claude-dev-env 1.92.0 → 1.93.0

package/skills/autoconverge/workflow/converge.mjs

@@ -11,12 +11,13 @@
 
 export const meta = {
   name: 'autoconverge',
-  description: 'Drive one draft PR to convergence in a single autonomous run: parallel Bugbot + code-review + bug-audit lenses on the same HEAD each round, dedup findings, fix once, re-verify, then a Copilot wait-gate and a final convergence check that marks the PR ready.',
+  description: 'Drive one draft PR to convergence in a single autonomous run: each round runs a deterministic static sweep first, then code-review, bug-audit, and self-review lenses in parallel on the same HEAD, dedups findings, fixes once, and re-verifies; Bugbot and Copilot then run as terminal confirmation gates before a final convergence check marks the PR ready.',
   whenToUse: 'Launched by the /autoconverge skill after it resolves PR scope, enters a worktree, and grants project .claude permissions.',
   phases: [
     { title: 'Reuse', detail: 'Before convergence, one reuse lens scans the full diff for reuse improvements that are certain, behaviorally identical, and autonomously implementable, and applies the qualifying ones in one commit' },
-    { title: 'Converge', detail: 'Bugbot + code-review + bug-audit in parallel each round; one clean-coder applies all fixes; loop until all three are clean on a stable HEAD' },
-    { title: 'Copilot gate', detail: 'When the quota pre-check reports Copilot out of premium-request quota or unavailable, skip the gate with no agent spawned; otherwise request a Copilot review and poll up to the configured cap, route findings back into Converge, and when Copilot is down or out of quota log a notice and mark the PR ready with the gate bypassed' },
+    { title: 'Converge', detail: 'A deterministic static sweep runs first each round; then code-review, bug-audit, and self-review run in parallel on the same HEAD; one clean-coder applies all fixes; the loop repeats until every lens is clean on a stable HEAD' },
+    { title: 'Bugbot gate', detail: 'A terminal confirmation gate that runs once the internal lenses are clean; when Bugbot is disabled or unavailable it spawns no agent and passes, otherwise it fetches Bugbot\'s verdict and routes any finding back into Converge' },
+    { title: 'Copilot gate', detail: 'When the quota pre-check reports Copilot out of premium-request quota or unavailable, skip the gate with no agent spawned; otherwise request a Copilot review and poll up to the configured cap, then route findings by tier — self-healing findings flow back into Converge, and one or more code-concern findings return blocker user-review with the findings for the orchestrator to gate on rather than auto-fixing or marking the PR ready; when Copilot is down or out of quota log a notice and mark the PR ready with the gate bypassed' },
     { title: 'Finalize', detail: 'Run check_convergence.py; mark draft=false on a full pass' },
   ],
 }
@@ -28,6 +29,7 @@ const CONFIG = {
   sharedScripts: '$HOME/.claude/skills/pr-converge/scripts',
   prLoopScripts: '$HOME/.claude/_shared/pr-loop/scripts',
   bugteamRubric: '$HOME/.claude/_shared/pr-loop/audit-contract.md',
+  precatchRubric: '$HOME/.claude/_shared/pr-loop/precatch-rubric.md',
 }
 
 const REVIEWER_GATE_SENTINEL = 'CLAUDE_REVIEWER_GATE=autoconverge '
@@ -38,7 +40,7 @@ const TIERS = {
   haikuLow: { model: 'haiku', effort: 'low' },
 }
 
-const HEADLESS_SAFETY_PREAMBLE =
+const HEADLESS_EDIT_PREAMBLE =
   'HEADLESS RUN — you run unattended: no human can answer a permission or confirmation prompt, and any such prompt stalls the entire convergence run. The destructive_command_blocker hook matches dangerous patterns (rm -rf, git reset --hard, dd, mkfs, chmod -R, fork bombs) as raw text anywhere in a Bash command, with no quote-awareness — so a destructive string stalls you even when it is only data you never execute. Therefore:\n' +
   '- Never place a destructive-command literal inside a Bash command — not in echo, not in a heredoc, and not as an argument to python -c, node -e, or awk. To exercise or verify destructive_command_blocker (or any hook) behavior, run the committed test suite, e.g. python -m pytest <test_file>, which passes the command strings as in-language data rather than as a shell command.\n' +
   '- When a commit message, or a PR / issue / review-comment body, must describe destructive-command behavior, write that text to a file and pass it by path (git commit -F <file>, gh ... --body-file <file>); never inline it with git commit -m or gh ... -b, where the literal lands in the Bash command and stalls you.\n' +
@@ -50,6 +52,22 @@ const HEADLESS_SAFETY_PREAMBLE =
   '- Size the Monitor to the whole wait: its timeout_ms defaults to 300000 (300 seconds) and the Monitor is killed the moment that elapses, so a poll whose interval or whose interval-times-attempts span runs longer registers a false time-out. Before you arm a Monitor, set timeout_ms to at least the poll interval times the attempt count the step names — up to the 3600000ms ceiling — or pass persistent: true so the Monitor is never timed out. A 360-second interval, or a many-minute total, exceeds the 300000 default, so arming the Monitor with the default truncates the wait; set timeout_ms to the step span instead.\n' +
   '- When your run was given a result schema, your final action is always the StructuredOutput call. If the poll budget is spent before the awaited signal arrives, call StructuredOutput with the whole time-out result the step documents — for the Copilot gate, the full down result {sha, clean:false, down:true, findings:[]}, never a bare down flag — rather than ending the turn without a result.\n\n'
 
+const HEADLESS_READONLY_DESTRUCTIVE_POINTER =
+  '- Never run a destructive command (rm -rf, git reset --hard, dd, mkfs, chmod -R, a fork bomb) and never place its literal text in a Bash command: this step reads only and edits nothing, so it needs no destructive command. If a step seems to require one, report it as a blocker rather than running it.\n'
+
+/**
+ * The read-only preamble a review, verify, or utility agent receives: the full
+ * edit preamble with the rm-shape-rules bullet dropped, since an agent that edits
+ * nothing never runs rm and the shape rules add no value to its prompt. The
+ * one-line destructive pointer keeps the escape-hatch guidance in view. The
+ * derivation reads the single rm-shape bullet out of the edit preamble and swaps
+ * the pointer in, so the two preambles share every other clause from one source.
+ */
+const HEADLESS_READONLY_PREAMBLE = HEADLESS_EDIT_PREAMBLE.replace(
+  /- rm shape rules — [\s\S]*?\n(?=- If a step appears to require)/,
+  HEADLESS_READONLY_DESTRUCTIVE_POINTER,
+)
+
 let activeRepoPath = null
 
