code-mower 1.2.1__tar.gz → 1.3.0__tar.gz

{code_mower-1.2.1 → code_mower-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 1.2.1
+Version: 1.3.0
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/codemower-ai/code-mower
@@ -21,6 +21,11 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: NOTICE
 Requires-Dist: PyYAML>=6.0
+Provides-Extra: coworker
+Requires-Dist: mcp<2.3,>=2.2.0; extra == "coworker"
+Requires-Dist: httpx2<3,>=2.12; extra == "coworker"
+Requires-Dist: PyJWT[crypto]<3,>=2.10; extra == "coworker"
+Requires-Dist: keyring<26,>=25; extra == "coworker"
 Provides-Extra: test
 Requires-Dist: build>=1.2; extra == "test"
 Requires-Dist: pytest>=8.0; extra == "test"
@@ -45,6 +50,8 @@ The short version:
   exposure, or GitHub Actions churn;
 - turn issue text, external docs, and project doctrine into local work orders
   before an agent starts coding;
+- optionally give Claude and Codex the same authorized organizational evidence
+  through a private Coworker connection, with fresh review when context changes;
 - generate local reviewer value reports from known-clean and known-blocked PRs;
   and
 - optionally share sanitized metadata with [CodeMower.com](https://codemower.com)
@@ -56,8 +63,8 @@ Default cloud bundles exclude source code, raw diffs, raw model transcripts,
 raw stdout/stderr, auth output, and secrets.
 
 Documentation on `main` follows the source on `main`. If you install the
-published `code-mower==1.2.1` package, use the documentation from the matching
-[`v1.2.1` tag](https://github.com/codemower-ai/code-mower/tree/v1.2.1) so the
+published `code-mower==1.3.0` package, use the documentation from the matching
+[`v1.3.0` tag](https://github.com/codemower-ai/code-mower/tree/v1.3.0) so the
 commands and package stay aligned as development continues.
 
 ## Design Principles
@@ -252,7 +259,7 @@ agent report its actual host posture, exact installed version, doctor result,
 Board URL, and any owner-only click-list before it mutates the repo.
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.2.1/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.3.0/docs/try-in-10-minutes.md)
 guide. The v1.0 supervised-pilot release includes the native Board, the
 controller dry-run and policy contract, adoption and upgrade hardening from
 recent install rehearsals, package-index release checks, provider-diversity
@@ -367,7 +374,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v1.2.1` / `code-mower==1.2.1`. The
+the package-index procedure for `v1.3.0` / `code-mower==1.3.0`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 After publication, [Release Qualification](docs/release-qualification.md)
 coordinates provider-specific install and operational checks without treating
@@ -561,8 +568,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index release baseline is `v1.2.1`, with pinned package
-install spec `code-mower==1.2.1`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.3.0`, with pinned package
+install spec `code-mower==1.3.0`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and
@@ -676,6 +683,10 @@ first so local work exercises the same package entrypoint users install.
 - [v1.1.2 Release Notes](docs/v112-release-notes.md)
 - [v1.2 Release Notes](docs/v12-release-notes.md)
 - [v1.2.1 Release Notes](docs/v121-release-notes.md)
+- [v1.2.2 Release Notes](docs/v122-release-notes.md)
+- [v1.3.0 Release Notes](docs/v130-release-notes.md)
+- [Optional Coworker Setup](docs/context-setup.md)
+- [Context Qualification and Limits](docs/v130-context-qualification.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
 

{code_mower-1.2.1 → code_mower-1.3.0}/README.md

@@ -15,6 +15,8 @@ The short version:
   exposure, or GitHub Actions churn;
 - turn issue text, external docs, and project doctrine into local work orders
   before an agent starts coding;
+- optionally give Claude and Codex the same authorized organizational evidence
+  through a private Coworker connection, with fresh review when context changes;
 - generate local reviewer value reports from known-clean and known-blocked PRs;
   and
 - optionally share sanitized metadata with [CodeMower.com](https://codemower.com)
@@ -26,8 +28,8 @@ Default cloud bundles exclude source code, raw diffs, raw model transcripts,
 raw stdout/stderr, auth output, and secrets.
 
