@uchibeke/gallivant 0.2.0 → 0.3.0

package/lib/commands/start.mjs

@@ -1,3 +1,9 @@
+import { publicationPolicyOf } from "../work_artifacts.mjs";
+import { repositoryReviewConfig } from "../review_policy.mjs";
+import { repositoryPreflight } from "../repository_preflight.mjs";
+import { hosts } from "../hosts.mjs";
+import { assertRepositoryAccess } from "../host_contract.mjs";
+import { hostApi } from "../hosts.mjs";
 // `gallivant start <prd path>`: one brief becomes one running session in its own checkout.
 //
 // The brief arrives as a Request (lib/sources/), which already names the target repository. `start` no longer works
@@ -10,7 +16,7 @@ import { remoteInput } from "../execution_input.mjs";
 import { learningInput, learningDispatch, learningDelivered, learningDeliveryPatch } from "../learning_input.mjs";
 import { capabilitiesFor, adapterFor, buildRun } from "../harness.mjs";
 import { newEntry, entryId, STATES } from "../state.mjs";
-import { branchFor, runEnv, worktreePath } from "../git.mjs";
+import { branchFor, runSessionEnv, worktreePath } from "../git.mjs";
 import { resolveCredentialFor, describe as describeCredential } from "../credential.mjs";
 import { requireIdentity, describeIdentity } from "../identity.mjs";
 import { rememberRepo, resolveContextPaths, resolveBase, configuredBase, repoNames } from "../config.mjs";
@@ -21,6 +27,7 @@ import { requireHarness } from "../probe.mjs";
 import { criteriaFromPrd, receiptInstructions } from "../deliverable.mjs";
 import { executionRunner, EXECUTION_VERSION } from "../execution.mjs";
 import { taskExecutionConfig } from "../task_allowance.mjs";
+import { selectReviewPolicy } from "../review_policy.mjs";
 
 export async function start(ctx, options) {
   ctx = { ...ctx, config: taskExecutionConfig(ctx.config, options.task) };
@@ -37,10 +44,11 @@ export async function start(ctx, options) {
 }
 
 async function startRequest(ctx, { path, base: askedBase = null, chain = null, request: prepared = null, task = null }, progress) {
-  const { config, state, gh, git, log, runnerFor, writePrd, writeSource, readSource } = ctx;
+  const { config, state, git, log, runnerFor, writePrd, writeSource, readSource } = ctx;
+  const host = hostApi(ctx);
   // Intake supplies an immutable, repository-resolved draft snapshot. All gates,
   // source capture and dispatch ownership below remain shared with file starts.
-  const request = prepared ?? await requestFor(path, { git, gh });
+  const request = prepared ?? await requestFor(path, { git, host });
   // The gate. Every rule that applies to this source, every time, no override: a brief that fails cannot start.
   // A `context_paths:` key in the frontmatter adds to the config list for this brief alone. It is held to exactly
   // the same rules, so a PRD cannot hand a session the home directory or the Gallivant home that the config file is
@@ -57,8 +65,14 @@ async function startRequest(ctx, { path, base: askedBase = null, chain = null, r
   // and there was no second half to join it to. It is the operator's path, never the session's, so nothing a session
   // does can move it, and the daemon reads it for exactly one thing: the divergence check.
   const { repo: nameWithOwner, defaultBranch, relPath: prdRel, checkout } = request;
+  const selectedHost = (ctx.hosts ?? hosts).select(nameWithOwner);
+  repositoryReviewConfig(config, nameWithOwner, selectedHost.adapter);
+  assertRepositoryAccess(capabilitiesFor(request.harness), selectedHost.repository);
   const id = entryId(nameWithOwner, request.id);
   if (state.get(id)) throw new Error(`${id} already exists; \`gallivant why ${id}\` explains it, \`gallivant remove ${id}\` forgets it`);
+  // Pin policy before cloning or launching the author. Config edits only apply
+  // to future tasks; the explicit review policy command owns migration.
+  const reviewPolicy = ctx.reviewService ? await ctx.reviewService.preflight(nameWithOwner) : selectReviewPolicy(config, nameWithOwner);
 
   // The base branch this pull request will target, resolved once here and then carried everywhere it is needed: the
   // branch the clone is cut from, the instruction the session is given, and the branch the daemon merges in before
@@ -69,17 +83,18 @@ async function startRequest(ctx, { path, base: askedBase = null, chain = null, r
   // Intake pins the resolved base, including its original provenance. Passing
   // that frozen value must not turn a default into a persisted operator override.
   const baseSource = task?.baseSource || selection.source;
-  if (!base) throw new Error(`no base branch for ${nameWithOwner}: GitHub reported no default branch and none is configured. Set one with \`gallivant start ${path} --base <branch>\`.`);
+  if (!base) throw new Error(`no base branch for ${nameWithOwner}: the host reported no default branch and none is configured. Set one with \`gallivant start ${path} --base <branch>\`.`);
   // A base that is not on the remote must fail HERE. Left to `gh pr create --base`, it fails after the session has
   // implemented the entire brief, run the tests and spent the budget, with the work stranded on a branch nobody asked
   // for. One API call before anything is cloned is the whole cost of not doing that.
   //
   // `branchExists` returns false for HTTP404; transport/CLI failures throw a
   // bounded credential-redacted diagnostic before any clone or provider dispatch.
-  if (!await gh.branchExists(nameWithOwner, base)) {
+  if (!await host.branchExists(nameWithOwner, base)) {
     const how = baseSource === "flag" ? "--base names it" : baseSource === "config" ? `repos in config.json names it for ${nameWithOwner}` : `it is ${nameWithOwner}'s default branch`;
-    throw new Error(`base branch "${base}" is not on ${nameWithOwner} (${how}), or GitHub could not be asked. Nothing was cloned and nothing was started. Check the branch name, or run \`gh api repos/${nameWithOwner}/branches/${base}\` to see what GitHub says.`);
+    throw new Error(`base branch "${base}" is not on ${nameWithOwner} (${how}), or the host could not be asked. Nothing was cloned and nothing was started. Check the branch name and host access.`);
   }
+  if (selectedHost.adapter.features?.transportSetup) await repositoryPreflight(config, nameWithOwner, { registry: ctx.hosts ?? hosts, git, base });
   if (baseSource !== "default") log.info(`${id}: base branch ${base} (from ${baseSource === "flag" ? "--base" : "config"}), not ${nameWithOwner}'s default ${defaultBranch ?? "branch"}`);
 