 /**
@@ -72,18 +90,32 @@ const worktreeDirective = (repoPath) =>
     : ''
 
 /**
- * Spawn a workflow agent with the headless-safety preamble prepended to its
- * prompt. Every agent in this convergence loop runs unattended, so each one is
- * routed through here to inherit the same no-confirmation-prompt guidance. On a
- * path-scoped run the worktree directive is prepended too, so every agent runs
- * in the PR's own worktree (activeRepoPath); on a single-PR run that directive
- * is empty and the agent keeps its own working directory.
+ * Spawn a workflow agent that edits code, with the full edit preamble prepended
+ * to its prompt. An edit agent may run rm during cleanup, so it inherits the
+ * rm-shape rules alongside the no-confirmation-prompt guidance. On a path-scoped
+ * run the worktree directive is prepended too, so the agent runs in the PR's own
+ * worktree (activeRepoPath); on a single-PR run that directive is empty and the
+ * agent keeps its own working directory. A read-only agent (a review, verify, or
+ * utility spawn) routes through convergeReadOnlyAgent for the trimmed preamble.
  * @param {string} prompt the agent's role-specific instruction body
  * @param {object} options the agent() options (label, phase, schema, agentType, model)
  * @returns {Promise<*>} the agent() result
  */
 const convergeAgent = (prompt, options) =>
-  agent(`${HEADLESS_SAFETY_PREAMBLE}${worktreeDirective(activeRepoPath)}${prompt}`, options)
+  agent(`${HEADLESS_EDIT_PREAMBLE}${worktreeDirective(activeRepoPath)}${prompt}`, options)
+
+/**
+ * Spawn a read-only workflow agent with the trimmed read-only preamble prepended
+ * to its prompt. A review, verify, or utility agent edits nothing and never runs
+ * rm, so it receives the read-only preamble that drops the rm-shape-rules bullet.
+ * The worktree directive is prepended on a path-scoped run exactly as for
+ * convergeAgent, so a read-only agent still runs in the PR's own worktree.
+ * @param {string} prompt the agent's role-specific instruction body
+ * @param {object} options the agent() options (label, phase, schema, agentType, model)
+ * @returns {Promise<*>} the agent() result
+ */
+const convergeReadOnlyAgent = (prompt, options) =>
+  agent(`${HEADLESS_READONLY_PREAMBLE}${worktreeDirective(activeRepoPath)}${prompt}`, options)
 
 /**
  * Spawn a fresh git-utility Explore agent for a specific task. The one task,
@@ -105,7 +137,7 @@ function runGitTask(task) {
   if (task !== 'preflight-git') {
     throw new Error(`runGitTask has no handler for task ${task}`)
   }
-  return convergeAgent(
+  return convergeReadOnlyAgent(
     `Run five read-only preflight steps for ${prCoordinates}. Do not edit, commit, push, rebase, or modify any files — read only.\n\n` +
       `STEP 1 — resolve HEAD. Print the current PR HEAD SHA. Run exactly:\n` +
       `   gh api repos/${input.owner}/${input.repo}/pulls/${input.prNumber} --jq .head.sha\n` +
@@ -308,7 +340,7 @@ function runCodeEditorTask(task, context) {
       `You are the EDIT step deferring a code-standard-only round on ${prCoordinates}, HEAD ${context.head} (${context.sourceLabel}). The round surfaced ONLY code-standard violations (CODE_RULES/style, no behavioral impact); the run treats it as passed and defers the fixes to follow-up work, which you now stage. A separate verify step then a separate commit step open the hardening PR after you. Do NOT commit or push to the PR's own branch.\n\n` +
         `Findings:\n${findingsBlock}\n\n` +
         `1. Follow-up fix issue: file a GitHub issue on ${input.owner}/${input.repo} (gh issue create --body-file with a temp file) titled "Deferred code-standard fixes from PR #${input.prNumber}". The body references the PR and lists each finding with its file:line, severity, and detail. The issue carries the fix work; do not open a fix PR. Capture the issue URL.\n` +
-        `2. Stage the environment-hardening change: in the Claude environment config repo (the repo owning ~/.claude hooks and rules — JonEcho/llm-settings for hooks, jl-cmd/claude-code-config for rules/skills; pick whichever owns the surface that would block these violation classes), find or clone a local checkout, fetch origin, and create a branch off origin/main. Edit the hooks/rules in that checkout's WORKING TREE so each violation class found here is blocked at Write/Edit time, before code is written. Do NOT commit and do NOT push — the commit step does that after the verify step binds a verdict to the working tree. Return the checkout's absolute path in hardeningRepoPath, the branch name in hardeningBranch, and set hardeningEdited=true. When no hardening is feasible for these classes, leave hardeningRepoPath and hardeningBranch empty and hardeningEdited=false; the follow-up issue still stands.\n` +
+        `2. Stage the environment-hardening change: in the Claude environment config repo (the repo owning ~/.claude hooks and rules — JonEcho/llm-settings for hooks, jl-cmd/claude-dev-env for rules/skills; pick whichever owns the surface that would block these violation classes), find or clone a local checkout, fetch origin, and create a branch off origin/main. Edit the hooks/rules in that checkout's WORKING TREE so each violation class found here is blocked at Write/Edit time, before code is written. Do NOT commit and do NOT push — the commit step does that after the verify step binds a verdict to the working tree. Return the checkout's absolute path in hardeningRepoPath, the branch name in hardeningBranch, and set hardeningEdited=true. When no hardening is feasible for these classes, leave hardeningRepoPath and hardeningBranch empty and hardeningEdited=false; the follow-up issue still stands.\n` +
         `3. For each finding that carries a GitHub review comment id (${threadIds.length ? threadIds.join(', ') : 'none this batch'}): post an inline reply via python "${CONFIG.sharedScripts}/post_fix_reply.py" --owner ${input.owner} --repo ${input.repo} --pr-number ${input.prNumber} --in-reply-to <id> --body "Code-standard-only finding — deferred to follow-up issue <url>." Then resolve the thread by its PRRT_ node id (GraphQL lookup on comment databaseId, then resolveReviewThread or the github MCP pull_request_review_write method=resolve_thread — not the numeric comment id).\n\n` +
         `Return the issue URL in issueUrl (empty string when it could not be filed), the hardening checkout path and branch, hardeningEdited, and a one-line summary.` +
         PRE_COMMIT_GATE_STEP,
@@ -382,7 +414,7 @@ function runVerifierTask(task, context) {
   const label = `verifier:${task}`
   if (task === 'fix-verify') {
     const findingsBlock = renderFindingsBlock(context.findings)
-    return convergeAgent(
+    return convergeReadOnlyAgent(
       `You are the VERIFY step for ${context.findings.length} finding(s) (${context.sourceLabel}) on ${prCoordinates}, HEAD ${context.head}. The edit step left fixes in the working tree, uncommitted. Do NO edits of any kind — verification only; any edit invalidates the verdict you are about to emit.\n\n` +
         `Findings the working-tree fixes must address:\n${findingsBlock}\n\n` +
         `Steps:\n` +
@@ -396,7 +428,7 @@ function runVerifierTask(task, context) {
     const failureBlock = context.failures.length
       ? context.failures.map((each, position) => `${position + 1}. ${each}`).join('\n')
       : 'none reported'
-    return convergeAgent(
+    return convergeReadOnlyAgent(
       `You are the VERIFY step for the convergence repair on ${prCoordinates}, HEAD ${context.head}. The edit step left its repair in the working tree (a bot-thread fix uncommitted, and/or a rebase onto origin/main), unpushed. Do NO edits of any kind — verification only; any edit invalidates the verdict you are about to emit.\n\n` +
         `Concerns the working-tree repair must resolve (the gates the convergence check flagged):\n${failureBlock}\n\n` +
         `Steps:\n` +
@@ -406,7 +438,7 @@ function runVerifierTask(task, context) {
       { label, phase: 'Finalize', agentType: 'code-verifier', ...TIERS.sonnetMedium },
     )
   }
-  return convergeAgent(
+  return convergeReadOnlyAgent(
     `You are the VERIFY step for an environment-hardening change (${context.sourceLabel}) staged in the working tree of ${context.hardeningRepoPath}. The edit step left the hooks/rules edits uncommitted there. Do NO edits of any kind — verification only; any edit invalidates the verdict you are about to emit.\n\n` +
       `Concern the working-tree change must resolve: the edited hooks/rules block the code-standard violation classes from the deferred round at Write/Edit time, and a hook change carries a passing test per CODE_RULES.\n\n` +
       `Steps:\n` +
@@ -480,7 +512,7 @@ function runGeneralUtilityTask(task, context) {
       context.deferredStandardsFindings.length > 0
         ? `The ${context.deferredStandardsFindings.length} unique code-standard finding(s) after de-duplication across the lens reports above were excluded from this CLEAN post and ${describeStandardsDeferral(context.standardsDeferral)}.\n\n`
         : ''
-    return convergeAgent(
+    return convergeReadOnlyAgent(
       `Transcribe a completed audit result to the PR thread for ${prCoordinates} at commit ${context.head}. You are relaying results that ${ranCount} audit lens(es) already produced on this HEAD earlier in this run — you are not judging the code yourself or clearing a merge gate.\n\n` +
         `${ranCount} audit lens(es) ran on HEAD ${context.head} this round: ${ranRoster}.\n\n` +
         notRunNote +
@@ -515,7 +547,7 @@ function runConvergenceCheck(context) {
   const copilotOptOut = context.copilotDown
     ? `   Copilot is down this run, so before gh pr ready export the token in this same shell session so the independent mark-ready blocker hook's convergence re-check inherits it:\n      bash: export CLAUDE_REVIEWS_DISABLED="copilot"   (PowerShell: $env:CLAUDE_REVIEWS_DISABLED = "copilot")\n`
     : ''
-  return convergeAgent(
+  return convergeReadOnlyAgent(
     `Run the convergence gate for ${prCoordinates} on HEAD ${context.head} and, only when every gate passes, mark the PR ready. Do not edit code.\n\n` +
       `1. Run: python "${CONFIG.sharedScripts}/check_convergence.py" --owner ${input.owner} --repo ${input.repo} --pr-number ${input.prNumber}${bugbotDownFlag}${copilotDownFlag}\n` +
       `   Exit 0 -> every gate passed: set pass:true, failures:[].\n` +
@@ -565,6 +597,31 @@ const LENS_SCHEMA = {
   required: ['sha', 'clean', 'down', 'findings'],
 }
 
