@opengsd/gsd-core 1.7.0 → 1.9.0

package/gsd-core/workflows/review.md

@@ -26,19 +26,46 @@ command -v cursor-agent >/dev/null 2>&1 && echo "cursor:available" || echo "curs
 command -v agy >/dev/null 2>&1 && echo "antigravity:available" || echo "antigravity:missing"
 
 # Check local model servers (OpenAI-compatible HTTP API — no CLI binary required)
-OLLAMA_HOST=$(gsd_run query config-get review.ollama_host 2>/dev/null | jq -r '.' 2>/dev/null || echo "")
+OLLAMA_HOST=$(gsd_run query config-get review.ollama_host --raw 2>/dev/null || echo "")
 if [ -z "$OLLAMA_HOST" ] || [ "$OLLAMA_HOST" = "null" ]; then OLLAMA_HOST="http://localhost:11434"; fi
 curl -s --max-time 2 "${OLLAMA_HOST}/v1/models" >/dev/null 2>&1 && echo "ollama:available" || echo "ollama:missing"
 
-LM_STUDIO_HOST=$(gsd_run query config-get review.lm_studio_host 2>/dev/null | jq -r '.' 2>/dev/null || echo "")
+LM_STUDIO_HOST=$(gsd_run query config-get review.lm_studio_host --raw 2>/dev/null || echo "")
 if [ -z "$LM_STUDIO_HOST" ] || [ "$LM_STUDIO_HOST" = "null" ]; then LM_STUDIO_HOST="http://localhost:1234"; fi
 curl -s --max-time 2 "${LM_STUDIO_HOST}/v1/models" >/dev/null 2>&1 && echo "lm_studio:available" || echo "lm_studio:missing"
 
-LLAMA_CPP_HOST=$(gsd_run query config-get review.llama_cpp_host 2>/dev/null | jq -r '.' 2>/dev/null || echo "")
+LLAMA_CPP_HOST=$(gsd_run query config-get review.llama_cpp_host --raw 2>/dev/null || echo "")
 if [ -z "$LLAMA_CPP_HOST" ] || [ "$LLAMA_CPP_HOST" = "null" ]; then LLAMA_CPP_HOST="http://localhost:8080"; fi
 curl -s --max-time 2 "${LLAMA_CPP_HOST}/v1/models" >/dev/null 2>&1 && echo "llama_cpp:available" || echo "llama_cpp:missing"
+
+# jq prerequisite (#2589). The config/model/budget lookups in this workflow no
+# longer need jq — they use the native --raw/--pick flags. But the lanes listed
+# under "jq-dependent reviewer lanes" below parse structured JSON that gsd-tools
+# does not emit (OpenAI-compatible /v1/chat/completions responses, opencode's
+# JSONL event stream, agy's conversation cache), so they cannot run without jq.
+# Probe it here rather than letting each lane swallow exit 127 into empty output.
+command -v jq >/dev/null 2>&1 && echo "jq:available" || echo "jq:missing"
+```
+
+**jq-dependent reviewer lanes.** `jq` is a production prerequisite for the
+`ollama`, `lm_studio`, `llama_cpp`, `opencode`, and `antigravity` lanes only. If
+`detect_clis` reports `jq:missing`, treat those five as **undetected** — they
+follow the same "known-but-undetected" path as a missing CLI. Which path that is
+depends on how the lane was selected (see the precedence rules below): reached
+through `review.default_reviewers` or `--all` it is an info note and the lane is
+ignored; named by an explicit flag it is an **error**, because the user asserted
+that lane. Tell the user to install jq:
+
+```
+NOTE: jq is not on PATH — the ollama, lm_studio, llama_cpp, opencode, and
+antigravity reviewer lanes are unavailable. Install jq (https://jqlang.org/download/)
+or select a lane that does not require it (--gemini, --claude, --codex,
+--coderabbit, --qwen, --cursor).
 ```
 
+The remaining lanes (`gemini`, `claude`, `codex`, `coderabbit`, `qwen`, `cursor`)
+do not require jq and must stay selectable on a jq-less host.
+
 Parse flags from `$ARGUMENTS`:
 - `--gemini` → include Gemini
 - `--claude` → include Claude
@@ -60,10 +87,22 @@ Reviewer-selection precedence:
 3. `review.default_reviewers`
 4. No key + no flags → all detected reviewers
 
+**Explicit reviewer flags are an assertion, not a preference (ADR-2782 D4).** A lane the user
+named on the command line and that cannot run is an **error**, surfaced and non-silent — even
+when other named lanes did run. Do not proceed with a thinner reviewer set and report success:
+`--gemini --qwen` on a host without `qwen` fails, it does not quietly become a Gemini-only
+review. This applies however the lane became unavailable — binary missing, prerequisite `jq`
+absent, or a local server not reachable.
+
+The asymmetry is deliberate: *not finding a lane nobody asked for is normal; failing to run a
+lane somebody asked for is an error.* A user who wants "whatever is available" has `--all`; a
+user who wants a preferred set has `review.default_reviewers`. Both stay lenient below.
+
 `review.default_reviewers` behavior:
 - Value must be a non-empty array of slug strings (configured via `gsd config-set review.default_reviewers '["gemini","codex"]'`)
 - Unknown slugs warn and are ignored
-- Known-but-undetected slugs emit an info note and are ignored
+- Known-but-undetected slugs emit an info note and are ignored — a configured default is a
+  preference evaluated across many hosts, so a subset being present is expected, not an error
 - If all configured reviewers are unavailable, fail with an actionable message
 
 **Reviewer instances (#1517, optional):** if `review.reviewer_instances` is configured,
@@ -119,10 +158,20 @@ Collect phase artifacts for the review prompt:
 ```bash
 INIT=$(gsd_run query init.phase-op "${PHASE_ARG}")
 if [[ "$INIT" == @file:* ]]; then INIT=$(cat "${INIT#@file:}"); fi
+
+# #2358: ONE run-scoped temp dir (portable via ${TMPDIR:-/tmp}) so overlapping
+# runs never collide or read each other's stale files.
+RUN_DIR=$(mktemp -d "${TMPDIR:-/tmp}/gsd-review-XXXXXX")
+echo "RUN_DIR=$RUN_DIR"
 ```
 
 Read from init: `phase_dir`, `phase_number`, `padded_phase`.
 
+Capture `RUN_DIR` above (created ONCE) and thread it into every `{run_dir}`
+placeholder and `$RUN_DIR`/`${RUN_DIR}` reference within a bash block. Do NOT
+re-run `mktemp -d` later — every block must resolve to this same directory, or
+`build_prompt`'s writes and `invoke_reviewers`' reads split.
+
 Then read:
 1. `.planning/PROJECT.md` (first 80 lines — project context)
 2. Phase section from `.planning/ROADMAP.md`
@@ -189,569 +238,160 @@ Focus on:
 Output your review in markdown format.
