Code Review adversary

The default general-purpose code reviewer and composition root. It reviews the entire change, while the CLI routes matching changed files to its pinned public language and domain specialists. Their findings are combined, deduplicated, and retain the reviewer sources that produced them. Shell and Bash changes route to shell/bash 0.0.1, combining ShellCheck diagnostics with model-backed shell correctness and operational review.

This package's own generalist pass reads the exact change, follows affected code and tests, asks one model pass to generate hypotheses, and asks a fresh pass to independently reject or verify them.

When the host supplies its detected pull-request intent, a separate outcome-integrity pass tests that hypothesis against the patch, tests, contracts, callers, and architecture. The ordinary generalist remains blind to that prose, so generic correctness coverage does not become anchored to the author's explanation. Candidates from both passes share the same independent verifier and evidence requirements.

This is additive to the existing repository graph and contract-evidence system. Both passes retain graph hints for symbols, imports, importers, related tests, callers, and callees; intent does not replace repository navigation.

PR text and detected intent are untrusted hypotheses, not instructions. Ambiguous intent does not become an invented requirement. The CLI owns displaying and posting the shared Reviewed as: basis for every adversary; this package only contributes outcome-integrity findings when repository evidence supports them.

The public review contract and reporting boundary are documented in CHECKS.md.

The checked-in runtime bundle includes the exact-change repository tools and bounded transient model retries from @adversarylabs/sdk.

Repository planning also recovers automatically when the model tries to finish without reading source. The SDK retrieves patches, then source windows covering their changed hunks through its existing safe tools, then continues the same investigation, audit, or verification pass. Recovery observations record the investigator's retrieval counts. The source-evidence checks remain in place if files are truly unavailable or excluded. The SDK’s deterministic changedHunksCovered signal allows metadata-only patches to complete without requiring nonexistent head text hunks. Recovery cannot finish with only unchanged prefix citations or partial changed-hunk coverage after budget exhaustion. The SDK revision pinned in package.json includes recovery diagnostics and support for sixteen planning rounds. Each stage permits 128 repository operations; byte and per-read limits remain bounded.

Contract evidence before investigation

The generalist now retrieves a bounded source packet before its investigator model call. It reads base/head windows around changed hunks, definitions and one forwarding hop selected by graph edges, callers, and graph-linked tests. A lexical Python fallback follows simple local, absolute, relative and aliased imports to top-level functions, including calls whose changed argument is on a later line. This adds source reads, not another model pass. Composition's other specialists are unchanged.

The packet contains navigation evidence, never defect verdicts. Ambiguous targets and missing source remain explicit. The investigator checks actual bindings and obtains fresh repository-tool citations; the verifier's prompt, schema and input stay unchanged. Committed reads use pinned revisions. Worktree reads are collected before investigation, but are not an atomic filesystem snapshot; avoid editing a dirty target during review.

Limits: 20 changed paths, 8 hunks per path, 60 distinct source reads, 40 target leads, 256 KB per file, 180 KB total source text, 24 KB/120 lines per window, and a 15-second retrieval deadline with at most 5 seconds per Git operation. Limit hits are recorded in code-review.contract-evidence observations. No reviewed code, external diff drivers or text-conversion filters are run.

The Python fallback is intentionally incomplete: dynamic dispatch, nested definitions, multiline imports, wildcard imports, dependency installations and custom import roots need ordinary repository investigation. A matching name is not proof of runtime resolution. Without a graph, non-Python changes retain their changed-source windows but have no automatically resolved target chain. Untracked files without diff hunks remain an explicit retrieval gap.

If the verifier marks a candidate verified but omits its finding, the reviewer rechecks that candidate alone with the same prompt and repository tools. The focused pass has a 4,000-token output budget instead of the batch's 12,000; findings record verificationPasses: 2 when this path succeeds. If the focused pass also omits the finding, that candidate becomes unresolved, so the review cannot report a clean opinion. Other independently verified findings remain. Malformed decisions or citations still fail the review.

For a controlled programmatic comparison use createApp({ contractEvidence: false }) or reviewChange(ctx, { contractEvidence: false }). This removes the packet and its reads while retaining the same model and verifier. The conditional investigator instruction is identical in both variants. Record the branch commit and option alongside results. The CLI is unchanged; this package is version 0.0.20.

Tests exercise evidence coverage for buggy and correct call variants, aliases, forwarding, pinned revisions, missing/ambiguous targets and size limits. They do not establish recall or precision. Keep running benchmarks frozen; compare this branch separately with the same validator after those runs finish.

Generated dependency lockfiles (*.lock, *.lockb, package-lock.json, npm-shrinkwrap.json, and pnpm-lock.yaml, including nested copies) are excluded from this general source review's repository tools. Their large generated patches can exceed the per-read limit and are not source-code evidence. Dependency manifests such as package.json remain reviewable. This reviewer does not claim to audit resolved lockfile dependencies; a lockfile-only change cannot receive a clean result without source evidence.

Limited source coverage

The reviewer uses the tested SDK development revision pinned in package.json to preload changed evidence before model planning. When a bounded lookup cannot cover every changed hunk, the review completes with a coverage observation and keeps independently verified findings. It does not declare the whole change clean. Coverage gaps alone do not fail the review or require rerunning it. Provider and citation validation errors remain errors.

Bounded model output repair

Model stages use the SDK output-validation loop with at most two final-generation requests (initial output plus one repair), unless a stage already supplies its own bounded validator. Broker and client schema failures provide specific feedback to final generation; gathered evidence and the original deadline are retained. Rejected completion usage is included in returned totals and terminal or interrupted ModelReviewError failures. Unexpected exceptions from custom model implementations propagate unchanged and do not expose SDK usage totals; custom models should report request failures with ModelReviewError. Exhausted validation remains incomplete and cannot grant a whole-change clean opinion.

This release uses SDK 0.1.43, including schema repair and interrupted-repair usage preservation.

Provider transport retries and format corrections have their own existing bounds; the two-attempt limit applies to SDK final-generation requests.

SDK 0.1.43

This release rebuilds with SDK 0.1.43. SDK PR #73 adds a tested neutral fallback to formatOpinionAsync when concern wording validation is exhausted, preserving completed findings and the ship decision. Reviewers that do not call this API retain their existing opinion behavior. Provider and transport failures remain errors. Domain rules and evidence requirements are unchanged.