 Documentation on `main` follows the source on `main`. If you install the
-published `code-mower==1.2.1` package, use the documentation from the matching
-[`v1.2.1` tag](https://github.com/codemower-ai/code-mower/tree/v1.2.1) so the
+published `code-mower==1.3.0` package, use the documentation from the matching
+[`v1.3.0` tag](https://github.com/codemower-ai/code-mower/tree/v1.3.0) so the
 commands and package stay aligned as development continues.
 
 ## Design Principles
@@ -222,7 +224,7 @@ agent report its actual host posture, exact installed version, doctor result,
 Board URL, and any owner-only click-list before it mutates the repo.
 
 The current package-index announcement entry point is the tagged
-[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.2.1/docs/try-in-10-minutes.md)
+[Try Code Mower In 10 Minutes](https://github.com/codemower-ai/code-mower/blob/v1.3.0/docs/try-in-10-minutes.md)
 guide. The v1.0 supervised-pilot release includes the native Board, the
 controller dry-run and policy contract, adoption and upgrade hardening from
 recent install rehearsals, package-index release checks, provider-diversity
@@ -337,7 +339,7 @@ Provider-contract baseline for the next release train:
 
 For release verification,
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the package-index procedure for `v1.2.1` / `code-mower==1.2.1`. The
+the package-index procedure for `v1.3.0` / `code-mower==1.3.0`. The
 GitHub release records the workflow and rehearsal evidence for the exact tag.
 After publication, [Release Qualification](docs/release-qualification.md)
 coordinates provider-specific install and operational checks without treating
@@ -531,8 +533,8 @@ measurement work.
 
 ## Installation Status
 
-The current package-index release baseline is `v1.2.1`, with pinned package
-install spec `code-mower==1.2.1`. Release evidence is recorded on the GitHub
+The current package-index release baseline is `v1.3.0`, with pinned package
+install spec `code-mower==1.3.0`. Release evidence is recorded on the GitHub
 release and in the first-user install rehearsal. The public repository is
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), and
 GitHub releases remain the auditable source for tags, build artifacts, and
@@ -646,6 +648,10 @@ first so local work exercises the same package entrypoint users install.
 - [v1.1.2 Release Notes](docs/v112-release-notes.md)
 - [v1.2 Release Notes](docs/v12-release-notes.md)
 - [v1.2.1 Release Notes](docs/v121-release-notes.md)
+- [v1.2.2 Release Notes](docs/v122-release-notes.md)
+- [v1.3.0 Release Notes](docs/v130-release-notes.md)
+- [Optional Coworker Setup](docs/context-setup.md)
+- [Context Qualification and Limits](docs/v130-context-qualification.md)
 - [Post-v0.8 Effectiveness Assessment](docs/post-v08-effectiveness-assessment.md)
 - [v1.0.1 Effectiveness Assessment](docs/v101-effectiveness-assessment.md)
 

{code_mower-1.2.1 → code_mower-1.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "1.2.1"
+version = "1.3.0"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.12"
 readme = "README.md"
@@ -29,6 +29,7 @@ Issues = "https://github.com/codemower-ai/code-mower/issues"
 Changelog = "https://github.com/codemower-ai/code-mower/blob/main/CHANGELOG.md"
 
 [project.optional-dependencies]
+coworker = ["mcp>=2.2.0,<2.3", "httpx2>=2.12,<3", "PyJWT[crypto]>=2.10,<3", "keyring>=25,<26"]
 test = [
     "build>=1.2",
     "pytest>=8.0",

{code_mower-1.2.1 → code_mower-1.3.0}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "1.2.1"
+__version__ = "1.3.0"

