@reviewsensei/cli-win32-x64 0.6.13 → 0.6.16

package/README.md

@@ -7,7 +7,7 @@ standalone Python engine bundled for Windows x64.
 Install the public launcher, which selects the matching native package:
 
 ```console
-npm install --save-dev @reviewsensei/cli@0.6.13
+npm install --save-dev @reviewsensei/cli@0.6.16
 npx review-sensei --help
 ```
 

package/bin/_internal/jsonschema-4.26.0.dist-info/RECORD

@@ -1,4 +1,4 @@
-../../Scripts/jsonschema.exe,sha256=u_Ortq6pKWDsrFIYdfQaYkW9mWdEFd-I0Nw-ihHnDC8,108352
+../../Scripts/jsonschema.exe,sha256=n20gzvsTit0hsx6gPk_EMXiTMmD5gcbXhqeu3dS3JbI,108352
 jsonschema-4.26.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
 jsonschema-4.26.0.dist-info/METADATA,sha256=BbGJhmypipbaOTS_a4NofO0_-FMlJzt34WtwX22LJtI,7592
 jsonschema-4.26.0.dist-info/RECORD,,

package/bin/_internal/review_sensei/schemas/broker-diagnostics.json

@@ -0,0 +1,412 @@
+{
+  "broker_capability_invalid": {
+    "stage": "request_validation",
+    "action": "check_request",
+    "hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
+  },
+  "broker_content_length_required": {
+    "stage": "request_validation",
+    "action": "check_request",
+    "hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
+  },
+  "broker_cors_not_supported": {
+    "stage": "request_validation",
+    "action": "check_request",
+    "hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
+  },
+  "broker_event_rejected": {
+    "stage": "workflow_identity",
+    "action": "check_workflow",
+    "hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
+  },
+  "broker_installation_unavailable": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "broker_invalid_request": {
+    "stage": "request_validation",
+    "action": "check_request",
+    "hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
+  },
+  "broker_ledger_invalid": {
+    "stage": "broker_ledger",
+    "action": "contact_operator",
+    "hint": "The broker ledger could not complete validation. Retry later; if it persists, ask the broker operator to inspect ledger health."
+  },
+  "broker_ledger_unavailable": {
+    "stage": "broker_ledger",
+    "action": "contact_operator",
+    "hint": "The broker ledger could not complete validation. Retry later; if it persists, ask the broker operator to inspect ledger health."
+  },
+  "broker_payload_too_large": {
+    "stage": "request_validation",
+    "action": "check_request",
+    "hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
+  },
+  "broker_rate_limited": {
+    "stage": "broker_admission",
+    "action": "retry_later",
+    "hint": "The broker rejected admission or replay. Wait before starting a fresh run; do not reuse an OIDC token."
+  },
+  "broker_replay": {
+    "stage": "broker_admission",
+    "action": "retry_later",
+    "hint": "The broker rejected admission or replay. Wait before starting a fresh run; do not reuse an OIDC token."
+  },
+  "broker_repository_rejected": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "broker_request_invalid": {
+    "stage": "request_validation",
+    "action": "check_request",
+    "hint": "The broker request was not accepted. Use the supported released CLI/workflow and valid bounded request fields."
+  },
+  "broker_runner_rejected": {
+    "stage": "workflow_identity",
+    "action": "check_workflow",
+    "hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
+  },
+  "broker_session_actor_rejected": {
+    "stage": "session_validation",
+    "action": "check_session",
+    "hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
+  },
+  "broker_session_attestation_invalid": {
+    "stage": "session_validation",
+    "action": "check_session",
+    "hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
+  },
+  "broker_session_grant_invalid": {
+    "stage": "session_validation",
+    "action": "check_session",
+    "hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
+  },
+  "broker_session_grant_rejected": {
+    "stage": "session_validation",
+    "action": "check_session",
+    "hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
+  },
+  "broker_session_head_rejected": {
+    "stage": "session_validation",
+    "action": "check_session",
+    "hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
+  },
+  "broker_session_invalid": {
+    "stage": "session_validation",
+    "action": "check_session",
+    "hint": "Session scope, head, actor or grant was not accepted. Refresh the pull request head and start a fresh supported workflow run."
+  },
+  "broker_unknown": {
+    "stage": "broker",
+    "action": "contact_operator",
+    "hint": "The broker supplied no recognized reason. Use the correlation ID and run time to inspect broker logs; do not infer a cause."
+  },
+  "broker_workflow_rejected": {
+    "stage": "workflow_identity",
+    "action": "check_workflow",
+    "hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
+  },
+  "github_api_url_invalid": {
+    "stage": "broker_configuration",
+    "action": "contact_operator",
+    "hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
+  },
+  "github_app_id_invalid": {
+    "stage": "broker_configuration",
+    "action": "contact_operator",
+    "hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
+  },
+  "github_app_key_invalid": {
+    "stage": "broker_configuration",
+    "action": "contact_operator",
+    "hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
+  },
+  "github_capability_issue_failed": {
+    "stage": "capability_issuance",
+    "action": "contact_operator",
+    "hint": "GitHub capability issuance failed. Ask the broker operator to inspect the installation grant and any upstream status; preserve existing permissions."
+  },
+  "github_capability_permissions_invalid": {
+    "stage": "capability_issuance",
+    "action": "contact_operator",
