@kylecheng3146/agent-ops 0.1.6 → 0.1.7

package/README.md

@@ -261,6 +261,28 @@ For a full command reference, run `agent-ops --help`. The `task`, `verify`, and
 `review` commands support acceptance tracking and independent verification when
 the project configuration defines those workflows.
 
+### External review
+
+`agent-ops review` can hand the review to another agent CLI, so the work is not
+judged by the agent that produced it. Enable it during `agent-ops init` (the
+default is off) and pick an ordered fallback chain of targets: `codex`, `agy`
+(Antigravity), and `claude`. Each is launched with its own read-only flag, and a
+target without one is skipped rather than run unsandboxed — which is why
+`opencode` is not a review target despite being a supported harness.
+
+The first target that actually runs produces the verdict. A `FAIL` is final:
+the chain never retries elsewhere after a real verdict. `--yes` is still
+required for every run, since each run spends another provider's quota.
+
+Authentication is diagnosed, never guessed:
+
+```bash
+agent-ops doctor              # presence only: no tokens, no network
+agent-ops doctor --check-auth # one real print call per configured target
+```
+
+See [Configuration](docs/en/guides/configuration.md) for the full contract.
+
 ## Project principles
 
 - Define verifiable success before making changes.

package/dist/packages/cli/src/args.js

@@ -13,6 +13,8 @@ export const COMMAND_NAMES = [
 const COMMAND_SET = new Set(COMMAND_NAMES);
 const SCOPES = new Set(["project", "user"]);
 const PROFILES = new Set(["advisory", "core", "guardrails", "loop"]);
+// opencode is absent: it has no read-only flag, so it cannot review.
+const REVIEW_TARGETS = new Set(["agy", "claude", "codex"]);
 export class CliArgumentError extends Error {
     code;
     option;
@@ -65,8 +67,10 @@ export function parseArgs(argv) {
     let title;
     let sessionId;
     const profiles = [];
+    const reviewTargets = [];
     const criteria = [];
     const evidence = [];
+    let checkAuth = false;
     let dryRun = false;
     let json = false;
     let yes = false;
@@ -121,6 +125,18 @@ export function parseArgs(argv) {
                 index += 1;
                 break;
             }
+            case "--review-target": {
+                const value = readOptionValue(argv, index, token);
+                if (!REVIEW_TARGETS.has(value)) {
+                    invalidValue(token, value);
+                }
+                if (reviewTargets.includes(value)) {
+                    duplicate(`${token} ${value}`);
+                }
+                reviewTargets.push(value);
+                index += 1;
+                break;
+            }
             case "--task": {
                 if (taskId !== undefined) {
                     duplicate(token);
@@ -163,6 +179,12 @@ export function parseArgs(argv) {
                 index += 1;
                 break;
             }
+            case "--check-auth":
+                if (checkAuth) {
+                    duplicate(token);
+                }
+                checkAuth = true;
+                break;
             case "--dry-run":
                 if (dryRun) {
                     duplicate(token);
@@ -249,7 +271,9 @@ export function parseArgs(argv) {
             title !== undefined ||
             criteria.length > 0 ||
             evidence.length > 0 ||
+            reviewTargets.length > 0 ||
             sessionId !== undefined ||
+            checkAuth ||
             dryRun ||
             yes) {
             throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Only --json may be combined with global help or version.");
@@ -284,6 +308,12 @@ export function parseArgs(argv) {
         command !== "update") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--hook-target may be used only with init or update.");
     }
+    if (checkAuth && command !== "doctor") {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--check-auth may be used only with doctor.");
+    }
+    if (reviewTargets.length > 0 && command !== "init") {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--review-target may be used only with init.");
+    }
     if (command === "task") {
         if (harness !== undefined ||
             profiles.length > 0 ||
@@ -345,9 +375,11 @@ export function parseArgs(argv) {
         ...(taskId === undefined ? {} : { taskId }),
         ...(targetVersion === undefined ? {} : { targetVersion }),
         ...(title === undefined ? {} : { title }),
+        ...(reviewTargets.length === 0 ? {} : { reviewTargets }),
         ...(criteria.length === 0 ? {} : { criteria }),
         ...(evidence.length === 0 ? {} : { evidence }),
         ...(sessionId === undefined ? {} : { sessionId }),
+        ...(checkAuth ? { checkAuth } : {}),
         dryRun,
         json,
         yes

