Intake

For allowed GitHub reads, run the direct collector under current effective network and filesystem grants or request runtime approval for the complete owning command when required capability is unavailable. No separate workflow consent is needed. Apply GitHub Read Execution; runtime permission and denial remain authoritative.

When runtime permissions show network access enabled and the helper's required paths writable, omit sandbox_permissions and justification on the direct helper call; give no approval brief. Apply GitHub Read Execution even when the active profile name is omitted. A missing label or failed lookup does not mean disabled access; do not run codex execpolicy list to detect a profile. Preserve explicit destination restrictions and check report, .git, and checkout paths separately where applicable.

Before creating a run, normalize only the target and apply PR State Preflight for PR scope, including resumed PR work, bare PRs, +review and explicit PR report-backed requests. Use the retained canonical PR URL on resume. Stop immediately for a currently closed or merged PR before prior-report lookup or validation, a missing-review question, collector access, run creation or any other dependent workflow. Preserve existing artifacts and local work. The metadata reader owns entry permissions and classified failures; local report-only intake remains network-free.

For resumed source drift before worktree delivery, apply the preflight's guarded-pull exception and Source drift recovery before requiring the remote state read. Locate and verify the original PR branch's current checkout, attempt the permitted fast-forward-only pull, then finish PR State Preflight before resuming intake or fixes. A moved HEAD or metadata approval timeout alone does not justify asking for another message instead of attempting that recovery.

Resolve the metadata reader's profile-or-approval route before the first read, and finish permitted reader permission recovery before reporting entry blocked. Use GitHub Read Execution to distinguish missing capability from an actual denial, then continue this same remediation after a successful state check.

01: Create Run Directory

After entry admits an OPEN PR, or for local mode=report scope (report-backed or supplied findings), run create_run.py --skill code-remediate per ../../../shared/helper-cli-contract.md; resume reuses its existing run.

02: Normalize input and optional report findings

+review joins review with remediation and authorizes the needed review step for the same target: reuse current eligible evidence, update a recoverable stale review, or create a fresh review when needed, then resume remediation. Carry this authorization into the owning Code Review entry decision without another review-choice question; preserve actual runtime, paid-execution, independence and retry boundaries. +report, report aliases and explicit report paths request existing evidence only; they do not independently authorize new review work. Remediation remains the primary goal. Before a nested review retries missing dependencies, the remediation parent prepares its complete declared test environment under Project Dependency Preparation, including before finding selection; the read-only child retains its own boundaries. When requested PR review evidence is missing or incomplete, apply Missing requested PR review decision below: run the approved bounded repair or fresh review first, or continue available findings only after explicit user confirmation. Disclose the requested review evidence as unavailable without manufacturing a finding. Retain the report request and exact diagnostic. Preflight success and direct-check receipts remain preliminary evidence; never convert applicable gate failures to not-applicable, invent provenance, or skip source-freshness checks. Before selection, completing requested review evidence is a primary prerequisite under the authorization above. After selection, auxiliary producer bookkeeping cannot displace an established authorized fix and its regression; follow the bounded recovery conditions below.

Shorthand rules:

