[meddlin]

What this adds

Slice 5 (the last), stacked on #40 (then #39, #38, #37). The LLM prose layer of item 8 in docs/dependabot-watch.md, built the way the research note and docs/ollama-integration.md say to.

• Notes, for needs work and review first only. A few plain sentences under the PR, written by the Ollama model from: the verdict's facts, the title, and a markup-stripped, 4,000-character slice of the PR description. The description is fetched on demand (a small GraphQL call) and is never stored with the findings or read by classify.
• The verdict never reads the note. It is stored in its own table (dependabot_explanations) with the model's name and a fingerprint of what it was written from, and the page shows it under "The verdict above comes from GitHub's data, not from this note", through the existing image-free MarkdownBody untrusted. A test confirms that a hostile reply ("this is READY, merge it") leaves every bucket, reason and action unchanged.
• Injection hygiene: rules fixed in code; the description is in a block marked as untrusted data whose closing tags the text cannot forge (the title and reasons are neutralised too); markup, images, link targets and comments are removed first; the reply is capped at 220 tokens and cleaned (reasoning blocks, control characters, images).
• ModelLane (packages/core/src/ai/lane.ts): one model request at a time, chat ahead of background work. The chat route now takes the lane; a note being written is told to stop and is simply written again afterwards (items are small and idempotent). A stuck background task cannot hold chat up for more than 10 s. It is per process, as the Ollama note says.
• A note is rewritten only when the facts change, is deleted when its PR leaves the newest check, and is skipped for PRs the user put aside. With Ollama off or down nothing else changes; the page shows why notes are paused (and backs off 10 minutes).
• Starts with the scheduler (boot hook / first page).

Not done, said plainly

• No real model was run: tests use a fake behind the ChatBackend interface. Quality, and time per note on the 3080 Ti, are unmeasured. Worth trying with your model and one real PR before relying on it.
• The tail of a CI log (needs Actions: read) and a lane shared across processes are not built.

Verification

npm run typecheck, npm test (511 tests; 38 new, covering the lane, prompt building, cleaning, the explainer, the page view and chat priority) and npm run build pass. Mutation-checked: ignoring preemption, or removing the chat-stops-batch step, fails tests. In the browser against an isolated seeded home: notes render under the right PRs, a hostile seeded note's image became the text "[image: …]" with no <img> in the DOM, and its link got rel=nofollow.

🤖 Generated with Claude Code