back.

Current limitation: imported personal-runner results do not support Sigma's thread replies, deferrals or automatic finding follow-up, even when a finding has an inline thread. To reassess such a result, check the current run and request a fresh full review when its execution path is available. The intended personal setup is not yet available for self-service on the hosted beta.

What a reply in the thread looks like

Sigma's replies are short and link nowhere. A reply from a named reviewer starts with its name and version, for example "Sigma Charlie v6", without the executor. Then one of these:

Wide tables: scroll horizontally to see more columns.

When Sigma needs your decision to settle a finding, the reply ends with one clarification question. The explanation, proof gaps and question are model text: they are escaped the same way as review text (see The review's layout), so they cannot mention anyone, link an issue or inject HTML. Long text is cut and ends with "…"; the full assessment stays on Sigma's run page.

Every reply ends with a hidden marker, <!-- sigma:reply:v3 id=<reply id> payload=<sha256> -->. Replies published before public format v2 (reply format 1 and 2, markers sigma:reply:v1 and sigma:reply:v2) keep the format they were published with, including their "Recheck evidence" and "Original review" links.

Who can reply to a finding today

Here, the connected owner is the GitHub account that connected this repository, including an invited account. Only that account's replies in a finding's GitHub thread are acted on; Sigma discards everyone else's with the recorded reason "only the owner authorizes conversation work". This is narrower than /sigma review, which any repository writer may comment (see Who may call Sigma). A colleague's reply is ordinary discussion: nothing is scheduled and nothing is posted back. The connected account must still be admitted and the repository remain in scope; invited accounts also need GitHub-confirmed write access. Not yet available: acting on replies from other writers.

A finding listed under "Additional verified findings" has no thread of its own, so it can be neither deferred nor rechecked by reply.

Deferring a finding

• Prerequisites: you are the connected owner and the finding has an inline thread.
• Action: reply /sigma defer <reason> (the reason is required in this form), or a plain phrase: "fix later", "will fix later" or "исправим позже", optionally followed by :, — or - and a reason.
• Expected result: no model work. The finding's disposition becomes deferred and Sigma replies "Deferred by the owner. The finding is retained; no fix evidence has been established."
• Check: the run page shows the finding as deferred. A finding already fixed or refuted gets "This finding is already {disposition}; the deferral request does not change that assessment."
• Recovery: none needed. A deferral works even when the reviewer is Off or no longer configured.

Requesting a targeted recheck

Any other new reply from the owner in the thread, even a one-line disagreement, starts a targeted recheck of that one finding by the reviewer and version that produced it.

• Prerequisites: that reviewer is still configured for the repository and is not Off.
• Action: reply in the thread with what changed or why you disagree.
• Expected result: model work scoped to this finding (metered on API stages, observed on subscription stages), reusing the original run's baseline, checks and limits. A fresh verifier adjudicates: open, fixed, refuted or inconclusive. An inconclusive assessment leaves the prior disposition unchanged. Sigma replies "Agent-adjudicated outcome: {outcome}." with the commit it assessed and the verifier's explanation.
• Check: the recheck's own check summary reads "Finding recheck: {outcome}"; until then, "no completed assessment". A recheck that ends without an outcome replies "Recheck not completed."
• Recovery: if the reviewer was removed or set Off, Sigma replies "Recheck unavailable: the original reviewer version is disabled or has no matching configured policy. No model run was started; the finding disposition is unchanged." Editing an old reply never starts anything; write a new one.

For coding agents. An outcome is agent-adjudicated evidence, not proof. "fixed" means the original claim is confirmed and is absent at a different head, with no proof gaps; "refuted" means the claim did not hold at the original head either. "open" means the original claim is confirmed and still present; "inconclusive" means the evidence was insufficient to decide. Assessment outcome and finding disposition are separate: an open assessment can retain an existing deferral, and inconclusive preserves the prior disposition. Read the outcome from the bold word after "Agent-adjudicated outcome:" and the commit from "Assessment target:". The marker sigma:reply:v3 carries the reply id and a payload digest, not the outcome.

What a push does to open findings

After a push, an Automatic reviewer first runs a full review of the new head. When that review completes, Sigma schedules a scoped recheck of that reviewer's earlier open and deferred findings on the same pull request, for every finding whose last assessment is older than the current head. When the outcome changes the disposition, Sigma posts "Agent-adjudicated outcome: fixed" or "refuted" in the finding's thread without anyone asking; an open or inconclusive outcome posts nothing and preserves the prior disposition, including an existing deferral.

An On request reviewer runs no full review after a push, so nothing follows up on its findings: reply in the thread, or comment /sigma review.

Not yet available: a lighter re-review that skips the full review of the new head and classifies the delta instead.

What a recheck costs versus a full review

A recheck is bounded to one finding and reuses the original run's baseline, checks and limits. A full review, after a push or a fresh /sigma review, reads the whole current head and costs like any other run. Neither shows its cost on GitHub; both report it on Sigma's run page the same way; see What each path costs you.