diff --git a/AGENTS.md b/AGENTS.md
index 2d696a8..77d0a7a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -22,6 +22,59 @@ This repository implements VectorLint — a prompt‑driven, structured‑output
 - `presets/` — bundled rule packs (e.g., `VectorLint/`)
 - `tests/` — Vitest specs for config, scanning, evaluation, providers
 
+## Agent Behavior Guidelines
+
+These guidelines reduce common LLM coding mistakes. They bias toward caution over speed; use judgment for trivial tasks.
+
+### Think Before Coding
+
+- State assumptions explicitly before implementing.
+- If multiple interpretations exist, present them instead of picking silently.
+- If a simpler approach exists, say so and push back when warranted.
+- If something is unclear, stop, name the confusion, and ask.
+
+### Simplicity First
+
+- Write the minimum code that solves the problem.
+- Do not add features beyond what was asked.
+- Do not introduce abstractions for single-use code.
+- Do not add flexibility or configurability that was not requested.
+- Do not add error handling for impossible scenarios.
+- If a change becomes larger than needed, simplify before finishing.
+
+### Surgical Changes
+
+- Touch only the files and lines required by the request.
+- Do not improve adjacent code, comments, or formatting unless required.
+- Match existing style, even when another style is tempting.
+- If you notice unrelated dead code, mention it instead of deleting it.
+- Remove imports, variables, functions, or files made unused by your own changes.
+- Do not remove pre-existing dead code unless asked.
+
+### Goal-Driven Execution
+
+- Turn requests into verifiable goals before implementing.
+- For bug fixes, write or identify a reproduction, then make it pass.
+- For validation changes, cover invalid inputs, then make the checks pass.
+- For refactors, verify behavior before and after the change.
+- For multi-step tasks, state a brief plan with verification for each step.
+- Loop until the success criteria are verified or a blocker is clear.
+
+### Error Organization
+
+- Put domain error classes in focused error files and import them into the modules that throw them.
+- Reuse the repository's custom error hierarchy instead of throwing native `Error` directly.
+- Catch errors as `unknown`; narrow or convert them with the existing error utilities.
+- Introduce error handling only for real failure modes, not speculative or impossible scenarios.
+
+### Comments
+
+- Write comments only when they explain non-obvious current behavior, invariants, or constraints.
+- Do not preserve planning discussions, rejected alternatives, absent fields, or speculative future architecture in production comments.
+- Do not use comments to restate code that is already clear from names and types.
+- Keep security and scope-boundary comments when they explain constraints that the implementation must preserve.
+- Test supported behavior and current invariants; do not add negative tests solely to memorialize rejected designs.
+
 ## Configuration System
 
 ### Quick Start
@@ -132,7 +185,6 @@ For documents >600 words, VectorLint automatically chunks content:
 - Separation of concerns: rules define rubric; schemas enforce structure; CLI orchestrates; evaluators process; reporters format
 - Separation of concerns: when a file starts combining contracts, orchestration, and utility logic, extract shared helpers and types into focused modules
 - Extensibility: add providers by implementing `LLMProvider` or `SearchProvider`; add evaluators via registry pattern
-- Error handling: prefer the repository's custom error hierarchy over native `Error`; catch blocks use `unknown` type and extend existing custom error types before introducing raw exceptions
 - Shared domain constants: avoid magic strings for core runtime concepts; define shared constants, enums, or types and import them where needed
 - Naming: choose domain-accurate names that reflect the real abstraction level; avoid use-case-specific terminology in shared runtime code
 - Logging: route runtime logging through an injected logger interface; keep concrete logger implementations behind the abstraction
diff --git a/src/review/README.md b/src/review/README.md
new file mode 100644
index 0000000..aa55e47
--- /dev/null
+++ b/src/review/README.md
@@ -0,0 +1,35 @@
+# `src/review/` — Review-Domain Contract
+
+The neutral, implementation-neutral contract every executor programs against.
+A caller builds a `ReviewRequest`; an executor returns a `ReviewResult`.
+
+## What lives here
+
+- `types.ts` — all review-domain interfaces (`ReviewTarget`, `ReviewRule`,
+  `ReviewContext`, `ReviewBudget`, `ReviewFinding`, `ReviewScore`,
+  `ReviewDiagnostic`, `ReviewResult`, `ReviewRequest`, `ReviewModelCall`).
+- `schemas.ts` — strict Zod schemas mirroring every external shape (boundary
+  validation).
+- `budget.ts` — `DEFAULT_REVIEW_BUDGET`, `REVIEW_BUDGET_SCHEMA`,
+  and `enforceBudget()`.
+- `errors.ts` — review-domain errors, including `BudgetExceededError`.
+- `boundary.ts` — `buildScope()` / `isInScope()` enforcing the on-page boundary.
+- `executor.ts` — `ReviewExecutor` interface, `REVIEW_MODEL_CALLS`
+  (`single | agent | auto`), `chooseModelCall()`.
+- `request-builder.ts` — `buildReviewRequest()` bridging `PromptFile` to
+  `ReviewRequest`.
+
+## On-page boundary
+
+- Target content is always in scope.
+- Caller-supplied context is in scope.
+- Workspace reads are out of scope unless the caller includes them as context.
+- Agent model calls page through target content only.
+- Rule bodies are source-backed and caller-authored, never model-authored.
+
+## Execution strategy
+
+`modelCall: single | agent | auto` selects how the reviewer model is invoked,
+not how rules are scored. `single` sends target + rule in one structured call;
+`agent` gives the executor a target-scoped read-section capability; `auto`
+picks `single` for normal-sized inputs and `agent` for large ones.
diff --git a/src/review/boundary.ts b/src/review/boundary.ts
new file mode 100644
index 0000000..1a33369
--- /dev/null
+++ b/src/review/boundary.ts
@@ -0,0 +1,66 @@
+import type { ReviewScope } from './types';
+
+const FILE_URI_RE = /^file:\/\/(?<authority>[^/]*)(?<path>\/.*)?$/;
+
+/**
+ * Lexically resolves '.' and '..' segments in a path string. Pure: performs no
+ * filesystem reads. The helper is kept local so src/review/ has no agent
+ * import and no filesystem access.
