@ddtcorex/dsh-maestro-review 0.3.2 → 0.5.0

package/lib/orchestrator.js

@@ -1,4 +1,4 @@
-import { mkdir, writeFile } from 'node:fs/promises';
+import { mkdir, writeFile, symlink, stat, lstat } from 'node:fs/promises';
 import { execFile } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { promisify } from 'node:util';
@@ -31,6 +31,9 @@ import { reviewDigestText } from './notify.js';
 import { loadedReviewProfile } from './skills-tool.js';
 import { gitlabProvider } from './providers/gitlab.js';
 import './events.js';
+import { gitlabAuthHeaders } from './gitlab-auth.js';
+import { reviewMarker, resolveFlow } from './review-marker.js';
+import { cloneSourceRepo, defaultRun } from './ci-clone.js';
 // Provider-aware wrapper — orchestrator can run reviews via any ReviewProvider.
 // This keeps the GitLab-specific flow intact while allowing Phase C to add GitHub/Jira without modifying core logic.
 export async function runReviewWithProvider(provider, request) {
@@ -45,6 +48,47 @@ export async function runReviewWithProvider(provider, request) {
 export { gitlabProvider };
 const execFileAsync = promisify(execFile);
 const GIT_TIMEOUT_MS = 60_000;
+/**
+ * Finding severity, assigned by the reviewer. Display order is fixed
+ * (blocking first) wherever counts are rendered.
+ */
+export const SEVERITY_ORDER = ['blocking', 'major', 'minor', 'nit'];
+const SEVERITY_LABEL = {
+    blocking: '🔴 Blocking',
+    major: '🟡 Major',
+    minor: '🔵 Minor',
+    nit: '⚪ Nit',
+};
+/** Missing or unknown severities degrade to `minor` — never drop a finding. */
+export function normalizeFindingSeverity(severity) {
+    return severity === 'blocking' || severity === 'major' || severity === 'minor' || severity === 'nit'
+        ? severity
+        : 'minor';
+}
+export function severityPrefix(severity) {
+    return SEVERITY_LABEL[normalizeFindingSeverity(severity)];
+}
+/** Count findings per severity; zero counts are omitted. */
+export function countFindingSeverities(findings) {
+    const counts = {};
+    for (const finding of findings) {
+        const level = normalizeFindingSeverity(finding.severity);
+        counts[level] = (counts[level] ?? 0) + 1;
+    }
+    return counts;
+}
+/**
+ * Reviewer scope prompt. Static analysis is mandatory: reviewers skipped
+ * govard_audit_lint for whole rounds (no lint signal at all), so the prompt
+ * requires at least one call before report_review_findings. Pure for testing.
+ */
+export function buildReviewerScopePrompt(opts) {
+    const lintRule = 'LINT RULE: you MUST call govard_audit_lint at least once (scope "diff"; the MR base default is already wired, no base arg needed) before report_review_findings. A review with no lint call is incomplete.';
+    if (opts.scopeKind === 'discussion') {
+        return `${opts.profileInstruction}Review only the requested inline discussion ${opts.discussionId} at ${opts.path}:${opts.line}. Do not review unrelated files or start a broad audit. Call gitlab_get_mr_diff, then gitlab_get_file_diff for the file under review, then call report_review_findings exactly once when done. ${lintRule}`;
+    }
+    return `${opts.profileInstruction}Review this merge request (${opts.mode} mode). Call gitlab_list_own_review_threads and gitlab_get_mr_diff first, then gitlab_get_file_diff per file you inspect (inline results never spill), then call report_review_findings exactly once when done. ${lintRule} DEDUP RULE: when a finding matches the substance of an existing own thread (same file and same underlying issue, even if worded differently — including resolved threads, whose reply reopens them), report it as {status: "reply", discussionId} instead of posting a new thread. Use status "new" only for issues with no matching thread.`;
+}
 /**
  * Build a user-friendly GitLab Markdown comment for a completed review.
  * Shared design language with `reviewDigestText` (Telegram HTML) — same
@@ -75,6 +119,13 @@ export function buildReviewComment(opts) {
                 parts.push(`💬 ${opts.findings.newCount} new`);
             if (opts.findings.replyCount > 0)
                 parts.push(`🔁 ${opts.findings.replyCount} updated`);
+            if (opts.findings.severityCounts !== undefined) {
+                for (const level of SEVERITY_ORDER) {
+                    const count = opts.findings.severityCounts[level] ?? 0;
+                    if (count > 0)
+                        parts.push(`${SEVERITY_LABEL[level].split(' ')[0]} ${count} ${level}`);
+                }
+            }
             if (parts.length === 0)
                 parts.push('no inline findings');
             return `\n\n**Findings:** ${parts.join(' · ')}`;
@@ -84,7 +135,8 @@ export function buildReviewComment(opts) {
         ? `\n\n<details>\n<summary>⚠️ Failed to post (${opts.failures.length})</summary>\n\n${opts.failures.map((f) => `- \`${f}\``).join('\n')}\n\n</details>`
         : '';
     const footer = `\n\n---\n\n<sub>Generated by Maestro · [View MR →](${mrUrl})</sub>`;
-    return `${title}\n\n${metaLine}\n\n${scopeNote}${opts.summary}${findingsLine}${failuresBlock}${footer}`;
+    const markerLine = opts.marker === undefined ? '' : `\n\n${reviewMarker(opts.marker.sha, opts.marker.flow)}`;
+    return `${title}\n\n${metaLine}\n\n${scopeNote}${opts.summary}${findingsLine}${failuresBlock}${footer}${markerLine}`;
 }
 export function buildNotStartedComment(opts) {
     const mrUrl = `${opts.gitlabBaseUrl.replace(/\/$/, '')}/${opts.projectPath}/-/merge_requests/${opts.mrIid}`;
@@ -99,6 +151,7 @@ export function buildNotStartedComment(opts) {
         `---`,
         '',
         `<sub>Generated by Maestro · [View MR →](${mrUrl})</sub>`,
+        ...(opts.marker === undefined ? [] : [``, `${reviewMarker(opts.marker.sha, opts.marker.flow)}`]),
     ].join('\n');
 }
 export const name = 'maestro-orchestrator';
@@ -151,10 +204,12 @@ export function getTurnErrorMessage(handle) {
 }
 /**
  * Resolve the model to use for an automated review. Priority: per-project
- * override > global reviewModel > DSH default (`fallback`).
