@codedology/code-forge 0.7.7 → 0.9.0

package/src/install/wizard/answers.mjs

@@ -58,8 +58,9 @@ export function linkDirsFromManifests(cwd) {
 
 /**
  * The proof profile is decided from the project, not from the gate detector's stack name alone:
- * `detectGates` (B5) names only `php-pest`, so a Laravel app on PHPUnit reaches here as `node`
- * (its Vite `package.json`) or `unknown` — `composer.json` + `artisan` is Laravel either way.
+ * `detectGates` names a Laravel app `php-pest` or `php-phpunit` only once its runner is installed
+ * (`vendor/bin/…`); before that it reaches here as `node` (its Vite `package.json`) or `unknown` —
+ * `composer.json` + `artisan` is Laravel either way.
  * @param {string} stack - `detectGates().stack`
  * @param {string} cwd
  * @returns {string} the proof profile: `laravel`, `php`, `node`, `python`, `rust`, `go` or `unknown`.
@@ -274,6 +275,11 @@ function gateArgv(gate) {
   return null;
 }
 
+/**
+ * A gate as the config holds it: an argv, `{argv, env}` (B60, kept from an existing config), or none.
+ * @typedef {string[] | {argv: string[], env?: Record<string, string>} | null} GateValue
+ */
+
 /**
  * @typedef {object} Answers
  * @property {'current'|'recommended'} tools
@@ -289,9 +295,13 @@ function gateArgv(gate) {
  * @property {{mode: 'auto'} | {mode: 'ref', ref: string} | {mode: 'none'}} jev
  * @property {string} engine
  * @property {number|null} solo_project
- * @property {{test: string[]|null, lint: string[]|null, types: string[]|null, format: string[]|null}} gates
+ * @property {{test: GateValue, lint: GateValue, types: GateValue, format: GateValue}} gates
  * @property {{high: string[], isolation: string, link_dirs: string[], copy_untracked: string[]}} proof
  * @property {boolean} doctor
+ * @property {boolean} coder_may_push - `autonomy.coder_may_push` (B65; default false).
+ * @property {boolean} coder_may_open_draft_pr - `autonomy.coder_may_open_draft_pr` (B65; default
+ *   false). `resolveAnswers` sets it false whenever `coder_may_push` is false, except for an
+ *   explicit `--coder-may-open-draft-pr yes`, which `runInit` refuses (exit 2): a draft PR needs a push.
  */
 
 /**
@@ -300,10 +310,15 @@ function gateArgv(gate) {
  * @typedef {{gates: Record<string, 'flag'|'existing'|'detected'>, proof: Record<string, 'flag'|'existing'|'detected'|'default'>}} Origins
  */
 
-/** The answer keys in step order. */
+/**
+ * The answer keys in the order they are settled: `askAnswers` asks the two autonomy keys last of
+ * its questions (after `solo_project`); gates and proof come later, in the settings step, and
+ * `doctor` is never asked (only `--skip-doctor` sets it).
+ */
 export const ANSWER_KEYS = Object.freeze([
   'tools', 'yes_tools', 'harnesses', 'scope', 'method', 'provider', 'levels', 'refresh_models',
-  'multimodel', 'second_provider', 'jev', 'engine', 'solo_project', 'gates', 'proof', 'doctor',
+  'multimodel', 'second_provider', 'jev', 'engine', 'solo_project', 'coder_may_push',
+  'coder_may_open_draft_pr', 'gates', 'proof', 'doctor',
 ]);
 
 /**
@@ -382,6 +397,20 @@ export function resolveAnswers(ctx, existing, user, given) {
   set('solo_project', user?.solo?.project_id, () => null);
   if (lastFlag('solo_project')) override('solo_project', lastFlag('solo_project').value);
 
