[tracking][automation] Complete event-driven Agent review and exact-head integration

Outcome

Complete the event-driven Agent review and exact-head integration path for Proto UI. Repository events and periodic reconciliation should lead directly to authenticated evidence collection, independent review, and any standing-authorized action without a fresh approval round for each transition.

The default path is:

event or reconciliation wakeup
  -> authenticate, normalize, and deduplicate
  -> collect canonical live state
  -> bind analysis and review to the exact head
  -> obtain an independent Agent verdict
  -> execute the standing-authorized action
  -> persist a receipt and reconcile any unknown outcome

The hourly read-only intake in #485 remains a reconciliation source. Its read-only boundary is not the capability ceiling of the downstream system.

Capability graph

• #485 supplies periodic intake and stuck-state reconciliation.
• #509 supplies the authenticated event envelope, replay protection, and intake contract.
• #555 supplies canonical review input and exact-head review mutation.
• #556 supplies exact-head integration after an independent clean approval.
• #557 supplies the trusted Poppy broker and separated analyzer/applier credentials.

Once an event is admitted, the system may automatically claim bounded work, implement it, respond to review, submit REQUEST_CHANGES, dismiss or supersede its own resolved request, submit a clean APPROVE, trigger a recheck, mark work ready for review, update ordinary Issue/PR metadata, and hand an eligible exact head to #556 for integration.

An earlier CHANGES_REQUESTED review on an old head is evidence to reconcile, not an unconditional permanent block. The Agent should map its findings to the live exact head: carry forward any still-applicable unresolved finding, and otherwise treat the stale review as superseded. Progress should not wait on obsolete review state.

Default automatic progression

The complete staged plan is standing-authorized. Each slice advances when its declared evidence is satisfied; it does not require another human checkpoint merely because execution moves from observation to review, from review to mutation, or from clean approval to exact-head integration.

Automation may select and sequence the next eligible transition, provided the live repository state, applicable spec/** authority, required checks, and action receipt all agree. Ordinary uncertainty is resolved by collecting more evidence, running focused validation, or abstaining from a specific mutation while the rest of the queue continues.

Attended decisions

Human attention is reserved for two decision classes:

1. unresolved-product-direction: the applicable authority does not settle a material product, protocol, compatibility, or scope choice.
2. privileged-or-irreversible-operation: an action changes secrets, access, repository rules, publication/release state, or another surface that cannot be safely reversed by the standing-authorized applier.

The decision packet should ask one concrete question, identify the exact blocked transition, and leave unrelated eligible work running. Review comments, routine metadata, rechecks, reversible review state, ready-for-review transitions, and exact-head integration through #556 are not attended decisions when their policy conditions are met.

Review and integration contract

• Every verdict and mutation is bound to repository, object, base SHA, head SHA, canonical-input digest, Agent identity, and policy version.
• An Agent never supplies the independent verdict for its own implementation. Analyzer, verifier/reviewer, and applier responsibilities remain separated.
• A blocking finding produces REQUEST_CHANGES against the live head. A clean independent verdict may produce APPROVE and hand the same exact head to #556.
• Findings and review threads are reconciled against current code and authority. Only unresolved findings applicable to the live head remain blocking.
• Integration requires trusted repository CI, DCO/provenance evidence, a live credential and permission check, an independent clean review, resolved applicable findings/threads, and an unchanged eligible head.
• Integration uses an atomic lease and idempotency key. Success, no-op, stale, rejected, failed, and unknown outcomes receive durable receipts; unknown outcomes are reconciled before any retry.
• The applier does not use force merge, admin bypass, or blind retry.
• Analysis workers do not receive write credentials. Review and integration credentials are provisioned narrowly and remain isolated from untrusted content processing.

Delivery slices

1. Event and reconciliation intake: authenticated envelope, allowlist, replay, deduplication, ordering, and bounded relevance admission.
2. Canonical live collection: exact body, commits, replies, threads, checks, external evidence, base/head SHAs, and digest binding.
3. Independent review: governed-authority lookup, finding reconciliation, REQUEST_CHANGES, own-review resolution, and clean APPROVE.
4. Standing-authorized operations: claims, review responses, rechecks, ready-for-review, and ordinary metadata updates.
5. Exact-head integration: #556 eligibility, lease, mutation, receipts, and unknown-outcome reconciliation.
6. Production operations: observability, bounded retry, kill switches, credential rotation, and disposable-PR end-to-end evidence.

Each slice should be small enough to review independently, while its accepted completion automatically unlocks the next eligible slice.

Completion evidence

• Authenticated event delivery and periodic reconciliation converge on one durable work item.
• Duplicate, stale, and bot-echo events are safely absorbed without losing eligible work.
• Canonical input, verdict, review mutation, and integration receipt all bind to the same exact head.
• Both REQUEST_CHANGES and clean APPROVE are demonstrated with independent identities.
• Resolved or obsolete review state no longer strands a newer head.
• #556 integrates a disposable eligible PR without force/admin bypass and reconciles an injected unknown outcome.
• Credential isolation, trusted CI, DCO/provenance, leases, idempotency, receipts, and kill switches are covered by executable evidence.

Start with the capability graph and delivery slices, then read linked issues #485, #509, #555, #556, and #557 to understand the existing intake, review, and integration boundaries. Use the completion evidence as the acceptance checklist, including exact-head binding, independent review identities, durable receipts, credential isolation, and unknown-outcome reconciliation.