pi-gauntlet 6.2.1 → 7.0.0

package/skills/gatekeep-pr/reference/decision-menu.md

@@ -1,226 +1,118 @@
-# gatekeep-pr: decision menu
-
-Read from SKILL.md `## Decide`. `## Decision` in the report has two parts: the
-action vocabulary, then the numbered courses.
-
-## Actions
-
-```markdown
-Actions (compose freely in the custom row):
-  fix <P#s|all>    apply blocking fixes in worktree, re-run gate, push  (in-repo PRs only)
-  push-docs        push already-applied doc-drift edits                 (only when uncommitted
-                                                                        reviewed doc edits exist
-                                                                        in the worktree)
-  merge-squash | merge-commit                                          (preconditions per Verdict;
-                                                                        never bundled with a push)
-  merge-squash anyway | merge-commit anyway                            (custom row only: overrides a
-                                                                        reviewer-withheld merge - the literal
-                                                                        `anyway` accepts the named reason;
-                                                                        GitHub-refused rows stay uncomposable)
-  wait             poll the reviewer run and comment set, then re-render
-  request-changes | review-comment | approve                           (approve: never own PR)
-  reply <C#s>      post drafted thread replies
-  tracker <act>    tracker action                                      (only when a tracker tool resolved)
-  stop             leave the PR as-is / report-only exit
-```
+# gatekeep-pr: step 6 - menu
+
+Read from SKILL.md step 6. Input: the report's verdict and the PR state. Output: the menu appended under the verdict line. Nothing executes until a pick; the pick runs per `post-selection-loop.md`.
+
+## Verbs
+
+`fix`, `push`, `review`, `approve`, `merge`, `merge anyway`, `reply`, `propose ticket change`, `show evidence`, `wait`, `stop`.
+
+Rows are `<n>. <verb> - <consequence>`; every row, `stop` and `(not available: ...)` rows included, carries its consequence clause. `stop` is always last, before the compose hint. `show evidence` is always offered and never `[recommended]`. A row GitHub would refuse (branch protection, missing permission, `viewerPermission` too low) renders `(not available: <reason>)` and is never `[recommended]`. Exactly one row is `[recommended]`.
 
-A `+ tracker <act>` suffix is available on any mutation course when a tracker tool
-resolved.
+- `fix` - apply the drafted payloads for the named blockers (default: all open blockers; with no open blockers, the nit payloads) in the provisioned worktree, run the verification pass once at the resulting SHA, push when `push` is available; `fix nits` applies nit payloads only, `fix + nits` blockers and nits; with no drafted payload at all, the human names the change
+- `push` - push local fix commits (renders only when unpushed commits exist)
+- `review` - post the blockers as a GitHub review: request-changes on someone else's PR, a comment on your own
+- `approve` - approve the PR (never your own)
+- `merge` - `gh pr merge --match-head-commit <assessed-sha>` with the resolved `merge policy` (default squash); preconditions per `post-selection-loop.md` `### Merge preconditions`
+- `merge anyway - accept AC<n> as impossible` - merge while an `impossible` row withholds it; lifts exactly that AC's withhold
+- `merge anyway` - merge while the pending-reviewer overlay withholds it; prints what it overrode
+- `reply` - post the drafted replies under `PR comments` (`reply <n>` for one)
+- `propose ticket change` - show the drafted AC text verbatim; post it as a tracker comment on an explicit confirmation reply, via the resolved tracker verb (`gh issue comment`, the overrides' tracker mapping, or `/skill:linear`); re-fetch the ticket first and re-render instead of posting when the AC row text drifted; no write path -> copy-paste block
+- `show evidence` - print the evidence record, claim and AC outcomes, dispositions, drafted payloads and replies (`report.md` `## What stays out`)
+- `wait` - poll the reviewer run, the pending required checks, and the comment set, then re-render
+- `stop` - leave the PR as-is
 
-Selection grammar: ID sets accept `all`, ranges (`P1-P4`), comma lists
-(`P1,P3`), and exclusions (`all but P2`).
+Compose hint: `Type a number, or compose: "fix 2", "fix nits", "fix + nits", "fix 1 + reply".` A composed line never bundles a push-producing verb (`fix`, `push`) with `merge`. When a failing check withholds `merge`, the hint line also offers `check <name> flaky | real | ci-broken`, which records the disposition on that check (`findings.md` `## Dispositions`): `flaky` lifts the blocker, `real` keeps it until green, `ci-broken` triggers the fallback local run (`ci-broken` records `ci-infrastructure-broken`).
+
+A composed line naming a `(not available: ...)` row is refused by name and the menu re-renders; the two `merge anyway` forms are the only overrides.
 
