[🔥AUDIT🔥] Bump the installed reviewer copy to review-v1.19.0

[jwbron]

🖍 This is an audit! 🖍

Bumps this repo's own installed reviewer copy from review-v1.18.0 to review-v1.19.0 (the tag cut from #374).

The hop is just the 1.19.0 release: adjudicated-corpus suppression drops its same-path key, author acknowledgments read as "fix pending" instead of unaddressed, the thumbs sweep is deleted (this repo never installed the sweep workflow), dispatcher deaths post a PR comment, a subject restating the discussion gets dropped, plus the entity-decoding gate fix and the checker's loud failure on a bad --repo path.

The 3-way merge had one conflict, the expected shape: the pre-agent-steps checkout ref sits inside its own LOCAL OVERRIDE comment, resolved by keeping the comment and taking ref: review-v1.19.0. All 6 override blocks survived (fork-PR skip, disabled observability, raised max-ai-credits and its env mirror, the two comment-only markers). Lock recompiled with gh-aw v0.85.4; the compile's merge=ours strip on .gitattributes was reverted. Full suite green locally (92 files, 1954 tests, review-pins.test.ts included).

no-jira: routine reviewer pin bump, no tracked lane owns this rollout

[changeset-bot]

⚠️ No Changeset found

Latest commit: 063358d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Guidance for reviewers

Triage notes for reviewers: risky files by owning team, repeated changes, and files excluded from review.

github-actions (1 file)

File	Reason
review.md	This repo's own installed reviewer prompt — its frontmatter carries the gh-aw-review-lib checkout pin, the credit caps, and the fork guard, so a bad merge here changes what reviews every PR in this repo.

Common patterns

2 files: Version pin bumped from review-v1.18.0 to review-v1.19.0 across all references in both files.

- ref: review-v1.18.0
+ ref: review-v1.19.0

Excluded from review (1 file)

Not individually reviewed — generated, formatting-only, or
fully explained by a common pattern above:

• .github/workflows/review.lock.yml — generated

_{review details}

_{review-v1.19.0 | schema 2 | depth full | re-review scoped blocking-only | enable holistic,completeness,test-adequacy,first-principles,conventions,documentation}

[github-actions]

_{review details}

_{review-v1.19.0 | schema 2 | depth full | re-review scoped blocking-only | enable holistic,completeness,test-adequacy,first-principles,conventions,documentation}

[github-actions]

question (non-blocking): The pin covers the lib, but the prompt still comes from the PR head. review.lock.yml builds the prompt via {{#runtime-import .github/workflows/review.md}} in the activation job, whose actions/checkout carries no ref: (the tag-pinned checkout is the separate gh-aw-review-lib step in the agent job), so only the lib half is pinned while the prompt half is read from the PR merge ref. Does this comment's "a PR must not be able to change the code that reviews it" — and the review-v1.19.0 footer the 1.18.0 changelog tells auditors to key on — hold on a PR that edits review.md itself, like this one?

_{review details}

_{found by first-principles}

[github-actions]

suggestion (non-blocking): Producer and consumer are the same repo, so these overrides need not be a fork. Four of the six LOCAL OVERRIDE blocks (fork guard, disabled observability, raised max-ai-credits, its env mirror) diverge from workflows/review/review.md sitting in this same repo, which this team owns and can change. The divergence is load-bearing enough to need review-pins.test.ts, a dedicated review-consumer-bump skill, and a hand-resolved conflict on this bump.

A sketch, not a committable replacement:

Make the four divergent knobs upstream-configurable — observability conditioned on the OTEL secrets being present, the credit cap read from its existing env value, the fork guard as a documented public-repo setting — so this repo's installed copy converges on the released file and a bump becomes a three-line ref change with no merge.

_{review details}

_{found by first-principles}