@feng0531/dsh-code-review 0.88.0 → 0.90.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.90.0 — 清晰结论与有界复审闭环
+
+- 数量优先摘要、稳定候选编号与严重程度排序，分开不确定和未完成，保留全部原始证据。
+- 确定性风险投入与高风险候选独立反证，共享额度和新回执，反证失败不再记为完成；不使用多数票替代证据。
+- owned历史台账、人工处置与最多三轮关联修复链；显式差异复审可省未变主审但始终partial，默认未知依赖全新主审，取消成果不丢失。
+- 真实事件评测合同保留全部运行分母，未裁决无金标；r7364归档质量指标未知，不宣称已解决或提速。
+
+## 0.89.0 — 超限分组的真实子智能体并行
+
+- 整体路径只有完整输入超限分组时创建真实spawn子会话，默认2组、可配1～4；同组持续上下文补读，主审全部收尾后集中复核。默认策略仍staged。
+- 受限快照工具强绑定child身份，共用唯一读取账本和模型生成尝试额度；能力或身份变化拒绝，不隐藏串行回退。逻辑LLM输入检查不冒充最终HTTP字节。
+- FIFO检查点、取消join和首个致命原因保真，按批准顺序汇总；跨组未核查仍partial。
+- 实际宿主独立离线Context通过两个真实child的并行、持续读取和结构化终态验证；模型、快照和cwd为fixture，不宣称真实提供方质量或业务提速。
+
 ## 0.88.0 — 整体主审实验路径与自动回归
 
 - 新增whole-scope完整文件字节合批与候选集中复核，显式输入容量绑定预览和执行；默认仍staged，fresh单轮changes限定，超大文件及跨批缺口如实保留。

package/README.md

@@ -280,10 +280,24 @@ Git / SVN 历史审查也能使用这些参数；依赖和调用方按对应版
 
 插件配置 `executionStrategy: "whole-scope"` 启用完整文件按字节合批的变更审查。能装下时，一次主审同时检查全部成员；超限才分批，不按四个文件强切，不再额外调用逐文件风险规划、业务分组及旧专门综合。候选集中独立复核，缺少上下文时仍可能增加检索调用，因此不承诺总调用仅一次。
 
-`maxInputBytes` 是插件显式输入保护，不是模型上下文容量探测；默认仍为 98304 字节，允许配置为 1～4194304 的整数。预算包含完整新旧正文、JSON 转义、规则、检索目录、指令与原生结果工具，预览的 `plan.maxInputBytes` 与执行使用同一值。提高前应核实当前模型容量、费用及提供方限制，插件不会自动猜测容量或因失败不断加大输入重试。
+实际超限分为多组时，整体路径使用宿主真实 `spawn` 子智能体有界并行，`wholeScopeConcurrency` 可设1～4（默认2）；只有一组时不创建子智能体。每组保持独立会话和持续上下文，补读不重新建组；全部主审收尾后集中复核。宿主须具备受限预设、结构化子会话和活动父Agent；能力缺失或变化明确拒绝，不暗中退回串行。子智能体共用唯一批准快照读取账本与模型生成尝试总账，取消须等待所有子会话清理。跨组关系未核查仍partial，并行不提高完成标准。
+
+内部 `review_snapshot` 工具可能在父会话目录可见，但只有本次注册且身份绑定的审查子会话可执行；父会话和其他子会话读取前拒绝。子会话作为宿主管理的独立Session按宿主规则记录，可能含批准源码和工具响应，不等同于插件私有模型工件留存。
+
+`maxInputBytes` 是插件显式输入保护，不是模型上下文容量探测；默认仍为 98304 字节，允许配置为 1～4194304 的整数。主审计划计入完整新旧正文、JSON转义、规则、检索目录、指令与原生结果工具；持续子会话发送前另外检查包含历史消息和工具的逻辑LLM envelope，不是提供方最终HTTP字节。宿主系统提示与历史开销可能使已规划组在发送前受限，届时保留未完成而不截断源码。预览的 `plan.maxInputBytes` 与执行使用同一值。提高前应核实当前模型容量、费用及提供方限制，插件不会自动猜测容量或因失败不断加大输入重试。
 
 当前仅支持 fresh 单轮 changes；多轮、旧任务恢复及 project 明确拒绝，预览显示 `resumeSupported:false`。超大完整文件显示 blocked，不截断或把差异窗口冒充全文；多批跨边界未核查保持 partial。身份、原文定位、归因、独立复核回执及来源新鲜度校验不变。默认仍为 `staged`；整体路径尚无真实业务同条件质量与耗时验收，不宜把单测调用减少当作业务问题已解决。配置由宿主插件管理方式加载，发布不会自动安装或重启宿主。
 
+## 风险投入、发现台账与复审
+
+`reviewEffort` 可选 `auto`（默认）、`quick`、`standard`、`deep`，在preview中明确。它是对批准变更的有界确定性检查，不额外调用模型规划；quick也不跳过原文、归因和独立复核。高风险线索只改变检查方向，不证明缺陷。深度模式下仅已获首轮支持的high/critical候选增加一次独立反证复核，使用新的读取回执；不把首轮结论传给第二位验证者。两次结论分歧、证据不足或反证未完成均保守处理，不按多数票升级。插件配置 `enableCounterVerification:false` 可关闭额外反证；开启状态在preview绑定。它可能增加调用和耗时，不承诺普遍提速。
+
+变更审查可在新后台preview传 `rereviewFromJobId` 接续本会话、相同仓库/模型/规则/需求政策的终态且未过期报告。每轮仍重新捕获、预览和授权；旧回执及结论不进入本轮证据。关联修复链第三轮提示重新考虑方案，第四轮拒绝；不是跨任务全局次数锁。可用 `findingOutcomes` 记录已知发现的 `fixed/refuted/intentional/deferred` 与原因，人工标记是处置声明，不证明修复。相同精确定位与缺陷主张保持台账身份，不因行号移动重复建项；未再次观察不自动关闭。
+
+默认 `rereviewScope:"full"`，未知完整依赖图时保持全新主审。明确选择 `rereviewScope:"diff-only"` 才将新旧两侧、属性和来源指纹都未变的主文件保留为未重审；本轮完整批准来源仍可检索。预览列出primary与unreviewed路径，实际省略未变主文件时报告强制partial，不能当作跨文件影响已排除或全范围通过。取消/失败终态不被partial覆盖。上述修复链和差异复审仅changes支持；project支持风险投入但不接受历史修复链参数。
+
+报告首屏先给复核支持数量和优先候选编号，分开已复核不确定与复核未完成，显示未查范围。正文按类别与严重程度展示，附录保留原候选顺序与完整证据。真实事件评测见[仓库评测说明](https://github.com/f-e-n-g-0531/dsh-code-review/blob/main/evaluation/README.md)；没有专家确认和完整实际结果时不输出命中率。
+
 ## 工具调用流程（给需要精确指定参数的人）
 
