@orion-agents/orion-code 0.3.25 → 0.3.27

package/CHANGELOG.md

@@ -22,15 +22,80 @@ which is **not** a pass.
 
 ## [Unreleased]
 
-## [0.3.25] — UNRELEASED
-
-> **Status: candidate.** Open. Four open-issue fixes: the Git conflict view reads the
-> edited working file from the filesystem instead of an unstored object (#269), file
-> history walks the requested revision instead of always HEAD (#270), model switching
-> gates the compact preflight on effective input budgets instead of raw context windows
-> (#271), and the left project navigation keeps a stable registration order when
-> sessions are activated (#272). Plan: `docs/plan/v0.3.25-plan.md`. Not merged, tagged
-> or published.
+## [0.3.27] — UNRELEASED
+
+> **Status: candidate.** Open. First slice of the professional code review loop
+> (plan: `docs/plan/v0.3.27-plan.md`): the shared review contract (selectors,
+> states, conclusions, findings, tighten-only budgets, receipt digests,
+> stale-applicability) is frozen in `src/services/code-review` and bound by
+> contract tests; the shared Git snapshot reader captures worktree (staged /
+> unstaged / untracked, separate sources) and base (frozen merge-base..HEAD
+> OIDs, rename tracking) scopes with typed scope errors; and the read-only
+> workflow constraints deny every non-read tool by default with a dispatch-level
+> guard whose digest binds receipts. Runtime / CLI wiring (PR2), the Web loop
+> (PR3) and the qualification benchmark (PR4) are subsequent slices of the same
+> plan and are not part of this release. Not merged, tagged or published.
+
+### Added
+
+- #277-plan PR0: `src/services/code-review/contract.ts` — the shared review
+  contract with the plan §4.1 conclusion mapping (a partial, failed, cancelled
+  or untrustworthy review can never surface as a green "no findings"),
+  tighten-only budgets from plan §4.3, finding validation, receipt digests
+  verified by recomputation, and stale-applicability annotation that never
+  rewrites history. Twelve contract tests pin the semantics.
+- PR0: the human-annotation review-quality benchmark set (12 defect + 8 clean
+  samples across TypeScript/JavaScript/Python with content digests, expected
+  triggers, allowed locations and frozen scoring thresholds), awaiting
+  per-sample human sign-off before any paid model run (plan §9.3).
+- PR1: `src/services/code-review/snapshot.ts` — the shared Git snapshot reader:
+  worktree scope records staged (index OIDs), unstaged (working content with
+  before/after digest re-checks) and untracked changes as separate sources;
+  base scope freezes ref/HEAD/merge-base into immutable OIDs with rename
+  tracking and typed `ref_unresolved` / `no_merge_base` errors; sensitive and
+  binary entries are skipped without being read; tightened budgets skip the
+  excess with typed reasons; the contained worktree reader refuses to leave the
+  repository root.
+- PR1: `src/services/code-review/constraints.ts` — deny-by-default read-only
+  workflow constraints (only `read_file`, `list_files`, `glob`, `grep` pass the
+  dispatch-level guard) with a frozen digest that receipts bind.
+
+## [0.3.26] — 2026-10-17
+
+> **Status: published.** Released as `@orion-agents/orion-code@0.3.26` from
+> `refs/tags/v0.3.26`, and merged to `main` as `b810996` (#278). Structured-diff
+> integrity and Session lifecycle: header-lookalike body rows stay body rows
+> (#274), hunks split across pagination keep their rows, line numbers and
+> identity (#275), permanent Session deletion removes the v2 Thread records
+> (#276), and exiting a cutover Session no longer rewrites its summary from the
+> frozen legacy JSONL (#277). Plan: `docs/plan/v0.3.26-plan.md`. GitHub Release:
+> https://github.com/orion-agents/orion-code/releases/tag/v0.3.26
+
+### Fixed
+
+- #274: a deletion row whose text starts with `-- ` (`--- old comment`) is no longer
+  mistaken for the old-file header; the hunk stays open and the remaining body is
+  no longer demoted to document metadata.
+- #275: the structured diff continuation contract carries the split hunk's state
+  (header, index, running line cursors) in the cursor, so every page of a large
+  hunk keeps its rows with correct line numbers and the stable hunk identity, and
+  the last page reports the true completeness.
+- #276: permanently deleting a cutover Session removes its v2 records — cutover
+  index entry, event log, head, projection, compact state and checkpoints,
+  session-index manifest, transcript pages and import receipt — under the same
+  file-lock and atomic-write discipline as the cutover itself.
+- #277: `/exit` (and the shutdown path) no longer rewrites a cutover Session's
+  `messageCount`/`historySizeBytes` from the frozen legacy JSONL; the summary comes
+  from the authoritative v2 Thread.
+
+## [0.3.25] — 2026-10-13
+
+> **Status: published.** Released as `@orion-agents/orion-code@0.3.25` from
+> `refs/tags/v0.3.25`, and merged to `main` as `c356323` (#273). Four open-issue fixes
+> for the Git conflict view (#269), file-history revisions (#270), the model-switch
+> compact preflight (#271) and the stable project navigation order (#272). Plan:
+> `docs/plan/v0.3.25-plan.md`. GitHub Release:
+> https://github.com/orion-agents/orion-code/releases/tag/v0.3.25
 
