@claudexor/review 1.0.0 → 2.1.2

package/dist/reviewEngine.js

@@ -1,12 +1,13 @@
 import { parseUnifiedDiff, runCapture } from "@claudexor/core";
 import { preflightEvidence, writeDiffEvidence } from "@claudexor/context";
 import { FallbackReason, HarnessRunSpec, ReviewFinding as ReviewFindingSchema, } from "@claudexor/schema";
-import { existsSync, lstatSync, readlinkSync, realpathSync } from "node:fs";
+import { existsSync, lstatSync, readlinkSync, realpathSync, statSync } from "node:fs";
 import { cp, mkdir, readdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join, normalize, relative, resolve } from "node:path";
-import { appendLine, containsSecretLikeToken, ensureDir, newId, nowIso, readTextSafe, redactSecrets, sha256, writeJson, writeText, } from "@claudexor/util";
+import { appendLine, containsSecretLikeToken, ensureDir, newId, nowIso, readTextSafe, redactSecrets, sensitiveResourcePolicy, sha256, writeJson, writeText, } from "@claudexor/util";
 import { dedupeFindings, extractJsonBlocks, parseFindingsDetailed, } from "./findings.js";
+import { buildReviewPrompt } from "./reviewPrompt.js";
 import { buildRouteProof, classifyDiversity } from "./route.js";
 const DEFAULT_REVIEWER_TIMEOUT_MS = 10 * 60_000;
 const DEFAULT_REVIEWER_TRANSIENT_RETRY_POLICY = {
@@ -14,41 +15,81 @@ const DEFAULT_REVIEWER_TRANSIENT_RETRY_POLICY = {
     initialDelayMs: 1_000,
     maxDelayMs: 10_000,
 };
-function reviewPrompt(label, candidateRoot, evidenceDir, patch) {
-    return [
-        "You are an adversarial code reviewer.",
-        `Candidate root: ${candidateRoot}.`,
-        `First read the evidence packet in ${evidenceDir} (USER_INTENT.md, FORBIDDEN_FINDINGS.md, PLAN_ACCEPTED.md, DECIDED_TRADEOFFS.md, TESTS.txt, DIFF.patch, DIFF_SUMMARY.md). If a mandatory file is missing, return INSUFFICIENT_EVIDENCE.`,
-        `Review ${label}'s change from the file-backed patch artifact, not from this prompt. Full patch: ${patch.diffPath}. Summary: ${patch.summaryPath}. Patch digest: ${patch.diffSha256}.`,
-        "All code/file evidence must come from Candidate root or the evidence packet. Do not inspect or cite sibling/base repository paths outside Candidate root; if required evidence is unavailable there, return INSUFFICIENT_EVIDENCE.",
-        "Treat TESTS.txt as the gate evidence. Do not rerun full build/test gates from the review; run only small targeted commands when needed to verify a concrete finding.",
-        "In finding evidence, cite candidate files with paths relative to Candidate root. Cite evidence packet files by their evidence filename (for example DIFF.patch or TESTS.txt). Do not cite absolute Candidate root, reviewer workspace, or evidenceDir paths; those are disposable transport paths and will be rejected as evidence.",
-        "Output ONLY a JSON array of findings.",
-        `Each finding: {"severity":"BLOCK|FIX_FIRST|WARN|NIT|OUT_OF_SCOPE|INSUFFICIENT_EVIDENCE|NEEDS_HUMAN","category":"correctness|regression|security|performance|maintainability|test_gap|spec_gap|deploy|architecture|ux","claim":"...","evidence":{"files":[{"path":"...","lines":"..."}]},"proposed_fix":"..."}.`,
-        "Rules: no evidence => do NOT use BLOCK. Do not relitigate FORBIDDEN_FINDINGS or DECIDED_TRADEOFFS.",
-        "",
-        "Patch summary (not a replacement for reading DIFF.patch):",
-        patch.summary,
-    ].join("\n");
+const BLOCKED_REVIEWER_RUNTIME_ROOTS = new Set("auth cache daemon home homes logs runs secrets state tmp workspaces".split(" "));
+const TEXT_EVIDENCE_SUFFIXES = [".md", ".txt", ".json", ".yaml", ".yml", ".patch"];
+const REVIEW_WAVE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function readExistingDiffEvidence(dir, diff) {
+    const diffText = diff.endsWith("\n") ? diff : `${diff}\n`;
+    const summaryPath = join(dir, "DIFF_SUMMARY.md");
+    const summary = readTextSafe(summaryPath);
+    if (summary === null)
+        throw new Error("sealed review packet is missing DIFF_SUMMARY.md");
+    return {
+        diffPath: join(dir, "DIFF.patch"),
+        summaryPath,
+        diffSha256: sha256(diffText),
+        summary,
+    };
+}
+function reviewerRouteProof(reviewer, modelId, source, peerFamilies) {
+    return buildRouteProof({
+        harness_id: reviewer.adapter.id,
+        provider_family: reviewer.providerFamily,
+        model_hint: reviewer.requestedModel ?? null,
+    }, {
+        provider: reviewer.providerFamily,
+        model_id: modelId,
+        evidence_source: modelId ? source : "unavailable",
+    }, peerFamilies);
+}
+function reviewerInfo(reviewer, routeProofStatus, observedModel = null) {
+    return {
+        harness_id: reviewer.adapter.id,
+        requested_model: reviewer.requestedModel ?? null,
+        requested_effort: reviewer.requestedEffort ?? null,
+        observed_model: observedModel,
+        route_proof_status: routeProofStatus,
+    };
 }
-/**
- * Cross-family review of one anonymized candidate. Each reviewer runs its review
- * intent and emits JSON findings; we attach route proofs and verify the
- * reviewers span >= 2 distinct provider families.