package/dist/packages/cli/src/bin.js

@@ -29,6 +29,9 @@ import { formatInstallPlan, runInitCommand } from "./commands/init.js";
 import { formatUninstallPlan, runUninstallCommand } from "./commands/uninstall.js";
 import { runTaskCommand } from "./commands/task.js";
 import { runReviewCommand } from "./commands/review.js";
+import { createReviewExecutor } from "../../../runtime/src/review/execute.js";
+import { probeReviewTarget } from "../../../runtime/src/review/probe.js";
+import { resolveReviewRole } from "../../../runtime/src/review/roles.js";
 import { runTrustCommand } from "./commands/trust.js";
 import { runVerifyCommand } from "./commands/verify.js";
 import { formatUpdatePlan, runUpdateCommand } from "./commands/update.js";
@@ -139,8 +142,12 @@ else {
                                 sources: await hookSources(root, args.scope === "user" ? "user" : "project")
                             }),
                             repositoryTrust: async () => repositoryTrustStatus(await repositoryTrust(root, config, CLI_VERSION)),
-                            smokeAvailability: () => smokeAvailabilityStatus(config)
-                        }
+                            smokeAvailability: () => smokeAvailabilityStatus(config),
+                            reviewTarget: async (target, deep) => await probeReviewTarget(target, { cwd: root, deep })
+                        },
+                        ...(args.checkAuth === true
+                            ? { checkReviewTargetAuth: true }
+                            : {})
                     });
                 }
                 if (args.command === "uninstall") {
@@ -179,9 +186,37 @@ else {
                     });
                 }
                 if (args.command === "review") {
+                    const reviewSessionId = process.env.AGENT_OPS_SESSION_ID;
+                    const reviewConfig = (await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config;
+                    const reviewRole = resolveReviewRole("independent-review", reviewConfig.reviewRoles ?? []);
                     return await runReviewCommand({
                         args,
-                        authorized: args.yes
+                        authorized: args.yes,
+                        tasks: taskService,
+                        ...(reviewSessionId === undefined
+                            ? {}
+                            : { sessionId: reviewSessionId }),
+                        ...(reviewConfig.reviewRoles === undefined
+                            ? {}
+                            : { roles: reviewConfig.reviewRoles }),
+                        execute: createReviewExecutor({
+                            targets: reviewRole?.targets ?? [],
+                            cwd: root,
+                            ...(reviewRole?.model === undefined
+                                ? {}
+                                : { model: reviewRole.model }),
+                            ...(reviewRole?.effort === undefined
+                                ? {}
+                                : { effort: reviewRole.effort }),
+                            ...(reviewRole?.timeoutMs === undefined
+                                ? {}
+                                : { timeoutMs: reviewRole.timeoutMs }),
+                            onProgress: (line) => {
+                                if (!args.json) {
+                                    process.stderr.write(`${line}\n`);
+                                }
+                            }
+                        })
                     });
                 }
                 if (args.command === "config") {

