Impact summary
Independent-review completion is now based on strict semantic replay, not file
presence. Invalid receipts preserve provider and assignment evidence and emit
only `REVIEW_RECEIPT_INVALID`. Canonical state remains 4/2/0/2/0: provider
evidence, ready assignments, completed reviews, retirements, proven advantages.
Ranked findings
- High — genuine review is still the binding constraint: two independent
reviewers must return completed forms before an honest aggregate can exist.
- High — aggregate replay is not identity proof: qualification and
independence remain separately governed private evidence.
- Medium — public evidence must stay aggregate-only: exact-key parsing must
continue to reject fields that could leak responses or identifiers.
Actions
| Owner | Action and acceptance criteria | Validation |
|---|---|---|
| AI Evaluation | Collect two genuine returns for Calliope v10 and Clio hook v6 | Two distinct private responses per packet |
| AI Reliability | Publish only a parser-valid aggregate bound to its surface | Strict parser and verifier replay |
| Trust | Verify independence separately and explicitly accept evidence | Receipt grants no acceptance authority |
| Maintainers | Privacy-test every new diagnostic code | No raw error, path, hash, candidate, or reviewer data |
Next-cycle hypothesis
One prepared surface can obtain two genuine blinded returns whose aggregate
populates quality lift and reviewer effort without protected-dimension regression.
Until then, no agent advantage over its deterministic baseline is proven.
Binding outcome
The verifier now proves the receipt belongs to the exact registered handoff, not
merely to a named surface. A semantically valid receipt with a different packet
hash is withheld, prior provider/assignment evidence remains available, and the
public diagnostic stays `REVIEW_RECEIPT_INVALID`.