@reviewsensei/cli-win32-x64 0.6.12 → 0.6.15

package/README.md

@@ -1,4 +1,19 @@
 # @reviewsensei/cli-win32-x64
 
-Native ReviewSensei standalone payload for Windows x64. This package is
-selected by `@reviewsensei/cli`; it contains no installer or download hook.
+ReviewSensei is a provider-neutral AI code review engine that turns unified
+Git diffs into validated summaries and findings. This package contains the
+standalone Python engine bundled for Windows x64.
+
+Install the public launcher, which selects the matching native package:
+
+```console
+npm install --save-dev @reviewsensei/cli@0.6.15
+npx review-sensei --help
+```
+
+Use [`@reviewsensei/cli`](https://www.npmjs.com/package/@reviewsensei/cli) for
+installation, provider/model configuration, authentication, and review examples.
+The launcher forwards CLI arguments unchanged and inherits your working directory
+and environment; the engine reads `.reviewsensei.yml` or an explicit `--config`.
+There is no separate platform-package configuration, npm command, installer, or
+download hook. A separate Python installation is unnecessary.

package/bin/_internal/jsonschema-4.26.0.dist-info/RECORD

@@ -1,4 +1,4 @@
-../../Scripts/jsonschema.exe,sha256=_dLD9ZAwdS7bdfOjh4_9RvmxhUjIWQYDzVewwEghuD0,108352
+../../Scripts/jsonschema.exe,sha256=v9u9Hyi233q5q7OIHqsByLwuPgP_W802j5xLbFGJzZY,108352
 jsonschema-4.26.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
 jsonschema-4.26.0.dist-info/METADATA,sha256=BbGJhmypipbaOTS_a4NofO0_-FMlJzt34WtwX22LJtI,7592
 jsonschema-4.26.0.dist-info/RECORD,,

