[tpouyer]

Summary

Adds ADR 0112: fullsend run resolves runtime, model, effort and persona models per task, on the host, before the sandbox exists, from a routing: block in .fullsend/config.yaml. Today every choice is static per agent (ADR 0091, ADR 0104), so a one-line docs change and a 2,000-line CI refactor get the same opus-at-high review. Docs only; no code.

This PR supersedes #7251, as @waynesun09 suggested. His two commits are cherry-picked unchanged, keeping authorship and sign-off. Four follow-up commits address the reviews on #7251 and on this PR, and align the ADR with entity-first dispatch (ADR 0098) and declarative repo configuration (ADR 0122). The last one (everything since @waynesun09's review on 3e2289efc) also trims the ADR from about 313 to 86 content lines so it records one decision, per skills/writing-adrs. The implementation requirements it removed are left to the implementation work that follows once a design is chosen.

Status: draft, one of two options. This PR is a draft alongside a second draft PR that decides the same question with the harness-overlay approach @ifireball suggested. Both are open so the team can compare the options and give feedback before either moves forward.

Related Issue

Refs:

• Review model routing should use diff complexity, not just author type #5777, Add pre-flight scope heuristic to adjust review effort/model for trivially-scoped PRs #6891, Review agent: use cheaper model for trivial bot-authored PRs #2842, Review agent should downgrade sub-agent models based on scope classification, not just author identity agents#497: a cheaper model or effort for trivially scoped changes
• Review agent should escalate security sub-agent depth based on PR labels and file-path signals agents#535: deeper review on security signals
• Add cost impact preview for harness model configuration changes #6560: a cost preview before a model change
• Validate model availability before review sub-agent dispatch to avoid wasted retries #6964, Add a pre-merge CI check that validates .fullsend/config.yaml model routing against models actually served by the production Vertex AI project agents#1225, pi: per-repo model catalog for Vertex Claude (ids pi's bundled catalog lacks) and a pre-sandbox availability preflight #6883: retry-on-unavailable incidents, which the served-model preflight answers
• Implement pi fullsend-models.js: cross-provider fallback chain, phases, and budget #6531: the routing advisor, deferred

This PR records the decision and closes none of these, since each still needs the implementation.

Changes

The decision, in brief

• Scope: routing configures a run that dispatch has already authorized (ADR 0098). It never decides whether a run happens.
• Where it lives: .fullsend/config.yaml. For repos that ADR 0122 manages, it's declared in repos.yaml, and any change that loosens routing counts as a relaxation under 0122's safety gate.
• Shape: routing.rules[] with agents:, a CEL when:, an optional mode: and a set: of the four fields an agents: entry holds.
  • Matching rules merge later-wins per field.
  • While any escalation matches, no field falls below the static choice, and a field with no order (runtime, or a model of the same model tier) keeps its static value.
  • routing.mode is off (the default), shadow or enforce. A rule's own mode may act less than the block's, never more. A malformed block fails the run.
• Precedence: flags and FULLSEND_* variables › routing.rules › the agent's agents: entry › the repo default.
• Inputs: an allowlisted, system-reported environment with change stats and paths, actor, labels, attempt count, and the linked issue's number, state and labels.
  • Rules never see author-written text.
  • Paths and stats are chosen by the author, an accepted risk. A downgrade still never applies to a change that touches agent-instruction or policy files.
  • A downgrade may key on a label or actor only through a reviewed trust list that fails closed, and only on evidence the change's author can't supply. An escalation may key on anything visible.
• Guards:
  • What counts as an escalation: the rule keeps the runtime and moves every other field up or leaves it unchanged. Anything else is a downgrade, including a runtime change or a swap to another model of the same model tier.
  • Models: they come from routing.allowed_models (empty by default) and the catalog.
  • Protected agents: agents in never_downgrade (by default triage, prioritize and review; the list can only grow) keep their runtime and keep or raise their model. Their personas keep their static model tier unless a persona file sets a lower min_tier, and escalations may raise both.
  • No self-routing: routing: and min_tier: come from the base branch or pinned harness, never from the change being routed.
  • Preflight: with routing on, every model is checked against its provider's served list. A routed model that isn't served falls back to static. A static model that isn't served fails the run only when nothing in its existing fallback chain is served.
• Echo: the plan block, metrics.json, the root span and the status comment name the rules that set each field and the rules a guard suppressed.
• Learning: offline only. A ledger on the root span (ADR 0050) is joined with later forge outcomes and replayed. A reviewed edit to routing: is the only path to production, and a downgrade rule moves to enforce only after replay shows it never downgraded a PR whose review later requested changes.

Options rejected:

• Per-prompt routing inside the sandbox (feat(sandbox): opt-in Costwise model routing hooks + ADR 0090 (POC) #6361). It reads prompts the author controls and loses the prompt cache mid-loop.
• A Route-job heuristic (Add pre-flight scope heuristic to adjust review effort/model for trivially-scoped PRs #6891). It works only on GitHub and adds a second decision point.

An LLM gateway stays an optional provider that must report which model actually served.

Deferred: a routing advisor that reads the diff (#6531). An advisor escalation may fire on its own. A downgrade may use the advisor's assessment only as one condition, and the rule must still match with that condition removed. The advisor's classifier (such as a decision model like Jev or Laya) is an open question in adaptive-agent-selection.md.

Living documents updated

• docs/architecture.md: one Decided line under Agent Runtime, marked not yet implemented.
• docs/problems/adaptive-agent-selection.md and operational-observability.md: annotations on the open questions this partly answers, plus the decision-model open question.
• docs/ADRs/0091-per-agent-runtime-model-effort.md: a forward link from its precedence chain.
• docs/contributing/tier-conventions.md: a new model tier row.

