@agilno-tech/rivet 0.1.0-alpha.1 → 0.1.0-alpha.2

package/schemas/quality.schema.json

@@ -4,46 +4,314 @@
   "title": "Agilno tracked quality policy",
   "type": "object",
   "additionalProperties": false,
-  "required": ["schemaVersion", "providerRefs", "completionProfileRefs", "commandGates", "expectations", "evidence"],
+  "required": [
+    "schemaVersion",
+    "providerRefs",
+    "completionProfileRefs",
+    "commandGates",
+    "expectations",
+    "evidence"
+  ],
   "properties": {
-    "schemaVersion": { "type": "integer", "const": 1 },
-    "providerRefs": { "type": "array", "minItems": 1, "maxItems": 64, "uniqueItems": true, "items": { "$ref": "#/$defs/id" } },
-    "completionProfileRefs": { "type": "array", "minItems": 1, "maxItems": 32, "uniqueItems": true, "items": { "$ref": "#/$defs/id" } },
-    "commandGates": { "type": "array", "minItems": 1, "maxItems": 32, "items": { "$ref": "#/$defs/commandGate" } },
+    "contentScan": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "secrets": {
+          "type": "boolean"
+        },
+        "unicode": {
+          "enum": [
+            "warn",
+            "required",
+            "off"
+          ]
+        },
+        "maxFiles": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 1000
+        },
+        "maxBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 2097152
+        },
+        "allowlist": {
+          "type": "array",
+          "maxItems": 100,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "ruleId",
+              "path",
+              "reason"
+            ],
+            "properties": {
+              "ruleId": {
+                "enum": [
+                  "private-key",
+                  "github-token",
+                  "npm-token",
+                  "aws-access-key",
+                  "unicode-bidi",
+                  "unicode-mixed-identifier",
+                  "type-suppression"
+                ]
+              },
+              "path": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 1024,
+                "pattern": "^(?!/)(?![A-Za-z]:)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*//)(?!.*[/]$)[^\\\\*?\\[\\]{}\\u0000-\\u001f\\u007f]+$"
+              },
+              "reason": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 500,
+                "pattern": "\\S"
+              }
+            }
+          }
+        },
+        "shortcutRules": {
+          "type": "array",
+          "maxItems": 100,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "ruleId",
+              "paths",
+              "reason"
+            ],
+            "properties": {
+              "ruleId": {
+                "const": "type-suppression"
+              },
+              "paths": {
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 100,
+                "uniqueItems": true,
+                "items": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 1024,
+                  "pattern": "^(?!/)(?![A-Za-z]:)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*//)(?!.*[/]$)[^\\\\*?\\[\\]{}\\u0000-\\u001f\\u007f]+$"
+                }
+              },
+              "reason": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 500,
+                "pattern": "\\S"
+              },
+              "required": {
+                "type": "boolean"
+              }
+            }
+          }
+        }
+      }
+    },
+    "schemaVersion": {
+      "type": "integer",
+      "const": 1
+    },
+    "providerRefs": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 64,
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/$defs/id"
+      }
+    },
+    "completionProfileRefs": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 32,
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/$defs/id"
+      }
+    },
+    "commandGates": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 32,
+      "items": {
+        "$ref": "#/$defs/commandGate"
+      }
+    },
     "expectations": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["storybook", "playwright", "accessibility", "security", "visual"],
+      "required": [
+        "storybook",
+        "playwright",
+        "accessibility",
