@dzhechkov/keysarium 1.7.8 → 1.7.9

package/.dz-manifest.json

@@ -9,7 +9,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "384c02be209742869d2a88e87746abad359d4099acb0146a68b9b86dd13d47dd"
+        "sha256": "13e7e27322403ce45af5be7df1fa565178b5df73ffeea1b0bbe6b3faddce9f45"
       },
       {
         "path": "README.ru.md",
@@ -21,7 +21,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "1dd2e14eb1a9f3108c5bf607490bf36127a655cfc8aa89136a2f164332757c6c"
+        "sha256": "96bcc52bfe2180fd9976589895f1f328f6c8ac62e24d22042d1105a5c16f4148"
       },
       {
         "path": "src/cli.js",
@@ -373,7 +373,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/03.5-ideation-swarm.md",
-        "sha256": "d48a8d6eebf9760cc8f1a4f19df0e6afc31fcc1284b5eacfb604ad8ced6a0b53"
+        "sha256": "b6e505083c1b8bc92243379b72ff4667b5b91ef65fd9c2ef7407129018b3e56b"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/04-ddd.md",
@@ -393,7 +393,7 @@
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/08-qe.md",
-        "sha256": "d7a967926feec9b0ec173ac7042ae3abd368644d8e1dba9a81a770794417fcb3"
+        "sha256": "4aa7ef1dea08b8d1995d968a317da5d36a4859ec299637bdc60170cf577c87af"
       },
       {
         "path": "templates/.claude/skills/feature-adr/modules/09-fleet-qe.md",
@@ -491,6 +491,10 @@
         "path": "templates/.claude/skills/feature-adr/scripts/check-plan-completeness.mjs",
         "sha256": "8b93949ce4f671d932c5389050db3a3e2750efcbed69681d69f392ccf4d2a168"
       },
+      {
+        "path": "templates/.claude/skills/feature-adr/scripts/check-review-convergence.mjs",
+        "sha256": "80f9691b8e94bf310461aeaaaa23af6e336d41d0962fdf137737639655cbdeb8"
+      },
       {
         "path": "templates/.claude/skills/feature-adr/scripts/markdown-masker.mjs",
         "sha256": "82c3c48c25f400f3a64d1caba3d47357f3db87460f0746f88706f901eb6ff689"
@@ -997,5 +1001,5 @@
       }
     ]
   },
-  "signature": "fTGSL3MpU5nWefu5K27ZehkXuMSbnESMohNdhhWggVsNtHkbsRP+fYgSdHRJEK7Qx86dOYvgywTLcveS5vjZCA=="
+  "signature": "n1PCRDF3YW7Tcdp+QdGzlK+p7PQGfraCKUO8yQxu6zrvXx6WUALgVsvmfAwh+QXmPZzINT6kYnKmzijtcEkrCw=="
 }

package/README.md

@@ -1,6 +1,6 @@
 # @dzhechkov/keysarium
 
-Current package version: `1.7.8`. <!-- dz:version -->
+Current package version: `1.7.9`. <!-- dz:version -->
 
 Site: https://aicoding.space · Source: https://github.com/djd1m/dz-harness/tree/main/packages/@dzhechkov/keysarium
 
@@ -509,3 +509,20 @@ watch v1 ETA is unavailable and global source inventory omitted. No stdin/raw mo
 store writes or automatic terminal/settings changes. Normal SQLite ephemeral WAL/SHM sidecars are
 permitted. One-shot Claude text/JSON/ETA remain unchanged. Codex native footer capability is not
 asserted; parity names manual `dz statusline --watch` access.
+
+
+Review convergence in `/feature-adr` now uses one installed Node gate in Plain and native Workflow.
+Step 3.5 closes before planning; Step 8 closes before completion and delivery, including S tier and
+resumed runs. The host measures current artifact bytes and preserves originating reviewer conditions;
+focused rework includes an explicit author delta/new-risk assessment and independent own-condition
+verification. Serious primary or precision findings remain visible at the round ceiling.
+
+Missing or stale receipts, legacy resume, unavailable reviewers and read-only Codex mode A pause
+with host-driven repair instructions. Parallel native design can require focused review after sibling
+artifacts settle. Clean initial supported review closes without invented conditions or an extra review.
+This is a receipt consistency/freshness gate, not reviewer authentication or semantic proof; existing
+Confirmation, scope, family and budget gates still apply. No automatic repair loop or new CLI command.
+
+Repeated prepare retains all pending paths until verified closure. Actual fallback families bind before dispatch while prior owners remain required. Same-slug QE repair uses current own-reviewer evidence bound to the complete historical checkpoint; original findings/grades remain visible, and failed Confirmation still blocks delivery.
+
+Before fallback, host prepare retains independently written pending receipt findings under the original owner even if that reviewer returned null. Unreconciled pending evidence pauses dispatch for originating-reviewer repair; it cannot be replaced by a clean fallback to obtain closure.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/keysarium",
-  "version": "1.7.8",
+  "version": "1.7.9",
   "scripts": {},
   "description": "AI Case Research Toolkit for Claude Code — full 7-phase pipeline with feature-adr, dream cycles, background workers, multi-platform support, reward learning, and Cloud.ru AI Factory mapping (--ai-factory flag)",
   "main": "src/cli.js",

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "384c02be209742869d2a88e87746abad359d4099acb0146a68b9b86dd13d47dd"
+          "content": "13e7e27322403ce45af5be7df1fa565178b5df73ffeea1b0bbe6b3faddce9f45"
         }
       ]
     },
@@ -59,7 +59,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "1dd2e14eb1a9f3108c5bf607490bf36127a655cfc8aa89136a2f164332757c6c"
+          "value": "96bcc52bfe2180fd9976589895f1f328f6c8ac62e24d22042d1105a5c16f4148"
         }
       ]
     },
@@ -939,7 +939,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d48a8d6eebf9760cc8f1a4f19df0e6afc31fcc1284b5eacfb604ad8ced6a0b53"
+          "content": "b6e505083c1b8bc92243379b72ff4667b5b91ef65fd9c2ef7407129018b3e56b"
         }
       ]
     },
@@ -989,7 +989,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d7a967926feec9b0ec173ac7042ae3abd368644d8e1dba9a81a770794417fcb3"
+          "content": "4aa7ef1dea08b8d1995d968a317da5d36a4859ec299637bdc60170cf577c87af"
         }
       ]
     },
@@ -1233,6 +1233,16 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "templates/.claude/skills/feature-adr/scripts/check-review-convergence.mjs",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "80f9691b8e94bf310461aeaaaa23af6e336d41d0962fdf137737639655cbdeb8"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "templates/.claude/skills/feature-adr/scripts/markdown-masker.mjs",

package/templates/.claude/skills/feature-adr/modules/03.5-ideation-swarm.md

@@ -27,6 +27,135 @@ sonnet (analytical quality assessment — multiple parallel agents)
 
