argus-reviewer-e2e 0.1.3 → 0.2.0

package/dist/config.d.ts

@@ -1,3 +1,4 @@
+import type { Trust } from './trust.js';
 export interface ProviderRules {
     only?: string[];
     ignore?: string[];
@@ -59,6 +60,13 @@ export interface Config {
      * PR diffs and post findings. Defaults to the primary `model` if not set.
      */
     code_model: string | undefined;
+    /**
+     * OpenRouter Decisions API model for typed adjudication (Jev). Defaults
+     * to the pinned `typesafe/jev-1.13-20260917` — alias slugs like
+     * `~typesafe/jev-latest` drift silently and thresholds are calibrated
+     * to a version. Set to `''` to disable adjudication (regex-only mode).
+     */
+    decisionModel: string | undefined;
     /**
      * Hard budget for the `argus-reviewer code-review` lane. When set, the
      * review stops early if the cumulative OpenRouter cost exceeds this cap.
@@ -152,16 +160,69 @@ export interface Config {
      * `resolveConfig` — `enabled: false` by default so the lane is opt-in.
      */
     sandbox: Sandbox;
+    /**
+     * Code-review policy knobs. Always populated after `resolveConfig`.
+     * `secretsThreshold`: Jev `noul` probability at/above which a
+     * secret-shaped diff literal is reported as a finding (below →
+     * suppressed but audit-recorded). Default 0.3 — tune after dogfooding.
+     * `maxComments`: cap on inline review comments posted per run
+     * (default 20) — overflow is summarized count-only in the sticky.
+     * `severityGate`: consumer-facing alias over `severity` — 'bug'
+     * fails on bugs only, 'risk' fails on bug|risk. Unset → `severity`
+     * list is authoritative.
+     * `triage`: Jev pre-review lane — 'off' no call, 'annotate' (default)
+     * records risk/deep-review/area into the report + sticky, 'route'
+     * additionally swaps the code model to `lowRiskModel` on low-risk
+     * diffs. Jev routes/annotates, never gates — coverage is constant.
+     * `lowRiskModel`: the cheap code-model slug 'route' falls to; unset →
+     * route keeps `code_model` (annotate-equivalent).
+     * `findingThreshold`: P(false-positive) required to suppress a nit/q
+     * finding after Jev adjudication — 1.0 (default) is annotate-only,
+     * lowering it suppresses progressively more low-confidence nits.
+     * bug/risk are never suppressed.
+     */
+    review: {
+        secretsThreshold: number;
+        maxComments: number;
+        severityGate: 'bug' | 'risk' | undefined;
+        triage: 'off' | 'annotate' | 'route';
+        lowRiskModel: string | undefined;
+        findingThreshold: number;
+    };
 }
-export type ConfigInput = Partial<Omit<Config, 'provider' | 'sandbox'>> & {
+export type ConfigInput = Partial<Omit<Config, 'provider' | 'sandbox' | 'review'>> & {
     provider?: Partial<ProviderRules>;
     sandbox?: Partial<Sandbox>;
+    review?: Partial<Config['review']>;
 };
 export declare const DEFAULT_RECORD_STEP_CAP = 40;
 export declare const DEFAULT_SANDBOX: Sandbox;
 export declare function defineConfig(input: ConfigInput): ConfigInput;
+/**
+ * Which severities fail the review status. `review.severityGate` is the
+ * consumer-facing alias over `severity` — 'risk' fails on bug|risk,
+ * 'bug' on bugs only; unset → the `severity` list is authoritative.
+ */
+export declare function resolveBlockSeverities(config: Config): string[];
+/**
+ * Inline-comment cap: `ARGUS_MAX_COMMENTS` (the action's `max-comments`
+ * input) wins when it parses as a non-negative integer — it's set by the
+ * workflow author, so an untrusted PR config can't reach it (`review`
+ * isn't on the untrusted allowlist). Anything else → `review.maxComments`.
+ */
+export declare function resolveMaxComments(env: Record<string, string | undefined>, config: Config): number;
 export declare function resolveConfig(input?: ConfigInput): Config;
-export declare function loadConfig(cwd: string): Promise<Config>;
+export interface LoadConfigOpts {
+    /**
+     * Required — there is no default. Every call site must state the
+     * checkout's trust so a missed or future caller can't silently execute
+     * config code on a hostile tree (see src/trust.ts).
+     */
+    trust: Trust;
+    /** Human-readable note on security-relevant load decisions (e.g. ctx.err). */
+    note?: (line: string) => void;
+}
+export declare function loadConfig(cwd: string, opts: LoadConfigOpts): Promise<Config>;
 /**
  * Provider slugs the harness recognizes for `provider.only/ignore/order`
  * (KTD4). Unknown slugs warn but do not fail — OpenRouter's catalog changes

