great-cto 3.71.1 → 3.73.0

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 72 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.71.1",
+  "version": "3.73.0",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/agents/architect.md

@@ -376,7 +376,7 @@ constraint in the new ARCH doc — document why this design choice was not taken
      ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); ARCHETYPE=${ARCHETYPE:-web-service}
      PROJECT_SIZE=$(grep "^project_size:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); PROJECT_SIZE=${PROJECT_SIZE:-medium}
      SECURITY_GATE=$(grep "^security-gate:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); SECURITY_GATE=${SECURITY_GATE:-conditional}
-     COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //' || echo "[]")
+     COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //'); COMPLIANCE=${COMPLIANCE:-[]}
      ```
      Read ARCHETYPES.md for QA strategy, deploy method, and thresholds matching `$ARCHETYPE`. Use these as constraints for the architecture design.
    - **Greenfield check** — determines how deep to read existing code:

package/board/agents/db-migration-reviewer.md

@@ -48,8 +48,9 @@ fi
 echo "Migrations to review:"
 echo "$MIGRATIONS"
 
-DB_ENGINE=$(grep "^db:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}' || \
-            grep -rn "postgresql\|mysql\|sqlite\|aurora\|cockroach\|planetscale" .great_cto/PROJECT.md 2>/dev/null | head -1 | grep -oE "postgresql|mysql|sqlite|aurora|cockroach|planetscale" | head -1 || echo "unknown")
+DB_ENGINE=$(grep "^db:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
+[ -n "$DB_ENGINE" ] || DB_ENGINE=$(grep -oE "postgresql|mysql|sqlite|aurora|cockroach|planetscale" .great_cto/PROJECT.md 2>/dev/null | head -1)
+DB_ENGINE=${DB_ENGINE:-unknown}
 
 # Slug from latest ARCH doc; date fallback must be an explicit branch —
 # `|| echo` after a pipeline never fires (basename "" exits 0 with empty output)

package/board/agents/design-advisor.md

@@ -1,6 +1,6 @@
 ---
 name: design-advisor
-description: Use after architect, before/parallel to pm, for any UI-bearing feature (landing pages, dashboards, admin panels, web apps, React Native apps). Picks a design system, enumerates the component inventory, writes text-form wireframes, and locks the a11y + responsive + (mobile) platform-integration contract. Outputs docs/design/DESIGN-{slug}.md. Plan altitude only — never writes implementation code.
+description: Use after architect and before pm, for any UI-bearing feature (landing pages, dashboards, admin panels, web apps, React Native apps). Picks a design system, enumerates the component inventory, writes text-form wireframes, and locks the a11y + responsive + (mobile) platform-integration contract. Outputs docs/design/DESIGN-{slug}.md. Plan altitude only — never writes implementation code.
 model: claude-opus-5
 authority: autonomous
 tools: Read, Write, Glob, Grep, WebFetch, Bash(git:*), Bash(bd:*), Bash(ls:*), Bash(cat:*), Bash(find:*), Bash(touch:*), Bash(head:*), Bash(tail:*), Bash(grep:*), Bash(wc:*), Bash(date:*), Bash(printf:*), Bash(echo:*), Bash(mkdir:*), memory_20250929, advisor_20260301

package/board/agents/devops.md

@@ -572,7 +572,7 @@ step for that condition before proceeding to Step 1 (gate:ship check).
      ESTIMATED=${ESTIMATED_RAW:-0}
      CONSOLE_URL=$(grep "console-url:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
      SERVICE=$(grep "^service:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}' || basename "$PWD")
-     FEATURE=$(basename "$ARCH_DOC" .md 2>/dev/null | sed 's/^ARCH-//' || echo "unknown")
+     FEATURE=$(basename "$ARCH_DOC" .md 2>/dev/null | sed 's/^ARCH-//'); FEATURE=${FEATURE:-unknown}
 
