@reviewsensei/cli-linux-x64-gnu 0.6.8 → 0.6.10

package/bin/_internal/review_sensei/schemas/convergence-sequence-report.schema.json

@@ -12,7 +12,6 @@
     "completed_verification_rounds",
     "handoffs",
     "no_progress_events",
-    "cap_created_approval",
     "limitations"
   ],
   "properties": {
@@ -22,8 +21,9 @@
       "enum": ["legacy", "advisory", "merge-focused", "strict"]
     },
     "steps": {
+      "description": "Replayed attempts. The bound is a storage ceiling, not a review-count admission limit; sequences past the former 32-round validation bound serialize normally.",
       "type": "array",
-      "maxItems": 32,
+      "maxItems": 1000000,
       "items": {
         "type": "object",
         "additionalProperties": false,
@@ -43,7 +43,6 @@
           "handoff_reason": {
             "type": ["string", "null"],
             "enum": [
-              "round-budget-exhausted",
               "failed-attempt-budget-exhausted",
               "no-progress",
               "incomplete-coverage",
@@ -58,11 +57,10 @@
         }
       }
     },
-    "completed_initial_reviews": {"type": "integer", "minimum": 0, "maximum": 32},
-    "completed_verification_rounds": {"type": "integer", "minimum": 0, "maximum": 32},
-    "handoffs": {"type": "integer", "minimum": 0, "maximum": 32},
-    "no_progress_events": {"type": "integer", "minimum": 0, "maximum": 32},
-    "cap_created_approval": {"type": "boolean"},
+    "completed_initial_reviews": {"type": "integer", "minimum": 0, "maximum": 1000000},
+    "completed_verification_rounds": {"type": "integer", "minimum": 0, "maximum": 1000000},
+    "handoffs": {"type": "integer", "minimum": 0, "maximum": 1000000},
+    "no_progress_events": {"type": "integer", "minimum": 0, "maximum": 1000000},
     "limitations": {
       "type": "array",
       "maxItems": 8,

package/bin/_internal/review_sensei/schemas/observed-convergence-report.schema.json

@@ -4,14 +4,15 @@
   "title": "ReviewSensei observed convergence evidence report v1",
   "type": "object",
   "additionalProperties": false,
-  "required": ["schema_version", "mode", "events", "baseline_events", "command_events", "finding_metrics", "execution_metrics", "shadow_isolated", "evidence_identity", "approval_events", "cap_created_approval", "cutover_status", "unmet_criteria", "limitations"],
+  "required": ["schema_version", "mode", "events", "baseline_events", "command_events", "finding_metrics", "execution_metrics", "shadow_isolated", "evidence_identity", "approval_events", "cutover_status", "unmet_criteria", "limitations"],
   "properties": {
     "schema_version": {"const": "1.0"},
     "mode": {"type": "string", "enum": ["advisory", "merge-focused", "strict"]},
     "events": {
+      "description": "Observed attempts. The bound is a storage ceiling, not a review-count admission limit; sequences past the former 32-round validation bound serialize normally.",
       "type": "array",
       "minItems": 1,
-      "maxItems": 32,
+      "maxItems": 1000000,
       "items": {
         "type": "object",
         "additionalProperties": false,
@@ -40,7 +41,7 @@
         }
       }
     },
-    "baseline_events": {"type": "integer", "minimum": 0, "maximum": 32},
+    "baseline_events": {"type": "integer", "minimum": 0, "maximum": 1000000},
     "command_events": {"type": "array", "minItems": 2, "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 128}},
     "finding_metrics": {
       "type": "object",
@@ -64,8 +65,8 @@
       "additionalProperties": false,
       "required": ["completed_rounds", "handoffs", "provider_calls", "failed_attempts"],
       "properties": {
-        "completed_rounds": {"type": "integer", "minimum": 0, "maximum": 32},
-        "handoffs": {"type": "integer", "minimum": 0, "maximum": 32},
+        "completed_rounds": {"type": "integer", "minimum": 0, "maximum": 1000000},
+        "handoffs": {"type": "integer", "minimum": 0, "maximum": 1000000},
         "provider_calls": {"type": "integer", "minimum": 0, "maximum": 512},
         "failed_attempts": {"type": "integer", "minimum": 0, "maximum": 32}
       }
@@ -84,8 +85,7 @@
         "command": {"type": "string", "minLength": 1, "maxLength": 256}
       }
     },
-    "approval_events": {"type": ["integer", "null"], "minimum": 0, "maximum": 32},
-    "cap_created_approval": {"type": ["boolean", "null"]},
+    "approval_events": {"type": ["integer", "null"], "minimum": 0, "maximum": 1000000},
     "cutover_status": {"type": "string", "enum": ["passed", "not_ready"]},
     "unmet_criteria": {"type": "array", "maxItems": 16, "items": {"type": "string", "minLength": 1, "maxLength": 256}},
     "limitations": {"type": "array", "minItems": 1, "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 256}}

