In-container adversarial-review quorum gate before PR opens

coilysiren commented

2026-06-18 02:34:50 +00:00

Owner

Summary

Add a heterogeneous adversarial-review gate that runs inside the dispatch container, before the PR opens. A claude worker's diff must survive a multi-model review panel (different model families) plus green CI before create_pull_request fires. The operator's review queue then only ever sees diffs the panel could not agree on, which moves the bottleneck off the human's verification step.

This is the v1-scoping feature for in-container multi-agent dispatch. Public-gap items are listed as explicit non-goals below.

Motivation

The launch primitive (ward agent claude headless / ward dispatch headless) is solved. The remaining constraint is verification, not observation or launch: at N concurrent workers the operator becomes the merge bottleneck because the PR is the only review gate. Burndown data backs this (154 dispatched, 68 landed, 44% autonomy quality). An in-container panel raises the trust floor of a diff so unsupervised merge is defensible for low-risk classes.

In-container review beats a separate cloud-review-between-CI-and-merge pass because the reviewers see the live worktree, not an abstract PR diff: they can run the exact failing test, grep the actually-edited files, and reproduce against the same filesystem state the worker produced. Sharing the container also shares the clone and CI artifacts (3 agents, 1 container is cheaper than 3 containers).

Design

Panel placement. Run the panel after green CI, before create_pull_request. Gate = CI green AND panel quorum >= threshold. Fail-closed: panel error or timeout blocks the merge, does not pass it.
Heterogeneity is the mechanism, protect it. Reviewers must be different model families from the worker (worker = claude; reviewers = codex + ollama-qwen). The worker may never review its own diff (correlated blind spots). If only one family is available, degrade to advisory-only and say so loudly in the log and PR body (see non-goals).
Cost-tiered panel. Local qwen is free, runs on every diff. Codex is subscription, runs as tie-breaker or on high-risk classes only. Claude (expensive worker) is not re-spent on review.
Refute-by-default prompt. Each reviewer is told to assume the diff is wrong, find the reason, and default to BLOCK on uncertainty. Reviewers get: the issue contract, the diff, the CI output, and the live tree. A pass with no attempted refutation is not a pass.
Veto-vs-quorum is a per-class knob. Threshold tiers by the autonomy class the triage filter already assigns: lint-cleanup can pass 1-of-2; a refactor needs unanimous; default 2-of-3. Expose as a flag, default sane.
Verdicts are structured. Each reviewer returns {verdict: pass|block, reason, confidence}. Persist the panel result alongside the dispatch audit row (and as span attributes once #135 lands).

Measurement (required, not optional)

A rubber-stamping panel is worse than none. Track and surface:

False-negative rate - of merges later reverted/fixed, how many did the panel pass. The dangerous number.
Precision - of blocks, how many were correct.
These calibrate the per-class threshold. Wire them into the same place autonomy-quality is reported.

Acceptance

A headless/cascade dispatch runs the panel after green CI and before opening the PR.
Panel verdicts (per reviewer: verdict, reason, confidence) are persisted to the audit row.
Merge gate honors CI green AND quorum >= threshold; fail-closed on panel error.
Threshold is configurable per autonomy class with a sane default.
Worker model is excluded from its own panel.
Single-family fallback degrades to advisory-only with a loud log + PR-body note.
Docs: docs/container.md (or a new docs/dispatch-review.md) documents the panel, the cost tiers, and the measurement hooks.

Non-goals (the public-gap items, deferred)

Repos the operator does not own. The current trusted-owner gate + --dangerously-skip-permissions-inside-container is safe because the operator owns the blast radius. Hardening the container into an audited security boundary for stranger repos is a separate project, not this issue.
BYO-model onboarding. This issue assumes the operator's three families are present. A public BYO-keys / claude-only-default story is separate.
The feed/triage/drain loop. Out of scope; this issue is the review gate only.

