instar 1.3.1189 → 1.3.1190

package/dist/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1189",
+  "packageVersion": "1.3.1190",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/dist/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "5d762bbb3b25d0fb34ecaa317a638f1eab6af13dc6a22f7392c054800ccee190",
+  "sha256": "e2275b904b85c7db59a699f899b730f164b89ca204813d9766d5b1c5233a92ba",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1189"
+  "packageVersion": "1.3.1190"
 }

package/dist/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1189"
+  "packageVersion": "1.3.1190"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1189",
+  "version": "1.3.1190",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/scripts/standards-coverage.mjs

@@ -56,6 +56,7 @@ import yaml from 'js-yaml';
 import { articleIds, parseRegistryStructure } from './standards-registry-article-core.mjs';
 import {
   evaluateStandardsDirection,
+  evaluateOperatorReviewApproval,
   inventoryStandardsArticles,
   readCandidateApproverKey,
   readDirectionApprovalLedger,
@@ -599,6 +600,12 @@ function validateRootSelfWiring() {
     STANDARDS_DIRECTION_BASE_FILE: '${{ runner.temp }}/standards-registry-base.md',
     STANDARDS_DIRECTION_BASE_APPROVER_KEY_FILE: '${{ runner.temp }}/standards-direction-approver-base.pem',
     STANDARDS_DIRECTION_BASE_REVISION: "${{ github.event.pull_request.base.sha || github.event.before || format('{0}^', github.sha) }}",
+    // Path B (2026-08-22): the operator-review context the guard reads. Pinned
+    // here for the same reason as the others — this contract is deliberately
+    // EXACT so the CI wiring cannot be quietly rearranged, and adding an input
+    // to the check must therefore be a visible, declared edit rather than a
+    // silent one. The guard caught exactly that when this key was introduced.
+    STANDARDS_DIRECTION_REVIEW_FILE: '${{ runner.temp }}/standards-direction-review.json',
   };
   if (!exactKeys(job, ['name', 'runs-on', 'steps']) ||
     job.name !== 'Standards Enforcement Coverage' || job['runs-on'] !== 'ubuntu-latest' ||
@@ -611,6 +618,11 @@ function validateRootSelfWiring() {
   const setupStep = steps.find((step) => step?.uses === 'actions/setup-node@v4');
   const installStep = steps.find((step) => step?.run === 'npm ci --ignore-scripts');
   const baseStep = steps.find((step) => step?.id === 'area-audit-base');
+  // Path B's evidence-gathering step. Pinned into the ordered prefix so it
+  // cannot be dropped without this check failing — an absent step would make
+  // every operator approval read as UNAVAILABLE, which fails safe but would
+  // silently return the operator to needing a key.
+  const reviewStep = steps.find((step) => step?.name === 'Fetch operator review context (direction guard path B)');
   const expectedBaseRun = [
     'git cat-file -e "$BASE_SHA^{commit}"',
     'if git cat-file -e "$BASE_SHA:docs/standards-registry-area-audits.json"; then',
@@ -624,7 +636,7 @@ function validateRootSelfWiring() {
     '',
   ].join('\n');
   const expectedBaseSha = "${{ github.event.pull_request.base.sha || github.event.before || format('{0}^', github.sha) }}";
