@codedology/code-forge 0.7.5 → 0.7.6

package/CHANGELOG.md

@@ -6,6 +6,23 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.7.6] — 2026-10-11
+
+### Added
+
+- review.external {required, name} (B58, issue #11): an owner-approved outside reviewer replaces the local per-file
+  review. Read only from the run-start config snapshot (run reload refuses to change it; run start refuses required:
+  true without a name) and signed as a review.external row; block close then skips the per-file review check (also
+  not_approved) and writes a signed gate.reviews_waived {by: config, reviewer} row just before block.close, only when
+  the block closes, with no TTY and under autopilot. Unowned, proof, no_changes, transcript, orphans and closeBlock
+  checks still refuse. block open and block claim refuse an owned entry that covers .code-forge.yml. Without the key
+  nothing changes.
+
+### Changed
+
+- block open, block claim and block close now read the run's config snapshot; a snapshot that does not match its hash
+  refuses them with config-snapshot, with or without review.external (B58).
+
 ## [0.7.5] — 2026-10-08
 
 ### Fixed

package/README.md

@@ -12,6 +12,14 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 
 Next release:
 
+- **An outside reviewer can replace the local review.** Set `review.external: {required: true,
+  name: <reviewer>}` in `.code-forge.yml`. `block close` then skips the per-file review check
+  and writes a signed `gate.reviews_waived` row with `by: config`. It needs no TTY and works
+  under autopilot. All other close checks still run. The key is fixed at `run start`, and a
+  coder can never own `.code-forge.yml`.
+
+In 0.7.5:
+
 - **An owned directory owns the files inside it, everywhere.** A block that owns `src/feature`
   now owns `src/feature/a.swift` for `block open`, `block claim`, `block rebase`, the scope gate,
   proof and the review worker, not only for `block close`. `block open` refuses a second block

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 60,
+  "block_count": 61,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -823,6 +823,19 @@
         "B56"
       ],
       "note": "root-added 2026-10-08; found while fixing GitHub issue #2 (B52); also amends src/state/{registry,block}.mjs, src/review/gate-check.mjs, src/cli/{block,proof,plan}.mjs, src/proof/{export,tiers}.mjs, src/worker/engine.mjs, src/session/plan-check.mjs, tests, docs/how-it-works.md, skill/references/code.md"
+    },
+    "B58": {
+      "title": "Outside reviewer (issue #11, #13 item 1): config key review.external {required, name}, read only from the run-start config snapshot (immutable, run reload refuses it), signed review.external row at run start; block close skips the per-file review check and writes a signed gate.reviews_waived {by: config, reviewer} row just before block.close, only when the block closes; unowned, proof, no_changes, transcript and closeBlock checks still refuse; block open and block claim refuse an owned entry that covers .code-forge.yml; run start refuses required: true without a name",
+      "wave": 13,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "test/review/external.test.mjs"
+      ],
+      "depends_on": [
+        "B57"
+      ],
+      "note": "root-added 2026-10-11; GitHub issue #13 adoption plan (plans/adoption-13/plan.md); also amends src/state/{config-snapshot,run,block}.mjs, src/cli/block.mjs, schema/code-forge.schema.json, docs/reference/config.md, docs/{how-it-works,concepts}.md, skill/references/{review,decisions,code}.md, test/config/schema-coverage.test.mjs"
     }
   }
 }

