implementation-final-review

Resolve the merge base, generate review state with review_state.py using task and component pathspec files, build a reviewer packet, and dispatch two independent reviewers on the frozen fingerprint. Only after clean review do you run the full build and test gates.

A content fingerprint is a SHA-256 digest over the resolved base and every task-owned workspace entry, including untracked files. It guarantees reviewers inspect exactly one immutable state, and any change to reviewed content invalidates the round.

Invoke it only when explicitly requested or when repository instructions require it after behavior-impacting implementation work. It is not for ordinary iteration; policy sets allow_implicit_invocation to false.

Yes. Every initialized submodule, including nested ones, must be clean and checked out at the commit recorded by its parent index before fingerprinting. Dirty worktrees, unmerged index stages, and cyclic submodule graphs cause the review state capture to fail closed.

review_protocol.py rejects outputs missing required schema fields, containing placeholder commands, duplicate JSON keys, non-finite numbers, or fingerprints that do not match the frozen packet. Every probe must record the exact executable command that ran.

Yes. Components whose fingerprint, requirement rows, behavior assertions, dependency inputs, and risk tier are unchanged retain clean credit. Only changed or dependency-invalidated components require two concurrent independent delta reviews.