review-council 4.1.11 → 4.2.0

package/README.md

@@ -44,8 +44,21 @@ rcl review changes.patch --ci --markdown report.md
 | 🏗️ `architecture` | Module boundaries, coupling, and architectural patterns |
 | 🐛 `bug-hunter` | Logic errors, null paths, race conditions, off-by-one |
 | ♿ `accessibility-auditor` | WCAG compliance, ARIA roles, keyboard navigation |
-| 📋 `project-rules` | Enforces repo conventions from `AGENTS.md`, `CLAUDE.md`, etc. |
 | 📄 `spec-compliance` | Checks implementation against a spec or plan file |
+| `regression-hunter` | Changed defaults, weakened guards, and lost behavior |
+| `dependency-hygiene` | Unnecessary dependencies, external requests, and privacy leaks |
+| `edge-case-hunter` | Boundary values, unusual inputs, and failure paths |
+
+`project-rules` and `dead-code` are no longer built-in reviewer roles. Repository
+rules discovered in `AGENTS.md`, `CLAUDE.md`, or the other supported rules files
+are supplied as shared context to the remaining reviewers. Remove the retired
+names from explicit role lists; they follow the usual unknown-role warning and
+skip behavior unless you define a custom role with that name.
+
+The default Fable and Sol general reviewers plus specialist assignments schedule
+13 blocking seats, or 14 when a specification enables `spec-compliance`. Gemini
+is eligible for specialist assignments only. The async general reviewer
+and verifier are separate; quorum is calculated from the blocking roster.
 
 List roles in the terminal:
 
@@ -228,10 +241,20 @@ impossible under any flag). The default is a consent boundary, not a stop: at
 15 rounds the workflow asks the user, and an approved continuation supplies a
 higher `--max-rounds`.
 
-Full-fleet reviewer completion is not required. For the generated
-`rcl-converge` skill, let `N = stats.totalReviews`; a round is conclusive only
-when `stats.successfulReviews >= max(2, ceil(2 × N / 3))`. Every timeout or
-error must be disclosed, and a result below that threshold is inconclusive.
+Full-fleet reviewer completion is not required. Reviewer health counts only
+the report roster's blocking seats, and a seat counts only when every one of
+its chunks succeeded. A round is conclusive when at least
+`max(2, ceil(2 × blocking seats / 3))` blocking seats completed, or more under
+a stricter configured `quorumFraction`. Each report records this as
+`stats.blockingHealth` (`seats`, `successful`, `required`, `conclusive`).
+Secondary, async and verification results keep their findings but never count
+toward the quorum, so the aggregate `stats.successfulReviews` /
+`stats.totalReviews` are informational only: 11 of 17 blocking seats plus one
+async success is 12/18 in aggregate yet inconclusive, because 12 blocking
+seats are required. This is the rule Harness applies to delivered evidence.
+Round closure uses the same seats and policy: bonus successes never cancel
+unfinished blocking reviewers. Every timeout or error must be disclosed, and a
+result below the requirement is inconclusive.
 
 Exit code 2 means the configured cap was exhausted and explicit continuation
 approval is required. Exit code 3 means attempt accounting itself failed
@@ -278,6 +301,21 @@ genuinely new evidence). The same call enforces the evidence-round cap:
 default 15, `--max-rounds` accepts 2–99, and rounds past 99 are impossible. Exit
 code 2 is the cap consent boundary; exit 3 is a state failure.
 
+Before reading or writing native state, `converge-report` derives blocking
+reviewer health from the report's roster and rows. An inconclusive report exits
+4 (`report_health_inconclusive`) and is not admitted: its findings are not
+classified or triaged. The refusal names the completed blocking seats, the
+required count, every missing, failed or canceled seat, and the excluded
+secondary/async successes (with `--json`, as `error.reviewerHealth`). A report
+whose recorded `stats.blockingHealth` disagrees with its rows exits 4 with
+`report_health_unverifiable`. The report, its attempt and all earlier rounds
+stay unchanged. Continue with the same guarded review command plus
+`--retry-reason`: the guard records blocking health for every new launch,
+requires that explicit reason for an inconclusive one, and spends one more
+attempt at the same round without resetting caps or cycle history. Retained
+missing-reviewer recovery remains a separate workflow. Conclusive health does
+not replace triage, and merging still requires matching enforced review and CI.
+
 A report key must identify one canonical identity, status and suppression reason.
 `converge-report` refuses conflicting mappings with exit 3 before writing the
 round state, even when telemetry is off. Reports without finding keys use the
@@ -1023,6 +1061,9 @@ Place `.review-council.yml` in your project root and run `rcl` from there. rcl l
 models:
   - anthropic/claude-fable-5-1
   - openai/gpt-6-sol
+
+# Specialist assignments only; no additional general reviewer.
+secondaryModels:
   - google/gemini-3.8-flash
 
