sentinelayer-cli 0.46.5 → 0.48.0

package/src/judge/verdict.js

@@ -0,0 +1,305 @@
+// judge-verdict v1: the document a judging model posts back to a coder.
+//
+// One schema, enforced the same way by this CLI and by the SentinelLayer API (the shared
+// agreement cases live in tests/fixtures/judge-verdict-cases.json). The judge is never named
+// in the document: the server records who judged from the credential or the stored post.
+
+export const JUDGE_VERDICT_KIND = "judge-verdict";
+export const JUDGE_VERDICT_VERSION = 1;
+export const JUDGE_VERDICT_MAX_BYTES = 32768;
+export const JUDGE_VERDICT_DEFAULT_MAX_ROUNDS = 3;
+export const JUDGE_VERDICT_SEVERITIES = Object.freeze(["P0", "P1", "P2", "P3"]);
+export const JUDGE_VERDICT_TARGET_TYPES = Object.freeze(["pr", "ticket", "message"]);
+
+const TOP_KEYS = new Set([
+  "kind", "version", "verdict", "round", "maxRounds", "target", "coder", "summary", "comments",
+  "escalate", "doNotTrain",
+]);
+const TARGET_KEYS = new Set(["type", "ref", "sha"]);
+const COMMENT_KEYS = new Set(["file", "line", "severity", "text", "fix"]);
+const MAX_ROUNDS_LIMIT = 10;
+const MAX_COMMENTS = 50;
+const MAX_LINE = 10_000_000;
+const PR_REF_RE = /^[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}#[1-9][0-9]{0,9}$/;
+const MESSAGE_REF_RE = /^[1-9][0-9]{0,18}$/;
+const SHA_RE = /^[0-9a-fA-F]{7,64}$/;
+const AGENT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+// Control characters are U+0000..U+001F and U+007F. Multi-line text may keep \t \n \r.
+const ANY_CONTROL_RE = /[\u0000-\u001f\u007f]/;
+const TEXT_CONTROL_RE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
+const ASCII_EDGE_WHITESPACE_RE = /^[ \t\n\r\f\v]+|[ \t\n\r\f\v]+$/g;
+// The fenced-block scanner works line by line, so its cost is linear in the message whatever the
+// message holds (an unclosed fence included). Each pattern is tested on one line, never the text.
+const FENCE_OPEN_RE = /^```(?:judge-verdict|json)[ \t]*$/;
+const FENCE_CLOSE_RE = /^```[ \t]*$/;
+export const JUDGE_VERDICT_BLOCK_MAX_BYTES = 64 * 1024;
+
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function trimAscii(value) {
+  return value.replace(ASCII_EDGE_WHITESPACE_RE, "");
+}
+
+function codePoints(value) {
+  return [...value].length;
+}
+
+function isWholeNumber(value) {
+  return typeof value === "number" && Number.isInteger(value);
+}
+
+/**
+ * Validate a judge-verdict document.
+ *
+ * Returns `{ ok: true, verdict }` with the normalized document (strings trimmed, defaults
+ * filled, sha lowercased), or `{ ok: false, errors }` where each error is `{ path, message }`.
+ */
+export function validateJudgeVerdict(document) {
+  const errors = [];
+  const fail = (path, message) => errors.push({ path, message });
+
+  if (!isPlainObject(document)) {
+    return { ok: false, errors: [{ path: "", message: "must be a JSON object" }] };
+  }
+  let serialized;
+  try {
+    serialized = JSON.stringify(document);
+  } catch {
+    return { ok: false, errors: [{ path: "", message: "must be serializable JSON" }] };
+  }
+  if (Buffer.byteLength(serialized, "utf8") > JUDGE_VERDICT_MAX_BYTES) {
+    return { ok: false, errors: [{ path: "", message: `must be at most ${JUDGE_VERDICT_MAX_BYTES} bytes as compact JSON` }] };
+  }
+  for (const key of Object.keys(document)) {
+    if (!TOP_KEYS.has(key)) fail(key, "is not a judge-verdict field (the judge is never named in the document)");
+  }
+
+  const text = (path, value, { min, max, multiline = false, required = true }) => {
+    if (value === undefined && !required) return undefined;
+    if (typeof value !== "string") {
+      fail(path, "must be a string");
+      return undefined;
+    }
+    if ((multiline ? TEXT_CONTROL_RE : ANY_CONTROL_RE).test(value)) {
+      fail(path, multiline ? "must not contain control characters other than tab and newline" : "must not contain control characters");
+      return undefined;
+    }
+    const trimmed = trimAscii(value);
+    const length = codePoints(trimmed);
+    if (length < min || length > max) {
+      fail(path, min > 0 ? `must be ${min}..${max} characters` : `must be at most ${max} characters`);
+      return undefined;
+    }
+    return trimmed;
+  };
+  const integer = (path, value, min, max) => {
+    if (!isWholeNumber(value) || value < min || value > max) {
+      fail(path, `must be an integer ${min}..${max}`);
+      return undefined;
+    }
+    return value;
+  };
+  const flag = (path, value) => {
+    if (value === undefined) return false;
