@uchibeke/gallivant 0.2.1 → 0.3.0

package/lib/commands/task.mjs

@@ -31,6 +31,7 @@ export async function taskCommand(ctx, { args, values, service = null, stdin = r
   const shared = { taskId: id, expectedRevision, noDaemon: values["no-daemon"] };
   if (values.context !== undefined && !["prepare", "answer"].includes(operation)) throw taskError("TASK_INPUT", "--context is supported by task prepare and task answer");
   if (values["completion-target"] !== undefined && operation !== "prepare") throw taskError("TASK_INPUT", "--completion-target is selected only at task creation");
+  for (const flag of ["delivery", "route"]) if (values[flag] !== undefined && operation !== "prepare") throw taskError("TASK_INPUT", `--${flag} is selected only at task creation`);
   if (operation === "list") return (service || createTaskService(ctx)).list();
   if (operation === "inspect") return (service || createTaskService(ctx)).inspect(shared);
   const owner = acquireCliMutation(ctx.home);
@@ -53,7 +54,10 @@ export async function taskCommand(ctx, { args, values, service = null, stdin = r
     const textArgs = first === "prepare" ? args.slice(1) : args;
     if (values.stdin && textArgs.length) throw taskError("TASK_INPUT", "use text or --stdin, not both");
     const text = textArgs.length ? textArgs.join(" ") : await stdin();
-    return await service.prepare({ text, dir: values.dir, repo: values.repo, base: values.base, harness: values.harness, context: values.context || [], requestId: values["request-id"], run: values.run, noDaemon: values["no-daemon"], verifyCommands: values.verify || [], ...(values["completion-target"] === undefined ? {} : { completion: { target: values["completion-target"] } }) });
+    // --delivery selects the typed profile action; --completion-target keeps its
+    // meaning as the profile's completion condition. Both are owner choices.
+    const delivery = values.delivery === undefined ? undefined : { action: values.delivery, ...(values["completion-target"] === undefined ? {} : { completion: values["completion-target"] }) };
+    return await service.prepare({ text, dir: values.dir, repo: values.repo, base: values.base, harness: values.harness, context: values.context || [], requestId: values["request-id"], run: values.run, noDaemon: values["no-daemon"], verifyCommands: values.verify || [], ...(values["completion-target"] === undefined ? {} : { completion: { target: values["completion-target"] } }), ...(delivery ? { delivery } : {}), route: values.route ?? null });
   }); } finally { owner.release(); }
 }
 
@@ -67,6 +71,10 @@ export function renderTask(result) {
     result.dispatchRecovery && `Dispatch recovery: inspect the clone at ${result.dispatchRecovery.worktree}; start ownership is retained`,
     result.implementation && `Implementation: ${result.implementation.id} (run ${result.implementation.run})`,
     result.completion && `Completion target: ${result.completion.target} (${result.completion.status})`,
+    result.deliveryProfile && (result.deliveryProfile.legacy ? `Delivery profile: historical task (${result.deliveryProfile.label})` : result.deliveryProfile.supported ? `Delivery profile: ${result.deliveryProfile.action} → ${result.deliveryProfile.target.repository}@${result.deliveryProfile.target.base}, completion ${result.deliveryProfile.completion.condition} (v${result.deliveryProfile.version}); no merge or deployment authority` : `Delivery profile: unsupported (${result.deliveryProfile.error?.message})`),
+    result.modelRoute && `Planner route: ${result.modelRoute.kind === "model" ? `${result.modelRoute.adapter} ${result.modelRoute.model} via ${result.modelRoute.endpointHost}` : `harness ${result.modelRoute.harness}`}; calls ${result.modelRoute.calls}; cost ${result.cost.status}${Number.isFinite(result.cost.usd) ? ` $${result.cost.usd.toFixed(4)}` : ""}`,
+    result.repositoryContext && `Repository context: ${result.repositoryContext.status}${result.repositoryContext.revision ? ` at ${result.repositoryContext.revision.slice(0, 12)} (digest ${result.repositoryContext.digest.slice(0, 12)})` : result.repositoryContext.reason ? `: ${result.repositoryContext.reason}` : ""}`,
+    result.review && `Review: revision ${result.review.revision}, digest ${result.review.digest.slice(0, 12)}, ${result.review.requirementMap.length} clauses mapped, ${result.review.questions.length} open question(s)${result.approval ? `, approved at ${result.approval.at}` : ", not yet approved"}`,
     result.daemonError,
     `Next: ${result.nextAction}`,
   ].filter(Boolean).join("\n");

package/lib/commands/up.mjs

@@ -1,3 +1,4 @@
+import { hostApi, hosts } from "../hosts.mjs";
 // `gallivant up`: the daemon. Reconciles with GitHub on boot, then ticks on a setTimeout chain so ticks never
 // overlap. Health is a file (daemon.json) that `status` reads; a second daemon exits when the first is alive.
 import { join } from "node:path";
@@ -6,7 +7,7 @@ import { openSync, closeSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { makeTick } from "../tick.mjs";
 import { checkGh, checkHarness, probeFix } from "../probe.mjs";
-import { makeProviderHealth } from "../provider_health.mjs";
+import { makeProviderHealth, coordinatorHealthLimits, scheduleProviderHealth } from "../provider_health.mjs";
 import { EXECUTION_LIMITS } from "../execution_io.mjs";
 import { readJson, writeJsonAtomic, VERSION, codeStamp, gallivantHome } from "../fs.mjs";
 import { nowIso, later } from "../time.mjs";
@@ -17,6 +18,7 @@ import { newEntry, entryId, STATES } from "../state.mjs";
 import { receiptHash } from "../deliverable.mjs";
 import { worktreePath, isOurBranch, prdIdFromBranch } from "../git.mjs";
 import { daemonPath, readDaemon, assertDaemonUsable, acquireDaemon, assertUnpinnedHome } from "../daemon.mjs";
+import { repositoryReviewConfig } from "../review_policy.mjs";
 import { repoNames } from "../config.mjs";
 
