@kyo-so/cli 0.10.0 → 0.11.0

package/dist/index.js

@@ -183779,6 +183779,14 @@ function date4(params) {
 
 // node_modules/zod/v4/classic/external.js
 config(en_default());
+// src/core/constants.ts
+var DEFAULT_AGENT_TIMEOUT_MS = 120000;
+var MAX_AGENT_OUTPUT_BYTES = 1048576;
+var JUDGE_MAX_OUTPUT_TOKENS = 4096;
+var RAW_OUTPUT_MAX_CHARS = 16384;
+var TRACE_DIR = ".kyoso/traces";
+var KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
+
 // src/config/schema.ts
 var CODEX_OPENROUTER_PROVIDER = "openrouter";
 var CODEX_DEFAULT_PROVIDER = "default";
@@ -183823,6 +183831,13 @@ var codexAgentSchema = baseAgentSchema.extend({
     }
   });
 });
+var reviewBudgetSchema = exports_external.object({
+  maxModelCalls: exports_external.number().int().positive(),
+  maxTotalWallTimeMs: exports_external.number().int().positive(),
+  maxAgentOutputBytes: exports_external.number().int().positive().max(MAX_AGENT_OUTPUT_BYTES),
+  maxFindingsPerAgent: exports_external.number().int().positive(),
+  skipOptionalPhasesWhenTokenUsageUnknown: exports_external.boolean()
+});
 var kyosoConfigSchema = exports_external.object({
   entrypoints: exports_external.object({
     mcp: exports_external.boolean(),
@@ -183880,6 +183895,7 @@ var kyosoConfigSchema = exports_external.object({
     timeoutMs: exports_external.number().int().positive().default(90000),
     allowDemotion: exports_external.boolean().default(false)
   }),
+  reviewBudget: reviewBudgetSchema,
   audit: exports_external.object({
     enabled: exports_external.boolean(),
     format: exports_external.literal("jsonl"),
@@ -183887,6 +183903,15 @@ var kyosoConfigSchema = exports_external.object({
     includeRawAgentOutput: exports_external.boolean(),
     includeFileContents: exports_external.boolean()
   })
+}).superRefine((config2, context) => {
+  const enabledPrimaryReviewers = Object.values(config2.agents).filter((agent) => agent.enabled).length;
+  if (config2.reviewBudget.maxModelCalls >= enabledPrimaryReviewers)
+    return;
+  context.addIssue({
+    code: exports_external.ZodIssueCode.custom,
+    path: ["reviewBudget", "maxModelCalls"],
+    message: "must be greater than or equal to the number of enabled primary reviewers."
+  });
 });
 function agentConfigLeafPaths(agent) {
   const paths = [
@@ -183945,6 +183970,11 @@ var kyosoConfigKnownLeafPaths = [
   "verification.maxFindings",
   "verification.timeoutMs",
   "verification.allowDemotion",
+  "reviewBudget.maxModelCalls",
+  "reviewBudget.maxTotalWallTimeMs",
+  "reviewBudget.maxAgentOutputBytes",
+  "reviewBudget.maxFindingsPerAgent",
+  "reviewBudget.skipOptionalPhasesWhenTokenUsageUnknown",
   "audit.enabled",
   "audit.format",
   "audit.directory",
@@ -183964,6 +183994,7 @@ var kyosoConfigSecuritySensitivePrefixes = [
   "secrets",
   "securityReview",
   "verification",
+  "reviewBudget",
   "workspace"
 ];
 
@@ -184077,7 +184108,7 @@ var defaultConfig = {
     }
   },
   judge: {
-    mode: "deterministic_plus_llm",
+    mode: "deterministic_only",
     provider: "auto",
     timeoutMs: 60000
   },
@@ -184087,6 +184118,13 @@ var defaultConfig = {
     timeoutMs: 90000,
     allowDemotion: false
   },
+  reviewBudget: {
+    maxModelCalls: 4,
+    maxTotalWallTimeMs: 480000,
+    maxAgentOutputBytes: 65536,
+    maxFindingsPerAgent: 10,
+    skipOptionalPhasesWhenTokenUsageUnknown: true
+  },
   audit: {
     enabled: true,
     format: "jsonl",
@@ -184151,7 +184189,7 @@ function collectProjectScopeViolations(config2) {
   const violations = [];
   for (const leaf of leaves) {
     const path = leaf.path.join(".");
-    const globalOnlyReason = PROJECT_GLOBAL_ONLY_REASONS[path];
+    const globalOnlyReason = projectGlobalOnlyReason(leaf.path);
     if (globalOnlyReason) {
       violations.push({ path, reason: globalOnlyReason });
       continue;
@@ -184166,6 +184204,15 @@ function collectProjectScopeViolations(config2) {
   }
   return violations.sort((left, right) => left.path.localeCompare(right.path));
 }
+function projectGlobalOnlyReason(path) {
+  const exactReason = PROJECT_GLOBAL_ONLY_REASONS[path.join(".")];
+  if (exactReason)
+    return exactReason;
+  if (path[0] === "reviewBudget") {
+    return "must be a user-global review budget ceiling";
+  }
+  return;
+}
 function isAllowedProjectPath(path) {
   const [top, second, third, fourth] = path;
   if (isAllowedConfigOverridePath(path))
@@ -184296,12 +184343,6 @@ function isRecord(value) {
 // src/security/redact.ts
 var REDACTION = "[KYOSO_REDACTED]";
 
-// src/core/constants.ts
-var DEFAULT_AGENT_TIMEOUT_MS = 120000;
-var RAW_OUTPUT_MAX_CHARS = 16384;
-var TRACE_DIR = ".kyoso/traces";
-var KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
-
 // src/security/sanitizeText.ts
 var SENSITIVE_TEXT_PATTERNS = [
   /\bsk-(?:proj-)?[A-Za-z0-9_-]{8,}\b/g,
@@ -189791,6 +189832,33 @@ var legacyClientNotificationMethods = new Set([
   CLIENT_METHODS.elicitation_complete
 ]);
 
+// src/core/tokenUsage.ts
+var TOKEN_USAGE_KEYS = [
+  "totalTokens",
+  "inputTokens",
+  "outputTokens",
+  "thoughtTokens",
+  "cachedReadTokens",
+  "cachedWriteTokens"
+];
+function normalizeModelTokenUsage(usage) {
+  if (!isRecord6(usage))
+    return;
+  const normalized = {};
+  for (const key of TOKEN_USAGE_KEYS) {
+    const value = usage[key];
+    if (isTokenCount(value))
+      normalized[key] = value;
+  }
+  return Object.keys(normalized).length > 0 ? normalized : undefined;
+}
+function isTokenCount(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/utils/env.ts
 import { stderr as stderr2 } from "node:process";
 var MINIMAL_ENV_KEYS = [
@@ -190136,7 +190204,7 @@ function isSeverity(value) {
   return typeof value === "string" && severities.includes(value);
 }
 function normalizeCisaSecureByDesign(value) {
-  if (!isRecord6(value))
+  if (!isRecord7(value))
     return;
   const normalized = {};
   const customerSecurityOutcomes = normalizeGateStatus(value.customerSecurityOutcomes);
@@ -190177,7 +190245,7 @@ function normalizeFindingFiles(value) {
   if (!Array.isArray(value))
     return;
   const files = value.flatMap((item) => {
-    if (!isRecord6(item) || typeof item.path !== "string" || item.path.trim().length === 0) {
+    if (!isRecord7(item) || typeof item.path !== "string" || item.path.trim().length === 0) {
       return [];
     }
     const file2 = {
@@ -190196,7 +190264,7 @@ function normalizeFindingFiles(value) {
 function normalizeLineNumber(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -190256,6 +190324,20 @@ class SubprocessAcpAgentManager extends BaseAcpAgentManager {
 }
 async function runSubprocessAgent(agent, agentConfig, input, env) {
   const startedAt = new Date().toISOString();
+  const effectiveTimeoutMs = resolveEffectiveTimeoutMs(input);
+  if (effectiveTimeoutMs <= 0) {
+    return {
+      agent,
+      role: input.role,
+      status: "timeout",
+      startedAt,
+      completedAt: startedAt,
+      error: {
+        code: "REVIEW_DEADLINE_EXCEEDED",
+        message: "Review deadline was reached before the agent could start."
