@cratis/pi 7.78.0 → 7.79.0

package/package/corpus/agents/code-reviewer.md

@@ -161,21 +161,6 @@ When checking unused code, references, or naming, use semantic navigation if the
 
 ## Output format
 
-Start with a **summary**:
-> **Review result: ✅ Approved / ⚠️ Approved with comments / ❌ Changes requested**
-
-Then list issues grouped by file:
-
-```
-### <file path>
-
-**[BLOCKING]** … or **[SUGGESTION]** …
-> Line N: `problematic code`
-> Because: explanation
-> Fix:
-> ```
-> corrected code
-> ```
-```
-
-End with a checklist of passed / failed items so the developer knows what was verified.
+Read and use `.cratis/ai/rules/review-reports.md` when writing conclusions.
+Apply the domain-specific classification in the Report section of
+`.cratis/ai/skills/cratis-code-review/SKILL.md`.

package/package/corpus/agents/coordinator.md

@@ -143,8 +143,7 @@ For implementation, the applicable changed-lane gates must pass. Mark unrelated
 - [ ] `npx tsc -b` — zero TypeScript errors (if frontend present)
 - [ ] Public-facing changes (clients, SDKs, public APIs) include associated documentation updates
 - [ ] `Documentation/verify-markdown.sh` passes when documentation is added or changed
-- [ ] `code-reviewer` finds no blocking issues
-- [ ] `security-reviewer` finds no vulnerabilities
+- [ ] Code and security reviews approve the scoped change; combine their reports using `.cratis/ai/rules/review-reports.md`, preserving each reviewer's findings and scope limits
 - [ ] PR description follows the pull request template and the release-note contract in `pull-requests.md`; test and review notes are in a PR comment
 
 ---

package/package/corpus/agents/orchestrator.md

@@ -167,8 +167,7 @@ For implementation, the applicable changed-lane gates must pass. Mark unrelated
 - [ ] `npx tsc -b` — zero TypeScript errors (if frontend present)
 - [ ] Public-facing changes (clients, SDKs, public APIs) include associated documentation updates
 - [ ] `Documentation/verify-markdown.sh` passes when documentation is added or changed
-- [ ] `code-reviewer` finds no blocking issues
-- [ ] `security-reviewer` finds no vulnerabilities
+- [ ] Code and security reviews approve the scoped change; combine their reports using `.cratis/ai/rules/review-reports.md`, preserving each reviewer's findings and scope limits
 - [ ] All documentation is complete and accurate (if required)
 - [ ] PR description follows the pull request template and the release-note contract in `pull-requests.md`; test and review notes are in a PR comment
 

package/package/corpus/agents/performance-reviewer.md

@@ -71,39 +71,8 @@ Your responsibility is to identify performance problems in changed code before t
 
 ---
 
-## Risk classification
-
-| Label | Meaning |
-| ------- | --------- |
-| 🔴 High | Will cause measurable degradation at moderate load — must fix before merge |
-| 🟡 Medium | Could degrade under load or at scale — should fix soon |
-| 🟢 Low | Minor inefficiency or style issue — fix when convenient |
-
----
-
 ## Output format
 
-Start with a **summary**:
-> **Performance Review: ✅ No issues / ⚠️ Minor findings / ❌ Blocking issues found**
-
-Group findings by category:
-
-```
-### MongoDB / Read Models
-
-🟡 **Medium** — `<AppSourceRoot>/Projects/Listing/AllProjects.cs`
-> The query does not specify a sort order or index hint, which will result in a
-> collection scan once the `projects` collection grows.
-> Fix: Add `.SortBy(m => m.Name)` and ensure an index on `Name` exists in the
-> MongoDB collection initialization.
-```
-
-End with a summary table:
-
-| Category | Status |
-| ---------- | -------- |
-| Chronicle / Event Sourcing | ✅ / ⚠️ / ❌ |
-| MongoDB / Read Models | ✅ / ⚠️ / ❌ |
-| ASP.NET Core / Commands & Queries | ✅ / ⚠️ / ❌ |
-| React / TypeScript | ✅ / ⚠️ / ❌ |
-| General .NET | ✅ / ⚠️ / ❌ |
+Read and use `.cratis/ai/rules/review-reports.md` when writing conclusions.
+Apply the domain-specific risk mapping in the Report section of
+`.cratis/ai/skills/cratis-performance-review/SKILL.md`.

