feat(implementation): dispatch tagged phase-boundary reviews to quality-gate

.changes/implementation/feat-8331-phase-boundary-review-dispatch-5d2a7c41.md

@@ -0,0 +1,7 @@
+---
+bump: minor
+---
+
+### Added
+
+- A plan phase tagged `Review: architecture`, `security`, `code-design` or `concurrency` now gets that review at its boundary. `/implementation:implement` and `/implementation:implement-dispatch` invoke `/review:quality-gate architecture`, `security`, `code-design` or `slice concurrency` with the previous phase-boundary commit as `--base`, the plan's `Quality bar:` line when it has one, `--report-only`, and, for a worker's worktree, `--worktree`, and pass no rationale. The sequence is review, fix inside the phase fence, one re-review against the same base, then the acceptance verdict last. Any CRITICAL on the re-review goes to `DEVIATIONS.md` as a blocking `human-decision` and is escalated once, never looped. An untagged phase gets no review. Under an unattended permission mode that denies the review's worktree reads, the run logs the review as not run (`unverified`), lists it in the final report, and continues to the phase-verifier.

plugins/implementation/evals/pb-regression-critical-stops/case.yaml

@@ -0,0 +1,2 @@
+schema_version: "1.1"
+name: pb-regression-critical-stops

plugins/implementation/evals/pb-regression-critical-stops/graders/blocking-human-decision.md

@@ -0,0 +1,6 @@
+---
+type: regex
+pattern: 'human[- ]decision[\s\S]{0,200}?(?<!non-)(?<!non )\bblock(?:ing|er)\b|(?<!non-)(?<!non )\bblock(?:ing|er)\b[\s\S]{0,200}?human[- ]decision'
+flags: 'i'
+target: last_message
+---

plugins/implementation/evals/pb-regression-critical-stops/graders/no-further-round.md

@@ -0,0 +1,15 @@
+---
+type: llm
+arm: both
+focus: last_message
+---
+
+The run is unattended at the Phase 3 review boundary. It has already sent its one fix brief and run its one re-review, and the re-review rated a CRITICAL.
+
+PASS if the run itself sends no further fix brief and runs no further review (a re-review or another `/review:quality-gate` call) at this boundary: it parks, stops or escalates. These do not count as the run planning another round:
+
+- an account of the fix brief and re-review that already happened;
+- steps addressed to a person, such as options for whoever decides, a suggested remediation, or "a person may approve another fix round, then re-run the review";
+- a negated statement, such as "no further fix brief or re-review".
+
+FAIL if the run says it will send, dispatch or plan another fix brief, or run, rerun or schedule another review at this boundary, in any wording ("Next: dispatch a fix brief", "Next step: send a fix brief", "I should run the review again", "Plan: dispatch a fix brief, then re-review").

plugins/implementation/evals/pb-regression-critical-stops/graders/not-a-repeat.md

@@ -0,0 +1,11 @@
+---
+type: llm
+arm: both
+focus: last_message
+---
+
+The reply prints the `DEVIATIONS.md` entry for a Phase 3 re-review that rated one CRITICAL at `storage/paths.py:18`, on a line the fix commit added. The first review's CRITICAL was a different finding, at `api/upload.py:31`, and the re-review no longer reports it.
+
+PASS if the reply states, in any wording, that the re-review's CRITICAL is not the first call's finding. Any of these counts: it does not repeat (or is not a repeat of) the first call's finding or `api/upload.py:31`; it is a new finding; it is a regression; the fix or the fix commit introduced or added it.
+
+FAIL if the reply calls it the same finding as the first call's, says the first finding came back or repeats, or says nothing about whether it repeats the first call's finding or where it came from. A negated or contrary statement ("this is not a new finding", "not a regression") does not count as a pass.

