@kyo-so/cli 0.10.0 → 0.11.0

package/dist/bin/kyoso.js

@@ -183945,10 +183945,12 @@ function matchesPathPattern(path, patterns, mode) {
 
 // src/core/constants.ts
 var DEFAULT_AGENT_TIMEOUT_MS = 120000;
+var MAX_AGENT_OUTPUT_BYTES = 1048576;
+var JUDGE_MAX_OUTPUT_TOKENS = 4096;
 var RAW_OUTPUT_MAX_CHARS = 16384;
 var TRACE_DIR = ".kyoso/traces";
 var KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
-var KYOSO_VERSION = "0.10.0";
+var KYOSO_VERSION = "0.11.0";
 
 // src/utils/pathContainment.ts
 import { resolve, sep as sep2 } from "node:path";
@@ -184345,7 +184347,7 @@ var defaultConfig = {
     }
   },
   judge: {
-    mode: "deterministic_plus_llm",
+    mode: "deterministic_only",
     provider: "auto",
     timeoutMs: 60000
   },
@@ -184355,6 +184357,13 @@ var defaultConfig = {
     timeoutMs: 90000,
     allowDemotion: false
   },
+  reviewBudget: {
+    maxModelCalls: 4,
+    maxTotalWallTimeMs: 480000,
+    maxAgentOutputBytes: 65536,
+    maxFindingsPerAgent: 10,
+    skipOptionalPhasesWhenTokenUsageUnknown: true
+  },
   audit: {
     enabled: true,
     format: "jsonl",
@@ -184412,7 +184421,7 @@ function collectProjectScopeViolations(config2) {
   const violations = [];
   for (const leaf of leaves) {
     const path = leaf.path.join(".");
-    const globalOnlyReason = PROJECT_GLOBAL_ONLY_REASONS[path];
+    const globalOnlyReason = projectGlobalOnlyReason(leaf.path);
     if (globalOnlyReason) {
       violations.push({ path, reason: globalOnlyReason });
       continue;
@@ -184427,6 +184436,15 @@ function collectProjectScopeViolations(config2) {
   }
   return violations.sort((left, right) => left.path.localeCompare(right.path));
 }
+function projectGlobalOnlyReason(path) {
+  const exactReason = PROJECT_GLOBAL_ONLY_REASONS[path.join(".")];
+  if (exactReason)
+    return exactReason;
+  if (path[0] === "reviewBudget") {
+    return "must be a user-global review budget ceiling";
+  }
+  return;
+}
 function isAllowedProjectPath(path) {
   const [top, second, third, fourth] = path;
   if (isAllowedConfigOverridePath(path))
@@ -184599,6 +184617,13 @@ var codexAgentSchema = baseAgentSchema.extend({
     }
   });
 });
+var reviewBudgetSchema = exports_external.object({
+  maxModelCalls: exports_external.number().int().positive(),
+  maxTotalWallTimeMs: exports_external.number().int().positive(),
+  maxAgentOutputBytes: exports_external.number().int().positive().max(MAX_AGENT_OUTPUT_BYTES),
+  maxFindingsPerAgent: exports_external.number().int().positive(),
+  skipOptionalPhasesWhenTokenUsageUnknown: exports_external.boolean()
+});
 var kyosoConfigSchema = exports_external.object({
   entrypoints: exports_external.object({
     mcp: exports_external.boolean(),
@@ -184656,6 +184681,7 @@ var kyosoConfigSchema = exports_external.object({
     timeoutMs: exports_external.number().int().positive().default(90000),
     allowDemotion: exports_external.boolean().default(false)
   }),
+  reviewBudget: reviewBudgetSchema,
   audit: exports_external.object({
     enabled: exports_external.boolean(),
     format: exports_external.literal("jsonl"),
@@ -184663,6 +184689,15 @@ var kyosoConfigSchema = exports_external.object({
     includeRawAgentOutput: exports_external.boolean(),
     includeFileContents: exports_external.boolean()
   })
+}).superRefine((config2, context) => {
+  const enabledPrimaryReviewers = Object.values(config2.agents).filter((agent) => agent.enabled).length;
+  if (config2.reviewBudget.maxModelCalls >= enabledPrimaryReviewers)
+    return;
+  context.addIssue({
+    code: exports_external.ZodIssueCode.custom,
+    path: ["reviewBudget", "maxModelCalls"],
+    message: "must be greater than or equal to the number of enabled primary reviewers."
+  });
 });
 function agentConfigLeafPaths(agent) {
   const paths = [
@@ -184721,6 +184756,11 @@ var kyosoConfigKnownLeafPaths = [
   "verification.maxFindings",
   "verification.timeoutMs",
   "verification.allowDemotion",
+  "reviewBudget.maxModelCalls",
+  "reviewBudget.maxTotalWallTimeMs",
+  "reviewBudget.maxAgentOutputBytes",
+  "reviewBudget.maxFindingsPerAgent",
+  "reviewBudget.skipOptionalPhasesWhenTokenUsageUnknown",
   "audit.enabled",
   "audit.format",
   "audit.directory",
@@ -184740,6 +184780,7 @@ var kyosoConfigSecuritySensitivePrefixes = [
   "secrets",
   "securityReview",
   "verification",
+  "reviewBudget",
   "workspace"
 ];
 
@@ -186203,6 +186244,33 @@ async function exists2(path) {
   }
 }
 
+// src/core/tokenUsage.ts
+var TOKEN_USAGE_KEYS = [
+  "totalTokens",
+  "inputTokens",
+  "outputTokens",
+  "thoughtTokens",
+  "cachedReadTokens",
+  "cachedWriteTokens"
+];
+function normalizeModelTokenUsage(usage) {
+  if (!isRecord4(usage))
+    return;
+  const normalized = {};
+  for (const key of TOKEN_USAGE_KEYS) {
+    const value = usage[key];
+    if (isTokenCount(value))
+      normalized[key] = value;
+  }
+  return Object.keys(normalized).length > 0 ? normalized : undefined;
+}
+function isTokenCount(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/judge/prompt.ts
 var ANALYSIS_MAX_ITEMS = 5;
 var ANALYSIS_MAX_CHARS = 500;
@@ -186251,7 +186319,7 @@ function parseJudgeOutput(text, fallbackSummaryText) {
   const parsed = JSON.parse(json2);
   const summaryText = typeof parsed.summaryText === "string" && parsed.summaryText.trim().length > 0 ? sanitizeText(parsed.summaryText) : fallbackSummaryText;
   const disagreementComments = Array.isArray(parsed.disagreementComments) ? parsed.disagreementComments.flatMap((item) => {
-    if (!isRecord4(item) || typeof item.topic !== "string" || typeof item.judgeComment !== "string") {
+    if (!isRecord5(item) || typeof item.topic !== "string" || typeof item.judgeComment !== "string") {
       return [];
     }
     return [
@@ -186267,7 +186335,7 @@ function parseJudgeOutput(text, fallbackSummaryText) {
   return { summaryText, disagreementComments, analysis };
 }
 function parseAnalysis(value) {
-  if (!isRecord4(value))
+  if (!isRecord5(value))
     return;
   if (!Array.isArray(value.blindSpots) || !Array.isArray(value.contradictions) || !Array.isArray(value.partialCoverage)) {
     return;
@@ -186275,7 +186343,7 @@ function parseAnalysis(value) {
   return {
     blindSpots: value.blindSpots.slice(0, ANALYSIS_MAX_ITEMS).flatMap((item) => typeof item === "string" ? [sanitizeAnalysisText(item)] : []),
     contradictions: value.contradictions.slice(0, ANALYSIS_MAX_ITEMS).flatMap((item) => {
-      if (!isRecord4(item) || typeof item.topic !== "string" || typeof item.detail !== "string") {
+      if (!isRecord5(item) || typeof item.topic !== "string" || typeof item.detail !== "string") {
         return [];
       }
       return [
@@ -186286,7 +186354,7 @@ function parseAnalysis(value) {
       ];
     }),
     partialCoverage: value.partialCoverage.slice(0, ANALYSIS_MAX_ITEMS).flatMap((item) => {
-      if (!isRecord4(item) || typeof item.note !== "string")
+      if (!isRecord5(item) || typeof item.note !== "string")
         return [];
       const findingId = typeof item.findingId === "string" ? sanitizeAnalysisText(item.findingId) : undefined;
       return [
@@ -186333,7 +186401,7 @@ function extractFirstJsonObject(text) {
   }
   return;
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -186351,7 +186419,7 @@ async function runAnthropicJudge(input2, timeoutMs) {
     },
     body: JSON.stringify({
       model: input2.env.KYOSO_ANTHROPIC_JUDGE_MODEL ?? "claude-haiku-4-5",
-      max_tokens: 4096,
+      max_tokens: JUDGE_MAX_OUTPUT_TOKENS,
       temperature: 0,
       messages: [
         {
@@ -186367,7 +186435,21 @@ async function runAnthropicJudge(input2, timeoutMs) {
   const content = payload.content?.find((item) => item.type === "text" && item.text)?.text;
   if (!content)
     throw new Error("Anthropic judge response did not include text content.");
-  return parseJudgeOutput(content, input2.summaryText);
+  const usage = normalizeUsage(payload.usage);
+  return {
+    output: parseJudgeOutput(content, input2.summaryText),
+    ...usage ? { usage } : {}
+  };
+}
+function normalizeUsage(usage) {
+  if (!usage)
+    return;
+  return normalizeModelTokenUsage({
+    inputTokens: usage.input_tokens,
+    outputTokens: usage.output_tokens,
+    cachedReadTokens: usage.cache_read_input_tokens,
+    cachedWriteTokens: usage.cache_creation_input_tokens
+  });
 }
 async function fetchWithTimeout(url2, init, timeoutMs) {
   const controller = new AbortController;
@@ -186411,6 +186493,7 @@ async function runOpenAiJudge(input2, timeoutMs) {
           content: buildJudgePrompt(input2.tool, input2.result, input2.summaryText, input2.agentFindings)
         }
       ],
+      max_completion_tokens: JUDGE_MAX_OUTPUT_TOKENS,
       temperature: 0
     })
   }, timeoutMs);
@@ -186420,7 +186503,22 @@ async function runOpenAiJudge(input2, timeoutMs) {
   const content = payload.choices?.[0]?.message?.content;
   if (!content)
     throw new Error("OpenAI judge response did not include content.");
-  return parseJudgeOutput(content, input2.summaryText);
+  const usage = normalizeUsage2(payload.usage);
+  return {
+    output: parseJudgeOutput(content, input2.summaryText),
+    ...usage ? { usage } : {}
+  };
+}
+function normalizeUsage2(usage) {
+  if (!usage)
+    return;
+  return normalizeModelTokenUsage({
+    totalTokens: usage.total_tokens,
+    inputTokens: usage.prompt_tokens,
+    outputTokens: usage.completion_tokens,
+    cachedReadTokens: usage.prompt_tokens_details?.cached_tokens,
+    thoughtTokens: usage.completion_tokens_details?.reasoning_tokens
+  });
 }
 async function fetchWithTimeout2(url2, init, timeoutMs) {
   const controller = new AbortController;
@@ -186462,8 +186560,13 @@ async function runJudge(input2) {
     return { provider, status: "deterministic_fallback", output: fallback };
   }
   try {
-    const output2 = provider === "openai" ? await runOpenAiJudge(input2, input2.config.timeoutMs) : await runAnthropicJudge(input2, input2.config.timeoutMs);
-    return { provider, status: "completed", output: output2 };
+    const output2 = provider === "openai" ? await runOpenAiJudge(input2, input2.timeoutMs ?? input2.config.timeoutMs) : await runAnthropicJudge(input2, input2.timeoutMs ?? input2.config.timeoutMs);
+    return {
+      provider,
+      status: "completed",
+      output: output2.output,
+      ...output2.usage ? { usage: output2.usage } : {}
+    };
   } catch (error51) {
     return {
       provider,
@@ -186714,9 +186817,9 @@ var PLUGIN_RUNTIME_COMPATIBILITY_SCHEMA_VERSION = 1;
 var MINIMUM_SUPPORTED_CODEX_VERSION = "0.144.0-alpha.4";
 var PLUGIN_RUNTIME_EXPECTED_CONTRACT = {
   distribution: {
-    pluginVersion: "0.3.1",
+    pluginVersion: "0.4.0",
     mcpCommand: "npx",
-    mcpPackagePin: "@kyo-so/cli@0.9.1"
