@atmin.ai/review 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/callees.js

@@ -0,0 +1,73 @@
+import { declaresSymbol } from './claim.js';
+import { definitionOf } from './symbolic.js';
+// The definitions, at head, of functions the added lines call and the change does not
+// define. A change can be right on its own lines and wrong in what unchanged code does
+// with its values: on mason-v1 #4590 (2026-09-24) new code threw plain errors into a
+// catch-all mapper 780 lines away that labels every one "vendor unavailable, retry", and
+// in seven runs the model never opened that file. Resolved by code, not left to the model
+// to go looking. Calls are taken by name or on `this`/`self` only: `x.map(` names a method
+// of a value nothing here can type, and a guess would put unrelated code in front of it.
+// A definition that does not fit is named, never silently dropped.
+export const MAX_CALLED_CODE_BYTES = 24 * 1024;
+const CALL = /(?<![\w$])([A-Za-z_$][\w$]*)\s*\(/g;
+const NOT_CALLS = new Set(['if', 'for', 'while', 'switch', 'catch', 'function', 'return', 'typeof', 'await',
+    'super', 'import', 'require', 'def', 'elif', 'not', 'and', 'or', 'in', 'lambda', 'assert', 'print', 'with']);
+const SOURCE = /\.(?:[cm]?[jt]sx?|py)$/;
+export const TEST = /(?:^|\/)(?:__tests__|tests?)\/|\.(?:test|spec)\.[^/]+$|(?:^|\/)test_[^/]+\.py$/;
+// Added lines per file, from a unified diff. A deleted file has no head side to call from.
+function addedLines(diff) {
+    const added = new Map();
+    let path = null;
+    for (const line of diff.split('\n')) {
+        if (line.startsWith('+++ ')) {
+            path = line.startsWith('+++ b/') ? line.slice(6) : null;
+            continue;
+        }
+        if (line.startsWith('diff --git ')) {
+            path = null;
+            continue;
+        }
+        if (path && line.startsWith('+'))
+            added.set(path, [...(added.get(path) ?? []), line.slice(1)]);
+    }
+    return added;
+}
+export function calledCode(diff, head) {
+    const added = addedLines(diff);
+    const addedText = [...added.values()].flat();
+    // name -> the first changed file that calls it, which is where resolution looks first.
+    const calls = new Map();
+    for (const [path, lines] of added) {
+        if (!SOURCE.test(path) || TEST.test(path))
+            continue;
+        for (const line of lines) {
+            for (const match of line.matchAll(CALL)) {
+                const before = line.slice(0, match.index);
+                if (/\.\s*$/.test(before) && !/\b(?:this|self)\.\s*$/.test(before))
+                    continue;
+                const name = match[1];
+                if (!NOT_CALLS.has(name) && !calls.has(name))
+                    calls.set(name, path);
+            }
+        }
+    }
+    const called = [];
+    const omitted = [];
+    let bytes = 0;
+    for (const [symbol, from] of calls) {
+        // Defined by the change itself: the model already has it in the diff.
+        if (addedText.some(line => declaresSymbol(line, symbol)))
+            continue;
+        const definition = definitionOf(head, symbol, from, path => SOURCE.test(path) && !TEST.test(path));
+        if (!definition)
+            continue;
+        const size = Buffer.byteLength(definition.text);
+        if (bytes + size > MAX_CALLED_CODE_BYTES) {
+            omitted.push(symbol);
+            continue;
+        }
+        bytes += size;
+        called.push({ symbol, ...definition });
+    }
+    return { called, omitted };
+}

package/dist/claim-result.d.ts

@@ -0,0 +1,64 @@
+import { type ClaimReview, type IncrementalScope } from './claim-run.js';
+import { type Titling } from './titles.js';
+import { type Claim } from './claim.js';
+import { type Packet, type Result } from './contracts.js';
+import type { Chain } from './evidence.js';
+import type { Model, Profile } from './investigation.js';
+export interface ClaimRunSummary {
+    claims: Claim[];
+    chains: Chain[];
+    verdict: string;
+    rule: string;
+    limitations: string[];
+    complete: boolean;
+    stopReason: string | null;
+    model: string;
+    scope?: string;
+    titles?: Record<string, string>;
+}
+export declare function claimResult(packet: Packet, repository: string, run: ClaimRunSummary): Result;
+export interface PreviousReview {
+    headSha: string;
+    mergeBaseSha: string;
+    claims: Claim[];
+    titles?: Record<string, string>;
+}
+export declare function incrementalScope(directory: string, packet: Packet): {
+    scope?: IncrementalScope;
+    note: string | null;
+    titles?: Record<string, string>;
+};
+export declare function previousReview(artifact: string): PreviousReview | null;
+export declare function claimReceipt(profile: Profile, review: ClaimReview, startedAt: string, finishedAt: string, titling?: Titling): {
+    schemaVersion: number;
+    pipeline: string;
