@bridge_gpt/mcp-server 0.2.41 → 0.2.43

package/build/claude-review-workflow.js

@@ -103,6 +103,172 @@ function yamlSingleQuoted(value) {
 function yamlFlowList(values) {
     return `[${values.map(yamlSingleQuoted).join(", ")}]`;
 }
+/**
+ * The verdict check, as an `actions/github-script` body.
+ *
+ * A faithful implementation of `docs/claude/claude-review-verdict-contract.md`
+ * §1-§4 — the same grammar, candidate eligibility, run-id/recency winner
+ * selection, conflict rule, and head binding the Conductor's merge gate applies.
+ * A check STRICTER than the gate turns mergeable pull requests red; a check
+ * LOOSER than the gate reproduces the silent green this whole state machine
+ * exists to remove. Neither side may relax a rule alone: the contract document is
+ * the authority both cite.
+ *
+ * Outputs, read by the retry conditions and the aggregate step:
+ *
+ * - `status` — `checked` when comments were read and the check completed,
+ *   `unavailable` when the read itself failed. Only `checked` may trigger another
+ *   paid attempt; another review cannot fix a check that could not read its input.
+ * - `valid` — `true` only for a verdict bound to the exact expected head.
+ * - `reason` — a stable code from the contract's fail-closed vocabulary.
+ *
+ * Read-only throughout: it never posts, edits, or deletes a comment. Diagnostics
+ * carry reason codes and commit SHAs only — never a comment body, a user login,
+ * or a token, because an Actions log is world-readable on a public repository.
+ */
+const VERDICT_CHECK_SCRIPT = [
+    "            // Contract: docs/claude/claude-review-verdict-contract.md §1-§4.",
+    "            const VERDICT = /claude-review-verdict:\\s*(approved|changes_requested)/i;",
+    "            const RUN_ID = /run[-_]id:\\s*(\\d+)/i;",
+    "            const REVIEWED_SHA = /Reviewed-SHA:\\s*([0-9A-Za-z._-]+)/i;",
+    "            const FULL_SHA = /^[0-9a-f]{40}$/;",
+    "            const APPROVED_WORD = /\\bapproved\\b/i;",
+    "            const CHANGES_WORD = /\\bchanges.requested\\b/i;",
+    "            const expected = String(process.env.EXPECTED_HEAD || '').trim().toLowerCase();",
+    "",
+    "            // Ambiguity (both verdict words) or absence (neither) yields",
+    "            // 'unknown', never 'approved'.",
+    "            const verdictOf = (body) => {",
+    "              const token = VERDICT.exec(body);",
+    "              if (token) return token[1].toLowerCase();",
+    "              const a = APPROVED_WORD.test(body);",
+    "              const c = CHANGES_WORD.test(body);",
+    "              if (a && !c) return 'approved';",
+    "              if (c && !a) return 'changes_requested';",
+    "              return 'unknown';",
+    "            };",
+    "            const declaredSha = (body) => {",
+    "              const m = REVIEWED_SHA.exec(body);",
+    "              return m ? m[1].trim().toLowerCase() : null;",
+    "            };",
+    "",
+    "            // §2 eligibility: the structured token, or the loose marker.",
+    "            // Malformed entries are skipped rather than throwing — one odd",
+    "            // comment must not fail the job for a reason unrelated to review.",
+    "            const build = (comments) => comments.reduce((acc, c, index) => {",
+    "              if (!c || typeof c !== 'object') return acc;",
+    "              const body = typeof c.body === 'string' ? c.body : '';",
+    "              const hasToken = VERDICT.test(body);",
+    "              if (!hasToken && body.indexOf('claude-review') === -1) return acc;",
+    "              const run = RUN_ID.exec(body);",
+    "              const raw = c.updated_at || c.created_at;",
+    "              const ts = typeof raw === 'string' ? Date.parse(raw) : NaN;",
+    "              acc.push({",
+    "                runId: run ? parseInt(run[1], 10) : 0,",
+    "                index,",
+    "                body,",
+    "                hasToken,",
+    "                ts: Number.isNaN(ts) ? null : ts,",
+    "              });",
+    "              return acc;",
+    "            }, []);",
+    "",
+    "            // §3 legacy rank: (has a usable timestamp, that instant, carries the",
+    "            // token). The array index is deliberately EXCLUDED so a genuine",
+    "            // two-verdict contradiction stays detectable instead of being",
+    "            // silently resolved as 'whichever came last'.",
+    "            const rankOf = (c) => [c.ts !== null ? 1 : 0, c.ts === null ? 0 : c.ts, c.hasToken ? 1 : 0];",
+    "            const cmpRank = (a, b) => {",
+    "              const x = rankOf(a);",
+    "              const y = rankOf(b);",
+    "              for (let i = 0; i < x.length; i++) {",
+    "                if (x[i] !== y[i]) return x[i] < y[i] ? -1 : 1;",
+    "              }",
+    "              return 0;",
+    "            };",
