Consensus loop: GitHub review evidence parser defaults missing or malformed review_round to 1

[MarketingChronoAi]

Problem

GitHub review evidence parsing does not require valid review-round metadata. If review_round is missing, blank, 0, non-numeric, or left as ${REVIEW_ROUND}, parsing defaults to round 1. This weakens diagnostics and ordering and hides prompt-rendering failures.

Confirmed behavior

• extract_review_round() returns None when no valid positive integer line exists.
• parse_github_review_evidence() uses extract_review_round(body) or 1.
• The parser validates marker, final sentinel, and head SHA, but not original review-round presence/validity.

Evidence

• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py: REVIEW_ROUND_RE accepts positive integer review rounds.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py: extract_review_round(text).
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py: parsed_round_number = extract_review_round(body) or 1.
• /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py: GitHub comments are parsed through parse_github_review_evidence(...).

Suggested fix

• Treat missing or malformed review_round as invalid evidence for new comments.
• Preserve legacy handling only if a migration path is explicitly required.
• Surface a precise invalid-evidence reason instead of silently defaulting to round 1.

Acceptance criteria

• Missing review round is rejected or marked invalid, not silently defaulted.
• Literal ${REVIEW_ROUND} is rejected or marked invalid.
• Non-positive and non-numeric rounds are rejected or marked invalid.
• Tests cover valid, missing, malformed, and literal-placeholder review-round metadata.

Review status

This was independently reviewed in /Users/chronoai/Desktop/proposed-main-repo-issues-review-gate.md and classified high confidence.

⟦AI:AUTO-LOOP⟧
ISSUE_RAISED:review-gate-hardening:review-round-parser-default

[ctkm-aelf]

🤖 Minimal solver proposes fail-closed review_round validation

TL;DR

• What this is: Minimal-change solver output for issue Consensus loop: GitHub review evidence parser defaults missing or malformed review_round to 1 #45.
• Current state or conclusion: The reported parser default is real and should be fixed by rejecting missing or malformed review_round metadata.
• What the controller does next: Use this as one design-consensus input and compare it with the other solver outputs.

---

Minimal Framing

parse_github_review_evidence() is the parser function that turns GitHub review comments into review-gate evidence; it currently lets extract_review_round() return None and then defaults that to round 1. The relevant file reference matters because /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py:143 is the single line where malformed or missing ordering metadata becomes accepted evidence.

Option	Trade-off
Reject missing/malformed review_round in the parser	Smallest change; live malformed comments require redispatch.
Add migration compatibility	Avoids disruption for old comments; keeps the silent-default risk alive.
Add a new metadata abstraction	More explicit model; unnecessary for this localized failure.

Recommended plan: keep REVIEW_ROUND_RE as the source of valid positive integer syntax, remove the or 1 default, return invalid evidence with a reason such as invalid_review_round:<role>, and update the existing review-gate tests that currently treat empty review rounds as valid.

📎 Full raw codex output (archival)

---
solver: minimal
issue: 45
cluster: issue-45
verdict: propose
---

## Recommended framing
在 `parse_github_review_evidence()` 内移除 `extract_review_round(body) or 1` 的静默默认值，把缺失、空白、`0`、非数字和字面 `${REVIEW_ROUND}` 都作为无效 GitHub review evidence 返回；这是最小可行边界，因为现有 `REVIEW_ROUND_RE` 已经只接受正整数，现有 invalid-evidence 通道也已经能阻断 gate，不需要新增协议、状态模型或迁移层。Reference-frame note: fail-closed input validation for automation gate evidence; externally supplied metadata that orders or authorizes a gate must be explicit and parseable, not inferred.

## Concrete plan
- Files:
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py`: change `parse_github_review_evidence()` so it stores `parsed_round_number = extract_review_round(body)`, parses the review marker first to know the role when possible, and returns `valid=False` with a precise reason such as `invalid_review_round:<role>` when the round is missing or malformed before accepting head SHA evidence.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py`: update the existing empty-round acceptance test at lines 386-398 into a fail-closed test, and extend `test_malformed_github_comment_evidence_fails_closed_without_merge` with missing, blank, `0`, non-numeric, and `${REVIEW_ROUND}` cases.
- LOC delta: ~+20 / -8.
- Tests to add/modify:
  - Modify `test_github_comment_empty_review_round_is_valid_and_gate_completes` to expect blocked status and no merge.
  - Add subcases in `test_malformed_github_comment_evidence_fails_closed_without_merge` for missing `review_round`, blank `review_round:`, `review_round: 0`, `review_round: abc`, and `review_round: ${REVIEW_ROUND}`.
  - Keep at least one valid GitHub comment path unchanged so `review_round: 1` remains accepted.
- Governance/ruleset change (if any): none.
- Migration path: no migration needed for new GitHub comments; old malformed comments will be reclassified as invalid evidence and the controller can redispatch fresh reviewers.

## Risks
- Existing live GitHub comments that omitted `review_round` will stop satisfying the review gate and require redispatch.
- A single generic `invalid_review_round:<role>` reason is precise enough for diagnosis but does not distinguish missing from malformed unless the implementation chooses separate reason strings.
- Parser ordering needs care: malformed review markers should continue to report `invalid_review_marker:<role>` rather than being masked by round validation when no reliable role can be extracted.

## Escalation triggers (if any)
- none

## Reasoning trace (internal — short, for meta-judge)
- Why this is the minimum: the violation is localized to `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py:143`, where `None` from `extract_review_round()` becomes round `1`; the regex at line 12 and helper at lines 81-85 already define valid positive integer metadata.
- What I considered but rejected: adding a new parsed metadata type or migration compatibility mode; both add surface area without changing the gate outcome needed by the issue.
- What I cannot decide alone: whether the exact invalid reason should split missing versus malformed; consensus can choose this without changing the minimal file boundary.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:minimal:propose:Reject malformed GitHub review_round metadata in the existing parser and update targeted review-gate tests

⟦AI:AUTO-LOOP⟧

[ctkm-aelf]

🤖 Structural solver proposes fail-closed review-round parsing

TL;DR

• What this is: Structural solver output for issue Consensus loop: GitHub review evidence parser defaults missing or malformed review_round to 1 #45, focused on GitHub review evidence parsing.
• Current state or conclusion: The parser should reject missing, blank, non-positive, non-numeric, and literal-placeholder review_round metadata instead of defaulting to round 1.
• What the maintainer should do OR what the controller does next: The controller can compare this with the other solver outputs and select the implementation shape.

---

Structural proposal

review_round should be treated as required provenance for GitHub review evidence. In the current parser, parse_github_review_evidence() calls extract_review_round(body) or 1, so a missing or malformed round becomes valid ordering metadata. That matters because review-gate selection uses round_number to decide which reviewer evidence is current.

The clean structure is a small parsed-round result in review_gate_selection.py: it carries either a positive integer or a precise invalid-evidence reason. parse_github_review_evidence() can then reuse the existing invalid ParsedGithubReviewEvidence path instead of adding a second validation channel. wakeup_runner.py already propagates valid and reason, so the boundary does not need deeper plumbing.

Option	Trade-off
Add ParsedReviewRound and fail closed	About +55/-20 LOC, explicit diagnostics, prevents fallback from reappearing at the call site.
Minimal if round is None guard	Fewer lines, but missing and malformed reasons remain easier to collapse accidentally.
Legacy migration window	Avoids blocking old comments, but preserves the exact silent-default risk unless explicitly time-boxed.

