Reconcile trading records with merged evidence (runtime-target, snapshot gate, dashboard, new-host EdgarTools receipt) - #200

…ty variable, refine the stale rule, drop host-only digests

From the CHANGES_REQUESTED reads at c999eee: the CC's Claude read, the CC's /code-review probe and
Astra's read.

- P1, the base: a codex-review now records the merge base its request named (openai/[email protected]
  review_request.rs:21, :62-70; branch.rs:13-15), and lg_gate requires it to be
  git merge-base <head> origin/main. Base = head and base = head^ stop.
- P1, an empty variable: a set but empty LOCAL_REVIEWS or CODEX_LOCAL_REVIEW now selects local mode and
  stops (2), instead of falling back to the connector.
- P2, the order: a review of our head that ended other than Completed gives 4 before the stale 5. A
  trigger after a stall gets the NOSTART grace, and the eyes reaction with no Running row is bounded.
- #200's value: OpenAI's Codex docs state no review time limit. The README records the measured basis
  (nas#1056) and keeps the value in one constant.
- P3s:
  - LANDING_REPO must have the owner/name shape, and every -R "$R" is quoted;
  - users/<login> must be of type User;
  - Legacy rollouts are refused, fail closed (exec/src/lib.rs:1425-1432; rollout/src/policy.rs:141-155);
  - codex_wait gives a local 2 its own message;
  - the plugin comment is bound to --head by its full-SHA links.
- Astra P1-3: the README carries no digest or prefix of a host-only file any more, and a test refuses any
  digest that is neither a tracked file's nor a named public artifact's.
- Astra's follow-ups 1 and 2: a refused retry removes the earlier --out file, and a non-finite
  confidence stops the gate.
- The new tests fail at c999eee (144 tests: failures=164, errors=2) and pass here (144 tests).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…tale-review rule and local reviews to the Codex gate

- nas_land.sh: R comes from LANDING_REPO, default native-agent-stack/native-agent-stack. GitHub
  redirects the old slug (github/docs@be38ec5d transferring-a-repository.md:62) until a repository
  is created at the old location (:68-69).
- Both scripts (CC correction #198): the no-reply author is LG_AUTHOR_LOGIN, default
  seathatflowsinourveins, and R's owner only when it is unset. A login of another shape is refused
  before any call (exit 11). The form <id>+<login>@users.noreply.github.com is unchanged
  (email-addresses-reference.md:47).
- codex_gate.py (CC correction #200): a review shown running with no connector activity for 90
  minutes gives 5. This is the CC's operational block, ported byte for byte.
- Local reviews: LOCAL_REVIEWS, with its alias CODEX_LOCAL_REVIEW, names normalized review files,
  and the gate decides from them alone:
  - 2 for a file that is malformed, of another head or not completed;
  - 4 for a P0 or P1 finding;
  - 0 otherwise, with P2 and P3 counted.
  lg_gate passes on the heads that carry the read head's change (lg_same_change).
- review_normalize.py writes the normalized files from a `codex review` rollout
  (openai/[email protected]) or from the /code-review plugin's comment
  (anthropics/claude-plugins-official@f359d43b).
- The new tests fail at c63c83a (104 failures, 7 errors) and pass here (133 tests).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…ty variable, refine the stale rule, drop host-only digests

From the CHANGES_REQUESTED reads at c999eee: the CC's Claude read, the CC's /code-review probe and
Astra's read.

- P1, the base: a codex-review now records the merge base its request named (openai/[email protected]
  review_request.rs:21, :62-70; branch.rs:13-15), and lg_gate requires it to be
  git merge-base <head> origin/main. Base = head and base = head^ stop.
- P1, an empty variable: a set but empty LOCAL_REVIEWS or CODEX_LOCAL_REVIEW now selects local mode and
  stops (2), instead of falling back to the connector.
- P2, the order: a review of our head that ended other than Completed gives 4 before the stale 5. A
  trigger after a stall gets the NOSTART grace, and the eyes reaction with no Running row is bounded.
- #200's value: OpenAI's Codex docs state no review time limit. The README records the measured basis
  (nas#1056) and keeps the value in one constant.
- P3s:
  - LANDING_REPO must have the owner/name shape, and every -R "$R" is quoted;
  - users/<login> must be of type User;
  - Legacy rollouts are refused, fail closed (exec/src/lib.rs:1425-1432; rollout/src/policy.rs:141-155);
  - codex_wait gives a local 2 its own message;
  - the plugin comment is bound to --head by its full-SHA links.
- Astra P1-3: the README carries no digest or prefix of a host-only file any more, and a test refuses any
  digest that is neither a tracked file's nor a named public artifact's.
- Astra's follow-ups 1 and 2: a refused retry removes the earlier --out file, and a non-finite
  confidence stops the gate.
- The new tests fail at c999eee (144 tests: failures=164, errors=2) and pass here (144 tests).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…eview rule and local reviews for the Codex gate (#1061)