 ## Protocol
 
+## Review convergence gate (Plain and native Workflow)
+
+Review follows **initial review → host rework → focused verification → closure**, or explicit owner
+escalation. A grade/GO label does not establish closure. Run the same installed Node gate before
+planning (phase `ideation`) and before Step-8 completion/delivery (phase `qe`), including resume.
+
+The host prepares a measured artifact snapshot BEFORE independent review. Resolve the executable
+from this installed skill's `scripts/check-review-convergence.mjs`; do not use a scratch replacement.
+For example, from the execution project, using the actual originating role/family:
+
+```bash
+node "$FEATURE_ADR_SKILL/scripts/check-review-convergence.mjs" prepare \
+  --repo "$EXECUTION_PROJECT" --feature "features/$FEATURE_SLUG" --phase ideation \
+  --reviewers '[{"id":"qcsd-quality","family":"owner-exception"},{"id":"qcsd-risk","family":"owner-exception"},{"id":"qcsd-testability","family":"owner-exception"}]'
+node "$FEATURE_ADR_SKILL/scripts/check-review-convergence.mjs" evaluate \
+  --repo "$EXECUTION_PROJECT" --feature "features/$FEATURE_SLUG" --phase ideation
+```
+
+For QE use `--phase qe` and the actual `qe-primary` reviewer, plus `qe-precision` when configured.
+`family` is `codex`, `claude`, or an explicitly authorized `owner-exception`. Existing family/routing
+policy remains binding; this receipt does not authorize an exception. Only the host calls `prepare`.
+It retains originating reviewer roles and prior condition meanings in the existing feature checkpoint
+`.fa-state/review-convergence-<phase>-host.json`; neither the latest report nor an empty request array
+can replace that lineage. Do not edit/delete host lineage to obtain a clean bootstrap. A new nonce is
+issued when measured bytes/path membership change; repeated preparation cannot remove conditions. Pending changed paths accumulate across every prepare, including path additions/deletions, until an established closure; failed/refused evaluations never clear them.
+
+The snapshot measures requirements, every direct ADR, architecture, and other available design
+inputs. QE also measures the plan, ideation report, every declared target, and host-discovered Git
+changes/additions/deletions against `.fa-state/base-ref` (HEAD when absent). Receipt/checkpoint files,
+QE report and generated `architecture/map.json` are outputs excluded to avoid circular hashes.
+Explicit planned deletions carry a null digest. Traversal, symlinks and non-files refuse. The host
+must include relevant unchanged dependencies in declared targets; hashing cannot discover semantic
+dependencies. Parallel Workflow design may change after ideation review: that stale review pauses
+before planning and needs focused review of the settled snapshot.
+
+All three QCSD core roles remain originating reviewers. The coordinator does not manufacture their
+receipts from grades or report prose. The JSON example below shows one entry; include all three
+actual roles in `reviews`, with their actual families. Each independent reviewer writes its OWN
+entry, preserving other reviewer entries and the actual
+author handoff, in `.fa-state/review-convergence-<phase>-review.json`. A genuinely clean initial
+review needs no invented condition or extra review. Its complete receipt shape is:
+
+```json
+{
+  "schema": "fa-review-convergence-1", "phase": "ideation",
+  "nonce": "<copy host snapshot nonce>", "revision": "<copy host snapshot revision>",
+  "author": null,
+  "reviews": [{
+    "reviewer": "qcsd-quality", "family": "owner-exception", "independent": true, "verdict": "clean",
+    "conditions": [], "verifications": [],
+    "newRisks": {"assessment": "none identified after complete scope review", "evidence": "<actual review evidence>", "conditions": []},
+    "authorAssessmentChecked": false, "deltaVerification": null
+  }]
+}
+```
+
+`verdict` is `clean`, `conditional`, or `no-go`. Conditions have closed fields
+`{id, owner, severity, classification, requirement, scope, evidence}`: stable unique ID, originating
+role ID, BLOCKER/CRITICAL/HIGH/WARNING/SUGGESTION, structural/wording, exact acceptance meaning,
+nonempty repo-relative scope paths, and original evidence. Carry every prior own condition unchanged
+on every pass. Reviewer verifications have closed fields
+`{id, revision, classification, evidence, implementationVerified}`. Only the originating independent
+role can verify its own condition at the current revision; author/lead/scribe assertions cannot.
+
+Rework requires the actual author object
+`{addressed, changedScope, classification, delta, evidence, newRisks}`. Addressed IDs name prior
+conditions; changedScope includes ALL host-measured changes and affected dependencies. Delta/evidence
+explain the actual fix. Both author and reviewer `newRisks` require explicit assessment/evidence and a
+conditions array, including an explicit none-identified assessment when empty. The reviewer must set
+`authorAssessmentChecked:true` and supply independent
+`deltaVerification:{classification,evidence,implementationVerified}`. Structural changes affect
