PR Replay · Free sample and paid reports

Understand the patterns
in recent changes.

Your agents are shipping code. Which structural findings deserve a closer look? Run a free sample, or request a written report on an agreed change history. Paid reports add founder review, practical next steps, and a walk-through with your team.

What this report does not cover: semantic correctness, a security audit, performance profiling, or live pre-merge review. It runs current checks against history; it does not rerun your tests or prove that an incident would have been caught or prevented. The replay uses the current index, not a separate reconstruction of the codebase before every historical change.

Try the free local sample Compare the paid reports

Same free engine · Local DIY sample · Paid interpretation by request · No hosted subscription required

Read the July 2026 Roam self-audit example. It shows the report format, not a customer result or a current measurement.

Inspect a full Team report example (Markdown). A clearly synthetic engagement showing the summary, scope, findings, gaps, recommendations and evidence appendix—not a customer case study.

Try the sample. Choose the depth of help.

The local sample is free. Paid Team and Deep reports add founder time and a defined deliverable. Before kickoff, agree how your repository's commits map to the requested PR window, especially with squash merges or shallow history.

Sample

Free · local sample · self-serve

A watermarked report from the same free engine, without founder review. The default window is HEAD~5..HEAD: recent commits, not necessarily five pull requests. 

pip install roam-code
roam pr-replay --tier sample

Run inside a local Git checkout with at least six commits along the current branch's first-parent history, so HEAD~5 exists. A shallow clone may need more history. For another window, choose a valid --range after reading roam pr-replay --help. No account, email, or repository upload is needed for this sample.

Team

$2,500 · 30 PRs · 30-min walk-through

A focused assessment of an agreed 30-PR history window.

  • Markdown + PDF report with ranked findings and a breakdown by check.
  • Founder review of the important patterns and checks to evaluate in CI.
  • A 30-minute walk-through with your team.

5 business days from the agreed kickoff. We confirm availability before work starts.

$1,250 banked toward Roam Review — redeemable within 60 days of its launch, not before. Read the future-credit conditions.

Request Team — $2,500

This opens an email draft, not an order. Payment follows agreed written scope and invoice confirmation.

Deep

$6,000 · 90 PRs · 90-min walk-through

A broader assessment of an agreed 90-PR window or specified range.

  • Everything in Team, with a deeper look at each finding category.
  • A written 90-day remediation plan in the Markdown + PDF report.
  • A 90-minute walk-through with your team.

10 business days from the agreed kickoff. We confirm availability before work starts.

$3,000 banked toward Roam Review — redeemable within 60 days of its launch, not before. Read the future-credit conditions.

Request Deep — $6,000

This opens an email draft, not an order. Payment follows agreed written scope and invoice confirmation.

Do not email source code, credentials, or private reports. Start with your question, languages, and approximate scope. If the email button does not open an app, write to [email protected]. Response time and availability are confirmed by email.

Reports ship as Markdown + PDF. Turnaround: 5 business days for Team, 10 business days for Deep, both from kickoff. We never train on or reuse buyer code; the engagement runs against a temporary clone we delete within 7 calendar days of report delivery. A separate tax invoice is issued within 30 days of payment according to the applicable VAT treatment. Confirm billing details before payment. See the SOW, DPA, and security policy for details. Email [email protected] with questions before purchase.

What's in the deliverable

Every paid report has the same skeleton. Section depth scales with tier; Deep adds the per-detector deep-dive.

Executive summary A short account of the agreed history, the findings that need attention, and the limits of the checks.
Detector breakdown Findings grouped by the check that produced them, so you can see which patterns recur.
Per-PR ranking Changes ranked for investigation, with their date, commit reference, subject, and reported findings.
Per-detector deep-dive Deep tier only. A closer look at each finding category, with up to five example PRs per category.
Recommended next steps Prioritised checks to evaluate on your repository, plus CLI examples. Validate findings and false positives before making a check block CI.
Roam Review credit Explicit credit amount and 60-day window — surfaced inside the deliverable, not just the marketing page.
What's NOT covered Semantic correctness, security audit, performance profiling, in-flight PR review — set out explicitly.
Methodology What was measured, what wasn't, and how to reproduce on your own machine.

Synthetic example · Not a customer report

Look inside a Team report.

A short excerpt from the full example—not a screenshot of a completed audit.

Executive summary · Example recommendation

Investigate a shared pricing calculation first. Check whether a similar implementation needs the same change.

The full example separates observations, reviewer decisions and the evidence needed before acting.

Evidence in this example

Repository review
Not performed
Tests
Not run
Findings
Fictional scenarios

Missing evidence is not an all-clear.

Read the complete synthetic Team report (Markdown) Paid delivery includes Markdown + PDF. This preview shows the format, not an executed engagement or a PDF delivery.

Who PR Replay is for

A report is useful when it helps answer a specific question about your change history.

  1. A Teams adopting AI coding agents. Agents are producing more changes than you can inspect line by line. You want help choosing which structural findings deserve investigation.
  2. B Post-incident retrospectives. You want to inspect structural patterns around a known incident and look for related changes. Bring your operational evidence: replay alone does not establish the cause or prove a gate would have prevented it.
  3. C Choosing checks for your existing workflow. You want to see whether particular findings are useful on your repository before adding checks to your agent instructions or CI. No hosted subscription is required; the report should be useful on its own.

How it works

Agree the question and scope, review the findings, then walk through the report together.