- */
 export async function reviewCandidate(input) {
     const findingsByReviewer = input.reviewers.map(() => []);
-    const routeProofs = [];
-    const reviewerRequests = [];
-    const healthyFamilies = new Set();
+    const reviewerFamilies = input.reviewers.map((reviewer) => reviewer.providerFamily);
+    const routeProofs = input.reviewers.map((reviewer, index) => reviewerRouteProof(reviewer, null, "unavailable", reviewerFamilies.filter((_, otherIndex) => otherIndex !== index)));
+    const reviewerRequests = input.reviewers.map((reviewer) => ({
+        harness_id: reviewer.adapter.id,
+        provider_family: reviewer.providerFamily,
+        requested_model: reviewer.requestedModel ?? null,
+        requested_effort: reviewer.requestedEffort ?? null,
+    }));
     const healthyReviewerIndexes = new Set();
-    let reviewSpendUsd = 0;
-    let reviewSpendEstimated = false;
+    const reviewSpendByReviewer = input.reviewers.map(() => 0);
+    const reviewSpendEstimatedByReviewer = input.reviewers.map(() => false);
     const reviewerTimeoutMs = input.reviewerTimeoutMs ?? DEFAULT_REVIEWER_TIMEOUT_MS;
+    const reviewWaveId = input.env?.["CLAUDEXOR_REVIEW_WAVE_ID"] ?? process.env["CLAUDEXOR_REVIEW_WAVE_ID"] ?? null;
+    if (input.evidenceReadOnly && input.frozenIdentity && !REVIEW_WAVE_ID.test(reviewWaveId ?? "")) {
+        throw new Error("sealed release review requires CLAUDEXOR_REVIEW_WAVE_ID UUID");
+    }
+    const frozenMetadata = input.frozenIdentity
+        ? {
+            candidate_sha: input.frozenIdentity.candidateSha,
+            candidate_tree: input.frozenIdentity.candidateTree,
+            packet_manifest_sha256: input.frozenIdentity.packetManifestSha256,
+            ...(reviewWaveId ? { review_wave_id: reviewWaveId } : {}),
+        }
+        : {};
     if (containsSecretLikeToken(input.diff || "(empty diff)\n")) {
         throw new Error("diff evidence contains a secret-like token; refusing to persist raw DIFF.patch");
     }
-    writeDiffEvidence(input.evidenceDir, input.diff);
+    if (input.evidenceReadOnly) {
+        const packetDiff = readTextSafe(join(input.evidenceDir, "DIFF.patch"));
+        const normalizedDiff = input.diff.endsWith("\n") ? input.diff : `${input.diff}\n`;
+        if (packetDiff === null || packetDiff !== normalizedDiff) {
+            throw new Error("sealed review packet DIFF.patch does not match the verified review diff");
+        }
+    }
+    else {
+        writeDiffEvidence(input.evidenceDir, input.diff);
+    }
     const preflight = preflightEvidence(input.evidenceDir);
     if (!preflight.ok) {
         const parts = [
@@ -60,69 +101,70 @@ export async function reviewCandidate(input) {
     const artifactsBaseDir = input.artifactsDir ?? join(input.evidenceDir, "reviewer-artifacts");
     ensureDir(artifactsBaseDir);
     const persistentEvidenceDir = join(artifactsBaseDir, "evidence");
-    await copyReviewEvidencePacket(input.evidenceDir, persistentEvidenceDir);
-    const persistentPatch = writeDiffEvidence(persistentEvidenceDir, input.diff);
-    writeJson(join(persistentEvidenceDir, "metadata.json"), {
+    await copyReviewEvidencePacket(input.evidenceDir, persistentEvidenceDir, input.evidenceReadOnly === true);
+    const persistentPatch = input.evidenceReadOnly
+        ? readExistingDiffEvidence(persistentEvidenceDir, input.diff)
+        : writeDiffEvidence(persistentEvidenceDir, input.diff);
+    writeJson(input.evidenceReadOnly
+        ? join(artifactsBaseDir, "evidence-metadata.json")
+        : join(persistentEvidenceDir, "metadata.json"), {
         source_evidence_dir: input.evidenceDir,
         candidate_root: input.cwd,
         persistent_evidence_dir: persistentEvidenceDir,
         diff_path: persistentPatch.diffPath,
         summary_path: persistentPatch.summaryPath,
         diff_sha256: persistentPatch.diffSha256,
+        ...frozenMetadata,
     });
-    const artifacts = [];
-    const reviewerFamilies = input.reviewers.map((r) => r.providerFamily);
+    const artifacts = input.reviewers.map(() => undefined);
     const preservePaths = extractDiffTouchedPaths(input.diff);
     const reviewerWorkspaceBaseDir = selectReviewerWorkspaceBaseDir(input.cwd, artifactsBaseDir, input.evidenceDir);
-    try {
-        for (const [index, reviewer] of input.reviewers.entries()) {
-            if (input.signal?.aborted)
-                break;
-            reviewerRequests.push({
-                harness_id: reviewer.adapter.id,
-                provider_family: reviewer.providerFamily,
-                requested_model: reviewer.requestedModel ?? null,
-                requested_effort: reviewer.requestedEffort ?? null,
+    const runReviewer = async (reviewer, index) => {
+        if (input.signal?.aborted)
+            return;
+        const artifact = createReviewerArtifactContext(artifactsBaseDir, index, reviewer);
+        artifacts[index] = artifact;
+        let reviewerWorkspace = null;
+        let spec = null;
+        try {
+            reviewerWorkspace = await prepareReviewerWorkspace({
+                sourceRoot: input.cwd,
+                sourceEvidenceDir: persistentEvidenceDir,
+                workspaceBaseDir: reviewerWorkspaceBaseDir,
+                reviewerDirName: `${String(index + 1).padStart(2, "0")}-${safeFilePart(reviewer.adapter.id)}`,
+                excludeRoots: [artifactsBaseDir],
+                preservePaths,
+                preserveEvidenceBytes: input.evidenceReadOnly === true,
             });
-            const artifact = createReviewerArtifactContext(artifactsBaseDir, index, reviewer);
-            artifacts.push(artifact);
-            let reviewerWorkspace = null;
-            let spec = null;
-            try {
-                reviewerWorkspace = await prepareReviewerWorkspace({
-                    sourceRoot: input.cwd,
-                    sourceEvidenceDir: persistentEvidenceDir,
-                    workspaceBaseDir: reviewerWorkspaceBaseDir,
-                    reviewerDirName: `${String(index + 1).padStart(2, "0")}-${safeFilePart(reviewer.adapter.id)}`,