package/dist/packages/cli/src/cli.js

@@ -2,6 +2,7 @@ import { CliArgumentError, parseArgs } from "./args.js";
 import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { errorEnvelope, okEnvelope, writeEnvelope } from "./output.js";
 import { completeInitChoices } from "./wizard.js";
+import { probeReviewTarget } from "../../../runtime/src/review/probe.js";
 import { BANNER } from "./ui.js";
 export function renderWelcome(color) {
     const cyan = color ? "\u001b[36m" : "";
@@ -32,6 +33,10 @@ Options:
   --harness <all|both|claude|codex|opencode|comma-separated>  Init/update
   --hook-target <harness=surface-id>  Repeatable advanced init/update option
   --profile <core|advisory|guardrails|loop>  Repeatable
+  --review-target <codex|agy|claude>  Repeatable init option; external review
+                                      targets in fallback-chain order
+  --check-auth                        Doctor only: probe each review target's
+                                      authentication with one real call
   --task <id>
   --target-version <version>          Update target version (offline-capable)
   --title <text>
@@ -76,7 +81,13 @@ export async function runCli(argv, io, services) {
     }
     try {
         if (args.command === "init") {
-            args = await completeInitChoices(args, args.json ? { ...io, isTTY: false } : io);
+            args = await completeInitChoices(args, args.json ? { ...io, isTTY: false } : io, {
+                probeReviewTarget: async (target) => (await probeReviewTarget(target, {
+                    cwd: process.cwd(),
+                    deep: true
+                })) === "ok",
+                warn: (message) => io.writeStderr(`${message}\n`)
+            });
         }
         const execute = args.command === "help" || args.command === "version"
             ? services.execute

package/dist/packages/cli/src/commands/init.js

@@ -63,7 +63,10 @@ export async function runInitCommand(options) {
             : { hookRuntimePath: options.hookRuntimePath }),
         ...((options.hookTargets ?? args.hookTargets) === undefined
             ? {}
-            : { hookTargets: options.hookTargets ?? args.hookTargets })
+            : { hookTargets: options.hookTargets ?? args.hookTargets }),
+        ...(args.reviewTargets === undefined
+            ? {}
+            : { reviewTargets: args.reviewTargets })
     });
     if (args.dryRun) {
         return okEnvelope("INIT_PLAN_READY", {

