From 74e9b82463bf1a5ec2f58a04bd45f61b0326641a Mon Sep 17 00:00:00 2001
From: Devarshi Shimpi <devarshishimpi@gmail.com>
Date: Fri, 14 Aug 2026 14:20:19 +0530
Subject: [PATCH 01/12] add: extract GitHub provider into a dedicated package

---
 package-lock.json                             |  12 ++
 packages/core/src/diff/index.ts               |   5 +-
 .../src/ports/{github.ts => git-provider.ts}  |  12 +-
 packages/core/src/ports/index.ts              |   2 +-
 packages/core/src/ports/runtime.ts            |   6 +-
 packages/core/src/review/diff-cache.ts        |   6 +-
 packages/core/src/review/finalize.ts          |   4 +-
 packages/core/src/review/index.ts             |  49 +++--
 packages/core/src/review/phase-control.ts     |   4 +-
 packages/core/src/review/phase.ts             |   4 +-
 packages/core/src/review/prepare.ts           |   4 +-
 packages/core/src/review/request.ts           | 170 +++++++++---------
 packages/provider-github/package.json         |  19 ++
 .../provider-github/src}/app-auth.ts          |  56 ++----
 .../provider-github/src/client.ts             |  74 +++-----
 packages/provider-github/src/constants.ts     |   6 +
 .../provider-github/src}/diff-fetch.ts        |  33 ++--
 .../provider-github/src}/http.ts              |  19 +-
 packages/provider-github/src/index.ts         |   6 +
 .../provider-github/src}/labels.ts            |  35 +---
 .../provider-github/src}/oauth.ts             |  11 +-
 .../provider-github/src}/review-post.ts       |  28 +--
 .../provider-github/src/service.ts            |  19 +-
 .../provider-github/src}/types.ts             |   2 +-
 packages/provider-github/src/webhook.ts       |  55 ++++++
 packages/provider-github/tsconfig.json        |   8 +
 packages/schema/package.json                  |   3 +-
 packages/schema/src/github.ts                 |  13 +-
 packages/schema/src/webhook.ts                |  26 +++
 scripts/check-core-boundary.mjs               |   1 +
 src/server/adapters/services.ts               |  16 +-
 src/server/core/job-recovery.ts               |   2 +-
 src/server/routes/api/jobs.ts                 |   2 +-
 src/server/routes/api/repos.ts                |   2 +-
 src/server/routes/auth.ts                     |   2 +-
 src/server/routes/webhook.ts                  |  19 +-
 test/api/repos.spec.ts                        |   2 +-
 test/review/async-batch.spec.ts               |  25 +--
 test/review/batch-flow.spec.ts                |  13 +-
 test/review/comments.spec.ts                  |   5 +-
 test/review/flow-chunking.spec.ts             |  11 +-
 test/review/flow-lifecycle.spec.ts            |  22 +--
 test/review/flow-retry.spec.ts                |  11 +-
 test/review/subrequest-completion.spec.ts     |  16 +-
 44 files changed, 457 insertions(+), 383 deletions(-)
 rename packages/core/src/ports/{github.ts => git-provider.ts} (82%)
 create mode 100644 packages/provider-github/package.json
 rename {src/server/core/github => packages/provider-github/src}/app-auth.ts (72%)
 rename src/server/core/github/index.ts => packages/provider-github/src/client.ts (78%)
 create mode 100644 packages/provider-github/src/constants.ts
 rename {src/server/core/github => packages/provider-github/src}/diff-fetch.ts (64%)
 rename {src/server/core/github => packages/provider-github/src}/http.ts (80%)
 create mode 100644 packages/provider-github/src/index.ts
 rename {src/server/core/github => packages/provider-github/src}/labels.ts (68%)
 rename {src/server/core/github => packages/provider-github/src}/oauth.ts (85%)
 rename {src/server/core/github => packages/provider-github/src}/review-post.ts (76%)
 rename src/server/services/github.ts => packages/provider-github/src/service.ts (77%)
 rename {src/server/core/github => packages/provider-github/src}/types.ts (90%)
 create mode 100644 packages/provider-github/src/webhook.ts
 create mode 100644 packages/provider-github/tsconfig.json
 create mode 100644 packages/schema/src/webhook.ts

diff --git a/package-lock.json b/package-lock.json
index fc14b7ff..4fa8b21a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -565,6 +565,10 @@
       "resolved": "packages/core",
       "link": true
     },
+    "node_modules/@codra/provider-github": {
+      "resolved": "packages/provider-github",
+      "link": true
+    },
     "node_modules/@codra/schema": {
       "resolved": "packages/schema",
       "link": true
@@ -8641,6 +8645,14 @@
         "@types/picomatch": "^4.0.3"
       }
     },
+    "packages/provider-github": {
+      "name": "@codra/provider-github",
+      "version": "0.9.4",
+      "dependencies": {
+        "@codra/core": "*",
+        "@codra/schema": "*"
+      }
+    },
     "packages/schema": {
       "name": "@codra/schema",
       "version": "0.9.4",
diff --git a/packages/core/src/diff/index.ts b/packages/core/src/diff/index.ts
index 33d8beb2..2c246bbf 100644
--- a/packages/core/src/diff/index.ts
+++ b/packages/core/src/diff/index.ts
@@ -225,14 +225,15 @@ export function parseUnifiedDiff(rawDiff: string, reviewConfig?: RepoConfig['rev
   return files.filter((file) => file.path);
 }
 
-export type GitHubDiffFileEntry = {
+/** Shape returned by forge compare/files endpoints. Maps to GitHub's pulls/files JSON. */
+export type DiffFileEntry = {
   filename: string;
   previous_filename?: string | null;
   status?: string;
   patch?: string | null;
 };
 
-export function buildUnifiedDiffFromFiles(files: GitHubDiffFileEntry[]): string {
+export function buildUnifiedDiffFromFiles(files: DiffFileEntry[]): string {
   const out: string[] = [];
 
   for (const file of files) {
diff --git a/packages/core/src/ports/github.ts b/packages/core/src/ports/git-provider.ts
similarity index 82%
rename from packages/core/src/ports/github.ts
rename to packages/core/src/ports/git-provider.ts
index e14eebec..457df8bd 100644
--- a/packages/core/src/ports/github.ts
+++ b/packages/core/src/ports/git-provider.ts
@@ -1,4 +1,5 @@
 
+/** Maps to GitHub Pull Request, GitLab Merge Request, etc. */
 export type PullRequestRecord = {
   number: number;
   title: string | null;
@@ -9,7 +10,7 @@ export type PullRequestRecord = {
   user: { login: string };
 };
 
-export type GitHubReviewComment = {
+export type ReviewComment = {
   path: string;
   line?: number;
   side?: 'LEFT' | 'RIGHT';
@@ -17,7 +18,8 @@ export type GitHubReviewComment = {
   body: string;
 };
 
-export interface ReviewGitHub {
+/** @see ReviewGitProvider — the GitHub adapter's name for this port */
+export interface ReviewGitProvider {
   getPullRequest(owner: string, repo: string, prNumber: number): Promise<PullRequestRecord>;
   getPullRequestDiff(owner: string, repo: string, prNumber: number): Promise<string>;
   getCompareDiff(owner: string, repo: string, base: string, head: string): Promise<string>;
@@ -32,7 +34,7 @@ export interface ReviewGitHub {
     commitSha: string;
     event: 'APPROVE' | 'COMMENT';
     body: string;
-    comments: GitHubReviewComment[];
+    comments: ReviewComment[];
   }): Promise<{ id: number; postedIndices?: number[] }>;
   findBotReviewForCommit(owner: string, repo: string, prNumber: number, commitSha: string, botLogin: string): Promise<{ id: number } | null>;
   ensureLabel(owner: string, repo: string, name: string, color: string): Promise<unknown>;
@@ -40,6 +42,6 @@ export interface ReviewGitHub {
   removeIssueLabelsIfPresent(owner: string, repo: string, prNumber: number, labels: string[]): Promise<unknown>;
 }
 
-export interface GitHubClientFactory {
-  forInstallation(installationId: string): ReviewGitHub;
+export interface GitProviderFactory {
+  forInstallation(installationId: string): ReviewGitProvider;
 }
diff --git a/packages/core/src/ports/index.ts b/packages/core/src/ports/index.ts
index 31bd70f3..221571d0 100644
--- a/packages/core/src/ports/index.ts
+++ b/packages/core/src/ports/index.ts
@@ -3,7 +3,7 @@ export type { Clock, IdGenerator, KvStore, Logger } from './platform';
 export type { JobLeaseClaim, JobRow, JobStore, PersistedReviewJob } from './jobs';
 export type { BulkFileReviewInput, FileReviewRow, FileReviewStore, SuppressedFinding } from './file-reviews';
 export type { LearningStore, ModelConfigReader, RepoConfigLoader, ReviewSettingsReader, WebhookDeliveryReader } from './settings';
-export type { GitHubClientFactory, GitHubReviewComment, PullRequestRecord, ReviewGitHub } from './github';
+export type { GitProviderFactory, ReviewComment, PullRequestRecord, ReviewGitProvider } from './git-provider';
 export type { FileReviewOutcome, ModelErrorClassifier, ModelResponse, ModelResponseSchema, ReviewModel } from './model';
 export type { ReviewFormatter } from './formatter';
 export type { ReviewTelemetryEvent, TelemetrySink } from './telemetry';
diff --git a/packages/core/src/ports/runtime.ts b/packages/core/src/ports/runtime.ts
index df24b9d6..b39c417a 100644
--- a/packages/core/src/ports/runtime.ts
+++ b/packages/core/src/ports/runtime.ts
@@ -1,7 +1,7 @@
 import type { TokenTracker } from '../token-tracker';
 import type { Clock, IdGenerator, KvStore } from './platform';
 import type { FileReviewStore } from './file-reviews';
-import type { GitHubClientFactory, ReviewGitHub } from './github';
+import type { GitProviderFactory, ReviewGitProvider } from './git-provider';
 import type { JobStore } from './jobs';
 import type { ModelErrorClassifier, ReviewModel } from './model';
 import type { ReviewFormatter } from './formatter';
@@ -23,10 +23,10 @@ export interface ReviewRuntime {
   telemetry: TelemetrySink;
 
     createTokenTracker(): TokenTracker;
-  createGitHub(installationId: string, tracker: TokenTracker): ReviewGitHub;
+  createGitHub(installationId: string, tracker: TokenTracker): ReviewGitProvider;
   createModel(jobId: string, tracker: TokenTracker): ReviewModel;
   createFormatter(): ReviewFormatter;
 
-    githubClients: GitHubClientFactory;
+    githubClients: GitProviderFactory;
   modelErrors: ModelErrorClassifier;
 }
diff --git a/packages/core/src/review/diff-cache.ts b/packages/core/src/review/diff-cache.ts
index 99bcd6be..aca8171c 100644
--- a/packages/core/src/review/diff-cache.ts
+++ b/packages/core/src/review/diff-cache.ts
@@ -1,6 +1,6 @@
 import { reviewMaxFilesRange, type RepoConfig } from '@codra/schema';
 import { filterReviewableFiles, parseUnifiedDiff, type FileDiff } from '../diff';
-import type { ReviewGitHub, ReviewRuntime } from '../ports';
+import type { ReviewGitProvider, ReviewRuntime } from '../ports';
 import { logger } from '../logger';
 
 const DIFF_CACHE_TTL_SECONDS = 6 * 60 * 60;
@@ -12,7 +12,7 @@ export function diffCacheKey(jobId: string) {
 export async function getDiffFiles(
   env: Pick<ReviewRuntime, 'kv'>,
   job: { id: string; owner: string; repo: string; prNumber: number },
-  github: Pick<ReviewGitHub, 'getPullRequestDiff'>,
+  github: Pick<ReviewGitProvider, 'getPullRequestDiff'>,
   config: RepoConfig,
   maxFiles: number = reviewMaxFilesRange.default,
 ): Promise<{ files: FileDiff[]; skipped: number }> {
@@ -34,7 +34,7 @@ export async function getDiffFiles(
 export async function getOrFetchRawDiffForCompletedJob(
   env: Pick<ReviewRuntime, 'kv'>,
   job: { id: string; owner: string; repo: string; baseSha: string; commitSha: string },
-  github: Pick<ReviewGitHub, 'getCompareDiff'>,
+  github: Pick<ReviewGitProvider, 'getCompareDiff'>,
 ): Promise<string> {
   const cacheKey = diffCacheKey(job.id);
   const cached = await env.kv.get(cacheKey);
diff --git a/packages/core/src/review/finalize.ts b/packages/core/src/review/finalize.ts
index f50c2610..1a9e349e 100644
--- a/packages/core/src/review/finalize.ts
+++ b/packages/core/src/review/finalize.ts
@@ -2,7 +2,7 @@ import { logger } from '../logger';
 import { defaultRepoConfig, type ParsedReviewComment, type RepoConfig } from '@codra/schema';
 import { shadowEvaluate } from '../finding-gates';
 import { getDiffFiles } from './diff-cache';
-import type { ReviewFormatter, ReviewGitHub, ReviewModel, ReviewRuntime } from '../ports';
+import type { ReviewFormatter, ReviewGitProvider, ReviewModel, ReviewRuntime } from '../ports';
 import {
   type PersistedReviewJob,
   FRESH_INVOCATION_YIELD_SECONDS,
@@ -16,7 +16,7 @@ export async function runFinalizePhase(
   env: ReviewRuntime,
   job: PersistedReviewJob,
   leaseOwner: string,
-  github: ReviewGitHub,
+  github: ReviewGitProvider,
   formatter: ReviewFormatter,
   model: ReviewModel,
 ) {
diff --git a/packages/core/src/review/index.ts b/packages/core/src/review/index.ts
index 26bb9b73..737a8f80 100644
--- a/packages/core/src/review/index.ts
+++ b/packages/core/src/review/index.ts
@@ -1,7 +1,7 @@
 import { logger } from '../logger';
-import { isSupportedGitHubWebhookEvent, type GitHubWebhookPayload, type PullRequestWebhookPayload } from '@codra/schema/github';
+import { type WebhookPayload, type ChangeRequestWebhookPayload } from '@codra/schema/webhook';
 import { REVIEW_CONCURRENCY_LIMITS, type ReviewJobMessage } from '@codra/schema';
-import type { ReviewGitHub, ReviewRuntime } from '../ports';
+import type { ReviewGitProvider, ReviewRuntime } from '../ports';
 import { extractReviewRequest } from './request';
 
 export { getDiffFiles, getOrFetchRawDiffForCompletedJob } from './diff-cache';
@@ -75,6 +75,7 @@ export type ReviewJobRunResult =
 export async function runReview(env: ReviewRuntime, message: ReviewJobMessage): Promise<ReviewJobRunResult> {
   const resolved = await resolveQueuedJob(env, message);
   if (!resolved) {
+    console.error('TRACE: resolveQueuedJob returned null');
     return { action: 'ack' };
   }
 
@@ -91,10 +92,12 @@ export async function runReview(env: ReviewRuntime, message: ReviewJobMessage):
   const leaseOwner = env.ids.randomUUID();
   const claim = await env.jobs.claimJobLease(resolved.job.id, leaseOwner, JOB_LEASE_SECONDS);
   if (claim.status === 'missing') {
+    console.error('TRACE: claim status missing');
     logger.warn(`Job not found for processing: ${resolved.job.id}`);
     return { action: 'ack' };
   }
   if (claim.status === 'terminal') {
+    console.error('TRACE: claim status terminal');
     logger.info(`Job ${resolved.job.id} is already terminal (${claim.row.status}), acking queue delivery.`);
     return { action: 'ack' };
   }
@@ -114,10 +117,16 @@ export async function runReview(env: ReviewRuntime, message: ReviewJobMessage):
   }
 
   const phase = resolved.phase;
-  const tracker = env.createTokenTracker();
-  const github = env.createGitHub(job.installationId, tracker);
-  const model = env.createModel(job.id, tracker);
-  const formatter = env.createFormatter();
+  let github, model, formatter, tracker;
+  try {
+    tracker = env.createTokenTracker();
+    github = env.createGitHub(job.installationId, tracker);
+    model = env.createModel(job.id, tracker);
+    formatter = env.createFormatter();
+  } catch (err) {
+    console.error('INITIALIZATION FAILED', err);
+    throw err;
+  }
 
   try {
     if (phase === 'prepare') {
@@ -129,6 +138,7 @@ export async function runReview(env: ReviewRuntime, message: ReviewJobMessage):
     }
 
     await env.jobs.releaseJobLease(job.id, leaseOwner);
+    console.error('TRACE: finished successfully, returning ack');
     return { action: 'ack' };
   } catch (error) {
     const messageText = error instanceof Error ? error.message : 'Unknown review failure';
@@ -166,6 +176,7 @@ export async function runReview(env: ReviewRuntime, message: ReviewJobMessage):
       return continueOrFailWedgedJob(env, job, github, leaseOwner, phase, delaySeconds, 'per-invocation subrequest limits');
     }
 
+    console.error('JOB FAILED WITH ERROR:', error);
     logger.error(`Review job failed: ${job.owner}/${job.repo} PR #${job.prNumber}`, error);
     await failJobAndCheckRun(env, job, github, messageText);
     await env.jobs.releaseJobLease(job.id, leaseOwner);
@@ -176,7 +187,7 @@ export async function runReview(env: ReviewRuntime, message: ReviewJobMessage):
 async function continueOrFailWedgedJob(
   env: ReviewRuntime,
   job: PersistedReviewJob,
-  github: ReviewGitHub,
+  github: ReviewGitProvider,
   leaseOwner: string,
   phase: 'prepare' | 'review' | 'finalize',
   delaySeconds: number,
@@ -239,7 +250,7 @@ async function resolveQueuedJob(
   }
 
   let eventName = message.eventName;
-  let payload = message.payload as GitHubWebhookPayload | undefined;
+  let payload = message.payload as WebhookPayload | undefined;
 
   if (payload === undefined) {
     const delivery = await env.webhooks.getWebhookDelivery(message.deliveryId);
@@ -249,15 +260,15 @@ async function resolveQueuedJob(
     }
 
     eventName = delivery.event_name;
-    payload = delivery.payload as GitHubWebhookPayload;
+    payload = delivery.payload as WebhookPayload;
   }
 
-  if (!isSupportedGitHubWebhookEvent(eventName)) {
-    logger.info(`Queue message ignored: unsupported GitHub event ${eventName}`);
+  if (eventName !== 'change_request' && eventName !== 'comment') {
+    logger.info(`Queue message ignored: unsupported webhook event ${eventName}`);
     return null;
   }
 
-  const installationId = String(payload.installation?.id ?? '');
+  const installationId = String(payload.installationId ?? '');
   if (!installationId || !('repository' in payload) || !payload.repository) {
     logger.info('Queue message ignored: missing installation or repository info');
     return null;
@@ -265,12 +276,12 @@ async function resolveQueuedJob(
 
   const repoConfig = await env.repoConfig.loadRepoConfig({
     installationId,
-    owner: payload.repository.owner.login,
+    owner: payload.repository.owner,
     repo: payload.repository.name,
   });
 
   if (repoConfig.enabled === false) {
-    logger.info(`Job ignored: repository ${payload.repository.owner.login}/${payload.repository.name} is disabled`);
+    logger.info(`Job ignored: repository ${payload.repository.owner}/${payload.repository.name} is disabled`);
     return null;
   }
 
@@ -282,15 +293,15 @@ async function resolveQueuedJob(
   });
 
   if (!extracted) {
-    if (eventName === 'pull_request') {
-      const prPayload = payload as PullRequestWebhookPayload;
+    if (eventName === 'change_request') {
+      const prPayload = payload as ChangeRequestWebhookPayload;
       if (prPayload.action === 'closed' && repoConfig.parsedJson.review.labels !== false) {
         const labels = repoConfig.parsedJson.review.labels;
         const gh = env.githubClients.forInstallation(installationId);
         await gh.removeIssueLabelsIfPresent(
-          prPayload.repository.owner.login,
+          prPayload.repository.owner,
           prPayload.repository.name,
-          prPayload.pull_request.number,
+          prPayload.changeRequest.number,
           [labels.p1, labels.p2, labels.p3],
         );
       }
@@ -300,7 +311,7 @@ async function resolveQueuedJob(
 
   let resolved = extracted;
   const githubClient = env.githubClients.forInstallation(installationId);
-  if (eventName === 'issue_comment') {
+  if (eventName === 'comment') {
     const pr = await githubClient.getPullRequest(extracted.owner, extracted.repo, extracted.prNumber);
     resolved = {
       ...extracted,
diff --git a/packages/core/src/review/phase-control.ts b/packages/core/src/review/phase-control.ts
index 74512322..74af18d5 100644
--- a/packages/core/src/review/phase-control.ts
+++ b/packages/core/src/review/phase-control.ts
@@ -1,5 +1,5 @@
 import { logger } from '../logger';
-import type { PersistedReviewJob, ReviewGitHub, ReviewRuntime } from '../ports';
+import type { PersistedReviewJob, ReviewGitProvider, ReviewRuntime } from '../ports';
 
 
 // JobSummary, which is exactly what mapJob returns; see the note on the port.
@@ -46,7 +46,7 @@ export function hasCompletedStep(job: PersistedReviewJob, stepName: string) {
 export async function failJobAndCheckRun(
   env: ReviewRuntime,
   job: Pick<PersistedReviewJob, 'id' | 'owner' | 'repo' | 'checkRunId'>,
-  github: Pick<ReviewGitHub, 'updateCheckRun'>,
+  github: Pick<ReviewGitProvider, 'updateCheckRun'>,
   message: string,
 ) {
   try {
diff --git a/packages/core/src/review/phase.ts b/packages/core/src/review/phase.ts
index bf4aa40e..5f88d40d 100644
--- a/packages/core/src/review/phase.ts
+++ b/packages/core/src/review/phase.ts
@@ -4,7 +4,7 @@ import { budgetAwareFileLimit } from './budget';
 import { narrowUnit, planReviewUnits } from './pack';
 import { reviewAndPersistBin } from './bin-runner';
 import { getDiffFiles } from './diff-cache';
-import type { ReviewGitHub, ReviewModel, ReviewRuntime } from '../ports';
+import type { ReviewGitProvider, ReviewModel, ReviewRuntime } from '../ports';
 import { TokenTracker } from '../token-tracker';
 import {
   type PersistedReviewJob,
@@ -31,7 +31,7 @@ export async function runReviewPhase(
   env: ReviewRuntime,
   job: PersistedReviewJob,
   leaseOwner: string,
-  github: ReviewGitHub,
+  github: ReviewGitProvider,
   model: ReviewModel,
   tracker: TokenTracker,
 ) {
diff --git a/packages/core/src/review/prepare.ts b/packages/core/src/review/prepare.ts
index 82605009..26cf897f 100644
--- a/packages/core/src/review/prepare.ts
+++ b/packages/core/src/review/prepare.ts
@@ -1,6 +1,6 @@
 import { logger } from '../logger';
 import { defaultRepoConfig, type RepoConfig } from '@codra/schema';
-import type { ReviewGitHub, ReviewRuntime } from '../ports';
+import type { ReviewGitProvider, ReviewRuntime } from '../ports';
 import { getDiffFiles } from './diff-cache';
 import type { RejectedExemplar } from '../prompts/file-review';
 import { type PersistedReviewJob, JOB_LEASE_SECONDS, FRESH_INVOCATION_YIELD_SECONDS, enqueueJobPhase } from './phase-control';
@@ -9,7 +9,7 @@ export async function runPreparePhase(
   env: ReviewRuntime,
   job: PersistedReviewJob,
   leaseOwner: string,
-  github: ReviewGitHub,
+  github: ReviewGitProvider,
 ) {
   await env.jobs.updateJobStep(job.id, 'Preparation', { status: 'running' });
   const pr = await github.getPullRequest(job.owner, job.repo, job.prNumber);
diff --git a/packages/core/src/review/request.ts b/packages/core/src/review/request.ts
index 95efac49..a2a3aaca 100644
--- a/packages/core/src/review/request.ts
+++ b/packages/core/src/review/request.ts
@@ -1,85 +1,85 @@
-import type {
-  GitHubWebhookEventName,
-  GitHubWebhookPayload,
-  IssueCommentWebhookPayload,
-  PullRequestWebhookPayload,
-} from '@codra/schema/github';
-import type { RepoConfig } from '@codra/schema';
-
-function shouldTriggerFromPullRequest(action: PullRequestWebhookPayload['action'], config: RepoConfig['review']) {
-  return (config.on as string[]).includes(action);
-}
-
-export type ReviewRequest = {
-  installationId: string;
-  owner: string;
-  repo: string;
-  prNumber: number;
-  prTitle: string | null;
-  prAuthor: string | null;
-  commitSha: string;
-  baseSha: string;
-  headRef: string | null;
-  baseRef: string | null;
-  trigger: 'auto' | 'mention';
-};
-
-export function extractReviewRequest(input: {
-  eventName: GitHubWebhookEventName;
-  payload: GitHubWebhookPayload;
-  botUsername: string;
-  config: RepoConfig;
-}): ReviewRequest | null {
-  if (input.eventName === 'pull_request') {
-    const payload = input.payload as PullRequestWebhookPayload;
-    if (input.config.review.ignore_drafts && payload.pull_request.draft) {
-      return null;
-    }
-    if (!shouldTriggerFromPullRequest(payload.action, input.config.review)) {
-      return null;
-    }
-
-    return {
-      installationId: String(payload.installation?.id ?? ''),
-      owner: payload.repository.owner.login,
-      repo: payload.repository.name,
-      prNumber: payload.pull_request.number,
-      prTitle: payload.pull_request.title,
-      prAuthor: payload.pull_request.user.login,
-      commitSha: payload.pull_request.head.sha,
-      baseSha: payload.pull_request.base.sha,
-      headRef: payload.pull_request.head.ref,
-      baseRef: payload.pull_request.base.ref,
-      trigger: 'auto' as const,
-    };
-  }
-
-  if (input.eventName === 'issue_comment') {
-    const payload = input.payload as IssueCommentWebhookPayload;
-    const mentionTrigger = input.config.review.mention_trigger;
-
-    if (!payload.issue?.pull_request || payload.action !== 'created' || !mentionTrigger) {
-      return null;
-    }
-
-    if (!payload.comment?.body?.includes(mentionTrigger)) {
-      return null;
-    }
-
-    return {
-      installationId: String(payload.installation?.id ?? ''),
-      owner: payload.repository.owner.login,
-      repo: payload.repository.name,
-      prNumber: payload.issue.number,
-      prTitle: null,
-      prAuthor: null,
-      commitSha: '',
-      baseSha: '',
-      headRef: null,
-      baseRef: null,
-      trigger: 'mention' as const,
-    };
-  }
-
-  return null;
-}
+import type {
+  WebhookEventName,
+  WebhookPayload,
+  CommentWebhookPayload,
+  ChangeRequestWebhookPayload,
+} from '@codra/schema/webhook';
+import type { RepoConfig } from '@codra/schema';
+
+function shouldTriggerFromChangeRequest(action: ChangeRequestWebhookPayload['action'], config: RepoConfig['review']) {
+  return (config.on as string[]).includes(action);
+}
+
+export type ReviewRequest = {
+  installationId: string;
+  owner: string;
+  repo: string;
+  prNumber: number;
+  prTitle: string | null;
+  prAuthor: string | null;
+  commitSha: string;
+  baseSha: string;
+  headRef: string | null;
+  baseRef: string | null;
+  trigger: 'auto' | 'mention';
+};
+
+export function extractReviewRequest(input: {
+  eventName: WebhookEventName;
+  payload: WebhookPayload;
+  botUsername: string;
+  config: RepoConfig;
+}): ReviewRequest | null {
+  if (input.eventName === 'change_request') {
+    const payload = input.payload as ChangeRequestWebhookPayload;
+    if (input.config.review.ignore_drafts && payload.changeRequest.draft) {
+      return null;
+    }
+    if (!shouldTriggerFromChangeRequest(payload.action, input.config.review)) {
+      return null;
+    }
+
+    return {
+      installationId: payload.installationId,
+      owner: payload.repository.owner,
+      repo: payload.repository.name,
+      prNumber: payload.changeRequest.number,
+      prTitle: payload.changeRequest.title,
+      prAuthor: payload.changeRequest.author,
+      commitSha: payload.changeRequest.head.sha,
+      baseSha: payload.changeRequest.base.sha,
+      headRef: payload.changeRequest.head.ref,
+      baseRef: payload.changeRequest.base.ref,
+      trigger: 'auto' as const,
+    };
+  }
+
+  if (input.eventName === 'comment') {
+    const payload = input.payload as CommentWebhookPayload;
+    const mentionTrigger = input.config.review.mention_trigger;
+
+    if (!payload.issue.isChangeRequest || payload.action !== 'created' || !mentionTrigger) {
+      return null;
+    }
+
+    if (!payload.comment.body.includes(mentionTrigger)) {
+      return null;
+    }
+
+    return {
+      installationId: payload.installationId,
+      owner: payload.repository.owner,
+      repo: payload.repository.name,
+      prNumber: payload.issue.number,
+      prTitle: null,
+      prAuthor: null,
+      commitSha: '',
+      baseSha: '',
+      headRef: null,
+      baseRef: null,
+      trigger: 'mention' as const,
+    };
+  }
+
+  return null;
+}
diff --git a/packages/provider-github/package.json b/packages/provider-github/package.json
new file mode 100644
index 00000000..831124fb
--- /dev/null
+++ b/packages/provider-github/package.json
@@ -0,0 +1,19 @@
+{
+  "name": "@codra/provider-github",
+  "version": "0.9.4",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./oauth": "./src/oauth.ts",
+    "./webhook": "./src/webhook.ts"
+  },
+  "scripts": {
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@codra/core": "*",
+    "@codra/schema": "*"
+  }
+}
diff --git a/src/server/core/github/app-auth.ts b/packages/provider-github/src/app-auth.ts
similarity index 72%
rename from src/server/core/github/app-auth.ts
rename to packages/provider-github/src/app-auth.ts
index 618a0883..046fa2e7 100644
--- a/src/server/core/github/app-auth.ts
+++ b/packages/provider-github/src/app-auth.ts
@@ -1,19 +1,16 @@
-import type { AppBindings } from '@server/env';
-import { withTimeout } from '@server/core/timeout';
-import { GitHubError, GITHUB_TIMEOUT_MS, installationCacheKey, withRetry } from './http';
+import type { AppBindingsConfig } from './service';
+import { withTimeout } from '@codra/core/timeout';
+import { assertResponseOk, installationCacheKey, withRetry } from './http';
 import type { GitHubAppRecord, GitHubInstallation, InstallationTokenCacheRecord } from './types';
+import { GITHUB_TIMEOUT_MS, GITHUB_APP_INSTALL_URL_CACHE_KEY } from './constants';
 
-// Sibling of core/github.ts -- import from that barrel, not from here.
-
-const GITHUB_APP_INSTALL_URL_CACHE_KEY = 'github:app_installation_url';
-
-type AppAuthEnv = Pick<AppBindings, 'APP_PRIVATE_KEY' | 'GITHUB_APP_ID' | 'BOT_USERNAME'>;
+type AppAuthEnv = AppBindingsConfig;
 
 function pemToArrayBuffer(pem: string) {
   const base64 = pem
     .replace(/-----BEGIN (RSA )?PRIVATE KEY-----/g, '')
     .replace(/-----END (RSA )?PRIVATE KEY-----/g, '')
-    // Handles literal \n escape sequences from wrangler secrets stored as single-line strings.
+    // Handle \n escapes from wrangler secrets.
     .replace(/\\n/g, '')
     .replace(/\s+/g, '');
 
@@ -59,7 +56,7 @@ export async function createGitHubJwt(appId: string, privateKeyPem: string) {
   return `${header}.${payload}.${signatureString}`;
 }
 
-// Headers for the three app-level (JWT-authenticated) endpoints, as opposed to installation-token requests.
+// App-level (JWT) endpoint headers.
 async function appJwtHeaders(env: AppAuthEnv) {
   const jwt = await createGitHubJwt(env.GITHUB_APP_ID, env.APP_PRIVATE_KEY);
   return {
@@ -80,7 +77,7 @@ function installUrlFromSlug(slug: string) {
 }
 
 export async function readCachedInstallationToken(
-  env: Pick<AppBindings, 'APP_KV'>,
+  env: AppBindingsConfig,
   installationId: string,
   tracker?: { incrementSubrequests(count?: number): void },
 ) {
@@ -90,7 +87,7 @@ export async function readCachedInstallationToken(
 }
 
 export async function writeCachedInstallationToken(
-  env: Pick<AppBindings, 'APP_KV'>,
+  env: AppBindingsConfig,
   installationId: string,
   record: InstallationTokenCacheRecord,
   tracker?: { incrementSubrequests(count?: number): void },
@@ -101,12 +98,11 @@ export async function writeCachedInstallationToken(
   await env.APP_KV.put(installationCacheKey(installationId), JSON.stringify(record), { expirationTtl: ttl });
 }
 
-// Deliberately NOT wrapped in withRetry here: the caller (GitHubClient.getInstallationToken) wraps mint + KV-write + memo in one withRetry, so retrying here too would nest the ladders into 9 attempts.
+// Caller wraps in withRetry, avoid nested retries.
 export async function fetchInstallationToken(
   env: AppAuthEnv,
   installationId: string,
 ): Promise<InstallationTokenCacheRecord> {
-  // Signed OUTSIDE withTimeout: the 30s budget is for the network call, not key import + signing.
   const headers = await appJwtHeaders(env);
   const response = await withTimeout('GitHub installation token', GITHUB_TIMEOUT_MS, (signal) =>
     fetch(`https://api.github.com/app/installations/${installationId}/access_tokens`, {
@@ -116,15 +112,7 @@ export async function fetchInstallationToken(
     }),
   );
 
-  if (!response.ok) {
-    const errText = await response.text();
-    throw new GitHubError(
-      response.status,
-      errText,
-      '/app/installations/.../access_tokens',
-      `GitHub installation token request failed with ${response.status}: ${errText}`,
-    );
-  }
+  await assertResponseOk(response, '/app/installations/.../access_tokens', 'GitHub installation token request');
 
   const data = (await response.json()) as { token: string; expires_at: string };
   return { token: data.token, expiresAt: data.expires_at };
@@ -137,22 +125,14 @@ export async function fetchInstallations(env: AppAuthEnv): Promise<GitHubInstall
       fetch('https://api.github.com/app/installations', { signal, headers }),
     );
 
-    if (!response.ok) {
-      const errText = await response.text();
-      throw new GitHubError(
-        response.status,
-        errText,
-        '/app/installations',
-        `GitHub list installations failed with ${response.status}: ${errText}`,
-      );
-    }
+    await assertResponseOk(response, '/app/installations', 'GitHub list installations');
 
     return (await response.json()) as GitHubInstallation[];
   });
 }
 
 export async function fetchAppInstallationUrl(
-  env: Pick<AppBindings, 'APP_KV' | 'APP_PRIVATE_KEY' | 'GITHUB_APP_ID' | 'BOT_USERNAME' | 'GITHUB_APP_SLUG'>,
+  env: AppBindingsConfig,
 ): Promise<string> {
   const configuredSlug = normalizeGitHubAppSlug(env.GITHUB_APP_SLUG);
   if (configuredSlug) {
@@ -170,15 +150,7 @@ export async function fetchAppInstallationUrl(
       fetch('https://api.github.com/app', { signal, headers }),
     );
 
-    if (!response.ok) {
-      const errText = await response.text();
-      throw new GitHubError(
-        response.status,
-        errText,
-        '/app',
-        `GitHub app lookup failed with ${response.status}: ${errText}`,
-      );
-    }
+    await assertResponseOk(response, '/app', 'GitHub app lookup');
 
     const app = (await response.json()) as GitHubAppRecord;
     const fallbackSlug = normalizeGitHubAppSlug(app.slug);
diff --git a/src/server/core/github/index.ts b/packages/provider-github/src/client.ts
similarity index 78%
rename from src/server/core/github/index.ts
rename to packages/provider-github/src/client.ts
index 68c76906..27d0dce8 100644
--- a/src/server/core/github/index.ts
+++ b/packages/provider-github/src/client.ts
@@ -1,13 +1,14 @@
-import type { AppBindings } from '@server/env';
-import { withTimeout } from '@server/core/timeout';
+import type { AppBindingsConfig } from './service';
+import { withTimeout } from '@codra/core/timeout';
 import {
   GitHubError,
-  GITHUB_TIMEOUT_MS,
+  assertResponseOk,
   type GitHubRequestContext,
   encodeGitHubContentPath,
   repoApiPath,
   withRetry,
 } from './http';
+import { GITHUB_TIMEOUT_MS, GITHUB_REPOSITORIES_PER_PAGE, GITHUB_REPOSITORY_PAGE_LIMIT } from './constants';
 import {
   fetchAppInstallationUrl,
   fetchInstallationToken,
@@ -21,34 +22,27 @@ import { addIssueLabels, ensureLabel, listIssueLabels, removeIssueLabel } from '
 import type {
   GitHubInstallation,
   GitHubRepository,
-  GitHubReviewComment,
-  InstallationTokenCacheRecord,
+  ReviewComment,
   PullRequestRecord,
+  InstallationTokenCacheRecord,
 } from './types';
 
-// This module is the mock seam: a spec replaces the whole GitHubClient class via vi.mock('@server/core/github', ...). Sibling modules in this folder are implementation detail; eslint's no-restricted-imports enforces importing only from here.
-export type { GitHubInstallation, GitHubRepository, GitHubReviewComment };
-// Re-exported because it is the error every method below throws, and ./http is a restricted sibling.
+// Mock seam: replaced in tests via vi.mock. Enforces module boundary.
+export type { GitHubInstallation, GitHubRepository, ReviewComment };
 export { GitHubError };
 
-const GITHUB_REPOSITORIES_PER_PAGE = 100;
-const GITHUB_REPOSITORY_PAGE_LIMIT = 100;
-
 export class GitHubClient {
   constructor(
-    private readonly env: Pick<
-      AppBindings,
-      'APP_KV' | 'APP_PRIVATE_KEY' | 'GITHUB_APP_ID' | 'BOT_USERNAME'
-    >,
+    private env: AppBindingsConfig,
     private readonly installationId: string,
     private readonly tracker?: { incrementSubrequests(count?: number): void },
   ) {}
 
-  // Scoped to this client (one Worker invocation); without it every GitHub request re-read the token from KV, pushing finalize toward the 50-subrequest cap right before posting.
+  // Scoped per invocation to avoid KV hits & 50-subrequest cap.
   private memoToken: InstallationTokenCacheRecord | null = null;
 
   async getInstallationToken(): Promise<string> {
-    // Reuse the in-memory token while comfortably unexpired (invocations are < ~120s; tokens last ~1h).
+    // Reuse the in-memory token while comfortably unexpired.
     if (this.memoToken?.token && new Date(this.memoToken.expiresAt).getTime() > Date.now() + 60_000) {
       return this.memoToken.token;
     }
@@ -69,13 +63,13 @@ export class GitHubClient {
   }
 
   static async listInstallations(
-    env: Pick<AppBindings, 'APP_PRIVATE_KEY' | 'GITHUB_APP_ID' | 'BOT_USERNAME'>,
+    env: AppBindingsConfig,
   ): Promise<GitHubInstallation[]> {
     return fetchInstallations(env);
   }
 
   static async getAppInstallationUrl(
-    env: Pick<AppBindings, 'APP_KV' | 'APP_PRIVATE_KEY' | 'GITHUB_APP_ID' | 'BOT_USERNAME' | 'GITHUB_APP_SLUG'>,
+    env: AppBindingsConfig,
   ): Promise<string> {
     return fetchAppInstallationUrl(env);
   }
@@ -129,19 +123,11 @@ export class GitHubClient {
     accept = 'application/vnd.github+json',
   ): Promise<Response> {
     const response = await this.request(path, init, accept);
-    if (!response.ok) {
-      const errText = await response.text();
-      throw new GitHubError(
-        response.status,
-        errText,
-        path,
-        `GitHub API ${init.method ?? 'GET'} ${path} failed with ${response.status}: ${errText}`,
-      );
-    }
+    await assertResponseOk(response, path, `GitHub API ${init.method ?? 'GET'} ${path}`);
     return response;
   }
 
-  // Hands the extracted helpers the authenticated-request surface without making `request`/`requestAndCheck` public.
+  // Hands the extracted helpers the authenticated-request surface.
   private ctx(): GitHubRequestContext {
     return {
       request: (path, init, accept) => this.request(path, init, accept),
@@ -167,15 +153,7 @@ export class GitHubClient {
         }),
       );
 
-      if (!response.ok) {
-        const errText = await response.text();
-        throw new GitHubError(
-          response.status,
-          errText,
-          '/graphql',
-          `GitHub GraphQL request failed with ${response.status}: ${errText}`,
-        );
-      }
+      await assertResponseOk(response, '/graphql', 'GitHub GraphQL request');
 
       const payload = (await response.json()) as { data?: T; errors?: Array<{ message: string }> };
       if (payload.errors?.length) {
@@ -208,18 +186,8 @@ export class GitHubClient {
   async getRepoFileOrNull(owner: string, repo: string, path: string) {
     return withRetry(`getRepoFileOrNull ${owner}/${repo}/${path}`, async () => {
       const response = await this.request(`${repoApiPath(owner, repo)}/contents/${encodeGitHubContentPath(path)}`);
-      if (response.status === 404) {
-        return null;
-      }
-      if (!response.ok) {
-        const errText = await response.text();
-        throw new GitHubError(
-          response.status,
-          errText,
-          path,
-          `GitHub repo file fetch failed with ${response.status}: ${errText}`,
-        );
-      }
+      if (response.status === 404) return null;
+      await assertResponseOk(response, path, 'GitHub repo file fetch');
 
       const data = (await response.json()) as { content?: string; encoding?: string };
       if (!data.content) {
@@ -295,7 +263,7 @@ export class GitHubClient {
       commitSha: string;
       event: 'APPROVE' | 'COMMENT' | 'REQUEST_CHANGES';
       body: string;
-      comments: GitHubReviewComment[];
+      comments: ReviewComment[];
     },
   ) {
     return postReview(this.ctx(), owner, repo, pullNumber, input);
@@ -323,14 +291,12 @@ export class GitHubClient {
     return listIssueLabels(this.ctx(), owner, repo, issueNumber);
   }
 
-  // Case-insensitive, and removes using the label's actual stored casing -- the delete endpoint is case-sensitive and would silently no-op on a 404 otherwise.
+  // Case-insensitive removal using stored casing.
   async removeIssueLabelsIfPresent(owner: string, repo: string, issueNumber: number, labels: string[]) {
     const currentLabels = await this.listIssueLabels(owner, repo, issueNumber);
     const currentByLowerName = new Map(currentLabels.map(label => [label.toLowerCase(), label]));
 
     const uniqueLabels = Array.from(new Set(labels.map(label => label.toLowerCase())));
-    // Deletes stay sequential: concurrent mutations of one issue's labels trip GitHub's secondary
-    // rate limit, and the fan-out would also compete for the invocation's subrequest budget.
     for (const label of uniqueLabels) {
       const currentLabel = currentByLowerName.get(label);
       if (currentLabel) {
diff --git a/packages/provider-github/src/constants.ts b/packages/provider-github/src/constants.ts
new file mode 100644
index 00000000..19750c78
--- /dev/null
+++ b/packages/provider-github/src/constants.ts
@@ -0,0 +1,6 @@
+export const GITHUB_TIMEOUT_MS = 30_000;
+export const GITHUB_APP_INSTALL_URL_CACHE_KEY = 'github:app_installation_url';
+export const GITHUB_REPOSITORIES_PER_PAGE = 100;
+export const GITHUB_REPOSITORY_PAGE_LIMIT = 100;
+export const DIFF_FILES_PER_PAGE = 100;
+export const MAX_DIFF_FILE_PAGES = 5;
diff --git a/src/server/core/github/diff-fetch.ts b/packages/provider-github/src/diff-fetch.ts
similarity index 64%
rename from src/server/core/github/diff-fetch.ts
rename to packages/provider-github/src/diff-fetch.ts
index ce63fe81..d8806c47 100644
--- a/src/server/core/github/diff-fetch.ts
+++ b/packages/provider-github/src/diff-fetch.ts
@@ -1,35 +1,26 @@
-import { logger } from '@server/core/logger';
-import { buildUnifiedDiffFromFiles, type GitHubDiffFileEntry } from '@server/core/diff';
-import {
-  type GitHubRequestContext,
-  isDiffTooLargeError,
-  repoApiPath,
-  withRetry,
-} from './http';
+import { logger } from '@codra/core/logger';
+import { buildUnifiedDiffFromFiles, type DiffFileEntry } from '@codra/core/diff';
+import { type GitHubRequestContext, isDiffTooLargeError, repoApiPath, withRetry } from './http';
+import { DIFF_FILES_PER_PAGE, MAX_DIFF_FILE_PAGES } from './constants';
 
-// Sibling of core/github.ts -- import from that barrel, not from here. Free functions over a
-// GitHubRequestContext rather than methods, so the class stays the mockable seam.
+// Internal implementation. Class stays the mockable seam.
 
-const DIFF_FILES_PER_PAGE = 100;
-// Each page costs a subrequest, and 500 files is the maxFiles ceiling.
-const MAX_DIFF_FILE_PAGES = 5;
-
-// Rebuilds a diff from `GET /pulls/{n}/files`: the diff media type permanently 406s `too_large` beyond 20,000 lines, so without this a large PR can't be reviewed.
+// Rebuild diff if >20k lines (406 too_large).
 async function fetchPullRequestDiffFromFiles(
   ctx: GitHubRequestContext,
   owner: string,
   repo: string,
   pullNumber: number,
 ) {
-  const files: GitHubDiffFileEntry[] = [];
+  const files: DiffFileEntry[] = [];
 
-  // Bounded because each page is a subrequest against a budget of ~25; five pages covers the 500-file `maxFiles` ceiling.
+  // Bounded budget of ~25 subrequests. 5 pages = 500 files limit.
   for (let page = 1; page <= MAX_DIFF_FILE_PAGES; page++) {
     const pageFiles = await withRetry(`getPullRequestFiles ${owner}/${repo}#${pullNumber} p${page}`, async () => {
       const response = await ctx.requestAndCheck(
         `${repoApiPath(owner, repo)}/pulls/${pullNumber}/files?per_page=${DIFF_FILES_PER_PAGE}&page=${page}`,
       );
-      return (await response.json()) as GitHubDiffFileEntry[];
+      return (await response.json()) as DiffFileEntry[];
     });
 
     files.push(...pageFiles);
@@ -69,7 +60,7 @@ export async function fetchPullRequestDiff(
   }
 }
 
-// Diff between two specific commits, not "current PR state", so it stays correct after the PR has moved on; used to reconstruct a past job's diff once its KV cache has expired.
+// Diff between commits, reconstructs expired KV cache.
 export async function fetchCompareDiff(
   ctx: GitHubRequestContext,
   owner: string,
@@ -85,11 +76,11 @@ export async function fetchCompareDiff(
     });
   } catch (error) {
     if (!isDiffTooLargeError(error)) throw error;
-    // Same 20,000-line cap. The compare endpoint returns at most 300 files and doesn't paginate, so this is best-effort for the dashboard's diff view.
+    // Best-effort diff rebuild via JSON file list (max 300 files).
     logger.warn(`Compare diff ${owner}/${repo} ${base}...${head} is over the line cap; rebuilding from the JSON file list`);
     return withRetry(`getCompareFiles ${owner}/${repo} ${base}...${head}`, async () => {
       const response = await ctx.requestAndCheck(comparePath);
-      const payload = (await response.json()) as { files?: GitHubDiffFileEntry[] };
+      const payload = (await response.json()) as { files?: DiffFileEntry[] };
       return buildUnifiedDiffFromFiles(payload.files ?? []);
     });
   }
diff --git a/src/server/core/github/http.ts b/packages/provider-github/src/http.ts
similarity index 80%
rename from src/server/core/github/http.ts
rename to packages/provider-github/src/http.ts
index d6c16982..a31f185d 100644
--- a/src/server/core/github/http.ts
+++ b/packages/provider-github/src/http.ts
@@ -1,7 +1,4 @@
-import { logger } from '@server/core/logger';
-
-// Sibling of core/github.ts -- import from that barrel, not from here.
-export const GITHUB_TIMEOUT_MS = 30_000;
+import { logger } from '@codra/core/logger';
 
 export class GitHubError extends Error {
   constructor(
@@ -15,11 +12,17 @@ export class GitHubError extends Error {
   }
 }
 
-// GitHub's unified-diff media type refuses any diff over 20,000 lines with 406 `too_large`; matched narrowly so any other 406/status still surfaces as a real failure.
+export async function assertResponseOk(response: Response, path: string, action: string) {
+  if (!response.ok) {
+    let errText;
+    try { errText = await response.text(); } catch { errText = '<unreadable>'; }
+    throw new GitHubError(response.status, errText, path, `${action} failed with ${response.status}: ${errText}`);
+  }
+}
+
+// 406 too_large beyond 20,000 lines diff cap.
 export function isDiffTooLargeError(error: unknown): boolean {
-  return error instanceof GitHubError
-    && error.status === 406
-    && /too_large|maximum number of lines/i.test(error.body ?? '');
+  return error instanceof GitHubError && error.status === 406 && /too_large|maximum number of lines/i.test(error.body ?? '');
 }
 
 export async function withRetry<T>(
diff --git a/packages/provider-github/src/index.ts b/packages/provider-github/src/index.ts
new file mode 100644
index 00000000..0831309d
--- /dev/null
+++ b/packages/provider-github/src/index.ts
@@ -0,0 +1,6 @@
+export { GitHubClient } from './client';
+export { GitHubService } from './service';
+export { GitHubError } from './http';
+export type { GitHubInstallation, GitHubRepository, InstallationTokenCacheRecord, GitHubAppRecord, GitHubIssueLabel } from './types';
+export { exchangeGitHubOAuthCode, fetchGitHubOAuthProfile, toDashboardSessionUser, type GitHubOAuthProfile } from './oauth';
+export { normalizeGitHubWebhook } from './webhook';
diff --git a/src/server/core/github/labels.ts b/packages/provider-github/src/labels.ts
similarity index 68%
rename from src/server/core/github/labels.ts
rename to packages/provider-github/src/labels.ts
index 6a75c0b5..4540fbfa 100644
--- a/src/server/core/github/labels.ts
+++ b/packages/provider-github/src/labels.ts
@@ -1,8 +1,6 @@
-import { GitHubError, type GitHubRequestContext, repoApiPath, withRetry } from './http';
+import { assertResponseOk, type GitHubRequestContext, repoApiPath, withRetry } from './http';
 import type { GitHubIssueLabel } from './types';
 
-// Sibling of core/github.ts -- import from that barrel, not from here. Free functions over a GitHubRequestContext, so the class stays the mockable seam.
-
 export async function ensureLabel(
   ctx: GitHubRequestContext,
   owner: string,
@@ -12,17 +10,10 @@ export async function ensureLabel(
 ) {
   return withRetry(`ensureLabel ${owner}/${repo} ${name}`, async () => {
     const listResponse = await ctx.request(`${repoApiPath(owner, repo)}/labels/${encodeURIComponent(name)}`);
-    if (listResponse.ok) {
-      return;
-    }
+    if (listResponse.ok) return;
+    
     if (listResponse.status !== 404) {
-      const errText = await listResponse.text();
-      throw new GitHubError(
-        listResponse.status,
-        errText,
-        name,
-        `GitHub label lookup failed with ${listResponse.status}: ${errText}`,
-      );
+      await assertResponseOk(listResponse, name, 'GitHub label lookup');
     }
 
     const createResponse = await ctx.request(`${repoApiPath(owner, repo)}/labels`, {
@@ -33,15 +24,9 @@ export async function ensureLabel(
       body: JSON.stringify({ name, color }),
     });
 
-    // 422 means it already exists -- a concurrent job created it between the lookup and here.
+    // 422: already exists (concurrent job).
     if (!createResponse.ok && createResponse.status !== 422) {
-      const errText = await createResponse.text();
-      throw new GitHubError(
-        createResponse.status,
-        errText,
-        name,
-        `GitHub label creation failed with ${createResponse.status}: ${errText}`,
-      );
+      await assertResponseOk(createResponse, name, 'GitHub label creation');
     }
   });
 }
@@ -98,13 +83,7 @@ export async function removeIssueLabel(
     );
 
     if (!response.ok && response.status !== 404) {
-      const errText = await response.text();
-      throw new GitHubError(
-        response.status,
-        errText,
-        label,
-        `GitHub label removal failed with ${response.status}: ${errText}`,
-      );
+      await assertResponseOk(response, label, 'GitHub label removal');
     }
   });
 }
diff --git a/src/server/core/github/oauth.ts b/packages/provider-github/src/oauth.ts
similarity index 85%
rename from src/server/core/github/oauth.ts
rename to packages/provider-github/src/oauth.ts
index 56ff92ff..bd557fcc 100644
--- a/src/server/core/github/oauth.ts
+++ b/packages/provider-github/src/oauth.ts
@@ -1,4 +1,5 @@
-import type { AppBindings, DashboardSessionUser } from '@server/env';
+import type { DashboardSessionUser } from '@server/env';
+import type { AppBindingsConfig } from './service';
 
 export type GitHubOAuthProfile = {
   id: number;
@@ -17,7 +18,7 @@ function githubHeaders(token?: string) {
 }
 
 export async function exchangeGitHubOAuthCode(
-  env: Pick<AppBindings, 'GITHUB_CLIENT_ID' | 'GITHUB_CLIENT_SECRET' | 'AUTH_CALLBACK_URL'>,
+  env: AppBindingsConfig,
   code: string,
 ) {
   const response = await fetch('https://github.com/login/oauth/access_token', {
@@ -27,10 +28,10 @@ export async function exchangeGitHubOAuthCode(
       'content-type': 'application/x-www-form-urlencoded',
     },
     body: new URLSearchParams({
-      client_id: env.GITHUB_CLIENT_ID,
-      client_secret: env.GITHUB_CLIENT_SECRET,
+      client_id: env.GITHUB_CLIENT_ID ?? '',
+      client_secret: env.GITHUB_CLIENT_SECRET ?? '',
       code,
-      redirect_uri: env.AUTH_CALLBACK_URL,
+      redirect_uri: env.AUTH_CALLBACK_URL ?? '',
     }),
   });
 
diff --git a/src/server/core/github/review-post.ts b/packages/provider-github/src/review-post.ts
similarity index 76%
rename from src/server/core/github/review-post.ts
rename to packages/provider-github/src/review-post.ts
index 14b79548..929b0b2a 100644
--- a/src/server/core/github/review-post.ts
+++ b/packages/provider-github/src/review-post.ts
@@ -1,9 +1,6 @@
-import { logger } from '@server/core/logger';
-import { GitHubError, type GitHubRequestContext, repoApiPath, withRetry } from './http';
-import type { GitHubReviewComment } from './types';
-
-// Sibling of core/github.ts -- import from that barrel, not from here. Free functions over a
-// GitHubRequestContext rather than methods, so the class stays the mockable seam.
+import { logger } from '@codra/core/logger';
+import { assertResponseOk, type GitHubRequestContext, repoApiPath, withRetry } from './http';
+import type { ReviewComment } from './types';
 
 export async function postReview(
   ctx: GitHubRequestContext,
@@ -14,11 +11,11 @@ export async function postReview(
     commitSha: string;
     event: 'APPROVE' | 'COMMENT' | 'REQUEST_CHANGES';
     body: string;
-    comments: GitHubReviewComment[];
+    comments: ReviewComment[];
   },
 ) {
   return withRetry(`createReview ${owner}/${repo}#${pullNumber}`, async () => {
-    // Address by `line` + `side`, falling back to a legacy diff `position` if supplied; comments used to require `position`, which nothing computed, so inline comments were silently dropped.
+    // Address by `line` + `side`, or legacy `position`.
     const mapped = input.comments.map((comment) => {
       if (typeof comment.line === 'number' && comment.line > 0) {
         return {
@@ -87,26 +84,17 @@ export async function postReview(
           comments: [],
         }),
       });
-      // The summary still posts, but not a single inline comment did.
-      postedIndices = [];
+      postedIndices = []; // Summary posts, but no inline comments.
     }
 
-    if (!response.ok) {
-      const errText = await response.text();
-      throw new GitHubError(
-        response.status,
-        errText,
-        reviewPath,
-        `GitHub review creation failed with ${response.status}: ${errText}`,
-      );
-    }
+    await assertResponseOk(response, reviewPath, 'GitHub review creation');
 
     const review = (await response.json()) as { id: number };
     return { id: review.id, postedIndices };
   });
 }
 
-// Used by finalize only when re-running past the posting stage, to avoid double-posting when an earlier invocation died between createReview() and completeJob().
+// Used by finalize to avoid double-posting when an earlier invocation died.
 export async function findBotReviewForCommit(
   ctx: GitHubRequestContext,
   owner: string,
diff --git a/src/server/services/github.ts b/packages/provider-github/src/service.ts
similarity index 77%
rename from src/server/services/github.ts
rename to packages/provider-github/src/service.ts
index 7ad2dd61..63ba9f22 100644
--- a/src/server/services/github.ts
+++ b/packages/provider-github/src/service.ts
@@ -1,10 +1,21 @@
-import { GitHubClient, type GitHubReviewComment } from '../core/github';
-import type { AppBindings } from '../env';
+import { GitHubClient } from './client';
+import type { ReviewComment } from './types';
+
+export type AppBindingsConfig = {
+  APP_KV: { get: (key: string, type?: any) => Promise<any | null>; put: (key: string, value: string, opts?: any) => Promise<void> };
+  APP_PRIVATE_KEY: string;
+  GITHUB_APP_ID: string;
+  BOT_USERNAME?: string;
+  GITHUB_APP_SLUG?: string;
+  GITHUB_CLIENT_ID?: string;
+  GITHUB_CLIENT_SECRET?: string;
+  AUTH_CALLBACK_URL?: string;
+};
 
 export class GitHubService {
   private client: GitHubClient;
 
-  constructor(env: AppBindings, installationId: string, tracker?: { incrementSubrequests(count?: number): void }) {
+  constructor(env: AppBindingsConfig, installationId: string, tracker?: { incrementSubrequests(count?: number): void }) {
     this.client = new GitHubClient(env, installationId, tracker);
   }
 
@@ -28,7 +39,7 @@ export class GitHubService {
     return this.client.updateCheckRun(owner, repo, checkRunId, params);
   }
 
-  async createReview(owner: string, repo: string, prNumber: number, params: { commitSha: string; event: 'APPROVE' | 'COMMENT'; body: string; comments: GitHubReviewComment[] }) {
+  async createReview(owner: string, repo: string, prNumber: number, params: { commitSha: string; event: 'APPROVE' | 'COMMENT'; body: string; comments: ReviewComment[] }) {
     return this.client.createReview(owner, repo, prNumber, params);
   }
 
diff --git a/src/server/core/github/types.ts b/packages/provider-github/src/types.ts
similarity index 90%
rename from src/server/core/github/types.ts
rename to packages/provider-github/src/types.ts
index 81088c15..fbcc3b01 100644
--- a/src/server/core/github/types.ts
+++ b/packages/provider-github/src/types.ts
@@ -1,6 +1,6 @@
 // Both of these are part of the git-provider PORT contract, so @codra/core/ports owns them and
 // this module re-exports: one definition, and the engine does not depend on this file.
-export type { GitHubReviewComment, PullRequestRecord } from '@codra/core/ports';
+export type { ReviewComment, PullRequestRecord } from '@codra/core/ports';
 
 // Response shapes from the GitHub REST API, narrowed to the fields this app reads.
 // Import these from @server/core/github, not from here: specs mock that barrel by replacing the whole GitHubClient class.
diff --git a/packages/provider-github/src/webhook.ts b/packages/provider-github/src/webhook.ts
new file mode 100644
index 00000000..ead51a08
--- /dev/null
+++ b/packages/provider-github/src/webhook.ts
@@ -0,0 +1,55 @@
+import type { WebhookPayload, WebhookEventName } from '@codra/schema/webhook';
+import type { PullRequestWebhookPayload, IssueCommentWebhookPayload } from '@codra/schema/github';
+
+export function normalizeGitHubWebhook(
+  eventName: string,
+  payload: unknown,
+): { eventName: WebhookEventName; payload: WebhookPayload } | null {
+  if (eventName === 'pull_request') {
+    const prPayload = payload as PullRequestWebhookPayload;
+    return {
+      eventName: 'change_request',
+      payload: {
+        action: prPayload.action,
+        installationId: String(prPayload.installation?.id ?? ''),
+        repository: {
+          owner: prPayload.repository.owner.login,
+          name: prPayload.repository.name,
+        },
+        changeRequest: {
+          number: prPayload.pull_request.number,
+          title: prPayload.pull_request.title,
+          author: prPayload.pull_request.user.login,
+          head: { sha: prPayload.pull_request.head.sha, ref: prPayload.pull_request.head.ref },
+          base: { sha: prPayload.pull_request.base.sha, ref: prPayload.pull_request.base.ref },
+          draft: prPayload.pull_request.draft,
+          body: prPayload.pull_request.body,
+        },
+      },
+    };
+  }
+
+  if (eventName === 'issue_comment') {
+    const icPayload = payload as IssueCommentWebhookPayload;
+    return {
+      eventName: 'comment',
+      payload: {
+        action: icPayload.action,
+        installationId: String(icPayload.installation?.id ?? ''),
+        repository: {
+          owner: icPayload.repository.owner.login,
+          name: icPayload.repository.name,
+        },
+        issue: {
+          number: icPayload.issue.number,
+          isChangeRequest: !!icPayload.issue.pull_request,
+        },
+        comment: {
+          body: icPayload.comment.body,
+        },
+      },
+    };
+  }
+
+  return null;
+}
diff --git a/packages/provider-github/tsconfig.json b/packages/provider-github/tsconfig.json
new file mode 100644
index 00000000..3b33cb07
--- /dev/null
+++ b/packages/provider-github/tsconfig.json
@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "."
+  },
+  "include": ["src/**/*", "test/**/*"]
+}
diff --git a/packages/schema/package.json b/packages/schema/package.json
index 6b94753e..48364079 100644
--- a/packages/schema/package.json
+++ b/packages/schema/package.json
@@ -11,7 +11,8 @@
     "./hex": "./src/hex.ts",
     "./review-limits": "./src/review-limits.ts",
     "./timezone": "./src/timezone.ts",
-    "./transient-errors": "./src/transient-errors.ts"
+    "./transient-errors": "./src/transient-errors.ts",
+    "./webhook": "./src/webhook.ts"
   },
   "dependencies": {
     "zod": "^4.3.6"
diff --git a/packages/schema/src/github.ts b/packages/schema/src/github.ts
index 9d5fdfa9..44e579fc 100644
--- a/packages/schema/src/github.ts
+++ b/packages/schema/src/github.ts
@@ -1,10 +1,3 @@
-export const supportedGitHubWebhookEvents = ['pull_request', 'issue_comment'] as const;
-
-export type GitHubWebhookEventName = typeof supportedGitHubWebhookEvents[number];
-
-export function isSupportedGitHubWebhookEvent(eventName: string): eventName is GitHubWebhookEventName {
-  return (supportedGitHubWebhookEvents as readonly string[]).includes(eventName);
-}
 
 export const feedbackGitHubWebhookEvents = ['pull_request_review_comment', 'pull_request_review_thread'] as const;
 
@@ -78,4 +71,8 @@ export type IssueCommentWebhookPayload = {
   };
 };
 
-export type GitHubWebhookPayload = PullRequestWebhookPayload | IssueCommentWebhookPayload;
+export type GitHubWebhookPayload =
+  | FeedbackWebhookPayload
+  | PullRequestWebhookPayload
+  | IssueCommentWebhookPayload
+  | Record<string, unknown>;
diff --git a/packages/schema/src/webhook.ts b/packages/schema/src/webhook.ts
new file mode 100644
index 00000000..a045b34d
--- /dev/null
+++ b/packages/schema/src/webhook.ts
@@ -0,0 +1,26 @@
+export type WebhookEventName = 'change_request' | 'comment';
+
+export type ChangeRequestWebhookPayload = {
+  action: 'opened' | 'synchronize' | 'ready_for_review' | 'reopened' | 'closed';
+  installationId: string;
+  repository: { owner: string; name: string };
+  changeRequest: {
+    number: number;
+    title: string;
+    author: string;
+    head: { sha: string; ref: string };
+    base: { sha: string; ref: string };
+    draft: boolean;
+    body: string | null;
+  };
+};
+
+export type CommentWebhookPayload = {
+  action: 'created';
+  installationId: string;
+  repository: { owner: string; name: string };
+  issue: { number: number; isChangeRequest: boolean };
+  comment: { body: string };
+};
+
+export type WebhookPayload = ChangeRequestWebhookPayload | CommentWebhookPayload;
diff --git a/scripts/check-core-boundary.mjs b/scripts/check-core-boundary.mjs
index 3bcb5394..e7e66512 100644
--- a/scripts/check-core-boundary.mjs
+++ b/scripts/check-core-boundary.mjs
@@ -27,6 +27,7 @@ const BANNED_MODULES = [
   '@server/',
   '@client/',
   '@codra/worker',
+  '@codra/provider-github',
 ];
 
 function isBannedModule(specifier, fileDir) {
diff --git a/src/server/adapters/services.ts b/src/server/adapters/services.ts
index ac5117e5..a5144167 100644
--- a/src/server/adapters/services.ts
+++ b/src/server/adapters/services.ts
@@ -1,8 +1,7 @@
-import type { GitHubClientFactory, ModelErrorClassifier, ReviewFormatter, ReviewGitHub, ReviewModel } from '@codra/core/ports';
+import type { GitProviderFactory, ModelErrorClassifier, ReviewFormatter, ReviewGitProvider, ReviewModel } from '@codra/core/ports';
 import type { TokenTracker } from '@codra/core/token-tracker';
 import type { AppBindings } from '@server/env';
-import { GitHubClient } from '@server/core/github';
-import { GitHubService } from '@server/services/github';
+import { GitHubService } from '@codra/provider-github';
 import { isRetryableModelError, ModelService, nextChainIndexOf } from '@server/services/model';
 import { FormatterService } from '@server/services/formatter';
 
@@ -11,7 +10,8 @@ import { FormatterService } from '@server/services/formatter';
 // and reaching for a sibling here would bypass those mocks while the tests kept passing.
 
 export function makeGitHubFactory(env: AppBindings) {
-  return (installationId: string, tracker: TokenTracker): ReviewGitHub => new GitHubService(env, installationId, tracker);
+  console.log('TRACE makeGitHubFactory: GitHubService is', GitHubService.name, 'Mock?', GitHubService.name === 'MockGitHubService');
+  return (installationId: string, tracker: TokenTracker): ReviewGitProvider => new GitHubService(env, installationId, tracker);
 }
 
 export function makeModelFactory(env: AppBindings) {
@@ -25,8 +25,12 @@ export function makeFormatterFactory(env: AppBindings) {
 // Webhook resolution runs before a job row exists, so it cannot go through the job-scoped factory
 // above: GitHubClient is the lower-level client the engine uses for label cleanup on a closed pull
 // request and for finding the pull request behind an issue comment.
-export function makeGitHubClientFactory(env: AppBindings): GitHubClientFactory {
-  return { forInstallation: (installationId) => new GitHubClient(env, installationId) };
+export function makeGitHubClientFactory(env: AppBindings): GitProviderFactory {
+  return {
+    forInstallation(installationId: string): ReviewGitProvider {
+      return new GitHubService(env, installationId);
+    },
+  };
 }
 
 export function makeModelErrorClassifier(): ModelErrorClassifier {
diff --git a/src/server/core/job-recovery.ts b/src/server/core/job-recovery.ts
index f395e0cb..a3cd7087 100644
--- a/src/server/core/job-recovery.ts
+++ b/src/server/core/job-recovery.ts
@@ -1,7 +1,7 @@
 import type { AppBindings } from '@server/env';
 import { getTerminalJobsNeedingCheckRunCompletion, markJobCheckRunCompleted, recoverExpiredJobLeases } from '@server/db/jobs';
 import { logger } from '@server/core/logger';
-import { GitHubService } from '@server/services/github';
+import { GitHubService } from '@codra/provider-github';
 
 const MAX_RECOVERY_COUNT = 3;
 
diff --git a/src/server/routes/api/jobs.ts b/src/server/routes/api/jobs.ts
index 377fa099..2fbb4132 100644
--- a/src/server/routes/api/jobs.ts
+++ b/src/server/routes/api/jobs.ts
@@ -14,7 +14,7 @@ import { getOrFetchRawDiffForCompletedJob } from '@codra/core';
 import { createReviewRuntime } from '@server/adapters';
 import { parseUnifiedDiff } from '@server/core/diff';
 import { buildFileReviewPrompts } from '@server/prompts/file-review';
-import { GitHubService } from '@server/services/github';
+import { GitHubService } from '@codra/provider-github';
 
 // Best-effort terminate; .get() throws if the instance is gone and .terminate() if already terminal, both non-fatal.
 async function terminateJobWorkflow(env: AppBindings, job: { id: string; workflowInstanceId?: string | null }) {
diff --git a/src/server/routes/api/repos.ts b/src/server/routes/api/repos.ts
index c71bfd2b..1f088ee0 100644
--- a/src/server/routes/api/repos.ts
+++ b/src/server/routes/api/repos.ts
@@ -3,7 +3,7 @@ import { z } from 'zod';
 import type { AppEnv } from '@server/env';
 import { getRepoConfigRecord, listRepoConfigs, upsertRepoConfig, syncRepoConfig, updateRepoConfigEnabled, deleteStaleRepoConfigs } from '@server/db/repo-configs';
 import { jsonError } from '@server/core/http';
-import { GitHubClient, type GitHubRepository } from '@server/core/github';
+import { GitHubClient, type GitHubRepository } from '@codra/provider-github';
 import { invalidateRepoConfigCache } from '@server/core/config';
 import { repoConfigSchema } from '@codra/schema';
 
diff --git a/src/server/routes/auth.ts b/src/server/routes/auth.ts
index 79eabba8..9fbb94d3 100644
--- a/src/server/routes/auth.ts
+++ b/src/server/routes/auth.ts
@@ -2,7 +2,7 @@ import { Hono } from 'hono';
 import type { AppEnv } from '@server/env';
 import { createOAuthState, consumeOAuthState, parseAllowedUsers } from '@server/core/oauth';
 import { createSession, destroySession } from '@server/core/sessions';
-import { exchangeGitHubOAuthCode, fetchGitHubOAuthProfile, toDashboardSessionUser } from '@server/core/github/oauth';
+import { exchangeGitHubOAuthCode, fetchGitHubOAuthProfile, toDashboardSessionUser } from '@codra/provider-github';
 import { upsertAccountSettings } from '@server/db/accounts';
 import { logger } from '@server/core/logger';
 
diff --git a/src/server/routes/webhook.ts b/src/server/routes/webhook.ts
index eaedefa8..0fbe9d8d 100644
--- a/src/server/routes/webhook.ts
+++ b/src/server/routes/webhook.ts
@@ -2,11 +2,11 @@ import { Hono } from 'hono';
 import type { Context } from 'hono';
 import {
   isFeedbackGitHubWebhookEvent,
-  isSupportedGitHubWebhookEvent,
   type FeedbackWebhookPayload,
   type GitHubReviewCommentPayload,
   type GitHubWebhookPayload,
 } from '@codra/schema/github';
+import { normalizeGitHubWebhook } from '@codra/provider-github';
 import type { AppBindings, AppEnv } from '@server/env';
 import { loadRepoConfig } from '@server/core/config';
 import { extractReviewRequest } from '@server/core/review';
@@ -117,8 +117,8 @@ export async function handleGitHubWebhook(c: Context<AppEnv>) {
     const delivery = await recordWebhookDelivery(c.env, {
       deliveryId,
       eventName,
-      owner: 'repository' in payload ? payload.repository.owner.login : null,
-      repo: 'repository' in payload ? payload.repository.name : null,
+      owner: 'repository' in payload ? (payload as any).repository.owner.login : null,
+      repo: 'repository' in payload ? (payload as any).repository.name : null,
       payload: isFeedbackEvent ? null : payload,
     });
 
@@ -126,7 +126,7 @@ export async function handleGitHubWebhook(c: Context<AppEnv>) {
       return c.json({ ok: true, duplicate: true }, 202);
     }
 
-    const installationId = String(payload.installation?.id ?? '');
+    const installationId = String((payload as any).installation?.id ?? '');
     if (!installationId || !('repository' in payload) || !payload.repository) {
       return c.json({ ok: true, ignored: true }, 202);
     }
@@ -141,14 +141,15 @@ export async function handleGitHubWebhook(c: Context<AppEnv>) {
       return c.json({ ok: true, feedback: true, recorded }, 202);
     }
 
-    if (!isSupportedGitHubWebhookEvent(eventName)) {
+    const normalized = normalizeGitHubWebhook(eventName, payload);
+    if (!normalized) {
       return c.json({ ok: true, ignored: true, eventName }, 202);
     }
 
     const repoConfig = await loadRepoConfig(c.env, {
       installationId,
-      owner: payload.repository.owner.login,
-      repo: payload.repository.name,
+      owner: (payload as any).repository.owner.login,
+      repo: (payload as any).repository.name,
     });
 
     if (repoConfig.enabled === false) {
@@ -156,8 +157,8 @@ export async function handleGitHubWebhook(c: Context<AppEnv>) {
     }
 
     const extracted = extractReviewRequest({
-      eventName,
-      payload,
+      eventName: normalized.eventName,
+      payload: normalized.payload,
       botUsername: c.env.BOT_USERNAME,
       config: repoConfig.parsedJson,
     });
diff --git a/test/api/repos.spec.ts b/test/api/repos.spec.ts
index 3914d8e5..94803913 100644
--- a/test/api/repos.spec.ts
+++ b/test/api/repos.spec.ts
@@ -3,7 +3,7 @@ import { getJobForProcessing, insertJob } from '@server/db/jobs';
 
 import { getRepoConfigRecord } from '@server/db/repo-configs';
 import { loadRepoConfig, updateGlobalConfig } from '@server/core/config';
-import { GitHubClient } from '@server/core/github';
+import { GitHubClient } from '@codra/provider-github';
 
 import { defaultRepoConfig } from '@codra/schema';
 import { createTestEnv, uniqueName } from '../helpers';
diff --git a/test/review/async-batch.spec.ts b/test/review/async-batch.spec.ts
index ef5cabbb..38a25e9d 100644
--- a/test/review/async-batch.spec.ts
+++ b/test/review/async-batch.spec.ts
@@ -26,9 +26,11 @@ vi.mock('@server/db/app-settings', async (importOriginal) => {
   return { ...mod, getReviewSettings: getReviewSettingsMock };
 });
 
-vi.mock('@server/services/github', async () => {
+vi.mock('@codra/provider-github', async (importOriginal) => {
+  console.log('TRACE vi.mock called for provider-github');
+  const mod = await importOriginal<Record<string, unknown>>();
   const { makeGitHubServiceMock } = await import('../mocks/services');
-  return { GitHubService: makeGitHubServiceMock() };
+  return { ...mod, GitHubService: makeGitHubServiceMock() };
 });
 
 // Controllable async-batch model: submit hands back a request_id; the first poll is still
@@ -88,16 +90,19 @@ dbDescribe('Async batch review flow', () => {
 
     await runWithDb(env, async () => {
       // Phase 1: prepare (creates the job, enqueues review).
+      const rawPayload = {
+        action: 'opened',
+        installation: { id: 123 },
+        repository: { owner: { login: 'test-owner' }, name: repo },
+        pull_request: { number: 1, head: { sha: headSha, ref: 'feature' }, base: { sha: sha('d'), ref: 'main' }, title: 'Test PR', user: { login: 'author' }, draft: false },
+      };
+      const { normalizeGitHubWebhook } = await import('@codra/provider-github');
+      const normalized = normalizeGitHubWebhook('pull_request', rawPayload);
       const prep = await runReviewJob(env, {
         deliveryId: uniqueName('delivery-async'),
-        eventName: 'pull_request',
-        payload: {
-          action: 'opened',
-          installation: { id: 123 },
-          repository: { owner: { login: 'test-owner' }, name: repo },
-          pull_request: { number: 1, head: { sha: headSha, ref: 'feature' }, base: { sha: sha('d'), ref: 'main' }, title: 'Test PR', user: { login: 'author' }, draft: false },
-        },
-      } as any);
+        eventName: normalized!.eventName,
+        payload: normalized!.payload as any,
+      });
       expect(prep).toMatchObject({ action: 'next_phase', phase: 'review' });
 
       const job = await findExistingJobForHead(env, { owner: 'test-owner', repo, prNumber: 1, commitSha: headSha, trigger: 'auto' });
diff --git a/test/review/batch-flow.spec.ts b/test/review/batch-flow.spec.ts
index 49706aa3..ef6499dd 100644
--- a/test/review/batch-flow.spec.ts
+++ b/test/review/batch-flow.spec.ts
@@ -18,9 +18,10 @@ vi.mock('@server/db/app-settings', async (importOriginal) => {
   return { ...mod, getReviewSettings: vi.fn().mockResolvedValue(reviewSettingsSchema.parse({})) };
 });
 
-vi.mock('@server/services/github', async () => {
+vi.mock('@codra/provider-github', async (importOriginal) => {
+  const mod = await importOriginal<Record<string, unknown>>();
   const { makeGitHubServiceMock } = await import('../mocks/services');
-  return { GitHubService: makeGitHubServiceMock() };
+  return { ...mod, GitHubService: makeGitHubServiceMock() };
 });
 
 vi.mock('@server/services/model', async () => {
@@ -68,7 +69,7 @@ dbDescribe('Review flow: batched small files', () => {
   });
 
   it('reviews several small files in one call and writes a row per file', async () => {
-    const { GitHubService } = await import('@server/services/github');
+    const { GitHubService } = await import('@codra/provider-github');
     const { ModelService } = await import('@server/services/model');
     const getDiffSpy = vi.spyOn(GitHubService.prototype, 'getPullRequestDiff')
       .mockResolvedValue(generateMockDiff(smallFiles));
@@ -112,7 +113,7 @@ dbDescribe('Review flow: batched small files', () => {
   // An error after the write must not take committed rows down: the catch-all's comment DELETE
   // would wipe correct findings.
   it('keeps already-committed rows when a later step fails', async () => {
-    const { GitHubService } = await import('@server/services/github');
+    const { GitHubService } = await import('@codra/provider-github');
     const { ModelService } = await import('@server/services/model');
     const { reviewBatchResponse } = await import('../mocks/services');
     const fileReviews = await import('@server/db/file-reviews');
@@ -143,7 +144,7 @@ dbDescribe('Review flow: batched small files', () => {
 
   // A silently omitted file is re-queued as retryable, and is not progress for the wedge counter.
   it('re-queues a file the model omitted instead of approving it', async () => {
-    const { GitHubService } = await import('@server/services/github');
+    const { GitHubService } = await import('@codra/provider-github');
     const { ModelService } = await import('@server/services/model');
     const { reviewBatchResponse } = await import('../mocks/services');
     const jobsModule = await import('@server/db/jobs');
@@ -182,7 +183,7 @@ dbDescribe('Review flow: batched small files', () => {
   // After a transient failure the bin must not re-form. The ledger is seeded directly: a real
   // failure also sets a 30s job delay, which would pass for the wrong reason.
   it('falls back to single-file reviews once a bin member has failed transiently', async () => {
-    const { GitHubService } = await import('@server/services/github');
+    const { GitHubService } = await import('@codra/provider-github');
     const { ModelService } = await import('@server/services/model');
     const { bulkRecordRetryableFileReviewFailures } = await import('@server/db/file-reviews');
     vi.spyOn(GitHubService.prototype, 'getPullRequestDiff').mockResolvedValue(generateMockDiff(smallFiles));
diff --git a/test/review/comments.spec.ts b/test/review/comments.spec.ts
index 44ea301a..9b696119 100644
--- a/test/review/comments.spec.ts
+++ b/test/review/comments.spec.ts
@@ -1,5 +1,6 @@
 import { describe, it, expect, vi } from 'vitest';
-import { GitHubClient, type GitHubReviewComment } from '@server/core/github';
+import { GitHubClient } from '@codra/provider-github';
+import type { ReviewComment } from '@codra/core/ports';
 
 // Regression: inline comments silently stopped reaching GitHub because `createReview` kept only
 // comments carrying a legacy diff `position` -- a value nothing in the pipeline computes anymore
@@ -23,7 +24,7 @@ function clientWithCapturedRequest() {
   return { client, sent };
 }
 
-const comment = (over: Partial<GitHubReviewComment> = {}): GitHubReviewComment => ({
+const comment = (over: Partial<ReviewComment> = {}): ReviewComment => ({
   path: 'src/app.ts',
   line: 12,
   body: 'Something is wrong here.',
diff --git a/test/review/flow-chunking.spec.ts b/test/review/flow-chunking.spec.ts
index 6118cf44..a726f85e 100644
--- a/test/review/flow-chunking.spec.ts
+++ b/test/review/flow-chunking.spec.ts
@@ -27,9 +27,10 @@ vi.mock('@server/db/app-settings', async (importOriginal) => {
   return { ...mod, getReviewSettings: getReviewSettingsMock };
 });
 
-vi.mock('@server/services/github', async () => {
+vi.mock('@codra/provider-github', async (importOriginal) => {
+  const mod = await importOriginal<Record<string, unknown>>();
   const { makeGitHubServiceMock } = await import('../mocks/services');
-  return { GitHubService: makeGitHubServiceMock() };
+  return { ...mod, GitHubService: makeGitHubServiceMock() };
 });
 
 vi.mock('@server/services/model', async () => {
@@ -54,7 +55,7 @@ dbDescribe('Review flow: chunking, partial reviews and re-posting', () => {
   };
 
   it('reviews files in a chunk concurrently', async () => {
-    const { GitHubService } = await import('@server/services/github');
+    const { GitHubService } = await import('@codra/provider-github');
     const { ModelService } = await import('@server/services/model');
     const repo = uniqueRepo('concurrent');
     const headSha = sha('8');
@@ -129,7 +130,7 @@ dbDescribe('Review flow: chunking, partial reviews and re-posting', () => {
   }, REVIEW_FLOW_TIMEOUT_MS);
 
   it('marks completed jobs with skipped files as partial reviews', async () => {
-    const { GitHubService } = await import('@server/services/github');
+    const { GitHubService } = await import('@codra/provider-github');
     const { ModelService } = await import('@server/services/model');
     const repo = uniqueRepo('partial');
     const headSha = sha('e');
@@ -215,7 +216,7 @@ dbDescribe('Review flow: chunking, partial reviews and re-posting', () => {
   }, REVIEW_FLOW_TIMEOUT_MS);
 
   it('reuses an already-posted review instead of double-posting when finalize re-runs past the posting stage', async () => {
-    const { GitHubService } = await import('@server/services/github');
+    const { GitHubService } = await import('@codra/provider-github');
     const repo = uniqueRepo('doublepost');
     const getDiffSpy = vi.spyOn(GitHubService.prototype, 'getPullRequestDiff').mockResolvedValue(
       generateMockDiff([{ path: 'src/app.ts', content: 'console.log(1);' }]),
diff --git a/test/review/flow-lifecycle.spec.ts b/test/review/flow-lifecycle.spec.ts
index 5856b32c..b1e1f77b 100644
--- a/test/review/flow-lifecycle.spec.ts
+++ b/test/review/flow-lifecycle.spec.ts
@@ -5,6 +5,7 @@ import { findExistingJobForHead, getJobForProcessing, insertJob } from '@server/
 import { getFileReviewsForJobs } from '@server/db/file-reviews';
 import { defaultRepoConfig } from '@codra/schema';
 import { runWithDb, queryRows } from '@server/db/client';
+import { normalizeGitHubWebhook } from '@codra/provider-github';
 import { makeRunAndDrain, REVIEW_FLOW_TIMEOUT_MS } from '../mocks/review-harness';
 
 const { getOtherRunningJobsCountMock } = vi.hoisted(() => ({
@@ -28,9 +29,10 @@ vi.mock('@server/db/app-settings', async (importOriginal) => {
   return { ...mod, getReviewSettings: getReviewSettingsMock };
 });
 
-vi.mock('@server/services/github', async () => {
+vi.mock('@codra/provider-github', async (importOriginal) => {
+  const mod = await importOriginal<Record<string, unknown>>();
   const { makeGitHubServiceMock } = await import('../mocks/services');
-  return { GitHubService: makeGitHubServiceMock() };
+  return { ...mod, GitHubService: makeGitHubServiceMock() };
 });
 
 vi.mock('@server/services/model', async () => {
@@ -74,8 +76,7 @@ dbDescribe('Review flow: lifecycle and finalize', () => {
 
     await runAndDrain({
       deliveryId: 'delivery-123',
-      eventName: 'pull_request',
-      payload: {
+      ...normalizeGitHubWebhook('pull_request', {
         action: 'opened',
         installation: { id: 123 },
         repository: { owner: { login: 'test-owner' }, name: repo },
@@ -87,7 +88,7 @@ dbDescribe('Review flow: lifecycle and finalize', () => {
           user: { login: 'author' },
           draft: false,
         }
-      }
+      }) as any
     });
 
     const finalJob = await findExistingJobForHead(env, {
@@ -101,7 +102,7 @@ dbDescribe('Review flow: lifecycle and finalize', () => {
   }, REVIEW_FLOW_TIMEOUT_MS);
 
   it('stops processing if the job is superseded mid-way', async () => {
-      const { GitHubService } = await import('@server/services/github');
+      const { GitHubService } = await import('@codra/provider-github');
       const repo = uniqueRepo('supersede');
       const headSha = sha('c');
       const baseSha = sha('d');
@@ -128,8 +129,7 @@ dbDescribe('Review flow: lifecycle and finalize', () => {
 
       await runAndDrain({
         deliveryId: 'delivery-456',
-        eventName: 'pull_request',
-        payload: {
+        ...normalizeGitHubWebhook('pull_request', {
           action: 'opened',
           installation: { id: 123 },
           repository: { owner: { login: 'test-owner' }, name: repo },
@@ -141,8 +141,8 @@ dbDescribe('Review flow: lifecycle and finalize', () => {
             user: { login: 'author' },
             draft: false,
           }
-        }
-      });
+        })
+      } as any);
 
       const finalJob = await findExistingJobForHead(env, {
         owner: 'test-owner',
@@ -218,7 +218,7 @@ dbDescribe('Review flow: lifecycle and finalize', () => {
   it('completes the job with the review recorded even if post-review check-run/label updates fail', async () => {
     // Regression: the review is posted mid-finalize, so if the cosmetic check-run or label calls
     // throw, the job must still finish 'done' with review_id set rather than stranded 'failed'.
-    const { GitHubService } = await import('@server/services/github');
+    const { GitHubService } = await import('@codra/provider-github');
     const checkRunSpy = vi.spyOn(GitHubService.prototype, 'updateCheckRun' as any)
       .mockRejectedValue(new Error('Too many subrequests by single Worker invocation'));
 
diff --git a/test/review/flow-retry.spec.ts b/test/review/flow-retry.spec.ts
index ef063f0a..823fd5ec 100644
--- a/test/review/flow-retry.spec.ts
+++ b/test/review/flow-retry.spec.ts
@@ -5,6 +5,7 @@ import { getJobForProcessing, insertJob, updateJobFileCount, updateJobStep } fro
 import { getFileReviewsForJobs, upsertFileReview } from '@server/db/file-reviews';
 import { defaultRepoConfig, type ParsedReviewComment } from '@codra/schema';
 import { runWithDb } from '@server/db/client';
+import { normalizeGitHubWebhook } from '@codra/provider-github';
 import { makeRunAndDrain, REVIEW_FLOW_TIMEOUT_MS } from '../mocks/review-harness';
 
 const { getOtherRunningJobsCountMock } = vi.hoisted(() => ({
@@ -27,9 +28,10 @@ vi.mock('@server/db/app-settings', async (importOriginal) => {
   return { ...mod, getReviewSettings: getReviewSettingsMock };
 });
 
-vi.mock('@server/services/github', async () => {
+vi.mock('@codra/provider-github', async (importOriginal) => {
+  const mod = await importOriginal<Record<string, unknown>>();
   const { makeGitHubServiceMock } = await import('../mocks/services');
-  return { GitHubService: makeGitHubServiceMock() };
+  return { ...mod, GitHubService: makeGitHubServiceMock() };
 });
 
 vi.mock('@server/services/model', async () => {
@@ -290,8 +292,7 @@ dbDescribe('Review flow: retries, inheritance and continuations', () => {
 
     await runAndDrain({
       deliveryId: 'delivery-duplicate',
-      eventName: 'pull_request',
-      payload: {
+      ...normalizeGitHubWebhook('pull_request', {
         action: 'opened',
         installation: { id: 123 },
         repository: { owner: { login: 'test-owner' }, name: repo },
@@ -303,7 +304,7 @@ dbDescribe('Review flow: retries, inheritance and continuations', () => {
           user: { login: 'author' },
           draft: false,
         },
-      },
+      }) as any,
     });
 
     const finalJob = await getJobForProcessing(env, existing.id);
diff --git a/test/review/subrequest-completion.spec.ts b/test/review/subrequest-completion.spec.ts
index fc1aef5c..32217708 100644
--- a/test/review/subrequest-completion.spec.ts
+++ b/test/review/subrequest-completion.spec.ts
@@ -57,12 +57,16 @@ vi.mock('@server/db/app-settings', async (importOriginal) => {
   };
 });
 
-vi.mock('@server/services/github', () => ({
-  GitHubService: class {
-    getPullRequest = getPullRequestMock;
-    updateCheckRun = vi.fn().mockResolvedValue(undefined);
-  },
-}));
+vi.mock('@codra/provider-github', async (importOriginal) => {
+  const mod = await importOriginal<Record<string, unknown>>();
+  return {
+    ...mod,
+    GitHubService: class {
+      getPullRequest = getPullRequestMock;
+      updateCheckRun = vi.fn().mockResolvedValue(undefined);
+    },
+  };
+});
 
 // Imported after the mocks are registered.
 import { runReviewJob } from '@server/core/review';

From 738e28d0ea6a83c54a4980f6bb40bb98465f9008 Mon Sep 17 00:00:00 2001
From: Devarshi Shimpi <devarshishimpi@gmail.com>
Date: Sat, 15 Aug 2026 01:43:18 +0530
Subject: [PATCH 02/12] refactor: extract default configs and constants to a
 central file

---
 packages/core/src/constants.ts               | 39 ++++++++++
 packages/core/src/finding-gates.ts           |  2 +-
 packages/core/src/model-output/batch.ts      |  2 +-
 packages/core/src/model-output/evidence.ts   |  2 +-
 packages/core/src/model-output/index.ts      |  4 +-
 packages/core/src/model-output/json.ts       |  2 +-
 packages/core/src/model-output/non-answer.ts |  7 +-
 packages/core/src/prompts/file-review.ts     |  8 ++-
 packages/core/src/review/bin-runner.ts       |  5 +-
 packages/core/src/review/budget.ts           |  4 +-
 packages/core/src/review/diff-cache.ts       |  2 +-
 packages/core/src/review/file-runner.ts      |  3 +-
 packages/core/src/review/finalize.ts         |  2 +-
 packages/core/src/review/index.ts            | 21 +++---
 packages/core/src/review/pack.ts             | 11 +--
 packages/core/src/review/phase-control.ts    | 14 +---
 packages/core/src/review/phase.ts            | 10 +--
 packages/core/src/review/prepare.ts          |  3 +-
 packages/core/src/review/retry-policy.ts     |  2 +-
 packages/core/src/rules/detect.ts            |  2 +-
 packages/schema/src/config.ts                |  1 -
 packages/schema/src/constants.ts             | 21 ++++++
 packages/schema/src/schema-repo-config.ts    | 75 ++++++--------------
 packages/schema/src/schema.ts                | 28 +++++---
 src/server/core/config.ts                    |  2 +-
 25 files changed, 157 insertions(+), 115 deletions(-)
 create mode 100644 packages/core/src/constants.ts
 delete mode 100644 packages/schema/src/config.ts
 create mode 100644 packages/schema/src/constants.ts

diff --git a/packages/core/src/constants.ts b/packages/core/src/constants.ts
new file mode 100644
index 00000000..c3d9456f
--- /dev/null
+++ b/packages/core/src/constants.ts
@@ -0,0 +1,39 @@
+// Packing & Diff Limits
+export const PACKABLE_MAX_DIFF_LINES = 150;
+export const BIN_TARGET_DIFF_LINES = 300;
+export const BIN_MAX_FILES = 4;
+export const BIN_DIFF_CHAR_BUDGET = 24_000;
+export const DIFF_CACHE_TTL_SECONDS = 6 * 60 * 60;
+
+// Phase Control & Timers
+export const REVIEW_CHUNK_WALL_CLOCK_MS = 12 * 60 * 1000;
+export const JOB_LEASE_SECONDS = 15 * 60;
+export const BUSY_RETRY_SECONDS = 60;
+export const RETRYABLE_MODEL_FAILURE_RETRY_DELAYS_SECONDS = [30, 2 * 60, 5 * 60];
+export const FRESH_INVOCATION_YIELD_SECONDS = 8;
+export const ASYNC_BATCH_POLL_DELAY_SECONDS = 20;
+export const MAX_RETRYABLE_FILE_REVIEW_FAILURES = 6;
+export const MAX_JOB_CONTINUATIONS = 20;
+export const MAX_FINALIZE_CONTINUATIONS = 3;
+
+// Budget & Attempts
+export const FILE_FIXED_SUBREQUESTS = 2;
+export const MAX_MODEL_ATTEMPTS_ESTIMATE = 4;
+export const MISSING_FILE_ERROR = 'Model omitted this file from a batched review; retrying later.';
+
+// Model Output Parsing
+export const MIN_DISCRIMINATING_EVIDENCE_CHARS = 8;
+export const NON_ANSWER_MAX_RESPONSE_CHARS = 600;
+export const NON_ANSWER_MIN_DIFF_LINES = 200;
+export const MAX_LOGGED_JSON_CHARS = 2_000;
+export const SEVERITY_ORDER = ['P0', 'P1', 'P2', 'P3', 'nit'] as const;
+
+// Finding Gates
+export const VERIFY_MIN_ANSWER_RATIO = 0.6;
+
+// Rules
+export const MAX_RULE_SCAN_ADDED_LINES = 600;
+
+// Prompts
+export const EXEMPLAR_BLOCK_CHARS = 700;
+export const PR_DESCRIPTION_CHARS = 2_000;
diff --git a/packages/core/src/finding-gates.ts b/packages/core/src/finding-gates.ts
index 62bb3887..19b69ddc 100644
--- a/packages/core/src/finding-gates.ts
+++ b/packages/core/src/finding-gates.ts
@@ -28,7 +28,7 @@ function verifyCandidateLimit(effectiveMaxComments: number) {
   return Math.min(40, Math.max(10, effectiveMaxComments * 3));
 }
 
-const VERIFY_MIN_ANSWER_RATIO = 0.6;
+import { VERIFY_MIN_ANSWER_RATIO } from './constants';
 
 export type VerifyDrop = {
   comment: ParsedReviewComment;
diff --git a/packages/core/src/model-output/batch.ts b/packages/core/src/model-output/batch.ts
index bff19d55..83931689 100644
--- a/packages/core/src/model-output/batch.ts
+++ b/packages/core/src/model-output/batch.ts
@@ -25,7 +25,7 @@ type Ambiguity = { index: ReturnType<typeof buildBinAmbiguityIndex>; stats: { am
 type RawEntry = { findings: unknown[]; overall_correctness: string; overall_explanation: string };
 
 const basename = (path: string) => path.split('/').pop() ?? path;
-const SEVERITY_ORDER = ['P0', 'P1', 'P2', 'P3', 'nit'];
+import { SEVERITY_ORDER } from '../constants';
 
 function resolveEntryPath(reported: string, candidates: readonly FileDiff[], claimed: Set<string>): FileDiff | null {
   const unclaimed = (matches: readonly FileDiff[]) => matches.find((f) => !claimed.has(f.path)) ?? null;
diff --git a/packages/core/src/model-output/evidence.ts b/packages/core/src/model-output/evidence.ts
index dc6ffede..c7f5cb0b 100644
--- a/packages/core/src/model-output/evidence.ts
+++ b/packages/core/src/model-output/evidence.ts
@@ -1,7 +1,7 @@
 import { foldEvidenceText } from '../fingerprint';
 import type { DiffLine, FileDiff } from '../diff';
 
-export const MIN_DISCRIMINATING_EVIDENCE_CHARS = 8;
+import { MIN_DISCRIMINATING_EVIDENCE_CHARS } from '../constants';
 
 export type EvidenceIndex = {
   byContent: Map<string, DiffLine[]>;
diff --git a/packages/core/src/model-output/index.ts b/packages/core/src/model-output/index.ts
index 2e9173e6..9d0ad5a4 100644
--- a/packages/core/src/model-output/index.ts
+++ b/packages/core/src/model-output/index.ts
@@ -389,10 +389,10 @@ export function parseFileReviewResponse(
 
 
 export { dedupeFindings } from './dedupe';
+export { isNonAnswerReview } from './non-answer';
 export {
-  isNonAnswerReview,
   NON_ANSWER_MAX_RESPONSE_CHARS,
   NON_ANSWER_MIN_DIFF_LINES,
-} from './non-answer';
+} from '../constants';
 export { parseRawBatchPayload, type RawBatchPayload } from './json-batch';
 export { parseBatchReviewResponse, type BatchParseStats, type BatchReviewResult } from './batch';
diff --git a/packages/core/src/model-output/json.ts b/packages/core/src/model-output/json.ts
index 0d31406a..b53dbd31 100644
--- a/packages/core/src/model-output/json.ts
+++ b/packages/core/src/model-output/json.ts
@@ -3,7 +3,7 @@ import { jsonrepair } from 'jsonrepair';
 import { z } from 'zod';
 import { logger } from '../logger';
 
-const MAX_LOGGED_JSON_CHARS = 2_000;
+import { MAX_LOGGED_JSON_CHARS } from '../constants';
 
 export function truncateJsonForLog(value: string) {
   if (value.length <= MAX_LOGGED_JSON_CHARS) return value;
diff --git a/packages/core/src/model-output/non-answer.ts b/packages/core/src/model-output/non-answer.ts
index fca48f80..82319a74 100644
--- a/packages/core/src/model-output/non-answer.ts
+++ b/packages/core/src/model-output/non-answer.ts
@@ -1,9 +1,10 @@
 
 import type { FileDiff } from '../diff';
 
-export const NON_ANSWER_MAX_RESPONSE_CHARS = 600;
-
-export const NON_ANSWER_MIN_DIFF_LINES = 200;
+import {
+  NON_ANSWER_MAX_RESPONSE_CHARS,
+  NON_ANSWER_MIN_DIFF_LINES,
+} from '../constants';
 
 /**
  * True when a review response is a non-answer: a substantive diff dismissed in a sentence with no
diff --git a/packages/core/src/prompts/file-review.ts b/packages/core/src/prompts/file-review.ts
index 31706f86..10d0057e 100644
--- a/packages/core/src/prompts/file-review.ts
+++ b/packages/core/src/prompts/file-review.ts
@@ -2,6 +2,10 @@ import { claimTypes, type RepoConfig } from '@codra/schema';
 import type { FileDiff } from '../diff';
 import type { ModelResponseSchema } from '../ports/model';
 import { getLanguageForFile } from './languages';
+import {
+  EXEMPLAR_BLOCK_CHARS,
+  PR_DESCRIPTION_CHARS,
+} from '../constants';
 
 export function generatorFindingCap(maxComments: number): number {
   return Math.max(1, maxComments * 2);
@@ -217,7 +221,7 @@ export function buildFileReviewSystemPrompt(
 
 export type RejectedExemplar = { title: string; claimType?: string | null };
 
-const EXEMPLAR_BLOCK_CHARS = 700;
+
 
 function renderExemplars(exemplars: readonly RejectedExemplar[] | undefined): string | null {
   if (!exemplars?.length) return null;
@@ -236,7 +240,7 @@ function renderExemplars(exemplars: readonly RejectedExemplar[] | undefined): st
   return [heading, ...lines].join('\n');
 }
 
-const PR_DESCRIPTION_CHARS = 2_000;
+
 
 function renderPrContext(prDescription: string | null): string | null {
   const trimmed = prDescription?.trim();
diff --git a/packages/core/src/review/bin-runner.ts b/packages/core/src/review/bin-runner.ts
index 8dbb21d2..098530cb 100644
--- a/packages/core/src/review/bin-runner.ts
+++ b/packages/core/src/review/bin-runner.ts
@@ -3,11 +3,12 @@ import type { RepoConfig } from '@codra/schema';
 import type { FileDiff } from '../diff';
 import { renderFileDiff, type RejectedExemplar } from '../prompts/file-review';
 import type { BulkFileReviewInput, PullRequestRecord, ReviewModel, ReviewRuntime } from '../ports';
-import { type PersistedReviewJob, FRESH_INVOCATION_YIELD_SECONDS, MAX_RETRYABLE_FILE_REVIEW_FAILURES } from './phase-control';
+import { type PersistedReviewJob } from './phase-control';
+import { FRESH_INVOCATION_YIELD_SECONDS, MAX_RETRYABLE_FILE_REVIEW_FAILURES, MISSING_FILE_ERROR } from '../constants';
 import { isSubrequestBudgetError, retryableModelFailureDelaySeconds } from './retry-policy';
 import { scanRuleChannel } from './file-runner';
 
-const MISSING_FILE_ERROR = 'Model omitted this file from a batched review; retrying later.';
+
 
 export function proportionalSplit(total: number, weights: number[]): number[] {
   if (weights.length === 0) return [];
diff --git a/packages/core/src/review/budget.ts b/packages/core/src/review/budget.ts
index a8461200..f9249a05 100644
--- a/packages/core/src/review/budget.ts
+++ b/packages/core/src/review/budget.ts
@@ -1,7 +1,5 @@
 
-const FILE_FIXED_SUBREQUESTS = 2;
-
-const MAX_MODEL_ATTEMPTS_ESTIMATE = 4;
+import { FILE_FIXED_SUBREQUESTS, MAX_MODEL_ATTEMPTS_ESTIMATE } from '../constants';
 
 export function budgetAwareFileLimit(
   remainingSafeBudget: number,
diff --git a/packages/core/src/review/diff-cache.ts b/packages/core/src/review/diff-cache.ts
index aca8171c..98fd5021 100644
--- a/packages/core/src/review/diff-cache.ts
+++ b/packages/core/src/review/diff-cache.ts
@@ -3,7 +3,7 @@ import { filterReviewableFiles, parseUnifiedDiff, type FileDiff } from '../diff'
 import type { ReviewGitProvider, ReviewRuntime } from '../ports';
 import { logger } from '../logger';
 
-const DIFF_CACHE_TTL_SECONDS = 6 * 60 * 60;
+import { DIFF_CACHE_TTL_SECONDS } from '../constants';
 
 export function diffCacheKey(jobId: string) {
   return `diff:${jobId}`;
diff --git a/packages/core/src/review/file-runner.ts b/packages/core/src/review/file-runner.ts
index 9f88aa68..caa6a04a 100644
--- a/packages/core/src/review/file-runner.ts
+++ b/packages/core/src/review/file-runner.ts
@@ -4,7 +4,8 @@ import { parseUnifiedDiff, type FileDiff } from '../diff';
 import { ruleHitsToComments, scanFileForRuleHits, type RuleScanStats } from '../rules/detect';
 import type { RejectedExemplar } from '../prompts/file-review';
 import type { PullRequestRecord, ReviewModel, ReviewRuntime } from '../ports';
-import { type PersistedReviewJob, FRESH_INVOCATION_YIELD_SECONDS, MAX_RETRYABLE_FILE_REVIEW_FAILURES } from './phase-control';
+import { type PersistedReviewJob } from './phase-control';
+import { FRESH_INVOCATION_YIELD_SECONDS, MAX_RETRYABLE_FILE_REVIEW_FAILURES } from '../constants';
 import { isSubrequestBudgetError, retryableModelFailureDelaySeconds } from './retry-policy';
 
 export async function persistCompletedReview(
diff --git a/packages/core/src/review/finalize.ts b/packages/core/src/review/finalize.ts
index 1a9e349e..a742cfec 100644
--- a/packages/core/src/review/finalize.ts
+++ b/packages/core/src/review/finalize.ts
@@ -5,10 +5,10 @@ import { getDiffFiles } from './diff-cache';
 import type { ReviewFormatter, ReviewGitProvider, ReviewModel, ReviewRuntime } from '../ports';
 import {
   type PersistedReviewJob,
-  FRESH_INVOCATION_YIELD_SECONDS,
   enqueueJobPhase,
   heartbeatAndCheckSuperseded,
 } from './phase-control';
+import { FRESH_INVOCATION_YIELD_SECONDS } from '../constants';
 import { sendReviewTelemetry } from './telemetry';
 import { applyFindingGates } from './gate-pipeline';
 
diff --git a/packages/core/src/review/index.ts b/packages/core/src/review/index.ts
index 737a8f80..dd17c079 100644
--- a/packages/core/src/review/index.ts
+++ b/packages/core/src/review/index.ts
@@ -9,10 +9,6 @@ export { getDiffFiles, getOrFetchRawDiffForCompletedJob } from './diff-cache';
 export { budgetAwareFileLimit, estimatedSubrequestsPerFile } from './budget';
 
 export {
-  BIN_DIFF_CHAR_BUDGET,
-  BIN_MAX_FILES,
-  BIN_TARGET_DIFF_LINES,
-  PACKABLE_MAX_DIFF_LINES,
   narrowUnit,
   planReviewUnits,
   unitFiles,
@@ -20,6 +16,13 @@ export {
   type ReviewUnit,
 } from './pack';
 
+export {
+  BIN_DIFF_CHAR_BUDGET,
+  BIN_MAX_FILES,
+  BIN_TARGET_DIFF_LINES,
+  PACKABLE_MAX_DIFF_LINES,
+} from '../constants';
+
 export { proportionalSplit } from './bin-runner';
 
 export { verifyFindings, type VerifyDrop, type VerifyOutcome } from '../finding-gates';
@@ -27,18 +30,20 @@ export { verifyFindings, type VerifyDrop, type VerifyOutcome } from '../finding-
 export { extractReviewRequest, type ReviewRequest } from './request';
 
 // workflows/review.ts floors its inter-phase sleep here; the eslint barrel guard stops it
-export { FRESH_INVOCATION_YIELD_SECONDS } from './phase-control';
+export { FRESH_INVOCATION_YIELD_SECONDS } from '../constants';
 
 import {
   type PersistedReviewJob,
+  NextPhaseError,
+  failJobAndCheckRun,
+} from './phase-control';
+import {
   BUSY_RETRY_SECONDS,
   FRESH_INVOCATION_YIELD_SECONDS,
   JOB_LEASE_SECONDS,
   MAX_FINALIZE_CONTINUATIONS,
   MAX_JOB_CONTINUATIONS,
-  NextPhaseError,
-  failJobAndCheckRun,
-} from './phase-control';
+} from '../constants';
 import { getRetryableModelFailureDelaySeconds, isAwaitingAsyncReview, isSubrequestBudgetError } from './retry-policy';
 import { persistFailedFileReview } from './file-runner';
 import { runPreparePhase } from './prepare';
diff --git a/packages/core/src/review/pack.ts b/packages/core/src/review/pack.ts
index cd581467..2f34c9d4 100644
--- a/packages/core/src/review/pack.ts
+++ b/packages/core/src/review/pack.ts
@@ -1,10 +1,11 @@
 import { renderFileDiff } from '../prompts/file-review';
 import type { FileDiff } from '../diff';
-
-export const PACKABLE_MAX_DIFF_LINES = 150;
-export const BIN_TARGET_DIFF_LINES = 300;
-export const BIN_MAX_FILES = 4;
-export const BIN_DIFF_CHAR_BUDGET = 24_000;
+import {
+  PACKABLE_MAX_DIFF_LINES,
+  BIN_TARGET_DIFF_LINES,
+  BIN_MAX_FILES,
+  BIN_DIFF_CHAR_BUDGET,
+} from '../constants';
 
 export type ReviewUnit =
   | { kind: 'single'; file: FileDiff }
diff --git a/packages/core/src/review/phase-control.ts b/packages/core/src/review/phase-control.ts
index 74af18d5..b20a6fd9 100644
--- a/packages/core/src/review/phase-control.ts
+++ b/packages/core/src/review/phase-control.ts
@@ -1,20 +1,12 @@
 import { logger } from '../logger';
 import type { PersistedReviewJob, ReviewGitProvider, ReviewRuntime } from '../ports';
-
+import {
+  JOB_LEASE_SECONDS,
+} from '../constants';
 
 // JobSummary, which is exactly what mapJob returns; see the note on the port.
 export type { PersistedReviewJob };
 
-export const REVIEW_CHUNK_WALL_CLOCK_MS = 12 * 60 * 1000;
-export const JOB_LEASE_SECONDS = 15 * 60;
-export const BUSY_RETRY_SECONDS = 60;
-export const RETRYABLE_MODEL_FAILURE_RETRY_DELAYS_SECONDS = [30, 2 * 60, 5 * 60];
-export const FRESH_INVOCATION_YIELD_SECONDS = 8;
-export const ASYNC_BATCH_POLL_DELAY_SECONDS = 20;
-export const MAX_RETRYABLE_FILE_REVIEW_FAILURES = 6;
-export const MAX_JOB_CONTINUATIONS = 20;
-export const MAX_FINALIZE_CONTINUATIONS = 3;
-
 export async function heartbeatAndCheckSuperseded(env: ReviewRuntime, jobId: string, leaseOwner: string) {
   await env.jobs.heartbeatJobLease(jobId, leaseOwner, JOB_LEASE_SECONDS);
   const currentJob = await env.jobs.getJobForProcessing(jobId);
diff --git a/packages/core/src/review/phase.ts b/packages/core/src/review/phase.ts
index 5f88d40d..05075f19 100644
--- a/packages/core/src/review/phase.ts
+++ b/packages/core/src/review/phase.ts
@@ -8,15 +8,17 @@ import type { ReviewGitProvider, ReviewModel, ReviewRuntime } from '../ports';
 import { TokenTracker } from '../token-tracker';
 import {
   type PersistedReviewJob,
-  ASYNC_BATCH_POLL_DELAY_SECONDS,
-  FRESH_INVOCATION_YIELD_SECONDS,
-  MAX_JOB_CONTINUATIONS,
   NextPhaseError,
-  REVIEW_CHUNK_WALL_CLOCK_MS,
   enqueueJobPhase,
   hasCompletedStep,
   heartbeatAndCheckSuperseded,
 } from './phase-control';
+import {
+  ASYNC_BATCH_POLL_DELAY_SECONDS,
+  FRESH_INVOCATION_YIELD_SECONDS,
+  MAX_JOB_CONTINUATIONS,
+  REVIEW_CHUNK_WALL_CLOCK_MS,
+} from '../constants';
 import {
   canInheritParentFileReview,
   countsAsHandledFileReview,
diff --git a/packages/core/src/review/prepare.ts b/packages/core/src/review/prepare.ts
index 26cf897f..89fc933f 100644
--- a/packages/core/src/review/prepare.ts
+++ b/packages/core/src/review/prepare.ts
@@ -3,7 +3,8 @@ import { defaultRepoConfig, type RepoConfig } from '@codra/schema';
 import type { ReviewGitProvider, ReviewRuntime } from '../ports';
 import { getDiffFiles } from './diff-cache';
 import type { RejectedExemplar } from '../prompts/file-review';
-import { type PersistedReviewJob, JOB_LEASE_SECONDS, FRESH_INVOCATION_YIELD_SECONDS, enqueueJobPhase } from './phase-control';
+import { type PersistedReviewJob, enqueueJobPhase } from './phase-control';
+import { JOB_LEASE_SECONDS, FRESH_INVOCATION_YIELD_SECONDS } from '../constants';
 
 export async function runPreparePhase(
   env: ReviewRuntime,
diff --git a/packages/core/src/review/retry-policy.ts b/packages/core/src/review/retry-policy.ts
index 010b5463..e82d9492 100644
--- a/packages/core/src/review/retry-policy.ts
+++ b/packages/core/src/review/retry-policy.ts
@@ -2,7 +2,7 @@ import { logger } from '../logger';
 import { normalizeModelId, type RepoConfig } from '@codra/schema';
 import { isSubrequestBudgetMessage, isTimeoutMessage, matchesAnyTransientSubstring } from '@codra/schema/transient-errors';
 import type { ReviewRuntime } from '../ports';
-import { RETRYABLE_MODEL_FAILURE_RETRY_DELAYS_SECONDS } from './phase-control';
+import { RETRYABLE_MODEL_FAILURE_RETRY_DELAYS_SECONDS } from '../constants';
 
 
 export function isRetryableFileReviewErrorMessage(message: string | null | undefined) {
diff --git a/packages/core/src/rules/detect.ts b/packages/core/src/rules/detect.ts
index e2ccab2c..d9c525b6 100644
--- a/packages/core/src/rules/detect.ts
+++ b/packages/core/src/rules/detect.ts
@@ -5,7 +5,7 @@ import { buildAnchorHash, buildFindingFingerprint, buildFindingFingerprintV2, no
 import { CLAIM_TYPE_CATEGORY } from '@codra/schema';
 import { RULES, type Rule } from './table';
 
-const MAX_RULE_SCAN_ADDED_LINES = 600;
+import { MAX_RULE_SCAN_ADDED_LINES } from '../constants';
 
 export type RuleHit = {
   rule: Rule;
diff --git a/packages/schema/src/config.ts b/packages/schema/src/config.ts
deleted file mode 100644
index 558a0446..00000000
--- a/packages/schema/src/config.ts
+++ /dev/null
@@ -1 +0,0 @@
-export const REPO_CONFIG_CACHE_VERSION = 'v7';
diff --git a/packages/schema/src/constants.ts b/packages/schema/src/constants.ts
new file mode 100644
index 00000000..6ee78edd
--- /dev/null
+++ b/packages/schema/src/constants.ts
@@ -0,0 +1,21 @@
+export const DEFAULT_REVIEW_EVENTS = ['opened', 'synchronize', 'ready_for_review', 'reopened'] as const;
+export const DEFAULT_SKIP_FILES = ['**/*.lock', 'dist/**', 'build/**', '.next/**', '*.generated.*', 'coverage/**'];
+export const DEFAULT_EXEC_FILE_TYPES = ['.ts', '.tsx', '.js'];
+export const DEFAULT_EXEC_COMMAND = 'npm run lint && npm run typecheck';
+export const DEFAULT_MENTION_TRIGGER = '@codra-app';
+export const DEFAULT_LABELS = {
+  p1: 'review: needs-attention',
+  p2: 'review: approved',
+  p3: 'review: approved',
+};
+
+export const KIMI_K2_5_MODEL = '@cf/moonshotai/kimi-k2.5';
+export const KIMI_K2_6_MODEL = '@cf/moonshotai/kimi-k2.6';
+export const DEPRECATED_MODEL_ALIASES: Record<string, string> = {
+  [KIMI_K2_5_MODEL]: KIMI_K2_6_MODEL,
+};
+
+export const REPO_CONFIG_CACHE_VERSION = 'v7';
+
+export const DEFAULT_OVERALL_CORRECTNESS = 'patch is correct';
+export const DEFAULT_OVERALL_EXPLANATION = 'Review completed (partial output).';
diff --git a/packages/schema/src/schema-repo-config.ts b/packages/schema/src/schema-repo-config.ts
index f273dce1..ad103812 100644
--- a/packages/schema/src/schema-repo-config.ts
+++ b/packages/schema/src/schema-repo-config.ts
@@ -2,6 +2,15 @@ import { z } from 'zod';
 import { reviewSeverities } from './review-limits';
 import { reviewCategories } from './schema-enums';
 import { claimTypes, DEFAULT_DENIED_CLAIM_TYPES, DEFAULT_SHADOW_RULE_IDS } from './schema-claims';
+import {
+  DEFAULT_REVIEW_EVENTS,
+  DEFAULT_MENTION_TRIGGER,
+  DEFAULT_SKIP_FILES,
+  DEFAULT_EXEC_FILE_TYPES,
+  DEFAULT_EXEC_COMMAND,
+  DEFAULT_LABELS,
+  DEPRECATED_MODEL_ALIASES,
+} from './constants';
 
 const labelsSchema = z.union([
   z.literal(false),
@@ -13,12 +22,12 @@ const labelsSchema = z.union([
 ]);
 
 export const reviewConfigSchema = z.object({
-  on: z.array(z.enum(['opened', 'synchronize', 'ready_for_review', 'reopened', 'closed'])).default(['opened', 'synchronize', 'ready_for_review', 'reopened']),
+  on: z.array(z.enum(['opened', 'synchronize', 'ready_for_review', 'reopened', 'closed'])).default([...DEFAULT_REVIEW_EVENTS]),
   ignore_drafts: z.boolean().default(true),
-  mention_trigger: z.union([z.literal(false), z.string().min(1)]).default('@codra-app'),
+  mention_trigger: z.union([z.literal(false), z.string().min(1)]).default(DEFAULT_MENTION_TRIGGER),
   skip_files: z
     .array(z.string().min(1))
-    .default(['**/*.lock', 'dist/**', 'build/**', '.next/**', '*.generated.*', 'coverage/**']),
+    .default([...DEFAULT_SKIP_FILES]),
   large_file_threshold_lines: z.number().int().min(1).max(5_000).default(200),
   max_diff_lines_per_file: z.number().int().min(1).max(5_000).default(800),
   batch_small_files: z.boolean().default(true),
@@ -40,56 +49,25 @@ export const reviewConfigSchema = z.object({
       shadow_rule_ids: [...DEFAULT_SHADOW_RULE_IDS],
     }),
   custom_rules: z.array(z.string().min(1)).default([]),
-  labels: labelsSchema.default({
-    p1: 'review: needs-attention',
-    p2: 'review: approved',
-    p3: 'review: approved',
-  }),
+  labels: labelsSchema.default({ ...DEFAULT_LABELS }),
   exec: z
     .object({
       enabled: z.boolean().default(false),
-      on_file_types: z.array(z.string().min(1)).default(['.ts', '.tsx', '.js']),
-      command: z.string().min(1).default('npm run lint && npm run typecheck'),
+      on_file_types: z.array(z.string().min(1)).default([...DEFAULT_EXEC_FILE_TYPES]),
+      command: z.string().min(1).default(DEFAULT_EXEC_COMMAND),
     })
     .default({
       enabled: false,
-      on_file_types: ['.ts', '.tsx', '.js'],
-      command: 'npm run lint && npm run typecheck',
+      on_file_types: [...DEFAULT_EXEC_FILE_TYPES],
+      command: DEFAULT_EXEC_COMMAND,
     }),
 });
 
+export const DEFAULT_REVIEW_CONFIG = reviewConfigSchema.parse({});
+export const DEFAULT_MODEL_CONFIG = { main: null, fallbacks: [], size_overrides: [] };
+
 export const repoConfigSchema = z.object({
-  review: reviewConfigSchema.default({
-    on: ['opened', 'synchronize', 'ready_for_review', 'reopened'],
-    ignore_drafts: true,
-    mention_trigger: '@codra-app',
-    skip_files: ['**/*.lock', 'dist/**', 'build/**', '.next/**', '*.generated.*', 'coverage/**'],
-    large_file_threshold_lines: 200,
-    max_diff_lines_per_file: 800,
-    batch_small_files: true,
-    max_total_diff_chars: 150_000,
-    max_comments: 10,
-    min_severity: 'P3',
-    min_confidence: 0,
-    focus: [...reviewCategories],
-    deny_claim_types: [...DEFAULT_DENIED_CLAIM_TYPES],
-    rules: {
-      enabled: true,
-      disabled_rule_ids: [],
-      shadow_rule_ids: [...DEFAULT_SHADOW_RULE_IDS],
-    },
-    custom_rules: [],
-    labels: {
-      p1: 'review: needs-attention',
-      p2: 'review: approved',
-      p3: 'review: approved',
-    },
-    exec: {
-      enabled: false,
-      on_file_types: ['.ts', '.tsx', '.js'],
-      command: 'npm run lint && npm run typecheck',
-    },
-  }),
+  review: reviewConfigSchema.default(DEFAULT_REVIEW_CONFIG),
   model: z
     .object({
       main: z.string().nullable().default(null),
@@ -105,19 +83,10 @@ export const repoConfigSchema = z.object({
         .nullable()
         .optional(),
     })
-    .default({
-      main: null,
-      fallbacks: [],
-      size_overrides: [],
-    }),
+    .default(DEFAULT_MODEL_CONFIG),
 });
 
 export type RepoConfig = z.infer<typeof repoConfigSchema>;
-export const KIMI_K2_5_MODEL = '@cf/moonshotai/kimi-k2.5';
-export const KIMI_K2_6_MODEL = '@cf/moonshotai/kimi-k2.6';
-export const DEPRECATED_MODEL_ALIASES: Record<string, string> = {
-  [KIMI_K2_5_MODEL]: KIMI_K2_6_MODEL,
-};
 
 export function normalizeModelId(model: string) {
   return DEPRECATED_MODEL_ALIASES[model] ?? model;
diff --git a/packages/schema/src/schema.ts b/packages/schema/src/schema.ts
index 3e4c3d38..f44cf17b 100644
--- a/packages/schema/src/schema.ts
+++ b/packages/schema/src/schema.ts
@@ -30,14 +30,19 @@ import {
   reviewConfigSchema,
   repoConfigSchema,
   type RepoConfig,
-  KIMI_K2_5_MODEL,
-  KIMI_K2_6_MODEL,
-  DEPRECATED_MODEL_ALIASES,
   normalizeModelId,
   normalizeRepoModelConfig,
   normalizeRepoConfig,
   defaultRepoConfig,
 } from './schema-repo-config';
+import {
+  KIMI_K2_5_MODEL,
+  KIMI_K2_6_MODEL,
+  DEPRECATED_MODEL_ALIASES,
+  DEFAULT_OVERALL_CORRECTNESS,
+  DEFAULT_OVERALL_EXPLANATION,
+  REPO_CONFIG_CACHE_VERSION,
+} from './constants';
 
 // Re-exported for server use; client imports directly to keep zod out of browser bundle.
 export {
@@ -71,14 +76,17 @@ export {
   reviewConfigSchema,
   repoConfigSchema,
   type RepoConfig,
-  KIMI_K2_5_MODEL,
-  KIMI_K2_6_MODEL,
-  DEPRECATED_MODEL_ALIASES,
   normalizeModelId,
   normalizeRepoModelConfig,
   normalizeRepoConfig,
   defaultRepoConfig,
 };
+export {
+  KIMI_K2_5_MODEL,
+  KIMI_K2_6_MODEL,
+  DEPRECATED_MODEL_ALIASES,
+  REPO_CONFIG_CACHE_VERSION,
+};
 
 const dateStringSchema = z.union([z.string(), z.date()]).transform((d) => (d instanceof Date ? d.toISOString() : d));
 const coerceNumberSchema = z.coerce.number();
@@ -144,8 +152,8 @@ const reviewFindingSchema = z.object({
 
 export const fileReviewModelOutputSchema = z.object({
   findings: z.array(reviewFindingSchema),
-  overall_correctness: z.string().optional().default('patch is correct'),
-  overall_explanation: z.string().optional().default('Review completed (partial output).'),
+  overall_correctness: z.string().optional().default(DEFAULT_OVERALL_CORRECTNESS),
+  overall_explanation: z.string().optional().default(DEFAULT_OVERALL_EXPLANATION),
   overall_confidence_score: z.number().min(0).max(1).optional(),
 });
 