package/bin/_internal/review_sensei/schemas/review-convergence-policy.schema.json

@@ -8,8 +8,6 @@
     "schema_version",
     "mode",
     "enforcement",
-    "max_completed_initial_reviews",
-    "max_completed_verification_rounds",
     "max_failed_attempts",
     "automatic_github_review_events",
     "inline_advisory_threads"
@@ -24,16 +22,6 @@
       "type": "string",
       "enum": ["display-only", "publication"]
     },
-    "max_completed_initial_reviews": {
-      "type": "integer",
-      "minimum": 1,
-      "maximum": 8
-    },
-    "max_completed_verification_rounds": {
-      "type": "integer",
-      "minimum": 0,
-      "maximum": 8
-    },
     "max_failed_attempts": {
       "type": "integer",
       "minimum": 1,

package/bin/_internal/review_sensei/schemas/review-round-decision.schema.json

@@ -10,12 +10,9 @@
     "admit",
     "count_as_completed_round",
     "round_kind",
-    "remaining_initial_reviews",
-    "remaining_verification_rounds",
     "handoff",
     "handoff_reason",
-    "may_emit_approve",
-    "cap_creates_approval"
+    "may_emit_approve"
   ],
   "properties": {
     "schema_version": {"const": "1.0"},
@@ -29,21 +26,10 @@
       "type": "string",
       "enum": ["initial", "verification", "none"]
     },
-    "remaining_initial_reviews": {
-      "type": "integer",
-      "minimum": 0,
-      "maximum": 8
-    },
-    "remaining_verification_rounds": {
-      "type": "integer",
-      "minimum": 0,
-      "maximum": 8
-    },
     "handoff": {"type": "boolean"},
     "handoff_reason": {
       "type": ["string", "null"],
       "enum": [
-        "round-budget-exhausted",
         "failed-attempt-budget-exhausted",
         "no-progress",
         "incomplete-coverage",
@@ -52,7 +38,6 @@
         null
       ]
     },
-    "may_emit_approve": {"type": "boolean"},
-    "cap_creates_approval": {"type": "boolean", "const": false}
+    "may_emit_approve": {"type": "boolean"}
   }
 }

package/bin/_internal/review_sensei/schemas/session-record.schema.json

@@ -30,9 +30,10 @@
       "minimum": 1,
       "maximum": 2147483647
     },
-    "completed_initial_reviews": {"type": "integer", "minimum": 0, "maximum": 32},
-    "completed_verification_rounds": {"type": "integer", "minimum": 0, "maximum": 32},
+    "completed_initial_reviews": {"type": "integer", "minimum": 0, "maximum": 1000000},
+    "completed_verification_rounds": {"type": "integer", "minimum": 0, "maximum": 1000000},
     "failed_attempts": {"type": "integer", "minimum": 0, "maximum": 32},
+    "failed_attempts_head_sha": {"type": ["string", "null"], "pattern": "^[a-f0-9]{40,64}$"},
     "generation": {"type": "integer", "minimum": 0, "maximum": 2147483647},
     "reservation_id": {
       "anyOf": [
@@ -85,6 +86,7 @@
       }
     },
     "continuation_grants": {
+      "description": "Retained pre-uncapped command attestations. Stored as history only; no command consumes them.",
       "type": "array",
       "maxItems": 4,
       "items": {