Left to implementation

• the trusted-label and trusted-actor tests and the list of protected paths
• the CEL environment and its edge cases (null guards, truncated listings, renames)
• merge and classification mechanics, and how shadow mode interacts with the floor
• the preflight fallback and revert sequence
• escaping for the echo
• runtime notes (Claude Code's CLAUDE_CODE_SUBAGENT_MODEL and the codex persona status)
• presets and layered config
• extending ADR 0122's gate to cover routing
• the advisor's candidate output shape

How it compares with #7842

	This PR (routing: policy)	#7842 (overlays)
Where routing lives	.fullsend/config.yaml routing: block (or repos.yaml under ADR 0122)	Harness overlays:
Fields routed	runtime, model, effort, persona models	model, effort
New mechanism	Rules, modes (off/shadow/enforce), trust lists	None; reuses ADR 0088
Repo-level routing without a custom harness	Yes	Deferred to a repo-override ADR
Downgrade trust	Reviewed trust lists that fail closed	Allowlisted inputs; harness authors own label-keyed downgrades
Protected agents	never_downgrade list	Floor on triage/prioritize/review and harnesses composed on them

Review follow-up

Round 1: review agent on #7251 (9 findings)

Finding	Resolution
Review orchestrator protected only "by implication" in never_downgrade	Named in the defaults. Its model can be raised but never lowered
No downgrade classification	Every field is compared with static: effort scale and catalog model tier
Persona min_tier undefined	A persona-file floor on routed models
subagents replaced as a whole field	Per-key merge (ADR 0104), left to implementation
Preflight fallback undefined	Routed miss falls back to static; static miss fails only when its fallback chain has nothing served
event not redacted	Explicit, allowlisted inputs
Linked-issue "metadata" too broad	Number, state and labels only
No fail-closed defaults	mode: off, empty lists, a malformed block fails the run
cross-run-memory.md outside relates_to	Annotation dropped

Round 2: review agent on this PR (14 findings)

Severity	Finding	Resolution
High	Bots and Apps satisfy the trusted-label provenance rule	The ADR requires evidence the change's author can't supply; the exact human-labeller test is left to implementation
Medium	A malformed block both errors and runs the static choice	Fails the run before the sandbox
Medium	never_downgrade pins only the orchestrator's model	Personas are floored at their static model tier unless they opt in
Medium	Classification ignores runtime changes	A runtime change or a same-model-tier swap is a downgrade
Medium	"Effort before model" reads as validated	Left to authoring guidance during implementation
Medium	Environment features credited to ADR 0098	Routing's own allowlisted environment
Medium	Poll runs carry a bot service actor	task.actor is null on poll, schedule and manual runs, left to implementation
Medium	Denylist over a growing schema	Explicit allowlist
Medium	A later downgrade can undercut an escalation	While any escalation matches, nothing falls below static
Medium	No defaults for trusted_labels and allowed_models	Empty by default
Medium	architecture.md states the decision as shipped	Marked not yet implemented
Low	No-retry claim conflicts with fallback chains	The preflight respects each runtime's existing fallback chain
Low	Advisor constraint not checkable	"Must still match with the assessment removed"
Low	A fourth meaning of "tier"	"model tier", now in tier-conventions.md

Round 3: @waynesun09 and @ifireball

Finding	Resolution
Codex "no persona roster" stated as a decision (#7809)	The ADR no longer carries a per-runtime inventory; the servability rule is left to implementation
"Fallback chain on Claude only" is false (pi has one)	Removed; the ADR refers to each model's existing fallback chain
CLAUDE_CODE_SUBAGENT_MODEL has no effect on fullsend personas; _FORCE	Removed from the ADR and left to implementation, limitation included; _FORCE dropped
A decision model's confidence is not portable	The abstention threshold comes from the probability distribution; the detail is left to implementation
Catalog tier stated in present tense	Consequences: "Implementing this adds a model tier to catalog entries"
#6527 is closed	Cited only as the origin of the rule
The echo omits suppressed rules	The echo names the rules a guard suppressed
Missing prompt-cache argument	Added to Options
Jev/Laya block too long	Shortened in adaptive-agent-selection.md
@ifireball: route through harness overlays instead	Written up as a separate draft PR so both options can be compared; see Notes for review

Local pr-review passes before pushing

The pr-review persona prompts (correctness, security, intent-coherence, docs-currency, style-conventions, risk-assessment, then the challenger) were run locally over twelve rounds, until only low findings remained.

After the trim, those passes also led to these changes:

• restoring the full escalation floor
• stating that the preflight respects fallback chains and runs only with routing on
• stating the trust principle and the exclusion for agent-instruction and policy files
• stating precedence over the agents: entry
• letting escalations raise protected agents' models
• defining an escalation as keeping the runtime and changing a model only to a higher model tier

Three low findings were declined:

• annotating accepted ADR 0122 (extending the gate is left to implementation)
• the heading the architecture.md bullet sits under (there's no decided-but-unimplemented list)
• the file slug (renaming would change links in five files)

Example config

An illustrative .fullsend/config.yaml for this repo under the ADR. The ADR fixes the concepts, not the schema: the task.* field names, the catalog's tier names and the account ID below are placeholders.

routing: block on this repo's config

agents:
    - name: code
      runtime: pi
      model: xai/grok-4.6
    - name: fix
      model: sonnet
    - name: review
      runtime: pi
      model: sonnet
      subagents:
        challenger: xai/grok-4.6
        correctness: xai/grok-4.6
        docs-currency: google-vertex/gemini-3.8-flash
        security: xai/grok-4.6
        style-conventions: google-vertex/gemini-3.8-flash

routing:
    mode: enforce                    # off (default) | shadow | enforce
    allowed_models:                  # closed set; "lower" comes from the catalog model tier
        - opus
        - sonnet
        - haiku
        - xai/grok-4.6
        - google-vertex/gemini-3.8-flash
    never_downgrade: [code]          # added to the built-in triage, prioritize, review
    # Trust lists are empty unless set, and fail closed. A listed label or actor
    # counts for a downgrade only on evidence the change's author can't supply
    # (the exact tests are left to implementation).
    trusted_labels: [docs-only]
    trusted_actors: [12345678]       # immutable account ID (placeholder), never a login

    rules:
        # Downgrade: review keeps its model; effort and the personas that opt in
        # move (challenger and correctness declare a lower min_tier, see below).
        # It stays in shadow until replay shows it is safe. Like every downgrade,
        # it is suppressed when the change touches agent-instruction or policy
        # files, even under docs/.
        - name: docs-only-review
          agents: [review]
          mode: shadow               # may act less than the block, never more
          when: >-
            task.change.complete &&
            task.change.lines < 50 &&
            task.change.paths.all(p, p.startsWith("docs/"))
          set:
              effort: low
              subagents:             # per-key merge (ADR 0104)
                  challenger: google-vertex/gemini-3.8-flash
                  correctness: google-vertex/gemini-3.8-flash