+    "hint": "GitHub capability issuance failed. Ask the broker operator to inspect the installation grant and any upstream status; preserve existing permissions."
+  },
+  "github_capability_response_invalid": {
+    "stage": "capability_issuance",
+    "action": "contact_operator",
+    "hint": "GitHub capability issuance failed. Ask the broker operator to inspect the installation grant and any upstream status; preserve existing permissions."
+  },
+  "github_installation_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_lookup_failed": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_permissions_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_repositories_failed": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_repositories_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_repositories_limit": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_repository_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_token_failed": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_installation_token_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_issue_comment_forbidden": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_issue_comment_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_issue_comment_lookup_failed": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_issue_comment_response_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_path_invalid": {
+    "stage": "broker_configuration",
+    "action": "contact_operator",
+    "hint": "Broker configuration could not be used. Ask the broker operator to validate the existing configuration."
+  },
+  "github_pull_request_forbidden": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_pull_request_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_pull_request_lookup_failed": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_pull_request_response_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_repository_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_repository_lookup_failed": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_repository_response_invalid": {
+    "stage": "repository_installation",
+    "action": "check_installation",
+    "hint": "Repository or installation validation failed. Confirm the App is installed and enabled for this repository and the request targets the current pull request."
+  },
+  "github_response_invalid": {
+    "stage": "github_api",
+    "action": "contact_operator",
+    "hint": "A GitHub API response could not be used. Retry later or ask the broker operator to inspect the upstream request."
+  },
+  "github_response_too_large": {
+    "stage": "github_api",
+    "action": "contact_operator",
+    "hint": "A GitHub API response could not be used. Retry later or ask the broker operator to inspect the upstream request."
+  },
+  "github_workflow_tag_invalid": {
+    "stage": "workflow_identity",
+    "action": "check_workflow",
+    "hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
+  },
+  "github_workflow_tag_unavailable": {
+    "stage": "workflow_identity",
+    "action": "check_workflow",
+    "hint": "Workflow identity was not accepted. Confirm the supported release, workflow ref/SHA, event and runner against broker policy; do not loosen policy."
+  },
+  "oidc_actor_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_audience_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_claims_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_event_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_header_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_identity_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_issuer_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_job_workflow_ref_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_job_workflow_sha_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_jti_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_jwks_invalid": {
+    "stage": "oidc_validation",
+    "action": "retry_later",
+    "hint": "OIDC signing keys could not be used. Retry later; if it persists, ask the broker operator to inspect signing-key availability."
+  },
+  "oidc_jwks_too_large": {
+    "stage": "oidc_validation",
+    "action": "retry_later",
+    "hint": "OIDC signing keys could not be used. Retry later; if it persists, ask the broker operator to inspect signing-key availability."
+  },
+  "oidc_jwks_unavailable": {
+    "stage": "oidc_validation",
+    "action": "retry_later",
+    "hint": "OIDC signing keys could not be used. Retry later; if it persists, ask the broker operator to inspect signing-key availability."
+  },
+  "oidc_key_not_found": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_ref_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_repository_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_repository_owner_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_run_attempt_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_run_id_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_run_number_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_runner_environment_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_sha_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_signature_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_subject_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_time_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_token_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_workflow_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_workflow_ref_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  },
+  "oidc_workflow_sha_invalid": {
+    "stage": "oidc_validation",
+    "action": "check_workflow",
+    "hint": "OIDC identity validation failed. Confirm the supported released workflow and GitHub Actions OIDC configuration; start a fresh run."
+  }
+}