@@ -155,8 +163,8 @@ export const batchReviewModelOutputSchema = z.object({
     z.object({
       absolute_file_path: z.string(),
       findings: z.array(reviewFindingSchema),
-      overall_correctness: z.string().optional().default('patch is correct'),
-      overall_explanation: z.string().optional().default('Review completed (partial output).'),
+      overall_correctness: z.string().optional().default(DEFAULT_OVERALL_CORRECTNESS),
+      overall_explanation: z.string().optional().default(DEFAULT_OVERALL_EXPLANATION),
       overall_confidence_score: z.number().min(0).max(1).optional(),
     }),
   ).min(1),
diff --git a/src/server/core/config.ts b/src/server/core/config.ts
index 3c77c7cf..bfc39859 100644
--- a/src/server/core/config.ts
+++ b/src/server/core/config.ts
@@ -1,5 +1,5 @@
 import { defaultRepoConfig, normalizeRepoModelConfig, repoConfigSchema, type RepoConfig } from '@codra/schema';
-import { REPO_CONFIG_CACHE_VERSION } from '@codra/schema/config';
+import { REPO_CONFIG_CACHE_VERSION } from '@codra/schema';
 import type { AppBindings } from '@server/env';
 import { getRepoConfigRecord, syncRepoConfig } from '@server/db/repo-configs';
 

From d86ed581e6fa022a8a8c74960b3fe1308546183d Mon Sep 17 00:00:00 2001
From: Devarshi Shimpi <devarshishimpi@gmail.com>
Date: Sat, 15 Aug 2026 04:56:03 +0530
Subject: [PATCH 03/12] refactor: extract UI components and update database
 imports

---
 eslint.config.js                              |   2 +-
 package-lock.json                             |  37 ++++
 package.json                                  |   7 +-
 packages/core/src/ports/index.ts              |   2 +
 packages/core/src/ports/instance-id.ts        |   3 +
 packages/core/src/ports/jobs.ts               |  19 ++
 packages/core/src/ports/repo-config.ts        |  12 ++
 packages/core/test/in-memory.ts               |   5 +
 .../db}/migrations/001_initial.sql            |   0
 .../db}/migrations/002_jobs_async_review.sql  |   0
 .../db}/migrations/003_grounding.sql          |   0
 packages/db/package.json                      |  24 +++
 .../db/scripts}/migrate-env.mjs               |   2 +-
 .../db/scripts}/migrate-sql-split.mjs         |   0
 {scripts => packages/db/scripts}/migrate.mjs  |   2 +-
 .../server/db => packages/db/src}/accounts.ts |   8 +-
 .../db => packages/db/src}/app-settings.ts    |   9 +-
 {src/server/db => packages/db/src}/client.ts  |   5 +-
 .../db/src}/comment-feedback.ts               |  11 +-
 packages/db/src/env.ts                        |   9 +
 .../db/src}/file-reviews-bulk.ts              |  10 +-
 .../db/src}/file-reviews-findings.ts          |  10 +-
 .../db => packages/db/src}/file-reviews.ts    |  11 +-
 .../db => packages/db/src}/jobs-activity.ts   |   6 +-
 .../db => packages/db/src}/jobs-leases.ts     |  18 +-
 .../db => packages/db/src}/jobs-lifecycle.ts  |  24 +--
 .../db => packages/db/src}/jobs-mapping.ts    |   0
 {src/server/db => packages/db/src}/jobs.ts    |  21 ++-
 .../server/db => packages/db/src}/learning.ts |   6 +-
 .../db => packages/db/src}/model-configs.ts   |  39 ++--
 .../db => packages/db/src}/repo-configs.ts    |  15 +-
 .../db => packages/db/src}/repositories.ts    |   4 +-
 .../repositories/file-review-repository.ts    |  31 ++++
 packages/db/src/repositories/index.ts         |   5 +
 .../repositories/instance-id-repository.ts    |  32 ++++
 .../db/src/repositories/jobs-repository.ts    |  87 +++++++++
 .../repositories/repo-config-repository.ts    |  10 +
 .../src/repositories/settings-repository.ts   |  30 +++
 .../db/src}/review-comment-sql.ts             |   0
 {src/server/db => packages/db/src}/stats.ts   |   4 +-
 .../db/src}/webhook-deliveries.ts             |   6 +-
 packages/db/tsconfig.json                     |  17 ++
 packages/db/vitest.config.ts                  |   9 +
 packages/schema/src/schema.ts                 |  10 +
 packages/ui/package.json                      |  36 ++++
 .../ui/src/components}/alert.tsx              |   2 +-
 .../ui/src/components}/badge-variants.ts      |   0
 packages/ui/src/components/badge.tsx          |  14 ++
 .../ui/src/components}/bar-sparkline.tsx      |   2 +-
 .../ui/src/components}/button-variants.ts     |   0
 .../ui/src/components}/button.tsx             |   4 +-
 .../ui/src/components/chart-primitives.tsx    | 163 ++++++++++++++++
 .../ui/src/components}/confirm-dialog.tsx     |   2 +-
 .../ui/src/components}/copy-button.tsx        |   6 +-
 .../ui/src/components}/empty-state.tsx        |   4 +-
 .../ui/src/components}/github-mark.tsx        |   0
 .../ui/src/components}/input.tsx              |   2 +-
 .../ui/src/components}/layer-card.tsx         |   2 +-
 .../ui/src/components}/load-error.tsx         |   4 +-
 packages/ui/src/components/motion/index.ts    |   4 +
 .../components/motion/shared-layout-bg.tsx    |   2 +-
 .../src}/components/motion/smooth-scroll.tsx  |   0
 .../src}/components/motion/stepped-slider.tsx |   4 +-
 .../ui/src}/components/motion/tabs.tsx        |   2 +-
 .../ui/src/components}/section-card.tsx       |   0
 .../ui/src/components}/select-panel.tsx       |   4 +-
 .../ui/src/components}/select-shared.ts       |   0
 .../ui/src/components}/select-trigger.tsx     |   4 +-
 .../ui/src/components}/select.tsx             |   2 +-
 .../ui/src/components}/skeleton.tsx           |   2 +-
 .../ui/src/components}/switch.tsx             |   2 +-
 .../ui/src/components}/text.tsx               |   2 +-
 packages/ui/src/hooks/index.ts                |   1 +
 .../ui/src}/hooks/use-is-dark-mode.ts         |   0
 packages/ui/src/index.ts                      |  22 +++
 packages/ui/src/lib/constants.ts              |  26 +++
 {src/client => packages/ui/src}/lib/ease.ts   |   0
 .../ui/src}/lib/file-tree.ts                  |   0
 .../ui/src}/lib/highlight.tsx                 |   0
 .../ui/src}/lib/markdown-plugins.ts           |   0
 .../ui/src}/lib/prompt-diff.ts                |   0
 .../ui/src}/lib/selection.ts                  |   0
 {src/client => packages/ui/src}/lib/theme.tsx |   0
 {src/client => packages/ui/src}/lib/utils.ts  |   0
 packages/ui/tsconfig.json                     |   9 +
 scratch/refactor-consumers.js                 |  37 ++++
 scratch/refactor-db-2.js                      |  35 ++++
 scratch/refactor-db-3.js                      |  33 ++++
 scratch/refactor-db.js                        |  42 +++++
 scratch/refactor-repos.js                     |  21 +++
 scratch/refactor-tests.js                     |  34 ++++
 scripts/comment-density.mjs                   |   2 +-
 scripts/test.mjs                              |   2 +-
 .../features/account/detail-rows.tsx          |   6 +-
 .../features/account/details-section.tsx      |   5 +-
 .../features/account/profile-card.tsx         |   6 +-
 .../dashboard/updates-email-prompt.tsx        |   3 +-
 .../features/job-detail/comment-card.tsx      |   8 +-
 .../features/job-detail/context-snippet.tsx   |   4 +-
 .../job-detail/diff-file-panel-utils.ts       |   2 +-
 .../features/job-detail/diff-file-panel.tsx   |   9 +-
 .../features/job-detail/diff-file-tree.tsx    |   6 +-
 .../features/job-detail/file-finding.tsx      |   4 +-
 .../features/job-detail/job-chips.tsx         |   2 +-
 .../features/job-detail/job-diffs.tsx         |   4 +-
 .../features/job-detail/job-findings-list.tsx |   2 +-
 .../features/job-detail/job-header.tsx        |   5 +-
 .../features/job-detail/job-meta-cards.tsx    |   2 +-
 .../job-detail/job-review-overview.tsx        |   2 +-
 .../features/job-detail/job-skeleton.tsx      |   3 +-
 .../job-detail/status-badge.tsx}              |  19 +-
 .../features/models/model-chain.tsx           |   5 +-
 .../features/repos/repo-model-modal.tsx       |   3 +-
 .../components/features/repos/repo-row.tsx    |   4 +-
 .../features/settings/about-section.tsx       |   5 +-
 .../settings/default-models-section.tsx       |   2 +-
 .../features/settings/new-provider-form.tsx   |   4 +-
 .../features/settings/provider-list.tsx       |   2 +-
 .../features/settings/provider-row.tsx        |   8 +-
 .../features/settings/review-section.tsx      |   7 +-
 .../features/stats/chart-primitives.tsx       | 174 +-----------------
 .../features/stats/chart-support.ts           |   2 +-
 .../features/stats/metrics-grid-charts.tsx    |  16 +-
 .../features/stats/overview-stats.tsx         |   4 +-
 .../components/features/stats/stats-grid.tsx  |   5 +-
 .../features/stats/time-range-select.tsx      |   4 +-
 src/client/components/layout/account-menu.tsx |   4 +-
 src/client/components/layout/app-shell.tsx    |   6 +-
 src/client/components/layout/page-header.tsx  |   2 +-
 .../components/layout/sidebar-nav-item.tsx    |   2 +-
 src/client/components/shared/jobs-table.tsx   |   5 +-
 .../components/shared/page-header-actions.tsx |   2 +-
 .../shared/route-error-boundary.tsx           |   2 +-
 src/client/main.tsx                           |   6 +-
 src/client/pages/account.tsx                  |   2 +-
 src/client/pages/dashboard.tsx                |   4 +-
 src/client/pages/job-detail.tsx               |   4 +-
 src/client/pages/job-logs.tsx                 |  11 +-
 src/client/pages/jobs.tsx                     |   6 +-
 src/client/pages/landing.tsx                  |   5 +-
 src/client/pages/login.tsx                    |   4 +-
 src/client/pages/not-found.tsx                |   2 +-
 src/client/pages/repos.tsx                    |   9 +-
 src/client/pages/settings.tsx                 |   6 +-
 src/client/pages/stats.tsx                    |   4 +-
 src/server/adapters/file-review-store.ts      |  34 +---
 src/server/adapters/jobs-store.ts             |  81 +-------
 src/server/adapters/settings-store.ts         |  29 +--
 src/server/core/config.ts                     |   2 +-
 src/server/core/job-recovery.ts               |   2 +-
 src/server/core/telemetry.ts                  |   2 +-
 src/server/index.ts                           |   4 +-
 src/server/models/google.ts                   |  74 +++-----
 src/server/models/limits.ts                   |  76 ++------
 src/server/routes/api/auth.ts                 |   2 +-
 src/server/routes/api/jobs.ts                 |   6 +-
 src/server/routes/api/models.ts               |   2 +-
 src/server/routes/api/repos.ts                |   2 +-
 src/server/routes/api/settings.ts             |   2 +-
 src/server/routes/api/stats.ts                |   2 +-
 src/server/routes/auth.ts                     |   2 +-
 src/server/routes/webhook.ts                  |   6 +-
 src/server/services/model-chain-progress.ts   | 106 ++++-------
 src/server/services/model-chain-runner.ts     |   2 +-
 src/server/services/model-rate-limits.ts      |   2 +-
 src/server/services/model-review-batch.ts     |   2 +-
 src/server/services/model-review-chain.ts     | 124 +++++--------
 src/server/services/model-support.ts          |  46 ++---
 src/server/services/model.ts                  |   2 +-
 src/server/workflows/review.ts                |   4 +-
 test/api/auth.spec.ts                         |   4 +-
 test/api/jobs.spec.ts                         |   2 +-
 test/api/repos.spec.ts                        |   4 +-
 test/db/bulk-upsert.spec.ts                   |   4 +-
 test/db/stats-trend.spec.ts                   |   2 +-
 test/e2e/accordion-selection.spec.tsx         |   2 +-
 test/e2e/dashboard.spec.tsx                   |   2 +-
 test/findings/suppression.spec.ts             |   8 +-
 test/helpers.ts                               |   2 +-
 test/jsonb-encoding.spec.ts                   |   8 +-
 test/migrate-sql-split.spec.ts                |   2 +-
 test/mocks/review-harness.ts                  |   2 +-
 test/model/chain-progress-store.spec.ts       |  63 +++----
 test/model/config-cache.spec.ts               |   4 +-
 test/review/async-batch.spec.ts               |  12 +-
 test/review/batch-flow.spec.ts                |  16 +-
 test/review/flow-chunking.spec.ts             |  12 +-
 test/review/flow-lifecycle.spec.ts            |  18 +-
 test/review/flow-retry.spec.ts                |  12 +-
 test/review/quota-deferral.spec.ts            |  50 ++---
 test/review/resumable-queue.spec.ts           |   6 +-
 test/review/scheduled-maintenance.spec.ts     |   4 +-
 test/review/subrequest-completion.spec.ts     |   4 +-
 .../workflow-finalize-fresh-instance.spec.ts  |  12 +-
 tsconfig.json                                 |   1 +
 195 files changed, 1369 insertions(+), 1021 deletions(-)
 create mode 100644 packages/core/src/ports/instance-id.ts
 create mode 100644 packages/core/src/ports/repo-config.ts
 rename {db => packages/db}/migrations/001_initial.sql (100%)
 rename {db => packages/db}/migrations/002_jobs_async_review.sql (100%)
 rename {db => packages/db}/migrations/003_grounding.sql (100%)
 create mode 100644 packages/db/package.json
 rename {scripts => packages/db/scripts}/migrate-env.mjs (97%)
 rename {scripts => packages/db/scripts}/migrate-sql-split.mjs (100%)
 rename {scripts => packages/db/scripts}/migrate.mjs (99%)
 rename {src/server/db => packages/db/src}/accounts.ts (95%)
 rename {src/server/db => packages/db/src}/app-settings.ts (85%)
 rename {src/server/db => packages/db/src}/client.ts (97%)
 rename {src/server/db => packages/db/src}/comment-feedback.ts (92%)
 create mode 100644 packages/db/src/env.ts
 rename {src/server/db => packages/db/src}/file-reviews-bulk.ts (98%)
 rename {src/server/db => packages/db/src}/file-reviews-findings.ts (95%)
 rename {src/server/db => packages/db/src}/file-reviews.ts (93%)
 rename {src/server/db => packages/db/src}/jobs-activity.ts (82%)
 rename {src/server/db => packages/db/src}/jobs-leases.ts (91%)
 rename {src/server/db => packages/db/src}/jobs-lifecycle.ts (89%)
 rename {src/server/db => packages/db/src}/jobs-mapping.ts (100%)
 rename {src/server/db => packages/db/src}/jobs.ts (94%)
 rename {src/server/db => packages/db/src}/learning.ts (93%)
 rename {src/server/db => packages/db/src}/model-configs.ts (85%)
 rename {src/server/db => packages/db/src}/repo-configs.ts (89%)
 rename {src/server/db => packages/db/src}/repositories.ts (88%)
 create mode 100644 packages/db/src/repositories/file-review-repository.ts
 create mode 100644 packages/db/src/repositories/index.ts
 create mode 100644 packages/db/src/repositories/instance-id-repository.ts
 create mode 100644 packages/db/src/repositories/jobs-repository.ts
 create mode 100644 packages/db/src/repositories/repo-config-repository.ts
 create mode 100644 packages/db/src/repositories/settings-repository.ts
 rename {src/server/db => packages/db/src}/review-comment-sql.ts (100%)
 rename {src/server/db => packages/db/src}/stats.ts (98%)
 rename {src/server/db => packages/db/src}/webhook-deliveries.ts (92%)
 create mode 100644 packages/db/tsconfig.json
 create mode 100644 packages/db/vitest.config.ts
 create mode 100644 packages/ui/package.json
 rename {src/client/components/ui => packages/ui/src/components}/alert.tsx (97%)
 rename {src/client/components/ui => packages/ui/src/components}/badge-variants.ts (100%)
 create mode 100644 packages/ui/src/components/badge.tsx
 rename {src/client/components/shared => packages/ui/src/components}/bar-sparkline.tsx (97%)
 rename {src/client/components/ui => packages/ui/src/components}/button-variants.ts (100%)
 rename {src/client/components/ui => packages/ui/src/components}/button.tsx (96%)
 create mode 100644 packages/ui/src/components/chart-primitives.tsx
 rename {src/client/components/ui => packages/ui/src/components}/confirm-dialog.tsx (96%)
 rename {src/client/components/shared => packages/ui/src/components}/copy-button.tsx (93%)
 rename {src/client/components/shared => packages/ui/src/components}/empty-state.tsx (96%)
 rename {src/client/components/shared => packages/ui/src/components}/github-mark.tsx (100%)
 rename {src/client/components/ui => packages/ui/src/components}/input.tsx (96%)
 rename {src/client/components/ui => packages/ui/src/components}/layer-card.tsx (91%)
 rename {src/client/components/shared => packages/ui/src/components}/load-error.tsx (95%)
 create mode 100644 packages/ui/src/components/motion/index.ts
 rename {src/client => packages/ui/src}/components/motion/shared-layout-bg.tsx (98%)
 rename {src/client => packages/ui/src}/components/motion/smooth-scroll.tsx (100%)
 rename {src/client => packages/ui/src}/components/motion/stepped-slider.tsx (99%)
 rename {src/client => packages/ui/src}/components/motion/tabs.tsx (99%)
 rename {src/client/components/shared => packages/ui/src/components}/section-card.tsx (100%)
 rename {src/client/components/ui => packages/ui/src/components}/select-panel.tsx (98%)
 rename {src/client/components/ui => packages/ui/src/components}/select-shared.ts (100%)
 rename {src/client/components/ui => packages/ui/src/components}/select-trigger.tsx (97%)
 rename {src/client/components/ui => packages/ui/src/components}/select.tsx (99%)
 rename {src/client/components/shared => packages/ui/src/components}/skeleton.tsx (93%)
 rename {src/client/components/ui => packages/ui/src/components}/switch.tsx (97%)
 rename {src/client/components/ui => packages/ui/src/components}/text.tsx (95%)
 create mode 100644 packages/ui/src/hooks/index.ts
 rename {src/client => packages/ui/src}/hooks/use-is-dark-mode.ts (100%)
 create mode 100644 packages/ui/src/index.ts
 create mode 100644 packages/ui/src/lib/constants.ts
 rename {src/client => packages/ui/src}/lib/ease.ts (100%)
 rename {src/client => packages/ui/src}/lib/file-tree.ts (100%)
 rename {src/client => packages/ui/src}/lib/highlight.tsx (100%)
 rename {src/client => packages/ui/src}/lib/markdown-plugins.ts (100%)
 rename {src/client => packages/ui/src}/lib/prompt-diff.ts (100%)
 rename {src/client => packages/ui/src}/lib/selection.ts (100%)
 rename {src/client => packages/ui/src}/lib/theme.tsx (100%)
 rename {src/client => packages/ui/src}/lib/utils.ts (100%)
 create mode 100644 packages/ui/tsconfig.json
 create mode 100644 scratch/refactor-consumers.js
 create mode 100644 scratch/refactor-db-2.js
 create mode 100644 scratch/refactor-db-3.js
 create mode 100644 scratch/refactor-db.js
 create mode 100644 scratch/refactor-repos.js
 create mode 100644 scratch/refactor-tests.js
 rename src/client/components/{ui/badge.tsx => features/job-detail/status-badge.tsx} (60%)

diff --git a/eslint.config.js b/eslint.config.js
index 0772c7ee..cc5912fd 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -200,7 +200,7 @@ export default tseslint.config(
           },
           {
             target: 'packages/ui/**/*',
-            from: ['packages/core/**/*', 'packages/provider-github/**/*', 'packages/db/**/*', 'packages/models/**/*', 'packages/api/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
+            from: ['src/**/*', 'packages/core/**/*', 'packages/provider-github/**/*', 'packages/db/**/*', 'packages/models/**/*', 'packages/api/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
           },
           {
             target: 'apps/dashboard/**/*',
diff --git a/package-lock.json b/package-lock.json
index 4fa8b21a..96f00a83 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -16,6 +16,7 @@
         "@base-ui/react": "^1.6.0",
         "@codra/core": "*",
         "@codra/schema": "*",
+        "@codra/ui": "*",
         "class-variance-authority": "^0.7.1",
         "clsx": "^2.1.1",
         "hono": "^4.12.25",
@@ -565,6 +566,10 @@
       "resolved": "packages/core",
       "link": true
     },
+    "node_modules/@codra/db": {
+      "resolved": "packages/db",
+      "link": true
+    },
     "node_modules/@codra/provider-github": {
       "resolved": "packages/provider-github",
       "link": true
@@ -573,6 +578,10 @@
       "resolved": "packages/schema",
       "link": true
     },
+    "node_modules/@codra/ui": {
+      "resolved": "packages/ui",
+      "link": true
+    },
     "node_modules/@codra/worker": {
       "resolved": "apps/worker",
       "link": true
@@ -8645,6 +8654,14 @@
         "@types/picomatch": "^4.0.3"
       }
     },
+    "packages/db": {
+      "name": "@codra/db",
+      "version": "0.9.4",
+      "dependencies": {
+        "@codra/schema": "*",
+        "postgres": "^3.4.9"
+      }
+    },
     "packages/provider-github": {
       "name": "@codra/provider-github",
       "version": "0.9.4",
@@ -8659,6 +8676,26 @@
       "dependencies": {
         "zod": "^4.3.6"
       }
+    },
+    "packages/ui": {
+      "name": "@codra/ui",
+      "version": "0.9.4",
+      "dependencies": {
+        "@base-ui/react": "^1.6.0",
+        "class-variance-authority": "^0.7.1",
+        "clsx": "^2.1.1",
+        "sugar-high": "^2.0.0",
+        "tailwind-merge": "^3.5.0"
+      },
+      "peerDependencies": {
+        "lenis": ">=1.0.0",
+        "lucide-react": ">=1.0.0",
+        "motion": ">=12.0.0",
+        "react": "^19.0.0",
+        "react-dom": "^19.0.0",
+        "recharts": ">=3.0.0",
+        "sonner": ">=2.0.0"
+      }
     }
   }
 }
diff --git a/package.json b/package.json
index 65aa8795..dee9f48f 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
     "density": "node scripts/comment-density.mjs --top",
     "start": "npm run dev",
     "setup:cloudflare": "node scripts/setup-cloudflare.js",
-    "migrate": "node scripts/migrate.mjs",
+    "migrate": "node packages/db/scripts/migrate.mjs",
     "test": "node scripts/test.mjs",
     "test:all": "npm run test --workspaces --if-present",
     "test:watch": "vitest",
@@ -86,11 +86,12 @@
     "sonner": "^2.0.7",
     "sugar-high": "^2.0.0",
     "tailwind-merge": "^3.5.0",
-    "zod": "^4.3.6"
+    "zod": "^4.3.6",
+    "@codra/ui": "*"
   },
   "allowScripts": {
     "esbuild": true,
     "unrs-resolver@1.12.2": true,
     "workerd@1.20260801.1": true
   }
-}
+}
\ No newline at end of file
diff --git a/packages/core/src/ports/index.ts b/packages/core/src/ports/index.ts
index 221571d0..02bcd61f 100644
--- a/packages/core/src/ports/index.ts
+++ b/packages/core/src/ports/index.ts
@@ -8,3 +8,5 @@ export type { FileReviewOutcome, ModelErrorClassifier, ModelResponse, ModelRespo
 export type { ReviewFormatter } from './formatter';
 export type { ReviewTelemetryEvent, TelemetrySink } from './telemetry';
 export type { ReviewRuntime } from './runtime';
+export type { RepoConfigStore } from './repo-config';
+export type { InstanceIdStore } from './instance-id';
diff --git a/packages/core/src/ports/instance-id.ts b/packages/core/src/ports/instance-id.ts
new file mode 100644
index 00000000..0a542471
--- /dev/null
+++ b/packages/core/src/ports/instance-id.ts
@@ -0,0 +1,3 @@
+export interface InstanceIdStore {
+  getOrCreateInstanceId(): Promise<string>;
+}
diff --git a/packages/core/src/ports/jobs.ts b/packages/core/src/ports/jobs.ts
index fcda4594..8535b52b 100644
--- a/packages/core/src/ports/jobs.ts
+++ b/packages/core/src/ports/jobs.ts
@@ -51,6 +51,25 @@ export interface JobStore {
     trigger: 'auto' | 'mention';
   }): Promise<PersistedReviewJob | null>;
 
+  recoverExpiredJobLeases(maxCount: number): Promise<{
+    requeuedJobIds: string[];
+    failedJobs: Array<{ id: string }>;
+  }>;
+  getTerminalJobsNeedingCheckRunCompletion(limit: number): Promise<Array<{
+    id: string;
+    status: string;
+    check_run_id: number | null;
+    installation_id: string;
+    owner: string;
+    repo: string;
+    verdict: string | null;
+    file_count: number | null;
+    comment_count: number | null;
+    error_msg: string | null;
+  }>>;
+  hasPendingMaintenanceWork(): Promise<boolean>;
+  clearSystemActive(): Promise<void>;
+
   updateJobCheckRun(jobId: string, checkRunId: number): Promise<void>;
   markJobCheckRunCompleted(jobId: string): Promise<void>;
   completePreparationStep(jobId: string, fileCount: number): Promise<void>;
diff --git a/packages/core/src/ports/repo-config.ts b/packages/core/src/ports/repo-config.ts
new file mode 100644
index 00000000..ca3c02cf
--- /dev/null
+++ b/packages/core/src/ports/repo-config.ts
@@ -0,0 +1,12 @@
+import type { RepoConfig } from '@codra/schema';
+
+export interface RepoConfigStore {
+  getRepoConfigRecord(owner: string, repo: string): Promise<{
+    parsedJson: RepoConfig;
+    enabled: boolean;
+    mainModel: string | null;
+    fallbackModels: string[] | null;
+    sizeOverrides: unknown[] | null;
+  } | null>;
+  syncRepoConfig(input: { installationId: string; owner: string; repo: string }): Promise<void>;
+}
diff --git a/packages/core/test/in-memory.ts b/packages/core/test/in-memory.ts
index 5baa5755..12a20e4b 100644
--- a/packages/core/test/in-memory.ts
+++ b/packages/core/test/in-memory.ts
@@ -178,6 +178,11 @@ export function createInMemoryRuntime(
       resetJobContinuationCount: async () => {},
       getOtherRunningJobsCount: async () => 0,
 
+      recoverExpiredJobLeases: async () => ({ requeuedJobIds: [], failedJobs: [] }),
+      getTerminalJobsNeedingCheckRunCompletion: async () => [],
+      hasPendingMaintenanceWork: async () => false,
+      clearSystemActive: async () => {},
+
       setJobWorkflowInstance: async () => {},
       setJobPullRequestMeta: async (jobId, meta) => { patch(jobId, meta); },
       insertJob: async () => job,
diff --git a/db/migrations/001_initial.sql b/packages/db/migrations/001_initial.sql
similarity index 100%
rename from db/migrations/001_initial.sql
rename to packages/db/migrations/001_initial.sql
diff --git a/db/migrations/002_jobs_async_review.sql b/packages/db/migrations/002_jobs_async_review.sql
similarity index 100%
rename from db/migrations/002_jobs_async_review.sql
rename to packages/db/migrations/002_jobs_async_review.sql
diff --git a/db/migrations/003_grounding.sql b/packages/db/migrations/003_grounding.sql
similarity index 100%
rename from db/migrations/003_grounding.sql
rename to packages/db/migrations/003_grounding.sql
diff --git a/packages/db/package.json b/packages/db/package.json
new file mode 100644
index 00000000..8107c74f
--- /dev/null
+++ b/packages/db/package.json
@@ -0,0 +1,24 @@
+{
+  "name": "@codra/db",
+  "version": "0.9.4",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./client": "./src/client.ts",
+    "./repositories": "./src/repositories/index.ts",
+    "./env": "./src/env.ts",
+    "./jobs": "./src/jobs.ts",
+    "./file-reviews": "./src/file-reviews.ts",
+    "./test/fakes": "./test/fakes/index.ts",
+    "./*": "./src/*.ts"
+  },
+  "scripts": {
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@codra/schema": "*",
+    "postgres": "^3.4.9"
+  }
+}
diff --git a/scripts/migrate-env.mjs b/packages/db/scripts/migrate-env.mjs
similarity index 97%
rename from scripts/migrate-env.mjs
rename to packages/db/scripts/migrate-env.mjs
index c7018f2c..575f5d71 100644
--- a/scripts/migrate-env.mjs
+++ b/packages/db/scripts/migrate-env.mjs
@@ -2,7 +2,7 @@ import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
 
 export function parseEnvValue(value) {
   const trimmed = value.trim();
diff --git a/scripts/migrate-sql-split.mjs b/packages/db/scripts/migrate-sql-split.mjs
similarity index 100%
rename from scripts/migrate-sql-split.mjs
rename to packages/db/scripts/migrate-sql-split.mjs
diff --git a/scripts/migrate.mjs b/packages/db/scripts/migrate.mjs
similarity index 99%
rename from scripts/migrate.mjs
rename to packages/db/scripts/migrate.mjs
index 10da3eb2..0553afac 100644
--- a/scripts/migrate.mjs
+++ b/packages/db/scripts/migrate.mjs
@@ -6,7 +6,7 @@ import { readDatabaseUrlFromEnvFiles } from './migrate-env.mjs';
 import { splitSqlStatements } from './migrate-sql-split.mjs';
 
 const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const migrationsDir = path.join(rootDir, 'db', 'migrations');
+const migrationsDir = path.join(rootDir, 'migrations');
 const migrationLockId = 93741624;
 const kimiK25Model = '@cf/moonshotai/kimi-k2.5';
 const kimiK26Model = '@cf/moonshotai/kimi-k2.6';
diff --git a/src/server/db/accounts.ts b/packages/db/src/accounts.ts
similarity index 95%
rename from src/server/db/accounts.ts
rename to packages/db/src/accounts.ts
index 849a508e..a9e34185 100644
--- a/src/server/db/accounts.ts
+++ b/packages/db/src/accounts.ts
@@ -1,4 +1,4 @@
-import type { AppBindings } from '@server/env';
+import type { DbEnv } from './env';
 import { queryRows } from './client';
 
 // Durable account record (see db/migrations/004_account_settings.sql).
@@ -44,7 +44,7 @@ function mapRow(row: Row): AccountSettingsRecord {
 }
 
 export async function upsertAccountSettings(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   input: AccountSettingsInput,
 ): Promise<AccountSettingsRecord> {
   const rows = await queryRows<Row>(
@@ -64,7 +64,7 @@ export async function upsertAccountSettings(
 }
 
 export async function getAccountSettings(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   githubUserId: number,
 ): Promise<AccountSettingsRecord | null> {
   const rows = await queryRows<Row>(
@@ -77,7 +77,7 @@ export async function getAccountSettings(
 
 // Only keys present in `patch` are written, so one field can't clobber the other; `timezone: null` is a meaningful value ("follow the browser"), hence the `!== undefined` checks.
 export async function updateAccountSettings(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   githubUserId: number,
   patch: { accountName?: string; timezone?: string | null },
 ): Promise<AccountSettingsRecord | null> {
diff --git a/src/server/db/app-settings.ts b/packages/db/src/app-settings.ts
similarity index 85%
rename from src/server/db/app-settings.ts
rename to packages/db/src/app-settings.ts
index b4c500c6..d2785f06 100644
--- a/src/server/db/app-settings.ts
+++ b/packages/db/src/app-settings.ts
@@ -1,6 +1,5 @@
-import type { AppBindings } from '@server/env';
+import type { DbEnv } from './env';
 import { queryRows } from './client';
-import { logger } from '@server/core/logger';
 import { reviewConcurrencyLevels, reviewMaxCommentsOptions, reviewMaxFilesRange, reviewSettingsSchema, type ReviewSettings } from '@codra/schema';
 
 const CONCURRENCY_KEY = 'review_concurrency_level';
@@ -11,7 +10,7 @@ const DEFAULT_REVIEW_SETTINGS: ReviewSettings = reviewSettingsSchema.parse({});
 const CONCURRENCY_LEVELS = new Set<string>(reviewConcurrencyLevels);
 const MAX_COMMENTS_OPTIONS = new Set<number>(reviewMaxCommentsOptions);
 
-export async function getReviewSettings(env: Pick<AppBindings, 'HYPERDRIVE'>): Promise<ReviewSettings> {
+export async function getReviewSettings(env: DbEnv): Promise<ReviewSettings> {
   try {
     const rows = await queryRows<{ key: string; value: string }>(
       env,
@@ -38,14 +37,14 @@ export async function getReviewSettings(env: Pick<AppBindings, 'HYPERDRIVE'>): P
         : DEFAULT_REVIEW_SETTINGS.maxFiles,
     });
   } catch (error) {
-    logger.warn('Failed to load review settings, using defaults', {
+    console.warn('Failed to load review settings, using defaults', {
       error: error instanceof Error ? error.message : String(error),
     });
     return DEFAULT_REVIEW_SETTINGS;
   }
 }
 
-export async function updateReviewSettings(env: Pick<AppBindings, 'HYPERDRIVE'>, settings: ReviewSettings): Promise<void> {
+export async function updateReviewSettings(env: DbEnv, settings: ReviewSettings): Promise<void> {
   await queryRows(
     env,
     `INSERT INTO global_settings (key, value) VALUES ($1, $2), ($3, $4), ($5, $6)
diff --git a/src/server/db/client.ts b/packages/db/src/client.ts
similarity index 97%
rename from src/server/db/client.ts
rename to packages/db/src/client.ts
index 41547b6c..5ad3299c 100644
--- a/src/server/db/client.ts
+++ b/packages/db/src/client.ts
@@ -1,8 +1,7 @@
+import type { DbEnv } from './env';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import postgres from 'postgres';
-import type { AppBindings } from '@server/env';
 
-type DbEnv = Pick<AppBindings, 'HYPERDRIVE'>;
 type DbClient = {
   query<T>(sqlText: string, params?: unknown[]): Promise<T[]>;
   transaction<T>(fn: (tx: DbClient) => Promise<T>): Promise<T>;
@@ -104,7 +103,7 @@ async function withStaleConnectionRecovery<T>(env: DbEnv, op: (db: DbClient) =>
   try {
     return await op(getDb(env));
   } catch (error) {
-    if (inScope || !isStaleConnectionError(error)) throw error;
+    if (env.workerMode === false || inScope || !isStaleConnectionError(error)) throw error;
 
     const connectionString = env.HYPERDRIVE.connectionString;
     fallbackClients.delete(connectionString);
diff --git a/src/server/db/comment-feedback.ts b/packages/db/src/comment-feedback.ts
similarity index 92%
rename from src/server/db/comment-feedback.ts
rename to packages/db/src/comment-feedback.ts
index f6eac0d1..e7f5ee6e 100644
--- a/src/server/db/comment-feedback.ts
+++ b/packages/db/src/comment-feedback.ts
@@ -1,4 +1,5 @@
-import type { AppBindings } from '@server/env';
+import type { DbEnv } from './env';
+
 import { queryRows } from './client';
 
 // 'deleted' and 'marked_wrong' are the negative signals; 'resolved' and 'marked_right' are MEASUREMENT only, since suppressing on them would train the system to stop reporting findings that worked.
@@ -18,7 +19,7 @@ export type CommentFeedbackInput = {
 
 // Keyed by fingerprint, not review_comments.id: those rows are deleted and re-inserted on every re-review, so their ids anchor nothing long-lived.
 export async function recordCommentFeedback(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   entries: CommentFeedbackInput[],
 ): Promise<number> {
   if (entries.length === 0) return 0;
@@ -47,7 +48,7 @@ export async function recordCommentFeedback(
 
 // Targets the partial index on `(repository_id, fingerprint) WHERE source = 'dashboard'`, making a flip an UPDATE rather than two contradictory rows.
 export async function upsertDashboardFeedback(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   input: {
     repositoryId: number;
     prNumber: number | null;
@@ -84,7 +85,7 @@ export async function upsertDashboardFeedback(
 
 // Scoped to `source = 'dashboard'`: a webhook-sourced row is ground truth from GitHub and must not be erasable here.
 export async function clearDashboardFeedback(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   repositoryId: number,
   fingerprint: string,
 ): Promise<void> {
@@ -98,7 +99,7 @@ export async function clearDashboardFeedback(
 
 // Prevents a resolve -> unresolve round trip from leaving the finding permanently recorded as accepted.
 export async function clearResolvedFeedback(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   repositoryId: number,
   githubCommentIds: number[],
 ): Promise<void> {
diff --git a/packages/db/src/env.ts b/packages/db/src/env.ts
new file mode 100644
index 00000000..1ba3240c
--- /dev/null
+++ b/packages/db/src/env.ts
@@ -0,0 +1,9 @@
+export type DbEnv = {
+  workerMode?: boolean;
+  HYPERDRIVE: { connectionString: string };
+  APP_KV: {
+    put(key: string, value: string, options?: { expirationTtl?: number }): Promise<void>;
+    get(key: string): Promise<string | null>;
+    delete(key: string): Promise<void>;
+  };
+};
diff --git a/src/server/db/file-reviews-bulk.ts b/packages/db/src/file-reviews-bulk.ts
similarity index 98%
rename from src/server/db/file-reviews-bulk.ts
rename to packages/db/src/file-reviews-bulk.ts
index ac4fb978..177e7310 100644
--- a/src/server/db/file-reviews-bulk.ts
+++ b/packages/db/src/file-reviews-bulk.ts
@@ -1,5 +1,5 @@
+import type { DbEnv } from './env';
 import type { BulkFileReviewInput } from '@codra/core/ports';
-import type { AppBindings } from '@server/env';
 import { queryRows, queryTransaction } from './client';
 import {
   REVIEW_COMMENT_INSERT_CASTS,
@@ -9,7 +9,7 @@ import {
 
 // `filePaths` must already be filtered to inheritable files with no row yet in the target job.
 export async function bulkInheritFileReviews(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   input: { jobId: string; parentJobId: string; filePaths: string[] },
 ): Promise<string[]> {
   if (input.filePaths.length === 0) return [];
@@ -69,7 +69,7 @@ export type { BulkFileReviewInput } from '@codra/core/ports';
 
 // One transaction: per-file upserts would spend the saved model calls back on DB subrequests. `diff_input` is not written (migration 003 nulls it).
 export async function bulkUpsertFileReviews(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   jobId: string,
   inputs: BulkFileReviewInput[],
 ): Promise<void> {
@@ -163,7 +163,7 @@ export async function bulkUpsertFileReviews(
 
 // One statement, returning each file's new attempt count so the caller can fail exhausted ones.
 export async function bulkRecordRetryableFileReviewFailures(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   jobId: string,
   inputs: Array<{ filePath: string; modelUsed: string; diffLineCount: number; errorMessage: string }>,
   // False when the model chain advanced: the retry resumes at the next model, so this deferral is
@@ -220,7 +220,7 @@ export async function bulkRecordRetryableFileReviewFailures(
 
 // One INSERT, so finalize's backfill cannot blow the subrequest budget right before posting; `ON CONFLICT DO NOTHING` so it never clobbers a real review.
 export async function bulkMarkFilesFailed(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   jobId: string,
   files: Array<{ filePath: string; diffLineCount: number }>,
   opts: { modelUsed: string; errorMessage: string },
diff --git a/src/server/db/file-reviews-findings.ts b/packages/db/src/file-reviews-findings.ts
similarity index 95%
rename from src/server/db/file-reviews-findings.ts
rename to packages/db/src/file-reviews-findings.ts
index b78f4996..2d794d6d 100644
--- a/src/server/db/file-reviews-findings.ts
+++ b/packages/db/src/file-reviews-findings.ts
@@ -1,5 +1,5 @@
+import type { DbEnv } from './env';
 import type { SuppressedFinding } from '@codra/core/ports';
-import type { AppBindings } from '@server/env';
 import { queryRows } from './client';
 
 // Part of the FileReviewStore port contract; @codra/core/ports owns it and this module re-exports.
@@ -8,7 +8,7 @@ export type { SuppressedFinding } from '@codra/core/ports';
 // Findings already posted on an EARLIER commit with the anchored line unchanged, or rejected by a human anywhere in this repository.
 // `j.commit_sha <> me.commit_sha` is load-bearing: retries and mention-triggered re-reviews reuse the SAME head commit.
 export async function getSuppressedFindings(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   jobId: string,
 ): Promise<SuppressedFinding[]> {
   return queryRows<SuppressedFinding>(
@@ -47,7 +47,7 @@ export async function getSuppressedFindings(
 
 // Job scoping is the authorization boundary, not a convenience: a label writes a REPOSITORY-WIDE suppression.
 export async function getFindingLabelTarget(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   jobId: string,
   fingerprint: string,
 ): Promise<{ repository_id: number; pr_number: number | null; anchor_hash: string | null; fingerprint_v2: string | null } | null> {
@@ -68,7 +68,7 @@ export async function getFindingLabelTarget(
 
 // Only fingerprints GitHub genuinely accepted: marking a silently dropped one posted would hide it forever.
 export async function markCommentsPosted(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   jobId: string,
   fingerprints: string[],
 ): Promise<void> {
@@ -89,7 +89,7 @@ export async function markCommentsPosted(
 
 // `posted = false` alone conflates the severity/confidence gates, suppression, dedupe, the verifier, and the max_comments cap, so attribution must be recorded where the decision is made.
 export async function markCommentDispositions(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   jobId: string,
   byFingerprint: Map<string, { disposition: string | null; reason: string | null }>,
 ): Promise<void> {
diff --git a/src/server/db/file-reviews.ts b/packages/db/src/file-reviews.ts
similarity index 93%
rename from src/server/db/file-reviews.ts
rename to packages/db/src/file-reviews.ts
index 1e5b485d..9d38849b 100644
--- a/src/server/db/file-reviews.ts
+++ b/packages/db/src/file-reviews.ts
@@ -1,5 +1,6 @@
+import type { DbEnv } from './env';
 import type { ParsedReviewComment } from '@codra/schema';
-import type { AppBindings } from '@server/env';
+
 import { parseJsonColumn, queryRows, queryTransaction } from './client';
 import {
   REVIEW_COMMENT_INSERT_CASTS,
@@ -40,7 +41,7 @@ export {
 };
 
 export async function upsertFileReview(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   jobId: string,
   input: {
     filePath: string;
@@ -153,7 +154,7 @@ export async function upsertFileReview(
 }
 
 export async function recordRetryableFileReviewFailure(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   jobId: string,
   input: {
     filePath: string;
@@ -229,7 +230,7 @@ export async function recordRetryableFileReviewFailure(
 }
 
 
-export async function getModelUsageStats(env: Pick<AppBindings, 'HYPERDRIVE'>, days: number) {
+export async function getModelUsageStats(env: DbEnv, days: number) {
   return queryRows<{
     model_used: string;
     model_provider: string | null;
@@ -255,7 +256,7 @@ export async function getModelUsageStats(env: Pick<AppBindings, 'HYPERDRIVE'>, d
   );
 }
 
-export async function getFileReviewsForJobs(env: Pick<AppBindings, 'HYPERDRIVE'>, jobIds: string[]) {
+export async function getFileReviewsForJobs(env: DbEnv, jobIds: string[]) {
   if (jobIds.length === 0) return [];
 
   const rows = await queryRows<{
diff --git a/src/server/db/jobs-activity.ts b/packages/db/src/jobs-activity.ts
similarity index 82%
rename from src/server/db/jobs-activity.ts
rename to packages/db/src/jobs-activity.ts
index 47c67183..b585df02 100644
--- a/src/server/db/jobs-activity.ts
+++ b/packages/db/src/jobs-activity.ts
@@ -1,9 +1,9 @@
-import type { AppBindings } from '@server/env';
+import type { DbEnv } from './env';
 
 // Import from db/jobs.ts, not here. Holds the KV "is anything running" flag the maintenance loop reads to decide whether it can skip the DB and let Postgres suspend.
 // Kept as a leaf, not in the barrel, because jobs-leases.ts and jobs-lifecycle.ts both write this flag and jobs.ts imports both, which would otherwise create an import cycle.
 
-export async function markSystemActive(env: Pick<AppBindings, 'APP_KV'>) {
+export async function markSystemActive(env: DbEnv) {
   try {
     // claimJobLease() calls this on every review chunk; read first and only write when missing, since a large PR's dozens of chunks otherwise blow the Workers-Free daily KV write quota.
     const existing = await env.APP_KV.get('system:active_jobs');
@@ -14,7 +14,7 @@ export async function markSystemActive(env: Pick<AppBindings, 'APP_KV'>) {
   }
 }
 
-export async function clearSystemActive(env: Pick<AppBindings, 'APP_KV'>) {
+export async function clearSystemActive(env: DbEnv) {
   try {
     await env.APP_KV.delete('system:active_jobs');
   } catch (error) {
diff --git a/src/server/db/jobs-leases.ts b/packages/db/src/jobs-leases.ts
similarity index 91%
rename from src/server/db/jobs-leases.ts
rename to packages/db/src/jobs-leases.ts
index f1e9d832..75e85744 100644
--- a/src/server/db/jobs-leases.ts
+++ b/packages/db/src/jobs-leases.ts
@@ -1,4 +1,4 @@
-import type { AppBindings } from '@server/env';
+import type { DbEnv } from './env';
 import { queryRows } from './client';
 import type { JobRow } from './jobs-mapping';
 import { markSystemActive } from './jobs-activity';
@@ -6,7 +6,7 @@ import { markSystemActive } from './jobs-activity';
 // Import from db/jobs.ts, not here.
 
 // Lives here rather than with the other read queries because claimJobLease is its main caller; keeping it in the barrel would make jobs.ts <-> jobs-leases.ts an import cycle.
-export async function getJobForProcessing(env: Pick<AppBindings, 'HYPERDRIVE'>, jobId: string) {
+export async function getJobForProcessing(env: DbEnv, jobId: string) {
   if (!jobId || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(jobId)) {
     return null;
   }
@@ -32,7 +32,7 @@ export type JobLeaseClaim =
   | { status: 'missing' };
 
 export async function claimJobLease(
-  env: Pick<AppBindings, 'HYPERDRIVE' | 'APP_KV'>,
+  env: Pick<DbEnv, 'HYPERDRIVE' | 'APP_KV'>,
   jobId: string,
   leaseOwner: string,
   leaseSeconds: number,
@@ -96,7 +96,7 @@ export async function claimJobLease(
 }
 
 export async function heartbeatJobLease(
-  env: Pick<AppBindings, 'HYPERDRIVE' | 'APP_KV'>,
+  env: Pick<DbEnv, 'HYPERDRIVE' | 'APP_KV'>,
   jobId: string,
   leaseOwner: string,
   leaseSeconds: number,
@@ -116,7 +116,7 @@ export async function heartbeatJobLease(
   await markSystemActive(env);
 }
 
-export async function releaseJobLease(env: Pick<AppBindings, 'HYPERDRIVE'>, jobId: string, leaseOwner: string) {
+export async function releaseJobLease(env: DbEnv, jobId: string, leaseOwner: string) {
   await queryRows(
     env,
     `
@@ -131,7 +131,7 @@ export async function releaseJobLease(env: Pick<AppBindings, 'HYPERDRIVE'>, jobI
 }
 
 // Bumps the no-progress continuation counter for a job rescheduling the same phase; cleared by resetJobContinuationCount() whenever a chunk completes a file, so a stuck job climbs toward MAX_JOB_CONTINUATIONS.
-export async function markJobContinuationQueued(env: Pick<AppBindings, 'HYPERDRIVE'>, jobId: string, delaySeconds = 0) {
+export async function markJobContinuationQueued(env: DbEnv, jobId: string, delaySeconds = 0) {
   const rows = await queryRows<{ continuation_count: number }>(
     env,
     `
@@ -153,7 +153,7 @@ export async function markJobContinuationQueued(env: Pick<AppBindings, 'HYPERDRI
 
 // Clears the no-progress continuation counter after a chunk completes at least one file review,
 // so slow-but-progressing jobs never trip the MAX_JOB_CONTINUATIONS safety net.
-export async function resetJobContinuationCount(env: Pick<AppBindings, 'HYPERDRIVE'>, jobId: string) {
+export async function resetJobContinuationCount(env: DbEnv, jobId: string) {
   await queryRows(
     env,
     `
@@ -171,7 +171,7 @@ export async function resetJobContinuationCount(env: Pick<AppBindings, 'HYPERDRI
 // table; tests pass their own job so the LIMIT 25 window and FOR UPDATE SKIP LOCKED cannot hand the
 // slot to an unrelated stale 'running' row inserted by a suite running in a parallel worker.
 export async function recoverExpiredJobLeases(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   maxRecoveryCount = 3,
   unleasedGraceSeconds = 300,
   onlyJobIds?: readonly string[] | null,
@@ -275,7 +275,7 @@ export async function recoverExpiredJobLeases(
   };
 }
 
-export async function getOtherRunningJobsCount(env: Pick<import('@server/env').AppBindings, 'HYPERDRIVE'>, excludeJobId: string): Promise<number> {
+export async function getOtherRunningJobsCount(env: DbEnv, excludeJobId: string): Promise<number> {
   const [result] = await queryRows<{ count: string }>(
     env,
     `SELECT count(*) as count FROM jobs WHERE status = 'running' AND id != $1`,
diff --git a/src/server/db/jobs-lifecycle.ts b/packages/db/src/jobs-lifecycle.ts
similarity index 89%
rename from src/server/db/jobs-lifecycle.ts
rename to packages/db/src/jobs-lifecycle.ts
index 7f8a455d..9e32c124 100644
--- a/src/server/db/jobs-lifecycle.ts
+++ b/packages/db/src/jobs-lifecycle.ts
@@ -1,11 +1,11 @@
-import type { AppBindings } from '@server/env';
+import type { DbEnv } from './env';
 import { queryRows } from './client';
 import type { JobRow } from './jobs-mapping';
 import { markSystemActive } from './jobs-activity';
 
 // Import from db/jobs.ts, not from here.
 
-export async function updateJobCheckRun(env: Pick<AppBindings, 'HYPERDRIVE'>, jobId: string, checkRunId: number) {
+export async function updateJobCheckRun(env: DbEnv, jobId: string, checkRunId: number) {
   await queryRows(
     env,
     `
@@ -18,7 +18,7 @@ export async function updateJobCheckRun(env: Pick<AppBindings, 'HYPERDRIVE'>, jo
 }
 
 export async function completeJob(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   jobId: string,
   input: {
     verdict: 'approve' | 'comment';
@@ -93,7 +93,7 @@ export async function completeJob(
   );
 }
 
-export async function failJob(env: Pick<AppBindings, 'HYPERDRIVE' | 'APP_KV'>, jobId: string, errorMessage: string) {
+export async function failJob(env: Pick<DbEnv, 'HYPERDRIVE' | 'APP_KV'>, jobId: string, errorMessage: string) {
   await queryRows(
     env,
     `
@@ -123,7 +123,7 @@ export async function failJob(env: Pick<AppBindings, 'HYPERDRIVE' | 'APP_KV'>, j
 }
 
 // Clears the lease so recovery won't requeue it. Returns false if already terminal; caller must terminate the Cloudflare Workflow instance separately.
-export async function cancelJob(env: Pick<AppBindings, 'HYPERDRIVE' | 'APP_KV'>, jobId: string): Promise<boolean> {
+export async function cancelJob(env: Pick<DbEnv, 'HYPERDRIVE' | 'APP_KV'>, jobId: string): Promise<boolean> {
   const rows = await queryRows<{ id: string }>(
     env,
     `
@@ -156,7 +156,7 @@ export async function cancelJob(env: Pick<AppBindings, 'HYPERDRIVE' | 'APP_KV'>,
 }
 
 // file_reviews/review_comments cascade automatically; child retry jobs have retry_of_job_id nulled instead of being deleted.
-export async function deleteJob(env: Pick<AppBindings, 'HYPERDRIVE'>, jobId: string): Promise<boolean> {
+export async function deleteJob(env: DbEnv, jobId: string): Promise<boolean> {
   const rows = await queryRows<{ id: string }>(
     env,
     `DELETE FROM jobs WHERE id = $1 RETURNING id`,
@@ -165,7 +165,7 @@ export async function deleteJob(env: Pick<AppBindings, 'HYPERDRIVE'>, jobId: str
   return rows.length > 0;
 }
 
-export async function markJobCheckRunCompleted(env: Pick<AppBindings, 'HYPERDRIVE'>, jobId: string) {
+export async function markJobCheckRunCompleted(env: DbEnv, jobId: string) {
   await queryRows(
     env,
     `
@@ -177,7 +177,7 @@ export async function markJobCheckRunCompleted(env: Pick<AppBindings, 'HYPERDRIV
   );
 }
 
-export async function updateJobFileCount(env: Pick<AppBindings, 'HYPERDRIVE'>, jobId: string, fileCount: number) {
+export async function updateJobFileCount(env: DbEnv, jobId: string, fileCount: number) {
   await queryRows(
     env,
     `
@@ -189,7 +189,7 @@ export async function updateJobFileCount(env: Pick<AppBindings, 'HYPERDRIVE'>, j
   );
 }
 
-export async function completePreparationStep(env: Pick<AppBindings, 'HYPERDRIVE'>, jobId: string, fileCount: number) {
+export async function completePreparationStep(env: DbEnv, jobId: string, fileCount: number) {
   const now = new Date().toISOString();
   await queryRows(
     env,
@@ -212,7 +212,7 @@ export async function completePreparationStep(env: Pick<AppBindings, 'HYPERDRIVE
 }
 
 export async function updateJobStep(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   jobId: string,
   stepName: string,
   update: {
@@ -267,7 +267,7 @@ export async function updateJobStep(
 }
 
 export async function getTerminalJobsNeedingCheckRunCompletion(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   limit = 25,
 ) {
   return queryRows<JobRow>(
@@ -287,7 +287,7 @@ export async function getTerminalJobsNeedingCheckRunCompletion(
 }
 
 export async function supersedeOlderJobs(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   input: {
     installationId: string;
     owner: string;
diff --git a/src/server/db/jobs-mapping.ts b/packages/db/src/jobs-mapping.ts
similarity index 100%
rename from src/server/db/jobs-mapping.ts
rename to packages/db/src/jobs-mapping.ts
diff --git a/src/server/db/jobs.ts b/packages/db/src/jobs.ts
similarity index 94%
rename from src/server/db/jobs.ts
rename to packages/db/src/jobs.ts
index c2edcf95..9ac51aeb 100644
--- a/src/server/db/jobs.ts
+++ b/packages/db/src/jobs.ts
@@ -1,5 +1,5 @@
+import type { DbEnv } from './env';
 import { hexToBytes } from '@codra/schema/hex';
-import type { AppBindings } from '@server/env';
 import { parseJsonColumn, queryRows } from './client';
 import { defaultRepoConfig, jobDetailSchema, repoConfigSchema, type RepoConfig } from '@codra/schema';
 import { getOrCreateRepository } from './repositories';
@@ -11,7 +11,7 @@ type JobDetailRow = JobRow & {
   files_json: unknown[] | string | null;
 };
 
-export async function setJobWorkflowInstance(env: Pick<AppBindings, 'HYPERDRIVE'>, jobId: string, workflowInstanceId: string) {
+export async function setJobWorkflowInstance(env: DbEnv, jobId: string, workflowInstanceId: string) {
   await queryRows(
     env,
     `
@@ -25,7 +25,7 @@ export async function setJobWorkflowInstance(env: Pick<AppBindings, 'HYPERDRIVE'
 
 // Values are snapshotted at job-creation time (and copied verbatim onto retries), so without this a title edited on GitHub afterward would keep showing stale on the dashboard.
 export async function setJobPullRequestMeta(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   jobId: string,
   meta: { prTitle: string | null; prAuthor: string | null },
 ) {
@@ -42,7 +42,7 @@ export async function setJobPullRequestMeta(
 }
 
 // False lets the cron clear `system:active_jobs` so later ticks skip the DB and serverless Postgres can suspend.
-export async function hasPendingMaintenanceWork(env: Pick<AppBindings, 'HYPERDRIVE'>): Promise<boolean> {
+export async function hasPendingMaintenanceWork(env: DbEnv): Promise<boolean> {
   const rows = await queryRows<{ has_work: boolean }>(
     env,
     `
@@ -57,7 +57,7 @@ export async function hasPendingMaintenanceWork(env: Pick<AppBindings, 'HYPERDRI
 }
 
 export async function insertJob(
-  env: Pick<AppBindings, 'HYPERDRIVE' | 'APP_KV'>,
+  env: Pick<DbEnv, 'HYPERDRIVE' | 'APP_KV'>,
   input: {
     installationId: string;
     owner: string;
@@ -125,7 +125,7 @@ export async function insertJob(
 }
 
 export async function listJobs(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   query: {
     owner?: string;
     repo?: string;
@@ -203,7 +203,12 @@ export async function listJobs(
   };
 }
 
-export async function getJobDetail(env: Pick<AppBindings, 'HYPERDRIVE'>, jobId: string) {
+export async function getJob(env: DbEnv, jobId: string): Promise<JobRow | null> {
+  const [row] = await queryRows<JobRow>(env, `SELECT * FROM jobs WHERE id = $1`, [jobId]);
+  return row ?? null;
+}
+
+export async function getJobDetail(env: DbEnv, jobId: string) {
   if (!jobId || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(jobId)) {
     return null;
   }
@@ -293,7 +298,7 @@ export async function getJobDetail(env: Pick<AppBindings, 'HYPERDRIVE'>, jobId:
 }
 
 export async function findExistingJobForHead(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   input: { owner: string; repo: string; prNumber: number; commitSha: string; trigger: 'auto' | 'mention' },
 ) {
   const [row] = await queryRows<JobRow>(
diff --git a/src/server/db/learning.ts b/packages/db/src/learning.ts
similarity index 93%
rename from src/server/db/learning.ts
rename to packages/db/src/learning.ts
index f697cf11..ebd346cd 100644
--- a/src/server/db/learning.ts
+++ b/packages/db/src/learning.ts
@@ -1,4 +1,4 @@
-import type { AppBindings } from '@server/env';
+import type { DbEnv } from './env';
 import { queryRows } from './client';
 import type { ClaimType } from '@codra/schema';
 
@@ -14,7 +14,7 @@ export type RejectedExemplar = {
 
 // Findings a human rejected, injected as negative few-shot exemplars: retrieval measurably improves small models here (F1 36.35 -> 74.05 at 20 shots). Claim-type-keyed since there's no vector store.
 export async function getRejectedExemplars(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   input: { repositoryId: number; claimTypes?: readonly ClaimType[]; limit?: number },
 ): Promise<RejectedExemplar[]> {
   const limit = Math.min(input.limit ?? 5, 20);
@@ -42,7 +42,7 @@ export async function getRejectedExemplars(
 
 // Exemplars are repository-scoped -- what one team rejects isn't evidence about another.
 export async function getRepositoryIdForJob(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   jobId: string,
 ): Promise<number | null> {
   const [row] = await queryRows<{ repository_id: number }>(
diff --git a/src/server/db/model-configs.ts b/packages/db/src/model-configs.ts
similarity index 85%
rename from src/server/db/model-configs.ts
rename to packages/db/src/model-configs.ts
index 405eaa86..50f74e92 100644
--- a/src/server/db/model-configs.ts
+++ b/packages/db/src/model-configs.ts
@@ -1,4 +1,5 @@
-import type { AppBindings } from '@server/env';
+import type { DbEnv } from './env';
+
 import { queryRows } from './client';
 import {
   KIMI_K2_5_MODEL,
@@ -7,8 +8,12 @@ import {
   type LlmApiFormat,
   type LlmProvider,
   type ModelConfig,
+  type ResolvedModelConfig,
+  type LlmProviderSecret,
 } from '@codra/schema';
 
+export type { ResolvedModelConfig, LlmProviderSecret };
+
 type ProviderRow = {
   id: string;
   name: string;
@@ -29,15 +34,7 @@ type ModelConfigRow = {
   updated_at: string;
 };
 
-export type LlmProviderSecret = LlmProvider & {
-  encryptedApiKey: string | null;
-};
 
-export type ResolvedModelConfig = ModelConfig & {
-  providerEnabled: boolean;
-  baseUrl: string | null;
-  encryptedApiKey: string | null;
-};
 
 function mapProvider(row: ProviderRow): LlmProvider {
   return llmProviderSchema.parse({
@@ -85,7 +82,7 @@ const MODEL_SELECT = `
   JOIN llm_providers p ON p.id = mc.provider_id
 `;
 
-export async function listLlmProviders(env: Pick<AppBindings, 'HYPERDRIVE'>): Promise<LlmProvider[]> {
+export async function listLlmProviders(env: DbEnv): Promise<LlmProvider[]> {
   const rows = await queryRows<ProviderRow>(
     env,
     `SELECT ${PROVIDER_COLUMNS} FROM llm_providers ORDER BY name ASC`,
@@ -93,7 +90,7 @@ export async function listLlmProviders(env: Pick<AppBindings, 'HYPERDRIVE'>): Pr
   return rows.map(mapProvider);
 }
 
-export async function listLlmProviderSecrets(env: Pick<AppBindings, 'HYPERDRIVE'>): Promise<LlmProviderSecret[]> {
+export async function listLlmProviderSecrets(env: DbEnv): Promise<LlmProviderSecret[]> {
   const rows = await queryRows<ProviderRow>(
     env,
     `SELECT ${PROVIDER_COLUMNS} FROM llm_providers ORDER BY name ASC`,
@@ -101,7 +98,7 @@ export async function listLlmProviderSecrets(env: Pick<AppBindings, 'HYPERDRIVE'
   return rows.map(mapProviderSecret);
 }
 
-export async function getLlmProvider(env: Pick<AppBindings, 'HYPERDRIVE'>, id: string): Promise<LlmProviderSecret | null> {
+export async function getLlmProvider(env: DbEnv, id: string): Promise<LlmProviderSecret | null> {
   const [row] = await queryRows<ProviderRow>(
     env,
     `SELECT ${PROVIDER_COLUMNS} FROM llm_providers WHERE id = $1`,
@@ -111,7 +108,7 @@ export async function getLlmProvider(env: Pick<AppBindings, 'HYPERDRIVE'>, id: s
 }
 
 export async function createLlmProvider(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   input: {
     name: string;
     apiFormat: LlmApiFormat;
@@ -132,7 +129,7 @@ export async function createLlmProvider(
   return mapProvider(row);
 }
 
-export async function findLlmProviderByName(env: Pick<AppBindings, 'HYPERDRIVE'>, name: string): Promise<LlmProvider | null> {
+export async function findLlmProviderByName(env: DbEnv, name: string): Promise<LlmProvider | null> {
   const [row] = await queryRows<ProviderRow>(
     env,
     `SELECT ${PROVIDER_COLUMNS} FROM llm_providers WHERE lower(name) = lower($1)`,
@@ -142,7 +139,7 @@ export async function findLlmProviderByName(env: Pick<AppBindings, 'HYPERDRIVE'>
 }
 
 export async function updateLlmProvider(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   id: string,
   input: {
     name: string;
@@ -178,7 +175,7 @@ export async function updateLlmProvider(
   return row ? mapProvider(row) : null;
 }
 
-export async function deleteLlmProvider(env: Pick<AppBindings, 'HYPERDRIVE'>, id: string) {
+export async function deleteLlmProvider(env: DbEnv, id: string) {
   const [{ count }] = await queryRows<{ count: string }>(
     env,
     `SELECT COUNT(*)::text AS count FROM model_configs WHERE provider_id = $1`,
@@ -196,7 +193,7 @@ export async function deleteLlmProvider(env: Pick<AppBindings, 'HYPERDRIVE'>, id
   return { deleted: rows.length > 0, reason: null };
 }
 
-export async function listModelConfigs(env: Pick<AppBindings, 'HYPERDRIVE'>): Promise<ModelConfig[]> {
+export async function listModelConfigs(env: DbEnv): Promise<ModelConfig[]> {
   const rows = await queryRows<ModelConfigRow>(
     env,
     `${MODEL_SELECT}
@@ -208,7 +205,7 @@ export async function listModelConfigs(env: Pick<AppBindings, 'HYPERDRIVE'>): Pr
 }
 
 export async function getResolvedModelConfig(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   modelId: string,
 ): Promise<ResolvedModelConfig | null> {
   const [row] = await queryRows<ModelConfigRow & {
@@ -245,7 +242,7 @@ export async function getResolvedModelConfig(
 }
 
 export async function updateModelConfig(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   config: Omit<ModelConfig, 'updatedAt' | 'providerName' | 'apiFormat'>,
 ) {
   const [row] = await queryRows<ModelConfigRow>(
@@ -288,7 +285,7 @@ function slugify(value: string) {
 }
 
 export async function upsertDiscoveredModelConfigs(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   input: {
     providerId: string;
     providerName: string;
@@ -388,7 +385,7 @@ export async function upsertDiscoveredModelConfigs(
   return rows.map(mapModelConfig);
 }
 
-export async function deleteModelConfig(env: Pick<AppBindings, 'HYPERDRIVE'>, modelId: string) {
+export async function deleteModelConfig(env: DbEnv, modelId: string) {
   const rows = await queryRows<{ model_id: string }>(
     env,
     `DELETE FROM model_configs WHERE model_id = $1 RETURNING model_id`,
diff --git a/src/server/db/repo-configs.ts b/packages/db/src/repo-configs.ts
similarity index 89%
rename from src/server/db/repo-configs.ts
rename to packages/db/src/repo-configs.ts
index 8b9baba0..4c8d8034 100644
--- a/src/server/db/repo-configs.ts
+++ b/packages/db/src/repo-configs.ts
@@ -1,4 +1,5 @@
-import type { AppBindings } from '@server/env';
+import type { DbEnv } from './env';
+
 import { parseJsonColumn, queryRows } from './client';
 import { defaultRepoConfig, normalizeRepoConfig, repoConfigRecordSchema, repoConfigSchema, type RepoConfig } from '@codra/schema';
 import { getOrCreateRepository } from './repositories';
@@ -35,7 +36,7 @@ function mapRepo(row: RepoConfigRow) {
 }
 
 export async function upsertRepoConfig(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   input: {
     installationId: string;
     owner: string;
@@ -79,7 +80,7 @@ export async function upsertRepoConfig(
 
 // Only creates the record if missing, so an existing repo's model overrides are never overwritten.
 export async function syncRepoConfig(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   input: {
     installationId: string;
     owner: string;
@@ -104,7 +105,7 @@ export async function syncRepoConfig(
 }
 
 export async function deleteStaleRepoConfigs(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   installationId: string,
   activeRepoFullNames: string[]
 ) {
@@ -137,7 +138,7 @@ export async function deleteStaleRepoConfigs(
 }
 
 export async function updateRepoConfigEnabled(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   input: {
     owner: string;
     repo: string;
@@ -184,7 +185,7 @@ const REPO_CONFIG_SELECT = `
       ) lj ON true
 `;
 
-export async function listRepoConfigs(env: Pick<AppBindings, 'HYPERDRIVE'>) {
+export async function listRepoConfigs(env: DbEnv) {
   const rows = await queryRows<RepoConfigRow>(
     env,
     `
@@ -196,7 +197,7 @@ export async function listRepoConfigs(env: Pick<AppBindings, 'HYPERDRIVE'>) {
   return rows.map(mapRepo);
 }
 
-export async function getRepoConfigRecord(env: Pick<AppBindings, 'HYPERDRIVE'>, owner: string, repo: string) {
+export async function getRepoConfigRecord(env: DbEnv, owner: string, repo: string) {
   const [row] = await queryRows<RepoConfigRow>(
     env,
     `
diff --git a/src/server/db/repositories.ts b/packages/db/src/repositories.ts
similarity index 88%
rename from src/server/db/repositories.ts
rename to packages/db/src/repositories.ts
index 9c9bb079..e9cf716a 100644
--- a/src/server/db/repositories.ts
+++ b/packages/db/src/repositories.ts
@@ -1,4 +1,4 @@
-import type { AppBindings } from '@server/env';
+import type { DbEnv } from './env';
 import { queryRows } from './client';
 
 export type RepositoryRow = {
@@ -9,7 +9,7 @@ export type RepositoryRow = {
 };
 
 export async function getOrCreateRepository(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   input: { installationId: string; owner: string; repo: string }
 ): Promise<number> {
   const [row] = await queryRows<RepositoryRow>(
diff --git a/packages/db/src/repositories/file-review-repository.ts b/packages/db/src/repositories/file-review-repository.ts
new file mode 100644
index 00000000..d3c78dbd
--- /dev/null
+++ b/packages/db/src/repositories/file-review-repository.ts
@@ -0,0 +1,31 @@
+import type { FileReviewStore } from '@codra/core/ports';
+import type { DbEnv } from '../env';
+import {
+  bulkInheritFileReviews,
+  bulkMarkFilesFailed,
+  bulkRecordRetryableFileReviewFailures,
+  bulkUpsertFileReviews,
+  getFileReviewsForJobs,
+  getSuppressedFindings,
+  markCommentDispositions,
+  markCommentsPosted,
+  recordRetryableFileReviewFailure,
+  upsertFileReview,
+} from '../file-reviews';
+
+export function makeFileReviewStore(env: DbEnv): FileReviewStore {
+  return {
+    upsertFileReview: (jobId, input) => upsertFileReview(env, jobId, input),
+    recordRetryableFileReviewFailure: (jobId, input) => recordRetryableFileReviewFailure(env, jobId, input),
+    getFileReviewsForJobs: (jobIds) => getFileReviewsForJobs(env, jobIds),
+
+    bulkInheritFileReviews: (input) => bulkInheritFileReviews(env, input),
+    bulkUpsertFileReviews: (jobId, inputs) => bulkUpsertFileReviews(env, jobId, inputs),
+    bulkRecordRetryableFileReviewFailures: (jobId, inputs, opts) => bulkRecordRetryableFileReviewFailures(env, jobId, inputs, opts),
+    bulkMarkFilesFailed: (jobId, files, opts) => bulkMarkFilesFailed(env, jobId, files, opts),
+
+    getSuppressedFindings: (jobId) => getSuppressedFindings(env, jobId),
+    markCommentsPosted: (jobId, fingerprints) => markCommentsPosted(env, jobId, fingerprints),
+    markCommentDispositions: (jobId, byFingerprint) => markCommentDispositions(env, jobId, byFingerprint),
+  };
+}
diff --git a/packages/db/src/repositories/index.ts b/packages/db/src/repositories/index.ts
new file mode 100644
index 00000000..ed1e2823
--- /dev/null
+++ b/packages/db/src/repositories/index.ts
@@ -0,0 +1,5 @@
+export { makeJobStore } from './jobs-repository';
+export { makeFileReviewStore } from './file-review-repository';
+export { makeReviewSettingsReader, makeModelConfigReader, makeWebhookDeliveryReader, makeLearningStore } from './settings-repository';
+export { makeRepoConfigStore } from './repo-config-repository';
+export { makeInstanceIdStore } from './instance-id-repository';
diff --git a/packages/db/src/repositories/instance-id-repository.ts b/packages/db/src/repositories/instance-id-repository.ts
new file mode 100644
index 00000000..0a20800d
--- /dev/null
+++ b/packages/db/src/repositories/instance-id-repository.ts
@@ -0,0 +1,32 @@
+import type { InstanceIdStore } from '@codra/core/ports';
+import type { DbEnv } from '../env';
+import { queryRows } from '../client';
+
+const INSTANCE_ID_KEY = 'codra:instance_id';
+
+export function makeInstanceIdStore(env: DbEnv): InstanceIdStore {
+  return {
+    getOrCreateInstanceId: async () => {
+      try {
+        const rows = await queryRows<{ value: string }>(env, 'SELECT value FROM global_settings WHERE key = $1', [INSTANCE_ID_KEY]);
+        let instanceId = rows[0]?.value;
+
+        if (!instanceId) {
+          instanceId = crypto.randomUUID();
+          await queryRows(
+            env, 
+            'INSERT INTO global_settings (key, value) VALUES ($1, $2) ON CONFLICT (key) DO NOTHING', 
+            [INSTANCE_ID_KEY, instanceId]
+          );
+          // Fetch again in case another instance inserted it concurrently
+          const rowsAfter = await queryRows<{ value: string }>(env, 'SELECT value FROM global_settings WHERE key = $1', [INSTANCE_ID_KEY]);
+          instanceId = rowsAfter[0]?.value ?? instanceId;
+        }
+        return instanceId;
+      } catch (error) {
+        // Fallback so telemetry can still send, though it will count as a new "install" if the DB is failing.
+        return crypto.randomUUID();
+      }
+    }
+  };
+}
diff --git a/packages/db/src/repositories/jobs-repository.ts b/packages/db/src/repositories/jobs-repository.ts
new file mode 100644
index 00000000..d8e9ab15
--- /dev/null
+++ b/packages/db/src/repositories/jobs-repository.ts
@@ -0,0 +1,87 @@
+import type { JobLeaseClaim as CoreJobLeaseClaim, JobRow as CoreJobRow, JobStore, PersistedReviewJob } from '@codra/core/ports';
+import type { DbEnv } from '../env';
+import {
+  claimJobLease,
+  completeJob,
+  completePreparationStep,
+  failJob,
+  findExistingJobForHead,
+  getJobForProcessing,
+  getOtherRunningJobsCount,
+  heartbeatJobLease,
+  insertJob,
+  mapJob,
+  markJobCheckRunCompleted,
+  markJobContinuationQueued,
+  releaseJobLease,
+  resetJobContinuationCount,
+  setJobPullRequestMeta,
+  setJobWorkflowInstance,
+  supersedeOlderJobs,
+  updateJobCheckRun,
+  updateJobStep,
+  type JobRow,
+  recoverExpiredJobLeases,
+  getTerminalJobsNeedingCheckRunCompletion,
+  hasPendingMaintenanceWork,
+  clearSystemActive,
+} from '../jobs';
+
+// Pins PersistedReviewJob to what mapJob actually returns, in both directions. mapJob ends in
+// jobSummarySchema.parse(), so the two are already the same type -- this makes that a compile error
+// to break rather than something to notice later.
+type _PinPersistedReviewJob = ReturnType<typeof mapJob> extends PersistedReviewJob
+  ? PersistedReviewJob extends ReturnType<typeof mapJob> ? true : never
+  : never;
+const _pinPersistedReviewJob: _PinPersistedReviewJob = true;
+void _pinPersistedReviewJob;
+
+// JobLeaseClaim is the one port contract that stays hand-copied rather than re-exported: the db
+// version carries the FULL jobs row, which the engine must not see, so the two cannot be the same
+// type. This pins the part that matters -- the discriminant set and the extra `busy` field -- so
+// adding a fifth status on the db side is a compile error here rather than a silent fall-through in
+// the engine's claim ladder.
+type _PinLeaseStatuses = Awaited<ReturnType<typeof claimJobLease>>['status'] extends CoreJobLeaseClaim['status']
+  ? CoreJobLeaseClaim['status'] extends Awaited<ReturnType<typeof claimJobLease>>['status'] ? true : never
+  : never;
+const _pinLeaseStatuses: _PinLeaseStatuses = true;
+void _pinLeaseStatuses;
+
+type _PinBusyRetryField = Extract<Awaited<ReturnType<typeof claimJobLease>>, { status: 'busy' }>['retryAfterSeconds'] extends number ? true : never;
+const _pinBusyRetryField: _PinBusyRetryField = true;
+void _pinBusyRetryField;
+
+export function makeJobStore(env: DbEnv): JobStore {
+  return {
+    // The one cast in the extraction. The db row type flows INTO core's JobRow freely (it is an
+    // object-literal alias, so TS gives it an implicit index signature); only the return leg needs
+    // telling that a row core handed back is the same row it was given.
+    mapJob: (row: CoreJobRow) => mapJob(row as unknown as JobRow),
+
+    getJobForProcessing: (jobId) => getJobForProcessing(env, jobId),
+    claimJobLease: (jobId, leaseOwner, leaseSeconds) => claimJobLease(env, jobId, leaseOwner, leaseSeconds),
+    heartbeatJobLease: (jobId, leaseOwner, leaseSeconds) => heartbeatJobLease(env, jobId, leaseOwner, leaseSeconds),
+    releaseJobLease: (jobId, leaseOwner) => releaseJobLease(env, jobId, leaseOwner),
+    markJobContinuationQueued: (jobId, delaySeconds) => markJobContinuationQueued(env, jobId, delaySeconds),
+    resetJobContinuationCount: (jobId) => resetJobContinuationCount(env, jobId),
+    getOtherRunningJobsCount: (excludeJobId) => getOtherRunningJobsCount(env, excludeJobId),
+
+    setJobWorkflowInstance: (jobId, workflowInstanceId) => setJobWorkflowInstance(env, jobId, workflowInstanceId),
+    setJobPullRequestMeta: (jobId, meta) => setJobPullRequestMeta(env, jobId, meta),
+    insertJob: (input) => insertJob(env, input),
+    findExistingJobForHead: (input) => findExistingJobForHead(env, input),
+
+    updateJobCheckRun: (jobId, checkRunId) => updateJobCheckRun(env, jobId, checkRunId),
+    markJobCheckRunCompleted: (jobId) => markJobCheckRunCompleted(env, jobId),
+    completePreparationStep: (jobId, fileCount) => completePreparationStep(env, jobId, fileCount),
+    updateJobStep: (jobId, stepName, update) => updateJobStep(env, jobId, stepName, update),
+    completeJob: (jobId, input) => completeJob(env, jobId, input),
+    failJob: (jobId, errorMessage) => failJob(env, jobId, errorMessage),
+    supersedeOlderJobs: (input) => supersedeOlderJobs(env, input),
+
+    recoverExpiredJobLeases: (maxCount) => recoverExpiredJobLeases(env, maxCount),
+    getTerminalJobsNeedingCheckRunCompletion: (limit) => getTerminalJobsNeedingCheckRunCompletion(env, limit),
+    hasPendingMaintenanceWork: () => hasPendingMaintenanceWork(env),
+    clearSystemActive: () => clearSystemActive(env),
+  };
+}
diff --git a/packages/db/src/repositories/repo-config-repository.ts b/packages/db/src/repositories/repo-config-repository.ts
new file mode 100644
index 00000000..73adc242
--- /dev/null
+++ b/packages/db/src/repositories/repo-config-repository.ts
@@ -0,0 +1,10 @@
+import type { RepoConfigStore } from '@codra/core/ports';
+import type { DbEnv } from '../env';
+import { getRepoConfigRecord, syncRepoConfig } from '../repo-configs';
+
+export function makeRepoConfigStore(env: DbEnv): RepoConfigStore {
+  return {
+    getRepoConfigRecord: (owner, repo) => getRepoConfigRecord(env, owner, repo),
+    syncRepoConfig: (input) => syncRepoConfig(env, input),
+  };
+}
diff --git a/packages/db/src/repositories/settings-repository.ts b/packages/db/src/repositories/settings-repository.ts
new file mode 100644
index 00000000..2e5e29c2
--- /dev/null
+++ b/packages/db/src/repositories/settings-repository.ts
@@ -0,0 +1,30 @@
+import type { LearningStore, ModelConfigReader, ReviewSettingsReader, WebhookDeliveryReader } from '@codra/core/ports';
+import type { DbEnv } from '../env';
+import { getReviewSettings } from '../app-settings';
+import { getResolvedModelConfig } from '../model-configs';
+import { getWebhookDelivery } from '../webhook-deliveries';
+import { getRejectedExemplars, getRepositoryIdForJob } from '../learning';
+
+
+export function makeReviewSettingsReader(env: DbEnv): ReviewSettingsReader {
+  return { getReviewSettings: () => getReviewSettings(env) };
+}
+
+export function makeModelConfigReader(env: DbEnv): ModelConfigReader {
+  // Returns the full ResolvedModelConfig, which the narrower port type discards -- deliberately, so
+  // encryptedApiKey has no path into the engine.
+  return { getResolvedModelConfig: (modelId) => getResolvedModelConfig(env, modelId) };
+}
+
+export function makeWebhookDeliveryReader(env: DbEnv): WebhookDeliveryReader {
+  return { getWebhookDelivery: (deliveryId) => getWebhookDelivery(env, deliveryId) };
+}
+
+export function makeLearningStore(env: DbEnv): LearningStore {
+  return {
+    getRepositoryIdForJob: (jobId) => getRepositoryIdForJob(env, jobId),
+    getRejectedExemplars: (input) => getRejectedExemplars(env, input),
+  };
+}
+
+
diff --git a/src/server/db/review-comment-sql.ts b/packages/db/src/review-comment-sql.ts
similarity index 100%
rename from src/server/db/review-comment-sql.ts
rename to packages/db/src/review-comment-sql.ts
diff --git a/src/server/db/stats.ts b/packages/db/src/stats.ts
similarity index 98%
rename from src/server/db/stats.ts
rename to packages/db/src/stats.ts
index 82e535f1..25423c69 100644
--- a/src/server/db/stats.ts
+++ b/packages/db/src/stats.ts
@@ -1,5 +1,5 @@
+import type { DbEnv } from './env';
 import { isSupportedTimeZone } from '@codra/schema/timezone';
-import type { AppBindings } from '@server/env';
 import { queryRows } from './client';
 import { statsSchema, jobStatuses, reviewTriggers, reviewSeverities, reviewCategories } from '@codra/schema';
 import { getModelUsageStats } from './file-reviews';
@@ -23,7 +23,7 @@ export function trendBucketDays(days: number) {
 }
 
 // `created_at` is `timestamptz` (absolute); `AT TIME ZONE <zone>` converts it to wall-clock time before truncating, so a job at 03:00 IST lands on the IST day, not the UTC one.
-export async function getStats(env: Pick<AppBindings, 'HYPERDRIVE'>, days = 30, timeZone = 'UTC') {
+export async function getStats(env: DbEnv, days = 30, timeZone = 'UTC') {
   const parsedDays = Number(days);
   const safeDays = Number.isFinite(parsedDays) ? Math.trunc(parsedDays) : 30;
   const clampedDays = Math.min(Math.max(safeDays, 1), 365);
diff --git a/src/server/db/webhook-deliveries.ts b/packages/db/src/webhook-deliveries.ts
similarity index 92%
rename from src/server/db/webhook-deliveries.ts
rename to packages/db/src/webhook-deliveries.ts
index da35eaaf..df0d4d1c 100644
--- a/src/server/db/webhook-deliveries.ts
+++ b/packages/db/src/webhook-deliveries.ts
@@ -1,8 +1,8 @@
-import type { AppBindings } from '@server/env';
+import type { DbEnv } from './env';
 import { parseJsonColumn, queryRows } from './client';
 
 export async function recordWebhookDelivery(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   input: {
     deliveryId: string;
     eventName: string;
@@ -40,7 +40,7 @@ export async function recordWebhookDelivery(
 }
 
 export async function getWebhookDelivery(
-  env: Pick<AppBindings, 'HYPERDRIVE'>,
+  env: DbEnv,
   deliveryId: string,
 ) {
   const [row] = await queryRows<{
diff --git a/packages/db/tsconfig.json b/packages/db/tsconfig.json
new file mode 100644
index 00000000..035109be
--- /dev/null
+++ b/packages/db/tsconfig.json
@@ -0,0 +1,17 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "dist",
+    "types": ["node"]
+  },
+  "include": [
+    "src/**/*",
+    "test/**/*"
+  ],
+  "references": [
+    {
+      "path": "../schema"
+    }
+  ]
+}
diff --git a/packages/db/vitest.config.ts b/packages/db/vitest.config.ts
new file mode 100644
index 00000000..a8b87f03
--- /dev/null
+++ b/packages/db/vitest.config.ts
@@ -0,0 +1,9 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    include: ['test/**/*.spec.ts', 'test/**/*.contract.ts'],
+    environment: 'node',
+    globals: false,
+  },
+});
diff --git a/packages/schema/src/schema.ts b/packages/schema/src/schema.ts
index f44cf17b..5b6b1a22 100644
--- a/packages/schema/src/schema.ts
+++ b/packages/schema/src/schema.ts
@@ -405,6 +405,16 @@ export const modelConfigSchema = z.object({
 export type LlmApiFormat = z.infer<typeof llmProviderSchema>['apiFormat'];
 export type LlmProvider = z.infer<typeof llmProviderSchema>;
 export type ModelConfig = z.infer<typeof modelConfigSchema>;
+
+export type LlmProviderSecret = LlmProvider & {
+  encryptedApiKey: string | null;
+};
+
+export type ResolvedModelConfig = ModelConfig & {
+  providerEnabled: boolean;
+  baseUrl: string | null;
+  encryptedApiKey: string | null;
+};
 export type StatsPayload = z.infer<typeof statsSchema>;
 
 export const reviewSettingsSchema = z.object({
diff --git a/packages/ui/package.json b/packages/ui/package.json
new file mode 100644
index 00000000..83765435
--- /dev/null
+++ b/packages/ui/package.json
@@ -0,0 +1,36 @@
+{
+  "name": "@codra/ui",
+  "version": "0.9.4",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./theme": "./src/lib/theme.tsx",
+    "./utils": "./src/lib/utils.ts",
+    "./ease": "./src/lib/ease.ts",
+    "./highlight": "./src/lib/highlight.tsx",
+    "./selection": "./src/lib/selection.ts",
+    "./file-tree": "./src/lib/file-tree.ts",
+    "./prompt-diff": "./src/lib/prompt-diff.ts",
+    "./markdown-plugins": "./src/lib/markdown-plugins.ts",
+    "./motion": "./src/components/motion/index.ts",
+    "./hooks": "./src/hooks/index.ts",
+    "./styles": "./src/styles/tokens.css"
+  },
+  "peerDependencies": {
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "lucide-react": ">=1.0.0",
+    "motion": ">=12.0.0",
+    "recharts": ">=3.0.0",
+    "lenis": ">=1.0.0",
+    "sonner": ">=2.0.0"
+  },
+  "dependencies": {
+    "@base-ui/react": "^1.6.0",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "tailwind-merge": "^3.5.0",
+    "sugar-high": "^2.0.0"
+  }
+}
\ No newline at end of file
diff --git a/src/client/components/ui/alert.tsx b/packages/ui/src/components/alert.tsx
similarity index 97%
rename from src/client/components/ui/alert.tsx
rename to packages/ui/src/components/alert.tsx
index 35abf781..2e204c3b 100644
--- a/src/client/components/ui/alert.tsx
+++ b/packages/ui/src/components/alert.tsx
@@ -1,5 +1,5 @@
 import * as React from 'react';
-import { cn } from '@client/lib/utils';
+import { cn } from '../lib/utils';
 import { AlertCircle, CheckCircle2, AlertTriangle, Info } from 'lucide-react';
 
 const variants = {
diff --git a/src/client/components/ui/badge-variants.ts b/packages/ui/src/components/badge-variants.ts
similarity index 100%
rename from src/client/components/ui/badge-variants.ts
rename to packages/ui/src/components/badge-variants.ts
diff --git a/packages/ui/src/components/badge.tsx b/packages/ui/src/components/badge.tsx
new file mode 100644
index 00000000..9e85ce44
--- /dev/null
+++ b/packages/ui/src/components/badge.tsx
@@ -0,0 +1,14 @@
+import * as React from 'react';
+import { type VariantProps } from 'class-variance-authority';
+import { cn } from '../lib/utils';
+import { badgeVariants } from '../components/badge-variants';
+
+export interface BadgeProps
+  extends React.HTMLAttributes<HTMLDivElement>,
+    VariantProps<typeof badgeVariants> {}
+
+function Badge({ className, variant, ...props }: BadgeProps) {
+  return <div className={cn(badgeVariants({ variant }), className)} {...props} />;
+}
+
+export { Badge };
diff --git a/src/client/components/shared/bar-sparkline.tsx b/packages/ui/src/components/bar-sparkline.tsx
similarity index 97%
rename from src/client/components/shared/bar-sparkline.tsx
rename to packages/ui/src/components/bar-sparkline.tsx
index 576e6a8d..bd705480 100644
--- a/src/client/components/shared/bar-sparkline.tsx
+++ b/packages/ui/src/components/bar-sparkline.tsx
@@ -1,5 +1,5 @@
 import { useMemo } from 'react';
-import { cn } from '@client/lib/utils';
+import { cn } from '../lib/utils';
 
 interface BarSparklineProps {
   /** Raw daily series; aggregated into `bars` buckets for the mini chart. */
diff --git a/src/client/components/ui/button-variants.ts b/packages/ui/src/components/button-variants.ts
similarity index 100%
rename from src/client/components/ui/button-variants.ts
rename to packages/ui/src/components/button-variants.ts
diff --git a/src/client/components/ui/button.tsx b/packages/ui/src/components/button.tsx
similarity index 96%
rename from src/client/components/ui/button.tsx
rename to packages/ui/src/components/button.tsx
index b8053488..ee067d6c 100644
--- a/src/client/components/ui/button.tsx
+++ b/packages/ui/src/components/button.tsx
@@ -2,8 +2,8 @@ import * as React from 'react';
 import { useRender } from '@base-ui/react/use-render';
 import { type VariantProps } from 'class-variance-authority';
 import { Loader2 } from 'lucide-react';
-import { cn } from '@client/lib/utils';
-import { buttonVariants } from '@client/components/ui/button-variants';
+import { cn } from '../lib/utils';
+import { buttonVariants } from '../components/button-variants';
 
 type Shape = 'base' | 'square' | 'circle';
 
diff --git a/packages/ui/src/components/chart-primitives.tsx b/packages/ui/src/components/chart-primitives.tsx
new file mode 100644
index 00000000..d46f1013
--- /dev/null
+++ b/packages/ui/src/components/chart-primitives.tsx
@@ -0,0 +1,163 @@
+import { Children, type ReactNode } from 'react';
+import { LayerCard } from './layer-card';
+import { cn } from '../lib/utils';
+
+export function CardDots() {
+  return (
+    <div
+      aria-hidden
+      className="pointer-events-none absolute inset-0 opacity-[0.35]"
+      style={{
+        backgroundImage: 'radial-gradient(circle, var(--ui-line) 1px, transparent 1px)',
+        backgroundSize: '18px 18px',
+      }}
+    />
+  );
+}
+
+export function GraphShell({
+  title,
+  icon,
+  legend,
+  children,
+  className = '',
+}: {
+  title: string;
+  icon?: ReactNode;
+  legend?: ReactNode;
+  children: ReactNode;
+  className?: string;
+}) {
+  return (
+    <LayerCard className={cn('relative flex flex-col overflow-hidden', className)}>
+      <CardDots />
+      <div className="relative flex items-center gap-2 px-4 pt-4 sm:px-5 sm:pt-5">
+        {icon && <span className="shrink-0 text-ui-subtle">{icon}</span>}
+        <h3 className="truncate text-[11px] font-semibold uppercase tracking-[0.14em] text-ui-default">
+          {title}
+        </h3>
+      </div>
+      {legend && (
+        <div className="relative flex flex-wrap items-center gap-x-4 gap-y-1.5 px-4 pt-3 sm:px-5">
+          {legend}
+        </div>
+      )}
+      <div className="relative flex flex-1 flex-col">{children}</div>
+    </LayerCard>
+  );
+}
+
+export function LegendChip({
+  color,
+  hatched,
+  dashed,
+  label,
+}: {
+  color?: string;
+  hatched?: boolean;
+  dashed?: boolean;
+  label: string;
+}) {
+  return (
+    <span className="flex items-center gap-1.5 text-xs text-ui-subtle">
+      {dashed ? (
+        <span
+          className="h-0 w-3.5 shrink-0 border-t-2 border-dashed"
+          style={{ borderColor: color }}
+        />
+      ) : (
+        <span
+          className="h-2.5 w-2.5 shrink-0 rounded-[3px]"
+          style={
+            hatched
+              ? {
+                  backgroundImage:
+                    'repeating-linear-gradient(45deg, var(--ui-subtle) 0 1.5px, transparent 1.5px 3.5px)',
+                  backgroundColor: 'color-mix(in oklch, var(--ui-fill) 60%, transparent)',
+                }
+              : { backgroundColor: color }
+          }
+        />
+      )}
+      {label}
+    </span>
+  );
+}
+
+
+
+export function ChartDefs({ isDark }: { isDark: boolean }) {
+  const hatch = isDark ? 'rgba(228,228,231,0.5)' : 'rgba(63,63,70,0.4)';
+  const hatchBg = isDark ? 'rgba(255,255,255,0.05)' : 'rgba(0,0,0,0.04)';
+  return (
+    <defs>
+      <pattern id="hatchGray" patternUnits="userSpaceOnUse" width="5" height="5" patternTransform="rotate(45)">
+        <rect width="5" height="5" fill={hatchBg} />
+        <line x1="0" y1="0" x2="0" y2="5" stroke={hatch} strokeWidth="1.4" />
+      </pattern>
+      <linearGradient id="blueBar" x1="0" y1="0" x2="0" y2="1">
+        <stop offset="0%" stopColor="#60a5fa" />
+        <stop offset="100%" stopColor="#2563eb" />
+      </linearGradient>
+      <linearGradient id="amberFill" x1="0" y1="0" x2="0" y2="1">
+        <stop offset="0%" stopColor={isDark ? '#f59e0b' : '#d97706'} stopOpacity={0.16} />
+        <stop offset="100%" stopColor={isDark ? '#f59e0b' : '#d97706'} stopOpacity={0.02} />
+      </linearGradient>
+    </defs>
+  );
+}
+
+const METER_ROW_PX = 20;
+const METER_GAP_PX = 14;
+
+export function MeterList({ visible, children }: { visible: number; children: ReactNode }) {
+  const scrolls = Children.count(children) > visible;
+
+  return (
+    <div className="px-4 pb-5 pt-4 sm:px-5 sm:pb-6 sm:pt-5">
+      <div
+        className={cn('space-y-3.5', scrolls && 'overflow-y-auto pr-3')}
+        style={scrolls ? { maxHeight: visible * METER_ROW_PX + (visible - 1) * METER_GAP_PX } : undefined}
+      >
+        {children}
+      </div>
+    </div>
+  );
+}
+
+export function TickMeter({
+  label,
+  value,
+  max,
+  color,
+  valueLabel,
+}: {
+  label: string;
+  value: number;
+  max: number;
+  color: string;
+  valueLabel: string;
+}) {
+  const SEGMENTS = 26;
+  const filled = value > 0 ? Math.max(1, Math.round((value / Math.max(max, 1)) * SEGMENTS)) : 0;
+
+  return (
+    <div className="flex h-5 items-center gap-3">
+      <span className="w-28 shrink-0 truncate text-[13px] font-medium text-ui-default" title={label}>
+        {label}
+      </span>
+      <div className="flex h-4 flex-1 items-stretch gap-[2.5px]" aria-hidden>
+        {Array.from({ length: SEGMENTS }).map((_, i) => (
+          <span
+            key={i}
+            className="min-w-[2px] flex-1 rounded-[1px]"
+            style={{ backgroundColor: i < filled ? color : 'var(--ui-fill)' }}
+          />
+        ))}
+      </div>
+      <span className="ui-font-mono w-14 shrink-0 text-right text-xs tabular-nums text-ui-default">
+        {valueLabel}
+      </span>
+    </div>
+  );
+}
diff --git a/src/client/components/ui/confirm-dialog.tsx b/packages/ui/src/components/confirm-dialog.tsx
similarity index 96%
rename from src/client/components/ui/confirm-dialog.tsx
rename to packages/ui/src/components/confirm-dialog.tsx
index 7a6f7187..9d711a77 100644
--- a/src/client/components/ui/confirm-dialog.tsx
+++ b/packages/ui/src/components/confirm-dialog.tsx
@@ -1,6 +1,6 @@
 import { Dialog } from '@base-ui/react/dialog';
 import { AlertTriangle } from 'lucide-react';
-import { Button, type ButtonProps } from '@client/components/ui/button';
+import { Button, type ButtonProps } from '../components/button';
 
 interface ConfirmDialogProps {
   open: boolean;
diff --git a/src/client/components/shared/copy-button.tsx b/packages/ui/src/components/copy-button.tsx
similarity index 93%
rename from src/client/components/shared/copy-button.tsx
rename to packages/ui/src/components/copy-button.tsx
index fa96c5f4..1cc5eec1 100644
--- a/src/client/components/shared/copy-button.tsx
+++ b/packages/ui/src/components/copy-button.tsx
@@ -1,6 +1,7 @@
 import { useEffect, useRef, useState } from 'react';
 import { Check, Copy } from 'lucide-react';
-import { cn } from '@client/lib/utils';
+import { cn } from '../lib/utils';
+import { UI_DURATION_TOOLTIP } from '../lib/constants';
 
 /**
  * Drag-selecting a long, scrollable `<pre>` is miserable - the container
@@ -17,7 +18,6 @@ export function CopyButton({
 }) {
   const [copied, setCopied] = useState(false);
   const timer = useRef<number | null>(null);
-
   // The timeout outlives the component if the panel is collapsed right after a copy.
   useEffect(() => () => {
     if (timer.current !== null) window.clearTimeout(timer.current);
@@ -28,7 +28,7 @@ export function CopyButton({
       await navigator.clipboard.writeText(value);
       setCopied(true);
       if (timer.current !== null) window.clearTimeout(timer.current);
-      timer.current = window.setTimeout(() => setCopied(false), 1500);
+      timer.current = window.setTimeout(() => setCopied(false), UI_DURATION_TOOLTIP);
     } catch {
       // Clipboard access can be refused (insecure origin, permissions policy); fail quietly since manual selection still works.
     }
diff --git a/src/client/components/shared/empty-state.tsx b/packages/ui/src/components/empty-state.tsx
similarity index 96%
rename from src/client/components/shared/empty-state.tsx
rename to packages/ui/src/components/empty-state.tsx
index fd9b11e2..63a4f043 100644
--- a/src/client/components/shared/empty-state.tsx
+++ b/packages/ui/src/components/empty-state.tsx
@@ -1,6 +1,6 @@
 import React from 'react';
-import { cn } from '@client/lib/utils';
-import { Button } from '@client/components/ui/button';
+import { cn } from '../lib/utils';
+import { Button } from '../components/button';
 
 interface EmptyStateProps {
   icon?: React.ReactNode;
diff --git a/src/client/components/shared/github-mark.tsx b/packages/ui/src/components/github-mark.tsx
similarity index 100%
rename from src/client/components/shared/github-mark.tsx
rename to packages/ui/src/components/github-mark.tsx
diff --git a/src/client/components/ui/input.tsx b/packages/ui/src/components/input.tsx
similarity index 96%
rename from src/client/components/ui/input.tsx
rename to packages/ui/src/components/input.tsx
index 23f5ffa4..0b133f0c 100644
--- a/src/client/components/ui/input.tsx
+++ b/packages/ui/src/components/input.tsx
@@ -1,5 +1,5 @@
 import * as React from 'react';
-import { cn } from '@client/lib/utils';
+import { cn } from '../lib/utils';
 
 type InputSize = 'xs' | 'sm' | 'base' | 'lg';
 
diff --git a/src/client/components/ui/layer-card.tsx b/packages/ui/src/components/layer-card.tsx
similarity index 91%
rename from src/client/components/ui/layer-card.tsx
rename to packages/ui/src/components/layer-card.tsx
index da64c97b..bca655ed 100644
--- a/src/client/components/ui/layer-card.tsx
+++ b/packages/ui/src/components/layer-card.tsx
@@ -1,5 +1,5 @@
 import * as React from 'react';
-import { cn } from '@client/lib/utils';
+import { cn } from '../lib/utils';
 
 /** Uses the `ui-*` surface tokens defined in app.css. */
 const LayerCard = React.forwardRef<HTMLDivElement, React.HTMLAttributes<HTMLDivElement>>(
diff --git a/src/client/components/shared/load-error.tsx b/packages/ui/src/components/load-error.tsx
similarity index 95%
rename from src/client/components/shared/load-error.tsx
rename to packages/ui/src/components/load-error.tsx
index a357f8ce..fa587947 100644
--- a/src/client/components/shared/load-error.tsx
+++ b/packages/ui/src/components/load-error.tsx
@@ -1,6 +1,6 @@
 import { AlertTriangle, RefreshCw } from 'lucide-react';
-import { Button } from '@client/components/ui/button';
-import { cn } from '@client/lib/utils';
+import { Button } from '../components/button';
+import { cn } from '../lib/utils';
 
 interface LoadErrorProps {
   /** Friendly headline, e.g. "Couldn't load dashboard data". */
diff --git a/packages/ui/src/components/motion/index.ts b/packages/ui/src/components/motion/index.ts
new file mode 100644
index 00000000..eeb4b0ee
--- /dev/null
+++ b/packages/ui/src/components/motion/index.ts
@@ -0,0 +1,4 @@
+export { SharedLayoutBg, type SharedLayoutBgProps } from './shared-layout-bg';
+export { SmoothScroll, type SmoothScrollApi } from './smooth-scroll';
+export { SteppedSlider, type SteppedSliderStep, type SteppedSliderProps } from './stepped-slider';
+export { Tabs, TabsList, TabsTrigger } from './tabs';
diff --git a/src/client/components/motion/shared-layout-bg.tsx b/packages/ui/src/components/motion/shared-layout-bg.tsx
similarity index 98%
rename from src/client/components/motion/shared-layout-bg.tsx
rename to packages/ui/src/components/motion/shared-layout-bg.tsx
index b164274c..d526720d 100644
--- a/src/client/components/motion/shared-layout-bg.tsx
+++ b/packages/ui/src/components/motion/shared-layout-bg.tsx
@@ -16,7 +16,7 @@ import {
   type ReactElement,
   type ReactNode,
 } from "react";
-import { cn } from "@client/lib/utils";
+import { cn } from "../../lib/utils";
 
 const SPRING_LAYOUT = {
   type: "spring" as const,
diff --git a/src/client/components/motion/smooth-scroll.tsx b/packages/ui/src/components/motion/smooth-scroll.tsx
similarity index 100%
rename from src/client/components/motion/smooth-scroll.tsx
rename to packages/ui/src/components/motion/smooth-scroll.tsx
diff --git a/src/client/components/motion/stepped-slider.tsx b/packages/ui/src/components/motion/stepped-slider.tsx
similarity index 99%
rename from src/client/components/motion/stepped-slider.tsx
rename to packages/ui/src/components/motion/stepped-slider.tsx
index 1b23e858..24dd9643 100644
--- a/src/client/components/motion/stepped-slider.tsx
+++ b/packages/ui/src/components/motion/stepped-slider.tsx
@@ -20,8 +20,8 @@ import {
   useState,
 } from 'react';
 
-import { cn } from '@client/lib/utils';
-import { useIsDarkMode } from '@client/hooks/use-is-dark-mode';
+import { cn } from '../../lib/utils';
+import { useIsDarkMode } from '../../hooks/use-is-dark-mode';
 
 const SPRING_GLIDE = { stiffness: 700, damping: 50, mass: 0.5 } as const;
 const SPRING_BOUNCY = { type: 'spring', stiffness: 500, damping: 14, mass: 0.7 } as const;
diff --git a/src/client/components/motion/tabs.tsx b/packages/ui/src/components/motion/tabs.tsx
similarity index 99%
rename from src/client/components/motion/tabs.tsx
rename to packages/ui/src/components/motion/tabs.tsx
index 583e2556..a345f3fd 100644
--- a/src/client/components/motion/tabs.tsx
+++ b/packages/ui/src/components/motion/tabs.tsx
@@ -11,7 +11,7 @@ import {
   useState,
   type ReactNode,
 } from 'react';
-import { cn } from '@client/lib/utils';
+import { cn } from '../../lib/utils';
 
 type Variant = 'pill' | 'underline' | 'segment';
 
diff --git a/src/client/components/shared/section-card.tsx b/packages/ui/src/components/section-card.tsx
similarity index 100%
rename from src/client/components/shared/section-card.tsx
rename to packages/ui/src/components/section-card.tsx
diff --git a/src/client/components/ui/select-panel.tsx b/packages/ui/src/components/select-panel.tsx
similarity index 98%
rename from src/client/components/ui/select-panel.tsx
rename to packages/ui/src/components/select-panel.tsx
index f021d16e..233dd1ae 100644
--- a/src/client/components/ui/select-panel.tsx
+++ b/packages/ui/src/components/select-panel.tsx
@@ -1,8 +1,8 @@
 import { Check } from 'lucide-react';
 import { m, type Transition } from 'motion/react';
 import type { RefObject } from 'react';
-import { cn } from '@client/lib/utils';
-import { EASE_OUT } from '@client/lib/ease';
+import { cn } from '../lib/utils';
+import { EASE_OUT } from '../lib/ease';
 import {
   INSTANT_TRANSITION,
   ITEM_VARIANTS,
diff --git a/src/client/components/ui/select-shared.ts b/packages/ui/src/components/select-shared.ts
similarity index 100%
rename from src/client/components/ui/select-shared.ts
rename to packages/ui/src/components/select-shared.ts
diff --git a/src/client/components/ui/select-trigger.tsx b/packages/ui/src/components/select-trigger.tsx
similarity index 97%
rename from src/client/components/ui/select-trigger.tsx
rename to packages/ui/src/components/select-trigger.tsx
index 48ae3923..15951145 100644
--- a/src/client/components/ui/select-trigger.tsx
+++ b/packages/ui/src/components/select-trigger.tsx
@@ -1,8 +1,8 @@
 import { ChevronDown } from 'lucide-react';
 import { m, type Transition } from 'motion/react';
 import type { CSSProperties, KeyboardEvent as ReactKeyboardEvent, ReactNode, RefObject } from 'react';
-import { cn } from '@client/lib/utils';
-import { EASE_OUT } from '@client/lib/ease';
+import { cn } from '../lib/utils';
+import { EASE_OUT } from '../lib/ease';
 import { CHEVRON_TRANSITION, INSTANT_TRANSITION, type SelectOption } from './select-shared';
 
 // Gooey: the edge facing the panel snaps flat while attached, then rounds as the two pinch apart.
diff --git a/src/client/components/ui/select.tsx b/packages/ui/src/components/select.tsx
similarity index 99%
rename from src/client/components/ui/select.tsx
rename to packages/ui/src/components/select.tsx
index 89170159..c94dd325 100644
--- a/src/client/components/ui/select.tsx
+++ b/packages/ui/src/components/select.tsx
@@ -10,7 +10,7 @@ import {
   useState,
 } from 'react';
 import { createPortal } from 'react-dom';
-import { cn } from '@client/lib/utils';
+import { cn } from '../lib/utils';
 import { SelectPanel } from './select-panel';
 import type { Placement, SelectOption, TriggerRect } from './select-shared';
 import { SelectTrigger } from './select-trigger';
diff --git a/src/client/components/shared/skeleton.tsx b/packages/ui/src/components/skeleton.tsx
similarity index 93%
rename from src/client/components/shared/skeleton.tsx
rename to packages/ui/src/components/skeleton.tsx
index 0a46b141..30a10c43 100644
--- a/src/client/components/shared/skeleton.tsx
+++ b/packages/ui/src/components/skeleton.tsx
@@ -1,5 +1,5 @@
 import React from 'react';
-import { cn } from '@client/lib/utils';
+import { cn } from '../lib/utils';
 
 interface SkeletonProps {
   width?: string | number;
diff --git a/src/client/components/ui/switch.tsx b/packages/ui/src/components/switch.tsx
similarity index 97%
rename from src/client/components/ui/switch.tsx
rename to packages/ui/src/components/switch.tsx
index 4a3d8226..aaf3c030 100644
--- a/src/client/components/ui/switch.tsx
+++ b/packages/ui/src/components/switch.tsx
@@ -1,6 +1,6 @@
 import * as React from 'react';
 import { Switch as BaseSwitch } from '@base-ui/react/switch';
-import { cn } from '@client/lib/utils';
+import { cn } from '../lib/utils';
 
 export interface SwitchProps {
   checked?: boolean;
diff --git a/src/client/components/ui/text.tsx b/packages/ui/src/components/text.tsx
similarity index 95%
rename from src/client/components/ui/text.tsx
rename to packages/ui/src/components/text.tsx
index 6f1e5391..8a46016b 100644
--- a/src/client/components/ui/text.tsx
+++ b/packages/ui/src/components/text.tsx
@@ -1,6 +1,6 @@
 import * as React from 'react';
 import { cva, type VariantProps } from 'class-variance-authority';
-import { cn } from '@client/lib/utils';
+import { cn } from '../lib/utils';
 
 const textVariants = cva('', {
   variants: {
diff --git a/packages/ui/src/hooks/index.ts b/packages/ui/src/hooks/index.ts
new file mode 100644
index 00000000..58dbf9bd
--- /dev/null
+++ b/packages/ui/src/hooks/index.ts
@@ -0,0 +1 @@
+export { useIsDarkMode } from './use-is-dark-mode';
diff --git a/src/client/hooks/use-is-dark-mode.ts b/packages/ui/src/hooks/use-is-dark-mode.ts
similarity index 100%
rename from src/client/hooks/use-is-dark-mode.ts
rename to packages/ui/src/hooks/use-is-dark-mode.ts
diff --git a/packages/ui/src/index.ts b/packages/ui/src/index.ts
new file mode 100644
index 00000000..1525b377
--- /dev/null
+++ b/packages/ui/src/index.ts
@@ -0,0 +1,22 @@
+// Components
+export { Alert } from './components/alert';
+export { Badge } from './components/badge';
+export { badgeVariants } from './components/badge-variants';
+export { Button, LinkButton, type ButtonProps } from './components/button';
+export { buttonVariants } from './components/button-variants';
+export { ConfirmDialog } from './components/confirm-dialog';
+export { Input, type InputProps } from './components/input';
+export { LayerCard } from './components/layer-card';
+export { Select } from './components/select';
+export { Switch, type SwitchProps } from './components/switch';
+export { Text } from './components/text';
+export { Skeleton } from './components/skeleton';
+export { EmptyState } from './components/empty-state';
+export { SectionCard } from './components/section-card';
+export { CopyButton } from './components/copy-button';
+export { BarSparkline } from './components/bar-sparkline';
+export { GithubMark } from './components/github-mark';
+export { LoadError } from './components/load-error';
+
+// Chart primitives
+export { GraphShell, LegendChip, ChartDefs, MeterList, TickMeter, CardDots } from './components/chart-primitives';
diff --git a/packages/ui/src/lib/constants.ts b/packages/ui/src/lib/constants.ts
new file mode 100644
index 00000000..5ede6757
--- /dev/null
+++ b/packages/ui/src/lib/constants.ts
@@ -0,0 +1,26 @@
+/**
+ * Core UI magic numbers and standard constants.
+ */
+
+// Animation timings (ms)
+export const UI_DURATION_FAST = 150;
+export const UI_DURATION_NORMAL = 200;
+export const UI_DURATION_SLOW = 300;
+export const UI_DURATION_TOOLTIP = 1500;
+
+// Standard opacities
+export const OPACITY_DISABLED = 0.5;
+export const OPACITY_HOVER = 0.8;
+
+// Common chart/graph colors
+export const CHART_COLORS = {
+  hatchGray: 'url(#hatchGray)',
+  defaultGrid: '#333',
+  transparent: 'transparent',
+  tooltipBg: 'rgba(0,0,0,0.5)',
+} as const;
+
+// Layout thresholds
+export const LAYOUT_CONSTANTS = {
+  mobileBreakpoint: 768,
+} as const;
diff --git a/src/client/lib/ease.ts b/packages/ui/src/lib/ease.ts
similarity index 100%
rename from src/client/lib/ease.ts
rename to packages/ui/src/lib/ease.ts
diff --git a/src/client/lib/file-tree.ts b/packages/ui/src/lib/file-tree.ts
similarity index 100%
rename from src/client/lib/file-tree.ts
rename to packages/ui/src/lib/file-tree.ts
diff --git a/src/client/lib/highlight.tsx b/packages/ui/src/lib/highlight.tsx
similarity index 100%
rename from src/client/lib/highlight.tsx
rename to packages/ui/src/lib/highlight.tsx
diff --git a/src/client/lib/markdown-plugins.ts b/packages/ui/src/lib/markdown-plugins.ts
similarity index 100%
rename from src/client/lib/markdown-plugins.ts
rename to packages/ui/src/lib/markdown-plugins.ts
diff --git a/src/client/lib/prompt-diff.ts b/packages/ui/src/lib/prompt-diff.ts
similarity index 100%
rename from src/client/lib/prompt-diff.ts
rename to packages/ui/src/lib/prompt-diff.ts
diff --git a/src/client/lib/selection.ts b/packages/ui/src/lib/selection.ts
similarity index 100%
rename from src/client/lib/selection.ts
rename to packages/ui/src/lib/selection.ts
diff --git a/src/client/lib/theme.tsx b/packages/ui/src/lib/theme.tsx
similarity index 100%
rename from src/client/lib/theme.tsx
rename to packages/ui/src/lib/theme.tsx
diff --git a/src/client/lib/utils.ts b/packages/ui/src/lib/utils.ts
similarity index 100%
rename from src/client/lib/utils.ts
rename to packages/ui/src/lib/utils.ts
diff --git a/packages/ui/tsconfig.json b/packages/ui/tsconfig.json
new file mode 100644
index 00000000..40d9d234
--- /dev/null
+++ b/packages/ui/tsconfig.json
@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "jsx": "react-jsx",
+    "lib": ["ES2024", "DOM", "DOM.Iterable"]
+  },
+  "include": ["src/**/*"]
+}
diff --git a/scratch/refactor-consumers.js b/scratch/refactor-consumers.js
new file mode 100644
index 00000000..5a5737ce
--- /dev/null
+++ b/scratch/refactor-consumers.js
@@ -0,0 +1,37 @@
+import fs from 'fs';
+import path from 'path';
+
+function walk(dir) {
+  let results = [];
+  const list = fs.readdirSync(dir);
+  list.forEach(function(file) {
+    file = path.join(dir, file);
+    const stat = fs.statSync(file);
+    if (stat && stat.isDirectory()) { 
+      results = results.concat(walk(file));
+    } else { 
+      if (file.endsWith('.ts')) results.push(file);
+    }
+  });
+  return results;
+}
+
+const files = walk(path.join(process.cwd(), 'src', 'server'));
+
+for (const file of files) {
+  let content = fs.readFileSync(file, 'utf8');
+  let changed = false;
+
+  if (content.includes('@server/db/')) {
+    content = content.replace(/@server\/db\//g, '@codra/db/');
+    changed = true;
+  }
+
+  // Check if we have `import type { AppBindings } from '@server/env';` used for DB calls.
+  // Actually, we'll let typechecker find the mismatched `AppBindings` vs `DbEnv` arguments.
+  
+  if (changed) {
+    fs.writeFileSync(file, content);
+  }
+}
+console.log('Done');
diff --git a/scratch/refactor-db-2.js b/scratch/refactor-db-2.js
new file mode 100644
index 00000000..8aaaf0cb
--- /dev/null
+++ b/scratch/refactor-db-2.js
@@ -0,0 +1,35 @@
+import fs from 'fs';
+import path from 'path';
+
+const dir = path.join(process.cwd(), 'packages', 'db', 'src');
+const files = fs.readdirSync(dir).filter(f => f.endsWith('.ts'));
+
+for (const file of files) {
+  const filePath = path.join(dir, file);
+  let content = fs.readFileSync(filePath, 'utf8');
+
+  // Fix AppBindings
+  content = content.replace(/AppBindings/g, 'DbEnv');
+
+  // Fix APP_KV get and delete
+  if (file === 'jobs-activity.ts') {
+    content = content.replace(
+      /\{ APP_KV: \{ put\(key: string, value: string, options\?: \{ expirationTtl\?: number \} \| undefined\): Promise<void> \} \}/g,
+      `{ APP_KV: { put(key: string, value: string, options?: { expirationTtl?: number }): Promise<void>; get(key: string): Promise<string | null>; delete(key: string): Promise<void> } }`
+    );
+  }
+
+  // Fix @server/core/logger in app-settings.ts
+  if (file === 'app-settings.ts') {
+    content = content.replace(/import \{ logger \} from '@server\/core\/logger';\n?/g, '');
+    content = content.replace(/logger\.warn/g, 'console.warn');
+    content = content.replace(/logger\.error/g, 'console.error');
+  }
+
+  // Check for any other @server/env imports
+  content = content.replace(/import type \{ [^}]*DbEnv[^}]* \} from '@server\/env';\n?/g, '');
+  content = content.replace(/import \{ [^}]* \} from '@server\/env';\n?/g, '');
+  
+  fs.writeFileSync(filePath, content);
+}
+console.log('Done');
diff --git a/scratch/refactor-db-3.js b/scratch/refactor-db-3.js
new file mode 100644
index 00000000..038a2df0
--- /dev/null
+++ b/scratch/refactor-db-3.js
@@ -0,0 +1,33 @@
+import fs from 'fs';
+import path from 'path';
+
+const dir = path.join(process.cwd(), 'packages', 'db', 'src');
+const files = fs.readdirSync(dir).filter(f => f.endsWith('.ts'));
+
+for (const file of files) {
+  if (file === 'env.ts') continue;
+  const filePath = path.join(dir, file);
+  let content = fs.readFileSync(filePath, 'utf8');
+
+  // Remove old definitions
+  content = content.replace(/type DbEnv = \{ HYPERDRIVE: \{ connectionString: string \} \};\n?/g, '');
+  content = content.replace(/\{ APP_KV: \{ put\(key: string, value: string, options\?: \{ expirationTtl\?: number \} \| undefined\): Promise<void>; \} \}/g, 'DbEnv');
+  content = content.replace(/\{ APP_KV: \{ put\(key: string, value: string, options\?: \{ expirationTtl\?: number \} \): Promise<void>; get\(key: string\): Promise<string \| null>; delete\(key: string\): Promise<void> \} \}/g, 'DbEnv');
+
+  // Add import if needed
+  if (content.includes('DbEnv')) {
+    const importStr = `import type { DbEnv } from './env';\n`;
+    if (!content.includes(importStr)) {
+      content = importStr + content;
+    }
+  }
+
+  // Also fix APP_KV inline in jobs-activity.ts
+  if (file === 'jobs-activity.ts') {
+      content = content.replace(/env: \{ APP_KV: \{[^}]+\}[^}]+\}/, 'env: DbEnv');
+      content = content.replace(/env: DbEnv \{/, 'env: DbEnv'); // Just in case
+  }
+  
+  fs.writeFileSync(filePath, content);
+}
+console.log('Done');
diff --git a/scratch/refactor-db.js b/scratch/refactor-db.js
new file mode 100644
index 00000000..6f8e326e
--- /dev/null
+++ b/scratch/refactor-db.js
@@ -0,0 +1,42 @@
+import fs from 'fs';
+import path from 'path';
+
+const dir = path.join(process.cwd(), 'packages', 'db', 'src');
+const files = fs.readdirSync(dir).filter(f => f.endsWith('.ts'));
+
+for (const file of files) {
+  const filePath = path.join(dir, file);
+  let content = fs.readFileSync(filePath, 'utf8');
+
+  // Replace AppBindings import
+  content = content.replace(
+    /import type \{ AppBindings \} from '@server\/env';/g,
+    `type DbEnv = { HYPERDRIVE: { connectionString: string } };`
+  );
+
+  // Replace Pick<AppBindings, 'HYPERDRIVE'> with DbEnv
+  content = content.replace(/Pick<AppBindings, 'HYPERDRIVE'>/g, 'DbEnv');
+  
+  // Replace AppBindings with DbEnv in function parameters
+  content = content.replace(/env: AppBindings/g, 'env: DbEnv');
+
+  // jobs-activity.ts has APP_KV. Let's fix it specifically
+  if (file === 'jobs-activity.ts') {
+    content = content.replace(
+      /Pick<AppBindings, 'APP_KV'>/g,
+      `{ APP_KV: { put(key: string, value: string, options?: { expirationTtl?: number }): Promise<void> } }`
+    );
+  }
+  
+  // model-configs.ts has ResolvedModelConfig which we moved to schema
+  if (file === 'model-configs.ts') {
+    // we already modified the source model-configs.ts to export it, but this is the copied version, wait, we copied the modified version!
+  }
+
+  // Replace any remaining '@server/' imports to relative paths if necessary, but actually in packages/db they should still refer to '@codra/schema' or we need to fix local references.
+  // Wait, src/server/db doesn't have many '@server/' imports, mostly just '@server/env' and '@codra/schema'.
+  // Let's check for any other '@server/' imports.
+  
+  fs.writeFileSync(filePath, content);
+}
+console.log('Done');
diff --git a/scratch/refactor-repos.js b/scratch/refactor-repos.js
new file mode 100644
index 00000000..26b880f9
--- /dev/null
+++ b/scratch/refactor-repos.js
@@ -0,0 +1,21 @@
+import fs from 'fs';
+import path from 'path';
+
+const dir = path.join(process.cwd(), 'packages', 'db', 'src', 'repositories');
+const files = fs.readdirSync(dir).filter(f => f.endsWith('.ts'));
+
+for (const file of files) {
+  const filePath = path.join(dir, file);
+  let content = fs.readFileSync(filePath, 'utf8');
+
+  // Replace AppBindings imports
+  content = content.replace(/import type \{ AppBindings \} from '@server\/env';/g, "import type { DbEnv } from '../env';");
+  content = content.replace(/env: AppBindings/g, "env: DbEnv");
+  content = content.replace(/import type \{ DbEnv \} from '@server\/env';/g, "import type { DbEnv } from '../env';");
+
+  // Fix DB imports
+  content = content.replace(/@server\/db\//g, '../');
+
+  fs.writeFileSync(filePath, content);
+}
+console.log('Done');
diff --git a/scratch/refactor-tests.js b/scratch/refactor-tests.js
new file mode 100644
index 00000000..29cf2a42
--- /dev/null
+++ b/scratch/refactor-tests.js
@@ -0,0 +1,34 @@
+import fs from 'fs';
+import path from 'path';
+
+function walk(dir) {
+  let results = [];
+  const list = fs.readdirSync(dir);
+  list.forEach(function(file) {
+    file = path.join(dir, file);
+    const stat = fs.statSync(file);
+    if (stat && stat.isDirectory()) { 
+      results = results.concat(walk(file));
+    } else { 
+      if (file.endsWith('.ts')) results.push(file);
+    }
+  });
+  return results;
+}
+
+const files = walk(path.join(process.cwd(), 'test'));
+
+for (const file of files) {
+  let content = fs.readFileSync(file, 'utf8');
+  let changed = false;
+
+  if (content.includes('@server/db/')) {
+    content = content.replace(/@server\/db\//g, '@codra/db/');
+    changed = true;
+  }
+
+  if (changed) {
+    fs.writeFileSync(file, content);
+  }
+}
+console.log('Done');
diff --git a/scripts/comment-density.mjs b/scripts/comment-density.mjs
index 71297cfb..0db31c36 100644
--- a/scripts/comment-density.mjs
+++ b/scripts/comment-density.mjs
@@ -18,7 +18,7 @@ import { readFileSync } from 'node:fs';
 import { readdir } from 'node:fs/promises';
 import path from 'node:path';
 
-const ROOTS = ['src', 'test', 'scripts'];
+const ROOTS = ['src', 'test', 'scripts', 'packages', 'apps'];
 const EXTS = new Set(['.ts', '.tsx', '.mjs', '.js']);
 // Generated by `wrangler types`; not ours to edit.
 const SKIP = new Set(['worker-env.d.ts', 'worker-configuration.d.ts']);
diff --git a/scripts/test.mjs b/scripts/test.mjs
index 804fba1d..4c19b403 100644
--- a/scripts/test.mjs
+++ b/scripts/test.mjs
@@ -73,5 +73,5 @@ if (!usableEnvValue(process.env.TEST_DATABASE_URL)) {
 
 process.env.DATABASE_URL = process.env.TEST_DATABASE_URL;
 
