fv-skills-baif 2.3.0 → 2.3.1

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to FVS (Formal Verification Skills) will be documented in th
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [2.3.1] - 2026-09-09
+
+### Added
+- Crypto plan and follow-up review now support selected Codex, Claude, or external reviewers with
+  explicit model/effort choices, read-only execution, honest provenance, immutable hash-bound
+  packets, and a three-round author/reviewer loop. Automatic handoff stays interactive, while
+  one-run Skip and `crypto_review.automatic: false` retain an explicit unreviewed trusted path.
+  This resolves
+  [GitHub issue #51](https://github.com/Beneficial-AI-Foundation/formal-verification-skills/issues/51).
+
+### Changed
+- Crypto and functional-correctness review now treat `APPROVE-WITH-EDITS` as terminal once the
+  authoring seat applies the exhaustively named bounded edits and reruns its gates. Reviewer output
+  remains immutable; only true `REJECT`, `REVISE`, or `BLOCKED` verdicts start a fresh review.
+  This resolves
+  [GitHub issue #52](https://github.com/Beneficial-AI-Foundation/formal-verification-skills/issues/52).
+
 ## [2.3.0] - 2026-09-07
 
 ### Added

package/README.md

@@ -172,10 +172,17 @@ Commands are grouped into five bundles. Each bundle has a **router** command tha
 rejects ordinary Lean identifiers with three or more namespace dots, steering generated code
 toward scoped namespaces, `open`, and local names.
 
-After `lean-specify`, a review menu offers the other runtime first, a fresh reviewer in the current
-runtime, or another provider. Choose GPT Sol or Astra for Codex, Fable for Claude, or a cheaper/custom
-model; effort defaults to `max` and can be lowered. Other providers use an exported source packet
-and imported response. Reviews and source hashes live under `.formalising/spec-reviews/`.
+After `lean-specify`, an interactive review menu asks reviewer, then model, then effort; it never
+auto-selects a choice. It offers the other runtime first, a fresh reviewer in the current runtime,
+or another provider. Choose GPT Sol or Astra for Codex, Fable for Claude, or a cheaper/custom model;
+effort defaults to `max` and can be lowered. Other providers use an exported source packet and
+imported response. One-run `Skip review` records `Unreviewed (user skipped)` and does not begin
+proof work. Reviews and source hashes live under `.formalising/spec-reviews/`.
+
+The reviewer stays read-only and `review.md` stays immutable. The `lean-specify` authoring seat
+writes separate `triage.md`. PASS proceeds; APPROVE-WITH-EDITS also proceeds after accepted bounded
+edits pass the structure/style/build gates, with no redundant second review. Only REVISE/BLOCKED
+starts another fresh review, carrying prior records as untrusted history, with a three-round cap.
 
 Automatic review works even without a config file. To disable the automatic menu, merge this
 setting into `.formalising/fvs-config.json` (or create that file with just this object):
@@ -216,7 +223,7 @@ secrets, raw transcripts, ephemeral error dumps, unsupported guesses, or inferre
 | `/fvs:lean-formalise` | Formalise paper/math content into Lean 4 specs and definitions (one-shot) |
 | `/fvs:lean-refactor` | Refactor, simplify, and decompose verified proofs — *also in Formal-Core* |
 | `/fvs:crypto-plan` | Author the next bounded, runtime-neutral plan for a topic-based crypto formalisation iteration (KB-grounded, cached under `sources/`) |
-| `/fvs:crypto-review` | Send an initial or follow-up crypto plan to authenticated Codex for independent, read-only adversarial review before execution |
+| `/fvs:crypto-review` | Review a crypto plan with selected Codex, Claude, or Other runtime/model/effort |
 | `/fvs:crypto-execute` | Run the current iteration's bounded plan under the green-build guard |
 | `/fvs:crypto-eval` | Adversarially evaluate the iteration; ends in one of ACCEPT / FOLLOWUP / HUMAN_RULING / BLOCKED |
 | `/fvs:crypto-followup` | Convert eval findings into the next follow-up plan; HALTs on HUMAN_RULING |
@@ -274,12 +281,12 @@ The paper track formalises papers directly into Lean 4 — no Rust, no Aeneas. T
 
 - **One-shot:** `/fvs:lean-formalise` reads your PDFs / images / LaTeX (optionally grounded in a NotebookLM knowledge base via `/fvs:kb-setup`) and produces Lean definition and spec files in a single pass.
 - **Iterative crypto loop:** for larger crypto formalisations, a topic-based, restartable loop with
-  an independent pre-execution review gate:
+  a fresh pre-execution review gate:
 
