.gitea/workflows/adversarial-review.yml

@@ -4,7 +4,8 @@
 # holds only the triggers, the actor gate, secret forwarding, and allow-list.
 #
 # Advisory only — never blocks a merge. It inherits the default swarm: 3 cloud
-# models + Claude Code (sonnet, opus, opus:max), 5-lens suite, 3 claudes at once.
+# models + Claude Code (sonnet, opus, opus:max), 5-lens suite (claude models run
+# one at a time, each with all 5 lenses at once).
 
 name: Adversarial Review (Gadfly)
 
@@ -49,6 +50,6 @@ jobs:
       GADFLY_FINDINGS_TOKEN:   ${{ secrets.GADFLY_FINDINGS_TOKEN }}
     with:
       # Inherit the default swarm (3 cloud + Claude Code sonnet/opus/opus:max,
-      # 5-lens suite, all three claudes concurrent) from review-reusable.yml.
-      # Only the consumer-specific allow-list is set here.
+      # 5-lens suite) from review-reusable.yml. Only the consumer-specific
+      # allow-list is set here.
       allowed_users: "steve,fizi,dazed"

.gitea/workflows/review-reusable.yml

@@ -13,7 +13,7 @@
 #       with: { allowed_users: "..." }   # config inputs are optional (see below)
 #
 # Inputs ship the DEFAULT swarm (see the inputs block): 3 cloud models + the
-# Claude Code engine, 5-lens suite, all three claudes concurrent. A consumer
+# Claude Code engine, 5-lens suite (claude models serial, 5 lenses each). A consumer
 # inherits it by omitting `with:` entirely, or overrides any field (e.g.
 # `models:` for a cloud-only / different-provider setup; "" falls back to the
 # image's built-in default). Secrets are DECLARED below (workflow_call.secrets) so a
@@ -35,21 +35,21 @@ on:
     # Inputs ship the DEFAULT Gadfly swarm so a consumer can just call this
     # workflow (no `with:` block) and inherit it. The default is opinionated —
     # 3 strong cloud models + the Claude Code engine (sonnet/opus/opus:max), the
-    # 5-lens suite, all three claudes concurrent AND each running its 5 lenses at
+    # 5-lens suite. Claude models run ONE at a time, but each runs all 5 lenses at
     # once. It needs OLLAMA_CLOUD_API_KEY and CLAUDE_CODE_OAUTH_TOKEN; a consumer
     # with only one (or a different provider) overrides `models:` (and forwards
     # just the secrets it uses). Set any input to "" to fall back to the
     # image/entrypoint built-in default.
     #
     # Peak claude concurrency = provider_concurrency × provider_lens_concurrency
-    # (3 models × 5 lenses = up to 15 concurrent `claude -p` per pass). If you hit
-    # subscription rate limits or runner load, dial claude-code down in either knob.
+    # (1 model × 5 lenses = up to 5 concurrent `claude -p` per pass) — friendly to
+    # a single subscription. Raise claude-code in either knob for more parallelism.
     inputs:
       models:                    { type: string, default: "minimax-m3:cloud,glm-5.2:cloud,deepseek-v4-pro:cloud,claude-code/sonnet,claude-code/opus,claude-code/opus:max" }   # GADFLY_MODELS (csv)
       specialists:               { type: string, default: "security,correctness,maintainability,performance,error-handling" }   # GADFLY_SPECIALISTS (5-lens default suite)
       provider:                  { type: string, default: "" }   # GADFLY_PROVIDER
       base_url:                  { type: string, default: "" }   # GADFLY_BASE_URL
-      provider_concurrency:      { type: string, default: "ollama-cloud=3,claude-code=3" }   # GADFLY_PROVIDER_CONCURRENCY (all 3 claudes at once)
+      provider_concurrency:      { type: string, default: "ollama-cloud=3,claude-code=1" }   # GADFLY_PROVIDER_CONCURRENCY (claude models one at a time)
       provider_lens_concurrency: { type: string, default: "ollama-cloud=3,claude-code=5" }   # GADFLY_PROVIDER_LENS_CONCURRENCY (each claude runs all 5 lenses at once)
       timeout_secs:              { type: string, default: "600" }   # GADFLY_TIMEOUT_SECS (per lens)
       max_steps:                 { type: string, default: "14" }   # GADFLY_MAX_STEPS

CLAUDE.md

@@ -47,8 +47,8 @@ entrypoint.sh          container brains: trigger gating, PR clone, model loop (t
 Dockerfile             multi-stage; private-module creds via BuildKit secrets never reach the final image
 .gitea/workflows/build-image.yml   push main → :latest; tag v* → :<tag>+:latest; PR → build-only
 .gitea/workflows/review-reusable.yml  reusable (workflow_call) review job; ships the DEFAULT swarm as
-                       input defaults (3 cloud + Claude Code sonnet/opus/opus:max, 5-lens suite,
-                       claude-code=3) so consumers inherit it by omitting `with:`. Consumers subscribe
+                       input defaults (3 cloud + Claude Code sonnet/opus/opus:max, 5-lens suite;
+                       claude models serial, 5 lenses each) so consumers inherit it by omitting `with:`. Consumers subscribe
                        with an ~8-line caller forwarding only the secrets the reviewer needs (Phase 4);
                        gadfly's own adversarial-review.yml is a thin caller of it (dogfoods the path).
 examples/              copy-paste consumer stub workflows for different providers