# I1 Independent Review Gates — 2026-08-22

Mode: Unlazy solo / tree 3. This slice is incomplete until every gate has current command-backed evidence. No owner FactoryRun/account login/publication credential provisioning is part of this gate set.

## Leaf A — durable reviewer identity

- [x] G1: every dogfood Review is bound to a distinct reviewer AgentRun/Principal and exact ChangeSet candidate; coder and reviewer identities cannot collapse.
  EVIDENCE: `tests/integration/verification-merge-gate.test.ts` proves producer role `coder`, reviewer role `reviewer`, distinct AgentRun IDs and Principal IDs, and exact Review candidate binding before submission.

- [x] G2: AgentRun role (`coder`/`reviewer`) and Review -> reviewer AgentRun binding survive persistence/restart and are visible to I1 read models.
  EVIDENCE: migration `0010_perfect_victor_mancha.sql` adds durable `agent_runs.role` and `reviews.reviewer_agent_run_id`; `tests/integration/persistence.test.ts` round-trips both; schema/read-model/UI tests pass in the full gate.

## Leaf B — reviewer execution

- [x] G3: trusted publication creates/idempotently reuses one reviewer AgentRun, Attempt and Workspace using explicit provider/account/model provenance.
  EVIDENCE: verification/merge integration replays the same coder completion and asserts one publication call, one reviewer AgentRun and one Review; reviewer Attempt inherits explicit selected account/model provenance.

- [x] G4: native ACP reviewer runs against the exact candidate snapshot, uses reviewer-specific prompt/callback, and fails if candidate content changes during review.
  EVIDENCE: `KubernetesAcpNativeClient` resets to immutable ChangeSet base, applies the exact persisted patch with `git apply --index --binary`, verifies `git write-tree` equals candidate digest, and launches reviewer-specific prompt/callback. `tests/integration/workspace/reviewer-runner.test.ts` proves candidate drift fails closed; runner permission requests are cancelled in reviewer mode and post-review tree identity is rechecked.

- [x] G5: reviewer result callback is Attempt-token authenticated, candidate-bound, persists findings/disposition, and only that reviewer Attempt can submit its agent-assigned Review.
  EVIDENCE: `/internal/execution/review` routes to `completeReview`; integration proves owner `approveReview` is rejected for agent-assigned Reviews, reviewer callback token/candidate/AgentRun bindings are required, and structured disposition/findings are persisted. Runner parser tests reject malformed/non-actionable reviewer output.

## Leaf C — merge gate / product composition

- [x] G6: ready-to-merge and requestMerge require an approved independent reviewer AgentRun; owner/coder self-approval and missing/stale reviewer bindings fail closed.
  EVIDENCE: `hasApprovedIndependentReview` validates reviewer role, Review binding and coder/reviewer separation for evidence transitions and merge. Go-live scripts 19/22/23/27 no longer use owner Review approval for dogfood; they wait for the reviewer AgentRun's durable submitted approval.

- [x] G7: focused persistence/application/ACP/UI tests and final full `pnpm check` pass on an authorized buildbox.
  EVIDENCE: debian2 full gate PASS after focused fixes: typecheck PASS; lint PASS; 146 tests PASS with 5 intentional skips; build PASS; dependency architecture PASS with 111 modules / 195 dependencies and zero violations; Prettier PASS. Focused reviewer runner/schema/persistence/merge gate also PASS. Final replay-idempotency focused verification gate PASS 4/4 before final full-gate remeasure.

- [x] G8: zero-run debian3 deployment remains healthy after migration/config convergence; no FactoryRun/account login is initiated and no owner credential is copied.
  CHECK: push the verified branch so the existing `agent-runner-image.yml` publisher can build/smoke/push the new runner with scoped GitHub Actions `GITHUB_TOKEN`, fetch its digest-lock commit, then deploy that exact branch head to debian3 and remeasure health/accounts/execution rows/pinned images.
  EVIDENCE: PASS at final branch head `0c06b3a`. GitHub Actions run `32586960856` published/smoke-tested the reviewer-capable runner and committed digest `ghcr.io/platform-modules/awp-agent-runner@sha256:af9aee7f4dcab70b743d6d2e619d3f16a7cee330cc09af5beccf512f1c179d5d`. Exact final head passed full `pnpm check` on debian2. debian3 deployment PASS: services active; migrations 11/11 with zero drift; Subrouter/model-gateway/Fabro 1/1 on pinned registry digests; new runner digest configured; accounts `[]`; FactoryRun/AgentRun/ChangeSet/Review/VerificationEvidence/ReviewFinding rows all zero; GitHub publication authority still absent; no owner credential copied or login/run initiated.