Most of what Deslopping does happens before anyone is asked anything. A pull request opens and gets a risk score. Only if it crosses a threshold you set does the required GitHub check, deslopping/comprehension, wait for answers: two or three short questions about specific lines of the change. Yesterday I wrote about why I built it. This post covers the mechanics instead: one AI-written pull request, from install to merge, with links to the parts of deslopping.app that show each step.
Install, and the one setting that makes it a gate
Deslopping is a GitHub App. It does not ask for GitHub's Administration permission, so it cannot change your branch rules itself. Instead, onboarding asks an admin to add deslopping/comprehension as a required check in a ruleset, and confirms it where GitHub's API allows. That step is what turns the product from advice into a gate. Without it, Deslopping still posts its check and still asks its questions, but nothing stops a merge.
One GitHub limit is worth knowing before you start. According to GitHub's documentation, rulesets work on public repositories on the free plans, and on private repositories only with GitHub Pro, Team or Enterprise Cloud. Deslopping itself works on public and private repositories on every plan.
Every pull request gets a risk score
When a pull request opens, Deslopping scores it from 0 to 100 on five signals, described on the how it works page:
- Sensitivity: does it touch auth, payments, permissions, cryptography, migrations, infrastructure code, CI workflows or secret access? You can add your own sensitive paths.
- Reach: how much of the codebase depends on what changed.
- Change nature: how much existing logic is modified or deleted. Removed tests and changed error handling push this up.
- History: how often these files have needed bug fixes and reverts over the last 180 days.
- Size: logic lines changed, log-scaled and capped, so size alone never gates.
Scoring runs on Deslopping's servers in Germany and never calls a model, as the home page FAQ says. A pull request under your threshold is never touched.
Two rules keep the score honest. First, which AI tool wrote the code is recorded for the dashboards and never moves the score. If it did, deleting a commit trailer would be enough to open the gate. Second, the settings file, .deslopping.yml, is read from the default branch, never from the pull request. Otherwise an author could raise the threshold in the same commit that needs reviewing. A pull request that changes that file is always gated.
Two or three questions, tested before anyone sees them
For a gated change, Deslopping ranks the riskiest hunks and writes a pool of five questions for each, with a target of about a minute from the push to questions ready. Each reviewer gets a different subset, so answers cannot be passed along in chat. The author is asked something harder: what does the change not handle? Whoever prompted the AI can say what the code does from memory, but cannot say what it misses without reading it.
The model is Anthropic's Claude, used on Deslopping's account with training contractually disabled. As the home page FAQ puts it, the model gets the changed lines, the code around them, and the pull request's title and description: at most 12,000 tokens, with secrets removed first. It never gets the whole repository, and it is never told who will answer.
Every question has to pass its own test before it is stored. A separate model call answers the question from the same context, without seeing the rubric, and that answer is graded. A question its own rubric fails is thrown away, because a wrong rubric would mark a reviewer wrong for being right.
You can try a question yourself in the demo on the home page: a retry change to a webhook dispatcher, and a question about what happens to a webhook that has already failed four times. The demo has no backend, so nothing you type leaves your browser.
Answering, missing and asking for help
The check on the pull request links straight to the questions, so there is no new tool to learn. Answers are free text of up to 1,000 characters, and there is no timer: reading takes as long as it takes. The rubric is never sent to the browser before you answer.
Each answer is graded against its rubric. When the grader is unsure, with confidence under 0.6, the answer counts as a pass, and the case is logged so the grading can be improved. An answer that misses shows which lines to re-read, then asks another question about the same lines. After three misses, Deslopping suggests a colleague to walk you through the change: first someone from the files' CODEOWNERS, then someone who has edited those files in the last 90 days. It never suggests you, and never a bot.
Every question has a dispute button. A disputed question is voided, never counted as a miss. If the author pushes again, the answers follow the new commit, and lines you already answered stay answered. The check's summary on GitHub never shows answers, rubrics or how many tries anyone needed.