+behavior, contracts, safeguards, architecture or acceptance meaning and require affected implementation
+and test verification. Wording changes affect expression only; the independent reviewer checks that
+classification, so an author's wording label cannot weaken structural verification.
+
+Focused scope is outstanding conditions plus actual changes and affected dependencies. New serious
+risks always expand that scope. Retain ALL conditions and serious primary/precision findings until
+own-reviewer verification; a token/round ceiling escalates unresolved risk, never approves it.
+
+Gate exits: 0 with `prepared` (prepare only) or `closed` (evaluate only); 1 `unresolved`; 3
+`not-established`. Inspect the structured reasons/unresolved IDs. Missing executable/report, malformed
+or contradictory output, foreign/duplicate/omitted conditions, stale phase/nonce/manifest or unavailable
+reviewer refuses. Native Workflow strictly checks stdout AND exit before planning and before
+completion/delivery/success tags. Supported native/Mode-B/fallback/precision reviewers receive this
+contract; the read-only Codex mode-A route cannot accept it and pauses for a supported independent
+review. A scribe never creates reviewer evidence from grade. Historical resume without this contract
+needs fresh evidence; resume rechecks bytes and every configured route, including unwitnessed precision.
+
+Host prepare first reads the existing reviewer receipt, including valid partial own entries written
+before an agent/transport failure. It preserves independently written conditions under their original
+role/family before binding any actual fallback. This imports findings, never closure or author/scribe
+claims. A stale receipt cannot originate new host conditions; known prior meanings remain immutable.
+`pending-reviewer-receipt-needs-origin-review` pauses before native fallback dispatch when pending
+evidence cannot be reconciled. Keep the original receipt and host lineage. Have its originating
+reviewer repair malformed/foreign fields or refresh unknown stale own findings at the unchanged
+host identity/current snapshot. Repeat prepare for the selected actual base-role families, complete
+the returned full reviewer roster with actual own verification, then evaluate and resume the same
+slug. No receipt/lineage deletion or relabeling is a recovery action. The existing QE checkpoint
+validator rejects a paused non-QE result, so same-slug resume re-enters only that reviewer stage;
+unrelated coder checkpoints remain eligible for reuse.
+
+Bind the actual fallback family with host prepare BEFORE reviewer dispatch. An unused role may change family; once review evidence originated, its role/family and prior conditions remain required, and the new family receives a distinct `<base-id>:<family>` role. Reviewers read the returned full roster and never relabel old ownership.
+
+On refusal, the host settles artifacts, calls prepare with the selected actual base-role families, supplies
+the author handoff, requests focused own-condition verification, then evaluates and resumes the same
+slug. This is host-driven repair, not an automatic repair loop. Existing Confirmation, amendment,
+scope, testing, independent-family and budget gates remain conjunctive. This gate establishes receipt
+consistency and current artifact binding, not semantic truth or authenticated reviewer identity.
+
+For a same-slug QE resume blocked by historical serious findings, read-only mode A, or an
+unwitnessed precision append, preserve the complete original checkpoint, findings and grades.
+Prepare returns `checkpointDigest`: SHA-256 of `JSON.stringify` of the latest `qe` result in
+`.fa-state/checkpoints.jsonl`. Each actual originating reviewer supplies optional closed-field
+`checkpointVerification:{checkpointDigest,evidence,supported:true,route,findings,reportDigest}`
+in its own review entry, in addition to the ordinary current-revision independent verification.
+`route` is native/mode-b/fallback and evidence describes the actual supported focused review;
+mode A, author/scribe flags, or the old grade cannot establish this proof. `findings` maps EVERY
+original serious gap with `{digest,conditionId}`, where digest is SHA-256(JSON.stringify(gap))
+and conditionId names that reviewer's preserved serious condition with its current structural
+implementation verification. Both primary and precision origins must verify their own findings.
+Use `reportDigest:null` normally; an unwitnessed precision append requires that originating
+precision reviewer to verify the actual complete `08_qe_report.md` and supply its SHA-256.
+The report must contain Primary QE pass, Precision QE pass, and Combined Step-8 grade sections.
+Then evaluate with the same phase/repo/feature and re-invoke the same slug. Only a closed gate
+with complete checkpoint binding can reconcile historical refusals on an actual resumed QE stage;
+live findings, changed checkpoints/artifacts and a failed Confirmation gate still block delivery.
+This procedure runs no coder or automatic repair loop, and retains the historical result for audit.
+
+
 ### 1. Flag Detection (MANDATORY)
 