-                    excludeRoots: [artifactsBaseDir],
-                    preservePaths,
-                });
-                const reviewerPatch = writeDiffEvidence(reviewerWorkspace.evidenceDir, input.diff);
-                updateReviewerMetadata(artifact, {
-                    candidate_evidence_dir: reviewerWorkspace.evidenceDir,
-                    candidate_root: reviewerWorkspace.root,
-                    source_candidate_evidence_dir: input.evidenceDir,
-                    source_candidate_root: input.cwd,
-                    reviewer_workspace_root: reviewerWorkspace.root,
-                    persistent_evidence_dir: persistentEvidenceDir,
-                    persistent_diff_path: persistentPatch.diffPath,
-                    persistent_summary_path: persistentPatch.summaryPath,
-                    diff_sha256: persistentPatch.diffSha256,
-                });
-                const runtimePrompt = reviewPrompt(input.candidateLabel, reviewerWorkspace.root, reviewerWorkspace.evidenceDir, reviewerPatch);
-                spec = HarnessRunSpec.parse({
-                    session_id: newId("rev"),
-                    intent: "review",
-                    prompt: runtimePrompt,
-                    cwd: reviewerWorkspace.root,
-                    access: "readonly",
-                    model_hint: reviewer.requestedModel ?? null,
-                    effort_hint: reviewer.requestedEffort ?? null,
-                    auth_preference: reviewer.authPreference ?? "auto",
-                    env_inheritance: input.envInheritance ?? "mirror_native",
-                    ...(input.env ? { env: input.env } : {}),
-                });
-                writeText(artifact.promptPath, redactSecrets(`Persistent local replay evidence:
+            const reviewerPatch = input.evidenceReadOnly
+                ? readExistingDiffEvidence(reviewerWorkspace.evidenceDir, input.diff)
+                : writeDiffEvidence(reviewerWorkspace.evidenceDir, input.diff);
+            updateReviewerMetadata(artifact, {
+                candidate_evidence_dir: reviewerWorkspace.evidenceDir,
+                candidate_root: reviewerWorkspace.root,
+                source_candidate_evidence_dir: input.evidenceDir,
+                source_candidate_root: input.cwd,
+                reviewer_workspace_root: reviewerWorkspace.root,
+                persistent_evidence_dir: persistentEvidenceDir,
+                persistent_diff_path: persistentPatch.diffPath,
+                persistent_summary_path: persistentPatch.summaryPath,
+                diff_sha256: persistentPatch.diffSha256,
+                ...frozenMetadata,
+            });
+            const runtimePrompt = buildReviewPrompt(input.candidateLabel, reviewerWorkspace.root, reviewerWorkspace.evidenceDir, reviewerPatch, input.evidenceReadOnly === true);
+            spec = HarnessRunSpec.parse({
+                session_id: newId("rev"),
+                intent: "review",
+                prompt: runtimePrompt,
+                cwd: reviewerWorkspace.root,
+                access: "readonly",
+                model_hint: reviewer.requestedModel ?? null,
+                effort_hint: reviewer.requestedEffort ?? null,
+                auth_preference: reviewer.authPreference ?? "auto",
+                env_inheritance: input.envInheritance ?? "mirror_native",
+                ...(input.env ? { env: input.env } : {}),
+            });
+            writeText(artifact.promptPath, redactSecrets(`Persistent local replay evidence:
 - evidence_dir: ${persistentEvidenceDir}
 - candidate_root: ${reviewerWorkspace.root}
 - source_candidate_root: ${input.cwd}
@@ -134,172 +176,124 @@ Runtime prompt used during review follows. Its candidate-tree paths may be trans
 
 ${runtimePrompt}
 `));
-            }
-            catch (err) {
-                const failedAt = nowIso();
-                const message = redactSecrets(err instanceof Error ? err.message : String(err));
-                updateReviewerMetadata(artifact, {
-                    status: "failed",
-                    failure_time: failedAt,
-                    error: `reviewer setup failed: ${message}`,
-                });
-                writeParseError(artifact, { error: `reviewer setup failed: ${message}` });
-                emitReviewerProgress(artifact, reviewer, input.onReviewerEvent, {
-                    type: "reviewer.failed",
-                    at: failedAt,
-                    duration_ms: 0,
-                    message: `Reviewer setup failed: ${message}`,
-                });
-                if (reviewerWorkspace)
-                    await cleanupReviewerWorkspace(reviewerWorkspace, artifact);
-                const proof = buildRouteProof({
-                    harness_id: reviewer.adapter.id,
-                    provider_family: reviewer.providerFamily,
-                    model_hint: reviewer.requestedModel ?? null,
-                }, {
-                    provider: reviewer.providerFamily,
-                    model_id: null,
-                    evidence_source: "unavailable",
-                }, reviewerFamilies);
-                routeProofs.push(proof);
-                findingsByReviewer[index]?.push(insufficientEvidenceFinding({
-                    harness_id: reviewer.adapter.id,
-                    requested_model: reviewer.requestedModel ?? null,
-                    requested_effort: reviewer.requestedEffort ?? null,
-                    observed_model: null,
-                    route_proof_status: proof.status,
-                }, `Reviewer setup failed: ${message}`));
-                continue;
-            }
-            if (!reviewerWorkspace || !spec)
-                continue;
-            let text = "";
-            // Stream-observed model: ONLY a model the native CLI actually emitted in its
-            // stream (stream_event/transcript/model_catalog). This is the honest
-            // `observed_model` for findings — an accepted argv echo is NOT an observation.