package/dist/packages/cli/src/commands/review.js

@@ -3,18 +3,78 @@ import { runIndependentReview } from "../../../../runtime/src/review/runner.js";
 import { resolveReviewRole } from "../../../../runtime/src/review/roles.js";
 import { okEnvelope } from "../output.js";
 /**
- * Review runs against one harness. Argument parsing already rejects a
+ * Review runs against one target. Argument parsing already rejects a
  * multi-harness selection here, so the first entry is the whole selection.
+ * `opencode` is not a review target — it has no read-only flag — so selecting
+ * it leaves the target unresolved and the configured chain decides.
  */
 function harness(value) {
-    return value?.[0] ?? "codex";
+    const selected = value?.[0];
+    return selected === undefined || selected === "opencode"
+        ? undefined
+        : selected;
 }
-export async function runReviewCommand(options) {
-    const ids = options.args.criteria ?? [];
-    const criteria = ids.map((id) => ({
-        id,
-        description: id
+/**
+ * Criterion descriptions come from the task store, never from the id. A
+ * reviewer handed `criterion: tests` cannot review anything, so a review with
+ * no task context is reported as not run rather than run meaninglessly.
+ */
+async function taskContext(options) {
+    const tasks = options.tasks;
+    if (tasks === undefined) {
+        return undefined;
+    }
+    const query = options.taskId !== undefined
+        ? { taskId: options.taskId }
+        : options.sessionId === undefined
+            ? undefined
+            : { sessionId: options.sessionId };
+    if (query === undefined) {
+        return undefined;
+    }
+    let record;
+    try {
+        record = await tasks.status(query);
+    }
+    catch {
+        return undefined;
+    }
+    const requested = options.args.criteria ?? [];
+    const criteria = record.task.criteria
+        .filter((criterion) => requested.length === 0 || requested.includes(criterion.id))
+        .map((criterion) => ({
+        id: criterion.id,
+        description: criterion.description,
+        verifierIds: [...criterion.verifierIds]
     }));
+    if (criteria.length === 0 ||
+        (requested.length > 0 && criteria.length !== requested.length)) {
+        return undefined;
+    }
+    return {
+        taskId: record.task.id,
+        active: record.status === "active",
+        criteria
+    };
+}
+function notRunEnvelope(result) {
+    const message = "Independent review was not run.";
+    return {
+        code: "REVIEW_NOT_RUN",
+        status: "error",
+        data: {
+            message,
+            result,
+            text: [message, `Reason: ${result.reason ?? "unknown"}.`, ""].join("\n")
+        },
+        errors: [{ code: "REVIEW_NOT_RUN", message }]
+    };
+}
+export async function runReviewCommand(options) {
+    const role = resolveReviewRole(options.role ?? "independent-review", options.roles ?? []);
+    const selectedHarness = harness(options.args.harness);
+    const target = role?.targets[0] ?? selectedHarness ?? "codex";
+    const context = await taskContext(options);
     const evidenceRequirements = (options.args.evidence ?? []).map((value) => {
         const separator = value.indexOf("=");
         return {
@@ -22,11 +82,22 @@ export async function runReviewCommand(options) {
             requirement: separator < 0 ? value : value.slice(separator + 1)
         };
     });
-    const selectedHarness = harness(options.args.harness);
-    const role = resolveReviewRole(options.role ?? "independent-review", options.roles ?? []);
+    if (options.tasks !== undefined && context === undefined) {
+        return notRunEnvelope({
+            status: "NOT_RUN",
+            reason: "no-task-context",
+            harness: target,
+            model: role?.model ?? options.model ?? "configured",
+            effort: role?.effort ?? options.effort ?? "configured",
+            prompt: ""
+        });
+    }
+    const criteria = context?.criteria !== undefined
+        ? [...context.criteria]
+        : (options.args.criteria ?? []).map((id) => ({ id, description: id }));
     const result = await runIndependentReview({
         invocation: {
-            harness: role?.harness ?? selectedHarness,
+            harness: target,
             model: role?.model ?? options.model ?? "configured",
             effort: role?.effort ?? options.effort ?? "configured",
             packet: buildReviewPacket({
@@ -42,6 +113,17 @@ export async function runReviewCommand(options) {
             reason: "missing-cli"
         }))
     });
+    // Evidence is only appended while the task is active: a completed record
+    // must stay exactly as it was verified.
+    if (options.tasks !== undefined &&
+        context !== undefined &&
+        context.active &&
+        result.results !== undefined) {
+        await options.tasks.recordEvidence(context.taskId, Object.fromEntries(result.results.map((item) => [
+            item.criterionId,
+            item.evidence.map((reference) => `review:${target}:${reference}`)
+        ])));
+    }
     const message = result.status === "PASS"
         ? "Independent review passed."
         : result.status === "FAIL"
@@ -55,6 +137,11 @@ export async function runReviewCommand(options) {
             `Status: ${result.status}`,
             `Harness: ${result.harness}; model: ${result.model}; effort: ${result.effort}.`,
             ...(result.reason === undefined ? [] : [`Reason: ${result.reason}.`]),
+            ...(result.status === "NOT_RUN"
+                ? [
+                    "Run: agent-ops doctor --check-auth to verify target authentication."
+                ]
+                : []),
             ...(result.results === undefined
                 ? []
                 : result.results.map((item) => `${item.criterionId}: ${item.status} [${item.evidence.join(", ")}]`)),

package/dist/packages/cli/src/version.js

@@ -1,3 +1,3 @@
 // Single source of the published CLI version. Release preparation updates
 // this constant; bin.ts and the hook entry both read it from here.
-export const CLI_VERSION = "0.1.6";
+export const CLI_VERSION = "0.1.7";

