Choose which bots review which project

README.md

@@ -385,6 +385,9 @@ crq loop <repo> <pr>      # blocking one-shot round: fire + wait + emit JSON fin
 crq feedback <repo> <pr>  # current normalized findings as JSON, WITHOUT triggering a review
 crq resolve <thread-id> [<thread-id>...]                    # resolve addressed review threads
 crq decline <thread-id> [...] --reason "<why>" [--resolve]  # record why a finding is declined
+crq reviewers <repo>      # which bots review this project, and what each costs
+crq reviewers set <repo> --bots <a,b> [--required <a,b>]   # choose them
+crq reviewers clear <repo>                                 # back to the fleet default
 crq autoreview            # ⭐ review ALL open PRs automatically, rate-coordinated
                           #    (--no-incremental = first review only; --once = single pass for cron)
 crq status                # show the dashboard: queue, in-flight, quota, next slot

cmd/crq/main.go

@@ -211,6 +211,12 @@ func run(ctx context.Context, args []string) int {
 		}
 		printJSON(result)
 		return 0
+	case "reviewers":
+		if err := cfg.RequireState(); err != nil {
+			fatal(err)
+			return 1
+		}
+		return runReviewers(ctx, service, args[1:])
 	case "decline":
 		threads, reason, resolve, ok := parseDeclineArgs(args[1:])
 		if !ok || len(threads) == 0 || strings.TrimSpace(reason) == "" {
@@ -356,6 +362,10 @@ USAGE
   crq decline <thread-id> [...] --reason "<why>" [--keep-open]
                                    reply on a thread to record why a finding is declined
                                    (resolves it; --keep-open leaves it open)
+  crq reviewers <repo>             which bots review this project (and what each costs)
+  crq reviewers set <repo> --bots <a,b> [--required <a,b>]
+                                   choose this project's reviewers
+  crq reviewers clear <repo>       go back to the fleet default
   crq autoreview [--once] [--no-incremental]
                                    keep open PRs reviewed, rate-coordinated
   crq preflight [--type all|committed|uncommitted] [--base <branch>]
@@ -509,6 +519,32 @@ replies contesting the decline, crq re-surfaces that reply as its own finding.
 
 Pass --keep-open to leave it unresolved anyway (an on-the-record disagreement you
 intend to keep working). Thread IDs come from .findings[].thread_id.
+`)
+	case "reviewers":
+		fmt.Print(`crq reviewers <repo>
+crq reviewers set <repo> --bots <login,...> [--required <login,...>]
+crq reviewers clear <repo>
+
+Which bots review one project, and what each of them costs.
+
+Without a subcommand it reports the reviewers that will actually run there — the
+fleet default, or this repository's own choice if it has one. Each entry carries
+its budget: "account" is serialized against the shared CodeRabbit allowance,
+"none" runs immediately and waits for nobody.
+
+  set     --bots chooses the co-reviewers; --required chooses which reviewers
+          gate convergence. An empty value means none here, which is a different
+          answer from not setting it at all.
+  clear   drops the override so the repository follows the fleet again.
+
+The configuration lives in the shared state ref, not in a file the repository
+carries: the daemon has no checkout of the repos it reviews, and a daemon and an
+agent reading different configurations while writing one state ref is a class of
+bug worth not having.
+
+The primary reviewer is fleet-wide. Its markers and command are compiled into the
+classifiers when crq starts, so a per-repo primary would mean per-repo
+classifiers — a much larger change than choosing who else runs.
 `)
 	case "autoreview", "auto":
 		fmt.Print(`crq autoreview [--once] [--no-incremental]
@@ -696,6 +732,100 @@ func codeRabbitOrg(ctx context.Context, binary string) string {
 	return checkCodeRabbitAuth(ctx, tools).CurrentOrg
 }
 