package/bin/_internal/review_sensei/schemas/session-record.schema.json

@@ -41,6 +41,16 @@
         {"type": "string", "pattern": "^[a-f0-9]{8,64}$"}
       ]
     },
+    "reservation_owner": {
+      "description": "Owning run from the authenticated OIDC broker; absent in legacy reservations.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["run_id", "head_sha"],
+      "properties": {
+        "run_id": {"type": "string", "pattern": "^[1-9][0-9]{0,18}$"},
+        "head_sha": {"type": "string", "pattern": "^[a-f0-9]{40}$"}
+      }
+    },
     "reserved_slot": {
       "type": ["string", "null"],
       "enum": ["initial", "verification", "failed-attempt", null]
@@ -233,6 +243,15 @@
     }
   },
   "allOf": [
+    {
+      "if": {"required": ["reservation_owner"]},
+      "then": {
+        "properties": {
+          "reservation_id": {"type": "string"},
+          "reserved_slot": {"type": "string"}
+        }
+      }
+    },
     {
       "if": {
         "required": ["transaction"],

package/bin/_internal/{review_sensei-0.6.13.dist-info → review_sensei-0.6.16.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: review-sensei
-Version: 0.6.13
+Version: 0.6.16
 Summary: Provider-neutral AI code review engine with an Ollama adapter.
 Author: Mohamad Alsabbagh
 License-Expression: MIT
@@ -136,8 +136,8 @@ Node.js 22 or newer can invoke the same Python review engine through the
 provider-neutral `@reviewsensei/cli` launcher:
 
 ```bash
-npx --yes @reviewsensei/cli@0.6.13 --version
-npx --yes @reviewsensei/cli@0.6.13 --help
+npx --yes @reviewsensei/cli@0.6.16 --version
+npx --yes @reviewsensei/cli@0.6.16 --help
 ```
 
 The launcher selects one of the five native packages (macOS arm64/x64,
@@ -240,7 +240,7 @@ broker resolves the same tag at capability exchange time and checks the
 executing workflow SHA. Moving `v5` is therefore the public cutoff action.
 The selected provider mode applies consistently to automatic pull-request
 reviews, manual reviews, learning proposals, artifacts, and authorized
-`@sensei` conversations. Cloud runs use GitHub-hosted compute; local runs use
+`@reviewsensei` conversations. Cloud runs use GitHub-hosted compute; local runs use
 the operator-controlled labeled self-hosted runner. Every generated write
 switch except automatic approval defaults to `false`; automatic approval
 defaults to `true` and requires automatic review and GitHub writes as separate
@@ -681,6 +681,32 @@ policy commit. Every other policy decision is a field of `.reviewsensei.yml`:
 requests no Variables permission and never creates the customer-owned
 `OLLAMA_API_KEY` secret.
 
+Reusable-workflow callers can optionally set `with.hosted_runner` to one
+Ubuntu-compatible Linux runner label, such as `ubicloud-standard-2` or an
+operator-owned label. Omitted and empty inputs use `ubuntu-latest`. Labels must
+contain 1-128 letters, digits, dots, underscores, or hyphens and start with a
+letter or digit; JSON arrays, runner groups, spaces, and expressions are not
+supported. The read-only bootstrap stays on `ubuntu-latest` and validates the
+input before scheduling preflight, command, and hosted-provider jobs on that
+runner. The local Ollama job keeps `[self-hosted, linux, x64, ollama]`; this
+infrastructure input does not select an inference backend or grant permissions.
+ReviewSensei's own repository workflows retain their existing runner routing.
+
+After the public `v5` channel includes this input, an operator can opt a trusted
+caller into Ubicloud with its existing repository variable:
+
+```yml
+    with:
+      hosted_runner: ${{ vars.ENABLE_UBICLOUD_HOSTED == 'true' && 'ubicloud-standard-2' || 'ubuntu-latest' }}
+      # Keep the caller's existing invocation inputs and named secrets.
+```
+
+Do not add this argument to a caller of an older reusable workflow that does
+not declare it: GitHub rejects unknown workflow inputs. Updating `main` alone
+does not activate tag-pinned callers; the approved `v5` release and broker
+workflow identity must advance together. No setup variable or credential is
+created by this feature.
+
 When explicitly enabled, same-repository pull requests can run automatic review
 with either provider mode: cloud on a GitHub-hosted runner or local Ollama on
 the labelled self-hosted runner. ReviewSensei checks out only trusted base
@@ -717,7 +743,7 @@ approval. An unclassified ReviewSensei root, malformed or incomplete thread
 data, an unverified configuration, or a draft/closed/fork/stale/App-authored PR
 fails closed or reports why approval was withheld. The finalizer runs after
 review publication and after the AI resolves a blocking ReviewSensei thread;
-`@sensei` replies themselves remain ordinary comments. Existing approval markers
+`@reviewsensei` replies themselves remain ordinary comments. Existing approval markers
 prevent duplicate approvals, and ReviewSensei never calls a merge endpoint or
 enables auto-merge.
 