+  // B65: push and draft-PR autonomy default to no; a re-run proposes the existing booleans.
+  const exAutonomy = ex.autonomy && typeof ex.autonomy === 'object' ? ex.autonomy : {};
+  /** @param {unknown} b @returns {boolean|undefined} */
+  const bool = (b) => (typeof b === 'boolean' ? b : undefined);
+  set('coder_may_push', bool(exAutonomy.coder_may_push), () => false);
+  const pushFlag = lastFlag('coder_may_push');
+  if (pushFlag) override('coder_may_push', pushFlag.value);
+  set('coder_may_open_draft_pr', bool(exAutonomy.coder_may_open_draft_pr), () => false);
+  const draftFlag = lastFlag('coder_may_open_draft_pr');
+  if (draftFlag) override('coder_may_open_draft_pr', draftFlag.value);
+  // A draft PR needs a push: with push no, a kept draft-PR yes follows to no. Only an explicit
+  // `--coder-may-open-draft-pr yes` stays true here — `runInit` refuses that combination.
+  if (!v.coder_may_push && sources.coder_may_open_draft_pr !== 'flag') v.coder_may_open_draft_pr = false;
+
   // Gates and proof are never asked (B24): each value comes from a flag, else the existing
   // config, else the project. `origins` records which, per gate and per proof key. A gate the
   // existing config left blank is filled when the project now shows one; a set gate is kept.

package/src/install/wizard/flags.mjs

@@ -6,7 +6,8 @@
  * **Q16 = cut (Ricardo, 2026-09-25):** step 8 asks no mutation-tool or nightly question, so the
  * v1.2 `--no-nightly` flag is gone and `--proof` takes only the keys the schema still has
  * (`isolation`, `high`, `link_dirs`, `copy_untracked`). With `-g` and `-p` counted as two flags
- * (two tokens that each set the scope answer) there are 19 answer flags.
+ * (two tokens that each set the scope answer) there are 21 answer flags: B65 added
+ * `--coder-may-push` and `--coder-may-open-draft-pr` (`yes`/`no`, default no).
  *
  * Parsing is strict: an unknown flag, a missing value, a repeated single-value flag or a bad value
  * is a usage error. Error messages name the flag, never the value given (a user can paste a key
@@ -46,6 +47,8 @@ export const ANSWER_FLAGS = Object.freeze({
   '--gate': 'gates',
   '--proof': 'proof',
   '--skip-doctor': 'doctor',
+  '--coder-may-push': 'coder_may_push',
+  '--coder-may-open-draft-pr': 'coder_may_open_draft_pr',
 });
 
 const BOOLEAN_FLAGS = new Set(['-g', '-p', '--copy', '--refresh-models', '--no-jev', '--skip-doctor', '--no-interaction']);
@@ -190,6 +193,10 @@ function convert(flag, value) {
       if (argv.length === 0) throw new UsageError('--gate: empty command');
       return { name, argv };
     }
+    case '--coder-may-push':
+    case '--coder-may-open-draft-pr':
+      if (value !== 'yes' && value !== 'no') throw new UsageError(`${flag} must be yes or no`);
+      return value === 'yes';
     case '--proof': {
       const [key, raw] = keyValue('--proof', value);
       if (!PROOF_KEYS.includes(key)) throw new UsageError(`--proof: key must be one of ${PROOF_KEYS.join(', ')}`);

package/src/install/wizard/project-file.mjs

@@ -55,6 +55,8 @@ export function generatedConfig(a, ctx, jevRef) {
     isolation: a.proof.isolation,
     export: { link_dirs: [...a.proof.link_dirs], copy_untracked: [...a.proof.copy_untracked] },
   };
+  // B65: always both keys, also when both are false, so the file states the choice
+  cfg.autonomy = { coder_may_push: a.coder_may_push === true, coder_may_open_draft_pr: a.coder_may_push === true && a.coder_may_open_draft_pr === true };
   return cfg;
 }
 

package/src/install/wizard/run.mjs

@@ -59,6 +59,7 @@ export const USAGE = [
   '  [--harness a,b] [-g|-p] [--copy] [--provider P] [--level Ln=model[:effort][@provider]]…',
   '  [--refresh-models] [--multimodel on|off] [--second-provider P]',
   '  [--jev-ref <item-id|link|op://…> | --jev-env NAME | --no-jev] [--engine auto|solo|harness] [--solo-project N]',
+  '  [--coder-may-push yes|no] [--coder-may-open-draft-pr yes|no]',
   '  [--gate name=cmd]… [--proof isolation=export|lock | high=a,b | link_dirs=a,b | copy_untracked=a,b]… [--skip-doctor]',
 ].join('\n');
 
