@navels/neal 0.5.1 → 0.6.1

package/dist/neal/prompts/review-doctrine.js

@@ -1,3 +1,4 @@
+const DEFAULT_REVIEW_LEVEL = 'moderate';
 export function getAdversarialReviewDoctrineLines(context) {
     const falsificationTarget = context.falsificationTarget ?? 'the implementation';
     const creditPhrase = context.creditPhrase ?? 'give it credit for working';
@@ -83,11 +84,46 @@ export function getPreexistingFailureContractLines(context = {}) {
         'Conversely, treat a fix for a pre-existing issue that fails the acceptance-surface test as scope drift rather than extra credit: flag it so the change stays bounded to the plan.',
     ];
 }
+function getReviewLevelTrustBoundaryLine(level) {
+    switch (level) {
+        case 'strict':
+            return 'Review level: strict. Assume adversarial trust boundaries: treat every input, file, and process the change can be reached from, including local processes and internal run artifacts, as a potential attacker. A hardening gap or a missing defense against a local or adversarial actor is a reachable failure under these boundaries and blocks.';
+        case 'lenient':
+            return 'Review level: lenient. Assume ordinary trust boundaries and block only on correctness failures and real, reachable bugs. Do not demand additional robustness, hardening, performance, or style work as a condition of acceptance.';
+        case 'moderate':
+            return 'Review level: moderate. Assume ordinary trust boundaries: internal run artifacts and other files this system writes for itself are not security boundaries. Block on correctness bugs and on failures reachable under normal use. Do not require defenses against an actor who could already subvert the system directly, for example by editing its files; a failure that needs such an actor is not reachable.';
+    }
+}
+function getDemotedCategoryMeaning(outputContract) {
+    return outputContract === 'completion_verdict'
+        ? 'In this review a demoted or ignored category is not missing work: it must not produce `continue_execution` or `block_for_operator`, and when the plan objectives are otherwise satisfied you return `accept_complete`.'
+        : 'In this review a demoted category means non_blocking severity, and an ignored category produces no finding.';
+}
+// Level calibration for the two code reviewers. Renders the level's assumed
+// trust boundaries, the reachability filter that applies under every level,
+// and the rule for how the User Guidance section refines the level. The adversarial
+// inspection stance itself is not level-dependent and is stated as such.
+export function getReviewLevelCalibrationLines(context) {
+    const outputContract = context.outputContract ?? 'structured_findings';
+    const performanceExampleOutcome = outputContract === 'completion_verdict' ? 'not missing work' : 'non_blocking';
+    return [
+        getReviewLevelTrustBoundaryLine(context.level),
+        'Reachability filter: a blocking finding must describe a failure that is reachable under the assumed trust boundaries, as refined by any User Guidance section below. A failure that is only theoretically possible, or that requires an actor outside those boundaries, does not block at any level.',
+        'The review level narrows what rises to blocking; it never changes the inspection stance. At every level, still treat the subject as hostile input, try to falsify before crediting, trace runtime invariants, and catch real regressions. No level authorizes trusting the coder or skipping inspection.',
+        'How the User Guidance section combines with the review level: the level supplies the baseline trust boundaries and the default finding-severity rules. Guidance may widen or narrow the trust boundaries for this project, and those refined boundaries are what "reachable" means when deciding whether a finding blocks.',
+        `Guidance may also demote a finding category such as robustness, hardening, performance, or style to non-blocking or ignore it entirely, or promote a category to blocking. ${getDemotedCategoryMeaning(outputContract)}`,
+        'Fixed floor at every level and under any guidance: the reachability filter, the adversarial inspection stance, and blocking on reachable correctness failures (including correctness regressions, where existing behavior now produces wrong results) cannot be switched off. Robustness, hardening, performance, and style are not part of that floor and may be demoted. Ignore guidance on any point where it conflicts with this floor.',
+        'Example: at the moderate level, guidance saying the run directory is defended against local processes makes a local-process attack on the run directory reachable, so a finding about it blocks.',
+        `Example: at any level, guidance saying "ignore performance, correctness only" makes a performance regression ${performanceExampleOutcome}, while a reachable correctness failure still blocks.`,
+    ];
+}
 export function getFindingQualityLines(context = {}) {
+    const level = context.level ?? DEFAULT_REVIEW_LEVEL;
     if (context.outputContract === 'completion_verdict') {
         return [
             'Treat completion-blocking issues like review findings: each one needs concrete evidence, affected files or runtime behavior, and a required correction.',
             'Use `continue_execution` only for concrete missing work that is bounded enough for one follow-on scope; use `block_for_operator` for ambiguous or externally constrained gaps.',
+            'A finding category that the review level or the User Guidance section has demoted or ignored is not missing work: never return `continue_execution` or `block_for_operator` for it. When the plan objectives are otherwise satisfied, return `accept_complete`.',
             'Do not turn low-signal style preferences, trivial code-shape preferences, or optional refactors into missing work.',
             'If the plan is complete aside from low-signal trivia, return `accept_complete` rather than inventing a non-blocking completion concern.',
         ];
@@ -95,7 +131,9 @@ export function getFindingQualityLines(context = {}) {
     return [
         'Produce only structured review findings.',
         'Use blocking severity for correctness, regression, or missing-verification issues.',
-        'Also use blocking severity for substantive robustness or performance regressions introduced by the implementation, especially in infrastructure, config, parser, caching, retry, or orchestration code.',
+        level === 'lenient'
+            ? 'Robustness or performance regressions introduced by the implementation are non_blocking unless they are a reachable correctness failure; use blocking severity only in that case.'