 普通使用者只需上面的对话请求，不必手工构造 ID。需要精确控制时，让 Agent 按下列顺序调用：

package/RELEASE-NOTES.md

@@ -1,17 +1,15 @@
-# v0.88.0 发布说明
+# v0.90.0 发布说明
 
-## 整体主审实验路径
+## 报告、收敛复审、风险投入与真实事件评测统一优化
 
-新增插件配置 `executionStrategy:"whole-scope"`：完整文件按实际输入字节合批，批内一次整体主审，候选每最多50条集中独立复核；不额外执行逐文件风险规划、业务分组和旧专门综合。缺上下文仍可补读，不承诺总调用一次。默认仍为 `staged`。
+- 结论首屏按数量说明复核支持的新增／既有／当前源码问题，分开已复核不确定和复核未完成，优先列出严重候选编号与未查范围；不把空发现等同通过。原始候选及证据保持不变。
+- 新增确定性风险投入auto/quick/standard/deep，不增加独立模型规划；quick保留严格校验。深度模式仅对首轮已支持的high/critical候选增加新回执的独立反证，不给第二验证者首轮结论；分歧保守不确定，反证失败明确incomplete，不缓存成完成。反证共用原预算、取消和来源边界，可能增加时间，不承诺提速。
+- 变更审查新增owned终态报告修复链，fresh preview与授权不可省。稳定指纹合并重复定位和缺陷主张，人工fixed/refuted/intentional/deferred仅记录处置，不证明当前状态；未再次观察不自动fixed。关联链第三轮要求step-back，第四轮拒绝，不是全局次数锁。
+- 默认全新主审。显式diff-only复审才减少完全未变文件的主审目标，批准原源仍可检索，跳过范围明确未重审，实际省略主文件时报告保持partial；未知依赖不得自动推断完整覆盖。不构造虚假历史差异，不继承旧回执或授权。取消与失败终态保留。修复链仅changes支持，project支持风险投入。
+- 新增离线真实事件评测合同：固定快照/版本/模型及预注册全部运行，专家裁决绑定实际报告摘要哈希和候选序号；未裁决不作金标，缺失／失败／partial不从分母消失。分别统计误报、有害建议、未完成和操作耗时，不以最佳一次或模型自评作为成绩。
 
-`maxInputBytes` 是显式输入保护，默认98304字节、最多4194304字节，不是模型容量探测；同一配置绑定预览与执行。当前整体路径仅支持fresh单轮changes；多轮、旧任务恢复及project明确拒绝。超大完整文件blocked，多批跨边界未核查仍partial，不截断全文换取完成。身份、原文定位、归因、独立新回执及来源新鲜度保护不放宽；取消保留已验收批次，存储失败不吞。
+## 验证与未完成边界
 
-组主审补上仅同成员同来源侧唯一精确原文的坐标纠正，随后仍严格校验；不得模糊匹配或跨文件借用。新增注入活宿主registered tools的自动回归编排：每轮fresh preview、固定模型及范围、终态等待与分页保存，失败和partial留在分母；不直连provider、不自动读取私有工件。
+本轮有合同、生产服务夹具、取消／身份／预算／定位回归与实际宿主独立离线子会话兼容验收；离线子会话只验证transport，不代表新增风险或反证管线真实模型成绩。r7364公开归档确证旧0.87.9为156次调用、861.351秒及大量未完成，但缺少完整原report JSON与专家确认标签，评测保持unadjudicated、质量指标null，不重建假报告或混用新鲜快照。没有同条件真实模型质量／耗时改善结论。
 
-## 实测边界
-
-用户r7364归档实际为0.87.9：74条目中48完成、4失败、1阻断、21待审，综合3/33，156次模型调用，执行861.351秒。四项关键主审原文定位失败，且全局读取仍有余量；此前小样例不能代表该业务闭环。
-
-同修订新鲜快照完整新旧源码约1.96MB。静态规划在96KiB下17批且15完整文件超限；256KiB下13批、1MiB下3批、3MiB下1批，后三者均装入73个可审条目。这些只是输入规划，不是模型可接收能力、实际调用数或质量提升证明；新鲜快照不冒充归档原身份。
-
-本版通过离线合同测试及宿主工具兼容验收，尚无新策略真实模型同条件质量与耗时成绩，**不宣称r7364已解决或已提速**。按用户要求正式发布实验能力，默认不切换，不自动安装、改配置或重启运行宿主。配置见[使用说明](README.md)，正式发布门禁见[开发说明](DEVELOPMENT.md)。
+本版保持只读，不自动修改／合并业务代码，不替代所需人类审批，不自动安装、改宿主配置或重启。配置见[使用说明](README.md)，正式门禁见[开发说明](DEVELOPMENT.md)，设计借鉴[Anthropic文章](https://claude.dev/blog/solving-code-review-at-anthropic/)。

package/evaluation/README.md

@@ -17,6 +17,12 @@
 
 第二条命令只读取固定合成输入，校验内容指纹并计算初始输入大小，不调用模型。输出不含源码或答案标签；它也不是宿主执行授权。
 
+## 真实事件评测合同
+
+[incident-eval.mjs](incident-eval.mjs)校验并评估外部注入的完整实际report与专家裁决，[schema](incidents.schema.json)定义固定快照／版本／模型身份、预注册全部runIds和confirmed/unadjudicated。confirmed中的reviewer与judgementRef是外部裁决声明，不是加密签名；评测器不自动确认专家身份或从模型判定推导金标。候选裁决必须绑定report精确JSON SHA256与索引。缺失、失败和partial保留所有预注册分母；未裁决或无金标时precision/recall为null，不以0冒充无缺陷。误报、有害建议、已处置与未完成分别统计。
+
+运行`node --test test/incident-eval.test.mjs`仅验证记账合同，不是业务成绩。真实业务素材、答案和原始会话保持仓库外，不进入安装包；模型输入不包含金标。当前r7364归档只验证旧调用和状态观察，缺完整report JSON与专家裁决，因此不宣称实际召回率或新版改进。任何prompt／工具／模型变化应重新运行同一组全部案例，不选最佳一次。可由现有registered-tool live runner保存新鲜预览和终态回执，再人工独立裁决；不直连provider、不自动读取私有模型工件。
+
 ## 真实模型观察
 
 已有六次小规模观察见 [试跑结果](PILOT-RESULTS.md)。其中一次证据复核未完成，其他结果也不能外推成质量指标。新评测仍后置，开始条件见 [运行条件](PILOT-GATE.md)。

package/index.mjs

@@ -2,19 +2,26 @@ import { registerBackgroundReview } from './src/background-review.mjs';
 import { createReviewService } from './src/service.mjs';
 import { DEFAULT_PROJECT_CONCURRENCY } from './src/project-execution.mjs';
 import { reviewToolOutput } from './src/tool-view.mjs';
+import { createHostReviewChildren } from './src/host-review-children.mjs';
+import { attachReviewChildMiddleware } from './src/review-child-broker.mjs';
+import { registerSnapshotTool } from './src/review-child-plugin.mjs';
 
 export const name = 'dsh-code-review';
 export const inject = ['tools', 'llm'];
 