@@ -230,6 +231,11 @@ export async function runInit(args, deps = {}) {
       ui = deps.ui ?? /** @type {any} */ (await import('@clack/prompts'));
       await askAnswers(values, sources, ctx, ui);
     }
+    // B65: a draft PR needs a push. `resolveAnswers` and `askAnswers` turn a kept draft-PR yes to
+    // no when push is no, so a yes left here came from the flag: refused.
+    if (values.coder_may_open_draft_pr && !values.coder_may_push) {
+      throw new InitFailure(2, '--coder-may-open-draft-pr yes needs autonomy.coder_may_push yes — a draft PR needs a push; pass --coder-may-push yes or drop the flag. Nothing written.');
+    }
 
     // Gates and proof are never asked (B24): the summary says what was found and what is blank.
     // A person sees it now, before anything is written; agent mode gets it in the JSON line.

package/src/install/wizard/steps.mjs

@@ -62,6 +62,8 @@ export const HINTS = Object.freeze({
   judge: 'The judge settles disagreements between the two reviewers.',
   engine: 'auto uses Solo when present, otherwise the subagents of the current harness.',
   solo_project: 'The Solo project that coder processes run in; leave blank for none.',
+  coder_may_push: 'No: the coder hands back its branch and you (or the orchestrator) push it.',
+  coder_may_open_draft_pr: 'Only after an independent review passes; marking it ready and merging stay with you.',
   jev: 'Jev is the small fast classifier behind System 1; skip uses rules only.',
   env: 'That variable must hold the key whenever code-forge runs.',
   paste: 'The key goes to the OS key store; the config keeps only a reference.',
@@ -69,6 +71,10 @@ export const HINTS = Object.freeze({
   apply: 'Only the listed keys change; your other edits stay.',
 });
 
+/** B65: the two autonomy questions, asked last among the answers (default no). */
+export const PUSH_QUESTION = 'May a coder push its block branch on its own?';
+export const DRAFT_PR_QUESTION = 'May a coder open a draft PR on its own?';
+
 /** The one-line hints of the "Customize now" questions, in the order they are asked (B24). */
 export const SETTING_HINTS = Object.freeze({
   test: 'the command that runs your tests; the block cannot close if it fails (blank = no test gate)',
@@ -205,6 +211,16 @@ export async function askAnswers(values, sources, ctx, ui) {
     const typed = await answer(ui, ui.text({ message: withHint('Solo project id (blank: none)', HINTS.solo_project), initialValue: values.solo_project === null ? '' : String(values.solo_project) }));
     values.solo_project = /^[1-9]\d{0,9}$/.test(String(typed).trim()) ? Number(String(typed).trim()) : null;
   }
+  // B65: push first; a draft PR needs a push, so with push no the draft-PR question is not asked
+  // and its answer is no (a `--coder-may-open-draft-pr yes` flag is then refused by `runInit`).
+  if (open('coder_may_push')) {
+    values.coder_may_push = (await answer(ui, ui.confirm({ message: withHint(PUSH_QUESTION, HINTS.coder_may_push), initialValue: values.coder_may_push === true }))) === true;
+  }
+  if (values.coder_may_push && open('coder_may_open_draft_pr')) {
+    values.coder_may_open_draft_pr = (await answer(ui, ui.confirm({ message: withHint(DRAFT_PR_QUESTION, HINTS.coder_may_open_draft_pr), initialValue: values.coder_may_open_draft_pr === true }))) === true;
+  } else if (open('coder_may_open_draft_pr')) {
+    values.coder_may_open_draft_pr = false;
+  }
   return values;
 }
 
