@caddis/cli 0.4.55 → 0.4.57

package/bundles/antigravity-plugin/hooks.json

@@ -9,7 +9,8 @@
             "command": "python guard_agy.py",
             "windows": "python guard_agy.py",
             "linux": "python3 guard_agy.py",
-            "osx": "python3 guard_agy.py"
+            "osx": "python3 guard_agy.py",
+            "timeout": 30
           }
         ]
       }

package/bundles/antigravity-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "caddis",
-  "version": "1.3.141",
+  "version": "1.3.143",
   "description": "caddis — agent-agnostic dev harness as an Antigravity (agy) plugin: TDD skills + commands, single-sourced with the Claude Code plugin."
 }

package/bundles/antigravity-plugin/repo_freshness.py

@@ -10,6 +10,14 @@ FAIL OPEN, ALWAYS. Every path exits 0 and every git call is wrapped. A hook that
 or fail a session start is worse than the staleness it prevents, so a failed or slow fetch
 reports and continues.
 
+NO LOCKS, NO PROMPTS, A TIME BUDGET (robustness audit #6, 18 Oct 2026). Every git call
+runs with GIT_OPTIONAL_LOCKS=0 (and `git status` with --no-optional-locks), so this hook never takes
+index.lock from a peer session mid-commit. Every call runs with GIT_TERMINAL_PROMPT=0 and
+GCM_INTERACTIVE=never, so a credential helper can never pop a sign-in window. The fetch runs in a
+job object (Windows) or process group (POSIX), so `git-remote-https` dies with `git` on a timeout
+instead of surviving it holding a ref lock. All git calls share one 18 s budget under the 25 s hook
+timeout; with less than the fetch timeout left, the fetch is skipped and the output says so.
+
 IT ONLY PRINTS. It never switches, stashes, resets, commits or creates anything except one
 throttle stamp inside .git/. A SessionStart hook cannot ask a question, and these checkouts
 are shared with other live sessions — acting without an answer could take work with it.
@@ -25,6 +33,7 @@ from __future__ import annotations
 import json
 import os
 import re
+import signal
 import subprocess
 import sys
 import time
@@ -49,21 +58,158 @@ if _reconfig:
         pass
 
 FETCH_TIMEOUT_S = 15        # ceiling: a slow or unreachable remote must not stall a session
+TOTAL_BUDGET_S = 18         # all git calls together; the hook timeout in hooks.json is 25 s
 FETCH_MAX_AGE_S = 600       # a restart within 10 minutes reuses the last fetch
 PEER_FRESH_S = 1800         # live peer session-state threshold (30 minutes, matches inject_relay)
 STAMP_NAME = "caddis-freshness-stamp"
 
+# No git child opens a console window on Windows (a hook is not a place for flashing windows).
+_NO_WINDOW = 0x08000000 if os.name == "nt" else 0
+_NEW_PROCESS_GROUP = 0x00000200
+# Never take an optional lock, never ask for a credential, never open a credential-manager window.
+_GIT_ENV_OVERRIDES = {"GIT_OPTIONAL_LOCKS": "0", "GIT_TERMINAL_PROMPT": "0", "GCM_INTERACTIVE": "never"}
+
+_deadline: float | None = None      # time.monotonic() value that ends this run's git budget; None = no budget
+
+
+def _git_env() -> dict:
+    """os.environ plus the no-lock, no-prompt overrides. A fresh dict each call."""
+    return {**os.environ, **_GIT_ENV_OVERRIDES}
+
+
+def _remaining() -> float:
+    """Seconds left in the git budget. Effectively unbounded outside report()."""
+    return float("inf") if _deadline is None else _deadline - time.monotonic()
+
 
 def _git(cwd: str, *args: str, timeout: int = 15) -> tuple[int, str]:
-    """(exit code, stdout). Never raises; a timeout is just a non-zero code."""
+    """(exit code, stdout). Never raises; a timeout is just a non-zero code. No call starts once the budget is
+    gone, and no call may run past it."""
+    left = _remaining()
+    if left <= 0:
+        return 1, ""
     try:
         r = subprocess.run(["git", *args], cwd=cwd, capture_output=True, text=True,
-                           encoding="utf-8", errors="replace", timeout=timeout)
+                           encoding="utf-8", errors="replace", timeout=min(timeout, left),
+                           stdin=subprocess.DEVNULL, env=_git_env(), creationflags=_NO_WINDOW)
     except (OSError, subprocess.SubprocessError):
         return 1, ""
     return r.returncode, (r.stdout or "").strip()
 