 export { daemonPath, readDaemon } from "../daemon.mjs";
@@ -54,11 +56,12 @@ export function down(ctx, { home = ctx?.home ?? gallivantHome() } = {}) {
  * the session, which the log says. Missing checkouts are recreated lazily by the tick when a run is needed.
  */
 export async function reconcile(ctx, ownLogin) {
-  const { config, state, gh, log } = ctx;
+  const { config, state, log } = ctx;
+  const host = hostApi(ctx);
   const added = [];
   for (const repo of repoNames(config)) {
     let prs;
-    try { prs = await gh.prListMine(repo); } catch (e) { log.warn(`reconcile ${repo}: ${e.message}`); continue; }
+    try { const selected = (ctx.hosts ?? hosts).select(repo); repositoryReviewConfig(config, repo, selected.adapter); prs = await host.prListMine(repo); } catch (e) { log.warn(`reconcile ${repo}: ${e.message}`); continue; }
     for (const pr of prs || []) {
       if (pr.isCrossRepository || !isOurBranch(pr.headRefName)) continue;
       if (state.findByPr(repo, pr.number)) continue;
@@ -70,15 +73,15 @@ export async function reconcile(ctx, ownLogin) {
       if (state.get(id)) { log.warn(`reconcile ${repo}#${pr.number}: id ${id} already in use, ignored`); continue; }
       try { state.assertCanRegister(id); }
       catch (e) { log.warn(`reconcile ${repo}#${pr.number}: ${e.message}, ignored`); continue; }
-      const [comments, headDate] = await Promise.all([gh.issueComments(repo, pr.number), gh.commitDate(repo, pr.headRefOid).catch(() => null)]);
-      const lastOwn = lastOwnCommentAt(comments, ownLogin);
+      const [comments, headDate] = await Promise.all([host.issueComments(repo, pr.number), host.commitDate(repo, pr.headRefOid).catch(() => null)]);
+      const lastOwn = lastOwnCommentAt(comments, host.userFor ? await host.userFor(repo) : ownLogin);
       await ensurePrdSnapshot(ctx, { id, repo, path: block.prd, ref: pr.headRefName });
       // `base` is the branch the PR targets, read off the PR rather than guessed from config: a recovered entry has to merge
       // in the branch this pull request will actually be merged into, and only GitHub knows which that is.
       const entry = newEntry({ prd: block.prd, harness: block.harness, session: block.session, repo, branch: pr.headRefName, worktree: worktreePath(config, repo, prdId), pr: pr.number, url: pr.url, state: STATES.prOpen, nowIso: nowIso(), base: typeof pr.baseRefName === "string" && pr.baseRefName ? pr.baseRefName : null });
       try { state.put(id, {
         ...entry,
-        iteration: countRounds(comments, ownLogin),
+        iteration: countRounds(comments, host.userFor ? await host.userFor(repo) : ownLogin),
         // The receipt fingerprint comes from the body `prListMine` already returned, as every other writer of this
         // cursor sets it. Left null, a receipt that was on the PR before the recovery read as a change the next time
         // a run ended, so a run that did nothing counted as a round and posted "Completion receipt updated." to the
@@ -151,15 +154,18 @@ export async function upInBackground(ctx, { bin = process.execPath, script = fil
 }
 
 export async function up(ctx, { once = false } = {}) {
-  const { home, config, gh, notify, log, clock = Date } = ctx;
+  const { home, config, notify, log, clock = Date } = ctx;
+  const host = hostApi(ctx);
   const existing = readDaemon(home);
   if (existing?.alive && existing.pid !== process.pid) throw new Error(`daemon already running (pid ${existing.pid})`);
   if (existing?.unverified) throw new Error(`daemon pid ${existing.pid} has an unverifiable process identity; verify and stop the older daemon before restarting`);
   const { owner, release } = acquireDaemon(home);
   let ownLogin = null;
   let timer = null;
+  let stopProviderHealth = null;
   const cleanup = () => {
     if (timer) clearTimeout(timer);
+    stopProviderHealth?.(); stopProviderHealth = null;
     try { writeJsonAtomic(daemonPath(home), { ...readJson(daemonPath(home), {}), ...owner, stoppedAt: nowIso() }); } catch { /* exiting */ }
     try { release(); } catch { /* stale lock can be recovered next boot */ }
     process.off("SIGINT", stop); process.off("SIGTERM", stop); process.off("exit", cleanup);
@@ -181,11 +187,11 @@ export async function up(ctx, { once = false } = {}) {
       catch (e) { log.warn(`cannot write ${daemonPath(home)} (${e.code || e.message}); status will not see this tick`); }
     };
     health({ starting: true });
-    ownLogin = await gh.user();
-    const providerHealth = makeProviderHealth({ home, clock, limits: config.execution, probe: (provider, account, signal) => checkHarness(provider, config, { signal }) });
+    ownLogin = await host.user();
+    const providerHealth = makeProviderHealth({ home, clock, limits: coordinatorHealthLimits(config.execution), probe: (provider, account, signal) => checkHarness(provider, config, { signal }) });
     const githubHealth = makeProviderHealth({ home, file: join(home, "github-health.json"), clock,
       limits: { ...config.execution, progressMs: config.poll_seconds * 1000 },
-      probe: (_provider, _account, signal) => checkGh(gh, { signal }) });
+      probe: (_provider, _account, signal) => checkGh(host, { signal }) });
     const tickImpl = makeTick({ ...ctx, ownLogin, providerHealth });
     health({ starting: false });
     keepAwake();
@@ -193,11 +199,13 @@ export async function up(ctx, { once = false } = {}) {
     const recovered = await reconcile(ctx, ownLogin);
     if (recovered.length) log.info(`recovered ${recovered.length} PR(s)`);
     const tickMs = Math.min(config.poll_seconds * 1000, config.execution?.progressMs || EXECUTION_LIMITS.progressMs);
+    const scopes = Object.keys(config.harness).map(h => [h, config.harness[h]?.account || "operator"]);
+    const providerInterval = Math.min(30_000, Math.max(1_000, Math.floor(coordinatorHealthLimits(config.execution).progressMs / 2)));
+    stopProviderHealth = scheduleProviderHealth(providerHealth, scopes, { intervalMs: providerInterval, onError: e => log.warn(`provider health refresh failed: ${e.code || "check unavailable"}`) });
 