      COST_LOG=.great_cto/cost-history.log
      [ ! -f "$COST_LOG" ] && printf '# Cost history — append only. Format: ISO8601 | service | estimated_usd_month | actual_usd_month | source | feature\n' > "$COST_LOG"

package/board/agents/growth-engineer.md

@@ -91,7 +91,7 @@ ARCH_FILE=$(ls -t docs/architecture/ARCH-*.md 2>/dev/null | head -1)
 SLUG=$(basename "$ARCH_FILE" .md | sed 's/^ARCH-//')
 
 ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
-GROWTH_GOAL=$(grep "^growth-goal:" .great_cto/PROJECT.md 2>/dev/null | sed 's/growth-goal: //' || echo "not specified")
+GROWTH_GOAL=$(grep "^growth-goal:" .great_cto/PROJECT.md 2>/dev/null | sed 's/growth-goal: //'); GROWTH_GOAL=${GROWTH_GOAL:-not specified}
 # Is there an analytics/connector layer we can read from?
 CONNECT=$(ls docs/connectors/CONNECT-*.md 2>/dev/null | head -1)
 echo "slug=$SLUG archetype=$ARCHETYPE goal='$GROWTH_GOAL' connector=${CONNECT:-none}"

package/board/agents/knowledge-extractor.md

@@ -28,7 +28,7 @@ Run in parallel:
 cat .great_cto/lessons.md 2>/dev/null || echo "(no lessons yet)"
 
 # Cross-project decisions (supplement)
-cat ~/.great_cto/decisions.md 2>/dev/null | head -300 || echo "(none)"
+D=$(head -300 ~/.great_cto/decisions.md 2>/dev/null); [ -n "$D" ] && printf '%s\n' "$D" || echo "(none)"
 
 # Session log pattern lines across all sessions
 grep -h "^## pattern:" .great_cto/logs/session-*-end.md 2>/dev/null \

package/board/agents/l3-support.md

@@ -327,7 +327,7 @@ node "$PLUGIN_DIR/scripts/lib/pattern-lookup.mjs" --role incident
 
    # Priority 4: systemd / journalctl
    if [ -z "$LOG_PATH" ] && [ -z "$APP_CONTAINER" ]; then
-     journalctl --since "30 min ago" -p err 2>/dev/null | tail -50 || \
+     { J=$(journalctl --since "30 min ago" -p err 2>/dev/null | tail -50); [ -n "$J" ] && printf '%s\n' "$J"; } || \
      echo "No log source found. Add 'error-log: /path/to/log' to PROJECT.md L3 section."
    fi
 

package/board/agents/performance-engineer.md

@@ -76,7 +76,7 @@ ARCH_FILE=$(ls -t docs/architecture/ARCH-*.md 2>/dev/null | head -1)
 [ -z "$ARCH_FILE" ] && { echo "BLOCKED: no ARCH doc" >&2; exit 1; }
 SLUG=$(basename "$ARCH_FILE" .md | sed 's/^ARCH-//')
 
-PERF_SLA=$(grep "^performance-sla:" .great_cto/PROJECT.md 2>/dev/null | sed 's/performance-sla: //' || echo "not specified")
+PERF_SLA=$(grep "^performance-sla:" .great_cto/PROJECT.md 2>/dev/null | sed 's/performance-sla: //'); PERF_SLA=${PERF_SLA:-not specified}
 MONTHLY_RPS=$(grep "^expected-rps:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); MONTHLY_RPS=${MONTHLY_RPS:-unknown}
 
 # Check for existing baseline

package/board/agents/pm.md

@@ -115,6 +115,10 @@ PHASE=$(grep "^phase:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); PH
 TEAM_SIZE=$(grep "^team-size:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); TEAM_SIZE=${TEAM_SIZE:-1}
 MONTHLY_BUDGET=$(grep "^monthly-budget-llm-usd:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
 
+# Design contract — design-advisor runs before pm on UI features; plan UI tasks against it
+DESIGN_DOC=$(ls -t docs/design/DESIGN-*.md 2>/dev/null | head -1)
+[ -n "$DESIGN_DOC" ] && echo "=== DESIGN CONTRACT: $DESIGN_DOC (components, a11y, responsive — one task per screen/component group) ==="
+
 # Past lessons — calibrate cost/time estimates against actuals
 if [ -f .great_cto/lessons.md ]; then
   COST_LESSONS=$(grep -B1 -A4 "shape: B" .great_cto/lessons.md 2>/dev/null | head -20)
@@ -138,7 +142,7 @@ FEATURE_SLUG=$(basename "$ARCH_FILE" .md | sed 's/^ARCH-//' | tr '[:upper:]' '[:
 