 # Async bonus reviewers — fired with each round, never awaited. Results that
@@ -1061,8 +1102,8 @@ thresholds:
   jaccardThreshold: 0.3    # weighted title+description similarity threshold for dedup
 
 # Convergence gating: which findings block convergence / CI (RCL-23).
-# A finding gates when multi-model, critical, or unrefuted by a cheap
-# verification pass; refuted single-model claims stay in the report but
+# A finding gates when multi-model, critical, or confirmed with source evidence by the
+# verifier; refuted or insufficient-evidence single-model claims stay visible but
 # stop blocking, and so does a claim the pass could not check (verdict
 # unavailable): verification promotes nothing it did not check. Report
 # JSON marks every finding with gating.reason
@@ -1070,7 +1111,8 @@ thresholds:
 gating:
   mode: verified-consensus        # or all-findings (legacy: severity alone decides)
   minModels: 2                    # distinct models for consensus gating
-  verificationModel: google/gemini-3.8-flash  # direct-API only
+  verificationModel: openai/gpt-6-astra  # direct-API only
+  verificationReasoningEffort: high     # OpenAI verifier only; separate from reviewer effort
   verificationPassTimeout: 180000 # ms for the complete verification queue
 
 # Output defaults
@@ -1080,19 +1122,25 @@ output:
   belowThresholdAppendix: true  # false drops below-threshold findings outright
 
 # Concurrency and reliability
-concurrency: 6
+concurrency: 9        # maximum simultaneous blocking reviewer calls per process
+                      # set to 6 to retain the previous limit
 timeout: 540000       # ms per blocking model call (matches the current default)
 asyncTimeout: 900000  # ms per async-lane call (slow reasoning models get headroom; nothing waits on them)
-# quorumFraction: 0.75  # round closes once this share of calls has completed; stragglers
-                        # are canceled and recorded (core `models` are never canceled).
-                        # Default: exactly 2/3 — leave unset for that; 1 disables.
+# quorumFraction: 0.75  # round closes once this share of blocking seats succeeds
+                        # on every chunk; all stragglers can be canceled, including core models.
+                        # Secondary successes never count; secondary calls still
+                        # running at closure are canceled. Also raises the report's
+                        # blocking-health requirement.
+                        # Default: exactly 2/3 — leave unset for that; 1 disables
+                        # closure and waits for every call.
 maxRetries: 3
 
 # Reasoning budget for providers that support it (currently OpenRouter).
-# low | medium | high — default medium. Unbounded reasoning makes these
+# low | medium | high — default low (supported by the default Kimi K3).
+# Check the selected model's supported levels before overriding. Unbounded reasoning makes these
 # models spend the whole completion budget thinking before they answer;
-# raise to 'high' for deeper review at the cost of latency and tokens.
-reasoningEffort: medium
+# select a supported higher level when evaluation justifies deeper review.
+reasoningEffort: low
 