+    "",
+    "            // §3 conflict: equal-ranked candidates that DISAGREE and share one",
+    "            // valid Reviewed-SHA. Duplicate upserts of the same verdict are not",
+    "            // a conflict, and candidates without shared provenance never proved",
+    "            // they examined the same code.",
+    "            const conflicts = (tied) => {",
+    "              if (new Set(tied.map((c) => verdictOf(c.body))).size < 2) return false;",
+    "              const shas = new Set(",
+    "                tied.map((c) => declaredSha(c.body)).filter((s) => s && FULL_SHA.test(s)),",
+    "              );",
+    "              if (shas.size !== 1) return false;",
+    "              const bound = tied.filter((c) => shas.has(declaredSha(c.body)));",
+    "              return new Set(bound.map((c) => verdictOf(c.body))).size >= 2;",
+    "            };",
+    "",
+    "            const resolve = (comments) => {",
+    "              const candidates = build(comments);",
+    "              if (candidates.length === 0) return { valid: false, reason: 'review_verdict_absent' };",
+    "              let tied;",
+    "              if (candidates.some((c) => c.runId > 0)) {",
+    "                const top = Math.max(...candidates.map((c) => c.runId));",
+    "                tied = candidates.filter((c) => c.runId === top);",
+    "              } else {",
+    "                const best = candidates.reduce((a, b) => (cmpRank(a, b) >= 0 ? a : b));",
+    "                tied = candidates.filter((c) => cmpRank(c, best) === 0);",
+    "              }",
+    "              if (conflicts(tied)) return { valid: false, reason: 'review_verdict_conflict' };",
+    "              const winner = tied.reduce((a, b) => (a.index >= b.index ? a : b));",
+    "              const declared = declaredSha(winner.body);",
+    "              if (declared === null) return { valid: false, reason: 'review_verdict_no_head_proof' };",
+    "              if (declared !== expected) {",
+    "                return {",
+    "                  valid: false,",
+    "                  reason: FULL_SHA.test(declared) ? 'review_verdict_stale_head' : 'review_verdict_malformed_sha',",
+    "                };",
+    "              }",
+    "              const verdict = verdictOf(winner.body);",
+    "              if (verdict !== 'approved' && verdict !== 'changes_requested') {",
+    "                return { valid: false, reason: 'review_verdict_unknown_token' };",
+    "              }",
+    "              return { valid: true, reason: 'review_verdict_resolved', verdict };",
+    "            };",
+    "",
+    "            if (!FULL_SHA.test(expected)) {",
+    "              core.setOutput('status', 'unavailable');",
+    "              core.setOutput('valid', 'false');",
+    "              core.setOutput('reason', 'checker_invalid_expected_head');",
+    "              return;",
+    "            }",
+    "",
+    "            // Bounded, read-only propagation loop: a verdict posted seconds ago",
+    "            // may not be visible to the comments API yet, and calling that",
+    "            // 'absent' would spend another paid review for nothing.",
+    "            let outcome = { valid: false, reason: 'checker_not_run' };",
+    "            let status = 'unavailable';",
+    "            for (let attempt = 1; attempt <= 4; attempt++) {",
+    "              let comments;",
+    "              try {",
+    "                comments = await github.paginate(github.rest.issues.listComments, {",
+    "                  owner: context.repo.owner,",
+    "                  repo: context.repo.repo,",
+    "                  issue_number: Number(process.env.PR_NUMBER),",
+    "                  per_page: 100,",
+    "                });",
+    "              } catch (err) {",
+    "                status = 'unavailable';",
+    "                outcome = { valid: false, reason: 'comment_fetch_failed' };",
+    "                await new Promise((r) => setTimeout(r, 10000));",
+    "                continue;",
+    "              }",
+    "              status = 'checked';",
+    "              outcome = resolve(comments);",
+    "              const retryable =",
+    "                outcome.reason === 'review_verdict_absent' ||",
+    "                outcome.reason === 'review_verdict_stale_head';",
+    "              if (outcome.valid || !retryable || attempt === 4) break;",
+    "              await new Promise((r) => setTimeout(r, 10000));",
+    "            }",
+    "            core.setOutput('status', status);",
+    "            core.setOutput('valid', outcome.valid ? 'true' : 'false');",
+    "            core.setOutput('reason', outcome.reason);",
+    "            core.info('Verdict check: valid=' + outcome.valid + ' reason=' + outcome.reason);",
+].join("\n");
 /**
  * Render the workflow YAML deterministically from validated parameters.