 # Goal ancestry (Paperclip pattern) — injected into every bd create call.
 # Built AFTER FEATURE_SLUG is known (it interpolates the slug).
-COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //' || echo "")
+COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //')
 _COMP_CLEAN=$(echo "$COMPLIANCE" | sed 's/^\[none\]$//;s/^\[none, *\]//;s/, *\[none\]//')
 GOAL_ANCESTRY="[archetype:${ARCHETYPE}]$([ -n "$_COMP_CLEAN" ] && echo " [compliance:${_COMP_CLEAN}]") [feature:${FEATURE_SLUG}] [phase:${PHASE}] | Why: see docs/plans/PLAN-${FEATURE_SLUG}.md"
 

package/board/agents/qa-engineer.md

@@ -286,9 +286,9 @@ PROJECT_SIZE=$(grep "^project_size:" .great_cto/PROJECT.md 2>/dev/null | awk '{p
 
 ```bash
 ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); ARCHETYPE=${ARCHETYPE:-web-service}
-COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //' || echo "[]")
-QA_EXTRAS=$(grep "^qa-extras:" .great_cto/PROJECT.md 2>/dev/null | sed 's/qa-extras: //' || echo "[]")
-PERF_SLA=$(grep "^performance-sla:" .great_cto/PROJECT.md 2>/dev/null | sed 's/performance-sla: //' || echo "")
+COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //'); COMPLIANCE=${COMPLIANCE:-[]}
+QA_EXTRAS=$(grep "^qa-extras:" .great_cto/PROJECT.md 2>/dev/null | sed 's/qa-extras: //'); QA_EXTRAS=${QA_EXTRAS:-[]}
+PERF_SLA=$(grep "^performance-sla:" .great_cto/PROJECT.md 2>/dev/null | sed 's/performance-sla: //')
 ```
 
 Read ARCHETYPES.md → find QA strategy row for `$ARCHETYPE`. This gives base QA plan.
@@ -362,7 +362,7 @@ PII column additions) that functional tests miss by design — the
 specialist agent owns this.
 
 ```bash
-BASE=$(git rev-parse --abbrev-ref --symbolic-full-name @{u} 2>/dev/null | sed 's|.*/||' || echo "main")
+BASE=$(git rev-parse --abbrev-ref --symbolic-full-name @{u} 2>/dev/null | sed 's|.*/||'); BASE=${BASE:-main}
 MIGRATION_HIT=$(git diff "$BASE"...HEAD --name-only 2>/dev/null | \
   grep -E '(^|/)(migrations|alembic/versions|db/migrate|prisma/migrations|flyway|knex/migrations)/.*\.(sql|py|ts|js|rb)$' | head -5)
 

package/board/agents/security-officer.md

@@ -424,7 +424,7 @@ Continues from the original Workflow below — produces `CSO-{slug}-{date}.md`,
 1b. **Read** `.great_cto/PROJECT.md` → get `archetype`, `type`, `stack`, and `compliance` params:
    ```bash
    ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); ARCHETYPE=${ARCHETYPE:-web-service}
-   COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //' || echo "[]")
+   COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //'); COMPLIANCE=${COMPLIANCE:-[]}
    ```
    Read ARCHETYPES.md → find security rules for `$ARCHETYPE`.
    The `compliance:` list in PROJECT.md determines which checklists to run (see Step 5).
@@ -670,7 +670,7 @@ Observations (signal < 2 or no direct evidence): record in a separate `## Observ
    the pipeline dispatcher and the board parse this line):
    ```bash
    bash scripts/log-verdict.sh security-officer <APPROVED|BLOCKED> auto \
-     findings=P0:<n>,P1:<n>,P2:<n> triaged=<n> valid=<n> invalid=<n> feature=<slug> need=<implementer|decision> finding=<id>
+     findings=P0:<n>,P1:<n>,P2:<n> triaged=<n> valid=<n> invalid=<n> feature=<slug> report=docs/security/CSO-<YYYY-MM-DD>.md need=<implementer|decision> finding=<id>
    ```
    On BLOCKED, `need` mirrors the report's `need` line: `implementer` for
    "senior-dev fix <finding>", `decision` for "CTO waive risk on <finding>".

package/board/agents/smart-contract-auditor.md

@@ -318,7 +318,7 @@ REPORT=docs/security/AUDIT-{slug}.md
 [ -s "$REPORT" ] || { echo "STOP: no audit report at $REPORT — write it first." >&2; exit 1; }
 
 bash scripts/log-verdict.sh smart-contract-auditor <PASS|FAIL|BLOCKED> auto \
-  feature=<slug> "audit=$REPORT" findings=C:<n>,H:<n>,M:<n> not_checked=<n> need=<implementer|decision> finding=<id>
+  feature=<slug> "report=$REPORT" findings=C:<n>,H:<n>,M:<n> not_checked=<n> need=<implementer|decision> finding=<id>
 ```
 
