engineering-memory 1.11.29 → 1.11.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-memory",
-  "version": "1.11.29",
+  "version": "1.11.30",
   "description": "Installs the Engineering Memory skill and its local MCP bridge. Sign in after installing; your organization and project are resolved from your account.",
   "license": "UNLICENSED",
   "type": "module",

package/runtime/build.json

@@ -1,3 +1,3 @@
 {
-  "gitHead": "0bcad22013da985e82e5ac61c6fcf0f3bd598fd2"
+  "gitHead": "36588e4f0edd74e5ca4f7ebb8c8f77a41a2af925"
 }

package/runtime/dist/src/config.js

@@ -80,6 +80,9 @@ export const endpoints = {
     reviewPass: (projectId, taskId) => `/projects/${projectId}/tasks/${taskId}/review/pass`,
     reviewSkip: (projectId, taskId) => `/projects/${projectId}/tasks/${taskId}/review/skip`,
     reviewExemption: (projectId, taskId) => `/projects/${projectId}/tasks/${taskId}/review/exemption`,
+    reviewRoundComment: (projectId, roundId) => `/projects/${projectId}/review-rounds/${roundId}/comment`,
+    reviewComment: (projectId, taskId) => `/projects/${projectId}/tasks/${taskId}/review/comment`,
+    reviewProviderFailure: (projectId, taskId) => `/projects/${projectId}/tasks/${taskId}/review/provider-failure`,
     projectSetup: '/projects/setup',
     projectList: '/projects',
     projectResolve: '/projects/resolve',

package/runtime/dist/src/localization/catalogue.generated.js

@@ -270,6 +270,15 @@ export const bundledTexts = {
         'reviewBatch.untitled': 'untitled {kind}',
         'reviewBatch.unversioned': 'Written without a source inspection: {titles}. Tasks that read memory by source version will not see them until an inspection retains them.',
         'reviewBatch.why': 'Why',
+        'reviewComment.exempted': 'Engineering Memory code review of {task}: exempted. Reason: {reason}',
+        'reviewComment.findingsOf': 'Findings of round {round}:',
+        'reviewComment.fixed': 'fixed in {commit}',
+        'reviewComment.open': 'still open',
+        'reviewComment.passed': 'Engineering Memory code review of {task}: passed after {rounds, plural, one {# round} other {# rounds}}',
+        'reviewComment.rejected': 'rejected: {reason}',
+        'reviewComment.round': 'Engineering Memory code review of {task}, round {round}: {count, plural, one {# finding} other {# findings}}',
+        'reviewComment.rule': 'rule {rule}',
+        'reviewComment.skipped': 'Engineering Memory code review of {task}: skipped',
         'reviewConclude.confirm.description': 'The review ends as described above.',
         'reviewConclude.confirm.label': 'Yes, end it',
         'reviewConclude.defer.description': 'The review stays open; nothing is recorded.',
@@ -736,6 +745,15 @@ export const bundledTexts = {
         'reviewBatch.untitled': 'başlıksız {kind}',
         'reviewBatch.unversioned': 'Kaynak incelemesi yapılmadan yazılanlar: {titles}. Hafızayı kaynak sürümüne göre okuyan görevler, bir inceleme bunları saklayana kadar görmez.',
         'reviewBatch.why': 'Nedeni',
+        'reviewComment.exempted': '{task} için Engineering Memory kod incelemesi: muaf tutuldu. Gerekçe: {reason}',
+        'reviewComment.findingsOf': 'Tur {round} bulguları:',
+        'reviewComment.fixed': '{commit} ile düzeltildi',
+        'reviewComment.open': 'hâlâ açık',
+        'reviewComment.passed': '{task} için Engineering Memory kod incelemesi: {rounds, plural, one {# turda} other {# turda}} geçti',
+        'reviewComment.rejected': 'reddedildi: {reason}',
+        'reviewComment.round': '{task} için Engineering Memory kod incelemesi, tur {round}: {count, plural, one {# bulgu} other {# bulgu}}',
+        'reviewComment.rule': 'kural {rule}',
+        'reviewComment.skipped': '{task} için Engineering Memory kod incelemesi: atlandı',
         'reviewConclude.confirm.description': 'İnceleme yukarıda anlatıldığı gibi sonuçlanır.',
         'reviewConclude.confirm.label': 'Evet, bitir',
         'reviewConclude.defer.description': 'İnceleme açık kalır; hiçbir şey kaydedilmez.',

package/runtime/dist/src/mcp/delivery-tools.js

@@ -647,28 +647,47 @@ function registerTaskDelivery(server, service) {
 }
 function registerTaskReviewRequest(server, service) {
     server.registerTool('task.review_request', {
-        description: "Record the pull request (GitHub) or merge request (GitLab) a closed task's changes went into, and its state: draft, ready, merged or closed. Call it with the link copied from the provider as soon as the pull request is opened, and again when the user says it became ready, was merged or was closed. Engineering Memory then moves the task's work item as the project's workflow rules say, for example to PR when every pull request of the work item is ready and to READY FOR QA when they are all merged. It works from any chat, also for a delivery session.entry lists. What is recorded is what was reported: Engineering Memory does not check it with the provider, and performs no Git or provider action.",
+        description: "Record the pull request (GitHub) or merge request (GitLab) a closed task's changes went into, and its state: draft, ready, merged or closed. Call it with the link copied from the provider as soon as the pull request is opened, and again when the user says it became ready, was merged or was closed. Pass headCommit and targetBranch when you can read them from the provider (on GitHub, gh pr view with --json headRefOid,baseRefName): a code review that had passed waits again when the pull request gets a new commit or a new target branch. Engineering Memory then moves the task's work item as the project's workflow rules say, for example to PR when every pull request of the work item is ready and to READY FOR QA when they are all merged. It works from any chat, also for a delivery session.entry lists. What is recorded is what was reported: Engineering Memory does not check it with the provider, and performs no Git or provider action.",
         inputSchema: z.strictObject({
             projectId: z.string().uuid(),
             taskId: z.string().uuid(),
             url: z.string().trim().min(1).max(500),
             state: z.enum(['draft', 'ready', 'merged', 'closed']),
+            headCommit: z
+                .string()
+                .regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/)
+                .optional(),
+            targetBranch: z.string().trim().min(1).max(255).optional(),
         }),
     }, async (input) => {
         const result = await service.taskReviewRequest(input);
         if (!result.ok)
             return output(result);
         const recorded = result.data;
+        const reopened = recorded.data?.reviewReopened;
+        const job = recorded.data?.providerJob;
         return output({
             ok: true,
             data: {
                 ...result.data,
                 nextAction: recorded.queued
                     ? 'Engineering Memory is unreachable, so this report is queued. It is recorded, and the work item moves as the rules say, when Engineering Memory is reachable again.'
-                    : (recorded.data?.reviewEvent?.nextAction ??
-                        (recorded.data?.reviewEvent
-                            ? 'The pull request is recorded; the work item stays where it is.'
-                            : 'The pull request is recorded. The work item does not move yet: other work on it is still open or undelivered, or the task has no active work item.')),
+                    : [
+                        reopened
+                            ? `The code review of this delivery had passed, but the pull request has ${reopened === 'new_target' ? 'a new target branch' : 'a new commit'} now, so the review waits again. Tell the user in one line; review.start runs the next round.`
+                            : '',
+                        job === 'make_draft'
+                            ? 'This project requires code review, so turn the pull request back into a draft with your own tools (on GitHub, gh pr ready --undo) and record it with state draft.'
+                            : job === 'make_ready'
+                                ? 'Its code review has already ended: review.make_ready makes the pull request ready.'
+                                : '',
+                        recorded.data?.reviewEvent?.nextAction ??
+                            (recorded.data?.reviewEvent
+                                ? 'The pull request is recorded; the work item stays where it is.'
+                                : 'The pull request is recorded. The work item does not move yet: other work on it is still open or undelivered, or the task has no active work item.'),
+                    ]
+                        .filter(Boolean)
+                        .join(' '),
             },
         });
     });

