codex-orchestrator 2.0.1 → 2.0.3

package/internal-workflow/skills/diagnosing-bugs/SKILL.md

@@ -0,0 +1,138 @@
+---
+name: diagnosing-bugs
+description: Debug hard, flaky, unclear, or performance bugs through reproduce, minimize, hypothesize, instrument, fix, and regression-test. Trigger for nondeterministic failures, unclear breakage, or performance regressions.
+---
+
+# Diagnosing Bugs
+
+A discipline for hard bugs. Skip phases only when explicitly justified.
+
+Routing precedence: use `$CODEX_ORCHESTRATOR_WORKFLOW_ROOT/docs/agents/bug-workflow-routing.md`. This skill owns the feedback loop; after the loop proves the bug, return to the original intent: diagnosis-only output or implementation through `code-debugger`.
+
+Use `$CODEX_ORCHESTRATOR_WORKFLOW_ROOT/docs/agents/confidence-rubric.md` when deciding whether a hypothesis, root cause, or fix is high-confidence enough to act on. Low-confidence concerns are questions or verification gaps, not proven causes.
+
+When exploring the codebase, read `CONTEXT.md` (if it exists) to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.
+
+## Phase 1 — Build a feedback loop
+
+**This is the skill.** Everything else is mechanical. If you have a **tight** pass/fail signal for the bug — one that goes red on _this_ bug — you will find the cause; bisection, hypothesis-testing, and instrumentation all just consume it. If you don't have one, no amount of staring at code will save you.
+
+Spend disproportionate effort here. **Be aggressive. Be creative. Refuse to give up.**
+
+### Ways to construct one — try them in roughly this order
+
+1. **Failing test** at whatever seam reaches the bug — unit, integration, e2e.
+2. **Curl / HTTP script** against a running dev server.
+3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.
+4. **Headless browser script** (Playwright / Puppeteer) — drives the UI, asserts on DOM/console/network.
+5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation.
+6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.
+7. **Property / fuzz loop.** If the bug is "sometimes wrong output", run 1000 random inputs and look for the failure mode.
+8. **Bisection harness.** If the bug appeared between two known states (commit, dataset, version), automate "boot at state X, check, repeat" so you can `git bisect run` it.
+9. **Differential loop.** Run the same input through old-version vs new-version (or two configs) and diff outputs.
+10. **HITL bash script.** Last resort. If a human must click, drive _them_ with `scripts/hitl-loop.template.sh` so the loop is still structured. Captured output feeds back to you.
+
+Build the right feedback loop, and the bug is 90% fixed.
+
+### Tighten the loop
+
+Treat the loop as a product. Once you have _a_ loop, **tighten** it:
+
+- Can I make it faster? (Cache setup, skip unrelated init, narrow the test scope.)
+- Can I make the signal sharper? (Assert on the specific symptom, not "didn't crash".)
+- Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.)
+
+A 30-second flaky loop is barely better than no loop; a 2-second deterministic one is tight — a debugging superpower.
+
+### Non-deterministic bugs
+
+The goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not — keep raising the rate until it's debuggable.
+
+### When you genuinely cannot build a loop
+
+Stop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop.
+
+### Completion criterion — a tight loop that goes red
+
+Phase 1 is done when the loop is **tight** and **red-capable**: you can name **one command** — a script path, a test invocation, a curl — that you have **already run at least once** (paste the invocation and its output), and that is:
+
+- [ ] **Red-capable** — it drives the actual bug code path and asserts the **user's exact symptom**, so it can go red on this bug and green once fixed. Not "runs without erroring" — it must be able to _catch this specific bug_.
+- [ ] **Deterministic** — same verdict every run (flaky bugs: a pinned, high reproduction rate, per above).