@@ -729,14 +755,25 @@ blocker. See
 [ADR 0032](docs/adr/0032-blocking-finding-classification-for-approvals.md)
 for the criteria and rollback path.
 
-Manual review and authorized `@sensei` replies use the same selected provider
-mode. Each authorized mention receives a temporary 👀 reaction while the reply
+Manual review and authorized `@reviewsensei` replies use the same selected provider
+mode. Generated `github reply` commands use the same inference configuration
+and CLI overrides as normal reviews, including `cloud-ollama` and
+`local-ollama`. Run from the trusted policy checkout or pass `--config` with
+its trusted configuration. A local backend receives no ambient cloud key;
+an explicitly named `--api-key-env` remains an operator opt-in.
+The canonical handle is `@reviewsensei`; `@ReviewSensei` and other ASCII case
+variants work too. `@sensei` remains supported, with its existing case behavior.
+Both handles use the same authorization, publication policy, and bounded context.
+Existing installations need a caller update as well as the matching runtime and
+broker update; see [the caller rollout guide](docs/mention-handle-rollout.md).
+
+Each authorized mention receives a temporary 👀 reaction while the reply
 is generated; ReviewSensei removes it after the reply or another terminal
 outcome. Follow-up mentions in the same inline or PR conversation include the
 bounded prior thread, diff context, findings, and trusted-base learnings. Cloud
 mode sends that bounded conversation context to Ollama Cloud; local mode keeps
 it on the configured local service. Published review summaries and inline
-findings also tell readers to reply with @sensei followed by their question.
+findings also tell readers to reply with @reviewsensei followed by their question.
 `review.json` is uploaded only when
 `github.artifacts: diagnostics` is set in `.reviewsensei.yml`; setup-v5 does not
 create a separate version artifact. See

package/bin/_internal/{review_sensei-0.6.13.dist-info → review_sensei-0.6.16.dist-info}/RECORD