 In prepare mode add `package=docs/security/audit-package-{slug}` and

package/board/scripts/codex-pipeline.mjs

@@ -43,19 +43,54 @@ const save = state => {
   renameSync(`${file}.tmp`, file);
   observeWorkRun(state);
 };
+// Keep this local to the entrypoint: source controller and packaged CLI have
+// separate runtime closures, but both must complete queued pipe writes.
+function drainOutput(stream) {
+  if (stream.destroyed || stream.closed || stream.writableFinished) return Promise.resolve(true);
+  return new Promise(resolve => {
+    let settled = false;
+    const finish = complete => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      stream.off('error', completed);
+      stream.off('close', completed);
+      stream.off('finish', completed);
+      resolve(complete);
+    };
+    const completed = () => finish(true);
+    const timer = setTimeout(() => finish(false), 1000);
+    timer.unref();
+    stream.once('error', completed);
+    stream.once('close', completed);
+    stream.once('finish', completed);
+    if (!stream.writableEnded) {
+      try {
+        stream.write('', error => {
+          // The error event follows an errored write callback.
+          if (error) queueMicrotask(completed);
+          else completed();
+        });
+      } catch { completed(); }
+    }
+  });
+}
+async function exitAfterOutput(code) {
+  // An unresolved promise and unref timer must not allow an early rc0.
+  process.exitCode = code || 1;
+  const completed = await Promise.all([drainOutput(process.stdout), drainOutput(process.stderr)]);
+  process.exit(completed.every(Boolean) ? code : code || 1);
+}
+
 let locked = null, projectLease = null, work = null, taskForFinish = null;
 try {
   if (command === 'doctor') {
     const result = codexHostDoctor({ pluginRoot: resolve(value('--plugin-root') || join(dirname(fileURLToPath(import.meta.url)), '..')), store });
-    console.log(JSON.stringify(result, null, 2)); process.exit(result.state === 'ready' ? 0 : 2);
+    console.log(JSON.stringify(result, null, 2)); await exitAfterOutput(result.state === 'ready' ? 0 : 2);
   }
   if (command === 'list') {
-    const output = JSON.stringify(listCodexRuns({ root: value('--dir') ? realpathSync(resolve(value('--dir'))) : null, store }), null, 2) + '\n';
-    // Piped stdout is asynchronous: exiting before the callback can truncate JSON.
-    await new Promise((resolve, reject) => {
-      process.stdout.write(output, error => error ? reject(error) : resolve());
-    });
-    process.exit(0);
+    console.log(JSON.stringify(listCodexRuns({ root: value('--dir') ? realpathSync(resolve(value('--dir'))) : null, store }), null, 2));
+    await exitAfterOutput(0);
   }
   let state;
   if (command === 'start') {

package/board/scripts/lib/approval-level.mjs

@@ -64,13 +64,15 @@ export const DEFAULT_LEVEL = 'gates-only';
 
