Roadmap and Feature Flags

Code-defined gates, actual default behavior, Cloudflare forwarding gaps and branch integration requirements.

A built feature is not an enabled feature. With untouched runner flags, the hypothesis swarm does not run, even in shadow: no worker is constructed and the method returns null. Native publication has a separate shadow/live gate. Do not conflate that gate with shadow analysis.

R/ means son-of-anton-review on feat/cloudflare-native. P/ means son-of-anton-operator-parity on feat/greptile-operator-parity. These branches are unmerged. This page records implementation state, not a release schedule or a claim about the currently deployed environment.

Flag table

Setting	Code default	Actual behavior
`GILF_HYPOTHESIS_PRIMARY`	Off; exact `1` enables	Usable hypothesis output can replace monolithic semantic review. Also implicitly enables a Prime worker unless `GILF_PRIME_SHADOW=0`.
`GILF_PRIME_SHADOW`	Off; exact `1`, or implied by primary flag	Supplies a Prime hypothesis worker. Its output can become primary when primary is enabled; usable hypotheses can also recover a failed monolithic review. It is not an unconditional never-published guarantee.
`GILF_HYPOTHESIS_CONCURRENCY`	`4` in runner	Bounds worker execution only when a worker exists.
`GILF_HYPOTHESIS_PLANNER`	Off; exact `1` enables	Calls an HTTP planner only when a hypothesis worker exists and semantic review is not fast-path skipped. Codex planner selection skips.
`GILF_PLANNER_PROVIDER`, `GILF_PLANNER_MODEL`	Actual runner primary provider/model	Separate planner selection; OpenRouter recommended, direct HTTP alternatives supported.
`GILF_EVIDENCE_ARTIFACTS`	Off; exact `1` enables	Builds/persists artifacts and attempts matching to findings. Requires a storage client to persist.
`GILF_EVIDENCE_REQUIRE_ARTIFACTS`	Off; accepts `1`, `true`, `yes`, `on`	Inside enabled artifact processing, marks unsupported execution claims unverified. Does not lower severity, and module errors return original findings.
`GILF_MODEL_INVERSION`	Off; accepts `1`, `true`, `yes`, `on`	Heuristic author-family detection chooses another configured model family. Low confidence, missing target/key or free-model rejection leaves the configured primary. An inverted provider failure retries the primary once.
`GILF_VALIDATION_SHADOW_EXECUTOR`	Unset	Supported, different and wired executor runs for telemetry; output does not merge into primary findings.
`GILF_CODEX_SHADOW_MODEL`	Unset	Actual runner shadow-model selector. Runs only after successful primary semantic review, not every review.
`GILF_MODEL_SHADOW`	Unset	Read by the generic library resolver, not wired into the Node/native runner entrypoints. Not a working replacement for the legacy shadow selector.
`GILF_PUBLISH_MODE`	Native code: `shadow`	Native `live` requires authenticated publication. Checked-in native manifest explicitly sets `live`. Node does not consult this gate.

Sources: R/src/codex-review-runner.js:2224-2226,2300-2337,2351-2366,2650-2707,3198-3267,3342-3353,3517-3569; R/src/author-model.js:15-16,198-231; R/src/validation-executor.js:251-282,365-430; R/src/model-provider.js:348-358; R/cloudflare-native/src/publish-mode.js:26-69; R/worker.mjs:35-54.

Native Cloudflare is blocked at the environment boundary

R/cloudflare-native/src/container-env.js:15-86 forwards a deliberate allowlist. None of these families are included:

GILF_HYPOTHESIS_* and GILF_PLANNER_*.
GILF_PRIME_*.
GILF_MODEL_INVERSION and its map/confidence controls.
GILF_EVIDENCE_ARTIFACTS / GILF_EVIDENCE_REQUIRE_ARTIFACTS.
Role-specific GILF_MODEL_PRIMARY / GILF_MODEL_SHADOW and legacy shadow-model variables.

Adding Worker vars or secrets with those names does not enable container behavior. A reviewed integration change must forward the intended controls, provide the required worker/provider/storage dependencies and verify the effective runtime. This page does not prescribe a production flag flip.

GILF_DISABLE_HYPOTHESIS_WORKERS is a harness-manifest descriptor control, not a runtime kill switch (R/src/harness-evolution.js:56-59). To stop a Node Prime-backed swarm, remove its actual enabling flags and account for the primary flag's implicit enablement.