@@ -240,16 +256,20 @@ export async function askProjectSettings(values, origins, ui) {
   const changed = [];
   for (const name of GATE_NAMES) {
     if (origins.gates[name] === 'flag') continue;
-    const gates = /** @type {Record<string, string[]|null>} */ (values.gates);
+    const gates = /** @type {Record<string, import('./answers.mjs').GateValue>} */ (values.gates);
     const current = gates[name];
+    // B60: a gate kept as {argv, env} is edited by its argv; its env is kept (and never shown).
+    const currentArgv = /** @type {string[] | null} */ (Array.isArray(current) || !current ? current : current.argv);
     const typed = await answer(ui, ui.text({
       message: withHint(`Gate ${name} (blank or "none": no gate)`, SETTING_HINTS[/** @type {keyof typeof SETTING_HINTS} */ (name)]),
-      initialValue: current ? current.join(' ') : '',
+      initialValue: currentArgv ? currentArgv.join(' ') : '',
     }));
     const text = String(typed ?? '').trim();
+    // blank or "none" turns the gate off: a gate kept as {argv, env} then loses its env too
     const next = text === '' || text === 'none' ? null : shellWords(text);
-    if (JSON.stringify(next) !== JSON.stringify(current)) changed.push(`gates.${name}`);
-    gates[name] = next;
+    if (JSON.stringify(next) === JSON.stringify(currentArgv)) continue;
+    changed.push(`gates.${name}`);
+    gates[name] = next && current && !Array.isArray(current) ? { ...current, argv: next } : next;
   }
   const proof = values.proof;
   /** @param {'high'|'link_dirs'|'copy_untracked'} key @param {string} message @param {string} path */

package/src/install/wizard/summary.mjs

@@ -46,7 +46,10 @@ const STACK_MARKER = Object.freeze({ rust: 'Cargo.toml', python: 'pyproject.toml
 
 /**
  * @typedef {object} Setting
- * @property {unknown} value - what is written to the config.
+ * @property {unknown} value - the value shown (a gate: its argv). The config file is written from
+ *   `values.gates`, not from here, so a `{argv, env}` gate keeps its env.
+ * @property {string[]} [env_keys] - B60: a gate given as `{argv, env}` with a non-empty env: the
+ *   variable NAMES, sorted (never the values).
  * @property {'flag'|'existing'|'detected'|'default'} source
  * @property {string} note - where it came from, or why it is blank, in the summary's words.
  */
@@ -115,7 +118,12 @@ export function summarizeSettings(values, origins, ctx) {
 
   for (const name of GATE_NAMES) {
     const key = SETTING_KEYS[/** @type {keyof typeof SETTING_KEYS} */ (name)];
-    const argv = values.gates[/** @type {keyof typeof values.gates} */ (name)];
+    const command = values.gates[/** @type {keyof typeof values.gates} */ (name)];
+    // B60: a gate given as {argv, env} is summarised by its argv and its env NAMES, never the values;
+    // an empty env counts as none
+    const envKeys = command && !Array.isArray(command) && command.env && Object.keys(command.env).length > 0 ? Object.keys(command.env).sort() : null;
+    const envNote = envKeys ? ` (env: ${envKeys.join(', ')})` : '';
+    const argv = /** @type {string[] | null} */ (Array.isArray(command) || !command ? command : command.argv);
     const source = origins.gates[name] ?? 'detected';
     let note;
     if (argv === null || argv === undefined || argv.length === 0) {
@@ -123,12 +131,12 @@ export function summarizeSettings(values, origins, ctx) {
       else if (source === 'existing') note = 'empty in .code-forge.yml';
       else note = GATE_MISSING[/** @type {keyof typeof GATE_MISSING} */ (name)];
       blank.push(key);
-      lines.push(`  ${name}: blank — ${note}`);
+      lines.push(`  ${name}: blank${envNote} — ${note}`);
     } else {
       note = source === 'detected' ? gateEvidence(ctx.detected.stack, name, argv, ctx.cwd) : keptFrom(source, '--gate');
-      lines.push(`  ${name}: ${shown(argv)} (from ${note})`);
+      lines.push(`  ${name}: ${shown(argv)}${envNote} (from ${note})`);
     }
-    settings[key] = { value: argv, source, note };
+    settings[key] = { value: argv, source, note, ...(envKeys ? { env_keys: envKeys } : {}) };
   }
 
