① Single-context DEFAULT
load whole codebase → analyze (sec / arch / deps) → STEP 3.5 refute → report
Cheapest, loses zero boundaries — the right call whenever the repo fits. Opus 4.8 · 1M context.
② Map-reduce SCALE TIER (Workflow)
Each shard keeps cross-file reasoning within it; the synthesis pass recovers cross-shard edges (taint/auth/dep-direction spanning modules) — sharding's blind spot, recovered on purpose. Then the same blind-refuter pass. Committed template: audit-full/workflows/audit-full-mapreduce.mjs.
The routing rule (STEP 1)
Why not just always fan out?
| Single-context | Map-reduce | |
|---|---|---|
| cross-file reasoning | ✅ whole repo, one window | ⚠️ within shard; cross-shard recovered in synthesis |
| cost | ✅ one pass | ❌ N shard agents + refuters |
| ceiling | ~125K LOC (1M tokens) | ✅ unbounded (shard count scales) |
| refutation | STEP 3.5 inline | same engine, in the workflow's Refute phase |
→ single-context stays the default because fanning out trades away the cross-file edge. Map-reduce is the fallback for scale one context can't hold — exactly what the Workflow tool is for.
Shared engine guarantees (both tiers)
blind refuters · citation-verify · quorum (xhigh) · deterministic CVE/build/test EXEMPT cross-shard finding a refuter can't reproduce → UPHELD · no-auto-flip (refuted CRITICAL flagged, not dropped) spawn ceiling 24 → overflow shipped "manual review required" (never silent truncation)