 /**
  * Archetypes where a compliance/security sign-off is not the operator's to skip.
- * SKILL.md already states these carry a `strict` minimum; encoding it here means
- * a new level cannot become a bypass by omission.
+ * The floor is gate:security + gate:compliance (with gate:ship) at every level, so
+ * a new level cannot become a bypass by omission. It is not `strict`: it adds no
+ * gate:code. reference/approval-level.md lists this set and a test holds the two equal.
  */
 const REGULATED = new Set([
   'ai-system', 'agent-product', 'commerce', 'web3', 'iot-embedded', 'regulated',
   'fintech', 'healthcare', 'insurance', 'legal', 'gov-public', 'defense-govcon',
 ]);
+export const REGULATED_ARCHETYPES = Object.freeze([...REGULATED]);
 const REGULATED_FLOOR = ['security', 'compliance'];
 
 /**

package/board/scripts/lib/cost-meter.mjs

@@ -60,6 +60,9 @@ export const DEFAULT_PRICES = {
   // override via ~/.great_cto/model-prices.json or GREAT_CTO_MODEL_PRICES).
   'moonshotai/kimi-k2':  { input: 0.55, output: 2.2 },
   'moonshotai/kimi-k3':  { input: 3,    output: 15 },
+  // Standard endpoint snapshot, 2026-10-24. Highspeed is a different rate.
+  'moonshotai/kimi-k3.1-pro': { input: 2, output: 10, cacheRead: 0.2 },
+  'moonshotai/kimi-k3.1-pro-20261023': { input: 2, output: 10, cacheRead: 0.2 },
   // Read from OpenRouter's /models on 2026-08-27, not guessed. Until now these
   // reported `priced: false` — correctly, and that honesty is why an eval run on
   // glm-5.3-flash showed $0.000: not free, unpriced. Now they are priced exactly.
@@ -159,7 +162,7 @@ export function resolvePrice(model, prices = effectivePrices()) {
  * 172 turns of `claude-fable-5` were billed at $0.00 for exactly that reason,
  * and the total looked like a total rather than a total plus a hole.
  *
- * @returns {{usd:number, priced:boolean, assumed:boolean, source:string, model:string}}
+ * @returns {{usd:number|null, priced:boolean, assumed:boolean, source:string, model:string}}
  */
 /**
  * Cache-write dollars. Anthropic bills a 5-minute cache write at 1.25× the input
@@ -180,7 +183,30 @@ export function cacheWriteUsd(usage, inputPrice) {
   return total * 1.25 * inputPrice;
 }
 