+    if (typeof value !== "boolean") {
+      fail(path, "must be true or false");
+      return false;
+    }
+    return value;
+  };
+
+  if (document.kind !== JUDGE_VERDICT_KIND) fail("kind", `must be "${JUDGE_VERDICT_KIND}"`);
+  if (document.version !== JUDGE_VERDICT_VERSION) fail("version", `must be ${JUDGE_VERDICT_VERSION}`);
+  const verdict = document.verdict;
+  if (verdict !== "ACCEPT" && verdict !== "CHANGES") fail("verdict", 'must be "ACCEPT" or "CHANGES"');
+  const round = integer("round", document.round, 1, MAX_ROUNDS_LIMIT);
+  const maxRounds = document.maxRounds === undefined
+    ? JUDGE_VERDICT_DEFAULT_MAX_ROUNDS
+    : integer("maxRounds", document.maxRounds, 1, MAX_ROUNDS_LIMIT);
+  if (round !== undefined && maxRounds !== undefined && round > maxRounds) {
+    fail("round", "must not exceed maxRounds");
+  }
+
+  let target;
+  if (!isPlainObject(document.target)) {
+    fail("target", "must be an object with type and ref");
+  } else {
+    for (const key of Object.keys(document.target)) {
+      if (!TARGET_KEYS.has(key)) fail(`target.${key}`, "is not a target field");
+    }
+    const type = document.target.type;
+    if (!JUDGE_VERDICT_TARGET_TYPES.includes(type)) fail("target.type", 'must be "pr", "ticket" or "message"');
+    const ref = text("target.ref", document.target.ref, { min: 1, max: 200 });
+    if (ref !== undefined && type === "pr" && !PR_REF_RE.test(ref)) fail("target.ref", "must look like owner/repo#123");
+    if (ref !== undefined && type === "message" && !MESSAGE_REF_RE.test(ref)) {
+      fail("target.ref", "must be the message's sequence id");
+    }
+    let sha;
+    if (document.target.sha !== undefined) {
+      sha = text("target.sha", document.target.sha, { min: 1, max: 64 });
+      if (sha !== undefined && !SHA_RE.test(sha)) {
+        fail("target.sha", "must be 7..64 hex characters");
+        sha = undefined;
+      }
+    } else if (type === "pr") {
+      fail("target.sha", "is required for a pr target (the exact head you judged)");
+    }
+    target = { type, ref, ...(sha !== undefined ? { sha: sha.toLowerCase() } : {}) };
+  }
+
+  const coder = text("coder", document.coder, { min: 1, max: 64 });
+  if (coder !== undefined && (!AGENT_ID_RE.test(coder) || coder.toLowerCase().startsWith("human-"))) {
+    fail("coder", "must be the coding agent's id");
+  }
+  const summary = text("summary", document.summary, { min: 1, max: 2000, multiline: true });
+
+  const comments = [];
+  if (!Array.isArray(document.comments)) {
+    fail("comments", "must be an array");
+  } else if (document.comments.length > MAX_COMMENTS) {
+    fail("comments", `must have at most ${MAX_COMMENTS} entries`);
+  } else {
+    document.comments.forEach((comment, index) => {
+      const at = `comments[${index}]`;
+      if (!isPlainObject(comment)) {
+        fail(at, "must be an object with file, line, severity and text");
+        return;
+      }
+      for (const key of Object.keys(comment)) {
+        if (!COMMENT_KEYS.has(key)) fail(`${at}.${key}`, "is not a comment field");
+      }
+      const file = text(`${at}.file`, comment.file, { min: 1, max: 300 });
+      const line = integer(`${at}.line`, comment.line, 0, MAX_LINE);
+      const severity = comment.severity;
+      if (!JUDGE_VERDICT_SEVERITIES.includes(severity)) fail(`${at}.severity`, "must be P0, P1, P2 or P3");
+      const body = text(`${at}.text`, comment.text, { min: 1, max: 2000, multiline: true });
+      const fix = text(`${at}.fix`, comment.fix, { min: 0, max: 500, multiline: true, required: false });
+      comments.push({ file, line, severity, text: body, ...(fix !== undefined ? { fix } : {}) });
+    });
+  }
+
+  const escalate = flag("escalate", document.escalate);
+  const doNotTrain = flag("doNotTrain", document.doNotTrain);
+  if (verdict === "CHANGES" && Array.isArray(document.comments) && document.comments.length === 0) {
+    fail("comments", "CHANGES needs at least one comment");
+  }
+  if (verdict === "ACCEPT" && comments.some((comment) => comment.severity === "P0" || comment.severity === "P1")) {
+    fail("verdict", "ACCEPT cannot carry a P0 or P1 comment");
+  }
+  if (escalate && verdict !== "CHANGES") fail("escalate", "only a CHANGES verdict escalates");
+  if (verdict === "CHANGES" && round !== undefined && maxRounds !== undefined && round === maxRounds && !escalate) {
+    fail("escalate", "the last round's CHANGES verdict must escalate to the human");
+  }
+