-            let streamObservedModel;
-            // Route-proof model: stream-observed when present, else the accepted argv arg
-            // (metadata tier). Drives RouteProof.observed.model_id + status.
-            let routeModel;
-            let routeSource = "unavailable";
-            let reviewerError = null;
-            try {
-                const out = await collectReviewerOutput(reviewer, spec, reviewerTimeoutMs, input.transientRetryPolicy ?? DEFAULT_REVIEWER_TRANSIENT_RETRY_POLICY, artifact, input.onReviewerEvent, input.signal);
-                text = out.text;
-                streamObservedModel = out.observedModel;
-                routeModel = out.observedModel;
-                routeSource = out.observedSource;
-                reviewSpendUsd += out.costUsd;
-                if (out.costEstimated)
-                    reviewSpendEstimated = true;
-                // accepted_model_arg semantics: when WE passed an explicit model argument
-                // and the native CLI completed without rejecting it, the accepted argv is
-                // metadata-level route evidence (weaker than stream-observed, stronger
-                // than nothing). Some CLIs (codex exec --json) never echo the model. This
-                // populates ONLY the route proof — never streamObservedModel, so the
-                // finding's observed_model stays null (an argv echo is not an observation).
-                if (!routeModel && reviewer.requestedModel) {
-                    routeModel = reviewer.requestedModel;
-                    routeSource = "metadata";
-                }
-            }
-            catch (err) {
-                reviewerError = redactSecrets(err instanceof Error ? err.message : String(err));
-                // Budget truth: a reviewer that streamed paid tokens then timed out/failed
-                // still spent money. Fold the partial cost into the ledger (the success
-                // path adds out.costUsd above; these paths are mutually exclusive).
-                const partial = err;
-                if (typeof partial?.partialText === "string" && partial.partialText.trim() !== "") {
-                    text = partial.partialText;
-                }
-                if (partial && typeof partial.partialCostUsd === "number" && partial.partialCostUsd > 0) {
-                    reviewSpendUsd += partial.partialCostUsd;
-                    if (partial.partialCostEstimated)
-                        reviewSpendEstimated = true;
-                }
-                if (partial?.partialObservedModel) {
-                    streamObservedModel = partial.partialObservedModel;
-                    routeModel = partial.partialObservedModel;
-                    routeSource = partial.partialObservedSource ?? "stream_event";
-                }
-                writeParseError(artifact, { error: reviewerError });
-            }
-            finally {
+        }
+        catch (err) {
+            const failedAt = nowIso();
+            const message = redactSecrets(err instanceof Error ? err.message : String(err));
+            updateReviewerMetadata(artifact, {
+                status: "failed",
+                failure_time: failedAt,
+                error: `reviewer setup failed: ${message}`,
+            });
+            writeParseError(artifact, { error: `reviewer setup failed: ${message}` });
+            emitReviewerProgress(artifact, reviewer, input.onReviewerEvent, {
+                type: "reviewer.failed",
+                at: failedAt,
+                duration_ms: 0,
+                message: `Reviewer setup failed: ${message}`,
+            });
+            if (reviewerWorkspace)
                 await cleanupReviewerWorkspace(reviewerWorkspace, artifact);
+            const proof = reviewerRouteProof(reviewer, null, "unavailable", reviewerFamilies);
+            routeProofs[index] = proof;
+            findingsByReviewer[index]?.push(insufficientEvidenceFinding(reviewerInfo(reviewer, proof.status), `Reviewer setup failed: ${message}`));
+            return;
+        }
+        if (!reviewerWorkspace || !spec)
+            return;
+        let text = "";
+        let streamObservedModel;
+        let routeModel;
+        let routeSource = "unavailable";
+        let reviewerError = null;
+        try {
+            const out = await collectReviewerOutput(reviewer, spec, reviewerTimeoutMs, input.transientRetryPolicy ?? DEFAULT_REVIEWER_TRANSIENT_RETRY_POLICY, artifact, input.onReviewerEvent, input.signal);
+            text = out.text;
+            streamObservedModel = out.observedModel;
+            routeModel = out.observedModel;
+            routeSource = out.observedSource;
+            reviewSpendByReviewer[index] = out.costUsd;
+            reviewSpendEstimatedByReviewer[index] = out.costEstimated;
+            if (!routeModel && reviewer.requestedModel) {
+                routeModel = reviewer.requestedModel;
+                routeSource = "metadata";
             }
-            const proof = buildRouteProof({
-                harness_id: reviewer.adapter.id,
-                provider_family: reviewer.providerFamily,
-                model_hint: reviewer.requestedModel ?? null,
-            }, {
-                provider: reviewer.providerFamily,
-                model_id: routeModel ?? null,
-                evidence_source: routeModel ? routeSource : "unavailable",
-            }, 
-            // The other reviewers' families this route is meant to be diverse against
-            // (mirrors the implementer route proof; reviewer diversity is otherwise
-            // enforced via classifyDiversity's same_model_fallback status below).
