cowork-flow 1.9.2 → 2.0.0

package/template/.cowork-flow/spec/contracts/subagent-dispatch.md

@@ -108,23 +108,6 @@ does not defend against a forged runtime record — writing
 `.cowork-flow/.runtime/**` is out of scope here and would need a signed or
 externally rooted record, which is a separate contract.
 
-## Delegated Spec Self-Check
-
-Delegated subagent tool calls receive no edit-phase hook feedback on hosts
-whose plugin hooks cover only the main session stream (verified on zcode:
-plugin PostToolUse fires for main-session tool calls but never for
-Agent-tool children). The reliable pull path is the CLI: before reporting
-completion, `cowork-implement` (and any child that changes files) runs
-
-```text
-./.cowork-flow/run spec-check
-```
-
-fixes every reported violation, and re-runs until the summary is clean or the
-remaining violations are reported as blockers. This is a protocol behavior,
-not a second lifecycle gate — the closeout gate re-runs the same checks and
-blocks completion regardless.
-
 ## Return Acceptance And Closeout
 
 - Converge on the child result before acceptance — via the wait primitive or
@@ -133,10 +116,12 @@ blocks completion regardless.
 - Confirm no stray running children with the adapter list primitive.
 - Verify the child report by checking files, commands, and results; do not
   trust completed text alone.
-- Before accepting delegated output, run `./.cowork-flow/run spec-check` in
-  the main session and treat every violation as an acceptance blocker: the
-  child receives no edit-phase hook feedback, so acceptance-time checking is
-  the earliest reliable checkpoint for delegated work.
+- Before accepting delegated output, verify the child's changed paths against
+  the task scope and the applicable `spec/` requirements from the diff
+  (`git diff --stat` / `task next <dir> --validate`): child sessions receive no
+  edit-phase hook feedback on hosts whose plugin hooks cover only the main
+  session stream, so acceptance-time review is the earliest reliable checkpoint
+  for delegated work.
 - After completion or failure, close the child with the adapter cancel/close
   primitive and clean the runtime context sessions.
 - The child remains a leaf executor and must not dispatch, wait for, list, or

package/template/.cowork-flow/spec/contracts/task-adopt.md

@@ -74,7 +74,7 @@ that does not advance status); `check_result` is `null` (no check is exempted).
 ## Session binding
 
 On successful adoption the CLI binds the adopter's session to that task (the same
-shape as a rebind by `task next <dir>` or the binding after `task create`), so a
+shape as a rebind by `task next <dir>` or the binding at task creation), so a
 later `task next <dir> --run` can omit the directory and continue the
 review/complete/archive chain.
 

package/template/.cowork-flow/spec/runtime/contract-registry.json

@@ -115,19 +115,6 @@
         "when changing task start readiness",
         "when changing resume context for active tasks"
       ]
-    },
-    {
-      "id": "SPEC_CHECKS_V1",
-      "path": ".cowork-flow/spec/contracts/spec-checks.md",
-      "digest": [
-        "Specs may declare `checks:` commands in frontmatter; the mechanism runs declarations, never prose.",
-        "A declared command that cannot be found counts as unchecked and blocks completion."
-      ],
-      "readWhen": [
-        "before adding or editing spec files",
-        "when a spec clause can be judged by a command exit code",
-        "when spec-check reports violations or unchecked"
-      ]
     }
   ],
   "references": [

