@delorenj/pjangler 1.3.7 → 1.4.3

package/templates/hermes-agent/template/.scripts/providers/plane.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env sh
 # Plane ticket-provider adapter.
 #
-# Credentials:  PLANE_API_KEY or PLANE_<WORKSPACE>_API_KEY (X-API-Key header)
+# Credentials:  PLANE_API_KEY or PLANE_<WORKSPACE>_API_KEY (raw at runtime or
+#               an op:// reference resolved immediately before use)
 # Endpoint:     PLANE_BASE       (default https://plane.delo.sh)
 # Board binding (repo-root .project.json `ticket_provider:`):
 #   workspace: <workspace-slug>      (or env PLANE_WORKSPACE)
@@ -59,6 +60,20 @@ print(value, end="")
 PY
 }
 
+# Resolve an approved secret reference only after selecting the exact provider
+# key. The shared dotenv stays inert and the resolved value exists only in this
+# provider process.
+resolve_secret_value() {
+  value="${1:-}"
+  case "$value" in
+    op://*)
+      command -v op >/dev/null 2>&1 || die "1Password CLI is required for the configured Plane credential"
+      op read "$value" || die "failed to resolve the configured Plane credential"
+      ;;
+    *) printf '%s' "$value" ;;
+  esac
+}
+
 tp_cfg() {
   [ -f "$ROLE_YAML" ] || return 0
   python3 - "$ROLE_YAML" "$1" <<'PY'
@@ -103,8 +118,9 @@ if [ -z "${PLANE_API_KEY:-}" ]; then
   if [ -z "${PLANE_API_KEY:-}" ] && [ -f "$FLEET_ENV" ]; then
     PLANE_API_KEY="$(dotenv_value "$FLEET_ENV" "$KEY")"
   fi
-  export PLANE_API_KEY
 fi
+PLANE_API_KEY="$(resolve_secret_value "${PLANE_API_KEY:-}")"
+export PLANE_API_KEY
 
 # api METHOD PATH [JSON_BODY] — call Plane REST, print response body.
 api() {
@@ -144,15 +160,21 @@ pick=(named or grouped or [{}])[0]
 print(pick.get("id",""))'
 }
 
-# All Plane ops require the API key; fail fast and clean before any pipe.
-need_key
+# All Plane ops except the explicit-workspace read below require the bound
+# workspace API key; fail fast and clean before any pipe.
+case "$OP" in describe_board) ;; *) need_key ;; esac
 
 case "$OP" in
   resolve)
     [ -n "$WS" ] || die "workspace not set (.project.json ticket_provider.workspace or PLANE_WORKSPACE)"
     [ -n "$PROJ" ] || die "project not set (.project.json ticket_provider.board_id; run 42-ticket-provider.sh)"
-    printf '{"provider":"plane","board_id":"%s","board_url":"%s/%s/projects/%s/issues/"}\n' \
-      "$PROJ" "$BASE" "$WS" "$PROJ"
+    PROJECT_DETAIL="$(api GET "projects/$PROJ/")"
+    LIVE_IDENTIFIER="$(printf '%s' "$PROJECT_DETAIL" | python3 -c 'import sys,json
+try: print(str(json.load(sys.stdin).get("identifier") or ""))
+except Exception: print("")')"
+    [ -n "$LIVE_IDENTIFIER" ] || die "live Plane project omitted its authoritative identifier"
+    printf '{"provider":"plane","board_id":"%s","board_url":"%s/%s/projects/%s/issues/","identifier":"%s"}\n' \
+      "$PROJ" "$BASE" "$WS" "$PROJ" "$LIVE_IDENTIFIER"
     ;;
 
   active_milestone)
@@ -236,6 +258,36 @@ print(json.dumps({"id":i.get("id",""),"key":i.get("sequence_id",""),"title":i.ge
       | python3 -c 'import sys,json; d=json.load(sys.stdin); print("ok "+str(d.get("sequence_id","")) )'
     ;;
 
