docs(code-review): plan ordinary local report adoption

openspec/CHANGE_ORDER.md

@@ -4,6 +4,22 @@ This document is the **single source of truth for active work** in this
 repository. It lists what is in flight, what is paused, and the order in which
 active changes should be implemented.
 
+## High-priority trusted local Code Review reset (2026-10-16)
+
+Planned only. The approved ordinary local sequence is
+[modules #513](https://github.com/nold-ai/specfact-cli-modules/issues/513) (`code-review-17-project-runtime-bootstrap`)
+-> [modules #514](https://github.com/nold-ai/specfact-cli-modules/issues/514) (`code-review-18-project-standards-and-checks`)
+-> [modules #515](https://github.com/nold-ai/specfact-cli-modules/issues/515) (`code-review-19-local-report-and-cutover`)
+-> [core #769](https://github.com/nold-ai/specfact-cli/issues/769) ([`code-review-local-report-adoption`](changes/code-review-local-report-adoption/proposal.md))
+-> [modules #516](https://github.com/nold-ai/specfact-cli-modules/issues/516) (`code-review-20-external-installation-acceptance`).
+Core #769 has only modules #515 as its direct blocker and blocks only modules #516.
+
+This reset removes capsule infrastructure from ordinary trusted-local scope and plans report schema 2.0.
+It makes no shipped-support claim. Older capsule/runtime references below remain historical or separate protected work, not current local reset acceptance.
+Core protected #680 remains separate and cannot be satisfied by local schema 2.0. C15 core #679 and modules #417 retain owners, status, and acceptance.
+Optional preflight, architecture, and Requirements addons may consume later without blanket blocker edges.
+Independent security modules #511 and core #719/#718 and existing signing gates remain independent.
+
 ## Authorized #747 dependency stack (2026-10-10)
 
 The owner approved `dev <- #744 <- #727 <- #752 <- #754 <- #753`, retaining
@@ -73,7 +89,7 @@ Recovered from uncommitted proposal-only feature worktrees into local `dev`; rem
 
 | Bucket | Count | Location |
 |---|---:|---|
-| **Active-tree entries** | 41 | [`openspec/changes/`](changes/) |
+| **Active-tree entries** | 47 | [`openspec/changes/`](changes/) |
 | **Parking-lot entries** | 21 | [`openspec/parking-lot/`](parking-lot/) |
 | **Archived** | 120 | [`openspec/changes/archive/`](changes/archive/) |
 

openspec/changes/cli-val-07-code-review-gate-adoption/design.md

@@ -41,3 +41,7 @@ active governance exception for the same canonical rule/path/symbol.
 3. Run trusted-source shadow dogfood against that authenticated verifier. Candidate tests do not supply protected authority.
 4. Activate changed local and protected range/full enforcement only after the modules measurement gate and trusted consumer evidence pass.
 5. Roll back by returning to shadow; preserve the validated consumer and report.
+
+## Local reset coordination (2026-10-16)
+
+Planned ordinary local adoption is tracked separately by [core #769](https://github.com/nold-ai/specfact-cli/issues/769), after modules #515 and before modules #516. Its schema 2.0 trusted-local evidence cannot satisfy protected core #680 capsule acceptance. This additive note does not change this change's owners, status, tasks, or acceptance. C15 core #679 and modules #417 retain their own contracts. Older capsule references remain relevant to their separate protected contract, not ordinary local reset scope.

openspec/changes/cli-val-07-code-review-gate-adoption/proposal.md

@@ -85,3 +85,7 @@ parked Copilot test-generation change.
 - **Last Synced Status**: GitHub metadata verified; blocked on signed prerequisite releases
 - **Parent Feature**: [#375](https://github.com/nold-ai/specfact-cli/issues/375)
 - **Paired Modules Change**: [nold-ai/specfact-cli-modules#417](https://github.com/nold-ai/specfact-cli-modules/issues/417) / `code-review-15-signal-calibrated-blocking-gate`
+
+## Local reset coordination (2026-10-16)
+
+Planned ordinary local adoption is tracked separately by [core #769](https://github.com/nold-ai/specfact-cli/issues/769), after modules #515 and before modules #516. Its schema 2.0 trusted-local evidence cannot satisfy protected core #680 capsule acceptance. This additive note does not change this change's owners, status, tasks, or acceptance. C15 core #679 and modules #417 retain their own contracts. Older capsule references remain relevant to their separate protected contract, not ordinary local reset scope.

openspec/changes/code-review-14-protected-range-adoption/design.md

@@ -185,3 +185,7 @@ impact and a linked follow-up; there is no blanket deferral.
 None for scope. Branch-protection selection of the final emitted check remains
 an operational promotion step after warning evidence is accepted; it does not
 change this software contract.
+
+## Local reset coordination (2026-10-16)
+
+Planned ordinary local adoption is tracked separately by [core #769](https://github.com/nold-ai/specfact-cli/issues/769), after modules #515 and before modules #516. Its schema 2.0 trusted-local evidence cannot satisfy protected core #680 capsule acceptance. This additive note does not change this change's owners, status, tasks, or acceptance. C15 core #679 and modules #417 retain their own contracts. Older capsule references remain relevant to their separate protected contract, not ordinary local reset scope.

