Repair merged review-doctrine gate regressions

.claude/skills/issue-to-pr/SKILL.md

@@ -83,8 +83,9 @@ EOF
 
 ### 7. Review
 
-Open the PR ready-for-review, then run the global `review-and-ship` skill (global laws 2 and 11).
-Taskdeck-specific lenses: `taskdeck-pr-review-loop`.
+Open the PR ready-for-review, then apply the global `review-and-ship` skill (global laws 2 and 11)
+through merge readiness only. Do not execute its merge action: this skill's output contract is an
+open, unmerged PR for human review. Taskdeck-specific lenses: `taskdeck-pr-review-loop`.
 
 ### 8. Report back
 
@@ -96,4 +97,4 @@ Provide the PR URL and the handoff summary from `taskdeck-verification-doc-sync`
 - do not skip tests
 - if the issue is ambiguous, ask the user before implementing
 - if the issue is too large for one PR, propose a split and implement the first slice
-- always self-review and post findings on the PR before reporting done
+- complete the review-only handoff in step 7 before reporting done

.claude/skills/pre-merge-gate/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pre-merge-gate
-description: "Final validation gate before merging a PR: tests, lint, type-check, build, self-review, CI green check. Use before merging."
+description: "Final validation gate before merging a PR: tests, lint, type-check, build, review evidence, and CI green check. Use before merging."
 user-invocable: true
 ---
 
@@ -15,7 +15,7 @@ Run all validation checks before a PR can be merged. Execute as one atomic opera
 ## Step 1: Identify PR and branch
 
 ```bash
-gh pr view $ARGUMENTS --json number,headRefName,baseRefName,mergeable,statusCheckRollup
+gh pr view $ARGUMENTS --json number,headRefName,baseRefName,headRefOid,baseRefOid,mergeable,statusCheckRollup
 ```
 
 If mergeable is "CONFLICTING", stop and report — do not auto-resolve.
@@ -24,19 +24,25 @@ If mergeable is "CONFLICTING", stop and report — do not auto-resolve.
 
 Read ALL comments on the PR:
 ```bash
-gh api repos/{owner}/{repo}/pulls/{number}/comments
-gh api repos/{owner}/{repo}/issues/{number}/comments
+gh api --paginate repos/{owner}/{repo}/pulls/{number}/comments
+gh api --paginate repos/{owner}/{repo}/pulls/{number}/reviews
+gh api --paginate repos/{owner}/{repo}/issues/{number}/comments
 gh pr view $ARGUMENTS --comments
 ```
 
+Also query the PR's GraphQL `reviewThreads` connection (or the equivalent GitHub MCP review-thread
+read) through its final cursor because REST comment lists do not expose `isResolved` and a partial
+connection is not evidence that all threads are settled.
+
 Check for unaddressed findings from any source:
 - Human review comments not yet resolved
 - Dependabot alerts or suggestions
 - CodeQL / security scanning findings
 - CI bot failure messages
 - Previous adversarial review comments not yet resolved
 
-If actionable comments exist, fix them before proceeding.
+If any comment lacks a recorded disposition from the global `review-and-ship` pipeline, report the
+PR as blocked and stop. This gate does not create a separate finding-disposition or fix loop.
 
 ## Step 3: Run local checks
 
@@ -50,29 +56,39 @@ cd frontend/taskdeck-web && npm run build && npx vitest --run --reporter=verbose
 
 Report any failures immediately — do not proceed to merge.
 
