review-council 1.8.2 → 2.0.0

package/README.md

@@ -153,17 +153,126 @@ rcl roles show <name>      # Show system prompt and details for a role
 
 ---
 
+### `rcl converge-attempt`
+
+Machine-enforced safety guard used by the generated `rcl-converge` skill.
+Each call atomically and durably consumes one per-target attempt under the
+repository's common Git directory, so the budget survives sessions, linked
+worktrees, and abrupt system restarts.
+New targets default to seven attempts, but an explicit invocation can set any
+positive cap with `--max-attempts`. Omitting the flag on resume preserves the
+persisted cap. At the boundary, RCL refuses before provider calls and directs
+the workflow to ask the user; an approved continuation explicitly supplies a
+higher cap.
+
+At the skill level, `--max-attempts N` controls this machine launch budget.
+The separate `--max-rounds N` flag caps evidence rounds and is machine-enforced
+by `rcl converge-report` (default 3, valid range 2–5; rounds past 5 are
+impossible under any flag).
+
+Full-fleet reviewer completion is not required. For the generated
+`rcl-converge` skill, let `N = stats.totalReviews`; a round is conclusive only
+when `stats.successfulReviews >= max(2, ceil(2 × N / 3))`. Every timeout or
+error must be disclosed, and a result below that threshold is inconclusive.
+
+Exit code 2 means the configured cap was exhausted and explicit continuation
+approval is required. Exit code 3 means attempt accounting itself failed
+(state, lock, Git, filesystem, or another infrastructure error); increasing
+the cap is not the remedy. With `--json`, failures are emitted as structured
+JSON on stderr. If the attempt is durably recorded but final lock release
+fails, the claim still succeeds with a warning so retrying cannot spend a
+second slot for the same intended launch.
+
+The short accounting mutex is fully written as a private owner file and then
+published with an exclusive hard link, which cannot replace an existing file
+or legacy directory. State contents and, where supported, their directory
+entry are synced before a claim succeeds. A dead owner is isolated through a
+token-scoped hard-link tombstone before another claimant can proceed; inode
+checks make that tombstone safe to remove after reclamation. Invalid or legacy
+ownerless locks fail closed, and timeout errors include the manual recovery
+path. When upgrading,
+an evidence ledger seeds only its highest recorded round: historical failed or
+missing-report launches cannot be reconstructed, while every claim after the
+machine state is created is counted exactly. The state remains a same-user
+local safety mechanism, not a tamper-proof store: deliberately deleting
+`.git/rcl-converge-attempts` is an explicit policy bypass.
+
+```bash
+rcl converge-attempt --target owner-repo-123                 # default/persisted cap
+rcl converge-attempt --target owner-repo-123 --max-attempts 10  # explicit override
+```
+
+---
+
+### `rcl converge-report` and `rcl converge-verdict`
+
+The cross-round memory of a converge run, persisted in
+`.git/rcl-converge-runs/<target>.json`.
+
+`converge-report` dedupes one round's report JSON against every prior round of
+the run using a location-anchored finding identity (hash of file + category +
+line bucket, plus a line-overlap matcher — titles are deliberately ignored:
+models rephrase ~98% of them between rounds). Each finding is classified
+`new`, `repeat`, `suppressed` (previously dismissed, no new corroboration —
+cannot re-gate), or `regating` (previously dismissed but now backed by ≥2
+models or critical severity). The same call enforces the evidence-round cap:
+default 3, `--max-rounds` accepts 2–5, and rounds past 5 are impossible. Exit
+code 2 is the cap consent boundary; exit 3 is a state failure.
+
+`converge-verdict` records triage outcomes per finding identity —
+`--fixed <key>` and `--dismissed '<key>=<reason>'` (both repeatable) — which
+drives later-round suppression and accrues the per-model precision history.
