samagotchi 0.105.0 → 0.107.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e0920f477e95206617da7d0d43e39dc981b071b34f456c60a7b669e4836875be
-  data.tar.gz: 1f9219bb12b92c2178ab15d57fddfaaee3654972d9b90e2ce11b8265ddab90cf
+  metadata.gz: 58e0f763c1974428c1144b884f63a9529fe5b1a973b1443e44b0a4e1a3f3cf48
+  data.tar.gz: 6c6a8a429e01a837329065239819bf69568e1455425bcf60e1badae8208553be
 SHA512:
-  metadata.gz: 5c7625cff1523fe72e997ec3265465f9385b7a7fe59e8a3f6b097f8015e84f1b32441582218c75b4145f2f8ffb2b58ea7909c30f65efd4dbac114650c4b65f55
-  data.tar.gz: 3f2afdc87fa1a48efebbc14138016f2da28502e74b3a69d59ddd2c1ae5c37041af2192a0a071cf78325a14c2f630afe28e42cfed03b625f103fbf88f2037533c
+  metadata.gz: b0fe1b18a4b7defe96fc787ab753e9cfbf6c62eebddac74d05d74b972439b87737a9b5e6192c1d026dc2add3702b1659be6846ebaa894bd87e65dc5ccdffd823
+  data.tar.gz: 7a74e55c15487d3ccdac35ecaaec567b5feefab39312712b2ed07befdbfd9def1b5e4685170cc28550fd89f47eca839e5aa06a3c4128ae426e89962f69f0c1db

data/CHANGELOG.md

@@ -8,6 +8,171 @@ and commands may change between minor versions. How releases are made:
 
