cross-review
README.md
<p align="center">
<img src=".github/assets/lcv-ideas-software-logo.svg" alt="LCV Ideas & Software" width="520" />
</p>
# cross-review
> MCP server orchestrating API-first cross-review between Claude, ChatGPT Codex,
> Gemini, DeepSeek, Grok, and Perplexity with unanimous convergence gates.
[](#status)
[](https://github.com/LCV-Ideas-Software/cross-review/releases)
[](https://www.npmjs.com/package/@lcv-ideas-software/cross-review)
[](https://github.com/LCV-Ideas-Software/cross-review/actions/workflows/ci.yml)
[](https://github.com/LCV-Ideas-Software/cross-review/actions/workflows/publish.yml)
[](#what-it-does)
[](./LICENSE)
**Upgrade from the published registry.**
```bash
npm upgrade -g @lcv-ideas-software/cross-review --ignore-scripts --allow-git=none --allow-remote=none
# or using the GitHub Packages mirror:
npm upgrade -g @lcv-ideas-software/cross-review --@lcv-ideas-software:registry=https://npm.pkg.github.com --ignore-scripts --allow-git=none --allow-remote=none
```
npm 12 global operations evaluate the whole global dependency tree, not this
package's project policy in isolation. The command therefore disables every
install-time script and keeps Git and remote-URL dependencies blocked. The
published package has no install lifecycle and is tested in this mode. Never add
`--dangerously-allow-all-scripts`, and do not install a locally built source
tree or tarball as a substitute for the published registry release.
**Status.** Stable. The current source/release target is **v09.02.02** (package `9.2.2`).
Use the npm badge or `npm view @lcv-ideas-software/cross-review version` for
registry state and `server_info` for the version actually loaded by an MCP
window. See
[CHANGELOG.md](./CHANGELOG.md) for the full release history.
> **Project renamed 15/05/2026.** This project was previously published as
> [`@lcv-ideas-software/cross-review-v2`](https://www.npmjs.com/package/@lcv-ideas-software/cross-review-v2)
> (versions 0.x through 3.7.5). v4.0.0 is the first release under the
> shorter canonical name `@lcv-ideas-software/cross-review` after the
> companion `cross-review-v1` project was discontinued and archived.
> Historical CHANGELOG entries below v4.0.0 reference the prior name
> verbatim.
The version history at a glance:
**v09.02.02 (23/09/2026):** The xAI peer now defaults to Grok 4.7 and reads
assistant text from typed Responses output, ignoring encrypted reasoning items.
| Release | Scope |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **`v09.02.01`** | Perplexity requests no longer ask `perplexity/kimi-k3` for a reasoning effort it rejects. Every bare `invalid request` failure of the peer since 14/09/2026 had one mechanism: the adapter sent `reasoning.effort: "max"` and the pinned model rejects `xhigh` and `max` — HTTP 400 synchronously, a `failed` background run at the first retrieval — while `minimal | low | medium | high`complete, other models on the same API still accept`max`, and the API reference still lists the full enum. The default effort for the peer is `high`, `clampEffortForPerplexity`lands`xhigh`, `max`and`ultra`on`high`, and a regression pins the clamp table and the wire value on both the reviewer and the relator path (CROSREV-51, #327). |
| **`v09.02.00`** | One re-creation after a bare asynchronous Perplexity failure: a background run the provider accepted and then reported `failed` at the first retrieval with the bare `invalid request` body — no `param`, no HTTP status, no usage, within `PERPLEXITY_BARE_FAILURE_RECREATE_WINDOW_MS` of the create — is created once more through `withRetry`; every other failure keeps its verdict, and a second bare failure persists. Also: the Windows token-file ACL probe in `scripts/smoke.ts` runs Windows PowerShell 5.1 with its own `PSModulePath` so the suite passes under a pwsh 7 ancestor, and three pre-existing biome `useOptionalChain` warnings are cleared (CROSREV-48, #324). |
| **`v09.01.00`** | A provider failure preserves the provider's own error object instead of discarding it: the optional `provider_error_detail` keeps the HTTP status, `type`, `code`, `param` and the body — redacted as structure, capped at a declared ceiling and flagged when truncated — so a 400 rejecting our request body and an asynchronous failure of an already-created background job can be told apart afterwards; an empty serialization is not recorded (CROSREV-50, #322). |
| **`v09.00.00`** | **Major: a circular session is refused when the output-ceiling screen would drop ANY rotator**, instead of quietly continuing with the rest. The initial screen ran once and a dropped peer never returned, so a session could finalize `converged` while a peer that would fit the final artifact never saw it. The refusal costs zero provider calls and names the excluded peers with their ceilings and what continuing would have narrowed the rotation to; the two levers stay the same — shrink the artifact or raise the ceilings in the central configuration (CROSREV-49, #319). |
| **`v08.00.00`** | **Major: `review` mode evaluates a fixed artifact, and the lead never revises it.** Three surfaces disagreed about the relator's role in `mode: "review"`, a seat died on `max_output_tokens` after the round's votes had been paid, and a short lead verdict silently replaced `draft`. In `review` the lead now generates only in round zero, when the caller brought no artifact; from there the peers vote on a fixed artifact, and the output-ceiling screen applies to `ship` and `circular` only. Callers that relied on the lead re-emitting the artifact in `review` no longer get that behaviour. Also updates the CodeQL SARIF upload Action to v4.38.0 and zizmor-action to v0.6.4, SHA-pinned (CROSREV-46, #318). |