+  describe_board)
+    # Read-only board lookup against an EXPLICIT workspace argument, so the
+    # .project.json / role.yaml / env workspace precedence can never silently
+    # query the wrong workspace. Emits Plane's own identifier, never a guess.
+    DWS="${1:?usage: describe_board <workspace> <board_id>}"
+    DBID="${2:?usage: describe_board <workspace> <board_id>}"
+    DKEYVAR="$(workspace_key "$DWS")"
+    DKEY="$(printenv "$DKEYVAR" 2>/dev/null || true)"
+    if [ -z "$DKEY" ] && [ -f "$FLEET_ENV" ]; then
+      DKEY="$(dotenv_value "$FLEET_ENV" "$DKEYVAR")"
+    fi
+    [ -n "$DKEY" ] || DKEY="${PLANE_API_KEY:-}"
+    DKEY="$(resolve_secret_value "$DKEY")"
+    [ -n "$DKEY" ] || die "no Plane API key for workspace '$DWS' (looked for $DKEYVAR)"
+    DETAIL="$(curl -fsS "$BASE/api/v1/workspaces/$DWS/projects/$DBID/" \
+      -H "X-API-Key: $DKEY" -H "User-Agent: curl/8.0")" \
+      || die "describe_board failed for $DWS/$DBID"
+    printf '%s' "$DETAIL" | WS="$DWS" BID="$DBID" python3 -c 'import sys, json, os
+d = json.load(sys.stdin)
+ident = str(d.get("identifier") or "")
+if not ident:
+    raise SystemExit("plane: live Plane project omitted its authoritative identifier")
+print(json.dumps({
+    "board_id": str(d.get("id") or os.environ["BID"]),
+    "identifier": ident,
+    "workspace": os.environ["WS"],
+    "name": str(d.get("name") or ""),
+}))'
+    ;;
+
   create_board)
     NAME="${1:?usage: create_board <name> <ident> <desc>}"; IDENT="${2:-}"; DESC="${3:-}"
     [ -n "$WS" ] || die "workspace not set"
@@ -249,13 +301,23 @@ pid=next((p["id"] for p in rows if str(p.get("name","")).strip().lower()==name),
 if not pid and ident:
     pid=next((p["id"] for p in rows if (p.get("identifier") or "").upper()==ident), "")
 print(pid)')"
+    LIVE_IDENTIFIER=""
     if [ -n "$EXIST" ]; then PID="$EXIST"; else
-      PID="$(api POST "projects/" \
-        "$(python3 -c 'import json,sys; print(json.dumps({"name":sys.argv[1],"identifier":sys.argv[2],"description":sys.argv[3]}))' "$NAME" "$IDENT" "$DESC")" \
-        | python3 -c 'import sys,json; print(json.load(sys.stdin).get("id",""))')"
+      CREATED="$(api POST "projects/" \
+        "$(python3 -c 'import json,sys; print(json.dumps({"name":sys.argv[1],"identifier":sys.argv[2],"description":sys.argv[3]}))' "$NAME" "$IDENT" "$DESC")")"
+      PID="$(printf '%s' "$CREATED" | python3 -c 'import sys,json; print(json.load(sys.stdin).get("id",""))')"
+      LIVE_IDENTIFIER="$(printf '%s' "$CREATED" | python3 -c 'import sys,json; print(json.load(sys.stdin).get("identifier","") or "")')"
     fi
     [ -n "$PID" ] || die "create_board failed"
-    printf '{"board_id":"%s","board_url":"%s/%s/projects/%s/issues/"}\n' "$PID" "$BASE" "$WS" "$PID"
+    if [ -z "$LIVE_IDENTIFIER" ]; then
+      DETAIL="$(api GET "projects/$PID/")"
+      LIVE_IDENTIFIER="$(printf '%s' "$DETAIL" | python3 -c 'import sys,json
+try: print(str(json.load(sys.stdin).get("identifier") or ""))
+except Exception: print("")')"
+    fi
+    [ -n "$LIVE_IDENTIFIER" ] || die "live Plane project omitted its authoritative identifier"
+    printf '{"board_id":"%s","board_url":"%s/%s/projects/%s/issues/","identifier":"%s"}\n' \
+      "$PID" "$BASE" "$WS" "$PID" "$LIVE_IDENTIFIER"
     ;;
 