+      }
+    };
+  }
   return new Promise((resolveResult) => {
     const child = spawn(agentConfig.command, agentConfig.args, {
       cwd: input.workspaceDir,
@@ -190284,6 +190366,7 @@ async function runSubprocessAgent(agent, agentConfig, input, env) {
     const timeout = setTimeout(() => {
       abortController.abort(new Error("Kyoso agent timeout"));
       terminateChild(child);
+      const deadlineReached = input.deadlineAtEpochMs !== undefined && Date.now() >= input.deadlineAtEpochMs;
       resolveOnce({
         agent,
         role: input.role,
@@ -190291,11 +190374,11 @@ async function runSubprocessAgent(agent, agentConfig, input, env) {
         startedAt,
         completedAt: new Date().toISOString(),
         error: {
-          code: "AGENT_TIMEOUT",
-          message: `Agent timed out after ${input.timeoutMs}ms`
+          code: deadlineReached ? "REVIEW_DEADLINE_EXCEEDED" : "AGENT_TIMEOUT",
+          message: deadlineReached ? "Review deadline reached before the agent completed." : `Agent timed out after ${effectiveTimeoutMs}ms`
         }
       });
-    }, input.timeoutMs);
+    }, effectiveTimeoutMs);
     child.stderr.on("data", (chunk) => {
       stderr3 += chunk.toString("utf8");
     });
@@ -190311,19 +190394,48 @@ async function runSubprocessAgent(agent, agentConfig, input, env) {
         error: failure
       });
     });
-    runAcpClientWorkflow(child, input, abortController.signal, resolveEffortConfigOption(agent, agentConfig.effort)).then(({ rawText, warnings }) => {
+    runAcpClientWorkflow(child, input, abortController, resolveEffortConfigOption(agent, agentConfig.effort)).then(({ rawText, warnings, usage, outputBytes, stopReason }) => {
       stdout = rawText;
+      const completed = stopReason === "end_turn";
       resolveOnce({
         agent,
         role: input.role,
-        status: "completed",
+        status: completed ? "completed" : "failed",
         rawText,
         normalized: normalizeAgentOutput(agent, input.role, rawText),
         startedAt,
         completedAt: new Date().toISOString(),
-        ...warnings.length > 0 ? { warnings } : {}
+        outputBytes,
+        stopReason,
+        ...usage ? { usage } : {},
+        ...warnings.length > 0 ? { warnings } : {},
+        ...completed ? {} : {
+          error: {
+            code: "AGENT_STOPPED_EARLY",
+            message: `Agent stopped before completing the review: ${stopReason}.`
+          }
+        }
       });
     }).catch((error51) => {
+      const outputLimitError = findOutputLimitError(error51, abortController);
+      if (outputLimitError) {
+        stdout = outputLimitError.rawText;
+        resolveOnce({
+          agent,
+          role: input.role,
+          status: "failed",
+          rawText: stdout,
+          outputBytes: outputLimitError.outputBytes,
+          stopReason: "cancelled",
+          startedAt,
+          completedAt: new Date().toISOString(),
+          error: {
+            code: "AGENT_OUTPUT_LIMIT",
+            message: `Agent output exceeded ${outputLimitError.maxOutputBytes} bytes and was cancelled.`
+          }
+        });
+        return;
+      }
       if (abortController.signal.aborted)
         return;
       const failureText = [stderr3, formatAgentErrorDetail(error51)].filter((part) => part.trim().length > 0).join(`
@@ -190356,7 +190468,7 @@ async function runSubprocessAgent(agent, agentConfig, input, env) {
     });
   });
 }
-async function runAcpClientWorkflow(child, input, signal, configOption) {
+async function runAcpClientWorkflow(child, input, abortController, configOption) {
   if (!child.stdin || !child.stdout) {
     throw new Error("Agent process did not expose stdio streams.");
   }
@@ -190406,8 +190518,8 @@ async function runAcpClientWorkflow(child, input, signal, configOption) {
     }).withSession(async (session) => {
       const warnings = [];
       if (configOption) {
-        await ctx.request(methods.agent.session.setConfigOption, { sessionId: session.sessionId, ...configOption }, { cancellationSignal: signal }).catch((error51) => {
-          if (signal.aborted)
+        await ctx.request(methods.agent.session.setConfigOption, { sessionId: session.sessionId, ...configOption }, { cancellationSignal: abortController.signal }).catch((error51) => {
+          if (abortController.signal.aborted)
             return;
           const sanitizedValue = sanitizeTextForDisplay(configOption.value);
           const detail = sanitizeTextForDisplay(formatAgentErrorDetail(error51));
@@ -190417,14 +190529,75 @@ async function runAcpClientWorkflow(child, input, signal, configOption) {
         });
       }
       const promptResponse = session.prompt(input.prompt, {
-        cancellationSignal: signal
+        cancellationSignal: abortController.signal
       });
-      const text = await session.readText();
-      await promptResponse;
-      return { rawText: text, warnings };
+      promptResponse.catch(() => {
+        return;
+      });
+      let rawText = "";
+      let outputBytes = 0;
+      for (;; ) {
+        const message = await session.nextUpdate();
+        if (message.kind === "stop") {
+          const usage = normalizeUsage(message.response.usage);
+          return {
+            rawText,
+            warnings,
+            ...usage ? { usage } : {},
+            outputBytes,
+            stopReason: message.stopReason
+          };
+        }
+        const update = message.update;
+        if (update.sessionUpdate !== "agent_message_chunk" && update.sessionUpdate !== "agent_thought_chunk" || update.content.type !== "text") {
+          continue;
+        }
+        const chunkBytes = Buffer.byteLength(update.content.text, "utf8");
+        const nextOutputBytes = outputBytes + chunkBytes;
+        if (input.maxOutputBytes !== undefined && nextOutputBytes > input.maxOutputBytes) {
+          await ctx.notify(methods.agent.session.cancel, {
+            sessionId: session.sessionId
+          }).catch(() => {
+            return;
+          });
+          const error51 = new AgentOutputLimitError(rawText, nextOutputBytes, input.maxOutputBytes);
+          abortController.abort(error51);
+          throw error51;
+        }
+        if (update.sessionUpdate === "agent_message_chunk") {
+          rawText += update.content.text;
+        }
+        outputBytes = nextOutputBytes;
+      }
     });
   });
 }
+
+class AgentOutputLimitError extends Error {
+  rawText;
+  outputBytes;
+  maxOutputBytes;
+  constructor(rawText, outputBytes, maxOutputBytes) {
+    super(`Agent output exceeded ${maxOutputBytes} bytes.`);
+    this.rawText = rawText;
+    this.outputBytes = outputBytes;
+    this.maxOutputBytes = maxOutputBytes;
+    this.name = "AgentOutputLimitError";
+  }
+}
+function findOutputLimitError(error51, abortController) {
+  if (error51 instanceof AgentOutputLimitError)
+    return error51;
+  const reason = abortController.signal.reason;
+  return reason instanceof AgentOutputLimitError ? reason : undefined;
+}
+function resolveEffectiveTimeoutMs(input) {
+  const deadlineRemaining = input.deadlineAtEpochMs === undefined ? Number.POSITIVE_INFINITY : input.deadlineAtEpochMs - Date.now();
+  return Math.max(0, Math.min(input.timeoutMs, deadlineRemaining));
+}
+function normalizeUsage(usage) {
+  return normalizeModelTokenUsage(usage);
+}
 function resolveEffortConfigOption(agent, effort) {
   if (!effort)
     return;
@@ -190646,9 +190819,10 @@ ${JSON.stringify(opinion)}
       role: input.role,
       status: "completed",
       rawText,
-      normalized: scenario === "success" ? opinion : undefined,
+      normalized: scenario === "success" || scenario === "unknown_usage" ? opinion : undefined,
       startedAt,
-      completedAt: new Date().toISOString()
+      completedAt: new Date().toISOString(),
+      ...scenario === "unknown_usage" ? {} : { usage: fakeUsage() }
     };
   }
 }
@@ -190682,9 +190856,13 @@ function verifierResult(input, startedAt, scenario) {
     status: "completed",
     rawText,
     startedAt,
-    completedAt: new Date().toISOString()
+    completedAt: new Date().toISOString(),
+    usage: fakeUsage()
   };
 }
+function fakeUsage() {
+  return { totalTokens: 20, inputTokens: 12, outputTokens: 8 };
+}
 function findingIdsFromPrompt(prompt) {
   return Array.from(prompt.matchAll(/^Finding ID: (.+)$/gm)).map((match) => match[1] ?? "");
 }
@@ -191607,6 +191785,16 @@ async function optionalLstat2(path) {
 }
 
 // src/audit/sanitize.ts
+var USAGE_METADATA_KEYS = new Set([
+  "tokenUsage",
+  "totalTokens",
+  "inputTokens",
+  "outputTokens",
+  "thoughtTokens",
+  "cachedReadTokens",
+  "cachedWriteTokens",
+  "skipOptionalPhasesWhenTokenUsageUnknown"
+]);
 function sanitizeForAudit(value, options = {}) {
   if (typeof value === "string")
     return sanitizeText(value);
@@ -191615,7 +191803,7 @@ function sanitizeForAudit(value, options = {}) {
   if (typeof value === "object" && value !== null) {
     const result = {};
     for (const [key, nested] of Object.entries(value)) {
-      if (/raw|content|env|credential|token|secret|password/i.test(key) && !(options.includeRawAgentOutput && key === "rawText")) {
+      if (/raw|content|env|credential|token|secret|password/i.test(key) && !(options.includeRawAgentOutput && key === "rawText") && !isUsageMetadata(key, nested)) {
         continue;
       }
       result[key] = sanitizeForAudit(nested, options);
@@ -191624,6 +191812,17 @@ function sanitizeForAudit(value, options = {}) {
   }
   return value;
 }
+function isUsageMetadata(key, value) {
+  if (!USAGE_METADATA_KEYS.has(key))
+    return false;
+  if (key === "tokenUsage") {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+  }
+  if (key === "skipOptionalPhasesWhenTokenUsageUnknown") {
+    return typeof value === "boolean";
+  }
+  return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
 
 // src/audit/trace.ts
 var AUDIT_WARNING_WRITE_FAILED = "AUDIT_WRITE_FAILED: Audit trace writing failed; no further audit events will be written.";
@@ -191889,6 +192088,8 @@ function renderMarkdownResult(tool, result, options = {}) {
     "",
     `**Decision:** ${result.decision}`,
     `**Mode:** ${tool}`,
+    `**Completion:** ${formatCompletion(result)}`,
+    `**Request fingerprint:** ${shortFingerprint(result.requestFingerprint)}`,
     `**Agents:** ${result.agentOpinions.map((opinion) => `${title(opinion.agent)} ${opinion.status}`).join(", ")}`,
     `**Review mode:** ${formatReviewMode(result)}`,
     ...result.verificationMode ? [
@@ -191900,6 +192101,7 @@ function renderMarkdownResult(tool, result, options = {}) {
     "",
     options.summaryText ?? defaultSummaryText(result)
   ];
+  lines.push(...formatExecutionBudget(result));
   if (result.cisaSecureByDesign) {