   // Nothing is recorded or cloned for a harness too old to honour its adapter, or one that is signed out.
@@ -94,9 +109,9 @@ async function startRequest(ctx, { path, base: askedBase = null, chain = null, r
   // There is no checkout yet, so the host reads as github.com, which is what `gh repo clone owner/name` resolves.
   // An enterprise install is the case this cannot see from here, and `noCredentialMessage` says so by name: the
   // answer there is `github_token_file`, rather than sending a github.com token to a host it cannot authenticate.
-  const credential = await resolveCredentialFor(ctx);
+  const credential = await resolveCredentialFor(ctx, { repo: nameWithOwner });
   if (!credential.token) throw new Error(credential.why);
-  log.info(`${id}: GitHub credential from ${describeCredential(credential)}`);
+  log.info(`${id}: repository credential from ${describeCredential(credential)}`);
   // And an identity, refused here for the same reason and in the same place. A run commits as the operator, so with no
   // identity on the machine every commit the session makes would fail; refusing before the clone means no money spent.
   const identity = await requireIdentity(ctx);
@@ -117,7 +132,7 @@ async function startRequest(ctx, { path, base: askedBase = null, chain = null, r
   // The list the brief declared, which the contract rule has already proved readable, so the prompt can name the files
   // before they are snapshotted below and there is no second source of truth about what a brief carries.
   const declared = sourcePathsOf(request);
-  const prompt = startPrompt({ prd: request, repo: nameWithOwner, branch, base, verify: verifyCommands(request), receipt, carried: declared });
+  const prompt = startPrompt({ host: selectedHost.adapter.prompts, prd: request, repo: nameWithOwner, branch, base, verify: verifyCommands(request), receipt, carried: declared });
   // Read-only extras for this session: the config list plus this brief's own frontmatter, merged in one place.
   const contextPaths = resolveContextPaths(config, request);
   if (remote && contextPaths.length) throw Object.assign(new Error("hosted backend cannot enforce private read-only context_paths"), { code: "EXECUTION_POLICY" });
@@ -168,6 +183,7 @@ async function startRequest(ctx, { path, base: askedBase = null, chain = null, r
     if (remote) {
       state.validateStart(id, claim.token, chain);
       const pending = newEntry({ prd: prdRel, harness: request.harness, session: null, repo: nameWithOwner, branch, worktree, state: STATES.needsHuman, nowIso: nowIso(), checkout, prdFingerprint: prdFingerprint(request), prdDecision: prdDecision(request), base, sources: carried });
+      pending.reviewPolicy = reviewPolicy;
       // The clone is owned, but snapshot delivery and read-only API preparation
       // can still fail. Consume the claim into an actionable entry before them;
       // preserve the checkout rather than silently deleting unfinished files.
@@ -184,6 +200,8 @@ async function startRequest(ctx, { path, base: askedBase = null, chain = null, r
     // operator edits the file in the second between the two writes. Same 0o644/0o755 as the brief, because these are
     // files in a source tree and must not be clamped to daemon-state modes.
     for (const rel of carried) writeRepositoryText(worktree, rel, readSource(id, rel));
+    const hook = git.installHooks?.(worktree, publicationPolicyOf(request, { sources: carried, base }));
+    if (hook && !hook.installed) log.warn(`${id}: publication hook could not be installed (${hook.why}); coordinator publication checks remain mandatory`);
     if (carried.length) log.info(`${id}: carried ${carried.length} file${carried.length === 1 ? "" : "s"} from ${request.checkout} into the checkout`);
     if (!remote) state.validateStart(id, claim.token, chain);
     const execution = executionRunner(ctx, id, request.harness);
@@ -209,7 +227,7 @@ async function startRequest(ctx, { path, base: askedBase = null, chain = null, r
     } else {
       // Even a throwing local spawn can have created a child.
       progress.spawnAttempted = true;
-      job = await learningDispatch(ctx, id, managed, () => execution.start("start", spec.cmd, spec.args, { cwd: worktree, runtimeSettings: spec.runtimeSettings, env: { ...runEnv(config, credential, identity, worktree), ...spec.env }, execution: dispatchInput }));
+      job = await learningDispatch(ctx, id, managed, () => execution.start("start", spec.cmd, spec.args, { cwd: worktree, runtimeSettings: spec.runtimeSettings, env: runSessionEnv(spec.env, config, credential, identity, worktree), execution: dispatchInput }));
     }
 
     // `checkout` and the two prd fields are what the divergence check compares against: where the operator's copy lives,
@@ -220,6 +238,7 @@ async function startRequest(ctx, { path, base: askedBase = null, chain = null, r
       prd: prdRel, harness: request.harness, session, repo: nameWithOwner, branch, worktree, state: STATES.running, nowIso: nowIso(),
       checkout, prdFingerprint: prdFingerprint(request), prdDecision: prdDecision(request), base, sources: carried,
     });
+    entry.reviewPolicy = reviewPolicy;
     const startedEntry = { ...entry, ...(remote ? { initial_dispatch: null } : {}), ...(job.execution ? { execution: job.execution } : {}), ...(task ? { task: { ...task, run: job.id } } : {}), public_since: publicSince, ...(chain ? { chain: { name: chain.name, index: chain.index, dispatch: chain.dispatch } } : {}), last: { at: nowIso(), run: job.id, exit: null, event: "start" } };
     if (remoteRegistered) state.update(id, current => ({ ...startedEntry, ...learningDeliveryPatch(current, managed, job) }));
     else state.putStarted(id, { ...startedEntry, ...learningDeliveryPatch(null, managed, job) }, claim.token);
@@ -237,7 +256,7 @@ async function startRequest(ctx, { path, base: askedBase = null, chain = null, r
     const persistBase = baseSource === "flag" && !chain ? base : null;
     rememberRepo(nameWithOwner, config.home, persistBase);
     if (persistBase) log.info(`${nameWithOwner}: base branch ${base} recorded in ${config.home}/config.json; later starts in this repository need no --base`);
-    if (isNewRepo) await gh.ensureLabels(nameWithOwner).catch(e => log.warn(`${nameWithOwner}: labels not created: ${e.message}`));
+    if (isNewRepo) await host.ensureLabels(nameWithOwner).catch(e => log.warn(`${nameWithOwner}: labels not created: ${e.message}`));
     log.info(`${id}: started ${request.harness} session in ${worktree}`);
     return { id, worktree, branch, base, baseSource, session, run: job.id };
   } catch (error) {

package/lib/commands/status.mjs

@@ -10,6 +10,19 @@ import { chainRows } from "../chains.mjs";
 import { executionRunner } from "../execution.mjs";
 import { networkRecoveryDetail } from "../network_recovery.mjs";
 import { probeStatus } from "../probe.mjs";
+import { reviewDisclosure, reviewProgressText } from "../review_policy.mjs";
+import { repoNames } from "../config.mjs";
+import { hostGuidance } from "../host_definitions.mjs";
+
+// Registry writes include routine polling. Show an actual run/review start or
+// recorded event instead of making an idle row look newly active on each tick.
+const activityAt = (entry, run, inFlight) => {
+  const reviewStart = entry.firstPartyReview?.startedAt;
+  const times = [reviewStart, inFlight ? run?.startedAt : null, entry.activity_at, entry.last?.at, entry.created_at]
+    .map(value => value == null ? NaN : new Date(value).getTime())
+    .filter(Number.isFinite);
+  return times.length ? new Date(Math.max(...times)).toISOString() : null;
+};
 