   create_issue)

package/templates/hermes-agent/template/.scripts/providers/trello.sh

@@ -144,6 +144,25 @@ print(json.dumps({"id":c.get("id",""),"key":c.get("id",""),"title":c.get("name",
     api PUT "cards/$ID" "idList=$LID" | python3 -c 'import sys,json; c=json.load(sys.stdin); print("ok "+c.get("id",""))'
     ;;
 
+  describe_board)
+    # Read-only board lookup against an EXPLICIT workspace argument, mirroring
+    # the Plane op, so no ambient binding can send the query somewhere else.
+    # Trello mints NO project key, so `identifier` is ALWAYS empty here: an
+    # empty identifier is this provider's authoritative answer, not a lookup
+    # failure, and callers must never promote it to a confirmed value.
+    DWS="${1:?usage: describe_board <workspace> <board_id>}"
+    DBID="${2:?usage: describe_board <workspace> <board_id>}"
+    api GET "boards/$DBID" "fields=id,name,idOrganization" \
+      | WS="$DWS" BID="$DBID" python3 -c 'import sys, json, os
+b = json.load(sys.stdin)
+print(json.dumps({
+    "board_id": str(b.get("id") or os.environ["BID"]),
+    "identifier": "",
+    "workspace": str(b.get("idOrganization") or os.environ["WS"]),
+    "name": str(b.get("name") or ""),
+}))'
+    ;;
+
   create_board)
     NAME="${1:?usage: create_board <name> <ident> <desc>}"
     EXIST="$(api GET "members/me/boards" "fields=name" | NM="$NAME" python3 -c 'import sys,json,os
@@ -154,8 +173,12 @@ print(next((b["id"] for b in rows if b.get("name","").lower()==nm), ""))')"
         | python3 -c 'import sys,json; print(json.load(sys.stdin).get("id",""))')"
     fi
     [ -n "$BID" ] || die "create_board failed"
-    api GET "boards/$BID" "fields=url" | BID="$BID" python3 -c 'import sys,json,os
-b=json.load(sys.stdin); print(json.dumps({"board_id":os.environ["BID"],"board_url":b.get("url","")}))'
+    # Trello assigns no project key, so the caller's prefix IS the identity and
+    # this adapter is the only thing that can confirm it. Echo it back: the
+    # create_board envelope always carries the identifier the board is bound
+    # under, so no caller ever has to invent one.
+    api GET "boards/$BID" "fields=url" | BID="$BID" IDENT="${2:-}" python3 -c 'import sys,json,os
+b=json.load(sys.stdin); print(json.dumps({"board_id":os.environ["BID"],"board_url":b.get("url",""),"identifier":os.environ.get("IDENT","")}))'
     ;;
 
   create_issue)

package/templates/hermes-agent/template/.scripts/sentinel/bin/issue-autonomous-review.sh

@@ -2,8 +2,8 @@
 # Provider-agnostic autonomous adversarial-review decision gate (act, don't wait).
 #
 # The rigorous, INDEPENDENT ADVERSARIAL review is the normal per-pass path: an
-# adversarial microscope that couples the close gate, an independent-reviewer
-# drift attestation, and the BloodBank decision event. A clean adversarial
+# adversarial microscope that couples the close gate with an independent-reviewer
+# drift attestation. A clean adversarial
 # verdict is acted on AUTONOMOUSLY -- the loop treats the ticket as done and
 # moves on; it never parks the ticket waiting on the operator for approval or
 # sign-off. Every adversarial check stays at full strength (locked-intent
@@ -40,17 +40,14 @@ ROLE_YAML="$ROLE_DIR/role.yaml"
 ROOT="$(git -C "$ROLE_DIR" rev-parse --show-toplevel 2>/dev/null || pwd)"
 cd "$ROOT"
 