 ```
 
-Write to a temp file: `/tmp/gsd-review-prompt-{phase}.md`
+Write to a temp file: `{run_dir}/gsd-review-prompt.md`
 
 Also write individual section files so the budget tool can re-trim per reviewer:
 
 ```bash
+RUN_DIR="{run_dir}"   # from gather_context
+
 # Write individual section files for per-reviewer budget trimming
 # These are always written so reviewers with a budget can invoke prompt-budget
-cp "$INSTRUCTIONS_BLOCK_FILE" "/tmp/gsd-review-${PHASE}-instructions.md"
-cp "$ROADMAP_SECTION_FILE" "/tmp/gsd-review-${PHASE}-roadmap.md"
+cp "$INSTRUCTIONS_BLOCK_FILE" "${RUN_DIR}/gsd-review-instructions.md"
+cp "$ROADMAP_SECTION_FILE" "${RUN_DIR}/gsd-review-roadmap.md"
 
 # Plan files: copy each PLAN.md to a predictable numbered path
 PLAN_INDEX=0
 for PLAN_FILE in "${PHASE_DIR}"/*-PLAN.md; do
   PADDED_IDX=$(printf '%02d' "$PLAN_INDEX")
-  cp "$PLAN_FILE" "/tmp/gsd-review-${PHASE}-plan-${PADDED_IDX}.md"
+  cp "$PLAN_FILE" "${RUN_DIR}/gsd-review-plan-${PADDED_IDX}.md"
   PLAN_INDEX=$((PLAN_INDEX + 1))
 done
 
 # Optional section files (only if content was included in the combined prompt)
 if [ -f ".planning/PROJECT.md" ]; then
-  cp .planning/PROJECT.md "/tmp/gsd-review-${PHASE}-project.md"
+  cp .planning/PROJECT.md "${RUN_DIR}/gsd-review-project.md"
 fi
 if ls "${PHASE_DIR}/"*"-CONTEXT.md" >/dev/null 2>&1; then
-  cat "${PHASE_DIR}/"*"-CONTEXT.md" > "/tmp/gsd-review-${PHASE}-context.md"
+  cat "${PHASE_DIR}/"*"-CONTEXT.md" > "${RUN_DIR}/gsd-review-context.md"
 fi
 if ls "${PHASE_DIR}/"*"-RESEARCH.md" >/dev/null 2>&1; then
-  cat "${PHASE_DIR}/"*"-RESEARCH.md" > "/tmp/gsd-review-${PHASE}-research.md"
+  cat "${PHASE_DIR}/"*"-RESEARCH.md" > "${RUN_DIR}/gsd-review-research.md"
 fi
 if [ -f ".planning/REQUIREMENTS.md" ]; then
-  cp .planning/REQUIREMENTS.md "/tmp/gsd-review-${PHASE}-requirements.md"
+  cp .planning/REQUIREMENTS.md "${RUN_DIR}/gsd-review-requirements.md"
 fi
 ```
 
-Note: The variable names above (`INSTRUCTIONS_BLOCK_FILE`, `ROADMAP_SECTION_FILE`, `PHASE_DIR`, `PHASE`) reference the variables already established during prompt assembly. In practice the AI implementing this step writes the instruction and roadmap blocks to temp files while assembling the combined prompt, then copies those same temp files to the per-reviewer section paths. If the assembled prompt was built inline (string concatenation rather than file-by-file), write each section to the corresponding path after writing the combined file.
+Note: `INSTRUCTIONS_BLOCK_FILE`, `ROADMAP_SECTION_FILE`, and `PHASE_DIR` come from prompt assembly; `RUN_DIR` is the run-scoped dir from `gather_context` (#2358) re-assigned from `{run_dir}` above. Copy the temp files written during prompt assembly to these section paths (or write each section here if the prompt was built inline).
 </step>
 
 <step name="invoke_reviewers">
-Read model preferences from planning config. Null/missing values fall back to CLI defaults.
-
-```bash
-# JSON scalars from gsd-tools.cjs query; use jq -r to strip JSON string quotes (install jq if missing)
-GEMINI_MODEL=$(gsd_run query config-get review.models.gemini 2>/dev/null | jq -r '.' 2>/dev/null || true)
-CLAUDE_MODEL=$(gsd_run query config-get review.models.claude 2>/dev/null | jq -r '.' 2>/dev/null || true)
-CODEX_MODEL=$(gsd_run query config-get review.models.codex 2>/dev/null | jq -r '.' 2>/dev/null || true)
-OPENCODE_MODEL=$(gsd_run query config-get review.models.opencode 2>/dev/null | jq -r '.' 2>/dev/null || true)
-# review.models.agy, when set, is passed to agy as --model (escape hatch for a
-# pinned model that 404s server-side); otherwise agy uses its persisted default.
-AGY_MODEL=$(gsd_run query config-get review.models.agy 2>/dev/null | jq -r '.' 2>/dev/null || true)
-
-# #1115: `--dangerously-bypass-hook-trust` only exists on codex-cli >= 0.137.0.
-# Capability-probe it so older installs don't fail with "unexpected argument"
-# (which, with stderr suppressed, produced a silent empty review). The codex
-# invocation works fine without the flag on older versions.
-if codex exec --help 2>/dev/null | grep -q -- '--dangerously-bypass-hook-trust'; then
-  CODEX_BYPASS_FLAG="--dangerously-bypass-hook-trust"
-else
-  CODEX_BYPASS_FLAG=""
-fi
-```
-
-**Reviewer instances (#1517, optional):** when instances are configured, each selected
-instance invokes its base `cli` with its own `model`/`agent` (opaque argv, never
-shell-interpolated). Exact invocation in `gsd-core/references/reviewer-instances.md`.
-
-For each selected CLI, invoke in sequence (not parallel — avoid rate limits):
-
-**Timeout guidance (#2194):** prompt-fed source-grounded reviews are slow — measured ~570s for Codex at `xhigh` effort and ~525s for headless Claude on a large plan set. Each of the Gemini / Claude / Codex blocks below MUST be invoked with a high Bash `timeout:` — at least `900000` (15 min), and `1200000` (20 min) for Codex `xhigh` or headless Claude — so a lane is not killed mid-review. On Claude Code, raise the host cap via `BASH_MAX_TIMEOUT_MS` if a review can exceed it. A silent empty output after a long run is a **timeout kill, not a crash** — the Codex `0xc0000142` misdiagnosis persisted because the empty-output branches below cannot distinguish the two; treat an empty result on a slow lane as a dropped lane and re-run with more time rather than diagnosing a CLI/sandbox failure. A cross-AI review that silently drops a lane is blind in one eye.
-
-**Gemini:**
-```bash
-if [ -n "$GEMINI_MODEL" ] && [ "$GEMINI_MODEL" != "null" ]; then
-  cat /tmp/gsd-review-prompt-{phase}.md | gemini -m "$GEMINI_MODEL" -p - 2>/dev/null > /tmp/gsd-review-gemini-{phase}.md
-else
-  cat /tmp/gsd-review-prompt-{phase}.md | gemini -p - 2>/dev/null > /tmp/gsd-review-gemini-{phase}.md
-fi
-```
-
-**Claude (separate session):**
-```bash
-if [ -n "$CLAUDE_MODEL" ] && [ "$CLAUDE_MODEL" != "null" ]; then
-  cat /tmp/gsd-review-prompt-{phase}.md | claude --model "$CLAUDE_MODEL" -p - 2>/dev/null > /tmp/gsd-review-claude-{phase}.md
-else
-  cat /tmp/gsd-review-prompt-{phase}.md | claude -p - 2>/dev/null > /tmp/gsd-review-claude-{phase}.md
-fi
-```
-
-**Codex:**
-```bash
-# $CODEX_BYPASS_FLAG is capability-gated above (#1115). Capture stderr to a .err
-# file (not /dev/null) so a non-zero exit — e.g. a flag the installed codex-cli
-# does not support — is diagnosable instead of a silent empty review.
-# Capture the review via codex's own `-o/--output-last-message <FILE>` (only the
-# final agent message) and discard stdout (#1698): on some platforms (Windows)
-# codex writes process-teardown output to stdout *after* the final message, and a
-# stdout redirect would append that noise to a non-empty file — slipping past the
-# `[ ! -s … ]` empty-output guard as a silently polluted review.