File references: /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py:143 is the default-to-1 line that should be removed. /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py:386 currently asserts blank rounds are valid, so it should flip to a fail-closed test.

---

📎 Full raw codex output (archival)

---
solver: structural
issue: 45
cluster: issue-45
verdict: propose
---

## PROJECT_RULES clause violated (quoted verbatim)
> All injected fragments must be defined as structs in `core/context` and implement ContextualUserFragment trait

> Features that change the agent logic MUST add an integration test:

> When writing tests, prefer comparing the equality of entire objects over fields one by one.

Reference-frame note: fail-closed evidence parsing. A review gate should treat missing required provenance as invalid input, not infer an ordering key from absence.

## Recommended framing
把 GitHub review evidence 的 `review_round` 从“可选字段加默认值”提升为一个显式解析出来的必需元数据对象，例如 `ParsedReviewRound` 或 `ReviewRoundMetadata`，并让 `parse_github_review_evidence()` 在 marker、final sentinel、head SHA 之外同等验证它。结构上，round 不再是 `extract_review_round(body) or 1` 这种丢失原因的裸 `Option[int]`，而是解析阶段产生的有效值或精确 invalid reason；这样缺失、空白、`0`、非数字和 `${REVIEW_ROUND}` 都会被同一条 evidence-validity 路径拒绝，而不是靠后续选择逻辑碰巧处理。

## Concrete plan
- New abstractions (if any): `ParsedReviewRound` dataclass in the review-gate parser layer, project `consensus-loop` Python scripts, file `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py`. Interface: `round_number: int`, `valid: bool`, `reason: str`; helper `parse_required_review_round(text: str, role: str) -> ParsedReviewRound`.
- Files:
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py`: add `ParsedReviewRound`, keep `extract_review_round()` as a compatibility helper if needed by existing callers, replace `parsed_round_number = extract_review_round(body) or 1` with fail-closed required-round parsing, and return invalid `ParsedGithubReviewEvidence` with reason `missing_review_round:{role}` or `invalid_review_round:{role}`.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py`: no behavioral plumbing change expected; `_review_evidence_from_github_comment()` already preserves `valid` and `reason` from `parse_github_review_evidence()`.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py`: replace permissive blank-round GitHub comment tests and add malformed-round cases.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py`: update or replace tests around `highest_complete_required_review_round()` only if they directly depend on GitHub-comment blank-round compatibility; local artifact/log round extraction from filenames should remain unchanged.
- LOC delta: ~+55 / -20 across 2-3 files.
- Tests to add:
  - `test_parse_github_review_evidence_requires_review_round`: valid comment with `review_round: 2` returns a valid whole `ParsedGithubReviewEvidence`.
  - `test_malformed_github_comment_evidence_fails_closed_without_merge`: extend invalid cases for missing line, blank line, `review_round: 0`, `review_round: abc`, and `review_round: ${REVIEW_ROUND}`; each blocks merge with `invalid_reviewer_evidence:<reason>:tests`.
  - Replace `test_github_comment_empty_review_round_is_valid_and_gate_completes` with a failing-closed version asserting no merge and the precise reason.
  - Replace GitHub ordering tests that currently use `round_number=None` with explicit valid round numbers so recency ordering remains tested independently from metadata validity.
- Schema/protocol changes (if any): none; this is parser validation for existing GitHub comment evidence text.
- Governance/ruleset changes (if any): none. The available `AGENTS.md` rules already require bounded tests and object-level assertions; no Tier, SPEC, conformance, or trusted-base wording change is needed.
- Runtime cost: one additional regex/search pass or one combined line scan per parsed GitHub comment; expected <0.05 ms per comment and one small dataclass allocation per comment. No network calls, actor hops, channel sends, schema generation, or persistent storage changes.
- If the structural answer is issue decomposition, use the controller-private `IssueDecompositionPlan` boundary and child body artifacts; forbid solver/judge/worker GitHub lifecycle, public issue factories, and any `wakeup_plan.py` decompose action/projection.
- Do not author helper-owned decomposition tracking comments or child fingerprint lines; the checked-in #403 helper is the only writer for the parent tracking grammar and per-child idempotency fingerprints.

## Risks
- This intentionally rejects legacy GitHub comments that omitted or blanked `review_round`; if any old open PR still relies on those comments, the gate will wait or redispatch reviewers instead of merging.
- A new dataclass is more structure than a two-line `if parsed_round_number is None`, but it keeps round validity and diagnostic text together and prevents another fallback from reappearing at the call site.
- Keep the abstraction bounded to GitHub comment evidence. Do not retrofit local review artifact/log parsing, because local rounds already come from `review-pr<PR>-<role>-r<N>` filenames and are a separate evidence source.

## Escalation triggers (if any)
- none

## Reasoning trace (internal — for meta-judge)
- Why this structure beats a documented exception: A documented exception would preserve the silent default path. The problem is not lack of documentation; it is that malformed provenance is converted into valid ordering metadata.
- Why I picked this abstraction over alternatives: A tiny `ParsedReviewRound` result gives the parser exactly one place to distinguish valid, missing, malformed, and placeholder metadata while preserving the existing `ParsedGithubReviewEvidence` invalid-evidence flow. It is justified by at least two parser branches: valid marker bodies and invalid marker bodies both need a role-aware round/reason without falling back to `1`.
- What I cannot decide alone: Whether to support a migration window for comments already posted before this fix. The issue suggests preserving legacy handling only if explicitly required, and no such requirement is present in the source snapshot.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:structural:propose:fail-closed review_round parsing with a small parsed-round metadata result and focused GitHub evidence tests

⟦AI:AUTO-LOOP⟧

[ctkm-aelf]

🤖 Delete-solver proposal: remove silent review_round fallback

TL;DR

• What this is: Delete-role design consensus output for issue Consensus loop: GitHub review evidence parser defaults missing or malformed review_round to 1 #45.
• Current state or conclusion: The review gate is load-bearing, but the review_round default-to-1 fallback is removable and should fail closed.
• What the controller does next: Compare this with the other solver roles and pick the smallest implementation that rejects missing or malformed review-round metadata.

---

Delete framing result

I classify this as a collapse-and-delete case: keep GitHub review evidence parsing, but delete the compatibility behavior that turns invalid or absent review_round metadata into round 1.

The key source line is /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py:143, where extract_review_round(body) or 1 silently converts missing, blank, placeholder, or malformed metadata into valid ordering metadata. That matters because GitHub comments are parsed through wakeup_runner._review_evidence_from_github_comment(...), so this fallback can authorize or order review-gate evidence that should be invalid.

Recommended implementation shape:

Option	Trade-off
Delete only the or 1 fallback and return invalid evidence with missing_review_round:<role> or invalid_review_round:<role>	Smallest change; preserves the review gate and existing invalid-evidence plumbing.
Delete GitHub review evidence parsing entirely	Unsafe; wakeup_runner.py and wakeup_plan.py use it for live review-gate completion.
Keep the fallback for legacy comments	Preserves compatibility but keeps the issue's diagnostic and ordering bug.

