onto-mcp 0.4.13 → 0.4.14

package/.onto/processes/review/external-oauth-worker-contract.md

@@ -65,11 +65,18 @@ Output formats are shared: `lens-sidecar`, `issue-artifact`,
 ### 3.1 Adapter-specific schema delivery
 
 - `codex_cli`: the schema is written to a file and passed via `codex exec --output-schema`.
-- `claude_code`: the schema is embedded in the prompt; `claude --json-schema` is
-  **not** used because its validator silently rejects the runtime's complex
-  submit schemas (`additionalProperties:false` + deep `required`) and exits with
-  no output. The in-process submit tool remains the authoritative validator, so
-  schema enforcement is preserved regardless of delivery mechanism.
+- `claude_code`: `claude --json-schema <schema>` **is** used — it constrains
+  output at the API level (grammar-based structured outputs) so the model cannot
+  emit syntactically malformed JSON, and the CLI returns a parsed
+  `structured_output` object. The earlier claim here that its validator "silently
+  rejects the runtime's complex submit schemas" was **inaccurate**: empirically
+  (opus-4.8 + haiku, 2026-07) the flag accepts the runtime's submit schemas
+  (`additionalProperties:false` + deep `required`, ~20 params, enums) and returns
+  native objects; without it, opus free-forms the JSON in-prompt and can drop a
+  comma on large findings → an unrecoverable `output_contract` failure. The
+  in-prompt schema remains as a redundant semantic hint, and the in-process submit
+  tool remains the authoritative validator of field CONTENT — so schema
+  enforcement holds regardless of delivery mechanism.
 
 ### 3.2 Result extraction
 

package/README.md

@@ -83,6 +83,19 @@ npm exec -- onto mcp
 Before running reviews, configure an LLM provider in `.onto/settings.json` or
 `~/.onto/settings.json` (see [Configuration](#configuration)).
 
+## onto CLI
+
+The `onto` binary exposes a small set of commands; the actual product work is
+driven through the MCP tools by your host.
+
+| Command | What it does |
+|---|---|
+| `onto mcp` | Start the MCP stdio tool server — each MCP host launches this (see [Quickstart](#quickstart)) |
+| `onto register` | Register the server into supported MCP hosts (see [Quickstart](#quickstart)) |
+| `onto configure-provider` | Write LLM provider/model settings into the settings.json chain (see [Configuration](#configuration)) |
+| `onto seats` | Print a read-only inventory of every LLM model seat the runtime can dispatch, resolved against the settings.json chain (`--json` for machine output); writes nothing |
+| `onto watch [session]` | Open a live, read-only TUI over a review/reconstruct session — pass a session id substring or path, or omit it for the most recent (see [Observing a run](#observing-a-run)) |
+
 ## What it does
 
 ### Review
@@ -159,16 +172,12 @@ point-in-time map (v0.4.7 snapshot, not maintained) is kept at
 | `onto_review_round` | Host-orchestration: return the units ready to execute now, with prompt packets materialized |
 | `onto_review_advance` | Host-orchestration: report host-executed units; onto validates seats, records results, and returns the next round |
 | `onto_review_cancel` | Request cancellation for a running review session |
-| `onto_review_status` | Read structured status and artifact refs |
-| `onto_review_result` | Read bounded result projections; `compact`/`standard` use count-and-signal summaries, `full` includes `review-record.yaml` and final output |
-| `onto_list_lenses` | List canonical lens sets |
-| `onto_list_domains` | List available domain ids |
-| `onto_list_source_profiles` | List reconstruct source profiles |
+| `onto_review_read` | Read a review session — one entry point for liveness while running and the bounded result once complete; `projectionLevel` `compact`/`standard`/`full` (`full` adds `review-record.yaml` and final output) |
+| `onto_list` | List a registry by `kind`: `lenses` (canonical lens sets), `domains` (available domain ids), or `source_profiles` (reconstruct source profiles) |
 | `onto_observe_source` | Materialize reconstruct material profile, inventory, source observations, and initial record |
 | `onto_validate_reconstruct_directive` | Validate LLM-authored reconstruct artifacts |
 | `onto_reconstruct` | Run the material-aware direct-call reconstruct path with runtime validation gates |
-| `onto_reconstruct_status` | Read reconstruct session status, progress, counts, and artifact refs |
-| `onto_reconstruct_result` | Read `reconstruct-record.yaml`, run manifest, progress projection, and final output |
+| `onto_reconstruct_read` | Read a reconstruct session — stage progress, liveness, and counts, or the full record, run manifest, and final output at `projectionLevel=full` |
 