 
+# -- the bounded runner for the fetch ---------------------------------------------------------------------------
+# Equivalent to caddis_roadmap.run_bounded (job object, tree kill), kept local on purpose: that module cannot take a
+# cwd or creation flags, costs ~120 ms to import, and agy ships this file in a bundle where scripts/ may not sit
+# beside it. A hook that cannot import its helper must still work.
+
+
+class _Job:
+    """A Windows job object holding one process and its children. KILL_ON_JOB_CLOSE: closing the handle (or the
+    death of this process) ends the whole tree, even after the first process has exited."""
+
+    def __init__(self, proc: "subprocess.Popen"):
+        import ctypes
+        from ctypes import wintypes
+
+        class _Basic(ctypes.Structure):
+            _fields_ = [("PerProcessUserTimeLimit", ctypes.c_int64), ("PerJobUserTimeLimit", ctypes.c_int64),
+                        ("LimitFlags", wintypes.DWORD), ("MinimumWorkingSetSize", ctypes.c_size_t),
+                        ("MaximumWorkingSetSize", ctypes.c_size_t), ("ActiveProcessLimit", wintypes.DWORD),
+                        ("Affinity", ctypes.c_size_t), ("PriorityClass", wintypes.DWORD),
+                        ("SchedulingClass", wintypes.DWORD)]
+
+        class _Io(ctypes.Structure):
+            _fields_ = [(n, ctypes.c_uint64) for n in (
+                "ReadOperationCount", "WriteOperationCount", "OtherOperationCount",
+                "ReadTransferCount", "WriteTransferCount", "OtherTransferCount")]
+
+        class _Extended(ctypes.Structure):
+            _fields_ = [("BasicLimitInformation", _Basic), ("IoInfo", _Io), ("ProcessMemoryLimit", ctypes.c_size_t),
+                        ("JobMemoryLimit", ctypes.c_size_t), ("PeakProcessMemoryUsed", ctypes.c_size_t),
+                        ("PeakJobMemoryUsed", ctypes.c_size_t)]
+
+        k = ctypes.WinDLL("kernel32", use_last_error=True)
+        k.CreateJobObjectW.argtypes = (ctypes.c_void_p, wintypes.LPCWSTR)
+        k.CreateJobObjectW.restype = wintypes.HANDLE
+        k.SetInformationJobObject.argtypes = (wintypes.HANDLE, ctypes.c_int, ctypes.c_void_p, wintypes.DWORD)
+        k.SetInformationJobObject.restype = wintypes.BOOL
+        k.AssignProcessToJobObject.argtypes = (wintypes.HANDLE, wintypes.HANDLE)
+        k.AssignProcessToJobObject.restype = wintypes.BOOL
+        k.TerminateJobObject.argtypes = (wintypes.HANDLE, wintypes.UINT)
+        k.TerminateJobObject.restype = wintypes.BOOL
+        k.CloseHandle.argtypes = (wintypes.HANDLE,)
+        k.CloseHandle.restype = wintypes.BOOL
+        self._k = k
+        self.handle = k.CreateJobObjectW(None, None)
+        if not self.handle:
+            raise OSError(ctypes.get_last_error(), "CreateJobObjectW failed")
+        info = _Extended()
+        info.BasicLimitInformation.LimitFlags = 0x2000          # JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
+        if not k.SetInformationJobObject(self.handle, 9, ctypes.byref(info), ctypes.sizeof(info)):
+            err = ctypes.get_last_error()
+            k.CloseHandle(self.handle)
+            raise OSError(err, "SetInformationJobObject failed")
+        if not k.AssignProcessToJobObject(self.handle, int(proc._handle)):  # type: ignore[attr-defined]
+            err = ctypes.get_last_error()
+            k.CloseHandle(self.handle)
+            raise OSError(err, "AssignProcessToJobObject failed")
+
+    def terminate(self) -> None:
+        self._k.TerminateJobObject(self.handle, 1)
+
+    def close(self) -> None:
+        self._k.CloseHandle(self.handle)
+
+
+def _kill_tree(proc: "subprocess.Popen", job: "_Job | None") -> None:
+    try:
+        if job is not None:
+            job.terminate()
+        elif os.name == "nt":
+            subprocess.run(["taskkill", "/T", "/F", "/PID", str(proc.pid)], capture_output=True,
+                           stdin=subprocess.DEVNULL, creationflags=_NO_WINDOW, timeout=5)
+        else:
+            os.killpg(proc.pid, signal.SIGKILL)
+    except Exception:
+        pass            # the kill is best effort; the caller still reports the timeout
+
+
+def _run_bounded(argv: list[str], cwd: str, timeout: float, env: dict) -> "int | None":
+    """Run `argv` with no stdin and no output. Returns its exit code, 1 when it cannot start, or None on timeout.
+    On a timeout the whole process tree is killed (job object on Windows, process group elsewhere). The tree is
+    also killed on any other way out, Ctrl+C included, and when this process dies (Windows job)."""
+    kwargs: dict = {"cwd": cwd, "env": env, "stdin": subprocess.DEVNULL, "stdout": subprocess.DEVNULL,
+                    "stderr": subprocess.DEVNULL}
+    if os.name != "nt":
+        kwargs["start_new_session"] = True
+    try:
+        proc = subprocess.Popen(argv, creationflags=(_NO_WINDOW | _NEW_PROCESS_GROUP) if os.name == "nt" else 0, **kwargs)
+    except (OSError, subprocess.SubprocessError):
+        return 1
+    job = None
+    if os.name == "nt":
+        try:
+            job = _Job(proc)
+        except Exception:
+            job = None          # no job object: taskkill /T is the fallback
+    try:
+        try:
+            return proc.wait(timeout=max(timeout, 0))
+        except subprocess.TimeoutExpired:
+            _kill_tree(proc, job)
+            try:
+                proc.wait(timeout=5)
+            except subprocess.SubprocessError:
+                pass
+            return None
+    except BaseException:
+        _kill_tree(proc, job)
+        raise
+    finally:
+        if job is not None:
+            job.close()
+
+
 def _default_ref(cwd: str) -> str:
     """The remote's default branch, e.g. origin/main. '' when there is no usable one."""
     code, out = _git(cwd, "symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD")
@@ -108,7 +254,12 @@ def _status_entries(top: str) -> list[list[str]]:
     """`git status --porcelain -z` at the repo top: one list of paths per entry (a rename gives two).
     NUL-separated, so a path is never quoted. [] when git fails."""
     try:
-        r = subprocess.run(["git", "status", "--porcelain", "-z"], cwd=top, capture_output=True, timeout=15)
+        left = _remaining()
+        if left <= 0:
+            return []
+        r = subprocess.run(["git", "--no-optional-locks", "status", "--porcelain", "-z"], cwd=top,
+                           capture_output=True, timeout=min(15, left), stdin=subprocess.DEVNULL,
+                           env=_git_env(), creationflags=_NO_WINDOW)
     except (OSError, subprocess.SubprocessError):
         return []
     if r.returncode != 0:
@@ -201,8 +352,31 @@ def _dirty_owners(top: str, dirty_paths: set[str], own_session_id: str = "") ->
         return []
 
