fix(review): preserve provider-owned causal classification across review lifecycle

[ftorga]

Pre-flight Checks

• I searched open and closed issues and pull requests. This is not an open duplicate; it is a regression of the closed fix(review): reject unsupported candidate-causal blockers #1317/fix(review): recover false causal blockers on unchanged candidate #1333 contract through the newer provider-owned artifact-admission path.
• I understand that PRs will be rejected without status:approved.

Bug Description

A bounded native review can reject or inconsistently reclassify severe findings when the reviewer claims introduced, behavior-activated, or worsened causality that is not supported by the frozen candidate evidence.

The provider derives CandidateCausalFindingIDs from the frozen repository evidence, but a negative location check is represented only as false. That result disproves the reviewer's claimed local causality; it does not by itself prove that the finding is base-only or pre-existing, because a change elsewhere may indirectly activate behavior at an unchanged path or line.

Artifact admission and finalize can consequently disagree: capture may reject the result as out of scope, while finalize may rewrite it to unknown. The resulting classification is not preserved consistently through replay, ledger projection, receipts, and gates.

This regresses #1103/#1104 and the contracts hardened through #1317/#1333: reviewer assertions do not own candidate causality, only findings proven candidate-causal may block delivery, and findings may become non-blocking only when affirmative provider evidence proves they are non-candidate.

Steps to Reproduce

1. Commit internal/reviewtransaction/artifact_admission.go.
2. Create a candidate changing only internal/cli/review_artifact.go and internal/cli/review_artifact_test.go.
3. Start a bounded native review and freeze that candidate.
4. Capture a strict reviewer result with a deterministic CRITICAL, causal_disposition: introduced, and a location in unchanged artifact_admission.go.
5. Let the provider derive causality from the frozen base and candidate trees.
6. Complete capture, replay, and finalize.
7. Observe rejection or inconsistent normalization instead of one provider-owned classification preserved through the lifecycle.

Observed regression shape:

lineage: review-ccec7aeac0171222
target: sha256:ccec7aeac0171222d797710e93f2c2095dcfe399ccc66f345cfad6b1c6df8bff
candidate paths: review_artifact.go, review_artifact_test.go
finding: CRITICAL / introduced / unchanged artifact_admission.go
result: escalated

The regression fixture must derive fresh repository identities rather than depend on private authority files.

Expected Behavior

Provider-derived frozen repository evidence is authoritative and produces exactly one classification:

• candidate-causal when affirmative evidence proves the candidate introduced, worsened, or behavior-activated the finding;
• proven non-candidate only when affirmative base/candidate evidence proves the finding is base-only or pre-existing;
• unknown when evidence merely disproves the reviewer's claimed local causality or remains otherwise indeterminate.

Candidate-causal severe findings remain blocking. Proven non-candidate findings remain durable non-blocking follow-ups. Severe unknown findings remain fail-closed. Capture, re-admission, replay, finalize, ledger, receipts, and gates preserve the same provider-owned classification without divergent recomputation.

Actual Behavior

A negative provider location check does not yield a complete authoritative classification. Downstream boundaries can reject the artifact or normalize it differently, so the same finding may change meaning across the lifecycle.

Operating System

Linux (Ubuntu/Debian)

Agent / Client

OpenCode

Shell

bash

Relevant Logs

lineage: review-ccec7aeac0171222
target: sha256:ccec7aeac0171222d797710e93f2c2095dcfe399ccc66f345cfad6b1c6df8bff
candidate changed only: review_artifact.go, review_artifact_test.go
reviewer location: unchanged artifact_admission.go
reviewer disposition: introduced
terminal result: escalated

Additional Context

Implementation Boundary

Centralize provider classification before artifact admission and preserve it without divergent recomputation through replay, finalize, ledger projection, receipts, and gates. Relevant boundaries:

• RunReviewCaptureResult
• verifiedCandidateCausalFindingIDs
• CandidateLocationSupportsCausality
• AdmitArtifact
• finalize causal normalization
• ledger freeze and receipt/gate projection

The current Boolean support result is insufficient as a complete classification. The provider-owned result must distinguish affirmative candidate causality, affirmative non-candidate evidence, and indeterminate evidence. Models and adapters must not author hashes, manifests, causal ID sets, or authoritative dispositions.