Tests should invert the current blank-round acceptance coverage: missing, blank, ${REVIEW_ROUND}, zero, negative, and non-numeric rounds should block GitHub-comment review completion instead of completing the gate.

📎 Full raw codex output (archival)

---

solver: delete
issue: 45
cluster: issue-45
verdict: propose

Classification

d) Genuinely needed but over-built.

Reference-frame note: fail-closed evidence validation. Metadata that orders or authorizes automated gate decisions should be explicit and valid; parser compatibility defaults are only acceptable when they do not change authorization or ordering.

Recommended action

Delete the implicit GitHub review evidence fallback from parse_github_review_evidence: parsed_round_number = extract_review_round(body) or 1 should no longer turn missing, blank, zero, non-numeric, or literal-placeholder review_round metadata into round 1. Keep the review evidence parser and GitHub comment ingestion path, because they are load-bearing for review-gate completion in wakeup_runner.py and wakeup_plan.py. Collapse the current "missing round means round 1" behavior into a single invalid-evidence path such as invalid_review_round:<role> or missing_review_round:<role>, and update tests that currently encode blank-round acceptance to assert fail-closed behavior instead.

Concrete plan (if propose)

• Files to delete: none as whole files.
• Behavior/LOC to delete:
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py: delete the or 1 fallback at line 143 and require extract_review_round(body) to produce a positive integer before evidence can be valid.
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py: delete or invert test_github_comment_empty_review_round_is_valid_and_gate_completes so blank GitHub review rounds block the gate instead of completing it.
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py: delete or invert blank-round completion expectations in test_review_gate_completion_uses_recency_resolved_github_comments_with_empty_rounds and keep recency tests only for comments with valid positive rounds.
• Caller migrations:
  • wakeup_runner._review_evidence_from_github_comment(...) -> no API migration; it already propagates ParsedGithubReviewEvidence.valid and reason into ReviewEvidence.
  • wakeup_plan.highest_complete_required_review_round(...) -> no API migration; it already consumes selected review evidence and blocks on invalid evidence.
  • Tests/helpers that emit GitHub review comments -> include an explicit positive review_round value instead of relying on blank metadata.
• Tests to delete:
  • Delete the positive assertion that empty GitHub review rounds are valid.
  • Delete only the parts of blank-round plan tests that assert completion; preserve or rewrite them as invalid-evidence regression coverage.
• Tests to add/update:
  • Valid positive round is accepted and preserves the parsed number.
  • Missing review_round is invalid.
  • Blank review_round: is invalid.
  • Literal ${REVIEW_ROUND} is invalid.
  • review_round: 0, negative, and non-numeric values are invalid.
  • Malformed round evidence blocks GitHub-comment review completion without merge.
• LOC delta: approximately -2 to -8 net if existing blank-round acceptance tests are inverted in place; deletion-positive behavior is the removal of the compatibility default, not a whole-module deletion.
• Philosophy/CLAUDE.md/SPEC/Tier changes (if any): none.

Reverse-evidence (why this is safe to delete)

• No public API breaks: rg found only the parser, its wrappers, and tests under the consensus-loop scripts; no external public protocol or CLI surface depends on a blank review_round being accepted.
• No external repo dependency on the code: $EXTERNAL_REPOS were untouched; this design pass inspected only the cited local skill source and the current repository issue context.
• Tests covering the path are themselves not load-bearing: test_github_comment_empty_review_round_is_valid_and_gate_completes encodes the bug as expected behavior and should be replaced by fail-closed tests.
• GitHub comment ingestion remains intact: parse_github_review_evidence(...) is still needed by wakeup_runner._review_evidence_from_github_comment(...), and review selection remains needed by select_latest_live_head_review_evidence(...).
• Existing parser strictness already supports the desired direction: REVIEW_ROUND_RE only accepts positive integers, and extract_review_round() already returns None for missing or malformed metadata. The unsafe part is only the downstream default to 1.
• Existing invalid-evidence plumbing already exists: marker, sentinel, and head-SHA failures return invalid ParsedGithubReviewEvidence values with precise reasons, so review-round failures can use the same path instead of introducing a new subsystem.

Risks

• If there are legacy GitHub review comments without round metadata that must still authorize current merges, deleting the fallback will block those comments until reviewers repost evidence with an explicit positive review_round.
• If downstream reporting assumes every parsed GitHub review evidence has a positive round_number even when invalid, the implementation may need a sentinel round value for invalid evidence or a small dataclass/API adjustment. That is an implementation detail, not a reason to keep the fallback.
• The cited files live under /Users/chronoai/.claude/skills/consensus-loop, which is not a git worktree here, so git blame intent could not be verified locally.

Escalation triggers (if any)

• None.

Reasoning trace (internal — for meta-judge)

• Why I claim this can be deleted: the issue targets a compatibility/defaulting behavior, not the review gate. extract_review_round() already rejects malformed data by returning None; only parse_github_review_evidence() reintroduces acceptance by defaulting to 1. Removing that fallback strengthens existing fail-closed validation.
• What I checked to verify safety: direct parser source; wakeup_runner call path; wakeup_plan completion tests; rg hits for extract_review_round, parse_github_review_evidence, REVIEW_ROUND_RE, and review_round; current tests that explicitly assert blank-round validity; GitHub issue 45 state/title via gh issue view.
• What I cannot decide alone: whether maintainers need a migration window for already-posted legacy review comments. The issue explicitly says preserve legacy handling only if a migration path is required; delete framing says no current deletion dependency justifies keeping the silent fallback by default.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:delete:propose:delete the silent review_round default-to-1 fallback and invert blank/malformed-round tests to fail closed

⟦AI:AUTO-LOOP⟧

[ctkm-aelf]

🤖 Meta-judge requests one narrowed convergence round

TL;DR

• What this is: Round-1 meta-judge decision for issue Consensus loop: GitHub review evidence parser defaults missing or malformed review_round to 1 #45.
• Current state or conclusion: All three solvers agree on fail-closed review_round validation, but they differ on parser shape and exact test scope.
• What the controller does next: Dispatch round 2 with a narrow question about minimal guard versus ParsedReviewRound, and whether test_wakeup_plan.py is in scope.

---

Meta-judge decision

The shared behavior target is settled: GitHub review evidence must reject missing, blank, non-positive, non-numeric, and literal-placeholder review_round metadata instead of defaulting it to round 1. The remaining disagreement is narrow but implementation-bearing.

parse_github_review_evidence() is the parser function that converts GitHub comments into review-gate evidence. The disputed implementation boundary matters because one proposal removes only the extract_review_round(body) or 1 fallback, while another adds a small ParsedReviewRound result object to keep the valid value and invalid reason together.

Option	Trade-off
Consensus now	Not valid yet because solver plans disagree on abstraction and test scope.
Converge round 2	Best fit; asks one named technical question and preserves the settled fail-closed behavior.
Triage only	Not applicable; all solvers found a real source-change issue.

Round 2 should answer exactly whether implementation uses a minimal None guard or a ParsedReviewRound helper, which files are in scope_paths, and whether missing versus malformed rounds need separate reasons such as missing_review_round:<role> and invalid_review_round:<role>.