+    profile: Profile;
+    startedAt: string;
+    finishedAt: string;
+    stopReason: string | null;
+    providerFailure: import("./provider-error.js").ProviderFailure | null;
+    toolCalls: number;
+    toolErrors: {
+        tool: string;
+        reason: string;
+        detail?: string;
+    }[];
+    calls: ({
+        inputTokens: number;
+        outputTokens: number;
+        cachedInputTokens: null;
+        reservedUsd: number;
+        meteredUsd: number | null;
+        model: "gpt-5.4-2026-03-05" | "gpt-6-luna" | "gpt-5.6-sol" | "claude-opus-5-5" | "claude-sonnet-5" | "claude-haiku-4-5-20251001" | "claude-fable-5-1" | "cohere/north-mini-code:free" | "deepseek/deepseek-v3.2" | "anthropic/claude-sonnet-5" | "openai/gpt-6-luna";
+        purpose?: never;
+    } | {
+        purpose: string;
+        inputTokens: number;
+        outputTokens: number;
+        cachedInputTokens: null;
+        reservedUsd: number;
+        meteredUsd: number | null;
+        model: "gpt-5.4-2026-03-05" | "gpt-6-luna" | "gpt-5.6-sol" | "claude-opus-5-5" | "claude-sonnet-5" | "claude-haiku-4-5-20251001" | "claude-fable-5-1" | "cohere/north-mini-code:free" | "deepseek/deepseek-v3.2" | "anthropic/claude-sonnet-5" | "openai/gpt-6-luna";
+    })[];
+};
+export declare function runClaimReviewAsResult(directory: string, profile: Profile, signal?: AbortSignal, injectedModel?: Model): Promise<ClaimReview>;

package/dist/claim-result.js

@@ -0,0 +1,206 @@
+import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { charges, modelFor, runClaimReview } from './claim-run.js';
+import { titleClaims } from './titles.js';
+import { parseLocation } from './claim.js';
+import { parseResult } from './contracts.js';
+import { git, loadReview, validateAnchor } from './snapshot.js';
+// The claim pipeline, written into the Result and receipt shapes the GitHub worker and
+// the `review` command already publish from. This is the bridge that makes what ships
+// the pipeline that was measured (2026-09-24: Luna, rung 3 on, P3 withheld) without
+// rewriting publication, freshness, checks or inline comments, which do not depend on
+// how the findings were produced.
+const CATEGORY = {
+    injection_risk: 'security', hardcoded_secret: 'security', auth_bypass: 'security',
+    race_condition: 'reliability', data_loss: 'data-integrity', contract_break: 'correctness',
+    error_handling_gap: 'reliability', resource_leak: 'reliability',
+};
+const clip = (value, limit = 16000) => value.length <= limit ? value : `${value.slice(0, limit - 1)}…`;
+export function claimResult(packet, repository, run) {
+    const byId = new Map(run.claims.map(claim => [claim.claimId, claim]));
+    const changed = new Map(packet.changedFiles.map(file => [file.path, file]));
+    const completed = run.complete && run.stopReason === 'finished';
+    const evidence = [];
+    const findings = [];
+    const limitations = [...run.limitations];
+    // The whole diff is in the claim pass's first turn (under the 128 KB limit), so every
+    // changed text file was in front of the model. That is what "reviewed" means here, and
+    // only for a run that finished: a run that stopped early claims no coverage at all.
+    const text = packet.changedFiles.filter(file => file.kind === 'text');
+    if (completed && text.length)
+        evidence.push({ id: 'change-diff', kind: 'source-reasoning', provenance: 'declared',
+            summary: 'The complete change diff for this path was in the claim pass context.',
+            anchors: text.map(file => ({ path: file.path, side: file.change === 'deleted' ? 'base' : 'head', line: null })) });
+    const outside = [];
+    // One finding per line: two confirmed claims on the same line are one defect seen twice
+    // (the main and failure-path passes word it differently, so their claim ids differ).
+    // The most severe is shown and carries the other's evidence; the summary counts the merge.
+    const onLine = new Map();
+    let merged = 0;
+    const confirmed = run.chains.filter(chain => chain.verdict === 'confirmed')
+        .sort((a, b) => (byId.get(a.claimId)?.severity ?? 'P4').localeCompare(byId.get(b.claimId)?.severity ?? 'P4'));
+    confirmed.forEach((chain, index) => {
+        const claim = byId.get(chain.claimId);
+        if (!claim)
+            return;
+        let anchor;
+        try {
+            const { path, line } = parseLocation(claim.location);
+            anchor = { path, side: changed.get(path)?.change === 'deleted' ? 'base' : 'head', line };
+            validateAnchor(repository, packet, anchor);
+        }
+        catch {
+            anchor = undefined;
+        }
+        // A finding may sit outside the changed files, as a caller the change broke, but its
+        // line must exist. A confirmed claim whose location does not resolve is still
+        // reported, as a limitation, rather than dropped.