package/docs/reference/config.md

@@ -117,6 +117,9 @@ Every other key defaults as shown, or is entirely absent from a minimal file. `a
 | `review.provider_concurrency.openai` | integer |  | `2` | min 1 |
 | `review.provider_concurrency.xai` | integer |  | `2` | min 1 |
 | `review.parallel_tickets` | integer |  | `3` | min 1; max 16; B42: how many review tickets the worker runs at once (oldest first); 1 = one at a time. Tickets for the same file never overlap. |
+| `review.external` | object |  | — |  |
+| `review.external.required` | boolean |  | `false` | B58: true ⇒ block close skips the local per-file review checks (and the --report ticket check), with no terminal and under autopilot, and writes a signed gate.reviews_waived {by: config} row. Unowned changes, proof, no_changes and the transcript grep still refuse. No block may own .code-forge.yml. |
+| `review.external.name` | string |  | — | minLength 1; B58: the outside reviewer, written in the review.external and gate.reviews_waived rows. Required when required is true: run start refuses a missing or blank name. |
 | `engine` | enum: `auto`, `solo`, `harness`, `subprocess` |  | `"auto"` |  |
 | `harnesses` | array<string> |  | — |  |
 | `harness` | object |  | — |  |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.7.5",
+  "version": "0.7.6",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",

package/schema/code-forge.schema.json

@@ -153,7 +153,16 @@
             "xai": { "type": "integer", "minimum": 1, "default": 2 }
           }
         },
-        "parallel_tickets": { "type": "integer", "minimum": 1, "maximum": 16, "default": 3, "description": "B42: how many review tickets the worker runs at once (oldest first); 1 = one at a time. Tickets for the same file never overlap." }
+        "parallel_tickets": { "type": "integer", "minimum": 1, "maximum": 16, "default": 3, "description": "B42: how many review tickets the worker runs at once (oldest first); 1 = one at a time. Tickets for the same file never overlap." },
+        "external": {
+          "type": "object",
+          "additionalProperties": false,
+          "description": "B58: an outside reviewer reviews each block. Set it before run start; run reload refuses to add, remove or change it.",
+          "properties": {
+            "required": { "type": "boolean", "default": false, "description": "B58: true ⇒ block close skips the local per-file review checks (and the --report ticket check), with no terminal and under autopilot, and writes a signed gate.reviews_waived {by: config} row. Unowned changes, proof, no_changes and the transcript grep still refuse. No block may own .code-forge.yml." },
+            "name": { "type": "string", "minLength": 1, "pattern": "\\S", "description": "B58: the outside reviewer, written in the review.external and gate.reviews_waived rows. Required when required is true: run start refuses a missing or blank name." }
+          }
+        }
       }
     },
     "engine": { "type": "string", "enum": ["auto", "solo", "harness", "subprocess"], "default": "auto" },

package/skill/references/code.md

@@ -41,7 +41,7 @@ The coder's report is a claim sheet. The gate reproduces each number in the meas
 | rows genuine | the MAC of every gate-relevant row verifies; the live worker matches the pinned pid |
 | nothing left open | no unruled `late_findings` (a ruling clears only a warning or nit ruled `nit`; a critical late finding needs the human's waiver); no file at `review_cap` without a signed `review.waived` row |
 
-`--no-require-reviews` is the human's way out, written as its own audit row. The human runs it themselves at a terminal: it asks for a yes, has no `--yes`, exits 2 unless stdin and stdout are both terminals, lifts `no_changes` and is refused while an autopilot grant is active — so never run it for them; tell them the command when they say so in chat. A finding counts only under the gate's own configuration; a tautology (an expected value computed by the code under test) is a finding. Reproduce disclosures: a coder that reports its own rule break did the hard part.
+`--no-require-reviews` is the human's way out, written as its own audit row. The human runs it themselves at a terminal: it asks for a yes, has no `--yes`, exits 2 unless stdin and stdout are both terminals, lifts `no_changes` and is refused while an autopilot grant is active — so never run it for them; tell them the command when they say so in chat. The owner's other way out is `review.external` in the config before `run start` (`review.md` §1): the gate then skips the review rows and the report's ticket ids and writes `gate.reviews_waived {by: config}`; every other check, `no_changes` included, still applies. A finding counts only under the gate's own configuration; a tautology (an expected value computed by the code under test) is a finding. Reproduce disclosures: a coder that reports its own rule break did the hard part.
 