 /**
  * The divergence for one entry, never fatal. `status` is what an operator runs when something already looks wrong, so a
@@ -44,8 +57,9 @@ export function model(ctx) {
     else if (e.state === STATES.needsHuman) { section = "needs_you"; label = "needs-human"; detail = e.reason; }
     // `gate_skipped` says the completion gate never ran, which is a different thing from passing it, and a person
     // deciding whether to merge on this line needs to be told which of the two it was.
-    else if (e.state === STATES.ready) { section = "needs_you"; label = "ready"; detail = e.gate_skipped ? `green, no blocking findings, RECEIPT NOT CHECKED (${e.gate_skipped})` : "green, no blocking findings, receipt accepted"; }
+    else if (e.state === STATES.ready) { section = "needs_you"; label = "ready"; detail = `${e.review_readiness?.note || reviewDisclosure(e)}; ${e.gate_skipped ? `RECEIPT NOT CHECKED (${e.gate_skipped})` : "receipt accepted"}`; }
     else if (e.state === STATES.done) { section = "done"; label = "done"; detail = ""; }
+    else if (e.firstPartyReview?.status === "running") { section = "running"; label = "reviewing"; detail = reviewProgressText(e); }
     // `retry` names the one GitHub write the tick is declining a step for, and it is the truest thing this row can say
     // while it is set. Without it, a start run whose identity block will not write read as "ended, settling on the next
     // tick" on every poll: the process HAD ended, and the tick was not settling it, it was retrying one write and
@@ -86,7 +100,7 @@ export function model(ctx) {
       base: e.base ?? null,
       // When the daemon last merged the base into this branch, so an operator can see the history was changed and when.
       base_merge: e.base_merge ?? null,
-      retry: e.retry ?? null, network_retry: e.network_retry ?? null, pr: e.pr, url: e.url || null, harness: e.harness, since: e.updated_at,
+      retry: e.retry ?? null, network_retry: e.network_retry ?? null, pr: e.pr, url: e.url || null, harness: e.harness, since: activityAt(e, run, inFlight),
       // `handle` rides along so a consumer can print the command that resolves it without rebuilding the handle from the
       // other fields: the tracker does exactly that, and `handleFor` is not its to know.
       divergence: divReason ? { verdict: divergence.verdict, reason: divReason, why: divergence.why, diff: divergence.diff, path: divergence.path ?? null, handle } : null,
@@ -95,6 +109,7 @@ export function model(ctx) {
     };
   });
   return {
+    repositoryGuidance: [...new Set([...repoNames(config), ...state.entries().map(([, entry]) => entry.repo)])].map(repo => ({ repo, detail: hostGuidance(repo) })).filter(r => r.detail),
     daemon: daemon ? { alive: daemon.alive, unverified: Boolean(daemon.unverified), pid: daemon.pid, startedAt: daemon.startedAt, lastTick: daemon.lastTick, nextTick: daemon.nextTick, probes: daemon.probes || {}, stale: Boolean(daemon.stale) } : null,
     latestError: log.latest(),
     chains: chainRows(ctx),
@@ -120,6 +135,7 @@ export function render(m, { all = false, clock = Date } = {}) {
     if (m.daemon.stale) lines.push("           the daemon is running code older than what is installed; its runs use the old behaviour. Restart it: gallivant down && gallivant up");
   }
   if (m.latestError) lines.push(`latest error: ${m.latestError}`);
+  for (const guidance of m.repositoryGuidance ?? []) lines.push(`${guidance.repo}: ${guidance.detail}`);
   const section = (title, rows) => {
     lines.push("", title);
     if (!rows.length) { lines.push("  (none)"); return; }

package/lib/commands/task.mjs

@@ -31,6 +31,7 @@ export async function taskCommand(ctx, { args, values, service = null, stdin = r
   const shared = { taskId: id, expectedRevision, noDaemon: values["no-daemon"] };
   if (values.context !== undefined && !["prepare", "answer"].includes(operation)) throw taskError("TASK_INPUT", "--context is supported by task prepare and task answer");
   if (values["completion-target"] !== undefined && operation !== "prepare") throw taskError("TASK_INPUT", "--completion-target is selected only at task creation");
+  for (const flag of ["delivery", "route"]) if (values[flag] !== undefined && operation !== "prepare") throw taskError("TASK_INPUT", `--${flag} is selected only at task creation`);
   if (operation === "list") return (service || createTaskService(ctx)).list();
   if (operation === "inspect") return (service || createTaskService(ctx)).inspect(shared);
   const owner = acquireCliMutation(ctx.home);
@@ -53,7 +54,10 @@ export async function taskCommand(ctx, { args, values, service = null, stdin = r
     const textArgs = first === "prepare" ? args.slice(1) : args;
     if (values.stdin && textArgs.length) throw taskError("TASK_INPUT", "use text or --stdin, not both");
     const text = textArgs.length ? textArgs.join(" ") : await stdin();
-    return await service.prepare({ text, dir: values.dir, repo: values.repo, base: values.base, harness: values.harness, context: values.context || [], requestId: values["request-id"], run: values.run, noDaemon: values["no-daemon"], verifyCommands: values.verify || [], ...(values["completion-target"] === undefined ? {} : { completion: { target: values["completion-target"] } }) });
+    // --delivery selects the typed profile action; --completion-target keeps its
+    // meaning as the profile's completion condition. Both are owner choices.
+    const delivery = values.delivery === undefined ? undefined : { action: values.delivery, ...(values["completion-target"] === undefined ? {} : { completion: values["completion-target"] }) };
+    return await service.prepare({ text, dir: values.dir, repo: values.repo, base: values.base, harness: values.harness, context: values.context || [], requestId: values["request-id"], run: values.run, noDaemon: values["no-daemon"], verifyCommands: values.verify || [], ...(values["completion-target"] === undefined ? {} : { completion: { target: values["completion-target"] } }), ...(delivery ? { delivery } : {}), route: values.route ?? null });
   }); } finally { owner.release(); }
 }
 