## Summary Add a heterogeneous adversarial-review gate that runs **inside the dispatch container, before the PR opens**. A `claude` worker's diff must survive a multi-model review panel (different model families) plus green CI before `create_pull_request` fires. The operator's review queue then only ever sees diffs the panel could not agree on, which moves the bottleneck off the human's verification step. This is the v1-scoping feature for in-container multi-agent dispatch. Public-gap items are listed as explicit non-goals below. ## Motivation The launch primitive (`ward agent claude headless` / `ward dispatch headless`) is solved. The remaining constraint is **verification**, not observation or launch: at N concurrent workers the operator becomes the merge bottleneck because the PR is the only review gate. Burndown data backs this (154 dispatched, 68 landed, 44% autonomy quality). An in-container panel raises the trust floor of a diff so unsupervised merge is defensible for low-risk classes. In-container review beats a separate cloud-review-between-CI-and-merge pass because the reviewers see the **live worktree**, not an abstract PR diff: they can run the exact failing test, grep the actually-edited files, and reproduce against the same filesystem state the worker produced. Sharing the container also shares the clone and CI artifacts (3 agents, 1 container is cheaper than 3 containers). ## Design - **Panel placement.** Run the panel after green CI, before `create_pull_request`. Gate = `CI green AND panel quorum >= threshold`. Fail-closed: panel error or timeout blocks the merge, does not pass it. - **Heterogeneity is the mechanism, protect it.** Reviewers must be different model families from the worker (worker = claude; reviewers = codex + ollama-qwen). The worker may never review its own diff (correlated blind spots). If only one family is available, degrade to advisory-only and say so loudly in the log and PR body (see non-goals). - **Cost-tiered panel.** Local qwen is free, runs on every diff. Codex is subscription, runs as tie-breaker or on high-risk classes only. Claude (expensive worker) is not re-spent on review. - **Refute-by-default prompt.** Each reviewer is told to assume the diff is wrong, find the reason, and default to BLOCK on uncertainty. Reviewers get: the issue contract, the diff, the CI output, and the live tree. A pass with no attempted refutation is not a pass. - **Veto-vs-quorum is a per-class knob.** Threshold tiers by the autonomy class the triage filter already assigns: lint-cleanup can pass 1-of-2; a refactor needs unanimous; default 2-of-3. Expose as a flag, default sane. - **Verdicts are structured.** Each reviewer returns `{verdict: pass|block, reason, confidence}`. Persist the panel result alongside the dispatch audit row (and as span attributes once #135 lands). ## Measurement (required, not optional) A rubber-stamping panel is worse than none. Track and surface: - **False-negative rate** - of merges later reverted/fixed, how many did the panel pass. The dangerous number. - **Precision** - of blocks, how many were correct. These calibrate the per-class threshold. Wire them into the same place autonomy-quality is reported. ## Acceptance - A headless/cascade dispatch runs the panel after green CI and before opening the PR. - Panel verdicts (per reviewer: verdict, reason, confidence) are persisted to the audit row. - Merge gate honors `CI green AND quorum >= threshold`; fail-closed on panel error. - Threshold is configurable per autonomy class with a sane default. - Worker model is excluded from its own panel. - Single-family fallback degrades to advisory-only with a loud log + PR-body note. - Docs: `docs/container.md` (or a new `docs/dispatch-review.md`) documents the panel, the cost tiers, and the measurement hooks. ## Non-goals (the public-gap items, deferred) - **Repos the operator does not own.** The current trusted-owner gate + `--dangerously-skip-permissions`-inside-container is safe because the operator owns the blast radius. Hardening the container into an audited security boundary for stranger repos is a separate project, not this issue. - **BYO-model onboarding.** This issue assumes the operator's three families are present. A public BYO-keys / claude-only-default story is separate. - **The feed/triage/drain loop.** Out of scope; this issue is the review gate only.

coilysiren referenced this issue

2026-06-18 02:35:15 +00:00

OTel-instrument the dispatch lifecycle (trace as verification artifact) #135

coilysiren referenced this issue

2026-06-18 04:10:24 +00:00

ward-kdl: list-all (auto-paginating) action for forgejo issue list #131

coilysiren added the

P2

interactive

labels

2026-06-18 06:17:11 +00:00

coilyco-ops added

consult

and removed

interactive

labels

2026-06-24 04:11:55 +00:00

coilyco-ops commented

2026-06-24 17:26:16 +00:00

Member

Re-triage (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24)

P2 - In-container adversarial-review quorum gate, big v1 feature, well-described, committed-adjacent.
consult - Substantial design with cost/trust tradeoffs, human-gated.

