@open-agent-toolkit/cli 0.1.41 → 0.1.42

package/assets/agents/oat-phase-implementer.md

@@ -1,6 +1,6 @@
 ---
 name: oat-phase-implementer
-version: 1.0.2
+version: 1.0.3
 description: Implements a single plan phase end-to-end — reads artifacts once, executes tasks sequentially, commits per task, self-reviews, and returns a structured summary. Dispatched by oat-project-implement.
 tools: Read, Write, Edit, Bash, Grep, Glob
 color: cyan
@@ -46,7 +46,7 @@ For Codex, `provider-default` means the base/unpinned role follows Codex configu
 
 If `mode: fix`, the block also includes:
 
-- **review_artifact**: Path to the review artifact from the reviewer (e.g., `reviews/p02-review-YYYY-MM-DD.md`)
+- **review_artifact**: Path to the review artifact from the reviewer (e.g., `reviews/p02-review-2026-01-28T140322Z.md`)
 - **findings**: Critical and Important findings list
 - **prior_summary**: Your own prior `implement` run summary (what was previously built)
 

package/assets/agents/oat-reviewer.md

@@ -1,6 +1,6 @@
 ---
 name: oat-reviewer
-version: 1.1.3
+version: 1.1.4
 description: Unified reviewer for OAT projects - mode-aware verification of requirements/design alignment and code quality. Writes a review artifact to disk by default, or returns structured findings in-memory when dispatched in structured-output mode.
 tools: Read, Bash, Grep, Glob, Write
 color: yellow
@@ -287,19 +287,21 @@ Write the review artifact to the specified path.
 
 **File path format:**
 
-- Phase review: `{project}/reviews/pNN-review-YYYY-MM-DD.md`
-- Final review: `{project}/reviews/final-review-YYYY-MM-DD.md`
-- Task review: `{project}/reviews/pNN-tNN-review-YYYY-MM-DD.md`
-- Range review: `{project}/reviews/range-review-YYYY-MM-DD.md`
+Use a seconds-precision **UTC** timestamp token (`YYYY-MM-DDTHHMMSSZ`, from `date -u +%Y-%m-%dT%H%M%SZ` — the `-u` and the trailing `Z` are mandatory) so same-scope, same-day re-reviews never collide and always sort by recency. Never emit a local-time or `Z`-less timestamp: a timezone-less datetime mis-orders artifacts written by agents in different timezones.
 
-**If file already exists for today:** add `-v2`, `-v3`, etc.
+- Phase review: `{project}/reviews/pNN-review-YYYY-MM-DDTHHMMSSZ.md`
+- Final review: `{project}/reviews/final-review-YYYY-MM-DDTHHMMSSZ.md`
+- Task review: `{project}/reviews/pNN-tNN-review-YYYY-MM-DDTHHMMSSZ.md`
+- Range review: `{project}/reviews/range-review-YYYY-MM-DDTHHMMSSZ.md`
+
+The timestamp token must match the `oat_generated_at` frontmatter for the same run. In the unlikely event a file with that exact second already exists, append `-v2`, `-v3`, etc.
 
