FAQ

R/ means son-of-anton-review (feat/cloudflare-native); P/ means son-of-anton-operator-parity (feat/greptile-operator-parity). They are separate, unmerged trees. Answers describe inspected source, not a live deployment probe.

Is Son of Anton open source?

Public source availability and license terms have not been established. The verified handoff records a private repository with no license. The local package declares private: true, has no license field and still points to the old repository URL (R/package.json:1-25). Do not infer distribution rights from source access or a README claim.

Do model keys ever leave the environment?

Yes, they must be sent to the selected provider to authenticate requests. The application resolves keys from environment and does not expose their values in the provider-status DTO or Models UI. That is narrower than claiming a key never leaves the process or can never be logged anywhere.

Native Cloudflare forwards bare names only. The native App private key remains on the separate broker; model keys do reach the review container. Do not paste keys into repository instructions, review bodies or diagnostic reports.

Sources: R/src/model-provider.js:24-37,174-185,212-227,254-273,363-385; R/cloudflare-native/src/container-env.js:11-70.

Which provider should I use?

OpenRouter is recommended. OpenAI direct and Anthropic direct are other HTTP options; Codex CLI uses its own local authentication. OpenRouter is not uniquely headless.

Select variables for your runtime: native entrypoint accepts GILF_MODEL_PROVIDER and GILF_MODEL; Node worker.mjs still needs GILF_CODEX_PROVIDER and GILF_CODEX_MODEL. Always select a model explicitly. The generic resolver's per-provider defaults are not wired into these entrypoints.

GILF_OPENROUTER_REQUIRE_FREE is on unless exactly 0; nonzero or unknown catalog pricing is refused. The checked-in native manifest explicitly opts into paid models. A cost-rate override cannot bypass the catalog guard.

Sources: R/worker.mjs:43-54; R/cloudflare-native/container/entrypoint.mjs:314-348; R/src/codex-review-runner.js:2022-2057,2320-2337; R/cloudflare-native/wrangler.jsonc:151-161. See Model providers.

Why did validation refuse to run?

An unavailable or unsafe executor is a missing validation, not a passed check or automatically a defect in the PR. The engine does not silently fall back to host-local execution. Summary text varies by route.

Publication is a separate decision. A refusal can appear in a posted review if analysis and publishing succeed, but it does not guarantee publication. Do not enable host-local execution merely to clear the warning.

Sources: R/src/validation-executor.js:287-296,485-579; R/src/codex-review-runner.js:1254-1340; R/cloudflare-native/src/cf-sandbox-validation.js:99-146. See Validation executors.

Why are there no inline comments?

The model finding schema contains a path, not line coordinates. The publisher posts a PR review body, check run and optional issue comments; it does not send inline comments or applyable suggestion patches. Check runs can be patched when an id is available. PR review bodies are posted, not updated in place across heads.

Sources: R/src/codex-review-runner.js:210-224; R/src/github-publisher.js:22-79. The declared inlineComments config key does not implement this missing capability. See Review output schema.

Can a shadow lane affect the posted review?

Distinguish three different mechanisms:

• Shadow model: actual runner selector is GILF_CODEX_SHADOW_MODEL, optionally GILF_CODEX_SHADOW_PROVIDER. The call follows successful primary semantic review and is stored as shadowReview, not published separately. GILF_MODEL_SHADOW alone does not activate it.
• Shadow validation executor: a supported, different and wired executor emits comparison telemetry. Its findings/missing validations are not merged into primary output. It still consumes compute and a bounded wait.
• Hypothesis shadow: not the same guarantee. Usable hypothesis results can recover failed monolithic analysis, and GILF_HYPOTHESIS_PRIMARY=1 can promote them to the primary result.

With no enabling flags and no injected worker, the swarm returns null. Native Cloudflare does not forward the model-shadow or V5 worker/planner/evidence/inversion flags; changing those Worker vars alone has no effect.

Sources: R/src/codex-review-runner.js:2324-2337,2657-2707,3198-3267; R/src/validation-executor.js:365-430; R/cloudflare-native/src/container-env.js:15-86.

Why is a successful native review not visible on GitHub?

Native code defaults to GILF_PUBLISH_MODE=shadow, which selects a recording publisher. Confirm the actual mode, policy and publication state, not just analysis success. The checked-in manifest explicitly sets live, so source defaults alone do not identify a deployment's mode.

The container logs omp-container: publish mode with the resolved value. Live mode requires broker transport and refuses a local SQLite dev-container path without it. On Node, the env publish-mode gate is not used: supplying App credentials constructs a live publisher.