 MCP results include `llmPresentation` prompts: the runtime supplies bounded
 facts, and the host LLM uses those prompts to explain the opening brief and
@@ -185,17 +194,22 @@ onto without external docs:
   `intent`, `reviewMode`) and `reconstruct_seed` (args: `targetRefs`,
   `intent`).
 
-`onto_review_status` accepts `projectionLevel` (`compact` | `standard` |
+`onto_review_read` accepts `projectionLevel` (`compact` | `standard` |
 `full`); use `compact` in token-limited hosts.
 
-### Runtime watcher
+### Observing a run
+
+`onto watch` opens a live, read-only TUI over a review or reconstruct session:
+browse the workflow tree, node details, and log. Pass a session id substring or
+a session path, or omit it to attach to the most recent session
+(`--project-root` selects where to look for `.onto/{review,reconstruct}`). It
+observes only — it writes nothing and drives nothing.
 
-When a review or reconstruct run starts, the runtime writes a session-local
-`runtime-events.ndjson` stream and tries to open a live watcher in a supported
-terminal (tmux, Warp, Cursor, iTerm2, Apple Terminal, Codex Desktop with a
-configured launcher). Set `ONTO_RUNTIME_WATCHER=0` to disable, or
-`ONTO_RUNTIME_WATCHER_COMMAND` with a `{watcherCommand}` template for
-unsupported hosts.
+The runtime also writes a session-local `runtime-events.ndjson` stream and tries
+to open a watcher automatically in a supported terminal (tmux, Warp, Cursor,
+iTerm2, Apple Terminal, Codex Desktop with a configured launcher). Set
+`ONTO_RUNTIME_WATCHER=0` to disable, or `ONTO_RUNTIME_WATCHER_COMMAND` with a
+`{watcherCommand}` template for unsupported hosts.
 
 ## Configuration
 
@@ -322,8 +336,10 @@ onto configure-provider --provider anthropic --model claude-opus-4-8 --auth oaut
 - `--project`는 프로젝트 seat(`.onto/settings.json`)에, 생략하면 사용자 seat
   (`~/.onto/settings.json`)에 기록합니다.
 - 지원 model id는 [`.onto/authority/supported-models.yaml`](.onto/authority/supported-models.yaml)가
-  authority입니다(현재 anthropic: `claude-opus-4-8`; `claude-sonnet-5`는
-  `semantic_map_synthesize` 역할 전용).
+  authority입니다. 범용 seat은 `gpt-5.5`(openai)·`claude-opus-4-8`(anthropic)이고,
+  역할 전용으로 `review`에 `gpt-5.6-sol`·`claude-fable-5`, `semantic_map_synthesize`에
+  `gpt-5.6-luna`·`claude-sonnet-5`가 인증돼 있습니다. 현재 프로젝트에서 실제로
+  해석되는 seat은 `onto seats`로 확인하세요.
 - 이 명령은 actor 블록만 기록합니다. `units[].llm.model`로 unit별 model을 고정해
   두었다면(위 정적 프로필 예시가 그렇습니다) 같은 model로 바꾸거나 그 `model` 키를
   지워 actor 값을 상속하게 하세요.