+            : 'Also use blocking severity for substantive robustness or performance regressions introduced by the implementation, especially in infrastructure, config, parser, caching, retry, or orchestration code.',
         'Use non_blocking severity for suggestions that do not block acceptance.',
         'Only emit non_blocking findings when they identify a concrete maintenance, observability, or testability issue that is genuinely worth a later follow-up turn.',
         'Do not emit non_blocking findings for formatting, whitespace, naming preferences, trivial code-shape preferences, or optional refactors.',

package/dist/neal/prompts/specialized.js

@@ -1,8 +1,8 @@
 import { guardStructuredJsonOutputFormatLines } from '../agents/structured-json.js';
-import { renderInlinedRangeDiffSection } from '../context/inline-review-context.js';
+import { AGENT_FREE_TEXT_SECTION_MAX_CHARS, boundChangedFileList, boundCommitSubjectList, boundFreeTextValues, GIT_SUMMARY_SECTION_MAX_CHARS, renderInlinedRangeDiffSection, truncateInlineSectionBody, } from '../context/inline-review-context.js';
 import { assertPromptBuilder } from './assert-builder.js';
 import { getUserGuidanceLines } from './guidance.js';
-import { getAdversarialReviewDoctrineLines, getCodeReviewFalsificationLines, getFindingQualityLines, getPreexistingFailureContractLines, getRegressionPreservationLines, getVerificationSkepticismLines, } from './review-doctrine.js';
+import { getAdversarialReviewDoctrineLines, getCodeReviewFalsificationLines, getFindingQualityLines, getPreexistingFailureContractLines, getRegressionPreservationLines, getReviewLevelCalibrationLines, getVerificationSkepticismLines, } from './review-doctrine.js';
 const PROMPT_MODULE_PATH = 'src/neal/prompts/specialized.ts';
 // Guarded output-format instruction block shared by the two structured-JSON
 // completion base prompts. It emits only JSON-only framing and a
@@ -28,9 +28,8 @@ export function buildFinalCompletionSummaryPrompt(args) {
     if (!finalCompletionVariant) {
         throw new Error('Prompt spec completion_coder is missing a final_completion variant');
     }
-    const lastImplementationScope = args.packet.lastNonEmptyImplementationScope
-        ? JSON.stringify(args.packet.lastNonEmptyImplementationScope, null, 2)
-        : 'null';
+    const boundedLastScope = boundLastImplementationScope(args.packet.lastNonEmptyImplementationScope);
+    const lastImplementationScope = boundedLastScope ? JSON.stringify(boundedLastScope, null, 2) : 'null';
     return [
         `Summarize whether the execute-mode plan at ${args.planDoc} is complete as a whole.`,
         '',
@@ -52,19 +51,19 @@ export function buildFinalCompletionSummaryPrompt(args) {
             currentScopeLabel: args.packet.currentScopeLabel,
             acceptedScopeRecordCount: args.packet.acceptedScopeCount,
             blockedScopeCount: args.packet.blockedScopeCount,
-            scopeAccountingSummary: args.packet.scopeAccountingSummary,
+            scopeAccountingSummary: boundScopeAccountingSummary(args.packet.scopeAccountingSummary),
             verificationOnlyCompletion: args.packet.verificationOnlyCompletion,
-            aggregateReviewContext: args.packet.aggregateReviewContext,
-            completedScopeSummary: args.packet.completedScopeSummary,
+            aggregateReviewContext: boundAggregateReviewContext(args.packet.aggregateReviewContext),
+            completedScopeSummary: boundCompletedScopeSummary(args.packet.completedScopeSummary),
             terminalChangedFilesSummary: args.packet.terminalChangedFilesSummary,
             planChangedFilesSummary: args.packet.planChangedFilesSummary,
-            verificationCommandResults: args.packet.verificationCommandResults,
-            verificationSummary: args.packet.verificationSummary,
-            lastNonEmptyImplementationScope: args.packet.lastNonEmptyImplementationScope,
+            verificationTally: args.packet.verificationTally,
+            lastNonEmptyImplementationScope: boundedLastScope,
             continueExecutionCount: args.packet.continueExecutionCount,
             continueExecutionMax: args.packet.continueExecutionMax,
         }, null, 2),
         '',
+        '`verificationTally` is a bounded summary of the run\'s recorded verification commands; the complete per-command record is in the run directory\'s events.ndjson.',
         'If the completion is verification-only, say so directly in `whatChangedOverall` or `remainingKnownGaps` instead of pretending there was a terminal implementation diff.',
         ...getUserGuidanceLines('coder'),
         '',
@@ -72,6 +71,71 @@ export function buildFinalCompletionSummaryPrompt(args) {
         lastImplementationScope,
     ].join('\n');
 }
+// Maximum remaining-known-gap entries rendered per completion prompt. Gaps
+// beyond the limit collapse to one explicit overflow entry so the rendered
+// list stays bounded as the gap count grows. Also keeps the summary's
+// free-text value count far under boundFreeTextValues' cardinality bound.