+// runReviewers handles `crq reviewers [set|clear] <repo> [flags]`.
+func runReviewers(ctx context.Context, service *crq.Service, args []string) int {
+	action, rest := "show", args
+	if len(args) > 0 && (args[0] == "set" || args[0] == "clear") {
+		action, rest = args[0], args[1:]
+	}
+	var repo string
+	var bots, required *string
+	for i := 0; i < len(rest); i++ {
+		arg := rest[i]
+		switch {
+		case arg == "--bots", arg == "--required":
+			if i+1 >= len(rest) {
+				fatal(fmt.Errorf("%s needs a value", arg))
+				return 1
+			}
+			value := rest[i+1]
+			i++
+			if arg == "--bots" {
+				bots = &value
+			} else {
+				required = &value
+			}
+		case strings.HasPrefix(arg, "--bots="):
+			value := strings.TrimPrefix(arg, "--bots=")
+			bots = &value
+		case strings.HasPrefix(arg, "--required="):
+			value := strings.TrimPrefix(arg, "--required=")
+			required = &value
+		case strings.HasPrefix(arg, "-"):
+			fatal(fmt.Errorf("unknown flag %s (usage: crq reviewers set <repo> --bots <a,b>)", arg))
+			return 1
+		case repo == "":
+			repo = arg
+		default:
+			fatal(fmt.Errorf("unexpected argument %q", arg))
+			return 1
+		}
+	}
+	if repo == "" {
+		fatal(errors.New("usage: crq reviewers [set|clear] <repo> [--bots <a,b>] [--required <a,b>]"))
+		return 1
+	}
+
+	var view crq.ReviewerView
+	var err error
+	switch action {
+	case "clear":
+		// Ignoring a mutation flag here would turn a malformed automation call
+		// like `reviewers clear repo --bots codex` into a silent wipe.
+		if bots != nil || required != nil {
+			fatal(errors.New("clear takes no --bots/--required (it drops the whole override)"))
+			return 1
+		}
+		view, err = service.ClearReviewers(ctx, repo)
+	case "set":
+		if bots == nil && required == nil {
+			fatal(errors.New("set needs --bots or --required (crq reviewers clear <repo> drops the override)"))
+			return 1
+		}
+		view, err = service.SetReviewers(ctx, repo, splitList(bots), splitList(required))
+	default:
+		// `crq reviewers owner/repo --bots codex` is a set command missing its
+		// verb. Showing the configuration and exiting 0 tells automation the
+		// mutation worked when nothing changed.
+		if bots != nil || required != nil {
+			fatal(errors.New("did you mean `crq reviewers set`? --bots/--required only apply to set"))
+			return 1
+		}
+		view, err = service.Reviewers(ctx, repo)
+	}
+	if err != nil {
+		fatal(err)
+		return 1
+	}
+	printJSON(view)
+	return 0
+}
+
+// splitList turns an unset flag into nil and an empty one into an empty
+// non-nil slice: "not chosen" and "chosen to be none" are different answers.
+func splitList(value *string) []string {
+	if value == nil {
+		return nil
+	}
+	out := []string{}
+	for _, part := range strings.Split(*value, ",") {
+		if part = strings.TrimSpace(part); part != "" {
+			out = append(out, part)
+		}
+	}
+	return out
+}
+
 func repoPR(args []string) (string, int, bool) {
 	if len(args) != 2 {
 		return "", 0, false

internal/crq/auto.go

@@ -305,17 +305,36 @@ func (s *Service) needsReview(ctx context.Context, state State, repo string, pr
 	if err != nil {
 		return false, "", err
 	}
-	bot := dialect.NormalizeBotName(s.cfg.Bot)
+	cfg := s.cfgFor(state, repo)
+	bot := dialect.NormalizeBotName(cfg.Bot)
 	lastBotReview := ""
+	// Every reviewer this repository gates on, not just the primary. A repo that
+	// requires Codex or Bugbot and already has a CodeRabbit review at the head
+	// would otherwise never be enqueued, so the reviewer it chose is never asked.
+	reviewedHere := map[string]string{}
 	for _, review := range reviews {
-		if dialect.NormalizeBotName(review.User.Login) == bot && review.CommitID != "" {
+		login := dialect.NormalizeBotName(review.User.Login)
+		if review.CommitID == "" {
+			continue
+		}
+		if login == bot {
 			lastBotReview = dialect.ShortOID(review.CommitID)
 		}
+		reviewedHere[login] = dialect.ShortOID(review.CommitID)
 	}
 	if incremental {
 		need := lastBotReview != head
+		missing := cfg.Bot
+		if !need {
+			for _, login := range cfg.RequiredBots {
+				if reviewedHere[dialect.NormalizeBotName(login)] != head {
+					need, missing = true, login
+					break
+				}
+			}
+		}
 		if need {
-			s.logEnqueue(repo, pr, head, "no bot review at head")
+			s.logEnqueue(repo, pr, head, "no "+dialect.NormalizeBotName(missing)+" review at head")
 		}
 		return need, head, nil
 	}