---

📎 Full raw codex output (archival)

---
issue: 45
cluster: issue-45
convergence_round: 1
solver_verdicts:
  minimal: propose
  structural: propose
  delete: propose
decision: converge
action_mode: plan
canonical_key: ChronoAIProject/codex#45
next_action: plan
---

## Decision
三個 solver 都同意 GitHub review evidence 的 `review_round` 必須 fail closed，且缺失、空白、非正數、非數字與字面 `${REVIEW_ROUND}` 不應再被預設成 round `1`；但它們尚未在實作邊界上達成深層一致。Minimal 和 delete framing 偏向刪除 `or 1` fallback 並沿用既有 invalid-evidence 通道，structural framing 則要求新增 `ParsedReviewRound` 類型並可能調整 `test_wakeup_plan.py`。依照本輪 truth table，這是具名技術分歧，應進入第二輪 convergence，而不是直接 dispatch implement。

Reference-frame note: fail-closed validation for authorization/order metadata. Gate evidence should carry explicit valid provenance instead of inferring an ordering key from absence.

## If converge
- Convergence question (specific): Should issue 45 be implemented as a minimal parser guard that removes `extract_review_round(body) or 1`, or as a small `ParsedReviewRound` abstraction, and are `test_wakeup_plan.py` changes in scope or only tests that directly parse GitHub comments?
- What each solver should address explicitly:
  - Name the exact implementation shape: minimal `None` guard, `ParsedReviewRound` dataclass/helper, or another already-justified shape.
  - Name the exact implementation scope paths and mark any optional test files as either required or out of scope.
  - State whether missing and malformed rounds need separate reasons such as `missing_review_round:<role>` versus `invalid_review_round:<role>`, or one precise reason is enough.
  - Preserve the shared behavior target: missing, blank, `0`, negative, non-numeric, and literal `${REVIEW_ROUND}` metadata are invalid evidence; valid positive rounds remain accepted.
  - State whether any legacy migration window is required; if yes, define it without preserving the silent default for new comments.
- Round number this fires: 2; marker payload uses source round `1`.
- Progress since prior round: all solvers verified the same root failure, agreed the silent round-1 fallback should be removed, agreed GitHub comment ingestion remains load-bearing, and agreed no governance, schema, or host production SSOT change is needed. The remaining divergence is named and limited to abstraction/test scope.
- Human-intervention threshold: not reached.

## Round audit trail (links to local artifacts)
- solver-minimal: .refactor-loop/logs/phase9-issue45-r1-minimal.log
- solver-structural: .refactor-loop/logs/phase9-issue45-r1-structural.log
- solver-delete: .refactor-loop/logs/phase9-issue45-r1-delete.log
- work-unit-producer: manual-issue (prompt-only provenance)
- work-unit-source-ref: gh-issue-45
- action_mode: plan
- canonical_key: ChronoAIProject/codex#45
- duplicate_search_summary: checked only the router-scoped issue snapshot and the three listed round-1 solver logs; no sibling judge artifacts, other issue artifacts, other round artifacts, branches, or PRs were used under the prompt boundary.
- branch: none
- PR: none
- commit: none
- unique_diff_status: not-applicable
- tests_verification: not run; this phase only arbitrates design consensus and made no source changes.
- resolution: converge
- next_action: plan

⟦AI:AUTO-LOOP⟧
META_JUDGE_DONE:converge:round-1:Decide parser shape and exact test scope for fail-closed review_round validation

⟦AI:AUTO-LOOP⟧

[ctkm-aelf]

🤖 Minimal solver narrows issue #45 to a parser-local required-round guard

TL;DR

• What this is: Round-2 minimal-change solver output for issue Consensus loop: GitHub review evidence parser defaults missing or malformed review_round to 1 #45.
• Current state or conclusion: The smallest viable fix is to remove the extract_review_round(body) or 1 fallback and require a valid positive review_round before GitHub review evidence can pass.
• What the controller does next: Compare this with the other round-2 solver outputs and choose the implementation boundary.

---

Minimal convergence answer

parse_github_review_evidence() is the GitHub comment parser that converts review comments into review-gate evidence. The current issue is localized: the parser already has a valid=False evidence path, but one line turns missing or malformed round metadata into round 1, which can hide prompt-rendering failures and order evidence incorrectly.

Option	Trade-off
Minimal required-round guard	Smallest change; preserves existing evidence types and invalid-reason plumbing.
New ParsedReviewRound helper/dataclass	Clearer missing-vs-malformed modeling; extra abstraction for one parser boundary.
Legacy default for old comments	Avoids redispatch for malformed comments; preserves the reported silent-default risk.

Recommended scope: change /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py, update /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py, and update /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py only where it still encodes blank GitHub comment rounds as a completed gate. Missing and malformed rounds may share invalid_review_round:<role>, but separate missing_review_round:<role> and invalid_review_round:<role> reasons are cheap and better for diagnostics.

📎 Full raw codex output (archival)

---
solver: minimal
issue: 45
cluster: issue-45
verdict: propose
---

## Recommended framing
在 `parse_github_review_evidence()` 里做最小的 fail-closed 修正：保留现有 `ParsedGithubReviewEvidence` 数据结构和 invalid-evidence 返回通道，只删除 `extract_review_round(body) or 1` 的静默默认值，并在接受 GitHub comment evidence 前要求 `review_round` 明确解析为正整数。Reference-frame note: fail-closed validation for automation gate provenance; ordering metadata that affects gate selection must be explicit and valid, not inferred from absence. 这不需要新增 `ParsedReviewRound` dataclass，因为现有 parser 已经有 `valid=False` 和 `reason` 字段，最小边界是在 parser 内把缺失、空白、`0`、负数、非数字和 `${REVIEW_ROUND}` 转成 invalid evidence。

## Concrete plan
- Files:
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py`: remove `parsed_round_number = extract_review_round(body) or 1`; parse the marker first enough to know the role; call `extract_review_round(body)`; if it returns `None`, return `_parsed_github_review_evidence(..., valid=False, reason=...)` before head SHA can make the evidence valid. Use a tiny local check for whether a `review_round`/`round` metadata line exists, not a new dataclass.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py`: invert the empty-round completion test and add malformed-round cases for missing metadata, blank metadata, `0`, negative, non-numeric, and literal `${REVIEW_ROUND}`. Keep valid positive `review_round: 1` coverage unchanged.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py`: update only the tests that still encode blank GitHub comment rounds as a completed gate, if those assertions are reached through the same shared review-gate parsing behavior. Do not broaden the plan test changes beyond that compatibility expectation.
- LOC delta: ~+18 / -10 in parser code, ~+35 / -20 in tests.
- Tests to add/modify:
  - Modify `test_github_comment_empty_review_round_is_valid_and_gate_completes` to expect blocked review-gate behavior and no merge.
  - Extend the malformed GitHub comment evidence coverage with subcases for absent `review_round`, `review_round:`, `review_round: 0`, `review_round: -1`, `review_round: abc`, and `review_round: ${REVIEW_ROUND}`.
  - Keep a valid positive-round GitHub comment path so `review_round: 1` remains accepted and ordering behavior still has coverage.
  - Update `test_review_gate_completion_uses_recency_resolved_github_comments_with_empty_rounds` only if the implementation path under test still imports or projects GitHub comment evidence through the shared parser contract.
- Governance/ruleset change (if any): none.
- Migration path: no migration window for new comments; old malformed comments become invalid evidence and the controller should redispatch reviewers with valid `review_round` metadata.