 Scan feature requirements + ADR decisions and SET these flags:

package/templates/.claude/skills/feature-adr/modules/08-qe.md

@@ -23,6 +23,132 @@ sonnet (analytical evaluation)
 
 ## Protocol
 
+## Review convergence gate (Plain and native Workflow)
+
+Review follows **initial review → host rework → focused verification → closure**, or explicit owner
+escalation. A grade/GO label does not establish closure. Run the same installed Node gate before
+planning (phase `ideation`) and before Step-8 completion/delivery (phase `qe`), including resume.
+
+The host prepares a measured artifact snapshot BEFORE independent review. Resolve the executable
+from this installed skill's `scripts/check-review-convergence.mjs`; do not use a scratch replacement.
+For example, from the execution project, using the actual originating role/family:
+
+```bash
+node "$FEATURE_ADR_SKILL/scripts/check-review-convergence.mjs" prepare \
+  --repo "$EXECUTION_PROJECT" --feature "features/$FEATURE_SLUG" --phase ideation \
+  --reviewers '[{"id":"qcsd","family":"owner-exception"}]'
+node "$FEATURE_ADR_SKILL/scripts/check-review-convergence.mjs" evaluate \
+  --repo "$EXECUTION_PROJECT" --feature "features/$FEATURE_SLUG" --phase ideation
+```
+
+The ideation example above is illustrative; QCSD uses its three actual core role entries. For QE use `--phase qe` and the actual `qe-primary` reviewer, plus `qe-precision` when configured.
+`family` is `codex`, `claude`, or an explicitly authorized `owner-exception`. Existing family/routing
+policy remains binding; this receipt does not authorize an exception. Only the host calls `prepare`.
+It retains originating reviewer roles and prior condition meanings in the existing feature checkpoint
+`.fa-state/review-convergence-<phase>-host.json`; neither the latest report nor an empty request array
+can replace that lineage. Do not edit/delete host lineage to obtain a clean bootstrap. A new nonce is
+issued when measured bytes/path membership change; repeated preparation cannot remove conditions. Pending changed paths accumulate across every prepare, including path additions/deletions, until an established closure; failed/refused evaluations never clear them.
+
+The snapshot measures requirements, every direct ADR, architecture, and other available design
+inputs. QE also measures the plan, ideation report, every declared target, and host-discovered Git
+changes/additions/deletions against `.fa-state/base-ref` (HEAD when absent). Receipt/checkpoint files,
+QE report and generated `architecture/map.json` are outputs excluded to avoid circular hashes.
+Explicit planned deletions carry a null digest. Traversal, symlinks and non-files refuse. The host
+must include relevant unchanged dependencies in declared targets; hashing cannot discover semantic
+dependencies. Parallel Workflow design may change after ideation review: that stale review pauses
+before planning and needs focused review of the settled snapshot.
+
+Each independent reviewer writes its OWN entry, preserving other reviewer entries and the actual
+author handoff, in `.fa-state/review-convergence-<phase>-review.json`. A genuinely clean initial
+review needs no invented condition or extra review. Its complete receipt shape is:
+
+```json
+{
+  "schema": "fa-review-convergence-1", "phase": "ideation",
+  "nonce": "<copy host snapshot nonce>", "revision": "<copy host snapshot revision>",
+  "author": null,
+  "reviews": [{
+    "reviewer": "qcsd", "family": "owner-exception", "independent": true, "verdict": "clean",
+    "conditions": [], "verifications": [],
+    "newRisks": {"assessment": "none identified after complete scope review", "evidence": "<actual review evidence>", "conditions": []},
+    "authorAssessmentChecked": false, "deltaVerification": null
+  }]
+}
+```
+
+`verdict` is `clean`, `conditional`, or `no-go`. Conditions have closed fields
+`{id, owner, severity, classification, requirement, scope, evidence}`: stable unique ID, originating
+role ID, BLOCKER/CRITICAL/HIGH/WARNING/SUGGESTION, structural/wording, exact acceptance meaning,
+nonempty repo-relative scope paths, and original evidence. Carry every prior own condition unchanged
+on every pass. Reviewer verifications have closed fields
+`{id, revision, classification, evidence, implementationVerified}`. Only the originating independent
+role can verify its own condition at the current revision; author/lead/scribe assertions cannot.
+
+Rework requires the actual author object
+`{addressed, changedScope, classification, delta, evidence, newRisks}`. Addressed IDs name prior
+conditions; changedScope includes ALL host-measured changes and affected dependencies. Delta/evidence
+explain the actual fix. Both author and reviewer `newRisks` require explicit assessment/evidence and a
+conditions array, including an explicit none-identified assessment when empty. The reviewer must set
+`authorAssessmentChecked:true` and supply independent
+`deltaVerification:{classification,evidence,implementationVerified}`. Structural changes affect
+behavior, contracts, safeguards, architecture or acceptance meaning and require affected implementation
+and test verification. Wording changes affect expression only; the independent reviewer checks that
+classification, so an author's wording label cannot weaken structural verification.
+
+Focused scope is outstanding conditions plus actual changes and affected dependencies. New serious
+risks always expand that scope. Retain ALL conditions and serious primary/precision findings until
+own-reviewer verification; a token/round ceiling escalates unresolved risk, never approves it.
+
+Gate exits: 0 with `prepared` (prepare only) or `closed` (evaluate only); 1 `unresolved`; 3
+`not-established`. Inspect the structured reasons/unresolved IDs. Missing executable/report, malformed
+or contradictory output, foreign/duplicate/omitted conditions, stale phase/nonce/manifest or unavailable
+reviewer refuses. Native Workflow strictly checks stdout AND exit before planning and before
+completion/delivery/success tags. Supported native/Mode-B/fallback/precision reviewers receive this
+contract; the read-only Codex mode-A route cannot accept it and pauses for a supported independent
+review. A scribe never creates reviewer evidence from grade. Historical resume without this contract
+needs fresh evidence; resume rechecks bytes and every configured route, including unwitnessed precision.
+
+Host prepare first reads the existing reviewer receipt, including valid partial own entries written
+before an agent/transport failure. It preserves independently written conditions under their original
+role/family before binding any actual fallback. This imports findings, never closure or author/scribe
+claims. A stale receipt cannot originate new host conditions; known prior meanings remain immutable.
+`pending-reviewer-receipt-needs-origin-review` pauses before native fallback dispatch when pending
+evidence cannot be reconciled. Keep the original receipt and host lineage. Have its originating
+reviewer repair malformed/foreign fields or refresh unknown stale own findings at the unchanged
+host identity/current snapshot. Repeat prepare for the selected actual base-role families, complete
+the returned full reviewer roster with actual own verification, then evaluate and resume the same
+slug. No receipt/lineage deletion or relabeling is a recovery action. The existing QE checkpoint
+validator rejects a paused non-QE result, so same-slug resume re-enters only that reviewer stage;
+unrelated coder checkpoints remain eligible for reuse.
+
+Bind the actual fallback family with host prepare BEFORE reviewer dispatch. An unused role may change family; once review evidence originated, its role/family and prior conditions remain required, and the new family receives a distinct `<base-id>:<family>` role. Reviewers read the returned full roster and never relabel old ownership.
+
+On refusal, the host settles artifacts, calls prepare with the selected actual base-role families, supplies
+the author handoff, requests focused own-condition verification, then evaluates and resumes the same
+slug. This is host-driven repair, not an automatic repair loop. Existing Confirmation, amendment,
+scope, testing, independent-family and budget gates remain conjunctive. This gate establishes receipt
+consistency and current artifact binding, not semantic truth or authenticated reviewer identity.
+
+For a same-slug QE resume blocked by historical serious findings, read-only mode A, or an
+unwitnessed precision append, preserve the complete original checkpoint, findings and grades.
+Prepare returns `checkpointDigest`: SHA-256 of `JSON.stringify` of the latest `qe` result in
+`.fa-state/checkpoints.jsonl`. Each actual originating reviewer supplies optional closed-field
+`checkpointVerification:{checkpointDigest,evidence,supported:true,route,findings,reportDigest}`
+in its own review entry, in addition to the ordinary current-revision independent verification.
+`route` is native/mode-b/fallback and evidence describes the actual supported focused review;
+mode A, author/scribe flags, or the old grade cannot establish this proof. `findings` maps EVERY
+original serious gap with `{digest,conditionId}`, where digest is SHA-256(JSON.stringify(gap))
+and conditionId names that reviewer's preserved serious condition with its current structural
+implementation verification. Both primary and precision origins must verify their own findings.
+Use `reportDigest:null` normally; an unwitnessed precision append requires that originating
+precision reviewer to verify the actual complete `08_qe_report.md` and supply its SHA-256.
+The report must contain Primary QE pass, Precision QE pass, and Combined Step-8 grade sections.
+Then evaluate with the same phase/repo/feature and re-invoke the same slug. Only a closed gate
+with complete checkpoint binding can reconcile historical refusals on an actual resumed QE stage;
+live findings, changed checkpoints/artifacts and a failed Confirmation gate still block delivery.
+This procedure runs no coder or automatic repair loop, and retains the historical result for audit.
+
+
 ### Bridge identity for plain Step 8
 