+const COPILOT_FINDING_TIERS = ['self-healing', 'code-concern']
+
+const COPILOT_FINDINGS_SCHEMA = {
+  type: 'array',
+  items: {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+      file: { type: 'string' },
+      line: { type: 'integer' },
+      severity: { type: 'string', enum: ['P0', 'P1', 'P2'] },
+      category: { type: 'string', enum: ['bug', 'code-standard'], description: 'code-standard for pure CODE_RULES/style violations with no behavioral impact; bug otherwise' },
+      tier: {
+        type: 'string',
+        enum: COPILOT_FINDING_TIERS,
+        description: 'routing signal separate from category: self-healing when the fix cannot change observable runtime behavior for production callers (style, type hints, misplaced or unused imports, formatting, magic-value extraction, test-only changes, doc-or-description vs code mismatches, code de-duplication); code-concern when the finding is behavior-changing or needs a product decision (logic or correctness, security, data handling, error-handling semantics, concurrency). Classify as code-concern whenever the tier is in doubt.',
+      },
+      title: { type: 'string' },
+      detail: { type: 'string' },
+      replyToCommentId: { type: ['integer', 'null'], description: 'GitHub review comment id to reply to and resolve, or null when the finding has no thread' },
+    },
+    required: ['file', 'line', 'severity', 'category', 'tier', 'title', 'detail', 'replyToCommentId'],
+  },
+}
+
 const COPILOT_SCHEMA = {
   type: 'object',
   additionalProperties: false,
@@ -572,7 +629,8 @@ const COPILOT_SCHEMA = {
     sha: { type: 'string' },
     clean: { type: 'boolean' },
     down: { type: 'boolean', description: 'true when Copilot is down or out of quota — it posts an out-of-usage notice or never surfaces a review on HEAD after the poll cap; the gate is bypassed and the run proceeds to mark-ready' },
-    findings: LENS_SCHEMA.properties.findings,
+    reviewUrl: { type: 'string', description: 'the Copilot review html_url when the gate carries findings, otherwise an empty string — the user-review payload links the orchestrator and the user to the review' },
+    findings: COPILOT_FINDINGS_SCHEMA,
   },
   required: ['sha', 'clean', 'down', 'findings'],
 }
@@ -594,7 +652,7 @@ const REVIEWER_AVAILABILITY_SCHEMA = {
       type: 'object',
       additionalProperties: false,
       properties: {
-        down: { type: 'boolean', description: 'true when reviewer_availability.py --reviewer bugbot exited non-zero (opted out via CLAUDE_REVIEWS_DISABLED)' },
+        down: { type: 'boolean', description: 'true when reviewer_availability.py --reviewer bugbot exited non-zero (off by default unless CLAUDE_REVIEWS_ENABLED lists bugbot, or opted out via CLAUDE_REVIEWS_DISABLED)' },
         reason: { type: 'string', description: 'the one-line reason reviewer_availability.py printed for Bugbot' },
       },
       required: ['down', 'reason'],
@@ -743,7 +801,7 @@ const CLEAN_AUDIT_SCHEMA = {
 
 const SEVERITY_RANK = { P0: 0, P1: 1, P2: 2 }
 const SHA_COMPARISON_PREFIX_LENGTH = 7
-const LENS_NAMES = ['Cursor Bugbot', 'code-review', 'bug-audit']
+const LENS_NAMES = ['code-review', 'bug-audit', 'self-review']
 const GITHUB_ISSUE_URL_PATTERN = /^(https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/issues\/\d+)\/?(?:[?#].*)?$/
 
