* chore(#2799): resolve reviewer lanes into executable invocation plans
Phase 5b of ADR-2782. Adds the resolver and runner that let invoke_reviewers
iterate declared lanes instead of hand-authored per-CLI bash.
Five additive descriptor amendments, each forced by a lane that ships today:
- LaneHandler gains 'opencode' — the lane rebuilds its review from assistant
text parts of a --format json stream; a plain stdout copy re-breaks #1936.
- modelConfigKey — antigravity's key is review.models.agy, not .antigravity,
so resolving by slug silently dropped a configured model.
- defaultHost/fallbackModel — Phase 4 federated every *_host with a default of
empty string; the real fallback only existed in the bash.
- args becomes an argv template with a closed four-placeholder vocabulary.
Positional splicing produced 'codex --model M -o F exec --ephemeral', which
is not a valid invocation: codex injects in the middle, twice.
- kimi-code lane, with the bounded command-capability probe (needle
--output-format) that tells Kimi Code from the legacy python kimi-cli.
Parity gate re-pointed: the workflow-text families it scanned are the text this
phase deletes, so they are replaced by descriptor-to-registry parity plus an
anti-parity check that no bespoke leg returns.
jq, curl and external timeout/gtimeout all drop out of the review path.
Refs #2782
* chore(#2799): add review-lane query surface and widen the manifest vocabulary
Adds the gsd-tools 'review-lane' route (plan/invoke/sections) the workflow
loops over, projects all twelve lanes into their capability manifests, and
widens capability-validator for the amendments.
opencode admitted to VALID_LANE_HANDLERS under the second arm of the enum's
own admission rule: one lane, justified by a documented upstream defect data
cannot express (#1936 — the agent can end its turn with zero output tokens and
--format default then drops the assistant text entirely).
Two bugs caught by an end-to-end stub run and fixed here:
- loadConfigResolved returns a provenance wrapper, not the config; using it
directly resolved every key to undefined, which reads as 'nothing
configured' and silently dropped every model override.
- hasBinary used shell:true with an args array (Node 26 DEP0190). Replaced
with a PATH scan that spawns nothing at all.
Refs #2782
* chore(#2799): iterate declared lanes in invoke_reviewers and write_reviews
Replaces the eleven hand-authored per-CLI bash legs with a loop over resolved
lanes, and renders REVIEWS.md sections from each lane's declared
reviewsSection instead of thirteen hardcoded headings. review.md drops from
1104 lines to 507 (61KB to 28.7KB).
Parity gate re-pointed, as agreed: the leg-marker and section-heading families
scanned exactly the text this phase deletes, so they are replaced by
descriptor-to-registry parity in both directions, plus an anti-parity check
that fires if a bespoke leg is ever re-added. Enum, emitting sites and the
Object.keys lock moved together.
The budget-trim helper is hoisted out of the Ollama leg: it was always
lane-agnostic, and any lane may now declare a promptBudgetKey.
Refs #2782
* feat(#2799): bind the consented egress host and re-verify it at invocation
Completes ADR-2782 D5. Rule 1 was recorded in the ADR as delivered by Phase 3
but was not implemented: ConsentRecord had no host field and nothing in the
tree bound one, so this phase's rule-4 comparison had no baseline.
ConsentRecord gains an OPTIONAL reviewerHost. Optional is the whole design:
isValidConsentRecord does not require it, so every record already on disk
stays valid and no re-consent storm fires (D4 rule 5). It is deliberately
excluded from disclosureSignature — the loader has no config resolver, so
folding a config-derived value in would make loader and lifecycle compute
different signatures for the same manifest and re-prompt forever.
Install resolves hostConfigKey (falling back to the lane's declared
defaultHost, which is what the invocation path uses) and records it.
Invocation re-resolves and blocks on mismatch rather than silently
redirecting. Absence allows: no record, or a record predating the field,
means nothing to compare — denying there would break every existing
local-model user on upgrade.
Refs #2782
* test(#2799): cover the resolver, runner and handlers; retarget the parity suites
Adds the golden invocation-plan table (one row per shipped lane, derived from
the bash legs rather than the descriptor types) plus runner coverage for the
probe, empty-output policy, the three handlers and the egress check.
Retargets the existing suites onto the new contract: descriptor-to-registry
parity, the anti-parity check, the opencode handler, and the twelfth lane.
Two corrections found by running them:
- modelConfigKey was required; that breaks D4 rule 2, since a reviewer
manifest authored before this phase would fail validation on upgrade. It is
optional, read as null when absent.
- the antigravity non-zero-exit test pre-seeded the transcript, which asserted
that a STALE entry leaks through — the exact bug the watermark prevents. The
spawn now appends, as the real tool does.
Refs #2782
* fix(#2799): restore agy --add-dir and the self-report prompt in the handler
Retargeting the three legacy reviewer suites off the deleted bash surfaced two
real regressions in the port, both #2176:
- --add-dir was dropped. Without it agy's permission context never receives the
cwd repo, so the agent anchors on its own scratch dir and reviews the plan
text in isolation — the exact failure the Review Instructions forbid. It is
capability-probed, because an older agy rejects the unknown flag outright and
a lane that fails to start is worse than one running on the prompt anchor.
- the prompt lost the clause mandating a REVIEWED-WITHOUT-REPO-ACCESS
self-report, which is what makes a blind review distinguishable from a
grounded one. antigravity now builds its own prompt variant.
Also ports the #2073 mode-2 cli.log diagnostic, which was dropped: a pinned
model that 404s exits 0 with empty stdout AND an empty transcript, so agy's own
log is the only evidence that anything failed.
The three suites now assert against the plan and the handler instead of
matching fence text, so they no longer need allow-test-rule exemptions.