 ## §6 Budget — the stop is the feature (R6)
 

package/skill/references/decisions.md

@@ -50,6 +50,6 @@ A fresh L3 session receives the failure evidence — the last attempt's diff, th
 
 ## §7 What reaches the human
 
-`next = stop`, `review.over_budget`, an orphan file or `unowned_change`, a `not_approved` critical finding, `--no-require-reviews`, `worker_down`, `review_cap`, `redecompose`, `ask_human`, a security question, consensus unavailable, and one budget raise per run. Everything else is decided by S1, S2 or the rules above and recorded. A change to a rule, limit or check is never decided here: it always reaches the owner (`rules-core.md` R17).
+`next = stop`, `review.over_budget`, an orphan file or `unowned_change`, a `not_approved` critical finding, `--no-require-reviews`, `worker_down`, `review_cap`, `redecompose`, `ask_human`, a security question, consensus unavailable, and one budget raise per run. The owner has two ways out of the per-file review gate: `--no-require-reviews` at a terminal, or `review.external.required: true` with the outside reviewer's `name`, set in `.code-forge.yml` before `run start` (`review.md` §1). You never choose either one. Everything else is decided by S1, S2 or the rules above and recorded. A change to a rule, limit or check is never decided here: it always reaches the owner (`rules-core.md` R17).
 
 **Autopilot:** while a grant is active, a warning or nit waiver, one extra round at `review_cap` and a coder level go first to the delegate (`forge autopilot ask`, then `forge autopilot waive|round|level --decision <id>` only when it acted, `autopilot.md` §2). Never delegated: `next = stop`, `ask_human`, a security question, a critical finding, a budget raise, `redecompose` — they wait for the owner (`autopilot.md` §5).

package/skill/references/review.md

@@ -4,6 +4,8 @@
 
 `forge review-file <path> --block <id> --run <r>` enqueues a ticket and returns `{ticket, status: queued}` in under a second; `forge review-file --wait <ticket> [--max 90s]` polls it. The worker computes the diff itself against the base sha `forge block open` recorded: tracked changes plus untracked files, filtered by `owned_files` for the review and unfiltered for the scope check. A coder that never calls `review-file` gains nothing: the block gate refuses any changed or new file without a signed `review.approved` row for its final content hash. The reviewer is always a new OS process (R1, R10) — identical under Solo, a harness subagent, a detached CLI process, or a human typing.
 
+**The owner's two ways out of the per-file review.** (1) `forge block close <id> --no-require-reviews`, typed by the owner at a terminal (`code.md` §5). (2) `review.external: {required: true, name: <reviewer>}` in `.code-forge.yml`, set before `run start`, when an outside reviewer reviews each block (B58). With `required: true`, `run start` refuses a missing or blank `name`, and writes a signed `review.external` row with the reviewer's name. `run reload` refuses to add, remove or change the key. With the key, `block close` does not check the review rows (a `not_approved` file included) or the report's ticket ids, needs no terminal and works under an autopilot grant. When the block closes, it writes a signed `gate.reviews_waived {by: config, reviewer}` row just before `block.close`; a refused close writes no such row. Unowned changes, `unproven`, `no_changes`, the transcript grep and the registry's orphans still refuse. No block may own `.code-forge.yml` while the key is on: `block open` and `block claim` refuse it. `block open`, `block claim` and `block close` read the run's config snapshot to find the key, so a snapshot that does not match its hash refuses them with `config-snapshot`, with or without the key. Never set or remove the key yourself: it is the owner's decision.
+
 ## §2 Depth by risk (adaptive mode)
 
 The topology is decided in one place (`planSessions`). Consensus (§6) runs only when `review.multimodel` is on **and** the file's risk is above `review.single_reviewer_max_risk` (default 1) **and** the block is not a `docs`/`contract` block (`decisions.md` §5) unless `review.multimodel_for_docs` is true (default false). Everything else is adaptive, below. Why: a consensus review of a four-file docs block cost $16.70 — review cost dominates, and a low-risk file gains nothing from a second provider.