        # Downgrade keyed on a trusted label.
        - name: docs-only-fix
          agents: [fix]
          when: >-
            "docs-only" in task.labels &&
            task.change.complete &&
            task.change.paths.all(p, p.startsWith("docs/"))
          set:
              effort: low
              model: haiku
              subagents: { default: haiku }

        # Downgrade keyed on a trusted actor; task.actor is null on poll,
        # schedule and manual runs, so the null test is required.
        - name: bot-deps-code
          agents: [code]
          when: >-
            task.actor != null && task.actor.kind == "bot" &&
            task.change.complete &&
            task.change.paths.all(p, p == "go.mod" || p == "go.sum")
          set: { effort: low }

        # Escalation: any label may trigger it, and it may raise review's model
        # and personas; while it matches, no other rule can lower a field.
        - name: security-escalate
          agents: [review]
          when: >-
            "security" in task.labels ||
            task.change.paths.exists(p, p.startsWith("internal/scaffold/"))
          set:
              model: opus
              effort: xhigh
              subagents: { security: opus, challenger: opus }

        # Escalation on a second attempt: same runtime, a higher model tier, and
        # effort at or above static.
        - name: retry-escalate
          agents: [code, fix]
          when: task.attempt >= 2
          set: { model: opus, effort: high }

Persona floors live in the persona files, not in config.yaml, and are read from the pinned harness. For an agent in never_downgrade, a persona with no min_tier is floored at its static model tier:

# sub-agents/challenger.md (same for correctness): opts in to the docs-only-review downgrade
---
name: challenger
min_tier: economy    # routed models only; static subagents.challenger still resolves per ADR 0104
---

Config validation would reject these rules:

- { name: bad-review-downgrade, agents: [review], when: "task.change.lines < 10",
    set: { model: haiku } }                        # review never loses model tier
- { name: bad-review-swap, agents: [review], when: "task.change.lines < 10",
    set: { model: xai/grok-4.6 } }                 # if grok-4.6 shares sonnet's model tier: a swap is a downgrade
- { name: bad-review-runtime, agents: [review], when: '"security" in task.labels',
    set: { runtime: claude } }                     # never-downgrade agents keep their runtime
- { name: bad-comment-key, agents: [review],
    when: 'event != null && event.transition.comment.body.contains("typo")',
    set: { effort: low } }                         # comment text is outside the allowlist
- { name: bad-unguarded-actor, agents: [code], when: 'task.actor.kind == "bot"',
    set: { effort: low } }                         # nullable input read without a null test
- { name: bad-model, agents: [code], when: "task.attempt >= 3",
    set: { model: gpt-6-sol } }                    # not in allowed_models
- { name: bad-persona-floor, agents: [review], when: "task.change.lines < 20",
    set: { subagents: { security: haiku } } }      # security has no lower min_tier under review
- { name: bad-mode, agents: [code], mode: enforce, when: "task.attempt >= 2",
    set: { effort: high } }                        # in a `mode: shadow` block: a rule may not act more than its block

Testing

• make lint passes (stage changes first, then run). All pre-commit hooks pass on the six changed files, including lint markdown links (lychee 0.24.2), the ADR status, number and frontmatter lints, and gitlint.
• Tests added or updated for new or modified logic: N/A, docs only.

Notes for review

• Overlay-based alternative (@ifireball): draft docs(adr): let overlays set any harness field and route models #7842 rewrites this ADR to route through harness overlays and the existing when: expressions. This PR keeps the separate routing: block and makes no claim about overlays either way, so the two can be compared side by side.
• ADR 0122 gate: the ADR puts any loosening of routing under 0122's safety gate. 0122 compares no routing setting today, so extending the gate is part of the implementation. Accepted ADR 0122 is not edited here.
• Entity-spec dependency: the trusted-label test needs, from ADR 0098's future entity spec, labels with who applied them and their permission, and the head commit at the time the label was applied. Without these fields, the guard fails closed.
• Catalog fields: implementing the ADR means adding tier and vendor to catalog entries, which don't exist today.
• ADR number: 0112 is unused on main, and only this PR and docs(adr): route runtime and model per task from a config policy #7251 claim it. Re-check with the renumber-adr skill before merge.
• Implementation phases are follow-up work if this option is chosen: task context and preflight; the routing: schema with shadow mode; in-run escalation on pi and Claude Code; then replay and the cost preview.

Checklist

• PR title follows Conventional Commits (correct type, ! for breaking changes)
• Commits are signed off (DCO) — human and human-directed agent sessions only
• I wrote this contribution myself and can explain all changes in it

🤖 Generated with Claude Code

[github-actions]

E2E tests did not run

E2E tests run automatically for org/repo members and collaborators on pull requests.

For other contributors, a maintainer with write access must add the ok-to-test label after the latest push.

See E2E testing guide for details.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can route each severity your way: inline, summary, both, or drop

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Previous reviews

Review updated until commit cd903f6 ⏭️ Skipped

Results up to commit 1f76d83 ⏭️ Skipped

No changes from previous review

[qodo-code-review]

PR Summary by Qodo

Document host-side, per-task runtime and model routing policy

📝 Documentation 🕐 20-40 Minutes

AI Description

• Record a proposed policy for choosing runtime, model, effort, and persona models per authorized
 task.
• Define routing precedence, safety guards, served-model checks, and shadow-to-enforce requirements.
• Link the decision to existing configuration, dispatch, architecture, and observability
 documentation; no code changes.

Diagram

graph TD
  A["Authorized task"] --> B["System task facts"] --> C["Host routing policy"] --> D{"Guards and preflight"} --> E["Sandbox run"]
  F["Static agent config"] --> C
  D --> G["Routing ledger"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Harness-overlay routing

• ➕ Could reuse existing harness overlay configuration rather than add a separate routing policy surface.
• ➖ Needs a clear way to preserve per-task precedence, host-side safety guards, and a single decision point after dispatch.

Recommendation: Keep the host-side policy as a draft option while comparing it with the parallel harness-overlay proposal. Its separation from dispatch and sandbox execution is coherent, but the team should choose one configuration surface before implementation.

