[ACP-HARDEN-250] review-disposition/v1とhead-bound review completenessを追加する

[ootakazuhiko]

Parent: #3655
Depends on: ACP-HARDEN-120, ACP-HARDEN-210
Blocks: #3640
Codex lane: agents/review-disposition-v1

背景

現在のreview gateはreview presenceとthread resolutionを確認できるが、resolved=trueが何を意味するかを標準化していない。実際のreview対応では、fixed、rejected-with-reason、not-actionable、deferred、superseded、accepted-riskを区別し、fix commit、focused tests、exact-head CI、remaining limitationを記録する必要があった。

Thread resolutionだけでは、別headへの修正、根拠のないresolve、古いreviewへのresponse、未処理findingの見落としを検出できない。

目的

review-disposition/v1を追加し、review threadの処理結果をhead SHA、subject digest、fix commit、Evidence refへbindingする。

Codex CLI preflight

• Copilot Review Gate
• review completeness scripts
• GitHub authority snapshot Issue
• human decision contract Issue
• PR automation docs
• policy gate／change package／hook feedback
• Context Pack／Boundary Map

Proposed contract

schema/review-disposition-v1.schema.json

最低限:

schemaVersion
repository
pullRequestNumber
threadId
topCommentId
reviewedHeadSha
subjectPaths
subjectDigest
disposition:
  fixed
  rejected-with-reason
  not-actionable
  deferred
  superseded
  accepted-risk
responseCommentId
fixCommit
validationEvidenceRefs
remainingLimitations
humanDecisionRef
resolvedAt
artifactStatus

不変条件

• actionable findingのfixedにはfix commitとEvidence refを要求する。
• accepted-riskにはsubject-bound human decisionを要求する。
• deferredは完了扱いにせず、follow-up Issueを要求する。
• dispositionはreviewed headとcurrent headの関係を明示する。
• new commitで対象行／artifactが変わった場合、旧dispositionの再確認要否を判定する。
• synthetic／test-only dispositionはreal review gateを満たさない。
• agentがhuman acceptanceを捏造しない。

実装タスク

• review disposition Schema、validator、fixtures、Contract Catalog entryを追加する。
• GitHub authority snapshotからthread ID、top comment ID、head SHAを取り込む。
• reply／resolve helperがdisposition artifactを生成または更新できるようにする。
• review completenessをall threads resolvedだけでなくall actionable threads have valid dispositionへ拡張する。
• generated comment count、missing review ID、outdated thread、head mismatchを検査する。
• fixed dispositionへfocused test、full test、exact-head CI Evidence refをbindingする。
• PR summary／change package／hook feedbackへreview disposition summaryを表示する。
• non-actionable／rejected dispositionにはbounded rationaleを要求し、review本文全文を複製しない。
• old head、missing fix commit、wrong thread ID、accepted-risk without decision、deferred without issueのnegative testsを追加する。

Acceptance criteria

• resolved threadでdisposition欠落時にreview completenessがpassしない。
• fixedはcurrent PR ancestry上のfix commitとEvidenceを持つ。
• accepted-riskは有効なhuman-decision refなしではpassしない。
• deferredはfollow-up Issueへbindingされ、merge-readyとは表示されない。
• same thread count／different IDsをauthority snapshotと組み合わせて検出する。
• exact-head CIが別headの場合はfix Evidenceとして扱わない。
• PR reviewer surfaceでdisposition別件数とremaining limitationsが読める。

Validation

• Schema self-validation
• GraphQL/review fixture tests
• head mismatch／missing Evidence／invalid disposition matrix
• review gate integration tests
• change package／hook feedback projection tests
• pnpm -s run check:schemas
• pnpm -s run check:doc-consistency
• pnpm -s run verify:lite

非目標

• AI reviewの内容品質を自動判定すること
• reviewを自動承認すること
• human reviewer identityの暗号学的証明
  -全PRへのauto-fix必須化

Stop condition

• Draft PR
• report-only integration first unless policy explicitly selects enforcement
• exact-head CI success
• unresolved review threads 0
• worktree clean

[ootakazuhiko]

Parallel review supplement — review convergence without suppressing findings (2026-09-07)

Review origin: #3675. This comment concerns the future review-disposition implementation, not the open threads currently owned by the Codex operator in PR #3674/#3673.

The dogfood history contains repeated small review fixes followed by full heavy CI and new review passes. Improve convergence without defining an arbitrary 'no more findings' cutoff:

• Establish a dated, exact-head review baseline covering the whole changed surface once, including producer, validator, consumer, failure branches and negative matrix.
• Subsequent passes should identify changed material, affected invariants and genuinely new evidence. Bind the finding to path/subject digest and deduplicate repeated observations. Do not count a duplicate comment or unchanged snapshot as new work.
• Separate an unmet acceptance/security requirement from an out-of-scope improvement suggestion. Real actionable blocking findings remain blockers. Rejected/not-actionable classifications require bounded evidence/rationale; accepted-risk and deferred dispositions still obey this Issue's human-decision and follow-up rules. No blanket suppression of P2 or newly discovered vulnerabilities.
• Make regression tests systematic across adjacent failure paths (discovery, version probe, process launch, timeout, parse, command result, artifact read/write and finalization) instead of fixing only the latest example.
• Use focused validation during edits and the declared complete exact-head acceptance suite for the final candidate. Record what was not rerun; never reuse evidence whose subject changed.
• Include review pass/round count, duplicate finding count, manual interventions and validation cost as report-only process metrics, not as proof of safety or an automatic merge trigger.

Coordinate with #3677 for execution/CI budgets and #3676 for typed identity. The intended result is fewer avoidable restarts, not fewer truthful findings.