package/skill/scripts/forge

@@ -10,7 +10,7 @@
 #      copied install with no package next to it); `test/skill/shim.test.mjs` asserts the pin
 #      equals package.json's version.
 # The shim holds no logic of its own: every verb, flag and message is the CLI's.
-PINNED_VERSION="0.7.5"
+PINNED_VERSION="0.7.6"
 set -eu
 
 self="$0"

package/src/cli/block.mjs

@@ -50,6 +50,15 @@
  * FAILED: no review-file ticket id for <files>` (skipped under `--no-require-reviews`, the human's
  * way out). It runs after the review rows and reuses their file set (listed once).
  *
+ * B58 (issue #11): `review.external.required: true` in the run's config snapshot (the owner set it
+ * before `run start`; `run reload` refuses to change it) is the owner's non-interactive way out
+ * when an outside reviewer reviews the block: the per-file review checks and the `--report` ticket
+ * check are skipped, with no TTY and under an active autopilot grant, and a signed
+ * `gate.reviews_waived {by: config, reviewer: <name>}` row is written just before `block.close`,
+ * only when the block closes. Everything
+ * else still refuses — `unowned_change`, `unproven`, `no_changes`, the transcript grep and
+ * `closeBlock`'s own rows. With `--no-require-reviews` the human path runs exactly as without the key.
+ *
  * B47: `block open` without `--level` takes the level `autopilot level` chose for the block (the
  * latest `autopilot.level` row of the run for it whose MAC verifies, `autopilotLevel`); with
  * neither it is a usage error (`no --level given and no autopilot level recorded for <id>`). An
@@ -67,6 +76,7 @@ import { approvalCheckText, expiryChecks } from '../autopilot/limits.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
 import { attemptBlock, claimPath, closeBlock, openBlock, rebaseBlock, repoTop, stopBlock } from '../state/block.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
+import { externalReviewer } from '../state/config-snapshot.mjs';
 import { StateError } from '../state/paths.mjs';
 import { readRun, writeSigned } from '../state/run.mjs';
 import { loadKey, verifyRow } from '../state/signer.mjs';
@@ -201,6 +211,9 @@ export async function runBlock(args, deps = {}) {
           return 1;
         }
       }
+      // B58: the owner's other way out — `review.external.required` in the run's config snapshot
+      // (set before `run start`, immutable): no TTY, allowed under autopilot, the human flag wins
+      const external = reviewsWaived ? null : externalReviewer(record);
       const rows = (await readAllRows(record.project)).filter((row) => row.run === runId);
       // B52: ONE path base and ONE listing, memoised as a promise and shared by every check. The
       // base is the repository top level: the worker signs every review row with a repo-root-
@@ -265,8 +278,9 @@ export async function runBlock(args, deps = {}) {
           unowned: scope?.unowned ?? [],
           // B52: an old ledger's review.result rows are judged by their signed result files
           resultFiles: await resultFilesFor({ repoRoot: top, runId, block: id, rows }),
-          files: reviewsWaived ? [] : fileSet,
-          // B52: nothing changed and nothing reviewed is never a pass (the owner's way out is --no-require-reviews)
+          files: reviewsWaived || external !== null ? [] : fileSet,
+          // B52: nothing changed and nothing reviewed is never a pass (the owner's way out is
+          // --no-require-reviews); B58: `review.external` does not lift it
           noChanges: !reviewsWaived && fileSet.length === 0,
           // B20: high-tier files need a proven red→green row; `--no-require-reviews` does not lift it
           proofFiles: fileSet,
@@ -275,7 +289,7 @@ export async function runBlock(args, deps = {}) {
       });
       // B36: the coder's report names a review-file ticket for every changed file, or it is FAILED
       const report = async () => {
-        if (typeof flags.report !== 'string' || reviewsWaived) return { ok: true };
+        if (typeof flags.report !== 'string' || reviewsWaived || external !== null) return { ok: true };
         let text;
         try {
           text = await readFile(flags.report, 'utf8');
@@ -286,7 +300,10 @@ export async function runBlock(args, deps = {}) {
         const missing = missingReviewTickets(text, fileSet.map((f) => f.file));
         return missing.length === 0 ? { ok: true } : { ok: false, reason: `coder report FAILED: no review-file ticket id for ${missing.join(', ')}` };
       };
-      const result = await closeBlock({ runId, id, rows, writeRow, livePid: intFlag(flags['worker-pid'], 'worker-pid'), probe, extraChecks: [reviews, report] });
+      // B58: the config waiver row is written by `closeBlock` under the run lock, just before
+      // `block.close` and only when every other check passed — never by a refused close
+      const closeRows = external === null ? [] : [{ event: 'gate.reviews_waived', block: id, by: 'config', reviewer: external }];
+      const result = await closeBlock({ runId, id, rows, writeRow, livePid: intFlag(flags['worker-pid'], 'worker-pid'), probe, extraChecks: [reviews, report], closeRows });
       (result.ok ? out : err)(`block ${id} ${result.status}${result.event ? ` (${result.event})` : ''}${result.reason ? `: ${result.reason}` : ''}\n`);
       return result.ok ? 0 : 1;
     }