package/package/corpus/agents/planner.md

@@ -136,9 +136,9 @@ For an implemented application slice, require the applicable changed-lane gates
 - [ ] All TypeScript specs pass (`yarn test`) if applicable
 - [ ] Public-facing changes (clients, SDKs, public APIs) include associated documentation updates
 - [ ] `Documentation/verify-markdown.sh` passes when documentation is added or changed
-- [ ] Code review by `code-reviewer` finds no blocking issues
+- [ ] Code review by `code-reviewer` approves the scoped change using `.cratis/ai/rules/review-reports.md`
 - [ ] In an opted-in repository: `.play` changes were reviewed by `screenplay-reviewer`, and no modeled business rule or model-owned behavior exists only in code (infrastructure, client, adapter, code-attachment/handler code and authorized gap-fill governed by the `.play` slice and specs are allowed)
-- [ ] Security review by `security-reviewer` finds no vulnerabilities
+- [ ] Security review by `security-reviewer` approves the scoped change; combine the review reports using `.cratis/ai/rules/review-reports.md`, preserving each reviewer's findings and scope limits
 - [ ] PR description follows the pull request template and the release-note contract in `pull-requests.md`; test and review notes are in a PR comment
 
 ---

package/package/corpus/agents/repository-investigation-reviewer.md

@@ -42,4 +42,11 @@ You independently review a completed Cratis repository investigation. Your resul
 7. Pre-existing failures are distinguished from failures caused by the investigated behavior.
 8. Failed, missing, or inconclusive evidence remains failed, blocked, or inconclusive.
 
-Return only the requested typed review envelope. Request a bounded correction when a correctable evidence gap exists; otherwise report the exact blocker.
+## Output format
+
+Use `.cratis/ai/rules/review-reports.md` for conclusions, including its
+typed-envelope mapping. Return only the requested typed review
+envelope; preserve its schema and blocked or inconclusive states. A material
+unsupported conclusion or inconsistent repository mode prevents acceptance;
+a non-blocking recommendation is advisory. Request a bounded correction when
+a correctable evidence gap exists; otherwise report the exact blocker.

package/package/corpus/agents/security-reviewer.md

@@ -79,42 +79,8 @@ Your responsibility is to perform a structured **security review** of all change
 
 ---
 
-## Risk classification
-
-Assign each finding one of:
-
-| Label | Meaning |
-|-------|---------|
-| 🔴 Critical | Must be fixed before merge — exploitable without significant effort |
-| 🟡 Medium | Should be fixed soon — exploitable under specific conditions |
-| 🟢 Low | Improvement or defense-in-depth — fix when convenient |
-
----
-
 ## Output format
 
-Start with a **summary**:
-> **Security Review: ✅ No issues / ⚠️ Low-risk findings / ❌ Blocking issues found**
-
-Then list findings grouped by category:
-
-```
-### Input Validation & Injection
-
-🔴 **Critical** — `Projects/Registration/RegisterProject.cs`
-> Line 14: `var path = Path.Combine(root, command.FileName);`
-> A path traversal attack is possible if `FileName` contains `../` sequences.
-> Fix: Validate that the resolved path stays within the expected root directory.
-```
-
-End with a summary table:
-
-| Category | Status |
-|----------|--------|
-| Input Validation | ✅ / ⚠️ / ❌ |
-| Auth / Authz | ✅ / ⚠️ / ❌ |
-| Data Exposure | ✅ / ⚠️ / ❌ |
-| Secrets | ✅ / ⚠️ / ❌ |
-| Dependencies | ✅ / ⚠️ / ❌ |
-| Event Sourcing | ✅ / ⚠️ / ❌ |
-| Frontend | ✅ / ⚠️ / ❌ |
+Read and use `.cratis/ai/rules/review-reports.md` when writing conclusions.
+Apply the domain-specific risk mapping in the Report section of
+`.cratis/ai/skills/cratis-security-review/SKILL.md`.