 # Context files to attach to every review
 context:
@@ -1106,6 +1154,11 @@ spec: SPEC.md
 # githubToken: ghp_...
 ```
 
+`concurrency` limits blocking reviewer calls within one RCL process. Separate
+RCL processes share provider capacity without sharing this limit; async reviewers
+and verification use their own scheduling. Set `concurrency: 6` in the applicable
+configuration to restore the previous limit for new reviews.
+
 `maxRetries` limits additional adapter SDK invocations after the first attempt;
 all attempts share the call's `timeout` and parent cancellation signal. Supported
 transient connection failures and HTTP status errors may retry; cancellation,
@@ -1118,6 +1171,30 @@ exposes, not proof of total charges across retries.
 
 Supported config file names: `.review-council.yml`, `.review-council.yaml`, `.review-council.json`. Executable JS config is never discovered: rcl often runs in untrusted checkouts with provider keys in the environment.
 
+The verifier uses three verdicts: `confirmed`, `refuted`, and
+`insufficient_evidence`. Confirmation requires a reachable failure mechanism and
+exact code excerpts from the supplied change; citations are checked against that
+source before a claim can be promoted to `verified`. Missing context or inability
+to refute a claim is not confirmation. This checks citation provenance, not semantic
+truth: the verifier still has to reason correctly. Infrastructure failures remain
+`unavailable`. Historical `unrefuted` verdicts retain their original meaning.
+
+Astra defaults to `high` effort. Set `gating.verificationReasoningEffort` to `low`,
+`medium`, `high`, `xhigh`, or `max` for an OpenAI verifier. The setting is included
+in the report header and retained verification plan. Other provider overrides
+retain their provider effort defaults and reject this OpenAI-only setting.
+
+The top-level `reasoningEffort` applies only to OpenRouter reviewers. Direct
+Sol and Gemini reviewers use their provider defaults (currently `medium`).
+Fable 5.1 reviews explicitly use `high`, streaming, and a 65,536-token output
+ceiling so thinking and findings share adequate headroom. This follows
+[Anthropic's recommended starting effort](https://platform.claude.com/docs/en/build-with-claude/effort)
+while preserving RCL's whole-call timeout and rejection of incomplete output.
+OpenRouter reviewers default to `low`, a supported level for the default Kimi K3;
+explicit `reasoningEffort` overrides are preserved. Kimi K3 advertises `low`,
+`high`, and `max`, so avoid overriding it to `medium`. Effort labels are
+provider-specific and do not imply equal compute or quality across models.
+
 Verifier calls default to the remaining whole-pass budget. Set the optional
 `gating.verificationTimeout` in milliseconds to impose a shorter per-call limit;
 every call is still capped by the remaining `verificationPassTimeout` deadline.

package/dist/config/defaults.d.ts

@@ -1,5 +1,5 @@
 /**
- * Core (blocking) council — every round waits for these and only these.
+ * Primary council — general reviewers; specialists also use secondary models.
  * Direct-API models only: the RCL-21 audit (922 rounds, 15,268 calls) found
  * the OpenRouter wing at p50 7–9.5 min per call with 19–39% dead calls,
  * last-finisher in 97.6% of rounds; the audited direct trio answered in
@@ -7,7 +7,7 @@
  * topology drops the median round from 14.4 to 2.0 min while 91% of
  * multi-model findings still surface.
  */
-export declare const DEFAULT_MODELS: readonly ["anthropic/claude-fable-5-1", "openai/gpt-6-sol", "google/gemini-3.8-flash"];
+export declare const DEFAULT_MODELS: readonly ["anthropic/claude-fable-5-1", "openai/gpt-6-sol"];
 /**
  * Async bonus reviewers — fired with the round but never awaited; whatever
  * has arrived by the NEXT round's dedup is merged then, marked async in the
@@ -15,14 +15,8 @@ export declare const DEFAULT_MODELS: readonly ["anthropic/claude-fable-5-1", "op
  * corroboration rate (62%) but is ~6× slower than the core trio.
  */
 export declare const DEFAULT_ASYNC_MODELS: readonly ["openrouter/moonshotai/kimi-k3"];
-/**
- * Secondary models — specialized round-robin only, no general role.
- * Empty by default since RCL-25: qwen3.8-max, deepseek-v4-flash and grok-4.5
- * were removed after the audit (24–39% dead calls, worst finding-cost in the
- * council). Before any slow model earns a seat back, try it via its direct
- * provider API instead of OpenRouter and re-measure.
- */
-export declare const DEFAULT_SECONDARY_MODELS: readonly [];
+/** Gemini contributes specialist reviews without adding a general-review seat. */
+export declare const DEFAULT_SECONDARY_MODELS: readonly ["google/gemini-3.8-flash"];
 export declare const DEFAULT_THRESHOLDS: {
     readonly minConsensusScore: 0.4;
     readonly minConfidence: 0.2;