package/runtime/dist/src/mcp/review-tools.js

@@ -39,6 +39,7 @@ const reviewRead = z.object({
     delivery: z.object({
         externalTaskId: z.string(),
         reviewState: z.string().nullish(),
+        reviewReopenReason: z.string().nullish(),
         reviewPolicy: z.string().optional(),
     }),
     rounds: z.array(z.object({ id: z.string(), state: z.string() })),
@@ -132,7 +133,7 @@ export function registerReviewTools(server, service) {
         inputSchema: z.strictObject({ projectId: z.string().uuid(), taskId: z.string().uuid() }),
     }, async (input) => output(await service.reviewGet(input)));
     server.registerTool('review.start', {
-        description: "Start the next code review round of a delivered task, or return the round already open at the same commit, from a clone of the task's project on this computer. It fetches the pushed branch and its target from origin without checking anything out and returns the review packet: the commits to compare, the changed files, the records that governed the change, earlier findings and the read-only Git commands the reviewer may use. Pass targetBranch only when the delivery names no target branch.",
+        description: "Start the next code review round of a delivered task, or return the round already open at the same commit, from a clone of the task's project on this computer. It fetches the pushed branch and its target from origin without checking anything out and returns the review packet: the commits to compare, the changed files, the records that governed the change, earlier findings and the read-only Git commands the reviewer may use; from the second round on, also what changed since the previous round. The target branch is the one recorded for its PR/MR, else the one the delivery answer named; pass targetBranch only when neither is right.",
         inputSchema: z.strictObject({
             projectId: z.string().uuid(),
             taskId: z.string().uuid(),
@@ -150,7 +151,7 @@ export function registerReviewTools(server, service) {
         }),
     }, async (input) => output(await service.reviewRules(input)));
     server.registerTool('review.submit', {
-        description: 'Record the result of a review round: its findings, or an empty list when there are none. E-mail addresses, IP addresses and user folders in descriptions are masked first; a description that still holds a secret or personal data is refused so it can be rephrased. Sending the same result again changes nothing.',
+        description: 'Record the result of a review round: its findings, or an empty list when there are none. E-mail addresses, IP addresses and user folders in descriptions are masked first; a description that still holds a secret or personal data is refused so it can be rephrased. Sending the same result again changes nothing. The findings, and later the conclusion, are written on the PR/MR as a comment: on GitLab with the token the user saved on this computer, elsewhere comment.body is returned for you to post.',
         inputSchema: z.strictObject({
             projectId: z.string().uuid(),
             roundId: z.string().uuid(),
@@ -285,6 +286,8 @@ export function registerReviewTools(server, service) {
             });
         if (!waitingReview.includes(state ?? ''))
             return refusal(`The review of ${task} is ${state ?? 'not tracked'}, so there is nothing to end. review.get shows where it stands.`, 'review.get');
+        if (input.outcome === 'passed' && review.delivery.reviewReopenReason)
+            return refusal(`The review of ${task} had passed, then its PR/MR got ${review.delivery.reviewReopenReason === 'new_target' ? 'a new target branch' : 'a new commit'}, so it passes again only after a round reviews it. Start one with review.start, or ask the user whether to skip or exempt it.`, 'review.start');
         if (input.outcome === 'passed' &&
             (state !== 'pending' ||
                 !review.rounds.some((round) => round.state === 'submitted') ||
@@ -353,7 +356,7 @@ export function registerReviewTools(server, service) {
         });
     });
     server.registerTool('review.make_ready', {
-        description: "Make the PR/MR of a delivered task ready for the team once its code review ended, or, when the user asks, one that has no code review; while a review runs it refuses. On GitLab with the user's own token saved on this computer, it removes Draft from the merge request and records it; anywhere else it says exactly what to do, since the draft is marked ready with the provider's own tools or by the user.",
+        description: "Make the PR/MR of a delivered task ready for the team once its code review ended, or, when the user asks, one that has no code review; while a review runs it refuses. On GitLab with the user's own token saved on this computer, it writes the review conclusion as a comment when it is not written yet, removes Draft from the merge request and records it; anywhere else it says exactly what to do, since the draft is marked ready with the provider's own tools or by the user.",
         inputSchema: z.strictObject({ projectId: z.string().uuid(), taskId: z.string().uuid() }),
     }, async (input) => output(await service.reviewMakeReady(input)));
 }