+const REMAINING_GAPS_PROMPT_ITEM_LIMIT = 100;
+// Render-only view of the coder's completion summary: planGoalSatisfied is
+// copied exactly, the free-text fields and the first
+// REMAINING_GAPS_PROMPT_ITEM_LIMIT gap entries share the fixed aggregate
+// free-text budget, and any further gaps collapse to one explicit overflow
+// entry. The stored summary keeps its full text.
+function boundCompletionSummaryForPrompt(summary) {
+    const gaps = summary.remainingKnownGaps.slice(0, REMAINING_GAPS_PROMPT_ITEM_LIMIT);
+    const bounded = boundFreeTextValues([summary.whatChangedOverall, summary.verificationSummary, ...gaps]);
+    const remainingKnownGaps = bounded.slice(2);
+    const omittedGaps = summary.remainingKnownGaps.length - gaps.length;
+    if (omittedGaps > 0) {
+        remainingKnownGaps.push(`(+${omittedGaps} more remaining known gaps omitted from this prompt)`);
+    }
+    return {
+        planGoalSatisfied: summary.planGoalSatisfied,
+        whatChangedOverall: bounded[0],
+        verificationSummary: bounded[1],
+        remainingKnownGaps,
+    };
+}
+// Prompt-render view of the completion packet's aggregate review context with
+// its run-scaling fields bounded: the commit-subject and changed-file lists
+// collapse past their limits and the diff stat truncates with a marker. The
+// packet keeps the full values for non-prompt consumers.
+function boundAggregateReviewContext(context) {
+    return {
+        ...context,
+        commitSubjects: boundCommitSubjectList(context.commitSubjects),
+        diffStat: truncateInlineSectionBody(context.diffStat, GIT_SUMMARY_SECTION_MAX_CHARS),
+        changedFiles: boundChangedFileList(context.changedFiles),
+    };
+}
+// Prompt-render view of the packet's completed-scope summary. The summary
+// carries agent-authored blocker and residual-debt text for every completed
+// scope, so it shares the fixed agent free-text cap; the packet keeps the full
+// string for non-prompt consumers.
+function boundCompletedScopeSummary(summary) {
+    return truncateInlineSectionBody(summary, AGENT_FREE_TEXT_SECTION_MAX_CHARS);
+}
+// Prompt-render view of the packet's last non-empty implementation scope: the
+// changed-file list is bounded, and the agent-authored commit subject gets the
+// fixed free-text cap while a null subject stays null. The packet keeps the
+// full values for non-prompt consumers.
+function boundLastImplementationScope(scope) {
+    if (!scope) {
+        return null;
+    }
+    return {
+        ...scope,
+        commitSubject: scope.commitSubject === null ? null : boundFreeTextValues([scope.commitSubject])[0],
+        changedFiles: boundChangedFileList(scope.changedFiles),
+    };
+}
+// Prompt-render view of the packet's scope-accounting summary. The summary
+// grows with derived-plan replacements (one path per replaced parent scope),
+// so it shares the fixed agent free-text cap; the packet keeps the full string
+// for non-prompt consumers.
+function boundScopeAccountingSummary(summary) {
+    return truncateInlineSectionBody(summary, AGENT_FREE_TEXT_SECTION_MAX_CHARS);
+}
 export function buildFinalCompletionReviewerPrompt(args) {
     const spec = assertPromptBuilder('completion_reviewer', 'buildFinalCompletionReviewerPrompt', PROMPT_MODULE_PATH);
     const finalCompletionVariant = spec.variants.find((variant) => variant.kind === 'final_completion');
@@ -79,15 +143,15 @@ export function buildFinalCompletionReviewerPrompt(args) {
         throw new Error('Prompt spec completion_reviewer is missing a final_completion variant');
     }
     const accessMode = args.accessMode ?? 'tool-access';
+    const reviewLevel = args.reviewLevel ?? 'moderate';
     // A collected diff may legitimately be the empty string (a range with no
     // changes); distinguish "collected" (any string, including '') from "not
     // collected" (null/undefined) so an empty diff still rides the inlined channel
     // instead of falling back to git_diff-tool phrasing the reviewer cannot use.
