onto-mcp 0.4.13 → 0.4.14

package/dist/core-runtime/discovery/llm-override.js

@@ -0,0 +1,262 @@
+import { defaultAuthForProvider, } from "../llm/model-switcher.js";
+import { reviewExecutionUnitActor } from "../review/review-execution-profile.js";
+import { PerCallLlmOverrideSchema, RECONSTRUCT_ACTOR_KEYS, REVIEW_EXECUTION_UNIT_IDS, } from "./settings-chain.js";
+/**
+ * Per-call LLM override overlay (design v4 §2.2). A `PerCallLlmOverride` is an
+ * ephemeral settings-`llm` edit applied to the resolved {@link OntoSettings}
+ * for ONE review/reconstruct invocation, after which the existing pipeline runs
+ * unchanged. These helpers are PURE and IMMUTABLE: they never mutate the input
+ * settings, and an absent/empty override is the IDENTITY (returns the same
+ * object reference), which is what makes the default-off path byte-identical.
+ *
+ * Per-block semantics:
+ * - `override.provider` present → REPLACE: the block becomes `{...override}`.
+ *   The switched-in provider's transport (base_url/api_key_env/service_tier/
+ *   timeout_ms) resolves fresh from model-switcher defaults; the old provider's
+ *   transport MUST NOT leak, so the previous block is dropped entirely. The
+ *   override schema excludes transport/credential fields, so a plain copy is
+ *   already transport-clean.
+ * - `override.provider` absent → field-OVERLAY: `{...block, ...override}` — only
+ *   the named fields (effort/model/service_tier/auth) win over the existing
+ *   same-provider block.
+ */
+function isEmptyOverride(override) {
+    return Object.keys(override).length === 0;
+}
+/**
+ * Parse a per-call override serialized as a single `--llm-override <json>` CLI
+ * arg back into a validated {@link PerCallLlmOverride}. The review pipeline
+ * crosses a process/argv boundary, so the override is JSON-serialized by the API
+ * seam and re-materialized (+ shape-revalidated via the canonical schema) at
+ * each settings-resolution seam that must apply it. Absent/empty → undefined
+ * (identity). Throws on malformed JSON or a shape violation (fail-loud).
+ */
+export function parsePerCallLlmOverrideArg(raw) {
+    if (raw === undefined || raw.length === 0)
+        return undefined;
+    const parsed = PerCallLlmOverrideSchema.parse(JSON.parse(raw));
+    // An EMPTY override is semantically an omission. Canonicalize it to undefined
+    // so every downstream truthiness check agrees: otherwise the overlay treats
+    // `{}` as identity while a `if (llmOverride)` gate still fires, making `{}`
+    // observably different from omission (breaking the default-off guarantee).
+    return isEmptyOverride(parsed) ? undefined : parsed;
+}
+/**
+ * Route identity of a block AFTER an override. Compared by EFFECTIVE value, not
+ * by field presence: an override may legitimately restate the current
+ * provider/auth just to change the model, and that is NOT a route change — so it
+ * must keep the block's route-scoped transport (api_key_env/base_url/
+ * service_tier) and any provider-scoped runtime settings.
+ */
+function effectiveRoute(block, override) {
+    // Compare the DEFAULTED auth, not the raw field: a block that omits `auth`
+    // still dispatches on `defaultAuthForProvider(provider)` (anthropic/grok →
+    // api_key, openai → oauth, lmstudio → local). Comparing the raw undefined
+    // would read an override that merely restates that effective auth as a switch
+    // and discard the block's still-valid transport (api_key_env/base_url).
+    const blockAuth = block.auth ??
+        (block.provider !== undefined ? defaultAuthForProvider(block.provider) : undefined);
+    return {
+        providerChanged: (override.provider ?? block.provider) !== block.provider,
+        authChanged: (override.auth ?? blockAuth) !== blockAuth,
+    };
+}
+/** Whether an override changes the block's ROUTE identity (provider or auth). */
+function overrideChangesRoute(block, override) {
+    const { providerChanged, authChanged } = effectiveRoute(block, override);
+    return providerChanged || authChanged;
+}
+/**
+ * Core per-`llm`-block override (REPLACE vs route-cleaned vs field-OVERLAY).