 const PREVIEW_DESCRIPTION = 'Preview Git/SVN working-copy or Git commit/range review scope and model destination without sending source to a model. repositoryPath selects an explicit child repository relative to session workspace; file paths are repository-relative. Each session reviews one selected repository independently; reviewMode=project selects tracked current source instead of changes; changeScope=staged or unstaged narrows a Git working-copy review to the index or to unstaged edits. Always capture and inspect the preview internally before execution. An explicit user request to review the selected code already authorizes execution within that request: proceed without asking the user to confirm the same review again. Ask only if the preview exceeds the requested scope or changes the authorized model/destination, or authorization is unclear. Never execute if the user requested preview only or explicitly asked to wait for confirmation. Preserve host tool permissions and all snapshot/identity checks.';
-const PREVIEW_PARAMETERS = { type: 'object', additionalProperties: false, properties: { resumeFromJobId: { type: 'string', description: 'Explicit terminal job to reuse identity-matching completed chains. Requires a fresh captured preview, confirmation and authorization; does not restore old approval.' }, reviewMode: {type:'string',enum:['changes','project'],description:'project reviews all tracked current files, including unchanged files, in bounded batches with shared session budget. Does not include ignored/untracked/external contents. Each DSH session owns independent preview, lock and model budget.'}, changeScope: {type:'string',enum:['worktree','staged','unstaged'],description:'Git working-copy comparison scope. worktree (default) compares HEAD to the working tree (net change); staged compares HEAD to the index so only staged content is reviewed; unstaged compares the index to the working tree so only unstaged edits are reviewed and staged content is the old side. Requires a Git working copy; mutually exclusive with Git history, SVN parameters and project mode.'}, svnReplacementBaseRevision: {type:'string',description:'Working-copy file replacement only: explicitly compare to this fixed repository revision at the target URL. Not local BASE and not proof of the removed-node revision. Requires separate remote opt-in when applicable; identity and properties frozen in preview.'}, svnReplacementAllowNetwork: {type:'boolean',description:'Explicit permission to read the selected working-copy target URL at svnReplacementBaseRevision. Does not permit arbitrary URLs, updates, merges or writes.'}, svnBasePath: {type:'string',description:'Explicit old endpoint path relative to the current SVN repository root; requires svnTargetPath and fixed revision range. Not an arbitrary URL. Same repository UUID required.'}, svnTargetPath: {type:'string',description:'Explicit new endpoint repository-relative path paired with svnBasePath. Each side content/context stays at its URL/revision; shared capture budgets and remote opt-in apply.'}, svnEffectiveMergeinfo: { type: 'boolean', description: 'Explicit SVN opt-in to bounded BASE/working or fixed-history ancestor mergeinfo property reads on each selected side. Offline for working copies; history uses existing remote permission and budgets. Mixed BASE revisions, unsafe ancestors or incomplete URL boundaries remain unknown. No branch source reads or merge attribution.' }, svnRevision: { type: 'string', description: 'SVN fixed numeric revision reviewed against revision minus one. Requires SVN working-copy root; no HEAD/date aliases.' }, svnBaseRevision: { type: 'string', description: 'SVN fixed numeric old endpoint; requires svnTargetRevision, mutually exclusive with svnRevision and Git revision parameters.' }, svnTargetRevision: { type: 'string', description: 'SVN fixed numeric new endpoint, greater than old endpoint. Fixed repository objects, not working-copy text. Supports explicitly selected target context with verified baseline provenance and target rules; explicit old-only context is also supported with fixed SVN provenance; autoContext follows at most three independent fixed-side dependency layers with bounded parent listings and shared capture budgets; callerScopePaths supports bounded fixed-side SVN historical literal discovery; only matched sides captured, never complete caller coverage.' }, svnAllowNetwork: { type: 'boolean', description: 'Explicit opt-in to read the working-copy repository URL at fixed SVN revisions during preview/execute; preview sends no source to a model. Required for non-file repository URLs; default denies remote access. Does not allow checkout/update/merge or arbitrary URLs.' }, reviewRounds: { type: 'integer', minimum: 1, maximum: 3, description: 'Explicit independent review passes, default 1. Preview discloses extra sends; later passes omit the first risk plan. Shares existing timeout, call and retrieval budgets, not provider reasoning effort. Bound to this preview; execute cannot override.' }, oldContextPaths: { type: 'array', maxItems: 20, items: { type: 'string' }, description: 'Explicit Git/SVN historical baseline-only context paths. Git uses fixed blobs; SVN uses UUID/URL/peg/operative revision/hash. Shares 20 context slots. No target text is inferred; selected old changes reuse original identity, excluded changes cannot reenter. Unsupported on working reviews.' }, callerScopePaths: { type: 'array', minItems: 1, maxItems: 4, items: { type: 'string' }, description: 'Explicit non-root repository-relative directories for bounded tracked literal reverse import/include discovery. Git/SVN working review or fixed Git/SVN historical review. SVN uses offline normal nodes, rejects unsafe ancestor states and special/keyword properties. Historical sides share scan budgets and use object blobs only. Preview reads candidate bodies, including nonmatches; only captured matching context is sent. Navigation only, not complete caller coverage.' }, businessRequirement: { type: 'string', maxLength: 16384, description: 'Optional business constraint text up to 16KiB UTF8; untrusted data, not evidence or permission. Bound to preview and sent in review phases.' }, commit: { type: 'string', description: 'Git commit versus sole parent; root empty, merge requires range.' }, baseRevision: { type: 'string', description: 'Git old endpoint; requires targetRevision, mutually exclusive with commit.' }, targetRevision: { type: 'string', description: 'Git new endpoint, exact tree endpoints not merge-base. Explicit context uses target tree with available baseline provenance; oldContextPaths is baseline-only. Historical caller discovery scans fixed sides; explicit rules use target-tree blobs.' }, repositoryPath: { type: 'string', description: 'Workspace-relative explicit child Git/SVN repository root, forward slashes; omit for current repository.' }, selectedPaths: { type: 'array', items: { type: 'string' }, maxItems: 200 }, autoContext: { type: 'boolean', description: 'Opt in to tracked literal import/include context shown in preview. Working Git follows changed and explicitly selected context sources at most 3 dependency layers under shared 512 exact probes, 20 candidates/context slots, 1MiB source and 30s verification budget. Git history follows at most 3 baseline/target dependency layers with shared limits, object reads only; SVN follows at most 3 safe offline current-side layers with exact path probes and node/ancestor identity verification, sharing limits; no SVN historical review. Not semantic binding or complete definitions.' }, contextPaths: { type: 'array', items: { type: 'string' }, maxItems: 20 }, rulePaths: { type: 'array', items: { type: 'string' }, maxItems: 4 } } };
+const PREVIEW_PARAMETERS = { type: 'object', additionalProperties: false, properties: { rereviewScope:{type:'string',enum:['full','diff-only'],description:'Changes only: explicit diff-only re-review omits unchanged primary files but retains approved retrieval context; unknown cross-file impact remains partial, never reuse old evidence. Requires rereviewFromJobId and fresh preview approval.'}, reviewEffort: {type:'string',enum:['auto','quick','standard','deep'],description:'Deterministic review effort policy; every tier retains strict evidence checks. No automatic human approval.'}, rereviewFromJobId:{type:'string',description:'Owned terminal review history for a fresh review-fix cycle; requires fresh snapshot preview and approval, never inherits old evidence or approval. Maximum three linked cycles.'}, findingOutcomes:{type:'array',maxItems:200,items:{type:'object',additionalProperties:false,properties:{id:{type:'string'},decision:{type:'string',enum:['fixed','refuted','intentional','deferred']},reason:{type:'string'}},required:['id','decision','reason']},description:'Explicit human dispositions of known historical findings; claims only, not proof of a fix. Requires rereviewFromJobId.'}, resumeFromJobId: { type: 'string', description: 'Explicit terminal job to reuse identity-matching completed chains. Requires a fresh captured preview, confirmation and authorization; does not restore old approval.' }, reviewMode: {type:'string',enum:['changes','project'],description:'project reviews all tracked current files, including unchanged files, in bounded batches with shared session budget. Does not include ignored/untracked/external contents. Each DSH session owns independent preview, lock and model budget.'}, changeScope: {type:'string',enum:['worktree','staged','unstaged'],description:'Git working-copy comparison scope. worktree (default) compares HEAD to the working tree (net change); staged compares HEAD to the index so only staged content is reviewed; unstaged compares the index to the working tree so only unstaged edits are reviewed and staged content is the old side. Requires a Git working copy; mutually exclusive with Git history, SVN parameters and project mode.'}, svnReplacementBaseRevision: {type:'string',description:'Working-copy file replacement only: explicitly compare to this fixed repository revision at the target URL. Not local BASE and not proof of the removed-node revision. Requires separate remote opt-in when applicable; identity and properties frozen in preview.'}, svnReplacementAllowNetwork: {type:'boolean',description:'Explicit permission to read the selected working-copy target URL at svnReplacementBaseRevision. Does not permit arbitrary URLs, updates, merges or writes.'}, svnBasePath: {type:'string',description:'Explicit old endpoint path relative to the current SVN repository root; requires svnTargetPath and fixed revision range. Not an arbitrary URL. Same repository UUID required.'}, svnTargetPath: {type:'string',description:'Explicit new endpoint repository-relative path paired with svnBasePath. Each side content/context stays at its URL/revision; shared capture budgets and remote opt-in apply.'}, svnEffectiveMergeinfo: { type: 'boolean', description: 'Explicit SVN opt-in to bounded BASE/working or fixed-history ancestor mergeinfo property reads on each selected side. Offline for working copies; history uses existing remote permission and budgets. Mixed BASE revisions, unsafe ancestors or incomplete URL boundaries remain unknown. No branch source reads or merge attribution.' }, svnRevision: { type: 'string', description: 'SVN fixed numeric revision reviewed against revision minus one. Requires SVN working-copy root; no HEAD/date aliases.' }, svnBaseRevision: { type: 'string', description: 'SVN fixed numeric old endpoint; requires svnTargetRevision, mutually exclusive with svnRevision and Git revision parameters.' }, svnTargetRevision: { type: 'string', description: 'SVN fixed numeric new endpoint, greater than old endpoint. Fixed repository objects, not working-copy text. Supports explicitly selected target context with verified baseline provenance and target rules; explicit old-only context is also supported with fixed SVN provenance; autoContext follows at most three independent fixed-side dependency layers with bounded parent listings and shared capture budgets; callerScopePaths supports bounded fixed-side SVN historical literal discovery; only matched sides captured, never complete caller coverage.' }, svnAllowNetwork: { type: 'boolean', description: 'Explicit opt-in to read the working-copy repository URL at fixed SVN revisions during preview/execute; preview sends no source to a model. Required for non-file repository URLs; default denies remote access. Does not allow checkout/update/merge or arbitrary URLs.' }, reviewRounds: { type: 'integer', minimum: 1, maximum: 3, description: 'Explicit independent review passes, default 1. Preview discloses extra sends; later passes omit the first risk plan. Shares existing timeout, call and retrieval budgets, not provider reasoning effort. Bound to this preview; execute cannot override.' }, oldContextPaths: { type: 'array', maxItems: 20, items: { type: 'string' }, description: 'Explicit Git/SVN historical baseline-only context paths. Git uses fixed blobs; SVN uses UUID/URL/peg/operative revision/hash. Shares 20 context slots. No target text is inferred; selected old changes reuse original identity, excluded changes cannot reenter. Unsupported on working reviews.' }, callerScopePaths: { type: 'array', minItems: 1, maxItems: 4, items: { type: 'string' }, description: 'Explicit non-root repository-relative directories for bounded tracked literal reverse import/include discovery. Git/SVN working review or fixed Git/SVN historical review. SVN uses offline normal nodes, rejects unsafe ancestor states and special/keyword properties. Historical sides share scan budgets and use object blobs only. Preview reads candidate bodies, including nonmatches; only captured matching context is sent. Navigation only, not complete caller coverage.' }, businessRequirement: { type: 'string', maxLength: 16384, description: 'Optional business constraint text up to 16KiB UTF8; untrusted data, not evidence or permission. Bound to preview and sent in review phases.' }, commit: { type: 'string', description: 'Git commit versus sole parent; root empty, merge requires range.' }, baseRevision: { type: 'string', description: 'Git old endpoint; requires targetRevision, mutually exclusive with commit.' }, targetRevision: { type: 'string', description: 'Git new endpoint, exact tree endpoints not merge-base. Explicit context uses target tree with available baseline provenance; oldContextPaths is baseline-only. Historical caller discovery scans fixed sides; explicit rules use target-tree blobs.' }, repositoryPath: { type: 'string', description: 'Workspace-relative explicit child Git/SVN repository root, forward slashes; omit for current repository.' }, selectedPaths: { type: 'array', items: { type: 'string' }, maxItems: 200 }, autoContext: { type: 'boolean', description: 'Opt in to tracked literal import/include context shown in preview. Working Git follows changed and explicitly selected context sources at most 3 dependency layers under shared 512 exact probes, 20 candidates/context slots, 1MiB source and 30s verification budget. Git history follows at most 3 baseline/target dependency layers with shared limits, object reads only; SVN follows at most 3 safe offline current-side layers with exact path probes and node/ancestor identity verification, sharing limits; no SVN historical review. Not semantic binding or complete definitions.' }, contextPaths: { type: 'array', items: { type: 'string' }, maxItems: 20 }, rulePaths: { type: 'array', items: { type: 'string' }, maxItems: 4 } } };
 const EXECUTE_DESCRIPTION = 'Execute a previewed read-only code review using the current DSH model. Sends the approved snapshot to the current Agent model under DSH tool execution policy; no separate plugin approval prompt. confirmed=true attests that the current user explicitly requested this review and the inspected preview matches that authorization; it does not require a second confirmation message. Never execute a preview-only or explicit wait-for-confirmation request, or exceed authorized scope/model/destination. Never modifies the reviewed repository.';
 const EXECUTE_PARAMETERS = { type: 'object', additionalProperties: false, properties: { previewId: { type: 'string' }, confirmed: { type: 'boolean', description: 'True only when the current user explicitly authorized this review and the inspected preview matches the requested scope/model/destination. The original explicit review request is sufficient; do not ask again for the same review. Preview-only or explicit wait-for-confirmation requests do not authorize execution.' } }, required: ['previewId', 'confirmed'] };
 