+        "security",
+        "visual"
+      ],
       "properties": {
-        "storybook": { "enum": ["optional", "required"] },
-        "playwright": { "enum": ["optional", "required"] },
-        "accessibility": { "enum": ["none", "wcag-a", "wcag-aa"] },
-        "security": { "enum": ["required", "not-applicable-with-approval"] },
-        "visual": { "enum": ["none", "automated", "human-baseline"] }
+        "storybook": {
+          "enum": [
+            "optional",
+            "required"
+          ]
+        },
+        "playwright": {
+          "enum": [
+            "optional",
+            "required"
+          ]
+        },
+        "accessibility": {
+          "enum": [
+            "none",
+            "wcag-a",
+            "wcag-aa"
+          ]
+        },
+        "security": {
+          "enum": [
+            "required",
+            "not-applicable-with-approval"
+          ]
+        },
+        "visual": {
+          "enum": [
+            "none",
+            "automated",
+            "human-baseline"
+          ]
+        }
       }
     },
     "evidence": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["requiredTypes", "requireHumanBaseline", "requireHumanFinal"],
+      "required": [
+        "requiredTypes",
+        "requireHumanBaseline",
+        "requireHumanFinal"
+      ],
       "properties": {
-        "requiredTypes": { "type": "array", "minItems": 1, "maxItems": 8, "uniqueItems": true, "items": { "$ref": "#/$defs/evidenceType" } },
-        "requireHumanBaseline": { "type": "boolean" },
-        "requireHumanFinal": { "type": "boolean", "const": true }
+        "requiredTypes": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 8,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/evidenceType"
+          }
+        },
+        "requireHumanBaseline": {
+          "type": "boolean"
+        },
+        "requireHumanFinal": {
+          "type": "boolean",
+          "const": true
+        }
+      }
+    },
+    "review": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "required": {
+          "type": "boolean"
+        },
+        "maxRounds": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 10
+        },
+        "strictCoverage": {
+          "type": "boolean"
+        },
+        "reviewers": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "id",
+              "paths",
+              "required"
+            ],
+            "properties": {
+              "id": {
+                "$ref": "#/$defs/id"
+              },
+              "paths": {
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 128,
+                "uniqueItems": true,
+                "items": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 512
+                }
+              },
+              "required": {
+                "type": "boolean"
+              }
+            }
+          }
+        }
       }
     }
   },
   "$defs": {
-    "id": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$" },
-    "evidenceType": { "enum": ["commit", "test", "journey", "screenshot", "report", "review", "human-approval", "external-update"] },
+    "id": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$"
+    },
+    "evidenceType": {
+      "enum": [
+        "commit",
+        "test",
+        "journey",
+        "screenshot",
+        "report",
+        "review",
+        "human-approval",
+        "external-update"
+      ]
+    },
     "commandGate": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["id", "command", "required"],
+      "required": [
+        "id",
+        "command",
+        "required"
+      ],
       "properties": {
-        "id": { "$ref": "#/$defs/id" },
-        "command": { "enum": ["build", "test", "lint", "typecheck", "dev", "check"] },
-        "required": { "type": "boolean" }
+        "id": {
+          "$ref": "#/$defs/id"
+        },
+        "command": {
+          "enum": [
+            "build",
+            "test",
+            "lint",
+            "typecheck",
+            "dev",
+            "check"
+          ]
+        },
+        "required": {
+          "type": "boolean"
+        }
       }
     }
   }