## Risks
- Existing live GitHub comments with missing or blank `review_round` will no longer satisfy the gate and may require redispatch.
- A minimal inline guard is less formal than a `ParsedReviewRound` object, but it avoids adding an abstraction for one parser call site.
- If the implementer chooses separate reasons, `missing_review_round:<role>` should mean no round metadata line exists, while `invalid_review_round:<role>` should cover blank, non-positive, non-numeric, negative, and placeholder values. One generic `invalid_review_round:<role>` would still satisfy the issue, but separate reasons make prompt-rendering failures easier to diagnose.

## Escalation triggers (if any)
- none

## Reasoning trace (internal — short, for meta-judge)
- Why this is the minimum: the verified source has a single silent fallback line, `extract_review_round(body) or 1`, and the existing return type already supports invalid evidence with a reason.
- What I considered but rejected: a `ParsedReviewRound` dataclass/helper, because it adds a new model for a single parser boundary without changing caller contracts; a legacy compatibility window, because it preserves the bug for the evidence class the issue is hardening.
- What I cannot decide alone: whether the implementer wants separate missing versus malformed reason strings; minimal consensus only requires invalid evidence, but separate strings are cheap and useful.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:minimal:propose:Remove the GitHub review_round default-to-1 fallback with a parser-local required-round guard and focused fail-closed tests.

⟦AI:AUTO-LOOP⟧

[ctkm-aelf]

🤖 Delete solver proposes removing only the review_round fallback

TL;DR

• What this is: Round-2 delete-role design input for issue Consensus loop: GitHub review evidence parser defaults missing or malformed review_round to 1 #45.
• Current state or conclusion: GitHub review evidence parsing is load-bearing, but the review_round default-to-1 fallback should be deleted.
• What the controller does next: Compare this with the other round-2 solver outputs and select the smallest fail-closed implementation.

---

Delete framing result

I classify this as a collapse-and-delete case. The review gate still needs GitHub comment evidence parsing, but it should stop treating absent or malformed ordering metadata as review_round: 1.

parse_github_review_evidence() is the parser that turns GitHub review comments into review-gate evidence. The important source line is /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py:143, where extract_review_round(body) or 1 silently converts missing, blank, placeholder, zero, or malformed metadata into a valid round number.

Option	Trade-off
Delete only the or 1 fallback	Smallest behavior change; keeps GitHub review evidence parsing and existing invalid-evidence plumbing.
Add a ParsedReviewRound abstraction	More explicit, but unnecessary because ParsedGithubReviewEvidence(valid=False, reason=...) already carries invalid state.
Delete GitHub comment review evidence parsing	Unsafe; wakeup_runner.py and wakeup_plan.py use it for live review-gate completion.

Implementation scope should include both runner and planner tests. /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py has several GitHub-comment tests that currently rely on blank rounds, and /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py:5292 explicitly asserts blank-round comments complete as round 1. Those expectations should be inverted or retargeted to valid positive rounds so only malformed-round tests fail closed.

📎 Full raw codex output (archival)

---

solver: delete
issue: 45
cluster: issue-45
verdict: propose

Classification

d) Genuinely needed but over-built.

Reference-frame note: fail-closed validation for authorization and ordering metadata. A gate should not infer a required ordering key from missing or malformed external input, because that hides prompt-rendering defects and can make invalid evidence selectable.

Recommended action

删除 parse_github_review_evidence() 中把无效或缺失 review_round 静默折叠为 1 的兼容 fallback，而不是删除 GitHub review evidence 解析本身。wakeup_runner._review_evidence_from_github_comment(...) 和 wakeup_plan.highest_complete_required_review_round(...) 都依赖这条路径判断 live GitHub review comments 是否满足 review gate，所以整条功能链是 load-bearing；应 collapse 为一个更小的 fail-closed 解析规则：marker 能解析出 role 后，review_round 必须由现有正整数语法显式产生，否则返回 invalid evidence，reason 用 missing_review_round:<role> 和 invalid_review_round:<role> 分开诊断即可。无需 legacy migration window；旧的 malformed comments 需要重新派发有效 reviewer comment。

Concrete plan (if propose)

• Files to delete: none as whole files.
• Behavior/LOC to delete:
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py:143: delete or 1 from parsed_round_number = extract_review_round(body) or 1.
  • Keep REVIEW_ROUND_RE and extract_review_round() as the single positive-integer parser; do not add a ParsedReviewRound dataclass for this issue because the existing ParsedGithubReviewEvidence(valid=False, reason=...) channel already carries invalid state to callers.
  • Parse REVIEW_DONE marker before accepting evidence so the invalid reason can name the role. For invalid markers where role cannot be trusted, keep the existing invalid_review_marker:<role-or-github> path and use fallback round 0 only inside invalid evidence objects if a positional round is still required by the dataclass.
  • After marker validation and before final sentinel/head SHA acceptance, require a positive parsed round. Suggested rule:
    • no round metadata line at all: missing_review_round:<role>
    • a round-like line exists but does not match the positive integer regex, including blank, 0, negative, non-numeric, and literal ${REVIEW_ROUND}: invalid_review_round:<role>
  • If distinguishing missing from malformed is too much code, a single invalid_review_round:<role> reason is acceptable; however separate reasons are preferable because the issue asks for precise diagnostics and the implementation can detect a round-like line with one small regex.
• Caller migrations:
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_runner.py:2485: no signature migration; it already propagates parsed.valid and parsed.reason into ReviewEvidence.
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/wakeup_plan.py:2506: no signature migration; highest_complete_required_review_round() already consumes the shared selector and should see invalid GitHub comment evidence as incomplete/blocking rather than completion.
• Tests to delete or invert:
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py:386: invert test_github_comment_empty_review_round_is_valid_and_gate_completes to assert blocked/no merge with missing_review_round or invalid_review_round.
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py:400, :417, :472, :498, :521, and :548: update GitHub-comment ordering, conflicting-marker, and stale-head tests so their baseline comments use valid review_round: 1; keep only the targeted malformed-round tests invalid. These tests are currently coupled to blank-round acceptance.
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py:5292: invert test_review_gate_completion_uses_recency_resolved_github_comments_with_empty_rounds so blank rounds do not produce round_number == 1 and do not suppress redispatch.
  • /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py:5336: use valid positive rounds for the unrelated conflicting-marker test so it continues testing marker conflicts rather than round validation.
  • Add focused parser or runner subcases for valid review_round: 1, missing metadata, blank metadata, review_round: 0, review_round: -1, review_round: abc, and review_round: ${REVIEW_ROUND}.
• LOC delta: about -1 for the compatibility fallback and +25 to +45 for explicit invalid-round checks/tests; deletion-positive in behavior, not in net lines.
• Philosophy/CLAUDE.md/SPEC/Tier changes (if any): none.

Reverse-evidence (why this is safe to delete)

• No public API breaks: checked direct callers with rg; parse_github_review_evidence() is imported by wakeup_runner.py, and wakeup_plan.py uses the same review-gate selection model rather than depending on a public wire contract.
• No external repo dependency checked: source path is outside /Users/chronoai/Desktop/codex, and no external repositories were modified or consulted.
• Tests covering the path are load-bearing, but the tests asserting blank-round success are encoding the bug. They should be inverted or retargeted to valid positive rounds.
• GitHub comment ingestion remains intact; only the silent conversion of invalid metadata into round 1 is removed.
• Existing REVIEW_ROUND_RE already defines the valid positive integer surface, so this plan does not create a new grammar.