-  const exactPrefix = [checkoutStep, setupStep, installStep, baseStep, checkStep];
+  const exactPrefix = [checkoutStep, setupStep, installStep, baseStep, reviewStep, checkStep];
   const ordered = exactPrefix.every((step, index) => step && steps[index] === step);
   const protectedBaseWired = ordered &&
     exactKeys(checkoutStep, ['uses', 'with']) && exactKeys(checkoutStep.with, ['fetch-depth']) && checkoutStep.with['fetch-depth'] === 0 &&
@@ -633,7 +645,11 @@ function validateRootSelfWiring() {
     exactKeys(baseStep, ['name', 'id', 'env', 'run']) &&
     baseStep.name === 'Resolve protected-base area ledger' &&
     exactKeys(baseStep.env, ['BASE_SHA']) && baseStep.env.BASE_SHA === expectedBaseSha &&
-    baseStep.run === expectedBaseRun;
+    baseStep.run === expectedBaseRun &&
+    exactKeys(reviewStep, ['name', 'if', 'env', 'run']) &&
+    reviewStep.if === "github.event_name == 'pull_request'" &&
+    exactKeys(reviewStep.env, ['GH_TOKEN', 'PR', 'HEAD_SHA', 'OWNER_LOGIN', 'OWNER_TYPE', 'PR_AUTHOR', 'OUT']) &&
+    reviewStep.env.OUT === '${{ runner.temp }}/standards-direction-review.json';
   if (!protectedBaseWired) {
     errors.push('The Root self-wiring requires dependency install plus full-history protected-base extraction and required base env on the standards check');
   }
@@ -1317,6 +1333,31 @@ function compute() {
     if (key.revision !== base.revision) {
       key.errors.push('protected-base registry and approver trust root resolved from different revisions');
     }
+    // PATH B context (2026-08-22). The WORKFLOW fetches the reviews and writes
+    // them here, so this script performs no network I/O and stays testable.
+    // Absent, unreadable or malformed => UNAVAILABLE, which falls back to
+    // requiring a signed ratification. It never becomes an approval.
+    const review = (() => {
+      const file = process.env.STANDARDS_DIRECTION_REVIEW_FILE;
+      if (!file) return null;
+      let raw;
+      try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('not a regular file');
+        raw = JSON.parse(fs.readFileSync(file, 'utf8'));
+      } catch (err) {
+        return { approved: false, approvedBy: null, reason: `review context unreadable (${err.message})` };
+      }
+      if (!isPlainObject(raw)) return { approved: false, approvedBy: null, reason: 'review context is not an object' };
+      return evaluateOperatorReviewApproval({
+        reviews: raw.reviews,
+        ownerLogin: raw.ownerLogin,
+        ownerType: raw.ownerType,
+        headSha: raw.headSha,
+        prAuthorLogin: raw.prAuthorLogin,
+      });
+    })();
+
     const assessed = evaluateStandardsDirection({
       baseMarkdown: base.markdown,
       candidateMarkdown: markdown,
@@ -1324,6 +1365,7 @@ function compute() {
       approverPublicKeyPem: key.pem,
       candidateApproverPublicKeyPem: candidateKey.pem,
       baseRevision: base.revision ?? 'unknown-protected-base',
+      reviewApproval: review,
     });
     assessed.errors.unshift(...approvals.errors, ...candidateKey.errors, ...key.errors);
     if (assessed.errors.length > 0) assessed.status = 'not-proven';