Files changed (6) +131 / -3

Documentation (6) +131 / -3

0091-per-agent-runtime-model-effort.mdClarify planned routing precedence +4/-0

Clarify planned routing precedence

• Notes that ADR 0112 would place per-task rules below per-run variables and above static agent entries. Explicitly marks the change as not yet implemented.

docs/ADRs/0091-per-agent-runtime-model-effort.md

0112-task-grain-routing-policy-on-the-host.mdRecord the proposed per-task routing decision +121/-0

Record the proposed per-task routing decision

• Defines host-side rule evaluation, precedence, trusted inputs, downgrade guards, served-model checks, observability, and offline replay. Distinguishes routing from dispatch authorization and defers the diff-reading advisor.

docs/ADRs/0112-task-grain-routing-policy-on-the-host.md

architecture.mdPlace routing in the runner architecture +1/-0

Place routing in the runner architecture

• Adds the planned host-side routing step and its precedence, rollout, and guard constraints alongside existing runtime selection.

docs/architecture.md

tier-conventions.mdDefine model-tier terminology +1/-0

Define model-tier terminology

• Adds the proposed catalog model tier to the list of distinct tier concepts, noting its use for routing comparisons and persona floors.

docs/contributing/tier-conventions.md

adaptive-agent-selection.mdConnect adaptive selection questions to routing +3/-2

Connect adaptive selection questions to routing

• Identifies which selection and safety questions ADR 0112 addresses through guarded, offline-evaluated policies. Retains open questions about fitness scoring and a future routing advisor.

docs/problems/adaptive-agent-selection.md

operational-observability.mdDocument planned routing telemetry +1/-1

Document planned routing telemetry

• Notes the proposed root-span routing ledger as a way to compare task facts and decisions with later outcomes.

docs/problems/operational-observability.md

[github-actions]

Site preview

Preview: https://eca528eb-site.fullsend-ai.workers.dev

Commit: 3a5467d41df1f54dfc41af26b3876a92b560b7db

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[waynesun09]

/fs-review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:31 PM UTC · Completed 7:57 PM UTC

Commit: 3a5467d · View workflow run →

Runtime: pi · Model: sonnet → claude-sonnet-5 · Effort: high · Cost: $7.57

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Docs-only ADR update with no protected paths or code changes, elevated to moderate risk by high commit churn, regression history, and co-change coupling on touched architecture documentation.

[fullsend-ai-review]

Review

Findings

High

• [fail-open] docs/ADRs/0112-task-g....md:117 — trusted_labels is the only extra trust gate on a label-keyed downgrade, but the stated provenance rule (actor is not the PR author AND holds current forge permission >= write, per ADR 0098) is satisfied by GitHub Apps, autolabel bots, and fullsend's own post-scripts — ADR 0098 exposes only current permission and does not distinguish human from bot/App identity. Those bot identities typically hold installation write and are never the PR author. The deferred routing-advisor section explicitly forbids the advisor from labeling its own outcome; the in-scope trusted_labels control has no equivalent restriction. As written, an author-controlled diff or issue body could be laundered into a trusted downgrade key (e.g. a size/documentation autolabel) without a human write-holder ever judging the change — undermining the ADR's central "no author-controlled input can trigger a downgrade" guarantee.
  Remediation: Require that a label may satisfy a downgrade rule only when the applying actor is human (excluding bot/App/fullsend-agent identities), held write (or higher) at the time the label was applied, and is not the PR author. Default trusted_labels to empty until this is specified.

Medium

• [logic-error] docs/ADRs/0112-task-g....md:107 — Decision 1 states in the same sentence that a malformed routing: block is a config-time error and that "the static choice runs" — contradictory fail-closed/fail-open semantics. ADR 0091 documents that fullsend run does not call Validate() on the loaded config, so an implementer following both records as written could silently skip routing (including any security-escalation rules in the same block) on malformed YAML rather than failing the run.
  Remediation: State one semantics only — either a malformed routing: block fails fullsend run before the sandbox exists, or it is treated as mode: off with an explicit, echoed validation error. Do not assert both outcomes for the same failure.

• [fail-open] docs/ADRs/0112-task-g....md:145 — never_downgrade (default triage, prioritize, review) is meant to preserve Runtime parity backlog: deferred runtime/model UX items (pi Agent tool, per-role models, per-run overrides, model switching, other clouds) #6527's "the deciding session is never downgraded" rule, but as written it only pins the orchestrator model. The same paragraph explicitly allows a downgrade rule for review to move effort and subagents, and merge includes ADR 0104 ~ tombstones. Persona min_tier is optional and floors only routed persona models, so an unset floor is no floor. A downgrade rule can lower review's effort and tombstone the security/challenger personas while technically "keeping" the orchestrator on opus — a real reduction of safety coverage on the review path. docs/problems/adaptive-agent-selection.md's new annotation overstates this guard without the caveat.
  Remediation: For agents in never_downgrade, either forbid routed reductions of review's effort and subagent tombstones outright, or require a mandatory default min_tier on safety-relevant personas. If the intent is genuinely model-ID-only protection, say so explicitly and soften the stronger claim in adaptive-agent-selection.md.

• [logic-error] docs/ADRs/0112-task-g....md:127 — Downgrade vs. escalation is classified only from the resolved model/effort delta. A rule whose set: changes only runtime (or a same-tier model, or a subagents tombstone) is always an "escalation" by this definition regardless of intent — so it may key on any label, bypassing the trusted_labels/provenance gate, and isn't subject to the poll/actor restriction. Combined with Decision 1 permitting runtime inside set:, an author-applied-label rule against review that only changes runtime slips past every downgrade guard.
  Remediation: Classify downgrade/escalation from the fully resolved, post-merge result per (rule, agent, persona), not solely from whether set: lowers the model/effort ordinal.

• [logic-error] docs/ADRs/0112-task-g....md:153 — Decision 5 states a strict sequential algorithm ("effort on the same model first, then a lower catalog tier, then across vendors"), but Decision 1 lets a single set: assign runtime/model/effort/subagents together, and the Consequences example ("sonnet at low effort for docs-only changes") sets model and effort in one rule, not in sequence. Whether a combined downgrade set: is rejected, normalized, or allowed is unstated.
  Remediation: Recast Decision 5 as non-normative authoring guidance, or make it an explicit validated config-time constraint with a rejection example, and align the Consequences example accordingly.