+ * override > global reviewModel (Maestro Settings) > row-config reviewModel
+ * (lets a headless profile such as reviewer-ci pin a model from env vars,
+ * where there is no Settings UI) > DSH default (`fallback`).
  */
-export function resolveReviewModel(userConfig, mapping, fallback) {
-    const raw = mapping?.reviewModel ?? userConfig.reviewModel;
+export function resolveReviewModel(userConfig, mapping, fallback, rowSelection) {
+    const raw = mapping?.reviewModel ?? userConfig.reviewModel ?? rowSelection;
     if (raw === undefined || raw === null)
         return fallback;
     return {
@@ -163,6 +218,13 @@ export function resolveReviewModel(userConfig, mapping, fallback) {
         ...(raw.reasoningEffort === undefined ? {} : { reasoningEffort: ReasoningEffortId(raw.reasoningEffort) }),
     };
 }
+/** Effective auto-trigger flags: per-project row overrides global, unset inherits (design §4). */
+export function resolveReviewTriggers(userConfig, mapping) {
+    return {
+        onPush: mapping?.rereviewOnPush ?? userConfig.autoRereviewOnPush ?? false,
+        onAssign: mapping?.reviewOnAssign ?? userConfig.autoReviewOnAssign ?? true,
+    };
+}
 /** Compose a newly-created agent from the preset service owned by the root context. */
 export async function mountAgentPreset(agentPresets, agentCtx, id) {
     await agentPresets.mount(agentCtx, id);
@@ -273,14 +335,16 @@ function normalizedDiffPath(path) {
 export async function postReviewFindings(findings, config) {
     const fetcher = config.fetcher ?? fetch;
     const apiBase = `${config.baseUrl}/api/v4/projects/${config.projectId}/merge_requests/${config.mrIid}`;
-    const headers = { 'PRIVATE-TOKEN': config.token, 'Content-Type': 'application/json' };
+    const headers = { ...gitlabAuthHeaders(config.token), 'Content-Type': 'application/json' };
     for (const finding of findings) {
         let response;
+        const label = severityPrefix(finding.severity);
+        const body = finding.body.startsWith(label) ? finding.body : `${label}\n\n${finding.body}`;
         if (finding.status === 'reply') {
             if (finding.discussionId === undefined)
                 throw new Error('reply finding missing discussionId');
             response = await fetcher(`${apiBase}/discussions/${encodeURIComponent(finding.discussionId)}/notes`, {
-                method: 'POST', headers, body: JSON.stringify({ body: finding.body }),
+                method: 'POST', headers, body: JSON.stringify({ body }),
             });
         }
         else {
@@ -301,13 +365,13 @@ export async function postReviewFindings(findings, config) {
                 // Line not in diff — fallback to MR note so finding is not silently lost.
                 response = await fetcher(`${apiBase}/notes`, {
                     method: 'POST', headers,
-                    body: JSON.stringify({ body: `**Inline fallback — \`${finding.path}:${finding.line}\` line is not in current MR diff**\n\n${finding.body}` }),
+                    body: JSON.stringify({ body: `**Inline fallback — \`${finding.path}:${finding.line}\` line is not in current MR diff**\n\n${body}` }),
                 });
             }
             else {
                 response = await fetcher(`${apiBase}/discussions`, {
                     method: 'POST', headers,
-                    body: JSON.stringify({ body: finding.body, position: {
+                    body: JSON.stringify({ body, position: {
                             position_type: 'text', ...snapshot.diffRefs, old_path: change.old_path, new_path: change.new_path,
                             ...linePosition.oldLine === undefined ? {} : { old_line: linePosition.oldLine },
                             ...linePosition.newLine === undefined ? {} : { new_line: linePosition.newLine },
@@ -356,7 +420,84 @@ function assertSafeId(value, label) {
         throw new Error(`refusing to operate on unsafe ${label}: ${JSON.stringify(value)}`);
     }
 }
+/**
+ * Read an agent session's transcript for the auditor's final output across
+ * host/session API skew: hosts built from the harness checkout expose
+ * `ownEvents()`/`snapshotEvents()` with no `.events` getter, while older
+ * packaged `@deepseek-ai/dsh-session` builds expose only the `.events`
+ * getter. `ownEvents()` (child-owned suffix, no fork prefix) matches
+ * `finalAssistantOutput`'s documented input best, so it wins when present.
+ * Returns `[]` — never throws — when no event source exists.
