feat(lifecycle): revision findings ledger — structured failure feedback, persisted and delivered down the chain (#486)

* feat(lifecycle): revision findings ledger — structured QA/PR/PM/CEO failure feedback, persisted and delivered down the chain

Every bounce used to survive only as flattened prose: rounds overwrote each
other in notes_structured, request_changes persisted nothing, two raw
dev_notes appends were silently destroyed by the next handoff note, and the
dev prompt pointed at fields (qa_notes via evidence(), pm_notes) the API
never delivered. Agents re-interpreted and re-discovered every failure
before they could start fixing it.

- task_review_findings (migration 071, append-only): file/line/severity/
  criterion(AC-id-validated)/expected/actual/fix/evidence per finding, with
  origin (qa|pr_gate|pm|ceo), round, and an open->addressed->verified
  lifecycle (waived reserved); new tasks.pm_notes + PmReviewContent give
  request_changes a structured home
- producers: fail_review/pr_fail/request_changes take findings=[...] (prose
  issues shimmed+merged for one release, deprecation-logged); ceo_reject
  validates its reason (no 500), lands an origin=ceo finding, and bumps
  round+audit on branchless coordination roots; guardrails at the verb
  chokepoint (nudge >5, hard reject >10, field caps, traversal-safe file);
  the dev_notes data-loss appends are removed; new task.request_changes +
  task.ceo_reject audit events close rework attribution
- delivery: qa_notes/pr_reviewer_notes/pm_notes carry the deterministic
  [F-id8] rendering; claim briefings, evidence(), the REVISION_REQUIRED
  spawn prompt, PM triage bounced-blocks, and A2A bodies deliver open
  findings; round-N+1 QA and gate reviewers get the full prior ledger;
  panel Findings tab + bounced-xN chip; metrics pm_rejects/ceo_rejects +
  findings counts; vault task notes render a Findings section (fail-open)
- resolution closes for every origin: i_am_done and submit_up/submit_root
  take resolved_findings gated by FINDINGS_ADDRESSED (owner-gated so a
  stale non-owner PM can never mutate the ledger); pass_review/pr_pass/
  complete verify-stamp same-transaction; ceo_approve stamps best-effort
- 24 real-DB integration tests drive the full loop through the real
  choreographer; full suite 12856 green

* docs: revision findings ledger sweep — CLAUDE.md, map, RAG corpus

- CLAUDE.md: new ledger section + corrected request_changes row
- docs/map/review-findings.md (new subsystem map) + surgical updates to
  task-service/pr-gate-review/metrics-observability/vault/panel maps
- docs/rag: producers' findings contract across qa/pr-reviewer/developer/
  cell-pm/main-pm/ceo role docs (the PM docs were missing request_changes
  entirely), verb references, and a new architecture/review-findings.md
  disambiguating ledger findings from convention findings

* test(e2e): resubmit resolves the pr_fail finding per the ledger contract

The scripted pr_fail revision loop resubmitted submit_up without
resolved_findings — correctly rejected now that FINDINGS_ADDRESSED gates
the PM resubmit verbs (green locally, red only in CI since the e2e suite
skips without ROBOCO_E2E_SMOKE=1). The scripted PM now reads the open
ledger row pr_fail persisted (new open_finding_ids arc helper) and
resolves it on resubmit, asserting the open set drains — exercising the
coordinator half of the new contract end to end.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

alembic/versions/071_review_findings.py

@@ -0,0 +1,81 @@
+"""Add task_review_findings (the revision-findings ledger) + tasks.pm_notes.
+
+Persists every qa_fail / pr_fail / request_changes / ceo_reject finding across
+every revision round as an append-only ledger — unlike notes_structured (one
+snapshot per content type, overwritten in place), a row here is never deleted,
+only advanced through open -> addressed -> verified (or waived). tasks.pm_notes
+is the new PM merge-review-reject note slot (mirrors pr_reviewer_notes),
+finally giving request_changes a structured home instead of a raw dev_notes
+append. Pure additive schema change; no backfill.
+
+Revision ID: 071_review_findings
+Revises: 070_vault_seen_notes
+Create Date: 2026-07-11
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "071_review_findings"
+down_revision = "070_vault_seen_notes"
+branch_labels: dict[str, str] | None = None
+depends_on: dict[str, str] | None = None
+
+
+def upgrade() -> None:
+    op.add_column("tasks", sa.Column("pm_notes", sa.Text(), nullable=True))
+
+    op.create_table(
+        "task_review_findings",
+        sa.Column("id", sa.UUID(as_uuid=True), nullable=False),
+        sa.Column("task_id", sa.UUID(as_uuid=True), nullable=False),
+        sa.Column("origin", sa.String(length=20), nullable=False),
+        sa.Column("round", sa.Integer(), nullable=False),
+        sa.Column("author_slug", sa.String(length=64), nullable=True),
+        sa.Column("file", sa.String(length=300), nullable=True),
+        sa.Column("line", sa.Integer(), nullable=True),
+        sa.Column("severity", sa.String(length=20), nullable=False),
+        sa.Column("criterion", sa.String(length=500), nullable=True),
+        sa.Column("expected", sa.String(length=300), nullable=False),
+        sa.Column("actual", sa.String(length=300), nullable=False),
+        sa.Column("fix", sa.String(length=500), nullable=True),
+        sa.Column("evidence", sa.String(length=2000), nullable=True),
+        sa.Column(
+            "status",
+            sa.String(length=20),
+            nullable=False,
+            server_default="open",
+        ),
+        sa.Column("addressed_by_commit", sa.String(length=100), nullable=True),
+        sa.Column("resolution_note", sa.String(length=300), nullable=True),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            nullable=False,
+            server_default=sa.text("now()"),
+        ),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=True),
+        sa.ForeignKeyConstraint(["task_id"], ["tasks.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(
+        "ix_task_review_findings_task_id",
+        "task_review_findings",
+        ["task_id"],
+    )
+    op.create_index(
+        "ix_task_review_findings_task_status",
+        "task_review_findings",
+        ["task_id", "status"],
+    )
+
+
+def downgrade() -> None:
+    op.drop_index(
+        "ix_task_review_findings_task_status", table_name="task_review_findings"
+    )
+    op.drop_index("ix_task_review_findings_task_id", table_name="task_review_findings")
+    op.drop_table("task_review_findings")
+    op.drop_column("tasks", "pm_notes")