+  if (errors.length) return { ok: false, errors };
+  return {
+    ok: true,
+    verdict: {
+      kind: JUDGE_VERDICT_KIND,
+      version: JUDGE_VERDICT_VERSION,
+      verdict,
+      round,
+      maxRounds,
+      target,
+      coder,
+      summary,
+      comments,
+      escalate,
+      doNotTrain,
+    },
+  };
+}
+
+export function formatJudgeVerdictErrors(errors = []) {
+  return errors.map((error) => (error.path ? `${error.path} ${error.message}` : error.message)).join("; ");
+}
+
+function targetLabel(target) {
+  if (target.type === "pr") return `${target.ref} @ ${target.sha.slice(0, 12)}`;
+  if (target.type === "message") return `message #${target.ref}${target.sha ? ` @ ${target.sha.slice(0, 12)}` : ""}`;
+  return `ticket ${target.ref}${target.sha ? ` @ ${target.sha.slice(0, 12)}` : ""}`;
+}
+
+export function formatJudgeVerdictBlock(verdict) {
+  return ["```judge-verdict", JSON.stringify(verdict), "```"].join("\n");
+}
+
+/**
+ * Render a validated verdict as the room message the coder receives: the mention that wakes
+ * the coder, the numbered comments in plain words, and the machine-readable block.
+ */
+export function renderJudgeVerdictMessage(verdict, { escalateTo = [] } = {}) {
+  const mentions = [`@${verdict.coder}`];
+  if (verdict.escalate) {
+    for (const handle of escalateTo) mentions.push(`@${handle}`);
+  }
+  const lines = [
+    `${mentions.join(" ")} Judge verdict: ${verdict.verdict} (round ${verdict.round} of ${verdict.maxRounds}) on ${targetLabel(verdict.target)}`,
+    verdict.summary,
+  ];
+  if (verdict.comments.length) {
+    lines.push("");
+    verdict.comments.forEach((comment, index) => {
+      const where = comment.line > 0 ? `${comment.file}:${comment.line}` : comment.file;
+      lines.push(`${index + 1}. [${comment.severity}] ${where} - ${comment.text}`);
+      if (comment.fix) lines.push(`   Fix: ${comment.fix}`);
+    });
+  }
+  lines.push("");
+  if (verdict.escalate) {
+    lines.push(`Round limit reached. Stopping the loop here; a human decides what happens next.`);
+  } else if (verdict.verdict === "CHANGES") {
+    lines.push(`Fix each numbered comment, then reply with the new head and what changed per number. I will re-check every one.`);
+  } else {
+    lines.push(`Accepted. No further rounds.`);
+  }
+  lines.push("", formatJudgeVerdictBlock(verdict));
+  return lines.join("\n");
+}
+
+/**
+ * Find the judge-verdict block in a room message. Returns `{ status, document }` where status
+ * is "none", "one" or "ambiguous" (more than one block: nothing is taken). The document is
+ * returned unvalidated; pass it to validateJudgeVerdict.
+ *
+ * A block opens at a line that is exactly ```judge-verdict or ```json (trailing spaces or tabs
+ * allowed) and closes at the next line that is exactly ```. An opener with no closing line ends
+ * the scan. A block body over JUDGE_VERDICT_BLOCK_MAX_BYTES (UTF-8) is skipped unparsed, and the
+ * scan stops at the second candidate. The API runs the same algorithm against the same vectors
+ * (tests/fixtures/judge-verdict-block-cases.json).
+ */
+export function extractJudgeVerdictBlock(message) {
+  const text = typeof message === "string" ? message : "";
+  // Every candidate carries "kind": "judge-verdict", so a message without the word has none.
+  if (!text.includes(JUDGE_VERDICT_KIND)) return { status: "none", document: null };
+  const lines = text.split("\n");
+  const line = (index) => (lines[index].endsWith("\r") ? lines[index].slice(0, -1) : lines[index]);
+  let document = null;
+  for (let index = 0; index < lines.length; index += 1) {
+    if (!FENCE_OPEN_RE.test(line(index))) continue;
+    const body = [];
+    let bytes = 0;
+    let close = index + 1;
+    for (; close < lines.length; close += 1) {
+      const current = line(close);
+      if (FENCE_CLOSE_RE.test(current)) break;
+      bytes += Buffer.byteLength(current, "utf8") + (close > index + 1 ? 1 : 0);
+      if (bytes <= JUDGE_VERDICT_BLOCK_MAX_BYTES) body.push(current);
+    }
+    if (close >= lines.length) break;
+    index = close;
+    if (bytes > JUDGE_VERDICT_BLOCK_MAX_BYTES) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(body.join("\n"));
+    } catch {
+      continue;
+    }
+    if (!isPlainObject(parsed) || parsed.kind !== JUDGE_VERDICT_KIND) continue;
+    if (document) return { status: "ambiguous", document: null };
+    document = parsed;
+  }
+  return document ? { status: "one", document } : { status: "none", document: null };
+}