+ */
+export function auditorOutputFromSession(session) {
+    const candidate = session;
+    let events;
+    if (typeof candidate?.ownEvents === 'function') {
+        events = candidate.ownEvents();
+    }
+    else if (typeof candidate?.snapshotEvents === 'function') {
+        events = candidate.snapshotEvents();
+    }
+    else {
+        events = candidate?.events;
+    }
+    if (!Array.isArray(events))
+        return [];
+    return finalAssistantOutput(events) ?? [];
+}
 /** Full review + performance audit; resolves to the comment body that was posted. */
+/** Marker for CI-posted comments; webhook payloads carry no headSha and stay marker-free. */
+function commentMarker(payload) {
+    if (payload.headSha === undefined)
+        return undefined;
+    return { sha: payload.headSha, flow: resolveFlow(payload.mode) };
+}
+/** CI-deep decision: deep mode + CI env + head SHA (spec §3). Mapping is checked by the caller. */
+export function shouldCiDeepReview(payload) {
+    return payload.mode === 'deep'
+        && payload.headSha !== undefined
+        && process.env.SOURCE_PROJECT_ID !== undefined
+        && process.env.MR_IID !== undefined;
+}
+/** CI quick-with-profile decision: quick mode + non-generic profile + CI env
+ *  + head SHA. Quick + generic/unset stays diff-only (no clone cost); a real
+ *  profile opts into the clone branch reviewer-only (no auditor — quick never
+ *  audits, see shouldAudit in runReviewAndAudit). Mapping is checked by the caller. */
+export function shouldCiQuickProfileReview(payload) {
+    return payload.mode === 'quick'
+        && payload.reviewProfile !== undefined
+        && payload.reviewProfile !== 'generic'
+        && payload.headSha !== undefined
+        && process.env.SOURCE_PROJECT_ID !== undefined
+        && process.env.MR_IID !== undefined;
+}
+/** Auditor degrade for CI (no runtime env): a govard throw becomes reviewer-only, never a failed review. */
+export function withAuditorDegrade(runAuditor) {
+    return async (worktreePath, payload) => {
+        try {
+            return await runAuditor(worktreePath, payload);
+        }
+        catch {
+            return 'Auditor skipped — no runtime environment in CI (reviewer-only review).';
+        }
+    };
+}
+/**
+ * Auditor instruction. The mapped flow keeps the full environment + test-suite
+ * workflow; the CI flow has no runtime, so the prompt countermands the
+ * auditor preset's environment steps and drops the Environment & Test Suite
+ * section entirely instead of reporting it "blocked".
+ */
+export function buildAuditorPrompt(opts) {
+    if (!opts.staticOnly) {
+        return 'Audit this merge request\'s performance: bring up the environment, run the test suite, look for regressions, then write a Markdown report and tear the environment down.';
+    }
+    return 'Audit this merge request\'s performance from the static diff and checked-out code only. '
+        + 'No runtime environment exists in this container: ignore the auditor preset\'s environment steps '
+        + '(do not bring anything up, do not run the test suite, do not tear anything down). '
+        + 'Look for regressions by static analysis (diff, dependencies, query/shape risks), then write a Markdown report '
+        + 'and OMIT the Environment & Test Suite section entirely — never report it as blocked.';
+}
 export async function runReviewAndAudit(payload, deps) {
     assertSafeId(payload.projectId, 'projectId');
     assertSafeId(payload.mrIid, 'mrIid');
@@ -375,7 +516,7 @@ export async function runReviewAndAudit(payload, deps) {
             ]);
             const labels = ['Reviewer', 'Auditor'];
             if (settled[0].status === 'fulfilled') {
-                const { summary, failures } = settled[0].value;
+                const { summary, failures, severityCounts } = settled[0].value;
                 // Try to parse findings counts from summary like "2 new inline comment(s), 1 thread(s) updated."
                 const summaryText = summary ?? '';
                 const newMatch = /(\d+)\s+new inline/.exec(summaryText);
@@ -392,7 +533,8 @@ export async function runReviewAndAudit(payload, deps) {
                         profile: deps.reviewProfile,
                         summary: summaryText,
                         failures,
-                        findings: { newCount, replyCount },
+                        findings: { newCount, replyCount, severityCounts },
+                        marker: commentMarker(payload),
                     })
                     : `## 🤖 Maestro Review\n\n**\`${payload.projectPath}\` !${payload.mrIid}** · ✅ Completed · \`${payload.mode}\`${deps.reviewProfile !== undefined ? ` · \`${deps.reviewProfile}\`` : ''}\n\n${summaryText}${failures.length > 0 ? `\n\n<details>\n<summary>⚠️ Failed to post (${failures.length})</summary>\n\n${failures.map((f) => `- \`${f}\``).join('\n')}\n\n</details>` : ''}`;
                 sections.push(richOpts);
@@ -414,7 +556,8 @@ export async function runReviewAndAudit(payload, deps) {
                 else
                     await deps.postComment(body);
             }
-            catch {
+            catch (err) {
+                console.error(`maestro-orchestrator: posting review comment failed: ${err instanceof Error ? err.message : String(err)}`);
                 await deps.writeFailedReport(payload.mrIid, body);
             }
             return body;
@@ -451,6 +594,7 @@ export async function runDiffOnlyReview(payload, deps) {
                 summary: summary ?? '',
                 failures,
                 isDiffOnly: true,
+                marker: commentMarker(payload),
             })
             : `## 🤖 Maestro Review — Diff-only\n\n> **Scope:** Diff-only — reviewed the GitLab diff without a local checkout, Magento environment, static analysis, or tests. For a full review, add this project in Settings → Maestro and mention again.\n\n${summary}${failures.length > 0 ? `\n\n<details>\n<summary>⚠️ Failed to post (${failures.length})</summary>\n\n${failures.map((f) => `- \`${f}\``).join('\n')}\n\n</details>` : ''}`;
         const body = diffBody;
@@ -460,7 +604,8 @@ export async function runDiffOnlyReview(payload, deps) {
             else
                 await deps.postComment(body);
         }
-        catch {
+        catch (err) {
+            console.error(`maestro-orchestrator: posting review comment failed: ${err instanceof Error ? err.message : String(err)}`);
             await deps.writeFailedReport(payload.mrIid, body);
         }
         return body;
@@ -480,7 +625,7 @@ export async function declineUnmappedDeepReview(payload, deps) {
     const depsWithUrl = deps;
     const baseUrl = depsWithUrl.gitlabBaseUrl;
     const body = baseUrl !== undefined
-        ? buildNotStartedComment({ gitlabBaseUrl: baseUrl, projectPath: payload.projectPath, mrIid: payload.mrIid })
+        ? buildNotStartedComment({ gitlabBaseUrl: baseUrl, projectPath: payload.projectPath, mrIid: payload.mrIid, marker: commentMarker(payload) })
         : '## 🤖 Maestro Review — Not started\n\n**`' + payload.projectPath + '` !' + payload.mrIid + '** · ⏸️ Not started\n\n> Deep review requires a project mapping with a local checkout and Magento environment.\n> Add this project in **Settings → Maestro**, then mention the reviewer again.';
     try {
         try {
@@ -489,7 +634,8 @@ export async function declineUnmappedDeepReview(payload, deps) {
             else
                 await deps.postComment(body);
         }
-        catch {
+        catch (err) {
+            console.error(`maestro-orchestrator: posting review comment failed: ${err instanceof Error ? err.message : String(err)}`);
             await deps.writeFailedReport(payload.mrIid, body);
         }
     }
@@ -540,7 +686,26 @@ export function isBranchNotFoundError(err) {
  */
 export function govardWorktreeOverride(projectId, mrIid, keySuffix) {
     const name = `maestro-mr-${projectId}-${mrIid}${keySuffix === undefined ? '' : `-${keySuffix}`}`;
-    return `project_name: ${name}\ndomain: ${name}.test\n`;
+    // Xdebug stays off in review envs: the auditor runs no coverage, and an
+    // enabled Xdebug trips govard's lint perf-tax guard (exit 1, 0 findings).