package/bin/_internal/review_sensei/schemas/broker-diagnostics.json

@@ -0,0 +1,412 @@
+{
+  "broker_capability_invalid": {
+    "stage": "request_validation",
+    "action": "check_request",
+    "hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
+  },
+  "broker_content_length_required": {
+    "stage": "request_validation",
+    "action": "check_request",
+    "hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
+  },
+  "broker_cors_not_supported": {
+    "stage": "request_validation",
+    "action": "check_request",
+    "hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
+  },
+  "broker_event_rejected": {
+    "stage": "workflow_identity",
+    "action": "check_workflow",
+    "hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
+  },
+  "broker_installation_unavailable": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "broker_invalid_request": {
+    "stage": "request_validation",
+    "action": "check_request",
+    "hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
+  },
+  "broker_ledger_invalid": {
+    "stage": "broker_ledger",
+    "action": "contact_operator",
+    "hint": "The broker ledger could not complete validation. Retry later; if it persists, ask the broker operator to inspect ledger health."
+  },
+  "broker_ledger_unavailable": {
+    "stage": "broker_ledger",
+    "action": "contact_operator",
+    "hint": "The broker ledger could not complete validation. Retry later; if it persists, ask the broker operator to inspect ledger health."
+  },
+  "broker_payload_too_large": {
+    "stage": "request_validation",
+    "action": "check_request",
+    "hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
+  },
+  "broker_rate_limited": {
+    "stage": "broker_admission",
+    "action": "retry_later",
+    "hint": "The broker rejected admission or replay. Wait before starting a fresh run; do not reuse an OIDC token."
+  },
+  "broker_replay": {
+    "stage": "broker_admission",
+    "action": "retry_later",
+    "hint": "The broker rejected admission or replay. Wait before starting a fresh run; do not reuse an OIDC token."
+  },
+  "broker_repository_rejected": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "broker_request_invalid": {
+    "stage": "request_validation",
+    "action": "check_request",
+    "hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
+  },
+  "broker_runner_rejected": {
+    "stage": "workflow_identity",
+    "action": "check_workflow",
+    "hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
+  },
+  "broker_session_actor_rejected": {
+    "stage": "session_validation",
+    "action": "check_session",
+    "hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
+  },
+  "broker_session_attestation_invalid": {
+    "stage": "session_validation",
+    "action": "check_session",
+    "hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
+  },
+  "broker_session_grant_invalid": {
+    "stage": "session_validation",
+    "action": "check_session",
+    "hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
+  },
+  "broker_session_grant_rejected": {
+    "stage": "session_validation",
+    "action": "check_session",
+    "hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
+  },
+  "broker_session_head_rejected": {
+    "stage": "session_validation",
+    "action": "check_session",
+    "hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
+  },
+  "broker_session_invalid": {
+    "stage": "session_validation",
+    "action": "check_session",
+    "hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
+  },
+  "broker_unknown": {
+    "stage": "broker",
+    "action": "contact_operator",
+    "hint": "The broker supplied no recognized reason. Use the correlation ID and run time to inspect broker logs; do not infer a cause."
+  },
+  "broker_workflow_rejected": {
+    "stage": "workflow_identity",
+    "action": "check_workflow",
+    "hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
+  },
+  "github_api_url_invalid": {
+    "stage": "broker_configuration",
+    "action": "contact_operator",
+    "hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
+  },
+  "github_app_id_invalid": {
+    "stage": "broker_configuration",
+    "action": "contact_operator",
+    "hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
+  },
+  "github_app_key_invalid": {
+    "stage": "broker_configuration",
+    "action": "contact_operator",
+    "hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
+  },
+  "github_capability_issue_failed": {
+    "stage": "capability_issuance",
+    "action": "contact_operator",
+    "hint": "GitHub capability issuance failed. Ask the broker operator to inspect the installation grant and any upstream status; preserve existing permissions."
+  },
+  "github_capability_permissions_invalid": {
+    "stage": "capability_issuance",
+    "action": "contact_operator",
+    "hint": "GitHub capability issuance failed. Ask the broker operator to inspect the installation grant and any upstream status; preserve existing permissions."
+  },
+  "github_capability_response_invalid": {
+    "stage": "capability_issuance",
+    "action": "contact_operator",
+    "hint": "GitHub capability issuance failed. Ask the broker operator to inspect the installation grant and any upstream status; preserve existing permissions."
+  },
+  "github_installation_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_lookup_failed": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_permissions_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_repositories_failed": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_repositories_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_repositories_limit": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_repository_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_token_failed": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_token_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_issue_comment_forbidden": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_issue_comment_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_issue_comment_lookup_failed": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_issue_comment_response_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_path_invalid": {
+    "stage": "broker_configuration",
+    "action": "contact_operator",
+    "hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
+  },
+  "github_pull_request_forbidden": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_pull_request_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_pull_request_lookup_failed": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_pull_request_response_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_repository_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_repository_lookup_failed": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_repository_response_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_response_invalid": {
+    "stage": "github_api",
+    "action": "contact_operator",
+    "hint": "A GitHub API response could not be used. Retry later or ask the broker operator to inspect the upstream request."
+  },
+  "github_response_too_large": {
+    "stage": "github_api",
+    "action": "contact_operator",
+    "hint": "A GitHub API response could not be used. Retry later or ask the broker operator to inspect the upstream request."
+  },
+  "github_workflow_tag_invalid": {
+    "stage": "workflow_identity",
+    "action": "check_workflow",
+    "hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
+  },
+  "github_workflow_tag_unavailable": {
+    "stage": "workflow_identity",
+    "action": "check_workflow",
+    "hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
+  },
+  "oidc_actor_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_audience_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_claims_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_event_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_header_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_identity_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_issuer_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_job_workflow_ref_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_job_workflow_sha_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_jti_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_jwks_invalid": {
+    "stage": "oidc_validation",
+    "action": "retry_later",
+    "hint": "OIDC signing keys could not be used. Retry later; if it persists, ask the broker operator to inspect signing-key availability."
+  },
+  "oidc_jwks_too_large": {
+    "stage": "oidc_validation",
+    "action": "retry_later",
+    "hint": "OIDC signing keys could not be used. Retry later; if it persists, ask the broker operator to inspect signing-key availability."
+  },
+  "oidc_jwks_unavailable": {
+    "stage": "oidc_validation",
+    "action": "retry_later",
+    "hint": "OIDC signing keys could not be used. Retry later; if it persists, ask the broker operator to inspect signing-key availability."
+  },
+  "oidc_key_not_found": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_ref_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_repository_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_repository_owner_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_run_attempt_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_run_id_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_run_number_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_runner_environment_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_sha_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_signature_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_subject_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_time_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_token_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_workflow_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_workflow_ref_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_workflow_sha_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  }
+}

package/bin/_internal/review_sensei/schemas/coverage-manifest.schema.json

@@ -43,6 +43,8 @@
             "enum": [
               "binary",
               "generated",
+              "lockfile-format",
+              "no-review-stage",
               "too-large-hunk",
               "too-large-file",
               "chunk-failed",
@@ -81,6 +83,8 @@
             "enum": [
               "binary",
               "generated",
+              "lockfile-format",
+              "no-review-stage",
               "too-large-hunk",
               "too-large-file",
               "chunk-failed",