 When the plain host invokes the existing Claude review bridge, take round number, pipeline run and
@@ -56,7 +182,7 @@ a live Claude model roundtrip or secure every native Codex QE receipt.
 - [ ] Type checker passes (if configured)
 ```
 
-For S-tier: if all pass, proceed to checkpoint. Done.
+For S-tier: passing smoke tests still requires the review-convergence contract above before checkpoint/completion; a smoke pass alone is not closure.
 
 ### 2. Test Generation (M+)
 

package/templates/.claude/skills/feature-adr/scripts/check-review-convergence.mjs

@@ -0,0 +1,316 @@
+#!/usr/bin/env node
+// Host checkpoint lineage, not a reviewer-supplied prior array, owns historical conditions.
+// This checks consistency/freshness; it does not authenticate models or judge their evidence.
+import { createHash, randomUUID } from 'node:crypto'
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, writeFileSync } from 'node:fs'
+import { dirname, relative, resolve, sep } from 'node:path'
+import { execFileSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+export const SCHEMA = 'fa-review-convergence-1'
+const phases = ['ideation', 'qe']
+const severities = ['BLOCKER', 'CRITICAL', 'HIGH', 'WARNING', 'SUGGESTION']
+const kinds = ['structural', 'wording']
+const digest = value => createHash('sha256').update(value).digest('hex')
+const same = (a, b) => JSON.stringify(a) === JSON.stringify(b)
+const text = value => typeof value === 'string' && value.trim().length > 0 && value.length <= 65536
+const hash = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value)
+const array = (value, limit = 512) => Array.isArray(value) && value.length <= limit
+function dictionary(value, keys, required = keys) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).every(key => keys.includes(key)) && required.every(key => Object.hasOwn(value, key))
+}
+function strings(value, nonempty = false) { return array(value) && (!nonempty || value.length > 0) && value.every(text) && new Set(value).size === value.length }
+function condition(c, owners) {
+  return dictionary(c, ['id', 'owner', 'severity', 'classification', 'requirement', 'scope', 'evidence']) && /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,95}$/.test(c.id) && owners.includes(c.owner) && severities.includes(c.severity) && kinds.includes(c.classification) && text(c.requirement) && strings(c.scope, true) && text(c.evidence)
+}
+function risks(r, owners) { return dictionary(r, ['assessment', 'evidence', 'conditions']) && text(r.assessment) && text(r.evidence) && array(r.conditions) && r.conditions.every(c => condition(c, owners)) }
+function checkpointProof(p) {
+  return dictionary(p, ['checkpointDigest', 'evidence', 'supported', 'route', 'findings', 'reportDigest']) && hash(p.checkpointDigest) && text(p.evidence) && p.supported === true && ['native', 'mode-b', 'fallback'].includes(p.route) && array(p.findings) && p.findings.every(v => dictionary(v, ['digest', 'conditionId']) && hash(v.digest) && text(v.conditionId)) && (p.reportDigest === null || hash(p.reportDigest))
+}
+function reviewerFamily(stage) { return stage.qeReviewerUsed === 'codex-fallback' ? 'codex' : stage.qeReviewerUsed }
+function reviewerEntry(r, roster) {
+  const owners = roster.map(p => p.id)
+  return !(!dictionary(r, ['reviewer', 'family', 'independent', 'verdict', 'conditions', 'verifications', 'newRisks', 'authorAssessmentChecked', 'deltaVerification', 'checkpointVerification'], ['reviewer', 'family', 'independent', 'verdict', 'conditions', 'verifications', 'newRisks', 'authorAssessmentChecked', 'deltaVerification']) || !owners.includes(r.reviewer) || roster.find(p => p.id === r.reviewer)?.family !== r.family || r.independent !== true || !['clean', 'conditional', 'no-go'].includes(r.verdict) || !array(r.conditions) || !r.conditions.every(c => condition(c, owners) && c.owner === r.reviewer) || !array(r.verifications) || !risks(r.newRisks, owners) || !r.newRisks.conditions.every(c => c.owner === r.reviewer) || typeof r.authorAssessmentChecked !== 'boolean')
+}
+function result(phase, verdict, revision, reasons, unresolved = []) { return { schema: SCHEMA, phase, verdict, revision, unresolved, reasons } }
+
+export function evaluateReviewConvergence(host, receipt, currentManifest) {
+  const phase = host?.phase
+  const refuse = reason => result(phase || 'qe', 'not-established', host?.snapshot?.revision || null, [reason], (host?.conditions || []).map(c => c.id))
+  if (!dictionary(host, ['schema', 'phase', 'reviewers', 'snapshot', 'conditions', 'reviewSeen', 'rework', 'changedPaths']) || host.schema !== SCHEMA || !phases.includes(phase) || !array(host.reviewers, 16) || host.reviewers.length === 0) return refuse('host-lineage-invalid')
+  const owners = host.reviewers.map(r => r.id)
+  if (new Set(owners).size !== owners.length || !host.reviewers.every(r => dictionary(r, ['id', 'family']) && text(r.id) && ['codex', 'claude', 'owner-exception'].includes(r.family))) return refuse('host-reviewers-invalid')
+  if (!dictionary(host.snapshot, ['nonce', 'revision', 'manifest']) || !text(host.snapshot.nonce) || !hash(host.snapshot.revision) || !array(host.conditions) || !host.conditions.every(c => condition(c, owners)) || typeof host.reviewSeen !== 'boolean' || typeof host.rework !== 'boolean' || !strings(host.changedPaths)) return refuse('host-snapshot-invalid')
+  if (!same(host.snapshot.manifest, currentManifest) || digest(JSON.stringify(currentManifest)) !== host.snapshot.revision) return refuse('artifact-manifest-changed')
+  if (!dictionary(receipt, ['schema', 'phase', 'nonce', 'revision', 'reviews', 'author']) || receipt.schema !== SCHEMA || receipt.phase !== phase || receipt.nonce !== host.snapshot.nonce || receipt.revision !== host.snapshot.revision) return refuse('receipt-phase-or-revision-invalid')
+  if (!array(receipt.reviews, 16) || receipt.reviews.length !== owners.length || new Set(receipt.reviews.map(r => r?.reviewer)).size !== owners.length) return refuse('reviewer-set-invalid')
+  const all = new Map(host.conditions.map(c => [c.id, c]))
+  const verified = new Set()
+  const reasons = []
+  const needsAuthor = host.rework || (host.reviewSeen && host.conditions.length > 0)
+  if (needsAuthor && !receipt.author) return refuse('author-delta-missing')
+  if (receipt.author !== null) {
+    const a = receipt.author
+    if (!dictionary(a, ['addressed', 'changedScope', 'classification', 'delta', 'evidence', 'newRisks']) || !strings(a.addressed) || !strings(a.changedScope, true) || !kinds.includes(a.classification) || !text(a.delta) || !text(a.evidence) || !risks(a.newRisks, owners)) return refuse('author-delta-invalid')