package/dist/core-api/reconstruct-api.js

@@ -13,7 +13,8 @@ import { RECONSTRUCT_SEMANTIC_AUTHOR_MAX_BASE_OUTPUT_TOKENS, } from "../core-run
 // allowlisted in scripts/check-import-boundary.ts). Active only when
 // ONTO_LLM_MOCK=1; mock runs record mock actor ids in the run manifest.
 import { RECONSTRUCT_MOCK_AUTHOR_ID, RECONSTRUCT_MOCK_CONFIRMATION_PROVIDER_ID, callReconstructMockLlm, isReconstructMockLlmRealizationEnabled, } from "../core-runtime/reconstruct/mock-llm-realization.js";
-import { assertSettingsModelsSupported, completeDispatchBreakerSettings, isReconstructSemanticMapAuthoringEnabled, resolveOptionalReconstructActorLlmSettings, resolveSettingsChain, resolveReconstructActorLlmSettings, resolveReconstructSemanticAuthorLlmRuntimeSettings, } from "../core-runtime/discovery/settings-chain.js";
+import { assertSettingsModelsSupported, completeDispatchBreakerSettings, isReconstructSemanticMapAuthoringEnabled, resolveOptionalReconstructActorLlmSettings, resolveSettingsChain, resolveReconstructActorLlmSettings, resolveReconstructSemanticAuthorLlmRuntimeSettings, PerCallLlmOverrideSchema, } from "../core-runtime/discovery/settings-chain.js";
+import { applyReconstructLlmOverride } from "../core-runtime/discovery/llm-override.js";
 import { assertDispatchFallbackSessionAdmission } from "../core-runtime/reconstruct/dispatch-fallback-artifacts.js";
 import { normalizeLlmModelSwitcher, } from "../core-runtime/llm/model-switcher.js";
 import { resolveOntoHome, } from "../core-runtime/discovery/onto-home.js";
@@ -329,13 +330,12 @@ export function resolveSemanticMapSynthesizeWiring(args) {
     }
     return {
         enableSemanticMapAuthoring: true,
+        // Effort comes from the seat's own (already overlaid) llm block —
+        // resolveLlmProviderConfig reads config.llm.effort (design v4 §6(a)).
         semanticMapSynthesizeLlmConfig: args.mockRealizationEnabled
             ? synthesizeSeatIdentityProjection(seat)
             : resolveLlmProviderConfig({
                 config: { llm: seat },
-                ...(args.llmEffortOverride
-                    ? { cliOverrides: args.llmEffortOverride }
-                    : {}),
             }),
     };
 }
@@ -577,7 +577,32 @@ export function createOntoReconstructCoreApi(options = {}) {
                 ...(ontoHome ? { ontoHome } : {}),
             });
             const targetRefs = request.targetRefs.map((targetRef) => resolveFromBase(projectRoot, targetRef));
-            const settings = await resolveSettingsChain(ontoHome ?? projectRoot, projectRoot);
+            // Per-call LLM override (design v4): overlay the resolved settings ONCE,
+            // here, so every downstream consumer (dispatch-fallback admission, the
+            // supported-model gate, actor/judge provider resolution, census,
+            // provenance) reads the SAME effective settings. Identity when absent →
+            // byte-identical default-off.
+            // The strict override schema IS the security boundary (it excludes
+            // base_url/api_key_env/timeout_ms so a per-call input cannot pick an
+            // endpoint or credential env). The MCP handler validates, but this Core
+            // API is also called programmatically, where a static type enforces
+            // nothing at runtime — so re-parse here, at admission, and overlay ONLY
+            // the parsed value.
+            const llmOverride = request.llmOverride === undefined
+                ? undefined
+                : PerCallLlmOverrideSchema.parse(request.llmOverride);
+            const baseSettings = await resolveSettingsChain(ontoHome ?? projectRoot, projectRoot);
+            // design v4 §2.5: `judgeModel` names a model ON THE AUTHOR'S PROVIDER, so
+            // combining it with an override that switches that provider is ambiguous —
+            // the judge would silently resolve (or degrade) on the switched-in
+            // provider, reintroducing the "believe X, run Y" failure the override
+            // contract forbids. Reject at the handler, before any dispatch.
+            const settings = applyReconstructLlmOverride(baseSettings, llmOverride);
+            const authorProviderBefore = baseSettings.reconstruct?.execution?.actors?.semantic_author?.llm?.provider;
+            const authorProviderAfter = settings.reconstruct?.execution?.actors?.semantic_author?.llm?.provider;
+            if (request.judgeModel && authorProviderAfter !== authorProviderBefore) {
+                throw new Error(`llmOverride switches the semantic author's provider (${String(authorProviderBefore)} → ${String(authorProviderAfter)}) while judgeModel="${request.judgeModel}" names a model on the author's provider. This combination is ambiguous: drop judgeModel, or keep the author's provider.`);
+            }
             await assertDispatchFallbackSessionAdmission({
                 sessionRoot,
