prizmkit 1.1.130 → 1.1.134

package/bundled/skills/prizmkit-code-review/SKILL.md

@@ -1,55 +1,66 @@
 ---
 name: "prizmkit-code-review"
-description: "Review the complete current change in a bounded Main-Agent loop. Adjudicate findings with evidence, directly repair accepted findings, verify repairs, and append progress until the review converges to PASS or stops with unresolved findings as NEEDS_FIXES. (project)"
+description: "Review the complete current change for a formal PrizmKit requirement with a mandatory bounded Main-Agent loop and optional capability-gated independent correctness review. Directly repair accepted corrections, verify repairs, converge to PASS or stop with NEEDS_FIXES, and hand off to prizmkit-test. (project)"
 ---
 
 # PrizmKit Code Review
 
-Use one Main-Agent review loop. The current Main Agent is the only Code Review executor: it performs the complete review, filters candidate findings, repairs accepted findings, verifies the repairs, and decides the final result.
+`/prizmkit-code-review` is the mandatory review stage after implementation and before the full test stage. The current Main Agent owns the complete baseline review loop: it discovers findings, adjudicates them, directly repairs accepted findings, verifies repairs, and continues until the review converges or stops safely. After convergence, one strictly capability-gated independent Reviewer may objectively check the complete current implementation without taking mutation or final-decision authority.
 
 ## Execution Boundary
 
-- Do not delegate any part of Code Review directly or indirectly.
+- Main-Agent review remains mandatory and must not be delegated directly or indirectly.
+- After Main-Agent convergence only, this skill may create the single independent Reviewer defined by `${SKILL_DIR}/references/independent-code-review.md` when every structural capability in that reference is proven.
 - Do not invoke another review skill or review workflow from inside this skill.
-- Do not launch review work through a general-purpose execution unit or relabel it as a finder, verifier, audit, compatibility review, verification, or gap sweep.
-- These restrictions apply for the entire review phase, including candidate discovery, evidence checks, repair verification, and final gap analysis.
-- The Main Agent may directly use non-delegating read, search, edit, and test capabilities in the active workspace.
-- `{artifact_dir}/review-report.md` is the only persisted review artifact. Do not append separate Review Notes to `context-snapshot.md`.
+- Do not launch any additional review work through a general-purpose execution unit or relabel it as a finder, verifier, audit, compatibility review, verification, or gap sweep.
+- The independent Reviewer cannot mutate, execute arbitrary commands, or create downstream execution units; prompt instructions never substitute for these structural guarantees.
+- The Main Agent may directly read, search, edit, and run targeted verification in the active workspace.
+- Review repairs occur before the full `/prizmkit-test` stage so final test evidence represents the final reviewed workspace.
+- `{artifact_dir}/review-report.md` is the only persisted review artifact for this execution.
+
+## Atomic Stage Boundary
+
+`prizmkit-code-review` owns the complete mandatory Main-Agent review, the optional independent correctness review, accepted-correction repairs, and review verification. It writes its truthful terminal result and `next_stage`, then returns control. It must not invoke `prizmkit-test` or `prizmkit-implement` itself; the active orchestrator owns outer repair routing and the next-stage invocation.
 
 ## When to Use
 
-- After `/prizmkit-implement` as the Full path quality gate
-- For Fast path when behavior, impact, or the user warrants review
-- When the user asks to validate implementation, find defects, assess regressions, or decide commit readiness
+- After `/prizmkit-implement` reports `IMPLEMENTED`.
+- After implementation repairs that changed production code, runtime configuration, schema, dependencies, or public interfaces.
+- When workflow state routes a formal requirement back to review after `TEST_FAIL`.
+- When the user asks for a complete review or commit readiness decision.
+
+## When NOT to Use
 
-## Input
+- No valid `spec.md` and `plan.md` exist for the active requirement.
+- Implementation tasks or required repair work remain incomplete.
+- A test-stage environment stop is caused by availability rather than a review concern; resume from test when the environment is available.
+- The request is a direct low-risk edit outside the formal requirement lifecycle.
+
+## Input and State
 
 | Parameter | Required | Description |
 |---|---|---|
-| `artifact_dir` | No | Directory containing `spec.md` and `plan.md`. Reuse a caller-provided directory; otherwise locate the current completed change artifact. |
-
-## Required Asset
+| `artifact_dir` | No | Directory containing `spec.md` and `plan.md`. Reuse the caller's directory or workflow-state value. |
+| `review_scope` | No | `full` for the initial review; `delta` for a production-affecting repair after a prior review pass. |
 
-- `${SKILL_DIR}/references/review-report-template.md`: report lifecycle and append contract
+Every invocation must reuse the same `artifact_dir`. If workflow state is missing, reconstruct it from `spec.md`, `plan.md`, `review-report.md`, the current diff, and any test evidence, and report the reconstruction.
 
