@kyo-so/cli 0.10.0 → 0.12.0

package/dist/cli/knownSkillDigests.d.ts

@@ -1,5 +1,12 @@
-export declare const CURRENT_SKILL_DIGEST = "sha256:98e715396ee3e1994c29ab49bc489197f242091c8ac0e06e182c0eccd5ab277e";
+export declare const CURRENT_SKILL_DIGEST = "sha256:8654e68ea61f2acea29027056802bf627ad737f084c9a86ab052946943538409";
 export declare const KNOWN_SKILL_DIGESTS_BY_VERSION: {
+    readonly "0.11.0": readonly [{
+        readonly digest: "sha256:110dd872a3d1c8a71474a0eadb226f51a6addd86f9d4f3ed17b73678b3179a4e";
+        readonly kind: "historical";
+    }, {
+        readonly digest: "sha256:570f83f716734f34db00147f1b98bc8cd4e9c0016d3946b352ecef4a5d6b8734";
+        readonly kind: "historical";
+    }];
     readonly "0.8.0": readonly [{
         readonly digest: "sha256:b16ea3f8141a01399b96dee650365d99df2b8c5fc99184d9cb22d5d72c106fd8";
         readonly kind: "historical";

package/dist/cli/pluginRuntimeContract.d.ts

@@ -10,9 +10,9 @@ export declare const PLUGIN_RUNTIME_COMPATIBILITY_SCHEMA_VERSION = 1;
 export declare const MINIMUM_SUPPORTED_CODEX_VERSION = "0.144.0-alpha.4";
 export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
     readonly distribution: {
-        readonly pluginVersion: "0.3.1";
+        readonly pluginVersion: "0.5.0";
         readonly mcpCommand: "npx";
-        readonly mcpPackagePin: "@kyo-so/cli@0.9.1";
+        readonly mcpPackagePin: "@kyo-so/cli@0.11.0";
     };
     readonly marketplace: {
         readonly name: "kyoso";
@@ -47,7 +47,7 @@ export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
             readonly enabled: true;
             readonly command: "$NODE";
             readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
-            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
             readonly cwd: null;
             readonly startupTimeoutSec: 20;
             readonly toolTimeoutSec: 360;
@@ -56,7 +56,7 @@ export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
             readonly enabled: false;
             readonly command: "$NODE";
             readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
-            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
             readonly cwd: null;
             readonly startupTimeoutSec: 20;
             readonly toolTimeoutSec: 360;
@@ -100,6 +100,7 @@ export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
             readonly OPENAI_API_KEY: true;
             readonly CODEX_API_KEY: true;
             readonly CODEX_ACCESS_TOKEN: true;
+            readonly OPENROUTER_API_KEY: true;
             readonly ANTHROPIC_API_KEY: true;
             readonly CLAUDE_CODE_OAUTH_TOKEN: true;
         };
@@ -129,9 +130,9 @@ export declare const pluginRuntimeContract: {
     readonly pluginListTopLevelKeys: readonly ["installed", "available"];
     readonly expectedContract: {
         readonly distribution: {
-            readonly pluginVersion: "0.3.1";
+            readonly pluginVersion: "0.5.0";
             readonly mcpCommand: "npx";
-            readonly mcpPackagePin: "@kyo-so/cli@0.9.1";
+            readonly mcpPackagePin: "@kyo-so/cli@0.11.0";
         };
         readonly marketplace: {
             readonly name: "kyoso";
@@ -166,7 +167,7 @@ export declare const pluginRuntimeContract: {
                 readonly enabled: true;
                 readonly command: "$NODE";
                 readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
-                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
                 readonly cwd: null;
                 readonly startupTimeoutSec: 20;
                 readonly toolTimeoutSec: 360;
@@ -175,7 +176,7 @@ export declare const pluginRuntimeContract: {
                 readonly enabled: false;
                 readonly command: "$NODE";
                 readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
-                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
                 readonly cwd: null;
                 readonly startupTimeoutSec: 20;
                 readonly toolTimeoutSec: 360;
@@ -219,6 +220,7 @@ export declare const pluginRuntimeContract: {
                 readonly OPENAI_API_KEY: true;
                 readonly CODEX_API_KEY: true;
                 readonly CODEX_ACCESS_TOKEN: true;
+                readonly OPENROUTER_API_KEY: true;
                 readonly ANTHROPIC_API_KEY: true;
                 readonly CLAUDE_CODE_OAUTH_TOKEN: true;
             };

package/dist/config/schema.d.ts

@@ -11,12 +11,31 @@ export declare const kyosoConfigSchema: z.ZodObject<{
         mcp: z.ZodBoolean;
         cli: z.ZodBoolean;
     }, z.core.$strip>;
-    firstClassClient: z.ZodString;
+    firstClassClient: z.ZodLiteral<"codex">;
     tools: z.ZodObject<{
         planReview: z.ZodBoolean;
         securityReview: z.ZodBoolean;
         diffReview: z.ZodBoolean;
     }, z.core.$strip>;
+    reviewPolicy: z.ZodObject<{
+        additionalLenses: z.ZodArray<z.ZodEnum<{
+            correctness: "correctness";
+            regression: "regression";
+            security_boundaries: "security_boundaries";
+            secrets_and_injection: "secrets_and_injection";
+            data_integrity: "data_integrity";
+            public_contract: "public_contract";
+            supply_chain: "supply_chain";
+            privacy: "privacy";
+            resource_amplification: "resource_amplification";
+            architecture: "architecture";
+            performance: "performance";
+            tests: "tests";
+            documentation: "documentation";
+            maintainability: "maintainability";
+        }>>;
+        multiAgentRequired: z.ZodBoolean;
+    }, z.core.$strip>;
     agents: z.ZodObject<{
         codex: z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
@@ -71,7 +90,7 @@ export declare const kyosoConfigSchema: z.ZodObject<{
     workspace: z.ZodObject<{
         mode: z.ZodLiteral<"temp_snapshot">;
         root: z.ZodString;
-        readOnly: z.ZodBoolean;
+        readOnly: z.ZodLiteral<true>;
         maxContextBytes: z.ZodNumber;
         maxDiffBytes: z.ZodNumber;
         deny: z.ZodArray<z.ZodString>;
@@ -89,7 +108,7 @@ export declare const kyosoConfigSchema: z.ZodObject<{
         allowUnrestricted: z.ZodBoolean;
         warnOnUnrestricted: z.ZodBoolean;
         mediatedWeb: z.ZodObject<{
-            enabled: z.ZodBoolean;
+            enabled: z.ZodLiteral<false>;
         }, z.core.$strip>;
     }, z.core.$strip>;
     securityReview: z.ZodObject<{
@@ -123,12 +142,19 @@ export declare const kyosoConfigSchema: z.ZodObject<{
         timeoutMs: z.ZodDefault<z.ZodNumber>;
         allowDemotion: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>;
+    reviewBudget: z.ZodObject<{
+        maxModelCalls: z.ZodNumber;
+        maxTotalWallTimeMs: z.ZodNumber;
+        maxAgentOutputBytes: z.ZodNumber;
+        maxFindingsPerAgent: z.ZodNumber;
+        skipOptionalPhasesWhenTokenUsageUnknown: z.ZodBoolean;
+    }, z.core.$strip>;
     audit: z.ZodObject<{
         enabled: z.ZodBoolean;
         format: z.ZodLiteral<"jsonl">;
         directory: z.ZodString;
         includeRawAgentOutput: z.ZodBoolean;
-        includeFileContents: z.ZodBoolean;
+        includeFileContents: z.ZodLiteral<false>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export declare const kyosoConfigKnownLeafPaths: string[];

package/dist/core/constants.d.ts

@@ -1,7 +1,9 @@
 export declare const DEFAULT_AGENT_TIMEOUT_MS = 120000;
 export declare const DEFAULT_MAX_CONTEXT_BYTES = 500000;
 export declare const DEFAULT_MAX_DIFF_BYTES = 300000;
+export declare const MAX_AGENT_OUTPUT_BYTES = 1048576;
+export declare const JUDGE_MAX_OUTPUT_TOKENS = 4096;
 export declare const RAW_OUTPUT_MAX_CHARS = 16384;
 export declare const TRACE_DIR = ".kyoso/traces";
 export declare const KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
-export declare const KYOSO_VERSION = "0.10.0";
+export declare const KYOSO_VERSION = "0.12.0";

package/dist/core/findingAdmission.d.ts

@@ -0,0 +1,10 @@
+import type { EvidenceRef, KyosoFinding, KyosoReviewRequest, ReviewMode, ReviewTool } from "./types.js";
+export declare function admitFindings(input: {
+    tool: ReviewTool;
+    request: KyosoReviewRequest;
+    findings: KyosoFinding[];
+    reviewMode: ReviewMode;
+}): KyosoFinding[];
+export declare function selectRegressionTests(tests: string[]): string[];
+export declare function buildAdmissionOpenQuestions(findings: KyosoFinding[]): string[];
+export declare function findingFingerprint(finding: Pick<KyosoFinding, "category" | "title">, evidenceRefs: EvidenceRef[]): string;

package/dist/core/requestFingerprint.d.ts

@@ -0,0 +1,12 @@
+import type { KyosoConfig } from "../config/schema.js";
+import type { AgentRole, KyosoReviewRequest, ReviewBudget, ReviewTool } from "./types.js";
+export declare const REVIEW_CONTRACT_VERSION = "2026-07-16-v3";
+export declare function createRequestFingerprint(input: {
+    tool: ReviewTool;
+    request: KyosoReviewRequest;
+    config: KyosoConfig;
+    roles: Partial<Record<"codex" | "claude", AgentRole>>;
+    budget: ReviewBudget;
+    entrypoint?: "cli" | "mcp" | "core";
+}): string;
+export declare function canonicalJson(value: unknown): string;

package/dist/core/reviewBudget.d.ts

@@ -0,0 +1,68 @@
+import type { AgentName, ModelCallKind, ModelTokenUsage, ReviewBudget, ReviewBudgetRequest, ReviewCompletion, ReviewCompletionReason, ReviewExecutionBudget, ReviewModelCallAudit } from "./types.js";
+type ReservationStatus = "reserved" | "started" | "completed" | "skipped";
+type Reservation = {
+    id: number;
+    kind: ModelCallKind;
+    agent?: AgentName;
+    status: ReservationStatus;
+    reason?: string;
+    outputBytes?: number;
+    usage?: ModelTokenUsage;
+    stopReason?: string;
+};
+export type ModelCallReservation = Pick<Reservation, "id" | "kind" | "agent">;
+export type BudgetReservationFailure = {
+    reason: "model_call_budget" | "deadline";
+};
+export declare function resolveReviewBudget(ceiling: ReviewBudget, requested: ReviewBudgetRequest | undefined): ReviewBudget;
+export declare class ReviewBudgetTracker {
+    readonly budget: ReviewBudget;
+    readonly startedAtEpochMs: number;
+    readonly deadlineAtEpochMs: number;
+    private readonly reservations;
+    private readonly skippedCalls;
+    private readonly incompleteReasons;
+    private nextReservationId;
+    constructor(budget: ReviewBudget, startedAtEpochMs?: number);
+    remainingWallTimeMs(now?: number): number;
+    hasDeadlineExpired(now?: number): boolean;
+    reserveMany(inputs: Array<{
+        kind: ModelCallKind;
+        agent?: AgentName;
+    }>): {
+        reservations: ModelCallReservation[];
+    } | {
+        failure: BudgetReservationFailure;
+    };
+    reserve(input: {
+        kind: ModelCallKind;
+        agent?: AgentName;
+    }): {
+        reservation: ModelCallReservation;
+    } | {
+        failure: BudgetReservationFailure;
+    };
+    markStarted(reservation: ModelCallReservation): void;
+    hasStarted(reservation: ModelCallReservation): boolean;
+    complete(reservation: ModelCallReservation, values?: {
+        outputBytes?: number;
+        usage?: ModelTokenUsage;
+        stopReason?: string;
+    }): void;
+    skip(reservation: ModelCallReservation, reason: string): void;
+    recordSkipped(input: {
+        kind: ModelCallKind;
+        agent?: AgentName;
+        reason: string;
+    }): void;
+    markIncomplete(reason: ReviewCompletionReason): void;
+    isTokenUsageUnknown(): boolean;
+    snapshot(now?: number): {
+        completion: ReviewCompletion;
+        executionBudget: ReviewExecutionBudget;
+        modelCalls: ReviewModelCallAudit[];
+    };
+    private usedCapacity;
+    private modelCalls;
+}
+export {};

package/dist/core/reviewPolicy.d.ts

@@ -0,0 +1,16 @@
+import type { AgentRole, AgentRunResult, KyosoReviewRequest, ReviewCoverage, ReviewLens } from "./types.js";
+export declare const REVIEW_LENSES: readonly ["correctness", "regression", "security_boundaries", "secrets_and_injection", "data_integrity", "public_contract", "supply_chain", "privacy", "resource_amplification", "architecture", "performance", "tests", "documentation", "maintainability"];
+export declare const BUILT_IN_SAFETY_FLOOR: readonly ["correctness", "regression", "security_boundaries", "secrets_and_injection", "data_integrity", "public_contract"];
+export declare const REQUIRED_REVIEW_PERSPECTIVES: AgentRole[];
+export declare function isReviewLens(value: unknown): value is ReviewLens;
+export declare function resolveRequiredLenses(request: KyosoReviewRequest, additionalLenses?: ReviewLens[]): ReviewLens[];
+export declare function buildReviewCoverage(input: {
+    request: KyosoReviewRequest;
+    additionalLenses?: ReviewLens[];
+    agentResults: AgentRunResult[];
+}): ReviewCoverage;
+export declare function isCoverageIncomplete(coverage: ReviewCoverage, options: {
+    multiAgentRequired: boolean;
+}): boolean;
+export declare function unavailableReviewCoverage(request: KyosoReviewRequest, reason: string, additionalLenses?: ReviewLens[]): ReviewCoverage;
+export declare function renderTrustedReviewContract(request: KyosoReviewRequest, requiredLenses?: ReviewLens[]): string;

package/dist/core/runReview.d.ts

@@ -10,6 +10,7 @@ export type RunReviewOptions = LoadConfigOptions & {
     agentManager?: AcpAgentManager;
     env?: NodeJS.ProcessEnv;
     mcpNetworkMode?: NetworkMode;
+    entrypoint?: "cli" | "mcp" | "core";
     traceWriterFactory?: (options: TraceWriterOptions) => TraceWriter;
 };
 export declare function runReview(tool: ReviewTool, request: KyosoReviewRequest, options?: RunReviewOptions): Promise<KyosoResult>;

package/dist/core/tokenUsage.d.ts

@@ -0,0 +1,2 @@
+import type { ModelTokenUsage } from "./types.js";
+export declare function normalizeModelTokenUsage(usage: unknown): ModelTokenUsage | undefined;

package/dist/core/types.d.ts

@@ -4,10 +4,53 @@ export type GateStatus = "pass" | "warn" | "fail" | "not_applicable";
 export type NetworkMode = "model_only" | "unrestricted";
 export type JudgeProvider = "auto" | "openai" | "anthropic" | "none";
 export type Severity = "critical" | "high" | "medium" | "low" | "info";
+export type ReviewLens = "correctness" | "regression" | "security_boundaries" | "secrets_and_injection" | "data_integrity" | "public_contract" | "supply_chain" | "privacy" | "resource_amplification" | "architecture" | "performance" | "tests" | "documentation" | "maintainability";
+export type ReviewContract = {
+    focus?: ReviewLens[];
+    nonGoals?: string[];
+    acceptedRisks?: Array<{
+        findingFingerprint: string;
+        rationale: string;
+    }>;
+};
+export type FindingDisposition = "gate" | "actionable" | "advisory" | "disputed";
+export type ChangeRelation = "introduced" | "worsened" | "pre_existing" | "unknown";
+export type EvidenceQuality = "concrete" | "partial" | "insufficient";
+export type EvidenceRef = {
+    kind: "file" | "diff_hunk" | "plan_clause";
+    path?: string;
+    lineStart?: number;
+    lineEnd?: number;
+    label?: string;
+};
+export type ReviewBudget = {
+    maxModelCalls: number;
+    maxTotalWallTimeMs: number;
+    maxAgentOutputBytes: number;
+    maxFindingsPerAgent: number;
+    skipOptionalPhasesWhenTokenUsageUnknown: boolean;
+};
+export type ReviewBudgetRequest = Partial<ReviewBudget>;
+export type ReviewCompletionReason = "model_call_budget" | "deadline" | "agent_output_limit" | "token_usage_unknown" | "coverage_incomplete" | "disputed_finding";
+export type ReviewCompletion = {
+    status: "complete" | "incomplete";
+    reasons: ReviewCompletionReason[];
+    retryable: false;
+};
+export type ModelCallKind = "primary" | "verifier" | "judge";
+export type ModelTokenUsage = {
+    totalTokens?: number;
+    inputTokens?: number;
+    outputTokens?: number;
+    thoughtTokens?: number;
+    cachedReadTokens?: number;
+    cachedWriteTokens?: number;
+};
 export type FindingCategory = "architecture" | "authn" | "authz" | "csrf" | "xss" | "ssrf" | "injection" | "secret" | "supply_chain" | "privacy" | "data_loss" | "test" | "maintainability" | "cisa_secure_by_design" | "other";
 export type CisaDimension = "customer_security_outcomes" | "secure_by_default" | "transparency_and_accountability" | "governance";
 export type KyosoReviewRequest = {
     goal: string;
+    reviewContract?: ReviewContract;
     repoSummary?: string;
     currentPlan?: string;
     selectedFiles?: Array<{
@@ -30,6 +73,7 @@ export type KyosoReviewRequest = {
     options?: {
         network?: NetworkMode;
         maxAgentTimeoutMs?: number;
+        reviewBudget?: ReviewBudgetRequest;
         includeAgentRawOutputs?: boolean;
         judgeProvider?: JudgeProvider;
         allowSecretRedaction?: boolean;
@@ -42,6 +86,12 @@ export type KyosoFinding = {
     title: string;
     evidence: string;
     recommendation: string;
+    disposition: FindingDisposition;
+    changeRelation: ChangeRelation;
+    evidenceQuality: EvidenceQuality;
+    evidenceRefs: EvidenceRef[];
+    policyReasons: string[];
+    fingerprint: string;
     files?: Array<{
         path: string;
         lineStart?: number;
@@ -58,6 +108,8 @@ export type KyosoFinding = {
     };
 };
 export type CisaSecureByDesignResult = {
+    gateEnabled: boolean;
+    enabledDimensions: CisaDimension[];
     customerSecurityOutcomes: GateStatus;
     secureByDefault: GateStatus;
     transparencyAndAccountability: GateStatus;
@@ -67,6 +119,17 @@ export type CisaSecureByDesignResult = {
 export type AgentName = "codex" | "claude";
 export type AgentRole = "implementation_reviewer" | "architecture_security_reviewer" | "combined_reviewer" | "finding_verifier";
 export type ReviewMode = "multi_agent" | "single_agent";
+export type ReviewCoverage = {
+    requiredLenses: ReviewLens[];
+    attemptedLenses: ReviewLens[];
+    missingLenses: Array<{
+        lens: ReviewLens;
+        reason: string;
+    }>;
+    requiredPerspectives: AgentRole[];
+    completedPerspectives: AgentRole[];
+    independentReview: boolean;
+};
 export type NormalizedAgentOpinion = {
     agent: AgentName;
     role: string;
@@ -77,6 +140,10 @@ export type NormalizedAgentOpinion = {
         title: string;
         evidence: string;
         recommendation: string;
+        disposition?: FindingDisposition;
+        changeRelation?: ChangeRelation;
+        evidenceQuality?: EvidenceQuality;
+        evidenceRefs?: EvidenceRef[];
         files?: Array<{
             path: string;
             lineStart?: number;
@@ -110,6 +177,8 @@ export type AgentRunInput = {
     prompt: string;
     workspaceDir: string;
     timeoutMs: number;
+    deadlineAtEpochMs?: number;
+    maxOutputBytes?: number;
     networkMode: NetworkMode;
     onStarted?: (() => void) | (() => Promise<void>);
 };
@@ -125,14 +194,58 @@ export type AgentRunResult = {
         detail?: string;
     };
     warnings?: string[];
+    usage?: ModelTokenUsage;
+    outputBytes?: number;
+    stopReason?: string;
     startedAt: string;
     completedAt?: string;
 };
+export type ReviewExecutionBudget = {
+    maxModelCalls: number;
+    modelCalls: {
+        planned: number;
+        consumed: number;
+        skipped: number;
+        byKind: Record<ModelCallKind, {
+            planned: number;
+            consumed: number;
+            skipped: number;
+        }>;
+    };
+    wallTime: {
+        limitMs: number;
+        consumedMs: number;
+        remainingMs: number;
+    };
+    maxAgentOutputBytes: number;
+    maxFindingsPerAgent: number;
+    skipOptionalPhasesWhenTokenUsageUnknown: boolean;
+    agentOutputBytes: Partial<Record<AgentName, number>>;
+    tokenUsage: {
+        status: "reported" | "partial" | "unknown";
+        reportedCalls: number;
+        unknownCalls: number;
+        totals: ModelTokenUsage;
+    };
+};
+export type ReviewModelCallAudit = {
+    kind: ModelCallKind;
+    agent?: AgentName;
+    status: "completed" | "skipped";
+    reason?: string;
+    outputBytes?: number;
+    usage?: ModelTokenUsage;
+    stopReason?: string;
+};
 export type KyosoResult = {
     decision: KyosoDecision;
+    completion: ReviewCompletion;
+    executionBudget: ReviewExecutionBudget;
+    requestFingerprint: string;
     degraded: boolean;
     agentsUsed: AgentName[];
     reviewMode: ReviewMode;
+    coverage: ReviewCoverage;
     verificationMode?: "cross_agent" | "skipped_single_agent";
     summaryMarkdown: string;
     findings: KyosoFinding[];
@@ -148,6 +261,7 @@ export type KyosoResult = {
     crossModelAnalysis?: CrossModelAnalysis;
     testsToAdd: string[];
     residualRisks: string[];
+    openQuestions: string[];
     agentOpinions: Array<{
         agent: AgentName;
         role: string;
@@ -166,6 +280,7 @@ export type KyosoResult = {
         workspaceMode: "temp_snapshot";
         configHash?: string;
         warnings?: string[];
+        modelCalls: ReviewModelCallAudit[];
     };
 };
 export type SecretScanResult = {

package/dist/core/verification.d.ts

@@ -18,7 +18,7 @@ export declare function groupVerificationTargetsByVerifier(targets: Verification
     verifier: AgentName;
     findings: KyosoFinding[];
 }>;
-export declare function markVerificationOverflow(targets: VerificationTarget[]): void;
+export declare function markVerificationOverflow(targets: VerificationTarget[], reason?: string): void;
 export declare function parseVerificationVerdicts(rawText: string | undefined): VerificationVerdict[] | undefined;
 export declare function applyVerificationVerdicts(targets: VerificationTarget[], verifier: AgentName, verdicts: VerificationVerdict[] | undefined): Record<"confirmed" | "refuted" | "uncertain", number>;
 export declare function countVerificationStatuses(findings: KyosoFinding[]): Record<"confirmed" | "refuted" | "uncertain" | "not_verified", number>;

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 export { defineConfig } from "./config/defineConfig.js";
 export { runReview } from "./core/runReview.js";
-export type { CisaSecureByDesignResult, GateStatus, KyosoDecision, KyosoFinding, KyosoResult, KyosoReviewRequest, NetworkMode, ReviewTool, } from "./core/types.js";
+export type { ChangeRelation, CisaSecureByDesignResult, EvidenceQuality, EvidenceRef, FindingDisposition, GateStatus, KyosoDecision, KyosoFinding, KyosoResult, KyosoReviewRequest, ModelTokenUsage, NetworkMode, ReviewBudget, ReviewBudgetRequest, ReviewCompletion, ReviewContract, ReviewCoverage, ReviewExecutionBudget, ReviewLens, ReviewModelCallAudit, ReviewTool, } from "./core/types.js";