{code_mower-1.2.1 → code_mower-1.3.0}/src/code_mower/audit_labeler_lib.py

@@ -25,10 +25,13 @@ import re
 if __package__:
     try:
         from . import decisions as code_mower_decisions
+        from . import context_review as code_mower_context_review
     except ImportError:  # pragma: no cover - copied tools fallback
         import decisions as code_mower_decisions  # type: ignore
+        import context_review as code_mower_context_review  # type: ignore
 else:  # pragma: no cover - direct helper execution
     import decisions as code_mower_decisions  # type: ignore
+    import context_review as code_mower_context_review  # type: ignore
 
 MIN_ABBREVIATED_SHA_LENGTH = 7
 AUTHOR_EXCLUSION_ENV = "CODE_MOWER_AUTHOR_EXCLUSION_JSON"
@@ -454,6 +457,7 @@ def latest_current_audit_verdict(
         bool,
     ],
     decision_authorities: Sequence[str] = (),
+    context_required: bool = False,
 ) -> str:
     verdict = latest_current_audit_verdict_detail(
         lane,
@@ -461,6 +465,7 @@ def latest_current_audit_verdict(
         head_sha=head_sha,
         trusted_comment_author=trusted_comment_author,
         decision_authorities=decision_authorities,
+        context_required=context_required,
     )
     return verdict.verdict if verdict else ""
 
@@ -475,8 +480,16 @@ def latest_current_audit_verdict_detail(
         bool,
     ],
     decision_authorities: Sequence[str] = (),
+    context_required: bool = False,
 ) -> AuditVerdict | None:
     verdicts: list[AuditVerdict] = []
+    try:
+        context_input = code_mower_context_review.latest_input(comments, authorities=decision_authorities)
+    except (ValueError, TypeError, RecursionError):
+        # A broken latest control declaration cannot expose an older PASS.
+        return None
+    if context_required and (context_input is None or not context_input['required']):
+        return None
     decisions = code_mower_decisions.collect_decision_records_from_comments(
         comments,
         authorities=decision_authorities,
@@ -492,6 +505,22 @@ def latest_current_audit_verdict_detail(
             head_sha=head_sha,
             decisions=decisions,
         )
+        failed_context_check = any(marker in body for marker in (
+            "<!-- CODE_MOWER_AUDIT_REQUEUE: kind=unknown -->",
+            "<!-- CODE_MOWER_AUDIT_REQUEUE: kind=stale -->",
+        )) and audit_comment_head_sha(body) == head_sha
+        if context_input is not None:
+            matches = code_mower_context_review.review_matches(body, context_input, head=head_sha)
+            # If the control-comment fetch itself failed, the wrapper cannot
+            # name a revision. Its current-head UNKNOWN still invalidates PASS.
+            # A verdict explicitly bound to a different revision never does.
+            unbound_failure = failed_context_check and code_mower_context_review.REVIEW_MARKER not in body
+            if not matches and not unbound_failure:
+                continue
+        if context_input is not None and failed_context_check:
+            # A later failed authorization/input check must supersede an older
+            # PASS even when both the code head and selected revision match.
+            verdict = "unknown"
         if verdict:
             try:
                 comment_id = int(comment.get("id") or 0)

{code_mower-1.2.1 → code_mower-1.3.0}/src/code_mower/claude_audit_pr.py

@@ -25,6 +25,8 @@ from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Tuple
 
+from code_mower import context_audit, context_delivery, context_review
+
 if __package__ in {None, "", "tools"}:
     try:
         from tools import audit_limits as code_mower_audit_limits
@@ -247,6 +249,8 @@ class ClaudeAuditConfig:
     decision_authorities: Tuple[str, ...] = ()
     merge_authority: bool = True
     calibration_badge: str = ""
+    context_revision: Optional[str] = None
+    context_state_dir: Optional[Path] = None
 