-## Phase 0: Initialize Report and Collect Context
+## Phase 0: Initialize Report and Reuse Current Context
 
-1. Resolve `{artifact_dir}` and `{artifact_dir}/review-report.md`.
-2. At the start of every execution, replace any prior report with a new execution header using the report template. The new report begins with `## Status: IN_PROGRESS` and contains no prior Final Result.
-3. Read `spec.md`, `plan.md`, relevant `/prizmkit-test` evidence, `.prizmkit/prizm-docs/root.prizm`, applicable progressive docs, and project rules.
-4. Inspect the complete current Git change:
-   - staged and unstaged tracked changes;
-   - untracked files;
-   - deleted and renamed files;
-   - relevant unchanged callers, dependents, contracts, and tests.
-5. Review in the active workspace so dirty and untracked content is authoritative.
-6. If no changes exist, append final verification and exactly one final result with `PASS`, then finish.
+1. Resolve `{artifact_dir}` and `{artifact_dir}/review-report.md` from the active requirement context.
+2. At the start of each execution, replace any prior report with a new execution header using `${SKILL_DIR}/references/review-report-template.md`.
+3. Within that execution, append progress after every review round, repair batch, final verification, and exactly one `## Final Result`.
+4. Start from the Main Agent's current requirement context and inspect the complete workspace change first: `git status --short`, the staged diff, and the unstaged diff. Include untracked, deleted, and renamed files in the review scope.
+5. Do not reread `spec.md`, `plan.md`, project rules, progressive docs, or unchanged source merely to recreate context the Main Agent already holds. Load only the missing or potentially stale material required to resolve a concrete ambiguity, verify an acceptance criterion, understand a changed contract, or reconstruct missing workflow state.
+6. Inspect unchanged callers, dependents, contracts, or tests only when the diff changes or may violate an interface, shared behavior, or regression boundary. Do not perform an unconditional repository-wide dependency sweep.
+7. For `review_scope=delta`, focus on files and behavior affected since the prior review pass and expand only across contracts implicated by that delta.
+8. If no changes exist, record final verification and `PASS` only when the current requirement context and prior implementation state prove there is nothing left to review.
 
 ## Phase 1: Main-Agent Review Loop
 
-The Main Agent reviews and repairs in the current context. The fixed limit is ten completed review rounds.
+The Main Agent reviews the complete current change, using the active requirement context and expanding beyond the diff only when a concrete acceptance criterion, contract, dependency, or regression risk requires it.
 
-Track cumulative counts:
+Use at most ten completed review rounds per execution. Track:
 
 ```yaml
 main_review_rounds: 0
@@ -59,85 +70,120 @@ rejected_findings: 0
 unresolved_findings: 0
 ```
 
-### Review One Round
+For every candidate finding:
 
-Each round examines the complete current change against goals, contracts, rules, callers, dependents, regression risks, and test evidence.
+1. Describe a reproducible failure scenario, affected behavior, and evidence.
+2. Classify exactly one of:
+   - `accepted`: evidence proves an in-scope repair is needed;
+   - `rejected`: evidence disproves the failure scenario;
+   - `unresolved`: correctness or safe repair cannot be established.
+3. Treat Missing tools, permissions, environment, or required evidence as an unresolved finding when they prevent review verification.
+4. If a repair cannot be completed safely, record an unresolved finding and return `NEEDS_FIXES`.
+5. Append the review round to `review-report.md`.
 