package/runtime/dist/src/providers/gitlab.js

@@ -152,6 +152,7 @@ export const mergeRequestSchema = z.object({
     project_id: z.number().optional(),
     source_project_id: z.number().optional(),
 });
+const noteSchema = z.object({ id: z.number(), body: z.string() });
 export function reviewState(request) {
     if (request.state === 'merged')
         return 'merged';
@@ -227,6 +228,13 @@ export class GitLabClient {
             ...(request.description ? { description: request.description } : {}),
         }));
     }
+    async notes(address, token, project, number) {
+        const query = new URLSearchParams({ sort: 'desc', order_by: 'created_at', per_page: '100' });
+        return this.shape(address, z.array(noteSchema), await this.call(address, token, 'GET', `/projects/${encodeURIComponent(project)}/merge_requests/${number}/notes?${query}`));
+    }
+    async createNote(address, token, project, number, body) {
+        this.shape(address, noteSchema, await this.call(address, token, 'POST', `/projects/${encodeURIComponent(project)}/merge_requests/${number}/notes`, { body }));
+    }
     async retitleMergeRequest(address, token, project, number, title) {
         return this.shape(address, mergeRequestSchema, await this.call(address, token, 'PUT', `/projects/${encodeURIComponent(project)}/merge_requests/${number}`, { title }));
     }

package/runtime/dist/src/runtime/api-client.js

@@ -95,6 +95,11 @@ export class ApiResponseError extends Error {
         this.recovery = normalizedRecovery;
     }
 }
+export function backendRejectsField(error, fields) {
+    return (error instanceof ApiResponseError &&
+        error.httpStatus === 400 &&
+        fields.some((field) => error.message.includes(`property ${field} should not exist`)));
+}
 export class ApiClient {
     options;
     fetchImplementation;