 ## Consent table
 
-Deterministic - this table is the golden-scenario oracle.
+Authorship moves only `[recommended]`, never which rows are offered. The first row is `[recommended]`; a `(not available: ...)` row is skipped, so the first available row carries it; when every other row is `show evidence`, `stop` is `[recommended]`.
+
+A `fixable` verdict with zero blockers (a withhold reason) uses the mergeable rows; `merge` renders `(not available: <withhold reason>)` - the overlay's reason when one applies, else the verdict's. On such a withhold, `[recommended]` goes to `wait` under the pending-reviewer or pending-required-check overlay, else to `propose ticket change` while an `impossible` row is `drafted`, else to `stop`.
 
-| Author | State | Offered rows (first = `[recommended]`) |
+| Author | Verdict | Rows |
 |---|---|---|
-| you | clean / follow-ups only | merge (squash); merge (merge-commit); do not merge (leave it); post no-blockers comment |
-| you | blocking | apply code fixes (named finding subset): skill edits in worktree, commits, re-runs gate, pushes - then merge re-offered; push applied doc fixes; do not act; post review-comment of findings |
-| someone else | clean / follow-ups only | approve; merge (squash, offered-unrecommended); post no-blockers comment |
-| someone else | blocking | post request-changes review; apply fixes on their branch (courtesy option 2); reply to existing threads; post comment |
-| bot author | any | someone-else's rows for the same state, review actions recommended |
-| fork (any) | any | post review (request-changes / comment / approve per state) - push and merge rows absent |
-| any | draft PR | assessment rows only; merge and approve rows absent until ready-for-review |
-| any | merged / closed | report-only; no mutation rows |
-
-This table is the single oracle for what is offered; `## Courses` renders its
-rows as actions and numbered courses. Rows GitHub would refuse (branch protection,
-missing permissions, `viewerPermission` too low) render listed-but-unavailable with
-the reason. Approving your own PR is never offered. Nothing executes until explicit
-selection. The fork, pending-reviewer, and CI-check overlays below modify the cell's rows; they are never a second offer source.
-
-## Courses
-
-A normative rendering of the consent table (never a second offer source): per
-author x state cell, exactly one `[recommended]` course renders first, the custom
-row renders last. Courses are atomic across pushes: no course, pre-composed or
-custom, bundles a push-producing action (`fix`, `push-docs`) with `merge-*`; after
-a fix wave the menu re-renders with merge as row 1 unless withheld (`reviewer still running` / `comments not refreshed`).
-
-| Author | State | Courses (first = `[recommended]`) |
+| you | mergeable | `merge`; `fix`; `reply` (when a drafted reply exists); `show evidence`; `stop` |
+| you | fixable | `fix`; `review`; `reply` (when a drafted reply exists); `show evidence`; `stop` |
+| someone else | mergeable | `approve`; `fix`; `merge`; `reply` (when a drafted reply exists); `show evidence`; `stop` |
+| someone else | fixable | `review`; `fix`; `reply` (when a drafted reply exists); `show evidence`; `stop` |
+
+`propose ticket change` joins any row set after the `fix` rows whenever an `impossible` row is `drafted`. `push` joins any row set after `fix` when unpushed fix commits sit in the worktree.
+
+## Overlays
+
+Overlays modify the consent row; they are never a second offer source. When two apply, the one higher in this table wins the `merge` reason and `[recommended]`.
+
+| Overlay | Trigger | Effect |
 |---|---|---|
-| you | clean / follow-ups only | 1. merge-squash; 2. merge-commit; 3. stop; 4. review-comment (post no-blockers note) |
-| you | blocking | 1. fix (worktree-fixable P#s only - `all` covers only those) [+ push-docs when uncommitted doc edits exist]; 2. push-docs (alone, when doc edits exist); 3. stop; 4. review-comment (post findings). When no P# is worktree-fixable (blocking is failing-check-only or L#-only), course 1 (fix) does not render: push-docs becomes first when doc edits exist, else stop is first |
-| you | blocking, post-fix re-render (gate green, preconditions hold) | 1. merge-squash; 2. merge-commit; 3. stop; 4. review-comment |
-| someone else | clean / follow-ups only | 1. approve; 2. merge-squash (offered-unrecommended); 3. review-comment (no-blockers note) |
-| someone else | blocking | 1. request-changes; 2. fix all (courtesy, their branch - omitted when nothing is worktree-fixable); 3. reply <C#s> (omitted when no replyable `C#` exists - `findings.md` `## IDs`; `reply all` and ranges skip non-replyable rows); 4. review-comment |
-| bot author | any | someone-else's rows for the same state; review actions recommended |
-| any | draft | 1. request-changes / review-comment / reply <C#s> (omit the reply course when no replyable `C#` exists) / stop - `[recommended]` follows the same authorship rule as the non-draft cells, except on your own draft PR `request-changes` is never recommended (you cannot request changes on your own PR any more than you can approve it); the fallback recommendation there is `review-comment` when findings exist, else `stop`. Custom present but cannot compose `merge-*`/`approve`/`fix`/`push-docs` until ready-for-review |
-| any | merged / closed | 1. stop; report-only, no other mutation courses at all; Custom present but cannot compose `merge-*`/`approve`/`fix`/`push-docs`/`request-changes`/`review-comment`/`reply`/`tracker` - nothing remains actionable |
-
-## Fork overlay
-
-The consent-table fork row renders as an overlay on the authorship cells
-(push/merge/fix absent; approve also dropped when the viewer authored the PR) - it
-is not a distinct authorship cell. It overlays the applicable authorship cell (you