+ *
+ * The contract does not perform symlink canonicalization. Callers must
+ * canonicalize real files into target/context URIs before building a
+ * ReviewRequest.
+ */
+function resolveDotSegments(input: string): string {
+  const segments: string[] = [];
+  for (const segment of input.split('/')) {
+    if (segment === '' || segment === '.') continue;
+    if (segment === '..') {
+      segments.pop();
+      continue;
+    }
+    segments.push(segment);
+  }
+  return (input.startsWith('/') ? '/' : '') + segments.join('/');
+}
+
+/**
+ * Normalizes a review URI by resolving '.'/'..' segments in its path. file://
+ * URIs are normalized structurally; other (virtual, in-memory) URIs are
+ * returned as-is after dot resolution of their path-like suffix.
+ */
+export function normalizeReviewUri(uri: string): string {
+  const match = FILE_URI_RE.exec(uri);
+  if (match?.groups) {
+    const authority = match.groups['authority'] ?? '';
+    const rawPath = match.groups['path'] ?? '/';
+    return `file://${authority}${resolveDotSegments(rawPath)}`;
+  }
+  return uri;
+}
+
+/**
+ * Builds the on-page boundary scope from the target URI and
+ * any caller-supplied context URIs. Only these URIs are in scope; arbitrary
+ * workspace files are out of scope unless the caller explicitly includes them.
+ */
+export function buildScope(params: {
+  targetUri: string;
+  contextUris?: readonly string[];
+}): ReviewScope {
+  const allowedUris = new Set<string>();
+  allowedUris.add(normalizeReviewUri(params.targetUri));
+  for (const uri of params.contextUris ?? []) {
+    allowedUris.add(normalizeReviewUri(uri));
+  }
+  return { allowedUris };
+}
+
+/**
+ * Returns true iff `uri` (after normalization) is the target or caller-supplied
+ * context. Path-traversal segments are resolved before comparison, so a
+ * traversal-style path cannot masquerade as an in-scope URI.
+ */
+export function isInScope(scope: ReviewScope, uri: string): boolean {
+  return scope.allowedUris.has(normalizeReviewUri(uri));
+}
diff --git a/src/review/budget.ts b/src/review/budget.ts
new file mode 100644
index 0000000..5c26b6a
--- /dev/null
+++ b/src/review/budget.ts
@@ -0,0 +1,63 @@
+import { z } from 'zod';
+import type { ReviewBudget } from './types';
+import { BudgetExceededError } from './errors';
+
+/**
+ * Sensible default bounds for a single review. Frozen so a
+ * shared default object cannot be accidentally mutated by a caller.
+ */
+export const DEFAULT_REVIEW_BUDGET: Readonly<ReviewBudget> = Object.freeze({
+  maxTargetBytes: 1_000_000,
+  maxCallerContextBytes: 500_000,
+  maxChunksPerRule: 20,
+  maxModelCallsPerReview: 50,
+  maxWallClockMs: 5 * 60_000,
+});
+
+/** Zod schema mirroring {@link ReviewBudget}, applying defaults for omitted fields. */
+export const REVIEW_BUDGET_SCHEMA = z
+  .object({
+    maxTargetBytes: z.number().int().positive().default(DEFAULT_REVIEW_BUDGET.maxTargetBytes),
+    maxCallerContextBytes: z
+      .number()
+      .int()
+      .positive()
+      .default(DEFAULT_REVIEW_BUDGET.maxCallerContextBytes),
+    maxChunksPerRule: z.number().int().positive().default(DEFAULT_REVIEW_BUDGET.maxChunksPerRule),
+    maxModelCallsPerReview: z
+      .number()
+      .int()
+      .positive()
+      .default(DEFAULT_REVIEW_BUDGET.maxModelCallsPerReview),
+    maxWallClockMs: z.number().int().positive().default(DEFAULT_REVIEW_BUDGET.maxWallClockMs),
+  })
+  .strict();
+
+/** Current resource usage, checked against a {@link ReviewBudget}. */
+export interface BudgetUsage {
+  modelCalls: number;
+  elapsedMs: number;
+}
+
+/**
+ * Throws {@link BudgetExceededError} if current usage violates a hard limit.
+ * Executors call this before/after each model call and on timeout checks.
+ * Only runtime counters (model calls, wall clock) are enforced here; size
+ * limits (target/context bytes, chunks) are enforced at request-build time.
+ */
+export function enforceBudget(budget: ReviewBudget, usage: BudgetUsage): void {
+  if (usage.modelCalls > budget.maxModelCallsPerReview) {
+    throw new BudgetExceededError(
+      `model calls (${usage.modelCalls}) exceed maxModelCallsPerReview (${budget.maxModelCallsPerReview})`,
+      'maxModelCallsPerReview',
+      usage.modelCalls,
+    );
+  }
+  if (usage.elapsedMs > budget.maxWallClockMs) {
+    throw new BudgetExceededError(
+      `elapsed time (${usage.elapsedMs}ms) exceeds maxWallClockMs (${budget.maxWallClockMs}ms)`,
+      'maxWallClockMs',
+      usage.elapsedMs,
+    );
+  }
+}
diff --git a/src/review/errors.ts b/src/review/errors.ts
new file mode 100644
index 0000000..1e97aa9
--- /dev/null
+++ b/src/review/errors.ts
@@ -0,0 +1,13 @@
+import { VectorlintError } from '../errors';
+import type { ReviewBudget } from './types';
+
+export class BudgetExceededError extends VectorlintError {
+  constructor(
+    message: string,
+    public readonly limit: keyof ReviewBudget,
+    public readonly actual: number,
+  ) {
+    super(message, 'BUDGET_EXCEEDED');
+    this.name = 'BudgetExceededError';
+  }
+}
diff --git a/src/review/executor.ts b/src/review/executor.ts
new file mode 100644
index 0000000..441cdd7
--- /dev/null
+++ b/src/review/executor.ts
@@ -0,0 +1,51 @@
+import type { ReviewModelCall, ReviewRequest, ReviewResult } from './types';
+
+/**
+ * Above this target byte size (roughly the existing chunking threshold in
+ * bytes), `auto` model-call selection prefers the agent executor so the
+ * reviewer can page through target content for context management.