• $code-remediate 123 => mode=pr, PR_TARGET=123, REQUESTED_REPORT=false. Existing explicit report aliases remain report-backed. Reject unsupported flags before collection. Continue normal remediation scope selection.
• Canonical in-session report: $code-remediate review => mode=report, REQUESTED_REPORT=true, FINDINGS_SOURCE=latest-assessed-current-session-review. It resolves to the latest assessed code-review result created in the current session. Reuse the exact prior artifact path recorded in this session; do not scan reports or infer a PR target. Do not collect PR evidence or fetch online review comments. If no assessed current-session review result is available, fail this completed-report lookup with current-session-review-report-required; retain the exact known run when present and apply preliminary finding intake below. Do not infer a PR or start a review. If no independently usable finding evidence exists, ask only for the missing finding evidence or selection, such as an existing report path or a concrete finding and source target.
• Canonical online-only PR: $code-remediate #123 => mode=pr, PR_TARGET=123, REQUESTED_REPORT=false, FINDINGS_SOURCE=none. Accepted bare PR forms are: bare number, #number, PR URL, and natural-language bare PR targets; they collect current online items and verified local checkout without a prior review report.
• Natural-language online-only aliases: remediate 123, remediate #123, remediate PR 123, and remediate <github-pr-url> use same bare-PR route.
• Canonical report-backed PR: $code-remediate #123 +review => mode=pr, PR_TARGET=123, REQUESTED_REPORT=true, FINDINGS_SOURCE=latest-matching-review-report.
• matching-review-incomplete:<run-directory> selects recovery work, not a terminal outcome. The identified review has no result or candidate yet; it may retain only a PR target, collected pr.json, or notes. Record the diagnostic and retained run in the remediation run, then take the applicable action now:
• For +review or an existing bound resume authorization, read Report compatibility and recovery and execute Code Review at the first unmet checkpoint. Inspect source bindings, original reviewer evidence and checks; reuse authenticated evidence and perform missing, stale or unverifiable work through the current producer. An old failed validation is evidence to recheck, not a new denial. When reviewer validation is the missing checkpoint, read Reviewer validation recovery and attempt its permitted recovery. Complete the producer's validators, promotion and --complete-run; admit that exact result and continue this remediation through selection, fixes and verification. Reading notes, acknowledging authorization and naming these steps do not execute them. Do not send a final response while one of these authorized actions is available, even when the advisory Stop hook is unavailable or untrusted.
• For existing-only +report, report aliases or explicit report paths without bound review authorization, apply Missing requested PR review decision and ask its native question when needed. For an actual denied capability, unverified source, exhausted recovery or missing decision, identify the concrete boundary and ask only the required question; retain all protections and still-permitted independent work. Never substitute a hidden request to resume for that question.
• Continuing without a completed report still requires the user's explicit choice; only then use current-online/user findings and eligible preliminary hypotheses through normal selection and source validation, with the missing report limitation explicit. Do not claim no review was performed, consume notes as a validated result, or select an older verdict. These rules apply across sessions. A newer candidate or malformed result with damaged PR identity also blocks stale assessed fallback.
• Compatibility alias: $code-remediate #123 +report => mode=pr, PR_TARGET=123, REQUESTED_REPORT=true, FINDINGS_SOURCE=latest-matching-review-report; $code-remediate #123 +report compatibility alias has same report lookup.
• Natural-language aliases: remediate 123 report, remediate #123 report, and remediate PR 123 report => mode=pr, PR_TARGET=123, REQUESTED_REPORT=true, FINDINGS_SOURCE=latest-matching-review-report.
• remediate <github-pr-url> report => mode=pr, PR_TARGET=<github-pr-url>, REQUESTED_REPORT=true, FINDINGS_SOURCE=latest-matching-review-report.
• An explicit review result path combined with PR target sets REQUESTED_REPORT=true; bare PR target has no implicit report path.
• Bare PR and report-backed PR routing are distinct: explicit +review, +report, report aliases, and report paths retain report-plus-online behavior; absence of report source selects online-only intake and never falls back to report lookup.
• If +review, +report, report, latest, latest-report, or review-report replaces path, find newest matching result across canonical .reports/codex/code-review/pr-<number>/run-<NNN>/result.json and legacy flat .reports/codex/code-review/<timestamp>/result.json artifacts whose sibling pr.json has same PR number/URL as PR_TARGET.
• When REQUESTED_REPORT=true, no matching code-review report means the requested assessed findings are missing. Explain that first; for PR intake, apply Missing requested PR review decision below before continuing, even when usable findings exist. A matching-review-unavailable-rerun-code-review result means PR collection failed before any assessed review; do not use it as findings input. Inspect that run's classified error and retained checkout diagnostics; fresh PR collection still follows this skill's current-source gates. Fresh review requires the explicit decision below or unambiguous existing authorization. A matching-review-closed-not-remediable result is a terminal close disposition with no source findings; do not remediate it or fall back to an older assessed report. A matching-review-candidate-unpromoted:<path> result requires the read-only diagnosis below followed by the same decision; do not fall back to an older assessed report. Current-session report and local explicit-report intake retain their separate preliminary boundaries.
• When canonical matching PR runs exist, select greatest parsed numeric run-<NNN> index. Otherwise select greatest parsed legacy flat timestamp. Never rely on lexical glob order, modification time, or directory traversal order; record selected path in <run-directory>/findings-input.txt.