Risks

• Existing live GitHub review comments without valid review_round will stop completing the gate and require redispatch.
• If a caller assumes every invalid ParsedGithubReviewEvidence has a positive round_number, using 0 for invalid-round evidence could expose an ordering edge; the selector already ignores invalid evidence for completion and uses invalid reasons for blocking, so this is expected to be safe.
• If implementers leave unrelated blank-round baseline comments in tests, those tests will start failing for the intended reason and obscure marker/head-SHA behavior.
• Git history/blame could not be verified because /Users/chronoai/.claude/skills/consensus-loop is not a Git repository in this environment.

Escalation triggers (if any)

• none

Reasoning trace (internal — for meta-judge)

• Why I claim this can be deleted: the only behavior to delete is extract_review_round(body) or 1, which turns invalid external metadata into valid ordering metadata. The parser, selector, runner, and planner are still needed.
• What I checked to verify safety: review_gate_selection.py:131-163 contains the default; wakeup_runner.py:2476-2508 propagates parsed invalid evidence without a deeper API change; wakeup_plan.py:2506-2547 consumes review completion evidence through the shared selector; tests in test_wakeup_runner_review_gate.py and test_wakeup_plan.py currently rely on empty rounds being accepted.
• What I cannot decide alone: whether maintainers prefer one generic invalid_review_round:<role> reason or the split missing_review_round:<role> / invalid_review_round:<role> diagnostics. I recommend the split because it is still small and answers the issue's diagnostic goal.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:delete:propose:delete silent review_round fallback, keep GitHub evidence parsing, update runner and plan tests to fail closed on missing or malformed rounds

⟦AI:AUTO-LOOP⟧

[ctkm-aelf]

🤖 Structural solver narrows review_round validation shape

TL;DR

• What this is: Round-2 structural solver output for issue Consensus loop: GitHub review evidence parser defaults missing or malformed review_round to 1 #45.
• Current state or conclusion: Use a private parser result object for required review_round metadata, and fail closed for missing, blank, non-positive, non-numeric, or literal-placeholder values.
• What the controller does next: Compare this with the other round-2 solver outputs and select the implementation scope.

---

Structural recommendation

ParsedReviewRound should be a private parser result object: it carries either a positive integer review round or an invalid-evidence reason. This keeps review_round as required provenance for GitHub review evidence without adding a new protocol, lifecycle path, or host state.

/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py:143 matters because extract_review_round(body) or 1 is where absent or malformed metadata becomes accepted ordering data. /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py:386 matters because it currently asserts blank GitHub review rounds complete the gate. /Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py:5292 matters because completion planning also has an empty-round GitHub comment success path.

Option	Trade-off
Private ParsedReviewRound helper	About +45/-28 LOC; explicit missing vs malformed diagnostics; prevents the fallback from reappearing at the parser call site.
Minimal if round is None guard	Fewer lines; keeps `int
Legacy migration window	Avoids redispatching old malformed comments; preserves the authorization/order risk for new evidence unless heavily time-boxed.

Recommended scope: update review_gate_selection.py, direct gate tests in test_wakeup_runner_review_gate.py, and completion-planning tests in test_wakeup_plan.py. Missing rounds should use missing_review_round:<role>; malformed rounds such as blank, 0, -1, abc, and ${REVIEW_ROUND} should use invalid_review_round:<role>.

---

📎 Full raw codex output (archival)

---
solver: structural
issue: 45
cluster: issue-45
verdict: propose
---

## PROJECT_RULES clause violated (quoted verbatim)
> FI-004 Facts that cross processes, turns, or nodes must have an authoritative record; in-process memory, caches, and temporary variables must not masquerade as fact sources.

> FI-006 Changes must be verifiable and evidence-based; failures, gaps, and out-of-scope promises must be exposed explicitly, and tests must not be disabled to force a pass.

## Recommended framing
把 GitHub review evidence 的 `review_round` 建模为 parser 层的必需 provenance，而不是 `extract_review_round(body) or 1` 的可选值加默认值。结构上应在 `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py` 增加一个小的 `ParsedReviewRound` 结果对象和 `parse_required_review_round()` helper，让同一个 parser 同时产出正整数 round 或精确 invalid reason；`parse_github_review_evidence()` 继续复用现有 `ParsedGithubReviewEvidence(valid=False, reason=...)` 通道，这样 `wakeup_runner.py` 与 `wakeup_plan.py` 两个调用路径都 fail closed，而不需要新增协议、GitHub lifecycle、host SSOT 或迁移状态。

Reference-frame note: fail-closed provenance validation for automation gates. Metadata that orders or authorizes review-gate evidence must be explicit and parseable; defaulting absent external metadata to an ordering key violates auditability.

## Concrete plan
- New abstractions (if any): `ParsedReviewRound` dataclass in the parser layer, project `consensus-loop` Python scripts, file `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py`. Fields: `round_number: int`, `valid: bool`, `reason: str`. Helper: `parse_required_review_round(text: str, role: str) -> ParsedReviewRound`, where a valid result has a positive integer and invalid results carry `missing_review_round:<role>` or `invalid_review_round:<role>`.
- Files:
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py`: keep `REVIEW_ROUND_RE` and `extract_review_round()` for compatibility, add the required-round helper, remove `parsed_round_number = extract_review_round(body) or 1` at line 143, parse marker first enough to identify the role, then reject missing/blank/non-positive/non-numeric/literal-placeholder round metadata before accepting head SHA evidence. Return invalid `ParsedGithubReviewEvidence` through `_parsed_github_review_evidence(...)`, with `round_number=0` for invalid round evidence because no authoritative ordering key exists.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py`: invert `test_github_comment_empty_review_round_is_valid_and_gate_completes` at lines 386-398; update blank-round GitHub comment tests at lines 400-561 to include explicit positive rounds when the behavior under test is recency, duplicate marker handling, conflicting marker handling, or stale-head handling; extend `test_malformed_github_comment_evidence_fails_closed_without_merge` at lines 648-681 with missing line, blank line, `review_round: 0`, `review_round: -1`, `review_round: abc`, and `review_round: ${REVIEW_ROUND}` cases.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py`: in scope. Invert or replace `test_review_gate_completion_uses_recency_resolved_github_comments_with_empty_rounds` at lines 5292-5334 so empty rounds do not produce completion; keep the recency-completion behavior by changing that positive-path fixture to use valid `review_round: 1` or `review_round: 2`. Update `test_review_gate_completion_latest_conflicting_github_comment_blocks_older_valid_role` at lines 5336-5382 to use valid rounds so it still isolates conflicting marker behavior rather than failing earlier on round validation.
- LOC delta: ~+45 / -28 across 3 files. The helper is roughly +25 LOC, parser call-site change ~-6/+10 LOC, tests ~+20/-22 LOC after replacing existing blank-round positive expectations rather than duplicating large fixtures.
- Tests to add:
  - Runner behavior test: missing `review_round` blocks with no merge and reason `missing_review_round:<role>`.
  - Runner behavior subcases: blank, zero, negative, non-numeric, and literal `${REVIEW_ROUND}` block with no merge and reason `invalid_review_round:<role>` except a truly absent line may use `missing_review_round:<role>`.
  - Runner positive path: valid `review_round: 1` comments still complete the gate and preserve recency ordering by `created_at`/comment id.
  - Wakeup-plan behavior: `highest_complete_required_review_round(...)` returns `None` for otherwise complete GitHub comments with empty/malformed rounds, and still returns the expected completion for valid positive rounds.
- Schema/protocol changes (if any): none. This is internal evidence parsing; no app-server, CLI, config, or persisted schema surface changes.
- Governance/ruleset changes (if any): none. The plan enforces existing FI-004/FI-006 by requiring authoritative review-round evidence rather than changing the invariant.
- Runtime cost: one extra regex scan or line scan per GitHub review comment; O(comment body bytes), expected <1 ms per 100 comments on local hardware. Allocation cost is one tiny frozen dataclass per comment containing 3 fields; no network calls, no actor hop, no additional disk reads.
- If the structural answer is issue decomposition, use the controller-private `IssueDecompositionPlan` boundary and child body artifacts; forbid solver/judge/worker GitHub lifecycle, public issue factories, and any `wakeup_plan.py` decompose action/projection.
- Do not author helper-owned decomposition tracking comments or child fingerprint lines; the checked-in #403 helper is the only writer for the parent tracking grammar and per-child idempotency fingerprints.