+    mcpPackagePin: "@kyo-so/cli@0.10.0"
   },
   marketplace: {
     name: "kyoso",
@@ -186744,6 +186847,7 @@ var PLUGIN_RUNTIME_EXPECTED_CONTRACT = {
         "CODEX_API_KEY",
         "CODEX_HOME",
         "CODEX_ACCESS_TOKEN",
+        "OPENROUTER_API_KEY",
         "ANTHROPIC_API_KEY",
         "CLAUDE_CODE_OAUTH_TOKEN"
       ],
@@ -186760,6 +186864,7 @@ var PLUGIN_RUNTIME_EXPECTED_CONTRACT = {
         "CODEX_API_KEY",
         "CODEX_HOME",
         "CODEX_ACCESS_TOKEN",
+        "OPENROUTER_API_KEY",
         "ANTHROPIC_API_KEY",
         "CLAUDE_CODE_OAUTH_TOKEN"
       ],
@@ -186806,6 +186911,7 @@ var PLUGIN_RUNTIME_EXPECTED_CONTRACT = {
       OPENAI_API_KEY: true,
       CODEX_API_KEY: true,
       CODEX_ACCESS_TOKEN: true,
+      OPENROUTER_API_KEY: true,
       ANTHROPIC_API_KEY: true,
       CLAUDE_CODE_OAUTH_TOKEN: true
     },
@@ -186958,7 +187064,7 @@ function parseJson(value) {
   }
 }
 function parsePluginList(value) {
-  if (!isRecord5(value))
+  if (!isRecord6(value))
     return;
   const allowedKeys = new Set(PLUGIN_LIST_JSON_SCHEMA.collections);
   if (Object.keys(value).some((key) => !allowedKeys.has(key))) {
@@ -186986,7 +187092,7 @@ function parsePluginEntries(value) {
     return;
   const entries = [];
   for (const item of value) {
-    if (!isRecord5(item))
+    if (!isRecord6(item))
       return;
     if (typeof item.pluginId !== "string" || typeof item.installed !== "boolean" || typeof item.enabled !== "boolean") {
       return;
@@ -187012,7 +187118,7 @@ function parseMcpList(value) {
     return;
   const matches = [];
   for (const item of value) {
-    if (!isRecord5(item) || typeof item.name !== "string")
+    if (!isRecord6(item) || typeof item.name !== "string")
       return "unknown";
     if (item.name !== "kyoso")
       continue;
@@ -187094,7 +187200,7 @@ function comparePrerelease(left, right) {
   }
   return 0;
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -187200,7 +187306,7 @@ function findKyosoPackage(executable) {
     if (existsSync(packagePath)) {
       try {
         const parsed = JSON.parse(readFileSync(packagePath, "utf8"));
-        if (isRecord6(parsed) && parsed.name === "@kyo-so/cli" && typeof parsed.version === "string" && parsed.version.trim().length > 0) {
+        if (isRecord7(parsed) && parsed.name === "@kyo-so/cli" && typeof parsed.version === "string" && parsed.version.trim().length > 0) {
           return { directory, version: parsed.version };
         }
       } catch {}
@@ -187286,7 +187392,7 @@ function isWithin(path, parent) {
   const relativePath = relative(resolve5(parent), resolve5(path));
   return relativePath === "" || !relativePath.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) && relativePath !== ".." && !isAbsolute4(relativePath);
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -187324,7 +187430,7 @@ import {
 } from "node:path";
 
 // src/cli/knownSkillDigests.ts
-var CURRENT_SKILL_DIGEST = "sha256:98e715396ee3e1994c29ab49bc489197f242091c8ac0e06e182c0eccd5ab277e";
+var CURRENT_SKILL_DIGEST = "sha256:570f83f716734f34db00147f1b98bc8cd4e9c0016d3946b352ecef4a5d6b8734";
 var KNOWN_SKILL_DIGESTS_BY_VERSION = {
   "0.8.0": [
     {
@@ -188073,7 +188179,7 @@ async function ensureClaudeMcp(context) {
   const configPath = join6(context.cwd, ".mcp.json");
   const current = await readJsonObject(configPath);
   const mcpServers = recordValue(current.mcpServers);
-  if (isRecord7(mcpServers.kyoso)) {
+  if (isRecord8(mcpServers.kyoso)) {
     return {
       kind: "mcp",
       registration: "preserved",
@@ -188313,7 +188419,7 @@ async function readJsonObject(path) {
   if (content.trim().length === 0)
     return {};
   const parsed = JSON.parse(content);
-  if (!isRecord7(parsed))
+  if (!isRecord8(parsed))
     throw new Error(`${path} must contain a JSON object`);
   return parsed;
 }
@@ -188323,9 +188429,9 @@ function hasCodexMcpContent(content) {
 function codexMcpStatusFromContent(content) {
   try {
     const parsed = parse5(content);
-    if (!isRecord7(parsed))
+    if (!isRecord8(parsed))
       return "unknown";
-    if (!isRecord7(parsed.mcp_servers))
+    if (!isRecord8(parsed.mcp_servers))
       return "missing";
     if (!("kyoso" in parsed.mcp_servers))
       return "missing";
@@ -188354,11 +188460,11 @@ function detectCodexMcp(path, cwd, home) {
     if (hasUnprobedProjectIntegrationOverride(parsed, cwd, home)) {
       return { status: "unknown", paths: [path] };
     }
-    if (!isRecord7(parsed))
+    if (!isRecord8(parsed))
       return { status: "unknown", paths: [path] };
     if (!("mcp_servers" in parsed))
       return { status: "missing", paths: [] };
-    if (!isRecord7(parsed.mcp_servers)) {
+    if (!isRecord8(parsed.mcp_servers)) {
       return { status: "unknown", paths: [path] };
     }
     if (!("kyoso" in parsed.mcp_servers)) {
@@ -188383,18 +188489,18 @@ function detectClaudeMcp(path, cwd, home) {
   }
 }
 function jsonMcpStatuses(value, cwd, home) {
-  if (!isRecord7(value))
+  if (!isRecord8(value))
     return ["unknown"];
   const statuses = directMcpStatuses(value);
   if (!("projects" in value))
     return statuses;
-  if (!isRecord7(value.projects))
+  if (!isRecord8(value.projects))
     return [...statuses, "unknown"];
   const currentProject = normalizeProjectPath(cwd, home);
   for (const [projectPath, projectConfig] of Object.entries(value.projects)) {
     if (normalizeProjectPath(projectPath, home) !== currentProject)
       continue;
-    if (!isRecord7(projectConfig)) {
+    if (!isRecord8(projectConfig)) {
       statuses.push("unknown");
       continue;
     }
@@ -188405,7 +188511,7 @@ function jsonMcpStatuses(value, cwd, home) {
 function directMcpStatuses(value) {
   const statuses = [];
   if ("mcpServers" in value) {
-    if (!isRecord7(value.mcpServers)) {
+    if (!isRecord8(value.mcpServers)) {
       statuses.push("unknown");
     } else if ("kyoso" in value.mcpServers) {
       statuses.push(mcpEntryStatus(value.mcpServers.kyoso));
@@ -188416,7 +188522,7 @@ function directMcpStatuses(value) {
 function nestedMcpEntryStatus(value, path) {
   let current = value;
   for (const key of path) {
-    if (!isRecord7(current))
+    if (!isRecord8(current))
       return "unknown";
     if (!(key in current))
       return "missing";
@@ -188425,11 +188531,11 @@ function nestedMcpEntryStatus(value, path) {
   return mcpEntryStatus(current);
 }
 function hasUnprobedProjectIntegrationOverride(value, cwd, home) {
-  if (!isRecord7(value) || !isRecord7(value.projects))
+  if (!isRecord8(value) || !isRecord8(value.projects))
     return false;
   const currentProject = normalizeProjectPath(cwd, home);
   for (const [projectPath, projectConfig] of Object.entries(value.projects)) {
-    if (normalizeProjectPath(projectPath, home) !== currentProject || !isRecord7(projectConfig)) {
+    if (normalizeProjectPath(projectPath, home) !== currentProject || !isRecord8(projectConfig)) {
       continue;
     }
     if ("mcp_servers" in projectConfig || "plugins" in projectConfig) {
@@ -188452,7 +188558,7 @@ function normalizeProjectPath(path, home) {
   return process.platform === "win32" ? normalized.toLowerCase() : normalized;
 }
 function mcpEntryStatus(value) {
-  if (!isRecord7(value))
+  if (!isRecord8(value))
     return "unknown";
   if (!("enabled" in value))
     return "enabled";
@@ -188486,7 +188592,7 @@ function readTextSync(path) {
 function recordValue(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function diffForAppend(path, snippet) {
@@ -191486,14 +191592,14 @@ var zGuardCreateElicitationResponseCancel = object({
 });
 // node_modules/@agentclientprotocol/sdk/dist/jsonrpc.js
 var CANCEL_REQUEST_METHOD = "$/cancel_request";
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null;
 }
 function isJsonRpcId(value) {
   return value === null || typeof value === "string" || typeof value === "number" && Number.isFinite(value);
 }
 function cancelRequestId(params) {
-  if (!isRecord8(params) || !isJsonRpcId(params["requestId"])) {
+  if (!isRecord9(params) || !isJsonRpcId(params["requestId"])) {
     return;
   }
   return params["requestId"];
@@ -191840,7 +191946,7 @@ class Connection {
     if (this.abortController.signal.aborted) {
       return;
     }
-    if (!isRecord8(message)) {
+    if (!isRecord9(message)) {
       console.error("Invalid message", { message });
       return;
     }
@@ -191933,7 +192039,7 @@ class Connection {
       pendingResponse.cleanup?.();
       if ("result" in response) {
         pendingResponse.resolve(response.result);
-      } else if ("error" in response && isRecord8(response.error)) {
+      } else if ("error" in response && isRecord9(response.error)) {
         const { code, message, data } = response.error;
         pendingResponse.reject(new RequestError(code, message, data));
       } else {
@@ -192143,7 +192249,7 @@ function ndJsonStream(output2, input2) {
         if (trimmedLine) {
           try {
             const message = JSON.parse(trimmedLine);
-            if (isRecord8(message)) {
+            if (isRecord9(message)) {
               controller.enqueue(message);
             } else {
               console.warn("Skipping JSON line that is not an object:", trimmedLine);
@@ -193141,7 +193247,7 @@ function isSeverity(value) {
   return typeof value === "string" && severities.includes(value);
 }
 function normalizeCisaSecureByDesign(value) {
-  if (!isRecord9(value))
+  if (!isRecord10(value))
     return;
   const normalized = {};
   const customerSecurityOutcomes = normalizeGateStatus(value.customerSecurityOutcomes);
@@ -193182,7 +193288,7 @@ function normalizeFindingFiles(value) {
   if (!Array.isArray(value))
     return;
   const files = value.flatMap((item) => {
-    if (!isRecord9(item) || typeof item.path !== "string" || item.path.trim().length === 0) {
+    if (!isRecord10(item) || typeof item.path !== "string" || item.path.trim().length === 0) {
       return [];
     }
     const file2 = {
@@ -193201,7 +193307,7 @@ function normalizeFindingFiles(value) {
 function normalizeLineNumber(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
 }
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -193261,6 +193367,20 @@ class SubprocessAcpAgentManager extends BaseAcpAgentManager {
 }
 async function runSubprocessAgent(agent, agentConfig, input2, env) {
   const startedAt = new Date().toISOString();
+  const effectiveTimeoutMs = resolveEffectiveTimeoutMs(input2);
+  if (effectiveTimeoutMs <= 0) {
+    return {
+      agent,
+      role: input2.role,
+      status: "timeout",
+      startedAt,
+      completedAt: startedAt,
+      error: {
+        code: "REVIEW_DEADLINE_EXCEEDED",
+        message: "Review deadline was reached before the agent could start."