-            reviewerFamilies.filter((_, i) => i !== index));
-            routeProofs.push(proof);
-            const info = {
-                harness_id: reviewer.adapter.id,
-                requested_model: reviewer.requestedModel ?? null,
-                requested_effort: reviewer.requestedEffort ?? null,
-                // Honest observation only: a finding's observed_model is the STREAM-observed
-                // model or null. An accepted argv arg lives in the route proof's model_id,
-                // not here — it must not masquerade as an observed model.
-                observed_model: streamObservedModel ?? null,
-                route_proof_status: proof.status,
-            };
-            const jsonBlocks = extractJsonBlocks(text);
-            writeJson(artifact.parsedPath, redactValue(jsonBlocks));
-            if (reviewerError && (text.trim() === "" || jsonBlocks.length === 0)) {
-                findingsByReviewer[index]?.push(insufficientEvidenceFinding(info, `Reviewer failed: ${reviewerError}`));
-                continue;
-            }
-            if (text.trim() === "" || jsonBlocks.length === 0) {
-                writeParseError(artifact, { error: "no_parseable_json", text_sha256: sha256(text) });
-                findingsByReviewer[index]?.push(insufficientEvidenceFinding(info, "Reviewer produced no parseable JSON findings."));
-                continue;
-            }
-            const parsed = parseFindingsDetailed(text, info);
-            const parseError = {};
-            let parsedFindingsRecorded = false;
-            const recordParsedFindings = () => {
-                if (parsedFindingsRecorded)
-                    return;
-                findingsByReviewer[index]?.push(...parsed.findings);
-                parsedFindingsRecorded = true;
-            };
-            if (parsed.malformed > 0) {
-                Object.assign(parseError, {
-                    error: "malformed_findings",
-                    malformed: parsed.malformed,
-                    text_sha256: sha256(text),
-                });
-                recordParsedFindings();
-                findingsByReviewer[index]?.push(insufficientEvidenceFinding(info, `Reviewer produced ${parsed.malformed} malformed finding item(s).`));
+        }
+        catch (err) {
+            reviewerError = redactSecrets(err instanceof Error ? err.message : String(err));
+            const partial = err;
+            if (typeof partial?.partialText === "string" && partial.partialText.trim() !== "") {
+                text = partial.partialText;
             }
-            if (reviewerError) {
-                Object.assign(parseError, {
-                    error: reviewerError,
-                    recovered_json_blocks: jsonBlocks.length,
-                    text_sha256: sha256(text),
-                });
-                recordParsedFindings();
-                findingsByReviewer[index]?.push(insufficientEvidenceFinding(info, parsed.findings.length === 0
-                    ? `Reviewer failed after parseable JSON with no findings: ${reviewerError}`
-                    : `Reviewer failed after parseable JSON output: ${reviewerError}`));
+            if (partial && typeof partial.partialCostUsd === "number" && partial.partialCostUsd > 0) {
+                reviewSpendByReviewer[index] = partial.partialCostUsd;
+                reviewSpendEstimatedByReviewer[index] = partial.partialCostEstimated === true;
             }
-            if (Object.keys(parseError).length > 0) {
-                writeParseError(artifact, parseError);
-                continue;
+            if (partial?.partialObservedModel) {
+                streamObservedModel = partial.partialObservedModel;
+                routeModel = partial.partialObservedModel;
+                routeSource = partial.partialObservedSource ?? "stream_event";
             }
-            if (reviewer.providerFamily !== "unknown")
-                healthyFamilies.add(reviewer.providerFamily);
-            healthyReviewerIndexes.add(index);
+            writeParseError(artifact, { error: reviewerError });
+        }
+        finally {
+            await cleanupReviewerWorkspace(reviewerWorkspace, artifact);
+        }
+        const proof = reviewerRouteProof(reviewer, routeModel ?? null, routeSource, reviewerFamilies.filter((_, i) => i !== index));
+        routeProofs[index] = proof;
+        const info = reviewerInfo(reviewer, proof.status, streamObservedModel ?? null);
+        const jsonBlocks = extractJsonBlocks(text);
+        writeJson(artifact.parsedPath, redactValue(jsonBlocks));
+        if (reviewerError && (text.trim() === "" || jsonBlocks.length === 0)) {
+            findingsByReviewer[index]?.push(insufficientEvidenceFinding(info, `Reviewer failed: ${reviewerError}`));
+            return;
+        }
+        if (text.trim() === "" || jsonBlocks.length === 0) {
+            writeParseError(artifact, { error: "no_parseable_json", text_sha256: sha256(text) });
+            findingsByReviewer[index]?.push(insufficientEvidenceFinding(info, "Reviewer produced no parseable JSON findings."));
+            return;
+        }
+        const parsed = parseFindingsDetailed(text, info);
+        const parseError = {};
+        let parsedFindingsRecorded = false;
+        const recordParsedFindings = () => {
+            if (parsedFindingsRecorded)
+                return;
             findingsByReviewer[index]?.push(...parsed.findings);
+            parsedFindingsRecorded = true;
+        };
+        if (parsed.malformed > 0) {
+            Object.assign(parseError, {
+                error: "malformed_findings",
+                malformed: parsed.malformed,
+                text_sha256: sha256(text),
+            });
+            recordParsedFindings();
+            findingsByReviewer[index]?.push(insufficientEvidenceFinding(info, `Reviewer produced ${parsed.malformed} malformed finding item(s).`));
+        }
+        if (reviewerError) {
+            Object.assign(parseError, {
+                error: reviewerError,
+                recovered_json_blocks: jsonBlocks.length,
+                text_sha256: sha256(text),
+            });
+            recordParsedFindings();
+            findingsByReviewer[index]?.push(insufficientEvidenceFinding(info, parsed.findings.length === 0
+                ? `Reviewer failed after parseable JSON with no findings: ${reviewerError}`
+                : `Reviewer failed after parseable JSON output: ${reviewerError}`));
         }
+        if (Object.keys(parseError).length > 0) {
+            writeParseError(artifact, parseError);
+            return;
+        }
+        healthyReviewerIndexes.add(index);
+        findingsByReviewer[index]?.push(...parsed.findings);
+    };
+    try {
+        const reviewerRuns = await Promise.allSettled(input.reviewers.map((reviewer, index) => runReviewer(reviewer, index)));
+        const failedRun = reviewerRuns.find((run) => run.status === "rejected");
+        if (failedRun)
+            throw failedRun.reason;
         const classifiedProofs = classifyDiversity(routeProofs);
         for (const [index, proof] of classifiedProofs.entries()) {
             const artifact = artifacts[index];
@@ -321,12 +315,12 @@ ${runtimePrompt}
                 });
             });
         });
-        const healthyProviders = [...healthyFamilies];
-        // Two-tier route proof: crossFamilyVerified — the strong tier that unblocks
-        // apply — requires the model to have been OBSERVED in the reviewer stream
-        // (status "verified"). An argv/metadata echo ("accepted_model_arg") is a weaker
-        // tier: it proves we PASSED a model arg, not that the CLI ran it, so it must
-        // NOT unblock apply on unobserved proof. same_model_fallback never counts.