 ## [Unreleased]
 
+## [0.107.0] - 2026-10-24
+
+### Added
+
+- Review sessions for participants (experimental). `chi review docs/plan.md …` starts a session made to be shared:
+  its subjects are project files (a secret such as `.env` or a key, a file outside the project or chi's own is
+  refused with one message), it starts idle, and it prints the `chi share` line to invite someone. `chi review --from
+  ID` starts a review of a working session from its recap, never its transcript; that session keeps running,
+  unarchived. Both work with `chi --remote NAME` (`--dir` there). On the web, the start page's `review…` chip takes
+  the files, and the participants panel's **Start a review of it** starts a review of the session. Sharing a session that isn't a review
+  session still works, with a warning naming how many tool outputs its history holds (`chi share`, the Invite
+  dialog). Participants read the subjects as the **Plan**: rendered beside the thread on a wide screen, a Plan |
+  Thread toggle on a phone, checked again on every read and redacted. Under each participant's review turn the owner
+  gets **Apply**: it puts an owner's turn in the composer, not sent, that quotes the proposal line by line, so the
+  participant's words never reach the model as the owner's instruction; sent while a turn runs, it queues as the
+  owner's own turn (the delivery line says so; during the owner's own turn Esc steers it in instead), never merged into the running one. Plugins get `ctx.sessions.review(subjects:,
+  seed:)`. The coordinator bundle (0.6.0) adds an experimental sprint review: `/coordinate review [handoff]` opens a
+  review of the coordinator session seeded with its handoff, where a participant's new context gets a hand-off diff
+  and the owner's Apply updates the handoff. See [docs/cli.md](docs/cli.md#review-sessions) and
+  [docs/sessions.md](docs/sessions.md#review-sessions).
+
+### Changed
+
+- `chi`'s run flags take their whole name only, as the subcommands' flags always have: an abbreviation such as
+  `--verb` or `--mem x` is now an invalid option (exit 1) instead of `--verbose` / `--memory x`. Under `chi --remote`,
+  an abbreviated local-only flag could slip past the "runs on this machine only" check and be dropped silently.
+
+### Fixed
+
+- The owner's Continue on the step-limit offer of a participant whose turn is refused since (revoked, expired, at
+  their cap) ends the offer as a Stop does, with a notice: no "resumed" for a turn that never runs, and idle exit,
+  `/exit` and that participant's queued turns no longer wait on an offer nobody can answer.
+- A participant's queued turn the worker refuses (revoked, expired, at their cap) ends their `chi send --wait` (and
+  chi web's participant wait) at once: status `refused`, exit 1, `cancel_reason` `revoked` or `cap_reached`, instead
+  of waiting to the timeout (none by default).
+- The owner's input while a participant's review turn runs queues as the owner's own turn after it, from every
+  client (the web, the attached TUI, `chi send` without `--queue`), never steered or cut into their read-only turn;
+  each says it was queued (the web's delivery line, the TUI's note, `chi send`'s line), and `chi send --wait` waits
+  for that turn's own answer.
+- Participants: an agent participant's `chi send --wait` no longer reads its reply unfiltered: the reply is
+  redacted as the page shows it (secret shapes, the owner's token, host paths, no thinking or tool calls), and a
+  failed turn says "this turn failed: the session's owner can see why", never the error's own words.
+- Participants: a secret on a long streamed line (`password: …`, an `Authorization:` header, an `sk-…` key, a
+  private key's BEGIN line) is no longer sent unredacted when the participant's stream cuts the line at 400
+  characters; a line with no space for 1600 characters ends in `[redacted]`. A private key block that begins on the
+  line where another one ends is withheld too.
+- Participants: a participant's link opened on chi web's own machine (or `chi share` on a chi web not on the LAN,
+  whose link opens on that machine only) is the participant, no longer the owner: a `chp_` token is the participant's
+  from any peer, an ended one is refused, and the owner's browser that opened a participant link is the owner's again
+  once that link ends.
+- Participants: each refusal has one wording wherever it is met: a participant's `chi --remote` refused an
+  owner's command says "a participant can't do that: only the session's owner can", as chi web does, and an ended
+  link's page says whether it was revoked or expired.
+- Participants: chi web and `chi share` revoking (inviting, changing a cap) at the same moment can no longer leave
+  `participants.json` reading a revoked participant as active, so the worker refuses their queued turns: the file
+  is written under the grants store's lock.
+- Participants: a grants store (`web-grants/grants.json`) that doesn't read is no longer overwritten by the next
+  invite, which kept only the new grant and dropped every other link's; `chi share` (exit 1) and chi web refuse invite,
+  ls, cap and revoke with one line naming the file, and a grant row without its digest or expiry no longer
+  makes every participant request a 500.
+- Participants: revoking a participant (or their link expiring) ends their `chi send --wait` already waiting at chi
+  web, refused as their link's end, instead of handing them the reply that came within the next 30 s.
+- Participants: an agent participant's `chi send --wait` no longer gets the owner's wait state from chi web (the
+  owner's newest reply file, message count, pending question, running turn), only what waiting on its own turn needs.
+- Participants: a reply that opens a private key block and never closes it is withheld to that turn's end, no
+  longer hiding every later turn's reply from the participant's stream until they reload.
+- Participants: two of a participant's turns sent at once while no worker runs the session can no longer both pass
+  their queue limit.
+- `chi --remote NAME` words a value the remote's chi web refuses (`sessions list --cwd rel/dir`, `note --source " "`)
+  as one line naming the command, exit 2, instead of a Ruby backtrace; its other refusals are one line, exit 1.
+- A remote whose address answers something other than HTTP (another server on that port, an SSH banner), or a
+  request that can't be written in time, is the one "remote NAME (URL): …" failure line, exit 1 (`chi --remote`,
+  `chi remote add`'s check; the attached TUI reads it as unreachable), instead of a Ruby backtrace.
+- The attached TUI on a remote whose host went away (no answer at all, not a refused connection) gives up each
+  stream reconnect after 5 s, so it ends within about two minutes instead of about seventeen.
+- `chi --remote NAME context push` with a name that isn't a source's (`a/b`, `Bad Name`) gives the name rule, as
+  it does locally, instead of "too old for this command … update chi there" or a URI error.
+- A remote at an IPv6 address (`chi remote add box http://[::1]:4567`) connects: its commands and its attached
+  TUI's stream used the bracketed host as a name to look up ("can't find host").
+- Two `chi remote add` / `chi remote rm` at once keep each other's change: `remotes.yml` is rewritten under a lock.
+- `chi --help` and `chi remote --help` list `review` (and `share`) among the commands `chi --remote NAME` runs, and
+  `-p` says it stays in the session (the attached TUI by default, the REPL with `--no-shared`), not "in the REPL".
+- The participant page sends a comment once: a second Enter (or Send) while it is being posted no longer sends it
+  again as a second review turn.
+- The participant page that can't reach chi web (a network blip, a 5xx) says "Can't reach the session — retrying…" and
+  reads again with a backoff (3 s, doubling, at most 30 s), at open and after a turn boundary, instead of a blank or
+  silently stale page; a comment that can't be sent says so and stays in the box.
+- The participant page's live reply no longer loses the text that streams while the page re-reads the review (another
+  participant's comment queuing mid-turn left a hole until the turn ended): it streams again from the re-read's
+  cursor, and an older re-read answering last no longer overwrites a newer one.
+- The participant page shows chi web's own words for a refused comment or take-back ("A participant can't do that:
+  only the session's owner can.", too many turns, the spending cap) and for an ended link (revoked or expired),
+  instead of its own second wording.
+- The participant page keeps a tool list the reader opened or closed as they left it when the thread is read again or
+  the reply streams, and no longer redraws the messages it already shows (a text selection in them stays).
+- The participant page on a phone is the visible viewport's height (100dvh), so its composer sits above the browser's
+  URL bar instead of under it.
+- The participant page no longer adds the next turn's first words to the reply of the turn that just ended while it
+  reads the review again (a queued turn starting): the live reply waits for the re-read, whose stream replays them.
+- The web info bar's session clock, speed and ctx chips keep one width while a turn runs (tabular digits in a
+  reserved width), and the speed and the clock show from the session's start as muted placeholders: a tick or the
+  first generation's speed no longer widens the line and wraps a chip onto a new row.
+- The participants panel drops an Invite, Cap or Revoke answered after it closed or another session opened: a
+  one-time link no longer shows the next time a panel opens, under another session, and a failed list no longer
+  keeps the previous session's working-session warning.
+- The participants panel's **Start a review of it** closes the panel only once the review is made; a refusal stays in
+  the open panel, said there, instead of the panel closing on a toast.
+- The participants panel's Revoke asks first (`Revoke Alex's link? …`), as a delete does: it can't be undone, and on
+  a phone's sheet it sat one tap away beside Cap.
+- A participant's older prompt drawn before the participants list came (no name saved with it) no longer says
+  "a participant" until the page is reloaded: its badge takes the name when the list comes.
+- The start page's `review…` chip can name a file with a space in its path: in double quotes (`"docs/my plan.md"`);
+  an unclosed quote is said in its form. A file Start refuses (a secret, outside the project) is said in that form,
+  opened again at the files chosen, instead of a blocking alert.
+- The participants panel no longer closes on its own Cap or Invite another (the button, redrawn away by its own
+  click, read as a click outside the panel).
+
+Update with `chi update` (the system bundle 0.107.0, the coordinator bundle 0.6.0, the dev profile 0.7.2), then restart `chi web`.
+
+## [0.106.0] - 2026-10-23
+
+### Added
+
+- Participants (experimental) can now ask questions and comment: a participant's message through chi web is a
+  review turn of its own, queued behind the running one, that the model answers read-only. It may read the session's
+  project (never its secret files, `~/.ssh` or chi's own state and config) and project memories, and proposes
+  changes as text for the owner to apply; writes, commands, fetches, notes, reminders, plugin and MCP tools are
+  denied, never asked about, and every approval or question stays the owner's. A line starting `!` or `/` and images
+  are refused. Each participant gets one running and 3 waiting turns (`web.participants.queue`) and a spending cap,
+  `chi share --cap DOLLARS` (default $2, `web.participants.cap`); at the cap their next comment is refused and the
+  owner gets a notice, and `chi share cap ID P DOLLARS` raises it. `/stats` shows each participant's spend, their
+  turns and the side requests they caused. Hooks see `author:` on a participant's turn and plugins
+  `ctx.turn_author`; a hook still runs with the owner's power. A participant now sees the conversation and comments
+  from their page (desktop and phone): prompts and replies with who wrote each, one-line tool rows (the tool and a
+  project file's path, never its arguments or output), the reply streaming in, their own queued comments (Take back),
+  "waiting for the owner" while you answer a question, and every refusal in words. They never see tool output,
+  thinking, approvals, questions, memories, notes, the working set, cost or host paths: one server-side filter covers
+  their stream and reads, and redacts secret-shaped text as well. On your page, a participant's prompts carry their
+  name, and the info bar's participants chip opens a panel to invite (a link to copy, share or scan), see each one's
+  spend, turns and last visit, change a cap, revoke, and open the participant view: their page for this session, as
+  they see it (an agent participant can wait on its turns' replies through chi web's API). The `review`
+  toolkit is new and reserved: config's `toolkit.kits.review` is refused. A session whose worker predates this
+  release takes no participant's turn until it is restarted. In the attached terminal a participant's message reads
+  `Alex ▸ review> …`, a line says when someone is invited, revoked or expires, the status row counts them, and
+  `/share` and `/participants` (list, revoke, cap) run `chi share` on the session there. See [docs/cli.md](docs/cli.md#participants) and
+  [docs/guardrails.md](docs/guardrails.md#a-participants-review-boundary).
+
+### Fixed
+
+- Web, dark theme: the working set's rail (its rule and count), the list's header rows (`files · 2`) and its ops
+  text and buttons (drop, pin, add) are easier to read.
+- Web: `!rollback` (and a canceled continue) updates the working set at once; one that emptied it no longer leaves
+  the dropped items in the rail and the list until the next turn.
+- `chi share`'s link names the port the running chi web listens on (recorded in `$XDG_STATE_HOME/samagotchi/web.json`),
+  not only config's `web.port`.
+- A participant's `chi --remote NAME send -m` prints the review turn's id, and `send --wait -m` waits on it instead of
+  being refused as busy; a participant's turn held for the owner reads `waiting_for_owner` (exit 3).
+- `chi send --wait --format json`: a turn still running names the wait on its turn id.
+- The attached terminal no longer announces your own `/share` or `/participants revoke` a second time.
+- Web: the session bar's first line keeps one width through a turn: the status word takes the same room for idle and
+  running, the working set's chip shows from the session's start (`set 0`), and every chip is one height. A short
+  folder path no longer hops between the bar's rows mid-turn and moves the stage.
+
+Update with `chi update`.
+
 ## [0.105.0] - 2026-10-23
 