+- [ ] **Fast** — seconds, not minutes.
+- [ ] **Agent-runnable** — you can run it unattended; a human in the loop only via `scripts/hitl-loop.template.sh`.
+
+If you catch yourself reading code to build a theory before this command exists, **stop — jumping straight to a hypothesis is the exact failure this skill prevents.** No red-capable command, no Phase 2.
+
+## Phase 2 — Reproduce + minimise
+
+Run the loop. Watch it go red — the bug appears.
+
+Confirm:
+
+- [ ] The loop produces the failure mode the **user** described — not a different failure that happens to be nearby. Wrong bug = wrong fix.
+- [ ] The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against).
+- [ ] You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it.
+
+### Minimise
+
+Once it's red, shrink the repro to the **smallest scenario that still goes red**. Cut inputs, callers, config, data, and steps **one at a time**, re-running the loop after each cut — keep only what's load-bearing for the failure.
+
+Why bother: a minimal repro shrinks the hypothesis space in Phase 3 (fewer moving parts left to suspect) and becomes the clean regression test in Phase 5.
+
+Done when **every remaining element is load-bearing** — removing any one of them makes the loop go green.
+
+Do not proceed until you have reproduced **and** minimised.
+
+## Phase 3 — Hypothesise
+
+Generate **3–5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea.
+
+Each hypothesis must be **falsifiable**: state the prediction it makes.
+
+> Format: "If <X> is the cause, then <changing Y> will make the bug disappear / <changing Z> will make it worse."
+
+If you cannot state the prediction, the hypothesis is a vibe — discard or sharpen it.
+
+**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly ("we just deployed a change to #3"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it — proceed with your ranking if the user is AFK.
+
+## Phase 4 — Instrument
+
+Each probe must map to a specific prediction from Phase 3. **Change one variable at a time.**
+
+Tool preference:
+
+1. **Debugger / REPL inspection** if the env supports it. One breakpoint beats ten logs.
+2. **Targeted logs** at the boundaries that distinguish hypotheses.
+3. Never "log everything and grep".
+
+**Tag every debug log** with a unique prefix, e.g. `[DEBUG-a4f2]`. Cleanup at the end becomes a single grep. Untagged logs survive; tagged logs die.
+
+**Perf branch.** For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, `performance.now()`, profiler, query plan), then bisect. Measure first, fix second.
+
+## Phase 5 — Fix + regression test
+
+Write the regression test **before the fix** — but only if there is a **correct seam** for it.
+
+A correct seam is one where the test exercises the **real bug pattern** as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence.
+
+**If no correct seam exists, that itself is the finding.** Note it. The codebase architecture is preventing the bug from being locked down. Flag this for the next phase.
+
+If a correct seam exists:
+
+1. Turn the minimised repro into a failing test at that seam.
+2. Watch it fail.
+3. Apply the fix.
+4. Watch it pass.
+5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.
+
+## Phase 6 — Cleanup + post-mortem
+
+Required before declaring done:
+
+- [ ] Original repro no longer reproduces (re-run the Phase 1 loop)
+- [ ] Regression test passes (or absence of seam is documented)
+- [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix)
+- [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location)
+- [ ] The hypothesis that turned out correct is stated in the commit / PR message — so the next debugger learns
+
+**Then ask: what would have prevented this bug?** If the answer involves architectural change (no good test seam, tangled callers, hidden coupling) hand off to the `$improve-codebase-architecture` skill with the specifics. Make the recommendation **after** the fix is in, not before — you have more information now than when you started.

