fix: normalize explicit no-limitation reviews

[romgenie]

Summary

• treat an explicit no material limitation statement as non-blocking review metadata
• keep fail-closed behavior when the same statement also reports missing, unavailable, truncated, or incomplete evidence
• add regression coverage for the exact production phrase observed on the merged-image smoke test

Root cause

The hosted-review prompt requires None when no material limitation exists, but the runtime returned a high-confidence sentence ending in no material limitation. Publication normalization only recognized expected bounded-scope wording, so it retained the sentence as a limitation and downgraded an otherwise complete, source-backed REQUEST_CHANGES review to COMMENT.

Verification

• npm test — 113/113 passed
• npm run build — passed
• git diff --check — passed

Live evidence

Observed on disposable OpenCoven/coven-github#79; repair was disabled immediately after the fail-closed COMMENT result. The probe will be retriggered only after this fix is merged and deployed.

[covencat]

Coven review

Status: success

The runtime review output was downgraded because its publication evidence was incomplete or contradictory.

Evidence

• PR: #13
• Base: main @ ed9fcb291b90724091d5a8de86619874b630ca8a
• Merge base: ed9fcb291b90724091d5a8de86619874b630ca8a
• Head: fix/no-material-limitation-normalization @ 46307926489824a41ce2542d5ef3e33aae8cac4f
• Checked-out workspace HEAD: 46307926489824a41ce2542d5ef3e33aae8cac4f
• Changed files supplied to agent: 2
• Review context SHA-256: 622304258c5e45603e5e714c3bb6812e323b7cd8cdcb2897c27aea883db86663
• Files: src/adapter.ts, tests/webhook-adapter.test.ts

Structured review

• Mode: pull_request
• Evidence status: partial
• Reviewed files: 2
• Reviewed file list: src/adapter.ts, tests/webhook-adapter.test.ts
• Supporting files inspected: 1
• Supporting file list: AGENTS.md
• Findings: 0
• No-findings reason: The changed config path in src/adapter.ts:191-212 preserves existing webhook verification behavior by still populating config.webhookSecret from either GITHUB_WEBHOOK_SECRET or the legacy WEBHOOK_SECRET, while separately deriving publication signing secrets. The request handler continues to require a valid X-Hub-Signature-256 before any event processing in src/adapter.ts:560-566, which aligns with AGENTS.md:42-44. The added test in tests/webhook-adapter.test.ts:623-641 exercises the legacy environment name and confirms a signed ping is accepted, so the change is covered and I did not identify an actionable defect in the touched code.
• Tests reported by runtime: 1
  • git diff --check: passed - Command completed successfully with no output.
• Limitations: 1
  • High confidence for the reviewed scope; no material limitation.

Files changed: 0
Commits: 1

Task autoreview-ba1c81b2f4f3b1021408ffda05dde47ea2bed3a013ebedb9.

Publication validation

• review reported limitations

Evidence was incomplete or contradictory, so this is a COMMENT review rather than an approval or change request.