package/src/legacy-cli.js

@@ -23,12 +23,12 @@ import {
   resolveTrustContext,
   userCredential,
 } from "./auth/credential-destinations.js";
-import { resolveOutputRoot } from "./config/service.js";
+import { resolveOutputContext } from "./config/service.js";
 import { normalizeAgentEvent } from "./events/schema.js";
 import { collectCodebaseIngest, formatIngestSummary } from "./ingest/engine.js";
 import { getExpressTemplate, getPackageJsonTemplate, buildReadmeContent } from "./scaffold/templates.js";
 import { generateScaffold } from "./scaffold/generator.js";
-import { isGhRepoSlug } from "./net/gh-api-path.js";
+import { ghRepoApiPath, isGhRepoSlug } from "./net/gh-api-path.js";
 import {
   getCoordinationEtiquetteItems,
   renderCoordinationNumberedList,
@@ -42,6 +42,7 @@ let DEFAULT_GITHUB_CLONE_BASE_URL =
 const DEFAULT_AUTH_TIMEOUT_MS = 10 * 60 * 1000;
 const DEFAULT_REQUEST_TIMEOUT_MS = 20_000;
 const PACKAGE_JSON_PATH = new URL("../package.json", import.meta.url);
+const GH_REPOS_ENDPOINT = "/user/repos?per_page=100&sort=updated&affiliation=owner,collaborator,organization_member";
 