   const found = new Map(linkDirsFromManifests(ctx.cwd).map((e) => [e.dir, e.manifests]));

package/src/ledger/export.mjs

@@ -1,5 +1,5 @@
 /**
- * `report --export <dir>` — writes one JSON file per report section (plan §6.2: "13 sections").
+ * `report --export <dir>` — writes one JSON file per report section (plan §6.2; 14 sections since B66).
  */
 
 import { mkdir, writeFile } from 'node:fs/promises';

package/src/ledger/outside-review.mjs

@@ -0,0 +1,164 @@
+/**
+ * B66 (issue #13 item 8): outside review rounds per PR, next to what code-forge spent on the PR's
+ * blocks. Pure helpers, no I/O:
+ *
+ *  - `parseOutsideReviewArgs` reads `ledger outside-review --run <r> --pr <n> --rounds <n>
+ *    --findings <n> [--link <url>] [--block <id>]…` (the verb in `src/cli/ledger.mjs` does the
+ *    run lookup, the block check, the redaction and the signed write);
+ *  - `buildOutsideReview` builds the `outside_review` report section from the ledger rows and the
+ *    `cost_per_block` entries (`src/ledger/report.mjs` passes them in, so the PR cost is computed
+ *    by the SAME function the `cost_per_block` section uses);
+ *  - `outsideReviewLines` renders the section as terminal text.
+ *
+ * Row: `outside_review {run, pr, rounds, findings, link (or null), blocks: [ids]}`. A later row for
+ * the same PR replaces the earlier one in every reader (the latest row in ledger order wins); the
+ * ledger itself stays append-only.
+ */
+
+import { roundUsd } from './spend.mjs';
+
+export const OUTSIDE_REVIEW_EVENT = 'outside_review';
+
+export const OUTSIDE_REVIEW_USAGE =
+  'usage: code-forge ledger outside-review --run <r> --pr <n> --rounds <n> --findings <n> [--link <url>] [--block <id>]...';
+
+const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const POSITIVE_INT = /^[1-9]\d*$/;
+const NON_NEGATIVE_INT = /^(0|[1-9]\d*)$/;
+const LINK = /^https?:\/\/\S+$/;
+const MAX_LINK_CHARS = 2048;
+
+/** @param {unknown} n @returns {boolean} */
+const isCount = (n) => Number.isSafeInteger(n) && /** @type {number} */ (n) >= 0;
+
+const SINGLE_FLAGS = new Set(['--run', '--pr', '--rounds', '--findings', '--link']);
+
+/**
+ * @typedef {{run: string, pr: number, rounds: number, findings: number, link: string | null, blocks: string[]}} OutsideReviewArgs
+ */
+
+/**
+ * @param {string} raw @param {RegExp} shape @returns {number | null}
+ */
+function parseShapedInt(raw, shape) {
+  if (!shape.test(raw)) return null;
+  const n = Number(raw);
+  return Number.isSafeInteger(n) ? n : null;
+}
+
+/**
+ * Parse the verb's flags (everything after `outside-review`). Every flag but `--block` is given at
+ * most once; `--block` may repeat (duplicates collapsed, first-seen order kept). Any other token,
+ * a flag with no value, a missing required flag or a value of the wrong shape is a usage error.
+ * The link is returned as given — the caller redacts it once the run key is registered.
+ * @param {string[]} args
+ * @returns {{ok: true, value: OutsideReviewArgs} | {ok: false, message: string}}
+ */
+export function parseOutsideReviewArgs(args) {
+  /** @type {Record<string, string>} */
+  const single = {};
+  /** @type {string[]} */
+  const blocks = [];
+  for (let i = 0; i < args.length; i += 2) {
+    const flag = args[i];
+    const value = args[i + 1];
+    // the position only, never the token: a stray value (a loose URL) may carry a secret
+    if (flag !== '--block' && !SINGLE_FLAGS.has(flag)) return { ok: false, message: `unknown argument at position ${i + 1}` };
+    if (value === undefined || value.startsWith('--')) return { ok: false, message: `${flag} requires a value` };
+    if (flag === '--block') {
+      if (!blocks.includes(value)) blocks.push(value);
+      continue;
+    }
+    if (Object.hasOwn(single, flag)) return { ok: false, message: `${flag} is given more than once` };
+    single[flag] = value;
+  }
+  for (const flag of ['--run', '--pr', '--rounds', '--findings']) {
+    if (!Object.hasOwn(single, flag)) return { ok: false, message: `${flag} is required` };
+  }
+  const run = single['--run'];
+  if (!RUN_ID.test(run)) return { ok: false, message: '--run must be a run id (letters, digits, ".", "_", "-")' };
+  const pr = parseShapedInt(single['--pr'], POSITIVE_INT);