 **Review artifact template:**
 
 ````markdown
 ---
 oat_generated: true
-oat_generated_at: YYYY-MM-DD
+oat_generated_at: YYYY-MM-DDTHH:MM:SSZ
 oat_review_scope: { scope }
 oat_review_type: { code|artifact|analysis }
 oat_review_invocation: { manual|auto|gate }
@@ -308,7 +310,7 @@ oat_project: { project-path }
 
 # {Code|Artifact|Analysis} Review: {scope}
 
-**Reviewed:** YYYY-MM-DD
+**Reviewed:** YYYY-MM-DDTHH:MM:SSZ
 **Scope:** {scope description}
 **Files reviewed:** {N}
 **Commits:** {range or count}

package/assets/docs/cli-utilities/workflow-gates.md

@@ -71,6 +71,61 @@ status when the configured threshold is met. `cross-provider-exec` does not do
 that interpretation; for generic prompts it still returns only the child process
 status.
 
+`oat-project-implement` uses `oat gate review` per phase when a project opts in
+via the `oat_phase_review_gate` plan frontmatter — a non-pausing gate that runs
+after each selected phase's standard reviewer passes. See
+[Reviews → Phase review gate](../workflows/projects/reviews.md#phase-review-gate)
+for the frontmatter contract and how passing versus blocking gates are
+dispositioned.
+
+### Gate completion signal
+
+The canonical "how do I know the gate finished" signal is the structured result
+`oat --json gate review` writes to stdout on exit, together with the process
+exit code. Orchestrators should run the gate synchronously and read that
+envelope — do **not** poll the `reviews/` directory for a file to appear or
+watch the provider process's log for liveness. Filesystem and log-liveness
+heuristics are unreliable: a re-gate can momentarily surface a prior round's
+artifact, and a lingering provider side-process says nothing about whether the
+review committed.
+
+Every terminal envelope carries a `runId` (unique per gate invocation) and,
+once an artifact exists, its `generatedAt` (the artifact's seconds-precision
+`oat_generated_at`), so a caller can correlate the result to the exact artifact
+and disambiguate re-gate rounds:
+
+| `status`                     | Exit | Meaning                                                   |
+| ---------------------------- | ---- | --------------------------------------------------------- |
+| `ok`                         | 0    | Review completed; gate passed at the threshold.           |
+| `blocked`                    | 1    | Review completed; findings at/above the threshold.        |
+| `review_failed`              | ≠0   | The provider target exited non-zero; no verdict.          |
+| `artifact_validation_failed` | 1    | Provider ran but the review artifact could not be parsed. |
+
+`ok` and `blocked` also include `outcome`, `artifactPath`, `counts`, `scope`,
+and `handoff`. Treat any status other than `ok`/`blocked` as an operational
+failure, not a passing gate.
+
+**Drive gates through `oat gate review`, not raw provider invocation.** An
+orchestrator that hand-rolls the review (for example, calling
+`codex exec … oat-project-review-provide <scope>` directly) and then watches
+`reviews/` for a file is reimplementing — less reliably — what the CLI already
+does: `oat gate review` snapshots the reviews directory, dispatches the
+provider, and attributes the produced artifact by content hash, so it is immune
+to a stale file lingering from a prior round. It works standalone, not only
+inside the `oat-project-implement` auto-loop — a one-off final review is just:
+
+```bash
+oat --json gate review \
+  --project "$PROJECT_PATH" \
+  --review-type code \
+  --review-scope final \
+  --exit-nonzero-on important \
+  'Use oat-project-review-provide code final to review the current project'
+```
+
+Read the resulting envelope and exit code; that is the whole completion
+contract.
+
 ## Exec targets
 
 `oat gate cross-provider-exec` chooses from `workflow.gates.execTargets`.

package/assets/docs/reference/cli-reference.md

@@ -68,7 +68,7 @@ Notable commands introduced in the current CLI surface:
 - `oat repo archive sync [project-name]` - hydrate archived project snapshots from the configured repo-scoped S3 archive into `.oat/projects/archived/`. The old `oat project archive sync` path remains as a deprecated shim.
 - `oat project validate-plan --project-path <path>` - validates `oat_plan_parallel_groups` metadata in `plan.md`; exits non-zero on invalid. See [Implementation Execution](../workflows/projects/implementation-execution.md#validating-plan-metadata).
 - `oat project set-mode` — deprecated no-op. Execution mode is no longer user-selectable; emits a deprecation warning and preserves the `--json` contract.
-- `oat gate review <prompt...>` - run a stateful OAT review through the target registry, parse the produced review artifact, and exit nonzero for configured blocking findings; produced gate reviews use `oat_review_invocation: gate` and still require `oat-project-review-receive` handoff before they are dispositioned.
+- `oat gate review <prompt...>` - run a stateful OAT review through the target registry, parse the produced review artifact, and exit nonzero for configured blocking findings; produced gate reviews use `oat_review_invocation: gate` and still require `oat-project-review-receive` handoff before they are dispositioned. With `--json`, the result envelope on exit is the canonical completion signal — `status` (`ok` | `blocked` | `review_failed` | `artifact_validation_failed`), `runId`, `generatedAt`, `artifactPath` — so orchestrators should read it rather than poll the filesystem. Runs standalone (e.g. `--review-scope final`), not only inside `oat-project-implement`. See [Workflow Gates → Gate completion signal](../cli-utilities/workflow-gates.md#gate-completion-signal).
 - `oat gate cross-provider-exec <prompt...>` - choose an available exec target while avoiding the current runtime by default, then run the prompt with the chosen target's configured base command and exit with the child status.
 
 ## `oat config` surface flags

package/assets/docs/workflows/projects/artifacts.md

@@ -57,6 +57,7 @@ See [Project Splitting](splitting.md) for the full parent/child model.
 
 - `oat_plan_hill_phases` — list of phase IDs to pause at for HiLL checkpoints.
 - `oat_plan_parallel_groups` — declares which phases may execute concurrently in worktrees. See below.
+- `oat_phase_review_gate` — opt-in non-pausing external review gate that runs after a phase's standard reviewer passes. See below.
 
 #### oat_plan_parallel_groups
 
@@ -85,6 +86,27 @@ Each inner array is a group of phases that execute concurrently in their own wor
 
 Before dispatching, `oat-project-implement` invokes `oat project validate-plan --project-path "${PROJECT_PATH}"`. Non-zero exit blocks the run. See [CLI Reference](../../reference/cli-reference.md) and [Implementation Execution](implementation-execution.md) for details.
 
+#### oat_phase_review_gate
+
+Enable an optional, non-pausing external review gate that runs after each selected phase's standard reviewer passes and its bookkeeping is committed:
+
+```yaml
+oat_phase_review_gate:
+  enabled: true
+  phases: [] # empty or omitted = every implementation phase
+  review_type: code
+  exit_nonzero_on: important
+```
+
+**Semantics:**
+
+- Missing, `null`, or `enabled: false` → disabled (default). `enabled: true` activates the gate.
+- `phases` → optional. Empty or missing runs the gate after every implementation phase; a populated list restricts it to those phase IDs, each of which must exist in the plan body.
+- `review_type` → optional, defaults to `code`. Only `code` is supported for phase gates.
+- `exit_nonzero_on` → optional, defaults to `important`. One of `critical`, `important`, `medium`, `minor`. This is the blocking threshold: findings at or above it stop the phase; sub-threshold findings are dispositioned by the judgment sweep rather than ignored.
+
+A malformed gate stops the run before task execution rather than being silently disabled. The gate is independent of HiLL checkpoints and reuses the existing `oat gate review` target config — it does not hardcode a `--target`. See [Reviews → Phase review gate](reviews.md#phase-review-gate) for the runtime behavior and disposition rules.
+
 ## Reference artifacts
 
 - `.oat/templates/*.md`

package/assets/docs/workflows/projects/hill-checkpoints.md

@@ -10,6 +10,8 @@ OAT supports two checkpoint classes:
 - Workflow phase checkpoints
 - Plan phase checkpoints
 
+The [phase review gate](reviews.md#phase-review-gate) (`oat_phase_review_gate`) is a separate, non-pausing mechanism — it does not pause on a passing gate and never modifies the HiLL keys below (`oat_hill_completed`, `oat_plan_hill_phases`).
+
 ## Workflow checkpoints (`state.md`)
 
 Frontmatter keys:

package/assets/docs/workflows/projects/implementation-execution.md

@@ -187,7 +187,8 @@ For each phase in the plan (whether sequential or inside a parallel group):
 5. **Parse the verdict:** zero Critical + zero Important findings → `pass`; otherwise `fail`.
 6. **On fail, run the bounded fix loop** (see below).
 7. **Update artifacts** (`implementation.md`, `plan.md` review row, `state.md`) and make the mandatory bookkeeping commit.
-8. **HiLL checkpoint** if the phase id is listed in `oat_plan_hill_phases`.
+8. **Phase review gate** — when `oat_phase_review_gate` selects the phase, run the optional non-pausing external gate (`oat gate review`) after the step 7 bookkeeping commit and before the HiLL check. A passing gate continues automatically; a blocking gate is received and fixed, reusing the bounded fix loop's `oat_orchestration_retry_limit`. See [Reviews → Phase review gate](reviews.md#phase-review-gate).
+9. **HiLL checkpoint** if the phase id is listed in `oat_plan_hill_phases`.
 
 ### Bounded fix loop
 

package/assets/docs/workflows/projects/reviews.md

@@ -107,6 +107,23 @@ Auto-triggered reviews use `oat_review_invocation: auto` in the review artifact
 
 This feature is opt-in and disabled by default. When disabled, the manual `oat-project-review-provide` workflow applies.
 
+## Phase review gate
+
+The phase review gate is an optional, **non-pausing** external review gate that runs after a phase's standard per-phase reviewer passes and the phase bookkeeping is committed. Where the Tier 1 reviewer is an in-session self-review, the gate calls `oat gate review` against the configured cross-provider target, adding an independent perspective before implementation moves to the next phase. It is enabled per-project through `plan.md` frontmatter (`oat_phase_review_gate`; see [Project Artifacts](artifacts.md#oat_phase_review_gate) for the field shape and validation).
+