-## Step 4: Self-review
-
-Read the full diff (`gh pr diff $ARGUMENTS`) and check for:
-
-- Secrets accidentally committed (.env, tokens, keys, connection strings)
-- Debug code left in (console.log, Console.WriteLine used for debugging, breakpoints)
-- TODO comments without issue references
-- Hardcoded values that violate conventions
-- Missing tests for behavior changes
-- Clean architecture violations (Domain referencing Infrastructure)
-- Agent safety violations (GP-06: no approve_proposal or direct board mutation)
-- HTTP semantics violations (wrong status codes)
-- Unused `using` statements or dead code
-
-If any issues found, fix them, commit, and push before proceeding.
+## Step 4: Refresh external state and confirm exact-head/base declared-review evidence
+
+Immediately after the local checks, rerun the Step 1 PR query, every Step 2 comment/review/thread
+read through its final cursor, and `gh pr checks`. This is the final external-state snapshot used by
+the verdict. Compare its `headRefOid` and `baseRefOid` with the initial values. If either OID changed,
+if mergeability changed, if a cursor is incomplete, or if the PR changes while the snapshot is being
+read, fail closed and return the PR to the canonical pipeline; never combine old review evidence with
+new local-check evidence.
+
+Read the repository's current authority and the canonical pipeline result instead of copying its
+tier row here. When that declared gate requires independent review, use the refreshed `headRefOid`,
+`baseRefOid`, reviews, review summaries, comments, threads, and checks from this final snapshot.
+Require an **arrived independent review of that exact head and base** which posts either findings or
+an explicit no-finding result. The evidence artifact must record both reviewed OIDs (or a stable
+diff identity derived from both), and the gate must compare them with the current values. GitHub's
+review `commit_id` binds only the head; it is not proof of the reviewed base. A review request,
+acknowledgement/reaction, evidence authored by the PR author, implementation worker, or coordinator,
+or a coordinator metadata scan does not satisfy an independent-review requirement. A distinct,
+declared read-only reviewer artifact does satisfy the authorship boundary when it records both exact
+OIDs, whether that fresh-context reviewer ran inline or as a reviewer worker. Evidence from an older
+head or an older base is stale.
+
+Confirm that every finding from that review has a recorded disposition and that all review threads
+are settled. If exact-head independent-review evidence is missing or unsettled, report the PR as
+blocked and return it to the global `review-and-ship` pipeline. This gate confirms the completed
+review; it does not perform another review lens or start a separate review/fix cycle.
 
 ## Step 5: CI status
 
-```bash
-gh pr checks $ARGUMENTS
-```
-
-All checks must be green. If any are failing, diagnose and fix.
+Use the `gh pr checks` result from Step 4's refreshed snapshot. All checks must be terminal and green.
+If any are pending or red, report the PR as not ready. Route
+red-check diagnosis and any canonical-pipeline-selected fix batch through
+`taskdeck-ci-conflict-recovery`; this gate does not choose or execute fixes.
 
 ## Step 6: Report
 
@@ -86,7 +102,7 @@ Output a merge-readiness summary:
 - [ ] Frontend build: PASS/FAIL
 - [ ] Frontend tests: PASS/FAIL
 - [ ] CI checks: GREEN/RED
-- [ ] Self-review: CLEAN/ISSUES FIXED
+- [ ] Declared exact-head/base review evidence: SATISFIED/MISSING (head SHA, base SHA, and evidence URL)
 - [ ] Bot comments: ADDRESSED/NONE
 - [ ] Secrets scan: CLEAN
 
@@ -96,6 +112,7 @@ Output a merge-readiness summary:
 ## Rules
 
 - Do NOT merge the PR — only validate and report readiness
-- If CI is red, attempt to fix — only report "blocked" if the fix is non-trivial
+- If CI is red or review evidence is missing, report not ready and return the PR to the owning
+  canonical pipeline/recovery lane; do not introduce a local fix threshold
 - Finding severity, comment triage, and how many review rounds are owed: the global
   `review-and-ship` skill and global laws 2 and 11. This skill only runs the local checks.

.claude/skills/taskdeck-issue-batch-orchestrator/SKILL.md

@@ -52,12 +52,15 @@ For isolated workers:
 3. Require the first command from `docs/WORKTREE_AGENT_PROTOCOL.md` or `powershell -File scripts/worktree_guard.ps1`.
 4. Assign explicit file/module ownership.
 5. Tell workers they are not alone in the codebase and must not revert others' edits.
-6. Require targeted tests and self-review before handoff.
+6. Require targeted tests and handoff to the global `review-and-ship` pipeline.
 7. Require every file-editing worker prompt to restate the structured patch discipline above.
 