 ### Changed
@@ -3965,7 +4130,9 @@ and long-lived sessions.
 - A macOS desktop helper (`chi desktop install`): a "Send to chi" Service and a
   hotkey panel that send selected text or the clipboard to your sessions.
 
-[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.105.0...HEAD
+[Unreleased]: https://github.com/dm1try/samagotchi/compare/v0.107.0...HEAD
+[0.107.0]: https://github.com/dm1try/samagotchi/compare/v0.106.0...v0.107.0
+[0.106.0]: https://github.com/dm1try/samagotchi/compare/v0.105.0...v0.106.0
 [0.105.0]: https://github.com/dm1try/samagotchi/compare/v0.104.0...v0.105.0
 [0.104.0]: https://github.com/dm1try/samagotchi/compare/v0.103.0...v0.104.0
 [0.103.0]: https://github.com/dm1try/samagotchi/compare/v0.102.0...v0.103.0

data/bin/chi

@@ -54,6 +54,8 @@ SUBCOMMANDS = {
   "answer" => ["samagotchi/answer_command", "AnswerCommand"],
   # invite participants to review a session, list them, revoke them
   "share" => ["samagotchi/share_command", "ShareCommand"],
+  # a review session for files, or of a session (--from, --dir, --model)
+  "review" => ["samagotchi/review_command", "ReviewCommand"],
   # find a model server and write config.yml (--model, --name)
   "bootstrap" => ["samagotchi/bootstrap_command", "BootstrapCommand"],
   # bring an installed chi up to date

data/docs/architecture.md

@@ -470,7 +470,10 @@ The per-session port is OS-assigned (bound to `0`) and published to a `bridge.js
 for client discovery. `chi web`'s `GET /api/sessions/:id/stream` proxies this bridge
 (503 `not_live` when the worker is not running; full history of any session is served by
 `GET /api/sessions/:id/output`), as a byte pipe for the owner: `App#proxy_stream_body` gives `ProxyStreamBody` the
-request principal's frame filter (`App#stream_filter`, nil for the owner, the only principal today). Resume/ring-buffer state is **in-memory**, per worker: a cursor from
+request's frame filter (`App#stream_filter`: nil for the owner; for a participant, and the owner's participant view
+`?as=participant`, a `Web::ParticipantStreamFilter`, which cuts the Bridge's chunks into frames and writes each again
+from `Web::ParticipantView.event`'s allowlist, dropping every other event; only `from_seq` and `snapshot` reach the
+Bridge; [internals/participants.md](internals/participants.md#what-a-participant-sees)). Resume/ring-buffer state is **in-memory**, per worker: a cursor from
 an earlier worker gets the `reset` snapshot, not a replay.
 
 **Session hub.** The cross-session layer (which sessions exist, who owns them, what changed)
@@ -513,8 +516,8 @@ calling the `SessionAccess::Local` operation of the same name, so a remote backe
 token-gated like the rest (LAN mode: `Authorization: Bearer`), and one that takes an id is a `:session` route (an id
 that isn't one, or no such session: 404 `not_found`). Every `ROUTES` row also names who may use it, checked against
 the request's `Web::Principal` (`App#principal_for`): `owner`, or `participant` for a route a participant may use too.
-A participant (a `Web::Grants` token for one session) may use three: `GET /`, `GET /api/info` and `GET /api/sessions/:id`,
-each answered as theirs; every other route is `owner` (Permission below, and the participants routes in
+A participant (a `Web::Grants` token for one session) may use the page (`GET /`), `GET /api/info`, their session's
+show, review and filtered stream, and their turns and waits, each answered as theirs; every other route is `owner` (Permission below, and the participants routes in
 [internals/participants.md](internals/participants.md)); `spec/web/principal_spec.rb` fails on a row without one. How a request flows end to end, which checks run where and the trust
 model: [internals/remote-sessions.md](internals/remote-sessions.md).
 
@@ -545,6 +548,8 @@ model: [internals/remote-sessions.md](internals/remote-sessions.md).
 | `POST /api/sessions/:id/turn` (`no_interrupt`) | owner | `no_interrupt: true`: the turn runs with the raised iteration limit (`SessionManager.deliver_turn(no_interrupt:)`, to the Bridge or the input file) | as before | |
 | `POST /api/sessions/:id/command` (its 501) | owner | | | 501 `not_supported` for a builtin the worker lacks adds `command` (`"/title"`) and `message` |
 | `GET`/`POST`/`DELETE /api/sessions/:id/participants`, `GET`/`DELETE /api/participants` | owner | `chi share`'s (`name`, `kind`, `ttl`; `?id=p_…`) | the grants, never a token but POST's own once ([internals/participants.md](internals/participants.md)) | 400 `invalid_participant`; 404 |
+| `GET /api/sessions/:id/apply[?turn=T]` | owner | `turn`: a turn id or a prefix (none: the latest review turn with a reply) | 200 `{text, turn_id, author, author_name}` (`ReviewApply`): the owner's Apply of a participant's review turn, for the composer, never sent ([internals/participants.md](internals/participants.md)) | 404 `not_found`; 400 `not_review_turn`; 409 `no_reply` |
+| `POST /api/sessions` (`review`) | owner | `review: {subjects: [project files], from: a session id}`; never with `prompt`, `preview`, `idle` or `continues` (a `from` takes the source's folder and setup) | 201 as a create's: an idle review session (`ReviewStart.start`, or `ReviewStart.fork` with `from`) | 400 `invalid_review` (`ReviewStart::Refused`'s words: a subject, a gone folder); with `from` also 404 `not_found`, 400 `ambiguous_id` |
 