Refs #2782
* docs(#2799): document the declared lanes, the new flag, and dropped prerequisites
COMMANDS.md gains --kimi-code and replaces the jq-prerequisite paragraph,
which is now false: no lane requires jq, curl or an external timeout. Adds the
changed-egress-destination behavior, since a blocked lane is something a user
can hit.
CONFIGURATION.md records that the model config key is declared per lane rather
than derived from the flag — antigravity's is review.models.agy — and adds
review.models.kimi-code.
reviewer-instances.md now routes an instance through its lane's single
invocation seam instead of a copied per-adapter bash block, which is what lets
a cross-cutting fix reach instances for free. That required implementing the
--model/--agent/--as flags it documents; --model re-resolves through the lane's
argv template rather than splicing, so the flag lands where the lane declares
it rather than ahead of a subcommand.
CONTEXT.md glossary gains both new modules.
Refs #2782
* chore(#2799): drop the stale emitted-drift acknowledgment
The only entry was #2797's, acknowledging COMMENT-ONLY GROWTH in review.md.
That file now shrinks by ~32KB and every emitted hash that moved is
attributable to this diff, so the ack no longer explains anything. Removing
the last entry means removing the file: its presence is the alarm, and an
empty one signals nothing.
Verified by deleting it and re-running the attribution and provenance gates
plus lint:ci — all green without it.
Refs #2782
* docs(#2799): record the Phase 5b vocabulary widenings in ADR-2782
Five additive amendments, each forced by a lane that ships today, plus two
corrections the phase had to make rather than work around:
- D5 rule 1 was recorded as delivered by Phase 3 and was not implemented, so
this phase's rule-4 comparison had no baseline. Recorded because an ADR
asserting a rule was delivered is exactly what stops a later phase checking.
- The DEFECT.GENERATIVE-FIX gate is re-pointed: its workflow-text families
scanned the text this phase deletes.
Also records that D7's 'skip the probe where no bounding mechanism exists'
carve-out is obsolete — in practice it meant the Antigravity lane ran unbounded
on every stock macOS host, which ships neither timeout nor gtimeout.
Refs #2782
* fix(#2799): close four defects found by adversarial review
Two confirmed bugs, both reproduced before fixing:
- resolveLanePlan was not total. An openai-http lane with a missing or
non-object invoke dereferenced inv.hostConfigKey and threw, contradicting
the module's own documented contract; the spawn branch guarded correctly and
the http branch did not. The CLI seam resolves every selected lane in one
map, so one malformed overlay manifest would have aborted the whole review
rather than dropping its own lane. Guarded, plus a per-lane try/catch at the
seam so a throw can never take down siblings.
- A reviewer-instance model was silently dropped for any lane declaring
modelConfigKey null (cursor, qwen, coderabbit). reviewer_instances validates
that cli is a known slug but never that the slug accepts a model, so a user
could configure one, get a clean run, and never learn a different model
reviewed their plan. Now warns explicitly.
Two hardening fixes:
- The slug is concatenated into artifact paths, so LANE_SLUG_RE is enforced in
the resolver rather than inherited from a validator that does not run on this
path — the module documents itself as the overlay-manifest trust boundary, so
it should not depend on someone else having checked.
- normalizeHost mangled a scheme-less value: new URL('localhost:11434') parses
with an empty hostname, so it became 'localhost://11434' and was compared and
requested as if real. An empty hostname now means not-a-URL.
Also documents the one gap that cannot be closed here: the antigravity
watermark is keyed by workspace, so two concurrent reviews of the same repo
share a transcript. agy exposes no per-invocation id to filter on, so the
handler now states which half of its never-stale guarantee actually holds.
Refs #2782
* test(#2799): retarget the remaining eight review.md-asserting suites
The remote runner found 37 failures the local sweep missed (it hit the shell's
two-minute cap before reaching these). All eight extract per-CLI bash from
review.md that this phase deletes; each protects a real invariant, so each is
retargeted onto the plan, the runner or the handler rather than removed.
Three real defects surfaced by doing so:
- effort args never reached ANY lane. model-resolver.cjs exports no
resolveExecution, so effortFor silently returned [] every time. Restored by
calling the same bounded resolve-execution query the bash legs used — and
NOT with --raw, which prints the resolved effort rather than the picked
field, so claude got 'low' instead of '--effort low'.
- the timeout guidance lost 'a silent empty output is a timeout kill, not a
crash' — the operator note that exists because of the Codex 0xc0000142
misdiagnosis. Restored.
- the opencode handler dropped EMPTY assistant text parts. The shipped jq was
, and only substitutes for false/null — an empty
string is truthy in jq and contributed a blank line. Found by a property
test shrinking to ['', ''].
The opencode property suite no longer spawns jq at all, which deletes the
#2099 hang mechanism it was architected around rather than mitigating it.
Refs #2782
* fix(#2799): register the two new generated modules, and untrack them
The remote runner caught build output committed to git. Both new modules
compile from src/*.cts into gsd-core/bin/lib/*.cjs, and every sibling generated
that way is gitignored and eslint-ignored (ADR-457) - including Phase 1's own
review-lane-descriptor.cjs. Mine were neither, so repo-invariants' "each
bin/lib/*.cjs is linted xor ignored according to migration state" failed.
Registered both in .gitignore and eslint.config.mjs alongside the Phase 1
module, and dropped them from the index. Nothing about the shipped behaviour
changes; the artifacts are rebuilt by build:lib.
This is the new-.cts-module registration ripple, and it is the one part of it I
had not completed - the CONTEXT.md glossary and the inventory manifest were
already done.
Refs #2782
* chore(#2799): backfill changeset pr number to 2861
* chore(#2799): backfill changeset pr number to 2861
---------
Co-authored-by: Test <test@example.com>
3f6b063fbb