@@ -67,6 +71,10 @@ export function renderTask(result) {
     result.dispatchRecovery && `Dispatch recovery: inspect the clone at ${result.dispatchRecovery.worktree}; start ownership is retained`,
     result.implementation && `Implementation: ${result.implementation.id} (run ${result.implementation.run})`,
     result.completion && `Completion target: ${result.completion.target} (${result.completion.status})`,
+    result.deliveryProfile && (result.deliveryProfile.legacy ? `Delivery profile: historical task (${result.deliveryProfile.label})` : result.deliveryProfile.supported ? `Delivery profile: ${result.deliveryProfile.action} → ${result.deliveryProfile.target.repository}@${result.deliveryProfile.target.base}, completion ${result.deliveryProfile.completion.condition} (v${result.deliveryProfile.version}); no merge or deployment authority` : `Delivery profile: unsupported (${result.deliveryProfile.error?.message})`),
+    result.modelRoute && `Planner route: ${result.modelRoute.kind === "model" ? `${result.modelRoute.adapter} ${result.modelRoute.model} via ${result.modelRoute.endpointHost}` : `harness ${result.modelRoute.harness}`}; calls ${result.modelRoute.calls}; cost ${result.cost.status}${Number.isFinite(result.cost.usd) ? ` $${result.cost.usd.toFixed(4)}` : ""}`,
+    result.repositoryContext && `Repository context: ${result.repositoryContext.status}${result.repositoryContext.revision ? ` at ${result.repositoryContext.revision.slice(0, 12)} (digest ${result.repositoryContext.digest.slice(0, 12)})` : result.repositoryContext.reason ? `: ${result.repositoryContext.reason}` : ""}`,
+    result.review && `Review: revision ${result.review.revision}, digest ${result.review.digest.slice(0, 12)}, ${result.review.requirementMap.length} clauses mapped, ${result.review.questions.length} open question(s)${result.approval ? `, approved at ${result.approval.at}` : ", not yet approved"}`,
     result.daemonError,
     `Next: ${result.nextAction}`,
   ].filter(Boolean).join("\n");

package/lib/commands/up.mjs

@@ -1,3 +1,4 @@
+import { hostApi, hosts } from "../hosts.mjs";
 // `gallivant up`: the daemon. Reconciles with GitHub on boot, then ticks on a setTimeout chain so ticks never
 // overlap. Health is a file (daemon.json) that `status` reads; a second daemon exits when the first is alive.
 import { join } from "node:path";
@@ -6,7 +7,7 @@ import { openSync, closeSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { makeTick } from "../tick.mjs";
 import { checkGh, checkHarness, probeFix } from "../probe.mjs";
-import { makeProviderHealth } from "../provider_health.mjs";
+import { makeProviderHealth, coordinatorHealthLimits, scheduleProviderHealth } from "../provider_health.mjs";
 import { EXECUTION_LIMITS } from "../execution_io.mjs";
 import { readJson, writeJsonAtomic, VERSION, codeStamp, gallivantHome } from "../fs.mjs";
 import { nowIso, later } from "../time.mjs";
@@ -17,6 +18,7 @@ import { newEntry, entryId, STATES } from "../state.mjs";
 import { receiptHash } from "../deliverable.mjs";
 import { worktreePath, isOurBranch, prdIdFromBranch } from "../git.mjs";
 import { daemonPath, readDaemon, assertDaemonUsable, acquireDaemon, assertUnpinnedHome } from "../daemon.mjs";
+import { repositoryReviewConfig } from "../review_policy.mjs";
 import { repoNames } from "../config.mjs";
 
 export { daemonPath, readDaemon } from "../daemon.mjs";
@@ -54,11 +56,12 @@ export function down(ctx, { home = ctx?.home ?? gallivantHome() } = {}) {
  * the session, which the log says. Missing checkouts are recreated lazily by the tick when a run is needed.
  */
 export async function reconcile(ctx, ownLogin) {
-  const { config, state, gh, log } = ctx;
+  const { config, state, log } = ctx;
+  const host = hostApi(ctx);
   const added = [];
   for (const repo of repoNames(config)) {
     let prs;
-    try { prs = await gh.prListMine(repo); } catch (e) { log.warn(`reconcile ${repo}: ${e.message}`); continue; }
+    try { const selected = (ctx.hosts ?? hosts).select(repo); repositoryReviewConfig(config, repo, selected.adapter); prs = await host.prListMine(repo); } catch (e) { log.warn(`reconcile ${repo}: ${e.message}`); continue; }
     for (const pr of prs || []) {
       if (pr.isCrossRepository || !isOurBranch(pr.headRefName)) continue;
       if (state.findByPr(repo, pr.number)) continue;
@@ -70,15 +73,15 @@ export async function reconcile(ctx, ownLogin) {
       if (state.get(id)) { log.warn(`reconcile ${repo}#${pr.number}: id ${id} already in use, ignored`); continue; }
       try { state.assertCanRegister(id); }
       catch (e) { log.warn(`reconcile ${repo}#${pr.number}: ${e.message}, ignored`); continue; }
-      const [comments, headDate] = await Promise.all([gh.issueComments(repo, pr.number), gh.commitDate(repo, pr.headRefOid).catch(() => null)]);
-      const lastOwn = lastOwnCommentAt(comments, ownLogin);
+      const [comments, headDate] = await Promise.all([host.issueComments(repo, pr.number), host.commitDate(repo, pr.headRefOid).catch(() => null)]);
+      const lastOwn = lastOwnCommentAt(comments, host.userFor ? await host.userFor(repo) : ownLogin);
       await ensurePrdSnapshot(ctx, { id, repo, path: block.prd, ref: pr.headRefName });
       // `base` is the branch the PR targets, read off the PR rather than guessed from config: a recovered entry has to merge
       // in the branch this pull request will actually be merged into, and only GitHub knows which that is.
       const entry = newEntry({ prd: block.prd, harness: block.harness, session: block.session, repo, branch: pr.headRefName, worktree: worktreePath(config, repo, prdId), pr: pr.number, url: pr.url, state: STATES.prOpen, nowIso: nowIso(), base: typeof pr.baseRefName === "string" && pr.baseRefName ? pr.baseRefName : null });
       try { state.put(id, {
         ...entry,
-        iteration: countRounds(comments, ownLogin),
+        iteration: countRounds(comments, host.userFor ? await host.userFor(repo) : ownLogin),
         // The receipt fingerprint comes from the body `prListMine` already returned, as every other writer of this
         // cursor sets it. Left null, a receipt that was on the PR before the recovery read as a change the next time
         // a run ended, so a run that did nothing counted as a round and posted "Completion receipt updated." to the
@@ -151,15 +154,18 @@ export async function upInBackground(ctx, { bin = process.execPath, script = fil
 }
 