• [api-contract] docs/ADRs/0112-task-g....md:109 — The ADR attributes runtime, config, a redacted entity/event, and "attempt count (from ADR 0098's handled-state evidence)" to "ADR 0098's CEL environment." This doesn't match ADR 0098: it adds a required entity and nullable event but does not redact either, and its "handled-state evidence" is history/receipts/checkpoints with no attempt counter. runtime.forge/config come from ADR 0088's overlay environment. Attempt count and label-provenance filtering are new 0112 requirements misattributed to an existing shipped contract.
  Remediation: Describe the routing CEL environment as 0112's own composition (0088's fields + 0098's entity/event + new task facts), rather than claiming they already exist in ADR 0098.

• [logic-error] docs/ADRs/0112-task-g....md:121 — A scheduled poll is described as "a run with no actor" that can never satisfy an actor-keyed downgrade, but ADR 0098 and the normalized-event spec have schedule/manual adapters set actor.kind to bot and actor.role to the identity's permission. If routing surfaces that actor as task.actor, an example downgrade like task.actor.kind == "bot" would match poll-originated runs rather than "never" matching.
  Remediation: Specify task.actor's value for poll/schedule/manual/event-backed bot runs explicitly, rather than relying on an unqualified "no actor" claim.

• [injection] docs/ADRs/0112-task-g....md:113 — The "no author-controlled text" guarantee is a denylist over ADR 0098's existing, evolving CEL environment, not a closed allowlist. The live normalized-event schema carries other author-controlled strings the denylist doesn't name (e.g. comment-derived command/instruction fields, change-proposal branch names). Separately, change paths/stats are treated as fully "system-derived" while being entirely author-chosen — in tension with adaptive-agent-selection.md's new claim of "no author-controlled input as a routing key."
  Remediation: Define routing's CEL environment as an explicit allowlist of fields rather than a denylist over a growable schema, and qualify the "no author-controlled input" claim to note paths/stats are author-chosen structured facts.

• [fail-open] docs/ADRs/0112-task-g....md:101 — All matching rules merge with later entries winning per field (correctly attributed to ADR 0088). Under this composition, a security-path escalation and a later, broader docs-path downgrade could both match a mixed PR, with the downgrade's lower model/effort applying — mixed-match composition safety is unspecified.
  Remediation: For mixed matches, specify fail-closed composition: if any matching rule for the task is an escalation, the merged result must not lower model/effort below static.

• [fail-open] docs/ADRs/0112-task-g....md:105 — routing.mode's default (off) is stated explicitly, but routing.trusted_labels and routing.allowed_models have no stated default, leaving room for an "omitted means everything" (fail-open) implementation reading.
  Remediation: State explicit empty/omitted defaults for both fields, consistent with the empty-allowlist convention used for never_downgrade.

• [api-contract] docs/architecture.md:240 — docs/architecture.md is explicitly documented (frontmatter + intro) as "the current architectural truth, kept in sync with accepted ADRs." The new bullet, placed under "Decided (implementation):" next to bullets describing shipped code, states in the present tense that routing "are routed per task" by a routing: policy — but ADR 0112 is docs-only with no implementation. As placed, the bullet misrepresents an accepted-but-unimplemented decision as current production behavior.
  Remediation: Rephrase to distinguish decision from implementation (e.g. "Accepted in ADR 0112 (not yet implemented): ...") or move out of "Decided (implementation)" until routing: lands in code.

Low

• [logic-error] docs/ADRs/0112-task-g....md:151 — "Nothing is retried inside the sandbox" immediately follows a requirement to preserve Claude's fallback chain (--fallback-model / FULLSEND_FALLBACK_MODELS, an in-sandbox retry mechanism), creating an apparent contradiction unless the intended scope (only the unservable-catalog-id incident class) is made explicit.
  Remediation: Narrow the sentence to the unservable-id incident class and state explicitly that Claude's existing fallback retries are unaffected.

• [fail-open] docs/ADRs/0112-task-g....md:199 — The deferred advisor's constraint ("an assessment may satisfy a downgrade only together with a system-derived fact that would justify it on its own") is not mechanically checkable as stated; a near-tautological system-derived conjunct could pair with the assessment and read as compliant. Lower severity since the advisor is deferred, but the ADR presents the constraint as fixed now.
  Remediation: When implemented, define the check as: the downgrade rule's when: with every task.assessment predicate replaced by true must still match on the same task facts.

• [misplaced-abstraction] docs/ADRs/0112-task-g....md:127 — Introduces a new catalog tier / persona min_tier concept. docs/contributing/tier-conventions.md documents this repo's existing tier domains and asks for a descriptive prefix to avoid ambiguity; this ADR adds a fourth tier concept without updating that convention doc.
  Remediation: Keep using "catalog tier" / "model tier" consistently in prose, and note in Consequences that tier-conventions.md will need a fourth entry once implemented.

---

This PR is docs-only (a new Architecture Decision Record plus four small cross-reference edits — no production code). Per this repo's ADR convention, an accepted ADR is treated as effectively frozen afterward (substantial rewrites require a new superseding ADR), so the internal-consistency and cross-ADR-consistency gaps above are worth resolving in this PR rather than in a follow-up, particularly the trusted_labels/never_downgrade findings, since they bear directly on the ADR's own stated goal of keeping author-controlled content out of cost/model routing decisions.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] api-contract

docs/architecture.md's frontmatter and intro explicitly describe the document as 'the current architectural truth, kept in sync with accepted ADRs' and state that ADRs 'crystallize' into this document as the source of present-tense fact. The new bullet added by this PR sits under 'Decided (implementation):' — alongside bullets describing shipped code (runtime.Runtime, ResolveForAgent()) — and states in the present tense that runtime/model/effort/persona selection 'are routed per task' by a routing: policy. ADR 0112 is a docs-only decision record with no implementation; nothing in .fullsend/config.yaml or fullsend run implements routing: yet. As placed, the bullet misrepresents an accepted-but-unimplemented decision as current production behavior.

Suggested fix: Rephrase the bullet to distinguish decision from implementation, e.g. 'Accepted in ADR 0112 (not yet implemented): runtime, model, effort and persona models will be routed per task ...', or move it to a clearly-marked 'Decided, not yet implemented' subsection until routing: actually lands in code.