package/src/state/block.mjs

@@ -17,6 +17,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { BLOCK_KINDS, blockKind, dispatchLevel } from '../decide/escalation.mjs';
 import { exec } from '../util/exec.mjs';
+import { DEFAULT_CONFIG_FILENAME } from '../config/load.mjs';
+import { externalReviewer } from './config-snapshot.mjs';
 import { ownedKinds, pathKind } from './owned-kinds.mjs';
 import { isAncestorArgv, revParseArgv } from '../util/git.mjs';
 import { StateError } from './paths.mjs';
@@ -254,6 +256,39 @@ function activeBlocks(record) {
   return Object.fromEntries(Object.entries(record.blocks).filter(([, b]) => b.status === 'open'));
 }
 
+/**
+ * B58: with `review.external.required` set in the run's snapshot, the project's `.code-forge.yml`
+ * is the owner's switch past the local per-file review, so no block may own it. These are the
+ * spellings an owned entry may match it by: relative to the workspace and, for a workspace in a
+ * subdirectory, relative to the repository top level (the close gate matches both, `ownsAt`).
+ * Empty when the key is not set.
+ * @param {Record<string, any>} record @returns {Promise<string[]>}
+ * @throws {StateError} `config-snapshot`, `git-failed`
+ */
+async function guardedConfigPaths(record) {
+  if (externalReviewer(record) === null) return [];
+  const top = await repoTop(record.workspace);
+  // the repo-top spelling `<prefix>/.code-forge.yml` may also match a different file of the same
+  // name under the workspace (`<ws>/<prefix>/.code-forge.yml`): that over-match only refuses more,
+  // never less, and is the one `ownsAt` gives the close gate
+  const prefix = path.relative(top, realpathSync(record.workspace)).split(path.sep).join('/');
+  return prefix === '' ? [DEFAULT_CONFIG_FILENAME] : [DEFAULT_CONFIG_FILENAME, `${prefix}/${DEFAULT_CONFIG_FILENAME}`];
+}
+
+/**
+ * B58: refuse an owned entry that owns one of `guarded` (B57's rule, `ownsFile`: the exact path,
+ * a directory above it, or a glob that matches it).
+ * @param {ReadonlyArray<string>} owned @param {import('./registry.mjs').OwnedKinds} kinds @param {ReadonlyArray<string>} guarded
+ * @throws {StateError} `config-owned`
+ */
+function refuseConfigOwner(owned, kinds, guarded) {
+  for (const entry of owned) {
+    if (guarded.some((file) => ownsFile([entry], file, kinds))) {
+      throw new StateError('config-owned', `owned entry ${JSON.stringify(entry)} covers the project's ${DEFAULT_CONFIG_FILENAME}; no block may own it while review.external.required is true`);
+    }
+  }
+}
+
 /**
  * `block open` — refuses a second open of the same id and any owned set that overlaps another
  * ACTIVE block's; records base, owned files, level, attempt, acceptance, line forecast and the
@@ -262,6 +297,8 @@ function activeBlocks(record) {
  * and the dispatch row carry the floor level, and the row adds `requested_level` and
  * `trigger: 'docs_floor'`. B52: the entry also records `tree_at_open` ({@link treeAtOpen}), the
  * tree's changes at open, which `block close` reads to tell the coder's changes from earlier ones.
+ * B58: with `review.external.required` set, an owned entry that owns the project's config is
+ * refused (`config-owned`, {@link refuseConfigOwner}).
  * @param {{
  *   runId: string, id: string, level: string, owned: string[], acceptance: unknown,
  *   attempt?: number, base?: string, lines?: number, brief?: {path: string, content: Buffer | string},
@@ -284,15 +321,19 @@ export async function openBlock(opts) {
 