 export async function up(ctx, { once = false } = {}) {
-  const { home, config, gh, notify, log, clock = Date } = ctx;
+  const { home, config, notify, log, clock = Date } = ctx;
+  const host = hostApi(ctx);
   const existing = readDaemon(home);
   if (existing?.alive && existing.pid !== process.pid) throw new Error(`daemon already running (pid ${existing.pid})`);
   if (existing?.unverified) throw new Error(`daemon pid ${existing.pid} has an unverifiable process identity; verify and stop the older daemon before restarting`);
   const { owner, release } = acquireDaemon(home);
   let ownLogin = null;
   let timer = null;
+  let stopProviderHealth = null;
   const cleanup = () => {
     if (timer) clearTimeout(timer);
+    stopProviderHealth?.(); stopProviderHealth = null;
     try { writeJsonAtomic(daemonPath(home), { ...readJson(daemonPath(home), {}), ...owner, stoppedAt: nowIso() }); } catch { /* exiting */ }
     try { release(); } catch { /* stale lock can be recovered next boot */ }
     process.off("SIGINT", stop); process.off("SIGTERM", stop); process.off("exit", cleanup);
@@ -181,11 +187,11 @@ export async function up(ctx, { once = false } = {}) {
       catch (e) { log.warn(`cannot write ${daemonPath(home)} (${e.code || e.message}); status will not see this tick`); }
     };
     health({ starting: true });
-    ownLogin = await gh.user();
-    const providerHealth = makeProviderHealth({ home, clock, limits: config.execution, probe: (provider, account, signal) => checkHarness(provider, config, { signal }) });
+    ownLogin = await host.user();
+    const providerHealth = makeProviderHealth({ home, clock, limits: coordinatorHealthLimits(config.execution), probe: (provider, account, signal) => checkHarness(provider, config, { signal }) });
     const githubHealth = makeProviderHealth({ home, file: join(home, "github-health.json"), clock,
       limits: { ...config.execution, progressMs: config.poll_seconds * 1000 },
-      probe: (_provider, _account, signal) => checkGh(gh, { signal }) });
+      probe: (_provider, _account, signal) => checkGh(host, { signal }) });
     const tickImpl = makeTick({ ...ctx, ownLogin, providerHealth });
     health({ starting: false });
     keepAwake();
@@ -193,11 +199,13 @@ export async function up(ctx, { once = false } = {}) {
     const recovered = await reconcile(ctx, ownLogin);
     if (recovered.length) log.info(`recovered ${recovered.length} PR(s)`);
     const tickMs = Math.min(config.poll_seconds * 1000, config.execution?.progressMs || EXECUTION_LIMITS.progressMs);
+    const scopes = Object.keys(config.harness).map(h => [h, config.harness[h]?.account || "operator"]);
+    const providerInterval = Math.min(30_000, Math.max(1_000, Math.floor(coordinatorHealthLimits(config.execution).progressMs / 2)));
+    stopProviderHealth = scheduleProviderHealth(providerHealth, scopes, { intervalMs: providerInterval, onError: e => log.warn(`provider health refresh failed: ${e.code || "check unavailable"}`) });
 
     /** One tick, with every failure caught: a daemon that dies on one bad tick is worse than one that logs it. */
     const loop = async () => {
       try {
-        const scopes = Object.keys(config.harness).map(h => [h, config.harness[h]?.account || "operator"]);
         // Provider checks and GitHub/progress work use separate lanes. Failed or
         // due/pending health reads fence only that account/provider, even before
         // refresh gets a worker; the previous healthy cache cannot authorize work.

package/lib/commands/why.mjs

@@ -1,12 +1,13 @@
 // `gallivant why <handle>`: the reason a PR stopped, what was dispatched, what the harness last said, any permission
 // denials, and APort audit lines from the run's window. Reads files; never calls GitHub.
+import { reviewDisclosure } from "../review_policy.mjs";
 import { resolveHandle, shortRepo } from "../state.mjs";
 import { adapterFor } from "../harness.mjs";
 import { prdDivergence, divergenceReason, renderDivergence, prdDecision, sourceDivergence } from "../prd.mjs";
 import { contract } from "../fs.mjs";
 import { aportDirFor, auditEntries } from "../aport.mjs";
 import { READY_LABEL_WRITE, COMPLETION_GATE } from "../tick.mjs";
-import { READY_LABEL } from "../gh.mjs";
+import { READY_LABEL } from "../host_contract.mjs";
 import { executionRunner } from "../execution.mjs";
 import { networkRecoveryDetail } from "../network_recovery.mjs";
 import { redact } from "../execution_io.mjs";
@@ -103,10 +104,13 @@ export function why(ctx, { handle }) {
     else if (e.prd_decision && now === e.prd_decision) out.push(`  aport_decision is unchanged (${e.prd_decision}), so the edit has not been through \`gallivant ready\`.`);
   }
   if (e.retry) out.push(`waiting on ${e.retry.op === COMPLETION_GATE ? "completion verification" : "GitHub"}: ${e.retry.op} has failed ${e.retry.count} tick${e.retry.count === 1 ? "" : "s"} in a row; the entry stops with "stuck" if it keeps failing`);
-  if (e.retry?.op === COMPLETION_GATE) out.push(`  checks green and reviewer clear; completion verification is pending: ${e.retry.error ?? "no decision from the gate"}`);
+  out.push(`  Review: ${reviewDisclosure(e)}`);
+  if (e.firstPartyReview?.error) out.push(`  Review failure: ${e.firstPartyReview.error}`);
+  if (e.firstPartyReview?.unresolvedScope?.length) for (const item of e.firstPartyReview.unresolvedScope) out.push(`  Unresolved: ${item}`);
+  if (e.retry?.op === COMPLETION_GATE) out.push(`  checks settled; ${e.review_readiness?.note || reviewDisclosure(e)}; completion verification is pending: ${e.retry.error ?? "no decision from the gate"}`);
   // The one retry whose op is not a step toward a fix round: everything a person waits for has already happened and
   // only the label that says so will not write, which is worth spelling out where the operator is already reading.
-  if (e.retry?.op === READY_LABEL_WRITE) out.push(`  this PR is otherwise ready: checks green, reviewer clear, receipt accepted. Only the ${READY_LABEL} label will not write.`);
+  if (e.retry?.op === READY_LABEL_WRITE) out.push(`  this PR is otherwise ready: checks settled, ${e.review_readiness?.note || reviewDisclosure(e)}, receipt accepted. Only the ${READY_LABEL} label will not write.`);
   // The round comment is the announcement of a round that is already counted, so the operator needs both halves: the
   // work is on the branch and charged, and the PR does not say so. The second half matters because the count on GitHub
   // is what a recovery rebuilds from, so an unposted marker is a round a recovery after this would not see.