package/template/.cowork-flow/spec/runtime/host-assets.json

@@ -155,7 +155,7 @@
         "runtimeContextDispatch": "native",
         "runtimeContextBinding": "shim",
         "runtimeContextCleanup": "native",
-        "editScopeWarning": "unsupported"
+        "editScopeWarning": "plugin"
       },
       "commandTargets": [
         {
@@ -204,7 +204,7 @@
         "runtimeContextDispatch": "native",
         "runtimeContextBinding": "shim",
         "runtimeContextCleanup": "native",
-        "editScopeWarning": "unsupported"
+        "editScopeWarning": "plugin"
       },
       "commandTargets": [],
       "payload": {
@@ -251,7 +251,7 @@
         "runtimeContextDispatch": "native",
         "runtimeContextBinding": "shim",
         "runtimeContextCleanup": "native",
-        "editScopeWarning": "unsupported"
+        "editScopeWarning": "plugin"
       },
       "commandTargets": [
         {
@@ -300,7 +300,7 @@
         "runtimeContextDispatch": "native",
         "runtimeContextBinding": "shim",
         "runtimeContextCleanup": "shim",
-        "editScopeWarning": "unsupported"
+        "editScopeWarning": "plugin"
       },
       "commandTargets": [],
       "payload": null
@@ -431,7 +431,7 @@
         "runtimeContextDispatch": "native",
         "runtimeContextBinding": "shim",
         "runtimeContextCleanup": "native",
-        "editScopeWarning": "unsupported"
+        "editScopeWarning": "plugin"
       },
       "commandTargets": [],
       "payload": {
@@ -460,8 +460,8 @@
       ".cowork-flow/.version",
       ".cowork-flow/run",
       ".cowork-flow/run.cmd",
-      ".cowork-flow/spec/contracts/spec-checks.md",
-      ".cowork-flow/spec/contracts/workflow-state-templates.md"
+      ".cowork-flow/spec/contracts/workflow-state-templates.md",
+      ".cowork-flow/spec/runtime/scope-rules.json"
     ],
     "safePrefixes": [
       ".cowork-flow/"
@@ -515,6 +515,7 @@
       ".cowork-flow/scripts/application",
       ".cowork-flow/scripts/services/batch_execution.py",
       ".cowork-flow/scripts/services/decision_review.py",
+      ".cowork-flow/scripts/services/spec_check.py",
       ".cowork-flow/scripts/commands",
       ".cowork-flow/scripts/common",
       ".cowork-flow/scripts/common/__init__.py",
@@ -567,6 +568,7 @@
       ".cowork-flow/scripts/subagent.py",
       ".cowork-flow/scripts/task.py",
       ".cowork-flow/spec/contracts/entry-contract.md",
+      ".cowork-flow/spec/contracts/spec-checks.md",
       ".cowork-flow/spec/runtime/rules.json",
       ".cowork-flow/spec/schemas/rules.schema.json",
       ".cowork-flow/spec/runtime/skill-registry.json",
@@ -575,6 +577,7 @@
       ".cowork-flow/scripts/adapters/cli/add_session.py",
       ".cowork-flow/workspace/index.md",
       ".cowork-flow/scripts/adapters/cli/change.py",
+      ".cowork-flow/scripts/adapters/cli/spec_check.py",
       ".cowork-flow/changes/",
       ".cowork-flow/skills/adversarial-review",
       ".cowork-flow/skills/agent-dispatch",

package/template/.cowork-flow/spec/runtime/scope-rules.json

@@ -8,9 +8,9 @@
     "trailingSlashRejectedTypes": ["planned-file", "deleted-file"]
   },
   "stageContract": {
-    "budget": 1200,
+    "budget": 3400,
     "scopeLimit": 8,
     "specLimit": 4,
-    "verifyLimit": 3
+    "verifyLimit": 10
   }
 }

package/template/.opencode/cowork-flow/plugin-core.js

@@ -1,11 +1,11 @@
 // Transport shim behind the opencode plugin. Every workflow fact
 // (contract digest, workflow-state, decision anchor, stage contract,
-// runtime-context bind) is rendered by the Python source
-// <scripts>/adapters/host/inject.py --host opencode; this module moves
-// bytes only. What stays here is what the Python side cannot reach:
-// the config-hook skills registration, the shell.env context-key
-// export, and the edit-phase spec-check the tool.execute.after hook
-// delegates to the project runtime.
+// runtime-context bind, edit-scope warning) is rendered by the Python
+// source <scripts>/adapters/host/inject.py --host opencode; this module
+// moves bytes only. What stays here is what the Python side cannot
+// reach: the config-hook skills registration, the shell.env context-key
+// export, and the tool-shape translation for the tool.execute.after
+// edit-scope delegation.
 //
 // This module must NOT live under plugins/: opencode
 // treats every file directly inside plugins/ as a plugin
@@ -175,8 +175,9 @@ function runInject(candidate, script, payload) {
 // inject.py and hand back whatever it printed. The payload spreads the
 // host input so every session/runtime-context key the Python identity
 // table knows arrives unchanged; hook_event_name and cwd are the two
-// fields the hook contract requires.
-async function renderViaInject(input) {
+// fields the hook contract requires. `overrides` swaps the event name
+// and adds the tool fields the PostToolUse contract needs.
+async function renderViaInject(input, overrides = null) {
   if (
     process.env.COWORK_FLOW_HOOKS === "0" ||
     process.env.COWORK_FLOW_DISABLE_HOOKS === "1"
@@ -188,9 +189,11 @@ async function renderViaInject(input) {
   if (!script) {
     return ""
   }
+  const extra = overrides && typeof overrides === "object" ? overrides : {}
   const payload = {
     ...(input && typeof input === "object" ? input : {}),
-    hook_event_name: "UserPromptSubmit",
+    ...extra,
+    hook_event_name: extra.hook_event_name || "UserPromptSubmit",
     cwd: inputCwd(input) || (root === pluginRoot ? null : root) || process.cwd(),
   }
   for (const candidate of pythonCandidates()) {
@@ -203,6 +206,34 @@ async function renderViaInject(input) {
   return ""
 }
 