+It is independent of [HiLL checkpoints](hill-checkpoints.md): a passing gate does not pause, and the gate never touches `oat_hill_completed`, `oat_plan_hill_phases`, or `oat_auto_review_at_hill_checkpoints`.
+
+Gate-produced review artifacts use `oat_review_invocation: gate` in frontmatter (the third invocation marker alongside `manual` and `auto`). The gate verdict — controlled by `exit_nonzero_on` (default `important`) — decides whether the **phase stops**; it does not decide whether sub-threshold findings are ignored. Either way the produced artifact is consumed by `oat-project-review-receive`, autonomously and without user prompts, so findings never evaporate:
+
+- **Passing gate** (no findings at or above the threshold): receive runs a non-pausing **judgment sweep**. It makes a per-finding decision for each Medium/Minor — defer to final review (the default, recorded so [final review](#phase-and-final-review) resurfaces it), address now (only for small, contained, low-risk fixes, which do **not** re-trigger the standard reviewer or re-gate the phase), or reject with rationale — then archives the artifact. Address-now is an exception, not the norm; if such a fix reveals a Critical/Important concern it escalates to the blocking path.
+- **Blocking gate** (one or more findings at or above the threshold): receive converts findings to fix tasks and implementation re-runs the standard reviewer and the gate for the phase. These block → fix → re-gate rounds are bounded by `oat_orchestration_retry_limit` (default `2`); exhausting the bound stops a sequential run or excludes the phase in a parallel group, matching the standard fix loop's terminal handling.
+
+Gate-originated artifacts (`oat_review_invocation: gate`) are excluded from the same-scope review-cycle cap in `oat-project-review-receive`. The cap measures failed fix cycles of the standard review loop, so counting gate artifacts would trip it on artifact volume rather than real fix rounds.
+
+When a phase is re-gated multiple times, each round produces a distinct review artifact — filenames and `oat_generated_at` are seconds-precision, so rounds never collide and `oat review latest` resolves the newest. An orchestrator should know a gate finished from the `oat --json gate review` result envelope on process exit (`status`, `runId`, `generatedAt`), not by watching the `reviews/` directory or the provider's log; see [Gate completion signal](../../cli-utilities/workflow-gates.md#gate-completion-signal).
+
+This feature is opt-in and disabled by default (missing or `enabled: false`). For a parallel phase group, selected gates run after fan-in and bookkeeping, one per merged phase in plan order.
+
 ## Auto artifact-review loops
 
 Generated planning and analysis artifacts have a separate review loop from code/phase reviews.

package/assets/public-package-versions.json

@@ -1,6 +1,6 @@
 {
-  "cli": "0.1.41",
-  "docs-config": "0.1.41",
-  "docs-theme": "0.1.41",
-  "docs-transforms": "0.1.41"
+  "cli": "0.1.42",
+  "docs-config": "0.1.42",
+  "docs-theme": "0.1.42",
+  "docs-transforms": "0.1.42"
 }

package/assets/skills/oat-project-implement/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-project-implement
-version: 2.0.24
+version: 2.0.25
 description: Use when plan.md is ready for execution. Dispatches phase-level subagents with bounded fix loops; supports plan-declared parallel phase groups with worktree-isolated execution and ordered fan-in.
 oat_gateable: true
 argument-hint: '[--retry-limit <N>] [--dry-run]'
@@ -679,6 +679,39 @@ This setting controls only the extra `oat-project-review-provide` lifecycle revi
 
 **On resume:** If `oat_auto_review_at_hill_checkpoints` is already present in plan.md frontmatter, skip Touchpoint A entirely — do not re-ask, do not re-read config, do not print the auto-review note. The stored value is authoritative. If only legacy `oat_auto_review_at_checkpoints` is present, treat it as authoritative for this run and write the new `oat_auto_review_at_hill_checkpoints` key on the next plan frontmatter update.
 
+### Step 2.6: Validate Optional Phase Review Gate
+
+Read `oat_phase_review_gate` from `"$PROJECT_PATH/plan.md"` frontmatter when present.
+
+This is the plan-level `phaseReviewGate` setting: an optional, non-pausing external lifecycle review gate that runs after a phase's standard per-phase self-review passes. It uses the existing `oat gate review` target configuration to run a cross-provider review, then maps the produced review artifact to a blocking/non-blocking gate result.
+
+Valid shape:
+
+```yaml
+oat_phase_review_gate:
+  enabled: true
+  phases: [] # empty or omitted = every implementation phase
+  review_type: code
+  exit_nonzero_on: important
+```
+
+Validation rules:
+
+- Missing, `null`, or `enabled: false` means disabled.
+- `enabled: true` activates the gate.
+- `phases` is optional. If missing or empty (`[]`), run after every implementation phase. If populated, every value must be a known plan phase ID.
+- `review_type` is optional and defaults to `code`. This skill only supports `code` phase gates; any other value is invalid for implementation phase execution.
+- `exit_nonzero_on` is optional and defaults to `important`. Allowed values: `critical`, `important`, `medium`, `minor`.
+
+If the setting is invalid, stop before task execution and ask the user to repair `plan.md`. Do not silently disable a malformed gate.
+
+This setting is independent from HiLL checkpoints:
+
+- It does not pause when the gate passes.
+- It does not append to `oat_hill_completed`.
+- It does not alter `oat_plan_hill_phases` or `oat_auto_review_at_hill_checkpoints`.
+- It uses the existing gate target config; do not hardcode `--target` in reusable plan execution unless the user explicitly asks for manual/debug routing.
+
 ### Step 3: Check Implementation State
 
 Check if implementation already started:
@@ -892,6 +925,43 @@ On reviewer verdict `fail`, run a bounded fix loop.
 - **Sequential mode:** STOP the run. Surface to user with phase ID, unresolved findings, review artifact path. Do not proceed to subsequent phases.
 - **Parallel group mode:** mark the phase `excluded`. Do not merge its worktree. Continue the remaining phases in the group. Report in Outstanding Items after the group completes.
 
+### Optional External Phase Review Gate
+
+After the standard per-phase reviewer passes and after the required phase bookkeeping commit is cleanly recorded, check `oat_phase_review_gate`.
+
+If the gate is enabled and the current phase is selected:
+
+1. Run the gate from the orchestration branch with the active project path:
+
+   ```bash
+   oat --json gate review \
+     --project "$PROJECT_PATH" \
+     --review-type code \
+     --review-scope "{pNN}" \
+     --exit-nonzero-on "{threshold}" \
+     '$oat-project-review-provide code {pNN}'
+   ```
+
+   - `{threshold}` comes from `oat_phase_review_gate.exit_nonzero_on` (default: `important`).
+   - `{pNN}` is the completed phase ID.
+   - Do not pass `--target` in normal execution; the existing gate config selects the cross-provider target.
+   - The gate CLI injects gate context into the review prompt. The produced review artifact must use `oat_review_invocation: gate`.
+
+2. Parse the JSON result. The gate verdict (`exit_nonzero_on: {threshold}`) decides whether the phase **stops**; it does not decide whether sub-threshold findings are ignored. Either way the produced artifact must be **consumed** — passing gate artifacts are not left unprocessed at the top level of `reviews/`.
+   - `status: "ok"` / exit code `0` means the phase gate passed at the configured threshold, so the phase does not stop. Still run `oat-project-review-receive` for the reported artifact path in non-pausing **judgment-sweep** mode (pass gate-passed context so receive selects sweep disposition). The sweep makes a per-finding judgment for each Medium/Minor — defer to final (default), address now (small/contained/low-risk fixes only), or reject with rationale — writes those durable dispositions into `implementation.md`, and archives the artifact. Then continue without pausing. Address-now fixes from a passing gate do **not** re-trigger the standard reviewer or re-gate the phase.
+   - `status: "blocked"` / non-zero exit due to review findings means blocking findings exist. Run `oat-project-review-receive` for the reported artifact path (blocking disposition) before treating the gate review as consumed.
+   - A non-zero exit caused by target execution failure, artifact validation failure, or missing review artifact is an operational failure. Stop and surface the gate output; do not continue as if the gate passed.
+
+3. If `oat-project-review-receive` adds fix tasks (blocking gate, or a sweep address-now fix that revealed a Critical/Important concern):
+   - Return to task execution for the newly added review-fix tasks.
+   - After fixes land, re-run the standard per-phase reviewer and this external phase gate for the same phase.
+   - Continue only after both the standard reviewer and the external phase gate pass.
+   - Bound these gate block → fix → re-gate rounds by `oat_orchestration_retry_limit` (from `state.md`, default `2`). If the limit is exhausted with the gate still blocking, apply the same terminal handling as the standard bounded fix loop: **sequential mode** stops the run and surfaces the phase ID, unresolved findings, and artifact path; **parallel group mode** marks the phase `excluded` and reports it in Outstanding Items.
+
+4. If the judgment sweep (passing gate) records only deferrals/rejections and no blocking fix tasks, record the receive result and continue.
+
+For a parallel group, run selected phase gates after fan-in and bookkeeping, one gate per successfully merged phase in plan order. If a phase gate blocks, stop the schedule and process that gate's review before starting later schedule entries.
+
 ### Parallel Group Execution
 
 When the current schedule entry is a multi-phase group, execute as follows.
@@ -966,7 +1036,7 @@ When the current schedule entry is a multi-phase group, execute as follows.
 
     For phases that were excluded (fix-loop exhausted), preserve the worktree and log its path in `implementation.md` Outstanding Items.
 
-8.  **Bookkeeping commit** after the group completes. Then HiLL checkpoint check.
+8.  **Bookkeeping commit** after the group completes. Then run any selected external phase review gates. After those gates pass, perform the HiLL checkpoint check.
 
 ### Step 7: Artifact Updates After Each Phase (or Group)
 
@@ -1039,7 +1109,7 @@ git add {PROJECT_PATH}/implementation.md {PROJECT_PATH}/state.md {PROJECT_PATH}/
 git commit -m "chore(oat): bookkeeping after {pNN} {pass|fail}"
 ```
 