+    return `project_name: ${name}\ndomain: ${name}.test\nstack:\n  features:\n    xdebug: false\n`;
+}
+/**
+ * Fetch the MR's diff base SHA for govard diff-scope runs. Best-effort:
+ * returns undefined (the lint tool then fail-fasts with guidance) rather
+ * than failing the review when GitLab is unreachable.
+ */
+export async function fetchMrBaseSha(baseUrl, token, projectId, mrIid, fetcher = fetch) {
+    try {
+        const response = await fetcher(`${baseUrl}/api/v4/projects/${projectId}/merge_requests/${mrIid}`, { headers: gitlabAuthHeaders(token) });
+        if (!response.ok)
+            return undefined;
+        const mr = await response.json();
+        return mr.diff_refs?.base_sha;
+    }
+    catch {
+        return undefined;
+    }
 }
 export async function ensureWorktree(localRepoPath, sourceBranch, projectId, mrIid, keySuffix) {
     assertSafeBranchName(sourceBranch);
@@ -564,8 +729,138 @@ export async function ensureWorktree(localRepoPath, sourceBranch, projectId, mrI
         .catch(() => { });
     await execFileAsync('git', ['worktree', 'add', '--', worktreePath, `origin/${sourceBranch}`], { cwd: localRepoPath, timeout: GIT_TIMEOUT_MS });
     await writeFile(join(worktreePath, '.govard.local.yml'), govardWorktreeOverride(projectId, mrIid, keySuffix), 'utf-8');
+    await linkVendorIntoWorktree(localRepoPath, worktreePath);
+    await writeContainerVendorOverride(localRepoPath, worktreePath);
     return worktreePath;
 }
+/**
+ * A vendor dir only counts as installed dependencies when the composer
+ * autoloader is a real file. Magento tracks `vendor/.htaccess`, so every
+ * worktree has a vendor/ stub — that stub must not pass for real deps, and
+ * must not block the container bind that provides them.
+ */
+export async function vendorHasAutoload(dir) {
+    try {
+        return (await stat(join(dir, 'vendor', 'autoload.php'))).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Share the primary checkout's `vendor/` (and `app/etc/env.php` when the
+ * auditor needs a database) into the review worktree via symlinks, so
+ * phpunit/static analysis run against real dependencies instead of falling
+ * back to static-only. Links point INTO the worktree only — the primary
+ * checkout is never written to — and `git worktree remove --force` deletes
+ * the links along with the worktree. Missing sources, or targets that
+ * already exist (e.g. Magento's tracked `vendor/.htaccess` stub), are
+ * skipped quietly: the review still runs, the auditor discloses it.
+ */
+export async function linkVendorIntoWorktree(localRepoPath, worktreePath) {
+    const linked = [];
+    const candidates = [
+        { source: join(localRepoPath, 'vendor'), target: join(worktreePath, 'vendor'), dir: true, needsAutoload: true },
+        { source: join(localRepoPath, 'app', 'etc', 'env.php'), target: join(worktreePath, 'app', 'etc', 'env.php'), dir: false, needsAutoload: false },
+    ];
+    let advertised = false;
+    for (const { source, target, dir, needsAutoload } of candidates) {
+        let isDir = false;
+        try {
+            isDir = (await stat(source)).isDirectory();
+            if (dir !== isDir)
+                continue;
+        }
+        catch {
+            continue;
+        }
+        if (needsAutoload && !(await vendorHasAutoload(localRepoPath)))
+            continue;
+        if ((await lstat(target).catch(() => undefined)) !== undefined) {
+            console.error(`maestro-orchestrator: link target exists, skipping ${target}`);
+            continue;
+        }
+        try {
+            if (!advertised) {
+                const sha = await execFileAsync('git', ['rev-parse', 'HEAD'], { cwd: localRepoPath, timeout: GIT_TIMEOUT_MS })
+                    .then(({ stdout }) => stdout.trim()).catch(() => 'unknown');
+                console.error(`maestro-orchestrator: linking vendor from ${localRepoPath} @ ${sha} into ${worktreePath}`);
+                advertised = true;
+            }
+            if (!dir)
+                await mkdir(join(worktreePath, 'app', 'etc'), { recursive: true });
+            await symlink(source, target, dir ? 'dir' : 'file');
+            linked.push(target);
+        }
+        catch (err) {
+            console.error(`maestro-orchestrator: failed to link ${source} into worktree:`, err);
+        }
+    }
+    if (!advertised) {
+        console.error(`maestro-orchestrator: no vendor/ in ${localRepoPath} — worktree ${worktreePath} runs without shared dependencies`);
+    }
+    return linked;
+}
+/** Container path of the project root inside govard services. */
+const GOVARD_CONTAINER_WORKDIR = '/var/www/html';
+/**
+ * Render a compose override that bind-mounts the primary checkout's vendor/
+ * read-only into the php service. A host-side symlink alone dangles inside
+ * containers (absolute host path), so container tools (phpunit) need this
+ * bind to see real dependencies.