[tpouyer]

Fixed in 3e2289e. The bullet now reads "will be routed per task … (decided in ADR 0112, not yet implemented)". I've kept it under "Decided (implementation):" because architecture.md has no separate list for decisions that are accepted but not yet built, and the bullet says so inline. When routing: ships, the future tense and the caveat both come out.

[waynesun09]

Review — routing policy ADR

Independent review of the ADR text and the example config against main @ afa135d45, plus a drift check on every cited reference. Complements the fleet review above rather than repeating it: everything below is a finding that review did not raise.

The decision is sound and eight of the nine findings from #7251 are genuinely closed — verified against the ADR text rather than the summary table. The guards are computed rather than declared, min_tier is defined, subagents merges per key, the preflight fallback is specified, and the fail-closed defaults are real. Number 0112 is free on main and claimed by no other open PR (re-scanned all open PRs; 38 touch docs/ADRs/). All eight sample CEL expressions compile to bool against the repo's own cel-go and all three sample YAML blocks parse. The ADR 0091 edit is a permitted minor annotation, not a rewrite.

Two findings I would treat as blocking, both small edits:

1. Decision §4 states three runtime-state snapshots as decision clauses. One is contradicted by ADR 0104 and by PR #7809, open right now, which registers codex personas; another is factually false today. An Accepted ADR whose Decision is wrong on merge day needs a superseding ADR to fix a sentence that was never the decision. Inline at the two lines.
2. The PR body and the ADR specify opposite behaviour for a malformed routing: block — the body says the static choice runs, the ADR says the run fails. The ADR is the correct, fail-closed version; the body needs the fix. Flagging because the body is what a reviewer approves against. (The fleet review reads this as an internal ADR contradiction; I read :109-111 as self-consistent and the body as the defect.)

Example-config defects (not inline — they live in the PR description)

• docs-only-review, the flagship downgrade, is rejected by the ADR's own persona floor. :160-161 floors a never_downgrade agent's personas at their static model's tier unless the persona file declares a lower min_tier. The sample moves challenger and correctness from xai/grok-4.6 to google-vertex/gemini-3.8-flash with no opt-in shown, so as written it fails validation. Either show the min_tier opt-in in the persona sample or pick personas that are not floored.
• retry-escalate is labelled an escalation but classifies as a downgrade under §4's own test. :140-141 makes a rule an escalation only when every resolved field is equal to or above static and at least one is above; :144-145 makes "anything else, including a runtime change or a same-tier model swap" a downgrade. For fix, whose static model is sonnet, {model: opus, effort: high} raises the model but the effort comparison against an unset static value is undefined (see also C4). Worth making the sample unambiguous, since it is the one readers will copy.
• bad-title-key uses a field shape this repo's CEL does not have. event is normevent.Event.ToMap() — six top-level fields, no pull_request, no title anywhere. The sample is right that PR titles must be unreachable, but it demonstrates it with a path that would fail for the wrong reason. Suggest keying the example on a field that does exist in the redacted event.

Drift check

Everything cited resolves correctly with one exception: #6527 is CLOSED (2026-08-23), so :204's "a later ADR that amends #6527" names a dead artifact. Inline below.

Worth recording that ADR 0098 is entity-first harness evaluation on main today (#6956, merged 2026-09-15) and 0106 is serialize-agent-runs (#6909, merged 2026-09-16) — I went in expecting the reverse and was wrong. The citation is correct and needs no change.

Length

248 lines against a main median of 131 (p90 283, n=103) — within practice but roughly double the median, and the skill's own targets are exceeded on Context (36 lines) and Consequences (61). The Jev/Laya block at :228-248 is the largest single win and reads as the open-ended exploration skills/writing-adrs/SKILL.md says belongs in a problem doc. Suggest collapsing it to one Deferred bullet and moving the substance to adaptive-agent-selection.md; happy to supply that text.

---

Agent-assisted review. Every source claim below was read at main @ afa135d45 or in the linked PR; file:line references are quoted so they can be checked.

[waynesun09]

BLOCKING — decision-vs-state. "on codex, which has no persona roster, any subagents key is rejected"

This states current runtime state as a decision clause, and it is already contradicted by two sources:

• ADR 0104:110-112 records the opposite status: "Consuming the same map on codex (subagents.default, OpenAI ids) is planned, not implemented here." ADR 0112 turns another ADR's "planned" into a standing prohibition without superseding it.
• PR feat(#6970)!: support native Codex review and retro children #7809 is open right now — feat(#6970)!: support native Codex review and retro children. Its own Changes section: "Register discovered personas plus generic and Explore roles. Resolve child models from an explicit persona override, then FULLSEND_CODEX_SUBAGENT_MODEL, then subagents.default…" If it merges, this Decision sentence is false and correcting it needs a superseding ADR.

Today's actual state is only internal/runtime/codex_bootstrap.go:311-320 (codexNoSubagentNote, a prompt note that the sub-agent tool is absent) — a fact, not a decision.

The guard's intent is right and belongs in the Decision; the per-runtime roster inventory is a snapshot that changed while this PR was open. docs/contributing/adrs.md lets a later PR annotate a note but not rewrite a Decision.

Suggested edit — keep the runtime-agnostic rule here:

A runtime change must keep the agent's capability needs, and every routed subagents key must be servable by the resolved runtime's persona mechanism: a key the runtime cannot serve fails validation before the sandbox exists, naming the runtime and the key. Each runtime's persona mechanism and the models it can carry are the runtime's to define (ADR 0104).

and move the inventory to a dated Consequences note ("Runtime state at acceptance (2026-09-11; annotate, do not rewrite)") naming pi as the only runtime registering personas today, codex as tracked by #6970, and Claude Code as pending ADR 0104's second half. When #7809 lands, codex becomes routable under the rule above with no change to this ADR.

[tpouyer]

Agreed, thanks. Addressed in cd903f6. I adopted the runtime-agnostic rule you suggested (every routed subagents key must be servable by the resolved runtime's persona mechanism, or validation fails), and the same commit trims the ADR to the decision alone, so it no longer names any runtime. The servability rule and a dated note on current runtime status (pi registers personas; codex is tracked by #6970 and #7809) are left to the implementation. If #7809 merges, codex personas become routable with no ADR change.