| **`v07.00.00`** | **Major: the operator identity is retired from the protocol.** `caller` is now REQUIRED on every tool that accepts it and `"operator"` is no longer an admissible value, so a host that omitted it and relied on the old default fails schema validation — set it explicitly before upgrading. The nine read-only tools that never accepted `caller` (`session_list`, `session_read`, `session_poll`, `session_metrics`, `session_peer_reliability_report`, `session_events`, `session_report`, `session_check_convergence`, `session_judgment_precision_report`) are unaffected. `escalate_to_operator`, `session_evidence_checklist_update` and `regenerate_caller_tokens` are removed; `session_finalize` accepts only `outcome=aborted` and is petitioner-scoped; `server_info` drops `operator_capability_loaded` and `operator_capability_required`; the `operator_verified` provenance tier is no longer produced, and `host-tokens.json` holds six capabilities instead of seven. The pins move to `gpt-6-astra` and `claude-fable-5-1`, with no second supported model per provider — re-key any `model_cost_rates` card accordingly or the financial preflight blocks. The relator draw now screens the seat's output ceiling against the draft before dispatching a round. Every cross-review-authored surface is English. Also: a Perplexity poll failure no longer re-creates the run it just abandoned — the rethrow carries `safe_to_repeat: false`, read only by the retry loop (issue #298). |
| **`v06.00.00`** | Major: the five legacy Sonar rate-card keys (`request_fee_low_per_1000`, `request_fee_medium_per_1000`, `request_fee_high_per_1000`, `citation_tokens_per_million`, `deep_research_reasoning_tokens_per_million`) are rejected by the strict central-config schema again — remove any Sonar card or key from `config.json` before upgrading, or the whole file is ignored and paid calls stay blocked with `CROSS_REVIEW_CONFIG_FILE_INVALID`. `TokenUsage.citation_tokens`, the three `CostEstimate` line items and the five legacy `CostRateConfig` keys leave the shipped declarations, so a consumer referencing them stops compiling; `server_info.config_load.deprecated_keys_ignored` and the `citation_tokens` clause of the provider-work predicate are gone with them. Also: the Perplexity reviewer and relator run in Agent API background mode (`background: true` plus `GET /v1/agent/{id}`) because the provider severs a synchronous request at ~300 s; those two long requests now send `store: true`, so Perplexity retains them (issue #296). |
| **`v05.00.00`** | **Major: legacy Sonar dimensions removed.** `estimateCost` no longer prices them; the five Sonar-only rate-card keys stay accepted by the schema as deprecated no-ops named at boot; a central config the schema rejects is now announced at boot. |
| **`v04.06.08`** | **Evidence custody fixes.** A provider-escaped GitHub URL quoted from the attachment no longer downgrades a READY vote; a relator may name a file the admitted unified diff materializes. |
| **`v04.06.07`** | **No manual gesture.** A push to `main` that changes the version publishes to npmjs.com and GitHub Packages and then records the Release with the run's own token. |
| **`v04.06.06`** | **Native release path.** The repository-owned tagging, dispatch and policy machinery leaves; publishing runs on a published GitHub Release with npm Trusted Publishing and provenance. |
| **`v04.06.05`** | **Native organization governance.** Actions lockfile, advanced CodeQL workflow, merge-queue triggers and the v04.05.26 recovery workflow leave; the canonical Dependabot auto-merge and the organization workflows enter; the release gates read the CodeQL default-setup analyses. |
| **`v04.06.04`** | Makes evidence conflict correlation linear and argv-exact, and makes future/current model parsing clause-aware through finite English/Portuguese frames, including `replace … with`, `update … to`, Portuguese present qualifiers, and semicolon isolation. |
| **`v04.06.03`** | Restores fail-closed anti-deception semantics for conflicting executions of the same command, additive `not only`/`não só` model claims, and current-state claims beside planning language, while preserving independent RED/GREEN records and genuine future targets. |
| **`v04.06.02`** | Republish of v04.06.01 with a self-contained pin-validator action (bundled parser, clean-runner proven), reference-resolved local action manifests and a location-scoped Scorecard allowance. |
| **`v04.06.01`** | Republish of v04.06.00 with the supply-chain gate fix: minimal per-job GITHUB_TOKEN permissions across all workflows, `TokenPermissionsID` back under Scorecard watch, and a real pinning revalidation in the Publish gate covering the immutable `$/` same-repo references. |
| **`v04.06.00`** | Migrates the Perplexity peer to the Agent API (`perplexity/kimi-k3`) before the Sonar sunset of 27/09/2026, moves Grok to `grok-4.6` with `xhigh` effort, refreshes provider rate documentation, and makes the relator lottery smoke deterministic with an explicit chi-square bound. |
| **`v04.05.39`** | Prevents repeated caller-token permission recovery in one boot, regenerates only after a confirmed disappearance, and makes the trusted-console Windows recipe replace only a protected-empty DACL before verifying the exact result. |
| **`v04.05.38`** | Locks the T2#10 source-regex debt at its current `smoke=129`, `source-contract=29`, total `158` baseline so a new broad source-style regex pin cannot consume the two-pin allowance left by the older v4.4.6 budget. |
| **`v04.05.37`** | Makes Windows caller-token ACL hardening interruption-tolerant, repairs one protected-empty-DACL denial without looping or rotating tokens, binds path/SID data outside the PowerShell command parser, and adds a dedicated Windows regression gate. |
| **`v04.05.36`** | Repairs byte-exact JSON citation grounding, preserves active caller evidence during full decision retry, accepts documented terminal Perplexity aggregate content, and refreshes the signed immutable central automation pins. |
| **`v04.05.35`** | Hardens the public-package boundary, moves administrative release checks into the protected non-deployment environment, updates TypeScript ESLint to 8.66.0, and makes Windows parent-process forensics tests deterministic without changing the 500 ms best-effort runtime cap. |
| **`v04.05.34`** | Removes two redundant control-flow expressions reported by GitHub Code Quality while preserving the budget-preflight behavior and the lazy evidence-attachment fallback used when truthfulness preflight is disabled. |
| **`v04.05.33`** | Supersedes the unpublished 4.5.32 tag by recognizing npm's documented `404` identity concealment only in the negative OIDC probe, matching npm's scoped-package escaping, retaining an exact-`201` positive gate, and resolving OpenAI 7.3.0. |
| **`v04.05.32`** | Bootstraps checksum-verified npm 12.0.2, proves both npm OIDC environment boundaries before source execution, splits privileged publication from verification, and remediates the current Hono, brace-expansion, fast-uri and ip-address advisories. |