+ */
+export const AGENT_MODEL_CALL_BYTE_THRESHOLD = 600_000;
+
+/**
+ * The single source of truth for reviewer model-call strategies. Kept in sync
+ * with the {@link ReviewModelCall} union via `satisfies`.
+ */
+export const REVIEW_MODEL_CALLS = ['single', 'agent', 'auto'] as const satisfies readonly ReviewModelCall[];
+
+/**
+ * The stable domain-level interface every executor implements. Single and
+ * agent executors are implementations behind this contract.
+ */
+export interface ReviewExecutor {
+  run(request: ReviewRequest): Promise<ReviewResult>;
+}
+
+/**
+ * Agent-call capability: a bounded way to page through target content for
+ * context management. NOT a workspace tool. An agent
+ * executor receives this capability scoped to the target only.
+ */
+export interface ReviewTargetReadCapability {
+  /** Read a 1-based [startLine, endLine] window of the target content. */
+  readTargetSection(
+    startLine: number,
+    endLine: number,
+  ): Promise<{ startLine: number; endLine: number; content: string }>;
+}
+
+/**
+ * Resolves 'auto' to 'single' or 'agent'. Single for normal-sized inputs;
+ * agent for large inputs or multi-rule runs that benefit from paging.
+ */
+export function chooseModelCall(
+  modelCall: ReviewModelCall,
+  signal: { targetBytes: number; rules: number },
+): 'single' | 'agent' {
+  if (modelCall === 'single') return 'single';
+  if (modelCall === 'agent') return 'agent';
+  if (signal.targetBytes > AGENT_MODEL_CALL_BYTE_THRESHOLD || signal.rules > 5) {
+    return 'agent';
+  }
+  return 'single';
+}
diff --git a/src/review/index.ts b/src/review/index.ts
new file mode 100644
index 0000000..95ac2e0
--- /dev/null
+++ b/src/review/index.ts
@@ -0,0 +1,16 @@
+/**
+ * Neutral review-domain contract for the VectorLint harness.
+ *
+ * Everything an executor needs to review target content against
+ * source-backed rules flows through this module. The CLI and external callers
+ * build a ReviewRequest and receive a ReviewResult.
+ *
+ * See README.md for the contract overview.
+ */
+export * from './types';
+export * from './schemas';
+export * from './errors';
+export * from './budget';
+export * from './boundary';
+export * from './executor';
+export * from './request-builder';
diff --git a/src/review/request-builder.ts b/src/review/request-builder.ts
new file mode 100644
index 0000000..56a3d5a
--- /dev/null
+++ b/src/review/request-builder.ts
@@ -0,0 +1,84 @@
+import type { PromptFile } from '../schemas/prompt-schemas';
+import type {
+  ReviewBudget,
+  ReviewContext,
+  ReviewModelCall,
+  ReviewOutputPolicy,
+  ReviewRequest,
+  ReviewRule,
+  ReviewTarget,
+} from './types';
+import { DEFAULT_REVIEW_BUDGET } from './budget';
+import { ValidationError } from '../errors';
+
+/** Default output policy: include usage metadata, never record payloads. */
+export const DEFAULT_REVIEW_OUTPUT_POLICY: Readonly<ReviewOutputPolicy> = Object.freeze({
+  includeUsage: true,
+  recordPayloadTelemetry: false,
+});
+
+/** Optional overrides applied by {@link buildReviewRequest}. */
+export interface ReviewRequestBuilderConfig {
+  budget?: ReviewBudget;
+  outputPolicy?: ReviewOutputPolicy;
+  modelCall?: ReviewModelCall;
+}
+
+export interface BuildReviewRequestParams {
+  target: ReviewTarget;
+  /** Existing prompt files to convert into source-backed ReviewRules. */
+  prompts: readonly PromptFile[];
+  /** Caller-supplied, in-scope context, passed through unchanged. */
+  context?: ReviewContext[];
+  config?: ReviewRequestBuilderConfig;
+}
+
+/** Builds the stable ReviewRule id formatted Pack.Rule (mirrors src/agent/rule-id.ts). */
+function toReviewRuleId(prompt: PromptFile): string {
+  const pack = prompt.pack || 'Default';
+  return `${pack}.${prompt.meta.id}`;
+}
+
+/** Converts a single PromptFile into a source-backed ReviewRule. */
+function toReviewRule(prompt: PromptFile): ReviewRule {
+  const rule: ReviewRule = {
+    id: toReviewRuleId(prompt),
+    source: prompt.fullPath,
+    body: prompt.body,
+  };
+  if (prompt.meta.name !== undefined) {
+    rule.name = prompt.meta.name;
+  }
+  // Severity is a string enum whose values ('error' | 'warning') match
+  // ReviewSeverity exactly, so it maps cleanly without transformation.
+  if (prompt.meta.severity !== undefined) {
+    rule.severity = prompt.meta.severity;
+  }
+  return rule;
+}
+
+/**
+ * Builds a {@link ReviewRequest} from existing {@link PromptFile}s plus a
+ * target. Callers can use this bridge to convert the current prompt pipeline
+ * into the review contract without changing how prompts load.
+ * Throws a {@link ValidationError} when no prompts are supplied.
+ */
+export function buildReviewRequest(params: BuildReviewRequestParams): ReviewRequest {
+  const { target, prompts, context } = params;
+  if (prompts.length === 0) {
+    throw new ValidationError('buildReviewRequest requires at least one prompt.');
+  }
+
+  const config = params.config;
+  const request: ReviewRequest = {
+    target,
+    rules: prompts.map(toReviewRule),
+    budget: config?.budget ?? DEFAULT_REVIEW_BUDGET,
+    outputPolicy: config?.outputPolicy ?? DEFAULT_REVIEW_OUTPUT_POLICY,
+    modelCall: config?.modelCall ?? 'auto',
+  };
+  if (context !== undefined) {
+    request.context = context;
+  }
+  return request;
+}
diff --git a/src/review/schemas.ts b/src/review/schemas.ts
new file mode 100644
index 0000000..398c880
--- /dev/null
+++ b/src/review/schemas.ts
@@ -0,0 +1,133 @@
+import { z } from 'zod';
+import { REVIEW_BUDGET_SCHEMA } from './budget';
+
+/**
+ * Zod schemas mirroring src/review/types.ts (boundary validation).