package/lib/config.mjs

@@ -1,7 +1,11 @@
+import { repositoryIdentity } from "./repository.mjs";
+import { repositoryReviewConfig, reviewPolicyProblems } from "./review_policy.mjs";
+import { HOST_DEFINITIONS } from "./host_definitions.mjs";
 // Config: one JSON file the operator writes by hand, validated here so every other module can trust its shape.
 //
 // Defaults hold nothing machine-specific. Anything that identifies the operator (trusted logins, token file,
 // binaries) has to be written explicitly, which is what `doctor` walks you through.
+import { reviewSettings, validateReviewSettings } from "./review_policy.mjs";
 import { join, relative, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { realpathSync } from "node:fs";
@@ -10,6 +14,7 @@ import { validateAgentsConfig } from "./openai_agents_config.mjs";
 import { validateCloudConfig } from "./codex_cloud_config.mjs";
 import { adapters, executionRegistry } from "./harness.mjs";
 import { findExecutable } from "./executable.mjs";
+import { intakeModelProblems } from "./task_model_config.mjs";
 
 // Recognition is independent of new-dispatch availability: a registered provider
 // must retain configuration and recovery identities while its readiness is refused.
@@ -77,7 +82,7 @@ export const DEFAULT_DELIVERABLE = Object.freeze({
 export const DEFAULTS = Object.freeze({
   deliverable: DEFAULT_DELIVERABLE,
   poll_seconds: 120,
-  max_iterations: 30,
+  max_iterations: 60,
   checks_grace_minutes: 5,            // a head younger than this with no checks yet is not "green", it is "not reported yet"
   // What this number is FOR, because the value only makes sense once that is settled. The timeout catches a session that
   // is genuinely wedged: spinning on a command that never returns, waiting on a prompt that will never come, looping.
@@ -97,7 +102,7 @@ export const DEFAULTS = Object.freeze({
   // A repository with a different shape sets its own on its `repos` entry; this is only the fallback. The validation
   // floor stays at 1, so an operator who deliberately wants a short timeout can have one.
   run_timeout_minutes: 720,
-  max_budget_usd: 5,
+  max_budget_usd: 50,
   rereview_minutes: 6,
   stall_hours: 6,
   trusted_authors: [],
@@ -278,21 +283,23 @@ export function resolveTimeout({ config, repo }) {
  */
 export function validateRepos(list) {
   if (list === undefined || list === null) return [];
-  if (!Array.isArray(list)) return ['repos must be an array of "owner/name" strings or { repo, base, run_timeout_minutes } objects'];
+  if (!Array.isArray(list)) return ['repos must be an array of "owner/name" strings or { repo, base, run_timeout_minutes, review } objects'];
   const problems = [];
   const seen = new Set();
   for (const raw of list) {
     if (typeof raw === "string") {
-      if (!/^[\w.-]+\/[\w.-]+$/.test(raw)) { problems.push(`repos: "${raw}" is not owner/name`); continue; }
+      if (!validRepository(raw)) { problems.push("repos: invalid identity is not owner/name or host/owner/name; URL credentials are not accepted"); continue; }
     } else if (raw && typeof raw === "object" && !Array.isArray(raw)) {
-      if (typeof raw.repo !== "string" || !/^[\w.-]+\/[\w.-]+$/.test(raw.repo)) { problems.push(`repos: ${JSON.stringify(raw)} needs a "repo" of the form owner/name`); continue; }
+      if (typeof raw.repo !== "string" || !validRepository(raw.repo)) { problems.push('repos: needs a "repo" of the form owner/name or host/owner/name, without URL credentials'); continue; }
       if (raw.base !== undefined && raw.base !== null && (typeof raw.base !== "string" || !raw.base.trim())) { problems.push(`repos: ${raw.repo} base must be a branch name`); continue; }
       // Refused rather than ignored, for the reason the unknown-key check above exists: a timeout typed as "45" or as 0
       // would read as "not configured" and the repository would keep the global forever, which is the silent failure.
       if (raw.run_timeout_minutes !== undefined && raw.run_timeout_minutes !== null && (typeof raw.run_timeout_minutes !== "number" || raw.run_timeout_minutes < 1)) { problems.push(`repos: ${raw.repo} run_timeout_minutes must be a number >= 1`); continue; }
-      const extra = Object.keys(raw).filter(k => k !== "repo" && k !== "base" && k !== "run_timeout_minutes");
-      if (extra.length) { problems.push(`repos: ${raw.repo} has unknown key${extra.length === 1 ? "" : "s"} ${extra.join(", ")} (only repo, base and run_timeout_minutes are read)`); continue; }
+      if (raw.review != null && (typeof raw.review !== "object" || Array.isArray(raw.review))) { problems.push(`repos: ${raw.repo} review must be an object of review settings`); continue; }
+      const extra = Object.keys(raw).filter(k => !["repo", "base", "run_timeout_minutes", "review", "reviewer", "trusted_authors", "required_checks"].includes(k));
+      if (extra.length) { problems.push(`repos: ${raw.repo} has unknown key${extra.length === 1 ? "" : "s"} ${extra.join(", ")} (use repo, base, run_timeout_minutes and explicit review policy)`); continue; }
     } else { problems.push(`repos: ${JSON.stringify(raw)} is neither "owner/name" nor a { repo } object`); continue; }
+    if (typeof raw === "object") problems.push(...reviewPolicyProblems(raw, HOST_DEFINITIONS.find(d => d.host === repositoryIdentity(raw.repo).host)?.reviewPolicy));