 export function apply(ctx, config = {}) {
   // This entry runs only when the host invokes the registered tool.
   // Host tool policy owns permission; do not request a second approval here.
-  const service = createReviewService(ctx.llm, { executionStrategy: config.executionStrategy ?? 'staged', maxInputBytes: config.maxInputBytes ?? 96 * 1024, allowModelSending: true, nativeOutputTools: true, enableGroupPrimary: true, enableEvidenceContext: config.enableEvidenceContext ?? true, inlineInteractionRisks: config.inlineInteractionRisks ?? true, enableMigrationContracts: config.enableMigrationContracts ?? true, enableMigrationRegression: config.enableMigrationRegression ?? true, enableGroupInteractions: config.enableGroupInteractions ?? true, enableStageContinuation: config.enableStageContinuation ?? true, enableRiskPlanning: true, enableBusinessGrouping: true, enableAnchorCorrection: true, projectConcurrency: config.projectConcurrency ?? DEFAULT_PROJECT_CONCURRENCY, riskPlanningMode: config.riskPlanningMode ?? 'auto', readerBudgetPolicy: config.readerBudgetPolicy ?? 'scaled', optimizeReviewCalls: true, enablePrimarySeeds: true, focusPrimaryContext: config.focusPrimaryContext ?? true, enableSearchSeeds: config.enableSearchSeeds ?? true, changesConcurrency: config.changesConcurrency ?? 2, maxRetrievalRounds: config.maxRetrievalRounds ?? 3, authorize: async () => true });
+  const hostChildren = createHostReviewChildren(ctx);
+  registerSnapshotTool(ctx);
+  attachReviewChildMiddleware(ctx);
+  ctx.on('dispose', () => hostChildren.dispose());
+  const service = createReviewService(ctx.llm, { reviewEffort: config.reviewEffort ?? 'auto', enableCounterVerification: config.enableCounterVerification ?? true, hostChildren, wholeScopeConcurrency: config.wholeScopeConcurrency ?? 2, executionStrategy: config.executionStrategy ?? 'staged', maxInputBytes: config.maxInputBytes ?? 96 * 1024, allowModelSending: true, nativeOutputTools: true, enableGroupPrimary: true, enableEvidenceContext: config.enableEvidenceContext ?? true, inlineInteractionRisks: config.inlineInteractionRisks ?? true, enableMigrationContracts: config.enableMigrationContracts ?? true, enableMigrationRegression: config.enableMigrationRegression ?? true, enableGroupInteractions: config.enableGroupInteractions ?? true, enableStageContinuation: config.enableStageContinuation ?? true, enableRiskPlanning: true, enableBusinessGrouping: true, enableAnchorCorrection: true, projectConcurrency: config.projectConcurrency ?? DEFAULT_PROJECT_CONCURRENCY, riskPlanningMode: config.riskPlanningMode ?? 'auto', readerBudgetPolicy: config.readerBudgetPolicy ?? 'scaled', optimizeReviewCalls: true, enablePrimarySeeds: true, focusPrimaryContext: config.focusPrimaryContext ?? true, enableSearchSeeds: config.enableSearchSeeds ?? true, changesConcurrency: config.changesConcurrency ?? 2, maxRetrievalRounds: config.maxRetrievalRounds ?? 3, authorize: async () => true });
   ctx.tools.register({
     name: 'code_review_preview', description: PREVIEW_DESCRIPTION, parameters: PREVIEW_PARAMETERS, output: reviewToolOutput,
     async execute(args, exec) { const preview = await service.preview(args, exec); return { json: JSON.stringify(preview), markdown: '' }; },

