.korvu.yml reference

.korvu.yml lives at the root of your repo. It overrides org-level defaults on a per-repo basis. Korvu validates the file on push — if it's invalid, the previous policy keeps applying.

Minimal example

version: 1
review:
  depth: standard

Everything else has sensible defaults. Drop just the keys you want to override.

Top-level keys

Key	Type	Default	Description
version	int	required	Config schema version. Currently 1.
review	object	—	Review behavior.
policies	object	—	Reviewer ping and gating rules.
paths	object	—	Path globs and ignore patterns.
prompts	object	—	Custom prompt overrides. (Business+ only.)

review

Controls the review's depth and how comments are posted.

review:
  depth: standard              # quick · standard · thorough
  comment_style: inline+summary # inline · summary · inline+summary
  language_hint: typescript     # optional: nudges the model on dominant language

• depth: quick — fastest, surface-level findings only. Good for low-risk repos.
• depth: standard — default. Balanced findings + cost.
• depth: thorough — deeper analysis. Slower, more thorough. Best for security-sensitive code.

policies

Defines who gets pinged and what blocks the merge.

policies:
  block_on_severity: critical
  request_review_from:
    - "@security-team"  # when finding tag includes "security"
  skip_if_authors:
    - "dependabot[bot]"
    - "renovate[bot]"

Org defaults win for security If your org sets block_on_severity at the org level, individual repos cannot loosen it. Repos can tighten (e.g. block on high) but not weaken.

paths

Tell Korvu which files to skip entirely.

paths:
  ignore:
    - "**/*.lock"
    - "vendor/**"
    - "**/*.generated.ts"
  focus:
    - "src/**"
    - "lib/**"

focus is a positive filter — if set, Korvu only reviews files matching one of these globs. ignore is subtractive.

prompts

Override the system prompt Korvu sends to the model. Business and Enterprise only.

prompts:
  system: |
    You are reviewing code for the Orbital monorepo.
    Treat performance regressions as severity:high.
    Skip stylistic nits — we run a formatter on every push.

Korvu validates that overridden prompts don't disable safety guardrails (no jailbreak strings, no system-prompt overrides for severity classification).

Don't store secrets here

The file is checked into git. Don't put tokens, keys, or any other secret in .korvu.yml. Use environment variables or the Korvu UI for credentials.