+      }
+    };
+  }
   return new Promise((resolveResult) => {
     const child = spawn(agentConfig.command, agentConfig.args, {
       cwd: input2.workspaceDir,
@@ -193289,6 +193409,7 @@ async function runSubprocessAgent(agent, agentConfig, input2, env) {
     const timeout = setTimeout(() => {
       abortController.abort(new Error("Kyoso agent timeout"));
       terminateChild(child);
+      const deadlineReached = input2.deadlineAtEpochMs !== undefined && Date.now() >= input2.deadlineAtEpochMs;
       resolveOnce({
         agent,
         role: input2.role,
@@ -193296,11 +193417,11 @@ async function runSubprocessAgent(agent, agentConfig, input2, env) {
         startedAt,
         completedAt: new Date().toISOString(),
         error: {
-          code: "AGENT_TIMEOUT",
-          message: `Agent timed out after ${input2.timeoutMs}ms`
+          code: deadlineReached ? "REVIEW_DEADLINE_EXCEEDED" : "AGENT_TIMEOUT",
+          message: deadlineReached ? "Review deadline reached before the agent completed." : `Agent timed out after ${effectiveTimeoutMs}ms`
         }
       });
-    }, input2.timeoutMs);
+    }, effectiveTimeoutMs);
     child.stderr.on("data", (chunk) => {
       stderr3 += chunk.toString("utf8");
     });
@@ -193316,19 +193437,48 @@ async function runSubprocessAgent(agent, agentConfig, input2, env) {
         error: failure
       });
     });
-    runAcpClientWorkflow(child, input2, abortController.signal, resolveEffortConfigOption(agent, agentConfig.effort)).then(({ rawText, warnings }) => {
+    runAcpClientWorkflow(child, input2, abortController, resolveEffortConfigOption(agent, agentConfig.effort)).then(({ rawText, warnings, usage, outputBytes, stopReason }) => {
       stdout = rawText;
+      const completed = stopReason === "end_turn";
       resolveOnce({
         agent,
         role: input2.role,
-        status: "completed",
+        status: completed ? "completed" : "failed",
         rawText,
         normalized: normalizeAgentOutput(agent, input2.role, rawText),
         startedAt,
         completedAt: new Date().toISOString(),
-        ...warnings.length > 0 ? { warnings } : {}
+        outputBytes,
+        stopReason,
+        ...usage ? { usage } : {},
+        ...warnings.length > 0 ? { warnings } : {},
+        ...completed ? {} : {
+          error: {
+            code: "AGENT_STOPPED_EARLY",
+            message: `Agent stopped before completing the review: ${stopReason}.`
+          }
+        }
       });
     }).catch((error51) => {
+      const outputLimitError = findOutputLimitError(error51, abortController);
+      if (outputLimitError) {
+        stdout = outputLimitError.rawText;
+        resolveOnce({
+          agent,
+          role: input2.role,
+          status: "failed",
+          rawText: stdout,
+          outputBytes: outputLimitError.outputBytes,
+          stopReason: "cancelled",
+          startedAt,
+          completedAt: new Date().toISOString(),
+          error: {
+            code: "AGENT_OUTPUT_LIMIT",
+            message: `Agent output exceeded ${outputLimitError.maxOutputBytes} bytes and was cancelled.`
+          }
+        });
+        return;
+      }
       if (abortController.signal.aborted)
         return;
       const failureText = [stderr3, formatAgentErrorDetail(error51)].filter((part) => part.trim().length > 0).join(`
@@ -193361,7 +193511,7 @@ async function runSubprocessAgent(agent, agentConfig, input2, env) {
     });
   });
 }
-async function runAcpClientWorkflow(child, input2, signal, configOption) {
+async function runAcpClientWorkflow(child, input2, abortController, configOption) {
   if (!child.stdin || !child.stdout) {
     throw new Error("Agent process did not expose stdio streams.");
   }
@@ -193411,8 +193561,8 @@ async function runAcpClientWorkflow(child, input2, signal, configOption) {
     }).withSession(async (session) => {
       const warnings = [];
       if (configOption) {
-        await ctx.request(methods.agent.session.setConfigOption, { sessionId: session.sessionId, ...configOption }, { cancellationSignal: signal }).catch((error51) => {
-          if (signal.aborted)
+        await ctx.request(methods.agent.session.setConfigOption, { sessionId: session.sessionId, ...configOption }, { cancellationSignal: abortController.signal }).catch((error51) => {
+          if (abortController.signal.aborted)
             return;
           const sanitizedValue = sanitizeTextForDisplay(configOption.value);
           const detail = sanitizeTextForDisplay(formatAgentErrorDetail(error51));
@@ -193422,14 +193572,75 @@ async function runAcpClientWorkflow(child, input2, signal, configOption) {
         });
       }
       const promptResponse = session.prompt(input2.prompt, {
-        cancellationSignal: signal
+        cancellationSignal: abortController.signal
       });
-      const text = await session.readText();
-      await promptResponse;
-      return { rawText: text, warnings };
+      promptResponse.catch(() => {
+        return;
+      });
+      let rawText = "";
+      let outputBytes = 0;
+      for (;; ) {
+        const message = await session.nextUpdate();
+        if (message.kind === "stop") {
+          const usage = normalizeUsage3(message.response.usage);
+          return {
+            rawText,
+            warnings,
+            ...usage ? { usage } : {},
+            outputBytes,
+            stopReason: message.stopReason
+          };
+        }
+        const update = message.update;
+        if (update.sessionUpdate !== "agent_message_chunk" && update.sessionUpdate !== "agent_thought_chunk" || update.content.type !== "text") {
+          continue;
+        }
+        const chunkBytes = Buffer.byteLength(update.content.text, "utf8");
+        const nextOutputBytes = outputBytes + chunkBytes;
+        if (input2.maxOutputBytes !== undefined && nextOutputBytes > input2.maxOutputBytes) {
+          await ctx.notify(methods.agent.session.cancel, {
+            sessionId: session.sessionId
+          }).catch(() => {
+            return;
+          });
+          const error51 = new AgentOutputLimitError(rawText, nextOutputBytes, input2.maxOutputBytes);
+          abortController.abort(error51);
+          throw error51;
+        }
+        if (update.sessionUpdate === "agent_message_chunk") {
+          rawText += update.content.text;
+        }
+        outputBytes = nextOutputBytes;
+      }
     });
   });
 }
+
+class AgentOutputLimitError extends Error {
+  rawText;
+  outputBytes;
+  maxOutputBytes;
+  constructor(rawText, outputBytes, maxOutputBytes) {
+    super(`Agent output exceeded ${maxOutputBytes} bytes.`);
+    this.rawText = rawText;
+    this.outputBytes = outputBytes;
+    this.maxOutputBytes = maxOutputBytes;
+    this.name = "AgentOutputLimitError";
+  }
+}
+function findOutputLimitError(error51, abortController) {
+  if (error51 instanceof AgentOutputLimitError)
+    return error51;
+  const reason = abortController.signal.reason;
+  return reason instanceof AgentOutputLimitError ? reason : undefined;
+}
+function resolveEffectiveTimeoutMs(input2) {
+  const deadlineRemaining = input2.deadlineAtEpochMs === undefined ? Number.POSITIVE_INFINITY : input2.deadlineAtEpochMs - Date.now();
+  return Math.max(0, Math.min(input2.timeoutMs, deadlineRemaining));
+}
+function normalizeUsage3(usage) {
+  return normalizeModelTokenUsage(usage);
+}
 function resolveEffortConfigOption(agent, effort) {
   if (!effort)
     return;
@@ -207299,7 +207510,7 @@ function clearInheritedOpenRouterModelForProviderReset(baseConfig, overridden, o
     return;
   }
   const codex = readPath2(overridden, ["agents", "codex"]);
-  if (isRecord10(codex))
+  if (isRecord11(codex))
     delete codex.model;
 }
 function findAssignmentForPath(overrides, path) {
@@ -207344,7 +207555,7 @@ function parseConfigOverrideValue(value, currentValue) {
 function readPath2(target, path) {
   let current = target;
   for (const key of path) {
-    if (!isRecord10(current))
+    if (!isRecord11(current))
       return;
     current = current[key];
   }
@@ -207354,7 +207565,7 @@ function writePath2(target, path, value) {
   let current = target;
   for (const key of path.slice(0, -1)) {
     const child = current[key];
-    if (!isRecord10(child)) {
+    if (!isRecord11(child)) {
       throw new Error(`Cannot apply --set key ${JSON.stringify(path.join("."))}.`);
     }
     current = child;
@@ -207363,7 +207574,7 @@ function writePath2(target, path, value) {
   if (leaf)
     current[leaf] = value;
 }
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -207444,9 +207655,10 @@ ${JSON.stringify(opinion)}
       role: input2.role,
       status: "completed",
       rawText,
-      normalized: scenario === "success" ? opinion : undefined,
+      normalized: scenario === "success" || scenario === "unknown_usage" ? opinion : undefined,
       startedAt,
-      completedAt: new Date().toISOString()
+      completedAt: new Date().toISOString(),
+      ...scenario === "unknown_usage" ? {} : { usage: fakeUsage() }
     };
   }
 }
@@ -207480,9 +207692,13 @@ function verifierResult(input2, startedAt, scenario) {
     status: "completed",
     rawText,
     startedAt,
-    completedAt: new Date().toISOString()
+    completedAt: new Date().toISOString(),
+    usage: fakeUsage()
   };
 }
+function fakeUsage() {
+  return { totalTokens: 20, inputTokens: 12, outputTokens: 8 };
+}
 function findingIdsFromPrompt(prompt) {
   return Array.from(prompt.matchAll(/^Finding ID: (.+)$/gm)).map((match) => match[1] ?? "");
 }
@@ -208095,6 +208311,16 @@ async function optionalLstat3(path) {
 }
 
 // src/audit/sanitize.ts
+var USAGE_METADATA_KEYS = new Set([
+  "tokenUsage",
+  "totalTokens",
+  "inputTokens",
+  "outputTokens",
+  "thoughtTokens",
+  "cachedReadTokens",
+  "cachedWriteTokens",
+  "skipOptionalPhasesWhenTokenUsageUnknown"
+]);
 function sanitizeForAudit(value, options = {}) {
   if (typeof value === "string")
     return sanitizeText(value);
@@ -208103,7 +208329,7 @@ function sanitizeForAudit(value, options = {}) {
   if (typeof value === "object" && value !== null) {
     const result = {};
     for (const [key, nested] of Object.entries(value)) {
-      if (/raw|content|env|credential|token|secret|password/i.test(key) && !(options.includeRawAgentOutput && key === "rawText")) {
+      if (/raw|content|env|credential|token|secret|password/i.test(key) && !(options.includeRawAgentOutput && key === "rawText") && !isUsageMetadata(key, nested)) {
         continue;
       }
       result[key] = sanitizeForAudit(nested, options);
@@ -208112,6 +208338,17 @@ function sanitizeForAudit(value, options = {}) {
   }
   return value;
 }
+function isUsageMetadata(key, value) {
+  if (!USAGE_METADATA_KEYS.has(key))
+    return false;
+  if (key === "tokenUsage") {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+  }
+  if (key === "skipOptionalPhasesWhenTokenUsageUnknown") {
+    return typeof value === "boolean";
+  }
+  return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
 
 // src/audit/trace.ts
 var AUDIT_WARNING_WRITE_FAILED = "AUDIT_WRITE_FAILED: Audit trace writing failed; no further audit events will be written.";
@@ -208377,6 +208614,8 @@ function renderMarkdownResult(tool, result, options = {}) {
     "",
     `**Decision:** ${result.decision}`,
     `**Mode:** ${tool}`,
+    `**Completion:** ${formatCompletion(result)}`,
+    `**Request fingerprint:** ${shortFingerprint(result.requestFingerprint)}`,
     `**Agents:** ${result.agentOpinions.map((opinion) => `${title(opinion.agent)} ${opinion.status}`).join(", ")}`,
     `**Review mode:** ${formatReviewMode(result)}`,
     ...result.verificationMode ? [
@@ -208388,6 +208627,7 @@ function renderMarkdownResult(tool, result, options = {}) {
     "",
     options.summaryText ?? defaultSummaryText(result)
   ];
+  lines.push(...formatExecutionBudget(result));
   if (result.cisaSecureByDesign) {
     lines.push("", "## CISA Secure by Design Gate", "", "| Dimension | Status | Notes |", "|---|---|---|", `| Customer Security Outcomes | ${result.cisaSecureByDesign.customerSecurityOutcomes} | ${notes(result.cisaSecureByDesign.notes)} |`, `| Secure by Default | ${result.cisaSecureByDesign.secureByDefault} | ${notes(result.cisaSecureByDesign.notes)} |`, `| Transparency & Accountability | ${result.cisaSecureByDesign.transparencyAndAccountability} | ${notes(result.cisaSecureByDesign.notes)} |`, `| Governance | ${result.cisaSecureByDesign.governance} | ${notes(result.cisaSecureByDesign.notes)} |`);