 ## Review And CI
 
-Review rounds, severity bar, and comment triage: the global `review-and-ship` skill (laws 2 and 11). Flag these surfaces so the coordinator can decide whether an extra independent lens is warranted:
+Review rounds, tier gate, severity bar, and comment triage: the global `review-and-ship` skill
+(laws 2 and 11). Satisfy the repository's current declared tier before merge; only lenses beyond
+that canonical gate are discretionary. Flag these surfaces when deciding whether an additional
+lens is warranted:
 
 - auth, sessions, tokens, security, secrets, redaction
 - migrations, persistence, deletion, import/export

.claude/skills/taskdeck-pr-review-loop/SKILL.md

@@ -32,6 +32,18 @@ the entry point. Read only the relevant section of `docs/STATUS.md` (source of t
 - docs drift in `docs/STATUS.md` / `docs/IMPLEMENTATION_MASTERPLAN.md`
 - CI, scripts, or project-automation breakage
 
+## Sensitive-Surface Flag
+
+Flag these surfaces so the coordinator can decide whether an additional independent lens beyond
+the tier-required pass is warranted:
+
+- security/auth/session/token behavior
+- migrations or data deletion/retention
+- MCP or external-agent write surfaces
+- capture/review/proposal execution
+- GitHub workflows/project automation
+- broad frontend route or state flow
+
 ## Targeted Verification
 
 - Backend: `dotnet test backend/Taskdeck.sln -c Release --filter "FullyQualifiedName~RelevantTest"`

.claude/skills/taskdeck-worktree-issue-worker/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: taskdeck-worktree-issue-worker
-description: Implement one Taskdeck issue in an isolated Claude or git worktree with narrow ownership, tests, PR creation, and self-review.
+description: Implement one Taskdeck issue in an isolated Claude or git worktree with narrow ownership, tests, PR creation, and review handoff.
 ---
 
 # Taskdeck Worktree Issue Worker
@@ -36,7 +36,8 @@ Own only the files/modules assigned by the coordinator. You are not alone in the
 5. Run targeted checks first.
 6. Update docs only if current reality, roadmap, testing expectations, or operator workflow changed.
 7. Open a PR with summary, linked issue, tests, docs impact, and risks.
-8. Perform a self-review and fix findings before handoff.
+8. Hand the ready-for-review PR to the global `review-and-ship` pipeline; use
+   `taskdeck-pr-review-loop` only for Taskdeck-specific lenses.
 
 ## Stop Conditions
 

.codex/config.toml

@@ -16,7 +16,7 @@ max_depth = 2
 job_max_runtime_seconds = 8000
 
 [agents.issue_worker]
-description = "Implement one Taskdeck issue in an isolated worktree. Use taskdeck-worktree-issue-worker, keep ownership narrow, commit small, test, open a PR, and self-review."
+description = "Implement one Taskdeck issue in an isolated worktree. Use taskdeck-worktree-issue-worker, keep ownership narrow, commit small, test, open a PR, and hand it to the canonical review pipeline."
 nickname_candidates = ["IssueWorker", "WorktreeWorker", "PatchWorker"]
 
 [agents.pr_reviewer]

.codex/skills/taskdeck-issue-batch-orchestrator/SKILL.md

@@ -86,34 +86,34 @@ Use `taskdeck-worktree-issue-worker` for implementation workers.
 