-Then check HiLL checkpoint — if the phase ID is in `oat_plan_hill_phases`, pause for user approval before continuing.
+Then run the optional external phase review gate for the completed phase when `oat_phase_review_gate` selects it. After the gate passes or is skipped, check HiLL checkpoint — if the phase ID is in `oat_plan_hill_phases`, pause for user approval before continuing.
 
 ### Step 8: Check Plan Phase Completion
 
@@ -1130,6 +1200,7 @@ Do not use `git add -A` or glob patterns. Only commit the three project artifact
 
 - **Workflow HiLL** (`oat_hill_checkpoints` in state.md): Gates between workflow phases (discovery → spec → design → plan → implement). Checked by oat-project-progress router.
 - **Plan phase checkpoints** (`oat_plan_hill_phases` in plan.md): Gates at plan phase boundaries during implementation. `[]` means pause after every phase; a populated array pauses only after listed phases. The field may be absent only before the first implementation-run confirmation. Listed phases are where you stop AFTER completing them.
+- **Phase review gate** (`oat_phase_review_gate` in plan.md): Optional non-pausing external review gate after a completed phase passes the standard reviewer. Missing/disabled means skip; `phases: []` means gate every implementation phase. Passing gates continue automatically; blocking gates are received/fixed before execution proceeds.
 
 **Revision phase completion handling:**
 
@@ -1296,7 +1367,7 @@ echo "$FINAL_ROW"
 **If final review row exists and status is `passed`:**
 
 - Example row:
-  - `| final | code | passed | 2026-01-28 | reviews/final-review-2026-01-28.md |`
+  - `| final | code | passed | 2026-01-28 | reviews/final-review-2026-01-28T140322Z.md |`
 - Check:
   ```bash
   echo "$FINAL_ROW" | grep -qE "^\\|\\s*final\\s*\\|.*\\|\\s*passed\\s*\\|" && echo "passed"
@@ -1446,7 +1517,7 @@ Final verification:
 
 Final review:
 - Status: ✓ passed
-- Artifact: reviews/final-review-{date}.md
+- Artifact: reviews/final-review-{timestamp}.md
 
 Next: Create PR or run the oat-project-pr-final skill (when available)
 ```

package/assets/skills/oat-project-review-provide/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-project-review-provide
-version: 1.3.8
+version: 1.3.10
 description: Use when the user explicitly asks to review an OAT project — e.g. "review project", "review the project", "run project review", or confirms a previously offered review. Do NOT auto-invoke on completed work alone. Resolves a project review scope and offers before running.
 disable-model-invocation: false
 user-invocable: true
@@ -25,11 +25,13 @@ Reviewers should distinguish implementation defects from artifact drift. If code
 
 ## Model Invocation Gate
 
-This skill is model-invokable only for explicit review asks such as "review project" or "review the project", or when the user confirms a previously offered project-review step. Do NOT auto-invoke merely because a task, phase, or implementation appears complete.
+This skill is model-invokable only for explicit review asks such as "review project" or "review the project", or when the user confirms a previously offered project-review step. A gate-originated request from `oat gate review` is also an explicit review ask. Do NOT auto-invoke merely because a task, phase, or implementation appears complete.
 
 Before acting, verify that there is an active OAT project or a user-provided review target that can be resolved to project state. If neither exists, do not run this skill; offer `oat-project-open` / `oat-project-quick-start` for project workflow setup, or `oat-review-provide` for a non-project ad-hoc review.
 
-When the gate passes, summarize the inferred review type and scope, then ask before running the review.
+When the invocation is manual, summarize the inferred review type and scope, then ask before running the review.
+
+**Gate-originated mode:** If the request context says the review is gate-originated, set `REVIEW_INVOCATION=gate`, honor any provided review type/scope arguments, and run without interactive confirmation prompts. The gate session is already the explicit authorization boundary. If subagent dispatch is unavailable, run the review inline in the current gate session instead of handing off to a fresh session.
 
 ## Mode Assertion
 
@@ -123,7 +125,7 @@ Tell user:
   - `oat-project-quick-start` (new quick project)
   - `oat-project-import-plan` (external plan import)
 
-If validation passes, derive `{project-name}` as basename of `PROJECT_PATH`. Summarize the resolved project/review target and ask before continuing to Step 1.
+If validation passes, derive `{project-name}` as basename of `PROJECT_PATH`. Summarize the resolved project/review target. For manual invocation, ask before continuing to Step 1. For `REVIEW_INVOCATION=gate`, continue without asking.
 