-EMIT="$BIN_DIR/emit-event.py"
 CLOSE_GATE="$BIN_DIR/issue-close-gate.sh"
 EVIDENCE="_bmad-output/implementation-artifacts/issue-evidence/$ISSUE.md"
 
 yget() { sed -n "s/^[[:space:]]*$1:[[:space:]]*//p" "$ROLE_YAML" 2>/dev/null | head -n1 | tr -d '"' | tr -d '\r'; }
-REPO="$(yget repo)"; REPO="${REPO:-unknown}"
-# Informational only: recorded in the decision event/comment, never a blocking
-# wait. Default 0 (no grace); an operator may set grace_hours>0 to reintroduce one.
+# Informational only: recorded in the ticket comment, never a blocking wait.
+# Default 0 (no grace); an operator may set grace_hours>0 to reintroduce one.
 GRACE_HOURS="${RECONCILE_GRACE_HOURS:-$(yget grace_hours)}"; GRACE_HOURS="${GRACE_HOURS:-0}"
 AUTO="$(yget auto_review)"; AUTO="${AUTO:-true}"
-EVT="bloodbank.v1.repo.$REPO.issue.autonomous_review.decided"
 
 if [[ "${RECONCILE_AUTO_REVIEW:-$AUTO}" == "false" || "${RECONCILE_AUTO_REVIEW:-}" == "off" ]]; then
   printf 'Autonomous review is disabled (reconcile.auto_review=false).\n' >&2; exit 3
@@ -85,14 +82,6 @@ if sh "$CLOSE_GATE" "$ISSUE" "$ROOT" >/dev/null 2>&1 </dev/null; then GATE=pass;
 
 if [[ -n "$HOLD" ]]; then DECISION=held; else DECISION=accepted; fi
 
-python3 "$EMIT" "$EVT" --root "$ROOT" \
-  --source "repo://sentinel/bin/issue-autonomous-review.sh" --actor-id "$REVIEWER" \
-  --field issue="$ISSUE" --field decision="$DECISION" --field drift="$DRIFT" \
-  --field close_gate="$GATE" --field reviewer_agent="$REVIEWER" \
-  --field evidence_file="$EVIDENCE" --field report_file="$REPORT" \
-  --field grace_hours="$GRACE_HOURS" --field hold_reasons="${HOLD:-none}" \
-  --quiet </dev/null || printf 'WARN: decision event emission failed; event trail incomplete.\n' >&2
-
 if [[ "$DECISION" == "held" ]]; then
   printf 'AUTONOMOUS REVIEW: HOLD for %s\nReasons: %s\n' "$ISSUE" "$HOLD" >&2
   exit 3
@@ -109,7 +98,7 @@ if [[ "$CLOSE" -eq 1 ]]; then
     TICKET_PROVIDER="$PROV" bash -c '. "$1"; tp comment "$2" "$3"' _ "$SCRIPTS_DIR/lib/ticket-provider.sh" "$ISSUE" \
       "Autonomously accepted by $REVIEWER under the independent adversarial-review protocol (drift: $DRIFT, gate: $GATE, grace ${GRACE_HOURS}h informational). Treated as done; review report: $REPORT." >/dev/null 2>&1 || true
   else
-    printf 'Adapter transition failed; decision event recorded, issue left open.\n' >&2
+    printf 'Adapter transition failed; issue left open.\n' >&2
     exit 1
   fi
 else

package/templates/hermes-agent/template/.scripts/sentinel/bin/issue-close-gate.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 # Provider-agnostic close gate. Verifies an issue's evidence file is complete
-# before any closure (manual or autonomous). Repo name is read from role.yaml so
-# event types carry the right repo lane.
+# before any closure (manual or autonomous). Pure gate: it reports PASS/FAIL on
+# stdout/stderr and via the exit code, and publishes nothing.
 #
 # Usage: issue-close-gate.sh ISSUE_ID [REPO_ROOT]
 set -eu
@@ -13,17 +13,9 @@ fi
 ISSUE="$1"
 case "$ISSUE" in *[!A-Za-z0-9_-]*) printf 'Invalid issue id: %s\n' "$ISSUE" >&2; exit 2 ;; esac
 