+ *
+ * The project mount (`.`) MUST be repeated first: govard merges overrides
+ * with MergeMap, which REPLACES lists instead of appending — an override
+ * carrying only the vendor bind would wipe `.:<workdir>` and leave the
+ * container docroot holding nothing but vendor/. Relative `.` resolves
+ * against the project root because govard passes --project-directory.
+ *
+ * Only the always-present `php` service is targeted: `php-debug` drops out
+ * of the rendered base when xdebug is off, and a volumes-only override
+ * entry would recreate it as a hollow service that fails compose validation.
+ */
+export function buildVendorOverrideYaml(vendorHostPath, envHostPath, containerWorkDir = GOVARD_CONTAINER_WORKDIR) {
+    const volumes = [
+        `.:${containerWorkDir}`,
+        `${vendorHostPath}:${containerWorkDir}/vendor:ro`,
+        ...(envHostPath !== undefined ? [`${envHostPath}:${containerWorkDir}/app/etc/env.php:ro`] : []),
+    ];
+    const service = `    volumes:\n${volumes.map((v) => `      - ${v}\n`).join('')}`;
+    return `services:\n  php:\n${service}`;
+}
+/**
+ * Drop the vendor bind override into the worktree (merged by govard via
+ * `.govard/docker-compose.override.yml`). Binds only when the primary
+ * checkout carries installed deps and the worktree does not — never shadow
+ * real deps with a possibly stale bind. Returns the written path, or
+ * undefined when skipped.
+ */
+export async function writeContainerVendorOverride(localRepoPath, worktreePath) {
+    const vendorHostPath = join(localRepoPath, 'vendor');
+    if (!(await vendorHasAutoload(localRepoPath)))
+        return undefined;
+    // Our own host-side symlink still needs the bind (it dangles in-container);
+    // only a real installed worktree vendor makes the bind redundant.
+    const wtLink = await lstat(join(worktreePath, 'vendor')).catch(() => undefined);
+    if (wtLink?.isSymbolicLink() !== true && await vendorHasAutoload(worktreePath))
+        return undefined;
+    const overridePath = join(worktreePath, '.govard', 'docker-compose.override.yml');
+    await mkdir(join(worktreePath, '.govard'), { recursive: true });
+    // A linked env.php dangles in-container like the vendor symlink did — bind
+    // the real file over it when the primary checkout carries one.
+    const envHostPath = join(localRepoPath, 'app', 'etc', 'env.php');
+    let envBind;
+    try {
+        if ((await stat(envHostPath)).isFile())
+            envBind = envHostPath;
+    }
+    catch {
+        envBind = undefined;
+    }
+    await writeFile(overridePath, buildVendorOverrideYaml(vendorHostPath, envBind), 'utf-8');
+    console.error(`maestro-orchestrator: container vendor bind ${vendorHostPath} -> ${GOVARD_CONTAINER_WORKDIR}/vendor (ro) for ${worktreePath}`);
+    return overridePath;
+}
 async function removeWorktree(worktreePath) {
     // Best-effort cleanup by design (a failure here must not block or fail the review that
     // already ran) — but a swallowed failure with zero visibility leaves an orphaned worktree
@@ -585,6 +880,9 @@ export function apply(ctx, config) {
     // effect without a plugin restart.
     let effectiveAgentTimeoutMs = config.agentTimeoutMs;
     async function runReviewer(worktreePath, payload, effective, reviewProfile, modelSelection, incrementalBlock) {
+        // MR base SHA feeds govard diff-scope runs; undefined degrades to the
+        // tool's fail-fast guidance instead of a wasted govard invocation.