package/package/corpus/harnesses/copilot/instructions/review-reports.instructions.md

@@ -0,0 +1,68 @@
+---
+applyTo: ".cratis/ai/skills/cratis-code-review/**,.cratis/ai/skills/cratis-security-review/**,.cratis/ai/skills/cratis-performance-review/**,.cratis/ai/agents/**,.cratis/ai/prompts/**"
+paths:
+  - ".cratis/ai/skills/cratis-code-review/**"
+  - ".cratis/ai/skills/cratis-security-review/**"
+  - ".cratis/ai/skills/cratis-performance-review/**"
+  - ".cratis/ai/agents/**"
+  - ".cratis/ai/prompts/**"
+---
+<!-- cratis-ai: generated Copilot instructions. Do not edit; rules/ is the source. -->
+
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Shared review reports
+
+Use this report shape for code, security, performance, and repository-investigation
+reviews. Domain-specific risk labels refine findings, not the report or verdict
+vocabulary. Review the change within the declared scope, not unrelated existing debt.
+
+## Report shape
+
+Keep these sections in order, writing `None` when a section has no entries:
+
+- **Blockers** — findings that must be fixed before merge. Each names a file and
+  line or evidence reference, the problem, its concrete consequence, and a proposed
+  correction. A blocker names a consequence, not a rule number: "returns HTTP 500
+  instead of a validation error" explains harm; "violates rule 4" does not.
+- **Suggestions** — non-blocking improvements, with their benefit and any relevant
+  conditions. Do not turn a preference or a hypothetical risk into a merge gate.
+- **Dismissed (with reason)** — candidate findings considered and rejected, each
+  with the evidence or reasoning for dismissal so another reviewer need not raise
+  it again. Do not invent candidates to populate this section.
+- **Verdict** — one of the values below, scoped to the evidence actually examined.
+
+An empty Blockers section is a valid, complete review. Never manufacture a finding
+to make a review look useful. Reserve **[BLOCKING]** exclusively for
+must-fix-before-merge findings; suggestions and dismissed findings never carry it.
+
+Every review includes a **Not examined:** line naming the paths, surfaces, checks,
+and axes not examined, including anything that could not be reached. Name what was
+not measured: code-shape inspection is not a benchmark, a build is not behavioral
+proof, and an unexamined surface is not verified. State `None` only when the entire
+declared scope was examined; otherwise give concrete limits and remaining checks.
+
+## Verdict vocabulary
+
+| Verdict | Meaning |
+| --- | --- |
+| **Approved** | No blockers or suggestions within the examined scope; required review checks are complete. |
+| **Approved with suggestions** | No blockers; non-blocking suggestions remain and required review checks are complete. |
+| **Changes requested** | At least one blocker must be corrected before merge. |
+| **Incomplete** | No confirmed blocker, but missing or inconclusive required evidence prevents approval. |
+
+Skipped optional axes belong on the Not examined line and do not alone prevent a
+scoped approval. Missing required evidence does. When blockers and evidence gaps
+coexist, use Changes requested and record the gaps on the Not examined line; never
+reinterpret a failed or blocked gate as passing.
+
+When combining reviews, retain one report per reviewer with the shared sections
+and scope line, then give one combined verdict. Any blocker means Changes requested;
+otherwise any Incomplete review means Incomplete; otherwise any remaining suggestion
+means Approved with suggestions; otherwise use Approved. Do not drop dismissals or
+scope limits when combining reports.
+
+When a workflow requires a typed review envelope, preserve its schema and express
+these sections, verdict meanings, and scope limits through its existing fields.
+Do not append a competing Markdown report or invent envelope fields.

package/package/corpus/harnesses/pi/agents/code-reviewer.md

@@ -158,21 +158,6 @@ When checking unused code, references, or naming, use semantic navigation if the
 