 ### Fixed
 

package/README.md

@@ -2,12 +2,14 @@
 
 Local-first, goal-driven coding agent for the terminal and browser.
 
-> v0.3.25 candidate — open. Four open-issue fixes: the Git conflict view reads the edited
-> working file from the filesystem (#269), file history walks the requested revision
-> (#270), model switching gates the compact preflight on effective input budgets (#271),
-> and the left project navigation keeps a stable registration order (#272). The previous
-> release 0.3.24 is on npm (registry `latest`), tagged `v0.3.24` (`85fadb4`, #268) and
-> released on GitHub.
+> v0.3.27 candidate — open. First slice of the professional code review loop: the
+> shared review contract (selectors, states, conclusions, findings, tighten-only
+> budgets, receipt digests, stale-applicability) is frozen and contract-tested,
+> the shared Git snapshot reader captures worktree and frozen-base scopes with
+> typed errors, and the read-only workflow constraints deny every non-read tool
+> by default. Runtime/CLI wiring, the Web loop and the qualification benchmark
+> are subsequent slices of the same plan. The previous release 0.3.26 is on npm
+> (registry `latest`), tagged `v0.3.26` (`b810996`, #278) and released on GitHub.
 
 [中文说明](README.zh-CN.md) ·
 [v0.3.24 plan](docs/plan/v0.3.24-plan.md) ·
@@ -170,10 +172,10 @@ user extension boundaries.
 Node.js 22.12+, 24, and 26 are supported. Use Node 24 LTS for production or Node 26 Current for
 current development environments. Node 20 is upstream EOL and is no longer a v0.3 runtime.
 
-To install the pinned v0.3.25 package when it is available on npm:
+To install the pinned v0.3.27 package when it is available on npm:
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.25
+npm install -g @orion-agents/orion-code@0.3.27
 orion --version
 orion doctor
 ```

package/README.zh-CN.md

@@ -2,10 +2,11 @@
 
 面向终端与浏览器、本地优先的目标驱动 Coding Agent。
 
-> v0.3.25 候选版本：进行中。四个开放 issue 修复：Git 冲突视图从文件系统读取已编辑的
-> 工作区文件（#269）、文件历史按请求的 revision 遍历（#270）、模型切换按有效输入预算
-> 触发压缩预检（#271）、左侧项目导航保持稳定注册序（#272）。上一版 0.3.24 已发布 npm
-> （registry `latest`）、打 tag `v0.3.24`（`85fadb4`，#268）并发布 GitHub Release。
+> v0.3.27 候选版本：进行中。专业代码审查闭环首切片：共享审查契约（selector、状态、结论、
+> finding、只收紧预算、receipt digest、stale 标注）已冻结并通过契约测试；共享 Git snapshot
+> reader 捕获 worktree 与冻结 base 两种范围并给出类型化错误；只读 workflow 约束默认拒绝一切
+> 非读取工具。Runtime/CLI 接线、Web 闭环与资格验证为同一计划的后续切片。上一版 0.3.26 已发布
+> npm（registry `latest`）、打 tag `v0.3.26`（`b810996`，#278）并发布 GitHub Release。
 
 [English](README.md) ·
 [v0.3.24 方案](docs/plan/v0.3.24-plan.md) ·
@@ -100,10 +101,10 @@ MCP 仍是用户可见的扩展边界。
 支持 Node.js 22.12+、24 和 26。生产环境建议使用 Node 24 LTS，当前开发环境也支持 Node 26
 Current。Node 20 已结束上游维护，不再属于 v0.3 Runtime 合同。
 
-v0.3.25 在 npm 可用后，可安装固定版本：
+v0.3.27 在 npm 可用后，可安装固定版本：
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.25
+npm install -g @orion-agents/orion-code@0.3.27
 orion --version
 orion doctor
 ```