   }
@@ -208440,8 +208680,37 @@ function renderMarkdownResult(tool, result, options = {}) {
 `);
 }
 function defaultSummaryText(result) {
+  if (result.completion.status === "incomplete") {
+    const reasons = result.completion.reasons.length > 0 ? result.completion.reasons.join(", ") : "unspecified coverage gap";
+    return `Review incomplete (${reasons}). Decision is block because review coverage is incomplete, not because a code finding was established.`;
+  }
   return result.findings.length === 0 ? "No blocking findings were detected from the supplied context." : `${result.findings.length} finding(s) require attention.`;
 }
+function formatExecutionBudget(result) {
+  const budget = result.executionBudget;
+  const agentOutputs = Object.entries(budget.agentOutputBytes);
+  const outputLines = agentOutputs.length > 0 ? agentOutputs.map(([agent, bytes]) => `- ${title(agent)}: ${bytes} bytes`) : ["- None reported."];
+  const totalTokens = budget.tokenUsage.totals.totalTokens;
+  return [
+    "",
+    "## Execution Budget",
+    "",
+    `- Model calls: ${budget.modelCalls.planned} planned / ${budget.modelCalls.consumed} consumed / ${budget.modelCalls.skipped} skipped`,
+    `- Wall time: ${budget.wallTime.consumedMs}ms consumed / ${budget.wallTime.limitMs}ms limit`,
+    `- Token usage: ${budget.tokenUsage.status} (${budget.tokenUsage.reportedCalls} reported, ${budget.tokenUsage.unknownCalls} unknown${totalTokens === undefined ? "" : `, ${totalTokens} total`})`,
+    "- Agent output:",
+    ...outputLines
+  ];
+}
+function formatCompletion(result) {
+  if (result.completion.status === "complete")
+    return "complete";
+  const reasons = result.completion.reasons.join(", ") || "unspecified";
+  return `incomplete (${reasons}; retryable=${String(result.completion.retryable)})`;
+}
+function shortFingerprint(value) {
+  return value.length <= 20 ? value : `${value.slice(0, 20)}…`;
+}
 function title(value) {
   return value.slice(0, 1).toUpperCase() + value.slice(1);
 }
@@ -208741,6 +209010,304 @@ function newTraceId() {
   return `tr_${randomUUID2()}`;
 }
 
+// src/core/requestFingerprint.ts
+import { createHash as createHash4 } from "node:crypto";
+var REVIEW_CONTRACT_VERSION = "2026-07-15-v1";
+function createRequestFingerprint(input2) {
+  const reviewers = ["codex", "claude"].filter((agent) => input2.config.agents[agent].enabled).map((agent) => ({
+    agent,
+    role: input2.roles[agent] ?? input2.config.agents[agent].role,
+    model: input2.config.agents[agent].model ?? null,
+    provider: agent === "codex" ? input2.config.agents.codex.provider ?? "default" : "default"
+  }));
+  const request = structuredClone(input2.request);
+  if (request.options)
+    delete request.options.includeAgentRawOutputs;
+  const payload = {
+    reviewContractVersion: REVIEW_CONTRACT_VERSION,
+    tool: input2.tool,
+    request,
+    reviewers,
+    verification: input2.config.verification,
+    judge: {
+      ...input2.config.judge,
+      requestedProvider: input2.request.options?.judgeProvider ?? null
+    },
+    executionBudget: input2.budget
+  };
+  return `sha256:${createHash4("sha256").update(canonicalJson(payload), "utf8").digest("hex")}`;
+}
+function canonicalJson(value) {
+  return JSON.stringify(canonicalize(value));
+}
+function canonicalize(value) {
+  if (Array.isArray(value))
+    return value.map(canonicalize);
+  if (!isRecord12(value))
+    return value;
+  return Object.fromEntries(Object.entries(value).filter(([, child]) => child !== undefined).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, child]) => [key, canonicalize(child)]));
+}
+function isRecord12(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/core/reviewBudget.ts
+var REVIEW_BUDGET_KEYS = new Set([
+  "maxModelCalls",
+  "maxTotalWallTimeMs",
+  "maxAgentOutputBytes",
+  "maxFindingsPerAgent",
+  "skipOptionalPhasesWhenTokenUsageUnknown"
+]);
+var MODEL_CALL_KINDS = ["primary", "verifier", "judge"];
+function resolveReviewBudget(ceiling, requested) {
+  if (requested === undefined)
+    return ceiling;
+  if (!isRecord13(requested)) {
+    throw new KyosoRequestError("options.reviewBudget must be an object.", "REVIEW_BUDGET_INVALID");
+  }
+  for (const [key, value] of Object.entries(requested)) {
+    if (!REVIEW_BUDGET_KEYS.has(key)) {
+      throw new KyosoRequestError(`options.reviewBudget.${key} is not supported.`, "REVIEW_BUDGET_INVALID");
+    }
+    if (key === "skipOptionalPhasesWhenTokenUsageUnknown") {
+      if (typeof value !== "boolean") {
+        throw new KyosoRequestError(`options.reviewBudget.${key} must be a boolean.`, "REVIEW_BUDGET_INVALID");
+      }
+      continue;
+    }
+    if (!isPositiveInteger(value)) {
+      throw new KyosoRequestError(`options.reviewBudget.${key} must be a positive integer.`, "REVIEW_BUDGET_INVALID");
+    }
+  }
+  const numericKeys = [
+    "maxModelCalls",
+    "maxTotalWallTimeMs",
+    "maxAgentOutputBytes",
+    "maxFindingsPerAgent"
+  ];
+  for (const key of numericKeys) {
+    const value = requested[key];
+    if (value === undefined)
+      continue;
+    if (value > ceiling[key]) {
+      throw new KyosoRequestError(`options.reviewBudget.${key} cannot exceed the user-global ceiling.`, "REVIEW_BUDGET_EXCEEDS_CEILING");
+    }
+  }
+  if (ceiling.skipOptionalPhasesWhenTokenUsageUnknown && requested.skipOptionalPhasesWhenTokenUsageUnknown === false) {
+    throw new KyosoRequestError("options.reviewBudget.skipOptionalPhasesWhenTokenUsageUnknown cannot relax the user-global ceiling.", "REVIEW_BUDGET_EXCEEDS_CEILING");
+  }
+  return {
+    maxModelCalls: requested.maxModelCalls ?? ceiling.maxModelCalls,
+    maxTotalWallTimeMs: requested.maxTotalWallTimeMs ?? ceiling.maxTotalWallTimeMs,
+    maxAgentOutputBytes: requested.maxAgentOutputBytes ?? ceiling.maxAgentOutputBytes,
+    maxFindingsPerAgent: requested.maxFindingsPerAgent ?? ceiling.maxFindingsPerAgent,
+    skipOptionalPhasesWhenTokenUsageUnknown: ceiling.skipOptionalPhasesWhenTokenUsageUnknown || requested.skipOptionalPhasesWhenTokenUsageUnknown === true
+  };
+}
+
+class ReviewBudgetTracker {
+  budget;
+  startedAtEpochMs;
+  deadlineAtEpochMs;
+  reservations = new Map;
+  skippedCalls = [];
+  incompleteReasons = new Set;
+  nextReservationId = 1;
+  constructor(budget, startedAtEpochMs = Date.now()) {
+    this.budget = budget;
+    this.startedAtEpochMs = startedAtEpochMs;
+    this.deadlineAtEpochMs = startedAtEpochMs + budget.maxTotalWallTimeMs;
+  }
+  remainingWallTimeMs(now = Date.now()) {
+    return Math.max(0, this.deadlineAtEpochMs - now);
+  }
+  hasDeadlineExpired(now = Date.now()) {
+    return this.remainingWallTimeMs(now) === 0;
+  }
+  reserveMany(inputs) {
+    if (this.hasDeadlineExpired())
+      return { failure: { reason: "deadline" } };
+    if (this.usedCapacity() + inputs.length > this.budget.maxModelCalls) {
+      return { failure: { reason: "model_call_budget" } };
+    }
+    const reservations = inputs.map((input2) => {
+      const reservation = {
+        id: this.nextReservationId,
+        kind: input2.kind,
+        ...input2.agent ? { agent: input2.agent } : {},
+        status: "reserved"
+      };
+      this.reservations.set(reservation.id, reservation);
+      this.nextReservationId += 1;
+      return reservation;
+    });
+    return {
+      reservations: reservations.map(({ id, kind, agent }) => ({
+        id,
+        kind,
+        ...agent ? { agent } : {}
+      }))
+    };
+  }
+  reserve(input2) {
+    const result = this.reserveMany([input2]);
+    if ("failure" in result)
+      return result;
+    const reservation = result.reservations[0];
+    if (!reservation) {
+      return { failure: { reason: "model_call_budget" } };
+    }
+    return { reservation };
+  }
+  markStarted(reservation) {
+    const current = this.reservations.get(reservation.id);
+    if (!current || current.status !== "reserved")
+      return;
+    current.status = "started";
+  }
+  hasStarted(reservation) {
+    const current = this.reservations.get(reservation.id);
+    return current?.status === "started" || current?.status === "completed";
+  }
+  complete(reservation, values = {}) {
+    const current = this.reservations.get(reservation.id);
+    if (!current || current.status === "skipped" || current.status === "completed") {
+      return;
+    }
+    current.status = "completed";
+    current.outputBytes = values.outputBytes;
+    current.usage = normalizeModelTokenUsage(values.usage);
+    current.stopReason = values.stopReason;
+  }
+  skip(reservation, reason) {
+    const current = this.reservations.get(reservation.id);
+    if (!current || current.status !== "reserved")
+      return;
+    current.status = "skipped";
+    current.reason = reason;
+  }
+  recordSkipped(input2) {
+    this.skippedCalls.push({
+      kind: input2.kind,
+      ...input2.agent ? { agent: input2.agent } : {},
+      status: "skipped",
+      reason: input2.reason
+    });
+  }
+  markIncomplete(reason) {
+    this.incompleteReasons.add(reason);
+  }
+  isTokenUsageUnknown() {
+    return Array.from(this.reservations.values()).some((reservation) => reservation.status === "completed" && reservation.usage === undefined);
+  }
+  snapshot(now = Date.now()) {
+    const calls = this.modelCalls();
+    const byKind = Object.fromEntries(MODEL_CALL_KINDS.map((kind) => [
+      kind,
+      { planned: 0, consumed: 0, skipped: 0 }
+    ]));
+    let planned = 0;
+    let consumed = 0;
+    let skipped = 0;
+    const agentOutputBytes = {};
+    const usageTotals = {};
+    let reportedCalls = 0;
+    let unknownCalls = 0;
+    for (const reservation of this.reservations.values()) {
+      planned += 1;
+      byKind[reservation.kind].planned += 1;
+      if (reservation.status === "completed") {
+        consumed += 1;
+        byKind[reservation.kind].consumed += 1;
+        if (reservation.agent && reservation.outputBytes !== undefined) {
+          agentOutputBytes[reservation.agent] = (agentOutputBytes[reservation.agent] ?? 0) + reservation.outputBytes;
+        }
+        if (reservation.usage) {
+          reportedCalls += 1;
+          addUsage(usageTotals, reservation.usage);
+        } else {
+          unknownCalls += 1;
+        }
+      }
+      if (reservation.status === "skipped") {
+        skipped += 1;
+        byKind[reservation.kind].skipped += 1;
+      }
+    }
+    for (const call of this.skippedCalls) {
+      skipped += 1;
+      byKind[call.kind].skipped += 1;
+    }
+    const tokenStatus = consumed === 0 || reportedCalls === 0 ? "unknown" : unknownCalls === 0 ? "reported" : "partial";
+    const completionReasons = Array.from(this.incompleteReasons).sort();
+    const consumedMs = Math.max(0, now - this.startedAtEpochMs);
+    return {
+      completion: {
+        status: completionReasons.length > 0 ? "incomplete" : "complete",
+        reasons: completionReasons,
+        retryable: false
+      },
+      executionBudget: {
+        maxModelCalls: this.budget.maxModelCalls,
+        modelCalls: { planned, consumed, skipped, byKind },
+        wallTime: {
+          limitMs: this.budget.maxTotalWallTimeMs,
+          consumedMs,
+          remainingMs: this.remainingWallTimeMs(now)
+        },
+        maxAgentOutputBytes: this.budget.maxAgentOutputBytes,
+        maxFindingsPerAgent: this.budget.maxFindingsPerAgent,
+        skipOptionalPhasesWhenTokenUsageUnknown: this.budget.skipOptionalPhasesWhenTokenUsageUnknown,
+        agentOutputBytes,
+        tokenUsage: {
+          status: tokenStatus,
+          reportedCalls,
+          unknownCalls,
+          totals: usageTotals
+        }
+      },
+      modelCalls: calls
+    };
+  }
+  usedCapacity() {
+    return Array.from(this.reservations.values()).filter((reservation) => reservation.status === "reserved" || reservation.status === "started" || reservation.status === "completed").length;
+  }
+  modelCalls() {
+    const reservations = Array.from(this.reservations.values()).filter((reservation) => reservation.status === "completed" || reservation.status === "skipped").map((reservation) => ({
+      kind: reservation.kind,
+      ...reservation.agent ? { agent: reservation.agent } : {},
+      status: reservation.status === "completed" ? "completed" : "skipped",
+      ...reservation.reason ? { reason: reservation.reason } : {},
+      ...reservation.outputBytes !== undefined ? { outputBytes: reservation.outputBytes } : {},
+      ...reservation.usage ? { usage: reservation.usage } : {},