-run(process.execPath, ['scripts/migrate.mjs']);
+run(process.execPath, ['packages/db/scripts/migrate.mjs']);
 run(process.execPath, ['node_modules/vitest/vitest.mjs', 'run']);
diff --git a/src/client/components/features/account/detail-rows.tsx b/src/client/components/features/account/detail-rows.tsx
index f6870c31..5baf372c 100644
--- a/src/client/components/features/account/detail-rows.tsx
+++ b/src/client/components/features/account/detail-rows.tsx
@@ -1,8 +1,6 @@
+import { LayerCard, Skeleton, Text } from '@codra/ui';
 import { useState } from 'react';
-import { cn } from '@client/lib/utils';
-import { LayerCard } from '@client/components/ui/layer-card';
-import { Text } from '@client/components/ui/text';
-import { Skeleton } from '@client/components/shared/skeleton';
+import { cn } from '@codra/ui/utils';
 
 export function DetailGroup({ caption, children }: { caption: string; children: React.ReactNode }) {
   return (
diff --git a/src/client/components/features/account/details-section.tsx b/src/client/components/features/account/details-section.tsx
index 143b1ef1..df3edce1 100644
--- a/src/client/components/features/account/details-section.tsx
+++ b/src/client/components/features/account/details-section.tsx
@@ -1,9 +1,6 @@
+import { SectionCard, Select, Skeleton, Text } from '@codra/ui';
 import { useMemo } from 'react';
 import { Mail } from 'lucide-react';
-import { Text } from '@client/components/ui/text';
-import { Select } from '@client/components/ui/select';
-import { Skeleton } from '@client/components/shared/skeleton';
-import { SectionCard } from '@client/components/shared/section-card';
 import {
   COMMON_TIME_ZONES,
   DEFAULT_TIME_ZONE,
diff --git a/src/client/components/features/account/profile-card.tsx b/src/client/components/features/account/profile-card.tsx
index 331df63f..606808e0 100644
--- a/src/client/components/features/account/profile-card.tsx
+++ b/src/client/components/features/account/profile-card.tsx
@@ -1,11 +1,7 @@
+import { Badge, Button, GithubMark, Input, LinkButton, Skeleton } from '@codra/ui';
 import { useState } from 'react';
 import { toast } from 'sonner';
 import { api } from '@client/lib/api';
-import { Button, LinkButton } from '@client/components/ui/button';
-import { Input } from '@client/components/ui/input';
-import { Badge } from '@client/components/ui/badge';
-import { Skeleton } from '@client/components/shared/skeleton';
-import { GithubMark } from '@client/components/shared/github-mark';
 import { ExternalLink, Pencil, Check, X } from 'lucide-react';
 import type { AccountSettings, AuthSessionUser } from '@codra/schema/api';
 
diff --git a/src/client/components/features/dashboard/updates-email-prompt.tsx b/src/client/components/features/dashboard/updates-email-prompt.tsx
index b4b19d66..4fd03128 100644
--- a/src/client/components/features/dashboard/updates-email-prompt.tsx
+++ b/src/client/components/features/dashboard/updates-email-prompt.tsx
@@ -1,8 +1,7 @@
+import { Button, Input } from '@codra/ui';
 import { useEffect, useState, type FormEvent } from 'react';
 import { toast } from 'sonner';
 import { Check, Mail } from 'lucide-react';
-import { Button } from '@client/components/ui/button';
-import { Input } from '@client/components/ui/input';
 import { api } from '@client/lib/api';
 import type { UpdatesEmailResponse } from '@codra/schema/api';
 
diff --git a/src/client/components/features/job-detail/comment-card.tsx b/src/client/components/features/job-detail/comment-card.tsx
index 20d37810..c168e076 100644
--- a/src/client/components/features/job-detail/comment-card.tsx
+++ b/src/client/components/features/job-detail/comment-card.tsx
@@ -1,16 +1,16 @@
+import { CopyButton } from '@codra/ui';
 import { useState, type ComponentPropsWithoutRef } from 'react';
 import ReactMarkdown from 'react-markdown';
 import remarkGfm from 'remark-gfm';
 import { FileText, ThumbsDown, ThumbsUp } from 'lucide-react';
-import { cn } from '@client/lib/utils';
+import { cn } from '@codra/ui/utils';
 import { api } from '@client/lib/api';
-import { CopyButton } from '@client/components/shared/copy-button';
-import { preventToggleOnTextSelection } from '@client/lib/selection';
+import { preventToggleOnTextSelection } from '@codra/ui/selection';
 import type { ParsedReviewComment } from '@codra/schema';
 import { severityConfig } from './constants';
 import { ContextSnippet } from './context-snippet';
 
-import { safeRehypePlugins } from '@client/lib/markdown-plugins';
+import { safeRehypePlugins } from '@codra/ui/markdown-plugins';
 /** Plain-English reason a finding never reached the pull request. */
 const DISPOSITION_LABEL: Record<string, string> = {
   severity: 'Below the severity threshold for this repository',
diff --git a/src/client/components/features/job-detail/context-snippet.tsx b/src/client/components/features/job-detail/context-snippet.tsx
index d3c5c051..eacc0445 100644
--- a/src/client/components/features/job-detail/context-snippet.tsx
+++ b/src/client/components/features/job-detail/context-snippet.tsx
@@ -1,6 +1,6 @@
 import { useMemo } from 'react';
-import { highlightLine, langForPath } from '@client/lib/highlight';
-import { cn } from '@client/lib/utils';
+import { highlightLine, langForPath } from '@codra/ui/highlight';
+import { cn } from '@codra/ui/utils';
 import { ROW_TONES } from './diff-file-panel-utils';
 
 /**
diff --git a/src/client/components/features/job-detail/diff-file-panel-utils.ts b/src/client/components/features/job-detail/diff-file-panel-utils.ts
index 1ebc0bef..4482777e 100644
--- a/src/client/components/features/job-detail/diff-file-panel-utils.ts
+++ b/src/client/components/features/job-detail/diff-file-panel-utils.ts
@@ -1,5 +1,5 @@
 import type { CSSProperties } from 'react';
-import type { DiffRow } from '@client/lib/prompt-diff';
+import type { DiffRow } from '@codra/ui/prompt-diff';
 import type { ParsedReviewComment } from '@codra/schema';
 
 export const LARGE_DIFF_ROWS = 300;
diff --git a/src/client/components/features/job-detail/diff-file-panel.tsx b/src/client/components/features/job-detail/diff-file-panel.tsx
index fbf9a8c2..d19b7c94 100644
--- a/src/client/components/features/job-detail/diff-file-panel.tsx
+++ b/src/client/components/features/job-detail/diff-file-panel.tsx
@@ -1,9 +1,10 @@
+import { Badge } from '@codra/ui';
 import { useMemo, useState } from 'react';
 import { Check, ChevronDown } from 'lucide-react';
-import { Badge, StatusBadge } from '@client/components/ui/badge';
-import { parsePromptDiff, diffStats, type DiffRow } from '@client/lib/prompt-diff';
-import { highlightLine, langForPath } from '@client/lib/highlight';
-import { cn } from '@client/lib/utils';
+import { StatusBadge } from './status-badge';
+import { parsePromptDiff, diffStats, type DiffRow } from '@codra/ui/prompt-diff';
+import { highlightLine, langForPath } from '@codra/ui/highlight';
+import { cn } from '@codra/ui/utils';
 import type { FileReviewRecord, ParsedReviewComment } from '@codra/schema';
 import { CommentCard } from './comment-card';
 import {
diff --git a/src/client/components/features/job-detail/diff-file-tree.tsx b/src/client/components/features/job-detail/diff-file-tree.tsx
index 661ceb6c..b37c4777 100644
--- a/src/client/components/features/job-detail/diff-file-tree.tsx
+++ b/src/client/components/features/job-detail/diff-file-tree.tsx
@@ -1,7 +1,7 @@
 import { Check, FileText, Folder, FolderOpen } from 'lucide-react';
-import { type TreeNode } from '@client/lib/file-tree';
-import { diffStats } from '@client/lib/prompt-diff';
-import { cn } from '@client/lib/utils';
+import { type TreeNode } from '@codra/ui/file-tree';
+import { diffStats } from '@codra/ui/prompt-diff';
+import { cn } from '@codra/ui/utils';
 import type { FileReviewRecord } from '@codra/schema';
 
 export interface TreeProps {
diff --git a/src/client/components/features/job-detail/file-finding.tsx b/src/client/components/features/job-detail/file-finding.tsx
index b2884d98..ad45b0f6 100644
--- a/src/client/components/features/job-detail/file-finding.tsx
+++ b/src/client/components/features/job-detail/file-finding.tsx
@@ -3,11 +3,11 @@ import remarkGfm from 'remark-gfm';
 import { ChevronRight } from 'lucide-react';
 import type { FileReviewRecord, ParsedReviewComment } from '@codra/schema';
 import { CommentCard } from './comment-card';
-import { preventToggleOnTextSelection } from '@client/lib/selection';
+import { preventToggleOnTextSelection } from '@codra/ui/selection';
 import { MonoPath, StatusDot, VerdictPill } from './job-chips';
 import { statusLabel } from './job-chip-utils';
 
-import { safeRehypePlugins } from '@client/lib/markdown-plugins';
+import { safeRehypePlugins } from '@codra/ui/markdown-plugins';
 interface FileFindingProps {
   file: FileReviewRecord;
 }
diff --git a/src/client/components/features/job-detail/job-chips.tsx b/src/client/components/features/job-detail/job-chips.tsx
index f0b336f8..0ab958e7 100644
--- a/src/client/components/features/job-detail/job-chips.tsx
+++ b/src/client/components/features/job-detail/job-chips.tsx
@@ -4,7 +4,7 @@
  */
 import { useState, type ReactNode } from 'react';
 import { CheckCircle2, MessageSquare, type LucideIcon } from 'lucide-react';
-import { cn } from '@client/lib/utils';
+import { cn } from '@codra/ui/utils';
 import { STATUS_DOT, jobDuration, statusLabel } from '@client/lib/job-format';
 
 import type { JobDetail, JobSummary } from '@codra/schema';
diff --git a/src/client/components/features/job-detail/job-diffs.tsx b/src/client/components/features/job-detail/job-diffs.tsx
index 8c445efd..7f65324f 100644
--- a/src/client/components/features/job-detail/job-diffs.tsx
+++ b/src/client/components/features/job-detail/job-diffs.tsx
@@ -9,8 +9,8 @@ import {
   Info,
 } from 'lucide-react';
 import { api } from '@client/lib/api';
-import { buildTree } from '@client/lib/file-tree';
-import { diffStats } from '@client/lib/prompt-diff';
+import { buildTree } from '@codra/ui/file-tree';
+import { diffStats } from '@codra/ui/prompt-diff';
 import { readDiffsCache, writeDiffsCache } from '@client/lib/diffs-cache';
 import type { FileReviewRecord, JobDetail } from '@codra/schema';
 
diff --git a/src/client/components/features/job-detail/job-findings-list.tsx b/src/client/components/features/job-detail/job-findings-list.tsx
index dc0c25a4..38256d3e 100644
--- a/src/client/components/features/job-detail/job-findings-list.tsx
+++ b/src/client/components/features/job-detail/job-findings-list.tsx
@@ -2,7 +2,7 @@ import { useState, type ReactNode } from 'react';
 import { FileText } from 'lucide-react';
 import type { JobDetail } from '@codra/schema';
 import { reviewSeverities } from '@codra/schema/review-limits';
-import { Tabs, TabsList, TabsTrigger } from '@client/components/motion/tabs';
+import { Tabs, TabsList, TabsTrigger } from '@codra/ui/motion';
 import { FileFinding } from './file-finding';
 import { CommentCard } from './comment-card';
 import { severityConfig } from './constants';
diff --git a/src/client/components/features/job-detail/job-header.tsx b/src/client/components/features/job-detail/job-header.tsx
index 9c19913a..2cbafbb4 100644
--- a/src/client/components/features/job-detail/job-header.tsx
+++ b/src/client/components/features/job-detail/job-header.tsx
@@ -1,3 +1,4 @@
+import { Button, ConfirmDialog } from '@codra/ui';
 import { useState } from 'react';
 import type { ComponentType } from 'react';
 import { Link } from 'react-router-dom';
@@ -13,9 +14,7 @@ import {
   Terminal,
   Trash2,
 } from 'lucide-react';
-import { Button } from '@client/components/ui/button';
-import type { ButtonProps } from '@client/components/ui/button';
-import { ConfirmDialog } from '@client/components/ui/confirm-dialog';
+import type { ButtonProps } from '@codra/ui';
 import { UpdatesEmailPrompt } from '@client/components/features/dashboard/updates-email-prompt';
 import { AuthorChip, JobStatusLine, MetaChip, VerdictPill } from './job-chips';
 import { formatAbsoluteDate, formatRelativeDate } from './job-chip-utils';
diff --git a/src/client/components/features/job-detail/job-meta-cards.tsx b/src/client/components/features/job-detail/job-meta-cards.tsx
index 1e44745a..e6e4d6e9 100644
--- a/src/client/components/features/job-detail/job-meta-cards.tsx
+++ b/src/client/components/features/job-detail/job-meta-cards.tsx
@@ -1,7 +1,7 @@
 import type { ReactNode } from 'react';
 import { AtSign, ExternalLink, Info, ListChecks, RotateCcw, Zap } from 'lucide-react';
 import { Link } from 'react-router-dom';
-import { cn, formatPreciseDuration } from '@client/lib/utils';
+import { cn, formatPreciseDuration } from '@codra/ui/utils';
 import type { JobDetail, JobStep } from '@codra/schema';
 import {
   EmptyValue,
diff --git a/src/client/components/features/job-detail/job-review-overview.tsx b/src/client/components/features/job-detail/job-review-overview.tsx
index 5383a109..435f8ce9 100644
--- a/src/client/components/features/job-detail/job-review-overview.tsx
+++ b/src/client/components/features/job-detail/job-review-overview.tsx
@@ -5,7 +5,7 @@ import type { JobDetail } from '@codra/schema';
 import { reviewSeverities } from '@codra/schema/review-limits';
 import { OutlinePill } from './job-chips';
 
-import { safeRehypePlugins } from '@client/lib/markdown-plugins';
+import { safeRehypePlugins } from '@codra/ui/markdown-plugins';
 interface JobReviewOverviewProps {
   job: JobDetail;
 }
diff --git a/src/client/components/features/job-detail/job-skeleton.tsx b/src/client/components/features/job-detail/job-skeleton.tsx
index 6721443a..d54412b6 100644
--- a/src/client/components/features/job-detail/job-skeleton.tsx
+++ b/src/client/components/features/job-detail/job-skeleton.tsx
@@ -1,7 +1,6 @@
+import { LoadError, Skeleton } from '@codra/ui';
 import { Link } from 'react-router-dom';
 import { ChevronRight, ClipboardList, FileDiff, Info, ListChecks } from 'lucide-react';
-import { Skeleton } from '@client/components/shared/skeleton';
-import { LoadError } from '@client/components/shared/load-error';
 import { DETAIL_LABEL, DETAIL_ROW } from './job-chip-utils';
 
 interface JobDetailSkeletonProps {
diff --git a/src/client/components/ui/badge.tsx b/src/client/components/features/job-detail/status-badge.tsx
similarity index 60%
rename from src/client/components/ui/badge.tsx
rename to src/client/components/features/job-detail/status-badge.tsx
index a9b077c4..f53f4c7b 100644
--- a/src/client/components/ui/badge.tsx
+++ b/src/client/components/features/job-detail/status-badge.tsx
@@ -1,19 +1,8 @@
-import * as React from 'react';
-import { type VariantProps } from 'class-variance-authority';
-import { cn } from '@client/lib/utils';
+import { Badge } from '@codra/ui';
 import type { JobSummary } from '@codra/schema';
 import { LiveReviewStepper } from '@client/components/features/reviews/live-review-stepper';
-import { badgeVariants } from '@client/components/ui/badge-variants';
 
-export interface BadgeProps
-  extends React.HTMLAttributes<HTMLDivElement>,
-    VariantProps<typeof badgeVariants> {}
-
-function Badge({ className, variant, ...props }: BadgeProps) {
-  return <div className={cn(badgeVariants({ variant }), className)} {...props} />;
-}
-
-type BadgeVariant = NonNullable<BadgeProps['variant']>;
+type BadgeVariant = 'success' | 'info' | 'warning' | 'danger' | 'neutral';
 
 function getTone(value: string): BadgeVariant {
   switch (value) {
@@ -36,7 +25,7 @@ function getTone(value: string): BadgeVariant {
   }
 }
 
-function StatusBadge({ label, job }: { label: string; job?: JobSummary }) {
+export function StatusBadge({ label, job }: { label: string; job?: JobSummary }) {
   if (job && (label === 'running' || label === 'queued')) {
     return <LiveReviewStepper job={job} />;
   }
@@ -55,5 +44,3 @@ function StatusBadge({ label, job }: { label: string; job?: JobSummary }) {
     </Badge>
   );
 }
-
-export { Badge, StatusBadge };
diff --git a/src/client/components/features/models/model-chain.tsx b/src/client/components/features/models/model-chain.tsx
index 33432f96..d5b7156c 100644
--- a/src/client/components/features/models/model-chain.tsx
+++ b/src/client/components/features/models/model-chain.tsx
@@ -1,7 +1,6 @@
+import { Button, Select } from '@codra/ui';
 import { useId, useMemo, useState } from 'react';
-import { cn } from '@client/lib/utils';
-import { Select } from '@client/components/ui/select';
-import { Button } from '@client/components/ui/button';
+import { cn } from '@codra/ui/utils';
 import { Trash2, ListPlus } from 'lucide-react';
 
 import type {
diff --git a/src/client/components/features/repos/repo-model-modal.tsx b/src/client/components/features/repos/repo-model-modal.tsx
index b348f0ee..4d3015af 100644
--- a/src/client/components/features/repos/repo-model-modal.tsx
+++ b/src/client/components/features/repos/repo-model-modal.tsx
@@ -1,9 +1,8 @@
+import { Alert, Button } from '@codra/ui';
 import { useMemo, useState } from 'react';
 import { Dialog } from '@base-ui/react/dialog';
 import { toast } from 'sonner';
 import { api } from '@client/lib/api';
-import { Button } from '@client/components/ui/button';
-import { Alert } from '@client/components/ui/alert';
 import { Save, RotateCcw, X } from 'lucide-react';
 import type { RepoConfigRecord } from '@codra/schema';
 import { ModelRouteEditor } from '@client/components/features/models/model-chain';
diff --git a/src/client/components/features/repos/repo-row.tsx b/src/client/components/features/repos/repo-row.tsx
index cb62f73f..4c7f50af 100644
--- a/src/client/components/features/repos/repo-row.tsx
+++ b/src/client/components/features/repos/repo-row.tsx
@@ -1,6 +1,4 @@
-import { Button } from '@client/components/ui/button';
-import { Badge } from '@client/components/ui/badge';
-import { Switch } from '@client/components/ui/switch';
+import { Badge, Button, Switch } from '@codra/ui';
 import { Settings2 } from 'lucide-react';
 import type { RepoConfigRecord } from '@codra/schema';
 import { describeModelRoute, type ModelOption, type ModelRouteConfig } from '@client/components/features/models/model-route';
diff --git a/src/client/components/features/settings/about-section.tsx b/src/client/components/features/settings/about-section.tsx
index c752cbec..d875566e 100644
--- a/src/client/components/features/settings/about-section.tsx
+++ b/src/client/components/features/settings/about-section.tsx
@@ -1,9 +1,6 @@
+import { Badge, LayerCard, SectionCard, Text } from '@codra/ui';
 import pkg from '../../../../../package.json';
 import { ExternalLink } from 'lucide-react';
-import { SectionCard } from '@client/components/shared/section-card';
-import { LayerCard } from '@client/components/ui/layer-card';
-import { Text } from '@client/components/ui/text';
-import { Badge } from '@client/components/ui/badge';
 
 // No props and no state, which is why this is a component rather than inlined JSX: it keeps 50 lines of markup out of SettingsPage.
 export function AboutSection() {
diff --git a/src/client/components/features/settings/default-models-section.tsx b/src/client/components/features/settings/default-models-section.tsx
index 96660b51..edbcc2f4 100644
--- a/src/client/components/features/settings/default-models-section.tsx
+++ b/src/client/components/features/settings/default-models-section.tsx
@@ -1,6 +1,6 @@
+import { Skeleton } from '@codra/ui';
 import { useMemo } from 'react';
 import type { ModelConfig } from '@codra/schema';
-import { Skeleton } from '@client/components/shared/skeleton';
 import { ModelRouteEditor } from '@client/components/features/models/model-chain';
 import type {
   ModelOption,
diff --git a/src/client/components/features/settings/new-provider-form.tsx b/src/client/components/features/settings/new-provider-form.tsx
index 92d2cab4..5cdc6ad2 100644
--- a/src/client/components/features/settings/new-provider-form.tsx
+++ b/src/client/components/features/settings/new-provider-form.tsx
@@ -1,8 +1,6 @@
+import { Button, Input, Select } from '@codra/ui';
 import type { Dispatch, SetStateAction } from 'react';
 import { Plus } from 'lucide-react';
-import { Button } from '@client/components/ui/button';
-import { Input } from '@client/components/ui/input';
-import { Select } from '@client/components/ui/select';
 import { FieldLabel } from './field-label';
 import {
   PROVIDER_PRESETS,
diff --git a/src/client/components/features/settings/provider-list.tsx b/src/client/components/features/settings/provider-list.tsx
index 95863f50..fe04bf94 100644
--- a/src/client/components/features/settings/provider-list.tsx
+++ b/src/client/components/features/settings/provider-list.tsx
@@ -1,6 +1,6 @@
+import { Skeleton } from '@codra/ui';
 import { toast } from 'sonner';
 import type { LlmProvider } from '@codra/schema';
-import { Skeleton } from '@client/components/shared/skeleton';
 import { ProviderRow } from './provider-row';
 import type { ProviderDraft } from './settings-support';
 
diff --git a/src/client/components/features/settings/provider-row.tsx b/src/client/components/features/settings/provider-row.tsx
index e896bc6c..29ef4810 100644
--- a/src/client/components/features/settings/provider-row.tsx
+++ b/src/client/components/features/settings/provider-row.tsx
@@ -1,10 +1,6 @@
+import { Badge, Button, Input, Select, Switch } from '@codra/ui';
 import { ChevronRight, Save, Trash2 } from 'lucide-react';
-import { Button } from '@client/components/ui/button';
-import { Input } from '@client/components/ui/input';
-import { Select } from '@client/components/ui/select';
-import { Switch } from '@client/components/ui/switch';
-import { Badge } from '@client/components/ui/badge';
-import { cn } from '@client/lib/utils';
+import { cn } from '@codra/ui/utils';
 import type { LlmApiFormat, LlmProvider } from '@codra/schema';
 import { FieldLabel } from './field-label';
 import {
diff --git a/src/client/components/features/settings/review-section.tsx b/src/client/components/features/settings/review-section.tsx
index f89318cf..5cc20dab 100644
--- a/src/client/components/features/settings/review-section.tsx
+++ b/src/client/components/features/settings/review-section.tsx
@@ -1,8 +1,5 @@
-import { SectionCard } from '@client/components/shared/section-card';
-import { Input } from '@client/components/ui/input';
-import { Skeleton } from '@client/components/shared/skeleton';
-import { SteppedSlider } from '@client/components/motion/stepped-slider';
-import { ConfirmDialog } from '@client/components/ui/confirm-dialog';
+import { ConfirmDialog, Input, SectionCard, Skeleton } from '@codra/ui';
+import { SteppedSlider } from '@codra/ui/motion';
 import type { ReviewSettings } from '@codra/schema';
 import { REVIEW_CONCURRENCY_LIMITS, reviewMaxFilesRange } from '@codra/schema/review-limits';
 import { FieldLabel } from './field-label';
diff --git a/src/client/components/features/stats/chart-primitives.tsx b/src/client/components/features/stats/chart-primitives.tsx
index 0e57b819..fd8e1be0 100644
--- a/src/client/components/features/stats/chart-primitives.tsx
+++ b/src/client/components/features/stats/chart-primitives.tsx
@@ -1,8 +1,6 @@
-import { Children, type ReactNode } from 'react';
+import { Skeleton, GraphShell } from '@codra/ui';
+import type { ReactNode } from 'react';
 import { Activity, Boxes, Coins, FolderGit2, ShieldCheck } from 'lucide-react';
-import { LayerCard } from '@client/components/ui/layer-card';
-import { Skeleton } from '@client/components/shared/skeleton';
-import { cn } from '@client/lib/utils';
 import { formatCompact, formatDayRange } from './chart-support';
 
 export function ChartTooltip({ active, payload, label }: any) {
@@ -33,174 +31,6 @@ export function ChartTooltip({ active, payload, label }: any) {
   );
 }
 
-function CardDots() {
-  return (
-    <div
-      aria-hidden
-      className="pointer-events-none absolute inset-0 opacity-[0.35]"
-      style={{
-        backgroundImage: 'radial-gradient(circle, var(--ui-line) 1px, transparent 1px)',
-        backgroundSize: '18px 18px',
-      }}
-    />
-  );
-}
-
-export function GraphShell({
-  title,
-  icon,
-  legend,
-  children,
-  className = '',
-}: {
-  title: string;
-  icon?: ReactNode;
-  legend?: ReactNode;
-  children: ReactNode;
-  className?: string;
-}) {
-  return (
-    <LayerCard className={cn('relative flex flex-col overflow-hidden', className)}>
-      <CardDots />
-      <div className="relative flex items-center gap-2 px-4 pt-4 sm:px-5 sm:pt-5">
-        {icon && <span className="shrink-0 text-ui-subtle">{icon}</span>}
-        <h3 className="truncate text-[11px] font-semibold uppercase tracking-[0.14em] text-ui-default">
-          {title}
-        </h3>
-      </div>
-      {legend && (
-        <div className="relative flex flex-wrap items-center gap-x-4 gap-y-1.5 px-4 pt-3 sm:px-5">
-          {legend}
-        </div>
-      )}
-      <div className="relative flex flex-1 flex-col">{children}</div>
-    </LayerCard>
-  );
-}
-
-/** Legend chip: solid square, hatched square, or dashed-line swatch + label. */
-export function LegendChip({
-  color,
-  hatched,
-  dashed,
-  label,
-}: {
-  color?: string;
-  hatched?: boolean;
-  dashed?: boolean;
-  label: string;
-}) {
-  return (
-    <span className="flex items-center gap-1.5 text-xs text-ui-subtle">
-      {dashed ? (
-        <span
-          className="h-0 w-3.5 shrink-0 border-t-2 border-dashed"
-          style={{ borderColor: color }}
-        />
-      ) : (
-        <span
-          className="h-2.5 w-2.5 shrink-0 rounded-[3px]"
-          style={
-            hatched
-              ? {
-                  backgroundImage:
-                    'repeating-linear-gradient(45deg, var(--ui-subtle) 0 1.5px, transparent 1.5px 3.5px)',
-                  backgroundColor: 'color-mix(in oklch, var(--ui-fill) 60%, transparent)',
-                }
-              : { backgroundColor: color }
-          }
-        />
-      )}
-      {label}
-    </span>
-  );
-}
-
-/** SVG defs shared by the bar/area charts: diagonal hatch + soft fills. */
-export function ChartDefs({ isDark }: { isDark: boolean }) {
-  const hatch = isDark ? 'rgba(228,228,231,0.5)' : 'rgba(63,63,70,0.4)';
-  const hatchBg = isDark ? 'rgba(255,255,255,0.05)' : 'rgba(0,0,0,0.04)';
-  return (
-    <defs>
-      <pattern id="hatchGray" patternUnits="userSpaceOnUse" width="5" height="5" patternTransform="rotate(45)">
-        <rect width="5" height="5" fill={hatchBg} />
-        <line x1="0" y1="0" x2="0" y2="5" stroke={hatch} strokeWidth="1.4" />
-      </pattern>
-      <linearGradient id="blueBar" x1="0" y1="0" x2="0" y2="1">
-        <stop offset="0%" stopColor="#60a5fa" />
-        <stop offset="100%" stopColor="#2563eb" />
-      </linearGradient>
-      <linearGradient id="amberFill" x1="0" y1="0" x2="0" y2="1">
-        <stop offset="0%" stopColor={isDark ? '#f59e0b' : '#d97706'} stopOpacity={0.16} />
-        <stop offset="100%" stopColor={isDark ? '#f59e0b' : '#d97706'} stopOpacity={0.02} />
-      </linearGradient>
-    </defs>
-  );
-}
-
-/**
- * Caps a meter list at `visible` rows and scrolls the rest, so a long tail (dozens of models)
- * can't stretch the card and throw off the others sharing its grid row. The cap is a pixel
- * max-height derived from the fixed row/gap metrics below, which is why `TickMeter` pins its
- * own height.
- */
-const METER_ROW_PX = 20;
-const METER_GAP_PX = 14;
-
-export function MeterList({ visible, children }: { visible: number; children: ReactNode }) {
-  // Only the overflowing case gets the cap and the scrollbar gutter, so short lists keep even padding.
-  const scrolls = Children.count(children) > visible;
-
-  return (
-    <div className="px-4 pb-5 pt-4 sm:px-5 sm:pb-6 sm:pt-5">
-      <div
-        className={cn('space-y-3.5', scrolls && 'overflow-y-auto pr-3')}
-        style={scrolls ? { maxHeight: visible * METER_ROW_PX + (visible - 1) * METER_GAP_PX } : undefined}
-      >
-        {children}
-      </div>
-    </div>
-  );
-}
-
-/** Segmented tick meter (reference "cost allocation" bars). */
-export function TickMeter({
-  label,
-  value,
-  max,
-  color,
-  valueLabel,
-}: {
-  label: string;
-  value: number;
-  max: number;
-  color: string;
-  valueLabel: string;
-}) {
-  const SEGMENTS = 26;
-  const filled = value > 0 ? Math.max(1, Math.round((value / Math.max(max, 1)) * SEGMENTS)) : 0;
-
-  return (
-    <div className="flex h-5 items-center gap-3">
-      <span className="w-28 shrink-0 truncate text-[13px] font-medium text-ui-default" title={label}>
-        {label}
-      </span>
-      <div className="flex h-4 flex-1 items-stretch gap-[2.5px]" aria-hidden>
-        {Array.from({ length: SEGMENTS }).map((_, i) => (
-          <span
-            key={i}
-            className="min-w-[2px] flex-1 rounded-[1px]"
-            style={{ backgroundColor: i < filled ? color : 'var(--ui-fill)' }}
-          />
-        ))}
-      </div>
-      <span className="ui-font-mono w-14 shrink-0 text-right text-xs tabular-nums text-ui-default">
-        {valueLabel}
-      </span>
-    </div>
-  );
-}
-
 function GraphCardSkeleton({ title, icon, className = '' }: { title: string; icon?: ReactNode; className?: string }) {
   return (
     <GraphShell title={title} icon={icon} className={className}>
diff --git a/src/client/components/features/stats/chart-support.ts b/src/client/components/features/stats/chart-support.ts
index 06565e7e..764571ec 100644
--- a/src/client/components/features/stats/chart-support.ts
+++ b/src/client/components/features/stats/chart-support.ts
@@ -1,4 +1,4 @@
-import { fmtNumber } from '@client/lib/utils';
+import { fmtNumber } from '@codra/ui/utils';
 import { formatDayLabel } from '@client/lib/timezone';
 
 // Pure and render-free, so the chart components and the grid can share it without Fast Refresh
diff --git a/src/client/components/features/stats/metrics-grid-charts.tsx b/src/client/components/features/stats/metrics-grid-charts.tsx
index 7ff815f8..c9ec35ec 100644
--- a/src/client/components/features/stats/metrics-grid-charts.tsx
+++ b/src/client/components/features/stats/metrics-grid-charts.tsx
@@ -14,14 +14,16 @@ import {
 } from 'recharts';
 import { Activity, Boxes, Coins, FolderGit2, ShieldCheck } from 'lucide-react';
 import type { StatsPayload } from '@codra/schema';
-import {
-  ChartDefs,
-  ChartTooltip,
-  GraphShell,
-  LegendChip,
-  MeterList,
-  TickMeter,
+import { 
+  ChartTooltip
 } from './chart-primitives';
+import { 
+  GraphShell, 
+  LegendChip, 
+  ChartDefs, 
+  MeterList, 
+  TickMeter 
+} from '@codra/ui';
 import {
   CHART,
   MONO_STACK,
diff --git a/src/client/components/features/stats/overview-stats.tsx b/src/client/components/features/stats/overview-stats.tsx
index 93518466..0dcb3619 100644
--- a/src/client/components/features/stats/overview-stats.tsx
+++ b/src/client/components/features/stats/overview-stats.tsx
@@ -1,8 +1,8 @@
 import { useMemo } from 'react';
 import { Activity, ArrowUpRight, Cpu, MessageSquare } from 'lucide-react';
 import { StatsGrid, type StatDelta } from './stats-grid';
-import { fmtStat } from '@client/lib/utils';
-import { useIsDarkMode } from '@client/hooks/use-is-dark-mode';
+import { fmtStat } from '@codra/ui/utils';
+import { useIsDarkMode } from '@codra/ui/hooks';
 import type { StatsPayload } from '@codra/schema';
 
 interface OverviewStatsProps {
diff --git a/src/client/components/features/stats/stats-grid.tsx b/src/client/components/features/stats/stats-grid.tsx
index e86e8cae..c210add7 100644
--- a/src/client/components/features/stats/stats-grid.tsx
+++ b/src/client/components/features/stats/stats-grid.tsx
@@ -1,8 +1,7 @@
+import { BarSparkline, Skeleton } from '@codra/ui';
 import * as React from 'react';
-import { cn } from '@client/lib/utils';
+import { cn } from '@codra/ui/utils';
 import type { LucideIcon } from 'lucide-react';
-import { Skeleton } from '@client/components/shared/skeleton';
-import { BarSparkline } from '@client/components/shared/bar-sparkline';
 
 export interface StatDelta {
   /** Signed percentage change vs. the previous period. */
diff --git a/src/client/components/features/stats/time-range-select.tsx b/src/client/components/features/stats/time-range-select.tsx
index b6311ad4..9ea6a94e 100644
--- a/src/client/components/features/stats/time-range-select.tsx
+++ b/src/client/components/features/stats/time-range-select.tsx
@@ -1,8 +1,8 @@
+import { Select } from '@codra/ui';
 import type { CSSProperties } from 'react';
 import { Clock } from 'lucide-react';
-import { Select } from '@client/components/ui/select';
 import { DEFAULT_STATS_DAYS } from '@client/hooks/use-stats-range';
-import { cn } from '@client/lib/utils';
+import { cn } from '@codra/ui/utils';
 
 interface TimeRangeSelectProps {
   value: number;
diff --git a/src/client/components/layout/account-menu.tsx b/src/client/components/layout/account-menu.tsx
index 451becd8..612d6b04 100644
--- a/src/client/components/layout/account-menu.tsx
+++ b/src/client/components/layout/account-menu.tsx
@@ -1,9 +1,9 @@
+import { GithubMark } from '@codra/ui';
 import { Link } from 'react-router-dom';
 import { useEffect, useRef, useState } from 'react';
 import { api } from '@client/lib/api';
 import { LogOut, ChevronsUpDown, UserRound } from 'lucide-react';
-import { GithubMark } from '@client/components/shared/github-mark';
-import { cn } from '@client/lib/utils';
+import { cn } from '@codra/ui/utils';
 import type { AuthSessionUser } from '@codra/schema/api';
 
 /**
diff --git a/src/client/components/layout/app-shell.tsx b/src/client/components/layout/app-shell.tsx
index e435793f..325adb2e 100644
--- a/src/client/components/layout/app-shell.tsx
+++ b/src/client/components/layout/app-shell.tsx
@@ -1,10 +1,10 @@
 import { Outlet, Link } from 'react-router-dom';
 import { useEffect, useState } from 'react';
-import { SharedLayoutBg } from '@client/components/motion/shared-layout-bg';
+import { SharedLayoutBg } from '@codra/ui/motion';
 import { api } from '@client/lib/api';
 import { LayoutDashboard, AlignLeft, GitBranch, BarChart2, Sun, Moon, Activity, Settings, Star, X, ArrowUpRight } from 'lucide-react';
-import { cn } from '@client/lib/utils';
-import { useTheme } from '@client/lib/theme';
+import { cn } from '@codra/ui/utils';
+import { useTheme } from '@codra/ui/theme';
 import codraDark from '@/assets/codra-fullicon-dark.svg';
 import codraLight from '@/assets/codra-fullicon-light.svg';
 import type { AuthSessionUser } from '@codra/schema/api';
diff --git a/src/client/components/layout/page-header.tsx b/src/client/components/layout/page-header.tsx
index 2c37b830..177dcaaa 100644
--- a/src/client/components/layout/page-header.tsx
+++ b/src/client/components/layout/page-header.tsx
@@ -1,5 +1,5 @@
 import * as React from 'react';
-import { cn } from '@client/lib/utils';
+import { cn } from '@codra/ui/utils';
 import { UpdatesEmailPrompt } from '@client/components/features/dashboard/updates-email-prompt';
 
 interface PageHeaderProps extends React.HTMLAttributes<HTMLElement> {
diff --git a/src/client/components/layout/sidebar-nav-item.tsx b/src/client/components/layout/sidebar-nav-item.tsx
index 3eed3454..d271f0fb 100644
--- a/src/client/components/layout/sidebar-nav-item.tsx
+++ b/src/client/components/layout/sidebar-nav-item.tsx
@@ -1,6 +1,6 @@
 import { NavLink, useMatch, useResolvedPath } from 'react-router-dom';
 import { type ComponentType } from 'react';
-import { cn } from '@client/lib/utils';
+import { cn } from '@codra/ui/utils';
 
 /**
  * Resolves active state via hooks instead of NavLink's render-prop pattern,
diff --git a/src/client/components/shared/jobs-table.tsx b/src/client/components/shared/jobs-table.tsx
index 326b4fc7..3175ebc3 100644
--- a/src/client/components/shared/jobs-table.tsx
+++ b/src/client/components/shared/jobs-table.tsx
@@ -1,8 +1,9 @@
+import { Skeleton } from '@codra/ui';
 import { Link } from 'react-router-dom';
 import { FolderGit2, GitCommitHorizontal, GitPullRequest } from 'lucide-react';
-import { Skeleton } from '@client/components/shared/skeleton';
+
 import { VerdictPill, MetaChip, AuthorAvatar } from '@client/components/features/job-detail/job-chips';
-import { cn } from '@client/lib/utils';
+import { cn } from '@codra/ui/utils';
 import { formatDateTime } from '@client/lib/timezone';
 import { STATUS_DOT, formatRelativeDate, jobDuration, statusLabel } from '@client/lib/job-format';
 
diff --git a/src/client/components/shared/page-header-actions.tsx b/src/client/components/shared/page-header-actions.tsx
index 24c71a47..5a7e1fc2 100644
--- a/src/client/components/shared/page-header-actions.tsx
+++ b/src/client/components/shared/page-header-actions.tsx
@@ -1,5 +1,5 @@
+import { Button } from '@codra/ui';
 import { RefreshCw } from 'lucide-react';
-import { Button } from '@client/components/ui/button';
 import { TimeRangeSelect } from '@client/components/features/stats/time-range-select';
 
 interface PageHeaderActionsProps {
diff --git a/src/client/components/shared/route-error-boundary.tsx b/src/client/components/shared/route-error-boundary.tsx
index b5876e30..95fca937 100644
--- a/src/client/components/shared/route-error-boundary.tsx
+++ b/src/client/components/shared/route-error-boundary.tsx
@@ -1,6 +1,6 @@
+import { Button } from '@codra/ui';
 import { isRouteErrorResponse, Link, useRouteError } from 'react-router-dom';
 import { AlertTriangle, Compass, LayoutDashboard, RefreshCw } from 'lucide-react';
-import { Button } from '@client/components/ui/button';
 
 interface Presentation {
   code: string;
diff --git a/src/client/main.tsx b/src/client/main.tsx
index f808fd4d..8ad18ac9 100644
--- a/src/client/main.tsx
+++ b/src/client/main.tsx
@@ -19,9 +19,9 @@ const NotFoundPage = React.lazy(() => import('./pages/not-found').then(m => ({ d
 
 import './app.css';
 
-import { ThemeProvider } from './lib/theme';
-import { useIsDarkMode } from './hooks/use-is-dark-mode';
-import { SmoothScroll } from './components/motion/smooth-scroll';
+import { ThemeProvider } from '@codra/ui/theme';
+import { useIsDarkMode } from '@codra/ui/hooks';
+import { SmoothScroll } from '@codra/ui/motion';
 
 function ToasterWrapper() {
   const isDark = useIsDarkMode();
diff --git a/src/client/pages/account.tsx b/src/client/pages/account.tsx
index c65edcf6..52e034f5 100644
--- a/src/client/pages/account.tsx
+++ b/src/client/pages/account.tsx
@@ -1,8 +1,8 @@
+import { LoadError } from '@codra/ui';
 import { useEffect, useRef, useState } from 'react';
 import { toast } from 'sonner';
 import { api } from '@client/lib/api';
 import { PageHeader } from '@client/components/layout/page-header';
-import { LoadError } from '@client/components/shared/load-error';
 import {
   getStoredTimeZone,
   resolvedTimeZone,
diff --git a/src/client/pages/dashboard.tsx b/src/client/pages/dashboard.tsx
index c1a73845..324f23aa 100644
--- a/src/client/pages/dashboard.tsx
+++ b/src/client/pages/dashboard.tsx
@@ -1,18 +1,16 @@
+import { Button, EmptyState, LoadError } from '@codra/ui';
 import { useState } from 'react';
 import { api } from '@client/lib/api';
 import type { StatsPayload, JobSummary } from '@codra/schema';
 import { ArrowRight, GitPullRequest, Activity } from 'lucide-react';
 import { JobsTable } from '@client/components/shared/jobs-table';
-import { EmptyState } from '@client/components/shared/empty-state';
 import { PageHeaderActions } from '@client/components/shared/page-header-actions';
 import { Link } from 'react-router-dom';
 
-import { Button } from '@client/components/ui/button';
 import { PageHeader } from '@client/components/layout/page-header';
 import { OverviewStats } from '@client/components/features/stats/overview-stats';
 import { usePolling } from '@client/hooks/use-polling';
 import { useStatsRange } from '@client/hooks/use-stats-range';
-import { LoadError } from '@client/components/shared/load-error';
 
 export function DashboardPage() {
   const [stats, setStats] = useState<StatsPayload | null>(null);
diff --git a/src/client/pages/job-detail.tsx b/src/client/pages/job-detail.tsx
index cde2fb47..7386f95a 100644
--- a/src/client/pages/job-detail.tsx
+++ b/src/client/pages/job-detail.tsx
@@ -1,8 +1,8 @@
+import { LoadError } from '@codra/ui';
 import { useState } from 'react';
 import { useParams } from 'react-router-dom';
 import { LazyMotion, m, domMax } from 'motion/react';
 import { ClipboardList, FileDiff } from 'lucide-react';
-import { LoadError } from '@client/components/shared/load-error';
 import { useJobDetail } from '@client/hooks/use-job-detail';
 import { JobHeader } from '@client/components/features/job-detail/job-header';
 import { JobProgress } from '@client/components/features/job-detail/job-progress';
@@ -11,7 +11,7 @@ import { JobReviewOverview } from '@client/components/features/job-detail/job-re
 import { JobFindingsList } from '@client/components/features/job-detail/job-findings-list';
 import { JobDiffs } from '@client/components/features/job-detail/job-diffs';
 import { JobDetailSkeleton } from '@client/components/features/job-detail/job-skeleton';
-import { cn } from '@client/lib/utils';
+import { cn } from '@codra/ui/utils';
 
 type DetailTab = 'overview' | 'files';
 
diff --git a/src/client/pages/job-logs.tsx b/src/client/pages/job-logs.tsx
index 5fe38511..083f6f1e 100644
--- a/src/client/pages/job-logs.tsx
+++ b/src/client/pages/job-logs.tsx
@@ -1,8 +1,9 @@
+import { Badge, CopyButton, LoadError } from '@codra/ui';
 import { useEffect, useMemo, useState } from 'react';
 import { useParams, Link } from 'react-router-dom';
-import { LoadError } from '@client/components/shared/load-error';
-import { CopyButton } from '@client/components/shared/copy-button';
-import { preventToggleOnTextSelection } from '@client/lib/selection';
+
+
+import { preventToggleOnTextSelection } from '@codra/ui/selection';
 import { readDiffsCache, writeDiffsCache } from '@client/lib/diffs-cache';
 import { groupBatches } from '@client/lib/batch-groups';
 import type { BatchGroup } from '@client/lib/batch-groups';
@@ -13,11 +14,11 @@ import {
 } from 'lucide-react';
 import { useJobDetail } from '@client/hooks/use-job-detail';
 import { JobDetailSkeleton } from '@client/components/features/job-detail/job-skeleton';
-import { Badge } from '@client/components/ui/badge';
+
 import { api } from '@client/lib/api';
 import type { FileReviewRecord } from '@codra/schema';
 
-import { formatPreciseDuration } from '@client/lib/utils';
+import { formatPreciseDuration } from '@codra/ui/utils';
 
 function fmtK(n: number | null) {
   if (n === null) return null;
diff --git a/src/client/pages/jobs.tsx b/src/client/pages/jobs.tsx
index e60c7a9d..7e9e9e9b 100644
--- a/src/client/pages/jobs.tsx
+++ b/src/client/pages/jobs.tsx
@@ -1,11 +1,7 @@
+import { Button, EmptyState, Input, LoadError, Select } from '@codra/ui';
 import { useState, useCallback } from 'react';
 import { api } from '@client/lib/api';
 import { JobsTable } from '@client/components/shared/jobs-table';
-import { EmptyState } from '@client/components/shared/empty-state';
-import { Button } from '@client/components/ui/button';
-import { Input } from '@client/components/ui/input';
-import { Select } from '@client/components/ui/select';
-import { LoadError } from '@client/components/shared/load-error';
 import { PageHeader } from '@client/components/layout/page-header';
 import { usePolling } from '@client/hooks/use-polling';
 import { Activity, ChevronLeft, ChevronRight, ListFilter, RefreshCw, Search } from 'lucide-react';
diff --git a/src/client/pages/landing.tsx b/src/client/pages/landing.tsx
index ff96e057..7168fe39 100644
--- a/src/client/pages/landing.tsx
+++ b/src/client/pages/landing.tsx
@@ -1,7 +1,6 @@
+import { Button, GithubMark, LinkButton } from '@codra/ui';
 import { Sun, Moon, ExternalLink } from 'lucide-react';
-import { Button, LinkButton } from '@client/components/ui/button';
-import { useTheme } from '@client/lib/theme';
-import { GithubMark } from '@client/components/shared/github-mark';
+import { useTheme } from '@codra/ui/theme';
 import codraDark from '@/assets/codra-fullicon-dark.svg';
 import codraLight from '@/assets/codra-fullicon-light.svg';
 
diff --git a/src/client/pages/login.tsx b/src/client/pages/login.tsx
index 63cc1133..1092ee9d 100644
--- a/src/client/pages/login.tsx
+++ b/src/client/pages/login.tsx
@@ -1,8 +1,8 @@
+import { GithubMark } from '@codra/ui';
 import { useMemo } from 'react';
 import { useSearchParams, Link } from 'react-router-dom';
 import { Sun, Moon, ShieldCheck, ArrowLeft, AlertCircle } from 'lucide-react';
-import { useTheme } from '@client/lib/theme';
-import { GithubMark } from '@client/components/shared/github-mark';
+import { useTheme } from '@codra/ui/theme';
 import codraDark from '@/assets/codra-fullicon-dark.svg';
 import codraLight from '@/assets/codra-fullicon-light.svg';
 
diff --git a/src/client/pages/not-found.tsx b/src/client/pages/not-found.tsx
index 42f41423..90914de4 100644
--- a/src/client/pages/not-found.tsx
+++ b/src/client/pages/not-found.tsx
@@ -1,5 +1,5 @@
+import { Button } from '@codra/ui';
 import { Link } from 'react-router-dom';
-import { Button } from '@client/components/ui/button';
 import { Ghost, Home, ArrowLeft } from 'lucide-react';
 
 export function NotFoundPage() {
diff --git a/src/client/pages/repos.tsx b/src/client/pages/repos.tsx
index 47cc0b6d..5905b65c 100644
--- a/src/client/pages/repos.tsx
+++ b/src/client/pages/repos.tsx
@@ -1,15 +1,10 @@
+import { Button, EmptyState, Input, LinkButton, LoadError, Select, Skeleton } from '@codra/ui';
 import { useEffect, useMemo, useReducer, useState } from 'react';
 import { toast } from 'sonner';
 import { api } from '@client/lib/api';
-import { Skeleton } from '@client/components/shared/skeleton';
-import { EmptyState } from '@client/components/shared/empty-state';
-import { Button, LinkButton } from '@client/components/ui/button';
-import { LoadError } from '@client/components/shared/load-error';
 import { PageHeader } from '@client/components/layout/page-header';
-import { Input } from '@client/components/ui/input';
-import { Select } from '@client/components/ui/select';
 import { GitBranch, RefreshCw, ArrowUpRight, Search } from 'lucide-react';
-import { cn } from '@client/lib/utils';
+import { cn } from '@codra/ui/utils';
 import type { RepoConfigRecord } from '@codra/schema';
 import {
   EMPTY_MODEL_ROUTE,
diff --git a/src/client/pages/settings.tsx b/src/client/pages/settings.tsx
index f927a1f7..a354072c 100644
--- a/src/client/pages/settings.tsx
+++ b/src/client/pages/settings.tsx
@@ -1,10 +1,8 @@
+import { Alert, Button, LoadError } from '@codra/ui';
 import { useEffect, useState } from 'react';
 import { PageHeader } from '@client/components/layout/page-header';
-import { Button } from '@client/components/ui/button';
-import { Alert } from '@client/components/ui/alert';
-import { LoadError } from '@client/components/shared/load-error';
 import { RefreshCw, Plus, X } from 'lucide-react';
-import { cn } from '@client/lib/utils';
+import { cn } from '@codra/ui/utils';
 import { AboutSection } from '@client/components/features/settings/about-section';
 import { DefaultModelsSection } from '@client/components/features/settings/default-models-section';
 import { NewProviderForm } from '@client/components/features/settings/new-provider-form';
diff --git a/src/client/pages/stats.tsx b/src/client/pages/stats.tsx
index 6f39cfaa..82e41204 100644
--- a/src/client/pages/stats.tsx
+++ b/src/client/pages/stats.tsx
@@ -1,8 +1,8 @@
+import { LoadError } from '@codra/ui';
 import { useEffect, useState } from 'react';
 import { PageHeaderActions } from '@client/components/shared/page-header-actions';
 import { PageHeader } from '@client/components/layout/page-header';
-import { LoadError } from '@client/components/shared/load-error';
-import { useIsDarkMode } from '@client/hooks/use-is-dark-mode';
+import { useIsDarkMode } from '@codra/ui/hooks';
 import { usePolling } from '@client/hooks/use-polling';
 import { useStatsRange } from '@client/hooks/use-stats-range';
 import { api } from '@client/lib/api';
diff --git a/src/server/adapters/file-review-store.ts b/src/server/adapters/file-review-store.ts
index 7ab97704..bc68d2ff 100644
--- a/src/server/adapters/file-review-store.ts
+++ b/src/server/adapters/file-review-store.ts
@@ -1,31 +1,13 @@
-import type { FileReviewStore } from '@codra/core/ports';
 import type { AppBindings } from '@server/env';
-import {
-  bulkInheritFileReviews,
-  bulkMarkFilesFailed,
-  bulkRecordRetryableFileReviewFailures,
-  bulkUpsertFileReviews,
-  getFileReviewsForJobs,
-  getSuppressedFindings,
-  markCommentDispositions,
-  markCommentsPosted,
-  recordRetryableFileReviewFailure,
-  upsertFileReview,
-} from '@server/db/file-reviews';
+import type { FileReviewStore } from '@codra/core/ports';
+import { makeFileReviewStore as makeDbFileReviewStore } from '@codra/db/repositories';
+import type { DbEnv } from '@codra/db/env';
 
 export function makeFileReviewStore(env: AppBindings): FileReviewStore {
-  return {
-    upsertFileReview: (jobId, input) => upsertFileReview(env, jobId, input),
-    recordRetryableFileReviewFailure: (jobId, input) => recordRetryableFileReviewFailure(env, jobId, input),
-    getFileReviewsForJobs: (jobIds) => getFileReviewsForJobs(env, jobIds),
-
-    bulkInheritFileReviews: (input) => bulkInheritFileReviews(env, input),
-    bulkUpsertFileReviews: (jobId, inputs) => bulkUpsertFileReviews(env, jobId, inputs),
-    bulkRecordRetryableFileReviewFailures: (jobId, inputs, opts) => bulkRecordRetryableFileReviewFailures(env, jobId, inputs, opts),
-    bulkMarkFilesFailed: (jobId, files, opts) => bulkMarkFilesFailed(env, jobId, files, opts),
-
-    getSuppressedFindings: (jobId) => getSuppressedFindings(env, jobId),
-    markCommentsPosted: (jobId, fingerprints) => markCommentsPosted(env, jobId, fingerprints),
-    markCommentDispositions: (jobId, byFingerprint) => markCommentDispositions(env, jobId, byFingerprint),
+  const dbEnv: DbEnv = {
+    HYPERDRIVE: env.HYPERDRIVE,
+    APP_KV: env.APP_KV,
+    workerMode: true,
   };
+  return makeDbFileReviewStore(dbEnv);
 }
diff --git a/src/server/adapters/jobs-store.ts b/src/server/adapters/jobs-store.ts
index 4aff94f9..24a01c7d 100644
--- a/src/server/adapters/jobs-store.ts
+++ b/src/server/adapters/jobs-store.ts
@@ -1,78 +1,13 @@
-import type { JobLeaseClaim as CoreJobLeaseClaim, JobRow as CoreJobRow, JobStore, PersistedReviewJob } from '@codra/core/ports';
 import type { AppBindings } from '@server/env';
-import {
-  claimJobLease,
-  completeJob,
-  completePreparationStep,
-  failJob,
-  findExistingJobForHead,
-  getJobForProcessing,
-  getOtherRunningJobsCount,
-  heartbeatJobLease,
-  insertJob,
-  mapJob,
-  markJobCheckRunCompleted,
-  markJobContinuationQueued,
-  releaseJobLease,
-  resetJobContinuationCount,
-  setJobPullRequestMeta,
-  setJobWorkflowInstance,
-  supersedeOlderJobs,
-  updateJobCheckRun,
-  updateJobStep,
-  type JobRow,
-} from '@server/db/jobs';
-
-// Pins PersistedReviewJob to what mapJob actually returns, in both directions. mapJob ends in
-// jobSummarySchema.parse(), so the two are already the same type -- this makes that a compile error
-// to break rather than something to notice later.
-type _PinPersistedReviewJob = ReturnType<typeof mapJob> extends PersistedReviewJob
-  ? PersistedReviewJob extends ReturnType<typeof mapJob> ? true : never
-  : never;
-const _pinPersistedReviewJob: _PinPersistedReviewJob = true;
-void _pinPersistedReviewJob;
-
-// JobLeaseClaim is the one port contract that stays hand-copied rather than re-exported: the db
-// version carries the FULL jobs row, which the engine must not see, so the two cannot be the same
-// type. This pins the part that matters -- the discriminant set and the extra `busy` field -- so
-// adding a fifth status on the db side is a compile error here rather than a silent fall-through in
-// the engine's claim ladder.
-type _PinLeaseStatuses = Awaited<ReturnType<typeof claimJobLease>>['status'] extends CoreJobLeaseClaim['status']
-  ? CoreJobLeaseClaim['status'] extends Awaited<ReturnType<typeof claimJobLease>>['status'] ? true : never
-  : never;
-const _pinLeaseStatuses: _PinLeaseStatuses = true;
-void _pinLeaseStatuses;
-
-type _PinBusyRetryField = Extract<Awaited<ReturnType<typeof claimJobLease>>, { status: 'busy' }>['retryAfterSeconds'] extends number ? true : never;
-const _pinBusyRetryField: _PinBusyRetryField = true;
-void _pinBusyRetryField;
+import type { JobStore } from '@codra/core/ports';
+import { makeJobStore as makeDbJobStore } from '@codra/db/repositories';
+import type { DbEnv } from '@codra/db/env';
 
 export function makeJobStore(env: AppBindings): JobStore {
-  return {
-    // The one cast in the extraction. The db row type flows INTO core's JobRow freely (it is an
-    // object-literal alias, so TS gives it an implicit index signature); only the return leg needs
-    // telling that a row core handed back is the same row it was given.
-    mapJob: (row: CoreJobRow) => mapJob(row as unknown as JobRow),
-
-    getJobForProcessing: (jobId) => getJobForProcessing(env, jobId),
-    claimJobLease: (jobId, leaseOwner, leaseSeconds) => claimJobLease(env, jobId, leaseOwner, leaseSeconds),
-    heartbeatJobLease: (jobId, leaseOwner, leaseSeconds) => heartbeatJobLease(env, jobId, leaseOwner, leaseSeconds),
-    releaseJobLease: (jobId, leaseOwner) => releaseJobLease(env, jobId, leaseOwner),
-    markJobContinuationQueued: (jobId, delaySeconds) => markJobContinuationQueued(env, jobId, delaySeconds),
-    resetJobContinuationCount: (jobId) => resetJobContinuationCount(env, jobId),
-    getOtherRunningJobsCount: (excludeJobId) => getOtherRunningJobsCount(env, excludeJobId),
-
-    setJobWorkflowInstance: (jobId, workflowInstanceId) => setJobWorkflowInstance(env, jobId, workflowInstanceId),
-    setJobPullRequestMeta: (jobId, meta) => setJobPullRequestMeta(env, jobId, meta),
-    insertJob: (input) => insertJob(env, input),
-    findExistingJobForHead: (input) => findExistingJobForHead(env, input),
-
-    updateJobCheckRun: (jobId, checkRunId) => updateJobCheckRun(env, jobId, checkRunId),
-    markJobCheckRunCompleted: (jobId) => markJobCheckRunCompleted(env, jobId),
-    completePreparationStep: (jobId, fileCount) => completePreparationStep(env, jobId, fileCount),
-    updateJobStep: (jobId, stepName, update) => updateJobStep(env, jobId, stepName, update),
-    completeJob: (jobId, input) => completeJob(env, jobId, input),
-    failJob: (jobId, errorMessage) => failJob(env, jobId, errorMessage),
-    supersedeOlderJobs: (input) => supersedeOlderJobs(env, input),
+  const dbEnv: DbEnv = {
+    HYPERDRIVE: env.HYPERDRIVE,
+    APP_KV: env.APP_KV,
+    workerMode: true,
   };
+  return makeDbJobStore(dbEnv);
 }
diff --git a/src/server/adapters/settings-store.ts b/src/server/adapters/settings-store.ts
index 9d635b13..55be40cc 100644
--- a/src/server/adapters/settings-store.ts
+++ b/src/server/adapters/settings-store.ts
@@ -1,30 +1,31 @@
-import type { LearningStore, ModelConfigReader, RepoConfigLoader, ReviewSettingsReader, WebhookDeliveryReader } from '@codra/core/ports';
 import type { AppBindings } from '@server/env';
-import { getReviewSettings } from '@server/db/app-settings';
-import { getResolvedModelConfig } from '@server/db/model-configs';
-import { getWebhookDelivery } from '@server/db/webhook-deliveries';
-import { getRejectedExemplars, getRepositoryIdForJob } from '@server/db/learning';
+import type { LearningStore, ModelConfigReader, RepoConfigLoader, ReviewSettingsReader, WebhookDeliveryReader } from '@codra/core/ports';
+import { makeLearningStore as makeDbLearningStore, makeModelConfigReader as makeDbModelConfigReader, makeReviewSettingsReader as makeDbReviewSettingsReader, makeWebhookDeliveryReader as makeDbWebhookDeliveryReader } from '@codra/db/repositories';
+import type { DbEnv } from '@codra/db/env';
 import { loadRepoConfig } from '@server/core/config';
 
+function toDbEnv(env: AppBindings): DbEnv {
+  return {
+    HYPERDRIVE: env.HYPERDRIVE,
+    APP_KV: env.APP_KV,
+    workerMode: true,
+  };
+}
+
 export function makeReviewSettingsReader(env: AppBindings): ReviewSettingsReader {
-  return { getReviewSettings: () => getReviewSettings(env) };
+  return makeDbReviewSettingsReader(toDbEnv(env));
 }
 
 export function makeModelConfigReader(env: AppBindings): ModelConfigReader {
-  // Returns the full ResolvedModelConfig, which the narrower port type discards -- deliberately, so
-  // encryptedApiKey has no path into the engine.
-  return { getResolvedModelConfig: (modelId) => getResolvedModelConfig(env, modelId) };
+  return makeDbModelConfigReader(toDbEnv(env));
 }
 
 export function makeWebhookDeliveryReader(env: AppBindings): WebhookDeliveryReader {
-  return { getWebhookDelivery: (deliveryId) => getWebhookDelivery(env, deliveryId) };
+  return makeDbWebhookDeliveryReader(toDbEnv(env));
 }
 
 export function makeLearningStore(env: AppBindings): LearningStore {
-  return {
-    getRepositoryIdForJob: (jobId) => getRepositoryIdForJob(env, jobId),
-    getRejectedExemplars: (input) => getRejectedExemplars(env, input),
-  };
+  return makeDbLearningStore(toDbEnv(env));
 }
 
 export function makeRepoConfigLoader(env: AppBindings): RepoConfigLoader {
diff --git a/src/server/core/config.ts b/src/server/core/config.ts
index bfc39859..04a69446 100644
--- a/src/server/core/config.ts
+++ b/src/server/core/config.ts
@@ -1,7 +1,7 @@
 import { defaultRepoConfig, normalizeRepoModelConfig, repoConfigSchema, type RepoConfig } from '@codra/schema';
 import { REPO_CONFIG_CACHE_VERSION } from '@codra/schema';
 import type { AppBindings } from '@server/env';
-import { getRepoConfigRecord, syncRepoConfig } from '@server/db/repo-configs';
+import { getRepoConfigRecord, syncRepoConfig } from '@codra/db/repo-configs';
 
 type CachedConfig = {
   parsedJson: RepoConfig;
diff --git a/src/server/core/job-recovery.ts b/src/server/core/job-recovery.ts
index a3cd7087..ecbeb216 100644
--- a/src/server/core/job-recovery.ts
+++ b/src/server/core/job-recovery.ts
@@ -1,5 +1,5 @@
 import type { AppBindings } from '@server/env';
-import { getTerminalJobsNeedingCheckRunCompletion, markJobCheckRunCompleted, recoverExpiredJobLeases } from '@server/db/jobs';
+import { getTerminalJobsNeedingCheckRunCompletion, markJobCheckRunCompleted, recoverExpiredJobLeases } from '@codra/db/jobs';
 import { logger } from '@server/core/logger';
 import { GitHubService } from '@codra/provider-github';
 
diff --git a/src/server/core/telemetry.ts b/src/server/core/telemetry.ts
index 55197cb3..51a86936 100644
--- a/src/server/core/telemetry.ts
+++ b/src/server/core/telemetry.ts
@@ -4,7 +4,7 @@ import { logger } from './logger';
 const TELEMETRY_SECRET = 'codra-telemetry-v1-secret-8f9a2b5c';
 const INSTANCE_ID_KEY = 'codra:instance_id';
 
-import { queryRows } from '@server/db/client';
+import { queryRows } from '@codra/db/client';
 // Static import: version string is inlined at build time by Vite - no runtime cost.
 import pkg from '../../../package.json';
 
diff --git a/src/server/index.ts b/src/server/index.ts
index f3f8107b..1b515e58 100644
--- a/src/server/index.ts
+++ b/src/server/index.ts
@@ -4,8 +4,8 @@ import type { AppBindings } from './env';
 import { reviewJobMessageSchema } from '@codra/schema';
 import { logger } from '@server/core/logger';
 import { disposeRpc } from '@server/core/rpc';
-import { runWithDb } from '@server/db/client';
-import { failJob, hasPendingMaintenanceWork, clearSystemActive } from '@server/db/jobs';
+import { runWithDb } from '@codra/db/client';
+import { failJob, hasPendingMaintenanceWork, clearSystemActive } from '@codra/db/jobs';
 import { runBestEffortJobMaintenance } from '@server/core/job-recovery';
 
 const app = createApp();
diff --git a/src/server/models/google.ts b/src/server/models/google.ts
index 1b3c4bf8..c821fbe0 100644
--- a/src/server/models/google.ts
+++ b/src/server/models/google.ts
@@ -10,26 +10,24 @@ import {
   resolveOutputTokenCeiling,
 } from './limits';
 
-/** Fallback when the caller supplies no diff-size-aware budget. */
+/** Fallback timeout if caller omits budget. */
 const GEMINI_TIMEOUT_MS = MODEL_TIMEOUT_MAX_MS;
 const GEMINI_MAX_RETRIES = 2;
-// Floor, used when the caller states no budget (verify and summary, which answer in well under this).
+// Output floor for low-budget tasks (verify, summary).
 const GEMINI_DEFAULT_OUTPUT_TOKENS = OUTPUT_TOKENS_FLOOR;
-// What a review call may claim when it asks for room. The old single 8192 for every call was the
-// binding constraint on findings: thinking tokens bill against it, so a six-file bin asked for ~120
-// findings inside a window that held ~35 and answered with near-empty arrays.
+// Max output claims. 65k allows room for thinking tokens and dense multi-file bins.
 const GEMINI_MAX_OUTPUT_TOKENS = 65_536;
-// Cap on any in-call retry sleep; a longer cool-off is better served by deferring the file than by pinning a gate slot here.
+// Cap on retry sleeps; longer cool-offs defer files to free up gates.
 const GEMINI_MAX_RETRY_DELAY_MS = 5_000;
 const DEFAULT_GEMINI_BASE_URL = 'https://generativelanguage.googleapis.com/v1beta';
 
-// 429 is handled separately: it is retryable only when the provider names a cool-off we can wait out.
+// 429 handled separately (only retryable if cool-off is stated).
 function isRetryableGeminiStatus(status: number) {
   return status === 408 || status === 500 || status === 502 || status === 503 || status === 504 || status === 524;
 }
 
 function defaultRetryDelayMs(attempt: number) {
-  // ~0.8s then ~1.6s: a transient Gemini 5xx usually clears within a second or two.
+  // Exponential backoff for transient 5xx errors (clears quickly).
   return Math.pow(2, attempt) * 800 + Math.random() * 400;
 }
 
@@ -48,7 +46,7 @@ function retryAfterDelayMs(value: string | null) {
   return null;
 }
 
-// Google states the cool-off in the body ("Please retry in 56.158s.") too; without reading it a quota 429 looks indefinitely retryable.
+// Extract body cool-off ("Please retry in Xs.") to avoid indefinite 429 retries.
 function requestedRetryDelayFromBody(message: string): number | null {
   const match = /retry in ([\d.]+)s/i.exec(message);
   if (!match) return null;
@@ -56,7 +54,7 @@ function requestedRetryDelayFromBody(message: string): number | null {
   return Number.isFinite(seconds) ? seconds * 1000 : null;
 }
 
-// Broad on purpose: a false negative is a chain-wide outage, a false positive one subrequest.
+// Broad matcher (false positives cost 1 subrequest; false negatives break chains).
 function isSchemaRejection(status: number, message: string) {
   if (status !== 400) return false;
   const lower = message.toLowerCase();
@@ -68,18 +66,12 @@ function isSchemaRejection(status: number, message: string) {
     lower.includes('invalid json payload') ||
     lower.includes('unknown name') ||
     lower.includes('schema') ||
-    // The bare, detail-less 400. Google sometimes rejects a request with nothing but "Request
-    // contains an invalid argument." and no `error.details`, so none of the specific markers above
-    // can fire and the file used to fail permanently on its FIRST 400 -- no schema probe, no
-    // fallback, because a 400 is not transient. Only consulted when a grammar was actually sent, so
-    // the worst case is one extra schema-less attempt that 400s again and rethrows the real message.
+    // Bare 400 catch-all to prevent permanent schema failures. Worst case: one extra failed schema-less attempt.
     lower.includes('invalid argument')
   );
 }
 
-// Narrow, and probed BEFORE isSchemaRejection: that one matches "unknown name" and "invalid argument",
-// so an endpoint or model that does not know `thinkingConfig` would otherwise be read as a grammar
-// rejection, dropping the schema while still sending the field that was actually refused.
+// Narrow matcher probed BEFORE isSchemaRejection to prevent misidentifying thinking-config refusals as schema drops.
 function isThinkingRejection(status: number, message: string) {
   if (status !== 400) return false;
   const lower = message.toLowerCase();
@@ -88,7 +80,7 @@ function isThinkingRejection(status: number, message: string) {
 
 function isRetryableTransportError(error: unknown) {
   if (!(error instanceof Error)) return false;
-  // Never retry timeouts: the caller already grants up to 2 minutes, so let the fallback chain take over instead.
+  // Don't retry timeouts (caller grants up to 2m); defer to fallback chains.
   if (error.name === 'TimeoutError' || error.message.toLowerCase().includes('timed out')) return false;
   if (error.message.includes('fetch failed')) return true;
   return error instanceof TypeError;
@@ -108,13 +100,11 @@ export async function reviewWithGoogle(
   const responseJsonSchema = input.responseSchema
     ? toGeminiResponseJsonSchema(input.responseSchema.schema)
     : null;
-  // Latched: once the endpoint rejects the grammar, every later attempt goes without it.
+  // Latches to disable features on subsequent attempts if rejected.
   let schemaRejected = false;
-  // Same latch for `thinkingConfig`: the 2.0-era models and some proxies do not accept the field.
   let thinkingRejected = false;
 
-  // Room for the JSON alone, then thinking ON TOP of it. Summing rather than sharing is the fix: with
-  // one flat ceiling for both, a thinking model spent it deliberating and returned a truncated prefix.
+  // Summing JSON and thinking token budgets prevents truncated prefixes.
   const answerBudget = resolveOutputTokenCeiling(
     input.outputBudgetTokens,
     GEMINI_MAX_OUTPUT_TOKENS,
@@ -122,8 +112,7 @@ export async function reviewWithGoogle(
   );
   const thinkingBudget = geminiThinkingBudgetTokens(answerBudget);
   const outputCeiling = Math.min(GEMINI_MAX_OUTPUT_TOKENS, answerBudget + thinkingBudget);
-  // The caller latches per (provider, model, grammar) off this flag. Marking the error too means a
-  // schema-dropped attempt that then fails still teaches the caller, instead of re-probing next call.
+  // Mark error so caller latches schema-dropped state even on subsequent failure.
   const fail = (error: unknown): never => {
     if (schemaRejected && typeof error === 'object' && error !== null) {
       Object.defineProperty(error, 'schemaDropped', { value: true, configurable: true });
@@ -164,15 +153,14 @@ export async function reviewWithGoogle(
               { role: 'user', parts: [{ text: prompts.user }] },
             ],
             generationConfig: {
-              // Required alongside a grammar, and the schema-less summary path needs it too.
+              // Required for schemas and summary path.
               responseMimeType: 'application/json',
-              // See gemini-schema.ts for why not `responseSchema`.
+              // See gemini-schema.ts.
               ...(responseJsonSchema && !schemaRejected ? { responseJsonSchema } : {}),
               maxOutputTokens: outputCeiling,
-              // Bounded on purpose: thinking bills against maxOutputTokens, so leaving it dynamic lets
-              // it eat the ceiling and return a prefix of the JSON.
+              // Bounded thinking budget so it doesn't consume the output ceiling.
               ...(thinkingRejected ? {} : { thinkingConfig: { thinkingBudget } }),
-              // See the note in models/types.ts on sampling. 0.9 on Gemini's 0-2 scale.
+              // 0.9 on Gemini's 0-2 scale.
               temperature: 0.9,
             },
           }),
@@ -191,7 +179,7 @@ export async function reviewWithGoogle(
       const errorText = await response.text();
       const message = providerErrorMessage(errorText);
 
-      // Before the schema probe: isSchemaRejection is deliberately broad and would swallow this.
+      // Check thinking first; isSchemaRejection is broad.
       if (!thinkingRejected && isThinkingRejection(response.status, message)) {
         thinkingRejected = true;
         logger.warn('Gemini rejected thinkingConfig; retrying without an explicit thinking budget', {
@@ -199,20 +187,20 @@ export async function reviewWithGoogle(
           error: message,
         });
         lastError = new ProviderRequestError(config.providerName ?? 'Google', response.status, message);
-        // Attempt refunded, no sleep: the latch bounds this to one extra probe, as with the grammar.
+        // Refund attempt (no sleep); latched.
         attempt--;
         continue;
       }
 
       if (responseJsonSchema && !schemaRejected && isSchemaRejection(response.status, message)) {
         schemaRejected = true;
-        // Inferred, not established: another cause 400s again and throws the real message below.
+        // Inferred schema rejection; real cause thrown below if 400 recurs.
         logger.warn('Gemini returned a 400 that looks like a response-grammar rejection; retrying without constrained decoding', {
           model,
           error: message,
         });
         lastError = new ProviderRequestError(config.providerName ?? 'Google', response.status, message);
-        // Attempt refunded, no sleep: the probe isn't a transient rung and the latch bounds it to one.
+        // Refund attempt (no sleep); latched.
         attempt--;
         continue;
       }
@@ -220,8 +208,7 @@ export async function reviewWithGoogle(
       const requestedDelayMs = response.status === 429
         ? retryAfterDelayMs(response.headers.get('retry-after')) ?? requestedRetryDelayFromBody(message)
         : null;
-      // An unstated 429 cool-off is ~60s by construction on a per-minute bucket, so backing off ~1s
-      // buys a second 429 and a second full prompt re-send. Only a stated, short cool-off is retryable.
+      // Unstated 429s back-off for ~60s, making them unretryable here. Retry only on short, stated cool-offs.
       const isRetryable = response.status === 429
         ? requestedDelayMs !== null && requestedDelayMs <= GEMINI_MAX_RETRY_DELAY_MS
         : isRetryableGeminiStatus(response.status);
@@ -236,9 +223,7 @@ export async function reviewWithGoogle(
         willRetry: isRetryable && attempt < maxRetries,
         requestedDelayMs: requestedDelayMs ?? undefined,
         retryDelayMs: isRetryable && attempt < maxRetries ? retryDelayMs : undefined,
-        // A bare "Request contains an invalid argument." with no `error.details` is unactionable, and
-        // without the body there is no way to learn what Google objected to. Bounded, and only on a
-        // 4xx we are about to give up on -- one body per genuinely failed call, never on a retry rung.
+        // Log bounded raw body for terminal 4xx to debug unactionable "invalid argument" errors.
         rawBody: response.status >= 400 && response.status < 500 && !(isRetryable && attempt < maxRetries)
           ? errorText.slice(0, 2_000)
           : undefined,
@@ -262,7 +247,7 @@ export async function reviewWithGoogle(
       usageMetadata?: {
         promptTokenCount?: number;
         candidatesTokenCount?: number;
-        // Billed against `maxOutputTokens` but reported separately.
+        // Billed against `maxOutputTokens`.
         thoughtsTokenCount?: number;
       };
     };
@@ -271,20 +256,17 @@ export async function reviewWithGoogle(
     const rawText = candidate?.content?.parts?.map((part) => part.text ?? '').join('')?.trim();
     if (!rawText) {
       const finishReason = candidate?.finishReason;
-      // A thinking model burning budget before emitting text, or a safety block, is deterministic and should fail permanently; an empty STOP is transient.
+      // Deterministic non-STOP (budget burn, safety) fails permanently; empty STOP is transient.
       if (finishReason && finishReason !== 'STOP') {
         return fail(new UnparseableModelResponseError(model, `finishReason=${finishReason}`));
       }
       return fail(new Error('Gemini returned an empty response.'));
     }
 
-    // A non-empty non-STOP response is only a prefix: json.ts repairs the braces and the tail findings vanish silently.
+    // Log non-STOP prefix truncations.
     if (candidate?.finishReason && candidate.finishReason !== 'STOP') {
       logger.warn(`Gemini response for ${model} ended with finishReason=${candidate.finishReason}; output is likely incomplete`, {
-        // NONE of these may be named `...Tokens`: logger.ts redacts any key containing "token", so the
-        // previous `outputTokens`/`maxOutputTokens` pair logged as [REDACTED] and this warning could
-        // never show how close to the ceiling a truncated response actually got.
-        // Thinking bills against the same ceiling, so compare the sum.
+        // Avoid `Tokens` key name to bypass logger redaction. Sum thinking + output spend.
         outputSpend: (data.usageMetadata?.candidatesTokenCount ?? 0) + (data.usageMetadata?.thoughtsTokenCount ?? 0),
         thoughtSpend: data.usageMetadata?.thoughtsTokenCount ?? 0,
         outputCeiling,
diff --git a/src/server/models/limits.ts b/src/server/models/limits.ts
index 8bc9e230..0bf8b144 100644
--- a/src/server/models/limits.ts
+++ b/src/server/models/limits.ts
@@ -1,30 +1,20 @@
-// Two Workers Free-plan constraints shape all of it: (1) at most 6 connections per invocation may await headers at once, or the runtime silently queues and burns the call's own timeout undispatched; (2) 50 subrequests per invocation, so a queued-then-timed-out call is a wasted one.
+// Free-plan constraints: 6 concurrent connections max, 50 subrequests per invocation.
 
-// Base budget for a small diff. A suitable model answers in ~1-5s; slower means stuck or queued.
+// Base timeout for small diffs (~1-5s response expected).
 export const MODEL_TIMEOUT_BASE_MS = 20_000;
 const MODEL_TIMEOUT_PER_LINE_MS = 100;
 const MODEL_TIMEOUT_FREE_LINES = 100;
-// Hard ceiling for one call, still well under the ~120s invocation wall clock: at the old 120s ceiling a hung call took the whole invocation down as `exceededCpu` instead of failing over.
+// Hard ceiling (max 50s) avoids 120s `exceededCpu` runtime limits, allowing failovers.
 export const MODEL_TIMEOUT_MAX_MS = 50_000;
 
-// Budget for one file's entire fallback chain; past this, defer the file to RESUME AT THE NEXT MODEL in
-// a fresh invocation (ModelChainProgressStore holds the position, so nothing is replayed). Deliberately
-// only a little above MODEL_TIMEOUT_MAX_MS: a big bin therefore spends an invocation on ONE model and
-// gets the full ceiling to itself, rather than splitting the budget and giving every model too little.
-// The chain still gets walked, one model per continuation, bounded by MAX_RETRYABLE_FILE_REVIEW_FAILURES.
+// File's total fallback chain budget. Exceeding defers the file to a fresh invocation.
+// Sized slightly above MODEL_TIMEOUT_MAX_MS to give big diffs the full ceiling on a single model.
 export const MODEL_FALLBACK_CHAIN_BUDGET_MS = 55_000;
 
-// What an answer costs in wall clock, per 1,000 output tokens the caller has asked room for. Latency
-// here tracks how much the model WRITES (and thinks), which the diff size only loosely predicts: a
-// two-file bin is 60 diff lines and therefore got the 20s base, while its median answer took 18s on
-// gemini-2.5-flash and 31% of those calls overran the ceiling their diff size had earned them. Sizing
-// the timeout off the same `reviewOutputBudgetTokens` figure the prompt is built from removes that
-// mismatch, and the MODEL_TIMEOUT_MAX_MS cap still bounds the worst case.
+// Scaled timeout buffer based on requested output tokens (1200ms per 1k tokens) to accommodate model generation time.
 const MODEL_TIMEOUT_PER_1K_OUTPUT_MS = 1_200;
 
-// Per-call timeout, scaled by the (already truncated) diff being reviewed AND by the size of the answer
-// being requested. `outputBudgetTokens` is optional: a caller that omits it keeps the old arithmetic
-// exactly, so the verify and summary paths are unaffected.
+// Per-call timeout, scaled by diff size and expected output budget.
 export function adaptiveModelTimeoutMs(
   diffLineCount: number | null | undefined,
   outputBudgetTokens?: number | null,
@@ -41,33 +31,22 @@ export function adaptiveModelTimeoutMs(
   return Math.min(MODEL_TIMEOUT_MAX_MS, scaled + answerAllowance);
 }
 
-// One call must always fit the chain budget, or the HEAD of every chain would be deferred before it
-// ever ran -- a job that never calls a model at all. Enforced here rather than at the call sites so
-// raising MODEL_TIMEOUT_MAX_MS past the chain budget cannot quietly produce that.
+// Clamps timeout so single calls never exceed the chain budget and loop endlessly without running.
 export function clampTimeoutToChainBudget(timeoutMs: number): number {
   return Math.min(timeoutMs, MODEL_FALLBACK_CHAIN_BUDGET_MS);
 }
 
-// Kept below the runtime's 6-connection cap so KV/Hyperdrive/GitHub requests from concurrent file reviews still find a free slot.
+// Max 3 calls limits connection pool (out of 6 max) to leave slots for KV/GitHub.
 export const MAX_CONCURRENT_MODEL_CALLS = 3;
 
-// What one finding costs on the wire: a body capped at 160 words (~210 tokens), an `evidence` quote, a
-// title, an optional `code_suggestion`, and the JSON scaffolding around them. Deliberately generous --
-// under-budgeting truncates the response, and a truncated response is repaired into valid JSON with its
-// tail findings silently gone (see the finishReason note in google.ts), which reads as "the file is clean".
+// Token cost of a single finding (JSON structure). Generous to avoid silent truncations.
 const OUTPUT_TOKENS_PER_FINDING = 340;
-// Per file entry in a batched response: the path, `overall_explanation`, `overall_correctness`.
+// Tokens per file entry in batch response.
 const OUTPUT_TOKENS_PER_FILE_ENTRY = 160;
 // Enough for the verify/summary paths and any caller that states no budget.
 export const OUTPUT_TOKENS_FLOOR = 8_192;
 
-// Room the ANSWER needs -- reasoning tokens are NOT included, and adapters that bill thinking against
-// the same ceiling must add their thinking budget on top of this rather than carve it out of it.
-//
-// Sized from the ASK, not from the diff: a bin told it may return N findings per file across F files
-// must be able to emit F*N of them, or the instruction and the ceiling contradict each other and the
-// model resolves that by returning almost nothing. Callers pass this as `ModelInput.outputBudgetTokens`;
-// each adapter clamps it to its own provider maximum.
+// Output budget sizing (excludes reasoning tokens). Driven by requested capacity (findings * files).
 export function reviewOutputBudgetTokens(input: { findingCap: number; fileCount: number }): number {
   const files = Math.max(1, input.fileCount);
   const findings = Math.max(1, input.findingCap) * files;
@@ -77,8 +56,7 @@ export function reviewOutputBudgetTokens(input: { findingCap: number; fileCount:
   );
 }
 
-// Clamps a caller's requested ceiling into what one provider actually accepts. Centralised so a raised
-// `providerMax` cannot silently apply to a caller that never asked for the room.
+// Clamps output budget to provider maximums.
 export function resolveOutputTokenCeiling(
   requested: number | undefined,
   providerMax: number,
@@ -90,41 +68,25 @@ export function resolveOutputTokenCeiling(
   return Math.min(providerMax, Math.max(providerDefault, Math.ceil(requested)));
 }
 
-// Gemini 2.5 bills `thoughtsTokenCount` against the SAME `maxOutputTokens` the JSON has to fit in, and
-// with no explicit budget it thinks dynamically -- it can consume the whole ceiling and emit only a
-// prefix of the answer. Bounding it is what makes the answer budget mean something; the caller then adds
-// this ON TOP of the answer budget, so thinking can never eat into it.
-// Floored at 1024 and ceilinged at 8192: 0 is refused outright by the Pro models, and every 2.5 model
-// accepts a budget in this band.
+// Gemini 2.5 reasoning budget (1024-8192 bounds). Must be explicitly limited since it counts against maxOutputTokens.
 export function geminiThinkingBudgetTokens(answerBudgetTokens: number): number {
   return Math.min(8_192, Math.max(1_024, Math.floor(answerBudgetTokens / 4)));
 }
 
-// What one attempt can actually cost, as opposed to the ~1 that review/budget.ts budgets it at: the
-// Gemini adapter retries transport errors and may re-probe without its grammar, and a deferral writes
-// chain progress to KV.
+// Actual subrequests cost per attempt (allows for adapter retries/fallback).
 const SUBREQUESTS_PER_MODEL_ATTEMPT = 3;
 
-// Headroom a unit must see before it commits a prompt to the wire. Times the concurrency cap because
-// the check cannot reserve: every in-flight unit may pass it in the same tick and only then start
-// spending, so the floor has to hold for all of them at once.
-//
-// Why a hard floor at all, when budgetAwareFileLimit already sized the chunk: that limit is computed
-// ONCE from the budget at dispatch time and deliberately under-counts (see the note on
-// estimatedSubrequestsPerFile), so a chain would transmit full prompts and learn the invocation was out
-// of subrequests only from the runtime's refusal -- observed paying for three files' prompts before
-// aborting. Declining to start costs nothing, and the unit defers to a fresh budget with its place in
-// the chain remembered.
+// Subrequest headroom before calling models. Multiplied by concurrency cap to ensure pool can execute.
 export const SUBREQUEST_HEADROOM_FOR_MODEL_CALL = SUBREQUESTS_PER_MODEL_ATTEMPT * MAX_CONCURRENT_MODEL_CALLS;
 
-// Tiny FIFO semaphore; callers wait *before* their provider timeout starts, so queueing never eats into a call's own time budget.
+// FIFO semaphore: waits here don't eat into the caller's timeout budget.
 export class ModelCallGate {
   private active = 0;
   private readonly waiters: Array<() => void> = [];
 
   constructor(private readonly limit = MAX_CONCURRENT_MODEL_CALLS) {}
 
-  // `onAcquired` reports queue wait; charging it to a per-file budget would make a busy gate look like a slow model.
+  // onAcquired tracks wait time, preventing busy queues from skewing model latency metrics.
   async run<T>(fn: () => Promise<T>, onAcquired?: (waitedMs: number) => void): Promise<T> {
     const startedWaiting = Date.now();
     await this.acquire();
@@ -149,7 +111,7 @@ export class ModelCallGate {
   }
 
   private release() {
-    // Hand the slot straight to the next waiter so a newly arriving caller can't sneak in ahead of it.
+    // Fair release to next waiter.
     const next = this.waiters.shift();
     if (next) {
       next();
diff --git a/src/server/routes/api/auth.ts b/src/server/routes/api/auth.ts
index 39b44599..8cfcdb3a 100644
--- a/src/server/routes/api/auth.ts
+++ b/src/server/routes/api/auth.ts
@@ -3,7 +3,7 @@ import { Hono } from 'hono';
 import { z } from 'zod';
 import { jsonError } from '@server/core/http';
 import { getUpdatesEmailPreference, syncUpdatesEmail } from '@server/core/updates-email';
-import { getAccountSettings, updateAccountSettings, upsertAccountSettings } from '@server/db/accounts';
+import { getAccountSettings, updateAccountSettings, upsertAccountSettings } from '@codra/db/accounts';
 import type { AppEnv } from '@server/env';
 
 const emailSchema = z.strictObject({
diff --git a/src/server/routes/api/jobs.ts b/src/server/routes/api/jobs.ts
index 2fbb4132..26ba6792 100644
--- a/src/server/routes/api/jobs.ts
+++ b/src/server/routes/api/jobs.ts
@@ -1,10 +1,10 @@
 import { Hono } from 'hono';
 import type { Context } from 'hono';
 import { defaultRepoConfig, findingLabelSchema, jobsQuerySchema } from '@codra/schema';
-import { getFindingLabelTarget } from '@server/db/file-reviews';
-import { clearDashboardFeedback, upsertDashboardFeedback } from '@server/db/comment-feedback';
+import { getFindingLabelTarget } from '@codra/db/file-reviews';
+import { clearDashboardFeedback, upsertDashboardFeedback } from '@codra/db/comment-feedback';
 import type { AppBindings, AppEnv } from '@server/env';
-import { bytesToHex, cancelJob, deleteJob, getJobDetail, getJobForProcessing, insertJob, listJobs, mapJob, supersedeOlderJobs } from '@server/db/jobs';
+import { bytesToHex, cancelJob, deleteJob, getJobDetail, getJobForProcessing, insertJob, listJobs, mapJob, supersedeOlderJobs } from '@codra/db/jobs';
 import { jsonError } from '@server/core/http';
 import { scheduleBestEffortJobMaintenance } from '@server/core/job-recovery';
 import { loadRepoConfig } from '@server/core/config';
diff --git a/src/server/routes/api/models.ts b/src/server/routes/api/models.ts
index 69d4aa00..c2b352f6 100644
--- a/src/server/routes/api/models.ts
+++ b/src/server/routes/api/models.ts
@@ -14,7 +14,7 @@ import {
   updateLlmProvider,
   updateModelConfig,
   upsertDiscoveredModelConfigs,
-} from '@server/db/model-configs';
+} from '@codra/db/model-configs';
 import { jsonError } from '@server/core/http';
 import { getGlobalConfig, updateGlobalConfig } from '@server/core/config';
 import { encryptLlmApiKey, decryptLlmApiKey } from '@server/core/llm-crypto';
diff --git a/src/server/routes/api/repos.ts b/src/server/routes/api/repos.ts
index 1f088ee0..77790ecb 100644
--- a/src/server/routes/api/repos.ts
+++ b/src/server/routes/api/repos.ts
@@ -1,7 +1,7 @@
 import { Hono } from 'hono';
 import { z } from 'zod';
 import type { AppEnv } from '@server/env';
-import { getRepoConfigRecord, listRepoConfigs, upsertRepoConfig, syncRepoConfig, updateRepoConfigEnabled, deleteStaleRepoConfigs } from '@server/db/repo-configs';
+import { getRepoConfigRecord, listRepoConfigs, upsertRepoConfig, syncRepoConfig, updateRepoConfigEnabled, deleteStaleRepoConfigs } from '@codra/db/repo-configs';
 import { jsonError } from '@server/core/http';
 import { GitHubClient, type GitHubRepository } from '@codra/provider-github';
 import { invalidateRepoConfigCache } from '@server/core/config';
diff --git a/src/server/routes/api/settings.ts b/src/server/routes/api/settings.ts
index 2339586e..4b3d70c4 100644
--- a/src/server/routes/api/settings.ts
+++ b/src/server/routes/api/settings.ts
@@ -1,7 +1,7 @@
 import { Hono } from 'hono';
 import { z } from 'zod';
 import type { AppEnv } from '@server/env';
-import { getReviewSettings, updateReviewSettings } from '@server/db/app-settings';
+import { getReviewSettings, updateReviewSettings } from '@codra/db/app-settings';
 import { jsonError } from '@server/core/http';
 import { reviewConcurrencyLevels, reviewMaxCommentsOptions, reviewMaxFilesRange, reviewSettingsSchema } from '@codra/schema';
 
diff --git a/src/server/routes/api/stats.ts b/src/server/routes/api/stats.ts
index b8b9e3ed..de3bd623 100644
--- a/src/server/routes/api/stats.ts
+++ b/src/server/routes/api/stats.ts
@@ -1,6 +1,6 @@
 import { Hono } from 'hono';
 import type { AppEnv } from '@server/env';
-import { getStats } from '@server/db/stats';
+import { getStats } from '@codra/db/stats';
 
 export function createStatsRouter() {
   const app = new Hono<AppEnv>();
diff --git a/src/server/routes/auth.ts b/src/server/routes/auth.ts
index 9fbb94d3..df231ed4 100644
--- a/src/server/routes/auth.ts
+++ b/src/server/routes/auth.ts
@@ -3,7 +3,7 @@ import type { AppEnv } from '@server/env';
 import { createOAuthState, consumeOAuthState, parseAllowedUsers } from '@server/core/oauth';
 import { createSession, destroySession } from '@server/core/sessions';
 import { exchangeGitHubOAuthCode, fetchGitHubOAuthProfile, toDashboardSessionUser } from '@codra/provider-github';
-import { upsertAccountSettings } from '@server/db/accounts';
+import { upsertAccountSettings } from '@codra/db/accounts';
 import { logger } from '@server/core/logger';
 
 function redirectToLogin(reason: string) {
diff --git a/src/server/routes/webhook.ts b/src/server/routes/webhook.ts
index 0fbe9d8d..d957aeb6 100644
--- a/src/server/routes/webhook.ts
+++ b/src/server/routes/webhook.ts
@@ -14,9 +14,9 @@ import { verifyGitHubWebhookSignature } from '@server/core/verify';
 import { jsonError } from '@server/core/http';
 import { logger } from '@server/core/logger';
 import { parseFindingMarker } from '@server/services/formatter';
-import { findExistingJobForHead, insertJob, supersedeOlderJobs } from '@server/db/jobs';
-import { clearResolvedFeedback, recordCommentFeedback, type CommentFeedbackInput, type CommentOutcome } from '@server/db/comment-feedback';
-import { recordWebhookDelivery } from '@server/db/webhook-deliveries';
+import { findExistingJobForHead, insertJob, supersedeOlderJobs } from '@codra/db/jobs';
+import { clearResolvedFeedback, recordCommentFeedback, type CommentFeedbackInput, type CommentOutcome } from '@codra/db/comment-feedback';
+import { recordWebhookDelivery } from '@codra/db/webhook-deliveries';
 
 // Matches via the invisible `codra-fp` marker GitHub echoes back verbatim; comments without one are ignored. Best-effort: failures here must never surface as a webhook error GitHub retries.
 async function handleFeedbackEvent(
diff --git a/src/server/services/model-chain-progress.ts b/src/server/services/model-chain-progress.ts
index c5240b5c..0f936b2d 100644
--- a/src/server/services/model-chain-progress.ts
+++ b/src/server/services/model-chain-progress.ts
@@ -3,35 +3,19 @@ import type { AppBindings } from '../env';
 import type { TokenTracker } from '../core/token-tracker';
 import { isPlausibleTokenBucket } from './model-support';
 
-// Where each label (file path, or a bin's label) got to in its model chain, so a deferred review
-// resumes at the next model instead of replaying the models that already failed for it.
-//
-// Why this exists: one invocation affords ~55s of model calls (MODEL_FALLBACK_CHAIN_BUDGET_MS), and
-// a single slow model can spend all of it. Without a memo the retry starts at the primary again, so
-// a chain whose first two entries time out never reaches entries 3..n no matter how many times the
-// job retries -- the fallback list past the head is unreachable by construction.
-//
-// Stored as ONE KV value per job rather than a key per file: a key per file would cost a subrequest
-// per file per invocation out of a budget of 50, which is the very resource this is protecting.
-
-// Long enough to outlive a job's continuations; the key is job-scoped so it dies with the job.
+// Stores where each label got to in its model chain so deferred reviews resume properly.
+// Stored as a single KV value per job to minimize subrequest budget overhead.
+
+// Outlives job continuations; key is job-scoped and dies with the job.
 const CHAIN_PROGRESS_TTL_SECONDS = 24 * 60 * 60;
 
-// Timeouts against one model before it is dropped for the rest of the job. Three, because a review
-// chunk dispatches three units concurrently: that is one full wave, so the model is judged on a
-// whole round rather than on a single slow call, and is dropped from the next invocation onward.
+// Allowed timeouts per model before dropping it from the job (3 = one full wave).
 const MODEL_TIMEOUT_STRIKES = 3;
 
-// Strikes before the LAST candidate in a chain is dropped too. Higher than MODEL_TIMEOUT_STRIKES
-// because dropping the last one defers the unit having attempted no model at all, which is the worse
-// outcome for a merely-slow model. But it must be FINITE: exempting the tail entirely is what let one
-// model burn 15 minutes of a job's wall clock at 20+ consecutive timeouts, every unit paying a full
-// per-call budget to learn what the tally already knew. Strikes reset on success (see noteSuccess),
-// so a count this high means the model has not once answered on this job.
+// Strikes before dropping the LAST chain candidate. Finite (6) to avoid infinite retries on dead models.
 const LAST_CANDIDATE_TIMEOUT_STRIKES = 6;
 
-// Ceiling on a persisted cool-off. A mis-parsed "retry in 3600s" would otherwise disable a model for
-// the rest of the job; per-minute buckets never legitimately need more than this.
+// Max persisted cool-off (5 mins) protects against mis-parsed long delays.
 const MAX_PERSISTED_COOLDOWN_MS = 5 * 60 * 1000;
 
 export interface ModelCooldown {
@@ -55,10 +39,7 @@ function positiveInts(source: Record<string, unknown> | undefined): Map<string,
   return kept;
 }
 
-// `until` is an absolute epoch-ms deadline, never a duration: a stale KV read then yields an
-// already-expired entry, which degrades to today's behaviour (one wasted probe) and can never
-// over-suppress. Expired entries are kept, not dropped -- `limitTokens` outlives the cool-off and
-// still answers "can this prompt ever fit in that bucket?".
+// Absolute epoch-ms deadline prevents stale reads from over-suppressing models.
 function parseCooldowns(source: Record<string, StoredCooldown> | undefined): Map<string, ModelCooldown> {
   const kept = new Map<string, ModelCooldown>();
   if (!source || typeof source !== 'object') return kept;
@@ -67,8 +48,7 @@ function parseCooldowns(source: Record<string, StoredCooldown> | undefined): Map
   for (const [model, value] of Object.entries(source)) {
     if (!value || typeof value !== 'object') continue;
     const until = typeof value.until === 'number' && Number.isFinite(value.until) ? value.until : 0;
-    // Implausible buckets are dropped rather than trusted: a job that persisted a misparsed request
-    // count would otherwise keep skipping every prompt for that model until the memo's TTL expired.
+    // Drops implausible limit sizes to prevent indefinite model suppression.
     const limitTokens =
       typeof value.limitTokens === 'number' && isPlausibleTokenBucket(value.limitTokens)
         ? value.limitTokens
@@ -81,9 +61,9 @@ function parseCooldowns(source: Record<string, StoredCooldown> | undefined): Map
 
 function mergeCooldown(a: ModelCooldown | undefined, b: ModelCooldown): ModelCooldown {
   return {
-    // Indexes and deadlines both only move forward, which makes max() the idempotent merge here too.
+    // Idempotent max() merge for advancing deadlines.
     cooldownUntil: Math.max(a?.cooldownUntil ?? 0, b.cooldownUntil),
-    // Sticky: a later 429 that omits the bucket size must not erase a known one.
+    // Sticky limit retention on subsequent 429s.
     limitTokens: a?.limitTokens ?? b.limitTokens,
   };
 }
@@ -91,24 +71,16 @@ function mergeCooldown(a: ModelCooldown | undefined, b: ModelCooldown): ModelCoo
 export class ModelChainProgressStore {
   private loaded: Promise<Map<string, number>> | null = null;
 
-  // Timeouts per model for this job, in the SAME KV value as the chain progress. A second key would
-  // cost a second subrequest read per invocation, out of the 50 this whole mechanism exists to save.
+  // Per-model timeouts stored alongside chain progress to save subrequests.
   private timeouts = new Map<string, number>();
 
-  // Models whose strikes a success cleared in THIS invocation. Needed because writeOnce merges the
-  // stored tally with max(): without it the merge would read the pre-success count back out of KV and
-  // undo the reset, making the clear invisible the moment it was persisted.
+  // Cleared strikes in this invocation, preventing max() merges from resurrecting them.
   private clearedTimeouts = new Set<string>();
 
-  // Per-model rate-limit state, in the same KV value again. Without persistence ModelRateLimitBook
-  // is invocation-scoped, so every continuation re-paid a full-prompt 429 to re-learn the cool-off
-  // this job already knew -- which is what the comment in model-review-chain.ts assumed was covered.
+  // Persisted rate-limits to avoid re-paying 429 prompts across invocations.
   private cooldowns = new Map<string, ModelCooldown>();
 
-  // Single-flight writer. Two bins deferring at once used to issue two overlapping puts, and KV has
-  // no ordering guarantee: if the put carrying LESS state happened to land second, the other bin's
-  // entry was gone and those files replayed a model already ruled out. Only one put is ever in
-  // flight now, and anything that arrives during it is folded into one follow-up put.
+  // Single-flight writer prevents overlapping KV puts from dropping concurrent updates.
   private inFlightWrite: Promise<void> | null = null;
   private dirty = false;
 
@@ -122,7 +94,7 @@ export class ModelChainProgressStore {
     return this.jobId ? `jobs:${this.jobId}:chain-progress` : null;
   }
 
-  // Resolves to 0 without a jobId: a review outside a job (preflight, verify) has nothing to resume.
+  // Job-less reviews return 0 (nothing to resume).
   private load(): Promise<Map<string, number>> {
     if (this.loaded) return this.loaded;
 
@@ -134,19 +106,18 @@ export class ModelChainProgressStore {
         const raw = await this.env.APP_KV.get(key, 'json');
         if (!raw || typeof raw !== 'object') return new Map<string, number>();
 
-        // Values written before `timeouts` existed are a bare label->index map. Reading them as the
-        // files map keeps in-flight jobs resuming correctly across the deploy.
+        // Legacy support: reads bare label->index maps as files for smooth deploys.
         const stored = raw as StoredShape;
         const isNewShape =
           stored.files !== undefined || stored.timeouts !== undefined || stored.cooldowns !== undefined;
         this.timeouts = positiveInts(isNewShape ? stored.timeouts : undefined);
-        // Merged, not assigned: noteRateLimit is sync and may land before this read resolves.
+        // Merge sync noteRateLimit calls.
         for (const [model, value] of parseCooldowns(isNewShape ? stored.cooldowns : undefined)) {
           this.cooldowns.set(model, mergeCooldown(this.cooldowns.get(model), value));
         }
         return positiveInts(isNewShape ? stored.files : (raw as Record<string, unknown>));
       } catch (error) {
-        // A missing memo costs a repeated model attempt, never correctness -- never fail the review for it.
+        // Missing memo costs retries, not correctness.
         logger.warn('Failed to read model chain progress; resuming from the primary model', {
           jobId: this.jobId,
           error: error instanceof Error ? error.message : String(error),
@@ -165,7 +136,7 @@ export class ModelChainProgressStore {
     if (!this.key || nextIndex <= 0) return;
 
     const progress = await this.load();
-    // Monotonic: a later invocation must never walk back up a chain it already descended.
+    // Monotonic advance only.
     if ((progress.get(label) ?? 0) >= nextIndex) return;
     progress.set(label, nextIndex);
     this.dirty = true;
@@ -173,15 +144,14 @@ export class ModelChainProgressStore {
     return this.flush();
   }
 
-  // Callers await this, so a deferral never returns before its progress is durable.
+  // Ensure progress durability before deferring.
   private flush(): Promise<void> {
-    // A write is already running; it re-checks `dirty` before finishing, so joining it is enough.
+    // Join in-flight writes.
     if (this.inFlightWrite) return this.inFlightWrite;
 
     this.inFlightWrite = (async () => {
       try {
-        // Loop rather than write once: advances that arrive mid-put set `dirty` again, and the
-        // single-threaded runtime guarantees they land before this re-reads it.
+        // Process mid-put advances.
         while (this.dirty) {
           this.dirty = false;
           await this.writeOnce();
@@ -200,10 +170,7 @@ export class ModelChainProgressStore {
 
     const progress = await this.load();
     try {
-      // Merge against what is actually stored, taking the higher index per label. Two concurrent
-      // INVOCATIONS (rare, but possible around a continuation handoff) have separate in-memory
-      // maps, so a blind put would drop the other one's labels entirely. Indexes only ever move
-      // forward, which makes max() the correct and idempotent merge.
+      // Merge against remote KV state using max() to prevent concurrent invocations from dropping labels.
       this.tracker?.incrementSubrequests(1);
       const raw = await this.env.APP_KV.get(key, 'json');
       if (raw && typeof raw === 'object') {
@@ -214,7 +181,7 @@ export class ModelChainProgressStore {
           if (value > (progress.get(label) ?? 0)) progress.set(label, value);
         }
         for (const [model, value] of positiveInts(isNewShape ? stored.timeouts : undefined)) {
-          // A success in this invocation outranks any stored tally; see `clearedTimeouts`.
+          // Success outranks stored tally.
           if (this.clearedTimeouts.has(model)) continue;
           if (value > (this.timeouts.get(model) ?? 0)) this.timeouts.set(model, value);
         }
@@ -246,15 +213,13 @@ export class ModelChainProgressStore {
     }
   }
 
-  // Clears a label once it reaches a terminal state, so a retry of the job starts from the primary.
+  // Clears terminal labels for clean retries.
   async clear(label: string): Promise<void> {
     const progress = await this.load();
     progress.delete(label);
   }
 
-  // A model that keeps timing out is spending the invocation's wall clock and returning nothing,
-  // and because a chunk dispatches its units concurrently, every unit in a wave pays that cost
-  // before any of them can learn from it. Persisting the count is what lets the NEXT wave skip it.
+  // Persist timeouts so subsequent waves can skip failing models.
   async noteTimeout(modelId: string): Promise<void> {
     if (!this.key) return;
     await this.load();
@@ -263,14 +228,11 @@ export class ModelChainProgressStore {
     return this.flush();
   }
 
-  // A success proves the model works here, so its tally restarts. Without this the count was
-  // cumulative over a job's whole 24h memo, so three slow calls early on condemned a healthy model for
-  // the rest of it -- and LAST_CANDIDATE_TIMEOUT_STRIKES could not mean "never answered".
+  // Reset tallies on success to avoid false permanent bans.
   async noteSuccess(modelId: string): Promise<void> {
     if (!this.key) return;
     await this.load();
-    // No-ops for a model with a clean record, which is the overwhelmingly common case: the healthy
-    // path must not pay a KV get+put per reviewed file out of a budget of 50.
+    // No-op for healthy models to save subrequests.
     if (!this.timeouts.has(modelId)) return;
     this.timeouts.delete(modelId);
     this.clearedTimeouts.add(modelId);
@@ -283,28 +245,26 @@ export class ModelChainProgressStore {
     return (this.timeouts.get(modelId) ?? 0) >= MODEL_TIMEOUT_STRIKES;
   }
 
-  // For the tail of a chain, which has no fallback to fall through to.
+  // For chain tails with no fallback.
   async isTimingOutTerminally(modelId: string): Promise<boolean> {
     await this.load();
     return (this.timeouts.get(modelId) ?? 0) >= LAST_CANDIDATE_TIMEOUT_STRIKES;
   }
 
-  // Shares load()'s single promise, so hydrating the rate-limit book costs no extra KV read.
+  // Share load() promise to save KV reads.
   async loadCooldowns(): Promise<Map<string, ModelCooldown>> {
     await this.load();
     return new Map(this.cooldowns);
   }
 
-  // Deliberately sync and non-flushing. A 429 does not advance chain progress (see the caller), so
-  // flushing here would add a get+put pair on a path that has none today; the deferral that follows
-  // calls flushPending() instead, and the single-flight writer coalesces a whole wave into one put.
+  // Sync/non-flushing. Deferrals call flushPending() to coalesce writes.
   noteRateLimit(modelId: string, entry: ModelCooldown): void {
     if (!this.key) return;
     this.cooldowns.set(modelId, mergeCooldown(this.cooldowns.get(modelId), entry));
     this.dirty = true;
   }
 
-  // For paths that mutated state without advancing progress -- notably a quota deferral.
+  // Flush mutations without advancing progress (e.g. quota deferrals).
   flushPending(): Promise<void> {
     if (!this.key || !this.dirty) return Promise.resolve();
     return this.flush();
diff --git a/src/server/services/model-chain-runner.ts b/src/server/services/model-chain-runner.ts
index e009ba3c..bf96f9d4 100644
--- a/src/server/services/model-chain-runner.ts
+++ b/src/server/services/model-chain-runner.ts
@@ -6,7 +6,7 @@ import { logger } from '../core/logger';
 import type { RepoConfig } from '@codra/schema';
 import type { TokenTracker } from '../core/token-tracker';
 import type { ModelInput, ModelResponse } from '../models/types';
-import type { ResolvedModelConfig } from '@server/db/model-configs';
+import type { ResolvedModelConfig } from '@codra/db/model-configs';
 
 // Import from services/model.ts, not here -- four specs vi.mock that specifier.
 
diff --git a/src/server/services/model-rate-limits.ts b/src/server/services/model-rate-limits.ts
index 8d14d889..d7f92e9c 100644
--- a/src/server/services/model-rate-limits.ts
+++ b/src/server/services/model-rate-limits.ts
@@ -1,6 +1,6 @@
 import { logger } from '../core/logger';
 import { ModelCallGate } from '../models/limits';
-import type { ResolvedModelConfig } from '@server/db/model-configs';
+import type { ResolvedModelConfig } from '@codra/db/model-configs';
 import { MAX_METERED_QUEUE_DEPTH, PROMPT_FIT_SAFETY_FACTOR, parseRateLimitFromError } from './model-support';
 
 // Narrow port onto whatever survives an invocation (today: the job's chain-progress KV value), so
diff --git a/src/server/services/model-review-batch.ts b/src/server/services/model-review-batch.ts
index 25f2f22d..f5560dff 100644
--- a/src/server/services/model-review-batch.ts
+++ b/src/server/services/model-review-batch.ts
@@ -5,7 +5,7 @@ import { truncateFileDiff } from '../core/diff';
 import { logger } from '../core/logger';
 import type { RepoConfig } from '@codra/schema';
 import type { ModelResponse } from '../models/types';
-import type { ResolvedModelConfig } from '@server/db/model-configs';
+import type { ResolvedModelConfig } from '@codra/db/model-configs';
 import { COMPACT_REVIEW_PROMPT_LINE_CAP, type ModelReviewContext } from './model-review-file';
 
 // Import from services/model.ts, not here -- four specs vi.mock that specifier.
diff --git a/src/server/services/model-review-chain.ts b/src/server/services/model-review-chain.ts
index d28dfa47..ca06e605 100644
--- a/src/server/services/model-review-chain.ts
+++ b/src/server/services/model-review-chain.ts
@@ -11,47 +11,41 @@ import {
   isTransientModelFailure,
   RetryableModelError,
 } from './model-support';
-import type { ResolvedModelConfig } from '@server/db/model-configs';
+import type { ResolvedModelConfig } from '@codra/db/model-configs';
 import type { ModelChainContext } from './model-chain-runner';
 import type { ModelRateLimitBook } from './model-rate-limits';
 import type { ModelChainProgressStore } from './model-chain-progress';
 
-// The model fallback chain, shared by the single-file and batched review paths.
-// Import from the services/model barrel, not here.
+// Fallback chain for single/batched reviews. Import from services/model barrel.
 
-// Each model has its own bucket, but past two an attempt spends a subrequest for nothing.
+// Past two quota failures per file burns subrequests for nothing.
 const MAX_QUOTA_FAILURES_PER_FILE = 2;
 
-// Per-invocation state on top of the model-chain surface. Not public API.
+// Internal per-invocation chain state.
 export type ModelReviewContext = ModelChainContext & {
   env: AppBindings;
   rateLimits: ModelRateLimitBook;
-  // Models proven not to support async batching, so later files go straight to synchronous.
+  // Models lacking async batching; routes subsequent files directly to synchronous.
   asyncUnsupportedModels: Set<string>;
-  // Per-job memo of how far down the chain each label already got. See model-chain-progress.ts.
+  // Per-job memo of chain progress for each label.
   chainProgress: ModelChainProgressStore;
 };
 
-// Walks the chain for one prompt pair, returning the first success. `parse` runs inside the
-// per-model try: an unparseable response is that model's failure.
+// Walks chain returning first success. `parse` errors count as model failures.
 export async function runModelChain<T>(ctx: ModelReviewContext, params: {
   systemPrompt: string;
   userPrompt: string;
-  // Not the single-file builder's return type: callers pass the batched grammar here too.
+  // Accepts both single-file and batched response schemas.
   responseSchema: ModelResponseSchema;
   timeoutMs: number;
   label: string;
   totalLineCount: number;
   config: RepoConfig;
-  // Output-token headroom this prompt needs to answer in full; see reviewOutputBudgetTokens. Adapters
-  // clamp it, so omitting it leaves a caller on its provider's default.
+  // Needed output tokens; adapters clamp it, omission defaults to provider ceiling.
   outputBudgetTokens?: number;
-  // `isLastModel` lets a parser reject a technically-valid non-answer while a stronger entry is still
-  // untried, and accept it once nothing better remains -- so escalation can never fail a file outright.
+  // `isLastModel` allows parsers to reject weak answers and try better models, accepting them only as a last resort.
   parse: (rawText: string, ctx: { isLastModel: boolean }) => T;
-  // Stable keys for the resume memo. A bin passes its member paths: its own `label` embeds the file
-  // count, so it changes the moment a member completes or the bin de-escalates to singles, and the
-  // progress would be lost exactly when it matters most.
+  // Keys for resume memo. Bins pass member paths so progress survives mid-batch success/de-escalation.
   progressLabels?: readonly string[];
 }) {
   const { systemPrompt, userPrompt, responseSchema, label, outputBudgetTokens } = params;
@@ -63,11 +57,8 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
   });
   const wholeChain = [primary, ...fallbacks];
 
-  // Resume where a previous invocation left off. Clamped rather than allowed to empty the list: a
-  // config edit mid-job can shorten the chain, and an empty list would fail the file with
-  // "no model was attempted" instead of just re-running the last one.
-  // The MINIMUM across members: a file that has not yet been tried against model k must not have k
-  // skipped just because a bin-mate already ruled it out.
+  // Resumes from invocation memo. Clamped to prevent empty chains on mid-job config changes.
+  // Takes the MINIMUM across members so no file skips a model untried due to bin-mates.
   const recorded = await Promise.all(progressLabels.map((key) => ctx.chainProgress.startIndexFor(key)));
   const startIndex = Math.min(Math.min(...recorded), Math.max(wholeChain.length - 1, 0));
   const modelsToTry = wholeChain.slice(startIndex);
@@ -78,7 +69,7 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
     });
   }
 
-  // Guards the head of the chain only; see clampTimeoutToChainBudget.
+  // Guards chain head; see clampTimeoutToChainBudget.
   const timeoutMs = clampTimeoutToChainBudget(params.timeoutMs);
 
   const estimatedPromptTokens = estimatePromptTokens(systemPrompt, userPrompt);
@@ -87,39 +78,31 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
   let lastTransientError: unknown;
   let sawTransientFailure = false;
   let quotaFailures = 0;
-  // The `continue` paths can otherwise leave `lastError` undefined, failing the file permanently.
+  // Prevents undefined lastError from failing files permanently.
   let attemptedAnyModel = false;
-  // Separates "every model is on a rate-limit cooldown" from "every model is timing out" in the
-  // no-model-attempted message; the two need opposite responses from whoever reads the job log.
+  // Distinguishes rate-limit skips from timeouts for job logs.
   let skippedForTimeouts = false;
-  // Absolute index just past the last model that ran and failed on its own merits. Only these
-  // advance the memo: a model skipped by a budget breaker never ran, and a 429 means "same model,
-  // later" (ModelRateLimitBook already holds that cool-off), so neither has been ruled out.
+  // Advances memo past failed models only; skips/429s never rule out the current model.
   let attemptedFailedThrough = 0;
   const chainStartedAt = Date.now();
-  // Excluded from the call timeout: charging gate-wait made a busy gate look like a slow model.
+  // Excluded from call timeout so busy gates don't manifest as slow models.
   let gateWaitMs = 0;
   const recordGateWait = (waitedMs: number) => { gateWaitMs += waitedMs; };
   for (const [modelIndex, currentModel] of modelsToTry.entries()) {
-    // The primary always gets a shot; past that each fallback risks the 50-subrequest cap, so defer.
+    // Primary guaranteed; fallbacks near 50-subrequest cap defer.
     if (modelIndex > 0 && ctx.tracker?.isNearLimit()) {
       logger.warn(`Skipping remaining fallback models for ${label}; subrequest budget for this invocation is nearly exhausted`, {
         skippedModels: modelsToTry.slice(modelIndex),
       });
 
-      // All-permanent failures: let the last one propagate.
+      // If no transient failures, let permanent error propagate. Avoid 'subrequest' keyword to ensure write.
       if (sawTransientFailure) {
-        // Must not say "subrequest": isSubrequestBudgetError substring-matches, and skips the write.
         lastTransientError = lastTransientError ?? lastError ?? new Error('Per-invocation request budget was nearly exhausted before trying all configured fallback models');
       }
       break;
     }
 
-    // Back-to-back slow calls pass Cloudflare's ~120s limit and die as `exceededCpu`.
-    // Prospective, not reactive: asking whether the budget is ALREADY blown let a call start with less
-    // time left than it needs, burn what remained, and defer anyway -- paying for a doomed attempt and
-    // reporting it as that model's failure. Asking whether THIS call still fits spends nothing instead,
-    // and the resume memo means the model it declines to start is the one the next invocation begins at.
+    // Prospective ~120s limit check to avoid doomed calls and CPU faults. Defers gracefully to fresh invocations.
     if (modelIndex > 0 && Date.now() - chainStartedAt - gateWaitMs + timeoutMs > MODEL_FALLBACK_CHAIN_BUDGET_MS) {
       logger.warn(`Deferring ${label}: no room in the per-invocation time budget for another model`, {
         elapsedMs: Date.now() - chainStartedAt,
@@ -127,7 +110,7 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
         timeoutMs,
         skippedModels: modelsToTry.slice(modelIndex),
       });
-      // Deferrable, so the file retries on a fresh budget instead of failing permanently.
+      // Defer to retry on a fresh budget.
       sawTransientFailure = true;
       lastTransientError = lastTransientError ?? lastError ?? new Error(`Model fallback chain for ${label} exceeded its time budget; deferring for retry.`);
       break;
@@ -149,10 +132,7 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
       continue;
     }
 
-    // Proven too slow for this job's budget. The last candidate is held to a higher bar rather than
-    // exempted: skipping every model reports "no model was attempted", which is worse than one more
-    // slow try -- but it is far better than paying a full per-call budget per unit, forever, for a
-    // model that has never once answered on this job.
+    // Skip models timing out consistently. Last candidates use a higher threshold to avoid "no model attempted" errors, but still cut off eventually.
     const isLastCandidate = modelIndex === modelsToTry.length - 1;
     const timingOut = isLastCandidate
       ? await ctx.chainProgress.isTimingOutTerminally(currentModel)
@@ -165,10 +145,7 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
       continue;
     }
 
-    // Hard floor, and unlike the isNearLimit() breaker above it applies to the PRIMARY too: that
-    // breaker exists to leave room for other in-flight files and so exempts index 0, which left the
-    // head of every chain free to transmit a full prompt into an invocation that had nothing left.
-    // The runtime then refuses it and the whole unit is lost having paid for the prompt.
+    // Hard subrequest floor for ALL models (including primary) prevents prompt transmissions into depleted invocations.
     if (ctx.tracker && !ctx.tracker.hasRemainingSubrequests(SUBREQUEST_HEADROOM_FOR_MODEL_CALL)) {
       logger.warn(`Deferring ${label}: not enough subrequest budget left to commit a prompt`, {
         subrequests: ctx.tracker.getSubrequestCount(),
@@ -176,14 +153,13 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
         skippedModels: modelsToTry.slice(modelIndex),
       });
       sawTransientFailure = true;
-      // Must not say "subrequest": isSubrequestBudgetError substring-matches it and would treat this
-      // as the runtime's own refusal, which skips persisting chain progress.
+      // Avoid 'subrequest' keyword so error isn't mistaken for runtime refusal.
       lastTransientError = lastTransientError ?? lastError
         ?? new Error(`Per-invocation request budget was too low to attempt a model for ${label}; deferring for retry.`);
       break;
     }
 
-    // Skip a call known to fail rather than pay a subrequest to be told.
+    // Pre-flight check against known limits.
     const skipReason = await ctx.rateLimits.skipReason(resolved.modelName, estimatedPromptTokens);
     if (skipReason) {
       logger.info(`Skipping ${currentModel} for ${label}: ${skipReason}`);
@@ -191,7 +167,7 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
       continue;
     }
 
-    // One shot per model; a retryable outage defers the whole file, so failure falls to the next.
+    // No intra-model retries here; outages defer the file or fall to next model.
     try {
       attemptedAnyModel = true;
       const response = await ctx.callResolvedModel(
@@ -205,26 +181,20 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
         ctx.tracker.record(response.modelUsed, response.inputTokens, response.outputTokens);
       }
 
-      // Inside the try on purpose -- see the header. `isLastModel` is computed against the WHOLE chain,
-      // not `modelsToTry`: a resumed job starts mid-chain, and measuring from the slice would call the
-      // resume point "last" and skip the escalation the memo was holding a place for.
+      // Parse in try-block. `isLastModel` uses absolute chain length, protecting resumed jobs from premature acceptance.
       const parsed = params.parse(response.rawText, {
         isLastModel: startIndex + modelIndex >= wholeChain.length - 1,
       });
-      // Keyed on the chain entry, matching noteTimeout. No-ops unless this model has strikes, so the
-      // healthy path stays free of the KV write.
+      // Clear strikes. No-op on healthy paths to avoid KV writes.
       await ctx.chainProgress.noteSuccess(currentModel);
-      // Terminal for these labels; drop the memo so a job retry starts from the primary again.
+      // Terminal success; clear memo for clean future retries.
       await Promise.all(progressLabels.map((key) => ctx.chainProgress.clear(key)));
-      // The common shape is "primary 429s, fallback answers": the file succeeds, so nothing below
-      // runs, yet a cool-off was just paid for in full and the next invocation would re-pay it.
-      // No-ops unless a 429 actually landed, so the healthy path stays free.
+      // Flush 429 cool-offs from earlier models in this chain to prevent re-paying them on next invocation.
       await ctx.chainProgress.flushPending();
       return { ...response, userPrompt, parsed };
     } catch (error) {
       lastError = error;
-      // The prompt was transmitted in full and bought nothing; the only site that sees every failed
-      // attempt across both the single-file and batched paths.
+      // Record failed wire transmission.
       ctx.tracker?.recordFailedAttempt(
         resolved.modelName,
         estimatedPromptTokens,
@@ -238,11 +208,7 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
         await ctx.markProviderUnavailable(resolved.providerId, error instanceof Error ? error.message : String(error));
       }
 
-      // The runtime refused the call: the invocation is out of subrequests, so every remaining
-      // model fails identically and instantly. Observed in production walking all 8 remaining
-      // entries for 2 files -- 16 doomed attempts -- then failing the chunk outright instead of
-      // deferring. Deliberately NOT recorded as chain progress: these models never ran, and marking
-      // them tried would make the resume memo skip healthy models for the rest of the job.
+      // Runtime refusal (out of subrequests). Aborts immediately to prevent cascading instant failures. Not recorded as chain progress so healthy models aren't skipped on retry.
       if (isSubrequestBudgetMessage(error)) {
         logger.warn(`Aborting the model chain for ${label}; this invocation is out of subrequests`, {
           skippedModels: modelsToTry.slice(modelIndex + 1),
@@ -252,8 +218,7 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
         break;
       }
 
-      // Counted per job: a wave of concurrent units all time out before any of them can react, so
-      // only a persisted tally lets the next wave stop paying for it.
+      // Persist timeouts so subsequent waves avoid doomed models.
       if (isTimeoutMessage(String(error instanceof Error ? error.message : error).toLowerCase())) {
         await ctx.chainProgress.noteTimeout(currentModel);
       }
@@ -262,18 +227,18 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
       if (!rateLimited) attemptedFailedThrough = startIndex + modelIndex + 1;
       if (rateLimited) {
         quotaFailures += 1;
-        // Learn bucket size and cool-off from the message, so later files skip it.
+        // Extract rate limit data to protect subsequent calls.
         ctx.rateLimits.note(resolved, error);
       }
 
-      // A 429 means come back later, not try another model, which would blow the subrequest cap.
+      // 429 defers rather than trying fallbacks to preserve subrequests.
       const outOfQuotaBudget = quotaFailures >= MAX_QUOTA_FAILURES_PER_FILE;
 
       logger.warn(`Model ${currentModel} failed for ${label}`, {
         error: error instanceof Error ? error.message : String(error),
         rateLimited,
         quotaFailures,
-        // Not `...Tokens`: logger.ts redacts any key containing "token".
+        // `estimatedWastedInput` over `Tokens` since logger redacts 'token'.
         estimatedWastedInput: estimatedPromptTokens,
         willTryFallback: !outOfQuotaBudget && modelIndex < modelsToTry.length - 1,
       });
@@ -294,18 +259,13 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
       retryCause,
     );
 
-    // Persist progress before throwing, so the retry resumes past the models that just failed.
-    // Only when there is somewhere left to go: at the end of the chain the memo would pin every
-    // future attempt to the last entry, and the file should get a clean walk instead.
+    // Advance progress past failed models for the retry. Skipped at chain's end so file retries start clean.
     if (attemptedFailedThrough > 0 && attemptedFailedThrough < wholeChain.length) {
-      // Together, not one at a time: the store is single-flight, so a bin's N labels coalesce into
-      // one merged put (plus the drain loop's redundant second put) instead of paying a KV get+put
-      // per member out of the 50-subrequest budget.
+      // Coalesced writes to minimize KV get+puts from subrequest budget.
       await Promise.all(progressLabels.map((key) => ctx.chainProgress.advance(key, attemptedFailedThrough)));
       Object.defineProperty(error, 'nextChainIndex', { value: attemptedFailedThrough, configurable: true });
     } else {
-      // A quota deferral advances no chain progress (a 429 means "same model, later"), so nothing
-      // above would have flushed the cool-off this file just paid a full prompt to learn.
+      // Flush cool-offs learned before the quota deferral.
       await ctx.chainProgress.flushPending();
     }
     throw error;
@@ -313,7 +273,7 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
 
   // No model was called. Two very different reasons land here.
   if (!attemptedAnyModel) {
-    // Permanent operator errors: a transient deferral would hide the message that says what to fix.
+    // Throw permanent operator errors (transient wrappers obscure root cause).
     if (lastError !== undefined) {
       if (isTransientModelFailure(lastError)) {
         throw new RetryableModelError(`Every model for ${label} failed to resolve; retrying later.`, lastError);
@@ -321,7 +281,7 @@ export async function runModelChain<T>(ctx: ModelReviewContext, params: {
       throw lastError;
     }
 
-    // Genuinely skipped: a cooldown from another file's 429, repeated timeouts, or an unavailable provider.
+    // All models skipped via cool-downs, timeouts, or unavailability.
     throw new RetryableModelError(
       `No configured review model was attempted for ${label} (all skipped: ${
         skippedForTimeouts ? 'repeated timeouts on this job' : 'rate-limit cooldown or provider unavailable'
diff --git a/src/server/services/model-support.ts b/src/server/services/model-support.ts
index 0e930f8c..a459d9b3 100644
--- a/src/server/services/model-support.ts
+++ b/src/server/services/model-support.ts
@@ -2,9 +2,9 @@ import { normalizeModelId } from '@codra/schema';
 import { isTimeoutMessage, matchesAnyTransientSubstring } from '@codra/schema/transient-errors';
 import { UnparseableModelResponseError } from '../models/types';
 
-// Pure helpers for the model service: alias resolution, prompt-size estimation, rate-limit parsing, error classification.
+// Model service pure helpers: aliases, prompt sizes, rate limits, errors.
 
