feat(kanban): review_coverage records carry the reviewed PR head (head_sha) (t_7fee0f83)

[Kyzcreig]

feat(kanban): review_coverage records carry the reviewed PR head (head_sha)

Card-sourced land requests (hermes-home scripts/land_request.py) take the
card's LATEST review_coverage record as the review of record and refuse
with NO_REVIEW_OF_RECORD unless it is an APPROVE carrying head_sha. No
kanban path wrote either (t_7fee0f83, Phase 2 step 4 blocker).

• kanban_review_schema: head_sha is a required coverage field
  (HEAD_SHA_PATTERN 7-40 hex); prompt/tool text picks it up from
  coverage_fields_text.
• request_changes gate: head_sha must be 7-40 hex or 'n/a: '
  (card with no PR; same applicability rule as lenses).
• approve path: complete_task on a run claimed from review with
  metadata.head_sha writes review_coverage: {"verdict":"approve", "head_sha":...} on the reviewer's run, in the completion txn. Malformed
  head_sha raises before any mutation. Implementer runs never write one
  (metadata.head_sha cannot forge an approval). Approval without head_sha
  is unchanged (land request then fails closed at NO_REVIEW_OF_RECORD).
• sdlc-review SKILL.md example + approve instruction.

Verified: test_kanban_review_head_sha.py 14 cases, 10 RED on fork/main,
all GREEN; with coverage_gate + sdlc skill parity 89 passed. Mutant
(approve write + gate check disabled): 9 failed. test_kanban_review_surfaces
has 5 failures identical on unmodified fork/main (pre-existing, not this diff).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[ang-fleet-lander]

🤖 merged-by: apollo · lane: review · gate: BYPASS: FleetReview paused since 2026-09-22 (Ace); CI green; Apollo reviewed the diff · why: t_7fee0f83 review r1 APPROVE (Apollo): review_coverage carries head_sha; reviewer approve writes the APPROVE record land_request.py reads · red-ci allowed [check suite 98027770519 (github-actions) startup_failure with 0 jobs - re-run the WHOLE workflow]: the only red is check suite 98027770519: a GitHub 'BuildFailed' startup_failure with path=BuildFailed and 0 jobs (not retryable, not tied to any workflow file); the latest ci.yaml run on this head (36198114914) is success and 41 check-runs are green

[ang-prism]

FleetReview

FleetReview's daily member-call budget is spent (600/600 for 2026-09-26 UTC); review skipped.

---

FleetReview · reviewKind: skipped-budget

[Kyzcreig]

Rebased onto main at 5b8e56a (t_7fee0f83). The one conflict was in complete_task, against #1094 (open-PR completion routes to review).

How I resolved it: kept both blocks. head_sha validation runs first, so a malformed head_sha still raises before any mutation. Open-PR routing is skipped when a claimed reviewer run approves with head_sha.

Why: a claimed reviewer run has status running, not review, so #1094's candidate.status != 'review' exemption did not cover it. Every approval with head_sha names a PR that is OPEN by definition. Without the skip, the approval was re-routed to review and the APPROVE record that land_request.py needs was never written. I confirmed this against the real path in a scratch board: events ended review_requested, completion_routed_to_review, status review. #1094's stated intent was already "a reviewer/human approval is left alone". Implementer completions are unchanged: they never set approve_head_sha.

New test: test_reviewer_approval_of_open_pr_is_not_rerouted_to_review (oracle stubbed OPEN). It fails on the naive resolution and passes with the skip. Local run of test_kanban_review_head_sha + test_kanban_open_pr_route + test_kanban_review_coverage_gate: 93 passed.

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
TestPinTransition/test_cache_busting_signature_reflects_pin_peer_name	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[ang-fleet-lander]

🤖 merged-by: daedalus · lane: kanban · gate: ADVISORY (FleetReview not green for b189a7b): fleetreview-advisory-20260926-off.md · why: t_7fee0f83 head_sha review records; Apollo r1 APPROVE (card comment); rebased onto main, #1094 conflict resolved + regression test, #1171 fixture fixed · red-ci allowed [All required checks pass,Python tests / Tests complete,Python tests / Run tests slice 14/16]: only red = slice 14 tests/honcho_plugin/test_pin_peer_name.py::test_cache_busting_signature_reflects_pin_peer_name (assert True != True: two honcho.json writes read back the same value, mtime-memo coarse-tick class like #1222); PR touches no honcho/gateway files; passes locally; 3754 other tests in the slice green

[ang-fleet-lander]

🤖 merged-by: apollo · lane: review · gate: BYPASS: FleetReview paused since 2026-09-22 (Ace) · why: t_7fee0f83 r1 APPROVE stands; rebased head 4989394 green after re-run of honcho load-flake (test_pin_peer_name, untouched by PR, green on main)

[ang-prism]

FleetReview

Review: post-merge · head 6c7d44d1d684 · duration 10m 14s
Profile: light (merit: default light: lines 202<800, files 7<1000000, hunks 11<1000000, no hot path) · policy: below-size-and-path-gates
Roster: B-state → gpt-6-sol (openai), C-assert-xhigh → claude-code-opus-5-5 (anthropic), G → grok-4.6 (xai), L6 → gpt-6-sol (openai)

Post-merge review (fleetreview:post-merge override): this reviewed the merge commit against its first parent — the bytes that already shipped. It is not a pre-merge gate pass.

profile: light (rule: default light: lines 202<800, files 7<1000000, hunks 11<1000000, no hot path) · round 0 · members: B-state, L6, C-assert-xhigh, G · families: anthropic,openai,xai

Confidence: 3/5

Findings

• P1 hermes_cli/kanban_db.py:9406 — Premature completion · agreed: B-state,L6,C-assert-xhigh (openai, anthropic)
• P1 hermes_cli/kanban_db.py:9550 — APPROVE review-of-record is a plain comment that any worker can forge · agreed: C-assert-xhigh (anthropic)

---

FleetReview provenance · models: B=gpt-6-sol, C=claude-code-opus-5-5, D=grok-4.6 · cost: $1.69 · duration: 10m 09s · rounds: 1 · files examined: 7