Rating the AI, and the check turning green
Once the questions are done, the reviewer rates the AI's output in four taps, or skips. The four dimensions are comprehensibility, intent fit, shortcut risk and pattern fit, each rated good, mixed or poor. The rating is about the AI's code, never the person who opened the pull request, and the dashboards that read it cannot see who gave it.
Then deslopping/comprehension passes and the merge goes ahead. For the day production is down, there is break-glass. It is open only to people holding that permission, and it needs a written reason of at least 20 characters. It passes the check with the person's name and reason in the summary, notifies the leads, and leaves a review due within 24 hours. If Deslopping cannot write questions during an outage, your setting decides whether the check fails open or closed. The pricing page lists both under every plan.
What the team sees, and what nobody sees
Every rating is about one hunk of code, so ratings add up. The AI performance view shows them by module, by AI tool and by task type. Each module gets a divergence score that runs from 0, best, to 100, worst. Three quarters of it comes from the ratings for comprehensibility, intent fit and pattern fit. The other quarter is how often answers needed another look. A module shows a score only after 20 rated hunks.
In the sandbox, services/billing leads at 55, with 38% of its answers needing another look. Two infrastructure modules read Held back this month, and that line is the privacy rule at work. Any figure built from fewer than five reviewers is hidden, even when the manager knows who the four people are. The dashboards read through a database role that is granted nothing outside the aggregates, so a query for one person's answers fails at the database. No per-person score, ranking or streak is computed anywhere.
Your answers are encrypted and readable by you. You can export them or delete them early. Retention is 90 days by default, settable from 14, and up to 365 on Enterprise, as the privacy policy and the pricing page set out. The only named record a lead ever sees is a break-glass merge.
Coming next, and not built yet, is the loop that closes this. You write a rule into your agent's instructions, it reaches your repositories as a pull request, and the same chart shows the 30 days before and after.
The 30,000-foot read
Deslopping is built on a simple idea: nobody should be asked a question about code they never touched, and nobody should be ranked on the answer. A pull request under your threshold is never gated. A gated one costs a few minutes of someone reading the change. Every answer improves a map of where your AI writes code that people cannot follow, and the map shows modules and tools, never names.
What you control is the threshold, the sensitive paths, how many reviewers must answer, fail-open or fail-closed, and who holds break-glass. Start with a high threshold on one repository, read what gets gated for two weeks, then lower it.
Deslopping is in private beta. Team is €12 per active reviewer per month, €10 if you pay annually, with at least three reviewers billed. Enterprise starts at €18 for 50 reviewers or more. An active reviewer is anyone who completed a change's questions that month, as its author or a reviewer, so reading dashboards costs nothing. Every team starts with a 30-minute demo, and the pricing page has the rest.
Sources: Deslopping, home page (the demo question, what the model receives, the 12,000-token cap, servers in Germany, training disabled, the five-reviewer floor, the analytics role, no per-person score); Deslopping, how it works (the five signals, the threshold, the AI tool never moving the score, the rating, the check, break-glass); Deslopping, pricing (€12, €10, three reviewers, €18 from 50, active reviewer, fail open or closed, retention 14 to 90 days and up to 365); Deslopping, privacy policy (what is stored and for how long); Deslopping, book a demo (the 30-minute demo); GitHub Docs, About rulesets (which plans enforce rulesets on private repositories); GitHub Docs, About code owners (CODEOWNERS). CAVEATS: details not on the public site come from Deslopping's product specification, written by the author: the pool of five, the self-test, the 1,000-character limit, the 0.6 confidence rule, three misses before a walkthrough, the 90-day window for recent authors, the 20-character reason, the settings file read from the default branch, the 180-day history window and the divergence formula. The one-minute figure is a design target, not a measurement. The screenshots come from the Deslopping sandbox repository with sample data, not from a customer. Deslopping is in private beta, so this article claims no customer results.