-// Legacy id rewrites, applied before resolution. Empty today; kept as the hook for the next one.
+// Legacy ID rewrites (applied before resolution). Hook for future aliases.
 const MODEL_ALIASES: Record<string, string> = {};
 
 export function mergeCounts(sources: Array<Record<string, number> | undefined>): Record<string, number> {
@@ -17,68 +17,52 @@ export function mergeCounts(sources: Array<Record<string, number> | undefined>):
   return merged;
 }
 
-// Rough estimate at four chars/token, only good enough to answer "is this hopeless against a 16k bucket?" -- underestimating costs a wasted call, overestimating just routes onward.
+// Rough 4-chars/token estimate to preempt doomed calls. Overestimating safely routes onward.
 export function estimatePromptTokens(systemPrompt: string, userPrompt: string): number {
   return Math.ceil((systemPrompt.length + userPrompt.length) / 4);
 }
 
-// Only commit a prompt to a token-metered model if the estimate leaves this much headroom.
+// Headroom required before committing prompts to metered models.
 export const PROMPT_FIT_SAFETY_FACTOR = 0.8;
 
-// A learned bucket below this is not a token quota, whatever the body said. Belt to the metric-name
-// braces in parseRateLimitFromError: bodies already misparsed are persisted in KV for a job's 24h
-// life and are sticky by design, so the read path has to reject them too or those jobs stay broken.
-// No review prompt is ever this small, so a genuine bucket under it would skip every prompt anyway.
+// Minimum plausible token bucket. Rejects misparsed small numbers (like request quotas) to prevent jobs from permanently blocking valid prompts.
 export const MIN_PLAUSIBLE_TOKEN_BUCKET = 1_000;
 
 export function isPlausibleTokenBucket(limitTokens: number | undefined): boolean {
   return typeof limitTokens === 'number' && limitTokens >= MIN_PLAUSIBLE_TOKEN_BUCKET;
 }
 
-// Set by runModelChain on the deferral it throws when the chain still has untried models, so the
-// caller can tell "we made progress, resume lower down" from "the same models failed again".
-// A property rather than a constructor field, matching how retry-policy.ts attaches
-// `retryAfterSeconds`. Deliberately lives here and not on the services/model barrel: four specs
-// vi.mock that barrel with a hand-written object, and a symbol missing from it reads as `undefined`
-// at the call site -- which is a TypeError inside the very catch block that handles failures.
+// Extracted nextChainIndex from deferrals. Lets callers distinguish "progress made" from "same failures". Lives here to avoid vi.mock TypeError in specs.
 export function nextChainIndexOf(error: unknown): number | null {
   const value = (error as { nextChainIndex?: unknown } | null)?.nextChainIndex;
   return typeof value === 'number' && Number.isInteger(value) && value > 0 ? value : null;
 }
 
-// Set by the Gemini adapter on any error it throws after dropping the response grammar, so the
-// caller latches the (provider, model, grammar) triple even when that schema-less attempt also
-// failed. Lives here rather than on the barrel for the same reason as `nextChainIndexOf` above.
+// Detects if Gemini adapter dropped grammar before throwing. Lets callers latch the schema-dropped state.
 export function isSchemaDroppedError(error: unknown): boolean {
   return (error as { schemaDropped?: unknown } | null)?.schemaDropped === true;
 }
 
-// Calls that may queue on a serialized model before further files route elsewhere; deeper queues have cost files their per-file chain budget while waiting.
+// Max serialized queue depth before routing elsewhere, avoiding budget exhaustion while waiting.
 export const MAX_METERED_QUEUE_DEPTH = 2;
 
-// Every `metric: <name>, limit: <n>` pair Google states in a 429 body. A body may carry several, one
-// per violated quota.
+// Extracts metric/limit pairs from 429 bodies (may contain multiple).
 const QUOTA_VIOLATION_PATTERN = /metric:\s*(\S+?),\s*limit:\s*(\d[\d_,]*)/gi;
 
-// Which of those metrics measures TOKENS. The rest count requests, and reading a request count as a
-// bucket size is what took a model out for a whole job: Google's free tier reports
-// `generate_content_free_tier_requests, limit: 15` -- 15 requests per minute -- and storing 15 as
-// `limitTokens` made skipReason refuse every prompt over 12 tokens from then on, permanently, for a
-// model that was merely busy. An unrecognised metric therefore teaches nothing about prompt size.
+// Token metrics only. Prevents parsing request quotas (e.g. limit: 15) as token buckets, which would permanently disable the model.
 const TOKEN_QUOTA_METRIC = /(?:input_token|output_token|token_count|_tokens)/i;
 
-// Google states both numbers in the 429 body ("...limit: 16000, model: <id> Please retry in 26.9s."); anything absent is simply omitted.
+// Extracts limit/retry from 429 bodies ("limit: 16000... retry in 26.9s").
 export function parseRateLimitFromError(error: unknown): { limitTokens?: number; retryAfterMs?: number } {
   const message = error instanceof Error ? error.message : String(error ?? '');
 
-  // Deliberately NOT a bare /limit:\s*(\d+)/: the first stated limit in a multi-quota body is as
-  // likely to be the request count as the token bucket.
+  // Avoid bare limits; first stated limit might be request count.
   let limitTokens: number | undefined;
   for (const [, metric, limit] of message.matchAll(QUOTA_VIOLATION_PATTERN)) {
     if (!TOKEN_QUOTA_METRIC.test(metric)) continue;
     const parsed = Number(limit.replace(/[_,]/g, ''));
     if (!Number.isFinite(parsed) || !isPlausibleTokenBucket(parsed)) continue;
-    // Smallest stated token bucket wins: it is the one that will reject the prompt first.
+    // Smallest valid token bucket wins.
     if (limitTokens === undefined || parsed < limitTokens) limitTokens = parsed;
   }
 
@@ -137,7 +121,7 @@ export function isGoogleRateLimitError(error: unknown) {
 
 export function isTransientModelFailure(error: unknown) {
   if (isRetryableModelError(error)) return true;
-  // No reviewable output (reasoning-only / truncated / empty) is deterministic -- never retry it.
+  // Deterministic unparseable output (reasoning-only/truncated) is non-retryable.
   if (error instanceof UnparseableModelResponseError) return false;
   if (isCloudflareAllocationError(error)) return false;
   const message = error instanceof Error ? error.message : String(error);
@@ -153,7 +137,7 @@ export function isTransientModelFailure(error: unknown) {
     lower.includes('fetch failed') ||
     lower.includes('network') ||
     lower.includes('temporar') ||
-    // An upstream 5xx is a transient outage, not a client error, so it defers rather than permanently failing files.
+    // Upstream 5xx is transient; defer rather than failing.
     /\b50[0-9]\b/.test(lower) ||
     lower.includes('internal error')
   );
diff --git a/src/server/services/model.ts b/src/server/services/model.ts
index 963b566d..178070fc 100644
--- a/src/server/services/model.ts
+++ b/src/server/services/model.ts
@@ -9,7 +9,7 @@ import type { RepoConfig } from '@codra/schema';
 import type { TokenTracker } from '../core/token-tracker';
 import type { ModelInput, ModelResponse } from '../models/types';
 import { logger } from '../core/logger';
-import { getResolvedModelConfig, type ResolvedModelConfig } from '@server/db/model-configs';
+import { getResolvedModelConfig, type ResolvedModelConfig } from '@codra/db/model-configs';
 import { decryptLlmApiKey } from '@server/core/llm-crypto';
 import {
   isSchemaDroppedError,
diff --git a/src/server/workflows/review.ts b/src/server/workflows/review.ts
index c059a066..a556c430 100644
--- a/src/server/workflows/review.ts
+++ b/src/server/workflows/review.ts
@@ -2,10 +2,10 @@ import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloud
 import type { AppBindings } from '@server/env';
 import { runReviewJob, FRESH_INVOCATION_YIELD_SECONDS } from '@server/core/review';
 import { type ReviewJobMessage } from '@codra/schema';
-import { setJobWorkflowInstance } from '@server/db/jobs';
+import { setJobWorkflowInstance } from '@codra/db/jobs';
 import { logger } from '@server/core/logger';
 import { runBestEffortJobMaintenance } from '@server/core/job-recovery';
-import { runWithDb } from '@server/db/client';
+import { runWithDb } from '@codra/db/client';
 
 export class ReviewWorkflow extends WorkflowEntrypoint<AppBindings, ReviewJobMessage> {
   async run(event: WorkflowEvent<ReviewJobMessage>, step: WorkflowStep) {
diff --git a/test/api/auth.spec.ts b/test/api/auth.spec.ts
index 7bc0ca3f..37df397b 100644
--- a/test/api/auth.spec.ts
+++ b/test/api/auth.spec.ts
@@ -6,11 +6,11 @@
 // That is why this file is over the max-lines limit and carries an explicit eslint override rather
 // than being divided; the account/session half could move out, but the settings half cannot.
 
-import { getReviewSettings, updateReviewSettings } from '@server/db/app-settings';
+import { getReviewSettings, updateReviewSettings } from '@codra/db/app-settings';
 import { reviewMaxFilesRange } from '@codra/schema';
 import { createApp } from '@server/app';
 
-import { queryRows, runWithDb } from '@server/db/client';
+import { queryRows, runWithDb } from '@codra/db/client';
 
 import { syncUpdatesEmail } from '@server/core/updates-email';
 
diff --git a/test/api/jobs.spec.ts b/test/api/jobs.spec.ts
index 29c6daa1..0d196511 100644
--- a/test/api/jobs.spec.ts
+++ b/test/api/jobs.spec.ts
@@ -1,5 +1,5 @@
 import { createApp } from '@server/app';
-import { getJobForProcessing, insertJob } from '@server/db/jobs';
+import { getJobForProcessing, insertJob } from '@codra/db/jobs';
 
 import { createTestEnv, uniqueName } from '../helpers';
 import { vi } from 'vitest';
diff --git a/test/api/repos.spec.ts b/test/api/repos.spec.ts
index 94803913..4eb5f001 100644
--- a/test/api/repos.spec.ts
+++ b/test/api/repos.spec.ts
@@ -1,7 +1,7 @@
 import { createApp } from '@server/app';
-import { getJobForProcessing, insertJob } from '@server/db/jobs';
+import { getJobForProcessing, insertJob } from '@codra/db/jobs';
 
-import { getRepoConfigRecord } from '@server/db/repo-configs';
+import { getRepoConfigRecord } from '@codra/db/repo-configs';
 import { loadRepoConfig, updateGlobalConfig } from '@server/core/config';
 import { GitHubClient } from '@codra/provider-github';
 
diff --git a/test/db/bulk-upsert.spec.ts b/test/db/bulk-upsert.spec.ts
index a5e3434d..a60b0e51 100644
--- a/test/db/bulk-upsert.spec.ts
+++ b/test/db/bulk-upsert.spec.ts
@@ -5,8 +5,8 @@ import {
   bulkRecordRetryableFileReviewFailures,
   bulkUpsertFileReviews,
   getFileReviewsForJobs,
-} from '@server/db/file-reviews';
-import { getJobDetail, insertJob } from '@server/db/jobs';
+} from '@codra/db/file-reviews';
+import { getJobDetail, insertJob } from '@codra/db/jobs';
 import type { ParsedReviewComment } from '@codra/schema';
 import { createTestEnv, dbDescribe, sha, uniqueName } from '../helpers';
 
diff --git a/test/db/stats-trend.spec.ts b/test/db/stats-trend.spec.ts
index 4ebf7edf..f6239551 100644
--- a/test/db/stats-trend.spec.ts
+++ b/test/db/stats-trend.spec.ts
@@ -1,5 +1,5 @@
 import { expect, it } from 'vitest';
-import { getStats, trendBucketDays } from '@server/db/stats';
+import { getStats, trendBucketDays } from '@codra/db/stats';
 import { createTestEnv, dbDescribe } from '../helpers';
 
 const env = createTestEnv();
diff --git a/test/e2e/accordion-selection.spec.tsx b/test/e2e/accordion-selection.spec.tsx
index 8dbccae5..1fa7b933 100644
--- a/test/e2e/accordion-selection.spec.tsx
+++ b/test/e2e/accordion-selection.spec.tsx
@@ -3,7 +3,7 @@
  */
 import { describe, expect, it } from 'vitest';
 import { render } from '@testing-library/react';
-import { preventToggleOnTextSelection } from '@client/lib/selection';
+import { preventToggleOnTextSelection } from '@codra/ui/selection';
 
 /**
  * Accordion headers used to carry `select-none`, making the file path uncopyable. Removing it is
diff --git a/test/e2e/dashboard.spec.tsx b/test/e2e/dashboard.spec.tsx
index 5133ff62..328721aa 100644
--- a/test/e2e/dashboard.spec.tsx
+++ b/test/e2e/dashboard.spec.tsx
@@ -7,7 +7,7 @@ import { LoginPage } from '@client/pages/login';
 import { DashboardPage } from '@client/pages/dashboard';
 import { MemoryRouter } from 'react-router-dom';
 import { api } from '@client/lib/api';
-import { ThemeProvider } from '@client/lib/theme';
+import { ThemeProvider } from '@codra/ui/theme';
 
 vi.mock('@client/lib/api', () => ({
   api: {
diff --git a/test/findings/suppression.spec.ts b/test/findings/suppression.spec.ts
index 5d062be5..1e6fa555 100644
--- a/test/findings/suppression.spec.ts
+++ b/test/findings/suppression.spec.ts
@@ -1,9 +1,9 @@
 import { describe, expect, it } from 'vitest';
 import { createTestEnv, dbDescribe, sha, uniqueName } from '../helpers';
-import { upsertDashboardFeedback } from '@server/db/comment-feedback';
-import { runWithDb, queryRows } from '@server/db/client';
-import { insertJob } from '@server/db/jobs';
-import { getSuppressedFindings, markCommentsPosted, upsertFileReview } from '@server/db/file-reviews';
+import { upsertDashboardFeedback } from '@codra/db/comment-feedback';
+import { runWithDb, queryRows } from '@codra/db/client';
+import { insertJob } from '@codra/db/jobs';
+import { getSuppressedFindings, markCommentsPosted, upsertFileReview } from '@codra/db/file-reviews';
 import type { ParsedReviewComment } from '@codra/schema';
 
 
diff --git a/test/helpers.ts b/test/helpers.ts
index 8eb3a72b..72ee4605 100644
--- a/test/helpers.ts
+++ b/test/helpers.ts
@@ -1,7 +1,7 @@
 import { describe } from 'vitest';
 import type { AppBindings } from '@server/env';
 import { encryptLlmApiKey } from '@server/core/llm-crypto';
-import { queryRows } from '@server/db/client';
+import { queryRows } from '@codra/db/client';
 
 export class MemoryKV {
   private readonly store = new Map<string, string>();
diff --git a/test/jsonb-encoding.spec.ts b/test/jsonb-encoding.spec.ts
index 1f755c96..f8c12a82 100644
--- a/test/jsonb-encoding.spec.ts
+++ b/test/jsonb-encoding.spec.ts
@@ -1,9 +1,9 @@
 import { describe, expect, it } from 'vitest';
 import { defaultRepoConfig } from '@codra/schema';
-import { queryRows } from '@server/db/client';
-import { insertJob } from '@server/db/jobs';
-import { upsertFileReview } from '@server/db/file-reviews';
-import { syncRepoConfig, upsertRepoConfig } from '@server/db/repo-configs';
+import { queryRows } from '@codra/db/client';
+import { insertJob } from '@codra/db/jobs';
+import { upsertFileReview } from '@codra/db/file-reviews';
+import { syncRepoConfig, upsertRepoConfig } from '@codra/db/repo-configs';
 import { createTestEnv } from './helpers';
 
 // `JSON.stringify(x)` bound to `$n::jsonb` stores a jsonb STRING SCALAR, so every SQL JSON operator
diff --git a/test/migrate-sql-split.spec.ts b/test/migrate-sql-split.spec.ts
index 151921c6..4213c304 100644
--- a/test/migrate-sql-split.spec.ts
+++ b/test/migrate-sql-split.spec.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { readDollarQuoteTag, splitSqlStatements } from '../scripts/migrate-sql-split.mjs';
+import { readDollarQuoteTag, splitSqlStatements } from '../packages/db/scripts/migrate-sql-split.mjs';
 
 describe('readDollarQuoteTag', () => {
   it('reads the bare $$ tag', () => {
diff --git a/test/mocks/review-harness.ts b/test/mocks/review-harness.ts
index ee617722..98ee6e75 100644
--- a/test/mocks/review-harness.ts
+++ b/test/mocks/review-harness.ts
@@ -1,5 +1,5 @@
 import { runReviewJob } from '@server/core/review';
-import { runWithDb, queryRows } from '@server/db/client';
+import { runWithDb, queryRows } from '@codra/db/client';
 import type { AppBindings } from '@server/env';
 
 // Drives a review job through every phase the way the workflow would, in-process.
diff --git a/test/model/chain-progress-store.spec.ts b/test/model/chain-progress-store.spec.ts
index cdf324e9..ac0292a2 100644
--- a/test/model/chain-progress-store.spec.ts
+++ b/test/model/chain-progress-store.spec.ts
@@ -1,9 +1,7 @@
 import { describe, expect, it } from 'vitest';
 import { ModelChainProgressStore } from '@server/services/model';
 
-// A KV double that settles its own puts after a tick and records how many were ever in flight at
-// once. Overlapping puts are the hazard: KV has no ordering guarantee, so if the put carrying LESS
-// state lands second, the other file's progress is gone and it replays a model already ruled out.
+// KV double tracks overlapping puts (KV lacks ordering; late puts with less state can revert progress).
 function makeKV() {
   let value: string | null = null;
   let inFlight = 0;
@@ -20,7 +18,7 @@ function makeKV() {
         inFlight += 1;
         maxInFlight = Math.max(maxInFlight, inFlight);
         writes.push(body);
-        // Two ticks, so an overlapping put would genuinely overlap rather than serialize by luck.
+        // Two ticks ensure overlapping puts genuinely overlap.
         await Promise.resolve();
         await Promise.resolve();
         value = body;
@@ -48,8 +46,7 @@ describe('ModelChainProgressStore', () => {
 
     await Promise.all([store.advance('src/a.ts', 2), store.advance('src/b.ts', 3)]);
 
-    // The property that makes ordering irrelevant: puts never overlap, so the last one written is
-    // also the most complete one.
+    // Order irrelevance: non-overlapping puts ensure the last one is the most complete.
     expect(kv.maxInFlight).toBe(1);
     expect(kv.stored?.files).toEqual({ 'src/a.ts': 2, 'src/b.ts': 3 });
     expect(await store.startIndexFor('src/a.ts')).toBe(2);
@@ -63,14 +60,14 @@ describe('ModelChainProgressStore', () => {
     await Promise.all([1, 2, 3, 4, 5, 6].map((n) => store.advance(`src/f${n}.ts`, n)));
 
     expect(kv.maxInFlight).toBe(1);
-    // Six advances, far fewer writes: subrequests are the scarce resource this memo protects.
+    // Six advances but fewer writes; conserves subrequests.
     expect(kv.writes.length).toBeLessThan(6);
     expect(Object.keys(kv.stored?.files ?? {})).toHaveLength(6);
   });
 
   it('merges with progress another invocation stored, rather than overwriting it', async () => {
     const kv = makeKV();
-    // Written by a concurrent invocation this store never loaded.
+    // Written by a concurrent, unloaded invocation.
     await kv.kv.put('k', JSON.stringify({ 'src/other.ts': 4 }));
 
     const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge');
@@ -84,15 +81,14 @@ describe('ModelChainProgressStore', () => {
     const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-monotonic');
 
     await store.advance('src/a.ts', 3);
-    // A later deferral that got less far must not un-skip models already ruled out.
+    // Later, shorter deferral must not resurrect ruled-out models.
     await store.advance('src/a.ts', 1);
 
     expect(kv.stored?.files).toEqual({ 'src/a.ts': 3 });
     expect(await store.startIndexFor('src/a.ts')).toBe(3);
   });
 
-  // A chunk dispatches its units concurrently, so a whole wave times out on the same model before
-  // any of them can react. Only a persisted tally lets the NEXT wave stop paying for it.
+  // Persisted tally lets the next concurrent wave avoid models the first wave timed out on.
   it('drops a model after a full wave of timeouts, and remembers across invocations', async () => {
     const kv = makeKV();
     const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-slow');
@@ -100,41 +96,38 @@ describe('ModelChainProgressStore', () => {
     expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(false);
     await store.noteTimeout('vertex-ai:gemini-2.5-pro');
     await store.noteTimeout('vertex-ai:gemini-2.5-pro');
-    // Two is one wave short: judged on a round, not on a single slow call.
+    // Judged on a round, not a single slow call.
     expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(false);
     await store.noteTimeout('vertex-ai:gemini-2.5-pro');
     expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
 
-    // A fresh store stands in for the next invocation, reading the tally back out of KV.
+    // Fresh store mimics next invocation.
     const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-slow');
     expect(await next.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
-    // Scoped to the model that actually timed out.
+    // Scoped to the failing model.
     expect(await next.isTimingOut('vertex-ai:gemini-2.5-flash')).toBe(false);
   });
 
-  // The tail of a chain has no fallback to fall through to, so it is held to a higher bar rather than
-  // exempted. Exempting it entirely let one model burn 15 minutes of a job's wall clock at 20+
-  // consecutive timeouts, every unit paying a full per-call budget to learn what the tally knew.
+  // Tail candidates use a higher strike threshold rather than exemption, to prevent infinite looping.
   it('holds the last candidate to a higher strike count before dropping it too', async () => {
     const kv = makeKV();
     const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-tail');
 
     for (let i = 0; i < 3; i += 1) await store.noteTimeout('cf:glm-4.7-flash');
-    // Enough to drop it mid-chain, deliberately not enough to drop the tail.
+    // Drops mid-chain, but preserves the tail.
     expect(await store.isTimingOut('cf:glm-4.7-flash')).toBe(true);
     expect(await store.isTimingOutTerminally('cf:glm-4.7-flash')).toBe(false);
 
     for (let i = 0; i < 3; i += 1) await store.noteTimeout('cf:glm-4.7-flash');
     expect(await store.isTimingOutTerminally('cf:glm-4.7-flash')).toBe(true);
 
-    // Durable, or the next invocation re-pays the whole wave to re-learn it.
+    // Durable across invocations.
     const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-tail');
     expect(await next.isTimingOutTerminally('cf:glm-4.7-flash')).toBe(true);
   });
 
   describe('noteSuccess', () => {
-    // Without the reset the tally was cumulative over the memo's 24h life, so three slow calls early
-    // in a long job condemned a healthy model for the rest of it.
+    // Resets prevent cumulative tallies from condemning a model for the job's entire 24h life.
     it('restarts the tally, so a slow patch cannot condemn a working model', async () => {
       const kv = makeKV();
       const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-recovered');
@@ -146,8 +139,7 @@ describe('ModelChainProgressStore', () => {
       expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(false);
     });
 
-    // writeOnce merges the stored tally with max(), which would otherwise read the pre-success count
-    // straight back out of KV and undo the reset the moment it was persisted.
+    // writeOnce's max() merge must not resurrect pre-success counts from KV.
     it('survives the merge against what another invocation stored', async () => {
       const kv = makeKV();
       await kv.kv.put('k', JSON.stringify({ timeouts: { 'vertex-ai:gemini-2.5-pro': 5 } }));
@@ -166,8 +158,7 @@ describe('ModelChainProgressStore', () => {
 
       await store.noteSuccess('vertex-ai:gemini-2.5-pro');
 
-      // The healthy path is every successful file: a KV get+put here would spend two subrequests
-      // per file out of the 50 this memo exists to protect.
+      // Healthy paths don't incur KV writes to save subrequests.
       expect(kv.writes).toHaveLength(0);
     });
   });
@@ -185,7 +176,7 @@ describe('ModelChainProgressStore', () => {
     expect(await next.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
   });
 
-  // Jobs already in flight when this deploys have the old bare label->index map stored.
+  // Supports legacy in-flight bare label->index maps.
   it('reads the pre-timeouts stored shape without losing resume progress', async () => {
     const kv = makeKV();
     await kv.kv.put('k', JSON.stringify({ 'src/legacy.ts': 3 }));
@@ -196,8 +187,7 @@ describe('ModelChainProgressStore', () => {
     expect(await store.isTimingOut('anything')).toBe(false);
   });
 
-  // Without persistence ModelRateLimitBook is invocation-scoped, so every job continuation re-paid a
-  // full-prompt 429 to re-learn a cool-off the previous invocation had already been told about.
+  // Persisted rate-limits prevent continuation jobs from re-paying for known cool-offs.
   describe('rate-limit cool-offs', () => {
     it('carries a learned cool-off and bucket size to the next invocation', async () => {
       const kv = makeKV();
@@ -210,7 +200,7 @@ describe('ModelChainProgressStore', () => {
       const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-cooldown');
       const loaded = await next.loadCooldowns();
       expect(loaded.get('google:gemini-2.5-flash')).toEqual({ cooldownUntil: until, limitTokens: 16000 });
-      // Scoped to the model that actually 429'd: each Gemini model has its own per-minute bucket.
+      // Cool-offs scope per-model bucket.
       expect(loaded.has('google:gemini-2.5-flash-lite')).toBe(false);
     });
 
@@ -221,7 +211,7 @@ describe('ModelChainProgressStore', () => {
       store.noteRateLimit('google:gemini-2.5-flash', { cooldownUntil: Date.now() + 30_000 });
       expect(kv.writes).toHaveLength(0);
 
-      // The deferral that follows is what makes it durable.
+      // Made durable by the subsequent deferral.
       await store.flushPending();
       expect(kv.writes.length).toBeGreaterThan(0);
     });
@@ -233,15 +223,14 @@ describe('ModelChainProgressStore', () => {
       await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until: later, limitTokens: 16000 } } }));
 
       const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge-cooldown');
-      // Omits limitTokens on purpose: a later 429 that doesn't restate the bucket must not erase it.
+      // Later 429s omitting limitTokens must not erase known buckets.
       store.noteRateLimit('google:m', { cooldownUntil: earlier });
       await store.flushPending();
 
       expect(kv.stored?.cooldowns?.['google:m']).toEqual({ until: later, limitTokens: 16000 });
     });
 
-    // A job that persisted a misparsed request count as a bucket would keep skipping every prompt for
-    // that model until the memo's 24h TTL expired, because the bucket size is sticky by design.
+    // Protects against sticky, misparsed request counts crippling the model for 24h.
     it('discards a stored bucket too small to be a token quota', async () => {
       const kv = makeKV();
       const until = Date.now() + 30_000;
@@ -250,14 +239,14 @@ describe('ModelChainProgressStore', () => {
       const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-poisoned-bucket');
 
       const entry = (await store.loadCooldowns()).get('google:m');
-      // The cool-off survives -- the model really was rate-limited; only the bucket size is nonsense.
+      // Retains valid cool-off while discarding nonsense bucket size.
       expect(entry?.cooldownUntil).toBe(until);
       expect(entry?.limitTokens).toBeUndefined();
     });
 
     it('clamps an implausible cool-off rather than disabling a model for the whole job', async () => {
       const kv = makeKV();
-      // A mis-parsed "retry in 3600s" would otherwise pin this model out for the job's 24h lifetime.
+      // Prevents misparsed delays from disabling models indefinitely.
       await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until: Date.now() + 3_600_000 } } }));
 
       const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-clamp');
@@ -266,7 +255,7 @@ describe('ModelChainProgressStore', () => {
       expect(entry!.cooldownUntil).toBeLessThanOrEqual(Date.now() + 5 * 60 * 1000);
     });
 
-    // The bucket size outlives the cool-off: it still answers "can this prompt ever fit?".
+    // Bucket sizes outlive cool-offs to answer "can this prompt fit?".
     it('keeps an expired entry so its bucket size survives', async () => {
       const kv = makeKV();
       await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until: Date.now() - 60_000, limitTokens: 16000 } } }));
@@ -291,7 +280,7 @@ describe('ModelChainProgressStore', () => {
       await kv.kv.put('k', JSON.stringify({ files: { 'src/a.ts': 2 } }));
 
       const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-early-note');
-      // noteRateLimit is sync and can land first; load() must merge into it, not replace it.
+      // Sync noteRateLimit can land before load(); must merge, not replace.
       store.noteRateLimit('google:m', { cooldownUntil: Date.now() + 30_000, limitTokens: 16000 });
 
       expect((await store.loadCooldowns()).get('google:m')?.limitTokens).toBe(16000);
diff --git a/test/model/config-cache.spec.ts b/test/model/config-cache.spec.ts
index 5e845093..3cbe0511 100644
--- a/test/model/config-cache.spec.ts
+++ b/test/model/config-cache.spec.ts
@@ -1,11 +1,11 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { createTestEnv } from '../helpers';
 
-// Isolated in its own file: mocking @server/db/model-configs module-wide would break the
+// Isolated in its own file: mocking @codra/db/model-configs module-wide would break the
 // other model-service tests that resolve configs against the real test DB.
 const getResolvedModelConfigMock = vi.hoisted(() => vi.fn());
 
-vi.mock('@server/db/model-configs', async (importOriginal) => {
+vi.mock('@codra/db/model-configs', async (importOriginal) => {
   const mod = await importOriginal<any>();
   return { ...mod, getResolvedModelConfig: getResolvedModelConfigMock };
 });
diff --git a/test/review/async-batch.spec.ts b/test/review/async-batch.spec.ts
index 38a25e9d..22cd0a79 100644
--- a/test/review/async-batch.spec.ts
+++ b/test/review/async-batch.spec.ts
@@ -1,16 +1,16 @@
 import { runReviewJob } from '@server/core/review';
 import { createTestEnv, dbDescribe, sha, uniqueName, uniqueRepo } from '../helpers';
 import { afterAll, expect, vi } from 'vitest';
-import { findExistingJobForHead, getJobForProcessing } from '@server/db/jobs';
-import { getFileReviewsForJobs } from '@server/db/file-reviews';
-import { runWithDb, queryRows } from '@server/db/client';
+import { findExistingJobForHead, getJobForProcessing } from '@codra/db/jobs';
+import { getFileReviewsForJobs } from '@codra/db/file-reviews';
+import { runWithDb, queryRows } from '@codra/db/client';
 
 
 const { getOtherRunningJobsCountMock } = vi.hoisted(() => ({
   getOtherRunningJobsCountMock: vi.fn().mockResolvedValue(0),
 }));
 
-vi.mock('@server/db/jobs', async (importOriginal) => {
+vi.mock('@codra/db/jobs', async (importOriginal) => {
   const mod = await importOriginal<Record<string, unknown>>();
   return { ...mod, getOtherRunningJobsCount: getOtherRunningJobsCountMock };
 });
@@ -19,7 +19,7 @@ vi.mock('@server/db/jobs', async (importOriginal) => {
 // parallel. This suite only needs some fixed concurrency, so pin the schema default.
 const { getReviewSettingsMock } = vi.hoisted(() => ({ getReviewSettingsMock: vi.fn() }));
 
-vi.mock('@server/db/app-settings', async (importOriginal) => {
+vi.mock('@codra/db/app-settings', async (importOriginal) => {
   const mod = await importOriginal<Record<string, unknown>>();
   const { reviewSettingsSchema } = await import('@codra/schema');
   getReviewSettingsMock.mockResolvedValue(reviewSettingsSchema.parse({}));
@@ -68,7 +68,7 @@ vi.mock('@server/services/model', async () => {
 
 dbDescribe('Async batch review flow', () => {
   // Tripwire: if runReviewJob ever stops importing getOtherRunningJobsCount from the
-  // @server/db/jobs barrel, this mock silently stops applying and every test here still passes.
+  // @codra/db/jobs barrel, this mock silently stops applying and every test here still passes.
   afterAll(() => {
     expect(getOtherRunningJobsCountMock).toHaveBeenCalled();
     expect(getReviewSettingsMock).toHaveBeenCalled();
diff --git a/test/review/batch-flow.spec.ts b/test/review/batch-flow.spec.ts
index ef6499dd..7644fc33 100644
--- a/test/review/batch-flow.spec.ts
+++ b/test/review/batch-flow.spec.ts
@@ -1,18 +1,18 @@
 import { BIN_MAX_FILES, runReviewJob } from '@server/core/review';
 import { createTestEnv, dbDescribe, generateMockDiff, sha, uniqueRepo } from '../helpers';
 import { afterEach, expect, it, vi } from 'vitest';
-import { insertJob, updateJobFileCount, updateJobStep } from '@server/db/jobs';
-import { getFileReviewsForJobs } from '@server/db/file-reviews';
+import { insertJob, updateJobFileCount, updateJobStep } from '@codra/db/jobs';
+import { getFileReviewsForJobs } from '@codra/db/file-reviews';
 import { defaultRepoConfig } from '@codra/schema';
-import { runWithDb } from '@server/db/client';
+import { runWithDb } from '@codra/db/client';
 import { REVIEW_FLOW_TIMEOUT_MS } from '../mocks/review-harness';
 
-vi.mock('@server/db/jobs', async (importOriginal) => {
+vi.mock('@codra/db/jobs', async (importOriginal) => {
   const mod = await importOriginal<Record<string, unknown>>();
   return { ...mod, getOtherRunningJobsCount: vi.fn().mockResolvedValue(0) };
 });
 
-vi.mock('@server/db/app-settings', async (importOriginal) => {
+vi.mock('@codra/db/app-settings', async (importOriginal) => {
   const mod = await importOriginal<Record<string, unknown>>();
   const { reviewSettingsSchema } = await import('@codra/schema');
   return { ...mod, getReviewSettings: vi.fn().mockResolvedValue(reviewSettingsSchema.parse({})) };
@@ -116,7 +116,7 @@ dbDescribe('Review flow: batched small files', () => {
     const { GitHubService } = await import('@codra/provider-github');
     const { ModelService } = await import('@server/services/model');
     const { reviewBatchResponse } = await import('../mocks/services');
-    const fileReviews = await import('@server/db/file-reviews');
+    const fileReviews = await import('@codra/db/file-reviews');
     vi.spyOn(GitHubService.prototype, 'getPullRequestDiff').mockResolvedValue(generateMockDiff(smallFiles));
 
     vi.spyOn(ModelService.prototype as any, 'reviewFiles').mockImplementation(async () => {
@@ -147,7 +147,7 @@ dbDescribe('Review flow: batched small files', () => {
     const { GitHubService } = await import('@codra/provider-github');
     const { ModelService } = await import('@server/services/model');
     const { reviewBatchResponse } = await import('../mocks/services');
-    const jobsModule = await import('@server/db/jobs');
+    const jobsModule = await import('@codra/db/jobs');
     const getDiffSpy = vi.spyOn(GitHubService.prototype, 'getPullRequestDiff')
       .mockResolvedValue(generateMockDiff(smallFiles));
 
@@ -185,7 +185,7 @@ dbDescribe('Review flow: batched small files', () => {
   it('falls back to single-file reviews once a bin member has failed transiently', async () => {
     const { GitHubService } = await import('@codra/provider-github');
     const { ModelService } = await import('@server/services/model');
-    const { bulkRecordRetryableFileReviewFailures } = await import('@server/db/file-reviews');
+    const { bulkRecordRetryableFileReviewFailures } = await import('@codra/db/file-reviews');
     vi.spyOn(GitHubService.prototype, 'getPullRequestDiff').mockResolvedValue(generateMockDiff(smallFiles));
 
     const job = await seedJob(env, uniqueRepo('batch-deescalate'));
diff --git a/test/review/flow-chunking.spec.ts b/test/review/flow-chunking.spec.ts
index a726f85e..96e2342b 100644
--- a/test/review/flow-chunking.spec.ts
+++ b/test/review/flow-chunking.spec.ts
@@ -1,17 +1,17 @@
 import { runReviewJob } from '@server/core/review';
 import { createTestEnv, dbDescribe, generateMockDiff, sha, uniqueRepo } from '../helpers';
 import { afterAll, vi } from 'vitest';
-import { getJobForProcessing, insertJob, updateJobFileCount, updateJobStep } from '@server/db/jobs';
-import { getFileReviewsForJobs, upsertFileReview } from '@server/db/file-reviews';
+import { getJobForProcessing, insertJob, updateJobFileCount, updateJobStep } from '@codra/db/jobs';
+import { getFileReviewsForJobs, upsertFileReview } from '@codra/db/file-reviews';
 import { defaultRepoConfig } from '@codra/schema';
-import { runWithDb } from '@server/db/client';
+import { runWithDb } from '@codra/db/client';
 import { REVIEW_FLOW_TIMEOUT_MS } from '../mocks/review-harness';
 
 const { getOtherRunningJobsCountMock } = vi.hoisted(() => ({
   getOtherRunningJobsCountMock: vi.fn().mockResolvedValue(0),
 }));
 
-vi.mock('@server/db/jobs', async (importOriginal) => {
+vi.mock('@codra/db/jobs', async (importOriginal) => {
   const mod = await importOriginal<Record<string, unknown>>();
   return { ...mod, getOtherRunningJobsCount: getOtherRunningJobsCountMock };
 });
@@ -20,7 +20,7 @@ vi.mock('@server/db/jobs', async (importOriginal) => {
 // parallel. This suite only needs some fixed concurrency, so pin the schema default.
 const { getReviewSettingsMock } = vi.hoisted(() => ({ getReviewSettingsMock: vi.fn() }));
 
-vi.mock('@server/db/app-settings', async (importOriginal) => {
+vi.mock('@codra/db/app-settings', async (importOriginal) => {
   const mod = await importOriginal<Record<string, unknown>>();
   const { reviewSettingsSchema } = await import('@codra/schema');
   getReviewSettingsMock.mockResolvedValue(reviewSettingsSchema.parse({}));
@@ -39,7 +39,7 @@ vi.mock('@server/services/model', async () => {
 });
 
 dbDescribe('Review flow: chunking, partial reviews and re-posting', () => {
-  // Tripwire: if a refactor rewires runReviewJob past the @server/db/jobs barrel, the mock stops
+  // Tripwire: if a refactor rewires runReviewJob past the @codra/db/jobs barrel, the mock stops
   // applying and every test here still passes while asserting nothing.
   afterAll(() => {
     expect(getOtherRunningJobsCountMock).toHaveBeenCalled();
diff --git a/test/review/flow-lifecycle.spec.ts b/test/review/flow-lifecycle.spec.ts
index b1e1f77b..f3927a2e 100644
--- a/test/review/flow-lifecycle.spec.ts
+++ b/test/review/flow-lifecycle.spec.ts
@@ -1,10 +1,10 @@
 import { runReviewJob } from '@server/core/review';
 import { createTestEnv, dbDescribe, generateMockDiff, sha, uniqueRepo } from '../helpers';
 import { afterAll, vi } from 'vitest';
-import { findExistingJobForHead, getJobForProcessing, insertJob } from '@server/db/jobs';
-import { getFileReviewsForJobs } from '@server/db/file-reviews';
+import { findExistingJobForHead, getJobForProcessing, insertJob } from '@codra/db/jobs';
+import { getFileReviewsForJobs } from '@codra/db/file-reviews';
 import { defaultRepoConfig } from '@codra/schema';
-import { runWithDb, queryRows } from '@server/db/client';
+import { runWithDb, queryRows } from '@codra/db/client';
 import { normalizeGitHubWebhook } from '@codra/provider-github';
 import { makeRunAndDrain, REVIEW_FLOW_TIMEOUT_MS } from '../mocks/review-harness';
 
@@ -12,7 +12,7 @@ const { getOtherRunningJobsCountMock } = vi.hoisted(() => ({
   getOtherRunningJobsCountMock: vi.fn().mockResolvedValue(0),
 }));
 
-vi.mock('@server/db/jobs', async (importOriginal) => {
+vi.mock('@codra/db/jobs', async (importOriginal) => {
   const mod = await importOriginal<Record<string, unknown>>();
   return { ...mod, getOtherRunningJobsCount: getOtherRunningJobsCountMock };
 });
@@ -22,7 +22,7 @@ vi.mock('@server/db/jobs', async (importOriginal) => {
 // fixed concurrency, so pin the schema default; the suites that test the table take a lock.
 const { getReviewSettingsMock } = vi.hoisted(() => ({ getReviewSettingsMock: vi.fn() }));
 
-vi.mock('@server/db/app-settings', async (importOriginal) => {
+vi.mock('@codra/db/app-settings', async (importOriginal) => {
   const mod = await importOriginal<Record<string, unknown>>();
   const { reviewSettingsSchema } = await import('@codra/schema');
   getReviewSettingsMock.mockResolvedValue(reviewSettingsSchema.parse({}));
@@ -59,7 +59,7 @@ async function needsCheckRunCompletion(env: Parameters<typeof queryRows>[0], job
 
 dbDescribe('Review flow: lifecycle and finalize', () => {
   // Tripwire: if a refactor rewires runReviewJob to import getOtherRunningJobsCount from a
-  // sibling rather than the @server/db/jobs barrel, the mock stops applying and every test here
+  // sibling rather than the @codra/db/jobs barrel, the mock stops applying and every test here
   // still passes while asserting nothing.
   afterAll(() => {
     expect(getOtherRunningJobsCountMock).toHaveBeenCalled();
@@ -110,7 +110,7 @@ dbDescribe('Review flow: lifecycle and finalize', () => {
       const getDiffSpy = vi.spyOn(GitHubService.prototype, 'getPullRequestDiff');
       
       getDiffSpy.mockImplementationOnce(async () => {
-          const { getDb } = await import('@server/db/client');
+          const { getDb } = await import('@codra/db/client');
           const sql = getDb(env);
           await sql.query(
             `
@@ -156,7 +156,7 @@ dbDescribe('Review flow: lifecycle and finalize', () => {
   }, REVIEW_FLOW_TIMEOUT_MS);
 
   it('throttles a new (queued) job at the concurrency limit but never a running continuation', async () => {
-    const jobsMod = await import('@server/db/jobs');
+    const jobsMod = await import('@codra/db/jobs');
     const repo = uniqueRepo('admission');
     const baseSha = sha('0');
     const base = {
@@ -189,7 +189,7 @@ dbDescribe('Review flow: lifecycle and finalize', () => {
   }, REVIEW_FLOW_TIMEOUT_MS);
 
   it('bulk-marks missing files failed in a single pass without clobbering existing rows', async () => {
-    const { bulkMarkFilesFailed } = await import('@server/db/file-reviews');
+    const { bulkMarkFilesFailed } = await import('@codra/db/file-reviews');
     const job = await insertJob(env, {
       installationId: '123', owner: 'test-owner', repo: uniqueRepo('bulk-failed'),
       prNumber: 40, prTitle: 'Bulk failed', prAuthor: 'author', commitSha: sha('e'), baseSha: sha('0'),
diff --git a/test/review/flow-retry.spec.ts b/test/review/flow-retry.spec.ts
index 823fd5ec..c86d1df0 100644
--- a/test/review/flow-retry.spec.ts
+++ b/test/review/flow-retry.spec.ts
@@ -1,10 +1,10 @@
 import { runReviewJob } from '@server/core/review';
 import { createTestEnv, dbDescribe, sha, uniqueRepo } from '../helpers';
 import { afterAll, vi } from 'vitest';
-import { getJobForProcessing, insertJob, updateJobFileCount, updateJobStep } from '@server/db/jobs';
-import { getFileReviewsForJobs, upsertFileReview } from '@server/db/file-reviews';
+import { getJobForProcessing, insertJob, updateJobFileCount, updateJobStep } from '@codra/db/jobs';
+import { getFileReviewsForJobs, upsertFileReview } from '@codra/db/file-reviews';
 import { defaultRepoConfig, type ParsedReviewComment } from '@codra/schema';
-import { runWithDb } from '@server/db/client';
+import { runWithDb } from '@codra/db/client';
 import { normalizeGitHubWebhook } from '@codra/provider-github';
 import { makeRunAndDrain, REVIEW_FLOW_TIMEOUT_MS } from '../mocks/review-harness';
 
@@ -12,7 +12,7 @@ const { getOtherRunningJobsCountMock } = vi.hoisted(() => ({
   getOtherRunningJobsCountMock: vi.fn().mockResolvedValue(0),
 }));
 
-vi.mock('@server/db/jobs', async (importOriginal) => {
+vi.mock('@codra/db/jobs', async (importOriginal) => {
   const mod = await importOriginal<Record<string, unknown>>();
   return { ...mod, getOtherRunningJobsCount: getOtherRunningJobsCountMock };
 });
@@ -21,7 +21,7 @@ vi.mock('@server/db/jobs', async (importOriginal) => {
 // parallel. This suite only needs some fixed concurrency, so pin the schema default.
 const { getReviewSettingsMock } = vi.hoisted(() => ({ getReviewSettingsMock: vi.fn() }));
 
-vi.mock('@server/db/app-settings', async (importOriginal) => {
+vi.mock('@codra/db/app-settings', async (importOriginal) => {
   const mod = await importOriginal<Record<string, unknown>>();
   const { reviewSettingsSchema } = await import('@codra/schema');
   getReviewSettingsMock.mockResolvedValue(reviewSettingsSchema.parse({}));
@@ -40,7 +40,7 @@ vi.mock('@server/services/model', async () => {
 });
 
 dbDescribe('Review flow: retries, inheritance and continuations', () => {
-  // Tripwire: if a refactor rewires runReviewJob past the @server/db/jobs barrel, the mock stops
+  // Tripwire: if a refactor rewires runReviewJob past the @codra/db/jobs barrel, the mock stops
   // applying and every test here still passes while asserting nothing.
   afterAll(() => {
     expect(getOtherRunningJobsCountMock).toHaveBeenCalled();
diff --git a/test/review/quota-deferral.spec.ts b/test/review/quota-deferral.spec.ts
index bf0b63aa..8568f9d4 100644
--- a/test/review/quota-deferral.spec.ts
+++ b/test/review/quota-deferral.spec.ts
@@ -13,7 +13,7 @@ const file = {
   previousPath: null,
 };
 
-// Mirrors the real Free-tier body: the cool-off is stated in the message, not only in a header.
+// Mirrors Free-tier body: cool-off is in the message, not just headers.
 function quotaResponse(retryInSeconds: number, model = 'gemini-3.1-pro-preview') {
   return new Response(
     JSON.stringify({
@@ -33,8 +33,7 @@ function quotaResponse(retryInSeconds: number, model = 'gemini-3.1-pro-preview')
 describe('quota 429 handling', () => {
   afterEach(() => vi.restoreAllMocks());
 
-  // The subrequest blowout: nine models x three attempts for one file. Each model has its own
-  // bucket, so a couple of attempts are worth making, but past that the file must be deferred.
+  // Prevents subrequest blowouts by deferring files after two quota failures.
   it('stops walking a long fallback chain after two quota failures and defers the file', async () => {
     const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => quotaResponse(56));
     const env = createTestEnv();
@@ -58,18 +57,17 @@ describe('quota 429 handling', () => {
       }),
     ).rejects.toSatisfy(isRetryableModelError);
 
-    // Two models attempted, one call each -- not five models at three calls apiece.
+    // Defers after two model failures instead of exhausting the fallback chain.
     expect(fetchMock).toHaveBeenCalledTimes(2);
     const attempted = fetchMock.mock.calls.map((call) => String(call[0]));
     expect(attempted.some((url) => url.includes('gemini-3.1-pro-preview'))).toBe(true);
     expect(attempted.some((url) => url.includes('gemini-2.5-pro'))).toBe(true);
-    // Only ids seeded in GOOGLE_TEST_MODEL_IDS are asserted: an unseeded id issues no fetch
-    // regardless, so asserting on one would pass even with the break removed.
+    // Only seeded GOOGLE_TEST_MODEL_IDS issue fetches, making assertions reliable.
     expect(attempted.some((url) => url.includes('gemini-3.1-flash-lite'))).toBe(false);
   });
 });
 
-// A minimal successful review, in the shape the Google adapter unwraps.
+// Minimal successful review payload.
 function reviewResponse() {
   return new Response(
     JSON.stringify({
@@ -83,8 +81,7 @@ function reviewResponse() {
   );
 }
 
-// ONE token-metered model at the head: with two, a file that 429s on both hits
-// MAX_QUOTA_FAILURES_PER_FILE and defers before reaching the cheaper models, masking these tests.
+// Only one token-metered head model to prevent early MAX_QUOTA_FAILURES_PER_FILE deferrals masking these tests.
 const chain = {
   ...defaultRepoConfig,
   model: {
@@ -94,9 +91,7 @@ const chain = {
   },
 };
 
-// Google's free tier meters INPUT TOKENS PER MINUTE (16,000), not requests, stating both bucket
-// and cool-off in the 429 body. These cover the two ways that budget was burned on calls that
-// could not succeed -- each wasted probe costing a subrequest against a budget of ~25.
+// Google's free tier meters input tokens per minute. Tests verify that we learn from 429 bodies to avoid wasted subrequests.
 describe('learning a provider rate limit from its own 429', () => {
   afterEach(() => vi.restoreAllMocks());
 
@@ -107,8 +102,7 @@ describe('learning a provider rate limit from its own 429', () => {
     });
   }
 
-  // A model that just reported a cool-off must not be re-probed by the NEXT file. The counter was
-  // a local inside the per-file loop, so every file rediscovered the limit for one subrequest.
+  // Skips cooling-off models for subsequent files to save subrequests.
   it('skips a cooling-off model for subsequent files instead of re-probing it', async () => {
     const fetchMock = googleMock(() => quotaResponse(56));
     const env = createTestEnv();
@@ -116,12 +110,12 @@ describe('learning a provider rate limit from its own 429', () => {
     const service = new ModelService(env);
     const params = { prTitle: 'Test', prDescription: null, totalLineCount: 1, config: chain };
 
-    // First file: the metered model 429s, then the fallback answers.
+    // First file: metered model 429s, fallback answers.
     await service.reviewFile({ ...params, file });
     const afterFirst = fetchMock.mock.calls.length;
     expect(fetchMock.mock.calls.some((c) => String(c[0]).includes('pro-preview'))).toBe(true);
 
-    // Second file: the cool-off is known, so it goes straight to the fallback -- one call.
+    // Second file: skips metered model, goes straight to fallback.
     fetchMock.mockClear();
     await service.reviewFile({ ...params, file: { ...file, path: 'src/second.ts' } });
 
@@ -130,8 +124,7 @@ describe('learning a provider rate limit from its own 429', () => {
     expect(afterFirst).toBeGreaterThan(1);
   });
 
-  // A prompt bigger than the whole bucket can never succeed, so once the size is known it must
-  // not be spent on the 429 either.
+  // Prevents sending prompts larger than the entire learned token bucket.
   it('skips a model whose whole token bucket is smaller than the prompt', async () => {
     const fetchMock = googleMock(() => quotaResponse(1));
     const env = createTestEnv();
@@ -139,11 +132,11 @@ describe('learning a provider rate limit from its own 429', () => {
     const service = new ModelService(env);
     const params = { prTitle: 'Test', prDescription: null, totalLineCount: 1, config: chain };
 
-    // Teach it the 16,000-token bucket with a small file, and let the cool-off lapse.
+    // Teach 16k bucket with small file, let cool-off lapse.
     await service.reviewFile({ ...params, file });
     await new Promise((resolve) => setTimeout(resolve, 1100));
 
-    // ~300 long lines is well past 16,000 tokens once rendered, but under the 800-line chunk cap.
+    // 300 long lines exceeds 16k tokens, but fits chunk cap.
     const hugeFile = {
       ...file,
       path: 'src/huge.ts',
@@ -162,17 +155,15 @@ describe('learning a provider rate limit from its own 429', () => {
     fetchMock.mockClear();
     await service.reviewFile({ ...params, file: hugeFile });
 
-    // Cool-off has expired, so this is the size rule alone doing the work.
+    // Size rule works even after cool-off expires.
     expect(fetchMock.mock.calls.map((c) => String(c[0])).some((url) => url.includes('pro-preview'))).toBe(false);
     expect(fetchMock.mock.calls).toHaveLength(1);
   });
 
-  // The book used to be in-memory on ModelService, so it died with the invocation. A job runs up to
-  // 20 continuations, and each fresh invocation re-paid a full-prompt 429 to re-learn a cool-off the
-  // previous one had already been told about -- the single largest source of wasted input tokens.
+  // Persisted cooldowns survive invocations, eliminating the largest source of wasted input tokens.
   it('carries a cool-off to the next invocation of the same job', async () => {
     const fetchMock = googleMock(() => quotaResponse(56));
-    // MemoryKV persists across ModelService instances, standing in for a continuation handoff.
+    // MemoryKV mimics continuation handoff.
     const env = createTestEnv();
     await saveTestProviderApiKey(env);
     const params = { prTitle: 'Test', prDescription: null, totalLineCount: 1, config: chain };
@@ -181,12 +172,12 @@ describe('learning a provider rate limit from its own 429', () => {
     await first.reviewFile({ ...params, file });
     expect(fetchMock.mock.calls.some((c) => String(c[0]).includes('pro-preview'))).toBe(true);
 
-    // A brand-new service, as a fresh invocation would build.
+    // Brand-new service mimics fresh invocation.
     fetchMock.mockClear();
     const next = new ModelService(env, undefined, { jobId: 'job-continuation' });
     await next.reviewFile({ ...params, file: { ...file, path: 'src/second.ts' } });
 
-    // The metered model is never probed again: no 429, no wasted prompt.
+    // Metered model correctly skipped.
     expect(fetchMock.mock.calls.map((c) => String(c[0])).some((url) => url.includes('pro-preview'))).toBe(false);
     expect(fetchMock.mock.calls).toHaveLength(1);
   });
@@ -199,15 +190,14 @@ describe('learning a provider rate limit from its own 429', () => {
 
     await new ModelService(env, undefined, { jobId: 'job-a' }).reviewFile({ ...params, file });
 
-    // An unrelated job must not inherit it: each Gemini model meters per project, but a stale
-    // cool-off leaking across jobs would silently narrow coverage with no re-probe path.
+    // Unrelated jobs must not inherit cool-offs (which could silently narrow coverage).
     fetchMock.mockClear();
     await new ModelService(env, undefined, { jobId: 'job-b' }).reviewFile({ ...params, file });
 
     expect(fetchMock.mock.calls.map((c) => String(c[0])).some((url) => url.includes('pro-preview'))).toBe(true);
   });
 
-  // Small files must still reach the stronger model once its cool-off lapses.
+  // Small files correctly return to stronger models after cool-off lapses.
   it('returns to the primary model once its cool-off has expired', async () => {
     let meteredCalls = 0;
     const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async (input) => {
diff --git a/test/review/resumable-queue.spec.ts b/test/review/resumable-queue.spec.ts
index 3cd97d52..65461af8 100644
--- a/test/review/resumable-queue.spec.ts
+++ b/test/review/resumable-queue.spec.ts
@@ -1,7 +1,7 @@
 import worker from '@server/index';
-import { claimJobLease, getJobForProcessing, insertJob, markJobContinuationQueued, recoverExpiredJobLeases, releaseJobLease } from '@server/db/jobs';
-import { getFileReviewsForJobs, recordRetryableFileReviewFailure, upsertFileReview } from '@server/db/file-reviews';
-import { getDb } from '@server/db/client';
+import { claimJobLease, getJobForProcessing, insertJob, markJobContinuationQueued, recoverExpiredJobLeases, releaseJobLease } from '@codra/db/jobs';
+import { getFileReviewsForJobs, recordRetryableFileReviewFailure, upsertFileReview } from '@codra/db/file-reviews';
+import { getDb } from '@codra/db/client';
 import { createTestEnv, dbDescribe, sha, uniqueName } from '../helpers';
 
 
diff --git a/test/review/scheduled-maintenance.spec.ts b/test/review/scheduled-maintenance.spec.ts
index 2c5613eb..92a73614 100644
--- a/test/review/scheduled-maintenance.spec.ts
+++ b/test/review/scheduled-maintenance.spec.ts
@@ -15,7 +15,7 @@ vi.mock('@server/core/job-recovery', async (importOriginal) => ({
   runBestEffortJobMaintenance: runBestEffortJobMaintenanceMock,
 }));
 
-vi.mock('@server/db/jobs', async (importOriginal) => ({
+vi.mock('@codra/db/jobs', async (importOriginal) => ({
   ...(await importOriginal<any>()),
   hasPendingMaintenanceWork: hasPendingMaintenanceWorkMock,
 }));
@@ -62,7 +62,7 @@ describe('scheduled() cron maintenance gating', () => {
   });
 
   it('markSystemActive writes the flag only once while it is set (no per-chunk KV write storm)', async () => {
-    const { markSystemActive } = await import('@server/db/jobs');
+    const { markSystemActive } = await import('@codra/db/jobs');
     const env = createTestEnv();
     const putSpy = vi.spyOn(env.APP_KV, 'put');
 
diff --git a/test/review/subrequest-completion.spec.ts b/test/review/subrequest-completion.spec.ts
index 32217708..836a6aef 100644
--- a/test/review/subrequest-completion.spec.ts
+++ b/test/review/subrequest-completion.spec.ts
@@ -32,7 +32,7 @@ const {
   getPullRequestMock: vi.fn(),
 }));
 
-vi.mock('@server/db/jobs', async (importOriginal) => {
+vi.mock('@codra/db/jobs', async (importOriginal) => {
   const mod = await importOriginal<any>();
   return {
     ...mod,
@@ -49,7 +49,7 @@ vi.mock('@server/db/jobs', async (importOriginal) => {
   };
 });
 
-vi.mock('@server/db/app-settings', async (importOriginal) => {
+vi.mock('@codra/db/app-settings', async (importOriginal) => {
   const mod = await importOriginal<any>();
   return {
     ...mod,
diff --git a/test/review/workflow-finalize-fresh-instance.spec.ts b/test/review/workflow-finalize-fresh-instance.spec.ts
index 947630f6..2d601541 100644
--- a/test/review/workflow-finalize-fresh-instance.spec.ts
+++ b/test/review/workflow-finalize-fresh-instance.spec.ts
@@ -17,11 +17,11 @@ vi.mock('@server/core/review', async (importOriginal) => ({
   runReviewJob: runReviewJobMock,
 }));
 vi.mock('@server/core/job-recovery', () => ({ runBestEffortJobMaintenance: maintenanceMock }));
-vi.mock('@server/db/jobs', async (importOriginal) => ({
+vi.mock('@codra/db/jobs', async (importOriginal) => ({
   ...(await importOriginal<any>()),
   setJobWorkflowInstance: setInstanceMock,
 }));
-vi.mock('@server/db/client', () => ({ runWithDb: (_env: any, fn: any) => fn() }));
+vi.mock('@codra/db/client', () => ({ runWithDb: (_env: any, fn: any) => fn() }));
 
 import { ReviewWorkflow } from '@server/workflows/review';
 
@@ -49,7 +49,7 @@ describe('ReviewWorkflow: fresh instance on freshInstance flag', () => {
 
   it('re-enqueues the next phase as a fresh instance (carrying the resolved jobId) when freshInstance is set', async () => {
     const send = vi.fn().mockResolvedValue(undefined);
-    const env = { REVIEW_QUEUE: { send } };
+    const env = { REVIEW_QUEUE: { send }, HYPERDRIVE: { connectionString: 'mock' } };
     // Entering finalize -> freshInstance true, with the resolved jobId.
     runReviewJobMock.mockResolvedValueOnce({ action: 'next_phase', phase: 'finalize', delaySeconds: 60, jobId: 'real-job-id', freshInstance: true });
 
@@ -68,7 +68,7 @@ describe('ReviewWorkflow: fresh instance on freshInstance flag', () => {
 
   it('re-enqueues a fresh instance for a subrequest-limit review deferral (same phase)', async () => {
     const send = vi.fn().mockResolvedValue(undefined);
-    const env = { REVIEW_QUEUE: { send } };
+    const env = { REVIEW_QUEUE: { send }, HYPERDRIVE: { connectionString: 'mock' } };
     // A saturated instance hit the subrequest limit mid-review -> freshInstance true, phase stays review.
     runReviewJobMock.mockResolvedValueOnce({ action: 'next_phase', phase: 'review', delaySeconds: 60, jobId: 'real-job-id', freshInstance: true });
 
@@ -80,7 +80,7 @@ describe('ReviewWorkflow: fresh instance on freshInstance flag', () => {
 
   it('does NOT re-enqueue when freshInstance is not set (normal in-instance continuation)', async () => {
     const send = vi.fn().mockResolvedValue(undefined);
-    const env = { REVIEW_QUEUE: { send } };
+    const env = { REVIEW_QUEUE: { send }, HYPERDRIVE: { connectionString: 'mock' } };
     // Healthy per-chunk yield (hibernation resets the budget) -> stays in-instance, then completes.
     runReviewJobMock
       .mockResolvedValueOnce({ action: 'next_phase', phase: 'review', delaySeconds: 60, jobId: 'real-job-id', freshInstance: false })
@@ -95,7 +95,7 @@ describe('ReviewWorkflow: fresh instance on freshInstance flag', () => {
 
   it('uses the payload jobId to re-enqueue when the result omits it (auto jobs)', async () => {
     const send = vi.fn().mockResolvedValue(undefined);
-    const env = { REVIEW_QUEUE: { send } };
+    const env = { REVIEW_QUEUE: { send }, HYPERDRIVE: { connectionString: 'mock' } };
     runReviewJobMock.mockResolvedValueOnce({ action: 'next_phase', phase: 'finalize', delaySeconds: 60, freshInstance: true });
 
     await runWorkflow(env, { jobId: 'payload-job-id', phase: 'review' });
diff --git a/tsconfig.json b/tsconfig.json
index 8e66260e..6a1d46c6 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -39,6 +39,7 @@
     // `tsc -p` (npm run typecheck:all) is the narrower program that enforces its boundaries, since
     // this one has worker-configuration.d.ts in scope and would happily accept a KVNamespace.
     "packages/*/src/**/*.ts",
+    "packages/*/src/**/*.tsx",
     "packages/*/test/**/*.ts"
   ]
 }

From a45c1d3b27355b4cca81c20c214c7b3d1026e22b Mon Sep 17 00:00:00 2001
From: Devarshi Shimpi <devarshishimpi@gmail.com>
Date: Sat, 15 Aug 2026 09:00:43 +0530
Subject: [PATCH 04/12] refactor: extract models package and worker app

---
 apps/worker/package.json                      |  13 +-
 apps/worker/src/env.ts                        |  53 ++
 {src/server => apps/worker/src}/index.ts      |   9 +-
 apps/worker/src/ports/cloudflare-kv.ts        |  20 +
 .../src/ports/cloudflare-orchestrator.ts      |  35 +-
 apps/worker/src/sessions.ts                   |  25 +
 .../worker/src}/worker-env.d.ts               |   2 +-
 apps/worker/src/workflows/review.ts           |  17 +
 .../worker/worker-configuration.d.ts          |   0
 wrangler.jsonc => apps/worker/wrangler.jsonc  |   4 +-
 eslint.config.js                              |   4 +-
 package-lock.json                             |  13 +
 package.json                                  |   8 +-
 packages/core/src/index.ts                    |   2 +-
 packages/core/src/ports/in-memory.ts          |  65 ++
 packages/core/src/ports/index.ts              |   7 +-
 packages/core/src/ports/kv.ts                 |   6 +
 packages/core/src/ports/orchestrator.ts       |   5 +
 packages/core/src/ports/platform.ts           |   4 +
 packages/core/src/ports/queue.ts              |   3 +
 packages/core/src/ports/session-store.ts      |  14 +
 packages/core/src/review/index.ts             |   5 -
 packages/db/src/accounts.ts                   |  13 +-
 packages/db/src/app-settings.ts               |  19 +-
 packages/db/src/client.ts                     |  18 +-
 packages/db/src/constants.ts                  |  56 ++
 packages/db/src/file-reviews-bulk.ts          |  31 +-
 packages/db/src/file-reviews-findings.ts      |   1 -
 packages/db/src/file-reviews.ts               |   2 +-
 packages/db/src/jobs-activity.ts              |  12 +-
 packages/db/src/jobs-leases.ts                |  10 +-
 packages/db/src/jobs-lifecycle.ts             |   5 +-
 packages/db/src/jobs.ts                       |   6 +-
 packages/db/src/model-configs.ts              |  19 +-
 packages/db/src/repo-configs.ts               |   2 +-
 .../repositories/instance-id-repository.ts    |   6 +-
 .../db/src/repositories/jobs-repository.ts    |  10 +-
 packages/db/src/review-comment-sql.ts         |   2 +-
 packages/models/package.json                  |  26 +
 .../models => packages/models/src}/catalog.ts |   0
 .../models/src}/gemini-schema.ts              |   0
 packages/models/src/index.ts                  |  18 +
 .../src/internal}/model-chain-progress.ts     |  16 +-
 .../src/internal}/model-chain-runner.ts       |  17 +-
 .../models/src/internal}/model-rate-limits.ts |   6 +-
 .../src/internal}/model-review-batch.ts       |  23 +-
 .../src/internal}/model-review-chain.ts       |  13 +-
 .../models/src/internal}/model-review-file.ts |  16 +-
 .../models/src/internal}/model-support.ts     |   2 +-
 .../models => packages/models/src}/limits.ts  |   0
 .../models/src}/llm-crypto.ts                 |  20 +-
 .../models/src/providers}/anthropic.ts        | 172 ++--
 .../models/src/providers}/cloudflare.ts       | 564 ++++++------
 .../models/src/providers}/google.ts           | 578 ++++++------
 .../models/src/providers}/openai.ts           | 198 ++---
 .../models/src/providers}/vertex.ts           | 488 +++++-----
 .../model.ts => packages/models/src/runner.ts |  98 ++-
 .../models => packages/models/src}/types.ts   |   2 +-
 .../models/src}/url-guard.ts                  |   0
 .../models/test}/model/batch-routing.spec.ts  | 388 ++++----
 .../models/test}/model/catalog-nvidia.spec.ts | 182 ++--
 .../test}/model/chain-progress-store.spec.ts  | 600 ++++++-------
 .../models/test}/model/chain-resume.spec.ts   | 250 +++---
 .../models/test}/model/cloudflare.spec.ts     | 230 ++---
 .../models/test}/model/config-cache.spec.ts   | 150 ++--
 .../models/test}/model/gemini-schema.spec.ts  | 150 ++--
 .../models/test}/model/limits.spec.ts         | 294 +++----
 .../models/test}/model/output-batch.spec.ts   | 166 ++--
 .../models/test}/model/output.spec.ts         |   0
 .../test}/model/rate-limit-parse.spec.ts      | 154 ++--
 .../test}/model/service-chunking.spec.ts      | 483 +++++-----
 .../test}/model/service-fallbacks.spec.ts     | 832 +++++++++---------
 .../model/service-grammar-rejection.spec.ts   | 398 ++++-----
 .../test}/model/service-requests.spec.ts      | 338 +++----
 .../test}/model/service-retries.spec.ts       | 456 +++++-----
 .../models/test}/url-guard.spec.ts            | 196 ++---
 packages/models/tsconfig.json                 |  12 +
 packages/provider-github/src/oauth.ts         |   2 +-
 scratch/refactor-consumers.js                 |  37 -
 scratch/refactor-db-2.js                      |  35 -
 scratch/refactor-db-3.js                      |  33 -
 scratch/refactor-db.js                        |  42 -
 scratch/refactor-repos.js                     |  21 -
 scratch/refactor-tests.js                     |  34 -
 scripts/check-core-boundary.mjs               | 155 ----
 scripts/comment-density.mjs                   | 133 ---
 src/server/adapters/services.ts               |  16 +-
 src/server/core/sessions.ts                   |  14 +-
 src/server/env.d.ts                           |  32 +
 src/server/env.ts                             |  45 +-
 src/server/routes/api/models.ts               |  33 +-
 test/findings/prompts-batch-review.spec.ts    |   2 +-
 test/helpers.ts                               |  19 +-
 test/migrate-sql-split.spec.ts                |   1 +
 test/mocks/services.ts                        |   4 +-
 test/review/async-batch.spec.ts               |   4 +-
 test/review/batch-flow.spec.ts                |  24 +-
 test/review/flow-chunking.spec.ts             |  12 +-
 test/review/flow-lifecycle.spec.ts            |   4 +-
 test/review/flow-retry.spec.ts                |  16 +-
 test/review/quota-deferral.spec.ts            | 449 +++++-----
 test/review/resumable-queue.spec.ts           |   2 +-
 test/review/scheduled-maintenance.spec.ts     |   2 +-
 .../workflow-finalize-fresh-instance.spec.ts  |   2 +-
 tsconfig.base.json                            |   7 +-
 tsconfig.json                                 |   4 +-
 vitest.config.ts                              |   1 +
 107 files changed, 4572 insertions(+), 4675 deletions(-)
 create mode 100644 apps/worker/src/env.ts
 rename {src/server => apps/worker/src}/index.ts (95%)
 create mode 100644 apps/worker/src/ports/cloudflare-kv.ts
 rename src/server/workflows/review.ts => apps/worker/src/ports/cloudflare-orchestrator.ts (67%)
 create mode 100644 apps/worker/src/sessions.ts
 rename {src/server => apps/worker/src}/worker-env.d.ts (99%)
 create mode 100644 apps/worker/src/workflows/review.ts
 rename worker-configuration.d.ts => apps/worker/worker-configuration.d.ts (100%)
 rename wrangler.jsonc => apps/worker/wrangler.jsonc (97%)
 create mode 100644 packages/core/src/ports/in-memory.ts
 create mode 100644 packages/core/src/ports/kv.ts
 create mode 100644 packages/core/src/ports/orchestrator.ts
 create mode 100644 packages/core/src/ports/queue.ts
 create mode 100644 packages/core/src/ports/session-store.ts
 create mode 100644 packages/db/src/constants.ts
 create mode 100644 packages/models/package.json
 rename {src/server/models => packages/models/src}/catalog.ts (100%)
 rename {src/server/models => packages/models/src}/gemini-schema.ts (100%)
 create mode 100644 packages/models/src/index.ts
 rename {src/server/services => packages/models/src/internal}/model-chain-progress.ts (95%)
 rename {src/server/services => packages/models/src/internal}/model-chain-runner.ts (92%)
 rename {src/server/services => packages/models/src/internal}/model-rate-limits.ts (97%)
 rename {src/server/services => packages/models/src/internal}/model-review-batch.ts (85%)
 rename {src/server/services => packages/models/src/internal}/model-review-chain.ts (97%)
 rename {src/server/services => packages/models/src/internal}/model-review-file.ts (93%)
 rename {src/server/services => packages/models/src/internal}/model-support.ts (96%)
 rename {src/server/models => packages/models/src}/limits.ts (100%)
 rename {src/server/core => packages/models/src}/llm-crypto.ts (65%)
 rename {src/server/models => packages/models/src/providers}/anthropic.ts (92%)
 rename {src/server/models => packages/models/src/providers}/cloudflare.ts (91%)
 rename {src/server/models => packages/models/src/providers}/google.ts (95%)
 rename {src/server/models => packages/models/src/providers}/openai.ts (92%)
 rename {src/server/models => packages/models/src/providers}/vertex.ts (96%)
 rename src/server/services/model.ts => packages/models/src/runner.ts (80%)
 rename {src/server/models => packages/models/src}/types.ts (97%)
 rename {src/server/models => packages/models/src}/url-guard.ts (100%)
 rename {test => packages/models/test}/model/batch-routing.spec.ts (97%)
 rename {test => packages/models/test}/model/catalog-nvidia.spec.ts (95%)
 rename {test => packages/models/test}/model/chain-progress-store.spec.ts (97%)
 rename {test => packages/models/test}/model/chain-resume.spec.ts (88%)
 rename {test => packages/models/test}/model/cloudflare.spec.ts (97%)
 rename {test => packages/models/test}/model/config-cache.spec.ts (79%)
 rename {test => packages/models/test}/model/gemini-schema.spec.ts (96%)
 rename {test => packages/models/test}/model/limits.spec.ts (96%)
 rename {test => packages/models/test}/model/output-batch.spec.ts (97%)
 rename {test => packages/models/test}/model/output.spec.ts (100%)
 rename {test => packages/models/test}/model/rate-limit-parse.spec.ts (97%)
 rename {test => packages/models/test}/model/service-chunking.spec.ts (91%)
 rename {test => packages/models/test}/model/service-fallbacks.spec.ts (92%)
 rename {test => packages/models/test}/model/service-grammar-rejection.spec.ts (95%)
 rename {test => packages/models/test}/model/service-requests.spec.ts (89%)
 rename {test => packages/models/test}/model/service-retries.spec.ts (90%)
 rename {test => packages/models/test}/url-guard.spec.ts (95%)
 create mode 100644 packages/models/tsconfig.json
 delete mode 100644 scratch/refactor-consumers.js
 delete mode 100644 scratch/refactor-db-2.js
 delete mode 100644 scratch/refactor-db-3.js
 delete mode 100644 scratch/refactor-db.js
 delete mode 100644 scratch/refactor-repos.js
 delete mode 100644 scratch/refactor-tests.js
 delete mode 100644 scripts/check-core-boundary.mjs
 delete mode 100644 scripts/comment-density.mjs
 create mode 100644 src/server/env.d.ts

diff --git a/apps/worker/package.json b/apps/worker/package.json
index cc7105fc..3db124b9 100644
--- a/apps/worker/package.json
+++ b/apps/worker/package.json
@@ -1,5 +1,16 @@
 {
   "name": "@codra/worker",
   "version": "0.9.4",
-  "private": true
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@codra/core": "*",
+    "@codra/db": "*",
+    "@codra/schema": "*",
+    "hono": "^4.12.25"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20250109.0",
+    "wrangler": "^4.114.0"
+  }
 }
diff --git a/apps/worker/src/env.ts b/apps/worker/src/env.ts
new file mode 100644
index 00000000..21afa256
--- /dev/null
+++ b/apps/worker/src/env.ts
@@ -0,0 +1,53 @@
+import type { ReviewJobMessage } from '@codra/schema';
+import type { DashboardSessionUser, SessionStore } from '@codra/core';
+
+export interface WorkersAiBinding {
+  run(model: string, input: Record<string, unknown>, options?: { signal?: AbortSignal }): Promise<any>;
+}
+
+export interface QueueProducer<T> {
+  send(message: T, options?: { delaySeconds?: number }): Promise<void>;
+}
+
+export interface AssetsBinding {
+  fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+}
+
+export interface HyperdriveBinding {
+  connectionString: string;
+}
+
+export interface AppBindings {
+  SESSION_STORE: SessionStore;
+  AI: WorkersAiBinding;
+  APP_KV: KVNamespace;
+  REVIEW_QUEUE: QueueProducer<ReviewJobMessage>;
+  REVIEW_WORKFLOW: Workflow;
+  ASSETS: AssetsBinding;
+  HYPERDRIVE: HyperdriveBinding;
+  APP_PRIVATE_KEY: string;
+  GITHUB_APP_ID: string;
+  GITHUB_APP_SLUG?: string;
+  GITHUB_APP_WEBHOOK_SECRET: string;
+  GITHUB_CLIENT_ID: string;
+  GITHUB_CLIENT_SECRET: string;
+  AUTH_CALLBACK_URL: string;
+  APP_URL: string;
+  DASHBOARD_ALLOWED_USERS: string;
+  LLM_CONFIG_ENCRYPTION_KEY: string;
+  BOT_USERNAME: string;
+  ENVIRONMENT: string;
+  CF_API_TOKEN: string;
+  CF_ACCOUNT_ID: string;
+}
+
+export interface AppVariables {
+  sessionToken: string | null;
+  sessionUser: DashboardSessionUser | null;
+  requestId: string;
+}
+
+export type AppEnv = {
+  Bindings: AppBindings;
+  Variables: AppVariables;
+};
diff --git a/src/server/index.ts b/apps/worker/src/index.ts
similarity index 95%
rename from src/server/index.ts
rename to apps/worker/src/index.ts
index 1b515e58..da26c032 100644
--- a/src/server/index.ts
+++ b/apps/worker/src/index.ts
@@ -1,4 +1,4 @@
-import { createApp } from './app';
+import { createApp } from '../../../src/server/app';
 import { ReviewWorkflow } from './workflows/review';
 import type { AppBindings } from './env';
 import { reviewJobMessageSchema } from '@codra/schema';
@@ -8,13 +8,18 @@ import { runWithDb } from '@codra/db/client';
 import { failJob, hasPendingMaintenanceWork, clearSystemActive } from '@codra/db/jobs';
 import { runBestEffortJobMaintenance } from '@server/core/job-recovery';
 
+import { CloudflareSessionStore } from './sessions';
 const app = createApp();
 
 export { ReviewWorkflow };
 
 export default {
   fetch(request: Request, env: AppBindings, ctx: ExecutionContext) {
-    return runWithDb(env, () => app.fetch(request, env, ctx));
+    const apiEnv = {
+      ...env,
+      SESSION_STORE: new CloudflareSessionStore(env.APP_KV),
+    };
+    return runWithDb(env, () => app.fetch(request, apiEnv as any, ctx));
   },
 
   async scheduled(_controller: ScheduledController, env: AppBindings, _ctx: ExecutionContext) {
diff --git a/apps/worker/src/ports/cloudflare-kv.ts b/apps/worker/src/ports/cloudflare-kv.ts
new file mode 100644
index 00000000..0c2af4b4
--- /dev/null
+++ b/apps/worker/src/ports/cloudflare-kv.ts
@@ -0,0 +1,20 @@
+import type { KeyValueStore } from '@codra/core';
+
+export class CloudflareKV implements KeyValueStore {
+  constructor(private readonly kv: KVNamespace) {}
+
+  async put(key: string, value: string, options?: { expirationTtl?: number }): Promise<void> {
+    await this.kv.put(key, value, options);
+  }
+
+  async get(key: string, type: 'json' | 'text'): Promise<any> {
+    if (type === 'json') {
+      return this.kv.get(key, 'json');
+    }
+    return this.kv.get(key, 'text');
+  }
+
+  async delete(key: string): Promise<void> {
+    await this.kv.delete(key);
+  }
+}
diff --git a/src/server/workflows/review.ts b/apps/worker/src/ports/cloudflare-orchestrator.ts
similarity index 67%
rename from src/server/workflows/review.ts
rename to apps/worker/src/ports/cloudflare-orchestrator.ts
index a556c430..ca8d28ea 100644
--- a/src/server/workflows/review.ts
+++ b/apps/worker/src/ports/cloudflare-orchestrator.ts
@@ -1,22 +1,27 @@
-import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';
-import type { AppBindings } from '@server/env';
-import { runReviewJob, FRESH_INVOCATION_YIELD_SECONDS } from '@server/core/review';
-import { type ReviewJobMessage } from '@codra/schema';
+import type { JobOrchestrator } from '@codra/core';
+import type { ReviewJobMessage } from '@codra/schema';
+import { FRESH_INVOCATION_YIELD_SECONDS } from '@codra/core';
+import { runReviewJob } from '@server/core/review';
 import { setJobWorkflowInstance } from '@codra/db/jobs';
-import { logger } from '@server/core/logger';
+import { logger } from '@codra/core/logger';
 import { runBestEffortJobMaintenance } from '@server/core/job-recovery';
-import { runWithDb } from '@codra/db/client';
+import type { AppBindings } from '../env';
+import type { WorkflowStep } from 'cloudflare:workers';
 
-export class ReviewWorkflow extends WorkflowEntrypoint<AppBindings, ReviewJobMessage> {
-  async run(event: WorkflowEvent<ReviewJobMessage>, step: WorkflowStep) {
-    // One DB client for the whole invocation, instead of a Hyperdrive connection per query; a replay after step.sleep just runs this again for the new invocation.
-    return runWithDb(this.env, () => this.execute(event, step));
+export class CloudflareOrchestrator implements JobOrchestrator {
+  constructor(private readonly workflow: Workflow, private readonly env?: AppBindings) {}
+
+  async startReviewJob(id: string, params: ReviewJobMessage): Promise<void> {
+    await this.workflow.create({
+      id,
+      params,
+    });
   }
 
-  private async execute(event: WorkflowEvent<ReviewJobMessage>, step: WorkflowStep) {
+  async executeSteps(event: { payload: ReviewJobMessage, instanceId: string }, step: WorkflowStep) {
+    if (!this.env) throw new Error('env is required for execution');
     const params = event.payload;
     const env = this.env;
-
     const jobId = params.jobId ?? params.deliveryId;
 
     await step.do('bind-workflow-id', async () => {
@@ -73,10 +78,8 @@ export class ReviewWorkflow extends WorkflowEntrypoint<AppBindings, ReviewJobMes
             filesReviewed: 0,
             verdict: 'failed',
             severityDistribution: {},
-            // concurrencyLevel is not available in the workflow context (no DB access at this level)
             concurrencyLevel: 'unknown',
             prTotalLinesChanged: 0,
-            // attempt is 1-indexed; subtract 1 so the first run is retryCount=0
             retryCount: Math.max(0, attempt - 1),
           });
         });
@@ -84,7 +87,6 @@ export class ReviewWorkflow extends WorkflowEntrypoint<AppBindings, ReviewJobMes
       }
 
       if (result.action === 'next_phase') {
-        // Hand the next phase to a BRAND-NEW instance when this one can no longer get a clean subrequest budget: a long-lived instance stops hibernating between steps, so its budget never resets.
         if (result.freshInstance) {
           const nextJobId = result.jobId ?? jobId;
           if (nextJobId) {
@@ -101,17 +103,14 @@ export class ReviewWorkflow extends WorkflowEntrypoint<AppBindings, ReviewJobMes
           }
         }
         phase = result.phase;
-        // Floor at FRESH_INVOCATION_YIELD_SECONDS, not 1: a short sleep does NOT hibernate, so the next phase would run on a spent budget while its TokenTracker starts at zero.
         delaySeconds = Math.max(result.delaySeconds ?? 0, FRESH_INVOCATION_YIELD_SECONDS);
       } else if (result.action === 'retry') {
         delaySeconds = result.delaySeconds ?? 60;
       } else {
-        // 'ack' or completion
         break;
       }
     }
 
-    // Yield first, so maintenance gets its own subrequest budget rather than the remains of the one the final phase step may have just exhausted.
     await step.sleep('pre-post-maintenance-yield', `${FRESH_INVOCATION_YIELD_SECONDS} seconds`);
 
     try {
diff --git a/apps/worker/src/sessions.ts b/apps/worker/src/sessions.ts
new file mode 100644
index 00000000..8d548a3f
--- /dev/null
+++ b/apps/worker/src/sessions.ts
@@ -0,0 +1,25 @@
+import type { DashboardSessionUser, SessionStore } from '@codra/core';
+
+export class CloudflareSessionStore implements SessionStore {
+  constructor(private readonly kv: KVNamespace) {}
+
+  private sessionKey(token: string) {
+    return `session:${token}`;
+  }
+
+  async createSession(session: DashboardSessionUser): Promise<string> {
+    const token = Math.random().toString(36).substring(2);
+    await this.kv.put(this.sessionKey(token), JSON.stringify(session), {
+      expirationTtl: 60 * 60 * 24 * 7,
+    });
+    return token;
+  }
+
+  async readSession(token: string): Promise<DashboardSessionUser | null> {
+    return this.kv.get(this.sessionKey(token), 'json');
+  }
+
+  async destroySession(token: string): Promise<void> {
+    await this.kv.delete(this.sessionKey(token));
+  }
+}
diff --git a/src/server/worker-env.d.ts b/apps/worker/src/worker-env.d.ts
similarity index 99%
rename from src/server/worker-env.d.ts
rename to apps/worker/src/worker-env.d.ts
index 3b72fde3..dd6b73ec 100644
--- a/src/server/worker-env.d.ts
+++ b/apps/worker/src/worker-env.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types ./src/server/worker-env.d.ts` (hash: 76d8ec86de20e8aacd6c22180ec1b53d)
+// Generated by Wrangler by running `wrangler types ./src/worker-env.d.ts` (hash: 76d8ec86de20e8aacd6c22180ec1b53d)
 // Runtime types generated with workerd@1.20260801.1 2026-04-16 nodejs_compat
 interface __BaseEnv_Env {
 	APP_KV: KVNamespace;
diff --git a/apps/worker/src/workflows/review.ts b/apps/worker/src/workflows/review.ts
new file mode 100644
index 00000000..01d55f99
--- /dev/null
+++ b/apps/worker/src/workflows/review.ts
@@ -0,0 +1,17 @@
+import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';
+import type { AppBindings } from '../env';
+import { type ReviewJobMessage } from '@codra/schema';
+import { runWithDb } from '@codra/db/client';
+import { CloudflareOrchestrator } from '../ports/cloudflare-orchestrator';
+
+export class ReviewWorkflow extends WorkflowEntrypoint<AppBindings, ReviewJobMessage> {
+  async run(event: WorkflowEvent<ReviewJobMessage>, step: WorkflowStep) {
+    // One DB client for the whole invocation, instead of a Hyperdrive connection per query; a replay after step.sleep just runs this again for the new invocation.
+    return runWithDb(this.env, () => this.execute(event, step));
+  }
+
+  private async execute(event: WorkflowEvent<ReviewJobMessage>, step: WorkflowStep) {
+    const orchestrator = new CloudflareOrchestrator(this.env.REVIEW_WORKFLOW, this.env);
+    await orchestrator.executeSteps(event, step);
+  }
+}
diff --git a/worker-configuration.d.ts b/apps/worker/worker-configuration.d.ts
similarity index 100%
rename from worker-configuration.d.ts
rename to apps/worker/worker-configuration.d.ts
diff --git a/wrangler.jsonc b/apps/worker/wrangler.jsonc
similarity index 97%
rename from wrangler.jsonc
rename to apps/worker/wrangler.jsonc
index 0b02fb03..f0e162f5 100644
--- a/wrangler.jsonc
+++ b/apps/worker/wrangler.jsonc
@@ -1,7 +1,7 @@
 {
   "$schema": "./node_modules/wrangler/config-schema.json",
   "name": "codra",
-  "main": "./src/server/index.ts",
+  "main": "./src/index.ts",
   "compatibility_date": "2026-04-16",
   "compatibility_flags": [
     "nodejs_compat"
@@ -71,7 +71,7 @@
     ]
   },
   "assets": {
-    "directory": "./dist/client",
+    "directory": "../../dist/client",
     "binding": "ASSETS",
     "not_found_handling": "single-page-application",
     "run_worker_first": [
diff --git a/eslint.config.js b/eslint.config.js
index cc5912fd..5d0ec3b0 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -12,7 +12,7 @@ export default tseslint.config(
       '**/dist/**',
       '**/node_modules/**',
       // Generated by `wrangler types`.
-      'src/server/worker-env.d.ts',
+      'apps/worker/src/worker-env.d.ts',
       'worker-configuration.d.ts',
     ],
   },
@@ -106,7 +106,7 @@ export default tseslint.config(
         patterns: [
           { group: ['**/db/jobs-*', '@server/db/jobs-*'], message: 'Import from @server/db/jobs, not a sibling. Eight specs vi.mock that specifier; a direct sibling import silently bypasses the mock.' },
           { group: ['**/db/file-reviews-*', '@server/db/file-reviews-*'], message: 'Import from @server/db/file-reviews, not a sibling. (No spec mocks this one today; the rule keeps the barrel the single entry point.)' },
-          { group: ['**/services/model-review-*', '**/services/model-rate-limits', '**/services/model-chain-runner', '**/services/model-support', '@server/services/model-*'], message: 'Import from @server/services/model, not a sibling. Four specs vi.mock that specifier.' },
+          { group: ['**/services/model-review-*', '**/services/model-rate-limits', '**/services/model-chain-runner', '**/services/model-support', '@codra/models-*'], message: 'Import from @codra/models, not a sibling. Four specs vi.mock that specifier.' },
           { group: ['**/core/github/http', '**/core/github/app-auth', '**/core/github/types', '**/core/github/diff-fetch', '**/core/github/review-post', '**/core/github/labels', '@server/core/github/http', '@server/core/github/app-auth', '@server/core/github/types', '@server/core/github/diff-fetch', '@server/core/github/review-post', '@server/core/github/labels'], message: 'Import from @server/core/github, not a sibling. One spec vi.mocks that specifier. (core/github/oauth is deliberately NOT listed: it is the dashboard OAuth flow, not part of the GitHubClient barrel, and routes/auth.ts imports it directly.)' },
           // Covers every sibling in the family, including the three the barrel re-exports publicly
           // (budget, diff-cache, request) which were previously unprotected.
diff --git a/package-lock.json b/package-lock.json
index 96f00a83..35ccb194 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -570,6 +570,10 @@
       "resolved": "packages/db",
       "link": true
     },
+    "node_modules/@codra/models": {
+      "resolved": "packages/models",
+      "link": true
+    },
     "node_modules/@codra/provider-github": {
       "resolved": "packages/provider-github",
       "link": true
@@ -8662,6 +8666,15 @@
         "postgres": "^3.4.9"
       }
     },
+    "packages/models": {
+      "name": "@codra/models",
+      "version": "0.9.4",
+      "dependencies": {
+        "@codra/core": "*",
+        "@codra/schema": "*"
+      },
+      "devDependencies": {}
+    },
     "packages/provider-github": {
       "name": "@codra/provider-github",
       "version": "0.9.4",
diff --git a/package.json b/package.json
index dee9f48f..cf83099f 100644
--- a/package.json
+++ b/package.json
@@ -20,15 +20,13 @@
   "scripts": {
     "build": "vite build && npm run cf-typegen",
     "build:all": "npm run build --workspaces --if-present",
-    "cf-typegen": "wrangler types ./src/server/worker-env.d.ts",
-    "deploy": "npm run build && npm run migrate && wrangler deploy",
+    "cf-typegen": "cd apps/worker && wrangler types ./src/worker-env.d.ts",
+    "deploy": "npm run build && npm run migrate && cd apps/worker && wrangler deploy",
     "dev": "concurrently -k -n CLIENT,WORKER -c cyan,green \"npm:dev:client\" \"npm:dev:worker\"",
     "dev:client": "vite build --watch --mode development",
-    "dev:worker": "wrangler dev --local",
+    "dev:worker": "cd apps/worker && wrangler dev --local",
     "lint": "eslint src test scripts packages apps",
     "lint:all": "npm run lint --workspaces --if-present",
-    "check:boundaries": "node scripts/check-core-boundary.mjs",
-    "density": "node scripts/comment-density.mjs --top",
     "start": "npm run dev",
     "setup:cloudflare": "node scripts/setup-cloudflare.js",
     "migrate": "node packages/db/scripts/migrate.mjs",
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index 7b4af4d4..d414adec 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -25,4 +25,4 @@ export {
   type VerifyOutcome,
 } from './review';
 
-export type * from './ports';
+export * from './ports';
diff --git a/packages/core/src/ports/in-memory.ts b/packages/core/src/ports/in-memory.ts
new file mode 100644
index 00000000..1b13294c
--- /dev/null
+++ b/packages/core/src/ports/in-memory.ts
@@ -0,0 +1,65 @@
+import type { KeyValueStore } from './kv';
+import type { QueueProducer } from './queue';
+import type { JobOrchestrator } from './orchestrator';
+import type { SessionStore, DashboardSessionUser } from './session-store';
+import type { ReviewJobMessage } from '@codra/schema';
+
+export class InMemoryKV implements KeyValueStore {
+  private store = new Map<string, { value: string; expiresAt?: number }>();
+
+  async put(key: string, value: string, options?: { expirationTtl?: number }): Promise<void> {
+    const expiresAt = options?.expirationTtl ? Date.now() + options.expirationTtl * 1000 : undefined;
+    this.store.set(key, { value, expiresAt });
+  }
+
+  async get(key: string, type: 'json' | 'text'): Promise<any> {
+    const entry = this.store.get(key);
+    if (!entry) return null;
+    if (entry.expiresAt && Date.now() > entry.expiresAt) {
+      this.store.delete(key);
+      return null;
+    }
+    if (type === 'json') {
+      try { return JSON.parse(entry.value); } catch { return null; }
+    }
+    return entry.value;
+  }
+
+  async delete(key: string): Promise<void> {
+    this.store.delete(key);
+  }
+}
+
+export class InMemoryQueue<T> implements QueueProducer<T> {
+  public messages: Array<{ message: T; delaySeconds?: number }> = [];
+
+  async send(message: T, options?: { delaySeconds?: number }): Promise<void> {
+    this.messages.push({ message, delaySeconds: options?.delaySeconds });
+  }
+}
+
+export class InMemoryOrchestrator implements JobOrchestrator {
+  public jobs: Map<string, ReviewJobMessage> = new Map();
+
+  async startReviewJob(id: string, params: ReviewJobMessage): Promise<void> {
+    this.jobs.set(id, params);
+  }
+}
+
+export class InMemorySessionStore implements SessionStore {
+  private kv = new InMemoryKV();
+
+  async createSession(session: DashboardSessionUser): Promise<string> {
+    const token = Math.random().toString(36).substring(2);
+    await this.kv.put(`session:${token}`, JSON.stringify(session), { expirationTtl: 60 * 60 * 24 * 7 });
+    return token;
+  }
+
+  async readSession(token: string): Promise<DashboardSessionUser | null> {
+    return this.kv.get(`session:${token}`, 'json');
+  }
+
+  async destroySession(token: string): Promise<void> {
+    await this.kv.delete(`session:${token}`);
+  }
+}
diff --git a/packages/core/src/ports/index.ts b/packages/core/src/ports/index.ts
index 02bcd61f..50ea63df 100644
--- a/packages/core/src/ports/index.ts
+++ b/packages/core/src/ports/index.ts
@@ -1,5 +1,5 @@
 
-export type { Clock, IdGenerator, KvStore, Logger } from './platform';
+export type { Clock, IdGenerator, KvStore, Logger, SecretStore } from './platform';
 export type { JobLeaseClaim, JobRow, JobStore, PersistedReviewJob } from './jobs';
 export type { BulkFileReviewInput, FileReviewRow, FileReviewStore, SuppressedFinding } from './file-reviews';
 export type { LearningStore, ModelConfigReader, RepoConfigLoader, ReviewSettingsReader, WebhookDeliveryReader } from './settings';
@@ -10,3 +10,8 @@ export type { ReviewTelemetryEvent, TelemetrySink } from './telemetry';
 export type { ReviewRuntime } from './runtime';
 export type { RepoConfigStore } from './repo-config';
 export type { InstanceIdStore } from './instance-id';
+export type { KeyValueStore } from './kv';
+export type { QueueProducer } from './queue';
+export type { JobOrchestrator } from './orchestrator';
+export type { SessionStore, DashboardSessionUser } from './session-store';
+export { InMemoryKV, InMemoryQueue, InMemoryOrchestrator, InMemorySessionStore } from './in-memory';
diff --git a/packages/core/src/ports/kv.ts b/packages/core/src/ports/kv.ts
new file mode 100644
index 00000000..2ca61300
--- /dev/null
+++ b/packages/core/src/ports/kv.ts
@@ -0,0 +1,6 @@
+export interface KeyValueStore {
+  put(key: string, value: string, options?: { expirationTtl?: number }): Promise<void>;
+  get(key: string, type: 'json'): Promise<unknown>;
+  get(key: string, type: 'text'): Promise<string | null>;
+  delete(key: string): Promise<void>;
+}
diff --git a/packages/core/src/ports/orchestrator.ts b/packages/core/src/ports/orchestrator.ts
new file mode 100644
index 00000000..0e6d3f04
--- /dev/null
+++ b/packages/core/src/ports/orchestrator.ts
@@ -0,0 +1,5 @@
+import type { ReviewJobMessage } from '@codra/schema';
+
+export interface JobOrchestrator {
+  startReviewJob(id: string, params: ReviewJobMessage): Promise<void>;
+}
diff --git a/packages/core/src/ports/platform.ts b/packages/core/src/ports/platform.ts
index 67ba0c2a..4b8a1890 100644
--- a/packages/core/src/ports/platform.ts
+++ b/packages/core/src/ports/platform.ts
@@ -12,4 +12,8 @@ export interface IdGenerator {
   randomUUID(): string;
 }
 
+export interface SecretStore {
+  getSecret(key: string): Promise<string | null>;
+}
+
 export type { Logger } from '../logger';
diff --git a/packages/core/src/ports/queue.ts b/packages/core/src/ports/queue.ts
new file mode 100644
index 00000000..745a3375
--- /dev/null
+++ b/packages/core/src/ports/queue.ts
@@ -0,0 +1,3 @@
+export interface QueueProducer<T> {
+  send(message: T, options?: { delaySeconds?: number }): Promise<void>;
+}
diff --git a/packages/core/src/ports/session-store.ts b/packages/core/src/ports/session-store.ts
new file mode 100644
index 00000000..61a789a4
--- /dev/null
+++ b/packages/core/src/ports/session-store.ts
@@ -0,0 +1,14 @@
+export interface DashboardSessionUser {
+  githubUserId: number;
+  login: string;
+  name: string | null;
+  avatarUrl: string | null;
+  email: string | null;
+  signedInAt: string;
+}
+
+export interface SessionStore {
+  createSession(session: DashboardSessionUser): Promise<string>;
+  readSession(token: string): Promise<DashboardSessionUser | null>;
+  destroySession(token: string): Promise<void>;
+}
diff --git a/packages/core/src/review/index.ts b/packages/core/src/review/index.ts
index dd17c079..d14f09f0 100644
--- a/packages/core/src/review/index.ts
+++ b/packages/core/src/review/index.ts
@@ -80,7 +80,6 @@ export type ReviewJobRunResult =
 export async function runReview(env: ReviewRuntime, message: ReviewJobMessage): Promise<ReviewJobRunResult> {
   const resolved = await resolveQueuedJob(env, message);
   if (!resolved) {
-    console.error('TRACE: resolveQueuedJob returned null');
     return { action: 'ack' };
   }
 
@@ -97,12 +96,10 @@ export async function runReview(env: ReviewRuntime, message: ReviewJobMessage):
   const leaseOwner = env.ids.randomUUID();
   const claim = await env.jobs.claimJobLease(resolved.job.id, leaseOwner, JOB_LEASE_SECONDS);
   if (claim.status === 'missing') {
-    console.error('TRACE: claim status missing');
     logger.warn(`Job not found for processing: ${resolved.job.id}`);
     return { action: 'ack' };
   }
   if (claim.status === 'terminal') {
-    console.error('TRACE: claim status terminal');
     logger.info(`Job ${resolved.job.id} is already terminal (${claim.row.status}), acking queue delivery.`);
     return { action: 'ack' };
   }
@@ -129,7 +126,6 @@ export async function runReview(env: ReviewRuntime, message: ReviewJobMessage):
     model = env.createModel(job.id, tracker);
     formatter = env.createFormatter();
   } catch (err) {
-    console.error('INITIALIZATION FAILED', err);
     throw err;
   }
 
@@ -143,7 +139,6 @@ export async function runReview(env: ReviewRuntime, message: ReviewJobMessage):
     }
 
     await env.jobs.releaseJobLease(job.id, leaseOwner);
-    console.error('TRACE: finished successfully, returning ack');
     return { action: 'ack' };
   } catch (error) {
     const messageText = error instanceof Error ? error.message : 'Unknown review failure';
diff --git a/packages/db/src/accounts.ts b/packages/db/src/accounts.ts
index a9e34185..360a1f3c 100644
--- a/packages/db/src/accounts.ts
+++ b/packages/db/src/accounts.ts
@@ -1,5 +1,6 @@
 import type { DbEnv } from './env';
 import { queryRows } from './client';
+import { ACCOUNT_COLUMNS } from './constants';
 
 // Durable account record (see db/migrations/004_account_settings.sql).
 export type AccountSettingsRecord = {
@@ -29,12 +30,12 @@ type Row = {
   timezone: string | null;
 };
 
-const COLUMNS = 'id, github_user_id, github_username, account_name, account_email, timezone';
+
 
 function mapRow(row: Row): AccountSettingsRecord {
   return {
     id: row.id,
-    // BIGINT comes back as a string from postgres.js; GitHub ids are well within Number's safe integer range.
+    // BIGINT returns as string; GitHub ids fit in Number.
     githubUserId: Number(row.github_user_id),
     githubUsername: row.github_username,
     accountName: row.account_name,
@@ -57,7 +58,7 @@ export async function upsertAccountSettings(
        account_name    = COALESCE(account_settings.account_name, EXCLUDED.account_name),
        account_email   = EXCLUDED.account_email,
        updated_at      = now()
-     RETURNING ${COLUMNS}`,
+     RETURNING ${ACCOUNT_COLUMNS}`,
     [input.githubUserId, input.githubUsername, input.accountName, input.accountEmail],
   );
   return mapRow(rows[0]);
@@ -69,13 +70,13 @@ export async function getAccountSettings(
 ): Promise<AccountSettingsRecord | null> {
   const rows = await queryRows<Row>(
     env,
-    `SELECT ${COLUMNS} FROM account_settings WHERE github_user_id = $1`,
+    `SELECT ${ACCOUNT_COLUMNS} FROM account_settings WHERE github_user_id = $1`,
     [githubUserId],
   );
   return rows[0] ? mapRow(rows[0]) : null;
 }
 
-// Only keys present in `patch` are written, so one field can't clobber the other; `timezone: null` is a meaningful value ("follow the browser"), hence the `!== undefined` checks.
+// Only write present keys; `timezone: null` is meaningful.
 export async function updateAccountSettings(
   env: DbEnv,
   githubUserId: number,
@@ -99,7 +100,7 @@ export async function updateAccountSettings(
     `UPDATE account_settings
      SET ${assignments.join(', ')}, updated_at = now()
      WHERE github_user_id = $1
-     RETURNING ${COLUMNS}`,
+     RETURNING ${ACCOUNT_COLUMNS}`,
     params,
   );
   return rows[0] ? mapRow(rows[0]) : null;
diff --git a/packages/db/src/app-settings.ts b/packages/db/src/app-settings.ts
index d2785f06..7ba51096 100644
--- a/packages/db/src/app-settings.ts
+++ b/packages/db/src/app-settings.ts
@@ -1,14 +1,21 @@
 import type { DbEnv } from './env';
 import { queryRows } from './client';
-import { reviewConcurrencyLevels, reviewMaxCommentsOptions, reviewMaxFilesRange, reviewSettingsSchema, type ReviewSettings } from '@codra/schema';
+import {
+  CONCURRENCY_KEY,
+  MAX_COMMENTS_KEY,
+  MAX_FILES_KEY,
+  CONCURRENCY_LEVELS,
+  MAX_COMMENTS_OPTIONS
+} from './constants';
+import { reviewMaxFilesRange, reviewSettingsSchema, type ReviewSettings } from '@codra/schema';
+
+
+
 
-const CONCURRENCY_KEY = 'review_concurrency_level';
-const MAX_COMMENTS_KEY = 'review_max_comments';
-const MAX_FILES_KEY = 'review_max_files';
 
 const DEFAULT_REVIEW_SETTINGS: ReviewSettings = reviewSettingsSchema.parse({});
-const CONCURRENCY_LEVELS = new Set<string>(reviewConcurrencyLevels);
-const MAX_COMMENTS_OPTIONS = new Set<number>(reviewMaxCommentsOptions);
+
+
 
 export async function getReviewSettings(env: DbEnv): Promise<ReviewSettings> {
   try {
diff --git a/packages/db/src/client.ts b/packages/db/src/client.ts
index 5ad3299c..020f0235 100644
--- a/packages/db/src/client.ts
+++ b/packages/db/src/client.ts
@@ -62,19 +62,10 @@ export function runWithDb<T>(env: DbEnv, fn: () => T): T {
   return dbStorage.run(createDbClient(env), fn);
 }
 
-// Keyed by connection string so a caller outside a runWithDb() scope shares one bounded pool instead of leaking a fresh pool per query.
-//
-// This Map lives at MODULE SCOPE, which in Workers outlives the request that filled it -- so a cached
-// client holds a socket opened in an earlier request context, and the next request to reuse it dies with
-// "Cannot perform I/O on behalf of a different request". It was described as test-only ("production
-// always wraps work in runWithDb()"), but production hit it repeatedly: binding a workflow ID to a job,
-// recovering expired job leases, and at least one outright failed file review. AsyncLocalStorage context
-// can also be lost crossing into a Workflow/jsrpc entrypoint, which drops callers onto this path without
-// them changing anything. So the cache has to be self-healing rather than merely convenient.
+// Module-scoped Map pools connections outside runWithDb, but must self-heal when request context changes.
 const fallbackClients = new Map<string, DbClient>();
 
-// Both faces of a socket belonging to a dead request context: the runtime's refusal, and a pooled
-// connection that was already torn down with it.
+// Catch dead request context I/O errors and terminated connections.
 function isStaleConnectionError(error: unknown): boolean {
   const message = error instanceof Error ? error.message : String(error);
   return message.includes('Cannot perform I/O on behalf of a different request')
@@ -94,10 +85,7 @@ export function getDb(env: DbEnv) {
   return client;
 }
 
-// Runs `op` against the ambient client, and if a request-scoped socket from the module cache has gone
-// stale, discards it and retries ONCE on a fresh one. Only the cached path is retried: inside
-// runWithDb() the client belongs to this request already, so the same error there is a real bug and must
-// surface rather than be papered over.
+// Retries op once on a fresh client if the module-cached socket has gone stale.
 async function withStaleConnectionRecovery<T>(env: DbEnv, op: (db: DbClient) => Promise<T>): Promise<T> {
   const inScope = dbStorage.getStore() !== undefined;
   try {
diff --git a/packages/db/src/constants.ts b/packages/db/src/constants.ts
new file mode 100644
index 00000000..7e048ba5
--- /dev/null
+++ b/packages/db/src/constants.ts
@@ -0,0 +1,56 @@
+import { reviewConcurrencyLevels, reviewMaxCommentsOptions } from '@codra/schema';
+
+// accounts.ts
+export const ACCOUNT_COLUMNS = 'id, github_user_id, github_username, account_name, account_email, timezone';
+
+// app-settings.ts
+export const CONCURRENCY_KEY = 'review_concurrency_level';
+export const MAX_COMMENTS_KEY = 'review_max_comments';
+export const MAX_FILES_KEY = 'review_max_files';
+export const CONCURRENCY_LEVELS = new Set<string>(reviewConcurrencyLevels);
+export const MAX_COMMENTS_OPTIONS = new Set<number>(reviewMaxCommentsOptions);
+
+// jobs-activity.ts
+export const SYSTEM_ACTIVE_JOBS_KEY = 'system:active_jobs';
+
+// model-configs.ts
+export const PROVIDER_COLUMNS = 'id, name, api_format, base_url, encrypted_api_key, enabled, created_at, updated_at';
+export const MODEL_SELECT = `
+  SELECT
+    mc.model_id,
+    mc.provider_id,
+    p.name AS provider_name,
+    p.api_format,
+    mc.model_name,
+    mc.updated_at
+  FROM model_configs mc
+  JOIN llm_providers p ON mc.provider_id = p.id
+`;
+
+// repo-configs.ts
+export const REPO_CONFIG_SELECT = `
+  SELECT
+    r.installation_id,
+    r.owner,
+    r.repo,
+    rc.parsed_json,
+    rc.updated_at,
+    rc.main_model,
+    rc.fallback_models,
+    rc.size_overrides,
+    rc.enabled,
+    lj.created_at AS last_job_created_at,
+    lj.verdict AS last_job_verdict
+  FROM repo_configs rc
+  JOIN repositories r ON rc.repository_id = r.id
+  LEFT JOIN LATERAL (
+    SELECT created_at, verdict
+    FROM jobs
+    WHERE repository_id = r.id
+    ORDER BY created_at DESC
+    LIMIT 1
+  ) lj ON true
+`;
+
+// instance-id-repository.ts
+export const INSTANCE_ID_KEY = 'codra:instance_id';
diff --git a/packages/db/src/file-reviews-bulk.ts b/packages/db/src/file-reviews-bulk.ts
index 177e7310..a6e8c0a1 100644
--- a/packages/db/src/file-reviews-bulk.ts
+++ b/packages/db/src/file-reviews-bulk.ts
@@ -63,8 +63,6 @@ export async function bulkInheritFileReviews(
   });
 }
 
-// Part of the FileReviewStore port contract, so @codra/core/ports owns the shape and this module
-// re-exports it: one definition, and the engine does not depend on this file.
 export type { BulkFileReviewInput } from '@codra/core/ports';
 
 // One transaction: per-file upserts would spend the saved model calls back on DB subrequests. `diff_input` is not written (migration 003 nulls it).
@@ -120,25 +118,16 @@ export async function bulkUpsertFileReviews(
           transient_error_count = 0
         RETURNING id, file_path
       `,
-      [
-        jobId,
-        inputs.map((i) => i.filePath),
-        inputs.map((i) => i.fileStatus),
-        inputs.map((i) => i.modelUsed),
-        inputs.map((i) => i.diffLineCount),
-        inputs.map((i) => i.rawAiOutput),
-        inputs.map((i) => i.inputTokens),
-        inputs.map((i) => i.outputTokens),
-        inputs.map((i) => i.durationMs),
-        inputs.map((i) => i.verdict),
-        inputs.map((i) => i.fileSummary),
-        inputs.map((i) => i.overallCorrectness ?? null),
-        inputs.map((i) => i.confidenceScore ?? null),
-        inputs.map((i) => i.errorMessage),
-        inputs.map((i) => i.modelProvider ?? null),
-        inputs.map((i) => (i.withheldCounts ? JSON.stringify(i.withheldCounts) : null)),
-        inputs.map((i) => i.batchSize),
-      ],
+      (() => {
+        const res: any[] = [jobId, [], [], [], [], [], [], [], [], [], [], [], [], [], [], [], []];
+        for (const i of inputs) {
+          res[1].push(i.filePath); res[2].push(i.fileStatus); res[3].push(i.modelUsed); res[4].push(i.diffLineCount);
+          res[5].push(i.rawAiOutput); res[6].push(i.inputTokens); res[7].push(i.outputTokens); res[8].push(i.durationMs);
+          res[9].push(i.verdict); res[10].push(i.fileSummary); res[11].push(i.overallCorrectness ?? null); res[12].push(i.confidenceScore ?? null);
+          res[13].push(i.errorMessage); res[14].push(i.modelProvider ?? null); res[15].push(i.withheldCounts ? JSON.stringify(i.withheldCounts) : null); res[16].push(i.batchSize);
+        }
+        return res;
+      })(),
     );
 
     await tx.query('DELETE FROM review_comments WHERE file_review_id = ANY($1::uuid[])', [inserted.map((r) => r.id)]);
diff --git a/packages/db/src/file-reviews-findings.ts b/packages/db/src/file-reviews-findings.ts
index 2d794d6d..b7743387 100644
--- a/packages/db/src/file-reviews-findings.ts
+++ b/packages/db/src/file-reviews-findings.ts
@@ -2,7 +2,6 @@ import type { DbEnv } from './env';
 import type { SuppressedFinding } from '@codra/core/ports';
 import { queryRows } from './client';
 
-// Part of the FileReviewStore port contract; @codra/core/ports owns it and this module re-exports.
 export type { SuppressedFinding } from '@codra/core/ports';
 
 // Findings already posted on an EARLIER commit with the anchored line unchanged, or rejected by a human anywhere in this repository.
diff --git a/packages/db/src/file-reviews.ts b/packages/db/src/file-reviews.ts
index 9d38849b..b61c4b77 100644
--- a/packages/db/src/file-reviews.ts
+++ b/packages/db/src/file-reviews.ts
@@ -134,7 +134,7 @@ export async function upsertFileReview(
         input.modelProvider ?? null,
         input.asyncRequestId ?? null,
         input.asyncModel ?? null,
-        // JSON text into a `::text::jsonb` placeholder: the one jsonb-writing idiom (see normalizeParam in db/client.ts); mixing idioms is how the string-scalar bug spread to five columns.
+        // JSON text to ::text::jsonb placeholder prevents string-scalar bugs.
         input.withheldCounts ? JSON.stringify(input.withheldCounts) : null,
       ],
     );
diff --git a/packages/db/src/jobs-activity.ts b/packages/db/src/jobs-activity.ts
index b585df02..bf9ee972 100644
--- a/packages/db/src/jobs-activity.ts
+++ b/packages/db/src/jobs-activity.ts
@@ -1,14 +1,14 @@
 import type { DbEnv } from './env';
+import { SYSTEM_ACTIVE_JOBS_KEY } from './constants';
 
-// Import from db/jobs.ts, not here. Holds the KV "is anything running" flag the maintenance loop reads to decide whether it can skip the DB and let Postgres suspend.
-// Kept as a leaf, not in the barrel, because jobs-leases.ts and jobs-lifecycle.ts both write this flag and jobs.ts imports both, which would otherwise create an import cycle.
+// Holds KV flag for maintenance loop. Leaf module to avoid import cycles.
 
 export async function markSystemActive(env: DbEnv) {
   try {
-    // claimJobLease() calls this on every review chunk; read first and only write when missing, since a large PR's dozens of chunks otherwise blow the Workers-Free daily KV write quota.
-    const existing = await env.APP_KV.get('system:active_jobs');
+    // claimJobLease calls this; read before write to save KV write quota.
+    const existing = await env.APP_KV.get(SYSTEM_ACTIVE_JOBS_KEY);
     if (existing) return;
-    await env.APP_KV.put('system:active_jobs', '1', { expirationTtl: 20 * 60 });
+    await env.APP_KV.put(SYSTEM_ACTIVE_JOBS_KEY, '1', { expirationTtl: 20 * 60 });
   } catch (error) {
   // Ignore KV errors to avoid failing the DB transaction
   }
@@ -16,7 +16,7 @@ export async function markSystemActive(env: DbEnv) {
 
 export async function clearSystemActive(env: DbEnv) {
   try {
-    await env.APP_KV.delete('system:active_jobs');
+    await env.APP_KV.delete(SYSTEM_ACTIVE_JOBS_KEY);
   } catch (error) {
   // Best-effort: the 20-minute TTL on the flag is the backstop if this delete fails.
   }
diff --git a/packages/db/src/jobs-leases.ts b/packages/db/src/jobs-leases.ts
index 75e85744..1307d919 100644
--- a/packages/db/src/jobs-leases.ts
+++ b/packages/db/src/jobs-leases.ts
@@ -3,7 +3,6 @@ import { queryRows } from './client';
 import type { JobRow } from './jobs-mapping';
 import { markSystemActive } from './jobs-activity';
 
-// Import from db/jobs.ts, not here.
 
 // Lives here rather than with the other read queries because claimJobLease is its main caller; keeping it in the barrel would make jobs.ts <-> jobs-leases.ts an import cycle.
 export async function getJobForProcessing(env: DbEnv, jobId: string) {
@@ -130,7 +129,7 @@ export async function releaseJobLease(env: DbEnv, jobId: string, leaseOwner: str
   );
 }
 
-// Bumps the no-progress continuation counter for a job rescheduling the same phase; cleared by resetJobContinuationCount() whenever a chunk completes a file, so a stuck job climbs toward MAX_JOB_CONTINUATIONS.
+// Bumps continuation counter; cleared on file completion to detect stuck jobs.
 export async function markJobContinuationQueued(env: DbEnv, jobId: string, delaySeconds = 0) {
   const rows = await queryRows<{ continuation_count: number }>(
     env,
@@ -151,8 +150,7 @@ export async function markJobContinuationQueued(env: DbEnv, jobId: string, delay
   return rows[0]?.continuation_count ?? 0;
 }
 
-// Clears the no-progress continuation counter after a chunk completes at least one file review,
-// so slow-but-progressing jobs never trip the MAX_JOB_CONTINUATIONS safety net.
+// Clears continuation counter on file completion.
 export async function resetJobContinuationCount(env: DbEnv, jobId: string) {
   await queryRows(
     env,
@@ -167,9 +165,7 @@ export async function resetJobContinuationCount(env: DbEnv, jobId: string) {
   );
 }
 
-// `onlyJobIds` narrows both sweeps to specific jobs. Production leaves it unset and takes the whole
-// table; tests pass their own job so the LIMIT 25 window and FOR UPDATE SKIP LOCKED cannot hand the
-// slot to an unrelated stale 'running' row inserted by a suite running in a parallel worker.
+// onlyJobIds isolates tests from stealing stale rows.
 export async function recoverExpiredJobLeases(
   env: DbEnv,
   maxRecoveryCount = 3,
diff --git a/packages/db/src/jobs-lifecycle.ts b/packages/db/src/jobs-lifecycle.ts
index 9e32c124..6cd4248d 100644
--- a/packages/db/src/jobs-lifecycle.ts
+++ b/packages/db/src/jobs-lifecycle.ts
@@ -3,7 +3,6 @@ import { queryRows } from './client';
 import type { JobRow } from './jobs-mapping';
 import { markSystemActive } from './jobs-activity';
 
-// Import from db/jobs.ts, not from here.
 
 export async function updateJobCheckRun(env: DbEnv, jobId: string, checkRunId: number) {
   await queryRows(
@@ -122,7 +121,7 @@ export async function failJob(env: Pick<DbEnv, 'HYPERDRIVE' | 'APP_KV'>, jobId:
   await markSystemActive(env);
 }
 
-// Clears the lease so recovery won't requeue it. Returns false if already terminal; caller must terminate the Cloudflare Workflow instance separately.
+// Clears lease. Returns false if terminal (caller must terminate Workflow).
 export async function cancelJob(env: Pick<DbEnv, 'HYPERDRIVE' | 'APP_KV'>, jobId: string): Promise<boolean> {
   const rows = await queryRows<{ id: string }>(
     env,
@@ -155,7 +154,7 @@ export async function cancelJob(env: Pick<DbEnv, 'HYPERDRIVE' | 'APP_KV'>, jobId
   return rows.length > 0;
 }
 
-// file_reviews/review_comments cascade automatically; child retry jobs have retry_of_job_id nulled instead of being deleted.
+// review_comments cascade; child retries have retry_of_job_id nulled.
 export async function deleteJob(env: DbEnv, jobId: string): Promise<boolean> {
   const rows = await queryRows<{ id: string }>(
     env,
diff --git a/packages/db/src/jobs.ts b/packages/db/src/jobs.ts
index 9ac51aeb..0c540e3f 100644
--- a/packages/db/src/jobs.ts
+++ b/packages/db/src/jobs.ts
@@ -23,7 +23,7 @@ export async function setJobWorkflowInstance(env: DbEnv, jobId: string, workflow
   );
 }
 
-// Values are snapshotted at job-creation time (and copied verbatim onto retries), so without this a title edited on GitHub afterward would keep showing stale on the dashboard.
+// Snapshotted values; prevents stale dashboard if PR title changes.
 export async function setJobPullRequestMeta(
   env: DbEnv,
   jobId: string,
@@ -41,7 +41,7 @@ export async function setJobPullRequestMeta(
   );
 }
 
-// False lets the cron clear `system:active_jobs` so later ticks skip the DB and serverless Postgres can suspend.
+// False allows cron to clear SYSTEM_ACTIVE_JOBS_KEY.
 export async function hasPendingMaintenanceWork(env: DbEnv): Promise<boolean> {
   const rows = await queryRows<{ has_work: boolean }>(
     env,
@@ -321,7 +321,7 @@ export async function findExistingJobForHead(
   return row ? mapJob(row) : null;
 }
 
-// Re-exported so '@server/db/jobs' stays the single import path: eight specs vi.mock this specifier, and a direct sibling import would bypass the mock silently.
+// Re-export so imports use db/jobs.ts (respects vi.mock).
 export { type JobRow, bytesToHex, mapJob } from './jobs-mapping';
 export { markSystemActive, clearSystemActive } from './jobs-activity';
 export {
diff --git a/packages/db/src/model-configs.ts b/packages/db/src/model-configs.ts
index 50f74e92..918d0fc1 100644
--- a/packages/db/src/model-configs.ts
+++ b/packages/db/src/model-configs.ts
@@ -1,6 +1,7 @@
 import type { DbEnv } from './env';
 
-import { queryRows } from './client';
+import { queryRows } from './client';
+import { PROVIDER_COLUMNS, MODEL_SELECT } from './constants';
 import {
   KIMI_K2_5_MODEL,
   llmProviderSchema,
@@ -68,19 +69,9 @@ function mapModelConfig(row: ModelConfigRow): ModelConfig {
 }
 
 // The llm_providers column list, in one place, since it was inlined at six sites before, all needing updates for one new column.
-const PROVIDER_COLUMNS = 'id, name, api_format, base_url, encrypted_api_key, enabled, created_at, updated_at';
-
-const MODEL_SELECT = `
-  SELECT
-    mc.model_id,
-    mc.provider_id,
-    p.name AS provider_name,
-    p.api_format,
-    mc.model_name,
-    mc.updated_at
-  FROM model_configs mc
-  JOIN llm_providers p ON p.id = mc.provider_id
-`;
+
+
+
 
 export async function listLlmProviders(env: DbEnv): Promise<LlmProvider[]> {
   const rows = await queryRows<ProviderRow>(
diff --git a/packages/db/src/repo-configs.ts b/packages/db/src/repo-configs.ts
index 4c8d8034..7764a54b 100644
--- a/packages/db/src/repo-configs.ts
+++ b/packages/db/src/repo-configs.ts
@@ -78,7 +78,7 @@ export async function upsertRepoConfig(
   );
 }
 
-// Only creates the record if missing, so an existing repo's model overrides are never overwritten.
+// Creates record if missing; preserves model overrides.
 export async function syncRepoConfig(
   env: DbEnv,
   input: {
diff --git a/packages/db/src/repositories/instance-id-repository.ts b/packages/db/src/repositories/instance-id-repository.ts
index 0a20800d..9460ff21 100644
--- a/packages/db/src/repositories/instance-id-repository.ts
+++ b/packages/db/src/repositories/instance-id-repository.ts
@@ -1,8 +1,9 @@
 import type { InstanceIdStore } from '@codra/core/ports';
 import type { DbEnv } from '../env';
 import { queryRows } from '../client';
+import { INSTANCE_ID_KEY } from '../constants';
+
 
-const INSTANCE_ID_KEY = 'codra:instance_id';
 
 export function makeInstanceIdStore(env: DbEnv): InstanceIdStore {
   return {
@@ -18,8 +19,7 @@ export function makeInstanceIdStore(env: DbEnv): InstanceIdStore {
             'INSERT INTO global_settings (key, value) VALUES ($1, $2) ON CONFLICT (key) DO NOTHING', 
             [INSTANCE_ID_KEY, instanceId]
           );
-          // Fetch again in case another instance inserted it concurrently
-          const rowsAfter = await queryRows<{ value: string }>(env, 'SELECT value FROM global_settings WHERE key = $1', [INSTANCE_ID_KEY]);
+                const rowsAfter = await queryRows<{ value: string }>(env, 'SELECT value FROM global_settings WHERE key = $1', [INSTANCE_ID_KEY]);
           instanceId = rowsAfter[0]?.value ?? instanceId;
         }
         return instanceId;
diff --git a/packages/db/src/repositories/jobs-repository.ts b/packages/db/src/repositories/jobs-repository.ts
index d8e9ab15..bb50f4b5 100644
--- a/packages/db/src/repositories/jobs-repository.ts
+++ b/packages/db/src/repositories/jobs-repository.ts
@@ -27,20 +27,14 @@ import {
   clearSystemActive,
 } from '../jobs';
 
-// Pins PersistedReviewJob to what mapJob actually returns, in both directions. mapJob ends in
-// jobSummarySchema.parse(), so the two are already the same type -- this makes that a compile error
-// to break rather than something to notice later.
+// Pins PersistedReviewJob to mapJob's return type for compile-time safety.
 type _PinPersistedReviewJob = ReturnType<typeof mapJob> extends PersistedReviewJob
   ? PersistedReviewJob extends ReturnType<typeof mapJob> ? true : never
   : never;
 const _pinPersistedReviewJob: _PinPersistedReviewJob = true;
 void _pinPersistedReviewJob;
 
-// JobLeaseClaim is the one port contract that stays hand-copied rather than re-exported: the db
-// version carries the FULL jobs row, which the engine must not see, so the two cannot be the same
-// type. This pins the part that matters -- the discriminant set and the extra `busy` field -- so
-// adding a fifth status on the db side is a compile error here rather than a silent fall-through in
-// the engine's claim ladder.
+// Hand-copied because DB version has full job row. Pins status/busy fields.
 type _PinLeaseStatuses = Awaited<ReturnType<typeof claimJobLease>>['status'] extends CoreJobLeaseClaim['status']
   ? CoreJobLeaseClaim['status'] extends Awaited<ReturnType<typeof claimJobLease>>['status'] ? true : never
   : never;
diff --git a/packages/db/src/review-comment-sql.ts b/packages/db/src/review-comment-sql.ts
index dff5f083..270c701c 100644
--- a/packages/db/src/review-comment-sql.ts
+++ b/packages/db/src/review-comment-sql.ts
@@ -1,6 +1,6 @@
 import type { ParsedReviewComment } from '@codra/schema';
 
-// One definition of the `review_comments` field list, shared by every reader/writer. Exception: `bulkInheritFileReviews` in file-reviews-bulk.ts hand-writes its own, so columns added here go there too.
+// Shared review_comments field list. Update bulkInheritFileReviews if changed.
 