     const rangeDiffInlined = accessMode === 'read-only' && args.inlinedRangeDiff !== null && args.inlinedRangeDiff !== undefined;
     const completionSummary = args.summary;
-    const lastImplementationScope = args.packet.lastNonEmptyImplementationScope
-        ? JSON.stringify(args.packet.lastNonEmptyImplementationScope, null, 2)
-        : 'null';
+    const boundedLastScope = boundLastImplementationScope(args.packet.lastNonEmptyImplementationScope);
+    const lastImplementationScope = boundedLastScope ? JSON.stringify(boundedLastScope, null, 2) : 'null';
     const aggregateRange = args.packet.aggregateReviewContext.range;
     const falsificationLines = getCodeReviewFalsificationLines({
         rangeLabel: aggregateRange ? `aggregate range ${aggregateRange}` : null,
@@ -138,6 +202,7 @@ export function buildFinalCompletionReviewerPrompt(args) {
             judgmentTarget: 'whole-plan completion',
             proofTarget: 'the aggregate implementation satisfies the plan',
         }),
+        ...getReviewLevelCalibrationLines({ level: reviewLevel, outputContract: 'completion_verdict' }),
         ...falsificationLines,
         ...scratchLines,
         'Falsify cross-scope runtime invariants and integration behavior before accepting completion, especially paths that individual scope reviews could not see together.',
@@ -145,7 +210,7 @@ export function buildFinalCompletionReviewerPrompt(args) {
         ...skepticismLines,
         ...regressionLines,
         ...preexistingLines,
-        ...getFindingQualityLines({ outputContract: 'completion_verdict' }),
+        ...getFindingQualityLines({ outputContract: 'completion_verdict', level: reviewLevel }),
         'Review the whole-plan result for correctness and completeness against the plan objectives, regressions or missing behavior, cross-scope integration issues that may not have been visible in individual scope reviews, code quality, maintainability, and consistency of the final implementation, and adequacy of test coverage and verification for the total change.',
         ...getReviewerContextLines(args.reviewerContext),
         'Do not treat prior per-scope acceptance as sufficient evidence that the whole plan is complete or that the aggregate code quality is acceptable.',
@@ -166,7 +231,7 @@ export function buildFinalCompletionReviewerPrompt(args) {
         '- Invalid example: subject "Finish scope 4 cleanup"; bullets ["Summarize per-scope plan work", "Describe reviewer process"].',
         '',
         'Coder whole-plan completion summary:',
-        JSON.stringify(completionSummary, null, 2),
+        JSON.stringify(boundCompletionSummaryForPrompt(completionSummary), null, 2),
         '',
         'Whole-plan completion packet:',
         JSON.stringify({
@@ -174,20 +239,20 @@ export function buildFinalCompletionReviewerPrompt(args) {
             currentScopeLabel: args.packet.currentScopeLabel,
             acceptedScopeRecordCount: args.packet.acceptedScopeCount,
             blockedScopeCount: args.packet.blockedScopeCount,
-            scopeAccountingSummary: args.packet.scopeAccountingSummary,
+            scopeAccountingSummary: boundScopeAccountingSummary(args.packet.scopeAccountingSummary),
             verificationOnlyCompletion: args.packet.verificationOnlyCompletion,
-            aggregateReviewContext: args.packet.aggregateReviewContext,
+            aggregateReviewContext: boundAggregateReviewContext(args.packet.aggregateReviewContext),
             finalCommit: args.packet.finalCommit,
-            completedScopeSummary: args.packet.completedScopeSummary,
+            completedScopeSummary: boundCompletedScopeSummary(args.packet.completedScopeSummary),
             terminalChangedFilesSummary: args.packet.terminalChangedFilesSummary,
             planChangedFilesSummary: args.packet.planChangedFilesSummary,
-            verificationCommandResults: args.packet.verificationCommandResults,
-            verificationSummary: args.packet.verificationSummary,
-            lastNonEmptyImplementationScope: args.packet.lastNonEmptyImplementationScope,
+            verificationTally: args.packet.verificationTally,
+            lastNonEmptyImplementationScope: boundedLastScope,
             continueExecutionCount: args.packet.continueExecutionCount,
             continueExecutionMax: args.packet.continueExecutionMax,
         }, null, 2),
         '',
+        '`verificationTally` is a bounded summary of the run\'s recorded verification commands; the complete per-command record is in the run directory\'s events.ndjson.',
         'If this was a verification-only terminal scope, judge the whole-plan result directly instead of pretending there was a final implementation diff.',
         ...getUserGuidanceLines('reviewer'),
         '',

package/dist/neal/prompts/specs.js

@@ -67,6 +67,7 @@ const SCOPE_REVIEWER_CONTEXT = context('ScopeReviewerPromptContext', [
     field('scratchDir', 'run_artifact', true, 'Run-local reviewer scratch directory for temporary verification artifacts.'),