package/internal-workflow/skills/diagnosing-bugs/agents/openai.yaml

@@ -0,0 +1,6 @@
+interface:
+  display_name: "Diagnosing Bugs"
+  short_description: "Run a disciplined hard-bug investigation loop"
+  default_prompt: "Use $diagnosing-bugs to reproduce, minimise, diagnose, and verify this difficult bug."
+policy:
+  allow_implicit_invocation: true

package/internal-workflow/skills/diagnosing-bugs/scripts/hitl-loop.template.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Human-in-the-loop reproduction loop.
+# Copy this file, edit the steps below, and run it.
+# The agent runs the script; the user follows prompts in their terminal.
+#
+# Usage:
+#   bash hitl-loop.template.sh
+#
+# Two helpers:
+#   step "<instruction>"          → show instruction, wait for Enter
+#   capture VAR "<question>"      → show question, read response into VAR
+#
+# At the end, captured values are printed as KEY=VALUE for the agent to parse.
+
+set -euo pipefail
+
+step() {
+  printf '\n>>> %s\n' "$1"
+  read -r -p "    [Enter when done] " _
+}
+
+capture() {
+  local var="$1" question="$2" answer
+  printf '\n>>> %s\n' "$question"
+  read -r -p "    > " answer
+  printf -v "$var" '%s' "$answer"
+}
+
+# --- edit below ---------------------------------------------------------
+
+step "Open the app at http://localhost:3000 and sign in."
+
+capture ERRORED "Click the 'Export' button. Did it throw an error? (y/n)"
+
+capture ERROR_MSG "Paste the error message (or 'none'):"
+
+# --- edit above ---------------------------------------------------------
+
+printf '\n--- Captured ---\n'
+printf 'ERRORED=%s\n' "$ERRORED"
+printf 'ERROR_MSG=%s\n' "$ERROR_MSG"