package/bin/_internal/{review_sensei-0.6.12.dist-info → review_sensei-0.6.15.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: review-sensei
-Version: 0.6.12
+Version: 0.6.15
 Summary: Provider-neutral AI code review engine with an Ollama adapter.
 Author: Mohamad Alsabbagh
 License-Expression: MIT
@@ -136,8 +136,8 @@ Node.js 22 or newer can invoke the same Python review engine through the
 provider-neutral `@reviewsensei/cli` launcher:
 
 ```bash
-npx --yes @reviewsensei/cli@0.6.12 --version
-npx --yes @reviewsensei/cli@0.6.12 --help
+npx --yes @reviewsensei/cli@0.6.15 --version
+npx --yes @reviewsensei/cli@0.6.15 --help
 ```
 
 The launcher selects one of the five native packages (macOS arm64/x64,
@@ -334,6 +334,28 @@ limits stay in place; opt-in `--orchestrate-large-changes` adds a separate
 total-work budget so larger diffs can be chunked without silent truncation or
 unbounded provider calls.
 
+Npm `package-lock.json` and `npm-shrinkwrap.json` changes are reviewed as
+material dependency input. Every original hunk remains in the request; a
+bounded aid identifies visible dependency members with exact diff hashes and
+left/right line references. This is patch evidence, not a validated full
+dependency graph or an integrity/security audit of downloaded packages. The
+lockfile version and owning package may be unknown in isolated hunks. Other
+recognized lockfile formats currently report `unsupported` with reason
+`lockfile-format`; generated non-lockfile exclusions still report `generated`.
+
+Validated partial results with explicit complete enumeration and evidence of
+some reviewed work can be checkpointed and published. Their findings and
+coverage limitations remain visible; approval is withheld, and enforcement
+modes keep the check at `action_required`. Publication success means the
+findings were delivered, not that review coverage became complete. Missing
+coverage, incomplete enumeration, summary-only results, and total analysis
+failure still cannot enter the partial identity-bound publication path. Legacy
+complete artifacts without coverage retain checkpoint/publication compatibility;
+their existing compatibility behavior is unchanged. The default
+review exit is `2` for a partial result; workflow `operational` exit semantics
+allow safe checkpointed findings to reach publication. Existing publisher
+diff-size and location-validation limits still apply.
+
 Repository paths are strict canonical NFC UTF-8, `/`-separated, relative paths:
 no empty, dot, parent, absolute, drive/UNC, backslash, surrounding whitespace,
 control/format/surrogate, or silently normalized forms are accepted. Glob
@@ -659,6 +681,32 @@ policy commit. Every other policy decision is a field of `.reviewsensei.yml`:
 requests no Variables permission and never creates the customer-owned
 `OLLAMA_API_KEY` secret.
 
+Reusable-workflow callers can optionally set `with.hosted_runner` to one
+Ubuntu-compatible Linux runner label, such as `ubicloud-standard-2` or an
+operator-owned label. Omitted and empty inputs use `ubuntu-latest`. Labels must
+contain 1-128 letters, digits, dots, underscores, or hyphens and start with a
+letter or digit; JSON arrays, runner groups, spaces, and expressions are not
+supported. The read-only bootstrap stays on `ubuntu-latest` and validates the
+input before scheduling preflight, command, and hosted-provider jobs on that
+runner. The local Ollama job keeps `[self-hosted, linux, x64, ollama]`; this
+infrastructure input does not select an inference backend or grant permissions.
+ReviewSensei's own repository workflows retain their existing runner routing.
+
+After the public `v5` channel includes this input, an operator can opt a trusted
+caller into Ubicloud with its existing repository variable:
+
+```yml
+    with:
+      hosted_runner: ${{ vars.ENABLE_UBICLOUD_HOSTED == 'true' && 'ubicloud-standard-2' || 'ubuntu-latest' }}
+      # Keep the caller's existing invocation inputs and named secrets.
+```
+
+Do not add this argument to a caller of an older reusable workflow that does
+not declare it: GitHub rejects unknown workflow inputs. Updating `main` alone
+does not activate tag-pinned callers; the approved `v5` release and broker
+workflow identity must advance together. No setup variable or credential is
+created by this feature.
+
 When explicitly enabled, same-repository pull requests can run automatic review
 with either provider mode: cloud on a GitHub-hosted runner or local Ollama on
 the labelled self-hosted runner. ReviewSensei checks out only trusted base
@@ -708,7 +756,12 @@ blocker. See
 for the criteria and rollback path.
 