-if [ -n "$CODEX_MODEL" ] && [ "$CODEX_MODEL" != "null" ]; then
-  cat /tmp/gsd-review-prompt-{phase}.md | codex exec --ephemeral $CODEX_BYPASS_FLAG --model "$CODEX_MODEL" --skip-git-repo-check -o /tmp/gsd-review-codex-{phase}.md - 2>/tmp/gsd-review-codex-{phase}.err >/dev/null
-else
-  cat /tmp/gsd-review-prompt-{phase}.md | codex exec --ephemeral $CODEX_BYPASS_FLAG --skip-git-repo-check -o /tmp/gsd-review-codex-{phase}.md - 2>/tmp/gsd-review-codex-{phase}.err >/dev/null
-fi
-if [ ! -s /tmp/gsd-review-codex-{phase}.md ]; then
-  echo "Codex review failed or returned empty output. stderr:" > /tmp/gsd-review-codex-{phase}.md
-  cat /tmp/gsd-review-codex-{phase}.err >> /tmp/gsd-review-codex-{phase}.md
-fi
-```
-
-**CodeRabbit:**
-
-Note: CodeRabbit reviews the current git diff/working tree — it does not accept a prompt or model flag. It may take up to 5 minutes. Use `timeout: 360000` on the Bash tool call. The source-grounding requirement in the build_prompt Review Instructions applies only to the prompt-fed reviewers above; CodeRabbit is a diff-only reviewer and never receives it. Treat its output as a diff observation, not a grounded plan-level verdict.
-
-```bash
-coderabbit review --prompt-only 2>/dev/null > /tmp/gsd-review-coderabbit-{phase}.md
-```
-
-**OpenCode (via GitHub Copilot):**
-
-OpenCode's default `build` agent is an agentic coder, not a prompt→completion API.
-On a large review prompt it may run a few `read` tool calls and then end its turn
-with **zero output tokens** (`reason:"stop"`, `output:0`), so `--format default`
-yields empty stdout and the second reviewer is silently lost (#1936). Invoke with
-`--format json` and reconstruct the review from the assistant `text` parts; if the
-agent emitted none, surface the stop `reason`, output-token count, and captured
-stderr so the failure is diagnosable instead of a generic empty stub. Runs are also
-nondeterministic in length, so bound this Bash tool call with a wall-clock timeout —
-set `timeout: 660000` on the call (same mechanism the CodeRabbit block documents).
-That bound is hard: if it fires mid-`opencode run` the tool kills the command and
-the jq reconstruction below never runs, so the reviewing agent simply proceeds
-without an OpenCode result. The completing zero-output case — the actual #1936 bug —
-is fully handled below; the timeout only backstops the rarer nondeterministic hang. A
-reviewer instance with `"agent": "review"` (see
-`gsd-core/references/reviewer-instances.md`) sidesteps the default `build` agent and
-is the durable fix when this recurs.
-
-```bash
-# stderr → sidecar (never /dev/null) so a real error is diagnosable — mirrors the
-# Codex block. --format json is the primary invocation (not a fallback): the review
-# text lives in assistant `text` parts, which the default formatter drops when the
-# agent stops with no final message (#1936).
-if [ -n "$OPENCODE_MODEL" ] && [ "$OPENCODE_MODEL" != "null" ]; then
-  set -- --model "$OPENCODE_MODEL"
-else
-  set --
-fi
-cat /tmp/gsd-review-prompt-{phase}.md | opencode run "$@" --format json - 2>/tmp/gsd-review-opencode-{phase}.err > /tmp/gsd-review-opencode-{phase}.json
-# Reconstruct the review from the assistant text parts. Capture into a variable and
-# test its CONTENT (not the output file's size): an empty extraction still prints a
-# trailing newline, which would fool a `[ -s file ]` check into skipping the stub.
-OPENCODE_REVIEW=$(jq -rs '[.[] | select(.type=="text") | .part.text // empty] | join("\n")' /tmp/gsd-review-opencode-{phase}.json 2>/dev/null)
-if [ -n "$OPENCODE_REVIEW" ]; then
-  printf '%s\n' "$OPENCODE_REVIEW" > /tmp/gsd-review-opencode-{phase}.md
-else
-  # No assistant text (agent emitted no final message, or stdout was not valid JSON events).
-  {
-    echo "OpenCode review returned no assistant text (#1936: agent ended its turn with no final message)."
-    OPENCODE_DIAG=$(jq -rs '[.[] | select(.type=="step_finish")] | last | "stop reason=\(.part.reason // "?"), output tokens=\(.part.tokens.output // "?")"' /tmp/gsd-review-opencode-{phase}.json 2>/dev/null)
-    [ -n "$OPENCODE_DIAG" ] && echo "Diagnostic: $OPENCODE_DIAG"
-    echo "stderr:"
-    cat /tmp/gsd-review-opencode-{phase}.err
-  } > /tmp/gsd-review-opencode-{phase}.md
-fi
-```
-
-**Qwen Code:**
-```bash
-cat /tmp/gsd-review-prompt-{phase}.md | qwen - 2>/dev/null > /tmp/gsd-review-qwen-{phase}.md
-if [ ! -s /tmp/gsd-review-qwen-{phase}.md ]; then
-  echo "Qwen review failed or returned empty output." > /tmp/gsd-review-qwen-{phase}.md
-fi
-```
-
-**Cursor:**
-```bash
-# cursor-agent is a SEPARATE binary from the `cursor` IDE launcher; print mode (-p) takes the
-# prompt as an ARGUMENT, not stdin. A full review prompt can exceed the OS argument limit, so
-# reference the prompt file by path rather than inlining it. Capture stderr so a failure is
-# diagnosable instead of a silent empty result.
-# #2176: same absolute-root anchor as the Antigravity block — cursor-agent runs
-# in the repo cwd, but repo-relative references in the assembled prompt still
-# need an explicit root to resolve against. rev-parse (not bare pwd) so the
-# anchor is correct even when /gsd:review is invoked from a repo subdirectory.
-_CURSOR_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
-CURSOR_PROMPT_ARG="Read the file at /tmp/gsd-review-prompt-{phase}.md in full and carry out the review request it contains. The repository under review is at $_CURSOR_ROOT — resolve every relative file path in the review request against that absolute root. Output only the resulting markdown review. Do not edit any files."
-cursor-agent -p --mode ask --trust --output-format text "$CURSOR_PROMPT_ARG" 2>/tmp/gsd-review-cursor-{phase}.err > /tmp/gsd-review-cursor-{phase}.md
-if [ ! -s /tmp/gsd-review-cursor-{phase}.md ]; then
-  echo "Cursor review failed or returned empty output. stderr:" > /tmp/gsd-review-cursor-{phase}.md
-  cat /tmp/gsd-review-cursor-{phase}.err >> /tmp/gsd-review-cursor-{phase}.md
-fi
-```
-
-**Antigravity CLI:**
-
-**Maintainer note — why this block has three layers (last updated against agy 1.0.16):**
-
-`agy -p` (the `--print` non-interactive flag) works correctly on macOS and Linux: it sends the
-prompt, receives the model response, and writes it to stdout. On **native Windows** it silently
-produces no stdout output despite the API call succeeding — a bug in `text_drip.go`'s non-TTY
-flush path, tracked at https://github.com/google-antigravity/antigravity-cli/issues/27466 and
-still open as of agy 1.0.2.
-
-Regardless of platform, `agy` always persists the full exchange to a transcript file on disk.
-The transcript fallback (Step 2 below) reads that file directly, giving Windows users full review
-coverage without any extra tooling. This pattern was first documented by the community MCP bridge
-at https://github.com/SinanTufekci/Claude-Code-Antigravity-CLI-MCP-Server — we inline the same
-logic here in pure bash/jq so no additional dependency is required.