**Re-triage** (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24) - **P2** - In-container adversarial-review quorum gate, big v1 feature, well-described, committed-adjacent. - **consult** - Substantial design with cost/trust tradeoffs, human-gated.

coilyco-ops commented

2026-06-24 17:28:32 +00:00

Member

Re-triage (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24)

P2 - In-container adversarial-review quorum gate, big v1 feature, well-described, committed-adjacent.
consult - Substantial design with cost/trust tradeoffs, human-gated.

**Re-triage** (goose-triage method, claude-macos-kais-macbook-pro-2 as the judgment engine, 2026-06-24) - **P2** - In-container adversarial-review quorum gate, big v1 feature, well-described, committed-adjacent. - **consult** - Substantial design with cost/trust tradeoffs, human-gated.

coilysiren added

P3

and removed

P2

labels

2026-07-01 04:29:57 +00:00

coilyco-ops added

headless

and removed

consult

labels

2026-07-02 00:18:44 +00:00

coilyco-ops commented

2026-07-02 00:20:45 +00:00

Member

Flipped headless: the body carries a full v1 spec with explicit non-goals. Coordinate the outcome surface with #485's machine-readable contract. Recorded by Claude Code (Fable) during the 2026-07-01 ward launch triage session with Kai.

coilyco-ops commented

2026-07-06 18:14:07 +00:00

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-ward-134 on host KAI-DESKTOP-TOWER is carrying this issue (reserved 2026-07-06T18:14:01Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#134 · branch issue-134 · driver claude · workflow direct-main
Run: engineer-claude-ward-134 · ward v0.414.0 · dispatched 2026-07-06T18:14:01Z
Comment thread: 3 included in the pre-flight read, 0 stripped (ward's own automated comments).
- included: @coilyco-ops (2026-06-24T17:26:16Z), @coilyco-ops (2026-06-24T17:28:32Z), @coilyco-ops (2026-07-02T00:20:45Z)

Issue body as seeded:

## Summary

Add a heterogeneous adversarial-review gate that runs **inside the dispatch container, before the PR opens**. A `claude` worker's diff must survive a multi-model review panel (different model families) plus green CI before `create_pull_request` fires. The operator's review queue then only ever sees diffs the panel could not agree on, which moves the bottleneck off the human's verification step.

This is the v1-scoping feature for in-container multi-agent dispatch. Public-gap items are listed as explicit non-goals below.

## Motivation

The launch primitive (`ward agent claude headless` / `ward dispatch headless`) is solved. The remaining constraint is **verification**, not observation or launch: at N concurrent workers the operator becomes the merge bottleneck because the PR is the only review gate. Burndown data backs this (154 dispatched, 68 landed, 44% autonomy quality). An in-container panel raises the trust floor of a diff so unsupervised merge is defensible for low-risk classes.

In-container review beats a separate cloud-review-between-CI-and-merge pass because the reviewers see the **live worktree**, not an abstract PR diff: they can run the exact failing test, grep the actually-edited files, and reproduce against the same filesystem state the worker produced. Sharing the container also shares the clone and CI artifacts (3 agents, 1 container is cheaper than 3 containers).

## Design

- **Panel placement.** Run the panel after green CI, before `create_pull_request`. Gate = `CI green AND panel quorum >= threshold`. Fail-closed: panel error or timeout blocks the merge, does not pass it.
- **Heterogeneity is the mechanism, protect it.** Reviewers must be different model families from the worker (worker = claude; reviewers = codex + ollama-qwen). The worker may never review its own diff (correlated blind spots). If only one family is available, degrade to advisory-only and say so loudly in the log and PR body (see non-goals).
- **Cost-tiered panel.**

… (truncated to 2000 chars; full body is on this issue)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.414.0).