 /**
@@ -902,20 +960,20 @@ function resolveRoundOutcome(lensResults) {
  * A lens is 'ran' when it returned a live result carrying a real review — either
  * not down, or down but still producing findings (which resolveRoundOutcome folds
  * into the round, so the same result is quoted here as ran). It is 'down' when the
- * workflow never spawned it (the synthesized Bugbot down-stub carries notSpawned,
- * so its stub is never presented as a returned result), 'reported-down' when its
- * agent ran but reported itself down with no findings (an opt-out or a poll-budget
- * timeout that surfaced no review), and 'dead' when its agent died and returned no
- * result. Only 'ran' carries a quoted report.
+ * workflow never spawned it (a down-stub carrying notSpawned is never presented as
+ * a returned result), 'reported-down' when its agent ran but reported itself down
+ * with no findings (an opt-out or a poll-budget timeout that surfaced no review),
+ * and 'dead' when its agent died and returned no result. Only 'ran' carries a
+ * quoted report.
  *
  * ::
  *
- *   nameLensResults([{down: true, notSpawned: true, ...}, null, auditReport])
- *   -> [{lens: 'Cursor Bugbot', status: 'down', report: null},
- *       {lens: 'code-review', status: 'dead', report: null},
- *       {lens: 'bug-audit', status: 'ran', report: auditReport}]
+ *   nameLensResults([codeReviewReport, null, selfReviewReport])
+ *   -> [{lens: 'code-review', status: 'ran', report: codeReviewReport},
+ *       {lens: 'bug-audit', status: 'dead', report: null},
+ *       {lens: 'self-review', status: 'ran', report: selfReviewReport}]
  *
- * The order matches the parallel([bugbot, code-review, bug-audit]) spawn order.
+ * The order matches the parallel([code-review, bug-audit, self-review]) spawn order.
  * @param {Array<object|null>} lensResults the positional lens results for the round
  * @returns {Array<object>} one {lens, status, report} entry per lens position
  */
@@ -944,13 +1002,13 @@ function nameLensResults(lensResults) {
  *
  * ::
  *
- *   describeNotRunLens({lens: 'Cursor Bugbot', status: 'down'})
- *   -> 'Cursor Bugbot (down/disabled — did not run)'
- *   describeNotRunLens({lens: 'Cursor Bugbot', status: 'reported-down'})
- *   -> 'Cursor Bugbot (ran, but reported itself down — it produced no review for this HEAD)'
+ *   describeNotRunLens({lens: 'self-review', status: 'down'})
+ *   -> 'self-review (down/disabled — did not run)'
+ *   describeNotRunLens({lens: 'self-review', status: 'reported-down'})
+ *   -> 'self-review (ran, but reported itself down — it produced no review for this HEAD)'
  *
- * The reported-down wording stays mechanism-neutral because the reviewer returns
- * the same down shape for an opt-out (no poll ever ran) and a poll-budget timeout.
+ * The reported-down wording stays mechanism-neutral because a lens returns the
+ * same down shape for an opt-out (no poll ever ran) and a poll-budget timeout.
  * @param {{lens: string, status: string}} lensEntry a non-ran lens provenance entry
  * @returns {string} the disclosure clause for that lens
  */
@@ -1303,28 +1361,86 @@ function classifyReadyOutcome(readyResult) {
 }
 