package/src/cli/main.js

@@ -115,6 +115,10 @@ Usage:
   rivet task start [--project=<path>] [--run=<id>]
   rivet task approve [--project=<path>] [--run=<id>]
   rivet task resume [--project=<path>] [--run=<id>]
+  rivet task decisions [--project=<path>] [--run=<id>]
+  rivet task decide --input=<decision.json> [--project=<path>] [--run=<id>]
+  rivet task approve-decision --decision=<id> [--project=<path>] [--run=<id>]
+  rivet task review [--phase=plan|final] [--input=<report.json>] [--project=<path>] [--run=<id>]
   rivet task deps [--project=<path>] [--run=<id>]
   rivet protocols add <slug> [--from=<path>] [--project=<path>] [--json]
   rivet protocols import <slug> --from=<path> [--project=<path>] [--json]

package/src/cli/parse-args.js

@@ -61,7 +61,7 @@ const STRICT_OPTIONS = {
   },
   task: {
     boolean: new Set(['details']),
-    valued: new Set(['project', 'run']),
+    valued: new Set(['project', 'run', 'input', 'input-json', 'phase', 'decision']),
   },
   setup: {
     boolean: new Set(['global', 'write', 'json']),
@@ -233,7 +233,7 @@ export function parseArgs(argv) {
   if (command === 'work' && !['propose', 'prepare', 'next', 'status', 'submit', 'verify', 'recover'].includes(positionals[0])) {
     throw new ArgumentError('Unsupported work subcommand');
   }
-  if (command === 'task' && !['status', 'start', 'approve', 'resume', 'deps', 'recover'].includes(positionals[0])) {
+  if (command === 'task' && !['status', 'start', 'approve', 'resume', 'deps', 'recover', 'decisions', 'decide', 'approve-decision', 'review'].includes(positionals[0])) {
     throw new ArgumentError('Unsupported task subcommand');
   }
 

package/src/commands/human-task.js

@@ -1,3 +1,4 @@
+import { taskGovernanceCommand } from './task-governance.js';
 import { taskState } from '../cli/task-presentation.js';
 import { finishTask } from './task-completion.js';
 import { resolveConfiguredProject } from '../cli/project-discovery.js';
@@ -172,13 +173,15 @@ function renderWorkerCheckouts(status, output) {
 
 
 export async function humanTaskCommand(parsed, dependencies) {
-  if (parsed.command !== 'task' || !['status', 'start', 'approve', 'resume', 'deps', 'recover'].includes(parsed.subcommand)
-    || parsed.operands.length !== 0 || Object.keys(parsed.flags).some(key => !['project', 'run', 'details'].includes(key))) {
+  if (parsed.command !== 'task' || !['status', 'start', 'approve', 'resume', 'deps', 'recover', 'decisions', 'decide', 'approve-decision', 'review'].includes(parsed.subcommand)
+    || parsed.operands.length !== 0 || Object.keys(parsed.flags).some(key => !['project', 'run', 'details', 'input', 'input-json', 'phase', 'decision'].includes(key))) {
     fail('Use rivet task status|start|approve|resume|deps|recover [--project=<path>] [--run=<id>].');
   }
   const project = await resolveConfiguredProject(dependencies.cwd(), parsed.flags.project, { env: dependencies.env });
   const record = await selectedRun(project.root, parsed.flags.run, parsed.subcommand, dependencies);
   if (!record) {dependencies.output.log('Task selection cancelled. No task action was taken.');return EXIT_CODES.SUCCESS;}
+  if (['decisions','decide','approve-decision','review'].includes(parsed.subcommand)) return taskGovernanceCommand(parsed,dependencies,project,record);
+  if (['input','input-json','phase','decision'].some(key=>parsed.flags[key]!==undefined)) fail('Evidence options require a decision or review command.');
   if (parsed.subcommand === 'approve') return finishTask(project, record, dependencies);
   if (parsed.subcommand === 'recover') {
     if (record.featurePlan.client !== 'host' && !['awaiting-final-approval','completed'].includes(record.status)) fail('Lock recovery is only available for host tasks or terminal tasks at final review; it never restarts a worker.', 'REPOSITORY_CONFLICT');
@@ -203,6 +206,11 @@ export async function humanTaskCommand(parsed, dependencies) {
       dependencies.output.log(`Worker harnesses: ${[...new Set(record.featurePlan.nodes.filter(node => node.role === 'worker').map(node => node.execution?.client ?? record.featurePlan.client))].join(', ')}`);
     } else dependencies.output.log(`Harness: ${record.featurePlan.client}`);
     dependencies.output.log(`Next: ${record.status === 'completed' ? 'Task completed. Inspect its recorded evidence and any separate delivery status.' : record.status === 'proposed' && record.featurePlan.client !== 'host' ? `rivet task start --run=${record.runId}` : record.status === 'awaiting-final-approval' && status.deliveryReady ? `rivet task approve --run=${record.runId}` : visible(status.nextAction)}`);
+    if (status.governance?.decisions.length) {
+      dependencies.output.log(`Decisions: ${status.governance.decisions.length}; use rivet task decisions to read the journal.`);
+    }
+    for (const blocker of status.governance?.blockers ?? []) dependencies.output.log(`Review: ${visible(blocker.code)}${blocker.reviewerId ? ` (${visible(blocker.reviewerId)})` : ''}`);
+    if (status.governance?.review.humanEscalation) dependencies.output.log('Review round limit reached. Ask a human to assess the findings and prepare a corrective task.');
     if (status.verification) {
       dependencies.output.log(`Verification: ${status.verification.status} at ${status.verification.commitSha}`);
       for (const path of status.verification.changedPaths) dependencies.output.log(`Changed: ${visible(path)}`);