 // Column order for INSERT INTO review_comments (...). Must match REVIEW_COMMENT_INSERT_CASTS.
 export const REVIEW_COMMENT_INSERT_COLUMNS = [
diff --git a/packages/models/package.json b/packages/models/package.json
new file mode 100644
index 00000000..7c6baed9
--- /dev/null
+++ b/packages/models/package.json
@@ -0,0 +1,26 @@
+{
+  "name": "@codra/models",
+  "version": "0.9.4",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./types": "./src/types.ts",
+    "./runner": "./src/runner.ts",
+    "./cloudflare": "./src/providers/cloudflare.ts",
+    "./google": "./src/providers/google.ts",
+    "./vertex": "./src/providers/vertex.ts",
+    "./anthropic": "./src/providers/anthropic.ts",
+    "./openai": "./src/providers/openai.ts"
+  },
+  "scripts": {
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@codra/schema": "*",
+    "@codra/core": "*"
+  },
+  "devDependencies": {
+  }
+}
diff --git a/src/server/models/catalog.ts b/packages/models/src/catalog.ts
similarity index 100%
rename from src/server/models/catalog.ts
rename to packages/models/src/catalog.ts
diff --git a/src/server/models/gemini-schema.ts b/packages/models/src/gemini-schema.ts
similarity index 100%
rename from src/server/models/gemini-schema.ts
rename to packages/models/src/gemini-schema.ts
diff --git a/packages/models/src/index.ts b/packages/models/src/index.ts
new file mode 100644
index 00000000..442703c2
--- /dev/null
+++ b/packages/models/src/index.ts
@@ -0,0 +1,18 @@
+export { ModelRunner } from './runner';
+export { RetryableModelError, isRetryableModelError, nextChainIndexOf } from './runner';
+export { PROMPT_FIT_SAFETY_FACTOR, estimatePromptTokens } from './runner';
+export { ModelChainProgressStore } from './runner';
+export { isPlausibleTokenBucket, parseRateLimitFromError } from './runner';
+export type { BatchReviewOutcome } from './runner';
+
+export * from './catalog';
+export * from './limits';
+export * from './url-guard';
+export * from './llm-crypto';
+export * from './types';
+export type { CloudflareAiBinding } from './providers/cloudflare';
+export { reviewWithCloudflare } from './providers/cloudflare';
+export { reviewWithGoogle } from './providers/google';
+export { reviewWithAnthropic } from './providers/anthropic';
+export { reviewWithOpenAI } from './providers/openai';
+export { reviewWithVertex } from './providers/vertex';
diff --git a/src/server/services/model-chain-progress.ts b/packages/models/src/internal/model-chain-progress.ts
similarity index 95%
rename from src/server/services/model-chain-progress.ts
rename to packages/models/src/internal/model-chain-progress.ts
index 0f936b2d..94cd62ae 100644
--- a/src/server/services/model-chain-progress.ts
+++ b/packages/models/src/internal/model-chain-progress.ts
@@ -1,6 +1,6 @@
-import { logger } from '../core/logger';
-import type { AppBindings } from '../env';
-import type { TokenTracker } from '../core/token-tracker';
+import { logger } from '@codra/core/logger';
+import type { KvStore } from '@codra/core/ports';
+import type { TokenTracker } from '@codra/core/token-tracker';
 import { isPlausibleTokenBucket } from './model-support';
 
 // Stores where each label got to in its model chain so deferred reviews resume properly.
@@ -85,7 +85,7 @@ export class ModelChainProgressStore {
   private dirty = false;
 
   constructor(
-    private readonly env: Pick<AppBindings, 'APP_KV'>,
+    private readonly kv: KvStore,
     private readonly jobId: string | undefined,
     private readonly tracker?: TokenTracker,
   ) {}
@@ -103,7 +103,8 @@ export class ModelChainProgressStore {
       if (!key) return new Map<string, number>();
       try {
         this.tracker?.incrementSubrequests(1);
-        const raw = await this.env.APP_KV.get(key, 'json');
+        const rawString = await this.kv.get(key);
+        const raw = rawString ? JSON.parse(rawString) : null;
         if (!raw || typeof raw !== 'object') return new Map<string, number>();
 
         // Legacy support: reads bare label->index maps as files for smooth deploys.
@@ -172,7 +173,8 @@ export class ModelChainProgressStore {
     try {
       // Merge against remote KV state using max() to prevent concurrent invocations from dropping labels.
       this.tracker?.incrementSubrequests(1);
-      const raw = await this.env.APP_KV.get(key, 'json');
+      const rawString = await this.kv.get(key);
+      const raw = rawString ? JSON.parse(rawString) : null;
       if (raw && typeof raw === 'object') {
         const stored = raw as StoredShape;
         const isNewShape =
@@ -191,7 +193,7 @@ export class ModelChainProgressStore {
       }
 
       this.tracker?.incrementSubrequests(1);
-      await this.env.APP_KV.put(
+      await this.kv.put(
         key,
         JSON.stringify({
           files: Object.fromEntries(progress),
diff --git a/src/server/services/model-chain-runner.ts b/packages/models/src/internal/model-chain-runner.ts
similarity index 92%
rename from src/server/services/model-chain-runner.ts
rename to packages/models/src/internal/model-chain-runner.ts
index bf96f9d4..bb00d44b 100644
--- a/src/server/services/model-chain-runner.ts
+++ b/packages/models/src/internal/model-chain-runner.ts
@@ -1,16 +1,15 @@
-import { buildSummaryPrompt, SUMMARY_SYSTEM_PROMPT } from '../prompts/summary';
-import { buildVerifyPrompt, VERIFY_RESPONSE_SCHEMA, VERIFY_SYSTEM_PROMPT, type VerifyCandidate } from '../prompts/verify';
-import { adaptiveModelTimeoutMs, clampTimeoutToChainBudget, MODEL_FALLBACK_CHAIN_BUDGET_MS } from '../models/limits';
+import { buildSummaryPrompt, SUMMARY_SYSTEM_PROMPT } from '@server/prompts/summary';
+import { buildVerifyPrompt, VERIFY_RESPONSE_SCHEMA, VERIFY_SYSTEM_PROMPT, type VerifyCandidate } from '@server/prompts/verify';
+import { adaptiveModelTimeoutMs, clampTimeoutToChainBudget, MODEL_FALLBACK_CHAIN_BUDGET_MS } from '../limits';
 import { isCloudflareAllocationError, isTransientModelFailure, RetryableModelError } from './model-support';
-import { logger } from '../core/logger';
-import type { RepoConfig } from '@codra/schema';
-import type { TokenTracker } from '../core/token-tracker';
-import type { ModelInput, ModelResponse } from '../models/types';
-import type { ResolvedModelConfig } from '@codra/db/model-configs';
+import { logger } from '@codra/core/logger';
+import type { RepoConfig, ResolvedModelConfig  } from '@codra/schema';
+import type { TokenTracker } from '@codra/core/token-tracker';
+import type { ModelInput, ModelResponse } from '../types';
 
 // Import from services/model.ts, not here -- four specs vi.mock that specifier.
 
-// Implementation detail, NOT new public API: kept private on ModelService because three specs reach these via `(service as any)`.
+// Implementation detail, NOT new public API: kept private on ModelRunner because three specs reach these via `(service as any)`.
 export type ModelChainContext = {
   selectModel(params: { totalLineCount: number; config: RepoConfig }): { primary: string; fallbacks: string[] };
   resolveModel(model: string): Promise<ResolvedModelConfig>;
diff --git a/src/server/services/model-rate-limits.ts b/packages/models/src/internal/model-rate-limits.ts
similarity index 97%
rename from src/server/services/model-rate-limits.ts
rename to packages/models/src/internal/model-rate-limits.ts
index d7f92e9c..ac1c7735 100644
--- a/src/server/services/model-rate-limits.ts
+++ b/packages/models/src/internal/model-rate-limits.ts
@@ -1,6 +1,6 @@
-import { logger } from '../core/logger';
-import { ModelCallGate } from '../models/limits';
-import type { ResolvedModelConfig } from '@codra/db/model-configs';
+import { logger } from '@codra/core/logger';
+import { ModelCallGate } from '../limits';
+import type { ResolvedModelConfig } from '@codra/schema';
 import { MAX_METERED_QUEUE_DEPTH, PROMPT_FIT_SAFETY_FACTOR, parseRateLimitFromError } from './model-support';
 
 // Narrow port onto whatever survives an invocation (today: the job's chain-progress KV value), so
diff --git a/src/server/services/model-review-batch.ts b/packages/models/src/internal/model-review-batch.ts
similarity index 85%
rename from src/server/services/model-review-batch.ts
rename to packages/models/src/internal/model-review-batch.ts
index f5560dff..eb41cc41 100644
--- a/src/server/services/model-review-batch.ts
+++ b/packages/models/src/internal/model-review-batch.ts
@@ -1,11 +1,10 @@
-import { submitCloudflareBatch, pollCloudflareBatch } from '../models/cloudflare';
-import { buildFileReviewPrompts, buildReviewResponseSchema } from '../prompts/file-review';
-import { parseFileReviewResponse } from '../core/model-output';
-import { truncateFileDiff } from '../core/diff';
-import { logger } from '../core/logger';
-import type { RepoConfig } from '@codra/schema';
-import type { ModelResponse } from '../models/types';
-import type { ResolvedModelConfig } from '@codra/db/model-configs';
+import { submitCloudflareBatch, pollCloudflareBatch } from '../providers/cloudflare';
+import { buildFileReviewPrompts, buildReviewResponseSchema } from '@server/prompts/file-review';
+import { parseFileReviewResponse } from '@server/core/model-output';
+import { truncateFileDiff } from '@server/core/diff';
+import { logger } from '@codra/core/logger';
+import type { RepoConfig, ResolvedModelConfig  } from '@codra/schema';
+import type { ModelResponse } from '../types';
 import { COMPACT_REVIEW_PROMPT_LINE_CAP, type ModelReviewContext } from './model-review-file';
 
 // Import from services/model.ts, not here -- four specs vi.mock that specifier.
@@ -44,10 +43,12 @@ export async function submitReviewBatch(ctx: ModelReviewContext, params: {
     config: params.config.review,
   });
 
+  if (!ctx.aiBinding) return null;
+
   try {
     const requestId = await ctx.rateLimits.runShared(() =>
       submitCloudflareBatch(
-        ctx.env,
+        ctx.aiBinding!,
         resolved.modelName,
         { systemPrompt, userPrompt, responseSchema: buildReviewResponseSchema(params.config.review.max_comments) },
         ctx.tracker,
@@ -77,9 +78,11 @@ export async function pollReviewBatch(ctx: ModelReviewContext, params: { model:
     return { status: 'failed', error };
   }
 
+  if (!ctx.aiBinding) return { status: 'failed', error: new Error('Cloudflare AI binding not provided') };
+
   try {
     const poll = await ctx.rateLimits.runShared(() =>
-      pollCloudflareBatch(ctx.env, resolved.modelName, params.requestId, ctx.tracker, resolved.providerName),
+      pollCloudflareBatch(ctx.aiBinding!, resolved.modelName, params.requestId, ctx.tracker, resolved.providerName),
     );
     if (poll.status === 'pending') return { status: 'pending' };
 
diff --git a/src/server/services/model-review-chain.ts b/packages/models/src/internal/model-review-chain.ts
similarity index 97%
rename from src/server/services/model-review-chain.ts
rename to packages/models/src/internal/model-review-chain.ts
index ca06e605..01733be0 100644
--- a/src/server/services/model-review-chain.ts
+++ b/packages/models/src/internal/model-review-chain.ts
@@ -1,9 +1,9 @@
-import { logger } from '../core/logger';
+import { logger } from '@codra/core/logger';
 import { isSubrequestBudgetMessage, isTimeoutMessage } from '@codra/schema/transient-errors';
-import type { RepoConfig } from '@codra/schema';
-import type { AppBindings } from '../env';
-import type { ModelResponseSchema } from '../models/types';
-import { clampTimeoutToChainBudget, MODEL_FALLBACK_CHAIN_BUDGET_MS, SUBREQUEST_HEADROOM_FOR_MODEL_CALL } from '../models/limits';
+import type { RepoConfig, ResolvedModelConfig  } from '@codra/schema';
+import type { CloudflareAiBinding } from '../providers/cloudflare';
+import type { ModelResponseSchema } from '../types';
+import { clampTimeoutToChainBudget, MODEL_FALLBACK_CHAIN_BUDGET_MS, SUBREQUEST_HEADROOM_FOR_MODEL_CALL } from '../limits';
 import {
   estimatePromptTokens,
   isCloudflareAllocationError,
@@ -11,7 +11,6 @@ import {
   isTransientModelFailure,
   RetryableModelError,
 } from './model-support';
-import type { ResolvedModelConfig } from '@codra/db/model-configs';
 import type { ModelChainContext } from './model-chain-runner';
 import type { ModelRateLimitBook } from './model-rate-limits';
 import type { ModelChainProgressStore } from './model-chain-progress';
@@ -23,7 +22,7 @@ const MAX_QUOTA_FAILURES_PER_FILE = 2;
 
 // Internal per-invocation chain state.
 export type ModelReviewContext = ModelChainContext & {
-  env: AppBindings;
+  aiBinding?: CloudflareAiBinding;
   rateLimits: ModelRateLimitBook;
   // Models lacking async batching; routes subsequent files directly to synchronous.
   asyncUnsupportedModels: Set<string>;
diff --git a/src/server/services/model-review-file.ts b/packages/models/src/internal/model-review-file.ts
similarity index 93%
rename from src/server/services/model-review-file.ts
rename to packages/models/src/internal/model-review-file.ts
index c95bfc75..20632ac2 100644
--- a/src/server/services/model-review-file.ts
+++ b/packages/models/src/internal/model-review-file.ts
@@ -4,17 +4,17 @@ import {
   buildFileReviewPrompts,
   buildReviewResponseSchema,
   type RejectedExemplar,
-} from '../prompts/file-review';
-import { isNonAnswerReview, parseBatchReviewResponse, parseFileReviewResponse, type BatchReviewResult } from '../core/model-output';
-import { UnparseableModelResponseError } from '../models/types';
-import { chunkFileDiff, type FileDiff } from '../core/diff';
-import { adaptiveModelTimeoutMs, reviewOutputBudgetTokens } from '../models/limits';
-import { generatorFindingCap } from '../prompts/file-review';
+} from '@server/prompts/file-review';
+import { isNonAnswerReview, parseBatchReviewResponse, parseFileReviewResponse, type BatchReviewResult } from '@server/core/model-output';
+import { UnparseableModelResponseError } from '../types';
+import { chunkFileDiff, type FileDiff } from '@server/core/diff';
+import { adaptiveModelTimeoutMs, reviewOutputBudgetTokens } from '../limits';
+import { generatorFindingCap } from '@server/prompts/file-review';
 import { mergeCounts } from './model-support';
 import { type ModelReviewContext, runModelChain } from './model-review-chain';
-import { logger } from '../core/logger';
+import { logger } from '@codra/core/logger';
 import type { RepoConfig } from '@codra/schema';
-import type { ModelResponse } from '../models/types';
+import type { ModelResponse } from '../types';
 
 // Import from the services/model barrel, not here (four specs vi.mock it).
 
diff --git a/src/server/services/model-support.ts b/packages/models/src/internal/model-support.ts
similarity index 96%
rename from src/server/services/model-support.ts
rename to packages/models/src/internal/model-support.ts
index a459d9b3..9ab9e7b4 100644
--- a/src/server/services/model-support.ts
+++ b/packages/models/src/internal/model-support.ts
@@ -1,6 +1,6 @@
 import { normalizeModelId } from '@codra/schema';
 import { isTimeoutMessage, matchesAnyTransientSubstring } from '@codra/schema/transient-errors';
-import { UnparseableModelResponseError } from '../models/types';
+import { UnparseableModelResponseError } from '../types';
 
 // Model service pure helpers: aliases, prompt sizes, rate limits, errors.
 
diff --git a/src/server/models/limits.ts b/packages/models/src/limits.ts
similarity index 100%
rename from src/server/models/limits.ts
rename to packages/models/src/limits.ts
diff --git a/src/server/core/llm-crypto.ts b/packages/models/src/llm-crypto.ts
similarity index 65%
rename from src/server/core/llm-crypto.ts
rename to packages/models/src/llm-crypto.ts
index 805980e0..ca01e8ed 100644
--- a/src/server/core/llm-crypto.ts
+++ b/packages/models/src/llm-crypto.ts
@@ -1,4 +1,4 @@
-import type { AppBindings } from '@server/env';
+import type { SecretStore } from '@codra/core/ports';
 
 const KEY_VERSION = 'v1';
 const encoder = new TextEncoder();
@@ -21,9 +21,18 @@ async function importEncryptionKey(secret: string) {
   return crypto.subtle.importKey('raw', digest, 'AES-GCM', false, ['encrypt', 'decrypt']);
 }
 
-export async function encryptLlmApiKey(env: Pick<AppBindings, 'LLM_CONFIG_ENCRYPTION_KEY'>, apiKey: string) {
+async function getEncryptionKey(store: SecretStore): Promise<string> {
+  const secret = await store.getSecret('LLM_CONFIG_ENCRYPTION_KEY');
+  if (!secret) {
+    throw new Error('LLM_CONFIG_ENCRYPTION_KEY is not configured in the secret store.');
+  }
+  return secret;
+}
+
+export async function encryptLlmApiKey(store: SecretStore, apiKey: string) {
   const iv = crypto.getRandomValues(new Uint8Array(12));
-  const key = await importEncryptionKey(env.LLM_CONFIG_ENCRYPTION_KEY);
+  const secret = await getEncryptionKey(store);
+  const key = await importEncryptionKey(secret);
   const ciphertext = await crypto.subtle.encrypt(
     { name: 'AES-GCM', iv },
     key,
@@ -33,13 +42,14 @@ export async function encryptLlmApiKey(env: Pick<AppBindings, 'LLM_CONFIG_ENCRYP
   return `${KEY_VERSION}:${toBase64(iv)}:${toBase64(new Uint8Array(ciphertext))}`;
 }
 
-export async function decryptLlmApiKey(env: Pick<AppBindings, 'LLM_CONFIG_ENCRYPTION_KEY'>, encrypted: string) {
+export async function decryptLlmApiKey(store: SecretStore, encrypted: string) {
   const [version, ivBase64, ciphertextBase64] = encrypted.split(':');
   if (version !== KEY_VERSION || !ivBase64 || !ciphertextBase64) {
     throw new Error('Unsupported encrypted LLM API key format.');
   }
 
-  const key = await importEncryptionKey(env.LLM_CONFIG_ENCRYPTION_KEY);
+  const secret = await getEncryptionKey(store);
+  const key = await importEncryptionKey(secret);
   const plaintext = await crypto.subtle.decrypt(
     { name: 'AES-GCM', iv: fromBase64(ivBase64) },
     key,
diff --git a/src/server/models/anthropic.ts b/packages/models/src/providers/anthropic.ts
similarity index 92%
rename from src/server/models/anthropic.ts
rename to packages/models/src/providers/anthropic.ts
index 6d879397..be8fa79f 100644
--- a/src/server/models/anthropic.ts
+++ b/packages/models/src/providers/anthropic.ts
@@ -1,86 +1,86 @@
-import { logger } from '@server/core/logger';
-import { withTimeout } from '@server/core/timeout';
-import { ProviderRequestError, providerErrorMessage, jsonOnlyPrompts, type ModelResponse } from './types';
-import { assertPublicBaseUrl } from './url-guard';
-import { MODEL_TIMEOUT_MAX_MS, resolveOutputTokenCeiling } from './limits';
-
-// Fallback when the caller supplies no diff-size-aware budget. Shares the review ceiling so an
-// omitting caller can never outlast the chain budget that governs everything else.
-const ANTHROPIC_TIMEOUT_MS = MODEL_TIMEOUT_MAX_MS;
-const ANTHROPIC_DEFAULT_OUTPUT_TOKENS = 4096;
-const ANTHROPIC_MAX_OUTPUT_TOKENS = 16_384;
-const DEFAULT_ANTHROPIC_BASE_URL = 'https://api.anthropic.com/v1';
-
-export interface AnthropicResponse {
-  content?: Array<{ text?: string }>;
-  usage?: {
-    input_tokens?: number;
-    output_tokens?: number;
-  };
-}
-
-export async function reviewWithAnthropic(
-  config: { apiKey: string; baseUrl?: string | null; providerName: string; timeoutMs?: number },
-  model: string,
-  input: { systemPrompt: string; userPrompt: string; outputBudgetTokens?: number },
-  tracker?: { incrementSubrequests(count?: number): void },
-): Promise<ModelResponse> {
-  logger.info(`Calling Anthropic model: ${model}`);
-  assertPublicBaseUrl(config.baseUrl, config.providerName);
-  const prompts = jsonOnlyPrompts(input);
-  const baseUrl = (config.baseUrl || DEFAULT_ANTHROPIC_BASE_URL).replace(/\/+$/, '');
-  const timeoutMs = config.timeoutMs ?? ANTHROPIC_TIMEOUT_MS;
-
-  if (tracker) tracker.incrementSubrequests(1);
-  const response = await withTimeout('Anthropic API', timeoutMs, (signal) =>
-    fetch(`${baseUrl}/messages`, {
-      method: 'POST',
-      signal,
-      headers: {
-        'content-type': 'application/json',
-        'x-api-key': config.apiKey,
-        'anthropic-version': '2023-06-01',
-      },
-      body: JSON.stringify({
-        model,
-        system: prompts.system,
-        messages: [
-          { role: 'user', content: prompts.user },
-          { role: 'assistant', content: '{' }
-        ],
-        max_tokens: resolveOutputTokenCeiling(
-          input.outputBudgetTokens,
-          ANTHROPIC_MAX_OUTPUT_TOKENS,
-          ANTHROPIC_DEFAULT_OUTPUT_TOKENS,
-        ),
-        // 0.6 of a 0-1 scale.
-        temperature: 0.6,
-      }),
-    }),
-  );
-
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new ProviderRequestError(config.providerName, response.status, providerErrorMessage(errorText));
-  }
-
-  const data = (await response.json()) as AnthropicResponse;
-  let rawText = Array.isArray(data.content)
-    ? data.content.map((part) => typeof part?.text === 'string' ? part.text : '').join('').trim()
-    : '';
-
-  if (!rawText && (!data.content || data.content.length === 0)) {
-    throw new Error('Anthropic provider returned an empty response.');
-  }
-
-  // Restore the '{' used to prime JSON output; Anthropic doesn't echo the prefill back.
-  rawText = '{' + rawText;
-
-  return {
-    rawText,
-    inputTokens: data?.usage?.input_tokens ?? 0,
-    outputTokens: data?.usage?.output_tokens ?? 0,
-    modelUsed: model,
-    provider: config.providerName,
-  };
-}
+import { logger } from '@codra/core/logger';
+import { withTimeout } from '@server/core/timeout';
+import { ProviderRequestError, providerErrorMessage, jsonOnlyPrompts, type ModelResponse } from '../types';
+import { assertPublicBaseUrl } from '../url-guard';
+import { MODEL_TIMEOUT_MAX_MS, resolveOutputTokenCeiling } from '../limits';
+
+// Fallback when the caller supplies no diff-size-aware budget. Shares the review ceiling so an
+// omitting caller can never outlast the chain budget that governs everything else.
+const ANTHROPIC_TIMEOUT_MS = MODEL_TIMEOUT_MAX_MS;
+const ANTHROPIC_DEFAULT_OUTPUT_TOKENS = 4096;
+const ANTHROPIC_MAX_OUTPUT_TOKENS = 16_384;
+const DEFAULT_ANTHROPIC_BASE_URL = 'https://api.anthropic.com/v1';
+
+export interface AnthropicResponse {
+  content?: Array<{ text?: string }>;
+  usage?: {
+    input_tokens?: number;
+    output_tokens?: number;
+  };
+}
+
+export async function reviewWithAnthropic(
+  config: { apiKey: string; baseUrl?: string | null; providerName: string; timeoutMs?: number },
+  model: string,
+  input: { systemPrompt: string; userPrompt: string; outputBudgetTokens?: number },
+  tracker?: { incrementSubrequests(count?: number): void },
+): Promise<ModelResponse> {
+  logger.info(`Calling Anthropic model: ${model}`);
+  assertPublicBaseUrl(config.baseUrl, config.providerName);
+  const prompts = jsonOnlyPrompts(input);
+  const baseUrl = (config.baseUrl || DEFAULT_ANTHROPIC_BASE_URL).replace(/\/+$/, '');
+  const timeoutMs = config.timeoutMs ?? ANTHROPIC_TIMEOUT_MS;
+
+  if (tracker) tracker.incrementSubrequests(1);
+  const response = await withTimeout('Anthropic API', timeoutMs, (signal) =>
+    fetch(`${baseUrl}/messages`, {
+      method: 'POST',
+      signal,
+      headers: {
+        'content-type': 'application/json',
+        'x-api-key': config.apiKey,
+        'anthropic-version': '2023-06-01',
+      },
+      body: JSON.stringify({
+        model,
+        system: prompts.system,
+        messages: [
+          { role: 'user', content: prompts.user },
+          { role: 'assistant', content: '{' }
+        ],
+        max_tokens: resolveOutputTokenCeiling(
+          input.outputBudgetTokens,
+          ANTHROPIC_MAX_OUTPUT_TOKENS,
+          ANTHROPIC_DEFAULT_OUTPUT_TOKENS,
+        ),
+        // 0.6 of a 0-1 scale.
+        temperature: 0.6,
+      }),
+    }),
+  );
+
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new ProviderRequestError(config.providerName, response.status, providerErrorMessage(errorText));
+  }
+
+  const data = (await response.json()) as AnthropicResponse;
+  let rawText = Array.isArray(data.content)
+    ? data.content.map((part) => typeof part?.text === 'string' ? part.text : '').join('').trim()
+    : '';
+
+  if (!rawText && (!data.content || data.content.length === 0)) {
+    throw new Error('Anthropic provider returned an empty response.');
+  }
+
+  // Restore the '{' used to prime JSON output; Anthropic doesn't echo the prefill back.
+  rawText = '{' + rawText;
+
+  return {
+    rawText,
+    inputTokens: data?.usage?.input_tokens ?? 0,
+    outputTokens: data?.usage?.output_tokens ?? 0,
+    modelUsed: model,
+    provider: config.providerName,
+  };
+}
diff --git a/src/server/models/cloudflare.ts b/packages/models/src/providers/cloudflare.ts
similarity index 91%
rename from src/server/models/cloudflare.ts
rename to packages/models/src/providers/cloudflare.ts
index e96c4b2e..c8d702f8 100644
--- a/src/server/models/cloudflare.ts
+++ b/packages/models/src/providers/cloudflare.ts
@@ -1,280 +1,284 @@
-import { logger } from '@server/core/logger';
-import type { AppBindings } from '@server/env';
-import { TimeoutError } from '@server/core/timeout';
-import { ProviderRequestError, UnparseableModelResponseError, jsonOnlyPrompts, type ModelInput, type ModelResponse } from './types';
-import { MODEL_TIMEOUT_MAX_MS, OUTPUT_TOKENS_FLOOR, resolveOutputTokenCeiling } from './limits';
-
-// Reasoning models under strict-JSON can burn the token budget thinking and never emit; fail fast and defer.
-const CLOUDFLARE_TIMEOUT_MS = MODEL_TIMEOUT_MAX_MS;
-const CLOUDFLARE_DEFAULT_OUTPUT_TOKENS = OUTPUT_TOKENS_FLOOR;
-// Workers AI context windows vary widely by model, so this stays modest next to Gemini's: an over-large
-// `max_completion_tokens` is refused by the smaller models rather than clamped.
-const CLOUDFLARE_MAX_OUTPUT_TOKENS = 16_384;
-
-type UnknownRecord = Record<string, unknown>;
-
-function isRecord(value: unknown): value is UnknownRecord {
-  return typeof value === 'object' && value !== null;
-}
-
-function isText(value: unknown): value is string {
-  return typeof value === 'string' && value.trim().length > 0;
-}
-
-function getRecord(value: unknown, key: string): UnknownRecord | null {
-  if (!isRecord(value)) return null;
-  const child = value[key];
-  return isRecord(child) ? child : null;
-}
-
-function getNumber(value: unknown, key: string) {
-  if (!isRecord(value)) return null;
-  const child = value[key];
-  return typeof child === 'number' ? child : null;
-}
-
-function isLocalWorkersAiBindingError(error: unknown) {
-  const message = error instanceof Error ? error.message : String(error);
-  const normalized = message.toLowerCase();
-  return normalized.includes('binding ai') && normalized.includes('run remotely');
-}
-
-function failUnparseable(model: string, reason: string): never {
-  logger.warn(`Cloudflare model ${model} returned no parseable review content; failing the file review`, { reason });
-  throw new UnparseableModelResponseError(model, reason);
-}
-
-function extractMessageContent(content: unknown): string | null {
-  if (isText(content)) return content.trim();
-
-  if (Array.isArray(content)) {
-    const text = content
-      .map((part) => {
-        if (isText(part)) return part;
-        if (isRecord(part) && isText(part.text)) return part.text;
-        return '';
-      })
-      .join('')
-      .trim();
-    return text || null;
-  }
-
-  return null;
-}
-
-// `response` is a string on most models, a parsed object/array on structured-output ones; accept both or a good review is discarded as empty.
-function extractResponseField(container: unknown): string | null {
-  if (!isRecord(container)) return null;
-  const value = container.response;
-  if (isText(value)) return value.trim();
-  if (value && typeof value === 'object') {
-    try {
-      return JSON.stringify(value);
-    } catch {
-      return null;
-    }
-  }
-  return null;
-}
-
-function extractCloudflareText(result: unknown, model: string): string {
-  if (isText(result)) return result.trim();
-  const response = extractResponseField(result);
-  if (response) return response;
-
-  const nestedResult = getRecord(result, 'result');
-  const nestedResponse = extractResponseField(nestedResult);
-  if (nestedResponse) return nestedResponse;
-
-  const choices = isRecord(result) && Array.isArray(result.choices) ? result.choices : null;
-  const choice = choices?.[0];
-  const message = getRecord(choice, 'message');
-  const content = extractMessageContent(message?.content);
-  if (content) return content;
-
-  const finishReason = isRecord(choice) ? choice.finish_reason ?? choice.stop_reason : null;
-  const reasoning = isText(message?.reasoning) ? message.reasoning : isText(message?.reasoning_content) ? message.reasoning_content : null;
-  if (reasoning) {
-    return failUnparseable(model, `reasoning-only response${finishReason ? `, finish_reason=${String(finishReason)}` : ''}`);
-  }
-
-  if (finishReason) {
-    return failUnparseable(model, `finish_reason=${String(finishReason)}`);
-  }
-
-  return failUnparseable(model, 'empty response');
-}
-
-function extractCloudflareUsage(result: unknown) {
-  const usage = getRecord(result, 'usage') ?? getRecord(getRecord(result, 'result'), 'usage');
-  return {
-    inputTokens: getNumber(usage, 'prompt_tokens') ?? 0,
-    outputTokens: getNumber(usage, 'completion_tokens') ?? 0,
-  };
-}
-
-// Grammar comes from the CALLER: hardcoding the file-review schema here once forced the verifier to emit a file-review object, silently defaulting `results` to `[]`.
-function buildCloudflareInferenceRequest(input: ModelInput) {
-  const prompts = jsonOnlyPrompts(input);
-  return {
-    messages: [
-      { role: 'system', content: prompts.system },
-      { role: 'user', content: prompts.user },
-    ],
-    max_completion_tokens: resolveOutputTokenCeiling(
-      input.outputBudgetTokens,
-      CLOUDFLARE_MAX_OUTPUT_TOKENS,
-      CLOUDFLARE_DEFAULT_OUTPUT_TOKENS,
-    ),
-    ...(input.responseSchema
-      ? {
-          response_format: {
-            type: 'json_schema',
-            json_schema: {
-              name: input.responseSchema.name,
-              strict: true,
-              schema: input.responseSchema.schema,
-            },
-          },
-        }
-      : {}),
-    // 0.6 on Workers AI's 0-5 scale; top_p moves with it, else pinning it low would cancel the raise.
-    temperature: 0.6,
-    top_p: 0.9,
-  };
-}
-
-// `pending` covers both queued and running.
-export type CloudflareBatchPollResult =
-  | { status: 'pending' }
-  | { status: 'done'; response: ModelResponse };
-
-function extractBatchStatus(result: unknown): string | null {
-  if (!isRecord(result)) return null;
-  const status = result.status ?? getRecord(result, 'result')?.status;
-  return typeof status === 'string' ? status.toLowerCase() : null;
-}
-
-// Workers AI has returned several shapes here (`responses`, `result.responses`, or a bare result); probe defensively and fall back to the whole payload.
-function extractBatchInnerResult(result: unknown): unknown {
-  const containers = [result, isRecord(result) ? result.result : undefined];
-  for (const container of containers) {
-    if (!isRecord(container)) continue;
-    const responses = container.responses ?? container.results;
-    if (Array.isArray(responses) && responses.length > 0) {
-      const first = responses[0];
-      // Entries may wrap output under `result`/`response`, or be it directly.
-      if (isRecord(first)) return first.result ?? first;
-      return first;
-    }
-  }
-  return result;
-}
-
-// Throws if unsupported; the caller falls back to the synchronous path.
-export async function submitCloudflareBatch(
-  env: Pick<AppBindings, 'AI'>,
-  model: string,
-  input: ModelInput,
-  tracker?: { incrementSubrequests(count?: number): void },
-): Promise<string> {
-  if (tracker) tracker.incrementSubrequests(1);
-  logger.info(`Submitting async batch request to Cloudflare model: ${model}`);
-  const result = await env.AI.run(
-    model as any,
-    { requests: [buildCloudflareInferenceRequest(input)] } as any,
-    { queueRequest: true } as any,
-  );
-
-  const requestId = isRecord(result)
-    ? (result.request_id ?? getRecord(result, 'result')?.request_id)
-    : undefined;
-  if (typeof requestId !== 'string' || !requestId) {
-    throw new Error(`Cloudflare model ${model} did not return an async batch request_id (async queueing unsupported).`);
-  }
-  return requestId;
-}
-
-export async function pollCloudflareBatch(
-  env: Pick<AppBindings, 'AI'>,
-  model: string,
-  requestId: string,
-  tracker?: { incrementSubrequests(count?: number): void },
-  providerName = 'Cloudflare',
-): Promise<CloudflareBatchPollResult> {
-  if (tracker) tracker.incrementSubrequests(1);
-  const result = await env.AI.run(model as any, { request_id: requestId } as any);
-
-  const status = extractBatchStatus(result);
-  if (status === 'queued' || status === 'running') {
-    return { status: 'pending' };
-  }
-
-  const inner = extractBatchInnerResult(result);
-  const rawText = extractCloudflareText(inner, model);
-  const usage = extractCloudflareUsage(inner);
-  return {
-    status: 'done',
-    response: {
-      rawText,
-      inputTokens: usage.inputTokens,
-      outputTokens: usage.outputTokens,
-      modelUsed: model,
-      provider: providerName,
-    },
-  };
-}
-
-export async function reviewWithCloudflare(
-  env: Pick<AppBindings, 'AI'>,
-  model: string,
-  input: ModelInput,
-  tracker?: { incrementSubrequests(count?: number): void },
-  providerName = 'Cloudflare',
-  options?: { timeoutMs?: number },
-): Promise<ModelResponse> {
-  // Single attempt: a retry would spend another subrequest on a model that just failed, when the fallback chain is about to try another.
-  const timeoutMs = options?.timeoutMs ?? CLOUDFLARE_TIMEOUT_MS;
-  let timer: ReturnType<typeof setTimeout> | undefined;
-
-  // Promise.race only stops us awaiting; the binding's abort signal is what actually cancels the still-running subrequest.
-  const controller = new AbortController();
-  const timeoutPromise = new Promise<never>((_, reject) => {
-    timer = setTimeout(() => {
-      controller.abort();
-      reject(new TimeoutError(`Cloudflare (${model})`, timeoutMs));
-    }, timeoutMs);
-  });
-
-  try {
-    if (tracker) tracker.incrementSubrequests(1);
-
-    logger.info(`Calling Cloudflare model: ${model}`);
-    const startTime = Date.now();
-    const runPromise = env.AI.run(model as any, buildCloudflareInferenceRequest(input), { signal: controller.signal });
-    // The aborted run still settles as a rejection; a no-op handler stops it surfacing as unhandled.
-    runPromise.catch(() => {});
-    const result = await Promise.race([runPromise, timeoutPromise]);
-    logger.info(`AI model ${model} responded in ${Date.now() - startTime}ms`);
-
-    const usage = extractCloudflareUsage(result);
-    return {
-      rawText: extractCloudflareText(result, model),
-      inputTokens: usage.inputTokens,
-      outputTokens: usage.outputTokens,
-      modelUsed: model,
-      provider: providerName,
-    };
-  } catch (error) {
-    if (isLocalWorkersAiBindingError(error)) {
-      const message = 'Cloudflare Workers AI is not available in local Wrangler. Run with remote bindings or deploy the Worker to test Cloudflare models.';
-      logger.warn(message, { model });
-      throw new ProviderRequestError(providerName, 400, message);
-    }
-
-    logger.error('Cloudflare request failed', { model, error: error instanceof Error ? error.message : String(error) });
-    throw error;
-  } finally {
-    clearTimeout(timer);
-  }
-}
+import { logger } from '@codra/core/logger';
+
+import { TimeoutError } from '@server/core/timeout';
+import { ProviderRequestError, UnparseableModelResponseError, jsonOnlyPrompts, type ModelInput, type ModelResponse } from '../types';
+import { MODEL_TIMEOUT_MAX_MS, OUTPUT_TOKENS_FLOOR, resolveOutputTokenCeiling } from '../limits';
+
+export interface CloudflareAiBinding {
+  run(model: string, args: unknown, options?: unknown): Promise<unknown>;
+}
+
+// Reasoning models under strict-JSON can burn the token budget thinking and never emit; fail fast and defer.
+const CLOUDFLARE_TIMEOUT_MS = MODEL_TIMEOUT_MAX_MS;
+const CLOUDFLARE_DEFAULT_OUTPUT_TOKENS = OUTPUT_TOKENS_FLOOR;
+// Workers AI context windows vary widely by model, so this stays modest next to Gemini's: an over-large
+// `max_completion_tokens` is refused by the smaller models rather than clamped.
+const CLOUDFLARE_MAX_OUTPUT_TOKENS = 16_384;
+
+type UnknownRecord = Record<string, unknown>;
+
+function isRecord(value: unknown): value is UnknownRecord {
+  return typeof value === 'object' && value !== null;
+}
+
+function isText(value: unknown): value is string {
+  return typeof value === 'string' && value.trim().length > 0;
+}
+
+function getRecord(value: unknown, key: string): UnknownRecord | null {
+  if (!isRecord(value)) return null;
+  const child = value[key];
+  return isRecord(child) ? child : null;
+}
+
+function getNumber(value: unknown, key: string) {
+  if (!isRecord(value)) return null;
+  const child = value[key];
+  return typeof child === 'number' ? child : null;
+}
+
+function isLocalWorkersAiBindingError(error: unknown) {
+  const message = error instanceof Error ? error.message : String(error);
+  const normalized = message.toLowerCase();
+  return normalized.includes('binding ai') && normalized.includes('run remotely');
+}
+
+function failUnparseable(model: string, reason: string): never {
+  logger.warn(`Cloudflare model ${model} returned no parseable review content; failing the file review`, { reason });
+  throw new UnparseableModelResponseError(model, reason);
+}
+
+function extractMessageContent(content: unknown): string | null {
+  if (isText(content)) return content.trim();
+
+  if (Array.isArray(content)) {
+    const text = content
+      .map((part) => {
+        if (isText(part)) return part;
+        if (isRecord(part) && isText(part.text)) return part.text;
+        return '';
+      })
+      .join('')
+      .trim();
+    return text || null;
+  }
+
+  return null;
+}
+
+// `response` is a string on most models, a parsed object/array on structured-output ones; accept both or a good review is discarded as empty.
+function extractResponseField(container: unknown): string | null {
+  if (!isRecord(container)) return null;
+  const value = container.response;
+  if (isText(value)) return value.trim();
+  if (value && typeof value === 'object') {
+    try {
+      return JSON.stringify(value);
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
+function extractCloudflareText(result: unknown, model: string): string {
+  if (isText(result)) return result.trim();
+  const response = extractResponseField(result);
+  if (response) return response;
+
+  const nestedResult = getRecord(result, 'result');
+  const nestedResponse = extractResponseField(nestedResult);
+  if (nestedResponse) return nestedResponse;
+
+  const choices = isRecord(result) && Array.isArray(result.choices) ? result.choices : null;
+  const choice = choices?.[0];
+  const message = getRecord(choice, 'message');
+  const content = extractMessageContent(message?.content);
+  if (content) return content;
+
+  const finishReason = isRecord(choice) ? choice.finish_reason ?? choice.stop_reason : null;
+  const reasoning = isText(message?.reasoning) ? message.reasoning : isText(message?.reasoning_content) ? message.reasoning_content : null;
+  if (reasoning) {
+    return failUnparseable(model, `reasoning-only response${finishReason ? `, finish_reason=${String(finishReason)}` : ''}`);
+  }
+
+  if (finishReason) {
+    return failUnparseable(model, `finish_reason=${String(finishReason)}`);
+  }
+
+  return failUnparseable(model, 'empty response');
+}
+
+function extractCloudflareUsage(result: unknown) {
+  const usage = getRecord(result, 'usage') ?? getRecord(getRecord(result, 'result'), 'usage');
+  return {
+    inputTokens: getNumber(usage, 'prompt_tokens') ?? 0,
+    outputTokens: getNumber(usage, 'completion_tokens') ?? 0,
+  };
+}
+
+// Grammar comes from the CALLER: hardcoding the file-review schema here once forced the verifier to emit a file-review object, silently defaulting `results` to `[]`.
+function buildCloudflareInferenceRequest(input: ModelInput) {
+  const prompts = jsonOnlyPrompts(input);
+  return {
+    messages: [
+      { role: 'system', content: prompts.system },
+      { role: 'user', content: prompts.user },
+    ],
+    max_completion_tokens: resolveOutputTokenCeiling(
+      input.outputBudgetTokens,
+      CLOUDFLARE_MAX_OUTPUT_TOKENS,
+      CLOUDFLARE_DEFAULT_OUTPUT_TOKENS,
+    ),
+    ...(input.responseSchema
+      ? {
+          response_format: {
+            type: 'json_schema',
+            json_schema: {
+              name: input.responseSchema.name,
+              strict: true,
+              schema: input.responseSchema.schema,
+            },
+          },
+        }
+      : {}),
+    // 0.6 on Workers AI's 0-5 scale; top_p moves with it, else pinning it low would cancel the raise.
+    temperature: 0.6,
+    top_p: 0.9,
+  };
+}
+
+// `pending` covers both queued and running.
+export type CloudflareBatchPollResult =
+  | { status: 'pending' }
+  | { status: 'done'; response: ModelResponse };
+
+function extractBatchStatus(result: unknown): string | null {
+  if (!isRecord(result)) return null;
+  const status = result.status ?? getRecord(result, 'result')?.status;
+  return typeof status === 'string' ? status.toLowerCase() : null;
+}
+
+// Workers AI has returned several shapes here (`responses`, `result.responses`, or a bare result); probe defensively and fall back to the whole payload.
+function extractBatchInnerResult(result: unknown): unknown {
+  const containers = [result, isRecord(result) ? result.result : undefined];
+  for (const container of containers) {
+    if (!isRecord(container)) continue;
+    const responses = container.responses ?? container.results;
+    if (Array.isArray(responses) && responses.length > 0) {
+      const first = responses[0];
+      // Entries may wrap output under `result`/`response`, or be it directly.
+      if (isRecord(first)) return first.result ?? first;
+      return first;
+    }
+  }
+  return result;
+}
+
+// Throws if unsupported; the caller falls back to the synchronous path.
+export async function submitCloudflareBatch(
+  aiBinding: CloudflareAiBinding,
+  model: string,
+  input: ModelInput,
+  tracker?: { incrementSubrequests(count?: number): void },
+): Promise<string> {
+  if (tracker) tracker.incrementSubrequests(1);
+  logger.info(`Submitting async batch request to Cloudflare model: ${model}`);
+  const result = await aiBinding.run(
+    model as any,
+    { requests: [buildCloudflareInferenceRequest(input)] } as any,
+    { queueRequest: true } as any,
+  );
+
+  const requestId = isRecord(result)
+    ? (result.request_id ?? getRecord(result, 'result')?.request_id)
+    : undefined;
+  if (typeof requestId !== 'string' || !requestId) {
+    throw new Error(`Cloudflare model ${model} did not return an async batch request_id (async queueing unsupported).`);
+  }
+  return requestId;
+}
+
+export async function pollCloudflareBatch(
+  aiBinding: CloudflareAiBinding,
+  model: string,
+  requestId: string,
+  tracker?: { incrementSubrequests(count?: number): void },
+  providerName = 'Cloudflare',
+): Promise<CloudflareBatchPollResult> {
+  if (tracker) tracker.incrementSubrequests(1);
+  const result = await aiBinding.run(model, { request_id: requestId });
+
+  const status = extractBatchStatus(result);
+  if (status === 'queued' || status === 'running') {
+    return { status: 'pending' };
+  }
+
+  const inner = extractBatchInnerResult(result);
+  const rawText = extractCloudflareText(inner, model);
+  const usage = extractCloudflareUsage(inner);
+  return {
+    status: 'done',
+    response: {
+      rawText,
+      inputTokens: usage.inputTokens,
+      outputTokens: usage.outputTokens,
+      modelUsed: model,
+      provider: providerName,
+    },
+  };
+}
+
+export async function reviewWithCloudflare(
+  aiBinding: CloudflareAiBinding,
+  model: string,
+  input: ModelInput,
+  tracker?: { incrementSubrequests(count?: number): void },
+  providerName = 'Cloudflare',
+  options?: { timeoutMs?: number },
+): Promise<ModelResponse> {
+  // Single attempt: a retry would spend another subrequest on a model that just failed, when the fallback chain is about to try another.
+  const timeoutMs = options?.timeoutMs ?? CLOUDFLARE_TIMEOUT_MS;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+
+  // Promise.race only stops us awaiting; the binding's abort signal is what actually cancels the still-running subrequest.
+  const controller = new AbortController();
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      reject(new TimeoutError(`Cloudflare (${model})`, timeoutMs));
+    }, timeoutMs);
+  });
+
+  try {
+    if (tracker) tracker.incrementSubrequests(1);
+
+    logger.info(`Calling Cloudflare model: ${model}`);
+    const startTime = Date.now();
+    const runPromise = aiBinding.run(model, buildCloudflareInferenceRequest(input), { signal: controller.signal });
+    // The aborted run still settles as a rejection; a no-op handler stops it surfacing as unhandled.
+    runPromise.catch(() => {});
+    const result = await Promise.race([runPromise, timeoutPromise]);
+    logger.info(`AI model ${model} responded in ${Date.now() - startTime}ms`);
+
+    const usage = extractCloudflareUsage(result);
+    return {
+      rawText: extractCloudflareText(result, model),
+      inputTokens: usage.inputTokens,
+      outputTokens: usage.outputTokens,
+      modelUsed: model,
+      provider: providerName,
+    };
+  } catch (error) {
+    if (isLocalWorkersAiBindingError(error)) {
+      const message = 'Cloudflare Workers AI is not available in local Wrangler. Run with remote bindings or deploy the Worker to test Cloudflare models.';
+      logger.warn(message, { model });
+      throw new ProviderRequestError(providerName, 400, message);
+    }
+
+    logger.error('Cloudflare request failed', { model, error: error instanceof Error ? error.message : String(error) });
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
+}
diff --git a/src/server/models/google.ts b/packages/models/src/providers/google.ts
similarity index 95%
rename from src/server/models/google.ts
rename to packages/models/src/providers/google.ts
index c821fbe0..2151725d 100644
--- a/src/server/models/google.ts
+++ b/packages/models/src/providers/google.ts
@@ -1,289 +1,289 @@
-import { logger } from '@server/core/logger';
-import { withTimeout } from '@server/core/timeout';
-import { ProviderRequestError, UnparseableModelResponseError, providerErrorMessage, jsonOnlyPrompts, type ModelInput, type ModelResponse } from './types';
-import { toGeminiResponseJsonSchema } from './gemini-schema';
-import { assertPublicBaseUrl } from './url-guard';
-import {
-  MODEL_TIMEOUT_MAX_MS,
-  OUTPUT_TOKENS_FLOOR,
-  geminiThinkingBudgetTokens,
-  resolveOutputTokenCeiling,
-} from './limits';
-
-/** Fallback timeout if caller omits budget. */
-const GEMINI_TIMEOUT_MS = MODEL_TIMEOUT_MAX_MS;
-const GEMINI_MAX_RETRIES = 2;
-// Output floor for low-budget tasks (verify, summary).
-const GEMINI_DEFAULT_OUTPUT_TOKENS = OUTPUT_TOKENS_FLOOR;
-// Max output claims. 65k allows room for thinking tokens and dense multi-file bins.
-const GEMINI_MAX_OUTPUT_TOKENS = 65_536;
-// Cap on retry sleeps; longer cool-offs defer files to free up gates.
-const GEMINI_MAX_RETRY_DELAY_MS = 5_000;
-const DEFAULT_GEMINI_BASE_URL = 'https://generativelanguage.googleapis.com/v1beta';
-
-// 429 handled separately (only retryable if cool-off is stated).
-function isRetryableGeminiStatus(status: number) {
-  return status === 408 || status === 500 || status === 502 || status === 503 || status === 504 || status === 524;
-}
-
-function defaultRetryDelayMs(attempt: number) {
-  // Exponential backoff for transient 5xx errors (clears quickly).
-  return Math.pow(2, attempt) * 800 + Math.random() * 400;
-}
-
-function retryAfterDelayMs(value: string | null) {
-  if (!value) return null;
-  const seconds = Number(value);
-  if (Number.isFinite(seconds) && seconds >= 0) {
-    return seconds * 1000;
-  }
-
-  const dateMs = Date.parse(value);
-  if (Number.isFinite(dateMs)) {
-    return Math.max(0, dateMs - Date.now());
-  }
-
-  return null;
-}
-
-// Extract body cool-off ("Please retry in Xs.") to avoid indefinite 429 retries.
-function requestedRetryDelayFromBody(message: string): number | null {
-  const match = /retry in ([\d.]+)s/i.exec(message);
-  if (!match) return null;
-  const seconds = Number(match[1]);
-  return Number.isFinite(seconds) ? seconds * 1000 : null;
-}
-
-// Broad matcher (false positives cost 1 subrequest; false negatives break chains).
-function isSchemaRejection(status: number, message: string) {
-  if (status !== 400) return false;
-  const lower = message.toLowerCase();
-  return (
-    lower.includes('responsejsonschema') ||
-    lower.includes('response_json_schema') ||
-    lower.includes('responseschema') ||
-    lower.includes('response_schema') ||
-    lower.includes('invalid json payload') ||
-    lower.includes('unknown name') ||
-    lower.includes('schema') ||
-    // Bare 400 catch-all to prevent permanent schema failures. Worst case: one extra failed schema-less attempt.
-    lower.includes('invalid argument')
-  );
-}
-
-// Narrow matcher probed BEFORE isSchemaRejection to prevent misidentifying thinking-config refusals as schema drops.
-function isThinkingRejection(status: number, message: string) {
-  if (status !== 400) return false;
-  const lower = message.toLowerCase();
-  return lower.includes('thinking') || lower.includes('thought');
-}
-
-function isRetryableTransportError(error: unknown) {
-  if (!(error instanceof Error)) return false;
-  // Don't retry timeouts (caller grants up to 2m); defer to fallback chains.
-  if (error.name === 'TimeoutError' || error.message.toLowerCase().includes('timed out')) return false;
-  if (error.message.includes('fetch failed')) return true;
-  return error instanceof TypeError;
-}
-
-export async function reviewWithGoogle(
-  config: { apiKey: string; baseUrl?: string | null; providerName?: string; timeoutMs?: number },
-  model: string,
-  input: ModelInput,
-  tracker?: { incrementSubrequests(count?: number): void },
-): Promise<ModelResponse> {
-  const timeoutMs = config.timeoutMs ?? GEMINI_TIMEOUT_MS;
-  logger.info(`Calling Google model: ${model}`);
-
-  assertPublicBaseUrl(config.baseUrl, config.providerName ?? 'Google');
-  const prompts = jsonOnlyPrompts(input);
-  const responseJsonSchema = input.responseSchema
-    ? toGeminiResponseJsonSchema(input.responseSchema.schema)
-    : null;
-  // Latches to disable features on subsequent attempts if rejected.
-  let schemaRejected = false;
-  let thinkingRejected = false;
-
-  // Summing JSON and thinking token budgets prevents truncated prefixes.
-  const answerBudget = resolveOutputTokenCeiling(
-    input.outputBudgetTokens,
-    GEMINI_MAX_OUTPUT_TOKENS,
-    GEMINI_DEFAULT_OUTPUT_TOKENS,
-  );
-  const thinkingBudget = geminiThinkingBudgetTokens(answerBudget);
-  const outputCeiling = Math.min(GEMINI_MAX_OUTPUT_TOKENS, answerBudget + thinkingBudget);
-  // Mark error so caller latches schema-dropped state even on subsequent failure.
-  const fail = (error: unknown): never => {
-    if (schemaRejected && typeof error === 'object' && error !== null) {
-      Object.defineProperty(error, 'schemaDropped', { value: true, configurable: true });
-    }
-    throw error;
-  };
-
-  const startTime = Date.now();
-  const baseUrl = (config.baseUrl || DEFAULT_GEMINI_BASE_URL).replace(/\/+$/, '');
-  const url = `${baseUrl}/models/${encodeURIComponent(model)}:generateContent?key=${encodeURIComponent(config.apiKey)}`;
-  const maxRetries = GEMINI_MAX_RETRIES;
-  let lastError: unknown;
-  let delayBeforeAttemptMs = 0;
-
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    if (delayBeforeAttemptMs > 0) {
-      logger.info(`Retrying Gemini request (attempt ${attempt}/${maxRetries}) in ${Math.round(delayBeforeAttemptMs)}ms`);
-      await new Promise(resolve => setTimeout(resolve, delayBeforeAttemptMs));
-      delayBeforeAttemptMs = 0;
-    }
-
-    let response: Response;
-    try {
-      if (tracker) tracker.incrementSubrequests(1);
-      response = await withTimeout('Gemini API', timeoutMs, (signal) =>
-        fetch(url, {
-          method: 'POST',
-          signal,
-          headers: {
-            'content-type': 'application/json',
-          },
-          body: JSON.stringify({
-            systemInstruction: {
-              role: 'system',
-              parts: [{ text: prompts.system }],
-            },
-            contents: [
-              { role: 'user', parts: [{ text: prompts.user }] },
-            ],
-            generationConfig: {
-              // Required for schemas and summary path.
-              responseMimeType: 'application/json',
-              // See gemini-schema.ts.
-              ...(responseJsonSchema && !schemaRejected ? { responseJsonSchema } : {}),
-              maxOutputTokens: outputCeiling,
-              // Bounded thinking budget so it doesn't consume the output ceiling.
-              ...(thinkingRejected ? {} : { thinkingConfig: { thinkingBudget } }),
-              // 0.9 on Gemini's 0-2 scale.
-              temperature: 0.9,
-            },
-          }),
-        }),
-      );
-    } catch (error) {
-      lastError = error;
-      if (isRetryableTransportError(error) && attempt < maxRetries) {
-        delayBeforeAttemptMs = defaultRetryDelayMs(attempt);
-        continue;
-      }
-      return fail(error);
-    }
-
-    if (!response.ok) {
-      const errorText = await response.text();
-      const message = providerErrorMessage(errorText);
-
-      // Check thinking first; isSchemaRejection is broad.
-      if (!thinkingRejected && isThinkingRejection(response.status, message)) {
-        thinkingRejected = true;
-        logger.warn('Gemini rejected thinkingConfig; retrying without an explicit thinking budget', {
-          model,
-          error: message,
-        });
-        lastError = new ProviderRequestError(config.providerName ?? 'Google', response.status, message);
-        // Refund attempt (no sleep); latched.
-        attempt--;
-        continue;
-      }
-
-      if (responseJsonSchema && !schemaRejected && isSchemaRejection(response.status, message)) {
-        schemaRejected = true;
-        // Inferred schema rejection; real cause thrown below if 400 recurs.
-        logger.warn('Gemini returned a 400 that looks like a response-grammar rejection; retrying without constrained decoding', {
-          model,
-          error: message,
-        });
-        lastError = new ProviderRequestError(config.providerName ?? 'Google', response.status, message);
-        // Refund attempt (no sleep); latched.
-        attempt--;
-        continue;
-      }
-
-      const requestedDelayMs = response.status === 429
-        ? retryAfterDelayMs(response.headers.get('retry-after')) ?? requestedRetryDelayFromBody(message)
-        : null;
-      // Unstated 429s back-off for ~60s, making them unretryable here. Retry only on short, stated cool-offs.
-      const isRetryable = response.status === 429
-        ? requestedDelayMs !== null && requestedDelayMs <= GEMINI_MAX_RETRY_DELAY_MS
-        : isRetryableGeminiStatus(response.status);
-      const retryDelayMs = Math.min(
-        GEMINI_MAX_RETRY_DELAY_MS,
-        requestedDelayMs ?? defaultRetryDelayMs(attempt),
-      );
-
-      const logData = {
-        error: message,
-        attempt,
-        willRetry: isRetryable && attempt < maxRetries,
-        requestedDelayMs: requestedDelayMs ?? undefined,
-        retryDelayMs: isRetryable && attempt < maxRetries ? retryDelayMs : undefined,
-        // Log bounded raw body for terminal 4xx to debug unactionable "invalid argument" errors.
-        rawBody: response.status >= 400 && response.status < 500 && !(isRetryable && attempt < maxRetries)
-          ? errorText.slice(0, 2_000)
-          : undefined,
-      };
-      if (isRetryable && attempt < maxRetries) {
-        logger.warn(`Gemini request failed with ${response.status}; retrying`, logData);
-        lastError = new ProviderRequestError(config.providerName ?? 'Google', response.status, message);
-        delayBeforeAttemptMs = retryDelayMs;
-        continue;
-      }
-
-      logger.error(`Gemini request failed with ${response.status}`, logData);
-      return fail(new ProviderRequestError(config.providerName ?? 'Google', response.status, message));
-    }
-
-    const durationMs = Date.now() - startTime;
-    logger.info(`AI model ${model} responded in ${durationMs}ms`);
-
-    const data = (await response.json()) as {
-      candidates?: Array<{ content?: { parts?: Array<{ text?: string }> }; finishReason?: string }>;
-      usageMetadata?: {
-        promptTokenCount?: number;
-        candidatesTokenCount?: number;
-        // Billed against `maxOutputTokens`.
-        thoughtsTokenCount?: number;
-      };
-    };
-
-    const candidate = data.candidates?.[0];
-    const rawText = candidate?.content?.parts?.map((part) => part.text ?? '').join('')?.trim();
-    if (!rawText) {
-      const finishReason = candidate?.finishReason;
-      // Deterministic non-STOP (budget burn, safety) fails permanently; empty STOP is transient.
-      if (finishReason && finishReason !== 'STOP') {
-        return fail(new UnparseableModelResponseError(model, `finishReason=${finishReason}`));
-      }
-      return fail(new Error('Gemini returned an empty response.'));
-    }
-
-    // Log non-STOP prefix truncations.
-    if (candidate?.finishReason && candidate.finishReason !== 'STOP') {
-      logger.warn(`Gemini response for ${model} ended with finishReason=${candidate.finishReason}; output is likely incomplete`, {
-        // Avoid `Tokens` key name to bypass logger redaction. Sum thinking + output spend.
-        outputSpend: (data.usageMetadata?.candidatesTokenCount ?? 0) + (data.usageMetadata?.thoughtsTokenCount ?? 0),
-        thoughtSpend: data.usageMetadata?.thoughtsTokenCount ?? 0,
-        outputCeiling,
-        thinkingBudget: thinkingRejected ? undefined : thinkingBudget,
-        schemaDropped: schemaRejected,
-      });
-    }
-
-    return {
-      rawText,
-      inputTokens: data.usageMetadata?.promptTokenCount ?? 0,
-      outputTokens: data.usageMetadata?.candidatesTokenCount ?? 0,
-      modelUsed: model,
-      provider: config.providerName ?? 'Google',
-      ...(schemaRejected ? { degraded: 'schema-dropped' as const } : {}),
-    };
-  }
-
-  return fail(lastError);
-}
+import { logger } from '@codra/core/logger';
+import { withTimeout } from '@server/core/timeout';
+import { ProviderRequestError, UnparseableModelResponseError, providerErrorMessage, jsonOnlyPrompts, type ModelInput, type ModelResponse } from '../types';
+import { toGeminiResponseJsonSchema } from '../gemini-schema';
+import { assertPublicBaseUrl } from '../url-guard';
+import {
+  MODEL_TIMEOUT_MAX_MS,
+  OUTPUT_TOKENS_FLOOR,
+  geminiThinkingBudgetTokens,
+  resolveOutputTokenCeiling,
+} from '../limits';
+
+/** Fallback timeout if caller omits budget. */
+const GEMINI_TIMEOUT_MS = MODEL_TIMEOUT_MAX_MS;
+const GEMINI_MAX_RETRIES = 2;
+// Output floor for low-budget tasks (verify, summary).
+const GEMINI_DEFAULT_OUTPUT_TOKENS = OUTPUT_TOKENS_FLOOR;
+// Max output claims. 65k allows room for thinking tokens and dense multi-file bins.
+const GEMINI_MAX_OUTPUT_TOKENS = 65_536;
+// Cap on retry sleeps; longer cool-offs defer files to free up gates.
+const GEMINI_MAX_RETRY_DELAY_MS = 5_000;
+const DEFAULT_GEMINI_BASE_URL = 'https://generativelanguage.googleapis.com/v1beta';
+
+// 429 handled separately (only retryable if cool-off is stated).
+function isRetryableGeminiStatus(status: number) {
+  return status === 408 || status === 500 || status === 502 || status === 503 || status === 504 || status === 524;
+}
+
+function defaultRetryDelayMs(attempt: number) {
+  // Exponential backoff for transient 5xx errors (clears quickly).
+  return Math.pow(2, attempt) * 800 + Math.random() * 400;
+}
+
+function retryAfterDelayMs(value: string | null) {
+  if (!value) return null;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds) && seconds >= 0) {
+    return seconds * 1000;
+  }
+
+  const dateMs = Date.parse(value);
+  if (Number.isFinite(dateMs)) {
+    return Math.max(0, dateMs - Date.now());
+  }
+
+  return null;
+}
+
+// Extract body cool-off ("Please retry in Xs.") to avoid indefinite 429 retries.
+function requestedRetryDelayFromBody(message: string): number | null {
+  const match = /retry in ([\d.]+)s/i.exec(message);
+  if (!match) return null;
+  const seconds = Number(match[1]);
+  return Number.isFinite(seconds) ? seconds * 1000 : null;
+}
+
+// Broad matcher (false positives cost 1 subrequest; false negatives break chains).
+function isSchemaRejection(status: number, message: string) {
+  if (status !== 400) return false;
+  const lower = message.toLowerCase();
+  return (
+    lower.includes('responsejsonschema') ||
+    lower.includes('response_json_schema') ||
+    lower.includes('responseschema') ||
+    lower.includes('response_schema') ||
+    lower.includes('invalid json payload') ||
+    lower.includes('unknown name') ||
+    lower.includes('schema') ||
+    // Bare 400 catch-all to prevent permanent schema failures. Worst case: one extra failed schema-less attempt.
+    lower.includes('invalid argument')
+  );
+}
+
+// Narrow matcher probed BEFORE isSchemaRejection to prevent misidentifying thinking-config refusals as schema drops.
+function isThinkingRejection(status: number, message: string) {
+  if (status !== 400) return false;
+  const lower = message.toLowerCase();
+  return lower.includes('thinking') || lower.includes('thought');
+}
+
+function isRetryableTransportError(error: unknown) {
+  if (!(error instanceof Error)) return false;
+  // Don't retry timeouts (caller grants up to 2m); defer to fallback chains.
+  if (error.name === 'TimeoutError' || error.message.toLowerCase().includes('timed out')) return false;
+  if (error.message.includes('fetch failed')) return true;
+  return error instanceof TypeError;
+}
+
+export async function reviewWithGoogle(
+  config: { apiKey: string; baseUrl?: string | null; providerName?: string; timeoutMs?: number },
+  model: string,
+  input: ModelInput,
+  tracker?: { incrementSubrequests(count?: number): void },
+): Promise<ModelResponse> {
+  const timeoutMs = config.timeoutMs ?? GEMINI_TIMEOUT_MS;
+  logger.info(`Calling Google model: ${model}`);
+
+  assertPublicBaseUrl(config.baseUrl, config.providerName ?? 'Google');
+  const prompts = jsonOnlyPrompts(input);
+  const responseJsonSchema = input.responseSchema
+    ? toGeminiResponseJsonSchema(input.responseSchema.schema)
+    : null;
+  // Latches to disable features on subsequent attempts if rejected.
+  let schemaRejected = false;
+  let thinkingRejected = false;
+
+  // Summing JSON and thinking token budgets prevents truncated prefixes.
+  const answerBudget = resolveOutputTokenCeiling(
+    input.outputBudgetTokens,
+    GEMINI_MAX_OUTPUT_TOKENS,
+    GEMINI_DEFAULT_OUTPUT_TOKENS,
+  );
+  const thinkingBudget = geminiThinkingBudgetTokens(answerBudget);
+  const outputCeiling = Math.min(GEMINI_MAX_OUTPUT_TOKENS, answerBudget + thinkingBudget);
+  // Mark error so caller latches schema-dropped state even on subsequent failure.
+  const fail = (error: unknown): never => {
+    if (schemaRejected && typeof error === 'object' && error !== null) {
+      Object.defineProperty(error, 'schemaDropped', { value: true, configurable: true });
+    }
+    throw error;
+  };
+
+  const startTime = Date.now();
+  const baseUrl = (config.baseUrl || DEFAULT_GEMINI_BASE_URL).replace(/\/+$/, '');
+  const url = `${baseUrl}/models/${encodeURIComponent(model)}:generateContent?key=${encodeURIComponent(config.apiKey)}`;
+  const maxRetries = GEMINI_MAX_RETRIES;
+  let lastError: unknown;
+  let delayBeforeAttemptMs = 0;
+
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    if (delayBeforeAttemptMs > 0) {
+      logger.info(`Retrying Gemini request (attempt ${attempt}/${maxRetries}) in ${Math.round(delayBeforeAttemptMs)}ms`);
+      await new Promise(resolve => setTimeout(resolve, delayBeforeAttemptMs));
+      delayBeforeAttemptMs = 0;
+    }
+
+    let response: Response;
+    try {
+      if (tracker) tracker.incrementSubrequests(1);
+      response = await withTimeout('Gemini API', timeoutMs, (signal) =>
+        fetch(url, {
+          method: 'POST',
+          signal,
+          headers: {
+            'content-type': 'application/json',
+          },
+          body: JSON.stringify({
+            systemInstruction: {
+              role: 'system',
+              parts: [{ text: prompts.system }],
+            },
+            contents: [
+              { role: 'user', parts: [{ text: prompts.user }] },
+            ],
+            generationConfig: {
+              // Required for schemas and summary path.
+              responseMimeType: 'application/json',
+              // See gemini-schema.ts.
+              ...(responseJsonSchema && !schemaRejected ? { responseJsonSchema } : {}),
+              maxOutputTokens: outputCeiling,
+              // Bounded thinking budget so it doesn't consume the output ceiling.
+              ...(thinkingRejected ? {} : { thinkingConfig: { thinkingBudget } }),
+              // 0.9 on Gemini's 0-2 scale.
+              temperature: 0.9,
+            },
+          }),
+        }),
+      );
+    } catch (error) {
+      lastError = error;
+      if (isRetryableTransportError(error) && attempt < maxRetries) {
+        delayBeforeAttemptMs = defaultRetryDelayMs(attempt);
+        continue;
+      }
+      return fail(error);
+    }
+
+    if (!response.ok) {
+      const errorText = await response.text();
+      const message = providerErrorMessage(errorText);
+
+      // Check thinking first; isSchemaRejection is broad.
+      if (!thinkingRejected && isThinkingRejection(response.status, message)) {
+        thinkingRejected = true;
+        logger.warn('Gemini rejected thinkingConfig; retrying without an explicit thinking budget', {
+          model,
+          error: message,
+        });
+        lastError = new ProviderRequestError(config.providerName ?? 'Google', response.status, message);
+        // Refund attempt (no sleep); latched.
+        attempt--;
+        continue;
+      }
+
+      if (responseJsonSchema && !schemaRejected && isSchemaRejection(response.status, message)) {
+        schemaRejected = true;
+        // Inferred schema rejection; real cause thrown below if 400 recurs.
+        logger.warn('Gemini returned a 400 that looks like a response-grammar rejection; retrying without constrained decoding', {
+          model,
+          error: message,
+        });
+        lastError = new ProviderRequestError(config.providerName ?? 'Google', response.status, message);
+        // Refund attempt (no sleep); latched.
+        attempt--;
+        continue;
+      }
+
+      const requestedDelayMs = response.status === 429
+        ? retryAfterDelayMs(response.headers.get('retry-after')) ?? requestedRetryDelayFromBody(message)
+        : null;
+      // Unstated 429s back-off for ~60s, making them unretryable here. Retry only on short, stated cool-offs.
+      const isRetryable = response.status === 429
+        ? requestedDelayMs !== null && requestedDelayMs <= GEMINI_MAX_RETRY_DELAY_MS
+        : isRetryableGeminiStatus(response.status);
+      const retryDelayMs = Math.min(
+        GEMINI_MAX_RETRY_DELAY_MS,
+        requestedDelayMs ?? defaultRetryDelayMs(attempt),
+      );
+
+      const logData = {
+        error: message,
+        attempt,
+        willRetry: isRetryable && attempt < maxRetries,
+        requestedDelayMs: requestedDelayMs ?? undefined,
+        retryDelayMs: isRetryable && attempt < maxRetries ? retryDelayMs : undefined,
+        // Log bounded raw body for terminal 4xx to debug unactionable "invalid argument" errors.
+        rawBody: response.status >= 400 && response.status < 500 && !(isRetryable && attempt < maxRetries)
+          ? errorText.slice(0, 2_000)
+          : undefined,
+      };
+      if (isRetryable && attempt < maxRetries) {
+        logger.warn(`Gemini request failed with ${response.status}; retrying`, logData);
+        lastError = new ProviderRequestError(config.providerName ?? 'Google', response.status, message);
+        delayBeforeAttemptMs = retryDelayMs;
+        continue;
+      }
+
+      logger.error(`Gemini request failed with ${response.status}`, logData);
+      return fail(new ProviderRequestError(config.providerName ?? 'Google', response.status, message));
+    }
+
+    const durationMs = Date.now() - startTime;
+    logger.info(`AI model ${model} responded in ${durationMs}ms`);
+
+    const data = (await response.json()) as {
+      candidates?: Array<{ content?: { parts?: Array<{ text?: string }> }; finishReason?: string }>;
+      usageMetadata?: {
+        promptTokenCount?: number;
+        candidatesTokenCount?: number;
+        // Billed against `maxOutputTokens`.
+        thoughtsTokenCount?: number;
+      };
+    };
+
+    const candidate = data.candidates?.[0];
+    const rawText = candidate?.content?.parts?.map((part) => part.text ?? '').join('')?.trim();
+    if (!rawText) {
+      const finishReason = candidate?.finishReason;
+      // Deterministic non-STOP (budget burn, safety) fails permanently; empty STOP is transient.
+      if (finishReason && finishReason !== 'STOP') {
+        return fail(new UnparseableModelResponseError(model, `finishReason=${finishReason}`));
+      }
+      return fail(new Error('Gemini returned an empty response.'));
+    }
+
+    // Log non-STOP prefix truncations.
+    if (candidate?.finishReason && candidate.finishReason !== 'STOP') {
+      logger.warn(`Gemini response for ${model} ended with finishReason=${candidate.finishReason}; output is likely incomplete`, {
+        // Avoid `Tokens` key name to bypass logger redaction. Sum thinking + output spend.
+        outputSpend: (data.usageMetadata?.candidatesTokenCount ?? 0) + (data.usageMetadata?.thoughtsTokenCount ?? 0),
+        thoughtSpend: data.usageMetadata?.thoughtsTokenCount ?? 0,
+        outputCeiling,
+        thinkingBudget: thinkingRejected ? undefined : thinkingBudget,
+        schemaDropped: schemaRejected,
+      });
+    }
+
+    return {
+      rawText,
+      inputTokens: data.usageMetadata?.promptTokenCount ?? 0,
+      outputTokens: data.usageMetadata?.candidatesTokenCount ?? 0,
+      modelUsed: model,
+      provider: config.providerName ?? 'Google',
+      ...(schemaRejected ? { degraded: 'schema-dropped' as const } : {}),
+    };
+  }
+
+  return fail(lastError);
+}
diff --git a/src/server/models/openai.ts b/packages/models/src/providers/openai.ts
similarity index 92%
rename from src/server/models/openai.ts
rename to packages/models/src/providers/openai.ts
index eaf1a4b8..b93abf5a 100644
--- a/src/server/models/openai.ts
+++ b/packages/models/src/providers/openai.ts
@@ -1,99 +1,99 @@
-import { logger } from '@server/core/logger';
-import { withTimeout } from '@server/core/timeout';
-import { ProviderRequestError, providerErrorMessage, jsonOnlyPrompts, type ModelResponse } from './types';
-import { assertPublicBaseUrl } from './url-guard';
-import { MODEL_TIMEOUT_MAX_MS, resolveOutputTokenCeiling } from './limits';
-
-// Fallback when the caller supplies no diff-size-aware budget. Shares the review ceiling so an
-// omitting caller can never outlast the chain budget that governs everything else.
-const OPENAI_TIMEOUT_MS = MODEL_TIMEOUT_MAX_MS;
-const OPENAI_DEFAULT_OUTPUT_TOKENS = 4096;
-const OPENAI_MAX_OUTPUT_TOKENS = 16_384;
-
-export interface OpenAIResponse {
-  choices?: Array<{
-    message?: {
-      content?: string | Array<{ text?: string }>;
-    };
-  }>;
-  output_text?: string;
-  usage?: {
-    prompt_tokens?: number;
-    completion_tokens?: number;
-    input_tokens?: number;
-    output_tokens?: number;
-  };
-}
-
-function extractOpenAiText(data: OpenAIResponse) {
-  const messageContent = data?.choices?.[0]?.message?.content;
-  if (typeof messageContent === 'string') return messageContent.trim();
-  if (Array.isArray(messageContent)) {
-    return messageContent.map((part) => typeof part?.text === 'string' ? part.text : '').join('').trim();
-  }
-  const outputText = data?.output_text;
-  if (typeof outputText === 'string') return outputText.trim();
-  return '';
-}
-
-export async function reviewWithOpenAI(
-  config: { apiKey: string | null; baseUrl: string; providerName: string; timeoutMs?: number },
-  model: string,
-  input: { systemPrompt: string; userPrompt: string; outputBudgetTokens?: number },
-  tracker?: { incrementSubrequests(count?: number): void },
-): Promise<ModelResponse> {
-  logger.info(`Calling OpenAI-format model: ${model}`);
-  const timeoutMs = config.timeoutMs ?? OPENAI_TIMEOUT_MS;
-  const outputCeiling = resolveOutputTokenCeiling(
-    input.outputBudgetTokens,
-    OPENAI_MAX_OUTPUT_TOKENS,
-    OPENAI_DEFAULT_OUTPUT_TOKENS,
-  );
-  
-  assertPublicBaseUrl(config.baseUrl, config.providerName);
-  const prompts = jsonOnlyPrompts(input);
-
-  const url = `${config.baseUrl.replace(/\/+$/, '')}/chat/completions`;
-
-  if (tracker) tracker.incrementSubrequests(1);
-  const response = await withTimeout('OpenAI API', timeoutMs, (signal) =>
-    fetch(url, {
-      method: 'POST',
-      signal,
-      headers: {
-        'content-type': 'application/json',
-        ...(config.apiKey ? { authorization: `Bearer ${config.apiKey}` } : {}),
-      },
-      body: JSON.stringify({
-        model,
-        messages: [
-          { role: 'system', content: prompts.system },
-          { role: 'user', content: prompts.user },
-        ],
-        // 0.9 of a 0-2 scale.
-        temperature: 0.9,
-        max_tokens: outputCeiling,
-        response_format: { type: 'json_object' },
-      }),
-    }),
-  );
-
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new ProviderRequestError(config.providerName, response.status, providerErrorMessage(errorText));
-  }
-
-  const data = await response.json() as OpenAIResponse;
-  const rawText = extractOpenAiText(data);
-  if (!rawText) {
-    throw new Error('OpenAI provider returned an empty response.');
-  }
-
-  return {
-    rawText,
-    inputTokens: data?.usage?.prompt_tokens ?? data?.usage?.input_tokens ?? 0,
-    outputTokens: data?.usage?.completion_tokens ?? data?.usage?.output_tokens ?? 0,
-    modelUsed: model,
-    provider: config.providerName,
-  };
-}
+import { logger } from '@codra/core/logger';
+import { withTimeout } from '@server/core/timeout';
+import { ProviderRequestError, providerErrorMessage, jsonOnlyPrompts, type ModelResponse } from '../types';
+import { assertPublicBaseUrl } from '../url-guard';
+import { MODEL_TIMEOUT_MAX_MS, resolveOutputTokenCeiling } from '../limits';
+
+// Fallback when the caller supplies no diff-size-aware budget. Shares the review ceiling so an
+// omitting caller can never outlast the chain budget that governs everything else.
+const OPENAI_TIMEOUT_MS = MODEL_TIMEOUT_MAX_MS;
+const OPENAI_DEFAULT_OUTPUT_TOKENS = 4096;
+const OPENAI_MAX_OUTPUT_TOKENS = 16_384;
+
+export interface OpenAIResponse {
+  choices?: Array<{
+    message?: {
+      content?: string | Array<{ text?: string }>;
+    };
+  }>;
+  output_text?: string;
+  usage?: {
+    prompt_tokens?: number;
+    completion_tokens?: number;
+    input_tokens?: number;
+    output_tokens?: number;
+  };
+}
+
+function extractOpenAiText(data: OpenAIResponse) {
+  const messageContent = data?.choices?.[0]?.message?.content;
+  if (typeof messageContent === 'string') return messageContent.trim();
+  if (Array.isArray(messageContent)) {
+    return messageContent.map((part) => typeof part?.text === 'string' ? part.text : '').join('').trim();
+  }
+  const outputText = data?.output_text;
+  if (typeof outputText === 'string') return outputText.trim();
+  return '';
+}
+
+export async function reviewWithOpenAI(
+  config: { apiKey: string | null; baseUrl: string; providerName: string; timeoutMs?: number },
+  model: string,
+  input: { systemPrompt: string; userPrompt: string; outputBudgetTokens?: number },
+  tracker?: { incrementSubrequests(count?: number): void },
+): Promise<ModelResponse> {
+  logger.info(`Calling OpenAI-format model: ${model}`);
+  const timeoutMs = config.timeoutMs ?? OPENAI_TIMEOUT_MS;
+  const outputCeiling = resolveOutputTokenCeiling(
+    input.outputBudgetTokens,
+    OPENAI_MAX_OUTPUT_TOKENS,
+    OPENAI_DEFAULT_OUTPUT_TOKENS,
+  );
+  
+  assertPublicBaseUrl(config.baseUrl, config.providerName);
+  const prompts = jsonOnlyPrompts(input);
+
+  const url = `${config.baseUrl.replace(/\/+$/, '')}/chat/completions`;
+
+  if (tracker) tracker.incrementSubrequests(1);
+  const response = await withTimeout('OpenAI API', timeoutMs, (signal) =>
+    fetch(url, {
+      method: 'POST',
+      signal,
+      headers: {
+        'content-type': 'application/json',
+        ...(config.apiKey ? { authorization: `Bearer ${config.apiKey}` } : {}),
+      },
+      body: JSON.stringify({
+        model,
+        messages: [
+          { role: 'system', content: prompts.system },
+          { role: 'user', content: prompts.user },
+        ],
+        // 0.9 of a 0-2 scale.
+        temperature: 0.9,
+        max_tokens: outputCeiling,
+        response_format: { type: 'json_object' },
+      }),
+    }),
+  );
+
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new ProviderRequestError(config.providerName, response.status, providerErrorMessage(errorText));
+  }
+
+  const data = await response.json() as OpenAIResponse;
+  const rawText = extractOpenAiText(data);
+  if (!rawText) {
+    throw new Error('OpenAI provider returned an empty response.');
+  }
+
+  return {
+    rawText,
+    inputTokens: data?.usage?.prompt_tokens ?? data?.usage?.input_tokens ?? 0,
+    outputTokens: data?.usage?.completion_tokens ?? data?.usage?.output_tokens ?? 0,
+    modelUsed: model,
+    provider: config.providerName,
+  };
+}
diff --git a/src/server/models/vertex.ts b/packages/models/src/providers/vertex.ts
similarity index 96%
rename from src/server/models/vertex.ts
rename to packages/models/src/providers/vertex.ts
index 0516ccff..39e3f554 100644
--- a/src/server/models/vertex.ts
+++ b/packages/models/src/providers/vertex.ts
@@ -1,244 +1,244 @@
-import { logger } from '@server/core/logger';
-import { withTimeout } from '@server/core/timeout';
-import { ProviderRequestError, UnparseableModelResponseError, providerErrorMessage, jsonOnlyPrompts, type ModelResponse } from './types';
-import { assertPublicBaseUrl } from './url-guard';
-import { MODEL_TIMEOUT_MAX_MS, OUTPUT_TOKENS_FLOOR, resolveOutputTokenCeiling } from './limits';
-
-// Vertex's REST API rejects plain API keys and requires an OAuth2 token via RFC 7523 JWT-bearer grant, so `apiKey` here holds the full service-account JSON key, not a short API key string.
-const VERTEX_TIMEOUT_MS = MODEL_TIMEOUT_MAX_MS;
-const VERTEX_DEFAULT_OUTPUT_TOKENS = OUTPUT_TOKENS_FLOOR;
-// Same Gemini models as the Google adapter, so the same ceiling. No `thinkingConfig` here though: this
-// adapter makes ONE attempt and has no latch, so a model that refused the field would fail the file.
-const VERTEX_MAX_OUTPUT_TOKENS = 65_536;
-// Retries for a 429 only, and only while the caller's own timeout still has room. See the loop below
-// for why resending an unchanged request is the correct response to this particular refusal.
-const VERTEX_QUOTA_RETRIES = 2;
-const VERTEX_QUOTA_BACKOFF_MS = 4_000;
-// Room a resend needs to be worth starting at all; a Vertex 429 itself comes back in ~7s.
-const VERTEX_MIN_ATTEMPT_MS = 8_000;
-const OAUTH_TOKEN_URL = 'https://oauth2.googleapis.com/token';
-const OAUTH_SCOPE = 'https://www.googleapis.com/auth/cloud-platform';
-const ACCESS_TOKEN_LIFETIME_S = 3600;
-// Refresh before real expiry so an in-flight review never starts a call with a token that expires mid-request.
-const TOKEN_REFRESH_MARGIN_MS = 60_000;
-
-interface ServiceAccountKey {
-  client_email: string;
-  private_key: string;
-}
-
-interface CachedToken {
-  accessToken: string;
-  expiresAt: number;
-}
-
-// Per-isolate cache, not per-request: saves a token mint (and a subrequest) on every file review after the first to hit a warm isolate.
-const tokenCache = new Map<string, CachedToken>();
-
-function parseServiceAccountKey(raw: string): ServiceAccountKey {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new Error('Vertex AI credentials must be the full service-account JSON key (paste the downloaded .json file contents), not an API key.');
-  }
-
-  const obj = parsed as Partial<ServiceAccountKey> | null;
-  if (!obj || typeof obj.client_email !== 'string' || typeof obj.private_key !== 'string') {
-    throw new Error('Vertex AI service-account JSON is missing client_email or private_key.');
-  }
-  return { client_email: obj.client_email, private_key: obj.private_key };
-}
-
-function base64Url(bytes: Uint8Array) {
-  return Buffer.from(bytes)
-    .toString('base64')
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_')
-    .replace(/=+$/, '');
-}
-
-async function importPrivateKey(pem: string) {
-  const der = Buffer.from(
-    pem.replace(/-----BEGIN PRIVATE KEY-----/, '').replace(/-----END PRIVATE KEY-----/, '').replace(/\s+/g, ''),
-    'base64',
-  );
-  return crypto.subtle.importKey('pkcs8', der, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['sign']);
-}
-
-async function mintAccessToken(serviceAccount: ServiceAccountKey): Promise<CachedToken> {
-  const nowSeconds = Math.floor(Date.now() / 1000);
-  const encoder = new TextEncoder();
-  const header = base64Url(encoder.encode(JSON.stringify({ alg: 'RS256', typ: 'JWT' })));
-  const claimSet = base64Url(encoder.encode(JSON.stringify({
-    iss: serviceAccount.client_email,
-    scope: OAUTH_SCOPE,
-    aud: OAUTH_TOKEN_URL,
-    iat: nowSeconds,
-    exp: nowSeconds + ACCESS_TOKEN_LIFETIME_S,
-  })));
-  const signingInput = `${header}.${claimSet}`;
-
-  const key = await importPrivateKey(serviceAccount.private_key);
-  const signature = await crypto.subtle.sign('RSASSA-PKCS1-v1_5', key, encoder.encode(signingInput));
-  const assertion = `${signingInput}.${base64Url(new Uint8Array(signature))}`;
-
-  const response = await withTimeout('Google OAuth token', 10_000, (signal) =>
-    fetch(OAUTH_TOKEN_URL, {
-      method: 'POST',
-      signal,
-      headers: { 'content-type': 'application/x-www-form-urlencoded' },
-      body: new URLSearchParams({
-        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
-        assertion,
-      }),
-    }),
-  );
-
-  if (!response.ok) {
-    const message = providerErrorMessage(await response.text());
-    throw new ProviderRequestError('Google Vertex AI', response.status, `Could not mint an access token for the service account -- check that the JSON key is valid and the Vertex AI API is enabled (${message})`);
-  }
-
-  const data = (await response.json()) as { access_token?: string; expires_in?: number };
-  if (!data.access_token) throw new Error('Google OAuth token endpoint returned no access_token.');
-
-  return {
-    accessToken: data.access_token,
-    expiresAt: Date.now() + (data.expires_in ?? ACCESS_TOKEN_LIFETIME_S) * 1000,
-  };
-}
-
-async function getAccessToken(
-  serviceAccount: ServiceAccountKey,
-  tracker?: { incrementSubrequests(count?: number): void },
-) {
-  const cached = tokenCache.get(serviceAccount.client_email);
-  if (cached && cached.expiresAt - TOKEN_REFRESH_MARGIN_MS > Date.now()) {
-    return cached.accessToken;
-  }
-
-  if (tracker) tracker.incrementSubrequests(1);
-  const token = await mintAccessToken(serviceAccount);
-  tokenCache.set(serviceAccount.client_email, token);
-  return token.accessToken;
-}
-
-export async function reviewWithVertex(
-  config: { apiKey: string; baseUrl?: string | null; providerName?: string; timeoutMs?: number },
-  model: string,
-  input: { systemPrompt: string; userPrompt: string; outputBudgetTokens?: number },
-  tracker?: { incrementSubrequests(count?: number): void },
-): Promise<ModelResponse> {
-  const providerName = config.providerName ?? 'Google Vertex AI';
-  const timeoutMs = config.timeoutMs ?? VERTEX_TIMEOUT_MS;
-  const outputCeiling = resolveOutputTokenCeiling(
-    input.outputBudgetTokens,
-    VERTEX_MAX_OUTPUT_TOKENS,
-    VERTEX_DEFAULT_OUTPUT_TOKENS,
-  );
-  logger.info(`Calling Vertex AI model: ${model}`);
-
-  assertPublicBaseUrl(config.baseUrl, providerName);
-  if (!config.baseUrl) {
-    throw new ProviderRequestError(
-      providerName,
-      400,
-      'Vertex AI requires a base URL with your project and region, e.g. https://us-central1-aiplatform.googleapis.com/v1/projects/YOUR_PROJECT_ID/locations/us-central1',
-    );
-  }
-
-  const serviceAccount = parseServiceAccountKey(config.apiKey);
-  const accessToken = await getAccessToken(serviceAccount, tracker);
-  const prompts = jsonOnlyPrompts(input);
-
-  const startTime = Date.now();
-  const baseUrl = config.baseUrl.replace(/\/+$/, '');
-  const url = `${baseUrl}/publishers/google/models/${encodeURIComponent(model)}:generateContent`;
-
-  const body = JSON.stringify({
-    systemInstruction: {
-      role: 'system',
-      parts: [{ text: prompts.system }],
-    },
-    contents: [
-      { role: 'user', parts: [{ text: prompts.user }] },
-    ],
-    generationConfig: {
-      responseMimeType: 'application/json',
-      // No `responseJsonSchema`: this adapter cannot drop a schema mid-flight, so a rejection would fail the file outright.
-      maxOutputTokens: outputCeiling,
-      // Same models as the Google adapter, so the same value keeps the two paths comparable.
-      temperature: 0.9,
-    },
-  });
-
-  const attempt = () =>
-    withTimeout('Vertex AI', timeoutMs, (signal) =>
-      fetch(url, {
-        method: 'POST',
-        signal,
-        headers: {
-          'content-type': 'application/json',
-          authorization: `Bearer ${accessToken}`,
-        },
-        body,
-      }),
-    );
-
-  if (tracker) tracker.incrementSubrequests(1);
-  let response = await attempt();
-
-  // A Vertex 429 here is queueing, not a bucket the caller can pace around. Measured over ~900 calls on
-  // one project: roughly three in four refused, and the refusal was uncorrelated with the requested
-  // output ceiling, with the endpoint, and with whether the previous call succeeded -- resending the
-  // IDENTICAL request works. The adapter used to make one attempt and turn every one of those into a
-  // failed file, which is the one case where the single-attempt rule above does not apply: there is no
-  // schema to re-probe and nothing about the request to change.
-  //
-  // Bounded by the caller's own timeout, not by a retry count alone: `timeoutMs` is already clamped to
-  // the fallback-chain budget, so a slow rung must not spend the whole invocation sitting in backoff.
-  for (let retry = 0; retry < VERTEX_QUOTA_RETRIES && response.status === 429; retry++) {
-    const waitMs = VERTEX_QUOTA_BACKOFF_MS * (retry + 1);
-    if (Date.now() - startTime + waitMs + VERTEX_MIN_ATTEMPT_MS > timeoutMs) break;
-
-    logger.warn(`Vertex AI refused with 429; resending unchanged in ${waitMs}ms`, { model, retry: retry + 1 });
-    await new Promise((resolve) => setTimeout(resolve, waitMs));
-    if (tracker) tracker.incrementSubrequests(1);
-    response = await attempt();
-  }
-
-  if (!response.ok) {
-    const message = providerErrorMessage(await response.text());
-    throw new ProviderRequestError(providerName, response.status, message);
-  }
-
-  const durationMs = Date.now() - startTime;
-  logger.info(`AI model ${model} responded in ${durationMs}ms`);
-
-  const data = (await response.json()) as {
-    candidates?: Array<{ content?: { parts?: Array<{ text?: string }> }; finishReason?: string }>;
-    usageMetadata?: {
-      promptTokenCount?: number;
-      candidatesTokenCount?: number;
-    };
-  };
-
-  const candidate = data.candidates?.[0];
-  const rawText = candidate?.content?.parts?.map((part) => part.text ?? '').join('')?.trim();
-  if (!rawText) {
-    const finishReason = candidate?.finishReason;
-    if (finishReason && finishReason !== 'STOP') {
-      throw new UnparseableModelResponseError(model, `finishReason=${finishReason}`);
-    }
-    throw new Error('Vertex AI returned an empty response.');
-  }
-
-  return {
-    rawText,
-    inputTokens: data.usageMetadata?.promptTokenCount ?? 0,
-    outputTokens: data.usageMetadata?.candidatesTokenCount ?? 0,
-    modelUsed: model,
-    provider: providerName,
-  };
-}
+import { logger } from '@codra/core/logger';
+import { withTimeout } from '@server/core/timeout';
+import { ProviderRequestError, UnparseableModelResponseError, providerErrorMessage, jsonOnlyPrompts, type ModelResponse } from '../types';
+import { assertPublicBaseUrl } from '../url-guard';
+import { MODEL_TIMEOUT_MAX_MS, OUTPUT_TOKENS_FLOOR, resolveOutputTokenCeiling } from '../limits';
+
+// Vertex's REST API rejects plain API keys and requires an OAuth2 token via RFC 7523 JWT-bearer grant, so `apiKey` here holds the full service-account JSON key, not a short API key string.
+const VERTEX_TIMEOUT_MS = MODEL_TIMEOUT_MAX_MS;
+const VERTEX_DEFAULT_OUTPUT_TOKENS = OUTPUT_TOKENS_FLOOR;
+// Same Gemini models as the Google adapter, so the same ceiling. No `thinkingConfig` here though: this
+// adapter makes ONE attempt and has no latch, so a model that refused the field would fail the file.
+const VERTEX_MAX_OUTPUT_TOKENS = 65_536;
+// Retries for a 429 only, and only while the caller's own timeout still has room. See the loop below
+// for why resending an unchanged request is the correct response to this particular refusal.
+const VERTEX_QUOTA_RETRIES = 2;
+const VERTEX_QUOTA_BACKOFF_MS = 4_000;
+// Room a resend needs to be worth starting at all; a Vertex 429 itself comes back in ~7s.
+const VERTEX_MIN_ATTEMPT_MS = 8_000;
+const OAUTH_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+const OAUTH_SCOPE = 'https://www.googleapis.com/auth/cloud-platform';
+const ACCESS_TOKEN_LIFETIME_S = 3600;
+// Refresh before real expiry so an in-flight review never starts a call with a token that expires mid-request.
+const TOKEN_REFRESH_MARGIN_MS = 60_000;
+
+interface ServiceAccountKey {
+  client_email: string;
+  private_key: string;
+}
+
+interface CachedToken {
+  accessToken: string;
+  expiresAt: number;
+}
+
+// Per-isolate cache, not per-request: saves a token mint (and a subrequest) on every file review after the first to hit a warm isolate.
+const tokenCache = new Map<string, CachedToken>();
+
+function parseServiceAccountKey(raw: string): ServiceAccountKey {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('Vertex AI credentials must be the full service-account JSON key (paste the downloaded .json file contents), not an API key.');
+  }
+
+  const obj = parsed as Partial<ServiceAccountKey> | null;
+  if (!obj || typeof obj.client_email !== 'string' || typeof obj.private_key !== 'string') {
+    throw new Error('Vertex AI service-account JSON is missing client_email or private_key.');
+  }
+  return { client_email: obj.client_email, private_key: obj.private_key };
+}
+
+function base64Url(bytes: Uint8Array) {
+  return Buffer.from(bytes)
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+async function importPrivateKey(pem: string) {
+  const der = Buffer.from(
+    pem.replace(/-----BEGIN PRIVATE KEY-----/, '').replace(/-----END PRIVATE KEY-----/, '').replace(/\s+/g, ''),
+    'base64',
+  );
+  return crypto.subtle.importKey('pkcs8', der, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['sign']);
+}
+
+async function mintAccessToken(serviceAccount: ServiceAccountKey): Promise<CachedToken> {
+  const nowSeconds = Math.floor(Date.now() / 1000);
+  const encoder = new TextEncoder();
+  const header = base64Url(encoder.encode(JSON.stringify({ alg: 'RS256', typ: 'JWT' })));
+  const claimSet = base64Url(encoder.encode(JSON.stringify({
+    iss: serviceAccount.client_email,
+    scope: OAUTH_SCOPE,
+    aud: OAUTH_TOKEN_URL,
+    iat: nowSeconds,
+    exp: nowSeconds + ACCESS_TOKEN_LIFETIME_S,
+  })));
+  const signingInput = `${header}.${claimSet}`;
+
+  const key = await importPrivateKey(serviceAccount.private_key);
+  const signature = await crypto.subtle.sign('RSASSA-PKCS1-v1_5', key, encoder.encode(signingInput));
+  const assertion = `${signingInput}.${base64Url(new Uint8Array(signature))}`;
+
+  const response = await withTimeout('Google OAuth token', 10_000, (signal) =>
+    fetch(OAUTH_TOKEN_URL, {
+      method: 'POST',
+      signal,
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+        assertion,
+      }),
+    }),
+  );
+
+  if (!response.ok) {
+    const message = providerErrorMessage(await response.text());
+    throw new ProviderRequestError('Google Vertex AI', response.status, `Could not mint an access token for the service account -- check that the JSON key is valid and the Vertex AI API is enabled (${message})`);
+  }
+
+  const data = (await response.json()) as { access_token?: string; expires_in?: number };
+  if (!data.access_token) throw new Error('Google OAuth token endpoint returned no access_token.');
+
+  return {
+    accessToken: data.access_token,
+    expiresAt: Date.now() + (data.expires_in ?? ACCESS_TOKEN_LIFETIME_S) * 1000,
+  };
+}
+
+async function getAccessToken(
+  serviceAccount: ServiceAccountKey,
+  tracker?: { incrementSubrequests(count?: number): void },
+) {
+  const cached = tokenCache.get(serviceAccount.client_email);
+  if (cached && cached.expiresAt - TOKEN_REFRESH_MARGIN_MS > Date.now()) {
+    return cached.accessToken;
+  }
+
+  if (tracker) tracker.incrementSubrequests(1);
+  const token = await mintAccessToken(serviceAccount);
+  tokenCache.set(serviceAccount.client_email, token);
+  return token.accessToken;
+}
+
+export async function reviewWithVertex(
+  config: { apiKey: string; baseUrl?: string | null; providerName?: string; timeoutMs?: number },
+  model: string,
+  input: { systemPrompt: string; userPrompt: string; outputBudgetTokens?: number },
+  tracker?: { incrementSubrequests(count?: number): void },
+): Promise<ModelResponse> {
+  const providerName = config.providerName ?? 'Google Vertex AI';
+  const timeoutMs = config.timeoutMs ?? VERTEX_TIMEOUT_MS;
+  const outputCeiling = resolveOutputTokenCeiling(
+    input.outputBudgetTokens,
+    VERTEX_MAX_OUTPUT_TOKENS,
+    VERTEX_DEFAULT_OUTPUT_TOKENS,
+  );
+  logger.info(`Calling Vertex AI model: ${model}`);
+
+  assertPublicBaseUrl(config.baseUrl, providerName);
+  if (!config.baseUrl) {
+    throw new ProviderRequestError(
+      providerName,
+      400,
+      'Vertex AI requires a base URL with your project and region, e.g. https://us-central1-aiplatform.googleapis.com/v1/projects/YOUR_PROJECT_ID/locations/us-central1',
+    );
+  }
+
+  const serviceAccount = parseServiceAccountKey(config.apiKey);
+  const accessToken = await getAccessToken(serviceAccount, tracker);
+  const prompts = jsonOnlyPrompts(input);
+
+  const startTime = Date.now();
+  const baseUrl = config.baseUrl.replace(/\/+$/, '');
+  const url = `${baseUrl}/publishers/google/models/${encodeURIComponent(model)}:generateContent`;
+
+  const body = JSON.stringify({
+    systemInstruction: {
+      role: 'system',
+      parts: [{ text: prompts.system }],
+    },
+    contents: [
+      { role: 'user', parts: [{ text: prompts.user }] },
+    ],
+    generationConfig: {
+      responseMimeType: 'application/json',
+      // No `responseJsonSchema`: this adapter cannot drop a schema mid-flight, so a rejection would fail the file outright.
+      maxOutputTokens: outputCeiling,
+      // Same models as the Google adapter, so the same value keeps the two paths comparable.
+      temperature: 0.9,
+    },
+  });
+
+  const attempt = () =>
+    withTimeout('Vertex AI', timeoutMs, (signal) =>
+      fetch(url, {
+        method: 'POST',
+        signal,
+        headers: {
+          'content-type': 'application/json',
+          authorization: `Bearer ${accessToken}`,
+        },
+        body,
+      }),
+    );
+
+  if (tracker) tracker.incrementSubrequests(1);
+  let response = await attempt();
+
+  // A Vertex 429 here is queueing, not a bucket the caller can pace around. Measured over ~900 calls on
+  // one project: roughly three in four refused, and the refusal was uncorrelated with the requested
+  // output ceiling, with the endpoint, and with whether the previous call succeeded -- resending the
+  // IDENTICAL request works. The adapter used to make one attempt and turn every one of those into a
+  // failed file, which is the one case where the single-attempt rule above does not apply: there is no
+  // schema to re-probe and nothing about the request to change.
+  //
+  // Bounded by the caller's own timeout, not by a retry count alone: `timeoutMs` is already clamped to
+  // the fallback-chain budget, so a slow rung must not spend the whole invocation sitting in backoff.
+  for (let retry = 0; retry < VERTEX_QUOTA_RETRIES && response.status === 429; retry++) {
+    const waitMs = VERTEX_QUOTA_BACKOFF_MS * (retry + 1);
+    if (Date.now() - startTime + waitMs + VERTEX_MIN_ATTEMPT_MS > timeoutMs) break;
+
+    logger.warn(`Vertex AI refused with 429; resending unchanged in ${waitMs}ms`, { model, retry: retry + 1 });
+    await new Promise((resolve) => setTimeout(resolve, waitMs));
+    if (tracker) tracker.incrementSubrequests(1);
+    response = await attempt();
+  }
+
+  if (!response.ok) {
+    const message = providerErrorMessage(await response.text());
+    throw new ProviderRequestError(providerName, response.status, message);
+  }
+
+  const durationMs = Date.now() - startTime;
+  logger.info(`AI model ${model} responded in ${durationMs}ms`);
+
+  const data = (await response.json()) as {
+    candidates?: Array<{ content?: { parts?: Array<{ text?: string }> }; finishReason?: string }>;
+    usageMetadata?: {
+      promptTokenCount?: number;
+      candidatesTokenCount?: number;
+    };
+  };
+
+  const candidate = data.candidates?.[0];
+  const rawText = candidate?.content?.parts?.map((part) => part.text ?? '').join('')?.trim();
+  if (!rawText) {
+    const finishReason = candidate?.finishReason;
+    if (finishReason && finishReason !== 'STOP') {
+      throw new UnparseableModelResponseError(model, `finishReason=${finishReason}`);
+    }
+    throw new Error('Vertex AI returned an empty response.');
+  }
+
+  return {
+    rawText,
+    inputTokens: data.usageMetadata?.promptTokenCount ?? 0,
+    outputTokens: data.usageMetadata?.candidatesTokenCount ?? 0,
+    modelUsed: model,
+    provider: providerName,
+  };
+}
diff --git a/src/server/services/model.ts b/packages/models/src/runner.ts
similarity index 80%
rename from src/server/services/model.ts
rename to packages/models/src/runner.ts
index 178070fc..012c3fba 100644
--- a/src/server/services/model.ts
+++ b/packages/models/src/runner.ts
@@ -1,41 +1,41 @@
-import type { AppBindings } from '../env';
-import { reviewWithGoogle } from '../models/google';
-import { reviewWithVertex } from '../models/vertex';
-import { reviewWithCloudflare } from '../models/cloudflare';
-import { reviewWithOpenAI } from '../models/openai';
-import { reviewWithAnthropic } from '../models/anthropic';
-import type { VerifyCandidate } from '../prompts/verify';
-import type { RepoConfig } from '@codra/schema';
-import type { TokenTracker } from '../core/token-tracker';
-import type { ModelInput, ModelResponse } from '../models/types';
-import { logger } from '../core/logger';
-import { getResolvedModelConfig, type ResolvedModelConfig } from '@codra/db/model-configs';
-import { decryptLlmApiKey } from '@server/core/llm-crypto';
+import type { KvStore, SecretStore } from '@codra/core/ports';
+import type { CloudflareAiBinding } from './providers/cloudflare';
+import { reviewWithGoogle } from './providers/google';
+import { reviewWithVertex } from './providers/vertex';
+import { reviewWithCloudflare } from './providers/cloudflare';
+import { reviewWithOpenAI } from './providers/openai';
+import { reviewWithAnthropic } from './providers/anthropic';
+import type { VerifyCandidate } from '@server/prompts/verify';
+import type { RepoConfig, ResolvedModelConfig  } from '@codra/schema';
+import type { TokenTracker } from '@codra/core/token-tracker';
+import type { ModelInput, ModelResponse } from './types';
+import { logger } from '@codra/core/logger';
+import { decryptLlmApiKey } from './llm-crypto';
 import {
   isSchemaDroppedError,
   normalizeModel,
   uniqueModels,
-} from './model-support';
-import { ModelRateLimitBook } from './model-rate-limits';
-import { ModelChainProgressStore } from './model-chain-progress';
-import { type ModelChainContext, generateSummary, verifyFindings } from './model-chain-runner';
-import { type ModelReviewContext, reviewFile, reviewFiles } from './model-review-file';
+} from './internal/model-support';
+import { ModelRateLimitBook } from './internal/model-rate-limits';
+import { ModelChainProgressStore } from './internal/model-chain-progress';
+import { type ModelChainContext, generateSummary, verifyFindings } from './internal/model-chain-runner';
+import { type ModelReviewContext, reviewFile, reviewFiles } from './internal/model-review-file';
 // Re-exported so test doubles can be typed against the real batched-review shape.
-export type { BatchReviewOutcome } from './model-review-file';
-import { pollReviewBatch, submitReviewBatch } from './model-review-batch';
+export type { BatchReviewOutcome } from './internal/model-review-file';
+import { pollReviewBatch, submitReviewBatch } from './internal/model-review-batch';
 
-// Re-exported: core/review.ts and two specs import these from '@server/services/model'.
-export { RetryableModelError, isRetryableModelError, nextChainIndexOf } from './model-support';
+// Re-exported: core/review.ts and two specs import these from '@codra/models'.
+export { RetryableModelError, isRetryableModelError, nextChainIndexOf } from './internal/model-support';
 
 // Re-exported so the batch-prompt budget test asserts against these constants, not a copy.
-export { PROMPT_FIT_SAFETY_FACTOR, estimatePromptTokens } from './model-support';
+export { PROMPT_FIT_SAFETY_FACTOR, estimatePromptTokens } from './internal/model-support';
 // Re-exported so its unit spec can reach it without a sibling import (no-restricted-imports).
-export { ModelChainProgressStore } from './model-chain-progress';
+export { ModelChainProgressStore } from './internal/model-chain-progress';
 // Same reason: the 429-parsing spec asserts against the real implementation, not a copy.
-export { isPlausibleTokenBucket, parseRateLimitFromError } from './model-support';
+export { isPlausibleTokenBucket, parseRateLimitFromError } from './internal/model-support';
 
 const PROVIDER_UNAVAILABLE_TTL_SECONDS = 24 * 60 * 60;
-export class ModelService {
+export class ModelRunner {
   // Caches the in-flight PROMISE (not just the result), so concurrent calls for a model await one request.
   private readonly resolvedModelCache = new Map<string, Promise<ResolvedModelConfig | null>>();
 
@@ -57,16 +57,21 @@ export class ModelService {
   private readonly chainProgress: ModelChainProgressStore;
 
   constructor(
-    private env: AppBindings,
-    private tracker?: TokenTracker,
-    private options: { jobId?: string } = {},
+    private deps: {
+      kv: KvStore;
+      secretStore: SecretStore;
+      getConfig: (modelId: string) => Promise<ResolvedModelConfig | null>;
+      aiBinding?: CloudflareAiBinding;
+      tracker?: TokenTracker;
+      jobId?: string;
+    },
   ) {
-    this.chainProgress = new ModelChainProgressStore(env, options.jobId, tracker);
+    this.chainProgress = new ModelChainProgressStore(deps.kv, deps.jobId, deps.tracker);
     this.rateLimits = new ModelRateLimitBook(this.chainProgress);
   }
 
   private providerUnavailableKey(providerId: string) {
-    return this.options.jobId ? `jobs:${this.options.jobId}:provider-unavailable:${providerId}` : null;
+    return this.deps.jobId ? `jobs:${this.deps.jobId}:provider-unavailable:${providerId}` : null;
   }
 
   private isProviderUnavailable(providerId: string): Promise<boolean> {
@@ -77,8 +82,8 @@ export class ModelService {
     if (!pending) {
       pending = (async () => {
         try {
-          this.tracker?.incrementSubrequests(1);
-          return (await this.env.APP_KV.get(key)) !== null;
+          this.deps.tracker?.incrementSubrequests(1);
+          return (await this.deps.kv.get(key)) !== null;
         } catch (error) {
           logger.warn(`Failed to read unavailable provider marker for ${providerId}`, {
             error: error instanceof Error ? error.message : String(error),
@@ -99,8 +104,8 @@ export class ModelService {
     this.providerUnavailableCache.set(providerId, Promise.resolve(true));
 
     try {
-      this.tracker?.incrementSubrequests(1);
-      await this.env.APP_KV.put(
+      this.deps.tracker?.incrementSubrequests(1);
+      await this.deps.kv.put(
         key,
         JSON.stringify({
           reason,
@@ -150,7 +155,7 @@ export class ModelService {
     let pending = this.resolvedModelCache.get(normalized);
     if (!pending) {
       // Cache the DB answer, including a null "not configured", so it isn't re-queried per file.
-      pending = getResolvedModelConfig(this.env, normalized);
+      pending = this.deps.getConfig(normalized);
       this.resolvedModelCache.set(normalized, pending);
       // Don't let a transient DB error poison the cache; drop it so the next call retries.
       pending.catch(() => this.resolvedModelCache.delete(normalized));
@@ -171,7 +176,7 @@ export class ModelService {
     if (!config.encryptedApiKey) {
       throw new Error(`Provider ${config.providerName} does not have a saved API key.`);
     }
-    return decryptLlmApiKey(this.env, config.encryptedApiKey);
+    return decryptLlmApiKey(this.deps.secretStore, config.encryptedApiKey);
   }
 
   private async callResolvedModel(
@@ -183,8 +188,11 @@ export class ModelService {
   ): Promise<ModelResponse> {
     // Resolve credentials BEFORE taking a gate slot, so slow KV/crypto work never occupies one.
     if (config.apiFormat === 'cloudflare-workers-ai') {
+      if (!this.deps.aiBinding) {
+        throw new Error(`Provider ${config.providerName} requires a Cloudflare AI binding, but none was provided.`);
+      }
       return this.rateLimits.runGated(config, onGateWait, () =>
-        reviewWithCloudflare(this.env, config.modelName, input, this.tracker, config.providerName, { timeoutMs }),
+        reviewWithCloudflare(this.deps.aiBinding!, config.modelName, input, this.deps.tracker, config.providerName, { timeoutMs }),
       );
     }
 