@@ -64,11 +58,12 @@ export declare const DEFAULT_MAX_RETRIES = 3;
 /**
  * Reasoning budget for OpenRouter-hosted models. Unbounded, they spend the
  * whole completion budget (and many minutes) thinking before emitting any
- * findings; 'medium' is calibrated against this repo's own diffs, where it
- * took the council from 10/17 to 17/17 completed reviews.
+ * findings. Kimi K3, the default async model, supports low/high/max, not
+ * medium. Use the supported low level while retaining the output/time caps;
+ * explicit configuration can still select another effort for other models.
  */
-export declare const DEFAULT_REASONING_EFFORT = "medium";
-export declare const DEFAULT_CONCURRENCY = 6;
+export declare const DEFAULT_REASONING_EFFORT = "low";
+export declare const DEFAULT_CONCURRENCY = 9;
 export declare const DEFAULT_SEVERITY_ORDER: readonly ["critical", "important", "minor", "nitpick"];
 export declare const CONFIDENCE_THRESHOLDS: {
     readonly veryHigh: 0.8;

package/dist/config/defaults.js

@@ -1,5 +1,5 @@
 /**
- * Core (blocking) council — every round waits for these and only these.
+ * Primary council — general reviewers; specialists also use secondary models.
  * Direct-API models only: the RCL-21 audit (922 rounds, 15,268 calls) found
  * the OpenRouter wing at p50 7–9.5 min per call with 19–39% dead calls,
  * last-finisher in 97.6% of rounds; the audited direct trio answered in
@@ -10,7 +10,6 @@
 export const DEFAULT_MODELS = [
     'anthropic/claude-fable-5-1',
     'openai/gpt-6-sol',
-    'google/gemini-3.8-flash',
 ];
 /**
  * Async bonus reviewers — fired with the round but never awaited; whatever
@@ -19,14 +18,8 @@ export const DEFAULT_MODELS = [
  * corroboration rate (62%) but is ~6× slower than the core trio.
  */
 export const DEFAULT_ASYNC_MODELS = ['openrouter/moonshotai/kimi-k3'];
-/**
- * Secondary models — specialized round-robin only, no general role.
- * Empty by default since RCL-25: qwen3.8-max, deepseek-v4-flash and grok-4.5
- * were removed after the audit (24–39% dead calls, worst finding-cost in the
- * council). Before any slow model earns a seat back, try it via its direct
- * provider API instead of OpenRouter and re-measure.
- */
-export const DEFAULT_SECONDARY_MODELS = [];
+/** Gemini contributes specialist reviews without adding a general-review seat. */
+export const DEFAULT_SECONDARY_MODELS = ['google/gemini-3.8-flash'];
 export const DEFAULT_THRESHOLDS = {
     minConsensusScore: 0.4,
     minConfidence: 0.2,
@@ -68,11 +61,12 @@ export const DEFAULT_MAX_RETRIES = 3;
 /**
  * Reasoning budget for OpenRouter-hosted models. Unbounded, they spend the
  * whole completion budget (and many minutes) thinking before emitting any
- * findings; 'medium' is calibrated against this repo's own diffs, where it
- * took the council from 10/17 to 17/17 completed reviews.
+ * findings. Kimi K3, the default async model, supports low/high/max, not
+ * medium. Use the supported low level while retaining the output/time caps;
+ * explicit configuration can still select another effort for other models.
  */
-export const DEFAULT_REASONING_EFFORT = 'medium';
-export const DEFAULT_CONCURRENCY = 6;
+export const DEFAULT_REASONING_EFFORT = 'low';
+export const DEFAULT_CONCURRENCY = 9;
 export const DEFAULT_SEVERITY_ORDER = [
     'critical',
     'important',

package/dist/config/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,4BAA4B;IAC5B,kBAAkB;IAClB,yBAAyB;CACjB,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,+BAA+B,CAAU,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAW,CAAC;AAEpD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,iBAAiB,EAAE,GAAG;IACtB,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,GAAG;CACb,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,CAAC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU;IACV,WAAW;IACX,OAAO;IACP,SAAS;CACD,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,GAAG;CACA,CAAC"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,4BAA4B;IAC5B,kBAAkB;CACV,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,+BAA+B,CAAU,CAAC;AAE/E,kFAAkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,yBAAyB,CAAU,CAAC;AAE7E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,iBAAiB,EAAE,GAAG;IACtB,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,GAAG;CACb,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,CAAC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAC9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU;IACV,WAAW;IACX,OAAO;IACP,SAAS;CACD,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,GAAG;CACA,CAAC"}

package/dist/config/schema.d.ts

@@ -44,9 +44,17 @@ export declare const ReasoningEffortSchema: z.ZodEnum<{
     medium: "medium";
     high: "high";
 }>;
+export declare const VerificationReasoningEffortSchema: z.ZodEnum<{