package/src/commands/task-governance.js

@@ -0,0 +1,53 @@
+import {withTerminalInterruption} from '../cli/interrupt.js';
+import {resolve} from 'node:path';
+import {createGitClient} from '../git/client.js';
+import {taskGovernance} from '../feature/governance.js';
+import {CliError,EXIT_CODES,observeOutputErrors} from '../cli/output.js';
+import {readJson} from './work.js';
+
+export async function taskGovernanceCommand(parsed,dependencies,project,run){
+  const {subcommand:operation,flags}=parsed;
+  const extra={decisions:[],decide:['input','input-json'],'approve-decision':['decision'],review:['input','input-json','phase']}[operation];
+  if(Object.keys(flags).some(key=>!['project','run',...extra].includes(key)))throw new CliError('Unexpected option for this task evidence command.','INVALID_INPUT');
+  if(operation==='decide'&&!flags.input&&!flags['input-json'])throw new CliError('Use rivet task decide --input=<decision.json>.','INVALID_INPUT');
+  if(operation==='approve-decision'&&!flags.decision)throw new CliError('Use rivet task approve-decision --decision=<id>.','INVALID_INPUT');
+  if(flags.phase!==undefined&&!['plan','final'].includes(flags.phase))throw new CliError('Review phase must be plan or final.','INVALID_INPUT');
+  if(flags.input!==undefined&&flags['input-json']!==undefined)throw new CliError('Choose one of --input or --input-json.','INVALID_INPUT');
+  let input;
+  if(flags['input-json']!==undefined){
+    const source=flags['input-json'];
+    if(typeof source!=='string'||!source.length||Buffer.byteLength(source)>64*1024)throw new CliError('Inline task evidence must be bounded JSON (up to 64 KiB).','INVALID_INPUT');
+    try{input=JSON.parse(source);}catch{throw new CliError('Task evidence is not valid JSON.','INVALID_INPUT');}
+  }
+  if(flags.input!==undefined)input=readJson(project.root,resolve(project.root,flags.input),dependencies.fs,'Task evidence');
+  let confirm,activeSignal;
+  if(operation==='approve-decision'){
+    if(dependencies.terminalIsInteractive?.()!==true)throw new CliError('Decision approval requires an interactive human terminal.','BLOCKED_AUTHORITY');
+    confirm=async record=>{
+      let failed=false;
+      const unobserve=observeOutputErrors(dependencies.output,()=>{failed=true;});
+      try{
+        activeSignal.throwIfAborted();
+        dependencies.output.log(JSON.stringify(record,null,2));
+        if(failed)throw new CliError('Could not display the decision. It remains pending.','REPOSITORY_CONFLICT');
+        const answer=await dependencies.taskApprovalPrompt({type:'select',signal:activeSignal,message:'Approve this exact decision? Existing execution and delivery permissions still apply.',choices:[{value:'approve',label:'Approve this decision'},{value:'leave',label:'Leave pending'}]});
+        activeSignal.throwIfAborted();
+        if(failed)throw new CliError('Decision output failed. It remains pending.','REPOSITORY_CONFLICT');
+        return answer==='approve';
+      }finally{unobserve?.();}
+    };
+  }
+  try{
+    const gitClient=await createGitClient({gitExecutable:await dependencies.resolveCommandExecutable('git')});
+    const result=await withTerminalInterruption(async signal=>{
+      activeSignal=signal;
+      return taskGovernance({project:project.root,runId:run.runId,gitClient,
+      operation:operation==='review'&&input!==undefined?'review-submit':operation,input,phase:flags.phase,decisionId:flags.decision,confirm,signal});
+    });
+    dependencies.output.log(operation==='decisions'?result.markdown:JSON.stringify(result,null,2));
+    return EXIT_CODES.SUCCESS;
+  }catch(error){
+    if(error instanceof CliError)throw error;
+    throw new CliError(error.safeMessage??'Task decision or review operation failed. Inspect task status and the input report.','FAILED_GATE');
+  }
+}