[waynesun09]

BLOCKING — factually false on main. "(fallback chain on Claude only)"

pi has a fallback chain today. internal/runtime/pi_run.go:1036-1044 documents it verbatim — "When the requested model is an alias and FallbackModels are set, Run attempts each model in the chain until one succeeds… A Vertex 404 … triggers the next fallback" — implemented at pi_run.go:1064 via piFallbackChain(effectiveModel, params.FallbackModels, params.ModelAliases). Only the stale comment at internal/runtime/runtime.go:66 still reads Claude-only.

As written, this parenthetical is a guard that would wrongly block a Claude→pi routed runtime change, on a capability pi actually has.

Same at :168: "Claude's existing --fallback-model chain is unchanged" → suggest "the runtimes' existing fallback chains are unchanged".

Suggested edit: drop the parenthetical entirely — "A runtime change must keep the agent's capability needs" carries the intent without naming a per-runtime inventory that is already out of date.

[tpouyer]

Fixed in cd903f6. The parenthetical is gone, and the ADR now refers only to each model's existing fallback chain, with no per-runtime list. It also narrows the preflight so it doesn't fight those chains: a static model that isn't served fails the run only when nothing in its existing fallback chain is served, whether that's Claude's --fallback-model or pi's piFallbackChain. The preflight runs only when routing.mode isn't off, so repos that haven't opted in see no new failure mode.

[waynesun09]

HIGH — mechanism is real but inert for every fullsend review persona. "subagents.default is applied through CLAUDE_CODE_SUBAGENT_MODEL"

The variable exists and the ordering stated is right, but per Claude Code's documented sub-agent resolution — per-invocation model argument › frontmatter model: › CLAUDE_CODE_SUBAGENT_MODEL › parent — it only reaches children that name no persona and receive no explicit model.

All nine pr-review personas in fullsend-ai/agents carry a frontmatter model: (verified today), so every one of them outranks it. The variable also appears zero times in the fullsend tree. So on Claude Code this clause routes nothing that fullsend currently dispatches.

Not blocking on its own, but it should not read as a working mechanism. Suggest stating the limitation where the mechanism is named, or folding it into the dated runtime-state note proposed above.

Separately, CLAUDE_CODE_SUBAGENT_MODEL_FORCE (:155) is not in the official docs — I could only find it in secondary sources describing a boolean that forces one model onto subagents. Worth a primary citation or removal.

[tpouyer]

Agreed. The ADR no longer names the variable (cd903f6). The runtime details are left to implementation, and I've recorded the limitation for that work: on Claude Code only subagents.default is routable, it reaches only children with no persona and no frontmatter model:, and a per-invocation model can override it. So the echo records the routed value, not necessarily the one that served. _FORCE is gone. The Claude Code 2.1.251 boundary is still unverified. If you know the release that introduced it, I'll cite it.

[waynesun09]

HIGH — "a confidence floor reads a real probability" is true only per backend, and is the one claim that does not survive making this pluggable.

confidence is not a portable quantity. Three backends that all serve the same POST /v1/systemone request body return three mathematically different numbers under that key:

Backend	What confidence is
Jev	(n·p_max − 1)/(n − 1) — p_max rescaled so uniform → 0 (third-party reading; TypeSafe publishes no formula)
djev-run	raw p_max — no rescaling, no calibration
Laya	1 − normalised entropy

Laya states the consequence outright: "A threshold carried over from Jev does not transfer." Worked example, and it is not academic — magpie gates at 0.4: meaningful under Jev's scaling, but under raw p_max a two-way question at chance already scores 0.5, so the floor can never fire. Silently: no error, no log line, the abstention guard just stops existing.

Two consequences for this ADR, both cheap because it is deferring the choice anyway:

1. The provider contract should carry the full probabilities distribution (all backends return it) and fullsend should compute the gate itself. A rule must never gate on a vendor's confidence field.
2. Calibration does not transfer either, so it is not the differentiator that justifies a backend. Laya's own benchmark shows miscalibration reversing direction on a routing task. The threshold has to be fitted on fullsend's own labelled runs regardless of backend — which §7's ledger, shadow mode and replay already provide. That reframes calibration from a vendor property into a workflow this ADR owns.

Suggest softening :240 to "the ledger records the distribution, and fullsend computes the abstention gate from it" and adding the fitting loop to the open question. Full survey available if useful.

[tpouyer]

Thanks, this was a good catch. The advisor is deferred, so I've kept the detail out of the ADR. The adaptive-agent-selection.md open question now says only that a decision model returns a probability per label, so fullsend could set its own abstention threshold from that distribution. I've recorded your two points for the advisor's implementation: never gate on a vendor's confidence field, and fit the threshold on fullsend's own labelled runs through shadow mode and replay.

[waynesun09]

MEDIUM — present tense for fields that do not exist. "the ordinal model tier (economy < standard < premium) that each catalog entry carries beside its vendor"

ModelsConfig is Aliases only (internal/config/config.go:399-406); there are zero hits for a tier field anywhere in the tree. The PR's own "Notes for review" says so — "the ADR commits the implementation to adding tier and vendor to catalog entries, which don't exist today" — but the Decision text asserts them as current.

Since the whole downgrade/escalation classification rests on this ordinal, the reader should not have to reach the Notes section to learn it is not there yet.

Suggested edit: "…by an ordinal model tier that each catalog entry will carry beside its vendor (neither field exists today; adding them is part of implementing this ADR)."

[tpouyer]

Fixed in cd903f6. The Decision now classifies models "by a catalog model tier", and Consequences says "Implementing this adds a model tier to catalog entries", so it's no longer stated as current. tier-conventions.md also gains a model tier row marked not yet implemented, and the Notes for review repeat that tier and vendor don't exist today.

[waynesun09]

MEDIUM — cites a closed issue as the amendable artifact. "a later ADR that amends #6527"

#6527 was closed on 2026-08-23 (the runtime-parity backlog). A closed issue cannot be amended, and a future ADR would have nothing to point at.

The rule it carried — the deciding session is never downgraded — is real and worth keeping; it is the citation that is stale. Note the same issue is cited live at :51 in Context, where "still holds" reads oddly for a closed backlog item.