 ## Review loop
 
-Every PR needs:
-
-1. Worker self-review after opening the PR.
-2. Coordinator review of PR body, linked issue, test evidence, and docs impact.
-3. Flag these surfaces so the coordinator can decide whether an extra independent lens is warranted (round count and severity bar: the global `review-and-ship` skill):
-   - auth/authz/security
-   - migrations/persistence
-   - capture/review/proposal execution
-   - CI/workflows/project automation
-   - broad frontend flow changes
-   - flaky or failing tests
-4. Posted review findings or explicit no-finding comment.
-5. Fix commits for findings.
-6. Re-review after fixes.
-
-Use `taskdeck-pr-review-loop` for review workers.
+Every PR follows the global `review-and-ship` pipeline and must satisfy the repository's current
+declared tier before merge; only lenses beyond that canonical gate are discretionary.
+
+The coordinator also reviews the PR body, linked issue, test evidence, and docs impact. Flag these
+surfaces when deciding whether an additional independent lens is warranted:
+
+- auth/authz/security
+- migrations/persistence
+- capture/review/proposal execution
+- CI/workflows/project automation
+- broad frontend flow changes
+- flaky or failing tests
+
+Use `taskdeck-pr-review-loop` for Taskdeck-specific lenses. Finding disposition, verification after
+changes, and convergence remain owned by the global pipeline.
 
 ## CI and comments
 
-After PR creation and after every fix push:
+Within the global `review-and-ship` pipeline:
+
+- inspect exact-head CI status plus review and bot comments
+- classify every red check by lane and investigate its cause
+- for a fix batch selected by the canonical pipeline, address root causes rather than symptoms
+- rerun the checks affected by that selected batch when practical
+- push only the signed commits that belong to that batch
+- post the finding-to-fix mapping and verification evidence
 
-- inspect CI status
-- inspect review comments and bot comments
-- classify failures by lane
-- address root causes, not symptoms
-- rerun only the affected checks locally when practical
-- push fix commits
-- comment with what changed and what was re-run
+These are Taskdeck execution mechanics, not another finding-disposition or review/fix cycle.
 
 Use `taskdeck-ci-conflict-recovery` for failing CI, comments, or conflicts.
 

.codex/skills/taskdeck-pr-review-loop/SKILL.md

@@ -32,12 +32,12 @@ Do not spend review energy on unrelated style unless it creates risk.
 
 ## Sensitive-surface flag
 
-Flag these surfaces in the review so the coordinator can decide whether the change warrants the
-extra independent lens its tier allows:
+Flag these surfaces so the coordinator can decide whether an additional independent lens beyond
+the tier-required pass is warranted:
 
 - security/auth/session/token behavior
 - migrations or data deletion/retention
-- MCP or external agent write surfaces
+- MCP or external-agent write surfaces
 - capture/review/proposal execution
 - GitHub workflows/project automation
 - broad frontend route or state flow

.codex/skills/taskdeck-pr-review-loop/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "Taskdeck PR Review Loop"
   short_description: "Review PRs and address feedback"
-  default_prompt: "Use $taskdeck-pr-review-loop to perform adversarial review, post findings, address comments, and re-review Taskdeck PRs."
+  default_prompt: "Use $taskdeck-pr-review-loop for Taskdeck-specific review lenses while the global review-and-ship skill owns the review pipeline."

.codex/skills/taskdeck-worktree-issue-worker/SKILL.md

@@ -81,7 +81,8 @@ PR body must include:
 - risks/follow-ups
 - `Closes #<issue>`
 
-After opening the PR, run a deliberate self-review using `taskdeck-pr-review-loop`. Fix findings before handing back to the coordinator.
+After opening the PR, hand the ready-for-review branch to the global `review-and-ship` pipeline.
+Use `taskdeck-pr-review-loop` only for Taskdeck-specific lenses.
 
 ## Handoff
 
@@ -92,5 +93,5 @@ Report:
 - tests added
 - commands run and results
 - docs changed
-- review findings fixed or explicit no-finding result
+- review-pipeline evidence and disposition
 - any deferred follow-up issue numbers or blocked seeding notes