package/src/commands/work.js

@@ -40,7 +40,7 @@ function sameFile(left, right) {
   return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.nlink === right.nlink;
 }
 
-function readJson(project, path, fs, label) {
+export function readJson(project, path, fs, label) {
   const target = absolute(path, `${label} path`);
   const contained = relative(project, target);
   if (!contained || contained === '..' || contained.startsWith(`..${sep}`) || isAbsolute(contained)) {

package/src/config/load.js

@@ -32,7 +32,7 @@ const DEFAULT_FILE_SYSTEM = Object.freeze({
   statSync,
 });
 
-function parseYaml(source, filename) {
+export function parseYaml(source, filename) {
   let documents;
   try {
     documents = parseAllDocuments(source, {

package/src/config/validate.js

@@ -79,7 +79,8 @@ function scanForSecrets(value, path = '') {
   if (!value || typeof value !== 'object') return;
   for (const [key, child] of Object.entries(value)) {
     const childPath = `${path}/${key}`;
-    if (SECRET_KEY.test(key) && !SAFE_SECRET_KEYS.has(key)) fail(childPath, 'secret-key');
+    if (SECRET_KEY.test(key) && !SAFE_SECRET_KEYS.has(key)
+      && !(childPath === '/quality/contentScan/secrets' && typeof child === 'boolean')) fail(childPath, 'secret-key');
     if (typeof child === 'string' && SECRET_VALUE.test(child)) fail(childPath, 'secret-value');
     if (typeof child === 'string' && /^https?:\/\//i.test(child)) assertSafeUrl(child, childPath);
     scanForSecrets(child, childPath);

package/src/delivery/contract.js

@@ -119,7 +119,7 @@ export function candidate(input) {
   exact(
     value,
     ['runId', 'repository', 'sourceBranch', 'targetBranch', 'localVerification'],
-    ['reviewNumber']
+    ['reviewNumber', 'decisionSummary']
   );
   id(value.runId);
   ref(value.sourceBranch);
@@ -132,11 +132,22 @@ export function candidate(input) {
     'evidenceDigest',
     'verifiedAt',
     'status',
-  ]);
+  ], ['governanceDigest', 'decisionSummaryDigest']);
   ensure(proof.runId === value.runId && proof.status === 'passed');
   sha(proof.headSha);
   digest(proof.evidenceDigest);
   timestamp(proof.verifiedAt);
+  if (proof.governanceDigest !== undefined) digest(proof.governanceDigest);
+  ensure((value.decisionSummary === undefined) === (proof.decisionSummaryDigest === undefined));
+  if (value.decisionSummary !== undefined) {
+    const summary = value.decisionSummary;
+    ensure(typeof summary === 'string' && summary.startsWith('## Decisions\n\n')
+      && Buffer.byteLength(summary) <= 32000 && summary.length > 16
+      && !/[\u0000-\u0009\u000b-\u001f\u007f<>[\]`@]/.test(summary), 'invalid-decision-summary');
+    digest(proof.decisionSummaryDigest);
+    ensure(proof.governanceDigest !== undefined && hash(summary) === proof.decisionSummaryDigest, 'decision-summary-mismatch');
+  }
+
   ensure(
     value.reviewNumber === undefined || (Number.isSafeInteger(value.reviewNumber) && value.reviewNumber > 0)
   );