@@ -1,18 +1,19 @@
-../../Scripts/review-sensei.exe,sha256=uE60sTVLVnMLNNo6KwTyy6mFFtcILJGRCvMGLM-rb04,108355
-review_sensei-0.6.13.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
-review_sensei-0.6.13.dist-info/METADATA,sha256=ko1oxiESirGixIpDSEiPhJvMq13p2N375NnXOfpZyrg,40290
-review_sensei-0.6.13.dist-info/RECORD,,
-review_sensei-0.6.13.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-review_sensei-0.6.13.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-review_sensei-0.6.13.dist-info/direct_url.json,sha256=EDhpXdSFq1qZfl2FCT07Hg2gleInjGFaAwkFy0selqU,67
-review_sensei-0.6.13.dist-info/entry_points.txt,sha256=Eki1ToC6hiOv8PMEAd2Cnbh5WWstVzzzf0XmHBHzpMQ,57
-review_sensei-0.6.13.dist-info/licenses/LICENSE,sha256=-eVBqOV92YK1K76UIcK5MrgUh0EiQMe8xNhSysQE68s,1095
-review_sensei-0.6.13.dist-info/top_level.txt,sha256=VCF4gJIJPP3MPJntoITDjMhJ8MUZfVLj-z3-VUQ9XDY,14
+../../Scripts/review-sensei.exe,sha256=yh1cysS-OZ6LJA-OEiaOZwXBUxpg-UEgTW0bt3cqBMo,108355
+review_sensei-0.6.16.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
+review_sensei-0.6.16.dist-info/METADATA,sha256=C7xbLfvCqr-1Ikv0QTFpB5dasbbivWVghNzRHGXYmbc,42555
+review_sensei-0.6.16.dist-info/RECORD,,
+review_sensei-0.6.16.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+review_sensei-0.6.16.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+review_sensei-0.6.16.dist-info/direct_url.json,sha256=EDhpXdSFq1qZfl2FCT07Hg2gleInjGFaAwkFy0selqU,67
+review_sensei-0.6.16.dist-info/entry_points.txt,sha256=Eki1ToC6hiOv8PMEAd2Cnbh5WWstVzzzf0XmHBHzpMQ,57
+review_sensei-0.6.16.dist-info/licenses/LICENSE,sha256=-eVBqOV92YK1K76UIcK5MrgUh0EiQMe8xNhSysQE68s,1095
+review_sensei-0.6.16.dist-info/top_level.txt,sha256=VCF4gJIJPP3MPJntoITDjMhJ8MUZfVLj-z3-VUQ9XDY,14
 review_sensei/__init__.py,sha256=hBA7OkQbK_oV4-fDFucVnpsnIut_JK-BbXLTznhg8ao,10524
 review_sensei/__main__.py,sha256=0iDYjdmiXNBinFF23WUyotsdpA6wFKjoB5aw3esTSRg,83
 review_sensei/__pycache__/__init__.cpython-311.pyc,,
 review_sensei/__pycache__/__main__.cpython-311.pyc,,
 review_sensei/__pycache__/baseline.cpython-311.pyc,,
+review_sensei/__pycache__/broker_diagnostics.cpython-311.pyc,,
 review_sensei/__pycache__/cli.cpython-311.pyc,,
 review_sensei/__pycache__/concurrency.cpython-311.pyc,,
 review_sensei/__pycache__/configuration.cpython-311.pyc,,
@@ -28,6 +29,7 @@ review_sensei/__pycache__/document_context.cpython-311.pyc,,
 review_sensei/__pycache__/errors.cpython-311.pyc,,
 review_sensei/__pycache__/evaluation.cpython-311.pyc,,
 review_sensei/__pycache__/hosted.cpython-311.pyc,,
+review_sensei/__pycache__/human_assessment.cpython-311.pyc,,
 review_sensei/__pycache__/learnings.cpython-311.pyc,,
 review_sensei/__pycache__/models.cpython-311.pyc,,
 review_sensei/__pycache__/openrouter_qualification.cpython-311.pyc,,
@@ -46,13 +48,14 @@ review_sensei/__pycache__/stages.cpython-311.pyc,,
 review_sensei/__pycache__/validation.cpython-311.pyc,,
 review_sensei/__pycache__/verifier.cpython-311.pyc,,
 review_sensei/__pycache__/workflow.cpython-311.pyc,,
-review_sensei/baseline.py,sha256=B8rEeAtcWDZKHmKpp1ivyKuDlyqq8W6dHInZr5sdoBM,58473
-review_sensei/cli.py,sha256=RQwX1PpFNx6yRNJRHZGwXLYldQGfnbj0dBJV1hIen7o,153581
+review_sensei/baseline.py,sha256=AeiZYZtfRiVtwt4Amnv7620W-FEZhautDIE877B88Rw,59350
+review_sensei/broker_diagnostics.py,sha256=F7BAouQwp7kqNGTtJ74RDolYmLw57HHzALvBaLXyi7E,6423