Acceptance Criteria

• Provider-derived frozen evidence alone determines the authoritative classification.
• Reviewer introduced, behavior-activated, or worsened cannot force candidate-causal classification.
• A negative location-support result alone never becomes base-only or pre-existing.
• Affirmative candidate evidence keeps genuine candidate-causal severe findings blocking.
• Affirmative base/candidate evidence preserves proven non-candidate findings as non-blocking follow-ups.
• Evidence that only disproves claimed local causality remains fail-closed unknown.
• Indirect behavior-activated causality requires affirmative frozen-candidate evidence and is not decided solely by line overlap.
• Capture, re-admission, replay, finalize, ledger, receipts, and every delivery gate preserve the same classification.
• Admission records bind subject, result digest, causal IDs, and provider classification.
• Existing subject, inspection, manifest, proof-scope, correction-scope, CAS, and exactly-once guarantees remain intact.

Required Tests

• Entirely unchanged path with no affirmative indirect-causality evidence.
• Changed file with an unchanged cited line.
• Added or modified candidate line remains blocking.
• Indirect behavior-activated finding with affirmative frozen-candidate evidence remains blocking.
• Unsupported indirect activation remains unknown, not proven non-candidate.
• Added file, deleted/deletion-only path, mode-only, binary, and malformed location semantics.
• Capture, replay, and finalize preserve one classification.
• Ledger cannot turn a proven non-candidate follow-up into a correction ID.
• Concurrent duplicate capture converges.
• Crash or response loss replays without another lens or budget.
• Revision, target, lens, order, or digest mismatch fails closed without mutation.

Historical Contract

#1103 was absorbed by #1104; PR #1106 delivered the frozen ledger. #1317/#1333 and PRs #1337/#1338 covered unsupported and unchanged candidate-causal blockers. PR #1550 introduced provider-owned artifact admission. #1689, #1699, and #1308 are adjacent but not duplicates.

Non-goals

• Implementing fix(opencode): enrich reviewer output with provider-owned capture subject #1689 enrichment.
• Fixing the underlying claims against artifact_admission.go.
• Treating every unchanged location as base-only or pre-existing.
• Weakening admission, subject binding, proof scope, CAS, or correction boundaries.
• Letting models or adapters choose authoritative causality.
• Implementing fix(review): align optional finding IDs with candidate-causal admission #1699 or feat(review): require candidate-bound evidence for materially distinct behavior #1308.
• Opening another review, correction, validator, or budget.

Suggested priority: priority:high. This blocks trustworthy formal review of #1689.

[ftorga]

Maintainer review is needed before implementation. This regression currently blocks trustworthy formal review of #1689 and, transitively, the reviewed correction for PR #1755.

Please apply the repository workflow labels (bug, status:needs-review, and, if appropriate, priority:high) and approve the issue when its scope and acceptance criteria are accepted. No implementation or PR will be started before status:approved.

[dnlrsls]

The capture/admission inconsistency is valid, but I do not think this is ready for status:approved as currently scoped.

A negative CandidateLocationSupportsCausality result proves only that the reported location is not supported by the candidate diff. It does not prove base-only or pre-existing: a change elsewhere may activate behavior at an unchanged line or path. Automatically routing that result to a non-blocking follow-up could suppress a real severe regression.

Please narrow the acceptance criteria so the provider preserves one authoritative classification through capture, replay, finalize, ledger, receipts, and gates:

• candidate-causal when frozen repository evidence proves it;
• proven non-candidate only when affirmative base/candidate evidence supports that conclusion;
• unknown when evidence only disproves the reviewer’s claimed local causality.