 function refreshRuntimeDefaults() {
   DEFAULT_API_URL = process.env.SENTINELAYER_API_URL || "https://api.sentinelayer.com";
@@ -232,7 +233,8 @@ function printUsage() {
   console.log("  sl session start --json            Create an agent coordination session");
   console.log("  sl session start --template code-review  Start from quick-start preset + launch plan");
   console.log("  sl session templates --json        List available session quick-start templates");
-  console.log("  sl session join <id> --name <n>    Join a session as an agent");
+  console.log("  sl session join <id> --agent <agent> --goal \"<goal>\"  Request owner-approved agent admission");
+  console.log("  sl session access --help           Request and govern scoped agent access");
   console.log("  sl session say <id> \"msg\" --json  Append a message event to session stream");
   console.log("  sl session lock <id> <file> --agent <agent> --intent <text>  Claim an API-backed file lease outside chat");
   console.log("  sl session guard-install <id> --agent <agent>  Install terminal/editor lease preflights");
@@ -248,6 +250,7 @@ function printUsage() {
   console.log("  sl session comment <id> <seq> \"msg\"  Alias for threaded reply");
   console.log("  sl session read <id> --remote --agent <id>  Read events and advance delivery cursor");
   console.log("  sl session edit <id> <seq|reply-uuid> \"msg\"  Edit your message without losing history");
+  console.log("  sl session observe <id> \"summary\" --agent <agent>  Record product/process feedback");
   console.log("  sl session pins <id> --json         List pinned messages with content (readable by agents)");
   console.log("  sl session lock <id> <files...> --intent <why>  Claim file locks (fail-closed, TTL auto-release)");
   console.log("  sl session unlock <id> <files...>   Release file locks you hold");
@@ -256,7 +259,10 @@ function printUsage() {
   console.log("  sl session recap now <id> --remote --json  Summarize current owners, locks, and work");
   console.log("  sl session daemon --session <id>    Run Senti recaps/checkpoints for long rooms");
   console.log("  sl session read <id> --tail 20      Read local session stream events");
-  console.log("  sl session status <id> --json      Show session health, agents, runs, leases");
+  console.log("  sl session status <id> --json      Show workspace status and file-lock health");
+  console.log("  sl session ticket --help           List, claim, renew, release, submit tickets and read events");
+  console.log("  sl session ticket list <id> --available --agent <agent>  Find currently claimable tickets");
+  console.log("  sl session checkpoint --help       List, show, create and generate durable checkpoints");
   console.log("  sl session leave <id>              Leave a session");
   console.log("  sl session list --json             List active sessions");
   console.log("  sl session setup-guides <id> --json  Upsert AGENTS.md/CLAUDE.md coordination section");
@@ -321,7 +327,7 @@ function printUsage() {
   console.log("  sl mcp registry init-session --force && sl mcp server run --path .");
   console.log("  sl mcp registry init-cli --json");
   console.log("");
-  console.log("Docs: https://github.com/mrrCarter/create-sentinelayer#readme");
+  console.log("Docs: https://github.com/Sentinelayer-AIdenID/create-sentinelayer#readme");
 }
 
 function normalizeInterviewInput(
@@ -597,7 +603,7 @@ async function issueBootstrapToken({ apiUrl, credential }) {
 }
 
 // The init flow's credential steps, for tests.
-export const __legacyCredentialFlowForTests = Object.freeze({ pollCliSession, generateArtifacts, issueBootstrapToken, requestJson });
+export const __initCallsForTests = Object.freeze({ pollCliSession, generateArtifacts, issueBootstrapToken, requestJson });
 
 function detectRepoSlug(cwd) {
   const gitRemote = spawnSync("git", ["config", "--get", "remote.origin.url"], {
@@ -675,14 +681,13 @@ function ensureGhAuthSession(ghCommand) {
 }
 
 function listReposViaGh(ghCommand) {
-  const endpoint = "/user/repos?per_page=100&sort=updated&affiliation=owner,collaborator,organization_member";
   const apiResult = spawnSync(
     ghCommand,
-    ["api", "--paginate", "--slurp", endpoint],
+    ["api", "--paginate", "--slurp", GH_REPOS_ENDPOINT],
     { encoding: "utf-8" }
   );
   if (apiResult.status !== 0) {
-    const fallback = spawnSync(ghCommand, ["api", endpoint], { encoding: "utf-8" });
+    const fallback = spawnSync(ghCommand, ["api", GH_REPOS_ENDPOINT], { encoding: "utf-8" });
     if (fallback.status !== 0) {
       throw new Error(
         String(
@@ -1059,14 +1064,14 @@ async function runCredentialScan(targetPath) {
 }
 