   `/fvs:crypto-plan` → `/fvs:crypto-review` → `/fvs:crypto-execute` → `/fvs:crypto-eval` → `/fvs:crypto-followup` → `/fvs:crypto-review` → repeat
 
-  A high-effort thinker authors each bounded plan. Before execution, authenticated Codex
-  independently attacks the plan or follow-up under a read-only sandbox and returns an
+  A high-effort thinker authors each bounded plan. Before execution, a selected Codex, Claude, or
+  Other fresh reviewer attacks the plan or follow-up under read-only controls and returns an
   evidence-backed APPROVE / APPROVE-WITH-EDITS / REJECT verdict. The executor runs an approved plan
   under a green-build guard; the post-execution adversarial eval tries to refute the spec, proof,
   and assumptions and ends in exactly one of ACCEPT / FOLLOWUP / HUMAN_RULING / BLOCKED. Follow-up
@@ -289,8 +296,15 @@ The paper track formalises papers directly into Lean 4 — no Rust, no Aeneas. T
   The authoring, execution, eval, and follow-up stages use the lightweight proof-engineering overlay:
   they load at most eight relevant `crypto`/`shared` lessons and propose at most three reviewed
   updates. Modeling lessons require paper or standard citations and remain provisional until an
-  accepted adversarial eval or explicit human ruling. The independent `crypto-review` gate is
-  deliberately memory-blind, so inherited lessons cannot frame the second-runtime critique.
+  accepted adversarial eval or explicit human ruling. The `crypto-review` gate is deliberately
+  memory-blind. It labels cross-runtime, same-runtime fresh reviewer, and unverified provenance;
+  Other uses packet export/import. APPROVE-WITH-EDITS becomes terminal after the authoring seat
+  applies accepted edits and reruns gates, with no second review. REJECT starts a fresh reviewed
+  revision with prior history, capped at three reviewer rounds per invocation. Automatic plan and
+  follow-up handoff asks reviewer -> model -> effort and never auto-selects. One-run `Skip review`
+  records `Unreviewed (user skipped)` and never starts execution. To opt out persistently, merge
+  `"crypto_review": {"automatic": false}` into `.formalising/fvs-config.json`; standalone review
+  and explicit trusted-path execution remain available without fabricating approval.
 
   **Single- vs dual-runtime (`--codex`).** By default the loop is single-runtime — the thinking stages (`crypto-plan`, `crypto-eval`, `crypto-followup`) run the in-runtime `fvs-crypto-thinker`. Pass `--codex` to hand a stage's thinking to an independent **Codex CLI** thinker instead, so the adversarial planner/evaluator runs on a *different engine* than the executor and blind spots don't correlate. `crypto-execute` is the runtime-neutral executor and takes no `--codex`. Without the Codex CLI installed, a `--codex` stage stops with an install hint rather than silently falling back.
 

package/commands/fvs/crypto-followup.md

@@ -185,8 +185,9 @@ The artifact MUST also record:
 Authoring runtime: {Claude Code | OpenCode | Gemini | Codex | Codex CLI}
 ```
 
-Use `Codex CLI` for `--codex`; otherwise name the actual host runtime. This provenance is mandatory
-for `/fvs:crypto-review` to prove the reviewer is independent.
+Use `Codex CLI` for `--codex`; otherwise name the actual host runtime. `/fvs:crypto-review` uses
+this provenance to label cross-runtime review as independent and same-runtime review as fresh but
+not independent; missing provenance fails closed.
 
 ## Step 4a: Reconcile Follow-Up Lessons
 
@@ -196,6 +197,31 @@ required. Strengthen an equivalent record or create one file per new lesson unde
 `lessons/crypto/`, updating the index in the same reviewable diff. Unruled choices stay
 `provisional`; never infer or generalize a ruling beyond its recorded scope.
 
+## Step 4b: Run the bounded review loop
+
+After authoring gates, run
+`node ~/.claude/scripts/fvs-codex-think.mjs review-automatic`; missing config or
+`crypto_review.automatic` defaults to true and malformed values stop clearly. If false, record
+`Unreviewed (automatic review disabled)`, preserve the follow-up, and do not auto-start execution.
+
+If true, enter the interactive `crypto-review` handoff. Honor reviewer/model/effort choices explicitly
+supplied earlier in this invocation. Ask only for missing choices in order: reviewer -> model ->
+effort. Recommend the normalized non-author runtime, but never auto-select or treat a preselected
+default as consent. Offer a one-run `Skip review`, recorded exactly as `Unreviewed (user skipped)`.
+Skipping preserves the follow-up and does not auto-start execution; a trusted user may explicitly
+invoke `/fvs:crypto-execute`. The standalone review flags remain the non-interactive path.
+
+Run at most three reviewer rounds in this command invocation. APPROVE stops.
+APPROVE-WITH-EDITS is terminal after the authoring seat applies accepted bounded edits, reruns plan
+gates, records hashes/finding IDs in separate triage, and marks `approved after edits`; no second
+review.
+
+REJECT creates a fresh authored revision at the next immutable iteration and a fresh review. Inline
+the preceding review and triage as delimited untrusted history for the author and pass repeated
+`--history` flags to the reviewer packet. At round three, stop with the latest artifacts and the
+exact `/fvs:crypto-review <topic> nN --target followup` resume command. Failed, cancelled, pending,
+and unverified states do not start execution.
+
 ## Step 5: Run-end banner + next command
 