+        const lintDefaultBase = await fetchMrBaseSha(effective.gitlabBaseUrl, effective.gitlabToken, payload.projectId, payload.mrIid);
         const primaryOptions = agentOptionsForModel(modelSelection ?? ctx.agentDefaultModel.currentSelection());
         const fallbackOptions = { provider: primaryOptions.provider, model: primaryOptions.model };
         let lastHandle;
@@ -619,7 +917,7 @@ export function apply(ctx, config) {
                             await agentCtx.plugin(ModuleCheckTool, { rootPath: worktreePath });
                             await agentCtx.plugin(PhtmlEscapeScanTool, { rootPath: worktreePath });
                             await agentCtx.plugin(ScopeSplitTool, { rootPath: worktreePath });
-                            await agentCtx.plugin(GovardAuditLintTool, { rootPath: worktreePath });
+                            await agentCtx.plugin(GovardAuditLintTool, { rootPath: worktreePath, defaultBase: lintDefaultBase, allowXdebug: true });
                             await agentCtx.plugin(PerfLogStatsTool, { rootPath: worktreePath });
                         }
                     },
@@ -636,8 +934,8 @@ export function apply(ctx, config) {
                     ? 'This is a diff-only review with no local checkout or Magento environment. Do not claim that tests, static analysis, or Magento runtime validation ran. '
                     : `Call maestro_load_review_profile with {"profile":"${reviewProfile}"} before examining code. `;
                 let scopePrompt = payload.scope.kind === 'discussion'
-                    ? `${profileInstruction}Review only the requested inline discussion ${payload.scope.discussionId} at ${payload.scope.path}:${payload.scope.line}. Do not review unrelated files or start a broad audit. Call gitlab_get_mr_diff, then call report_review_findings exactly once when done.`
-                    : `${profileInstruction}Review this merge request (${payload.mode} mode). Call gitlab_list_own_review_threads and gitlab_get_mr_diff first, then call report_review_findings exactly once when done.`;
+                    ? buildReviewerScopePrompt({ scopeKind: 'discussion', discussionId: payload.scope.discussionId, path: payload.scope.path, line: payload.scope.line, profileInstruction })
+                    : buildReviewerScopePrompt({ scopeKind: 'full', mode: payload.mode, profileInstruction });
                 if (incrementalBlock !== undefined)
                     scopePrompt = `${incrementalBlock}\n\n${scopePrompt}`;
                 handle.agent.followup(createUserMessage({
@@ -680,7 +978,7 @@ export function apply(ctx, config) {
                         failures.push(`${locator}: ${err instanceof Error ? err.message : String(err)}`);
                     }
                 }
-                return { summary: `${postedNew} new inline comment(s), ${postedReplies} thread(s) updated.`, failures };
+                return { summary: `${postedNew} new inline comment(s), ${postedReplies} thread(s) updated.`, failures, severityCounts: countFindingSeverities(capturedFindings) };
             }
             finally {
                 await handle.dispose();
@@ -715,7 +1013,7 @@ export function apply(ctx, config) {
             throw err;
         }
     }
-    async function runAuditor(worktreePath, payload, effective, modelSelection) {
+    async function runAuditor(worktreePath, payload, effective, modelSelection, opts) {
         let handle;
         const agentOptions = agentOptionsForModel(modelSelection ?? ctx.agentDefaultModel.currentSelection());
         try {
@@ -743,10 +1041,10 @@ export function apply(ctx, config) {
         }
         ctx.sessionTitle.rename(handle.agent.session, `Maestro Auditor — MR !${payload.mrIid} (${payload.projectPath})`);
         try {
-            const prompt = 'Audit this merge request\'s performance: bring up the environment, run the test suite, look for regressions, then write a Markdown report and tear the environment down.';
+            const prompt = buildAuditorPrompt({ staticOnly: opts?.staticOnly === true });
             handle.agent.followup(createUserMessage({ content: [{ type: 'text', text: prompt }], source: { kind: 'user' } }));
             await whenIdleWithTimeout(handle, effectiveAgentTimeoutMs);
-            const output = finalAssistantOutput(handle.agent.session.events) ?? [];
+            const output = auditorOutputFromSession(handle.agent.session);
             const text = output.map(block => ('text' in block ? block.text : '')).join('');
             return `## Maestro Performance Audit\n\n${text}`;
         }
@@ -754,8 +1052,9 @@ export function apply(ctx, config) {
             await handle.dispose();
         }
     }
-    ctx.on('maestro/review-request', (payload) => {
-        void (async () => {
+    async function runReview(payload) {
+        const t0 = Date.now();
+        try {
             const userConfig = await loadUserConfig();
             const effective = {
                 gitlabBaseUrl: userConfig.gitlabBaseUrl ?? config.gitlabBaseUrl,
@@ -773,18 +1072,37 @@ export function apply(ctx, config) {
                 });
             }
             const mapping = effective.projectMappings.find(m => m.projectPath === payload.projectPath);
+            // CI-deep (spec §3): unmapped deep review with CI env + head SHA skips
+            // both the decline and the diff-only fallback and runs the clone branch
+            // below, which shares the mapped path's completion tail.
+            const ciDeep = mapping === undefined && payload.mode === 'deep' && shouldCiDeepReview(payload);
+            // CI quick-with-profile: unmapped quick + non-generic profile + CI env
+            // skips the diff-only fallback and joins the clone branch below, which
+            // runs reviewer-only (quick never audits).
+            const ciQuickProfile = mapping === undefined && shouldCiQuickProfileReview(payload);
             // Unmapped reviewer assignments remain no-ops. Only an explicit mention
             // may opt into the intentionally limited, diff-only fallback below.
-            if (mapping === undefined && payload.trigger !== 'mention')
-                return;
+            if (mapping === undefined && payload.trigger !== 'mention') {
+                return { ok: true, failures: [], durationMs: Date.now() - t0 };
+            }
+            const triggers = resolveReviewTriggers(userConfig, mapping);
+            // Gated-off auto-triggers stay fully silent: no history, no signals, no comment.
+            if (payload.trigger === 'reviewer-assignment' && !triggers.onAssign) {
+                return { ok: true, failures: [], durationMs: Date.now() - t0 };
+            }
+            if (payload.trigger === 'push' && !triggers.onPush) {
+                return { ok: true, failures: [], durationMs: Date.now() - t0 };
+            }
             // A push only re-reviews an MR that already has a completed review;
             // otherwise every newly opened MR would be reviewed twice.
-            if (payload.trigger === 'push' && !(await hasCompletedReview(payload.projectId, payload.mrIid)))
-                return;
+            if (payload.trigger === 'push' && !(await hasCompletedReview(payload.projectId, payload.mrIid))) {
+                return { ok: true, failures: [], durationMs: Date.now() - t0 };
+            }
             const { gitlabToken } = effective;
             if (gitlabToken === undefined) {
-                console.error(`maestro-orchestrator: MR !${String(payload.mrIid)} for project ${payload.projectPath} has no GitLab token — set one in Maestro Settings or MAESTRO_GITLAB_TOKEN`);
-                return;
+                const message = `MR !${String(payload.mrIid)} for project ${payload.projectPath} has no GitLab token — set one in Maestro Settings or MAESTRO_GITLAB_TOKEN`;
+                console.error(`maestro-orchestrator: ${message}`);
+                return { ok: false, failures: [message], durationMs: Date.now() - t0 };
             }
             const resolved = { ...effective, gitlabToken };
             const historyId = `${payload.projectId}-${payload.mrIid}-${Date.now()}`;
@@ -816,7 +1134,7 @@ export function apply(ctx, config) {
             const fallbackSelection = ctx.get?.('agentDefaultModel')?.currentSelection()
                 ?? ctx.agentDefaultModel?.currentSelection()
                 ?? { provider: 'fallback', model: 'fallback' };
-            const reviewModelSelection = resolveReviewModel(userConfig, mapping, fallbackSelection);
+            const reviewModelSelection = resolveReviewModel(userConfig, mapping, fallbackSelection, config.reviewModel);
             // Opt-in Telegram digest; a delivery failure is logged and dropped.
