[zzwong]

Summary

Builds on the provider foundation in #714. Add cr review --identity-shadow --identity-shadow-config <path> to compare an explicitly configured System One model with the review's existing finding groups and prior-thread matching. The diagnostic runs after a newly completed review, its posting lock release, and completion-hook dispatch. It is off by default; a config path alone does nothing.

Current findings, verdicts, thread actions, posting, ledger records, fail-on behavior and normal output remain authoritative. The observer receives copied values and returns no decision to the review path. Resumed, retried, aborted and incomplete live reviews skip it. Dry-run opt-in can send diagnostic inputs to the configured inference provider while retaining the usual prohibition on Git-provider writes.

The implementation reuses the offline identity prompts, request preparation, provider adapter, receipts and replay machinery. Complete findings and eligible normalized prior opening bodies are retained in private run-owned artifacts, together with the observed baseline, bounded inference receipts and hash-bound comparisons. Baseline agreement measures agreement with current behavior; it is not an accuracy label or evidence of model qualification.

Limits and operation

The standalone strict YAML requires an HTTPS endpoint, model, exact expected response model, auth scheme and credential-store reference. Both complete pair universes are preflighted and output directories reserved before credentials or HTTP. The default qualification envelope is 40 calls, 327,680 aggregate request bytes, 6,144 state bytes, 8,192 request bytes, 10 seconds per call and a 30-second inference phase; oversized runs are refused rather than sampled. There are no automatic retries or profile/init defaults.

Credential lookup precedes the inference timer and retains the selected backend's existing synchronous bound. It can therefore add command latency after the authoritative review has completed. Local publication adds further time. Unknown prices or usage remain unknown; these limits do not promise a hard dollar ceiling. Ordinary diagnostic errors produce private receipts and sanitized stderr warnings without changing the completed review.

Validation

• Full make check passed: tidy, formatting, zero lint issues, the complete Go test suite and build. Race checks passed for internal/identityexperiment, internal/identityshadow and internal/app.
• A real local Live/pipeline/outbox/ledger regression compares shadow off/on for success, malformed output, cancellation, invalid config and comparison-publication failure. It verifies both native findings, all five posted actions, thread reply/resolution, fail-on behavior and unchanged authoritative state; the same posting lock is held at submission and released before observer entry, after completion-hook dispatch. Deliberately contradictory shadow predictions measure three disagreements without filtering findings. JSON coverage combines the actual pipeline presentation with every live-result field consumed by the command.
• Main-branch integration retains the flat workspace layout and successful-checkout cleanup. The live equivalence regression derives exact workspace paths independently, preserves unknown paths and hashes, verifies both checkout locations are removed, and confirms diagnostic artifacts remain under their owning run.
• Snapshot and observer regressions cover default-off zero work, selected-store cleanup, source eligibility, copied inputs, baseline isolation, complete-universe preflight, private artifact reservation/publication failures, inference budgets, retained accounting and all resumed/recovery exclusions.
• Review follow-ups preserve unresolved task status in the aggregate receipt and manifest, including fully answered but contradictory cohorts. Added regressions independently verify the aggregate byte cap, the shared configured deadline after credential lookup, and exact prior-match direction. Temporary mutations removing each guard fail the intended tests; all original calls and findings remain accounted for.
• A compiled CLI smoke verifies both flags, empty-fixture completion and budget refusal with zero provider calls and a nonexistent synthetic credential ref. Retained payload hashes, private permissions and independent offline replay all match. All feature verification used local fixtures, synthetic credentials and mock providers; no live review or paid inference was performed for these checks.

This feature does not enable the diagnostic on live reviews or change any model-selection or posting policy.

[zzwong]

An inconsistent decision cycle can mark the diagnostic complete. Add regression coverage for aggregate-byte limits, the inference deadline and exact prior-pair request contents. The status defect affects diagnostic completeness without changing the authoritative verdict or posting.