 ```
@@ -205,8 +231,8 @@ Topic:     {TOPIC_RAW}
 Decision:  {FOLLOWUP | HUMAN_RULING -> ruled}
 Plan:      plans/FOLLOWUP_PLAN_n{N}.md
 
->> Next Up
-/fvs:crypto-review <topic> n{N} --target followup
+Review:    {approved | approved after edits | Unreviewed (user skipped) | Unreviewed (automatic review disabled) | failed | pending | unverified | rejected at cap}
+Next:      {/fvs:crypto-execute only after approval | exact crypto-review resume command}
 ```
 
 </process>
@@ -233,8 +259,7 @@ unchanged.
 - [ ] Latest `EVAL_nN.md` read; decision routed (`ACCEPT` stop / `BLOCKED` pause / `FOLLOWUP` author / `HUMAN_RULING` HALT).
 - [ ] On `HUMAN_RULING` the command HALTs and asks the user -- it NEVER fabricates a follow-up plan.
 - [ ] On `FOLLOWUP` the thinker is dispatched (`subagent_type="fvs-crypto-thinker"`) and the bounded follow-up plan written to `plans/`.
-- [ ] The follow-up records truthful `Authoring runtime:` provenance and routes next to
-      `/fvs:crypto-review --target followup`.
+- [ ] The follow-up records truthful provenance and runs at most three review rounds before stop.
 - [ ] At most three source/ruling-evidenced candidates reconciled as one file each plus index updates.
 - [ ] No bare `lake build`, no `gh` open/create, no generated-Lean write.
 </success_criteria>

package/commands/fvs/crypto-plan.md

@@ -205,8 +205,8 @@ Authoring runtime: {Claude Code | OpenCode | Gemini | Codex | Codex CLI}
 ```
 
 Use `Codex CLI` when `--codex` authored the plan; otherwise name the actual host runtime. Never
-write a generic or guessed marker. `/fvs:crypto-review` uses it to prevent Codex self-review and
-fails closed when provenance is missing.
+write a generic or guessed marker. `/fvs:crypto-review` uses it to label cross-runtime review as
+independent and same-runtime review as fresh but not independent; missing provenance fails closed.
 
 Carry the BOUNDED-PLAN CONTRACT verbatim into `EXEC_PLAN_nN.md`:
 1. **Branch and current state** -- the branch name and what already compiles / is proven.
@@ -229,6 +229,38 @@ accepted adversarial eval or explicit human ruling validates them. Strengthen an
 or create one `lessons/crypto/<date>-<slug>.md` file per new lesson and update the index in the same
 reviewable diff. Never persist uncited claims, raw transcripts, full error dumps, or secrets.
 