package/runtime/dist/src/runtime/bridge-service.js

@@ -15,7 +15,7 @@ import { minimatch } from 'minimatch';
 import { endpoints } from '../config.js';
 import { startPhaseTimer } from './phase-timer.js';
 import { sha256, stableStringify } from '../utilities/hash.js';
-import { ApiResponseError, BackendUnavailableError, } from './api-client.js';
+import { ApiResponseError, BackendUnavailableError, backendRejectsField, } from './api-client.js';
 import { assertSafeToPersist, normalizeRepositoryPaths } from './offline-outbox.js';
 import { restrictedValueKind } from './privacy-detector.js';
 import { principalFingerprint } from './principal-state.js';
@@ -26,6 +26,7 @@ import { BridgeRecoveryError } from './recovery-error.js';
 import { gitLabRemote } from '../providers/gitlab.js';
 import { awaitsReviewRequest, concludedReview, opensAsDraft, reviewDeliveries, reviewDeliverySchema, waitingReview, } from './merge-request-sync.js';
 import { maskFinding } from './review-masking.js';
+import { commentReviewSchema, dueComment, markComment } from './review-comment.js';
 export const validationIds = [
     'format',
     'static_analysis',
@@ -4410,6 +4411,9 @@ export class BridgeService {
                 .object({
                 total: z.number().int(),
                 items: z.array(reviewDeliverySchema.extend({
+                    reviewReopenReason: z.string().nullish(),
+                    providerJobSince: z.string().nullish(),
+                    providerFailure: z.string().nullish(),
                     openRound: z.object({ number: z.number().int(), createdAt: z.string() }).nullish(),
                     openFindings: z.number().int(),
                 })),
@@ -4424,15 +4428,25 @@ export class BridgeService {
                     externalTaskId: item.externalTaskId ?? null,
                     workItemKey: item.workItemKey ?? null,
                     reviewState: item.reviewState ?? null,
+                    reopened: item.reviewReopenReason ?? null,
                     pullRequest: item.reviewRequest
                         ? { url: item.reviewRequest.url, state: item.reviewRequest.state }
                         : null,
+                    readyBeforeReview: waitingReview.includes(item.reviewState ?? '') && item.reviewRequest?.state === 'ready',
+                    pullRequestChange: item.providerJob
+                        ? {
+                            job: item.providerJob,
+                            since: item.providerJobSince ?? null,
+                            failure: item.providerFailure ?? null,
+                            failedAt: item.providerFailedAt ?? null,
+                        }
+                        : null,
                     openRound: item.openRound
                         ? { number: item.openRound.number, since: item.openRound.createdAt }
                         : null,
                     openFindings: item.openFindings,
                 })),
-                nextAction: 'These deliveries wait for code review. Mention them to the user in one line and start nothing on your own. When the user asks, review.get reads one and review.start runs its next round from a clone of this project; a review that ended while its PR/MR is still a draft waits for review.make_ready.',
+                nextAction: 'These deliveries wait for code review. Mention them to the user in one line and start nothing on your own. When the user asks, review.get reads one and review.start runs its next round from a clone of this project; a review that ended while its PR/MR is still a draft waits for review.make_ready. reopened (new_commit or new_target) means the review had passed and then a new commit or a new target branch arrived, so it waits again; readyBeforeReview means its PR/MR was made ready while the review had not ended; pullRequestChange is a make-ready or make-draft that a member computer with a GitLab token does in the background, with the last failure when one was recorded.',
             });
         }
         catch {
@@ -4757,7 +4771,18 @@ export class BridgeService {
         return this.execute(() => this.mutateWithOutbox('task.delivery', endpoints.taskDeliveryCancel(input.projectId, input.taskId), { reason: input.reason }));
     }
     async taskReviewRequest(input) {
-        return this.execute(() => this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), { url: input.url, state: input.state }));
+        return this.execute(() => {
+            const report = (reading) => this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), cleanJson({
+                url: input.url,
+                state: input.state,
+                ...(reading ? { headCommit: input.headCommit, targetBranch: input.targetBranch } : {}),
+            }));
+            return report(true).catch((error) => {
+                if (!backendRejectsField(error, ['headCommit', 'targetBranch']))
+                    throw error;
+                return report(false);
+            });
+        });
     }
     async taskOpenReviewRequest(input) {
         return this.execute(async () => {
@@ -4882,7 +4907,7 @@ export class BridgeService {
                     : `No code review was asked for ${task}. A review starts when its delivery chooses a reviewed PR/MR, or, where review is required, when its PR/MR is recorded.`, 'review.get');
             if (delivery.state !== 'delivered' || !delivery.pushed || !delivery.branch)
                 throw refuse(`${task} is not pushed yet, and a review reads the pushed branch. Push it and record the delivery (worktree.release with deliveryOutcome delivered), then call review.start again.`, 'review.get');
-            const target = input.targetBranch ?? delivery.baseBranch;
+            const target = input.targetBranch ?? delivery.reviewRequest?.targetBranch ?? delivery.baseBranch;
             if (!target)
                 throw refuse(`The delivery of ${task} names no target branch. Call review.start again with targetBranch: the branch its PR/MR goes into.`, 'review.start');
             const git = this.dependencies.repositories.git;
@@ -4894,9 +4919,18 @@ export class BridgeService {
             if (!tip)
                 throw refuse(`The target branch ${target} could not be fetched from origin. If the PR/MR goes into another branch, call review.start again with targetBranch.`, 'review.start');
             const base = await git.mergeBase(repository.repoRoot, head.sourceCommit, tip.sourceCommit);
-            const started = reviewSchema.parse((await this.dependencies.client.request(endpoints.reviewRounds(input.projectId, input.taskId), {
+            const startRound = (withTarget) => this.dependencies.client.request(endpoints.reviewRounds(input.projectId, input.taskId), {
                 method: 'POST',
-                body: cleanJson({ commit: head.sourceCommit, baseCommit: base ?? undefined }),
+                body: cleanJson({
+                    commit: head.sourceCommit,
+                    baseCommit: base ?? undefined,
+                    targetBranch: withTarget ? target : undefined,
+                }),
+            });
+            const started = reviewSchema.parse((await startRound(true).catch((error) => {
+                if (!backendRejectsField(error, ['targetBranch']))
+                    throw error;
+                return startRound(false);
             })).data);
             const round = started.rounds.find((candidate) => candidate.state === 'open');
             if (!round)
@@ -4904,6 +4938,12 @@ export class BridgeService {
             const files = base
                 ? await git.changedFiles(repository.repoRoot, base, head.sourceCommit)
                 : [];
+            const previous = started.rounds.find((candidate) => candidate.state === 'submitted' && candidate.number < round.number);
+            const since = previous &&
+                previous.headCommit !== head.sourceCommit &&
+                (await git.isAncestor(repository.repoRoot, previous.headCommit, head.sourceCommit))
+                ? await git.changedFiles(repository.repoRoot, previous.headCommit, head.sourceCommit)
+                : null;
             const records = await this.dependencies.client.request(`${endpoints.reviewRoundRules(input.projectId, round.id)}?offset=0&limit=5`);
             const range = base ? `${base} ${head.sourceCommit}` : head.sourceCommit;
             return asJsonValue({
@@ -4925,22 +4965,36 @@ export class BridgeService {
                 },
                 changedFiles: files.slice(0, 300),
                 changedFileCount: files.length,
+                ...(previous && since
+                    ? {
+                        sinceLastRound: {
+                            commit: previous.headCommit,
+                            changedFiles: since.slice(0, 300),
+                            changedFileCount: since.length,
+                        },
+                    }
+                    : {}),
                 earlierFindings: round.number > 1 ? started.findings : [],
                 records: records.data,
-                commands: base
-                    ? [
-                        `git diff --stat ${range}`,
-                        `git diff ${range} -- <path>`,
-                        `git show ${head.sourceCommit}:<path>`,
-                        `git grep -n <pattern> ${head.sourceCommit} -- <path>`,
-                        `git log --oneline ${base}..${head.sourceCommit}`,
-                    ]
-                    : [
-                        `git show --stat ${head.sourceCommit}`,
-                        `git show ${head.sourceCommit}:<path>`,
-                        `git grep -n <pattern> ${head.sourceCommit} -- <path>`,
-                    ],
-                nextAction: `Give this packet to a fresh subagent that did not write the change; if your host cannot start one, review it yourself under the same rules. The reviewer reads the change from baseCommit to headCommit only through the listed read-only Git commands: it never checks out, switches branches, edits, commits or pushes, and changes no file. It judges the change against the records (more with review.rules for this round from offset 5 while more are listed) and says whether each earlier finding still holds. Each finding names the file path, the line in headCommit when there is one, the ruleKey of the record it breaks when one applies, and a plain description of what is wrong and why. Then call review.submit with this projectId, roundId and the findings, an empty list when there are none.`,