+    if (host.changedPaths.some(path => !a.changedScope.includes(path))) return refuse('author-delta-omits-measured-changes')
+    if (a.addressed.some(id => !all.has(id))) return refuse('author-addressed-unknown-condition')
+    for (const c of a.newRisks.conditions) {
+      if (all.has(c.id) && !same(all.get(c.id), c)) return refuse('author-risk-condition-redefined')
+      all.set(c.id, c)
+    }
+  }
+  for (const r of receipt.reviews) {
+    if (!reviewerEntry(r, host.reviewers)) return refuse('reviewer-contract-invalid')
+    if (Object.hasOwn(r, 'checkpointVerification') && !checkpointProof(r.checkpointVerification)) return refuse('checkpoint-verification-contract-invalid')
+    if (receipt.author && !r.authorAssessmentChecked) return refuse('author-risk-assessment-not-reviewed')
+    if (receipt.author) {
+      const d = r.deltaVerification
+      if (!dictionary(d, ['classification', 'evidence', 'implementationVerified']) || !kinds.includes(d.classification) || !text(d.evidence) || typeof d.implementationVerified !== 'boolean') return refuse('independent-delta-classification-missing')
+      if ((receipt.author.classification === 'structural' || d.classification === 'structural') && (!d.implementationVerified || d.classification !== 'structural')) reasons.push('structural-delta-not-verified:' + r.reviewer)
+    } else if (r.deltaVerification !== null) return refuse('unexpected-delta-verification')
+    const own = r.conditions.concat(r.newRisks.conditions)
+    if (new Set(own.map(c => c.id)).size !== own.length) return refuse('duplicate-condition')
+    for (const c of host.conditions.filter(c => c.owner === r.reviewer)) if (!own.some(n => same(n, c))) return refuse('prior-condition-omitted-or-redefined:' + c.id)
+    for (const c of own) {
+      if (c.scope.some(path => !currentManifest.some(p => p.path === path))) return refuse('condition-scope-unmeasured:' + c.id)
+      if (all.has(c.id) && !same(all.get(c.id), c)) return refuse('condition-redefined:' + c.id)
+      all.set(c.id, c)
+    }
+    if (r.verdict === 'clean' && own.length > 0 && r.verifications.length === 0) return refuse('clean-verdict-contradicts-conditions')
+    if (r.verdict === 'conditional' && own.length === 0) return refuse('conditional-without-conditions')
+    if (r.verdict === 'no-go') reasons.push('reviewer-no-go:' + r.reviewer)
+    const seen = new Set()
+    for (const v of r.verifications) {
+      if (!dictionary(v, ['id', 'revision', 'classification', 'evidence', 'implementationVerified']) || seen.has(v.id) || !all.has(v.id) || all.get(v.id).owner !== r.reviewer || v.revision !== host.snapshot.revision || !kinds.includes(v.classification) || !text(v.evidence) || typeof v.implementationVerified !== 'boolean') return refuse('verification-invalid-or-foreign')
+      seen.add(v.id)
+      // A semantic change cannot become a weaker check by the author's label.
+      const structural = all.get(v.id).classification === 'structural' || receipt.author?.classification === 'structural' || v.classification === 'structural'
+      if (structural && (!v.implementationVerified || v.classification !== 'structural')) reasons.push('structural-verification-missing:' + v.id)
+      else verified.add(v.id)
+    }
+  }
+  const unresolved = [...all.keys()].filter(id => !verified.has(id))
+  for (const id of unresolved) reasons.push('unresolved:' + id)
+  if (receipt.author?.newRisks.conditions.some(c => !receipt.reviews.some(r => r.conditions.concat(r.newRisks.conditions).some(n => same(n, c))))) reasons.push('author-risk-not-adopted-by-reviewer')
+  return result(phase, reasons.length ? 'unresolved' : 'closed', host.snapshot.revision, reasons, unresolved)
+}
+
+function safePath(root, rel, allowMissing = true) {
+  if (!text(rel) || rel.startsWith('/') || rel.includes('\\') || rel.split('/').some(p => !p || p === '.' || p === '..') || /[\x00-\x1f]/.test(rel)) throw Error('unsafe-artifact-path')
+  let path = root
+  for (const part of rel.split('/')) {
+    path = resolve(path, part)
+    if (!existsSync(path)) { if (allowMissing) return resolve(root, rel); throw Error('artifact-missing:' + rel) }
+    if (lstatSync(path).isSymbolicLink()) throw Error('symlink-artifact:' + rel)
+  }
+  return path
+}
+function readJson(path) { return JSON.parse(readFileSync(path, 'utf8')) }
+function writeJson(path, value) {
+  if (existsSync(path) && (!lstatSync(path).isFile() || lstatSync(path).isSymbolicLink())) throw Error('unsafe-checkpoint')
+  const temporary = path + '.' + randomUUID() + '.tmp'
+  writeFileSync(temporary, JSON.stringify(value, null, 2) + '\n', { flag: 'wx' })
+  renameSync(temporary, path)
+}
+function pathsFor(repo, feature, phase) {
+  const prefix = relative(repo, feature).split(sep).join('/')
+  if (!prefix || prefix.startsWith('../')) throw Error('feature-must-be-inside-repo')
+  safePath(repo, prefix, false)
+  const targets = ['00_complexity_assessment.md', '01_requirements.md', '02_research.md', '04_domain_model.md', '05_architecture.md']
+  if (phase === 'qe') targets.push('06_implementation_plan.md', '03.5_ideation_report.md')
+  const adr = safePath(repo, prefix + '/03_adr')
+  if (existsSync(adr) && !lstatSync(adr).isDirectory()) throw Error('adr-not-directory')
+  const decisions = existsSync(adr) ? readdirSync(adr).filter(p => /^[0-9]{3}-.+\.md$/.test(p)).sort() : []
+  if (phase === 'ideation' && !decisions.length) throw Error('adr-missing')
+  const paths = targets.filter(p => existsSync(resolve(feature, p))).concat(decisions.map(p => '03_adr/' + p)).map(p => prefix + '/' + p)
+  for (const required of phase === 'ideation' ? ['01_requirements.md', '05_architecture.md'] : ['01_requirements.md', '06_implementation_plan.md']) if (!paths.includes(prefix + '/' + required)) throw Error('design-input-missing:' + required)
+  if (phase === 'qe') {
+    const plan = readFileSync(safePath(repo, prefix + '/06_implementation_plan.md', false), 'utf8')
+    const block = plan.split(/^EXPECTED_CODE_TARGETS:\s*$/m)
+    if (block.length !== 2) throw Error('target-block-missing-or-duplicate')
+    const planned = block[1].split('\n').filter(line => line.trim()).map(line => {
+      const match = /^- (.+)$/.exec(line)
+      if (!match) throw Error('target-block-malformed')
+      return match[1]
+    })
+    if (!planned.length) throw Error('target-block-empty')
+    if (planned.some(p => /^(features|\.dz|\.agentic-qe|roam)\//.test(p))) throw Error('circular-review-target')
+    paths.push(...planned)
