fix(orchestration): deliver bounded closure and review responsibility reduction

bin/install.sh

@@ -470,14 +470,14 @@ install_default() {
     record failed "$installer"
     echo "missing executable skill installer: $installer" >&2
   else
-    installer_args=()
+    installer_command=("$installer")
     if [[ "$force" -eq 1 ]]; then
-      installer_args+=(--force)
+      installer_command+=(--force)
     fi
     if [[ "$dry_run" -eq 1 ]]; then
-      installer_args+=(--dry-run)
+      installer_command+=(--dry-run)
     fi
-    if installer_output="$("$installer" "${installer_args[@]}")"; then
+    if installer_output="$("${installer_command[@]}")"; then
       printf '%s\n' "$installer_output"
       record updated "$installer"
     else

references/assets/orchestration/contract/bounded-closure-v1.yaml

@@ -0,0 +1,36 @@
+schema: bounded-closure-v1
+status: active
+policy:
+  owner: .work-bundle/project.yaml#orchestration_control
+  field: post_execution_review_round_limit
+  value: 5
+  rejected_execution_policy: review_revision_limit
+state:
+  owner: .work-bundle/runtime/orchestration-control/post-execution-review-rounds-v1.json
+  schema: post-execution-review-ledger-v1
+  portable_projection: orchestration_control.post_execution_review_flows
+  identity:
+    - workspace
+    - flow_id
+  independent_of:
+    - plan_revision
+    - branch
+    - reviewer
+    - resume
+round:
+  boundary: all_executor_attempts_terminal
+  terminal_attempt_states: [completed, blocked, partial, failed, cancelled]
+  outcomes: [accepted, findings, blocked]
+  idempotency: exact_request_id_and_target_identity
+  reserve_before: [evidence_preparation, reviewer_dispatch]
+  complete_evidence:
+    product: immutable_stored_review_reference
+    controller_blocked: factual_audit_block
+  finalization_required_when:
+    - accepted_outcome
+    - fifth_round_completed
+  forbidden_after_finalization_required:
+    - review_preparation
+    - review_dispatch
+    - reconciliation
+    - executor_repair

references/assets/orchestration/contract/handoff-executor-result-v1.md

@@ -24,6 +24,7 @@ Templates define the maximum available fields, not mandatory output shape. Omit
 id: handoff-exec-YYYYMMDD-001-slug
 type: executor-result
 status: active
+lifecycle_authority: location-v1
 project: work-bundle
 created_at: YYYY-MM-DD
 updated_at: YYYY-MM-DD
@@ -109,16 +110,6 @@ task_fit_check:
     - assigned task
   findings: []
 
-acceptance_review:
-  required: false | true
-  reviewer_independent: true | false
-  verdict: pending | accept | repair | blocked
-  reviewed_head: commit-or-tree-identity
-  findings:
-    - severity: blocking | advisory
-      scope: specification | correctness | quality | validation | rule
-      finding: "Compact evidence-backed text."
-
 repository:
   - root: /absolute/path
     target_kind: git-backed | local-project
@@ -161,19 +152,19 @@ allocation_evidence:
 