 /**
- * Classify a Copilot gate result into the loop's next action. A dead gate agent
- * (null result) is a retry rather than an approval, mirroring the converge
- * lenses' dead-agent convention so a failed gate is never mistaken for a clean
- * Copilot review. A down result — Copilot out of quota or unreachable, so it
+ * Classify a terminal reviewer-gate result into the loop's next action, shared by
+ * both external confirmation gates — Cursor Bugbot and GitHub Copilot. The logic
+ * is reviewer-neutral over the {clean, down, findings} shape both gates return. A
+ * dead gate agent (null result) is a retry rather than an approval, mirroring the
+ * converge lenses' dead-agent convention so a failed gate is never mistaken for a
+ * clean review. A down result — the reviewer out of quota or unreachable, so it
  * posts an out-of-usage notice or never surfaces a review after the poll cap —
- * routes to the 'down' kind, which logs a notice and proceeds to mark-ready with
- * the Copilot gate bypassed, the same way a down Bugbot lens is bypassed; this is
- * checked first so an outage proceeds rather than waiting on a review that will
- * not arrive. Findings route to a fix step. The gate otherwise approves only when
- * it explicitly reports clean:true with no findings — a clean:false result with
- * zero findings is an unreliable or malformed gate response and retries rather
- * than advancing to Finalize, so a PR never goes ready on a HEAD Copilot did not
- * call clean.
+ * routes to the 'down' kind, which logs a notice and proceeds with the gate
+ * bypassed; this is checked first so an outage proceeds rather than waiting on a
+ * review that will not arrive. Findings route to a fix step. The gate otherwise
+ * approves only when it explicitly reports clean:true with no findings — a
+ * clean:false result with zero findings is an unreliable or malformed gate
+ * response and retries rather than advancing, so a PR never advances on a HEAD the
+ * reviewer did not call clean.
+ * @param {object|null|undefined} reviewerGate the terminal gate result, or null on agent failure
+ * @returns {{kind: string, findings?: Array<object>}} the next action
+ */
+function classifyReviewerGateOutcome(reviewerGate) {
+  if (reviewerGate == null) return { kind: 'retry' }
+  if (reviewerGate.down === true) return { kind: 'down' }
+  if (reviewerGate.findings.length > 0) return { kind: 'fix', findings: reviewerGate.findings }
+  if (reviewerGate.clean === true) return { kind: 'approved' }
+  return { kind: 'retry' }
+}
+
+/**
+ * Layer the Copilot-specific two-tier triage over the shared reviewer-gate
+ * classifier. The base classifier decides retry / down / approved and routes any
+ * findings to a fix; this wrapper then upgrades a fix round carrying a
+ * code-concern finding to a 'user-review' outcome, so the workflow neither
+ * auto-fixes it nor marks the PR ready. A self-healing-only fix round passes
+ * through unchanged and flows into the fix flow. Only the Copilot gate uses this
+ * wrapper; the terminal Bugbot gate keeps the base classifier, whose findings
+ * carry no tier and always route to a fix.
  * @param {object|null|undefined} copilot the Copilot gate result, or null on agent failure
  * @returns {{kind: string, findings?: Array<object>}} the next action
  */
 function classifyCopilotOutcome(copilot) {
-  if (copilot == null) return { kind: 'retry' }
-  if (copilot.down === true) return { kind: 'down' }
-  if (copilot.findings.length > 0) return { kind: 'fix', findings: copilot.findings }
-  if (copilot.clean === true) return { kind: 'approved' }
-  return { kind: 'retry' }
+  const outcome = classifyReviewerGateOutcome(copilot)
+  if (outcome.kind === 'fix' && hasCodeConcernFinding(outcome.findings)) {
+    return { kind: 'user-review', findings: outcome.findings }
+  }
+  return outcome
+}
+
+/**
+ * Decide whether a Copilot round carries a code-concern finding — one that is
+ * behavior-changing or needs a product decision, so the workflow may neither
+ * auto-fix it nor mark the PR ready. Any tier other than the explicit
+ * 'self-healing' counts as a code concern, so a missing or unexpected tier
+ * defaults to code-concern rather than silently routing into the auto-fix flow.
+ * @param {Array<object>} findings the Copilot findings for the round
+ * @returns {boolean} true when at least one finding is not tier self-healing
+ */
+function hasCodeConcernFinding(findings) {
+  return findings.some((each) => each.tier !== 'self-healing')
+}
+
+/**
+ * Build the user-review payload the orchestrator hands to the
+ * copilot-finding-triage skill: the Copilot review link plus the code-concern
+ * findings pared to the fields the ntfy summary and the review gate read. The
+ * workflow returns this alongside blocker 'user-review' so the orchestrating
+ * session runs the notify-and-wait gate; a background workflow cannot hold for a
+ * human, so it carries the findings out rather than deciding them.
+ * @param {object} copilot the COPILOT_SCHEMA gate result carrying the review URL
+ * @param {Array<object>} findings the Copilot findings for this HEAD
+ * @returns {{reviewUrl: string, findings: Array<object>}} the triage payload
+ */
+function buildUserReview(copilot, findings) {
+  return {
+    reviewUrl: copilot.reviewUrl || '',
+    findings: findings.map((each) => ({
+      file: each.file,
+      line: each.line,
+      severity: each.severity,
+      tier: each.tier,
+      title: each.title,
+    })),
+  }
 }
 
 /**
@@ -1338,7 +1454,7 @@ function classifyCopilotOutcome(copilot) {
  * from the current outcome is what lets a recovered Copilot — one that returns
  * standards-only findings after an earlier down pass — reach FINALIZE without
  * the stale bypass that would skip its non-clean review.
- * @param {{kind: string}} copilotOutcome a classifyCopilotOutcome result
+ * @param {{kind: string}} copilotOutcome a classifyReviewerGateOutcome result
  * @returns {boolean} true only when this pass's Copilot gate is bypassed
  */
 function resolveCopilotDown(copilotOutcome) {
@@ -1445,6 +1561,35 @@ function renderLensDiffContext(preflightResult) {
   )
 }
 
+/**
+ * Static-sweep lens: the deterministic pre-catch pass that runs the CODE_RULES
+ * gate, ruff, mypy, and stem-matched pytest over the PR's changed files, so the
+ * opus reading lenses only ever review sweep-clean code. It runs on the cheaper
+ * sonnet tier because the mechanical, static, and test classes are the right job
+ * for a deterministic run rather than a reading judgment. It uses only local
+ * git, python, and node commands — never the GitHub CLI — so it runs in any
+ * session, and a gate it could not run is disclosed in a finding detail rather
+ * than silently treated as clean.
+ * @param {string} head PR HEAD SHA to evaluate
+ * @param {object|null|undefined} preflightResult the preflight-git result carrying the changed-file list and diffstat for this round
+ * @returns {Promise<object>} LENS_SCHEMA result carrying each gate or test failure as a finding
+ */
+function runStaticSweep(head, preflightResult) {
+  return convergeReadOnlyAgent(
+    `You are the deterministic static-sweep lens for ${prCoordinates}, HEAD ${head}. Run the mechanical gates over the PR's changed files and report each failure as a finding; do not edit, commit, or push.\n\n` +
+      renderLensDiffContext(preflightResult) +
+      `Use only local git, python, and node commands — never the GitHub CLI — so this runs in any session.\n\n` +
+      `1. Detect the repository's lint, type-check, and test entrypoints from pyproject.toml, package.json, and the repo layout.\n` +
+      `2. Resolve the repo root with git rev-parse --show-toplevel, then run:\n` +
+      `   - python "${CONFIG.prLoopScripts}/code_rules_gate.py" --repo-root <that root> --base origin/main (exit 1 means blocking CODE_RULES violations on the diff).\n` +
+      `   - ruff check on the changed files, and mypy on the changed files.\n` +
+      `   - stem-matched pytest for the changed production modules — run each changed module's paired test file.\n` +
+      `3. Map each failure to one LENS_SCHEMA finding at its file:line: category 'code-standard' for a lint, CODE_RULES, or type violation; category 'bug' for a failing test. Set severity per impact and replyToCommentId=null.\n\n` +
+      `When a gate cannot run in this session because a tool is absent, report that as a finding detail rather than treating the gate as clean. Return strictly the schema: clean=true with empty findings when every gate and test passes on the diff, otherwise one entry per failure. Set sha=${'`'}${head}${'`'}, down=false.`,
+    { label: 'lens:static-sweep', phase: 'Converge', schema: LENS_SCHEMA, agentType: 'Explore', ...TIERS.sonnetMedium },
+  )
+}
+
 /**
  * Bugbot lens: ensure Cursor Bugbot has rendered a verdict on the given HEAD,
  * triggering and polling its CI check run when needed, and return its findings.
@@ -1453,7 +1598,7 @@ function renderLensDiffContext(preflightResult) {
  * @returns {Promise<object>} LENS_SCHEMA result
  */
 function runBugbotLens(head, preflightResult) {
-  return convergeAgent(
+  return convergeReadOnlyAgent(
     `You are the Cursor Bugbot lens for ${prCoordinates}, HEAD ${head}. Cursor Bugbot participates this run.\n\n` +
       `Goal: return Bugbot's verdict on HEAD ${head}. Do not edit code, commit, or push. You may post the literal trigger comment described below.\n\n` +
       renderLensDiffContext(preflightResult) +
@@ -1481,7 +1626,7 @@ function runBugbotLens(head, preflightResult) {
  * @returns {Promise<object>} LENS_SCHEMA result
  */
 function runCodeReviewLens(head, preflightResult) {
-  return convergeAgent(
+  return convergeReadOnlyAgent(
     `You are the code-review lens for ${prCoordinates}, HEAD ${head}.\n\n` +
       `Review the FULL origin/main...HEAD diff — every file the PR touches. Do NOT delta-scope to recent commits or to a single file.\n\n` +
       renderLensDiffContext(preflightResult) +
@@ -1499,16 +1644,43 @@ function runCodeReviewLens(head, preflightResult) {
  * @returns {Promise<object>} LENS_SCHEMA result
  */
 function runAuditLens(head, preflightResult) {
-  return convergeAgent(
+  return convergeReadOnlyAgent(
     `You are the second-opinion bug-audit lens for ${prCoordinates}, HEAD ${head}.\n\n` +
       `Read the audit rubric at ${CONFIG.bugteamRubric} and apply its categories (A through P) against the FULL origin/main...HEAD diff — every file the PR touches, never a delta cut.\n\n` +
       renderLensDiffContext(preflightResult) +
       `This is a clean-room audit: assume nothing from other lenses. Report only findings backed by concrete file:line evidence. Do NOT edit, commit, or push.\n\n` +
+      `Adversarial second pass — mandatory after the primary A-P pass: assume your first pass missed at least 3 P1 bugs. Where are they? Re-examine the diff category by category and return either new Shape-A findings at new file:line references, or an explicit Shape-B adversarial-probe entry naming each category you re-examined and why it holds. A bare "nothing new" is not an acceptable result for this pass.\n\n` +
+      `The doc-vs-code parity, test-assertion completeness, and PR-description-vs-diff lanes sit outside the A-P categories; read the pre-catch rubric at ${CONFIG.precatchRubric} for their checklists and fold any finding those lanes surface into your returned findings.\n\n` +
       `Return strictly the schema: clean=true with empty findings when the diff passes every category, otherwise one entry per finding (severity P0/P1/P2; category 'code-standard' for pure CODE_RULES/style violations with no behavioral impact, 'bug' otherwise; replyToCommentId=null). Set sha=${'`'}${head}${'`'}, down=false.`,
     { label: 'lens:bug-audit', phase: 'Converge', schema: LENS_SCHEMA, agentType: 'code-quality-agent', ...TIERS.opusMedium },
   )
 }
 