+ *
+ * `routeBasis` is the block whose ROUTE identity the decision is made on, which
+ * is not always `block` itself: a review UNIT's llm is a PARTIAL block merged
+ * over its default actor, so its route lives in the merged result. Judging a
+ * provider-less unit on its own partial block would report a provider change for
+ * every provider-bearing override (comparing against `undefined`). The override
+ * is still APPLIED to `block` so the unit keeps its partial shape.
+ */
+function applyLlmBlockOverride(block, override, routeBasis = block) {
+    const { providerChanged, authChanged } = effectiveRoute(routeBasis, override);
+    if (providerChanged) {
+        // REPLACE (provider switch): drop the old block so no stale transport
+        // (base_url/api_key_env/service_tier/timeout_ms) leaks into the new
+        // provider. override carries only {provider, auth?, model?, effort?,
+        // service_tier?}, so the copy is transport-clean by construction.
+        return { ...override };
+    }
+    if (authChanged) {
+        // AUTH switch is ALSO a route switch (oauth ↔ api_key normalize to
+        // different execution routes/adapters), so the previous route's scoped
+        // fields must not survive: `service_tier` is openai+oauth-only (
+        // normalizeLlmModelSwitcher rejects it on any other route) and
+        // `api_key_env`/`base_url` belong to the direct-call routes. Keeping them
+        // would turn an otherwise valid auth switch into a hard failure (or leak an
+        // api-key endpoint into an OAuth route). The override may re-state
+        // service_tier; base_url/api_key_env stay settings-owned by design.
+        const { service_tier: _serviceTier, api_key_env: _apiKeyEnv, base_url: _baseUrl, ...routeAgnostic } = block;
+        return { ...routeAgnostic, ...override };
+    }
+    // OVERLAY (same route — including an override that restates the current
+    // provider/auth): only the named fields win; transport is preserved.
+    return { ...block, ...override };
+}
+// ── review scope ──────────────────────────────────────────────────────────
+const REVIEW_ACTOR_KEYS = ["teamlead", "lens", "synthesize"];
+/**
+ * Apply a per-call override to the review dispatch seats of `settings`
+ * (design v4 §2.2). Overlays every configured actor llm
+ * (`review.execution.{teamlead,lens,synthesize}.llm`) and every configured unit
+ * llm (`review.execution.units[id].llm`), plus the salvage transcription model.
+ * Actors/units WITHOUT an explicit llm are left untouched (their inheritance is
+ * unchanged). In REPLACE mode each unit's own llm is DROPPED so it inherits the
+ * replaced actor rather than keeping a stale unit model.
+ */
+export function applyReviewLlmOverride(settings, override) {
+    if (!override || isEmptyOverride(override))
+        return settings; // IDENTITY
+    const execution = settings.review?.execution;
+    if (!execution)
+        return settings;
+    const nextExecution = { ...execution };
+    for (const actorKey of REVIEW_ACTOR_KEYS) {
+        const actor = execution[actorKey];
+        if (actor?.llm) {
+            nextExecution[actorKey] = {
+                ...actor,
+                llm: applyLlmBlockOverride(actor.llm, override),
+            };
+        }
+    }
+    if (execution.units) {
+        const nextUnits = {};
+        for (const unitId of REVIEW_EXECUTION_UNIT_IDS) {
+            const unit = execution.units[unitId];
+            if (!unit)
+                continue;
+            if (!unit.llm) {
+                nextUnits[unitId] = unit;
+                continue;
+            }
+            // A unit's llm is a PARTIAL block that the runtime merges over its default
+            // actor ({...actorLlm, ...unitLlm}), so the unit's real route is that
+            // merge — judge the override against it, not against the partial block.
+            const unitRouteBasis = {
+                ...(execution[reviewExecutionUnitActor(unitId)]?.llm ?? {}),
+                ...unit.llm,
+            };
+            if (effectiveRoute(unitRouteBasis, override).providerChanged) {
+                // REPLACE: drop the unit's llm so it inherits the replaced actor
+                // (no stale unit model on the old provider).
+                const { llm: _dropped, ...rest } = unit;
+                nextUnits[unitId] = rest;
+            }
+            else {
+                // Units go through the SAME block rules as actors — a raw spread here
+                // would keep the previous route's scoped fields (e.g. a unit's own
+                // openai/oauth `service_tier` surviving an `auth: "api_key"` override),
+                // so the unit route would be rejected even though the actor was cleaned.