package/dist/config.js

@@ -1,4 +1,5 @@
 import { pathToFileURL } from 'node:url';
+import { JEV_DEFAULT_MODEL } from './vision/decisions.js';
 export const DEFAULT_RECORD_STEP_CAP = 40;
 export const DEFAULT_SANDBOX = {
     enabled: false,
@@ -15,6 +16,7 @@ const defaults = {
     escalation_model: 'moonshotai/kimi-k2.5',
     grounding_model: undefined,
     code_model: 'deepseek/deepseek-v4.1-flash',
+    decisionModel: JEV_DEFAULT_MODEL,
     codeReviewBudgetUsd: undefined,
     provider: {
         ignore: ['siliconflow', 'novitaai', 'atlascloud', 'streamlake', 'chutes'],
@@ -38,6 +40,14 @@ const defaults = {
     a0: undefined,
     heal: 'local',
     sandbox: { ...DEFAULT_SANDBOX },
+    review: {
+        secretsThreshold: 0.3,
+        maxComments: 20,
+        severityGate: undefined,
+        triage: 'annotate',
+        lowRiskModel: undefined,
+        findingThreshold: 1.0,
+    },
 };
 export function defineConfig(input) {
     return input;
@@ -46,6 +56,36 @@ export function defineConfig(input) {
 function posInt(v, dflt) {
     return v !== undefined && Number.isFinite(v) && v >= 1 ? Math.floor(v) : dflt;
 }
+/** Probability config values (must be in [0,1]) fall back to their default. */
+function prob01(v, dflt) {
+    return v !== undefined && Number.isFinite(v) && v >= 0 && v <= 1 ? v : dflt;
+}
+/**
+ * Which severities fail the review status. `review.severityGate` is the
+ * consumer-facing alias over `severity` — 'risk' fails on bug|risk,
+ * 'bug' on bugs only; unset → the `severity` list is authoritative.
+ */
+export function resolveBlockSeverities(config) {
+    if (config.review.severityGate === 'risk')
+        return ['bug', 'risk'];
+    if (config.review.severityGate === 'bug')
+        return ['bug'];
+    return config.severity ?? ['bug'];
+}
+/**
+ * Inline-comment cap: `ARGUS_MAX_COMMENTS` (the action's `max-comments`
+ * input) wins when it parses as a non-negative integer — it's set by the
+ * workflow author, so an untrusted PR config can't reach it (`review`
+ * isn't on the untrusted allowlist). Anything else → `review.maxComments`.
+ */
+export function resolveMaxComments(env, config) {
+    const raw = env.ARGUS_MAX_COMMENTS?.trim();
+    // ^\d+$ — Number() would also accept '0x10', '1e2', ' 4 ', 'Infinity'.
+    if (raw !== undefined && /^\d+$/.test(raw)) {
+        return Number(raw);
+    }
+    return config.review.maxComments;
+}
 export function resolveConfig(input = {}) {
     const provider = { ...defaults.provider, ...(input.provider ?? {}) };
     // Wrong-typed sandbox values (e.g. `sandbox: true`, `enabled: 'yes'`,
@@ -56,23 +96,81 @@ export function resolveConfig(input = {}) {
     sandbox.enabled = raw.enabled === true;
     sandbox.allowForks = raw.allowForks === true;
     sandbox.image = typeof raw.image === 'string' && raw.image !== '' ? raw.image : undefined;
-    sandbox.memory = typeof raw.memory === 'string' && raw.memory !== '' ? raw.memory : DEFAULT_SANDBOX.memory;
+    sandbox.memory =
+        typeof raw.memory === 'string' && raw.memory !== '' ? raw.memory : DEFAULT_SANDBOX.memory;
     sandbox.cpus = typeof raw.cpus === 'string' && raw.cpus !== '' ? raw.cpus : DEFAULT_SANDBOX.cpus;
     sandbox.maxProbes = posInt(sandbox.maxProbes, DEFAULT_SANDBOX.maxProbes);
     sandbox.timeoutMs = posInt(sandbox.timeoutMs, DEFAULT_SANDBOX.timeoutMs);
     sandbox.pidsLimit = posInt(sandbox.pidsLimit, DEFAULT_SANDBOX.pidsLimit);
-    const resolved = { ...defaults, ...input, provider, sandbox };
+    const rawReview = typeof input.review === 'object' && input.review !== null ? input.review : {};
+    const review = { ...defaults.review, ...rawReview };
+    // Thresholds must be probabilities — anything else (NaN, >1,
+    // negative) would silently suppress or flood the Jev lanes.
+    review.secretsThreshold = prob01(review.secretsThreshold, defaults.review.secretsThreshold);
+    review.maxComments =
+        typeof review.maxComments === 'number' &&