+
+```bash
+rcl converge-report --target rcl-30 --report report-r2.json --round 2 --json
+rcl converge-verdict --target rcl-30 --round 2 \
+  --fixed 9787c6ea72ae778c --dismissed 'd2baf9675eb450f0=guard already exists'
+```
+
+---
+
+### `rcl models`
+
+The tool's own memory of which reviewers earn their seat. Every reviewer call
+and every `converge-verdict` outcome accrues in a cross-run store at `~/.rcl`
+(`RCL_DATA_DIR` overrides; deliberately not under /tmp, so history survives
+converge-state cleanup). `rcl models` prints, per model over a trailing 90-day
+window: triage precision (share of its supported findings the converge loop
+verified and fixed rather than dismissed), triage volume, call volume,
+dead-call rate, p50 latency — and the consensus **weight** the model earns:
+`0.5 + precision`, clamped to [0.5, 1.5], neutral (1) below 20 triaged
+outcomes. Weights scale each model's consensus vote in report confidence and
+in consensus gating, so persistently noisy models lose gating power
+automatically; the applied weights are visible per finding
+(`consensus.weightedScore` / `consensus.modelWeights`) and per run
+(`stats.modelWeights`) in the report JSON.
+
+```bash
+rcl models                       # table over the trailing 90 days
+rcl models show --window 30 --json
+rcl models seed --from ~/recovered-rcl-artifacts   # backfill from reports + converge ledgers
+```
+
+---
+
 ## Config File
 
 Place `.review-council.yml` in your project root (or any parent directory). All fields are optional.
 
 ```yaml
-# Models to use (provider-prefixed names)
+# Blocking council (provider-prefixed names) — every round waits for these.
+# Shown here: the actual defaults. Keep slow/aggregator-routed models out of
+# this list; give them an async seat instead.
 models:
-  - anthropic/claude-opus-4-6
-  - openai/gpt-5.4
-  - google/gemini-2.5-pro
-  # Any model on https://openrouter.ai — keep the vendor segment after the prefix
+  - anthropic/claude-fable-5
+  - openai/gpt-5.6-sol
+  - google/gemini-3.6-flash
+
+# Async bonus reviewers — fired with each round, never awaited. Results that
+# have arrived by the next round of the same target are merged into that
+# round's dedup and marked `async` in the report JSON.
+# Any model on https://openrouter.ai works — keep the vendor segment after the prefix.
+asyncModels:
   - openrouter/moonshotai/kimi-k3
 
 # Default roles to run
@@ -194,6 +303,17 @@ thresholds:
   dedupeLineWindow: 5      # lines within which findings are merged
   jaccardThreshold: 0.3    # weighted title+description similarity threshold for dedup
 
+# Convergence gating: which findings block convergence / CI (RCL-23).
+# A finding gates when multi-model, critical, or unrefuted by a cheap
+# verification pass; refuted single-model claims stay in the report but
+# stop blocking. Report JSON marks every finding with gating.reason
+# (consensus | critical | verified | none).
+gating:
+  mode: verified-consensus        # or all-findings (legacy: severity alone decides)
+  minModels: 2                    # distinct models for consensus gating
+  verificationModel: google/gemini-3.6-flash  # direct-API only
+  verificationTimeout: 60000      # ms for the single batched refutation call
+
 # Output defaults
 output:
   markdown: true
@@ -202,7 +322,11 @@ output:
 
 # Concurrency and reliability
 concurrency: 6
-timeout: 600000       # ms per model call (reasoning models need headroom on real diffs)
+timeout: 300000       # ms per blocking model call (every direct-API p90 is under 260s)
+asyncTimeout: 900000  # ms per async-lane call (slow reasoning models get headroom; nothing waits on them)
+# quorumFraction: 0.75  # round closes once this share of calls has completed; stragglers
+                        # are canceled and recorded (core `models` are never canceled).
+                        # Default: exactly 2/3 — leave unset for that; 1 disables.
 maxRetries: 3
 
 # Reasoning budget for providers that support it (currently OpenRouter).
@@ -225,6 +349,12 @@ spec: SPEC.md
 
 Supported config file names: `.review-council.yml`, `.review-council.yaml`, `.review-council.json`, `review-council.config.js`.
 
+Before dispatch, RCL prints the expanded reviewer × chunk call count,
+concurrency, wave count, timeout, and timeout-bound queue estimate. Interactive
+runs update the spinner; redirected runs emit periodic heartbeat and bounded
+completion lines with status counters, so a long queue is distinguishable from
+a hung process.