+                nextUnits[unitId] = {
+                    ...unit,
+                    llm: applyLlmBlockOverride(unit.llm, override, unitRouteBasis),
+                };
+            }
+        }
+        nextExecution.units = nextUnits;
+    }
+    const transcription = execution.retry?.salvage?.transcription_llm;
+    if (transcription) {
+        nextExecution.retry = {
+            ...execution.retry,
+            salvage: {
+                ...execution.retry?.salvage,
+                transcription_llm: applySalvageTranscriptionOverride(transcription, override),
+            },
+        };
+    }
+    return {
+        ...settings,
+        review: { ...settings.review, execution: nextExecution },
+    };
+}
+/**
+ * Salvage transcription_llm has a RESTRICTED shape ({provider?: "anthropic" |
+ * "openai"; model: string}) — it is a cheap-tier transcription model run by the
+ * unit's OWN adapter, so only anthropic/openai are representable. Overlay the
+ * model always; overlay the provider only when salvage can express it.
+ *
+ * A grok/lmstudio override leaves the seat untouched, and that is INERT rather
+ * than a mixed route: those providers resolve to the direct-call route, and the
+ * runner only attempts salvage on a `claude_code`/`codex` worker executor (see
+ * run-review-prompt-execution: `salvageAdapter === "claude_code" || "codex"`),
+ * so salvage cannot dispatch there at all. This is also exactly what editing the
+ * same provider into settings would do — the override is a settings overlay, so
+ * it must not invent a stricter contract than the settings path has.
+ */
+function applySalvageTranscriptionOverride(transcription, override) {
+    // A switch to a salvage-incompatible provider (grok/lmstudio) leaves salvage
+    // ENTIRELY unchanged — the model would otherwise land on an anthropic/openai
+    // route it does not belong to. Salvage is opt-in / default-off, so
+    // under-applying here fails closed, never dispatches an unverified call.
+    if (override.provider === "grok" || override.provider === "lmstudio") {
+        return transcription;
+    }
+    const next = { ...transcription };
+    if (override.model !== undefined)
+        next.model = override.model;
+    if (override.provider === "anthropic" || override.provider === "openai") {
+        next.provider = override.provider;
+    }
+    return next;
+}
+// ── reconstruct scope ───────────────────────────────────────────────────────
+/**
+ * Apply a per-call override to the reconstruct dispatch seats of `settings`
+ * (design v4 §2.2). Overlays the actor seats
+ * (`reconstruct.execution.actors.{semantic_author,confirmation_provider,
+ * semantic_map_synthesize}.llm`) with full REPLACE/OVERLAY semantics, and threads
+ * the override EFFORT into the opt-in `dispatch_fallback.llm` (the faithful
+ * replacement of the removed `llmEffort` pin).
+ */
+export function applyReconstructLlmOverride(settings, override) {
+    if (!override || isEmptyOverride(override))
+        return settings; // IDENTITY
+    const execution = settings.reconstruct?.execution;
+    if (!execution)
+        return settings;
+    const nextExecution = { ...execution };
+    if (execution.actors) {
+        const nextActors = { ...execution.actors };
+        for (const actorKey of RECONSTRUCT_ACTOR_KEYS) {
+            const actor = execution.actors[actorKey];
+            if (actor) {
+                const llm = applyLlmBlockOverride(actor.llm, override);
+                // `llm_runtime` (openai Responses output headroom) is scoped to the
+                // openai + api_key direct-call route, so it must NOT survive a route
+                // change: reconstruct would apply openai-only headroom to the new route
+                // and fail before dispatch, and the caller cannot clear it through
+                // `llmOverride` (transport/runtime fields are settings-owned).
+                nextActors[actorKey] = overrideChangesRoute(actor.llm, override)
+                    ? { llm }
+                    : { ...actor, llm };
+            }
+        }
+        nextExecution.actors = nextActors;
+    }
+    // dispatch_fallback.llm is a RESTRICTED, alternate-provider shape (requires
+    // api_key_env; provider constrained to openai/anthropic; model is
+    // provider-specific). It exists specifically to be a DIFFERENT provider than
+    // the primary, so a per-call provider/model switch must NOT collapse it onto
+    // the primary. Only the provider-agnostic EFFORT knob flows through — this is
+    // exactly what the removed `llmEffort` pin used to apply here (v4 §6(a)).