package/scripts/standards-direction-guard.mjs

@@ -218,6 +218,87 @@ function familyPopulation(articles) {
   return map;
 }
 
+/**
+ * PATH B — an approving GitHub review from the repository owner.
+ *
+ * WHY THIS EXISTS (2026-08-22, topic 52222). Path A (an Ed25519 ratification)
+ * requires the operator to create, guard for years, and use a private key from
+ * a laptop. That key was never created, so NO registry change merged between
+ * this guard landing on 2026-08-17 and today. A guard nobody can satisfy stops
+ * the work it was meant to govern rather than the risk.
+ *
+ * WHAT MAKES THIS SOUND, AND WHAT DOES NOT. An adversarial review of the first
+ * draft established that no check the agent writes can constrain the agent: it
+ * authors this file and (before the ruleset changed) could push straight to
+ * main. So THIS FUNCTION IS NOT THE SECURITY BOUNDARY. The boundary is the
+ * repository ruleset — require-PR plus CODEOWNERS naming the operator on
+ * docs/STANDARDS-REGISTRY.md — which needs admin rights the agent does not
+ * hold. What this function adds is LEGIBILITY: it tells the pipeline, and the
+ * reader, which articles changed and whether the operator's approval is still
+ * attached to the bytes currently proposed. Removing it would not remove the
+ * protection; weakening it would not weaken the protection.
+ *
+ * Pure — the caller supplies the review list, so this stays testable and does
+ * no network I/O. Every uncertainty resolves to NOT approved.
+ */
+export function evaluateOperatorReviewApproval({
+  reviews = null,
+  ownerLogin = null,
+  ownerType = null,
+  headSha = null,
+  prAuthorLogin = null,
+} = {}) {
+  const no = (reason) => ({ approved: false, approvedBy: null, reason });
+
+  // An organization owner names no individual. Falling back to an in-repo
+  // allowlist here would reintroduce a trust root the agent can edit, which is
+  // the whole defect this design was rewritten around — so this is UNAVAILABLE,
+  // never a softer check.
+  if (ownerType !== 'User') return no(`owner is not an individual (type: ${ownerType ?? 'unknown'})`);
+  if (typeof ownerLogin !== 'string' || ownerLogin.length === 0) return no('owner login unavailable');
+  if (typeof headSha !== 'string' || !/^[0-9a-f]{40}$/i.test(headSha)) return no('head sha unavailable or malformed');
+  if (!Array.isArray(reviews)) return no('review list unavailable');
+
+  // The agent must not be able to approve its own change. GitHub already
+  // forbids this; checking it here too means the property does not depend on
+  // one platform behaviour staying the way it is today.
+  if (typeof prAuthorLogin === 'string' && prAuthorLogin.toLowerCase() === ownerLogin.toLowerCase()) {
+    return no('the pull request author is the owner — self-approval is not a different principal');
+  }
+
+  const ownerReviews = reviews
+    .filter((r) => r && typeof r === 'object' && typeof r.user?.login === 'string' &&
+      r.user.login.toLowerCase() === ownerLogin.toLowerCase())
+    .map((r) => ({
+      state: String(r.state || '').toUpperCase(),
+      commitId: typeof r.commit_id === 'string' ? r.commit_id : '',
+      at: typeof r.submitted_at === 'string' ? Date.parse(r.submitted_at) : NaN,
+    }))
+    // A review with no parseable timestamp cannot be ordered against a possible
+    // later withdrawal, so it is dropped rather than trusted.
+    .filter((r) => Number.isFinite(r.at))
+    .sort((a, b) => a.at - b.at);
+
+  if (ownerReviews.length === 0) return no(`no review from ${ownerLogin}`);
+
+  const onHead = ownerReviews.filter((r) => r.commitId.toLowerCase() === headSha.toLowerCase());
+  const approval = [...onHead].reverse().find((r) => r.state === 'APPROVED');
+  if (!approval) {
+    const stale = ownerReviews.some((r) => r.state === 'APPROVED');