The forwarding allowlist does carry current provider selection, GILF_MODEL, cost overrides, bare model keys, publication mode, paid-OpenRouter opt-in, E2B key/shape/timeout, validation shadow selection and validation rates. See Environment reference.

Policy defaults are not environment flags

Policy capability	Default	Safety boundary
Auto approval	`autoApprove.enabled: false`	Needs confidence 5, enabled confidence section, complete same-head coverage, no missing validation, allowed risk, matching filters and no substantive/protected findings.
PR description update	`updatePrDescription: false`	Reads latest PR, checks pinned head and changes only the owned summary section.
Prompt to Fix	`promptToFix: false`	Copyable text, not an applyable patch or verified repair.
Memory creation permission	`memoryRuleCreation: ADMINS_ONLY`	Stored/validated enum, not a runtime write-authorization gate in these trees.

Sources: R/src/operator-review-policy.js:25-45,227-238; R/src/github-publisher.js:82-103; R/src/review-format.js:237-242,249-266. Policy editing endpoints are on P/cloudflare/; see Dashboard settings.

Integration work, not promised releases

The inspected source establishes these concrete remaining boundaries:

Unify API and engine deployment deliberately. P/cloudflare/src/worker.js:142-157 dispatches settings, reports, SCM and Test Lab; R/cloudflare-native/src/main.js:26-29 sends public fetch to ingress only. A dashboard proxy target change cannot merge those implementations.
Wire and verify optional analysis dependencies. An enabled planner with no hypothesis worker emits no_hypothesis_worker; a Codex planner emits codex_provider_unsupported. Forwarding flags alone cannot supply a worker or working provider (R/src/codex-review-runner.js:3342-3353).
Establish artifact persistence before relying on evidence enforcement. With no storage, processing records no_artifact_storage; generated artifacts are not automatically uploaded or linked (R/src/codex-review-runner.js:3531-3546).
Add actual line-addressed findings before offering inline workflows. Model output has no line fields and publisher review bodies have no inline comments (R/src/codex-review-runner.js:210-224; R/src/github-publisher.js:50-66).
Establish representative evaluation evidence. The benchmark CLI scores supplied fixtures, not live historical PR replay (R/evals/v5-benchmark-cli.mjs:10-24,106-131).
Resolve distribution status separately. Public source availability and license rights are not established. Local package metadata is private and still names the old repository (R/package.json:1-25).

These are source-backed integration needs, not dates, guarantees or an instruction to alter production. The older internal plan is not used here as evidence that an item is still missing: finding evolution and outcome priors already have implementations.

Test Lab definitions

The parity API defines the following experiment records:

Experiment id	Definition status	What exists
`validation-executor`	`running`	CF Sandbox primary and E2B shadow variants; reads validation spans.
`model-comparison`	`planned`	No variants or span prefix.
`hypothesis-shadow`	`planned`	No variants or span prefix.
`hypothesis-planner`	`planned`	No variants or span prefix.

A static running label does not prove observed samples or quality. Evidence: P/cloudflare/src/test-lab-api.js:12-61,90-118. Native manifest selects E2B shadow with a 600000 ms timeout and 50 USD ledger ceiling. The budget gate logs e2b_budget_exhausted and withholds the exact managed-e2b selector at the ceiling; a ledger read failure leaves it enabled (R/cloudflare-native/wrangler.jsonc:143-150; R/cloudflare-native/src/container-env.js:100-141).

Benchmark CLI

From the review repository, this scores existing fixture outputs and writes a scorecard; it does not run the model on a local diff:

node evals/v5-benchmark-cli.mjs --fixture evals/benchmark/fixtures/v5-smoke.json --run-id smoke

The parser supports --fixture, --out-dir, --run-id, --persist, --repo, --commit-sha and --help. Default output root is generated/benchmark-harness; persistence is an explicit remote-write option requiring a configured context-graph store. Do not use fixture scorecards as public claims of review quality.

Source: R/evals/v5-benchmark-cli.mjs:10-61,69-74,106-131. This command is documented from source, not executed as part of this documentation update.

Operational checks are runtime-specific

Use the native ingress /health only as an ingress liveness probe. It does not expose the parity Worker's /operator/api/* or legacy /queue/stats routes. Node's server and worker also have different lifecycle and publication behavior. See Troubleshooting before treating a green health response, configured-provider badge or unset feature flag as proof of an end-to-end review.