## Risks
- This blocks legacy live GitHub review comments that omitted or malformed `review_round`; the intended remediation is redispatching reviewers to produce valid comments, not preserving a migration window that keeps the authorization/order bug.
- `ParsedReviewRound` could be over-engineering if implemented as a general metadata framework. Keep it private to `review_gate_selection.py`, do not introduce a new module, and do not expose it beyond the parser helper unless a second concrete parser field needs the same result shape later.
- Returning `round_number=0` for invalid round evidence is deliberately non-authoritative. Selection already rejects `valid=False`, but tests should assert the invalid reason rather than treating `0` as an ordering value.

## Escalation triggers (if any)
- none

## Reasoning trace (internal — for meta-judge)
- Why this structure beats a documented exception: the failing value crosses from GitHub comments into gate ordering, so a documented exception would preserve the non-authoritative default. A required-round parse result makes absence and malformed input impossible to accept by construction at both current call paths.
- Why I picked this abstraction over alternatives: a minimal `if round is None` guard fixes the current line, but it keeps the parser API as an ambiguous `int | None` and makes missing-versus-malformed diagnostics easy to collapse. A private three-field helper is justified by two concrete consumers of the shared parser path: `wakeup_runner._github_review_evidences()` and `wakeup_plan.highest_complete_required_review_round(...)` through the shared selection behavior.
- What I cannot decide alone: whether maintainers prefer one generic `invalid_review_round:<role>` reason for all bad inputs. Structurally, separate `missing_review_round:<role>` and `invalid_review_round:<role>` is better because it distinguishes prompt omission from prompt rendering or user edit corruption without adding a second validation channel.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:structural:propose:Use a private ParsedReviewRound helper in review_gate_selection.py, keep wakeup_runner and wakeup_plan on the shared invalid-evidence path, and update both direct gate and completion tests to reject missing or malformed review_round metadata.

⟦AI:AUTO-LOOP⟧

[ctkm-aelf]

🤖 Meta-judge requests one final narrowed convergence round

TL;DR

• What this is: Round-2 meta-judge decision for issue Consensus loop: GitHub review evidence parser defaults missing or malformed review_round to 1 #45.
• Current state or conclusion: All solvers agree on fail-closed review_round validation, no legacy migration, and the direct runner plus plan tests being in scope.
• What the controller does next: Dispatch round 3 only on the remaining helper-object versus parser-local-guard implementation question.

---

Meta-judge decision

The implementation-bearing behavior is now settled: GitHub review evidence must reject missing, blank, non-positive, non-numeric, negative, and literal-placeholder review_round metadata instead of defaulting to round 1. review_round is provenance used to order or authorize review-gate evidence, so fail-closed validation is the applicable engineering frame.

parse_github_review_evidence() is the parser that converts GitHub comments into review-gate evidence. The remaining disagreement matters because one plan introduces a private ParsedReviewRound result object, while the other two plans keep the existing ParsedGithubReviewEvidence(valid=False, reason=...) invalid-evidence channel and add a parser-local required-round guard.

Option	Trade-off
Consensus now	Not valid yet because one solver requires ParsedReviewRound and two solvers explicitly prefer no new round result object.
Round 3 convergence	Keeps the already-settled behavior and scope, and asks only the implementation-boundary question.
Triage only	Not applicable because all three solvers proposed source and test changes.

Round 3 should answer exactly this: should implementation use a private ParsedReviewRound/parse_required_review_round() helper, or a parser-local guard with no new helper/dataclass? The scope should remain review_gate_selection.py, test_wakeup_runner_review_gate.py, and test_wakeup_plan.py unless a solver proves a file is not touched.

---

📎 Full raw codex output (archival)

---
issue: 45
cluster: issue-45
convergence_round: 2
solver_verdicts:
  minimal: propose
  structural: propose
  delete: propose
decision: converge
action_mode: plan
canonical_key: ChronoAIProject/codex#45
next_action: plan
---

## Decision
三個 solver 仍然同意實作方向是 implementation-bearing：GitHub review evidence 的 `review_round` 必須 fail closed，缺失、空白、`0`、負數、非數字與字面 `${REVIEW_ROUND}` 都不能再被 `extract_review_round(body) or 1` 靜默轉成 round `1`；也同意不需要 legacy migration window，且 `review_gate_selection.py`、`test_wakeup_runner_review_gate.py`、`test_wakeup_plan.py` 都在實作範圍內。Reference-frame note: fail-closed provenance validation for automation gates; authorization/order metadata from GitHub comments must be explicit and parseable. 但是 round 2 仍有 implementation-bearing 分歧：structural solver 要求新增私有 `ParsedReviewRound`/`parse_required_review_round()` helper，minimal 與 delete solver 則明確偏向 parser-local guard 並沿用既有 `ParsedGithubReviewEvidence(valid=False, reason=...)` 通道；依 truth table 這不是深層 consensus，必須再 converge 一輪，問題只保留這個 abstraction boundary。

## If converge
- Convergence question (specific): Should the issue 45 implementation introduce a private `ParsedReviewRound`/`parse_required_review_round()` helper, or should it use a parser-local guard plus existing `ParsedGithubReviewEvidence(valid=False, reason=...)` without a new round result object?
- What each solver should address explicitly:
  - Pick exactly one implementation shape: private `ParsedReviewRound` helper or parser-local guard with no new helper/dataclass.
  - State the concrete code reason why that shape is preferable at the current call sites, not a general style preference.
  - Keep the already-converged behavior target: missing, blank, `0`, negative, non-numeric, and literal `${REVIEW_ROUND}` are invalid evidence; valid positive rounds remain accepted.
  - Keep the already-converged scope paths unless a solver can prove one is not touched: `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py`, `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py`, and `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py`.
  - Use separate `missing_review_round:<role>` and `invalid_review_round:<role>` reasons unless rejecting that split is justified by existing parser constraints.
  - Do not propose a legacy migration window unless it excludes the silent default for all new GitHub comments and names an enforceable cutoff.
- Round number this fires: 3; marker payload uses source round `2`
- Progress since prior round: round 2 resolved that the parser must fail closed, no legacy migration is required, `test_wakeup_plan.py` is in scope because it also encodes empty-round GitHub comment success, and separate missing-versus-malformed reasons are preferred by structural/delete and acceptable to minimal. The only remaining split is whether the explicit required-round parse state needs a private helper object.
- Human-intervention threshold: not reached; this is round 2 and it produced new scope/test/reasoning convergence.

