pi-pr-review 1.17.1 → 1.17.3

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.17.3](https://github.com/10ego/pi-pr-review/compare/v1.17.2...v1.17.3) (2026-08-31)
+
+
+### Bug Fixes
+
+* **review:** preserve validated confidence ratings ([#128](https://github.com/10ego/pi-pr-review/issues/128)) ([27843b7](https://github.com/10ego/pi-pr-review/commit/27843b7c6469827e65fc5d7c69511b20be3615ba))
+
+## [1.17.2](https://github.com/10ego/pi-pr-review/compare/v1.17.1...v1.17.2) (2026-08-31)
+
+
+### Bug Fixes
+
+* **review:** keep degraded comments concise ([#126](https://github.com/10ego/pi-pr-review/issues/126)) ([912e474](https://github.com/10ego/pi-pr-review/commit/912e474d04be9db504d2ea83bcd9a7c86db2ca5b))
+
 ## [1.17.1](https://github.com/10ego/pi-pr-review/compare/v1.17.0...v1.17.1) (2026-08-31)
 
 

package/README.md

@@ -195,7 +195,7 @@ Every invocation has a host-owned monotonic 15-minute hard cap, including the tw
 
 A timed-out or retryable quota/rate-limit/capacity lane may start at most one configured fallback attempt. It starts only when at least `minimumFallbackMs` plus cleanup reserve remains; the host never changes the configured model, thinking level, or tool policy to save time. If a tier is unset, its existing nearest-configured-tier/Pi-default behavior is unchanged.
 
-On an attempt deadline the host records timeout separately from user cancellation, sends TERM to the original child, waits only `terminationGraceMs`, then sends KILL if no exit was observed and stops draining after the cleanup reserve. Partial assistant text and telemetry survive this lifecycle. The synthesis cap arms only once review work goes quiet: any turn that starts or any review tool that runs again while the cap is armed defers it, and it re-arms from the next turn end, so early review-tool turns (for example verification discovery) cannot starve later heavy lanes. Batch/total expiry stops queued work and waiting lanes; completed and partial artifacts proceed to Markdown synthesis or deterministic lane assembly, identify every incomplete reviewer, and remain eligible for the safe body-only `COMMENT` publication path. A timed-out lane is never reported as `NO FINDINGS` or full coverage, and a lane ended by the host total or synthesis deadline is disclosed with that kind (`deadline_expired`) instead of being mistaken for its own attempt deadline expiring. Host lane artifacts are authoritative for completeness in both directions: a false assistant completion claim cannot upgrade incomplete lanes, and a paraphrased or omitted `Lane completeness` line cannot downgrade a host-complete batch away from the concise renderer.
+On an attempt deadline the host records timeout separately from user cancellation, sends TERM to the original child, waits only `terminationGraceMs`, then sends KILL if no exit was observed and stops draining after the cleanup reserve. Partial assistant text and telemetry survive this lifecycle. The synthesis cap arms only once review work goes quiet: any turn that starts or any review tool that runs again while the cap is armed defers it, and it re-arms from the next turn end, so early review-tool turns (for example verification discovery) cannot starve later heavy lanes. Batch/total expiry stops queued work and waiting lanes; completed and partial artifacts proceed to Markdown synthesis or deterministic lane assembly, identify every incomplete reviewer, and remain eligible for the concise body-only `COMMENT` publication path. A timed-out lane is never reported as `NO FINDINGS` or full coverage, and a lane ended by the host total or synthesis deadline is disclosed with that kind (`deadline_expired`) instead of being mistaken for its own attempt deadline expiring. Host lane artifacts are authoritative for completeness in both directions: a false assistant completion claim cannot upgrade incomplete lanes, and a paraphrased or omitted `Lane completeness` line cannot downgrade a host-complete batch away from the concise renderer.
 
 Initial operating targets are ordinary-review p50 ≤ 6 minutes and p95 ≤ 12 minutes, and large-review p50 ≤ 10 minutes and p95 ≤ 14 minutes, with the 15-minute hard cap authoritative. Invocation telemetry starts before GitHub preflight and records configured deadline source/caps, termination grace, cleanup reserve, and active wall time; batch details record invocation time consumed before each attempt, batch/total time remaining at dispatch, first event/output timing, lifecycle counts, configured and effective batch-truncated attempt deadlines, fallback starts/budget rejections, external total/synthesis deadline expiries per lane, and termination grace/escalation data. These are initial production targets, not a promise that every provider completes before its host deadline.
 