+        if (!anchor) {
+            outside.push(`${claim.severity} ${claim.type} at ${claim.location}: ${claim.description}`);
+            return;
+        }
+        const id = `claim-${index + 1}`;
+        const established = chain.propositions.filter(item => item.status === 'established');
+        evidence.push({ id, kind: 'source-reasoning', provenance: 'declared', anchors: [anchor],
+            summary: clip(`Verified at ${chain.verifierConfidence} confidence. ${established.length} of ${chain.propositions.length} proposition(s) established: `
+                + established.map(item => `${item.proposition} [${item.settledBy ?? 'unsettled'}]`).join('; ')) });
+        const same = onLine.get(`${anchor.path}:${anchor.line}`);
+        if (same) {
+            same.evidenceIds.push(id);
+            merged++;
+            return;
+        }
+        const finding = { id, priority: claim.severity, kind: claim.severity === 'P4' ? 'improvement' : 'defect',
+            category: CATEGORY[claim.type], title: clip(run.titles?.[claim.claimId] ?? claim.description, 400), trigger: clip(claim.suspectedCondition),
+            consequence: clip(claim.description),
+            priorityReason: `Rated ${claim.severity} by the reviewer when it made the claim; type ${claim.type}.`,
+            counterEvidence: clip(`Each proposition was checked against the frozen revision: ${chain.propositions
+                .map(item => `${item.proposition} (${item.status})`).join('; ')}`),
+            ...(claim.shouldBe ? { suggestion: clip(claim.shouldBe.text) } : {}),
+            anchor, evidenceIds: [id] };
+        findings.push(finding);
+        onLine.set(`${anchor.path}:${anchor.line}`, finding);
+    });
+    for (const item of outside)
+        limitations.push(clip(`Confirmed, but its location does not resolve at this revision: ${item}`));
+    const withheld = run.chains.filter(chain => chain.verdict === 'withheld').map(chain => byId.get(chain.claimId)?.location).filter(Boolean);
+    if (withheld.length)
+        limitations.push(`${withheld.length} confirmed minor (P3) finding(s) withheld: ${withheld.join(', ')}.`);
+    const counts = { refuted: 0, inconclusive: 0 };
+    for (const chain of run.chains)
+        if (chain.verdict === 'refuted' || chain.verdict === 'inconclusive')
+            counts[chain.verdict]++;
+    const result = {
+        schemaVersion: 1, headSha: packet.headSha, baseSha: packet.baseSha, policyHash: packet.policyHash,
+        status: completed ? 'completed' : 'partial',
+        reviewer: { name: 'atmin claim review', model: run.model, context: 'independent' },
+        summary: `${run.scope ? `${run.scope} ` : ''}Claim review: ${run.claims.length} claim(s) checked, ${findings.length + outside.length} confirmed and shown, ${merged ? `${merged} merged into a finding on the same line, ` : ''}${withheld.length} withheld as minor, `
+            + `${counts.refuted} refuted, ${counts.inconclusive} inconclusive. Policy verdict ${run.verdict} (rule ${run.rule}).`,
+        coverage: packet.changedFiles.map(file => ({ path: file.path,
+            status: completed && file.kind === 'text' ? 'reviewed' : 'unreviewed', evidenceIds: completed && file.kind === 'text' ? ['change-diff'] : [] })),
+        validation: packet.policy.requiredChecks.map(name => ({ name, status: 'not-run', reason: 'Required validation has not run.', evidenceIds: [] })),
+        evidence, findings,
+        limitations: limitations.length ? limitations.map(item => clip(item)) : ['No repository code was executed.'],
+    };
+    return parseResult(result);
+}
+export function incrementalScope(directory, packet) {
+    const path = join(directory, 'previous.json');
+    if (!existsSync(path))
+        return { note: null };
+    const previous = JSON.parse(readFileSync(path, 'utf8'));
+    const sha = /^[a-f0-9]{40}$/;
+    if (!sha.test(previous.headSha) || !sha.test(previous.mergeBaseSha) || !Array.isArray(previous.claims)) {
+        return { note: 'Full review: the earlier review record was unreadable.' };
+    }
+    if (previous.mergeBaseSha !== packet.mergeBaseSha)
+        return { note: 'Full review: the merge base moved since the earlier review.' };
+    const repository = join(directory, 'source.git');
+    try {
+        git(repository, ['merge-base', '--is-ancestor', previous.headSha, packet.headSha]);
+    }
+    catch {
+        return { note: 'Full review: the earlier reviewed head is not an ancestor of this one, as after a force-push.' };
+    }
+    const diff = git(repository, ['diff', '--no-ext-diff', '--no-textconv', '--no-renames', previous.headSha, packet.headSha, '--']);
+    const changed = git(repository, ['diff', '--no-ext-diff', '--no-textconv', '--no-renames', '--name-only', '-z', previous.headSha, packet.headSha, '--'])
+        .toString('utf8').split('\0').filter(Boolean);
+    const titles = Object.fromEntries(Object.entries(previous.titles ?? {}).filter(([, title]) => typeof title === 'string'));
+    return { scope: { since: previous.headSha, diff, carried: previous.claims, changed }, titles,
+        note: `Incremental review: new claims were sought only in the commits since ${previous.headSha.slice(0, 12)}; ${previous.claims.length} earlier finding(s) were re-checked against this head.` };
+}
+// Read from a finished claim run: only a completed review can stand in for the part of the
+// change this one will not re-read, and only its confirmed and withheld claims carry.