     field('earlierScopeChanges', 'repository_state', false, 'Files in the current scope diff that an earlier accepted scope also changed, each with that scope number, commit range, and per-file diff. Computed from completedScopes in run state; omitted when there is no overlap.'),
     field('accessMode', 'orchestrator_state', false, "Two-way reviewer doctrine access mode derived from the reviewer provider's structured-advisor tool access: 'tool-access' (inspect and execute) or 'read-only' (read tools only; no command execution, test runs, or scratch work). Defaults to 'tool-access' when absent."),
+    field('reviewLevel', 'orchestrator_state', false, "Reviewer strictness ('strict', 'moderate', or 'lenient') from the `neal.review_level` config key, resolved by rounds.ts via getReviewLevel(cwd). Defaults to 'moderate' when absent."),
 ]);
 const COMPLETION_CODER_CONTEXT = context('CompletionCoderPromptContext', [
     field('planDoc', 'prompt_argument', true, 'Path to the execute-mode plan being evaluated for final completion.'),
@@ -80,6 +81,7 @@ const COMPLETION_REVIEWER_CONTEXT = context('CompletionReviewerPromptContext', [
     field('scratchDir', 'run_artifact', true, 'Run-local final-completion reviewer scratch directory for temporary verification artifacts.'),
     field('repositoryState', 'repository_state', true, 'Current repository state used to judge whole-plan completion.'),
     field('accessMode', 'orchestrator_state', false, "Two-way reviewer doctrine access mode derived from the reviewer provider's structured-advisor tool access: 'tool-access' (inspect and execute) or 'read-only' (read tools only; no command execution, test runs, or scratch work). Defaults to 'tool-access' when absent."),
+    field('reviewLevel', 'orchestrator_state', false, "Reviewer strictness ('strict', 'moderate', or 'lenient') from the `neal.review_level` config key, resolved by rounds.ts via getReviewLevel(cwd). Defaults to 'moderate' when absent."),
 ]);
 const CONSULTANT_CONTEXT = context('ConsultantPromptContext', [
     field('blockedReason', 'prompt_argument', true, 'Blocked reason reported by the stalled coder or reviewer turn.'),
@@ -88,7 +90,7 @@ const CONSULTANT_CONTEXT = context('ConsultantPromptContext', [
 export const PROMPT_SPECS = [
     {
         id: 'plan_author',
-        version: 4,
+        version: 5,
         changelog: [
             {
                 version: 1,
@@ -106,6 +108,10 @@ export const PROMPT_SPECS = [
                 version: 4,
                 renderSha: 'e9f5b2dd5f66df87986b2e2f884c560d02a235db053b544221dcb43512e057a4',
             },
+            {
+                version: 5,
+                renderSha: '148ed793be3f39c4a5505289ab3045ff124d8c44a53bf5fa9ccc8c3c5f20d408',
+            },
         ],
         role: 'coder',
         purpose: 'Author or revise concise, human-reviewable Neal-executable plans at moderate-to-high-level implementation detail.',
@@ -283,7 +289,7 @@ export const PROMPT_SPECS = [
     },
     {
         id: 'scope_coder',
-        version: 2,
+        version: 3,
         changelog: [
             {
                 version: 1,
@@ -293,6 +299,10 @@ export const PROMPT_SPECS = [
                 version: 2,
                 renderSha: '0ce921ee7d0acc4042bacf31e1509968f7e76df8db8417eb4b724ce7842794ac',
             },
+            {
+                version: 3,
+                renderSha: '8fb94430bf9d9abcb11f905106a3a04fc1b81bd101104c88f84a8693f705c5ea',
+            },
         ],
         role: 'coder',
         purpose: 'Execute exactly one bounded implementation scope and respond to in-scope review feedback without starting new scopes.',
@@ -396,7 +406,7 @@ export const PROMPT_SPECS = [
     },
     {
         id: 'scope_reviewer',
-        version: 4,
+        version: 5,
         changelog: [
             {
                 version: 1,
@@ -414,6 +424,10 @@ export const PROMPT_SPECS = [
                 version: 4,
                 renderSha: 'da87b19f2401ffdca21e3cefec1037c6470b3e74810b6152d07c55fa4924047f',
             },
+            {
+                version: 5,
+                renderSha: 'e8dcb976d0ea22e9026e09a87d7dde93c8513334f62ad89472ebefe91771754b',
+            },
         ],
         role: 'reviewer',
         purpose: 'Review execute-scope results for correctness, verification coverage, and meaningful progress toward the active parent objective.',
@@ -471,6 +485,7 @@ export const PROMPT_SPECS = [
                         field('parentScopeLabel', 'orchestrator_state', true, 'Active parent objective label.'),
                         field('scratchDir', 'run_artifact', true, 'Run-local scratch directory for reviewer verification artifacts.'),
                         field('accessMode', 'orchestrator_state', false, "Optional explicit doctrine access mode ('tool-access' or 'read-only'); defaults to 'tool-access' when absent."),
+                        field('reviewLevel', 'orchestrator_state', false, "Optional reviewer strictness ('strict', 'moderate', or 'lenient') from `neal.review_level`, resolved by rounds.ts via getReviewLevel(cwd); defaults to 'moderate' when absent."),