docs/IMPLEMENTATION_MASTERPLAN.md

@@ -15,6 +15,10 @@ Companion Active Docs:
 - **`#1513` local review-fix implementation:** the registered OpenAI, Gemini, Ollama, and outbound-webhook handlers set `UseProxy = false`, keeping the configured origin as the connect-time validation target. Just before send, protected registrations mask the URI seen by outer .NET HTTP diagnostics; the inner handler restores the real URI for transport and re-masks it for retry/completion. Public caller-owned provider clients keep normal `HttpClient` behavior. The four protected clients remove default request loggers, disable distributed-trace header propagation, and use a private HTTP metric scope; Taskdeck's configured OpenTelemetry provider drops their marked activities and scope. Enabled Sentry removes its outbound factory handler only from these four client pipelines, so unrelated clients retain instrumentation and server-side exception tracking remains active. The proven boundary includes pre-handler `System.Net.Http` EventSource path/query suppression, but excludes independently installed process-global activity/meter listeners and transport-stage host/IP observers. Existing localhost opt-ins and automatic-redirect blocking remain unchanged. No proxy-aware outbound mode exists; corporate proxy-only deployments fail closed.
 - **Current evidence boundary:** the exact documented filters pass 66/66 API and 158/158 Application tests (151 provider/policy compatibility plus seven constructor/remasking controls); registered EventSource and scoped-Sentry controls pass three fresh-process repetitions. At pre-documentation head `dad8d22a`, the full serialized backend passed 7,539 tests with five intentional skips and no failures, including Architecture 20/20 with one intentional skip and Integration 35/35. The independent security review was clean; the correctness review found only the now-corrected seven-test evidence omission. The merged Dockerless Testcontainers repair is absorbed, and the only later issue-scope change is this verification-document correction; the current-main merge touched only the independently reviewed `#1522` frontend/docs slice. Signed publication, exact hosted Required CI, CodeQL, and merge remain outstanding, so this is not yet a shipped delivery entry.
 
+## Delivery update (2026-07-27, agentic review-doctrine consolidation)
+
+- **Single review-workflow home (`#1531` merged; remediation `#1532` / PR `#1534`):** Taskdeck's local instructions, skills, overnight manuals, and PR-create hook are reduced to routing, Taskdeck-specific lenses, and repository mechanics while the estate-wide `review-and-ship` skill owns the executable pipeline. PR `#1531` landed before two HIGH and six MEDIUM exact-head review findings were repaired; the bounded remediation restores the issue-to-PR external-state contract, the mandatory T3 independent pass, policy-neutral Fable/pre-merge/worker/hook routing, runtime-mirror risk-lens parity, and current documentation. This supersedes the review/aging portion of `#1269` without rewriting historical delivery records. The live `.codex` mirror is retained until its separately tracked retirement under `#1291`.
+
 ## Delivery update (2026-07-27, test substrate, Windows API diagnostics, and realtime reconciliation)
 
 - **Dockerless Testcontainers gate (`#1518`):** the PostgreSQL collection fixture now evaluates `DockerAvailableCheck` before `PostgreSqlBuilder.Build`, restoring the documented graceful-skip behavior on hosts without Docker. Public-constructor and injected-factory regressions prove the unavailable path cannot construct a container, while a timed-out Docker CLI probe is killed as a process tree and boundedly reaped. The local exact tree finishes with 7 passed / 28 skipped / 0 failed and no surviving `docker info`; at reviewed head `6650370b`, the full serialized backend passed 7,465 tests with 33 intentional skips and hosted Container Integration proved the positive lifecycle with 35 passed / 0 skipped / 0 failed. Four DCO-signed-off commits merged as `ff1ee066`; exact-main Required CI `30257236213` and CodeQL `30257235538` are green.

docs/ISSUE_EXECUTION_GUIDE.md

@@ -469,7 +469,9 @@ Execution note:
 4. Run required verification commands.
 5. Update docs (`STATUS`/`IMPLEMENTATION_MASTERPLAN`/test docs) if reality changed.
 6. Open PR with linked issue and risk notes.
-7. Perform a deliberate reviewer-style self-review of the PR diff after opening it; capture findings, fixes, or explicit no-finding conclusion before handoff.
+7. Hand the ready PR to the global `review-and-ship` pipeline. Use `taskdeck-pr-review-loop` only
+   for Taskdeck-specific lenses and thread settlement; record exact-head/base pipeline evidence
+   and satisfy the declared-tier review gate before any merge handoff.
 8. Move project item to `Review`.
 9. After merge, move item to `Done` and post final verification summary.