-
-**Stale-response guard (why the pre-flight watermark matters):**
-Without a watermark, the fallback would read the last `PLANNER_RESPONSE` entry in the transcript
-regardless of when it was written — including entries from a previous invocation in the same
-workspace. To prevent that, we record the transcript's line count *before* calling `agy -p`. In
-the fallback, we only read lines appended after that count. If no new lines were written (agy
-failed before producing a response), `_AGY_RESULT` is empty and Step 3 fires — never stale. If
-the conv-id changed (agy started a fresh session), all lines in the new file are new and we use
-skip=0.
-
-**If the upstream stdout bug is fixed** (check the issue above): Step 2 silently becomes
-unreachable; stdout is non-empty and Step 1 handles it. No code change needed.
-
-**If the transcript paths change** in a future `agy` release: Step 2 silently becomes a no-op
-and Step 3 fires with a clear error message in REVIEWS.md. No silent corruption. To debug:
-- `~/.gemini/antigravity-cli/cache/last_conversations.json` — workspace → conv-id map
-- `~/.gemini/antigravity-cli/brain/<id>/.system_generated/logs/transcript.jsonl`
-  Filter: `source=="MODEL"`, `status=="DONE"`, `type=="PLANNER_RESPONSE"`, take the last match's `content` field.
-
-Invocation specifics (verified agy 1.0.0, macOS arm64 and Linux amd64):
-- `-p` takes the prompt as a **flag value** — `echo X | agy -p` errors with "flag needs an argument: -p"
-- `--print-timeout` defaults to 5m, aligning with this workflow's global timeout
-- `--model "<name>"` selects the model (available since agy ~1.0.3; `agy models` lists
-  them). When `review.models.agy` is set it is passed as `--model`; otherwise agy uses
-  its persisted default (`agy models`).
-
-```bash
-# Pre-flight: snapshot the transcript watermark before invoking agy.
-# Must run BEFORE agy -p — this is what prevents the fallback from reading a stale prior response.
-_AGY_WS=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-_AGY_CACHE="$HOME/.gemini/antigravity-cli/cache/last_conversations.json"
-_AGY_MARK_CONV=""
-_AGY_MARK_LINES=0
-if [ -f "$_AGY_CACHE" ]; then
-  _AGY_MARK_CONV=$(jq -r --arg ws "$_AGY_WS" '
-    .[$ws] //
-    (to_entries
-     | map(select(.key | ascii_downcase == ($ws | ascii_downcase)))
-     | first | .value) //
-    empty
-  ' "$_AGY_CACHE" 2>/dev/null)
-  if [ -n "$_AGY_MARK_CONV" ] && [ "$_AGY_MARK_CONV" != "null" ]; then
-    _AGY_MARK_TX="$HOME/.gemini/antigravity-cli/brain/${_AGY_MARK_CONV}/.system_generated/logs/transcript.jsonl"
-    [ -f "$_AGY_MARK_TX" ] && _AGY_MARK_LINES=$(wc -l < "$_AGY_MARK_TX" | tr -d ' ')
-  fi
-fi
-
-# Step 1 — primary invocation: stdout works on macOS, Linux, and WSL.
-# Three hardening invariants (#2073), all mirroring the Cursor block's discipline:
-#   * FILE-REFERENCE prompt (not inline `$(cat …)`) — a large review prompt (≈197 KB
-#     for 6 plans + CONTEXT + RESEARCH + REQUIREMENTS) overflows the exec arg list
-#     (`bash: agy: Argument list too long`, rc 126), indistinguishable from a model
-#     failure when stderr is suppressed.
-#   * EXTERNAL `timeout` wrapper when available (GNU `timeout` / `gtimeout`) —
-#     `--print-timeout` is agy's native cap but it CANNOT fire before agy creates a
-#     session; under concurrent heavy runs one process can stall pre-session (no
-#     `brain/<conv-id>/` dir, alive at 583 s despite `--print-timeout 300s`). The
-#     external cap bounds wall-clock regardless. Stock macOS lacks `timeout`, so
-#     the block probes for it and falls back to --print-timeout alone there.
-#   * `--model` from `review.models.agy` when set — escape hatch for a pinned model
-#     that 404s server-side (exits 0 with empty stdout AND empty transcript).
-#   * stdin tied to /dev/null so agy never blocks on a tty.
-# A non-zero exit (external timeout = 124, crash, etc.) discards any partial output
-# so the Step 2 transcript fallback / Step 3 diagnostic take over.
-if [ -n "$AGY_MODEL" ] && [ "$AGY_MODEL" != "null" ]; then
-  set -- --model "$AGY_MODEL"
-else
-  set --
-fi
-# #2176: grant the reviewer the repo under review. Without --add-dir, agy's
-# permission context never receives the cwd repo — the agent anchors on its own
-# ~/.gemini/antigravity-cli/scratch dir and reviews the plan text in isolation
-# (the exact failure the Review Instructions forbid). Capability-probed like the
-# Codex bypass flag so an older agy without --add-dir still runs; the prompt
-# anchor below keeps absolute-path reads possible on that fallback.
-if agy --help 2>/dev/null | grep -q -- '--add-dir'; then
-  set -- "$@" --add-dir "$_AGY_WS"
-fi
-# #2176: anchor the prompt to the absolute repo root so repo-relative references
-# in the assembled review prompt resolve even on the no---add-dir fallback, and
-# require an explicit self-report if the reviewer still cannot read the repo.
-_AGY_PROMPT="Read the file at /tmp/gsd-review-prompt-{phase}.md in full and carry out the review request it contains. The repository under review is at $_AGY_WS — resolve every relative file path in the review request against that absolute root and verify claims against those files. If you cannot read files under $_AGY_WS, begin your output with the exact line REVIEWED-WITHOUT-REPO-ACCESS before the review. Output only the resulting markdown review. Do not edit any files."
-# Capability-probe an external wall-clock killer (GNU coreutils `timeout` or the
-# macOS Homebrew `gtimeout`). Stock macOS ships NEITHER — a bare `timeout …` would
-# fail with rc 127 ("command not found") and silently lose the reviewer, so fall
-# back to agy's native --print-timeout alone in that case. The external cap, when
-# available, is set HIGHER than --print-timeout so it only backstops a pre-session
-# stall (which --print-timeout cannot bound — #2073 mode 3) and never pre-empts a
-# healthy run. Mirrors the probe in scripts/base64-scan.sh.
-_AGY_KILLER="$(command -v timeout 2>/dev/null || command -v gtimeout 2>/dev/null || true)"
-if [ -n "$_AGY_KILLER" ]; then
-  "$_AGY_KILLER" 600 agy --print-timeout 540s "$@" -p "$_AGY_PROMPT" </dev/null 2>/dev/null > /tmp/gsd-review-antigravity-{phase}.md
-else
-  agy --print-timeout 540s "$@" -p "$_AGY_PROMPT" </dev/null 2>/dev/null > /tmp/gsd-review-antigravity-{phase}.md
-fi
-_AGY_RC=$?
-if [ "$_AGY_RC" -ne 0 ]; then
-  : > /tmp/gsd-review-antigravity-{phase}.md
-fi
-
-# Step 2 — transcript fallback: catches Windows agy -p stdout bug (and any future stdout-silent edge cases).
-# Reads only lines appended AFTER the pre-flight watermark. If agy failed before writing a new response,
-# _AGY_RESULT is empty and Step 3 fires — no stale content can leak through.
-# Undocumented paths, verified agy 1.0.0–1.0.2. See maintainer note above if these break.