-1. Identify concrete candidate findings. A finding must describe a reproducible failure scenario, affected behavior, and supporting evidence.
-2. Classify each candidate as exactly one of:
-   - `accepted`: concrete evidence supports the failure scenario and an in-scope repair is required;
-   - `rejected`: code, tests, contracts, or governing evidence disproves the failure scenario;
-   - `unresolved`: correctness cannot be established or repaired safely with the available evidence or environment.
-3. Treat Missing tools, permissions, environment, or required evidence as an unresolved finding when they prevent required verification. Do not treat missing evidence as success.
-4. Append `## Main Review Round N` with findings, accepted, rejected, unresolved, and the next action.
-5. Apply these rules:
+Round behavior:
 
 ```text
-accepted = 0 and unresolved = 0                     -> review converged
-accepted > 0 and round < 10                         -> Main Agent directly repairs, verifies, and continues
-accepted > 0 at ten completed review rounds         -> NEEDS_FIXES
-unresolved > 0                                      -> NEEDS_FIXES
-repair cannot be completed safely                   -> unresolved finding -> NEEDS_FIXES
-required verification fails or cannot be performed -> unresolved finding -> NEEDS_FIXES
-```
+accepted = 0 and unresolved = 0
+  → review converged
+  → when all candidate findings are rejected, accepted remains 0 and the review converges
 
-When all candidate findings are rejected, `accepted = 0` and `unresolved = 0`, so the review converges. Rejected findings do not cause another round.
+accepted > 0 and rounds remain
+  → Main Agent directly repairs accepted findings
+  → targeted verification
+  → next complete review round
 
-## Phase 2: Repair and Verification
+unresolved > 0 or safe repair impossible
+  → NEEDS_FIXES
+
+maximum ten completed rounds reached with accepted findings
+  → NEEDS_FIXES
+```
 
-When a round has accepted findings and fewer than ten rounds have completed:
+## Phase 2: Repair and Verification
 
-1. Main Agent directly repairs every accepted in-scope finding in the active workspace.
-2. Run targeted tests, static checks, or other verification appropriate to each repaired behavior.
-3. Inspect resulting changes and ensure the repair did not introduce a new regression.
-4. Append `## Repair Verification` with fixed findings, verification evidence, and the next round.
-5. Start the next complete review round.
+For accepted findings while the round limit remains:
 
-If a repair is unsafe, incomplete, or cannot receive required verification, record the affected finding as unresolved and finish with `NEEDS_FIXES`.
+1. Repair directly in the active workspace.
+2. Run targeted tests, static checks, or other verification appropriate to each repair.
+3. Inspect the complete resulting diff for unrelated changes and regressions.
+4. Append repair verification and continue the review loop.
 
-## Phase 3: Append-Only Reporting
+Do not run the full auditable testing protocol as a substitute for this review stage. The full testing stage follows only after review `PASS`.
 
-`{artifact_dir}/review-report.md` is the only required persisted review artifact.
+If a repair is unsafe, incomplete, or unverifiable, record an unresolved finding and finish with `NEEDS_FIXES`.
 
-Within one execution, append new sections only. Do not rewrite an earlier progress section. Append after:
+## Phase 3: Independent Code Review
 
-- every Main-Agent review round;
-- every repair and verification batch;
-- final verification;
-- the final result.
+Run only after the Main-Agent review and repair loop converges with no unresolved finding. Main-Agent review remains mandatory on every host; this optional check never replaces or weakens it.
 
-An interrupted execution remains `IN_PROGRESS` and shows its latest completed phase. It has no terminal verdict.
+1. Read `${SKILL_DIR}/references/independent-code-review.md` and follow its complete contract.
+2. Apply its all-or-nothing semantic Host Capability Gate. If any required structural capability is unavailable or unproven, create no Reviewer, append `independent-review-downgrade`, and preserve the valid completed Main-Agent review.
+3. When the gate passes, capture bounded immutable input for the complete current change and create exactly one Code Reviewer with the reference's Initial Reviewer Prompt.
+4. Use maximum five Reviewer responses. Append `independent-review-round` and `independent-adjudication` events. The Main Agent adjudicates every correction as `accepted`, `rejected`, or `unresolved` and retains all mutation authority.
+5. For accepted corrections, repair directly in the active checkout, run targeted verification, and inspect the complete resulting change.
+6. When responses remain, capture the complete fresh state and natively resume the exact same Reviewer. Never create a replacement Reviewer or simulate continuation with a fresh Reviewer plus summary.
+7. If native resume fails after repair, append downgrade and rerun the Main-Agent review over that repair within the existing ten-round safety fuse.
+8. If the fifth response causes a repair, run targeted verification, inspect the complete final change, record `Final State Independently Rechecked: no`, and do not send a sixth response.
+9. `NO_CORRECTION_NEEDED` or all corrections rejected with evidence converges independent review. Any unresolved correction produces `NEEDS_FIXES`.
 
-## Phase 4: Final Verification and Result
+## Phase 4: Final Result
 
 Before completing:
 
-1. Confirm the final workspace still represents the complete reviewed change.
-2. Confirm required tests and checks have credible evidence.
-3. Confirm no accepted or unresolved finding remains for `PASS`.
-4. Append `## Final Verification`.
-5. Append exactly one final result:
-
-```markdown
-## Final Result
-
-- Verdict: PASS | NEEDS_FIXES
-- Main Review Rounds: <count>
-- Accepted Findings: <count>
-- Fixed Findings: <count>
-- Rejected Findings: <count>
-- Unresolved Findings: <count>
-- Summary: <concise conclusion>
+1. Confirm the final workspace is the complete reviewed change.
+2. Confirm all accepted findings are fixed and no unresolved finding remains for `PASS`.
+3. Append final verification and exactly one final result.
+
+Valid results:
+
+```text
+PASS | NEEDS_FIXES
+```
+
+`PASS` requires review convergence, no unresolved findings, and credible targeted verification. `NEEDS_FIXES` means an outer implementation repair is required or completion must stop safely.
+
+## Workflow State and Outer Repair Routing
+
+Before reading or updating workflow state, read `${SKILL_DIR}/references/workflow-state-protocol.md`.
+
+On `PASS`, update workflow state:
+
+```json
+{
+  "stage": "code-review",
+  "status": "REVIEW_PASS",
+  "stage_result": "PASS",
+  "completed_stages": ["plan", "implement", "code-review"],
+  "next_stage": "test",
+  "resume_from": "prizmkit-test"
+}
+```
+
+On `NEEDS_FIXES` caused by code findings, update workflow state:
+
+```json
+{
+  "stage": "code-review",
+  "status": "REVIEW_NEEDS_FIXES",
+  "stage_result": "NEEDS_FIXES",
+  "repair_scope": "production",
+  "next_stage": "implement",
+  "resume_from": "prizmkit-implement"
+}
 ```
 