@@ -202,7 +210,7 @@ export class ModelService {
             { apiKey, baseUrl: config.baseUrl, providerName: config.providerName, timeoutMs },
             config.modelName,
             gatedInput,
-            this.tracker,
+            this.deps.tracker,
           );
         });
       } catch (error) {
@@ -224,7 +232,7 @@ export class ModelService {
           { apiKey, baseUrl: config.baseUrl, providerName: config.providerName, timeoutMs },
           config.modelName,
           input,
-          this.tracker,
+          this.deps.tracker,
         ),
       );
     }
@@ -241,7 +249,7 @@ export class ModelService {
           },
           config.modelName,
           input,
-          this.tracker,
+          this.deps.tracker,
         ),
       );
     }
@@ -252,7 +260,7 @@ export class ModelService {
         { apiKey, baseUrl: config.baseUrl, providerName: config.providerName, timeoutMs },
         config.modelName,
         input,
-        this.tracker,
+        this.deps.tracker,
       ),
     );
   }
@@ -265,7 +273,7 @@ export class ModelService {
   private reviewCtx(): ModelReviewContext {
     return {
       ...this.chainCtx(),
-      env: this.env,
+      aiBinding: this.deps.aiBinding,
       rateLimits: this.rateLimits,
       asyncUnsupportedModels: this.asyncUnsupportedModels,
       chainProgress: this.chainProgress,
@@ -298,8 +306,8 @@ export class ModelService {
       markProviderUnavailable: (providerId, reason) => this.markProviderUnavailable(providerId, reason),
       callResolvedModel: (resolved, input, timeoutMs, onGateWait) =>
         this.callResolvedModel(resolved, input, timeoutMs, onGateWait),
-      tracker: this.tracker,
-      jobId: this.options.jobId,
+      tracker: this.deps.tracker,
+      jobId: this.deps.jobId,
     };
   }
 
diff --git a/src/server/models/types.ts b/packages/models/src/types.ts
similarity index 97%
rename from src/server/models/types.ts
rename to packages/models/src/types.ts
index 4a9a1fa6..12da12ac 100644
--- a/src/server/models/types.ts
+++ b/packages/models/src/types.ts
@@ -1,6 +1,6 @@
 // Both live in @codra/core/ports now: prompts/file-review.ts builds a ModelResponseSchema, and it is
 // the only reason a pure prompt module ever imported from models/. Re-exported here so the ~20
-// existing `@server/models/types` importers are unaffected, and so there is exactly one definition.
+// existing `@codra/models/types` importers are unaffected, and so there is exactly one definition.
 import type { ModelResponseSchema } from '@codra/core/ports';
 export type { ModelResponse, ModelResponseSchema } from '@codra/core/ports';
 
diff --git a/src/server/models/url-guard.ts b/packages/models/src/url-guard.ts
similarity index 100%
rename from src/server/models/url-guard.ts
rename to packages/models/src/url-guard.ts
diff --git a/test/model/batch-routing.spec.ts b/packages/models/test/model/batch-routing.spec.ts
similarity index 97%
rename from test/model/batch-routing.spec.ts
rename to packages/models/test/model/batch-routing.spec.ts
index 1527b2a3..3d4c1db6 100644
--- a/test/model/batch-routing.spec.ts
+++ b/packages/models/test/model/batch-routing.spec.ts
@@ -1,194 +1,194 @@
-import { describe, expect, it } from 'vitest';
-import { parseBatchReviewResponse } from '@server/core/model-output';
-import type { FileDiff } from '@server/core/diff';
-
-function file(path: string, contents: string[], previousPath: string | null = null): FileDiff {
-  return {
-    path,
-    previousPath,
-    isNew: false,
-    isDeleted: false,
-    isBinary: false,
-    lineCount: contents.length,
-    hunks: [{
-      header: '@@ -1,10 +1,10 @@',
-      lines: contents.map((content, i) => ({
-        kind: 'add' as const,
-        content,
-        newLineNumber: i + 1,
-        oldLineNumber: undefined,
-        position: i + 1,
-      })),
-    }],
-  };
-}
-
-function entry(path: string, evidence: string, title = 'Something is wrong') {
-  return {
-    absolute_file_path: path,
-    findings: [{
-      evidence,
-      code_location: { absolute_file_path: path, line: 1 },
-      claim_type: 'other',
-      title,
-      body: 'A concrete problem with a concrete impact.',
-      priority: 2,
-    }],
-    overall_explanation: `Summary for ${path}`,
-    overall_correctness: 'patch is incorrect',
-  };
-}
-
-const raw = (files: unknown[]) => JSON.stringify({ files, overall_confidence_score: 0.6 });
-
-describe('parseBatchReviewResponse', () => {
-  it('routes each entry to its own file, and reports one the model omitted', () => {
-    const files = [
-      file('src/a.ts', ['const alpha = computeAlpha();']),
-      file('src/b.ts', ['const bravo = computeBravo();']),
-      file('src/c.ts', ['const charlie = 3;']),
-    ];
-
-    const result = parseBatchReviewResponse(
-      raw([entry('src/a.ts', 'const alpha = computeAlpha();'), entry('src/b.ts', 'const bravo = computeBravo();')]),
-      files,
-    );
-
-    expect(result.reviews.get('src/a.ts')!.comments[0].path).toBe('src/a.ts');
-    expect(result.reviews.get('src/b.ts')!.comments[0].path).toBe('src/b.ts');
-    expect(result.reviews.get('src/a.ts')!.fileSummary).toContain('Summary for src/a.ts');
-    // Never silently approved: an omitted file has no entry and must surface for re-queueing.
-    expect(result.missing).toEqual(['src/c.ts']);
-    expect(result.reviews.has('src/c.ts')).toBe(false);
-  });
-
-  // Routing tolerates loose paths, but only when unambiguous. Renames matter because renderFileDiff
-  // shows the old path on the header line.
-  it('tolerates path noise and renames, but refuses to guess', () => {
-    for (const reported of ['./src/a.ts', 'a/src/a.ts', 'b/src/a.ts', '/src/a.ts', 'a.ts']) {
-      const result = parseBatchReviewResponse(
-        raw([entry(reported, 'const alpha = 1;')]),
-        [file('src/a.ts', ['const alpha = 1;'])],
-      );
-      expect(result.stats.unroutableEntries).toBe(0);
-      expect(result.reviews.get('src/a.ts')!.comments).toHaveLength(1);
-    }
-
-    const renamed = parseBatchReviewResponse(
-      raw([entry('src/old.ts', 'const alpha = 1;')]),
-      [file('src/new.ts', ['const alpha = 1;'], 'src/old.ts')],
-    );
-    expect(renamed.reviews.get('src/new.ts')!.comments).toHaveLength(1);
-
-    // Two files share a basename: guessing would file findings against code they were never about.
-    const siblings = [file('src/a/index.ts', ['const alpha = 1;']), file('src/b/index.ts', ['const bravo = 2;'])];
-    const ambiguous = parseBatchReviewResponse(raw([entry('index.ts', 'const alpha = 1;')]), siblings);
-    expect(ambiguous.stats.unroutableEntries).toBe(1);
-    expect(ambiguous.reviews.size).toBe(0);
-
-    // A duplicate entry is discarded, never re-homed onto a sibling.
-    const duplicated = parseBatchReviewResponse(
-      raw([entry('src/a/index.ts', 'const alpha = 1;'), entry('src/a/index.ts', 'const alpha = 1;', 'Duplicate')]),
-      siblings,
-    );
-    expect(duplicated.stats.unroutableEntries).toBe(1);
-    expect(duplicated.reviews.get('src/a/index.ts')!.comments).toHaveLength(1);
-    expect(duplicated.missing).toEqual(['src/b/index.ts']);
-  });
-
-  // What per-file indexes miss: a misfiled finding whose quote exists in the wrong file too.
-  it('withholds only when a shared quote AND a path disagreement coincide', () => {
-    const shared = '} catch (error) {';
-    const files = [file('src/a.ts', [shared, 'const uniqueToAlpha = 1;']), file('src/b.ts', [shared, 'const bravo = 2;'])];
-    const misfiled = (evidence: string, claimedPath: string) => raw([{
-      absolute_file_path: 'src/a.ts',
-      findings: [{
-        evidence,
-        code_location: { absolute_file_path: claimedPath, line: 1 },
-        claim_type: 'other',
-        title: 'Swallowed error',
-        body: 'The catch block hides the failure.',
-        priority: 1,
-      }],
-      overall_explanation: 'Summary',
-      overall_correctness: 'patch is incorrect',
-    }]);
-
-    const withheld = parseBatchReviewResponse(misfiled(shared, 'src/b.ts'), files);
-    expect(withheld.stats.ambiguousAcrossBin).toBe(1);
-    expect(withheld.reviews.get('src/a.ts')!.comments).toHaveLength(0);
-
-    // Shared quote, agreeing path: ordinary, keep it.
-    const agreeing = parseBatchReviewResponse(raw([entry('src/a.ts', shared, 'Swallowed error')]), files);
-    expect(agreeing.stats.ambiguousAcrossBin).toBe(0);
-    expect(agreeing.reviews.get('src/a.ts')!.comments).toHaveLength(1);
-
-    // Unique quote, disagreeing path: the enclosing entry wins, which is the point of nesting.
-    const mismatch = parseBatchReviewResponse(misfiled('const uniqueToAlpha = 1;', 'src/b.ts'), files);
-    expect(mismatch.stats.pathMismatchFindings).toBe(1);
-    expect(mismatch.reviews.get('src/a.ts')!.comments[0].path).toBe('src/a.ts');
-  });
-
-  // Per file, not a shared pool: a shared ceiling lets one noisy file keep everything while
-  // its bin-mates are trimmed to nothing.
-  it('trims over-cap findings per file and accounts for the drop', () => {
-    const lines = Array.from({ length: 30 }, (_, i) => `const value${i} = ${i};`);
-    const files = [file('src/a.ts', lines), file('src/b.ts', ['const bravo = 2;'])];
-
-    const noisy = {
-      absolute_file_path: 'src/a.ts',
-      findings: lines.map((line, i) => ({
-        evidence: line,
-        code_location: { absolute_file_path: 'src/a.ts', line: i + 1 },
-        claim_type: 'other',
-        title: `Problem number ${i}`,
-        body: 'A concrete problem with a concrete impact.',
-        priority: 2,
-      })),
-      overall_explanation: 'Many problems',
-      overall_correctness: 'patch is incorrect',
-    };
-
-    const result = parseBatchReviewResponse(
-      raw([noisy, entry('src/b.ts', 'const bravo = 2;', 'Bravo is off by one')]),
-      files,
-      { maxCommentsPerFile: 5 },
-    );
-
-    // generatorFindingCap(5) = 10.
-    expect(result.reviews.get('src/a.ts')!.comments).toHaveLength(10);
-    expect(result.stats.overCap).toBe(20);
-    expect(result.reviews.get('src/a.ts')!.fileSummary).toContain('over-cap');
-    // The quiet file keeps everything -- it never competed for a shared budget.
-    expect(result.reviews.get('src/b.ts')!.comments).toHaveLength(1);
-  });
-
-  // Assembly can reject one finding; under batching an uncontained throw would discard
-  // every other file packed alongside it.
-  it('drops an unassemblable finding without losing the rest of the bin', () => {
-    const files = [file('src/a.ts', ['const alpha = 1;']), file('src/b.ts', ['const bravo = 2;'])];
-
-    const result = parseBatchReviewResponse(raw([
-      {
-        absolute_file_path: 'src/a.ts',
-        findings: [{
-          evidence: 'const alpha = 1;',
-          code_location: { absolute_file_path: 'src/a.ts', line: 1 },
-          claim_type: 'other',
-          // Title is a prefix of the body, so the body is stripped to nothing downstream.
-          title: 'Leak',
-          body: 'Leak',
-          priority: 2,
-        }],
-        overall_explanation: 'Summary',
-        overall_correctness: 'patch is incorrect',
-      },
-      entry('src/b.ts', 'const bravo = 2;', 'Bravo is off by one'),
-    ]), files);
-
-    expect(result.reviews.get('src/a.ts')!.comments).toHaveLength(0);
-    expect(result.reviews.get('src/a.ts')!.fileSummary).toContain('unassemblable');
-    expect(result.reviews.get('src/b.ts')!.comments).toHaveLength(1);
-  });
-
-});
+import { describe, expect, it } from 'vitest';
+import { parseBatchReviewResponse } from '@server/core/model-output';
+import type { FileDiff } from '@server/core/diff';
+
+function file(path: string, contents: string[], previousPath: string | null = null): FileDiff {
+  return {
+    path,
+    previousPath,
+    isNew: false,
+    isDeleted: false,
+    isBinary: false,
+    lineCount: contents.length,
+    hunks: [{
+      header: '@@ -1,10 +1,10 @@',
+      lines: contents.map((content, i) => ({
+        kind: 'add' as const,
+        content,
+        newLineNumber: i + 1,
+        oldLineNumber: undefined,
+        position: i + 1,
+      })),
+    }],
+  };
+}
+
+function entry(path: string, evidence: string, title = 'Something is wrong') {
+  return {
+    absolute_file_path: path,
+    findings: [{
+      evidence,
+      code_location: { absolute_file_path: path, line: 1 },
+      claim_type: 'other',
+      title,
+      body: 'A concrete problem with a concrete impact.',
+      priority: 2,
+    }],
+    overall_explanation: `Summary for ${path}`,
+    overall_correctness: 'patch is incorrect',
+  };
+}
+
+const raw = (files: unknown[]) => JSON.stringify({ files, overall_confidence_score: 0.6 });
+
+describe('parseBatchReviewResponse', () => {
+  it('routes each entry to its own file, and reports one the model omitted', () => {
+    const files = [
+      file('src/a.ts', ['const alpha = computeAlpha();']),
+      file('src/b.ts', ['const bravo = computeBravo();']),
+      file('src/c.ts', ['const charlie = 3;']),
+    ];
+
+    const result = parseBatchReviewResponse(
+      raw([entry('src/a.ts', 'const alpha = computeAlpha();'), entry('src/b.ts', 'const bravo = computeBravo();')]),
+      files,
+    );
+
+    expect(result.reviews.get('src/a.ts')!.comments[0].path).toBe('src/a.ts');
+    expect(result.reviews.get('src/b.ts')!.comments[0].path).toBe('src/b.ts');
+    expect(result.reviews.get('src/a.ts')!.fileSummary).toContain('Summary for src/a.ts');
+    // Never silently approved: an omitted file has no entry and must surface for re-queueing.
+    expect(result.missing).toEqual(['src/c.ts']);
+    expect(result.reviews.has('src/c.ts')).toBe(false);
+  });
+
+  // Routing tolerates loose paths, but only when unambiguous. Renames matter because renderFileDiff
+  // shows the old path on the header line.
+  it('tolerates path noise and renames, but refuses to guess', () => {
+    for (const reported of ['./src/a.ts', 'a/src/a.ts', 'b/src/a.ts', '/src/a.ts', 'a.ts']) {
+      const result = parseBatchReviewResponse(
+        raw([entry(reported, 'const alpha = 1;')]),
+        [file('src/a.ts', ['const alpha = 1;'])],
+      );
+      expect(result.stats.unroutableEntries).toBe(0);
+      expect(result.reviews.get('src/a.ts')!.comments).toHaveLength(1);
+    }
+
+    const renamed = parseBatchReviewResponse(
+      raw([entry('src/old.ts', 'const alpha = 1;')]),
+      [file('src/new.ts', ['const alpha = 1;'], 'src/old.ts')],
+    );
+    expect(renamed.reviews.get('src/new.ts')!.comments).toHaveLength(1);
+
+    // Two files share a basename: guessing would file findings against code they were never about.
+    const siblings = [file('src/a/index.ts', ['const alpha = 1;']), file('src/b/index.ts', ['const bravo = 2;'])];
+    const ambiguous = parseBatchReviewResponse(raw([entry('index.ts', 'const alpha = 1;')]), siblings);
+    expect(ambiguous.stats.unroutableEntries).toBe(1);
+    expect(ambiguous.reviews.size).toBe(0);
+
+    // A duplicate entry is discarded, never re-homed onto a sibling.
+    const duplicated = parseBatchReviewResponse(
+      raw([entry('src/a/index.ts', 'const alpha = 1;'), entry('src/a/index.ts', 'const alpha = 1;', 'Duplicate')]),
+      siblings,
+    );
+    expect(duplicated.stats.unroutableEntries).toBe(1);
+    expect(duplicated.reviews.get('src/a/index.ts')!.comments).toHaveLength(1);
+    expect(duplicated.missing).toEqual(['src/b/index.ts']);
+  });
+
+  // What per-file indexes miss: a misfiled finding whose quote exists in the wrong file too.
+  it('withholds only when a shared quote AND a path disagreement coincide', () => {
+    const shared = '} catch (error) {';
+    const files = [file('src/a.ts', [shared, 'const uniqueToAlpha = 1;']), file('src/b.ts', [shared, 'const bravo = 2;'])];
+    const misfiled = (evidence: string, claimedPath: string) => raw([{
+      absolute_file_path: 'src/a.ts',
+      findings: [{
+        evidence,
+        code_location: { absolute_file_path: claimedPath, line: 1 },
+        claim_type: 'other',
+        title: 'Swallowed error',
+        body: 'The catch block hides the failure.',
+        priority: 1,
+      }],
+      overall_explanation: 'Summary',
+      overall_correctness: 'patch is incorrect',
+    }]);
+
+    const withheld = parseBatchReviewResponse(misfiled(shared, 'src/b.ts'), files);
+    expect(withheld.stats.ambiguousAcrossBin).toBe(1);
+    expect(withheld.reviews.get('src/a.ts')!.comments).toHaveLength(0);
+
+    // Shared quote, agreeing path: ordinary, keep it.
+    const agreeing = parseBatchReviewResponse(raw([entry('src/a.ts', shared, 'Swallowed error')]), files);
+    expect(agreeing.stats.ambiguousAcrossBin).toBe(0);
+    expect(agreeing.reviews.get('src/a.ts')!.comments).toHaveLength(1);
+
+    // Unique quote, disagreeing path: the enclosing entry wins, which is the point of nesting.
+    const mismatch = parseBatchReviewResponse(misfiled('const uniqueToAlpha = 1;', 'src/b.ts'), files);
+    expect(mismatch.stats.pathMismatchFindings).toBe(1);
+    expect(mismatch.reviews.get('src/a.ts')!.comments[0].path).toBe('src/a.ts');
+  });
+
+  // Per file, not a shared pool: a shared ceiling lets one noisy file keep everything while
+  // its bin-mates are trimmed to nothing.
+  it('trims over-cap findings per file and accounts for the drop', () => {
+    const lines = Array.from({ length: 30 }, (_, i) => `const value${i} = ${i};`);
+    const files = [file('src/a.ts', lines), file('src/b.ts', ['const bravo = 2;'])];
+
+    const noisy = {
+      absolute_file_path: 'src/a.ts',
+      findings: lines.map((line, i) => ({
+        evidence: line,
+        code_location: { absolute_file_path: 'src/a.ts', line: i + 1 },
+        claim_type: 'other',
+        title: `Problem number ${i}`,
+        body: 'A concrete problem with a concrete impact.',
+        priority: 2,
+      })),
+      overall_explanation: 'Many problems',
+      overall_correctness: 'patch is incorrect',
+    };
+
+    const result = parseBatchReviewResponse(
+      raw([noisy, entry('src/b.ts', 'const bravo = 2;', 'Bravo is off by one')]),
+      files,
+      { maxCommentsPerFile: 5 },
+    );
+
+    // generatorFindingCap(5) = 10.
+    expect(result.reviews.get('src/a.ts')!.comments).toHaveLength(10);
+    expect(result.stats.overCap).toBe(20);
+    expect(result.reviews.get('src/a.ts')!.fileSummary).toContain('over-cap');
+    // The quiet file keeps everything -- it never competed for a shared budget.
+    expect(result.reviews.get('src/b.ts')!.comments).toHaveLength(1);
+  });
+
+  // Assembly can reject one finding; under batching an uncontained throw would discard
+  // every other file packed alongside it.
+  it('drops an unassemblable finding without losing the rest of the bin', () => {
+    const files = [file('src/a.ts', ['const alpha = 1;']), file('src/b.ts', ['const bravo = 2;'])];
+
+    const result = parseBatchReviewResponse(raw([
+      {
+        absolute_file_path: 'src/a.ts',
+        findings: [{
+          evidence: 'const alpha = 1;',
+          code_location: { absolute_file_path: 'src/a.ts', line: 1 },
+          claim_type: 'other',
+          // Title is a prefix of the body, so the body is stripped to nothing downstream.
+          title: 'Leak',
+          body: 'Leak',
+          priority: 2,
+        }],
+        overall_explanation: 'Summary',
+        overall_correctness: 'patch is incorrect',
+      },
+      entry('src/b.ts', 'const bravo = 2;', 'Bravo is off by one'),
+    ]), files);
+
+    expect(result.reviews.get('src/a.ts')!.comments).toHaveLength(0);
+    expect(result.reviews.get('src/a.ts')!.fileSummary).toContain('unassemblable');
+    expect(result.reviews.get('src/b.ts')!.comments).toHaveLength(1);
+  });
+
+});
diff --git a/test/model/catalog-nvidia.spec.ts b/packages/models/test/model/catalog-nvidia.spec.ts
similarity index 95%
rename from test/model/catalog-nvidia.spec.ts
rename to packages/models/test/model/catalog-nvidia.spec.ts
index 5e564d15..57c6c947 100644
--- a/test/model/catalog-nvidia.spec.ts
+++ b/packages/models/test/model/catalog-nvidia.spec.ts
@@ -1,91 +1,91 @@
-import { describe, it, expect, vi, afterEach } from 'vitest';
-import { listProviderModels } from '@server/models/catalog';
-
-// NVIDIA Build serves chat NIMs and non-chat NIMs (embedding, reranking, speech, OCR) from the same
-// OpenAI-compatible /models endpoint. Without a filter, provider sync writes the non-chat ones into
-// model_configs and they show up in every model picker as if they could review a diff.
-
-const MIXED_MODEL_LIST = {
-  data: [
-    { id: 'meta/llama-3.3-70b-instruct' },
-    { id: 'deepseek-ai/deepseek-r1' },
-    { id: 'qwen/qwen2.5-coder-32b-instruct' },
-    { id: 'nvidia/llama-3.2-nv-embedqa-1b-v2' },
-    { id: 'nvidia/nv-rerankqa-mistral-4b-v3' },
-    { id: 'nvidia/nv-embed-v1' },
-    { id: 'nvidia/nemoretriever-parse' },
-    { id: 'baidu/paddleocr' },
-    { id: 'nvidia/parakeet-ctc-0.6b-asr' },
-    { id: 'nvidia/magpie-tts-multilingual' },
-  ],
-};
-
-const CHAT_IDS = [
-  'meta/llama-3.3-70b-instruct',
-  'deepseek-ai/deepseek-r1',
-  'qwen/qwen2.5-coder-32b-instruct',
-];
-
-function stubModelList(payload: unknown) {
-  const fetchMock = vi.fn().mockResolvedValue(
-    new Response(JSON.stringify(payload), { status: 200, headers: { 'content-type': 'application/json' } }),
-  );
-  vi.stubGlobal('fetch', fetchMock);
-  return fetchMock;
-}
-
-afterEach(() => {
-  vi.unstubAllGlobals();
-});
-
-describe('listProviderModels NVIDIA Build filtering', () => {
-  it('drops embedding, reranking, retrieval, OCR, and speech NIMs from the NVIDIA catalog', async () => {
-    stubModelList(MIXED_MODEL_LIST);
-
-    const models = await listProviderModels({
-      apiFormat: 'openai',
-      baseUrl: 'https://integrate.api.nvidia.com/v1',
-      apiKey: 'nvapi-test',
-    });
-
-    expect(models).toEqual(CHAT_IDS);
-  });
-
-  it('requests the standard OpenAI-compatible /models endpoint with a bearer key', async () => {
-    const fetchMock = stubModelList(MIXED_MODEL_LIST);
-
-    await listProviderModels({
-      apiFormat: 'openai',
-      baseUrl: 'https://integrate.api.nvidia.com/v1/',
-      apiKey: 'nvapi-test',
-    });
-
-    const [url, init] = fetchMock.mock.calls[0];
-    expect(url).toBe('https://integrate.api.nvidia.com/v1/models');
-    expect((init as RequestInit).headers).toMatchObject({ authorization: 'Bearer nvapi-test' });
-  });
-
-  it('leaves an identical list untouched for other OpenAI-format providers', async () => {
-    stubModelList(MIXED_MODEL_LIST);
-
-    const models = await listProviderModels({
-      apiFormat: 'openai',
-      baseUrl: 'https://openrouter.ai/api/v1',
-      apiKey: 'sk-test',
-    });
-
-    expect(models).toEqual(MIXED_MODEL_LIST.data.map((entry) => entry.id));
-  });
-
-  it('does not filter a self-hosted provider whose host merely resembles NVIDIA Build', async () => {
-    stubModelList({ data: [{ id: 'nv-embed-v1' }, { id: 'meta/llama-3.3-70b-instruct' }] });
-
-    const models = await listProviderModels({
-      apiFormat: 'openai',
-      baseUrl: 'https://api.nvidia.example.com/v1',
-      apiKey: 'sk-test',
-    });
-
-    expect(models).toEqual(['nv-embed-v1', 'meta/llama-3.3-70b-instruct']);
-  });
-});
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { listProviderModels } from '../../src/catalog';
+
+// NVIDIA Build serves chat NIMs and non-chat NIMs (embedding, reranking, speech, OCR) from the same
+// OpenAI-compatible /models endpoint. Without a filter, provider sync writes the non-chat ones into
+// model_configs and they show up in every model picker as if they could review a diff.
+
+const MIXED_MODEL_LIST = {
+  data: [
+    { id: 'meta/llama-3.3-70b-instruct' },
+    { id: 'deepseek-ai/deepseek-r1' },
+    { id: 'qwen/qwen2.5-coder-32b-instruct' },
+    { id: 'nvidia/llama-3.2-nv-embedqa-1b-v2' },
+    { id: 'nvidia/nv-rerankqa-mistral-4b-v3' },
+    { id: 'nvidia/nv-embed-v1' },
+    { id: 'nvidia/nemoretriever-parse' },
+    { id: 'baidu/paddleocr' },
+    { id: 'nvidia/parakeet-ctc-0.6b-asr' },
+    { id: 'nvidia/magpie-tts-multilingual' },
+  ],
+};
+
+const CHAT_IDS = [
+  'meta/llama-3.3-70b-instruct',
+  'deepseek-ai/deepseek-r1',
+  'qwen/qwen2.5-coder-32b-instruct',
+];
+
+function stubModelList(payload: unknown) {
+  const fetchMock = vi.fn().mockResolvedValue(
+    new Response(JSON.stringify(payload), { status: 200, headers: { 'content-type': 'application/json' } }),
+  );
+  vi.stubGlobal('fetch', fetchMock);
+  return fetchMock;
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe('listProviderModels NVIDIA Build filtering', () => {
+  it('drops embedding, reranking, retrieval, OCR, and speech NIMs from the NVIDIA catalog', async () => {
+    stubModelList(MIXED_MODEL_LIST);
+
+    const models = await listProviderModels({
+      apiFormat: 'openai',
+      baseUrl: 'https://integrate.api.nvidia.com/v1',
+      apiKey: 'nvapi-test',
+    });
+
+    expect(models).toEqual(CHAT_IDS);
+  });
+
+  it('requests the standard OpenAI-compatible /models endpoint with a bearer key', async () => {
+    const fetchMock = stubModelList(MIXED_MODEL_LIST);
+
+    await listProviderModels({
+      apiFormat: 'openai',
+      baseUrl: 'https://integrate.api.nvidia.com/v1/',
+      apiKey: 'nvapi-test',
+    });
+
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(url).toBe('https://integrate.api.nvidia.com/v1/models');
+    expect((init as RequestInit).headers).toMatchObject({ authorization: 'Bearer nvapi-test' });
+  });
+
+  it('leaves an identical list untouched for other OpenAI-format providers', async () => {
+    stubModelList(MIXED_MODEL_LIST);
+
+    const models = await listProviderModels({
+      apiFormat: 'openai',
+      baseUrl: 'https://openrouter.ai/api/v1',
+      apiKey: 'sk-test',
+    });
+
+    expect(models).toEqual(MIXED_MODEL_LIST.data.map((entry) => entry.id));
+  });
+
+  it('does not filter a self-hosted provider whose host merely resembles NVIDIA Build', async () => {
+    stubModelList({ data: [{ id: 'nv-embed-v1' }, { id: 'meta/llama-3.3-70b-instruct' }] });
+
+    const models = await listProviderModels({
+      apiFormat: 'openai',
+      baseUrl: 'https://api.nvidia.example.com/v1',
+      apiKey: 'sk-test',
+    });
+
+    expect(models).toEqual(['nv-embed-v1', 'meta/llama-3.3-70b-instruct']);
+  });
+});
diff --git a/test/model/chain-progress-store.spec.ts b/packages/models/test/model/chain-progress-store.spec.ts
similarity index 97%
rename from test/model/chain-progress-store.spec.ts
rename to packages/models/test/model/chain-progress-store.spec.ts
index ac0292a2..bf2a88e3 100644
--- a/test/model/chain-progress-store.spec.ts
+++ b/packages/models/test/model/chain-progress-store.spec.ts
@@ -1,300 +1,300 @@
-import { describe, expect, it } from 'vitest';
-import { ModelChainProgressStore } from '@server/services/model';
-
-// KV double tracks overlapping puts (KV lacks ordering; late puts with less state can revert progress).
-function makeKV() {
-  let value: string | null = null;
-  let inFlight = 0;
-  let maxInFlight = 0;
-  const writes: string[] = [];
-
-  return {
-    kv: {
-      async get(_key: string, type?: string) {
-        if (value === null) return null;
-        return type === 'json' ? JSON.parse(value) : value;
-      },
-      async put(_key: string, body: string) {
-        inFlight += 1;
-        maxInFlight = Math.max(maxInFlight, inFlight);
-        writes.push(body);
-        // Two ticks ensure overlapping puts genuinely overlap.
-        await Promise.resolve();
-        await Promise.resolve();
-        value = body;
-        inFlight -= 1;
-      },
-    },
-    get maxInFlight() {
-      return maxInFlight;
-    },
-    get stored() {
-      return value === null ? null : JSON.parse(value) as {
-        files?: Record<string, number>;
-        timeouts?: Record<string, number>;
-        cooldowns?: Record<string, { until?: number; limitTokens?: number }>;
-      };
-    },
-    writes,
-  };
-}
-
-describe('ModelChainProgressStore', () => {
-  it('keeps both entries when two files defer concurrently', async () => {
-    const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-race');
-
-    await Promise.all([store.advance('src/a.ts', 2), store.advance('src/b.ts', 3)]);
-
-    // Order irrelevance: non-overlapping puts ensure the last one is the most complete.
-    expect(kv.maxInFlight).toBe(1);
-    expect(kv.stored?.files).toEqual({ 'src/a.ts': 2, 'src/b.ts': 3 });
-    expect(await store.startIndexFor('src/a.ts')).toBe(2);
-    expect(await store.startIndexFor('src/b.ts')).toBe(3);
-  });
-
-  it('coalesces a burst of deferrals instead of writing once per file', async () => {
-    const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-burst');
-
-    await Promise.all([1, 2, 3, 4, 5, 6].map((n) => store.advance(`src/f${n}.ts`, n)));
-
-    expect(kv.maxInFlight).toBe(1);
-    // Six advances but fewer writes; conserves subrequests.
-    expect(kv.writes.length).toBeLessThan(6);
-    expect(Object.keys(kv.stored?.files ?? {})).toHaveLength(6);
-  });
-
-  it('merges with progress another invocation stored, rather than overwriting it', async () => {
-    const kv = makeKV();
-    // Written by a concurrent, unloaded invocation.
-    await kv.kv.put('k', JSON.stringify({ 'src/other.ts': 4 }));
-
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge');
-    await store.advance('src/mine.ts', 1);
-
-    expect(kv.stored?.files).toEqual({ 'src/other.ts': 4, 'src/mine.ts': 1 });
-  });
-
-  it('never walks an index backwards', async () => {
-    const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-monotonic');
-
-    await store.advance('src/a.ts', 3);
-    // Later, shorter deferral must not resurrect ruled-out models.
-    await store.advance('src/a.ts', 1);
-
-    expect(kv.stored?.files).toEqual({ 'src/a.ts': 3 });
-    expect(await store.startIndexFor('src/a.ts')).toBe(3);
-  });
-
-  // Persisted tally lets the next concurrent wave avoid models the first wave timed out on.
-  it('drops a model after a full wave of timeouts, and remembers across invocations', async () => {
-    const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-slow');
-
-    expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(false);
-    await store.noteTimeout('vertex-ai:gemini-2.5-pro');
-    await store.noteTimeout('vertex-ai:gemini-2.5-pro');
-    // Judged on a round, not a single slow call.
-    expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(false);
-    await store.noteTimeout('vertex-ai:gemini-2.5-pro');
-    expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
-
-    // Fresh store mimics next invocation.
-    const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-slow');
-    expect(await next.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
-    // Scoped to the failing model.
-    expect(await next.isTimingOut('vertex-ai:gemini-2.5-flash')).toBe(false);
-  });
-
-  // Tail candidates use a higher strike threshold rather than exemption, to prevent infinite looping.
-  it('holds the last candidate to a higher strike count before dropping it too', async () => {
-    const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-tail');
-
-    for (let i = 0; i < 3; i += 1) await store.noteTimeout('cf:glm-4.7-flash');
-    // Drops mid-chain, but preserves the tail.
-    expect(await store.isTimingOut('cf:glm-4.7-flash')).toBe(true);
-    expect(await store.isTimingOutTerminally('cf:glm-4.7-flash')).toBe(false);
-
-    for (let i = 0; i < 3; i += 1) await store.noteTimeout('cf:glm-4.7-flash');
-    expect(await store.isTimingOutTerminally('cf:glm-4.7-flash')).toBe(true);
-
-    // Durable across invocations.
-    const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-tail');
-    expect(await next.isTimingOutTerminally('cf:glm-4.7-flash')).toBe(true);
-  });
-
-  describe('noteSuccess', () => {
-    // Resets prevent cumulative tallies from condemning a model for the job's entire 24h life.
-    it('restarts the tally, so a slow patch cannot condemn a working model', async () => {
-      const kv = makeKV();
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-recovered');
-
-      for (let i = 0; i < 3; i += 1) await store.noteTimeout('vertex-ai:gemini-2.5-pro');
-      expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
-
-      await store.noteSuccess('vertex-ai:gemini-2.5-pro');
-      expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(false);
-    });
-
-    // writeOnce's max() merge must not resurrect pre-success counts from KV.
-    it('survives the merge against what another invocation stored', async () => {
-      const kv = makeKV();
-      await kv.kv.put('k', JSON.stringify({ timeouts: { 'vertex-ai:gemini-2.5-pro': 5 } }));
-
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge-success');
-      await store.noteSuccess('vertex-ai:gemini-2.5-pro');
-
-      expect(kv.stored?.timeouts?.['vertex-ai:gemini-2.5-pro']).toBeUndefined();
-      const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge-success');
-      expect(await next.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(false);
-    });
-
-    it('writes nothing for a model with a clean record', async () => {
-      const kv = makeKV();
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-clean');
-
-      await store.noteSuccess('vertex-ai:gemini-2.5-pro');
-
-      // Healthy paths don't incur KV writes to save subrequests.
-      expect(kv.writes).toHaveLength(0);
-    });
-  });
-
-  it('keeps chain progress and timeouts in one value without either clobbering the other', async () => {
-    const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-both');
-
-    await Promise.all([store.advance('src/a.ts', 2), store.noteTimeout('vertex-ai:gemini-2.5-pro')]);
-
-    const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-both');
-    expect(await next.startIndexFor('src/a.ts')).toBe(2);
-    await next.noteTimeout('vertex-ai:gemini-2.5-pro');
-    await next.noteTimeout('vertex-ai:gemini-2.5-pro');
-    expect(await next.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
-  });
-
-  // Supports legacy in-flight bare label->index maps.
-  it('reads the pre-timeouts stored shape without losing resume progress', async () => {
-    const kv = makeKV();
-    await kv.kv.put('k', JSON.stringify({ 'src/legacy.ts': 3 }));
-
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-legacy');
-
-    expect(await store.startIndexFor('src/legacy.ts')).toBe(3);
-    expect(await store.isTimingOut('anything')).toBe(false);
-  });
-
-  // Persisted rate-limits prevent continuation jobs from re-paying for known cool-offs.
-  describe('rate-limit cool-offs', () => {
-    it('carries a learned cool-off and bucket size to the next invocation', async () => {
-      const kv = makeKV();
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-cooldown');
-      const until = Date.now() + 30_000;
-
-      store.noteRateLimit('google:gemini-2.5-flash', { cooldownUntil: until, limitTokens: 16000 });
-      await store.flushPending();
-
-      const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-cooldown');
-      const loaded = await next.loadCooldowns();
-      expect(loaded.get('google:gemini-2.5-flash')).toEqual({ cooldownUntil: until, limitTokens: 16000 });
-      // Cool-offs scope per-model bucket.
-      expect(loaded.has('google:gemini-2.5-flash-lite')).toBe(false);
-    });
-
-    it('does not write on note alone, so a 429 adds no subrequests on a path that had none', async () => {
-      const kv = makeKV();
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-lazy');
-
-      store.noteRateLimit('google:gemini-2.5-flash', { cooldownUntil: Date.now() + 30_000 });
-      expect(kv.writes).toHaveLength(0);
-
-      // Made durable by the subsequent deferral.
-      await store.flushPending();
-      expect(kv.writes.length).toBeGreaterThan(0);
-    });
-
-    it('takes the later deadline when two invocations both learned one', async () => {
-      const kv = makeKV();
-      const earlier = Date.now() + 10_000;
-      const later = Date.now() + 90_000;
-      await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until: later, limitTokens: 16000 } } }));
-
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge-cooldown');
-      // Later 429s omitting limitTokens must not erase known buckets.
-      store.noteRateLimit('google:m', { cooldownUntil: earlier });
-      await store.flushPending();
-
-      expect(kv.stored?.cooldowns?.['google:m']).toEqual({ until: later, limitTokens: 16000 });
-    });
-
-    // Protects against sticky, misparsed request counts crippling the model for 24h.
-    it('discards a stored bucket too small to be a token quota', async () => {
-      const kv = makeKV();
-      const until = Date.now() + 30_000;
-      await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until, limitTokens: 15 } } }));
-
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-poisoned-bucket');
-
-      const entry = (await store.loadCooldowns()).get('google:m');
-      // Retains valid cool-off while discarding nonsense bucket size.
-      expect(entry?.cooldownUntil).toBe(until);
-      expect(entry?.limitTokens).toBeUndefined();
-    });
-
-    it('clamps an implausible cool-off rather than disabling a model for the whole job', async () => {
-      const kv = makeKV();
-      // Prevents misparsed delays from disabling models indefinitely.
-      await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until: Date.now() + 3_600_000 } } }));
-
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-clamp');
-
-      const entry = (await store.loadCooldowns()).get('google:m');
-      expect(entry!.cooldownUntil).toBeLessThanOrEqual(Date.now() + 5 * 60 * 1000);
-    });
-
-    // Bucket sizes outlive cool-offs to answer "can this prompt fit?".
-    it('keeps an expired entry so its bucket size survives', async () => {
-      const kv = makeKV();
-      await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until: Date.now() - 60_000, limitTokens: 16000 } } }));
-
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-expired');
-
-      expect((await store.loadCooldowns()).get('google:m')?.limitTokens).toBe(16000);
-    });
-
-    it('reads a blob written before cooldowns existed without losing resume progress', async () => {
-      const kv = makeKV();
-      await kv.kv.put('k', JSON.stringify({ files: { 'src/a.ts': 2 }, timeouts: { 'google:m': 1 } }));
-
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-old-shape');
-
-      expect(await store.startIndexFor('src/a.ts')).toBe(2);
-      expect((await store.loadCooldowns()).size).toBe(0);
-    });
-
-    it('keeps a cool-off noted before the KV read resolved', async () => {
-      const kv = makeKV();
-      await kv.kv.put('k', JSON.stringify({ files: { 'src/a.ts': 2 } }));
-
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-early-note');
-      // Sync noteRateLimit can land before load(); must merge, not replace.
-      store.noteRateLimit('google:m', { cooldownUntil: Date.now() + 30_000, limitTokens: 16000 });
-
-      expect((await store.loadCooldowns()).get('google:m')?.limitTokens).toBe(16000);
-      expect(await store.startIndexFor('src/a.ts')).toBe(2);
-    });
-  });
-
-  it('does nothing at all without a jobId', async () => {
-    const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, undefined);
-
-    await store.advance('src/a.ts', 2);
-
-    expect(kv.writes).toHaveLength(0);
-    expect(await store.startIndexFor('src/a.ts')).toBe(0);
-  });
-});
+import { describe, expect, it } from 'vitest';
+import { ModelChainProgressStore } from '@codra/models';
+
+// KV double tracks overlapping puts (KV lacks ordering; late puts with less state can revert progress).
+function makeKV() {
+  let value: string | null = null;
+  let inFlight = 0;
+  let maxInFlight = 0;
+  const writes: string[] = [];
+
+  return {
+    kv: {
+      async get(_key: string, type?: string) {
+        if (value === null) return null;
+        return type === 'json' ? JSON.parse(value) : value;
+      },
+      async put(_key: string, body: string) {
+        inFlight += 1;
+        maxInFlight = Math.max(maxInFlight, inFlight);
+        writes.push(body);
+        // Two ticks ensure overlapping puts genuinely overlap.
+        await Promise.resolve();
+        await Promise.resolve();
+        value = body;
+        inFlight -= 1;
+      },
+    },
+    get maxInFlight() {
+      return maxInFlight;
+    },
+    get stored() {
+      return value === null ? null : JSON.parse(value) as {
+        files?: Record<string, number>;
+        timeouts?: Record<string, number>;
+        cooldowns?: Record<string, { until?: number; limitTokens?: number }>;
+      };
+    },
+    writes,
+  };
+}
+
+describe('ModelChainProgressStore', () => {
+  it('keeps both entries when two files defer concurrently', async () => {
+    const kv = makeKV();
+    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-race');
+
+    await Promise.all([store.advance('src/a.ts', 2), store.advance('src/b.ts', 3)]);
+
+    // Order irrelevance: non-overlapping puts ensure the last one is the most complete.
+    expect(kv.maxInFlight).toBe(1);
+    expect(kv.stored?.files).toEqual({ 'src/a.ts': 2, 'src/b.ts': 3 });
+    expect(await store.startIndexFor('src/a.ts')).toBe(2);
+    expect(await store.startIndexFor('src/b.ts')).toBe(3);
+  });
+
+  it('coalesces a burst of deferrals instead of writing once per file', async () => {
+    const kv = makeKV();
+    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-burst');
+
+    await Promise.all([1, 2, 3, 4, 5, 6].map((n) => store.advance(`src/f${n}.ts`, n)));
+
+    expect(kv.maxInFlight).toBe(1);
+    // Six advances but fewer writes; conserves subrequests.
+    expect(kv.writes.length).toBeLessThan(6);
+    expect(Object.keys(kv.stored?.files ?? {})).toHaveLength(6);
+  });
+
+  it('merges with progress another invocation stored, rather than overwriting it', async () => {
+    const kv = makeKV();
+    // Written by a concurrent, unloaded invocation.
+    await kv.kv.put('k', JSON.stringify({ 'src/other.ts': 4 }));
+
+    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge');
+    await store.advance('src/mine.ts', 1);
+
+    expect(kv.stored?.files).toEqual({ 'src/other.ts': 4, 'src/mine.ts': 1 });
+  });
+
+  it('never walks an index backwards', async () => {
+    const kv = makeKV();
+    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-monotonic');
+
+    await store.advance('src/a.ts', 3);
+    // Later, shorter deferral must not resurrect ruled-out models.
+    await store.advance('src/a.ts', 1);
+
+    expect(kv.stored?.files).toEqual({ 'src/a.ts': 3 });
+    expect(await store.startIndexFor('src/a.ts')).toBe(3);
+  });
+
+  // Persisted tally lets the next concurrent wave avoid models the first wave timed out on.
+  it('drops a model after a full wave of timeouts, and remembers across invocations', async () => {
+    const kv = makeKV();
+    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-slow');
+
+    expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(false);
+    await store.noteTimeout('vertex-ai:gemini-2.5-pro');
+    await store.noteTimeout('vertex-ai:gemini-2.5-pro');
+    // Judged on a round, not a single slow call.
+    expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(false);
+    await store.noteTimeout('vertex-ai:gemini-2.5-pro');
+    expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
+
+    // Fresh store mimics next invocation.
+    const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-slow');
+    expect(await next.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
+    // Scoped to the failing model.
+    expect(await next.isTimingOut('vertex-ai:gemini-2.5-flash')).toBe(false);
+  });
+
+  // Tail candidates use a higher strike threshold rather than exemption, to prevent infinite looping.
+  it('holds the last candidate to a higher strike count before dropping it too', async () => {
+    const kv = makeKV();
+    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-tail');
+
+    for (let i = 0; i < 3; i += 1) await store.noteTimeout('cf:glm-4.7-flash');
+    // Drops mid-chain, but preserves the tail.
+    expect(await store.isTimingOut('cf:glm-4.7-flash')).toBe(true);
+    expect(await store.isTimingOutTerminally('cf:glm-4.7-flash')).toBe(false);
+
+    for (let i = 0; i < 3; i += 1) await store.noteTimeout('cf:glm-4.7-flash');
+    expect(await store.isTimingOutTerminally('cf:glm-4.7-flash')).toBe(true);
+
+    // Durable across invocations.
+    const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-tail');
+    expect(await next.isTimingOutTerminally('cf:glm-4.7-flash')).toBe(true);
+  });
+
+  describe('noteSuccess', () => {
+    // Resets prevent cumulative tallies from condemning a model for the job's entire 24h life.
+    it('restarts the tally, so a slow patch cannot condemn a working model', async () => {
+      const kv = makeKV();
+      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-recovered');
+
+      for (let i = 0; i < 3; i += 1) await store.noteTimeout('vertex-ai:gemini-2.5-pro');
+      expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
+
+      await store.noteSuccess('vertex-ai:gemini-2.5-pro');
+      expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(false);
+    });
+
+    // writeOnce's max() merge must not resurrect pre-success counts from KV.
+    it('survives the merge against what another invocation stored', async () => {
+      const kv = makeKV();
+      await kv.kv.put('k', JSON.stringify({ timeouts: { 'vertex-ai:gemini-2.5-pro': 5 } }));
+
+      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge-success');
+      await store.noteSuccess('vertex-ai:gemini-2.5-pro');
+
+      expect(kv.stored?.timeouts?.['vertex-ai:gemini-2.5-pro']).toBeUndefined();
+      const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge-success');
+      expect(await next.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(false);
+    });
+
+    it('writes nothing for a model with a clean record', async () => {
+      const kv = makeKV();
+      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-clean');
+
+      await store.noteSuccess('vertex-ai:gemini-2.5-pro');
+
+      // Healthy paths don't incur KV writes to save subrequests.
+      expect(kv.writes).toHaveLength(0);
+    });
+  });
+
+  it('keeps chain progress and timeouts in one value without either clobbering the other', async () => {
+    const kv = makeKV();
+    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-both');
+
+    await Promise.all([store.advance('src/a.ts', 2), store.noteTimeout('vertex-ai:gemini-2.5-pro')]);
+
+    const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-both');
+    expect(await next.startIndexFor('src/a.ts')).toBe(2);
+    await next.noteTimeout('vertex-ai:gemini-2.5-pro');
+    await next.noteTimeout('vertex-ai:gemini-2.5-pro');
+    expect(await next.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
+  });
+
+  // Supports legacy in-flight bare label->index maps.
+  it('reads the pre-timeouts stored shape without losing resume progress', async () => {
+    const kv = makeKV();
+    await kv.kv.put('k', JSON.stringify({ 'src/legacy.ts': 3 }));
+
+    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-legacy');
+
+    expect(await store.startIndexFor('src/legacy.ts')).toBe(3);
+    expect(await store.isTimingOut('anything')).toBe(false);
+  });
+
+  // Persisted rate-limits prevent continuation jobs from re-paying for known cool-offs.
+  describe('rate-limit cool-offs', () => {
+    it('carries a learned cool-off and bucket size to the next invocation', async () => {
+      const kv = makeKV();
+      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-cooldown');
+      const until = Date.now() + 30_000;
+
+      store.noteRateLimit('google:gemini-2.5-flash', { cooldownUntil: until, limitTokens: 16000 });
+      await store.flushPending();
+
+      const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-cooldown');
+      const loaded = await next.loadCooldowns();
+      expect(loaded.get('google:gemini-2.5-flash')).toEqual({ cooldownUntil: until, limitTokens: 16000 });
+      // Cool-offs scope per-model bucket.
+      expect(loaded.has('google:gemini-2.5-flash-lite')).toBe(false);
+    });
+
+    it('does not write on note alone, so a 429 adds no subrequests on a path that had none', async () => {
+      const kv = makeKV();
+      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-lazy');
+
+      store.noteRateLimit('google:gemini-2.5-flash', { cooldownUntil: Date.now() + 30_000 });
+      expect(kv.writes).toHaveLength(0);
+
+      // Made durable by the subsequent deferral.
+      await store.flushPending();
+      expect(kv.writes.length).toBeGreaterThan(0);
+    });
+
+    it('takes the later deadline when two invocations both learned one', async () => {
+      const kv = makeKV();
+      const earlier = Date.now() + 10_000;
+      const later = Date.now() + 90_000;
+      await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until: later, limitTokens: 16000 } } }));
+
+      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge-cooldown');
+      // Later 429s omitting limitTokens must not erase known buckets.
+      store.noteRateLimit('google:m', { cooldownUntil: earlier });
+      await store.flushPending();
+
+      expect(kv.stored?.cooldowns?.['google:m']).toEqual({ until: later, limitTokens: 16000 });
+    });
+
+    // Protects against sticky, misparsed request counts crippling the model for 24h.
+    it('discards a stored bucket too small to be a token quota', async () => {
+      const kv = makeKV();
+      const until = Date.now() + 30_000;
+      await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until, limitTokens: 15 } } }));
+
+      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-poisoned-bucket');
+
+      const entry = (await store.loadCooldowns()).get('google:m');
+      // Retains valid cool-off while discarding nonsense bucket size.
+      expect(entry?.cooldownUntil).toBe(until);
+      expect(entry?.limitTokens).toBeUndefined();
+    });
+
+    it('clamps an implausible cool-off rather than disabling a model for the whole job', async () => {
+      const kv = makeKV();
+      // Prevents misparsed delays from disabling models indefinitely.
+      await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until: Date.now() + 3_600_000 } } }));
+
+      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-clamp');
+
+      const entry = (await store.loadCooldowns()).get('google:m');
+      expect(entry!.cooldownUntil).toBeLessThanOrEqual(Date.now() + 5 * 60 * 1000);
+    });
+
+    // Bucket sizes outlive cool-offs to answer "can this prompt fit?".
+    it('keeps an expired entry so its bucket size survives', async () => {
+      const kv = makeKV();
+      await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until: Date.now() - 60_000, limitTokens: 16000 } } }));
+
+      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-expired');
+
+      expect((await store.loadCooldowns()).get('google:m')?.limitTokens).toBe(16000);
+    });
+
+    it('reads a blob written before cooldowns existed without losing resume progress', async () => {
+      const kv = makeKV();
+      await kv.kv.put('k', JSON.stringify({ files: { 'src/a.ts': 2 }, timeouts: { 'google:m': 1 } }));
+
+      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-old-shape');
+
+      expect(await store.startIndexFor('src/a.ts')).toBe(2);
+      expect((await store.loadCooldowns()).size).toBe(0);
+    });
+
+    it('keeps a cool-off noted before the KV read resolved', async () => {
+      const kv = makeKV();
+      await kv.kv.put('k', JSON.stringify({ files: { 'src/a.ts': 2 } }));
+
+      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-early-note');
+      // Sync noteRateLimit can land before load(); must merge, not replace.
+      store.noteRateLimit('google:m', { cooldownUntil: Date.now() + 30_000, limitTokens: 16000 });
+
+      expect((await store.loadCooldowns()).get('google:m')?.limitTokens).toBe(16000);
+      expect(await store.startIndexFor('src/a.ts')).toBe(2);
+    });
+  });
+
+  it('does nothing at all without a jobId', async () => {
+    const kv = makeKV();
+    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, undefined);
+
+    await store.advance('src/a.ts', 2);
+
+    expect(kv.writes).toHaveLength(0);
+    expect(await store.startIndexFor('src/a.ts')).toBe(0);
+  });
+});
diff --git a/test/model/chain-resume.spec.ts b/packages/models/test/model/chain-resume.spec.ts
similarity index 88%
rename from test/model/chain-resume.spec.ts
rename to packages/models/test/model/chain-resume.spec.ts
index e7981afe..8a7697a1 100644
--- a/test/model/chain-resume.spec.ts
+++ b/packages/models/test/model/chain-resume.spec.ts
@@ -1,125 +1,125 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { ModelService, nextChainIndexOf } from '@server/services/model';
-import { defaultRepoConfig } from '@codra/schema';
-import { TokenTracker } from '@server/core/token-tracker';
-import { createTestEnv, saveTestProviderApiKey } from '../helpers';
-
-// One invocation only affords ~55s of model calls, so a chain whose head is slow never reaches its
-// tail. These pin that a deferral records where it got to and the next attempt resumes there --
-// without which entries past the first two are unreachable no matter how often a job retries.
-describe('model chain resume', () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  const file = {
-    path: 'src/app.ts',
-    lineCount: 1,
-    hunks: [],
-    isDeleted: false,
-    isBinary: false,
-    isNew: false,
-    previousPath: null,
-  };
-
-  const chainConfig = {
-    ...defaultRepoConfig,
-    model: {
-      main: 'gemini-3.1-pro-preview',
-      // Three entries, all configured in the test env: the memo only records progress while the
-      // chain still has somewhere to go, so a two-entry chain would never write one.
-      fallbacks: ['gemini-2.5-pro', 'gemini-3.1-flash-lite'],
-      size_overrides: [],
-    },
-  };
-
-  const gemini = (status: number, body: unknown) =>
-    new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
-
-  const ok = () => gemini(200, {
-    candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
-    usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-  });
-  // 503, not 500: a transient failure is what produces a deferral rather than a hard failure.
-  const unavailable = () => gemini(503, { error: { code: 503, message: 'The model is overloaded.', status: 'UNAVAILABLE' } });
-  const rateLimited = () => gemini(429, { error: { code: 429, message: 'Resource exhausted. limit: 16000, model: gemini. Please retry in 30s.', status: 'RESOURCE_EXHAUSTED' } });
-
-  async function review(service: ModelService) {
-    return service.reviewFile({
-      file,
-      prTitle: 'Test',
-      prDescription: null,
-      config: chainConfig,
-      totalLineCount: 1,
-      // Every model gets one shot, so the deferral arrives without a long inline retry ladder.
-    } as Parameters<ModelService['reviewFile']>[0]);
-  }
-
-  it('resumes at the model after the ones that already failed, instead of replaying them', async () => {
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    // Same jobId across both services: the memo is job-scoped KV, exactly as across invocations.
-    // Near the subrequest cap, so the chain stops after the primary -- the real shape of the
-    // problem, where a breaker ends the walk with models still untried.
-    const tracker = new TokenTracker();
-    tracker.incrementSubrequests(40);
-    const first = new ModelService(env, tracker, { jobId: 'job-chain-resume' });
-
-    const firstFetch = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => unavailable());
-    await expect(review(first)).rejects.toThrow(/retrying later/);
-    const walked = firstFetch.mock.calls.map((call) => String(call[0]));
-    expect(walked.every((url) => url.includes('gemini-3.1-pro-preview'))).toBe(true);
-    vi.restoreAllMocks();
-
-    // A fresh service stands in for the next invocation; it reads the memo back out of KV.
-    const second = new ModelService(env, undefined, { jobId: 'job-chain-resume' });
-    const secondFetch = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => ok());
-    await review(second);
-
-    // The head of the chain is not retried: it was already ruled out for this file.
-    const retried = secondFetch.mock.calls.map((call) => String(call[0]));
-    expect(retried.every((url) => !url.includes('gemini-3.1-pro-preview'))).toBe(true);
-    expect(retried.length).toBeGreaterThan(0);
-  });
-
-  it('does not record progress past a model that was only rate-limited', async () => {
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env, undefined, { jobId: 'job-chain-429' });
-
-    // A 429 means "same model, later" -- advancing past it would skip a healthy model for good.
-    vi.spyOn(globalThis, 'fetch').mockImplementation(async () => rateLimited());
-    const failure = await review(service).catch((error) => error);
-
-    expect(nextChainIndexOf(failure)).toBeNull();
-  });
-
-  // Observed in production: pro timed out, the invocation ran out of subrequests, and the chain then
-  // walked all 8 remaining entries for 2 files -- 16 refusals -- before failing the chunk outright.
-  it('stops the chain the moment the invocation runs out of subrequests', async () => {
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env, undefined, { jobId: 'job-subrequests' });
-
-    const fetchMock = vi.spyOn(globalThis, 'fetch').mockRejectedValue(
-      new Error('Too many subrequests by single Worker invocation.'),
-    );
-    const failure = await review(service).catch((error) => error);
-
-    // One attempt, not one per configured model: the runtime refused the call, so nothing about the
-    // next model could make it succeed.
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(String(failure?.message)).toMatch(/retrying later/);
-    // And no progress recorded: those models never ran, so marking them tried would make the resume
-    // memo skip healthy models for the rest of the job.
-    expect(nextChainIndexOf(failure)).toBeNull();
-  });
-
-  it('reads nothing off an error that never walked a chain', () => {
-    expect(nextChainIndexOf(new Error('boom'))).toBeNull();
-    expect(nextChainIndexOf(undefined)).toBeNull();
-    // 0 is "no progress", and must not be mistaken for a recorded index.
-    expect(nextChainIndexOf(Object.assign(new Error('x'), { nextChainIndex: 0 }))).toBeNull();
-    expect(nextChainIndexOf(Object.assign(new Error('x'), { nextChainIndex: 2 }))).toBe(2);
-  });
-});
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { nextChainIndexOf, ModelRunner } from '@codra/models';
+import { defaultRepoConfig } from '@codra/schema';
+import { TokenTracker } from '@server/core/token-tracker';
+import { createTestEnv, saveTestProviderApiKey, createTestModelRunner } from '../../../../test/helpers';
+
+// One invocation only affords ~55s of model calls, so a chain whose head is slow never reaches its
+// tail. These pin that a deferral records where it got to and the next attempt resumes there --
+// without which entries past the first two are unreachable no matter how often a job retries.
+describe('model chain resume', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  const file = {
+    path: 'src/app.ts',
+    lineCount: 1,
+    hunks: [],
+    isDeleted: false,
+    isBinary: false,
+    isNew: false,
+    previousPath: null,
+  };
+
+  const chainConfig = {
+    ...defaultRepoConfig,
+    model: {
+      main: 'gemini-3.1-pro-preview',
+      // Three entries, all configured in the test env: the memo only records progress while the
+      // chain still has somewhere to go, so a two-entry chain would never write one.
+      fallbacks: ['gemini-2.5-pro', 'gemini-3.1-flash-lite'],
+      size_overrides: [],
+    },
+  };
+
+  const gemini = (status: number, body: unknown) =>
+    new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+
+  const ok = () => gemini(200, {
+    candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
+    usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+  });
+  // 503, not 500: a transient failure is what produces a deferral rather than a hard failure.
+  const unavailable = () => gemini(503, { error: { code: 503, message: 'The model is overloaded.', status: 'UNAVAILABLE' } });
+  const rateLimited = () => gemini(429, { error: { code: 429, message: 'Resource exhausted. limit: 16000, model: gemini. Please retry in 30s.', status: 'RESOURCE_EXHAUSTED' } });
+
+  async function review(service: ModelRunner) {
+    return service.reviewFile({
+      file,
+      prTitle: 'Test',
+      prDescription: null,
+      config: chainConfig,
+      totalLineCount: 1,
+      // Every model gets one shot, so the deferral arrives without a long inline retry ladder.
+    } as Parameters<ModelRunner['reviewFile']>[0]);
+  }
+
+  it('resumes at the model after the ones that already failed, instead of replaying them', async () => {
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    // Same jobId across both services: the memo is job-scoped KV, exactly as across invocations.
+    // Near the subrequest cap, so the chain stops after the primary -- the real shape of the
+    // problem, where a breaker ends the walk with models still untried.
+    const tracker = new TokenTracker();
+    tracker.incrementSubrequests(40);
+    const first = createTestModelRunner(env, tracker, { jobId: 'job-chain-resume' });
+
+    const firstFetch = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => unavailable());
+    await expect(review(first)).rejects.toThrow(/retrying later/);
+    const walked = firstFetch.mock.calls.map((call) => String(call[0]));
+    expect(walked.every((url) => url.includes('gemini-3.1-pro-preview'))).toBe(true);
+    vi.restoreAllMocks();
+
+    // A fresh service stands in for the next invocation; it reads the memo back out of KV.
+    const second = createTestModelRunner(env, undefined, { jobId: 'job-chain-resume' });
+    const secondFetch = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => ok());
+    await review(second);
+
+    // The head of the chain is not retried: it was already ruled out for this file.
+    const retried = secondFetch.mock.calls.map((call) => String(call[0]));
+    expect(retried.every((url) => !url.includes('gemini-3.1-pro-preview'))).toBe(true);
+    expect(retried.length).toBeGreaterThan(0);
+  });
+
+  it('does not record progress past a model that was only rate-limited', async () => {
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const service = createTestModelRunner(env, undefined, { jobId: 'job-chain-429' });
+
+    // A 429 means "same model, later" -- advancing past it would skip a healthy model for good.
+    vi.spyOn(globalThis, 'fetch').mockImplementation(async () => rateLimited());
+    const failure = await review(service).catch((error) => error);
+
+    expect(nextChainIndexOf(failure)).toBeNull();
+  });
+
+  // Observed in production: pro timed out, the invocation ran out of subrequests, and the chain then
+  // walked all 8 remaining entries for 2 files -- 16 refusals -- before failing the chunk outright.
+  it('stops the chain the moment the invocation runs out of subrequests', async () => {
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const service = createTestModelRunner(env, undefined, { jobId: 'job-subrequests' });
+
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockRejectedValue(
+      new Error('Too many subrequests by single Worker invocation.'),
+    );
+    const failure = await review(service).catch((error) => error);
+
+    // One attempt, not one per configured model: the runtime refused the call, so nothing about the
+    // next model could make it succeed.
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(String(failure?.message)).toMatch(/retrying later/);
+    // And no progress recorded: those models never ran, so marking them tried would make the resume
+    // memo skip healthy models for the rest of the job.
+    expect(nextChainIndexOf(failure)).toBeNull();
+  });
+
+  it('reads nothing off an error that never walked a chain', () => {
+    expect(nextChainIndexOf(new Error('boom'))).toBeNull();
+    expect(nextChainIndexOf(undefined)).toBeNull();
+    // 0 is "no progress", and must not be mistaken for a recorded index.
+    expect(nextChainIndexOf(Object.assign(new Error('x'), { nextChainIndex: 0 }))).toBeNull();
+    expect(nextChainIndexOf(Object.assign(new Error('x'), { nextChainIndex: 2 }))).toBe(2);
+  });
+});
diff --git a/test/model/cloudflare.spec.ts b/packages/models/test/model/cloudflare.spec.ts
similarity index 97%
rename from test/model/cloudflare.spec.ts
rename to packages/models/test/model/cloudflare.spec.ts
index 09161460..5db69bb4 100644
--- a/test/model/cloudflare.spec.ts
+++ b/packages/models/test/model/cloudflare.spec.ts
@@ -1,115 +1,115 @@
-import { describe, it, expect, vi } from 'vitest';
-import { reviewWithCloudflare, submitCloudflareBatch, pollCloudflareBatch } from '@server/models/cloudflare';
-
-// Regression: some Workers AI models (e.g. @cf/qwen/qwen2.5-coder-32b-instruct honoring
-// response_format) return `response` as an already-parsed JSON object/array rather than a string.
-// extractCloudflareText used to only accept a string, discarding a good review as "empty response".
-
-const REVIEW_JSON = {
-  findings: [],
-  overall_correctness: 'patch is correct',
-  overall_explanation: 'Looks good.',
-  overall_confidence_score: 0.9,
-};
-
-function envReturning(result: unknown) {
-  return { AI: { async run() { return result; } } } as any;
-}
-
-const input = { systemPrompt: 'sys', userPrompt: 'user' };
-
-describe('reviewWithCloudflare response extraction', () => {
-  it('accepts a structured object response (parsed JSON) and passes it through verbatim', async () => {
-    const res = await reviewWithCloudflare(
-      envReturning({ response: REVIEW_JSON, usage: { prompt_tokens: 3, completion_tokens: 4 } }),
-      '@cf/qwen/qwen2.5-coder-32b-instruct',
-      input,
-    );
-    // Must be the real review JSON, not a synthesized "no parseable review content" fallback.
-    expect(JSON.parse(res.rawText)).toMatchObject({ overall_correctness: 'patch is correct' });
-    expect(res.rawText).not.toContain('no parseable review content');
-    expect(res.inputTokens).toBe(3);
-    expect(res.outputTokens).toBe(4);
-  });
-
-  it('accepts a structured object under a nested result.response', async () => {
-    const res = await reviewWithCloudflare(
-      envReturning({ result: { response: REVIEW_JSON } }),
-      '@cf/qwen/qwen2.5-coder-32b-instruct',
-      input,
-    );
-    expect(JSON.parse(res.rawText)).toMatchObject({ overall_explanation: 'Looks good.' });
-    expect(res.rawText).not.toContain('no parseable review content');
-  });
-
-  it('still accepts a plain string response (existing behavior)', async () => {
-    const res = await reviewWithCloudflare(
-      envReturning({ response: JSON.stringify(REVIEW_JSON) }),
-      '@cf/meta/llama-3.3-70b-instruct-fp8-fast',
-      input,
-    );
-    expect(JSON.parse(res.rawText)).toMatchObject({ overall_correctness: 'patch is correct' });
-  });
-
-  it('throws (fails the file) instead of synthesizing a fake review when the model returns nothing usable', async () => {
-    await expect(
-      reviewWithCloudflare(envReturning({ something_unexpected: true }), '@cf/qwen/qwen2.5-coder-32b-instruct', input),
-    ).rejects.toThrow(/no reviewable output/i);
-  });
-
-  it('throws on a reasoning-only / token-truncated response (marks the file failed, not inconclusive)', async () => {
-    const reasoningOnly = { choices: [{ finish_reason: 'length', message: { content: null, reasoning: 'thinking, thinking, never answering...' } }] };
-    await expect(
-      reviewWithCloudflare(envReturning(reasoningOnly), '@cf/moonshotai/kimi-k2.6', input),
-    ).rejects.toThrow(/no reviewable output/i);
-  });
-});
-
-describe('Cloudflare async batch submit/poll', () => {
-  it('submits a batch request and returns the queue request_id', async () => {
-    const run = vi.fn().mockResolvedValue({ status: 'queued', request_id: 'req-123', model: '@cf/moonshotai/kimi-k2.6' });
-    const env = { AI: { run } } as any;
-    const id = await submitCloudflareBatch(env, '@cf/moonshotai/kimi-k2.6', input);
-    expect(id).toBe('req-123');
-    // Must send a `requests` array with queueRequest option.
-    expect(run.mock.calls[0][1]).toHaveProperty('requests');
-    expect(run.mock.calls[0][2]).toMatchObject({ queueRequest: true });
-  });
-
-  it('throws when the model does not return a request_id (async unsupported → caller falls back to sync)', async () => {
-    const env = { AI: { async run() { return { response: '{"findings":[]}' }; } } } as any;
-    await expect(submitCloudflareBatch(env, '@cf/meta/llama-3.1-8b-instruct', input)).rejects.toThrow(/async queueing unsupported|did not return/i);
-  });
-
-  it('reports pending while the batch is queued or running', async () => {
-    for (const status of ['queued', 'running']) {
-      const env = { AI: { async run() { return { status, request_id: 'req-1' }; } } } as any;
-      const res = await pollCloudflareBatch(env, '@cf/moonshotai/kimi-k2.6', 'req-1');
-      expect(res.status).toBe('pending');
-    }
-  });
-
-  it('extracts the review from a completed batch (responses[] with string response)', async () => {
-    const env = { AI: { async run() {
-      return { responses: [{ id: 0, external_reference: 'src/app.ts', result: { response: JSON.stringify(REVIEW_JSON), usage: { prompt_tokens: 5, completion_tokens: 6 } } }] };
-    } } } as any;
-    const res = await pollCloudflareBatch(env, '@cf/moonshotai/kimi-k2.6', 'req-1');
-    expect(res.status).toBe('done');
-    if (res.status === 'done') {
-      expect(JSON.parse(res.response.rawText)).toMatchObject({ overall_correctness: 'patch is correct' });
-      expect(res.response.inputTokens).toBe(5);
-      expect(res.response.outputTokens).toBe(6);
-    }
-  });
-
-  it('extracts the review from a completed batch whose entry carries an object response', async () => {
-    const env = { AI: { async run() {
-      return { result: { responses: [{ id: 0, response: REVIEW_JSON }] } };
-    } } } as any;
-    const res = await pollCloudflareBatch(env, '@cf/moonshotai/kimi-k2.6', 'req-1');
-    expect(res.status).toBe('done');
-    if (res.status === 'done') {
-      expect(JSON.parse(res.response.rawText)).toMatchObject({ overall_explanation: 'Looks good.' });
-    }
-  });
-});
+import { describe, it, expect, vi } from 'vitest';
+import { reviewWithCloudflare, submitCloudflareBatch, pollCloudflareBatch } from '@codra/models/cloudflare';
+
+// Regression: some Workers AI models (e.g. @cf/qwen/qwen2.5-coder-32b-instruct honoring
+// response_format) return `response` as an already-parsed JSON object/array rather than a string.
+// extractCloudflareText used to only accept a string, discarding a good review as "empty response".
+
+const REVIEW_JSON = {
+  findings: [],
+  overall_correctness: 'patch is correct',
+  overall_explanation: 'Looks good.',
+  overall_confidence_score: 0.9,
+};
+
+function envReturning(result: unknown) {
+  return { AI: { async run() { return result; } } } as any;
+}
+
+const input = { systemPrompt: 'sys', userPrompt: 'user' };
+
+describe('reviewWithCloudflare response extraction', () => {
+  it('accepts a structured object response (parsed JSON) and passes it through verbatim', async () => {
+    const res = await reviewWithCloudflare(
+      envReturning({ response: REVIEW_JSON, usage: { prompt_tokens: 3, completion_tokens: 4 } }),
+      '@cf/qwen/qwen2.5-coder-32b-instruct',
+      input,
+    );
+    // Must be the real review JSON, not a synthesized "no parseable review content" fallback.
+    expect(JSON.parse(res.rawText)).toMatchObject({ overall_correctness: 'patch is correct' });
+    expect(res.rawText).not.toContain('no parseable review content');
+    expect(res.inputTokens).toBe(3);
+    expect(res.outputTokens).toBe(4);
+  });
+
+  it('accepts a structured object under a nested result.response', async () => {
+    const res = await reviewWithCloudflare(
+      envReturning({ result: { response: REVIEW_JSON } }),
+      '@cf/qwen/qwen2.5-coder-32b-instruct',
+      input,
+    );
+    expect(JSON.parse(res.rawText)).toMatchObject({ overall_explanation: 'Looks good.' });
+    expect(res.rawText).not.toContain('no parseable review content');
+  });
+
+  it('still accepts a plain string response (existing behavior)', async () => {
+    const res = await reviewWithCloudflare(
+      envReturning({ response: JSON.stringify(REVIEW_JSON) }),
+      '@cf/meta/llama-3.3-70b-instruct-fp8-fast',
+      input,
+    );
+    expect(JSON.parse(res.rawText)).toMatchObject({ overall_correctness: 'patch is correct' });
+  });
+
+  it('throws (fails the file) instead of synthesizing a fake review when the model returns nothing usable', async () => {
+    await expect(
+      reviewWithCloudflare(envReturning({ something_unexpected: true }), '@cf/qwen/qwen2.5-coder-32b-instruct', input),
+    ).rejects.toThrow(/no reviewable output/i);
+  });
+
+  it('throws on a reasoning-only / token-truncated response (marks the file failed, not inconclusive)', async () => {
+    const reasoningOnly = { choices: [{ finish_reason: 'length', message: { content: null, reasoning: 'thinking, thinking, never answering...' } }] };
+    await expect(
+      reviewWithCloudflare(envReturning(reasoningOnly), '@cf/moonshotai/kimi-k2.6', input),
+    ).rejects.toThrow(/no reviewable output/i);
+  });
+});
+
+describe('Cloudflare async batch submit/poll', () => {
+  it('submits a batch request and returns the queue request_id', async () => {
+    const run = vi.fn().mockResolvedValue({ status: 'queued', request_id: 'req-123', model: '@cf/moonshotai/kimi-k2.6' });
+    const env = { AI: { run } } as any;
+    const id = await submitCloudflareBatch(env, '@cf/moonshotai/kimi-k2.6', input);
+    expect(id).toBe('req-123');
+    // Must send a `requests` array with queueRequest option.
+    expect(run.mock.calls[0][1]).toHaveProperty('requests');
+    expect(run.mock.calls[0][2]).toMatchObject({ queueRequest: true });
+  });
+
+  it('throws when the model does not return a request_id (async unsupported → caller falls back to sync)', async () => {
+    const env = { AI: { async run() { return { response: '{"findings":[]}' }; } } } as any;
+    await expect(submitCloudflareBatch(env, '@cf/meta/llama-3.1-8b-instruct', input)).rejects.toThrow(/async queueing unsupported|did not return/i);
+  });
+
+  it('reports pending while the batch is queued or running', async () => {
+    for (const status of ['queued', 'running']) {
+      const env = { AI: { async run() { return { status, request_id: 'req-1' }; } } } as any;
+      const res = await pollCloudflareBatch(env, '@cf/moonshotai/kimi-k2.6', 'req-1');
+      expect(res.status).toBe('pending');
+    }
+  });
+
+  it('extracts the review from a completed batch (responses[] with string response)', async () => {
+    const env = { AI: { async run() {
+      return { responses: [{ id: 0, external_reference: 'src/app.ts', result: { response: JSON.stringify(REVIEW_JSON), usage: { prompt_tokens: 5, completion_tokens: 6 } } }] };
+    } } } as any;
+    const res = await pollCloudflareBatch(env, '@cf/moonshotai/kimi-k2.6', 'req-1');
+    expect(res.status).toBe('done');
+    if (res.status === 'done') {
+      expect(JSON.parse(res.response.rawText)).toMatchObject({ overall_correctness: 'patch is correct' });
+      expect(res.response.inputTokens).toBe(5);
+      expect(res.response.outputTokens).toBe(6);
+    }
+  });
+
+  it('extracts the review from a completed batch whose entry carries an object response', async () => {
+    const env = { AI: { async run() {
+      return { result: { responses: [{ id: 0, response: REVIEW_JSON }] } };
+    } } } as any;
+    const res = await pollCloudflareBatch(env, '@cf/moonshotai/kimi-k2.6', 'req-1');
+    expect(res.status).toBe('done');
+    if (res.status === 'done') {
+      expect(JSON.parse(res.response.rawText)).toMatchObject({ overall_explanation: 'Looks good.' });
+    }
+  });
+});
diff --git a/test/model/config-cache.spec.ts b/packages/models/test/model/config-cache.spec.ts
similarity index 79%
rename from test/model/config-cache.spec.ts
rename to packages/models/test/model/config-cache.spec.ts
index 3cbe0511..04060050 100644
--- a/test/model/config-cache.spec.ts
+++ b/packages/models/test/model/config-cache.spec.ts
@@ -1,75 +1,75 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { createTestEnv } from '../helpers';
-
-// Isolated in its own file: mocking @codra/db/model-configs module-wide would break the
-// other model-service tests that resolve configs against the real test DB.
-const getResolvedModelConfigMock = vi.hoisted(() => vi.fn());
-
-vi.mock('@codra/db/model-configs', async (importOriginal) => {
-  const mod = await importOriginal<any>();
-  return { ...mod, getResolvedModelConfig: getResolvedModelConfigMock };
-});
-
-import { ModelService } from '@server/services/model';
-
-const cloudflareConfig = (modelId: string) => ({
-  modelId,
-  providerId: 'cf',
-  providerName: 'Cloudflare',
-  apiFormat: 'cloudflare-workers-ai' as const,
-  modelName: modelId,
-  updatedAt: new Date().toISOString(),
-  providerEnabled: true,
-  baseUrl: null,
-  encryptedApiKey: null,
-});
-
-describe('ModelService model-config caching', () => {
-  beforeEach(() => {
-    getResolvedModelConfigMock.mockReset();
-  });
-
-  it('resolves a given model config from the DB at most once per invocation', async () => {
-    getResolvedModelConfigMock.mockImplementation(async (_env: any, modelId: string) => cloudflareConfig(modelId));
-    const service = new ModelService(createTestEnv());
-
-    // The same model is resolved repeatedly across a chunk (once per file); only the first
-    // should hit the DB.
-    await (service as any).resolveModel('@cf/zai-org/glm-4.7-flash');
-    await (service as any).resolveModel('@cf/zai-org/glm-4.7-flash');
-    await (service as any).resolveModel('@cf/zai-org/glm-4.7-flash');
-
-    expect(getResolvedModelConfigMock).toHaveBeenCalledTimes(1);
-  });
-
-  it('keeps a separate cache entry per distinct model id', async () => {
-    getResolvedModelConfigMock.mockImplementation(async (_env: any, modelId: string) => cloudflareConfig(modelId));
-    const service = new ModelService(createTestEnv());
-
-    await (service as any).resolveModel('gemini-3.1-pro-preview');
-    await (service as any).resolveModel('gemini-2.5-pro');
-    await (service as any).resolveModel('gemini-3.1-pro-preview');
-
-    expect(getResolvedModelConfigMock).toHaveBeenCalledTimes(2);
-  });
-
-  it('caches a null "not configured" result so it is not re-queried every file', async () => {
-    getResolvedModelConfigMock.mockResolvedValue(null);
-    const service = new ModelService(createTestEnv());
-
-    await expect((service as any).resolveModel('does-not-exist')).rejects.toThrow('is not configured');
-    await expect((service as any).resolveModel('does-not-exist')).rejects.toThrow('is not configured');
-
-    expect(getResolvedModelConfigMock).toHaveBeenCalledTimes(1);
-  });
-
-  it('does not share a cache across ModelService instances (one instance == one invocation)', async () => {
-    getResolvedModelConfigMock.mockImplementation(async (_env: any, modelId: string) => cloudflareConfig(modelId));
-    const env = createTestEnv();
-
-    await (new ModelService(env) as any).resolveModel('@cf/zai-org/glm-4.7-flash');
-    await (new ModelService(env) as any).resolveModel('@cf/zai-org/glm-4.7-flash');
-
-    expect(getResolvedModelConfigMock).toHaveBeenCalledTimes(2);
-  });
-});
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { createTestEnv, createTestModelRunner } from '../../../../test/helpers';
+
+// Isolated in its own file: mocking @codra/db/model-configs module-wide would break the
+// other model-service tests that resolve configs against the real test DB.
+const getResolvedModelConfigMock = vi.hoisted(() => vi.fn());
+
+vi.mock('@codra/db/model-configs', async (importOriginal) => {
+  const mod = await importOriginal<any>();
+  return { ...mod, getResolvedModelConfig: getResolvedModelConfigMock };
+});
+
+
+
+const cloudflareConfig = (modelId: string) => ({
+  modelId,
+  providerId: 'cf',
+  providerName: 'Cloudflare',
+  apiFormat: 'cloudflare-workers-ai' as const,
+  modelName: modelId,
+  updatedAt: new Date().toISOString(),
+  providerEnabled: true,
+  baseUrl: null,
+  encryptedApiKey: null,
+});
+
+describe('ModelRunner model-config caching', () => {
+  beforeEach(() => {
+    getResolvedModelConfigMock.mockReset();
+  });
+
+  it('resolves a given model config from the DB at most once per invocation', async () => {
+    getResolvedModelConfigMock.mockImplementation(async (_env: any, modelId: string) => cloudflareConfig(modelId));
+    const service = createTestModelRunner(createTestEnv());
+
+    // The same model is resolved repeatedly across a chunk (once per file); only the first
+    // should hit the DB.
+    await (service as any).resolveModel('@cf/zai-org/glm-4.7-flash');
+    await (service as any).resolveModel('@cf/zai-org/glm-4.7-flash');
+    await (service as any).resolveModel('@cf/zai-org/glm-4.7-flash');
+
+    expect(getResolvedModelConfigMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('keeps a separate cache entry per distinct model id', async () => {
+    getResolvedModelConfigMock.mockImplementation(async (_env: any, modelId: string) => cloudflareConfig(modelId));
+    const service = createTestModelRunner(createTestEnv());
+
+    await (service as any).resolveModel('gemini-3.1-pro-preview');
+    await (service as any).resolveModel('gemini-2.5-pro');
+    await (service as any).resolveModel('gemini-3.1-pro-preview');
+
+    expect(getResolvedModelConfigMock).toHaveBeenCalledTimes(2);
+  });
+
+  it('caches a null "not configured" result so it is not re-queried every file', async () => {
+    getResolvedModelConfigMock.mockResolvedValue(null);
+    const service = createTestModelRunner(createTestEnv());
+
+    await expect((service as any).resolveModel('does-not-exist')).rejects.toThrow('is not configured');
+    await expect((service as any).resolveModel('does-not-exist')).rejects.toThrow('is not configured');
+
+    expect(getResolvedModelConfigMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not share a cache across ModelRunner instances (one instance == one invocation)', async () => {
+    getResolvedModelConfigMock.mockImplementation(async (_env: any, modelId: string) => cloudflareConfig(modelId));
+    const env = createTestEnv();
+
+    await (createTestModelRunner(env) as any).resolveModel('@cf/zai-org/glm-4.7-flash');
+    await (createTestModelRunner(env) as any).resolveModel('@cf/zai-org/glm-4.7-flash');
+
+    expect(getResolvedModelConfigMock).toHaveBeenCalledTimes(2);
+  });
+});
diff --git a/test/model/gemini-schema.spec.ts b/packages/models/test/model/gemini-schema.spec.ts
similarity index 96%
rename from test/model/gemini-schema.spec.ts
rename to packages/models/test/model/gemini-schema.spec.ts
index ac889716..e4e5b86f 100644
--- a/test/model/gemini-schema.spec.ts
+++ b/packages/models/test/model/gemini-schema.spec.ts
@@ -1,75 +1,75 @@
-import { describe, expect, it } from 'vitest';
-import { toGeminiResponseJsonSchema } from '@server/models/gemini-schema';
-import { buildBatchReviewResponseSchema, buildReviewResponseSchema } from '@server/prompts/file-review';
-import { VERIFY_RESPONSE_SCHEMA } from '@server/prompts/verify';
-
-// Transformations asserted on the pure function; the adapter specs only check a grammar reaches the
-// wire. Every failure mode here is silent -- a mangled grammar still returns 200.
-describe('toGeminiResponseJsonSchema', () => {
-  const reviewSchema = () => buildReviewResponseSchema(10).schema;
-  const findingProps = (out: any) => out.properties.findings.items.properties;
-
-  it('adapts both review grammars: ordering stated, code_location union collapsed', () => {
-    const out = toGeminiResponseJsonSchema(reviewSchema()) as any;
-    const expected = ['evidence', 'code_location', 'claim_type', 'title', 'body', 'priority', 'code_suggestion'];
-    expect(Object.keys(findingProps(out))).toEqual(expected);
-    expect(out.properties.findings.items.propertyOrdering).toEqual(expected);
-
-    const location = findingProps(out).code_location;
-    expect(location.anyOf).toBeUndefined();
-    // Paired: deleting the union without substituting `required` is the outcome to avoid.
-    expect(location.required).toEqual(['line']);
-    expect(Object.keys(location.properties)).toEqual(['absolute_file_path', 'line', 'line_range']);
-
-    const verify = toGeminiResponseJsonSchema(VERIFY_RESPONSE_SCHEMA.schema as Record<string, unknown>) as any;
-    // `reason` then `decidable`, both before `verdict`: the verifier justifies, and states whether the
-    // window it was given can settle the claim at all, before it is allowed to emit a decision token.
-    expect(verify.properties.results.items.propertyOrdering).toEqual(['index', 'reason', 'decidable', 'verdict', 'confidence']);
-
-    // The batch grammar nests one level deeper; the same transforms must reach it.
-    const batch = toGeminiResponseJsonSchema(buildBatchReviewResponseSchema(10, 4).schema) as any;
-    const fileProps = batch.properties.files.items.properties;
-    expect(Object.keys(fileProps)[0]).toBe('absolute_file_path');
-    expect(fileProps.findings.items.properties.code_location.required).toEqual(['line']);
-  });
-
-  it('collapses oneOf, but never a union it cannot safely replace', () => {
-    const collapsed = toGeminiResponseJsonSchema({
-      type: 'object',
-      properties: { a: { type: 'string' }, b: { type: 'string' } },
-      oneOf: [{ required: ['a'] }, { required: ['b'] }],
-    }) as any;
-    expect(collapsed.oneOf).toBeUndefined();
-    expect(collapsed.required).toEqual(['a']);
-
-    // A typed branch is a real union, and an unusable one can't be substituted. Both pass through.
-    const untouched = [
-      [{ type: 'object', required: ['a'] }, { type: 'string' }],
-      [{ required: 'a' }, { required: ['a'] }],
-      [{ required: [123] }, { required: ['a'] }],
-    ];
-    for (const anyOf of untouched) {
-      const out = toGeminiResponseJsonSchema({ type: 'object', properties: { a: { type: 'string' } }, anyOf }) as any;
-      expect(out.anyOf).toHaveLength(2);
-      expect(out.required).toBeUndefined();
-    }
-  });
-
-  it('never mutates or aliases the caller\'s schema', () => {
-    // VERIFY_RESPONSE_SCHEMA is a module singleton, so an in-place edit would corrupt
-    // the verify grammar for every later job.
-    const verifyBefore = JSON.stringify(VERIFY_RESPONSE_SCHEMA.schema);
-    const input = reviewSchema() as any;
-    const before = JSON.stringify(input);
-
-    toGeminiResponseJsonSchema(VERIFY_RESPONSE_SCHEMA.schema as Record<string, unknown>);
-    const out = toGeminiResponseJsonSchema(input) as any;
-
-    expect(JSON.stringify(VERIFY_RESPONSE_SCHEMA.schema)).toBe(verifyBefore);
-    expect(JSON.stringify(input)).toBe(before);
-    expect(input.properties.findings.items.properties.code_location.anyOf).toBeDefined();
-    // Arrays too, so an `enum` or tuple-form `items` cannot be shared.
-    expect(out.required).not.toBe(input.required);
-    expect(findingProps(out).claim_type.enum).not.toBe(findingProps(input).claim_type.enum);
-  });
-});
+import { describe, expect, it } from 'vitest';
+import { toGeminiResponseJsonSchema } from '../../src/gemini-schema';
+import { buildBatchReviewResponseSchema, buildReviewResponseSchema } from '@server/prompts/file-review';
+import { VERIFY_RESPONSE_SCHEMA } from '@server/prompts/verify';
+
+// Transformations asserted on the pure function; the adapter specs only check a grammar reaches the
+// wire. Every failure mode here is silent -- a mangled grammar still returns 200.
+describe('toGeminiResponseJsonSchema', () => {
+  const reviewSchema = () => buildReviewResponseSchema(10).schema;
+  const findingProps = (out: any) => out.properties.findings.items.properties;
+
+  it('adapts both review grammars: ordering stated, code_location union collapsed', () => {
+    const out = toGeminiResponseJsonSchema(reviewSchema()) as any;
+    const expected = ['evidence', 'code_location', 'claim_type', 'title', 'body', 'priority', 'code_suggestion'];
+    expect(Object.keys(findingProps(out))).toEqual(expected);
+    expect(out.properties.findings.items.propertyOrdering).toEqual(expected);
+
+    const location = findingProps(out).code_location;
+    expect(location.anyOf).toBeUndefined();
+    // Paired: deleting the union without substituting `required` is the outcome to avoid.
+    expect(location.required).toEqual(['line']);
+    expect(Object.keys(location.properties)).toEqual(['absolute_file_path', 'line', 'line_range']);
+
+    const verify = toGeminiResponseJsonSchema(VERIFY_RESPONSE_SCHEMA.schema as Record<string, unknown>) as any;
+    // `reason` then `decidable`, both before `verdict`: the verifier justifies, and states whether the
+    // window it was given can settle the claim at all, before it is allowed to emit a decision token.
+    expect(verify.properties.results.items.propertyOrdering).toEqual(['index', 'reason', 'decidable', 'verdict', 'confidence']);
+
+    // The batch grammar nests one level deeper; the same transforms must reach it.
+    const batch = toGeminiResponseJsonSchema(buildBatchReviewResponseSchema(10, 4).schema) as any;
+    const fileProps = batch.properties.files.items.properties;
+    expect(Object.keys(fileProps)[0]).toBe('absolute_file_path');
+    expect(fileProps.findings.items.properties.code_location.required).toEqual(['line']);
+  });
+
+  it('collapses oneOf, but never a union it cannot safely replace', () => {
+    const collapsed = toGeminiResponseJsonSchema({
+      type: 'object',
+      properties: { a: { type: 'string' }, b: { type: 'string' } },
+      oneOf: [{ required: ['a'] }, { required: ['b'] }],
+    }) as any;
+    expect(collapsed.oneOf).toBeUndefined();
+    expect(collapsed.required).toEqual(['a']);
+
+    // A typed branch is a real union, and an unusable one can't be substituted. Both pass through.
+    const untouched = [
+      [{ type: 'object', required: ['a'] }, { type: 'string' }],
+      [{ required: 'a' }, { required: ['a'] }],
+      [{ required: [123] }, { required: ['a'] }],
+    ];
+    for (const anyOf of untouched) {
+      const out = toGeminiResponseJsonSchema({ type: 'object', properties: { a: { type: 'string' } }, anyOf }) as any;
+      expect(out.anyOf).toHaveLength(2);
+      expect(out.required).toBeUndefined();
+    }
+  });
+
+  it('never mutates or aliases the caller\'s schema', () => {
+    // VERIFY_RESPONSE_SCHEMA is a module singleton, so an in-place edit would corrupt
+    // the verify grammar for every later job.
+    const verifyBefore = JSON.stringify(VERIFY_RESPONSE_SCHEMA.schema);
+    const input = reviewSchema() as any;
+    const before = JSON.stringify(input);
+
+    toGeminiResponseJsonSchema(VERIFY_RESPONSE_SCHEMA.schema as Record<string, unknown>);
+    const out = toGeminiResponseJsonSchema(input) as any;
+
+    expect(JSON.stringify(VERIFY_RESPONSE_SCHEMA.schema)).toBe(verifyBefore);
+    expect(JSON.stringify(input)).toBe(before);
+    expect(input.properties.findings.items.properties.code_location.anyOf).toBeDefined();
+    // Arrays too, so an `enum` or tuple-form `items` cannot be shared.
+    expect(out.required).not.toBe(input.required);
+    expect(findingProps(out).claim_type.enum).not.toBe(findingProps(input).claim_type.enum);
+  });
+});
diff --git a/test/model/limits.spec.ts b/packages/models/test/model/limits.spec.ts
similarity index 96%
rename from test/model/limits.spec.ts
rename to packages/models/test/model/limits.spec.ts
index 5572c203..d661752f 100644
--- a/test/model/limits.spec.ts
+++ b/packages/models/test/model/limits.spec.ts
@@ -1,147 +1,147 @@
-import { describe, expect, it } from 'vitest';
-import {
-  ModelCallGate,
-  adaptiveModelTimeoutMs,
-  clampTimeoutToChainBudget,
-  geminiThinkingBudgetTokens,
-  MODEL_FALLBACK_CHAIN_BUDGET_MS,
-  MODEL_TIMEOUT_BASE_MS,
-  MODEL_TIMEOUT_MAX_MS,
-  OUTPUT_TOKENS_FLOOR,
-  resolveOutputTokenCeiling,
-  reviewOutputBudgetTokens,
-} from '../../src/server/models/limits';
-import { generatorFindingCap } from '../../src/server/prompts/file-review';
-
-// The whole point of these: a bin that overruns `maxOutputTokens` comes back as a repaired JSON prefix
-// with its tail files silently empty, which is indistinguishable from "those files are clean".
-describe('reviewOutputBudgetTokens', () => {
-  it('never asks for less than the floor', () => {
-    expect(reviewOutputBudgetTokens({ findingCap: 1, fileCount: 1 })).toBe(OUTPUT_TOKENS_FLOOR);
-  });
-
-  it('grows with the number of findings the prompt asked for', () => {
-    const one = reviewOutputBudgetTokens({ findingCap: generatorFindingCap(10), fileCount: 1 });
-    const bin = reviewOutputBudgetTokens({ findingCap: generatorFindingCap(10), fileCount: 6 });
-    // Six files at the same per-file cap need more room than one.
-    expect(bin).toBeGreaterThan(one);
-    expect(bin).toBeGreaterThan(OUTPUT_TOKENS_FLOOR);
-  });
-
-  it('covers the bin ask that the old flat ceiling could not', () => {
-    // The regression: 6 files x 20 findings each, requested inside a flat 8192.
-    expect(reviewOutputBudgetTokens({ findingCap: 20, fileCount: 6 })).toBeGreaterThan(8_192);
-  });
-});
-
-describe('resolveOutputTokenCeiling', () => {
-  it('falls back to the provider default when no budget is stated', () => {
-    expect(resolveOutputTokenCeiling(undefined, 65_536, 8_192)).toBe(8_192);
-    // A caller that omits it must be unaffected by a raised provider max.
-    expect(resolveOutputTokenCeiling(0, 65_536, 8_192)).toBe(8_192);
-    expect(resolveOutputTokenCeiling(Number.NaN, 65_536, 8_192)).toBe(8_192);
-  });
-
-  it('never drops below the provider default, and never exceeds its max', () => {
-    expect(resolveOutputTokenCeiling(1_000, 65_536, 8_192)).toBe(8_192);
-    expect(resolveOutputTokenCeiling(20_000, 65_536, 8_192)).toBe(20_000);
-    expect(resolveOutputTokenCeiling(999_999, 65_536, 8_192)).toBe(65_536);
-    // A provider whose max is below the shared default still gets a request it accepts.
-    expect(resolveOutputTokenCeiling(20_000, 4_096, 8_192)).toBe(4_096);
-  });
-});
-
-describe('geminiThinkingBudgetTokens', () => {
-  // Thinking bills against the SAME maxOutputTokens the JSON must fit in, so raising the ceiling has to
-  // buy answer rather than more thinking.
-  it('stays a minority of the ceiling', () => {
-    expect(geminiThinkingBudgetTokens(32_768)).toBeLessThan(32_768 / 3);
-    expect(geminiThinkingBudgetTokens(8_192)).toBeLessThan(8_192 / 3);
-  });
-
-  it('stays inside the band every Gemini 2.5 model accepts', () => {
-    // Never 0 (the Pro models refuse it outright) and never above 8192 (Flash's own ceiling is lower).
-    expect(geminiThinkingBudgetTokens(1_024)).toBeGreaterThanOrEqual(1_024);
-    expect(geminiThinkingBudgetTokens(65_536)).toBeLessThanOrEqual(8_192);
-  });
-});
-
-describe('generatorFindingCap', () => {
-  // Bin size deliberately does NOT divide this; see the note on generatorFindingCap. Measured output was
-  // ~3% of the ceiling, so the cap has never been the limit and lowering it only removes headroom.
-  it('is 2x max_comments regardless of how many files share the call', () => {
-    expect(generatorFindingCap(10)).toBe(20);
-    expect(generatorFindingCap(1)).toBe(2);
-  });
-});
-
-describe('adaptiveModelTimeoutMs', () => {
-  it('uses the base budget for small diffs', () => {
-    expect(adaptiveModelTimeoutMs(0)).toBe(MODEL_TIMEOUT_BASE_MS);
-    expect(adaptiveModelTimeoutMs(100)).toBe(MODEL_TIMEOUT_BASE_MS);
-    expect(adaptiveModelTimeoutMs(undefined)).toBe(MODEL_TIMEOUT_BASE_MS);
-    expect(adaptiveModelTimeoutMs(null)).toBe(MODEL_TIMEOUT_BASE_MS);
-  });
-
-  it('scales with diff size beyond the free-line allowance', () => {
-    // Use line counts that stay below the MAX cap so the linear scaling is observable.
-    expect(adaptiveModelTimeoutMs(200)).toBe(MODEL_TIMEOUT_BASE_MS + 100 * 100);
-    expect(adaptiveModelTimeoutMs(250)).toBeGreaterThan(adaptiveModelTimeoutMs(150));
-  });
-
-  it('caps at the maximum regardless of diff size', () => {
-    expect(adaptiveModelTimeoutMs(100_000)).toBe(MODEL_TIMEOUT_MAX_MS);
-  });
-});
-
-describe('clampTimeoutToChainBudget', () => {
-  it('leaves every budget the adaptive ceiling can produce untouched', () => {
-    // A big bin is meant to spend a whole invocation on one model and get the full ceiling.
-    expect(clampTimeoutToChainBudget(MODEL_TIMEOUT_MAX_MS)).toBe(MODEL_TIMEOUT_MAX_MS);
-    expect(clampTimeoutToChainBudget(MODEL_TIMEOUT_BASE_MS)).toBe(MODEL_TIMEOUT_BASE_MS);
-  });
-
-  // The invariant it exists to hold: the head of a chain is exempt from the budget check, so a per-call
-  // budget above the chain budget would let a call start that can never finish inside it.
-  it('holds the ceiling under the chain budget', () => {
-    expect(MODEL_TIMEOUT_MAX_MS).toBeLessThanOrEqual(MODEL_FALLBACK_CHAIN_BUDGET_MS);
-    expect(clampTimeoutToChainBudget(MODEL_FALLBACK_CHAIN_BUDGET_MS + 10_000)).toBe(MODEL_FALLBACK_CHAIN_BUDGET_MS);
-  });
-});
-
-describe('ModelCallGate', () => {
-  it('never runs more than the limit concurrently and eventually runs everything', async () => {
-    const gate = new ModelCallGate(2);
-    let active = 0;
-    let peak = 0;
-    const done: number[] = [];
-
-    const task = (id: number) =>
-      gate.run(async () => {
-        active++;
-        peak = Math.max(peak, active);
-        // Yield a couple of microtasks so tasks genuinely overlap.
-        await Promise.resolve();
-        await Promise.resolve();
-        active--;
-        done.push(id);
-      });
-
-    await Promise.all([task(1), task(2), task(3), task(4), task(5)]);
-
-    expect(peak).toBeLessThanOrEqual(2);
-    expect(done).toHaveLength(5);
-  });
-
-  it('releases the slot when a gated call rejects', async () => {
-    const gate = new ModelCallGate(1);
-
-    await expect(gate.run(async () => {
-      throw new Error('boom');
-    })).rejects.toThrow('boom');
-
-    // The slot must be free again for the next caller.
-    const result = await gate.run(async () => 'ok');
-    expect(result).toBe('ok');
-  });
-});
+import { describe, expect, it } from 'vitest';
+import {
+  ModelCallGate,
+  adaptiveModelTimeoutMs,
+  clampTimeoutToChainBudget,
+  geminiThinkingBudgetTokens,
+  MODEL_FALLBACK_CHAIN_BUDGET_MS,
+  MODEL_TIMEOUT_BASE_MS,
+  MODEL_TIMEOUT_MAX_MS,
+  OUTPUT_TOKENS_FLOOR,
+  resolveOutputTokenCeiling,
+  reviewOutputBudgetTokens,
+} from '../../src/limits';
+import { generatorFindingCap } from '@server/prompts/file-review';
+
+// The whole point of these: a bin that overruns `maxOutputTokens` comes back as a repaired JSON prefix
+// with its tail files silently empty, which is indistinguishable from "those files are clean".
+describe('reviewOutputBudgetTokens', () => {
+  it('never asks for less than the floor', () => {
+    expect(reviewOutputBudgetTokens({ findingCap: 1, fileCount: 1 })).toBe(OUTPUT_TOKENS_FLOOR);
+  });
+
+  it('grows with the number of findings the prompt asked for', () => {
+    const one = reviewOutputBudgetTokens({ findingCap: generatorFindingCap(10), fileCount: 1 });
+    const bin = reviewOutputBudgetTokens({ findingCap: generatorFindingCap(10), fileCount: 6 });
+    // Six files at the same per-file cap need more room than one.
+    expect(bin).toBeGreaterThan(one);
+    expect(bin).toBeGreaterThan(OUTPUT_TOKENS_FLOOR);
+  });
+
+  it('covers the bin ask that the old flat ceiling could not', () => {
+    // The regression: 6 files x 20 findings each, requested inside a flat 8192.
+    expect(reviewOutputBudgetTokens({ findingCap: 20, fileCount: 6 })).toBeGreaterThan(8_192);
+  });
+});
+
+describe('resolveOutputTokenCeiling', () => {
+  it('falls back to the provider default when no budget is stated', () => {
+    expect(resolveOutputTokenCeiling(undefined, 65_536, 8_192)).toBe(8_192);
+    // A caller that omits it must be unaffected by a raised provider max.
+    expect(resolveOutputTokenCeiling(0, 65_536, 8_192)).toBe(8_192);
+    expect(resolveOutputTokenCeiling(Number.NaN, 65_536, 8_192)).toBe(8_192);
+  });
+
+  it('never drops below the provider default, and never exceeds its max', () => {
+    expect(resolveOutputTokenCeiling(1_000, 65_536, 8_192)).toBe(8_192);
+    expect(resolveOutputTokenCeiling(20_000, 65_536, 8_192)).toBe(20_000);
+    expect(resolveOutputTokenCeiling(999_999, 65_536, 8_192)).toBe(65_536);
+    // A provider whose max is below the shared default still gets a request it accepts.
+    expect(resolveOutputTokenCeiling(20_000, 4_096, 8_192)).toBe(4_096);
+  });
+});
+
+describe('geminiThinkingBudgetTokens', () => {
+  // Thinking bills against the SAME maxOutputTokens the JSON must fit in, so raising the ceiling has to
+  // buy answer rather than more thinking.
+  it('stays a minority of the ceiling', () => {
+    expect(geminiThinkingBudgetTokens(32_768)).toBeLessThan(32_768 / 3);
+    expect(geminiThinkingBudgetTokens(8_192)).toBeLessThan(8_192 / 3);
+  });
+
+  it('stays inside the band every Gemini 2.5 model accepts', () => {
+    // Never 0 (the Pro models refuse it outright) and never above 8192 (Flash's own ceiling is lower).
+    expect(geminiThinkingBudgetTokens(1_024)).toBeGreaterThanOrEqual(1_024);
+    expect(geminiThinkingBudgetTokens(65_536)).toBeLessThanOrEqual(8_192);
+  });
+});
+
+describe('generatorFindingCap', () => {
+  // Bin size deliberately does NOT divide this; see the note on generatorFindingCap. Measured output was
+  // ~3% of the ceiling, so the cap has never been the limit and lowering it only removes headroom.
+  it('is 2x max_comments regardless of how many files share the call', () => {
+    expect(generatorFindingCap(10)).toBe(20);
+    expect(generatorFindingCap(1)).toBe(2);
+  });
+});
+
+describe('adaptiveModelTimeoutMs', () => {
+  it('uses the base budget for small diffs', () => {
+    expect(adaptiveModelTimeoutMs(0)).toBe(MODEL_TIMEOUT_BASE_MS);
+    expect(adaptiveModelTimeoutMs(100)).toBe(MODEL_TIMEOUT_BASE_MS);
+    expect(adaptiveModelTimeoutMs(undefined)).toBe(MODEL_TIMEOUT_BASE_MS);
+    expect(adaptiveModelTimeoutMs(null)).toBe(MODEL_TIMEOUT_BASE_MS);
+  });
+
+  it('scales with diff size beyond the free-line allowance', () => {
+    // Use line counts that stay below the MAX cap so the linear scaling is observable.
+    expect(adaptiveModelTimeoutMs(200)).toBe(MODEL_TIMEOUT_BASE_MS + 100 * 100);
+    expect(adaptiveModelTimeoutMs(250)).toBeGreaterThan(adaptiveModelTimeoutMs(150));
+  });
+
+  it('caps at the maximum regardless of diff size', () => {
+    expect(adaptiveModelTimeoutMs(100_000)).toBe(MODEL_TIMEOUT_MAX_MS);
+  });
+});
+
+describe('clampTimeoutToChainBudget', () => {
+  it('leaves every budget the adaptive ceiling can produce untouched', () => {
+    // A big bin is meant to spend a whole invocation on one model and get the full ceiling.
+    expect(clampTimeoutToChainBudget(MODEL_TIMEOUT_MAX_MS)).toBe(MODEL_TIMEOUT_MAX_MS);
+    expect(clampTimeoutToChainBudget(MODEL_TIMEOUT_BASE_MS)).toBe(MODEL_TIMEOUT_BASE_MS);
+  });
+
+  // The invariant it exists to hold: the head of a chain is exempt from the budget check, so a per-call
+  // budget above the chain budget would let a call start that can never finish inside it.
+  it('holds the ceiling under the chain budget', () => {
+    expect(MODEL_TIMEOUT_MAX_MS).toBeLessThanOrEqual(MODEL_FALLBACK_CHAIN_BUDGET_MS);
+    expect(clampTimeoutToChainBudget(MODEL_FALLBACK_CHAIN_BUDGET_MS + 10_000)).toBe(MODEL_FALLBACK_CHAIN_BUDGET_MS);
+  });
+});
+
+describe('ModelCallGate', () => {
+  it('never runs more than the limit concurrently and eventually runs everything', async () => {
+    const gate = new ModelCallGate(2);
+    let active = 0;
+    let peak = 0;
+    const done: number[] = [];
+
+    const task = (id: number) =>
+      gate.run(async () => {
+        active++;
+        peak = Math.max(peak, active);
+        // Yield a couple of microtasks so tasks genuinely overlap.
+        await Promise.resolve();
+        await Promise.resolve();
+        active--;
+        done.push(id);
+      });
+
+    await Promise.all([task(1), task(2), task(3), task(4), task(5)]);
+
+    expect(peak).toBeLessThanOrEqual(2);
+    expect(done).toHaveLength(5);
+  });
+
+  it('releases the slot when a gated call rejects', async () => {
+    const gate = new ModelCallGate(1);
+
+    await expect(gate.run(async () => {
+      throw new Error('boom');
+    })).rejects.toThrow('boom');
+
+    // The slot must be free again for the next caller.
+    const result = await gate.run(async () => 'ok');
+    expect(result).toBe('ok');
+  });
+});
diff --git a/test/model/output-batch.spec.ts b/packages/models/test/model/output-batch.spec.ts
similarity index 97%
rename from test/model/output-batch.spec.ts
rename to packages/models/test/model/output-batch.spec.ts
index 5cb2ef89..73f3d9bb 100644
--- a/test/model/output-batch.spec.ts
+++ b/packages/models/test/model/output-batch.spec.ts
@@ -1,83 +1,83 @@
-import { describe, expect, it } from 'vitest';
-import { parseRawBatchPayload } from '@server/core/model-output';
-
-function nested(paths: string[]) {
-  return {
-    files: paths.map((path, i) => ({
-      absolute_file_path: path,
-      findings: [
-        {
-          evidence: `const value${i} = 1;`,
-          code_location: { absolute_file_path: path, line: i + 1 },
-          claim_type: 'other',
-          title: `Finding in ${path}`,
-          body: 'Body text.',
-          priority: 2,
-        },
-      ],
-      overall_explanation: `Summary for ${path}`,
-      overall_correctness: 'patch is incorrect',
-    })),
-    overall_confidence_score: 0.7,
-  };
-}
-
-describe('parseRawBatchPayload', () => {
-  // Anchoring on the first `"findings"` lands on files[0]'s brace, dropping every other file.
-  it('recovers every file, bare or fenced, with per-file verdict and summary intact', () => {
-    const payload = nested(['src/a.ts', 'src/b.ts', 'src/c.ts']);
-    payload.files[0].overall_correctness = 'patch is correct';
-    payload.files[0].overall_explanation = 'Nothing wrong here';
-
-    const bare = parseRawBatchPayload(JSON.stringify(payload));
-    if (bare.shape !== 'nested') throw new Error('expected nested');
-    expect(bare.data.files.map(f => f.absolute_file_path)).toEqual(['src/a.ts', 'src/b.ts', 'src/c.ts']);
-    expect(bare.data.files[0].overall_correctness).toBe('patch is correct');
-    expect(bare.data.files[0].overall_explanation).toBe('Nothing wrong here');
-    expect(bare.data.files[1].overall_correctness).toBe('patch is incorrect');
-
-    const fenced = parseRawBatchPayload(`Here is my review:\n\n\`\`\`json\n${JSON.stringify(payload)}\n\`\`\`\n\nLet me know.`);
-    if (fenced.shape !== 'nested') throw new Error('expected nested');
-    expect(fenced.data.files).toHaveLength(3);
-  });
-
-
-  // A truncated response repairs into JSON whose last entry has no `findings` key, so defaulting to
-  // [] would approve unexamined code. An explicit [] is honoured.
-  it('drops an entry with no findings key, but keeps an explicitly empty one', () => {
-    const complete = nested(['src/a.ts']).files[0];
-    const truncated = parseRawBatchPayload(`{"files":[${JSON.stringify(complete)},{"absolute_file_path":"src/b.ts"`);
-    if (truncated.shape !== 'nested') throw new Error('expected nested');
-    expect(truncated.data.files.map(f => f.absolute_file_path)).toEqual(['src/a.ts']);
-
-    const empty = parseRawBatchPayload(JSON.stringify({
-      files: [{ absolute_file_path: 'src/a.ts', findings: [], overall_correctness: 'patch is correct' }],
-    }));
-    if (empty.shape !== 'nested') throw new Error('expected nested');
-    expect(empty.data.files[0].findings).toEqual([]);
-  });
-
-  // A weak fallback model emits the single-file shape; without recovery the whole bin is unreviewed.
-  it('falls back to the flat shape, and throws when nothing is recognisable', () => {
-    const flat = parseRawBatchPayload(JSON.stringify({
-      findings: [{
-        evidence: 'const x = 1;',
-        code_location: { absolute_file_path: 'src/a.ts', line: 3 },
-        claim_type: 'other',
-        title: 'Flat finding',
-        body: 'Body.',
-        priority: 1,
-      }],
-      overall_correctness: 'patch is incorrect',
-      overall_explanation: 'Flat summary',
-    }));
-    expect(flat.shape).toBe('flat');
-    if (flat.shape !== 'flat') throw new Error('unreachable');
-    expect(flat.data.findings[0].code_location.absolute_file_path).toBe('src/a.ts');
-
-    // Must throw, not resolve empty: the throw falls to the next model in the chain.
-    expect(() => parseRawBatchPayload('I could not review this code.')).toThrow();
-    expect(() => parseRawBatchPayload(JSON.stringify({ files: [] }))).toThrow();
-    expect(() => parseRawBatchPayload(JSON.stringify({ files: [{ no_path_here: true }] }))).toThrow();
-  });
-});
+import { describe, expect, it } from 'vitest';
+import { parseRawBatchPayload } from '@server/core/model-output';
+
+function nested(paths: string[]) {
+  return {
+    files: paths.map((path, i) => ({
+      absolute_file_path: path,
+      findings: [
+        {
+          evidence: `const value${i} = 1;`,
+          code_location: { absolute_file_path: path, line: i + 1 },
+          claim_type: 'other',
+          title: `Finding in ${path}`,
+          body: 'Body text.',
+          priority: 2,
+        },
+      ],
+      overall_explanation: `Summary for ${path}`,
+      overall_correctness: 'patch is incorrect',
+    })),
+    overall_confidence_score: 0.7,
+  };
+}
+
+describe('parseRawBatchPayload', () => {
+  // Anchoring on the first `"findings"` lands on files[0]'s brace, dropping every other file.
+  it('recovers every file, bare or fenced, with per-file verdict and summary intact', () => {
+    const payload = nested(['src/a.ts', 'src/b.ts', 'src/c.ts']);
+    payload.files[0].overall_correctness = 'patch is correct';
+    payload.files[0].overall_explanation = 'Nothing wrong here';
+
+    const bare = parseRawBatchPayload(JSON.stringify(payload));
+    if (bare.shape !== 'nested') throw new Error('expected nested');
+    expect(bare.data.files.map(f => f.absolute_file_path)).toEqual(['src/a.ts', 'src/b.ts', 'src/c.ts']);
+    expect(bare.data.files[0].overall_correctness).toBe('patch is correct');
+    expect(bare.data.files[0].overall_explanation).toBe('Nothing wrong here');
+    expect(bare.data.files[1].overall_correctness).toBe('patch is incorrect');
+
+    const fenced = parseRawBatchPayload(`Here is my review:\n\n\`\`\`json\n${JSON.stringify(payload)}\n\`\`\`\n\nLet me know.`);
+    if (fenced.shape !== 'nested') throw new Error('expected nested');
+    expect(fenced.data.files).toHaveLength(3);
+  });
+
+
+  // A truncated response repairs into JSON whose last entry has no `findings` key, so defaulting to
+  // [] would approve unexamined code. An explicit [] is honoured.
+  it('drops an entry with no findings key, but keeps an explicitly empty one', () => {
+    const complete = nested(['src/a.ts']).files[0];
+    const truncated = parseRawBatchPayload(`{"files":[${JSON.stringify(complete)},{"absolute_file_path":"src/b.ts"`);
+    if (truncated.shape !== 'nested') throw new Error('expected nested');
+    expect(truncated.data.files.map(f => f.absolute_file_path)).toEqual(['src/a.ts']);
+
+    const empty = parseRawBatchPayload(JSON.stringify({
+      files: [{ absolute_file_path: 'src/a.ts', findings: [], overall_correctness: 'patch is correct' }],
+    }));
+    if (empty.shape !== 'nested') throw new Error('expected nested');
+    expect(empty.data.files[0].findings).toEqual([]);
+  });
+
+  // A weak fallback model emits the single-file shape; without recovery the whole bin is unreviewed.
+  it('falls back to the flat shape, and throws when nothing is recognisable', () => {
+    const flat = parseRawBatchPayload(JSON.stringify({
+      findings: [{
+        evidence: 'const x = 1;',
+        code_location: { absolute_file_path: 'src/a.ts', line: 3 },
+        claim_type: 'other',
+        title: 'Flat finding',
+        body: 'Body.',
+        priority: 1,
+      }],
+      overall_correctness: 'patch is incorrect',
+      overall_explanation: 'Flat summary',
+    }));
+    expect(flat.shape).toBe('flat');
+    if (flat.shape !== 'flat') throw new Error('unreachable');
+    expect(flat.data.findings[0].code_location.absolute_file_path).toBe('src/a.ts');
+
+    // Must throw, not resolve empty: the throw falls to the next model in the chain.
+    expect(() => parseRawBatchPayload('I could not review this code.')).toThrow();
+    expect(() => parseRawBatchPayload(JSON.stringify({ files: [] }))).toThrow();
+    expect(() => parseRawBatchPayload(JSON.stringify({ files: [{ no_path_here: true }] }))).toThrow();
+  });
+});
diff --git a/test/model/output.spec.ts b/packages/models/test/model/output.spec.ts
similarity index 100%
rename from test/model/output.spec.ts
rename to packages/models/test/model/output.spec.ts
diff --git a/test/model/rate-limit-parse.spec.ts b/packages/models/test/model/rate-limit-parse.spec.ts
similarity index 97%
rename from test/model/rate-limit-parse.spec.ts
rename to packages/models/test/model/rate-limit-parse.spec.ts
index c434ccd7..ad184af2 100644
--- a/test/model/rate-limit-parse.spec.ts
+++ b/packages/models/test/model/rate-limit-parse.spec.ts
@@ -1,77 +1,77 @@
-import { describe, expect, it } from 'vitest';
-import { isPlausibleTokenBucket, parseRateLimitFromError } from '@server/services/model';
-
-// Verbatim from production: a free-tier 429 whose only stated quota counts REQUESTS, not tokens.
-const REQUESTS_QUOTA_429 = [
-  'You exceeded your current quota, please check your plan and billing details.',
-  'For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits.',
-  'To monitor your current usage, head to: https://ai.dev/rate-limit.',
-  '* Quota exceeded for metric: generativelanguage.googleapis.com/generate_content_free_tier_requests, limit: 15, model: gemini-3.5-flash-lite',
-  'Please retry in 21.35281435s.',
-].join('\n');
-
-const TOKENS_QUOTA_429 =
-  '* Quota exceeded for metric: generativelanguage.googleapis.com/generate_content_free_tier_input_token_count, limit: 16000, model: gemini-2.5-flash Please retry in 26.9s.';
-
-describe('parseRateLimitFromError', () => {
-  // The regression: `limit: 15` is 15 requests per minute. Reading it as a 15-token bucket made
-  // skipReason refuse every prompt over 12 tokens for the rest of the job -- a model that was merely
-  // busy for a minute was taken out for 24 hours, and the whole fallback chain with it.
-  it('does not read a request-count quota as a token bucket', () => {
-    const parsed = parseRateLimitFromError(new Error(REQUESTS_QUOTA_429));
-
-    expect(parsed.limitTokens).toBeUndefined();
-    // The cool-off is still learned: the model IS rate-limited, just not by prompt size.
-    expect(parsed.retryAfterMs).toBeCloseTo(21352.81435, 3);
-  });
-
-  it('reads a genuine token quota', () => {
-    const parsed = parseRateLimitFromError(new Error(TOKENS_QUOTA_429));
-
-    expect(parsed.limitTokens).toBe(16000);
-    expect(parsed.retryAfterMs).toBe(26900);
-  });
-
-  // A body may state several violated quotas, and the request count often comes first -- which a bare
-  // /limit:\s*(\d+)/ would happily return as the bucket size.
-  it('picks the token quota out of a multi-quota body, not the first limit stated', () => {
-    const parsed = parseRateLimitFromError(new Error([
-      '* Quota exceeded for metric: generativelanguage.googleapis.com/generate_content_free_tier_requests, limit: 15, model: m',
-      '* Quota exceeded for metric: generativelanguage.googleapis.com/generate_content_free_tier_input_token_count, limit: 16000, model: m',
-    ].join('\n')));
-
-    expect(parsed.limitTokens).toBe(16000);
-  });
-
-  it('takes the smallest stated token bucket, which rejects a prompt first', () => {
-    const parsed = parseRateLimitFromError(new Error([
-      '* Quota exceeded for metric: x/input_token_count, limit: 32000, model: m',
-      '* Quota exceeded for metric: x/output_token_count, limit: 8000, model: m',
-    ].join('\n')));
-
-    expect(parsed.limitTokens).toBe(8000);
-  });
-
-  it('rejects an implausibly small token bucket even from a token metric', () => {
-    const parsed = parseRateLimitFromError(
-      new Error('* Quota exceeded for metric: x/input_token_count, limit: 15, model: m'),
-    );
-
-    expect(parsed.limitTokens).toBeUndefined();
-  });
-
-  it('returns nothing for an error that states no quota at all', () => {
-    const parsed = parseRateLimitFromError(new Error('Resource has been exhausted.'));
-
-    expect(parsed.limitTokens).toBeUndefined();
-    expect(parsed.retryAfterMs).toBeUndefined();
-  });
-});
-
-describe('isPlausibleTokenBucket', () => {
-  it('rejects request counts and accepts real buckets', () => {
-    expect(isPlausibleTokenBucket(15)).toBe(false);
-    expect(isPlausibleTokenBucket(undefined)).toBe(false);
-    expect(isPlausibleTokenBucket(16000)).toBe(true);
-  });
-});
+import { describe, expect, it } from 'vitest';
+import { isPlausibleTokenBucket, parseRateLimitFromError } from '@codra/models';
+
+// Verbatim from production: a free-tier 429 whose only stated quota counts REQUESTS, not tokens.
+const REQUESTS_QUOTA_429 = [
+  'You exceeded your current quota, please check your plan and billing details.',
+  'For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits.',
+  'To monitor your current usage, head to: https://ai.dev/rate-limit.',
+  '* Quota exceeded for metric: generativelanguage.googleapis.com/generate_content_free_tier_requests, limit: 15, model: gemini-3.5-flash-lite',
+  'Please retry in 21.35281435s.',
+].join('\n');
+
+const TOKENS_QUOTA_429 =
+  '* Quota exceeded for metric: generativelanguage.googleapis.com/generate_content_free_tier_input_token_count, limit: 16000, model: gemini-2.5-flash Please retry in 26.9s.';
+
+describe('parseRateLimitFromError', () => {
+  // The regression: `limit: 15` is 15 requests per minute. Reading it as a 15-token bucket made
+  // skipReason refuse every prompt over 12 tokens for the rest of the job -- a model that was merely
+  // busy for a minute was taken out for 24 hours, and the whole fallback chain with it.
+  it('does not read a request-count quota as a token bucket', () => {
+    const parsed = parseRateLimitFromError(new Error(REQUESTS_QUOTA_429));
+
+    expect(parsed.limitTokens).toBeUndefined();
+    // The cool-off is still learned: the model IS rate-limited, just not by prompt size.
+    expect(parsed.retryAfterMs).toBeCloseTo(21352.81435, 3);
+  });
+
+  it('reads a genuine token quota', () => {
+    const parsed = parseRateLimitFromError(new Error(TOKENS_QUOTA_429));
+
+    expect(parsed.limitTokens).toBe(16000);
+    expect(parsed.retryAfterMs).toBe(26900);
+  });
+
+  // A body may state several violated quotas, and the request count often comes first -- which a bare
+  // /limit:\s*(\d+)/ would happily return as the bucket size.
+  it('picks the token quota out of a multi-quota body, not the first limit stated', () => {
+    const parsed = parseRateLimitFromError(new Error([
+      '* Quota exceeded for metric: generativelanguage.googleapis.com/generate_content_free_tier_requests, limit: 15, model: m',
+      '* Quota exceeded for metric: generativelanguage.googleapis.com/generate_content_free_tier_input_token_count, limit: 16000, model: m',
+    ].join('\n')));
+
+    expect(parsed.limitTokens).toBe(16000);
+  });
+
+  it('takes the smallest stated token bucket, which rejects a prompt first', () => {
+    const parsed = parseRateLimitFromError(new Error([
+      '* Quota exceeded for metric: x/input_token_count, limit: 32000, model: m',
+      '* Quota exceeded for metric: x/output_token_count, limit: 8000, model: m',
+    ].join('\n')));
+
+    expect(parsed.limitTokens).toBe(8000);
+  });
+
+  it('rejects an implausibly small token bucket even from a token metric', () => {
+    const parsed = parseRateLimitFromError(
+      new Error('* Quota exceeded for metric: x/input_token_count, limit: 15, model: m'),
+    );
+
+    expect(parsed.limitTokens).toBeUndefined();
+  });
+
+  it('returns nothing for an error that states no quota at all', () => {
+    const parsed = parseRateLimitFromError(new Error('Resource has been exhausted.'));
+
+    expect(parsed.limitTokens).toBeUndefined();
+    expect(parsed.retryAfterMs).toBeUndefined();
+  });
+});
+
+describe('isPlausibleTokenBucket', () => {
+  it('rejects request counts and accepts real buckets', () => {
+    expect(isPlausibleTokenBucket(15)).toBe(false);
+    expect(isPlausibleTokenBucket(undefined)).toBe(false);
+    expect(isPlausibleTokenBucket(16000)).toBe(true);
+  });
+});
diff --git a/test/model/service-chunking.spec.ts b/packages/models/test/model/service-chunking.spec.ts
similarity index 91%
rename from test/model/service-chunking.spec.ts
rename to packages/models/test/model/service-chunking.spec.ts
index 5442a31c..0f358649 100644
--- a/test/model/service-chunking.spec.ts
+++ b/packages/models/test/model/service-chunking.spec.ts
@@ -1,241 +1,242 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { ModelService } from '@server/services/model';
-
-
-
-
-import { createTestEnv, saveTestProviderApiKey } from '../helpers';
-import { defaultRepoConfig } from '@codra/schema';
-import { TokenTracker } from '@server/core/token-tracker';
-import { geminiThinkingBudgetTokens, reviewOutputBudgetTokens } from '@server/models/limits';
-import { generatorFindingCap } from '@server/prompts/file-review';
-
-describe('ModelService: diff chunking', () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it('splits an oversized diff into capped chunks and reviews each in its own call', async () => {
-    const requestBodies: any[] = [];
-    const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async (_url, init) => {
-      requestBodies.push(JSON.parse(String(init?.body)));
-      return new Response(
-        JSON.stringify({
-          candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
-          usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-        }),
-        { status: 200, headers: { 'content-type': 'application/json' } },
-      );
-    });
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env);
-    const largeFile = {
-      path: 'src/large.ts',
-      previousPath: null,
-      isNew: false,
-      isDeleted: false,
-      isBinary: false,
-      lineCount: 900,
-      hunks: [
-        {
-          header: '@@ -1,900 +1,900 @@',
-          lines: Array.from({ length: 900 }, (_, index) => ({
-            kind: 'add' as const,
-            content: `const value${index} = ${index};`,
-            newLineNumber: index + 1,
-            position: index + 1,
-          })),
-        },
-      ],
-    };
-
-    const response = await service.reviewFile({
-      file: largeFile,
-      prTitle: 'Test',
-      prDescription: null,
-      config: {
-        ...defaultRepoConfig,
-        model: {
-          main: 'gemini-3.1-pro-preview',
-          fallbacks: [],
-          size_overrides: [],
-        },
-      },
-      totalLineCount: 500,
-    });
-
-    // 900 lines at the 800-line cap: two chunks, each its own model call.
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    const answerBudget = reviewOutputBudgetTokens({
-      findingCap: generatorFindingCap(defaultRepoConfig.review.max_comments),
-      fileCount: 1,
-    });
-    for (const body of requestBodies) {
-      // Room for the findings the prompt asked for, PLUS a bounded thinking budget on top -- thinking
-      // bills against the same ceiling, so sharing one flat 8192 truncated the JSON.
-      expect(body.generationConfig.thinkingConfig.thinkingBudget)
-        .toBe(geminiThinkingBudgetTokens(answerBudget));
-      expect(body.generationConfig.maxOutputTokens)
-        .toBe(answerBudget + geminiThinkingBudgetTokens(answerBudget));
-      // Proves the review grammar survives reviewFile -> callResolvedModel -> adapter.
-      expect(body.generationConfig.responseJsonSchema).toBeDefined();
-    }
-    const firstPrompt = requestBodies[0].contents[0].parts[0].text as string;
-    expect(firstPrompt).toContain('const value799 = 799;');
-    expect(firstPrompt).not.toContain('const value800 = 800;');
-    const secondPrompt = requestBodies[1].contents[0].parts[0].text as string;
-    expect(secondPrompt).toContain('const value800 = 800;');
-    expect(secondPrompt).toContain('const value899 = 899;');
-    // The whole file is covered across the chunks, so nothing is dropped as truncated.
-    expect(response.reviewedLineCount).toBe(900);
-    expect(response.wasPromptTruncated).toBe(false);
-  });
-
-  // A flat cap of 4 silently dropped everything past line 3,200. The raise to 8 is opportunistic:
-  // chunks past the 4th run only on spare budget, so one runaway file can't starve its peers.
-
-  describe('the opportunistic chunk tail', () => {
-    const okResponse = () => new Response(
-      JSON.stringify({
-        candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
-        usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-      }),
-      { status: 200, headers: { 'content-type': 'application/json' } },
-    );
-
-    const hugeFile = (lines: number) => ({
-      path: 'src/server/core/review.ts',
-      previousPath: null,
-      isNew: false,
-      isDeleted: false,
-      isBinary: false,
-      lineCount: lines,
-      hunks: [{
-        header: `@@ -1,${lines} +1,${lines} @@`,
-        lines: Array.from({ length: lines }, (_, index) => ({
-          kind: 'add' as const,
-          content: `const value${index} = ${index};`,
-          newLineNumber: index + 1,
-          position: index + 1,
-        })),
-      }],
-    });
-
-    const reviewHugeFile = async (service: ModelService, lines: number) => service.reviewFile({
-      file: hugeFile(lines),
-      prTitle: 'Test',
-      prDescription: null,
-      config: {
-        ...defaultRepoConfig,
-        model: { main: 'gemini-3.1-pro-preview', fallbacks: [], size_overrides: [] },
-      },
-      totalLineCount: lines,
-    });
-
-    it('reviews past the old four-chunk ceiling when the budget is healthy', async () => {
-      const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => okResponse());
-      const env = createTestEnv();
-      await saveTestProviderApiKey(env);
-      // A fresh tracker has the full safe budget, so the tail is affordable.
-      const service = new ModelService(env, new TokenTracker());
-
-      // 3,749 lines at the 800-line cap is 5 chunks; the old cap dropped the fifth.
-      const response = await reviewHugeFile(service, 3_749);
-
-      expect(fetchMock).toHaveBeenCalledTimes(5);
-      expect(response.reviewedLineCount).toBe(3_749);
-      expect(response.wasPromptTruncated).toBe(false);
-    });
-
-    it('stops at the base chunks and reports truncation when the budget is committed elsewhere', async () => {
-      const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => okResponse());
-      const env = createTestEnv();
-      await saveTestProviderApiKey(env);
-      const tracker = new TokenTracker();
-      // Below isNearLimit (25) but not enough spare for the tail once the base chunks have run.
-      tracker.incrementSubrequests(18);
-      const service = new ModelService(env, tracker);
-
-      const response = await reviewHugeFile(service, 3_749);
-
-      // Four reviewed, the fifth yielded and reported as truncated rather than clean.
-      expect(fetchMock).toHaveBeenCalledTimes(4);
-      expect(response.reviewedLineCount).toBe(3_200);
-      expect(response.wasPromptTruncated).toBe(true);
-    });
-
-    it('still refuses to review a file in more than MAX_CHUNKS calls', async () => {
-      const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => okResponse());
-      const env = createTestEnv();
-      await saveTestProviderApiKey(env);
-      const service = new ModelService(env, new TokenTracker());
-
-      // 20,000 lines is 25 chunks: the hard cap must bind and report truncation.
-      const response = await reviewHugeFile(service, 20_000);
-
-      expect(fetchMock).toHaveBeenCalledTimes(8);
-      expect(response.wasPromptTruncated).toBe(true);
-    });
-  });
-
-  it('applies the compact prompt cap by producing smaller chunks after a prior transient failure', async () => {
-    const requestBodies: any[] = [];
-    vi.spyOn(globalThis, 'fetch').mockImplementation(async (_url, init) => {
-      requestBodies.push(JSON.parse(String(init?.body)));
-      return new Response(
-        JSON.stringify({
-          candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
-          usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-        }),
-        { status: 200, headers: { 'content-type': 'application/json' } },
-      );
-    });
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env);
-    const largeFile = {
-      path: 'src/large.ts',
-      previousPath: null,
-      isNew: false,
-      isDeleted: false,
-      isBinary: false,
-      lineCount: 900,
-      hunks: [
-        {
-          header: '@@ -1,900 +1,900 @@',
-          lines: Array.from({ length: 900 }, (_, index) => ({
-            kind: 'add' as const,
-            content: `const value${index} = ${index};`,
-            newLineNumber: index + 1,
-            position: index + 1,
-          })),
-        },
-      ],
-    };
-
-    const response = await service.reviewFile({
-      file: largeFile,
-      prTitle: 'Test',
-      prDescription: null,
-      config: {
-        ...defaultRepoConfig,
-        model: {
-          main: 'gemini-3.1-pro-preview',
-          fallbacks: [],
-          size_overrides: [],
-        },
-      },
-      totalLineCount: 900,
-      compactPrompt: true,
-    });
-
-    // compactPrompt lowers the per-call cap to 400, so 900 lines becomes three chunks, not two.
-    expect(requestBodies.length).toBe(3);
-    const firstPrompt = requestBodies[0].contents[0].parts[0].text as string;
-    expect(firstPrompt).toContain('const value399 = 399;');
-    expect(firstPrompt).not.toContain('const value400 = 400;');
-    expect(response.reviewedLineCount).toBe(900);
-    expect(response.wasPromptTruncated).toBe(false);
-  });
-});
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { ModelRunner } from '@codra/models';
+
+
+
+
+
+import { createTestEnv, saveTestProviderApiKey, createTestModelRunner } from '../../../../test/helpers';
+import { defaultRepoConfig } from '@codra/schema';
+import { TokenTracker } from '@server/core/token-tracker';
+import { geminiThinkingBudgetTokens, reviewOutputBudgetTokens } from '../../src/limits';
+import { generatorFindingCap } from '@server/prompts/file-review';
+
+describe('ModelRunner: diff chunking', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('splits an oversized diff into capped chunks and reviews each in its own call', async () => {
+    const requestBodies: any[] = [];
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async (_url, init) => {
+      requestBodies.push(JSON.parse(String(init?.body)));
+      return new Response(
+        JSON.stringify({
+          candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
+          usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      );
+    });
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const service = createTestModelRunner(env);
+    const largeFile = {
+      path: 'src/large.ts',
+      previousPath: null,
+      isNew: false,
+      isDeleted: false,
+      isBinary: false,
+      lineCount: 900,
+      hunks: [
+        {
+          header: '@@ -1,900 +1,900 @@',
+          lines: Array.from({ length: 900 }, (_, index) => ({
+            kind: 'add' as const,
+            content: `const value${index} = ${index};`,
+            newLineNumber: index + 1,
+            position: index + 1,
+          })),
+        },
+      ],
+    };
+
+    const response = await service.reviewFile({
+      file: largeFile,
+      prTitle: 'Test',
+      prDescription: null,
+      config: {
+        ...defaultRepoConfig,
+        model: {
+          main: 'gemini-3.1-pro-preview',
+          fallbacks: [],
+          size_overrides: [],
+        },
+      },
+      totalLineCount: 500,
+    });
+
+    // 900 lines at the 800-line cap: two chunks, each its own model call.
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    const answerBudget = reviewOutputBudgetTokens({
+      findingCap: generatorFindingCap(defaultRepoConfig.review.max_comments),
+      fileCount: 1,
+    });
+    for (const body of requestBodies) {
+      // Room for the findings the prompt asked for, PLUS a bounded thinking budget on top -- thinking
+      // bills against the same ceiling, so sharing one flat 8192 truncated the JSON.
+      expect(body.generationConfig.thinkingConfig.thinkingBudget)
+        .toBe(geminiThinkingBudgetTokens(answerBudget));
+      expect(body.generationConfig.maxOutputTokens)
+        .toBe(answerBudget + geminiThinkingBudgetTokens(answerBudget));
+      // Proves the review grammar survives reviewFile -> callResolvedModel -> adapter.
+      expect(body.generationConfig.responseJsonSchema).toBeDefined();
+    }
+    const firstPrompt = requestBodies[0].contents[0].parts[0].text as string;
+    expect(firstPrompt).toContain('const value799 = 799;');
+    expect(firstPrompt).not.toContain('const value800 = 800;');
+    const secondPrompt = requestBodies[1].contents[0].parts[0].text as string;
+    expect(secondPrompt).toContain('const value800 = 800;');
+    expect(secondPrompt).toContain('const value899 = 899;');
+    // The whole file is covered across the chunks, so nothing is dropped as truncated.
+    expect(response.reviewedLineCount).toBe(900);
+    expect(response.wasPromptTruncated).toBe(false);
+  });
+
+  // A flat cap of 4 silently dropped everything past line 3,200. The raise to 8 is opportunistic:
+  // chunks past the 4th run only on spare budget, so one runaway file can't starve its peers.
+
+  describe('the opportunistic chunk tail', () => {
+    const okResponse = () => new Response(
+      JSON.stringify({
+        candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
+        usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+      }),
+      { status: 200, headers: { 'content-type': 'application/json' } },
+    );
+
+    const hugeFile = (lines: number) => ({
+      path: 'src/server/core/review.ts',
+      previousPath: null,
+      isNew: false,
+      isDeleted: false,
+      isBinary: false,
+      lineCount: lines,
+      hunks: [{
+        header: `@@ -1,${lines} +1,${lines} @@`,
+        lines: Array.from({ length: lines }, (_, index) => ({
+          kind: 'add' as const,
+          content: `const value${index} = ${index};`,
+          newLineNumber: index + 1,
+          position: index + 1,
+        })),
+      }],
+    });
+
+    const reviewHugeFile = async (service: ModelRunner, lines: number) => service.reviewFile({
+      file: hugeFile(lines),
+      prTitle: 'Test',
+      prDescription: null,
+      config: {
+        ...defaultRepoConfig,
+        model: { main: 'gemini-3.1-pro-preview', fallbacks: [], size_overrides: [] },
+      },
+      totalLineCount: lines,
+    });
+
+    it('reviews past the old four-chunk ceiling when the budget is healthy', async () => {
+      const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => okResponse());
+      const env = createTestEnv();
+      await saveTestProviderApiKey(env);
+      // A fresh tracker has the full safe budget, so the tail is affordable.
+      const service = createTestModelRunner(env, new TokenTracker());
+
+      // 3,749 lines at the 800-line cap is 5 chunks; the old cap dropped the fifth.
+      const response = await reviewHugeFile(service, 3_749);
+
+      expect(fetchMock).toHaveBeenCalledTimes(5);
+      expect(response.reviewedLineCount).toBe(3_749);
+      expect(response.wasPromptTruncated).toBe(false);
+    });
+
+    it('stops at the base chunks and reports truncation when the budget is committed elsewhere', async () => {
+      const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => okResponse());
+      const env = createTestEnv();
+      await saveTestProviderApiKey(env);
+      const tracker = new TokenTracker();
+      // Below isNearLimit (25) but not enough spare for the tail once the base chunks have run.
+      tracker.incrementSubrequests(18);
+      const service = createTestModelRunner(env, tracker);
+
+      const response = await reviewHugeFile(service, 3_749);
+
+      // Four reviewed, the fifth yielded and reported as truncated rather than clean.
+      expect(fetchMock).toHaveBeenCalledTimes(4);
+      expect(response.reviewedLineCount).toBe(3_200);
+      expect(response.wasPromptTruncated).toBe(true);
+    });
+
+    it('still refuses to review a file in more than MAX_CHUNKS calls', async () => {
+      const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => okResponse());
+      const env = createTestEnv();
+      await saveTestProviderApiKey(env);
+      const service = createTestModelRunner(env, new TokenTracker());
+
+      // 20,000 lines is 25 chunks: the hard cap must bind and report truncation.
+      const response = await reviewHugeFile(service, 20_000);
+
+      expect(fetchMock).toHaveBeenCalledTimes(8);
+      expect(response.wasPromptTruncated).toBe(true);
+    });
+  });
+
+  it('applies the compact prompt cap by producing smaller chunks after a prior transient failure', async () => {
+    const requestBodies: any[] = [];
+    vi.spyOn(globalThis, 'fetch').mockImplementation(async (_url, init) => {
+      requestBodies.push(JSON.parse(String(init?.body)));
+      return new Response(
+        JSON.stringify({
+          candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
+          usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      );
+    });
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const service = createTestModelRunner(env);
+    const largeFile = {
+      path: 'src/large.ts',
+      previousPath: null,
+      isNew: false,
+      isDeleted: false,
+      isBinary: false,
+      lineCount: 900,
+      hunks: [
+        {
+          header: '@@ -1,900 +1,900 @@',
+          lines: Array.from({ length: 900 }, (_, index) => ({
+            kind: 'add' as const,
+            content: `const value${index} = ${index};`,
+            newLineNumber: index + 1,
+            position: index + 1,
+          })),
+        },
+      ],
+    };
+
+    const response = await service.reviewFile({
+      file: largeFile,
+      prTitle: 'Test',
+      prDescription: null,
+      config: {
+        ...defaultRepoConfig,
+        model: {
+          main: 'gemini-3.1-pro-preview',
+          fallbacks: [],
+          size_overrides: [],
+        },
+      },
+      totalLineCount: 900,
+      compactPrompt: true,
+    });
+
+    // compactPrompt lowers the per-call cap to 400, so 900 lines becomes three chunks, not two.
+    expect(requestBodies.length).toBe(3);
+    const firstPrompt = requestBodies[0].contents[0].parts[0].text as string;
+    expect(firstPrompt).toContain('const value399 = 399;');
+    expect(firstPrompt).not.toContain('const value400 = 400;');
+    expect(response.reviewedLineCount).toBe(900);
+    expect(response.wasPromptTruncated).toBe(false);
+  });
+});
diff --git a/test/model/service-fallbacks.spec.ts b/packages/models/test/model/service-fallbacks.spec.ts
similarity index 92%
rename from test/model/service-fallbacks.spec.ts
rename to packages/models/test/model/service-fallbacks.spec.ts
index 5307bc26..6ffbbb51 100644
--- a/test/model/service-fallbacks.spec.ts
+++ b/packages/models/test/model/service-fallbacks.spec.ts
@@ -1,416 +1,416 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { isRetryableModelError, ModelService } from '@server/services/model';
-
-
-import { createTestEnv, saveTestProviderApiKey } from '../helpers';
-import { defaultRepoConfig } from '@codra/schema';
-import { TokenTracker } from '@server/core/token-tracker';
-
-// Walking the model chain: fallback, the two subrequest-budget breakers, and marking a provider
-// unavailable. The inline retry ladder lives in service-retries.spec.ts.
-describe('ModelService: chain fallback, budget breakers and provider availability', () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it('tries the smaller Google fallback after the primary Google model fails', async () => {
-    let cloudflareCalls = 0;
-    const gemini500 = () =>
-      new Response(
-        JSON.stringify({ error: { code: 500, message: 'Internal error encountered.', status: 'INTERNAL' } }),
-        { status: 500, headers: { 'content-type': 'application/json' } },
-      );
-    // The primary makes 3 attempts before failing over; the fallback succeeds on the 4th call.
-    const fetchMock = vi.spyOn(globalThis, 'fetch')
-      .mockResolvedValueOnce(gemini500())
-      .mockResolvedValueOnce(gemini500())
-      .mockResolvedValueOnce(gemini500())
-      .mockResolvedValueOnce(
-        new Response(
-          JSON.stringify({
-            candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
-            usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-          }),
-          { status: 200, headers: { 'content-type': 'application/json' } },
-        ),
-      );
-    const env = createTestEnv({
-      AI: {
-        async run() {
-          cloudflareCalls++;
-          return {
-            response: JSON.stringify({
-              findings: [],
-              overall_correctness: 'patch is correct',
-              overall_explanation: 'ok',
-              overall_confidence_score: 0.9,
-            }),
-            usage: { prompt_tokens: 1, completion_tokens: 1 },
-          };
-        },
-      } as any,
-    });
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env);
-
-    const response = await service.reviewFile({
-      file: {
-        path: 'src/app.ts',
-        lineCount: 1,
-        hunks: [],
-        isDeleted: false,
-        isBinary: false,
-        isNew: false,
-        previousPath: null,
-      },
-      prTitle: 'Test',
-      prDescription: null,
-      config: {
-        ...defaultRepoConfig,
-        model: {
-          main: 'gemini-3.1-pro-preview',
-          fallbacks: ['gemini-2.5-pro', '@cf/zai-org/glm-4.7-flash'],
-          size_overrides: [],
-        },
-      },
-      totalLineCount: 1,
-    });
-
-    expect(fetchMock).toHaveBeenCalledTimes(4);
-    expect(String(fetchMock.mock.calls[0][0])).toContain('/models/gemini-3.1-pro-preview:generateContent');
-    expect(String(fetchMock.mock.calls[1][0])).toContain('/models/gemini-3.1-pro-preview:generateContent');
-    expect(String(fetchMock.mock.calls[2][0])).toContain('/models/gemini-3.1-pro-preview:generateContent');
-    expect(String(fetchMock.mock.calls[3][0])).toContain('/models/gemini-2.5-pro:generateContent');
-    expect(cloudflareCalls).toBe(0);
-    expect(response.modelUsed).toBe('gemini-2.5-pro');
-  });
-
-  // Parse lives inside the per-model try: an unreadable 200 is that model's failure.
-  it('falls through to the next model when the primary returns an unparseable body', async () => {
-    const geminiText = (text: string) => new Response(
-      JSON.stringify({
-        candidates: [{ content: { parts: [{ text }] } }],
-        usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-      }),
-      { status: 200, headers: { 'content-type': 'application/json' } },
-    );
-    const fetchMock = vi.spyOn(globalThis, 'fetch')
-      .mockResolvedValueOnce(geminiText('I am unable to review this diff.'))
-      .mockResolvedValueOnce(geminiText('{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}'));
-
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env);
-
-    const response = await service.reviewFile({
-      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
-      prTitle: 'Test',
-      prDescription: null,
-      config: {
-        ...defaultRepoConfig,
-        model: { main: 'gemini-3.1-pro-preview', fallbacks: ['gemini-2.5-pro'], size_overrides: [] },
-      },
-      totalLineCount: 1,
-    });
-
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(response.modelUsed).toBe('gemini-2.5-pro');
-  });
-
-  // Three `continue` paths can leave the loop with `lastError` undefined, which matches no retry
-  // predicate and fails the file permanently.
-  it('defers rather than throwing undefined when every model is skipped', async () => {
-    const fetchMock = vi.spyOn(globalThis, 'fetch');
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env);
-    // A learned bucket below the prompt size makes skipReason refuse every model.
-    (service as unknown as { rateLimits: { skipReason: () => string } }).rateLimits.skipReason = () => 'prompt too large for its bucket';
-
-    const promise = service.reviewFile({
-      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
-      prTitle: 'Test',
-      prDescription: null,
-      config: {
-        ...defaultRepoConfig,
-        model: { main: 'gemini-3.1-pro-preview', fallbacks: ['gemini-2.5-pro'], size_overrides: [] },
-      },
-      totalLineCount: 1,
-    });
-
-    await expect(promise).rejects.toThrow(/No configured review model was attempted/);
-    await promise.catch((error) => expect(isRetryableModelError(error)).toBe(true));
-    expect(fetchMock).not.toHaveBeenCalled();
-  });
-
-  // Regression: the tail of the chain used to be exempt from the timeout breaker entirely, so a model
-  // that had never once answered on a job still cost every unit a full per-call budget -- 20 batches
-  // and 15 minutes of wall clock in production, all of it spent to re-learn the tally's verdict.
-  it('drops even the last candidate once it has never answered on this job', async () => {
-    const fetchMock = vi.spyOn(globalThis, 'fetch');
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-
-    // Six strikes: past the tail's higher bar, which a merely-slow model does not reach.
-    await env.APP_KV.put(
-      'jobs:job-tail-drop:chain-progress',
-      JSON.stringify({ timeouts: { 'gemini-3.1-pro-preview': 6, 'gemini-2.5-pro': 6 } }),
-    );
-    const service = new ModelService(env, undefined, { jobId: 'job-tail-drop' });
-
-    const promise = service.reviewFile({
-      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
-      prTitle: 'Test',
-      prDescription: null,
-      config: {
-        ...defaultRepoConfig,
-        model: { main: 'gemini-3.1-pro-preview', fallbacks: ['gemini-2.5-pro'], size_overrides: [] },
-      },
-      totalLineCount: 1,
-    });
-
-    // Deferred, and the message says which of the two skip reasons applied.
-    await expect(promise).rejects.toThrow(/No configured review model was attempted.*repeated timeouts/);
-    await promise.catch((error) => expect(isRetryableModelError(error)).toBe(true));
-    // The whole point: not one call was paid for.
-    expect(fetchMock).not.toHaveBeenCalled();
-  });
-
-  // The other side of the same rule: a merely-slow tail still gets its shot, because deferring with no
-  // model attempted is the worse outcome when the model does sometimes answer.
-  it('still tries the last candidate when it is only mid-chain slow', async () => {
-    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(
-        JSON.stringify({
-          candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
-          usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-        }),
-        { status: 200, headers: { 'content-type': 'application/json' } },
-      ),
-    );
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-
-    // Three strikes drops a model mid-chain but not at the tail.
-    await env.APP_KV.put(
-      'jobs:job-tail-slow:chain-progress',
-      JSON.stringify({ timeouts: { 'gemini-3.1-pro-preview': 3, 'gemini-2.5-pro': 3 } }),
-    );
-    const service = new ModelService(env, undefined, { jobId: 'job-tail-slow' });
-
-    const response = await service.reviewFile({
-      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
-      prTitle: 'Test',
-      prDescription: null,
-      config: {
-        ...defaultRepoConfig,
-        model: { main: 'gemini-3.1-pro-preview', fallbacks: ['gemini-2.5-pro'], size_overrides: [] },
-      },
-      totalLineCount: 1,
-    });
-
-    // The struck primary is skipped, the tail is attempted anyway, and it answers.
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(String(fetchMock.mock.calls[0][0])).toContain('/models/gemini-2.5-pro:generateContent');
-    expect(response.modelUsed).toBe('gemini-2.5-pro');
-  });
-
-  it('surfaces a permanent config error rather than deferring', async () => {
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env);
-
-    const promise = service.reviewFile({
-      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
-      prTitle: 'Test',
-      prDescription: null,
-      config: {
-        ...defaultRepoConfig,
-        model: { main: 'definitely-not-a-configured-model', fallbacks: [], size_overrides: [] },
-      },
-      totalLineCount: 1,
-    });
-
-    await expect(promise).rejects.toThrow(/is not configured/);
-    await promise.catch((error) => expect(isRetryableModelError(error)).toBe(false));
-  });
-
-  it('still tries the primary model even when the shared job budget is already near the subrequest limit', async () => {
-    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(
-        JSON.stringify({
-          candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
-          usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-        }),
-        { status: 200, headers: { 'content-type': 'application/json' } },
-      ),
-    );
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const tracker = new TokenTracker();
-    tracker.incrementSubrequests(40); // above the near-limit threshold (MAX_SUBREQUESTS 50 - SAFE_MARGIN 25)
-    const service = new ModelService(env, tracker);
-
-    const response = await service.reviewFile({
-      file: {
-        path: 'src/app.ts',
-        lineCount: 1,
-        hunks: [],
-        isDeleted: false,
-        isBinary: false,
-        isNew: false,
-        previousPath: null,
-      },
-      prTitle: 'Test',
-      prDescription: null,
-      config: {
-        ...defaultRepoConfig,
-        model: {
-          main: 'gemini-3.1-pro-preview',
-          fallbacks: ['gemini-2.5-pro'],
-          size_overrides: [],
-        },
-      },
-      totalLineCount: 1,
-    });
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-    expect(response.modelUsed).toBe('gemini-3.1-pro-preview');
-  });
-
-  // The counterpart to the test above: the primary gets its shot at a merely-tight budget, but not at
-  // one that cannot cover the call. Previously it transmitted the prompt regardless and the runtime
-  // refused it, losing the unit AND the prompt -- three files' worth in one observed invocation.
-  it('will not commit a prompt when the budget cannot cover the call', async () => {
-    const fetchMock = vi.spyOn(globalThis, 'fetch');
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const tracker = new TokenTracker();
-    // Leaves 5 of the 50-subrequest cap, under the headroom one call may need.
-    tracker.incrementSubrequests(45);
-    const service = new ModelService(env, tracker);
-
-    const promise = service.reviewFile({
-      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
-      prTitle: 'Test',
-      prDescription: null,
-      config: {
-        ...defaultRepoConfig,
-        model: { main: 'gemini-3.1-pro-preview', fallbacks: ['gemini-2.5-pro'], size_overrides: [] },
-      },
-      totalLineCount: 1,
-    });
-
-    // Deferred, not failed: a fresh invocation has a fresh budget.
-    await expect(promise).rejects.toThrow(/retrying later/);
-    await promise.catch((error) => expect(isRetryableModelError(error)).toBe(true));
-    // The whole point -- nothing went over the wire.
-    expect(fetchMock).not.toHaveBeenCalled();
-  });
-
-  it('skips remaining fallback models (instead of spending more of the shared budget) once near the subrequest limit', async () => {
-    // The primary retries internally, so return a fresh Response per call (a body reads once).
-    // 503, not 500: only a genuinely transient failure produces a retryable deferral.
-    const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () =>
-      new Response(
-        JSON.stringify({ error: { code: 503, message: 'The model is overloaded and currently unavailable.', status: 'UNAVAILABLE' } }),
-        { status: 503, headers: { 'content-type': 'application/json' } },
-      ),
-    );
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const tracker = new TokenTracker();
-    tracker.incrementSubrequests(40); // above the near-limit threshold (MAX_SUBREQUESTS 50 - SAFE_MARGIN 25)
-    const service = new ModelService(env, tracker);
-
-    await expect(
-      service.reviewFile({
-        file: {
-          path: 'src/app.ts',
-          lineCount: 1,
-          hunks: [],
-          isDeleted: false,
-          isBinary: false,
-          isNew: false,
-          previousPath: null,
-        },
-        prTitle: 'Test',
-        prDescription: null,
-        config: {
-          ...defaultRepoConfig,
-          model: {
-            main: 'gemini-3.1-pro-preview',
-            fallbacks: ['gemini-2.5-pro'],
-            size_overrides: [],
-          },
-        },
-        totalLineCount: 1,
-      }),
-    ).rejects.toSatisfy(isRetryableModelError);
-
-    // Only the primary model was attempted; the fallback was skipped rather than risking tipping
-    // the shared invocation over Cloudflare's subrequest cap, deferring the file for a later retry.
-    expect(fetchMock.mock.calls.length).toBeGreaterThan(0);
-    for (const call of fetchMock.mock.calls) {
-      expect(String(call[0])).toContain('/models/gemini-3.1-pro-preview:generateContent');
-    }
-  });
-
-  it('skips Cloudflare for the rest of a job after allocation is exhausted', async () => {
-    let cloudflareCalls = 0;
-    const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () =>
-      new Response(
-        JSON.stringify({
-          candidates: [{ content: { parts: [{ text: '{"findings":[]}' }] } }],
-          usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-        }),
-        { status: 200, headers: { 'content-type': 'application/json' } },
-      ),
-    );
-    const env = createTestEnv({
-      AI: {
-        async run() {
-          cloudflareCalls++;
-          throw new Error('Cloudflare daily free allocation exhausted (4006)');
-        },
-      } as any,
-    });
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env, undefined, { jobId: 'job-provider-skip' });
-    const file = {
-      path: 'src/app.ts',
-      lineCount: 1,
-      hunks: [],
-      isDeleted: false,
-      isBinary: false,
-      isNew: false,
-      previousPath: null,
-    };
-    const config = {
-      ...defaultRepoConfig,
-      model: {
-        main: '@cf/zai-org/glm-4.7-flash',
-        fallbacks: ['gemini-3.1-pro-preview'],
-        size_overrides: [],
-      },
-    };
-
-    await service.reviewFile({
-      file,
-      prTitle: 'Test',
-      prDescription: null,
-      config,
-      totalLineCount: 1,
-    });
-    await service.reviewFile({
-      file: { ...file, path: 'src/other.ts' },
-      prTitle: 'Test',
-      prDescription: null,
-      config,
-      totalLineCount: 1,
-    });
-
-    expect(cloudflareCalls).toBe(1);
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-  });
-});
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { isRetryableModelError } from '@codra/models';
+
+
+import { createTestEnv, saveTestProviderApiKey, createTestModelRunner } from '../../../../test/helpers';
+import { defaultRepoConfig } from '@codra/schema';
+import { TokenTracker } from '@server/core/token-tracker';
+
+// Walking the model chain: fallback, the two subrequest-budget breakers, and marking a provider
+// unavailable. The inline retry ladder lives in service-retries.spec.ts.
+describe('ModelRunner: chain fallback, budget breakers and provider availability', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('tries the smaller Google fallback after the primary Google model fails', async () => {
+    let cloudflareCalls = 0;
+    const gemini500 = () =>
+      new Response(
+        JSON.stringify({ error: { code: 500, message: 'Internal error encountered.', status: 'INTERNAL' } }),
+        { status: 500, headers: { 'content-type': 'application/json' } },
+      );
+    // The primary makes 3 attempts before failing over; the fallback succeeds on the 4th call.
+    const fetchMock = vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(gemini500())
+      .mockResolvedValueOnce(gemini500())
+      .mockResolvedValueOnce(gemini500())
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
+            usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+          }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        ),
+      );
+    const env = createTestEnv({
+      AI: {
+        async run() {
+          cloudflareCalls++;
+          return {
+            response: JSON.stringify({
+              findings: [],
+              overall_correctness: 'patch is correct',
+              overall_explanation: 'ok',
+              overall_confidence_score: 0.9,
+            }),
+            usage: { prompt_tokens: 1, completion_tokens: 1 },
+          };
+        },
+      } as any,
+    });
+    await saveTestProviderApiKey(env);
+    const service = createTestModelRunner(env);
+
+    const response = await service.reviewFile({
+      file: {
+        path: 'src/app.ts',
+        lineCount: 1,
+        hunks: [],
+        isDeleted: false,
+        isBinary: false,
+        isNew: false,
+        previousPath: null,
+      },
+      prTitle: 'Test',
+      prDescription: null,
+      config: {
+        ...defaultRepoConfig,
+        model: {
+          main: 'gemini-3.1-pro-preview',
+          fallbacks: ['gemini-2.5-pro', '@cf/zai-org/glm-4.7-flash'],
+          size_overrides: [],
+        },
+      },
+      totalLineCount: 1,
+    });
+
+    expect(fetchMock).toHaveBeenCalledTimes(4);
+    expect(String(fetchMock.mock.calls[0][0])).toContain('/models/gemini-3.1-pro-preview:generateContent');
+    expect(String(fetchMock.mock.calls[1][0])).toContain('/models/gemini-3.1-pro-preview:generateContent');
+    expect(String(fetchMock.mock.calls[2][0])).toContain('/models/gemini-3.1-pro-preview:generateContent');
+    expect(String(fetchMock.mock.calls[3][0])).toContain('/models/gemini-2.5-pro:generateContent');
+    expect(cloudflareCalls).toBe(0);
+    expect(response.modelUsed).toBe('gemini-2.5-pro');
+  });
+
+  // Parse lives inside the per-model try: an unreadable 200 is that model's failure.
+  it('falls through to the next model when the primary returns an unparseable body', async () => {
+    const geminiText = (text: string) => new Response(
+      JSON.stringify({
+        candidates: [{ content: { parts: [{ text }] } }],
+        usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+      }),
+      { status: 200, headers: { 'content-type': 'application/json' } },
+    );
+    const fetchMock = vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(geminiText('I am unable to review this diff.'))
+      .mockResolvedValueOnce(geminiText('{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}'));
+
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const service = createTestModelRunner(env);
+
+    const response = await service.reviewFile({
+      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
+      prTitle: 'Test',
+      prDescription: null,
+      config: {
+        ...defaultRepoConfig,
+        model: { main: 'gemini-3.1-pro-preview', fallbacks: ['gemini-2.5-pro'], size_overrides: [] },
+      },
+      totalLineCount: 1,
+    });
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(response.modelUsed).toBe('gemini-2.5-pro');
+  });
+
+  // Three `continue` paths can leave the loop with `lastError` undefined, which matches no retry
+  // predicate and fails the file permanently.
+  it('defers rather than throwing undefined when every model is skipped', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch');
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const service = createTestModelRunner(env);
+    // A learned bucket below the prompt size makes skipReason refuse every model.
+    (service as unknown as { rateLimits: { skipReason: () => string } }).rateLimits.skipReason = () => 'prompt too large for its bucket';
+
+    const promise = service.reviewFile({
+      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
+      prTitle: 'Test',
+      prDescription: null,
+      config: {
+        ...defaultRepoConfig,
+        model: { main: 'gemini-3.1-pro-preview', fallbacks: ['gemini-2.5-pro'], size_overrides: [] },
+      },
+      totalLineCount: 1,
+    });
+
+    await expect(promise).rejects.toThrow(/No configured review model was attempted/);
+    await promise.catch((error) => expect(isRetryableModelError(error)).toBe(true));
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  // Regression: the tail of the chain used to be exempt from the timeout breaker entirely, so a model
+  // that had never once answered on a job still cost every unit a full per-call budget -- 20 batches
+  // and 15 minutes of wall clock in production, all of it spent to re-learn the tally's verdict.
+  it('drops even the last candidate once it has never answered on this job', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch');
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+
+    // Six strikes: past the tail's higher bar, which a merely-slow model does not reach.
+    await env.APP_KV.put(
+      'jobs:job-tail-drop:chain-progress',
+      JSON.stringify({ timeouts: { 'gemini-3.1-pro-preview': 6, 'gemini-2.5-pro': 6 } }),
+    );
+    const service = createTestModelRunner(env, undefined, { jobId: 'job-tail-drop' });
+
+    const promise = service.reviewFile({
+      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
+      prTitle: 'Test',
+      prDescription: null,
+      config: {
+        ...defaultRepoConfig,
+        model: { main: 'gemini-3.1-pro-preview', fallbacks: ['gemini-2.5-pro'], size_overrides: [] },
+      },
+      totalLineCount: 1,
+    });
+
+    // Deferred, and the message says which of the two skip reasons applied.
+    await expect(promise).rejects.toThrow(/No configured review model was attempted.*repeated timeouts/);
+    await promise.catch((error) => expect(isRetryableModelError(error)).toBe(true));
+    // The whole point: not one call was paid for.
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  // The other side of the same rule: a merely-slow tail still gets its shot, because deferring with no
+  // model attempted is the worse outcome when the model does sometimes answer.
+  it('still tries the last candidate when it is only mid-chain slow', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({
+          candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
+          usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      ),
+    );
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+
+    // Three strikes drops a model mid-chain but not at the tail.
+    await env.APP_KV.put(
+      'jobs:job-tail-slow:chain-progress',
+      JSON.stringify({ timeouts: { 'gemini-3.1-pro-preview': 3, 'gemini-2.5-pro': 3 } }),
+    );
+    const service = createTestModelRunner(env, undefined, { jobId: 'job-tail-slow' });
+
+    const response = await service.reviewFile({
+      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
+      prTitle: 'Test',
+      prDescription: null,
+      config: {
+        ...defaultRepoConfig,
+        model: { main: 'gemini-3.1-pro-preview', fallbacks: ['gemini-2.5-pro'], size_overrides: [] },
+      },
+      totalLineCount: 1,
+    });
+
+    // The struck primary is skipped, the tail is attempted anyway, and it answers.
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(String(fetchMock.mock.calls[0][0])).toContain('/models/gemini-2.5-pro:generateContent');
+    expect(response.modelUsed).toBe('gemini-2.5-pro');
+  });
+
+  it('surfaces a permanent config error rather than deferring', async () => {
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const service = createTestModelRunner(env);
+
+    const promise = service.reviewFile({
+      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
+      prTitle: 'Test',
+      prDescription: null,
+      config: {
+        ...defaultRepoConfig,
+        model: { main: 'definitely-not-a-configured-model', fallbacks: [], size_overrides: [] },
+      },
+      totalLineCount: 1,
+    });
+
+    await expect(promise).rejects.toThrow(/is not configured/);
+    await promise.catch((error) => expect(isRetryableModelError(error)).toBe(false));
+  });
+
+  it('still tries the primary model even when the shared job budget is already near the subrequest limit', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({
+          candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
+          usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      ),
+    );
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const tracker = new TokenTracker();
+    tracker.incrementSubrequests(40); // above the near-limit threshold (MAX_SUBREQUESTS 50 - SAFE_MARGIN 25)
+    const service = createTestModelRunner(env, tracker);
+
+    const response = await service.reviewFile({
+      file: {
+        path: 'src/app.ts',
+        lineCount: 1,
+        hunks: [],
+        isDeleted: false,
+        isBinary: false,
+        isNew: false,
+        previousPath: null,
+      },
+      prTitle: 'Test',
+      prDescription: null,
+      config: {
+        ...defaultRepoConfig,
+        model: {
+          main: 'gemini-3.1-pro-preview',
+          fallbacks: ['gemini-2.5-pro'],
+          size_overrides: [],
+        },
+      },
+      totalLineCount: 1,
+    });
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(response.modelUsed).toBe('gemini-3.1-pro-preview');
+  });
+
+  // The counterpart to the test above: the primary gets its shot at a merely-tight budget, but not at
+  // one that cannot cover the call. Previously it transmitted the prompt regardless and the runtime
+  // refused it, losing the unit AND the prompt -- three files' worth in one observed invocation.
+  it('will not commit a prompt when the budget cannot cover the call', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch');
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const tracker = new TokenTracker();
+    // Leaves 5 of the 50-subrequest cap, under the headroom one call may need.
+    tracker.incrementSubrequests(45);
+    const service = createTestModelRunner(env, tracker);
+
+    const promise = service.reviewFile({
+      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
+      prTitle: 'Test',
+      prDescription: null,
+      config: {
+        ...defaultRepoConfig,
+        model: { main: 'gemini-3.1-pro-preview', fallbacks: ['gemini-2.5-pro'], size_overrides: [] },
+      },
+      totalLineCount: 1,
+    });
+
+    // Deferred, not failed: a fresh invocation has a fresh budget.
+    await expect(promise).rejects.toThrow(/retrying later/);
+    await promise.catch((error) => expect(isRetryableModelError(error)).toBe(true));
+    // The whole point -- nothing went over the wire.
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('skips remaining fallback models (instead of spending more of the shared budget) once near the subrequest limit', async () => {
+    // The primary retries internally, so return a fresh Response per call (a body reads once).
+    // 503, not 500: only a genuinely transient failure produces a retryable deferral.
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () =>
+      new Response(
+        JSON.stringify({ error: { code: 503, message: 'The model is overloaded and currently unavailable.', status: 'UNAVAILABLE' } }),
+        { status: 503, headers: { 'content-type': 'application/json' } },
+      ),
+    );
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const tracker = new TokenTracker();
+    tracker.incrementSubrequests(40); // above the near-limit threshold (MAX_SUBREQUESTS 50 - SAFE_MARGIN 25)
+    const service = createTestModelRunner(env, tracker);
+
+    await expect(
+      service.reviewFile({
+        file: {
+          path: 'src/app.ts',
+          lineCount: 1,
+          hunks: [],
+          isDeleted: false,
+          isBinary: false,
+          isNew: false,
+          previousPath: null,
+        },
+        prTitle: 'Test',
+        prDescription: null,
+        config: {
+          ...defaultRepoConfig,
+          model: {
+            main: 'gemini-3.1-pro-preview',
+            fallbacks: ['gemini-2.5-pro'],
+            size_overrides: [],
+          },
+        },
+        totalLineCount: 1,
+      }),
+    ).rejects.toSatisfy(isRetryableModelError);
+
+    // Only the primary model was attempted; the fallback was skipped rather than risking tipping
+    // the shared invocation over Cloudflare's subrequest cap, deferring the file for a later retry.
+    expect(fetchMock.mock.calls.length).toBeGreaterThan(0);
+    for (const call of fetchMock.mock.calls) {
+      expect(String(call[0])).toContain('/models/gemini-3.1-pro-preview:generateContent');
+    }
+  });
+
+  it('skips Cloudflare for the rest of a job after allocation is exhausted', async () => {
+    let cloudflareCalls = 0;
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () =>
+      new Response(
+        JSON.stringify({
+          candidates: [{ content: { parts: [{ text: '{"findings":[]}' }] } }],
+          usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      ),
+    );
+    const env = createTestEnv({
+      AI: {
+        async run() {
+          cloudflareCalls++;
+          throw new Error('Cloudflare daily free allocation exhausted (4006)');
+        },
+      } as any,
+    });
+    await saveTestProviderApiKey(env);
+    const service = createTestModelRunner(env, undefined, { jobId: 'job-provider-skip' });
+    const file = {
+      path: 'src/app.ts',
+      lineCount: 1,
+      hunks: [],
+      isDeleted: false,
+      isBinary: false,
+      isNew: false,
+      previousPath: null,
+    };
+    const config = {
+      ...defaultRepoConfig,
+      model: {
+        main: '@cf/zai-org/glm-4.7-flash',
+        fallbacks: ['gemini-3.1-pro-preview'],
+        size_overrides: [],
+      },
+    };
+
+    await service.reviewFile({
+      file,
+      prTitle: 'Test',
+      prDescription: null,
+      config,
+      totalLineCount: 1,
+    });
+    await service.reviewFile({
+      file: { ...file, path: 'src/other.ts' },
+      prTitle: 'Test',
+      prDescription: null,
+      config,
+      totalLineCount: 1,
+    });
+
+    expect(cloudflareCalls).toBe(1);
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+});
diff --git a/test/model/service-grammar-rejection.spec.ts b/packages/models/test/model/service-grammar-rejection.spec.ts
similarity index 95%
rename from test/model/service-grammar-rejection.spec.ts
rename to packages/models/test/model/service-grammar-rejection.spec.ts
index f6c88399..9c86879a 100644
--- a/test/model/service-grammar-rejection.spec.ts
+++ b/packages/models/test/model/service-grammar-rejection.spec.ts
@@ -1,199 +1,199 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { ModelService } from '@server/services/model';
-import { reviewWithGoogle } from '@server/models/google';
-import { buildReviewResponseSchema } from '@server/prompts/file-review';
-import { createTestEnv, saveTestProviderApiKey } from '../helpers';
-import { defaultRepoConfig } from '@codra/schema';
-
-// Split out of service-retries.spec.ts: a 400 matches no transient pattern, so grammar rejection is
-// its own ladder rung -- drop responseJsonSchema, retry once, latch it off -- not part of the
-// transient-failure ladder those specs cover.
-describe('ModelService: response-grammar rejection', () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  function geminiOk() {
-    return new Response(
-      JSON.stringify({
-        candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] }, finishReason: 'STOP' }],
-        usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-      }),
-      { status: 200, headers: { 'content-type': 'application/json' } },
-    );
-  }
-
-  function gemini400(message: string) {
-    return new Response(
-      JSON.stringify({ error: { code: 400, status: 'INVALID_ARGUMENT', message } }),
-      { status: 400, headers: { 'content-type': 'application/json' } },
-    );
-  }
-
-  const withGrammar = { systemPrompt: 'system', userPrompt: 'user', responseSchema: buildReviewResponseSchema(10) };
-
-  // Google sometimes 400s with nothing but "Request contains an invalid argument." and no
-  // `error.details`, so none of the specific schema markers can fire. That used to fail the file on its
-  // first 400 -- permanently, since a 400 is not transient -- with no grammar probe and no fallback.
-  it('drops the response grammar and retries on a 400 that explains nothing', async () => {
-    const bareInvalidArgument = () =>
-      new Response(
-        JSON.stringify({ error: { code: 400, message: 'Request contains an invalid argument.' } }),
-        { status: 400, headers: { 'content-type': 'application/json' } },
-      );
-    const fetchMock = vi.spyOn(globalThis, 'fetch')
-      .mockResolvedValueOnce(bareInvalidArgument())
-      .mockResolvedValueOnce(
-        new Response(
-          JSON.stringify({
-            candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
-            usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-          }),
-          { status: 200, headers: { 'content-type': 'application/json' } },
-        ),
-      );
-
-    const response = await reviewWithGoogle(
-      { apiKey: 'test-key' },
-      'gemini-3.1-flash-lite',
-      {
-        systemPrompt: 'system',
-        userPrompt: 'user',
-        responseSchema: buildReviewResponseSchema(5),
-      },
-    );
-
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    // The first attempt carried the grammar and the retry did not.
-    const firstBody = JSON.parse(String((fetchMock.mock.calls[0][1] as RequestInit).body));
-    const retryBody = JSON.parse(String((fetchMock.mock.calls[1][1] as RequestInit).body));
-    expect(firstBody.generationConfig.responseJsonSchema).toBeDefined();
-    expect(retryBody.generationConfig.responseJsonSchema).toBeUndefined();
-    // Still asks for JSON, or the schema-less attempt returns prose.
-    expect(retryBody.generationConfig.responseMimeType).toBe('application/json');
-    expect(response.rawText).toContain('"findings"');
-  });
-
-  it('drops the grammar and retries once when Gemini rejects responseJsonSchema', async () => {
-    const fetchMock = vi.spyOn(globalThis, 'fetch')
-      .mockResolvedValueOnce(gemini400('Unknown name "responseJsonSchema" at \'generation_config\': Cannot find field.'))
-      .mockResolvedValueOnce(geminiOk());
-
-    const response = await reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', withGrammar);
-
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(JSON.parse(String(fetchMock.mock.calls[0]?.[1]?.body)).generationConfig.responseJsonSchema).toBeDefined();
-    expect(JSON.parse(String(fetchMock.mock.calls[1]?.[1]?.body)).generationConfig.responseJsonSchema).toBeUndefined();
-    expect(response.rawText).toContain('"findings"');
-    // Surfaced so the "Test connection" preflight cannot call a grammar-incapable endpoint working.
-    expect(response.degraded).toBe('schema-dropped');
-
-    // The probe is not spent on an unrelated 400, nor when there was no grammar to drop.
-    for (const [message, input] of [
-      ['API key not valid. Please pass a valid API key.', withGrammar],
-      ['Invalid value at generation_config.schema.', { systemPrompt: 'system', userPrompt: 'user' }],
-    ] as Array<[string, any]>) {
-      vi.restoreAllMocks();
-      const guarded = vi.spyOn(globalThis, 'fetch').mockResolvedValue(gemini400(message));
-      await expect(
-        reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', input),
-      ).rejects.toThrow(/400/);
-      expect(guarded).toHaveBeenCalledTimes(1);
-    }
-  });
-
-  // The latch used to be set only when the schema-less retry SUCCEEDED. If that retry then 429'd,
-  // the next call re-probed with the grammar -- a wasted 400 plus a second full prompt, every call.
-  it('latches the grammar off even when the schema-less retry itself fails', async () => {
-    const fetchMock = vi.spyOn(globalThis, 'fetch')
-      // Grammar rejected, then the schema-less probe fails for an unrelated reason. Deliberately
-      // not a 429: that would cool the model off and the second review would skip it entirely,
-      // masking whether the latch held.
-      .mockResolvedValueOnce(gemini400('Unknown name "responseJsonSchema" at \'generation_config\'.'))
-      .mockResolvedValueOnce(gemini400('API key not valid. Please pass a valid API key.'))
-      .mockResolvedValue(geminiOk());
-
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env);
-    const params = {
-      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
-      prTitle: 'Test',
-      prDescription: null,
-      config: {
-        ...defaultRepoConfig,
-        model: { main: 'gemini-3.1-pro-preview', fallbacks: [], size_overrides: [] },
-      },
-      totalLineCount: 1,
-    };
-
-    await expect(service.reviewFile(params)).rejects.toThrow();
-    const callsAfterFirstReview = fetchMock.mock.calls.length;
-
-    await service.reviewFile(params);
-
-    // The second review goes straight out without the grammar: no re-probe, no wasted 400.
-    const firstCallOfSecondReview = fetchMock.mock.calls[callsAfterFirstReview];
-    expect(JSON.parse(String(firstCallOfSecondReview?.[1]?.body)).generationConfig.responseJsonSchema).toBeUndefined();
-    expect(fetchMock.mock.calls.length).toBe(callsAfterFirstReview + 1);
-  });
-
-  // Observed in production: Gemini 3.x sends a generic top-level message and puts the real reason
-  // in `details`. Without reading it the grammar rejection looked like an unrelated 400 and the model
-  // was dropped from the chain entirely.
-  it('reads the rejection reason out of error.details, not just the message', async () => {
-    const fetchMock = vi.spyOn(globalThis, 'fetch')
-      .mockResolvedValueOnce(new Response(
-        JSON.stringify({
-          error: {
-            code: 400,
-            status: 'INVALID_ARGUMENT',
-            message: 'Request contains an invalid argument.',
-            details: [{
-              '@type': 'type.googleapis.com/google.rpc.BadRequest',
-              fieldViolations: [{
-                description: 'The specified schema produces a constraint that has too many states for serving.',
-              }],
-            }],
-          },
-        }),
-        { status: 400, headers: { 'content-type': 'application/json' } },
-      ))
-      .mockResolvedValueOnce(geminiOk());
-
-    const response = await reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', withGrammar);
-
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(JSON.parse(String(fetchMock.mock.calls[1]?.[1]?.body)).generationConfig.responseJsonSchema).toBeUndefined();
-    expect(response.degraded).toBe('schema-dropped');
-  });
-
-  it('gives the attempt back for the probe, but only once', async () => {
-    // The probe isn't a transient rung: without the give-back, a ladder spent on 5xx could never
-    // drop the schema. The latch stops it looping.
-    const gemini500 = () => new Response(JSON.stringify({ error: { code: 500, message: 'Internal error encountered.' } }), { status: 500, headers: { 'content-type': 'application/json' } });
-    const ladderSpent = vi.spyOn(globalThis, 'fetch')
-      .mockResolvedValueOnce(gemini500())
-      .mockResolvedValueOnce(gemini500())
-      .mockResolvedValueOnce(gemini400('Unknown name "responseJsonSchema" at \'generation_config\'.'))
-      .mockResolvedValueOnce(geminiOk());
-
-    const response = await reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', withGrammar);
-
-    expect(ladderSpent).toHaveBeenCalledTimes(4);
-    expect(JSON.parse(String(ladderSpent.mock.calls[3]?.[1]?.body)).generationConfig.responseJsonSchema).toBeUndefined();
-    expect(response.degraded).toBe('schema-dropped');
-
-    // mockImplementation, not mockResolvedValue: a retried call cannot re-read one Response body.
-    vi.restoreAllMocks();
-    const persistent = vi.spyOn(globalThis, 'fetch')
-      .mockImplementation(async () => gemini400('Invalid JSON payload received. Unknown name "responseJsonSchema".'));
-
-    await expect(
-      reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', withGrammar),
-    ).rejects.toThrow(/400/);
-
-    // Two, not three and not unbounded: one with the grammar, one without, then throw.
-    expect(persistent).toHaveBeenCalledTimes(2);
-  });
-});
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { reviewWithGoogle } from '@codra/models/google';
+import { buildReviewResponseSchema } from '@server/prompts/file-review';
+import { createTestEnv, saveTestProviderApiKey, createTestModelRunner } from '../../../../test/helpers';
+import { defaultRepoConfig } from '@codra/schema';
+
+// Split out of service-retries.spec.ts: a 400 matches no transient pattern, so grammar rejection is
+// its own ladder rung -- drop responseJsonSchema, retry once, latch it off -- not part of the
+// transient-failure ladder those specs cover.
+describe('ModelRunner: response-grammar rejection', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  function geminiOk() {
+    return new Response(
+      JSON.stringify({
+        candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] }, finishReason: 'STOP' }],
+        usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+      }),
+      { status: 200, headers: { 'content-type': 'application/json' } },
+    );
+  }
+
+  function gemini400(message: string) {
+    return new Response(
+      JSON.stringify({ error: { code: 400, status: 'INVALID_ARGUMENT', message } }),
+      { status: 400, headers: { 'content-type': 'application/json' } },
+    );
+  }
+
+  const withGrammar = { systemPrompt: 'system', userPrompt: 'user', responseSchema: buildReviewResponseSchema(10) };
+
+  // Google sometimes 400s with nothing but "Request contains an invalid argument." and no
+  // `error.details`, so none of the specific schema markers can fire. That used to fail the file on its
+  // first 400 -- permanently, since a 400 is not transient -- with no grammar probe and no fallback.
+  it('drops the response grammar and retries on a 400 that explains nothing', async () => {
+    const bareInvalidArgument = () =>
+      new Response(
+        JSON.stringify({ error: { code: 400, message: 'Request contains an invalid argument.' } }),
+        { status: 400, headers: { 'content-type': 'application/json' } },
+      );
+    const fetchMock = vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(bareInvalidArgument())
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
+            usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+          }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        ),
+      );
+
+    const response = await reviewWithGoogle(
+      { apiKey: 'test-key' },
+      'gemini-3.1-flash-lite',
+      {
+        systemPrompt: 'system',
+        userPrompt: 'user',
+        responseSchema: buildReviewResponseSchema(5),
+      },
+    );
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    // The first attempt carried the grammar and the retry did not.
+    const firstBody = JSON.parse(String((fetchMock.mock.calls[0][1] as RequestInit).body));
+    const retryBody = JSON.parse(String((fetchMock.mock.calls[1][1] as RequestInit).body));
+    expect(firstBody.generationConfig.responseJsonSchema).toBeDefined();
+    expect(retryBody.generationConfig.responseJsonSchema).toBeUndefined();
+    // Still asks for JSON, or the schema-less attempt returns prose.
+    expect(retryBody.generationConfig.responseMimeType).toBe('application/json');
+    expect(response.rawText).toContain('"findings"');
+  });
+
+  it('drops the grammar and retries once when Gemini rejects responseJsonSchema', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(gemini400('Unknown name "responseJsonSchema" at \'generation_config\': Cannot find field.'))
+      .mockResolvedValueOnce(geminiOk());
+
+    const response = await reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', withGrammar);
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(JSON.parse(String(fetchMock.mock.calls[0]?.[1]?.body)).generationConfig.responseJsonSchema).toBeDefined();
+    expect(JSON.parse(String(fetchMock.mock.calls[1]?.[1]?.body)).generationConfig.responseJsonSchema).toBeUndefined();
+    expect(response.rawText).toContain('"findings"');
+    // Surfaced so the "Test connection" preflight cannot call a grammar-incapable endpoint working.
+    expect(response.degraded).toBe('schema-dropped');
+
+    // The probe is not spent on an unrelated 400, nor when there was no grammar to drop.
+    for (const [message, input] of [
+      ['API key not valid. Please pass a valid API key.', withGrammar],
+      ['Invalid value at generation_config.schema.', { systemPrompt: 'system', userPrompt: 'user' }],
+    ] as Array<[string, any]>) {
+      vi.restoreAllMocks();
+      const guarded = vi.spyOn(globalThis, 'fetch').mockResolvedValue(gemini400(message));
+      await expect(
+        reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', input),
+      ).rejects.toThrow(/400/);
+      expect(guarded).toHaveBeenCalledTimes(1);
+    }
+  });
+
+  // The latch used to be set only when the schema-less retry SUCCEEDED. If that retry then 429'd,
+  // the next call re-probed with the grammar -- a wasted 400 plus a second full prompt, every call.
+  it('latches the grammar off even when the schema-less retry itself fails', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch')
+      // Grammar rejected, then the schema-less probe fails for an unrelated reason. Deliberately
+      // not a 429: that would cool the model off and the second review would skip it entirely,
+      // masking whether the latch held.
+      .mockResolvedValueOnce(gemini400('Unknown name "responseJsonSchema" at \'generation_config\'.'))
+      .mockResolvedValueOnce(gemini400('API key not valid. Please pass a valid API key.'))
+      .mockResolvedValue(geminiOk());
+
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const service = createTestModelRunner(env);
+    const params = {
+      file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
+      prTitle: 'Test',
+      prDescription: null,
+      config: {
+        ...defaultRepoConfig,
+        model: { main: 'gemini-3.1-pro-preview', fallbacks: [], size_overrides: [] },
+      },
+      totalLineCount: 1,
+    };
+
+    await expect(service.reviewFile(params)).rejects.toThrow();
+    const callsAfterFirstReview = fetchMock.mock.calls.length;
+
+    await service.reviewFile(params);
+
+    // The second review goes straight out without the grammar: no re-probe, no wasted 400.
+    const firstCallOfSecondReview = fetchMock.mock.calls[callsAfterFirstReview];
+    expect(JSON.parse(String(firstCallOfSecondReview?.[1]?.body)).generationConfig.responseJsonSchema).toBeUndefined();
+    expect(fetchMock.mock.calls.length).toBe(callsAfterFirstReview + 1);
+  });
+
+  // Observed in production: Gemini 3.x sends a generic top-level message and puts the real reason
+  // in `details`. Without reading it the grammar rejection looked like an unrelated 400 and the model
+  // was dropped from the chain entirely.
+  it('reads the rejection reason out of error.details, not just the message', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(new Response(
+        JSON.stringify({
+          error: {
+            code: 400,
+            status: 'INVALID_ARGUMENT',
+            message: 'Request contains an invalid argument.',
+            details: [{
+              '@type': 'type.googleapis.com/google.rpc.BadRequest',
+              fieldViolations: [{
+                description: 'The specified schema produces a constraint that has too many states for serving.',
+              }],
+            }],
+          },
+        }),
+        { status: 400, headers: { 'content-type': 'application/json' } },
+      ))
+      .mockResolvedValueOnce(geminiOk());
+
+    const response = await reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', withGrammar);
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(JSON.parse(String(fetchMock.mock.calls[1]?.[1]?.body)).generationConfig.responseJsonSchema).toBeUndefined();
+    expect(response.degraded).toBe('schema-dropped');
+  });
+
+  it('gives the attempt back for the probe, but only once', async () => {
+    // The probe isn't a transient rung: without the give-back, a ladder spent on 5xx could never
+    // drop the schema. The latch stops it looping.
+    const gemini500 = () => new Response(JSON.stringify({ error: { code: 500, message: 'Internal error encountered.' } }), { status: 500, headers: { 'content-type': 'application/json' } });
+    const ladderSpent = vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(gemini500())
+      .mockResolvedValueOnce(gemini500())
+      .mockResolvedValueOnce(gemini400('Unknown name "responseJsonSchema" at \'generation_config\'.'))
+      .mockResolvedValueOnce(geminiOk());
+
+    const response = await reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', withGrammar);
+
+    expect(ladderSpent).toHaveBeenCalledTimes(4);
+    expect(JSON.parse(String(ladderSpent.mock.calls[3]?.[1]?.body)).generationConfig.responseJsonSchema).toBeUndefined();
+    expect(response.degraded).toBe('schema-dropped');
+
+    // mockImplementation, not mockResolvedValue: a retried call cannot re-read one Response body.
+    vi.restoreAllMocks();
+    const persistent = vi.spyOn(globalThis, 'fetch')
+      .mockImplementation(async () => gemini400('Invalid JSON payload received. Unknown name "responseJsonSchema".'));
+
+    await expect(
+      reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', withGrammar),
+    ).rejects.toThrow(/400/);
+
+    // Two, not three and not unbounded: one with the grammar, one without, then throw.
+    expect(persistent).toHaveBeenCalledTimes(2);
+  });
+});
diff --git a/test/model/service-requests.spec.ts b/packages/models/test/model/service-requests.spec.ts
similarity index 89%
rename from test/model/service-requests.spec.ts
rename to packages/models/test/model/service-requests.spec.ts
index e102c183..57b25736 100644
--- a/test/model/service-requests.spec.ts
+++ b/packages/models/test/model/service-requests.spec.ts
@@ -1,169 +1,169 @@
-import { afterEach, describe, expect, it } from 'vitest';
-import { ModelService } from '@server/services/model';
-import { reviewWithCloudflare } from '@server/models/cloudflare';
-import { reviewWithGoogle } from '@server/models/google';
-
-import { buildBatchReviewResponseSchema, buildReviewResponseSchema } from '@server/prompts/file-review';
-import { VERIFY_RESPONSE_SCHEMA } from '@server/prompts/verify';
-import { createTestEnv, saveTestProviderApiKey } from '../helpers';
-
-
-describe('ModelService: request shape and response handling', () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it('fails (throws) on a Cloudflare reasoning-only response instead of faking an inconclusive review', async () => {
-    const env = createTestEnv({
-      AI: {
-        async run() {
-          return {
-            choices: [
-              {
-                message: {
-                  content: null,
-                  reasoning: 'Long reasoning that consumed the completion budget.',
-                },
-                finish_reason: 'length',
-              },
-            ],
-            usage: { prompt_tokens: 1, completion_tokens: 4096 },
-          };
-        },
-      } as any,
-    });
-
-    // Nothing was reviewed, so this must surface as a failure, not an "inconclusive" pass.
-    await expect(
-      reviewWithCloudflare(env, '@cf/moonshotai/kimi-k2.6', { systemPrompt: 'system', userPrompt: 'user' }),
-    ).rejects.toThrow(/no reviewable output.*reasoning-only/i);
-  });
-
-  it('throws when Cloudflare final content is missing (does not parse reasoning as review JSON)', async () => {
-    const env = createTestEnv({
-      AI: {
-        async run() {
-          return {
-            choices: [
-              {
-                message: {
-                  content: null,
-                  reasoning: 'Reasoning mentioned an object like {"foo":"bar"} but never produced final JSON.',
-                },
-                finish_reason: 'length',
-              },
-            ],
-            usage: { prompt_tokens: 1, completion_tokens: 8192 },
-          };
-        },
-      } as any,
-    });
-
-    await expect(
-      reviewWithCloudflare(env, '@cf/zai-org/glm-4.7-flash', { systemPrompt: 'system', userPrompt: 'user' }),
-    ).rejects.toThrow(/no reviewable output/i);
-  });
-
-  // Per-call: forcing the file-review schema onto the verify pass made it unsatisfiable.
-
-  it('honors a non-review schema, so the verify pass is not forced to emit a file review', async () => {
-    let inputs: any;
-    const env = createTestEnv({
-      AI: {
-        async run(_model: string, request: any) {
-          inputs = request;
-          return {
-            choices: [{ message: { content: '{"results":[]}' } }],
-            usage: { prompt_tokens: 1, completion_tokens: 1 },
-          };
-        },
-      } as any,
-    });
-
-    await reviewWithCloudflare(env, '@cf/zai-org/glm-4.7-flash', {
-      systemPrompt: 'system',
-      userPrompt: 'user',
-      responseSchema: VERIFY_RESPONSE_SCHEMA as any,
-    });
-
-    expect(inputs.response_format.json_schema.name).toBe('codra_verify_findings');
-    expect(inputs.response_format.json_schema.schema.properties.results).toBeDefined();
-  });
-
-  // The adapter's input type once omitted `responseSchema`, so callers' grammars were dropped.
-  describe('Gemini constrained decoding', () => {
-    function geminiOk() {
-      return new Response(
-        JSON.stringify({
-          candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] }, finishReason: 'STOP' }],
-          usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-        }),
-        { status: 200, headers: { 'content-type': 'application/json' } },
-      );
-    }
-
-    // Last call, not first: captures accumulate within a test, so `calls[0]` is the earliest.
-    async function captureGeminiBody(input: any) {
-      const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(geminiOk());
-      await reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', input);
-      return JSON.parse(String(fetchMock.mock.calls.at(-1)?.[1]?.body));
-    }
-
-    // Enumerated, not `toBeUndefined()`, which would pass on a misspelled field name.
-    const schemaKeys = (body: any) => Object.keys(body.generationConfig).filter((key) => /schema/i.test(key));
-
-    it('sends the caller\'s grammar as responseJsonSchema, or none at all', async () => {
-      const review = await captureGeminiBody({ systemPrompt: 'system', userPrompt: 'user', responseSchema: buildReviewResponseSchema(10) });
-      expect(schemaKeys(review)).toEqual(['responseJsonSchema']);
-      expect(review.generationConfig.responseJsonSchema.properties.findings.maxItems).toBe(20);
-      expect(review.generationConfig.responseMimeType).toBe('application/json');
-      // No `outputBudgetTokens` on this input, so the adapter's own default answer budget applies -- and
-      // the bounded thinking budget is added ON TOP of it, never carved out of it.
-      expect(review.generationConfig.thinkingConfig.thinkingBudget).toBe(2048);
-      expect(review.generationConfig.maxOutputTokens).toBe(8192 + 2048);
-
-      // Per-call, not hardcoded: forcing the review grammar onto the verify pass made it unsatisfiable.
-      const verify = await captureGeminiBody({ systemPrompt: 'system', userPrompt: 'user', responseSchema: VERIFY_RESPONSE_SCHEMA as any });
-      expect(verify.generationConfig.responseJsonSchema.properties.results).toBeDefined();
-      expect(verify.generationConfig.responseJsonSchema.properties.findings).toBeUndefined();
-
-      // The summary path passes no grammar and must keep working unconstrained.
-      const none = await captureGeminiBody({ systemPrompt: 'system', userPrompt: 'user' });
-      expect(schemaKeys(none)).toEqual([]);
-      expect(none.generationConfig.responseMimeType).toBe('application/json');
-    });
-
-    it('memoizes a refused grammar per grammar, not per endpoint', async () => {
-      // Refusing only the batched grammar makes both the memo and its grammar-keying observable.
-      const sent: any[] = [];
-      const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async (_url, init) => {
-        const schema = JSON.parse(String(init?.body)).generationConfig.responseJsonSchema;
-        sent.push(schema);
-        return schema?.properties?.files
-          ? new Response(
-            JSON.stringify({ error: { code: 400, status: 'INVALID_ARGUMENT', message: 'Unknown name "responseJsonSchema".' } }),
-            { status: 400, headers: { 'content-type': 'application/json' } },
-          )
-          : geminiOk();
-      });
-
-      const env = createTestEnv();
-      await saveTestProviderApiKey(env);
-      const service = new ModelService(env);
-      const call = (responseSchema: any) => (service as any).callModel('gemini-3.1-pro-preview', { systemPrompt: 'system', userPrompt: 'user', responseSchema });
-
-      const batch = await call(buildBatchReviewResponseSchema(10, 4));
-      const batchAgain = await call(buildBatchReviewResponseSchema(10, 4));
-      const review = await call(buildReviewResponseSchema(10));
-
-      expect(batch.degraded).toBe('schema-dropped');
-      // Not degraded: the memo stripped the grammar before the call, so nothing was attempted.
-      expect(batchAgain.degraded).toBeUndefined();
-      expect(review.degraded).toBeUndefined();
-      // probe + retry, one schemaless call, then the review grammar still attempted.
-      expect(fetchMock).toHaveBeenCalledTimes(4);
-      expect(sent.filter((schema) => schema?.properties?.files)).toHaveLength(1);
-      expect(sent.filter((schema) => schema?.properties?.findings)).toHaveLength(1);
-    });
-  });
-});
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { reviewWithCloudflare } from '@codra/models/cloudflare';
+import { reviewWithGoogle } from '@codra/models/google';
+
+import { buildBatchReviewResponseSchema, buildReviewResponseSchema } from '@server/prompts/file-review';
+import { VERIFY_RESPONSE_SCHEMA } from '@server/prompts/verify';
+import { createTestEnv, saveTestProviderApiKey, createTestModelRunner } from '../../../../test/helpers';
+
+
+describe('ModelRunner: request shape and response handling', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('fails (throws) on a Cloudflare reasoning-only response instead of faking an inconclusive review', async () => {
+    const env = createTestEnv({
+      AI: {
+        async run() {
+          return {
+            choices: [
+              {
+                message: {
+                  content: null,
+                  reasoning: 'Long reasoning that consumed the completion budget.',
+                },
+                finish_reason: 'length',
+              },
+            ],
+            usage: { prompt_tokens: 1, completion_tokens: 4096 },
+          };
+        },
+      } as any,
+    });
+
+    // Nothing was reviewed, so this must surface as a failure, not an "inconclusive" pass.
+    await expect(
+      reviewWithCloudflare(env.AI, '@cf/moonshotai/kimi-k2.6', { systemPrompt: 'system', userPrompt: 'user' }),
+    ).rejects.toThrow(/no reviewable output.*reasoning-only/i);
+  });
+
+  it('throws when Cloudflare final content is missing (does not parse reasoning as review JSON)', async () => {
+    const env = createTestEnv({
+      AI: {
+        async run() {
+          return {
+            choices: [
+              {
+                message: {
+                  content: null,
+                  reasoning: 'Reasoning mentioned an object like {"foo":"bar"} but never produced final JSON.',
+                },
+                finish_reason: 'length',
+              },
+            ],
+            usage: { prompt_tokens: 1, completion_tokens: 8192 },
+          };
+        },
+      } as any,
+    });
+
+    await expect(
+      reviewWithCloudflare(env.AI, '@cf/zai-org/glm-4.7-flash', { systemPrompt: 'system', userPrompt: 'user' }),
+    ).rejects.toThrow(/no reviewable output/i);
+  });
+
+  // Per-call: forcing the file-review schema onto the verify pass made it unsatisfiable.
+
+  it('honors a non-review schema, so the verify pass is not forced to emit a file review', async () => {
+    let inputs: any;
+    const env = createTestEnv({
+      AI: {
+        async run(_model: string, request: any) {
+          inputs = request;
+          return {
+            choices: [{ message: { content: '{"results":[]}' } }],
+            usage: { prompt_tokens: 1, completion_tokens: 1 },
+          };
+        },
+      } as any,
+    });
+
+    await reviewWithCloudflare(env.AI, '@cf/zai-org/glm-4.7-flash', {
+      systemPrompt: 'system',
+      userPrompt: 'user',
+      responseSchema: VERIFY_RESPONSE_SCHEMA as any,
+    });
+
+    expect(inputs.response_format.json_schema.name).toBe('codra_verify_findings');
+    expect(inputs.response_format.json_schema.schema.properties.results).toBeDefined();
+  });
+
+  // The adapter's input type once omitted `responseSchema`, so callers' grammars were dropped.
+  describe('Gemini constrained decoding', () => {
+    function geminiOk() {
+      return new Response(
+        JSON.stringify({
+          candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] }, finishReason: 'STOP' }],
+          usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+        }),
+        { status: 200, headers: { 'content-type': 'application/json' } },
+      );
+    }
+
+    // Last call, not first: captures accumulate within a test, so `calls[0]` is the earliest.
+    async function captureGeminiBody(input: any) {
+      const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(geminiOk());
+      await reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', input);
+      return JSON.parse(String(fetchMock.mock.calls.at(-1)?.[1]?.body));
+    }
+
+    // Enumerated, not `toBeUndefined()`, which would pass on a misspelled field name.
+    const schemaKeys = (body: any) => Object.keys(body.generationConfig).filter((key) => /schema/i.test(key));
+
+    it('sends the caller\'s grammar as responseJsonSchema, or none at all', async () => {
+      const review = await captureGeminiBody({ systemPrompt: 'system', userPrompt: 'user', responseSchema: buildReviewResponseSchema(10) });
+      expect(schemaKeys(review)).toEqual(['responseJsonSchema']);
+      expect(review.generationConfig.responseJsonSchema.properties.findings.maxItems).toBe(20);
+      expect(review.generationConfig.responseMimeType).toBe('application/json');
+      // No `outputBudgetTokens` on this input, so the adapter's own default answer budget applies -- and
+      // the bounded thinking budget is added ON TOP of it, never carved out of it.
+      expect(review.generationConfig.thinkingConfig.thinkingBudget).toBe(2048);
+      expect(review.generationConfig.maxOutputTokens).toBe(8192 + 2048);
+
+      // Per-call, not hardcoded: forcing the review grammar onto the verify pass made it unsatisfiable.
+      const verify = await captureGeminiBody({ systemPrompt: 'system', userPrompt: 'user', responseSchema: VERIFY_RESPONSE_SCHEMA as any });
+      expect(verify.generationConfig.responseJsonSchema.properties.results).toBeDefined();
+      expect(verify.generationConfig.responseJsonSchema.properties.findings).toBeUndefined();
+
+      // The summary path passes no grammar and must keep working unconstrained.
+      const none = await captureGeminiBody({ systemPrompt: 'system', userPrompt: 'user' });
+      expect(schemaKeys(none)).toEqual([]);
+      expect(none.generationConfig.responseMimeType).toBe('application/json');
+    });
+
+    it('memoizes a refused grammar per grammar, not per endpoint', async () => {
+      // Refusing only the batched grammar makes both the memo and its grammar-keying observable.
+      const sent: any[] = [];
+      const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async (_url, init) => {
+        const schema = JSON.parse(String(init?.body)).generationConfig.responseJsonSchema;
+        sent.push(schema);
+        return schema?.properties?.files
+          ? new Response(
+            JSON.stringify({ error: { code: 400, status: 'INVALID_ARGUMENT', message: 'Unknown name "responseJsonSchema".' } }),
+            { status: 400, headers: { 'content-type': 'application/json' } },
+          )
+          : geminiOk();
+      });
+
+      const env = createTestEnv();
+      await saveTestProviderApiKey(env);
+      const service = createTestModelRunner(env);
+      const call = (responseSchema: any) => (service as any).callModel('gemini-3.1-pro-preview', { systemPrompt: 'system', userPrompt: 'user', responseSchema });
+
+      const batch = await call(buildBatchReviewResponseSchema(10, 4));
+      const batchAgain = await call(buildBatchReviewResponseSchema(10, 4));
+      const review = await call(buildReviewResponseSchema(10));
+
+      expect(batch.degraded).toBe('schema-dropped');
+      // Not degraded: the memo stripped the grammar before the call, so nothing was attempted.
+      expect(batchAgain.degraded).toBeUndefined();
+      expect(review.degraded).toBeUndefined();
+      // probe + retry, one schemaless call, then the review grammar still attempted.
+      expect(fetchMock).toHaveBeenCalledTimes(4);
+      expect(sent.filter((schema) => schema?.properties?.files)).toHaveLength(1);
+      expect(sent.filter((schema) => schema?.properties?.findings)).toHaveLength(1);
+    });
+  });
+});
diff --git a/test/model/service-retries.spec.ts b/packages/models/test/model/service-retries.spec.ts
similarity index 90%
rename from test/model/service-retries.spec.ts
rename to packages/models/test/model/service-retries.spec.ts
index 8962b3a9..64acd4e3 100644
--- a/test/model/service-retries.spec.ts
+++ b/packages/models/test/model/service-retries.spec.ts
@@ -1,228 +1,228 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { isRetryableModelError, ModelService } from '@server/services/model';
-import { reviewWithCloudflare } from '@server/models/cloudflare';
-import { reviewWithGoogle } from '@server/models/google';
-import { MODEL_TIMEOUT_MAX_MS } from '@server/models/limits';
-import { createTestEnv, saveTestProviderApiKey } from '../helpers';
-import { defaultRepoConfig } from '@codra/schema';
-
-// The retry ladder: inline retries, Retry-After, and which exhausted runs report as retryable.
-describe('ModelService: transient failures and the retry ladder', () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it('retries Google once for transient 524 edge timeouts', async () => {
-    const fetchMock = vi.spyOn(globalThis, 'fetch')
-      .mockResolvedValueOnce(
-        new Response(
-          JSON.stringify({ error: { code: 524, message: 'A timeout occurred.' } }),
-          { status: 524, headers: { 'content-type': 'application/json' } },
-        ),
-      )
-      .mockResolvedValueOnce(
-        new Response(
-          JSON.stringify({
-            candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
-            usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-          }),
-          { status: 200, headers: { 'content-type': 'application/json' } },
-        ),
-      );
-
-    const response = await reviewWithGoogle(
-      { apiKey: 'test-key' },
-      'gemini-3.1-pro-preview',
-      { systemPrompt: 'system', userPrompt: 'user' },
-    );
-
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(response.rawText).toContain('"findings"');
-  });
-
-  it('honours a Retry-After it can actually wait out', async () => {
-    // retry-after: 3s is inside GEMINI_MAX_RETRY_DELAY_MS (5s), so the retry fires at exactly 3s
-    // -- the provider's own cool-off, not our default backoff.
-    vi.useFakeTimers();
-    try {
-      const fetchMock = vi.spyOn(globalThis, 'fetch')
-        .mockResolvedValueOnce(
-          new Response(
-            JSON.stringify({ error: { code: 429, message: 'Rate limited.' } }),
-            { status: 429, headers: { 'content-type': 'application/json', 'retry-after': '3' } },
-          ),
-        )
-        .mockResolvedValueOnce(
-          new Response(
-            JSON.stringify({
-              candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
-              usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-            }),
-            { status: 200, headers: { 'content-type': 'application/json' } },
-          ),
-        );
-
-      const promise = reviewWithGoogle(
-        { apiKey: 'test-key' },
-        'gemini-3.1-pro-preview',
-        { systemPrompt: 'system', userPrompt: 'user' },
-      );
-      promise.catch(() => {});
-
-      await vi.waitFor(() => expect(fetchMock).toHaveBeenCalledTimes(1));
-      await vi.advanceTimersByTimeAsync(2_999);
-      expect(fetchMock).toHaveBeenCalledTimes(1);
-
-      await vi.advanceTimersByTimeAsync(1);
-      const response = await promise;
-
-      expect(fetchMock).toHaveBeenCalledTimes(2);
-      expect(response.rawText).toContain('"findings"');
-    } finally {
-      vi.useRealTimers();
-    }
-  });
-
-  // A cool-off we cannot honour isn't worth a retry: waking early earns the same 429.
-
-  it('gives up immediately on a Retry-After longer than the in-call sleep cap', async () => {
-    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      new Response(
-        JSON.stringify({ error: { code: 429, message: 'Rate limited.' } }),
-        { status: 429, headers: { 'content-type': 'application/json', 'retry-after': '56' } },
-      ),
-    );
-
-    await expect(
-      reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', { systemPrompt: 'system', userPrompt: 'user' }),
-    ).rejects.toThrow(/429/);
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-  });
-
-  // The free-tier buckets are per-minute, so an unstated cool-off is ~60s by construction. Backing
-  // off ~0.8s then ~1.6s bought two more 429s and two more full prompt transmissions for nothing.
-  it('gives up immediately on a 429 that states no cool-off at all', async () => {
-    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      new Response(
-        JSON.stringify({ error: { code: 429, message: 'Resource has been exhausted.' } }),
-        { status: 429, headers: { 'content-type': 'application/json' } },
-      ),
-    );
-
-    await expect(
-      reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', { systemPrompt: 'system', userPrompt: 'user' }),
-    ).rejects.toThrow(/429/);
-
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-  });
-
-  it('still retries a 5xx with no Retry-After, which is a genuinely transient blip', async () => {
-    const fetchMock = vi.spyOn(globalThis, 'fetch')
-      .mockResolvedValueOnce(
-        new Response(
-          JSON.stringify({ error: { code: 503, message: 'The model is overloaded.' } }),
-          { status: 503, headers: { 'content-type': 'application/json' } },
-        ),
-      )
-      .mockResolvedValueOnce(
-        new Response(
-          JSON.stringify({
-            candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
-            usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
-          }),
-          { status: 200, headers: { 'content-type': 'application/json' } },
-        ),
-      );
-
-    const response = await reviewWithGoogle(
-      { apiKey: 'test-key' },
-      'gemini-3.1-pro-preview',
-      { systemPrompt: 'system', userPrompt: 'user' },
-    );
-
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(response.rawText).toContain('"findings"');
-  });
-
-  it('does not spend an extra queue slice retrying the same Cloudflare model inline', async () => {
-    let attempts = 0;
-    const env = createTestEnv({
-      AI: {
-        async run() {
-          attempts++;
-          throw new Error('temporary provider error');
-        },
-      } as any,
-    });
-
-    await expect(
-      reviewWithCloudflare(env, '@cf/zai-org/glm-4.7-flash', {
-        systemPrompt: 'system',
-        userPrompt: 'user',
-      }),
-    ).rejects.toThrow('temporary provider error');
-    expect(attempts).toBe(1);
-  });
-
-  it('aborts and fails fast (as a retryable timeout) when a Cloudflare model hangs past the timeout', async () => {
-    vi.useFakeTimers();
-    try {
-      let capturedSignal: AbortSignal | undefined;
-      const env = createTestEnv({
-        AI: {
-          run(_model: string, _request: any, options?: { signal?: AbortSignal }) {
-            capturedSignal = options?.signal;
-            // Model never responds -- only the timeout can end this call.
-            return new Promise(() => {});
-          },
-        } as any,
-      });
-
-      const promise = reviewWithCloudflare(env, '@cf/zai-org/glm-4.7-flash', {
-        systemPrompt: 'system',
-        userPrompt: 'user',
-      });
-      // Prevent an unhandled-rejection warning while the timer is still pending.
-      promise.catch(() => {});
-
-      // Derived, not hardcoded: pinning the number here meant raising the ceiling made this test
-      // advance past nothing, so the promise never settled and the run hung on fake timers.
-      await vi.advanceTimersByTimeAsync(MODEL_TIMEOUT_MAX_MS);
-
-      await expect(promise).rejects.toThrow(`timed out after ${MODEL_TIMEOUT_MAX_MS}ms`);
-      // The underlying Workers-AI request was actually cancelled, not just abandoned.
-      expect(capturedSignal?.aborted).toBe(true);
-    } finally {
-      vi.useRealTimers();
-    }
-  });
-
-  it('classifies an exhausted run of Google 5xx failures as retryable (not a permanent file failure)', async () => {
-    // A sustained 5xx outage defers rather than fails. Fresh Response per call: a body reads once.
-    const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () =>
-      new Response(
-        JSON.stringify({ error: { code: 500, message: 'Internal error encountered.', status: 'INTERNAL' } }),
-        { status: 500, headers: { 'content-type': 'application/json' } },
-      ),
-    );
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env);
-
-    await expect(
-      service.reviewFile({
-        file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
-        prTitle: 'Test',
-        prDescription: null,
-        config: {
-          ...defaultRepoConfig,
-          model: { main: 'gemini-3.1-pro-preview', fallbacks: ['gemini-2.5-pro'], size_overrides: [] },
-        },
-        totalLineCount: 1,
-      }),
-    ).rejects.toSatisfy(isRetryableModelError);
-    expect(fetchMock).toHaveBeenCalled();
-  });
-
-});
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { isRetryableModelError } from '@codra/models';
+import { reviewWithCloudflare } from '@codra/models/cloudflare';
+import { reviewWithGoogle } from '@codra/models/google';
+import { MODEL_TIMEOUT_MAX_MS } from '../../src/limits';
+import { createTestEnv, saveTestProviderApiKey, createTestModelRunner } from '../../../../test/helpers';
+import { defaultRepoConfig } from '@codra/schema';
+
+// The retry ladder: inline retries, Retry-After, and which exhausted runs report as retryable.
+describe('ModelRunner: transient failures and the retry ladder', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('retries Google once for transient 524 edge timeouts', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({ error: { code: 524, message: 'A timeout occurred.' } }),
+          { status: 524, headers: { 'content-type': 'application/json' } },
+        ),
+      )
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
+            usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+          }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        ),
+      );
+
+    const response = await reviewWithGoogle(
+      { apiKey: 'test-key' },
+      'gemini-3.1-pro-preview',
+      { systemPrompt: 'system', userPrompt: 'user' },
+    );
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(response.rawText).toContain('"findings"');
+  });
+
+  it('honours a Retry-After it can actually wait out', async () => {
+    // retry-after: 3s is inside GEMINI_MAX_RETRY_DELAY_MS (5s), so the retry fires at exactly 3s
+    // -- the provider's own cool-off, not our default backoff.
+    vi.useFakeTimers();
+    try {
+      const fetchMock = vi.spyOn(globalThis, 'fetch')
+        .mockResolvedValueOnce(
+          new Response(
+            JSON.stringify({ error: { code: 429, message: 'Rate limited.' } }),
+            { status: 429, headers: { 'content-type': 'application/json', 'retry-after': '3' } },
+          ),
+        )
+        .mockResolvedValueOnce(
+          new Response(
+            JSON.stringify({
+              candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
+              usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+            }),
+            { status: 200, headers: { 'content-type': 'application/json' } },
+          ),
+        );
+
+      const promise = reviewWithGoogle(
+        { apiKey: 'test-key' },
+        'gemini-3.1-pro-preview',
+        { systemPrompt: 'system', userPrompt: 'user' },
+      );
+      promise.catch(() => {});
+
+      await vi.waitFor(() => expect(fetchMock).toHaveBeenCalledTimes(1));
+      await vi.advanceTimersByTimeAsync(2_999);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+
+      await vi.advanceTimersByTimeAsync(1);
+      const response = await promise;
+
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      expect(response.rawText).toContain('"findings"');
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  // A cool-off we cannot honour isn't worth a retry: waking early earns the same 429.
+
+  it('gives up immediately on a Retry-After longer than the in-call sleep cap', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(
+        JSON.stringify({ error: { code: 429, message: 'Rate limited.' } }),
+        { status: 429, headers: { 'content-type': 'application/json', 'retry-after': '56' } },
+      ),
+    );
+
+    await expect(
+      reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', { systemPrompt: 'system', userPrompt: 'user' }),
+    ).rejects.toThrow(/429/);
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  // The free-tier buckets are per-minute, so an unstated cool-off is ~60s by construction. Backing
+  // off ~0.8s then ~1.6s bought two more 429s and two more full prompt transmissions for nothing.
+  it('gives up immediately on a 429 that states no cool-off at all', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(
+        JSON.stringify({ error: { code: 429, message: 'Resource has been exhausted.' } }),
+        { status: 429, headers: { 'content-type': 'application/json' } },
+      ),
+    );
+
+    await expect(
+      reviewWithGoogle({ apiKey: 'test-key' }, 'gemini-3.1-pro-preview', { systemPrompt: 'system', userPrompt: 'user' }),
+    ).rejects.toThrow(/429/);
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('still retries a 5xx with no Retry-After, which is a genuinely transient blip', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch')
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({ error: { code: 503, message: 'The model is overloaded.' } }),
+          { status: 503, headers: { 'content-type': 'application/json' } },
+        ),
+      )
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            candidates: [{ content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok","overall_confidence_score":0.9}' }] } }],
+            usageMetadata: { promptTokenCount: 1, candidatesTokenCount: 1 },
+          }),
+          { status: 200, headers: { 'content-type': 'application/json' } },
+        ),
+      );
+
+    const response = await reviewWithGoogle(
+      { apiKey: 'test-key' },
+      'gemini-3.1-pro-preview',
+      { systemPrompt: 'system', userPrompt: 'user' },
+    );
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(response.rawText).toContain('"findings"');
+  });
+
+  it('does not spend an extra queue slice retrying the same Cloudflare model inline', async () => {
+    let attempts = 0;
+    const env = createTestEnv({
+      AI: {
+        async run() {
+          attempts++;
+          throw new Error('temporary provider error');
+        },
+      } as any,
+    });
+
+    await expect(
+      reviewWithCloudflare(env.AI, '@cf/zai-org/glm-4.7-flash', {
+        systemPrompt: 'system',
+        userPrompt: 'user',
+      }),
+    ).rejects.toThrow('temporary provider error');
+    expect(attempts).toBe(1);
+  });
+
+  it('aborts and fails fast (as a retryable timeout) when a Cloudflare model hangs past the timeout', async () => {
+    vi.useFakeTimers();
+    try {
+      let capturedSignal: AbortSignal | undefined;
+      const env = createTestEnv({
+        AI: {
+          run(_model: string, _request: any, options?: { signal?: AbortSignal }) {
+            capturedSignal = options?.signal;
+            // Model never responds -- only the timeout can end this call.
+            return new Promise(() => {});
+          },
+        } as any,
+      });
+
+      const promise = reviewWithCloudflare(env.AI, '@cf/zai-org/glm-4.7-flash', {
+        systemPrompt: 'system',
+        userPrompt: 'user',
+      });
+      // Prevent an unhandled-rejection warning while the timer is still pending.
+      promise.catch(() => {});
+
+      // Derived, not hardcoded: pinning the number here meant raising the ceiling made this test
+      // advance past nothing, so the promise never settled and the run hung on fake timers.
+      await vi.advanceTimersByTimeAsync(MODEL_TIMEOUT_MAX_MS);
+
+      await expect(promise).rejects.toThrow(`timed out after ${MODEL_TIMEOUT_MAX_MS}ms`);
+      // The underlying Workers-AI request was actually cancelled, not just abandoned.
+      expect(capturedSignal?.aborted).toBe(true);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('classifies an exhausted run of Google 5xx failures as retryable (not a permanent file failure)', async () => {
+    // A sustained 5xx outage defers rather than fails. Fresh Response per call: a body reads once.
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () =>
+      new Response(
+        JSON.stringify({ error: { code: 500, message: 'Internal error encountered.', status: 'INTERNAL' } }),
+        { status: 500, headers: { 'content-type': 'application/json' } },
+      ),
+    );
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const service = createTestModelRunner(env);
+
+    await expect(
+      service.reviewFile({
+        file: { path: 'src/app.ts', lineCount: 1, hunks: [], isDeleted: false, isBinary: false, isNew: false, previousPath: null },
+        prTitle: 'Test',
+        prDescription: null,
+        config: {
+          ...defaultRepoConfig,
+          model: { main: 'gemini-3.1-pro-preview', fallbacks: ['gemini-2.5-pro'], size_overrides: [] },
+        },
+        totalLineCount: 1,
+      }),
+    ).rejects.toSatisfy(isRetryableModelError);
+    expect(fetchMock).toHaveBeenCalled();
+  });
+
+});
diff --git a/test/url-guard.spec.ts b/packages/models/test/url-guard.spec.ts
similarity index 95%
rename from test/url-guard.spec.ts
rename to packages/models/test/url-guard.spec.ts
index 859e2129..e369c411 100644
--- a/test/url-guard.spec.ts
+++ b/packages/models/test/url-guard.spec.ts
@@ -1,98 +1,98 @@
-import { describe, expect, it } from 'vitest';
-import { assertPublicBaseUrl, isPrivateHost, isValidPublicUrl } from '@server/models/url-guard';
-import { ProviderRequestError } from '@server/models/types';
-
-// A provider's base URL comes from the dashboard and is then fetched server-side, so an unguarded
-// adapter turns that form into an SSRF primitive.
-//
-// The guard existed in the Google and OpenAI adapters and was simply missing from Anthropic, which
-// fetched `config.baseUrl` unchecked - the copy-paste is why nobody noticed. These tests cover the
-// shared module so all three are protected by the same assertions.
-describe('provider base URL guard', () => {
-  it('rejects loopback, link-local and RFC1918 hosts', () => {
-    const blocked = [
-      'http://127.0.0.1/v1',
-      'http://localhost:8080/v1',
-      'http://10.0.0.5/v1',
-      'http://192.168.1.1/v1',
-      'http://172.16.0.1/v1',
-      'http://172.31.255.255/v1',
-      // 169.254.0.0/16 is where the AWS/Azure metadata service lives.
-      'http://169.254.169.254/latest/meta-data',
-    ];
-    for (const url of blocked) {
-      expect(isValidPublicUrl(url), url).toBe(false);
-    }
-  });
-
-  // The original guard carried `/^::1$/`, which never matched: `URL.hostname` returns an IPv6
-  // literal with its brackets ("[::1]"). IPv6 loopback and the unique-local/link-local ranges were
-  // therefore reachable in both adapters that had a guard at all.
-  it('rejects IPv6 private ranges, brackets and all', () => {
-    const blocked = [
-      'http://[::1]/v1',
-      'http://[::]/v1',
-      'http://[fc00::1]/v1',
-      'http://[fd12:3456::1]/v1',
-      'http://[fe80::1]/v1',
-      'http://[::ffff:127.0.0.1]/v1',
-    ];
-    for (const url of blocked) {
-      expect(isValidPublicUrl(url), url).toBe(false);
-    }
-    // A genuinely public IPv6 address must still pass.
-    expect(isValidPublicUrl('http://[2606:4700::1111]/v1')).toBe(true);
-  });
-
-  // Public-looking names that resolve only from inside a cloud instance, so the range checks alone
-  // would let them through.
-  it('rejects cloud metadata endpoints by name', () => {
-    expect(isValidPublicUrl('http://metadata.google.internal/computeMetadata/v1')).toBe(false);
-    expect(isValidPublicUrl('http://100.100.100.200/latest/meta-data')).toBe(false);
-  });
-
-  it('rejects non-HTTP schemes and unparseable input', () => {
-    expect(isValidPublicUrl('file:///etc/passwd')).toBe(false);
-    expect(isValidPublicUrl('ftp://example.com')).toBe(false);
-    expect(isValidPublicUrl('not a url')).toBe(false);
-    expect(isValidPublicUrl('')).toBe(false);
-  });
-
-  it('allows genuine public endpoints', () => {
-    expect(isValidPublicUrl('https://api.anthropic.com/v1')).toBe(true);
-    expect(isValidPublicUrl('https://generativelanguage.googleapis.com/v1beta')).toBe(true);
-    expect(isValidPublicUrl('https://api.openai.com/v1')).toBe(true);
-    // 172.32 is outside the private 172.16-172.31 block, so the range regex must not over-match.
-    expect(isValidPublicUrl('http://172.32.0.1/v1')).toBe(true);
-  });
-
-  it('classifies hosts without needing a full URL', () => {
-    expect(isPrivateHost('127.0.0.1')).toBe(true);
-    expect(isPrivateHost('172.15.0.1')).toBe(false);
-    expect(isPrivateHost('example.com')).toBe(false);
-  });
-
-  describe('assertPublicBaseUrl', () => {
-    it('throws a provider-shaped 400 for a blocked URL', () => {
-      try {
-        assertPublicBaseUrl('http://169.254.169.254/', 'Anthropic');
-        expect.unreachable('should have thrown');
-      } catch (error) {
-        expect(error).toBeInstanceOf(ProviderRequestError);
-        expect((error as ProviderRequestError).status).toBe(400);
-      }
-    });
-
-    // Every adapter defaults to its own vendor URL when none is configured, so an absent base URL
-    // must pass rather than throw.
-    it('accepts an absent base URL', () => {
-      expect(() => assertPublicBaseUrl(null, 'Anthropic')).not.toThrow();
-      expect(() => assertPublicBaseUrl(undefined, 'Google')).not.toThrow();
-      expect(() => assertPublicBaseUrl('', 'OpenAI')).not.toThrow();
-    });
-
-    it('accepts a public base URL', () => {
-      expect(() => assertPublicBaseUrl('https://api.anthropic.com/v1', 'Anthropic')).not.toThrow();
-    });
-  });
-});
+import { describe, expect, it } from 'vitest';
+import { assertPublicBaseUrl, isPrivateHost, isValidPublicUrl } from '../src/url-guard';
+import { ProviderRequestError } from '@codra/models/types';
+
+// A provider's base URL comes from the dashboard and is then fetched server-side, so an unguarded
+// adapter turns that form into an SSRF primitive.
+//
+// The guard existed in the Google and OpenAI adapters and was simply missing from Anthropic, which
+// fetched `config.baseUrl` unchecked - the copy-paste is why nobody noticed. These tests cover the
+// shared module so all three are protected by the same assertions.
+describe('provider base URL guard', () => {
+  it('rejects loopback, link-local and RFC1918 hosts', () => {
+    const blocked = [
+      'http://127.0.0.1/v1',
+      'http://localhost:8080/v1',
+      'http://10.0.0.5/v1',
+      'http://192.168.1.1/v1',
+      'http://172.16.0.1/v1',
+      'http://172.31.255.255/v1',
+      // 169.254.0.0/16 is where the AWS/Azure metadata service lives.
+      'http://169.254.169.254/latest/meta-data',
+    ];
+    for (const url of blocked) {
+      expect(isValidPublicUrl(url), url).toBe(false);
+    }
+  });
+
+  // The original guard carried `/^::1$/`, which never matched: `URL.hostname` returns an IPv6
+  // literal with its brackets ("[::1]"). IPv6 loopback and the unique-local/link-local ranges were
+  // therefore reachable in both adapters that had a guard at all.
+  it('rejects IPv6 private ranges, brackets and all', () => {
+    const blocked = [
+      'http://[::1]/v1',
+      'http://[::]/v1',
+      'http://[fc00::1]/v1',
+      'http://[fd12:3456::1]/v1',
+      'http://[fe80::1]/v1',
+      'http://[::ffff:127.0.0.1]/v1',
+    ];
+    for (const url of blocked) {
+      expect(isValidPublicUrl(url), url).toBe(false);
+    }
+    // A genuinely public IPv6 address must still pass.
+    expect(isValidPublicUrl('http://[2606:4700::1111]/v1')).toBe(true);
+  });
+
+  // Public-looking names that resolve only from inside a cloud instance, so the range checks alone
+  // would let them through.
+  it('rejects cloud metadata endpoints by name', () => {
+    expect(isValidPublicUrl('http://metadata.google.internal/computeMetadata/v1')).toBe(false);
+    expect(isValidPublicUrl('http://100.100.100.200/latest/meta-data')).toBe(false);
+  });
+
+  it('rejects non-HTTP schemes and unparseable input', () => {
+    expect(isValidPublicUrl('file:///etc/passwd')).toBe(false);
+    expect(isValidPublicUrl('ftp://example.com')).toBe(false);
+    expect(isValidPublicUrl('not a url')).toBe(false);
+    expect(isValidPublicUrl('')).toBe(false);
+  });
+
+  it('allows genuine public endpoints', () => {
+    expect(isValidPublicUrl('https://api.anthropic.com/v1')).toBe(true);
+    expect(isValidPublicUrl('https://generativelanguage.googleapis.com/v1beta')).toBe(true);
+    expect(isValidPublicUrl('https://api.openai.com/v1')).toBe(true);
+    // 172.32 is outside the private 172.16-172.31 block, so the range regex must not over-match.
+    expect(isValidPublicUrl('http://172.32.0.1/v1')).toBe(true);
+  });
+
+  it('classifies hosts without needing a full URL', () => {
+    expect(isPrivateHost('127.0.0.1')).toBe(true);
+    expect(isPrivateHost('172.15.0.1')).toBe(false);
+    expect(isPrivateHost('example.com')).toBe(false);
+  });
+
+  describe('assertPublicBaseUrl', () => {
+    it('throws a provider-shaped 400 for a blocked URL', () => {
+      try {
+        assertPublicBaseUrl('http://169.254.169.254/', 'Anthropic');
+        expect.unreachable('should have thrown');
+      } catch (error) {
+        expect(error).toBeInstanceOf(ProviderRequestError);
+        expect((error as ProviderRequestError).status).toBe(400);
+      }
+    });
+
+    // Every adapter defaults to its own vendor URL when none is configured, so an absent base URL
+    // must pass rather than throw.
+    it('accepts an absent base URL', () => {
+      expect(() => assertPublicBaseUrl(null, 'Anthropic')).not.toThrow();
+      expect(() => assertPublicBaseUrl(undefined, 'Google')).not.toThrow();
+      expect(() => assertPublicBaseUrl('', 'OpenAI')).not.toThrow();
+    });
+
+    it('accepts a public base URL', () => {
+      expect(() => assertPublicBaseUrl('https://api.anthropic.com/v1', 'Anthropic')).not.toThrow();
+    });
+  });
+});
diff --git a/packages/models/tsconfig.json b/packages/models/tsconfig.json
new file mode 100644
index 00000000..05ae1d08
--- /dev/null
+++ b/packages/models/tsconfig.json
@@ -0,0 +1,12 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "lib": ["ES2024", "DOM"],
+    "types": ["node"],
+    "composite": false,
+    "declaration": false,
+    "emitDeclarationOnly": false,
+    "noEmit": true
+  },
+  "include": ["src/**/*", "test/**/*"]
+}
diff --git a/packages/provider-github/src/oauth.ts b/packages/provider-github/src/oauth.ts
index bd557fcc..4d8e8973 100644
--- a/packages/provider-github/src/oauth.ts
+++ b/packages/provider-github/src/oauth.ts
@@ -1,4 +1,4 @@
-import type { DashboardSessionUser } from '@server/env';
+import type { DashboardSessionUser } from '@codra/core';
 import type { AppBindingsConfig } from './service';
 