 async function writeLocalCommandReport(targetPath, prefix, body, { outputDir = "" } = {}) {
-  const outputRoot = await resolveOutputRoot({
+  const { outputRoot, outputFs } = await resolveOutputContext({
     cwd: targetPath,
     outputDirOverride: outputDir,
   });
   const reportDir = path.join(outputRoot, "reports");
-  await ensureDirectory(reportDir);
+  await outputFs.mkdir(reportDir, { recursive: true });
   const reportPath = path.join(reportDir, `${prefix}-${formatTimestampForFile()}.md`);
-  await writeTextFile(reportPath, `${body}\n`);
+  await outputFs.writeFile(reportPath, `${body}\n`, "utf-8");
   return reportPath;
 }
 
@@ -1348,7 +1353,12 @@ async function runLocalOmarGateCommand(args) {
   const outputDirArg = getCommandOptionValue(args, "--output-dir") || "";
   const aiEnabled = !hasCommandOption(args, "--no-ai");
   const aiDryRun = hasCommandOption(args, "--ai-dry-run");
-  const maxCostUsd = parseFloat(getCommandOptionValue(args, "--max-cost") || "5.0") || 5.0;
+  const { normalizeSeverityClassifier, parseSeverityEvaluationMaxCost } = await import("./review/typesafe-severity.js");
+  const severityClassifier = normalizeSeverityClassifier(getCommandOptionValue(args, "--severity-classifier") || "off");
+  const maxCostFlag = getCommandOptionValue(args, "--max-cost");
+  const maxCostUsd = severityClassifier === "typesafe"
+    ? parseSeverityEvaluationMaxCost(maxCostFlag, 5)
+    : parseFloat(maxCostFlag || "5.0") || 5.0;
   const modelOverride = getCommandOptionValue(args, "--model") || "";
   const providerOverride = getCommandOptionValue(args, "--provider") || "";
   const notifySessionFlag = getCommandOptionValue(args, "--notify-session") || "";
@@ -1444,6 +1454,7 @@ async function runLocalOmarGateCommand(args) {
         provider: providerOverride || undefined,
         model: modelOverride || undefined,
         maxCostUsd,
+        ...(severityClassifier === "typesafe" ? { severityClassifier } : {}),
         dryRun: aiDryRun,
         outputDir: outputDirArg,
         deterministic: {
@@ -1479,6 +1490,7 @@ async function runLocalOmarGateCommand(args) {
         summary: aiOnlySummary,
         costUsd: orchestratorResult.totalCostUsd || 0,
         model: modelOverride || "multi-persona",
+        ...(severityClassifier === "typesafe" ? { severityClassification: orchestratorResult.severityClassification } : {}),
         provider: providerOverride || "sentinelayer",
         dryRun: aiDryRun,
         personas: (orchestratorResult.personas || []).map((p) => ({
@@ -1520,6 +1532,7 @@ async function runLocalOmarGateCommand(args) {
         model: modelOverride || undefined,
         sessionId: notifySession,
         maxCostUsd,
+        ...(severityClassifier === "typesafe" ? { severityClassifier } : {}),
         dryRun: aiDryRun,
         requireUsageLedger,
         sourceCommand: "omargate deep",
@@ -1543,17 +1556,26 @@ async function runLocalOmarGateCommand(args) {
   // via reconcileReviewFindings. Use its output directly to avoid double-counting.
   // Fallback path (legacy single ai-review): union of det + AI findings.
   const aiFindings = aiResult?.findings || [];
+  const aiCoverageFailed = aiEnabled && aiResult?.skipped === true;
+  const coverage = orchestratorResult?.coverage || (aiCoverageFailed ? { status: "incomplete" } : null);
+  const coverageFailureFindings = aiCoverageFailed ? [{
+    severity: "P1", file: "<omargate>", line: 1,
+    message: "Omar AI coverage incomplete: the requested AI review did not complete.",
+    category: "Omar AI Coverage", source: "orchestrator", sources: ["orchestrator"],
+    confidence: 1,
+    remediation: "Resolve the reported AI review failure and rerun the requested review. Partial coverage cannot satisfy a full AI review gate.",
+  }] : [];
   const reconciledFromOrchestrator = orchestratorResult?.findings;
   const allFindings = reconciledFromOrchestrator && reconciledFromOrchestrator.length >= 0
     ? reconciledFromOrchestrator
-    : [...detFindings, ...aiFindings];
+    : [...detFindings, ...aiFindings, ...coverageFailureFindings];
   const combinedSummary = orchestratorResult?.summary || {
     P0: detSummary.P0 + (aiResult?.summary?.P0 || 0),
-    P1: detSummary.P1 + (aiResult?.summary?.P1 || 0),
+    P1: detSummary.P1 + (aiResult?.summary?.P1 || 0) + coverageFailureFindings.length,
     P2: detSummary.P2 + (aiResult?.summary?.P2 || 0),
     P3: (detSummary.P3 || 0) + (aiResult?.summary?.P3 || 0),
     blocking: (detSummary.P0 + (aiResult?.summary?.P0 || 0)) > 0 ||
-              (detSummary.P1 + (aiResult?.summary?.P1 || 0)) > 0,
+              (detSummary.P1 + (aiResult?.summary?.P1 || 0) + coverageFailureFindings.length) > 0,
   };
   const combinedP0 = combinedSummary.P0 || 0;
   const combinedP1 = combinedSummary.P1 || 0;
@@ -1582,6 +1604,7 @@ async function runLocalOmarGateCommand(args) {
       roster: orchestratorResult.roster,
       basePersonas: orchestratorResult.basePersonas || [],
       personaRouting: orchestratorResult.personaRouting || null,
+      coverage,
       findings: (orchestratorResult.personas || []).flatMap((p) => []),
       aiFindings: aiFindings,
       personaCount: (orchestratorResult.personas || []).length,
@@ -1591,6 +1614,7 @@ async function runLocalOmarGateCommand(args) {
     artifactPaths.personas = await writeJsonArtifact("REVIEW_PERSONAS.json", {
       runId: orchestratorResult.runId,
       personas: orchestratorResult.personas || [],
+      coverage,
     });
     artifactPaths.reconciled = await writeJsonArtifact("REVIEW_RECONCILED.json", {
       runId: orchestratorResult.runId,
@@ -1599,6 +1623,7 @@ async function runLocalOmarGateCommand(args) {
       reconciliation: orchestratorResult.reconciliation,
       personaRouting: orchestratorResult.personaRouting || null,
       findingsBySource: orchestratorResult.findingsBySource,
+      coverage,
     });
   }
 
