feat: add dedicated reconciliation controller-handoff schema (Closes #303)

Add assess_reconciliation_handoff to review_proofs: already-landed PR
reconciliation runs must emit a dedicated handoff schema (selected PR,
live state, candidate head SHA, target branch + SHA, ancestor proof,
linked issue + live status, eligibility class
ALREADY_LANDED_RECONCILE_REQUIRED, capability proofs, per-category
mutation ledger, blocker, safe next action, no-review/merge
confirmation) instead of author or reviewer fields. Stale fields (PR
number opened, Pinned reviewed head, Scratch worktree used, Workspace
mutations, Issue lock proof, Claim/comment status) fail validation, a
wrong eligibility class fails, and an observed git fetch/pull must be
reported under Git ref mutations rather than claimed none. Fails
closed on a missing Controller Handoff section. Tests cover blocked
reconciliation, successful PR close, comment-only, no-op
already-closed, missing linked-issue proof, wrong eligibility class,
each stale field, and unreported observed fetch.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

review_proofs.py

@@ -1171,6 +1171,121 @@ def assess_workspace_mutation_consistency(report_text, observed_commands=None):
     }
 
 
+# ── Reconciliation controller-handoff schema (Issue #303) ────────────────────
+#
+# Already-landed PR reconciliation is neither author issue work nor
+# reviewer merge work; its handoff needs its own schema. Stale
+# author/reviewer fields fail validation, and observed git ref
+# mutations (fetch) must be reported under the precise category.
+
+RECONCILIATION_ELIGIBILITY_CLASS = "ALREADY_LANDED_RECONCILE_REQUIRED"
+
+RECONCILIATION_HANDOFF_FIELDS = (
+    ("Task", ("task",)),
+    ("Repo", ("repo",)),
+    ("Role/profile", ("role/profile", "role", "profile")),
+    ("Identity", ("identity",)),
+    ("Selected PR", ("selected pr",)),
+    ("PR live state", ("pr live state",)),
+    ("Candidate head SHA", ("candidate head sha",)),
+    ("Target branch", ("target branch",)),
+    ("Target branch SHA", ("target branch sha",)),
+    ("Ancestor proof", ("ancestor proof",)),
+    ("Linked issue", ("linked issue",)),
+    ("Linked issue live status", ("linked issue live status",)),
+    ("Eligibility class", ("eligibility class",)),
+    ("Capabilities proven", ("capabilities proven",)),
+    ("Missing capabilities", ("missing capabilities",)),
+    ("PR comments posted", ("pr comments posted",)),
+    ("Issue comments posted", ("issue comments posted",)),
+    ("PRs closed", ("prs closed",)),
+    ("Issues closed", ("issues closed",)),
+    ("Git ref mutations", ("git ref mutations",)),
+    ("Worktree mutations", ("worktree mutations",)),
+    ("MCP/Gitea mutations", ("mcp/gitea mutations",)),
+    ("External-state mutations", ("external-state mutations",)),
+    ("Read-only diagnostics", ("read-only diagnostics",)),
+    ("Blocker", ("blocker",)),
+    ("Safe next action", ("safe next action",)),
+    ("No review/merge confirmation", ("no review/merge",)),
+)
+
+RECONCILIATION_FORBIDDEN_FIELDS = (
+    "pr number opened",
+    "pinned reviewed head",
+    "scratch worktree used",
+    "workspace mutations",
+    "issue lock proof",
+    "claim/comment status",
+)
+
+
+def assess_reconciliation_handoff(report_text, observed_commands=None):
+    """#303: validate the dedicated reconciliation handoff schema.
+
+    Requires a Controller Handoff section carrying every reconciliation
+    field, ``Eligibility class: ALREADY_LANDED_RECONCILE_REQUIRED``, and
+    no stale author/reviewer fields. *observed_commands* is the git
+    command log; an observed fetch/pull must be reported under ``Git ref
+    mutations`` (never claimed none).
+
+    Returns {'complete', 'downgraded', 'reasons'}; fails closed.
+    """
+    section = _handoff_section_lines(report_text)
+    if section is None:
+        return {
+            "complete": False,
+            "downgraded": True,
+            "reasons": [
+                "reconciliation report has no section titled exactly "
+                f"'{HANDOFF_HEADING}'"
+            ],
+        }
+
+    fields = {}
+    for line in section:
+        stripped = line.strip().lstrip("-*").strip()
+        if ":" in stripped:
+            k, v = stripped.split(":", 1)
+            fields[k.strip().lower()] = v.strip()
+
+    reasons = []
+
+    for name, aliases in RECONCILIATION_HANDOFF_FIELDS:
+        if not any(label.startswith(alias)
+                   for label in fields for alias in aliases):
+            reasons.append(
+                f"reconciliation handoff missing required field: {name}"
+            )
+
+    for stale in RECONCILIATION_FORBIDDEN_FIELDS:
+        if any(label.startswith(stale) for label in fields):
+            reasons.append(
+                f"reconciliation handoff must not include stale field "
+                f"'{stale}'"
+            )
+
+    eligibility = fields.get("eligibility class", "")
+    if eligibility and RECONCILIATION_ELIGIBILITY_CLASS not in eligibility.upper():
+        reasons.append(
+            "reconciliation handoff eligibility class must be "
+            f"'{RECONCILIATION_ELIGIBILITY_CLASS}' (got '{eligibility}')"
+        )
+
+    _, ref_cmds = _classify_git_commands(observed_commands)
+    if ref_cmds and _field_claims_none(fields, "git ref mutations"):
+        reasons.append(
+            "observed git ref mutation not reported under 'Git ref "
+            f"mutations': {ref_cmds[0]}"
+        )
+
+    return {
+        "complete": not reasons,
+        "downgraded": bool(reasons),
+        "reasons": reasons,
+    }
+
+
 def assess_role_boundary(proof=None, *, task_role=None, namespaces_used=None,
                          justification=None):
     """Assess reviewer/author role separation for blind queue workflows.