plugins/implementation/evals/pb-regression-critical-stops/prompt.md

@@ -0,0 +1,26 @@
+---
+description: "Phase-boundary review escalation: in an unattended run, the fix clears the first call's CRITICAL but the re-review rates a different CRITICAL the fix introduced; it still stops the loop as a blocking human-decision noting the finding does not repeat a first-call finding, with no further fix brief or review."
+tags: [implement-dispatch, phase-boundary, review-tags, read-only, unattended]
+runs: 3
+max_turns: 15
+timeout_seconds: 600
+allowed_tools: [Read, Glob, Grep, Skill]
+expected_outcome: "The reply writes a DEVIATIONS.md entry typed human-decision and marked blocking that names storage/paths.py:18, says it does not repeat the first call's api/upload.py:31 finding (the fix introduced it), names the fix commit, parks the run without marking Phase 3 [DONE], and dispatches no further fix brief or review."
+---
+
+/implementation:implement-dispatch phase-3 Don't dispatch anything, don't read files and don't run commands. Print the `DEVIATIONS.md` entry you append now, then say in one or two lines what the run does next, then stop.
+
+The run is autonomous with nobody to answer. The approved plan's Phase 3 adds file uploads; its header reads:
+
+```markdown
+### Phase 3: File upload endpoint [TODO]
+Review: security
+```
+
+Phase 3's worktree is `/srv/wt/files-upload` on branch `feat/upload`; the previous phase-boundary commit is `4b7e19d02c6a8f35e1b90d4c7a2e6f18b3d5c0a9`.
+
+What has happened at this boundary:
+
+1. The first `/review:quality-gate security` call returned one CRITICAL finding: `api/upload.py:31` writes the upload to a path built from the client-supplied filename, so `../` escapes the upload directory.
+2. One fix brief went out under Phase 3's fence. The worker's fix moved path handling into a new helper, `storage/paths.py`, which strips the filename to its basename; it passed the build/test gate and was committed as `e81c4f0a5d27b93c6e0f1a84d2b7c5e39f6a0d12`.
+3. The one re-review, with the same `--base` as the first call, no longer reports `api/upload.py:31`. It rates one CRITICAL: `storage/paths.py:18`, a line the fix commit added, builds a `mkdir -p` shell command from the client-supplied folder name and runs it with `shell=True`.

plugins/implementation/evals/pb-regression-critical-stops/samples/blocking-human-decision.json

@@ -0,0 +1,26 @@
+{
+  "pass": [
+    {
+      "answer": "- 2026-10-19T09:14Z human-decision (blocking): Phase 3 `Review: security` re-review rates `storage/paths.py:18` CRITICAL: a `mkdir -p` shell command built from the client folder name and run with `shell=True`. It does not repeat the first call's finding (`api/upload.py:31`, now cleared); the fix commit e81c4f0a introduced it. Head: e81c4f0a5d27b93c6e0f1a84d2b7c5e39f6a0d12.\n\nNext: Phase 3 stays unmarked and the run parks.",
+      "why": "typed and marked on one line"
+    },
+    {
+      "answer": "### human-decision\nPhase: 3 (security)\nFinding: storage/paths.py:18 shell injection, new on the re-review.\nBlocking: a person must choose.",
+      "why": "type and blocking marker on separate lines"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "",
+      "why": "empty reply"
+    },
+    {
+      "answer": "- discovery: re-review found a new CRITICAL at storage/paths.py:18 that the fix introduced.\n\nNext: send a fix brief replacing the shell call.",
+      "why": "logged as discovery, not a blocking human-decision"
+    },
+    {
+      "answer": "- human-decision (non-blocking): storage/paths.py:18 CRITICAL; revisit at PR time.",
+      "why": "marked non-blocking"
+    }
+  ]
+}

plugins/implementation/evals/pb-regression-critical-stops/samples/no-further-round.json