Suggested edit: make this ADR the artifact — "…only by a later ADR that supersedes this clause" — and in Context cite #6527 as the origin of the rule rather than as something that "still holds".

[tpouyer]

Fixed. The "amends #6527" clause is gone, and Context now cites #6527 only as where the rule came from: "The deciding session's model is never downgraded (#6527)". The rule itself is now this ADR's never_downgrade guard, so changing it would take a later ADR that supersedes this one.

[waynesun09]

MEDIUM — the echo records what applied, never what a guard suppressed, and §7's replay needs both.

:174-177 echoes "the rules that set each field" and §7 carries "choice, rules, task facts, cost, status, verdict". A rule that matched but whose effect never_downgrade, allowed_models, a persona floor or the served-model preflight rejected leaves no trace.

That is a real gap for this ADR's own learning loop: replay cannot distinguish "no rule matched" from "a rule matched and was suppressed", so a policy whose downgrades are all being silently rejected looks identical to one with no downgrades. Two of the example-config rules in the PR description are exactly that case, written by accident — which is the evidence that it happens.

(This is the one lesson worth importing from yetone/magpie, whose per-decision trace names which candidates were skipped and why.)

Suggested edit, one clause here:

…status-comment footer, and the rules that matched but whose effect a guard suppressed, naming the guard.

[tpouyer]

Fixed in cd903f6. Decision item 4 now reads: the plan block, metrics.json, the root span and the status comment "name the rules that set each field and those a guard suppressed". The implementation is expected to have each suppressed rule name its guard in the echo and in the ledger, so replay can tell "no rule matched" apart from "a rule matched and was suppressed".

[waynesun09]

LOW — the mechanical argument against per-prompt routing is missing, and it is the strongest one.

The four grounds given are all governance arguments (author-controlled prompt, per-sandbox state, Claude-only, too-late). The decisive mechanical reason is absent: a mid-loop model change discards the accumulated prompt cache, and on vendors that seal reasoning content it is an outright error on the next tool result.

That is also the unstated reason behind :216's "lets a worker consult a stronger model without switching session model", so stating it here makes that later clause follow. It is the reason yetone/magpie holds one route across an entire turn and its whole tool-call loop, migrating only on context outgrowth.

Suggested edit, one clause:

…and a mid-loop model change discards the accumulated prompt cache — on some vendors an outright error on encrypted reasoning content — so the turn, not the prompt, is the smallest safe grain.

[tpouyer]

Added in cd903f6. Options now rejects per-prompt routing because it "reads author-controlled prompts and loses the prompt cache mid-loop". To keep Options short in the trim, I dropped the encrypted-reasoning clause; I'm happy to put it back if you think it carries weight.

[ifireball]

I think routing should be done by setting fields in overlays in the harness file and using the existing harness overlay "when" expressions, instead of separate rules in the config file.

If we want to allow repo-level overrides for the model selection, then it should be a part of a general repo-level overrides mechanism for harness settings, I think there is an in-flight ADR for such a mechanism already.

[tpouyer]

Thanks. Rather than choose between the two designs here, I'm writing up the overlay approach as a second draft PR: routing as fields set in harness overlays with the existing when: expressions, under a general repo-level override mechanism for harness settings. I'm moving this PR to draft as well, so the team can compare the two options side by side and give feedback before either goes forward. This one keeps the separate routing: block so its guards (never-downgrade, allowlisted inputs, trust lists, the served-model preflight) can be judged on their own terms. Could you point me at the in-flight ADR for repo-level overrides you mentioned, so the overlay version builds on it?

[tpouyer]

The overlay-based alternative @ifireball suggested is now up as draft #7842. Both PRs are drafts so we can compare the two approaches side by side.

[qodo-code-review]

Code review by qodo was updated up to the latest commit cd903f6

[tpouyer]

Closing in favor of #7842 as discussed on Thursday Oct 1st in Technical Review Forum call.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 2:27 PM UTC · Completed 2:44 PM UTC

Commit: cd903f6 · View workflow run →

Runtime: claude · Model: sonnet → claude-sonnet-5 · Effort: high · Cost: $2.90

[fullsend-ai-retro]

Retro on #7808 ("docs(adr): route runtime and model per task from a config policy"), a human-authored draft ADR PR closed without merging on 2026-10-02 in favor of a competing design (#7842), per a live Technical Review Forum decision outside the automated pipeline. This is a normal, healthy design-competition outcome, not a pipeline failure.

Review quality: the fullsend-ai-review[bot] agent delivered one substantive CHANGES_REQUESTED pass (14 findings: 1 high, 10 medium, 3 low — fail-open/closed ambiguity, CEL misattribution, escalation/downgrade misclassification, trust-label gaps). A human reviewer (waynesun09) independently confirmed 8/9 of an earlier predecessor-PR round's findings were genuinely fixed, and caught 2 additional issues the agent's single pass could not: (1) an ADR Decision-text claim about Codex persona rejection that was stale relative to a separate, concurrently open PR (#7809); (2) a contradiction between the PR body's description of fail-open/closed semantics and the ADR's actual text. Both gaps are already tracked by open issues in fullsend-ai/agents: #895 ("verify documentation claims against explicitly-coupled companion PRs") and #1359 ("ADR/docs consistency checks catch stale filenames but miss contradicted semantic invariants" — notably citing the same reviewer, waynesun09, from a prior instance). This PR's timeline is corroborating evidence for both; no new proposal filed for either to avoid duplication.

Separately, tracing the workflow runs surfaced a previously unfiled platform reliability bug: when the PR author submitted 10 GitHub reviews in rapid succession on 2026-09-29, all 10 resulting pull_request_review-triggered fullsend workflow dispatches failed silently with zero jobs scheduled (GitHub's generic "workflow file issue" banner, no logs, no annotations). The identical signature was independently reproduced on a second, unrelated fork PR (#7718) across 53 occurrences. This is filed below as a new proposal since no existing issue covers the exact symptom (top-level zero-job dispatch failure on fork-PR pull_request_review bursts).

No evidence of rework caused by agent error, redundant agent token spend, or avoidable iteration — the multiple review rounds reflect genuine design iteration on a complex, competing-options ADR, not agent mistakes.

Proposals filed

• Reusable workflow dispatch fails silently (zero jobs) on rapid-fire pull_request_review events for fork PRs (in fullsend-ai/fullsend)