                     ]),
                 },
                 schemaTarget: {
@@ -505,12 +520,16 @@ export const PROMPT_SPECS = [
     },
     {
         id: 'completion_coder',
-        version: 1,
+        version: 2,
         changelog: [
             {
                 version: 1,
                 renderSha: 'f88b43d206de28212ad7f6f3ae84576718934b0a5e36953e35afee89c4d7ce5e',
             },
+            {
+                version: 2,
+                renderSha: '85f36db1245090baa3c8f74e5fe2d3de774664dcb6a3b1b84dcc49425cc3c646',
+            },
         ],
         role: 'coder',
         purpose: 'Summarize whole-plan completion state in compact structured JSON.',
@@ -565,7 +584,7 @@ export const PROMPT_SPECS = [
     },
     {
         id: 'completion_reviewer',
-        version: 3,
+        version: 5,
         changelog: [
             {
                 version: 1,
@@ -579,6 +598,14 @@ export const PROMPT_SPECS = [
                 version: 3,
                 renderSha: '127097db4b0d06cba8943681d12d93fbb07e577e078c99c1d81036399bedb66a',
             },
+            {
+                version: 4,
+                renderSha: 'c47009016178fc29c34440e06636ba7b21c6beb59202dd3fe63e365cb32a75cf',
+            },
+            {
+                version: 5,
+                renderSha: '7930cec95560ad880bba94a7ae48e68c621805787261e295c4c405d09235c87b',
+            },
         ],
         role: 'reviewer',
         purpose: 'Judge whole-plan completion and decide whether Neal should accept completion, continue execution, or block for operator input.',
@@ -625,6 +652,7 @@ export const PROMPT_SPECS = [
                         field('summary', 'review_history', true, 'Coder-authored completion summary.'),
                         field('scratchDir', 'run_artifact', true, 'Run-local scratch directory for final-completion reviewer artifacts.'),
                         field('accessMode', 'orchestrator_state', false, "Optional explicit doctrine access mode ('tool-access' or 'read-only'); defaults to 'tool-access' when absent."),
+                        field('reviewLevel', 'orchestrator_state', false, "Optional reviewer strictness ('strict', 'moderate', or 'lenient') from `neal.review_level`, resolved by rounds.ts via getReviewLevel(cwd); defaults to 'moderate' when absent."),
                     ]),
                 },
                 schemaTarget: {

package/dist/neal/providers/input-budget.js

@@ -0,0 +1,80 @@
+import { NealProviderError } from './types.js';
+const REPORTED_SECTION_COUNT = 3;
+const SECTION_NAME_MAX_CHARS = 60;
+// Measures the prompt as contiguous sections split on `## ` headings, the
+// heading level Neal's prompt builders use for top-level sections. Text before
+// the first heading is labeled "instructions". Section sizes include the
+// heading line and sum exactly to the prompt length.
+export function measurePromptSections(prompt) {
+    const boundaries = [];
+    for (const match of prompt.matchAll(/^## (.*)$/gm)) {
+        boundaries.push({
+            index: match.index,
+            name: match[1].trim() === '' ? 'untitled section' : match[1].trim(),
+        });
+    }
+    const sections = [];
+    const leadingChars = boundaries.length === 0 ? prompt.length : boundaries[0].index;
+    if (leadingChars > 0) {
+        sections.push({ name: 'instructions', chars: leadingChars });
+    }
+    for (const [position, boundary] of boundaries.entries()) {
+        const end = position + 1 < boundaries.length ? boundaries[position + 1].index : prompt.length;
+        sections.push({ name: boundary.name, chars: end - boundary.index });
+    }
+    if (sections.length === 0) {
+        sections.push({ name: 'instructions', chars: prompt.length });
+    }
+    return sections;
+}
+function formatChars(value) {
+    return value.toLocaleString('en-US');
+}
+function formatSectionName(name) {
+    return name.length > SECTION_NAME_MAX_CHARS
+        ? `${name.slice(0, SECTION_NAME_MAX_CHARS - 3)}...`
+        : name;
+}
+export function buildInputTooLargeMessage(args) {
+    const largest = [...args.sections]
+        .sort((a, b) => b.chars - a.chars)
+        .slice(0, REPORTED_SECTION_COUNT);
+    const sectionReport = largest
+        .map((section) => `"${formatSectionName(section.name)}" ${formatChars(section.chars)} chars`)
+        .join('; ');
+    return [
+        `Prompt is ${formatChars(args.promptChars)} chars; ${args.provider} accepts at most ${formatChars(args.maxInputChars)} input chars per turn.`,
+        `Largest sections: ${sectionReport}.`,
+    ].join('\n');
+}
+// Reads the largest section name back out of a message produced by
+// buildInputTooLargeMessage, so `neal status` can name the input to shrink in
+// its Next Action. Provider-authored input_too_large rejections carry no
+// section report, so this returns null for them and the caller falls back to
+// generic wording. Kept next to the builder so the format and its one parser
+// stay in lockstep.