+    // Additions/deletions are discovered by the host, not the author delta request.
+    const baseFile = resolve(feature, '.fa-state/base-ref')
+    const base = existsSync(baseFile) ? readFileSync(baseFile, 'utf8').trim() : 'HEAD'
+    if (!/^[A-Za-z0-9_./:-]+$/.test(base) || base.startsWith('-')) throw Error('base-ref-invalid')
+    for (const command of [['diff', '--name-only', '-z', base, '--'], ['ls-files', '--others', '--exclude-standard', '-z']]) {
+      const names = execFileSync('git', command, { cwd: repo, encoding: 'utf8', maxBuffer: 4 * 1024 * 1024 }).split('\0').filter(Boolean)
+      paths.push(...names.filter(p => !p.startsWith('features/') && !p.startsWith('.dz/') && !p.startsWith('.agentic-qe/') && !p.startsWith('roam/') && p !== 'architecture/map.json'))
+    }
+  }
+  return [...new Set(paths)].sort()
+}
+export function measureManifest(repo, feature, phase) {
+  return pathsFor(repo, feature, phase).map(path => {
+    const absolute = safePath(repo, path)
+    if (!existsSync(absolute)) return { path, digest: null }
+    if (!lstatSync(absolute).isFile()) throw Error('non-file-artifact:' + path)
+    return { path, digest: digest(readFileSync(absolute)) }
+  })
+}
+function checkpointPaths(repo, feature, phase) {
+  const stateRel = relative(repo, feature).split(sep).join('/') + '/.fa-state'
+  const state = safePath(repo, stateRel)
+  mkdirSync(state, { recursive: true })
+  return { host: safePath(repo, stateRel + '/review-convergence-' + phase + '-host.json'), review: safePath(repo, stateRel + '/review-convergence-' + phase + '-review.json') }
+}
+function qeCheckpoint(repo, feature) {
+  const rel = relative(repo, feature).split(sep).join('/') + '/.fa-state/checkpoints.jsonl'
+  const file = safePath(repo, rel)
+  if (!existsSync(file)) return null
+  let checkpoint = null
+  for (const line of readFileSync(file, 'utf8').split('\n').filter(Boolean)) {
+    const item = JSON.parse(line)
+    if (item.stage === 'qe') checkpoint = item.result
+  }
+  return checkpoint ? { checkpointDigest: digest(JSON.stringify(checkpoint)), checkpoint } : null
+}
+function seriousFindings(source) {
+  return (array(source?.gaps) ? source.gaps : []).filter(gap => [gap.sev, gap.severity, gap.priority].some(v => /(?:^|[^A-Z0-9])(BLOCKER|CRITICAL|HIGH|P0|P1)(?:$|[^A-Z0-9])/.test(String(v || '').toUpperCase())))
+}
+function reconcileCheckpoint(host, receipt, measured, repo, feature) {
+  if (!measured) return null
+  const stage = measured.checkpoint
+  for (const [base, source, family, missing] of [
+    ['qe-primary', stage.qe, reviewerFamily(stage), !stage.qe || Boolean(stage.qe?.convergenceUnavailable)],
+    ['qe-precision', stage.qe2, 'claude', host.reviewers.some(r => r.id.startsWith('qe-precision')) && (!stage.qe2 || !stage.qe2.reportWritten)],
+  ]) {
+    const findings = seriousFindings(source)
+    if (!missing && !findings.length) continue
+    const origin = host.reviewers.find(r => (r.id === base || r.id === base + ':' + family) && r.family === family)
+    const review = receipt.reviews.find(r => r.reviewer === origin?.id)
+    const proof = review?.checkpointVerification
+    if (!origin || !checkpointProof(proof) || proof.checkpointDigest !== measured.checkpointDigest || !text(proof.evidence) || proof.supported !== true || !['native', 'mode-b', 'fallback'].includes(proof.route) || !array(proof.findings) || proof.findings.length !== findings.length || !(proof.reportDigest === null || hash(proof.reportDigest))) return null
+    const mapped = new Set()
+    for (const gap of findings) {
+      const item = proof.findings.find(v => v.digest === digest(JSON.stringify(gap)))
+      if (!dictionary(item, ['digest', 'conditionId']) || mapped.has(item.conditionId) || !host.conditions.some(c => c.id === item.conditionId && c.owner === origin.id && ['BLOCKER', 'CRITICAL', 'HIGH'].includes(c.severity)) || !review.verifications.some(v => v.id === item.conditionId && v.revision === host.snapshot.revision && v.implementationVerified === true && v.classification === 'structural')) return null
+      mapped.add(item.conditionId)
+    }
+    if (base === 'qe-precision' && missing) {
+      const file = safePath(repo, relative(repo, feature).split(sep).join('/') + '/08_qe_report.md', false)
+      const report = readFileSync(file)
+      if (digest(report) !== proof.reportDigest || !/## Primary QE pass/.test(report.toString()) || !/## Precision QE pass/.test(report.toString()) || !/Combined Step-8 grade:/.test(report.toString())) return null
+    }
+  }
+  return { ...measured, revision: host.snapshot.revision }
+}
+function retainPendingReceipt(host, path) {
+  if (!host || !existsSync(path)) return host
+  let receipt
+  try { receipt = readJson(path) } catch (_) { throw Error('pending-reviewer-receipt-needs-origin-review') }
+  if (!dictionary(receipt, ['schema', 'phase', 'nonce', 'revision', 'reviews', 'author']) || receipt.schema !== SCHEMA || receipt.phase !== host.phase || !text(receipt.nonce) || !hash(receipt.revision) || !array(receipt.reviews, 16) || !receipt.reviews.length || new Set(receipt.reviews.map(r => r?.reviewer)).size !== receipt.reviews.length) throw Error('pending-reviewer-receipt-needs-origin-review')
+  const owners = host.reviewers.map(r => r.id), preserved = new Map(host.conditions.map(c => [c.id, c]))
+  const fresh = receipt.nonce === host.snapshot.nonce && receipt.revision === host.snapshot.revision
+  let problem = false, witnessed = false
+  for (const r of receipt.reviews) {
+    if (!reviewerEntry(r, host.reviewers) || Object.hasOwn(r, 'checkpointVerification') && !checkpointProof(r.checkpointVerification)) { problem = true; continue }
+    const own = r.conditions.concat(r.newRisks.conditions)
+    if (new Set(own.map(c => c.id)).size !== own.length) { problem = true; continue }
+    witnessed = true
+    for (const c of own) {
+      // Stale evidence may preserve a known condition; it cannot originate new host authority.
+      if (preserved.has(c.id)) { if (!same(preserved.get(c.id), c)) problem = true }
+      else if (!fresh || c.scope.some(path => !host.snapshot.manifest.some(p => p.path === path))) problem = true
+      else if (condition(c, owners) && c.owner === r.reviewer) preserved.set(c.id, c)
+    }
+  }
+  const next = { ...host, conditions: [...preserved.values()], reviewSeen: host.reviewSeen || witnessed }
+  // This imports original independent findings only, never closure, author claims or a grade.
+  return { next, problem }
+}
+function bindReviewers(host, requested, measured) {