+  if (pr === null) return { ok: false, message: '--pr must be a positive integer' };
+  const rounds = parseShapedInt(single['--rounds'], NON_NEGATIVE_INT);
+  if (rounds === null) return { ok: false, message: '--rounds must be a non-negative integer' };
+  const findings = parseShapedInt(single['--findings'], NON_NEGATIVE_INT);
+  if (findings === null) return { ok: false, message: '--findings must be a non-negative integer' };
+  let link = null;
+  if (Object.hasOwn(single, '--link')) {
+    link = single['--link'];
+    if (link.length > MAX_LINK_CHARS) return { ok: false, message: `--link is longer than ${MAX_LINK_CHARS} characters` };
+    if (!LINK.test(link)) return { ok: false, message: '--link must be an https:// or http:// URL with no whitespace' };
+  }
+  return { ok: true, value: { run, pr, rounds, findings, link, blocks } };
+}
+
+/** @param {string[]} blocks @returns {string} */
+const blockList = (blocks) => (blocks.length > 0 ? blocks.join(', ') : '-');
+
+/**
+ * The verb's one stdout line.
+ * @param {{pr: number, rounds: number, findings: number, blocks: string[]}} row @returns {string}
+ */
+export function outsideReviewRecordedLine({ pr, rounds, findings, blocks }) {
+  return `outside_review pr ${pr} · rounds ${rounds} · findings ${findings} · blocks ${blockList(blocks)}\n`;
+}
+
+/**
+ * @typedef {{pr: number, rounds: number, findings: number, link: string | null, blocks: string[], code_forge_usd: number, unknown_usd_sessions: number}} OutsideReviewEntry
+ */
+
+/**
+ * The `outside_review` report section: one entry per PR (the latest `outside_review` row for it,
+ * by ledger order), sorted by PR number ascending. `code_forge_usd` sums `totalUsd` of the
+ * `cost_per_block` entries of the row's run whose block the row names; `unknown_usd_sessions` sums
+ * their `unknownUsdSessions` (those sessions count 0 in the dollars). `[]` with no rows.
+ * @param {Array<Record<string, any>>} rows - shadow rows already removed.
+ * @param {Array<{run: string | null, block: string, totalUsd: number, unknownUsdSessions: number}>} costEntries - the `cost_per_block` section.
+ * @returns {OutsideReviewEntry[]}
+ */
+export function buildOutsideReview(rows, costEntries) {
+  /** @type {Map<number, Record<string, any>>} */
+  const latest = new Map();
+  for (const row of rows) {
+    if (row.event !== OUTSIDE_REVIEW_EVENT || !Number.isSafeInteger(row.pr) || row.pr <= 0) continue;
+    // a row whose counts are not 0-or-more safe integers is skipped (the verb never writes one)
+    if (!isCount(row.rounds) || !isCount(row.findings)) continue;
+    latest.set(row.pr, row);
+  }
+  return [...latest.values()]
+    .sort((a, b) => a.pr - b.pr)
+    .map((row) => {
+      const blocks = Array.isArray(row.blocks) ? row.blocks.filter((b) => typeof b === 'string') : [];
+      const run = typeof row.run === 'string' ? row.run : null;
+      // a row with no string run matches no cost entry (never the null-run entries): 0 and 0 unknown
+      const mine = run === null ? [] : costEntries.filter((e) => e.run === run && blocks.includes(e.block));
+      const usd = mine.reduce((sum, e) => sum + e.totalUsd, 0);
+      return {
+        pr: row.pr,
+        rounds: row.rounds,
+        findings: row.findings,
+        link: typeof row.link === 'string' ? row.link : null,
+        blocks,
+        // rounded as `cost_per_block` rounds its dollars (4 decimals)
+        code_forge_usd: roundUsd(usd),
+        unknown_usd_sessions: mine.reduce((sum, e) => sum + e.unknownUsdSessions, 0),
+      };
+    });
+}
+
+/** @param {number} n @param {string} word @returns {string} */
+const plural = (n, word) => `${n} ${word}${n === 1 ? '' : 's'}`;
+
+/**
+ * Terminal text of the section: `outside review: none` with no entry, else one line per PR.
+ * @param {OutsideReviewEntry[]} section @returns {string}
+ */
+export function outsideReviewLines(section) {
+  if (section.length === 0) return 'outside review: none\n';
+  return section
+    .map((e) => {
+      const unknown = e.unknown_usd_sessions > 0 ? ` (+${e.unknown_usd_sessions} unknown)` : '';
+      return `PR #${e.pr} · ${plural(e.rounds, 'outside round')} · ${plural(e.findings, 'finding')} · code-forge $${e.code_forge_usd.toFixed(2)}${unknown} · ${blockList(e.blocks)}\n`;
+    })
+    .join('');
+}