package/src/delivery/prepare.js

@@ -5,6 +5,9 @@ import { resolveExistingFeatureRunPaths } from '../state/paths.js';
 import { loadProjectConfig } from '../config/load.js';
 import { discoverRepositoryRemotes, selectConfiguredRepositoryRemote } from '../repositories/index.js';
 import { immutableJson } from '../clients/contract.js';
+import { inspectGovernance } from '../feature/governance.js';
+import { renderDecisions } from '../feature/decisions.js';
+import { hash } from './contract.js';
 
 export class DeliveryPreparationError extends Error {
   constructor(message = 'Delivery requires a verified run and unchanged integration checkout. Inspect work status and verification results.') {
@@ -18,6 +21,30 @@ function fail() {
   throw new DeliveryPreparationError();
 }
 
+// Called only with application-observed governance, never a CLI-supplied summary.
+export function deliveryGovernanceEvidence(governance, run, checkout) {
+  if (!governance || governance.ready !== true || !Array.isArray(governance.blockers) || governance.blockers.length
+    || !Array.isArray(governance.decisions) || governance.decisions.some(value => value.status === 'pending')
+    || governance.review?.valid !== true || !Array.isArray(governance.review.reports)
+    || governance.review.blockers?.length || (governance.scan !== null && governance.scan?.status !== 'passed')) fail();
+  const bindings = { runId: run.runId, requestDigest: run.workRequest.digest, planDigest: run.proposalDigest };
+  if (governance.subject?.phase !== 'final' || governance.subject.headSha !== checkout.acceptedCommit
+    || governance.subject.baseSha !== run.featurePlan.baselineCommit
+    || Object.entries(bindings).some(([key, value]) => governance.subject[key] !== value)) fail();
+  const decisionSummary = governance.decisions.length ? renderDecisions(governance.decisions, {
+    ...bindings, approvedPlanDecisions: governance.decisions.filter(value => value.status === 'approved').map(({ id, choice }) => ({ id, choice })),
+  }) : null;
+  if (decisionSummary !== null && Buffer.byteLength(decisionSummary) > 30000) {
+    throw new DeliveryPreparationError('Decision evidence exceeds the review body limit. Split the task before preparing delivery; evidence is never truncated.');
+  }
+  const hasEvidence = governance.decisions.length > 0 || governance.policy?.required === true
+    || governance.review.reports.length > 0 || governance.scan !== null;
+  if (!hasEvidence) return Object.freeze({});
+  const governanceDigest = hash({ subject: governance.subject, policy: governance.policy, decisions: governance.decisions,
+    review: governance.review, scan: governance.scan });
+  return immutableJson({ governanceDigest, ...(decisionSummary === null ? {} : { decisionSummary, decisionSummaryDigest: hash(decisionSummary) }) });
+}
+
 // Only the application reads local verification. CLI inputs never stand in for evidence.
 export async function loadDeliveryCandidate({ project, runId, remoteName, gitClient, runner }) {
   const paths = await resolveExistingFeatureRunPaths(project, runId, runner ? { runner } : {});
@@ -28,6 +55,10 @@ export async function loadDeliveryCandidate({ project, runId, remoteName, gitCli
     const observed = await execution.status({ project, runId });
     const config = await loadProjectConfig(project);
     const { run, verification, checkout } = observed;
+    const governance = observed.governance ?? await inspectGovernance({ project, run, gitClient, config, phase: 'final',
+      ...(checkout?.acceptedCommit ? { checkout: { path: checkout.path, commitSha: checkout.acceptedCommit, branch: checkout.branch } } : {}) });
+    const governanceEvidence = deliveryGovernanceEvidence(governance, run, checkout ?? {});
+    const { decisionSummary, ...governanceProof } = governanceEvidence;
     const source = await gitClient.inspectRepository(project);
     if (
       source.dirty ||
@@ -64,17 +95,20 @@ export async function loadDeliveryCandidate({ project, runId, remoteName, gitCli
     return immutableJson({
       runId,
       repository,
+      ...(decisionSummary === undefined ? {} : { decisionSummary }),
       sourceBranch: checkout.branch,
       targetBranch: config.project.repository.defaultBranch,
       localVerification: {
         runId,
         status: 'passed',
+        ...governanceProof,
         headSha: checkout.acceptedCommit,
         evidenceDigest: createHash('sha256')
           .update(
             JSON.stringify({
               proposalDigest: run.proposalDigest,
               verification,
+              ...(governanceEvidence.governanceDigest ? { governanceDigest: governanceEvidence.governanceDigest } : {}),
             })
           )
           .digest('hex'),