| **`v04.05.31`** | Supersedes the unpublished 4.5.30 tag by making the clean-consumer license gate follow the exact bundled MCP SDK version instead of a stale hard-coded version. |
| **`v04.05.30`** | Updates the OpenAI runtime to 7.0.0 and bundled MCP SDK to 1.30.0; completely removes Socket Security and StepSecurity; prevents redundant immutable-tag publication; fails closed on ambiguous GitHub API status; and runs direct Zizmor through checksum-verified uv. |
| **`v04.05.29`** | Supersedes the unpublished 4.5.28 tag and locks `brace-expansion` 5.0.8 after its newly disclosed high-severity DoS advisory blocked publication; also retains the descriptor-based caller-token TOCTOU fix verified by CodeQL. |
| **`v04.05.28`** | Adds opt-in Claude Opus 5 support; bounds Evidence Broker amplification without weakening blockers; repairs interrupted-session lifecycle, checklist provenance and truthfulness diagnostics; hardens caller-token ACLs; and makes event polling compact. |
| **`v04.05.27`** | Updates the Anthropic and OpenAI SDKs, makes manifests and lockfiles the dependency source of truth, and ships hardened dependency automation with verified release recovery. |
| **`v04.05.26`** | Bundles the MCP runtime and hardens exact-SHA automation, immutable releases, and current provider dependencies. |
| **`v04.05.25`** | Resolves the three registry advisories in the lockfile: `body-parser` 2.3.0, nested `protobufjs` 7.6.5, and `brace-expansion` 5.0.7; updates the one reviewed install-script approval to `protobufjs@7.6.5`. Scorecard and Auto-tag remain fail-closed; no alert was suppressed. |
| **`v04.05.23`** | Accepts npm 12's one-item `npm view --json` response only when it contains one metadata object; empty, multiple, and malformed responses fail closed before the integrity-bound audit lock and mandatory `npm audit signatures` gate. |
| **`v04.05.22`** | Decodes npm's Sigstore DSSE envelope before binding the SLSA provenance to the protected tag, publication workflow, and immutable source commit; the later cryptographic `npm audit signatures` gate remains mandatory. |
| **`v04.05.21`** | Aligns the durable effective-config regression with JSON semantics: unset optional properties are omitted consistently from persisted snapshots and their SHA-256 canonical form. |
| **`v04.05.20`** | Restores a deterministic CI fixture for the pre-publish budget/cache contract: Gemini has an explicit test rate and a manually known settlement cannot retain a stale unknown-spend marker. The production financial gate remains fail-closed. |
| **`v04.05.19`** | Hardens the npm publication gate without weakening artifact verification: an integrity-bound temporary lock drives `npm ci` and `npm audit signatures`, while visibility no longer pipes downloaded data into Node. |
| **`v04.05.18`** | Closes the 4.5.16–4.5.17 session-audit findings: symmetric grounding for blocking verdicts, per-peer write-through durability, terminal preflight audit trails, bounded evidence judges, complete cache/config telemetry and action-oriented compact reports. |
| **`v04.05.17`** | Publishes the accumulated provider/toolchain maintenance, raises the Anthropic SDK range and keeps npm 12 dependency scripts fail-closed with an exact, reviewed Google Gen AI 2.12.0 no-op lifecycle permission. |
| **`v04.05.16`** | Makes background observation compact and race-safe: summary polling by default, explicit forensic detail, real HTML-neutralized Markdown, durable cross-host job status and idempotent late-cancellation results with final state. |
| **`v04.05.15`** | Ships the Evidence Broker continuity fix with the complete Dependabot hardgate: supported npm resolver, npm 12 build/release pin, pip-compile source+hash lock, grouped Python updates and concurrent-base merge retry. |
| **`v04.05.14`** | Restores Evidence Broker continuity safely: clean grounded historical READY sources are replayed locally without stale prompt reuse, strict same-owner aliases collapse, `git -C ... diff --check` is recognized and final convergence is persisted consistently. |
| **`v04.05.13`** | Eliminates a repeated ReDoS class in Evidence Broker symbol extraction and makes publication wait for CodeQL on the exact SHA plus zero actual open code-scanning alerts. |
| **`v04.05.12`** | Fixes Evidence Broker convergence: direct rounds receive unresolved checklist IDs, grounded same-requester rechecks close the correct item, natural-language alternatives no longer deadlock, and irrelevant or partial evidence still fails closed. |
| **`v04.05.11`** | Makes autonomous evidence routing unambiguous in the MCP contract: AI evidence is persisted automatically through review starters, while the optional operator authority-promotion tool cannot be mistaken for a mandatory human upload step. |
| **`v04.05.10`** | Retries npm attestation propagation independently from package visibility and follows the registry-advertised pathname on the pinned npm registry origin, preventing false-negative post-publish failures without weakening SLSA provenance requirements. |
| **`v04.05.09`** | Keeps server-authored READY remediation out of peer `caller_requests`, preventing unresolvable evidence-checklist blockers while preserving real peer asks and the complete decision audit trail. |
| **`v04.05.08`** | Hash-pinned npm 12.0.1 bootstrap across CI/release jobs and trusted default-branch auto-tag checkout with exact successful-CI SHA gating; closes code-scanning alerts 32–38. |
| **`v04.05.07`** | Complete 4.5.6 provider remediation plus CI-before-tag release ordering, npm 12.0.1 alignment, strict dependency-script review and cache exclusion. |
| **`v04.05.06`** | Six-provider contract remediation — provider-specific wire schemas and output budgets, controlled OpenAI/Gemini truncation recovery, safe citation/diff correlation, runtime namespace fixes, corrected FinOps, and npm 12/OIDC release hardening. |
| **`v04.05.05`** | Clean-runner publish follow-up — make cancellation, health and accounting regression fixtures independent from private operator rate cards and reject false-green preflight coverage; production financial gates remain fail-closed. |
| **`v04.05.04`** | Runtime-hardgate remediation — fix grounding, truthfulness namespaces, consensus judging, multi-window cancellation, accounting, session ceilings, terminal reports and cross-provider `ultra` normalization. |