package/internal-workflow/skills/implementation-spec-maker/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: "implementation-spec-maker"
+description: "Turn an approved plan, implementation issue, contract-discovery task, or existing spec into the smallest deterministic implementation spec. Use when downstream coding needs an executable checklist with confirmed scope, targets, commands, contracts, validation, and review evidence; do not use for product discovery or implementation."
+---
+
+# Implementation Spec Maker
+
+Create or revise an execution-ready specification for a downstream coding agent. Do not implement code or reopen approved product scope.
+
+## Core Contract
+
+- Treat the supplied plan, issue, discovery task, or existing spec as source authority.
+- Preserve approved scope, exclusions, guardrails, rejected approaches, blockers, validation, and required docs.
+- Confirm execution-critical facts from repository evidence or trusted external contracts. Never invent paths, symbols, commands, fixtures, env vars, schemas, ownership, or API behavior.
+- Produce the smallest spec another agent can execute without guessing. Save a useful `blocked` spec when a material unknown cannot be resolved.
+- Reference approved source content instead of repeating it; write only the missing execution delta.
+
+## Preflight
+
+1. Read the source authority, applicable repository instructions, and only the evidence needed to confirm targets, commands, contracts, consumers, fixtures, and validation.
+2. Reuse valid Evidence Maps and `$research` artifacts. Refresh only claims invalidated by changed files, versions, dates, contracts, or conflicts.
+3. Read the relevant section of [source modes](references/source-modes.md). Stop or mark the spec blocked when its source-specific requirements are not satisfied.
+4. Classify and record these independent facts:
+   - `spec_mode`: `compact | full` — document and coordination density.
+   - `implementation_size`: `small | medium | large` — expected delivery shape.
+   - `review_profile`: `simple | medium | high` — consequence and uncertainty, resolved through the Artifact Review Module.
+   - `expected_repositories`: exact positive integer from approved scope.
+
+Do not infer one classification from another. For ticket work, `direct` returns
+to `$tdd`, `compact spec` requests compact mode, and `standard spec` asks the
+maker to choose the smallest deterministic shape. Start a standard ticket in
+compact mode and expand to full only when repository evidence proves a concrete
+ambiguity that compact form cannot remove safely.
+
+## Choose The Smallest Shape
+
+Default to `compact`, including coherent high-risk or cross-repository work, when ownership, sequencing, stop conditions, and proof fit clearly.
+
+Use `full` only when compact form would leave a concrete ambiguity in safety, contract, ownership, sequencing, validation, revision history, or multi-agent integration. Add only the conditional controls that resolve that ambiguity. Risk alone does not require a long document.
+
+Keep `execution_model: "single-agent"` unless write scopes are perfectly disjoint and one integrator contract is necessary. Never assign overlapping ownership of files, schemas, generated artifacts, migrations, source-of-truth rules, or shared contracts.
+
+## Minimum Solution Gate
+
+Before drafting slices:
+
+1. Reduce the approved outcome to required behavior, material invariants, and proof.
+2. State the direct `Minimum Solution` through existing owners, public seams, and repository patterns.
+3. Set `Added Complexity: None` unless the minimum solution cannot satisfy a named requirement or evidenced failure path.
+4. For every added mechanism, including a new service, helper, adapter, layer, schema object, transaction, retry policy, job, cache, flag, compatibility path, or coordination boundary, record the exact invariant or failure that requires it and what breaks without it.
+5. Run the deletion challenge: if removing a proposed mechanism still satisfies all approved behavior, invariants, and proof, remove it from the spec.
+
+Judge simplicity by the fewest necessary concepts, owners, states, and integration points, not by line or file count. Do not require complexity scores or alternative-solution essays.
+
+## Draft The Execution Contract
+
+Read [the spec template](references/spec-template.md) before drafting, then remove every unused placeholder and optional block.
+
+- Name exact source material, approved scope, exclusions, preconditions, confirmed targets, commands, and observable done criteria.
+- Organize behavior-changing work as narrow vertical slices. Start each slice with the first failing behavior test or exact observable proof, then implementation targets and a slice exit gate.
+- For contract-heavy behavior, use `../../docs/agents/contract-test-ledger.md` and include only material invariants with their first RED test or proof.
+- For UI/app-facing behavior, invoke `$ui-evidence-proof` and embed its task-specific workflow, expected screen state, viewport coverage, fresh artifacts, and criterion-to-artifact mapping in the relevant slice.
+- State exact manual/live proof when automation is not applicable.
+- Name one source of truth when behavior or data can drift. Reuse existing owners and public seams; invoke `$codebase-design` only when ownership or a public seam changes.
+- Add task-specific review checkpoints only when a risky slice becomes stable before later work. Otherwise assign its mandatory lenses, applicable targeted recipes, and concrete bug classes to final review coverage.
+- For medium/high-risk specs, point `Final Handoff Requirements` to the standard `$spec-implementer` Final Risk Handoff and add only task-specific deviations; do not copy its field list.
+- Keep optional cleanup, compatibility logic, feature flags, telemetry, rollout machinery, generic fallbacks, and speculative abstractions out of the spec unless source authority or a proven failure path requires them.
+
+## Review And Save
+
+1. Save the draft at `docs/implementation-specs/YYYY-MM-DD/HHMM-<slug>.md` with temporary `status: "draft"` and `review_outcome: "Pending"` so review applies to a stable artifact path without presenting it as approved.
+2. Invoke `../../docs/agents/artifact-review-loop.md` with `$implementation-spec-review` as its Adapter. Supply the saved spec, source authority, approved decisions, and evidence; do not restate or replace the Module's topology, defect lifecycle, or convergence rules.
+3. Apply consolidated, scope-preserving repairs in place until the Module returns `Approved`, `Blocked`, or an eligible user-authorized `Waived` outcome.
+4. A preflight-blocked spec may be saved with zero reviews and `review_verdict: "Not run"`. Never fabricate approval or use `Not required`.
+5. Replace temporary lifecycle metadata with the Module outcome, last real Adapter verdict, review coverage/counts, accepted risks, and open stable IDs. Any substantive post-approval edit invalidates approval until reviewed again.
+
+## Final Response
+
+Return only:
+
+```text
+Spec Status: Ready | Blocked
+Saved Path: <path>
+Execution: <single-agent | multi-agent>; <compact | full>; <small | medium | large>; <n> repository/repositories
+Review: <Approved | Blocked | Waived>; <simple | medium | high>; <pass counts and coverage>
+Adapter Verdict: <Approved | Needs Work | Rejected | Not run>
+Verified Defects: <stable IDs or None>
+Accepted Risks: <stable IDs, authority, and reason or None>
+Open Defects: <stable IDs or None>
+Blockers: <unresolved blockers or None>
+```
+
+Do not repeat the specification or downstream implementation/signoff procedure in chat.