internal/crq/codex_replay_test.go

@@ -513,9 +513,9 @@ func TestSelfHealCodexClaimPreventsDoublePost(t *testing.T) {
 	}
 	obs.eng.Events = events
 	before := f.codexPosted(repo, pr)
-	f.svc.selfHealCoReviewers(f.ctx, *round, obs.eng, f.clk.now())
+	f.svc.selfHealCoReviewers(f.ctx, f.svc.cfg, *round, obs.eng, f.clk.now())
 	// Second sweeper with the SAME stale observation (still CodexCommandID==0).
-	f.svc.selfHealCoReviewers(f.ctx, *round, obs.eng, f.clk.now())
+	f.svc.selfHealCoReviewers(f.ctx, f.svc.cfg, *round, obs.eng, f.clk.now())
 	if got := f.codexPosted(repo, pr) - before; got != 1 {
 		t.Fatalf("concurrent self-heals must post exactly once, got %d extra posts", got)
 	}

internal/crq/config.go

@@ -44,10 +44,22 @@ type Config struct {
 	// CRQ_COBOT_<NAME>_* keys). An entry exists for every wanted or required
 	// co-reviewer; required ones are already folded into RequiredBots.
 	CoBots []CoBotConfig
+	// KnownCoBots is every registry co-reviewer with the operator's per-bot
+	// environment applied, enabled here or not. A repository override picks from
+	// this, so enabling a bot the fleet disabled still honours CRQ_COBOT_<NAME>_*
+	// instead of silently falling back to registry defaults.
+	KnownCoBots []CoBotConfig
 	// Reviewers is the single description of who reviews and what they cost.
 	// Bot / RequiredBots / FeedbackBots / CoBots above are DERIVED from it and
 	// kept only so existing consumers keep compiling; new code should read this.
-	Reviewers         []Reviewer
+	Reviewers []Reviewer
+	// FeedbackBotsExplicit records that CRQ_FEEDBACK_BOTS was set. It is the one
+	// list an operator may widen beyond who reviews, so neither LoadConfig's
+	// derivation nor a per-repo override may quietly replace it.
+	FeedbackBotsExplicit bool
+	// OverrideAt is when the per-repo reviewer override this configuration was
+	// built from was last written, so a fire can tell whether it still holds.
+	OverrideAt        *time.Time
 	RateLimitCommand  string
 	RateLimitMarker   string
 	CalibrationMarker string
@@ -184,13 +196,19 @@ func LoadConfig() (Config, error) {
 	}
 	// Built here, after the command is resolved, because the primary's trigger is
 	// part of describing it.
+	cfg.KnownCoBots = parseAllCoBots(env)
 	cfg.Reviewers = buildReviewers(cfg.Bot, cfg.ReviewCommand, requiredBots, coBots)
 	// The legacy lists are now VIEWS of cfg.Reviewers rather than parallel
 	// parses, so they cannot answer differently from it. An explicit
 	// CRQ_FEEDBACK_BOTS still wins: it is the one list an operator may widen
 	// beyond who reviews (to surface a bot's findings without waiting for it).
 	cfg.RequiredBots = cfg.reviewerLogins(func(r Reviewer) bool { return r.Required })
-	if _, explicit := env["CRQ_FEEDBACK_BOTS"]; !explicit {
+	// Present-but-empty is not a choice: an operator who exports the variable
+	// blank has named nobody, and treating that as explicit would freeze the
+	// derived list and, through ForRepo, ignore every per-repo override.
+	explicitFeedback := strings.TrimSpace(env["CRQ_FEEDBACK_BOTS"]) != ""
+	cfg.FeedbackBotsExplicit = explicitFeedback
+	if !explicitFeedback {
 		// Everyone except a primary the operator deliberately left out of
 		// CRQ_REQUIRED_BOTS. That omission is how you say "do not wait for
 		// CodeRabbit here", and surfacing its findings anyway would put the round
@@ -326,6 +344,44 @@ type CoBotConfig struct {
 // legacy alias of CRQ_COBOT_CODEX_CMD. Bugbot/Macroscope default to
 // `selfheal` — they auto-review pushes, so crq only nudges one that went
 // silent on a head it should have covered.
+// resolveCoBot applies the operator's per-bot environment to a registry entry.
+// Uniform across bots: the per-bot key wins, then the registry's legacy alias if
+// it declares one, then its default command. No bot is named here — the policy
+// travels as registry metadata.
+func resolveCoBot(env map[string]string, co dialect.CoReviewer, required bool) CoBotConfig {
+	key := strings.ToUpper(co.Name)
+	base := defaultCoBot(co, required)
+	command := base.Command
+	if v, ok := env["CRQ_COBOT_"+key+"_CMD"]; ok {
+		command = v
+	} else if co.LegacyCommandEnv != "" {
+		command = stringEnvAllowEmpty(env, co.LegacyCommandEnv, command)
+	}
+	command = strings.TrimSpace(command)
+	trigger := base.Trigger
+	switch v := engine.TriggerMode(strings.ToLower(strings.TrimSpace(env["CRQ_COBOT_"+key+"_TRIGGER"]))); v {
+	case engine.TriggerNever, engine.TriggerSelfHeal, engine.TriggerAlways:
+		trigger = v
+	}
+	if command == "" {
+		// No trigger command means crq can never post one, whatever the mode.
+		trigger = engine.TriggerNever
+	}
+	base.Command, base.Trigger = command, trigger
+	base.SelfHealGrace = durationEnv(env, "CRQ_COBOT_"+key+"_GRACE", defaultSelfHealGrace)
+	return base
+}
+
+// parseAllCoBots resolves every registry co-reviewer with the environment
+// applied, regardless of whether CRQ_COBOTS enables it.
+func parseAllCoBots(env map[string]string) []CoBotConfig {
+	out := make([]CoBotConfig, 0, 4)
+	for _, co := range dialect.KnownCoReviewers() {
+		out = append(out, resolveCoBot(env, co, false))
+	}
+	return out
+}
+
 func parseCoBots(env map[string]string, requiredBots []string) ([]CoBotConfig, error) {
 	enabled := map[string]bool{}
 	var unknown []string
@@ -359,40 +415,36 @@ func parseCoBots(env map[string]string, requiredBots []string) ([]CoBotConfig, e
 		if !enabled[co.Name] && !required {
 			continue
 		}
-		// Uniform across bots: the per-bot key wins, then the registry's legacy
-		// alias if it declares one, then its default command. No bot is named
-		// here — the policy travels as registry metadata.
-		command := co.Command
-		if v, ok := env["CRQ_COBOT_"+key+"_CMD"]; ok {
-			command = v
-		} else if co.LegacyCommandEnv != "" {
-			command = stringEnvAllowEmpty(env, co.LegacyCommandEnv, command)
-		}
-		command = strings.TrimSpace(command)
-		trigger := triggerMode(co.DefaultTrigger, engine.TriggerSelfHeal)
-		if required && co.RequiredTrigger != "" {
-			trigger = triggerMode(co.RequiredTrigger, trigger)
-		}
-		switch v := engine.TriggerMode(strings.ToLower(strings.TrimSpace(env["CRQ_COBOT_"+key+"_TRIGGER"]))); v {
-		case engine.TriggerNever, engine.TriggerSelfHeal, engine.TriggerAlways:
-			trigger = v
-		}
-		if command == "" {
-			// No trigger command means crq can never post one, whatever the mode.
-			trigger = engine.TriggerNever
-		}
-		out = append(out, CoBotConfig{
-			Login:         co.Login,
-			Name:          co.Name,
-			Command:       command,
-			Trigger:       trigger,
-			Required:      required,
-			SelfHealGrace: durationEnv(env, "CRQ_COBOT_"+key+"_GRACE", 10*time.Minute),
-		})
+		out = append(out, resolveCoBot(env, co, required))
 	}
 	return out, nil
 }
 