+    low: "low";
+    medium: "medium";
+    high: "high";
+    xhigh: "xhigh";
+    max: "max";
+}>;
+export type VerificationReasoningEffort = z.infer<typeof VerificationReasoningEffortSchema>;
 /**
  * Convergence gating (RCL-23). `verified-consensus` (default): a finding
- * gates only when multi-model, critical, or unrefuted by the verification
+ * gates only when multi-model, critical, or confirmed with evidence by the verification
  * pass. `all-findings` restores the legacy behavior where every
  * critical/important finding gates.
  */
@@ -57,6 +65,13 @@ export declare const GatingSchema: z.ZodObject<{
     }>>;
     minModels: z.ZodOptional<z.ZodNumber>;
     verificationModel: z.ZodOptional<z.ZodString>;
+    verificationReasoningEffort: z.ZodOptional<z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+        xhigh: "xhigh";
+        max: "max";
+    }>>;
     verificationTimeout: z.ZodOptional<z.ZodNumber>;
     verificationPassTimeout: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
@@ -105,6 +120,13 @@ export declare const ConfigSchema: z.ZodObject<{
         }>>;
         minModels: z.ZodOptional<z.ZodNumber>;
         verificationModel: z.ZodOptional<z.ZodString>;
+        verificationReasoningEffort: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+            xhigh: "xhigh";
+            max: "max";
+        }>>;
         verificationTimeout: z.ZodOptional<z.ZodNumber>;
         verificationPassTimeout: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;

package/dist/config/schema.js

@@ -41,9 +41,10 @@ export const OutputSchema = z.object({
     belowThresholdAppendix: z.boolean().optional(),
 });
 export const ReasoningEffortSchema = z.enum(['low', 'medium', 'high']);
+export const VerificationReasoningEffortSchema = z.enum(['low', 'medium', 'high', 'xhigh', 'max']);
 /**
  * Convergence gating (RCL-23). `verified-consensus` (default): a finding
- * gates only when multi-model, critical, or unrefuted by the verification
+ * gates only when multi-model, critical, or confirmed with evidence by the verification
  * pass. `all-findings` restores the legacy behavior where every
  * critical/important finding gates.
  */
@@ -53,6 +54,8 @@ export const GatingSchema = z.object({
     minModels: z.number().int().min(2).optional(),
     /** Direct-API model for the refutation pass (openrouter/ is rejected). */
     verificationModel: z.string().optional(),
+    /** OpenAI verifier effort, independent of reviewer reasoning effort. */
+    verificationReasoningEffort: VerificationReasoningEffortSchema.optional(),
     /** Per-call timeout (ms) for the verification pass. */
     verificationTimeout: TimerDelaySchema.optional(),
     /** Whole-pass timeout (ms) across every verification batch. */

package/dist/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+CAA+C;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEhD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,OAAO;IACP,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/D,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,0EAA0E;IAC1E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,uDAAuD;IACvD,mBAAmB,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAChD,+DAA+D;IAC/D,uBAAuB,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,gFAAgF;IAChF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,6EAA6E;IAC7E,eAAe,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+CAA+C;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEhD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,OAAO;IACP,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAGnG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/D,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,0EAA0E;IAC1E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,wEAAwE;IACxE,2BAA2B,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IACzE,uDAAuD;IACvD,mBAAmB,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAChD,+DAA+D;IAC/D,uBAAuB,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,gFAAgF;IAChF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,6EAA6E;IAC7E,eAAe,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC"}

package/dist/consensus/gating.d.ts

@@ -1,3 +1,4 @@
+import { type VerificationReasoningEffort } from '../config/schema.js';
 import type { ConsensusFinding } from './types.js';
 import type { ModelAnswer } from '../dispatch/adapter.js';
 import type { FileChange } from '../resolver/types.js';
@@ -9,7 +10,7 @@ import type { FileChange } from '../resolver/types.js';
  * zero). A finding now gates only if it is:
  *   (a) supported by ≥ minModels distinct models after dedup  → 'consensus'
  *   (b) critical severity                                     → 'critical'
- *   (c) single-model but unrefuted by a cheap verification