openspec/changes/code-review-14-protected-range-adoption/proposal.md

@@ -122,3 +122,7 @@ does not automatically authorize unrelated implementation.
 - **Historical signed publication**: nold-ai/specfact-cli-modules#419 at `6a0d0b31`
 - **Downstream C15 adoption**: nold-ai/specfact-cli#679
 - **Last Synced Status**: open; Todo; parent #375; blocks #679; current compatible signed pair and trusted verifier publication must be verified; implementation not started
+
+## Local reset coordination (2026-10-16)
+
+Planned ordinary local adoption is tracked separately by [core #769](https://github.com/nold-ai/specfact-cli/issues/769), after modules #515 and before modules #516. Its schema 2.0 trusted-local evidence cannot satisfy protected core #680 capsule acceptance. This additive note does not change this change's owners, status, tasks, or acceptance. C15 core #679 and modules #417 retain their own contracts. Older capsule references remain relevant to their separate protected contract, not ordinary local reset scope.

openspec/changes/code-review-local-report-adoption/design.md

@@ -0,0 +1,35 @@
+# Planned local report consumption
+
+## Existing paths and ownership
+
+Inspected on 2026-10-16: `scripts/pre_commit_code_review.py` shells out to the CLI, writes `.specfact/code-review.json`, and defines a minimal `CodeReviewReport`. `src/specfact_cli/registry/module_installer.py` installs verified modules and invokes `install_resolved_pip_requirements`. `src/specfact_cli/registry/module_discovery.py` and `module_packages.py` own discovery and compatibility. These are implementation touchpoints to verify again before changing behavior, not evidence of schema 2.0 support.
+
+Reuse ordinary invocation and existing module verification first. Adapt their narrow report and installation boundaries. Custom runtime or registry infrastructure is unnecessary for this approved outcome. Modules own project runtime and standards resolution, analyzer execution, and serialized reports. Core owns ordinary hooks, workflow invocation, installation compatibility, loading, and discovery.
+
+## Report boundary
+
+Use a small validated, version-discriminated report input at existing consumers. Schema 2.0 dispatch selects the modules #515 contract. Historical 1.6 dispatch is restricted to consumers with supported 1.6 semantics. Consumers governed by C15 retain explicit schema 1.7 dispatch and its enforcement until a separately authorized C15 retirement. This adoption neither enables C15 nor changes its owners, prerequisites or acceptance. Reject unrecognized versions, including unsupported same-major schemas, and malformed required fields before summarizing success. Any current or future helper using a numeric `>=1.6` test must not classify 2.0 as 1.6.
+
+Read the producer's authoritative assurance status and completeness, preserving failure and uncertainty in the summary and machine output. Score, fixability, and missing findings cannot replace assurance. Shadow mode changes blocking policy only. It retains adverse evidence and does not print a successful assurance claim for an incomplete report. Reconcile process exit and report according to the released producer contract; contradictory evidence cannot become success.
+
+No consumer promotes local evidence to protected `pr_range` or capsule attestation. The protected #680 contract remains separate. Preserve C15 #679 and modules #417 ownership and acceptance rather than folding those contracts into local schema 2.0.
+
+## Installation boundary
+
+The customer CLI may run in pipx, uv tool, or uvx while project Python differs. Preserve this separation. Do not inject analyzer or module dependencies into the customer project environment. A uvx tool environment may have no pip. Use supported external tooling or declared tool dependencies for the installed CLI environment instead of unmanaged mutation or an assumption that `python -m pip` exists. Verify the actual installer path against each supported installation before claiming compatibility.
+
+After provisioning, exercise ordinary local review with networking disabled and valid locally verified signed modules, the selected project environment and all selected check tools available. Loading must not require fresh registry or package-index access. Missing or invalid local prerequisites retain their normal nonaccepting diagnostics; this does not promise cold offline installation or dependency bootstrap. Modules #516 owns release-level offline acceptance as part of the installed workflow.
+
+`--project-runtime` denotes a descriptor contract. Do not reinterpret it as an interpreter path. Modules resolve project execution using their descriptor and project discovery contracts. Core forwards only supported declared inputs.
+
+## Rollout and risks
+
+First prove one real installed local review workflow. Then collect core consumer-compatibility preflight evidence for pipx, uv tool, and uvx with exact signed module/core identities and project interpreters. Modules #516 owns release-level installed acceptance and its full manager/platform matrix; core supplies the compatibility handoff rather than duplicating that release authority. Apply schema dispatch before replacing ordinary invocation. Retain security and signature gates, including independent modules #511 and core #719/#718 work.
+
+Schema confusion can falsely report success. Mitigate with unsupported-major and contradictory-report cases. Installation drift can hide dependency mistakes. Mitigate with clean external environments, including uvx without pip. Trusted project tools can execute repository code. Document that trust boundary and keep protected credentials and attestation claims outside this workflow.
+
+Rollback pins the previous immutable compatible released CLI/module pair and retains actual adverse results. Do not reduce acceptance requirements to hide an incompatible consumer or resurrect a second capsule backend in the replacement. Optional downstream consumers remain future work.
+
+## Planning and later implementation
+
+All acceptance remains planned. Follow spec, tests, observed failing evidence, production code, then passing evidence during implementation. Before RED, bind scenario-derived tests into requirements-evidence.yaml with executable selectors and stable requirement/case identities. Before GREEN, run the Requirements evidence gate against actual test results at implementation maturity; planning inspection alone cannot establish implementation evidence. The internal wiki source and C14/C15 compatibility notes were aligned through the owning checkout on 2026-10-16, and the native graph was rebuilt. Its strict health check reports 59 pre-existing errors, down from 62, with no new errors. Unrelated source pages were preserved. This records planning alignment only; all implementation tasks remain unchecked.