+      ...reservation.stopReason ? { stopReason: reservation.stopReason } : {}
+    }));
+    return [...reservations, ...this.skippedCalls];
+  }
+}
+function addUsage(total, usage) {
+  for (const key of [
+    "totalTokens",
+    "inputTokens",
+    "outputTokens",
+    "thoughtTokens",
+    "cachedReadTokens",
+    "cachedWriteTokens"
+  ]) {
+    const value = usage[key];
+    if (value === undefined)
+      continue;
+    total[key] = (total[key] ?? 0) + value;
+  }
+}
+function isPositiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+function isRecord13(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/core/verification.ts
 var REAL_AGENTS = ["codex", "claude"];
 var VERIFIABLE_SEVERITIES = new Set(["critical", "high"]);
@@ -208782,9 +209349,12 @@ function groupVerificationTargetsByVerifier(targets) {
     findings
   }));
 }
-function markVerificationOverflow(targets) {
+function markVerificationOverflow(targets, reason) {
   for (const target of targets) {
-    target.finding.verification = { status: "not_verified" };
+    target.finding.verification = {
+      status: "not_verified",
+      ...reason ? { note: reason } : {}
+    };
   }
 }
 function parseVerificationVerdicts(rawText) {
@@ -208796,7 +209366,7 @@ function parseVerificationVerdicts(rawText) {
     if (!Array.isArray(parsed.verdicts))
       return;
     return parsed.verdicts.flatMap((item) => {
-      if (!isRecord11(item))
+      if (!isRecord14(item))
         return [];
       if (typeof item.findingId !== "string")
         return [];
@@ -208874,15 +209444,23 @@ function verificationNote(reasoning) {
 function isVerdict(value) {
   return value === "confirmed" || value === "refuted" || value === "uncertain";
 }
-function isRecord11(value) {
+function isRecord14(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // src/core/runReview.ts
+function requestForRecursionFingerprint(request) {
+  try {
+    return scanAndRedactSecrets(request).redactedRequest;
+  } catch {
+    return { goal: "" };
+  }
+}
 async function runReview(tool, request, options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const traceId = newTraceId();
-  const startedAt = new Date().toISOString();
+  const startedAtEpochMs = Date.now();
+  const startedAt = new Date(startedAtEpochMs).toISOString();
   const auditEnv = { ...process.env, ...options.env };
   const traceWriterFactory = options.traceWriterFactory ?? createTraceWriter;
   let snapshot;
@@ -208891,6 +209469,14 @@ async function runReview(tool, request, options = {}) {
   } catch (error51) {
     if (error51 instanceof KyosoRequestError) {
       const config2 = kyosoConfigSchema.parse(defaultConfig);
+      const budgetTracker = new ReviewBudgetTracker(config2.reviewBudget, startedAtEpochMs);
+      const requestFingerprint = createRequestFingerprint({
+        tool,
+        request: requestForRecursionFingerprint(request),
+        config: config2,
+        roles: resolveAgentRoles(config2),
+        budget: config2.reviewBudget
+      });
       const trace2 = traceWriterFactory({
         enabled: config2.audit.enabled,
         directory: config2.audit.directory,
@@ -208905,6 +209491,12 @@ async function runReview(tool, request, options = {}) {
           tool,
           timestamp: new Date().toISOString()
         });
+        await writeReviewBudgetPlanned({
+          trace: trace2,
+          traceId,
+          budgetTracker,
+          requestFingerprint
+        });
         return await buildPolicyBlockResult({
           tool,
           trace: trace2,
@@ -208912,6 +209504,8 @@ async function runReview(tool, request, options = {}) {
           startedAt,
           networkMode: config2.network.defaultMode,
           warning: error51.message,
+          budgetTracker,
+          requestFingerprint,
           finding: {
             id: "KYOSO-1",
             severity: "critical",
@@ -208977,6 +209571,8 @@ async function runReview(tool, request, options = {}) {
       timestamp: new Date().toISOString()
     });
     validateReviewRequest(tool, request);
+    const reviewBudget = resolveReviewBudget(loaded.config.reviewBudget, request.options?.reviewBudget);
+    const budgetTracker = new ReviewBudgetTracker(reviewBudget, startedAtEpochMs);
     assertTrustedWorkspaceRoot(request.workspace?.root, loaded.config.workspace.root, cwd);
     const networkMode = resolveNetworkMode(request.options?.network, loaded.config.network.defaultMode, options.mcpNetworkMode);
     if (networkMode === "unrestricted" && !loaded.config.network.allowUnrestricted) {
@@ -208995,6 +209591,19 @@ async function runReview(tool, request, options = {}) {
     });
     const allowSecretOverride = loaded.config.secrets.allowOverride && request.options?.allowSecretRedaction === true;
     if (secretScan.detected && loaded.config.secrets.blockOnDetectedSecret && !allowSecretOverride) {
+      const requestFingerprint2 = createRequestFingerprint({
+        tool,
+        request: secretScan.redactedRequest,
+        config: loaded.config,
+        roles: resolveAgentRoles(loaded.config),
+        budget: reviewBudget
+      });
+      await writeReviewBudgetPlanned({
+        trace,
+        traceId,
+        budgetTracker,
+        requestFingerprint: requestFingerprint2
+      });
       return await buildSecretBlockResult({
         tool,
         trace,
@@ -209003,7 +209612,9 @@ async function runReview(tool, request, options = {}) {
         configHash: loaded.configHash,
         networkMode,
         secretScan,
-        warnings
+        warnings,
+        budgetTracker,
+        requestFingerprint: requestFingerprint2
       });
     }
     const denyPatterns = mergeDenyPatterns(loaded.config.workspace.deny, secretScan.redactedRequest.workspace?.denyRead);
@@ -209016,6 +209627,19 @@ async function runReview(tool, request, options = {}) {
     });
     warnings.push(...built.warnings);
     const agentRoles = resolveAgentRoles(loaded.config);
+    const requestFingerprint = createRequestFingerprint({
+      tool,
+      request: built.request,
+      config: loaded.config,
+      roles: agentRoles,
+      budget: reviewBudget
+    });
+    await writeReviewBudgetPlanned({
+      trace,
+      traceId,
+      budgetTracker,
+      requestFingerprint
+    });
     snapshot = await createSnapshot(traceId, tool, built.request, {
       denyPatterns,
       allowPatterns,
@@ -209038,14 +209662,22 @@ async function runReview(tool, request, options = {}) {
       networkMode,
       manager,
       trace,
-      warnings
+      warnings,
+      budgetTracker
     });
     warnings.push(...agentResults.flatMap((result) => (result.warnings ?? []).map((warning) => `Agent ${result.agent} ${warning}`)));
-    const normalizedAgentResults = agentResults.map(normalizeAgentRunResult);
-    const agentsUsed = normalizedAgentResults.map((result) => result.agent);
-    const reviewMode = agentsUsed.length === 1 ? "single_agent" : "multi_agent";
+    const normalized = agentResults.map((result) => normalizeAgentRunResult(result, reviewBudget.maxFindingsPerAgent));
+    const normalizedAgentResults = normalized.map((item) => item.result);
+    for (const item of normalized.filter((item2) => item2.findingsCapped)) {
+      budgetTracker.markIncomplete("coverage_incomplete");
+      warnings.push(`Agent ${item.result.agent} findings were capped at ${reviewBudget.maxFindingsPerAgent}; review coverage is incomplete.`);
+    }
+    const enabledAgents = ["codex", "claude"].filter((agent) => loaded.config.agents[agent].enabled);
+    const agentsUsed = normalizedAgentResults.filter((result) => result.status !== "skipped").map((result) => result.agent);
+    const reviewMode = enabledAgents.length === 1 ? "single_agent" : "multi_agent";
     const completed = normalizedAgentResults.filter((result) => result.status === "completed");
-    const degraded = completed.length !== agentResults.length;
+    const attempted = normalizedAgentResults.filter((result) => result.status !== "skipped");
+    const degraded = completed.length !== attempted.length || enabledAgents.length === 0;
     let aggregate = aggregateAgentResults(normalizedAgentResults, {
       reviewMode
     });
@@ -209061,7 +209693,12 @@ async function runReview(tool, request, options = {}) {
         ])
       };
     }
-    if (completed.length === 0) {
+    if (completed.length === 0 && (attempted.length > 0 || enabledAgents.length === 0)) {
+      const noPrimaryAgents = enabledAgents.length === 0;
+      if (noPrimaryAgents) {
+        budgetTracker.markIncomplete("coverage_incomplete");
+        warnings.push("No primary review agents are enabled; review coverage is incomplete.");
+      }
       aggregate = {
         ...aggregate,
         findings: [
@@ -209070,9 +209707,9 @@ async function runReview(tool, request, options = {}) {
             id: `KYOSO-${aggregate.findings.length + 1}`,
             severity: "critical",
             category: "other",
-            title: "All backend agents failed",
-            evidence: normalizedAgentResults.map((result) => `${result.agent}: ${result.error?.code ?? result.status}`).join("; "),
-            recommendation: "Run kyoso doctor and retry after agent authentication or adapter issues are fixed.",
+            title: noPrimaryAgents ? "No primary review agents enabled" : "All backend agents failed",
+            evidence: noPrimaryAgents ? "Both configured primary reviewers are disabled." : normalizedAgentResults.map((result) => `${result.agent}: ${result.error?.code ?? result.status}`).join("; "),
+            recommendation: noPrimaryAgents ? "Enable at least one primary reviewer before running Kyoso." : "Run kyoso doctor and retry after agent authentication or adapter issues are fixed.",
             sourceAgents: ["kyoso_policy"],
             confidence: "high"
           }
@@ -209085,7 +209722,7 @@ async function runReview(tool, request, options = {}) {
       findingCount: aggregate.findings.length,
       timestamp: new Date().toISOString()
     });
-    const verificationMode = loaded.config.verification.enabled && reviewMode === "single_agent" ? "skipped_single_agent" : loaded.config.verification.enabled ? "cross_agent" : undefined;
+    const verificationMode = loaded.config.verification.enabled && reviewMode === "single_agent" ? "skipped_single_agent" : loaded.config.verification.enabled && enabledAgents.length > 1 ? "cross_agent" : undefined;
     if (verificationMode === "cross_agent") {
       warnings.push(...await runFindingVerification({
         tool,
@@ -209096,11 +209733,16 @@ async function runReview(tool, request, options = {}) {
         networkMode,
         manager,
         trace,
-        findings: aggregate.findings
+        findings: aggregate.findings,
+        budgetTracker
       }));
     }
+    if (aggregate.findings.some((finding) => finding.verification?.status === "refuted")) {
+      budgetTracker.markIncomplete("disputed_finding");
+    }
     const cisa = tool === "security_review" ? computeCisaGate(aggregate.findings, normalizedAgentResults) : undefined;
-    const decision = decide({
+    const budgetBeforeJudge = budgetTracker.snapshot();
+    const decision = budgetBeforeJudge.completion.status === "incomplete" ? "block" : decide({
       tool,
       findings: aggregate.findings,
       cisa,
@@ -209110,6 +209752,9 @@ async function runReview(tool, request, options = {}) {
     const completedAt = new Date().toISOString();
     const resultWithoutMarkdown = {
       decision,
+      completion: budgetBeforeJudge.completion,
+      executionBudget: budgetBeforeJudge.executionBudget,
+      requestFingerprint,
       degraded,
       agentsUsed,
       reviewMode,
@@ -209131,18 +209776,22 @@ async function runReview(tool, request, options = {}) {
         networkMode,
         workspaceMode: "temp_snapshot",
         configHash: loaded.configHash,
-        warnings: Array.from(new Set([...warnings, ...trace.warnings]))
+        warnings: Array.from(new Set([...warnings, ...trace.warnings])),
+        modelCalls: budgetBeforeJudge.modelCalls
       }
     };
     const summaryText = defaultSummaryText(resultWithoutMarkdown);
-    const judge = await runJudge({
+    const judge = await runBudgetedJudge({
       tool,
       result: resultWithoutMarkdown,
       summaryText,
       agentFindings: buildJudgeAgentFindings(normalizedAgentResults),
       config: loaded.config.judge,
       requestedProvider: request.options?.judgeProvider,