+/**
+ * Self-review lens: the semantic pre-catch parity pass over the full diff. It
+ * covers the doc-vs-code parity, test-assertion completeness, and
+ * PR-description-vs-diff lanes that sit outside the A-P bug categories, reusing
+ * the pr-consistency-audit skill's canonical-source cross-reference method. It
+ * stays on opus because line-citation accuracy, symbol attribution, and
+ * inventory or count claims are semantic judgments a cheaper tier misreads. It
+ * reports findings without editing.
+ * @param {string} head PR HEAD SHA to evaluate
+ * @param {object|null|undefined} preflightResult the preflight-git result carrying the changed-file list and diffstat for this round
+ * @returns {Promise<object>} LENS_SCHEMA result carrying the parity findings
+ */
+function runSelfReviewLens(head, preflightResult) {
+  return convergeReadOnlyAgent(
+    `You are the self-review parity lens for ${prCoordinates}, HEAD ${head}. Review the FULL origin/main...HEAD diff — every file the PR touches. Do NOT edit, commit, or push.\n\n` +
+      renderLensDiffContext(preflightResult) +
+      `Read the pre-catch rubric at ${CONFIG.precatchRubric} for the three lane checklists, and cover each lane:\n` +
+      `1. Doc-vs-code parity: reuse the pr-consistency-audit skill's canonical-source cross-reference method ($HOME/.claude/skills/pr-consistency-audit/SKILL.md) and the drift rubric at $HOME/.claude/audit-rubrics/category_rubrics/category-o-docstring-vs-impl-drift.md. Verify every line citation resolves, every referenced file or script path exists, every symbol is attributed to the file that defines it, and every inventory, count, and ordering claim matches the code.\n` +
+      `2. Test-assertion completeness: every changed or new production path has a paired test that calls it and asserts on its behavior, and a changed test pins behavior rather than hiding it behind a mock.\n` +
+      `3. PR-description-vs-diff two-way parity: fetch the PR body read-only, then confirm every PR-body claim maps to a hunk in the diff and every hunk maps to a claim; flag invented paths, invented counts, and out-of-scope changes.\n\n` +
+      `Before returning clean, state one proof-of-absence line per lane naming what you checked. Return strictly the schema: clean=true with empty findings when all three lanes pass, otherwise one entry per finding (severity P0/P1/P2; category 'code-standard' for a pure doc or style parity gap with no behavioral impact, 'bug' otherwise; replyToCommentId=null). Set sha=${'`'}${head}${'`'}, down=false.`,
+    { label: 'lens:self-review', phase: 'Converge', schema: LENS_SCHEMA, agentType: 'code-quality-agent', ...TIERS.opusMedium },
+  )
+}
+
 /**
  * Reuse lens: a one-time pre-convergence pass that scans the full diff for
  * places the PR re-implements behavior the codebase already provides, and
@@ -1521,7 +1693,7 @@ function runAuditLens(head, preflightResult) {
  * @returns {Promise<object>} LENS_SCHEMA result carrying the qualifying reuse findings
  */
 function runReuseAuditPass(head, preflightResult) {
-  return convergeAgent(
+  return convergeReadOnlyAgent(
     `You are the REUSE lens for ${prCoordinates}, HEAD ${head}. This pass runs once before convergence to find where the PR re-implements behavior the codebase already provides.\n\n` +
       `Review the FULL origin/main...HEAD diff — every file the PR touches. Do NOT delta-scope to recent commits or a single file.\n\n` +
       renderLensDiffContext(preflightResult) +
@@ -1554,11 +1726,22 @@ function renderFindingsBlock(findings) {
 