package/src/ledger/report.mjs

@@ -1,5 +1,5 @@
 /**
- * `code-forge report` (plan §6.2, R4): builds the 13 report sections from a run's ledger rows.
+ * `code-forge report` (plan §6.2, R4): builds the 14 report sections from a run's ledger rows.
  * Pure data, no I/O — terminal rendering + `--export` live in `src/cli/report.mjs`.
  *
  * Shadow rows (`row.source === 'shadow'`) are excluded everywhere here (plan §6.3: shadow-sampled
@@ -13,9 +13,14 @@
  * `session.background` rows, whose price is unknown); its dollars come from `./spend.mjs`
  * (`usd`, else `cost_usd`, else ESTIMATED from its tokens × `./prices.mjs`); `review.done` {block,file,context_mode,findings_by_severity,round}; `decision`
  * {block,question,source}; `run.start` {run}; `run.mode` {run,mode,plan} (B59, `buildRunModes`); `outcome` {block,missed_after_degrade}; `escalation` {block,trigger};
- * `review.unavailable` {block,reason}; `proof` {block,duration_ms}; `run.stop` {reason}.
+ * `review.unavailable` {block,reason}; `proof` {block,duration_ms}; `run.stop` {reason};
+ * `outside_review` {run,pr,rounds,findings,link,blocks} (B66, `./outside-review.mjs`).
+ *
+ * Signatures are not verified here: like every other section, `outside_review` reads the rows as
+ * the ledger holds them (an unsigned or tampered row is counted, not dropped).
  */
 