+    if (execution.dispatch_fallback?.enabled === true && override.effort !== undefined) {
+        nextExecution.dispatch_fallback = {
+            ...execution.dispatch_fallback,
+            llm: { ...execution.dispatch_fallback.llm, effort: override.effort },
+        };
+    }
+    return {
+        ...settings,
+        reconstruct: { ...settings.reconstruct, execution: nextExecution },
+    };
+}

package/dist/core-runtime/discovery/review-cert-assemble.js

@@ -163,7 +163,7 @@ export function assembleReviewCertRecord(args) {
     if (guardViolations.length > 0) {
         return { record: null, violations: guardViolations };
     }
-    const aggregates = computeReviewCertAggregates(args.runs, args.fixtures.map((fixture) => fixture.fixture_id));
+    const aggregates = computeReviewCertAggregates(args.runs, args.fixtures);
     const armDispatch = (arm) => {
         const effort = projection.witnessed[arm].reasoning_effort;
         return effort !== undefined ? { reasoning_effort: effort } : {};

package/dist/core-runtime/discovery/review-cert-record.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { SEMANTIC_QUALITY_GATE_CHECK_IDS, } from "../review/semantic-quality-gate.js";
+import { CLEAN_TARGET_EXCLUDED_CHECK_IDS, SEMANTIC_QUALITY_GATE_CHECK_IDS, } from "../review/semantic-quality-gate.js";
 import { SynthesizeCertDispatchConfigSchema } from "./synthesize-cert-record.js";
 // ─────────────────────────────────────────────────────────────────────────────
 // review-cert/v1 — the evidence contract behind the `review` role
@@ -51,14 +51,49 @@ const Sha256Schema = z.string().regex(/^[0-9a-f]{64}$/, "expected a lowercase sh
 const ArmModelSchema = z
     .object({ provider: IdSchema, model: IdSchema })
     .strict();
+const CheckIdSchema = z.enum(SEMANTIC_QUALITY_GATE_CHECK_IDS);
+/** The single legal reduced applicable set (v3 clean-target): the full gate
+ * universe minus the checks a clean target omits. Derived from the gate's
+ * CLEAN_TARGET_EXCLUDED authority so the two cannot drift. Sorted for compare. */
+const CLEAN_TARGET_APPLICABLE_CHECK_IDS = [
+    ...SEMANTIC_QUALITY_GATE_CHECK_IDS,
+]
+    .filter((id) => !CLEAN_TARGET_EXCLUDED_CHECK_IDS.has(id))
+    .sort();
+/** Fixtures permitted to declare a REDUCED applicable_check_ids. A reduced set
+ * shrinks a fixture's core floor, so the deterministic validator — not just the
+ * honest harness — must gate it: only a designated clean-target fixture may
+ * reduce, or a material-bearing fixture could drop its recall spine and certify
+ * silently. Identity is by fixture_id; binding the id to the actual clean blob
+ * via content_sha256 is Phase B (design §D2/§D5). */
+const REDUCED_APPLICABLE_FIXTURE_IDS = new Set([
+    "clean-target-v1",
+]);
+/** The applicable_check_ids a fixture's manifest entry MUST declare — the single
+ * authority shared by the cert-record PRODUCER (scripts/review-cert-run.mts) and
+ * this validator, so the two cannot drift. A designated clean-target fixture
+ * declares the reduced set; every other fixture declares nothing (undefined =
+ * absent = full universe, byte-identical v2 recompute). The producer emits
+ * exactly this; the validator below recomputes and rejects any mismatch. */
+export function fixtureApplicableCheckIds(fixtureId) {
+    return REDUCED_APPLICABLE_FIXTURE_IDS.has(fixtureId)
+        ? CLEAN_TARGET_APPLICABLE_CHECK_IDS
+        : undefined;
+}
 const FixtureManifestEntrySchema = z
     .object({
     fixture_id: IdSchema,
     target_anchor: z.string().min(1),
     content_sha256: Sha256Schema,
+    /** v3 (design 20260712 §D2): the check subset this fixture's ok runs emit
+     * and that aggregates iterate. ABSENT = the full gate universe — so v2
+     * records and the existing code fixtures recompute byte-for-byte. A
+     * clean-target fixture declares its reduced applicable set here (recall/
+     * grounding/actionability are N/A with no material defect). Additive-
+     * optional: the wire contract stays review-cert/v2, no G7 bump. */
+    applicable_check_ids: z.array(CheckIdSchema).min(1).optional(),
 })
     .strict();
-const CheckIdSchema = z.enum(SEMANTIC_QUALITY_GATE_CHECK_IDS);
 const RunCheckSchema = z
     .object({
     check_id: CheckIdSchema,
@@ -174,26 +209,40 @@ function passRate(runs, arm, fixtureId, checkId) {
     const passed = completed.filter((run) => run.checks.some((check) => check.check_id === checkId && check.status === "passed")).length;
     return passed / completed.length;
 }
+/** The check set a fixture's ok runs emit and that aggregates iterate: its
+ * declared applicable_check_ids, or the full gate universe when absent (v2 /
+ * existing fixtures — byte-identical recompute). */
+function applicableChecks(fixture) {
+    return fixture.applicable_check_ids ?? SEMANTIC_QUALITY_GATE_CHECK_IDS;
+}
 /**
  * The ONE aggregate computation both the validator (recompute/compare) and the
  * harness assembler (declare) consume — a second rate implementation could
- * silently disagree with the gate. Fixture×check pairs where either arm has no
- * completed run are OMITTED (rep_floor reports that state separately).