 ## Output format
 
-Start with a **summary**:
-> **Review result: ✅ Approved / ⚠️ Approved with comments / ❌ Changes requested**
-
-Then list issues grouped by file:
-
-```
-### <file path>
-
-**[BLOCKING]** … or **[SUGGESTION]** …
-> Line N: `problematic code`
-> Because: explanation
-> Fix:
-> ```
-> corrected code
-> ```
-```
-
-End with a checklist of passed / failed items so the developer knows what was verified.
+Read and use `.cratis/ai/rules/review-reports.md` when writing conclusions.
+Apply the domain-specific classification in the Report section of
+`.cratis/ai/skills/cratis-code-review/SKILL.md`.

package/package/corpus/harnesses/pi/agents/coordinator.md

@@ -139,8 +139,7 @@ For implementation, the applicable changed-lane gates must pass. Mark unrelated
 - [ ] `npx tsc -b` — zero TypeScript errors (if frontend present)
 - [ ] Public-facing changes (clients, SDKs, public APIs) include associated documentation updates
 - [ ] `Documentation/verify-markdown.sh` passes when documentation is added or changed
-- [ ] `code-reviewer` finds no blocking issues
-- [ ] `security-reviewer` finds no vulnerabilities
+- [ ] Code and security reviews approve the scoped change; combine their reports using `.cratis/ai/rules/review-reports.md`, preserving each reviewer's findings and scope limits
 - [ ] PR description follows the pull request template and the release-note contract in `pull-requests.md`; test and review notes are in a PR comment
 
 ---

package/package/corpus/harnesses/pi/agents/orchestrator.md

@@ -163,8 +163,7 @@ For implementation, the applicable changed-lane gates must pass. Mark unrelated
 - [ ] `npx tsc -b` — zero TypeScript errors (if frontend present)
 - [ ] Public-facing changes (clients, SDKs, public APIs) include associated documentation updates
 - [ ] `Documentation/verify-markdown.sh` passes when documentation is added or changed
-- [ ] `code-reviewer` finds no blocking issues
-- [ ] `security-reviewer` finds no vulnerabilities
+- [ ] Code and security reviews approve the scoped change; combine their reports using `.cratis/ai/rules/review-reports.md`, preserving each reviewer's findings and scope limits
 - [ ] All documentation is complete and accurate (if required)
 - [ ] PR description follows the pull request template and the release-note contract in `pull-requests.md`; test and review notes are in a PR comment
 

package/package/corpus/harnesses/pi/agents/performance-reviewer.md

@@ -68,39 +68,8 @@ Your responsibility is to identify performance problems in changed code before t
 
 ---
 
-## Risk classification
-
-| Label | Meaning |
-| ------- | --------- |
-| 🔴 High | Will cause measurable degradation at moderate load — must fix before merge |
-| 🟡 Medium | Could degrade under load or at scale — should fix soon |
-| 🟢 Low | Minor inefficiency or style issue — fix when convenient |
-
----
-
 ## Output format
 
-Start with a **summary**:
-> **Performance Review: ✅ No issues / ⚠️ Minor findings / ❌ Blocking issues found**
-
-Group findings by category:
-
-```
-### MongoDB / Read Models
-
-🟡 **Medium** — `<AppSourceRoot>/Projects/Listing/AllProjects.cs`
-> The query does not specify a sort order or index hint, which will result in a
-> collection scan once the `projects` collection grows.
-> Fix: Add `.SortBy(m => m.Name)` and ensure an index on `Name` exists in the
-> MongoDB collection initialization.
-```
-
-End with a summary table:
-
-| Category | Status |
-| ---------- | -------- |
-| Chronicle / Event Sourcing | ✅ / ⚠️ / ❌ |
-| MongoDB / Read Models | ✅ / ⚠️ / ❌ |
-| ASP.NET Core / Commands & Queries | ✅ / ⚠️ / ❌ |
-| React / TypeScript | ✅ / ⚠️ / ❌ |
-| General .NET | ✅ / ⚠️ / ❌ |
+Read and use `.cratis/ai/rules/review-reports.md` when writing conclusions.
+Apply the domain-specific risk mapping in the Report section of
+`.cratis/ai/skills/cratis-performance-review/SKILL.md`.