package/dist/runtime/legacy-thread-materializer.d.ts

@@ -102,4 +102,17 @@ export declare function openSessionCheckpointStorageV1(projectPathInput: string,
  */
 export declare function openSessionStorageV1(projectPathInput: string, sessionId: string): OpenedSessionStorageV1;
 export declare function loadThreadCutoverIndexV1(projectPath: string): ThreadCutoverIndexV1;
+/**
+ * v0.3.26 #276 — permanently removes one Session's durable v2 records: the
+ * cutover index entry plus every thread file the materializer and the event
+ * store publish (event log, projection, head, compact state and checkpoints,
+ * session-index manifest, transcript pages, import receipt). Returns the
+ * removed thread id, or null when the Session was never cut over.
+ *
+ * The index write takes the same file lock and atomic-write discipline as the
+ * cutover itself, with the generation bumped; an emptied index keeps its file
+ * with an empty session map so readers stay on the atomic authority instead of
+ * treating a missing file as "no v2 Sessions at all".
+ */
+export declare function deleteSessionThreadRecordsV1(projectPathInput: string, sessionId: string): string | null;
 //# sourceMappingURL=legacy-thread-materializer.d.ts.map

package/dist/runtime/legacy-thread-materializer.js

@@ -7,6 +7,7 @@ exports.resolveSessionStorageV1 = resolveSessionStorageV1;
 exports.openSessionCheckpointStorageV1 = openSessionCheckpointStorageV1;
 exports.openSessionStorageV1 = openSessionStorageV1;
 exports.loadThreadCutoverIndexV1 = loadThreadCutoverIndexV1;
+exports.deleteSessionThreadRecordsV1 = deleteSessionThreadRecordsV1;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const atomic_write_1 = require("../services/atomic-write");
@@ -205,6 +206,77 @@ function openSessionStorageV1(projectPathInput, sessionId) {
 function loadThreadCutoverIndexV1(projectPath) {
     return readThreadCutoverIndex((0, paths_1.getProjectThreadsV2IndexPath)((0, path_1.resolve)(projectPath)));
 }
+/**
+ * v0.3.26 #276 — permanently removes one Session's durable v2 records: the
+ * cutover index entry plus every thread file the materializer and the event
+ * store publish (event log, projection, head, compact state and checkpoints,
+ * session-index manifest, transcript pages, import receipt). Returns the
+ * removed thread id, or null when the Session was never cut over.
+ *
+ * The index write takes the same file lock and atomic-write discipline as the
+ * cutover itself, with the generation bumped; an emptied index keeps its file
+ * with an empty session map so readers stay on the atomic authority instead of
+ * treating a missing file as "no v2 Sessions at all".
+ */
+function deleteSessionThreadRecordsV1(projectPathInput, sessionId) {
+    const projectPath = (0, path_1.resolve)(projectPathInput);
+    const indexPath = (0, paths_1.getProjectThreadsV2IndexPath)(projectPath);
+    // A project that never cut a Session over has no index and no threads-v2
+    // directory; taking the lock would create one on a pure legacy deletion.
+    if (!(0, fs_1.existsSync)(indexPath))
+        return null;
+    const threadsDir = (0, paths_1.getProjectThreadsV2Dir)(projectPath);
+    return (0, file_lock_1.withFileLockSync)(indexPath, () => {
+        const current = readThreadCutoverIndex(indexPath);
+        const entry = current.sessions[sessionId];
+        if (!entry)
+            return null;
+        const sessions = { ...current.sessions };
+        delete sessions[sessionId];