 
 @dataclass
@@ -949,6 +953,7 @@ def _review_prompt(
     review_doctrine: str = "",
     plan_context_text: str = "",
     decision_registry_text: str = "",
+    private_evidence_text: str = "",
 ) -> str:
     safe_branch_name = _one_line(branch_name, 200)
     safe_title = _one_line(title, 500)
@@ -1005,6 +1010,7 @@ Return only the structured JSON object required by the provided schema.
 {doctrine_block}
 {plan_context_block}
 {decision_registry_block}
+{private_evidence_text}
 
 Repository: {repo}
 Pull request: #{pr_number}
@@ -1473,7 +1479,18 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
     final_fixture_reason: Optional[str] = None
     unknown_reason = ""
 
-    if diff_context.was_truncated:
+    private_context = context_audit.prepare(
+        repository=repo, pr=pr_number, head=head_sha_start, host="claude",
+        authorities=decision_authorities, revision=config.context_revision,
+        state_dir=config.context_state_dir,
+        repo_path=local_repo, base_ref=config.base_ref,
+        fetch_comments=lambda: fetch_issue_comments(repo, pr_number, token=config.github_token),
+    )
+
+    if private_context is not None and not private_context.ready:
+        unknown_reason = "Selected context input is unavailable; authorize the selected connection and retry"
+        parsed = _unknown_structured_verdict(unknown_reason)
+    elif diff_context.was_truncated:
         unknown_reason = _diff_truncation_unknown_reason(diff_context)
         parsed = _unknown_structured_verdict(unknown_reason)
         print(
@@ -1534,6 +1551,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
                 rendered_plan_context.text if rendered_plan_context is not None else ""
             ),
             decision_registry_text=decision_registry_context,
+            private_evidence_text=private_context.text if private_context is not None else "",
         )
 
         attempt_prompt = prompt
@@ -1579,9 +1597,10 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
                     config = replace(config, max_budget_usd=raised_budget)
                     continue
             if guardrail_reason and attempt < MAX_CLAUDE_AUDIT_ATTEMPTS:
+                visible_reason = "private context verdict needs validation" if private_context is not None and private_context.private else guardrail_reason
                 print(
                     "  structured-verdict guardrail rejected Claude output: "
-                    f"{guardrail_reason}; retrying once",
+                    f"{visible_reason}; retrying once",
                     file=sys.stderr,
                     flush=True,
                 )
@@ -1595,10 +1614,14 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
         dt = time.time() - t0
         print(f"  claude audit completed in {dt:.0f}s", file=sys.stderr, flush=True)
     if parsed.mismatch_note:
-        print(f"  structured-verdict mismatch: {parsed.mismatch_note}", file=sys.stderr, flush=True)
+        note = "private context verdict needs validation" if private_context is not None and private_context.private else parsed.mismatch_note
+        print(f"  structured-verdict mismatch: {note}", file=sys.stderr, flush=True)
 
     pr_meta_after = fetch_pull_request(repo, pr_number, token=config.github_token)
     head_sha_end = pr_meta_after["head"]["sha"]
+    if private_context is not None and not private_context.finish(head=head_sha_end, prose=parsed.prose):
+        unknown_reason = "Selected context authorization or review input changed; reattach and review again"
+        parsed = _unknown_structured_verdict(unknown_reason)
     is_stale = head_sha_start != head_sha_end
     actions_run_id = os.environ.get("GITHUB_RUN_ID") or None
     claude_cli_reason = unknown_reason or _claude_cli_failure_reason(
@@ -1642,6 +1665,17 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
         result_verdict = parsed.verdict
         trailer = BLOCKED_TRAILER if parsed.verdict == "BLOCKED" else DONE_TRAILER
 