 `GET /api/info` names the feature `session_commands` (`SessionAccessRoutes::FEATURE`): `SessionAccess::Remote` asks it
 once before its first request, and a chi web without it (or `serve_static`'s 404 for a path no route takes) is "remote NAME runs chi X, too
@@ -689,6 +694,8 @@ A map of the parts the overview above doesn't name (paths under `lib/samagotchi/
 | Attached context | `context_sources.rb` (`ContextSources`), `context_poller.rb`, `context_absorber.rb`, `peer_sources.rb` (`PeerSources`: the sources peer bundles declare) | External sources a session keeps fresh, and the peer loop's wakes ([context.md](context.md)). |
 | LLM context strategies | `llm_context_strategy.rb`, `llm_context_view.rb`, `llm_context_stale.rb`, `llm_context_forget.rb` | What a request sends of the history (none, stale, forget) ([internals/llm-context-forget.md](internals/llm-context-forget.md)). |
 | Session chains | `session_continue.rb` (`SessionContinue`), `session_chain.rb` (`SessionChain`) | A session that continues an earlier one. `SessionChain.opener_for` gives the text web `continue →` prefills in the new link: the previous link's own first typed message when that link continues one itself, else nil (the 201's `opener`; not saved) ([sessions.md](sessions.md)). |
+| Review sessions | `review_start.rb` (`ReviewStart`), `session_review.rb` (`SessionReview`, the session's `review` field), `review_command.rb` (`ReviewCommand`, `chi review`), `review_apply.rb` (`ReviewApply`) | A session made to be shared: idle, its subjects project files checked by `Guardrails::ReviewPaths`, a fork of a working session from its recap (`--from`); Apply quotes a participant's review turn into the owner's composer ([sessions.md](sessions.md#review-sessions), [internals/participants.md](internals/participants.md)). |
+| Participants | `participants.rb` (`Participants`, the `participants.json` sidecar), `share_command.rb` (`ShareCommand`, `chi share`), `session_participants.rb`, `participants_watch.rb`, `web/grants.rb` (`Web::Grants`), `web/principal.rb` (`Web::Principal`), `web/participant_access.rb` (`Web::ParticipantAccess`), `web/participant_review.rb` + `web/participant_view.rb` (`Web::ParticipantReview`, `Web::ParticipantView`), `web/participant_stream_filter.rb`, `guardrails/review_boundary.rb` + `guardrails/review_paths.rb` | The people or agents an owner invites to review one session through chi web: their grants and gate, what they read, their read-only review turns ([internals/participants.md](internals/participants.md), [guardrails.md](guardrails.md)). |
 | Analytics | `analytics_file.rb` (`AnalyticsFile`), `session_metrics/totals.rb` (`SessionMetrics::Totals`), `session_metrics/model_segment.rb` (`SessionMetrics::ModelSegment`) | A session's `analytics.json` (`SessionMetrics#persist`); the sums over its turn records (`Totals`: tokens, cost, speeds, kept as running counters) and their split per model after a `/model` switch (`ModelSegment`: a run of turns on one model, the `model_segments` rows); `session_metrics/cost.rb` (`SessionMetrics::Cost`): the spend `ctx.cost` reads; `session_metrics/usage.rb` (`SessionMetrics::Usage`): the work `ctx.usage` reads. `session_metrics/side_totals.rb` (`SessionMetrics::SideTotals`) and `side_usage.rb` (`SideUsage`): the side requests' sums, apart from the turns'. |
 | Images / vision | `image_store.rb` (`ImageStore`), `vision_support.rb`, `vision_context.rb` | Stored prompt images and whether a model takes them. |
 | Toolkits | `toolkit.rb` (`Toolkit`), `toolkit_binding.rb` (`ToolkitBinding`, the Engine's seam), `toolkit_command.rb` (`/toolkit`), `tools/registry.rb` (`Registry#toolkit`, `#left_out_names`), `web/public/toolkit_chip.js` | Which registered tools a session's prompts declare: saved in the session, resolved at a turn's start (`Engine#apply_toolkit!`), named in the prompt's not-loaded line, a kit's prompt text after the appended files; `chi.toolkit` and `ctx.use_toolkit` for plugins ([configuration.md](configuration.md#toolkits)). |