+ *   (c) single-model and confirmed with source evidence by a verification
  *       pass against the actual change                        → 'verified'
  * Everything else still lands in the report — it just stops blocking
  * convergence ('none'). This is the two-stage recall→precision split
@@ -30,14 +31,16 @@ export interface GatingVerification {
     model?: string;
     /**
      * 'refuted': the verifier showed the finding does not hold → not gating.
-     * 'unrefuted': the verifier could not refute it → gates.
+     * 'confirmed': source-supported failure mechanism → gates.
+     * 'insufficient_evidence': insufficient source evidence → not promoted.
+     * 'unrefuted': historical version-one verdict, preserved on replay only.
      * 'unavailable': the verification pass failed, did not run, or did not
      * cover this finding — it is left at the tier it earned without
      * verification ('none'): a single-model claim nobody checked is reported,
      * not promoted to blocking (RCL-62). Read `note` for the cause; a
      * persistently broken verifier is a fixable infrastructure problem.
      */
-    verdict: 'refuted' | 'unrefuted' | 'unavailable';
+    verdict: 'confirmed' | 'refuted' | 'insufficient_evidence' | 'unrefuted' | 'unavailable';
     note?: string;
 }
 export interface GatingInfo {
@@ -48,6 +51,7 @@ export type AskFn = (model: string, systemPrompt: string, userPrompt: string, op
     timeoutMs: number;
     maxRetries: number;
     signal?: AbortSignal;
+    reasoningEffort?: VerificationReasoningEffort;
 }) => Promise<ModelAnswer>;
 export interface GatingOptions {
     /** Distinct supporting models that make a finding 'consensus'. */
@@ -58,6 +62,7 @@ export interface GatingOptions {
      * and do not gate, and no content leaves the configured providers.
      */
     verificationModel: string | undefined;
+    verificationReasoningEffort?: VerificationReasoningEffort;
     verificationTimeoutMs: number;
     /** Whole verification-lane budget across all queued batches. */
     verificationPassTimeoutMs?: number;
@@ -86,7 +91,10 @@ export interface VerificationStats {
     model: string;
     candidates: number;
     refuted: number;
+    /** Historical count; new verification uses confirmed/insufficientEvidence. */
     unrefuted: number;
+    confirmed?: number;
+    insufficientEvidence?: number;
     unavailable: number;
     durationMs: number;
 }
@@ -103,6 +111,7 @@ export interface GatingConfigInput {
     mode?: 'verified-consensus' | 'all-findings';
     minModels?: number;
     verificationModel?: string;
+    verificationReasoningEffort?: VerificationReasoningEffort;
     verificationTimeout?: number;
     verificationPassTimeout?: number;
 }
@@ -110,13 +119,15 @@ export interface ResolvedGatingConfig {
     mode: 'verified-consensus' | 'all-findings';
     minModels: number;
     verificationModel: string | undefined;
+    verificationReasoningEffort?: VerificationReasoningEffort;
     verificationTimeoutMs: number;
     verificationPassTimeoutMs: number;
 }
 export declare const DEFAULT_GATING_CONFIG: {
     readonly mode: "verified-consensus";
     readonly minModels: 2;
-    readonly verificationModel: "google/gemini-3.8-flash";
+    readonly verificationModel: "openai/gpt-6-astra";
+    readonly verificationReasoningEffort: "high";
     readonly verificationPassTimeoutMs: 180000;
 };
 /**
@@ -143,14 +154,17 @@ export interface GatingBatch {
     findingIndices: number[];
     systemPrompt: string;
     userPrompt: string;
+    /** Supplied source excerpts, retained for citation validation in version two. */
+    sourcePatches?: Record<string, string>;
 }
 /** Private deterministic work plan, not authenticated evidence or launch authority. */
 export interface GatingPlan {
-    version: 1;
+    version: 1 | 2;
     findings: ConsensusFinding[];
     initialGating: Array<GatingInfo | null>;
     candidateIndices: number[];
     model: string;
+    verificationReasoningEffort?: VerificationReasoningEffort;
     verificationTimeoutMs: number;
     verificationPassTimeoutMs: number;
     batches: GatingBatch[];
@@ -164,7 +178,7 @@ export type GatingBatchOutcome = {
     kind: 'failure';
     reason: string;
 };
-type GatingPlanOptions = Pick<GatingOptions, 'minModels' | 'verificationModel' | 'verificationTimeoutMs' | 'verificationPassTimeoutMs' | 'diffFiles' | 'modelWeights'>;
+type GatingPlanOptions = Pick<GatingOptions, 'minModels' | 'verificationModel' | 'verificationTimeoutMs' | 'verificationPassTimeoutMs' | 'verificationReasoningEffort' | 'diffFiles' | 'modelWeights'>;
 /** Derive every private verifier request before dispatch, without clocks, adapters or caller aliases. */
 export declare function planGating(input: ConsensusFinding[], options: GatingPlanOptions): GatingPlan;
 /**