     /** One tick, with every failure caught: a daemon that dies on one bad tick is worse than one that logs it. */
     const loop = async () => {
       try {
-        const scopes = Object.keys(config.harness).map(h => [h, config.harness[h]?.account || "operator"]);
         // Provider checks and GitHub/progress work use separate lanes. Failed or
         // due/pending health reads fence only that account/provider, even before
         // refresh gets a worker; the previous healthy cache cannot authorize work.

package/lib/commands/why.mjs

@@ -1,12 +1,13 @@
 // `gallivant why <handle>`: the reason a PR stopped, what was dispatched, what the harness last said, any permission
 // denials, and APort audit lines from the run's window. Reads files; never calls GitHub.
+import { reviewDisclosure } from "../review_policy.mjs";
 import { resolveHandle, shortRepo } from "../state.mjs";
 import { adapterFor } from "../harness.mjs";
 import { prdDivergence, divergenceReason, renderDivergence, prdDecision, sourceDivergence } from "../prd.mjs";
 import { contract } from "../fs.mjs";
 import { aportDirFor, auditEntries } from "../aport.mjs";
 import { READY_LABEL_WRITE, COMPLETION_GATE } from "../tick.mjs";
-import { READY_LABEL } from "../gh.mjs";
+import { READY_LABEL } from "../host_contract.mjs";
 import { executionRunner } from "../execution.mjs";
 import { networkRecoveryDetail } from "../network_recovery.mjs";
 import { redact } from "../execution_io.mjs";
@@ -103,10 +104,13 @@ export function why(ctx, { handle }) {
     else if (e.prd_decision && now === e.prd_decision) out.push(`  aport_decision is unchanged (${e.prd_decision}), so the edit has not been through \`gallivant ready\`.`);
   }
   if (e.retry) out.push(`waiting on ${e.retry.op === COMPLETION_GATE ? "completion verification" : "GitHub"}: ${e.retry.op} has failed ${e.retry.count} tick${e.retry.count === 1 ? "" : "s"} in a row; the entry stops with "stuck" if it keeps failing`);
-  if (e.retry?.op === COMPLETION_GATE) out.push(`  checks green and reviewer clear; completion verification is pending: ${e.retry.error ?? "no decision from the gate"}`);
+  out.push(`  Review: ${reviewDisclosure(e)}`);
+  if (e.firstPartyReview?.error) out.push(`  Review failure: ${e.firstPartyReview.error}`);
+  if (e.firstPartyReview?.unresolvedScope?.length) for (const item of e.firstPartyReview.unresolvedScope) out.push(`  Unresolved: ${item}`);
+  if (e.retry?.op === COMPLETION_GATE) out.push(`  checks settled; ${e.review_readiness?.note || reviewDisclosure(e)}; completion verification is pending: ${e.retry.error ?? "no decision from the gate"}`);
   // The one retry whose op is not a step toward a fix round: everything a person waits for has already happened and
   // only the label that says so will not write, which is worth spelling out where the operator is already reading.
-  if (e.retry?.op === READY_LABEL_WRITE) out.push(`  this PR is otherwise ready: checks green, reviewer clear, receipt accepted. Only the ${READY_LABEL} label will not write.`);
+  if (e.retry?.op === READY_LABEL_WRITE) out.push(`  this PR is otherwise ready: checks settled, ${e.review_readiness?.note || reviewDisclosure(e)}, receipt accepted. Only the ${READY_LABEL} label will not write.`);
   // The round comment is the announcement of a round that is already counted, so the operator needs both halves: the
   // work is on the branch and charged, and the PR does not say so. The second half matters because the count on GitHub
   // is what a recovery rebuilds from, so an unposted marker is a round a recovery after this would not see.