+// Editor-phase scope warning: opencode sessions get the same
+// single-line out-of-scope advisory the other hosts receive on
+// PostToolUse. Best-effort — a missing runtime, a timeout, or any
+// error stays silent and never blocks the edit that already happened.
+const EDIT_TOOL_NAMES = new Set(["edit", "write"])
+
+function editedFilePath(input) {
+  const tool = typeof input?.tool === "string" ? input.tool : ""
+  if (!EDIT_TOOL_NAMES.has(tool)) {
+    return ""
+  }
+  const args = input?.args
+  const candidate = args && typeof args === "object" ? args.filePath : null
+  return typeof candidate === "string" && candidate.trim() ? candidate.trim() : ""
+}
+
+async function renderEditScopeWarning(input) {
+  const filePath = editedFilePath(input)
+  if (!filePath) {
+    return ""
+  }
+  return renderViaInject(input, {
+    hook_event_name: "PostToolUse",
+    tool_name: typeof input?.tool === "string" ? input.tool : "edit",
+    tool_input: { file_path: filePath },
+  })
+}
+
 function sanitize(value) {
   return String(value ?? "")
     .trim()
@@ -262,82 +293,6 @@ function injectShellEnv(input, output) {
   }
 }
 
-// Editor-phase spec-check: opencode sessions get the same
-// single-line violation hint zcode and claude-code
-// receive. Best-effort — a missing runtime, a timeout, or
-// any error stays silent and never blocks the edit that
-// already happened.
-const EDIT_TOOL_NAMES = new Set(["edit", "write"])
-const EDIT_CHECK_TIMEOUT_MS = 2500
-
-function editedFilePath(input) {
-  const tool = typeof input?.tool === "string" ? input.tool : ""
-  if (!EDIT_TOOL_NAMES.has(tool)) {
-    return ""
-  }
-  const args = input?.args
-  const candidate = args && typeof args === "object" ? args.filePath : null
-  return typeof candidate === "string" && candidate.trim() ? candidate.trim() : ""
-}
-
-function runEditSpecCheck(root, filePath) {
-  return new Promise((resolvePromise) => {
-    let settled = false
-    const finish = (value) => {
-      if (!settled) {
-        settled = true
-        resolvePromise(value)
-      }
-    }
-    const entry = resolve(
-      root,
-      DIR_WORKFLOW,
-      process.platform === "win32" ? "run.cmd" : "run"
-    )
-    if (!existsSync(entry)) {
-      finish("")
-      return
-    }
-    let child
-    try {
-      child = spawn(
-        entry,
-        ["spec-check", "--phase", "edit", "--file", filePath, "--throttled"],
-        {
-          cwd: root,
-          stdio: ["ignore", "pipe", "ignore"],
-          shell: process.platform === "win32",
-        }
-      )
-    } catch {
-      finish("")
-      return
-    }
-    const timer = setTimeout(() => {
-      try {
-        child.kill()
-      } catch {
-        // the edit must not be held up by a stuck checker
-      }
-      finish("")
-    }, EDIT_CHECK_TIMEOUT_MS)
-    let stdout = ""
-    if (child.stdout) {
-      child.stdout.on("data", (chunk) => {
-        stdout += String(chunk)
-      })
-    }
-    child.on("error", () => {
-      clearTimeout(timer)
-      finish("")
-    })
-    child.on("close", () => {
-      clearTimeout(timer)
-      finish(stdout.trim())
-    })
-  })
-}
-
 // The payload's own skills directory, located from this
 // module's file path and not from the repository root: the
 // machine install puts this file in
@@ -382,11 +337,11 @@ export function registerPayloadSkills(config) {
 