-or someone else), removing `fix`, `push-docs`, and `merge-*` (never available on a
-fork). When you authored the fork PR, `approve` is also dropped (never offered on
-your own PR) - fork|you|clean renders `review-comment`/`stop` only; fork|you|blocking
-renders `request-changes`/`review-comment`/`stop` (the someone-else courtesy
-fix-on-their-branch course is also absent, since it is your own PR). A fork PR
-authored by someone else uses the someone-else cells with `fix`/`push-docs`/
-`merge-*` removed.
-
-## Pending-reviewer overlay
-
-While any `C#` row is `pending`, a reviewer run on the assessed head is
-queued/in progress, or the last comment refetch failed
-(`post-selection-loop.md` `### Re-render`), every pre-composed
-`merge-squash` / `merge-commit` course renders listed-but-unavailable with
-the reason: `reviewer still running` or `comments not refreshed`. This is a
-menu-level gate modelled on the `flaky` disposition's custom-row path, never
-a `## Verdict` precondition: `### Merge course` does not refuse the override.
-Only the custom row's `merge-squash anyway` / `merge-commit anyway` executes
-merge in that state, under the normal Merge course rules. Apply the comment-delta consent and incomplete-review rules in `post-selection-loop.md` `### Compare-and-swap` and `### Re-render`; `anyway` does not bypass an unreviewed delta or a blocking finding.
-
-`wait` is `[recommended]` in cells whose recommended course would otherwise
-be `merge-*` or `approve` (clean / follow-ups only, and the post-fix
-re-render); in blocking cells the existing first course (`fix`,
-`request-changes`) stays recommended and `wait` renders as row 2. Draft and
-merged/closed cells do not offer `wait`. A `reviewer failed (<conclusion>)`
-row changes nothing: the cell renders as it would without it.
-
-The overlay applies on the initial assessment too: a PR gated while the
-reviewer is mid-run withholds pre-composed merge from the first menu.
-
-Precedence: when the CI-check gate below also applies, its rendering wins -
-merge rows are absent and the CI-check gate line names both reasons.
-
-## CI-check gate
-
-An undispositioned failing check in the resolved set, or a pending required check,
-withholds every pre-composed course containing `merge-*` (merge preconditions per
-SKILL.md `## Verdict`) - none render, whatever the author/state cell says.
-Disposition and pending-check definitions per `findings.md` `## Dispositions`.
-
-| Disposition | Merge courses |
-|---|---|
-| Flaky | Not restored to a pre-composed course; merge proceeds only via the custom row naming the disposition explicitly |
-| Real, or an unresolved pending check | Withheld until the check is green |
-| CI-infrastructure-broken | Withheld until the triggered fallback run is green |
-
-A pending-only render is not itself a blocking verdict (findings groups can all
-read "None"); the recommended course falls to `stop` or `review-comment` in the
-meantime. This never falls through to the clean cell's recommended `merge-squash` -
-a failing resolved-set check or a pending required check means the PR is not in the
-clean state to begin with.
+| merged or closed PR | `state` is not `OPEN` | the report renders; the menu is `show evidence` and `stop` only |
+| draft PR | `isDraft` | `merge` and `approve` render `(not available: draft)` and never carry `[recommended]`; `review` is recommended on someone else's fixable draft and `fix` on their mergeable draft; on your own, `fix` when a blocker exists, else `stop` |
+| CI check | an undispositioned failing check in the resolved set, or a pending required check (`findings.md` `## Dispositions`) | on a failing check, the hint line offers `check <name> flaky \| real \| ci-broken`; `merge` renders `(not available: <check name> failing)`; `flaky` restores `merge` on the next render; `real` and `ci-infrastructure-broken` keep it withheld until green; a pending required check renders one `PR comments` line (`A required check is still pending, so merge waits. (<check name>)`), puts `wait` as row 1 and, when `Blockers` is empty, `[recommended]`, and renders `merge` `(not available: required check pending)`; it mints no disposition hint (not dispositionable) |
+| pending reviewer | a `pending` ledger row, a queued or in-progress reviewer run on the assessed head, or a failed comment refetch (`post-selection-loop.md` `### Re-render`) | puts `wait` as row 1 and, when `Blockers` is empty, `[recommended]`; `merge` renders `(not available: reviewer still running)` or `(not available: comments not refreshed)`; a composed `anyway` (`merge anyway`) overrides only this overlay and does not bypass an unreviewed delta or a blocker; a `reviewer failed (<conclusion>)` row changes nothing |
+| comment source review incomplete | the `### Re-render` step-4 source review of a comment delta did not finish (`post-selection-loop.md`) | one `PR comments` line `The comment source review did not finish, so merge waits. (<reason>)`; `merge` renders `(not available: comment source review incomplete)` with no `anyway` override; `reply` and `review` are dropped (the delta is unreviewed); `fix`, `show evidence`, `stop` stay; `stop` is `[recommended]` |
+| impossible AC | an `impossible` row in `drafted` or `proposed` while every other merge prerequisite holds | `merge` renders `(not available: ticket change pending on AC<n>)`; `merge anyway - accept AC<n> as impossible` renders and lifts exactly that withhold - blockers, an unreviewed delta, pending checks, and GitHub-refused states stay in force |
+| fork PR | `isCrossRepository` | `push` and `merge` render `(not available: fork)`; `fix` stays and applies to the local `pr-<N>` worktree, its consequence clause reading "open a PR from `pr-<N>`, or hand the patch to the author"; `approve` is dropped on your own fork PR |
+| bot author | `author_is_bot` | the someone-else rows |
 