 Manual review and authorized `@sensei` replies use the same selected provider
-mode. Each authorized mention receives a temporary 👀 reaction while the reply
+mode. Generated `github reply` commands use the same inference configuration
+and CLI overrides as normal reviews, including `cloud-ollama` and
+`local-ollama`. Run from the trusted policy checkout or pass `--config` with
+its trusted configuration. A local backend receives no ambient cloud key;
+an explicitly named `--api-key-env` remains an operator opt-in.
+Each authorized mention receives a temporary 👀 reaction while the reply
 is generated; ReviewSensei removes it after the reply or another terminal
 outcome. Follow-up mentions in the same inline or PR conversation include the
 bounded prior thread, diff context, findings, and trusted-base learnings. Cloud

package/bin/_internal/{review_sensei-0.6.12.dist-info → review_sensei-0.6.15.dist-info}/RECORD

@@ -1,18 +1,19 @@
-../../Scripts/review-sensei.exe,sha256=WaUw5eZvxWI3ODpnfo0vdGdVBF4x50rQFHEyUvcslxE,108355
-review_sensei-0.6.12.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
-review_sensei-0.6.12.dist-info/METADATA,sha256=yqGjz-dzmA3PcsZkZ751g4TM5rCSCdyT-8hPBMVoiUo,38788
-review_sensei-0.6.12.dist-info/RECORD,,
-review_sensei-0.6.12.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-review_sensei-0.6.12.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-review_sensei-0.6.12.dist-info/direct_url.json,sha256=EDhpXdSFq1qZfl2FCT07Hg2gleInjGFaAwkFy0selqU,67
-review_sensei-0.6.12.dist-info/entry_points.txt,sha256=Eki1ToC6hiOv8PMEAd2Cnbh5WWstVzzzf0XmHBHzpMQ,57
-review_sensei-0.6.12.dist-info/licenses/LICENSE,sha256=-eVBqOV92YK1K76UIcK5MrgUh0EiQMe8xNhSysQE68s,1095
-review_sensei-0.6.12.dist-info/top_level.txt,sha256=VCF4gJIJPP3MPJntoITDjMhJ8MUZfVLj-z3-VUQ9XDY,14
+../../Scripts/review-sensei.exe,sha256=Ald8ApUfWLLbQ69U_O7QBT3p52zJeriHKCJ7HaXjQdc,108355
+review_sensei-0.6.15.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
+review_sensei-0.6.15.dist-info/METADATA,sha256=b8lGu2nXmQSMy5DesttwNmIy4AreGd0_JnEJRZpfDds,42124
+review_sensei-0.6.15.dist-info/RECORD,,
+review_sensei-0.6.15.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+review_sensei-0.6.15.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+review_sensei-0.6.15.dist-info/direct_url.json,sha256=EDhpXdSFq1qZfl2FCT07Hg2gleInjGFaAwkFy0selqU,67
+review_sensei-0.6.15.dist-info/entry_points.txt,sha256=Eki1ToC6hiOv8PMEAd2Cnbh5WWstVzzzf0XmHBHzpMQ,57
+review_sensei-0.6.15.dist-info/licenses/LICENSE,sha256=-eVBqOV92YK1K76UIcK5MrgUh0EiQMe8xNhSysQE68s,1095
+review_sensei-0.6.15.dist-info/top_level.txt,sha256=VCF4gJIJPP3MPJntoITDjMhJ8MUZfVLj-z3-VUQ9XDY,14
 review_sensei/__init__.py,sha256=hBA7OkQbK_oV4-fDFucVnpsnIut_JK-BbXLTznhg8ao,10524
 review_sensei/__main__.py,sha256=0iDYjdmiXNBinFF23WUyotsdpA6wFKjoB5aw3esTSRg,83
 review_sensei/__pycache__/__init__.cpython-311.pyc,,
 review_sensei/__pycache__/__main__.cpython-311.pyc,,