 // The plugin adapter imports the hook helpers; these are
 // the unit-test surface (transport, fail-open, shell env,
-// edit-phase delegation). opencode never reads this module.
+// edit-scope delegation). opencode never reads this module.
 export {
   renderViaInject,
   editedFilePath,
+  renderEditScopeWarning,
   findRepoRoot,
   injectShellEnv,
-  runEditSpecCheck,
 }

package/template/.opencode/plugins/cowork-flow.js

@@ -7,12 +7,10 @@
 // re-exported helper would be called as a plugin and break
 // host bootstrap.
 import {
-  editedFilePath,
-  findRepoRoot,
   injectShellEnv,
   registerPayloadSkills,
-  renderViaInject,
-  runEditSpecCheck
+  renderEditScopeWarning,
+  renderViaInject
 } from "../cowork-flow/plugin-core.js"
 
 export const CoworkFlowPlugin = async () => {
@@ -37,12 +35,12 @@ export const CoworkFlowPlugin = async () => {
         output.system.push(text)
       }
     },
+    // Editor-phase scope advisory: the tool already ran, so
+    // the single out-of-scope line is appended to its output
+    // and the call is never blocked. Non-edit tools and a
+    // missing/failing runtime stay silent.
     "tool.execute.after": async (input, output) => {
-      const filePath = editedFilePath(input)
-      if (!filePath) {
-        return
-      }
-      const warning = await runEditSpecCheck(findRepoRoot(input), filePath)
+      const warning = await renderEditScopeWarning(input)
       if (warning) {
         output.output = [output.output, warning].filter(Boolean).join("\n")
       }

package/template/AGENTS.md

@@ -144,5 +144,4 @@
 
 <!-- COWORK-FLOW:START -->
 项目流程以 `task next`、runtime gate、Skill command manifests 和 `.cowork-flow/spec/` 硬契约为准；不要维护第二套流程文档或 Skill 注册控制面。
-规范声明的检查以 `.cowork-flow/spec/contracts/spec-checks.md` 为准；交付或收口前运行 `./.cowork-flow/run spec-check`。
 <!-- COWORK-FLOW:END -->

package/template/skills/agent-dispatch/SKILL.md

@@ -30,21 +30,6 @@ Use this Skill only inside fixed subagents such as `cowork-implement`,
 - Treat runtime gates as CLI adapters backed by kernel services; this Skill may
   explain when to run or report them, but does not enforce them.
 
-## Spec Self-Check
-
-Delegated subagent tool calls receive no edit-phase hook feedback on hosts
-whose plugin hooks cover only the main session stream — a `spec-check[...]
-violation` line never reaches this session, even when the edit violates a
-declared check. Before reporting completion after any file change, run:
-
-```text
-./.cowork-flow/run spec-check
-```
-
-Fix every reported violation and re-run until the summary is clean, or report
-the remaining violations as blockers. Honor any hook feedback the host does
-deliver; the self-check exists because delivery is not guaranteed.
-
 ## Role Outputs
 
 - `cowork-implement`: report changed files, acceptance IDs, verification

package/template/skills/runtime-health/scripts/doctor.py

@@ -672,52 +672,6 @@ def check_runtime(repo_root: Path) -> list[str]:
     return errors
 
