## Summary This issue proposes exploring a framework that extends Duo Code Review with two additional capabilities: **Deep Analysis** and **Specialized Agents**. Rather than owning every possible review type, the goal is to build the platform infrastructure that enables both — and that domain teams can build on top of. Before committing to this work, we want to align with engineering and product on feasibility, scope, and approach. ## Problem Statement The existing Duo Code Review flow runs on every merge request and is designed to be fast and consistent. That is a deliberate tradeoff — it provides a reliable first pass across all MRs without adding meaningful overhead to the review process, and it will continue to be a core part of our offering. But some changes warrant a different kind of review — not because the standard review is inadequate, but because **the change itself calls for something more**. A modification to authentication logic benefits from security-focused reasoning. A schema migration benefits from database expertise. A large, sprawling refactor benefits from deeper context about the broader codebase. These are distinct needs, and they call for distinct capabilities. There is also an emerging pattern of domain teams at GitLab building their own specialized review flows independently, with ad-hoc triggering and no shared experience model. This exploration is partly about building the framework that makes those efforts coherent. ## Proposed Approach (Ideas for Discussion) The following are directional ideas. We are not committing to any of these — we want engineering and product input before defining what we actually build. **Two distinct capabilities within the framework** This exploration covers two related but separate value propositions that should not be conflated: *Deep Analysis* is the most literal version of an "advanced" review. It applies to any MR that warrants richer analysis — same agent, same breadth, but with significantly more context (Orbit-enabled) and longer runtime. This is appropriate for large or complex changes where the standard review's context window is a meaningful constraint on quality. Deep Analysis is not a domain-specific review; it is a depth upgrade. *Specialized Agents* are domain-specific reviewers — focused on a particular area of a codebase, with reasoning tailored to that domain. Examples of what these might look like: a security-focused agent that reasons about authentication, authorization, and exploitability; a database-focused agent that evaluates schema migrations and query patterns; an API-focused agent that checks for contract changes affecting downstream consumers. We would own the framework for how these agents plug in and surface findings — not necessarily all of the agents themselves. Domain teams could build and own their own specialized agents while benefiting from standard triggering, unified UX, and integration with risk classification. **Customer journey: regular review always runs first** The intended flow is sequential and additive: 1. Every MR runs the standard **Duo Code Review** — fast, consistent, always-on 2. Based on findings from that review and signals from [MR Risk Classification (21610)](https://gitlab.com/groups/gitlab-org/-/work_items/21610), we surface targeted recommendations: *"This MR may benefit from a Deep Analysis and a Security Review"* 3. The recommended reviews can then be triggered — manually by the author or reviewer, or automatically based on team configuration This positions these capabilities as an *escalation path*, not a replacement or a critique of the standard review. The recommendation is driven by what the **change** is — not by what the standard review missed. **Relationship to MR Risk Classification (21610)** [MR Risk Classification](https://gitlab.com/groups/gitlab-org/-/work_items/21610) is the upstream signal that informs which extended reviews are appropriate for a given MR. A high-risk classification on an MR touching auth paths should surface a security-focused agent recommendation. A high-risk classification on an MR with a large blast radius should surface a Deep Analysis recommendation. The two capabilities are designed to work together as part of a coherent tiered review system. **What the framework owns** Rather than building every specialized agent, the primary work here is building the infrastructure that makes this pattern possible and coherent: - Standard triggering that doesn't require per-team CI component workarounds - Unified output UX within the MR experience (not ad-hoc internal notes or bespoke UI) - Integration with MR Risk Classification for routing and recommendations - Extension points that allow domain teams to build and plug in specialized agents Some specialized agents we may build directly (as first-party examples and to validate the framework). Others will come from domain teams who already have this need — there are existing internal experiments that would be natural fits for this model. ## Market Context The broader AI code review space is actively validating a tiered depth model. Tools that run on every MR optimize for speed and low false-positive rates. At the same time, there is strong and growing demand for domain-specialized review on complex changes — and the market is demonstrating that customers will pay a premium for that level of analysis. Several players have recently launched or are building in this direction. GitLab is well-positioned to offer this natively within the platform, without requiring customers to stitch together third-party tools. That is a meaningful differentiator worth pursuing. ## Out of Scope * Replacing or deprecating the existing Duo Code Review flow — the two are designed to be complementary and sequential * Auto-remediation or automated fix suggestions (may be worth exploring in a follow-on using Duo Developer) * IDE-based or pre-commit review experiences * Support for repositories outside of GitLab ## Open Questions * Is the Duo Agent Platform ready to support a pluggable specialized agent model today, or does it require foundational work first? * What is the right extension model for domain teams — how do they build and register a specialized agent against this framework? * What domains should we build first-party agents for, to validate the framework? * How tightly should this be coupled to MR Risk Classification (21610)? Could Deep Analysis or a specialized agent be triggered independently, or should a risk classification always precede it? * What does enabling Orbit for Deep Analysis look like in practice, and what does that do to runtime and cost? * How do we clearly communicate the distinction between Duo Code Review and these extended capabilities to customers, so they understand these are complementary — not evidence that the standard review is insufficient?