+ *
+ * Every external review-domain shape has a paired schema here so callers and
+ * external adapters can validate untrusted input at the system boundary.
+ * Schemas reject unknown keys.
+ */
+
+export const REVIEW_SEVERITY_SCHEMA = z.enum(['error', 'warning']);
+
+export const REVIEW_VIOLATION_CONDITION_SCHEMA = z
+  .object({
+    id: z.string().min(1),
+    description: z.string().min(1),
+  })
+  .strict();
+
+export const REVIEW_TARGET_SCHEMA = z
+  .object({
+    uri: z.string().min(1),
+    content: z.string(),
+    contentType: z.string().min(1),
+    byteLength: z.number().int().nonnegative().optional(),
+  })
+  .strict();
+
+export const REVIEW_RULE_SCHEMA = z
+  .object({
+    id: z.string().min(1),
+    source: z.string().min(1),
+    body: z.string(),
+    name: z.string().optional(),
+    severity: REVIEW_SEVERITY_SCHEMA.default('warning'),
+    violationConditions: z.array(REVIEW_VIOLATION_CONDITION_SCHEMA).optional(),
+  })
+  .strict();
+
+export const REVIEW_CONTEXT_SCHEMA = z
+  .object({
+    label: z.string().min(1),
+    content: z.string(),
+    relation: z.string().optional(),
+    uri: z.string().optional(),
+  })
+  .strict();
+
+export const REVIEW_OUTPUT_POLICY_SCHEMA = z
+  .object({
+    includeUsage: z.boolean(),
+    recordPayloadTelemetry: z.boolean(),
+  })
+  .strict();
+
+export const REVIEW_DIAGNOSTIC_LEVEL_SCHEMA = z.enum(['info', 'warn', 'error']);
+
+export const REVIEW_SCORE_COMPONENT_SCHEMA = z
+  .object({
+    id: z.string().min(1),
+    scoreText: z.string(),
+    score: z.number(),
+    weight: z.number().optional(),
+  })
+  .strict();
+
+export const REVIEW_SCORE_SCHEMA = z
+  .object({
+    ruleId: z.string().min(1),
+    score: z.number(),
+    scoreText: z.string(),
+    severity: REVIEW_SEVERITY_SCHEMA,
+    findingCount: z.number().int().nonnegative().optional(),
+    components: z.array(REVIEW_SCORE_COMPONENT_SCHEMA).optional(),
+  })
+  .strict();
+
+export const REVIEW_FINDING_SCHEMA = z
+  .object({
+    ruleId: z.string().min(1),
+    ruleSource: z.string().min(1),
+    severity: REVIEW_SEVERITY_SCHEMA,
+    message: z.string(),
+    line: z.number().int().positive(),
+    column: z.number().int().positive(),
+    match: z.string(),
+    analysis: z.string().optional(),
+    suggestion: z.string().optional(),
+    fix: z.string().optional(),
+  })
+  .strict();
+
+export const REVIEW_DIAGNOSTIC_SCHEMA = z
+  .object({
+    level: REVIEW_DIAGNOSTIC_LEVEL_SCHEMA,
+    code: z.string().min(1),
+    message: z.string(),
+    ruleId: z.string().optional(),
+    context: z.record(z.string(), z.unknown()).optional(),
+  })
+  .strict();
+
+export const REVIEW_USAGE_SCHEMA = z
+  .object({
+    inputTokens: z.number().int().nonnegative().optional(),
+    outputTokens: z.number().int().nonnegative().optional(),
+    modelCalls: z.number().int().nonnegative(),
+    costUsd: z.number().nonnegative().optional(),
+    wallClockMs: z.number().int().nonnegative().optional(),
+  })
+  .strict();
+
+export const REVIEW_RESULT_SCHEMA = z
+  .object({
+    findings: z.array(REVIEW_FINDING_SCHEMA),
+    scores: z.array(REVIEW_SCORE_SCHEMA),
+    diagnostics: z.array(REVIEW_DIAGNOSTIC_SCHEMA),
+    usage: REVIEW_USAGE_SCHEMA.optional(),
+    hadOperationalErrors: z.boolean().optional(),
+  })
+  .strict();
+
+export const REVIEW_REQUEST_SCHEMA = z
+  .object({
+    target: REVIEW_TARGET_SCHEMA,
+    rules: z.array(REVIEW_RULE_SCHEMA).min(1),
+    context: z.array(REVIEW_CONTEXT_SCHEMA).optional(),
+    budget: REVIEW_BUDGET_SCHEMA,
+    outputPolicy: REVIEW_OUTPUT_POLICY_SCHEMA,
+    modelCall: z.enum(['single', 'agent', 'auto']),
+  })
+  .strict();
diff --git a/src/review/types.ts b/src/review/types.ts
new file mode 100644
index 0000000..2df19e0
--- /dev/null
+++ b/src/review/types.ts
@@ -0,0 +1,187 @@
+/**
+ * Neutral review-domain contract types for the VectorLint harness.
+ *
+ * Everything an executor needs to review target content against
+ * source-backed rules flows through this module. Callers build a
+ * {@link ReviewRequest} and executors return a {@link ReviewResult}.
+ * `modelCall` selects how the reviewer model is invoked, not how rules are
+ * scored.
+ */
+
+/** Finding/Rule severity. */
+export type ReviewSeverity = 'error' | 'warning';
+
+/** Objective Via Negativa condition that counts as a violation when present. */
+export interface ReviewViolationCondition {
+  id: string;
+  description: string;
+}
+
+/**
+ * Target content under review. The on-page boundary is enforced against this:
+ * executors may only read sections of `content`.