package/lib/config.mjs

@@ -1,7 +1,11 @@
+import { repositoryIdentity } from "./repository.mjs";
+import { repositoryReviewConfig, reviewPolicyProblems } from "./review_policy.mjs";
+import { HOST_DEFINITIONS } from "./host_definitions.mjs";
 // Config: one JSON file the operator writes by hand, validated here so every other module can trust its shape.
 //
 // Defaults hold nothing machine-specific. Anything that identifies the operator (trusted logins, token file,
 // binaries) has to be written explicitly, which is what `doctor` walks you through.
+import { reviewSettings, validateReviewSettings } from "./review_policy.mjs";
 import { join, relative, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { realpathSync } from "node:fs";
@@ -10,6 +14,7 @@ import { validateAgentsConfig } from "./openai_agents_config.mjs";
 import { validateCloudConfig } from "./codex_cloud_config.mjs";
 import { adapters, executionRegistry } from "./harness.mjs";
 import { findExecutable } from "./executable.mjs";
+import { intakeModelProblems } from "./task_model_config.mjs";
 
 // Recognition is independent of new-dispatch availability: a registered provider
 // must retain configuration and recovery identities while its readiness is refused.
@@ -77,7 +82,7 @@ export const DEFAULT_DELIVERABLE = Object.freeze({
 export const DEFAULTS = Object.freeze({
   deliverable: DEFAULT_DELIVERABLE,
   poll_seconds: 120,
-  max_iterations: 30,
+  max_iterations: 60,
   checks_grace_minutes: 5,            // a head younger than this with no checks yet is not "green", it is "not reported yet"
   // What this number is FOR, because the value only makes sense once that is settled. The timeout catches a session that
   // is genuinely wedged: spinning on a command that never returns, waiting on a prompt that will never come, looping.
@@ -97,7 +102,7 @@ export const DEFAULTS = Object.freeze({
   // A repository with a different shape sets its own on its `repos` entry; this is only the fallback. The validation
   // floor stays at 1, so an operator who deliberately wants a short timeout can have one.
   run_timeout_minutes: 720,
-  max_budget_usd: 5,
+  max_budget_usd: 50,
   rereview_minutes: 6,
   stall_hours: 6,
   trusted_authors: [],
@@ -278,21 +283,23 @@ export function resolveTimeout({ config, repo }) {
  */
 export function validateRepos(list) {
   if (list === undefined || list === null) return [];
-  if (!Array.isArray(list)) return ['repos must be an array of "owner/name" strings or { repo, base, run_timeout_minutes } objects'];
+  if (!Array.isArray(list)) return ['repos must be an array of "owner/name" strings or { repo, base, run_timeout_minutes, review } objects'];
   const problems = [];
   const seen = new Set();
   for (const raw of list) {
     if (typeof raw === "string") {
-      if (!/^[\w.-]+\/[\w.-]+$/.test(raw)) { problems.push(`repos: "${raw}" is not owner/name`); continue; }
+      if (!validRepository(raw)) { problems.push("repos: invalid identity is not owner/name or host/owner/name; URL credentials are not accepted"); continue; }
     } else if (raw && typeof raw === "object" && !Array.isArray(raw)) {
-      if (typeof raw.repo !== "string" || !/^[\w.-]+\/[\w.-]+$/.test(raw.repo)) { problems.push(`repos: ${JSON.stringify(raw)} needs a "repo" of the form owner/name`); continue; }
+      if (typeof raw.repo !== "string" || !validRepository(raw.repo)) { problems.push('repos: needs a "repo" of the form owner/name or host/owner/name, without URL credentials'); continue; }
       if (raw.base !== undefined && raw.base !== null && (typeof raw.base !== "string" || !raw.base.trim())) { problems.push(`repos: ${raw.repo} base must be a branch name`); continue; }
       // Refused rather than ignored, for the reason the unknown-key check above exists: a timeout typed as "45" or as 0
       // would read as "not configured" and the repository would keep the global forever, which is the silent failure.
       if (raw.run_timeout_minutes !== undefined && raw.run_timeout_minutes !== null && (typeof raw.run_timeout_minutes !== "number" || raw.run_timeout_minutes < 1)) { problems.push(`repos: ${raw.repo} run_timeout_minutes must be a number >= 1`); continue; }
-      const extra = Object.keys(raw).filter(k => k !== "repo" && k !== "base" && k !== "run_timeout_minutes");
-      if (extra.length) { problems.push(`repos: ${raw.repo} has unknown key${extra.length === 1 ? "" : "s"} ${extra.join(", ")} (only repo, base and run_timeout_minutes are read)`); continue; }
+      if (raw.review != null && (typeof raw.review !== "object" || Array.isArray(raw.review))) { problems.push(`repos: ${raw.repo} review must be an object of review settings`); continue; }
+      const extra = Object.keys(raw).filter(k => !["repo", "base", "run_timeout_minutes", "review", "reviewer", "trusted_authors", "required_checks"].includes(k));
+      if (extra.length) { problems.push(`repos: ${raw.repo} has unknown key${extra.length === 1 ? "" : "s"} ${extra.join(", ")} (use repo, base, run_timeout_minutes and explicit review policy)`); continue; }
     } else { problems.push(`repos: ${JSON.stringify(raw)} is neither "owner/name" nor a { repo } object`); continue; }
+    if (typeof raw === "object") problems.push(...reviewPolicyProblems(raw, HOST_DEFINITIONS.find(d => d.host === repositoryIdentity(raw.repo).host)?.reviewPolicy));