package/package/corpus/harnesses/pi/agents/planner.md

@@ -132,9 +132,9 @@ For an implemented application slice, require the applicable changed-lane gates
 - [ ] All TypeScript specs pass (`yarn test`) if applicable
 - [ ] Public-facing changes (clients, SDKs, public APIs) include associated documentation updates
 - [ ] `Documentation/verify-markdown.sh` passes when documentation is added or changed
-- [ ] Code review by `code-reviewer` finds no blocking issues
+- [ ] Code review by `code-reviewer` approves the scoped change using `.cratis/ai/rules/review-reports.md`
 - [ ] In an opted-in repository: `.play` changes were reviewed by `screenplay-reviewer`, and no modeled business rule or model-owned behavior exists only in code (infrastructure, client, adapter, code-attachment/handler code and authorized gap-fill governed by the `.play` slice and specs are allowed)
-- [ ] Security review by `security-reviewer` finds no vulnerabilities
+- [ ] Security review by `security-reviewer` approves the scoped change; combine the review reports using `.cratis/ai/rules/review-reports.md`, preserving each reviewer's findings and scope limits
 - [ ] PR description follows the pull request template and the release-note contract in `pull-requests.md`; test and review notes are in a PR comment
 
 ---

package/package/corpus/harnesses/pi/agents/repository-investigation-reviewer.md

@@ -40,4 +40,11 @@ You independently review a completed Cratis repository investigation. Your resul
 7. Pre-existing failures are distinguished from failures caused by the investigated behavior.
 8. Failed, missing, or inconclusive evidence remains failed, blocked, or inconclusive.
 
-Return only the requested typed review envelope. Request a bounded correction when a correctable evidence gap exists; otherwise report the exact blocker.
+## Output format
+
+Use `.cratis/ai/rules/review-reports.md` for conclusions, including its
+typed-envelope mapping. Return only the requested typed review
+envelope; preserve its schema and blocked or inconclusive states. A material
+unsupported conclusion or inconsistent repository mode prevents acceptance;
+a non-blocking recommendation is advisory. Request a bounded correction when
+a correctable evidence gap exists; otherwise report the exact blocker.

package/package/corpus/harnesses/pi/agents/security-reviewer.md

@@ -76,42 +76,8 @@ Your responsibility is to perform a structured **security review** of all change
 
 ---
 
-## Risk classification
-
-Assign each finding one of:
-
-| Label | Meaning |
-|-------|---------|
-| 🔴 Critical | Must be fixed before merge — exploitable without significant effort |
-| 🟡 Medium | Should be fixed soon — exploitable under specific conditions |
-| 🟢 Low | Improvement or defense-in-depth — fix when convenient |
-
----
-
 ## Output format
 
-Start with a **summary**:
-> **Security Review: ✅ No issues / ⚠️ Low-risk findings / ❌ Blocking issues found**
-
-Then list findings grouped by category:
-
-```
-### Input Validation & Injection
-
-🔴 **Critical** — `Projects/Registration/RegisterProject.cs`
-> Line 14: `var path = Path.Combine(root, command.FileName);`
-> A path traversal attack is possible if `FileName` contains `../` sequences.
-> Fix: Validate that the resolved path stays within the expected root directory.
-```
-
-End with a summary table:
-
-| Category | Status |
-|----------|--------|
-| Input Validation | ✅ / ⚠️ / ❌ |
-| Auth / Authz | ✅ / ⚠️ / ❌ |
-| Data Exposure | ✅ / ⚠️ / ❌ |
-| Secrets | ✅ / ⚠️ / ❌ |
-| Dependencies | ✅ / ⚠️ / ❌ |
-| Event Sourcing | ✅ / ⚠️ / ❌ |
-| Frontend | ✅ / ⚠️ / ❌ |
+Read and use `.cratis/ai/rules/review-reports.md` when writing conclusions.
+Apply the domain-specific risk mapping in the Report section of
+`.cratis/ai/skills/cratis-security-review/SKILL.md`.

package/package/corpus/prompts/code-review.prompt.md

@@ -7,3 +7,4 @@ description: Review a proposed change for correctness, maintainability, and secu
 
 Review the proposed change for correctness, maintainability, and security.
 Focus on actionable findings and minimize false positives.
+Read and use `.cratis/ai/rules/review-reports.md` when writing the report.

package/package/corpus/prompts/review-pr.prompt.md

@@ -21,15 +21,11 @@ Produce a structured review of a pull request against all Cratis standards.
 