+export function previousReview(artifact) {
+    try {
+        const read = (name) => JSON.parse(readFileSync(join(artifact, name), 'utf8'));
+        const packet = read('packet.json'), result = read('result.json');
+        if (result.status !== 'completed' || !existsSync(join(artifact, 'claim-verification.json')))
+            return null;
+        const chains = (read('claim-verification.json').chains ?? []);
+        const kept = new Set(chains.filter(chain => chain.verdict === 'confirmed' || chain.verdict === 'withheld').map(chain => chain.claimId));
+        const claims = [...(existsSync(join(artifact, 'carried-claims.json')) ? read('carried-claims.json') : []), ...read('claims.json')];
+        const titles = existsSync(join(artifact, 'titles.json')) ? (read('titles.json').titles ?? {}) : {};
+        return { headSha: packet.headSha, mergeBaseSha: packet.mergeBaseSha, claims: claims.filter(claim => kept.has(claim.claimId)),
+            titles: Object.fromEntries(Object.entries(titles).filter(([id]) => kept.has(id))) };
+    }
+    catch {
+        return null;
+    }
+}
+// The fields the dashboard reads from a receipt, and nothing it would misread. Spend is
+// metered only when every request's charge is known, stopped runs included; otherwise it
+// holds a reservation, and an unknown spend must not be shown as a known one.
+export function claimReceipt(profile, review, startedAt, finishedAt, titling) {
+    const { investigation } = review;
+    return { schemaVersion: 1, pipeline: 'claims', profile, startedAt, finishedAt, stopReason: investigation.stopReason,
+        providerFailure: investigation.telemetry.failure, toolCalls: investigation.telemetry.toolCalls, toolErrors: investigation.toolErrors,
+        calls: [{ inputTokens: investigation.telemetry.inputTokens, outputTokens: investigation.telemetry.outputTokens, cachedInputTokens: null,
+                reservedUsd: investigation.spentUsd, meteredUsd: investigation.unsettledCalls ? null : investigation.spentUsd, model: profile.model },
+            // The titling call, when one was made: metered only when its charge is known.
+            ...(titling && (titling.spentUsd || titling.failure) ? [{ purpose: 'titles', inputTokens: titling.inputTokens, outputTokens: titling.outputTokens,
+                    cachedInputTokens: null, reservedUsd: titling.spentUsd, meteredUsd: titling.unsettled ? null : titling.spentUsd, model: profile.model }] : [])] };
+}
+// One claim review over a prepared snapshot, leaving result.json and receipt.json where
+// the older engine left them. Rung 3 is Jev when TYPESAFE_API_KEY is set, which is the
+// configuration measured; without it the run says so rather than failing.
+export async function runClaimReviewAsResult(directory, profile, signal, injectedModel) {
+    const { packet, result: initial } = loadReview(directory);
+    // One run per snapshot, as with the older engine: a rerun must not reset a spend.
+    if (initial.status !== 'not-started' || existsSync(join(directory, 'claims.json'))) {
+        throw new Error('Run has existing investigation or spending evidence; prepare a new snapshot');
+    }
+    const jev = Boolean(process.env.TYPESAFE_API_KEY);
+    const deadline = AbortSignal.timeout(profile.deadlineMs);
+    const startedAt = new Date().toISOString();
+    const { scope, note, titles: earlierTitles = {} } = incrementalScope(directory, packet);
+    const review = await runClaimReview(directory, profile, injectedModel, signal ? AbortSignal.any([signal, deadline]) : deadline, undefined, jev ? 'jev' : 'none', {}, {}, scope);
+    // The claim record keeps its own name, because verification.json belongs to the local
+    // fix checks the worker may run next, which would overwrite it.