+            Number.isInteger(review.maxComments) &&
+            review.maxComments >= 0
+            ? review.maxComments
+            : defaults.review.maxComments;
+    if (review.severityGate !== 'bug' && review.severityGate !== 'risk') {
+        review.severityGate = undefined;
+    }
+    if (review.triage !== 'off' && review.triage !== 'annotate' && review.triage !== 'route') {
+        review.triage = defaults.review.triage;
+    }
+    if (typeof review.lowRiskModel !== 'string' || review.lowRiskModel === '') {
+        review.lowRiskModel = undefined;
+    }
+    review.findingThreshold = prob01(review.findingThreshold, defaults.review.findingThreshold);
+    const resolved = { ...defaults, ...input, provider, sandbox, review };
     resolved.recordStepCap = posInt(resolved.recordStepCap, DEFAULT_RECORD_STEP_CAP);
     if (resolved.heal !== 'a0')
         resolved.heal = 'local';
+    // '' is the documented opt-out — an empty slug would send a broken
+    // model id to the decisions endpoint on every adjudication call.
+    if (resolved.decisionModel === '')
+        resolved.decisionModel = undefined;
     return resolved;
 }
-export async function loadConfig(cwd) {
+/**
+ * Config keys honored on untrusted checkouts — policy-free fields only.
+ * Everything else (exec-bearing fields, model/budget/provider selection,
+ * severity/verdict policy, credentials maps, network endpoints, write
+ * locations) is ignored: the review policy over hostile code must not be
+ * authored by that code.
+ */
+const UNTRUSTED_CONFIG_KEYS = new Set(['logLevel', 'sourceGlobs']);
+function filterUntrustedConfig(input) {
+    const out = {};
+    for (const [key, value] of Object.entries(input)) {
+        if (UNTRUSTED_CONFIG_KEYS.has(key))
+            out[key] = value;
+    }
+    return out;
+}
+export async function loadConfig(cwd, opts) {
     const fs = await import('node:fs/promises');
     const path = await import('node:path');
+    const untrusted = opts.trust === 'untrusted';
     const names = ['argus-reviewer.config', 'vision-e2e.config'];
     for (const name of names) {
-        for (const ext of ['.ts', '.json']) {
+        if (untrusted) {
+            // Surface skipped .ts candidates — otherwise a hostile config (or a
+            // legit consumer debugging "why is my config ignored") is invisible.
+            try {
+                if ((await fs.stat(path.join(cwd, `${name}.ts`))).isFile()) {
+                    opts.note?.(`config: ${name}.ts ignored — untrusted checkouts load JSON config only`);
+                }
+            }
+            catch {
+                // no .ts candidate — nothing to note
+            }
+        }
+        // .ts is tried before .json, so an untrusted checkout must skip the .ts
+        // candidate *before* it can shadow a committed .json — importing it
+        // executes arbitrary code beside the runner's secrets (#58).
+        for (const ext of untrusted ? ['.json'] : ['.ts', '.json']) {
             const file = path.join(cwd, `${name}${ext}`);
             try {
                 const stat = await fs.stat(file);
@@ -80,7 +178,12 @@ export async function loadConfig(cwd) {
                     continue;
                 if (ext === '.json') {
                     const raw = await fs.readFile(file, 'utf8');
-                    return resolveConfig(JSON.parse(raw));
+                    const parsed = JSON.parse(raw);
+                    if (untrusted) {
+                        opts.note?.(`config: ${name}.json loaded untrusted — honoring ${[...UNTRUSTED_CONFIG_KEYS].join(', ')} only`);
+                        return resolveConfig(filterUntrustedConfig(parsed));
+                    }
+                    return resolveConfig(parsed);
                 }
                 // Always transpile .ts to a temp .mjs rather than importing natively:
                 // Node's built-in type stripping resolves the module type from the