data/docs/cli.md

@@ -18,12 +18,14 @@
 - `chi web --no-web-working-set` — turns the stage view's working set off (on by default; `--web-working-set` turns a config's `web.working_set: false` back on): what each turn brought into the model's context, in the stage and under each finished turn; `?working_set=1|0` on the page URL overrides it (see [The working set](#the-working-set))
 - `chi sessions list|stop|restart|archive|unarchive|delete|prune|clean|stats` — manage persisted sessions; `list` shows this git project's, `list --scope=all` every one, a delegated session with `↳ <parent>`, `list --archived` the archived ones too (see [Sessions](sessions.md)). `stats ID` prints a session's cost, tokens and progress, and its own settings (`--set`; a `settings:` line), from a live worker's `GET stats`, else its saved `analytics.json` (`--format json` one object, with `settings`), without running a model turn. A usage error (an unknown subcommand or flag, a flag missing its value, `stop`, `restart` or `delete` with no ids, a bad `list --format` or `--scope`, a `--days`, `--keep` or `--limit` that isn't a whole number) exits 2; an unknown or refused session exits 1
 - `chi note [--source NAME] [-m TEXT] (ID|PREFIX)... | --all` — add a context note (TEXT or stdin) to sessions: background the model sees on its next turn; it starts no turn (see [Sessions: Context notes](sessions.md#context-notes))
+- `chi broadcast [-m TEXT] [--all] [--dry-run]`, `chi broadcast log [--last N] [--format json]`, `chi broadcast deliver BROADCAST_ID (ID|PREFIX)...` — share one piece of information (TEXT or stdin) with every session it may concern, as a context note from `broadcast` (see [Broadcast](broadcast.md))
 - `chi context <add|push|ls|show|refresh|rm|mute|unmute> …` — attach live external text to sessions (a command chi runs every so often, or text pushed in); the model gets a short note when it changes and reads it with `context_read`; `chi context add <URL>` attaches a GitHub PR with the github-pr bundle (see [Attached context](context.md))
 - `chi send [-m TEXT] [--image PATH]... [--cut | --queue] (ID|PREFIX)...` — send a message to sessions as if typed there: a turn starts (or a running one takes it at its next step; `--cut` asks it to cut long thinking for it; `--queue` runs it as a turn of its own after the running one, and `--queue --wait` waits for that turn's own answer); piped stdin goes above `-m` as quoted context, and `--image` attaches images (see [Sessions: Sending a message](sessions.md#sending-a-message)); `--new` starts a session with it instead (`--new --continues ID|last:ID` the next link of that session's chain, see [Session chains](sessions.md#session-chains)), and `--wait` prints the answer (`--wait ID` with no message waits for the next reply without sending — to an idle session whose last turn already ended, that ended turn's reply or end comes back; `--wait --turn T ID` with no message waits for exactly turn T, whether running, queued or last ended; `--format json` includes its `turn_id` when known, for waiting again after exit 3 or 4; exit 3 a question waits, its options on stderr; exit 4 `--timeout` passed with the turn still running; see [Starting a session](sessions.md#starting-a-session))
 - `chi answer ID --question QID (--option N|LABEL)... [--text T] [--timeout S] [--format json]` (or `--dismiss`) — answer the question a session waits on (the one `chi send --wait` exited 3 with), then wait and print what comes next as `chi send --wait` does: the reply (0), the next question (3), still running after `--timeout` (4). `--option` is 1-based or the label, repeated on a multi-select question; `--text` is free text, or a Deny's reason; `--dismiss` leaves it unanswered and the model finishes its reply. A question no longer open (the web answered first) isn't answered again: it waits for that turn's reply. An option the question doesn't offer exits 2; a worker that is gone exits 1 (`send the task again: chi send --wait -m "…" ID`). What a parent may pick follows `guardrails.parent_answers`, or the session's own `parent_answers` when stricter (`soft`, the default: a deny, a plain answer, Continue and "Allow once"; `standard`: no allow; `hard`: no Continue either), never a wider scope or an allow on chi's own config; a refused pick exits 1 with what to answer instead (a convention, not a security boundary; see [Guardrails](guardrails.md#answers-from-a-parent-agent))
 - `chi remote add NAME URL [--token-file F | --token-stdin]`, `chi remote ls`, `chi remote rm NAME` — the other machines whose chi web the session commands reach with `--remote NAME` (see [Remote sessions](#remote-sessions))
-- `chi share ID --name NAME [--agent] [--expires 3d]`, `chi share ls [ID]`, `chi share revoke ID [P] | --all` — invite a participant to review a session through chi web on the LAN (a link of their own, 7 days), list them, revoke them (see [Participants](#participants))
-- `chi --remote NAME send|answer|note|context|sessions|share …` (or `CHI_REMOTE=NAME`) — those commands on that machine's sessions, through its chi web (see [Remote sessions](#remote-sessions))
+- `chi review FILE… [--dir DIR] [--model M]`, `chi review --from ID [FILE…]` — start a review session to invite participants to: for files of a project, or as a review of a working session that starts from its recap, not its transcript (see [Review sessions](#review-sessions))
+- `chi share ID --name NAME [--agent] [--expires 3d] [--cap 2]`, `chi share ls [ID]`, `chi share cap ID P DOLLARS`, `chi share revoke ID [P] | --all` — invite a participant to review a session through chi web on the LAN (a link of their own, 7 days, a $2 spending cap), list them, change one's cap, revoke them (see [Participants](#participants))
+- `chi --remote NAME send|answer|note|context|sessions|share|review …` (or `CHI_REMOTE=NAME`) — those commands on that machine's sessions, through its chi web (see [Remote sessions](#remote-sessions))
 - `chi --remote NAME --attach ID` (`--resume ID`, `--dir DIR [-p TEXT]`) — the attached TUI on a session of that machine (see [Remote sessions](#remote-sessions))
 - `chi memory ls [--scope project|system] [--format text|json]` — the memories of both scopes (this folder's project first), one row each: scope, name, size, date, `from <bundle>`, the index description and its model overlays; `chi memory rm NAME [--scope project|system]` removes one as `memory_write` with `remove: true` does: its file and model overlays go to the bundle trash (the line names the dir; `chi bundle trash` lists and empties it) and its index line is dropped. NAME in both scopes without `--scope` exits 2 naming both; a missing NAME or a bundle's memory (`chi bundle uninstall` removes it) exits 1 (see [Memory: Listing and removing from the shell](memory.md#listing-and-removing-from-the-shell))
 - `chi desktop install|upgrade|uninstall|status` — the macOS "Send to chi" helper: a Service and a ⌃⌥⌘N hotkey that send text or images to a session (live, stopped or new) as a message (⏎, a turn runs) or a context note (⌘⏎) (see [Desktop helper](desktop.md))
@@ -273,6 +275,8 @@ bundles or the helper can be updated.
 
 Samagotchi exposes one flag that feeds a prompt (`-p`, `--prompt`) and one that
 controls exit behavior (`--non-interactive`); `--resume` composes with both.
+Every flag takes its whole name, as the subcommands' flags do: an abbreviation (`--verb`, `--mem x`) is an
+invalid option (exit 1).
 
