feat(reusable): ship the curated swarm as the default config consumers inherit (#10)

.gitea/workflows/review-reusable.yml

@@ -10,11 +10,13 @@
 #       secrets:                     # forward ONLY what the reviewer needs
 #         OLLAMA_CLOUD_API_KEY:    ${{ secrets.OLLAMA_CLOUD_API_KEY }}
 #         CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-#       with: { models: "...", allowed_users: "..." }   # all optional
+#       with: { allowed_users: "..." }   # config inputs are optional (see below)
 #
-# Inputs are all optional and default to "" — an empty env value makes the
-# image/entrypoint use its own built-in default, so the caller only sets what it
-# wants to override. Secrets are DECLARED below (workflow_call.secrets) so a
+# Inputs ship the DEFAULT swarm (see the inputs block): 3 cloud models + the
+# Claude Code engine, 5-lens suite (claude models serial, 5 lenses each). A consumer
+# inherits it by omitting `with:` entirely, or overrides any field (e.g.
+# `models:` for a cloud-only / different-provider setup; "" falls back to the
+# image's built-in default). Secrets are DECLARED below (workflow_call.secrets) so a
 # caller forwards only the credentials the reviewer actually uses — least
 # privilege — rather than `secrets: inherit`, which leaks every caller secret
 # (registry/deploy/db creds) into this workflow. `secrets: inherit` still works
@@ -30,21 +32,33 @@ name: Gadfly review (reusable)
 
 on:
   workflow_call:
+    # Inputs ship the DEFAULT Gadfly swarm so a consumer can just call this
+    # workflow (no `with:` block) and inherit it. The default is opinionated —
+    # 3 strong cloud models + the Claude Code engine (sonnet/opus/opus:max), the
+    # 5-lens suite. Claude models run ONE at a time, but each runs all 5 lenses at
+    # once. It needs OLLAMA_CLOUD_API_KEY and CLAUDE_CODE_OAUTH_TOKEN; a consumer
+    # with only one (or a different provider) overrides `models:` (and forwards
+    # just the secrets it uses). Set any input to "" to fall back to the
+    # image/entrypoint built-in default.
+    #
+    # Peak claude concurrency = provider_concurrency × provider_lens_concurrency
+    # (1 model × 5 lenses = up to 5 concurrent `claude -p` per pass) — friendly to
+    # a single subscription. Raise claude-code in either knob for more parallelism.
     inputs:
-      models:                    { type: string, default: "" }   # GADFLY_MODELS (csv)
-      specialists:               { type: string, default: "" }   # GADFLY_SPECIALISTS
+      models:                    { type: string, default: "minimax-m3:cloud,glm-5.2:cloud,deepseek-v4-pro:cloud,claude-code/sonnet,claude-code/opus,claude-code/opus:max" }   # GADFLY_MODELS (csv)
+      specialists:               { type: string, default: "security,correctness,maintainability,performance,error-handling" }   # GADFLY_SPECIALISTS (5-lens default suite)
       provider:                  { type: string, default: "" }   # GADFLY_PROVIDER
       base_url:                  { type: string, default: "" }   # GADFLY_BASE_URL
-      provider_concurrency:      { type: string, default: "" }   # GADFLY_PROVIDER_CONCURRENCY
-      provider_lens_concurrency: { type: string, default: "" }   # GADFLY_PROVIDER_LENS_CONCURRENCY
-      timeout_secs:              { type: string, default: "" }   # GADFLY_TIMEOUT_SECS (per lens)
-      max_steps:                 { type: string, default: "" }   # GADFLY_MAX_STEPS
+      provider_concurrency:      { type: string, default: "ollama-cloud=3,claude-code=1" }   # GADFLY_PROVIDER_CONCURRENCY (claude models one at a time)
+      provider_lens_concurrency: { type: string, default: "ollama-cloud=3,claude-code=5" }   # GADFLY_PROVIDER_LENS_CONCURRENCY (each claude runs all 5 lenses at once)
+      timeout_secs:              { type: string, default: "600" }   # GADFLY_TIMEOUT_SECS (per lens)
+      max_steps:                 { type: string, default: "14" }   # GADFLY_MAX_STEPS
       worker_model:              { type: string, default: "" }   # GADFLY_WORKER_MODEL
-      allowed_users:             { type: string, default: "" }   # GADFLY_ALLOWED_USERS
+      allowed_users:             { type: string, default: "" }   # GADFLY_ALLOWED_USERS (consumer-specific; set in your stub)
       trigger_phrase:            { type: string, default: "" }   # GADFLY_TRIGGER_PHRASE
-      # Job wall-clock cap. 45 > 30 as a default: a multi-model swarm or a slow
-      # lens (e.g. claude-code with extended thinking) can exceed 30 minutes.
-      timeout_minutes:           { type: number, default: 45 }
+      # Job wall-clock cap. 90 as a default: the 5-lens suite across a slow lane
+      # (claude-code with extended thinking) over two passes can run long.
+      timeout_minutes:           { type: number, default: 90 }
     # Declared so callers can forward ONLY the secrets the reviewer needs
     # (least privilege) instead of `secrets: inherit`, which would hand this
     # workflow every secret in the caller's repo (registry/deploy/db creds the