             const reviewStartMsOuter = Date.now();
             const notifyTelegram = (status, summary, extra) => {
@@ -868,7 +1186,7 @@ export function apply(ctx, config) {
             const postComment = async (body) => {
                 const response = await fetch(`${resolved.gitlabBaseUrl}/api/v4/projects/${payload.projectId}/merge_requests/${payload.mrIid}/notes`, {
                     method: 'POST',
-                    headers: { 'PRIVATE-TOKEN': resolved.gitlabToken, 'Content-Type': 'application/json' },
+                    headers: { ...gitlabAuthHeaders(resolved.gitlabToken), 'Content-Type': 'application/json' },
                     body: JSON.stringify({ body }),
                 });
                 if (!response.ok)
@@ -877,23 +1195,25 @@ export function apply(ctx, config) {
             const replyToDiscussion = async (discussionId, body) => {
                 const response = await fetch(`${resolved.gitlabBaseUrl}/api/v4/projects/${payload.projectId}/merge_requests/${payload.mrIid}/discussions/${encodeURIComponent(discussionId)}/notes`, {
                     method: 'POST',
-                    headers: { 'PRIVATE-TOKEN': resolved.gitlabToken, 'Content-Type': 'application/json' },
+                    headers: { ...gitlabAuthHeaders(resolved.gitlabToken), 'Content-Type': 'application/json' },
                     body: JSON.stringify({ body }),
                 });
                 if (!response.ok)
                     throw new Error(`GitLab API error ${response.status}: ${await response.text()}`);
             };
             try {
-                if (mapping === undefined) {
-                    if (payload.mode === 'deep') {
+                if (mapping === undefined && !ciDeep && !ciQuickProfile) {
+                    // CI-deep (spec §3) skips the decline and falls through to the clone
+                    // branch below; every other unmapped deep review still declines here.
+                    if (payload.mode === 'deep' && !shouldCiDeepReview(payload)) {
                         await declineUnmappedDeepReview(payload, { postComment, replyToDiscussion, writeFailedReport, gitlabBaseUrl: resolved.gitlabBaseUrl });
                         await recordReviewFinish(historyId, { status: 'completed', summary: 'Deep review declined (unmapped project)' });
                         notifyTelegram('completed', 'Deep review declined (unmapped project)');
                         await signals?.finish('completed');
-                        return;
+                        return { ok: true, summary: 'Deep review declined (unmapped project)', failures: [], durationMs: Date.now() - t0 };
                     }
                     const diffBody = await runDiffOnlyReview(payload, {
-                        runReviewer: (p) => runReviewer(undefined, p, resolved, undefined, reviewModelSelection, incrementalBlock),
+                        runReviewer: (p) => runReviewer(undefined, p, resolved, payload.reviewProfile, reviewModelSelection, incrementalBlock),
                         postComment,
                         replyToDiscussion,
                         writeFailedReport,
@@ -902,59 +1222,108 @@ export function apply(ctx, config) {
                     await recordReviewFinish(historyId, { status: 'completed', summary: summarize(diffBody) });
                     notifyTelegram('completed', summarize(diffBody));
                     await signals?.finish('completed');
-                    return;
+                    return { ok: true, summary: summarize(diffBody), failures: [], durationMs: Date.now() - t0 };
                 }
                 let fullBody;
-                try {
-                    fullBody = await runReviewAndAudit(payload, {
-                        localRepoPath: mapping.localRepoPath,
-                        ensureWorktree,
-                        removeWorktree,
-                        runReviewer: (worktreePath, p) => runReviewer(worktreePath, p, resolved, mapping.reviewProfile ?? 'magento2', reviewModelSelection, incrementalBlock),
-                        runAuditor: (worktreePath, p) => runAuditor(worktreePath, p, resolved, reviewModelSelection),
-                        postComment,
-                        replyToDiscussion,
-                        writeFailedReport,
-                        gitlabBaseUrl: resolved.gitlabBaseUrl,
-                        reviewProfile: mapping.reviewProfile ?? 'magento2',
-                    });
+                if (ciDeep || ciQuickProfile) {
+                    // CI-deep (mapping is always undefined here — the unmapped block above
+                    // returned for every other case): clone the source at the head SHA,
+                    // map it in memory, and reuse the mapped machinery reviewer-only.
+                    // CI quick-with-profile joins the same branch; runReviewAndAudit skips
+                    // the auditor for quick (shouldAudit), so it stays reviewer-only.
+                    // No govard/vendor linking (ciEnsureWorktree is plain fetch + worktree).