 
+def _fetch(cwd: str) -> "bool | None":
+    """`git fetch origin` through the bounded runner. True = fetched, False = failed or timed out, None = skipped
+    because less than FETCH_TIMEOUT_S of the budget is left. Never raises. Maintenance is off for this one call:
+    a background `gc --auto` would be killed with the job and could leave its lock behind."""
+    left = _remaining()
+    if left < FETCH_TIMEOUT_S:
+        return None
+    argv = ["git", "-c", "gc.auto=0", "-c", "maintenance.auto=false", "fetch", "origin", "--quiet"]
+    try:
+        return _run_bounded(argv, cwd, min(FETCH_TIMEOUT_S, left), _git_env()) == 0
+    except Exception:
+        return False
+
+
 def report(cwd: str, own_session_id: str = "") -> list[str]:
     """The lines to print. Empty when there is nothing worth saying."""
+    global _deadline
+    _deadline = time.monotonic() + TOTAL_BUDGET_S
+    try:
+        return _report(cwd, own_session_id)
+    finally:
+        _deadline = None
+
+
+def _report(cwd: str, own_session_id: str = "") -> list[str]:
     if _git(cwd, "rev-parse", "--is-inside-work-tree")[0] != 0:
         return []                                   # not a git repository
     branch = _git(cwd, "branch", "--show-current")[1]
@@ -214,8 +388,12 @@ def report(cwd: str, own_session_id: str = "") -> list[str]:
     has_origin = "origin" in _git(cwd, "remote")[1].split()
     git_dir = _git(cwd, "rev-parse", "--absolute-git-dir")[1] or os.path.join(cwd, ".git")
     if has_origin and _fetch_is_due(git_dir):
-        if _git(cwd, "fetch", "origin", "--quiet", timeout=FETCH_TIMEOUT_S)[0] == 0:
+        fetched = _fetch(cwd)
+        if fetched:
             _mark_fetched(git_dir)
+        elif fetched is None:
+            lines.append("[HARNESS] skipped the fetch - the session-start time budget was nearly spent. "
+                         "The figures below may be stale.")
         else:
             lines.append("[HARNESS] could not fetch origin - the figures below may be stale.")
 