Sources: R/cloudflare-native/src/publish-mode.js:26-69; R/cloudflare-native/container/entrypoint.mjs:273-302; R/cloudflare-native/wrangler.jsonc:133; R/worker.mjs:35-41.

Can I run without Cloudflare?

Yes. The Node server can share SQLite state and queue files with the Node worker. Supply absolute paths in both processes, for example:

export GILF_DB_PATH=/absolute/path/to/data/anton.db
export GILF_QUEUE_DB_PATH=/absolute/path/to/data/anton-queue.db

Use your real writable paths, not these illustrative ones. The entrypoint commands are node server.mjs for the server and node worker.mjs for a bounded worker batch, run separately. The worker is not a persistent polling service: defaults are one job and one concurrent worker per invocation, so provide an appropriate supervisor/scheduler for continuous operation.

A configured GILF_QUEUE_URL plus GILF_QUEUE_TOKEN wins over SQLite. Without remote configuration or shared database paths, separate processes use separate in-memory queues and do not exchange jobs. The server requires GITHUB_WEBHOOK_SECRET; provider, validation and GitHub setup are additional prerequisites, not supplied by the two database variables.

Sources: R/server.mjs:21-50,108-112; R/src/worker-runner.js:29-72; R/worker.mjs:64-66. See Run on a Node box.

Is GILF_REPOS a security allowlist?

No. It seeds Node repo configuration. An absent repo record is merged over defaults that enable automatic review on main and dev. Native Cloudflare instead derives enablement from stored config, previous reviewed state and autoEnableNewRepos. GitHub App installation access and authorization are separate controls.

Sources: R/server.mjs:73-74; R/src/config.js:1-9,86-97; R/src/review-service.js:1295-1310; R/cloudflare-native/src/d1-store-adapter.js:153-172. See Repo scoping.

Why GILF_ and not ANTON_?

The runtime still reads GILF_ names. Do not rename them based on product branding. The parity Worker has a narrower canonical alias mechanism: SON_OF_ANTON_ names win over GILF_ for the suffixes its callers request. This does not alias arbitrary Node or native container flags, and no future cutover date is promised here.

Sources: R/cloudflare-native/src/container-env.js:15-70; P/cloudflare/src/env.js:1-10.

What does @gilf do?

It is a supported alias for @anton in the command parser. Both prefixes accept review, rerun, status and help, at the start of the comment, case-insensitively. Parsing a command is not authorization or proof every runtime handles every command the same way. Native container dispatch distinguishes review/rerun requests; Node also implements status/help responses.

Sources: R/src/commands.js:1-39; R/src/review-service.js:764-834; R/cloudflare-native/src/ingress.js:80-114. See Triggers and commands.

How do I see cost?

Inspect persisted run/model telemetry and the appropriate dashboard trace surface. Known usage is multiplied by built-in OpenAI/Anthropic rates or GILF_MODEL_PRICES; OpenRouter has no built-in rate table. Unknown price or usage can produce null. Do not enter zero rates unless they are actually applicable.

Validation costs use separate wall-clock rate cards. Dashboard provider badges indicate its backend environment, not a successful review-container call. Expanded parity dashboard routes do not exist on native ingress.

Sources: R/src/model-provider.js:39-93; R/src/validation-executor.js:146-202; anton-ui/worker/proxy-utils.js:15-23; anton-ui-trace-parity/worker/proxy-utils.js:15-38. See Observability and cost.

Does it review docs-only PRs?

Yes, potentially on a deterministic fast path. Validation is skipped when code-changes-only config is enabled and preflight classifies a docs-only diff. The semantic model skip additionally requires no supplied memory text, no rendered operator guidance, no command and no competitor context. Thus an automatic docs-only PR does not always skip the model.

GILF_CODEX_FOR_DOCS_ONLY=1 disables the semantic fast-path skip in a process that actually receives it. It is not forwarded by the native container projection. Generated-artifact-only diffs also skip validation under code-changes-only config, but that alone is not the docs-only model skip.

Sources: R/src/codex-review-runner.js:840-848,2528-2548,2620-2656; R/cloudflare-native/src/container-env.js:15-86.

Where do I start when a review is stuck?

Troubleshooting separates ingress, admission, dispatch, model, validation, persistence and publication failures. Keep the delivery id, review key, head SHA, error and phase; omit secrets. An HTTP health response, configured badge or empty findings list is not evidence that the whole review succeeded.