     const key = repoEntry(raw).repo;
     if (seen.has(key)) problems.push(`repos: ${key} is listed twice`);
     seen.add(key);
@@ -323,6 +330,14 @@ export function merge(raw, home = gallivantHome()) {
 /** Problems as human sentences; empty means valid. Used by `load` (throws) and by `doctor` (prints). */
 export function validate(cfg, home = gallivantHome()) {
   const problems = [];
+  if (cfg.git_hosts != null) {
+    if (typeof cfg.git_hosts !== "object" || Array.isArray(cfg.git_hosts)) problems.push("git_hosts must be a host-scoped configuration object");
+    else for (const [host, settings] of Object.entries(cfg.git_hosts)) {
+      const adapter = HOST_DEFINITIONS.find(d => d.host === host);
+      if (!adapter?.validateConfig) problems.push("Unsupported git_hosts configuration; use a registered host's documented credential settings");
+      else problems.push(...adapter.validateConfig(settings));
+    }
+  }
   const num = (k, min) => { if (typeof cfg[k] !== "number" || cfg[k] < min) problems.push(`${k} must be a number >= ${min}`); };
   num("poll_seconds", 30); num("max_iterations", 1); num("run_timeout_minutes", 1); num("max_budget_usd", 0);
   num("rereview_minutes", 1); num("stall_hours", 1); num("checks_grace_minutes", 0);
@@ -333,7 +348,21 @@ export function validate(cfg, home = gallivantHome()) {
       if (!range || !Number.isSafeInteger(value) || value < range[0] || value > range[1]) problems.push(`execution.${key} must be an integer in ${range ? range.join("..") : "the documented execution limits"}`);
     }
   }
-  if (!Array.isArray(cfg.trusted_authors) || cfg.trusted_authors.length === 0) problems.push("trusted_authors must list at least one GitHub login");
+  const legacy = !Array.isArray(cfg.repos) || !cfg.repos.length || cfg.repos.some(r => {
+    try { return HOST_DEFINITIONS.find(d => d.host === repositoryIdentity(typeof r === "string" ? r : r.repo).host)?.features?.legacyReviewDefaults; } catch { return true; }
+  });
+  if (legacy && (!Array.isArray(cfg.trusted_authors) || cfg.trusted_authors.length === 0)) problems.push("trusted_authors must list at least one GitHub login");
+  for (const repo of Array.isArray(cfg.repos) ? cfg.repos : []) {
+    try { const r = repositoryIdentity(typeof repo === "string" ? repo : repo.repo); if (HOST_DEFINITIONS.find(d => d.host === r.host)?.reviewPolicy) repositoryReviewConfig(cfg, r); }
+    catch (error) { problems.push(error.message); }
+  }
+  try {
+    for (const value of [cfg.review, ...(cfg.repos || []).map(r => r?.review)]) {
+      if (value !== undefined && (value === null || typeof value !== "object" || Array.isArray(value))) throw new Error("review must be a configuration object");
+    }
+    validateReviewSettings(reviewSettings(cfg));
+    for (const repo of cfg.repos || []) if (repo?.review) validateReviewSettings(reviewSettings(cfg, repo.repo));
+  } catch (error) { problems.push(error.message); }
   if (cfg.reviewer !== null) {
     for (const k of ["login", "rereview_comment", "blocking_pattern"]) if (typeof cfg.reviewer?.[k] !== "string") problems.push(`reviewer.${k} must be a string (or set reviewer to null)`);
     // `reviewed_commit_pattern` is optional, and that is deliberate rather than an omission. It was added after configs
@@ -350,6 +379,7 @@ export function validate(cfg, home = gallivantHome()) {
   if (cfg.deliverable !== null && (typeof cfg.deliverable !== "object" || Array.isArray(cfg.deliverable))) problems.push("deliverable must be an object of limits (or null to disable the completion gate)");
   else if (cfg.deliverable && !["aport", "local"].includes(cfg.deliverable.evaluator)) problems.push('deliverable.evaluator must be "aport" or "local"');
   else if (cfg.deliverable && !["wait", "local"].includes(cfg.deliverable.on_unreachable)) problems.push('deliverable.on_unreachable must be "wait" or "local"');
+  if (cfg.intake_model !== undefined && cfg.intake_model !== null) problems.push(...intakeModelProblems(cfg.intake_model));
   if (!cfg.worktrees) problems.push("worktrees must be a directory path outside the Gallivant home");
   else if (isInside(expand(cfg.worktrees), home)) problems.push("worktrees must not be under the Gallivant home directory");
   problems.push(...validateContextPaths(cfg.context_paths, home));
@@ -401,7 +431,8 @@ export function repoEntry(raw) {
   if (raw && typeof raw === "object" && typeof raw.repo === "string") {
     const base = typeof raw.base === "string" && raw.base.trim() ? raw.base.trim() : null;
     const t = typeof raw.run_timeout_minutes === "number" && raw.run_timeout_minutes >= 1 ? raw.run_timeout_minutes : null;
-    return { repo: raw.repo.toLowerCase(), base, run_timeout_minutes: t };
+    const policy = Object.fromEntries(["review", "reviewer", "trusted_authors", "required_checks"].filter(k => Object.hasOwn(raw, k)).map(k => [k, raw[k]]));
+    return { repo: raw.repo.toLowerCase(), base, run_timeout_minutes: t, ...policy };
   }
   return null;
 }
@@ -459,3 +490,5 @@ export function rememberRepo(nameWithOwner, home = gallivantHome(), base = null)
   writeJsonAtomic(configPath(home), { ...raw, repos: updated }, 0o600);
   return true;
 }
+
+function validRepository(value) { try { repositoryIdentity(value); return true; } catch { return false; } }