package/bundles/antigravity-plugin/scripts/caddis_adhoc.py

@@ -26,6 +26,14 @@ except ModuleNotFoundError as exc:
     sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "claude-harness" / "scripts"))
     import caddis_exit
 
+try:
+    import caddis_worktree_safety
+except ModuleNotFoundError as exc:
+    if exc.name != "caddis_worktree_safety":
+        raise
+    sys.path.insert(0, str(Path(__file__).resolve().parent))
+    import caddis_worktree_safety
+
 if hasattr(sys.stdout, "reconfigure"):
     sys.stdout.reconfigure(encoding="utf-8", errors="replace")
     sys.stderr.reconfigure(encoding="utf-8", errors="replace")
@@ -467,12 +475,10 @@ def run_adhoc(
                 if branch_res.returncode != 0:
                     reason = f"branch update failed: {branch_res.stderr.strip()}"
                 else:
-                    remove_res = subprocess.run(
-                        ["git", "-C", str(repo), "worktree", "remove", "--force", str(wt_path)],
-                        capture_output=True, text=True, encoding="utf-8", errors="replace",
-                    )
-                    if remove_res.returncode != 0 or wt_path.exists():
-                        reason = f"worktree remove failed: {remove_res.stderr.strip() or wt_path}"
+                    # An OSError from the helper (git not runnable) lands in the `except OSError` below.
+                    problem = caddis_worktree_safety.safe_remove_worktree(repo, wt_path)
+                    if problem or wt_path.exists():
+                        reason = problem or f"worktree remove failed: {wt_path}"
                     else:
                         kept_worktree = None
                         subprocess.run(["git", "-C", str(repo), "worktree", "prune"], capture_output=True)
@@ -603,12 +609,14 @@ def drop_adhoc(repo: Path) -> int:
         print(f"[mmr] Refusing to remove {kept_worktree}: not a registered lane/* worktree")
         return EXIT_FAIL
     if kept_worktree:
-        removed = subprocess.run(
-            ["git", "-C", str(repo), "worktree", "remove", "--force", kept_worktree],
-            capture_output=True, text=True, encoding="utf-8", errors="replace",
-        )
-        if removed.returncode != 0:
-            print(f"[mmr] Could not remove kept worktree: {removed.stderr.strip()}")
+        try:
+            problem = caddis_worktree_safety.safe_remove_worktree(repo, Path(kept_worktree))
+        except OSError as exc:
+            problem = f"{type(exc).__name__}: {exc}"
+        if not problem and os.path.lexists(kept_worktree):
+            problem = f"{kept_worktree} still exists after git worktree remove"
+        if problem:
+            print(f"[mmr] Could not remove kept worktree: {problem}")
             return EXIT_FAIL
         pruned = subprocess.run(
             ["git", "-C", str(repo), "worktree", "prune"],

package/bundles/antigravity-plugin/scripts/caddis_checkout_guard.py

@@ -3,6 +3,11 @@
 `shared` (handoff-integrity Phase 5, the design of fleet-handoff Phase 2): a checkout is shared when its root
 `AGENTS.md` says `Shared checkout: yes`, or when `git status` lists a path this session did not change. In a
 shared checkout handoff writes no tracked file there; it uses `caddis_docs_pr.py` instead.
+
+`checkout_is_shared` and `foreign_changes` (robustness #11) are the two halves of that test. `caddis_lanes.py accept`
+calls them before it fast-forwards the session checkout, and the commands that switch, rebase or pull run
+`shared` first (pr-merge, ship-pr, ship-merge, cloud-phases). A linked worktree is never shared: AGENTS.md is
+tracked, so a worktree carries the line too, but the worktree is the safe place the rule sends the work to.
 """
 
 from __future__ import annotations
@@ -79,28 +84,74 @@ def _norm(path: str) -> str:
     return path.strip().replace("\\", "/")
 
 
-def is_shared_checkout(root: Path, own_files: set[str]) -> tuple[bool, str]:
-    """(True, reason) when handoff must not write tracked files in `root`; else (False, "").
+class CheckoutStatusError(OSError):
+    """`git status` could not run in the checkout, so foreign changes cannot be ruled out."""
 