@@ -227,11 +227,11 @@ Publishing is off by default.
 
 The extension owns normal publishing. Before review execution it captures repository, hostname, PR number/title, reviewed head, lifecycle state, posting/stale authority, and invocation identity independently of assistant text. After synthesis, it caches one validated completed review (the host-owned canonical artifact) per repository and PR in the current Pi session. `autoPostReviews` and `--comment` publish that cached review after completion; `--no-comment` suppresses publication for the run.
 
-Review semantics are Markdown-first. A deterministic tolerant parser normalizes line endings, extracts complete findings when possible, and ignores heading-like text inside CommonMark fenced-code and HTML-block contexts. Every degraded synthesis — ambiguous, partially parsed, incomplete lane coverage, or absent terminal synthesis — publishes one deterministic host-rendered `COMMENT` body with generic code-review labels: a `Coverage` section with the exact lane lifecycle disclosure, a `Findings` section with host-formatted parsed findings (never a clean-review claim when nothing parsed), and the complete original synthesis plus every retained lane artifact preserved verbatim under `Retained synthesis` / `Retained lane output` with heading levels shifted so they nest. A contradictory completion claim inside retained text is reconciled to the host verdict. Reserved markers are sanitized, size limits are enforced, and the canonical marker is appended only by host code. Optional formatting repair is never required and can never suppress the degraded fallback.
+Review semantics are Markdown-first. A deterministic tolerant parser normalizes line endings, extracts complete findings when possible, and ignores heading-like text inside CommonMark fenced-code and HTML-block contexts. Every degraded synthesis — ambiguous, partially parsed, incomplete lane coverage, or absent terminal synthesis — is retained internally as one deterministic host-rendered artifact with generic code-review labels: a `Coverage` section with the exact lane lifecycle disclosure, a `Findings` section with host-formatted parsed findings (never a clean-review claim when nothing parsed), and the complete original synthesis plus every retained lane artifact preserved under `Retained synthesis` / `Retained lane output`. GitHub publication never dumps that artifact: it emits a concise `COMMENT` with a short incomplete-coverage or unstructured-output warning, validated inline findings, and summary-only `Other Notes`. Reserved markers are sanitized, size limits are enforced, and the canonical marker is appended only by host code. Optional formatting repair is never required and can never suppress the degraded fallback.
 
 You can publish the cache later with `/pr-review-publish 123`, or directly ask the agent to “post the inline review,” “post it as an inline review,” or “publish the review for PR #123.” The extension handles that request directly before an agent turn. `/pr-review-publish` and a matching direct request publish only the cache; they never start or rerun review agents. Unnumbered direct requests select the latest cached review for the current repository. Only fresh interactive/RPC input can use the direct path.
 