 const FIX_RECOVERY_MAX_ATTEMPTS = 2
 
+/**
+ * Commit-recovery attempt cap, held to one. The edit agent already pre-clears the
+ * commit gate via PRE_COMMIT_GATE_STEP before the working tree reaches the commit
+ * step, so a second commit-recover edit is wasted effort: a rejection that
+ * survives one recovery pass is a genuine post-clear block that fails fast to a
+ * blocker rather than looping. The verify-recovery loop keeps the wider
+ * FIX_RECOVERY_MAX_ATTEMPTS budget, since a verify objection can take more than
+ * one pass to resolve.
+ */
+const COMMIT_RECOVERY_MAX_ATTEMPTS = 1
+
 /**
  * Run a commit step and, when it is blocked by a commit-time hook or gate that
  * requires a code change, route back to a fixer: fix the blocking violation,
  * re-verify so a fresh verdict binds the corrected surface, then retry the
- * commit — bounded by FIX_RECOVERY_MAX_ATTEMPTS. The loop breaks early when the
+ * commit — bounded by COMMIT_RECOVERY_MAX_ATTEMPTS. The loop breaks early when the
  * fixer makes no edit or the re-verify does not pass, returning the last commit
  * result so the caller's existing no-push handling still applies. A transient
  * failure never enters the loop (commitNeedsCodeRecovery is false), so an auth or
@@ -1569,7 +1752,7 @@ const FIX_RECOVERY_MAX_ATTEMPTS = 2
 async function commitWithRecovery({ runCommit, runVerify, runRecoverEdit }) {
   let commitResult = await runCommit()
   let attempt = 0
-  while (commitNeedsCodeRecovery(commitResult) && attempt < FIX_RECOVERY_MAX_ATTEMPTS) {
+  while (commitNeedsCodeRecovery(commitResult) && attempt < COMMIT_RECOVERY_MAX_ATTEMPTS) {
     attempt += 1
     const recoverEdit = await runRecoverEdit(commitResult.blockerDetail, attempt)
     if (recoverEdit?.edited !== true) break
@@ -1667,7 +1850,7 @@ function cleanAuditBlocker(head, auditResult) {
  * @returns {Promise<object>} COPILOT_SCHEMA result
  */
 function runCopilotGate(head) {
-  return convergeAgent(
+  return convergeReadOnlyAgent(
     `You are the Copilot gate for ${prCoordinates}, HEAD ${head}. Do not edit code, commit, or push.\n\n` +
       `Copilot can run out of usage. When the newest Copilot review on HEAD carries an out-of-usage notice — a body stating Copilot was unable to review because the user who requested the review has reached their quota limit, or any equivalent quota / premium-request / usage-limit exhaustion message rather than an actual code review — Copilot is down for this run: return {sha:${'`'}${head}${'`'}, clean:true, down:true, findings:[]} and stop. Do NOT re-request a review, do NOT keep polling, and do NOT treat the notice as a finding.\n\n` +
       `1. Read any existing Copilot review on HEAD first: python "${CONFIG.sharedScripts}/fetch_copilot_reviews.py" --owner ${input.owner} --repo ${input.repo} --pr-number ${input.prNumber}. This lists every Copilot review across all commits newest-first; only count entries whose commit_id starts with ${head}. If the newest such HEAD-scoped Copilot review is the out-of-usage notice above -> return the down result and stop. A notice on any earlier commit is NOT down: ignore it and continue. With no Copilot review on HEAD, skip a duplicate request: python "${CONFIG.sharedScripts}/check_pending_reviews.py" --owner ${input.owner} --repo ${input.repo} --pr-number ${input.prNumber} --user copilot. Exit 0 means a request is already pending; otherwise request one:\n` +
@@ -1675,8 +1858,13 @@ function runCopilotGate(head) {
       `2. Poll for Copilot's review on HEAD ${head}: up to ${CONFIG.copilotMaxPolls} attempts, 360 seconds apart (wait each 360-second interval inside this turn with the Monitor tool, per the WAITS AND POLLS rule above; if the attempt budget is spent with no review on HEAD, return the full down result {sha:${'`'}${head}${'`'}, clean:false, down:true, findings:[]}). Each attempt: python "${CONFIG.sharedScripts}/fetch_copilot_reviews.py" --owner ${input.owner} --repo ${input.repo} --pr-number ${input.prNumber} for the top-level review state, plus gh api "repos/${input.owner}/${input.repo}/pulls/${input.prNumber}/comments" --paginate --slurp for inline comment ids (Copilot's login contains "copilot", case-insensitive). Only count entries whose commit_id starts with ${head}.\n` +
       `   - Out-of-usage notice on HEAD -> return the down result above (clean:true, down:true) and stop.\n` +
       `   - Copilot review present on HEAD whose state is APPROVED, or COMMENTED with no inline findings -> a clean pass: return {sha:${'`'}${head}${'`'}, clean:true, down:false, findings:[]}.\n` +
-      `   - Copilot findings on HEAD -> return them (each with its inline comment id in replyToCommentId; category 'code-standard' for pure CODE_RULES/style violations with no behavioral impact, 'bug' otherwise), clean:false, down:false.\n` +
+      `   - Copilot findings on HEAD -> return them (each with its inline comment id in replyToCommentId; category 'code-standard' for pure CODE_RULES/style violations with no behavioral impact, 'bug' otherwise; tier per the two-tier rubric below), reviewUrl set to the Copilot review html_url, clean:false, down:false.\n` +
       `   - No review after ${CONFIG.copilotMaxPolls} attempts -> Copilot is down for this run (unreachable, or silently out of quota with no notice): return {sha:${'`'}${head}${'`'}, clean:false, down:true, findings:[]}.\n\n` +
+      `Tier every finding for routing, separate from its category:\n` +
+      `   - tier 'self-healing': pure style, type hints, misplaced or unused imports, formatting, magic-value extraction, test-only changes, doc-or-description vs code mismatches, or code de-duplication — any fix that cannot change observable runtime behavior for production callers. These route into the fix flow automatically.\n` +
+      `   - tier 'code-concern': logic or correctness, security, data handling, error-handling semantics, or concurrency — anything behavior-changing or needing a product decision. These hold for a user-review gate rather than an auto-fix.\n` +
+      `   - Classify as 'code-concern' whenever the tier is in doubt.\n\n` +
