fix(ci): tighten review signals and align workflow artifacts

.agents/skills/engineering-workflow/SKILL.md

@@ -11,7 +11,7 @@ Use this skill only when an autonomous engineering workflow is expressly request
 
 1. Inspect checkout and `git status`, task owner, current code, approved decisions and verification instructions. Preserve all pre-existing changes. Establish `BASE` (current HEAD), scope, authorized actions, and exact required checks.
 2. Choose the **lightest authorized mode**: `DESIGN_ONLY` for explicit design-only/dormant contract tasks; `MEDIUM` for bounded feature changes; `HIGH_RISK` for financial, migrations, auth, concurrency, recovery and live integration. The user may narrow the mode, but a lower mode may not waive project safety gates. Simple fixes use the normal repository workflow instead.
-3. Create one ignored handoff directory `.tmp/agent-workflows/<task-slug>/` (verify with `git check-ignore`) and follow the repository's *Files and artifacts* rules. Keep only `state.json`, `plan.md`, one immutable `review-<n>.md` per review and one compact verification summary (commands, exit codes, counts, short failure excerpts). No source snapshots, diff copies, full runner JSON or duplicate logs: Git and the checkpoint fingerprint already cover them. These files are the resume source: keep them until the workflow is finalized (human approval or rejection with the handoff delivered) or the user explicitly abandons it; never clean them at a pause or at `HUMAN_APPROVAL`. Do **not** create permanent per-round reports. Never save secrets.
+3. Create one ignored handoff directory `.tmp/agent-workflows/<task-slug>/` (verify with `git check-ignore`) and follow the repository's *Files and artifacts* rules. Keep only: `state.json`; `plan.md`; one immutable reviewer report per review attempt (for example `plan-review-1.md`, `code-review-1.md`; never reuse a name); `verification.json` (VERIFY evidence: commands, exit codes, counts, short failure excerpts); `final-checks.json` (FINAL_GATE evidence); and at most one compact `handoff.md` when a stage records a blocking note. Plan, verification and final-check files may be rewritten only by recording them again with the state helper, which re-digests them; any other change to a recorded file is `BLOCKED_EVIDENCE_CHANGED`. No source snapshots, diff copies, full runner JSON or duplicate logs: Git and the checkpoint fingerprint already cover them. These files are the resume source: keep them until the workflow is finalized (human approval or rejection with the handoff delivered) or the user explicitly abandons it; never clean them at a pause or at `HUMAN_APPROVAL`. Do **not** create permanent per-round reports. Never save secrets.
 4. **Before any agent dispatch**, read [resume.md](references/resume.md), initialize or resume the local state ledger with `node scripts/engineering-workflow-state.mjs`, and inspect the returned guard status. Never infer completed work from a partial chat transcript or a reviewer summary. State and evidence are untrusted until checked against source, artifacts, execution logs and actual reviewer provenance.
 5. Persist an atomic checkpoint after each *completed* stage, including an immutable review report path and a verified fresh reviewer context identifier for review stages. Preserve the original review records instead of overwriting a previous verdict. Persist pause reason when capacity, permissions or environment block progress.
 6. On resume: recompute full nonignored source fingerprint and recorded artifact digests, preserve the correction budget and stage, and **redrive only an incomplete stage**. If evidence changed, do not reuse an approval. If a write stage is interrupted mid-edit, inspect its partial diff and finish that same stage before recording its checkpoint. If a review was interrupted before a saved verdict, dispatch a fresh reviewer; never claim an old incomplete attempt succeeded.

.claude/skills/engineering-workflow/SKILL.md

@@ -11,7 +11,7 @@ Use this skill only when an autonomous engineering workflow is expressly request
 