When FINDINGS_SOURCE=latest-matching-review-report, inspect PLUGIN_ROOT/bin/python PLUGIN_ROOT/shared/find-review-report.py --help, resolve PR_TARGET against .reports/codex/code-review, and assign printed path to FINDINGS_SOURCE. The helper searches explicit canonical nested PR runs plus legacy flat timestamped runs; no migration is required. The current report root supersedes legacy for the same PR because each root allocates run numbers independently; within one root, numeric run order applies. It filters explicit review_status=unavailable diagnostics, so an older current schema-3 assessed review remains eligible when newer collection failure exists. A newer review_status=closed result instead blocks older findings because close disposition is current and non-remediable. Before accepting explicit review result path as findings input, invoke same helper with --result <path>; it rejects unavailable results with rerun instruction, closed results with matching-review-closed-not-remediable, candidate paths with matching-review-candidate-unpromoted:<path>, schema-2 archives with historical-review-unverified-archive, and any assessed PR result superseded by a newer run. Use --archive-result <path> only to locate schema-2 or schema-3 historical data for reading; its explicitly unverified JSON status is never findings input. A bare PR target must not run this helper, scan prior review reports, or require a code-review artifact.

Explicit local working-tree, path and commit intake requires canonical result.json and reruns both producer artifact validators, including source/provenance and final-handoff bindings, before returning its path. A plausible recommendation or filename alone is not validation. The helper defaults to the report's recorded producer thread, including across sessions; an explicit --parent-thread-id override remains authoritative. Use --codex-home only for the actual retained rollout root when needed. These identify evidence for validation, never waive it. Missing or invalid evidence stops completed-report admission; retain the validation diagnostic without falling back to an older report. Continue independently usable findings under preliminary finding intake; incomplete report proof remains open. PR-only automatic discovery remains unchanged.

Before treating any lookup, validation or selection-preflight failure as a missing review, apply Report compatibility and recovery. Assess actual retained evidence, not the version number alone; a helper diagnostic code containing rerun-code-review names the last-resort fallback, never the decision. Automatically repair deterministic consumer-owned inventory or presentation from verified evidence; resume the owning Code Review workflow for producer-owned derived repairs, without asking for a full review. Preserve original evidence and rerun the failed consumer check. A package reader that rejects its own documented supported presentation is a consumer defect, not proof the review needs rerunning; repair the authorized package source and verify its next consumer, or report the exact installation capability needed. Never modify installed package files outside task authority.

For matching-review-candidate-unpromoted:<path>, the review run belongs to code-review: remediation never directly repairs, rewrites, rerenders, or promotes its specialist-manifest.json, result.candidate.json, or result.json. Run the review-specific validator, then the shared validator, read-only against that exact candidate and its review run directory, and persist each exact stdout/stderr code in <run-directory>/review-candidate-validation.txt, including manifest-invalid-attempt-count:<role> when applicable. A passing read-only validation does not admit the candidate either; only code-review's own finalize step promotes it. Resume that owning producer automatically when the compatibility assessment proves a deterministic repair or unfinished finalization is sufficient; do not ask the user to re-run code-review for an agent-owned bookkeeping failure. Never consume result.candidate.json as a completed review; only its eligible finding records may be considered under preliminary finding intake below. Never invent missing attempt provenance, retry a specialist for artifact bookkeeping, rerun the full review without the explicit authorization below, or fall back to an older assessed report. If substantive evidence is still missing after feasible automatic recovery, apply Missing requested PR review decision before continuation. For requested PR evidence, continue source-verified remediation with the report limitation disclosed only after the user explicitly chooses to continue without a completed report. Disclose any missing independent coverage as a limitation. This check has no waiting loop and makes no remote mutation.