     lines.push("", "## CISA Secure by Design Gate", "", "| Dimension | Status | Notes |", "|---|---|---|", `| Customer Security Outcomes | ${result.cisaSecureByDesign.customerSecurityOutcomes} | ${notes(result.cisaSecureByDesign.notes)} |`, `| Secure by Default | ${result.cisaSecureByDesign.secureByDefault} | ${notes(result.cisaSecureByDesign.notes)} |`, `| Transparency & Accountability | ${result.cisaSecureByDesign.transparencyAndAccountability} | ${notes(result.cisaSecureByDesign.notes)} |`, `| Governance | ${result.cisaSecureByDesign.governance} | ${notes(result.cisaSecureByDesign.notes)} |`);
   }
@@ -191952,8 +192154,37 @@ function renderMarkdownResult(tool, result, options = {}) {
 `);
 }
 function defaultSummaryText(result) {
+  if (result.completion.status === "incomplete") {
+    const reasons = result.completion.reasons.length > 0 ? result.completion.reasons.join(", ") : "unspecified coverage gap";
+    return `Review incomplete (${reasons}). Decision is block because review coverage is incomplete, not because a code finding was established.`;
+  }
   return result.findings.length === 0 ? "No blocking findings were detected from the supplied context." : `${result.findings.length} finding(s) require attention.`;
 }
+function formatExecutionBudget(result) {
+  const budget = result.executionBudget;
+  const agentOutputs = Object.entries(budget.agentOutputBytes);
+  const outputLines = agentOutputs.length > 0 ? agentOutputs.map(([agent, bytes]) => `- ${title(agent)}: ${bytes} bytes`) : ["- None reported."];
+  const totalTokens = budget.tokenUsage.totals.totalTokens;
+  return [
+    "",
+    "## Execution Budget",
+    "",
+    `- Model calls: ${budget.modelCalls.planned} planned / ${budget.modelCalls.consumed} consumed / ${budget.modelCalls.skipped} skipped`,
+    `- Wall time: ${budget.wallTime.consumedMs}ms consumed / ${budget.wallTime.limitMs}ms limit`,
+    `- Token usage: ${budget.tokenUsage.status} (${budget.tokenUsage.reportedCalls} reported, ${budget.tokenUsage.unknownCalls} unknown${totalTokens === undefined ? "" : `, ${totalTokens} total`})`,
+    "- Agent output:",
+    ...outputLines
+  ];
+}
+function formatCompletion(result) {
+  if (result.completion.status === "complete")
+    return "complete";
+  const reasons = result.completion.reasons.join(", ") || "unspecified";
+  return `incomplete (${reasons}; retryable=${String(result.completion.retryable)})`;
+}
+function shortFingerprint(value) {
+  return value.length <= 20 ? value : `${value.slice(0, 20)}…`;
+}
 function title(value) {
   return value.slice(0, 1).toUpperCase() + value.slice(1);
 }
@@ -192042,7 +192273,7 @@ function parseJudgeOutput(text, fallbackSummaryText) {
   const parsed = JSON.parse(json2);
   const summaryText = typeof parsed.summaryText === "string" && parsed.summaryText.trim().length > 0 ? sanitizeText(parsed.summaryText) : fallbackSummaryText;
   const disagreementComments = Array.isArray(parsed.disagreementComments) ? parsed.disagreementComments.flatMap((item) => {
-    if (!isRecord7(item) || typeof item.topic !== "string" || typeof item.judgeComment !== "string") {
+    if (!isRecord8(item) || typeof item.topic !== "string" || typeof item.judgeComment !== "string") {
       return [];
     }
     return [
@@ -192058,7 +192289,7 @@ function parseJudgeOutput(text, fallbackSummaryText) {
   return { summaryText, disagreementComments, analysis };
 }
 function parseAnalysis(value) {
-  if (!isRecord7(value))
+  if (!isRecord8(value))
     return;
   if (!Array.isArray(value.blindSpots) || !Array.isArray(value.contradictions) || !Array.isArray(value.partialCoverage)) {
     return;
@@ -192066,7 +192297,7 @@ function parseAnalysis(value) {
   return {
     blindSpots: value.blindSpots.slice(0, ANALYSIS_MAX_ITEMS).flatMap((item) => typeof item === "string" ? [sanitizeAnalysisText(item)] : []),
     contradictions: value.contradictions.slice(0, ANALYSIS_MAX_ITEMS).flatMap((item) => {
-      if (!isRecord7(item) || typeof item.topic !== "string" || typeof item.detail !== "string") {
+      if (!isRecord8(item) || typeof item.topic !== "string" || typeof item.detail !== "string") {
         return [];
       }
       return [
@@ -192077,7 +192308,7 @@ function parseAnalysis(value) {
       ];
     }),
     partialCoverage: value.partialCoverage.slice(0, ANALYSIS_MAX_ITEMS).flatMap((item) => {
-      if (!isRecord7(item) || typeof item.note !== "string")
+      if (!isRecord8(item) || typeof item.note !== "string")
         return [];
       const findingId = typeof item.findingId === "string" ? sanitizeAnalysisText(item.findingId) : undefined;
       return [
@@ -192124,7 +192355,7 @@ function extractFirstJsonObject2(text) {
   }
   return;
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -192142,7 +192373,7 @@ async function runAnthropicJudge(input, timeoutMs) {
     },
     body: JSON.stringify({
       model: input.env.KYOSO_ANTHROPIC_JUDGE_MODEL ?? "claude-haiku-4-5",
-      max_tokens: 4096,
+      max_tokens: JUDGE_MAX_OUTPUT_TOKENS,
       temperature: 0,
       messages: [
         {
@@ -192158,7 +192389,21 @@ async function runAnthropicJudge(input, timeoutMs) {
   const content = payload.content?.find((item) => item.type === "text" && item.text)?.text;
   if (!content)
     throw new Error("Anthropic judge response did not include text content.");
-  return parseJudgeOutput(content, input.summaryText);
+  const usage = normalizeUsage2(payload.usage);
+  return {
+    output: parseJudgeOutput(content, input.summaryText),
+    ...usage ? { usage } : {}
+  };
+}
+function normalizeUsage2(usage) {
+  if (!usage)
+    return;
+  return normalizeModelTokenUsage({
+    inputTokens: usage.input_tokens,
+    outputTokens: usage.output_tokens,
+    cachedReadTokens: usage.cache_read_input_tokens,
+    cachedWriteTokens: usage.cache_creation_input_tokens
+  });
 }
 async function fetchWithTimeout(url2, init, timeoutMs) {
   const controller = new AbortController;
@@ -192202,6 +192447,7 @@ async function runOpenAiJudge(input, timeoutMs) {
           content: buildJudgePrompt(input.tool, input.result, input.summaryText, input.agentFindings)
         }
       ],
+      max_completion_tokens: JUDGE_MAX_OUTPUT_TOKENS,
       temperature: 0
     })
   }, timeoutMs);
@@ -192211,7 +192457,22 @@ async function runOpenAiJudge(input, timeoutMs) {
   const content = payload.choices?.[0]?.message?.content;
   if (!content)
     throw new Error("OpenAI judge response did not include content.");
-  return parseJudgeOutput(content, input.summaryText);
+  const usage = normalizeUsage3(payload.usage);
+  return {
+    output: parseJudgeOutput(content, input.summaryText),
+    ...usage ? { usage } : {}
+  };
+}
+function normalizeUsage3(usage) {
+  if (!usage)
+    return;
+  return normalizeModelTokenUsage({
+    totalTokens: usage.total_tokens,
+    inputTokens: usage.prompt_tokens,
+    outputTokens: usage.completion_tokens,
+    cachedReadTokens: usage.prompt_tokens_details?.cached_tokens,
+    thoughtTokens: usage.completion_tokens_details?.reasoning_tokens
+  });
 }
 async function fetchWithTimeout2(url2, init, timeoutMs) {
   const controller = new AbortController;
@@ -192253,8 +192514,13 @@ async function runJudge(input) {
     return { provider, status: "deterministic_fallback", output: fallback };
   }
   try {
-    const output = provider === "openai" ? await runOpenAiJudge(input, input.config.timeoutMs) : await runAnthropicJudge(input, input.config.timeoutMs);
-    return { provider, status: "completed", output };
+    const output = provider === "openai" ? await runOpenAiJudge(input, input.timeoutMs ?? input.config.timeoutMs) : await runAnthropicJudge(input, input.timeoutMs ?? input.config.timeoutMs);
+    return {
+      provider,
+      status: "completed",
+      output: output.output,
+      ...output.usage ? { usage: output.usage } : {}
+    };
   } catch (error51) {
     return {
       provider,
@@ -192527,6 +192793,304 @@ function newTraceId() {
   return `tr_${randomUUID()}`;
 }
 
+// src/core/requestFingerprint.ts
+import { createHash as createHash3 } from "node:crypto";
+var REVIEW_CONTRACT_VERSION = "2026-07-15-v1";
+function createRequestFingerprint(input) {
+  const reviewers = ["codex", "claude"].filter((agent) => input.config.agents[agent].enabled).map((agent) => ({
+    agent,
+    role: input.roles[agent] ?? input.config.agents[agent].role,
+    model: input.config.agents[agent].model ?? null,
+    provider: agent === "codex" ? input.config.agents.codex.provider ?? "default" : "default"
+  }));
+  const request = structuredClone(input.request);
+  if (request.options)
+    delete request.options.includeAgentRawOutputs;
+  const payload = {
+    reviewContractVersion: REVIEW_CONTRACT_VERSION,
+    tool: input.tool,
+    request,
+    reviewers,
+    verification: input.config.verification,
+    judge: {
+      ...input.config.judge,
+      requestedProvider: input.request.options?.judgeProvider ?? null
+    },
+    executionBudget: input.budget
+  };
+  return `sha256:${createHash3("sha256").update(canonicalJson(payload), "utf8").digest("hex")}`;
+}
+function canonicalJson(value) {
+  return JSON.stringify(canonicalize(value));
+}
+function canonicalize(value) {
+  if (Array.isArray(value))
+    return value.map(canonicalize);
+  if (!isRecord9(value))
+    return value;
+  return Object.fromEntries(Object.entries(value).filter(([, child]) => child !== undefined).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, child]) => [key, canonicalize(child)]));
+}
+function isRecord9(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/core/reviewBudget.ts
+var REVIEW_BUDGET_KEYS = new Set([
+  "maxModelCalls",
+  "maxTotalWallTimeMs",
+  "maxAgentOutputBytes",
+  "maxFindingsPerAgent",
+  "skipOptionalPhasesWhenTokenUsageUnknown"
+]);
+var MODEL_CALL_KINDS = ["primary", "verifier", "judge"];
+function resolveReviewBudget(ceiling, requested) {
+  if (requested === undefined)
+    return ceiling;
+  if (!isRecord10(requested)) {
+    throw new KyosoRequestError("options.reviewBudget must be an object.", "REVIEW_BUDGET_INVALID");
+  }
+  for (const [key, value] of Object.entries(requested)) {
+    if (!REVIEW_BUDGET_KEYS.has(key)) {
+      throw new KyosoRequestError(`options.reviewBudget.${key} is not supported.`, "REVIEW_BUDGET_INVALID");
+    }
+    if (key === "skipOptionalPhasesWhenTokenUsageUnknown") {
+      if (typeof value !== "boolean") {
+        throw new KyosoRequestError(`options.reviewBudget.${key} must be a boolean.`, "REVIEW_BUDGET_INVALID");
+      }
+      continue;
+    }
+    if (!isPositiveInteger(value)) {
+      throw new KyosoRequestError(`options.reviewBudget.${key} must be a positive integer.`, "REVIEW_BUDGET_INVALID");
+    }
+  }
+  const numericKeys = [
+    "maxModelCalls",
+    "maxTotalWallTimeMs",
+    "maxAgentOutputBytes",