+    renameSync(join(directory, 'verification.json'), join(directory, 'claim-verification.json'));
+    // Titles for the confirmed findings only, from what the claim pass left of the budget.
+    const confirmed = new Set(review.verification.chains.filter(chain => chain.verdict === 'confirmed').map(chain => chain.claimId));
+    const titling = await titleClaims(review.claims.filter(claim => confirmed.has(claim.claimId) && !earlierTitles[claim.claimId]), modelFor(profile, injectedModel), charges(profile).costOf, charges(profile).charged, profile.maxUsd - review.investigation.spentUsd, signal ? AbortSignal.any([signal, deadline]) : deadline);
+    const persist = (name, value) => {
+        const temporary = join(directory, `${name}.pending`);
+        writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600, flag: 'wx', flush: true });
+        renameSync(temporary, join(directory, name));
+    };
+    titling.titles = { ...Object.fromEntries(Object.entries(earlierTitles).filter(([id]) => confirmed.has(id))), ...titling.titles };
+    persist('titles.json', titling);
+    persist('receipt.json', claimReceipt(profile, review, startedAt, new Date().toISOString(), titling));
+    const limitations = [...review.investigation.limitations, ...review.verification.limitations];
+    if (!jev)
+        limitations.push('The cross-family rung was off (no TYPESAFE_API_KEY), so no finding reached high confidence through agreement.');
+    if (note)
+        limitations.push(note);
+    if (titling.failure)
+        limitations.push(`Finding titles were not written (${titling.failure}), so each finding is titled by its full description.`);
+    persist('result.json', claimResult(packet, join(directory, 'source.git'), {
+        claims: review.claims, chains: review.verification.chains, verdict: review.verification.decision.verdict,
+        rule: review.verification.decision.rule, limitations, complete: review.investigation.complete,
+        stopReason: review.investigation.stopReason, model: profile.model, titles: titling.titles,
+        ...(scope ? { scope: `Incremental review since ${scope.since.slice(0, 12)}.` } : {})
+    }));
+    return review;
+}

package/dist/claim-run.d.ts

@@ -0,0 +1,38 @@
+import { type ClaimInvestigation } from './investigator.js';
+import { type CrossFamilyRung, type Verification, type VerifyOptions } from './lifecycle.js';
+import { type RungContribution } from './ablation.js';
+import { type Model, type ModelReply, type Profile } from './investigation.js';
+import { type Claim } from './claim.js';
+import type { Rung } from './evidence.js';
+import type { Packet } from './contracts.js';
+export interface ClaimReview {
+    claims: Claim[];
+    investigation: ClaimInvestigation;
+    verification: Verification;
+}
+export type CrossFamilySource = 'none' | 'jev';
+export declare const MAX_DIFF_BYTES: number;
+export interface IncrementalScope {
+    since: string;
+    diff: Buffer;
+    carried: Claim[];
+    changed: string[];
+}
+export declare function touchedBy(claim: Claim, changed: ReadonlySet<string>): boolean;
+export declare const MAX_GUIDANCE_BYTES: number;
+export declare function targetGuidance(repository: string, packet: Packet): {
+    guidance: {
+        path: string;
+        text: string;
+    }[];
+    omitted: string[];
+};
+export declare function charges(profile: Profile): {
+    costOf: (input: number, output: number) => number;
+    charged: (reply: ModelReply) => number | null;
+};
+export declare function modelFor(profile: Profile, injectedModel?: Model): Model;
+export declare function runClaimReview(directory: string, profile: Profile, injectedModel?: Model, signal?: AbortSignal, crossFamily?: CrossFamilyRung, crossFamilySource?: CrossFamilySource, verify?: VerifyOptions, capture?: {
+    transcript?: boolean;
+}, incremental?: IncrementalScope): Promise<ClaimReview>;
+export declare function ablate(directory: string, rung?: Rung): RungContribution;

package/dist/claim-run.js

@@ -0,0 +1,227 @@
+import { readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { loadReview, sourceText } from './snapshot.js';
+import { revisionFrom } from './symbolic.js';
+import { investigateClaims } from './investigator.js';
+import { verifyClaims } from './lifecycle.js';
+import { contributionOf, recordedRung } from './ablation.js';
+import { askJev } from './jev.js';
+import { BALANCED } from './policy.js';
+import { meteredCost, reservedCost, subscription } from './investigation.js';
+import { openAIModel } from './openai-model.js';
+import { openRouterModel } from './openrouter-model.js';
+import { parseLocation } from './claim.js';
+import { calledCode, MAX_CALLED_CODE_BYTES } from './callees.js';
+import { failureExcerpt } from './failure-excerpt.js';
+// The whole diff goes into every turn of the claim pass. 128 KB refused 29% of the PRs on
+// the first real repository measured (mason-v1, 2026-09-24); 512 KB refuses 7%. A diff
+// this size needs a profile whose input cap leaves room to read beside it: the OpenRouter
+// adapter counts serialized bytes, not tokens, and the diff is escaped twice on the way,
+// so a diff counts about 1.2 times its size (measured on a 471 KB mason-v1 diff). The
+// production profile allows 1,000,000, under Luna's 1.05M-token window (`profiles/review-luna-openrouter.json`).