 
-def check_spec_checks(repo_root: Path) -> list[dict[str, str]]:
-    """Spec-check declaration health: parse errors and command entry
-    existence. Execution belongs to `run spec-check`; doctor only proves
-    the declarations can run, before a completion gate finds out they
-    cannot."""
-    issues: list[dict[str, str]] = []
-    import shutil
-
-    try:
-        from services.spec_check import collect_spec_declarations
-    except Exception as error:
-        return [
-            {
-                "kind": "spec-checks",
-                "spec": "",
-                "message": f"spec-check service unavailable: {error}",
-            }
-        ]
-    for spec_decls in collect_spec_declarations(repo_root):
-        for message in spec_decls.errors:
-            issues.append(
-                {"kind": "spec-checks", "spec": spec_decls.spec, "message": message}
-            )
-        for decl in spec_decls.decls:
-            entry = (decl.cmd_win if sys.platform == "win32" else decl.cmd) or decl.cmd
-            first_token = entry.split()[0] if entry.split() else ""
-            if not first_token:
-                issues.append(
-                    {
-                        "kind": "spec-checks",
-                        "spec": spec_decls.spec,
-                        "message": f"empty command declaration: {decl.cmd!r}",
-                    }
-                )
-                continue
-            if shutil.which(first_token) is None:
-                issues.append(
-                    {
-                        "kind": "spec-checks",
-                        "spec": spec_decls.spec,
-                        "message": f"command entry not found: {first_token}",
-                    }
-                )
-    return issues
-
-
 def _global_mcp_registered() -> bool:
     """Tolerant probe of user-level host configs for a cowork-flow MCP
     entry. Read-only; missing files simply mean "not registered"."""
@@ -1654,7 +1608,6 @@ def _all_check_result(repo_root: Path) -> dict[str, object]:
     task_hygiene_issues = check_task_hygiene(repo_root)
     state_recovery_issues = check_state_recovery(repo_root)
     session_hygiene_issues = check_session_hygiene(repo_root)
-    spec_check_issues = check_spec_checks(repo_root)
     mcp_issues = check_mcp_registration(repo_root)
     dsh_preset_issues = check_dsh_preset(repo_root)
     kimi_hook_issues = check_kimi_hook(repo_root)
@@ -1675,7 +1628,6 @@ def _all_check_result(repo_root: Path) -> dict[str, object]:
         {"kind": "distribution", "message": error}
         for error in distribution_errors
     )
-    errors.extend({"kind": "spec-checks", **issue} for issue in spec_check_issues)
     return {
         "ok": not errors,
         "errors": errors,
@@ -1684,7 +1636,6 @@ def _all_check_result(repo_root: Path) -> dict[str, object]:
             "taskHygiene": task_hygiene_issues,
             "stateRecovery": state_recovery_issues,
             "sessionHygiene": session_hygiene_issues,
-            "specChecks": spec_check_issues,
             "mcpRegistration": mcp_issues,
             "dshPreset": dsh_preset_issues,
             "kimiHook": kimi_hook_issues,

package/template/skills/spec-sync/SKILL.md

@@ -33,7 +33,6 @@ Keep each update concrete:
 - Show the contract or command shape.
 - Include good/bad cases when useful.
 - State tests or checks that protect the behavior.
-- When a clause is machine-checkable (可机检), add or refresh its `checks:` declaration in the same pass (main session only — never rewrite the clause text): the command must pass on a clean tree, a negative case must prove it can fail, `files` must narrow the scope, and a `spec-check` run after writing must confirm the declaration parses.
 - Update the matching `index.md` when adding a new topic.
 - Check for duplicate guidance and remove stale wording before finishing.
 

package/template/skills/task-planning/SKILL.md

@@ -128,7 +128,7 @@ Then list task briefs, followed by integrated verification and completion checks
 
 - For Tiny tasks, keep the brief short but still name exact file boundaries, completion conditions, and verification commands.
 - For behavior changes, include a failing test before implementation when behavior can be tested.
-- For implementation tasks whose changed files are covered by spec `checks:` declarations, include the spec self-check in the task's Verification Command (for example `./.cowork-flow/run spec-check`): delegated subagents receive no edit-phase hook feedback on some hosts (zcode), so the explicit command is the reliable pull path for both self-check and acceptance.
+- For implementation tasks whose changed files are covered by `.cowork-flow/spec/` requirements, name the covered spec files in the plan so review can check them clause by clause.
 - Do not add shallow tests just to satisfy process. Avoid tests that only assert existence, mirror implementation details, count mock calls without behavior, or snapshot empty structure.
 - For complex problems, test depth first: business invariants, cross-layer contracts, state transitions, error boundaries, and real regression paths before narrow unit cases.
 - Map behavior-changing tests to stable `decision-anchor.md` acceptance IDs when useful; do not create `tdd.jsonl` or write TDD evidence records into `check.jsonl`.