package/dist/debug.d.ts

@@ -1 +1,2 @@
+export declare function setLiveDir(dir: string | undefined): void;
 export declare function debug(kind: string, ...args: unknown[]): void;

package/dist/debug.js

@@ -1,8 +1,14 @@
 import { join } from 'node:path';
 import { liveLog } from './live.js';
 const DEBUG = process.env.ARGUS_DEBUG === '1' || process.env.ARGUS_DEBUG === 'true';
-// debug() has no config access — it lives under the default cache dir.
-const LIVE_DIR = join(process.cwd(), '.argus-reviewer-cache');
+// debug() has no config access — it defaults to the conventional cache dir,
+// and callers that resolve a config set the real live dir once it's known
+// (otherwise debug lines and stage lines would split across two dirs).
+const DEFAULT_LIVE_DIR = join(process.cwd(), '.argus-reviewer-cache');
+let liveDir = DEFAULT_LIVE_DIR;
+export function setLiveDir(dir) {
+    liveDir = dir ?? DEFAULT_LIVE_DIR;
+}
 function toMsg(arg) {
     if (typeof arg === 'string')
         return arg;
@@ -18,7 +24,7 @@ export function debug(kind, ...args) {
     if (!DEBUG)
         return; // keep debug() free of fs work on the hot path
     for (const arg of args) {
-        liveLog(LIVE_DIR, kind, 'debug', toMsg(arg));
+        liveLog(liveDir, kind, 'debug', toMsg(arg));
         const prefix = `[argus-reviewer:${kind}]`;
         if (typeof arg === 'string') {
             console.error(`${prefix} ${arg}`);

package/dist/evidence/ci.d.ts

@@ -42,6 +42,9 @@ export interface PrMeta {
      * timeline fetch failed (the gate fails closed either way).
      */
     labelApprovedAt: string | undefined;
+    /** PR title/body — triage state only (untrusted text; feeds Jev, never gates). */
+    title: string | undefined;
+    body: string | undefined;
 }
 /**
  * Shared GitHub GET scaffold — Bearer auth, API headers, 30s abort timeout,

package/dist/evidence/ci.js

@@ -6,7 +6,7 @@ export const PROBE_LABEL = 'argus-probe';
  * FIRST_TIMER, MANNEQUIN, and NONE are not.
  */
 export function isTrustedAssociation(association) {
-    return (association === 'MEMBER' || association === 'OWNER' || association === 'COLLABORATOR');
+    return association === 'MEMBER' || association === 'OWNER' || association === 'COLLABORATOR';
 }
 const GH_API = 'https://api.github.com';
 const MAX_CHECK_RUN_PAGES = 5;
@@ -85,6 +85,8 @@ export async function fetchPrMeta(repo, pr, token, ctx) {
         labels,
         pushedAt: data.head?.repo?.pushed_at,
         labelApprovedAt,
+        title: typeof data.title === 'string' ? data.title : undefined,
+        body: typeof data.body === 'string' ? data.body : undefined,
     };
 }
 /**