+    "maxFindingsPerAgent"
+  ];
+  for (const key of numericKeys) {
+    const value = requested[key];
+    if (value === undefined)
+      continue;
+    if (value > ceiling[key]) {
+      throw new KyosoRequestError(`options.reviewBudget.${key} cannot exceed the user-global ceiling.`, "REVIEW_BUDGET_EXCEEDS_CEILING");
+    }
+  }
+  if (ceiling.skipOptionalPhasesWhenTokenUsageUnknown && requested.skipOptionalPhasesWhenTokenUsageUnknown === false) {
+    throw new KyosoRequestError("options.reviewBudget.skipOptionalPhasesWhenTokenUsageUnknown cannot relax the user-global ceiling.", "REVIEW_BUDGET_EXCEEDS_CEILING");
+  }
+  return {
+    maxModelCalls: requested.maxModelCalls ?? ceiling.maxModelCalls,
+    maxTotalWallTimeMs: requested.maxTotalWallTimeMs ?? ceiling.maxTotalWallTimeMs,
+    maxAgentOutputBytes: requested.maxAgentOutputBytes ?? ceiling.maxAgentOutputBytes,
+    maxFindingsPerAgent: requested.maxFindingsPerAgent ?? ceiling.maxFindingsPerAgent,
+    skipOptionalPhasesWhenTokenUsageUnknown: ceiling.skipOptionalPhasesWhenTokenUsageUnknown || requested.skipOptionalPhasesWhenTokenUsageUnknown === true
+  };
+}
+
+class ReviewBudgetTracker {
+  budget;
+  startedAtEpochMs;
+  deadlineAtEpochMs;
+  reservations = new Map;
+  skippedCalls = [];
+  incompleteReasons = new Set;
+  nextReservationId = 1;
+  constructor(budget, startedAtEpochMs = Date.now()) {
+    this.budget = budget;
+    this.startedAtEpochMs = startedAtEpochMs;
+    this.deadlineAtEpochMs = startedAtEpochMs + budget.maxTotalWallTimeMs;
+  }
+  remainingWallTimeMs(now = Date.now()) {
+    return Math.max(0, this.deadlineAtEpochMs - now);
+  }
+  hasDeadlineExpired(now = Date.now()) {
+    return this.remainingWallTimeMs(now) === 0;
+  }
+  reserveMany(inputs) {
+    if (this.hasDeadlineExpired())
+      return { failure: { reason: "deadline" } };
+    if (this.usedCapacity() + inputs.length > this.budget.maxModelCalls) {
+      return { failure: { reason: "model_call_budget" } };
+    }
+    const reservations = inputs.map((input) => {
+      const reservation = {
+        id: this.nextReservationId,
+        kind: input.kind,
+        ...input.agent ? { agent: input.agent } : {},
+        status: "reserved"
+      };
+      this.reservations.set(reservation.id, reservation);
+      this.nextReservationId += 1;
+      return reservation;
+    });
+    return {
+      reservations: reservations.map(({ id, kind, agent }) => ({
+        id,
+        kind,
+        ...agent ? { agent } : {}
+      }))
+    };
+  }
+  reserve(input) {
+    const result = this.reserveMany([input]);
+    if ("failure" in result)
+      return result;
+    const reservation = result.reservations[0];
+    if (!reservation) {
+      return { failure: { reason: "model_call_budget" } };
+    }
+    return { reservation };
+  }
+  markStarted(reservation) {
+    const current = this.reservations.get(reservation.id);
+    if (!current || current.status !== "reserved")
+      return;
+    current.status = "started";
+  }
+  hasStarted(reservation) {
+    const current = this.reservations.get(reservation.id);
+    return current?.status === "started" || current?.status === "completed";
+  }
+  complete(reservation, values = {}) {
+    const current = this.reservations.get(reservation.id);
+    if (!current || current.status === "skipped" || current.status === "completed") {
+      return;
+    }
+    current.status = "completed";
+    current.outputBytes = values.outputBytes;
+    current.usage = normalizeModelTokenUsage(values.usage);
+    current.stopReason = values.stopReason;
+  }
+  skip(reservation, reason) {
+    const current = this.reservations.get(reservation.id);
+    if (!current || current.status !== "reserved")
+      return;
+    current.status = "skipped";
+    current.reason = reason;
+  }
+  recordSkipped(input) {
+    this.skippedCalls.push({
+      kind: input.kind,
+      ...input.agent ? { agent: input.agent } : {},
+      status: "skipped",
+      reason: input.reason
+    });
+  }
+  markIncomplete(reason) {
+    this.incompleteReasons.add(reason);
+  }
+  isTokenUsageUnknown() {
+    return Array.from(this.reservations.values()).some((reservation) => reservation.status === "completed" && reservation.usage === undefined);
+  }
+  snapshot(now = Date.now()) {
+    const calls = this.modelCalls();
+    const byKind = Object.fromEntries(MODEL_CALL_KINDS.map((kind) => [
+      kind,
+      { planned: 0, consumed: 0, skipped: 0 }
+    ]));
+    let planned = 0;
+    let consumed = 0;
+    let skipped = 0;
+    const agentOutputBytes = {};
+    const usageTotals = {};
+    let reportedCalls = 0;
+    let unknownCalls = 0;
+    for (const reservation of this.reservations.values()) {
+      planned += 1;
+      byKind[reservation.kind].planned += 1;
+      if (reservation.status === "completed") {
+        consumed += 1;
+        byKind[reservation.kind].consumed += 1;
+        if (reservation.agent && reservation.outputBytes !== undefined) {
+          agentOutputBytes[reservation.agent] = (agentOutputBytes[reservation.agent] ?? 0) + reservation.outputBytes;
+        }
+        if (reservation.usage) {
+          reportedCalls += 1;
+          addUsage(usageTotals, reservation.usage);
+        } else {
+          unknownCalls += 1;
+        }
+      }
+      if (reservation.status === "skipped") {
+        skipped += 1;
+        byKind[reservation.kind].skipped += 1;
+      }
+    }
+    for (const call of this.skippedCalls) {
+      skipped += 1;
+      byKind[call.kind].skipped += 1;
+    }
+    const tokenStatus = consumed === 0 || reportedCalls === 0 ? "unknown" : unknownCalls === 0 ? "reported" : "partial";
+    const completionReasons = Array.from(this.incompleteReasons).sort();
+    const consumedMs = Math.max(0, now - this.startedAtEpochMs);
+    return {
+      completion: {
+        status: completionReasons.length > 0 ? "incomplete" : "complete",
+        reasons: completionReasons,
+        retryable: false
+      },
+      executionBudget: {
+        maxModelCalls: this.budget.maxModelCalls,
+        modelCalls: { planned, consumed, skipped, byKind },
+        wallTime: {
+          limitMs: this.budget.maxTotalWallTimeMs,
+          consumedMs,
+          remainingMs: this.remainingWallTimeMs(now)
+        },
+        maxAgentOutputBytes: this.budget.maxAgentOutputBytes,
+        maxFindingsPerAgent: this.budget.maxFindingsPerAgent,
+        skipOptionalPhasesWhenTokenUsageUnknown: this.budget.skipOptionalPhasesWhenTokenUsageUnknown,
+        agentOutputBytes,
+        tokenUsage: {
+          status: tokenStatus,
+          reportedCalls,
+          unknownCalls,
+          totals: usageTotals
+        }
+      },
+      modelCalls: calls
+    };
+  }
+  usedCapacity() {
+    return Array.from(this.reservations.values()).filter((reservation) => reservation.status === "reserved" || reservation.status === "started" || reservation.status === "completed").length;
+  }
+  modelCalls() {
+    const reservations = Array.from(this.reservations.values()).filter((reservation) => reservation.status === "completed" || reservation.status === "skipped").map((reservation) => ({
+      kind: reservation.kind,
+      ...reservation.agent ? { agent: reservation.agent } : {},
+      status: reservation.status === "completed" ? "completed" : "skipped",
+      ...reservation.reason ? { reason: reservation.reason } : {},
+      ...reservation.outputBytes !== undefined ? { outputBytes: reservation.outputBytes } : {},
+      ...reservation.usage ? { usage: reservation.usage } : {},
+      ...reservation.stopReason ? { stopReason: reservation.stopReason } : {}
+    }));
+    return [...reservations, ...this.skippedCalls];
+  }
+}
+function addUsage(total, usage) {
+  for (const key of [
+    "totalTokens",
+    "inputTokens",
+    "outputTokens",
+    "thoughtTokens",
+    "cachedReadTokens",
+    "cachedWriteTokens"
+  ]) {
+    const value = usage[key];
+    if (value === undefined)
+      continue;
+    total[key] = (total[key] ?? 0) + value;
+  }
+}
+function isPositiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+function isRecord10(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/core/verification.ts
 var REAL_AGENTS = ["codex", "claude"];
 var VERIFIABLE_SEVERITIES = new Set(["critical", "high"]);
@@ -192568,9 +193132,12 @@ function groupVerificationTargetsByVerifier(targets) {
     findings
   }));
 }
-function markVerificationOverflow(targets) {
+function markVerificationOverflow(targets, reason) {
   for (const target of targets) {
-    target.finding.verification = { status: "not_verified" };
+    target.finding.verification = {
+      status: "not_verified",
+      ...reason ? { note: reason } : {}
+    };
   }
 }
 function parseVerificationVerdicts(rawText) {
@@ -192582,7 +193149,7 @@ function parseVerificationVerdicts(rawText) {
     if (!Array.isArray(parsed.verdicts))
       return;
     return parsed.verdicts.flatMap((item) => {
-      if (!isRecord8(item))
+      if (!isRecord11(item))
         return [];
       if (typeof item.findingId !== "string")
         return [];
@@ -192660,15 +193227,23 @@ function verificationNote(reasoning) {
 function isVerdict(value) {
   return value === "confirmed" || value === "refuted" || value === "uncertain";
 }
-function isRecord8(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // src/core/runReview.ts
+function requestForRecursionFingerprint(request) {
+  try {
+    return scanAndRedactSecrets(request).redactedRequest;
+  } catch {
+    return { goal: "" };
+  }
+}
 async function runReview(tool, request, options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const traceId = newTraceId();
-  const startedAt = new Date().toISOString();
+  const startedAtEpochMs = Date.now();
+  const startedAt = new Date(startedAtEpochMs).toISOString();
   const auditEnv = { ...process.env, ...options.env };
   const traceWriterFactory = options.traceWriterFactory ?? createTraceWriter;
   let snapshot;
@@ -192677,6 +193252,14 @@ async function runReview(tool, request, options = {}) {
   } catch (error51) {
     if (error51 instanceof KyosoRequestError) {
       const config2 = kyosoConfigSchema.parse(defaultConfig);
+      const budgetTracker = new ReviewBudgetTracker(config2.reviewBudget, startedAtEpochMs);
+      const requestFingerprint = createRequestFingerprint({
+        tool,
+        request: requestForRecursionFingerprint(request),
+        config: config2,
+        roles: resolveAgentRoles(config2),
+        budget: config2.reviewBudget
+      });
       const trace2 = traceWriterFactory({
         enabled: config2.audit.enabled,
         directory: config2.audit.directory,
@@ -192691,6 +193274,12 @@ async function runReview(tool, request, options = {}) {
           tool,
           timestamp: new Date().toISOString()