-Every authorized publish path builds one GitHub review payload and sends at most one review `POST`; it never submits `REQUEST_CHANGES` or retries a rejected write with a fallback POST. Fully parsed Markdown with one complete retained artifact for every host-registered dispatch may emit a gated `APPROVE` through the same host binding, priority, lifecycle, self-author, and stale checks as strict JSON. Host lane evidence is authoritative for completeness: a paraphrased or omitted `All requested lanes completed.` disclosure cannot downgrade a host-complete batch, and a false disclosure cannot upgrade incomplete or missing lane coverage; the assistant's canonical line is consulted only when no batch evidence exists. Verdict fields outside the document preamble, hidden in CommonMark code/HTML blocks, or inside lazy container continuations, severity-tagged headings outside `Findings`, incomplete or missing host lane coverage, malformed or unsafe output, and lane-fallback artifacts remain `COMMENT` reviews; their safely parsed findings keep inline placement, while unparsable output publishes body-only. Cache restore reclassifies persisted lane output and requires the exact host-recorded artifact key set, with every complete artifact matching the frozen invocation generation, tier, and minor-hygiene contract, and re-synthesizes the retained raw text under that frozen binding before retaining approval eligibility. For a current, open PR, the first 50 eligible P0–P3 findings with valid, unique diff anchors are inline. The concise top-level body starts with the verdict, points readers to inline findings, and places nits, off-diff findings, unavailable diff metadata, duplicate anchors, and overflow under `Other Notes`; overview, verification, strengths, and transport diagnostics stay out of the public summary. The complete original Markdown remains retained internally and is never substituted for a fully parsed concise review. If the concise body plus its canonical marker exceeds GitHub's limit, publication fails closed rather than dumping the full report. Stale or authorized non-open reviews are body-only. A stale approval additionally requires `allowStaleApprovals: true`.
+Every authorized publish path builds one GitHub review payload and sends at most one review `POST`; it never submits `REQUEST_CHANGES` or retries a rejected write with a fallback POST. Fully parsed Markdown with one complete retained artifact for every host-registered dispatch may emit a gated `APPROVE` through the same host binding, priority, lifecycle, self-author, and stale checks as strict JSON. Host lane evidence is authoritative for completeness: a paraphrased or omitted `All requested lanes completed.` disclosure cannot downgrade a host-complete batch, and a false disclosure cannot upgrade incomplete or missing lane coverage; the assistant's canonical line is consulted only when no batch evidence exists. Verdict fields outside the document preamble, hidden in CommonMark code/HTML blocks, or inside lazy container continuations, severity-tagged headings outside `Findings`, incomplete or missing host lane coverage, malformed or unsafe output, and lane-fallback artifacts remain `COMMENT` reviews; their safely parsed findings keep inline placement, while unparsable output publishes body-only. Cache restore reclassifies persisted lane output and requires the exact host-recorded artifact key set, with every complete artifact matching the frozen invocation generation, tier, and minor-hygiene contract, and re-synthesizes the retained raw text under that frozen binding before retaining approval eligibility. For a current, open PR, the first 50 eligible P0–P3 findings with valid, unique diff anchors are inline. The concise top-level body starts with the verdict, points readers to inline findings, and places nits, off-diff findings, unavailable diff metadata, duplicate anchors, and overflow under `Other Notes`; overview, verification, strengths, and transport diagnostics stay out of the public summary. The complete original Markdown and retained lane evidence remain internal and are never substituted for a concise GitHub review, including degraded, incomplete, cached, direct, and stale `COMMENT` publication. If the concise body plus its canonical marker exceeds GitHub's limit, publication fails closed rather than dumping the full report. Stale or authorized non-open reviews are body-only. A stale approval additionally requires `allowStaleApprovals: true`.
 
 All publication paths apply host-enforced safety gates: captured posting authority, repository and requested-PR binding, reviewed/current-head and stale policy, bounded bodies and payloads, draft and lifecycle checks, non-open authorization, authenticated-identity same-head duplicate detection, and a final head check. Fully or partially parsed review paths additionally enforce safe inline locations, including degraded incomplete-lane reviews whose findings still parse. Raw and lane-assembled fallbacks without parsed findings are body-only; every degraded path is `COMMENT`-only, and assistant text cannot select event, commit, repository, hostname, API path, or inline anchors. Unknown or invalid host states fail closed before a write.
 
@@ -293,7 +293,7 @@ Each finding includes:
 
 - severity: `P0`, `P1`, `P2`, `P3`, or `nit`;
 - whether it blocks the verdict;
-- an explanation and confidence score;
+- an explanation and independently validated confidence score (the host preserves the supplied 0.0–1.0 value instead of manufacturing `1.00`; scoreless or malformed current Markdown degrades fail-closed, and pre-fix cached completion records are invalidated);
 - a diff-anchored file and line range when available.
 
 | Severity | Meaning |

package/extensions/review-table.ts

@@ -432,6 +432,16 @@ type ReviewPublicationOrigin =
 	| { readonly kind: "publish-command"; readonly stalePolicy: "frozen" | "allow-stale" }
 	| { readonly kind: "direct-request" };
 