package/bin/_internal/review_sensei.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: review-sensei
-Version: 0.6.8
+Version: 0.6.10
 Summary: Provider-neutral AI code review engine with an Ollama adapter.
 Author: Mohamad Alsabbagh
 License-Expression: MIT
@@ -84,32 +84,60 @@ python -m pip install .
 review-sensei --version
 ```
 
-The default is a local Ollama server using Qwen3.5 4B. Leave the API key empty
-and select the local mode:
+The default backend is a local Ollama server using the packaged local model,
+so a local review runs with no credential and no repository setup at all. A
+repository selects its backend in `.reviewsensei.yml` at the repository root,
+and a repository without that file uses the packaged defaults:
+
+```yaml
+schema: 1
+
+inference:
+  backend: local-ollama
+```
+
+Select a backend on the command line when one run needs a different one:
 
 ```bash
-export REVIEWSENSEI_PROVIDER_MODE="local"
-export REVIEWSENSEI_LOCAL_MODEL="qwen3.5:4b"
-unset OLLAMA_API_KEY
+review-sensei --diff pr.patch --provider local-ollama
+review-sensei --diff pr.patch --provider local-ollama --model qwen3.5:8b
 ```
 
-Ollama Cloud is explicit opt-in:
+The hosted backends are explicit, and each one requires its own credential:
 
 ```bash
-export OLLAMA_API_KEY="your-key"
-export REVIEWSENSEI_PROVIDER_MODE="cloud"
-export REVIEWSENSEI_CLOUD_MODEL="deepseek-v4.1-flash:cloud"
-unset OLLAMA_BASE_URL OLLAMA_MODEL
+OLLAMA_API_KEY="your-key" review-sensei --diff pr.patch --provider cloud-ollama
+OPENROUTER_API_KEY="your-key" review-sensei --diff pr.patch --provider openrouter
+OPENAI_API_KEY="your-key" review-sensei --diff pr.patch --provider openai-compatible
+```
+
+Ollama Cloud is explicit opt-in and requires `OLLAMA_API_KEY`:
+
+```yaml
+schema: 1
+
+inference:
+  backend: cloud-ollama
 ```
 
+A backend that needs no credential never receives one implicitly: a key
+exported for another backend does not travel to `local-ollama`.
+
+The packaged model for the selected backend applies unless `inference.model`
+names another one. `REVIEWSENSEI_PROVIDER` and `REVIEWSENSEI_MODEL` remain the
+only supported environment overrides; the retired
+`REVIEWSENSEI_PROVIDER_MODE`, `REVIEWSENSEI_LOCAL_MODEL`, and
+`REVIEWSENSEI_CLOUD_MODEL` variables have no effect and are reported with their
+replacements by `review-sensei config`.
+
 ### Run through npx
 
 Node.js 22 or newer can invoke the same Python review engine through the
 provider-neutral `@reviewsensei/cli` launcher:
 
 ```bash
-npx --yes @reviewsensei/cli@0.6.8 --version
-npx --yes @reviewsensei/cli@0.6.8 --help
+npx --yes @reviewsensei/cli@0.6.10 --version
+npx --yes @reviewsensei/cli@0.6.10 --help
 ```
 
 The launcher selects one of the five native packages (macOS arm64/x64,
@@ -125,7 +153,14 @@ release tag. See [`docs/installation.md`](docs/installation.md),
 for prerequisites, release ordering, provenance, and version-forward rollback
 guidance.
 
-Generate a bounded diff and run a review:
+Generate a bounded diff and review it. The shortest local run needs nothing
+but the diff and a reachable local model server:
+
+```bash
+review-sensei --diff pr.patch
+```
+
+Repository context, learnings, and an explicit change identity are optional:
 