         });
+        await writeReviewBudgetPlanned({
+          trace: trace2,
+          traceId,
+          budgetTracker,
+          requestFingerprint
+        });
         return await buildPolicyBlockResult({
           tool,
           trace: trace2,
@@ -192698,6 +193287,8 @@ async function runReview(tool, request, options = {}) {
           startedAt,
           networkMode: config2.network.defaultMode,
           warning: error51.message,
+          budgetTracker,
+          requestFingerprint,
           finding: {
             id: "KYOSO-1",
             severity: "critical",
@@ -192763,6 +193354,8 @@ async function runReview(tool, request, options = {}) {
       timestamp: new Date().toISOString()
     });
     validateReviewRequest(tool, request);
+    const reviewBudget = resolveReviewBudget(loaded.config.reviewBudget, request.options?.reviewBudget);
+    const budgetTracker = new ReviewBudgetTracker(reviewBudget, startedAtEpochMs);
     assertTrustedWorkspaceRoot(request.workspace?.root, loaded.config.workspace.root, cwd);
     const networkMode = resolveNetworkMode(request.options?.network, loaded.config.network.defaultMode, options.mcpNetworkMode);
     if (networkMode === "unrestricted" && !loaded.config.network.allowUnrestricted) {
@@ -192781,6 +193374,19 @@ async function runReview(tool, request, options = {}) {
     });
     const allowSecretOverride = loaded.config.secrets.allowOverride && request.options?.allowSecretRedaction === true;
     if (secretScan.detected && loaded.config.secrets.blockOnDetectedSecret && !allowSecretOverride) {
+      const requestFingerprint2 = createRequestFingerprint({
+        tool,
+        request: secretScan.redactedRequest,
+        config: loaded.config,
+        roles: resolveAgentRoles(loaded.config),
+        budget: reviewBudget
+      });
+      await writeReviewBudgetPlanned({
+        trace,
+        traceId,
+        budgetTracker,
+        requestFingerprint: requestFingerprint2
+      });
       return await buildSecretBlockResult({
         tool,
         trace,
@@ -192789,7 +193395,9 @@ async function runReview(tool, request, options = {}) {
         configHash: loaded.configHash,
         networkMode,
         secretScan,
-        warnings
+        warnings,
+        budgetTracker,
+        requestFingerprint: requestFingerprint2
       });
     }
     const denyPatterns = mergeDenyPatterns(loaded.config.workspace.deny, secretScan.redactedRequest.workspace?.denyRead);
@@ -192802,6 +193410,19 @@ async function runReview(tool, request, options = {}) {
     });
     warnings.push(...built.warnings);
     const agentRoles = resolveAgentRoles(loaded.config);
+    const requestFingerprint = createRequestFingerprint({
+      tool,
+      request: built.request,
+      config: loaded.config,
+      roles: agentRoles,
+      budget: reviewBudget
+    });
+    await writeReviewBudgetPlanned({
+      trace,
+      traceId,
+      budgetTracker,
+      requestFingerprint
+    });
     snapshot = await createSnapshot(traceId, tool, built.request, {
       denyPatterns,
       allowPatterns,
@@ -192824,14 +193445,22 @@ async function runReview(tool, request, options = {}) {
       networkMode,
       manager,
       trace,
-      warnings
+      warnings,
+      budgetTracker
     });
     warnings.push(...agentResults.flatMap((result) => (result.warnings ?? []).map((warning) => `Agent ${result.agent} ${warning}`)));
-    const normalizedAgentResults = agentResults.map(normalizeAgentRunResult);
-    const agentsUsed = normalizedAgentResults.map((result) => result.agent);
-    const reviewMode = agentsUsed.length === 1 ? "single_agent" : "multi_agent";
+    const normalized = agentResults.map((result) => normalizeAgentRunResult(result, reviewBudget.maxFindingsPerAgent));
+    const normalizedAgentResults = normalized.map((item) => item.result);
+    for (const item of normalized.filter((item2) => item2.findingsCapped)) {
+      budgetTracker.markIncomplete("coverage_incomplete");
+      warnings.push(`Agent ${item.result.agent} findings were capped at ${reviewBudget.maxFindingsPerAgent}; review coverage is incomplete.`);
+    }
+    const enabledAgents = ["codex", "claude"].filter((agent) => loaded.config.agents[agent].enabled);
+    const agentsUsed = normalizedAgentResults.filter((result) => result.status !== "skipped").map((result) => result.agent);
+    const reviewMode = enabledAgents.length === 1 ? "single_agent" : "multi_agent";
     const completed = normalizedAgentResults.filter((result) => result.status === "completed");
-    const degraded = completed.length !== agentResults.length;
+    const attempted = normalizedAgentResults.filter((result) => result.status !== "skipped");
+    const degraded = completed.length !== attempted.length || enabledAgents.length === 0;
     let aggregate = aggregateAgentResults(normalizedAgentResults, {
       reviewMode
     });
@@ -192847,7 +193476,12 @@ async function runReview(tool, request, options = {}) {
         ])
       };
     }
-    if (completed.length === 0) {
+    if (completed.length === 0 && (attempted.length > 0 || enabledAgents.length === 0)) {
+      const noPrimaryAgents = enabledAgents.length === 0;
+      if (noPrimaryAgents) {
+        budgetTracker.markIncomplete("coverage_incomplete");
+        warnings.push("No primary review agents are enabled; review coverage is incomplete.");
+      }
       aggregate = {
         ...aggregate,
         findings: [
@@ -192856,9 +193490,9 @@ async function runReview(tool, request, options = {}) {
             id: `KYOSO-${aggregate.findings.length + 1}`,
             severity: "critical",
             category: "other",
-            title: "All backend agents failed",
-            evidence: normalizedAgentResults.map((result) => `${result.agent}: ${result.error?.code ?? result.status}`).join("; "),
-            recommendation: "Run kyoso doctor and retry after agent authentication or adapter issues are fixed.",
+            title: noPrimaryAgents ? "No primary review agents enabled" : "All backend agents failed",
+            evidence: noPrimaryAgents ? "Both configured primary reviewers are disabled." : normalizedAgentResults.map((result) => `${result.agent}: ${result.error?.code ?? result.status}`).join("; "),
+            recommendation: noPrimaryAgents ? "Enable at least one primary reviewer before running Kyoso." : "Run kyoso doctor and retry after agent authentication or adapter issues are fixed.",
             sourceAgents: ["kyoso_policy"],
             confidence: "high"
           }
@@ -192871,7 +193505,7 @@ async function runReview(tool, request, options = {}) {
       findingCount: aggregate.findings.length,
       timestamp: new Date().toISOString()
     });
-    const verificationMode = loaded.config.verification.enabled && reviewMode === "single_agent" ? "skipped_single_agent" : loaded.config.verification.enabled ? "cross_agent" : undefined;
+    const verificationMode = loaded.config.verification.enabled && reviewMode === "single_agent" ? "skipped_single_agent" : loaded.config.verification.enabled && enabledAgents.length > 1 ? "cross_agent" : undefined;
     if (verificationMode === "cross_agent") {
       warnings.push(...await runFindingVerification({
         tool,
@@ -192882,11 +193516,16 @@ async function runReview(tool, request, options = {}) {
         networkMode,
         manager,
         trace,
-        findings: aggregate.findings
+        findings: aggregate.findings,
+        budgetTracker
       }));
     }
+    if (aggregate.findings.some((finding) => finding.verification?.status === "refuted")) {
+      budgetTracker.markIncomplete("disputed_finding");
+    }
     const cisa = tool === "security_review" ? computeCisaGate(aggregate.findings, normalizedAgentResults) : undefined;
-    const decision = decide({
+    const budgetBeforeJudge = budgetTracker.snapshot();
+    const decision = budgetBeforeJudge.completion.status === "incomplete" ? "block" : decide({
       tool,
       findings: aggregate.findings,
       cisa,
@@ -192896,6 +193535,9 @@ async function runReview(tool, request, options = {}) {
     const completedAt = new Date().toISOString();
     const resultWithoutMarkdown = {
       decision,
+      completion: budgetBeforeJudge.completion,
+      executionBudget: budgetBeforeJudge.executionBudget,
+      requestFingerprint,
       degraded,
       agentsUsed,
       reviewMode,
@@ -192917,18 +193559,22 @@ async function runReview(tool, request, options = {}) {
         networkMode,
         workspaceMode: "temp_snapshot",
         configHash: loaded.configHash,
-        warnings: Array.from(new Set([...warnings, ...trace.warnings]))
+        warnings: Array.from(new Set([...warnings, ...trace.warnings])),
+        modelCalls: budgetBeforeJudge.modelCalls
       }
     };
     const summaryText = defaultSummaryText(resultWithoutMarkdown);
-    const judge = await runJudge({
+    const judge = await runBudgetedJudge({
       tool,
       result: resultWithoutMarkdown,
       summaryText,
       agentFindings: buildJudgeAgentFindings(normalizedAgentResults),
       config: loaded.config.judge,
       requestedProvider: request.options?.judgeProvider,
-      env: options.env ?? process.env
+      env: options.env ?? process.env,
+      budgetTracker,
+      trace,
+      traceId
     });
     const judgeComments = new Map(judge.output.disagreementComments.map((comment) => [
       comment.topic,
@@ -192939,10 +193585,20 @@ async function runReview(tool, request, options = {}) {
       judgeComment: judgeComments.get(disagreement.topic) ?? disagreement.judgeComment
     }));
     const crossModelAnalysis = buildCrossModelAnalysis(judge, reviewMode);
+    const budgetAfterJudge = budgetTracker.snapshot();
+    const finalDecision = budgetAfterJudge.completion.status === "incomplete" ? "block" : decision;
     const resultAfterJudge = {
       ...resultWithoutMarkdown,
+      decision: finalDecision,
+      completion: budgetAfterJudge.completion,
+      executionBudget: budgetAfterJudge.executionBudget,
       disagreements,
-      ...crossModelAnalysis ? { crossModelAnalysis } : {}
+      ...crossModelAnalysis ? { crossModelAnalysis } : {},
+      audit: {
+        ...resultWithoutMarkdown.audit,
+        completedAt: new Date().toISOString(),
+        modelCalls: budgetAfterJudge.modelCalls
+      }
     };
     const judgeEvent = {
       type: "judge_completed",
@@ -192955,10 +193611,16 @@ async function runReview(tool, request, options = {}) {
       judgeEvent.error = judge.error;
     await trace.write(judgeEvent);
     resultAfterJudge.audit.completedAt = new Date().toISOString();
+    await writeReviewBudgetCompleted({
+      trace,
+      traceId,
+      budgetTracker,
+      requestFingerprint
+    });