-if [ ! -s /tmp/gsd-review-antigravity-{phase}.md ]; then
-  if [ -f "$_AGY_CACHE" ]; then
-    _AGY_CONV=$(jq -r --arg ws "$_AGY_WS" '
-      .[$ws] //
-      (to_entries
-       | map(select(.key | ascii_downcase == ($ws | ascii_downcase)))
-       | first | .value) //
-      empty
-    ' "$_AGY_CACHE" 2>/dev/null)
-    if [ -n "$_AGY_CONV" ] && [ "$_AGY_CONV" != "null" ]; then
-      _AGY_TX="$HOME/.gemini/antigravity-cli/brain/${_AGY_CONV}/.system_generated/logs/transcript.jsonl"
-      if [ -f "$_AGY_TX" ]; then
-        # If conv-id changed, agy started a new session — all lines are new, skip 0.
-        # If same conv-id, only read lines beyond the watermark.
-        [ "$_AGY_CONV" = "$_AGY_MARK_CONV" ] && _AGY_SKIP=$_AGY_MARK_LINES || _AGY_SKIP=0
-        _AGY_RESULT=$(tail -n +"$((_AGY_SKIP + 1))" "$_AGY_TX" 2>/dev/null | \
-          jq -r 'select(.source=="MODEL" and .status=="DONE" and .type=="PLANNER_RESPONSE") | .content' \
-          2>/dev/null | tail -1)
-        [ -n "$_AGY_RESULT" ] && echo "$_AGY_RESULT" > /tmp/gsd-review-antigravity-{phase}.md
-      fi
-    fi
-  fi
-fi
-
-# Step 3 — final guard: both approaches yielded nothing (auth error, first-run setup,
-# path schema changed, 404'd pinned model, pre-session stall, etc.)
-if [ ! -s /tmp/gsd-review-antigravity-{phase}.md ]; then
-  {
-    echo "Antigravity review failed or returned empty output."
-    # #2073 mode 2: a pinned model that 404s exits 0 with empty stdout AND an empty
-    # transcript — the only evidence is in agy's own log. Surface it instead of a
-    # bare generic stub so the failure is diagnosable.
-    _AGY_LOG="$HOME/.gemini/antigravity-cli/cli.log"
-    if [ -f "$_AGY_LOG" ]; then
-      _AGY_ERR=$(grep -iE 'agent executor error|NOT_FOUND|Publisher model' "$_AGY_LOG" | tail -3)
-      if [ -n "$_AGY_ERR" ]; then
-        echo "agy log hint (pinned model may be unavailable — run 'agy models' and set review.models.agy):"
-        echo "$_AGY_ERR"
-      fi
-    fi
-    # #2073 mode 3: pre-session stall tell — no new conversation dir appeared.
-    echo "If no agy run started, that is the pre-session-stall case: check whether a new ~/.gemini/antigravity-cli/brain/<conv-id>/ dir appeared within ~30s of launch."
-  } > /tmp/gsd-review-antigravity-{phase}.md
-fi
-
-# #2176: blind-review marker. Two tells that the reviewer ran without repo
-# access: the prompt's mandated REVIEWED-WITHOUT-REPO-ACCESS self-report in the
-# first lines of output, or the agent DECLARING the scratch dir as its
-# workspace. Both patterns are anchored — the self-report to the head of the
-# file, the scratch tell to a workspace-declaration phrasing — so a grounded
-# review that merely QUOTES these strings (e.g. reviewing this very file) is
-# never mis-stamped. Stamp a machine-readable marker so the Consensus Summary
-# down-weights the review instead of counting an ungrounded verdict at full
-# weight. (Temp file + mv, no in-place sed — BSD/GNU safe.)
-if [ -s /tmp/gsd-review-antigravity-{phase}.md ] && \
-   { head -5 /tmp/gsd-review-antigravity-{phase}.md | grep -q 'REVIEWED-WITHOUT-REPO-ACCESS' || \
-     grep -qiE '(workspace|working) (directory|dir).{0,40}antigravity-cli/scratch' /tmp/gsd-review-antigravity-{phase}.md; }; then
-  {
-    echo "> [reviewed-without-repo-access] This reviewer ran without visibility into the repo under review — down-weight its verdict in the Consensus Summary."
-    echo ""
-    cat /tmp/gsd-review-antigravity-{phase}.md
-  } > /tmp/gsd-review-antigravity-{phase}.md.tmp && \
-  mv /tmp/gsd-review-antigravity-{phase}.md.tmp /tmp/gsd-review-antigravity-{phase}.md
-fi
-```
-
-**Ollama (local, OpenAI-compatible):**
-
-Read host and model from config. All three local backends share the same `/v1/chat/completions` endpoint — only host and model differ. Use `jq --rawfile` to safely encode the multi-line prompt as JSON without shell-escaping issues.
+Every reviewer lane is **declared data** (ADR-2782). This step iterates the lanes the selection
+resolved; it does not enumerate them. Adding a reviewer is a capability manifest, not an edit here.
+
+**Do not re-add a per-CLI block.** A `<!-- reviewer-lane: … -->` marker anywhere in this step now
+FAILS the parity gate (`checkReviewerLaneParity` → `bespoke_leg_present`). Lane divergence is
+declared in the manifest — timeout floor, probe, prompt/output channel, empty-output policy — and
+behaviour that data genuinely cannot express is a named first-party `handler` (ADR-2782 D6), never
+a bespoke block here.
+
+**Timeout guidance (#2194):** prompt-fed source-grounded reviews are slow — measured ~570 s for
+Codex at `xhigh` effort and ~525 s for headless Claude on a large plan set. Each lane declares its
+own `timeoutFloorMs` and the runner enforces it internally, but the **Bash tool call wrapping the
+loop below must still be given a high `timeout:`** — at least `900000`, and `1200000` when Codex or
+headless Claude are in the selection — or the host kills the whole loop mid-lane. On Claude Code,
+raise the host cap via `BASH_MAX_TIMEOUT_MS` if a review can exceed it.
+
+A silent empty output after a long run is a **timeout kill, not a crash** — the Codex `0xc0000142`
+misdiagnosis persisted for exactly this reason, because an empty result cannot distinguish the two
+on its own. Treat an empty result on a slow lane as a dropped lane and re-run with more time rather
+than diagnosing a CLI or sandbox failure. A cross-AI review that silently drops a lane is blind in
+one eye.
+
+**No hook-trust bypass (#2479):** no lane passes a hook-trust bypass flag and none runs a capability
+probe for one. That flag only bypasses *persisted* hook trust (a first-run condition) and flagless
+invocations work in steady state, while host-harness safety classifiers deny commands carrying it.
+An environment that genuinely hits an untrusted-hook prompt surfaces through the `.err` capture and
+the empty-output stub as a dropped lane with diagnosable stderr, not silent attrition. Do not
+reintroduce the flag (even spelled out in prose — a regression test bans the literal file-wide).
+
+**Reviewer instances (#1517, optional):** instances resolve *through* a lane and are not lanes
+themselves (ADR-2782 D8). Each selected instance invokes its base `cli` with its own `model`/`agent`
+as opaque argv. Exact invocation in `gsd-core/references/reviewer-instances.md`.
+
+Lanes run **sequentially, not in parallel** — concurrent invocation trips provider rate limits.
 
 ```bash
-# Shared helper: apply prompt-budget trimming for local reviewers
+RUN_DIR="{run_dir}"
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+# SELECTED_REVIEWERS is the comma-separated result of reviewer selection (ADR-0011 precedence:
+# explicit flags > --all > review.default_reviewers > all detected). Unchanged by this phase.