+    return no(stale
+      ? `${ownerLogin} approved an earlier commit, not the current head — the proposed bytes changed after approval`
+      : `no APPROVED review from ${ownerLogin} on the current head`);
+  }
+
+  // A later withdrawal wins. DISMISSED is included because a dismissed approval
+  // is an approval the platform has already retracted.
+  const withdrawn = ownerReviews.find((r) => r.at >= approval.at &&
+    (r.state === 'CHANGES_REQUESTED' || r.state === 'DISMISSED'));
+  if (withdrawn) return no(`${ownerLogin} withdrew the approval (${withdrawn.state.toLowerCase()})`);
+
+  return { approved: true, approvedBy: ownerLogin, reason: `approved by ${ownerLogin} on the current head` };
+}
+
 /**
  * Evaluate candidate constitutional direction against a protected base.
  * This exact export is imported by the pipeline and its negative-control test.
@@ -229,6 +310,12 @@ export function evaluateStandardsDirection({
   approverPublicKeyPem = '',
   candidateApproverPublicKeyPem = null,
   baseRevision = 'unknown-protected-base',
+  // PATH B (2026-08-22). The result of evaluateOperatorReviewApproval, or null
+  // when the caller could not obtain the review context (not a pull request, an
+  // API failure, a rate limit). NULL MEANS UNAVAILABLE, NOT APPROVED — an
+  // approval that cannot be verified is not an approval, so the article falls
+  // back to requiring path A.
+  reviewApproval = null,
 }) {
   const base = inventoryStandardsArticles(baseMarkdown);
   const candidate = inventoryStandardsArticles(candidateMarkdown);
@@ -280,8 +367,20 @@ export function evaluateStandardsDirection({
       payload.articleId === change.id);
     const displayName = change.after?.name ?? change.before?.name ?? change.id;
     if (matching.length === 0) {
+      // Path B before refusing: the operator's approving review on the exact
+      // head covers every article in the pull request, because a reviewer
+      // approves the diff in front of them. Per-article granularity was an
+      // artifact of the signing mechanism, not a requirement anyone stated.
+      if (reviewApproval?.approved === true) {
+        change.direction = change.kind === 'add' ? 'add' : change.kind === 'remove' ? 'remove' : 'unstated-review-approved';
+        change.approvedBy = reviewApproval.approvedBy;
+        change.approvedVia = 'github-review';
+        continue;
+      }
       errors.push(
-        `${directionLabel(null, change.kind)} "${displayName}" (${change.id}) requires an independently signed direction ratification`,
+        `${directionLabel(null, change.kind)} "${displayName}" (${change.id}) requires the operator's approving review on this commit, ` +
+        `or an independently signed direction ratification` +
+        (reviewApproval?.reason ? ` — review path unavailable: ${reviewApproval.reason}` : ''),
       );
       continue;
     }
@@ -328,6 +427,9 @@ export function evaluateStandardsDirection({
     baseRevision,
     baseRegistrySha256,
     candidateRegistrySha256,
+    reviewApproval: reviewApproval
+      ? { approved: reviewApproval.approved === true, approvedBy: reviewApproval.approvedBy ?? null, reason: reviewApproval.reason ?? null }
+      : { approved: false, approvedBy: null, reason: 'review context unavailable' },
     changes: changes.map((change) => ({
       articleId: change.id,
       name: change.after?.name ?? change.before?.name ?? change.id,
@@ -336,6 +438,7 @@ export function evaluateStandardsDirection({
       change: change.kind,
       direction: change.direction ?? null,
       approvedBy: change.approvedBy ?? null,
+      approvedVia: change.approvedVia ?? (change.approvedBy ? 'signed-ratification' : null),
     })),
     population: {
       protectedBase: base.articles.length,