+                commands: [
+                    ...(base
+                        ? [
+                            `git diff --stat ${range}`,
+                            `git diff ${range} -- <path>`,
+                            `git show ${head.sourceCommit}:<path>`,
+                            `git grep -n <pattern> ${head.sourceCommit} -- <path>`,
+                            `git log --oneline ${base}..${head.sourceCommit}`,
+                        ]
+                        : [
+                            `git show --stat ${head.sourceCommit}`,
+                            `git show ${head.sourceCommit}:<path>`,
+                            `git grep -n <pattern> ${head.sourceCommit} -- <path>`,
+                        ]),
+                    ...(previous && since
+                        ? [`git diff ${previous.headCommit} ${head.sourceCommit} -- <path>`]
+                        : []),
+                ],
+                nextAction: `Give this packet to a fresh subagent that did not write the change; if your host cannot start one, review it yourself under the same rules. The reviewer reads the change from baseCommit to headCommit only through the listed read-only Git commands: it never checks out, switches branches, edits, commits or pushes, and changes no file. It judges the change against the records (more with review.rules for this round from offset 5 while more are listed) and says whether each earlier finding still holds${previous && since ? ', starting from sinceLastRound: what changed since the previous round' : ''}. Each finding names the file path, the line in headCommit when there is one, the ruleKey of the record it breaks when one applies, and a plain description of what is wrong and why. Then call review.submit with this projectId, roundId and the findings, an empty list when there are none.`,
             });
         });
     }
@@ -4971,14 +5025,20 @@ export class BridgeService {
             }));
             const idempotencyKey = deterministicUuid('review.submit', input.roundId, stableStringify(findings));
             const response = await this.dependencies.client.request(endpoints.reviewRoundResult(input.projectId, input.roundId), { method: 'POST', body: cleanJson({ idempotencyKey, findings }) });
+            const comment = await this.reviewComment(input.projectId, response.data);
             return asJsonValue({
                 review: response.data,
                 masked: [...new Set(checked.flatMap(({ mask }) => mask.masked))],
+                ...(comment ? { comment } : {}),
             });
         });
     }
     async reviewRejectFinding(input) {
-        return this.execute(async () => asJsonValue((await this.dependencies.client.request(endpoints.reviewFindingRejection(input.projectId, input.findingId), { method: 'POST', body: { reason: input.reason } })).data));
+        return this.execute(async () => {
+            const response = await this.dependencies.client.request(endpoints.reviewFindingRejection(input.projectId, input.findingId), { method: 'POST', body: { reason: input.reason } });
+            const comment = await this.reviewComment(input.projectId, response.data);
+            return asJsonValue({ ...objectOrEmpty(response.data), ...(comment ? { comment } : {}) });
+        });
     }
     async reviewConclude(input) {
         return this.execute(async () => {
@@ -4987,15 +5047,18 @@ export class BridgeService {
                 : input.outcome === 'skipped'
                     ? endpoints.reviewSkip(input.projectId, input.taskId)
                     : endpoints.reviewExemption(input.projectId, input.taskId);
-            return asJsonValue((await this.dependencies.client.request(path, {
+            const response = await this.dependencies.client.request(path, {
                 method: 'POST',
                 ...(input.outcome === 'exempted' ? { body: { reason: input.reason ?? '' } } : {}),
-            })).data);
+            });
+            const comment = await this.reviewComment(input.projectId, response.data);
+            return asJsonValue({ ...objectOrEmpty(response.data), ...(comment ? { comment } : {}) });
         });
     }
     async reviewMakeReady(input) {
         return this.execute(async () => {
-            const { delivery } = await this.review(input.projectId, input.taskId);
+            const data = (await this.dependencies.client.request(endpoints.review(input.projectId, input.taskId))).data;
+            const { delivery } = reviewSchema.parse(data);
             const task = delivery.externalTaskId;
             const request = delivery.reviewRequest;
             if (waitingReview.includes(delivery.reviewState ?? ''))
@@ -5005,32 +5068,75 @@ export class BridgeService {
                     ready: false,
                     nextAction: `No PR/MR is recorded for ${task}. Open it now as ready: on GitLab task.open_review_request with draft false; elsewhere with your own tools, then record it with task.review_request.`,
                 });
+            const comment = await this.reviewComment(input.projectId, data);
+            const commented = comment ? { comment } : {};
             if (request.state !== 'draft')
                 return asJsonValue({
                     ready: request.state === 'ready',
                     pullRequest: { url: request.url, state: request.state },
+                    ...commented,
                     nextAction: `${request.url} is ${request.state} already; nothing was changed.`,
                 });
             if (request.provider !== 'gitlab' || !this.dependencies.gitlab)
                 return asJsonValue({
                     ready: false,
                     pullRequest: { url: request.url, state: request.state },
+                    ...commented,
                     nextAction: `Mark ${request.url} ready for review with your own tools (on GitHub, gh pr ready or the "Ready for review" button), or ask the user to, then record it with task.review_request state ready.`,
                 });
-            const readied = await this.dependencies.gitlab.requests.markReady(request);
+            const readied = await this.dependencies.gitlab.requests
+                .markReady(request)
+                .catch(async (error) => {
+                const failure = error instanceof BridgeRecoveryError ? objectValue(error.details)?.failure : undefined;
+                if (delivery.providerJob === 'make_ready' && typeof failure === 'string')
+                    await this.dependencies.client
+                        .request(endpoints.reviewProviderFailure(input.projectId, input.taskId), {
+                        method: 'POST',
+                        body: { job: 'make_ready', failure },
+                    })
+                        .catch(() => undefined);
+                throw error;
+            });
             if (readied.state !== 'ready')
                 return asJsonValue({
                     ready: false,
                     pullRequest: readied,
+                    ...commented,
                     nextAction: `GitLab still shows ${readied.url} as ${readied.state}. Ask the user to mark it ready in GitLab ("Mark as ready"); Engineering Memory follows it.`,
                 });
             const report = await this.mutateWithOutbox('task.review_request', endpoints.taskReviewRequest(input.projectId, input.taskId), { url: readied.url, state: 'ready', source: 'machine' });
-            return asJsonValue({ ready: true, pullRequest: readied, report });
+            return asJsonValue({ ready: true, pullRequest: readied, ...commented, report });
         });
     }
     async review(projectId, taskId) {
         return reviewSchema.parse((await this.dependencies.client.request(endpoints.review(projectId, taskId))).data);
     }
+    async reviewComment(projectId, data) {
+        const review = commentReviewSchema.safeParse(data);
+        const request = review.success ? review.data.delivery.reviewRequest : null;
+        const comment = review.success && request ? dueComment(review.data, (await this.language()) ?? 'en') : null;
+        if (!review.success || !request || !comment)
+            return null;
+        const taskId = review.data.delivery.taskId;
+        if (request.provider === 'gitlab' && this.dependencies.gitlab) {
+            const written = await this.dependencies.gitlab.requests.comment(projectId, taskId, request, comment);
+            if (written.posted)
+                return { posted: true };
+            return {
+                posted: false,
+                ...(written.failure ? { failure: written.failure } : {}),
+                nextAction: written.failure
+                    ? `GitLab refused the review comment on ${request.url} (${written.failure.replace(/_/g, ' ')}); a member computer with a GitLab token writes it later, and nothing waits for it.`
+                    : `No GitLab token is saved on this computer, so the review comment was not written on ${request.url}; a member computer with a GitLab token writes it later, and gitlab.token lets this computer write it too.`,
+            };
+        }
+        await markComment(this.dependencies.client, projectId, taskId, comment);
+        return {
+            posted: false,
+            body: comment.body,
+            nextAction: `Post body unchanged as a comment on ${request.url} with your own tools (on GitHub, gh pr comment with the body in a file), so the team sees the review there. It is recorded as handed over and is not handed over again.`,
+        };
+    }
     async reportDeliveryOutcome(report) {
         const path = report.outcome === 'delivered'
             ? endpoints.taskDeliveryDeliver(report.projectId, report.taskId)
@@ -6241,11 +6347,6 @@ function classifyError(error) {
     }
     return 'bridge_delivery_error';
 }
-function backendRejectsField(error, fields) {
-    return (error instanceof ApiResponseError &&
-        error.httpStatus === 400 &&
-        fields.some((field) => error.message.includes(`property ${field} should not exist`)));
-}
 function isDefinitiveAuthenticationFailure(error) {
     return (error instanceof ApiResponseError &&
         (error.httpStatus === 400 || error.httpStatus === 401 || error.httpStatus === 403));