 | Flag | Purpose |
 |------|---------|
@@ -1274,10 +1278,11 @@ A session's owner can invite **participants**, people or agents, to review it th
 
 ```sh
 chi share 3f9a1c2e --name Alex
-# p_7c01d2aa  Alex (human, reviewer) · session 3f9a1c2e · expires 2026-10-30 14:02
+# p_7c01d2aa  Alex (human, reviewer) · session 3f9a1c2e · expires 2026-10-30 14:02 · cap $2.00
 # http://192.168.1.29:4567/?token=chp_…#s=3f9a1c2e-…
 # (shown once: chi keeps only its digest; chi share revoke 3f9a1c2e p_7c01d2aa ends it)
 chi share ls                    # every session's participants (--format json; never a token)
+chi share cap 3f9a1c2e p_7c01d2aa 5   # Alex's turns may cost you $5, from their next one
 chi share revoke 3f9a1c2e       # every link to that session; add a participant id for one
 chi share revoke --all          # every link to every session
 ```
@@ -1285,13 +1290,88 @@ chi share revoke --all          # every link to every session
 - The link is printed once (with a QR code at a terminal): chi keeps only a digest of its token. Send it to the
   participant; opening it sets their browser's cookie, as the owner's LAN link does. `--agent` marks an agent
   participant, which uses the token as `Authorization: Bearer` (e.g. `chi --remote` with that token).
-- It works for 7 days (`--expires Nh` or `Nd`, 1 hour to 30 days), until it is revoked, or until the session is
-  archived or deleted. A revoked or expired link shows "This review link has expired or was revoked."
-- For now a participant sees a page with the session's title and status; comments and the review itself come in
-  a later chi. They can't reach anything else: every other route answers them 403, another session 404.
+- It works for 7 days (`--expires Nh` or `Nd`, 1 hour to 30 days; `web.participants.expires`), until it is revoked,
+  or until the session is archived or deleted. A revoked link shows "This review link was revoked by the session's
+  owner.", an expired one "This review link expired: ask the session's owner for a new one."
+- **Review turns (experimental).** A participant can ask questions and comment through chi web's `POST …/turn`: each
+  message is a turn of its own, queued behind the running one, that the model answers **read-only**. It may read the
+  project (never its secret files or chi's own), and proposes changes as text or a diff for you to apply; it can't
+  write, run, fetch, send notes or set reminders, and any approval or question is yours. A line starting `!` or `/`
+  and images are refused. One running and 3 waiting turns per participant (`web.participants.queue`). You pay: each
+  participant has a spending cap (`--cap DOLLARS`, default $2, `web.participants.cap`), counted from their turns'
+  cost and the side requests they cause; at the cap their next comment is refused and you get a notice, and `chi
+  share cap` raises it. `/stats` shows each participant's spend. Their turns go only to a worker with the review
+  boundary: restart an older one. While your turn waits at the step limit (Continue or Stop), their turns wait too
+  (still queued, still counted): they run, in order, once you continue, stop or send a turn of your own.
+- **The participant page.** Their link opens a page of its own (never yours): the session's title and status, who
+  else takes part, and the conversation as a participant sees it: every prompt and reply with who wrote it, each
+  step's tools as one line (`read docs/plan.md`: the tool and a project file's path, never arguments or output), and
+  the reply streaming in while a turn runs. A "Comment or ask" box sends their comment; their queued comments show
+  with **Take back**; "waiting for the owner" shows while you answer a question or an approval of the turn; a refused
+  comment (a `!` or `/` line, too many waiting, their cap reached) says why. On a phone it is the thread first with
+  the box pinned, tool lines folded. They never see tool output or arguments, thinking, approvals or questions,
+  memories, context notes, plugin and delegate input, cards, command output, the working set, cost, timing or host
+  paths; secret-shaped text (API keys, tokens, private keys) is redacted too. An agent participant can wait on its
+  turns' replies through the API, or with chi: its link's token in a remote, `chi --remote NAME send --wait -m "…" ID`,
+  or `send -m`, which prints the turn id `--wait --turn T` takes; that wait exits 3 with `waiting_for_owner` while
+  their turn waits on you (a question, an approval, your step-limit Continue) and 1 with `refused` (`cancel_reason`
+  `revoked` or `cap_reached`) when their queued turn is refused before it runs. They can't reach anything else: every other route answers them 403, another
+  session 404.
+- **Apply.** Under each of a participant's review turns that has a reply, your page shows **Apply** (full width on a
+  phone): it puts an Apply turn in your composer, not sent, `Apply this proposal from Alex's review turn 3f2a1c0d, as
+  far as it fits the plan. It's quoted: …` and the reply quoted line by line. Read it, edit it, send it: the
+  participant's text reaches the model as a quote under your line, never as your instruction. Don't send "do what
+  Alex said" instead: that hands their words your tools.
+- **Your side of it.** In the session bar, the participants chip (`invite` while nobody has a link, then `2
+  participants`, with a green dot while one is on their page) opens the panel: each participant's state, last visit,
+  spend against their cap, turns and expiry, with **Cap** and **Revoke** (revoking ends their page and stream and
+  drops their queued comments). **Invite** takes a name, person or agent, the expiry and a cap, and shows the link
+  once, with Copy, Share (a phone's share sheet) and its QR code. **Participant view ↗** opens their page for this
+  session in a new tab, read-only, through the same server filter: exactly what they see. A participant's prompt
+  shows their name in their colour, live and after a reload.
 - `chi --remote studio share …` invites on studio: the link names studio's LAN address. Locally, the link names
-  this machine's chi web; without one on the LAN, chi says the link opens on this machine only.
+  this machine's running chi web, on the port it listens on (it records it in `$XDG_STATE_HOME/samagotchi/web.json`;
+  `web.port` when none answers there); without one on the LAN, chi says the link opens on this machine only (as
+  the participant there too: a participant's link never opens as the owner).
 - The owner's own token and the `chi web --new-token` rotation are separate: rotating it ends no participant's link.
+- **In the attached terminal.** A participant's message reads `Alex ▸ review> is step 3 right?`, the name in that
+  participant's own colour (queued, running, and the last exchange when you join); yours stay as they were. A line
+  says when someone is invited, revoked or their link expires (`participants> Alex joined (p_7c01d2aa)`,
+  `participants> Alex left: their link was revoked`), within a few seconds and between turns, and the status row
+  counts who is in the review (`2 participants`). The same commands work from there, on the attached session:
+  `/share NAME [--agent] [--expires 3d] [--cap 2]` (the link and its QR code, once), `/participants` (the list),
+  `/participants revoke [P]` (one participant, or everyone) and `/participants cap P DOLLARS`. They are `chi share`'s
+  own, so under `chi --remote NAME` they reach that machine's chi web, as `chi --remote NAME share` does; an invite or
+  a revoke made with them isn't announced again by the `participants>` line. The REPL
+  (`--no-shared`) answers them with a note: a participant's turns run on the session's worker.
+
+#### Review sessions
+
+Share a **review session**, not a working one: a working session's history holds its tool outputs, and a review
+turn's model may quote them. `chi review` starts one, idle:
+
+```sh
+chi review docs/plan.md docs/spec.md          # a fresh session in this project for those files
+# 4b7e9a01-…  review · docs/plan.md, docs/spec.md · idle
+# open it: chi --attach 4b7e9a01 or the web
+# invite someone: chi share 4b7e9a01 --name NAME
+chi review --from 3f9a1c2e docs/plan.md       # a review of a working session: its recap, not its transcript
+```
+
+- Each FILE is a **subject**: a file in the session's project (the git work tree of its folder, `--dir`, else
+  here), relative to that folder or absolute. A missing file, a folder, a file outside the project, a secret
+  (`.env*`, keys and certificates, credentials files, a git config) or chi's own refuses the review with one line:
+  `chi review: .env can't be a review subject: …`. At most 20.
+- `--from ID` (an id, a prefix, `last:ID`) starts a **review fork**: a new session in ID's folder, on its model
+  (`--model` to change it) and setup, seeded with a fresh recap of ID (its live worker is asked first, as a continue
+  asks), never its transcript. ID keeps running, unarchived, its delegates its own. Its FILEs are relative to ID's
+  folder.
+- `chi --remote NAME review … --dir /path/there` starts it on that machine; its chi web checks the files there.
+- Sharing a working session (one `chi review` didn't start) still works, with a warning on stderr that says how many
+  tool outputs its history holds: `chi share: warning: 3f9a1c2e is a working session, not a review session: a
+  participant's review turn can quote what its history holds (42 tool outputs so far). … (chi review --from 3f9a1c2e
+  starts one)`. On the web the participants panel shows the same words before its Invite, with **Start a review of
+  it**, and again above the link an invite gives.
 