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-08-23T02:26:13.695Z",
-  "instarVersion": "1.3.1189",
+  "generatedAt": "2026-08-23T02:53:10.208Z",
+  "instarVersion": "1.3.1190",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1189",
+  "packageVersion": "1.3.1190",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "5d762bbb3b25d0fb34ecaa317a638f1eab6af13dc6a22f7392c054800ccee190",
+  "sha256": "e2275b904b85c7db59a699f899b730f164b89ca204813d9766d5b1c5233a92ba",
   "registrySha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
-  "packageVersion": "1.3.1189"
+  "packageVersion": "1.3.1190"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "81b53363a440e832672618965540b3e507ae0d93adcc67ec2b93daf7933b3ab4",
   "articleCount": 88,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1189"
+  "packageVersion": "1.3.1190"
 }

package/upgrades/1.3.1190.md

@@ -0,0 +1,28 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The constitutional direction guard now accepts a second proof that a change to `docs/STANDARDS-REGISTRY.md` was approved: an approving GitHub review from the repository owner, on the exact head commit. The existing Ed25519 ratification path is unchanged and still takes precedence when both are present.
+
+`evaluateOperatorReviewApproval` (pure, in `scripts/standards-direction-guard.mjs`) decides whether an owner approval is present, bound to the current head, and unwithdrawn. `standards-coverage.mjs` reads the review context from a file written by a new `pull_request`-only CI step, so the script performs no network I/O. The report gains `directionGuard.reviewApproval` and a per-change `approvedVia`.
+
+## What to Tell Your User
+
+None — internal change (no user-facing surface).
+
+## Summary of New Capabilities
+
+None — internal change (no user-facing surface).
+
+## Evidence
+
+17 tests, both directions per arm: accepted on the current head; refused on an earlier commit; refused after a later `CHANGES_REQUESTED`; refused on `DISMISSED`; accepted on a re-approval that follows a resolved objection; refused for a non-owner; refused for self-approval; refused for `COMMENTED`; UNAVAILABLE rather than permissive on an organization-owned repository; and fails closed on a missing review list, a malformed head sha, an absent owner login, and an unparseable timestamp. Composition tests assert an unavailable context is not-approved *and names why*, and that an unchanged registry produces no change to approve.
+
+## Known Limits
+
+**This code is not the security boundary and does not claim to be.** The agent authors it and the workflow that runs it, so it cannot constrain the agent. The boundary is the repository ruleset (require-PR on `main`, `require_code_owner_review`, empty bypass list) plus `.github/CODEOWNERS` naming the operator on the registry — all of which need admin rights the agent does not hold. This change adds legibility on top of that: which articles changed, and whether the approval still matches the proposed bytes.
+
+The approval binds to the reviewed head, not to the bytes that finally land — a moved base or merge commit can differ. Mitigation is a platform setting (require branches up to date), recommended in `docs/specs/standards-approval-via-github-review.md` and not assumed here. `docs/STANDARDS-DIRECTION-GUARD.md` still describes path A as the only proof and is now incomplete; updating it is tracked separately.

package/upgrades/direction-guard-review-approval.eli16.md

@@ -0,0 +1,43 @@
+# Letting the operator's approval count — Plain-English Overview
+
+## The problem in one breath
+
+A check is supposed to stop the agent changing its own rulebook without the operator agreeing. The only proof it accepted was a cryptographic signature from a key the operator would have to create and guard for years. Nobody made that key, so the check refused everything — including the operator's own five approved changes. A check nobody can satisfy blocks the work rather than the risk.
+
+## What already exists
+
+Since 17 August, any change to the rulebook has been refused for want of that signature. Nothing has slipped past it; nothing has got through it either.
+
+As of this afternoon there is also a real lock, and it is not code: the repository now requires changes to the rulebook to be approved by the operator, enforced by GitHub against the filename. That setting needs owner rights the agent doesn't have.
+
+## What this adds
+
+A second accepted proof: **the operator approving the pull request**. Three taps on a phone, on an account that already has two-factor. The signature route stays exactly as it was for anyone who prefers it.
+
+## The new pieces
+
+When a change touches the rulebook, the pipeline asks GitHub a single question: did the owner approve *this exact version*? If yes, that counts. If no — or if the answer can't be obtained — it falls back to demanding the signature.
+
+## The safeguards
+
+**The approval sticks to one exact version.** Push anything afterwards and it stops counting, so nobody can get a yes on one text and land another.
+
+**A withdrawn approval counts as withdrawn** — and a re-approval after a resolved objection counts again, so an old objection can't block forever.
+
+**Nobody can approve their own change**, checked here as well as by GitHub, so the property doesn't depend on one platform behaviour staying as it is.
+
+**Anything unverifiable is refused.** An API failure means "we couldn't check", never "nobody objected".
+
+## The honest part
+
+**This code is not the lock, and it says so.** The agent writes this check and the job that runs it, so a version of the agent that wanted around it would edit it rather than defeat it. The thing that actually stops that is the repository setting, which needs admin rights the agent doesn't have. What the code adds is legibility — it tells you which parts of the rulebook changed and whether your approval still matches them, so your three taps are informed rather than ceremonial.
+
+**One gap left open on purpose.** The approval is tied to the version you read. If the project moves underneath while you're reading, what finally lands can differ slightly. A further setting closes that; it's recommended, not assumed.
+
+## What ships when
+
+This can merge on its own — it touches no rulebook text, so it doesn't need an approval to install the approval path. Once it's in, the five amendments go green and merge on the operator's tap.
+
+## What you actually need to decide
+
+Nothing here. The decision was made this afternoon; this is the implementation. The one open question is unrelated: whether to also require branches be up to date before merging, which would close the last gap above.