+ */
+export interface ReviewTarget {
+  /** Stable absolute URI (file:// or virtual scheme for in-memory content). */
+  uri: string;
+  /** Full target content. May be paged by an agent executor. */
+  content: string;
+  /** MIME-ish content type, e.g. 'text/markdown'. */
+  contentType: string;
+  /** Optional byte length hint; computed from content if absent. */
+  byteLength?: number;
+}
+
+/**
+ * A source-backed, caller-authored rule. Model-authored rule overrides are
+ * explicitly disallowed.
+ */
+export interface ReviewRule {
+  /** Stable id, formatted Pack.Rule[.Criterion] in output. */
+  id: string;
+  /** Canonical source path (where the rule body came from). */
+  source: string;
+  /** The rule prompt body. Source-backed; never model-authored. */
+  body: string;
+  /** Human-readable name. */
+  name?: string;
+  /** 'error' | 'warning'. Defaults to 'warning'. */
+  severity?: ReviewSeverity;
+  /** Optional structured Via Negativa violation conditions. */
+  violationConditions?: ReviewViolationCondition[];
+}
+
+/**
+ * Caller-supplied context. Explicitly in scope:
+ * VectorLint does NOT discover workspace files as context on its own; the
+ * caller owns exploration and context gathering.
+ */
+export interface ReviewContext {
+  /** Short label used in diagnostics/tracing. */
+  label: string;
+  /** The context content itself. */
+  content: string;
+  /** How this context relates to the target, e.g. 'reference' | 'glossary'. */
+  relation?: string;
+  /** Optional source URI for provenance. */
+  uri?: string;
+}
+
+/**
+ * The on-page boundary scope: the normalized URIs an executor may read.
+ * Built by {@link buildScope} (see boundary.ts) and checked by
+ * {@link isInScope}.
+ */
+export interface ReviewScope {
+  /** Normalized absolute URIs that are in scope (target + caller context). */
+  readonly allowedUris: ReadonlySet<string>;
+}
+
+/**
+ * Hard bounds on a single review. These limit work, not
+ * output. Executors MUST check these and surface a ReviewDiagnostic (or fail
+ * the run) when exceeded.
+ */
+export interface ReviewBudget {
+  maxTargetBytes: number;
+  maxCallerContextBytes: number;
+  maxChunksPerRule: number;
+  maxModelCallsPerReview: number;
+  /** Maximum elapsed review time in milliseconds. This is the run timeout. */
+  maxWallClockMs: number;
+}
+
+/**
+ * Controls optional output/telemetry behavior. Diagnostics are always part of
+ * ReviewResult; this policy does not hide operational warnings. Payload
+ * telemetry is a separate opt-in from metadata telemetry.
+ */
+export interface ReviewOutputPolicy {
+  /** Include usage/cost in the result. */
+  includeUsage: boolean;
+  /** Opt-in: record prompt/content payloads to telemetry. Default false. */
+  recordPayloadTelemetry: boolean;
+}
+
+/** A verified finding anchored in the target content. */
+export interface ReviewFinding {
+  ruleId: string;
+  ruleSource: string;
+  severity: ReviewSeverity;
+  message: string;
+  /** 1-based line in the target content. */
+  line: number;
+  /** 1-based column. */
+  column: number;
+  /** Verified anchored text. Unverified finding evidence is a diagnostic. */
+  match: string;
+  analysis?: string;
+  suggestion?: string;
+  fix?: string;
+}
+
+/** A per-rule score produced through shared finding processing. */
+export interface ReviewScore {
+  ruleId: string;
+  score: number;
+  /** Human-readable score, e.g. "8.0/10". */
+  scoreText: string;
+  severity: ReviewSeverity;
+  /** Count of verified findings that contributed to this score, if applicable. */
+  findingCount?: number;
+  components?: ReviewScoreComponent[];
+}
+
+export interface ReviewScoreComponent {
+  id: string;
+  scoreText: string;
+  score: number;
+  weight?: number;
+}
+
+export type ReviewDiagnosticLevel = 'info' | 'warn' | 'error';
+
+/** An operational or finding-processing note. Always part of ReviewResult. */
+export interface ReviewDiagnostic {
+  level: ReviewDiagnosticLevel;
+  /** Stable machine code, e.g. 'finding-evidence-not-locatable'. */
+  code: string;
+  message: string;
+  ruleId?: string;
+  /** Extra machine-readable detail (model-call count, evidence preview, ...). */
+  context?: Record<string, unknown>;
+}
+
+/** Aggregated resource usage for a review run. */
+export interface ReviewUsage {
+  inputTokens?: number;
+  outputTokens?: number;
+  modelCalls: number;
+  costUsd?: number;
+  wallClockMs?: number;
+}
+
+/** The output from any executor, produced through shared finding processing. */
+export interface ReviewResult {
+  findings: ReviewFinding[];
+  scores: ReviewScore[];
+  diagnostics: ReviewDiagnostic[];
+  usage?: ReviewUsage;
+  /** True if the run hit an operational error but still returned partial results. */
+  hadOperationalErrors?: boolean;
+}
+
+/** How to call the reviewer model. 'auto' resolves via chooseModelCall(). */
+export type ReviewModelCall = 'single' | 'agent' | 'auto';
+
+/** The complete input to any executor. */
+export interface ReviewRequest {
+  target: ReviewTarget;
+  rules: ReviewRule[];
+  /** Caller-supplied, in-scope context (never workspace-discovered). */
+  context?: ReviewContext[];
+  budget: ReviewBudget;
+  outputPolicy: ReviewOutputPolicy;
+  /** Reviewer model call shape. 'auto' resolves via chooseModelCall(). */
+  modelCall: ReviewModelCall;
+}
diff --git a/tests/review/boundary.test.ts b/tests/review/boundary.test.ts
new file mode 100644
index 0000000..5ff92da
--- /dev/null
+++ b/tests/review/boundary.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest';
+import { buildScope, isInScope, normalizeReviewUri } from '../../src/review';
+
+describe('review boundary', () => {
+  const scope = buildScope({