+    if private_context is not None and private_context.metadata is not None:
+        if private_context.private:
+            comment_body = context_delivery.public_verdict(
+                private_context.delivery, provider="Claude", head=head_sha_start,
+                verdict=result_verdict, counts=[parsed.p0_count, parsed.p1_count, parsed.p2_count, parsed.p3_count],
+                trailer=trailer, actions_run_id=actions_run_id, merge_authority=config.merge_authority,
+            )
+        else:
+            footer = context_review.marker(private_context.metadata, review=True) + "\n" + trailer
+            comment_body = limit_comment_body(comment_body.rsplit(trailer, 1)[0] + footer + "\n", footer, provider_name="Claude")
+
     result = ClaudeAuditResult(
         repo=repo,
         pr_number=pr_number,
@@ -1656,7 +1690,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
     )
 
     if not config.dry_run:
-        if result_verdict == "UNKNOWN":
+        if result_verdict == "UNKNOWN" and not (private_context is not None and private_context.private):
             dump_path = _dump_claude_cli_failure(
                 repo=repo,
                 pr_number=pr_number,
@@ -1694,7 +1728,8 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
                 file=sys.stderr,
                 flush=True,
             )
-            _write_claude_raw_output_sidecar(artifact_path, raw_output_attempts)
+            if not (private_context is not None and private_context.private):
+                _write_claude_raw_output_sidecar(artifact_path, raw_output_attempts)
         if quarantine_reason:
             print(
                 "  runtime guard quarantined verdict artifact: "
@@ -1785,6 +1820,8 @@ def _parse_args(argv: Optional[List[str]] = None) -> argparse.Namespace:
         ),
     )
     ap.add_argument("--repo-paths", default=os.environ.get("CLAUDE_AUDIT_REPO_PATHS", ""))
+    ap.add_argument("--context-revision", help="Require this explicitly attached private context input revision")
+    ap.add_argument("--context-state-dir", type=Path, help="Private context store outside the repository")
     ap.add_argument("--claude-cli-path", default=os.environ.get("CLAUDE_CLI_PATH", DEFAULT_CLAUDE_CLI_PATH))
     ap.add_argument("--model", default=os.environ.get("CLAUDE_AUDIT_MODEL", DEFAULT_CLAUDE_MODEL))
     ap.add_argument("--max-budget-usd", default=_env_text("CLAUDE_AUDIT_MAX_BUDGET_USD"))
@@ -1997,6 +2034,8 @@ def main(argv: Optional[List[str]] = None) -> int:
             prompt_lenses=code_mower_prompts.split_lenses(args.prompt_lenses),
             prompt_dir=args.prompt_dir,
             include_plan_context=not args.no_plan_context,
+            context_revision=args.context_revision,
+            context_state_dir=args.context_state_dir,
             project_context_manifest=args.project_context_manifest,
             external_context_manifest=args.external_context_manifest,
             max_plan_context_bytes=args.max_plan_context_bytes,

{code_mower-1.2.1 → code_mower-1.3.0}/src/code_mower/codex_audit_pr.py

@@ -68,6 +68,9 @@ Trailer protocol (mirrors Devin/local LLM):
 
 from __future__ import annotations
 
+from code_mower import context_audit, context_delivery, context_review
+from code_mower.context_contract import ContextError
+
 import argparse
 import json
 import os
@@ -288,6 +291,9 @@ class AuditConfig:
     # Optional human-facing calibration status. This must never decide merge
     # authority; it only renders as a separate badge line in the comment.
     calibration_badge: str = ""
+    context_revision: Optional[str] = None
+    context_state_dir: Optional[Path] = None
+    private_evidence: str = field(default="", repr=False)
 