+
 ---
 
 ## How Consensus Works
@@ -254,16 +384,15 @@ For the full algorithm, see [CONSENSUS_V2_SPEC.md](./CONSENSUS_V2_SPEC.md).
 | `RCL_DEBUG` | Set to any value to print full error stack traces |
 | `RCL_NO_HARNESS_KEYS` | Set to any value to disable Harness key distribution (below) |
 
-The default model fleet includes OpenRouter-hosted models. If `OPENROUTER_API_KEY`
-is not set, those entries are dropped from the defaults with a warning naming the
-surviving fleet (models you configure explicitly still fail loudly instead). The
-default secondary list is entirely OpenRouter-hosted, so without the key it is
-empty and specialist roles are spread across the primary models only — set
-`secondaryModels:` explicitly if you want a secondary tier without OpenRouter. Note that when the key is set,
-default reviews send diff and context content to OpenRouter — an aggregator and
-an additional data processor beyond the direct model providers — as well as to
-Anthropic, OpenAI, and Google. Configure `models:` explicitly if that matters
-for your repository.
+The default blocking council is direct-API only (Anthropic, OpenAI, Google) —
+no default review round ever waits on an OpenRouter-routed call. The default
+async lane holds one OpenRouter-hosted bonus reviewer (`kimi-k3`); if
+`OPENROUTER_API_KEY` is not set, it is dropped from the defaults with a warning
+(models you configure explicitly still fail loudly instead). Note that when the
+key is set, default reviews send diff and context content to OpenRouter — an
+aggregator and an additional data processor beyond the direct model providers —
+as well as to Anthropic, OpenAI, and Google. Configure `models:` and
+`asyncModels:` explicitly if that matters for your repository.
 
 ### Key distribution via Harness
 

package/dist/ci.js

@@ -13,7 +13,13 @@ export function evaluateCiGate(result) {
             message: `CI: 0/${result.stats.totalReviews} reviewers succeeded — nothing was reviewed. Exiting with code 1.`,
         };
     }
-    const blocking = result.findings.filter((f) => f.severity === 'critical' || f.severity === 'important');
+    // Gating-annotated findings (RCL-23) block on their gating reason —
+    // consensus, critical, or verified — so a refuted single-model claim no
+    // longer fails CI. Legacy reports without annotations keep the pure
+    // severity gate.
+    const blocking = result.findings.filter((f) => f.gating
+        ? f.gating.reason !== 'none'
+        : f.severity === 'critical' || f.severity === 'important');
     if (blocking.length > 0) {
         return {
             exitCode: 1,

package/dist/ci.js.map

@@ -1 +1 @@
-{"version":3,"file":"ci.js","sourceRoot":"","sources":["../src/ci.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB;IACjD,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,SAAS,MAAM,CAAC,KAAK,CAAC,YAAY,mEAAmE;SAC/G,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,CAC/D,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,QAAQ,CAAC,MAAM,kDAAkD;SAClF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"ci.js","sourceRoot":"","sources":["../src/ci.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB;IACjD,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,SAAS,MAAM,CAAC,KAAK,CAAC,YAAY,mEAAmE;SAC/G,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,oEAAoE;IACpE,iBAAiB;IACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5C,CAAC,CAAC,MAAM;QACN,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM;QAC5B,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,CAC5D,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,QAAQ,CAAC,MAAM,kDAAkD;SAClF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACzB,CAAC"}

package/dist/config/defaults.d.ts

@@ -1,12 +1,27 @@
-/** SOTA models — run the general role + participate in specialized round-robin */
-export declare const DEFAULT_MODELS: readonly ["anthropic/claude-fable-5", "openai/gpt-5.6-sol", "google/gemini-3.6-flash", "openrouter/moonshotai/kimi-k3"];
+/**
+ * Core (blocking) council — every round waits for these and only these.
+ * Direct-API models only: the RCL-21 audit (922 rounds, 15,268 calls) found
+ * the OpenRouter wing at p50 7–9.5 min per call with 19–39% dead calls,
+ * last-finisher in 97.6% of rounds; the direct trio answers in 45–70 s with
+ * ~0% dead calls. Replaying the corpus with this trio alone drops the median
+ * round from 14.4 to 2.0 min while 91% of multi-model findings still surface.
+ */
+export declare const DEFAULT_MODELS: readonly ["anthropic/claude-fable-5", "openai/gpt-5.6-sol", "google/gemini-3.6-flash"];
+/**
+ * Async bonus reviewers — fired with the round but never awaited; whatever
+ * has arrived by the NEXT round's dedup is merged then, marked async in the
+ * report. kimi-k3 keeps a seat here because it has the council's best
+ * corroboration rate (62%) but is ~6× slower than the core trio.