                 enabled: settings.reconstruct?.execution?.dispatch_fallback?.enabled === true,
@@ -598,9 +623,9 @@ export function createOntoReconstructCoreApi(options = {}) {
             // Mock realization needs no provider config: actor llm settings stay
             // required only for live direct_call execution, and the recorded route
             // comes from the mock result marker, not from a configured provider.
-            const llmEffortOverride = request.llmEffort
-                ? { reasoning_effort: request.llmEffort }
-                : undefined;
+            // The author-side effort is carried on each actor's (already overlaid) llm
+            // block — resolveLlmProviderConfig reads config.llm.effort — so no separate
+            // effort-override plumbing is needed (design v4 §6(a)).
             // The semantic_author actor settings (non-mock). The MODEL provider here
             // (e.g. "openai") is the supported-models registry key, DISTINCT from the
             // resolved RUNTIME provider (openai OAuth resolves to "codex"). The document
@@ -612,7 +637,6 @@ export function createOntoReconstructCoreApi(options = {}) {
             let semanticAuthorLlmConfig = semanticAuthorActorLlm
                 ? resolveLlmProviderConfig({
                     config: { llm: semanticAuthorActorLlm },
-                    ...(llmEffortOverride ? { cliOverrides: llmEffortOverride } : {}),
                 })
                 : {};
             const confirmationProviderLlmConfig = mockRealizationEnabled
@@ -621,7 +645,6 @@ export function createOntoReconstructCoreApi(options = {}) {
                     config: {
                         llm: resolveReconstructActorLlmSettings(settings, "confirmation_provider"),
                     },
-                    ...(llmEffortOverride ? { cliOverrides: llmEffortOverride } : {}),
                 });
             // The supported-models registry (non-mock only): loaded once and shared by
             // the judge-override support check and the document projection-budget
@@ -649,13 +672,12 @@ export function createOntoReconstructCoreApi(options = {}) {
             // Semantic-map authoring opt-in + optional synthesize seat (INV-MODEL-1
             // role-aware design §5.4/§5.5): ONE deterministic seam owns the wiring
             // (resolveSemanticMapSynthesizeWiring) — live completes the seat into a
-            // provider config (own auth/adapter, cross-provider; the request
-            // llmEffort pin applies as cliOverrides, so pin > seat effort), mock
-            // takes an identity-only projection (no auth material required).
+            // provider config (own auth/adapter, cross-provider; effort comes from the
+            // seat's own — already overlaid — llm block), mock takes an identity-only
+            // projection (no auth material required).
             const semanticMapWiring = resolveSemanticMapSynthesizeWiring({
                 settings,
                 mockRealizationEnabled,
-                llmEffortOverride,
             });
             // Single seed-stage document projection budget (chars), derived once from
             // the semantic author's MODEL window.
@@ -687,18 +709,19 @@ export function createOntoReconstructCoreApi(options = {}) {
                 if (!semanticMapWiring.enableSemanticMapAuthoring) {
                     throw new Error("reconstruct dispatch_fallback requires reconstruct.execution.semantic_map_authoring=true.");
                 }
-                const effectiveEffort = request.llmEffort;
+                // Effort is carried on each (already overlaid) llm block: the primary
+                // seats via the semantic_map_synthesize/semantic_author actors, the
+                // fallback via dispatch_fallback.llm (applyReconstructLlmOverride threads
+                // override.effort into it). No separate request-effort pin (design v4 §6(a)).
+                // Fresh copies keep these dispatch inputs independent of the shared settings.
                 const primarySynthesizeLlm = {
                     ...(resolveOptionalReconstructActorLlmSettings(settings, "semantic_map_synthesize") ?? resolveReconstructActorLlmSettings(settings, "semantic_author")),
-                    ...(effectiveEffort ? { effort: effectiveEffort } : {}),
                 };
                 const primaryVerifyLlm = {
                     ...resolveReconstructActorLlmSettings(settings, "semantic_author"),
-                    ...(effectiveEffort ? { effort: effectiveEffort } : {}),
                 };
                 const fallbackLlm = {
                     ...dispatchFallbackSettings.llm,
-                    ...(effectiveEffort ? { effort: effectiveEffort } : {}),
                 };
                 const [primarySynthesize, primaryVerify, fallbackSynthesize, fallbackVerify] = await Promise.all([
                     tryCreateEligiblePrimarySealedDispatchCapability({