 ## Output
 
-```
-## Pull Request Review — #<number>
-### Summary — <2–3 sentences>
-### Architecture & Quality — ✅ / ⚠️ / ❌   <findings>
-### Security — ✅ / ⚠️ / ❌   <findings>
-### Spec Coverage — ✅ / ⚠️ / ❌
-### Documentation — ✅ / ⚠️ / ❌
-### Overall — ✅ Approved / ⚠️ Approved with comments / ❌ Changes requested
-**Blocking** (violates a MUST): 1. …    **Suggestions**: 1. …
-```
-
-Be specific — file, line, and corrected code for every blocking issue.
+Read and use `.cratis/ai/rules/review-reports.md` before writing the report.
+Open with the PR number and a short summary. Keep one report per reviewer using
+the shared Blockers / Suggestions / Dismissed (with reason) / Verdict sections
+and Not examined line. Include specification-coverage and documentation checks
+in the relevant reviewer's scope, with any missing evidence made explicit.
+
+End with one **Combined verdict** using the shared aggregation rule, preserving
+each reviewer's findings, dismissals, and scope limits.

package/package/corpus/prompts/review-skill.prompt.md

@@ -9,6 +9,6 @@ Read [authoring-skills.md](../rules/authoring-skills.md), then apply its section
 checklist to the requested skill folder under `.cratis/ai/skills/`. Check routing
 against neighboring skills and workflow correctness against the owning product.
 
-Report blocking findings separately from suggestions, with the file and concrete
-consequence. Name any evaluation runs or verification not performed. Return findings
-first, then proposed edits; do not edit during the review.
+Read and use `.cratis/ai/rules/review-reports.md` when writing the report.
+Name any evaluation runs or verification not performed on the scope line.
+Include proposed edits with the findings; do not edit during the review.

package/package/corpus/rules/general.md

@@ -161,6 +161,7 @@ A claim is only as good as the signal behind it — a build result, a test run,
 | Reviewing or explaining a `.play` model | the **cratis-screenplay-model-review** skill |
 | Turning an existing system into a model | the **cratis-screenplay-legacy-extraction** skill |
 | Rendering or gap-filling an accepted model | the **cratis-screenplay-render-and-gap-fill** skill, then **cratis-stage-rendering-and-sandbox** for renderer facts |
+| Code, security, performance and repository-investigation review reports | `review-reports.md` |
 | Authoring or reviewing skills, rules, agents or prompts | `authoring-skills.md` |
 | Step-by-step recipes | `.cratis/ai/skills/` |
 