package/upgrades/side-effects/direction-guard-review-approval.md

@@ -0,0 +1,80 @@
+# Side-Effects Review — the direction guard accepts the operator's GitHub review
+
+**Version / slug:** `direction-guard-review-approval`
+**Date:** `2026-08-22`
+**Author:** `echo`
+**Second-pass reviewer:** `codex-cli — 4 adversarial rounds on the design (spec: docs/specs/standards-approval-via-github-review.md)`
+
+## Summary of the change
+
+The constitutional direction guard accepted exactly one proof that a change to `docs/STANDARDS-REGISTRY.md` was approved: an Ed25519 signature over the exact article bytes, verified against a key pinned in the repository. That key shipped as an empty placeholder, so **no registry change merged between the guard landing on 2026-08-17 and 2026-08-22** — including the operator's own five ratified amendments (#1960). This adds a second accepted proof: an approving GitHub review from the repository owner, on the exact head commit. Path A is untouched. Files: `scripts/standards-direction-guard.mjs` (new `evaluateOperatorReviewApproval`, plus a `reviewApproval` input to `evaluateStandardsDirection`), `scripts/standards-coverage.mjs` (reads the review context from a file the workflow writes), `.github/workflows/ci.yml` (a step that fetches the reviews from the API).
+
+## Decision-point inventory
+
+- `evaluateOperatorReviewApproval` (new) — **add** — decides whether an owner approval is present, current and unwithdrawn. Pure; no I/O.
+- `evaluateStandardsDirection` per-article decision — **modify** — a changed article may now be satisfied by path B as well as path A.
+- CI `Fetch operator review context` step — **add** — supplies the evidence. Cannot fail the job.
+
+## 1. Over-block
+
+The added path only ever turns a refusal into an acceptance; it cannot refuse anything path A previously accepted. A signed ratification is still checked first and still wins. The one way this could over-block is if the new CI step failed the job — it cannot, because it tolerates API failure and writes an empty context, which the guard reads as UNAVAILABLE rather than as an error.
+
+## 2. Under-block
+
+**This is the section that matters, and the honest answer is that the code does not carry the security.** An adversarial review of the first draft established it: the agent authors this file and the workflow that runs it, and (before 2026-08-22) could push directly to `main`. So a version of the agent that wanted to bypass this would edit it, not defeat it.
+
+What actually blocks that is the repository ruleset the operator applied on 2026-08-22 — require-PR on `main`, `require_code_owner_review`, `bypass_actors: []` — plus `.github/CODEOWNERS` naming the operator on `docs/STANDARDS-REGISTRY.md`. Those need admin rights the agent does not hold (verified: a ruleset write returns 404 for its identity). **This change is legibility on top of that, not a lock.** Removing it would not remove the protection.
+
+Within its own scope it under-blocks in one named way: it verifies that an approval exists on the reviewed head, not that the bytes reaching `main` are those bytes. A moved base or a merge commit can differ. Mitigation is a platform setting (require branches up to date), recommended in the spec and not assumed here.
+
+## 3. Level-of-abstraction fit
+
+The decision lives beside the existing signature check, in the function that already owns "is this article's change approved?". The evidence-gathering lives in the workflow, so the script stays pure and testable and performs no network I/O. No new file, no new invocation point.
+
+## 4. Signal vs authority compliance
+
+Compliant, and the change makes the split more honest than before. The script is a SIGNAL that reports which articles changed and whether an approval is attached. The AUTHORITY is the ruleset, which the agent cannot alter. The previous arrangement blurred this by describing an agent-authored check as the thing preventing self-amendment; the spec and the code comments now say plainly that it is not.
+
+## 4b. Judgment-point check