 ```bash
 review-sensei prepare-diff \
@@ -142,13 +177,40 @@ review-sensei \
   --title "Reviewable change" \
   --learning-root /path/to/target-branch-checkout \
   --context-root /path/to/target-branch-checkout \
+  --format json \
   --output review.json
 ```
 
-The output is a validated JSON document containing `summary`, `comments`,
-`provider`, `model`, and `learning_proposals`. Learning proposals are not
+The default output is readable terminal text. `--format markdown` and
+`--format json` are explicit, and only the selected format is written to
+stdout or `--output` while warnings, diagnostics, and the final status and
+reason lines stay on stderr. The JSON format
+is the validated `review-result` document containing `summary`, `comments`,
+`provider`, `model`, and `learning_proposals`; learning proposals are not
 stored or used automatically.
 
+The review exit contract is stable:
+
+| Code | Meaning |
+| --- | --- |
+| `0` | The review completed and no required fixes remain |
+| `1` | The review completed with required fixes remaining |
+| `2` | The review could not complete, the input was invalid, or a human decision is required |
+
+A non-zero exit prints a `review-sensei: reason=<token>` line naming the cause,
+and the exit codes are unchanged by the selected output format. Hosts and
+launchers that select a lane from the historical 0/1 contract pass
+`--exit-semantics operational`.
+
+A local review is a bounded one-shot and needs no GitHub identity, OIDC token,
+broker, or hosted state. `--local-session` is the one explicit
+persistent-local-session operation: it keeps the durable session ledger in the
+platform's per-user state directory (`~/Library/Application Support/review-sensei`
+on macOS, `%LOCALAPPDATA%\review-sensei` on Windows, and
+`$XDG_STATE_HOME/review-sensei` or `~/.local/state/review-sensei` elsewhere) so
+repeated runs of the same change reuse one session, and `--session-ledger`
+still overrides that location.
+
 The published schema files live under `src/review_sensei/schemas/` and are
 included in the installed package. Public compatibility rules, CLI flags, error
 categories, and provider protocol expectations are documented in
@@ -205,7 +267,7 @@ environment.
 
 During installation or migration, the Worker separately uses GitHub App
 authentication to obtain a repository-scoped installation token for the setup
-branch, pull request, and default variables.
+branch and pull request.
 
 Installation, reinstall, permission-acceptance, and repository-added events
 reconcile absent or older generated clients through at most one setup-v5 PR.
@@ -519,16 +581,33 @@ See [ADR 0036](docs/adr/0036-learning-lifecycle-diagnostics-and-feedback.md).
 
 ## Local Ollama
 
+A local review defaults to the `local-ollama` backend and needs no credential.
+State it explicitly in `.reviewsensei.yml` when the repository should not rely
+on the packaged default:
+
+```yaml
+schema: 1
+
+inference:
+  backend: local-ollama
+```
+
 ```bash
-export REVIEWSENSEI_PROVIDER_MODE="local"
-export REVIEWSENSEI_LOCAL_MODEL="qwen3.5:4b"
-unset OLLAMA_API_KEY
 review-sensei --diff pr.patch
 ```
 
+Select the backend and model explicitly when you need to
+(`--provider local-ollama --model qwen3.5:8b`, or `REVIEWSENSEI_PROVIDER` and
+`REVIEWSENSEI_MODEL`). A backend that requires no credential never receives one
+implicitly, so an exported `OLLAMA_API_KEY` is not attached to loopback
+requests unless `--api-key-env` names it.
+
 ## Providers
 
-The shipped registry keys are `ollama`, `openai-compatible`, and `openrouter`.
+The shipped registry adapters are `ollama`, `openai-compatible`,
+`openrouter`, and the `fixture` test seam. Canonical backends — `local-ollama`,
+`cloud-ollama`, `openai-compatible`, `openrouter`, and `fixture` — are what
+`--provider`, `REVIEWSENSEI_PROVIDER`, and inference configuration name.
 Operator defaults, workflow modes, named profiles, credentials, and hosted
 OpenRouter allowlists are documented in [`docs/installation.md`](docs/installation.md).