 ### Step 1: Parse Arguments or Ask
 
@@ -424,6 +426,8 @@ Files changed: {FILE_COUNT}
 Proceed with review?
 ```
 
+If `REVIEW_INVOCATION=gate`, print the same scope summary but do not ask `Proceed with review?`; continue directly.
+
 ### Step 4.1: Dispatch Profile Override Advisory (Artifact Plan Only)
 
 When reviewing `artifact plan`, apply this Dispatch Profile override advisory:
@@ -536,6 +540,7 @@ Detection logic:
 - If the runtime can dispatch reviewer work (`subagent_type` in Claude Code, Cursor invocation via `/name` or natural mention, or Codex multi-agent spawn/auto-spawn) → **Tier 1**.
 - If the Task tool is not available or subagent dispatch is not supported → **Tier 2**.
 - If user explicitly requests inline or confirms they are already in a fresh session → **Tier 3**.
+- If `REVIEW_INVOCATION=gate` and Tier 1 is unavailable, skip Tier 2 and use **Tier 3** inline. Do not return fresh-session instructions from a gate invocation.
 
 **Step 6b: Tier 1 — Subagent (if available)**
 
@@ -566,6 +571,7 @@ If subagent not available:
 - If user is already in a fresh session (confirmed), proceed to Tier 3.
 - If Codex reported `authorization required` and the user approved delegation, do **not** use Tier 2. Return to Tier 1 and delegate to `oat-reviewer`.
 - If user prefers fresh session: provide instructions and exit.
+- If `REVIEW_INVOCATION=gate`: do not provide fresh-session instructions; run Tier 3 inline instead.
 
 Instructions for fresh session:
 
@@ -599,13 +605,15 @@ Review storage contract:
 
 **Naming convention:**
 
-- Phase review: `{PROJECT_PATH}/reviews/pNN-review-YYYY-MM-DD.md`
-- Task review: `{PROJECT_PATH}/reviews/pNN-tNN-review-YYYY-MM-DD.md`
-- Final review: `{PROJECT_PATH}/reviews/final-review-YYYY-MM-DD.md`
-- Range review: `{PROJECT_PATH}/reviews/range-review-YYYY-MM-DD.md`
-- Artifact review: `{PROJECT_PATH}/reviews/artifact-{artifact}-review-YYYY-MM-DD.md`
+Use a seconds-precision **UTC** timestamp token (`YYYY-MM-DDTHHMMSSZ`, from `date -u +%Y-%m-%dT%H%M%SZ` — the `-u` and the trailing `Z` are mandatory), not a date-only or local-time stamp, so that same-scope re-reviews and re-gates within one day never collide and `oat review latest` orders them by recency:
+
+- Phase review: `{PROJECT_PATH}/reviews/pNN-review-YYYY-MM-DDTHHMMSSZ.md`
+- Task review: `{PROJECT_PATH}/reviews/pNN-tNN-review-YYYY-MM-DDTHHMMSSZ.md`
+- Final review: `{PROJECT_PATH}/reviews/final-review-YYYY-MM-DDTHHMMSSZ.md`
+- Range review: `{PROJECT_PATH}/reviews/range-review-YYYY-MM-DDTHHMMSSZ.md`
+- Artifact review: `{PROJECT_PATH}/reviews/artifact-{artifact}-review-YYYY-MM-DDTHHMMSSZ.md`
 
-**If file exists for today:** append `-v2`, `-v3`, etc.
+Set `oat_generated_at` in the artifact frontmatter to the matching full timestamp (`YYYY-MM-DDTHH:MM:SSZ`). Same-second collisions are effectively impossible for sequential runs; if one occurs, append `-v2`, `-v3`, etc.
 
 **Important:** `PROJECT_PATH` here must be the resolved path from Step 1.5. If a worktree was detected, this path is relative to the worktree root, ensuring the artifact is written on the correct branch.
 
@@ -636,7 +644,7 @@ Shared ad-hoc companion reference (non-project mode):
 ```markdown
 ---
 oat_generated: true
-oat_generated_at: { today }
+oat_generated_at: { full UTC timestamp, e.g. 2026-07-06T11:16:01Z }
 oat_review_scope: { scope }
 oat_review_type: { code|artifact }
 oat_review_invocation: { manual|auto|gate }
@@ -655,9 +663,13 @@ oat_project: { PROJECT_PATH }
 
 - `manual` (default): Review was manually triggered by the user. `oat-project-review-receive` uses standard disposition behavior (user prompts for triage, minors auto-deferred for non-final scopes).
 - `auto`: Review was spawned by the auto-review checkpoint trigger in `oat-project-implement`. `oat-project-review-receive` uses relaxed disposition: minors are auto-converted to fix tasks (not deferred), no user prompts for disposition decisions.
-- `gate`: Review was spawned by `oat gate review`. Gate-originated reviews use normal stateful review-provide behavior: write the review artifact, update the `## Reviews` row, and commit review bookkeeping. `oat-project-review-receive` treats gate reviews with the same standard disposition behavior as manual reviews unless a future implementation explicitly designs autonomous receive.
+- `gate`: Review was spawned by `oat gate review` for a workflow gate. Gate-originated reviews use normal stateful review-provide behavior: write the review artifact, update the `## Reviews` row, and commit review bookkeeping. The gate CLI maps the review artifact findings to exit status, and `oat-project-review-receive` dispositions gate reviews autonomously (no user prompts) — selecting convert-to-fix-tasks when the gate **blocked** at its threshold, or non-pausing judgment-sweep disposition (defer / small-fix-now / reject, with sub-threshold findings recorded durably) when the gate **passed**.
+
+When `oat-project-implement` spawns this skill for auto-review at checkpoints, it passes context indicating auto invocation. Set `oat_review_invocation: auto` in the artifact frontmatter.
+
+When `oat gate review` invokes this skill, it includes gate-originated context instructing the reviewer to write `oat_review_invocation: gate`. Honor that instruction in the artifact frontmatter.
 
-When `oat-project-implement` spawns this skill for auto-review at checkpoints, it passes context indicating auto invocation. Set `oat_review_invocation: auto` in the artifact frontmatter. When `oat gate review` spawns this skill, set `oat_review_invocation: gate`. For all other invocations (user-triggered, fresh session), use `manual`.
+For all other invocations (user-triggered, fresh session), use `manual`.
 
 Gate parsing contract:
 

package/assets/skills/oat-project-review-receive/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-project-review-receive
-version: 1.5.4
+version: 1.5.6
 description: Use when the user explicitly asks to receive review findings for an OAT project — e.g. "receive review", "process review", "process the project review", or confirms a previously offered review-receive step. Do NOT auto-invoke merely because a review file exists. Resolves the latest review and offers before acting.
 disable-model-invocation: false
 user-invocable: true
@@ -102,7 +102,7 @@ fi
 
 Selection rules:
 