 review_sensei/__pycache__/baseline.cpython-311.pyc,,
+review_sensei/__pycache__/broker_diagnostics.cpython-311.pyc,,
 review_sensei/__pycache__/cli.cpython-311.pyc,,
 review_sensei/__pycache__/concurrency.cpython-311.pyc,,
 review_sensei/__pycache__/configuration.cpython-311.pyc,,
@@ -20,6 +21,7 @@ review_sensei/__pycache__/context.cpython-311.pyc,,
 review_sensei/__pycache__/convergence.cpython-311.pyc,,
 review_sensei/__pycache__/conversation.cpython-311.pyc,,
 review_sensei/__pycache__/coverage.cpython-311.pyc,,
+review_sensei/__pycache__/dependencies.cpython-311.pyc,,
 review_sensei/__pycache__/diagnostics.cpython-311.pyc,,
 review_sensei/__pycache__/diff.cpython-311.pyc,,
 review_sensei/__pycache__/disposition.cpython-311.pyc,,
@@ -27,6 +29,7 @@ review_sensei/__pycache__/document_context.cpython-311.pyc,,
 review_sensei/__pycache__/errors.cpython-311.pyc,,
 review_sensei/__pycache__/evaluation.cpython-311.pyc,,
 review_sensei/__pycache__/hosted.cpython-311.pyc,,
+review_sensei/__pycache__/human_assessment.cpython-311.pyc,,
 review_sensei/__pycache__/learnings.cpython-311.pyc,,
 review_sensei/__pycache__/models.cpython-311.pyc,,
 review_sensei/__pycache__/openrouter_qualification.cpython-311.pyc,,
@@ -45,20 +48,22 @@ review_sensei/__pycache__/stages.cpython-311.pyc,,
 review_sensei/__pycache__/validation.cpython-311.pyc,,
 review_sensei/__pycache__/verifier.cpython-311.pyc,,
 review_sensei/__pycache__/workflow.cpython-311.pyc,,
-review_sensei/baseline.py,sha256=B8rEeAtcWDZKHmKpp1ivyKuDlyqq8W6dHInZr5sdoBM,58473
-review_sensei/cli.py,sha256=w2nU2Es_x0jJXusSJ4dJlwTcq0sUCaZ55L5NhGtXGAY,153429
+review_sensei/baseline.py,sha256=AeiZYZtfRiVtwt4Amnv7620W-FEZhautDIE877B88Rw,59350
+review_sensei/broker_diagnostics.py,sha256=F7BAouQwp7kqNGTtJ74RDolYmLw57HHzALvBaLXyi7E,6423
+review_sensei/cli.py,sha256=O12Jd0BdDNPxoEcXfSVeeMtOlC8MjE5BO7JuhgUk3Ww,165009
 review_sensei/concurrency.py,sha256=7nqMDNaIl7YoKafkAF1ctXu6D5SFxXosm-1407OKimQ,20097
 review_sensei/configuration.py,sha256=b2D09kp8JcMFWaC5hVRirwYI8FB--cxSpiV1EERNU4o,90145
 review_sensei/context.py,sha256=pP3GrI0WyVYyWJJHyZgVFEjizBoY2Aeh0a_frLrjvj0,101720
 review_sensei/convergence.py,sha256=ZxnHmmFLGramRrOE8IHsAvqdhK3Rd--rimfm7UJKy08,50962
 review_sensei/conversation.py,sha256=KRWtF8JnmOrOQsvAX4q-d0UzzXjNp2XeePSbyIm4_pw,7467
-review_sensei/coverage.py,sha256=8fVsO4x2swqaa9QI5fcqeqB_FB6m0JfKrlRCg7_KA6E,12951
+review_sensei/coverage.py,sha256=kJcf0MchFfrHkc-5nFhpqsx3dGGP6O8xdk6I2vNvzXk,13007
 review_sensei/default_categories/01-correctness.json,sha256=ZeTTvEavHU6_ih7JKhv8a6gH-4wRJGv0abckRWNWTfs,211
 review_sensei/default_categories/02-security.json,sha256=6mz8Hlteb9q1PouLDmDoR-1wxrN31XR2X5I9yoYiG-E,231
 review_sensei/default_categories/03-architecture.json,sha256=Fg3VsUCzl9trCpSnoOgwTqfNHbB7a4znEfrw2apqjXA,806
 review_sensei/default_categories/03-maintainability.json,sha256=eyF9_slQ50LwEqSSet63jthfNp9ZOTnwiDVtVYjVv1A,229