+        const content = { version: 1, generation: current.generation + 1, sessions };
+        const next = deepFreeze({ ...content, digest: (0, canonical_1.digestRuntimeValue)(content) });
+        (0, atomic_write_1.atomicWriteFileSync)(indexPath, `${(0, canonical_1.canonicalRuntimeJson)(next)}\n`, {
+            mode: 0o600,
+            fsync: true,
+        });
+        removeThreadFiles(threadsDir, projectPath, entry.threadId);
+        return entry.threadId;
+    });
+}
+/** v0.3.26 #276 — removes every durable file of one thread. Best effort per
+ *  file: a missing artifact is already deleted, and an unlink failure must not
+ *  resurrect the cutover entry that was just removed. */
+function removeThreadFiles(threadsDir, projectPath, threadId) {
+    const files = [
+        (0, path_1.join)(threadsDir, `${threadId}.events.v1.jsonl`),
+        (0, path_1.join)(threadsDir, `${threadId}.projection.v1.json`),
+        (0, path_1.join)(threadsDir, `${threadId}.head.v1.json`),
+        (0, path_1.join)(threadsDir, `${threadId}.compact-state.v1.json`),
+        (0, path_1.join)(threadsDir, `${threadId}.session-index.v1.json`),
+        (0, paths_1.getProjectThreadV2ImportReceiptPath)(projectPath, threadId),
+    ];
+    for (const file of files) {
+        try {
+            if ((0, fs_1.existsSync)(file))
+                (0, fs_1.unlinkSync)(file);
+        }
+        catch {
+            // Durable leftovers are reported by the integrity checks, never by
+            // throwing here: the cutover entry removal is already committed.
+        }
+    }
+    for (const dir of [
+        (0, path_1.join)(threadsDir, `${threadId}.compact-checkpoints.v1`),
+        (0, path_1.join)(threadsDir, `${threadId}.transcript-pages.v1`),
+    ]) {
+        try {
+            (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+        }
+        catch {
+            // See above.
+        }
+    }
+}
 function buildMaterializedEvents(snapshot) {
     const receipt = snapshot.receipt;
     const pending = [

package/dist/services/code-review/constraints.d.ts

@@ -0,0 +1,25 @@
+/** Read-only tools the review turn may use. Only first-party core tools with
+ *  `readOnly: true` in their descriptors qualify (plan §5.1); `edit_file`,
+ *  `exec_command` and `write_file` are structurally excluded. */
+export declare const REVIEW_ALLOWED_TOOLS: ReadonlySet<string>;
+export interface ReviewWorkflowConstraintsV1 {
+    readonly schemaVersion: 1;
+    readonly workflow: 'code-review';
+    readonly allowedTools: readonly string[];
+    readonly constraintsDigest: string;
+    readonly policy: string;
+}
+/** The frozen constraint set with its digest. Receipts and capability
+ *  compilations bind this digest so a policy change invalidates old reviews'
+ *  rules provenance alongside the rules digest. */
+export declare const REVIEW_WORKFLOW_CONSTRAINTS: ReviewWorkflowConstraintsV1;
+export declare class ReviewToolPolicyError extends Error {
+    readonly code: 'review_tool_denied';
+    readonly toolName: string;
+    constructor(message: string, code: 'review_tool_denied', toolName: string);
+}
+/** Dispatch-level re-validation. Called on every tool invocation of a review
+ *  turn — direct calls, batch calls, aliases and steering all funnel through
+ *  here before the gateway executes anything. */
+export declare function assertReviewToolAllowed(toolName: string): void;
+//# sourceMappingURL=constraints.d.ts.map