 
 @dataclass
@@ -1351,12 +1357,15 @@ def run_codex_review(
     review_path = tmp_dir / "review.txt"
     prompt = ""
     context_omission_notice = ""
-    if trusted_context.strip():
+    if trusted_context.strip() or config.private_evidence:
         wrapper_context = _build_codex_wrapper_review_context(
             worktree_path,
             config,
         )
         if wrapper_context.was_truncated:
+            if config.private_evidence:
+                shutil.rmtree(str(tmp_dir), ignore_errors=True)
+                raise ContextError("private evidence cannot be omitted from the review")
             context_omission_notice = _codex_context_omission_notice(
                 diff_bytes=wrapper_context.full_diff_bytes,
                 hard_limit_bytes=wrapper_context.hard_limit_bytes,
@@ -1376,6 +1385,7 @@ def run_codex_review(
                 base_ref=config.base_ref,
                 trusted_context=trusted_context,
                 review_context=wrapper_context,
+                private_evidence_text=config.private_evidence,
             )
             env = _build_subprocess_env(None)
     if not prompt:
@@ -1461,6 +1471,7 @@ def _codex_wrapper_review_prompt(
     base_ref: str,
     trusted_context: str,
     review_context: _CodexWrapperReviewContext,
+    private_evidence_text: str = "",
 ) -> str:
     nonce = secrets.token_hex(8)
     context_begin = f"----- BEGIN TRUSTED AUDIT CONTEXT [{nonce}] -----"
@@ -1497,6 +1508,8 @@ Trusted Code Mower audit context:
 {trusted_context.rstrip()}
 {context_end}
 
+{private_evidence_text}
+
 Base ref: {base_ref}
 Diff truncation: {truncation_note}
 Diff bytes: included {review_context.included_diff_bytes} of at least
@@ -1863,6 +1876,16 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
         config.decision_authorities,
         trusted_ref=config.base_ref,
     )
+    private_context = context_audit.prepare(
+        repository=repo, pr=pr_number, head=head_sha_start, host="codex",
+        authorities=decision_authorities, revision=config.context_revision,
+        state_dir=config.context_state_dir,
+        repo_path=local_repo, base_ref=config.base_ref,
+        fetch_comments=lambda: fetch_issue_comments(repo, pr_number, token=config.github_token),
+    )
+    private_input_unavailable = private_context is not None and not private_context.ready
+    if private_context is not None:
+        config = replace(config, private_evidence=private_context.text)
     review_context_summary = "review context diagnostics unavailable"
     review_context: ReviewContextDiagnostics | None = None
     context_notice = ""
@@ -2027,7 +2050,7 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
         )
         effective_trusted_context = trusted_audit_context
         if (
-            trusted_audit_context.strip()
+            (trusted_audit_context.strip() or config.private_evidence)
             and review_context is not None
             and review_context.was_truncated
         ):
@@ -2036,23 +2059,33 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
                 hard_limit_bytes=review_context.hard_limit_bytes,
             )
             effective_trusted_context = ""
+            if config.private_evidence:
+                private_input_unavailable = True
             print(
-                f"  {context_notice}; using context-free codex review --base",
+                f"  {context_notice}; " + ("selected context cannot be omitted; emitting UNKNOWN"
+                    if config.private_evidence else "using context-free codex review --base"),
                 file=sys.stderr,
                 flush=True,
             )
         t0 = time.time()
-        review_text, review_stderr = run_codex_review(
-            config,
-            worktree_path,
-            effective_trusted_context,
-        )
+        review_text, review_stderr = "", ""
+        if not private_input_unavailable:
+            try:
+                review_text, review_stderr = run_codex_review(
+                    config,
+                    worktree_path,
+                    effective_trusted_context,
+                )
+            except ContextError:
+                private_input_unavailable = True
         if not context_notice:
             context_notice = _codex_context_omission_notice_from_diagnostics(
                 review_stderr
             )
             if context_notice:
                 effective_trusted_context = ""
+                if config.private_evidence:
+                    private_input_unavailable = True
         dt = time.time() - t0
         print(f"  codex review completed in {dt:.0f}s", file=sys.stderr, flush=True)
     finally:
@@ -2063,11 +2096,15 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
     # may receive the same trusted context only to apply transport policy
     # to findings already present in the review prose.
     t0 = time.time()
-    parsed, structure_stdout, structure_stderr = run_codex_verdict_structuring(
-        config,
-        review_text,
-        effective_trusted_context,
-    )
+    if private_input_unavailable:
+        parsed = _unknown_structured_verdict("Selected context input could not be delivered; reattach and review again")
+        structure_stdout, structure_stderr = "", ""
+    else:
+        parsed, structure_stdout, structure_stderr = run_codex_verdict_structuring(
+            config,
+            review_text,
+            effective_trusted_context,
+        )
     dt = time.time() - t0
     print(
         f"  codex verdict structuring completed in {dt:.0f}s",
@@ -2075,8 +2112,9 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
         flush=True,
     )
     if parsed.mismatch_note:
+        note = "private context verdict needs validation" if private_context is not None and private_context.private else parsed.mismatch_note
         print(
-            f"  structured-verdict mismatch: {parsed.mismatch_note}",
+            f"  structured-verdict mismatch: {note}",
             file=sys.stderr,
             flush=True,
         )
@@ -2097,6 +2135,8 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
     # the verdict applies to a no-longer-current SHA — requeue.
     pr_meta_after = fetch_pull_request(repo, pr_number, token=config.github_token)
     head_sha_end = pr_meta_after["head"]["sha"]
+    if private_context is not None and not private_context.finish(head=head_sha_end, prose=parsed.prose):
+        parsed = _unknown_structured_verdict("Selected context authorization or review input changed; reattach and review again")
     is_stale = head_sha_start != head_sha_end
     actions_run_id = os.environ.get("GITHUB_RUN_ID") or None
 