+ */
+export declare const DEFAULT_ASYNC_MODELS: readonly ["openrouter/moonshotai/kimi-k3"];
 /**
  * Secondary models — specialized round-robin only, no general role.
- * Chosen for training-lineage diversity: with the four SOTA models above,
- * every default voter comes from a different lab, so cross-model consensus
- * always reflects independent confirmation.
+ * Empty by default since RCL-25: qwen3.8-max, deepseek-v4-flash and grok-4.5
+ * were removed after the audit (24–39% dead calls, worst finding-cost in the
+ * council). Before any slow model earns a seat back, try it via its direct
+ * provider API instead of OpenRouter and re-measure.
  */
-export declare const DEFAULT_SECONDARY_MODELS: readonly ["openrouter/qwen/qwen3.8-max", "openrouter/deepseek/deepseek-v4-flash-0731", "openrouter/x-ai/grok-4.5"];
+export declare const DEFAULT_SECONDARY_MODELS: readonly [];
 export declare const DEFAULT_THRESHOLDS: {
     readonly minConsensusScore: 0.4;
     readonly minConfidence: 0.2;
@@ -23,13 +38,26 @@ export declare const DEFAULT_THRESHOLDS: {
     readonly jaccardThreshold: 0.3;
 };
 /**
- * Reasoning-heavy models (kimi-k3, qwen3.8-max, deepseek-v4, grok-4.5)
- * routinely need several minutes to review a real diff: at 120s the entire
- * OpenRouter wing of the default fleet timed out, and at 300s most
- * specialist runs still did (successful calls measured 217–291s, with no
- * headroom). Dogfooded on this repo's own diffs.
+ * Blocking-path per-call timeout. Every direct-API model's p90 in the
+ * RCL-21 corpus is under 260 s, so 300 s only ever cuts models that should
+ * not be on the blocking path in the first place (slow reasoning models
+ * belong in the async lane, which has its own longer cap below).
+ */
+export declare const DEFAULT_TIMEOUT_MS = 300000;
+/**
+ * Quorum round closure (RCL-26): a round closes once this fraction of its
+ * planned calls has completed; outstanding non-core calls are canceled and
+ * recorded. ⅔ matches the converge reviewer-health threshold, so a round
+ * closed exactly at quorum can still be conclusive. Corpus replay: −51%
+ * total review wall even with the pre-RCL-25 roster. Set to 1 to disable.
+ */
+export declare const DEFAULT_QUORUM_FRACTION: number;
+/**
+ * Per-call timeout for the async (non-blocking) lane. Async reviewers are
+ * slow by definition — kimi-k3's p50 is 7–9.5 min — and nothing waits on
+ * them, so they get more headroom than the blocking council.
  */
-export declare const DEFAULT_TIMEOUT_MS = 600000;
+export declare const DEFAULT_ASYNC_TIMEOUT_MS = 900000;
 export declare const DEFAULT_MAX_RETRIES = 3;
 /**
  * Reasoning budget for OpenRouter-hosted models. Unbounded, they spend the

package/dist/config/defaults.js

@@ -1,21 +1,31 @@
-/** SOTA models — run the general role + participate in specialized round-robin */
+/**
+ * Core (blocking) council — every round waits for these and only these.
+ * Direct-API models only: the RCL-21 audit (922 rounds, 15,268 calls) found
+ * the OpenRouter wing at p50 7–9.5 min per call with 19–39% dead calls,
+ * last-finisher in 97.6% of rounds; the direct trio answers in 45–70 s with
+ * ~0% dead calls. Replaying the corpus with this trio alone drops the median
+ * round from 14.4 to 2.0 min while 91% of multi-model findings still surface.
+ */
 export const DEFAULT_MODELS = [
     'anthropic/claude-fable-5',
     'openai/gpt-5.6-sol',
     'google/gemini-3.6-flash',
-    'openrouter/moonshotai/kimi-k3',
 ];
+/**
+ * Async bonus reviewers — fired with the round but never awaited; whatever
+ * has arrived by the NEXT round's dedup is merged then, marked async in the
+ * report. kimi-k3 keeps a seat here because it has the council's best
+ * corroboration rate (62%) but is ~6× slower than the core trio.
+ */
+export const DEFAULT_ASYNC_MODELS = ['openrouter/moonshotai/kimi-k3'];
 /**
  * Secondary models — specialized round-robin only, no general role.