@@ -1616,6 +1641,7 @@ Summary:
 - Files scanned: ${scannedFiles}
 - Scope mode: ${scopeMode}
 - Persona routing: ${orchestratorResult?.personaRouting?.enabled ? `${orchestratorResult.personaRouting.effectivePersonas.length}/${orchestratorResult.personaRouting.basePersonas.length} personas for ${orchestratorResult.personaRouting.changedFileCount} changed files` : "full roster"}
+- AI coverage: ${coverage?.status || (aiEnabled ? "unknown" : "not requested")}
 - Deterministic findings: P0=${detSummary.P0} P1=${detSummary.P1} P2=${detSummary.P2} P3=${detSummary.P3 || 0}
 - AI findings (raw, pre-reconciliation): ${aiResult ? `P0=${aiResult.summary?.P0 || 0} P1=${aiResult.summary?.P1 || 0} P2=${aiResult.summary?.P2 || 0} P3=${aiResult.summary?.P3 || 0}` : "skipped"}
 - Reconciled (deduped + confidence-boosted): P0=${combinedP0} P1=${combinedP1} P2=${combinedP2} P3=${combinedP3}
@@ -1657,6 +1683,7 @@ ${formatFindingsMarkdown(allFindings)}
           p2: combinedP2,
           p3: combinedP3,
           blocking: combinedP0 > 0 || combinedP1 > 0,
+          coverage,
           elapsedMs: totalElapsedMs,
           artifacts: artifactPaths,
           deterministic: {
@@ -2134,6 +2161,55 @@ async function ensureEnvFileIgnored(projectDir) {
   await writeTextFile(gitignorePath, next);
 }
 