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.88.0",
+  "version": "0.90.0",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },
   "main": "./index.mjs",
-  "exports": { ".": "./index.mjs", "./package.json": "./package.json", "./locale/*.json": "./locale/*.json" },
+  "exports": { ".": "./index.mjs", "./package.json": "./package.json", "./child": "./src/review-child-plugin.mjs", "./locale/*.json": "./locale/*.json" },
   "files": ["scripts/review-bench-adapter.mjs", "evaluation/REVIEWBENCH-LOCAL.md", "index.mjs", "cordis.patch.yml", "src/", "locale/", "README.md", "CHANGELOG.md", "RELEASE-NOTES.md", "DEVELOPMENT.md", "CORE-ALIGNMENT-TASKS.md", "CORE-SOURCE-INVENTORY.md", "SVN-SUPPORT-MATRIX.md", "SVN-RELEASE-EVIDENCE.md", "LICENSE", "LICENSES/"],
   "dsh": { "bundle": { "patch": "./cordis.patch.yml" } },
   "repository": { "type": "git", "url": "https://github.com/f-e-n-g-0531/dsh-code-review.git" },

package/src/approved-retrieval.mjs

@@ -0,0 +1,13 @@
+import { isDeepStrictEqual } from 'node:util';
+// Internal scope projection only; never an extra public source authority.
+export function approvedRetrievalSnapshot(review,approved=review) {
+  if(approved===review)return review;
+  if(!approved||review.id!==approved.id||!Array.isArray(review.files)||review.files.length!==approved.files?.length)throw new Error('Incremental source identity mismatch');
+  const expected=structuredClone(approved);
+  for(let i=0;i<review.files.length;i++){
+    const target=review.files[i],source=expected.files[i];
+    if(target.eligibility==='excluded'&&target.reason==='incremental-unchanged-not-reviewed'&&source.eligibility==='reviewable'){source.eligibility=target.eligibility;source.reason=target.reason;}
+  }
+  if(!isDeepStrictEqual(expected,review))throw new Error('Incremental projection changed approved source or metadata');
+  return structuredClone(approved);
+}

package/src/background-review.mjs

@@ -83,6 +83,7 @@ async function startBackgroundJob(args, exec, jobs, service) {
     const detached = {
       ...exec, agent: original, signal,
       resolveReviewResume: id => jobs.resume(id, exec),
+      resolvePriorReview: id => jobs.priorReview(id, exec),
       reviewResumeCheckpoint: saveResumeState,
       onModelArtifact: artifact,
       reviewCheckpoint: async value => {

package/src/child-output-schema.mjs

@@ -0,0 +1,22 @@
+// The host's structured_output accepts a documented finite JSON Schema subset.
+// Numeric/length bounds remain mandatory in the ordinary review validators.
+const annotations = new Set(['title', 'description', 'default']);
+const scalars = new Set(['type', 'enum', 'const', 'required', 'additionalProperties', ...annotations]);
+export function childOutputSchema(schema) {
+  if (!schema || typeof schema !== 'object' || Array.isArray(schema)) throw new Error('Invalid child output schema');
+  const result = {};
+  for (const [key, value] of Object.entries(schema)) {
+    if (key === 'properties') result.properties = Object.fromEntries(Object.entries(value).map(([name, child]) => [name, childOutputSchema(child)]));
+    else if (key === 'items') result.items = childOutputSchema(value);
+    else if (key === 'oneOf') result.oneOf = value.map(childOutputSchema);
+    else if (scalars.has(key)) result[key] = structuredClone(value);
+    else if (!['minimum','maximum','minItems','maxItems','minLength','maxLength','pattern'].includes(key)) throw new Error('Unknown child schema constraint: ' + key);
+  }
+  if (!result.type && !result.oneOf) {
+    const values = result.enum ?? (Object.hasOwn(result, 'const') ? [result.const] : []);
+    const types = [...new Set(values.map(value => value === null ? 'null' : typeof value))];
+    if (types.length === 1 && ['string','number','boolean','null'].includes(types[0])) result.type = types[0];
+    else if (values.length) throw new Error('Ambiguous child enum type');
+  }
+  return result;
+}