+const KIMI_STANDARD_MODELS = new Set(['moonshotai/kimi-k3.1-pro', 'moonshotai/kimi-k3.1-pro-20261023']);
+
+function priceKimiUsage({ model, usage, prices }) {
+  const { price, source } = resolvePrice(model, prices);
+  const input = usage?.prompt_tokens;
+  const output = usage?.completion_tokens;
+  const cached = usage?.prompt_tokens_details?.cached_tokens;
+  const reasoning = usage?.completion_tokens_details?.reasoning_tokens;
+  const providerReportedUsd = typeof usage?.cost === 'number' && Number.isFinite(usage.cost) && usage.cost >= 0 ? usage.cost : null;
+  const base = { model, source, assumed: false, providerReportedUsd, costProvenance: 'calculated-standard-token-rates' };
+  if (source !== 'exact' || !price || ![price.input, price.output, price.cacheRead].every(n => Number.isFinite(n) && n >= 0)
+      || ![input, output, cached, reasoning].every(n => Number.isSafeInteger(n) && n >= 0)
+      || (Object.hasOwn(usage, 'total_tokens') && (!Number.isSafeInteger(usage.total_tokens) || usage.total_tokens !== input + output))
+      || (Object.hasOwn(usage, 'cost') && providerReportedUsd === null)
+      || cached > input || reasoning > output) {
+    return { ...base, usd: null, priced: false, usageState: 'unknown', costState: 'unknown' };
+  }
+  // OpenRouter includes cache reads in prompt and reasoning in completion.
+  const usd = ((input - cached) * price.input + cached * price.cacheRead + output * price.output) / 1_000_000;
+  return { ...base, usd, priced: true, usageState: 'known', costState: 'known' };
+}
+
 export function priceUsage({ model, usage, prices }) {
+  if (KIMI_STANDARD_MODELS.has(model)) return priceKimiUsage({ model, usage, prices: prices || effectivePrices() });
   const { price, source } = resolvePrice(model, prices || effectivePrices());
   if (!usage || !price) {
     return { usd: 0, priced: false, assumed: false, source, model: model || '' };
@@ -199,9 +225,11 @@ export function priceUsage({ model, usage, prices }) {
  * @param {string} opts.model
  * @param {{input_tokens?:number, output_tokens?:number}} opts.usage  Anthropic response.usage
  * @param {object} [opts.prices]  override table (for tests)
- * @returns {number} USD (0 if usage or price unknown)
+ * @returns {number|null} USD; exact Kimi requires complete raw OpenRouter usage
+ * and returns null when unknown. Legacy models retain the numeric 0 fallback.
  */
 export function costForUsage({ model, usage, prices }) {
+  if (KIMI_STANDARD_MODELS.has(model)) return priceKimiUsage({ model, usage, prices: prices || effectivePrices() }).usd;
   if (!usage) return 0;
   const p = priceForModel(model, prices);
   if (!p) return 0;
@@ -246,6 +274,10 @@ function main(argv) {
     return process.exit(2);
   }
   const cost = costForUsage({ model, usage: { input_tokens: inTok, output_tokens: outTok } });
+  if (cost === null) {
+    process.stderr.write('cost-meter: complete provider usage required — cost unknown\n');
+    return process.exit(2);
+  }
   process.stdout.write(String(round4(cost)));
 }
 

package/board/scripts/lib/cross-model-review.mjs

@@ -13,14 +13,14 @@
 //   node scripts/lib/cross-model-review.mjs --diff /tmp/d.diff --spec docs/architecture/ARCH-x.md
 //   GREAT_CTO_CROSS_REVIEW_MODEL=google/gemini-2.5-pro node ... --diff -
 
-import { readFileSync } from 'node:fs';
+import { readFileSync, lstatSync, openSync, closeSync, fstatSync, readSync, constants } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import { costForUsage, round4, resolvePrice } from './cost-meter.mjs';
 import { resolveSecondOpinion, codexReview } from './second-opinion.mjs';
 import { principalError } from './provider-exhaustion.mjs';
 import { existsSync, appendFileSync, mkdirSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve, parse, sep } from 'node:path';
 import { reviewInputBinding, parseLegacyReview } from './review-contract.mjs';
 
 /**
@@ -34,9 +34,14 @@ import { reviewInputBinding, parseLegacyReview } from './review-contract.mjs';
 export const EXIT = Object.freeze({ PASS: 0, BLOCK: 1, USAGE: 2, SKIPPED: 3 });
 
 /**
- * Which provider reviews, decided from three sources in a fixed order:
- * an explicit `--provider`, then the project's `capabilities: second_opinion`,
- * then — for compatibility with every script that set it — the OpenRouter env.
+ * Which provider reviews, decided from two sources in a fixed order:
+ * an explicit `--provider`, then the project's `capabilities: second_opinion`.
+ *
+ * An exported OPENROUTER_API_KEY used to be a third source: with nothing
+ * declared, the key chose OpenRouter and the diff left the machine without
+ * anyone deciding it should (CSO SEC-2, 27.10). The key is a credential, not a
+ * decision — undeclared stays undeclared, and the skip line names the
+ * declaration that would turn the review on.
  *
  * Returns the resolver's four states plus `source`, so the log line can say
  * why this provider and not another. Pure: `codex` and `env` are injected.
@@ -48,9 +53,9 @@ export function decideProvider({ argv = [], projectMd = '', codex = null, env =
     return { ...r, source: '--provider' };
   }
   const fromProject = resolveSecondOpinion({ projectMd, codex, env });
-  if (fromProject.state !== 'undeclared') return { ...fromProject, source: 'PROJECT.md' };
-  if (env.OPENROUTER_API_KEY) {
-    return { state: 'declared', provider: 'openrouter', why: '', source: 'OPENROUTER_API_KEY (second_opinion undeclared)' };
+  if (fromProject.state === 'undeclared' && env.OPENROUTER_API_KEY) {
+    return { ...fromProject, source: 'PROJECT.md',
+      why: `${fromProject.why}; OPENROUTER_API_KEY is set but does not choose the provider — declare \`second_opinion: openrouter\` or pass --provider openrouter` };
   }
   return { ...fromProject, source: 'PROJECT.md' };
 }
@@ -128,6 +133,93 @@ export async function callOpenRouter({ apiKey, model, system, user, maxTokens =
 