package/dist/probe/queue.d.ts

@@ -6,6 +6,7 @@ import type { RepoIndex } from '../index/scan.js';
 import type { VisionClient } from '../engine/loop.js';
 import type { CallCost } from '../vision/cost.js';
 import type { Ledger } from '../vision/ledger.js';
+import type { TriageAreaSignal } from '../review/triage.js';
 import { type ProbeOutcome } from './harness.js';
 /**
  * The B.2 probe lane (U4). Called after `linkFindings` inside `code-review`.
@@ -69,13 +70,15 @@ export interface ProbeLaneOptions {
     /** Configured blocking severities — the queue only admits those. */
     severityGates: string[];
     index: RepoIndex | undefined;
+    /** U9 — triage top_risk_area; advisory reorder of probe candidates. */
+    triageArea?: TriageAreaSignal | undefined;
     /** Report sink — authored probe CallCosts are pushed here for the report. */
     calls?: CallCost[] | undefined;
     exec?: ExecFn | undefined;
     log?: ((line: string) => void) | undefined;
 }
 /** Pure selection: not_exercised findings at blocking severities, capped. */
-export declare function selectProbeTargets(findings: LinkedFinding[], severityGates: string[], maxProbes: number): LinkedFinding[];
+export declare function selectProbeTargets(findings: LinkedFinding[], severityGates: string[], maxProbes: number, triageArea?: TriageAreaSignal): LinkedFinding[];
 /**
  * Repo-relative path gate for anything model- or index-derived that is read
  * or written on the HOST: no absolute paths, no `..` escapes, no backslashes.

package/dist/probe/queue.js

@@ -7,14 +7,42 @@ import { isTestFile } from '../evidence/link.js';
 import { buildProbeMessages, parseProbe, probeImportsSafe, PROBE_SCHEMA, } from './author.js';
 import { detectHarness } from './harness.js';
 import { checkSandboxPaths, dockerAvailable, resolveSandboxImage, runProbeInSandbox, SANDBOX_OUTPUT_CAP, SCRATCH_DIR_NAME, stripControlChars, sandboxLimits, } from '../executor/sandbox.js';
+/** U9 — below this confidence the triage area signal is ignored. */
+const MIN_AREA_CONFIDENCE = 0.5;
+/**
+ * U9 triage-informed ordering: a finding's file path "hits" the flagged
+ * risk area when a path segment equals the area token or starts with
+ * it at a camelCase/digit boundary — `src/auth/session.ts` and
+ * `dataStore.ts` hit auth/data, while `author.ts` and `database.ts`
+ * do not. Advisory only.
+ */
+function fileHitsArea(file, area) {
+    const token = area.toLowerCase();
+    return file.split(/[/._-]+/).some((segment) => {
+        const lower = segment.toLowerCase();
+        if (lower === token)
+            return true;
+        if (!lower.startsWith(token))
+            return false;
+        return /[A-Z0-9]/.test(segment.charAt(token.length));
+    });
+}
 /** Pure selection: not_exercised findings at blocking severities, capped. */
-export function selectProbeTargets(findings, severityGates, maxProbes) {
-    return findings
-        .filter((f) => f.evidence.status === 'not_exercised' &&
+export function selectProbeTargets(findings, severityGates, maxProbes, triageArea) {
+    const eligible = findings.filter((f) => f.evidence.status === 'not_exercised' &&
         f.file !== undefined &&
         isSafeRepoPath(f.file) &&
-        severityGates.includes(f.severity ?? ''))
-        .slice(0, Math.max(0, maxProbes));
+        severityGates.includes(f.severity ?? ''));
+    // U9 — a confident triage top_risk_area reorders candidates so probes
+    // prefer the flagged subsystem. Stable sort keeps the original order
+    // within each group; probe count/gates/verdict are unchanged.
+    if (triageArea !== undefined && triageArea.confidence >= MIN_AREA_CONFIDENCE) {
+        // Hit flags precomputed once — the comparator would re-derive them
+        // O(n log n) times otherwise.
+        const hit = new Map(eligible.map((f) => [f, fileHitsArea(f.file ?? '', triageArea.area)]));
+        eligible.sort((a, b) => Number(hit.get(b)) - Number(hit.get(a)));
+    }
+    return eligible.slice(0, Math.max(0, maxProbes));
 }
 /**
  * Repo-relative path gate for anything model- or index-derived that is read
@@ -145,14 +173,24 @@ async function authorProbe(o, target, harness, exemplarPath, indexPaths) {
         });
     }
     catch (e) {
-        return { probe: undefined, reason: `authoring call failed: ${e.message}`, costUsd: 0, tokens: 0 };
+        return {
+            probe: undefined,
+            reason: `authoring call failed: ${e.message}`,
+            costUsd: 0,
+            tokens: 0,
+        };
     }
     o.ledger.recordCall(response.cost);
     o.calls?.push(response.cost);
     const parsed = parseProbe(response.content);
     if (!parsed.ok) {
         // Failed parses still cost the call — carry the spend on the record.
-        return { probe: undefined, reason: parsed.reason, costUsd: response.cost.costUsd, tokens: response.cost.tokens };
+        return {
+            probe: undefined,
+            reason: parsed.reason,
+            costUsd: response.cost.costUsd,
+            tokens: response.cost.tokens,
+        };
     }
     return { probe: parsed.probe, costUsd: response.cost.costUsd, tokens: response.cost.tokens };
 }
@@ -203,7 +241,7 @@ export async function runProbeLane(findings, o) {
     // image/limits/allowForks would self-approve the gate. Forks always run
     // on DEFAULT_SANDBOX and approve only via trusted author or the label.
     const sandbox = o.meta?.isFork ? { ...DEFAULT_SANDBOX, enabled: true } : o.sandbox;
-    const targets = selectProbeTargets(findings, o.severityGates, sandbox.maxProbes);
+    const targets = selectProbeTargets(findings, o.severityGates, sandbox.maxProbes, o.triageArea);
     if (targets.length === 0)
         return { records: [] };
     if (!mayProbePr(o.meta, sandbox)) {

