feat(lifecycle): revision findings ledger — structured failure feedback, persisted and delivered down the chain (#486)

* feat(lifecycle): revision findings ledger — structured QA/PR/PM/CEO failure feedback, persisted and delivered down the chain

Every bounce used to survive only as flattened prose: rounds overwrote each
other in notes_structured, request_changes persisted nothing, two raw
dev_notes appends were silently destroyed by the next handoff note, and the
dev prompt pointed at fields (qa_notes via evidence(), pm_notes) the API
never delivered. Agents re-interpreted and re-discovered every failure
before they could start fixing it.

- task_review_findings (migration 071, append-only): file/line/severity/
  criterion(AC-id-validated)/expected/actual/fix/evidence per finding, with
  origin (qa|pr_gate|pm|ceo), round, and an open->addressed->verified
  lifecycle (waived reserved); new tasks.pm_notes + PmReviewContent give
  request_changes a structured home
- producers: fail_review/pr_fail/request_changes take findings=[...] (prose
  issues shimmed+merged for one release, deprecation-logged); ceo_reject
  validates its reason (no 500), lands an origin=ceo finding, and bumps
  round+audit on branchless coordination roots; guardrails at the verb
  chokepoint (nudge >5, hard reject >10, field caps, traversal-safe file);
  the dev_notes data-loss appends are removed; new task.request_changes +
  task.ceo_reject audit events close rework attribution
- delivery: qa_notes/pr_reviewer_notes/pm_notes carry the deterministic
  [F-id8] rendering; claim briefings, evidence(), the REVISION_REQUIRED
  spawn prompt, PM triage bounced-blocks, and A2A bodies deliver open
  findings; round-N+1 QA and gate reviewers get the full prior ledger;
  panel Findings tab + bounced-xN chip; metrics pm_rejects/ceo_rejects +
  findings counts; vault task notes render a Findings section (fail-open)
- resolution closes for every origin: i_am_done and submit_up/submit_root
  take resolved_findings gated by FINDINGS_ADDRESSED (owner-gated so a
  stale non-owner PM can never mutate the ledger); pass_review/pr_pass/
  complete verify-stamp same-transaction; ceo_approve stamps best-effort
- 24 real-DB integration tests drive the full loop through the real
  choreographer; full suite 12856 green

* docs: revision findings ledger sweep — CLAUDE.md, map, RAG corpus

- CLAUDE.md: new ledger section + corrected request_changes row
- docs/map/review-findings.md (new subsystem map) + surgical updates to
  task-service/pr-gate-review/metrics-observability/vault/panel maps
- docs/rag: producers' findings contract across qa/pr-reviewer/developer/
  cell-pm/main-pm/ceo role docs (the PM docs were missing request_changes
  entirely), verb references, and a new architecture/review-findings.md
  disambiguating ledger findings from convention findings

* test(e2e): resubmit resolves the pr_fail finding per the ledger contract

The scripted pr_fail revision loop resubmitted submit_up without
resolved_findings — correctly rejected now that FINDINGS_ADDRESSED gates
the PM resubmit verbs (green locally, red only in CI since the e2e suite
skips without ROBOCO_E2E_SMOKE=1). The scripted PM now reads the open
ledger row pr_fail persisted (new open_finding_ids arc helper) and
resolves it on resubmit, asserting the open set drains — exercising the
coordinator half of the new contract end to end.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

panel/src/lib/api/tasks.ts

@@ -34,6 +34,47 @@ export interface BoardReviewEntry {
   timestamp: string | null;
 }
 
+// One row of the revision-findings ledger. Matches the backend
+// TaskFindingResponse schema (roboco/api/schemas/tasks.py).
+export interface TaskFinding {
+  id: string;
+  task_id: string;
+  origin: "qa" | "pr_gate" | "pm" | "ceo";
+  round: number;
+  author_slug: string | null;
+  file: string | null;
+  line: number | null;
+  severity: "blocker" | "major" | "minor" | "nit";
+  criterion: string | null;
+  expected: string;
+  actual: string;
+  fix: string | null;
+  evidence: string | null;
+  status: "open" | "addressed" | "verified" | "waived";
+  addressed_by_commit: string | null;
+  resolution_note: string | null;
+  created_at: string;
+  updated_at: string | null;
+}
+
+// Per-origin status counts — matches TaskFindingsSummaryRow.
+export interface TaskFindingsSummaryRow {
+  origin: string;
+  open: number;
+  addressed: number;
+  verified: number;
+  waived: number;
+}
+
+export interface TaskFindingsResponse {
+  findings: TaskFinding[];
+  summary: TaskFindingsSummaryRow[];
+  // Whole-ledger aggregates: the findings list is capped server-side, and
+  // truncated flags when it holds fewer rows than total.
+  total: number;
+  truncated: boolean;
+}
+
 // Wire shape of GET /tasks/summary (backend TaskSummaryResponse) — exactly
 // the fields list views render; everything fat stays on GET /tasks/{id}.
 interface TaskSummaryWire {
@@ -160,6 +201,18 @@ export const tasksApi = {
     return data;
   },
 
+  // The revision-findings ledger (qa_fail/pr_fail/request_changes/ceo_reject),
+  // newest round first, plus per-origin status counts. Empty for a task
+  // never bounced.
+  getFindings: async (taskId: string): Promise<TaskFindingsResponse> => {
+    if (isMockMode())
+      return { findings: [], summary: [], total: 0, truncated: false };
+    const { data } = await api.get<TaskFindingsResponse>(
+      "/tasks/" + taskId + "/findings",
+    );
+    return data;
+  },
+
   // Create task
   create: async (task: TaskCreate): Promise<Task> => {
     if (isMockMode()) {