package/internal-workflow/skills/implementation-spec-maker/agents/openai.yaml

@@ -0,0 +1,6 @@
+interface:
+  display_name: "Implementation Spec Maker"
+  short_description: "Create lean deterministic implementation specs"
+  default_prompt: "Use $implementation-spec-maker to create the smallest deterministic spec while classifying document mode, implementation size, repository count, and review risk independently."
+policy:
+  allow_implicit_invocation: true

package/internal-workflow/skills/implementation-spec-maker/references/source-modes.md

@@ -0,0 +1,31 @@
+# Source Modes
+
+Read the section matching the active source. Apply the common source-authority and evidence rules from `SKILL.md` in every mode.
+
+## Plan-Based
+
+- Treat the approved plan as architectural authority.
+- Preserve its scope, vertical-slice boundaries, guardrails, rejected paths, required docs, validation, and blocking assumptions.
+- Block when missing guardrails would let implementation drift or require redesign.
+
+## Issue-Based
+
+- Treat one issue's acceptance criteria as the execution contract; parent material supplies product context, not sibling-ticket authority.
+- Read comments for changed decisions, blockers, credentials, external contracts, live prerequisites, and rejected approaches.
+- Preserve relevant `Implementation preparation`, `External contracts`, `Verification`, and `Blocked by` content.
+- Use `source_type: "issue"` when no plan exists. Do not block merely because `source_plan` is absent.
+- Block when acceptance criteria are ambiguous, non-verifiable, or contradicted by repository evidence.
+
+## Contract Discovery
+
+- Specify discovery only: exact sources/tools to inspect, evidence to collect, decision record to update, and issue fields/comments to update.
+- Confirm the API surface, auth/secret source, license or terms constraints, acquisition path, deterministic fixture strategy, live-validation prerequisite, and rejected acquisition paths that matter to later implementation.
+- Do not include downstream implementation slices while material external behavior remains unconfirmed.
+
+## Revision
+
+- Reconcile the entire existing spec against new authority and current repository evidence.
+- Preserve still-valid completed `[x]` items exactly.
+- Reopen invalid completed items to `[ ]` and add a short `Revision Note:` with evidence.
+- Never silently delete progress or defect history.
+- Mark the spec blocked when completed history or its contract ledger cannot be trusted.

package/internal-workflow/skills/implementation-spec-maker/references/spec-template.md