   // B52: the tree is stamped BEFORE the run lock (hashing can be slow; other block commands must
   // not wait on it); under the lock the base is resolved again and must be the one stamped against
-  const { workspace } = await readRun(runId);
+  const before = await readRun(runId);
+  const { workspace } = before;
   const stampedBase = await resolveCommit(opts.base ?? 'HEAD', workspace);
   const treeOpen = await treeAtOpen(workspace, stampedBase);
+  // B58: `review.external` cannot change mid-run, so the record read here decides
+  const guarded = await guardedConfigPaths(before);
 
   const block = await mutateRun(runId, null, writeRow, async (record) => {
     if (record.blocks[id]?.status === 'open') throw new StateError('already-open', `block ${id} is already open`);
     // B57: what each exact owned entry is on disk, under the lock (as `block claim`) — a regular
     // file owns only itself, here and in every later check
     const kinds = ownedKinds(record.workspace, owned);
+    refuseConfigOwner(owned, kinds, guarded);
     for (const [otherId, other] of Object.entries(activeBlocks(record))) {
       const pair = findOverlap(owned, other.owned_files, { kindsA: kinds, kindsB: other.owned_kinds });
       if (pair) throw new StateError('overlap', `block ${id} owns ${pair[0]}, which overlaps ${pair[1]} owned by open block ${otherId}`);
@@ -347,13 +388,17 @@ export async function rebaseBlock({ runId, id, head = 'HEAD', writeRow }) {
  * glob, and when another open block owns it — or anything it would own: the claimed path becomes an
  * owned entry, so it is checked with `findOverlap` (B57: an entry owns the paths below it too,
  * unless it is a regular file now — its kind is recorded in `owned_kinds` as at `block open`).
+ * B58: with `review.external.required` set, a path that owns the project's config is refused
+ * (`config-owned`), as at `block open`.
  * @param {{runId: string, id: string, file: string, writeRow: WriteRow}} opts
  */
 export async function claimPath({ runId, id, file, writeRow }) {
   assertOwned([file]);
   if (!isExactEntry(file)) throw new StateError('bad-owned', `block claim takes one exact path, not a glob (${JSON.stringify(file)})`);
+  const guarded = await guardedConfigPaths(await readRun(runId));
   await mutateRun(runId, id, writeRow, (record, block) => {
     const kinds = { [file]: pathKind(record.workspace, file) };
+    refuseConfigOwner([file], kinds, guarded);
     for (const [otherId, other] of Object.entries(activeBlocks(record))) {
       const pair = otherId === id ? null : findOverlap([file], other.owned_files, { kindsA: kinds, kindsB: other.owned_kinds });
       if (pair) throw new StateError('overlap', `${file} overlaps ${pair[1]} owned by open block ${otherId}`);
@@ -396,15 +441,18 @@ export async function stopBlock({ runId, id, reason, writeRow, event = 'block.st
  * stopped); the block's signed `dispatch` row must exist and verify, and every other
  * gate-relevant row of the block must verify ⇒ else `ledger.tamper` (block stopped); then
  * `extraChecks`; finally, UNDER the run lock, orphans in the registry ⇒ refused (block stays
- * open), else closed.
+ * open), else closed. B58: `closeRows` are signed and written under that same lock just before
+ * `block.close`, and only when the block closes — a row that records why it may close is never
+ * left behind by a refused close.
  * @param {{
  *   runId: string, id: string, rows: Record<string, any>[], writeRow: WriteRow,
  *   livePid?: number, probe?: import('./run.mjs').StartTimeProbe,
  *   extraChecks?: Array<() => Promise<{ok: boolean, reason?: string}>>,
+ *   closeRows?: Record<string, any>[],
  * }} opts
  * @returns {Promise<{ok: boolean, status: 'closed' | 'stopped' | 'open', reason?: string, event?: string}>}
  */
-export async function closeBlock({ runId, id, rows, writeRow, livePid, probe, extraChecks = [] }) {
+export async function closeBlock({ runId, id, rows, writeRow, livePid, probe, extraChecks = [], closeRows = [] }) {
   const record = await readRun(runId);
   if (record.blocks[id]?.status !== 'open') throw new StateError('no-block', `block ${id} is not open in run ${runId}`);
 
