Bound Background Review cost and require surfaced disposition

[shiny-code-bot]

Finish Line

Background Review is predictably bounded and actionable during real dogfood: it has hard scope, elapsed-time, and cumulative-token ceilings; it reports why it stopped; and current findings receive an explicit user/agent disposition instead of arriving silently after handoff.

Current Status

The July 17-18, 2026 live run completed after roughly 17 minutes and reported about 2.55 million total tokens, mostly cached, from an estimated review prompt of about 6,186 tokens. One finding arrived after the main agent had already declared the task complete. Follow-up review found that the exact claim overstated an unshipped intermediate implementation, although it still exposed useful coverage and scope concerns.

Codex Lab already caps captured review diff bytes and persists token usage after completion, but the detached spawn_detached_review_thread() path has no hard wall-clock or cumulative-token ceiling. Durable control supports cancellation reasons such as timeout/budget, but no automatic budget policy owns that transition.

Completed July 18, 2026: bounded execution, durable diagnostics/disposition, deterministic fixtures, and provenance-recorded live dogfood proof are implemented in PR #377.

Scope

• Background Review prompt/scope, elapsed-time, cumulative-token, output, and finding-count limits.
• Automatic cancellation/skip reasons with durable diagnostics.
• Current/stale target verification at completion.
• Idle-session notification and explicit finding disposition.
• Bounded live-provider proof after deterministic fixtures.

Acceptance Criteria

• Every Background Review starts with explicit effective scope, elapsed-time, token, output, and finding-count limits.
• Exceeding a limit terminates the worker and records a durable cancelled or skipped result with a structured budget reason.
• Token usage is enforced during the run rather than only recorded after completion.
• Status surfaces elapsed time, tokens used, effective limits, and the terminal reason without exposing unbounded raw output.
• Completion rechecks target freshness; stale/off-target findings cannot become actionable current findings.
• A current finding creates a persistent attention state with an explicit disposition: open a bounded repair turn, acknowledge/defer, or mark obsolete with reason.
• A clean review settles quietly but remains inspectable; a failed or budget-cancelled review is visible without stranding the session.
• Deterministic fixtures cover timeout, token ceiling, oversized scope, stale completion, empty output, and actionable current findings.
• A provenance-recorded real dogfood review completes within the accepted budget and is dispositioned before cutover evidence is declared complete.

Relationships

• Parent: Cut over the primary coding-agent harness from Every Code to Codex Lab #343 primary-harness cutover.
• Related: Rework durable Background Review around upstream review primitives #231 durable Background Review architecture.
• Related: Design Auto Review run control plane #72 durable review control plane.
• Related: Dogfood Codex Lab through ChatGPT GUI remote access #365 GUI remote-access dogfood.
• Depends on the detached-review terminal lifecycle repair discovered during July 17-18 dogfood.

Validation

• Fake reviewer streams with deterministic time/token growth and cancellation.
• Core persistence/control tests plus app-server/TUI status tests.
• One bounded live review on a representative Codex Lab diff with exact source and binary provenance.

Decisions

• A review that is detached is not allowed to be unbounded.
• Do not treat cached tokens as free for budget and latency diagnostics.
• Preserve raw detail for bounded inspection, but make the disposition state the primary product surface.

Completion Evidence

• PR: feat(auto-review): bound background review execution #377
• Source SHA: 0e3eb23201b06767c27dbc299e41206ec935c811
• Candidate binary SHA-256: 67ca3c1b186639c917d1516ade19778108f16ce21bbadcaf6f9680ed3c0ef057
• Live review run: 34026fd7-6645-4f57-9185-1553a5eba17c
• Effective budget: 120,000 scope bytes; 180,000 ms; 250,000 total tokens; 32,768 output bytes; 5 findings
• Observed usage: 1,123 scope bytes; 61,318 ms; 15,658 total tokens; 1,068 output bytes; 1 finding
• Result: current completed run; the intentional u64 underflow was found as P1.
• Disposition: obsolete by agent with reason deliberate disposable dogfood fixture; not a production change.
• The run also exposed a narrow-width TUI diff-rendering panic, fixed and regression-tested in 0e3eb23201.

[shiny-code-bot]

Completed by merged PR #377 (merge commit 8f7e2f1). Deterministic coverage and the provenance-recorded bounded live review passed; run 34026fd7-6645-4f57-9185-1553a5eba17c completed within the effective budget and its fixture finding was explicitly dispositioned obsolete before merge.