-      env: options.env ?? process.env
+      env: options.env ?? process.env,
+      budgetTracker,
+      trace,
+      traceId
     });
     const judgeComments = new Map(judge.output.disagreementComments.map((comment) => [
       comment.topic,
@@ -209153,10 +209802,20 @@ async function runReview(tool, request, options = {}) {
       judgeComment: judgeComments.get(disagreement.topic) ?? disagreement.judgeComment
     }));
     const crossModelAnalysis = buildCrossModelAnalysis(judge, reviewMode);
+    const budgetAfterJudge = budgetTracker.snapshot();
+    const finalDecision = budgetAfterJudge.completion.status === "incomplete" ? "block" : decision;
     const resultAfterJudge = {
       ...resultWithoutMarkdown,
+      decision: finalDecision,
+      completion: budgetAfterJudge.completion,
+      executionBudget: budgetAfterJudge.executionBudget,
       disagreements,
-      ...crossModelAnalysis ? { crossModelAnalysis } : {}
+      ...crossModelAnalysis ? { crossModelAnalysis } : {},
+      audit: {
+        ...resultWithoutMarkdown.audit,
+        completedAt: new Date().toISOString(),
+        modelCalls: budgetAfterJudge.modelCalls
+      }
     };
     const judgeEvent = {
       type: "judge_completed",
@@ -209169,10 +209828,16 @@ async function runReview(tool, request, options = {}) {
       judgeEvent.error = judge.error;
     await trace.write(judgeEvent);
     resultAfterJudge.audit.completedAt = new Date().toISOString();
+    await writeReviewBudgetCompleted({
+      trace,
+      traceId,
+      budgetTracker,
+      requestFingerprint
+    });
     await trace.write({
       type: "decision_completed",
       traceId,
-      decision,
+      decision: finalDecision,
       timestamp: new Date().toISOString()
     });
     await trace.write({
@@ -209184,7 +209849,7 @@ async function runReview(tool, request, options = {}) {
       tool,
       trace,
       result: resultAfterJudge,
-      summaryText: judge.output.summaryText
+      summaryText: resultAfterJudge.completion.status === "incomplete" ? defaultSummaryText(resultAfterJudge) : judge.output.summaryText
     });
   } finally {
     await trace.finalize();
@@ -209195,37 +209860,180 @@ async function runReview(tool, request, options = {}) {
 async function runFindingVerification(input2) {
   const allowDemotionRequested = input2.config.verification.allowDemotion;
   const selection = selectVerificationTargets(input2.findings, input2.config.verification.maxFindings);
-  markVerificationOverflow(selection.overflow);
-  if (selection.selected.length === 0)
-    return [];
   const warnings = [];
-  const groups = groupVerificationTargetsByVerifier(selection.selected);
+  if (selection.overflow.length > 0) {
+    markVerificationOverflow(selection.overflow, "verification_max_findings");
+    input2.budgetTracker.markIncomplete("coverage_incomplete");
+  }
+  if (selection.selected.length === 0)
+    return warnings;
+  const potentialGroups = groupVerificationTargetsByVerifier(selection.selected);
   await input2.trace.write({
     type: "verification_started",
     traceId: input2.traceId,
     targetCount: selection.selected.length,
     notVerifiedCount: selection.overflow.length,
-    verifierCount: groups.length,
+    verifierCount: potentialGroups.length,
     timeoutMs: input2.config.verification.timeoutMs,
     allowDemotionRequested,
     timestamp: new Date().toISOString()
   });
-  const agentInputs = groups.map(({ verifier, findings }) => ({
+  if (input2.budgetTracker.budget.skipOptionalPhasesWhenTokenUsageUnknown && input2.budgetTracker.isTokenUsageUnknown()) {
+    markVerificationOverflow(selection.selected, "token_usage_unknown");
+    input2.budgetTracker.markIncomplete("token_usage_unknown");
+    input2.budgetTracker.markIncomplete("coverage_incomplete");
+    warnings.push("Finding verification was skipped because primary-agent token usage was not reported.");
+    for (const group of potentialGroups) {
+      input2.budgetTracker.recordSkipped({
+        kind: "verifier",
+        agent: group.verifier,
+        reason: "token_usage_unknown"
+      });
+      await input2.trace.write({
+        type: "model_call_skipped",
+        traceId: input2.traceId,
+        kind: "verifier",
+        agent: group.verifier,
+        reason: "token_usage_unknown",
+        timestamp: new Date().toISOString()
+      });
+    }
+    await input2.trace.write({
+      type: "verification_completed",
+      traceId: input2.traceId,
+      counts: countVerificationStatuses(input2.findings),
+      timestamp: new Date().toISOString()
+    });
+    return warnings;
+  }
+  const groups = new Map;
+  const unavailableVerifiers = new Map;
+  for (const target of selection.selected) {
+    const existing = groups.get(target.verifier);
+    if (existing) {
+      existing.targets.push(target);
+      continue;
+    }
+    const unavailable = unavailableVerifiers.get(target.verifier);
+    if (unavailable) {
+      markVerificationOverflow([target], unavailable === "model_call_budget" ? "budget_exhausted" : "deadline");
+      continue;
+    }
+    const reservationResult = input2.budgetTracker.reserve({
+      kind: "verifier",
+      agent: target.verifier
+    });
+    if ("failure" in reservationResult) {
+      unavailableVerifiers.set(target.verifier, reservationResult.failure.reason);
+      markVerificationOverflow([target], reservationResult.failure.reason === "model_call_budget" ? "budget_exhausted" : "deadline");
+      input2.budgetTracker.recordSkipped({
+        kind: "verifier",
+        agent: target.verifier,
+        reason: reservationResult.failure.reason
+      });
+      input2.budgetTracker.markIncomplete(reservationResult.failure.reason);
+      input2.budgetTracker.markIncomplete("coverage_incomplete");
+      await input2.trace.write({
+        type: "review_budget_exhausted",
+        traceId: input2.traceId,
+        phase: "verification",
+        kind: "verifier",
+        agent: target.verifier,
+        reason: reservationResult.failure.reason,
+        timestamp: new Date().toISOString()
+      });
+      await input2.trace.write({
+        type: "model_call_skipped",
+        traceId: input2.traceId,
+        kind: "verifier",
+        agent: target.verifier,
+        reason: reservationResult.failure.reason,
+        timestamp: new Date().toISOString()
+      });
+      continue;
+    }
+    const group = {
+      verifier: target.verifier,
+      targets: [target],
+      reservation: reservationResult.reservation
+    };
+    groups.set(target.verifier, group);
+    await input2.trace.write({
+      type: "model_call_reserved",
+      traceId: input2.traceId,
+      kind: "verifier",
+      agent: target.verifier,
+      timestamp: new Date().toISOString()
+    });
+  }
+  const scheduledGroups = [];
+  for (const group of groups.values()) {
+    const timeoutMs = Math.min(input2.config.verification.timeoutMs, input2.budgetTracker.remainingWallTimeMs());
+    if (timeoutMs > 0) {
+      scheduledGroups.push(group);
+      continue;
+    }
+    input2.budgetTracker.skip(group.reservation, "deadline");
+    input2.budgetTracker.markIncomplete("deadline");
+    input2.budgetTracker.markIncomplete("coverage_incomplete");
+    markVerificationOverflow(group.targets, "deadline");
+    await input2.trace.write({
+      type: "review_budget_exhausted",
+      traceId: input2.traceId,
+      phase: "verification",
+      kind: "verifier",
+      agent: group.verifier,
+      reason: "deadline",
+      timestamp: new Date().toISOString()
+    });
+    await input2.trace.write({
+      type: "model_call_skipped",
+      traceId: input2.traceId,
+      kind: "verifier",
+      agent: group.verifier,
+      reason: "deadline",
+      timestamp: new Date().toISOString()
+    });
+  }
+  if (scheduledGroups.length === 0) {
+    await input2.trace.write({
+      type: "verification_completed",
+      traceId: input2.traceId,
+      counts: countVerificationStatuses(input2.findings),
+      timestamp: new Date().toISOString()
+    });
+    return warnings;
+  }
+  const agentInputs = scheduledGroups.map((group) => ({
     traceId: input2.traceId,
-    agent: verifier,
+    agent: group.verifier,
     role: "finding_verifier",
     tool: input2.tool,
-    prompt: buildFindingVerifierPrompt(input2.tool, input2.request, verifier, findings),
+    prompt: buildFindingVerifierPrompt(input2.tool, input2.request, group.verifier, group.targets.map((target) => target.finding)),
     workspaceDir: input2.workspaceDir,
-    timeoutMs: input2.config.verification.timeoutMs,
-    networkMode: input2.networkMode
+    timeoutMs: Math.min(input2.config.verification.timeoutMs, input2.budgetTracker.remainingWallTimeMs()),
+    deadlineAtEpochMs: input2.budgetTracker.deadlineAtEpochMs,
+    maxOutputBytes: input2.budgetTracker.budget.maxAgentOutputBytes,
+    networkMode: input2.networkMode,
+    onStarted: () => {
+      input2.budgetTracker.markStarted(group.reservation);
+      return Promise.resolve();
+    }
   }));
   let results;
   try {
     results = await input2.manager.runAll(agentInputs);
   } catch (error51) {
-    for (const group of groups) {
-      applyVerificationVerdicts(selection.selected, group.verifier, undefined);
+    for (const group of scheduledGroups) {
+      applyVerificationVerdicts(group.targets, group.verifier, undefined);
+      await finalizeModelCallResult({
+        budgetTracker: input2.budgetTracker,
+        reservation: group.reservation,
+        result: failedVerifierResult(group.verifier, "AGENT_MANAGER_FAILED"),
+        trace: input2.trace,
+        traceId: input2.traceId
+      });
+      input2.budgetTracker.markIncomplete("coverage_incomplete");
     }
     const message = `Finding verification failed: ${sanitizeTextForDisplay(error51 instanceof Error ? error51.message : String(error51))}`;
     warnings.push(message);
@@ -209238,9 +210046,32 @@ async function runFindingVerification(input2) {
     });
     return warnings;
   }
-  for (const result of results) {
+  const resultByAgent = new Map(results.map((result) => [result.agent, result]));
+  for (const group of scheduledGroups) {
+    const result = resultByAgent.get(group.verifier);
+    if (!result) {
+      applyVerificationVerdicts(group.targets, group.verifier, undefined);
+      await finalizeModelCallResult({
+        budgetTracker: input2.budgetTracker,
+        reservation: group.reservation,
+        result: failedVerifierResult(group.verifier, "AGENT_RESULT_MISSING"),
+        trace: input2.trace,
+        traceId: input2.traceId
+      });
+      input2.budgetTracker.markIncomplete("coverage_incomplete");
+      warnings.push(`Finding verification by ${group.verifier} did not return a result.`);
+      continue;
+    }
+    await finalizeModelCallResult({
+      budgetTracker: input2.budgetTracker,
+      reservation: group.reservation,
+      result,
+      trace: input2.trace,
+      traceId: input2.traceId
+    });
     if (result.status !== "completed") {
-      applyVerificationVerdicts(selection.selected, result.agent, undefined);
+      applyVerificationVerdicts(group.targets, result.agent, undefined);
+      input2.budgetTracker.markIncomplete("coverage_incomplete");
       const message = `Finding verification by ${result.agent} ${result.status}: ${result.error?.message ?? result.error?.code ?? "no detail"}`;
       warnings.push(sanitizeTextForDisplay(message));
       await input2.trace.write({
@@ -209254,8 +210085,9 @@ async function runFindingVerification(input2) {
       continue;
     }
     const verdicts = parseVerificationVerdicts(result.rawText);
-    applyVerificationVerdicts(selection.selected, result.agent, verdicts);
+    applyVerificationVerdicts(group.targets, result.agent, verdicts);
     if (!verdicts) {
+      input2.budgetTracker.markIncomplete("coverage_incomplete");
       const message = `Finding verification by ${result.agent} returned malformed verdict JSON.`;
       warnings.push(message);
       await input2.trace.write({
@@ -209275,6 +210107,20 @@ async function runFindingVerification(input2) {
   });
   return warnings;
 }
+function failedVerifierResult(agent, code) {
+  const timestamp = new Date().toISOString();
+  return {
+    agent,
+    role: "finding_verifier",
+    status: "failed",
+    startedAt: timestamp,
+    completedAt: timestamp,
+    error: {
+      code,
+      message: "The agent manager did not return a verification result."