-BIN_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
-ROLE_DIR="$(cd "$BIN_DIR/../../.." && pwd)"
-ROLE_YAML="$ROLE_DIR/role.yaml"
-EMIT="$BIN_DIR/emit-event.py"
 ROOT="${2:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
 cd "$ROOT"
 
-REPO="$(sed -n 's/^repo:[[:space:]]*//p' "$ROLE_YAML" 2>/dev/null | head -n1 | tr -d '"' | tr -d '\r')"
-REPO="${REPO:-unknown}"
-EVT_PREFIX="bloodbank.v1.repo.$REPO.issue"
-
 FILE="_bmad-output/implementation-artifacts/issue-evidence/$ISSUE.md"
 FAIL=0
 check() { grep -q "$1" "$FILE" || { printf 'Missing required evidence: %s\n' "$2" >&2; FAIL=1; }; }
@@ -49,14 +41,8 @@ grep -q 'Ledger updated: yes' "$FILE" || { printf 'Ledger update is not marked y
 grep -q 'Close recommendation: ready' "$FILE" || { printf 'Close recommendation is not ready.\n' >&2; FAIL=1; }
 
 if [ "$FAIL" -ne 0 ]; then
-  python3 "$EMIT" "$EVT_PREFIX.gate.failed" --root "$ROOT" \
-    --source "repo://sentinel/bin/issue-close-gate.sh" \
-    --field issue="$ISSUE" --field evidence_file="$FILE" --quiet </dev/null || true
   printf '\nCLOSE GATE: FAIL for %s\n' "$ISSUE" >&2
   exit 1
 fi
 
-python3 "$EMIT" "$EVT_PREFIX.gate.passed" --root "$ROOT" \
-  --source "repo://sentinel/bin/issue-close-gate.sh" \
-  --field issue="$ISSUE" --field evidence_file="$FILE" --quiet </dev/null || true
 printf 'CLOSE GATE: PASS for %s\n' "$ISSUE"

package/templates/hermes-agent/template/.scripts/sentinel/docs/autonomous-delegated-review.md