  1. 1 Kickoff (day 1). Describe your question and proposed history window. We confirm fit and availability, then agree a written scope of work and data-handling agreement. The linked documents are templates for review, not signed agreements. Agree the access and payment path before work begins.
  2. 2 Replay (days 2–4 for Team, 2–8 for Deep). We clone to a temp working tree, run roam pr-replay across your range, founder reviews the top findings by hand and drafts the narrative. Per-detector deep-dive added on Deep tier.
  3. 3 Walk-through + delivery (day 5 / day 10). 30-min call (Team) or 90-min call (Deep) over your video tool of choice. We walk the report, answer questions, and discuss the recommended CI gates. Polished Markdown + PDF lands in your inbox right after.

We delete the temporary clone within 7 calendar days of report delivery. The git ledger we kept of the engagement is yours on request, and the optional 50% credit toward Roam Review is banked as a founding-customer credit — the 60-day redemption window starts when Roam Review ships, not now.

What the report can—and cannot—tell you

The report names what was checked, what was found, and what remains unknown. These eight questions make the boundaries visible. Reading history does not recreate an agent's actions, permissions, or approval process.

Who acted? Out of scope. Git authors stay in your git log; replay does not re-derive identity.
What authority existed? Out of scope. A replay cannot reconstruct the permissions in force when a change was made.
What context was read? Partial. Commit range, changed files, graph context, and detector set are disclosed.
What changed? In scope. Per-PR files, changed subjects, and structural findings are reported.
What could break? Partial. Indexed connections and detector findings identify leads to inspect, not every runtime effect or vulnerability.
What policy applied? In scope. Default detector policy or your provided rule file is named in the report.
What verified it? Partial. Replay command, detector versions, and report artifacts are captured; tests are not rerun.
Who accepted risk? Out of scope. Approval remains producer_not_available unless your source system supplies it.

The coverage table is reproducible from the audit-report template. PR Replay does not create live edit-time authority or approval records. Those need evidence captured by the system that performed the work. Hosted Roam Review is not available. For the framework mapping see governance; for current certification posture and target dates see trust.

Apache 2.0 engine The same roam-code CLI you can install yourself runs the analysis. Nothing proprietary in the audit pipeline.
Temporary repository clone We use a temporary clone for the engagement and delete it within 7 calendar days of report delivery. The DPA covers termination, working files and other retention details.
No training on your code Contractually committed: never used to train, fine-tune, or evaluate any ML model — ours or any third-party's. See the security policy.
EU-based provider Default processing location is the EU; Stripe handles billing under SCCs. Agree access and data-handling terms before sharing private material. See the invoice terms for billing details.
Procurement packet Reviewers can pull the DPA, NDA template, security-procurement packet, and master SOW from templates/legal/security-procurement-packet.md. Current certification posture lives on the trust page; framework control mapping on governance.

The optional credit toward a future Roam Review subscription

Half of the engagement fee is banked toward your first year of Roam Review — the 60-day redemption window starts when Roam Review ships (it's in development), so the credit can't expire before you can use it.

Roam Review has no confirmed launch date and is not available to subscribe to. This is a future subscription credit, not cash back. The PR Replay report fee is still payable in full.

PR Replay tier Fee Credits toward Review
Team $2,500 $1,250
Deep $6,000 $3,000

Mention the report when subscribing and we apply the credit to the first invoice. Credit is single-use and expires 60 days after Roam Review reaches general availability. The written credit terms also define transferability and eligible tiers. Review those terms before agreeing an engagement; the credit is not a launch promise.

Common questions

How do I get the report on a private repo without giving you direct access?

We can discuss read-only access or a customer-run replay. If you run it locally, first agree which reports can be shared and whether they contain enough evidence for the work. Reports may contain source snippets and identifiers: review them before sharing. Agree the access, written scope, and data-handling terms before sending private material.

What if the report is noise, or finds nothing material?

For new engagements expressly adopting the September 20, 2026 terms, raise a disputed finding within 5 business days after the walk-through. We supply supporting evidence within 10 business days of your objection. Unsupported findings are removed; findings still disputed after 30 calendar days do not count as surviving findings. Each excluded finding earns a pro-rata refund. Zero material findings, or fewer than half the original high/medium findings surviving review, means a full refund for Team or Deep. You keep the report. The Refund Policy defines the evidence test, calculation and deadlines. Already-agreed customer rights remain unchanged.

Can I share the report with my CTO, board, or auditor?

Yes. The report is yours. You own the IP and can redistribute internally without restriction. External attribution (e.g., in a public post-mortem) is appreciated but not required.

Why this and not just running roam critique ourselves?

You can run the free tools yourself. The paid engagement adds founder review of the agreed history, prioritised findings to investigate, a written report, and a 30 or 90-minute walk-through. Any proposed CI check still needs validation on your repository before it blocks changes.

How fast is the turnaround?

5 business days from kickoff for Team, 10 business days for Deep. Kickoff happens the day we receive payment confirmation and the agreed-on commit range or repo access. Any different schedule is agreed in writing before work begins.

Do you train ML models on our code?

No. Contractually committed in the DPA. We never use buyer source code, diffs, comments, metrics, or any derived artefact to train, fine-tune, or evaluate any machine-learning model — ours, ours-via-third-party, or any third party's.

Can multiple people on our team join the walk-through?

Yes. The draft scope of work includes up to five attendees. Agree who should join and the meeting time before kickoff; useful participants include the engineering lead and people familiar with the changes being reviewed.

Is this a compliance certification?

No. PR Replay is a scoped structural assessment, not legal advice or certification. Its records describe the checks performed and their limits. Your legal or assurance team must decide whether those records are useful for its requirements.

Try the free sample first: Run the local sample · or email [email protected] with questions before purchase.

Adjacent pages: Trust · Governance · Pricing · Architecture