openspec/changes/code-review-local-report-adoption/proposal.md

@@ -0,0 +1,46 @@
+# Change: Adopt local Code Review reports in ordinary core workflows
+
+## Status
+
+Planned only, 2026-10-16. No runtime implementation, test execution, release support, or completed acceptance is claimed.
+
+- GitHub issue: [core #769](https://github.com/nold-ai/specfact-cli/issues/769).
+- Parent: core #375 under epic #285. Project: SpecFact CLI. Status: Todo. Type: User Story.
+- Direct blocker: [modules #515](https://github.com/nold-ai/specfact-cli-modules/issues/515), `code-review-19-local-report-and-cutover`.
+- Blocks only [modules #516](https://github.com/nold-ai/specfact-cli-modules/issues/516), `code-review-20-external-installation-acceptance`.
+
+## Why
+
+A customer runs an externally installed SpecFact CLI against a trusted local Python repository. Ordinary hooks and workflows need truthful local evidence without making the project adopt SpecFact's interpreter or capsule infrastructure. Core must consume the new producer contract before external installation acceptance can prove the complete workflow.
+
+## What Changes
+
+- Plan explicit report schema 2.0 dispatch in ordinary core consumers. Keep a historical 1.6 reader only where its contract is supported. Preserve explicit schema 1.7 dispatch at consumers governed by C15 until its owner authorizes a separate retirement; this adoption does not enable C15. Reject unrecognized versions, including unsupported same-major schemas.
+- Consume producer assurance and completeness. Do not derive success from score or fixability. Shadow rollout preserves adverse results.
+- Keep ordinary hook and workflow invocation, module installation compatibility, loading, and discovery in core. Keep project runtime resolution, customer standards, analyzers, and report production in modules.
+- Collect exact installed core and signed module compatibility preflight evidence for pipx, uv tool, and uvx, independent of project Python. Modules #516 retains release-level installation acceptance and the manager/platform matrix.
+
+## Capabilities
+
+### New capabilities
+
+- `local-review-consumer`: ordinary core consumption of trusted local schema 2.0 evidence.
+
+## Non-goals
+
+Protected `pr_range`, capsule attestation, analyzer changes, customer-environment dependency injection, broader registry rewrites, and C15 policy redesign are excluded. Local execution trusts the repository, including its project tooling. Optional preflight, architecture, and Requirements addons may consume reports later. They are not blanket blockers.
+
+Core #680 retains its separate protected capsule contract. Local schema 2.0 cannot satisfy it. Core #679 and modules #417 retain their owners, status, and acceptance. Independent security work modules #511 and core #719/#718 remains independent. Signing and security gates remain mandatory.
+
+## Impact
+
+Future work is bounded to existing ordinary consumers and necessary installed-module compatibility paths. Completion requires real installed customer workflow proof, explicit schema rejection, truthful adverse summaries, and normal quality/security/signature gates. Effort requires consumer changes and a multi-install acceptance matrix; no duration estimate is asserted. Rollback pins the previous immutable compatible released CLI/module pair while retaining adverse evidence. It must not silently reinterpret schema 2.0 through an older reader or reduce acceptance to hide incompatibility.
+
+## Source Tracking
+
+<!-- source_repo: nold-ai/specfact-cli -->
+- **GitHub Issue**: #769
+- **Issue URL**: <https://github.com/nold-ai/specfact-cli/issues/769>
+- **Last Synced Status**: open
+- **Project Status**: Todo
+- **Parent Feature**: [#375](https://github.com/nold-ai/specfact-cli/issues/375)