+        const healthyProviders = [
+            ...new Set(input.reviewers
+                .filter((_, index) => healthyReviewerIndexes.has(index))
+                .map((reviewer) => reviewer.providerFamily)
+                .filter((family) => family !== "unknown")),
+        ];
         const observedFamilies = [
             ...new Set(classifiedProofs
                 .filter((p, index) => p.status === "verified" && healthyReviewerIndexes.has(index))
@@ -341,8 +335,8 @@ ${runtimePrompt}
             healthyProviders,
             crossFamilyVerified: observedFamilies.length >= 2,
             distinctProviders: observedFamilies,
-            reviewSpendUsd,
-            reviewSpendEstimated,
+            reviewSpendUsd: reviewSpendByReviewer.reduce((sum, spend) => sum + spend, 0),
+            reviewSpendEstimated: reviewSpendEstimatedByReviewer.some(Boolean),
         };
     }
     finally {
@@ -376,9 +370,6 @@ async function collectReviewerOutput(reviewer, spec, timeoutMs, transientRetryPo
     let firstEventTime = null;
     let observedModel;
     let observedSource = "unavailable";
-    // Reviewer spend tracked at function scope so a timed-out/failed reviewer still
-    // contributes its PARTIAL cost to the ledger (budget truth). It is attached to
-    // the thrown error so the caller can fold it in.
     let costUsd = 0;
     let costEstimated = false;
     let partialText = "";
@@ -506,13 +497,12 @@ async function collectReviewerOutput(reviewer, spec, timeoutMs, transientRetryPo
             text,
             observedModel: attemptObservedModel,
             observedSource: attemptObservedSource,
-            artifactDir: artifact.dir,
             costUsd,
             costEstimated,
         };
     };
     const consume = consumeOnce(0);
-    const removeExternalAbortListeners = [];
+    let removeExternalAbortListener = () => { };
     const cancelled = new Promise((_, reject) => {
         if (!signal)
             return;
@@ -534,7 +524,7 @@ async function collectReviewerOutput(reviewer, spec, timeoutMs, transientRetryPo
             queueMicrotask(onAbort);
         else
             signal.addEventListener("abort", onAbort, { once: true });
-        removeExternalAbortListeners.push(() => signal.removeEventListener("abort", onAbort));
+        removeExternalAbortListener = () => signal.removeEventListener("abort", onAbort);
     });
     const timed = new Promise((_, reject) => {
         timeout = setTimeout(() => {
@@ -610,9 +600,7 @@ async function collectReviewerOutput(reviewer, spec, timeoutMs, transientRetryPo
         settled = true;
         if (timeout)
             clearTimeout(timeout);
-        for (const removeExternalAbortListener of removeExternalAbortListeners) {
-            removeExternalAbortListener();
-        }
+        removeExternalAbortListener();
         consume.catch(() => {
             /* timeout path: consume may reject after the race already returned */
         });
@@ -665,11 +653,13 @@ async function prepareReviewerWorkspace(input) {
             const resolvedSourceEvidenceDir = realpathSync(sourceEvidenceDir);
             const evidenceExcludeRoots = excludeRoots.filter((root) => !isSameOrInside(root, sourceEvidenceDir));
             await rm(evidenceDir, { recursive: true, force: true });
-            await cp(sourceEvidenceDir, evidenceDir, {
-                recursive: true,
-                dereference: false,
-                filter: (sourcePath) => shouldCopyReviewerPath(sourceEvidenceDir, resolvedSourceEvidenceDir, sourcePath, evidenceExcludeRoots),
-            });
+            await cp(sourceEvidenceDir, evidenceDir, input.preserveEvidenceBytes
+                ? { recursive: true, dereference: false }
+                : {
+                    recursive: true,
+                    dereference: false,
+                    filter: (sourcePath) => shouldCopyReviewerPath(sourceEvidenceDir, resolvedSourceEvidenceDir, sourcePath, evidenceExcludeRoots),
+                });
         }
         await mkdir(evidenceDir, { recursive: true, mode: 0o700 });
         await initializeReviewerWorkspaceGit(root);
@@ -680,14 +670,20 @@ async function prepareReviewerWorkspace(input) {
         throw err;
     }
 }
-async function copyReviewEvidencePacket(sourceEvidenceDir, persistentEvidenceDir) {
+async function copyReviewEvidencePacket(sourceEvidenceDir, persistentEvidenceDir, preserveBytes = false) {
     const source = resolve(sourceEvidenceDir);
     const target = resolve(persistentEvidenceDir);
     await rm(target, { recursive: true, force: true });
-    await mkdir(target, { recursive: true, mode: 0o700 });
     if (!existsSync(source)) {
+        await mkdir(target, { recursive: true, mode: 0o700 });
         return;
     }
+    if (preserveBytes) {
+        await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+        await cp(source, target, { recursive: true, dereference: false });
+        return;
+    }
+    await mkdir(target, { recursive: true, mode: 0o700 });
     const resolvedSource = realpathSync(source);
     for (const entry of await readdir(source, { withFileTypes: true })) {
         const sourcePath = join(source, entry.name);
@@ -725,13 +721,7 @@ async function copyReviewEvidenceEntry(sourceEvidenceDir, resolvedSourceEvidence
     await cp(sourcePath, targetPath, { recursive: false, dereference: false });
 }
 function shouldTextSanitizeEvidenceFile(path) {
