# Review finding contract ## Required header ```yaml schema: shepherd.review-result/1 run: lane: |null mode: critic-prehoc|auditor-posthoc reviewer_role: critic|auditor candidate_commit: input_digest: startup_skill: reviewing skill_bundle_digest: result_channel: native-result verdict: green|pass|redo|red|blocked review_artifact: subject_result_artifact: subject_task_digest: ``` ## Conditional report path Every verdict and finding is delivered through the native `result_channel`. `report_path` is optional in the record and is valid only when the native reviewer capability explicitly includes `report-write`. Auditor briefs with that capability require one exact assigned `report_path`; Critic has no `report-write` capability, omits `report_path`, and returns the complete record through `native-result`. ## Finding fields Each finding contains `finding_id`, `location`, `hypothesis`, `falsification_command`, `falsification_exit_status`, `observed_result`, `confidence`, `severity`, `impact`, `acceptance_predicate`, `owner_role`, `route`, and `evidence_paths`. `confidence` is one of `structurally-verifiable`, `plausible-partial`, or `suggestive-only`; a low-confidence concern is an open question, not a passing defect claim. ## Mode checks `lane: null` is reserved for run-scoped planning Critic review. Native requires the exact current planning-mode Shepherd root, a planted run, the live lane-free Engineer/Planning claim, and that Engineer's lane-free child Critic. Never invent a planning lane. An Auditor or execution review retains the exact assigned lane. Structural Component validation alone does not prove live Native review authority. REDO 1 through 3 retain the exact subject instance, task, and scope. Rejection 4 quarantines that subject and preserves its singleton claim and review history. Only the current Native root's `dispatch review-replace` can authorize the exact lineaged replacement; preparation alone grants no claim or activation authority. The old singleton remains occupied until the authorized replacement is durably Active and Native compares the old claim and payload before transferring it. Interrupted or rejected replacement attempts cannot free that slot. Recovery accepts only the exact typed quarantine transition, never arbitrary changed JSON. Critic records necessity, assumptions, logic, scope/complexity, graph coverage, and runnable review gates before execution. Auditor records brief compliance, exact diff/path ownership, real gate evidence, fragile one-off configuration, duplicate helpers, and local-green/CI-red divergence after implementation. Neither mode edits the reviewed scope. A report is invalid when it lacks the candidate identity, mode, `result_channel`, hypothesis-falsification-confidence triple, exact location, severity basis, route, or final verdict. A `report_path` without explicit `report-write` authority is invalid. Stale candidate or post-review mutation is a custody RED regardless of the author's claimed result. The review document and the Native result artifact are one canonical `shepherd.review-result/1` document; the separate `review_artifact` slot is required only as the exact allocated carrier path. A posthoc ruling must bind the subject result digest and task digest captured by Native. A RED, REDO, or blocked verdict without at least one finding is invalid; green/pass may carry an explicit empty findings array to represent no findings.