- * Chosen for training-lineage diversity: with the four SOTA models above,
- * every default voter comes from a different lab, so cross-model consensus
- * always reflects independent confirmation.
+ * Empty by default since RCL-25: qwen3.8-max, deepseek-v4-flash and grok-4.5
+ * were removed after the audit (24–39% dead calls, worst finding-cost in the
+ * council). Before any slow model earns a seat back, try it via its direct
+ * provider API instead of OpenRouter and re-measure.
  */
-export const DEFAULT_SECONDARY_MODELS = [
-    'openrouter/qwen/qwen3.8-max',
-    'openrouter/deepseek/deepseek-v4-flash-0731',
-    'openrouter/x-ai/grok-4.5',
-];
+export const DEFAULT_SECONDARY_MODELS = [];
 export const DEFAULT_THRESHOLDS = {
     minConsensusScore: 0.4,
     minConfidence: 0.2,
@@ -32,13 +42,26 @@ export const DEFAULT_THRESHOLDS = {
     jaccardThreshold: 0.3,
 };
 /**
- * Reasoning-heavy models (kimi-k3, qwen3.8-max, deepseek-v4, grok-4.5)
- * routinely need several minutes to review a real diff: at 120s the entire
- * OpenRouter wing of the default fleet timed out, and at 300s most
- * specialist runs still did (successful calls measured 217–291s, with no
- * headroom). Dogfooded on this repo's own diffs.
+ * Blocking-path per-call timeout. Every direct-API model's p90 in the
+ * RCL-21 corpus is under 260 s, so 300 s only ever cuts models that should
+ * not be on the blocking path in the first place (slow reasoning models
+ * belong in the async lane, which has its own longer cap below).
+ */
+export const DEFAULT_TIMEOUT_MS = 300_000;
+/**
+ * Quorum round closure (RCL-26): a round closes once this fraction of its
+ * planned calls has completed; outstanding non-core calls are canceled and
+ * recorded. ⅔ matches the converge reviewer-health threshold, so a round
+ * closed exactly at quorum can still be conclusive. Corpus replay: −51%
+ * total review wall even with the pre-RCL-25 roster. Set to 1 to disable.
+ */
+export const DEFAULT_QUORUM_FRACTION = 2 / 3;
+/**
+ * Per-call timeout for the async (non-blocking) lane. Async reviewers are
+ * slow by definition — kimi-k3's p50 is 7–9.5 min — and nothing waits on
+ * them, so they get more headroom than the blocking council.
  */
-export const DEFAULT_TIMEOUT_MS = 600_000;
+export const DEFAULT_ASYNC_TIMEOUT_MS = 900_000;
 export const DEFAULT_MAX_RETRIES = 3;
 /**
  * Reasoning budget for OpenRouter-hosted models. Unbounded, they spend the

package/dist/config/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,0BAA0B;IAC1B,oBAAoB;IACpB,yBAAyB;IACzB,+BAA+B;CACvB,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,6BAA6B;IAC7B,4CAA4C;IAC5C,0BAA0B;CAClB,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,iBAAiB,EAAE,GAAG;IACtB,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,GAAG;CACb,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU;IACV,WAAW;IACX,OAAO;IACP,SAAS;CACD,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,GAAG;CACA,CAAC"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,0BAA0B;IAC1B,oBAAoB;IACpB,yBAAyB;CACjB,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,+BAA+B,CAAU,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAW,CAAC;AAEpD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,iBAAiB,EAAE,GAAG;IACtB,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,GAAG;CACb,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,CAAC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU;IACV,WAAW;IACX,OAAO;IACP,SAAS;CACD,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,GAAG;CACA,CAAC"}

package/dist/config/loader.js

@@ -1,6 +1,6 @@
 import { cosmiconfig } from 'cosmiconfig';
 import { ConfigSchema } from './schema.js';
-import { DEFAULT_MODELS, DEFAULT_SECONDARY_MODELS, DEFAULT_THRESHOLDS, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_RETRIES, DEFAULT_CONCURRENCY, DEFAULT_REASONING_EFFORT, } from './defaults.js';