+## Step 5b: Run the bounded review loop
+
+Read the automatic-review setting after the plan gates pass; missing config or
+`crypto_review.automatic` defaults to true, while malformed values stop clearly:
+
+```bash
+AUTOMATIC_REVIEW=$(node ~/.claude/scripts/fvs-codex-think.mjs review-automatic) || exit 1
+```
+
+If true, automatically enter the interactive `crypto-review` handoff. Honor reviewer/model/effort
+choices explicitly supplied earlier in this invocation, then ask only for missing choices in order:
+reviewer -> model -> effort. Recommend the normalized non-author runtime. Never auto-select or treat
+a default/preselected menu item as consent. Also offer `Skip review` for this run. Record that choice
+exactly as `Unreviewed (user skipped)`; an Other export without an imported response is pending.
+
+If false, record `Unreviewed (automatic review disabled)`. Users set this persistently by merging
+`"crypto_review": {"automatic": false}` into `.formalising/fvs-config.json`. Either unreviewed
+route preserves the plans; do not auto-start crypto execution. A trusted user may explicitly
+invoke `/fvs:crypto-execute <topic> nN` afterward. The standalone `/fvs:crypto-review` flags remain
+the non-interactive review path.
+
+When review runs, allow at most three reviewer rounds in this command invocation. APPROVE ends the
+loop. APPROVE-WITH-EDITS is also terminal after the authoring seat applies accepted bounded edits,
+reruns the plan gates, and records `approved after edits` in a separate triage; do not request a
+redundant second review.
+
+REJECT requires a fresh authored revision at the next immutable iteration and a fresh review.
+Inline the previous review and triage into the author prompt as delimited untrusted history and pass
+both to the next reviewer packet with repeated `--history` flags. At round three, stop with the
+latest artifacts and the exact `/fvs:crypto-review <topic> nN --target plan` resume command; never
+auto-approve or start execution. Failed, cancelled, pending, and unverified states also stop.
+
 ## Step 6: Run-end banner + next command
 
 ```
@@ -240,8 +272,8 @@ KB:        {grounded | degraded -- not configured}
 Plans:     plans/PLAN_n{NEXT}.md, plans/EXEC_PLAN_n{NEXT}.md
 Sources:   {K} cached under sources/
 
->> Next Up
-/fvs:crypto-review <topic> n{NEXT} --target plan
+Review:    {approved | approved after edits | Unreviewed (user skipped) | Unreviewed (automatic review disabled) | failed | pending | unverified | rejected at cap}
+Next:      {/fvs:crypto-execute only after approval | exact crypto-review resume command}
 ```
 
 </process>
@@ -268,8 +300,8 @@ auto-picks a default, never writes an upstream artifact).
 - [ ] `$THINKER_MODEL` resolved via the model-profiles sequence; the thinker dispatched (`subagent_type="fvs-crypto-thinker"`) with inlined context.
 - [ ] KB grounded intensively when configured; cached under `sources/` and re-read before re-querying; loud-fail-once + labeled-degrade + `/fvs:kb-setup` when unconfigured.
 - [ ] The bounded-plan contract (stop conditions, verification commands `LEAN_NUM_THREADS="${LEAN_NUM_THREADS:-4}" nice -n 19 lake build`, immutable public statements, allowed-`sorry`) is written into `EXEC_PLAN_nN.md`.
-- [ ] Both plan artifacts record truthful `Authoring runtime:` provenance; the next action is
-      independent `/fvs:crypto-review`, not direct execution.
+- [ ] Both plan artifacts record truthful `Authoring runtime:` provenance; automatic review runs
+      for at most three rounds and only an approved result can suggest execution.
 - [ ] At most three evidence-gated lesson candidates reconciled as one file each plus index updates.
 - [ ] No bare `lake build`, no `gh` open/create, no generated-Lean write.
 </success_criteria>

package/commands/fvs/crypto-review.md

@@ -1,7 +1,7 @@
 ---
 name: fvs:crypto-review
-description: Send an initial or follow-up crypto plan to authenticated Codex for independent adversarial review
-argument-hint: "<topic> [nN] [--target plan|followup]"
+description: Adversarially review a crypto plan with a chosen runtime, model, and effort
+argument-hint: "<topic> [nN] [--target plan|followup] [--reviewer codex|claude|other] [--model ID] [--effort LEVEL]"
 allowed-tools:
   - Read
   - Bash
@@ -9,20 +9,14 @@ allowed-tools:
   - Grep
   - Write
   - Edit
+  - AskUserQuestion
+  - Task
 ---
 
 <objective>
-Put an FVS crypto plan through an independent, pre-execution adversarial review by the Codex CLI.
-Review either the initial `PLAN_nN.md` + `EXEC_PLAN_nN.md` pair or a
-`FOLLOWUP_PLAN_nN.md`, persist exactly one reviewer artifact under `reviews/`, then have the
-primary planning seat verify and triage every finding.
-
-This is not the post-execution `/fvs:crypto-eval` stage. It attacks the PLAN before an executor
-spends effort. Codex is the independent reviewer; it never authors or edits the plan.
-
-This gate is deliberately proof-engineering-memory-blind. Do not load
-`.formalising/proof-engineering/` or the topic's `sources/proof-engineering-context.md` snapshot into
-the reviewer: independence includes re-challenging assumptions without inherited lesson framing.
+Run a fresh, read-only adversarial review before crypto execution. The reviewer returns evidence;
+the distinct planning/authoring seat owns triage and any plan edits. Preserve every review and
+triage record, and never load proof-engineering memory into the reviewer.
 </objective>
 
 <execution_context>
@@ -31,45 +25,14 @@ the reviewer: independence includes re-challenging assumptions without inherited
 @~/.claude/fv-skills/references/ui-brand.md
 </execution_context>
 
