Module standards_review 

The standards-review shadow run: its request, the patch it covers, its one HTTPS call and the result it appends. What: The standards-review shadow run: its request, the patch it covers, its one HTTPS call and the result it appends. Why: The review is optional and self-contained, so its modules sit together.

In TS you’d write (pseudocode):

// standards_review/index.ts: one `export * from './file'` per module below.

Modules

standards_review_append

The standards-review shadow run: appending an entry to the shared log without a lock, once per commit, with repair. What: How the service adds a review entry to the repository’s live shadow log, which every worktree’s service instance appends to at the same time: one whole-entry write on an append-mode descriptor, once per commit, creating the directory and the file when missing. Why: The live log is an untracked file in the common repository directory (cli-git/standards-review-shadow.md), and no lock may be taken. One write of the whole entry on an O_APPEND descriptor lands at the end of the file in one step, so two instances (threads or processes, each with its own descriptor) cannot interleave their entries. Nothing else edits this file, so the protection a tracked, session-edited log needed is gone: the per-worktree spool of delivered entries, the bounded repair that appended again an entry another writer’s whole-file rewrite had lost, and the rule that the service never creates the log. A write the operating system cuts short (a signal, a full disk) is continued with the rest of the same entry, so an entry is whole unless the disk refuses it.

standards_review_client

The standards-review shadow run: the in-process HTTPS call to the decisions gateway, with a total deadline. What: The one HTTPS call of the standards-review shadow run, made in-process and ended only when it shows no sign of work. Why: The root mise.toml task shadow-review calls fetch with a 30 s signal. This port calls the same endpoint from the wrapper itself, so no node or mise is started. A call that keeps moving bytes is never cut off for being slow (owner, 2026-11-03: “Stop only on no progress”; pick 9 of doc/planning/cli-git-shipped-limits-audit.md, the coordinator’s under the owner’s delegation and open to the owner’s veto). The transport’s own idle timeouts do the judging: resolving, connecting, and each read and each write of the connection (TLS handshake, request, response head and body) may stay silent for the quiet window and no longer, and one ceiling covers the call as a whole (owner, 2026-11-04, “Silence plus a ceiling (Recommended)”; wait_ceilings.rs, REVIEW_CALL_CEILING). The longest quiet gap of every call is measured beside the call and kept in the ledger (quiet_ledger.rs, thread_quiet.rs). The trust roots are a parameter: production uses the roots embedded in the binary, a test passes the fixture authority of its local TLS server.

standards_review_entry

The standards-review shadow run: log entry rendering and appending. What: The log entries of the standards-review shadow run, rendered as the root mise.toml task shadow-review writes them. Why: doc/audit/standards-review-gate-shadow.md already holds that task’s entries, and readers and scorers parse them, so the port writes the same lines; standards_review_append.rs appends each entry, whole, to the live log.

standards_review_input

The standards-review shadow run: which commits get an entry, and the capped model input. What: The pure part of the standards-review shadow run: which landed commits get an entry, and the capped model input built from the commit’s patch and the excerpts of its changed code files. Why: This is the root mise.toml task shadow-review after its Git reads: the no-entry, no-code-files and review cases, the 2000-line patch cap, the eight-file and 4000-line excerpt caps, and the 24000-unit input cap. Taking the patch and the file contents as plain values lets the caps be tested without Git, a network or a clock.

standards_review_patch

The standards-review shadow run: a file’s changed old-side ranges read from the patch. What: Reading one file’s changed new-side line spans out of a git show --patch text, so the review needs no git diff -U0 start per excerpted file. Why: The script runs git diff -U0 <sha>^ <sha> -- <name> for each of up to eight files. A hunk of the three-line-context patch is a list of change runs, and each run is one zero-context hunk, so the same spans follow from the patch the review already holds. The spans are on the new side because the excerpt is cut from the new-side file.

standards_review_request

The standards-review shadow run: the Decisions API request body and the answer reading. What: The Decisions API request body the standards-review shadow run sends, and the reading of the gateway’s answer into the verdict and the Findings kept line. Why: The root mise.toml task shadow-review builds this body with JSON.stringify and reads the answer with JSON.parse; the body must keep its key order and escaping so the same input sends the same bytes, and the answer text must print numbers and failures the way the log’s readers already know.

standards_review_run

The standards-review shadow run, end to end, and its bounded runner. Nothing calls it yet. What: The standards-review shadow run, end to end and in-process: classify the landed commit’s names, read the commit, build the capped input, call the gateway, and append the one log entry. Also a runner that contains a panic of any of it. Why: This replaces the root mise.toml task shadow-review (its Luna route; the SHADOW_REVIEW_ALLOW=1 route starts pi and is not ported). The review must never delay or fail a landing, so nothing here panics or returns a failure the landing would act on. No wall-clock budget covers the run (owner, 2026-11-03: “Stop only on no progress”; pick 9 of doc/planning/cli-git-shipped-limits-audit.md, the coordinator’s under the owner’s delegation and open to the owner’s veto): each step of it ends on no progress by itself, the Git reads under the watch of child_watch.rs and the gateway call under the idle timeouts of standards_review_client.rs. The one step with no judge is the local write of the log entry.

standards_review_source

The standards-review shadow run: the two real-Git reads (patch and file texts) of a landed commit. What: The Git reads of the standards-review shadow run, in as few real-Git starts as the data allows: one git show for the patch and one git cat-file --batch for the new-side text of the excerpted code files. Why: The root mise.toml task shadow-review starts Git twenty-odd times per landing (rev-parse, log, show, diff-tree, then show and diff -U0 for each of up to eight files). The landing already knows the commit name, its message and the changed names, so the subject and the names need no start, the zero-context ranges come out of the patch, and the file texts come in one batch. A commit with no code files costs no start at all.

standards_review_text

The standards-review shadow run: JavaScript text behaviors the log depends on (UTF-16 lengths, number text). What: The few text behaviors of the standards-review log that JavaScript defines and Rust does not share: UTF-16 lengths and prefixes, Number to text, toFixed(1) of a duration, and Git’s %s subject. Why: The root mise.toml task shadow-review measures and cuts text in UTF-16 code units and prints numbers the way ECMAScript does, and its log is compared entry by entry with this port’s, so the same text must give the same counts and the same bytes.