@@ -0,0 +1,146 @@
+# Implementation Spec Template
+
+Use the base template for every spec. Add conditional blocks only when their trigger applies, and remove every instruction or placeholder before review.
+
+## Base Template
+
+```markdown
+---
+title: "<title>"
+created_at: "<ISO timestamp>"
+source_type: "plan | issue | contract-discovery | revised-spec"
+source_plan: "<absolute path or None>"
+source_issues:
+  - "<URL/reference or None>"
+status: "draft | ready | blocked"
+execution_model: "single-agent | multi-agent"
+spec_mode: "compact | full"
+implementation_size: "small | medium | large"
+expected_repositories: <positive integer>
+review_profile: "simple | medium | high"
+review_reasons:
+  - "<signal: evidence>"
+review_outcome: "Pending"
+review_verdict: "Not run"
+review_coverage: "Not reviewed"
+review_passes: "0"
+---
+
+## 1. Execution Context
+- **Goal:** <one observable outcome>
+- **Source Material:** <exact references>
+- **Approved Scope:** <strict allowed work>
+- **Out of Scope:** <explicit exclusions or None>
+- **Minimum Solution:** <direct path through existing owners and public seams>
+- **Added Complexity:** None | <repeat one entry per mechanism: `<mechanism>` — required for `<invariant or evidenced failure>`; without it `<concrete breakage>`>
+- **Primary Risk:** <main correctness or coordination risk>
+
+## 2. Preconditions And Evidence
+- **Required Services / Env / Fixtures:** <exact requirements or None>
+- **Blocking Unknowns:** <exact unknowns when blocked, otherwise None>
+- **Confirmed Targets:** <minimal evidence-backed paths and symbols>
+- **Confirmed Commands:** <exact commands>
+- **Protected Paths / Rejected Approaches:** <items or None>
+- **Source of Truth:** <existing owner whenever behavior/data can drift; otherwise omit>
+- **New Boundaries:** <only when ownership or a public seam changes; otherwise omit>
+
+## 3. Execution Slices
+
+### Slice 1 — <narrow end-to-end behavior>
+- [ ] **Test/Proof First:** <failing behavior test or exact observable proof>
+- [ ] **Target:** `<exact/path:symbol>` — <specific action>
+- [ ] **Validation:** <target-level check>
+- [ ] **Exit Gate:** <command or proof that the slice works end-to-end>
+
+<repeat only for independently verifiable behavior slices>
+
+## 4. Validation And Done Criteria
+- [ ] **Lint/Format:** <exact command or Not applicable with reason>
+- [ ] **Typecheck/Build:** <exact command or Not applicable with reason>
+- [ ] **Tests:** <exact command or Not applicable with reason>
+- [ ] **Architecture Check:** <exact command or Not applicable with reason>
+- [ ] **Live/Manual Proof:** <exact flow or Not applicable with reason>
+- [ ] **Behavior Proof:** <observable acceptance proof>
+- [ ] **Reconciliation:** every unchecked item is unfinished, blocked with evidence, or intentionally not applicable.
+- [ ] **Final Handoff Requirements:** <medium/high only: standard `$spec-implementer` Final Risk Handoff plus task-specific deviations or None>
+```
+
+## Conditional Blocks
+
+### Contract Test Ledger
+
+Add for contract-heavy behavior using the shared Contract Test Ledger referenced by `SKILL.md`. Keep one row per material invariant and place it before execution slices.
+
+### Review Checkpoint And Focus
+
+Add a checkpoint only when the risky target becomes stable before later slices. Otherwise put this compact block in final review coverage:
+
+```markdown
+## Review Focus
+- **Mandatory Lenses:** <applicable lenses>
+- **Targeted Recipes:** <applicable recipes or None>
+- **Bug Classes:** <concrete failures to hunt>
+```
+
+### Risk Controls
+
+Add in `full` mode only for applicable ambiguity:
+
+```markdown
+## Risk Controls
+- **Source of Truth:** <owner>
+- **Safety / Contract / State Constraints:** <only applicable constraints>
+- **Forbidden Scope:** <tempting but rejected paths>
+- **Review Timing:** <stable early checkpoint or concrete final-review focus>
+```
+
+### Write Scope Summary
+
+Add for multi-agent work, generated artifacts, broad runtime changes, or when phase targets do not make the write set auditable.
+
+```markdown
+## Write Scope Summary
+- `<path>` — <Create | Update | Delete>; <responsibility>
+```
+
+### Integrator Coordination Contract
+
+Require only when `execution_model: "multi-agent"`:
+
+```markdown
+## Integrator Coordination Contract
+| Agent | Exclusive Write Scope | Handoff | Merge Phase |
+| --- | --- | --- | --- |
+| <agent> | <disjoint paths> | <artifact> | <order> |
+
+- **Integrator Owner:** <owner>
+- **Forbidden Overlap:** <paths/contracts>
+- **Final Duties:** <integration, validation, reconciliation>
+```
+
+### Halt Conditions
+
+Add only when the common contradiction/guessing stop rule is insufficient. Use 3–6 task-specific conditions.
+
+### Defect Closure Notes
+
+Add only when review returns defects:
+
+```markdown
+## Defect Closure Notes
+- **Review Summary:** <pass counts and coverage>
+- **Verified Defects:** <stable IDs or None>
+- **Accepted Risks:** <stable IDs, authority, and reason or None>
+- **Open Defects:** <stable IDs or None>
+```
+
+## Terminal Review Metadata
+
+Replace the temporary frontmatter values after the Artifact Review Module returns a real terminal outcome:
+
+```yaml
+review_outcome: "Approved | Blocked | Waived"
+review_verdict: "Approved | Needs Work | Rejected | Not run"
+review_coverage: "<covered lenses or Not reviewed>"
+review_passes: "<total; full/closure/fresh counts>"
+```