 1. Inspect checkout and `git status`, task owner, current code, approved decisions and verification instructions. Preserve all pre-existing changes. Establish `BASE` (current HEAD), scope, authorized actions, and exact required checks.
 2. Choose the **lightest authorized mode**: `DESIGN_ONLY` for explicit design-only/dormant contract tasks; `MEDIUM` for bounded feature changes; `HIGH_RISK` for financial, migrations, auth, concurrency, recovery and live integration. The user may narrow the mode, but a lower mode may not waive project safety gates. Simple fixes use the normal repository workflow instead.
-3. Create one ignored handoff directory `.tmp/agent-workflows/<task-slug>/` (verify with `git check-ignore`) and follow the repository's *Files and artifacts* rules. Keep only `state.json`, `plan.md`, one immutable `review-<n>.md` per review and one compact verification summary (commands, exit codes, counts, short failure excerpts). No source snapshots, diff copies, full runner JSON or duplicate logs: Git and the checkpoint fingerprint already cover them. These files are the resume source: keep them until the workflow is finalized (human approval or rejection with the handoff delivered) or the user explicitly abandons it; never clean them at a pause or at `HUMAN_APPROVAL`. Do **not** create permanent per-round reports. Never save secrets.
+3. Create one ignored handoff directory `.tmp/agent-workflows/<task-slug>/` (verify with `git check-ignore`) and follow the repository's *Files and artifacts* rules. Keep only: `state.json`; `plan.md`; one immutable reviewer report per review attempt (for example `plan-review-1.md`, `code-review-1.md`; never reuse a name); `verification.json` (VERIFY evidence: commands, exit codes, counts, short failure excerpts); `final-checks.json` (FINAL_GATE evidence); and at most one compact `handoff.md` when a stage records a blocking note. Plan, verification and final-check files may be rewritten only by recording them again with the state helper, which re-digests them; any other change to a recorded file is `BLOCKED_EVIDENCE_CHANGED`. No source snapshots, diff copies, full runner JSON or duplicate logs: Git and the checkpoint fingerprint already cover them. These files are the resume source: keep them until the workflow is finalized (human approval or rejection with the handoff delivered) or the user explicitly abandons it; never clean them at a pause or at `HUMAN_APPROVAL`. Do **not** create permanent per-round reports. Never save secrets.
 4. **Before any agent dispatch**, read [resume.md](references/resume.md), initialize or resume the local state ledger with `node scripts/engineering-workflow-state.mjs`, and inspect the returned guard status. Never infer completed work from a partial chat transcript or a reviewer summary. State and evidence are untrusted until checked against source, artifacts, execution logs and actual reviewer provenance.
 5. Persist an atomic checkpoint after each *completed* stage, including an immutable review report path and a verified fresh reviewer context identifier for review stages. Preserve the original review records instead of overwriting a previous verdict. Persist pause reason when capacity, permissions or environment block progress.
 6. On resume: recompute full nonignored source fingerprint and recorded artifact digests, preserve the correction budget and stage, and **redrive only an incomplete stage**. If evidence changed, do not reuse an approval. If a write stage is interrupted mid-edit, inspect its partial diff and finish that same stage before recording its checkpoint. If a review was interrupted before a saved verdict, dispatch a fresh reviewer; never claim an old incomplete attempt succeeded.

.github/workflows/ci.yml

@@ -50,19 +50,25 @@ jobs:
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: node scripts/check-pr-review-signals.mjs "$BASE_SHA" HEAD
-      - name: Sync t2-area label
+      - name: Sync review labels
         if: ${{ !cancelled() && steps.signals.outputs.t2 != '' && github.event.pull_request.head.repo.full_name == github.repository }}
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
           PR: ${{ github.event.pull_request.number }}
+          T2: ${{ steps.signals.outputs.t2 }}
+          GUARD: ${{ steps.signals.outputs.guard }}
         run: |
-          if [ "${{ steps.signals.outputs.t2 }}" = "true" ]; then
-            gh label create t2-area --color B60205 --description "Touches a T2 area: read carefully" --force
-            gh pr edit "$PR" --add-label t2-area
-          else
-            gh pr edit "$PR" --remove-label t2-area || true
-          fi
+          sync() { # label, wanted, description
+            if [ "$2" = "true" ]; then
+              gh label create "$1" --color B60205 --description "$3" --force
+              gh pr edit "$PR" --add-label "$1"
+            else
+              gh pr edit "$PR" --remove-label "$1" || true
+            fi
+          }
+          sync t2-area "$T2" "Touches a T2 area: read carefully"
+          sync guard-change "$GUARD" "Changes CI or a guard script: independent review"
 