+    targetUri: 'file:///repo/docs/guide.md',
+    contextUris: ['file:///repo/docs/glossary.md'],
+  });
+
+  it('target is always in scope', () => {
+    expect(isInScope(scope, 'file:///repo/docs/guide.md')).toBe(true);
+  });
+
+  it('caller-supplied context uri is in scope', () => {
+    expect(isInScope(scope, 'file:///repo/docs/glossary.md')).toBe(true);
+  });
+
+  it('arbitrary workspace file is NOT in scope', () => {
+    expect(isInScope(scope, 'file:///repo/src/index.ts')).toBe(false);
+  });
+
+  it('rejects path traversal that escapes the target', () => {
+    expect(isInScope(scope, 'file:///repo/docs/../src/index.ts')).toBe(false);
+  });
+
+  it('normalizes traversal that resolves back onto an in-scope uri', () => {
+    expect(isInScope(scope, 'file:///repo/docs/sub/../guide.md')).toBe(true);
+  });
+});
+
+describe('normalizeReviewUri', () => {
+  it('resolves dot segments in file uris', () => {
+    expect(normalizeReviewUri('file:///repo/a/../b/./c.md')).toBe('file:///repo/b/c.md');
+  });
+
+  it('preserves authority', () => {
+    expect(normalizeReviewUri('file://host/x/../y.md')).toBe('file://host/y.md');
+  });
+});
diff --git a/tests/review/budget.test.ts b/tests/review/budget.test.ts
new file mode 100644
index 0000000..f1e864f
--- /dev/null
+++ b/tests/review/budget.test.ts
@@ -0,0 +1,62 @@
+import { describe, expect, it } from 'vitest';
+import {
+  BudgetExceededError,
+  DEFAULT_REVIEW_BUDGET,
+  REVIEW_BUDGET_SCHEMA,
+  enforceBudget,
+} from '../../src/review';
+import { VectorlintError } from '../../src/errors';
+
+describe('review budget defaults', () => {
+  it('provides sensible positive defaults', () => {
+    expect(DEFAULT_REVIEW_BUDGET.maxModelCallsPerReview).toBeGreaterThan(0);
+    expect(DEFAULT_REVIEW_BUDGET.maxWallClockMs).toBeGreaterThan(0);
+    expect(DEFAULT_REVIEW_BUDGET.maxTargetBytes).toBeGreaterThan(0);
+  });
+});
+
+describe('REVIEW_BUDGET_SCHEMA', () => {
+  it('applies defaults for omitted fields', () => {
+    const parsed = REVIEW_BUDGET_SCHEMA.parse({ maxModelCallsPerReview: 5 });
+    expect(parsed.maxWallClockMs).toBe(DEFAULT_REVIEW_BUDGET.maxWallClockMs);
+    expect(parsed.maxModelCallsPerReview).toBe(5);
+  });
+
+  it('rejects non-positive limits', () => {
+    expect(() => REVIEW_BUDGET_SCHEMA.parse({ maxModelCallsPerReview: 0 })).toThrow();
+  });
+});
+
+describe('enforceBudget', () => {
+  it('is silent within limits', () => {
+    expect(() =>
+      enforceBudget(DEFAULT_REVIEW_BUDGET, { modelCalls: 1, elapsedMs: 1000 }),
+    ).not.toThrow();
+  });
+
+  it('throws BudgetExceededError when model calls exceed the limit', () => {
+    expect(() =>
+      enforceBudget(
+        { ...DEFAULT_REVIEW_BUDGET, maxModelCallsPerReview: 3 },
+        { modelCalls: 4, elapsedMs: 0 },
+      ),
+    ).toThrow(BudgetExceededError);
+  });
+
+  it('throws BudgetExceededError when wall clock exceeds the limit', () => {
+    expect(() =>
+      enforceBudget(
+        { ...DEFAULT_REVIEW_BUDGET, maxWallClockMs: 100 },
+        { modelCalls: 0, elapsedMs: 101 },
+      ),
+    ).toThrow(BudgetExceededError);
+  });
+
+  it('extends the repository error base', () => {
+    const err = new BudgetExceededError('boom', 'maxModelCallsPerReview', 9);
+    expect(err).toBeInstanceOf(VectorlintError);
+    expect(err.limit).toBe('maxModelCallsPerReview');
+    expect(err.actual).toBe(9);
+    expect(err.code).toBe('BUDGET_EXCEEDED');
+  });
+});
diff --git a/tests/review/executor.test.ts b/tests/review/executor.test.ts
new file mode 100644
index 0000000..c15e670
--- /dev/null
+++ b/tests/review/executor.test.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from 'vitest';
+import {
+  REVIEW_MODEL_CALLS,
+  chooseModelCall,
+  type ReviewExecutor,
+  type ReviewRequest,
+} from '../../src/review';
+
+describe('REVIEW_MODEL_CALLS', () => {
+  it('exposes single | agent | auto', () => {
+    expect(REVIEW_MODEL_CALLS).toEqual(['single', 'agent', 'auto']);
+  });
+});
+
+describe('chooseModelCall', () => {
+  it('respects an explicit single call', () => {
+    expect(chooseModelCall('single', { targetBytes: 2_000_000, rules: 10 })).toBe('single');
+  });
+
+  it('respects an explicit agent call', () => {
+    expect(chooseModelCall('agent', { targetBytes: 10, rules: 1 })).toBe('agent');
+  });
+
+  it('returns single for small inputs under auto', () => {
+    expect(chooseModelCall('auto', { targetBytes: 10_000, rules: 1 })).toBe('single');
+  });
+
+  it('returns agent for large inputs under auto', () => {
+    expect(chooseModelCall('auto', { targetBytes: 2_000_000, rules: 1 })).toBe('agent');
+  });
+
+  it('returns agent for many rules under auto', () => {
+    expect(chooseModelCall('auto', { targetBytes: 1_000, rules: 6 })).toBe('agent');
+  });
+});
+
+describe('ReviewExecutor contract', () => {
+  it('can be implemented and run() returns a ReviewResult', async () => {
+    const fake: ReviewExecutor = {
+      run: () => Promise.resolve({ findings: [], scores: [], diagnostics: [] }),
+    };
+    const result = await fake.run({} as unknown as ReviewRequest);
+    expect(result.findings).toEqual([]);
+    expect(result.diagnostics).toEqual([]);
+  });
+});
diff --git a/tests/review/module-surface.test.ts b/tests/review/module-surface.test.ts
new file mode 100644
index 0000000..6c03ad3
--- /dev/null
+++ b/tests/review/module-surface.test.ts
@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'vitest';
+import * as review from '../../src/review';
+
+describe('src/review public surface', () => {
+  it('exports the core contract values and functions', () => {
+    // Runtime presence checks for values; types are checked by tsc.