     const key = repoEntry(raw).repo;
     if (seen.has(key)) problems.push(`repos: ${key} is listed twice`);
     seen.add(key);
@@ -323,6 +330,14 @@ export function merge(raw, home = gallivantHome()) {
 /** Problems as human sentences; empty means valid. Used by `load` (throws) and by `doctor` (prints). */
 export function validate(cfg, home = gallivantHome()) {
   const problems = [];
+  if (cfg.git_hosts != null) {
+    if (typeof cfg.git_hosts !== "object" || Array.isArray(cfg.git_hosts)) problems.push("git_hosts must be a host-scoped configuration object");
+    else for (const [host, settings] of Object.entries(cfg.git_hosts)) {
+      const adapter = HOST_DEFINITIONS.find(d => d.host === host);
+      if (!adapter?.validateConfig) problems.push("Unsupported git_hosts configuration; use a registered host's documented credential settings");
+      else problems.push(...adapter.validateConfig(settings));
+    }
+  }
   const num = (k, min) => { if (typeof cfg[k] !== "number" || cfg[k] < min) problems.push(`${k} must be a number >= ${min}`); };
   num("poll_seconds", 30); num("max_iterations", 1); num("run_timeout_minutes", 1); num("max_budget_usd", 0);
   num("rereview_minutes", 1); num("stall_hours", 1); num("checks_grace_minutes", 0);
@@ -333,7 +348,21 @@ export function validate(cfg, home = gallivantHome()) {
       if (!range || !Number.isSafeInteger(value) || value < range[0] || value > range[1]) problems.push(`execution.${key} must be an integer in ${range ? range.join("..") : "the documented execution limits"}`);
     }
   }
-  if (!Array.isArray(cfg.trusted_authors) || cfg.trusted_authors.length === 0) problems.push("trusted_authors must list at least one GitHub login");
+  const legacy = !Array.isArray(cfg.repos) || !cfg.repos.length || cfg.repos.some(r => {
+    try { return HOST_DEFINITIONS.find(d => d.host === repositoryIdentity(typeof r === "string" ? r : r.repo).host)?.features?.legacyReviewDefaults; } catch { return true; }
+  });
+  if (legacy && (!Array.isArray(cfg.trusted_authors) || cfg.trusted_authors.length === 0)) problems.push("trusted_authors must list at least one GitHub login");
+  for (const repo of Array.isArray(cfg.repos) ? cfg.repos : []) {
+    try { const r = repositoryIdentity(typeof repo === "string" ? repo : repo.repo); if (HOST_DEFINITIONS.find(d => d.host === r.host)?.reviewPolicy) repositoryReviewConfig(cfg, r); }
+    catch (error) { problems.push(error.message); }
+  }
+  try {
+    for (const value of [cfg.review, ...(cfg.repos || []).map(r => r?.review)]) {
+      if (value !== undefined && (value === null || typeof value !== "object" || Array.isArray(value))) throw new Error("review must be a configuration object");
+    }
+    validateReviewSettings(reviewSettings(cfg));
+    for (const repo of cfg.repos || []) if (repo?.review) validateReviewSettings(reviewSettings(cfg, repo.repo));
+  } catch (error) { problems.push(error.message); }
   if (cfg.reviewer !== null) {
     for (const k of ["login", "rereview_comment", "blocking_pattern"]) if (typeof cfg.reviewer?.[k] !== "string") problems.push(`reviewer.${k} must be a string (or set reviewer to null)`);
     // `reviewed_commit_pattern` is optional, and that is deliberate rather than an omission. It was added after configs
@@ -350,6 +379,7 @@ export function validate(cfg, home = gallivantHome()) {
   if (cfg.deliverable !== null && (typeof cfg.deliverable !== "object" || Array.isArray(cfg.deliverable))) problems.push("deliverable must be an object of limits (or null to disable the completion gate)");
   else if (cfg.deliverable && !["aport", "local"].includes(cfg.deliverable.evaluator)) problems.push('deliverable.evaluator must be "aport" or "local"');
   else if (cfg.deliverable && !["wait", "local"].includes(cfg.deliverable.on_unreachable)) problems.push('deliverable.on_unreachable must be "wait" or "local"');
+  if (cfg.intake_model !== undefined && cfg.intake_model !== null) problems.push(...intakeModelProblems(cfg.intake_model));
   if (!cfg.worktrees) problems.push("worktrees must be a directory path outside the Gallivant home");
   else if (isInside(expand(cfg.worktrees), home)) problems.push("worktrees must not be under the Gallivant home directory");
   problems.push(...validateContextPaths(cfg.context_paths, home));
@@ -401,7 +431,8 @@ export function repoEntry(raw) {
   if (raw && typeof raw === "object" && typeof raw.repo === "string") {
     const base = typeof raw.base === "string" && raw.base.trim() ? raw.base.trim() : null;
     const t = typeof raw.run_timeout_minutes === "number" && raw.run_timeout_minutes >= 1 ? raw.run_timeout_minutes : null;
-    return { repo: raw.repo.toLowerCase(), base, run_timeout_minutes: t };
+    const policy = Object.fromEntries(["review", "reviewer", "trusted_authors", "required_checks"].filter(k => Object.hasOwn(raw, k)).map(k => [k, raw[k]]));
+    return { repo: raw.repo.toLowerCase(), base, run_timeout_minutes: t, ...policy };
   }
   return null;
 }
@@ -459,3 +490,5 @@ export function rememberRepo(nameWithOwner, home = gallivantHome(), base = null)
   writeJsonAtomic(configPath(home), { ...raw, repos: updated }, 0o600);
   return true;
 }
+
+function validRepository(value) { try { repositoryIdentity(value); return true; } catch { return false; } }