| **`v04.05.03`** | Security/hardgate patch — remove exponential regex backtracking, trust integrity-checked attachment path/digest metadata, accept correlated single-quoted artifact literals and stop treating source-version bumps as historical runtime claims. |
| **`v04.05.02`** | Patch release — publish the complete authenticated-evidence transport update with a hermetic clean-runner regression fixture; no operator central configuration is required by the test gate. |
| **`v04.05.01`** | Patch release — restore authenticated peer evidence transport with append-only active snapshots, combined preflight parity, strict operational records, independent relator/reviewer roles and immutable terminal outcomes; no manual operator attachment is required. |
| **`v04.05.00`** | Minor release — refresh all six provider contracts and add fail-closed provider terminals, runtime config fingerprints, operator evidence custody, peer self-attestation rejection, and grounded READY votes. |
| **`v04.04.08`** | Patch — raise the transitive `hono` override floor and clear the current advisory set. |
| **`v04.04.07`** | Patch — promote the patched `protobufjs` floor for downstream consumers. |
| **`v04.04.06`** | Patch — close the remaining Claude re-validation tail: orchestrator attached-evidence reads now fail closed, session_doctor defaults to action-oriented findings, and T2#10 source-regex debt drops to a locked total of 160. |
| **`v04.04.05`** | Patch — close the seven verified residual audit items: evidence fail-closed realpath handling, typed shadow-decision runtime events, derived release date, redaction-comment correction, retry/security gate verification, and a locked T2#10 smoke source-contract budget. |
| **`v04.04.04`** | Patch — central config can now carry model-specific rate cards, so Claude Opus 4.8 and Claude Fable 5 pricing are both stored and the active Anthropic rates follow the configured Claude model automatically. |
| **`v04.04.03`** | Patch — continue the T2#10 smoke-debt reduction by moving the lazy provider SDK import source contract into the dedicated source-contract smoke, preserving coverage while reducing broad smoke regex pins. |
| **`v04.04.02`** | Patch — support Claude Fable 5 as an explicit Anthropic production-model option, including verified model selection, refusal handling, refusal events, docs and cost guidance. |
| **`v04.04.01`** | Patch — complete residual audit sweep: full mutating-tool identity gate, evidence attachment cache/safety, async EventLog flush, Perplexity auth-only probe mode, cache-cost correctness, dashboard report method split, and dedicated source-contract smoke isolation. |
| **`v04.04.00`** | Minor — consolidated audit close-out: log-level validation, realpath containment, initial-draft fabrication guard, Perplexity probe minimization, identity audit events, derived tool list, docs and metadata guards. |
| **`v04.03.09`** | Patch — move `truthfulness_preflight` coverage into a focused smoke script and tighten evidence-artifact matching for path-qualified refs and `.md/.diff/.patch/.csv` files. |
| **`v04.03.08`** | Patch — move `evidence_preflight` behavior coverage into a focused smoke script and run it explicitly before the broader smoke suite. |
| **`v04.03.07`** | Patch — evidence preflight now blocks paid review when the submission references an external evidence/log artifact that was not attached to the session. |
| **`v04.03.06`** | Patch — isolate `runtime-smoke` in a temporary data directory so harness runs do not write open sessions into the operator's real runtime corpus. |
| **`v04.03.05`** | Patch — filter Perplexity streaming `<think>` token events, expand `~` in central config paths, escape dashboard runtime paths, and harden smoke scripts. |
| **`v04.03.04`** | Patch — harden cross-process event sequencing, exact-match fabrication checks, Gemini missing-text handling, and streaming provider error retry classification. |
| **`v04.03.03`** | Patch — add forensic diagnostics for append/event and identity failures, flush pending events on shutdown signals, retry structured provider 5xx errors, and refresh official AI provider SDKs. |
| **`v04.03.02`** | Patch — harden persistence redaction, finalized-session mutation guards, side-effect identity gates, caller-token rotation output, and Windows registry config fallback. |
| **`v04.03.01`** | Patch — tighten skip-peer classification so non-retryable provider errors block, while Anthropic overload events remain retryable and better surfaced in skip diagnostics. |
| **`v04.03.00`** | Minor — P1/P2/P3 follow-up with unresolved-evidence close-out visibility, an offline fixture eval harness, and a read-only peer reliability report. |
| **`v04.02.05`** | Patch — harden session auditability with terminal events, cost split reporting, `not_resurfaced` visibility, and relator provenance checks for session IDs/GitHub URLs. |
| **`v04.02.04`** | Patch — harden truthfulness preflight auditability, add a read-only preflight retest tool, and reduce false parser warnings for attached/log evidence. |
| **`v04.02.03`** | Patch — promote the Gemini canonical default to `gemini-3.1-pro-preview` and refresh the active local Gemini rate card. |
| **`v04.02.02`** | Patch — provider-doc refresh, Perplexity probe repair, current model pins, and rate-card guidance. |
| **`v04.02.01`** | Patch — publish the workspace hard-gate cleanup as a package release. |
| **`v04.02.00`** | Minor — bounded MCP session listing and cancellation semantics cleanup. |
| **`v04.01.01`** | Patch — release the hard-gate cleanup as a published package. |
| **`v04.01.00`** | Minor — security hardening of session-store concurrency, write-path DoS surface, and credential redaction. |
| **`v04.00.08`** | Patch — eliminate the recurring `js/file-access-to-http` CodeQL false positive at the source. |
| **`v04.00.07`** | Patch — bounded npm registry fetch in the post-publish verifier. |
| **`v04.00.06`** | Patch — Windows-safe registry verifier. |
| **`v04.00.05`** | Patch — hard-gate close-out for the Codex v4.0.4 audit. |
| **`v04.00.04`** | Patch — restore prettier coverage of `src/` and `scripts/` (close audit on v4.0.3 hard-gate gap). |
| **`v04.00.03`** | Patch — biome/check gate wiring after the v4 rename. |
| **`v04.00.02`** | Patch — Codex second-pass audit close-out (6 findings). |
| **`v04.00.01`** | Patch — close-out of post-v4.0.0 audit (eight surfaces left stale by the rename bulk-replace). |