package/dist/packages/cli/src/wizard.js

@@ -1,9 +1,49 @@
 import { CliArgumentError } from "./args.js";
+import { DEFAULT_REVIEW_TARGETS } from "../../../runtime/src/review/roles.js";
 import { HARNESS_IDS, resolveHarnessSelection } from "../../../runtime/src/install/harness.js";
 import { selectOption, selectOptions } from "./ui.js";
 const SCOPES = new Set(["project", "user"]);
 const PROFILES = new Set(["advisory", "core", "guardrails", "loop"]);
 const DEFAULT_HARNESS = [];
+const REVIEW_TARGET_SET = new Set(DEFAULT_REVIEW_TARGETS);
+const REVIEW_TARGET_CHOICES = DEFAULT_REVIEW_TARGETS.map((id) => ({
+    label: id,
+    value: id,
+    description: id === "codex"
+        ? "Runs with -s read-only; stdout is the bare final message."
+        : id === "agy"
+            ? "Antigravity CLI; runs with --sandbox --mode plan."
+            : "Runs with --permission-mode plan; tried last when it is the host."
+}));
+function selectReviewTargets(raw) {
+    const values = raw
+        .split(",")
+        .map((value) => value.trim())
+        .filter((value) => value.length > 0);
+    for (const value of values) {
+        if (!REVIEW_TARGET_SET.has(value)) {
+            throw new CliArgumentError("CLI_INVALID_VALUE", `Invalid review target: ${value}`, "--review-target");
+        }
+    }
+    // Declared order wins: the chain order is the option list, not click order.
+    return DEFAULT_REVIEW_TARGETS.filter((target) => values.includes(target));
+}
+function affirmative(raw) {
+    return /^(y|yes)$/i.test(raw.trim());
+}
+async function probeReviewTargets(targets, setup) {
+    const probe = setup.probeReviewTarget;
+    if (probe === undefined) {
+        return;
+    }
+    for (const target of targets) {
+        if (!(await probe(target))) {
+            setup.warn?.(`${target} is not usable yet (missing or unauthenticated). ` +
+                `Install it or run: ${target} login, ` +
+                "then: agent-ops doctor --check-auth");
+        }
+    }
+}
 const SCOPE_CHOICES = [
     { label: "project", value: "project" },
     { label: "user", value: "user" }
@@ -83,7 +123,7 @@ function selectProfiles(raw) {
     }
     return values;
 }
-export async function completeInitChoices(args, io) {
+export async function completeInitChoices(args, io, setup = {}) {
     if (args.command !== "init" ||
         (args.scope !== undefined &&
             args.harness !== undefined &&
@@ -117,11 +157,25 @@ export async function completeInitChoices(args, io) {
                 selectAllLabel: "Select all",
                 selectAllDescription: "Enable core, advisory, guardrails, and loop together."
             });
+        const enabled = args.reviewTargets !== undefined ||
+            (await selectOption("External review: call another agent CLI to review your work?", [
+                { label: "no", value: false, description: "Default. Nothing is spawned." },
+                {
+                    label: "yes",
+                    value: true,
+                    description: "Pick target CLIs; each is probed for authentication."
+                }
+            ], selectorIo));
+        const reviewTargets = args.reviewTargets ?? (enabled
+            ? await selectOptions("Review targets (multi-select: tried in listed order)", REVIEW_TARGET_CHOICES, selectorIo, [])
+            : []);
+        await probeReviewTargets(reviewTargets, setup);
         return {
             ...args,
             scope,
             harness,
-            profiles
+            profiles,
+            ...(reviewTargets.length === 0 ? {} : { reviewTargets })
         };
     }
     const session = await createPromptSession(io);
@@ -133,11 +187,16 @@ export async function completeInitChoices(args, io) {
         const profiles = args.profiles.length > 0
             ? args.profiles
             : selectProfiles(await session.question("Profiles (core,advisory,guardrails,loop) [core]: "));
+        const reviewTargets = args.reviewTargets ?? (affirmative(await session.question("Enable external review by another agent CLI? [y/N]: "))
+            ? selectReviewTargets(await session.question(`Review targets (${DEFAULT_REVIEW_TARGETS.join(",")}): `))
+            : []);
+        await probeReviewTargets(reviewTargets, setup);
         return {
             ...args,
             scope,
             harness,
-            profiles
+            profiles,
+            ...(reviewTargets.length === 0 ? {} : { reviewTargets })
         };
     }
     finally {