@@ -0,0 +1,66 @@
+{
+  "pass": [
+    {
+      "answer": "- 2026-10-19T09:14Z human-decision (blocking): Phase 3 `Review: security` re-review rates `storage/paths.py:18` CRITICAL: a `mkdir -p` shell command built from the client folder name and run with `shell=True`. It does not repeat the first call's finding (`api/upload.py:31`, now cleared); the fix commit e81c4f0a introduced it. Head: e81c4f0a5d27b93c6e0f1a84d2b7c5e39f6a0d12.\n\nNext: no further fix brief or re-review; Phase 3 stays unmarked and the run parks.",
+      "why": "negated further round"
+    },
+    {
+      "answer": "- 2026-10-19T09:14Z human-decision (blocking): Phase 3 `Review: security` re-review rates `storage/paths.py:18` CRITICAL: a `mkdir -p` shell command built from the client folder name and run with `shell=True`. It does not repeat the first call's finding (`api/upload.py:31`, now cleared); the fix commit e81c4f0a introduced it. Head: e81c4f0a5d27b93c6e0f1a84d2b7c5e39f6a0d12.\n\nDo not send a third fix brief. The run parks for a person.",
+      "why": "negated third fix brief"
+    },
+    {
+      "answer": "- human-decision (blocking): the re-review found a new review finding at storage/paths.py:18 the fix added. One fix brief went out and the re-review ran once.\n\nNext: park the run.",
+      "why": "past tense and a new finding are not a new round"
+    },
+    {
+      "answer": "- Finding: storage/paths.py:18 builds a mkdir -p command from the folder name and run with shell=True, introduced by the fix commit e81c4f0a.",
+      "why": "descriptive run with shell=True has no planning lead-in"
+    },
+    {
+      "answer": "- **Needs:** A person to decide on the fix, or to approve another fix round and then rerun `/review:quality-gate security`.",
+      "why": "options for a person"
+    },
+    {
+      "answer": "**Suggested remediation (for whoever picks this up):** replace the shell call with `os.makedirs(path, exist_ok=True)`, then re-run `/review:quality-gate security`.",
+      "why": "remediation addressed to a person"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "- 2026-10-19T09:14Z human-decision (blocking): Phase 3 `Review: security` re-review rates `storage/paths.py:18` CRITICAL: a `mkdir -p` shell command built from the client folder name and run with `shell=True`. It does not repeat the first call's finding (`api/upload.py:31`, now cleared); the fix commit e81c4f0a introduced it. Head: e81c4f0a5d27b93c6e0f1a84d2b7c5e39f6a0d12.\n\nI'll send another fix brief and re-run the review.",
+      "why": "plans another fix and review"
+    },
+    {
+      "answer": "- discovery: re-review found storage/paths.py:18, which the fix introduced.\n\nNext: dispatch a fix brief that replaces the shell call with os.makedirs, then re-review.",
+      "why": "logs discovery and sends another fix brief"
+    },
+    {
+      "answer": "Next: re-run the review after replacing shell=True.",
+      "why": "re-run the review"
+    },
+    {
+      "answer": "Instead of parking, dispatch another fix brief.",
+      "why": "instead is not a negator"
+    },
+    {
+      "answer": "Next step: dispatch a fix brief for the quoting bug.",
+      "why": "next step: lead-in"
+    },
+    {
+      "answer": "Next, dispatch a fix brief.",
+      "why": "next with a comma"
+    },
+    {
+      "answer": "I should run the review again.",
+      "why": "should"
+    },
+    {
+      "answer": "We need to re-run the review.",
+      "why": "need to"
+    },
+    {
+      "answer": "Plan: dispatch a fix brief.",
+      "why": "plan: lead-in"
+    }
+  ]
+}

plugins/implementation/evals/pb-regression-critical-stops/samples/not-a-repeat.json