package/src/delivery/review-request.js

@@ -4,15 +4,16 @@ import { parseRepositoryRemote } from '../repositories/identity.js';
 import { createTrustedDeliveryExecutor } from './service.js';
 import { digest, ensure, exact, factsDigest, hash, plain, sha, timestamp, validateCandidate } from './contract.js';
 
+const REVIEW_MARKER_BYTES = Buffer.byteLength('\n\n<!-- rivet-review-operation:' + '0'.repeat(64) + ' -->');
 export function reviewRequestPayload(candidate) {
   validateCandidate(candidate);
-  return plain({
-    title: `Rivet: ${candidate.runId}`,
-    body: ['Rivet verified delivery candidate', '', `Run: ${candidate.runId}`,
-      `Source branch: ${candidate.sourceBranch}`, `Target branch: ${candidate.targetBranch}`,
-      `Verified commit: ${candidate.headSha}`, `Verification evidence: ${candidate.localVerification.evidenceDigest}`,
-      '', 'Review the changes and repository checks before making a separate merge decision.'].join('\n'),
-  });
+  const body = ['Rivet verified delivery candidate', '', `Run: ${candidate.runId}`,
+    `Source branch: ${candidate.sourceBranch}`, `Target branch: ${candidate.targetBranch}`,
+    `Verified commit: ${candidate.headSha}`, `Verification evidence: ${candidate.localVerification.evidenceDigest}`,
+    ...(candidate.decisionSummary === undefined ? [] : ['', candidate.decisionSummary]),
+    '', 'Review the changes and repository checks before making a separate merge decision.'].join('\n');
+  ensure(Buffer.byteLength(body) + REVIEW_MARKER_BYTES <= 32000, 'review-content-too-large');
+  return plain({ title: `Rivet: ${candidate.runId}`, body });
 }
 
 export function reviewRequestContent(operation) {
@@ -20,9 +21,12 @@ export function reviewRequestContent(operation) {
   digest(operation.digest);
   const payload = plain(operation.payload);
   exact(payload, ['title', 'body']);
+  if (operation.candidate?.decisionSummary !== undefined) {
+    ensure(hash(payload) === hash(reviewRequestPayload(operation.candidate)), 'decision-summary-mismatch');
+  }
   ensure(typeof payload.title === 'string' && payload.title.trim() === payload.title && payload.title.length >= 1
     && payload.title.length <= 256 && !/[\u0000-\u001f\u007f]/.test(payload.title));
-  ensure(typeof payload.body === 'string' && payload.body.length >= 1 && payload.body.length <= 32000
+  ensure(typeof payload.body === 'string' && payload.body.length >= 1 && Buffer.byteLength(payload.body) + REVIEW_MARKER_BYTES <= 32000
     && !/[\u0000-\u0008\u000b-\u001f\u007f]/.test(payload.body)
     && !payload.body.includes('rivet-review-operation:'));
   return plain({ title: payload.title, body: `${payload.body}\n\n<!-- rivet-review-operation:${operation.digest} -->` });