-- Use `oat review latest` as the first-choice resolver. It scans project reviews (`reviews/` and `reviews/archived/`) plus ad-hoc review locations and orders candidates by `oat_generated_at` frontmatter rather than filesystem mtime.
+- Use `oat review latest` as the first-choice resolver. It scans project reviews (`reviews/` and `reviews/archived/`) plus ad-hoc review locations and orders candidates by `oat_generated_at` frontmatter rather than filesystem mtime. Review artifacts carry a seconds-precision `oat_generated_at` and a matching timestamped filename, so same-scope same-day re-gates order deterministically and the newest round wins — never assume the plain `<scope>-review-<date>.md` name is current.
 - Read the JSON result:
   - `path: null` means no review target was found.
   - `kind: "project"` and `actionable: true` means this skill can process the target when the path is an active top-level project review.
@@ -267,15 +267,23 @@ Read `oat_review_type` and `oat_review_invocation` from review artifact frontmat
   - Require explicit user confirmation before applying any artifact edits.
   - Resolve findings directly in artifact files; do not convert findings into plan tasks.
   - Do not defer findings by default. Only use `rejected_with_rationale` for invalid findings, or `needs_user_direction` when user input is required.
-- If `oat_review_type == code` AND `oat_review_invocation == auto`:
-  - **Auto-disposition mode.** This review was spawned by the auto-review checkpoint trigger in `oat-project-implement`. Apply relaxed disposition defaults:
+- If `oat_review_type == code` AND `oat_review_invocation == auto`, OR `oat_review_invocation == gate` from a **blocking** gate (the gate-originated context does not indicate a passing-gate sweep):
+  - **Auto-disposition mode.** This review was spawned by the auto-review checkpoint trigger in `oat-project-implement` or by a blocking `oat gate review`. Apply relaxed disposition defaults:
     - Critical/Important/Medium: convert to fix tasks (same as manual mode)
-    - Minor: auto-convert to fix tasks unless clearly out of scope (e.g., cosmetic polish unrelated to changed code). Manual mode now also defaults minors to `convert` (see Step 9); auto mode keeps the same intent — fix everything while context is fresh — but without any user prompts.
-    - **No user prompts for disposition decisions.** The auto-review path runs fully autonomously.
+    - Minor: auto-convert to fix tasks unless clearly out of scope (e.g., cosmetic polish unrelated to changed code). Manual mode now also defaults minors to `convert` (see Step 9); auto/gate mode keeps the same intent — fix everything while context is fresh — but without any user prompts.
+    - **No user prompts for disposition decisions.** The auto/gate review path runs fully autonomously.
     - Genuinely ambiguous findings (e.g., a medium the agent disagrees with) are deferred with a note explaining why, rather than pausing for interactive resolution.
   - Follow the task-conversion flow in Steps 3-10 with these adjusted defaults.
-- If `oat_review_type == code` AND `oat_review_invocation == gate`:
-  - **Gate review mode.** This review was spawned by `oat gate review`, but receive remains standard disposition behavior. Treat `gate` the same as manual for prompts, finding conversion, artifact archival, and bookkeeping unless a future implementation explicitly designs an autonomous receive path.
+- If `oat_review_type == code` AND `oat_review_invocation == gate` from a **passing** gate (the gate-originated context indicates a passing-gate judgment sweep):
+  - **Judgment-sweep mode.** The phase gate already passed at its `exit_nonzero_on` threshold, so the phase does not stop. Consume the artifact anyway, so its sub-threshold findings become durable, ordered dispositions in `implementation.md` instead of evaporating. Fully non-pausing; no user prompts.
+    - The gate verdict decided whether the phase stops; it did **not** decide whether Medium/Minor findings are ignored. There are, by definition, no unresolved Critical/Important findings in a passing gate (if there were, the gate would have blocked).
+    - Make a per-finding **judgment call** for each Medium/Minor — do not mechanically dump them all:
+      - **Defer to final** (default): record under "Deferred Findings" (Mediums under "Deferred Findings (Medium)" so Step 8.5 resurfacing picks them up) with concrete rationale.
+      - **Address now:** only for small, contained, low-risk fixes. Apply the fix, commit it with the phase bookkeeping, and record the disposition. Do **not** re-run the standard reviewer or re-gate the phase for address-now fixes.
+      - **Reject** as false-positive / out-of-scope, with concrete rationale.
+    - `address now` is an **exception, not the norm** — when in doubt, defer. Do not let a passing gate drift into behaving like a Medium-blocking gate by habit.
+    - **Escalation exception:** if an address-now fix reveals or creates a Critical/Important concern, stop treating it as a sweep item. Convert it to a fix task and return control to the blocking-gate path (`oat-project-implement` re-runs the standard reviewer and the gate for the phase).
+    - Do not add blocking fix tasks for deferred or rejected findings. After recording all dispositions, archive the artifact (Step 7.5) and commit review bookkeeping (Step 7.6) as usual.
 - If `oat_review_type == code` (manual or `oat_review_invocation` absent):
   - Follow the existing task-conversion flow in Steps 3-10 with standard disposition behavior.
 
@@ -483,13 +491,15 @@ If the project itself is still untracked because earlier lifecycle steps never c
 
 **Bounded loop protection:**
 
-Count how many review cycles have occurred for this scope:
+Count how many review cycles have occurred for this scope. Exclude gate-originated artifacts (`oat_review_invocation: gate`): the cap measures failed fix cycles of the standard review loop, not artifact volume, and phase gate re-runs are governed by the phase review gate flow in `oat-project-implement`, not by this cap.
 
 ```bash
 {
   find "$PROJECT_PATH/reviews" -maxdepth 1 -type f -name "*$SCOPE_TOKEN*.md" 2>/dev/null
   find "$PROJECT_PATH/reviews/archived" -maxdepth 1 -type f -name "*$SCOPE_TOKEN*.md" 2>/dev/null
-} | wc -l
+} | while IFS= read -r artifact; do
+  grep -q "oat_review_invocation: gate" "$artifact" || echo "$artifact"
+done | wc -l
 ```
 
 **If 3 or more cycles:**

package/assets/skills/oat-review-provide/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-review-provide
-version: 1.2.2
+version: 1.2.3
 description: Use when you need an ad-hoc review outside an active OAT project lifecycle. Reviews code or artifacts without project phase state, unlike oat-project-review-provide.
 argument-hint: '[unstaged|staged|base_branch=<branch>|base_sha=<sha>|<sha1>..<sha2>|--files <path1,path2,...>] [--output <path>] [--mode auto|local|tracked|inline]'
 disable-model-invocation: true
@@ -151,18 +151,20 @@ If user asks for tracked `.oat/repo/reviews` and it is gitignored, warn and ask
 
 Derive a **scope slug** from the resolved scope mode so that the filename indicates what was reviewed:
 
-| Scope mode             | Slug derivation                      | Example filename                              |
-| ---------------------- | ------------------------------------ | --------------------------------------------- |
-| `base_branch=<branch>` | Current branch name                  | `ad-hoc-review-2026-02-16-oat-repo.md`        |
-| `unstaged`             | Literal `unstaged`                   | `ad-hoc-review-2026-02-16-unstaged.md`        |
-| `staged`               | Literal `staged`                     | `ad-hoc-review-2026-02-16-staged.md`          |
-| `--files <paths>`      | First 2–3 basenames, joined with `-` | `ad-hoc-review-2026-02-16-auth-login.md`      |
-| `base_sha=<sha>`       | Short SHA (7 chars)                  | `ad-hoc-review-2026-02-16-abc1234.md`         |
-| `<sha1>..<sha2>`       | Both short SHAs joined with `-`      | `ad-hoc-review-2026-02-16-abc1234-def5678.md` |
+| Scope mode             | Slug derivation                      | Example filename                                      |
+| ---------------------- | ------------------------------------ | ----------------------------------------------------- |
+| `base_branch=<branch>` | Current branch name                  | `ad-hoc-review-2026-02-16T140322Z-oat-repo.md`        |
+| `unstaged`             | Literal `unstaged`                   | `ad-hoc-review-2026-02-16T140322Z-unstaged.md`        |
+| `staged`               | Literal `staged`                     | `ad-hoc-review-2026-02-16T140322Z-staged.md`          |
+| `--files <paths>`      | First 2–3 basenames, joined with `-` | `ad-hoc-review-2026-02-16T140322Z-auth-login.md`      |
+| `base_sha=<sha>`       | Short SHA (7 chars)                  | `ad-hoc-review-2026-02-16T140322Z-abc1234.md`         |
+| `<sha1>..<sha2>`       | Both short SHAs joined with `-`      | `ad-hoc-review-2026-02-16T140322Z-abc1234-def5678.md` |
 
 ```bash
 mkdir -p "$OUTPUT_DIR"
-TODAY=$(date +%Y-%m-%d)
+# Seconds-precision UTC token so same-scope same-day re-reviews never collide and
+# order by recency in `oat review latest`. The trailing Z (UTC) is mandatory.
+STAMP=$(date -u +%Y-%m-%dT%H%M%SZ)
 
 # Derive SCOPE_SLUG based on scope mode (examples):
 # base_branch → SCOPE_SLUG=$(git branch --show-current | tr '/' '-')
@@ -174,10 +176,10 @@ TODAY=$(date +%Y-%m-%d)
 # Sanitize: lowercase, replace non-alphanumeric with '-', collapse runs, trim to 40 chars
 SCOPE_SLUG=$(echo "$SCOPE_SLUG" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g; s/--*/-/g; s/^-//; s/-$//' | cut -c1-40)
 
-OUT_FILE="$OUTPUT_DIR/ad-hoc-review-${TODAY}-${SCOPE_SLUG}.md"
+OUT_FILE="$OUTPUT_DIR/ad-hoc-review-${STAMP}-${SCOPE_SLUG}.md"
 ```
 
-If the file already exists (same scope reviewed twice in one day), suffix with `-v2`, `-v3`, etc.
+Set `oat_generated_at` in the artifact frontmatter to the matching full UTC timestamp (`YYYY-MM-DDTHH:MM:SSZ`). Same-second collisions are effectively impossible for sequential runs; if one occurs, suffix with `-v2`, `-v3`, etc.
 