-Final outcomes:
+Increment the outer `repair_round` only when returning to implementation; the review-internal ten-round loop never increments it. The outer workflow permits at most three repair rounds and must return a truthful unresolved `NEEDS_FIXES` result instead of beginning a fourth.
 
-- `PASS`: review converged with `accepted = 0`, `unresolved = 0`, and required verification evidence is complete.
-- `NEEDS_FIXES`: round ten still has accepted findings, any finding remains unresolved, a repair cannot be completed safely, or required verification is unavailable or failed.
+## Handoff
 
-Exactly one final result is allowed. Do not append progress after Final Result.
+After `PASS`:
+
+```text
+REVIEW_PASS
+  → /prizmkit-test
+```
 
-Completion handoff:
+If workflow state names an active `orchestrator`, return `REVIEW_PASS`, the report/state paths, and `next_stage=test` to it; do not invoke test independently. For direct stage use, report the exact `/prizmkit-test` invocation and same `artifact_dir`; a host may perform that semantic handoff on the user's behalf.
 
-- `PASS`: run `/prizmkit-retrospective` when structural docs or durable knowledge changed; otherwise proceed to `/prizmkit-committer`.
-- `NEEDS_FIXES`: report unresolved findings and stop.
+After `NEEDS_FIXES`, stop and hand off to `/prizmkit-implement`; do not test or commit the unrepaired production change.

package/bundled/skills/prizmkit-code-review/references/independent-code-review.md