## Round audit trail (links to local artifacts)
- solver-minimal: .refactor-loop/logs/phase9-issue45-r2-minimal.log
- solver-structural: .refactor-loop/logs/phase9-issue45-r2-structural.log
- solver-delete: .refactor-loop/logs/phase9-issue45-r2-delete.log
- work-unit-producer: manual-issue (prompt-only provenance)
- work-unit-source-ref: gh-issue-45
- action_mode: plan
- canonical_key: ChronoAIProject/codex#45
- duplicate_search_summary: not run by judge; issue source snapshot and three routed round-2 solver logs were the only arbitration inputs
- branch: none
- PR: none
- commit: none
- unique_diff_status: not-applicable
- tests_verification: not run; judge-only arbitration artifact
- resolution: converge
- next_action: plan

⟦AI:AUTO-LOOP⟧
META_JUDGE_DONE:converge:round-2:Resolve ParsedReviewRound helper versus parser-local guard for required review_round validation.

⟦AI:AUTO-LOOP⟧

[ctkm-aelf]

🤖 Minimal solver selects parser-local review_round guard

TL;DR

• What this is: Round-3 minimal-change solver output for issue Consensus loop: GitHub review evidence parser defaults missing or malformed review_round to 1 #45.
• Current state or conclusion: Use a parser-local required-round guard and the existing invalid-evidence channel, not a new ParsedReviewRound helper/dataclass.
• What the controller does next: Compare this with the other round-3 solver outputs and choose the implementation boundary.

---

Minimal convergence answer

parse_github_review_evidence() is the function that turns GitHub comments into review-gate evidence. The current failure is localized: one line, extract_review_round(body) or 1, silently accepts missing or malformed ordering metadata as round 1.

ParsedGithubReviewEvidence already carries invalid evidence using valid=False and reason, so the smallest implementation is to delete the fallback and return reasons such as missing_review_round:<role> or invalid_review_round:<role> through the existing path. A private ParsedReviewRound object would be explicit, but it adds another result type for one parser boundary that already has a validity channel.

Option	Trade-off
Parser-local guard	Smallest change; preserves current parser data model and invalid-evidence plumbing.
Private ParsedReviewRound helper	More explicit object model; extra surface for a single call site.
Keep legacy fallback	Avoids redispatch for malformed old comments; preserves the reported ordering and diagnostics bug.

Scope remains review_gate_selection.py, test_wakeup_runner_review_gate.py, and test_wakeup_plan.py. Valid positive rounds should still pass; missing, blank, 0, negative, non-numeric, and literal ${REVIEW_ROUND} should fail closed.

📎 Full raw codex output (archival)

---
solver: minimal
issue: 45
cluster: issue-45
verdict: propose
---

## Recommended framing
Implement issue 45 with a parser-local required-round guard in `parse_github_review_evidence()`, not a new `ParsedReviewRound` helper/dataclass. The current violation is a single parser boundary where `extract_review_round(body) or 1` converts missing, blank, non-positive, non-numeric, negative, and literal placeholder metadata into valid round `1`; `ParsedGithubReviewEvidence` already has `valid` and `reason`, so the minimal viable fix is to remove the fallback and return invalid evidence through the existing channel. Reference-frame note: fail-closed provenance validation for automation gates; ordering metadata from GitHub comments must be explicit and parseable before it can authorize or order review evidence.

## Concrete plan
- Files:
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/codex_refactor_loop/review_gate_selection.py`: remove `extract_review_round(body) or 1`; parse and validate the `REVIEW_DONE` marker as today; after a trusted role is available and before final acceptance, require `extract_review_round(body)` to return a positive integer. Missing metadata should return `ParsedGithubReviewEvidence(valid=False, reason="missing_review_round:<role>")`; malformed metadata, including blank, `0`, negative, non-numeric, and `${REVIEW_ROUND}`, should return `reason="invalid_review_round:<role>"`. Use a small local metadata-line presence check if the implementation wants to distinguish missing from malformed; do not introduce a new dataclass/helper solely for this one call site.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_runner_review_gate.py`: invert `test_github_comment_empty_review_round_is_valid_and_gate_completes` so empty rounds block and no merge occurs; extend `test_malformed_github_comment_evidence_fails_closed_without_merge` with missing `review_round`, blank `review_round:`, `review_round: 0`, `review_round: -1`, `review_round: abc`, and `review_round: ${REVIEW_ROUND}`; keep one valid positive-round GitHub comment path unchanged.
  - `/Users/chronoai/.claude/skills/consensus-loop/scripts/test_wakeup_plan.py`: update the completion-planning tests that currently encode blank GitHub comment rounds as successful round `1`; use valid positive rounds for recency behavior that should still pass, and add or adjust fail-closed coverage where blank rounds should prevent completion.
- LOC delta: ~+25 / -18 across parser and tests.
- Tests to add/modify:
  - Modify 1 runner test that currently asserts blank GitHub `review_round` completes the gate.
  - Add 6 malformed-round subcases to the existing runner malformed-evidence test.
  - Modify 1 planner completion test that currently asserts blank-round GitHub comments complete as round `1`.
  - Keep or add 1 positive `review_round: 1` planner/runner path so valid evidence remains accepted.
- Governance/ruleset change (if any): none.
- Migration path: no migration needed; malformed existing GitHub comments should be reclassified as invalid evidence and redispatched with explicit positive `review_round` metadata.

## Risks
- Existing live review comments that omitted or malformed `review_round` will stop satisfying the gate until reviewers are redispatched.
- Distinguishing missing from malformed with a local line-presence check is enough for diagnostics but can be imprecise if comments contain unrelated prose mentioning `review_round`; that is acceptable because both outcomes remain fail-closed.
- Parser ordering needs care: invalid marker handling should remain `invalid_review_marker:<role-or-github>` rather than being hidden by round validation when the role cannot be trusted.

## Escalation triggers (if any)
- none

## Reasoning trace (internal — short, for meta-judge)
- Why this is the minimum: I verified the current source still has `parsed_round_number = extract_review_round(body) or 1`, and the cited tests still encode blank-round success paths. Removing the fallback and using the existing invalid evidence return type fixes the reported behavior without adding a new parser object.
- What I considered but rejected: A private `ParsedReviewRound` helper/dataclass would make diagnostics explicit, but this parser has one call site and already returns `ParsedGithubReviewEvidence(valid=False, reason=...)`; adding another result type is extra surface for the same state.
- What I cannot decide alone: Whether maintainers want a more granular reason taxonomy beyond `missing_review_round:<role>` and `invalid_review_round:<role>`; the minimal plan only needs those two.

⟦AI:AUTO-LOOP⟧
SOLVER_DONE:minimal:propose:Use parser-local guard and existing invalid evidence channel for required review_round validation

⟦AI:AUTO-LOOP⟧