package/lib/context.mjs

@@ -5,9 +5,9 @@ import { contentHash } from "./openai_agents_sources.mjs";
 import { join } from "node:path";
 import { load as loadConfig } from "./config.mjs";
 import { makeState, idSlug } from "./state.mjs";
-import { makeGh } from "./gh.mjs";
+import { makeHostRegistry } from "./hosts.mjs";
 import { makeGit } from "./git.mjs";
-import { resolveCredential } from "./credential.mjs";
+import { repositoryIdentity } from "./repository.mjs";
 import { resolveIdentity } from "./identity.mjs";
 import { makeNotifier } from "./notify.mjs";
 import { makeLog } from "./log.mjs";
@@ -20,6 +20,7 @@ import { capabilitiesFor } from "./harness.mjs";
 import { createLearningService } from "./learning.mjs";
 import { makeTrust } from "./events.mjs";
 import { revokeLearningAttempts } from "./learning_input.mjs";
+import { createReviewService } from "./first_party_review.mjs";
 import { silentLog } from "./log.mjs";
 const { createTaskService } = await import("./tasks.mjs").catch(error => {
   if (error.code === "ERR_MODULE_NOT_FOUND") assertExecutionDependency(null);
@@ -42,26 +43,24 @@ export function makeContext({ home = gallivantHome(), needConfig = true, readOnl
   const log = readOnly ? silentLog : makeLog(home);
   if (!needConfig) return { home, log };
   const config = loadConfig(home);
-  // One credential resolver for the whole process, shared by `gh` and `git` so both act as the same identity.
-  //
-  // Per call, not per boot. It costs one `gh auth token` subprocess (only when neither the config file nor the
-  // daemon's own environment answers, which are both free), and it is the only way an operator who re-authenticates
-  // under a long-lived daemon gets the new token without restarting it. A value cached at boot would expire under
-  // exactly the daemon this product is built around.
-  const credential = (opts = {}) => resolveCredential(config, opts);
+  // Each adapter resolves its credentials per operation, so reauthentication is
+  // picked up without restarting the coordinator or sharing another host's token.
+  const hosts = makeHostRegistry({ config, log });
+  const credential = (opts = {}) => hosts.credential(repositoryIdentity(opts.path ?? opts.repository ?? opts.repo ?? "owner/name", opts.host));
   // The git identity a run commits as, resolved the same way and for the same reason: per call, so an operator who
   // changes their name or email under a long-lived daemon is committed as who they are now.
   const identity = () => resolveIdentity();
-  const gh = makeGh({ credential, log });
+  const host = hosts.api;
+  const gh = hosts.select("owner/name").api;
   const state = makeState(home);
   const context = {
-    home, log, config, gh, credential, identity,
+    home, log, config, host, hosts, gh, credential, identity,
     state, capabilitiesFor,
     executionInputFor: (id, entry, input, contextPaths) => remoteInput(context, id, entry, input, contextPaths),
     // `identity` as well as `credential`, because `git.mergeBase` commits: the merge that brings a base into a branch
     // is the daemon's own commit, and with no identity pairs it is either attributed to a machine-derived address or
     // refused outright, depending on whether the host's git can guess one. See makeGit for the two shapes.
-    git: makeGit({ config, credential, identity }),
+    git: makeGit({ config, identity, hosts }),
     notify: makeNotifier({ config, log }),
     runnerFor: id => makeRunner(join(home, "runs", idSlug(id))),
     executionFor: (id, provider) => {
@@ -72,9 +71,9 @@ export function makeContext({ home = gallivantHome(), needConfig = true, readOnl
       return makeExecution({ root, taskId: id, provider, account, ledgerEpoch: epoch, ledgerFile: join(root, epoch ? `execution-${epoch}.json` : "execution.json"),
         ...(provider === "openai-agents" ? { transport: makeAgentsTransport({ root, taskId: id, account, config: selected }), capabilities: { ...capabilitiesFor(provider), models: [selected?.model] } } : {}),
         ...(provider === "codex-cloud" ? { transport: makeCloudTransport({ root, taskId: id, account, config: selected, verifyRemote: async input => {
-          if (await gh.refSha(input.repo, input.sources.inputBranch) !== input.inputHead || await gh.refSha(input.repo, input.branch) !== input.inputHead) throw new Error("Cloud remote input revision moved; reconcile before dispatch");
+          if (await host.refSha(input.repo, input.sources.inputBranch) !== input.inputHead || await host.refSha(input.repo, input.branch) !== input.inputHead) throw new Error("Cloud remote input revision moved; reconcile before dispatch");
           for (const [path, hash] of Object.entries(input.sources.hashes)) {
-            if (contentHash(await gh.fileAtStrict(input.repo, path, input.inputHead)) !== hash) throw new Error("Cloud remote snapshot hash differs");
+            if (contentHash(await host.fileAtStrict(input.repo, path, input.inputHead)) !== hash) throw new Error("Cloud remote snapshot hash differs");
           }
         } }), capabilities: { ...capabilitiesFor(provider), environments: [selected?.environment] } } : {}),
         legacySessionId: state.get(id)?.harness === provider ? state.get(id).session : null,
@@ -92,11 +91,17 @@ export function makeContext({ home = gallivantHome(), needConfig = true, readOnl
   const learningServices = new Map();
   context.learningFor = (ownLogin = "learning-coordinator", { signerExecutable } = {}) => {
     const cacheKey = JSON.stringify([ownLogin, signerExecutable ?? null]);
-    if (!learningServices.has(cacheKey)) learningServices.set(cacheKey, createLearningService({
-      root: join(home, "learning"), signerExecutable, gh, trust: makeTrust(config, ownLogin),
-      onRevocation: intent => revokeLearningAttempts(context, intent),
-    }));
+    if (!learningServices.has(cacheKey)) {
+      const service = createLearningService({
+        root: join(home, "learning"), signerExecutable, gh, trust: makeTrust(config, ownLogin),
+        onRevocation: intent => revokeLearningAttempts(context, intent),
+      });
+      learningServices.set(cacheKey, { ...service,
+        identityFor: name => hosts.select(name).adapter.features?.learning ? service.identityFor(name) : null,
+      });
+    }
     return learningServices.get(cacheKey);
   };
+  if (!readOnly) context.reviewService = createReviewService(context);
   return context;
 }