package/src/counter-verification.mjs

@@ -0,0 +1,48 @@
+import { verificationLoop } from './verification-loop.mjs';
+
+const confirmed = value => value?.verdict === 'supported' && Array.isArray(value.evidence) && value.evidence.length > 0 && value.evidence.every(ref => ref?.status === 'references-validated');
+const classification = value => value?.regression?.classification;
+const comparable = value => ['introduced', 'preexisting'].includes(classification(value)) && value.regression.status === 'comparison-references-validated';
+const fatal = (error, options) => ['MODEL_ARTIFACT_FAILED', 'CHECKPOINT_FAILED', 'RESUME_CHECKPOINT_FAILED'].includes(error?.code) || options.isFatalError?.(error) === true;
+
+// Input baseline must be the just-completed strict verificationLoop result, not
+// historical findings or model-supplied verdicts. This pass grants no authority.
+export async function runCounterVerification(model, request, candidates, baseline, scope, options = {}) {
+  request.signal?.throwIfAborted();
+  if (!Array.isArray(candidates) || candidates.length > 50 || !Array.isArray(baseline) || baseline.length !== candidates.length) throw new Error('Invalid counterverification candidates or baseline');
+  if (options.enabled !== undefined && typeof options.enabled !== 'boolean') throw new Error('Invalid counterverification policy');
+  if (options.isFatalError !== undefined && typeof options.isFatalError !== 'function') throw new Error('Invalid counterverification fatal predicate');
+  const results = structuredClone(baseline);
+  if (options.enabled !== true) return results;
+  const indices = candidates.flatMap((candidate, index) => ['critical', 'high'].includes(candidate?.severity) && confirmed(baseline[index]) ? [index] : []);
+  if (!indices.length) return results;
+  const independent = indices.map(index => {
+    const value = structuredClone(candidates[index]);
+    delete value.verification;
+    delete value.counterVerification;
+    return value;
+  });
+  let counter, failureCode;
+  try {
+    counter = await verificationLoop(model, request, independent, scope, { ...options, verificationFocus: 'counterevidence', correctProtocol: false });
+    request.signal?.throwIfAborted();
+  } catch (error) {
+    request.signal?.throwIfAborted();
+    if (error?.name === 'AbortError' || fatal(error, options)) throw error;
+    // Never echo an untrusted model exception (which may contain source text).
+    failureCode = 'COUNTER_VERIFICATION_INCOMPLETE';
+  }
+  indices.forEach((index, offset) => {
+    const original = baseline[index], extra = counter?.[offset];
+    const metadata = extra ? { status: 'completed', result: structuredClone(extra), baselineResult: structuredClone(original) } : { status: 'incomplete', failureCode, baselineResult: structuredClone(original) };
+    results[index].counterVerification = metadata;
+    if (extra && confirmed(extra) && comparable(original) && comparable(extra) && classification(original) === classification(extra)) return;
+    // Preserve both independent records. Uncertainty is a conservative aggregate,
+    // not a new model verdict or evidence borrowed from the second receipt table.
+    results[index].verdict = 'uncertain';
+    results[index].reason = extra ? 'Independent counterevidence verification did not confirm the same supported classification.' : 'Independent counterevidence verification is incomplete.';
+    results[index].causality = 'unverified';
+    results[index].regression = { classification: 'uncertain', reason: results[index].reason, oldEvidence: [], newEvidence: [], causality: 'unverified' };
+  });
+  return results;
+}