-    `Shared checkout: no` in AGENTS.md never hides a change this session did not make. When git status cannot
-    run, the checkout counts as shared: a wrong "no" could commit another session's files.
-    """
-    agents = Path(root) / "AGENTS.md"
+
+def _repo_top(start: Path) -> Path:
+    """The nearest folder at or above `start` that holds `.git` (a folder or a gitfile); `start` when none does."""
+    here = Path(start).resolve()
+    for folder in (here, *here.parents):
+        if (folder / ".git").exists():
+            return folder
+    return here
+
+
+def is_linked_worktree(top: Path) -> bool:
+    """True when `top/.git` is a gitfile that points into `<repo>/.git/worktrees/` (a `git worktree add` tree)."""
+    gitfile = Path(top) / ".git"
+    if not gitfile.is_file():
+        return False
     try:
-        text = agents.read_text(encoding="utf-8", errors="replace") if agents.is_file() else ""
+        line = gitfile.read_text(encoding="utf-8", errors="replace").strip()
     except OSError:
-        text = ""
-    if SHARED_RE.search(text):
-        return True, "AGENTS.md says Shared checkout: yes"
+        return False
+    return line.lower().startswith("gitdir:") and "/worktrees/" in line.replace("\\", "/").lower()
+
+
+def checkout_is_shared(root: Path) -> bool:
+    """True when the repo that holds `root` says `Shared checkout: yes` in its top `AGENTS.md` (any case).
+
+    A linked worktree is never shared (see the module note). A missing or unreadable AGENTS.md means no."""
+    top = _repo_top(Path(root))
+    if is_linked_worktree(top):
+        return False
+    try:
+        text = (top / "AGENTS.md").read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return False
+    return bool(SHARED_RE.search(text))
+
+
+def foreign_changes(root: Path, own_files: set[str] | None = None) -> list[str]:
+    """The dirty paths in `root` that are not in `own_files`, in `git status` order. A rename counts both paths.
+
+    Without session tracking (`own_files` None or empty), every dirty path counts. Raises CheckoutStatusError
+    when `git status` fails: the caller must then treat the checkout as unsafe."""
     ret, lines = get_porcelain_lines(Path(root))
     if ret != 0:
-        return True, "git status failed, so changes by other sessions cannot be ruled out"
-    own = {_norm(p) for p in own_files}
+        raise CheckoutStatusError(f"git status failed in {root}")
+    own = {_norm(p) for p in (own_files or set())}
     foreign: list[str] = []
     for entry in lines:
         for path in entry_paths(entry):
             if _norm(path) not in own and path not in foreign:
                 foreign.append(path)
+    return foreign
+
+
+def is_shared_checkout(root: Path, own_files: set[str]) -> tuple[bool, str]:
+    """(True, reason) when handoff must not write tracked files in `root`; else (False, "").
+
+    `Shared checkout: no` in AGENTS.md never hides a change this session did not make. When git status cannot
+    run, the checkout counts as shared: a wrong "no" could commit another session's files.
+    """
+    if checkout_is_shared(Path(root)):
+        return True, "AGENTS.md says Shared checkout: yes"
+    try:
+        foreign = foreign_changes(Path(root), own_files)
+    except CheckoutStatusError:
+        return True, "git status failed, so changes by other sessions cannot be ruled out"
     if foreign:
         return True, "changes not made by this session: " + ", ".join(foreign[:3])
     return False, ""

package/bundles/antigravity-plugin/scripts/caddis_docs_pr.py

@@ -31,7 +31,6 @@ import datetime
 import json
 import os
 import re
-import shutil
 import subprocess
 import sys
 import tempfile
@@ -41,14 +40,16 @@ try:
     import caddis_exit
     import caddis_checkout_guard
     import caddis_roadmap as roadmap
+    import caddis_worktree_safety
 except ModuleNotFoundError as exc:
-    if exc.name not in {"caddis_exit", "caddis_checkout_guard", "caddis_roadmap"}:
+    if exc.name not in {"caddis_exit", "caddis_checkout_guard", "caddis_roadmap", "caddis_worktree_safety"}:
         raise
     sys.path.insert(0, str(Path(__file__).resolve().parent))
     sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "claude-harness" / "scripts"))
     import caddis_exit
     import caddis_checkout_guard
     import caddis_roadmap as roadmap
+    import caddis_worktree_safety
 