+export const MAX_DIFF_BYTES = 512 * 1024;
+// A carried claim is re-verified on the propositions it was recorded with, and a fix can
+// remove a premise none of them states. Measured 2026-09-24 on a real push (mason-v1):
+// the fix wrapped a read-then-delete in an advisory lock, every recorded proposition (the
+// read, the comparison, the delete by name) stayed true, and the fixed race was confirmed
+// again. So a claim whose file the push changed, or a file one of its checks names, is not
+// carried on its own: the model is shown it and records it again only if it still holds.
+// A fix made in a file the claim never names still escapes this.
+export function touchedBy(claim, changed) {
+    const checked = claim.evidenceToCheck.flatMap(item => item.check && 'path' in item.check ? [item.check.path] : []);
+    return [parseLocation(claim.location).path, ...checked].some(path => changed.has(path));
+}
+// The target's own AGENTS.md files: the root one and one in each directory above a changed
+// path, read from the target branch so a change cannot rewrite the rules it is reviewed
+// against. The older engine loaded these (investigation.ts); the claim pipeline had not,
+// and on mason-v1 #4590 (2026-09-24) 5 of CodeRabbit's 12 items came from house rules the
+// claim pass was never shown. Shallowest first, so the root rules are the last to be cut;
+// a file that does not fit is named, never silently dropped.
+export const MAX_GUIDANCE_BYTES = 32 * 1024;
+export function targetGuidance(repository, packet) {
+    const paths = new Set(['AGENTS.md']);
+    for (const { path } of packet.changedFiles) {
+        const parts = path.split('/');
+        parts.pop();
+        for (; parts.length; parts.pop())
+            paths.add(`${parts.join('/')}/AGENTS.md`);
+    }
+    const guidance = [];
+    const omitted = [];
+    let bytes = 0;
+    for (const path of [...paths].sort((a, b) => a.split('/').length - b.split('/').length || a.localeCompare(b))) {
+        const text = sourceText(repository, packet.baseSha, path);
+        if (text === null)
+            continue;
+        const size = Buffer.byteLength(text);
+        if (bytes + size > MAX_GUIDANCE_BYTES) {
+            omitted.push(path);
+            continue;
+        }
+        bytes += size;
+        guidance.push({ path, text });
+    }
+    return { guidance, omitted };
+}
+// Both passes as one investigation: a claim either recorded counts once, the run is
+// complete only if both were, and the second pass's limitations say which pass they are from.
+function combined(main, focus, sites) {
+    const ids = new Set(main.claims.map(claim => claim.claimId));
+    const byName = { ...main.telemetry.toolCallsByName };
+    for (const [name, count] of Object.entries(focus.telemetry.toolCallsByName))
+        byName[name] = (byName[name] ?? 0) + count;
+    const transcript = main.transcript && focus.transcript ? [...main.transcript, ...focus.transcript] : undefined;
+    return {
+        claims: [...main.claims, ...focus.claims.filter(claim => !ids.has(claim.claimId))],
+        complete: main.complete && focus.complete,
+        limitations: [...main.limitations, ...focus.limitations.map(line => `Failure-path pass: ${line}`)],
+        toolErrors: [...main.toolErrors, ...focus.toolErrors],
+        stopReason: main.stopReason === 'finished' ? focus.stopReason : main.stopReason,
+        spentUsd: main.spentUsd + focus.spentUsd,
+        unsettledCalls: main.unsettledCalls + focus.unsettledCalls,
+        telemetry: {
+            turns: main.telemetry.turns + focus.telemetry.turns,
+            toolCalls: main.telemetry.toolCalls + focus.telemetry.toolCalls,
+            toolCallsByName: byName,
+            droppedTurns: main.telemetry.droppedTurns + focus.telemetry.droppedTurns,
+            inputTokens: main.telemetry.inputTokens + focus.telemetry.inputTokens,
+            cachedInputTokens: main.telemetry.cachedInputTokens + focus.telemetry.cachedInputTokens,
+            outputTokens: main.telemetry.outputTokens + focus.telemetry.outputTokens,
+            finishReason: focus.telemetry.finishReason ?? main.telemetry.finishReason,
+            failure: main.telemetry.failure ?? focus.telemetry.failure,
+            reads: [...main.telemetry.reads, ...focus.telemetry.reads],
+            retries: [...main.telemetry.retries, ...focus.telemetry.retries],
+            failurePathClaimIds: focus.claims.map(claim => claim.claimId),
+            failurePathSpentUsd: focus.spentUsd,
+            failurePathTurns: focus.telemetry.turns,
+            failurePathSites: sites,
+        },
+        ...(transcript ? { transcript } : {}),
+    };
+}
+const idle = () => ({ claims: [], complete: true, limitations: [], toolErrors: [], stopReason: 'finished',
+    spentUsd: 0, unsettledCalls: 0, telemetry: { turns: 0, toolCalls: 0, toolCallsByName: {}, droppedTurns: 0, inputTokens: 0, cachedInputTokens: 0, outputTokens: 0,
+        finishReason: null, failure: null, reads: [], retries: [] } });
+// Reservations use the rate card at its dearest; settlement uses what the call cost.