 ## Fixtures
 
-Refused rows render per `## Consent table`. Zero mutation courses is a legal
-render (merged/closed) - the menu still appears, carrying findings and `stop`.
+Fixture 1 - own PR, fixable, one nit, one drafted ticket change, one drafted reply: the menu in `report.md` `## Worked example`.
 
-Example render (golden fixture 1 - own PR, blocking findings including committed
-doc drift, so uncommitted reviewed doc edits exist):
+Fixture 2 - the re-render after fixture 1's `fix` pushed; the reviewer bot is mid-run on the new head:
 
-```markdown
-Pick one:
-  1. fix all (P1-P10) + push-docs   [recommended]
-  2. push-docs (docs only, hold code fixes)
-  3. stop (leave as-is)
-  4. review-comment (post findings, act later)
-  5. Custom - compose: e.g. "fix P1-P8,P10 + push-docs" or "reply C1 + tracker comment"
 ```
-
-Golden fixture 2 - the post-fix re-render after course 1's gate re-run passes,
-with the sticky reviewer bot mid-run and one independently edited comment:
-
-```markdown
-## Comment-thread replies
-  C1. <thread ref> -> superseded by C3
-  C2. <thread ref> -> superseded by C4
-  C3. <thread ref> -> pending  https://github.com/<owner>/<repo>/actions/runs/<run-id>
-  C4. <thread ref> -> <drafted reply>  (reasonable)
-
-Pick one:
-  1. wait   [recommended]
-  2. merge-squash   (unavailable: reviewer still running)
-  3. merge-commit   (unavailable: reviewer still running)
-  4. stop (leave as-is)
-  5. review-comment
-  6. Custom - compose: e.g. "merge-squash anyway" or "reply C4"
+Delivers: the reports page exports CSV on demand. The PR covers AC1-2 of gh-45; AC3
+(export completes under 5s on production data) is checked after merge, not here.
+
+Ticket changes:
+- AC4 asks for the customer's credit score in the export, and the vendor API this
+  service reads returns no such field.
+  Proposed wording: "Exports include the customer's risk tier." (drafted; vendor doc api.example.com/v2/customers)
+
+PR comments:
+- maria's comment on the missing CSV header is already addressed, so the drafted reply points her at the fix. (3f2a1c0)
+- The reviewer run is still in progress, so merge waits. (https://github.com/<owner>/<repo>/actions/runs/<run-id>)
+
+Nits:
+- The export pages results with its own loop instead of the shared paging helper, so a paging bug fixed once would need fixing twice. (src/api/export.ts:31, lib/page.ts)
+
+Verdict: fixable - reviewer run in progress
+
+1. wait - poll the reviewer run, then re-render [recommended]
+2. merge - squash onto main (not available: reviewer still running)
+3. fix - apply the nit payload in the worktree, re-run the gate, push
+4. propose ticket change - show the AC4 edit for approval before it posts
+5. reply - post the drafted reply to maria
+6. show evidence - gate output, CI run
+7. stop - leave the PR as-is
+Type a number, or compose: "merge anyway", "fix nits".
 ```
 
-Golden fixture 3 - the same PR after `wait` completes. (a) The run concluded
-`failure` and the bot rewrote its comment to the error header:
-
-```markdown
-## Evidence
-  reviewer check <name> failed - inert (reviewer failure never withholds)
-
-## Comment-thread replies
-  C1. <thread ref> -> superseded by C3
-  C2. <thread ref> -> superseded by C4
-  C3. <thread ref> -> superseded by C5
-  C4. <thread ref> -> <drafted reply>  (reasonable)
-  C5. <thread ref> -> reviewer failed (error)  https://github.com/<owner>/<repo>/actions/runs/<run-id>
-
-Pick one:
-  1. merge-squash   [recommended]
-  2. merge-commit
-  3. stop (leave as-is)
-  4. review-comment
-  5. Custom
-```
+Fixture 3 - a different PR: your own, ticket fully covered, no nits, no drafted replies; the reviewer bot's run was the only withhold and `wait` just returned.
+
+(a) The run concluded `failure`: the `PR comments` line disappears, the reviewer check is inert, the verdict is `mergeable - CI green on the assessed head (test)`, and the menu is `merge` [recommended], `fix`, `show evidence`, `stop`.
+
+(b) The run concluded `success` and the verdict comment raises a retry bug; source review confirms it and mints a blocker:
 