package/dist/services/code-review/constraints.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReviewToolPolicyError = exports.REVIEW_WORKFLOW_CONSTRAINTS = exports.REVIEW_ALLOWED_TOOLS = void 0;
+exports.assertReviewToolAllowed = assertReviewToolAllowed;
+/**
+ * v0.3.27 PR1 — read-only workflow constraints for code review (plan §5.1).
+ *
+ * The review turn runs through the normal AgentLoop / ToolGateway, but under
+ * immutable workflow constraints: the model only sees bounded read/list/glob/
+ * grep capabilities, and every dispatch re-validates against this module so
+ * aliases, batch calls, steering or permission escalation (AUTO / ALLOW) can
+ * never widen the turn. The constraint set is deny-by-default: a tool that is
+ * not explicitly allowlisted is rejected, which covers long-tail tools, MCP,
+ * network, task derivation and future additions without maintaining a denylist.
+ *
+ * PR2 wires this guard into the review workflow's dispatch; PR1 ships the
+ * frozen model, its digest, and the negative tests.
+ */
+const canonical_1 = require("../../runtime/protocol/canonical");
+/** Read-only tools the review turn may use. Only first-party core tools with
+ *  `readOnly: true` in their descriptors qualify (plan §5.1); `edit_file`,
+ *  `exec_command` and `write_file` are structurally excluded. */
+exports.REVIEW_ALLOWED_TOOLS = new Set([
+    'read_file',
+    'list_files',
+    'glob',
+    'grep',
+]);
+const REVIEW_CONSTRAINT_CONTENT = Object.freeze({
+    schemaVersion: 1,
+    workflow: 'code-review',
+    mode: 'read-only',
+    allowedTools: [...exports.REVIEW_ALLOWED_TOOLS].sort(),
+    deniedByDefault: Object.freeze([
+        'exec_command',
+        'write_file',
+        'edit_file',
+        'git mutations',
+        'mcp',
+        'network tools',
+        'dynamic skills',
+        'task derivation',
+        'settings mutation',
+    ]),
+    /** Rationale text is part of the digest: changing the policy changes every
+     *  receipt that binds it. */
+    policy: 'The review turn may only inspect the frozen snapshot through the ' +
+        'allowlisted read tools. Permission escalation (AUTO / ALLOW) may tighten ' +
+        'or maintain but never widen this set. Test commands are not run: they ' +
+        'can write caches and mutate the workspace under review.',
+});
+/** The frozen constraint set with its digest. Receipts and capability
+ *  compilations bind this digest so a policy change invalidates old reviews'
+ *  rules provenance alongside the rules digest. */
+exports.REVIEW_WORKFLOW_CONSTRAINTS = Object.freeze({
+    schemaVersion: 1,
+    workflow: 'code-review',
+    allowedTools: REVIEW_CONSTRAINT_CONTENT.allowedTools,
+    constraintsDigest: (0, canonical_1.digestRuntimeValue)(REVIEW_CONSTRAINT_CONTENT),
+    policy: REVIEW_CONSTRAINT_CONTENT.policy,
+});
+class ReviewToolPolicyError extends Error {
+    constructor(message, code, toolName) {
+        super(message);
+        this.code = code;
+        this.toolName = toolName;
+        this.name = 'ReviewToolPolicyError';
+    }
+}
+exports.ReviewToolPolicyError = ReviewToolPolicyError;
+/** Dispatch-level re-validation. Called on every tool invocation of a review
+ *  turn — direct calls, batch calls, aliases and steering all funnel through
+ *  here before the gateway executes anything. */
+function assertReviewToolAllowed(toolName) {
+    if (!exports.REVIEW_ALLOWED_TOOLS.has(toolName)) {
+        throw new ReviewToolPolicyError(`Tool "${toolName}" is not available in a read-only code review turn.`, 'review_tool_denied', toolName);
+    }
+}
+//# sourceMappingURL=constraints.js.map