package/dist/review/adjudicate.d.ts

@@ -0,0 +1,63 @@
+import { DecisionClient } from '../vision/decisions.js';
+/**
+ * U8 finding adjudication — one batched Jev decide() scores each
+ * synthesized finding's true-positive probability before posting. Same
+ * posture as the secrets lane: Jev annotates/routes, never gates.
+ * `p` lands on the finding record and the sticky confidence column;
+ * suppression is scoped to `nit`/`q` severities whose false-positive
+ * confidence exceeds `findingThreshold` — `bug`/`risk` are never
+ * suppressed, and a Jev outage leaves every finding unadjudicated and
+ * unsuppressed (degrade open).
+ *
+ * `findingThreshold` is the required P(false positive): a nit/q is
+ * suppressed when `1 - p > threshold`, i.e. `p < 1 - threshold`.
+ * Default 1.0 → nothing can exceed 100% FP → annotate-only.
+ */
+export interface AdjudicableFinding {
+    file: string;
+    line?: number;
+    severity: string;
+    category?: string;
+    message: string;
+}
+export interface FindingAdjudicationRecord {
+    file: string;
+    line?: number;
+    severity: string;
+    category?: string;
+    /** Finding text — capped; suppressed findings keep their message in audit. */
+    message: string;
+    adjudicated: boolean;
+    /** Jev P(true positive) for this finding. */
+    p?: number;
+    /** nit/q below the FP bar — kept for audit, removed from findings. */
+    suppressed?: boolean;
+}
+/** The audit half of the result — what report.findingAdjudication stores. */
+export interface FindingAdjudicationAudit {
+    records: FindingAdjudicationRecord[];
+    /** Findings past MAX_CANDIDATES — unadjudicated, never suppressed. */
+    overflow: number;
+    /** Whole-call failure — nothing adjudicated, nothing suppressed. */
+    unadjudicated?: boolean;
+}
+export interface FindingAdjudicationResult<T extends AdjudicableFinding> extends FindingAdjudicationAudit {
+    /** Surviving findings — adjudicated ones carry `p`. */
+    findings: (T & {
+        p?: number;
+    })[];
+}
+export declare function adjudicateFindings<T extends AdjudicableFinding>(opts: {
+    findings: T[];
+    /** PR file patches keyed by filename — Jev state context. */
+    patchByFile?: Map<string, string>;
+    threshold: number;
+    /**
+     * User-configured blocking severities — a severity listed here drives
+     * the verdict, so it must never be suppressed even if it is nit/q
+     * (otherwise Jev suppression could flip the commit-status gate).
+     */
+    blockSeverities?: string[];
+    client: DecisionClient;
+    model?: string;
+}): Promise<FindingAdjudicationResult<T>>;