- * `quality_pass` = every recall-first core check meets the absolute floor.
- * Candidate<baseline regressions outside that decisive spine are retained in
- * the aggregate rows and projected by {@link reviewCertQualityDisclosures}.
+ * silently disagree with the gate. Iterates each fixture's APPLICABLE check set
+ * only (v3 §D2): a clean-target fixture omits recall/grounding/actionability, so
+ * they never enter the core-floor judgment as vacuous 0-rate rows. Fixture×check
+ * pairs where either arm has no completed run are OMITTED (rep_floor reports
+ * that state separately). `quality_pass` = every recall-first core check that IS
+ * applicable meets the absolute floor. Candidate<baseline regressions outside
+ * that decisive spine are retained in the aggregate rows and projected by
+ * {@link reviewCertQualityDisclosures}. Duplicate fixture_ids are collapsed
+ * (first wins; duplicate_manifest_input is reported separately).
  */
-export function computeReviewCertAggregates(runs, fixtureIds) {
+export function computeReviewCertAggregates(runs, fixtures) {
     const rows = [];
     let qualityPass = true;
-    for (const fixtureId of fixtureIds) {
-        for (const checkId of SEMANTIC_QUALITY_GATE_CHECK_IDS) {
-            const baselineRate = passRate(runs, "baseline", fixtureId, checkId);
-            const candidateRate = passRate(runs, "candidate", fixtureId, checkId);
+    const seen = new Set();
+    for (const fixture of fixtures) {
+        if (seen.has(fixture.fixture_id))
+            continue;
+        seen.add(fixture.fixture_id);
+        for (const checkId of applicableChecks(fixture)) {
+            const baselineRate = passRate(runs, "baseline", fixture.fixture_id, checkId);
+            const candidateRate = passRate(runs, "candidate", fixture.fixture_id, checkId);
             if (baselineRate === null || candidateRate === null)
                 continue;
             rows.push({
-                fixture_id: fixtureId,
+                fixture_id: fixture.fixture_id,
                 check_id: checkId,
                 baseline_pass_rate: baselineRate,
                 candidate_pass_rate: candidateRate,
@@ -236,8 +285,7 @@ export function reviewCertResubmitDisclosure(record) {
     });
 }
 export function reviewCertQualityDisclosures(record) {
-    const fixtureIds = [...new Set(record.fixtures.map((fixture) => fixture.fixture_id))];
-    return computeReviewCertAggregates(record.runs, fixtureIds).per_fixture_check
+    return computeReviewCertAggregates(record.runs, record.fixtures).per_fixture_check
         .filter((row) => row.candidate_pass_rate < row.baseline_pass_rate &&
         !ratesEqual(row.candidate_pass_rate, row.baseline_pass_rate))
         .map((row) => {
@@ -296,8 +344,35 @@ export function validateReviewCertRecord(record) {
     if (!record.gate_pin.issue_artifacts_provided) {
         push("check_universe_mismatch", "gate_pin.issue_artifacts_provided must be true — without issue artifacts the gate emits a subset universe");
     }
+    // v3 §D2: applicable_check_ids is a per-fixture DECLARATION that can shrink a
+    // fixture's core floor, so the deterministic validator must constrain it — an
+    // unconstrained reduced set lets a MATERIAL-bearing fixture drop its recall
+    // spine and certify silently. Only a designated clean-target fixture may
+    // reduce, and only to the single legal clean-target reduction.