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-ward-134` on host `KAI-DESKTOP-TOWER` is carrying this issue (reserved 2026-07-06T18:14:01Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh** — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#134` · branch `issue-134` · driver `claude` · workflow `direct-main` - **Run:** `engineer-claude-ward-134` · ward `v0.414.0` · dispatched `2026-07-06T18:14:01Z` - **Comment thread:** 3 included in the pre-flight read, 0 stripped (ward's own automated comments). - included: @coilyco-ops (2026-06-24T17:26:16Z), @coilyco-ops (2026-06-24T17:28:32Z), @coilyco-ops (2026-07-02T00:20:45Z) **Issue body as seeded:** ``` ## Summary Add a heterogeneous adversarial-review gate that runs **inside the dispatch container, before the PR opens**. A `claude` worker's diff must survive a multi-model review panel (different model families) plus green CI before `create_pull_request` fires. The operator's review queue then only ever sees diffs the panel could not agree on, which moves the bottleneck off the human's verification step. This is the v1-scoping feature for in-container multi-agent dispatch. Public-gap items are listed as explicit non-goals below. ## Motivation The launch primitive (`ward agent claude headless` / `ward dispatch headless`) is solved. The remaining constraint is **verification**, not observation or launch: at N concurrent workers the operator becomes the merge bottleneck because the PR is the only review gate. Burndown data backs this (154 dispatched, 68 landed, 44% autonomy quality). An in-container panel raises the trust floor of a diff so unsupervised merge is defensible for low-risk classes. In-container review beats a separate cloud-review-between-CI-and-merge pass because the reviewers see the **live worktree**, not an abstract PR diff: they can run the exact failing test, grep the actually-edited files, and reproduce against the same filesystem state the worker produced. Sharing the container also shares the clone and CI artifacts (3 agents, 1 container is cheaper than 3 containers). ## Design - **Panel placement.** Run the panel after green CI, before `create_pull_request`. Gate = `CI green AND panel quorum >= threshold`. Fail-closed: panel error or timeout blocks the merge, does not pass it. - **Heterogeneity is the mechanism, protect it.** Reviewers must be different model families from the worker (worker = claude; reviewers = codex + ollama-qwen). The worker may never review its own diff (correlated blind spots). If only one family is available, degrade to advisory-only and say so loudly in the log and PR body (see non-goals). - **Cost-tiered panel.** ``` … (truncated to 2000 chars; full body is on this issue) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.414.0). </details>  — Claude (she/her), via `ward agent`

coilysiren commented

2026-07-06 19:55:10 +00:00

Author

Owner

This is describing PRs, but we can and should do the same thing with the agents that merge straight to main. It's more important there, even.

coilyco-ops commented

2026-07-07 22:39:03 +00:00

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-ward-134 on host KAI-DESKTOP-TOWER is carrying this issue (reserved 2026-07-07T22:38:58Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#134 · branch issue-134 · driver claude · workflow direct-main
Run: engineer-claude-ward-134 · ward v0.422.0 · dispatched 2026-07-07T22:38:58Z
Comment thread: 4 included in the pre-flight read, 1 stripped (ward's own automated comments).
- included: @coilyco-ops (2026-06-24T17:26:16Z), @coilyco-ops (2026-06-24T17:28:32Z), @coilyco-ops (2026-07-02T00:20:45Z), @coilysiren (2026-07-06T19:55:10Z)
- stripped: @coilyco-ops (2026-07-06T18:14:07Z)

Issue body as seeded:

## Summary

Add a heterogeneous adversarial-review gate that runs **inside the dispatch container, before the PR opens**. A `claude` worker's diff must survive a multi-model review panel (different model families) plus green CI before `create_pull_request` fires. The operator's review queue then only ever sees diffs the panel could not agree on, which moves the bottleneck off the human's verification step.

This is the v1-scoping feature for in-container multi-agent dispatch. Public-gap items are listed as explicit non-goals below.