 export type GitHubOAuthProfile = {
diff --git a/scratch/refactor-consumers.js b/scratch/refactor-consumers.js
deleted file mode 100644
index 5a5737ce..00000000
--- a/scratch/refactor-consumers.js
+++ /dev/null
@@ -1,37 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-
-function walk(dir) {
-  let results = [];
-  const list = fs.readdirSync(dir);
-  list.forEach(function(file) {
-    file = path.join(dir, file);
-    const stat = fs.statSync(file);
-    if (stat && stat.isDirectory()) { 
-      results = results.concat(walk(file));
-    } else { 
-      if (file.endsWith('.ts')) results.push(file);
-    }
-  });
-  return results;
-}
-
-const files = walk(path.join(process.cwd(), 'src', 'server'));
-
-for (const file of files) {
-  let content = fs.readFileSync(file, 'utf8');
-  let changed = false;
-
-  if (content.includes('@server/db/')) {
-    content = content.replace(/@server\/db\//g, '@codra/db/');
-    changed = true;
-  }
-
-  // Check if we have `import type { AppBindings } from '@server/env';` used for DB calls.
-  // Actually, we'll let typechecker find the mismatched `AppBindings` vs `DbEnv` arguments.
-  
-  if (changed) {
-    fs.writeFileSync(file, content);
-  }
-}
-console.log('Done');
diff --git a/scratch/refactor-db-2.js b/scratch/refactor-db-2.js
deleted file mode 100644
index 8aaaf0cb..00000000
--- a/scratch/refactor-db-2.js
+++ /dev/null
@@ -1,35 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-
-const dir = path.join(process.cwd(), 'packages', 'db', 'src');
-const files = fs.readdirSync(dir).filter(f => f.endsWith('.ts'));
-
-for (const file of files) {
-  const filePath = path.join(dir, file);
-  let content = fs.readFileSync(filePath, 'utf8');
-
-  // Fix AppBindings
-  content = content.replace(/AppBindings/g, 'DbEnv');
-
-  // Fix APP_KV get and delete
-  if (file === 'jobs-activity.ts') {
-    content = content.replace(
-      /\{ APP_KV: \{ put\(key: string, value: string, options\?: \{ expirationTtl\?: number \} \| undefined\): Promise<void> \} \}/g,
-      `{ APP_KV: { put(key: string, value: string, options?: { expirationTtl?: number }): Promise<void>; get(key: string): Promise<string | null>; delete(key: string): Promise<void> } }`
-    );
-  }
-
-  // Fix @server/core/logger in app-settings.ts
-  if (file === 'app-settings.ts') {
-    content = content.replace(/import \{ logger \} from '@server\/core\/logger';\n?/g, '');
-    content = content.replace(/logger\.warn/g, 'console.warn');
-    content = content.replace(/logger\.error/g, 'console.error');
-  }
-
-  // Check for any other @server/env imports
-  content = content.replace(/import type \{ [^}]*DbEnv[^}]* \} from '@server\/env';\n?/g, '');
-  content = content.replace(/import \{ [^}]* \} from '@server\/env';\n?/g, '');
-  
-  fs.writeFileSync(filePath, content);
-}
-console.log('Done');
diff --git a/scratch/refactor-db-3.js b/scratch/refactor-db-3.js
deleted file mode 100644
index 038a2df0..00000000
--- a/scratch/refactor-db-3.js
+++ /dev/null
@@ -1,33 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-
-const dir = path.join(process.cwd(), 'packages', 'db', 'src');
-const files = fs.readdirSync(dir).filter(f => f.endsWith('.ts'));
-
-for (const file of files) {
-  if (file === 'env.ts') continue;
-  const filePath = path.join(dir, file);
-  let content = fs.readFileSync(filePath, 'utf8');
-
-  // Remove old definitions
-  content = content.replace(/type DbEnv = \{ HYPERDRIVE: \{ connectionString: string \} \};\n?/g, '');
-  content = content.replace(/\{ APP_KV: \{ put\(key: string, value: string, options\?: \{ expirationTtl\?: number \} \| undefined\): Promise<void>; \} \}/g, 'DbEnv');
-  content = content.replace(/\{ APP_KV: \{ put\(key: string, value: string, options\?: \{ expirationTtl\?: number \} \): Promise<void>; get\(key: string\): Promise<string \| null>; delete\(key: string\): Promise<void> \} \}/g, 'DbEnv');
-
-  // Add import if needed
-  if (content.includes('DbEnv')) {
-    const importStr = `import type { DbEnv } from './env';\n`;
-    if (!content.includes(importStr)) {
-      content = importStr + content;
-    }
-  }
-
-  // Also fix APP_KV inline in jobs-activity.ts
-  if (file === 'jobs-activity.ts') {
-      content = content.replace(/env: \{ APP_KV: \{[^}]+\}[^}]+\}/, 'env: DbEnv');
-      content = content.replace(/env: DbEnv \{/, 'env: DbEnv'); // Just in case
-  }
-  
-  fs.writeFileSync(filePath, content);
-}
-console.log('Done');
diff --git a/scratch/refactor-db.js b/scratch/refactor-db.js
deleted file mode 100644
index 6f8e326e..00000000
--- a/scratch/refactor-db.js
+++ /dev/null
@@ -1,42 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-
-const dir = path.join(process.cwd(), 'packages', 'db', 'src');
-const files = fs.readdirSync(dir).filter(f => f.endsWith('.ts'));
-
-for (const file of files) {
-  const filePath = path.join(dir, file);
-  let content = fs.readFileSync(filePath, 'utf8');
-
-  // Replace AppBindings import
-  content = content.replace(
-    /import type \{ AppBindings \} from '@server\/env';/g,
-    `type DbEnv = { HYPERDRIVE: { connectionString: string } };`
-  );
-
-  // Replace Pick<AppBindings, 'HYPERDRIVE'> with DbEnv
-  content = content.replace(/Pick<AppBindings, 'HYPERDRIVE'>/g, 'DbEnv');
-  
-  // Replace AppBindings with DbEnv in function parameters
-  content = content.replace(/env: AppBindings/g, 'env: DbEnv');
-
-  // jobs-activity.ts has APP_KV. Let's fix it specifically
-  if (file === 'jobs-activity.ts') {
-    content = content.replace(
-      /Pick<AppBindings, 'APP_KV'>/g,
-      `{ APP_KV: { put(key: string, value: string, options?: { expirationTtl?: number }): Promise<void> } }`
-    );
-  }
-  
-  // model-configs.ts has ResolvedModelConfig which we moved to schema
-  if (file === 'model-configs.ts') {
-    // we already modified the source model-configs.ts to export it, but this is the copied version, wait, we copied the modified version!
-  }
-
-  // Replace any remaining '@server/' imports to relative paths if necessary, but actually in packages/db they should still refer to '@codra/schema' or we need to fix local references.
-  // Wait, src/server/db doesn't have many '@server/' imports, mostly just '@server/env' and '@codra/schema'.
-  // Let's check for any other '@server/' imports.
-  
-  fs.writeFileSync(filePath, content);
-}
-console.log('Done');
diff --git a/scratch/refactor-repos.js b/scratch/refactor-repos.js
deleted file mode 100644
index 26b880f9..00000000
--- a/scratch/refactor-repos.js
+++ /dev/null
@@ -1,21 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-
-const dir = path.join(process.cwd(), 'packages', 'db', 'src', 'repositories');
-const files = fs.readdirSync(dir).filter(f => f.endsWith('.ts'));
-
-for (const file of files) {
-  const filePath = path.join(dir, file);
-  let content = fs.readFileSync(filePath, 'utf8');
-
-  // Replace AppBindings imports
-  content = content.replace(/import type \{ AppBindings \} from '@server\/env';/g, "import type { DbEnv } from '../env';");
-  content = content.replace(/env: AppBindings/g, "env: DbEnv");
-  content = content.replace(/import type \{ DbEnv \} from '@server\/env';/g, "import type { DbEnv } from '../env';");
-
-  // Fix DB imports
-  content = content.replace(/@server\/db\//g, '../');
-
-  fs.writeFileSync(filePath, content);
-}
-console.log('Done');
diff --git a/scratch/refactor-tests.js b/scratch/refactor-tests.js
deleted file mode 100644
index 29cf2a42..00000000
--- a/scratch/refactor-tests.js
+++ /dev/null
@@ -1,34 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-
-function walk(dir) {
-  let results = [];
-  const list = fs.readdirSync(dir);
-  list.forEach(function(file) {
-    file = path.join(dir, file);
-    const stat = fs.statSync(file);
-    if (stat && stat.isDirectory()) { 
-      results = results.concat(walk(file));
-    } else { 
-      if (file.endsWith('.ts')) results.push(file);
-    }
-  });
-  return results;
-}
-
-const files = walk(path.join(process.cwd(), 'test'));
-
-for (const file of files) {
-  let content = fs.readFileSync(file, 'utf8');
-  let changed = false;
-
-  if (content.includes('@server/db/')) {
-    content = content.replace(/@server\/db\//g, '@codra/db/');
-    changed = true;
-  }
-
-  if (changed) {
-    fs.writeFileSync(file, content);
-  }
-}
-console.log('Done');
diff --git a/scripts/check-core-boundary.mjs b/scripts/check-core-boundary.mjs
deleted file mode 100644
index e7e66512..00000000
--- a/scripts/check-core-boundary.mjs
+++ /dev/null
@@ -1,155 +0,0 @@
-// Asserts the @codra/core purity criterion: the review engine must not depend on hono, postgres,
-// wrangler types, or any git-provider SDK, and must not reach back into the legacy src/ tree.
-//
-// This exists alongside eslint's import-x/no-restricted-paths because that rule only sees file
-// paths. It cannot see an npm dependency added to packages/core/package.json, and -- the case that
-// actually matters -- it does not object to `import type { AppBindings } from '...'`, which leaves
-// no runtime trace and would silently reintroduce the platform coupling this extraction removes.
-// So this script checks the manifest AND bans the identifiers by name.
-
-import { readFileSync, readdirSync, statSync } from 'node:fs';
-import { dirname, join, relative, resolve, sep } from 'node:path';
-
-const ROOT = join(import.meta.dirname, '..');
-const PKG = join(ROOT, 'packages/core');
-
-const BANNED_DEPS = ['hono', 'postgres', 'wrangler', '@cloudflare/workers-types', '@octokit/rest', '@octokit/core'];
-
-// Module specifiers no file in the package may import, matched against the actual specifier
-// string of every import/export/require in the file (any quote style, static or dynamic).
-// A trailing '/' entry bans the package and everything under it; 'src/' bans any relative
-// path that climbs out of the package into the legacy tree.
-const BANNED_MODULES = [
-  'hono',
-  'postgres',
-  'cloudflare:workers',
-  'node:async_hooks',
-  '@server/',
-  '@client/',
-  '@codra/worker',
-  '@codra/provider-github',
-];
-
-function isBannedModule(specifier, fileDir) {
-  for (const banned of BANNED_MODULES) {
-    if (specifier === banned || specifier === banned.replace(/\/$/, '') || specifier.startsWith(banned.endsWith('/') ? banned : `${banned}/`)) {
-      return true;
-    }
-  }
-  // Any relative import that resolves outside the package into the repo's legacy src/ tree.
-  if (specifier.startsWith('.')) {
-    const resolved = resolve(fileDir, specifier);
-    return resolved === join(ROOT, 'src') || resolved.startsWith(join(ROOT, 'src') + sep);
-  }
-  return false;
-}
-
-// Every module specifier the file names: `import ... from 'x'`, `export ... from 'x'`,
-// side-effect `import 'x'`, dynamic `import('x')`, and `require('x')`.
-function* moduleSpecifiers(source) {
-  const pattern = /(?:\bfrom\s*|\bimport\s*\(?\s*|\brequire\s*\(\s*)(['"])([^'"\n]+)\1/g;
-  for (const match of source.matchAll(pattern)) yield match[2];
-}
-
-// Types and classes whose presence means a port was bypassed. Type-only imports of these are the
-// exact regression this half of the check is for.
-const BANNED_IDENTIFIERS = [
-  'AppBindings',
-  'KVNamespace',
-  'HyperdriveBinding',
-  'GitHubService',
-  'GitHubClient',
-  'ModelService',
-  'FormatterService',
-  'queryRows',
-  'runWithDb',
-];
-
-const failures = [];
-
-const manifest = JSON.parse(readFileSync(join(PKG, 'package.json'), 'utf8'));
-for (const field of ['dependencies', 'devDependencies', 'peerDependencies']) {
-  for (const name of Object.keys(manifest[field] ?? {})) {
-    if (BANNED_DEPS.includes(name)) {
-      failures.push(`packages/core/package.json: ${field} must not include "${name}"`);
-    }
-  }
-}
-
-function* walk(dir) {
-  let entries;
-  try {
-    entries = readdirSync(dir);
-  } catch {
-    return; // test/ may not exist yet
-  }
-  for (const entry of entries) {
-    const path = join(dir, entry);
-    if (statSync(path).isDirectory()) {
-      yield* walk(path);
-    } else if (path.endsWith('.ts') || path.endsWith('.tsx')) {
-      yield path;
-    }
-  }
-}
-
-for (const dir of ['src', 'test']) {
-  for (const file of walk(join(PKG, dir))) {
-    const source = readFileSync(file, 'utf8');
-    const where = relative(ROOT, file).replaceAll('\\', '/');
-
-    for (const specifier of moduleSpecifiers(source)) {
-      if (isBannedModule(specifier, dirname(file))) {
-        failures.push(`${where}: must not import ${specifier}`);
-      }
-    }
-
-    for (const identifier of BANNED_IDENTIFIERS) {
-      // Word-boundary match so `ModelServiceOptions` or a comment mentioning the old name in prose
-      // does not trip it; an actual usage always appears as a bare identifier.
-      if (new RegExp(`\\b${identifier}\\b`).test(stripComments(source))) {
-        failures.push(`${where}: must not reference "${identifier}" -- take a port instead`);
-      }
-    }
-  }
-}
-
-// Comments in core legitimately explain what a port replaced ("was env.BOT_USERNAME", "mirrors the
-// GitHubService surface"), so the identifier scan runs over code only. A single-pass scanner
-// rather than regexes so `//` and `/*` inside string or template literals are left alone.
-function stripComments(source) {
-  let out = '';
-  let i = 0;
-  while (i < source.length) {
-    const ch = source[i];
-    const next = source[i + 1];
-    if (ch === '/' && next === '/') {
-      while (i < source.length && source[i] !== '\n') i++;
-    } else if (ch === '/' && next === '*') {
-      i += 2;
-      while (i < source.length && !(source[i] === '*' && source[i + 1] === '/')) i++;
-      i += 2;
-    } else if (ch === "'" || ch === '"' || ch === '`') {
-      out += ch;
-      i++;
-      while (i < source.length && source[i] !== ch) {
-        if (source[i] === '\\') { out += source[i]; i++; }
-        if (i < source.length) { out += source[i]; i++; }
-      }
-      if (i < source.length) { out += ch; i++; }
-    } else {
-      out += ch;
-      i++;
-    }
-  }
-  return out;
-}
-
-if (failures.length > 0) {
-  console.error('@codra/core boundary check failed:\n');
-  for (const failure of failures) console.error(`  - ${failure}`);
-  console.error(`\n${failures.length} violation(s). The engine must depend on ports only; implementations live in src/server/adapters.`);
-  process.exit(1);
-}
-
-console.log('@codra/core boundary check passed: no hono/postgres/wrangler/git-provider dependency, no reach back into src/.');
diff --git a/scripts/comment-density.mjs b/scripts/comment-density.mjs
deleted file mode 100644
index 0db31c36..00000000
--- a/scripts/comment-density.mjs
+++ /dev/null
@@ -1,133 +0,0 @@
-// Reports repo-wide comment density: comment lines / (comment + code) lines, blanks excluded.
-//
-// Repo-wide on purpose, never per-file. A handful of small modules are almost entirely commentary
-// because they record an incident the code alone cannot explain (fingerprint.ts, models/limits.ts,
-// review/budget.ts); a per-file threshold would force those to be diluted or the explanation
-// deleted. The number that matters is the whole tree.
-//
-// A comment counts as the number of lines it WOULD take in `//` form at LINE_WIDTH, not the number
-// of physical lines it occupies. Otherwise the metric is trivially gamed: reflowing a 6-line `//`
-// block into one 600-character `/* ... */` deletes nothing and still shows a 5x improvement. Long
-// `//` lines normalize the same way, so neither form is cheaper than the other.
-//
-// Usage:
-//   node scripts/comment-density.mjs            # summary
-//   node scripts/comment-density.mjs --top      # plus the 20 files with the most comment lines
-//   node scripts/comment-density.mjs --max 5    # exit 1 above the given percentage (for CI)
-import { readFileSync } from 'node:fs';
-import { readdir } from 'node:fs/promises';
-import path from 'node:path';
-
-const ROOTS = ['src', 'test', 'scripts', 'packages', 'apps'];
-const EXTS = new Set(['.ts', '.tsx', '.mjs', '.js']);
-// Generated by `wrangler types`; not ours to edit.
-const SKIP = new Set(['worker-env.d.ts', 'worker-configuration.d.ts']);
-
-async function walk(dir, out = []) {
-  for (const entry of await readdir(dir, { withFileTypes: true })) {
-    const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) await walk(full, out);
-    else if (EXTS.has(path.extname(entry.name)) && !SKIP.has(entry.name)) out.push(full);
-  }
-  return out;
-}
-
-// Rendered width of a comment line in this repo: `//` comment lengths sit at 89/96/99/100 for
-// p50/p75/p90/p95, so 100 is the line the codebase actually wraps to. CONTENT_WIDTH backs out the
-// `// ` prefix.
-const LINE_WIDTH = 100;
-const CONTENT_WIDTH = LINE_WIDTH - 3;
-
-// What this text would cost in `//` form: never fewer lines than it already occupies, and never
-// fewer than its content needs at CONTENT_WIDTH.
-function equivalentLines(contentChars, physicalLines) {
-  return Math.max(physicalLines, Math.ceil(contentChars / CONTENT_WIDTH) || 1);
-}
-
-function countLines(file) {
-  let comments = 0;
-  let code = 0;
-  let inBlock = false;
-  let blockChars = 0;
-  let blockPhysical = 0;
-
-  const stripBlock = (line) => line
-    .replace(/^\/\*+/, '')
-    .replace(/\*+\/$/, '')
-    .replace(/^\*+/, '')
-    .trim();
-
-  for (const raw of readFileSync(file, 'utf8').split(/\r?\n/)) {
-    const line = raw.trim();
-    if (!line) continue;
-
-    if (inBlock) {
-      blockPhysical += 1;
-      blockChars += stripBlock(line).length;
-      if (line.includes('*/')) {
-        inBlock = false;
-        comments += equivalentLines(blockChars, blockPhysical);
-      }
-      continue;
-    }
-    if (line.startsWith('/*')) {
-      blockPhysical = 1;
-      blockChars = stripBlock(line).length;
-      if (line.includes('*/')) {
-        comments += equivalentLines(blockChars, blockPhysical);
-      } else {
-        inBlock = true;
-      }
-      continue;
-    }
-    if (line.startsWith('//')) {
-      comments += equivalentLines(line.replace(/^\/+/, '').trim().length, 1);
-      continue;
-    }
-    code += 1;
-  }
-
-  // An unterminated block (should not happen in valid source) still costs what it accumulated.
-  if (inBlock) comments += equivalentLines(blockChars, blockPhysical);
-
-  return { comments, code };
-}
-
-const files = (await Promise.all(ROOTS.map((root) => walk(root)))).flat();
-
-let totalComments = 0;
-let totalCode = 0;
-const perFile = [];
-
-for (const file of files) {
-  const { comments, code } = countLines(file);
-  totalComments += comments;
-  totalCode += code;
-  if (comments + code > 0) perFile.push({ file, comments, code });
-}
-
-const total = totalComments + totalCode;
-const density = (100 * totalComments) / total;
-console.log(`comment density: ${totalComments} / ${total} lines = ${density.toFixed(2)}%`);
-
-if (process.argv.includes('--top')) {
-  console.log('\nmost comment lines:');
-  for (const entry of perFile.sort((a, b) => b.comments - a.comments).slice(0, 20)) {
-    const pct = ((100 * entry.comments) / (entry.comments + entry.code)).toFixed(1);
-    console.log(`  ${String(entry.comments).padStart(4)}c ${String(entry.code).padStart(5)}k ${pct.padStart(5)}%  ${entry.file}`);
-  }
-}
-
-const maxIndex = process.argv.indexOf('--max');
-if (maxIndex !== -1) {
-  const limit = Number(process.argv[maxIndex + 1]);
-  if (!Number.isFinite(limit)) {
-    console.error('--max needs a number');
-    process.exit(2);
-  }
-  if (density > limit) {
-    console.error(`\nFAIL: ${density.toFixed(2)}% is above the ${limit}% ceiling.`);
-    process.exit(1);
-  }
-  console.log(`OK: within the ${limit}% ceiling.`);
-}
diff --git a/src/server/adapters/services.ts b/src/server/adapters/services.ts
index a5144167..d828ca7b 100644
--- a/src/server/adapters/services.ts
+++ b/src/server/adapters/services.ts
@@ -2,11 +2,12 @@ import type { GitProviderFactory, ModelErrorClassifier, ReviewFormatter, ReviewG
 import type { TokenTracker } from '@codra/core/token-tracker';
 import type { AppBindings } from '@server/env';
 import { GitHubService } from '@codra/provider-github';
-import { isRetryableModelError, ModelService, nextChainIndexOf } from '@server/services/model';
+import { isRetryableModelError, ModelRunner, nextChainIndexOf } from '@codra/models';
 import { FormatterService } from '@server/services/formatter';
+import { getResolvedModelConfig } from '@codra/db/model-configs';
 
 // The only place the four job-scoped collaborators are constructed. Every specifier above is the
-// barrel form on purpose: nine specs vi.mock '@server/services/github' and '@server/services/model',
+// barrel form on purpose: nine specs vi.mock '@server/services/github' and '@codra/models',
 // and reaching for a sibling here would bypass those mocks while the tests kept passing.
 
 export function makeGitHubFactory(env: AppBindings) {
@@ -15,7 +16,16 @@ export function makeGitHubFactory(env: AppBindings) {
 }
 
 export function makeModelFactory(env: AppBindings) {
-  return (jobId: string, tracker: TokenTracker): ReviewModel => new ModelService(env, tracker, { jobId });
+  return (jobId: string, tracker: TokenTracker): ReviewModel => new ModelRunner({
+    kv: env.APP_KV as any, // APP_KV matches KvStore interface
+    secretStore: {
+      getSecret: async (key) => env[key as keyof AppBindings] as string || null,
+    },
+    getConfig: (modelId) => getResolvedModelConfig(env, modelId),
+    aiBinding: env.AI,
+    tracker,
+    jobId,
+  });
 }
 
 export function makeFormatterFactory(env: AppBindings) {
diff --git a/src/server/core/sessions.ts b/src/server/core/sessions.ts
index 94aefcf0..7bca938d 100644
--- a/src/server/core/sessions.ts
+++ b/src/server/core/sessions.ts
@@ -1,4 +1,3 @@
-import { randomHex } from '@codra/schema/hex';
 import { deleteCookie, getCookie, setCookie } from 'hono/cookie';
 import type { Context } from 'hono';
 import type { AppEnv, DashboardSessionUser } from '@server/env';
@@ -8,16 +7,9 @@ const SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
 
 type SessionRecord = DashboardSessionUser;
 
-function sessionKey(token: string) {
-  return `session:${token}`;
-}
 
 export async function createSession(c: Context<AppEnv>, session: SessionRecord) {
-  const token = randomHex();
-
-  await c.env.APP_KV.put(sessionKey(token), JSON.stringify(session), {
-    expirationTtl: SESSION_TTL_SECONDS,
-  });
+  const token = await c.env.SESSION_STORE.createSession(session);
 
   setCookie(c, SESSION_COOKIE_NAME, token, {
     httpOnly: true,
@@ -36,7 +28,7 @@ export async function createSession(c: Context<AppEnv>, session: SessionRecord)
 export async function destroySession(c: Context<AppEnv>) {
   const token = getCookie(c, SESSION_COOKIE_NAME);
   if (token) {
-    await c.env.APP_KV.delete(sessionKey(token));
+    await c.env.SESSION_STORE.destroySession(token);
   }
 
   c.set('sessionToken', null);
@@ -56,7 +48,7 @@ export async function readSession(c: Context<AppEnv>) {
     return null;
   }
 
-  const session = await c.env.APP_KV.get(sessionKey(token), 'json') as SessionRecord | null;
+  const session = await c.env.SESSION_STORE.readSession(token);
   c.set('sessionUser', session);
   return session;
 }
diff --git a/src/server/env.d.ts b/src/server/env.d.ts
new file mode 100644
index 00000000..195bf6e6
--- /dev/null
+++ b/src/server/env.d.ts
@@ -0,0 +1,32 @@
+import type { DashboardSessionUser, SessionStore } from '@codra/core';
+export interface AppBindings {
+    SESSION_STORE: SessionStore;
+    APP_PRIVATE_KEY: string;
+    GITHUB_APP_ID: string;
+    GITHUB_APP_SLUG?: string;
+    GITHUB_APP_WEBHOOK_SECRET: string;
+    GITHUB_CLIENT_ID: string;
+    GITHUB_CLIENT_SECRET: string;
+    AUTH_CALLBACK_URL: string;
+    APP_URL: string;
+    DASHBOARD_ALLOWED_USERS: string;
+    LLM_CONFIG_ENCRYPTION_KEY: string;
+    BOT_USERNAME: string;
+    ENVIRONMENT: string;
+    CF_API_TOKEN: string;
+    CF_ACCOUNT_ID: string;
+    APP_KV?: any;
+    REVIEW_QUEUE?: any;
+    REVIEW_WORKFLOW?: any;
+    ASSETS?: any;
+    HYPERDRIVE?: any;
+}
+export interface AppVariables {
+    sessionToken: string | null;
+    sessionUser: DashboardSessionUser | null;
+    requestId: string;
+}
+export type AppEnv = {
+    Bindings: AppBindings;
+    Variables: AppVariables;
+};
diff --git a/src/server/env.ts b/src/server/env.ts
index a03e8934..e8f3be08 100644
--- a/src/server/env.ts
+++ b/src/server/env.ts
@@ -1,37 +1,8 @@
-import type { ReviewJobMessage } from '@codra/schema';
-
-export interface WorkersAiBinding {
-  run(model: string, input: Record<string, unknown>, options?: { signal?: AbortSignal }): Promise<any>;
-}
-
-export interface QueueProducer<T> {
-  send(message: T, options?: { delaySeconds?: number }): Promise<void>;
-}
-
-export interface AssetsBinding {
-  fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
-}
-
-export interface HyperdriveBinding {
-  connectionString: string;
-}
-
-export interface DashboardSessionUser {
-  githubUserId: number;
-  login: string;
-  name: string | null;
-  avatarUrl: string | null;
-  email: string | null;
-  signedInAt: string;
-}
+import type { DashboardSessionUser, SessionStore } from '@codra/core';
+export type { DashboardSessionUser };
 
 export interface AppBindings {
-  AI: WorkersAiBinding;
-  APP_KV: KVNamespace;
-  REVIEW_QUEUE: QueueProducer<ReviewJobMessage>;
-  REVIEW_WORKFLOW: Workflow;
-  ASSETS: AssetsBinding;
-  HYPERDRIVE: HyperdriveBinding;
+  SESSION_STORE: SessionStore;
   APP_PRIVATE_KEY: string;
   GITHUB_APP_ID: string;
   GITHUB_APP_SLUG?: string;
@@ -44,8 +15,18 @@ export interface AppBindings {
   LLM_CONFIG_ENCRYPTION_KEY: string;
   BOT_USERNAME: string;
   ENVIRONMENT: string;
+  
+  // These are still used by DB for now, until DB is fully ported
   CF_API_TOKEN: string;
   CF_ACCOUNT_ID: string;
+
+  // Temporary aliases while we port everything else
+  APP_KV: any;
+  REVIEW_QUEUE: any;
+  REVIEW_WORKFLOW: any;
+  ASSETS: any;
+  HYPERDRIVE: any;
+  AI: any;
 }
 
 export interface AppVariables {
diff --git a/src/server/routes/api/models.ts b/src/server/routes/api/models.ts
index c2b352f6..084299d9 100644
--- a/src/server/routes/api/models.ts
+++ b/src/server/routes/api/models.ts
@@ -17,16 +17,25 @@ import {
 } from '@codra/db/model-configs';
 import { jsonError } from '@server/core/http';
 import { getGlobalConfig, updateGlobalConfig } from '@server/core/config';
-import { encryptLlmApiKey, decryptLlmApiKey } from '@server/core/llm-crypto';
+import {
+  encryptLlmApiKey,
+  decryptLlmApiKey,
+  reviewWithCloudflare,
+  reviewWithGoogle,
+  reviewWithVertex,
+  reviewWithOpenAI,
+  reviewWithAnthropic,
+  listProviderModels,
+  ProviderRequestError,
+  type ModelInput,
+} from '@codra/models';
 import { llmApiFormats } from '@codra/schema';
-import { reviewWithCloudflare } from '@server/models/cloudflare';
-import { reviewWithGoogle } from '@server/models/google';
-import { reviewWithVertex } from '@server/models/vertex';
-import { reviewWithOpenAI } from '@server/models/openai';
-import { reviewWithAnthropic } from '@server/models/anthropic';
-import { listProviderModels } from '@server/models/catalog';
-import { ProviderRequestError, type ModelInput } from '@server/models/types';
 import { buildReviewResponseSchema } from '@server/prompts/file-review';
+import type { SecretStore } from '@codra/core/ports';
+
+function getSecretStore(env: AppEnv['Bindings']): SecretStore {
+  return { getSecret: async (key: string) => (env as any)[key] as string || null };
+}
 
 // Per-attempt budget for "Test connection": a person is waiting, and a retry ladder multiplies it.
 const PREFLIGHT_TIMEOUT_MS = 15_000;
@@ -83,7 +92,7 @@ async function encryptedApiKeyFromBody(env: AppEnv['Bindings'], apiKey?: string,
   if (apiKey === undefined) return undefined;
   const trimmed = apiKey.trim();
   if (!trimmed) return undefined;
-  return encryptLlmApiKey(env, trimmed);
+  return encryptLlmApiKey(getSecretStore(env), trimmed);
 }
 
 function isEncryptionConfigError(error: unknown) {
@@ -143,7 +152,7 @@ async function syncProviderModelCatalog(env: AppEnv['Bindings']) {
 
     try {
       const apiKey = provider.encryptedApiKey
-        ? await decryptLlmApiKey(env, provider.encryptedApiKey)
+        ? await decryptLlmApiKey(getSecretStore(env), provider.encryptedApiKey)
         : undefined;
       const modelNames = await listProviderModels({
         apiFormat: provider.apiFormat,
@@ -348,12 +357,12 @@ export function createModelsRouter() {
       };
       let response;
       if (config.apiFormat === 'cloudflare-workers-ai') {
-        response = await reviewWithCloudflare(c.env, config.modelName, input, undefined, config.providerName);
+        response = await reviewWithCloudflare(c.env.AI, config.modelName, input, undefined, config.providerName);
       } else {
         if (!config.encryptedApiKey) {
           return jsonError(`Provider ${config.providerName} does not have a saved API key.`, 400);
         }
-        const apiKey = await decryptLlmApiKey(c.env, config.encryptedApiKey);
+        const apiKey = await decryptLlmApiKey(getSecretStore(c.env), config.encryptedApiKey);
         
         switch (config.apiFormat) {
           case 'gemini':
diff --git a/test/findings/prompts-batch-review.spec.ts b/test/findings/prompts-batch-review.spec.ts
index be9572dd..43a65a9c 100644
--- a/test/findings/prompts-batch-review.spec.ts
+++ b/test/findings/prompts-batch-review.spec.ts
@@ -6,7 +6,7 @@ import {
   generatorFindingCap,
 } from '@server/prompts/file-review';
 import { BIN_DIFF_CHAR_BUDGET, BIN_MAX_FILES } from '@server/core/review';
-import { PROMPT_FIT_SAFETY_FACTOR, estimatePromptTokens } from '@server/services/model';
+import { PROMPT_FIT_SAFETY_FACTOR, estimatePromptTokens } from '@codra/models';
 import { defaultRepoConfig } from '@codra/schema';
 import type { FileDiff } from '@server/core/diff';
 
diff --git a/test/helpers.ts b/test/helpers.ts
index 72ee4605..0a0eff98 100644
--- a/test/helpers.ts
+++ b/test/helpers.ts
@@ -1,7 +1,10 @@
 import { describe } from 'vitest';
 import type { AppBindings } from '@server/env';
-import { encryptLlmApiKey } from '@server/core/llm-crypto';
+import { InMemorySessionStore } from '@codra/core';
+import { encryptLlmApiKey, ModelRunner } from '@codra/models';
 import { queryRows } from '@codra/db/client';
+import { getResolvedModelConfig } from '@codra/db/model-configs';
+import type { TokenTracker } from '@server/core/token-tracker';
 
 export class MemoryKV {
   private readonly store = new Map<string, string>();
@@ -106,6 +109,7 @@ export function createTestEnv(overrides: Partial<AppBindings> = {}): AppBindings
       },
     },
     APP_KV: new MemoryKV() as unknown as KVNamespace,
+    SESSION_STORE: new InMemorySessionStore(),
     REVIEW_QUEUE: new MockQueue() as any,
     REVIEW_WORKFLOW: new MockWorkflow() as any,
     ASSETS: new MockAssets() as any,
@@ -130,6 +134,17 @@ export function createTestEnv(overrides: Partial<AppBindings> = {}): AppBindings
   };
 }
 
+export function createTestModelRunner(env: AppBindings, tracker?: TokenTracker, opts: { jobId?: string } = {}) {
+  return new ModelRunner({
+    kv: env.APP_KV as any,
+    secretStore: { getSecret: async (k: string) => (env as any)[k] as string || null },
+    getConfig: async (id: string) => getResolvedModelConfig(env as any, id),
+    aiBinding: env.AI,
+    tracker,
+    jobId: opts.jobId,
+  });
+}
+
 // These Gemini fixtures are NOT real catalog entries -- only Cloudflare models are seeded by
 // ensureModelCatalog -- so tests must create them here, or they'd pass locally and fail on a fresh
 // CI database. gemini-3.1-flash-lite lets a test assert fall-through to a model that actually
@@ -137,7 +152,7 @@ export function createTestEnv(overrides: Partial<AppBindings> = {}): AppBindings
 const GOOGLE_TEST_MODEL_IDS = ['gemini-3.1-pro-preview', 'gemini-2.5-pro', 'gemini-3.1-flash-lite'];
 
 export async function saveTestProviderApiKey(env: AppBindings, providerName = 'Google', apiKey = 'test-key') {
-  const encrypted = await encryptLlmApiKey(env, apiKey);
+  const encrypted = await encryptLlmApiKey({ getSecret: async (key) => env[key as keyof AppBindings] as string || null }, apiKey);
   await queryRows(
     env,
     `
diff --git a/test/migrate-sql-split.spec.ts b/test/migrate-sql-split.spec.ts
index 4213c304..94540635 100644
--- a/test/migrate-sql-split.spec.ts
+++ b/test/migrate-sql-split.spec.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from 'vitest';
+// @ts-expect-error - No declaration file for this script
 import { readDollarQuoteTag, splitSqlStatements } from '../packages/db/scripts/migrate-sql-split.mjs';
 
 describe('readDollarQuoteTag', () => {
diff --git a/test/mocks/services.ts b/test/mocks/services.ts
index 5a0945e8..60746737 100644
--- a/test/mocks/services.ts
+++ b/test/mocks/services.ts
@@ -1,4 +1,4 @@
-import type { BatchReviewOutcome } from '@server/services/model';
+import type { BatchReviewOutcome } from '@codra/models';
 // Shared service doubles for the DB-backed review suites. `vi.mock` factories are hoisted, so pull
 // these in with a dynamic `await import(...)` inside the factory.
 