     await trace.write({
       type: "decision_completed",
       traceId,
-      decision,
+      decision: finalDecision,
       timestamp: new Date().toISOString()
     });
     await trace.write({
@@ -192970,7 +193632,7 @@ async function runReview(tool, request, options = {}) {
       tool,
       trace,
       result: resultAfterJudge,
-      summaryText: judge.output.summaryText
+      summaryText: resultAfterJudge.completion.status === "incomplete" ? defaultSummaryText(resultAfterJudge) : judge.output.summaryText
     });
   } finally {
     await trace.finalize();
@@ -192981,37 +193643,180 @@ async function runReview(tool, request, options = {}) {
 async function runFindingVerification(input) {
   const allowDemotionRequested = input.config.verification.allowDemotion;
   const selection = selectVerificationTargets(input.findings, input.config.verification.maxFindings);
-  markVerificationOverflow(selection.overflow);
-  if (selection.selected.length === 0)
-    return [];
   const warnings = [];
-  const groups = groupVerificationTargetsByVerifier(selection.selected);
+  if (selection.overflow.length > 0) {
+    markVerificationOverflow(selection.overflow, "verification_max_findings");
+    input.budgetTracker.markIncomplete("coverage_incomplete");
+  }
+  if (selection.selected.length === 0)
+    return warnings;
+  const potentialGroups = groupVerificationTargetsByVerifier(selection.selected);
   await input.trace.write({
     type: "verification_started",
     traceId: input.traceId,
     targetCount: selection.selected.length,
     notVerifiedCount: selection.overflow.length,
-    verifierCount: groups.length,
+    verifierCount: potentialGroups.length,
     timeoutMs: input.config.verification.timeoutMs,
     allowDemotionRequested,
     timestamp: new Date().toISOString()
   });
-  const agentInputs = groups.map(({ verifier, findings }) => ({
+  if (input.budgetTracker.budget.skipOptionalPhasesWhenTokenUsageUnknown && input.budgetTracker.isTokenUsageUnknown()) {
+    markVerificationOverflow(selection.selected, "token_usage_unknown");
+    input.budgetTracker.markIncomplete("token_usage_unknown");
+    input.budgetTracker.markIncomplete("coverage_incomplete");
+    warnings.push("Finding verification was skipped because primary-agent token usage was not reported.");
+    for (const group of potentialGroups) {
+      input.budgetTracker.recordSkipped({
+        kind: "verifier",
+        agent: group.verifier,
+        reason: "token_usage_unknown"
+      });
+      await input.trace.write({
+        type: "model_call_skipped",
+        traceId: input.traceId,
+        kind: "verifier",
+        agent: group.verifier,
+        reason: "token_usage_unknown",
+        timestamp: new Date().toISOString()
+      });
+    }
+    await input.trace.write({
+      type: "verification_completed",
+      traceId: input.traceId,
+      counts: countVerificationStatuses(input.findings),
+      timestamp: new Date().toISOString()
+    });
+    return warnings;
+  }
+  const groups = new Map;
+  const unavailableVerifiers = new Map;
+  for (const target of selection.selected) {
+    const existing = groups.get(target.verifier);
+    if (existing) {
+      existing.targets.push(target);
+      continue;
+    }
+    const unavailable = unavailableVerifiers.get(target.verifier);
+    if (unavailable) {
+      markVerificationOverflow([target], unavailable === "model_call_budget" ? "budget_exhausted" : "deadline");
+      continue;
+    }
+    const reservationResult = input.budgetTracker.reserve({
+      kind: "verifier",
+      agent: target.verifier
+    });
+    if ("failure" in reservationResult) {
+      unavailableVerifiers.set(target.verifier, reservationResult.failure.reason);
+      markVerificationOverflow([target], reservationResult.failure.reason === "model_call_budget" ? "budget_exhausted" : "deadline");
+      input.budgetTracker.recordSkipped({
+        kind: "verifier",
+        agent: target.verifier,
+        reason: reservationResult.failure.reason
+      });
+      input.budgetTracker.markIncomplete(reservationResult.failure.reason);
+      input.budgetTracker.markIncomplete("coverage_incomplete");
+      await input.trace.write({
+        type: "review_budget_exhausted",
+        traceId: input.traceId,
+        phase: "verification",
+        kind: "verifier",
+        agent: target.verifier,
+        reason: reservationResult.failure.reason,
+        timestamp: new Date().toISOString()
+      });
+      await input.trace.write({
+        type: "model_call_skipped",
+        traceId: input.traceId,
+        kind: "verifier",
+        agent: target.verifier,
+        reason: reservationResult.failure.reason,
+        timestamp: new Date().toISOString()
+      });
+      continue;
+    }
+    const group = {
+      verifier: target.verifier,
+      targets: [target],
+      reservation: reservationResult.reservation
+    };
+    groups.set(target.verifier, group);
+    await input.trace.write({
+      type: "model_call_reserved",
+      traceId: input.traceId,
+      kind: "verifier",
+      agent: target.verifier,
+      timestamp: new Date().toISOString()
+    });
+  }
+  const scheduledGroups = [];
+  for (const group of groups.values()) {
+    const timeoutMs = Math.min(input.config.verification.timeoutMs, input.budgetTracker.remainingWallTimeMs());
+    if (timeoutMs > 0) {
+      scheduledGroups.push(group);
+      continue;
+    }
+    input.budgetTracker.skip(group.reservation, "deadline");
+    input.budgetTracker.markIncomplete("deadline");
+    input.budgetTracker.markIncomplete("coverage_incomplete");
+    markVerificationOverflow(group.targets, "deadline");
+    await input.trace.write({
+      type: "review_budget_exhausted",
+      traceId: input.traceId,
+      phase: "verification",
+      kind: "verifier",
+      agent: group.verifier,
+      reason: "deadline",
+      timestamp: new Date().toISOString()
+    });
+    await input.trace.write({
+      type: "model_call_skipped",
+      traceId: input.traceId,
+      kind: "verifier",
+      agent: group.verifier,
+      reason: "deadline",
+      timestamp: new Date().toISOString()
+    });
+  }
+  if (scheduledGroups.length === 0) {
+    await input.trace.write({
+      type: "verification_completed",
+      traceId: input.traceId,
+      counts: countVerificationStatuses(input.findings),
+      timestamp: new Date().toISOString()
+    });
+    return warnings;
+  }
+  const agentInputs = scheduledGroups.map((group) => ({
     traceId: input.traceId,
-    agent: verifier,
+    agent: group.verifier,
     role: "finding_verifier",
     tool: input.tool,
-    prompt: buildFindingVerifierPrompt(input.tool, input.request, verifier, findings),
+    prompt: buildFindingVerifierPrompt(input.tool, input.request, group.verifier, group.targets.map((target) => target.finding)),
     workspaceDir: input.workspaceDir,
-    timeoutMs: input.config.verification.timeoutMs,
-    networkMode: input.networkMode
+    timeoutMs: Math.min(input.config.verification.timeoutMs, input.budgetTracker.remainingWallTimeMs()),
+    deadlineAtEpochMs: input.budgetTracker.deadlineAtEpochMs,
+    maxOutputBytes: input.budgetTracker.budget.maxAgentOutputBytes,
+    networkMode: input.networkMode,
+    onStarted: () => {
+      input.budgetTracker.markStarted(group.reservation);
+      return Promise.resolve();
+    }
   }));
   let results;
   try {
     results = await input.manager.runAll(agentInputs);
   } catch (error51) {
-    for (const group of groups) {
-      applyVerificationVerdicts(selection.selected, group.verifier, undefined);
+    for (const group of scheduledGroups) {
+      applyVerificationVerdicts(group.targets, group.verifier, undefined);
+      await finalizeModelCallResult({
+        budgetTracker: input.budgetTracker,
+        reservation: group.reservation,
+        result: failedVerifierResult(group.verifier, "AGENT_MANAGER_FAILED"),
+        trace: input.trace,
+        traceId: input.traceId
+      });
+      input.budgetTracker.markIncomplete("coverage_incomplete");
     }
     const message = `Finding verification failed: ${sanitizeTextForDisplay(error51 instanceof Error ? error51.message : String(error51))}`;
     warnings.push(message);
@@ -193024,9 +193829,32 @@ async function runFindingVerification(input) {
     });
     return warnings;
   }
-  for (const result of results) {
+  const resultByAgent = new Map(results.map((result) => [result.agent, result]));
+  for (const group of scheduledGroups) {
+    const result = resultByAgent.get(group.verifier);
+    if (!result) {
+      applyVerificationVerdicts(group.targets, group.verifier, undefined);
+      await finalizeModelCallResult({
+        budgetTracker: input.budgetTracker,
+        reservation: group.reservation,
+        result: failedVerifierResult(group.verifier, "AGENT_RESULT_MISSING"),
+        trace: input.trace,
+        traceId: input.traceId
+      });
+      input.budgetTracker.markIncomplete("coverage_incomplete");
+      warnings.push(`Finding verification by ${group.verifier} did not return a result.`);
+      continue;
+    }
+    await finalizeModelCallResult({
+      budgetTracker: input.budgetTracker,
+      reservation: group.reservation,
+      result,
+      trace: input.trace,
+      traceId: input.traceId
+    });
     if (result.status !== "completed") {
-      applyVerificationVerdicts(selection.selected, result.agent, undefined);
+      applyVerificationVerdicts(group.targets, result.agent, undefined);
+      input.budgetTracker.markIncomplete("coverage_incomplete");
       const message = `Finding verification by ${result.agent} ${result.status}: ${result.error?.message ?? result.error?.code ?? "no detail"}`;
       warnings.push(sanitizeTextForDisplay(message));
       await input.trace.write({
@@ -193040,8 +193868,9 @@ async function runFindingVerification(input) {
       continue;
     }
     const verdicts = parseVerificationVerdicts(result.rawText);
-    applyVerificationVerdicts(selection.selected, result.agent, verdicts);
+    applyVerificationVerdicts(group.targets, result.agent, verdicts);
     if (!verdicts) {
+      input.budgetTracker.markIncomplete("coverage_incomplete");
       const message = `Finding verification by ${result.agent} returned malformed verdict JSON.`;
       warnings.push(message);
       await input.trace.write({
@@ -193061,6 +193890,20 @@ async function runFindingVerification(input) {
   });
   return warnings;
 }
+function failedVerifierResult(agent, code) {
+  const timestamp = new Date().toISOString();
+  return {
+    agent,
+    role: "finding_verifier",
+    status: "failed",
+    startedAt: timestamp,
+    completedAt: timestamp,
+    error: {
+      code,
+      message: "The agent manager did not return a verification result."