+export function charges(profile) {
+    return {
+        costOf: (input, output) => reservedCost(profile, input, output),
+        charged: (reply) => meteredCost(profile, reply),
+    };
+}
+// The model a profile names, unless a test or benchmark injects one.
+export function modelFor(profile, injectedModel) {
+    if (subscription(profile) && !injectedModel) {
+        throw new Error('Local subscription experiments require a benchmark adapter (Codex or Claude); hosted execution is not supported');
+    }
+    return injectedModel ?? (profile.provider === 'openrouter' ? openRouterModel(profile) : openAIModel(profile));
+}
+export async function runClaimReview(directory, profile, injectedModel, signal, crossFamily, crossFamilySource = 'none', verify = {}, capture = {}, incremental) {
+    const { packet } = loadReview(directory);
+    const model = modelFor(profile, injectedModel);
+    const repository = join(directory, 'source.git');
+    // Both sides, because a claim about a regression is a claim about the difference.
+    const revisions = { head: revisionFrom(repository, packet.headSha), base: revisionFrom(repository, packet.mergeBaseSha) };
+    const sourceOf = (path) => sourceText(repository, packet.headSha, path);
+    const full = readFileSync(join(directory, 'change.diff'));
+    const diff = incremental ? incremental.diff : full;
+    if (diff.length > MAX_DIFF_BYTES)
+        throw new Error('Diff exceeds 512 KB investigation limit');
+    const changed = new Set(incremental?.changed ?? []);
+    const recheck = (incremental?.carried ?? []).filter(claim => touchedBy(claim, changed));
+    const { guidance, omitted } = targetGuidance(repository, packet);
+    const { called, omitted: uncalled } = calledCode(diff.toString('utf8'), revisions.head);
+    const guided = { ...(guidance.length ? { targetGuidance: guidance } : {}), ...(called.length ? { calledCode: called } : {}) };
+    const context = incremental
+        ? { packet, ...guided, diff: diff.toString('utf8'), incrementalSince: incremental.since,
+            scope: `This diff holds only the commits pushed since an earlier review at ${incremental.since}. The whole change is listed in packet.changedFiles, and the earlier review's other findings are re-checked separately. Claim defects that these new commits introduce or expose; revision "base" still means the merge base.`
+                + (recheck.length ? ' earlierFindings are findings from that review in files these commits changed. They are not carried forward on their own: read the new code, and record again, with the same type, location symbol and suspectedCondition, each one that still holds at the new head. Leave out any the new commits fixed.' : ''),
+            ...(recheck.length ? { earlierFindings: recheck.map(({ type, location, description, suspectedCondition }) => ({ type, location, description, suspectedCondition })) } : {}) }
+        : { packet, ...guided, diff: diff.toString('utf8') };
+    const limits = (maxUsd) => ({
+        maxTurns: profile.maxTurns, maxToolCalls: profile.maxToolCalls,
+        maxInputTokens: profile.maxInputTokens, maxOutputTokens: profile.maxOutputTokens,
+        maxUsd, ...(capture.transcript ? { recordTranscript: true } : {}), ...charges(profile),
+    });
+    // Nothing new to read, as when only the target branch moved: no model is asked.
+    const main = incremental && !diff.length ? idle() : await investigateClaims(revisions, sourceOf, context, model, limits(profile.maxUsd), signal);
+    // A second pass on failure paths alone, within what the first left of the budget, shown
+    // only the diff around error handling; a change with none gets no second pass. See
+    // failurePathInstruction for why it is a pass of its own, failureExcerpt for the cost.
+    const failure = failureExcerpt(diff.toString('utf8'));
+    const failurePaths = !failure.excerpt ? idle()
+        : await investigateClaims(revisions, sourceOf, { ...context, diff: failure.excerpt }, model, { ...limits(profile.maxUsd - main.spentUsd), focus: 'failure_paths' }, signal);
+    const investigation = combined(main, failurePaths, failure.sites);
+    // Earlier claims first, so a claim the model records again keeps the earlier wording
+    // and checks; the verifier is then handed one list and cannot tell them apart.
