Review phase procedures - verdict rules, issue format, re-review protocol, zero-tolerance policy

A zero-tolerance security review gate blocks code merges by returning a FAIL verdict if any issue at CRITICAL, MAJOR, or MINOR severity is found. PASS requires zero issues across all changed files.

Code review issues must be reported as structured ISSUE entries containing the exact location, description, and actionable Fix guidance. This deterministic format ensures automated parsing and tracking across review iterations.

Re-review verification checks prior fixes by marking them as resolved, not resolved, or regressed. It also validates disputed issues and flags any newly introduced problems in the latest workflow changes.

Yes, automated code reviews can be scoped to only workflow-changed files. This convention-aware review targets OWASP Top 10 checks, edge cases, and error handling specifically on modified code.

When issues remain after maximum review iterations, the protocol provides escalation guidance. This ensures unresolved security or quality findings are routed appropriately rather than blocking the pipeline indefinitely.

Yes, the verdict format supports OWASP Top 10 checks. It applies security review workflows to changed files, enforcing zero-tolerance standards that fail the verdict on any security-critical findings.