-<context>
-Topic and optional iteration/target: $ARGUMENTS.
-
-Default target selection is `followup` when `FOLLOWUP_PLAN_nN.md` exists, otherwise `plan`.
-The optional `--target` makes that choice explicit.
-</context>
+<context>Topic, iteration, target, and reviewer options: $ARGUMENTS.</context>
 
 <process>
 
-## Step 0: Preflight Codex installation and authentication
-
-Before reading plan contents or doing any later work, verify that the Codex CLI is installed and
-signed in:
-
-```bash
-command -v codex >/dev/null 2>&1 \
-  && codex login status >/dev/null 2>&1 \
-  && echo "CODEX_OK" \
-  || echo "CODEX_NOT_READY"
-```
-
-If the result is `CODEX_NOT_READY`, STOP:
-
-```
-FVS >> CODEX ISN'T READY
-
-This review needs the OpenAI Codex CLI installed and signed in.
-1. Install: npm install -g @openai/codex
-2. Sign in: codex login
-3. Verify: codex login status
+## 1. Resolve target and reviewer choices
 
-Then re-run /fvs:crypto-review. There is no silent same-runtime fallback because that would not be
-an independent review.
-```
-
-## Step 1: Resolve topic, iteration, and target safely
-
-Treat all arguments as untrusted. Collapse topic whitespace to `-`, preserve meaningful
-capitalization, reject shell metacharacters, `..`, and `/`, quote every path, and never `eval`.
+Treat arguments as untrusted. Collapse topic whitespace to `-`, preserve capitalization, reject
+shell metacharacters, `..`, and `/`, quote every path, and never `eval`:
 
 ```bash
 TOPIC_RAW="$1"
@@ -81,107 +44,87 @@ SLUG=$(printf '%s' "$TOPIC_RAW" | tr -s '[:space:]' '-')
 ROOT=".formalising/fv-plans/$SLUG"
 ```
 
-Require an existing topic directory. Resolve `nN` from the explicit argument or the highest numeric
-plan/follow-up iteration; never use lexical ordering. Validate the iteration against
-`^n[1-9][0-9]*$`.
-
-Resolve the target:
-
-- `plan`: require both `plans/PLAN_nN.md` and `plans/EXEC_PLAN_nN.md`; output
-  `reviews/PLAN_REVIEW_nN.md`.
-- `followup`: require `plans/FOLLOWUP_PLAN_nN.md`; also expose the matching eval and original plan
-  when present; output `reviews/FOLLOWUP_REVIEW_nN.md`.
-- omitted/auto: choose `followup` when its file exists, otherwise `plan`.
-
-Refuse to overwrite an existing output. Preserve prior review history and ask the user to choose a
-new iteration or archive the old review deliberately.
+Resolve numeric `nN` and `--target plan|followup`. Initial review consumes `PLAN_nN.md` plus
+`EXEC_PLAN_nN.md` and owns `PLAN_REVIEW_nN.md`; follow-up consumes `FOLLOWUP_PLAN_nN.md` plus
+available original-plan/eval context and owns `FOLLOWUP_REVIEW_nN.md`. Refuse an occupied output.
 
-## Step 2: Enforce independent-review provenance
+Normalize the target's `Authoring runtime:` marker to `codex`, `claude`, `other`, or `unknown`.
+Missing, foreign, or conflicting markers are `unverified`; they do not block review, but never
+claim independence. Label a different known runtime `cross-runtime`, an explicitly selected
+matching runtime `same-runtime, fresh reviewer`, and Other `unverified`.
 
-This command is Codex-as-second-runtime. Read the target artifact's `Authoring runtime:` marker.
-If it says `Codex CLI`, STOP: Codex cannot independently review a plan it authored. If the marker is
-missing, report that provenance is unverified and STOP rather than falsely claiming independence.
+Honor explicit `--reviewer`, `--model`, and `--effort`. Ask only for missing choices in exactly
+this order: reviewer -> model -> effort. Supplying all three flags is the standalone
+non-interactive path; never replace an explicit choice.
 
-`crypto-plan` and `crypto-followup` write this marker for new artifacts. A legacy plan can be
-reviewed after its authoring runtime is recorded truthfully in the artifact.
+1. Reviewer: recommend the normalized non-author runtime first. Offer `Codex`, `Claude`, and
+   `Other`; a same-runtime choice is opt-in.
+2. Model: Codex offers `gpt-5.6-sol` then `gpt-6-astra` and custom; Claude offers `fable` then
+   `sonnet` and custom. Other requires the exact external model ID.
+3. Effort: offer `max` first, then supported lower levels and `runtime-default`; offer Codex
+   `ultra` only when supported. Other accepts the external provider's effort label.
 