-    const lower = path.toLowerCase();
-    return (lower.endsWith(".md") ||
-        lower.endsWith(".txt") ||
-        lower.endsWith(".json") ||
-        lower.endsWith(".yaml") ||
-        lower.endsWith(".yml") ||
-        lower.endsWith(".patch"));
+    return TEXT_EVIDENCE_SUFFIXES.some((extension) => path.toLowerCase().endsWith(extension));
 }
 function shouldFailClosedEvidenceFile(path) {
     return path.toLowerCase().endsWith(".patch");
@@ -742,9 +732,7 @@ function shouldCopyEvidencePacketPath(sourceEvidenceDir, resolvedSourceEvidenceD
         return false;
     if (isSameOrInside(targetEvidenceDir, resolvedSourcePath))
         return false;
-    return shouldCopyReviewerPath(sourceEvidenceDir, resolvedSourceEvidenceDir, resolvedSourcePath, [
-        targetEvidenceDir,
-    ]);
+    return shouldCopyReviewerPath(sourceEvidenceDir, resolvedSourceEvidenceDir, resolvedSourcePath, [targetEvidenceDir], new Set(), false);
 }
 async function cleanupReviewerWorkspace(workspace, artifact) {
     try {
@@ -777,7 +765,7 @@ async function cleanupTemporaryReviewerWorkspaceBaseDir(workspaceBaseDir, artifa
         }
     }
 }
-function shouldCopyReviewerPath(sourceRoot, resolvedSourceRoot, sourcePath, excludeRoots, preservePaths = new Set()) {
+function shouldCopyReviewerPath(sourceRoot, resolvedSourceRoot, sourcePath, excludeRoots, preservePaths = new Set(), enforceContentPolicy = true) {
     const resolvedSourcePath = resolve(sourcePath);
     if (!isCopyableReviewerSymlink(sourceRoot, resolvedSourceRoot, resolvedSourcePath, excludeRoots)) {
         return false;
@@ -788,55 +776,35 @@ function shouldCopyReviewerPath(sourceRoot, resolvedSourceRoot, sourcePath, excl
     if (!rel)
         return true;
     const parts = rel.split(/[\\/]+/);
-    if (parts.some(isReviewerSecretLikePathPart)) {
+    if (sensitiveResourcePolicy.classifyPath(rel).sensitive) {
         return false;
     }
     if (parts[0] === ".claudexor") {
-        return isCopyableReviewerClaudexorPath(rel, parts, preservePaths);
+        return (isCopyableReviewerClaudexorPath(rel, parts, preservePaths) &&
+            (!enforceContentPolicy || reviewerFileContentAllowed(resolvedSourcePath)));
     }
-    if (parts.some((part) => [
-        ".git",
-        ".adversarial-review",
-        ".turbo",
-        "node_modules",
-    ].includes(part))) {
+    if (parts.some((part) => [".git", ".adversarial-review", ".turbo", "node_modules"].includes(part))) {
         return false;
     }
     if (parts.some((part) => [".next", ".cache", "coverage", "dist"].includes(part)) &&
         !isPreservedReviewerPath(rel, preservePaths)) {
         return false;
     }
-    return !rel.endsWith(".tsbuildinfo");
+    return (!rel.endsWith(".tsbuildinfo") &&
+        (!enforceContentPolicy || reviewerFileContentAllowed(resolvedSourcePath)));
 }
-function isReviewerSecretLikePathPart(part) {
-    const lower = part.toLowerCase();
-    if (lower.startsWith(".env") && !isSafeEnvTemplateName(lower))
-        return true;
-    if ([
-        ".npmrc",
-        ".netrc",
-        ".pypirc",
-        ".git-credentials",
-        ".ssh",
-        ".aws",
-        ".azure",
-        ".gcloud",
-        ".cursor",
-        ".codex",
-        ".claude",
-        ".anthropic",
-        ".openai",
-    ].includes(lower)) {
-        return true;
+function reviewerFileContentAllowed(path) {
+    let targetStat;
+    try {
+        targetStat = statSync(path);
     }
-    if (/^id_(rsa|dsa|ecdsa|ed25519)$/.test(lower))
-        return true;
-    if (lower.endsWith(".pem") || lower.endsWith(".p12") || lower.endsWith(".pfx"))
+    catch {
+        return false;
+    }
+    if (!targetStat.isFile())
         return true;
-    return false;
-}
-function isSafeEnvTemplateName(lower) {
-    return [".env.example", ".env.sample", ".env.template"].includes(lower);
+    const content = readTextSafe(path);
+    return content !== null && !sensitiveResourcePolicy.containsSensitiveContent(content);
 }
 function isCopyableReviewerClaudexorPath(rel, parts, preservePaths) {
     if (parts.length === 1) {
@@ -846,22 +814,8 @@ function isCopyableReviewerClaudexorPath(rel, parts, preservePaths) {
         return true;
     }
     const runtimeRoot = parts[1]?.toLowerCase();
-    if (runtimeRoot &&
-        [
-            "auth",
-            "cache",
-            "daemon",
-            "home",
-            "homes",
-            "logs",
-            "runs",
-            "secrets",
-            "state",
-            "tmp",
-            "workspaces",
-        ].includes(runtimeRoot)) {
+    if (runtimeRoot && BLOCKED_REVIEWER_RUNTIME_ROOTS.has(runtimeRoot))
         return false;
-    }
     return isPreservedReviewerPath(rel, preservePaths);
 }
 function isPreservedReviewerPath(rel, preservePaths) {
@@ -877,15 +831,10 @@ function isPreservedReviewerPath(rel, preservePaths) {
     }
     return false;
 }
-/** Test-only alias for the preserve-set extractor. */
 export function __testExtractDiffTouchedPaths(diff) {
     return extractDiffTouchedPaths(diff);
 }
 function extractDiffTouchedPaths(diff) {
-    // One structural parser owns diff headers (INV-050): parseUnifiedDiff is
-    // quote-aware and decodes git's C-quoted paths (incl. octal escapes for
-    // non-ASCII), which the old private tokenizer mis-decoded — a mis-decoded
-    // touched path silently dropped the file from the reviewer preserve set.