## Motivation

The launch primitive (`ward agent claude headless` / `ward dispatch headless`) is solved. The remaining constraint is **verification**, not observation or launch: at N concurrent workers the operator becomes the merge bottleneck because the PR is the only review gate. Burndown data backs this (154 dispatched, 68 landed, 44% autonomy quality). An in-container panel raises the trust floor of a diff so unsupervised merge is defensible for low-risk classes.

In-container review beats a separate cloud-review-between-CI-and-merge pass because the reviewers see the **live worktree**, not an abstract PR diff: they can run the exact failing test, grep the actually-edited files, and reproduce against the same filesystem state the worker produced. Sharing the container also shares the clone and CI artifacts (3 agents, 1 container is cheaper than 3 containers).

## Design

- **Panel placement.** Run the panel after green CI, before `create_pull_request`. Gate = `CI green AND panel quorum >= threshold`. Fail-closed: panel error or timeout blocks the merge, does not pass it.
- **Heterogeneity is the mechanism, protect it.** Reviewers must be different model families from the worker (worker = claude; reviewers = codex + ollama-qwen). The worker may never review its own diff (correlated blind spots). If only one family is available, degrade to advisory-only and say so loudly in the log and PR body (see non-goals).
- **Cost-tiered panel.**

… (truncated to 2000 chars; full body is on this issue)

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.422.0).

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-ward-134` on host `KAI-DESKTOP-TOWER` is carrying this issue (reserved 2026-07-07T22:38:58Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh** — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#134` · branch `issue-134` · driver `claude` · workflow `direct-main` - **Run:** `engineer-claude-ward-134` · ward `v0.422.0` · dispatched `2026-07-07T22:38:58Z` - **Comment thread:** 4 included in the pre-flight read, 1 stripped (ward's own automated comments). - included: @coilyco-ops (2026-06-24T17:26:16Z), @coilyco-ops (2026-06-24T17:28:32Z), @coilyco-ops (2026-07-02T00:20:45Z), @coilysiren (2026-07-06T19:55:10Z) - stripped: @coilyco-ops (2026-07-06T18:14:07Z) **Issue body as seeded:** ``` ## Summary Add a heterogeneous adversarial-review gate that runs **inside the dispatch container, before the PR opens**. A `claude` worker's diff must survive a multi-model review panel (different model families) plus green CI before `create_pull_request` fires. The operator's review queue then only ever sees diffs the panel could not agree on, which moves the bottleneck off the human's verification step. This is the v1-scoping feature for in-container multi-agent dispatch. Public-gap items are listed as explicit non-goals below. ## Motivation The launch primitive (`ward agent claude headless` / `ward dispatch headless`) is solved. The remaining constraint is **verification**, not observation or launch: at N concurrent workers the operator becomes the merge bottleneck because the PR is the only review gate. Burndown data backs this (154 dispatched, 68 landed, 44% autonomy quality). An in-container panel raises the trust floor of a diff so unsupervised merge is defensible for low-risk classes. In-container review beats a separate cloud-review-between-CI-and-merge pass because the reviewers see the **live worktree**, not an abstract PR diff: they can run the exact failing test, grep the actually-edited files, and reproduce against the same filesystem state the worker produced. Sharing the container also shares the clone and CI artifacts (3 agents, 1 container is cheaper than 3 containers). ## Design - **Panel placement.** Run the panel after green CI, before `create_pull_request`. Gate = `CI green AND panel quorum >= threshold`. Fail-closed: panel error or timeout blocks the merge, does not pass it. - **Heterogeneity is the mechanism, protect it.** Reviewers must be different model families from the worker (worker = claude; reviewers = codex + ollama-qwen). The worker may never review its own diff (correlated blind spots). If only one family is available, degrade to advisory-only and say so loudly in the log and PR body (see non-goals). - **Cost-tiered panel.** ``` … (truncated to 2000 chars; full body is on this issue) Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.422.0). </details>  — Claude (she/her), via `ward agent`

coilyco-ops referenced this issue from a commit

2026-07-07 23:15:45 +00:00

feat(agent): in-container adversarial-review quorum gate before a run lands

coilyco-ops closed this issue

2026-07-07 23:15:45 +00:00

coilyco-ops commented

2026-07-07 23:16:17 +00:00

Member

WARD-OUTCOME: done - ward agent review in-container adversarial-review quorum gate landed on main (closes #134)

Retro from the container that carried this.