+
+# Shared budget-trim helper. Was defined inside the Ollama leg; it is lane-agnostic, so it is
+# hoisted here now that any lane may declare a promptBudgetKey. Returns non-zero when the budget
+# is too small for the minimum review set (prompt-budget exit 2 / 11).
 prepare_trimmed_prompt_for_reviewer() {
-  REVIEWER_KEY="$1"
-  REVIEWER_BUDGET="$2"
-  OUTPUT_PROMPT="$3"
-  OUTPUT_META="$4"
-
-  [ -z "$REVIEWER_BUDGET" ] && return 0
-  [ "$REVIEWER_BUDGET" = "null" ] && return 0
-  [ "$REVIEWER_BUDGET" = "0" ] && return 0
+  REVIEWER_KEY="$1"; REVIEWER_BUDGET="$2"; OUTPUT_PROMPT="$3"; OUTPUT_META="$4"
 
   PLAN_FILE_ARGS=""
-  for p in /tmp/gsd-review-{phase}-plan-*.md; do
+  for p in "$RUN_DIR"/gsd-review-plan-*.md; do
     [ -f "$p" ] && PLAN_FILE_ARGS="$PLAN_FILE_ARGS --plan-file $p"
   done
   PROJECT_ARG=""
-  [ -f "/tmp/gsd-review-{phase}-project.md" ] && PROJECT_ARG="--project-file /tmp/gsd-review-{phase}-project.md"
+  [ -f "$RUN_DIR/gsd-review-project.md" ] && PROJECT_ARG="--project-file $RUN_DIR/gsd-review-project.md"
   CONTEXT_ARG=""
-  [ -f "/tmp/gsd-review-{phase}-context.md" ] && CONTEXT_ARG="--context-file /tmp/gsd-review-{phase}-context.md"
+  [ -f "$RUN_DIR/gsd-review-context.md" ] && CONTEXT_ARG="--context-file $RUN_DIR/gsd-review-context.md"
   RESEARCH_ARG=""
-  [ -f "/tmp/gsd-review-{phase}-research.md" ] && RESEARCH_ARG="--research-file /tmp/gsd-review-{phase}-research.md"
+  [ -f "$RUN_DIR/gsd-review-research.md" ] && RESEARCH_ARG="--research-file $RUN_DIR/gsd-review-research.md"
   REQUIREMENTS_ARG=""
-  [ -f "/tmp/gsd-review-{phase}-requirements.md" ] && REQUIREMENTS_ARG="--requirements-file /tmp/gsd-review-{phase}-requirements.md"
+  [ -f "$RUN_DIR/gsd-review-requirements.md" ] && REQUIREMENTS_ARG="--requirements-file $RUN_DIR/gsd-review-requirements.md"
 
   gsd_run query prompt-budget \
     --budget "$REVIEWER_BUDGET" \
-    --instructions-file "/tmp/gsd-review-{phase}-instructions.md" \
-    --roadmap-file "/tmp/gsd-review-{phase}-roadmap.md" \
+    --instructions-file "$RUN_DIR/gsd-review-instructions.md" \
+    --roadmap-file "$RUN_DIR/gsd-review-roadmap.md" \
     $PLAN_FILE_ARGS $PROJECT_ARG $CONTEXT_ARG $RESEARCH_ARG $REQUIREMENTS_ARG \
     --output-prompt "$OUTPUT_PROMPT" \
     --output-metadata "$OUTPUT_META"
   return $?
 }
 
-# Resolve prompt budget for Ollama: per-reviewer override > global default > null
-OLLAMA_REVIEWER_BUDGET=$(gsd_run query config-get review.max_prompt_tokens_per_reviewer.ollama 2>/dev/null | jq -r '.' 2>/dev/null || echo "null")
-if [ -z "$OLLAMA_REVIEWER_BUDGET" ] || [ "$OLLAMA_REVIEWER_BUDGET" = "null" ]; then
-  OLLAMA_REVIEWER_BUDGET=$(gsd_run query config-get review.max_prompt_tokens 2>/dev/null | jq -r '.' 2>/dev/null || echo "null")
-fi
-
-# Apply budget trim for Ollama if a budget is configured
-OLLAMA_PROMPT_FILE="/tmp/gsd-review-prompt-{phase}.md"
-OLLAMA_SKIP=0
-if [ -n "$OLLAMA_REVIEWER_BUDGET" ] && [ "$OLLAMA_REVIEWER_BUDGET" != "null" ] && [ "$OLLAMA_REVIEWER_BUDGET" != "0" ]; then
-  OLLAMA_TRIMMED_PROMPT="/tmp/gsd-review-prompt-{phase}-ollama.md"
-  OLLAMA_TRIM_META="/tmp/gsd-review-prompt-{phase}-ollama.metadata.json"
-  prepare_trimmed_prompt_for_reviewer "ollama" "$OLLAMA_REVIEWER_BUDGET" "$OLLAMA_TRIMMED_PROMPT" "$OLLAMA_TRIM_META"
-  OLLAMA_EXIT=$?
-  if [ $OLLAMA_EXIT -ne 0 ]; then
-    if [ $OLLAMA_EXIT -eq 2 ] || [ $OLLAMA_EXIT -eq 11 ]; then
-      echo "WARNING: prompt budget for ollama (${OLLAMA_REVIEWER_BUDGET} tokens) is too small for the minimum review set. Skipping Ollama reviewer." >&2
-    else
-      echo "WARNING: prompt-budget returned unexpected exit code ${OLLAMA_EXIT} for ollama. Skipping Ollama reviewer." >&2
-    fi
-    OLLAMA_SKIP=1
-  else
-    OLLAMA_PROMPT_FILE="$OLLAMA_TRIMMED_PROMPT"
-  fi
-fi
-
-if [ "$OLLAMA_SKIP" != "1" ]; then
-OLLAMA_HOST=$(gsd_run query config-get review.ollama_host 2>/dev/null | jq -r '.' 2>/dev/null || echo "")
-if [ -z "$OLLAMA_HOST" ] || [ "$OLLAMA_HOST" = "null" ]; then OLLAMA_HOST="http://localhost:11434"; fi
-OLLAMA_MODEL=$(gsd_run query config-get review.models.ollama 2>/dev/null | jq -r '.' 2>/dev/null || echo "")
-if [ -z "$OLLAMA_MODEL" ] || [ "$OLLAMA_MODEL" = "null" ]; then
-  OLLAMA_MODEL=$(curl -s --max-time 2 "${OLLAMA_HOST}/v1/models" 2>/dev/null | jq -r '.data[0].id // "llama3"' 2>/dev/null || echo "llama3")
-fi
-jq -n --rawfile content "$OLLAMA_PROMPT_FILE" \
-  --arg model "$OLLAMA_MODEL" \
-  '{model: $model, messages: [{role: "user", content: $content}]}' | \
-  curl -s --max-time 120 -X POST "${OLLAMA_HOST}/v1/chat/completions" \
-    -H "Content-Type: application/json" -d @- 2>/dev/null | \
-  jq -r '.choices[0].message.content // "Ollama review failed or returned empty output."' \
-  > /tmp/gsd-review-ollama-{phase}.md
-if [ ! -s /tmp/gsd-review-ollama-{phase}.md ]; then
-  echo "Ollama review failed or returned empty output." > /tmp/gsd-review-ollama-{phase}.md
-fi
-fi
-```
-
-**LM Studio (local, OpenAI-compatible):**
-```bash
-# Resolve prompt budget for LM Studio: per-reviewer override > global default > null
-LM_STUDIO_REVIEWER_BUDGET=$(gsd_run query config-get review.max_prompt_tokens_per_reviewer.lm_studio 2>/dev/null | jq -r '.' 2>/dev/null || echo "null")
-if [ -z "$LM_STUDIO_REVIEWER_BUDGET" ] || [ "$LM_STUDIO_REVIEWER_BUDGET" = "null" ]; then
-  LM_STUDIO_REVIEWER_BUDGET=$(gsd_run query config-get review.max_prompt_tokens 2>/dev/null | jq -r '.' 2>/dev/null || echo "null")
-fi
-
-# Apply budget trim for LM Studio if a budget is configured
-LM_STUDIO_PROMPT_FILE="/tmp/gsd-review-prompt-{phase}.md"
-LM_STUDIO_SKIP=0
-if [ -n "$LM_STUDIO_REVIEWER_BUDGET" ] && [ "$LM_STUDIO_REVIEWER_BUDGET" != "null" ] && [ "$LM_STUDIO_REVIEWER_BUDGET" != "0" ]; then
-  LM_STUDIO_TRIMMED_PROMPT="/tmp/gsd-review-prompt-{phase}-lm_studio.md"
-  LM_STUDIO_TRIM_META="/tmp/gsd-review-prompt-{phase}-lm_studio.metadata.json"
-  prepare_trimmed_prompt_for_reviewer "lm_studio" "$LM_STUDIO_REVIEWER_BUDGET" "$LM_STUDIO_TRIMMED_PROMPT" "$LM_STUDIO_TRIM_META"
-  LM_STUDIO_EXIT=$?