-(b) The run concluded `success`; the reviewer check moved from pending to
-`success` in the refreshed rollup and the comment carries the verdict. Reconcile C5 against source at the assessed head. For a confirmed retry bug missed by the previous source review, mint source-backed P11 and withhold merge; C5's triage label remains verdict-neutral:
-
-```markdown
-## Findings (blocking)
-Blocking findings (P#):
-  P11. **<source_ref>** - Retry attempts never increment. Fix: increment attempts on failure and throw after the retry limit. | Action: fix P11. [code]
-## Comment-thread replies
-  C1. <thread ref> -> superseded by C3
-  C2. <thread ref> -> superseded by C4
-  C3. <thread ref> -> superseded by C5
-  C4. <thread ref> -> <drafted reply>  (reasonable)
-  C5. <thread ref> -> <drafted reply>  (reasonable)
-Pick one:
-  1. fix P11   [recommended]
-  2. stop
-  3. review-comment
-  4. Custom
 ```
+PR comments:
+- The reviewer bot's retry concern holds up against the source, so the drafted reply confirms it. (src/retry.ts)
+
+Blockers:
+1. Retries never count up, so a failing call retries forever instead of giving up
+   after the limit. (src/retry.ts:41)
 
-When source review instead disproves C5's concern, mint no `P#` and retain the clean menu:
-
-```markdown
-## Comment-thread replies
-  C1. <thread ref> -> superseded by C3
-  C2. <thread ref> -> superseded by C4
-  C3. <thread ref> -> superseded by C5
-  C4. <thread ref> -> <drafted reply>  (reasonable)
-  C5. <thread ref> -> <drafted reply>  (judgment-call)
-
-Pick one:
-  1. merge-squash   [recommended]
-  2. merge-commit
-  3. stop (leave as-is)
-  4. review-comment
-  5. Custom
+Verdict: fixable - 1 blocker
+
+1. fix - apply the blocker in the worktree, re-run the gate, push          [recommended]
+2. review - post the blocker as a comment on your PR
+3. reply - post the drafted reply
+4. show evidence - gate output, CI run, drafted edit
+5. stop - leave the PR as-is
+Type a number, or compose: "fix 1 + reply".
 ```
 
-Golden fixture 4 - last premerge refetch finds a new human comment after merge consent. Reconcile it against source at the assessed head, abort that merge even when the concern is false, and show the refreshed menu for a new selection. A same-head identical-body timestamp edit mints the next `C#` but causes no repeat source review or test run. A bot placeholder or error header keeps its existing state and does not enter source review.
+When source review disproves the comment, no blocker is minted; the mergeable menu renders with `reply` for the drafted reply.
+
+Fixture 4 - the pre-merge refetch finds a new human comment after a `merge` pick: the merge aborts even when the concern is false, the comment is reviewed against source, and the menu re-renders for a fresh pick. A same-head identical-body timestamp edit mints a ledger row but triggers no source review or test run.