+import { DEFAULT_MODELS, DEFAULT_SECONDARY_MODELS, DEFAULT_ASYNC_MODELS, DEFAULT_THRESHOLDS, DEFAULT_TIMEOUT_MS, DEFAULT_ASYNC_TIMEOUT_MS, DEFAULT_QUORUM_FRACTION, DEFAULT_MAX_RETRIES, DEFAULT_CONCURRENCY, DEFAULT_REASONING_EFFORT, } from './defaults.js';
 /**
  * A config file was found but could not be used. Never silently recover
  * from this: falling back to defaults would send code to cloud providers
@@ -80,8 +80,11 @@ function buildDefaultConfig() {
     return {
         models: dropOpenRouterDefaultsWithoutKey(DEFAULT_MODELS, 'models'),
         secondaryModels: dropOpenRouterDefaultsWithoutKey(DEFAULT_SECONDARY_MODELS, 'secondary models'),
+        asyncModels: dropOpenRouterDefaultsWithoutKey(DEFAULT_ASYNC_MODELS, 'async models'),
         thresholds: { ...DEFAULT_THRESHOLDS },
         timeout: DEFAULT_TIMEOUT_MS,
+        asyncTimeout: DEFAULT_ASYNC_TIMEOUT_MS,
+        quorumFraction: DEFAULT_QUORUM_FRACTION,
         maxRetries: DEFAULT_MAX_RETRIES,
         concurrency: DEFAULT_CONCURRENCY,
         reasoningEffort: DEFAULT_REASONING_EFFORT,
@@ -94,6 +97,13 @@ function mergeWithDefaults(config) {
             (config.models
                 ? []
                 : dropOpenRouterDefaultsWithoutKey(DEFAULT_SECONDARY_MODELS, 'secondary models')),
+        // Same containment rule as secondaryModels: an explicit `models` list
+        // means "send code to exactly these providers" — default async reviewers
+        // must not leak the diff to a provider the user configured away from.
+        asyncModels: config.asyncModels ??
+            (config.models
+                ? []
+                : dropOpenRouterDefaultsWithoutKey(DEFAULT_ASYNC_MODELS, 'async models')),
         roles: config.roles,
         reviewers: config.reviewers,
         customRoles: config.customRoles,
@@ -101,8 +111,12 @@ function mergeWithDefaults(config) {
             ...DEFAULT_THRESHOLDS,
             ...config.thresholds,
         },
+        // Resolved (and validated) at use by resolveGatingConfig.
+        gating: config.gating,
         output: config.output,
         timeout: config.timeout ?? DEFAULT_TIMEOUT_MS,
+        asyncTimeout: config.asyncTimeout ?? DEFAULT_ASYNC_TIMEOUT_MS,
+        quorumFraction: config.quorumFraction ?? DEFAULT_QUORUM_FRACTION,
         maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,
         concurrency: config.concurrency ?? DEFAULT_CONCURRENCY,
         reasoningEffort: config.reasoningEffort ?? DEFAULT_REASONING_EFFORT,

package/dist/config/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAe,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,yEAAyE;AACzE,mEAAmE;AACnE,wEAAwE;AACxE,mCAAmC;AACnC,MAAM,aAAa,GAAG;IACpB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;CACvB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAmB,EAAE,UAAmB;IACvE,MAAM,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,gBAAgB,EAAE;QAC7C,YAAY,EAAE,aAAa;QAC3B,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,+DAA+D;QAC/D,cAAc,EAAE,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU;YACjB,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YACjC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,UAAU,IAAI,mBAAmB,CAAC;QACjD,MAAM,IAAI,WAAW,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aACzE,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,WAAW,CAAC,qBAAqB,MAAM,CAAC,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gCAAgC,CACvC,MAAyB,EACzB,QAAgB;IAEhB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,sEAAsE;QACtE,kEAAkE;QAClE,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/D,OAAO,CAAC,IAAI,CACV,4CAA4C,OAAO,0CAA0C,QAAQ,gBAAgB,SAAS,8CAA8C,CAC7K,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;QACL,MAAM,EAAE,gCAAgC,CAAC,cAAc,EAAE,QAAQ,CAAC;QAClE,eAAe,EAAE,gCAAgC,CAAC,wBAAwB,EAAE,kBAAkB,CAAC;QAC/F,UAAU,EAAE,EAAE,GAAG,kBAAkB,EAAE;QACrC,OAAO,