+    }
+  };
+}
 function buildJudgeAgentFindings(results) {
   return results.flatMap((result) => {
     if (!result.normalized)
@@ -193097,13 +193940,182 @@ function buildCrossModelAnalysis(judge, reviewMode) {
     provider: judge.provider
   };
 }
+async function runBudgetedJudge(input) {
+  const configuredProvider = input.requestedProvider ?? input.config.provider;
+  const provider = resolveJudgeProvider(configuredProvider, input.env);
+  if (input.config.mode === "deterministic_only" || provider === "deterministic_fallback") {
+    return runJudge(input);
+  }
+  const fallback = () => runJudge({
+    ...input,
+    config: { ...input.config, mode: "deterministic_only" }
+  });
+  if (input.budgetTracker.snapshot().completion.status === "incomplete") {
+    await recordSkippedJudgeCall(input, "review_incomplete");
+    return fallback();
+  }
+  if (input.budgetTracker.budget.skipOptionalPhasesWhenTokenUsageUnknown && input.budgetTracker.isTokenUsageUnknown()) {
+    await recordSkippedJudgeCall(input, "token_usage_unknown");
+    return fallback();
+  }
+  const reservationResult = input.budgetTracker.reserve({ kind: "judge" });
+  if ("failure" in reservationResult) {
+    await recordSkippedJudgeCall(input, reservationResult.failure.reason);
+    await input.trace.write({
+      type: "review_budget_exhausted",
+      traceId: input.traceId,
+      phase: "judge",
+      kind: "judge",
+      reason: reservationResult.failure.reason,
+      timestamp: new Date().toISOString()
+    });
+    return fallback();
+  }
+  const reservation = reservationResult.reservation;
+  await input.trace.write({
+    type: "model_call_reserved",
+    traceId: input.traceId,
+    kind: "judge",
+    timestamp: new Date().toISOString()
+  });
+  const timeoutMs = Math.min(input.config.timeoutMs, input.budgetTracker.remainingWallTimeMs());
+  if (timeoutMs <= 0) {
+    input.budgetTracker.skip(reservation, "deadline");
+    await input.trace.write({
+      type: "review_budget_exhausted",
+      traceId: input.traceId,
+      phase: "judge",
+      kind: "judge",
+      reason: "deadline",
+      timestamp: new Date().toISOString()
+    });
+    await input.trace.write({
+      type: "model_call_skipped",
+      traceId: input.traceId,
+      kind: "judge",
+      reason: "deadline",
+      timestamp: new Date().toISOString()
+    });
+    return fallback();
+  }
+  input.budgetTracker.markStarted(reservation);
+  const judge = await runJudge({ ...input, timeoutMs });
+  const usage = normalizeModelTokenUsage(judge.usage);
+  input.budgetTracker.complete(reservation, {
+    ...usage ? { usage } : {}
+  });
+  await input.trace.write({
+    type: "model_call_completed",
+    traceId: input.traceId,
+    kind: "judge",
+    provider: judge.provider,
+    resultStatus: judge.status,
+    ...usage ? { usage } : {},
+    timestamp: new Date().toISOString()
+  });
+  return judge;
+}
+async function recordSkippedJudgeCall(input, reason) {
+  input.budgetTracker.recordSkipped({ kind: "judge", reason });
+  await input.trace.write({
+    type: "model_call_skipped",
+    traceId: input.traceId,
+    kind: "judge",
+    reason,
+    timestamp: new Date().toISOString()
+  });
+}
 async function runAgents(input) {
   const agentRoles = resolveAgentRoles(input.config);
+  const enabledAgents = ["codex", "claude"].filter((agent) => input.config.agents[agent].enabled);
+  if (enabledAgents.length === 0)
+    return [];
+  const reservationResult = input.budgetTracker.reserveMany(enabledAgents.map((agent) => ({ kind: "primary", agent })));
+  if ("failure" in reservationResult) {
+    input.budgetTracker.markIncomplete(reservationResult.failure.reason);
+    input.budgetTracker.markIncomplete("coverage_incomplete");
+    await input.trace.write({
+      type: "review_budget_exhausted",
+      traceId: input.traceId,
+      phase: "primary",
+      reason: reservationResult.failure.reason,
+      requiredCalls: enabledAgents.length,
+      timestamp: new Date().toISOString()
+    });
+    for (const agent of enabledAgents) {
+      input.budgetTracker.recordSkipped({
+        kind: "primary",
+        agent,
+        reason: reservationResult.failure.reason
+      });
+      await input.trace.write({
+        type: "model_call_skipped",
+        traceId: input.traceId,
+        kind: "primary",
+        agent,
+        reason: reservationResult.failure.reason,
+        timestamp: new Date().toISOString()
+      });
+    }
+    return enabledAgents.map((agent) => {
+      const role = agentRoles[agent] ?? input.config.agents[agent].role;
+      const timestamp = new Date().toISOString();
+      return {
+        agent,
+        role,
+        status: "skipped",
+        startedAt: timestamp,
+        completedAt: timestamp,
+        error: {
+          code: reservationResult.failure.reason === "deadline" ? "REVIEW_DEADLINE_EXCEEDED" : "MODEL_CALL_BUDGET_EXHAUSTED",
+          message: reservationResult.failure.reason === "deadline" ? "Review deadline was reached before primary agents could start." : "The review model-call budget cannot reserve all primary agents."
+        }
+      };
+    });
+  }
+  const reservations = new Map(reservationResult.reservations.map((reservation) => [
+    reservation.agent,
+    reservation
+  ]));
+  for (const reservation of reservationResult.reservations) {
+    await input.trace.write({
+      type: "model_call_reserved",
+      traceId: input.traceId,
+      kind: reservation.kind,
+      agent: reservation.agent,
+      timestamp: new Date().toISOString()
+    });
+  }
+  if (input.budgetTracker.remainingWallTimeMs() <= 0) {
+    input.budgetTracker.markIncomplete("deadline");
+    input.budgetTracker.markIncomplete("coverage_incomplete");
+    await input.trace.write({
+      type: "review_budget_exhausted",
+      traceId: input.traceId,
+      phase: "primary",
+      reason: "deadline",
+      timestamp: new Date().toISOString()
+    });
+    return await skipReservedPrimaryAgents({
+      trace: input.trace,
+      traceId: input.traceId,
+      budgetTracker: input.budgetTracker,
+      config: input.config,
+      agents: enabledAgents,
+      agentRoles,
+      reservations,
+      reason: "deadline"
+    });
+  }
   const startedWrites = [];
   let acceptingStartedEvents = true;
-  const agentInputs = ["codex", "claude"].filter((agent) => input.config.agents[agent].enabled).map((agent) => {
+  const agentInputs = enabledAgents.map((agent) => {
     const agentConfig = input.config.agents[agent];
     const role = agentRoles[agent] ?? agentConfig.role;
+    const reservation = reservations.get(agent);
+    if (!reservation) {
+      throw new Error(`Missing primary budget reservation for ${agent}.`);
+    }
     return {
       traceId: input.traceId,
       agent,
@@ -193111,9 +194123,12 @@ async function runAgents(input) {
       tool: input.tool,
       prompt: buildAgentPrompt(input.tool, input.request, agent, role),
       workspaceDir: input.workspaceDir,
-      timeoutMs: input.request.options?.maxAgentTimeoutMs ?? agentConfig.timeoutMs ?? DEFAULT_AGENT_TIMEOUT_MS,
+      timeoutMs: Math.min(input.request.options?.maxAgentTimeoutMs ?? Number.POSITIVE_INFINITY, agentConfig.timeoutMs ?? DEFAULT_AGENT_TIMEOUT_MS, input.budgetTracker.remainingWallTimeMs()),
+      deadlineAtEpochMs: input.budgetTracker.deadlineAtEpochMs,
+      maxOutputBytes: input.budgetTracker.budget.maxAgentOutputBytes,
       networkMode: input.networkMode,
       onStarted: () => {
+        input.budgetTracker.markStarted(reservation);
         if (!acceptingStartedEvents)
           return Promise.resolve();
         const event = {
@@ -193141,10 +194156,61 @@ async function runAgents(input) {
       }
     };
   });
-  const results = await input.manager.runAll(agentInputs);
+  let results;
+  try {
+    results = await input.manager.runAll(agentInputs);
+  } catch (error51) {
+    const detail = sanitizeTextForDisplay(error51 instanceof Error ? error51.message : String(error51));
+    input.warnings.push(`Primary-agent execution failed: ${detail}`);
+    results = agentInputs.map((agentInput) => ({
+      agent: agentInput.agent,
+      role: agentInput.role,
+      status: "failed",
+      startedAt: new Date().toISOString(),
+      completedAt: new Date().toISOString(),
+      error: {
+        code: "AGENT_MANAGER_FAILED",
+        message: "The agent manager did not return a review result."