package/skills/gatekeep-pr/reference/findings.md

@@ -1,120 +1,70 @@
-# gatekeep-pr: findings
-
-Read from SKILL.md `## Assess`. Phase 4 mints the IDs the report and menu carry.
-
-## IDs
-
-`<source_ref>` is a `file:line` where one exists, else the disputed thing (a
-quoted PR-body claim, a failing gate command, a required check name).
-
-Precedence: Phase 4 and the merged rubric decide blocking vs. follow-up (the
-severity translation, AC coverage, claims, and required-check rules). This
-section only chooses which namespace (`P#` / `L#` / `F#`) renders that
-decision. Category tags and the triage bar never override an upstream
-blocking classification - a Phase-4 Moderate is always blocking (`P#` or `L#`
-per Total mapping), never demoted to `F#` by tag or by judgment call.
-
-Total mapping: every blocking element of the Verdict maps to a `P#` or `L#` -
-a blocking verdict with "None" in both groups is a rendering bug. Map: failed
-gate -> `P#` `[test]` referencing the gate command; contradicted or
-merge-proof-unverifiable material claim -> `P#` `[spec]` referencing the
-claim; scope creep with a linked issue -> `L#` `spec-conflict`; committed doc
-drift -> `L#` `doc-drift`; `partial` AC coverage -> `L#` `outdated-AC`;
-`missing` AC coverage -> `L#` `missing-behavior`. `L#` covers exactly the
-drift the Verdict already blocks on (committed doc drift, AC coverage, spec
-conflict); it widens nothing.
-
-`P#` vs `L#` boundary: code-level spec bugs (the diff contradicts the spec)
-are `P#` `[spec]`; requirement/doc mismatches (the spec or docs are stale
-relative to intent) are `L#`.
-
-Labelled `C#` rows are verdict-neutral drafts: they never gate merge, and
-nothing posts until selected. The `pending` state, a queued/in-progress
-reviewer run, and a failed comment refetch withhold pre-composed `merge-*`
-courses at the menu level (`decision-menu.md` `## Pending-reviewer overlay`);
-they are not `## Verdict` preconditions.
-
-**`C#` ledger.** Each `C#` row carries its comment `id` and the `updated_at`
-it was minted against; the post-push diff (`post-selection-loop.md`
-`### Re-render`) runs against this ledger, never against the report text.
-States rendered under a `C#`: a triage label (`already-addressed` /
-`reasonable` / `judgment-call`) with a drafted reply; `superseded by C<new>`;
-`withdrawn`; `pending`; `reviewer failed (<conclusion>)`. Superseded and
-withdrawn rows keep rendering for the rest of the run, so a sticky bot's
-chain reads `C1` (old verdict) `superseded by C3`, `C3 pending`, then
-`C3 superseded by C5`, `C5 <label> -> <reply>`. The last four states carry no
-reply and are not replyable: `reply all` and ranges skip them silently; an
-explicitly named non-replyable `C#` is refused with its state named and the
-menu re-renders; reply courses are omitted when no replyable `C#` exists.
-
-`F#` items carry an owner (pr-author | tracker | human) so follow-ups don't
-evaporate; when no tracker tool resolved, the report itself is their durable
-home.
-
-IDs are append-only for the run's lifetime: minted at first assessment, never
-renumbered, never reused. A resolved finding keeps its ID annotated
-`(fixed in <sha>)`; later rounds continue each namespace's sequence.
-
-Empty groups say "None".
-
-## Triage
-
-A finding lands in `P#` only when it must be fixed before merge (correctness,
-security, material performance trap, a convention the repo enforces);
-improvements that don't change merge correctness are `F#`, whatever their
-category. `[quality]` and `[performance]` on a `P#` are categories, never a
-downgrade - every `P#` blocks. This triage bar governs findings the
-orchestrator originates itself; it never re-triages a classification Phase 4
-already made (see Precedence in `## IDs`).
+# gatekeep-pr: step 5 - integrate
+
+Read from SKILL.md step 5, before `report.md`. Inputs: the digest, the step-2 AC rows, the step-3 evidence and claim dispositions, the step-4 reviewer output and comment ledger. Output: AC outcomes, blockers, nits, drafted payloads - the report's content, not its rendering.
+
+## Provenance
+
+Local evidence: `worktree_root` matches the provisioned path, every `run_cwd` sits inside it, `head_sha` matches the digest's `headRefOid`. On mismatch, re-fetch the PR head once and re-sync + re-run steps 3-4 when it advanced; a second mismatch, or any path mismatch, is missing evidence. The evidence clause names its source exactly: local -> `verification command passed locally`; CI -> `CI green on the assessed head (<check name>)`, never worded as a local run.
+
+## AC outcomes
+
+Inputs: the ticket AC rows (step 2), the source behind the diff at the assessed `headRefOid`, tests in the diff and existing tests the diff reaches, docs in the diff and docs the diff makes stale, CI per the brief's Evidence resolution table. PR body, PR comments, and a spec inside the PR are leads to verify, never evidence.
+
+Split each AC row once into a **mechanism half** (code + test + doc that make the behavior possible) and, when the row names an observation that needs an environment, dataset, deployed target, or external system that repository tests cannot reach, an **observation half**. Behavior a unit test can assert ("retries three times then fails", "rejects a nil name") is mechanism, never an observation half. A `venue:` disposition in the PR's spec is a lead to compare against the ticket's own AC text, never proof and never an exemption. Judge the mechanism half only; the observation half is checked after merge, not here, and blocks nothing.
+
+| Outcome | Condition | Renders as | Blocks |
+|---|---|---|---|
+| `covered` | evidence matches what the AC promises: executable behavior needs the code path plus a real test that exercises it; a documentation-only AC is judged against the promised doc text and demands no test; in both cases docs that describe the behavior agree with it | counted in `Delivers` | no |