 ## Required By Applicability
 
-- `id`, `type`, `status`, `project`, `created_at`, `related`, and `result` are always required.
+- `id`, `type`, `status`, `lifecycle_authority: location-v1`, `project`, `created_at`, `related`, and `result` are always required for newly written handoffs. Embedded `status` is immutable creation metadata; current lifecycle status comes from the status-specific location.
 - For a task-scoped executor-result, `related.plan` and `related.task` are required and must equal the assigned task's `plan_id` and `id`. Nested `related.plan` and flat `related_plan` must resolve to exactly one identity. Missing, null, conflicting, or mismatched plan identity fails closed before `Completed` and before `build-review-package` produces a review package. The shared `validate-executor-result` helper owns this gate. Do not infer plan identity from a local task ID.
 - `changes.files` is required when files, symbols, artifacts, schemas, commands, or docs changed or were inspected as the task output.
-- `validation.commands` is required when any command, test, lint, inspection, or manual verification was run or intentionally skipped.
-- `evidence_closure` is required for a completed task whose compiled `evidence_capability.result` is `mapped`. Its invariant IDs, boundary, freshness, and evidence IDs must exactly match allocated task authority. Each referenced validation report carries the allocated `id` and `invariant_ids`; direct harness observation reuses those compiled identities. Only all-`passed` capable, current, correctly bounded evidence closes the task. Negative results fail closed and name the first repair owner: task for failed, stale, or unexecuted implementation evidence; plan for missing, wrong-boundary, or incapable allocation; specification for contradictory accepted authority. Executor-authored closure is corroboration and cannot replace harness observation or semantic review.
+- `validation.commands` records commands, tests, lints, inspections, or manual verification actually run or intentionally skipped by the executor. Focused test-first corroboration may be reported separately from compiled controller-owned final validation. A compiled final command that has not yet been independently observed is omitted rather than duplicated or fabricated merely to admit the immutable handoff; any supplied report must remain well formed and truthful.
+- `evidence_closure` is required for a completed task whose compiled `evidence_capability.result` is `mapped`. Its invariant IDs, boundary, freshness, and evidence IDs must exactly match allocated task authority. A supplied executor report for referenced validation carries the allocated `id` and `invariant_ids`; direct harness observation reuses those compiled identities and remains mandatory at terminal validation even when no executor report exists. Only all-`passed` capable, current, correctly bounded harness evidence closes the task. Negative results fail closed and name the first repair owner: task for failed or stale implementation evidence; plan for missing, wrong-boundary, or incapable allocation; specification for contradictory accepted authority. Executor-authored closure is corroboration and cannot replace harness observation or semantic review.
 - `knowledge_disposition` is required for every completed or partial meaningful move. It records task-local evidence only and does not authorize durable-knowledge retrieval or writes. A change action requires allocated `AUTH-NNN` aliases from the task's accepted decision authority, allocated source IDs, or exact paths already present in the compiled task scope; `none` requires an empty affected-authority list. Invented or unallocated AUTH aliases fail closed.
 - `contract_decoupling` is required when a task is marked contract-decoupled or depends on a common contract group.
 - `barrier` is required when a task is a barrier participant or convergence owner.
 - `convergence` is required when the task owns post-barrier joint debug, integration checks, or cross-branch validation.
 - `defect_closure` is required when a review task closes or carries specification-included defect evidence.
 - `unresolved` is included only when blockers or issues remain.
 - `task_fit_check` is required for completed and partial task results. It records the assigned task, result `clean|repaired|unresolved|skipped`, artifacts checked, and meaningful findings.
-- `acceptance_review` is required when the task contract requires review. A review-required task cannot become `Completed` until the verdict is `accept`.
+- Review requirements come from compiled task authority. Review packets, verdicts, receipts, accepted-result identities, observations, and later audit facts are wrong-owner fields and must not be written into a new executor-result handoff. A structurally complete review-required executor result is admitted before review; accepted-result materialization later joins it with the exact published review and current observations.
 - `repository` is required when repository preflight, accepted baseline, changed paths, or blocker state matters for continuation.
 - `repository[].metadata` is required when project metadata baseline was used for target resolution, branch checks, commit checks, or CodeGraph policy decisions.
 - `codegraph` is required when source-code inspection or edits were in scope. Keep it compact: `root`, `applicable`, `up_to_date`, and required fallback or blocker facts are enough unless a failure needs detail.
@@ -194,6 +185,11 @@ deviations: []
 strategy_advice: []
 knowledge_persistence: []
 baseline: {}
+acceptance_review: {}
+accepted_result: {}
+reviewer_run: {}
+publication: {}
+receipt: {}
 ```
 
 Use `delegation_evidence` for compact delegation proof. Use `unresolved` and `task_fit_check.findings` for remaining issues instead of `deviations`. Do not include a top-level `baseline`; the helper owns pre-task baseline capture, and executor-result cannot supply or replace that baseline.