+    for (const fixture of record.fixtures) {
+        if (fixture.applicable_check_ids === undefined)
+            continue;
+        if (!REDUCED_APPLICABLE_FIXTURE_IDS.has(fixture.fixture_id)) {
+            push("applicable_check_ids_invalid", `fixture ${fixture.fixture_id} declares a reduced applicable_check_ids but is not a designated clean-target fixture — a material-bearing fixture must emit the full check universe`, fixture.fixture_id);
+            continue;
+        }
+        const declared = [...new Set(fixture.applicable_check_ids)].sort();
+        if (declared.length !== CLEAN_TARGET_APPLICABLE_CHECK_IDS.length ||
+            declared.some((id, index) => id !== CLEAN_TARGET_APPLICABLE_CHECK_IDS[index])) {
+            push("applicable_check_ids_invalid", `fixture ${fixture.fixture_id} applicable_check_ids must equal the clean-target reduction (${CLEAN_TARGET_APPLICABLE_CHECK_IDS.length} checks: ${CLEAN_TARGET_APPLICABLE_CHECK_IDS.join(", ")})`, fixture.fixture_id);
+        }
+    }
     // Run rows: unique coordinates, manifest membership, completion honesty,
-    // full universe emission on every completed run.
+    // applicable-set emission on every completed run. Each fixture's ok runs must
+    // emit EXACTLY its applicable set (the full universe when it declares none —
+    // v2 / existing fixtures); a clean-target fixture emits its reduced set. The
+    // check_universe pin above stays the full vocabulary regardless (§D2).
+    const expectedEmissionByFixture = new Map();
+    for (const fixture of record.fixtures) {
+        if (expectedEmissionByFixture.has(fixture.fixture_id))
+            continue;
+        expectedEmissionByFixture.set(fixture.fixture_id, [...new Set(applicableChecks(fixture))].sort());
+    }
     const seen = new Set();
     const fixtureSet = new Set(fixtureIds);
     for (const run of record.runs) {
@@ -313,11 +388,12 @@ export function validateReviewCertRecord(record) {
             if (run.units_completed !== run.units_total) {
                 push("units_incomplete", `run ${coordinate} claims completion=ok with ${run.units_completed}/${run.units_total} units — a partial run must be not_run`, coordinate);
             }
+            const expected = expectedEmissionByFixture.get(run.fixture_id) ?? canonical;
             const emitted = [...new Set(run.checks.map((check) => check.check_id))].sort();
-            if (run.checks.length !== canonical.length ||
-                emitted.length !== canonical.length ||
-                emitted.some((id, index) => id !== canonical[index])) {
-                push("check_emission_incomplete", `run ${coordinate} must emit the full check universe exactly once (${canonical.length} checks); got ${run.checks.length}`, coordinate);
+            if (run.checks.length !== expected.length ||
+                emitted.length !== expected.length ||
+                emitted.some((id, index) => id !== expected[index])) {
+                push("check_emission_incomplete", `run ${coordinate} must emit its applicable check set exactly once (${expected.length} checks); got ${run.checks.length}`, coordinate);
             }
         }
         else if (run.checks.length > 0) {
@@ -344,7 +420,7 @@ export function validateReviewCertRecord(record) {
     if (!ratesEqual(record.declared_aggregates.core_check_floor, REVIEW_CERT_CORE_CHECK_FLOOR)) {
         push("aggregate_mismatch", `declared core_check_floor=${record.declared_aggregates.core_check_floor} does not match the contract floor ${REVIEW_CERT_CORE_CHECK_FLOOR}`);
     }
-    const computed = computeReviewCertAggregates(record.runs, [...fixtureSet]);
+    const computed = computeReviewCertAggregates(record.runs, record.fixtures);
     for (const row of computed.per_fixture_check) {
         const subject = `${row.fixture_id}/${row.check_id}`;
         const declared = declaredByKey.get(`${row.fixture_id}\u0000${row.check_id}`);
@@ -359,6 +435,28 @@ export function validateReviewCertRecord(record) {
             push("core_check_floor", `${subject}: candidate pass-rate ${row.candidate_pass_rate.toFixed(4)} is below the absolute core-check floor ${REVIEW_CERT_CORE_CHECK_FLOOR.toFixed(4)}`, subject);
         }
     }
+    // Declared-aggregate set integrity (v3 A-2): the loop above proves every
+    // COMPUTED row is declared and recomputes; this reverse pass proves the declared
+    // side carries no EXTRA and no DUPLICATE rows. A declared aggregate for a
+    // fixture×check pair that is not applicable (a clean-target's excluded recall/
+    // grounding checks) or has no completed run never appears in `computed`, so its
+    // asserted rate cannot be recomputed; a repeated pair would let a spurious rate
+    // ride alongside the honest one. Together the passes pin the declared aggregate
+    // set to EXACTLY the computed set — one rate per applicable, computed pair.