-  if [ $LM_STUDIO_EXIT -ne 0 ]; then
-    if [ $LM_STUDIO_EXIT -eq 2 ] || [ $LM_STUDIO_EXIT -eq 11 ]; then
-      echo "WARNING: prompt budget for lm_studio (${LM_STUDIO_REVIEWER_BUDGET} tokens) is too small for the minimum review set. Skipping LM Studio reviewer." >&2
+gsd_run query review-lane plan \
+  --selected "$SELECTED_REVIEWERS" --run-dir "$RUN_DIR" --repo-root "$REPO_ROOT" --json \
+  > "$RUN_DIR/gsd-review-lanes.json"
+
+for SLUG in $(echo "$SELECTED_REVIEWERS" | tr ',' ' '); do
+  # Per-lane prompt budget. The lane declares its own `promptBudgetKey`; `plan` resolved it,
+  # applying #2797's sentinel rule (-1 = unset → fall back to the global budget; 0 legitimately
+  # means "do not trim this lane"). Trimming itself stays in prompt-budget, which owns it.
+  LANE_BUDGET=$(gsd_run query review-lane plan --selected "$SLUG" --run-dir "$RUN_DIR" \
+                  --repo-root "$REPO_ROOT" --json 2>/dev/null \
+                | sed -n 's/.*"promptBudget": *\([0-9-]*\).*/\1/p' | head -1)
+  PROMPT_ARG=""
+  if [ -n "$LANE_BUDGET" ] && [ "$LANE_BUDGET" != "null" ] && [ "$LANE_BUDGET" -gt 0 ] 2>/dev/null; then
+    TRIMMED="$RUN_DIR/gsd-review-prompt-$SLUG.md"
+    if prepare_trimmed_prompt_for_reviewer "$SLUG" "$LANE_BUDGET" "$TRIMMED" \
+         "$RUN_DIR/gsd-review-prompt-$SLUG.metadata.json"; then
+      PROMPT_ARG="--prompt-file $TRIMMED"
     else
-      echo "WARNING: prompt-budget returned unexpected exit code ${LM_STUDIO_EXIT} for lm_studio. Skipping LM Studio reviewer." >&2
+      # A budget too small for the minimum review set drops the lane just as silently as an empty
+      # response used to (#2605), so leave the skip visible in the review output, not only on stderr.
+      echo "$SLUG review skipped: prompt budget (${LANE_BUDGET} tokens) too small for the minimum review set." \
+        > "$RUN_DIR/gsd-review-$SLUG.md"
+      continue
     fi
-    LM_STUDIO_SKIP=1
-  else
-    LM_STUDIO_PROMPT_FILE="$LM_STUDIO_TRIMMED_PROMPT"
   fi
-fi
 
-if [ "$LM_STUDIO_SKIP" != "1" ]; then
-LM_STUDIO_HOST=$(gsd_run query config-get review.lm_studio_host 2>/dev/null | jq -r '.' 2>/dev/null || echo "")
-if [ -z "$LM_STUDIO_HOST" ] || [ "$LM_STUDIO_HOST" = "null" ]; then LM_STUDIO_HOST="http://localhost:1234"; fi
-LM_STUDIO_MODEL=$(gsd_run query config-get review.models.lm_studio 2>/dev/null | jq -r '.' 2>/dev/null || echo "")
-if [ -z "$LM_STUDIO_MODEL" ] || [ "$LM_STUDIO_MODEL" = "null" ]; then
-  LM_STUDIO_MODEL=$(curl -s --max-time 2 "${LM_STUDIO_HOST}/v1/models" 2>/dev/null | jq -r '.data[0].id // "local-model"' 2>/dev/null || echo "local-model")
-fi
-LM_STUDIO_RESPONSE=$(jq -n --rawfile content "$LM_STUDIO_PROMPT_FILE" \
-  --arg model "$LM_STUDIO_MODEL" \
-  '{model: $model, messages: [{role: "user", content: $content}]}' | \
-  curl -s --max-time 120 -X POST "${LM_STUDIO_HOST}/v1/chat/completions" \
-    -H "Content-Type: application/json" -d @- 2>/dev/null)
-LM_STUDIO_ACTUAL_MODEL=$(echo "$LM_STUDIO_RESPONSE" | jq -r '.model // ""' 2>/dev/null || echo "")
-if [ -n "$LM_STUDIO_ACTUAL_MODEL" ] && [ "$LM_STUDIO_ACTUAL_MODEL" != "null" ] && [ "$LM_STUDIO_ACTUAL_MODEL" != "$LM_STUDIO_MODEL" ]; then
-  echo "Warning: LM Studio served model '$LM_STUDIO_ACTUAL_MODEL' but '$LM_STUDIO_MODEL' was requested. Review may be from a different model." >&2
-fi
-LM_STUDIO_CONTENT=$(echo "$LM_STUDIO_RESPONSE" | jq -r '.choices[0].message.content // ""' 2>/dev/null || echo "")
-if [ -n "$LM_STUDIO_CONTENT" ]; then
-  echo "$LM_STUDIO_CONTENT" > /tmp/gsd-review-lm_studio-{phase}.md
-else
-  echo "Warning: LM Studio returned empty content — skipping review." >&2
-fi
-fi
+  # One invocation, whatever the lane's transport, prompt channel, output channel or handler.
+  # `--explicit` marks a lane the user NAMED: ADR-2782 D4 — not finding a lane nobody asked for is
+  # normal, failing to run one somebody asked for is an error.
