Engineering Review adversary

Reviews proposed changes with Staff-level engineering judgment across languages.

Goals

The adversary is designed to produce a small number of high-confidence, actionable findings grounded in concrete repository evidence. Its review should be deterministic where possible, explicit about impact, and quiet when the available evidence does not justify a finding.

Scope

It evaluates proposed changes across languages for correctness, completeness, maintainability, architecture, operational risk, and validation quality.

The complete detector or review inventory is maintained in CHECKS.md.

Boundaries

Unsupported model citations receive one bounded citation-only correction using the original prepared evidence. The claim is not regenerated and all returned references are checked again. If correction fails, that candidate is withheld; supported findings remain available, with an explicit incomplete-review warning and no clean/ship opinion. This does not relax evidence requirements.

It owns cross-language engineering judgment, while language mechanics, framework rules, security, infrastructure, pure style, and specialist test design remain with domain adversaries.

SDK source coverage

This branch pins the SDK schema-repair commit from SDK PR #71. Publish a new SDK version and replace the development pin before publishing a signed reviewer release.

Model review retains evidence-backed findings when repository source coverage is partial, records the limitation, and does not grant a whole-change clean opinion. Provider and output-validation failures are not coverage gaps: they retain failure or model-unavailable reporting and cannot grant a whole-change clean opinion.

The model schema declares observation prose bounds and item limits; semantic validation uses those same bounds. Errors identify the field and the specific problem (including character counts for length failures) without copying rejected model text. Required observation prose has no leading or trailing whitespace; tradeoffs may be an empty string. Optional overall summaries and strengths retain their synthesis and omission behavior.

Whitespace and placeholder checks run in semantic validation. The generation schema avoids unsupported composition keywords such as not, as required by OpenAI strict Structured Outputs.

Schema-invalid output rejected by the Go broker or SDK client, and invalid semantic judgments, receive one SDK-managed final-generation repair with field-specific validation feedback. Both generations share the original deadline, gathered evidence, citations, and coverage state; repair does not retrieve source again. Exhaustion is a terminal model_validation_failed error, retains output-validation failure diagnostics, and cannot grant a clean/ship opinion.

The regression suite compiles and validates the model schema with the production Go broker’s JSON Schema library, then feeds its HTTP envelopes through BrokerReviewModel to verify schema repair before the semantic callback and whitespace repair within it. A separate contract test checks the documented OpenAI strict-schema composition rules. These tests use mocked HTTP responses and do not open listeners or execute reviewed source.

Live file-read activity

The maintainer explicitly requested filenames in the live review transcript. This reviewer opts into SDK readDiagnostics so the UI can show which known repository file is being read. This is an intentional exception to the older blanket prohibition on paths in DOO-87; it does not change the nonfatal coverage policy. Default SDK coverage diagnostics remain path-free. Opt-in read details only report normalized paths from the known repository file set; unknown paths are redacted. Source contents, prompts, and raw tool errors are not logged.

The current DOO-87 requirements record this opt-in filename exception alongside the unchanged coverage safeguards.

npm test downloads the pinned Go broker-schema modules before running the offline contract checks. Go 1.26.6 or newer must be installed: the contract adapter uses GOTOOLCHAIN=local, so it does not download a newer compiler during the checks. CI and release workflows install the Go version declared in test/broker-schema/go.mod and also prepare the modules explicitly.

SDK 0.1.43

This release rebuilds with SDK 0.1.43. SDK PR #73 adds a tested neutral fallback to formatOpinionAsync when concern wording validation is exhausted, preserving completed findings and the ship decision. Reviewers that do not call this API retain their existing opinion behavior. Provider and transport failures remain errors. Domain rules and evidence requirements are unchanged.