package/dist/review/adjudicate.js

@@ -0,0 +1,111 @@
+import { debug } from '../debug.js';
+import { describeDecisionError, isNoulAnswer, MAX_CANDIDATES, } from '../vision/decisions.js';
+/** Suppression is scoped to severities that never drive the verdict. */
+const SUPPRESSIBLE = new Set(['nit', 'q']);
+const MAX_PATCH_EXCERPT = 4000;
+/** Aggregate patch-state bound — 50 unique files x 4KB is still ~200KB. */
+const MAX_PATCH_STATE_CHARS = 24_000;
+/** Audit-record message bound — full text already lives in findings. */
+const MAX_RECORD_MESSAGE = 300;
+export async function adjudicateFindings(opts) {
+    const capped = opts.findings.slice(0, MAX_CANDIDATES);
+    const overflow = opts.findings.length - capped.length;
+    const pByIdx = new Array(capped.length);
+    let adjudicationFailed = false;
+    if (capped.length > 0) {
+        try {
+            const questions = {};
+            capped.forEach((_f, i) => {
+                questions[`f_${i}`] = {
+                    type: 'noul',
+                    instructions: `state.findings[${i}]: is this code-review finding a real problem the ` +
+                        'PR author should act on? Its file patch is under state.patches. ' +
+                        'Answer no for speculative style nits, issues already handled by ' +
+                        'guards visible in the patch, and findings that merely restate ' +
+                        'what the code does.',
+                };
+            });
+            // Each finding references its patch by filename — sending patches
+            // once keyed by file avoids repeating a 4KB excerpt per finding
+            // on the same file; an aggregate bound caps the whole state.
+            const patches = {};
+            let patchBudget = MAX_PATCH_STATE_CHARS;
+            for (const f of capped) {
+                if (patchBudget <= 0)
+                    break;
+                if (patches[f.file] !== undefined)
+                    continue;
+                const p = opts.patchByFile?.get(f.file);
+                if (p !== undefined) {
+                    const excerpt = p.slice(0, Math.min(MAX_PATCH_EXCERPT, patchBudget));
+                    patches[f.file] = excerpt;
+                    patchBudget -= excerpt.length;
+                }
+            }
+            const state = {
+                findings: capped.map((f) => ({
+                    file: f.file,
+                    line: f.line,
+                    severity: f.severity,
+                    message: f.message,
+                })),
+                patches,
+            };
+            const { answers } = await opts.client.decide({
+                ...(opts.model !== undefined ? { model: opts.model } : {}),
+                state,
+                questions,
+            });
+            capped.forEach((_f, i) => {
+                const a = answers[`f_${i}`];
+                pByIdx[i] = a !== undefined && isNoulAnswer(a) ? a.noul : undefined;
+            });
+        }
+        catch (e) {
+            adjudicationFailed = true;
+            debug('adjudicate', `decision call failed — no suppression: ${describeDecisionError(e)}`);
+        }
+    }
+    const blocking = new Set(opts.blockSeverities ?? []);
+    // Only Jev may attach p — a model-emitted p on an unadjudicated
+    // finding is spoofed confidence, so strip it.
+    const stripP = (f) => {
+        const out = { ...f };
+        delete out.p;
+        return out;
+    };
+    const findings = [];
+    const records = [];
+    capped.forEach((f, i) => {
+        const p = pByIdx[i];
+        const adjudicated = p !== undefined && !adjudicationFailed;
+        const suppress = adjudicated &&
+            SUPPRESSIBLE.has(f.severity) &&
+            !blocking.has(f.severity) &&
+            p !== undefined &&
+            p < 1 - opts.threshold;
+        records.push({
+            file: f.file,
+            ...(f.line !== undefined ? { line: f.line } : {}),
+            severity: f.severity,
+            ...(f.category !== undefined ? { category: f.category } : {}),
+            message: f.message.slice(0, MAX_RECORD_MESSAGE),
+            adjudicated,
+            ...(p !== undefined ? { p } : {}),
+            ...(suppress ? { suppressed: true } : {}),
+        });
+        if (!suppress) {
+            findings.push(p !== undefined ? { ...stripP(f), p } : stripP(f));
+        }
+    });
+    // Overflow findings keep their place — never adjudicated, never
+    // suppressed; count-only in the audit record like the secrets lane.
+    for (const f of opts.findings.slice(MAX_CANDIDATES))
+        findings.push(stripP(f));
+    return {
+        findings,
+        records,
+        overflow,
+        ...(adjudicationFailed ? { unadjudicated: true } : {}),
+    };
+}