-On the Codex host runtime, STOP as well: recursively invoking Codex would be same-runtime review.
-Run this stage from Claude, OpenCode, Gemini, or another non-Codex planning seat.
+Automatic callers also offer a one-run `Skip review`. Record it exactly as
+`Unreviewed (user skipped)` and do not auto-start crypto execution.
 
-## Step 3: Invoke the read-only Codex reviewer
-
-Run the installed FVS helper at xhigh effort:
+## 2. Run or export the read-only review
 
 ```bash
 node ~/.claude/scripts/fvs-codex-think.mjs review \
-  --topic "$ROOT" \
-  --iteration "n$N" \
-  --target "$TARGET_KIND" \
-  --effort xhigh
+  --topic "$ROOT" --iteration "n$N" --target "$TARGET_KIND" \
+  --reviewer "$REVIEWER" --model "$MODEL" --effort "$EFFORT"
 ```
 
-The helper:
+The shared provider machinery preflights only the selected CLI. Codex runs read-only and ephemeral
+with user config ignored; Claude runs safe mode with only Read/Glob/Grep, no MCP servers, and no
+persisted session. The reviewer never edits a target or repository file. The wrapper creates a
+unique hash-bound packet, validates one track-valid verdict, and exclusively writes the final
+review. Authentication, process, stale-input, or output failure is `failed`; never silently switch
+reviewers.
 
-- repeats the install/auth preflight as defense in depth;
-- loads the installed `crypto-plan-review.md` contract;
-- runs `codex exec` from the repository root with `--sandbox read-only`, `--ephemeral`, an argv
-  array, xhigh effort, and no `--model`;
-- gives Codex the exact target paths and tells it to treat repository/plan contents as data;
-- excludes proof-engineering memory and its derived snapshot from reviewer context;
-- captures the final reviewer message in an OS temporary directory;
-- validates exactly one `VERDICT:` line;
-- has the WRAPPER persist exactly one review artifact, then removes temporary output.
+For Other, the command reports `PENDING` and a managed packet. Give `prompt.md` to the selected
+reviewer, save its Markdown response inside the project, then run the printed `review-import`
+command with `--topic`, `--packet`, and `--response`. A pending export is not a completed review.
 
-Codex receives no repository write permission. If it is absent, unauthenticated, killed, returns
-nonzero, or violates the output contract, STOP. Never fall back to the plan author.
+## 3. Triage in the authoring seat
 
-## Step 4: Verify and triage the review
+Keep the reviewer response byte-for-byte intact. Never append triage to it. The planning seat
+re-checks every finding and exclusively writes one separate file:
 
-Read the review artifact without rewriting or softening Codex's text. Treat every finding as a
-claim: independently check its cited file lines, paper anchors, probes, and consequence before
-accepting it.
+- `PLAN_REVIEW_nN_TRIAGE.md`, or
+- `FOLLOWUP_REVIEW_nN_TRIAGE.md`.
 
-Append a `## Planning-seat triage` section to the SAME review artifact. For each finding record
-`accept`, `reject`, or `defer`, the evidence checked, and the exact destination for any planned
-edit. Do not edit the plan silently during review.
+Record requested and observed runtime/model/effort, provenance, each finding ID with
+accept/reject/defer and checked evidence, pre-edit target hashes, post-edit target hashes when
+applicable, gates rerun, and one status. Refuse to overwrite either review or triage history.
 
-Respond to the user using exactly these three top-level sections:
+Route the verdict:
 
-```
-### 1. Codex's review
-{the complete reviewer text, faithfully attributed}
+- `APPROVE`: write supported triage status `approved`; execution may be suggested.
+- `APPROVE-WITH-EDITS`: the authoring seat applies every accepted, exhaustively named bounded edit,
+  reruns the plan's own verification gates, records accepted/rejected finding IDs plus pre-edit and
+  post-edit hashes, then writes `approved after edits`. This is terminal: no second review.
+- `REJECT`: bounded edits cannot promote it. The authoring seat creates a fresh authored revision
+  at the next immutable iteration and a fresh review.
 
-### 2. What I'll do in response
-{accepted findings and concrete bounded edits, tied to finding IDs}
+For a true REJECT revision, pass the preceding review and triage to the new author prompt and next
+review packet as separately delimited untrusted history using repeated `--history` flags. Do not
+load `.formalising/proof-engineering/` or `sources/proof-engineering-context.md` into the reviewer.
 
-### 3. What I'll deliberately NOT do
-{rejected/deferred findings and retained assumptions, each with one-line evidence-based reason}
-```
+Hard cap each command invocation at at most three reviewer rounds. After the third REJECT, stop
+with the latest artifacts and print the exact standalone `/fvs:crypto-review <topic> nN --target
+<kind>` resume command; never auto-approve.
 