* Land on the organization's repository as the merging account; add a stale-review rule and local reviews to the Codex gate

- nas_land.sh: R comes from LANDING_REPO, default native-agent-stack/native-agent-stack. GitHub
  redirects the old slug (github/docs@be38ec5d transferring-a-repository.md:62) until a repository
  is created at the old location (:68-69).
- Both scripts (CC correction #198): the no-reply author is LG_AUTHOR_LOGIN, default
  seathatflowsinourveins, and R's owner only when it is unset. A login of another shape is refused
  before any call (exit 11). The form <id>+<login>@users.noreply.github.com is unchanged
  (email-addresses-reference.md:47).
- codex_gate.py (CC correction #200): a review shown running with no connector activity for 90
  minutes gives 5. This is the CC's operational block, ported byte for byte.
- Local reviews: LOCAL_REVIEWS, with its alias CODEX_LOCAL_REVIEW, names normalized review files,
  and the gate decides from them alone:
  - 2 for a file that is malformed, of another head or not completed;
  - 4 for a P0 or P1 finding;
  - 0 otherwise, with P2 and P3 counted.
  lg_gate passes on the heads that carry the read head's change (lg_same_change).
- review_normalize.py writes the normalized files from a `codex review` rollout
  (openai/[email protected]) or from the /code-review plugin's comment
  (anthropics/claude-plugins-official@f359d43b).
- The new tests fail at c63c83a (104 failures, 7 errors) and pass here (133 tests).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Carry Codex's verdict into the local review gate and make the /code-review arm advisory

The CC's follow-up to the first commit of this pull request.

- review_normalize.py carries Codex's overall_correctness verbatim, and overall_confidence_score when
  present. openai/[email protected] rubric.md:85 fixes "patch is correct" | "patch is incorrect",
  while the wire type is a free String (protocol.rs:3507). The mirror at 092d3acd6 holds the same
  bytes as the tag.
- codex_gate.py:
  - "patch is incorrect" blocks (4), whatever the findings' priorities;
  - any verdict other than exactly those two stops (2), as does a set with no completed
    codex-review (the required arm).
- The /code-review arm is advisory until the review-replay addendum measures it (arms E and F).
  Below a score of 80 the plugin does not proceed to its comment (code-review.md:26), and it
  skips a pull request it already reviewed (:11). So its issues are counted and a missing comment
  is noted, and neither stops the gate.
- The new tests fail at a6c8bf7 (134 tests: failures=76, errors=2) and pass here (134 tests).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Fix the reviews at c999eee: bind the review's base, stop on a set empty variable, refine the stale rule, drop host-only digests

From the CHANGES_REQUESTED reads at c999eee: the CC's Claude read, the CC's /code-review probe and
Astra's read.