The shape fell out cleanly once I traced how a run actually lands: the PR/merge is driven by the worker agent following its seed, not by host orchestration, so the gate had to be a ward verb the seed tells the worker to run before landing. That kept it honest - the deterministic quorum/fail-closed logic lives in internal/reviewpanel (pure, seam-injected, heavily unit-tested), and the seed only wires the call. Splitting worker-excludes-own-family, cost-tiered escalation, and the advisory fallback into pure functions made them exhaustively testable without ever spawning a real codex/ollama.

What fought back: the repo's code-comments hook caps contiguous comment blocks at 2 lines, and I write denser doc comments - so a big chunk of the tail was mechanically compressing ~40 blocks and trimming the docs under the 80-line/4000-char cap into two files. Annoying but fair discipline. Also spent a beat distinguishing my failures from a pre-existing red test (TestReadBootstrapEnvDefaults) that a concurrent change had left broken; the rebase onto main picked up its fix, so the tree is fully green now.

Confidence: high on the gate logic, the wiring, and fail-closed behavior (all tested + --print/stats exercised end to end). The honest soft spot is provisioning: inside a claude engineer container, codex/opencode credentials+endpoints may not be present, so in practice the panel often degrades to advisory until reviewer harnesses are seeded into the worker container - I documented that as a prerequisite rather than solving it (BYO-model onboarding is an explicit non-goal). Follow-ups worth filing: (1) seed reviewer creds/endpoints into engineer containers so the panel is binding by default; (2) block-precision measurement needs a human-label signal (only false-negative rate is auto-computable today); (3) span attributes for panel verdicts once #135 lands; (4) key --review-class off the director triage label instead of a flag default.

WARD-OUTCOME: done - `ward agent review` in-container adversarial-review quorum gate landed on main (closes #134) Retro from the container that carried this. The shape fell out cleanly once I traced how a run actually lands: the PR/merge is driven by the worker agent following its seed, not by host orchestration, so the gate had to be a ward verb the seed tells the worker to run before landing. That kept it honest - the deterministic quorum/fail-closed logic lives in `internal/reviewpanel` (pure, seam-injected, heavily unit-tested), and the seed only wires the call. Splitting worker-excludes-own-family, cost-tiered escalation, and the advisory fallback into pure functions made them exhaustively testable without ever spawning a real codex/ollama. What fought back: the repo's `code-comments` hook caps contiguous comment blocks at 2 lines, and I write denser doc comments - so a big chunk of the tail was mechanically compressing ~40 blocks and trimming the docs under the 80-line/4000-char cap into two files. Annoying but fair discipline. Also spent a beat distinguishing my failures from a pre-existing red test (`TestReadBootstrapEnvDefaults`) that a concurrent change had left broken; the rebase onto main picked up its fix, so the tree is fully green now. Confidence: high on the gate logic, the wiring, and fail-closed behavior (all tested + `--print`/`stats` exercised end to end). The honest soft spot is **provisioning**: inside a claude engineer container, codex/opencode credentials+endpoints may not be present, so in practice the panel often degrades to advisory until reviewer harnesses are seeded into the worker container - I documented that as a prerequisite rather than solving it (BYO-model onboarding is an explicit non-goal). Follow-ups worth filing: (1) seed reviewer creds/endpoints into engineer containers so the panel is binding by default; (2) block-precision measurement needs a human-label signal (only false-negative rate is auto-computable today); (3) span attributes for panel verdicts once #135 lands; (4) key `--review-class` off the director triage label instead of a flag default.

Rows
Columns

In-container adversarial-review quorum gate before PR opens #134

Summary

Motivation

Design

Measurement (required, not optional)

Acceptance

Non-goals (the public-gap items, deferred)