 The release-aware public matrix lives at
@@ -566,13 +645,18 @@ The GitHub App opens a setup-v5 PR containing a thin caller that follows the
 operator-managed `v5` public git tag. The reusable workflow prefers the
 requested exact package from PyPI and falls back to its executing workflow
 commit only when that package/version is unavailable. Unrelated PyPI
-installation failures remain fatal. Setup provisions 15 repository variables,
-including 7 boolean controls, and manages 3 generated files. Automatic review,
-GitHub writes, learning proposals, learning PRs, mention replies, and artifact
-upload default to `false`; automatic approval defaults to `true` but is effective
-only when review and write gates are enabled. `REVIEWSENSEI_REVIEW_MODE` is a
-policy selector, not a boolean control, and defaults to `merge-focused`.
-The App never creates the customer-owned `OLLAMA_API_KEY` secret.
+installation failures remain fatal. Setup creates no repository variables and
+manages 3 generated files: the caller, the uninstall workflow, and the minimal
+root `.reviewsensei.yml` that the operator owns from the first install on. The
+only two optional Actions overrides the product consumes are
+`REVIEWSENSEI_PROVIDER` (`inference.backend`) and `REVIEWSENSEI_MODEL`
+(`inference.model`); the reusable workflow maps them once from the trusted
+policy commit. Every other policy decision is a field of `.reviewsensei.yml`:
+`github.automatic_reviews` defaults to `true`, `github.writes` to `false`,
+`github.reviews` to `auto-approve`, `github.mentions` to `true`,
+`github.learning` to `disabled`, and `github.artifacts` to `none`. The App
+requests no Variables permission and never creates the customer-owned
+`OLLAMA_API_KEY` secret.
 
 When explicitly enabled, same-repository pull requests can run automatic review
 with either provider mode: cloud on a GitHub-hosted runner or local Ollama on
@@ -587,19 +671,32 @@ transport ceiling remains unchanged. Fork pull requests fail closed before
 provider or broker access.
 
 When automatic review and GitHub writes are enabled, automatic approval is on by
-default; set `REVIEWSENSEI_AUTO_APPROVE=false` for an explicit opt-out.
-ReviewSensei publishes blocking findings as `REQUEST_CHANGES` and non-blocking
-findings as `COMMENT`, then invokes one shared, idempotent approval finalizer.
-It emits `APPROVE` for an eligible exact head when no unresolved ReviewSensei
-root is classified blocking. A later execution on the same commit still
-requests changes if blocking comments appear after an approval, and it
-approves after an earlier change request only once those blocking roots are
-resolved. Unresolved non-blocking ReviewSensei findings and human threads do
-not withhold approval. An unclassified ReviewSensei root, malformed or
-incomplete thread data, or a draft/closed/fork/stale/App-authored PR fails
-closed. The finalizer runs after review publication and after the AI resolves a
-blocking ReviewSensei thread; `@sensei` replies themselves remain ordinary
-comments. Existing approval markers prevent duplicate approvals.
+default; `github.reviews: blocking` (publish and enforce, never automatically
+approve) or `github.reviews: advisory` (no ReviewSensei merge gate and no
+approval) in `.reviewsensei.yml` selects another policy.
+ReviewSensei publishes one exact-head `COMMENT` review with its summary and
+valid inline findings, and enforces through one stable `ReviewSensei` check run
+bound to that head and to the App that produced it: `success` for a complete
+review with no required fixes, `failure` when required fixes remain, and
+`action_required` for a partial, incomplete, or unpublished review. An earlier
+conclusion on the same head is superseded by a pending `in_progress` write, so
+a finished review cannot stand in for one that is still running. No persistent
+`REQUEST_CHANGES` is emitted as a second gate. A repository administrator must
+mark `ReviewSensei` required for it to gate merges; `review-sensei doctor`
+reports the check identity and producing App, and nothing reads or changes