package/runtime/dist/src/runtime/create-bridge-service.js

@@ -113,7 +113,7 @@ export function createBridgeService(options = {}) {
         gitlab: {
             tokens: gitlabTokens,
             page: new GitLabTokenPage(gitlabTokens, gitlab, signedInLanguage),
-            requests: new MergeRequests(client, gitlabTokens, gitlab, git),
+            requests: new MergeRequests(client, gitlabTokens, gitlab, git, signedInLanguage),
         },
     }));
 }

package/runtime/dist/src/runtime/live-signals.js

@@ -29,6 +29,9 @@ const kindByPrefix = [
     ['sync-start-', 'project_onboarding'],
     ['workflow-apply-', 'project_onboarding'],
     ['status-description-', 'project_onboarding'],
+    ['review-policy-', 'review_decision'],
+    ['review-reject-', 'review_decision'],
+    ['review-conclude-', 'review_decision'],
 ];
 export function liveQuestionKind(record) {
     if (record.owner?.tool === 'decision.mode')

package/runtime/dist/src/runtime/merge-request-sync.js

@@ -2,7 +2,9 @@ import { randomUUID } from 'node:crypto';
 import * as z from 'zod/v4';
 import { endpoints } from '../config.js';
 import { GitLabError, gitLabRemote, projectPath, reviewState, } from '../providers/gitlab.js';
+import { backendRejectsField } from './api-client.js';
 import { BridgeRecoveryError } from './recovery-error.js';
+import { commentReviewSchema, dueComment, markComment } from './review-comment.js';
 export const reviewDeliverySchema = z.object({
     taskId: z.string(),
     externalTaskId: z.string().nullish(),
@@ -14,6 +16,10 @@ export const reviewDeliverySchema = z.object({
     branch: z.string().nullish(),
     workItemKey: z.string().nullish(),
     reviewState: z.string().nullish(),
+    reviewCommit: z.string().nullish(),
+    reviewCommentPostedAt: z.string().nullish(),
+    providerJob: z.string().nullish(),
+    providerFailedAt: z.string().nullish(),
     reviewRequest: z
         .object({
         provider: z.string(),
@@ -23,6 +29,7 @@ export const reviewDeliverySchema = z.object({
         url: z.string(),
         state: z.string(),
         source: z.string().optional(),
+        targetBranch: z.string().nullish(),
     })
         .nullish(),
 });
@@ -54,13 +61,16 @@ export class MergeRequests {
     tokens;
     gitlab;
     git;
+    language;
     passes = new Map();
     running = new Set();
-    constructor(client, tokens, gitlab, git) {
+    readingRefused = false;
+    constructor(client, tokens, gitlab, git, language) {
         this.client = client;
         this.tokens = tokens;
         this.gitlab = gitlab;
         this.git = git;
+        this.language = language;
     }
     async open(input) {
         const delivery = reviewDeliverySchema.parse((await this.client.request(endpoints.taskDelivery(input.projectId, input.taskId)))
@@ -166,6 +176,21 @@ export class MergeRequests {
                 : 'review.make_ready', { address: at, failure: error.failure, status: error.status });
         }
     }
+    async comment(projectId, taskId, request, comment) {
+        const link = await this.tokens.forLink(request.host, request.repository);
+        const token = link ? await this.tokens.token(link.address) : null;
+        if (!link || !token)
+            return { posted: false };
+        try {
+            await this.post(projectId, taskId, { address: link.address, token, project: link.project, number: request.number }, comment);
+            return { posted: true };
+        }
+        catch (error) {
+            if (!(error instanceof GitLabError))
+                throw error;
+            return { posted: false, failure: error.failure };
+        }
+    }
     schedule(projectId, repoRoot, deliveries) {
         const now = Date.now();
         const last = this.passes.get(projectId);
@@ -192,8 +217,17 @@ export class MergeRequests {
         const worker = async () => {
             for (let delivery = queue.shift(); delivery && pass.calls > 0; delivery = queue.shift()) {
                 const found = await this.follow(delivery, repoRoot, pass).catch(() => null);
-                if (found && (await this.report(projectId, delivery.taskId, found)))
+                if (!found)
+                    continue;
+                let job = delivery.providerJob ?? null;
+                if (this.changed(delivery, found)) {
+                    const answer = await this.report(projectId, delivery.taskId, found);
+                    if (!answer)
+                        continue;
                     reported++;
+                    job = answer.providerJob;
+                }
+                await this.provide(projectId, delivery, found, job, pass).catch(() => undefined);
             }
         };
         await Promise.all([worker(), worker(), worker(), worker()]);
@@ -209,10 +243,9 @@ export class MergeRequests {
             if (!link || !token)
                 return null;
             const request = await this.call(pass, link.address, () => this.gitlab.mergeRequest(link.address, token, link.project, known.number));
-            if (!request)
-                return null;
-            const state = reviewState(request);
-            return state !== known.state || known.source !== 'machine' ? { url: known.url, state } : null;
+            return request
+                ? { url: known.url, request, address: link.address, token, project: link.project }
+                : null;
         }
         if (!repoRoot || !delivery.branch)
             return null;
@@ -242,7 +275,78 @@ export class MergeRequests {
             .sort((left, right) => rank(left) - rank(right) ||
             Number(right.sha === delivery.deliveredCommit) -
                 Number(left.sha === delivery.deliveredCommit))[0];
-        return chosen ? { url: chosen.web_url, state: reviewState(chosen) } : null;
+        return chosen ? { url: chosen.web_url, request: chosen, address, token, project: path } : null;
+    }
+    changed(delivery, found) {
+        const known = delivery.reviewRequest;
+        const head = found.request.sha;
+        return (!known ||
+            reviewState(found.request) !== known.state ||
+            known.source !== 'machine' ||
+            (known.targetBranch !== undefined && found.request.target_branch !== known.targetBranch) ||
+            (!this.readingRefused &&
+                delivery.reviewState === 'passed' &&
+                !!head &&
+                !!delivery.reviewCommit &&
+                head !== delivery.reviewCommit));
+    }
+    async provide(projectId, delivery, found, job, pass) {
+        const state = reviewState(found.request);
+        const failedAt = job === (delivery.providerJob ?? null) ? delivery.providerFailedAt : null;
+        if ((state !== 'draft' && state !== 'ready') ||
+            (failedAt && Date.now() - Date.parse(failedAt) < 30 * 60 * 1000) ||
+            pass.failed.has(found.address) ||
+            pass.calls < 3)
+            return;
+        if (delivery.reviewState === 'findings_open' ||
+            (concludedReview.includes(delivery.reviewState ?? '') &&
+                delivery.reviewCommentPostedAt === null)) {
+            const review = commentReviewSchema.safeParse((await this.client
+                .request(endpoints.review(projectId, delivery.taskId))
+                .catch(() => null))?.data);
+            const comment = review.success
+                ? dueComment(review.data, (await this.language()) ?? 'en')
+                : null;
+            if (comment)
+                await this.post(projectId, delivery.taskId, { ...found, number: found.request.iid }, comment, pass).catch(() => undefined);
+        }
+        const due = (job === 'make_ready' && state === 'draft') || (job === 'make_draft' && state === 'ready')
+            ? job
+            : null;
+        if (!due)
+            return;
+        try {
+            pass.calls--;
+            const title = found.request.title;
+            if (title === undefined)
+                throw new GitLabError('unexpected_answer', found.address, null, null);
+            const after = await this.gitlab.retitleMergeRequest(found.address, found.token, found.project, found.request.iid, due === 'make_ready'
+                ? title.replace(draftPrefix, '') || defaultTitle(found.request.source_branch, null)
+                : `Draft: ${title}`.slice(0, 255));
+            await this.report(projectId, delivery.taskId, { ...found, request: after });
+        }
+        catch (error) {
+            if (!(error instanceof GitLabError))
+                return;
+            pass.failed.add(found.address);
+            await this.client
+                .request(endpoints.reviewProviderFailure(projectId, delivery.taskId), {
+                method: 'POST',
+                body: { job: due, failure: error.failure },
+            })
+                .catch(() => undefined);
+        }
+    }
+    async post(projectId, taskId, target, comment, pass) {
+        if (pass)
+            pass.calls--;
+        const notes = await this.gitlab.notes(target.address, target.token, target.project, target.number);
+        if (!notes.some((note) => note.body.includes(comment.marker))) {
+            if (pass)
+                pass.calls--;
+            await this.gitlab.createNote(target.address, target.token, target.project, target.number, comment.body);
+        }
+        await markComment(this.client, projectId, taskId, comment);
     }
     async call(pass, address, request) {
         if (pass.failed.has(address) || pass.calls <= 0)
@@ -259,16 +363,28 @@ export class MergeRequests {
         }
     }
     async report(projectId, taskId, found) {
+        const body = { url: found.url, state: reviewState(found.request), source: 'machine' };
+        const reading = {
+            ...(found.request.sha ? { headCommit: found.request.sha } : {}),
+            targetBranch: found.request.target_branch,
+        };
+        const send = () => this.client.request(endpoints.taskReviewRequest(projectId, taskId), {
+            method: 'POST',
+            body: this.readingRefused ? body : { ...body, ...reading },
+            idempotencyKey: randomUUID(),
+        });
         try {
-            await this.client.request(endpoints.taskReviewRequest(projectId, taskId), {
-                method: 'POST',
-                body: { url: found.url, state: found.state, source: 'machine' },
-                idempotencyKey: randomUUID(),
+            const response = await send().catch(async (error) => {
+                if (this.readingRefused || !backendRejectsField(error, ['headCommit', 'targetBranch']))
+                    throw error;
+                this.readingRefused = true;
+                return send();
             });
-            return true;
+            const answer = z.object({ providerJob: z.string().nullish() }).safeParse(response.data);
+            return { providerJob: answer.success ? (answer.data.providerJob ?? null) : null };
         }
         catch {
-            return false;
+            return null;
         }
     }
 }