@@ -112,29 +112,23 @@ loop:
 .scripts/sentinel/bin/issue-autonomous-review.sh <ISSUE> <REPORT> --close
 ```
 
-## Decision event
+## Decision record
 
-```text
-bloodbank.v1.repo.<repo>.issue.autonomous_review.decided
-```
-
-Required data: `issue`, `decision` (`accepted | held`), `drift`, `close_gate`,
-`reviewer_agent`, `evidence_file`, `report_file`. See `bloodbank-events.md`.
+The verdict is carried by the script's exit code (`0` accepted, `3` held) and
+its stdout/stderr, plus the review report and the ticket comment it posts. The
+durable accountability trail is the review report + evidence file in the repo.
+No event is published; see `bloodbank-events.md` for why the old
+`repo.issue.*` family was retired.
 
 ## Downstream regression rollback
 
 Deferring operator QA means a later dependent can prove a review-accepted
 feature is ACTUALLY BROKEN. When that happens, move the accepted ticket back to
 active (`started` if a worker takes it now, else `unstarted`) as a PREREQUISITE
-of the dependent, via the adapter (`tp transition <id> <state>`); comment naming
-the dependent + symptom; and emit:
-
-```text
-bloodbank.v1.repo.<repo>.issue.review_rollback.recorded
-```
-
-Required data: `issue`, `surfaced_by`, `reason`. The dependent is blocked on the
-prerequisite until it is fixed. This is expected and healthy — it is the trade
+of the dependent, via the adapter (`tp transition <id> <state>`), and comment
+naming the dependent + symptom. Record the rollback in the ticket comment and
+the issue evidence file. The dependent is blocked on the prerequisite until it
+is fixed. This is expected and healthy — it is the trade
 for deferring operator QA, not a failure.
 
 ## Review report shape
@@ -163,6 +157,6 @@ Write `<ISSUE>.review.md`; the script validates it:
 ## Operator override
 
 `reconcile.auto_review: false` (role.yaml) or `RECONCILE_AUTO_REVIEW=off`
-disables autonomous acceptance. Autonomous acceptances are fully traceable via
-the decision events in
-`_bmad-output/implementation-artifacts/bloodbank-events.jsonl`.
+disables autonomous acceptance. Autonomous acceptances are traceable via the
+review report, the issue evidence file, and the ticket comment the script
+posts.

package/templates/hermes-agent/template/.scripts/sentinel/docs/bloodbank-events.md

@@ -4,46 +4,39 @@ Status: Sentinel engine protocol (provider-agnostic)
 
 ## Purpose
 
-Local workflow events are the machine-readable timeline of the sentinel loop.
-The board remains the human command center; issue evidence files remain the
-close gate; this JSONL spool lets Hermes, dashboards, and future agents observe
-what happened.
+The board remains the human command center and issue evidence files remain the
+close gate. Neither depends on an event trail: `bin/issue-close-gate.sh` and
+`bin/issue-autonomous-review.sh` report their verdicts on stdout/stderr and via
+their exit codes, and publish nothing.
+
+The `repo.issue.*` family the sentinel loop used to mint was retired on
+2026-08-28. It was never published to NATS and never consumed by anything, and
+its shape was invalid twice over: it embedded the repo slug inside the type
+(`bloodbank.v1.repo.<repo>.issue.…`) and `issue` is not in the Bloodbank §7
+entity allowlist. There is no correct version of it to migrate to, so it is
+gone rather than renamed.
 
 ## Emitter
 
+`bin/emit-event.py` stays as a dependency-free local emitter for a family a
+future pass genuinely needs:
+
 ```bash
 .scripts/sentinel/bin/emit-event.py <event_type> --field key=value [...]
 ```
 
-Appends to `_bmad-output/implementation-artifacts/bloodbank-events.jsonl`
-(git-ignored dev spool) using the Hermes CloudEvents envelope shape. Event types
-use the project repo lane `bloodbank.v1.repo.<repo>.<entity>.<action>`, where
-`<repo>` comes from `role.yaml`.
-
-## Event types
-
-| Event type | When | Required data |
-| --- | --- | --- |
-| `…repo.<repo>.issue.evidence.created` | Evidence file created | `issue`, `evidence_file` |
-| `…repo.<repo>.issue.gate.passed` | Close gate passes | `issue`, `evidence_file` |
-| `…repo.<repo>.issue.gate.failed` | Close gate fails | `issue`, `evidence_file` |
-| `…repo.<repo>.issue.autonomous_review.decided` | An independent adversarial review clears a review-lane ticket; the loop acts on the verdict autonomously and treats `accepted` tickets as done (left in the review lane) | `issue`, `decision` (`accepted`/`held`), `drift`, `close_gate`, `reviewer_agent`, `evidence_file`, `report_file` |