+      }
+    }));
+  }
   acceptingStartedEvents = false;
   await Promise.all(startedWrites);
-  await Promise.all(results.map((result) => {
+  const resultByAgent = new Map(results.map((result) => [result.agent, result]));
+  const orderedResults = enabledAgents.map((agent) => {
+    const existing = resultByAgent.get(agent);
+    if (existing)
+      return existing;
+    const role = agentRoles[agent] ?? input.config.agents[agent].role;
+    const timestamp = new Date().toISOString();
+    return {
+      agent,
+      role,
+      status: "failed",
+      startedAt: timestamp,
+      completedAt: timestamp,
+      error: {
+        code: "AGENT_RESULT_MISSING",
+        message: "The agent manager did not return a review result."
+      }
+    };
+  });
+  for (const result of orderedResults) {
+    const reservation = reservations.get(result.agent);
+    if (!reservation)
+      continue;
+    await finalizeModelCallResult({
+      budgetTracker: input.budgetTracker,
+      reservation,
+      result,
+      trace: input.trace,
+      traceId: input.traceId
+    });
+    if (result.status !== "completed") {
+      input.budgetTracker.markIncomplete("coverage_incomplete");
+    }
+  }
+  await Promise.all(orderedResults.map((result) => {
     const event = {
       type: "agent_completed",
       traceId: input.traceId,
@@ -193164,8 +194230,92 @@ async function runAgents(input) {
     }
     return input.trace.write(event);
   }));
+  return orderedResults;
+}
+async function skipReservedPrimaryAgents(input) {
+  const results = [];
+  for (const agent of input.agents) {
+    const reservation = input.reservations.get(agent);
+    if (reservation)
+      input.budgetTracker.skip(reservation, input.reason);
+    await input.trace.write({
+      type: "model_call_skipped",
+      traceId: input.traceId,
+      kind: "primary",
+      agent,
+      reason: input.reason,
+      timestamp: new Date().toISOString()
+    });
+    const timestamp = new Date().toISOString();
+    results.push({
+      agent,
+      role: input.agentRoles[agent] ?? input.config.agents[agent].role,
+      status: "skipped",
+      startedAt: timestamp,
+      completedAt: timestamp,
+      error: {
+        code: "REVIEW_DEADLINE_EXCEEDED",
+        message: "Review deadline was reached before the agent could start."
+      }
+    });
+  }
   return results;
 }
+async function finalizeModelCallResult(input) {
+  const reason = input.result.error?.code ?? input.result.status;
+  const hasStarted = input.budgetTracker.hasStarted(input.reservation);
+  const canSkip = input.result.status === "skipped" || isPreflightAgentFailure(input.result) || !hasStarted && input.result.error?.code === "REVIEW_DEADLINE_EXCEEDED";
+  if (canSkip && !hasStarted) {
+    input.budgetTracker.skip(input.reservation, reason);
+    if (input.result.error?.code === "REVIEW_DEADLINE_EXCEEDED") {
+      input.budgetTracker.markIncomplete("deadline");
+    }
+    await input.trace.write({
+      type: "model_call_skipped",
+      traceId: input.traceId,
+      kind: input.reservation.kind,
+      agent: input.reservation.agent,
+      reason,
+      timestamp: new Date().toISOString()
+    });
+    return;
+  }
+  input.budgetTracker.markStarted(input.reservation);
+  const usage = normalizeModelTokenUsage(input.result.usage);
+  const outputBytes = input.result.outputBytes ?? (input.result.rawText ? Buffer.byteLength(input.result.rawText, "utf8") : undefined);
+  input.budgetTracker.complete(input.reservation, {
+    ...outputBytes === undefined ? {} : { outputBytes },
+    ...usage ? { usage } : {},
+    ...input.result.stopReason ? { stopReason: input.result.stopReason } : {}
+  });
+  if (input.result.error?.code === "AGENT_OUTPUT_LIMIT") {
+    input.budgetTracker.markIncomplete("agent_output_limit");
+  }
+  if (input.result.error?.code === "REVIEW_DEADLINE_EXCEEDED") {
+    input.budgetTracker.markIncomplete("deadline");
+  }
+  await input.trace.write({
+    type: "model_call_completed",
+    traceId: input.traceId,
+    kind: input.reservation.kind,
+    agent: input.reservation.agent,
+    resultStatus: input.result.status,
+    ...input.result.error?.code ? { errorCode: input.result.error.code } : {},
+    ...outputBytes === undefined ? {} : { outputBytes },
+    ...usage ? { usage } : {},
+    ...input.result.stopReason ? { stopReason: input.result.stopReason } : {},
+    timestamp: new Date().toISOString()
+  });
+}
+function isPreflightAgentFailure(result) {
+  return result.status === "failed" && [
+    "AGENT_CONFIG_INVALID",
+    "OPENROUTER_KEY_MISSING",
+    "AGENT_SPAWN_FAILED",
+    "AGENT_MANAGER_FAILED",
+    "AGENT_RESULT_MISSING"
+  ].includes(result.error?.code ?? "");
+}
 function resolveAgentRoles(config2) {
   const enabledAgents = ["codex", "claude"].filter((agent) => config2.agents[agent].enabled);
   const singleAgentMode = enabledAgents.length === 1;
@@ -193181,14 +194331,30 @@ function defaultAgentManager(config2, parentEnv) {
   }
   return new SubprocessAcpAgentManager(config2, parentEnv);
 }
-function normalizeAgentRunResult(result) {
-  if (result.status === "completed" && result.rawText && !result.normalized) {
-    return {
-      ...result,
-      normalized: normalizeAgentOutput(result.agent, result.role, result.rawText)
-    };
-  }
-  return result;
+function normalizeAgentRunResult(result, maxFindingsPerAgent) {
+  const normalizedResult = result.status === "completed" && result.rawText && !result.normalized ? {
+    ...result,
+    normalized: normalizeAgentOutput(result.agent, result.role, result.rawText)
+  } : result;
+  const normalized = normalizedResult.normalized;
+  const findings = normalized?.findings;
+  if (!normalized || !findings || findings.length <= maxFindingsPerAgent) {
+    return { result: normalizedResult, findingsCapped: false };
+  }
+  const limitedFindings = findings.map((finding, index) => ({ finding, index })).sort((left, right) => {
+    const severity = compareSeverity(left.finding.severity, right.finding.severity);
+    return severity === 0 ? left.index - right.index : severity;
+  }).slice(0, maxFindingsPerAgent).map(({ finding }) => finding);
+  return {
+    result: {
+      ...normalizedResult,
+      normalized: {
+        ...normalized,
+        findings: limitedFindings
+      }
+    },
+    findingsCapped: true
+  };
 }
 function agentOpinionSummary(result, includeRawText = false) {
   const opinion = {
@@ -193210,8 +194376,12 @@ async function buildSecretBlockResult(input) {
   });
   const cisa = input.tool === "security_review" ? computeCisaGate([finding], []) : undefined;
   const completedAt = new Date().toISOString();
+  const budget = input.budgetTracker.snapshot();
   const resultWithoutMarkdown = {
     decision: "block",
+    completion: budget.completion,
+    executionBudget: budget.executionBudget,
+    requestFingerprint: input.requestFingerprint,
     degraded: false,
     agentsUsed: [],
     reviewMode: "multi_agent",
@@ -193247,9 +194417,16 @@ async function buildSecretBlockResult(input) {
       networkMode: input.networkMode,
       workspaceMode: "temp_snapshot",
       configHash: input.configHash,
-      warnings: input.warnings
+      warnings: input.warnings,
+      modelCalls: budget.modelCalls
     }
   };
+  await writeReviewBudgetCompleted({
+    trace: input.trace,
+    traceId: input.traceId,
+    budgetTracker: input.budgetTracker,
+    requestFingerprint: input.requestFingerprint
+  });
   await input.trace.write({
     type: "decision_completed",
     traceId: input.traceId,
@@ -193292,8 +194469,12 @@ function reindexFindings(findings) {
 }
 async function buildPolicyBlockResult(input) {
   const completedAt = new Date().toISOString();
+  const budget = input.budgetTracker.snapshot();
   const resultWithoutMarkdown = {
     decision: "block",
+    completion: budget.completion,
+    executionBudget: budget.executionBudget,
+    requestFingerprint: input.requestFingerprint,
     degraded: false,
     agentsUsed: [],
     reviewMode: "multi_agent",
@@ -193312,9 +194493,16 @@ async function buildPolicyBlockResult(input) {
       networkMode: input.networkMode,
       workspaceMode: "temp_snapshot",
       configHash: input.configHash,
-      warnings: [input.warning]
+      warnings: [input.warning],
+      modelCalls: budget.modelCalls
     }
   };
+  await writeReviewBudgetCompleted({
+    trace: input.trace,
+    traceId: input.traceId,
+    budgetTracker: input.budgetTracker,
+    requestFingerprint: input.requestFingerprint
+  });
   await input.trace.write({
     type: "decision_completed",
     traceId: input.traceId,
@@ -193351,6 +194539,33 @@ async function finalizeReviewResult(input) {
     })
   };
 }
+async function writeReviewBudgetPlanned(input) {
+  const snapshot = input.budgetTracker.snapshot();
+  await input.trace.write({
+    type: "review_budget_planned",
+    traceId: input.traceId,
+    requestFingerprint: input.requestFingerprint,
+    maxModelCalls: snapshot.executionBudget.maxModelCalls,
+    maxTotalWallTimeMs: snapshot.executionBudget.wallTime.limitMs,
+    maxAgentOutputBytes: snapshot.executionBudget.maxAgentOutputBytes,
+    maxFindingsPerAgent: snapshot.executionBudget.maxFindingsPerAgent,
+    skipOptionalPhasesWhenTokenUsageUnknown: snapshot.executionBudget.skipOptionalPhasesWhenTokenUsageUnknown,
+    timestamp: new Date().toISOString()
+  });
+}
+async function writeReviewBudgetCompleted(input) {
+  const snapshot = input.budgetTracker.snapshot();
+  await input.trace.write({
+    type: "review_budget_completed",
+    traceId: input.traceId,
+    requestFingerprint: input.requestFingerprint,
+    completion: snapshot.completion,
+    modelCalls: snapshot.executionBudget.modelCalls,
+    wallTime: snapshot.executionBudget.wallTime,
+    tokenUsage: snapshot.executionBudget.tokenUsage,
+    timestamp: new Date().toISOString()
+  });
+}
 function mergeDenyPatterns(configDeny, requestDeny) {
   return Array.from(new Set([...configDeny, ...requestDeny ?? []]));
 }