  *
@@ -111,6 +277,22 @@ function yamlFlowList(values) {
  * `Reviewed-SHA`/`run-id` contract the Conductor's merge gate consumes — with
  * every org-specific literal replaced by a parameter.
  *
+ * BAPI-851 widened "structurally equivalent" to include the whole PRODUCER-SIDE
+ * VERDICT CONTRACT, not just the prompt: three bounded, timeout-capped review
+ * attempts; a fresh head guard before each one; a fail-closed verdict check after
+ * each one; a terminal marker whose conclusion is the aggregate check result; and
+ * a final step that fails the job when no head-bound verdict was published. A
+ * consumer repo installing this workflow otherwise inherits the exact defect
+ * BAPI-851 removed here — a green check with no verdict, which reads as approval
+ * to anyone who does not know better.
+ *
+ * The rendered workflow does the verdict check in `actions/github-script`, while
+ * the Bridge repo's own workflow shells out to `scripts/check_claude_review_verdict.py`.
+ * They are two implementations of ONE contract —
+ * `docs/claude/claude-review-verdict-contract.md` §1-§4 — because a generated
+ * workflow cannot depend on a Python file living in the Bridge repository. The
+ * contract document, not either implementation, is the authority.
+ *
  * @throws ClaudeReviewWorkflowValidationError before producing any output.
  */
 export function renderClaudeReviewWorkflow(params) {
@@ -120,8 +302,141 @@ export function renderClaudeReviewWorkflow(params) {
     // `${'$'}{{ ... }}` is avoided by building the expression marker from a constant,
     // so nothing in this template can be mistaken for a TS template substitution.
     const gh = (expr) => "${{ " + expr + " }}";
-    return `# Generated by \`install-bridge conductor\` (Bridge API, BAPI-679).
+    /**
+     * Preflight: will the review action run at all?
+     *
+     * `anthropics/claude-code-action` refuses to run when the workflow file differs
+     * from the version on the repository's DEFAULT branch — its own supply-chain
+     * guard, so a pull request cannot rewrite the reviewer that judges it. It
+     * reports that as a warning and exits SUCCESS, so without this preflight the
+     * attempts would each publish nothing and the run would blame
+     * `retries_exhausted_without_verdict`, naming a cause that did not occur.
+     */
+    const preflight = () => `      - name: Preflight the review action
+        id: preflight
+        env:
+          DEFAULT_BRANCH: ${gh("github.event.repository.default_branch")}
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const fs = require('fs');
+            const crypto = require('crypto');
+            // Reproduce git's blob hash so it can be compared with the contents
+            // API's own \`sha\`, which avoids downloading and decoding the file.