EAAE,kBAAkB;QAC3B,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,mBAAmB;QAChC,eAAe,EAAE,wBAAwB;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,gCAAgC,CAAC,cAAc,EAAE,QAAQ,CAAC;QACnF,eAAe,EACb,MAAM,CAAC,eAAe;YACtB,CAAC,MAAM,CAAC,MAAM;gBACZ,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,gCAAgC,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAAC;QACrF,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE;YACV,GAAG,kBAAkB;YACrB,GAAG,MAAM,CAAC,UAAU;SACrB;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,kBAAkB;QAC7C,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,mBAAmB;QACpD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;QACtD,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,wBAAwB;QACnE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC9D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAe,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,yEAAyE;AACzE,mEAAmE;AACnE,wEAAwE;AACxE,mCAAmC;AACnC,MAAM,aAAa,GAAG;IACpB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;CACvB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAmB,EAAE,UAAmB;IACvE,MAAM,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,gBAAgB,EAAE;QAC7C,YAAY,EAAE,aAAa;QAC3B,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,+DAA+D;QAC/D,cAAc,EAAE,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU;YACjB,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YACjC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,UAAU,IAAI,mBAAmB,CAAC;QACjD,MAAM,IAAI,WAAW,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aACzE,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,WAAW,CAAC,qBAAqB,MAAM,CAAC,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gCAAgC,CACvC,MAAyB,EACzB,QAAgB;IAEhB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,sEAAsE;QACtE,kEAAkE;QAClE,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/D,OAAO,CAAC,IAAI,CACV,4CAA4C,OAAO,0CAA0C,QAAQ,gBAAgB,SAAS,8CAA8C,CAC7K,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;QACL,MAAM,EAAE,gCAAgC,CAAC,cAAc,EAAE,QAAQ,CAAC;QAClE,eAAe,EAAE,gCAAgC,CAAC,wBAAwB,EAAE,kBAAkB,CAAC;QAC/F,WAAW,EAAE,gCAAgC,CAAC,oBAAoB,EAAE,cAAc,CAAC;QACnF,UAAU,EAAE,EAAE,GAAG,kBAAkB,EAAE;QACrC,OAAO,EAAE,kBAAkB;QAC3B,YAAY,EAAE,wBAAwB;QACtC,cAAc,EAAE,uBAAuB;QACvC,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,mBAAmB;QAChC,eAAe,EAAE,wBAAwB;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,gCAAgC,CAAC,cAAc,EAAE,QAAQ,CAAC;QACnF,eAAe,EACb,MAAM,CAAC,eAAe;YACtB,CAAC,MAAM,CAAC,MAAM;gBACZ,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,gCAAgC,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAAC;QACrF,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,WAAW,EACT,MAAM,CAAC,WAAW;YAClB,CAAC,MAAM,CAAC,MAAM;gBACZ,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,gCAAgC,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;QAC7E,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE;YACV,GAAG,kBAAkB;YACrB,GAAG,MAAM,CAAC,UAAU;SACrB;QACD,0DAA0D;QAC1D,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,kBAAkB;QAC7C,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,wBAAwB;QAC7D,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,uBAAuB;QAChE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,mBAAmB;QACpD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;QACtD,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,wBAAwB;QACnE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC9D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC"}

package/dist/config/schema.d.ts

@@ -42,9 +42,25 @@ export declare const ReasoningEffortSchema: z.ZodEnum<{
     medium: "medium";
     high: "high";
 }>;
+/**
+ * Convergence gating (RCL-23). `verified-consensus` (default): a finding
+ * gates only when multi-model, critical, or unrefuted by the verification
+ * pass. `all-findings` restores the legacy behavior where every
+ * critical/important finding gates.
