Run a manual PR review loop with SHA-bound verdict provenance #2573

Problem

The accepted Base governance implementation plan assigns this existing issue to package 6. Its previous scope no longer matches the accepted review-loop and automation boundaries, so this issue has been reconciled to a bounded deliverable and remains in Triage/Backlog until independently reviewed.

Expected behavior

Replace the rejected machine-readable Agent Assignment proposal with the manual PR review loop and verdict provenance. The reviewer is a genuinely fresh session with no author transcript or persistent authoring memory; whether it must use a different tool follows the repository setting. Record author/reviewer tool, model and session, round number and full PR head SHA. The author answers every finding; the reviewer verifies and resolves justified threads; disputes go to the maintainer. After three rounds, unresolved findings stop for the maintainer. Apply the accepted exact base-only re-verification rule without consuming a round only when all checks prove no PR change.

Scope and non-goals

Scope: Replace the rejected machine-readable Agent Assignment proposal with the manual PR review loop and verdict provenance. The reviewer is a genuinely fresh session with no author transcript or persistent authoring memory; whether it must use a different tool follows the repository setting. Record author/reviewer tool, model and session, round number and full PR head SHA. The author answers every finding; the reviewer verifies and resolves justified threads; disputes go to the maintainer. After three rounds, unresolved findings stop for the maintainer. Apply the accepted exact base-only re-verification rule without consuming a round only when all checks prove no PR change.

Non-goals: Do not use the rejected Agent Assignment/autonomy state machine; do not expand authority or silently change the accepted design; do not activate enforcement or make status/merge changes before the required gates.

Affected areas

• docs/github-workflow.md, review runbook, PR template and reviewer rules.
• Accepted source: governance design and implementation plan, PR #2664
• Parent tracker: #2665

Impact and evidence

1. Product intent: Implements the accepted governance design; no product-requirement change is authorized here.
2. Architecture and contracts: Destination: package 6 of the accepted plan in PR Revise the Base ecosystem governance design and implementation plan #2664, plus the named issue contract.
3. User guidance: Likely destinations: docs/github-workflow.md, review runbook, PR template and reviewer rules.; the implementation PR must name exact paths or provide a change-specific no-impact reason.
4. CLI/API and reference: Update the applicable reference if behavior/commands change; otherwise the implementation PR states why no CLI/API surface is affected.
5. Operations and safety: The scope states its authority boundary and rollback; no merge/release authority is implied.
6. Validation and testing: Validation steps are listed below; the PR records executed evidence and explains unavailable checks.
7. Examples and downstream use: The PR identifies affected examples/consumers or gives a scoped repository search as evidence of no impact.
8. Governance and contributor process: This issue applies the accepted process rule and does not duplicate Project fields in the body.
9. Decision records: No new decision is accepted by this issue; any deviation requires explicit maintainer approval and a superseding record.
10. Release notes: The PR includes a release-note line or a reasoned none; no user-facing release claim is pre-approved here.

These are issue-stage dispositions; refine exact paths and evidence in Triage before Ready. The implementation PR repeats the ten categories against the actual diff.

Open questions

• None beyond the scope-specific gates above. If evidence changes the accepted contract, return to Triage and obtain a separate maintainer decision.

Plan

• S1: One focused PR for this issue. Use Fixes #N if single-PR; if a maintainer approves more than one PR, name slices S1…Sn before opening them and use Part of #N.
• Dependencies: #2669, #2680, #2583
• Acceptance criteria:
• The runbook covers review of issue, slice, diff, tests, docs and rules in a fresh session with provenance.
• Every finding receives an author fix/challenge response and reviewer verification; only the reviewer resolves justified threads, with maintainer handling disputes.
• Each verdict cites the full head SHA, tool/model/session and round; changed code requires a fresh round.
• The exact accepted base-only re-verification rule is recorded, and uncertainty requires a full review round.
• No Agent Assignment field, required GitHub approval, agent merge or status write is introduced.
• Validation:
• Walk through a sample PR with fixed, disputed, new and unresolved findings.
• Verify the verdict SHA matches the live head and reviewers can audit thread resolution.
• Review the base-only comparison procedure against clean and conflict-resolution merge examples.
• Risks and rollback: Shared GitHub identity prevents GitHub from enforcing reviewer independence or approvals; keep human maintainer audit and merge as the gate.
• Decision impact: No decision is accepted by implementation alone; record accepted decisions and file a superseding ADR if a change is approved.