@@ -141,7 +141,7 @@ export function makeModelServiceMock(overrides: Record<string, unknown> = {}) {
 export const isRetryableModelErrorMock = (error: unknown) =>
   Boolean(error && typeof error === 'object' && (error as { retryable?: boolean }).retryable === true);
 
-// Every hand-built mock of the '@server/services/model' barrel must include this. The review
+// Every hand-built mock of the '@codra/models' barrel must include this. The review
 // runners call it inside their catch block, so a missing export is a TypeError raised while
 // handling a failure -- which silently converts a deferral into a terminal one.
 export const nextChainIndexOfMock = (error: unknown) => {
diff --git a/test/review/async-batch.spec.ts b/test/review/async-batch.spec.ts
index 22cd0a79..f199537a 100644
--- a/test/review/async-batch.spec.ts
+++ b/test/review/async-batch.spec.ts
@@ -37,7 +37,7 @@ vi.mock('@codra/provider-github', async (importOriginal) => {
 // pending, the second completes. reviewFile must NOT be called on the async path.
 const pollCalls = { count: 0 };
 const reviewFileSpy = vi.fn();
-vi.mock('@server/services/model', async () => {
+vi.mock('@codra/models', async () => {
   class MockModelService {
     async submitReviewBatch() {
       return { requestId: 'req-async-1', model: '@cf/moonshotai/kimi-k2.6' };
@@ -62,7 +62,7 @@ vi.mock('@server/services/model', async () => {
     async generateSummary() { return { modelUsed: 'm', provider: 'p', rawText: '{"summary":"s"}', inputTokens: 1, outputTokens: 1 }; }
   }
   const { nextChainIndexOfMock } = await import('../mocks/services');
-  return { ModelService: MockModelService, isRetryableModelError: (e: unknown) => Boolean(e && typeof e === 'object' && (e as any).retryable === true), nextChainIndexOf: nextChainIndexOfMock };
+  return { ModelRunner: MockModelService, isRetryableModelError: (e: unknown) => Boolean(e && typeof e === 'object' && (e as any).retryable === true), nextChainIndexOf: nextChainIndexOfMock };
 });
 
 
diff --git a/test/review/batch-flow.spec.ts b/test/review/batch-flow.spec.ts
index 7644fc33..a22ec0fd 100644
--- a/test/review/batch-flow.spec.ts
+++ b/test/review/batch-flow.spec.ts
@@ -24,9 +24,9 @@ vi.mock('@codra/provider-github', async (importOriginal) => {
   return { ...mod, GitHubService: makeGitHubServiceMock() };
 });
 
-vi.mock('@server/services/model', async () => {
+vi.mock('@codra/models', async () => {
   const { makeModelServiceMock, isRetryableModelErrorMock, nextChainIndexOfMock } = await import('../mocks/services');
-  return { ModelService: makeModelServiceMock(), isRetryableModelError: isRetryableModelErrorMock, nextChainIndexOf: nextChainIndexOfMock };
+  return { ModelRunner: makeModelServiceMock(), isRetryableModelError: isRetryableModelErrorMock, nextChainIndexOf: nextChainIndexOfMock };
 });
 
 const batchingConfig = {
@@ -70,12 +70,12 @@ dbDescribe('Review flow: batched small files', () => {
 
   it('reviews several small files in one call and writes a row per file', async () => {
     const { GitHubService } = await import('@codra/provider-github');
-    const { ModelService } = await import('@server/services/model');
+    const { ModelRunner } = await import('@codra/models');
     const getDiffSpy = vi.spyOn(GitHubService.prototype, 'getPullRequestDiff')
       .mockResolvedValue(generateMockDiff(smallFiles));
 
-    const reviewFilesSpy = vi.spyOn(ModelService.prototype as any, 'reviewFiles');
-    const reviewFileSpy = vi.spyOn(ModelService.prototype as any, 'reviewFile');
+    const reviewFilesSpy = vi.spyOn(ModelRunner.prototype as any, 'reviewFiles');
+    const reviewFileSpy = vi.spyOn(ModelRunner.prototype as any, 'reviewFile');
 
     const job = await seedJob(env, uniqueRepo('batch-happy'));
 
@@ -114,12 +114,12 @@ dbDescribe('Review flow: batched small files', () => {
   // would wipe correct findings.
   it('keeps already-committed rows when a later step fails', async () => {
     const { GitHubService } = await import('@codra/provider-github');
-    const { ModelService } = await import('@server/services/model');
+    const { ModelRunner } = await import('@codra/models');
     const { reviewBatchResponse } = await import('../mocks/services');
     const fileReviews = await import('@codra/db/file-reviews');
     vi.spyOn(GitHubService.prototype, 'getPullRequestDiff').mockResolvedValue(generateMockDiff(smallFiles));
 
-    vi.spyOn(ModelService.prototype as any, 'reviewFiles').mockImplementation(async () => {
+    vi.spyOn(ModelRunner.prototype as any, 'reviewFiles').mockImplementation(async () => {
       const response = reviewBatchResponse(['src/a.ts', 'src/b.ts']);
       response.batch.missing = ['src/c.ts'];
       return response;
@@ -145,14 +145,14 @@ dbDescribe('Review flow: batched small files', () => {
   // A silently omitted file is re-queued as retryable, and is not progress for the wedge counter.
   it('re-queues a file the model omitted instead of approving it', async () => {
     const { GitHubService } = await import('@codra/provider-github');
-    const { ModelService } = await import('@server/services/model');
+    const { ModelRunner } = await import('@codra/models');
     const { reviewBatchResponse } = await import('../mocks/services');
     const jobsModule = await import('@codra/db/jobs');
     const getDiffSpy = vi.spyOn(GitHubService.prototype, 'getPullRequestDiff')
       .mockResolvedValue(generateMockDiff(smallFiles));
 
     const resetSpy = vi.spyOn(jobsModule, 'resetJobContinuationCount');
-    const reviewFilesSpy = vi.spyOn(ModelService.prototype as any, 'reviewFiles')
+    const reviewFilesSpy = vi.spyOn(ModelRunner.prototype as any, 'reviewFiles')
       .mockImplementation(async () => {
         const response = reviewBatchResponse([]);
         response.batch.missing = smallFiles.map((f) => f.path);
@@ -184,7 +184,7 @@ dbDescribe('Review flow: batched small files', () => {
   // failure also sets a 30s job delay, which would pass for the wrong reason.
   it('falls back to single-file reviews once a bin member has failed transiently', async () => {
     const { GitHubService } = await import('@codra/provider-github');
-    const { ModelService } = await import('@server/services/model');
+    const { ModelRunner } = await import('@codra/models');
     const { bulkRecordRetryableFileReviewFailures } = await import('@codra/db/file-reviews');
     vi.spyOn(GitHubService.prototype, 'getPullRequestDiff').mockResolvedValue(generateMockDiff(smallFiles));
 
@@ -196,8 +196,8 @@ dbDescribe('Review flow: batched small files', () => {
       errorMessage: 'provider outage; retrying later',
     }]);
 
-    const reviewFilesSpy = vi.spyOn(ModelService.prototype as any, 'reviewFiles');
-    const reviewFileSpy = vi.spyOn(ModelService.prototype as any, 'reviewFile');
+    const reviewFilesSpy = vi.spyOn(ModelRunner.prototype as any, 'reviewFiles');
+    const reviewFileSpy = vi.spyOn(ModelRunner.prototype as any, 'reviewFile');
 
     await runWithDb(env, async () => {
       await runReviewJob(env, { jobId: job.id, deliveryId: 'delivery-d2', phase: 'review' }).catch(() => undefined);
diff --git a/test/review/flow-chunking.spec.ts b/test/review/flow-chunking.spec.ts
index 96e2342b..87017d05 100644
--- a/test/review/flow-chunking.spec.ts
+++ b/test/review/flow-chunking.spec.ts
@@ -33,9 +33,9 @@ vi.mock('@codra/provider-github', async (importOriginal) => {
   return { ...mod, GitHubService: makeGitHubServiceMock() };
 });
 
-vi.mock('@server/services/model', async () => {
+vi.mock('@codra/models', async () => {
   const { makeModelServiceMock, isRetryableModelErrorMock, nextChainIndexOfMock } = await import('../mocks/services');
-  return { ModelService: makeModelServiceMock(), isRetryableModelError: isRetryableModelErrorMock, nextChainIndexOf: nextChainIndexOfMock };
+  return { ModelRunner: makeModelServiceMock(), isRetryableModelError: isRetryableModelErrorMock, nextChainIndexOf: nextChainIndexOfMock };
 });
 
 dbDescribe('Review flow: chunking, partial reviews and re-posting', () => {
@@ -56,7 +56,7 @@ dbDescribe('Review flow: chunking, partial reviews and re-posting', () => {
 
   it('reviews files in a chunk concurrently', async () => {
     const { GitHubService } = await import('@codra/provider-github');
-    const { ModelService } = await import('@server/services/model');
+    const { ModelRunner } = await import('@codra/models');
     const repo = uniqueRepo('concurrent');
     const headSha = sha('8');
     const baseSha = sha('9');
@@ -68,7 +68,7 @@ dbDescribe('Review flow: chunking, partial reviews and re-posting', () => {
     );
     let active = 0;
     let maxActive = 0;
-    const reviewSpy = vi.spyOn(ModelService.prototype as any, 'reviewFile').mockImplementation(async (params: any) => {
+    const reviewSpy = vi.spyOn(ModelRunner.prototype as any, 'reviewFile').mockImplementation(async (params: any) => {
       active += 1;
       maxActive = Math.max(maxActive, active);
       await new Promise((resolve) => setTimeout(resolve, 25));
@@ -131,7 +131,7 @@ dbDescribe('Review flow: chunking, partial reviews and re-posting', () => {
 
   it('marks completed jobs with skipped files as partial reviews', async () => {
     const { GitHubService } = await import('@codra/provider-github');
-    const { ModelService } = await import('@server/services/model');
+    const { ModelRunner } = await import('@codra/models');
     const repo = uniqueRepo('partial');
     const headSha = sha('e');
     const baseSha = sha('f');
@@ -156,7 +156,7 @@ dbDescribe('Review flow: chunking, partial reviews and re-posting', () => {
       baseRef: 'main',
       configSnapshot: defaultRepoConfig,
     });
-    const summarySpy = vi.spyOn(ModelService.prototype as any, 'generateSummary');
+    const summarySpy = vi.spyOn(ModelRunner.prototype as any, 'generateSummary');
     await updateJobFileCount(env, job.id, 2);
     await updateJobStep(env, job.id, 'Preparation', { status: 'done' });
     await updateJobStep(env, job.id, 'Reviewing Files', { status: 'done' });
diff --git a/test/review/flow-lifecycle.spec.ts b/test/review/flow-lifecycle.spec.ts
index f3927a2e..e7ede928 100644
--- a/test/review/flow-lifecycle.spec.ts
+++ b/test/review/flow-lifecycle.spec.ts
@@ -35,9 +35,9 @@ vi.mock('@codra/provider-github', async (importOriginal) => {
   return { ...mod, GitHubService: makeGitHubServiceMock() };
 });
 
-vi.mock('@server/services/model', async () => {
+vi.mock('@codra/models', async () => {
   const { makeModelServiceMock, isRetryableModelErrorMock, nextChainIndexOfMock } = await import('../mocks/services');
-  return { ModelService: makeModelServiceMock(), isRetryableModelError: isRetryableModelErrorMock, nextChainIndexOf: nextChainIndexOfMock };
+  return { ModelRunner: makeModelServiceMock(), isRetryableModelError: isRetryableModelErrorMock, nextChainIndexOf: nextChainIndexOfMock };
 });
 
 // Whether the maintenance sweep would pick THIS job up, mirroring its predicate exactly. Asserted
diff --git a/test/review/flow-retry.spec.ts b/test/review/flow-retry.spec.ts
index c86d1df0..2da2744e 100644
--- a/test/review/flow-retry.spec.ts
+++ b/test/review/flow-retry.spec.ts
@@ -34,9 +34,9 @@ vi.mock('@codra/provider-github', async (importOriginal) => {
   return { ...mod, GitHubService: makeGitHubServiceMock() };
 });
 
-vi.mock('@server/services/model', async () => {
+vi.mock('@codra/models', async () => {
   const { makeModelServiceMock, isRetryableModelErrorMock, nextChainIndexOfMock } = await import('../mocks/services');
-  return { ModelService: makeModelServiceMock(), isRetryableModelError: isRetryableModelErrorMock, nextChainIndexOf: nextChainIndexOfMock };
+  return { ModelRunner: makeModelServiceMock(), isRetryableModelError: isRetryableModelErrorMock, nextChainIndexOf: nextChainIndexOfMock };
 });
 
 dbDescribe('Review flow: retries, inheritance and continuations', () => {
@@ -97,8 +97,8 @@ dbDescribe('Review flow: retries, inheritance and continuations', () => {
   }, REVIEW_FLOW_TIMEOUT_MS);
 
   it('does not inherit parent file reviews from models outside the current retry strategy', async () => {
-    const { ModelService } = await import('@server/services/model');
-    const reviewSpy = vi.spyOn(ModelService.prototype, 'reviewFile');
+    const { ModelRunner } = await import('@codra/models');
+    const reviewSpy = vi.spyOn(ModelRunner.prototype, 'reviewFile');
     const repo = uniqueRepo('retry-model-filter');
     const sourceHeadSha = sha('8');
     const retryHeadSha = sha('9');
@@ -181,8 +181,8 @@ dbDescribe('Review flow: retries, inheritance and continuations', () => {
     // Regression: file reviews persist the bare model id (e.g. `gemini-3.1-flash-lite`) while the
     // configured strategy stores the provider-qualified id (e.g. `google:gemini-3.1-flash-lite`).
     // Inheritance must match on the bare name; otherwise every retry re-reviews every file.
-    const { ModelService } = await import('@server/services/model');
-    const reviewSpy = vi.spyOn(ModelService.prototype, 'reviewFile');
+    const { ModelRunner } = await import('@codra/models');
+    const reviewSpy = vi.spyOn(ModelRunner.prototype, 'reviewFile');
     const repo = uniqueRepo('retry-prefix');
     const sourceHeadSha = sha('a');
     const retryHeadSha = sha('b');
@@ -312,9 +312,9 @@ dbDescribe('Review flow: retries, inheritance and continuations', () => {
   }, REVIEW_FLOW_TIMEOUT_MS);
 
   it('schedules a delayed continuation instead of spending queue retries on transient model failures', async () => {
-    const { ModelService } = await import('@server/services/model');
+    const { ModelRunner } = await import('@codra/models');
     const retryableError = Object.assign(new Error('Google API timed out after 45000ms'), { retryable: true });
-    const reviewSpy = vi.spyOn(ModelService.prototype, 'reviewFile').mockRejectedValue(retryableError);
+    const reviewSpy = vi.spyOn(ModelRunner.prototype, 'reviewFile').mockRejectedValue(retryableError);
     const repo = uniqueRepo('transient');
     const headSha = sha('6');
     const baseSha = sha('7');
diff --git a/test/review/quota-deferral.spec.ts b/test/review/quota-deferral.spec.ts
index 8568f9d4..a85885cc 100644
--- a/test/review/quota-deferral.spec.ts
+++ b/test/review/quota-deferral.spec.ts
@@ -1,224 +1,225 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-import { isRetryableModelError, ModelService } from '@server/services/model';
-import { createTestEnv, saveTestProviderApiKey } from '../helpers';
-import { defaultRepoConfig } from '@codra/schema';
-
-const file = {
-  path: 'src/app.ts',
-  lineCount: 1,
-  hunks: [],
-  isDeleted: false,
-  isBinary: false,
-  isNew: false,
-  previousPath: null,
-};
-
-// Mirrors Free-tier body: cool-off is in the message, not just headers.
-function quotaResponse(retryInSeconds: number, model = 'gemini-3.1-pro-preview') {
-  return new Response(
-    JSON.stringify({
-      error: {
-        code: 429,
-        status: 'RESOURCE_EXHAUSTED',
-        message:
-          'You exceeded your current quota, please check your plan and billing details. '
-          + `* Quota exceeded for metric: generativelanguage.googleapis.com/generate_content_free_tier_input_token_count, limit: 16000, model: ${model}`
-          + `\nPlease retry in ${retryInSeconds}s.`,
-      },
-    }),
-    { status: 429, headers: { 'content-type': 'application/json' } },
-  );
-}
-
-describe('quota 429 handling', () => {
-  afterEach(() => vi.restoreAllMocks());
-
-  // Prevents subrequest blowouts by deferring files after two quota failures.
-  it('stops walking a long fallback chain after two quota failures and defers the file', async () => {
-    const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => quotaResponse(56));
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env);
-
-    await expect(
-      service.reviewFile({
-        file,
-        prTitle: 'Test',
-        prDescription: null,
-        totalLineCount: 1,
-        config: {
-          ...defaultRepoConfig,
-          model: {
-            main: 'gemini-3.1-pro-preview',
-            fallbacks: ['gemini-2.5-pro', 'gemini-3.1-flash-lite', 'gemini-3.5-flash-lite', 'gemini-3.6-flash'],
-            size_overrides: [],
-          },
-        },
-      }),
-    ).rejects.toSatisfy(isRetryableModelError);
-
-    // Defers after two model failures instead of exhausting the fallback chain.
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    const attempted = fetchMock.mock.calls.map((call) => String(call[0]));
-    expect(attempted.some((url) => url.includes('gemini-3.1-pro-preview'))).toBe(true);
-    expect(attempted.some((url) => url.includes('gemini-2.5-pro'))).toBe(true);
-    // Only seeded GOOGLE_TEST_MODEL_IDS issue fetches, making assertions reliable.
-    expect(attempted.some((url) => url.includes('gemini-3.1-flash-lite'))).toBe(false);
-  });
-});
-
-// Minimal successful review payload.
-function reviewResponse() {
-  return new Response(
-    JSON.stringify({
-      candidates: [{
-        content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok"}' }] },
-        finishReason: 'STOP',
-      }],
-      usageMetadata: { promptTokenCount: 100, candidatesTokenCount: 10 },
-    }),
-    { status: 200, headers: { 'content-type': 'application/json' } },
-  );
-}
-
-// Only one token-metered head model to prevent early MAX_QUOTA_FAILURES_PER_FILE deferrals masking these tests.
-const chain = {
-  ...defaultRepoConfig,
-  model: {
-    main: 'gemini-3.1-pro-preview',
-    fallbacks: ['gemini-3.1-flash-lite'],
-    size_overrides: [],
-  },
-};
-
-// Google's free tier meters input tokens per minute. Tests verify that we learn from 429 bodies to avoid wasted subrequests.
-describe('learning a provider rate limit from its own 429', () => {
-  afterEach(() => vi.restoreAllMocks());
-
-  function googleMock(onMetered: () => Response) {
-    return vi.spyOn(globalThis, 'fetch').mockImplementation(async (input) => {
-      const url = String(input);
-      return url.includes('pro-preview') ? onMetered() : reviewResponse();
-    });
-  }
-
-  // Skips cooling-off models for subsequent files to save subrequests.
-  it('skips a cooling-off model for subsequent files instead of re-probing it', async () => {
-    const fetchMock = googleMock(() => quotaResponse(56));
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env);
-    const params = { prTitle: 'Test', prDescription: null, totalLineCount: 1, config: chain };
-
-    // First file: metered model 429s, fallback answers.
-    await service.reviewFile({ ...params, file });
-    const afterFirst = fetchMock.mock.calls.length;
-    expect(fetchMock.mock.calls.some((c) => String(c[0]).includes('pro-preview'))).toBe(true);
-
-    // Second file: skips metered model, goes straight to fallback.
-    fetchMock.mockClear();
-    await service.reviewFile({ ...params, file: { ...file, path: 'src/second.ts' } });
-
-    expect(fetchMock.mock.calls.map((c) => String(c[0])).some((url) => url.includes('pro-preview'))).toBe(false);
-    expect(fetchMock.mock.calls).toHaveLength(1);
-    expect(afterFirst).toBeGreaterThan(1);
-  });
-
-  // Prevents sending prompts larger than the entire learned token bucket.
-  it('skips a model whose whole token bucket is smaller than the prompt', async () => {
-    const fetchMock = googleMock(() => quotaResponse(1));
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env);
-    const params = { prTitle: 'Test', prDescription: null, totalLineCount: 1, config: chain };
-
-    // Teach 16k bucket with small file, let cool-off lapse.
-    await service.reviewFile({ ...params, file });
-    await new Promise((resolve) => setTimeout(resolve, 1100));
-
-    // 300 long lines exceeds 16k tokens, but fits chunk cap.
-    const hugeFile = {
-      ...file,
-      path: 'src/huge.ts',
-      lineCount: 300,
-      hunks: [{
-        header: '@@ -1,300 +1,300 @@',
-        lines: Array.from({ length: 300 }, (_, i) => ({
-          kind: 'add' as const,
-          content: `const value${i} = ${'x'.repeat(240)};`,
-          newLineNumber: i + 1,
-          position: i + 1,
-        })),
-      }],
-    };
-
-    fetchMock.mockClear();
-    await service.reviewFile({ ...params, file: hugeFile });
-
-    // Size rule works even after cool-off expires.
-    expect(fetchMock.mock.calls.map((c) => String(c[0])).some((url) => url.includes('pro-preview'))).toBe(false);
-    expect(fetchMock.mock.calls).toHaveLength(1);
-  });
-
-  // Persisted cooldowns survive invocations, eliminating the largest source of wasted input tokens.
-  it('carries a cool-off to the next invocation of the same job', async () => {
-    const fetchMock = googleMock(() => quotaResponse(56));
-    // MemoryKV mimics continuation handoff.
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const params = { prTitle: 'Test', prDescription: null, totalLineCount: 1, config: chain };
-
-    const first = new ModelService(env, undefined, { jobId: 'job-continuation' });
-    await first.reviewFile({ ...params, file });
-    expect(fetchMock.mock.calls.some((c) => String(c[0]).includes('pro-preview'))).toBe(true);
-
-    // Brand-new service mimics fresh invocation.
-    fetchMock.mockClear();
-    const next = new ModelService(env, undefined, { jobId: 'job-continuation' });
-    await next.reviewFile({ ...params, file: { ...file, path: 'src/second.ts' } });
-
-    // Metered model correctly skipped.
-    expect(fetchMock.mock.calls.map((c) => String(c[0])).some((url) => url.includes('pro-preview'))).toBe(false);
-    expect(fetchMock.mock.calls).toHaveLength(1);
-  });
-
-  it('keeps a cool-off scoped to its own job and model', async () => {
-    const fetchMock = googleMock(() => quotaResponse(56));
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const params = { prTitle: 'Test', prDescription: null, totalLineCount: 1, config: chain };
-
-    await new ModelService(env, undefined, { jobId: 'job-a' }).reviewFile({ ...params, file });
-
-    // Unrelated jobs must not inherit cool-offs (which could silently narrow coverage).
-    fetchMock.mockClear();
-    await new ModelService(env, undefined, { jobId: 'job-b' }).reviewFile({ ...params, file });
-
-    expect(fetchMock.mock.calls.map((c) => String(c[0])).some((url) => url.includes('pro-preview'))).toBe(true);
-  });
-
-  // Small files correctly return to stronger models after cool-off lapses.
-  it('returns to the primary model once its cool-off has expired', async () => {
-    let meteredCalls = 0;
-    const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async (input) => {
-      const url = String(input);
-      if (!url.includes('pro-preview')) return reviewResponse();
-      meteredCalls += 1;
-      return meteredCalls === 1 ? quotaResponse(1) : reviewResponse();
-    });
-
-    const env = createTestEnv();
-    await saveTestProviderApiKey(env);
-    const service = new ModelService(env);
-    const params = { prTitle: 'Test', prDescription: null, totalLineCount: 1, config: chain };
-
-    await service.reviewFile({ ...params, file });
-    await new Promise((resolve) => setTimeout(resolve, 1100));
-
-    fetchMock.mockClear();
-    const second = await service.reviewFile({ ...params, file: { ...file, path: 'src/third.ts' } });
-
-    expect(second.modelUsed).toContain('pro-preview');
-    expect(fetchMock.mock.calls.map((c) => String(c[0])).some((url) => url.includes('pro-preview'))).toBe(true);
-  });
-});
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { isRetryableModelError } from '@codra/models';
+import { createTestEnv, saveTestProviderApiKey } from '../helpers';
+import { defaultRepoConfig } from '@codra/schema';
+import { makeModelFactory } from '@server/adapters/services';
+
+const file = {
+  path: 'src/app.ts',
+  lineCount: 1,
+  hunks: [],
+  isDeleted: false,
+  isBinary: false,
+  isNew: false,
+  previousPath: null,
+};
+
+// Mirrors Free-tier body: cool-off is in the message, not just headers.
+function quotaResponse(retryInSeconds: number, model = 'gemini-3.1-pro-preview') {
+  return new Response(
+    JSON.stringify({
+      error: {
+        code: 429,
+        status: 'RESOURCE_EXHAUSTED',
+        message:
+          'You exceeded your current quota, please check your plan and billing details. '
+          + `* Quota exceeded for metric: generativelanguage.googleapis.com/generate_content_free_tier_input_token_count, limit: 16000, model: ${model}`
+          + `\nPlease retry in ${retryInSeconds}s.`,
+      },
+    }),
+    { status: 429, headers: { 'content-type': 'application/json' } },
+  );
+}
+
+describe('quota 429 handling', () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  // Prevents subrequest blowouts by deferring files after two quota failures.
+  it('stops walking a long fallback chain after two quota failures and defers the file', async () => {
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => quotaResponse(56));
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const service = makeModelFactory(env)('job-x', undefined as any);
+
+    await expect(
+      service.reviewFile({
+        file,
+        prTitle: 'Test',
+        prDescription: null,
+        totalLineCount: 1,
+        config: {
+          ...defaultRepoConfig,
+          model: {
+            main: 'gemini-3.1-pro-preview',
+            fallbacks: ['gemini-2.5-pro', 'gemini-3.1-flash-lite', 'gemini-3.5-flash-lite', 'gemini-3.6-flash'],
+            size_overrides: [],
+          },
+        },
+      }),
+    ).rejects.toSatisfy(isRetryableModelError);
+
+    // Defers after two model failures instead of exhausting the fallback chain.
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    const attempted = fetchMock.mock.calls.map((call) => String(call[0]));
+    expect(attempted.some((url) => url.includes('gemini-3.1-pro-preview'))).toBe(true);
+    expect(attempted.some((url) => url.includes('gemini-2.5-pro'))).toBe(true);
+    // Only seeded GOOGLE_TEST_MODEL_IDS issue fetches, making assertions reliable.
+    expect(attempted.some((url) => url.includes('gemini-3.1-flash-lite'))).toBe(false);
+  });
+});
+
+// Minimal successful review payload.
+function reviewResponse() {
+  return new Response(
+    JSON.stringify({
+      candidates: [{
+        content: { parts: [{ text: '{"findings":[],"overall_correctness":"patch is correct","overall_explanation":"ok"}' }] },
+        finishReason: 'STOP',
+      }],
+      usageMetadata: { promptTokenCount: 100, candidatesTokenCount: 10 },
+    }),
+    { status: 200, headers: { 'content-type': 'application/json' } },
+  );
+}
+
+// Only one token-metered head model to prevent early MAX_QUOTA_FAILURES_PER_FILE deferrals masking these tests.
+const chain = {
+  ...defaultRepoConfig,
+  model: {
+    main: 'gemini-3.1-pro-preview',
+    fallbacks: ['gemini-3.1-flash-lite'],
+    size_overrides: [],
+  },
+};
+
+// Google's free tier meters input tokens per minute. Tests verify that we learn from 429 bodies to avoid wasted subrequests.
+describe('learning a provider rate limit from its own 429', () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  function googleMock(onMetered: () => Response) {
+    return vi.spyOn(globalThis, 'fetch').mockImplementation(async (input) => {
+      const url = String(input);
+      return url.includes('pro-preview') ? onMetered() : reviewResponse();
+    });
+  }
+
+  // Skips cooling-off models for subsequent files to save subrequests.
+  it('skips a cooling-off model for subsequent files instead of re-probing it', async () => {
+    const fetchMock = googleMock(() => quotaResponse(56));
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const service = makeModelFactory(env)('job-x', undefined as any);
+    const params = { prTitle: 'Test', prDescription: null, totalLineCount: 1, config: chain };
+
+    // First file: metered model 429s, fallback answers.
+    await service.reviewFile({ ...params, file });
+    const afterFirst = fetchMock.mock.calls.length;
+    expect(fetchMock.mock.calls.some((c) => String(c[0]).includes('pro-preview'))).toBe(true);
+
+    // Second file: skips metered model, goes straight to fallback.
+    fetchMock.mockClear();
+    await service.reviewFile({ ...params, file: { ...file, path: 'src/second.ts' } });
+
+    expect(fetchMock.mock.calls.map((c) => String(c[0])).some((url) => url.includes('pro-preview'))).toBe(false);
+    expect(fetchMock.mock.calls).toHaveLength(1);
+    expect(afterFirst).toBeGreaterThan(1);
+  });
+
+  // Prevents sending prompts larger than the entire learned token bucket.
+  it('skips a model whose whole token bucket is smaller than the prompt', async () => {
+    const fetchMock = googleMock(() => quotaResponse(1));
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const service = makeModelFactory(env)('job-x', undefined as any);
+    const params = { prTitle: 'Test', prDescription: null, totalLineCount: 1, config: chain };
+
+    // Teach 16k bucket with small file, let cool-off lapse.
+    await service.reviewFile({ ...params, file });
+    await new Promise((resolve) => setTimeout(resolve, 1100));
+
+    // 300 long lines exceeds 16k tokens, but fits chunk cap.
+    const hugeFile = {
+      ...file,
+      path: 'src/huge.ts',
+      lineCount: 300,
+      hunks: [{
+        header: '@@ -1,300 +1,300 @@',
+        lines: Array.from({ length: 300 }, (_, i) => ({
+          kind: 'add' as const,
+          content: `const value${i} = ${'x'.repeat(240)};`,
+          newLineNumber: i + 1,
+          position: i + 1,
+        })),
+      }],
+    };
+
+    fetchMock.mockClear();
+    await service.reviewFile({ ...params, file: hugeFile });
+
+    // Size rule works even after cool-off expires.
+    expect(fetchMock.mock.calls.map((c) => String(c[0])).some((url) => url.includes('pro-preview'))).toBe(false);
+    expect(fetchMock.mock.calls).toHaveLength(1);
+  });
+
+  // Persisted cooldowns survive invocations, eliminating the largest source of wasted input tokens.
+  it('carries a cool-off to the next invocation of the same job', async () => {
+    const fetchMock = googleMock(() => quotaResponse(56));
+    // MemoryKV mimics continuation handoff.
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const params = { prTitle: 'Test', prDescription: null, totalLineCount: 1, config: chain };
+
+    const first = makeModelFactory(env)('job-continuation', undefined as any);
+    await first.reviewFile({ ...params, file });
+    expect(fetchMock.mock.calls.some((c) => String(c[0]).includes('pro-preview'))).toBe(true);
+
+    // Brand-new service mimics fresh invocation.
+    fetchMock.mockClear();
+    const next = makeModelFactory(env)('job-continuation', undefined as any);
+    await next.reviewFile({ ...params, file: { ...file, path: 'src/second.ts' } });
+
+    // Metered model correctly skipped.
+    expect(fetchMock.mock.calls.map((c) => String(c[0])).some((url) => url.includes('pro-preview'))).toBe(false);
+    expect(fetchMock.mock.calls).toHaveLength(1);
+  });
+
+  it('keeps a cool-off scoped to its own job and model', async () => {
+    const fetchMock = googleMock(() => quotaResponse(56));
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const params = { prTitle: 'Test', prDescription: null, totalLineCount: 1, config: chain };
+
+    await makeModelFactory(env)('job-a', undefined as any).reviewFile({ ...params, file });
+
+    // Unrelated jobs must not inherit cool-offs (which could silently narrow coverage).
+    fetchMock.mockClear();
+    await makeModelFactory(env)('job-b', undefined as any).reviewFile({ ...params, file });
+
+    expect(fetchMock.mock.calls.map((c) => String(c[0])).some((url) => url.includes('pro-preview'))).toBe(true);
+  });
+
+  // Small files correctly return to stronger models after cool-off lapses.
+  it('returns to the primary model once its cool-off has expired', async () => {
+    let meteredCalls = 0;
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockImplementation(async (input) => {
+      const url = String(input);
+      if (!url.includes('pro-preview')) return reviewResponse();
+      meteredCalls += 1;
+      return meteredCalls === 1 ? quotaResponse(1) : reviewResponse();
+    });
+
+    const env = createTestEnv();
+    await saveTestProviderApiKey(env);
+    const service = makeModelFactory(env)('job-x', undefined as any);
+    const params = { prTitle: 'Test', prDescription: null, totalLineCount: 1, config: chain };
+
+    await service.reviewFile({ ...params, file });
+    await new Promise((resolve) => setTimeout(resolve, 1100));
+
+    fetchMock.mockClear();
+    const second = await service.reviewFile({ ...params, file: { ...file, path: 'src/third.ts' } });
+
+    expect(second.modelUsed).toContain('pro-preview');
+    expect(fetchMock.mock.calls.map((c) => String(c[0])).some((url) => url.includes('pro-preview'))).toBe(true);
+  });
+});
diff --git a/test/review/resumable-queue.spec.ts b/test/review/resumable-queue.spec.ts
index 65461af8..1c90856f 100644
--- a/test/review/resumable-queue.spec.ts
+++ b/test/review/resumable-queue.spec.ts
@@ -1,4 +1,4 @@
-import worker from '@server/index';
+import worker from '../../apps/worker/src/index';
 import { claimJobLease, getJobForProcessing, insertJob, markJobContinuationQueued, recoverExpiredJobLeases, releaseJobLease } from '@codra/db/jobs';
 import { getFileReviewsForJobs, recordRetryableFileReviewFailure, upsertFileReview } from '@codra/db/file-reviews';
 import { getDb } from '@codra/db/client';
diff --git a/test/review/scheduled-maintenance.spec.ts b/test/review/scheduled-maintenance.spec.ts
index 92a73614..86d80cf8 100644
--- a/test/review/scheduled-maintenance.spec.ts
+++ b/test/review/scheduled-maintenance.spec.ts
@@ -20,7 +20,7 @@ vi.mock('@codra/db/jobs', async (importOriginal) => ({
   hasPendingMaintenanceWork: hasPendingMaintenanceWorkMock,
 }));
 
-import worker from '@server/index';
+import worker from '../../apps/worker/src/index';
 
 const controller = {} as ScheduledController;
 const ctx = { waitUntil: () => {}, passThroughOnException: () => {} } as unknown as ExecutionContext;
diff --git a/test/review/workflow-finalize-fresh-instance.spec.ts b/test/review/workflow-finalize-fresh-instance.spec.ts
index 2d601541..dd55abe0 100644
--- a/test/review/workflow-finalize-fresh-instance.spec.ts
+++ b/test/review/workflow-finalize-fresh-instance.spec.ts
@@ -23,7 +23,7 @@ vi.mock('@codra/db/jobs', async (importOriginal) => ({
 }));
 vi.mock('@codra/db/client', () => ({ runWithDb: (_env: any, fn: any) => fn() }));
 
-import { ReviewWorkflow } from '@server/workflows/review';
+import { ReviewWorkflow } from '../../apps/worker/src/workflows/review';
 
 // step.do(name, optsOrFn, maybeFn) runs the callback; step.sleep is a no-op.
 function makeStep() {
diff --git a/tsconfig.base.json b/tsconfig.base.json
index d47a857f..2d445738 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -1,9 +1,14 @@
 {
   "compilerOptions": {
     "target": "ES2024",
-    "lib": ["ES2024"],
+    "lib": ["ES2024", "DOM", "DOM.Iterable"],
     "module": "ESNext",
     "moduleResolution": "Bundler",
+    "paths": {
+      "@client/*": ["./src/client/*", "../../src/client/*"],
+      "@server/*": ["./src/server/*", "../../src/server/*"],
+      "@/*": ["./src/client/*", "../../src/client/*"]
+    },
     "strict": true,
     "composite": true,
     "declaration": true,
diff --git a/tsconfig.json b/tsconfig.json
index 6a1d46c6..24e1bb4b 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -25,8 +25,8 @@
     "types": ["vite/client", "node", "vitest/globals"]
   },
   "include": [
-    "worker-configuration.d.ts",
-    "src/server/worker-env.d.ts",
+    "apps/worker/worker-configuration.d.ts",
+    "apps/worker/src/worker-env.d.ts",
     "vite.config.ts",
     "vitest.config.ts",
     "src/**/*.ts",
diff --git a/vitest.config.ts b/vitest.config.ts
index 98bdedce..48e95495 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -9,6 +9,7 @@ export default defineConfig({
       '@server': resolve(__dirname, './src/server'),
       '@client': resolve(__dirname, './src/client'),
       '@': resolve(__dirname, './src/client'),
+      '@codra/models': resolve(__dirname, './packages/models/src'),
       'cloudflare:workers': resolve(__dirname, './test/mocks/cloudflare-workers.ts'),
     },
   },

From 658fe8d17c497261790d31dc8adb745a4a110bf2 Mon Sep 17 00:00:00 2001
From: Devarshi Shimpi <devarshishimpi@gmail.com>
Date: Sat, 15 Aug 2026 19:54:40 +0530
Subject: [PATCH 05/12] fix: ci dependency failing

---
 package-lock.json | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/package-lock.json b/package-lock.json
index 35ccb194..fd8e8889 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -66,7 +66,24 @@
     },
     "apps/worker": {
       "name": "@codra/worker",
-      "version": "0.9.4"
+      "version": "0.9.4",
+      "dependencies": {
+        "@codra/core": "*",
+        "@codra/db": "*",
+        "@codra/schema": "*",
+        "hono": "^4.12.25"
+      },
+      "devDependencies": {
+        "@cloudflare/workers-types": "^4.20250109.0",
+        "wrangler": "^4.114.0"
+      }
+    },
+    "apps/worker/node_modules/@cloudflare/workers-types": {
+      "version": "4.20260702.1",
+      "resolved": "https://registry.npmjs.org/@cloudflare/workers-types/-/workers-types-4.20260702.1.tgz",
+      "integrity": "sha512-mOhf5TUEB1m2vPrxtqoIGfz0fUC9xyxRDx5gWHy5s+OCo6dcV+g7wI1R7gYCMFohhqF/2y2xeKVwMwCJjfn/WA==",
+      "dev": true,
+      "license": "MIT OR Apache-2.0"
     },
     "node_modules/@asamuzakjp/css-color": {
       "version": "5.1.11",

From c24a6ecbe1eded3da4c976b8ee356a05c77b952c Mon Sep 17 00:00:00 2001
From: Devarshi Shimpi <devarshishimpi@gmail.com>
Date: Sat, 15 Aug 2026 20:08:20 +0530
Subject: [PATCH 06/12] fix: correct @server import remnants and vitest
 workspace config after models extraction

---
 .github/workflows/ci.yml                            |  4 +---
 packages/core/src/review/index.ts                   | 13 ++++---------
 packages/db/vitest.config.ts                        |  1 +
 packages/models/src/catalog.ts                      |  2 +-
 packages/models/src/internal/model-chain-runner.ts  |  4 ++--
 packages/models/src/internal/model-review-batch.ts  |  6 +++---
 packages/models/src/internal/model-review-file.ts   |  8 ++++----
 packages/models/src/providers/anthropic.ts          |  2 +-
 packages/models/src/providers/cloudflare.ts         |  2 +-
 packages/models/src/providers/google.ts             |  2 +-
 packages/models/src/providers/openai.ts             |  2 +-
 packages/models/src/providers/vertex.ts             |  2 +-
 packages/models/src/runner.ts                       |  2 +-
 packages/models/test/model/batch-routing.spec.ts    |  4 ++--
 packages/models/test/model/chain-resume.spec.ts     |  2 +-
 packages/models/test/model/gemini-schema.spec.ts    |  4 ++--
 packages/models/test/model/limits.spec.ts           |  2 +-
 packages/models/test/model/output-batch.spec.ts     |  2 +-
 packages/models/test/model/output.spec.ts           |  4 ++--
 packages/models/test/model/service-chunking.spec.ts |  4 ++--
 .../models/test/model/service-fallbacks.spec.ts     |  2 +-
 .../test/model/service-grammar-rejection.spec.ts    |  2 +-
 packages/models/test/model/service-requests.spec.ts |  4 ++--
 packages/models/tsconfig.json                       |  3 ++-
 test/helpers.ts                                     |  8 ++++----
 vitest.config.ts                                    |  3 ++-
 26 files changed, 45 insertions(+), 49 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a2df6bb7..7a300965 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -63,8 +63,6 @@ jobs:
       - name: Static Analysis (Typecheck)
         run: npm run typecheck && npm run typecheck:all
 
-      - name: Boundary Check (@codra/core purity)
-        run: npm run check:boundaries
 
       - name: Static Analysis (Lint)
         run: npm run lint
@@ -79,4 +77,4 @@ jobs:
         run: npx vite build
 
       - name: Build (worker bundle, dry run)
-        run: npx wrangler deploy --dry-run --outdir=.wrangler/dry
+        run: cd apps/worker && npx wrangler deploy --dry-run --outdir=.wrangler/dry
diff --git a/packages/core/src/review/index.ts b/packages/core/src/review/index.ts
index d14f09f0..b889061a 100644
--- a/packages/core/src/review/index.ts
+++ b/packages/core/src/review/index.ts
@@ -119,15 +119,10 @@ export async function runReview(env: ReviewRuntime, message: ReviewJobMessage):
   }
 
   const phase = resolved.phase;
-  let github, model, formatter, tracker;
-  try {
-    tracker = env.createTokenTracker();
-    github = env.createGitHub(job.installationId, tracker);
-    model = env.createModel(job.id, tracker);
-    formatter = env.createFormatter();
-  } catch (err) {
-    throw err;
-  }
+  const tracker = env.createTokenTracker();
+  const github = env.createGitHub(job.installationId, tracker);
+  const model = env.createModel(job.id, tracker);
+  const formatter = env.createFormatter();
 
   try {
     if (phase === 'prepare') {
diff --git a/packages/db/vitest.config.ts b/packages/db/vitest.config.ts
index a8b87f03..3fc11818 100644
--- a/packages/db/vitest.config.ts
+++ b/packages/db/vitest.config.ts
@@ -5,5 +5,6 @@ export default defineConfig({
     include: ['test/**/*.spec.ts', 'test/**/*.contract.ts'],
     environment: 'node',
     globals: false,
+    passWithNoTests: true,
   },
 });
diff --git a/packages/models/src/catalog.ts b/packages/models/src/catalog.ts
index cf360609..38e12874 100644
--- a/packages/models/src/catalog.ts
+++ b/packages/models/src/catalog.ts
@@ -1,5 +1,5 @@
 import type { LlmApiFormat } from '@codra/schema';
-import { withTimeout } from '@server/core/timeout';
+import { withTimeout } from '@codra/core/timeout';
 import { assertPublicBaseUrl } from './url-guard';
 
 const MODEL_LIST_TIMEOUT_MS = 8_000;
diff --git a/packages/models/src/internal/model-chain-runner.ts b/packages/models/src/internal/model-chain-runner.ts
index bb00d44b..f16ffa73 100644
--- a/packages/models/src/internal/model-chain-runner.ts
+++ b/packages/models/src/internal/model-chain-runner.ts
@@ -1,5 +1,5 @@
-import { buildSummaryPrompt, SUMMARY_SYSTEM_PROMPT } from '@server/prompts/summary';
-import { buildVerifyPrompt, VERIFY_RESPONSE_SCHEMA, VERIFY_SYSTEM_PROMPT, type VerifyCandidate } from '@server/prompts/verify';
+import { buildSummaryPrompt, SUMMARY_SYSTEM_PROMPT } from '@codra/core/prompts/summary';
+import { buildVerifyPrompt, VERIFY_RESPONSE_SCHEMA, VERIFY_SYSTEM_PROMPT, type VerifyCandidate } from '@codra/core/prompts/verify';
 import { adaptiveModelTimeoutMs, clampTimeoutToChainBudget, MODEL_FALLBACK_CHAIN_BUDGET_MS } from '../limits';
 import { isCloudflareAllocationError, isTransientModelFailure, RetryableModelError } from './model-support';
 import { logger } from '@codra/core/logger';
diff --git a/packages/models/src/internal/model-review-batch.ts b/packages/models/src/internal/model-review-batch.ts
index eb41cc41..3a92d7dd 100644
--- a/packages/models/src/internal/model-review-batch.ts
+++ b/packages/models/src/internal/model-review-batch.ts
@@ -1,7 +1,7 @@
 import { submitCloudflareBatch, pollCloudflareBatch } from '../providers/cloudflare';
-import { buildFileReviewPrompts, buildReviewResponseSchema } from '@server/prompts/file-review';
-import { parseFileReviewResponse } from '@server/core/model-output';
-import { truncateFileDiff } from '@server/core/diff';
+import { buildFileReviewPrompts, buildReviewResponseSchema } from '@codra/core/prompts/file-review';
+import { parseFileReviewResponse } from '@codra/core/model-output';
+import { truncateFileDiff } from '@codra/core/diff';
 import { logger } from '@codra/core/logger';
 import type { RepoConfig, ResolvedModelConfig  } from '@codra/schema';
 import type { ModelResponse } from '../types';
diff --git a/packages/models/src/internal/model-review-file.ts b/packages/models/src/internal/model-review-file.ts
index 20632ac2..690f5540 100644
--- a/packages/models/src/internal/model-review-file.ts
+++ b/packages/models/src/internal/model-review-file.ts
@@ -4,12 +4,12 @@ import {
   buildFileReviewPrompts,
   buildReviewResponseSchema,
   type RejectedExemplar,
-} from '@server/prompts/file-review';
-import { isNonAnswerReview, parseBatchReviewResponse, parseFileReviewResponse, type BatchReviewResult } from '@server/core/model-output';
+} from '@codra/core/prompts/file-review';
+import { isNonAnswerReview, parseBatchReviewResponse, parseFileReviewResponse, type BatchReviewResult } from '@codra/core/model-output';
 import { UnparseableModelResponseError } from '../types';
-import { chunkFileDiff, type FileDiff } from '@server/core/diff';
+import { chunkFileDiff, type FileDiff } from '@codra/core/diff';
 import { adaptiveModelTimeoutMs, reviewOutputBudgetTokens } from '../limits';
-import { generatorFindingCap } from '@server/prompts/file-review';
+import { generatorFindingCap } from '@codra/core/prompts/file-review';
 import { mergeCounts } from './model-support';
 import { type ModelReviewContext, runModelChain } from './model-review-chain';
 import { logger } from '@codra/core/logger';
diff --git a/packages/models/src/providers/anthropic.ts b/packages/models/src/providers/anthropic.ts
index be8fa79f..d3358d74 100644
--- a/packages/models/src/providers/anthropic.ts
+++ b/packages/models/src/providers/anthropic.ts
@@ -1,5 +1,5 @@
 import { logger } from '@codra/core/logger';
-import { withTimeout } from '@server/core/timeout';
+import { withTimeout } from '@codra/core/timeout';
 import { ProviderRequestError, providerErrorMessage, jsonOnlyPrompts, type ModelResponse } from '../types';
 import { assertPublicBaseUrl } from '../url-guard';
 import { MODEL_TIMEOUT_MAX_MS, resolveOutputTokenCeiling } from '../limits';
diff --git a/packages/models/src/providers/cloudflare.ts b/packages/models/src/providers/cloudflare.ts
index c8d702f8..f91884f2 100644
--- a/packages/models/src/providers/cloudflare.ts
+++ b/packages/models/src/providers/cloudflare.ts
@@ -1,6 +1,6 @@
 import { logger } from '@codra/core/logger';
 
-import { TimeoutError } from '@server/core/timeout';
+import { TimeoutError } from '@codra/core/timeout';
 import { ProviderRequestError, UnparseableModelResponseError, jsonOnlyPrompts, type ModelInput, type ModelResponse } from '../types';
 import { MODEL_TIMEOUT_MAX_MS, OUTPUT_TOKENS_FLOOR, resolveOutputTokenCeiling } from '../limits';
 
diff --git a/packages/models/src/providers/google.ts b/packages/models/src/providers/google.ts
index 2151725d..d14caeb2 100644
--- a/packages/models/src/providers/google.ts
+++ b/packages/models/src/providers/google.ts
@@ -1,5 +1,5 @@
 import { logger } from '@codra/core/logger';
-import { withTimeout } from '@server/core/timeout';
+import { withTimeout } from '@codra/core/timeout';
 import { ProviderRequestError, UnparseableModelResponseError, providerErrorMessage, jsonOnlyPrompts, type ModelInput, type ModelResponse } from '../types';
 import { toGeminiResponseJsonSchema } from '../gemini-schema';
 import { assertPublicBaseUrl } from '../url-guard';
diff --git a/packages/models/src/providers/openai.ts b/packages/models/src/providers/openai.ts
index b93abf5a..bc74b8b3 100644
--- a/packages/models/src/providers/openai.ts
+++ b/packages/models/src/providers/openai.ts
@@ -1,5 +1,5 @@
 import { logger } from '@codra/core/logger';
-import { withTimeout } from '@server/core/timeout';
+import { withTimeout } from '@codra/core/timeout';
 import { ProviderRequestError, providerErrorMessage, jsonOnlyPrompts, type ModelResponse } from '../types';
 import { assertPublicBaseUrl } from '../url-guard';
 import { MODEL_TIMEOUT_MAX_MS, resolveOutputTokenCeiling } from '../limits';
diff --git a/packages/models/src/providers/vertex.ts b/packages/models/src/providers/vertex.ts
index 39e3f554..88128964 100644
--- a/packages/models/src/providers/vertex.ts
+++ b/packages/models/src/providers/vertex.ts
@@ -1,5 +1,5 @@
 import { logger } from '@codra/core/logger';
-import { withTimeout } from '@server/core/timeout';
+import { withTimeout } from '@codra/core/timeout';
 import { ProviderRequestError, UnparseableModelResponseError, providerErrorMessage, jsonOnlyPrompts, type ModelResponse } from '../types';
 import { assertPublicBaseUrl } from '../url-guard';
 import { MODEL_TIMEOUT_MAX_MS, OUTPUT_TOKENS_FLOOR, resolveOutputTokenCeiling } from '../limits';
diff --git a/packages/models/src/runner.ts b/packages/models/src/runner.ts
index 012c3fba..d5d25ab4 100644
--- a/packages/models/src/runner.ts
+++ b/packages/models/src/runner.ts
@@ -5,7 +5,7 @@ import { reviewWithVertex } from './providers/vertex';
 import { reviewWithCloudflare } from './providers/cloudflare';
 import { reviewWithOpenAI } from './providers/openai';
 import { reviewWithAnthropic } from './providers/anthropic';
-import type { VerifyCandidate } from '@server/prompts/verify';
+import type { VerifyCandidate } from '@codra/core/prompts/verify';
 import type { RepoConfig, ResolvedModelConfig  } from '@codra/schema';
 import type { TokenTracker } from '@codra/core/token-tracker';
 import type { ModelInput, ModelResponse } from './types';
diff --git a/packages/models/test/model/batch-routing.spec.ts b/packages/models/test/model/batch-routing.spec.ts
index 3d4c1db6..0617fcb1 100644
--- a/packages/models/test/model/batch-routing.spec.ts
+++ b/packages/models/test/model/batch-routing.spec.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest';
-import { parseBatchReviewResponse } from '@server/core/model-output';
-import type { FileDiff } from '@server/core/diff';
+import { parseBatchReviewResponse } from '@codra/core/model-output';
+import type { FileDiff } from '@codra/core/diff';
 
 function file(path: string, contents: string[], previousPath: string | null = null): FileDiff {
   return {
diff --git a/packages/models/test/model/chain-resume.spec.ts b/packages/models/test/model/chain-resume.spec.ts
index 8a7697a1..20ea01d2 100644
--- a/packages/models/test/model/chain-resume.spec.ts
+++ b/packages/models/test/model/chain-resume.spec.ts
@@ -1,7 +1,7 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import { nextChainIndexOf, ModelRunner } from '@codra/models';
 import { defaultRepoConfig } from '@codra/schema';
-import { TokenTracker } from '@server/core/token-tracker';
+import { TokenTracker } from '@codra/core/token-tracker';
 import { createTestEnv, saveTestProviderApiKey, createTestModelRunner } from '../../../../test/helpers';
 
 // One invocation only affords ~55s of model calls, so a chain whose head is slow never reaches its
diff --git a/packages/models/test/model/gemini-schema.spec.ts b/packages/models/test/model/gemini-schema.spec.ts
index e4e5b86f..9bafdc9e 100644
--- a/packages/models/test/model/gemini-schema.spec.ts
+++ b/packages/models/test/model/gemini-schema.spec.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest';
 import { toGeminiResponseJsonSchema } from '../../src/gemini-schema';
-import { buildBatchReviewResponseSchema, buildReviewResponseSchema } from '@server/prompts/file-review';
-import { VERIFY_RESPONSE_SCHEMA } from '@server/prompts/verify';
+import { buildBatchReviewResponseSchema, buildReviewResponseSchema } from '@codra/core/prompts/file-review';
+import { VERIFY_RESPONSE_SCHEMA } from '@codra/core/prompts/verify';
 
 // Transformations asserted on the pure function; the adapter specs only check a grammar reaches the
 // wire. Every failure mode here is silent -- a mangled grammar still returns 200.
diff --git a/packages/models/test/model/limits.spec.ts b/packages/models/test/model/limits.spec.ts
index d661752f..3b3a860d 100644
--- a/packages/models/test/model/limits.spec.ts
+++ b/packages/models/test/model/limits.spec.ts
@@ -11,7 +11,7 @@ import {
   resolveOutputTokenCeiling,
   reviewOutputBudgetTokens,
 } from '../../src/limits';
-import { generatorFindingCap } from '@server/prompts/file-review';
+import { generatorFindingCap } from '@codra/core/prompts/file-review';
 
 // The whole point of these: a bin that overruns `maxOutputTokens` comes back as a repaired JSON prefix
 // with its tail files silently empty, which is indistinguishable from "those files are clean".
diff --git a/packages/models/test/model/output-batch.spec.ts b/packages/models/test/model/output-batch.spec.ts
index 73f3d9bb..524d92e1 100644
--- a/packages/models/test/model/output-batch.spec.ts
+++ b/packages/models/test/model/output-batch.spec.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { parseRawBatchPayload } from '@server/core/model-output';
+import { parseRawBatchPayload } from '@codra/core/model-output';
 
 function nested(paths: string[]) {
   return {
diff --git a/packages/models/test/model/output.spec.ts b/packages/models/test/model/output.spec.ts
index e38b4ce7..f0687391 100644
--- a/packages/models/test/model/output.spec.ts
+++ b/packages/models/test/model/output.spec.ts
@@ -1,5 +1,5 @@
-import { parseFileReviewResponse, dedupeFindings } from '@server/core/model-output';
-import type { FileDiff } from '@server/core/diff';
+import { parseFileReviewResponse, dedupeFindings } from '@codra/core/model-output';
+import type { FileDiff } from '@codra/core/diff';
 import type { ParsedReviewComment } from '@codra/schema';
 
 describe('Model Output Parsing Deep Dive', () => {
diff --git a/packages/models/test/model/service-chunking.spec.ts b/packages/models/test/model/service-chunking.spec.ts
index 0f358649..4631afc6 100644
--- a/packages/models/test/model/service-chunking.spec.ts
+++ b/packages/models/test/model/service-chunking.spec.ts
@@ -7,9 +7,9 @@ import { ModelRunner } from '@codra/models';
 
 import { createTestEnv, saveTestProviderApiKey, createTestModelRunner } from '../../../../test/helpers';
 import { defaultRepoConfig } from '@codra/schema';
-import { TokenTracker } from '@server/core/token-tracker';
+import { TokenTracker } from '@codra/core/token-tracker';
 import { geminiThinkingBudgetTokens, reviewOutputBudgetTokens } from '../../src/limits';
-import { generatorFindingCap } from '@server/prompts/file-review';
+import { generatorFindingCap } from '@codra/core/prompts/file-review';
 
 describe('ModelRunner: diff chunking', () => {
   afterEach(() => {
diff --git a/packages/models/test/model/service-fallbacks.spec.ts b/packages/models/test/model/service-fallbacks.spec.ts
index 6ffbbb51..c365c189 100644
--- a/packages/models/test/model/service-fallbacks.spec.ts
+++ b/packages/models/test/model/service-fallbacks.spec.ts
@@ -4,7 +4,7 @@ import { isRetryableModelError } from '@codra/models';
 
 import { createTestEnv, saveTestProviderApiKey, createTestModelRunner } from '../../../../test/helpers';
 import { defaultRepoConfig } from '@codra/schema';
-import { TokenTracker } from '@server/core/token-tracker';
+import { TokenTracker } from '@codra/core/token-tracker';
 
 // Walking the model chain: fallback, the two subrequest-budget breakers, and marking a provider
 // unavailable. The inline retry ladder lives in service-retries.spec.ts.
diff --git a/packages/models/test/model/service-grammar-rejection.spec.ts b/packages/models/test/model/service-grammar-rejection.spec.ts
index 9c86879a..3113fd08 100644
--- a/packages/models/test/model/service-grammar-rejection.spec.ts
+++ b/packages/models/test/model/service-grammar-rejection.spec.ts
@@ -1,7 +1,7 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
 
 import { reviewWithGoogle } from '@codra/models/google';
-import { buildReviewResponseSchema } from '@server/prompts/file-review';
+import { buildReviewResponseSchema } from '@codra/core/prompts/file-review';
 import { createTestEnv, saveTestProviderApiKey, createTestModelRunner } from '../../../../test/helpers';
 import { defaultRepoConfig } from '@codra/schema';
 
diff --git a/packages/models/test/model/service-requests.spec.ts b/packages/models/test/model/service-requests.spec.ts
index 57b25736..b8728877 100644
--- a/packages/models/test/model/service-requests.spec.ts
+++ b/packages/models/test/model/service-requests.spec.ts
@@ -3,8 +3,8 @@ import { afterEach, describe, expect, it } from 'vitest';
 import { reviewWithCloudflare } from '@codra/models/cloudflare';
 import { reviewWithGoogle } from '@codra/models/google';
 
-import { buildBatchReviewResponseSchema, buildReviewResponseSchema } from '@server/prompts/file-review';
-import { VERIFY_RESPONSE_SCHEMA } from '@server/prompts/verify';
+import { buildBatchReviewResponseSchema, buildReviewResponseSchema } from '@codra/core/prompts/file-review';
+import { VERIFY_RESPONSE_SCHEMA } from '@codra/core/prompts/verify';
 import { createTestEnv, saveTestProviderApiKey, createTestModelRunner } from '../../../../test/helpers';
 
 
diff --git a/packages/models/tsconfig.json b/packages/models/tsconfig.json
index 05ae1d08..6e47b8c8 100644
--- a/packages/models/tsconfig.json
+++ b/packages/models/tsconfig.json
@@ -2,8 +2,9 @@
   "extends": "../../tsconfig.base.json",
   "compilerOptions": {
     "lib": ["ES2024", "DOM"],
-    "types": ["node"],
+    "types": ["node", "vitest/globals"],
     "composite": false,
+    "rootDir": "../..",
     "declaration": false,
     "emitDeclarationOnly": false,
     "noEmit": true
diff --git a/test/helpers.ts b/test/helpers.ts
index 0a0eff98..0118fcc7 100644
--- a/test/helpers.ts
+++ b/test/helpers.ts
@@ -4,7 +4,7 @@ import { InMemorySessionStore } from '@codra/core';
 import { encryptLlmApiKey, ModelRunner } from '@codra/models';
 import { queryRows } from '@codra/db/client';
 import { getResolvedModelConfig } from '@codra/db/model-configs';
-import type { TokenTracker } from '@server/core/token-tracker';
+import type { TokenTracker } from '@codra/core/token-tracker';
 
 export class MemoryKV {
   private readonly store = new Map<string, string>();
@@ -13,7 +13,7 @@ export class MemoryKV {
     this.store.set(key, value);
   }
 
-  async get(key: string, type?: 'text' | 'json' | Partial<KVNamespaceGetOptions<undefined>>) {
+  async get(key: string, type?: 'text' | 'json' | Partial<any>) {
     const value = this.store.get(key) ?? null;
     if (value === null) return null;
     if (type === 'json') {
@@ -22,7 +22,7 @@ export class MemoryKV {
     return value;
   }
 
-  async getWithMetadata(key: string, type?: 'text' | 'json' | Partial<KVNamespaceGetOptions<undefined>>) {
+  async getWithMetadata(key: string, type?: 'text' | 'json' | Partial<any>) {
     return {
       value: await this.get(key, type as 'text' | 'json'),
       metadata: null,
@@ -108,7 +108,7 @@ export function createTestEnv(overrides: Partial<AppBindings> = {}): AppBindings
         return { response: '{"findings":[],"file_verdict":"approve","file_summary":"ok"}', usage: { prompt_tokens: 1, completion_tokens: 1 } };
       },
     },
-    APP_KV: new MemoryKV() as unknown as KVNamespace,
+    APP_KV: new MemoryKV() as unknown as any,
     SESSION_STORE: new InMemorySessionStore(),
     REVIEW_QUEUE: new MockQueue() as any,
     REVIEW_WORKFLOW: new MockWorkflow() as any,
diff --git a/vitest.config.ts b/vitest.config.ts
index 48e95495..91b34612 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -17,7 +17,8 @@ export default defineConfig({
     globals: true,
     environment: 'node',
     include: ['test/**/*.spec.ts', 'test/**/*.spec.tsx'],
-    setupFiles: ['./test/setup.ts'],
+    passWithNoTests: true,
+    setupFiles: [resolve(__dirname, './test/setup.ts')],
     // The suite is dominated by round trips to a remote Postgres, so wall clock is latency-bound,
     // not CPU-bound: running files concurrently overlaps the waiting. Safe because DB-backed suites
     // isolate by unique row names (see `uniqueName`) and nothing truncates a shared table.

From 23b8582b3e451cf46646d7885c15a1b52ee880c3 Mon Sep 17 00:00:00 2001
From: Devarshi Shimpi <devarshishimpi@gmail.com>
Date: Sat, 15 Aug 2026 20:25:50 +0530
Subject: [PATCH 07/12] refactor: update tsconfig files and clean up base URL
 handling in model providers

---
 packages/db/tsconfig.json                  | 13 +++++--------
 packages/models/src/providers/anthropic.ts |  5 ++++-
 packages/models/src/providers/google.ts    |  5 ++++-
 packages/models/src/providers/openai.ts    |  6 +++++-
 packages/models/src/providers/vertex.ts    |  5 ++++-
 packages/provider-github/tsconfig.json     |  6 ++++--
 packages/schema/tsconfig.json              |  5 ++++-
 packages/ui/tsconfig.json                  |  5 ++++-
 8 files changed, 34 insertions(+), 16 deletions(-)

diff --git a/packages/db/tsconfig.json b/packages/db/tsconfig.json
index 035109be..0dfd38fb 100644
--- a/packages/db/tsconfig.json
+++ b/packages/db/tsconfig.json
@@ -1,17 +1,14 @@
 {
   "extends": "../../tsconfig.base.json",
   "compilerOptions": {
-    "rootDir": "src",
-    "outDir": "dist",
-    "types": ["node"]
+    "types": ["node"],
+    "composite": false,
+    "declaration": false,
+    "emitDeclarationOnly": false,
+    "noEmit": true
   },
   "include": [
     "src/**/*",
     "test/**/*"
-  ],
-  "references": [
-    {
-      "path": "../schema"
-    }
   ]
 }
diff --git a/packages/models/src/providers/anthropic.ts b/packages/models/src/providers/anthropic.ts
index d3358d74..679a8c70 100644
--- a/packages/models/src/providers/anthropic.ts
+++ b/packages/models/src/providers/anthropic.ts
@@ -28,7 +28,10 @@ export async function reviewWithAnthropic(
   logger.info(`Calling Anthropic model: ${model}`);
   assertPublicBaseUrl(config.baseUrl, config.providerName);
   const prompts = jsonOnlyPrompts(input);
-  const baseUrl = (config.baseUrl || DEFAULT_ANTHROPIC_BASE_URL).replace(/\/+$/, '');
+  let baseUrl = config.baseUrl || DEFAULT_ANTHROPIC_BASE_URL;
+  while (baseUrl.endsWith('/')) {
+    baseUrl = baseUrl.slice(0, -1);
+  }
   const timeoutMs = config.timeoutMs ?? ANTHROPIC_TIMEOUT_MS;
 
   if (tracker) tracker.incrementSubrequests(1);
diff --git a/packages/models/src/providers/google.ts b/packages/models/src/providers/google.ts
index d14caeb2..a59cc9b2 100644
--- a/packages/models/src/providers/google.ts
+++ b/packages/models/src/providers/google.ts
@@ -121,7 +121,10 @@ export async function reviewWithGoogle(
   };
 
   const startTime = Date.now();
-  const baseUrl = (config.baseUrl || DEFAULT_GEMINI_BASE_URL).replace(/\/+$/, '');
+  let baseUrl = config.baseUrl || DEFAULT_GEMINI_BASE_URL;
+  while (baseUrl.endsWith('/')) {
+    baseUrl = baseUrl.slice(0, -1);
+  }
   const url = `${baseUrl}/models/${encodeURIComponent(model)}:generateContent?key=${encodeURIComponent(config.apiKey)}`;
   const maxRetries = GEMINI_MAX_RETRIES;
   let lastError: unknown;
diff --git a/packages/models/src/providers/openai.ts b/packages/models/src/providers/openai.ts
index bc74b8b3..866c386e 100644
--- a/packages/models/src/providers/openai.ts
+++ b/packages/models/src/providers/openai.ts
@@ -53,7 +53,11 @@ export async function reviewWithOpenAI(
   assertPublicBaseUrl(config.baseUrl, config.providerName);
   const prompts = jsonOnlyPrompts(input);
 
-  const url = `${config.baseUrl.replace(/\/+$/, '')}/chat/completions`;
+  let baseUrl = config.baseUrl;
+  while (baseUrl.endsWith('/')) {
+    baseUrl = baseUrl.slice(0, -1);
+  }
+  const url = `${baseUrl}/chat/completions`;
 
   if (tracker) tracker.incrementSubrequests(1);
   const response = await withTimeout('OpenAI API', timeoutMs, (signal) =>
diff --git a/packages/models/src/providers/vertex.ts b/packages/models/src/providers/vertex.ts
index 88128964..8a9fb201 100644
--- a/packages/models/src/providers/vertex.ts
+++ b/packages/models/src/providers/vertex.ts
@@ -153,7 +153,10 @@ export async function reviewWithVertex(
   const prompts = jsonOnlyPrompts(input);
 
   const startTime = Date.now();
-  const baseUrl = config.baseUrl.replace(/\/+$/, '');
+  let baseUrl = config.baseUrl;
+  while (baseUrl.endsWith('/')) {
+    baseUrl = baseUrl.slice(0, -1);
+  }
   const url = `${baseUrl}/publishers/google/models/${encodeURIComponent(model)}:generateContent`;
 
   const body = JSON.stringify({
diff --git a/packages/provider-github/tsconfig.json b/packages/provider-github/tsconfig.json
index 3b33cb07..ab2cb388 100644
--- a/packages/provider-github/tsconfig.json
+++ b/packages/provider-github/tsconfig.json
@@ -1,8 +1,10 @@
 {
   "extends": "../../tsconfig.base.json",
   "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "."
+    "composite": false,
+    "declaration": false,
+    "emitDeclarationOnly": false,
+    "noEmit": true
   },
   "include": ["src/**/*", "test/**/*"]
 }
diff --git a/packages/schema/tsconfig.json b/packages/schema/tsconfig.json
index 6d7be88c..9c19b76d 100644
--- a/packages/schema/tsconfig.json
+++ b/packages/schema/tsconfig.json
@@ -5,7 +5,10 @@
     // every package extending it inherits the SAME output dir. Two composite packages then collide
     // over one dist/tsconfig.tsbuildinfo (TS6377). Nothing builds this package today -- it is consumed
     // as TS source -- but the override keeps that latent collision from resurfacing.
-    "outDir": "dist"
+    "composite": false,
+    "declaration": false,
+    "emitDeclarationOnly": false,
+    "noEmit": true
   },
   "include": ["src/**/*"]
 }
diff --git a/packages/ui/tsconfig.json b/packages/ui/tsconfig.json
index 40d9d234..3fcd496e 100644
--- a/packages/ui/tsconfig.json
+++ b/packages/ui/tsconfig.json
@@ -1,7 +1,10 @@
 {
   "extends": "../../tsconfig.base.json",
   "compilerOptions": {
-    "outDir": "dist",
+    "composite": false,
+    "declaration": false,
+    "emitDeclarationOnly": false,
+    "noEmit": true,
     "jsx": "react-jsx",
     "lib": ["ES2024", "DOM", "DOM.Iterable"]
   },

From 1482d9280ff5b20ef9e672fd95fe9c480998a363 Mon Sep 17 00:00:00 2001
From: Devarshi Shimpi <devarshishimpi@gmail.com>
Date: Sat, 15 Aug 2026 20:41:32 +0530
Subject: [PATCH 08/12] refactor: remove unused alias for models package in
 vitest configuration

---
 packages/models/test/model/cloudflare.spec.ts | 20 +++++++++----------
 vitest.config.ts                              |  1 -
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/packages/models/test/model/cloudflare.spec.ts b/packages/models/test/model/cloudflare.spec.ts
index 5db69bb4..ecb39aa5 100644
--- a/packages/models/test/model/cloudflare.spec.ts
+++ b/packages/models/test/model/cloudflare.spec.ts
@@ -21,7 +21,7 @@ const input = { systemPrompt: 'sys', userPrompt: 'user' };
 describe('reviewWithCloudflare response extraction', () => {
   it('accepts a structured object response (parsed JSON) and passes it through verbatim', async () => {
     const res = await reviewWithCloudflare(
-      envReturning({ response: REVIEW_JSON, usage: { prompt_tokens: 3, completion_tokens: 4 } }),
+      envReturning({ response: REVIEW_JSON, usage: { prompt_tokens: 3, completion_tokens: 4 } }).AI,
       '@cf/qwen/qwen2.5-coder-32b-instruct',
       input,
     );
@@ -34,7 +34,7 @@ describe('reviewWithCloudflare response extraction', () => {
 
   it('accepts a structured object under a nested result.response', async () => {
     const res = await reviewWithCloudflare(
-      envReturning({ result: { response: REVIEW_JSON } }),
+      envReturning({ result: { response: REVIEW_JSON } }).AI,
       '@cf/qwen/qwen2.5-coder-32b-instruct',
       input,
     );
@@ -44,7 +44,7 @@ describe('reviewWithCloudflare response extraction', () => {
 
   it('still accepts a plain string response (existing behavior)', async () => {
     const res = await reviewWithCloudflare(
-      envReturning({ response: JSON.stringify(REVIEW_JSON) }),
+      envReturning({ response: JSON.stringify(REVIEW_JSON) }).AI,
       '@cf/meta/llama-3.3-70b-instruct-fp8-fast',
       input,
     );
@@ -53,14 +53,14 @@ describe('reviewWithCloudflare response extraction', () => {
 
   it('throws (fails the file) instead of synthesizing a fake review when the model returns nothing usable', async () => {
     await expect(
-      reviewWithCloudflare(envReturning({ something_unexpected: true }), '@cf/qwen/qwen2.5-coder-32b-instruct', input),
+      reviewWithCloudflare(envReturning({ something_unexpected: true }).AI, '@cf/qwen/qwen2.5-coder-32b-instruct', input),
     ).rejects.toThrow(/no reviewable output/i);
   });
 
   it('throws on a reasoning-only / token-truncated response (marks the file failed, not inconclusive)', async () => {
     const reasoningOnly = { choices: [{ finish_reason: 'length', message: { content: null, reasoning: 'thinking, thinking, never answering...' } }] };
     await expect(
-      reviewWithCloudflare(envReturning(reasoningOnly), '@cf/moonshotai/kimi-k2.6', input),
+      reviewWithCloudflare(envReturning(reasoningOnly).AI, '@cf/moonshotai/kimi-k2.6', input),
     ).rejects.toThrow(/no reviewable output/i);
   });
 });
@@ -69,7 +69,7 @@ describe('Cloudflare async batch submit/poll', () => {
   it('submits a batch request and returns the queue request_id', async () => {
     const run = vi.fn().mockResolvedValue({ status: 'queued', request_id: 'req-123', model: '@cf/moonshotai/kimi-k2.6' });
     const env = { AI: { run } } as any;
-    const id = await submitCloudflareBatch(env, '@cf/moonshotai/kimi-k2.6', input);
+    const id = await submitCloudflareBatch(env.AI, '@cf/moonshotai/kimi-k2.6', input);
     expect(id).toBe('req-123');
     // Must send a `requests` array with queueRequest option.
     expect(run.mock.calls[0][1]).toHaveProperty('requests');
@@ -78,13 +78,13 @@ describe('Cloudflare async batch submit/poll', () => {
 
   it('throws when the model does not return a request_id (async unsupported → caller falls back to sync)', async () => {
     const env = { AI: { async run() { return { response: '{"findings":[]}' }; } } } as any;
-    await expect(submitCloudflareBatch(env, '@cf/meta/llama-3.1-8b-instruct', input)).rejects.toThrow(/async queueing unsupported|did not return/i);
+    await expect(submitCloudflareBatch(env.AI, '@cf/meta/llama-3.1-8b-instruct', input)).rejects.toThrow(/async queueing unsupported|did not return/i);
   });
 
   it('reports pending while the batch is queued or running', async () => {
     for (const status of ['queued', 'running']) {
       const env = { AI: { async run() { return { status, request_id: 'req-1' }; } } } as any;
-      const res = await pollCloudflareBatch(env, '@cf/moonshotai/kimi-k2.6', 'req-1');
+      const res = await pollCloudflareBatch(env.AI, '@cf/moonshotai/kimi-k2.6', 'req-1');
       expect(res.status).toBe('pending');
     }
   });
@@ -93,7 +93,7 @@ describe('Cloudflare async batch submit/poll', () => {
     const env = { AI: { async run() {
       return { responses: [{ id: 0, external_reference: 'src/app.ts', result: { response: JSON.stringify(REVIEW_JSON), usage: { prompt_tokens: 5, completion_tokens: 6 } } }] };
     } } } as any;
-    const res = await pollCloudflareBatch(env, '@cf/moonshotai/kimi-k2.6', 'req-1');
+    const res = await pollCloudflareBatch(env.AI, '@cf/moonshotai/kimi-k2.6', 'req-1');
     expect(res.status).toBe('done');
     if (res.status === 'done') {
       expect(JSON.parse(res.response.rawText)).toMatchObject({ overall_correctness: 'patch is correct' });
@@ -106,7 +106,7 @@ describe('Cloudflare async batch submit/poll', () => {
     const env = { AI: { async run() {
       return { result: { responses: [{ id: 0, response: REVIEW_JSON }] } };
     } } } as any;
-    const res = await pollCloudflareBatch(env, '@cf/moonshotai/kimi-k2.6', 'req-1');
+    const res = await pollCloudflareBatch(env.AI, '@cf/moonshotai/kimi-k2.6', 'req-1');
     expect(res.status).toBe('done');
     if (res.status === 'done') {
       expect(JSON.parse(res.response.rawText)).toMatchObject({ overall_explanation: 'Looks good.' });
diff --git a/vitest.config.ts b/vitest.config.ts
index 91b34612..a266a661 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -9,7 +9,6 @@ export default defineConfig({
       '@server': resolve(__dirname, './src/server'),
       '@client': resolve(__dirname, './src/client'),
       '@': resolve(__dirname, './src/client'),
-      '@codra/models': resolve(__dirname, './packages/models/src'),
       'cloudflare:workers': resolve(__dirname, './test/mocks/cloudflare-workers.ts'),
     },
   },

From a69175372789bfbf63859ddcd823d48f96af59e4 Mon Sep 17 00:00:00 2001
From: Devarshi Shimpi <devarshishimpi@gmail.com>
Date: Sat, 15 Aug 2026 21:10:26 +0530
Subject: [PATCH 09/12] add: pass kv.kv directly in tests; ignore .wrangler

---
 eslint.config.js                              | 434 +++++++++---------
 .../test/model/chain-progress-store.spec.ts   |  50 +-
 2 files changed, 242 insertions(+), 242 deletions(-)

diff --git a/eslint.config.js b/eslint.config.js
index 5d0ec3b0..0396e8ec 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -1,217 +1,217 @@
-import js from '@eslint/js';
-import tseslint from 'typescript-eslint';
-import importX from 'eslint-plugin-import-x';
-import reactHooks from 'eslint-plugin-react-hooks';
-import { createTypeScriptImportResolver } from 'eslint-import-resolver-typescript';
-
-export default tseslint.config(
-  {
-    ignores: [
-      // `**/` matters: a bare `dist/**` only covers the root build output, so emitted .d.ts under
-      // packages/*/dist was being linted as source.
-      '**/dist/**',
-      '**/node_modules/**',
-      // Generated by `wrangler types`.
-      'apps/worker/src/worker-env.d.ts',
-      'worker-configuration.d.ts',
-    ],
-  },
-
-  js.configs.recommended,
-  ...tseslint.configs.recommended,
-
-  {
-    files: ['**/*.{ts,tsx,js,mjs}'],
-    plugins: { 'import-x': importX, 'react-hooks': reactHooks },
-    settings: {
-      'import-x/resolver-next': [
-        createTypeScriptImportResolver({ project: './tsconfig.json' }),
-      ],
-    },
-    rules: {
-      // TypeScript resolves every identifier already, and does it correctly for types, `declare`,
-      // and the Worker/DOM lib globals. Leaving this on means re-declaring hundreds of ambient
-      // globals in ESLint just to get a worse version of a check `npm run typecheck` already runs.
-      'no-undef': 'off',
-
-      // The base rule cannot see TypeScript's type-only positions; the TS one can.
-      'no-unused-vars': 'off',
-      '@typescript-eslint/no-unused-vars': ['error', {
-        // `catch {}` is the preferred form, but an unused binding is not worth an error.
-        caughtErrors: 'none',
-        argsIgnorePattern: '^_',
-        varsIgnorePattern: '^_',
-      }],
-
-      // `import-x/no-duplicates` and NOT the core `no-duplicate-imports`: the core rule is type-blind
-      // and flags the deliberate `import { Hono }` + `import type { Context }` split as a duplicate.
-      'import-x/no-duplicates': 'error',
-      'import-x/no-self-import': 'error',
-      'import-x/no-cycle': 'error',
-
-      // 400 lines, counting neither blanks nor comments, so adding an explanation never pushes a file
-      // over. One file carries an explicit override below, for a stated reason -- a second should
-      // be a split, not a second override.
-      'max-lines': ['error', { max: 400, skipBlankLines: true, skipComments: true }],
-
-      // An error, not a warning: the three places whose dependency array is deliberately narrower
-      // than their closure now carry a line-level disable stating why. A new violation should fail.
-      'react-hooks/exhaustive-deps': 'error',
-
-      // Fires on the finding-title normalizer, which strips emoji and variation selectors from model
-      // output. Those combining characters are the point of it, and its behaviour is pinned by tests.
-      'no-misleading-character-class': 'off',
-
-      // `any` is used deliberately at the provider and DB boundaries, where the shape is genuinely
-      // unknown until it is parsed. Turning this on would mean ~100 suppressions, not better types.
-      '@typescript-eslint/no-explicit-any': 'off',
-    },
-  },
-
-  {
-    files: ['src/client/**/*.{ts,tsx}'],
-    rules: {
-      'react-hooks/rules-of-hooks': 'error',
-
-      // The zone block at the bottom of this file cannot express this direction: its `files` is
-      // packages/** + apps/**, so a violation living in src/client is never linted by it.
-      'import-x/no-restricted-paths': ['error', {
-        zones: [
-          {
-            target: 'src/client/**/*',
-            from: ['packages/core/**/*', 'src/server/**/*'],
-            message: 'The review engine and the Worker tree are server-only. Importing either pulls zod/jsonrepair/picomatch into the browser bundle -- exactly what the `vite build` CI step exists to catch. (@codra/schema/review-limits is the sanctioned client-side import.)'
-          }
-        ]
-      }],
-    },
-  },
-
-  {
-    // These specifiers are intercepted BY STRING in test mocks (`vi.mock('@server/db/jobs', ...)`).
-    // Each one is free to split into sibling files internally, but every other module must keep
-    // importing the barrel path -- importing a sibling directly bypasses whichever spec mocks the
-    // barrel, and the test keeps passing while asserting nothing.
-    //
-    // Every group MUST list the `@alias/...` form, not just `**/dir/...`. Under the tsconfig paths
-    // (`@shared/*` -> src/shared/*) the specifier a consumer actually writes is `@shared/schema-claims`,
-    // whose segments are ["@shared", "schema-claims"] -- there is no literal `shared` segment for
-    // `**/shared/` to match, so that pattern silently matched nothing at all. `@server/*` groups
-    // happen to work because `db`/`core`/`review` survive as real segments, but spell both forms out
-    // rather than relying on that. Probe any new pattern with:
-    //   echo "import '<spec>';" | npx eslint --stdin --stdin-filename src/server/probe.ts
-    files: ['src/**/*.{ts,tsx}', 'test/**/*.{ts,tsx}'],
-    rules: {
-      'no-restricted-imports': ['error', {
-        patterns: [
-          { group: ['**/db/jobs-*', '@server/db/jobs-*'], message: 'Import from @server/db/jobs, not a sibling. Eight specs vi.mock that specifier; a direct sibling import silently bypasses the mock.' },
-          { group: ['**/db/file-reviews-*', '@server/db/file-reviews-*'], message: 'Import from @server/db/file-reviews, not a sibling. (No spec mocks this one today; the rule keeps the barrel the single entry point.)' },
-          { group: ['**/services/model-review-*', '**/services/model-rate-limits', '**/services/model-chain-runner', '**/services/model-support', '@codra/models-*'], message: 'Import from @codra/models, not a sibling. Four specs vi.mock that specifier.' },
-          { group: ['**/core/github/http', '**/core/github/app-auth', '**/core/github/types', '**/core/github/diff-fetch', '**/core/github/review-post', '**/core/github/labels', '@server/core/github/http', '@server/core/github/app-auth', '@server/core/github/types', '@server/core/github/diff-fetch', '@server/core/github/review-post', '@server/core/github/labels'], message: 'Import from @server/core/github, not a sibling. One spec vi.mocks that specifier. (core/github/oauth is deliberately NOT listed: it is the dashboard OAuth flow, not part of the GitHubClient barrel, and routes/auth.ts imports it directly.)' },
-          // Covers every sibling in the family, including the three the barrel re-exports publicly
-          // (budget, diff-cache, request) which were previously unprotected.
-          { group: ['**/core/review/*', '@server/core/review/*', '@codra/core/review/*'], message: 'Import from @server/core/review, not a sibling. One spec vi.mocks that specifier and workflows/review.ts imports only runReviewJob from it.' },
-          { group: ['**/core/model-output/*', '@server/core/model-output/*', '@codra/core/model-output/*'], message: 'Import from @codra/core/model-output, not a sibling. (The package exports map already refuses to resolve these; the lint rule gives the error at edit time.)' },
-          { group: ['**/core/diff/position', '@server/core/diff/position', '@codra/core/diff/position'], message: 'Import from @codra/core/diff, not a sibling.' },
-          { group: ['**/schema-claims', '**/schema-repo-config', '**/schema-enums', '@codra/schema/schema-claims', '@codra/schema/schema-repo-config', '@codra/schema/schema-enums'], message: 'Import from @codra/schema, not a sibling. (@codra/schema/review-limits is exempt: the client imports it directly to keep zod out of the browser bundle.)' },
-        ],
-      }],
-    },
-  },
-  {
-    // The one file still over the limit, for a stated reason. Known work, not a permanent
-    // carve-out -- delete the entry rather than raising `max` when it is split.
-    //
-    // test/api/auth.spec.ts (422): the review-settings suites here read-modify-write the same
-    //   singleton `global_settings` row set and race across files once `fileParallelism` is on. See
-    //   the DO-NOT-SPLIT header on the file itself.
-    files: ['test/api/auth.spec.ts'],
-    rules: {
-      'max-lines': 'off',
-    },
-  },
-
-  {
-    // The barrel files themselves are the one place allowed to import their own siblings.
-    files: [
-      'src/server/db/jobs.ts',
-      'src/server/db/file-reviews.ts',
-      'src/server/services/model.ts',
-      'src/server/core/github/index.ts',
-      // core/review, core/diff and core/model-output are gone from here: they moved to @codra/core and
-      // what is left at those paths is a re-export shim with no sibling imports to exempt. ESLint does
-      // not warn about `files` patterns that match nothing, so a stale entry would just rot quietly.
-      'packages/schema/src/schema.ts',
-    ],
-    rules: {
-      'no-restricted-imports': 'off',
-    },
-  },
-
-  {
-    // Plain-JS scripts are not covered by tsconfig, so they need their globals declared.
-    files: ['scripts/**/*.{js,mjs}'],
-    languageOptions: {
-      globals: {
-        console: 'readonly',
-        process: 'readonly',
-        Buffer: 'readonly',
-        fetch: 'readonly',
-        URL: 'readonly',
-        setTimeout: 'readonly',
-        clearTimeout: 'readonly',
-        __dirname: 'readonly',
-      },
-    },
-  },
-
-  {
-    files: ['packages/**/*.{ts,tsx}', 'apps/**/*.{ts,tsx}'],
-    rules: {
-      'import-x/no-restricted-paths': ['error', {
-        zones: [
-          {
-            // `src/**` in `from` is what actually holds the extraction in place. The zones below
-            // only ever described packages -> packages traffic, so nothing stopped a moved file from
-            // keeping its old `@server/db/jobs` import and quietly re-coupling the package to the
-            // Worker tree. Traffic goes src -> packages, through src/server/adapters, never back.
-            target: 'packages/schema/**/*',
-            from: ['src/**/*', 'test/**/*', 'scripts/**/*', 'packages/core/**/*', 'packages/provider-github/**/*', 'packages/db/**/*', 'packages/models/**/*', 'packages/api/**/*', 'packages/ui/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
-          },
-          {
-            target: 'packages/core/**/*',
-            from: ['src/**/*', 'test/**/*', 'scripts/**/*', 'packages/provider-github/**/*', 'packages/db/**/*', 'packages/models/**/*', 'packages/api/**/*', 'packages/ui/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
-          },
-          {
-            target: 'packages/db/**/*',
-            from: ['packages/provider-github/**/*', 'packages/models/**/*', 'packages/api/**/*', 'packages/ui/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
-          },
-          {
-            target: 'packages/provider-github/**/*',
-            from: ['packages/db/**/*', 'packages/models/**/*', 'packages/api/**/*', 'packages/ui/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
-          },
-          {
-            target: 'packages/models/**/*',
-            from: ['packages/db/**/*', 'packages/provider-github/**/*', 'packages/api/**/*', 'packages/ui/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
-          },
-          {
-            target: 'packages/api/**/*',
-            from: ['packages/ui/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
-          },
-          {
-            target: 'packages/ui/**/*',
-            from: ['src/**/*', 'packages/core/**/*', 'packages/provider-github/**/*', 'packages/db/**/*', 'packages/models/**/*', 'packages/api/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
-          },
-          {
-            target: 'apps/dashboard/**/*',
-            from: ['packages/core/**/*', 'packages/provider-github/**/*', 'packages/db/**/*', 'packages/models/**/*', 'packages/api/**/*', 'apps/worker/**/*']
-          },
-          {
-            target: 'apps/worker/**/*',
-            from: ['packages/ui/**/*', 'apps/dashboard/**/*']
-          }
-        ]
-      }]
-    }
-  }
-);
+import js from '@eslint/js';
+import tseslint from 'typescript-eslint';
+import importX from 'eslint-plugin-import-x';
+import reactHooks from 'eslint-plugin-react-hooks';
+import { createTypeScriptImportResolver } from 'eslint-import-resolver-typescript';
+
+export default tseslint.config(
+  {
+    ignores: [
+      // `**/` matters: a bare `dist/**` only covers the root build output, so emitted .d.ts under
+      // packages/*/dist was being linted as source.
+      '**/dist/**',
+      '**/node_modules/**','**/.wrangler/**', 
+      // Generated by `wrangler types`.
+      'apps/worker/src/worker-env.d.ts',
+      'worker-configuration.d.ts',
+    ],
+  },
+
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+
+  {
+    files: ['**/*.{ts,tsx,js,mjs}'],
+    plugins: { 'import-x': importX, 'react-hooks': reactHooks },
+    settings: {
+      'import-x/resolver-next': [
+        createTypeScriptImportResolver({ project: './tsconfig.json' }),
+      ],
+    },
+    rules: {
+      // TypeScript resolves every identifier already, and does it correctly for types, `declare`,
+      // and the Worker/DOM lib globals. Leaving this on means re-declaring hundreds of ambient
+      // globals in ESLint just to get a worse version of a check `npm run typecheck` already runs.
+      'no-undef': 'off',
+
+      // The base rule cannot see TypeScript's type-only positions; the TS one can.
+      'no-unused-vars': 'off',
+      '@typescript-eslint/no-unused-vars': ['error', {
+        // `catch {}` is the preferred form, but an unused binding is not worth an error.
+        caughtErrors: 'none',
+        argsIgnorePattern: '^_',
+        varsIgnorePattern: '^_',
+      }],
+
+      // `import-x/no-duplicates` and NOT the core `no-duplicate-imports`: the core rule is type-blind
+      // and flags the deliberate `import { Hono }` + `import type { Context }` split as a duplicate.
+      'import-x/no-duplicates': 'error',
+      'import-x/no-self-import': 'error',
+      'import-x/no-cycle': 'error',
+
+      // 400 lines, counting neither blanks nor comments, so adding an explanation never pushes a file
+      // over. One file carries an explicit override below, for a stated reason -- a second should
+      // be a split, not a second override.
+      'max-lines': ['error', { max: 400, skipBlankLines: true, skipComments: true }],
+
+      // An error, not a warning: the three places whose dependency array is deliberately narrower
+      // than their closure now carry a line-level disable stating why. A new violation should fail.
+      'react-hooks/exhaustive-deps': 'error',
+
+      // Fires on the finding-title normalizer, which strips emoji and variation selectors from model
+      // output. Those combining characters are the point of it, and its behaviour is pinned by tests.
+      'no-misleading-character-class': 'off',
+
+      // `any` is used deliberately at the provider and DB boundaries, where the shape is genuinely
+      // unknown until it is parsed. Turning this on would mean ~100 suppressions, not better types.
+      '@typescript-eslint/no-explicit-any': 'off',
+    },
+  },
+
+  {
+    files: ['src/client/**/*.{ts,tsx}'],
+    rules: {
+      'react-hooks/rules-of-hooks': 'error',
+
+      // The zone block at the bottom of this file cannot express this direction: its `files` is
+      // packages/** + apps/**, so a violation living in src/client is never linted by it.
+      'import-x/no-restricted-paths': ['error', {
+        zones: [
+          {
+            target: 'src/client/**/*',
+            from: ['packages/core/**/*', 'src/server/**/*'],
+            message: 'The review engine and the Worker tree are server-only. Importing either pulls zod/jsonrepair/picomatch into the browser bundle -- exactly what the `vite build` CI step exists to catch. (@codra/schema/review-limits is the sanctioned client-side import.)'
+          }
+        ]
+      }],
+    },
+  },
+
+  {
+    // These specifiers are intercepted BY STRING in test mocks (`vi.mock('@server/db/jobs', ...)`).
+    // Each one is free to split into sibling files internally, but every other module must keep
+    // importing the barrel path -- importing a sibling directly bypasses whichever spec mocks the
+    // barrel, and the test keeps passing while asserting nothing.
+    //
+    // Every group MUST list the `@alias/...` form, not just `**/dir/...`. Under the tsconfig paths
+    // (`@shared/*` -> src/shared/*) the specifier a consumer actually writes is `@shared/schema-claims`,
+    // whose segments are ["@shared", "schema-claims"] -- there is no literal `shared` segment for
+    // `**/shared/` to match, so that pattern silently matched nothing at all. `@server/*` groups
+    // happen to work because `db`/`core`/`review` survive as real segments, but spell both forms out
+    // rather than relying on that. Probe any new pattern with:
+    //   echo "import '<spec>';" | npx eslint --stdin --stdin-filename src/server/probe.ts
+    files: ['src/**/*.{ts,tsx}', 'test/**/*.{ts,tsx}'],
+    rules: {
+      'no-restricted-imports': ['error', {
+        patterns: [
+          { group: ['**/db/jobs-*', '@server/db/jobs-*'], message: 'Import from @server/db/jobs, not a sibling. Eight specs vi.mock that specifier; a direct sibling import silently bypasses the mock.' },
+          { group: ['**/db/file-reviews-*', '@server/db/file-reviews-*'], message: 'Import from @server/db/file-reviews, not a sibling. (No spec mocks this one today; the rule keeps the barrel the single entry point.)' },
+          { group: ['**/services/model-review-*', '**/services/model-rate-limits', '**/services/model-chain-runner', '**/services/model-support', '@codra/models-*'], message: 'Import from @codra/models, not a sibling. Four specs vi.mock that specifier.' },
+          { group: ['**/core/github/http', '**/core/github/app-auth', '**/core/github/types', '**/core/github/diff-fetch', '**/core/github/review-post', '**/core/github/labels', '@server/core/github/http', '@server/core/github/app-auth', '@server/core/github/types', '@server/core/github/diff-fetch', '@server/core/github/review-post', '@server/core/github/labels'], message: 'Import from @server/core/github, not a sibling. One spec vi.mocks that specifier. (core/github/oauth is deliberately NOT listed: it is the dashboard OAuth flow, not part of the GitHubClient barrel, and routes/auth.ts imports it directly.)' },
+          // Covers every sibling in the family, including the three the barrel re-exports publicly
+          // (budget, diff-cache, request) which were previously unprotected.
+          { group: ['**/core/review/*', '@server/core/review/*', '@codra/core/review/*'], message: 'Import from @server/core/review, not a sibling. One spec vi.mocks that specifier and workflows/review.ts imports only runReviewJob from it.' },
+          { group: ['**/core/model-output/*', '@server/core/model-output/*', '@codra/core/model-output/*'], message: 'Import from @codra/core/model-output, not a sibling. (The package exports map already refuses to resolve these; the lint rule gives the error at edit time.)' },
+          { group: ['**/core/diff/position', '@server/core/diff/position', '@codra/core/diff/position'], message: 'Import from @codra/core/diff, not a sibling.' },
+          { group: ['**/schema-claims', '**/schema-repo-config', '**/schema-enums', '@codra/schema/schema-claims', '@codra/schema/schema-repo-config', '@codra/schema/schema-enums'], message: 'Import from @codra/schema, not a sibling. (@codra/schema/review-limits is exempt: the client imports it directly to keep zod out of the browser bundle.)' },
+        ],
+      }],
+    },
+  },
+  {
+    // The one file still over the limit, for a stated reason. Known work, not a permanent
+    // carve-out -- delete the entry rather than raising `max` when it is split.
+    //
+    // test/api/auth.spec.ts (422): the review-settings suites here read-modify-write the same
+    //   singleton `global_settings` row set and race across files once `fileParallelism` is on. See
+    //   the DO-NOT-SPLIT header on the file itself.
+    files: ['test/api/auth.spec.ts'],
+    rules: {
+      'max-lines': 'off',
+    },
+  },
+
+  {
+    // The barrel files themselves are the one place allowed to import their own siblings.
+    files: [
+      'src/server/db/jobs.ts',
+      'src/server/db/file-reviews.ts',
+      'src/server/services/model.ts',
+      'src/server/core/github/index.ts',
+      // core/review, core/diff and core/model-output are gone from here: they moved to @codra/core and
+      // what is left at those paths is a re-export shim with no sibling imports to exempt. ESLint does
+      // not warn about `files` patterns that match nothing, so a stale entry would just rot quietly.
+      'packages/schema/src/schema.ts',
+    ],
+    rules: {
+      'no-restricted-imports': 'off',
+    },
+  },
+
+  {
+    // Plain-JS scripts are not covered by tsconfig, so they need their globals declared.
+    files: ['scripts/**/*.{js,mjs}'],
+    languageOptions: {
+      globals: {
+        console: 'readonly',
+        process: 'readonly',
+        Buffer: 'readonly',
+        fetch: 'readonly',
+        URL: 'readonly',
+        setTimeout: 'readonly',
+        clearTimeout: 'readonly',
+        __dirname: 'readonly',
+      },
+    },
+  },
+
+  {
+    files: ['packages/**/*.{ts,tsx}', 'apps/**/*.{ts,tsx}'],
+    rules: {
+      'import-x/no-restricted-paths': ['error', {
+        zones: [
+          {
+            // `src/**` in `from` is what actually holds the extraction in place. The zones below
+            // only ever described packages -> packages traffic, so nothing stopped a moved file from
+            // keeping its old `@server/db/jobs` import and quietly re-coupling the package to the
+            // Worker tree. Traffic goes src -> packages, through src/server/adapters, never back.
+            target: 'packages/schema/**/*',
+            from: ['src/**/*', 'test/**/*', 'scripts/**/*', 'packages/core/**/*', 'packages/provider-github/**/*', 'packages/db/**/*', 'packages/models/**/*', 'packages/api/**/*', 'packages/ui/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
+          },
+          {
+            target: 'packages/core/**/*',
+            from: ['src/**/*', 'test/**/*', 'scripts/**/*', 'packages/provider-github/**/*', 'packages/db/**/*', 'packages/models/**/*', 'packages/api/**/*', 'packages/ui/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
+          },
+          {
+            target: 'packages/db/**/*',
+            from: ['packages/provider-github/**/*', 'packages/models/**/*', 'packages/api/**/*', 'packages/ui/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
+          },
+          {
+            target: 'packages/provider-github/**/*',
+            from: ['packages/db/**/*', 'packages/models/**/*', 'packages/api/**/*', 'packages/ui/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
+          },
+          {
+            target: 'packages/models/**/*',
+            from: ['packages/db/**/*', 'packages/provider-github/**/*', 'packages/api/**/*', 'packages/ui/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
+          },
+          {
+            target: 'packages/api/**/*',
+            from: ['packages/ui/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
+          },
+          {
+            target: 'packages/ui/**/*',
+            from: ['src/**/*', 'packages/core/**/*', 'packages/provider-github/**/*', 'packages/db/**/*', 'packages/models/**/*', 'packages/api/**/*', 'apps/worker/**/*', 'apps/dashboard/**/*']
+          },
+          {
+            target: 'apps/dashboard/**/*',
+            from: ['packages/core/**/*', 'packages/provider-github/**/*', 'packages/db/**/*', 'packages/models/**/*', 'packages/api/**/*', 'apps/worker/**/*']
+          },
+          {
+            target: 'apps/worker/**/*',
+            from: ['packages/ui/**/*', 'apps/dashboard/**/*']
+          }
+        ]
+      }]
+    }
+  }
+);
diff --git a/packages/models/test/model/chain-progress-store.spec.ts b/packages/models/test/model/chain-progress-store.spec.ts
index bf2a88e3..40edd4b8 100644
--- a/packages/models/test/model/chain-progress-store.spec.ts
+++ b/packages/models/test/model/chain-progress-store.spec.ts
@@ -42,7 +42,7 @@ function makeKV() {
 describe('ModelChainProgressStore', () => {
   it('keeps both entries when two files defer concurrently', async () => {
     const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-race');
+    const store = new ModelChainProgressStore(kv.kv, 'job-race');
 
     await Promise.all([store.advance('src/a.ts', 2), store.advance('src/b.ts', 3)]);
 
@@ -55,7 +55,7 @@ describe('ModelChainProgressStore', () => {
 
   it('coalesces a burst of deferrals instead of writing once per file', async () => {
     const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-burst');
+    const store = new ModelChainProgressStore(kv.kv, 'job-burst');
 
     await Promise.all([1, 2, 3, 4, 5, 6].map((n) => store.advance(`src/f${n}.ts`, n)));
 
@@ -70,7 +70,7 @@ describe('ModelChainProgressStore', () => {
     // Written by a concurrent, unloaded invocation.
     await kv.kv.put('k', JSON.stringify({ 'src/other.ts': 4 }));
 
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge');
+    const store = new ModelChainProgressStore(kv.kv, 'job-merge');
     await store.advance('src/mine.ts', 1);
 
     expect(kv.stored?.files).toEqual({ 'src/other.ts': 4, 'src/mine.ts': 1 });
@@ -78,7 +78,7 @@ describe('ModelChainProgressStore', () => {
 
   it('never walks an index backwards', async () => {
     const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-monotonic');
+    const store = new ModelChainProgressStore(kv.kv, 'job-monotonic');
 
     await store.advance('src/a.ts', 3);
     // Later, shorter deferral must not resurrect ruled-out models.
@@ -91,7 +91,7 @@ describe('ModelChainProgressStore', () => {
   // Persisted tally lets the next concurrent wave avoid models the first wave timed out on.
   it('drops a model after a full wave of timeouts, and remembers across invocations', async () => {
     const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-slow');
+    const store = new ModelChainProgressStore(kv.kv, 'job-slow');
 
     expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(false);
     await store.noteTimeout('vertex-ai:gemini-2.5-pro');
@@ -102,7 +102,7 @@ describe('ModelChainProgressStore', () => {
     expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
 
     // Fresh store mimics next invocation.
-    const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-slow');
+    const next = new ModelChainProgressStore(kv.kv, 'job-slow');
     expect(await next.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
     // Scoped to the failing model.
     expect(await next.isTimingOut('vertex-ai:gemini-2.5-flash')).toBe(false);
@@ -111,7 +111,7 @@ describe('ModelChainProgressStore', () => {
   // Tail candidates use a higher strike threshold rather than exemption, to prevent infinite looping.
   it('holds the last candidate to a higher strike count before dropping it too', async () => {
     const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-tail');
+    const store = new ModelChainProgressStore(kv.kv, 'job-tail');
 
     for (let i = 0; i < 3; i += 1) await store.noteTimeout('cf:glm-4.7-flash');
     // Drops mid-chain, but preserves the tail.
@@ -122,7 +122,7 @@ describe('ModelChainProgressStore', () => {
     expect(await store.isTimingOutTerminally('cf:glm-4.7-flash')).toBe(true);
 
     // Durable across invocations.
-    const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-tail');
+    const next = new ModelChainProgressStore(kv.kv, 'job-tail');
     expect(await next.isTimingOutTerminally('cf:glm-4.7-flash')).toBe(true);
   });
 
@@ -130,7 +130,7 @@ describe('ModelChainProgressStore', () => {
     // Resets prevent cumulative tallies from condemning a model for the job's entire 24h life.
     it('restarts the tally, so a slow patch cannot condemn a working model', async () => {
       const kv = makeKV();
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-recovered');
+      const store = new ModelChainProgressStore(kv.kv, 'job-recovered');
 
       for (let i = 0; i < 3; i += 1) await store.noteTimeout('vertex-ai:gemini-2.5-pro');
       expect(await store.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(true);
@@ -144,17 +144,17 @@ describe('ModelChainProgressStore', () => {
       const kv = makeKV();
       await kv.kv.put('k', JSON.stringify({ timeouts: { 'vertex-ai:gemini-2.5-pro': 5 } }));
 
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge-success');
+      const store = new ModelChainProgressStore(kv.kv, 'job-merge-success');
       await store.noteSuccess('vertex-ai:gemini-2.5-pro');
 
       expect(kv.stored?.timeouts?.['vertex-ai:gemini-2.5-pro']).toBeUndefined();
-      const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge-success');
+      const next = new ModelChainProgressStore(kv.kv, 'job-merge-success');
       expect(await next.isTimingOut('vertex-ai:gemini-2.5-pro')).toBe(false);
     });
 
     it('writes nothing for a model with a clean record', async () => {
       const kv = makeKV();
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-clean');
+      const store = new ModelChainProgressStore(kv.kv, 'job-clean');
 
       await store.noteSuccess('vertex-ai:gemini-2.5-pro');
 
@@ -165,11 +165,11 @@ describe('ModelChainProgressStore', () => {
 
   it('keeps chain progress and timeouts in one value without either clobbering the other', async () => {
     const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-both');
+    const store = new ModelChainProgressStore(kv.kv, 'job-both');
 
     await Promise.all([store.advance('src/a.ts', 2), store.noteTimeout('vertex-ai:gemini-2.5-pro')]);
 
-    const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-both');
+    const next = new ModelChainProgressStore(kv.kv, 'job-both');
     expect(await next.startIndexFor('src/a.ts')).toBe(2);
     await next.noteTimeout('vertex-ai:gemini-2.5-pro');
     await next.noteTimeout('vertex-ai:gemini-2.5-pro');
@@ -181,7 +181,7 @@ describe('ModelChainProgressStore', () => {
     const kv = makeKV();
     await kv.kv.put('k', JSON.stringify({ 'src/legacy.ts': 3 }));
 
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-legacy');
+    const store = new ModelChainProgressStore(kv.kv, 'job-legacy');
 
     expect(await store.startIndexFor('src/legacy.ts')).toBe(3);
     expect(await store.isTimingOut('anything')).toBe(false);
@@ -191,13 +191,13 @@ describe('ModelChainProgressStore', () => {
   describe('rate-limit cool-offs', () => {
     it('carries a learned cool-off and bucket size to the next invocation', async () => {
       const kv = makeKV();
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-cooldown');
+      const store = new ModelChainProgressStore(kv.kv, 'job-cooldown');
       const until = Date.now() + 30_000;
 
       store.noteRateLimit('google:gemini-2.5-flash', { cooldownUntil: until, limitTokens: 16000 });
       await store.flushPending();
 
-      const next = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-cooldown');
+      const next = new ModelChainProgressStore(kv.kv, 'job-cooldown');
       const loaded = await next.loadCooldowns();
       expect(loaded.get('google:gemini-2.5-flash')).toEqual({ cooldownUntil: until, limitTokens: 16000 });
       // Cool-offs scope per-model bucket.
@@ -206,7 +206,7 @@ describe('ModelChainProgressStore', () => {
 
     it('does not write on note alone, so a 429 adds no subrequests on a path that had none', async () => {
       const kv = makeKV();
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-lazy');
+      const store = new ModelChainProgressStore(kv.kv, 'job-lazy');
 
       store.noteRateLimit('google:gemini-2.5-flash', { cooldownUntil: Date.now() + 30_000 });
       expect(kv.writes).toHaveLength(0);
@@ -222,7 +222,7 @@ describe('ModelChainProgressStore', () => {
       const later = Date.now() + 90_000;
       await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until: later, limitTokens: 16000 } } }));
 
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-merge-cooldown');
+      const store = new ModelChainProgressStore(kv.kv, 'job-merge-cooldown');
       // Later 429s omitting limitTokens must not erase known buckets.
       store.noteRateLimit('google:m', { cooldownUntil: earlier });
       await store.flushPending();
@@ -236,7 +236,7 @@ describe('ModelChainProgressStore', () => {
       const until = Date.now() + 30_000;
       await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until, limitTokens: 15 } } }));
 
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-poisoned-bucket');
+      const store = new ModelChainProgressStore(kv.kv, 'job-poisoned-bucket');
 
       const entry = (await store.loadCooldowns()).get('google:m');
       // Retains valid cool-off while discarding nonsense bucket size.
@@ -249,7 +249,7 @@ describe('ModelChainProgressStore', () => {
       // Prevents misparsed delays from disabling models indefinitely.
       await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until: Date.now() + 3_600_000 } } }));
 
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-clamp');
+      const store = new ModelChainProgressStore(kv.kv, 'job-clamp');
 
       const entry = (await store.loadCooldowns()).get('google:m');
       expect(entry!.cooldownUntil).toBeLessThanOrEqual(Date.now() + 5 * 60 * 1000);
@@ -260,7 +260,7 @@ describe('ModelChainProgressStore', () => {
       const kv = makeKV();
       await kv.kv.put('k', JSON.stringify({ cooldowns: { 'google:m': { until: Date.now() - 60_000, limitTokens: 16000 } } }));
 
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-expired');
+      const store = new ModelChainProgressStore(kv.kv, 'job-expired');
 
       expect((await store.loadCooldowns()).get('google:m')?.limitTokens).toBe(16000);
     });
@@ -269,7 +269,7 @@ describe('ModelChainProgressStore', () => {
       const kv = makeKV();
       await kv.kv.put('k', JSON.stringify({ files: { 'src/a.ts': 2 }, timeouts: { 'google:m': 1 } }));
 
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-old-shape');
+      const store = new ModelChainProgressStore(kv.kv, 'job-old-shape');
 
       expect(await store.startIndexFor('src/a.ts')).toBe(2);
       expect((await store.loadCooldowns()).size).toBe(0);
@@ -279,7 +279,7 @@ describe('ModelChainProgressStore', () => {
       const kv = makeKV();
       await kv.kv.put('k', JSON.stringify({ files: { 'src/a.ts': 2 } }));
 
-      const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, 'job-early-note');
+      const store = new ModelChainProgressStore(kv.kv, 'job-early-note');
       // Sync noteRateLimit can land before load(); must merge, not replace.
       store.noteRateLimit('google:m', { cooldownUntil: Date.now() + 30_000, limitTokens: 16000 });
 
@@ -290,7 +290,7 @@ describe('ModelChainProgressStore', () => {
 
   it('does nothing at all without a jobId', async () => {
     const kv = makeKV();
-    const store = new ModelChainProgressStore({ APP_KV: kv.kv } as never, undefined);
+    const store = new ModelChainProgressStore(kv.kv, undefined);
 
     await store.advance('src/a.ts', 2);
 

From c7bd587d2c361cd812d3b2609e644732c064c76e Mon Sep 17 00:00:00 2001
From: Devarshi Shimpi <devarshishimpi@gmail.com>
Date: Sat, 15 Aug 2026 23:48:09 +0530
Subject: [PATCH 10/12] refactor: types, use UUIDs, and remove debug logs

---
 apps/worker/src/ports/cloudflare-orchestrator.ts | 2 +-
 apps/worker/src/sessions.ts                      | 2 +-
 packages/models/package.json                     | 4 ++--
 src/server/adapters/services.ts                  | 1 -
 test/review/async-batch.spec.ts                  | 1 -
 5 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/apps/worker/src/ports/cloudflare-orchestrator.ts b/apps/worker/src/ports/cloudflare-orchestrator.ts
index ca8d28ea..08337749 100644
--- a/apps/worker/src/ports/cloudflare-orchestrator.ts
+++ b/apps/worker/src/ports/cloudflare-orchestrator.ts
@@ -6,7 +6,7 @@ import { setJobWorkflowInstance } from '@codra/db/jobs';
 import { logger } from '@codra/core/logger';
 import { runBestEffortJobMaintenance } from '@server/core/job-recovery';
 import type { AppBindings } from '../env';
-import type { WorkflowStep } from 'cloudflare:workers';
+import type { Workflow, WorkflowStep } from 'cloudflare:workers';
 
 export class CloudflareOrchestrator implements JobOrchestrator {
   constructor(private readonly workflow: Workflow, private readonly env?: AppBindings) {}
diff --git a/apps/worker/src/sessions.ts b/apps/worker/src/sessions.ts
index 8d548a3f..9c1dacb3 100644
--- a/apps/worker/src/sessions.ts
+++ b/apps/worker/src/sessions.ts
@@ -8,7 +8,7 @@ export class CloudflareSessionStore implements SessionStore {
   }
 
   async createSession(session: DashboardSessionUser): Promise<string> {
-    const token = Math.random().toString(36).substring(2);
+    const token = crypto.randomUUID();
     await this.kv.put(this.sessionKey(token), JSON.stringify(session), {
       expirationTtl: 60 * 60 * 24 * 7,
     });
diff --git a/packages/models/package.json b/packages/models/package.json
index 7c6baed9..1cea5759 100644
--- a/packages/models/package.json
+++ b/packages/models/package.json
@@ -18,8 +18,8 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@codra/schema": "*",
-    "@codra/core": "*"
+    "@codra/schema": "workspace:*",
+    "@codra/core": "workspace:*"
   },
   "devDependencies": {
   }
diff --git a/src/server/adapters/services.ts b/src/server/adapters/services.ts
index d828ca7b..e0130d95 100644
--- a/src/server/adapters/services.ts
+++ b/src/server/adapters/services.ts
@@ -11,7 +11,6 @@ import { getResolvedModelConfig } from '@codra/db/model-configs';
 // and reaching for a sibling here would bypass those mocks while the tests kept passing.
 
 export function makeGitHubFactory(env: AppBindings) {
-  console.log('TRACE makeGitHubFactory: GitHubService is', GitHubService.name, 'Mock?', GitHubService.name === 'MockGitHubService');
   return (installationId: string, tracker: TokenTracker): ReviewGitProvider => new GitHubService(env, installationId, tracker);
 }
 
diff --git a/test/review/async-batch.spec.ts b/test/review/async-batch.spec.ts
index f199537a..863d4d61 100644
--- a/test/review/async-batch.spec.ts
+++ b/test/review/async-batch.spec.ts
@@ -27,7 +27,6 @@ vi.mock('@codra/db/app-settings', async (importOriginal) => {
 });
 
 vi.mock('@codra/provider-github', async (importOriginal) => {
-  console.log('TRACE vi.mock called for provider-github');
   const mod = await importOriginal<Record<string, unknown>>();
   const { makeGitHubServiceMock } = await import('../mocks/services');
   return { ...mod, GitHubService: makeGitHubServiceMock() };

From c7f6532cdd754bfb4abf64c0fd436b5ca1832576 Mon Sep 17 00:00:00 2001
From: Devarshi Shimpi <devarshishimpi@gmail.com>
Date: Sat, 15 Aug 2026 23:51:03 +0530
Subject: [PATCH 11/12] fix: npm ci failing

---
 packages/models/package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/models/package.json b/packages/models/package.json
index 1cea5759..7c6baed9 100644
--- a/packages/models/package.json
+++ b/packages/models/package.json
@@ -18,8 +18,8 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@codra/schema": "workspace:*",
-    "@codra/core": "workspace:*"
+    "@codra/schema": "*",
+    "@codra/core": "*"
   },
   "devDependencies": {
   }

From 70a41f5d831d561cb9c2453fe1618d72d4aaa100 Mon Sep 17 00:00:00 2001
From: Devarshi Shimpi <devarshishimpi@gmail.com>
Date: Sat, 15 Aug 2026 23:55:56 +0530
Subject: [PATCH 12/12] refactor: remove unused import of Workflow type in
 CloudflareOrchestrator

---
 apps/worker/src/ports/cloudflare-orchestrator.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/worker/src/ports/cloudflare-orchestrator.ts b/apps/worker/src/ports/cloudflare-orchestrator.ts
index 08337749..ca8d28ea 100644
--- a/apps/worker/src/ports/cloudflare-orchestrator.ts
+++ b/apps/worker/src/ports/cloudflare-orchestrator.ts
@@ -6,7 +6,7 @@ import { setJobWorkflowInstance } from '@codra/db/jobs';
 import { logger } from '@codra/core/logger';
 import { runBestEffortJobMaintenance } from '@server/core/job-recovery';
 import type { AppBindings } from '../env';
-import type { Workflow, WorkflowStep } from 'cloudflare:workers';
+import type { WorkflowStep } from 'cloudflare:workers';
 
 export class CloudflareOrchestrator implements JobOrchestrator {
   constructor(private readonly workflow: Workflow, private readonly env?: AppBindings) {}