@@ -0,0 +1,243 @@
+# Independent Code Review
+
+## Purpose
+
+Run one optional independent correctness review after the mandatory Main-Agent review and repair loop has converged. The Reviewer determines whether the complete current implementation correctly satisfies the requirement and plan. It is not required to disagree and must return `NO_CORRECTION_NEEDED` when no correction is justified.
+
+This reference is complete within `prizmkit-code-review`. Do not depend on another skill's prompt or a platform-generated Reviewer role.
+
+## Required Ordering and Budget
+
+```text
+Implementation complete
+→ mandatory Main-Agent review and repair loop: maximum ten rounds
+→ optional independent Code Reviewer: maximum five responses
+→ PASS or NEEDS_FIXES
+```
+
+The independent budget does not replace, reduce, or extend the Main-Agent loop. Create at most one Reviewer for this Code Review stage. Never reuse it in another stage.
+
+## Host Capability Gate
+
+The gate is all-or-nothing. Before creating a Reviewer, the host must prove this semantic execution contract:
+
+```yaml
+execution_unit:
+  count: 1
+  access: read-only
+  mutation: unavailable
+  arbitrary_command_execution: unavailable
+  downstream_execution: structurally-unavailable
+  context_continuation: same-unit-native-resume
+  workspace_observation: bounded-active-checkout-input
+  model_configuration: inherit-current-session
+```
+
+Rules:
+
+- Prompt instructions cannot satisfy a missing structural capability.
+- The decision must not branch on platform identity, tool name, execution-unit type name, adapter output, or a platform allowlist.
+- If any capability is missing or cannot be proven, do not create a Reviewer. Use Strict Downgrade.
+- A general execution unit with a prompt saying "do not mutate or delegate" is not eligible when those capabilities remain available.
+- The Reviewer inherits the current session's model configuration. Do not add a separate model-selection contract.
+
+## Review Input
+
+Before each response, the Main Agent captures one bounded review input that is immutable for one response:
+
+```text
+review-input
+├── manifest: input identity, response number, exact changed paths, states, and consistency markers
+├── context: requirement, plan decisions, applicable rules, and prior adjudication on resume
+└── payload: complete captured current change plus targeted supporting material
+```
+
+The Code payload contains a logical representation of:
+
+- staged tracked changes;
+- unstaged tracked changes;
+- untracked files;
+- deleted and renamed files;
+- the exact changed-file manifest;
+- requirement goals and acceptance criteria;
+- relevant plan decisions;
+- applicable project rules and Prizm traps;
+- targeted unchanged callers, dependents, contracts, schemas, or tests implicated by changed interfaces.
+
+The Main Agent captures authoritative workspace state. The Reviewer does not run Git commands. Do not provide broad repository access as a substitute for complete current-change capture. The representation may use host-native immutable content or a read-only temporary payload outside the project change set; the protocol does not require a particular temporary path or command.
+
+Before ordinary review, the Reviewer verifies that manifest, context, and payload agree. Missing paths, unexplained changed files, stale content, or mixed-round input produces `REVIEW_BLOCKED`, never partial success.
+
+## Initial Reviewer Prompt
+
+Instantiate the bracketed fields and retain every boundary below.
+
+```text
+You are the sole independent Code Reviewer for this PrizmKit Code Review stage.
+
+Purpose:
+Objectively determine whether the Main Agent's complete current implementation correctly satisfies the confirmed requirement and plan. You are not an adversary and are not required to disagree. Return NO_CORRECTION_NEEDED when the current implementation is correct.
+
+Response:
+This is response [RESPONSE_NUMBER] of a maximum five responses.
+Review-input identity: [INPUT_ID]
+Manifest: [MANIFEST]
+Context: [CONTEXT]
+Payload: [PAYLOAD]
+Permitted targeted paths, if represented separately: [TARGETED_PATHS_OR_NONE]
+
+Execution boundaries:
+- Complete this review personally.
+- Do not create, schedule, resume, continue, request, or coordinate another execution unit.
+- Do not ask the Main Agent to create a helper.
+- Do not re-enter orchestration, delegation, another review workflow, or an equivalent process.
+- Do not modify, create, delete, rename, stage, commit, or otherwise mutate files.
+- Do not execute commands, tests, builds, network calls, or any operation that can change state.
+- Read only the bounded review input and explicitly permitted targeted paths.
+- Do not perform broad repository discovery or a full repository scan.
+- Report only corrections supported by a concrete target and evidence.
+- Do not invent an issue merely to return feedback.
+- Return REVIEW_BLOCKED rather than delegate or provide an incomplete success result.
+- Do not expose private reasoning traces. Return only the required output.
+
+First validate input consistency. Then review requirement and acceptance-criteria alignment, implementation completeness, concrete failure scenarios, error handling, security, authorization, data integrity, transaction/concurrency/state-transition behavior, public and internal contracts, compatibility and regression risk, test-boundary or evidence defects that can conceal incorrect behavior, and applicable project-rule compliance.
+
+Do not rewrite the plan, modify code, execute tests, or perform broad exploratory repository discovery.
+
+Return exactly one result using the Reviewer Output Protocol.
+```
+
+## Resume Prompt
+
+Resume the exact same Reviewer; do not create a new Reviewer with this text. Instantiate the bracketed fields.
+
+```text
+Continue as the same independent Code Reviewer.
+
+Response:
+This is response [RESPONSE_NUMBER] of a maximum five responses.
+New review-input identity: [INPUT_ID]
+New manifest: [MANIFEST]
+Current context: [CONTEXT]
+Current payload: [PAYLOAD]
+Previously accepted corrections: [ACCEPTED_CORRECTIONS_OR_NONE]