package/lib/context.mjs

@@ -5,21 +5,22 @@ import { contentHash } from "./openai_agents_sources.mjs";
 import { join } from "node:path";
 import { load as loadConfig } from "./config.mjs";
 import { makeState, idSlug } from "./state.mjs";
-import { makeGh } from "./gh.mjs";
+import { makeHostRegistry } from "./hosts.mjs";
 import { makeGit } from "./git.mjs";
-import { resolveCredential } from "./credential.mjs";
+import { repositoryIdentity } from "./repository.mjs";
 import { resolveIdentity } from "./identity.mjs";
 import { makeNotifier } from "./notify.mjs";
 import { makeLog } from "./log.mjs";
 import { makeRunner } from "./run.mjs";
 import { ensureDir, gallivantHome, readText, writeText } from "./fs.mjs";
 import { aportDirFor, guardrailMode } from "./aport.mjs";
-import { makeExecution, assertExecutionDependency } from "./execution.mjs";
+import { makeExecution, executionEpoch, assertExecutionDependency } from "./execution.mjs";
 import { makeAgentsTransport } from "./openai_agents.mjs";
 import { capabilitiesFor } from "./harness.mjs";
 import { createLearningService } from "./learning.mjs";
 import { makeTrust } from "./events.mjs";
 import { revokeLearningAttempts } from "./learning_input.mjs";
+import { createReviewService } from "./first_party_review.mjs";
 import { silentLog } from "./log.mjs";
 const { createTaskService } = await import("./tasks.mjs").catch(error => {
   if (error.code === "ERR_MODULE_NOT_FOUND") assertExecutionDependency(null);
@@ -42,41 +43,41 @@ export function makeContext({ home = gallivantHome(), needConfig = true, readOnl
   const log = readOnly ? silentLog : makeLog(home);
   if (!needConfig) return { home, log };
   const config = loadConfig(home);
-  // One credential resolver for the whole process, shared by `gh` and `git` so both act as the same identity.
-  //
-  // Per call, not per boot. It costs one `gh auth token` subprocess (only when neither the config file nor the
-  // daemon's own environment answers, which are both free), and it is the only way an operator who re-authenticates
-  // under a long-lived daemon gets the new token without restarting it. A value cached at boot would expire under
-  // exactly the daemon this product is built around.
-  const credential = (opts = {}) => resolveCredential(config, opts);
+  // Each adapter resolves its credentials per operation, so reauthentication is
+  // picked up without restarting the coordinator or sharing another host's token.
+  const hosts = makeHostRegistry({ config, log });
+  const credential = (opts = {}) => hosts.credential(repositoryIdentity(opts.path ?? opts.repository ?? opts.repo ?? "owner/name", opts.host));
   // The git identity a run commits as, resolved the same way and for the same reason: per call, so an operator who
   // changes their name or email under a long-lived daemon is committed as who they are now.
   const identity = () => resolveIdentity();
-  const gh = makeGh({ credential, log });
+  const host = hosts.api;
+  const gh = hosts.select("owner/name").api;
   const state = makeState(home);
   const context = {
-    home, log, config, gh, credential, identity,
+    home, log, config, host, hosts, gh, credential, identity,
     state, capabilitiesFor,
     executionInputFor: (id, entry, input, contextPaths) => remoteInput(context, id, entry, input, contextPaths),
     // `identity` as well as `credential`, because `git.mergeBase` commits: the merge that brings a base into a branch
     // is the daemon's own commit, and with no identity pairs it is either attributed to a machine-derived address or
     // refused outright, depending on whether the host's git can guess one. See makeGit for the two shapes.
-    git: makeGit({ config, credential, identity }),
+    git: makeGit({ config, identity, hosts }),
     notify: makeNotifier({ config, log }),
     runnerFor: id => makeRunner(join(home, "runs", idSlug(id))),
     executionFor: (id, provider) => {
       const root = join(home, "runs", idSlug(id)), selected = config.harness[provider];
       const account = selected?.account || "operator";
-      return makeExecution({ root, taskId: id, provider, account,
+      const entry = state.get(id), runner = capabilitiesFor(provider).transport === "remote" ? null : makeRunner(root);
+      const epoch = executionEpoch({ root, taskId: id, entry, provider, account, runner });
+      return makeExecution({ root, taskId: id, provider, account, ledgerEpoch: epoch, ledgerFile: join(root, epoch ? `execution-${epoch}.json` : "execution.json"),
         ...(provider === "openai-agents" ? { transport: makeAgentsTransport({ root, taskId: id, account, config: selected }), capabilities: { ...capabilitiesFor(provider), models: [selected?.model] } } : {}),
         ...(provider === "codex-cloud" ? { transport: makeCloudTransport({ root, taskId: id, account, config: selected, verifyRemote: async input => {
-          if (await gh.refSha(input.repo, input.sources.inputBranch) !== input.inputHead || await gh.refSha(input.repo, input.branch) !== input.inputHead) throw new Error("Cloud remote input revision moved; reconcile before dispatch");
+          if (await host.refSha(input.repo, input.sources.inputBranch) !== input.inputHead || await host.refSha(input.repo, input.branch) !== input.inputHead) throw new Error("Cloud remote input revision moved; reconcile before dispatch");
           for (const [path, hash] of Object.entries(input.sources.hashes)) {
-            if (contentHash(await gh.fileAtStrict(input.repo, path, input.inputHead)) !== hash) throw new Error("Cloud remote snapshot hash differs");
+            if (contentHash(await host.fileAtStrict(input.repo, path, input.inputHead)) !== hash) throw new Error("Cloud remote snapshot hash differs");
           }
         } }), capabilities: { ...capabilitiesFor(provider), environments: [selected?.environment] } } : {}),
         legacySessionId: state.get(id)?.harness === provider ? state.get(id).session : null,
-        runner: capabilitiesFor(provider).transport === "remote" ? null : makeRunner(root), limits: config.execution });
+        runner, limits: config.execution });
     },
     // The APort API key the Claude install recorded, if any, so hosted gate calls count against the same account.
     aportApiKey: guardrailMode(aportDirFor(config.harness?.claude?.settings)).apiKey,
@@ -90,11 +91,17 @@ export function makeContext({ home = gallivantHome(), needConfig = true, readOnl
   const learningServices = new Map();
   context.learningFor = (ownLogin = "learning-coordinator", { signerExecutable } = {}) => {
     const cacheKey = JSON.stringify([ownLogin, signerExecutable ?? null]);
-    if (!learningServices.has(cacheKey)) learningServices.set(cacheKey, createLearningService({
-      root: join(home, "learning"), signerExecutable, gh, trust: makeTrust(config, ownLogin),
-      onRevocation: intent => revokeLearningAttempts(context, intent),
-    }));
+    if (!learningServices.has(cacheKey)) {
+      const service = createLearningService({
+        root: join(home, "learning"), signerExecutable, gh, trust: makeTrust(config, ownLogin),
+        onRevocation: intent => revokeLearningAttempts(context, intent),
+      });
+      learningServices.set(cacheKey, { ...service,
+        identityFor: name => hosts.select(name).adapter.features?.learning ? service.identityFor(name) : null,
+      });
+    }
     return learningServices.get(cacheKey);
   };
+  if (!readOnly) context.reviewService = createReviewService(context);
   return context;
 }