package/dist/core-api/review-api.js

@@ -6,6 +6,7 @@ import os from "node:os";
 import path from "node:path";
 import { resolveOntoHome } from "../core-runtime/discovery/onto-home.js";
 import { completeDispatchBreakerSettings, defaultReviewRetrySettings, resolveSettingsChain, } from "../core-runtime/discovery/settings-chain.js";
+import { applyReviewLlmOverride } from "../core-runtime/discovery/llm-override.js";
 import { loadCoreLensRegistry } from "../core-runtime/discovery/lens-registry.js";
 import { fileExists, isDeprecatedDomainAlias, isoFromTimestamp, isoNow, normalizeDomainValue, readYamlDocument, writeYamlDocument, } from "../core-runtime/review/review-artifact-utils.js";
 import { assertPathInsideRoot, realpathIfExists, } from "../core-runtime/path-boundary.js";
@@ -2448,7 +2449,11 @@ function reviewExecutionProfileFromActorProfiles(args) {
     return reconstructed;
 }
 async function projectReviewExecutionProfileForContinuation(args) {
-    const settings = await resolveSettingsChain(args.ontoHome, args.projectRoot);
+    const projectSettings = await resolveSettingsChain(args.ontoHome, args.projectRoot);
+    // Re-apply the session's per-call override (design v4 §7) so the unit
+    // execution policy this profile carries stays on the overridden route rather
+    // than reverting to the non-overlaid project models. Identity when absent.
+    const settings = applyReviewLlmOverride(projectSettings, args.llmOverride);
     const resolved = resolveReviewExecutionProfile({
         explicitCodex: false,
         settings,
@@ -3116,6 +3121,9 @@ export function createOntoReviewCoreApi(options = {}) {
                 : await projectReviewExecutionProfileForContinuation({
                     projectRoot,
                     ontoHome,
+                    ...(executionPlan.llm_override
+                        ? { llmOverride: executionPlan.llm_override }
+                        : {}),
                 });
             const actorProfileReviewExecutionProfile = manifestReviewExecutionProfile
                 ? undefined