 BRANCH_PREFIX = "docs/handoff-"
 DIR_PREFIX = "caddis-docs-pr-"
@@ -199,14 +200,22 @@ def _save_patch(worktree: Path) -> Path:
 
 
 def _remove(main: Path, worktree: Path, branch: str) -> None:
-    for args in (("worktree", "remove", "--force", "--force", str(worktree)), ("worktree", "prune"),
-                 ("branch", "-D", branch)):
+    """Remove the worktree (links first, so a junction's target survives), prune, delete the branch.
+
+    Best effort, as before: the result of each step is not checked. Every caller has already saved the session's
+    work as a patch or has none, so a step that fails leaves only a temp folder. A folder that git leaves is
+    removed below through remove_tree, which also removes links first."""
+    try:
+        caddis_worktree_safety.safe_remove_worktree(main, worktree, force_locked=True, env=roadmap._quiet_env())
+    except OSError:
+        pass
+    for args in (("worktree", "prune"), ("branch", "-D", branch)):
         try:
             _git(main, *args, check=False)
         except (roadmap.RoadmapError, OSError):
             pass
     if worktree.exists():
-        shutil.rmtree(worktree, ignore_errors=True)
+        caddis_worktree_safety.remove_tree(worktree)
 
 
 def finish(worktree: Path, title: str, body: str, out=print) -> int:

package/bundles/antigravity-plugin/scripts/caddis_gate.py

@@ -602,7 +602,26 @@ def is_test_file(path: str) -> bool:
     return False
 
 
+_STEERING_FILENAMES = {"conftest.py", "pytest.ini", "pyproject.toml", "setup.cfg", "tox.ini"}
+
+
+def is_review_steering_file(path: str) -> bool:
+    """True for config that steers reviews, merges or tests: never tier 0, and never a 0-reviewer "1-small".
+
+    `.caddis/*.toml` (review/implement routing, merge-chain checks, spend cap), any `conftest.py`, the pytest and
+    packaging config, and `.github/workflows/**`. A fix diff that changes these can turn a gate off, so it is reviewed.
+    """
+    norm = path.replace("\\", "/").lower().removeprefix("./")
+    if norm.startswith(".caddis/") and norm.endswith(".toml"):
+        return True
+    if norm.startswith(".github/workflows/"):
+        return True
+    return norm.rsplit("/", 1)[-1] in _STEERING_FILENAMES
+
+
 def is_tier0_file(path: str) -> bool:
+    if is_review_steering_file(path):
+        return False
     norm = path.replace("\\", "/").lower()
     if norm.startswith("./"):
         norm = norm[2:]
@@ -647,8 +666,13 @@ def _numstat(rng: str | None = None, repo_root: Path = Path(".")) -> list[tuple[
     if res.returncode != 0:
         reason = (res.stderr or "").strip().splitlines()
         raise RuntimeError(f"git diff --numstat exited {res.returncode}: {reason[0] if reason else 'no message'}")
+    return _parse_numstat(res.stdout)
+
+
+def _parse_numstat(stdout: str) -> list[tuple[str, int]]:
+    """(path, changed-lines) per file from `git diff --numstat` output; see `_numstat`."""
     files: list[tuple[str, int]] = []
-    for row in res.stdout.splitlines():
+    for row in stdout.splitlines():
         parts = row.split("\t")
         if len(parts) != 3:
             continue
@@ -680,6 +704,8 @@ def review_tier(files: list[tuple[str, int]], plan_risk: str = "normal") -> str:
     non_tier0_lines = sum(lines for _, lines in non_tier0)
     if review_triggers(non_tier0_paths, non_tier0_lines):
         return "2"
+    if any(is_review_steering_file(p) for p in non_tier0_paths):
+        return "1"
     has_test = any(is_test_file(p) for p, _ in files)
     if non_tier0_lines <= 40 and has_test:
         return "1-small"