+    expect(review.REVIEW_MODEL_CALLS).toBeDefined();
+    expect(review.DEFAULT_REVIEW_BUDGET).toBeDefined();
+    expect(typeof review.chooseModelCall).toBe('function');
+    expect(typeof review.isInScope).toBe('function');
+    expect(typeof review.buildReviewRequest).toBe('function');
+  });
+
+  it('exposes the boundary, budget, and error helpers', () => {
+    expect(typeof review.buildScope).toBe('function');
+    expect(typeof review.enforceBudget).toBe('function');
+    expect(typeof review.normalizeReviewUri).toBe('function');
+    expect(review.BudgetExceededError).toBeDefined();
+  });
+
+  it('exposes the Zod schemas for every external shape', () => {
+    expect(review.REVIEW_TARGET_SCHEMA).toBeDefined();
+    expect(review.REVIEW_RULE_SCHEMA).toBeDefined();
+    expect(review.REVIEW_CONTEXT_SCHEMA).toBeDefined();
+    expect(review.REVIEW_BUDGET_SCHEMA).toBeDefined();
+    expect(review.REVIEW_OUTPUT_POLICY_SCHEMA).toBeDefined();
+    expect(review.REVIEW_FINDING_SCHEMA).toBeDefined();
+    expect(review.REVIEW_SCORE_SCHEMA).toBeDefined();
+    expect(review.REVIEW_DIAGNOSTIC_SCHEMA).toBeDefined();
+    expect(review.REVIEW_USAGE_SCHEMA).toBeDefined();
+    expect(review.REVIEW_RESULT_SCHEMA).toBeDefined();
+    expect(review.REVIEW_REQUEST_SCHEMA).toBeDefined();
+  });
+});
diff --git a/tests/review/request-builder.test.ts b/tests/review/request-builder.test.ts
new file mode 100644
index 0000000..affb83a
--- /dev/null
+++ b/tests/review/request-builder.test.ts
@@ -0,0 +1,87 @@
+import { describe, expect, it } from 'vitest';
+import {
+  DEFAULT_REVIEW_BUDGET,
+  REVIEW_RULE_SCHEMA,
+  buildReviewRequest,
+} from '../../src/review';
+import { ValidationError } from '../../src/errors';
+import { Severity } from '../../src/evaluators/types';
+import type { PromptFile } from '../../src/schemas/prompt-schemas';
+import type { ReviewContext, ReviewTarget } from '../../src/review';
+
+function makePrompt(overrides: Partial<PromptFile> = {}): PromptFile {
+  return {
+    id: 'pseudo-advice',
+    filename: 'pseudo-advice.md',
+    fullPath: '/repo/presets/VectorLint/pseudo-advice.md',
+    meta: {
+      id: 'PseudoAdvice',
+      name: 'Pseudo Advice',
+      severity: Severity.WARNING,
+      type: 'check',
+      criteria: [{ id: 'Vague', name: 'Vague advice' }],
+    },
+    body: 'Check for pseudo advice.',
+    pack: 'VectorLint',
+    ...overrides,
+  };
+}
+
+describe('buildReviewRequest', () => {
+  const target: ReviewTarget = {
+    uri: 'file:///repo/docs/guide.md',
+    content: '# Guide',
+    contentType: 'text/markdown',
+  };
+
+  it('maps one PromptFile to one ReviewRule with default budget and auto modelCall', () => {
+    const request = buildReviewRequest({ target, prompts: [makePrompt()] });
+    expect(request.modelCall).toBe('auto');
+    expect(request.budget).toEqual(DEFAULT_REVIEW_BUDGET);
+    expect(request.rules).toHaveLength(1);
+
+    const rule = request.rules[0];
+    expect(rule).toBeDefined();
+    expect(rule?.id).toBe('VectorLint.PseudoAdvice');
+    expect(rule?.source).toBe('/repo/presets/VectorLint/pseudo-advice.md');
+    expect(rule?.body).toBe('Check for pseudo advice.');
+    expect(rule?.severity).toBe('warning');
+    expect(rule?.name).toBe('Pseudo Advice');
+    expect(() => REVIEW_RULE_SCHEMA.parse(rule)).not.toThrow();
+  });
+
+  it('throws a ValidationError when no prompts are supplied', () => {
+    expect(() => buildReviewRequest({ target, prompts: [] })).toThrow(ValidationError);
+  });
+
+  it('passes caller-supplied context through unchanged', () => {
+    const context: ReviewContext[] = [
+      { label: 'glossary', content: 'term a means ...', relation: 'reference' },
+    ];
+    const request = buildReviewRequest({ target, prompts: [makePrompt()], context });
+    expect(request.context).toBe(context);
+  });
+
+  it('honors an explicit modelCall override', () => {
+    const request = buildReviewRequest({
+      target,
+      prompts: [makePrompt()],
+      config: { modelCall: 'agent' },
+    });
+    expect(request.modelCall).toBe('agent');
+  });
+
+  it('omits severity on the rule when the prompt has none', () => {
+    const request = buildReviewRequest({
+      target,
+      prompts: [
+        makePrompt({
+          meta: { id: 'PseudoAdvice', name: 'Pseudo Advice' },
+        }),
+      ],
+    });
+    const rule = request.rules[0];
+    expect(rule).toBeDefined();
+    expect(rule && 'severity' in rule).toBe(false);
+  });
+});
diff --git a/tests/review/result.test.ts b/tests/review/result.test.ts
new file mode 100644
index 0000000..3be3767
--- /dev/null
+++ b/tests/review/result.test.ts
@@ -0,0 +1,95 @@
+import { describe, expect, it } from 'vitest';
+import {
+  REVIEW_DIAGNOSTIC_SCHEMA,
+  REVIEW_FINDING_SCHEMA,
+  REVIEW_RESULT_SCHEMA,
+} from '../../src/review';
+
+describe('ReviewFinding schema', () => {
+  it('parses a complete finding', () => {