 review_sensei/default_categories/04-tests.json,sha256=UHhvH79bae9FmLJT_MYNvki4Y9xhJDLpDuLdgp2npe0,208
 review_sensei/default_stages/01-default-review.json,sha256=-y9LP_8XNqEPpRN2K8z_qMHRqXyP6ZsiydzZFHozZwY,3463
+review_sensei/dependencies.py,sha256=OLNAFDMzmdtRVxex0XSpzwVVJl8jkCtUqxEk-0KohbE,5998
 review_sensei/diagnostics.py,sha256=ibG_2tI_VP4gTNM1c5XlAUAohYgSOd-5PZ-6xipbEcI,45613
 review_sensei/diff.py,sha256=na5MWhYcnRimFwGElNBiSp27Su_oufHhWiGtm1W38oY,32057
 review_sensei/disposition.py,sha256=d0nsNUKtba3UijH7X2YF7Wj5FSLdjRjE2Ni6HH0d9GI,21496
@@ -80,6 +85,7 @@ review_sensei/hosting/github/__pycache__/checks.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/conversation.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/errors.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/http.cpython-311.pyc,,
+review_sensei/hosting/github/__pycache__/human_assessment.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/jwt.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/learning_pr.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/observed.cpython-311.pyc,,
@@ -89,14 +95,14 @@ review_sensei/hosting/github/__pycache__/session_ledger.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/setup.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/trigger.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/webhooks.cpython-311.pyc,,
-review_sensei/hosting/github/application.py,sha256=jjAgvwFGGiamKqzRv-uhh0uCKTRcyVPXaIgTZQwELHE,73285
-review_sensei/hosting/github/approval.py,sha256=IUis72xMRJEwKYejnNmViZnHel_98yNLvxhkhP1pAbQ,20125
+review_sensei/hosting/github/application.py,sha256=rLv3dNtECUzOU4zFvGHxvG8Rc-eX3Wi3i_ZS59Sm2sg,76013
+review_sensei/hosting/github/approval.py,sha256=n8GQlELM_7AHzxvtIJEytQRUUnCdAndWtniHjm3SGkQ,21051
 review_sensei/hosting/github/auth.py,sha256=koITagUX9piVboGJ_smEhPsCf4rOQkOqqSKeLKvFRbc,19055
 review_sensei/hosting/github/broker.py,sha256=FFC7DsFhzy1tENXTCmLNuYzX2cHaYsgMkDGwXEcJaTU,18014
-review_sensei/hosting/github/broker_client.py,sha256=TfA4NNW-I0gvd-Q122xfIY5pHmJp_rzbGYzJEsN77t8,16607
+review_sensei/hosting/github/broker_client.py,sha256=clm_eInRSUg9MI6fxl_QfhUBGJglgy4pKB65FCwpv-k,16903
 review_sensei/hosting/github/checks.py,sha256=7jdUkaHO9UzpeBn8WLhrT-PSz4W6tHVOFU00zXgQbPY,17481
 review_sensei/hosting/github/conversation.py,sha256=Jg-H3xtEg5TpBujA8271IlCfIxpvkG1r54a7PfNTGrc,63578
-review_sensei/hosting/github/errors.py,sha256=K5Lfsh4uzuAW6tER2l7pcEM4Lz6FwGEmMPxvF1vNc4E,5352
+review_sensei/hosting/github/errors.py,sha256=KUGHSn1Udl4vVCKPWQ6NfkRmGSQ2YZVhPbyyJdBh63o,5826
 review_sensei/hosting/github/fixtures/__init__.py,sha256=2sBygkvppFJ6F8KV1_MDmbBNl7Yd0oPvYOFG6R_NOpA,82
 review_sensei/hosting/github/fixtures/__pycache__/__init__.cpython-311.pyc,,
 review_sensei/hosting/github/fixtures/historical-v4-uninstall.yml,sha256=VrX1XpTrOlqscHDoJM_yRKwbP-cvcFvnG79G3HTO3hY,2664
@@ -104,23 +110,25 @@ review_sensei/hosting/github/fixtures/merge-focused-v4-caller.yml,sha256=EGs0F3O
