feat(reviewer): D1 — run ordinary reviews on codex when claude is cooled (backend-agnostic fallback) by ProtocolWarden · Pull Request #486 · ProtocolWarden/OperationsCenter

ProtocolWarden · 2026-07-17T20:14:43Z

What & why

Completes audit item D1. The self-review sweep's defer branch already carried the marker that this was "a validated follow-up; until then any non-claude selection means claude — the only review backend — is unavailable". This builds that follow-up: the ORDINARY single-reviewer now runs the controller's full claude→codex ladder instead of parking whenever claude is cooled.

Operator directive verbatim: "d1 should have the same mechanisms the fleet has, why no fallback to codex" → give the reviewer the controller's backend ladder; divert reviews to codex when claude is cooled, PARK only when the whole ladder is exhausted.

The change (single-reviewer path only)

At the sweep's backend-selection gate:

claude runnable → review on claude/haiku (unchanged; still via _run_direct_review).
claude cooled, codex runnable → DIVERT the ordinary review to codex_cli/codex and feed its verdict into the same downstream pipeline (verdict parse → self-heal ladder → LGTM-only green-CI merge). Charges codex's budget, not claude's, via the normal _run_member_review usage path.
whole ladder exhausted (no runnable backend) → PARK (defer+return, no burn), preserving the #446 1h auto-resume.

backend→model reuses the validated council seat pairing (verdict._COUNCIL_PANEL, codex_cli→codex) via a small _review_model_for_backend helper — no new registry. The claude path keeps routing through _run_direct_review (the name the test suite patches; back-compat default preserved); the codex path branches at the call site to the already-backend-agnostic _run_member_review.

Boundary preserved (hard constraint)

Guardrail PRs are untouched. They fork to the K=3 cross-family council before this gate is reached, so a cooled claude still genuinely PARKS the council (the F14 park-cap case) rather than being single-reviewed on codex. Pinned by a new test.

Backend-agnostic downstream

_dispatch_verdict_outcome (verdict parse → self-heal ladder → LGTM-only merge with the green-CI precondition) was already backend-agnostic — it takes a plain {result, failing_checks, summary} dict shared with the council path. No claude-specific assumption found on the ordinary path. Updated one now-imprecise INJ comment that named _run_direct_review.

Validation basis

The 2026-07-15 codex spike: codex exec wrote a schema-conformant verdict.json, caught a planted bug with the exact evidence span, and did NOT author the overall verdict (INJ boundary held) — same trust level as claude-solo today. Codex already runs live as council seat C3.

Tests

test_phase1_cooled_claude_runs_ordinary_review_on_codex — cooled claude → runs on codex_cli/codex, verdict flows to merge (not deferred).
test_phase1_ladder_exhausted_parks_no_burn — no runnable backend → parks, no runner invoked, no budget charged.
test_phase1_guardrail_pr_cooled_claude_does_not_single_review_on_codex — guardrail PR still forks to council; NOT single-reviewed on codex.
tests/unit/reviewer/test_d1_codex_fallback.py (CI-run) — _review_model_for_backend pairing + unknown→None; _run_direct_review no-arg back-compat still runs claude/haiku.

Full: 169 reviewer + 8536 unit passed; ruff clean; custodian pre-push clean.

🤖 Generated with Claude Code

…led (backend-agnostic fallback) The self-review sweep's defer branch already flagged this as "a validated follow-up": until now, any non-claude backend selection meant claude — the only review backend — was unavailable, so the ordinary review PARKED. This gives the ordinary single-reviewer the controller's full claude→codex ladder instead: - claude runnable → review on claude/haiku (unchanged path). - claude cooled, codex up → DIVERT the ordinary review to codex_cli/codex, feeding its verdict into the SAME downstream pipeline (verdict parse → self-heal ladder → LGTM-only green-CI merge). Charges codex's budget. - whole ladder exhausted → PARK (defer+return, no burn); #446 auto-resume. backend→model reuses the validated council seat pairing (verdict._COUNCIL_PANEL, codex_cli→codex) via a small _review_model_for_backend helper — no new registry. The claude path keeps routing through _run_direct_review (the name the test suite patches; back-compat intact); the codex path branches to the already backend-agnostic _run_member_review. Downstream _dispatch_verdict_outcome was already backend-agnostic — no claude-specific assumption on the ordinary path. GUARDRAIL PRs are untouched: they fork to the K=3 cross-family council BEFORE this gate, so a cooled claude still genuinely PARKS the council (F14) rather than falling back to a single codex reviewer — pinned by a new test. Codex was validated as the ordinary reviewer by the 2026-07-15 spike (schema verdict.json, caught a planted bug with the exact span, did not author the overall verdict — INJ boundary held) and runs live as council seat C3. Tests: 3 root integration (codex-runs / ladder-exhausted-parks / guardrail-not-single-reviewed) + 3 unit under tests/unit/reviewer. 169 reviewer + 8536 unit green; ruff clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ProtocolWarden · 2026-07-17T20:27:04Z

Resolved: backend cooldown elapsed — automated review resumed