@@ -442,6 +490,6 @@ export async function closeBlock({ runId, id, rows, writeRow, livePid, probe, ex
     block.status = 'closed';
     /** @type {CloseResult} */
     const closed = { ok: true, status: 'closed' };
-    return { result: closed, rows: [{ event: 'block.close', block: id, status: 'complete' }] };
+    return { result: closed, rows: [...closeRows, { event: 'block.close', block: id, status: 'complete' }] };
   });
 }

package/src/state/config-snapshot.mjs

@@ -18,6 +18,7 @@
  */
 
 import { createHash } from 'node:crypto';
+import { StateError } from './paths.mjs';
 
 /**
  * Keys that cannot change mid-run, each with why. A change to one is refused by `run reload`
@@ -30,6 +31,9 @@ export const IMMUTABLE_KEYS = Object.freeze({
   'tmp.root': "the worker's run temp root is created at run start",
   keys: 'the worker resolves keys once, at start',
   'system1.key': 'the worker resolves the Jev key once, at start',
+  // B58: the owner's switch past the local per-file review is set before the run starts or not at
+  // all, so nobody turns it on (or off) mid-run
+  'review.external': 'the outside reviewer is fixed by the owner before the run starts',
 });
 
 /** @param {unknown} v @returns {boolean} what `JSON.stringify` drops from an object. */
@@ -148,3 +152,26 @@ export function snapshotFor(record, ticket) {
   if (!isMapping(config) || configHash(config) !== hash) throw new Error('config-snapshot');
   return { hash, config };
 }
+
+/**
+ * B58: the outside reviewer named by the snapshot in force when `review.external.required` is
+ * true; null otherwise (key absent, `required` false, or a record from before snapshots). The key
+ * is immutable ({@link IMMUTABLE_KEYS}), so this is the value `run start` stored.
+ * @param {Record<string, any>} record
+ * @returns {string | null}
+ * @throws {StateError} `config-snapshot` when the snapshot in force does not match its hash.
+ */
+export function externalReviewer(record) {
+  let snap;
+  try {
+    snap = snapshotFor(record, '');
+  } catch (thrown) {
+    if (!(thrown instanceof Error) || thrown.message !== 'config-snapshot') throw thrown;
+    throw new StateError('config-snapshot', `run ${record.run_id}: the config snapshot in force does not match its hash`);
+  }
+  const external = snap?.config.review?.external;
+  if (!isMapping(external) || external.required !== true) return null;
+  // required without a usable name is no switch at all (the schema refuses it; this is the floor)
+  const name = typeof external.name === 'string' ? external.name.trim() : '';
+  return name === '' ? null : name; // trimmed: no row ever carries padding
+}

