Cloud contract: blocker-scoped finding outcomes for reviewer evidence

[jeffhuber]

Problem

CodeMower.com can observe run-level PASS/BLOCKED transitions, but it cannot prove whether an individual blocking finding was fixed, rejected as a false positive, accepted as risk, or resolved by an owner decision. Run-level agreement is not blocker-level adjudication and cannot support confirmed-catch or reviewer-precision claims.

Outcome

Add a versioned, metadata-only finding-outcome contract that the CLI can emit from audit artifacts and code-mower decide records without uploading finding prose, source, diffs, transcripts, or file paths.

Scope

• Define an additive reviewer_finding_outcome event schema with a stable opaque finding id, repository/PR/head/lane linkage, severity, disposition, timestamps, fix/decision linkage, and automated-versus-manual source.
• Support dispositions accepted_fixed, false_positive, accepted_risk, owner_decision, duplicate, infrastructure, and insufficient_context.
• Make retries idempotent and permit a newer observation to supersede an earlier unresolved observation.
• Export outcomes from structured verdict artifacts, later qualifying PASS heads, and explicit owner decisions only when linkage is defensible.
• Keep older v0.x/v1.0 uploads valid and omit unknown fields rather than guessing.
• Update docs/cloud-data-contract.md, validation, privacy scanning, fixtures, and focused tests.

Acceptance criteria

• A BLOCKED finding fixed on a later audited head emits one accepted-fixed outcome with stable linkage.
• A code-mower decide finding decision emits the matching explicit disposition without issue or finding prose.
• Ambiguous or unlinked findings remain unknown and never become confirmed catches.
• Dry-run output contains metadata only and no source, raw diffs, transcripts, issue bodies, finding titles/details, file paths, raw stdout/stderr, auth output, local paths, or secrets.
• CodeMower.com's paired issue is linked before merge.

Process

One focused PR, tests and docs, independent Codex and Claude final-head audits, author-lane exclusion, required green code-mower/gate, and metadata-only dogfood upload.

[jeffhuber]

Paired CodeMower.com consumer issue: https://github.com/jeffhuber/codemower.com/issues/240

The OSS contract must land first. The server remains backward-compatible with existing v0.x/v1.0 uploads and preserves the metadata-only privacy boundary.