+review_sensei/cli.py,sha256=kzkaqs39q6WmWD3fNyFU8OamtWAZPtNjygmYY1zyJ90,167718
 review_sensei/concurrency.py,sha256=7nqMDNaIl7YoKafkAF1ctXu6D5SFxXosm-1407OKimQ,20097
 review_sensei/configuration.py,sha256=b2D09kp8JcMFWaC5hVRirwYI8FB--cxSpiV1EERNU4o,90145
 review_sensei/context.py,sha256=pP3GrI0WyVYyWJJHyZgVFEjizBoY2Aeh0a_frLrjvj0,101720
 review_sensei/convergence.py,sha256=ZxnHmmFLGramRrOE8IHsAvqdhK3Rd--rimfm7UJKy08,50962
-review_sensei/conversation.py,sha256=KRWtF8JnmOrOQsvAX4q-d0UzzXjNp2XeePSbyIm4_pw,7467
+review_sensei/conversation.py,sha256=eD59P1_iH4UAWtd7jQj0LaxNRqm0r1O8Jkqiy31wqoI,7473
 review_sensei/coverage.py,sha256=kJcf0MchFfrHkc-5nFhpqsx3dGGP6O8xdk6I2vNvzXk,13007
 review_sensei/default_categories/01-correctness.json,sha256=ZeTTvEavHU6_ih7JKhv8a6gH-4wRJGv0abckRWNWTfs,211
 review_sensei/default_categories/02-security.json,sha256=6mz8Hlteb9q1PouLDmDoR-1wxrN31XR2X5I9yoYiG-E,231
@@ -63,7 +66,7 @@ review_sensei/default_stages/01-default-review.json,sha256=-y9LP_8XNqEPpRN2K8z_q
 review_sensei/dependencies.py,sha256=OLNAFDMzmdtRVxex0XSpzwVVJl8jkCtUqxEk-0KohbE,5998
 review_sensei/diagnostics.py,sha256=ibG_2tI_VP4gTNM1c5XlAUAohYgSOd-5PZ-6xipbEcI,45613
 review_sensei/diff.py,sha256=na5MWhYcnRimFwGElNBiSp27Su_oufHhWiGtm1W38oY,32057
-review_sensei/disposition.py,sha256=d0nsNUKtba3UijH7X2YF7Wj5FSLdjRjE2Ni6HH0d9GI,21496
+review_sensei/disposition.py,sha256=vGzMrE5xO71bt4rBiXiPA9e267Dtn1dZAxZjkj_e7jU,22443
 review_sensei/document_context.py,sha256=NZKmt2lAOi8ICFhCemEe15-5i6M6xvh58YwiEok1q1c,20482
 review_sensei/errors.py,sha256=1-JKbLcEodjQMXleJwR-QDzRhMSFwDSe9Oc6Pg1UYmY,2901
 review_sensei/evaluation.py,sha256=kKhbcF3XpHhDYLW8e_dxGjcS0sXJpz8nXYsPpUuXnBE,59450
@@ -82,44 +85,50 @@ review_sensei/hosting/github/__pycache__/checks.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/conversation.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/errors.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/http.cpython-311.pyc,,
+review_sensei/hosting/github/__pycache__/human_assessment.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/jwt.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/learning_pr.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/observed.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/oidc.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/publication.cpython-311.pyc,,
+review_sensei/hosting/github/__pycache__/reservation_recovery.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/session_ledger.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/setup.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/trigger.cpython-311.pyc,,
 review_sensei/hosting/github/__pycache__/webhooks.cpython-311.pyc,,
-review_sensei/hosting/github/application.py,sha256=mOWRN9ABHGEJ9OPiPFYVru7JJV93uAdRgRnJDWWuBQM,74049
-review_sensei/hosting/github/approval.py,sha256=IUis72xMRJEwKYejnNmViZnHel_98yNLvxhkhP1pAbQ,20125
+review_sensei/hosting/github/application.py,sha256=HCKHl1ZQCo2CvH6jtFSCE5a25QVxW1l4BPxIoIvs6Zg,77665
+review_sensei/hosting/github/approval.py,sha256=n8GQlELM_7AHzxvtIJEytQRUUnCdAndWtniHjm3SGkQ,21051
 review_sensei/hosting/github/auth.py,sha256=koITagUX9piVboGJ_smEhPsCf4rOQkOqqSKeLKvFRbc,19055
 review_sensei/hosting/github/broker.py,sha256=FFC7DsFhzy1tENXTCmLNuYzX2cHaYsgMkDGwXEcJaTU,18014
-review_sensei/hosting/github/broker_client.py,sha256=TfA4NNW-I0gvd-Q122xfIY5pHmJp_rzbGYzJEsN77t8,16607
+review_sensei/hosting/github/broker_client.py,sha256=askIvbReTUZq9NejQansW8FBdm0jSTctdLzFbEaYSQ0,17500
 review_sensei/hosting/github/checks.py,sha256=7jdUkaHO9UzpeBn8WLhrT-PSz4W6tHVOFU00zXgQbPY,17481
-review_sensei/hosting/github/conversation.py,sha256=Jg-H3xtEg5TpBujA8271IlCfIxpvkG1r54a7PfNTGrc,63578
-review_sensei/hosting/github/errors.py,sha256=K5Lfsh4uzuAW6tER2l7pcEM4Lz6FwGEmMPxvF1vNc4E,5352
+review_sensei/hosting/github/conversation.py,sha256=wqeUlG6qpoVhaBHJB7dVg2ZqP1n6y93MjfiAq26kyGQ,68536
+review_sensei/hosting/github/errors.py,sha256=KUGHSn1Udl4vVCKPWQ6NfkRmGSQ2YZVhPbyyJdBh63o,5826
 review_sensei/hosting/github/fixtures/__init__.py,sha256=2sBygkvppFJ6F8KV1_MDmbBNl7Yd0oPvYOFG6R_NOpA,82
 review_sensei/hosting/github/fixtures/__pycache__/__init__.cpython-311.pyc,,
 review_sensei/hosting/github/fixtures/historical-v4-uninstall.yml,sha256=VrX1XpTrOlqscHDoJM_yRKwbP-cvcFvnG79G3HTO3hY,2664
 review_sensei/hosting/github/fixtures/merge-focused-v4-caller.yml,sha256=EGs0F3O7Ictx0azK07q_6Px2cMTA87mKCLnsWSyIoFY,17496
 review_sensei/hosting/github/fixtures/merge-focused-v4-config.yml,sha256=4L1UvSucMGJqPh_OwmPgq_lE-nenySkIg7Xogtmk7Us,464
 review_sensei/hosting/github/fixtures/released-v4-resolve-trigger-runner-switch.yml,sha256=09um6w5QmIodLMrbR10z4gdZ3f5AaVj7eqjhQzOfkV8,16194
+review_sensei/hosting/github/fixtures/sensei-only-v5-caller.yml,sha256=n0ZSa1lxTRSw0qsizg8m80E74VCBjkwDO5RAZy1S604,13030
 review_sensei/hosting/github/http.py,sha256=6Dz9S-U4M07KehE7FhjNyrBt_XKKz4Dnp6zULMFKHk0,8943
+review_sensei/hosting/github/human_assessment.py,sha256=0pcD2q0s825o5JLHzJzvAOtL65laOBg_4iH5BfSIWY4,16634
 review_sensei/hosting/github/jwt.py,sha256=mTakXBxU-GR-hBnIZE-FryfFXwpS9hJ7qb3X7P0FBMo,4582
 review_sensei/hosting/github/learning_pr.py,sha256=hT7FmmpWCnUO5WCQEmP9XioQiceNALxuJCtcZXAQxSU,112424
 review_sensei/hosting/github/observed.py,sha256=Sk0J_kfTBS1je6_YI5-HgGE266zv0_JP1CfvaR7X_zY,36461
 review_sensei/hosting/github/oidc.py,sha256=h3UVcBYQIKy-xQS7Ixv3_fy670mmuBoNKSYurPZWZ60,13310
-review_sensei/hosting/github/publication.py,sha256=jUh07Pg-6gk-a6cHJi7LEBmWQFFUZtg6ZQ5rPW_zVQI,102173
-review_sensei/hosting/github/session_ledger.py,sha256=DZgLY-fP1SMjsQh55k7DsEEdEdPh-72uGEezCjePP9s,31131
-review_sensei/hosting/github/setup.py,sha256=5L3O3gZ7CMbFPKj37XKq33hpj59Gx0pCr1B5c7CTKgI,119022
-review_sensei/hosting/github/trigger.py,sha256=7jwSWoFU5VsJ1XUhhEEgne9-pA6zaHyYJ_BVlMcqlsI,10434
+review_sensei/hosting/github/publication.py,sha256=fXwGXFbv9xEuBtOV2Qghivu8RHYIEB9pqBrmNouiUCE,104346
+review_sensei/hosting/github/reservation_recovery.py,sha256=rOa6bVold_eHaJxOv-7E2ZiFHWkipXtu1Jttxxkg3jk,9787
+review_sensei/hosting/github/session_ledger.py,sha256=wqIG_ixdysbom4SzF4OmM4ihf-hudjWLxGHbUNNU75Y,36225
+review_sensei/hosting/github/setup.py,sha256=Lxs1zeGy7wHBCAy1Nl8EISuPma8ZLnGRoObPPT39W6E,120115
+review_sensei/hosting/github/trigger.py,sha256=O4z65mAqgFCnrwuRqGzH5iRzf0WB-AS2VWCGsFKCo4M,10576
 review_sensei/hosting/github/webhooks.py,sha256=7hh_YlF7riV6wov7A_27aOb5g6-Ivob1PBWR4m5bF3I,13662
 review_sensei/hosting/openrouter_workflow.py,sha256=qepVpa12sL6mTaBqTGhcWEaYI8zawcgAYK6sOCRnKtE,1330
+review_sensei/human_assessment.py,sha256=Q6VeK_oQwC6BubpZJbfBVxEHrj7g_-K0JnHCNP_tpCA,18783