package/dist/runtime/src/config/merge.js

@@ -107,6 +107,7 @@ export function mergeConfigLayers(inputLayers) {
     const commands = new Map();
     const mappings = new Map();
     const exceptions = new Map();
+    const reviewRoles = new Map();
     let schemaVersion;
     let features;
     for (const layer of layers) {
@@ -128,6 +129,12 @@ export function mergeConfigLayers(inputLayers) {
             }
             mappings.set(key, effective(mapping, layer));
         }
+        // Keyed by role so a project can override one role without inheriting the
+        // rest. Review targets are a capability choice, not a guardrail, so no
+        // monotonic restriction applies.
+        for (const reviewRole of layer.config.reviewRoles ?? []) {
+            reviewRoles.set(reviewRole.role, effective(reviewRole, layer));
+        }
         for (const securityException of layer.config.securityExceptions) {
             const key = exceptionKey(securityException);
             const existing = exceptions.get(key);
@@ -150,7 +157,8 @@ export function mergeConfigLayers(inputLayers) {
         profiles: [...profiles.values()],
         verificationCommands: [...commands.values()],
         pathMappings: [...mappings.values()],
-        securityExceptions: [...exceptions.values()]
+        securityExceptions: [...exceptions.values()],
+        reviewRoles: [...reviewRoles.values()]
     };
     const config = {
         schemaVersion: schemaVersion.value,
@@ -160,7 +168,14 @@ export function mergeConfigLayers(inputLayers) {
         },
         features: provenance.features.value,
         pathMappings: provenance.pathMappings.map(({ value }) => value),
-        securityExceptions: provenance.securityExceptions.map(({ value }) => value)
+        securityExceptions: provenance.securityExceptions.map(({ value }) => value),
+        // Absent, not empty: an empty array would read as "configured with no
+        // targets" rather than "external review disabled".
+        ...(provenance.reviewRoles.length === 0
+            ? {}
+            : {
+                reviewRoles: provenance.reviewRoles.map(({ value }) => value)
+            })
     };
     const validation = validateConfig(config);
     if (!validation.ok) {