@@ -206,15 +202,21 @@ Compact handoffs must not weaken safety gates:
 - Metadata evidence must preserve repository id, expected and actual branch, expected and actual commit, branch status, commit status, and baseline status when project metadata preflight applies.
 - CodeGraph evidence must preserve no-index fallback, sync-failed, stale, or blocker facts when applicable.
 - Delegation evidence must preserve delegated state, `owner_kind: subagent`, minimum agent/run identity, and `host-native|execution-flow` mechanism. UI, visibility, fallback, controller-owner, and internal-worker fields are invalid.
-- Validation evidence must list exact commands or inspections and their result. Executor-authored `result`, `exit_code`, or an equivalently named receipt block is corroboration, not independent proof and not authority for `Completed`. Direct helper observation in the bound worktree is the terminal evidence.
+- Executor validation evidence must list exact commands or inspections it actually performed and their result; it does not claim an unexecuted controller-owned final command. Executor-authored `result`, `exit_code`, or an equivalently named receipt block is corroboration, not independent proof and not authority for `Completed`. Direct helper observation of every compiled final validation in the bound worktree is the terminal evidence.
 - Task-fit evidence must prove the executor followed the compiled brief and assigned task. Full specification, root-plan, and phase inspection is an escalation path when compiled context is inconsistent.
-- Acceptance-review evidence must identify review independence, the reviewed tree, verdict, and blocking or advisory findings.
+- Published review authority must identify review independence, the reviewed tree, verdict, and findings outside the executor-result handoff. Accepted-result materialization owns the join and never rewrites the original handoff.
 - Executor-result handoffs must not retrieve or write `.work-bundle/knowledge/`.
 - `knowledge_disposition.action` is exactly `none`, `update`, `supersede`, or `reclassify`; reasons and affected authority must not name knowledge paths or any `ks-*` skill, and review owns any approved persistence follow-up.
 - Contract-decoupled handoffs must show validation against the common contract and accepted prior handoffs, not sibling in-progress implementation.
 - Barrier handoffs must show whether the participant reached the barrier or blocked before convergence work is scheduled.
 - Defect closure handoffs must use review-owned lifecycle evidence and must not delete defect evidence files.
 
+## Immutable Lifecycle Authority
+
+New handoffs are marked `lifecycle_authority: location-v1`. Their complete bytes never change after creation. The controller moves the same bytes among `active/`, `reviewed/`, `superseded/`, and `archived/`; the index derives current status from that location and lookups search every status directory. Same-state requests are no-ops and write neither artifact, override, index, nor dispatch evidence.
+
+Unmarked historical handoffs are not rewritten or bulk-migrated. Without an override, an unmarked file in `active/` uses a recognized embedded status and an unmarked file in a non-active status directory uses its location. On the first actual explicit status change, including return to `active`, the controller writes only `handoff/legacy-status-overrides/<handoff-id>.json`, binding the complete-byte digest, type, related plan/task, and current status. A valid override then takes precedence and must agree with location. The index preserves a pre-existing duplicate identity only when every copy is unmarked, co-located in the same lifecycle directory, and has no override; identity-based lifecycle operations remain ambiguous and fail closed. New identities remain unique. Every other duplicate identity, type/folder disagreement, task/plan contradiction, or override digest/binding/location contradiction fails closed.
+
 ## Format Guidance
 
 - Small task handoffs should normally be 20-60 lines.

references/assets/orchestration/contract/plan-v1.md

@@ -91,6 +91,8 @@ Plan review identity uses the canonical semantic plan projection shared by all l
 
 Every executable task declares the same five-field Truth Basis. When a consequential simplification or compatibility assumption exists, make the earliest ordinary task cheaply falsify it before broad edits. Do not add a risk score, checkpoint phase, or parallel lifecycle.
 
+Planning remains outside the bounded post-execution counter: plan and specification revisions do not consume post-execution review rounds. A task that reconciles an existing post-execution flow preserves its stable flow identity and declares the existing blocker/finalization context; shared admission, not plan wording, decides whether reconciliation may proceed.
+
 ## 4. Desired Files
 
 | ID | File Type | Path | Purpose | Operation | Related Phase |
@@ -120,6 +122,8 @@ Every executable task declares the same five-field Truth Basis. When a consequen
 
 Harness-executed integration commands run against the final accepted plan workspace after ordinary task integration and must be Git-observable-state-neutral. Do not declare a plan-level `files.write` envelope.
 
+When post-execution integrated review applies, record controller commands as lifecycle operations rather than plan validation rows: `begin-review-round` before review preparation, `complete-review-round` from stored review or factual audit-block evidence, `review-round-status` for diagnosis, and `finalize-with-blockers` only for unresolved bounded closure. Task review and artifact revision are not review rounds.
+
 ## 7.1 Contract Groups, Barriers, And Convergence
 
 Use this section when parallel tasks share a stable common contract.