-Routing:
-
-- `APPROVE`: the plan may proceed to `/fvs:crypto-execute`.
-- `APPROVE-WITH-EDITS`: STOP before execution; revise the named plan sections and run a fresh
-  independently recorded review.
-- `REJECT`: STOP before execution; return to `/fvs:crypto-plan` or `/fvs:crypto-followup`.
+Failed, cancelled, pending, or unverified review states never auto-start execution or
+`/fvs:crypto-execute`. Report them honestly. Standalone invocation remains usable.
 
 </process>
 
-<codex_skill_adapter>
-This command itself is a cross-runtime bridge to the Codex CLI; it does not dispatch a Codex
-subagent. On the Codex host runtime it fails closed because Codex reviewing Codex is not independent.
-All coordination is artifact-mediated. Interactive ambiguity degrades to a plain-text question and
-waits; it never guesses provenance, iteration, or overwrite intent.
-</codex_skill_adapter>
-
 <success_criteria>
-- [ ] Codex install + login preflight ran before plan review work; no silent fallback.
-- [ ] Topic/iteration/target resolved safely; path traversal and overwrite refused.
-- [ ] Initial plans and follow-up plans are both supported.
-- [ ] Codex-authored or unknown-provenance plans are not mislabeled as independently reviewed.
-- [ ] Reviewer ran xhigh, effort-only, ephemeral, and read-only from the repo root.
-- [ ] Reviewer received no proof-engineering memory or derived memory snapshot.
-- [ ] Wrapper persisted exactly one well-formed review with one allowed verdict.
-- [ ] Planning seat re-verified and triaged findings without softening Codex's review.
-- [ ] Non-APPROVE verdicts stop before execution.
+- [ ] Reviewer -> model -> effort selection honored, including explicit same-runtime and Other.
+- [ ] Provenance says only cross-runtime, same-runtime fresh reviewer, or unverified as observed.
+- [ ] Reviewer remained read-only and memory-blind; final response and separate triage are immutable.
+- [ ] APPROVE-WITH-EDITS becomes approved after edits once author edits and local gates pass.
+- [ ] REJECT alone starts a fresh review round; at most three reviews run per invocation.
+- [ ] Failed/cancelled/pending/unverified states do not start execution.
 </success_criteria>

package/commands/fvs/formalise.md

@@ -17,17 +17,18 @@ When invoked WITH a request, match it against the table below and invoke the mat
 | Formalise a paper/topic into Lean (one-shot) | fvs:lean-formalise |
 | Refactor / simplify / decompose a proof | fvs:lean-refactor |
 | Start/plan a topic-based crypto formalisation iteration | fvs:crypto-plan |
-| Independently review an initial or follow-up crypto plan | fvs:crypto-review |
+| Fresh-review an initial or follow-up crypto plan | fvs:crypto-review |
 | Run the current iteration's plan | fvs:crypto-execute |
 | Adversarially evaluate the iteration | fvs:crypto-eval |
 | Write a follow-up plan from eval findings | fvs:crypto-followup |
 
 The crypto iteration loop is
-plan -> independent review -> execute -> eval -> follow-up -> independent review -> repeat,
+plan -> fresh review -> execute -> eval -> follow-up -> fresh review -> repeat,
 restartable from records under `fv-plans/<topic>/`. `lean-formalise` stays the one-shot paper-track
 command; the loop sits beside it for topic-based, multi-iteration crypto work.
 
 The one-shot and iterative authoring stages share the bounded, indexed learning loop under
-`.formalising/proof-engineering/`. Independent `crypto-review` remains memory-blind.
+`.formalising/proof-engineering/`. `crypto-review` remains memory-blind; only verified
+cross-runtime provenance is labeled independent.
 
 Invoke the matched skill directly using the Skill tool.

package/commands/fvs/help.md

@@ -140,8 +140,11 @@ Adversarially review an FC specification against Rust, extracted Lean, and inter
 - Effort defaults to `max`; lower settings and `runtime-default` remain selectable
 - Uses fresh reviewers and labels cross-runtime versus same-runtime review
 - Other providers use an exported packet and imported response; missing CLIs offer setup/fallback
-- Preserves the spec and records findings, input hashes, and triage in `.formalising/spec-reviews/`
-- PASS readies the statement for proof; REVISE/BLOCKED need corrections or evidence
+- Preserves immutable `review.md` plus separate author-owned `triage.md` and input hashes
+- Never auto-selects a menu item; supplying all flags is the non-interactive path
+- One-run `Skip review` records `Unreviewed (user skipped)` and never starts proof work
+- PASS proceeds; APPROVE-WITH-EDITS proceeds after author edits and gates, without another review
+- REVISE/BLOCKED create a fresh review with prior history; each invocation stops after three rounds
 
