fix(ally-guard): ignore superseded review status updates

[allyblockcast]

Thinking Path

• Paperclip is the open source app people use to manage AI agents for work.
• The Ally review-consistency guard audits GitHub review objects for identity, head-attestation, and duplicate-verdict hazards.
• The guard had remained red because follow-up status/disposition updates from the Ally App were being counted as additional same-head verdicts.
• Treating those status updates as independent verdicts makes a healthy review sequence look like duplicate review submissions.
• This pull request narrows the operative App review set to canonical attestations and recognizes a later canonical prior-findings disposition as superseding earlier same-head evidence.
• The result is a guard that reports actionable review inconsistencies without flagging superseded status updates.

Linked Issues or Issue Description

Refs #25764 (Paperclip: BLO-25764).

What Changed

• Ignore non-canonical App COMMENTED status updates when counting operative Ally verdicts.
• Keep only the latest canonical App verdict when a later Prior Findings Dispositioned section supersedes earlier same-head evidence.
• Preserve the existing App and User-seat lane checks and fail-closed head/list validation.
• Add regression coverage for status updates and superseding dispositions.

Verification

• node --test scripts/check-ally-review-consistency.test.mjs passed: 88 tests, 0 failures.
• The one-verdict-per-head GitHub check passed on head 8ba996328cf0b75d909346dc3d0fcdb65348e86b.
• The current guard output on the branch was: Ally review-consistency guard passed: no attestation conflicts found across 87 open PR(s) in Blockcast/paperclip.
• The discriminator used PRs fix(heartbeat): classify missing skills as deterministic failures (BLO-7991 AC3) #1525, fix(alertmanager): route team=devops and recognize severity=page/ticket #1360, and fix: retry-now can now promote ccrotate_capacity parks (no retryOfRunId) #1316 for same-App follow-up objects, with PR [codex] fix(security): block indirect env reconstruction #1204 as the two-surface control.

Risks

• Low risk: the change is limited to the scheduled consistency checker and its unit tests.
• A malformed or non-canonical App review is no longer treated as a verdict, while canonical head attestations and the required App/User approval-pair semantics remain enforced.
• No production systems, deployment paths, credentials, or review bypasses are changed.

Model Used

OpenAI GPT-5.6 Terra (openai/gpt-5.6-terra) via the Paperclip OpenCode agent, with repository inspection, GitHub API evidence review, and local Node test execution.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked them above
• I have either (a) linked existing issues with Fixes: # / Closes # / Refs # OR (b) described the issue in-PR following the relevant issue template
• I have run tests locally and they pass
• I have added or updated tests where applicable
• If this change affects the UI, I have included before/after screenshots
• I have updated relevant documentation to reflect my changes
• I have considered and documented any risks above
• All Paperclip CI gates are green
• Greptile is 5/5 with no open P2s, recommendations, or follow-ups
• I will address all Greptile and reviewer comments before requesting merge

[allyblockcast]

🔗 Paperclip issue: BLO-25764

[allyblockcast]

🔗 Paperclip issue: BLO-25764

[allyblockcast]

Hey @allyblockcast[bot]! Before this PR can be reviewed, a few things need attention:

Missing or incomplete:

• Missing section: ## Thinking Path
• Missing section: ## What Changed
• Missing section: ## Verification
• Missing section: ## Risks
• Missing section: ## Model Used
• PR body is empty — please fill out the PR template
• PR body is empty — please fill out the PR template

Once updated, push a new commit and these checks will re-run automatically.

— commitperclip

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: 8ba9963

Critical Issues (0)

Important Issues (0)

Suggestions (0)

Strengths

• The App-lane filtering cleanly ignores non-canonical status updates while retaining canonical verdicts and approvals.
• Superseding disposition-bearing App reviews are selected by submission time, and the focused regression coverage exercises both behaviors.
• The focused test suite passes all 88 tests.

Recommended Action

1. Merge when the remaining CI checks pass.