+      `A down verdict is valid ONLY in two cases: the review request itself failed, or the FULL poll budget (${CONFIG.copilotMaxPolls} attempts x 360 seconds) elapsed with no review on HEAD. A successful review request means the review is in flight; returning down:true on a partial poll is an invalid result. Never end the poll early for any reason other than a received review on HEAD or an out-of-usage notice — not tooling friction, not turn-length pressure, not a failed attempt to write a polling helper. When your wait tooling fails, re-arm it and keep polling until the budget is spent.\n\n` +
       `Return strictly the schema.`,
     { label: 'copilot-gate', phase: 'Copilot gate', schema: COPILOT_SCHEMA, ...TIERS.haikuLow },
   )
@@ -2101,14 +2289,25 @@ while (iterations < CONFIG.maxIterations) {
       log(`Round ${rounds}: preflight-git agent returned no SHA — retrying without spawning lenses`)
       continue
     }
-    const isBugbotDownPreSpawn = resolveReviewerDown(reviewerAvailability?.bugbot, input.bugbotDisabled || false)
-    log(`Round ${rounds}: parallel Bugbot + code-review + bug-audit on ${head?.slice(0, 7)}`)
+    const sweep = await runStaticSweep(head, reviewerAvailability)
+    if ((sweep?.findings || []).length > 0) {
+      resetNoLensRounds()
+      log(`Round ${rounds}: static sweep raised ${sweep.findings.length} deterministic gate/test failure(s) — fixing before the reading lenses`)
+      const sweepFix = await applyFixes(head, sweep.findings, 'static-sweep')
+      const sweepProgress = detectFixProgress(sweepFix, head, false)
+      if (!sweepProgress.progressed) {
+        blocker = `static-sweep stall: the deterministic gates raised ${sweep.findings.length} failure(s) the fixer could not clear on HEAD ${head} — re-running would loop to the iteration cap`
+        break
+      }
+      head = null
+      continue
+    }
+    log(`Round ${rounds}: parallel code-review + bug-audit + self-review on ${head?.slice(0, 7)}`)
     const lenses = await parallel([
-      () => (isBugbotDownPreSpawn ? Promise.resolve({ sha: head, clean: true, down: true, notSpawned: true, findings: [] }) : runBugbotLens(head, reviewerAvailability)),
       () => runCodeReviewLens(head, reviewerAvailability),
       () => runAuditLens(head, reviewerAvailability),
+      () => runSelfReviewLens(head, reviewerAvailability),
     ])
-    bugbotDown = lenses[0] == null ? true : resolveReviewerDown(lenses[0], input.bugbotDisabled || false)
     const roundOutcome = resolveRoundOutcome(lenses)
     if (roundOutcome.allLensesDead) {
       if (registerNoLensRound(['a review lens agent died'])) {
@@ -2138,7 +2337,7 @@ while (iterations < CONFIG.maxIterations) {
         blocker = cleanAuditBlocker(head, auditResult)
         break
       }
-      phase = 'COPILOT'
+      phase = 'BUGBOT'
       continue
     }
     if (findings.length > 0) {
@@ -2183,6 +2382,54 @@ while (iterations < CONFIG.maxIterations) {
       break
     }
     resetNoLensRounds()
+    phase = 'BUGBOT'
+    continue
+  }
+
+  if (phase === 'BUGBOT') {
+    if (resolveReviewerDown(reviewerAvailability?.bugbot, input.bugbotDisabled || false)) {
+      bugbotDown = true
+      log('Bugbot gate: the shared reviewer-availability probe (or the run input) reported Bugbot unavailable — skipping the terminal Bugbot gate with no agent spawned and proceeding to the Copilot gate.')
+      phase = 'COPILOT'
+      continue
+    }
+    const bugbot = await runBugbotLens(head, reviewerAvailability)
+    const bugbotOutcome = classifyReviewerGateOutcome(bugbot)
+    if (bugbotOutcome.kind === 'retry') {
+      log('Bugbot gate agent died or returned an unreliable not-clean result with no findings — re-running the gate on the same HEAD')
+      continue
+    }
+    if (bugbotOutcome.kind === 'down') {
+      log('Bugbot gate: Bugbot is down or out of quota — no review on HEAD after the poll cap. Bypassing the terminal Bugbot gate and proceeding to the Copilot gate.')
+      bugbotDown = true
+      phase = 'COPILOT'
+      continue
+    }
+    if (bugbotOutcome.kind === 'fix') {
+      if (isStandardsOnlyRound(bugbotOutcome.findings)) {
+        log(`Bugbot raised ${bugbotOutcome.findings.length} code-standard-only finding(s) — deferring to follow-up PRs and treating the gate as passed`)
+        const standardsOutcome = await openStandardsFollowUpOnce(head, bugbotOutcome.findings, 'bugbot', { copilotDisabled: copilotDown, bugbotDisabled: bugbotDown })
+        standardsNote = standardsDeferralNote(bugbotOutcome.findings.length, buildStandardsDeferral())
+        if (standardsOutcome?.deferredPr) deferredPrs.push(standardsOutcome.deferredPr)
+        bugbotDown = false
+        phase = 'COPILOT'
+        continue
+      }
+      log(`Bugbot raised ${bugbotOutcome.findings.length} finding(s) — fixing and re-converging`)
+      const fixResult = await applyFixes(head, bugbotOutcome.findings, 'bugbot')
+      const hadThreadBearingFinding = bugbotOutcome.findings.some((each) => collectFindingThreadIds(each).length > 0)
+      const fixProgress = detectFixProgress(fixResult, head, hadThreadBearingFinding)
+      if (!fixProgress.progressed) {
+        blocker = fixResult?.resolvedWithoutCommit === true && !hadThreadBearingFinding
+          ? `fix stalled: bugbot gate raised ${bugbotOutcome.findings.length} in-memory finding(s) with no GitHub thread, the fix judged them all stale (resolvedWithoutCommit) and moved no code on HEAD ${head} — re-raising would loop to the iteration cap`
+          : `bugbot fix lens landed no push for ${bugbotOutcome.findings.length} finding(s) on HEAD ${head}`
+        break
+      }
+      head = null
+      phase = 'CONVERGE'
+      continue
+    }
+    bugbotDown = false
     phase = 'COPILOT'
     continue
   }
@@ -2210,6 +2457,20 @@ while (iterations < CONFIG.maxIterations) {
       phase = 'FINALIZE'
       continue
     }
+    if (copilotOutcome.kind === 'user-review') {
+      log(`Copilot raised ${copilotOutcome.findings.length} code-concern finding(s) — holding for user review: the workflow does not auto-fix them and does not mark the PR ready`)
+      return {
+        converged: false,
+        rounds,
+        finalSha: head,
+        blocker: 'user-review',
+        userReview: buildUserReview(copilot, copilotOutcome.findings),
+        standardsNote,
+        copilotNote,
+        reuseNote,
+        deferredPrs,
+      }
+    }
     if (copilotOutcome.kind === 'fix') {
       if (isStandardsOnlyRound(copilotOutcome.findings)) {
         log(`Copilot raised ${copilotOutcome.findings.length} code-standard-only finding(s) — deferring to follow-up PRs and treating the gate as passed`)