package/dist/services/code-review/contract.d.ts

@@ -0,0 +1,172 @@
+/** v0.3.27 §3.1 — what a review examines. Parsed once, frozen at admission. */
+export type ReviewSelectorV1 = {
+    readonly kind: 'worktree';
+    readonly paths?: readonly string[];
+} | {
+    readonly kind: 'base';
+    readonly ref: string;
+    readonly paths?: readonly string[];
+};
+/** v0.3.27 §4.1 — run states. `queued`/`running` never carry a conclusion. */
+export type ReviewRunStateV1 = 'queued' | 'running' | 'completed' | 'partial' | 'failed' | 'cancelled';
+/** v0.3.27 §4.1 — terminal conclusions. Absence can only be asserted when the
+ *  state is `completed`, coverage is complete and the output contained no
+ *  invalid findings; everything else maps to findings or inconclusive. */
+export type ReviewConclusionV1 = 'findings' | 'no_findings' | 'inconclusive';
+/** v0.3.27 §6.1 — a stored result's applicability after code or rules change.
+ *  History is never rewritten; staleness is an annotation, not an edit. */
+export type ReviewApplicabilityV1 = 'current' | 'stale';
+/** Priority levels. P0 requires evidence that the defect blocks usage without
+ *  special preconditions; the definition is frozen here and in PR0 tests. */
+export type ReviewFindingPriorityV1 = 'P0' | 'P1' | 'P2' | 'P3';
+/** v0.3.27 §4.1 — one review finding. `fileKey` is validated for shape here;
+ *  membership against the frozen snapshot manifest happens at Host validation
+ *  time (PR1+), never in the model's favor. */
+export interface ReviewFindingV1 {
+    readonly findingId: string;
+    readonly priority: ReviewFindingPriorityV1;
+    readonly title: string;
+    /** The condition under which the defect manifests — not a style opinion. */
+    readonly trigger: string;
+    readonly impact: string;
+    readonly fileKey: string;
+    readonly side: 'old' | 'new';
+    readonly startLine: number;
+    readonly endLine: number;
+    readonly evidence: string;
+}
+/** Coverage is evidence, not a count: what was actually inspected, what was
+ *  skipped and why, and where truncation or budget exhaustion occurred. */
+export interface ReviewCoverageV1 {
+    readonly inspectedFiles: readonly string[];
+    readonly inspectedRanges: readonly {
+        readonly fileKey: string;
+        readonly startLine: number;
+        readonly endLine: number;
+    }[];
+    readonly skipped: readonly {
+        readonly fileKey: string;
+        readonly reason: 'over_budget_files' | 'over_budget_bytes' | 'binary' | 'sensitive' | 'unreadable' | 'changed_during_review' | 'other';
+        readonly detail?: string;
+    }[];
+    readonly truncated: boolean;
+    readonly budgetExhausted: readonly string[];
+}
+/** Whether the declared coverage is internally consistent and complete for the
+ *  resolved selector — computed by the Host from the frozen manifest, never
+ *  taken from the model's self-report (§4.1). */
+export interface ReviewCoverageAssertionV1 {
+    readonly complete: boolean;
+    readonly reason?: string;
+}
+/** v0.3.27 §4.1 — the persisted receipt. `receiptDigest` covers the canonical
+ *  form of everything above it and is recomputed on read. */
+export interface CodeReviewResultV1 {
+    readonly schemaVersion: 1;
+    readonly reviewId: string;
+    readonly workspaceIdentity: string;
+    readonly sessionId: string;
+    readonly threadId: string;
+    readonly turnId: string;
+    readonly requestedSelector: ReviewSelectorV1;
+    /** The actually resolved target (commit OIDs, snapshot ids), not the request. */
+    readonly resolvedTarget: {
+        readonly kind: 'worktree' | 'base';
+        readonly baseOid?: string;
+        readonly headOid?: string;
+        readonly snapshotId: string;
+    };
+    /** Digest of the frozen input snapshot; a stored result is stale when this
+     *  no longer matches the current snapshot digest for the same selector. */
+    readonly inputSnapshotDigest: string;
+    readonly rulesDigest: string;
+    readonly state: ReviewRunStateV1;
+    readonly conclusion: ReviewConclusionV1;
+    readonly findings: readonly ReviewFindingV1[];