+function conciseDegradedPublicationNotice(record: CompletedReviewRecord): string | undefined {
+	if (record.completeness === "incomplete") {
+		return "> [!WARNING]\n> Review coverage was incomplete. This COMMENT is not evidence of a clean review.";
+	}
+	if (record.synthesisQuality !== undefined && record.synthesisQuality !== "fully_parsed") {
+		return "> [!WARNING]\n> The review output was not fully structured. This COMMENT is not evidence of a clean review.";
+	}
+	return undefined;
+}
+
 async function publishCompletedReview(
 	record: CompletedReviewRecord,
 	origin: ReviewPublicationOrigin,
@@ -459,8 +469,9 @@ async function publishCompletedReview(
 		ctx.ui.notify("PR review was not posted: cached review artifact is missing pr.head_sha", "error");
 		return undefined;
 	}
-	const useDegradedPublicationBody = typeof record.publicationBody === "string" &&
-		(record.synthesisQuality !== "fully_parsed" || record.completeness === "incomplete");
+	const degradedPublication = record.completeness === "incomplete" ||
+		(record.synthesisQuality !== undefined && record.synthesisQuality !== "fully_parsed");
+	const publicationNotice = conciseDegradedPublicationNotice(record);
 	const result = await publishPullReview({
 		cwd: ctx.cwd,
 		prNumber: record.invocation.prNumber,
@@ -471,21 +482,18 @@ async function publishCompletedReview(
 		approveMaxPriorityLevel: record.invocation.approveMaxPriorityLevel,
 		expectedRepository: record.repository,
 		review: record.review,
-		...(useDegradedPublicationBody ? { publicationBody: record.publicationBody } : {}),
-		// Fully parsed reviews publish only the concise host-rendered body plus
-		// inline findings. If that payload cannot fit, publication fails closed;
-		// retained raw synthesis is never substituted as a public report dump.
-		// A degraded synthesis stays COMMENT-only, but its safely parsed findings
-		// still earn inline placement; only unparsable output is forced body-only.
+		...(publicationNotice ? { publicationNotice } : {}),
+		// Every review publishes only the concise host-rendered body plus validated
+		// inline findings. Retained raw synthesis and lane evidence remain private
+		// completion diagnostics, including for degraded/incomplete COMMENT runs.
+		// If the concise payload cannot fit, publication fails closed.
 		forceBodyOnly: record.synthesisQuality !== undefined &&
 			record.synthesisQuality !== "fully_parsed" &&
 			!(Array.isArray(record.review.findings) && record.review.findings.length > 0),
 		// A publication body identifies Markdown-derived or degraded synthesis.
 		// Enforce COMMENT again at the final publication boundary so restored
 		// canonical artifacts created by an older parser cannot inherit APPROVE.
-		forceComment: record.mergeApprovalEligible === false || useDegradedPublicationBody ||
-			(record.synthesisQuality !== undefined &&
-				(record.synthesisQuality !== "fully_parsed" || record.completeness === "incomplete")),
+		forceComment: record.mergeApprovalEligible === false || degradedPublication,
 	});
 	notifyPublishResult(result, source, ctx);
 	return result;

package/lib/pr-review-markdown.ts

@@ -384,14 +384,18 @@ function parseFindings(text: string): { findings: ReviewFindingLike[]; count: nu
 		const severity = explicitSeverity?.toLowerCase() === "nit" ? "nit" : explicitSeverity?.toUpperCase();
 		const normalizedTag = tagged?.toLowerCase() === "nit" ? "nit" : tagged?.toUpperCase();
 		const rationale = field(block, "Rationale") ?? field(block, "Why");
+		const confidenceText = field(block, "Confidence");
+		const confidence = confidenceText === undefined ? undefined : Number(confidenceText.trim());
+		const validConfidence = confidenceText !== undefined &&
+			/^(?:0(?:\.\d+)?|1(?:\.0+)?)$/.test(confidenceText.trim()) && Number.isFinite(confidence);
 		const location = parseLocation(field(block, "Location"));
 		const recognizedFieldCount = fieldCount(block, "Severity") + fieldCount(block, "Rationale") +
-			fieldCount(block, "Why") + fieldCount(block, "Location");
-		const unconsumed = block.replace(/^\*\*(?:Severity|Rationale|Why|Location):\*\*.*$/gim, "").trim();
+			fieldCount(block, "Why") + fieldCount(block, "Confidence") + fieldCount(block, "Location");
+		const unconsumed = block.replace(/^\*\*(?:Severity|Rationale|Why|Confidence|Location):\*\*.*$/gim, "").trim();
 		if (
-			!explicitSeverity || !rationale?.trim() || recognizedFieldCount < 2 || unconsumed ||
+			!explicitSeverity || !rationale?.trim() || recognizedFieldCount < 2 || unconsumed || !validConfidence ||
 			fieldCount(block, "Severity") !== 1 || fieldCount(block, "Rationale") + fieldCount(block, "Why") !== 1 ||
-			fieldCount(block, "Location") > 1
+			fieldCount(block, "Confidence") !== 1 || fieldCount(block, "Location") > 1
 		) {
 			complete = false;
 			continue;
@@ -410,7 +414,7 @@ function parseFindings(text: string): { findings: ReviewFindingLike[]; count: nu
 			severity,
 			blocking: severity === "P0" || severity === "P1",
 			body: rationale,
-			confidence_score: 1,
+			confidence_score: confidence,
 			code_location: location.location,
 		});
 	}
@@ -470,7 +474,6 @@ function syntheticReview(
 		verdict,
 		overall_correctness: verdict === "request_changes" ? "patch is incorrect" : "patch is correct",
 		overall_explanation: overview.split(/\n\n|\n/)[0] ?? "Review completed.",
-		overall_confidence_score: 1,
 	};
 }
 