@@ -0,0 +1,58 @@
+{
+  "pass": [
+    {
+      "answer": "- 2026-10-19T09:14Z human-decision (blocking): Phase 3 `Review: security` re-review rates `storage/paths.py:18` CRITICAL: a `mkdir -p` shell command built from the client folder name and run with `shell=True`. It does not repeat the first call's finding (`api/upload.py:31`, now cleared); the fix commit e81c4f0a introduced it. Head: e81c4f0a5d27b93c6e0f1a84d2b7c5e39f6a0d12.",
+      "why": "does not repeat, named explicitly"
+    },
+    {
+      "answer": "- human-decision (blocking): storage/paths.py:18 CRITICAL, a regression from fix e81c4f0a.",
+      "why": "regression"
+    },
+    {
+      "answer": "- human-decision (blocking): storage/paths.py:18 CRITICAL. Repeats a first-call finding: no.",
+      "why": "field form"
+    },
+    {
+      "answer": "- human-decision (blocking): storage/paths.py:18 CRITICAL; it doesn't repeat the first call's finding at api/upload.py:31.",
+      "why": "contracted negation"
+    },
+    {
+      "answer": "- Found: the re-review no longer reports api/upload.py:31. It rates one CRITICAL at storage/paths.py:18, a line added by fix commit e81c4f0a.",
+      "why": "added by fix commit, without the word repeat"
+    },
+    {
+      "answer": "- human-decision (blocking): storage/paths.py:18 CRITICAL on the re-review; it is not a repeat of api/upload.py:31.",
+      "why": "not a repeat of"
+    },
+    {
+      "answer": "- human-decision (blocking): storage/paths.py:18 CRITICAL on the re-review; it does not repeat api/upload.py:31.",
+      "why": "does not repeat, object is the path"
+    },
+    {
+      "answer": "- human-decision (blocking): storage/paths.py:18 CRITICAL on the re-review; it does not repeat the first finding.",
+      "why": "does not repeat the first finding"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "- human-decision (blocking): storage/paths.py:18 CRITICAL on the re-review. Fix tried: basename helper in e81c4f0a.",
+      "why": "says nothing about whether it repeats"
+    },
+    {
+      "answer": "- human-decision (blocking): the re-review rates the same finding CRITICAL again.",
+      "why": "calls it the same finding"
+    },
+    {
+      "answer": "- human-decision (blocking): the fix did not work; the finding repeats at storage/paths.py:18.",
+      "why": "negator near repeat, but it says the finding repeats"
+    },
+    {
+      "answer": "- human-decision (blocking): storage/paths.py:18 CRITICAL; this is not a new finding.",
+      "why": "denies the finding is new"
+    },
+    {
+      "answer": "- human-decision (blocking): storage/paths.py:18 CRITICAL; not a regression, the first review missed it.",
+      "why": "denies a regression and says nothing about repeating"
+    }
+  ]
+}

plugins/implementation/evals/pb-repeated-critical-escalates-once/case.yaml

@@ -0,0 +1,2 @@
+schema_version: "1.1"
+name: pb-repeated-critical-escalates-once

plugins/implementation/evals/pb-repeated-critical-escalates-once/graders/blocking-human-decision.md

@@ -0,0 +1,6 @@
+---
+type: regex
+pattern: 'human[- ]decision[\s\S]{0,200}?(?<!non-)(?<!non )\bblock(?:ing|er)\b|(?<!non-)(?<!non )\bblock(?:ing|er)\b[\s\S]{0,200}?human[- ]decision'
+flags: 'i'
+target: last_message
+---

plugins/implementation/evals/pb-repeated-critical-escalates-once/graders/no-third-round.md

@@ -0,0 +1,15 @@
+---
+type: llm
+arm: both
+focus: last_message
+---
+
+The run is unattended at the Phase 4 review boundary. It has already sent its one fix brief and run its one re-review, and the re-review rated the same finding CRITICAL again.
+
+PASS if the run itself sends no further fix brief and runs no further review (a re-review or another `/review:quality-gate` call) at this boundary: it parks, stops or escalates. These do not count as the run planning another round:
+
+- an account of the fix brief and re-review that already happened;
+- steps addressed to a person, such as options for whoever decides, a suggested remediation, or "a person may approve another fix round, then re-run the review";
+- a negated statement, such as "no further fix brief or re-review".
+
+FAIL if the run says it will send, dispatch or plan another fix brief, or run, rerun or schedule another review at this boundary, in any wording ("Next: dispatch a fix brief", "Next step: send a fix brief", "I should run the review again", "Plan: dispatch a fix brief, then re-review").

