Dashboard Settings Reference

Review policy is one stored JSON document for the workspace. This page describes the settings API on son-of-anton-operator-parity, branch feat/greptile-operator-parity (P/ below), and the editor in anton-ui-trace-parity. That branch is not merged into the son-of-anton-review engine on feat/cloudflare-native (R/). The native engine can hydrate and pin policy from its own D1 snapshot; writing a different deployment's policy does not configure it.

Where policy lives

• Storage: D1 table review_policy_settings, row id = 'workspace', with a revision counter (P/src/review-policy-store.js:59-89).
• API: /operator/api/settings on P/cloudflare/. GET returns { ok, settings, revision, updatedAt }. PATCH accepts { revision, settings } and merges over the saved policy. Stale revisions return 409; bodies over 256 KiB return 413 (P/cloudflare/src/review-policy-api.js:5-63).
• Audit: a successful policy write and its review_policy_audit entry share a D1 batch. GET /operator/api/settings/audit?q=&limit=&offset= returns policy audit plus memory/SCM audit where those tables exist. Limit 1 to 100, default 50 (P/src/review-policy-store.js:69-110).
• Usage: GET /operator/api/settings/usage?from=YYYY-MM-DD&to=YYYY-MM-DD reports model/chat telemetry. UTC date range defaults to month start through today; incomplete telemetry produces unknown values, not zero (P/src/review-policy-store.js:26-38,112-168).
• Defaults: DEFAULT_REVIEW_POLICY in src/operator-review-policy.js. Missing fields in a patch fall back to the stored value, then to the default.

# Read current policy and revision
curl -sS "$ANTON_OPERATOR/operator/api/settings" \
  -H "authorization: Bearer $SON_OF_ANTON_OPERATOR_READ_TOKEN"

# Raise strictness. Revision must match the GET above.
curl -sS -X PATCH "$ANTON_OPERATOR/operator/api/settings" \
  -H "authorization: Bearer $SON_OF_ANTON_OPERATOR_ADMIN_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"revision": 3, "settings": {"strictness": "medium"}}'

ANTON_OPERATOR is your parity Worker origin in these examples, not an application env setting. Use the revision actually returned by GET, not the illustrative 3. Canonical SON_OF_ANTON_ tokens take precedence over GILF_ fallbacks.

The handler requires OPERATOR_ACTOR supplied by the outer authenticated Worker. This is not an independently provisioned service binding: the Worker derives the actor and injects it. For legacy bearer callers it accepts x-operator-actor or defaults to service-admin; JSON cannot supply identity. Generated anton_ machine keys cannot write policy or read the main settings document; their read scope permits settings usage only (P/cloudflare/src/worker.js:65-80,115-146).

The parity Settings view groups Repositories, Code providers, Code review, Summary, Checks & approval, Sandbox execution, Memory permissions, Models, Usage & limits, Audit log and API keys. Repositories also edits the workspace auto-enable policy and has separate per-repo writes. Models is a browse-only view, not a model selector that saves configuration (anton-ui-trace-parity/src/views/Settings.tsx:16-27,209-218,247-264). The original anton-ui does not contain this policy editor.

Code review tab

Strictness (filterReviewFindings):

• low: publish every finding.
• medium: drop medium-priority findings only when they carry a recognized confidence value below 0.8. Missing confidence is retained; the model finding schema does not require it.
• high: drop medium and low priority findings.

Findings ranked blocker, critical or high, or whose text matches security, injection, XSS, CSRF, SSRF, memory leak, infinite loop, null dereference or missing validation, are always kept. See Triggers and Commands for how these knobs gate a run.

Summary tab

Five sections share one shape: { enabled, collapsible, defaultOpen }, all booleans.

A disabled section is omitted. A collapsible section renders as <details>, opened when defaultOpen is true (src/review-format.js appendSection). Disabling summary.confidence also disables auto approval.

Checks & approval tab

Auto approval (mayAutoApprove) needs all of: confidence 5, complete semantic coverage with no failed or skipped workers, no missing validations, every finding at nit or info level with no protected match, a non-draft PR, and a head SHA that equals the SHA the coverage was computed on. The publisher refuses APPROVE without a pinned head commit (src/github-publisher.js publishReview). Everything else publishes as COMMENT.

Sandbox execution tab

shouldRunExecution returns true, false, or the filter result. See Validation and Evidence.

Memory permissions tab

Stored and validated, but not an enforced runtime rule-creation authorization gate in the inspected engine. Do not rely on this enum to grant or restrict memory writes; the parity API's route authentication is separate.

Usage & limits tab

Filter rules

filters, autoApprove.filters and execution.filters share one grammar. A PR matches when any rule matches, and a rule matches when all its conditions match.

{
  "filters": [
    { "conditions": [
      { "field": "targetBranch", "operator": "is", "values": ["main", "release/*"] },
      { "field": "label", "operator": "is_not", "values": ["skip-review"] }
    ] }
  ]
}

If the PR metadata a condition needs is missing, the decision is deferred, not denied.

Validation

PATCH returns 400 with a message naming the path, for example Unknown or invalid field: settings.foo.

• Unknown fields are rejected at every level, including inside rules and conditions.
• Max 50 rules per list, 1 to 20 conditions per rule, max 50 values per condition, each value 1 to 500 chars.
• Globs allow A-Z a-z 0-9 _ . @ space / ? * -. Empty segments, ., .. and ** glued to other text are rejected.
• Control characters (U+0000 to U+001F except tab, newline and carriage return, plus U+007F) are rejected in every string.
• Integers must be safe integers within range. Booleans must be booleans.

Models and API keys tabs

The Models tab is read-only. It shows configured-key presence, selected provider and known model ids from the backend snapshot; it does not probe the actual review process or return provider credentials. OpenRouter is recommended; OpenAI, Anthropic and Codex are alternatives. See Model providers before selecting variables: Node reads the legacy runner names, and the native container only receives a restricted environment projection.

The API keys tab manages operator machine keys, not model credentials. POST /operator/api/keys with { name, scopes } returns the token once; storage keeps its SHA-256 hash, 14-character prefix and metadata. Scopes are only read and memory:write; default scope is read. POST /operator/api/keys/:id/revoke revokes it. Creation/listing/revocation require the administrative bearer route, not another generated machine key (P/src/operator-api-keys.js:1-3,65-109; P/cloudflare/src/worker.js:71,115-135).

Source evidence and runtime limits

• Policy defaults, validation and filters: R/src/operator-review-policy.js:25-108,110-180; the corresponding P/src/operator-review-policy.js has the same definitions.
• Strictness and approval: R/src/operator-review-policy.js:183-238. Approval also checks risk ceiling and both filter lists. R/src/github-publisher.js:50-65 pins approval to a head.
• Check conclusions and rendering: R/src/review-format.js:127-159,186-245. Coverage failure is not equivalent to a failed numeric confidence threshold.
• Runtime policy and budget admission: R/src/review-policy-runtime.js:26-53,74-90; R/src/codex-review-runner.js:2376-2392.
• Native policy snapshot: R/cloudflare-native/src/d1-store-adapter.js:153-172; settings routes remain on P/cloudflare/src/worker.js:145-146.

For conflicts, authorization failures or a missing endpoint, see Troubleshooting. No saved policy value can enable an unforwarded native V5 flag.