Promote Neon findings into review workflows

[pandemicsyn]

Summary

• extend the versioned review-source/finding contracts with capability-declared promotion targets, a source/revision/surface/finding-bound request, and bounded durable destination metadata
• atomically reject stale, dismissed, resolved, promoted, wrong-source, wrong-surface, unsupported, capability-mismatched, unconfirmed, or unavailable-anchor requests before lifecycle mutation
• retain promoted findings and full provenance in history while removing them from active attention counts through the existing targeted surface event stream
• expose the shared prepared finding controller on prepared-backed Kilo results; unsupported Kilo findings remain visible and explicitly local-only

Durable workflow reuse and trust boundaries

GitHub pull requests

Promotion validates the current file patch and exact single- or multi-line anchor, creates or reuses the existing local review draft, and adds a normal local draft comment with Neon origin/provenance. It never calls GitHub or submits the review. An existing draft on a different head is rejected with explicit refresh/re-anchor guidance rather than silently changing its head. Existing draft validation, dirty-composer suppression, re-anchoring, submission, and recovery remain authoritative.

Trust boundary shown in the UI: local finding -> local GitHub draft; submission remains separate.

Prepared diffs and Kilo results

Promotion validates the current prepared patch, recomputes the current worktree fingerprint, and enters the existing typed requestPreparedDiffRevision transition with bounded finding provenance in its summary. Prepared-backed Kilo results use the same controller and transition. The existing explicit confirmation, task authority, approval/recovery state, and later execution action are unchanged. There is no second revision endpoint and promotion never starts a revision run.

Trust boundary shown in the UI: local finding -> prepared revision request; authority and execution remain separate.

Lifecycle, retries, and accessibility

• exact request retries replay from a bounded canonical fingerprint retained with promotion metadata even after the in-memory completed cache evicts; request-id conflicts are rejected
• in-flight work is locked by durable finding identity across concurrent surfaces, dismissal/clear races are rejected atomically, target failures stay retryable, and delayed completions retain destination metadata without regressing newer lifecycle state
• the durable adapters reuse an existing Neon-seeded draft comment or prepared revision request before recording promotion metadata
• promotion controls are surface-wide pending-safe; composer identity is keyed to the finding, conflicting actions are cross-disabled, and failures remain retryable
• status is announced politely, destination controls have descriptive accessible names, and unsupported/unanchorable states expose their reason
• the shared prepared-revision composer retains keyboard/editor behavior, visible focus, compact embedding, square hairline Cockpit styling, and existing confirmation behavior

Verification

• prior implementation pass: npm run check — lint, layer check, migration check, app/docs typecheck, and 102 unit files / 651 tests passed
• latest review-delta suite: 4 focused service/route/component files / 40 tests passed
• npm run typecheck:app
• changed-path Oxlint
• changed-path Prettier check
• git diff --check
• Impeccable deterministic detector on every changed frontend file: no findings

Coverage includes source/revision/surface/finding matching, lifecycle gates, atomic failures, destination metadata, retry after bounded cache eviction, request-id conflicts, lone-surrogate finding IDs, delayed cross-surface dismiss ordering, targeted events, GitHub single/multi-line anchors and local-draft-only behavior, stale-draft head rejection, prepared worktree revision rechecks, prepared/Kilo revision-path reuse and confirmation, composer identity, surface-wide pending controls, unsupported sources, unanchorable patches, retained history, and failure retry.

Per review direction, broad Git/worktree/integration suites and npm run verify were not rerun for this bounded delta.

Performance and data loading

Promotion remains bounded metadata/control flow. GitHub and prepared promotion load at most the requested file patch for anchor validation. Prepared promotion additionally recomputes the current worktree revision from changed-file identity metadata immediately before transition, without eagerly loading every patch, adding speculative caching, or relaxing existing performance gates.

Plan handoff

• adds a minor changeset for the user-facing feature
• marks Phase B step 4 complete in place and clarifies prepared/Kilo plus worktree-fingerprint behavior
• records the current sequencing decision: complete B5, run a Phase B completion audit, then pause while preserving every Phase C-E item as future work
• B5 revision refresh/orientation redesign is intentionally untouched

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 611786ac50

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".