references/assets/orchestration/contract/review-finding-v2.schema.json

@@ -0,0 +1,75 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:work-bundle:orchestration:review-finding:v2",
+  "$ref": "#/$defs/reviewFindingV2",
+  "$defs": {
+    "id": {"type": "string", "minLength": 1, "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$"},
+    "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "gitOid": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+    "targetIdentity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["artifact_id", "revision", "sha256", "source_tree"],
+      "properties": {
+        "artifact_id": {"$ref": "#/$defs/id"},
+        "revision": {"type": "string", "minLength": 1},
+        "sha256": {"$ref": "#/$defs/sha256"},
+        "source_tree": {"anyOf": [{"$ref": "#/$defs/gitOid"}, {"type": "null"}]}
+      }
+    },
+    "evidenceItem": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "locator", "digest_or_identity", "observation"],
+      "properties": {
+        "kind": {"enum": ["authority", "source", "test", "runtime", "environment"]},
+        "locator": {"type": "string", "minLength": 1},
+        "digest_or_identity": {"type": "string", "minLength": 1},
+        "observation": {"type": "string", "minLength": 1}
+      }
+    },
+    "reviewerObservation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["finding_id", "severity", "requirement_id", "boundary", "evidence", "expected", "observed", "owner"],
+      "properties": {
+        "finding_id": {"$ref": "#/$defs/id"},
+        "severity": {"enum": ["blocking", "non_blocking", "advisory"]},
+        "requirement_id": {"type": "string", "minLength": 1},
+        "boundary": {"type": "string", "minLength": 1},
+        "evidence": {"type": "string", "minLength": 1},
+        "expected": {"type": "string", "minLength": 1},
+        "observed": {"type": "string", "minLength": 1},
+        "owner": {"type": "string", "minLength": 1}
+      }
+    },
+    "controllerDecision": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["classification", "first_broken_artifact", "affected_owner", "action", "obligation_basis", "evidence_basis"],
+      "properties": {
+        "classification": {"enum": ["specification_gap", "decomposition_gap", "allocation_gap", "implementation_defect", "validation_oracle_defect", "environment_failure", "advisory_enhancement"]},
+        "first_broken_artifact": {"enum": ["specification", "plan", "task", "implementation", "validation_oracle", "environment"]},
+        "affected_owner": {"enum": ["specification_owner", "plan_owner", "task_owner", "oracle_owner", "environment_owner", "backlog_owner"]},
+        "action": {"enum": ["reopen_specification", "repair_plan", "reslice_plan", "repair_task", "repair_oracle", "recover_environment", "record_advisory", "accepted", "rejected"]},
+        "obligation_basis": {"enum": ["accepted_requirement", "essential_safety", "evidence_integrity", "none"]},
+        "evidence_basis": {"type": "string", "minLength": 1}
+      }
+    },
+    "reviewFindingV2": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema", "finding_id", "stage", "reviewer_observation", "evidence", "target_identity", "summary", "controller_decision"],
+      "properties": {
+        "schema": {"const": "review-finding-v2"},
+        "finding_id": {"$ref": "#/$defs/id"},
+        "stage": {"enum": ["specification", "plan", "implementation", "validation", "environment"]},
+        "reviewer_observation": {"$ref": "#/$defs/reviewerObservation"},
+        "evidence": {"type": "array", "items": {"$ref": "#/$defs/evidenceItem"}},
+        "target_identity": {"$ref": "#/$defs/targetIdentity"},
+        "summary": {"type": "string", "minLength": 1},
+        "controller_decision": {"anyOf": [{"$ref": "#/$defs/controllerDecision"}, {"type": "null"}]}
+      }
+    }
+  }
+}

references/assets/orchestration/contract/specification-v1.md

@@ -210,6 +210,8 @@ Choose policy only; specification creation does not provision a worktree.
 - `required` for risky large features or migrations.
 - Name the hydration profile and cleanup policy. Planning carries them into task and executor context; execution owns selection, preparation, hydration, and provenance.
 
+Specification authoring and repair are pre-execution activities: plan and specification revisions do not consume post-execution review rounds. A forced-closure residual specification records unresolved product claims and portable clean source-baseline identities; it remains active blocker evidence and does not authorize reconciliation, executor repair, or another review round for the exhausted flow.
+
 ## 11. Open Questions
 
 [List unresolved decisions, uncertainty, conflicts, and material non-authority evidence that affects requirements, architecture, workflow, API, persistence, validation, execution behavior, or user purpose.]
@@ -262,6 +264,7 @@ Do not instruct specification authors or executors to write durable knowledge di
 - The source context records neutral cross-stage retrieval anchors or a retrieval gap, and any named retrieval policy is used only for classification/output grouping.
 - The specification carries accepted authority context forward so downstream planning and execution do not need to read `.work-bundle/knowledge/`.
 - The specification records project metadata preflight evidence including `working_branch`, `last_commit_id`, branch status, baseline status, and CodeGraph no-index fallback when applicable.
+- The specification does not encode artifact-version counting as post-execution review policy; any residual forced-closure specification preserves unresolved claims without reopening product work.
 - WorkBundle project specifications record related active defects and expected review closure when applicable.
 - Material non-authority or opposing evidence is visible without shaping requirements unless resolved by user decision or accepted authority.