| **`v04.00.00`** | Major — project renamed to `cross-review` |
| **`v03.07.05`** | Patch — logs+sessions study 15/05/2026 close-out (4 surgical fixes from 244-session/429-round corpus). |
| **`v03.07.03`** | Patch — the directive quoted verbatim in pt-BR, "sem fallback é sem fallback", + Codex v3.7.2 review residuals. |
| **`v03.07.02`** | Patch — Codex 3rd super-audit close-out of v3.7.1 |
| **`v03.07.01`** | Patch — Codex super-audit close-out of v3.7.0 |
| **`v03.07.00`** | Minor — Codex super-audit close-out 14/05/2026 |
| **`v03.06.00`** | Minor — observability + caller-discipline close-out 14/05/2026 |
| **`v03.05.00`** | Minor — Codex operational-report close-out 14/05/2026: 5 findings from sessions `f0db3970` + `df052926`. |
| **`v03.04.00`** | Minor — Perplexity multi-failure-mode close-out 13/05/2026: 3 coordinated fixes covering 7 production sessions Codex flagged (`51973fac`, `f72e597a`, `f9a19401`, `99d46a2b`, `00d92cce`, `59776026`, `0003b2fe`). |
| **`v03.03.00`** | Minor — Caller peer-selection lock (operator directive 12/05/2026, quoted verbatim in pt-BR: "TODOS OS AGENTES/PEERS SEMPRE PARTICIPAM, INDEPENDENTE DA ESCOLHA OU VONTADE DO CALLER"). |
| **`v03.02.00`** | Patch — Codex bug-report close-out 12/05/2026: three surgical fixes (Perplexity `<think>` parser + session-state invariant + orchestrator strict peers). |
| **`v03.01.00`** | Minor — Central config file (`config.json`). Eliminates ~700 redundant env-var declarations across the 7 MCP host configs. |
| **`v03.00.00`** | Major — Perplexity joins the sexteto. Quinteto (5 peers) → sexteto (6). |
| **`v02.28.00`** | Minor — Cold-start hardening Part 3: Windows registry env-var lookup bulk-cached (3-7 s → ~100 ms). |
| **`v02.27.01`** | Patch — Cold-start hardening Part 2: lazy-load 5 provider SDKs + defer 6 startup sweeps to setTimeout(30s). |
| **`v02.27.00`** | Minor — Cold-start hardening Part 1: corrupted meta.json auto-quarantine + finalized-session auto-prune. |
| **`v02.26.01`** | Patch — `max_attached_evidence_chars` default raised 80_000 → 200_000 to fix multi-file evidence truncation. |
| **`v02.26.00`** | Minor — Full pricing-model schema: base + extended-tier + cache (read/write) + promo (limited-time discount), all env-configurable, graceful fallback when fields are absent or promo expires. |
| **`v02.25.01`** | Patch — `meta.json` corruption hotfix: `redact()` env-style pattern was crossing JSON-escape boundaries. |
| **`v02.25.00`** | Third deliberation mode `circular` joins `ship` and `review`. |
| **`v02.24.00`** | Evidence-provenance lock for the ship-mode relator (Codex bug report 10/05/2026). |
| **`v02.23.00`** | Anthropic empty-revision degenerate path detection. |
| **`v02.22.00`** | `session_doctor` drill-down + per-round cost telemetry + budget warning event. |
| **`v02.21.00`** | Cross-provider prompt caching across all 5 peers (OpenAI, Anthropic, Gemini, DeepSeek, Grok). |
| **`v02.18.08`** | Site sponsor card iteration. |
| **`v02.18.07`** | Patch — `site/index.html` visual identity refresh. |
| **`v02.18.06`** | Patch — Gemini API function-declaration compatibility for MCP tool inputSchemas. |
| **`v02.18.05`** | Patch — anti-drift smoke drivers for v2.18.4 audit closure (operator directive 07/05/2026). |
| **`v02.18.04`** | Patch — Codex external audit 07/05/2026 outcome: 6 surgical fixes (P1.1, P1.2, P1.3, P1.4, P2.1, P2.4). |
| **`v02.18.03`** | Patch — Gemini default pin bump `gemini-3.1-pro-preview` → `gemini-2.5-pro` (operator preference 07/05/2026; coordinated with cross-review-v1 v1.12.4). |
| **`v02.18.02`** | Tier 5 — Windows process-tree introspection (coordinated with cross-review-v1 v1.12.2). |
| **`v02.18.01`** | Hotfix: closes Dependabot security advisory GHSA-v2v4-37r5-5v8g (medium severity) — `ip-address` XSS in Address6 HTML-emitting methods. |
| **`v02.18.00`** | F1 caller capability tokens (coordinated with cross-review-v1 v1.11.0). |
| **`v02.17.00`** | HARD GATE — identity forgery rejection (operator directive 05/05/2026). |
| **`v02.16.00`** | Tribunal protocol repair plus operational doctor. |
| **`v02.15.01`** | `server_info` consensus visibility hotfix. |
| **`v02.15.00`** | Backlog bundle for operational judge controls. |
| **`v02.14.01`** | Grok reasoning model hotfix. |
| **`v02.14.00`** | Grok joins the tribunal. |
| **`v02.13.00`** | Lead meta-review drift fix. |
| **`v02.12.00`** | Shadow judge observability. |
| **`v02.11.00`** | Relator lottery plus shadow auto-wire. |
| **`v02.09.00`** | LLM evidence-judge pass. |
| **`v02.08.00`** | Per-peer health and Evidence Broker lifecycle. |
| **`v02.07.00`** | Evidence Broker. |
| **`v02.06.01`** | Fallback/recovery budget hard gate. |
| **`v02.06.00`** | Token-delta compaction plus v2.5 format hotfix bundle. |
| **`v02.05.00`** | Evidence and budget hardening pass. |
| **`v02.04.01`** | CI stub fail-fast hotfix. |
| **`v02.04.00`** | Audit-closure hardening pass. |
| **`v02.03.03`** | Prompt shielding and financial safety. |
| **`v02.03.02`** | CI-green README/docs cleanup. |
| **`v02.03.01`** | README organizational standardization. |
| **`v02.03.00`** | Provider-neutral `review_focus`. |
| **`v02.02.00`** | Provider token streaming. |
| **`v02.01.01`** | CodeQL and model-selection hardening. |
| **`v02.01.00`** | First stable `cross-review` release. |
| **`v02.00.04`** | Session event race hotfix. |
| **`v02.00.03`** | Background sessions and durable reports. |
| **`v02.00.02`** | Publishing and dashboard sanitization. |
| **`v02.00.01`** | Public npm/package metadata alignment. |
| **`v02.00.00`** | Development package line hardening. |
| **`v2.0.0-alpha.2`** | Durable session recovery alpha. |
| **`v2.0.0-alpha.1`** | Model attestation and store hardening alpha. |
| **`v2.0.0-alpha.0`** | Initial API/SDK-only MCP server. |
## What It Does
`cross-review` is the stable API-first implementation of the cross-review
pattern. It orchestrates provider API clients (OpenAI/Codex, Anthropic/Claude,
Google Gemini, DeepSeek, xAI/Grok, and Perplexity) and provides an
MCP-compatible server surface.
Runtime calls are real provider calls by default. Stubs exist only for smoke
tests and CI when `CROSS_REVIEW_STUB=1`.
- OpenAI client library (`openai`) for the Codex/OpenAI peer.
- Anthropic TypeScript client library (`@anthropic-ai/sdk`) for Claude.
- Google Gen AI client library (`@google/genai`) for Gemini.
- OpenAI-compatible DeepSeek API through the OpenAI client library.