+    const computedKeys = new Set(computed.per_fixture_check.map((row) => `${row.fixture_id}\u0000${row.check_id}`));
+    const declaredSeen = new Set();
+    for (const row of record.declared_aggregates.per_fixture_check) {
+        const key = `${row.fixture_id}\u0000${row.check_id}`;
+        const subject = `${row.fixture_id}/${row.check_id}`;
+        if (declaredSeen.has(key)) {
+            push("aggregate_mismatch", `declared aggregate for ${subject} appears more than once — a fixture×check pair must declare exactly one rate`, subject);
+            continue;
+        }
+        declaredSeen.add(key);
+        if (computedKeys.has(key))
+            continue;
+        push("aggregate_mismatch", `declared aggregate for ${subject} does not recompute — the pair is not applicable or has no completed run (over-declaration)`, subject);
+    }
     if (record.declared_aggregates.quality_pass !== computed.quality_pass) {
         push("aggregate_mismatch", `declared quality_pass=${record.declared_aggregates.quality_pass} does not recompute (recomputed ${computed.quality_pass})`);
     }

package/dist/core-runtime/discovery/settings-chain.js

@@ -55,6 +55,21 @@ const ReviewActorLlmSettingsSchema = z
     timeout_ms: z.number().int().min(1).optional(),
 })
     .strict();
+// Per-call LLM override (MCP tool surface): an ephemeral settings-`llm` overlay
+// applied to the resolved settings for one review/reconstruct invocation, after
+// which the existing pipeline runs unchanged. Single-sourced from
+// LlmSettingsSchema minus the transport/credential fields (base_url, api_key_env,
+// timeout_ms) — those stay settings-owned so a per-call override cannot select an
+// arbitrary endpoint or credential env. The chosen provider's transport resolves
+// from settings exactly as a settings edit would. .strict() rejects the excluded
+// fields. See development-records/design/per-call-llm-override-design-v4.md.
+export const PerCallLlmOverrideSchema = LlmSettingsSchema.pick({
+    provider: true,
+    auth: true,
+    model: true,
+    effort: true,
+    service_tier: true,
+}).strict();
 const LlmRefSchema = LlmSettingsSchema;
 const ReviewWorkerSeatSchema = z.enum(["main", "worker"]);
 const ReviewExecutionModeSchema = z.enum(["main-workers", "nested-workers"]);
@@ -187,8 +202,10 @@ const DEFAULT_REVIEW_EXECUTION = {
     deliberation: "controlled-lens-deliberation",
 };
 export const DEFAULT_DISPATCH_BREAKER_SETTINGS = {
-    // opt-in: OFF = 현행 동작 보존 — 활성화는 settings로만.
-    enabled: false,
+    // DEFAULT ON (2026-07-15 owner-directed promotion): the fan-out dispatch
+    // breaker (trip/poison/recover) is on unless a setting disables it. Disable
+    // with `dispatch_breaker.enabled=false`.
+    enabled: true,
     systemic_threshold: 3,
     per_call_max_attempts: 3,
     backoff_initial_ms: 3000,
@@ -212,11 +229,15 @@ const DEFAULT_REVIEW_RETRY_SETTINGS = {
     deliberation_max_retries: 2,
     synthesis_max_retries: 2,
     retry_initial_delay_ms: 3000,
-    // opt-in: 벤치마크 재현성 보호 — 활성화는 settings로만.
-    salvage: { enabled: false, delta_completion: "unit_llm" },
-    // opt-in: OFF = 현행 halt 동작 보존 — 활성화는 settings로만.
-    resubmit: { enabled: false },
-    // opt-in: OFF = 현행 halt/배리어 동작 보존 — 활성화는 settings로만.