With that distinction, plus focused tests for indirect behavior-activated findings, unchanged lines, and entirely unchanged paths, this would be appropriate to approve as a high-priority bug.

[carlosduribe]

Additional 2.1.11 reproduction: multi-range location followed by terminal escalation

I encountered a related compact-v2 review case on Gentle AI 2.1.11.

The reviewer-authored finding was:

{
  "id": "R2-001",
  "severity": "CRITICAL",
  "evidence_class": "deterministic",
  "causal_disposition": "introduced",
  "location": "<redacted>:139-142,184-185,205-212",
  "proof_refs": ["E1", "E2"]
}

The finding described a real candidate defect: a prepared dataset object could retain caller-owned NumPy buffers and mutable mappings. The caller could subsequently mutate or replace the retained data while the previously computed dataset identity remained unchanged.

The public capture artifacts and manifests preserved the reviewer-authored finding and its bindings, but did not expose:

• the provider-owned admitted evidence class;
• the provider-owned causal disposition;
• the provider causal proof;
• the result of candidate-location causality validation;
• the final finding outcome;
• the resulting fix_finding_ids.

After FINALIZE, the publicly observable state was:

state: escalated
action: stop
replayability: manual_action_required
next_transition.reason_code: native_stop_required
receipt: present

The original FINALIZE response was not preserved. Therefore, I cannot prove from the available public artifacts whether the provider preserved introduced, normalized it to unknown, or selected another terminal classification.

One relevant detail is that the reviewer-authored location contains multiple ranges:

<redacted>:139-142,184-185,205-212

The native causal-location representation appears to require one canonical path:positive-line value. This may therefore be a malformed-location case that caused the provider to reject or normalize the reviewer-authored causal claim.

That remains an inference, however, because the provider-owned classification and location-validation result are not exposed by the public post-finalization surfaces.

Expected behavior

One of the following should occur:

1. A malformed causal location is rejected before terminal authority mutation, with an actionable diagnostic identifying the invalid location format; or
2. The provider normalizes the finding through one authoritative classification and exposes enough terminal reasoning to distinguish between:
   • deterministic candidate-causal finding → correction_required;
   • unknown or insufficient causality → terminal escalated.

The provider-owned classification should remain consistent across:

• artifact admission;
• capture replay;
• FINALIZE;
• ledger projection;
• receipt generation;
• delivery gates;
• negotiated STATUS.

The public result should expose enough information to determine why a severe finding was routed to correction, follow-up, refutation, or terminal escalation.

Actual behavior

The reviewer result declares:

severity: CRITICAL
evidence_class: deterministic
causal_disposition: introduced

The public post-FINALIZE surface exposes only a terminal escalation.

It does not expose whether the provider ultimately classified the finding as:

• deterministic and candidate-causal;
• unknown;
• insufficient;
• inconclusive following a failed location check;
• or another supported disposition.

Consequently, it is not possible to determine from public artifacts why correction_required was not offered.

Additional context

• The review was classified as high risk because the frozen candidate exceeded the 400-line threshold.
• All four native review lenses completed.
• The correction budget was available and had not been consumed.
• Non-severe findings remained informational and did not cause the terminal state.
• No authority files were manually edited.
• No unsupported FINALIZE retry was attempted.
• No recovery, fresh review, staging, commit, or push was performed after the escalation.

Related but not duplicate:

• fix(review): preserve provider-owned causal classification across review lifecycle #1757 covers preservation of provider-owned causal classification across admission, replay, finalization, ledgers, receipts, and gates.
• fix(review): review start recovers stale escalated lineage after staged candidate changes #1639 contains a similar deterministic → unknown → inconclusive → escalated incident, but this reproduction specifically involves a multi-range reviewer location and the absence of public terminal-classification details.

This reproduction may be useful for the malformed-location and lifecycle-consistency test cases already listed in this issue.

[ftorga]

This issue depends on the stable provider-owned finding IDs from #1699 and PR #1797. Do not publish its implementation until the canonical #1699 carrier lands and the provider-owned causal classification acceptance is clear.