+  gsd_run query review-lane invoke --slug "$SLUG" \
+    --run-dir "$RUN_DIR" --repo-root "$REPO_ROOT" $PROMPT_ARG $EXPLICIT_FLAG --json \
+    >> "$RUN_DIR/gsd-review-lane-results.jsonl"
+done
 ```
 
-**llama.cpp (local, OpenAI-compatible):**
-```bash
-# Resolve prompt budget for llama.cpp: per-reviewer override > global default > null
-LLAMA_CPP_REVIEWER_BUDGET=$(gsd_run query config-get review.max_prompt_tokens_per_reviewer.llama_cpp 2>/dev/null | jq -r '.' 2>/dev/null || echo "null")
-if [ -z "$LLAMA_CPP_REVIEWER_BUDGET" ] || [ "$LLAMA_CPP_REVIEWER_BUDGET" = "null" ]; then
-  LLAMA_CPP_REVIEWER_BUDGET=$(gsd_run query config-get review.max_prompt_tokens 2>/dev/null | jq -r '.' 2>/dev/null || echo "null")
-fi
+Each lane leaves `{run_dir}/gsd-review-<slug>.md` — its review, or a diagnostic stub carrying the
+captured stderr (and, for an OpenAI-compatible lane, the raw response body, where such a server puts
+its error JSON on an HTTP 4xx/5xx while still exiting 0). A stub is never mistaken for a clean
+review: it keeps its "failed or returned empty output" header (#2494/#2605/#2794).
 
-# Apply budget trim for llama.cpp if a budget is configured
-LLAMA_CPP_PROMPT_FILE="/tmp/gsd-review-prompt-{phase}.md"
-LLAMA_CPP_SKIP=0
-if [ -n "$LLAMA_CPP_REVIEWER_BUDGET" ] && [ "$LLAMA_CPP_REVIEWER_BUDGET" != "null" ] && [ "$LLAMA_CPP_REVIEWER_BUDGET" != "0" ]; then
-  LLAMA_CPP_TRIMMED_PROMPT="/tmp/gsd-review-prompt-{phase}-llama_cpp.md"
-  LLAMA_CPP_TRIM_META="/tmp/gsd-review-prompt-{phase}-llama_cpp.metadata.json"
-  prepare_trimmed_prompt_for_reviewer "llama_cpp" "$LLAMA_CPP_REVIEWER_BUDGET" "$LLAMA_CPP_TRIMMED_PROMPT" "$LLAMA_CPP_TRIM_META"
-  LLAMA_CPP_EXIT=$?
-  if [ $LLAMA_CPP_EXIT -ne 0 ]; then
-    if [ $LLAMA_CPP_EXIT -eq 2 ] || [ $LLAMA_CPP_EXIT -eq 11 ]; then
-      echo "WARNING: prompt budget for llama_cpp (${LLAMA_CPP_REVIEWER_BUDGET} tokens) is too small for the minimum review set. Skipping llama.cpp reviewer." >&2
-    else
-      echo "WARNING: prompt-budget returned unexpected exit code ${LLAMA_CPP_EXIT} for llama_cpp. Skipping llama.cpp reviewer." >&2
-    fi
-    LLAMA_CPP_SKIP=1
-  else
-    LLAMA_CPP_PROMPT_FILE="$LLAMA_CPP_TRIMMED_PROMPT"
-  fi
-fi
-
-if [ "$LLAMA_CPP_SKIP" != "1" ]; then
-LLAMA_CPP_HOST=$(gsd_run query config-get review.llama_cpp_host 2>/dev/null | jq -r '.' 2>/dev/null || echo "")
-if [ -z "$LLAMA_CPP_HOST" ] || [ "$LLAMA_CPP_HOST" = "null" ]; then LLAMA_CPP_HOST="http://localhost:8080"; fi
-LLAMA_CPP_MODEL=$(gsd_run query config-get review.models.llama_cpp 2>/dev/null | jq -r '.' 2>/dev/null || echo "")
-if [ -z "$LLAMA_CPP_MODEL" ] || [ "$LLAMA_CPP_MODEL" = "null" ]; then
-  LLAMA_CPP_MODEL=$(curl -s --max-time 2 "${LLAMA_CPP_HOST}/v1/models" 2>/dev/null | jq -r '.data[0].id // "local-model"' 2>/dev/null || echo "local-model")
-fi
-LLAMA_CPP_CONTENT=$(jq -n --rawfile content "$LLAMA_CPP_PROMPT_FILE" \
-  --arg model "$LLAMA_CPP_MODEL" \
-  '{model: $model, messages: [{role: "user", content: $content}]}' | \
-  curl -s --max-time 120 -X POST "${LLAMA_CPP_HOST}/v1/chat/completions" \
-    -H "Content-Type: application/json" -d @- 2>/dev/null | \
-  jq -r '.choices[0].message.content // ""' 2>/dev/null || echo "")
-if [ -n "$LLAMA_CPP_CONTENT" ]; then
-  echo "$LLAMA_CPP_CONTENT" > /tmp/gsd-review-llama_cpp-{phase}.md
-else
-  echo "Warning: llama.cpp returned empty content — skipping review." >&2
-fi
-fi
-```
-
-If a CLI or local server fails, log the error and continue with remaining reviewers.
+A lane that will not run reports a typed reason rather than an empty file — `missing_binary`,
+`probe_failed`, `probe_timeout`, `missing_required_binary`, `host_unreachable`,
+`egress_host_changed`, `unknown_handler`, `budget_too_small`. **`egress_host_changed` means the lane
+was consented to send plans to one destination and `.planning/config.json` now names another; it is
+blocked, not silently redirected** (ADR-2782 D5).
 
 Display progress:
 ```
@@ -794,83 +434,26 @@ trimmed_reviewers:        # only present if at least one reviewer was trimmed
 
 # Cross-AI Plan Review — Phase {N}
 
-## Gemini Review
-
-{gemini review content}
-
----
-
-## Claude Review
-
-{claude review content}
-
----
-
-## Codex Review
-
-{codex review content}
-
----
-
-## CodeRabbit Review
-
-{coderabbit review content}
-
----
-
-## OpenCode Review
-
-{opencode review content}
-
----
-
-## OpenCode Review (opencode-deepseek)
-
-{opencode-deepseek instance review content — only present when this instance was selected}
-
----
-
-## OpenCode Review (opencode-mimo)
-
-{opencode-mimo instance review content — only present when this instance was selected}
-
----
-
-## Qwen Review
+<!-- Sections are RENDERED from each lane's declared `reviewsSection`, in descriptor order.
+     There is deliberately no hardcoded per-reviewer heading list here any more: a hand-maintained
+     list is exactly the drift #2781 was filed about, and it silently disagreed with the roster.
+     `gsd_run query review-lane sections --selected "$SELECTED_REVIEWERS"` emits
+     `<slug><TAB><reviewsSection>` in order; for each row, emit:
 
-{qwen review content}
+         ## <reviewsSection> Review
 
----
-
-## Cursor Review
-
-{cursor review content}
-
----
-
-## Antigravity Review
+         {contents of {run_dir}/gsd-review-<slug>.md}
 
-{antigravity review content}
+         ---
 
----
-
-## Ollama Review
-
-{ollama review content}
-
----
+     Two headings must NOT be generated from this list, because they are not lanes:
+       * `## <Adapter> Review (<instance>)` — an ADR-1517 reviewer INSTANCE resolves THROUGH a lane
+         and is rendered from the instance list, not the lane list (ADR-2782 D8).
+       * `## Consensus Summary` — not a review section at all.
 
-## LM Studio Review
-
-{lm_studio review content}
-
----
-
-## llama.cpp Review
-
-{llama_cpp review content}
-
----
+     A lane whose `evidenceClass` is `diff-only` (CodeRabbit) carries its caveat from data: it never
+     received the source-grounding prompt, so its verdict is folded in as a diff observation and is
+     not weighted as a grounded plan review. -->
 
 ## Consensus Summary
 
@@ -911,7 +494,11 @@ To incorporate feedback into planning:
   /gsd:plan-phase {N} --reviews
 ```
 
-Clean up temp files.
+Clean up — remove the run's temp directory now that REVIEWS.md is committed:
+
+```bash
+rm -rf "{run_dir}"
+```
 </step>
 
 </process>