+                    const ciHost = process.env.GITLAB_HOST?.trim() || new URL(resolved.gitlabBaseUrl).hostname;
+                    const cloneDir = join('/tmp', `maestro-ci-src-${payload.projectId}-${payload.mrIid}`);
+                    await cloneSourceRepo({ fetcher: fetch, run: defaultRun, host: ciHost, projectId: payload.projectId, sourceBranch: payload.sourceBranch, headSha: payload.headSha, token: resolved.gitlabToken, dir: cloneDir });
+                    try {
+                        const ciEnsureWorktree = async (repoPath, branch, pid, iid, suffix) => {
+                            assertSafeBranchName(branch);
+                            const wt = join('/tmp', `maestro-mr-${pid}-${iid}${suffix === undefined ? '' : `-${suffix}`}`);
+                            await defaultRun('git', ['fetch', '--depth', '50', 'origin', branch], repoPath);
+                            await defaultRun('git', ['worktree', 'remove', '--force', wt], repoPath).catch(() => { });
+                            await defaultRun('git', ['worktree', 'add', '--detach', '--', wt, payload.headSha], repoPath);
+                            return wt;
+                        };
+                        fullBody = await runReviewAndAudit(payload, {
+                            localRepoPath: cloneDir,
+                            ensureWorktree: ciEnsureWorktree,
+                            removeWorktree,
+                            runReviewer: (worktreePath, p) => runReviewer(worktreePath, p, resolved, payload.reviewProfile ?? 'generic', reviewModelSelection, incrementalBlock),
+                            runAuditor: withAuditorDegrade((worktreePath, p) => runAuditor(worktreePath, p, resolved, reviewModelSelection, { staticOnly: true })),
+                            postComment,
+                            replyToDiscussion,
+                            writeFailedReport,
+                            gitlabBaseUrl: resolved.gitlabBaseUrl,
+                            reviewProfile: payload.reviewProfile ?? 'generic',
+                        });
+                    }
+                    finally {
+                        await defaultRun('rm', ['-rf', cloneDir]).catch(() => { });
+                    }
                 }
-                catch (err) {
-                    const isBranchNotFound = err?.code === 'BRANCH_NOT_FOUND' || isBranchNotFoundError(err);
-                    if (isBranchNotFound) {
-                        const diffBody = await runDiffOnlyReview(payload, {
-                            runReviewer: (p) => runReviewer(undefined, p, resolved, undefined, reviewModelSelection, incrementalBlock),
+                else {
+                    // Unreachable when mapping is undefined: the unmapped block returned
+                    // for every non-CI-deep case, and ciDeep took the branch above.
+                    if (mapping === undefined)
+                        throw new Error('unreachable: unmapped review without CI-deep decision');
+                    try {
+                        fullBody = await runReviewAndAudit(payload, {
+                            localRepoPath: mapping.localRepoPath,
+                            ensureWorktree,
+                            removeWorktree,
+                            runReviewer: (worktreePath, p) => runReviewer(worktreePath, p, resolved, mapping.reviewProfile ?? 'magento2', reviewModelSelection, incrementalBlock),
+                            runAuditor: (worktreePath, p) => runAuditor(worktreePath, p, resolved, reviewModelSelection),
                             postComment,
                             replyToDiscussion,
                             writeFailedReport,
                             gitlabBaseUrl: resolved.gitlabBaseUrl,
+                            reviewProfile: mapping.reviewProfile ?? 'magento2',
                         });
-                        const summary = summarize(diffBody);
-                        const branchNote = `fallback diff-only: branch ${payload.sourceBranch} not found on origin — ${summary ?? ''}`.trim();
-                        await recordReviewFinish(historyId, { status: 'completed', summary: branchNote });
-                        notifyTelegram('completed', branchNote);
-                        await signals?.finish('completed');
-                        return;
                     }
-                    throw err;
+                    catch (err) {
+                        const isBranchNotFound = err?.code === 'BRANCH_NOT_FOUND' || isBranchNotFoundError(err);
+                        if (isBranchNotFound) {
+                            const diffBody = await runDiffOnlyReview(payload, {
+                                runReviewer: (p) => runReviewer(undefined, p, resolved, payload.reviewProfile, reviewModelSelection, incrementalBlock),
+                                postComment,
+                                replyToDiscussion,
+                                writeFailedReport,
+                                gitlabBaseUrl: resolved.gitlabBaseUrl,
+                            });
+                            const summary = summarize(diffBody);
+                            const branchNote = `fallback diff-only: branch ${payload.sourceBranch} not found on origin — ${summary ?? ''}`.trim();
+                            await recordReviewFinish(historyId, { status: 'completed', summary: branchNote });
+                            notifyTelegram('completed', branchNote);
+                            await signals?.finish('completed');
+                            return { ok: true, summary: branchNote, failures: [], durationMs: Date.now() - t0 };
+                        }
+                        throw err;
+                    }
                 }
                 await recordReviewFinish(historyId, { status: 'completed', summary: summarize(fullBody) });
                 notifyTelegram('completed', summarize(fullBody));
                 await signals?.finish('completed');
+                return { ok: true, summary: summarize(fullBody), failures: [], durationMs: Date.now() - t0 };
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);
                 await recordReviewFinish(historyId, { status: 'failed', error: message }).catch(() => { });
                 notifyTelegram('failed', message);
                 await signals?.finish('failed');
-                throw err;
+                return { ok: false, summary: undefined, failures: [message], durationMs: Date.now() - t0 };
             }
-        })().catch((err) => {
+        }
+        catch (err) {
             // Worktree creation, agent creation, and fallback delivery all run from
-            // an event callback, so surface failures rather than leaking a rejected
-            // fire-and-forget Promise.
+            // this function — surface failures as a result instead of an unhandled
+            // rejection, so both the fire-and-forget webhook path and an awaiting
+            // CI caller observe the same outcome.
+            const message = err instanceof Error ? err.message : String(err);
             console.error(`maestro-orchestrator: review run failed for MR !${String(payload.mrIid)}:`, err);
-        });
-    });
+            return { ok: false, summary: undefined, failures: [message], durationMs: Date.now() - t0 };
+        }
+    }
+    ctx.on('maestro/review-request', (payload) => { void runReview(payload); });
+    ctx.provide('reviewRunner', runReview);
 }
 //# sourceMappingURL=orchestrator.js.map