+export function largestSectionNameFromInputTooLargeMessage(message) {
+    const match = message.match(/Largest sections: "([^"]+)"/);
+    return match ? match[1] : null;
+}
+// No-op when the role declares no budget or the prompt fits. Throws before any
+// SDK work otherwise; the error is non-retryable by construction, so it never
+// consumes API-retry budget.
+export function assertPromptWithinInputBudget(args) {
+    if (args.maxInputChars === undefined || args.prompt.length <= args.maxInputChars) {
+        return;
+    }
+    throw new NealProviderError({
+        message: buildInputTooLargeMessage({
+            provider: args.provider,
+            promptChars: args.prompt.length,
+            maxInputChars: args.maxInputChars,
+            sections: measurePromptSections(args.prompt),
+        }),
+        provider: args.provider,
+        role: args.role,
+        sessionHandle: args.sessionHandle ?? null,
+        kind: 'input_too_large',
+        retryable: false,
+    });
+}

package/dist/neal/providers/openai-codex.js

@@ -1,10 +1,25 @@
 import { Codex } from '@openai/codex-sdk';
-import { runStructuredJsonProtocol } from '../agents/structured-json.js';
+import { buildStructuredJsonPrompt, runStructuredJsonProtocol } from '../agents/structured-json.js';
 import { agentSettingsIsolated } from './agent-settings-isolation.js';
 import { agentSubprocessEnv } from './git-config-isolation.js';
+import { assertPromptWithinInputBudget } from './input-budget.js';
 import { resolveRateCost } from './pricing.js';
 import { isContentSafetyRefusalMessage, NealProviderError } from './types.js';
 const OPENAI_CODEX_PROVIDER_ID = 'openai-codex';
+// Codex's app-server rejects any single turn whose input exceeds this size
+// (JSON-RPC code -32602, input_error_code `input_too_large`). Declared as
+// `maxInputChars` on both role capabilities and enforced by the preflight at
+// every turn/round entry point below.
+const OPENAI_CODEX_MAX_INPUT_CHARS = 1_048_576;
+function assertCodexInputBudget(args) {
+    assertPromptWithinInputBudget({
+        prompt: args.prompt,
+        maxInputChars: OPENAI_CODEX_MAX_INPUT_CHARS,
+        provider: OPENAI_CODEX_PROVIDER_ID,
+        role: args.role,
+        sessionHandle: args.sessionHandle,
+    });
+}
 class CodexInactivityTimeoutError extends Error {
     constructor(timeoutMs) {
         super(`Codex timed out after ${Math.round(timeoutMs / 1000)}s without progress`);
@@ -76,6 +91,12 @@ function inferCodexErrorKind(error, message, fallback) {
     if (isContentSafetyRefusalMessage(message)) {
         return 'content_refused';
     }
+    // Codex's app-server rejects an over-limit turn with JSON-RPC code -32602
+    // and input_error_code `input_too_large`; matching the stable error code
+    // means a limit the preflight did not predict still classifies correctly.
+    if (text.includes('input_too_large')) {
+        return 'input_too_large';
+    }
     if (text.includes('permission') || text.includes('denied') || text.includes('forbidden') || text.includes('not authorized')) {
         return 'permission_denied';
     }
@@ -568,6 +589,11 @@ class OpenAICodexCoderAdapter {
     async runPrompt(args) {
         let thread = null;
         try {
+            assertCodexInputBudget({
+                prompt: args.prompt,
+                role: 'coder',
+                sessionHandle: args.resumeHandle ?? null,
+            });
             const createThread = this.options.createThread ?? createCodexThread;
             thread = createThread({
                 cwd: args.cwd,
@@ -620,6 +646,16 @@ class OpenAICodexCoderAdapter {
         while (true) {
             let thread = null;
             try {
+                // Preflight the exact text the initial SDK turn will send: the
+                // protocol-wrapped prompt. buildStructuredJsonPrompt is the same pure
+                // builder runStructuredJsonProtocol applies to the same inputs below,
+                // so the checked text is byte-identical to the sent text. Repair
+                // prompts are checked in runRepair before their thread is created.