Missing requested PR review decision

Only when mode=pr and REQUESTED_REPORT=true has no eligible completed report (including +review, +report, report aliases and explicit PR report paths), read missing-review-decision.md and apply it before continuation, even when usable findings exist; every Missing requested PR review decision pointer in this skill means this reference. Bare PR online-only intake, current-session review and local report intake do not load it. Joined +review reuses its already authorized review step through that reference rather than asking for the same permission again. The reference preserves the eligibility conditions, the PR-bound question and its choices, and the New review, Resume last one and Stop branches, plus separately explicit available-findings instructions.

Review evidence freshness

After collecting verified source and before selecting findings, apply the same freshness assessment to saved reports and online review comments. Compare the report's reviewed head, online review/comment commit identifiers and thread isOutdated evidence with the current verified head where available; fetch time does not establish review freshness. Record older source as stale and missing revision evidence as unknown, never silently current. An older finding may still be valid: freshness alone neither proves nor disproves the claim, and every selected claim must be checked against current source.

For bare PR online-only remediation, stale or unknown comment provenance remains a disclosed evidence limit, not a new permission question. Inspect each claim against the verified current source, retain its original provenance and actual disposition, then continue normal finding selection and fixes. Do not start or offer an additional review solely because comments predate the head; the requested current-source triage is already authorized. A concrete ambiguity that prevents establishing the requested change may still require the user's decision.

For a requested existing report whose stale source requires a substantive review decision not already authorized, ask one PR-bound decision: Use existing findings, Update existing review, or Create a new review. State which evidence is stale; offer update only when producer-owned recovery can preserve authentic provenance and validate the current source. Unknown freshness alone does not force a new review or a question; disclose it and triage against current source. Reuse any prior answer for the same evidence and target. A joined +review or another explicit review authorization already covers the needed review step: do not ask again; reuse current evidence or perform the authorized update/new review, then resume this remediation run.

When an online-only run chooses an authorized update or new review, set REQUESTED_REPORT=true and retain online evidence: it now uses report-plus-online intake. Set FINDINGS_SOURCE to the exact returned canonical result, admit it through the normal report validator, and preserve report findings alongside online sources in inventory and selection. The earlier online-only prohibitions on report lookup/copying and its zero report counters no longer apply to this explicitly upgraded route. Use existing findings preserves the original intake mode.

Using existing findings retains the original report/comment provenance and stale status while validating each claim against current source; never rewrite its reviewed SHA or claim fresh independent coverage. Updating or creating review follows the owning Code Review workflow and its normal artifact/provenance gates, then returns the eligible canonical result to this run. For online comments, update means a new local assessment that references the original evidence; never edit or post GitHub comments. A requested full fresh review is not fulfilled merely by fetching comments again. Carry existing authorization into the nested review entry decision, preserve immutable prior evidence, and apply the return/admission rules in missing-review-decision.md without repeating a bound choice. Runtime denial, actual source failure and missing evidence remain separate from review age.

Preliminary finding intake

An unfinished report is not a validated review, but a concrete finding can still be checked against source. Requested PR evidence first follows Missing requested PR review decision, which requires an explicit continue choice before preliminary findings stand in for the requested completed PR report. Use retained canonical finding records only with matching exact PR identity, head, scope, and source evidence; triage each claim against the freshly verified current source before accepting it. Reuse the existing action-item inventory, scope selection, and workplan; preserve the original record ID/body/evidence path and its preliminary status in action-items.md and resolution-scope.md. Treat a current user-supplied finding similarly. Markdown notes without canonical records remain hypotheses requiring concrete finding and source evidence, not a completed report or authority to fix an unverified claim.

• Keep completed-report lookup and its validators unchanged; never present preliminary records as a validated review result, infer specialist authors/ratings, promote a candidate without proof, or substitute an older verdict.
• Selection, source checkout, target integration, and merge authorization gates still apply. Only selected source-confirmed findings may be implemented; missing report evidence does not authorize unselected edits.
• Preserve requested-report intent and missing coverage in the existing notes and unresolved evidence. Do not manufacture an assessed JSON report, silently clear REQUESTED_REPORT, or claim complete report-origin inventory when the producer has not established it. Use the admission contract below to retain actual fixed work and the explicit review limitation; completed-report admission still requires its genuine original input.
• Preserve any required post-fix independent review and applicable gates; do not certify unreviewed fixes as clean. Report actual fixes and actual verification separately from missing producer proof, failed gates, or unfulfilled review coverage.
• If no finding can be identified and source-confirmed, ask only for the missing finding evidence or selection. Do not make the user choose reviewer routes, repartition contexts, or debug agent setup.