package/dist/core-runtime/cli/prepare-review-session.js

@@ -11,6 +11,7 @@ import { printOntoReleaseChannelNotice } from "../release-channel/release-channe
 import { detectCodexEnvSignal } from "../discovery/host-detection.js";
 import { resolveOntoHome } from "../discovery/onto-home.js";
 import { resolveSettingsChain } from "../discovery/settings-chain.js";
+import { applyReviewLlmOverride, parsePerCallLlmOverrideArg, } from "../discovery/llm-override.js";
 /**
  * Stage 1 — resolve the window-proportional review prompt budget multiplier from
  * the lens model's registered context window. The registry load and model
@@ -178,6 +179,7 @@ export async function runPrepareReviewSessionCli(argv) {
             "max-listing-depth": { type: "string" },
             "max-listing-entries": { type: "string" },
             "max-embed-lines": { type: "string" },
+            "llm-override": { type: "string" },
         },
         strict: true,
         allowPositionals: false,
@@ -195,7 +197,16 @@ export async function runPrepareReviewSessionCli(argv) {
     const executionRealization = resolveExecutionRealization(argv, values["execution-realization"] ?? values["execution-mode"], hostRuntime);
     const projectRoot = path.resolve(requireString(values["project-root"], "project-root"));
     const ontoHome = resolveOntoHome(optionalString(values["onto-home"]) || undefined);
-    const ontoConfig = await resolveSettingsChain(ontoHome, projectRoot);
+    // Per-call LLM override (design v4): overlay the resolved settings so the
+    // baked artifacts (session-metadata resolved_llm_plan, actor-invocation
+    // profiles) carry the effective actor LLM — this is what onto_review_continue
+    // replays. Same overlay applied at the orchestrator profile seam
+    // (resolveReviewInvokeSetup); identity when absent → byte-identical default-off.
+    const overlay = parsePerCallLlmOverrideArg(values["llm-override"]);
+    const resolvedConfig = await resolveSettingsChain(ontoHome, projectRoot);
+    const ontoConfig = overlay
+        ? applyReviewLlmOverride(resolvedConfig, overlay)
+        : resolvedConfig;
     // Stage 1 — resolve the window-proportional review prompt budget ONCE, here,
     // and thread it to both consumers: the spreadsheet inventory prompt caps
     // (into the materialize call) and the embed line budget (persisted into the
@@ -209,6 +220,10 @@ export async function runPrepareReviewSessionCli(argv) {
     const bindingParams = {
         projectRoot,
         ontoConfig,
+        // Stamp the RAW override into the execution plan too: ontoConfig carries its
+        // effect on the actors, but continuation re-resolves the project profile for
+        // unit execution policy and must re-overlay it (design v4 §7).
+        ...(overlay ? { llmOverride: overlay } : {}),
         requestedTarget: requireString(values["requested-target"], "requested-target"),
         requestedDomainToken: optionalString(values["requested-domain-token"]),
         targetScopeKind,

package/dist/core-runtime/cli/review-invocation-runner.js

@@ -57,6 +57,12 @@ export function appendReviewInvocationRequestArgs(args, request, options) {
     if (request.confirmValueAlignment) {
         result.push("--confirm-value-alignment");
     }
+    if (request.llmOverride) {
+        // Serialize the per-call override as a single JSON passthrough arg — it must
+        // survive into the start argv so both the orchestrator profile resolve and
+        // the prepare-session bake apply the same overlay (design v4 §2.3).
+        result.push("--llm-override", JSON.stringify(request.llmOverride));
+    }
     return result;
 }
 function executorRealizationFromRequest(request) {