package/lib/control.mjs

@@ -1,3 +1,4 @@
+import { hostApi } from "./hosts.mjs";
 // Local operator requests. UI and CLI enqueue; the daemon is the only consumer.
 // One outstanding request per entry avoids competing resumes and needs no second runner.
 import { randomUUID } from "node:crypto";
@@ -5,7 +6,7 @@ import { needsAgentResume } from "./network_recovery.mjs";
 import { resolveHandle, STATES } from "./state.mjs";
 import { readDaemon, assertDaemonUsable } from "./daemon.mjs";
 import { nowIso } from "./time.mjs";
-import { NEEDS_LABEL, READY_LABEL } from "./gh.mjs";
+import { NEEDS_LABEL, READY_LABEL } from "./host_contract.mjs";
 import { adapterFor } from "./harness.mjs";
 import { executionRunner, unsubmittedInitialDispatch, PROVIDER_STATES } from "./execution.mjs";
 import { requestRunCancellation } from "./run.mjs";
@@ -163,21 +164,28 @@ export async function applyControl(ctx, id) {
   }
   const runner = executionRunner(ctx, id);
   if (runner.current()?.running) return false;
+  if (["message", "resume"].includes(request.action)) {
+    const health = ctx.providerHealth?.get(entry.harness, ctx.config.harness[entry.harness]?.account || "operator");
+    if (health?.pending) {
+      if (request.message !== "Waiting for the provider readiness check.") ctx.state.update(id, current => current.control?.id === request.id ? { control: { ...request, message: "Waiting for the provider readiness check." } } : {});
+      return true;
+    }
+  }
   ctx.state.update(id, { control: { ...request, status: "applying" } });
   try {
     if (entry.state === STATES.done) throw new Error("The task was closed or merged before this request ran.");
     if (entry.pr) {
-      const pr = await ctx.gh.prView(entry.repo, entry.pr);
+      const pr = await hostApi(ctx).prView(entry.repo, entry.pr);
       if (pr.state !== "OPEN") throw new Error("The PR is no longer open.");
     }
     let run = null, initialLaunch = false;
     if (request.action === "recheck") {
       if (needsAgentResume(entry)) throw Object.assign(new Error("The agent failure requires resume, not PR recheck."), { code: "AGENT_RESUME_REQUIRED" });
       if (executionResultCheckpoint(runner)?.phase === "blocked") throw Object.assign(new Error("Result publication needs an explicit corrective resume."), { code: "EXECUTION_RESULT_BLOCKED" });
-      await ctx.gh.removeLabel(entry.repo, entry.pr, READY_LABEL);
-      await ctx.gh.removeLabel(entry.repo, entry.pr, NEEDS_LABEL);
+      await hostApi(ctx).removeLabel(entry.repo, entry.pr, READY_LABEL);
+      await hostApi(ctx).removeLabel(entry.repo, entry.pr, NEEDS_LABEL);
       ctx.state.update(id, {
-        state: STATES.prOpen, reason: null, retry: null, labels_pending: false, public_fix: null,
+        state: STATES.prOpen, reason: null, retry: null, labels_pending: false, public_fix: null, review_next_at: 0,
         last: { ...entry.last, event: "operator requested PR recheck" }, updated_at: nowIso(ctx.clock),
       });
       // Preserve budgets, dispatch markers and the brief. Only the normal tick judges readiness.
@@ -187,13 +195,20 @@ export async function applyControl(ctx, id) {
       run = result.run;
       initialLaunch = result.initialLaunch === true;
       // A cosmetic label failure after spawning must not invite another resume.
-      if (entry.pr) await ctx.gh.removeLabel(entry.repo, entry.pr, NEEDS_LABEL).catch(e => ctx.log.warn(`${id}: could not remove stopped label: ${e.message}`));
+      if (entry.pr) await hostApi(ctx).removeLabel(entry.repo, entry.pr, NEEDS_LABEL).catch(e => ctx.log.warn(`${id}: could not remove stopped label: ${e.message}`));
     }
     finish({ status: "applied", run, message: initialLaunch ? "Started the initial run after repairing launch prerequisites." : request.action === "message"
       ? "Started the next run in the same session with your message."
       : run ? "Resumed the same agent session." : "Watching PR checks and review again." });
     return request.action !== "recheck"; // A recheck continues through normal judgement in this same tick.
   } catch (e) {
+    // PROVIDER_UNAVAILABLE is raised only before launch. Preserve the exact
+    // request when a due probe races with preparation; do not replay an
+    // ambiguous dispatch or turn a failed/auth check into automatic retries.
+    if (e.code === "PROVIDER_UNAVAILABLE" && e.retryableProviderPending === true) {
+      ctx.state.update(id, current => current.control?.id === request.id ? { control: { ...request, status: "queued", message: "Waiting for the provider readiness check." } } : {});
+      return true;
+    }
     ctx.log.warn(`${id}: operator ${request.action} failed: ${e.message}`);
     // Subprocess errors can carry credentials. Details stay in the local daemon log.
     finish({ status: "failed", message: controlFailure(e) });