package/src/state/run.mjs

@@ -16,7 +16,7 @@ import { mkdir, readFile, rename, rmdir, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { exec } from '../util/exec.mjs';
 import { StateError, assertRunId, assertWorkspaceOutsideRuns, mirrorPath, newRunId, runRecordPath, runsDir } from './paths.mjs';
-import { changedKeyPaths, configHash, IMMUTABLE_KEYS, immutableChanges, initialConfigState } from './config-snapshot.mjs';
+import { changedKeyPaths, configHash, externalReviewer, IMMUTABLE_KEYS, immutableChanges, initialConfigState } from './config-snapshot.mjs';
 import { generateKey, loadKey, signRow } from './signer.mjs';
 
 /** @typedef {(row: Record<string, any>) => Promise<unknown>} WriteRow */
@@ -149,6 +149,12 @@ export async function startRun(opts) {
     throw new StateError('bad-project', 'project slug must match /^[a-z0-9][a-z0-9-]*$/ (config key project.slug)');
   }
   const workspace = assertWorkspaceOutsideRuns(opts.workspace);
+  // B58: the schema lets `review.external` stand without a name while `required` is off; on, the
+  // reviewer must be named — refused before anything is written
+  const external = config.review?.external;
+  if (external?.required === true && (typeof external.name !== 'string' || external.name.trim() === '')) {
+    throw new StateError('external-no-name', 'review.external.required is true but review.external.name is missing or blank');
+  }
   const worker = await pinWorker(opts.workerPid, probe);
   const record = {
     version: 1,
@@ -179,6 +185,9 @@ export async function startRun(opts) {
     await generateKey(runId);
     await saveRun(record);
     await writeSigned(runId, writeRow, { event: 'run.start', engine: record.engine, worker_pinned: worker !== null });
+    // B58: the owner's outside reviewer is on the ledger from the first row of the run on
+    const reviewer = externalReviewer(record);
+    if (reviewer !== null) await writeSigned(runId, writeRow, { event: 'review.external', required: true, reviewer });
     return record;
   });
 }
@@ -198,8 +207,8 @@ export async function startRun(opts) {
  * Fixed keys ({@link IMMUTABLE_KEYS}): every one that changed is refused at once
  * (`immutable-key`, nothing written). A record from before snapshots (no `config`) is checked
  * against what it does store: `engine` and the ledger slug (`effectiveSlug`, computed by the
- * caller the same way `run start` did); it then gets its first snapshot, `changed_keys: null`,
- * `old_hash: null`.
+ * caller the same way `run start` did), and B58's `review.external.required` must not turn true;
+ * it then gets its first snapshot, `changed_keys: null`, `old_hash: null`.
  *
  * No change (same hash) ⇒ nothing written, no row. Otherwise the record is saved FIRST (it is the
  * source of truth), then one signed `run.reload` row: the changed key PATHS (never values) and
@@ -238,6 +247,9 @@ export async function reloadRun({ runId, config, readPending = () => [], effecti
       frozen = [];
       if (effectiveSlug !== undefined && effectiveSlug !== current.project) frozen.push('project.slug');
       if (typeof current.engine === 'string' && (config.engine ?? 'auto') !== current.engine) frozen.push('engine');
+      // B58: a run started without the key has none to keep — turning it on now is a change; an
+      // entry that leaves it off (`required` false or absent, as the schema default) is not
+      if (config.review?.external?.required === true) frozen.push('review.external');
     }
     if (frozen.length > 0) {
       const why = frozen.map((key) => `${key} cannot change mid-run (${IMMUTABLE_KEYS[/** @type {keyof typeof IMMUTABLE_KEYS} */ (key)]})`);