- OpenAI-compatible xAI Grok API through the OpenAI client library.
- OpenAI-Responses-compatible Perplexity Agent API through the OpenAI client library.
- The MCP SDK (`@modelcontextprotocol/sdk`) is declared as a
development dependency and bundled into the stdio artifact; its audited scope
is therefore `bundled/dev`, not an undeclared consumer dependency.
`package.json` is the source of truth for declared dependency ranges.
`package-lock.json` records the exact resolution for this repository checkout;
consumers resolve those ranges through their own lockfiles.
## Quick Start
```powershell
# Set API keys (PowerShell example)
[Environment]::SetEnvironmentVariable("OPENAI_API_KEY", "<OPENAI_API_KEY>", "User")
[Environment]::SetEnvironmentVariable("ANTHROPIC_API_KEY", "<ANTHROPIC_API_KEY>", "User")
[Environment]::SetEnvironmentVariable("GEMINI_API_KEY", "<GEMINI_API_KEY>", "User")
[Environment]::SetEnvironmentVariable("DEEPSEEK_API_KEY", "<DEEPSEEK_API_KEY>", "User")
[Environment]::SetEnvironmentVariable("GROK_API_KEY", "<GROK_API_KEY>", "User")
[Environment]::SetEnvironmentVariable("PERPLEXITY_API_KEY", "<PERPLEXITY_API_KEY>", "User")
```
Restart your terminal after changing environment variables.
Run the MCP host only from the package published by the registry; do not point a
production host at this checkout:
```bash
npm upgrade -g @lcv-ideas-software/cross-review --ignore-scripts --allow-git=none --allow-remote=none
```
For local smoke tests (no-cost):
```powershell
$env:CROSS_REVIEW_STUB = "1"
npm test
```
## Configuration
Model selection and runtime behaviour can be controlled with environment
variables. Example overrides (PowerShell):
```powershell
[Environment]::SetEnvironmentVariable("CROSS_REVIEW_OPENAI_MODEL", "gpt-6-astra", "User")
[Environment]::SetEnvironmentVariable("CROSS_REVIEW_OPENAI_REASONING_EFFORT", "max", "User")
[Environment]::SetEnvironmentVariable("CROSS_REVIEW_ANTHROPIC_MODEL", "claude-fable-5-1", "User")
[Environment]::SetEnvironmentVariable("CROSS_REVIEW_ANTHROPIC_REASONING_EFFORT", "max", "User")
[Environment]::SetEnvironmentVariable("CROSS_REVIEW_GEMINI_MODEL", "gemini-3.1-pro-preview", "User")
[Environment]::SetEnvironmentVariable("CROSS_REVIEW_DEEPSEEK_MODEL", "deepseek-v4-pro", "User")
[Environment]::SetEnvironmentVariable("CROSS_REVIEW_GROK_MODEL", "grok-4.7", "User")
[Environment]::SetEnvironmentVariable("CROSS_REVIEW_GROK_REASONING_EFFORT", "xhigh", "User")
[Environment]::SetEnvironmentVariable("CROSS_REVIEW_PERPLEXITY_MODEL", "perplexity/kimi-k3", "User")
[Environment]::SetEnvironmentVariable("CROSS_REVIEW_PERPLEXITY_REASONING_EFFORT", "high", "User")
```
`ultra` is a Codex product/CLI execution mode, not a literal OpenAI Responses
API `reasoning.effort`. Cross-review nevertheless accepts it in central config,
environment variables and per-call overrides as a compatibility alias, then
normalizes it inside each provider adapter. For `gpt-6-astra`, the wire value is
the official `max`; `ultra` is never sent to the Responses API. Using `max`
directly remains equivalent and makes the API value explicit. The shared
legacy value `minimal` is likewise translated to Astra's lowest active API
effort, `low` — Astra documents `low|medium|high|xhigh|max` and does NOT list
`none`, so `none` is raised to `low` rather than sent and rejected. Explicit older-model overrides use a family-aware compatibility
matrix: GPT-5.5/5.4/5.2 map `minimal` to `low` and `max`/`ultra` to `xhigh`;
GPT-5.1 maps `minimal` to `low` and `xhigh`/`max`/`ultra` to `high`; original
GPT-5 maps `none` to `minimal` and `xhigh`/`max`/`ultra` to `high`. Supported
native values pass through unchanged.
Claude Fable 5 is the canonical Anthropic pin. Its request deliberately omits
the explicit `thinking` field: Fable applies adaptive thinking automatically,
while `output_config.effort` controls depth. Anthropic documents a 30-day data
retention posture and no zero-data-retention option for this model. A response
with `stop_reason="refusal"` is recorded as `provider_refusal`, and partial
refusal output is not accepted as a review.
There is no second supported Claude model. cross-review runs the top model of
each provider, so the canonical pin is the whole admissible set. 128,000 output
tokens is the model's synchronous API ceiling — the most the provider will
accept, not the budget this package ships with. Unconfigured,
`maxOutputTokensForPeer()` falls through `max_output_tokens_by_peer` to the
global `CROSS_REVIEW_MAX_OUTPUT_TOKENS`, whose default is 20,000. Raising it to
the provider ceiling is part of setup, documented with the other per-peer
ceilings in `docs/api-keys.md`; the relator output-ceiling screen measures the
configured value, so a draft sized against 128,000 is refused until it is.
For Grok, `GROK_API_KEY` is canonical. The default pin is `grok-4.7`; xAI
accepts `low`, `medium`, `high`, or `xhigh` reasoning effort for it, so the
adapter normalizes `max`/`ultra` to `xhigh` before sending the request.
For Perplexity, `PERPLEXITY_API_KEY` is canonical. The default pin is
`perplexity/kimi-k3` on the Perplexity Agent API (OpenAI-Responses-compatible
`/v1/responses`). Sonar Chat Completions retires on 27/09/2026, so legacy
unprefixed Sonar ids are rejected with a migration diagnostic. The reviewer
role declares the `web_search` tool (billed per invocation); the relator role
never does. Both of those long roles run in Agent API background mode
(`background: true`, retrieved with `GET /v1/agent/{id}`) because Perplexity
severs a synchronous request at about 300 seconds; a background response has
to be retrievable, so those two requests send `store: true` and Perplexity
retains them. The probe stays synchronous and keeps `store: false`. See
[docs/architecture.md](docs/architecture.md) for the retention consequence.