+            const raw = fs.readFileSync('.github/workflows/claude-review.yml');
+            const header = Buffer.from('blob ' + raw.length + '\\0', 'utf8');
+            const localSha = crypto.createHash('sha1')
+              .update(Buffer.concat([header, raw]))
+              .digest('hex');
+            let remoteSha = '';
+            try {
+              const res = await github.rest.repos.getContent({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                path: '.github/workflows/claude-review.yml',
+                ref: String(process.env.DEFAULT_BRANCH || ''),
+              });
+              remoteSha = String(res.data.sha || '');
+            } catch (err) {
+              remoteSha = '';
+            }
+            if (!remoteSha) {
+              // Cannot prove a mismatch. Fail OPEN toward attempting the review: a
+              // suppressed review that would have worked is worse than a wasted
+              // attempt, and enforcement still catches a missing verdict.
+              core.setOutput('action_runnable', 'true');
+              core.setOutput('status', 'unverified');
+              core.info('Could not read the default branch copy of this workflow; proceeding.');
+              return;
+            }
+            if (localSha === remoteSha) {
+              core.setOutput('action_runnable', 'true');
+              core.setOutput('status', 'ok');
+            } else {
+              core.setOutput('action_runnable', 'false');
+              core.setOutput('status', 'workflow_modified');
+              core.warning('This pull request modifies the review workflow, so the review action will refuse to run against it. Suppressing all attempts; review this pull request by hand.');
+            }
+
+`;
+    /** One paid review attempt: guard the head, review, then check for a verdict. */
+    const attempt = (n) => {
+        const prev = n - 1;
+        const guardIf = n === 1
+            ? "        if: steps.preflight.outputs.action_runnable == 'true'\n"
+            : `        if: steps.check${prev}.outputs.status == 'checked' && steps.check${prev}.outputs.valid != 'true'\n`;
+        return `      - name: Guard head (attempt ${n})
+        id: guard${n}
+${guardIf}        uses: actions/github-script@v9
+        with:
+          script: |
+            // Never spend a paid review on a head the PR has already moved past.
+            // A failed lookup is NOT read as "unchanged": an unprovable head is an
+            // infrastructure failure, not permission to review.
+            const expected = String(process.env.EXPECTED_HEAD || '').toLowerCase();
+            let actual = '';
+            try {
+              const pr = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: Number(process.env.PR_NUMBER),
+              });
+              actual = String(pr.data.head.sha || '').toLowerCase();
+            } catch (err) {
+              core.setOutput('head_ok', 'false');
+              core.setOutput('status', 'lookup_failed');
+              core.warning('Could not resolve the pull request head; refusing to start a review attempt.');
+              return;
+            }
+            if (!/^[0-9a-f]{40}$/.test(actual)) {
+              core.setOutput('head_ok', 'false');
+              core.setOutput('status', 'lookup_failed');
+              core.warning('Pull request head was not a usable commit SHA.');
+              return;
+            }
+            if (actual !== expected) {
+              core.setOutput('head_ok', 'false');
+              core.setOutput('status', 'drift');
+              core.warning('PR head moved from ' + expected + ' to ' + actual + '; suppressing remaining attempts.');
+              return;
+            }
+            core.setOutput('head_ok', 'true');
+            core.setOutput('status', 'ok');
+            core.info('PR head confirmed at ' + expected + '.');
+
+      - name: Claude Code Review (attempt ${n})
+        id: review${n}
+        if: steps.guard${n}.outputs.head_ok == 'true'
+        continue-on-error: true
+        timeout-minutes: 10
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${gh(`secrets.${secretName}`)}
+          allowed_bots: ${yamlSingleQuoted(allowedBot)}
+          use_sticky_comment: true
+          track_progress: true
+          prompt: ${gh("env.REVIEW_PROMPT")}
+          claude_args: ${gh("env.REVIEW_CLAUDE_ARGS")}
+
+      # An action failure or a ten-minute timeout does NOT skip the check: the
+      # agent may have published a valid verdict before the step returned
+      # non-success. Only the checker decides whether this attempt counted.
+      - name: Check verdict (attempt ${n})
+        id: check${n}
+        if: always() && steps.guard${n}.outputs.head_ok == 'true'
+        uses: actions/github-script@v9
+        with:
+          script: |
+${VERDICT_CHECK_SCRIPT}
+`;
+    };
+    return `# Generated by \`install-bridge conductor\` (Bridge API, BAPI-679/BAPI-851).