+    // DEFAULT ON (2026-07-15 owner-directed promotion): submit-salvage recovery is
+    // on in real usage unless disabled with `salvage.enabled=false`. The review-cert
+    // harness pins it OFF explicitly (benchmark --no-salvage) for raw, reproducible
+    // measurement — that pin is cert-only, not the product default.
+    salvage: { enabled: true, delta_completion: "unit_llm" },
+    // DEFAULT ON (2026-07-15 owner-directed promotion): bounded unit resubmit on
+    // validation rejection is on unless disabled with `resubmit.enabled=false`.
+    resubmit: { enabled: true },
+    // DEFAULT ON via DEFAULT_DISPATCH_BREAKER_SETTINGS (2026-07-15 promotion).
     dispatch_breaker: DEFAULT_DISPATCH_BREAKER_SETTINGS,
 };
 const DEFAULT_REVIEW_UNIT_TIMEOUT_MS = 240000;
@@ -564,11 +585,12 @@ export function resolveOptionalReconstructActorLlmSettings(settings, actorName)
     normalizeLlmModelSwitcher(actor.llm);
     return actor.llm;
 }
-/** Production opt-in for the semantic-map authoring stage (design §5.5).
- * Absent/false = off: the capability pair is not attached AND the synthesize
- * seat is dormant (excluded from the gate walk — U6, salvage precedent). */
+/** Semantic-map authoring stage (design §5.5). DEFAULT ON (2026-07-15
+ * owner-directed promotion): absent = on; only an explicit `false` disables it,
+ * which detaches the capability pair AND leaves the synthesize seat dormant
+ * (excluded from the gate walk — U6, salvage precedent). */
 export function isReconstructSemanticMapAuthoringEnabled(settings) {
-    return settings.reconstruct?.execution?.semantic_map_authoring === true;
+    return settings.reconstruct?.execution?.semantic_map_authoring !== false;
 }
 export const SETTINGS_FILENAME = "settings.json";
 export const RETIRED_CONFIG_FILENAMES = [

package/dist/core-runtime/llm/model-switcher.js

@@ -6,7 +6,13 @@ export function isDirectModelCallSelection(selection) {
 }
 export const DEFAULT_GROK_BASE_URL = "https://api.x.ai/v1";
 export const DEFAULT_LMSTUDIO_BASE_URL = "http://localhost:1234/v1";
-function defaultAuthForProvider(provider) {
+/**
+ * The auth a block resolves to when it omits `auth`. Exported because callers
+ * that reason about ROUTE IDENTITY (e.g. the per-call llmOverride overlay) must
+ * compare the DEFAULTED auth, not the raw field — a block without `auth` still
+ * dispatches on this route, so an override restating it is not a route change.
+ */
+export function defaultAuthForProvider(provider) {
     if (provider === "openai")
         return "oauth";
     if (provider === "lmstudio")

package/dist/core-runtime/reconstruct/run.js

@@ -7200,7 +7200,7 @@ export function createDirectCallReconstructDirectiveAuthor(args = {}) {
         // of the EFFECTIVE config (model/adapter/base_url/effort — always folded,
         // no equality judgment); else ⑤a arg present → legacy string, byte-identical
         // to the pre-seat format (existing reuse keys never rotate); else absent
-        // (seat 부재·인자 부재 = 현행 byte-parity — a request llmEffort pin alone
+        // (seat 부재·인자 부재 = 현행 byte-parity — a per-call override effort alone
         // reaches synthesize through the base config on BOTH sides, so no fold).
         ...(args.semanticMapSynthesizeLlmConfig !== undefined
             ? {

package/dist/core-runtime/review/materializers.js

@@ -594,6 +594,10 @@ export async function bootstrapInvocationBindingArtifacts(params) {
         // the A-path profile carries). Host advances read it for auditable
         // execution-result/ReviewRecord retry reporting.
         retry_policy: completeReviewRetrySettings(ontoConfig?.review?.execution?.retry),
+        // Durable stamp of the per-call override (design v4 §7): continuation
+        // re-overlays the freshly resolved project profile with it so an overridden
+        // session's units cannot revert to the non-overlaid project models.
+        ...(params.llmOverride ? { llm_override: params.llmOverride } : {}),
         interpretation_artifact_path: interpretationArtifactPath,
         binding_output_path: bindingOutputPath,
         session_metadata_path: sessionMetadataPath,