+| `gap` | any part of the mechanism absent in this PR | one `Blockers` item | yes - a mechanism `gap` is a blocker |
+| `not judged here` | the observation half; the mechanism half of the same row is still judged `covered`/`gap` | one `Delivers` clause ("<row>'s observable half is checked after merge, not here"); nothing is written, listed, or handed to check-delivery | no |
+| `impossible` | a `gap` whose fix is on the ticket - all four conditions below hold | one `Ticket changes` item with a drafted replacement AC text, in state `drafted` or `proposed` | withholds `merge` until the ticket body changes or the human picks `merge anyway - accept AC<n> as impossible` |
+
+`impossible` requires all of: (1) no change to this repository can satisfy the mechanism half; (2) the constraint is cited - a vendor/platform doc URL, a dependency's released API at `file:line` or in its changelog, a repo policy at `file:line`, or a second AC in the same ticket whose quoted text contradicts this one; (3) the cited source was read this run; (4) the reason is none of: cost, effort, "needs another PR", "needs a deploy first" (that is `not judged here`), a `deviates:`/`deferred:` disposition in the PR's spec, "the AC is ambiguous" (an ambiguous row stays judged as written). Anything failing a condition is `gap`. Passes: the AC asks the export to include the customer's credit score and the vendor API the repository reads returns no such field (vendor doc URL cited). Fails: the AC asks for the user's local timezone and the browser sends no timezone header - a request parameter is a repository-side mechanism, so this is `gap`.
+
+**Impossible-AC lifecycle.** Three states in order: `drafted` (the proposal exists in the run), `proposed` (`propose ticket change` posted it as a tracker comment; a comment is not an edit), `resolved` (a human edited the ticket body). Every step-5 re-entry re-fetches the ticket and re-extracts the AC rows; a changed row is re-judged on the current head, so a human edit to the ticket body lifts the withhold without a PR head change. `Ticket changes` keeps one item per unresolved row, labeled `drafted` or `proposed`, and drops it only after the re-extracted row no longer meets the four conditions.
+
+**No ticket** (none linked, or fetch failed): no AC rows; `Delivers` states the PR's intent as read from its title and body; `not judged here`, `impossible`, `Ticket changes`, and scope creep do not apply.
+
+**Whole or part.** With a ticket linked, `Delivers` names coverage: *whole* when every row is `covered` or is `not judged here` with its mechanism half `covered`; *part, acceptable* when every uncovered row is either an observation half or **explicitly split** - the ticket body or a human-authored ticket comment names another tracker ref for that row, read from the tracker this run. Only the tracker waives an obligation: a spec `deferred: <where>`, a linked later PR, or a `proposed` (not yet `resolved`) ticket change is a lead to check the tracker, never a waiver. Any other uncovered row is `gap`: "a later PR will add X" in the PR body, an unchecked box with no tracker split, a `deferred:` the ticket does not confirm.
+
+**Claims.** The Verifier's three dispositions stand. `contradicted` is a blocker. `unverifiable-pre-merge` is not evidence and renders nothing: a PR whose only proof of a new path is "verified on stg" is blocked by the untested-path rubric row, not by a claim rule.
+
+## Namespaces
+
+Every finding is one of two:
+
+| Namespace | Contents | Gates merge |
+|---|---|---|
+| blocker | code defects, security, untested new path, `contradicted` claim, AC `gap`, scope creep against a linked ticket (diff content traceable to no AC and no stated intent), doc drift beyond wording (a doc now describes behavior the code does not have, or omits an operation or parameter the code adds), failed gate or undispositioned failing check | yes |
+| nit | wording-only doc drift (typo, label, phrasing with the same meaning), style, reuse of an existing helper, naming | no; take-or-leave at the menu; untracked after the run |
+
+Behavior the ticket promises is a blocker or an explicit tracker split - never deferred to a PR nobody opened.
+
+**Severity translation.** Reviewer Critical and Moderate -> blocker; Minor -> nit. A repo `REVIEW.md` mapping overrides this; a severity it names but does not map is fail-safe blocker, noted in `show evidence`.
+
+**Triage bar** for findings the orchestrator originates itself: blocker only when it must be fixed before merge (correctness, security, a material performance trap, a convention the repo enforces); everything else is a nit, whatever its category. The bar never re-triages a classification the severity translation already made.
+
+**Internal IDs.** `P#` (blocker or nit on code, a claim, a check), `L#` (AC `gap`, doc drift, scope creep), and the comment ledger's `C#` survive as keys for the post-push re-render diff and the fix wave; the human never sees them. IDs are append-only for the run: minted once, never renumbered, never reused. A fixed blocker leaves the rendered list on the next render; its ID stays in the ledger.
+
+**`C#` ledger.** Each ledger row carries its comment `id` and the `updated_at` it was minted against; the post-push diff (`post-selection-loop.md` `### Re-render`) runs against this ledger, never against the report text. Row states: a triage label (`already-addressed` / `reasonable` / `judgment-call`) with a drafted reply; `superseded by C<new>`; `withdrawn`; `pending`; `reviewer failed (<conclusion>)`. The last four carry no reply and are not replyable; `reply` skips them.
 