package/template/skills/task-review/SKILL.md

@@ -39,11 +39,11 @@ Read only what is needed for the current task:
 - **Tests**: test intent is explicit; tests fail for meaningful regressions, reject shallow tests such as existence/mock/snapshot-only checks, and cover boundary/error paths when relevant.
 - **Evidence coverage**: when the decision anchor declares acceptance criteria (`AC-xxx`), verify each one has an evidence record in `<task>/evidence.jsonl` — or a recorded `meta.evidenceExempt` exemption from an explicit `--allow-missing-evidence` completion. Schema and gate codes (`LIFECYCLE-AC-001..004`) are defined in `.cowork-flow/spec/contracts/evidence-completion.md`. A record must point at real proof (test, command output, or manual verification note); a record that restates the AC without evidence is a finding.
 - **Receipt freshness**: a strict task's completion gate requires the latest receipt to match the current change fingerprint, which covers the changed paths' content, the anchor's goal and AC text, the bound plan, `dev_type`, the referenced spec bodies, and `implement.jsonl`. Appending a scope entry to `implement.jsonl` — or editing a referenced spec body — therefore invalidates the receipt, so the review is re-run on the final state. That is the intended cost, not a defect. Evidence appends, AC ticks, and `.cowork-flow/.runtime/**` stay fingerprint-neutral, so closeout never invalidates what it just checked.
-- **User specs**: every applicable backend/frontend requirement is verified against the diff and marked `pass`, `finding`, or `not_applicable` with reason. Every `finding` is fixed during review; an unfixed spec violation blocks completion and is never accepted as-is or deferred to the user. For each requirement, also ask whether it is machine-checkable (可机检) and already declared with `checks:`; identifying checkable clauses and adding or refreshing declarations is a main-session duty (never rewrite the clause text — raise a conflict through the review instead), and a declared check must earn its place: the command passes on a clean tree, a negative case proves it can fail, `files` narrows the scope, and a `spec-check` run after declaring confirms the declaration parses. Delegated subagents do not edit specs; they report candidates up.
+- **User specs**: every applicable backend/frontend requirement is verified against the diff and marked `pass`, `finding`, or `not_applicable` with reason. Every `finding` is fixed during review; an unfixed spec violation blocks completion and is never accepted as-is or deferred to the user. For each requirement, also ask whether it is machine-checkable (可机检) and name the command that decides it together with what that command reports when the clause is broken: a machine-checkable clause left with no deciding command is itself a finding. Review never rewrites the clause text — a conflict between a clause and the implementation is raised through the review for the user to decide. Delegated subagents do not edit specs; they report candidates up.
 - **Specs**: project specs are updated when behavior/contracts changed, or the review states why no spec update is needed.
 - **Code quality**: naming, layering, error handling, state boundaries, security-sensitive paths, and complexity are reviewed against applicable user specs.
 - **Lifecycle blockers**: state/scope blockers are fixed before acceptance; review does not invent hard blockers for natural-language specs.
-- **Delegated acceptance**: when the implementation came from a delegated subagent, run `./.cowork-flow/run spec-check` before accepting its report — delegated sessions receive no edit-phase hook feedback on some hosts (zcode), so the report can be silently non-compliant; every violation is fixed or blocks acceptance.
+- **Delegated acceptance**: when the implementation came from a delegated subagent, verify the changed paths against the task scope and the applicable `spec/` requirements before accepting its report — delegated sessions receive no edit-phase hook feedback on some hosts, so the report can be silently out of scope or out of spec; every violation is fixed or blocks acceptance.
 - **Advisory facts**: helper output is used to focus review, not to declare pass/fail or block completion.
 - **Anti-self-proof**: every claimed pass maps to source, diff, test output, or lifecycle output.
 - **Anti-rationalization**: every accepted gap has an explicit user decision or narrow technical reason.
@@ -85,7 +85,7 @@ Return a concise review result with:
 - `status`: `pass`, `needs_fix`, or `blocked`.
 - `findings`: severity, file, line/scope, impact, fix, plus the `clause` / `command` / `negativeProof` triple defined in Review Report Format.
 - `test_intent_review`: why tests prove the intended behavior or what is missing.
-- `user_spec_review`: applicable spec files, per-requirement result, findings, and the "clause → command → negative proof" list for every `checks:` declaration added or refreshed in this review (`none` when nothing became machine-checkable).
+- `user_spec_review`: applicable spec files, per-requirement result, findings, and the "clause → command → negative proof" list for every machine-checkable requirement the review judged (`none` when nothing was machine-checkable).
 - `lifecycle_check_review`: lifecycle commands run, blocker status, and resolution.
 - `verification`: exact commands run from this checkout.
 - `specUpdates`: files updated or reason no update was needed.