 review_sensei/hosting/github/fixtures/merge-focused-v4-config.yml,sha256=4L1UvSucMGJqPh_OwmPgq_lE-nenySkIg7Xogtmk7Us,464
 review_sensei/hosting/github/fixtures/released-v4-resolve-trigger-runner-switch.yml,sha256=09um6w5QmIodLMrbR10z4gdZ3f5AaVj7eqjhQzOfkV8,16194
 review_sensei/hosting/github/http.py,sha256=6Dz9S-U4M07KehE7FhjNyrBt_XKKz4Dnp6zULMFKHk0,8943
+review_sensei/hosting/github/human_assessment.py,sha256=gpnTM8xMnnrPsHjw2aQQIYATZasfbZLyFY3f2jUZJrQ,13438
 review_sensei/hosting/github/jwt.py,sha256=mTakXBxU-GR-hBnIZE-FryfFXwpS9hJ7qb3X7P0FBMo,4582
 review_sensei/hosting/github/learning_pr.py,sha256=hT7FmmpWCnUO5WCQEmP9XioQiceNALxuJCtcZXAQxSU,112424
 review_sensei/hosting/github/observed.py,sha256=Sk0J_kfTBS1je6_YI5-HgGE266zv0_JP1CfvaR7X_zY,36461
 review_sensei/hosting/github/oidc.py,sha256=h3UVcBYQIKy-xQS7Ixv3_fy670mmuBoNKSYurPZWZ60,13310
-review_sensei/hosting/github/publication.py,sha256=aUIObKlD2T4Y4kNCmm4AUquZF3AjIFleE9D6eI7u1tQ,101777
+review_sensei/hosting/github/publication.py,sha256=aruNXWQ0y1y4fShJJKGxOqDNpb5y5d2knVvU-RpzVQc,103398
 review_sensei/hosting/github/session_ledger.py,sha256=DZgLY-fP1SMjsQh55k7DsEEdEdPh-72uGEezCjePP9s,31131
 review_sensei/hosting/github/setup.py,sha256=5L3O3gZ7CMbFPKj37XKq33hpj59Gx0pCr1B5c7CTKgI,119022
 review_sensei/hosting/github/trigger.py,sha256=7jwSWoFU5VsJ1XUhhEEgne9-pA6zaHyYJ_BVlMcqlsI,10434
 review_sensei/hosting/github/webhooks.py,sha256=7hh_YlF7riV6wov7A_27aOb5g6-Ivob1PBWR4m5bF3I,13662
 review_sensei/hosting/openrouter_workflow.py,sha256=qepVpa12sL6mTaBqTGhcWEaYI8zawcgAYK6sOCRnKtE,1330
+review_sensei/human_assessment.py,sha256=mzP92oPBlV7-OVweb0IdCNFatZXCCIt2i2leCY6MSt0,13540
 review_sensei/learnings.py,sha256=AF9Dqyreb9WQLWLZiciuyRXNviSso6sYVTe2xzx1ZfY,21434
 review_sensei/models.py,sha256=gT5E-4YL7y763xwszpFbQGiqONGTF3Tjb_b6LZPADMk,93081
 review_sensei/openrouter_qualification.py,sha256=UKUL8oK8oexX1P_othR3y_QAAW0PG2EdAYnWXA-ACZI,30296
-review_sensei/outcomes.py,sha256=xFAwYck3XkmSyqY9Hqd_A-aUneQCaOQ1Iui_49rVw28,34002
+review_sensei/outcomes.py,sha256=ni0WaxHGkYDMINRExljkgeP0dqSaIIps_w2jmsspIaY,35428
 review_sensei/patches.py,sha256=P9plsU7-5Z-Jxy8EJBFQX5hX3bcmxBoRJxTnEqA_tbA,15981
 review_sensei/placement.py,sha256=ABioTJwmS4bhyB1M6IdWqyGOx9j1Ge3CeYSKMk9GXSA,6607
-review_sensei/planning.py,sha256=kdT5pWKw7MWYnRFa12d46TpR3ugG4u6dis-xgUmqxFs,23516
+review_sensei/planning.py,sha256=SB1Jrq9YaTLGo9bINppO1QUN8P2k6ILPYr1fUmQ9GYQ,23585
 review_sensei/presentation.py,sha256=xbqLb1OcDwk0wOD_bHVBiRyfO6ZLXq5-PWGdGWG0Zl0,30226
 review_sensei/provider_config.py,sha256=y03TeL6wNsx_9KECr_AhHQkWyWOBOUMnPHzDDyL9AdQ,16382
 review_sensei/providers/__init__.py,sha256=gmfB6gm0QN_FfN3lJJ0kN8QgTtJom4ayzaqUkLmwQwc,779
@@ -146,6 +154,7 @@ review_sensei/providers/transport.py,sha256=9QhvHM33gYE7DbmXNxhfBoVDsa7Hx3audaxz
 review_sensei/release_manifest.py,sha256=a7pPhr0YVBCrzC6Q8JC4HiqTD3aBUyTYV4Y0827U5TA,37775