Central configuration is loaded once when the MCP server process starts. Use
`server_info.config_load` to inspect the loaded path, parse result, loaded and
current SHA-256/mtime, and `reload_required`. `live_reload_supported` is
`false`: after editing `config.json` or host environment variables, restart or
reload the MCP host/window. A stale or invalid central config blocks paid calls
instead of silently spending under fallback defaults.
Evidence judges have independent compact controls:
`evidence_judge_autowire.max_output_tokens` defaults to `2048` and
`evidence_judge_autowire.reasoning_effort` defaults to `medium`. Unknown
in-flight provider cost blocks judge dispatch rather than being treated as
zero. Their environment-variable equivalents are
`CROSS_REVIEW_EVIDENCE_JUDGE_MAX_OUTPUT_TOKENS` and
`CROSS_REVIEW_EVIDENCE_JUDGE_REASONING_EFFORT`; as with the other central
settings, an explicit host environment value takes precedence over
`config.json`.
Evidence Broker admission is fail-closed and atomic. Its configurable defaults
are `8` requests per peer per round, `24` requests per round, `64` durable
items and `64,000` total request characters per session:
```json
{
"evidence_broker": {
"max_requests_per_peer_round": 8,
"max_requests_per_round": 24,
"max_items_per_session": 64,
"max_chars_per_session": 64000
}
}
```
Crossing a limit never truncates, discards or auto-satisfies a blocker. The
complete peer response remains durable, the checklist batch is rejected as a
unit, automatic judging is skipped and the session stops with
`evidence_checklist_contract_violation` before another paid round. Existing
oversized sessions stop before provider dispatch.
Financial and budget controls are required for paid provider calls. Configure
these environment variables before running real sessions (example):
```powershell
[Environment]::SetEnvironmentVariable("CROSS_REVIEW_MAX_SESSION_COST_USD", "20", "User")
[Environment]::SetEnvironmentVariable("CROSS_REVIEW_PREFLIGHT_MAX_ROUND_COST_USD", "20", "User")
[Environment]::SetEnvironmentVariable("CROSS_REVIEW_UNTIL_STOPPED_MAX_COST_USD", "20", "User")
```
## MCP Tools
- `server_info`
- `runtime_capabilities`
- `probe_peers`
- `session_init`
- `session_list`
- `session_read`
- `ask_peers`
- `session_start_round`
- `run_until_unanimous`
- `session_start_unanimous`
- `session_cancel_job`
- `session_recover_interrupted`
- `session_poll`
- `session_events`
- `session_metrics`
- `session_doctor`
- `session_report`
- `session_peer_reliability_report`
- `session_check_convergence`
- `session_preflight_check`
- `session_truthfulness_preflight_check`
- `session_attach_evidence` — optional durable attachment channel; AI callers
normally use the automatic `evidence` field on review starters
- `session_evidence_judge_pass`
- `session_evidence_judge_consensus_pass`
- `session_judgment_precision_report`
- `contest_verdict`
- `session_sweep`
- `session_finalize`
`session_events` returns at most 200 events by default, excludes
`peer.token.delta` telemetry unless `include_token_deltas=true`, and returns
`next_seq` plus `has_more` for bounded pagination. Set `limit` explicitly up to
1,000 when a larger forensic page is needed.
`session_poll` uses `detail="summary"` by default. The compact response keeps
operational progress, verdicts, bounded peer summaries and convergence data,
but omits complete prior-round peer `text`, `raw` and `structured`
payloads. Use `detail="full"` or `session_read` only for deliberate forensic
inspection. `active_round_number` names the round executing now, whereas
`latest_completed_round_number` names the newest round already appended to
durable history; during a live round these values can differ.
Every tool that accepts `response_format="markdown"` returns actual Markdown,
not a JSON object serialized inside a text block. Strings from callers, peers
and persisted sessions are HTML-neutralized before rendering.
`session_cancel_job` is idempotent around settlement races. A late request
for a known completed, failed or cancelled job returns `requested=false`,
`reason="job_already_terminal"`, `terminal_job` and `final_state`. When
the session itself is already terminal, the reason is
`session_already_terminal`. Compact job status is persisted per session so a
sibling MCP host or a restarted runtime can return the same answer without
requiring process-local memory.
`session_doctor` separates real and stub sessions, flags terminal outcomes that
lack terminal events, and reports peer-call cost separately from generation
artifact cost. Terminal `max-rounds` and terminal `not_resurfaced` history stay
in totals but are omitted from default operational findings; pass
`include_terminal_findings=true` to enumerate that historical inventory.
`session_report` uses the same cost split and calls out `not_resurfaced`
evidence checklist items as inference-only, not proof that the requested
evidence was satisfied. If a session otherwise reaches unanimity with open or
`not_resurfaced` checklist items, finalization records an
`*_with_unresolved_evidence` outcome reason and emits a durable unresolved
evidence event. `session_peer_reliability_report` is read-only and aggregates
per-peer parser warnings, evidence ask status, provider failures, cost and
latency.
## Anti-deception and evidence custody
The runtime does not treat a peer's claim that work was completed as proof.
Before paid calls and again during convergence, it checks runtime/model claims,
workflow and authorization assertions, test/build/hash claims, concrete source
correspondence, unresolved evidence asks, model attestation, and structured
status completeness. Authenticated caller evidence supplied inline or through
the `evidence` field is persisted with an integrity digest and transported to
every reviewer as `CALLER-SUBMITTED / UNVERIFIED`, which is the only
provenance an attachment can carry. Each external submission atomically supersedes the active caller
snapshot while preserving prior manifests for audit, so retries cannot inherit
old failures or replay old successes. Every `READY` vote must cite sources traceable to the reviewed
artifact or admitted evidence. When operational claims depend only on
peer-submitted material, at least two independent non-author reviewers must use
`confidence="verified"` and cite the attachment path, SHA-256 and correlated raw
lines; one voter, inferred confidence or narrative repetition cannot converge.
Relator output that invents operational evidence is rejected rather than
propagated; a source that quotes an admitted attachment literally — a GitHub
URL the provider escaped included — is not treated as invented, and a file
whose post-image an admitted unified diff carries is not treated as
unattached.
`READY` is intentionally not free-form. Its `summary` must be exactly
`No blocking objections remain.`, `caller_requests` and `follow_ups` must be
empty, and no narrative may appear outside the JSON/status envelope. Detail
belongs in `evidence_sources`. This removes synonym/negation ambiguity: any
noncanonical READY becomes `NEEDS_EVIDENCE` and cannot converge.