@@ -840,9 +843,9 @@ export function synthesizeReviewArtifact(input: {
 		}
 		return reasons.length > 0 ? reasons : ["terminal synthesis was not structurally parseable; preserved as body-only Markdown"];
 	})();
-	// Markdown is the durable semantic product. A fully parsed complete synthesis
-	// publishes verbatim; every degraded synthesis publishes the deterministic
-	// host-rendered body so labels stay readable while all content is retained.
+	// Markdown is the durable semantic product. Keep the complete deterministic
+	// body for local rendering, cache diagnostics, and extraction. GitHub
+	// publication independently renders a concise host summary for every quality.
 	const body = quality === "fully_parsed"
 		? safeReviewBody(raw)
 		: buildDegradedReviewBody({

package/lib/pr-review-publish.ts

@@ -596,7 +596,7 @@ export interface CompletedReviewSessionIdentity {
 }
 
 export interface PersistedCompletedReview {
-	schemaVersion: 2;
+	schemaVersion: 3;
 	session: CompletedReviewSessionIdentity;
 	invocation: ReviewInvocation;
 	repository: RepositoryBinding;
@@ -819,7 +819,7 @@ export class CompletedReviewCache {
 		const digest = reviewHash(record.review);
 		const useReference = !!reviewEntryId && !!referencedReview && reviewHash(referencedReview) === digest;
 		return {
-			schemaVersion: 2,
+			schemaVersion: 3,
 			session: { ...session },
 			invocation: { ...record.invocation, autoPost: { ...record.invocation.autoPost } },
 			repository: { ...record.repository },
@@ -849,7 +849,7 @@ export class CompletedReviewCache {
 	): boolean {
 		if (
 			!isObject(value) ||
-			value.schemaVersion !== 2 ||
+			value.schemaVersion !== 3 ||
 			!validSessionIdentity(value.session) ||
 			!sameSessionIdentity(value.session, session) ||
 			!validRepositoryBinding(value.repository)
@@ -866,7 +866,7 @@ export class CompletedReviewCache {
 		const candidate = hasReference ? referencedReview : value.review;
 		let parsed: PublishableReviewParseResult;
 		try {
-			parsed = parsePublishableReview(JSON.stringify(candidate));
+			parsed = canonicalReviewSnapshot(candidate as ReviewLike);
 		} catch {
 			return false;
 		}
@@ -1083,7 +1083,10 @@ function publishableReviewEnvelope(text: string): { text: string; source: "json"
  * Publication accepts one complete JSON object. A single surrounding Markdown code
  * fence is tolerated for compatibility but remains distinguishable from exact JSON.
  */
-export function parsePublishableReview(text: string): PublishableReviewParseResult {
+export function parsePublishableReview(
+	text: string,
+	options: { allowMissingOverallConfidence?: boolean } = {},
+): PublishableReviewParseResult {
 	const envelope = publishableReviewEnvelope(text);
 	let value: unknown;
 	try {
@@ -1140,7 +1143,11 @@ export function parsePublishableReview(text: string): PublishableReviewParseResu
 	if (!new Set(["patch is correct", "patch is incorrect"]).has(String(value.overall_correctness))) {
 		return { error: "overall_correctness is invalid" };
 	}
-	if (!isConfidence(value.overall_confidence_score)) {
+	if (
+		value.overall_confidence_score !== undefined
+			? !isConfidence(value.overall_confidence_score)
+			: !options.allowMissingOverallConfidence
+	) {
 		return { error: "overall_confidence_score is invalid" };
 	}
 	return { review: value as unknown as ReviewLike, source: envelope.source };
@@ -1257,7 +1264,11 @@ function findingAnchor(finding: ReviewFindingLike): string | undefined {
 	return `${path}:${side}:${start}:${end}`;
 }
 