+branch protection.
+
+The same mode also runs one shared, idempotent approval finalizer. It emits
+`APPROVE` for an eligible exact head whose review is complete and qualified and
+whose bounded thread sweep finds no unresolved blocking ReviewSensei root.
+Unresolved non-blocking ReviewSensei findings and human threads do not withhold
+approval. An unclassified ReviewSensei root, malformed or incomplete thread
+data, an unverified configuration, or a draft/closed/fork/stale/App-authored PR
+fails closed or reports why approval was withheld. The finalizer runs after
+review publication and after the AI resolves a blocking ReviewSensei thread;
+`@sensei` replies themselves remain ordinary comments. Existing approval markers
+prevent duplicate approvals, and ReviewSensei never calls a merge endpoint or
+enables auto-merge.
 
 The approval policy is deliberately conservative: explicit blocking metadata,
 or an unclassified canonical `critical`/`high` severity, blocks approval.
@@ -618,9 +715,9 @@ mode sends that bounded conversation context to Ollama Cloud; local mode keeps
 it on the configured local service. Published review summaries and inline
 findings also tell readers to reply with @sensei followed by their question.
 `review.json` is uploaded only when
-`REVIEWSENSEI_UPLOAD_ARTIFACTS=true`; setup-v5 does not create a separate
-version artifact. See [installation and migration](docs/installation.md) and
-the reviewable
+`github.artifacts: diagnostics` is set in `.reviewsensei.yml`; setup-v5 does not
+create a separate version artifact. See
+[installation and migration](docs/installation.md) and the reviewable
 [`setup-v5 example`](examples/github-actions/review-sensei-review.yml).
 
 ## Concurrency policy

package/bin/_internal/review_sensei.egg-info/SOURCES.txt

@@ -75,6 +75,9 @@ docs/adr/0052-logical-review-transaction-across-analysis-and-publication.md
 docs/adr/0053-bounded-durable-convergence-history.md
 docs/adr/0054-observed-convergence-acceptance-evidence.md
 docs/adr/0055-merge-focused-default-and-legacy-retirement.md
+docs/adr/0056-host-fact-placement-and-honest-approval-presentation.md
+docs/adr/0056-remove-pr-wide-review-count-caps.md
+docs/adr/0057-one-check-run-as-the-single-merge-authority.md
 docs/adr/README.md
 docs/architecture/index.md
 docs/process/adr-process.md
@@ -135,6 +138,7 @@ src/review_sensei/__main__.py
 src/review_sensei/baseline.py
 src/review_sensei/cli.py
 src/review_sensei/concurrency.py
+src/review_sensei/configuration.py
 src/review_sensei/context.py
 src/review_sensei/convergence.py
 src/review_sensei/conversation.py
@@ -144,11 +148,13 @@ src/review_sensei/diff.py
 src/review_sensei/disposition.py
 src/review_sensei/errors.py
 src/review_sensei/evaluation.py
+src/review_sensei/hosted.py
 src/review_sensei/learnings.py
 src/review_sensei/models.py
 src/review_sensei/openrouter_qualification.py
 src/review_sensei/outcomes.py
 src/review_sensei/patches.py
+src/review_sensei/placement.py
 src/review_sensei/planning.py
 src/review_sensei/presentation.py
 src/review_sensei/provider_config.py
@@ -175,7 +181,7 @@ src/review_sensei/hosting/github/approval.py
 src/review_sensei/hosting/github/auth.py
 src/review_sensei/hosting/github/broker.py
 src/review_sensei/hosting/github/broker_client.py
-src/review_sensei/hosting/github/budget_admission.py
+src/review_sensei/hosting/github/checks.py
 src/review_sensei/hosting/github/conversation.py
 src/review_sensei/hosting/github/errors.py
 src/review_sensei/hosting/github/http.py
@@ -238,5 +244,6 @@ tests/fake_github_http.py
 tests/packaging_guard.py
 tests/dist_safe/test_distribution_contract.py
 tests/dist_safe/test_install_smoke.py
+tests/dist_safe/test_local_review_contract.py
 tests/downstream/test_acceptance.py
 tests/fixtures/distribution-contract.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reviewsensei/cli-linux-x64-gnu",
-  "version": "0.6.8",
+  "version": "0.6.10",
   "description": "ReviewSensei native CLI for glibc Linux x64",
   "license": "MIT",
   "repository": {