 How it works inside (grants, the gate, the routes, the audit trail):
 [internals/participants.md](internals/participants.md).
@@ -1417,7 +1497,7 @@ changes:
 
 ```
 status> Coordinator | model=Qwen3.6-35B | ↳ 3f2a1c9e | ctx=12.3% (under20) | mem: notes, cli_usage | muted: gh-helper
-status> model=Qwen3.6-35B | ⑂ 2 running · 1 waiting | ctx=8.1% (under20) | mem: skill_coordinator
+status> model=Qwen3.6-35B | ⑂ 2 running · 1 waiting | 2 participants | ctx=8.1% (under20) | mem: skill_coordinator
 ```
 
 - The session's title first, when it has one (`/title`; not the first message a session without one is named by),
@@ -1434,6 +1514,7 @@ status> model=Qwen3.6-35B | ⑂ 2 running · 1 waiting | ctx=8.1% (under20) | me
   ends and when a delegate's report merges into a turn, the REPL whenever it draws the row. A
   child that starts waiting on an approval (which doesn't wake the parent) shows at the next of
   those.
+- `N participants`: who is in the session's review now ([Participants](#participants)), attached only.
 - `ctx=`: the kernel's context estimate and its bucket, updated during a turn (on hosts that
   report none, `api: openai`, at the turn's end).
 - `mem:`: the memories the session read, with its `--memory` list; `muted:` its `--mute` list.

data/docs/configuration.md

@@ -157,7 +157,7 @@ or `chi web` restart.
 | `toolkit.default`, `toolkit.child` | Session creation | The chosen toolkit is saved; changing the defaults does not move existing sessions. |
 | `toolkit.kits`, `execute.description`, `llm_context.policy` | Worker start | These are held by the engine's toolkit or tool registry. |
 | `skip_agents_md` | Prompt rebuild | A running engine caches its built prompt; a new worker or `/model` rebuild uses the changed value. |
-| `context.*` except `context.every_seconds`, `llm_context.*` except `llm_context.policy`, `steer.cut_after`, `memory.index_warn_tokens`, `status.line` | Next matching turn, display, poll or write | Readers resolve these settings when they perform that operation. Session-specific LLM context and thinking values remain saved in the session. |
+| `context.*` except `context.every_seconds`, `llm_context.*` except `llm_context.policy`, `steer.cut_after`, `memory.index_warn_tokens`, `status.line`, `web.participants.*` | Next matching turn, display, poll or write | Readers resolve these settings when they perform that operation. Session-specific LLM context and thinking values remain saved in the session. A participant's grant keeps the expiry and cap it was issued with; `web.participants.*` is what the next invite gets, and the cap and queue of a grant from before caps. |
 | `context.every_seconds` | Next context poll | The poller checks it for each source that has no explicit interval. |
 | `guardrails.*` | Next tool call or approval | Guardrail rules and disable lists are reloaded when the config file changes; rule settings take effect on that evaluation. `guardrails.parent_answers` is checked when a parent answers a question. |
 | `hooks`, `bundles` | Worker start | Hooks, plugins and their bundle settings load with the engine. |
@@ -165,7 +165,7 @@ or `chi web` restart.
 | `session.shared` | Next `chi` invocation | It selects attached-worker or in-process mode for that invocation. |
 | `session.idle_exit_minutes`, `session.keep_empty`, `session.max_children`, `session.delegate_reports`, `session.task_wakes`, `session.max_wakes` | Worker start or next matching lifecycle decision | Existing workers keep their idle-exit timer; the other values are read for the next corresponding decision. |
 | `session.retention_*`, `session.max_count`, `session.keep_status`, `session.sweep_interval_hours` | Next retention sweep | `chi web` sweeps on its configured schedule and on `GET /api/sessions`; `chi sessions prune` uses the values for that invocation. The sweep interval is checked on the next hub tick. |
-| `web.*` | `chi web` start | Restart `chi web` to change its bind address, port or page settings. |
+| `web.*` except `web.participants.*` | `chi web` start | Restart `chi web` to change its bind address, port or page settings. |
 | `log.*` | Process start | Each process holds its configured log sink and level after first use; restart that process. |
 | `history.file` | Next history access | The TUI and web composer resolve its path when they read or append history. |
 | `broadcast.*` | Next `chi broadcast` | Each broadcast invocation reads its targeting and triage settings. |
@@ -1391,7 +1391,7 @@ toolkit:
   default: lean        # the sessions you start (unset: full)
   child: child         # delegate children (unset: full)
   kits:                # your own, on a base
-    review: { base: lean, add: [web_fetch, delegate], remove: [memory_write] }
+    audit: { base: lean, add: [web_fetch, delegate], remove: [memory_write] }
     terse: { base: lean, prompt: "- Be concise in your responses" }
 ```
 
@@ -1402,13 +1402,14 @@ toolkit:
 | `child` | `lean` plus `send_note`, without `memory_write`, `delegate`, `delegate_result` |
 | `coordinator` | `lean` plus `delegate`, `delegate_result`, `list_sessions` (declared by the coordinator bundle) |
 | `coding` | `child`, with the prompt text `- Be concise in your responses` / `- Show file paths clearly when working with files` (declared by the coordinator bundle, for build and fix children) |
+| `review` | `read`, `memory_read` (not `forget_outputs`, even under the `forget` layer): what a [participant's](internals/participants.md#turns) turn may call, whatever the session declares (the review boundary, [guardrails](guardrails.md#a-participants-review-boundary)). Reserved: `toolkit.kits.review` is refused ("review is reserved for participants' turns"), and a bundle can't declare it. A session may run on it too, as any kit |
 
 - **Plugin tools** are declared in every toolkit unless its `remove:` names them, and so is `forget_outputs` under
   the `forget` layer. A `kits:` entry takes `base:` (default `full`), `add:`, `remove:` and `prompt:` (any other
-  key, a typo or a `tools:` list, is ignored with a warning); it can't reuse a built-in's name. A bundle declares its own with `chi.toolkit` ([plugins](plugins.md#chitoolkitname-base-add--remove--prompt-nil)).
+  key, a typo or a `tools:` list, is ignored with a warning); it can't reuse a built-in's name (`review`'s least of all: it is the participants' boundary). A bundle declares its own with `chi.toolkit` ([plugins](plugins.md#chitoolkitname-base-add--remove--prompt-nil)).
 - **A kit's prompt text.** `prompt:` (text, several lines allowed) goes into the system prompt of the sessions on
   that kit, verbatim, with no header: after AGENTS.md and the appended files, before the memory indexes. A kit
-  without one inherits its base's (`review: {base: terse, add: [web_fetch]}` stays concise); `prompt: ""` clears
+  without one inherits its base's (`audit: {base: terse, add: [web_fetch]}` stays concise); `prompt: ""` clears
   it; a session's own `--tool` / `/toolkit add` never touch it. Sessions on the same kit share it in the prompt
   cache; `full` and every kit without a prompt send the bytes they sent before. Keep it to a line or two that
   fits the kit's work (the coordinator bundle's `coding`: be concise): one that isn't text or is over 2000
@@ -1719,6 +1720,9 @@ column says so, a `--kebab-name` flag. The maps (`hosts:`, `models:`,
 | `web.working_set` | `true` | yes | The stage view's working set: the files, memories and URLs a turn brought into the model's context, in a rail in the stage, a footprint line under each finished turn and a `set N` chip in place of the mem chip; `false` brings the mem chip back. `?working_set=1` or `?working_set=0` on the page URL overrides it for that page load; the turn view ignores it. See [CLI: the working set](cli.md#the-working-set). |
 | `web.annotate_presets` | `Agreed\|Could you please elaborate?` | yes | Quick replies next to Annotate in `chi web`, `\|`-separated (a YAML list works too); `""` in the file or on the CLI leaves only Annotate (an empty env value means the default). See [CLI](cli.md#web-annotate-presets). |
 | `web.editor` | `vscode` | yes | What a file ref in `chi web` (a file tool row's title, a diff line) opens, for a viewer on this machine: a preset (`vscode`, `vscode-insiders`, `cursor`, `zed`) or a URL template with `{path}` and an optional `{line}`; `none` turns refs off. See [Opening files from chi web](#opening-files-from-chi-web). |
+| `web.participants.expires` | `7d` | | How long a participant's link lasts unless `chi share --expires` says otherwise: `Nh` or `Nd`, 1h to 30d. See [participants](internals/participants.md). |
+| `web.participants.cap` | `2.0` | | What a participant's turns, and the side calls they cause, may cost you in dollars unless `chi share --cap` says otherwise ($0 to $1000); at the cap their next comment is refused (429 `cap_reached`) and you get a notice. `chi share cap ID P DOLLARS` changes one grant's. |
+| `web.participants.queue` | `3` | | How many of a participant's turns may wait behind their running one (0 to 20); one more is refused (429 `too_many_turns`). |
 | `history.file` | state dir | | Prompt history path, shared by the TUI and the web composer. |
 | `no_interrupt` | `false` | `--no-interrupt` | Raise the step limit of a turn to 1000 (or `turn.max_iterations`, when larger); a top-level key. |
 | `no_default_input` | `false` | `--no-default-input` | Don't pre-fill `default.input`; a top-level key. |

data/docs/guardrails.md

@@ -298,6 +298,52 @@ card still names `child-boundary`. The parent (never a delegate), forks and
 ordinary sessions don't get it. Like the rules it reads command text: a
 `sh -c` body, a script or `$(…)` isn't looked into.
 
+## A participant's review boundary
+
+Built in, for a [participant's](internals/participants.md#turns) turns only (a
+turn whose author is `p:<id>`), in every mode (also with
+`guardrails.enabled: false`) and without the guardrails bundle:
+`Guardrails::ReviewBoundary`, rule `review-boundary`, source `core`. It comes
+right after the load-failure check (rules that don't load deny every call) and before the hooks' asks, the
+protected paths and the rules (`GuardrailWiring#checks`; a deny is sticky, so no later vote turns it into a
+question), and it
+**denies, never asks**: nobody on the participant's side may approve, and the
+owner's approval would give the participant's text the owner's tools. A
+participant's turn may call only the `review` kit's tools:
+
+- `read`, under the session's project root (the work tree top of its folder)
+  and never a secret: chi's state and config dirs (sessions, the grants, the
+  web token, memories and their `.bundles`, `config.yml`, hooks), `~/.ssh`,
+  `~/.gnupg`, `~/.aws`, and the project's `.env*`, `.netrc`, `*.pem`, `*.key`,
+  `*.p12`, anything named `credentials` (`.git-credentials` too), `.npmrc`,
+  `.pypirc`, ssh keys (`id_rsa`, `id_ed25519`, …), `*.tfstate`,
+  `secrets.yml`/`.json`, `.docker/config.json`, `.kube/config` and any config
+  under `.git` (a submodule's too). The path is checked as given and as it
+  resolves, so a symlink in the project to `~/.ssh` is `~/.ssh`. A session
+  whose folder is the home folder or above it reads nothing.
+- `memory_read` with `scope: project` (a read without a scope would fall back
+  to the system memories). The prompt's preloaded memories and the memory
+  index are in the system prompt anyway: a review session should start
+  without personal ones.
+
+Everything else is denied with "a participant's review turn may only read …",
+and the model is told to propose the change as text or a diff for the owner
+to apply: `write`, `edit`, `memory_write`, `execute`, the task tools,
+`delegate`, `send_note`, `list_sessions`, `register_reminder` (it would fire
+an owner turn later), `web_fetch`, `context_read`, `ask_user_question`,
+`forget_outputs` (it would replace the owner's earlier tool outputs with the
+participant's note, which later owner turns would read as their own), and
+every plugin or MCP tool, including through `call_tool` (a built-in reached
+through `call_tool` is checked as that built-in). The session's declared tools
+stay its own (no prompt rebuild per author), so the model may still try a
+write; the turn's header ("This turn may only read") keeps that rare.
+
+The kit is `Toolkit::REVIEW`, a frozen built-in: config's `toolkit.kits.review`
+is refused with one message ([configuration](configuration.md#toolkits)), so
+config can't widen the boundary. Hooks still run on a participant's turn, with
+the owner's power ([hooks](hooks.md#participants-turns)); a hook that rewrites a
+call is checked on the call it leaves.
+
 ## Rules in config.yml
 