+
+No judgment point is added. Every predicate is a deterministic comparison — login equality, sha equality, state string, timestamp ordering. No model is consulted, and nothing infers intent from prose.
+
+## 5. Interactions
+
+- **`.github/CODEOWNERS`** (merged in #1962) is what makes the review exist at all: it causes GitHub to request the operator automatically. Verified live — pushing to #1960 auto-added `JKHeadley` as a reviewer and the PR went to `blocked`.
+- **`docs/STANDARDS-DIRECTION-GUARD.md`** describes path A as the only proof. It is now incomplete; updating it is tracked, not done here, and named rather than left silent.
+- **The `standards-coverage` report** gains `directionGuard.reviewApproval` and a per-change `approvedVia`, so a reader can tell which proof was used.
+
+## 6. External surfaces
+
+One outbound call, from CI only: `GET /repos/{owner}/{repo}/pulls/{n}/reviews` using the workflow's own `github.token`. Read-only, no secrets beyond the ephemeral job token, and it never runs outside a `pull_request` event. No agent-side runtime surface, no route, no message.
+
+## 6b. Operator-surface quality
+
+The operator's experience is three taps on a PR GitHub already asked them to review. The failure text names which proof is missing and, when the review path is unavailable, why — so a red check says "waiting for Justin" rather than something cryptic.
+
+## 7. Multi-machine posture
+
+`unified` — trivially. Pure functions plus one CI-side read; no durable state, no per-machine state, no generated URL, no notification. Identical on any machine over the same inputs.
+
+## 8. Rollback cost
+
+Near zero and additive to revert: delete the new function, the `reviewApproval` parameter, the CI step and the test, and the guard is byte-equivalent to today's behaviour. Because the ruleset carries the security, a revert does not reopen a hole — it only makes the pipeline less informative and returns the operator to needing a key.
+
+## Conclusion
+
+Ship. It converts a guard nobody could satisfy into one the operator can satisfy in three taps, adds no authority, has no runtime or agent-facing surface, and is covered in both directions by 17 tests. The honest caveat, repeated because it is the point: the security is the ruleset, not this code.
+
+## Second-pass review
+
+The DESIGN was adversarially reviewed over four rounds (5 → 3 → 1 → 0 security findings) before any of this was written; round 1 was invalidated wholesale and the design rewritten around its central finding. Record: `docs/specs/standards-approval-via-github-review.md`. The implementation follows that converged design.
+
+## Evidence pointers
+
+- `tests/unit/standards-direction-review-approval.test.ts` — 17 tests. Both directions per arm: accepted on head; refused on an earlier commit; refused after withdrawal; refused on dismissal; **accepted on re-approval after an objection** (so a resolved objection cannot block forever); refused for a non-owner; refused for self-approval; refused for `COMMENTED`; unavailable (not permissive) for an organization owner; fails closed on a missing list, a malformed sha, an absent login, and an unparseable timestamp.
+- Composition tests assert that an unavailable context is not-approved *and names why*, and that an unchanged registry produces no fabricated change to approve.
+- Pre-existing local failures in `standards-coverage-ratchet.test.ts` (2) were verified to fail identically on clean `upstream/main` with this work stashed — a local git-ref artifact, not a regression from this change.
+
+## Class-Closure Declaration (display-only mirror)
+
+The class is "a guard that cannot be satisfied, and is therefore not a guard." Closed here for the constitution: the operator now has a reachable proof. It is NOT closed generally — the same shape exists wherever a check depends on a credential nobody has created, and the dashboard-PIN finding (a dozen routes documented as operator-only, gated on a secret the agent reads) is the same class from the other direction. Tracked separately, open.