 # Safe to edit: this file is never overwritten without explicit consent.
+#
+# The verdict grammar, winner selection, head binding, and every terminal shape
+# this workflow can produce are specified in ONE place — Bridge API's
+# docs/claude/claude-review-verdict-contract.md. The checker below and the
+# Conductor's merge gate both implement that document; neither defines its own.
 name: Claude Code Review
 
 on:
@@ -133,6 +448,10 @@ on:
 # Reviewed-SHA provenance the review emits: the Conductor rejects a verdict whose
 # Reviewed-SHA does not match the current head, so cancelling a superseded review
 # only avoids wasted minutes.
+#
+# The bounded retry below runs as sequential steps INSIDE this job. It never
+# dispatches or re-runs the workflow, so a retry never joins this group and can
+# never cancel a legitimately in-flight review of a newer head.
 concurrency:
   group: claude-review-${gh("github.event.pull_request.number")}
   cancel-in-progress: true
@@ -147,58 +466,204 @@ jobs:
       pull-requests: write
       issues: write
       id-token: write
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 1
+    env:
+      # The IMMUTABLE head this run was triggered for. Every attempt reviews it and
+      # every check demands a verdict bound to it, so no later step can quietly
+      # drift onto a different head.
+      EXPECTED_HEAD: ${gh("github.event.pull_request.head.sha")}
+      PR_NUMBER: ${gh("github.event.pull_request.number")}
+      # Held once and passed to all three attempts, so a retry cannot review under
+      # different instructions than the first try.
+      REVIEW_PROMPT: |
+        REPO: ${gh("github.repository")}
+        PR NUMBER: ${gh("github.event.pull_request.number")}
 
-      - name: Claude Code Review
-        id: review
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${gh(`secrets.${secretName}`)}
-          allowed_bots: ${yamlSingleQuoted(allowedBot)}
-          use_sticky_comment: true
-          track_progress: true
-          prompt: |
-            REPO: ${gh("github.repository")}
-            PR NUMBER: ${gh("github.event.pull_request.number")}
+        Review this pull request with a focus on:
+        - Bugs, logic errors, and edge cases
+        - Security issues (injection, auth bypasses, sensitive data exposure)
+        - Project conventions and patterns (see CLAUDE.md)
+        - Data-access correctness (parameterized queries, migration safety)
+        - Test coverage gaps for changed code
+
+        Be specific: cite file paths and line numbers.
 
-            Review this pull request with a focus on:
-            - Bugs, logic errors, and edge cases
-            - Security issues (injection, auth bypasses, sensitive data exposure)
-            - Project conventions and patterns (see CLAUDE.md)
-            - Data-access correctness (parameterized queries, migration safety)
-            - Test coverage gaps for changed code
+        Call out significant issues; ignore minor nits with no meaningful impact.
+        If there are no significant issues, just say "Looks good to me!"
 
-            Be specific: cite file paths and line numbers.
+        Use \`gh pr comment\` for top-level feedback.
+        Use \`mcp__github_inline_comment__create_inline_comment\` (with \`confirmed: true\`)
+        to highlight specific code issues.
+        Only post GitHub comments - don't submit review text as messages.
 
-            Call out significant issues; ignore minor nits with no meaningful impact.
-            If there are no significant issues, just say "Looks good to me!"
+        After your feedback, end your top-level \`gh pr comment\` with EXACTLY ONE
+        machine-readable verdict line, on its own line, verbatim — this single line is
+        the source of truth consumed by automation (the Conductor merge gate):
+        - \`claude-review-verdict: approved\` — when the PR is safe to merge
+        - \`claude-review-verdict: changes_requested\` — when significant issues remain
+        Emit exactly one such verdict line, and do not use the words \`approved\` or
+        \`changes_requested\` as a verdict anywhere else in the comment.
 
-            Use \`gh pr comment\` for top-level feedback.
-            Use \`mcp__github_inline_comment__create_inline_comment\` (with \`confirmed: true\`)
-            to highlight specific code issues.
-            Only post GitHub comments - don't submit review text as messages.