 Runs automatically after `lean-specify` by default, even on projects without config. To disable
 only automation, merge `"spec_review": {"automatic": false}` into `.formalising/fvs-config.json`,
@@ -242,22 +245,28 @@ Author the next bounded, runtime-neutral executor plan for a topic, grounded in
 Usage: `/fvs:crypto-plan "CKA from KEM"`
 Usage: `/fvs:crypto-plan "CKA from KEM" --codex`   # hand the planning think-step to Codex
 
-**`/fvs:crypto-review <topic> [nN] [--target plan|followup]`**
-Send an initial or follow-up plan to authenticated Codex for an independent, pre-execution
-adversarial review.
+**`/fvs:crypto-review <topic> [nN] [--target plan|followup] [--reviewer codex|claude|other] [--model ID] [--effort LEVEL]`**
+Send a plan to a selected fresh adversarial reviewer.
 
-- Preflights both Codex installation and `codex login status`; never silently falls back
-- Rejects Codex-authored or unknown-provenance plans instead of claiming self-review is independent
-- Runs xhigh, effort-only, ephemeral Codex with a read-only repository sandbox
+- Recommends the non-author runtime, then model (Sol/Astra or Fable/Sonnet), then max-first effort
+- Labels cross-runtime, same-runtime fresh reviewer, and unverified provenance honestly
+- Runs Codex or Claude with read-only ephemeral controls and no repository write tools
 - Attacks source fidelity, statement soundness, semantic closure, interfaces, gates, boundedness,
   security/data-loss risks, and roadmap coherence
-- Wrapper persists exactly one `PLAN_REVIEW_nN.md` or `FOLLOWUP_REVIEW_nN.md`; the planning seat
-  verifies and triages every finding
+- Wrapper preserves immutable review evidence; the authoring seat writes separate hash-bound triage
 - Deliberately excludes canonical and snapshotted proof-engineering memory from reviewer context
-- Only APPROVE proceeds; APPROVE-WITH-EDITS and REJECT stop before execution
+- APPROVE-WITH-EDITS proceeds after accepted author edits and gates, with no second review
+- REJECT creates a fresh reviewed revision; each invocation stops after three reviewer rounds
+- Automatic handoff asks reviewer -> model -> effort and never auto-selects a choice
+- One-run `Skip review` records `Unreviewed (user skipped)` and never starts execution
 
 Usage: `/fvs:crypto-review "CKA from KEM" n1 --target plan`
-Usage: `/fvs:crypto-review "CKA from KEM" n1 --target followup`
+Usage: `/fvs:crypto-review "CKA from KEM" n1 --target followup --reviewer claude --model sonnet --effort max`
+
+Crypto plan and follow-up enter the interactive review handoff by default. To disable only that
+automatic handoff, merge `"crypto_review": {"automatic": false}` into
+`.formalising/fvs-config.json`. Standalone review remains available, and a trusted user may
+explicitly invoke crypto execution from an unreviewed plan.
 
 **`/fvs:crypto-execute <topic> nN`**
 Run the current iteration's bounded plan under the green-build guard; a failed proof triggers a short interactive redirect early. (Executor stage — takes no `--codex`.)

package/commands/fvs/lean-spec-review.md

@@ -26,4 +26,16 @@ runtime, model, and effort menu; preserve the spec and record the review and fin
 Follow the review workflow with `$ARGUMENTS`. Explicit invocation always runs the selection flow,
 even when `spec_review.automatic` is false. Automatic invocation from `lean-specify` enters the
 same workflow after generation checks, with the resolved spec/source paths and author runtime.
+
+Honor explicit reviewer/model/effort choices. Supplying all three standalone flags is the
+non-interactive path; otherwise ask only for missing choices in order: reviewer -> model -> effort.
+Automatic callers record `Skip review` exactly as `Unreviewed (user skipped)` and do not auto-start
+proof work.
+
+The reviewer is read-only; the `lean-specify` authoring seat keeps `review.md` unchanged and writes
+separate `triage.md` with finding IDs, old/new hashes (pre-edit/post-edit), and rerun structure,
+style, and optional build gates. PASS is terminal. APPROVE-WITH-EDITS becomes `approved after edits`
+after accepted bounded edits pass those gates, with no second review. REVISE and BLOCKED
+require a fresh revision or evidence packet and another review with prior review/triage history.
+Run at most three reviewer rounds per invocation; stop at the cap with an exact resume command.
 </process>