+  if (!host) return requested
+  const bound = host.reviewers.map(r => ({ ...r }))
+  for (const actual of requested) {
+    const prior = bound.find(r => r.id === actual.id)
+    if (!prior) throw Error('host-lineage-conflict')
+    if (prior.family === actual.family) continue
+    const originated = host.reviewSeen || host.conditions.some(c => c.owner === prior.id) || measured && (prior.id === 'qe-primary' && reviewerFamily(measured.checkpoint) === prior.family || prior.id === 'qe-precision' && measured.checkpoint.qe2)
+    if (!originated) prior.family = actual.family
+    else if (!bound.some(r => r.id === actual.id + ':' + actual.family)) bound.push({ id: actual.id + ':' + actual.family, family: actual.family })
+  }
+  if (host.reviewers.some(r => !r.id.includes(':') && !requested.some(n => n.id === r.id)) || bound.length > 16) throw Error('host-lineage-conflict')
+  return bound
+}
+export function runGate({ action, repo, feature, phase, reviewers }) {
+  if (!phases.includes(phase) || !['prepare', 'evaluate'].includes(action)) throw Error('invalid-command')
+  repo = realpathSync(repo); feature = resolve(repo, feature)
+  const current = measureManifest(repo, feature, phase)
+  const paths = checkpointPaths(repo, feature, phase)
+  let host = existsSync(paths.host) ? readJson(paths.host) : null
+  const measuredCheckpoint = phase === 'qe' ? qeCheckpoint(repo, feature) : null
+  if (action === 'prepare') {
+    if (!array(reviewers, 16) || !reviewers.length || !reviewers.every(r => dictionary(r, ['id', 'family']) && text(r.id) && ['codex', 'claude', 'owner-exception'].includes(r.family)) || new Set(reviewers.map(r => r.id)).size !== reviewers.length) throw Error('reviewers-invalid')
+    if (host && (host.phase !== phase || host.schema !== SCHEMA || !array(host.conditions) || typeof host.reviewSeen !== 'boolean')) throw Error('host-lineage-conflict')
+    if (host && existsSync(paths.review)) {
+      const pending = retainPendingReceipt(host, paths.review)
+      host = pending.next; writeJson(paths.host, host)
+      if (pending.problem) throw Error('pending-reviewer-receipt-needs-origin-review')
+    }
+    reviewers = bindReviewers(host, reviewers, measuredCheckpoint)
+    const revision = digest(JSON.stringify(current))
+    const snapshot = host?.snapshot?.revision === revision ? host.snapshot : { nonce: randomUUID(), revision, manifest: current }
+    const priorManifest = new Map((host?.snapshot?.manifest || []).map(p => [p.path, p.digest]))
+    const newManifest = new Map(current.map(p => [p.path, p.digest]))
+    const changedPaths = host?.snapshot?.revision === revision ? host.changedPaths : host ? [...new Set([...(host.changedPaths || []), ...[...new Set([...priorManifest.keys(), ...newManifest.keys()])].filter(path => priorManifest.get(path) !== newManifest.get(path))])].sort() : []
+    const next = { schema: SCHEMA, phase, reviewers, snapshot, conditions: host?.conditions || [], reviewSeen: host?.reviewSeen || false, rework: Boolean(host && (host.rework || host.reviewSeen && (host.snapshot.revision !== revision || host.conditions.length > 0))), changedPaths }
+    writeJson(paths.host, next)
+    return { ...result(phase, 'prepared', revision, []), nonce: snapshot.nonce, manifest: current, conditions: next.conditions, reviewers, checkpointDigest: measuredCheckpoint?.checkpointDigest || null }
+  }
+  if (!host) return result(phase, 'not-established', null, ['host-lineage-missing'])
+  if (!existsSync(paths.review)) return result(phase, 'not-established', host.snapshot.revision, ['reviewer-receipt-missing'], host.conditions.map(c => c.id))
+  const receipt = readJson(paths.review)
+  let verdict = evaluateReviewConvergence(host, receipt, current)
+  let closure = null
+  if (phase === 'qe' && verdict.verdict === 'closed' && measuredCheckpoint) {
+    closure = reconcileCheckpoint(host, receipt, measuredCheckpoint, repo, feature)
+    if (!closure) verdict = result(phase, 'not-established', host.snapshot.revision, ['historical-checkpoint-own-verification-missing'])
+  }
+  // Preserve independently owned findings even on refusal. Never import author/scribe claims.
+  // Invalid ownership/meaning refuses without overwriting the prior host authority.
+  const owners = host.reviewers.map(r => r.id)
+  const preserved = new Map(host.conditions.map(c => [c.id, c]))
+  if (receipt?.schema === SCHEMA && receipt.phase === phase && array(receipt.reviews)) {
+    for (const r of receipt.reviews) if (owners.includes(r?.reviewer) && host.reviewers.find(p => p.id === r.reviewer)?.family === r.family && r.independent === true) {
+      for (const c of [...(array(r.conditions) ? r.conditions : []), ...(array(r.newRisks?.conditions) ? r.newRisks.conditions : [])]) {
+        if (condition(c, owners) && c.owner === r.reviewer && !preserved.has(c.id)) preserved.set(c.id, c)
+      }
+    }
+  }
+  if (receipt?.phase === phase && receipt.nonce === host.snapshot.nonce && receipt.revision === host.snapshot.revision && risks(receipt.author?.newRisks, owners)) {
+    for (const c of receipt.author.newRisks.conditions) if (!preserved.has(c.id)) preserved.set(c.id, c)
+  }
+  writeJson(paths.host, { ...host, conditions: [...preserved.values()], reviewSeen: true, changedPaths: verdict.verdict === 'closed' ? [] : host.changedPaths })
+  if (closure && verdict.verdict === 'closed') return { ...verdict, checkpointClosure: closure }
+  return verdict
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  let phase = 'qe'
+  try {
+    const args = process.argv.slice(2)
+    const action = args.shift()
+    const options = {}
+    while (args.length) {
+      const key = args.shift()
+      if (!['--repo', '--feature', '--phase', '--reviewers'].includes(key) || !args.length || Object.hasOwn(options, key)) throw Error('invalid-arguments')
+      options[key] = args.shift()
+    }
+    phase = options['--phase']
+    if (!options['--repo'] || !options['--feature'] || !phases.includes(phase)) throw Error('invalid-arguments')
+    const output = runGate({ action, repo: options['--repo'], feature: options['--feature'], phase, reviewers: options['--reviewers'] ? JSON.parse(options['--reviewers']) : undefined })
+    process.stdout.write(JSON.stringify(output) + '\n')
+    process.exitCode = ['closed', 'prepared'].includes(output.verdict) ? 0 : output.verdict === 'unresolved' ? 1 : 3
+  } catch (error) {
+    process.stdout.write(JSON.stringify(result(phases.includes(phase) ? phase : 'qe', 'not-established', null, [String(error.message)])) + '\n')
+    process.exitCode = 3
+  }
+}