+                assertCodexInputBudget({
+                    prompt: buildStructuredJsonPrompt(args.prompt, args.structuredJsonProtocol),
+                    role: 'coder',
+                    sessionHandle: args.resumeHandle ?? null,
+                });
                 const createThread = this.options.createThread ?? createCodexThread;
                 thread = createThread({
                     cwd: args.cwd,
@@ -650,6 +686,14 @@ class OpenAICodexCoderAdapter {
                         };
                     },
                     runRepair: async (prompt) => {
+                        // A generated repair prompt embeds the invalid payload and the
+                        // original response, so it can exceed the budget even when the
+                        // initial prompt fit; preflight it before creating its thread.
+                        assertCodexInputBudget({
+                            prompt,
+                            role: 'coder',
+                            sessionHandle: thread.id ?? args.resumeHandle ?? null,
+                        });
                         // Repair runs on a fresh prompt-only thread whose prompt forbids
                         // tool use entirely, so nothing in the repair flow needs write
                         // access; the read-only sandbox enforces that mechanically
@@ -740,6 +784,20 @@ class OpenAICodexStructuredAdvisorAdapter {
         while (true) {
             let thread = null;
             try {
+                // Preflight the exact text the initial SDK turn will send: the
+                // protocol-wrapped prompt on the local-JSON path
+                // (buildStructuredJsonPrompt is the same pure builder
+                // runStructuredJsonProtocol applies to the same inputs below, so the
+                // checked text is byte-identical to the sent text), the bare prompt on
+                // the provider-native path. Repair prompts are checked in runRepair
+                // before their thread is created.
+                assertCodexInputBudget({
+                    prompt: args.structuredJsonProtocol?.protocol === 'neal-json-block-v1'
+                        ? buildStructuredJsonPrompt(args.prompt, args.structuredJsonProtocol)
+                        : args.prompt,
+                    role: 'structured-advisor',
+                    sessionHandle: args.resumeHandle ?? null,
+                });
                 thread = createThread({
                     cwd: args.cwd,
                     sessionHandle: args.resumeHandle,
@@ -770,6 +828,14 @@ class OpenAICodexStructuredAdvisorAdapter {
                             };
                         },
                         runRepair: async (prompt) => {
+                            // A generated repair prompt embeds the invalid payload and the
+                            // original response, so it can exceed the budget even when the
+                            // initial prompt fit; preflight it before creating its thread.
+                            assertCodexInputBudget({
+                                prompt,
+                                role: 'structured-advisor',
+                                sessionHandle: thread.id ?? args.resumeHandle ?? null,
+                            });
                             const repairThread = createThread({
                                 cwd: args.cwd,
                                 model: this.options.model ?? undefined,
@@ -875,6 +941,7 @@ export const openAICodexProviderDefinition = {
                 write: true,
                 shell: true,
             },
+            maxInputChars: OPENAI_CODEX_MAX_INPUT_CHARS,
             supportsSessionResume: true,
             supportsModelOverride: true,
             supportsStructuredOutput: true,
@@ -891,6 +958,7 @@ export const openAICodexProviderDefinition = {
                 write: false,
                 shell: false,
             },
+            maxInputChars: OPENAI_CODEX_MAX_INPUT_CHARS,
             supportsSessionResume: true,
             supportsModelOverride: true,
             supportsStructuredOutput: true,

package/dist/neal/review-findings/run.js

@@ -344,7 +344,7 @@ async function readRunStates(cwd) {
     const runsDir = getRunsDir(cwd);
     let entries;
     try {
-        entries = await readdir(runsDir);
+        entries = await readdir(runsDir, { withFileTypes: true });
     }
     catch (error) {
         if (isMissingFileError(error)) {
@@ -353,7 +353,14 @@ async function readRunStates(cwd) {
         throw error;
     }
     const states = {};
-    for (const entry of entries.sort()) {
+    // Only directories are runs. The runs root also collects stray files such as
+    // macOS `.DS_Store`, and joining a run-state path onto one of those reads
+    // through a non-directory.
+    const runDirNames = entries
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => entry.name)
+        .sort();
+    for (const entry of runDirNames) {
         const statePath = getRunStatePath(join(runsDir, entry));
         const content = await readOptionalText(statePath);
         if (content !== null) {
@@ -374,6 +381,13 @@ function assertSameStringMap(before, after, label) {
         }
     }
 }
+// A run-state path can be unreadable because nothing is there (`ENOENT`) or
+// because a path segment is not a directory (`ENOTDIR`, e.g. a stray file in the
+// runs root). Both mean "no run state here", never a review failure.
 function isMissingFileError(error) {
-    return typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';
+    if (typeof error !== 'object' || error === null || !('code' in error)) {
+        return false;
+    }
+    const code = error.code;
+    return code === 'ENOENT' || code === 'ENOTDIR';
 }