fix(review-gate): require strict current-head review

.github/PULL_REQUEST_TEMPLATE.md

@@ -79,7 +79,7 @@ Examples:
 - [ ] `node scripts/verify-github-release-assets.mjs --tag <tag> --zip <zip> --checksum <sha256> --provenance <json>` when release assets exist
 - [ ] `node scripts/publish-chrome-web-store.mjs --zip .output/<zip> --provenance .output/pack-release-provenance.v1.json --publisher-id <id> --dry-run true`
 - [ ] `git diff --check`
-- [ ] `pnpm review:gate -- --strict-head-review --required-review-author chatgpt-codex-connector --wait-head-review-ms 180000 --allow-missing-head-review` before merge/readiness claim, with missing Codex review recorded as an audit gap if reported:
+- [ ] `pnpm review:gate -- --strict-head-review --wait-head-review-ms 180000` before merge/readiness claim; a missing Codex review blocks readiness:
 
 ## Artifact Evidence
 

AGENTS.md

@@ -19,7 +19,7 @@ pnpm exec prettier --check .
 node scripts/verify-extension-package.mjs .output/chrome-mv3
 pnpm exec wxt zip && node scripts/verify-extension-zip.mjs   # release only
 pnpm workflow:preflight                                      # before non-trivial edits
-pnpm review:gate -- --strict-head-review                     # PR readiness
+pnpm review:gate -- --strict-head-review                     # PR readiness; requires Codex's current-head review
 ```
 
 Run the first seven before calling any change complete. Quote the last three lines of the Vitest

docs/AGENT_REVIEW_RECTIFY.md

@@ -131,7 +131,7 @@ node scripts/verify-extension-package.mjs .output/chrome-mv3
 pnpm exec wxt zip
 node scripts/verify-extension-zip.mjs
 git diff --check
-pnpm review:gate -- --strict-head-review --required-review-author chatgpt-codex-connector --wait-head-review-ms 180000 --allow-missing-head-review
+pnpm review:gate -- --strict-head-review --wait-head-review-ms 180000
 ```
 
 `node scripts/run-dependency-audit.mjs` runs `pnpm audit --audit-level high`
@@ -141,12 +141,17 @@ there is no PR,
 network access, or authenticated GitHub CLI session, report that as a PR-readiness
 verification gap instead of treating it as a pass.
 
-The `Review gate` workflow is allowed to pass with
-`--allow-missing-head-review` after waiting for Codex because the external bot can
-acknowledge `@codex review` without producing a formal review in a deterministic
-time window. Treat that mode as a findings gate: unresolved review threads and
-current-head requested-changes reviews still fail, but a missing bot review is an
-audit gap to record before merge/release claims.
+For local PR readiness, `--wait-head-review-ms` waits for Codex's review on the
+current head and then fails if none arrives. A timeout does not waive the
+current-head review requirement; otherwise the wait is a timer rather than a
+gate.
+
+The `Review gate` workflow separately uses `--allow-missing-head-review` after
+waiting for Codex because the external bot can acknowledge `@codex review`
+without producing a formal review in a deterministic time window. Treat that
+workflow mode as a findings gate: unresolved review threads and current-head
+requested-changes reviews still fail, but a missing bot review is an audit gap
+to record before merge/release claims. Do not use it as PR-readiness evidence.
 
 For PRs, record the exact local commands or CI run, release ZIP/checksum
 evidence when a ZIP is produced, and the SHA-256 checksum. Treat late Codex/bot

package.json

@@ -48,7 +48,7 @@
     "verify:local": "pnpm install --frozen-lockfile && node scripts/run-dependency-audit.mjs && wxt prepare && prettier --check . && eslint . --max-warnings 0 && tsc --noEmit && vitest run && wxt build && node scripts/verify-extension-package.mjs .output/chrome-mv3 && git diff --check",
     "verify": "pnpm verify:local",
     "verify:release": "pnpm verify:local && pnpm verify:clean && wxt zip && node scripts/verify-extension-zip.mjs",
-    "verify:pr": "pnpm workflow:preflight && pnpm review:gate -- --strict-head-review --required-review-author chatgpt-codex-connector --wait-head-review-ms 180000 --poll-interval-ms 10000 --allow-missing-head-review"
+    "verify:pr": "pnpm workflow:preflight && pnpm review:gate -- --strict-head-review --wait-head-review-ms 180000"
   },
   "dependencies": {
     "@wxt-dev/module-react": "^1.1.3",

scripts/check-pr-review-gate.mjs

@@ -24,8 +24,11 @@ const pollIntervalMs = readNonNegativeIntegerArg("--poll-interval-ms", 10_000);
 const retryAttempts = readPositiveIntegerArg("--retry-attempts", DEFAULT_GH_RETRY_ATTEMPTS);
 const retryBackoffMs = readNonNegativeIntegerArg("--retry-backoff-ms", DEFAULT_GH_RETRY_BACKOFF_MS);
 const fixturePaths = readFixturePaths();
-const requiredReviewAuthor = readArgValue("--required-review-author");
-const prFindingAuthor = requiredReviewAuthor ?? DEFAULT_PR_FINDING_AUTHOR;
+const requestedReviewAuthor = readArgValue("--required-review-author");
+const requiredReviewAuthor = strictHeadReview
+  ? (requestedReviewAuthor ?? DEFAULT_PR_FINDING_AUTHOR)
+  : requestedReviewAuthor;
+const prFindingAuthor = requestedReviewAuthor ?? DEFAULT_PR_FINDING_AUTHOR;
 const expectedHeadOid = readArgValue("--expected-head-oid");
 const explicitRepo = readArgValue("--repo");
 const explicitPr = readArgValue("--pr");

tests/scripts/check-pr-review-gate.test.ts

@@ -329,6 +329,40 @@ describe("PR review gate", () => {
     ).toThrow(/No review was found for current head/);
   });
 
+  it("does not let another author satisfy strict mode without an explicit author", () => {
+    const fixturePath = writeFixture(
+      "other-author-current-head-review",
+      reviewFixture({
+        headRefOid: "head-sha",
+        reviews: [
+          review({
+            state: "COMMENTED",
+            commit: "head-sha",
+            author: "external-reviewer",
+          }),
+        ],
+      }),
+    );
+
+    const result = spawnSync(
+      process.execPath,
+      [
+        scriptPath,
+        "--repo",
+        "lamemustafa/pack",
+        "--pr",
+        "14",
+        "--fixture",
+        fixturePath,
+        "--strict-head-review",
+      ],
+      { cwd: rootDir, encoding: "utf8" },
+    );
+
+    expect(result.status).toBe(1);
+    expect(result.stderr).toContain("No review was found for current head");
+  });
+
   it("does not count dismissed current-head reviews as satisfying strict review", () => {
     const fixturePath = writeFixture(
       "dismissed-head-review",
@@ -1149,16 +1183,18 @@ function review({
   state,
   commit,
   submittedAt = "2026-06-24T17:45:40Z",
+  author = "chatgpt-codex-connector",
 }: {
   state: "APPROVED" | "COMMENTED" | "CHANGES_REQUESTED" | "DISMISSED" | "PENDING";
   commit: string | null;
   submittedAt?: string;
+  author?: string;
 }) {
   return {
     state,
     submittedAt,
     url: `https://github.com/lamemustafa/pack/pull/14#${commit}-${state}`,
-    author: { login: "chatgpt-codex-connector" },
+    author: { login: author },
     commit: commit ? { oid: commit } : null,
   };
 }