+Repairs actually made: [REPAIRS_OR_NONE]
+Main-Agent targeted verification: [VERIFICATION]
+Previously rejected corrections and rejection evidence: [REJECTIONS_OR_NONE]
+Unresolved items: [UNRESOLVED_OR_NONE]
+
+All initial execution boundaries and the Reviewer Output Protocol remain mandatory. Review the complete current state, not only the repair and not the superseded payload. Do not repeat a rejected correction unless the new state invalidates the recorded rejection evidence. Validate the new input before ordinary review and return exactly one result.
+```
+
+## Reviewer Output Protocol
+
+Return exactly one of these forms. Do not add severity, confidence, dimension, workflow impact, or acceptance fields.
+
+### No Correction Needed
+
+```markdown
+### Result: NO_CORRECTION_NEEDED
+
+### Corrections
+None.
+
+### Summary
+<one or two sentences confirming what was reviewed>
+```
+
+### Correction Needed
+
+```markdown
+### Result: CORRECTION_NEEDED
+
+### Corrections
+
+#### Correction 1
+- Target: <file and location, contract, or behavior>
+- Problem: <what is currently incorrect>
+- Evidence: <concrete basis or reproducible scenario>
+- Correction: <recommended correction>
+
+### Summary
+<one or two sentences describing the current state>
+```
+
+Every correction contains only `Target`, `Problem`, `Evidence`, and `Correction`.
+
+### Review Blocked
+
+```markdown
+### Result: REVIEW_BLOCKED
+
+### Blocker
+- Target: <missing or inconsistent review input>
+- Problem: <why a complete review cannot be performed>
+- Evidence: <concrete mismatch or capability failure>
+- Correction: <what input or host condition would unblock review>
+
+### Summary
+No review verdict was produced.
+```
+
+`REVIEW_BLOCKED` is an internal independent-review result, not a lifecycle verdict.
+
+## Main-Agent Adjudication
+
+The Main Agent verifies each proposed correction and records exactly one decision:
+
+| Decision | Meaning | Action |
+|---|---|---|
+| `accepted` | Evidence proves an in-scope implementation correction is needed. | Main Agent repairs the current implementation and performs targeted verification. |
+| `rejected` | Current code, contracts, tests, artifacts, or rules disprove the proposed problem. | Record concrete rejection evidence and make no change for it. |
+| `unresolved` | Correctness or a safe repair cannot be established. | Record the item and return `NEEDS_FIXES`. |
+
+The Reviewer never modifies files and cannot overrule adjudication.
+
+Independent review converges normally when:
+
+1. the Reviewer returns `NO_CORRECTION_NEEDED`; or
+2. every correction in the current response is rejected with concrete evidence and no unresolved item remains.
+
+## Response Algorithm
+
+1. Run only after the Main-Agent review and repair loop converges with no unresolved finding.
+2. Apply the Host Capability Gate.
+3. If eligible, capture response 1 input and create exactly one Reviewer with the Initial Reviewer Prompt.
+4. Validate the result against the Reviewer Output Protocol and append an independent-review round event.
+5. Adjudicate every correction and append independent-adjudication events. Any unresolved item returns `NEEDS_FIXES`.
+6. For accepted corrections, the Main Agent repairs the active checkout, runs targeted verification, and inspects the complete resulting change.
+7. If one or more responses remain, capture the complete fresh current change and resume the exact same Reviewer with the Resume Prompt. Do not restart the complete ten-round Main-Agent loop after every ordinary independent correction.
+8. If the fifth response causes a repair, no sixth response is allowed. Run targeted verification, inspect the complete final change, record final-budget handling and `Final State Independently Rechecked: no`, and do not exceed the response budget.
+9. End the Reviewer when review converges, reaches the response limit, fails irrecoverably, or the stage becomes blocked. Explicitly terminate it when the host safely supports that operation; otherwise stop sending messages.
+10. Complete the existing final verification and append exactly one `## Final Result` with `PASS` or `NEEDS_FIXES`.
+
+## Strict Downgrade
+
+Use strict downgrade in any of these cases:
+
+- a required capability is unavailable or unproven before creation;
+- Reviewer creation fails;
+- the exact same Reviewer cannot be resumed or resume fails;
+- execution-unit integrity becomes uncertain.
+
+Behavior:
+
+1. Never create a weaker or replacement Reviewer.
+2. Never create a fresh Reviewer with a summary of the prior conversation; a summary is context, not native continuation.
+3. When no Reviewer is created, record the downgrade and continue from the completed Main-Agent review if it remains valid.
+4. When creation fails before any response, record the failure and preserve the completed Main-Agent review.
+5. When resume fails after an accepted repair, Never create a replacement Reviewer; rerun the Main-Agent review over the repair, within the existing ten-round safety fuse, record the downgrade and fallback, and return `NEEDS_FIXES` if review cannot establish convergence.
+6. Reviewer input problems may be corrected and sent to the same Reviewer only while response budget and native continuation remain available. Otherwise downgrade.
+7. Report temporary input-cleanup failures honestly; cleanup failure does not change an otherwise verified review result.
+
+Strict downgrade is visible reduced assurance, not a new lifecycle verdict and not permission to weaken the gate.
+
+## Report Recording
+
+Use the existing append-only `review-report.md` lifecycle and renderer events:
+
+- `independent-review-round`: response number `1..5`, result, correction count, adjudication counts, and next action;
+- `independent-adjudication`: correction summary, `accepted | rejected | unresolved`, evidence, and actual modification;
+- `independent-review-downgrade`: reason, Main-Agent fallback, and whether the final state was independently rechecked.
+
+The report remains the only persisted Code Review artifact. It ends with exactly one `## Final Result`; valid final verdicts remain `PASS | NEEDS_FIXES`.