 ## Dispositions
 
-Any blocking conclusion in the resolved check set (required or not - per
-`../verification-brief.md` Section B, Evidence resolution table) withholds
-merge from every pre-composed course until the user explicitly dispositions
-it, and mints a `P#` - except the reviewer check. claude-code-action's sticky
-mode runs on `pull_request` events, so its job is also a check run: a failing
-check whose run id (from its `url` / `detailsUrl`) matches a `reviewer failed`
-`C#` row, or whose `workflowName` equals the recorded reviewer `workflowName`
-while that run is `reviewer failed`, is inert when it is the only failing
-check mapping to that run id (two or more failing checks on one run id: none
-inert, each stays a `P#`, fail-safe) - no `P#`, no withhold, one `## Evidence`
-line `reviewer check <name> failed - inert (reviewer failure never withholds)`.
-With no sibling `success` left, evidence resolves to the Fallback row, not
-Failed CI. Reviewer failure never withholds merge; GitHub-enforced
-restrictions still apply.
-
-An undispositioned failing check in the resolved set is `P#` `[test]`
-referencing the check name; it is never a target of a worktree `fix`. Close
-failing checks by disposition, not by fix: the user's Phase-4 disposition
-annotates the same ID rather than closing it outright.
-
-| Disposition | Annotation on the `P#` | Counts against unfixed-blocker set | Merge course | Fallback local run |
-|---|---|---|---|---|
-| undispositioned failing check | none yet | yes | withheld from every pre-composed course | none |
-| flaky | `(dispositioned: flaky)` | excepted - no longer counts against "every `P#` blocks" or "every blocking finding fixed" | only the custom row naming the disposition explicitly; no pre-composed course restores | none |
-| real | `(dispositioned: real)` | still counts - `P#` keeps blocking | withheld until the check is green | none |
-| CI-infrastructure-broken | `(dispositioned: ci-infrastructure-broken)` | still counts - `P#` keeps blocking; the checks themselves are untrustworthy | withheld until the fallback run is green | triggers the fallback local run, and merge stays withheld until that fallback produces green evidence |
-| pending required check | mints no `P#`, is never dispositioned | not applicable - not dispositionable | withheld; auto-lifts the moment it turns green, or converts to an undispositioned failing check with its own `P#` on failure | none |
-| reviewer check failed (matches a `reviewer failed` `C#`) | mints no `P#`, is never dispositioned | not applicable - inert | not withheld; GitHub-enforced restrictions still apply | none |
-
-A pending required check is wait-until-green, not dispositionable. While
-pending, the report notes it under Evidence.
-
-The evidence decision is independent of the merge decision: a green check
-elsewhere in the resolved set still satisfies verification evidence while a
-pending required check withholds merge. The CI-sufficient path changes no
-consent surface: still read-only, no auto-merge, no posting, no menu change
-beyond the third disposition.
-
-## Payloads
-
-"Drafted fixes / review" holds, per finding ID, the concrete edit (for
-`fix`), the reviewed doc-drift edit (for `push-docs`, keyed to its `L#`), or
-the reply text (for `reply`) - each keyed to its finding ID, one selection
-mapping 1:1 to its payload.
-
-A posted review body is not itself a finding: compose it at post time from
-the ID'd `P#`/`L#` findings being addressed - one summary sentence, then the
-numbered findings, ending on the fix or asked action - and give it its own
-non-finding slot of this section.
+Any blocking conclusion in the resolved check set (required or not - `../verification-brief.md` Section B, Evidence resolution table) withholds `merge` until the user dispositions it, and mints a `P#` - except the reviewer check, whose exception the brief's Section B defines (one `show evidence` line `reviewer check <name> failed - inert`). An undispositioned failing check is never a target of `fix`; close it by disposition. A pending required check mints nothing and is not dispositionable: merge waits until it turns green, or it converts to a failing check with its own `P#`.
+
+| Disposition | Annotation on the `P#` |
+|---|---|
+| undispositioned failing check | none yet |
+| flaky | `(dispositioned: flaky)` |
+| real | `(dispositioned: real)` |
+| CI-infrastructure-broken | `(dispositioned: ci-infrastructure-broken)` |
+
+Only `flaky` lifts the blocker; an undispositioned check, `real`, and `ci-infrastructure-broken` keep it until the check - or, for `ci-infrastructure-broken`, the fallback local run (brief Section B, Failed CI row) - is green.
+
+How each disposition changes the menu: `decision-menu.md` `## Overlays`, CI check row.
+
+## Drafted payloads
+
+Step 5 drafts, never applies. For every blocker and nit with a file-level fix - code and doc drift alike - draft the concrete edit as a payload keyed to the finding's internal ID. For every `impossible` row, draft the replacement AC text. For every replyable `C#`, draft the reply. The worktree stays tracked-clean (`git status --porcelain --untracked-files=no` empty) at every menu render; a payload is applied only on a `fix` pick (the same path for code and docs) and dropped at teardown otherwise.
+
+A posted review body is composed at post time from the blockers being addressed - one summary sentence, then the numbered items, ending on the fix or asked action.