package/lib/credential.mjs

@@ -1,3 +1,4 @@
+import { parseRemote, repositoryIdentity } from "./repository.mjs";
 // The one place a GitHub credential for a run is resolved.
 //
 // The defect this exists for. A run is sandboxed: it cannot reach the operator's macOS keyring, their Linux secret
@@ -46,15 +47,11 @@ export const SOURCES = Object.freeze({
  * The host a remote URL's credential belongs to. `gh` can be logged in to an enterprise host as well as
  * github.com, and the token for github.com is the wrong one for `github.acme.com`.
  *
- * Only the host is taken, and only from a URL shape we recognise. An SSH remote has no useful host for a token
- * (a token cannot authenticate SSH), so it reads as github.com and the caller's own remote check is what fails.
+ * The strict repository parser supplies the host for every accepted transport. Malformed input throws
+ * without reflecting URL userinfo. The host adapter decides which transport may actually use a token.
  */
 export function hostFromRemote(url) {
-  const s = String(url || "").trim();
-  const m = s.match(/^https?:\/\/(?:[^@/]*@)?([a-z0-9.-]+)/i);
-  if (m) return m[1].toLowerCase();
-  const ssh = s.match(/^(?:ssh:\/\/)?(?:[^@/]+@)([a-z0-9.-]+)[:/]/i);
-  return ssh ? ssh[1].toLowerCase() : "github.com";
+  return parseRemote(url).host;
 }
 
 /** True when a host is github.com itself rather than an enterprise install. */
@@ -111,6 +108,7 @@ export function noCredentialMessage(host = "github.com") {
  * putting a real token anywhere near a fixture.
  */
 export async function resolveCredential(config, { host = "github.com", env = process.env, exec = execFileAsyncQuiet } = {}) {
+  if (host.toLowerCase() === "bitbucket.org") throw new Error("GitHub credentials cannot authorize Bitbucket; resolve its selected credential through the host registry");
   // A configured file is an authority boundary, not merely the first candidate.
   // Missing, unreadable or blank must not silently widen to an ambient login.
   if (config?.github_token_file) {
@@ -134,12 +132,11 @@ export const describe = ({ token, source, host }) =>
   token ? `${source}${isDotCom(host) ? "" : ` for ${host}`} (${token.length} characters)` : "none";
 
 /**
- * The host a checkout's credential belongs to, from its `origin` remote. Failure reads as github.com, because a
- * checkout whose remote cannot be read has a bigger problem than which host its token is for and the caller's own
- * git operations will say so.
+ * The host a checkout's credential belongs to, from its verified origin. Unreadable origins throw before
+ * any credential is resolved; they never fall back to another host.
  */
 export async function hostForWorktree(git, dir) {
-  try { return hostFromRemote(await git.originOf(dir)); } catch { return "github.com"; }
+  return hostFromRemote(await git.originOf(dir));
 }
 
 /**
@@ -154,8 +151,17 @@ export async function hostForWorktree(git, dir) {
  * from the config alone, so a test that wants a credential sets `github_token_file` and one that wants none sets
  * nothing, and no test needs a `gh` on the machine.
  */
-export async function resolveCredentialFor(ctx, { worktree = null } = {}) {
-  const host = worktree && ctx.git ? await hostForWorktree(ctx.git, worktree) : "github.com";
+export async function resolveCredentialFor(ctx, { worktree = null, repo = null } = {}) {
+  let repository = repo ? repositoryIdentity(repo) : null;
+  if (worktree && ctx.git?.originOf) {
+    const actual = parseRemote(await ctx.git.originOf(worktree));
+    if (repository && actual.remoteIdentity !== repository.remoteIdentity) throw new Error("Checkout host/repository mismatch; restore the bound origin before resolving credentials");
+    repository = actual;
+  }
+  repository ??= repositoryIdentity("owner/name");
+  if (ctx.hosts) return ctx.hosts.credential(repository);
   const resolve = ctx.credential ?? (opts => resolveCredential(ctx.config, opts));
-  return resolve({ host });
+  const resolved = await resolve({ host: repository.host });
+  if (resolved?.host && resolved.host !== repository.host) throw new Error("Credential host mismatch");
+  return { ...resolved, host: repository.host, ...(repo || worktree ? { repository: repository.path } : {}) };
 }

package/lib/deliverable.mjs

@@ -35,6 +35,8 @@ export const provenance = (framework = null) => ({ ...(framework ? { framework }
 
 const RECEIPT_RE = new RegExp("^```(?:" + RECEIPT_TAGS.join("|") + ")\\s*\\n([\\s\\S]*?)\\n```[ \t]*\\r?(?=\\n|$)", "gm");
 const receiptMatches = body => [...String(body || "").matchAll(RECEIPT_RE)];
+/** A cross-host handoff must not carry the source task's machine receipt. */
+export const withoutReceipt = body => String(body || "").replace(RECEIPT_RE, "");
 export const publicTaskId = taskId => "task-" + createHash("sha256").update(String(taskId)).digest("hex").slice(0, 24);
 const FETCH_TIMEOUT_MS = 15_000;
 // The hosted route limits the whole JSON body to 256 KiB, including the passport and JSON escaping.