package/runtime/dist/src/runtime/review-comment.js

@@ -0,0 +1,135 @@
+import * as z from 'zod/v4';
+import { endpoints } from '../config.js';
+import { concludedReview } from './merge-request-sync.js';
+import { copies, format } from './texts.js';
+const text = z.string().min(1);
+const commentWording = z.strictObject({
+    round: text,
+    passed: text,
+    skipped: text,
+    exempted: text,
+    findingsOf: text,
+    rule: text,
+    open: text,
+    fixed: text,
+    rejected: text,
+});
+export const commentReviewSchema = z.object({
+    delivery: z.object({
+        id: z.string(),
+        taskId: z.string(),
+        externalTaskId: z.string(),
+        workItemKey: z.string().nullish(),
+        reviewState: z.string().nullish(),
+        reviewChangedAt: z.string().nullish(),
+        reviewExemptionReason: z.string().nullish(),
+        reviewCommentPostedAt: z.string().nullish(),
+        reviewRequest: z
+            .object({
+            provider: z.string(),
+            host: z.string(),
+            repository: z.string(),
+            number: z.number().int().positive(),
+            url: z.string(),
+            state: z.string(),
+        })
+            .nullish(),
+    }),
+    rounds: z.array(z.object({
+        id: z.string(),
+        number: z.number().int(),
+        state: z.string(),
+        commentPostedAt: z.string().nullish(),
+    })),
+    totalRounds: z.number().int().optional(),
+    findings: z.array(z.object({
+        position: z.number().int(),
+        path: z.string(),
+        line: z.number().int().nullish(),
+        ruleKey: z.string().nullish(),
+        description: z.string(),
+        resolution: z.string(),
+        rejectionReason: z.string().nullish(),
+        fixedCommit: z.string().nullish(),
+    })),
+});
+export function dueComment(review, language) {
+    const { delivery, findings } = review;
+    const { copy, language: shown } = copies(commentWording, 'reviewComment', language)[0];
+    const task = delivery.workItemKey ?? delivery.externalTaskId;
+    const where = (finding) => '`' + (finding.path + (finding.line ? `:${finding.line}` : '')).replace(/`/g, '') + '`';
+    const latest = review.rounds.find((round) => round.state === 'submitted');
+    if (delivery.reviewState === 'findings_open' &&
+        latest?.commentPostedAt === null &&
+        findings.length) {
+        const marker = `<!-- engineering-memory review-round ${latest.id} -->`;
+        const lines = findings.map((finding) => `${finding.position}. ${where(finding)}` +
+            (finding.ruleKey
+                ? ` (${format(copy.rule, shown, { rule: oneLine(finding.ruleKey) })})`
+                : '') +
+            `: ${oneLine(finding.description)}`);
+        return {
+            kind: 'round',
+            roundId: latest.id,
+            marker,
+            body: [
+                marker,
+                `**${format(copy.round, shown, { task, round: latest.number, count: findings.length })}**`,
+                '',
+                ...lines,
+            ].join('\n'),
+        };
+    }
+    const outcome = delivery.reviewState;
+    if (!outcome ||
+        !concludedReview.includes(outcome) ||
+        !delivery.reviewChangedAt ||
+        delivery.reviewCommentPostedAt !== null ||
+        !['draft', 'ready'].includes(delivery.reviewRequest?.state ?? ''))
+        return null;
+    const marker = `<!-- engineering-memory review-conclusion ${delivery.id} ${delivery.reviewChangedAt} -->`;
+    const title = outcome === 'passed'
+        ? format(copy.passed, shown, { task, rounds: review.totalRounds ?? review.rounds.length })
+        : outcome === 'skipped'
+            ? format(copy.skipped, shown, { task })
+            : format(copy.exempted, shown, {
+                task,
+                reason: oneLine(delivery.reviewExemptionReason ?? ''),
+            });
+    const status = (finding) => finding.resolution === 'fixed'
+        ? format(copy.fixed, shown, { commit: (finding.fixedCommit ?? '').slice(0, 12) })
+        : finding.resolution === 'rejected'
+            ? format(copy.rejected, shown, { reason: oneLine(finding.rejectionReason ?? '') })
+            : copy.open;
+    return {
+        kind: 'conclusion',
+        concludedAt: delivery.reviewChangedAt,
+        marker,
+        body: [
+            marker,
+            `**${title}**`,
+            ...(findings.length && latest
+                ? [
+                    '',
+                    format(copy.findingsOf, shown, { round: latest.number }),
+                    ...findings.map((finding) => `${finding.position}. ${where(finding)}: ${status(finding)}`),
+                ]
+                : []),
+        ].join('\n'),
+    };
+}
+export async function markComment(client, projectId, taskId, comment) {
+    await client
+        .request(comment.kind === 'round'
+        ? endpoints.reviewRoundComment(projectId, comment.roundId)
+        : endpoints.reviewComment(projectId, taskId), {
+        method: 'POST',
+        ...(comment.kind === 'conclusion' ? { body: { concludedAt: comment.concludedAt } } : {}),
+    })
+        .catch(() => undefined);
+}
+function oneLine(value) {
+    const line = value.replace(/\s+/g, ' ').trim();
+    return (line.length > 1500 ? `${line.slice(0, 1499)}…` : line).replace(/@/g, '@​');
+}
+//# sourceMappingURL=review-comment.js.map

package/skill/references/lifecycle.md

@@ -304,12 +304,14 @@ When the user later says a pull request became ready, was merged or was closed,
 
 A project can review code before a pull request is ready: `project.review_policy` reads its setting — none, optional or required — and, only when the user asks to change it, `change: true` asks them in one native form; only an owner or maintainer can change it. Under optional the delivery question offers a pull request reviewed first, which opens as a draft, and one without review; under required only the reviewed one. A user's own instruction for a ready pull request under required becomes the reviewed one, and the tool says so; relay it. When the tool says the setting changed while the question was open, tell the user and call it again.
 
-After a reviewed pull request is pushed and the worktree released, open it as a draft (`task.open_review_request`, or your own tools and `task.review_request` with `draft`), then call `review.start` in a clone of the project. It fetches the pushed branch without checking anything out and returns the review packet. Give the packet to a fresh subagent that did not write the change; only when your host cannot start one, review it yourself under the same rules. The reviewer reads the change only through the read-only Git commands the packet lists: it never checks out, switches branches, edits, commits, pushes or changes a file. It judges the change against the packet's records (more with `review.rules`) and says whether each earlier finding still holds. Each finding names the file by its path in the repository, the line in the reviewed commit when there is one, the key of the record it breaks when one applies, and what is wrong and why in plain words. Record the result with `review.submit`, an empty list when there are no findings. Describe a problem without the value itself: e-mail addresses, IP addresses and user folders are masked, and a description that still looks like it holds a secret or personal data is refused.
+After a reviewed pull request is pushed and the worktree released, open it as a draft (`task.open_review_request`, or your own tools and `task.review_request` with `draft`), then call `review.start` in a clone of the project. It fetches the pushed branch without checking anything out and returns the review packet. Give the packet to a fresh subagent that did not write the change; only when your host cannot start one, review it yourself under the same rules. The reviewer reads the change only through the read-only Git commands the packet lists: it never checks out, switches branches, edits, commits, pushes or changes a file. It judges the change against the packet's records (more with `review.rules`) and says whether each earlier finding still holds; from the second round on it starts from `sinceLastRound`, what changed since the previous round. Each finding names the file by its path in the repository, the line in the reviewed commit when there is one, the key of the record it breaks when one applies, and what is wrong and why in plain words. Record the result with `review.submit`, an empty list when there are no findings. Describe a problem without the value itself: e-mail addresses, IP addresses and user folders are masked, and a description that still looks like it holds a secret or personal data is refused.
 
 Show the findings to the user and ask whether to fix them. A fix is a write task: `task.branch` with `reviewFixOf` set to the reviewed task's id, then `session.bootstrap` with the same `reviewFixOf`; it continues the pull request's branch, and its delivery offers commit or commit and push onto that branch — never a second pull request. After its push the open findings are marked fixed; ask whether to review again (`review.start`) or end the review (`review.conclude` with passed). A finding the user disagrees with is rejected with `review.reject_finding`, where the user writes the reason in the form; never write it for them. `review.conclude` also skips a review where the setting is not required, and exempts one under required, which only an owner or maintainer can do and only with the reason the user writes. Every one of these asks the user in a native form first.
 
 Once a review has ended, call `review.make_ready`: on GitLab, with the user's own token saved, it removes Draft and records the pull request ready; anywhere else follow its `nextAction` (for example `gh pr ready`) and record the state with `task.review_request`. It also makes ready, when the user asks, a pull request that has no code review. Never mark a draft ready while its review has not ended. `session.entry` lists as `awaitingReviews` the deliveries that wait for code review; mention them in one line and start nothing on your own. When the user asks, `review.queue` and `review.get` read them, and every member except readers can continue any review where it stopped.
 
+The review is written on the pull request as comments: the findings of each round and the conclusion. On GitLab the bridge writes them with the user's saved token; when a result of `review.submit`, `review.reject_finding`, `review.conclude` or `review.make_ready` carries `comment.body`, post that body unchanged as a comment with your own tools (on GitHub, `gh pr comment` with the body in a file) — it is recorded as handed over and not handed over again. When you record a pull request with `task.review_request`, pass `headCommit` and `targetBranch` when you can read them (on GitHub, `gh pr view --json headRefOid,baseRefName`): a review that had passed waits again when its pull request gets a new commit or a new target branch, and the answer says so; tell the user in one line, and do not pass it again without a round — `review.start` runs the next one, and skipping or exempting still asks the user. An `awaitingReviews` entry shows `reopened`, `readyBeforeReview` and `pullRequestChange`: a make-ready or make-draft that a member computer with a GitLab token does in the background, with its last failure. Mention a failure in one line; on GitHub, when the answer asks for a draft again, make it a draft with your own tools (`gh pr ready --undo`) and record it with `task.review_request`.
+
 ## Code source and memory applicability
 
 The bridge sends the checkout's committed Git commit and tree at bootstrap. Task and session