 review_sensei/schemas.py,sha256=DG0Z2VsZUKRaoLNquemWSsGT8XFavUy1ot-W3ADowWw,2736
 review_sensei/schemas/blocker-admission.schema.json,sha256=M3nBzti7M5yAWKFDcsfdJ3TsPbiJrEEn2Zj4yYUDBPQ,2800
+review_sensei/schemas/broker-diagnostics.json,sha256=x3f4K53EURGK2iZl93u_pU36imqFEg7RP7wK94GDHtg,21369
 review_sensei/schemas/canary-binding.schema.json,sha256=065T5GIYG16P9S22HEKrHeRg6unHu8WXedbJxwUYBgk,794
 review_sensei/schemas/candidate-finding.schema.json,sha256=P_FM6pbwdOZGZPAiI_E_ZSmxDfScu2u_2RPzpkdIdmk,1982
 review_sensei/schemas/channel-promotion.schema.json,sha256=LNQgvm6IxntfXrpEnoVz4aL_7_ALo8syiVYEFrfxHYw,1085
@@ -153,7 +162,7 @@ review_sensei/schemas/compatibility-manifest.schema.json,sha256=RIsEo5Os6obelQ07
 review_sensei/schemas/concurrency-plan.schema.json,sha256=YtHPlfShzFPLE4sQMEn7TogW3souwiKC6d4yd-kgFRY,830
 review_sensei/schemas/convergence-sequence-report.schema.json,sha256=e5T1QEepf8k3Zaoilfekt8-Wes9yol8FuHXe8VOAkEU,2412
 review_sensei/schemas/conversation-reply.schema.json,sha256=bKHxO1CX_g_VrWDb1e0GKPGIUzMPORchHqrT805yPXA,682
-review_sensei/schemas/coverage-manifest.schema.json,sha256=rrbvq1YYNt-c4YPLmdmrzWo_Au-rDu-e35eg3NdZzQQ,2765
+review_sensei/schemas/coverage-manifest.schema.json,sha256=WEyGaJVs9ptF_TDX7CkU5-dkQ6uhfz8Jelsw3vkMB1Q,2901
 review_sensei/schemas/evaluation-corpus.schema.json,sha256=0W3-zgmVFa5AjDSs385szKNt4DX_D_ZdrE9ur3Nrnz0,7905
 review_sensei/schemas/evaluation-report.schema.json,sha256=kPLXcJv3XeRFNW__VnQzrnovXHaKfS4-ZevfLDgV1xY,10012
 review_sensei/schemas/later-finding-classification.schema.json,sha256=YxsogG9aN4Kbm7__lJpvhOMBbuRe8NbDKS4GnJf4Kl4,2092
@@ -177,8 +186,8 @@ review_sensei/schemas/stage.schema.json,sha256=WsxbwZFGpRNCyZ6xzWsAQHf8f7YpJLAh9
 review_sensei/schemas/verification-result.schema.json,sha256=Hf765S-aC1Tk4c7KMWaaSf5DMsg6ogmjnHXcjcHE01k,625
 review_sensei/schemas/verification-scope.schema.json,sha256=402Q7OiLHnb41lwb5JkVoKUpCe19fMV9hVhTjsenLFo,2141
 review_sensei/sequence.py,sha256=Mc3ejY8Cmo7xASNAo2vfep9rILb3BgnzH8T9rw8xjRY,23746
-review_sensei/service.py,sha256=wfU84eab9uXH-ph3JYxcUGWni6oKy1pRLnySqu-thVc,70808
-review_sensei/session.py,sha256=kcUqQZsEk3_QPrsn0n5293Um7tMopjBvylOehfh6tCQ,124506
+review_sensei/service.py,sha256=B5ld08iQa6A_770zio1g5ejQ_-a41Q16JCYZh8bnVbs,73541
+review_sensei/session.py,sha256=y_RC3zhmSLtT18yP11b-hN1qjjreyyvOttq7-X4Z3rs,126590
 review_sensei/stages.py,sha256=rMomi3dvKrEl3yiuy2VbX09_bLu8dWD2rblFH8aJ6yI,24256
 review_sensei/validation.py,sha256=euLaI7cxwTCxcpNRh-F8zGz0BQu8GMG3cA3_1_wtdkU,12390
 review_sensei/verifier.py,sha256=_6cbaoXj8R9hatM7fZav-BgfkSPRyJ4ASmQlZbxF5HA,34913

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@reviewsensei/cli-win32-x64",
-  "version": "0.6.12",
-  "description": "ReviewSensei native CLI for Windows x64",
+  "version": "0.6.15",
+  "description": "ReviewSensei AI code review engine for Windows x64; native payload used by @reviewsensei/cli",
   "license": "MIT",
   "repository": {
     "type": "git",