 function readArg(argv, name) { const i = argv.indexOf(name); return i > -1 ? argv[i + 1] : null; }
 
+/** Read explicitly selected input without following symlinks or special files. */
+function readProfileFile(file, root, cap) {
+  if (typeof file !== 'string' || !file || file === '-' || Buffer.byteLength(file) > 4096
+      || file.split(/[\\/]/).includes('..') || /[\x00-\x1f\x7f]/.test(file)) throw new Error('invalid-input-file');
+  const target = resolve(root, file), parsed = parse(target);
+  const parts = target.slice(parsed.root.length).split(sep);
+  let current = parsed.root;
+  for (let i = 0; i < parts.length; i++) {
+    if (parts[i] === '.git' || /^\.env(?:\.|$)/i.test(parts[i])) throw new Error('invalid-input-file');
+    current = join(current, parts[i]);
+    const st = lstatSync(current);
+    if (st.isSymbolicLink() || (i < parts.length - 1 ? !st.isDirectory() : !st.isFile())) throw new Error('invalid-input-file');
+  }
+  const fd = openSync(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const st = fstatSync(fd);
+    if (!st.isFile() || st.size > cap) throw new Error('invalid-input-file');
+    const bytes = Buffer.alloc(cap + 1);
+    let size = 0, n;
+    while (size <= cap && (n = readSync(fd, bytes, size, cap + 1 - size, null)) > 0) size += n;
+    if (size > cap) throw new Error('invalid-input-file');
+    return new TextDecoder('utf-8', { fatal: true }).decode(bytes.subarray(0, size));
+  } finally { closeSync(fd); }
+}
+
+/** Check explicit runtime roots before any credential getter is evaluated. */
+export function validateKimiRuntimePaths(root, operatorRoot) {
+  for (const [directory, allowMissing] of [[root, false], [operatorRoot, true]]) {
+    if (typeof directory !== 'string' || !directory || Buffer.byteLength(directory) > 4096
+        || /[\x00-\x1f\x7f]/.test(directory)) throw new Error('invalid-runtime-path');
+    const target = resolve(directory), parsed = parse(target);
+    let current = parsed.root, missing = false;
+    for (const part of target.slice(parsed.root.length).split(sep).filter(Boolean)) {
+      if (Buffer.byteLength(part) > 255 || part === '.git' || /^\.env(?:\.|$)/i.test(part)) throw new Error('invalid-runtime-path');
+      current = join(current, part);
+      if (missing) continue;
+      try {
+        const st = lstatSync(current);
+        if (st.isSymbolicLink() || !st.isDirectory()) throw new Error('invalid-runtime-path');
+      } catch (error) {
+        if (allowMissing && error.code === 'ENOENT') missing = true;
+        else throw error;
+      }
+    }
+  }
+}
+
+/** Explicit extra opinion. Runtime capabilities are resolved only after admission. */
+export async function runProfileReview(options = {}) {
+  const argv = options.argv ?? [];
+  if (!argv.includes('--profile')) return null;
+  const denied = () => ({ exitCode: EXIT.USAGE, summary: { status: 'usage-error', verdict: null,
+    advisory: true, authority: 'NONE', releaseEligibility: 'NOT_CHECKED', reasonCode: 'invalid-profile-invocation' } });
+  const allowed = new Set(['--profile', '--envelope', '--task', '--context-class', '--reason', '--root', '--operator-root', '--diff', '--spec']);
+  const flags = new Map();
+  for (let i = 0; i < argv.length; i += 2) {
+    const flag = argv[i], value = argv[i + 1];
+    if (!allowed.has(flag) || flags.has(flag) || typeof value !== 'string' || !value || value.startsWith('--')) return denied();