@@ -2125,7 +2165,7 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
         # without this dump there's no way to diagnose "real structured
         # output drift or one-shot Codex CLI flake?" after the fact.
         # Best-effort: a logging failure must not interrupt the audit.
-        dump_path = dump_cli_failure(
+        dump_path = None if private_context is not None and private_context.private else dump_cli_failure(
             repo=repo,
             pr_number=pr_number,
             head_sha=head_sha_start,
@@ -2166,6 +2206,17 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
         result_verdict = parsed.verdict
         trailer = BLOCKED_TRAILER if parsed.verdict == "BLOCKED" else DONE_TRAILER
 
+    if private_context is not None and private_context.metadata is not None:
+        if private_context.private:
+            comment_body = context_delivery.public_verdict(
+                private_context.delivery, provider="Codex", head=head_sha_start,
+                verdict=result_verdict, counts=[parsed.p0_count, parsed.p1_count, parsed.p2_count, parsed.p3_count],
+                trailer=trailer, actions_run_id=actions_run_id, merge_authority=config.merge_authority,
+            )
+        else:
+            footer = context_review.marker(private_context.metadata, review=True) + "\n" + trailer
+            comment_body = limit_comment_body(comment_body.rsplit(trailer, 1)[0] + footer + "\n", footer, provider_name="Codex")
+
     result = AuditResult(
         repo=repo,
         pr_number=pr_number,
@@ -2256,6 +2307,8 @@ def _parse_args(argv: Optional[List[str]] = None) -> argparse.Namespace:
     )
     ap.add_argument("--repo", help="owner/repo, e.g. owner/repo")
     ap.add_argument("--pr", type=int, help="PR number")
+    ap.add_argument("--context-revision", help="Require this explicitly attached private context input revision")
+    ap.add_argument("--context-state-dir", type=Path, help="Private context store outside the repository")
     ap.add_argument(
         "--repost-verdict-artifact",
         type=Path,
@@ -2602,6 +2655,8 @@ def main(argv: Optional[List[str]] = None) -> int:
         venv_path=explicit_venv,
         disable_venv=disable_venv,
         include_plan_context=not args.no_plan_context,
+        context_revision=args.context_revision,
+        context_state_dir=args.context_state_dir,
         project_context_manifest=args.project_context_manifest,
         external_context_manifest=args.external_context_manifest,
         max_plan_context_bytes=args.max_plan_context_bytes,