+    /** Findings that failed validation — counted and surfaced, never silently
+     *  dropped (dropping them must not turn the run into no_findings). */
+    readonly invalidFindingCount: number;
+    readonly coverage: ReviewCoverageV1;
+    readonly coverageAssertion: ReviewCoverageAssertionV1;
+    readonly limits: readonly string[];
+    readonly model: {
+        readonly provider: string;
+        readonly model: string;
+    };
+    readonly usage: {
+        readonly inputTokens: number;
+        readonly outputTokens: number;
+    };
+    readonly startedAt: number;
+    readonly endedAt: number;
+    readonly receiptDigest: string;
+}
+/** Budgets are ceilings that may only be tightened (§4.3): a provider with a
+ *  smaller window takes the stricter value; nothing may widen them at runtime. */
+export interface ReviewBudgetsV1 {
+    readonly maxFiles: number;
+    readonly maxBodyBytes: number;
+    readonly maxDiffBytes: number;
+    readonly maxReadToolCalls: number;
+    readonly maxDurationMs: number;
+    readonly maxFindings: number;
+    readonly maxResultBytes: number;
+}
+export declare const DEFAULT_REVIEW_BUDGETS: ReviewBudgetsV1;
+/** Text size caps for finding fields, in characters. Chosen so 100 maximal
+ *  findings stay well inside the 256 KiB result bound. */
+export declare const FINDING_TEXT_LIMITS: Readonly<{
+    title: 200;
+    trigger: 2000;
+    impact: 2000;
+    evidence: 4000;
+    fileKey: 1024;
+}>;
+/** Validates one model-produced finding against the frozen shape. Returns the
+ *  finding unchanged when valid; a typed reason when not. Membership against
+ *  the snapshot manifest is a separate Host check (PR1+). */
+export declare function validateReviewFinding(value: unknown): {
+    readonly valid: true;
+    readonly finding: ReviewFindingV1;
+} | {
+    readonly valid: false;
+    readonly reason: 'not_an_object' | 'finding_id_invalid' | 'priority_invalid' | 'title_invalid' | 'trigger_invalid' | 'impact_invalid' | 'file_key_invalid' | 'side_invalid' | 'line_range_invalid' | 'evidence_invalid';
+};
+/**
+ * v0.3.27 §4.1 — the conclusion mapping, frozen as code so CLI and Web cannot
+ * diverge. The invariants:
+ * - `queued`/`running` results carry no conclusion (callers must not call this).
+ * - A state that is not `completed` can never conclude `no_findings`.
+ * - Invalid findings make the output untrustworthy: zero valid findings with
+ *   invalid ones present is `inconclusive`, never a green pass.
+ * - Zero findings without complete coverage is `inconclusive`, never a green
+ *   pass ("不静默截断后宣布全部完成").
+ */
+export declare function resolveReviewConclusion(input: {
+    readonly state: ReviewRunStateV1;
+    readonly validFindingCount: number;
+    readonly invalidFindingCount: number;
+    readonly coverageComplete: boolean;
+}): ReviewConclusionV1;
+/** Applies the budgets with the tighten-only rule: every override must be a
+ *  safe integer at or below the frozen default, otherwise the run is refused
+ *  rather than silently widened. */
+export declare function resolveReviewBudgets(overrides?: Partial<ReviewBudgetsV1>): {
+    readonly ok: true;
+    readonly budgets: ReviewBudgetsV1;
+} | {
+    readonly ok: false;
+    readonly field: string;
+};
+/** Marks a stored result's applicability against the current input snapshot and
+ *  rules digests. The receipt itself is never rewritten. */
+export declare function reviewApplicability(result: Pick<CodeReviewResultV1, 'inputSnapshotDigest' | 'rulesDigest'>, current: {
+    readonly inputSnapshotDigest: string;
+    readonly rulesDigest: string;
+}): ReviewApplicabilityV1;
+/** The receipt digest covers the canonical form of the result with the digest
+ *  field itself excluded, so verification is a recomputation, not a lookup. */
+export declare function computeReceiptDigest(result: Omit<CodeReviewResultV1, 'receiptDigest'>): string;
+/** Verifies a stored receipt by recomputing its digest. */
+export declare function verifyReceiptDigest(result: CodeReviewResultV1): boolean;
+//# sourceMappingURL=contract.d.ts.map