+import { buildOutsideReview } from './outside-review.mjs';
 import { isSpendRow, rowUsd, spendByRun, sumSpend } from './spend.mjs';
 
 const ROLE_BUCKET = Object.freeze({
@@ -51,7 +56,7 @@ export function sessionCostUsd(row) {
 
 /**
  * B33: spend per run (running totals, open blocks included) and over the whole ledger — kept
- * beside the 13 sections, not as a 14th (`SECTION_NAMES` stays pinned at 13).
+ * beside the sections, never one of them (text only, not in `SECTION_NAMES`).
  * @param {Array<Record<string, any>>} rows
  * @returns {{runs: Array<{run: string | null, usd: number, unknown: number, sessions: number}>, total: {usd: number, unknown: number, sessions: number}}}
  */
@@ -257,7 +262,8 @@ const runStopCounts = (rows) => ({
   noEngineStops: rows.filter((r) => r.event === 'run.stop' && r.reason === 'no_engine').length,
 });
 
-/** The exact, ordered set of section keys `buildReport` produces (plan §6.2: "13 sections") —
+/** The exact, ordered set of section keys `buildReport` produces (plan §6.2; B66 appended the
+ * 14th, `outside_review` — append new sections, never reorder) —
  * exported so tests (and `--export`) can assert against ONE source of truth instead of a copy. */
 export const SECTION_NAMES = Object.freeze([
   'cost_per_block',
@@ -273,6 +279,7 @@ export const SECTION_NAMES = Object.freeze([
   'forecast_vs_actual_lines',
   'blocks_stopped_at_l3',
   'run_stop_counts',
+  'outside_review',
 ]);
 
 /**
@@ -281,8 +288,10 @@ export const SECTION_NAMES = Object.freeze([
  */
 export function buildReport(rows) {
   const acted = rows.filter((r) => r.source !== 'shadow');
+  // computed once: `cost_per_block` and `outside_review` share the same entries
+  const costs = costPerBlock(acted);
   const builders = {
-    cost_per_block: costPerBlock,
+    cost_per_block: () => costs,
     lane_distribution: laneDistribution,
     escalations: escalationsPerBlock,
     s1_calls_per_block: s1CallsPerBlock,
@@ -295,6 +304,9 @@ export function buildReport(rows) {
     forecast_vs_actual_lines: forecastVsActualLines,
     blocks_stopped_at_l3: blocksStoppedAtL3,
     run_stop_counts: runStopCounts,
+    // B66: per PR, the outside review rounds next to the cost of its blocks — the SAME
+    // `costPerBlock` entries the `cost_per_block` section shows
+    outside_review: (/** @type {any[]} */ r) => buildOutsideReview(r, costs),
   };
   /** @type {Record<string, any>} */
   const sections = {};

package/src/ledger/write.mjs

@@ -53,9 +53,14 @@ function normalizeRow(row) {
 /**
  * Claim `<base>.<n>.jsonl` for `n = 1, 2, ...` atomically via `link()` (hardlink the still-full
  * file under the rotated name, then unlink the original) instead of `rename()`.
+ *
+ * `hooks.afterLink` is a test seam only: when given, it is awaited with the claimed candidate path
+ * right after a successful `link()` and before this call's `unlink()` of the source, so a test can
+ * force another racer's unlink into exactly that window. Production callers pass nothing.
  * @param {string} file @param {string} dir @param {string} base
+ * @param {{ afterLink?: (candidate: string) => Promise<void> | void }} [hooks]
  */
-export async function claimRotatedName(file, dir, base) {
+export async function claimRotatedName(file, dir, base, hooks = {}) {
   let n = 1;
   for (;;) {
     const candidate = path.join(dir, `${base}.${n}.jsonl`);
@@ -70,6 +75,7 @@ export async function claimRotatedName(file, dir, base) {
       if (err.code === 'ENOENT') return; // `file` vanished before we could link it — a racer already rotated it out
       throw err;
     }
+    if (hooks.afterLink) await hooks.afterLink(candidate);
     try {
       await unlink(file);
       return;