+    const finding = REVIEW_FINDING_SCHEMA.parse({
+      ruleId: 'VectorLint.Consistency',
+      ruleSource: '/repo/presets/VectorLint/consistency.md',
+      severity: 'warning',
+      message: 'Vague advice.',
+      line: 5,
+      column: 1,
+      match: 'consider leveraging',
+      analysis: 'too vague',
+      suggestion: 'be specific',
+      fix: 'consider using concrete terms',
+    });
+    expect(finding.line).toBe(5);
+    expect(finding.match).toBe('consider leveraging');
+    expect(finding.severity).toBe('warning');
+  });
+
+  it('rejects a finding with an unknown severity', () => {
+    expect(() =>
+      REVIEW_FINDING_SCHEMA.parse({
+        ruleId: 'P.R',
+        ruleSource: '/x.md',
+        severity: 'critical',
+        message: 'x',
+        line: 1,
+        column: 1,
+        match: 'x',
+      }),
+    ).toThrow();
+  });
+
+  it('rejects a finding missing required anchored match evidence', () => {
+    expect(() =>
+      REVIEW_FINDING_SCHEMA.parse({
+        ruleId: 'P.R',
+        ruleSource: '/x.md',
+        severity: 'warning',
+        message: 'x',
+        line: 1,
+        column: 1,
+      }),
+    ).toThrow();
+  });
+});
+
+describe('ReviewDiagnostic schema', () => {
+  it('parses a diagnostic with level/code/message', () => {
+    const diag = REVIEW_DIAGNOSTIC_SCHEMA.parse({
+      level: 'warn',
+      code: 'finding-evidence-not-locatable',
+      message: 'could not anchor the finding',
+    });
+    expect(diag.level).toBe('warn');
+  });
+
+  it('rejects an unknown level', () => {
+    expect(() =>
+      REVIEW_DIAGNOSTIC_SCHEMA.parse({ level: 'fatal', code: 'x', message: 'y' }),
+    ).toThrow();
+  });
+});
+
+describe('ReviewResult schema', () => {
+  it('accepts findings/scores/diagnostics and defaults usage to undefined', () => {
+    const result = REVIEW_RESULT_SCHEMA.parse({ findings: [], scores: [], diagnostics: [] });
+    expect(result.findings).toEqual([]);
+    expect(result.diagnostics).toEqual([]);
+    expect(result.usage).toBeUndefined();
+  });
+
+  it('keeps diagnostics mandatory', () => {
+    expect(() =>
+      REVIEW_RESULT_SCHEMA.parse({ findings: [], scores: [] }),
+    ).toThrow();
+  });
+
+  it('accepts usage when provided', () => {
+    const result = REVIEW_RESULT_SCHEMA.parse({
+      findings: [],
+      scores: [],
+      diagnostics: [],
+      usage: { modelCalls: 2, inputTokens: 10, outputTokens: 5 },
+    });
+    expect(result.usage?.modelCalls).toBe(2);
+  });
+});
diff --git a/tests/review/types.test.ts b/tests/review/types.test.ts
new file mode 100644
index 0000000..3479074
--- /dev/null
+++ b/tests/review/types.test.ts
@@ -0,0 +1,73 @@
+import { describe, expect, it } from 'vitest';
+import { REVIEW_CONTEXT_SCHEMA, REVIEW_RULE_SCHEMA, REVIEW_TARGET_SCHEMA } from '../../src/review';
+
+describe('ReviewTarget schema', () => {
+  it('parses a valid target', () => {
+    const target = REVIEW_TARGET_SCHEMA.parse({
+      uri: 'file:///repo/docs/guide.md',
+      content: '# Guide\n\nBody text.',
+      contentType: 'text/markdown',
+    });
+    expect(target.uri).toBe('file:///repo/docs/guide.md');
+  });
+
+  it('allows empty content (streaming target)', () => {
+    expect(() =>
+      REVIEW_TARGET_SCHEMA.parse({ uri: 'file:///x', content: '', contentType: 'text/plain' }),
+    ).not.toThrow();
+  });
+
+  it('rejects a target missing a uri', () => {
+    expect(() =>
+      REVIEW_TARGET_SCHEMA.parse({ content: 'x', contentType: 'text/plain' }),
+    ).toThrow();
+  });
+});
+
+describe('ReviewRule schema', () => {
+  it('parses a rule with required fields and defaults severity to warning', () => {
+    const rule = REVIEW_RULE_SCHEMA.parse({
+      id: 'Consistency',
+      source: 'VectorLint/consistency.md',
+      body: 'Check internal consistency.',
+      violationConditions: [
+        { id: 'Contradiction', description: 'The target makes mutually inconsistent claims.' },
+      ],
+    });
+    expect(rule.severity).toBe('warning');
+    expect(rule.violationConditions?.[0]?.id).toBe('Contradiction');
+  });
+
+  it('rejects unknown fields', () => {
+    expect(() =>
+      REVIEW_RULE_SCHEMA.parse({
+        id: 'Tone',
+        source: 'VectorLint/tone.md',
+        body: 'Judge whether the tone is good.',
+        unexpected: true,
+      }),
+    ).toThrow();
+  });
+
+  it('rejects an unknown severity', () => {
+    expect(() =>
+      REVIEW_RULE_SCHEMA.parse({
+        id: 'Tone',
+        source: 'VectorLint/tone.md',
+        body: 'x',
+        severity: 'critical',
+      }),
+    ).toThrow();
+  });
+});
+
+describe('ReviewContext schema', () => {
+  it('parses caller-supplied scoped content', () => {
+    const ctx = REVIEW_CONTEXT_SCHEMA.parse({
+      label: 'related-glossary',
+      content: 'Term A means ...',
+      relation: 'reference',
+    });
+    expect(ctx.label).toBe('related-glossary');
+  });
+});