+const defaultSelfHealGrace = 10 * time.Minute
+
+// defaultCoBot is a co-reviewer's configuration from the registry alone, with no
+// environment applied. parseCoBots layers env on top of it, and a per-repo
+// override uses it directly for a bot the fleet default does not enable — which
+// is the whole point of choosing reviewers per project.
+func defaultCoBot(co dialect.CoReviewer, required bool) CoBotConfig {
+	trigger := triggerMode(co.DefaultTrigger, engine.TriggerSelfHeal)
+	if required && co.RequiredTrigger != "" {
+		trigger = triggerMode(co.RequiredTrigger, trigger)
+	}
+	command := strings.TrimSpace(co.Command)
+	if command == "" {
+		trigger = engine.TriggerNever
+	}
+	return CoBotConfig{
+		Login:         co.Login,
+		Name:          co.Name,
+		Command:       command,
+		Trigger:       trigger,
+		Required:      required,
+		SelfHealGrace: defaultSelfHealGrace,
+	}
+}
+
 // triggerMode converts a registry trigger string to the engine mode, falling
 // back when a bot declares none.
 func triggerMode(name string, fallback engine.TriggerMode) engine.TriggerMode {
@@ -480,3 +532,11 @@ func ownerOf(repo string) string {
 	owner, _, _ := strings.Cut(repo, "/")
 	return owner
 }
+
+// WriterID identifies this PROCESS in the shared state, in the same form the
+// autoreview leader records. A new CLI and an old daemon commonly run on one
+// machine, so a per-host key would let the upgraded CLI's write vouch for the
+// daemon that has not been upgraded.
+func (c Config) WriterID() string {
+	return fmt.Sprintf("host=%s pid=%d", c.Host, os.Getpid())
+}