+ */
+export declare const GatingSchema: z.ZodObject<{
+    mode: z.ZodOptional<z.ZodEnum<{
+        "verified-consensus": "verified-consensus";
+        "all-findings": "all-findings";
+    }>>;
+    minModels: z.ZodOptional<z.ZodNumber>;
+    verificationModel: z.ZodOptional<z.ZodString>;
+    verificationTimeout: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
 export declare const ConfigSchema: z.ZodObject<{
     models: z.ZodOptional<z.ZodArray<z.ZodString>>;
     secondaryModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    asyncModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
     roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
     reviewers: z.ZodOptional<z.ZodArray<z.ZodObject<{
         model: z.ZodString;
@@ -62,6 +78,15 @@ export declare const ConfigSchema: z.ZodObject<{
         dedupeLineWindow: z.ZodOptional<z.ZodNumber>;
         jaccardThreshold: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
+    gating: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<{
+            "verified-consensus": "verified-consensus";
+            "all-findings": "all-findings";
+        }>>;
+        minModels: z.ZodOptional<z.ZodNumber>;
+        verificationModel: z.ZodOptional<z.ZodString>;
+        verificationTimeout: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
     output: z.ZodOptional<z.ZodObject<{
         terminal: z.ZodOptional<z.ZodBoolean>;
         json: z.ZodOptional<z.ZodBoolean>;
@@ -72,6 +97,8 @@ export declare const ConfigSchema: z.ZodObject<{
         belowThresholdAppendix: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     timeout: z.ZodOptional<z.ZodNumber>;
+    asyncTimeout: z.ZodOptional<z.ZodNumber>;
+    quorumFraction: z.ZodOptional<z.ZodNumber>;
     maxRetries: z.ZodOptional<z.ZodNumber>;
     concurrency: z.ZodOptional<z.ZodNumber>;
     reasoningEffort: z.ZodOptional<z.ZodEnum<{

package/dist/config/schema.js

@@ -38,15 +38,46 @@ export const OutputSchema = z.object({
     belowThresholdAppendix: z.boolean().optional(),
 });
 export const ReasoningEffortSchema = z.enum(['low', 'medium', 'high']);
+/**
+ * Convergence gating (RCL-23). `verified-consensus` (default): a finding
+ * gates only when multi-model, critical, or unrefuted by the verification
+ * pass. `all-findings` restores the legacy behavior where every
+ * critical/important finding gates.
+ */
+export const GatingSchema = z.object({
+    mode: z.enum(['verified-consensus', 'all-findings']).optional(),
+    /** Distinct supporting models that make a finding consensus-gated. */
+    minModels: z.number().int().min(2).optional(),
+    /** Direct-API model for the refutation pass (openrouter/ is rejected). */
+    verificationModel: z.string().optional(),
+    /** Per-call timeout (ms) for the verification pass. */
+    verificationTimeout: z.number().positive().optional(),
+});
 export const ConfigSchema = z.object({
     models: z.array(z.string()).optional(),
     secondaryModels: z.array(z.string()).optional(),
+    /**
+     * Async bonus reviewers — fired with each round, never awaited. Results
+     * that have arrived by the next round's dedup are merged then and marked
+     * async in the report. Never on the blocking path.
+     */
+    asyncModels: z.array(z.string()).optional(),
     roles: z.array(z.string()).optional(),
     reviewers: z.array(ReviewerPairSchema).optional(),
     customRoles: z.array(RoleConfigSchema).optional(),
     thresholds: ThresholdsSchema.optional(),
+    gating: GatingSchema.optional(),
     output: OutputSchema.optional(),
     timeout: z.number().positive().optional(),
+    /** Per-call timeout (ms) for the async lane; defaults higher than `timeout`. */
+    asyncTimeout: z.number().positive().optional(),
+    /**
+     * Fraction of planned calls whose completion closes a review round;
+     * outstanding non-core calls are canceled. 1 disables early closure.
+     * Floored at ⅔ so a closed round can still pass the converge
+     * reviewer-health check (successful ≥ ⅔ of total).
+     */
+    quorumFraction: z.number().min(2 / 3).max(1).optional(),
     maxRetries: z.number().int().nonnegative().optional(),
     concurrency: z.number().int().positive().optional(),
     /** Reasoning budget for providers that support it (currently OpenRouter). */

package/dist/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,OAAO;IACP,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,6EAA6E;IAC7E,eAAe,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,OAAO;IACP,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/D,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,0EAA0E;IAC1E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,uDAAuD;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,gFAAgF;IAChF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,6EAA6E;IAC7E,eAAe,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC"}

package/dist/consensus/deduper.d.ts

@@ -37,5 +37,5 @@ export declare function hasOpposingSentiment(a: Finding, b: Finding, specificOnl
  * (the ungated code-council version added one).
  */
 export declare function conceptSimilarity(a: Finding, b: Finding): number;
-export declare function linesOverlap(a: Finding, b: Finding, window: number): boolean;
+export declare function linesOverlap(a: Pick<Finding, 'startLine' | 'endLine'>, b: Pick<Finding, 'startLine' | 'endLine'>, window: number): boolean;
 export declare function deduplicateFindings(reviews: ModelReview[], jaccardThreshold?: number, lineWindow?: number, minConsensusScore?: number): DeduplicatedGroup[];