- P1, the base: a codex-review now records the merge base its request named (openai/[email protected]
  review_request.rs:21, :62-70; branch.rs:13-15), and lg_gate requires it to be
  git merge-base <head> origin/main. Base = head and base = head^ stop.
- P1, an empty variable: a set but empty LOCAL_REVIEWS or CODEX_LOCAL_REVIEW now selects local mode and
  stops (2), instead of falling back to the connector.
- P2, the order: a review of our head that ended other than Completed gives 4 before the stale 5. A
  trigger after a stall gets the NOSTART grace, and the eyes reaction with no Running row is bounded.
- #200's value: OpenAI's Codex docs state no review time limit. The README records the measured basis
  (nas#1056) and keeps the value in one constant.
- P3s:
  - LANDING_REPO must have the owner/name shape, and every -R "$R" is quoted;
  - users/<login> must be of type User;
  - Legacy rollouts are refused, fail closed (exec/src/lib.rs:1425-1432; rollout/src/policy.rs:141-155);
  - codex_wait gives a local 2 its own message;
  - the plugin comment is bound to --head by its full-SHA links.
- Astra P1-3: the README carries no digest or prefix of a host-only file any more, and a test refuses any
  digest that is neither a tracked file's nor a named public artifact's.
- Astra's follow-ups 1 and 2: a refused retry removes the earlier --out file, and a non-finite
  confidence stops the gate.
- The new tests fail at c999eee (144 tests: failures=164, errors=2) and pass here (144 tests).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Require local reviews on nas, let the latest review decide, revert the eyes bound, harden the digest guard

The fixes for the CC's Claude delta and Astra's read at 974090c, both
CHANGES_REQUESTED:

- nas_land.sh requires local reviews (the CC's ruling). With LOCAL_REVIEWS
  and CODEX_LOCAL_REVIEW both unset it stops with 2 before any call, before
  the lock, update-branch and ready. The one exception is
  LOCAL_REVIEW_WAIVER: a file whose last Waiver line reads "Waiver: local
  reviews for #<pr> at <head8>", checked in verdict_gate and again by
  final_gate. A waived landing asks the connector as before and records the
  waiver in its squash body, after the body GitHub offers for the squash
  (viewerMergeBodyText, where gh's own edit step starts). uet_land.sh keeps
  the connector path; neither the shared block nor codex_gate.py changes
  for this.
- codex_gate.py, Astra's P2: the latest review of our heads since the
  trigger decides. An earlier completion hid a later Cancelled review:
  beside a stale row of another commit the gate gave 5, and with no row
  running 0. Both give 4 now; a later completion still supersedes a
  failure. The base's test that pinned "any completion evidence passes" is
  flipped.
- codex_gate.py: the connector's eyes reaction with no Running row waits
  (3) with no bound again, as at c999eee; 974090c's 5 was a new opening.
- Sources cited: the users API's type and the owner/repo parameters
  (github/rest-api-description@58b1e0c0), the repository-name rule
  (github/docs@be38ec5d), the set-or-unset tests (bash(1), cpython
  v3.13.16 os.environ), os.replace and os.unlink, json's number parsing
  and math.isfinite.
- The digest guard reads any letter case and bare prefixes (a commit id
  must be a named public commit), the four scripts and, with
  LANDING_PR_BODY, a pull request's body; its known digests are the files
  git tracks.
- README: the requirement and the waiver, the latest-review rule, the
  eyes revert, the guard and its residuals, the clean-comment limit, the
  sources and the files as committed. manifests/evidence.json: the six
  records.

The module run against 974090c's tools/landing: 156 tests, FAILED
(failures=31, skipped=1). The guard's probes are measured against
974090c's guard, which finds none of them.

Follow-ups (P3 from the reviews at f9266fd; not changed here):
- GPT 1: pin a Git citation for the tracked-file selection.
- GPT 2: retry recovery still keeps output on a usage error; use a fresh output path per attempt before adding retries.
- GPT 3: digest coverage and evidence packaging stay bounded (README 585-587).
- GPT 4: keep the recorded adjacent boundaries (the clean plugin comment binds no head; the arm stays advisory).
- GPT 5: inherited hostname hygiene in the tests.
- Claude 1: README 98-99 still states the reversed Completed/Cancelled rule; the gate gives 4.
- Claude 2: README 203 and nas_land.sh 15-16 say a 5 proceeds; it now proceeds only under a waiver.
- Claude 3: README 345 and nas_land.sh 332 say uet_land.sh binds GPT_VERDICT; it binds the head prefix only.
- Claude 4: no same-second completion/failure tie test; no "waiver unreadable" test.
- Claude 5: a failed git rev-parse is read as "not a work tree" in the digest guard test.
- Claude 6: a set-but-empty LOCAL_REVIEWS passes the presence check; update-branch and ready run before exit 9.

Co-Authored-By: Claude Opus 5.5 <[email protected]>