+    const emitted = new Set(investigation.claims.map(claim => claim.claimId));
+    const carried = (incremental?.carried ?? []).filter(claim => !emitted.has(claim.claimId) && !touchedBy(claim, changed));
+    if (uncalled.length)
+        investigation.limitations.push(`Code the change calls over ${MAX_CALLED_CODE_BYTES / 1024} KB was left out, so these definitions were not shown: ${uncalled.join(', ')}.`);
+    if (omitted.length)
+        investigation.limitations.push(`Repository guidance over ${MAX_GUIDANCE_BYTES / 1024} KB was left out, so these rules were not shown: ${omitted.join(', ')}.`);
+    if (recheck.length)
+        investigation.limitations.push(`${recheck.length} earlier finding(s) were in files this push changed, so they were re-asked rather than carried; ${recheck.filter(claim => emitted.has(claim.claimId)).length} were recorded again.`);
+    const claims = [...carried, ...investigation.claims];
+    const persist = (name, value) => {
+        const temporary = join(directory, `${name}.pending`);
+        writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600, flag: 'wx', flush: true });
+        renameSync(temporary, join(directory, name));
+    };
+    persist('claims.json', investigation.claims);
+    if (incremental)
+        persist('carried-claims.json', carried);
+    // Opt-in, for the emission bench only: this is provider and repository text.
+    if (investigation.transcript)
+        persist('transcript.json', investigation.transcript);
+    // Written as its own file rather than folded into the verification, because it is about
+    // the run and not about any claim, and because a run that emits nothing still needs to
+    // leave an explanation behind. Counts and allowlisted enums only -- see ClaimTelemetry.
+    // Both are written before verification, because a verification that throws must not
+    // take the claims and the spend down with it: seen 2026-09-23, when a grep overflow did
+    // exactly that on a live run.
+    persist('telemetry.json', { ...investigation.telemetry, stopReason: investigation.stopReason,
+        complete: investigation.complete, claims: investigation.claims.length, spentUsd: investigation.spentUsd,
+        toolErrors: investigation.toolErrors, limitations: investigation.limitations });
+    // The verifier is handed the claims and the revision, and nothing else. Whatever the
+    // investigator believed does not travel with them.
+    let rung = crossFamily;
+    // A claim whose Jev call fails is skipped, which the lifecycle reads as unsettled, and
+    // that is the honest outcome. What was not honest was saying nothing about it: seen
+    // 2026-09-21, a run asked zero questions where seven claims needed them, every claim
+    // came out inconclusive, and the report gave no hint that the rung had never answered.
+    // The count is reported and the reason is not, because provider text can carry
+    // repository content.
+    let unreached = [];
+    if (!rung && crossFamilySource === 'jev' && claims.length) {
+        const asked = await askJev(claims, revisions, full.toString('utf8'), { signal, verify });
+        rung = recordedRung(asked.log);
+        unreached = [...new Set(asked.skippedClaims)];
+    }
+    const verification = verifyClaims(claims, revisions, BALANCED, rung, undefined, verify);
+    if (unreached.length) {
+        verification.limitations.push(unreached.length === claims.length
+            ? `The cross-family rung answered nothing: all ${unreached.length} claim(s) failed to reach it, so any proposition only it could settle is unsettled.`
+            : `The cross-family rung did not reach ${unreached.length} of ${claims.length} claim(s), so any proposition only it could settle is unsettled for those.`);
+    }
+    persist('verification.json', { ...verification, stopReason: investigation.stopReason, spentUsd: investigation.spentUsd });
+    return { claims, investigation, verification };
+}
+// The same claims, verified again with the cross-family rung switched off. Emission is
+// not repeated and the model is not re-asked — the recorded answers are replayed — so
+// the difference is the rung's contribution and nothing else.
+export function ablate(directory, rung = 'cross_family_llm') {
+    const { packet } = loadReview(directory);
+    const repository = join(directory, 'source.git');
+    const revisions = { head: revisionFrom(repository, packet.headSha), base: revisionFrom(repository, packet.mergeBaseSha) };
+    const read = (name) => {
+        const bytes = readFileSync(join(directory, name));
+        if (bytes.length > 16_000_000)
+            throw new Error(`${name} exceeds the 16 MB replay limit`);
+        return JSON.parse(bytes.toString('utf8'));
+    };
+    const verification = read('verification.json');
+    if (!Array.isArray(verification.crossFamilyLog))
+        throw new Error('This run predates cross-family recording; re-run claim-review to measure the rung');
+    return contributionOf(rung, read('claims.json'), revisions, BALANCED, verification.crossFamilyLog);
+}