package/package/corpus/rules/review-reports.md

@@ -0,0 +1,67 @@
+---
+applyTo: ".cratis/ai/skills/cratis-code-review/**,.cratis/ai/skills/cratis-security-review/**,.cratis/ai/skills/cratis-performance-review/**,.cratis/ai/agents/**,.cratis/ai/prompts/**"
+paths:
+  - ".cratis/ai/skills/cratis-code-review/**"
+  - ".cratis/ai/skills/cratis-security-review/**"
+  - ".cratis/ai/skills/cratis-performance-review/**"
+  - ".cratis/ai/agents/**"
+  - ".cratis/ai/prompts/**"
+---
+
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Shared review reports
+
+Use this report shape for code, security, performance, and repository-investigation
+reviews. Domain-specific risk labels refine findings, not the report or verdict
+vocabulary. Review the change within the declared scope, not unrelated existing debt.
+
+## Report shape
+
+Keep these sections in order, writing `None` when a section has no entries:
+
+- **Blockers** — findings that must be fixed before merge. Each names a file and
+  line or evidence reference, the problem, its concrete consequence, and a proposed
+  correction. A blocker names a consequence, not a rule number: "returns HTTP 500
+  instead of a validation error" explains harm; "violates rule 4" does not.
+- **Suggestions** — non-blocking improvements, with their benefit and any relevant
+  conditions. Do not turn a preference or a hypothetical risk into a merge gate.
+- **Dismissed (with reason)** — candidate findings considered and rejected, each
+  with the evidence or reasoning for dismissal so another reviewer need not raise
+  it again. Do not invent candidates to populate this section.
+- **Verdict** — one of the values below, scoped to the evidence actually examined.
+
+An empty Blockers section is a valid, complete review. Never manufacture a finding
+to make a review look useful. Reserve **[BLOCKING]** exclusively for
+must-fix-before-merge findings; suggestions and dismissed findings never carry it.
+
+Every review includes a **Not examined:** line naming the paths, surfaces, checks,
+and axes not examined, including anything that could not be reached. Name what was
+not measured: code-shape inspection is not a benchmark, a build is not behavioral
+proof, and an unexamined surface is not verified. State `None` only when the entire
+declared scope was examined; otherwise give concrete limits and remaining checks.
+
+## Verdict vocabulary
+
+| Verdict | Meaning |
+| --- | --- |
+| **Approved** | No blockers or suggestions within the examined scope; required review checks are complete. |
+| **Approved with suggestions** | No blockers; non-blocking suggestions remain and required review checks are complete. |
+| **Changes requested** | At least one blocker must be corrected before merge. |
+| **Incomplete** | No confirmed blocker, but missing or inconclusive required evidence prevents approval. |
+
+Skipped optional axes belong on the Not examined line and do not alone prevent a
+scoped approval. Missing required evidence does. When blockers and evidence gaps
+coexist, use Changes requested and record the gaps on the Not examined line; never
+reinterpret a failed or blocked gate as passing.
+
+When combining reviews, retain one report per reviewer with the shared sections
+and scope line, then give one combined verdict. Any blocker means Changes requested;
+otherwise any Incomplete review means Incomplete; otherwise any remaining suggestion
+means Approved with suggestions; otherwise use Approved. Do not drop dismissals or
+scope limits when combining reports.
+
+When a workflow requires a typed review envelope, preserve its schema and express
+these sections, verdict meanings, and scope limits through its existing fields.
+Do not append a competing Markdown report or invent envelope fields.

package/package/corpus/skills/cratis-code-review/SKILL.md

@@ -169,28 +169,13 @@ degradations a reviewer can see without measuring:
 
 ## Step 7 — Report
 
-Open with one line:
+Read and use `.cratis/ai/rules/review-reports.md` when writing the report.
 
-> **Review result: Approved / Approved with comments / Changes requested**
-
-Then, per file:
-
-```
-### <file path>
-
-**[BLOCKING]** Line N: `problematic code`
-Because: <the consequence, not the rule number>
-Fix:
-<corrected code>
-```
-
-Close with what passed and what must change. Two rules make the report usable:
-
-- **A blocking finding names a consequence.** "Violates the style guide" is not
-  a reason. "Throws on a recoverable path, so the caller sees a 500 instead of a
-  validation error" is.
-- **Say what you did not review.** A report listing only findings reads as if
-  everything was checked. Name the files, the paths, and the axes you skipped.
+Correctness regressions, broken contracts, and missing specification coverage
+that leaves changed behavior unverified belong in Blockers when they require
+correction before merge. Style preferences and maintainability improvements
+without such a consequence belong in Suggestions. Apply the shared verdict
+vocabulary to those findings.
 
 ## What breaks
 

package/package/corpus/skills/cratis-code-review/verification.json

@@ -0,0 +1,10 @@
+{
+  "skill": "cratis-code-review",
+  "input": "Report a code review with no blockers and one non-blocking maintainability suggestion.",
+  "fixtures": [],
+  "assertions": [
+    { "kind": "skill-contains", "value": ".cratis/ai/rules/review-reports.md" },
+    { "kind": "skill-contains", "value": "Correctness regressions, broken contracts" },
+    { "kind": "skill-contains", "value": "Style preferences and maintainability improvements" }
+  ]
+}

package/package/corpus/skills/cratis-performance-review/SKILL.md

@@ -121,25 +121,23 @@ behavior this file does not already state.
 