package/src/finding-ledger.mjs

@@ -0,0 +1,169 @@
+import { createHash } from 'node:crypto';
+
+// Navigation and human disposition metadata only. Never a source/evidence receipt,
+// verification result, coverage certificate, approval, or permission to run again.
+const MAX_CYCLES = 3;
+const LIMIT = 10000;
+const TRUST = 'historical-metadata-not-evidence';
+const digest = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+const fail = message => { throw new Error('Finding ledger: ' + message); };
+const text = value => typeof value === 'string' && value.trim().length > 0 && value.length <= 16000;
+const hash = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+const record = value => value && typeof value === 'object' && !Array.isArray(value) && [Object.prototype, null].includes(Object.getPrototypeOf(value));
+function exact(value, keys) {
+  if (!record(value) || Reflect.ownKeys(value).some(key => typeof key !== 'string' || !keys.includes(key) || !Object.hasOwn(Object.getOwnPropertyDescriptor(value, key), 'value'))) fail('unknown or invalid fields');
+}
+function list(value) { if (!Array.isArray(value) || value.length > LIMIT) fail('invalid or excessive list'); }
+function path(value) {
+  // SVN uses the canonical repository root for directory property changes.
+  if (value === '.') return value;
+  if (!text(value) || value.includes('\\') || value.includes('\0') || value.startsWith('/') || /^[a-z]:/i.test(value) || value.split('/').some(part => !part || part === '.' || part === '..')) fail('invalid repository-relative path');
+  return value;
+}
+function identityValue(value) {
+  const keys = ['repository', 'route', 'rulesHash', 'requirementPolicyHash'];
+  exact(value, keys);
+  if (!text(value.repository) || !text(value.route) || !hash(value.rulesHash) || !hash(value.requirementPolicyHash)) fail('invalid identity');
+  return Object.fromEntries(keys.map(key => [key, value[key]]));
+}
+function sameIdentity(left, right) { if (JSON.stringify(left) !== JSON.stringify(right)) fail('identity mismatch'); }
+function freeze(value) {
+  if (value && typeof value === 'object') { for (const item of Object.values(value)) freeze(item); Object.freeze(value); }
+  return value;
+}
+function decisionValue(value) {
+  exact(value, ['decision', 'reason', 'cycle']);
+  if (!['fixed', 'refuted', 'intentional', 'deferred'].includes(value.decision) || !text(value.reason) || !Number.isInteger(value.cycle) || value.cycle < 1 || value.cycle > MAX_CYCLES) fail('invalid human decision');
+  return { decision: value.decision, reason: value.reason, cycle: value.cycle };
+}
+function validatePrevious(value, identity) {
+  exact(value, ['schemaVersion', 'identity', 'originSnapshotId', 'chainOrigin', 'cycle', 'maxCycles', 'nextAction', 'trust', 'snapshotId', 'findings']);
+  sameIdentity(identityValue(value.identity), identity);
+  if (value.schemaVersion !== 1 || value.trust !== TRUST || value.maxCycles !== MAX_CYCLES || !Number.isInteger(value.cycle) || value.cycle < 1 || value.cycle > MAX_CYCLES || !text(value.snapshotId) || !text(value.originSnapshotId) || value.chainOrigin !== digest([identity, value.originSnapshotId]) || value.nextAction !== (value.cycle === MAX_CYCLES ? 'step-back' : 'human-review')) fail('invalid chain');
+  list(value.findings);
+  const ids = new Set();
+  const findings = value.findings.map(item => {
+    exact(item, ['id', 'path', 'side', 'anchorHash', 'claimHash', 'matchable', 'firstSeen', 'lastSeen', 'observation', 'findingIndices', 'humanDecisions']);
+    path(item.path);
+    if (item.path === '.' && !['property', 'file'].includes(item.side)) fail('root findings require property or file anchor');
+    if (!hash(item.id) || ids.has(item.id) || !hash(item.anchorHash) || !hash(item.claimHash) || !['old', 'new', 'property', 'file'].includes(item.side) || typeof item.matchable !== 'boolean' || item.matchable !== (item.side !== 'file') || !['new', 'repeated', 'not-observed'].includes(item.observation) || !Number.isInteger(item.firstSeen) || !Number.isInteger(item.lastSeen) || item.firstSeen < 1 || item.lastSeen < item.firstSeen || item.lastSeen > value.cycle) fail('invalid historical finding');
+    list(item.findingIndices); list(item.humanDecisions);
+    if (item.findingIndices.some(index => !Number.isSafeInteger(index) || index < 0) || new Set(item.findingIndices).size !== item.findingIndices.length) fail('invalid finding indices');
+    const humanDecisions = item.humanDecisions.map(decisionValue);
+    if (humanDecisions.length > MAX_CYCLES || humanDecisions.some(d => d.cycle > value.cycle) || new Set(humanDecisions.map(d => d.cycle)).size !== humanDecisions.length) fail('invalid decision history');
+    const expected = digest([identity.repository, item.path, item.side, item.anchorHash, item.claimHash, item.matchable ? null : value.chainOrigin, item.matchable ? null : item.firstSeen]);
+    if (item.id !== expected) fail('invalid finding fingerprint');
+    ids.add(item.id);
+    return { ...item, findingIndices: [], humanDecisions };
+  });
+  return { ...value, findings };
+}
+
+/** Accepts the real report.findings shape from review.mjs (including project reports).
+ * Does not mutate or copy report verification, evidence receipts, status or source.
+ * Hashes exact source anchor and defect claim; prose drift deliberately makes a new
+ * candidate rather than heuristically merging distinct causes by title/path.
+ */
+export function buildFindingLedger(report, identity, options = {}) {
+  identity = identityValue(identity);
+  exact(options, ['previous', 'outcomes']);
+  if (!record(report) || !text(report.snapshotId)) fail('invalid current report');
+  list(report.findings);
+  const previous = options.previous === undefined ? undefined : validatePrevious(options.previous, identity);
+  if (previous?.cycle === MAX_CYCLES) fail('cycle cap reached; step back with human review, not automatic approval');
+  const cycle = (previous?.cycle ?? 0) + 1;
+  const originSnapshotId = previous?.originSnapshotId ?? report.snapshotId;
+  const chainOrigin = digest([identity, originSnapshotId]);
+  const rows = new Map((previous?.findings ?? []).map(item => [item.id, { ...item, observation: 'not-observed' }]));
+  report.findings.forEach((finding, index) => {
+    if (!record(finding)) fail('invalid current finding');
+    const mapped = finding.path === undefined && Array.isArray(report.files) ? report.files.filter(file => file.fileId === finding.fileId && (finding.batchSnapshotId === undefined || file.batchSnapshotId === finding.batchSnapshotId)) : [];
+    const findingPath = path(finding.path ?? (mapped.length === 1 ? mapped[0].path : undefined)), anchor = finding.anchor;
+    if (!record(anchor) || !['line', 'property', 'file'].includes(anchor.kind)) fail('invalid current anchor');
+    if (findingPath === '.' && !['property', 'file'].includes(anchor.kind)) fail('root findings require property or file anchor');
+    const side = anchor.kind === 'line' ? anchor.side : anchor.kind;
+    if (anchor.kind === 'line' && (!['old', 'new'].includes(side) || !text(anchor.snippet))) fail('missing exact snippet/side');
+    if (anchor.kind === 'property' && !text(anchor.name)) fail('missing exact property');
+    for (const key of ['evidence', 'trigger', 'impact']) if (!text(finding[key])) fail('missing defect claim');
+    const a = finding.attribution;
+    const causal = ['beforeBehavior', 'afterBehavior', 'reason'].map(key => {
+      if (a?.[key] !== undefined && !text(a[key])) fail('invalid causal claim');
+      return a?.[key] ?? null;
+    });
+    // Qualified interaction refs differentiate cross-file claims without transferring receipts.
+    const interaction = finding.interaction?.editRefs;
+    if (interaction !== undefined) {
+      list(interaction);
+      for (const ref of interaction) if (!record(ref) || !text(ref.fileId) || !text(ref.editId)) fail('invalid interaction claim');
+    }
+    const claimHash = digest([finding.evidence, finding.trigger, finding.impact, causal, interaction?.map(ref => [ref.fileId, ref.editId]).sort() ?? null]);
+    const anchorHash = digest(anchor.kind === 'line' ? anchor.snippet : anchor.kind === 'property' ? anchor.name : 'file');
+    const matchable = anchor.kind !== 'file';
+    const id = digest([identity.repository, findingPath, side, anchorHash, claimHash, matchable ? null : chainOrigin, matchable ? null : cycle]);
+    const existing = rows.get(id);
+    if (existing) { existing.observation = existing.firstSeen === cycle ? 'new' : 'repeated'; existing.lastSeen = cycle; existing.findingIndices.push(index); }
+    else rows.set(id, { id, path: findingPath, side, anchorHash, claimHash, matchable, firstSeen: cycle, lastSeen: cycle, observation: 'new', findingIndices: [index], humanDecisions: [] });
+  });
+  const outcomes = options.outcomes ?? [];
+  list(outcomes);
+  const decided = new Set();
+  for (const outcome of outcomes) {
+    exact(outcome, ['id', 'decision', 'reason']);
+    const item = rows.get(outcome.id);
+    if (!item || decided.has(outcome.id)) fail('unknown or duplicate outcome id');
+    decided.add(outcome.id);
+    item.humanDecisions.push(decisionValue({ decision: outcome.decision, reason: outcome.reason, cycle }));
+  }
+  if (rows.size > LIMIT) fail('excessive historical findings');
+  return freeze({ schemaVersion: 1, identity, originSnapshotId, chainOrigin, cycle, maxCycles: MAX_CYCLES, nextAction: cycle === MAX_CYCLES ? 'step-back' : 'human-review', trust: TRUST, snapshotId: report.snapshotId, findings: [...rows.values()] });
+}
+
+function snapshotMetadata(value) {
+  exact(value, ['identity', 'snapshotId', 'files']);
+  const identity = identityValue(value.identity);
+  if (!text(value.snapshotId)) fail('invalid snapshot metadata');
+  list(value.files);
+  const files = new Map();
+  for (const file of value.files) {
+    exact(file, ['path', 'hash', 'dependencies']);
+    const name = path(file.path);
+    if (files.has(name) || file.hash !== undefined && !hash(file.hash)) fail('invalid or duplicate source hash');
+    const dependencies = file.dependencies;
+    if (dependencies !== undefined) {
+      list(dependencies);
+      const seen = new Set();
+      for (const dep of dependencies) {
+        exact(dep, ['path', 'hash']); path(dep.path);
+        if (seen.has(dep.path) || dep.hash !== undefined && !hash(dep.hash)) fail('invalid dependency');
+        seen.add(dep.path);
+      }
+    }
+    files.set(name, file);
+  }
+  return { identity, files };
+}
+
+/** Explicit complete dependency lists are caller-supplied metadata, not discovery
+ * or proof. Unknown/changing deps conservatively invalidate their transitive users.
+ * Even unchanged paths are navigation only, never full coverage or reused evidence.
+ */
+export function planIncrementalReview(previous, current) {
+  const old = snapshotMetadata(previous), next = snapshotMetadata(current);
+  sameIdentity(old.identity, next.identity);
+  const safe = new Set();
+  for (const [name, file] of next.files) {
+    const before = old.files.get(name);
+    if (!before || !hash(file.hash) || file.hash !== before.hash || !Array.isArray(file.dependencies) || !Array.isArray(before.dependencies)) continue;
+    const deps = list => list.map(dep => [dep.path, dep.hash]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
+    if (JSON.stringify(deps(file.dependencies)) !== JSON.stringify(deps(before.dependencies))) continue;
+    if (file.dependencies.every(dep => hash(dep.hash) && next.files.get(dep.path)?.hash === dep.hash && old.files.get(dep.path)?.hash === dep.hash)) safe.add(name);
+  }
+  // Fixed point is cycle-safe: an unchanged, fully-known dependency cycle is safe
+  // navigation; any unknown/changed member invalidates every reachable dependent.
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const name of safe) if (next.files.get(name).dependencies.some(dep => !safe.has(dep.path))) { safe.delete(name); changed = true; }
+  }
+  return freeze({ freshReviewPaths: [...next.files.keys()].filter(name => !safe.has(name)), unchangedNavigationPaths: [...next.files.keys()].filter(name => safe.has(name)), removedPaths: [...old.files.keys()].filter(name => !next.files.has(name)), coverage: false, trust: TRUST, requiresFreshEvidence: true });
+}