 ### Step 4: Run Review
 

package/assets/skills/oat-review-provide/references/review-artifact-template.md

@@ -5,7 +5,7 @@ Use this template for non-project commit-range reviews.
 ````markdown
 ---
 oat_generated: true
-oat_generated_at: YYYY-MM-DD
+oat_generated_at: YYYY-MM-DDTHH:MM:SSZ
 oat_review_type: code
 oat_review_scope: { scope }
 oat_review_scope_mode: { files|unstaged|staged|range }

package/dist/commands/gate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/gate/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EAQL,KAAK,UAAU,EAIf,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,UAAU,EAEhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,UAAU,uBAAuB;IAC/B,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,mBAAmB,EAAE,CACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,cAAc,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D,eAAe,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,sBAAsB,EAAE,CACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,UAAU,EAAE,CACV,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CAC/B;AA0CD,UAAU,iBAAiB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,EAAE,gBAAgB,GAAG,cAAc,GAAG,SAAS,CAAC;IACvD,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC7B;AAED,UAAU,gBAAgB;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,KAAK,kBAAkB,GAAG,cAAc,GAAG,MAAM,CAAC;AAMlD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,UAAU,CAAC;CACpB;AAyZD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,EAC9C,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,kBAAkB,GACxB,kBAAkB,GAAG,IAAI,CAE3B;AAo6BD,wBAAgB,iBAAiB,CAC/B,SAAS,GAAE,OAAO,CAAC,uBAAuB,CAAM,GAC/C,OAAO,CAwKT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/gate/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,EAQL,KAAK,UAAU,EAIf,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,UAAU,EAEhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,UAAU,uBAAuB;IAC/B,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,mBAAmB,EAAE,CACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,cAAc,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D,eAAe,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,sBAAsB,EAAE,CACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,UAAU,EAAE,CACV,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CAC/B;AA0CD,UAAU,iBAAiB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,EAAE,gBAAgB,GAAG,cAAc,GAAG,SAAS,CAAC;IACvD,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC7B;AAED,UAAU,gBAAgB;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,KAAK,kBAAkB,GAAG,cAAc,GAAG,MAAM,CAAC;AAMlD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,UAAU,CAAC;CACpB;AAyZD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,EAC9C,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,kBAAkB,GACxB,kBAAkB,GAAG,IAAI,CAE3B;AAu7BD,wBAAgB,iBAAiB,CAC/B,SAAS,GAAE,OAAO,CAAC,uBAAuB,CAAM,GAC/C,OAAO,CAwKT"}

package/dist/commands/gate/index.js

@@ -1,9 +1,9 @@
 import { spawn } from 'node:child_process';
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { readdir, readFile } from 'node:fs/promises';
 import { basename, isAbsolute, join, relative } from 'node:path';
 import { buildCommandContext, } from '../../app/command-context.js';
-import { getFrontmatterBlock, getFrontmatterField, } from '../shared/frontmatter.js';
+import { getFrontmatterBlock, getFrontmatterField, parseGeneratedTime, } from '../shared/frontmatter.js';
 import { readGlobalOptions } from '../shared/shared.utils.js';
 import { BUILTIN_EXEC_TARGETS, readOatConfig, readOatLocalConfig, readUserConfig, writeOatConfig, writeOatLocalConfig, writeUserConfig, } from '../../config/oat-config.js';
 import { resolveEffectiveConfig, resolveExecTargets, resolveGate, } from '../../config/resolve.js';
@@ -502,7 +502,7 @@ async function readReviewGateArtifactCandidate(repoRoot, relativePath) {
     if (!generatedAt) {
         return null;
     }
-    const generatedTime = Date.parse(generatedAt);
+    const generatedTime = parseGeneratedTime(generatedAt);
     if (Number.isNaN(generatedTime)) {
         return null;
     }
@@ -616,6 +616,7 @@ function writeReviewGateResult(context, payload) {
     else {
         context.logger.info('Review completed and gate passed.');
     }
+    context.logger.info(`Run: ${payload.runId} (generated ${payload.generatedAt})`);
     context.logger.info(`Review artifact: ${payload.artifactPath}`);
     if (payload.normalization) {
         context.logger.info(`Artifact normalized: inserted ${payload.normalization.insertedSeverities.map((severity) => severityDisplayName(severity)).join(', ')} empty Findings section(s).`);
@@ -629,6 +630,7 @@ function writeReviewGateExecutionFailure(context, payload) {
         context.logger.json({
             status: 'review_failed',
             outcome: 'review_did_not_complete',
+            runId: payload.runId,
             target: payload.target,
             project: payload.project,
             exitCode: payload.exitCode,
@@ -643,9 +645,11 @@ function writeReviewGateArtifactValidationFailure(context, payload) {
         context.logger.json({
             status: 'artifact_validation_failed',
             outcome: 'review_completed_artifact_validation_failed',
+            runId: payload.runId,
             target: payload.target,
             project: payload.project,
             artifactPath: payload.artifactPath,
+            generatedAt: payload.generatedAt,
             message: payload.message,
             recovery: payload.recovery,
         });
@@ -755,6 +759,7 @@ async function runCrossProviderExec(prompt, options, context, dependencies) {
     }
 }
 async function runReviewGate(prompt, options, context, dependencies) {
+    const runId = randomUUID();
     try {
         const repoRoot = await dependencies.resolveProjectRoot(context.cwd);
         const userConfigDir = join(context.home, '.oat');
@@ -785,6 +790,7 @@ async function runReviewGate(prompt, options, context, dependencies) {
         const childExitCode = await executeTarget(selected, [reviewPrompt], context, dependencies);
         if (childExitCode !== 0) {
             writeReviewGateExecutionFailure(context, {
+                runId,
                 target: selected.id,
                 project: projectPath,
                 exitCode: childExitCode,
@@ -799,9 +805,11 @@ async function runReviewGate(prompt, options, context, dependencies) {
         const producedArtifact = findProducedReviewArtifact(before, after);
         if (!producedArtifact) {
             writeReviewGateArtifactValidationFailure(context, {
+                runId,
                 target: selected.id,
                 project: projectPath,
                 artifactPath: null,
+                generatedAt: null,
                 message: `No new review artifact was detected for project ${projectPath}.`,
                 recovery: 'Ensure the review provider wrote a project review artifact. If it did, fix or attach that artifact and run oat-project-review-receive before treating the review as consumed.',
             });
@@ -817,9 +825,11 @@ async function runReviewGate(prompt, options, context, dependencies) {
         catch (error) {
             const detail = error instanceof Error ? error.message : String(error);
             writeReviewGateArtifactValidationFailure(context, {
+                runId,
                 target: selected.id,
                 project: projectPath,
                 artifactPath: producedArtifact.path,
+                generatedAt: producedArtifact.generatedAt,
                 message: detail,