 ## Step 6 — Report
 
-Open with one line:
+Read and use `.cratis/ai/rules/review-reports.md` when writing the report.
+Keep the performance risk label on each finding:
 
-> **Performance review: No issues / Minor findings / Blocking issues found**
-
-Group findings by the section that produced them, and classify each:
-
-| Risk | Meaning |
+| Risk | Shared classification |
 | --- | --- |
-| **High** | Measurable degradation at moderate load — fix before merge |
-| **Medium** | Degrades under load or as data grows |
-| **Low** | Minor inefficiency |
+| **High** | Blockers: degradation at moderate load requiring correction before merge |
+| **Medium** | Suggestions: degradation under load or as data grows |
+| **Low** | Suggestions: minor inefficiency |
 
-Close with a per-section summary table.
+Use the shared verdict vocabulary, not a separate performance verdict. If a
+scale-dependent degradation must be corrected before merge, classify it as High
+and state the relevant scale rather than leaving a blocker under Medium.
 
 **Say what the finding costs and at what scale.** "This is slow" is not
 actionable; "this scans the whole collection on every page load, so it is fine
-at hundreds of rows and not at tens of thousands" is. And **name what you did
-not measure** — a review of code shape is not a benchmark, and reporting it as
-one overstates the evidence.
+at hundreds of rows and not at tens of thousands" is. Distinguish measured cost
+from code-shape inference; use the shared scope line to name unmeasured behavior.
 
 ## What breaks
 

package/package/corpus/skills/cratis-performance-review/verification.json

@@ -0,0 +1,12 @@
+{
+  "skill": "cratis-performance-review",
+  "input": "Report performance risks from code inspection without presenting unmeasured cost as a benchmark.",
+  "fixtures": [],
+  "assertions": [
+    { "kind": "skill-contains", "value": ".cratis/ai/rules/review-reports.md" },
+    { "kind": "skill-contains", "value": "**High** | Blockers:" },
+    { "kind": "skill-contains", "value": "**Medium** | Suggestions:" },
+    { "kind": "skill-contains", "value": "**Low** | Suggestions:" },
+    { "kind": "skill-contains", "value": "Distinguish measured cost" }
+  ]
+}

package/package/corpus/skills/cratis-security-review/SKILL.md

@@ -129,21 +129,18 @@ command's properties as well as grepping them.
 
 ## Step 7 — Report
 
-Open with one line:
+Read and use `.cratis/ai/rules/review-reports.md` when writing the report.
+Keep the security risk label on each finding:
 
-> **Security review: No issues / Low-risk findings / Blocking issues found**
-
-Group findings by the section that produced them, and classify each:
-
-| Risk | Meaning |
+| Risk | Shared classification |
 | --- | --- |
-| **Critical** | Must be fixed before merge |
-| **Medium** | Should be fixed soon; state what makes it not-critical |
-| **Low** | Fix when convenient |
+| **Critical** | Blockers: exploitable exposure requiring correction before merge |
+| **Medium** | Suggestions: conditional exposure; state what makes it non-critical |
+| **Low** | Suggestions: defense-in-depth improvement |
 
-Close with a per-section summary table, and **name what you did not review** —
-the paths, the surfaces, and the axes out of scope. A security report listing
-only findings reads as a clean bill of health for everything it never opened.
+Use the shared verdict vocabulary, not a separate security verdict. If a
+conditional exposure must be corrected before merge, classify it as Critical
+and explain the exploit conditions rather than leaving a blocker under Medium.
 
 ## What breaks
 

package/package/corpus/skills/cratis-security-review/verification.json

@@ -0,0 +1,11 @@
+{
+  "skill": "cratis-security-review",
+  "input": "Report security risks using the shared report and distinguish conditional exposure from a merge blocker.",
+  "fixtures": [],
+  "assertions": [
+    { "kind": "skill-contains", "value": ".cratis/ai/rules/review-reports.md" },
+    { "kind": "skill-contains", "value": "**Critical** | Blockers:" },
+    { "kind": "skill-contains", "value": "**Medium** | Suggestions:" },
+    { "kind": "skill-contains", "value": "**Low** | Suggestions:" }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.78.0",
+  "version": "7.79.0",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [