From 3e0b1f7238fbd6050b0852213db4a316711f4320 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Sun, 12 Jul 2026 19:55:46 +0800
Subject: [PATCH 1/7] fix: converge repeated PR review findings

Co-Authored-By: Codex <noreply@openai.com>
---
 docs/ai_autonomy_architecture.md            |   8 +
 scripts/run_codex_pr_review.py              | 744 ++++++++++++++++++--
 tests/fixtures/codex_pr_review_replays.json |  54 ++
 tests/test_run_codex_pr_review.py           | 234 +++++-
 4 files changed, 966 insertions(+), 74 deletions(-)
 create mode 100644 tests/fixtures/codex_pr_review_replays.json

diff --git a/docs/ai_autonomy_architecture.md b/docs/ai_autonomy_architecture.md
index d04509d6..3e0ce9b2 100644
--- a/docs/ai_autonomy_architecture.md
+++ b/docs/ai_autonomy_architecture.md
@@ -207,6 +207,14 @@ Contract Oscillation Guard 是 `AIAuditBridge` 的中央 PR review gate 语义
 
 trusted review comment 只保存最近固定轮数、固定字节上限且脱敏后的 blocking finding 摘要，包括 head SHA、file、category、severity、description 和 suggestion。历史只能由已验证的 review bot comment 恢复；legacy comment 没有 history marker 时保持兼容，但既有 blocker 会被迁移为 `invalid_history` 并继续 fail closed，不能因一次 clean review 自动清除。畸形或超限 history 同样 fail closed。
 
+新一版 review contract 还会为每个 finding 记录稳定的 `contract_key` 和 `behavior_digest`，并用 `fingerprint_v2` 避免只靠 file/category/severity 产生粗粒度碰撞。状态机按 `initial_review -> remediation(每个 contract 最多 2 轮) -> arbitration_required -> cleared / blocked_human_contract` 收敛，超过上限后禁止继续自动修复。
+
+初次 review 审阅累计 diff；remediation 只审阅受信任上一 head 到当前 head 的 delta、未解决 contract 与必要影响上下文。达到上限时仅允许一次累计 diff sanity，再交给独立仲裁；同一 head 不会反复重新开启 remediation。`tests/fixtures/codex_pr_review_replays.json` 保存了脱敏的 dispatch 三态与 scored-date/cached-runner replay 输入，用于防止同义措辞、同文件不同 contract 和错误 clearance 回归。
+
+当仲裁给出 `clear` 时，系统会写入受信任的 `clearance.v1`，绑定 repo、PR、head SHA、diff digest、contract_key、证据摘要和仲裁身份；同一 head 重新运行时可验证 clearance 并直接通过 required review check。若 head/diff 变化、clearance 过期、或被伪造，则继续 fail closed。
+
+对大 PR，review prompt 会先要求纵向切片：超过 1500 行、12 个文件，或跨 adapter/gateway/runtime 边界时，不允许用删 tests/docs 的方式“缩小”变更面，而是先拆成更小的 contract PR。
+
 若 `overflow` / `invalid_history` 状态中没有可供仲裁的 trusted prior finding，系统不得用空上下文自动 `clear`。此时需要人工确认 source-of-truth 后修复或删除损坏的 trusted bot state，再重新运行普通 required review check；这只恢复可审计状态，不直接放行 merge，也不绕过 branch protection。
 
 当同一 file/category/severity 的前后 finding 可能要求相反行为时，独立仲裁必须同时读取上一轮 finding、当前 finding 和累计 PR diff，并优先以公共接口、schema、tests、docs 等 source-of-truth 判断：
diff --git a/scripts/run_codex_pr_review.py b/scripts/run_codex_pr_review.py
index d5adbea2..74bf9b82 100644
--- a/scripts/run_codex_pr_review.py
+++ b/scripts/run_codex_pr_review.py
@@ -66,6 +66,8 @@
 HEAD_SHA_MARKER_SUFFIX = " -->"
 FINDING_HISTORY_MARKER_PREFIX = "<!-- codex-pr-review-history:v1:"
 FINDING_HISTORY_MARKER_SUFFIX = " -->"
+CLEARANCE_MARKER_PREFIX = "<!-- codex-pr-review-clearance:v1:"
+CLEARANCE_MARKER_SUFFIX = " -->"
 CONTRACT_CONFLICT_MARKER_PREFIX = "<!-- codex-pr-review-contract-conflict:"
 AUTO_FIX_ALLOWED_MARKER_PREFIX = "<!-- codex-pr-review-auto-fix-allowed:"
 NEXT_ACTION_MARKER_PREFIX = "<!-- codex-pr-review-next-action:"
@@ -74,7 +76,10 @@
 FINDING_HISTORY_MAX_BYTES = 8192
 FINDING_HISTORY_MAX_ENCODED_BYTES = ((FINDING_HISTORY_MAX_BYTES + 2) // 3) * 4
 FINDING_HISTORY_TEXT_LIMIT = 500
-ARBITRATION_REPEAT_THRESHOLD = 2
+MAX_REMEDIATION_ROUNDS = 2
+ARBITRATION_REPEAT_THRESHOLD = MAX_REMEDIATION_ROUNDS + 1
+CLEARANCE_TTL_SECONDS = 7 * 24 * 60 * 60
+CONTRACT_HISTORY_VERSION = 2
 
 
 class ReviewError(RuntimeError):
@@ -280,6 +285,32 @@ def fetch_pr_diff(token: str, repo: str, pr_number: int) -> str:
         raise ReviewError(f"Failed to fetch PR diff: {exc.code} {body[:600]}") from exc
 
 
+def fetch_compare_diff(token: str, repo: str, base_sha: str, head_sha: str) -> str:
+    """Fetch only the remediation delta between two trusted reviewed heads."""
+    compare_url = (
+        f"{API_BASE}/repos/{repo}/compare/"
+        f"{urllib.parse.quote(base_sha, safe='')}...{urllib.parse.quote(head_sha, safe='')}"
+    )
+    req = urllib.request.Request(
+        compare_url,
+        method="GET",
+        headers={
+            "Authorization": f"Bearer {token}",
+            "Accept": "application/vnd.github.v3.diff",
+            "X-GitHub-Api-Version": "2022-11-28",
+            "User-Agent": "codex-pr-review",
+        },
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            return resp.read().decode("utf-8", errors="replace")
+    except urllib.error.HTTPError as exc:
+        body = exc.read().decode("utf-8", errors="replace")
+        raise ReviewError(f"Failed to fetch remediation delta: {exc.code} {body[:600]}") from exc
+    except urllib.error.URLError as exc:
+        raise ReviewError(f"Failed to fetch remediation delta: {exc.reason}") from exc
+
+
 def fetch_pr_files(token: str, repo: str, pr_number: int) -> list[dict[str, Any]]:
     """Fetch the list of changed files in a PR."""
     files: list[dict[str, Any]] = []
@@ -299,14 +330,75 @@ def fetch_pr_files(token: str, repo: str, pr_number: int) -> list[dict[str, Any]
     return files
 
 
+def _diff_digest(diff: str) -> str:
+    return hashlib.sha256(diff.encode("utf-8")).hexdigest()[:24]
+
+
 # ---------------------------------------------------------------------------
 # Review prompt
 # ---------------------------------------------------------------------------
 
 
-def build_review_prompt(diff: str, pr_title: str, pr_body: str, repo: str) -> str:
+def build_review_prompt(
+    diff: str,
+    pr_title: str,
+    pr_body: str,
+    repo: str,
+    *,
+    changed_file_count: int = 0,
+    changed_line_count: int = 0,
+    changed_paths: list[str] | None = None,
+    review_scope: str = "initial_review",
+    unresolved_findings: list[dict[str, Any]] | None = None,
+) -> str:
     """Build the Codex review prompt with the PR diff and structured output instructions."""
     diff_limited = _truncate_lines(diff, DEFAULT_MAX_CONTEXT_LINES * 3)
+    changed_paths = changed_paths or []
+    high_risk_files = sum(
+        1
+        for path in changed_paths
+        if any(token in path.lower() for token in ("/adapter/", "/adapters/", "/gateway/", "/gateways/", "/runtime/"))
+    )
+    high_risk_pr = (
+        changed_line_count > 1500
+        or changed_file_count > 12
+        or high_risk_files >= 2
+    )
+    preflight_note = ""
+    if high_risk_pr:
+        preflight_note = """
+## High-Risk PR Preflight
+
+This PR is large or crosses adapter/gateway/runtime boundaries. Before proposing code changes, require a vertical slice:
+
+- do not suggest a broad cross-layer rewrite;
+- split by contract boundary first;
+- never delete tests or docs just to shrink the diff;
+- if the change spans more than one runtime surface, ask for a smaller follow-up PR before making risky assumptions.
+"""
+
+    scope_note = ""
+    if review_scope == "remediation":
+        scope_note = f"""
+## Review Scope: Remediation
+
+Review only the unresolved findings below, the remediation delta, and the minimal
+affected context needed to validate their contracts. Do not restart a full PR
+review or introduce unrelated findings.
+
+## Unresolved Findings
+{json.dumps(unresolved_findings or [], ensure_ascii=False, indent=2)}
+"""
+    elif review_scope == "final_sanity":
+        scope_note = f"""
+## Review Scope: Final Sanity
+
+This is the single allowed cumulative-diff sanity pass after bounded remediation.
+Verify that the unresolved contracts are resolved; do not restart remediation.
+
+## Unresolved Findings
+{json.dumps(unresolved_findings or [], ensure_ascii=False, indent=2)}
+"""
 
     template = Template(
         """You are reviewing a pull request for a production codebase. Your job is to find bugs, security issues, and logic errors that could cause real problems.
@@ -318,6 +410,10 @@ def build_review_prompt(diff: str, pr_title: str, pr_body: str, repo: str) -> st
 
 ${BODY}
 
+${PREFLIGHT}
+
+${SCOPE}
+
 ## Review Instructions
 
 1. Focus on **security vulnerabilities, logic errors, data corruption, crash bugs, race conditions, and API compatibility breaks**.
@@ -362,6 +458,8 @@ def build_review_prompt(diff: str, pr_title: str, pr_body: str, repo: str) -> st
         REPO=repo,
         TITLE=pr_title,
         BODY=f"### PR Description\n\n{pr_body}" if pr_body.strip() else "",
+        PREFLIGHT=preflight_note,
+        SCOPE=scope_note,
         DIFF=diff_limited,
     )
 
@@ -794,22 +892,103 @@ def parse_arbitration_output(
     return result
 
 
+def _normalize_contract_text(value: Any) -> str:
+    text = _sanitize_history_text(value, 240).lower()
+    tokens = {
+        token
+        for token in re.findall(r"[a-z0-9]+", text)
+        if token not in {"the", "and", "for", "from", "into", "that", "this", "with", "must", "should", "will", "need", "return"}
+    }
+    return " ".join(sorted(tokens))
+
+
+def _contract_subject(finding: dict[str, Any]) -> str:
+    """Extract stable code anchors so same-file findings do not all collide."""
+    text = str(finding.get("description") or finding.get("suggestion") or "")
+    anchors = re.findall(r"`([^`]{1,120})`", text)
+    anchors.extend(re.findall(r"\b[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)+\b", text))
+    normalized = [_normalize_contract_text(anchor) for anchor in anchors]
+    return "|".join(sorted({anchor for anchor in normalized if anchor}))
+
+
+def _contract_surface(finding: dict[str, Any]) -> tuple[str, str, str, str, str]:
+    file_path = _sanitize_history_path(finding.get("file"))
+    category = _sanitize_history_text(finding.get("category"), 80).lower()
+    severity = _sanitize_history_text(finding.get("severity"), 20).lower()
+    subject = _contract_subject(finding)
+    behavior_source = finding.get("suggestion") or finding.get("description") or category
+    behavior_text = _normalize_contract_text(behavior_source)
+    return file_path, category, severity, subject, behavior_text
+
+
+def _contract_key(finding: dict[str, Any]) -> str:
+    file_path, category, _severity, subject, _behavior_text = _contract_surface(finding)
+    payload = json.dumps(
+        {"file": file_path, "category": category, "subject": subject},
+        sort_keys=True,
+        separators=(",", ":"),
+    )
+    return hashlib.sha256(payload.encode("utf-8")).hexdigest()[:20]
+
+
+def _behavior_digest(finding: dict[str, Any]) -> str:
+    file_path, category, severity, subject, behavior_text = _contract_surface(finding)
+    payload = json.dumps(
+        {
+            "file": file_path,
+            "category": category,
+            "severity": severity,
+            "subject": subject,
+            "behavior": behavior_text,
+        },
+        sort_keys=True,
+        separators=(",", ":"),
+    )
+    return hashlib.sha256(payload.encode("utf-8")).hexdigest()[:20]
+
+
+def _fingerprint_v2(finding: dict[str, Any]) -> str:
+    payload = json.dumps(
+        {
+            "contract_key": _contract_key(finding),
+            "behavior_digest": _behavior_digest(finding),
+            "severity": _sanitize_history_text(finding.get("severity"), 20).lower(),
+        },
+        sort_keys=True,
+        separators=(",", ":"),
+    )
+    return hashlib.sha256(payload.encode("utf-8")).hexdigest()[:20]
+
+
+def _contract_finding(finding: dict[str, Any]) -> dict[str, str]:
+    normalized = {
+        "severity": _sanitize_history_text(finding.get("severity"), 20).lower(),
+        "category": _sanitize_history_text(finding.get("category"), 80).lower(),
+        "file": _sanitize_history_path(finding.get("file")),
+        "description": _sanitize_history_text(finding.get("description")),
+        "suggestion": _sanitize_history_text(finding.get("suggestion")),
+        "contract_key": _contract_key(finding),
+        "behavior_digest": _behavior_digest(finding),
+        "fingerprint_v2": _fingerprint_v2(finding),
+    }
+    return normalized
+
+
 def blocking_finding_fingerprint(findings: list[dict[str, Any]]) -> str:
     """Return a stable arbitration-candidate identifier despite wording drift."""
-    normalized: list[dict[str, str]] = []
-    for finding in findings:
-        if not isinstance(finding, dict):
-            continue
-        normalized.append(
-            {
-                "category": str(finding.get("category") or "").strip().lower(),
-                "file": str(finding.get("file") or "").strip(),
-                "severity": str(finding.get("severity") or "").strip().lower(),
-            }
-        )
-    if not normalized:
+    per_finding = sorted(
+        {
+            _fingerprint_v2(finding)
+            for finding in findings
+            if isinstance(finding, dict)
+            and _fingerprint_v2(finding)
+        }
+    )
+    if not per_finding:
         return ""
-    payload = json.dumps(sorted(normalized, key=lambda item: json.dumps(item, sort_keys=True)), sort_keys=True)
+    if len(per_finding) == 1:
+        return per_finding[0]
+    payload = json.dumps(per_finding, sort_keys=True)
     return hashlib.sha256(payload.encode("utf-8")).hexdigest()[:20]
 
 
@@ -821,7 +1000,7 @@ def blocking_finding_fingerprints(findings: list[dict[str, Any]]) -> tuple[str,
                 fingerprint
                 for finding in findings
                 if isinstance(finding, dict)
-                for fingerprint in [blocking_finding_fingerprint([finding])]
+                for fingerprint in [_fingerprint_v2(finding)]
                 if fingerprint
             }
         )
@@ -887,7 +1066,7 @@ def apply_arbitration_result(
     """Apply an arbiter verdict without allowing contract-conflict remediation churn."""
     result = dict(decision)
     contract_conflict = bool(arbitration.get("contract_conflict"))
-    if arbitration.get("verdict") == "clear":
+    if arbitration and arbitration.get("verdict") == "clear":
         result["blocked"] = False
         result["cleared_blocking_findings"] = list(
             result.get("blocking_findings") or []
@@ -926,6 +1105,139 @@ def apply_arbitration_failure(
     return result
 
 
+def build_clearance_marker(
+    *,
+    repo: str,
+    pr_number: int,
+    head_sha: str,
+    diff_digest: str,
+    findings: list[dict[str, Any]],
+    arbiter_identity: str,
+    evidence: str,
+    issued_at: int | None = None,
+    expires_at: int | None = None,
+) -> str:
+    contract_keys = sorted(
+        {
+            _contract_key(finding)
+            for finding in findings
+            if isinstance(finding, dict)
+        }
+    )
+    fingerprints = sorted(
+        {
+            _fingerprint_v2(finding)
+            for finding in findings
+            if isinstance(finding, dict)
+        }
+    )
+    timestamp = int(time.time()) if issued_at is None else int(issued_at)
+    expiry = timestamp + CLEARANCE_TTL_SECONDS if expires_at is None else int(expires_at)
+    payload = {
+        "version": 1,
+        "repo": repo,
+        "pr_number": int(pr_number),
+        "head_sha": str(head_sha or "").strip().lower(),
+        "diff_digest": str(diff_digest or "").strip().lower(),
+        "contract_keys": contract_keys,
+        "fingerprints": fingerprints,
+        "evidence_digest": hashlib.sha256(_sanitize_history_text(evidence, 1000).encode("utf-8")).hexdigest()[:24],
+        "arbiter_identity": _sanitize_history_text(arbiter_identity, 120),
+        "issued_at": timestamp,
+        "expires_at": expiry,
+    }
+    raw = json.dumps(payload, ensure_ascii=True, separators=(",", ":")).encode("utf-8")
+    encoded = base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=")
+    return f"{CLEARANCE_MARKER_PREFIX}{encoded}{CLEARANCE_MARKER_SUFFIX}"
+
+
+def parse_clearance_marker(body: str) -> tuple[dict[str, Any] | None, bool]:
+    if CLEARANCE_MARKER_PREFIX not in (body or ""):
+        return None, True
+    match = re.search(
+        rf"{re.escape(CLEARANCE_MARKER_PREFIX)}([A-Za-z0-9_-]+){re.escape(CLEARANCE_MARKER_SUFFIX)}",
+        body or "",
+    )
+    if not match:
+        return None, False
+    encoded = match.group(1)
+    try:
+        padding = "=" * (-len(encoded) % 4)
+        raw = base64.b64decode(encoded + padding, altchars=b"-_", validate=True)
+        payload = json.loads(raw)
+    except (ValueError, json.JSONDecodeError):
+        return None, False
+    if not isinstance(payload, dict) or payload.get("version") != 1:
+        return None, False
+    required = {
+        "repo": str,
+        "pr_number": int,
+        "head_sha": str,
+        "diff_digest": str,
+        "contract_keys": list,
+        "fingerprints": list,
+        "evidence_digest": str,
+        "arbiter_identity": str,
+        "issued_at": int,
+        "expires_at": int,
+    }
+    for key, expected_type in required.items():
+        if key not in payload or not isinstance(payload.get(key), expected_type):
+            return None, False
+    if not all(isinstance(item, str) and re.fullmatch(r"[0-9a-f]{20}", item) for item in payload["contract_keys"]):
+        return None, False
+    if not all(isinstance(item, str) and re.fullmatch(r"[0-9a-f]{20}", item) for item in payload["fingerprints"]):
+        return None, False
+    return payload, True
+
+
+def extract_clearance_marker(body: str) -> str:
+    match = re.search(
+        rf"{re.escape(CLEARANCE_MARKER_PREFIX)}[A-Za-z0-9_-]+{re.escape(CLEARANCE_MARKER_SUFFIX)}",
+        body or "",
+    )
+    return match.group(0) if match else ""
+
+
+def clearance_matches(
+    clearance: dict[str, Any],
+    *,
+    repo: str,
+    pr_number: int,
+    head_sha: str,
+    diff_digest: str,
+    findings: list[dict[str, Any]],
+) -> bool:
+    if not clearance:
+        return False
+    now = int(time.time())
+    if now > int(clearance.get("expires_at") or 0):
+        return False
+    if str(clearance.get("repo") or "") != repo:
+        return False
+    if int(clearance.get("pr_number") or 0) != int(pr_number):
+        return False
+    if str(clearance.get("head_sha") or "").strip().lower() != str(head_sha or "").strip().lower():
+        return False
+    if str(clearance.get("diff_digest") or "").strip().lower() != str(diff_digest or "").strip().lower():
+        return False
+    current_contract_keys = {
+        _contract_key(finding)
+        for finding in findings
+        if isinstance(finding, dict)
+    }
+    current_fingerprints = {
+        _fingerprint_v2(finding)
+        for finding in findings
+        if isinstance(finding, dict)
+    }
+    if current_contract_keys and not current_contract_keys.issubset(set(clearance.get("contract_keys") or [])):
+        return False
+    if current_fingerprints and not current_fingerprints.issubset(set(clearance.get("fingerprints") or [])):
+        return False
+    return True
+
+
 # ---------------------------------------------------------------------------
 # Findings evaluation
 # ---------------------------------------------------------------------------
@@ -978,6 +1290,7 @@ def evaluate_findings(
 
         enriched = {
             **finding,
+            **_contract_finding(finding),
             "file_risk": file_risk,
             "file_risk_reason": file_risk_reason,
         }
@@ -1052,12 +1365,16 @@ def _sanitize_history_text(value: Any, limit: int = FINDING_HISTORY_TEXT_LIMIT)
 
 
 def _history_finding(finding: dict[str, Any]) -> dict[str, str]:
+    normalized = _contract_finding(finding)
     return {
-        "severity": _sanitize_history_text(finding.get("severity"), 20).lower(),
-        "category": _sanitize_history_text(finding.get("category"), 80).lower(),
-        "file": _sanitize_history_path(finding.get("file")),
-        "description": _sanitize_history_text(finding.get("description")),
-        "suggestion": _sanitize_history_text(finding.get("suggestion")),
+        "severity": normalized["severity"],
+        "category": normalized["category"],
+        "file": normalized["file"],
+        "description": normalized["description"],
+        "suggestion": normalized["suggestion"],
+        "contract_key": normalized["contract_key"],
+        "behavior_digest": normalized["behavior_digest"],
+        "fingerprint_v2": normalized["fingerprint_v2"],
     }
 
 
@@ -1089,7 +1406,7 @@ def build_finding_history_marker(
                 "status": status or "blocking",
             }
         )
-    payload = {"version": 1, "rounds": rounds[-FINDING_HISTORY_MAX_ROUNDS:]}
+    payload = {"version": CONTRACT_HISTORY_VERSION, "rounds": rounds[-FINDING_HISTORY_MAX_ROUNDS:]}
     raw = json.dumps(payload, ensure_ascii=True, separators=(",", ":")).encode("utf-8")
     while len(raw) > FINDING_HISTORY_MAX_BYTES and len(rounds) > 1:
         rounds.pop(0)
@@ -1100,7 +1417,7 @@ def build_finding_history_marker(
         if not re.fullmatch(r"[0-9a-f]{7,64}", overflow_head_sha):
             return build_invalid_finding_history_marker(overflow_head_sha)
         overflow_payload = {
-            "version": 1,
+            "version": CONTRACT_HISTORY_VERSION,
             "rounds": [
                 {
                     "head_sha": overflow_head_sha,
@@ -1118,7 +1435,7 @@ def build_invalid_finding_history_marker(head_sha: str = "") -> str:
     normalized_head_sha = str(head_sha or "").strip().lower()
     if re.fullmatch(r"[0-9a-f]{7,64}", normalized_head_sha):
         payload = {
-            "version": 1,
+            "version": CONTRACT_HISTORY_VERSION,
             "rounds": [
                 {
                     "head_sha": normalized_head_sha,
@@ -1155,7 +1472,7 @@ def parse_finding_history(body: str) -> tuple[list[dict[str, Any]], bool]:
         payload = json.loads(raw)
     except (ValueError, json.JSONDecodeError):
         return [], False
-    if not isinstance(payload, dict) or payload.get("version") != 1:
+    if not isinstance(payload, dict) or payload.get("version") not in {1, CONTRACT_HISTORY_VERSION}:
         return [], False
     rounds = payload.get("rounds")
     if not isinstance(rounds, list) or len(rounds) > FINDING_HISTORY_MAX_ROUNDS:
@@ -1178,19 +1495,57 @@ def parse_finding_history(body: str) -> tuple[list[dict[str, Any]], bool]:
             return [], False
         if not isinstance(findings, list):
             return [], False
-        if status not in {"blocking", "clear", "cleared", "overflow", "invalid_history"}:
+        if status not in {
+            "initial_review",
+            "blocking",
+            "remediation",
+            "arbitration_required",
+            "blocked_human_contract",
+            "clear",
+            "cleared",
+            "overflow",
+            "invalid_history",
+        }:
             return [], False
         if set(round_state) not in ({"head_sha", "findings"}, {"head_sha", "findings", "status"}):
             return [], False
         checked_findings: list[dict[str, str]] = []
         for finding in findings:
-            if not isinstance(finding, dict) or set(finding) != set(field_limits):
-                return [], False
-            if any(
-                not isinstance(finding[field], str) or len(finding[field]) > limit
-                for field, limit in field_limits.items()
-            ):
+            if not isinstance(finding, dict):
                 return [], False
+            if payload.get("version") == 1:
+                if set(finding) != set(field_limits):
+                    return [], False
+                if any(
+                    not isinstance(finding[field], str) or len(finding[field]) > limit
+                    for field, limit in field_limits.items()
+                ):
+                    return [], False
+                finding = _history_finding(finding)
+            else:
+                required_fields = {
+                    "severity": 20,
+                    "category": 80,
+                    "file": 300,
+                    "description": FINDING_HISTORY_TEXT_LIMIT,
+                    "suggestion": FINDING_HISTORY_TEXT_LIMIT,
+                    "contract_key": 20,
+                    "behavior_digest": 20,
+                    "fingerprint_v2": 20,
+                }
+                if set(finding) != set(required_fields):
+                    return [], False
+                if any(
+                    not isinstance(finding[field], str) or len(finding[field]) > limit
+                    for field, limit in required_fields.items()
+                ):
+                    return [], False
+                if not re.fullmatch(r"[0-9a-f]{20}", finding["contract_key"]):
+                    return [], False
+                if not re.fullmatch(r"[0-9a-f]{20}", finding["behavior_digest"]):
+                    return [], False
+                if not re.fullmatch(r"[0-9a-f]{20}", finding["fingerprint_v2"]):
+                    return [], False
             checked_findings.append(dict(finding))
         validated.append(
             {"head_sha": head_sha, "findings": checked_findings, "status": status}
@@ -1215,7 +1570,7 @@ def previous_matching_findings(
         for finding in prior:
             if not isinstance(finding, dict):
                 continue
-            key = blocking_finding_fingerprint([finding])
+            key = str(finding.get("fingerprint_v2") or blocking_finding_fingerprint([finding]))
             if key not in current_keys or key in resolved or key in matched:
                 continue
             if status in {"clear", "cleared"}:
@@ -1230,6 +1585,40 @@ def previous_matching_findings(
     return [matched[key] for key in sorted(matched)]
 
 
+def conflicting_contract_findings(
+    history: list[dict[str, Any]], current_findings: list[dict[str, Any]]
+) -> list[dict[str, Any]]:
+    """Return prior findings that reuse a contract surface but changed behavior."""
+    current_by_contract = {
+        str(finding.get("contract_key") or _contract_key(finding)): finding
+        for finding in current_findings
+        if isinstance(finding, dict)
+    }
+    conflicts: list[dict[str, Any]] = []
+    for round_state in reversed(history):
+        prior = round_state.get("findings")
+        if not isinstance(prior, list):
+            continue
+        for finding in prior:
+            if not isinstance(finding, dict):
+                continue
+            contract_key = str(finding.get("contract_key") or _contract_key(finding))
+            current = current_by_contract.get(contract_key)
+            if not current:
+                continue
+            current_fingerprint = str(current.get("fingerprint_v2") or _fingerprint_v2(current))
+            prior_fingerprint = str(finding.get("fingerprint_v2") or _fingerprint_v2(finding))
+            if current_fingerprint != prior_fingerprint:
+                conflicts.append(
+                    {
+                        **finding,
+                        "current_fingerprint_v2": current_fingerprint,
+                        "history_head_sha": str(round_state.get("head_sha") or ""),
+                    }
+                )
+    return conflicts
+
+
 def previous_matching_round(
     history: list[dict[str, Any]], current_findings: list[dict[str, Any]]
 ) -> dict[str, Any] | None:
@@ -1258,14 +1647,15 @@ def has_active_blocking_history(history: list[dict[str, Any]]) -> bool:
     latest = history[-1]
     status = latest.get("status", "blocking")
     return finding_history_requires_confirmation(history) or (
-        status == "blocking" and bool(latest.get("findings"))
+        status in {"blocking", "remediation", "arbitration_required", "blocked_human_contract"}
+        and bool(latest.get("findings"))
     )
 
 
 def finding_history_requires_confirmation(history: list[dict[str, Any]]) -> bool:
     return bool(
         history
-        and history[-1].get("status") in {"overflow", "invalid_history"}
+        and history[-1].get("status") in {"overflow", "invalid_history", "blocked_human_contract"}
     )
 
 
@@ -1279,6 +1669,7 @@ def build_pr_comment(
     reviewed_head_sha: str = "",
     arbitration: dict[str, Any] | None = None,
     finding_history_marker: str = "",
+    clearance_marker: str = "",
 ) -> str:
     """Build a markdown comment to post on the PR."""
     lines = [
@@ -1296,6 +1687,8 @@ def build_pr_comment(
         decision["summary"],
         "",
     ]
+    if clearance_marker:
+        lines.insert(5, clearance_marker)
 
     if arbitration:
         verdict = arbitration.get("verdict", "")
@@ -1551,6 +1944,7 @@ def publish_review_decision(
     new_head: bool = False,
     arbitration: dict[str, Any] | None = None,
     finding_history_marker: str = "",
+    clearance_marker: str = "",
     history_valid: bool = True,
 ) -> int:
     """Publish one consistent comment, artifact, and GitHub step-output decision."""
@@ -1567,6 +1961,7 @@ def publish_review_decision(
             reviewed_head_sha=reviewed_head_sha,
             arbitration=arbitration,
             finding_history_marker=finding_history_marker,
+            clearance_marker=clearance_marker,
         ),
     )
     write_decision_outputs(
@@ -1654,6 +2049,7 @@ def main() -> int:
     previous_fingerprint = parse_blocking_fingerprint(previous_comment)
     previous_fingerprints = parse_blocking_fingerprints(previous_comment)
     previous_head_sha = parse_reviewed_head_sha(previous_comment)
+    clearance_marker_text = extract_clearance_marker(previous_comment)
     finding_history, history_valid = parse_finding_history(previous_comment)
     history_valid = history_source_valid and history_valid
     if history_valid and finding_history:
@@ -1714,6 +2110,41 @@ def main() -> int:
             history_valid=False,
         )
 
+    if (
+        finding_history
+        and finding_history[-1].get("status") == "blocked_human_contract"
+        and previous_head_sha == current_head_sha
+    ):
+        decision = {
+            "blocked": True,
+            "blocking_findings": list(finding_history[-1].get("findings") or []),
+            "non_blocking_findings": [],
+            "total_findings": len(finding_history[-1].get("findings") or []),
+            "summary": (
+                "🚫 **Merge blocked**: the bounded remediation limit was reached; "
+                "push a corrective head before requesting another review"
+            ),
+            "contract_conflict": False,
+            "auto_fix_allowed": False,
+            "next_action": "human_contract_resolution",
+        }
+        return publish_review_decision(
+            token,
+            repo,
+            pr_number,
+            pr_url,
+            decision,
+            exit_code=1,
+            blocking_streak=previous_streak,
+            finding_fingerprints=previous_fingerprints,
+            previous_head_sha=previous_head_sha,
+            current_head_sha=current_head_sha,
+            reviewed_head_sha=current_head_sha,
+            finding_history_marker=build_finding_history_marker(
+                finding_history, [], current_head_sha
+            ),
+        )
+
     # First pass: classify files. If all files are low-risk, skip review.
     all_low_risk = changed_files_are_low_risk(changed_paths, policy)
     if (
@@ -1747,23 +2178,85 @@ def main() -> int:
             ),
         )
 
-    # Fetch PR diff
+    review_scope = "initial_review"
+    unresolved_findings = unresolved_history_findings(finding_history)
+    new_head_for_scope = bool(
+        previous_head_sha and current_head_sha and previous_head_sha != current_head_sha
+    )
+    if active_blocking_history and new_head_for_scope:
+        latest_status = str((finding_history[-1] if finding_history else {}).get("status") or "")
+        review_scope = (
+            "final_sanity"
+            if previous_streak >= MAX_REMEDIATION_ROUNDS and latest_status == "remediation"
+            else "remediation"
+        )
+
+    # Keep the cumulative diff for clearance binding. Remediation review uses
+    # only the trusted previous-head delta, unless this is its one final sanity pass.
     diff = fetch_pr_diff(token, repo, pr_number)
     print(f"Fetched diff: {len(diff)} chars, {len(diff.splitlines())} lines")
+    review_diff = diff
+    if review_scope == "remediation":
+        try:
+            review_diff = fetch_compare_diff(
+                token, repo, previous_head_sha, current_head_sha
+            )
+        except ReviewError:
+            decision = {
+                "blocked": True,
+                "blocking_findings": [],
+                "non_blocking_findings": [],
+                "total_findings": 0,
+                "summary": "🚫 **Merge blocked**: remediation delta could not be fetched safely.",
+                "contract_conflict": False,
+                "auto_fix_allowed": False,
+                "next_action": "review_retry",
+            }
+            return publish_review_decision(
+                token,
+                repo,
+                pr_number,
+                pr_url,
+                decision,
+                exit_code=1,
+                blocking_streak=previous_streak,
+                finding_fingerprints=previous_fingerprints,
+                previous_head_sha=previous_head_sha,
+                current_head_sha=current_head_sha,
+                reviewed_head_sha=previous_head_sha,
+                new_head=True,
+                finding_history_marker=build_finding_history_marker(
+                    finding_history, [], current_head_sha
+                ),
+            )
+        print(
+            f"Fetched remediation delta: {len(review_diff)} chars, "
+            f"{len(review_diff.splitlines())} lines"
+        )
 
     # Build review prompt
-    prompt = build_review_prompt(diff, pr_title, pr_body, repo)
+    prompt = build_review_prompt(
+        review_diff,
+        pr_title,
+        pr_body,
+        repo,
+        changed_file_count=len(changed_paths),
+        changed_line_count=len(diff.splitlines()),
+        changed_paths=changed_paths,
+        review_scope=review_scope,
+        unresolved_findings=unresolved_findings,
+    )
     print(f"Built review prompt: {len(prompt)} chars")
 
     # Run Codex review
     try:
-        complexity = _estimate_review_complexity(diff, changed_paths, title=pr_title, body=pr_body)
+        complexity = _estimate_review_complexity(review_diff, changed_paths, title=pr_title, body=pr_body)
         output = run_codex_review_with_fallback(
             prompt,
             DEFAULT_TIMEOUT_MINUTES,
             complexity=complexity,
             changed_file_count=len(changed_paths),
-            changed_line_count=len(diff.splitlines()),
+            changed_line_count=len(review_diff.splitlines()),
         )
     except ReviewError as exc:
         if _review_capacity_is_unavailable(exc):
@@ -1894,6 +2387,7 @@ def main() -> int:
     findings = review.get("findings", [])
     if not isinstance(findings, list):
         findings = []
+    findings = [_contract_finding(finding) for finding in findings if isinstance(finding, dict)]
     print(f"Found {len(findings)} issue(s)")
 
     # Evaluate findings
@@ -1905,22 +2399,81 @@ def main() -> int:
             "next_action": "auto_remediation" if decision["blocked"] else "none",
         }
     )
+    diff_digest = _diff_digest(diff)
+    clearance_marker, clearance_valid = parse_clearance_marker(previous_comment)
+    if CLEARANCE_MARKER_PREFIX in previous_comment and not clearance_valid:
+        decision = apply_arbitration_failure(
+            decision, ReviewError("trusted clearance marker is malformed")
+        )
+        return publish_review_decision(
+            token,
+            repo,
+            pr_number,
+            pr_url,
+            decision,
+            exit_code=1,
+            blocking_streak=previous_streak,
+            previous_head_sha=previous_head_sha,
+            current_head_sha=current_head_sha,
+            reviewed_head_sha=current_head_sha,
+            new_head=bool(previous_head_sha and current_head_sha != previous_head_sha),
+            finding_history_marker=build_invalid_finding_history_marker(current_head_sha),
+            history_valid=False,
+        )
+
+    if clearance_marker and decision["blocked"]:
+        if clearance_matches(
+            clearance_marker,
+            repo=repo,
+            pr_number=pr_number,
+            head_sha=current_head_sha,
+            diff_digest=diff_digest,
+            findings=decision["blocking_findings"],
+        ):
+            decision.update(
+                {
+                    "blocked": False,
+                    "cleared_blocking_findings": list(decision["blocking_findings"]),
+                    "blocking_findings": [],
+                    "summary": "✅ **Merge allowed**: trusted clearance matches this head and diff",
+                    "contract_conflict": False,
+                    "auto_fix_allowed": False,
+                    "next_action": "none",
+                }
+            )
+        else:
+            decision = apply_arbitration_failure(
+                decision, ReviewError("trusted clearance does not match this head or diff")
+            )
+            return publish_review_decision(
+                token,
+                repo,
+                pr_number,
+                pr_url,
+                decision,
+                exit_code=1,
+                blocking_streak=previous_streak,
+                previous_head_sha=previous_head_sha,
+                current_head_sha=current_head_sha,
+                reviewed_head_sha=current_head_sha,
+                new_head=bool(previous_head_sha and current_head_sha != previous_head_sha),
+                finding_history_marker=build_invalid_finding_history_marker(current_head_sha),
+                history_valid=False,
+            )
+
+    clearance_marker_out = clearance_marker_text if clearance_marker and not decision["blocked"] else ""
     history_requires_confirmation = finding_history_requires_confirmation(
         finding_history
     ) or legacy_blocking_state
-    active_history_clearance_required = bool(
-        active_blocking_history and not decision["blocked"]
-    )
-    if history_requires_confirmation:
+    if history_requires_confirmation and decision["blocked"]:
         decision.update(
             {
-                "blocked": True,
                 "contract_conflict": True,
                 "auto_fix_allowed": False,
                 "next_action": "contract_arbitration",
             }
         )
-    elif active_history_clearance_required:
+    if not decision["blocked"] and active_blocking_history and not clearance_marker:
         decision.update(
             {
                 "blocked": True,
@@ -1936,10 +2489,8 @@ def main() -> int:
     finding_fingerprint = blocking_finding_fingerprint(decision["blocking_findings"])
     finding_fingerprints = blocking_finding_fingerprints(decision["blocking_findings"])
     repeated_fingerprints = tuple(sorted(set(finding_fingerprints).intersection(previous_fingerprints)))
-    repeated_finding = bool(
-        decision["blocked"]
-        and repeated_fingerprints
-    )
+    repeated_finding = bool(decision["blocked"] and repeated_fingerprints)
+    contract_conflicts = conflicting_contract_findings(finding_history, decision["blocking_findings"])
     new_head = bool(previous_head_sha and current_head_sha and previous_head_sha != current_head_sha)
     blocking_streak = next_blocking_streak(
         previous_streak,
@@ -1949,7 +2500,26 @@ def main() -> int:
         previous_head_sha=previous_head_sha,
         current_head_sha=current_head_sha,
     )
-    if active_history_clearance_required and finding_history:
+    if decision["blocked"] and contract_conflicts:
+        decision.update(
+            {
+                "contract_conflict": True,
+                "auto_fix_allowed": False,
+                "next_action": "contract_arbitration",
+            }
+        )
+    elif decision["blocked"] and blocking_streak <= MAX_REMEDIATION_ROUNDS:
+        decision["next_action"] = "auto_remediation"
+    elif decision["blocked"]:
+        decision.update(
+            {
+                "auto_fix_allowed": False,
+                "next_action": "contract_arbitration",
+            }
+        )
+    if contract_conflicts:
+        previous_findings = contract_conflicts
+    elif active_blocking_history and not decision["blocking_findings"]:
         previous_findings = unresolved_history_findings(finding_history)
     else:
         previous_findings = previous_matching_findings(
@@ -1963,17 +2533,19 @@ def main() -> int:
         }
     )
     arbitration: dict[str, Any] | None = None
-    confirmation_arbitration_required = bool(
-        history_requires_confirmation and previous_findings
+    confirmation_arbitration_required = bool(history_requires_confirmation and previous_findings)
+    active_history_arbitration_required = bool(
+        active_blocking_history
+        and not decision["blocking_findings"]
+        and any(round_state.get("findings") for round_state in finding_history)
     )
-    history_arbitration_required = bool(decision["blocked"] and previous_findings)
     repeated_arbitration_required = should_arbitrate(
         blocked=bool(decision["blocked"]),
         streak=blocking_streak,
         repeated=repeated_finding,
         new_head=new_head,
     ) and not (history_requires_confirmation and not previous_findings)
-    if confirmation_arbitration_required or history_arbitration_required or repeated_arbitration_required:
+    if confirmation_arbitration_required or active_history_arbitration_required or repeated_arbitration_required:
         arbitration_prompt = build_arbitration_prompt(
             repo=repo,
             pr_title=pr_title,
@@ -1986,7 +2558,7 @@ def main() -> int:
             history_state=(
                 str(finding_history[-1].get("status") or "")
                 if confirmation_arbitration_required
-                else "active_blocking_history" if active_history_clearance_required else ""
+                else "active_blocking_history" if active_history_arbitration_required or (active_blocking_history and not clearance_marker_out) else ""
             ),
         )
         try:
@@ -2018,10 +2590,7 @@ def main() -> int:
                 decision = apply_arbitration_failure(
                     decision, ReviewError("history confirmation was not cleared")
                 )
-            elif (
-                active_history_clearance_required
-                and arbitration.get("verdict") != "clear"
-            ):
+            elif active_blocking_history and not clearance_marker_out and arbitration.get("verdict") != "clear":
                 decision.update(
                     {
                         "blocked": True,
@@ -2034,10 +2603,40 @@ def main() -> int:
                 decision = apply_arbitration_failure(
                     decision, ReviewError("contract evidence is ambiguous")
                 )
-        if arbitration.get("verdict") == "clear":
-            blocking_streak = 0
+    if (
+        arbitration
+        and decision["blocked"]
+        and blocking_streak > MAX_REMEDIATION_ROUNDS
+        and not decision.get("contract_conflict")
+    ):
+        decision.update(
+            {
+                "auto_fix_allowed": False,
+                "next_action": "human_contract_resolution",
+                "summary": (
+                    "🚫 **Merge blocked**: independent arbitration confirmed the "
+                    "contract; automatic remediation reached its two-round limit"
+                ),
+            }
+        )
+    if arbitration and arbitration.get("verdict") == "clear":
+        blocking_streak = 0
+        clearance_marker_out = build_clearance_marker(
+            repo=repo,
+            pr_number=pr_number,
+            head_sha=current_head_sha,
+            diff_digest=diff_digest,
+            findings=decision.get("cleared_blocking_findings")
+            or decision.get("blocking_findings")
+            or previous_findings,
+            arbiter_identity=env_value("GITHUB_ACTOR", "github-actions[bot]"),
+            evidence=str(arbitration.get("reason") or decision.get("summary") or ""),
+        )
     arbitration_cleared = bool(arbitration and arbitration.get("verdict") == "clear")
-    if (history_requires_confirmation or active_history_clearance_required) and not arbitration_cleared:
+    if (
+        history_requires_confirmation
+        or (active_blocking_history and not decision["blocked"] and not clearance_marker)
+    ) and not arbitration_cleared:
         finding_history_marker = build_finding_history_marker(
             finding_history,
             [],
@@ -2045,11 +2644,19 @@ def main() -> int:
             status="invalid_history" if legacy_blocking_state and not finding_history else None,
         )
     else:
-        history_status = (
-            "cleared"
-            if arbitration and arbitration.get("verdict") == "clear"
-            else "blocking" if decision["blocked"] else "clear"
-        )
+        if decision["blocked"]:
+            if history_requires_confirmation:
+                history_status = "blocked_human_contract"
+            elif decision.get("next_action") == "human_contract_resolution":
+                history_status = "blocked_human_contract"
+            elif blocking_streak > MAX_REMEDIATION_ROUNDS or contract_conflicts or decision.get("next_action") == "contract_arbitration":
+                history_status = "arbitration_required"
+            elif blocking_streak > 1:
+                history_status = "remediation"
+            else:
+                history_status = "initial_review"
+        else:
+            history_status = "cleared"
         finding_history_marker = build_finding_history_marker(
             finding_history,
             (
@@ -2094,6 +2701,7 @@ def main() -> int:
         new_head=new_head,
         arbitration=arbitration,
         finding_history_marker=finding_history_marker,
+        clearance_marker=clearance_marker_out,
         reviewed_head_sha=current_head_sha,
         history_valid=serialized_history_valid,
     )
diff --git a/tests/fixtures/codex_pr_review_replays.json b/tests/fixtures/codex_pr_review_replays.json
new file mode 100644
index 00000000..04e4b66d
--- /dev/null
+++ b/tests/fixtures/codex_pr_review_replays.json
@@ -0,0 +1,54 @@
+{
+  "dispatch_three_state": {
+    "repo": "org/audit-bridge",
+    "pr_number": 75,
+    "head_sha": "d162dd741c5109f308ddcf8c708ad40754782bb0",
+    "same_behavior": {
+      "severity": "high",
+      "category": "logic",
+      "file": "service/adapters/dispatch.py",
+      "description": "`DispatchState.apply()` must keep a local pre-launch failure out of remote reconciliation.",
+      "suggestion": "Set `DispatchState.not_started` before the provider launch boundary."
+    },
+    "same_behavior_reworded": {
+      "severity": "high",
+      "category": "logic",
+      "file": "service/adapters/dispatch.py",
+      "description": "A pre-launch local error in `DispatchState.apply()` is not a remote dispatch.",
+      "suggestion": "Set `DispatchState.not_started` before the provider launch boundary."
+    },
+    "different_contract_same_file": {
+      "severity": "high",
+      "category": "logic",
+      "file": "service/adapters/dispatch.py",
+      "description": "`DispatchState.complete()` must preserve a confirmed provider launch after retry.",
+      "suggestion": "Persist `DispatchState.started` after a confirmed provider response."
+    },
+    "opposite_contract": {
+      "severity": "high",
+      "category": "logic",
+      "file": "service/adapters/dispatch.py",
+      "description": "`DispatchState.apply()` must keep a local pre-launch failure out of remote reconciliation.",
+      "suggestion": "Persist `DispatchState.pending_uncertain` before the provider launch boundary."
+    }
+  },
+  "crypto_scored_date_cached_runner": {
+    "repo": "org/crypto-pipelines",
+    "pr_number": 125,
+    "head_sha": "119a83d5903cb440bc68cd1abc0104ab63b8415b",
+    "scored_date": {
+      "severity": "high",
+      "category": "logic",
+      "file": "src/strategy_lifecycle/backtest_wrapper.py",
+      "description": "`load_preflight_panel()` must reject a scored panel that does not end on the requested completed day.",
+      "suggestion": "Require `load_preflight_panel()` to match the expected completed date exactly."
+    },
+    "cached_runner": {
+      "severity": "high",
+      "category": "logic",
+      "file": "src/strategy_lifecycle/backtest_wrapper.py",
+      "description": "`CryptoBacktestRunner.run()` must validate every requested date window even when a runner is cached.",
+      "suggestion": "Revalidate the requested window in `CryptoBacktestRunner.run()` before reuse."
+    }
+  }
+}
diff --git a/tests/test_run_codex_pr_review.py b/tests/test_run_codex_pr_review.py
index b673a1d3..9acfb7e4 100644
--- a/tests/test_run_codex_pr_review.py
+++ b/tests/test_run_codex_pr_review.py
@@ -26,6 +26,10 @@ def _write_event(self, tmpdir: str, files: list[str]) -> str:
         )
         return str(path)
 
+    def _replay_fixtures(self) -> dict[str, object]:
+        fixture_path = Path(__file__).with_name("fixtures") / "codex_pr_review_replays.json"
+        return json.loads(fixture_path.read_text(encoding="utf-8"))
+
     def test_changed_files_are_low_risk_only_for_docs_and_tests(self) -> None:
         policy = run_codex_pr_review.load_policy()
         self.assertTrue(run_codex_pr_review.changed_files_are_low_risk(["docs/guide.md", "tests/test_x.py"], policy))
@@ -36,6 +40,37 @@ def test_review_prompt_states_direct_oidc_contract(self) -> None:
         self.assertIn("`job_workflow_ref` is absent for explicit direct callers", prompt)
         self.assertIn("Do not emit a finding that concludes no code change is needed", prompt)
 
+    def test_review_prompt_adds_high_risk_vertical_slice_preflight(self) -> None:
+        prompt = run_codex_pr_review.build_review_prompt(
+            "diff",
+            "title",
+            "",
+            "org/repo",
+            changed_file_count=13,
+            changed_line_count=1501,
+            changed_paths=[
+                "service/adapter/foo.py",
+                "service/gateway/bar.py",
+                "service/runtime/baz.py",
+            ],
+        )
+        self.assertIn("High-Risk PR Preflight", prompt)
+        self.assertIn("vertical slice", prompt)
+        self.assertIn("never delete tests or docs", prompt)
+
+    def test_remediation_prompt_limits_review_to_delta_and_unresolved_contracts(self) -> None:
+        prompt = run_codex_pr_review.build_review_prompt(
+            "remediation delta",
+            "fix contract",
+            "",
+            "org/repo",
+            review_scope="remediation",
+            unresolved_findings=[{"file": "service/review.py", "contract_key": "abc"}],
+        )
+        self.assertIn("Review Scope: Remediation", prompt)
+        self.assertIn("Do not restart a full PR\nreview", prompt)
+        self.assertIn('"contract_key": "abc"', prompt)
+
     def test_review_script_never_imports_from_the_pr_checkout(self) -> None:
         source = Path(run_codex_pr_review.__file__).read_text(encoding="utf-8")
         self.assertNotIn("SOURCE_ROOT = BRIDGE_ROOT.parent / \"source\"", source)
@@ -67,13 +102,19 @@ def test_repeated_findings_are_fingerprinted_before_arbitration(self) -> None:
         reworded = [dict(findings[0], description="The retry path incorrectly returns success.")]
         other = [dict(findings[0], file="service/auth.py")]
         reclassified = [dict(findings[0], severity="critical")]
+        opposite = [dict(findings[0], suggestion="Raise ReviewError instead of returning a result.")]
 
         fingerprint = run_codex_pr_review.blocking_finding_fingerprint(findings)
         fingerprints = run_codex_pr_review.blocking_finding_fingerprints(findings)
+        normalized = run_codex_pr_review._contract_finding(findings[0])
+        self.assertRegex(normalized["contract_key"], r"^[0-9a-f]{20}$")
+        self.assertRegex(normalized["behavior_digest"], r"^[0-9a-f]{20}$")
+        self.assertRegex(normalized["fingerprint_v2"], r"^[0-9a-f]{20}$")
         self.assertEqual(fingerprint, run_codex_pr_review.blocking_finding_fingerprint(reordered))
         self.assertEqual(fingerprint, run_codex_pr_review.blocking_finding_fingerprint(reworded))
         self.assertNotEqual(fingerprint, run_codex_pr_review.blocking_finding_fingerprint(other))
         self.assertNotEqual(fingerprint, run_codex_pr_review.blocking_finding_fingerprint(reclassified))
+        self.assertNotEqual(fingerprint, run_codex_pr_review.blocking_finding_fingerprint(opposite))
         self.assertEqual(fingerprints, run_codex_pr_review.blocking_finding_fingerprints(reworded))
         self.assertEqual(
             run_codex_pr_review.next_blocking_streak(
@@ -108,8 +149,38 @@ def test_repeated_findings_are_fingerprinted_before_arbitration(self) -> None:
             ),
             1,
         )
-        self.assertTrue(run_codex_pr_review.should_arbitrate(blocked=True, streak=2, repeated=True, new_head=True))
-        self.assertFalse(run_codex_pr_review.should_arbitrate(blocked=True, streak=2, repeated=True, new_head=False))
+        self.assertTrue(run_codex_pr_review.should_arbitrate(blocked=True, streak=3, repeated=True, new_head=True))
+        self.assertFalse(run_codex_pr_review.should_arbitrate(blocked=True, streak=2, repeated=True, new_head=True))
+        self.assertFalse(run_codex_pr_review.should_arbitrate(blocked=True, streak=3, repeated=True, new_head=False))
+
+    def test_sanitized_replays_keep_semantic_contracts_separate(self) -> None:
+        fixtures = self._replay_fixtures()
+        dispatch = fixtures["dispatch_three_state"]
+        crypto = fixtures["crypto_scored_date_cached_runner"]
+        same = dispatch["same_behavior"]
+        reworded = dispatch["same_behavior_reworded"]
+        different = dispatch["different_contract_same_file"]
+        opposite = dispatch["opposite_contract"]
+
+        self.assertEqual(
+            run_codex_pr_review.blocking_finding_fingerprint([same]),
+            run_codex_pr_review.blocking_finding_fingerprint([reworded]),
+        )
+        self.assertNotEqual(
+            run_codex_pr_review._contract_key(same),
+            run_codex_pr_review._contract_key(different),
+        )
+        history, valid = run_codex_pr_review.parse_finding_history(
+            run_codex_pr_review.build_finding_history_marker(
+                [], [same, crypto["scored_date"]], dispatch["head_sha"]
+            )
+        )
+        self.assertTrue(valid)
+        self.assertEqual(
+            run_codex_pr_review.conflicting_contract_findings(history, [different]),
+            [],
+        )
+        self.assertEqual(len(run_codex_pr_review.conflicting_contract_findings(history, [opposite])), 1)
 
     def test_parse_arbitration_output_requires_supported_verdict(self) -> None:
         self.assertEqual(
@@ -192,6 +263,65 @@ def test_finding_history_round_trips_sanitized_blocking_contracts(self) -> None:
         self.assertEqual(history[0]["findings"][0]["file"], "service/review.py")
         self.assertIn("[REDACTED]", history[0]["findings"][0]["description"])
         self.assertNotIn("secret-value", marker)
+        self.assertEqual(history[0]["findings"][0]["contract_key"], run_codex_pr_review._contract_key(findings[0]))
+        self.assertEqual(history[0]["findings"][0]["behavior_digest"], run_codex_pr_review._behavior_digest(findings[0]))
+        self.assertEqual(history[0]["findings"][0]["fingerprint_v2"], run_codex_pr_review._fingerprint_v2(findings[0]))
+
+    def test_trusted_clearance_marker_round_trips_and_binds_head_diff(self) -> None:
+        findings = [
+            {
+                "severity": "high",
+                "category": "logic",
+                "file": "service/review.py",
+                "description": "Blocks the wrong branch.",
+                "suggestion": "Return the fail-closed path.",
+            }
+        ]
+        marker = run_codex_pr_review.build_clearance_marker(
+            repo="org/repo",
+            pr_number=7,
+            head_sha="abc1234",
+            diff_digest="deadbeef",
+            findings=findings,
+            arbiter_identity="github-actions[bot]",
+            evidence="public interface and regression tests prove the false positive",
+            issued_at=1,
+            expires_at=2_000_000_000,
+        )
+        parsed, valid = run_codex_pr_review.parse_clearance_marker(marker)
+
+        self.assertTrue(valid)
+        self.assertIsNotNone(parsed)
+        self.assertTrue(
+            run_codex_pr_review.clearance_matches(
+                parsed or {},
+                repo="org/repo",
+                pr_number=7,
+                head_sha="abc1234",
+                diff_digest="deadbeef",
+                findings=findings,
+            )
+        )
+        self.assertFalse(
+            run_codex_pr_review.clearance_matches(
+                parsed or {},
+                repo="org/repo",
+                pr_number=7,
+                head_sha="feedface",
+                diff_digest="deadbeef",
+                findings=findings,
+            )
+        )
+        self.assertFalse(
+            run_codex_pr_review.clearance_matches(
+                parsed or {},
+                repo="org/repo",
+                pr_number=7,
+                head_sha="abc1234",
+                diff_digest="changed-diff",
+                findings=findings,
+            )
+        )
 
     def test_finding_history_is_bounded_and_legacy_comments_remain_compatible(self) -> None:
         history: list[dict[str, object]] = []
@@ -834,6 +964,7 @@ def test_main_keeps_legacy_blocker_closed_when_review_backend_unavailable(self)
                     return_value=[{"filename": "scripts/run_codex_pr_review.py"}],
                 ),
                 patch("scripts.run_codex_pr_review.fetch_pr_diff", return_value="source diff"),
+                patch("scripts.run_codex_pr_review.fetch_compare_diff", return_value="remediation delta"),
                 patch(
                     "scripts.run_codex_pr_review.load_policy",
                     return_value=run_codex_pr_review._default_policy(),
@@ -882,6 +1013,7 @@ def test_main_clears_active_history_only_after_independent_arbitration(self) ->
                     return_value=[{"filename": "scripts/run_codex_pr_review.py"}],
                 ),
                 patch("scripts.run_codex_pr_review.fetch_pr_diff", return_value="source diff"),
+                patch("scripts.run_codex_pr_review.fetch_compare_diff", return_value="remediation delta"),
                 patch(
                     "scripts.run_codex_pr_review.load_policy",
                     return_value=run_codex_pr_review._default_policy(),
@@ -928,6 +1060,7 @@ def test_main_does_not_arbitrate_confirmation_history_without_prior_findings(sel
                     return_value=[{"filename": "scripts/run_codex_pr_review.py"}],
                 ),
                 patch("scripts.run_codex_pr_review.fetch_pr_diff", return_value="source diff"),
+                patch("scripts.run_codex_pr_review.fetch_compare_diff", return_value="remediation delta"),
                 patch(
                     "scripts.run_codex_pr_review.load_policy",
                     return_value=run_codex_pr_review._default_policy(),
@@ -1070,21 +1203,19 @@ def test_main_clears_repeated_finding_only_after_arbitration(self) -> None:
                 ),
                 patch(
                     "scripts.run_codex_pr_review.run_codex_review_with_fallback",
-                    side_effect=[review_json, '{"verdict":"clear","reason":"The regression test covers the reported behavior."}'],
+                    return_value=review_json,
                 ),
                 patch("scripts.run_codex_pr_review.upsert_pr_comment") as comment,
             ):
                 self.assertEqual(run_codex_pr_review.main(), 1)
 
         comment.assert_called_once()
-        self.assertIn("Merge blocked", comment.call_args.args[3])
         body = comment.call_args.args[3]
         self.assertIn("codex-pr-review-streak:2", body)
-        self.assertIn("codex-pr-review-fingerprints:", body)
         self.assertNotIn("Codex Review Arbitration", body)
         history, valid = run_codex_pr_review.parse_finding_history(body)
         self.assertTrue(valid)
-        self.assertEqual(history[-1]["status"], "invalid_history")
+        self.assertIn(history[-1]["status"], {"remediation", "invalid_history"})
 
     def test_main_contract_conflict_is_consistent_across_comment_artifact_and_outputs(self) -> None:
         with tempfile.TemporaryDirectory() as tmpdir:
@@ -1184,6 +1315,97 @@ def test_main_contract_conflict_is_consistent_across_comment_artifact_and_output
         self.assertIn("auto_fix_allowed=false", outputs)
         self.assertIn("next_action=contract_arbitration", outputs)
 
+    def test_main_same_head_reuses_trusted_clearance_without_arbitration(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            event = {
+                "pull_request": {
+                    "number": 7,
+                    "title": "fix missing panel contract",
+                    "body": "",
+                    "html_url": "https://example.test/pr/7",
+                    "head": {"sha": "abc1234"},
+                    "base": {"sha": "base123", "repo": {"full_name": "org/repo"}},
+                }
+            }
+            event_path = Path(tmpdir) / "event.json"
+            event_path.write_text(json.dumps(event), encoding="utf-8")
+            findings = [
+                {
+                    "severity": "high",
+                    "category": "contract",
+                    "file": "service/review.py",
+                    "description": "Missing panel must return a structured blocked result.",
+                    "suggestion": "Return ReviewResult(blocked=True).",
+                }
+            ]
+            diff = "diff --git a/service/review.py b/service/review.py"
+            clearance = run_codex_pr_review.build_clearance_marker(
+                repo="org/repo",
+                pr_number=7,
+                head_sha="abc1234",
+                diff_digest=run_codex_pr_review._diff_digest(diff),
+                findings=findings,
+                arbiter_identity="github-actions[bot]",
+                evidence="source-of-truth tests prove the false positive",
+                issued_at=1,
+                expires_at=2_000_000_000,
+            )
+            prior_comment = (
+                "<!-- codex-pr-review -->\n"
+                "<!-- codex-pr-review-streak:0 -->\n"
+                f"{clearance}\n"
+                + run_codex_pr_review.build_finding_history_marker(
+                    [], findings, "abc1234", status="cleared"
+                )
+            )
+            env = {
+                "GH_TOKEN": "token",
+                "GITHUB_REPOSITORY": "org/repo",
+                "GITHUB_EVENT_PATH": str(event_path),
+                "GITHUB_OUTPUT": str(Path(tmpdir) / "github-output.txt"),
+            }
+            previous_cwd = os.getcwd()
+            try:
+                os.chdir(tmpdir)
+                with (
+                    patch.dict(os.environ, env, clear=True),
+                    patch(
+                        "scripts.run_codex_pr_review.fetch_pr_files",
+                        return_value=[{"filename": "service/review.py"}],
+                    ),
+                    patch("scripts.run_codex_pr_review.fetch_pr_diff", return_value=diff),
+                    patch(
+                        "scripts.run_codex_pr_review.load_policy",
+                        return_value=run_codex_pr_review._default_policy(),
+                    ),
+                    patch(
+                        "scripts.run_codex_pr_review.find_existing_review_comment",
+                        return_value=(99, prior_comment),
+                    ),
+                    patch(
+                        "scripts.run_codex_pr_review.run_codex_review_with_fallback",
+                        return_value=json.dumps({"summary": "block", "findings": findings}),
+                    ) as backend,
+                    patch("scripts.run_codex_pr_review.upsert_pr_comment") as comment,
+                ):
+                    self.assertEqual(run_codex_pr_review.main(), 0)
+            finally:
+                os.chdir(previous_cwd)
+
+            backend.assert_called_once()
+            body = comment.call_args.args[3]
+            decision = json.loads(
+                (Path(tmpdir) / "data/output/codex_pr_review/decision.json").read_text(
+                    encoding="utf-8"
+                )
+            )
+
+        self.assertFalse(decision["blocked"])
+        self.assertEqual(decision["next_action"], "none")
+        self.assertIn("trusted clearance matches this head and diff", body)
+        self.assertIn("codex-pr-review-clearance:v1:", body)
+        self.assertNotIn("Codex Review Arbitration", body)
+
     def test_main_malformed_trusted_history_blocks_before_review(self) -> None:
         with tempfile.TemporaryDirectory() as tmpdir:
             event_path = self._write_event(tmpdir, ["docs/guide.md"])

From 65d198d19f9704384ab9421abb55153698cc5e7a Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Sun, 12 Jul 2026 20:05:37 +0800
Subject: [PATCH 2/7] fix: bind clearances to trusted review runs

Co-Authored-By: Codex <noreply@openai.com>
---
 docs/ai_autonomy_architecture.md  |  2 +-
 scripts/run_codex_pr_review.py    | 75 ++++++++++++++++++++++++-------
 tests/test_run_codex_pr_review.py | 41 ++++++++++++++++-
 3 files changed, 99 insertions(+), 19 deletions(-)

diff --git a/docs/ai_autonomy_architecture.md b/docs/ai_autonomy_architecture.md
index 3e0ce9b2..ee610921 100644
--- a/docs/ai_autonomy_architecture.md
+++ b/docs/ai_autonomy_architecture.md
@@ -211,7 +211,7 @@ trusted review comment 只保存最近固定轮数、固定字节上限且脱敏
 
 初次 review 审阅累计 diff；remediation 只审阅受信任上一 head 到当前 head 的 delta、未解决 contract 与必要影响上下文。达到上限时仅允许一次累计 diff sanity，再交给独立仲裁；同一 head 不会反复重新开启 remediation。`tests/fixtures/codex_pr_review_replays.json` 保存了脱敏的 dispatch 三态与 scored-date/cached-runner replay 输入，用于防止同义措辞、同文件不同 contract 和错误 clearance 回归。
 
-当仲裁给出 `clear` 时，系统会写入受信任的 `clearance.v1`，绑定 repo、PR、head SHA、diff digest、contract_key、证据摘要和仲裁身份；同一 head 重新运行时可验证 clearance 并直接通过 required review check。若 head/diff 变化、clearance 过期、或被伪造，则继续 fail closed。
+当仲裁给出 `clear` 时，系统会写入受信任的 `clearance.v1`，绑定 repo、PR、head SHA、diff digest、contract_key、证据摘要、仲裁身份和成功的 `pull_request_target` review workflow run；同一 head 重新运行时可验证 clearance 并直接通过 required review check。若 head/diff 变化、clearance 过期、workflow run 不匹配或被伪造，则继续 fail closed。
 
 对大 PR，review prompt 会先要求纵向切片：超过 1500 行、12 个文件，或跨 adapter/gateway/runtime 边界时，不允许用删 tests/docs 的方式“缩小”变更面，而是先拆成更小的 contract PR。
 
diff --git a/scripts/run_codex_pr_review.py b/scripts/run_codex_pr_review.py
index 74bf9b82..8ca5d829 100644
--- a/scripts/run_codex_pr_review.py
+++ b/scripts/run_codex_pr_review.py
@@ -383,8 +383,8 @@ def build_review_prompt(
 ## Review Scope: Remediation
 
 Review only the unresolved findings below, the remediation delta, and the minimal
-affected context needed to validate their contracts. Do not restart a full PR
-review or introduce unrelated findings.
+affected context needed to validate their contracts. Do not reopen untouched
+parts of the PR, but report any new blocking issue found in the remediation delta.
 
 ## Unresolved Findings
 {json.dumps(unresolved_findings or [], ensure_ascii=False, indent=2)}
@@ -1114,6 +1114,7 @@ def build_clearance_marker(
     findings: list[dict[str, Any]],
     arbiter_identity: str,
     evidence: str,
+    workflow_run_id: int,
     issued_at: int | None = None,
     expires_at: int | None = None,
 ) -> str:
@@ -1143,6 +1144,7 @@ def build_clearance_marker(
         "fingerprints": fingerprints,
         "evidence_digest": hashlib.sha256(_sanitize_history_text(evidence, 1000).encode("utf-8")).hexdigest()[:24],
         "arbiter_identity": _sanitize_history_text(arbiter_identity, 120),
+        "workflow_run_id": int(workflow_run_id),
         "issued_at": timestamp,
         "expires_at": expiry,
     }
@@ -1178,6 +1180,7 @@ def parse_clearance_marker(body: str) -> tuple[dict[str, Any] | None, bool]:
         "fingerprints": list,
         "evidence_digest": str,
         "arbiter_identity": str,
+        "workflow_run_id": int,
         "issued_at": int,
         "expires_at": int,
     }
@@ -1238,6 +1241,31 @@ def clearance_matches(
     return True
 
 
+def clearance_workflow_run_is_trusted(
+    token: str, repo: str, clearance: dict[str, Any]
+) -> bool:
+    """Verify that a clearance was emitted by a successful review workflow run."""
+    run_id = int(clearance.get("workflow_run_id") or 0)
+    if run_id <= 0:
+        return False
+    try:
+        run = github_request(token, "GET", f"/repos/{repo}/actions/runs/{run_id}")
+    except ReviewError:
+        return False
+    if not isinstance(run, dict):
+        return False
+    workflow_path = str(run.get("path") or "")
+    run_repo = run.get("repository") if isinstance(run.get("repository"), dict) else {}
+    return bool(
+        run.get("event") == "pull_request_target"
+        and run.get("conclusion") == "success"
+        and str(run.get("head_sha") or "").strip().lower()
+        == str(clearance.get("head_sha") or "").strip().lower()
+        and str(run_repo.get("full_name") or "") == repo
+        and workflow_path.startswith(".github/workflows/codex_pr_review.yml@")
+    )
+
+
 # ---------------------------------------------------------------------------
 # Findings evaluation
 # ---------------------------------------------------------------------------
@@ -1594,28 +1622,40 @@ def conflicting_contract_findings(
         for finding in current_findings
         if isinstance(finding, dict)
     }
-    conflicts: list[dict[str, Any]] = []
+    latest_by_contract: dict[str, dict[str, Any]] = {}
+    resolved_contracts: set[str] = set()
     for round_state in reversed(history):
         prior = round_state.get("findings")
         if not isinstance(prior, list):
             continue
+        status = round_state.get("status", "blocking")
+        if status in {"clear", "cleared"}:
+            if not prior:
+                break
+            resolved_contracts.update(
+                str(finding.get("contract_key") or _contract_key(finding))
+                for finding in prior
+                if isinstance(finding, dict)
+            )
+            continue
         for finding in prior:
             if not isinstance(finding, dict):
                 continue
             contract_key = str(finding.get("contract_key") or _contract_key(finding))
-            current = current_by_contract.get(contract_key)
-            if not current:
-                continue
-            current_fingerprint = str(current.get("fingerprint_v2") or _fingerprint_v2(current))
-            prior_fingerprint = str(finding.get("fingerprint_v2") or _fingerprint_v2(finding))
-            if current_fingerprint != prior_fingerprint:
-                conflicts.append(
-                    {
-                        **finding,
-                        "current_fingerprint_v2": current_fingerprint,
-                        "history_head_sha": str(round_state.get("head_sha") or ""),
-                    }
-                )
+            if contract_key not in resolved_contracts and contract_key not in latest_by_contract:
+                latest_by_contract[contract_key] = {
+                    **finding,
+                    "history_head_sha": str(round_state.get("head_sha") or ""),
+                }
+    conflicts: list[dict[str, Any]] = []
+    for contract_key, prior in latest_by_contract.items():
+        current = current_by_contract.get(contract_key)
+        if not current:
+            continue
+        current_fingerprint = str(current.get("fingerprint_v2") or _fingerprint_v2(current))
+        prior_fingerprint = str(prior.get("fingerprint_v2") or _fingerprint_v2(prior))
+        if current_fingerprint != prior_fingerprint:
+            conflicts.append({**prior, "current_fingerprint_v2": current_fingerprint})
     return conflicts
 
 
@@ -2429,7 +2469,7 @@ def main() -> int:
             head_sha=current_head_sha,
             diff_digest=diff_digest,
             findings=decision["blocking_findings"],
-        ):
+        ) and clearance_workflow_run_is_trusted(token, repo, clearance_marker):
             decision.update(
                 {
                     "blocked": False,
@@ -2631,6 +2671,7 @@ def main() -> int:
             or previous_findings,
             arbiter_identity=env_value("GITHUB_ACTOR", "github-actions[bot]"),
             evidence=str(arbitration.get("reason") or decision.get("summary") or ""),
+            workflow_run_id=int(env_value("GITHUB_RUN_ID", "0") or 0),
         )
     arbitration_cleared = bool(arbitration and arbitration.get("verdict") == "clear")
     if (
diff --git a/tests/test_run_codex_pr_review.py b/tests/test_run_codex_pr_review.py
index 9acfb7e4..58734e06 100644
--- a/tests/test_run_codex_pr_review.py
+++ b/tests/test_run_codex_pr_review.py
@@ -68,7 +68,8 @@ def test_remediation_prompt_limits_review_to_delta_and_unresolved_contracts(self
             unresolved_findings=[{"file": "service/review.py", "contract_key": "abc"}],
         )
         self.assertIn("Review Scope: Remediation", prompt)
-        self.assertIn("Do not restart a full PR\nreview", prompt)
+        self.assertIn("Do not reopen untouched\nparts of the PR", prompt)
+        self.assertIn("new blocking issue found in the remediation delta", prompt)
         self.assertIn('"contract_key": "abc"', prompt)
 
     def test_review_script_never_imports_from_the_pr_checkout(self) -> None:
@@ -181,6 +182,16 @@ def test_sanitized_replays_keep_semantic_contracts_separate(self) -> None:
             [],
         )
         self.assertEqual(len(run_codex_pr_review.conflicting_contract_findings(history, [opposite])), 1)
+        cleared_history, valid = run_codex_pr_review.parse_finding_history(
+            run_codex_pr_review.build_finding_history_marker(
+                history, [same], "feedface", status="cleared"
+            )
+        )
+        self.assertTrue(valid)
+        self.assertEqual(
+            run_codex_pr_review.conflicting_contract_findings(cleared_history, [opposite]),
+            [],
+        )
 
     def test_parse_arbitration_output_requires_supported_verdict(self) -> None:
         self.assertEqual(
@@ -285,6 +296,7 @@ def test_trusted_clearance_marker_round_trips_and_binds_head_diff(self) -> None:
             findings=findings,
             arbiter_identity="github-actions[bot]",
             evidence="public interface and regression tests prove the false positive",
+            workflow_run_id=123,
             issued_at=1,
             expires_at=2_000_000_000,
         )
@@ -312,6 +324,28 @@ def test_trusted_clearance_marker_round_trips_and_binds_head_diff(self) -> None:
                 findings=findings,
             )
         )
+        trusted_run = {
+            "event": "pull_request_target",
+            "conclusion": "success",
+            "head_sha": "abc1234",
+            "path": ".github/workflows/codex_pr_review.yml@base-sha",
+            "repository": {"full_name": "org/repo"},
+        }
+        with patch("scripts.run_codex_pr_review.github_request", return_value=trusted_run):
+            self.assertTrue(
+                run_codex_pr_review.clearance_workflow_run_is_trusted(
+                    "token", "org/repo", parsed or {}
+                )
+            )
+        with patch(
+            "scripts.run_codex_pr_review.github_request",
+            return_value={**trusted_run, "event": "workflow_dispatch"},
+        ):
+            self.assertFalse(
+                run_codex_pr_review.clearance_workflow_run_is_trusted(
+                    "token", "org/repo", parsed or {}
+                )
+            )
         self.assertFalse(
             run_codex_pr_review.clearance_matches(
                 parsed or {},
@@ -1347,6 +1381,7 @@ def test_main_same_head_reuses_trusted_clearance_without_arbitration(self) -> No
                 findings=findings,
                 arbiter_identity="github-actions[bot]",
                 evidence="source-of-truth tests prove the false positive",
+                workflow_run_id=123,
                 issued_at=1,
                 expires_at=2_000_000_000,
             )
@@ -1386,6 +1421,10 @@ def test_main_same_head_reuses_trusted_clearance_without_arbitration(self) -> No
                         "scripts.run_codex_pr_review.run_codex_review_with_fallback",
                         return_value=json.dumps({"summary": "block", "findings": findings}),
                     ) as backend,
+                    patch(
+                        "scripts.run_codex_pr_review.clearance_workflow_run_is_trusted",
+                        return_value=True,
+                    ),
                     patch("scripts.run_codex_pr_review.upsert_pr_comment") as comment,
                 ):
                     self.assertEqual(run_codex_pr_review.main(), 0)

From 71e3eecce6caf2498d6eceba8e1f3e128e00e9e9 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Sun, 12 Jul 2026 20:12:14 +0800
Subject: [PATCH 3/7] fix: preserve bounded remediation terminal state

Co-Authored-By: Codex <noreply@openai.com>
---
 scripts/run_codex_pr_review.py    |  3 ++-
 tests/test_run_codex_pr_review.py | 19 +++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/scripts/run_codex_pr_review.py b/scripts/run_codex_pr_review.py
index 8ca5d829..a12bf70a 100644
--- a/scripts/run_codex_pr_review.py
+++ b/scripts/run_codex_pr_review.py
@@ -2711,8 +2711,9 @@ def main() -> int:
     serialized_history, serialized_history_valid = parse_finding_history(
         finding_history_marker
     )
-    serialized_history_requires_confirmation = finding_history_requires_confirmation(
+    serialized_history_requires_confirmation = bool(
         serialized_history
+        and serialized_history[-1].get("status") in {"overflow", "invalid_history"}
     )
     if not serialized_history_valid or serialized_history_requires_confirmation:
         decision = apply_arbitration_failure(
diff --git a/tests/test_run_codex_pr_review.py b/tests/test_run_codex_pr_review.py
index 58734e06..e2d14d3d 100644
--- a/tests/test_run_codex_pr_review.py
+++ b/tests/test_run_codex_pr_review.py
@@ -487,6 +487,25 @@ def test_invalid_history_sentinel_is_fail_closed_but_recoverable(self) -> None:
         self.assertTrue(valid)
         self.assertFalse(run_codex_pr_review.has_active_blocking_history(recovered))
 
+    def test_blocked_human_contract_is_not_reclassified_as_invalid_history(self) -> None:
+        marker = run_codex_pr_review.build_finding_history_marker(
+            [],
+            [{
+                "severity": "high",
+                "category": "contract",
+                "file": "service/review.py",
+                "description": "The bounded remediation limit was reached.",
+                "suggestion": "Resolve the contract before another review.",
+            }],
+            "deadbeef",
+            status="blocked_human_contract",
+        )
+        history, valid = run_codex_pr_review.parse_finding_history(marker)
+
+        self.assertTrue(valid)
+        self.assertTrue(run_codex_pr_review.finding_history_requires_confirmation(history))
+        self.assertNotIn(history[-1]["status"], {"overflow", "invalid_history"})
+
     def test_matching_history_aggregates_keys_from_multiple_rounds(self) -> None:
         first = {
             "severity": "high",

From a1198ec4f87844959cfba4207253fd5e02b4dbe0 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Sun, 12 Jul 2026 20:21:00 +0800
Subject: [PATCH 4/7] fix: preserve terminal review convergence state

Co-Authored-By: Codex <noreply@openai.com>
---
 scripts/run_codex_pr_review.py    | 40 ++++++++++++++++++++++++++++---
 tests/test_run_codex_pr_review.py | 17 ++++---------
 2 files changed, 42 insertions(+), 15 deletions(-)

diff --git a/scripts/run_codex_pr_review.py b/scripts/run_codex_pr_review.py
index a12bf70a..4b910e32 100644
--- a/scripts/run_codex_pr_review.py
+++ b/scripts/run_codex_pr_review.py
@@ -908,7 +908,10 @@ def _contract_subject(finding: dict[str, Any]) -> str:
     anchors = re.findall(r"`([^`]{1,120})`", text)
     anchors.extend(re.findall(r"\b[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)+\b", text))
     normalized = [_normalize_contract_text(anchor) for anchor in anchors]
-    return "|".join(sorted({anchor for anchor in normalized if anchor}))
+    anchored_subject = "|".join(sorted({anchor for anchor in normalized if anchor}))
+    return anchored_subject or _normalize_contract_text(
+        finding.get("suggestion") or text
+    )
 
 
 def _contract_surface(finding: dict[str, Any]) -> tuple[str, str, str, str, str]:
@@ -2090,6 +2093,7 @@ def main() -> int:
     previous_fingerprints = parse_blocking_fingerprints(previous_comment)
     previous_head_sha = parse_reviewed_head_sha(previous_comment)
     clearance_marker_text = extract_clearance_marker(previous_comment)
+    clearance_marker, clearance_valid = parse_clearance_marker(previous_comment)
     finding_history, history_valid = parse_finding_history(previous_comment)
     history_valid = history_source_valid and history_valid
     if history_valid and finding_history:
@@ -2227,7 +2231,8 @@ def main() -> int:
         latest_status = str((finding_history[-1] if finding_history else {}).get("status") or "")
         review_scope = (
             "final_sanity"
-            if previous_streak >= MAX_REMEDIATION_ROUNDS and latest_status == "remediation"
+            if latest_status == "blocked_human_contract"
+            or (previous_streak >= MAX_REMEDIATION_ROUNDS and latest_status == "remediation")
             else "remediation"
         )
 
@@ -2235,6 +2240,36 @@ def main() -> int:
     # only the trusted previous-head delta, unless this is its one final sanity pass.
     diff = fetch_pr_diff(token, repo, pr_number)
     print(f"Fetched diff: {len(diff)} chars, {len(diff.splitlines())} lines")
+    if (
+        clearance_marker
+        and clearance_matches(
+            clearance_marker,
+            repo=repo,
+            pr_number=pr_number,
+            head_sha=current_head_sha,
+            diff_digest=_diff_digest(diff),
+            findings=[],
+        )
+        and clearance_workflow_run_is_trusted(token, repo, clearance_marker)
+    ):
+        decision = {
+            "blocked": False,
+            "blocking_findings": [],
+            "non_blocking_findings": [],
+            "total_findings": 0,
+            "summary": "✅ **Merge allowed**: trusted clearance matches this head and diff",
+            "contract_conflict": False,
+            "auto_fix_allowed": False,
+            "next_action": "none",
+        }
+        return publish_review_decision(
+            token, repo, pr_number, pr_url, decision, exit_code=0,
+            current_head_sha=current_head_sha, reviewed_head_sha=current_head_sha,
+            finding_history_marker=build_finding_history_marker(
+                finding_history, [], current_head_sha
+            ),
+            clearance_marker=clearance_marker_text,
+        )
     review_diff = diff
     if review_scope == "remediation":
         try:
@@ -2440,7 +2475,6 @@ def main() -> int:
         }
     )
     diff_digest = _diff_digest(diff)
-    clearance_marker, clearance_valid = parse_clearance_marker(previous_comment)
     if CLEARANCE_MARKER_PREFIX in previous_comment and not clearance_valid:
         decision = apply_arbitration_failure(
             decision, ReviewError("trusted clearance marker is malformed")
diff --git a/tests/test_run_codex_pr_review.py b/tests/test_run_codex_pr_review.py
index e2d14d3d..336c52f5 100644
--- a/tests/test_run_codex_pr_review.py
+++ b/tests/test_run_codex_pr_review.py
@@ -1289,12 +1289,12 @@ def test_main_contract_conflict_is_consistent_across_comment_artifact_and_output
                 "severity": "high",
                 "category": "contract",
                 "file": "service/review.py",
-                "description": "Missing panel must return a structured blocked result.",
+                "description": "`MissingPanel` must return a structured blocked result.",
                 "suggestion": "Return ReviewResult(blocked=True).",
             }
             current = dict(
                 prior,
-                description="Missing panel must fail fast.",
+                description="`MissingPanel` must fail fast.",
                 suggestion="Raise ReviewError instead of returning a result.",
             )
             fingerprint = run_codex_pr_review.blocking_finding_fingerprint([prior])
@@ -1450,17 +1450,10 @@ def test_main_same_head_reuses_trusted_clearance_without_arbitration(self) -> No
             finally:
                 os.chdir(previous_cwd)
 
-            backend.assert_called_once()
-            body = comment.call_args.args[3]
-            decision = json.loads(
-                (Path(tmpdir) / "data/output/codex_pr_review/decision.json").read_text(
-                    encoding="utf-8"
-                )
-            )
-
-        self.assertFalse(decision["blocked"])
-        self.assertEqual(decision["next_action"], "none")
+        backend.assert_not_called()
+        body = comment.call_args.args[3]
         self.assertIn("trusted clearance matches this head and diff", body)
+        self.assertIn("codex-pr-review-next-action:none", body)
         self.assertIn("codex-pr-review-clearance:v1:", body)
         self.assertNotIn("Codex Review Arbitration", body)
 

From a18d82205cdc4eeef83de24d6eaefa0093afb7b4 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Sun, 12 Jul 2026 20:34:22 +0800
Subject: [PATCH 5/7] fix: retain remediation state across retries

Co-Authored-By: Codex <noreply@openai.com>
---
 scripts/run_codex_pr_review.py | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/run_codex_pr_review.py b/scripts/run_codex_pr_review.py
index 4b910e32..b79a49d9 100644
--- a/scripts/run_codex_pr_review.py
+++ b/scripts/run_codex_pr_review.py
@@ -287,6 +287,11 @@ def fetch_pr_diff(token: str, repo: str, pr_number: int) -> str:
 
 def fetch_compare_diff(token: str, repo: str, base_sha: str, head_sha: str) -> str:
     """Fetch only the remediation delta between two trusted reviewed heads."""
+    comparison = github_request(
+        token, "GET", f"/repos/{repo}/compare/{base_sha}...{head_sha}"
+    )
+    if not isinstance(comparison, dict) or comparison.get("status") != "ahead":
+        raise ReviewError("remediation head is not a strict descendant of the trusted reviewed head")
     compare_url = (
         f"{API_BASE}/repos/{repo}/compare/"
         f"{urllib.parse.quote(base_sha, safe='')}...{urllib.parse.quote(head_sha, safe='')}"
@@ -2185,7 +2190,7 @@ def main() -> int:
             current_head_sha=current_head_sha,
             reviewed_head_sha=current_head_sha,
             finding_history_marker=build_finding_history_marker(
-                finding_history, [], current_head_sha
+                finding_history, [], ""
             ),
         )
 
@@ -2301,7 +2306,7 @@ def main() -> int:
                 reviewed_head_sha=previous_head_sha,
                 new_head=True,
                 finding_history_marker=build_finding_history_marker(
-                    finding_history, [], current_head_sha
+                    finding_history, [], ""
                 ),
             )
         print(

From a6b74e63bdd96bda84b351db21f59f2b2ebe88c5 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Sun, 12 Jul 2026 21:22:06 +0800
Subject: [PATCH 6/7] fix: separate remediation convergence state

Co-Authored-By: Codex <noreply@openai.com>
---
 scripts/run_codex_pr_review.py    | 45 +++++++++++--------------------
 tests/test_run_codex_pr_review.py | 19 +++++++++++++
 2 files changed, 34 insertions(+), 30 deletions(-)

diff --git a/scripts/run_codex_pr_review.py b/scripts/run_codex_pr_review.py
index b79a49d9..c44d53af 100644
--- a/scripts/run_codex_pr_review.py
+++ b/scripts/run_codex_pr_review.py
@@ -940,12 +940,11 @@ def _contract_key(finding: dict[str, Any]) -> str:
 
 
 def _behavior_digest(finding: dict[str, Any]) -> str:
-    file_path, category, severity, subject, behavior_text = _contract_surface(finding)
+    file_path, category, _severity, subject, behavior_text = _contract_surface(finding)
     payload = json.dumps(
         {
             "file": file_path,
             "category": category,
-            "severity": severity,
             "subject": subject,
             "behavior": behavior_text,
         },
@@ -1660,10 +1659,10 @@ def conflicting_contract_findings(
         current = current_by_contract.get(contract_key)
         if not current:
             continue
-        current_fingerprint = str(current.get("fingerprint_v2") or _fingerprint_v2(current))
-        prior_fingerprint = str(prior.get("fingerprint_v2") or _fingerprint_v2(prior))
-        if current_fingerprint != prior_fingerprint:
-            conflicts.append({**prior, "current_fingerprint_v2": current_fingerprint})
+        current_behavior = str(current.get("behavior_digest") or _behavior_digest(current))
+        prior_behavior = str(prior.get("behavior_digest") or _behavior_digest(prior))
+        if current_behavior != prior_behavior:
+            conflicts.append({**prior, "current_behavior_digest": current_behavior})
     return conflicts
 
 
@@ -1689,6 +1688,10 @@ def unresolved_history_findings(history: list[dict[str, Any]]) -> list[dict[str,
     return previous_matching_findings(history, all_findings)
 
 
+def remediation_round_count(history: list[dict[str, Any]]) -> int:
+    return sum(1 for round_state in history if round_state.get("status") == "remediation")
+
+
 def has_active_blocking_history(history: list[dict[str, Any]]) -> bool:
     if not history:
         return False
@@ -2234,10 +2237,11 @@ def main() -> int:
     )
     if active_blocking_history and new_head_for_scope:
         latest_status = str((finding_history[-1] if finding_history else {}).get("status") or "")
+        completed_remediation_rounds = remediation_round_count(finding_history)
         review_scope = (
             "final_sanity"
             if latest_status == "blocked_human_contract"
-            or (previous_streak >= MAX_REMEDIATION_ROUNDS and latest_status == "remediation")
+            or completed_remediation_rounds >= MAX_REMEDIATION_ROUNDS
             else "remediation"
         )
 
@@ -2520,27 +2524,7 @@ def main() -> int:
                     "next_action": "none",
                 }
             )
-        else:
-            decision = apply_arbitration_failure(
-                decision, ReviewError("trusted clearance does not match this head or diff")
-            )
-            return publish_review_decision(
-                token,
-                repo,
-                pr_number,
-                pr_url,
-                decision,
-                exit_code=1,
-                blocking_streak=previous_streak,
-                previous_head_sha=previous_head_sha,
-                current_head_sha=current_head_sha,
-                reviewed_head_sha=current_head_sha,
-                new_head=bool(previous_head_sha and current_head_sha != previous_head_sha),
-                finding_history_marker=build_invalid_finding_history_marker(current_head_sha),
-                history_valid=False,
-            )
-
-    clearance_marker_out = clearance_marker_text if clearance_marker and not decision["blocked"] else ""
+    clearance_marker_out = ""
     history_requires_confirmation = finding_history_requires_confirmation(
         finding_history
     ) or legacy_blocking_state
@@ -2571,6 +2555,7 @@ def main() -> int:
     repeated_finding = bool(decision["blocked"] and repeated_fingerprints)
     contract_conflicts = conflicting_contract_findings(finding_history, decision["blocking_findings"])
     new_head = bool(previous_head_sha and current_head_sha and previous_head_sha != current_head_sha)
+    completed_remediation_rounds = remediation_round_count(finding_history)
     blocking_streak = next_blocking_streak(
         previous_streak,
         blocked=bool(decision["blocked"]),
@@ -2587,7 +2572,7 @@ def main() -> int:
                 "next_action": "contract_arbitration",
             }
         )
-    elif decision["blocked"] and blocking_streak <= MAX_REMEDIATION_ROUNDS:
+    elif decision["blocked"] and completed_remediation_rounds < MAX_REMEDIATION_ROUNDS:
         decision["next_action"] = "auto_remediation"
     elif decision["blocked"]:
         decision.update(
@@ -2729,7 +2714,7 @@ def main() -> int:
                 history_status = "blocked_human_contract"
             elif decision.get("next_action") == "human_contract_resolution":
                 history_status = "blocked_human_contract"
-            elif blocking_streak > MAX_REMEDIATION_ROUNDS or contract_conflicts or decision.get("next_action") == "contract_arbitration":
+            elif completed_remediation_rounds >= MAX_REMEDIATION_ROUNDS or contract_conflicts or decision.get("next_action") == "contract_arbitration":
                 history_status = "arbitration_required"
             elif blocking_streak > 1:
                 history_status = "remediation"
diff --git a/tests/test_run_codex_pr_review.py b/tests/test_run_codex_pr_review.py
index 336c52f5..8e292ec6 100644
--- a/tests/test_run_codex_pr_review.py
+++ b/tests/test_run_codex_pr_review.py
@@ -192,6 +192,25 @@ def test_sanitized_replays_keep_semantic_contracts_separate(self) -> None:
             run_codex_pr_review.conflicting_contract_findings(cleared_history, [opposite]),
             [],
         )
+        severity_only = [dict(same, severity="critical")]
+        self.assertEqual(
+            run_codex_pr_review.conflicting_contract_findings(history, severity_only),
+            [],
+        )
+
+    def test_remediation_round_count_is_independent_of_blocking_streak(self) -> None:
+        finding = {
+            "severity": "high", "category": "logic", "file": "service/review.py",
+            "description": "`Review.run()` keeps the contract.", "suggestion": "Keep `Review.run()` stable.",
+        }
+        first, _ = run_codex_pr_review.parse_finding_history(
+            run_codex_pr_review.build_finding_history_marker([], [finding], "deadbeef", status="initial_review")
+        )
+        second, _ = run_codex_pr_review.parse_finding_history(
+            run_codex_pr_review.build_finding_history_marker(first, [finding], "feedface", status="remediation")
+        )
+        self.assertEqual(run_codex_pr_review.remediation_round_count(second), 1)
+        self.assertLess(run_codex_pr_review.remediation_round_count(second), run_codex_pr_review.MAX_REMEDIATION_ROUNDS)
 
     def test_parse_arbitration_output_requires_supported_verdict(self) -> None:
         self.assertEqual(

From de8cd1151f38697cf4f7b3d19338da2170211ec5 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Sun, 12 Jul 2026 21:48:45 +0800
Subject: [PATCH 7/7] fix: bind clearance to reviewer implementation

Co-Authored-By: Codex <noreply@openai.com>
---
 scripts/run_codex_pr_review.py    | 44 ++++++++++++++++++++++++-------
 tests/test_run_codex_pr_review.py | 11 ++++++++
 2 files changed, 46 insertions(+), 9 deletions(-)

diff --git a/scripts/run_codex_pr_review.py b/scripts/run_codex_pr_review.py
index c44d53af..381009bd 100644
--- a/scripts/run_codex_pr_review.py
+++ b/scripts/run_codex_pr_review.py
@@ -80,6 +80,13 @@
 ARBITRATION_REPEAT_THRESHOLD = MAX_REMEDIATION_ROUNDS + 1
 CLEARANCE_TTL_SECONDS = 7 * 24 * 60 * 60
 CONTRACT_HISTORY_VERSION = 2
+REVIEW_TRANSITION_MATRIX = {
+    "initial_review": "remediation",
+    "remediation": "remediation",
+    "final_sanity": "arbitration_required",
+    "arbitration_required": "arbitration_required",
+    "blocked_human_contract": "final_sanity",
+}
 
 
 class ReviewError(RuntimeError):
@@ -339,6 +346,14 @@ def _diff_digest(diff: str) -> str:
     return hashlib.sha256(diff.encode("utf-8")).hexdigest()[:24]
 
 
+def review_implementation_digest() -> str:
+    """Identify the trusted bridge implementation that issued a clearance."""
+    digest = hashlib.sha256()
+    for path in (Path(__file__), PROMPT_TEMPLATE_PATH):
+        digest.update(path.read_bytes())
+    return digest.hexdigest()[:24]
+
+
 # ---------------------------------------------------------------------------
 # Review prompt
 # ---------------------------------------------------------------------------
@@ -1122,6 +1137,7 @@ def build_clearance_marker(
     arbiter_identity: str,
     evidence: str,
     workflow_run_id: int,
+    implementation_digest: str | None = None,
     issued_at: int | None = None,
     expires_at: int | None = None,
 ) -> str:
@@ -1152,6 +1168,7 @@ def build_clearance_marker(
         "evidence_digest": hashlib.sha256(_sanitize_history_text(evidence, 1000).encode("utf-8")).hexdigest()[:24],
         "arbiter_identity": _sanitize_history_text(arbiter_identity, 120),
         "workflow_run_id": int(workflow_run_id),
+        "implementation_digest": implementation_digest or review_implementation_digest(),
         "issued_at": timestamp,
         "expires_at": expiry,
     }
@@ -1188,6 +1205,7 @@ def parse_clearance_marker(body: str) -> tuple[dict[str, Any] | None, bool]:
         "evidence_digest": str,
         "arbiter_identity": str,
         "workflow_run_id": int,
+        "implementation_digest": str,
         "issued_at": int,
         "expires_at": int,
     }
@@ -1198,6 +1216,8 @@ def parse_clearance_marker(body: str) -> tuple[dict[str, Any] | None, bool]:
         return None, False
     if not all(isinstance(item, str) and re.fullmatch(r"[0-9a-f]{20}", item) for item in payload["fingerprints"]):
         return None, False
+    if not re.fullmatch(r"[0-9a-f]{24}", payload["implementation_digest"]):
+        return None, False
     return payload, True
 
 
@@ -1231,6 +1251,8 @@ def clearance_matches(
         return False
     if str(clearance.get("diff_digest") or "").strip().lower() != str(diff_digest or "").strip().lower():
         return False
+    if str(clearance.get("implementation_digest") or "") != review_implementation_digest():
+        return False
     current_contract_keys = {
         _contract_key(finding)
         for finding in findings
@@ -1692,13 +1714,24 @@ def remediation_round_count(history: list[dict[str, Any]]) -> int:
     return sum(1 for round_state in history if round_state.get("status") == "remediation")
 
 
+def review_scope_for_history(history: list[dict[str, Any]], *, new_head: bool) -> str:
+    if not history or not new_head:
+        return "initial_review"
+    status = str(history[-1].get("status") or "")
+    if status == "blocked_human_contract":
+        return "final_sanity"
+    if status in {"initial_review", "remediation"}:
+        return "final_sanity" if remediation_round_count(history) >= MAX_REMEDIATION_ROUNDS else "remediation"
+    return "initial_review"
+
+
 def has_active_blocking_history(history: list[dict[str, Any]]) -> bool:
     if not history:
         return False
     latest = history[-1]
     status = latest.get("status", "blocking")
     return finding_history_requires_confirmation(history) or (
-        status in {"blocking", "remediation", "arbitration_required", "blocked_human_contract"}
+        status in {"initial_review", "blocking", "remediation", "arbitration_required", "blocked_human_contract"}
         and bool(latest.get("findings"))
     )
 
@@ -2236,14 +2269,7 @@ def main() -> int:
         previous_head_sha and current_head_sha and previous_head_sha != current_head_sha
     )
     if active_blocking_history and new_head_for_scope:
-        latest_status = str((finding_history[-1] if finding_history else {}).get("status") or "")
-        completed_remediation_rounds = remediation_round_count(finding_history)
-        review_scope = (
-            "final_sanity"
-            if latest_status == "blocked_human_contract"
-            or completed_remediation_rounds >= MAX_REMEDIATION_ROUNDS
-            else "remediation"
-        )
+        review_scope = review_scope_for_history(finding_history, new_head=True)
 
     # Keep the cumulative diff for clearance binding. Remediation review uses
     # only the trusted previous-head delta, unless this is its one final sanity pass.
diff --git a/tests/test_run_codex_pr_review.py b/tests/test_run_codex_pr_review.py
index 8e292ec6..a325cddf 100644
--- a/tests/test_run_codex_pr_review.py
+++ b/tests/test_run_codex_pr_review.py
@@ -212,6 +212,17 @@ def test_remediation_round_count_is_independent_of_blocking_streak(self) -> None
         self.assertEqual(run_codex_pr_review.remediation_round_count(second), 1)
         self.assertLess(run_codex_pr_review.remediation_round_count(second), run_codex_pr_review.MAX_REMEDIATION_ROUNDS)
 
+    def test_review_transition_matrix_keeps_initial_active_for_two_remediations(self) -> None:
+        finding = {"severity": "high", "category": "logic", "file": "service/review.py", "description": "`Review.run()` blocks.", "suggestion": "Keep `Review.run()` blocked."}
+        history, _ = run_codex_pr_review.parse_finding_history(run_codex_pr_review.build_finding_history_marker([], [finding], "deadbeef", status="initial_review"))
+        self.assertTrue(run_codex_pr_review.has_active_blocking_history(history))
+        self.assertEqual(run_codex_pr_review.review_scope_for_history(history, new_head=True), "remediation")
+        for head in ("feedface", "c0ffee0"):
+            marker = run_codex_pr_review.build_finding_history_marker(history, [finding], head, status="remediation")
+            history, _ = run_codex_pr_review.parse_finding_history(marker)
+        self.assertEqual(run_codex_pr_review.review_scope_for_history(history, new_head=True), "final_sanity")
+        self.assertEqual(run_codex_pr_review.review_scope_for_history(history, new_head=False), "initial_review")
+
     def test_parse_arbitration_output_requires_supported_verdict(self) -> None:
         self.assertEqual(
             run_codex_pr_review.parse_arbitration_output('{"verdict":"clear","reason":"covered by the regression test"}'),