Each attachment-backed `evidence_sources` item has one canonical string format:
```text
Attachment: evidence/review.txt
sha256=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Artifact quote: "Tests 74 passed (74)"
```
This block shows the decoded string; a raw JSON response encodes its two line
breaks as `\n`.
The path and full 64-character lowercase digest identify the same persisted
attachment, and `Artifact quote` is a literal from that attachment. The quote
must be at least 12 characters and must end the item. Cite the smallest
sufficient literal (normally no more than 500 characters); the hard limits are
2,500 characters per whole item and 30 items. Multiple sources belong in
separate array items—never join attachments or append rationale after a quote.
The wire type deliberately remains `string[]`, so existing string-producing
clients remain compatible; the runtime does not require citation objects.
These limits are both anti-verbosity and anti-shortcut controls. A peer must
inspect the artifact and cite the decisive raw value, but must not replace a
review with a full-file, full-log, or provider-output dump. A bare filename,
digest, generic assurance, or empty code fence cannot sustain `READY`.
`session_attach_evidence` is an optional durable attachment channel, open to
the session's own petitioner. It is never required for an ordinary review: the
runtime directs callers to the automatically persisted `evidence` field, and
the attachment carries exactly the same provenance either way. Each new
attachment records the verified caller, origin, timestamp, byte count and
SHA-256, emits a durable custody event, and is re-hashed on every read.
Tampering fails closed. There is no tier above caller-submitted, so no
attachment promotes itself: a generic attachment does not by itself prove an
unrelated claim.
Terminal closure is different. The runtime alone seals `converged`; the
persisted session petitioner closes its own
non-terminal session as `aborted` through `session_finalize`; `max-rounds`
is written only by the runtime or the idle sweep; and sessions left open by a
dead petitioner are aborted by the boot-time stale sweep after 24 hours. No
tool escalates to a human: the MCP surface has no such actor.
An evidence requester may automatically withdraw only its own earlier ask after
a strictly grounded `READY/verified` recheck. That transition is recorded as
`requester_reverified`; silence remains `not_resurfaced`, and no peer can close
another peer's ask or a terminal item.
On an existing session, review starters require the persisted petitioner
token. Evidence is attributed to the authenticated invoker rather than
inherited from the session owner, so a peer cannot inherit another caller's
provenance by continuing its session.
Caller identity uses six distinct local capabilities, one per peer. A seventh
existed for an `operator` identity whose token was meant to live in a separate
human console; that host does not exist, because the whole surface is MCP and
is exercised by agents, so the capability bound a secret to nobody and is gone.
`host-tokens.json` contains secrets and assumes the local
OS account/data directory is trusted. The runtime now removes inherited NTFS
ACLs from this file on Windows and grants only the current user, SYSTEM and
Administrators; on POSIX it verifies owner-only mode `0600`. This blocks direct
read access inherited by model-sandbox groups, but it is not isolation from
another process running as the same unrestricted OS user.
`session_cancel_job`, `contest_verdict` and `session_finalize` accept only the
explicitly persisted session petitioner with its peer token. A legacy session
without an explicit petitioner yields no derivable owner and is refused; the
idle sweep closes it after 24 hours.
## Repository conventions
- **License**: [Apache-2.0](./LICENSE). See [NOTICE](./NOTICE) and [THIRDPARTY](./THIRDPARTY.md).
- **Security disclosure**: see [SECURITY.md](./SECURITY.md).
- **Code of conduct**: see [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md).
- **Changelog**: [CHANGELOG.md](./CHANGELOG.md).
- **Contributing**: see [CONTRIBUTING.md](./CONTRIBUTING.md).
- **Sponsorship**: see the repo's `Sponsor` button or [central sponsor page](https://www.lcv.dev/sponsor).
- **Action pinning**: all GitHub Actions are pinned by full SHA per supply-chain hardening baseline.
- **Code owners**: [.github/CODEOWNERS](.github/CODEOWNERS).
## Links
- Site: [https://cross-review.lcv.dev](https://cross-review.lcv.dev)
- npmjs.com: [https://www.npmjs.com/package/@lcv-ideas-software/cross-review](https://www.npmjs.com/package/@lcv-ideas-software/cross-review)
- GitHub: [https://github.com/LCV-Ideas-Software/cross-review](https://github.com/LCV-Ideas-Software/cross-review)
- Sponsors: [https://github.com/sponsors/LCV-Ideas-Software](https://github.com/sponsors/LCV-Ideas-Software)
## License
Apache-2.0. See [LICENSE](./LICENSE), [NOTICE](./NOTICE), and [THIRDPARTY](./THIRDPARTY.md).
---
<p align="center"><span style="font-size: 1.5em;"><strong>Copyright © 2026 LCV Ideas & Software</strong></span><br><sub>LEONARDO CARDOZO VARGAS TECNOLOGIA DA INFORMACAO LTDA<br>Rua Pais Leme, 215 Conj 1713 - Pinheiros<br>São Paulo - SP - CEP 05424-150<br>CNPJ: 66.584.678/0001-77 - IM: 3039854</sub></p>
TDQS
B3.2/5.0
Scored across 28 tools
Disambiguation3/5
Most tools have distinct roles, but there is meaningful overlap among state-inspection tools (session_read, session_poll, session_events, session_check_convergence) and between the synchronous/asynchronous round-starting variants. The deliberate alias session_truthfulness_preflight_check also adds avoidable ambiguity.
Naming Consistency4/5
The dominant session_* family is consistently snake_case and action-oriented, and even the non-session tools use clear lowercase_snake names. Minor deviations like server_info, runtime_capabilities, and run_until_unanimous break the strict pattern but are not seriously confusing.
Tool Count2/5
At 28 tools, the surface is above the comfortable range and feels bloated, with several maintenance, telemetry, and inspection variants that could plausibly be consolidated. While the domain is complex, the alias tool and overlapping read/state operations suggest the count is not fully justified.
Completeness4/5
The lifecycle is well covered: session creation, reading, polling, round execution, evidence handling, judgment, convergence checking, reporting, cancellation, recovery, finalization, and contestation are all present. Minor gaps like explicit session export or deletion exist, but the append-only session design makes those omissions reasonable.
Maintenance
ActivityActive
ResponsivenessResponsive