+    }
+  };
+}
 function buildJudgeAgentFindings(results) {
   return results.flatMap((result) => {
     if (!result.normalized)
@@ -209311,13 +210157,182 @@ function buildCrossModelAnalysis(judge, reviewMode) {
     provider: judge.provider
   };
 }
+async function runBudgetedJudge(input2) {
+  const configuredProvider = input2.requestedProvider ?? input2.config.provider;
+  const provider = resolveJudgeProvider(configuredProvider, input2.env);
+  if (input2.config.mode === "deterministic_only" || provider === "deterministic_fallback") {
+    return runJudge(input2);
+  }
+  const fallback = () => runJudge({
+    ...input2,
+    config: { ...input2.config, mode: "deterministic_only" }
+  });
+  if (input2.budgetTracker.snapshot().completion.status === "incomplete") {
+    await recordSkippedJudgeCall(input2, "review_incomplete");
+    return fallback();
+  }
+  if (input2.budgetTracker.budget.skipOptionalPhasesWhenTokenUsageUnknown && input2.budgetTracker.isTokenUsageUnknown()) {
+    await recordSkippedJudgeCall(input2, "token_usage_unknown");
+    return fallback();
+  }
+  const reservationResult = input2.budgetTracker.reserve({ kind: "judge" });
+  if ("failure" in reservationResult) {
+    await recordSkippedJudgeCall(input2, reservationResult.failure.reason);
+    await input2.trace.write({
+      type: "review_budget_exhausted",
+      traceId: input2.traceId,
+      phase: "judge",
+      kind: "judge",
+      reason: reservationResult.failure.reason,
+      timestamp: new Date().toISOString()
+    });
+    return fallback();
+  }
+  const reservation = reservationResult.reservation;
+  await input2.trace.write({
+    type: "model_call_reserved",
+    traceId: input2.traceId,
+    kind: "judge",
+    timestamp: new Date().toISOString()
+  });
+  const timeoutMs = Math.min(input2.config.timeoutMs, input2.budgetTracker.remainingWallTimeMs());
+  if (timeoutMs <= 0) {
+    input2.budgetTracker.skip(reservation, "deadline");
+    await input2.trace.write({
+      type: "review_budget_exhausted",
+      traceId: input2.traceId,
+      phase: "judge",
+      kind: "judge",
+      reason: "deadline",
+      timestamp: new Date().toISOString()
+    });
+    await input2.trace.write({
+      type: "model_call_skipped",
+      traceId: input2.traceId,
+      kind: "judge",
+      reason: "deadline",
+      timestamp: new Date().toISOString()
+    });
+    return fallback();
+  }
+  input2.budgetTracker.markStarted(reservation);
+  const judge = await runJudge({ ...input2, timeoutMs });
+  const usage = normalizeModelTokenUsage(judge.usage);
+  input2.budgetTracker.complete(reservation, {
+    ...usage ? { usage } : {}
+  });
+  await input2.trace.write({
+    type: "model_call_completed",
+    traceId: input2.traceId,
+    kind: "judge",
+    provider: judge.provider,
+    resultStatus: judge.status,
+    ...usage ? { usage } : {},
+    timestamp: new Date().toISOString()
+  });
+  return judge;
+}
+async function recordSkippedJudgeCall(input2, reason) {
+  input2.budgetTracker.recordSkipped({ kind: "judge", reason });
+  await input2.trace.write({
+    type: "model_call_skipped",
+    traceId: input2.traceId,
+    kind: "judge",
+    reason,
+    timestamp: new Date().toISOString()
+  });
+}
 async function runAgents(input2) {
   const agentRoles = resolveAgentRoles(input2.config);
+  const enabledAgents = ["codex", "claude"].filter((agent) => input2.config.agents[agent].enabled);
+  if (enabledAgents.length === 0)
+    return [];
+  const reservationResult = input2.budgetTracker.reserveMany(enabledAgents.map((agent) => ({ kind: "primary", agent })));
+  if ("failure" in reservationResult) {
+    input2.budgetTracker.markIncomplete(reservationResult.failure.reason);
+    input2.budgetTracker.markIncomplete("coverage_incomplete");
+    await input2.trace.write({
+      type: "review_budget_exhausted",
+      traceId: input2.traceId,
+      phase: "primary",
+      reason: reservationResult.failure.reason,
+      requiredCalls: enabledAgents.length,
+      timestamp: new Date().toISOString()
+    });
+    for (const agent of enabledAgents) {
+      input2.budgetTracker.recordSkipped({
+        kind: "primary",
+        agent,
+        reason: reservationResult.failure.reason
+      });
+      await input2.trace.write({
+        type: "model_call_skipped",
+        traceId: input2.traceId,
+        kind: "primary",
+        agent,
+        reason: reservationResult.failure.reason,
+        timestamp: new Date().toISOString()
+      });
+    }
+    return enabledAgents.map((agent) => {
+      const role = agentRoles[agent] ?? input2.config.agents[agent].role;
+      const timestamp = new Date().toISOString();
+      return {
+        agent,
+        role,
+        status: "skipped",
+        startedAt: timestamp,
+        completedAt: timestamp,
+        error: {
+          code: reservationResult.failure.reason === "deadline" ? "REVIEW_DEADLINE_EXCEEDED" : "MODEL_CALL_BUDGET_EXHAUSTED",
+          message: reservationResult.failure.reason === "deadline" ? "Review deadline was reached before primary agents could start." : "The review model-call budget cannot reserve all primary agents."
+        }
+      };
+    });
+  }
+  const reservations = new Map(reservationResult.reservations.map((reservation) => [
+    reservation.agent,
+    reservation
+  ]));
+  for (const reservation of reservationResult.reservations) {
+    await input2.trace.write({
+      type: "model_call_reserved",
+      traceId: input2.traceId,
+      kind: reservation.kind,
+      agent: reservation.agent,
+      timestamp: new Date().toISOString()
+    });
+  }
+  if (input2.budgetTracker.remainingWallTimeMs() <= 0) {
+    input2.budgetTracker.markIncomplete("deadline");
+    input2.budgetTracker.markIncomplete("coverage_incomplete");
+    await input2.trace.write({
+      type: "review_budget_exhausted",
+      traceId: input2.traceId,
+      phase: "primary",
+      reason: "deadline",
+      timestamp: new Date().toISOString()
+    });
+    return await skipReservedPrimaryAgents({
+      trace: input2.trace,
+      traceId: input2.traceId,
+      budgetTracker: input2.budgetTracker,
+      config: input2.config,
+      agents: enabledAgents,
+      agentRoles,
+      reservations,
+      reason: "deadline"
+    });
+  }
   const startedWrites = [];
   let acceptingStartedEvents = true;
-  const agentInputs = ["codex", "claude"].filter((agent) => input2.config.agents[agent].enabled).map((agent) => {
+  const agentInputs = enabledAgents.map((agent) => {
     const agentConfig = input2.config.agents[agent];
     const role = agentRoles[agent] ?? agentConfig.role;
+    const reservation = reservations.get(agent);
+    if (!reservation) {
+      throw new Error(`Missing primary budget reservation for ${agent}.`);
+    }
     return {
       traceId: input2.traceId,
       agent,
@@ -209325,9 +210340,12 @@ async function runAgents(input2) {
       tool: input2.tool,
       prompt: buildAgentPrompt(input2.tool, input2.request, agent, role),
       workspaceDir: input2.workspaceDir,
-      timeoutMs: input2.request.options?.maxAgentTimeoutMs ?? agentConfig.timeoutMs ?? DEFAULT_AGENT_TIMEOUT_MS,
+      timeoutMs: Math.min(input2.request.options?.maxAgentTimeoutMs ?? Number.POSITIVE_INFINITY, agentConfig.timeoutMs ?? DEFAULT_AGENT_TIMEOUT_MS, input2.budgetTracker.remainingWallTimeMs()),
+      deadlineAtEpochMs: input2.budgetTracker.deadlineAtEpochMs,
+      maxOutputBytes: input2.budgetTracker.budget.maxAgentOutputBytes,
       networkMode: input2.networkMode,
       onStarted: () => {
+        input2.budgetTracker.markStarted(reservation);
         if (!acceptingStartedEvents)
           return Promise.resolve();
         const event = {
@@ -209355,10 +210373,61 @@ async function runAgents(input2) {
       }
     };
   });
-  const results = await input2.manager.runAll(agentInputs);
+  let results;
+  try {
+    results = await input2.manager.runAll(agentInputs);
+  } catch (error51) {
+    const detail = sanitizeTextForDisplay(error51 instanceof Error ? error51.message : String(error51));
+    input2.warnings.push(`Primary-agent execution failed: ${detail}`);
+    results = agentInputs.map((agentInput) => ({
+      agent: agentInput.agent,
+      role: agentInput.role,
+      status: "failed",
+      startedAt: new Date().toISOString(),
+      completedAt: new Date().toISOString(),
+      error: {
+        code: "AGENT_MANAGER_FAILED",
+        message: "The agent manager did not return a review result."