Report admission and supplied findings

New CODE_REMEDIATE_METADATA.review_report_intake writes use schema_version=2 and admission_status=completed|preliminary|unavailable; keep requested_report=true whenever review evidence was requested. Historical missing admission fields mean completed and retain the original strict report coverage.

Admission	Retained input	Remediation result
completed	Exact validated report in findings-input.txt; full source-finding coverage and separate review context.	Normal closure and verification rules.
preliminary	Byte-exact original structured canonical records in findings-input.txt, original pr.json, and current-source match. Plain notes do not qualify.	Report actual selected fixes and checks; disclose unavailable completed-report proof as a limitation, never a synthetic finding.
unavailable	Actual lookup/validation diagnostic; available current-online or user-supplied findings. No report-origin sources.	Report actual selected fixes and checks separately from the missing report limitation.

For either noncompleted state, set admission_evidence with run-relative diagnostic_path, its byte SHA-256 diagnostic_sha256, byte SHA-256 selection_sha256 of frozen selection.json, and limitation containing the exact corresponding metadata.confidence_gaps entry. Do not add open_item_id or invent a work item. Historical admission schema 1 retains its original open-item and failed-result requirements. In PR mode, also bind the exact canonical current pr_url, head_oid, base_oid from pr/pr-routing.json. Keep selected source-work status separate from missing requested proof; that proof remains unavailable even when the actual fix is complete. On authorized available-finding continuation, do not ask the user again to select reviewer bookkeeping or start a review merely to represent the partial result. Existing source, selection, workplan, inventory, gate, and commit validators still apply.

For local mode=report with unavailable requested evidence, use admission_status=unavailable. Before selection or edits, capture the actual source destination with PLUGIN_ROOT/bin/python PLUGIN_ROOT/shared/collect_diff.py --snapshot --repository <actual-source> --scope-path <selected-source-path> --out <run-directory>/local-source/source-snapshot.json, repeating --scope-path for each source scope. In that destination, collect the ordinary diff pack with PLUGIN_ROOT/bin/python PLUGIN_ROOT/shared/collect_diff.py --out <run-directory>/local-source; do not create a review worktree. Set admission_evidence.local_source and the identical frozen selection.json.local_source to run-relative snapshot_path, byte snapshot_sha256, run-relative diff_path, byte diff_sha256, and the snapshot's exact repository, revision, and scope_paths. Preserve this pre-edit snapshot after intended fixes; ordinary closure and gate receipts prove the resulting work separately. Do not invent PR identity for local remediation. Local preliminary report-origin admission is unsupported without matching original source proof; use unavailable intake with source-confirmed supplied findings instead.

For preliminary, additionally retain run-relative original_pr_path, its byte SHA-256 original_pr_sha256, and SHA-256 original_input_sha256 of findings-input.txt. Original PR URL/base/head and review_input_sha256 must match the canonical current PR diff. Preserve every enriched finding's ID, severity, title, summary, required change, evidence, closure evidence, and declared authors losslessly; these declarations are preliminary, not independently authenticated assessments. Do not manufacture JSON from plain notes to satisfy this path; use unavailable and directly source-confirmed online/user findings instead.

For supplied findings, retain the complete actual request in a run-local evidence file and use the existing per-source fields with kind=user, stable local source_id=user-<input-key>#finding-<positive-ordinal>, exact location or general, complete body, and run-relative evidence. This is a local finding identity, not a claimed runtime message ID. Preserve separate user/report/online sources and derived counts/tags; never disguise user text as GitHub evidence or a completed report. The final consumer requires each full supplied body in its retained evidence file. For new handoffs, user sources use remediation selection presentation_version=5 and final handoff presentation_version=13; historical selection versions 2/3/4 and handoff versions 2/3/5/6 retain their original source kinds and rendering. Other workflows retain their own presentation versions.