package/src/host-review-children.mjs

@@ -0,0 +1,100 @@
+import { randomUUID } from 'node:crypto';
+import { modelResultTools } from './model-tools.mjs';
+import { childOutputSchema } from './child-output-schema.mjs';
+import { parseRetrievalResponse, executeRetrievalBatch } from './retrieval-protocol.mjs';
+import { registerReviewChild } from './review-child-broker.mjs';
+
+export const REVIEW_CHILD_PRESET = 'dsh-code-review-restricted';
+const failure = (code, message) => Object.assign(new Error(message), { code });
+// One managed spawn activation owns the entire primary loop, including snapshot tools.
+// No credentials or free-form filesystem tools are passed into that activation.
+export function createHostReviewChildren(ctx) {
+  let ready, unregisterPreset;
+  const service = () => ctx.get?.('subagents');
+  const presets = () => ctx.get?.('agentPresets');
+  function capability() {
+    const runtime = service(), provider = runtime?.getProvider?.('spawn');
+    return !!(provider?.capabilities?.outputSchema && provider.capabilities.agentPreset && provider.capabilities.agentOptions && runtime.resolveMaxDepth && presets()?.register && ctx.get?.('agents')?.get);
+  }
+  async function prepare() {
+    if (!capability()) throw failure('REVIEW_SUBAGENTS_UNAVAILABLE', 'Restricted host spawn subagents are unavailable; no hidden direct fallback');
+    ready ??= presets().register({ id: REVIEW_CHILD_PRESET, name: 'Read-only snapshot review', plugins: [
+      { name: '@deepseek-ai/dsh-tool-executor-native' },
+      { name: '@feng0531/dsh-code-review/child' },
+    ] }).then(dispose => { unregisterPreset = dispose; });
+    await ready;
+  }
+  return { capability, prepare,
+    async create({ parent, route, cwd, signal }) {
+      await prepare(); signal.throwIfAborted();
+      const runtime = service(), childId = randomUUID();
+      let handle, revoked, stop, started = false;
+      const child = { transport: 'host-subagent', childId,
+        async runPrimary({ request, scope, maxRounds, maxInputBytes, reserveModelCall, onRetrieved, onBudgetLimited, onTruncated, onProgress }) {
+          if (started) throw new Error('A review child cannot be reused for another primary');
+          started = true; let rounds = 0, modelCalls = 0, bindingFatal;
+          const abortBinding = error => { bindingFatal ??= error; handle?.dispose().catch(() => {}); };
+          const assertAgent = agent => {
+            if (!agent || agent.id !== childId || agent.session.header.parentSession !== (parent.session.header.id ?? parent.id) || agent.session.header.agentPreset !== REVIEW_CHILD_PRESET) throw failure('REVIEW_CHILD_IDENTITY', 'Review child ownership changed');
+          };
+          const binding = { parent, parentId: parent.session.header.id ?? parent.id, presetId: REVIEW_CHILD_PRESET, route, assertAgent, onFatal: abortBinding,
+            beforeModelCall(options) {
+              try {
+                signal.throwIfAborted();
+                if (bindingFatal) throw bindingFatal;
+                if (options.provider !== route.provider || options.model !== route.model || options.reasoningEffort !== route.reasoningEffort) throw failure('REVIEW_CHILD_ROUTE', 'Review child model route changed');
+                // This is the complete logical LLM envelope, not provider-specific HTTP bytes.
+                const bytes = Buffer.byteLength(JSON.stringify({ system: options.system, messages: options.messages, tools: options.tools }));
+                if (bytes > maxInputBytes) throw failure('WHOLE_SCOPE_INPUT_BUDGET', 'Child logical model input exceeds approved capacity');
+                if (modelCalls >= maxRounds + 2) throw failure('WHOLE_SCOPE_MODEL_CALL_LIMIT', 'Child primary loop call limit exceeded');
+                reserveModelCall(); modelCalls++;
+              } catch (error) { abortBinding(error); throw error; }
+            },
+            executeRequests(args, exec) {
+              assertAgent(exec.agent); signal.throwIfAborted();
+              if (bindingFatal) throw bindingFatal;
+              const requests = parseRetrievalResponse(args);
+              if (rounds >= maxRounds) {
+                const info = { code: 'RETRIEVAL_ROUND_BUDGET_EXCEEDED', reason: 'Child snapshot tool rounds exhausted' };
+                onBudgetLimited?.(info); throw failure(info.code, info.reason);
+              }
+              try {
+                scope.preflight(requests);
+                const results = scope.transaction(() => executeRetrievalBatch(args, scope, signal));
+                rounds++;
+                for (const { request: operation, result } of results) {
+                  if (result.truncated) onTruncated?.();
+                  onRetrieved?.([{ kind: operation.kind, snapshotId: result.snapshotId, stage: 'retrieved-locally', sourceId: result.sourceId, hash: result.hash, start: result.start, count: result.count, resultBytes: Buffer.byteLength(JSON.stringify(result)) }]);
+                }
+                return { snapshotId: JSON.parse(request.input).snapshotId, results, budget: scope.budget() };
+              } catch (error) {
+                if (['READER_CALL_BUDGET_EXCEEDED','READER_OUTPUT_BUDGET_EXCEEDED'].includes(error.code)) onBudgetLimited?.({code:error.code,reason:error.message});
+                throw error;
+              }
+            },
+          };
+          revoked = registerReviewChild(childId, binding);
+          const finalEnvelope = JSON.parse(request.input); finalEnvelope.retrievalFinalization = { reason: 'Use review_snapshot tool for supplemental reading; structured_output submits final reviews only' };
+          const schema = childOutputSchema(modelResultTools(JSON.stringify(finalEnvelope), request.instructions)[0].parameters);
+          stop = () => { handle?.dispose().catch(() => {}); }; signal.addEventListener('abort', stop, { once: true });
+          try {
+            handle = await runtime.startActivation({ provider: 'spawn', childId, label: 'Whole-scope review batch', request: {
+              parent, cwd, agentPreset: REVIEW_CHILD_PRESET, maxDepth: runtime.resolveMaxDepth(undefined),
+              agentOptions: { ...route, maxTokens: 4096 }, outputSchema: schema,
+              prompt: [{ type: 'text', text: request.instructions + '\nUse only review_snapshot for approved catalog sources. Preserve this child context for all supplemental reads. Return final reviews via structured_output, never requests.\n' + JSON.stringify({ ...JSON.parse(request.input), catalog: scope.catalog(), retrievalBudget: scope.budget() }) }],
+            }, signal, delivery: 'caller' });
+            if (signal.aborted || bindingFatal) await handle.dispose();
+            const result = await handle.result;
+            signal.throwIfAborted(); if (bindingFatal) throw bindingFatal;
+            if (result.stopReason !== 'completed' || !result.structured) throw failure('REVIEW_CHILD_INCOMPLETE', 'Host child did not commit a structured final result');
+            await onProgress?.({stage:'host-child-complete',childId,modelCalls});
+            return result.structured;
+          } catch (error) { throw bindingFatal ?? error; } finally { signal.removeEventListener('abort', stop); }
+        },
+        async dispose() { revoked?.(); if (handle) await handle.dispose(); },
+      };
+      return child;
+    },
+    async dispose() { if (ready) await ready; await unregisterPreset?.(); },
+  };
+}