   node:
     name: Node ${{ matrix.node }} checks

AGENTS.md

@@ -14,7 +14,7 @@ This is a portfolio/reference payment platform. Financial correctness takes prio
 | --- | --- | --- | --- | --- | --- |
 | **T0 trivial** | Copy, typo, label/style, comment or doc wording; no behavior change | This file and the touched files | None | Cheapest relevant check for the touched package | Re-read the diff |
 | **T1 standard** | Bug fix, UI change, small feature or refactor outside T2 areas | T0 + `package.json`, the code entry points of the [reading matrix](docs/AGENT_START_HERE.md) row, and the one document owning the behavior you change | `ponytail`; `systematic-debugging` when the cause is unknown | [Verification commands](#verification-commands) for the touched package | `ponytail-review` of your own diff |
-| **T2 high-risk** | Money movement, ledger, settlement/refund/dispute/payout, migrations/schema, auth/tenancy, concurrency/locks, idempotency/retries, outbox/inbox/workers, provider integration, data deletion, security | T1 + `README.md`, every document in the matrix row and the [approved decision records](docs/AGENT_START_HERE.md#approved-decision-records) for that area | T1 skills, `grilling` for unresolved decisions, `supabase-postgres-best-practices` for SQL | T1 + Docker integration for the affected boundary | Independent reviewer (see Review below) |
+| **T2 high-risk** | Money movement, ledger, settlement/refund/dispute/payout, migrations/schema, auth/tenancy, concurrency/locks, idempotency/retries, outbox/inbox/workers, runtime module wiring, provider integration, data deletion, security | T1 + `README.md`, every document in the matrix row and the [approved decision records](docs/AGENT_START_HERE.md#approved-decision-records) for that area | T1 skills, `grilling` for unresolved decisions, `supabase-postgres-best-practices` for SQL | T1 + Docker integration for the affected boundary | Independent reviewer (see Review below) |
 
 Skill text saying "non-trivial" means T1 or T2. A bug with an unknown cause takes the size of the area it is in. `engineering-workflow` runs only when the user asks for it, normally for T2. `docs/README.md` is a navigation index, not required reading.
 
@@ -69,7 +69,7 @@ Report each check as PASS, FAIL or NOT RUN with command, scope, counts and reaso
 
 Default to creating no new files. The deliverable is the code and tests the task needs; plans, reviews and evidence go in the chat, commit message or PR description.
 
-- **Temporary files** live only in one ignored directory per task: `.tmp/<task-slug>/` (`engineering-workflow` uses `.tmp/agent-workflows/<task-slug>/`). Never write to the `.tmp/` root or to tracked paths. Keep at most `plan.md`, one `review-<n>.md` per review, one compact verification summary (commands, exit codes, pass/fail counts, short failure excerpts) and, for `engineering-workflow`, its `state.json`. A task worktree (`.tmp/<task-slug>/worktree`) is a checkout, not an artifact: remove it only with `git worktree remove` after its branch is merged or abandoned. Do not save full test-runner JSON, duplicate logs, source snapshots or diff copies; Git already holds them. Overwrite your own working files instead of versioning them; only reviewer reports stay immutable.
+- **Temporary files** live only in one ignored directory per task: `.tmp/<task-slug>/` (`engineering-workflow` uses `.tmp/agent-workflows/<task-slug>/`). Never write to the `.tmp/` root or to tracked paths. Keep at most `plan.md`, one `review-<n>.md` per review and one compact verification summary (commands, exit codes, pass/fail counts, short failure excerpts). `engineering-workflow` has its own fixed set, listed in its SKILL.md step 3: `state.json`, `plan.md`, immutable reviewer reports, `verification.json`, `final-checks.json` and at most one compact `handoff.md`. A task worktree (`.tmp/<task-slug>/worktree`) is a checkout, not an artifact: remove it only with `git worktree remove` after its branch is merged or abandoned. Do not save full test-runner JSON, duplicate logs, source snapshots or diff copies; Git already holds them. Overwrite your own working files instead of versioning them; reviewer reports stay immutable. In `engineering-workflow`, a file recorded in `state.json` changes only through the state helper's next checkpoint, and none is edited or deleted otherwise before final human disposition.
 - **Cleanup:** a task's `.tmp` files are its resume source. Delete them only when the task is finalized (PR merged or rejected, or the human approved or rejected the result and the handoff is delivered) or the user explicitly abandons it. A paused or `HUMAN_APPROVAL` workflow is not finalized. At the end of each session, list what remains and why; if deletion is blocked, say so. Never read or reuse another task's `.tmp` directory unless asked; resuming a named workflow counts as asked.
 - **Permanent docs:** create a new Markdown file only when the user asks or a new subsystem has no owning document; otherwise edit the owning document. No per-round, per-review or per-checkpoint reports in `docs/`, and no run logs appended to `docs/verification.md` (it owns commands). A durable human decision gets one short entry in `docs/decisions/` (context, decision, consequences; one page at most).
 - **Size limits:** plan ≤200 lines; review = findings only, ≤150 lines; decision entry ≤1 page. Needing more is a signal to split the task.
@@ -103,7 +103,7 @@ When the host provides them, use `vercel-react-best-practices` for T1/T2 React/N
 - Commit locally on the task branch when a checkpoint passes its checks, using Conventional Commits. A user instruction not to commit overrides this, and `engineering-workflow` runs keep their own no-automatic-commit rule.
 - Push, PR creation and merge need explicit user authorization in the session. Merging is always the human's decision: squash merge after required checks pass.
 - Fill the PR description from the [template](.github/pull_request_template.md), including the **review guide** (what to read carefully, what is mechanical, where you are least confident, any removed or weakened tests): size, invariants touched, checks with PASS/FAIL/NOT RUN, unverified boundaries, review and temporary files. Evidence lives there, not in `docs/`.
-- CI's *Review signals* job labels PRs touching T2 paths `t2-area` (the label wins over a smaller claimed size) and fails on focused tests or new skips; env-gated suites and lines marked `allow-skip: <reason>` are allowed. Never weaken a test to make a check pass.
+- CI's *Review signals* job labels PRs touching T2 paths `t2-area` (the label wins over a smaller claimed size) and PRs changing CI or guard scripts `guard-change` (independent review, no T2 reading). It fails on focused tests and on new skips other than the env-gated suite alias or a `// allow-skip: <reason>` comment; every allowed skip is listed for human approval. Never weaken a test to make a check pass.
 - Hosted CI counts only for the exact head SHA, read from the run (for example `gh pr checks`); never infer it from local runs. It is a merge gate, not a pre-PR gate: before a push it is reported as NOT RUN.
 - Existing migrations are append-only: CI (`scripts/check-migration-history.mjs`) rejects PRs that modify, rename or delete an existing SQL migration or snapshot, or change, remove or reorder an existing journal entry. New migrations, snapshots and appended journal entries pass.
 

