Move generic review-evidence integrity into compound-loop

[teslamint]

Problem

A consuming repository had to add a project-local review contract and verifier for baseline-aware changes to tests and verification assets.

This duplicated compound-loop lifecycle rules and left an integrity gap:

• RED and GREEN outputs remained under the run-scoped .tmp/ directory.
• The committed review record referenced those untracked files by path and SHA-256.
• A fresh clone could not inspect the bytes or recompute the digests.
• The project-local verifier checked approval-shaped strings instead of a compound-loop review event.
• A sealed review-result/v1 proves byte integrity, but it does not prove that a person performed the required semantic review.

The project must still own its test inventory, lint rules, and report semantics. Compound-loop should own generic review-event integrity, durable evidence publication, and the link to explicit human approval when a plan requires it.

Proposed responsibility boundary

Compound-loop owns

• Publish review evidence from <artifact_root>/.tmp/ into immutable, run-scoped evidence/<unit>/... targets.
• Register every final evidence file in .phase-artifact-ownership.json.
• Validate that review records reference existing journal-owned files.
• Validate every referenced SHA-256 against the preserved bytes.
• Bind the evidence manifest, reviewed head or baseline, changed paths, and requirement references to one review event.
• Distinguish an agent review seal from explicit human semantic approval.
• Fail closed when a plan requires human approval and only an agent-generated clean result exists.

Consuming repositories own

• The exact test and verification-asset inventory.
• Project-specific lint, formatter, accessibility, license, and test-report rules.
• A machine-readable receipt that compound-loop can bind to the review event.

Suggested contract

Add a canonical baseline-aware review-evidence manifest. It should contain:

• schema version
• unit and review event identifiers
• reviewed baseline or full head
• Changed verification-asset paths
• Requirement references
• RED and GREEN evidence paths with SHA-256 values
• Project verification receipt path and SHA-256
• Required reviewer class, such as human
• Approval event or approval artifact reference

Do not infer human approval from a reviewer name string or from review-result/v1. The latter only seals reviewer output bytes.

Acceptance criteria

1. A publisher command accepts sources only from the selected run's .tmp/ directory and publishes immutable files under evidence/<unit>/....
2. The ownership journal records every published evidence file and digest.
3. A verifier passes from a fresh clone without access to the original .tmp/ files.
4. Missing evidence, an unowned target, a digest mismatch, or a reference to .tmp/ fails with a named reason.
5. A sealed agent clean review fails when the manifest requires independent human approval but no human approval artifact exists.
6. A valid human approval artifact binds the reviewer, reviewed baseline, requirement references, and evidence manifest.
7. Mutation tests cover missing files, path substitution, digest changes, incomplete changed-path coverage, and forged approval-shaped strings.
8. The generic implementation contains no consuming repository's test names, lint rules, or source paths.
9. Existing review-body/v1, review-result/v1, and phase-artifact ownership contracts remain the integrity foundation instead of introducing a parallel lifecycle.

Non-goals

• Automating the human reviewer's semantic judgment.
• Moving project-specific test inventory checks into compound-loop.
• Treating a synthetic approval fixture as evidence that a person approved a change.