package/dist/runtime/src/install/doctor.js

@@ -338,6 +338,46 @@ async function checkRegistrationDrift(root, manifest, config) {
         return check("registration-drift", "UNKNOWN", "Hook registration drift could not be assessed safely.");
     }
 }
+/**
+ * Guidance lives in `message` rather than a `remediation` field: as of this
+ * check, `remediation` does not exist on DoctorCheck. Because target
+ * authentication failures surface as one unexplained review failure — the
+ * chain deliberately does not sniff stderr for "not logged in" — this text is
+ * the operator's only route out, so it names the exact command.
+ */
+async function checkReviewTargets(config, probe, checkAuth) {
+    const targets = config?.reviewRoles?.find((role) => role.role === "independent-review")?.targets ?? [];
+    if (targets.length === 0) {
+        return check("review-targets", "PASS", "External review disabled. Re-run agent-ops init to enable.");
+    }
+    if (probe === undefined) {
+        return check("review-targets", "PASS", `External review targets: ${targets.join(", ")}. ` +
+            "Login state unverified; run: agent-ops doctor --check-auth");
+    }
+    for (const target of targets) {
+        const result = await probe(target, checkAuth);
+        if (result === "missing-executable") {
+            return check("review-targets", "FAIL", `${target} not found. Install it, or remove "${target}" from ` +
+                "reviewRoles[].targets.", "UPDATE_REQUIRED");
+        }
+        if (result === "ineligible") {
+            return check("review-targets", "FAIL", `${target} has no read-only mode and cannot review. Remove ` +
+                `"${target}" from reviewRoles[].targets.`, "UPDATE_REQUIRED");
+        }
+        if (result === "timeout") {
+            return check("review-targets", "FAIL", `${target} did not answer in time. Re-run: ` +
+                "agent-ops doctor --check-auth", "UPDATE_REQUIRED");
+        }
+        if (checkAuth && result !== "ok") {
+            return check("review-targets", "FAIL", `${target} is installed but not authenticated, or it rejected the ` +
+                `call. Run: ${target} login`, "UPDATE_REQUIRED");
+        }
+    }
+    return check("review-targets", "PASS", checkAuth
+        ? `External review targets authenticated: ${targets.join(", ")}.`
+        : `External review targets: ${targets.join(", ")}. ` +
+            "Login state unverified; run: agent-ops doctor --check-auth");
+}
 export async function doctorInstallation(options) {
     const manifest = await checkManifest(options.root);
     const config = await checkConfig(options.root);
@@ -355,7 +395,8 @@ export async function doctorInstallation(options) {
         await checkProbe("hook-registration", options.probes?.hookRegistration),
         checkLifecycleSummary(manifest.manifest, config.config),
         await checkProbe("repository-trust", options.probes?.repositoryTrust),
-        await checkProbe("smoke-availability", options.probes?.smokeAvailability)
+        await checkProbe("smoke-availability", options.probes?.smokeAvailability),
+        await checkReviewTargets(config.config, options.probes?.reviewTarget, options.checkReviewTargetAuth === true)
     ];
     return {
         checks,

package/dist/runtime/src/install/plan.js

@@ -40,7 +40,12 @@ async function readCurrentFile(root, path) {
         throw error;
     }
 }
-function formatConfig(profiles, existing) {
+function formatConfig(profiles, existing, reviewTargets = []) {
+    // Absent reviewRoles means external review is disabled; an empty selection
+    // must therefore omit the field rather than write an empty array.
+    const reviewRoles = reviewTargets.length > 0
+        ? [{ role: "independent-review", targets: [...reviewTargets] }]
+        : existing?.reviewRoles;
     return `${JSON.stringify({
         schemaVersion: CONFIG_SCHEMA_VERSION,
         profiles,
@@ -51,10 +56,11 @@ function formatConfig(profiles, existing) {
             }
         },
         pathMappings: existing?.pathMappings ?? [],
-        securityExceptions: existing?.securityExceptions ?? []
+        securityExceptions: existing?.securityExceptions ?? [],
+        ...(reviewRoles === undefined ? {} : { reviewRoles })
     }, null, 2)}\n`;
 }
-async function planConfig(root, profiles, existingManifest, suppliedConfig) {
+async function planConfig(root, profiles, existingManifest, suppliedConfig, reviewTargets = []) {
     const current = await readCurrentFile(root, CONFIG_PATH);
     const owned = findOwnedArtifact(existingManifest, CONFIG_PATH);
     if (current !== null && owned === undefined) {
@@ -86,7 +92,7 @@ async function planConfig(root, profiles, existingManifest, suppliedConfig) {
         }
         existingConfig = result.value;
     }
-    const content = formatConfig(profiles, existingConfig);
+    const content = formatConfig(profiles, existingConfig, reviewTargets);
     return {
         operation: {
             kind: "write",
@@ -413,7 +419,7 @@ export async function createInstallPlan(options) {
         : [];
     const operations = [];
     const artifacts = [];
-    const config = await planConfig(options.root, resolved.profiles, existing?.manifest ?? null, options.existingConfig);
+    const config = await planConfig(options.root, resolved.profiles, existing?.manifest ?? null, options.existingConfig, options.reviewTargets ?? []);
     operations.push(config.operation);
     artifacts.push(config.record);
     for (const artifact of contribution.artifacts) {