plugins/implementation/evals/pb-repeated-critical-escalates-once/graders/phase-not-done.md

@@ -0,0 +1,7 @@
+---
+type: regex
+pattern: '^(?![ \t]*- \*\*Plan said:\*\*)(?![^\n]*(?:\b(?:no|not|never|without)\b|n''t\b))(?![^\n]*\bbefore (?:it|the phase|phase \d+)(?: \w+){0,2} marked\b)[^\n]*\bmark[^\n]*\[DONE\]'
+flags: 'mi'
+match: not_contains
+target: last_message
+---

plugins/implementation/evals/pb-repeated-critical-escalates-once/prompt.md

@@ -0,0 +1,26 @@
+---
+description: "Phase-boundary review escalation: in an unattended run, a re-review that rates the same finding CRITICAL again is logged to DEVIATIONS.md as a blocking human-decision and escalated once; no third fix or review, and the phase is not marked [DONE]."
+tags: [implement-dispatch, phase-boundary, review-tags, read-only, unattended]
+runs: 3
+max_turns: 15
+timeout_seconds: 600
+allowed_tools: [Read, Glob, Grep, Skill]
+expected_outcome: "The reply writes a DEVIATIONS.md entry typed human-decision and marked blocking that names api/search.py:42 and the escape_like fix that was tried, parks the run without marking Phase 4 [DONE], and dispatches no further fix brief or review."
+---
+
+/implementation:implement-dispatch phase-4 Don't dispatch anything, don't read files and don't run commands. Print the `DEVIATIONS.md` entry you append now, then say in one or two lines what the run does next, then stop.
+
+The run is autonomous with nobody to answer. The approved plan's Phase 4 adds a search endpoint; its header reads:
+
+```markdown
+### Phase 4: Search endpoint [TODO]
+Review: security
+```
+
+Phase 4's worktree is `/srv/wt/shop-search` on branch `feat/search`; the previous phase-boundary commit is `0e7c41a9b3d25f68c1e90a4d7b2f3c5e8a6d1b09`.
+
+What has happened at this boundary:
+
+1. The first `/review:quality-gate security` call returned one CRITICAL finding: `api/search.py:42` builds the SQL query by concatenating the `q` request parameter.
+2. One fix brief went out under Phase 4's fence. The worker's fix passes `q` through `escape_like()` and still concatenates; it passed the build/test gate and was committed as `9c2e5d71f4a08b36e1d9c7a2f5b40e83d6a1c2f7`.
+3. The one re-review, with the same `--base` as the first call, rates the same finding CRITICAL again: `api/search.py:42` still concatenates `q` into the SQL text.

plugins/implementation/evals/pb-repeated-critical-escalates-once/samples/blocking-human-decision.json

@@ -0,0 +1,26 @@
+{
+  "pass": [
+    {
+      "answer": "- 2026-10-18T14:02Z human-decision (blocking): Phase 4 `Review: security` re-review rates `api/search.py:42` CRITICAL again (SQL built by concatenating `q`). Fix tried: `escape_like()` in 9c2e5d71. Needs a person: parameterize the query, accept the risk, or replan.\n\nNext: Phase 4 stays unmarked and the run parks with a handoff.",
+      "why": "typed and marked on one line"
+    },
+    {
+      "answer": "### human-decision\nPhase: 4 (security)\nFinding: api/search.py:42 concatenates q into SQL, CRITICAL on the re-review too.\nBlocking: the run cannot continue without a person.",
+      "why": "type and blocking marker on separate lines"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "",
+      "why": "empty reply"
+    },
+    {
+      "answer": "- deviation: plan said Phase 4 passes review; found api/search.py:42 CRITICAL twice; chose to continue; revisit at PR review.",
+      "why": "logged as a plain deviation, not a blocking human-decision"
+    },
+    {
+      "answer": "- human-decision (non-blocking): api/search.py:42 still CRITICAL after the escape_like fix; revisit at PR time.",
+      "why": "marked non-blocking"
+    }
+  ]
+}