+        Immediately BELOW the verdict line, on its own line, emit this exact
+        head-SHA provenance line verbatim — it binds the verdict to the exact commit
+        you reviewed so the Conductor can reject a stale verdict:
+        \`Reviewed-SHA: ${gh("github.event.pull_request.head.sha")}\`
+
+        Also include the GitHub Actions run id on its own line so overlapping
+        reviews resolve deterministically by run id, verbatim:
+        \`run-id: ${gh("github.run_id")}\`
+      REVIEW_CLAUDE_ARGS: |
+        --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(git diff:*),Bash(git log:*),Bash(git show:*),Read,Glob,Grep"
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 1
 
-            After your feedback, end your top-level \`gh pr comment\` with EXACTLY ONE
-            machine-readable verdict line, on its own line, verbatim — this single line is
-            the source of truth consumed by automation (the Conductor merge gate):
-            - \`claude-review-verdict: approved\` — when the PR is safe to merge
-            - \`claude-review-verdict: changes_requested\` — when significant issues remain
-            Emit exactly one such verdict line, and do not use the words \`approved\` or
-            \`changes_requested\` as a verdict anywhere else in the comment.
+      # ------------------------------------------------------------------
+      # Three bounded attempts. The review action can report success while
+      # having abandoned its own progress checklist and published no verdict;
+      # every observed occurrence recovered on a re-run at the identical head.
+      # So: retry up to three times in-job, then fail loudly. Each attempt bills
+      # a full review, which is what the cap of three is for — a deterministic
+      # failure (a dead OAuth token) must not bill indefinitely.
+      # ------------------------------------------------------------------
+${preflight()}${attempt(1)}
+${attempt(2)}
+${attempt(3)}
+      # ONE boolean drives both the terminal marker and the job conclusion, so the
+      # two can never tell contradictory stories. Aggregate success requires a
+      # CHECK to have confirmed a head-bound verdict — three self-reported
+      # successful attempts that published nothing aggregate to failure.
+      - name: Resolve aggregate review result
+        id: aggregate
+        if: always()
+        # Step outputs reach the script through \`env\`, never through a bare
+        # expression interpolated into JS: a skipped step's output is the EMPTY
+        # STRING, which would splice into a syntax error rather than a falsy value.
+        env:
+          PREFLIGHT_STATUS: ${gh("steps.preflight.outputs.status")}
+          CHECK1_VALID: ${gh("steps.check1.outputs.valid")}
+          CHECK2_VALID: ${gh("steps.check2.outputs.valid")}
+          CHECK3_VALID: ${gh("steps.check3.outputs.valid")}
+          CHECK1_STATUS: ${gh("steps.check1.outputs.status")}
+          CHECK2_STATUS: ${gh("steps.check2.outputs.status")}
+          CHECK3_STATUS: ${gh("steps.check3.outputs.status")}
+          GUARD1_STATUS: ${gh("steps.guard1.outputs.status")}
+          GUARD2_STATUS: ${gh("steps.guard2.outputs.status")}
+          GUARD3_STATUS: ${gh("steps.guard3.outputs.status")}
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const env = process.env;
+            const checks = [
+              { valid: env.CHECK1_VALID, status: env.CHECK1_STATUS },
+              { valid: env.CHECK2_VALID, status: env.CHECK2_STATUS },
+              { valid: env.CHECK3_VALID, status: env.CHECK3_STATUS },
+            ].map((c) => ({ valid: String(c.valid || ''), status: String(c.status || '') }));
+            const guards = [env.GUARD1_STATUS, env.GUARD2_STATUS, env.GUARD3_STATUS]
+              .map((s) => String(s || ''));
+            const success = checks.some((c) => c.valid === 'true');
+            let reason;
+            if (success) {
+              reason = 'verdict_published';
+            } else if (env.PREFLIGHT_STATUS === 'workflow_modified') {
+              reason = 'review_action_blocked_by_workflow_modification';
+            } else if (guards.includes('drift')) {
+              reason = 'head_drift';
+            } else if (guards.includes('lookup_failed')) {
+              reason = 'head_lookup_failed';
+            } else if (checks.some((c) => c.status === 'unavailable')) {
+              reason = 'verdict_check_unavailable';
+            } else {
+              reason = 'retries_exhausted_without_verdict';
+            }
+            core.setOutput('success', success ? 'true' : 'false');
+            core.setOutput('conclusion', success ? 'success' : 'failure');
+            core.setOutput('reason', reason);
+            core.info('Aggregate review result: success=' + success + ' reason=' + reason);
 
-            Immediately BELOW the verdict line, on its own line, emit this exact
-            head-SHA provenance line verbatim — it binds the verdict to the exact commit
-            you reviewed so the Conductor can reject a stale verdict:
-            \`Reviewed-SHA: ${gh("github.event.pull_request.head.sha")}\`
+      # A durable, machine-readable TERMINAL marker recording the workflow run id,
+      # the exact reviewed head SHA, and the run's terminal conclusion — WITHOUT
+      # ever fabricating a review verdict. It lives in its OWN dedicated comment,
+      # whose grammar shares none of the substrings the sticky-verdict parser keys
+      # on, and is upserted per PR. \`terminal-conclusion: success\` is published on
+      # precisely the path that also lets this job finish green, and still never
+      # means "approved" — only the sticky verdict answers that.