-| `…repo.<repo>.issue.review_rollback.recorded` | A review-accepted ticket is moved back to active because a dependent proved it broken | `issue`, `surfaced_by`, `reason` |
-| `…repo.<repo>.issue.truthcheck.flagged` | Status/evidence mismatch found | `issue`, `reason` |
-
-## Rules
-
-- Emit events for consequential transitions; do not invent types casually.
-- Event emission never replaces the board update or issue evidence.
-- If emission fails, continue and report the trail is incomplete.
-- Autonomous acceptance is legitimate only when
-  `issue.autonomous_review.decided` is emitted with `decision=accepted` and
-  `close_gate=pass` by `bin/issue-autonomous-review.sh`. That script will not
-  emit an `accepted` decision while the close gate fails or drift is `significant`.
-
-## Canonical BloodBank
-
-These project-local repo-lane events are BloodBank-*style*. Promote a type to a
-canonical NATS subject only after adding its JSON Schema to the BloodBank schema
-tree and passing validation. The local emitter does not require NATS so the loop
-stays reliable offline.
+It appends to `_bmad-output/implementation-artifacts/bloodbank-events.jsonl`
+(git-ignored dev spool) using the Hermes CloudEvents envelope shape. Nothing in
+the engine calls it today.
+
+## Naming, before you add one
+
+Event types are exactly four tokens — `bloodbank.<domain>.<entity>.<action>` —
+with `<domain>` and `<entity>` drawn from the allowlists in
+`~/code/33GOD/bloodbank/docs/event-naming.md` (§6/§7). Repo and agent identity
+go in `data.repo` / `actor.agent_id`, never in a type or subject token. Schema
+revision lives in `dataschema`/`schemaref`, never in the type.
+
+Add a family when something will actually consume it — register the schema in
+the BloodBank schema tree first, then emit. A type nobody reads is a type that
+rots into the wrong shape.

package/templates/hermes-agent/template/.scripts/sentinel.prompt.md.jinja

@@ -33,8 +33,8 @@ on Linear, Plane, or Trello.
 ## Pass
 
 **Trigger.** This pass runs both on the cheap heartbeat timer AND on a live
-**Plane board event** — a `bloodbank.evt.v1.repo.<repo>.ticket_*` event delivered
-by the `plane-webhook-bridge`. If a specific ticket event triggered you, FIRST
+**Plane board event** — a `bloodbank.evt.repo.task.*` event (repo identity lives
+in `data.repo`, never in the subject) delivered by the `plane-webhook-bridge`. If a specific ticket event triggered you, FIRST
 `tp get_issue <that ticket>`, read the change, and react to it (triage / refine /
 comment / transition per the lifecycle) before the general reconcile below.
 
@@ -68,19 +68,18 @@ comment / transition per the lifecycle) before the general reconcile below.
      independence satisfied, close gate passes): autonomously TREAT THE TICKET AS
      DONE. Leave it in the review lane as the operator's deferred-QA queue (do NOT
      auto-transition to `completed`; `--close` is an optional operator-QA-sweep
-     flag the loop omits). Record the adversarial review report, emit the decision
-     event, and post ONE ticket comment stating the autonomous acceptance with a
+     flag the loop omits). Record the adversarial review report and post ONE
+     ticket comment stating the autonomous acceptance with a
      pointer to the report — never a "waiting on you" comment, no grace wait. A
      dependent blocked only on this review-accepted feature is now unblocked.
    - **Held** (a real finding or gate failure): the ticket goes back to active
      (`started` if a worker takes it now, else `unstarted`); record the hold
-     reasons and emit the decision event.
+     reasons in the review report and a ticket comment.
 6. **Regression rollback.** If a later dependent proves a review-accepted feature
    is ACTUALLY BROKEN, move that feature back to active (`started` if a worker
    takes it now, else `unstarted`) as a PREREQUISITE of the dependent; comment
-   naming the dependent + symptom; emit
-   `bloodbank.v1.repo.{{ target_repo }}.issue.review_rollback.recorded`
-   `{issue, surfaced_by, reason}`. The dependent stays blocked on the prerequisite
+   naming the dependent + symptom, and record the rollback (issue, surfaced_by,
+   reason) in the issue evidence file. The dependent stays blocked on the prerequisite
    until it is fixed. This is expected and healthy — it is the trade for deferring
    operator QA, not a failure.
 7. **External blockers only** (credentials, third-party access, paid actions,