@tokenfactory/acc-runner 0.44.1 → 0.44.2

package/dist/runtime/reviewer.js

@@ -15,10 +15,11 @@
  * cron's poll-merge loop can advance.
  */
 import { execa } from "execa";
-import { priceUsdCents, normalizeUsage, modelFallbackChain, } from "../cost-pricing.js";
+import { priceUsdCents, normalizeUsage, modelFallbackChain, toReviewerApiId, toReviewerCliAlias, } from "../cost-pricing.js";
 import { extractResetTime, isReviewerAuthFailure, isEnvBrokenReviewerProbe, } from "../failure-classifier.js";
 import { buildEnv } from "../bin-resolve.js";
-import { getEngine } from "../engines/registry.js";
+import { engineIds, getEngine } from "../engines/registry.js";
+import { resolveCodexSpawnMode } from "../engines/codex.js";
 import { ensureRepoClone } from "./clone-cache.js";
 import { prepareReviewWorktree, ReviewFetchError } from "./worktree.js";
 import { isEmptyReviewDiff } from "../review-diff-guard.js";
@@ -29,6 +30,28 @@ import { describePromptRenderBleed, findPromptRenderBleed, substitutePlaceholder
 import { abstainReasons, describeAbstainForLog, } from "./reviewer-abstain.js";
 import { chargeReviewAttempt, classifyReviewCost, openReviewCostContext, reviewCostLedger, reviewCostOverrunReason, reviewCostRunawayReason, } from "./review-cost-cap.js";
 import { classifyTeardownFailure } from "../review-worktree-cleanup.js";
+import { failureDiagnostics } from "../output-diagnostics.js";
+/** Stable marker keying every reviewer tooling-failure reason (mirrors
+ *  TOOLING_FAILURE_MARKER in api/_lib/review-retry.ts — the runner is a
+ *  standalone package and cannot import from api/_lib). // keep in sync */
+const REVIEWER_TOOLING_FAILURE_MARKER = "reviewer tooling failure:";
+const REVIEWER_UNRESOLVABLE_ENGINE_REASON = `${REVIEWER_TOOLING_FAILURE_MARKER} assigned runner could not resolve the ` +
+    "task's agent engine. This is fleet configuration infra, not a review " +
+    "verdict; review budget untouched.";
+/* The stamp above is for OPERATOR legibility, not for correctness. The server's
+ * MARKER classifier (isUnresolvableEngineReviewerOutcome in api/_lib/review-retry.ts)
+ * matches ONLY this marker — it deliberately does NOT free-text-match the raw
+ * `runtime_threw: unknown agent engine:` text, so a row from an un-upgraded runner
+ * is not exempted there. Instead the capability-reset in countReviewerErrors (keyed
+ * on LEGACY_UNRESOLVABLE_ENGINE_RAW) amnesties BOTH stamped and legacy rows — but
+ * only once the fleet regains the engine (engineServedByFleet). So an
+ * already-stranded PR recovers when a codex-capable runner comes online: recovery
+ * does not wait on THIS package being republished across the fleet, but it IS
+ * conditional on the engine being served again (while unserved the rows still
+ * count and strand — AC3). */
+function isUnresolvableEngineError(err) {
+    return err?.message?.startsWith("unknown agent engine:") === true;
+}
 // Byte-identical to prompts/reviewer-agent.md. The runner does not have
 // the markdown file at runtime (the package ships without prompts/) so
 // the prompt is embedded. Keep this string in sync with the markdown
@@ -78,6 +101,18 @@ export const REVIEWER_PROMPT_TEMPLATE = [
     "  (security/tenant-isolation, build/typecheck, unsafe migration, secret,",
     "  forbidden file, out-of-scope edits present in the diff).",
     "- Only approve if EVERY acceptance criterion is clearly met by the diff.",
+    "- **A LOC / line-count cap acceptance criterion is ADVISORY, not blocking (operator",
+    "  decision D-7, 2026-09-05).** An acceptance criterion whose ONLY content is a numeric",
+    '  line-count / LOC / added-lines BUDGET (e.g. "implementation additions <= 200 LOC") is',
+    "  a budget, not a behaviour. When the diff exceeds it, emit that overrun as its OWN",
+    "  reason in the EXACT machine form `loc_cap: measured=<N> limit=<M>` (nothing else in",
+    "  that reason), and approve when every OTHER acceptance criterion is met. Put every",
+    "  OTHER finding in its OWN separate reason — a forbidden file in the diff, a named",
+    "  acceptance criterion whose mechanism the diff does not implement, a defect the diff",
+    "  introduces, scope creep, a PR body whose numbers contradict the diff — those ALL",
+    "  still reject. NEVER fold a real finding into the `loc_cap:` reason: a reason that",
+    "  mixes any other clause with the overrun is NOT the cap tag and still rejects. Only a",
+    "  reason that is EXACTLY the `loc_cap:` tag is advisory.",
     "- Reject if the diff adds files outside the task's stated scope.",
     "- Reject if the diff makes changes beyond what the task asked for",
     "  (refactors, drive-by cleanups, dependency bumps that weren't requested).",
@@ -160,6 +195,46 @@ export const REVIEWER_PROMPT_TEMPLATE = [
     "  pointing at a specific part of the diff or the task spec. No prose",
     "  paragraphs. No re-stating the task.",
 ].join("\n");
+/**
+ * D-7 (operator decision, 2026-09-05): the reviewer emits a LOC/line-count cap overrun
+ * as a STRUCTURED, machine-tagged finding — a reason that is EXACTLY
+ * `loc_cap: measured=<N> limit=<M>` and nothing else — so a cap overrun is a typed
+ * object, not English the seam has to interpret. This matcher is a WHITELIST, not a
+ * blacklist: it flips only on that exact tag, anchored END TO END (^…$), so a reason
+ * that mixes any other clause — a defect, a forbidden file, a scope note, a body-vs-diff
+ * contradiction — cannot be the tag and stays a reject. Fail-CLOSED by construction:
+ * anything not positively proven the pure cap tag keeps the REJECT. A mixed finding is
+ * structurally impossible because the defect half is its OWN separate, untagged reason.
+ */
+const LOC_CAP_TAG_RE = /^\s*loc_cap:\s*measured=(\d+)\s+limit=(\d+)[.\s]*$/i;
+export function isLocCapAdvisoryReason(reason) {
+    return LOC_CAP_TAG_RE.test(reason ?? "");
+}
+/** Render the machine tag into an operator-legible advisory line (measured/limit kept
+ *  visible), or return the reason unchanged when it is not a cap tag. */
+export function renderLocCapAdvisory(reason) {
+    const m = LOC_CAP_TAG_RE.exec(reason ?? "");
+    return m
+        ? `LOC-cap advisory (D-7): implementation additions ${m[1]} exceed the ${m[2]}-line ` +
+            `budget — recorded, not blocking.`
+        : reason;
+}
+/**
+ * D-7: reduce a reviewer verdict under the cap-advisory rule. A `reject` whose EVERY
+ * substantive reason is the pure `loc_cap:` tag is not a rejection — it becomes an
+ * `approve` that STILL carries the measured overrun (rendered) in `reasons`. Any reason
+ * that is not exactly the tag — a defect, forbidden file, unmet AC, body mismatch, scope
+ * creep, or even a cap stated in free prose — keeps the reject (fail-closed). A
+ * non-reject verdict is returned untouched.
+ */
+export function applyLocCapAdvisory(verdict) {
+    if (verdict.decision !== "reject")
+        return verdict;
+    const substantive = (verdict.reasons ?? []).filter((r) => r && r.trim());
+    if (substantive.length === 0 || !substantive.every(isLocCapAdvisoryReason))
+        return verdict;
+    return { ...verdict, decision: "approve", reasons: verdict.reasons.map(renderLocCapAdvisory) };
+}
 /* ──────── RF-1 (NOT-IMPLEMENTED-CARVE-OUT): completion-signal scoping ────────
  *
  * The reviewer prompt's completion-negative rule used to fire on the WHOLE PR
@@ -441,9 +516,9 @@ export function truncationInfraNote(omitted, partialFile = null, reordered = fal
 const RETRY_DELAYS_MS = [2000, 4000, 8000];
 /* ───────────────── REVFB (G1): in-process capacity retry/backoff ────────────
  *
- * A `reviewer_capacity` outcome (Claude-subscription 429 / momentary brownout)
+ * A `reviewer_capacity` outcome (engine subscription 429 / momentary brownout)
  * is often transient. Rather than immediately yielding reviewer_capacity — which
- * pauses the WHOLE runner via watch.ts until a resume timer fires — we retry the
+ * pauses review claims via watch.ts until a resume timer fires — we retry the
  * claude spawn IN-PROCESS a bounded number of times with exponential backoff,
  * but ONLY for a brownout with no stated reset time. A hard session cap (which
  * carries a "resets <time>" reset instant) is yielded immediately, since there
@@ -919,21 +994,126 @@ async function cleanupReviewTree(tree, supabase, assignment) {
         await emitReviewWorktreeOrphaned(supabase, assignment, tree.path ?? "", result);
     }
 }
-// M2 (ENGINE-EXTRACT): the coding engine the reviewer drives. Wave 1 fixed
-// this to a single module-level `claude-code` constant — spawn/argv/result-
-// parse/failure-class behavior was byte-identical to the pre-refactor inline
-// logic now owned by src/engines/claude-code.ts. buildEnv() is the reviewer's
-// base env (mirrors v0.74-B): the engine forwards ANTHROPIC_API_KEY over it
-// when set.
+// M2 (ENGINE-EXTRACT): the coding engine the reviewer drives. buildEnv() is the
+// reviewer's base env (mirrors v0.74-B): the engine forwards provider auth over
+// it when set.
 //
-// NS MM-2 (BATCH-ENGINE-DISPATCH): the reviewer now resolves the engine PER
-// REVIEW from the reviewed task's `engine` column (`driveReview` below), so it
-// drives the same CLI the runner built the PR with instead of always assuming
-// claude-code. `getEngine(id)` defaults to claude-code on a null/blank id —
-// unstamped/pre-MM-1 rows are byte-identical to Wave 1.
+// CROSS-ENGINE-REVIEW-1: the reviewed task's engine is now only the AUTHORING
+// engine. The reviewer engine is selected from an org policy per review, with a
+// default that prefers a different provider family but advances to the next
+// local engine when the preferred provider is capacity-blocked.
 function defaultSpawnClaude(modelId, engine) {
     return engine.spawn({ modelId, baseEnv: buildEnv() });
 }
+export const DEFAULT_REVIEWER_ENGINE_SELECTION_POLICY = "prefer_different_family";
+function engineFamily(engineId) {
+    const id = engineId.trim().toLowerCase();
+    if (id.startsWith("claude"))
+        return "anthropic";
+    if (id.startsWith("codex"))
+        return "openai";
+    if (id.startsWith("gemini"))
+        return "google";
+    return id;
+}
+export function resolveReviewerEngineSelectionPolicy(policy) {
+    const raw = policy && typeof policy === "object"
+        ? policy.reviewer_engine_policy
+        : null;
+    return raw === "prefer_same_family" || raw === "capacity_first" || raw === "prefer_different_family"
+        ? raw
+        : DEFAULT_REVIEWER_ENGINE_SELECTION_POLICY;
+}
+function uniqueEngineIds(ids) {
+    const out = [];
+    for (const id of ids) {
+        const v = id.trim().toLowerCase();
+        if (v && !out.includes(v))
+            out.push(v);
+    }
+    return out;
+}
+export function selectReviewerEngineIds(authorEngine, policy, availableEngineIds = engineIds()) {
+    const resolvedPolicy = resolveReviewerEngineSelectionPolicy(policy);
+    const authorId = (authorEngine ?? "").trim().toLowerCase() || "claude-code";
+    const authorFamily = engineFamily(authorId);
+    const available = uniqueEngineIds(availableEngineIds);
+    // FAIL CLOSED: an empty available set is a FAILURE (the runner advertised no
+    // engine, or the capability probe failed), not a licence to route to the author
+    // engine anyway — that would review on an engine the assigned runner may not be
+    // able to spawn. Yield NO candidate; runReview then surfaces a no-route infra
+    // error instead of dispatching blind.
+    if (available.length === 0)
+        return { engineIds: [], policy: resolvedPolicy };
+    const same = available.filter((id) => engineFamily(id) === authorFamily);
+    const different = available.filter((id) => engineFamily(id) !== authorFamily);
+    const ordered = resolvedPolicy === "prefer_same_family"
+        ? [...same, ...different]
+        : resolvedPolicy === "capacity_first"
+            ? available
+            : [...different, ...same];
+    return { engineIds: ordered.length > 0 ? ordered : available, policy: resolvedPolicy };
+}
+/**
+ * CROSS-ENGINE-REVIEW-1 (AC10): map the org policy's single reviewer `model_id`
+ * onto the engine actually chosen for THIS review. The policy historically
+ * carries a Claude id (default 'claude-sonnet-4-6'). Cross-engine selection now
+ * routes a review to codex even when the PR was authored by Claude — so that
+ * Claude model id is meaningless to the reviewer engine and MUST NOT be pinned:
+ *
+ *   - codex → run UNPINNED (model_id → `null`) unless an OpenAI-valid id is
+ *     explicitly configured on an api-key channel (a Claude id is never valid
+ *     for codex and is always dropped to `null`).
+ *   - claude-family → keep the existing catalog fallback chain unchanged.
+ *
+ * Returning `null` tells `engine.spawn` to omit `--model`, so codex never sees
+ * `claude-sonnet-4-6` on argv.
+ */
+export function reviewerModelChain(engine, policyModelId, modelChainMax) {
+    const baseModel = policyModelId ?? "claude-sonnet-4-6";
+    if (engine.id === "codex") {
+        // ChatGPT-account Codex rejects every explicit --model, including valid
+        // OpenAI ids; and a Claude model id can never drive codex. Both collapse to
+        // a single unpinned attempt. An OpenAI-valid id on an api-key channel is the
+        // only case that pins.
+        const codexAuthMode = resolveCodexSpawnMode(buildEnv());
+        return codexAuthMode === "api-key" && !baseModel.startsWith("claude-")
+            ? [baseModel]
+            : [null];
+    }
+    // #2169 namespace split: build the fallback chain from the CANONICAL API id so
+    // a configured CLI alias ('sonnet') never lands in the recorded chain; the
+    // spawn call CLI-alias-translates each entry with toReviewerCliAlias.
+    return modelFallbackChain(toReviewerApiId(baseModel), modelChainMax);
+}
+/**
+ * CROSS-ENGINE-REVIEW-1 (AC3): resolve the assigned runner's advertised
+ * caps.engines. Prefers the explicitly-injected list (watch.ts threads the
+ * runner's ALREADY-PUBLISHED `acc.runners.caps.engines` — the value the
+ * assignment was made against), then an async `detectEngines` override, and only
+ * as a last resort falls back to the local registry (`engineIds()`). The
+ * production path always injects, so the reviewer only ever selects an engine
+ * THIS runner can spawn, never a registry entry it cannot.
+ *
+ * FAIL CLOSED: if the `detectEngines` probe THROWS we return an EMPTY set, never
+ * the full local registry. A failed capability probe is not licence to route to
+ * an engine the assigned runner never advertised; the empty set makes
+ * `selectReviewerEngineIds` yield no candidate, so the review surfaces a no-route
+ * infra error rather than silently reviewing on an unadvertised engine.
+ */
+async function resolveAdvertisedEngineIds(deps) {
+    if (deps.advertisedEngineIds)
+        return deps.advertisedEngineIds;
+    if (deps.detectEngines) {
+        try {
+            return await deps.detectEngines();
+        }
+        catch {
+            return [];
+        }
+    }
+    return engineIds();
+}
 function parseEnvelope(stdout, fallbackModel, engine) {
     const parsed = engine.parseResult(stdout);
     if (!parsed) {
@@ -962,8 +1142,8 @@ function parseEnvelope(stdout, fallbackModel, engine) {
 export async function runReview(assignment, deps) {
     const fetchMeta = deps.fetchPRMeta ?? defaultFetchPRMeta;
     const prepareTree = deps.prepareReviewTree ?? defaultPrepareReviewTree;
-    // NS MM-2: `spawnFn`'s default needs the REVIEWED task's `engine` column,
-    // which driveReview fetches — so its binding moves there instead of here.
+    // CROSS-ENGINE-REVIEW-1: `spawnFn`'s default needs the selected REVIEWER
+    // engine, which driveReview resolves from policy after it fetches the task.
     // `deps.spawnClaude` (test override) is unaffected either way.
     let outcome;
     try {
@@ -979,9 +1159,12 @@ export async function runReview(assignment, deps) {
             outcome = null;
         }
         else {
+            const runtimeReason = `runtime_threw: ${err.message?.slice(0, 200)}`;
             outcome = {
                 decision: "reviewer_error",
-                reasons: [`runtime_threw: ${err.message?.slice(0, 200)}`],
+                reasons: isUnresolvableEngineError(err)
+                    ? [REVIEWER_UNRESOLVABLE_ENGINE_REASON, runtimeReason]
+                    : [runtimeReason],
                 confidence: 0,
                 session_id: null,
                 cost_usd: 0,
@@ -1028,21 +1211,231 @@ export async function runReview(assignment, deps) {
     if (error) {
         process.stderr.write(`[acc-runner] submit_review(${assignment.review_id}) failed: ${error.message}\n`);
     }
+    // REVIEWER-SPEND-TO-COST-PIPE: emit this completed review's spend into
+    // acc.cost_events AT COMPLETION (best-effort), only when the review actually
+    // completed (submit_review did not error). See recordReviewCost.
+    if (!error) {
+        await recordReviewCost(deps.supabase, assignment.task_id, submitted.cost_usd);
+    }
+    // RUNNER-DISCARDS-STDOUT-ON-FAILURE-1: submit_review is reasons-only (frozen
+    // RPC), so preserve the captured child stdout/stderr tails of a genuine
+    // reviewer_error through the additive log_activity seam — otherwise the real
+    // failure is discarded and only the reason banner survives.
+    if (submitted.decision === "reviewer_error" &&
+        (submitted.stdout_tail || submitted.stderr_tail)) {
+        await emitReviewerErrorDiagnostics(deps.supabase, assignment, submitted);
+    }
     return submitted;
 }
+/**
+ * RUNNER-DISCARDS-STDOUT-ON-FAILURE-1 — record the credential-scrubbed,
+ * end-truncated child stdout/stderr tails of a reviewer_error on the additive
+ * `task.reviewer_error` `log_activity` verb (no RPC-signature or protocol-shape
+ * change). Best-effort: a logging failure must never turn a settled review row
+ * into a crash.
+ */
+async function emitReviewerErrorDiagnostics(supabase, assignment, outcome) {
+    try {
+        const { error } = await supabase.rpc("log_activity", {
+            p_verb: "task.reviewer_error",
+            p_target_id: assignment.task_id,
+            p_target_type: "task",
+            p_payload: {
+                review_id: assignment.review_id,
+                pr_number: assignment.pr_number,
+                model_used: outcome.model_used ?? null,
+                reasons: outcome.reasons,
+                stdout_tail: outcome.stdout_tail ?? null,
+                stderr_tail: outcome.stderr_tail ?? null,
+            },
+        });
+        if (error) {
+            process.stderr.write(`[acc-runner] task.reviewer_error log_activity(${assignment.task_id}) failed: ${error.message}\n`);
+        }
+    }
+    catch (logErr) {
+        process.stderr.write(`[acc-runner] task.reviewer_error emit failed: ${logErr.message}\n`);
+    }
+}
+/** REVIEWER-SPEND-TO-COST-PIPE: the runner's thin mirror of the api-side
+ *  emitReviewCostEvent — a call site of the shared acc.record_cost_event RPC
+ *  (model='reviewer', zero-cost skipped, best-effort), NOT shared logic (the
+ *  runner cannot import api/_lib). Exactly-once HALTed per AC7. Returns the
+ *  outcome for the runner-package test (which root CI does NOT run — see PR body). */
+export async function recordReviewCost(supabase, taskId, costUsd) {
+    const cents = Math.max(Math.round((costUsd ?? 0) * 100), 0);
+    if (cents <= 0)
+        return "skipped_zero";
+    let res;
+    try {
+        res = await supabase.rpc("record_cost_event", {
+            p_task_id: taskId,
+            p_model: "reviewer",
+            p_input_tokens: 0,
+            p_output_tokens: 0,
+            p_cache_read_tokens: 0,
+            p_cache_write_tokens: 0,
+            p_usd_cents: cents,
+            p_runner_id: null,
+        });
+    }
+    catch (err) {
+        res = { error: { message: err.message } };
+    }
+    if (res?.error) {
+        process.stderr.write(`[acc-runner] review cost-event(${taskId}) failed: ${res.error.message}\n`);
+        return "error";
+    }
+    return "emitted";
+}
 async function invokeClaude(spawnFn, modelId, prompt) {
     const spawnedAt = Date.now();
     const child = spawnFn(modelId);
-    if (child.stdin) {
-        child.stdin.write(prompt);
-        child.stdin.end();
+    const stdoutP = collectStream(child.stdout);
+    const stderrP = collectStream(child.stderr);
+    const exitP = child;
+    const delivery = await deliverReviewerPrompt(child.stdin, prompt);
+    const [stdout, stderr, exit] = await Promise.all([stdoutP, stderrP, exitP]);
+    const durationMs = Date.now() - spawnedAt;
+    const exitCode = exit.exitCode ?? null;
+    const signal = exit.signal ?? null;
+    // Clean delivery — the child's own exit is authoritative.
+    if (!delivery) {
+        return { stdout, stderr, exitCode: exitCode ?? 1, durationMs };
+    }
+    // REVIEWER-EPIPE-MASKS-THE-REAL-CHILD-EXIT — STARTUP DEATH: the child never
+    // accepted a byte (`bytesWritten === 0`) AND exited abnormally (non-zero or by
+    // signal). Only bytes_written distinguishes this from a genuine delivery break:
+    // a write that failed with NOTHING delivered means the child was already dead
+    // before it read input, so its OWN exit code / signal / stderr are the
+    // diagnosable cause and pass through here VERBATIM. Everything downstream that
+    // reads them — engine.classifyFailure, isRetriableError, extractResetTime AND
+    // the stderr_tail recorded by emitReviewerErrorDiagnostics — sees the real child
+    // signal, so the capacity class and the infra-retry ladder are decided by the
+    // child, never by a reason string (AC1/AC4). The failed write is the parent's
+    // SYMPTOM only: recorded SEPARATELY in `deliverySymptom` (appended after the
+    // child cause, never fed back into classification).
+    //
+    // A MID-WRITE break (`bytesWritten > 0`) is NOT a startup death — the child WAS
+    // reading and the pipe broke mid-stream, so the review ran on partial input and
+    // the DELIVERY failure is the reported cause (falls through below). Branching on
+    // exitCode/signal ALONE mislabelled that shape as a startup death — the exact
+    // misattribution this card removes.
+    if (delivery.bytesWritten === 0 && (exitCode !== 0 || signal !== null)) {
+        // AC4 INVARIANT: the prompt was never delivered (bytesWritten === 0), so this
+        // result MUST reach runClaudeAndDecide as a FAILURE whatever the child's exit
+        // code says. A child killed by a signal can still report exitCode 0; passing
+        // that 0 through (`?? 1` did) makes runClaudeAndDecide take the exitCode === 0
+        // path and finalizeReviewerSuccess on an undelivered prompt. `|| 1` forces a
+        // non-zero code (0/null → 1) while preserving a real non-zero exit for the
+        // retry ladder; the child's TRUE exit/signal are named in deliverySymptom.
+        return {
+            stdout,
+            stderr,
+            exitCode: exitCode || 1,
+            durationMs,
+            deliverySymptom: reviewerStartupDeathSymptom(delivery, { exitCode, signal }),
+        };
+    }
+    // The prompt never fully landed while the child was NOT dead-before-reading —
+    // it exited 0 on no/partial input, or a MID-WRITE break (bytesWritten > 0) gave
+    // it partial input. Its "success" is not a real verdict, so the delivery write
+    // is the reported cause; exitCode is forced non-zero so an exit-0 partial run is
+    // not mistaken for a verdict. The marker is PREPENDED (not appended) so it is the
+    // first-useful stderr line failureDiagnostics reports — surfacing in `reasons`
+    // (budget-exempt) even when the child had its OWN stderr, while that child stderr
+    // is still carried through for stderr_tail + classification. Prepending also keeps
+    // the stderr non-empty, so an exit-0 empty child is never misread as a silent
+    // capacity exit.
+    return {
+        stdout,
+        stderr: [reviewerPromptDeliveryFailure(delivery), stderr].filter(Boolean).join("\n"),
+        exitCode: 1,
+        durationMs,
+    };
+}
+/**
+ * REVIEWER-EPIPE — a prompt-delivery write failure when the child itself exited
+ * CLEANLY (exit 0). The review ran on no / partial input, so its "success" is not a
+ * real verdict and THIS is the one shape where the delivery write is the reported
+ * cause. Worded off bytes_written so a 0-byte failure never contradicts itself by
+ * claiming a "mid-write" break (the stdin-unavailable and bytes_written=0 cases now
+ * read "before any byte reached the child", not "mid-write ... bytes_written=0").
+ */
+function reviewerPromptDeliveryFailure(f) {
+    const phase = f.bytesWritten > 0
+        ? `mid-write (${f.bytesWritten} of ${f.promptBytes} bytes delivered)`
+        : "before any byte reached the child";
+    return (`${REVIEWER_TOOLING_FAILURE_MARKER} reviewer prompt delivery failed ${phase} ` +
+        `(mechanism=stdin_pipe, prompt_bytes=${f.promptBytes}, bytes_written=${f.bytesWritten}). ` +
+        `${f.detail.slice(0, 160)}. Review budget untouched (not a verdict).`);
+}
+/**
+ * REVIEWER-EPIPE-MASKS-THE-REAL-CHILD-EXIT — the child EXITED ABNORMALLY before it
+ * finished reading the prompt. Its OWN exit code / signal / stderr are the
+ * diagnosable cause and are passed through UNTOUCHED by invokeClaude (so the
+ * classifier, the retry ladder and the verbatim stderr_tail all see the real child
+ * signal). This line records the parent's failed stdin write SEPARATELY and
+ * explicitly as the SYMPTOM that first surfaced the death — never in place of the
+ * child stderr. It is appended to the outcome reasons AFTER the child cause and
+ * carries the tooling-failure marker so the row stays budget-exempt (a startup
+ * death is infra, not a verdict); it is NEVER fed back into classification.
+ *
+ * Scope of the class this names: the subset of "exited 1" reviewer_errors that are
+ * EPIPE-masked startup deaths. Rows that already carry the child's own stderr are
+ * NOT touched here. How many rows this newly names is a POST-DEPLOY measurement,
+ * carried by the follow-up card (D-1) — no count is asserted here.
+ */
+function reviewerStartupDeathSymptom(f, exit) {
+    return (`${REVIEWER_TOOLING_FAILURE_MARKER} reviewer child died at startup ` +
+        `(exit=${exit.exitCode ?? "null"}, signal=${exit.signal ?? "none"}) — the cause is the ` +
+        `child's own exit/stderr recorded above (verbatim in stderr_tail); the parent stdin write ` +
+        `is only the symptom (bytes_written=${f.bytesWritten}/${f.promptBytes}: ${f.detail.slice(0, 160)}). ` +
+        `Review budget untouched (not a verdict).`);
+}
+async function deliverReviewerPrompt(stdin, prompt) {
+    const promptBytes = Buffer.byteLength(prompt);
+    if (!stdin) {
+        return { detail: "child stdin pipe was unavailable", promptBytes, bytesWritten: 0 };
+    }
+    let bytesWritten = 0;
+    try {
+        await new Promise((resolve, reject) => {
+            const onError = (err) => {
+                stdin.off("error", onError);
+                reject(err);
+            };
+            stdin.once("error", onError);
+            stdin.write(prompt, (err) => {
+                stdin.off("error", onError);
+                if (err)
+                    reject(err);
+                else {
+                    bytesWritten = promptBytes;
+                    resolve();
+                }
+            });
+        });
+        await new Promise((resolve, reject) => {
+            const onError = (err) => {
+                stdin.off("error", onError);
+                reject(err);
+            };
+            stdin.once("error", onError);
+            stdin.end(() => {
+                stdin.off("error", onError);
+                resolve();
+            });
+        });
+        return null;
+    }
+    catch (err) {
+        return {
+            detail: err.message || String(err),
+            promptBytes,
+            bytesWritten,
+        };
     }
-    const [stdout, stderr, exit] = await Promise.all([
-        collectStream(child.stdout),
-        collectStream(child.stderr),
-        child,
-    ]);
-    return { stdout, stderr, exitCode: exit.exitCode ?? 1, durationMs: Date.now() - spawnedAt };
 }
 async function driveReview(assignment, deps, fetchMeta, prepareTree) {
     const { data, error } = await deps.supabase.rpc("fetch_task_for_runner", {
@@ -1069,12 +1462,6 @@ async function driveReview(assignment, deps, fetchMeta, prepareTree) {
             cost_usd: 0,
         };
     }
-    // NS MM-2 (BATCH-ENGINE-DISPATCH): resolve the reviewed task's engine ONCE,
-    // right after the task itself is known — mirrors task-runner.ts's
-    // per-task resolution. `getEngine(null)` (an unstamped/pre-MM-1 row)
-    // resolves the same claude-code default Wave 1 always used.
-    const engine = getEngine(task.engine ?? null);
-    const spawnFn = deps.spawnClaude ?? ((modelId) => defaultSpawnClaude(modelId, engine));
     // Look up the org's reviewer policy. The runner-side reviewer needs
     // confidence_threshold + max_cost_usd_per_review to stay consistent
     // with the cron-side gate, since the cron now just lifts the decision
@@ -1082,6 +1469,13 @@ async function driveReview(assignment, deps, fetchMeta, prepareTree) {
     const policy = deps.loadPolicy
         ? await deps.loadPolicy("")
         : await loadReviewerPolicy(deps.supabase);
+    // CROSS-ENGINE-REVIEW-1 (AC3): constrain reviewer-engine selection to the
+    // engines THIS (the assigned) runner actually advertises in caps.engines —
+    // NOT the full local registry. `resolveAdvertisedEngineIds` prefers an
+    // explicitly-injected list and otherwise re-runs the same capability probe
+    // the runner published at register time.
+    const advertisedEngineIds = await resolveAdvertisedEngineIds(deps);
+    const reviewerEngineSelection = selectReviewerEngineIds(task.engine ?? null, policy, advertisedEngineIds);
     const meta = await fetchMeta(repo, assignment.pr_number);
     // R0-D-REVIEWER-WORKSPACE-INTEGRITY: materialize the EXACT PR head before
     // forming any verdict, or fail closed. On failure we post NO verdict and emit
@@ -1141,13 +1535,86 @@ async function driveReview(assignment, deps, fetchMeta, prepareTree) {
         throw err;
     }
     try {
-        return await produceVerdict({
+        let lastCapacity = null;
+        // The engine that ACTUALLY produced the returned outcome. After a capacity
+        // fallback this is NOT engineIds[0] — recording the first candidate would make
+        // every same-vs-cross-family row in the AC4 measurement wrong whenever a
+        // fallback fired (and fallbacks are common). Set to each engine as it is tried,
+        // so it names the winning engine on success and the last-tried on a whole-chain
+        // capacity cap.
+        let reviewerEngineId = null;
+        let outcome = null;
+        const input = {
             task_description: task.description ?? "",
             acceptance_criteria: task.acceptance ?? [],
             pr_title: meta.title,
             pr_body: meta.body,
             pr_diff: tree.diff,
-        }, policy, deps, spawnFn, engine);
+        };
+        for (let i = 0; i < reviewerEngineSelection.engineIds.length; i++) {
+            const engineId = reviewerEngineSelection.engineIds[i];
+            // CAPS-ENGINES-STALE-KEYCHAIN-1 (AC12): the reviewer only selects an
+            // ADVERTISED engine, so a getEngine throw here is a caps-vs-registry SELF-
+            // INCONSISTENCY. Drop it from caps (onUnknownAdvertisedEngine) — AC12's
+            // "dropped from caps immediately" — THEN re-throw, so upstream's #2129
+            // (REVIEWER-INFRA-ERROR-BURNS-BUDGET) still stamps it as a budget-exempt
+            // tooling-failure `reviewer_error` that recovers (ns04-mm2 / riebb). Mirrors
+            // the task-runner guard: AC12 side-effect + upstream's outcome, both kept.
+            let engine;
+            try {
+                engine = getEngine(engineId);
+            }
+            catch (err) {
+                await deps.onUnknownAdvertisedEngine?.(engineId, err);
+                throw err;
+            }
+            const spawnFn = deps.spawnClaude
+                ? ((modelId) => deps.spawnClaude(modelId))
+                : ((modelId) => defaultSpawnClaude(modelId, engine));
+            const out = await produceVerdict(input, policy, deps, spawnFn, engine);
+            reviewerEngineId = engineId; // the engine this outcome actually came from
+            if (out.decision !== "reviewer_capacity") {
+                outcome = lastCapacity ? { ...out, capacity_degraded: true } : out;
+                break;
+            }
+            lastCapacity = out;
+        }
+        if (outcome === null) {
+            outcome = lastCapacity ?? {
+                decision: "reviewer_error",
+                reasons: ["no reviewer engine resolved from policy/runner caps.engines"],
+                confidence: 0,
+                session_id: null,
+                cost_usd: 0,
+            };
+        }
+        // AC4 + AC8: record WHICH engine reviewed (submit_review is frozen reasons-only;
+        // task.review_submitted carries no engine), so same-vs-cross-family outcomes are
+        // computable. Emitted AFTER the decision comes back, keyed on the engine that
+        // ACTUALLY produced it (`reviewerEngineId`) — the routing OUTCOME, never the
+        // first candidate at selection time. Additive log_activity seam, fire-and-
+        // forget. docs/acc/CROSS_ENGINE_REVIEW_MEASUREMENT.md.
+        const authorEngineId = (task.engine ?? "claude-code").trim().toLowerCase();
+        void deps.supabase
+            .rpc("log_activity", {
+            p_verb: "review.engine_selected",
+            p_target_id: assignment.task_id,
+            p_target_type: "task",
+            p_payload: {
+                pr_number: assignment.pr_number,
+                review_id: assignment.review_id,
+                policy: reviewerEngineSelection.policy,
+                author_engine: authorEngineId,
+                author_family: engineFamily(authorEngineId),
+                reviewer_engine: reviewerEngineId,
+                reviewer_family: engineFamily(reviewerEngineId ?? ""),
+                cross_family: engineFamily(reviewerEngineId ?? "") !== engineFamily(authorEngineId),
+                candidate_engines: reviewerEngineSelection.engineIds,
+                advertised_engines: advertisedEngineIds,
+            },
+        })
+            .then?.(undefined, () => undefined);
+        return outcome;
     }
     finally {
         // Remove the dedicated review worktree so it can never become a stale
@@ -1434,9 +1901,18 @@ function finalizeReviewerSuccess(stdout, modelId, degraded, costCtx, engine) {
             cost_breakdown: ledger,
         };
     }
-    return {
+    // D-7 (2026-09-05): a reject whose ONLY reasons are pure LOC-cap advisories is
+    // not a rejection — flip to approve, keeping the measured overrun in `reasons`.
+    // The prompt already instructs the model to do this; the guard makes the operator
+    // decision deterministic. Conservative: a single non-cap reason keeps the reject,
+    // so the reviewer's bias-to-reject is untouched for every other finding.
+    const adjudicated = applyLocCapAdvisory({
         decision: decision.decision,
         reasons: decision.reasons,
+    });
+    return {
+        decision: adjudicated.decision,
+        reasons: adjudicated.reasons,
         confidence: decision.confidence,
         session_id: envelope.session_id,
         cost_usd: envelope.cost_usd,
@@ -1462,10 +1938,15 @@ function finalizeReviewerSuccess(stdout, modelId, degraded, costCtx, engine) {
  */
 async function runClaudeAndDecide(prompt, policy, deps, spawnFn, engine, costCtx) {
     const sleepFn = deps.sleep ?? defaultSleep;
-    const baseModel = policy?.model_id ?? "claude-sonnet-4-6";
     const maxCapacityRetries = resolveCapacityRetries(process.env[CAPACITY_RETRIES_ENV]);
-    const chain = modelFallbackChain(baseModel, deps.modelChainMax ?? DEFAULT_MODEL_CHAIN_MAX);
-    const primaryModel = chain[0] ?? baseModel;
+    // CROSS-ENGINE-REVIEW-1 (AC10): map policy.model_id onto the SELECTED reviewer
+    // engine. For codex this drops a Claude id (e.g. 'claude-sonnet-4-6') to an
+    // unpinned run so the reviewer engine never receives a foreign model id;
+    // Claude keeps its catalog fallback chain (built from the CANONICAL API id via
+    // toReviewerApiId — the #2169 namespace split — and CLI-alias-translated only
+    // at the spawn call inside the loop). See `reviewerModelChain`.
+    const chain = reviewerModelChain(engine, policy?.model_id, deps.modelChainMax ?? DEFAULT_MODEL_CHAIN_MAX);
+    const primaryModel = chain[0] ?? `${engine.id}-default`;
     // RVU-2: optional env-broken CLI-auth PREFLIGHT canary. A broken login /
     // rejected key is caught BEFORE spawning the reviewer against a dead
     // credential, so it never loops as a spurious reviewer_error.
@@ -1484,10 +1965,15 @@ async function runClaudeAndDecide(prompt, policy, deps, spawnFn, engine, costCtx
     let lastCapacityDetail = "reviewer capacity exhausted across all fallback tiers";
     let lastResumeMs = null;
     for (let i = 0; i < chain.length; i++) {
-        const modelId = chain[i];
+        // `modelId` is the CANONICAL id recorded on every outcome / cost row below.
+        const modelId = chain[i] ?? `${engine.id}-default`;
+        // Alias→CLI translation is one-way, for the spawn call ONLY — never recorded.
+        // Codex passes its own id (or null, its unpinned default) straight through;
+        // Claude spawns the CLI alias derived from the canonical id.
+        const spawnModelId = chain[i] === null || engine.id === "codex" ? chain[i] : toReviewerCliAlias(modelId);
         const isLast = i === chain.length - 1;
-        const invokeResult = await invokeReviewerModel(spawnFn, modelId, prompt, sleepFn, maxCapacityRetries, engine);
-        const { stdout, exitCode, stderr: claudeStderr, durationMs } = invokeResult;
+        const invokeResult = await invokeReviewerModel(spawnFn, spawnModelId, prompt, sleepFn, maxCapacityRetries, engine);
+        const { stdout, exitCode, stderr: claudeStderr, durationMs, deliverySymptom } = invokeResult;
         if (exitCode === 0) {
             return finalizeReviewerSuccess(stdout, modelId, modelId !== primaryModel, costCtx, engine);
         }
@@ -1527,6 +2013,7 @@ async function runClaudeAndDecide(prompt, policy, deps, spawnFn, engine, costCtx
                 session_id: null,
                 cost_usd: 0,
                 resume_at: lastResumeMs !== null ? new Date(lastResumeMs).toISOString() : null,
+                engine: engine.id,
                 model_used: modelId,
                 capacity_degraded: true,
                 cost_cap: costCtx.cap,
@@ -1535,16 +2022,30 @@ async function runClaudeAndDecide(prompt, policy, deps, spawnFn, engine, costCtx
         }
         // Genuine error (task_error / usage_limit) — legacy reviewer_error, no
         // re-route (a lower tier would just repeat the failure/cost).
+        const diagnostics = failureDiagnostics({
+            exitCode,
+            stdout,
+            stderr: claudeStderr,
+            detail: classified.detail,
+            label: engine.id,
+        });
+        // REVIEWER-EPIPE-MASKS-THE-REAL-CHILD-EXIT — the child cause is already named by
+        // `diagnostics` (its first-useful stderr line) and its FULL stderr is preserved
+        // verbatim in stderr_tail. When a startup-death write symptom was recorded, append
+        // it AFTER the child cause: it names the masked exit/signal, labels the parent
+        // write a symptom, and carries the tooling marker so the row is budget-exempt.
+        const reasons = deliverySymptom
+            ? [...diagnostics.reasons, deliverySymptom]
+            : diagnostics.reasons;
         return {
             decision: "reviewer_error",
-            reasons: [
-                `claude exited ${exitCode}`,
-                ...(claudeStderr ? [`stderr: ${claudeStderr.slice(0, 200)}`] : []),
-            ],
+            reasons,
             confidence: 0,
             session_id: null,
             cost_usd: 0,
             model_used: modelId,
+            stdout_tail: diagnostics.stdoutTail,
+            stderr_tail: diagnostics.stderrTail,
         };
     }
     // Unreachable in practice (chain always has ≥1 entry): a blank policy model