 ```yaml
@@ -702,7 +748,23 @@ keep every guardrail. But an owner turn that says "do what Alex said" hands
 Alex's text the owner's tools: the model will act on it as the owner asked.
 That is the residual risk, documented rather than engineered away: on a
 session with sensitive tools, quote the proposal you want applied in your own
-turn instead.
+turn instead: the web's **Apply** under a review turn does that (it puts your
+line and the reply quoted line by line in your composer, for you to read and
+send; [internals/participants.md](internals/participants.md#apply)). A quote
+lowers the risk, it doesn't remove it: your line still asks the model to act
+on what it quotes, with your tools, so read the quote before you send it.
+
+Within its own turn a participant's text can't act: the review boundary
+leaves it reads of the project only, and an injection that convinces the
+model still meets the boundary (containment over detection). What it can do
+is make the model *say* what the history holds: a review turn's model sees the
+whole conversation, earlier tool outputs included, so start a review in a
+fresh session (or a continue), not on a working session full of outputs. A
+line of a participant's text that looks like one of chi's own headers goes
+out quoted (`(quoted) [Steer from the user, …]`), under the real one, in any
+case and after any spaces (chi's context-note and task frames too). The owner's
+due reminders wait for the owner's next turn: they never go into a
+participant's.
 
 ## Limits
 

data/docs/hooks.md

@@ -74,6 +74,15 @@ of the hook about to run) and the callables `notify:`, `ask_user:`,
 undefined behaviour. `:before_tool_call` carries no messages (the gate stays
 cheap).
 
+## Participants' turns
+
+A [participant's](internals/participants.md#turns) review turn fires the same hooks, and every event of it carries
+`author: "p:<id>"` (the owner's carry no `author:` key, as before); a plugin reads the same as `ctx.turn_author`
+(nil for the owner's turns and between turns). **A hook runs with the owner's power whatever the author**: it may
+read, write and run what the owner's chi may, and `notify`, `ask_user` and `steer` reach the owner. A bundle that
+acts on a turn's text (a prompt rewrite, a fetch of what it names) should check `author:` first: the text may be a
+participant's. The review boundary checks a tool call after the hooks, on the call they leave.
+
 ## What a hook can do: the runtime
 
 Besides reading (and, on `:before_tool_call`, voting on) its event, a hook