+      }
+    }));
+  }
   acceptingStartedEvents = false;
   await Promise.all(startedWrites);
-  await Promise.all(results.map((result) => {
+  const resultByAgent = new Map(results.map((result) => [result.agent, result]));
+  const orderedResults = enabledAgents.map((agent) => {
+    const existing = resultByAgent.get(agent);
+    if (existing)
+      return existing;
+    const role = agentRoles[agent] ?? input2.config.agents[agent].role;
+    const timestamp = new Date().toISOString();
+    return {
+      agent,
+      role,
+      status: "failed",
+      startedAt: timestamp,
+      completedAt: timestamp,
+      error: {
+        code: "AGENT_RESULT_MISSING",
+        message: "The agent manager did not return a review result."
+      }
+    };
+  });
+  for (const result of orderedResults) {
+    const reservation = reservations.get(result.agent);
+    if (!reservation)
+      continue;
+    await finalizeModelCallResult({
+      budgetTracker: input2.budgetTracker,
+      reservation,
+      result,
+      trace: input2.trace,
+      traceId: input2.traceId
+    });
+    if (result.status !== "completed") {
+      input2.budgetTracker.markIncomplete("coverage_incomplete");
+    }
+  }
+  await Promise.all(orderedResults.map((result) => {
     const event = {
       type: "agent_completed",
       traceId: input2.traceId,
@@ -209378,8 +210447,92 @@ async function runAgents(input2) {
     }
     return input2.trace.write(event);
   }));
+  return orderedResults;
+}
+async function skipReservedPrimaryAgents(input2) {
+  const results = [];
+  for (const agent of input2.agents) {
+    const reservation = input2.reservations.get(agent);
+    if (reservation)
+      input2.budgetTracker.skip(reservation, input2.reason);
+    await input2.trace.write({
+      type: "model_call_skipped",
+      traceId: input2.traceId,
+      kind: "primary",
+      agent,
+      reason: input2.reason,
+      timestamp: new Date().toISOString()
+    });
+    const timestamp = new Date().toISOString();
+    results.push({
+      agent,
+      role: input2.agentRoles[agent] ?? input2.config.agents[agent].role,
+      status: "skipped",
+      startedAt: timestamp,
+      completedAt: timestamp,
+      error: {
+        code: "REVIEW_DEADLINE_EXCEEDED",
+        message: "Review deadline was reached before the agent could start."
+      }
+    });
+  }
   return results;
 }
+async function finalizeModelCallResult(input2) {
+  const reason = input2.result.error?.code ?? input2.result.status;
+  const hasStarted = input2.budgetTracker.hasStarted(input2.reservation);
+  const canSkip = input2.result.status === "skipped" || isPreflightAgentFailure(input2.result) || !hasStarted && input2.result.error?.code === "REVIEW_DEADLINE_EXCEEDED";
+  if (canSkip && !hasStarted) {
+    input2.budgetTracker.skip(input2.reservation, reason);
+    if (input2.result.error?.code === "REVIEW_DEADLINE_EXCEEDED") {
+      input2.budgetTracker.markIncomplete("deadline");
+    }
+    await input2.trace.write({
+      type: "model_call_skipped",
+      traceId: input2.traceId,
+      kind: input2.reservation.kind,
+      agent: input2.reservation.agent,
+      reason,
+      timestamp: new Date().toISOString()
+    });
+    return;
+  }
+  input2.budgetTracker.markStarted(input2.reservation);
+  const usage = normalizeModelTokenUsage(input2.result.usage);
+  const outputBytes = input2.result.outputBytes ?? (input2.result.rawText ? Buffer.byteLength(input2.result.rawText, "utf8") : undefined);
+  input2.budgetTracker.complete(input2.reservation, {
+    ...outputBytes === undefined ? {} : { outputBytes },
+    ...usage ? { usage } : {},
+    ...input2.result.stopReason ? { stopReason: input2.result.stopReason } : {}
+  });
+  if (input2.result.error?.code === "AGENT_OUTPUT_LIMIT") {
+    input2.budgetTracker.markIncomplete("agent_output_limit");
+  }
+  if (input2.result.error?.code === "REVIEW_DEADLINE_EXCEEDED") {
+    input2.budgetTracker.markIncomplete("deadline");
+  }
+  await input2.trace.write({
+    type: "model_call_completed",
+    traceId: input2.traceId,
+    kind: input2.reservation.kind,
+    agent: input2.reservation.agent,
+    resultStatus: input2.result.status,
+    ...input2.result.error?.code ? { errorCode: input2.result.error.code } : {},
+    ...outputBytes === undefined ? {} : { outputBytes },
+    ...usage ? { usage } : {},
+    ...input2.result.stopReason ? { stopReason: input2.result.stopReason } : {},
+    timestamp: new Date().toISOString()
+  });
+}
+function isPreflightAgentFailure(result) {
+  return result.status === "failed" && [
+    "AGENT_CONFIG_INVALID",
+    "OPENROUTER_KEY_MISSING",
+    "AGENT_SPAWN_FAILED",
+    "AGENT_MANAGER_FAILED",
+    "AGENT_RESULT_MISSING"
+  ].includes(result.error?.code ?? "");
+}
 function resolveAgentRoles(config2) {
   const enabledAgents = ["codex", "claude"].filter((agent) => config2.agents[agent].enabled);
   const singleAgentMode = enabledAgents.length === 1;
@@ -209395,14 +210548,30 @@ function defaultAgentManager(config2, parentEnv) {
   }
   return new SubprocessAcpAgentManager(config2, parentEnv);
 }
-function normalizeAgentRunResult(result) {
-  if (result.status === "completed" && result.rawText && !result.normalized) {
-    return {
-      ...result,
-      normalized: normalizeAgentOutput(result.agent, result.role, result.rawText)
-    };
-  }
-  return result;
+function normalizeAgentRunResult(result, maxFindingsPerAgent) {
+  const normalizedResult = result.status === "completed" && result.rawText && !result.normalized ? {
+    ...result,
+    normalized: normalizeAgentOutput(result.agent, result.role, result.rawText)
+  } : result;
+  const normalized = normalizedResult.normalized;
+  const findings = normalized?.findings;
+  if (!normalized || !findings || findings.length <= maxFindingsPerAgent) {
+    return { result: normalizedResult, findingsCapped: false };
+  }
+  const limitedFindings = findings.map((finding, index) => ({ finding, index })).sort((left, right) => {
+    const severity = compareSeverity(left.finding.severity, right.finding.severity);
+    return severity === 0 ? left.index - right.index : severity;
+  }).slice(0, maxFindingsPerAgent).map(({ finding }) => finding);
+  return {
+    result: {
+      ...normalizedResult,
+      normalized: {
+        ...normalized,
+        findings: limitedFindings
+      }
+    },
+    findingsCapped: true
+  };
 }
 function agentOpinionSummary(result, includeRawText = false) {
   const opinion = {
@@ -209424,8 +210593,12 @@ async function buildSecretBlockResult(input2) {
   });
   const cisa = input2.tool === "security_review" ? computeCisaGate([finding], []) : undefined;
   const completedAt = new Date().toISOString();
+  const budget = input2.budgetTracker.snapshot();
   const resultWithoutMarkdown = {
     decision: "block",
+    completion: budget.completion,
+    executionBudget: budget.executionBudget,
+    requestFingerprint: input2.requestFingerprint,
     degraded: false,
     agentsUsed: [],
     reviewMode: "multi_agent",
@@ -209461,9 +210634,16 @@ async function buildSecretBlockResult(input2) {
       networkMode: input2.networkMode,
       workspaceMode: "temp_snapshot",
       configHash: input2.configHash,
-      warnings: input2.warnings
+      warnings: input2.warnings,
+      modelCalls: budget.modelCalls
     }
   };
+  await writeReviewBudgetCompleted({
+    trace: input2.trace,
+    traceId: input2.traceId,
+    budgetTracker: input2.budgetTracker,
+    requestFingerprint: input2.requestFingerprint
+  });
   await input2.trace.write({
     type: "decision_completed",
     traceId: input2.traceId,
@@ -209506,8 +210686,12 @@ function reindexFindings(findings) {
 }
 async function buildPolicyBlockResult(input2) {
   const completedAt = new Date().toISOString();
+  const budget = input2.budgetTracker.snapshot();
   const resultWithoutMarkdown = {
     decision: "block",
+    completion: budget.completion,
+    executionBudget: budget.executionBudget,
+    requestFingerprint: input2.requestFingerprint,
     degraded: false,
     agentsUsed: [],
     reviewMode: "multi_agent",
@@ -209526,9 +210710,16 @@ async function buildPolicyBlockResult(input2) {
       networkMode: input2.networkMode,
       workspaceMode: "temp_snapshot",
       configHash: input2.configHash,
-      warnings: [input2.warning]
+      warnings: [input2.warning],
+      modelCalls: budget.modelCalls
     }
   };
+  await writeReviewBudgetCompleted({
+    trace: input2.trace,
+    traceId: input2.traceId,
+    budgetTracker: input2.budgetTracker,
+    requestFingerprint: input2.requestFingerprint
+  });
   await input2.trace.write({
     type: "decision_completed",
     traceId: input2.traceId,
@@ -209565,6 +210756,33 @@ async function finalizeReviewResult(input2) {
     })
   };
 }
+async function writeReviewBudgetPlanned(input2) {
+  const snapshot = input2.budgetTracker.snapshot();
+  await input2.trace.write({
+    type: "review_budget_planned",
+    traceId: input2.traceId,
+    requestFingerprint: input2.requestFingerprint,
+    maxModelCalls: snapshot.executionBudget.maxModelCalls,
+    maxTotalWallTimeMs: snapshot.executionBudget.wallTime.limitMs,
+    maxAgentOutputBytes: snapshot.executionBudget.maxAgentOutputBytes,
+    maxFindingsPerAgent: snapshot.executionBudget.maxFindingsPerAgent,
+    skipOptionalPhasesWhenTokenUsageUnknown: snapshot.executionBudget.skipOptionalPhasesWhenTokenUsageUnknown,
+    timestamp: new Date().toISOString()
+  });
+}
+async function writeReviewBudgetCompleted(input2) {
+  const snapshot = input2.budgetTracker.snapshot();
+  await input2.trace.write({
+    type: "review_budget_completed",
+    traceId: input2.traceId,
+    requestFingerprint: input2.requestFingerprint,
+    completion: snapshot.completion,
+    modelCalls: snapshot.executionBudget.modelCalls,
+    wallTime: snapshot.executionBudget.wallTime,
+    tokenUsage: snapshot.executionBudget.tokenUsage,
+    timestamp: new Date().toISOString()
+  });
+}
 function mergeDenyPatterns(configDeny, requestDeny) {
   return Array.from(new Set([...configDeny, ...requestDeny ?? []]));
 }
@@ -209617,6 +210835,13 @@ var kyosoReviewRequestSchema = object({
   options: object({
     network: _enum2(["model_only", "unrestricted"]).optional(),
     maxAgentTimeoutMs: number2().int().positive().optional(),
+    reviewBudget: object({
+      maxModelCalls: number2().int().positive().optional(),
+      maxTotalWallTimeMs: number2().int().positive().optional(),
+      maxAgentOutputBytes: number2().int().positive().optional(),
+      maxFindingsPerAgent: number2().int().positive().optional(),
+      skipOptionalPhasesWhenTokenUsageUnknown: boolean2().optional()
+    }).strict().optional(),
     includeAgentRawOutputs: boolean2().optional(),
     judgeProvider: _enum2(["auto", "openai", "anthropic", "none"]).optional(),
     allowSecretRedaction: boolean2().optional()