package/bundled/skills/prizmkit-code-review/references/review-report-template.md

@@ -39,6 +39,44 @@ Within that execution, append sections only. Never edit or replace an earlier pr
 - Next: <next action>
 ```
 
+### Independent Review Round
+
+```markdown
+## Independent Review Round <N>
+
+- Result: <NO_CORRECTION_NEEDED | CORRECTION_NEEDED | REVIEW_BLOCKED>
+- Corrections: <count>
+- Accepted: <count>
+- Rejected: <count>
+- Unresolved: <count>
+- Next: <next action>
+```
+
+### Independent Adjudication
+
+```markdown
+## Independent Adjudication
+
+- Correction: <summary>
+- Decision: <accepted | rejected | unresolved>
+- Evidence: <evidence>
+- Modification: <actual change or none>
+```
+
+Repeat this section once per proposed correction.
+
+### Independent Review Downgrade
+
+```markdown
+## Independent Review Downgrade
+
+- Reason: <missing capability, creation failure, or native-resume failure>
+- Fallback: <completed Main-Agent review or Main-Agent re-review of repair>
+- Final State Independently Rechecked: <yes | no | not applicable>
+```
+
+Use this section for strict downgrade, including final-budget handling when the final allowed response causes a repair that cannot receive another independent response.
+
 ### Final Verification
 
 ```markdown
@@ -68,10 +106,13 @@ Exactly one Final Result terminates a completed execution:
 
 - Start of a new execution removes stale progress and terminal results from prior executions.
 - A phase appends its result before the next phase starts.
+- Main-Agent round numbers are from `1` through `10`; independent Reviewer response numbers are from `1` through `5`.
+- Independent Reviewer results are `NO_CORRECTION_NEEDED`, `CORRECTION_NEEDED`, or `REVIEW_BLOCKED`; they never replace the terminal lifecycle verdict.
+- For an independent round, `accepted + rejected + unresolved = corrections`; `NO_CORRECTION_NEEDED` requires zero corrections.
 - Finding counts satisfy `accepted + rejected + unresolved = findings`.
 - `PASS` requires every accepted finding fixed and zero unresolved findings.
 - `NEEDS_FIXES` requires at least one unfixed accepted or unresolved finding.
 - An IN_PROGRESS report without Final Result is incomplete.
 - Generic or incidental verdict text outside the last Final Result does not prove completion.
 - Do not append any section after Final Result.
-- Do not persist a separate review-state JSON file.
+- A separate review-state JSON file is not required; the shared workflow state under `.prizmkit/state/workflows/` may record lifecycle handoff and recovery metadata.