+export async function ensureSentinelConfigIgnored(projectDir) {
+  const gitignorePath = path.join(projectDir, ".gitignore");
+  let existing = "";
+  if (fs.existsSync(gitignorePath)) {
+    existing = await fsp.readFile(gitignorePath, "utf-8");
+  }
+
+  const entry = ".sentinelayer/";
+  const lines = existing.split(/\r?\n/);
+  const hasEntry = lines.some((line) => {
+    const normalized = String(line || "").trim();
+    return normalized === entry || normalized === ".sentinelayer";
+  });
+  if (hasEntry) {
+    return;
+  }
+
+  let next = "";
+  if (existing.trim().length === 0) {
+    next = `${entry}\n`;
+  } else if (existing.endsWith("\n")) {
+    next = `${existing}${entry}\n`;
+  } else {
+    next = `${existing}\n${entry}\n`;
+  }
+  await writeTextFile(gitignorePath, next);
+}
+
+export async function warnIfSentinelConfigTracked(projectDir) {
+  try {
+    const configRelPath = ".sentinelayer/config.json";
+    const result = spawnSync("git", ["-C", projectDir, "ls-files", "--error-unmatch", configRelPath], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (result.status === 0) {
+      console.log(
+        pc.yellow(
+          `! ${configRelPath} is tracked by git and may contain a token from a previous init. ` +
+            `To remove it: git rm --cached ${configRelPath} && git commit -m "Remove tracked SentinelLayer config". ` +
+            `Then rotate your token at https://sentinelayer.com/dashboard.`
+        )
+      );
+    }
+  } catch {
+    // git may not be installed or projectDir may not be a repo; silently skip.
+  }
+}
+
 async function ensureSentinelStartScript(projectDir, projectName) {
   const packagePath = path.join(projectDir, "package.json");
   const fallback = {
@@ -2789,7 +2865,7 @@ function confirmSecretsRepository(repoSlug) {
   } catch (error) {
     return { ok: false, reason: error instanceof Error ? error.message : String(error) };
   }
-  const view = spawnSync(ghCommand, ["api", `repos/${repoSlug}`], { encoding: "utf-8" });
+  const view = spawnSync(ghCommand, ["api", ghRepoApiPath(repoSlug)], { encoding: "utf-8" });
   if (view.status !== 0) {
     return { ok: false, reason: `gh could not read ${repoSlug}: ${String(view.stderr || view.stdout || "").trim()}` };
   }
@@ -2895,7 +2971,7 @@ function resolveGeneratedSpecId(generated) {
   return "";
 }
 
-async function writeInitConfigLockfile({
+export async function writeInitConfigLockfile({
   projectDir,
   specId,
   sentinelayerToken,
@@ -2910,7 +2986,6 @@ async function writeInitConfigLockfile({
     schema_version: 1,
     generated_at: new Date().toISOString(),
     spec_id: String(specId || "").trim(),
-    sentinelayer_token: String(sentinelayerToken || "").trim(),
     required_secret_name: String(secretName || "SENTINELAYER_TOKEN").trim() || "SENTINELAYER_TOKEN",
     repo_slug: normalizeRepoSlug(repoSlug || ""),
     workflow_path: path.relative(projectDir, workflowPath).replace(/\\/g, "/"),
@@ -3602,8 +3677,10 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
 
   if (sentinelayerToken) {
     await ensureEnvFileIgnored(projectDir);
+    await ensureSentinelConfigIgnored(projectDir);
     await upsertEnvVariable(path.join(projectDir, ".env"), secretName, sentinelayerToken);
   }
+  await warnIfSentinelConfigTracked(projectDir);
   await ensureGitRepositorySetup({
     projectDir,
     repoSlug: interview.connectRepo ? interview.repoSlug : "",