-export function buildReviewSummary(review: ReviewLike, inlineComments: PublishComment[] = []): string {
+export function buildReviewSummary(
+	review: ReviewLike,
+	inlineComments: PublishComment[] = [],
+	publicationNotice?: string,
+): string {
 	const findings = Array.isArray(review.findings) ? review.findings : [];
 	const inlineAnchors = new Map<string, number>();
 	for (const comment of inlineComments) {
@@ -1281,6 +1292,7 @@ export function buildReviewSummary(review: ReviewLike, inlineComments: PublishCo
 			? "Approve"
 			: "Comment";
 	const lines = [`**Verdict:** ${verdict}`];
+	if (publicationNotice?.trim()) lines.push("", publicationNotice.trim());
 	if (inlineComments.length > 0) {
 		lines.push("", "See the inline review comments for the primary findings.");
 	}
@@ -1416,7 +1428,10 @@ export function canonicalReviewSnapshot(review: ReviewLike): PublishableReviewPa
 	if (typeof serialized !== "string") {
 		return { error: "review could not be serialized for publication" };
 	}
-	return parsePublishableReview(serialized);
+	// Host-synthesized canonical Markdown has no manufactured overall score,
+	// but every parsed finding still requires its validated numeric confidence.
+	// Assistant-authored strict JSON requires both at its public parse boundary.
+	return parsePublishableReview(serialized, { allowMissingOverallConfidence: true });
 }
 
 export function validateInlineComments(
@@ -1503,6 +1518,7 @@ function buildLosslessReviewPayload(input: {
 	changedFiles?: readonly ChangedFileLike[];
 	bodyPreamble?: string;
 	bodyOverride?: string;
+	publicationNotice?: string;
 	diagnostics?: readonly string[];
 	event?: ReviewEventType;
 }): { payload?: PullReviewPayload; diagnostics: string[]; errors: string[] } {
@@ -1520,6 +1536,9 @@ function buildLosslessReviewPayload(input: {
 	if (input.bodyPreamble && containsReservedReviewMarker(input.bodyPreamble)) {
 		return { diagnostics, errors: ["publication preamble contains a reserved pi-pr-review marker"] };
 	}
+	if (input.publicationNotice && containsReservedReviewMarker(input.publicationNotice)) {
+		return { diagnostics, errors: ["publication notice contains a reserved pi-pr-review marker"] };
+	}
 	const selected = input.allowInlineComments
 		? selectInlineComments(input.review, input.changedFiles ?? [])
 		: { comments: [], diagnostics: [], errors: [] };
@@ -1529,7 +1548,10 @@ function buildLosslessReviewPayload(input: {
 	// Inline-placement diagnostics remain available to the host notification,
 	// while every affected finding is retained under Other Notes. Do not expose
 	// transport diagnostics as if they were review findings.
-	let content = input.bodyOverride?.trim() || buildReviewSummary(input.review, selected.comments);
+	let content = input.bodyOverride?.trim() || buildReviewSummary(input.review, selected.comments, input.publicationNotice);
+	if (input.bodyOverride?.trim() && input.publicationNotice?.trim()) {
+		content = `${content}\n\n${input.publicationNotice.trim()}`;
+	}
 	if (input.bodyPreamble?.trim()) content = `${input.bodyPreamble.trim()}\n\n${content}`;
 	const marker = canonicalReviewMarker(markerHeadSha);
 	const bodyError = validateReviewBody(content);
@@ -2148,8 +2170,10 @@ export async function publishPullReview(input: {
 	approveMaxPriorityLevel?: ApproveMaxPriorityLevel;
 	expectedRepository?: RepositoryBinding;
 	review: ReviewLike;
-	/** Host-sanitized original synthesis retained when structured extraction is partial or absent. */
+	/** Compatibility-only body override. The extension lifecycle keeps retained synthesis private. */
 	publicationBody?: string;
+	/** Short host-owned warning included in the concise summary. */
+	publicationNotice?: string;
 	/** Prevent uncertain/raw synthesis from selecting APPROVE or inline anchors. */
 	forceBodyOnly?: boolean;
 	/** Prevent partially trusted synthesis from selecting a merge-relevant event. */
@@ -2166,6 +2190,7 @@ export async function publishPullReview(input: {
 		expectedRepository,
 		review,
 		publicationBody,
+		publicationNotice,
 		forceBodyOnly = false,
 		forceComment = false,
 	} = input;
@@ -2266,6 +2291,7 @@ export async function publishPullReview(input: {
 			allowInlineComments,
 			changedFiles,
 			...(publicationBody ? { bodyOverride: publicationBody } : {}),
+			...(publicationNotice ? { publicationNotice } : {}),
 			...(isApprove ? { event: APPROVE_EVENT } : {}),
 			...(changedFileLookupFailed ? { diagnostics: [CHANGED_FILE_LOOKUP_DIAGNOSTIC] } : {}),
 			...(headPlan.stale