+    flags.set(flag, value);
+  }
+  if (flags.get('--profile') !== 'kimi-readonly-v1'
+      || ['--envelope', '--task', '--context-class', '--reason', '--operator-root'].some(k => !flags.has(k))) return denied();
+  let root, operatorRoot, envelope, profileApi;
+  try {
+    root = resolve(flags.get('--root') || process.cwd());
+    operatorRoot = resolve(root, flags.get('--operator-root'));
+    validateKimiRuntimePaths(root, operatorRoot);
+    envelope = JSON.parse(readProfileFile(flags.get('--envelope'), root, 131072));
+    if (!envelope || envelope.mode !== 'diff-review' || envelope.taskId !== flags.get('--task')
+        || envelope.contextClass !== flags.get('--context-class') || envelope.reason !== flags.get('--reason')) return denied();
+    for (const [flag, field, cap] of [['--diff', 'diff', 96000], ['--spec', 'spec', 16000]]) {
+      if (flags.has(flag) && readProfileFile(flags.get(flag), root, cap) !== envelope[field]) return denied();
+    }
+    profileApi = await import('./kimi-review-profile.mjs');
+    profileApi.buildKimiInputBinding(envelope);
+  } catch { return denied(); }
+  const result = await profileApi.runKimiReview({ profile: flags.get('--profile'), envelope, root,
+    operatorRoot,
+    get apiKey() { return options.apiKey ?? (options.env ?? process.env).OPENROUTER_API_KEY; },
+    fetchImpl: options.fetchImpl, now: options.now, uuid: options.uuid, signal: options.signal, timeoutMs: options.timeoutMs });
+  const complete = result.status === 'complete' && ['PASS', 'BLOCK'].includes(result.verdict);
+  return { exitCode: complete ? result.verdict === 'BLOCK' ? EXIT.BLOCK : EXIT.PASS : EXIT.SKIPPED,
+    summary: { status: result.status, reasonCode: result.reasonCode, verdict: complete ? result.verdict : null,
+      advisory: true, authority: 'NONE', releaseEligibility: 'NOT_CHECKED', bindingDigest: result.bindingDigest,
+      findings: result.result?.findings?.length ?? null, costState: result.costState, costUsd: result.costUsd } };
+}
+
 /**
  * The tree's identity at review time — git HEAD and whether it was dirty.
  * CLI-only: the pure `reviewLogLine` above never shells out; per this file's
@@ -147,6 +239,11 @@ function gitIdentity(cwd) {
 }
 
 async function main(argv) {
+  if (argv.includes('--profile')) {
+    const r = await runProfileReview({ argv, fetchImpl: fetch });
+    console.log(JSON.stringify(r.summary));
+    process.exit(r.exitCode);
+  }
   const diffPath = readArg(argv, '--diff');
   if (!diffPath) { console.error('Usage: cross-model-review.mjs --diff <file|-> [--spec <file>] [--model <slug>] [--provider codex|openrouter]'); process.exit(EXIT.USAGE); }
 
@@ -216,7 +313,8 @@ async function main(argv) {
   // was present and costForUsage prices an unknown model at nothing. A reviewer
   // that reads as free is the defect this repository has removed twice already.
   const priced = resolvePrice(res.model).price != null;
-  const cost = res.usage && priced ? round4(costForUsage({ model: res.model, usage: res.usage })) : null;
+  const calculated = res.usage && priced ? costForUsage({ model: res.model, usage: res.usage }) : null;
+  const cost = calculated === null ? null : round4(calculated);
 
   for (const f of findings) console.log(`  ${f.severity} ${f.file}:${f.line} — ${f.issue}`);
   if (verdict == null) {