                 recovery: `The review artifact was created at ${producedArtifact.path} but could not be consumed. Fix the artifact format, then run oat-project-review-receive for ${producedArtifact.path}; if the only issue is a missing zero-count severity heading, rerun the gate to normalize the same artifact instead of creating a new review version.`,
             });
@@ -835,9 +845,11 @@ async function runReviewGate(prompt, options, context, dependencies) {
         });
         writeReviewGateResult(context, {
             status: blocking ? 'blocked' : 'ok',
+            runId,
             target: selected.id,
             project: projectPath,
             artifactPath: producedArtifact.path,
+            generatedAt: producedArtifact.generatedAt,
             threshold,
             blocking,
             counts: verdict.counts,

package/dist/commands/review/latest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"latest.d.ts","sourceRoot":"","sources":["../../../src/commands/review/latest.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAAC;AAEnD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;CACrB;AAQD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,UAAU,wBAAwB;IAChC,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACnE;AAmID,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAqF9B;AA+CD,wBAAgB,yBAAyB,CACvC,SAAS,GAAE,OAAO,CAAC,wBAAwB,CAAM,GAChD,OAAO,CAkBT"}
+{"version":3,"file":"latest.d.ts","sourceRoot":"","sources":["../../../src/commands/review/latest.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAAC;AAEnD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;CACrB;AAQD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,UAAU,wBAAwB;IAChC,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACnE;AAsID,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAqF9B;AA+CD,wBAAgB,yBAAyB,CACvC,SAAS,GAAE,OAAO,CAAC,wBAAwB,CAAM,GAChD,OAAO,CAkBT"}

package/dist/commands/review/latest.js

@@ -1,7 +1,7 @@
 import { readdir, readFile } from 'node:fs/promises';
 import { isAbsolute, join, relative } from 'node:path';
 import { buildCommandContext, } from '../../app/command-context.js';
-import { getFrontmatterBlock, getFrontmatterField, } from '../shared/frontmatter.js';
+import { getFrontmatterBlock, getFrontmatterField, parseGeneratedTime, } from '../shared/frontmatter.js';
 import { readGlobalOptions } from '../shared/shared.utils.js';
 import { readOatLocalConfig } from '../../config/oat-config.js';
 import { normalizeToPosixPath, resolveProjectRoot } from '../../fs/paths.js';
@@ -72,7 +72,7 @@ async function readReviewCandidate(repoRoot, relativePath, kind, priority, archi
     if (!generatedAt) {
         return null;
     }
-    const generatedTime = Date.parse(generatedAt);
+    const generatedTime = parseGeneratedTime(generatedAt);
     if (Number.isNaN(generatedTime)) {
         return null;
     }
@@ -99,6 +99,9 @@ function sortReviewCandidates(a, b) {
     if (a.lifecycleRank !== b.lifecycleRank) {
         return b.lifecycleRank - a.lifecycleRank;
     }
+    // Same scope, same generated time: fall back to a stable path order. Review
+    // artifacts carry a seconds-precision `oat_generated_at`, so distinct re-gate
+    // rounds differ on generatedTime above and never reach this branch.
     return a.path.localeCompare(b.path);
 }
 export async function findLatestReview(options) {

package/dist/commands/shared/frontmatter.d.ts

@@ -9,6 +9,17 @@ export declare function isProjectStatePhase(value: string): value is ProjectStat
 export declare function isProjectStateFrontmatterField(value: string): value is ProjectStateFrontmatterField;
 export declare function getFrontmatterBlock(content: string): string | null;
 export declare function getFrontmatterField(frontmatter: string, field: string): string | null;
+/**
+ * Parse an `oat_generated_at` value into a comparable epoch millisecond time.
+ *
+ * Review artifacts should carry a UTC, `Z`-suffixed timestamp
+ * (`YYYY-MM-DDTHH:MM:SSZ`). A bare date (`YYYY-MM-DD`) already parses as UTC,
+ * but a datetime with no timezone designator parses as *local* time, which
+ * mis-orders artifacts written by agents in different timezones. Treat such a
+ * value as UTC by appending `Z` so ordering is timezone-independent regardless
+ * of what the writer emitted. Returns `NaN` for unparseable input.
+ */
+export declare function parseGeneratedTime(value: string): number;
 export declare function parseFrontmatterField(filePath: string, field: string): Promise<string>;
 export declare function getSkillVersion(skillDir: string): Promise<string | null>;
 export declare function getAgentVersion(agentPath: string): Promise<string | null>;

package/dist/commands/shared/frontmatter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../../src/commands/shared/frontmatter.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,mBAAmB,6CAA8C,CAAC;AAE/E,eAAO,MAAM,oBAAoB,gFAOvB,CAAC;AAEX,eAAO,MAAM,gCAAgC,sgBA2BnC,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,MAAM,MAAM,4BAA4B,GACtC,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,gBAAgB,CAE3E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,iBAAiB,CAE7E;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,4BAA4B,CAIvC;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlE;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,IAAI,CAKf;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB"}
+{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../../src/commands/shared/frontmatter.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,mBAAmB,6CAA8C,CAAC;AAE/E,eAAO,MAAM,oBAAoB,gFAOvB,CAAC;AAEX,eAAO,MAAM,gCAAgC,sgBA2BnC,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,MAAM,MAAM,4BAA4B,GACtC,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,gBAAgB,CAE3E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,iBAAiB,CAE7E;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,4BAA4B,CAIvC;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlE;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,IAAI,CAKf;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQxB;AAED,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB"}

package/dist/commands/shared/frontmatter.js

@@ -57,6 +57,21 @@ export function getFrontmatterField(frontmatter, field) {
         return null;
     return match[1].replace(/\s*#.*$/, '').trim();
 }
+/**
+ * Parse an `oat_generated_at` value into a comparable epoch millisecond time.
+ *
+ * Review artifacts should carry a UTC, `Z`-suffixed timestamp
+ * (`YYYY-MM-DDTHH:MM:SSZ`). A bare date (`YYYY-MM-DD`) already parses as UTC,
+ * but a datetime with no timezone designator parses as *local* time, which
+ * mis-orders artifacts written by agents in different timezones. Treat such a
+ * value as UTC by appending `Z` so ordering is timezone-independent regardless
+ * of what the writer emitted. Returns `NaN` for unparseable input.
+ */
+export function parseGeneratedTime(value) {
+    const hasTime = value.includes('T');
+    const hasZone = /(?:[zZ]|[+-]\d{2}:?\d{2})$/.test(value);
+    return Date.parse(hasTime && !hasZone ? `${value}Z` : value);
+}
 export async function parseFrontmatterField(filePath, field) {
     try {
         const content = await readFile(filePath, 'utf8');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-agent-toolkit/cli",
-  "version": "0.1.41",
+  "version": "0.1.42",
   "private": false,
   "description": "Open Agent Toolkit CLI",
   "homepage": "https://github.com/voxmedia/open-agent-toolkit/tree/main/packages/cli",
@@ -34,7 +34,7 @@
     "ora": "^9.0.0",
     "yaml": "2.8.2",
     "zod": "^3.25.76",
-    "@open-agent-toolkit/control-plane": "0.1.41"
+    "@open-agent-toolkit/control-plane": "0.1.42"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",