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-pr-review",
-  "version": "1.17.1",
+  "version": "1.17.3",
   "description": "Parallel AI code review for GitHub pull requests in the Pi coding agent, with model-agnostic tiered subagents, structured findings, optional verification, and host-gated COMMENT or qualified APPROVE publishing.",
   "keywords": [
     "pi-package",

package/prompts/pr-review.md

@@ -222,6 +222,7 @@ Return Markdown using these stable headings. Do not emit a GitHub API payload an
 ### [P1] Imperative finding title
 **Severity:** P1
 **Rationale:** Concise Markdown explaining the trigger, impact, and source-grounded evidence.
+**Confidence:** 0.92
 **Location:** `path/to/file.ts:10-12 RIGHT`
 
 ## Lane completeness
@@ -231,6 +232,6 @@ Return Markdown using these stable headings. Do not emit a GitHub API payload an
 <useful strengths plus concise correctness, security, or performance notes>
 ```
 
-Repeat the `###` finding block for every confirmed finding. Omit `Location` when no safe diff location exists. Use `No findings.` under `## Findings` when empty. The extension retains the complete raw synthesis even when some or all finding blocks cannot be parsed. Canonical heading discovery ignores heading-like content in CommonMark fenced-code and HTML-block contexts. It validates safe P0–P3 anchors for inline placement, preserves ambiguous or unparsed substantive content in exactly one sanitized body-only `COMMENT`, and degrades malformed synthesis the same way; if synthesis is absent, it assembles a deterministic body-only review from retained lane artifacts. Optional formatting repair can never block this fallback.
+Repeat the `###` finding block for every confirmed finding. `Confidence` is the independently validated numeric confidence for that finding from 0.0 through 1.0; do not use a fixed default. Omit `Location` when no safe diff location exists. Use `No findings.` under `## Findings` when empty. The extension retains the complete raw synthesis even when some or all finding blocks cannot be parsed. Canonical heading discovery ignores heading-like content in CommonMark fenced-code and HTML-block contexts. It validates safe P0–P3 anchors for inline placement, preserves ambiguous or unparsed substantive content in exactly one sanitized body-only `COMMENT`, and degrades malformed synthesis the same way; if synthesis is absent, it assembles a deterministic body-only review from retained lane artifacts. Optional formatting repair can never block this fallback.
 
 Host code captures repository, PR, reviewed head, lifecycle, posting authority, stale policy, and invocation identity before review execution, serializes the single GitHub request with `JSON.stringify`, sanitizes reserved markers, enforces payload limits, appends the canonical marker, and performs duplicate/stale/draft/lifecycle/final-head checks. The assistant's semantic `approve` is only one input to the host gates; assistant text cannot directly choose `APPROVE`, `REQUEST_CHANGES`, commit ID, API path, repository, or hostname. Parent candidate validation must gather all independent evidence in one wave and use at most one dependency-driven follow-up, as specified in Step 7.