 review_sensei/learnings.py,sha256=AF9Dqyreb9WQLWLZiciuyRXNviSso6sYVTe2xzx1ZfY,21434
 review_sensei/models.py,sha256=gT5E-4YL7y763xwszpFbQGiqONGTF3Tjb_b6LZPADMk,93081
 review_sensei/openrouter_qualification.py,sha256=UKUL8oK8oexX1P_othR3y_QAAW0PG2EdAYnWXA-ACZI,30296
-review_sensei/outcomes.py,sha256=xFAwYck3XkmSyqY9Hqd_A-aUneQCaOQ1Iui_49rVw28,34002
+review_sensei/outcomes.py,sha256=fB1hh00OexqXv2sLh9s9QeTgz7OAKXlW5op3fhPqz2A,35470
 review_sensei/patches.py,sha256=P9plsU7-5Z-Jxy8EJBFQX5hX3bcmxBoRJxTnEqA_tbA,15981
 review_sensei/placement.py,sha256=ABioTJwmS4bhyB1M6IdWqyGOx9j1Ge3CeYSKMk9GXSA,6607
 review_sensei/planning.py,sha256=SB1Jrq9YaTLGo9bINppO1QUN8P2k6ILPYr1fUmQ9GYQ,23585
@@ -148,6 +157,7 @@ review_sensei/providers/transport.py,sha256=9QhvHM33gYE7DbmXNxhfBoVDsa7Hx3audaxz
 review_sensei/release_manifest.py,sha256=a7pPhr0YVBCrzC6Q8JC4HiqTD3aBUyTYV4Y0827U5TA,37775
 review_sensei/schemas.py,sha256=DG0Z2VsZUKRaoLNquemWSsGT8XFavUy1ot-W3ADowWw,2736
 review_sensei/schemas/blocker-admission.schema.json,sha256=M3nBzti7M5yAWKFDcsfdJ3TsPbiJrEEn2Zj4yYUDBPQ,2800
+review_sensei/schemas/broker-diagnostics.json,sha256=x3f4K53EURGK2iZl93u_pU36imqFEg7RP7wK94GDHtg,21369
 review_sensei/schemas/canary-binding.schema.json,sha256=065T5GIYG16P9S22HEKrHeRg6unHu8WXedbJxwUYBgk,794
 review_sensei/schemas/candidate-finding.schema.json,sha256=P_FM6pbwdOZGZPAiI_E_ZSmxDfScu2u_2RPzpkdIdmk,1982
 review_sensei/schemas/channel-promotion.schema.json,sha256=LNQgvm6IxntfXrpEnoVz4aL_7_ALo8syiVYEFrfxHYw,1085
@@ -174,13 +184,13 @@ review_sensei/schemas/review-round-decision.schema.json,sha256=d1GOE4RSgNRkvF35k
 review_sensei/schemas/review-stage.schema.json,sha256=H5CDiC-ngQXJpVomEvd8YPP1tgyPgwo_k3atK4Vjev0,4707
 review_sensei/schemas/review-transaction.schema.json,sha256=KWtsfa0p0CmPx--cB91XpDizF2Z6N2Ehg5YMlRqJwN8,2215
 review_sensei/schemas/run-outcome.schema.json,sha256=pyByHFmQ8yNFPsLD7wccR5lxsWBwzoxNyD77bjNqeU8,1744
-review_sensei/schemas/session-record.schema.json,sha256=b3YKz4r4-qeNcuOgCP8ntM1IByduJguZUj2q4X_lAXA,12173
+review_sensei/schemas/session-record.schema.json,sha256=YHl7NH0-nqv0D7sFJsRNIl4ryshDZV2gu1I4q3a4zdY,12814
 review_sensei/schemas/stage.schema.json,sha256=WsxbwZFGpRNCyZ6xzWsAQHf8f7YpJLAh9FKRXN_vlao,2900
 review_sensei/schemas/verification-result.schema.json,sha256=Hf765S-aC1Tk4c7KMWaaSf5DMsg6ogmjnHXcjcHE01k,625
 review_sensei/schemas/verification-scope.schema.json,sha256=402Q7OiLHnb41lwb5JkVoKUpCe19fMV9hVhTjsenLFo,2141
 review_sensei/sequence.py,sha256=Mc3ejY8Cmo7xASNAo2vfep9rILb3BgnzH8T9rw8xjRY,23746
 review_sensei/service.py,sha256=B5ld08iQa6A_770zio1g5ejQ_-a41Q16JCYZh8bnVbs,73541
-review_sensei/session.py,sha256=y_RC3zhmSLtT18yP11b-hN1qjjreyyvOttq7-X4Z3rs,126590
+review_sensei/session.py,sha256=36J9b3vF_OKThfPHve1QVUaFWvciPMUIRw56IbEXex8,129119
 review_sensei/stages.py,sha256=rMomi3dvKrEl3yiuy2VbX09_bLu8dWD2rblFH8aJ6yI,24256
 review_sensei/validation.py,sha256=euLaI7cxwTCxcpNRh-F8zGz0BQu8GMG3cA3_1_wtdkU,12390
 review_sensei/verifier.py,sha256=_6cbaoXj8R9hatM7fZav-BgfkSPRyJ4ASmQlZbxF5HA,34913

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reviewsensei/cli-win32-x64",
-  "version": "0.6.13",
+  "version": "0.6.16",
   "description": "ReviewSensei AI code review engine for Windows x64; native payload used by @reviewsensei/cli",
   "license": "MIT",
   "repository": {