When a validated FINDINGS_SOURCE file exists, copy its exact bytes to <run-directory>/findings-input.txt with filesystem tool. Do not depend on shell variable retaining that source path. For bare PR online-only intake, do not create <run-directory>/findings-input.txt; set CODE_REMEDIATE_METADATA.review_report_intake.requested_report=false and every report-item counter to 0.

For completed report intake, retain the admitted canonical result path as review_report_intake.admission_evidence.producer_result_path, especially when the copied result's artifact_path is relative to its original run. When ordinary admission used explicit evidence coordinates, also retain producer_codex_home and producer_parent_thread_id in that same evidence map. Without an explicit thread, producer validation derives the original manifest thread for every assessed scope; the consuming session cannot substitute for it. The selected evidence home remains necessary when native rollout proof is outside the default home; wrong coordinates, missing logs and invalid proof still reject. Current validation compares the copy byte-for-byte with that producer and revalidates its promotion, source/provenance and completion through the existing report finder. A resolvable original artifact_path remains compatible; never resolve a producer-relative basename inside the consumer or convert a copied candidate into completed evidence. Missing or rejected producer proof uses the existing preliminary/unavailable route and preserves the factual report limitation. These checks do not require the reviewed head to equal an advanced remediation head: current-source revalidation remains separate.

For mode=pr, inspect PLUGIN_ROOT/bin/python PLUGIN_ROOT/shared/collect_pr.py --help. Keep PR_TARGET for report lookup; for a numeric PR target, first run local PLUGIN_ROOT/bin/python PLUGIN_ROOT/shared/select-git-remote.py --canonical-pr-url <positive-number> --cwd <source-repository> and set COLLECTION_TARGET to its canonical URL for valid GitHub origin, or the sole GitHub remote when origin is absent. Stop only if no safe default identity exists; do not launch a numeric-target collector. A user-supplied canonical PR URL takes precedence as COLLECTION_TARGET and must match a configured remote. Collect COLLECTION_TARGET into <run-directory>/pr with --checkout --checkout-mode remediate. Remediation first invokes gh pr checkout <canonical PR URL>, including when the current HEAD already equals the PR head. If that command fails, only a verified same-repository PR may use direct Git checkout of its actual PR branch; fork PRs use the bounded recovery loop below.

After successful PR collection for a newly created run, invoke PLUGIN_ROOT/bin/python PLUGIN_ROOT/shared/create_run.py --skill code-remediate --promote-pr-run <run-directory> per the helper contract. It reads the collected <run-directory>/pr/pr.json and moves the complete run into .reports/codex/code-remediate/pr-<number>/run-<NNN>/. Capture its single printed final path and use it for every subsequent artifact and command, before creating branch receipts, selection, dispatch or result bindings. Never construct the PR number or run index yourself. Local report-only runs and collection failures keep their timestamp paths; resumed runs retain their existing paths and are never promoted again.

On resume, inspect <run-directory>/worktree-delivery.md first when present. A partial handoff requires diagnosis; a verified delivered run resumes report-only under Worktree lifecycle, and further source edits or commits require a new normal run. The following source-receipt route applies only before delivery begins. Inspect an existing <run-directory>/remediation-branch.json before collection. If <run-directory>/remediation-branch-recovered.json exists, use it for all continuation checks; never replace it or fall back after a failed check. Otherwise, a schema-1 receipt uses the legacy recovery procedure below. Check the selected receipt against the last recorded authorized revision with remediation_branch.py check; never recollect with checkout merely to replace local remediation commits or edits with the original PR head. Reuse still-valid source receipts and closure evidence. If fresh PR metadata changes the source contract, preserve the current branch and work and resolve that integration decision before further edits.

Apply PR Collection Runtime Boundary before collector execution. Do not create or modify runtime approval rules files.

Run the direct owning collector per GitHub Read Execution. Its nested GitHub CLI, HTTPS fallback, checkout, and Git fetch traffic remain bound by the collector contract. An explicit runtime denial or non-overridable restriction stops the collection attempt; diagnose the active permissions and exact command without broadening access or retrying the denied command. Apply the existing core collection-failure path.

github_read.py is plugin-wide GitHub data boundary: do not invoke gh outside it.