package/dist/core-runtime/cli/review-invoke.js

@@ -8,7 +8,8 @@ import { generateReviewSessionId } from "../review/materializers.js";
 import { fileExists, hasOptionFlag, isDeprecatedDomainAlias, normalizeDomainValue, readMultiOptionValuesFromArgv, readYamlDocument, readSingleOptionValueFromArgv, } from "../review/review-artifact-utils.js";
 import { isOntoRoot, resolveOntoHome } from "../discovery/onto-home.js";
 import { resolveInstallationPath } from "../discovery/installation-paths.js";
-import { REVIEW_EXECUTION_UNIT_IDS, resolveSettingsChain, } from "../discovery/settings-chain.js";
+import { assertSettingsModelsSupported, REVIEW_EXECUTION_UNIT_IDS, resolveSettingsChain, } from "../discovery/settings-chain.js";
+import { applyReviewLlmOverride, parsePerCallLlmOverrideArg, } from "../discovery/llm-override.js";
 import { loadCoreLensRegistry } from "../discovery/lens-registry.js";
 import { isPathInsideRoot, isPathInsideRootRealpathAwareSync, } from "../path-boundary.js";
 import { isDirectModelCallSelection, isExternalOauthWorkerSelection, normalizeLlmModelSwitcher, } from "../llm/model-switcher.js";
@@ -61,6 +62,9 @@ const KNOWN_PASSTHROUGH_OPTION_NAMES = [
     "max-listing-depth",
     "max-listing-entries",
     "max-embed-lines",
+    // Per-call LLM override JSON — passthrough so it reaches the prepare-session
+    // bake (prepare-review-session.ts) as well as the orchestrator profile resolve.
+    "llm-override",
 ];
 const KNOWN_PASSTHROUGH_FLAG_NAMES = [
     "codex",
@@ -2053,9 +2057,29 @@ export async function resolveReviewInvokeSetup(argv) {
     const ontoHomeFlag = readSingleOptionValueFromArgv(argv, "onto-home");
     const ontoHome = resolveOntoHome(ontoHomeFlag);
     const projectRoot = path.resolve(readSingleOptionValueFromArgv(argv, "project-root") ?? ".");
-    const ontoConfig = ontoHome
+    const resolvedOntoConfig = ontoHome
         ? await resolveSettingsChain(ontoHome, projectRoot)
         : await readOntoConfig(projectRoot);
+    // Per-call LLM override (design v4): overlay the resolved settings BEFORE the
+    // execution profile is resolved, so the profile route/adapter/model reflects
+    // the effective settings and flows into the spawn `--provider/--model/...`
+    // flags. Identity when absent → default-off is byte-identical. When an override
+    // IS present, fail loud (cause = override) if it selects an unsupported model
+    // (INV-MODEL-1) — the one new review-side model-support gate; it stays scoped
+    // to overrides so an existing (ungated) config's behavior is unchanged.
+    const llmOverride = parsePerCallLlmOverrideArg(readSingleOptionValueFromArgv(argv, "llm-override"));
+    const ontoConfig = llmOverride
+        ? applyReviewLlmOverride(resolvedOntoConfig, llmOverride)
+        : resolvedOntoConfig;
+    if (llmOverride) {
+        // Gate ONLY the review dispatch seats. The shared gate walks every seat in
+        // the object it is handed, so passing the whole config would fail a review
+        // because of an unrelated reconstruct model the review never dispatches.
+        // Review resolves its route from `review.execution` actors + units alone
+        // (llmRouteEntries), and salvage lives under review.execution.retry — so the
+        // review block is exactly the set this run can dispatch.
+        assertSettingsModelsSupported(ontoConfig.review ? { review: ontoConfig.review } : {});
+    }
     const resolvedInvokeInputs = await resolveReviewInvokeInputs(argvWithSessionId, ontoConfig, projectRoot, sessionId, ontoHome);
     const { optionTokens: argvWithoutPositionals } = splitArgvIntoOptionsAndPositionals(argvWithSessionId, [...KNOWN_INVOKE_ONLY_OPTION_NAMES, ...KNOWN_PASSTHROUGH_OPTION_NAMES], [...KNOWN_INVOKE_ONLY_FLAG_NAMES, ...KNOWN_PASSTHROUGH_FLAG_NAMES]);
     const normalizedStartArgv = appendReviewInvokeDerivedArgs(stripOptionsFromArgv(argvWithoutPositionals, [...KNOWN_INVOKE_ONLY_OPTION_NAMES], [...KNOWN_INVOKE_ONLY_FLAG_NAMES]), resolvedInvokeInputs);