Add auto-review and auto-drive budget guardrails

[cbusillo]

Objective

Add budget and stop-condition guardrails for auto-review and auto-drive loops so useful automation cannot churn indefinitely or silently burn rate limits.

Finish Line

Auto-review and auto-drive keep their Every Code value, but long-running or stuck loops have visible budgets, progress checks, and safe stop behavior.

Current Status

State: Active
Next action: Inspect auto-review/auto-drive loop control, token accounting, and subprocess lifecycle behavior.
Blocked by: #44
Last verified: 2026-05-11, parent #43 evidence

Scope

• In: Turn caps, token budgets, progress heuristics, stuck-process detection, subprocess status visibility, and user-facing warnings.
• Out: Disabling auto-review or reducing it to a cheap ineffective reviewer.

Acceptance Criteria

• Auto-review sessions expose current token/turn spend and model role.
• Stuck or non-progressing review loops stop or ask for escalation before large burn.
• Budget thresholds are configurable enough for power users but safe by default.
• The system distinguishes image-history bloat from ordinary review churn.

Relationships

Parent: #43
Blocked by: #44
Related: model-role audit and local LLM sandboxing.

Validation

Reproduce a long-running review scenario and verify budget/stop behavior without losing useful review output.

Decisions

Auto-review is a flagship feature to preserve with guardrails, not remove.

Open Questions

What thresholds should apply by default for Pro/Team/high-budget users?