     const paths = new Set();
     for (const file of parseUnifiedDiff(diff).files) {
         if (file.oldPath)
@@ -921,57 +870,40 @@ function isCopyableReviewerSymlink(sourceRoot, resolvedSourceRoot, sourcePath, e
         return true;
     let linkTarget = "";
     let resolvedTarget = "";
+    let targetKind = "other";
     try {
         linkTarget = readlinkSync(sourcePath);
         resolvedTarget = realpathSync(sourcePath);
+        const targetStat = statSync(sourcePath);
+        targetKind = targetStat.isDirectory() ? "directory" : targetStat.isFile() ? "file" : "other";
     }
     catch {
         return false;
     }
-    if (isAbsolute(linkTarget))
-        return false;
-    if (!isSameOrInside(resolvedSourceRoot, resolvedTarget))
-        return false;
-    if (excludeRoots.some((root) => isSameOrInside(root, resolvedTarget)))
-        return false;
-    const sourceParentRel = relative(sourceRoot, dirname(sourcePath));
-    if (sourceParentRel.split(/[\\/]+/)[0] === ".." || isAbsolute(sourceParentRel))
-        return false;
-    const relocatedTargetRel = normalize(join(sourceParentRel, linkTarget));
-    const relocatedFirstPart = relocatedTargetRel.split(/[\\/]+/)[0];
-    if (relocatedFirstPart === ".." || isAbsolute(relocatedTargetRel))
-        return false;
-    const relocatedTargetPath = resolve(sourceRoot, relocatedTargetRel);
-    if (!isSameOrInside(sourceRoot, relocatedTargetPath))
-        return false;
-    return !excludeRoots.some((root) => isSameOrInside(root, relocatedTargetPath));
+    return sensitiveResourcePolicy.assessSymlink({
+        sourceRoot,
+        canonicalSourceRoot: resolvedSourceRoot,
+        sourcePath,
+        linkTarget,
+        resolvedTargetPath: resolvedTarget,
+        targetKind,
+        allowedTargetKinds: ["file", "directory"],
+        excludedRoots: excludeRoots,
+        relocationRoot: sourceRoot,
+    }).allowed;
 }
 async function initializeReviewerWorkspaceGit(root) {
-    await runGitOrThrow("init", root, [
-        "-c",
-        "init.templateDir=",
-        "-c",
-        "core.hooksPath=/dev/null",
-        "init",
-    ]);
-    await runGitOrThrow("config user.email", root, [
-        "-c",
-        "core.hooksPath=/dev/null",
-        "config",
-        "user.email",
-        "claudexor-review@example.invalid",
-    ]);
-    await runGitOrThrow("config user.name", root, [
-        "-c",
-        "core.hooksPath=/dev/null",
-        "config",
-        "user.name",
-        "Claudexor Review",
-    ]);
-    await runGitOrThrow("add", root, ["-c", "core.hooksPath=/dev/null", "add", "-A", "--force"]);
+    const noHooks = ["-c", "core.hooksPath=/dev/null"];
+    await runGitOrThrow("init", root, ["-c", "init.templateDir=", ...noHooks, "init"]);
+    for (const [key, value] of [
+        ["user.email", "claudexor-review@example.invalid"],
+        ["user.name", "Claudexor Review"],
+    ]) {
+        await runGitOrThrow(`config ${key}`, root, [...noHooks, "config", key, value]);
+    }
+    await runGitOrThrow("add", root, [...noHooks, "add", "-A", "--force"]);
     await runGitOrThrow("commit", root, [
-        "-c",
-        "core.hooksPath=/dev/null",
+        ...noHooks,
         "commit",
         "--allow-empty",
         "--no-verify",
@@ -1034,6 +966,9 @@ function emitReviewerProgress(artifact, reviewer, onReviewerEvent, patch) {
         requested_model: reviewer.requestedModel ?? null,
         requested_effort: reviewer.requestedEffort ?? null,
         artifact_dir: artifact.dir,
+        ...(typeof artifact.metadata["review_wave_id"] === "string"
+            ? { review_wave_id: artifact.metadata["review_wave_id"] }
+            : {}),
         ...patch,
     };
     const redacted = redactValue(event);