+      - name: Emit terminal review marker
+        id: marker
+        if: always()
+        continue-on-error: true
+        env:
+          AGGREGATE_CONCLUSION: ${gh("steps.aggregate.outputs.conclusion")}
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const anchor = '<!-- bapi-review-terminal -->';
+            const runId = String(context.runId);
+            const reviewedHead = context.payload.pull_request
+              ? String(context.payload.pull_request.head.sha)
+              : '';
+            const conclusion = String(process.env.AGGREGATE_CONCLUSION || 'unknown');
+            const prNumber = context.payload.pull_request
+              ? context.payload.pull_request.number
+              : (context.issue && context.issue.number);
+            if (!prNumber) {
+              core.warning('No PR number in context; skipping terminal marker.');
+              return;
+            }
+            const body = [
+              anchor,
+              'bapi-review-terminal: v1',
+              'terminal-workflow-run: ' + runId,
+              'terminal-reviewed-head: ' + reviewedHead,
+              'terminal-conclusion: ' + conclusion,
+            ].join('\\n');
+            const existing = await github.paginate(github.rest.issues.listComments, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+              per_page: 100,
+            });
+            const markerComment = existing.find((c) => c.body && c.body.includes(anchor));
+            if (markerComment) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: markerComment.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: prNumber,
+                body,
+              });
+            }
+            core.info('Emitted terminal review marker: conclusion=' + conclusion);
 
-            Also include the GitHub Actions run id on its own line so overlapping
-            reviews resolve deterministically by run id, verbatim:
-            \`run-id: ${gh("github.run_id")}\`
-          claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(git diff:*),Bash(git log:*),Bash(git show:*),Read,Glob,Grep"
+      # The loud failure. A review that published nothing used to produce a green
+      # check, which reads as approval to anyone who does not know better. Now the
+      # check goes red — but only after the retries are exhausted, so a single
+      # early quit never surfaces as red to a human. Marker-upsert failure also
+      # fails the job: a green check with no durable terminal evidence is
+      # indistinguishable from a review that never ran.
+      - name: Enforce review verdict
+        if: always()
+        env:
+          AGGREGATE_SUCCESS: ${gh("steps.aggregate.outputs.success")}
+          AGGREGATE_REASON: ${gh("steps.aggregate.outputs.reason")}
+          MARKER_OUTCOME: ${gh("steps.marker.outcome")}
+        run: |
+          set -uo pipefail
+          if [ "\${MARKER_OUTCOME}" != "success" ]; then
+            echo "::error::The durable terminal review marker could not be published (\${MARKER_OUTCOME})."
+            exit 1
+          fi
+          if [ "\${AGGREGATE_SUCCESS}" != "true" ]; then
+            echo "::error::claude-review published no verdict bound to \${EXPECTED_HEAD} after its bounded attempts (\${AGGREGATE_REASON})."
+            exit 1
+          fi
+          echo "claude-review published a verdict bound to \${EXPECTED_HEAD}."
 `;
 }
 function joinCwd(cwd, rel) {