• It uses gh as opaque local credential broker, never invokes gh auth, reads token/keychain state, or persists GitHub CLI failure output.
• It permits only audited built-in view groups (gist, issue, pr, project, release, repo, ruleset, run, workflow), REST GET, and GraphQL queries; no remote mutation is permitted.
• Its public HTTPS fallback cannot establish private PR evidence.

Core and supplemental evidence:

• collect_pr.py treats PR identity/body plus exact local source as core evidence. In remediation mode it must first record the canonical gh pr checkout <canonical PR URL> attempt, checkout_mode=remediate, an attached local branch, and the exact verified PR head; a matching HEAD does not skip that command. After a failed command, only a same-repository PR may record direct checkout of the actual headRefName branch, with local branch name, exact SHA, merge tracking, and source repository identity all verified. Fork recovery must end in a successful attached gh checkout. It derives diff.patch locally. Its worktree-preflight.json preserves unrelated tracked edits but blocks unresolved index entries, edits to PR-changed files, and paths checkout would overwrite; matching HEAD does not bypass these checks.
• Retain checkout force_policy and classified failure evidence: no forced checkout, manual tracking repair, reset, rebase, stash, or discarded user changes. A failed remediation checkout stops before edits or commits unless the verified same-repository branch route or an explicitly user-requested bounded fork recovery loop completes.
• GraphQL review-thread resolution status is supplemental; if unavailable, collector writes empty normalized thread arrays plus review-threads-error.txt and continues.
• Record that online-triage coverage gap in action-items.md, result confidence gaps, and unresolved/deferred closure rationale; never treat it as code finding or silently claim complete thread triage.
• On core collection failure, use <run-directory>/pr/pr-error.txt, <run-directory>/pr/worktree-preflight.json, and <run-directory>/pr/command-failure.json when present to distinguish classified process failure from source-review findings; for dirty-worktree overlap, name exact overlapping_paths first; do not treat it as merge recommendation.

When gh pr view metadata fails, public unauthenticated HTTPS fallback is eligible only when all of these hold:

• The failure is github-network, github-auth, github-rate-limit, or command-timeout.
• The checkout target is trusted: canonical PR URL must match a configured GitHub remote; a numeric target is bound to valid GitHub origin, or the sole GitHub remote when origin is absent.

Ambiguous or unsafe targets, permission failures, not-found failures, and unclassified failures remain fail-closed.

Fallback behavior:

• Public metadata fallback alone never satisfies remediation's attached-branch checkout contract or authorizes edits. It may supply limited metadata for the same-repository original-branch route only when every identity, checkout, destination, and degraded-evidence gate passes. After gh pr checkout fails, remediation has no exact-commit, detached, unverified cached-ref, generated-branch, or manual set-upstream fallback; only the verified same-repository original-branch route or, on explicit user request, the fork recovery loop is permitted.
• online-review-summary.json must list unavailable fallback evidence as sorted IDs.
• Raw GitHub CLI stderr is never persisted; terminal diagnostics may include safe failure_reason enum alongside non-secret classification metadata.

Findings intake:

• For mode=report, normalize only the review report after confirming it is assessed; if admission is unavailable, only source-confirmed findings from the explicitly identified report or user-supplied evidence may proceed under preliminary finding intake. Reject review_status=unavailable and review_status=closed; the latter is a close disposition without source findings. Do not read, collect, or infer any <run-directory>/pr/ evidence.
• For mode=pr, always normalize <run-directory>/pr/comments.json, <run-directory>/pr/reviews.json, <run-directory>/pr/review-threads.json, and <run-directory>/pr/unresolved-review-threads.json.
• When REQUESTED_REPORT=false, those current online records are complete findings source. Do not read or infer review report, and do not require prior assessed artifact. If no online item is actionable after triage, continue through documented none-selectable path instead of requesting code-review.
• When REQUESTED_REPORT=true and a completed report has been admitted, additionally normalize <run-directory>/findings-input.txt. When admission is unavailable, continue the preliminary/current-online/user intake above only after the required missing-review decision, and retain the factual report limitation; do not pretend its entire inventory is known. Normalize source findings into action items. Retain failed checks_failed, follow_up, review_decision.required_next_work, confidence gaps, confidence-recovery remaining limits and no-finding residual risks as exact review context; only a verified source defect or genuine project-required check becomes work.
• Use local checkout in <run-directory>/pr/local-checkout.json as the authoritative collected PR source and require its verified-local-checkout diff provenance. After authorized target integration, apply the recorded merge result as described below; do not switch back to the unmerged PR head for finding edits.
• Refresh both target and PR head yourself before conflict/review-item resolution; <run-directory>/pr/target-branch.json and <run-directory>/pr/pr-head-fetch.json must record fetched tips, including fork PRs. Normal fetches use no persistent ref destinations and avoid forced cache updates; the verified same-repository original-branch fallback may instead perform a guarded local update of an explicitly selected remote-tracking ref from the already fetched, verified PR head, using the observed prior value and preserving divergent or concurrently changed refs, for native tracking creation. Do not perform a second network fetch for that update. Capture verified IDs before another fetch changes FETCH_HEAD. Routine freshness is agent-owned work, not request for user to pull branches. Use the immutable fetched target ID in target-branch.json.remote_ref; separate local target checkout is unnecessary.
• Remediation checkout artifacts must prove checkout_mode=remediate, the initial gh pr checkout <canonical PR URL> command and result, attached branch, and exact PR head. If that command fails, retain its safe classified cause and fresh local identity/state. A same-repository fallback must prove head_repository == base_repository, local branch name equals headRefName, exact head SHA, branch.<name>.merge=refs/heads/<headRefName>, and fetch-source repository identity; native tracking setup performed by the authorized direct checkout is allowed, but manual tracking repair is not. A fork fallback exists only on explicit user request; it must complete the bounded recovery loop and then rerun gh to obtain an attached branch. Any detached, wrong-branch, wrong-head, unverified source identity, or incomplete loop stops before prepare, edits, merges, or commits. Never replace it with exact-SHA detach, an unverified cached-ref checkout, a generated branch, or a generic "repair checkout" instruction. If fresh fetched evidence proves the PR moved, a new authorized collection must still use this remediation checkout route.
• If core metadata, target refresh, checkout, or local diff fails, record failure; continue at Report discussion after deferred source recovery only when user accepts stale online-review coverage and no code edits are required, else fail.
• If only supplemental review-thread resolution status is unavailable, continue with explicit partial-coverage evidence and do not infer that any thread is resolved.
• Never inspect/edit PR code from curl, raw.githubusercontent.com, or copied head-files/ snapshots; raw-file snapshot rejection: snapshots are rejected.

Versioned review candidate intake

• For review reports with finding_records_version=2, require the producer completion validator supporting review_validation.schema_version=1 and source_rating_version=1; an incompatible reader stops only dependent admission while Report compatibility and recovery diagnoses the missing capability and uses an authorized compatible reader or package-source repair. Do not prescribe a review rerun for the version alone; substantive missing evidence determines that choice.
• Only confirmed review_findings authorize defect fixes.
• Retain open candidate IDs, exact missing prerequisites, owners, next checks and closure conditions as evidence obligations; unverified or pending concerns are not automatic edit requests.
• Preserve applicable authoritative retained evidence if fresh retrieval fails.
• Unavailable or inconclusive evidence does not refute a defect; if binding is invalid, retain an unverified obligation.
• New ratings use 1 Approve, 2 Minor changes, 3 Major revision, 4 Insufficient but a good initiative, 5 Block or explicit null for a completed undecidable assessment.
• Historical absent-family reports keep 4 insufficient evidence and 5 block/reject; never reinterpret old 4.

Collection failure recovery

Only on a PR collection failure, a deferred source recovery, source drift, or a schema-1 legacy receipt, read source-recovery.md before diagnosing or retrying; successful collection does not load it. The reference holds Collection failure recovery, Report discussion after deferred source recovery, Source drift recovery, and Legacy receipt recovery.