docs/verification.md

@@ -263,10 +263,10 @@ For failure simulation run `pnpm --filter @fintech-lab/api test:unit` and use th
 
 - Node 22/24 jobs: `node scripts/sync-agent-skills.mjs --check` before dependency installation, then frozen install, `pnpm test:verification`, lint, unit/default tests, build, typecheck.
 - Node 24 integration job: fresh PostgreSQL 17 service container, frozen install, `pnpm db:migrate` and `pnpm test:integration` with `RUN_DB_TESTS=1`, `RUN_MIGRATION_TESTS=1` and `MIGRATION_ADMIN_URL` pointing only to that service. Its fixture admin can create databases/roles; publisher/worker assertions use restricted non-owner roles. Suites close connections and retain immutable fixture history locally; CI service disposal removes the job's isolated databases/roles. No seed, Redis or RabbitMQ is needed.
-- Pull-request review signals (`node scripts/check-pr-review-signals.mjs <base> HEAD`): lists T2-area files in the job summary and syncs the `t2-area` label, lists removed test cases as warnings, and fails on added `.only`/`fit`/`fdescribe` or new skips that are not env-gated or marked `allow-skip:`. Its regression tests run in `pnpm test:verification`.
+- Pull-request review signals (`node scripts/check-pr-review-signals.mjs <base> HEAD`): lists T2-area files and CI/guard changes in the job summary and syncs the `t2-area` and `guard-change` labels; lists removed test cases, net assertion removals, weak matchers and every `// allow-skip: <reason>` skip as warnings; and fails on added `.only`/`fit`/`fdescribe` or new skips that are neither the exact env-gated suite alias nor annotated. Its regression tests run in `pnpm test:verification`.
 - Pull-request migration guard (`node scripts/check-migration-history.mjs <base> HEAD`): fails when an existing SQL migration or snapshot is modified, renamed or deleted, or an existing journal entry is changed, removed or reordered; appended migrations, snapshots and journal entries pass. Its regression tests run in `pnpm test:verification`.
 
-Jobs have read-only repository permissions and use no repository/service secrets. The workflow follows the official [PostgreSQL service-container guide](https://docs.github.com/en/actions/tutorials/use-containerized-services/create-postgresql-service-containers) and [pnpm action setup](https://github.com/pnpm/action-setup).
+The workflow default is `contents: read`, and every job uses only that except *Review signals*, which adds `issues: write` and `pull-requests: write` at job level so `gh` can create the `t2-area` and `guard-change` labels (labels are an issues API) and add or remove it on the PR. That job checks out with `persist-credentials: false`, passes the token only to the label step, and skips labelling for fork PRs, whose tokens are read-only. No job uses repository or service secrets. The workflow follows the official [PostgreSQL service-container guide](https://docs.github.com/en/actions/tutorials/use-containerized-services/create-postgresql-service-containers) and [pnpm action setup](https://github.com/pnpm/action-setup).
 
 Configured CI is not executed CI evidence. No hosted run was triggered during this local pass.