ci(permit): move the quorum to Gemini 3 Flash + GPT-5 mini (generation-3 candidate) - #72
Draft
peycheff-com wants to merge 2 commits into
Draft
ci(permit): move the quorum to Gemini 3 Flash + GPT-5 mini (generation-3 candidate)#72peycheff-com wants to merge 2 commits into
peycheff-com wants to merge 2 commits into
Conversation
Cost, measured on helm-ai-kernel#693: the review patch is 158,394 bytes, and 78KB of it — 74% — is tools/boundary/protected.manifest, a sorted SHA256 index of the protected surface. That PR went through nine permit rounds with two reviewers each, so the same generated hash list was sent to a metered model eighteen times. It carries nothing a reviewer can act on: its content is a pure function of the other files in the same patch, and `make verify-boundary` regenerates and byte-compares it in the same run. prepare gains --elide-derived PATH (repeatable, exact paths only). The named file's diff body is withheld and the patch drops to 42,002 bytes, a 73% reduction, with the reviewable changes untouched. Nothing is hidden. Each elision is declared twice — as a stub in patch.diff carrying the post-image SHA256, byte size and line counts, and as an entry in context.json under elided_derived_paths, which is covered by context_sha256 and therefore bound into the permit. The review protocol now tells the reviewer the block exists, that its content is a claim rather than a fact, and that an unjustified elision is a blocking finding. The list lives in this SHA-pinned workflow repository and deliberately not in a file the pull request can edit: a list the PR controls would let a change add its own path and hide itself from review. Guards: globs and directories are rejected, so an elision cannot widen; path traversal is rejected; and a configured path that is not in the patch produces no record at all, so a stale entry cannot become a licence to hide a future file. Six tests, three of them negative. prepare_args gains elide_derived=[] — without it every existing prepare test raised AttributeError. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Cost. Since the 2026-06-01 move to usage-based billing there is no 0x model tier left to switch to — every model is metered per token, and Copilot code review consumes AI credits per review as well. The lever is which models and how much we send them. claude-fable-5 and gpt-5.6-sol are flagships. gemini-3-flash ($0.50/$3.00 per 1M) and gpt-5-mini ($0.25/$2.00) are the cheapest pair that keeps two DISTINCT providers, which is the property the 2-of-2 quorum actually depends on. The reviewer flags were named after vendors, so changing them was a code change. --anthropic-model/--openai-model become a repeatable --reviewer PROVIDER/MODEL, validated for distinct providers and a minimum of two. The Go verifier never knew the vendor names — it only requires each reviewer object to carry provider and model — so nothing outside this repository moves. The elision declaration also moves out of context.json. The verifier calls requireKeys(context, ..., optional=nil), which rejects any key it does not know, so shipping a new context key would have failed every permit in every repository until the kernel verifier and the pinned authority.kernel_sha were bumped in lockstep. It now lives only in patch.diff, at the same artifact-chain trust level as the patch it describes. Binding it to context_sha256 is strictly better and is the follow-up, gated on that verifier change. Note the quality trade: over eight rounds on helm-ai-kernel#693 the flagship pair found two real defects the author missed — an unprotected boundary config and an unconditional commercial-gate failure. Cheaper reviewers may not. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft on purpose — a generation-3 candidate, not a merge request. Same posture as #71 and
helm-ai-kernel#701: it amends the
authority and must not land under the generation it amends. Cut this way because
#57 was closed under the HELM-350 operator
disposition of 2026-07-23, which puts moving the ruleset-pinned workflow SHA out of scope and
requires a successor model bump to carry its own operator decision.
Operator decision on record for this one: reduce reviewer cost, drop Anthropic and OpenAI flagships.
What it changes
anthropic/claude-fable-5google/gemini-3-flashopenai/gpt-5.6-solopenai/gpt-5-miniThere is no zero-cost lane to move to: since the 2026-06-01 shift to usage-based billing every
Copilot model is metered per token, and Copilot code review consumes AI credits per review as well.
The lever is which models, and how much is sent to them (#70 covers the second).
--anthropic-model/--openai-modelbecome a repeatable--reviewer PROVIDER/MODEL, validatedfor distinct providers and a minimum of two. The vendor names were baked into the flag surface, so
changing reviewers was a code change. The Go verifier never knew them — it only requires each
reviewer object to carry
providerandmodel— so nothing outside this repository moves.Interaction with #71 / kernel#701
Those two fix the severity half of the same problem, with measurements this change does not
duplicate: deny rate 14% vs 64%, blocking findings 7 vs 39, and one lane using P2/P3 while the other
uses P1/P2. Changing the models without their rubric change would carry that scale divergence over
to a new pair. Sequence this after them, or the same unsatisfiable-by-iteration behaviour
returns under different names.
Known cost
Over eight rounds on helm-ai-kernel#693
the flagship pair found two real defects the author missed — an unprotected boundary configuration
and an unconditional commercial-gate failure. Cheaper reviewers may not. That is the trade being
bought, and it should be bought deliberately.
49 tests passing.
🤖 Generated with Claude Code