feat: reject legacy Workspace mutations field in reviewer handoffs (Closes #320)

Reviewer controller handoffs must now report the precise mutation
categories (File edits by reviewer, Worktree/index mutations, Git ref
mutations, MCP/Gitea mutations, Review mutations, Merge mutations,
Cleanup mutations, External-state mutations, Read-only diagnostics)
instead of the ambiguous legacy "Workspace mutations" field.

- assess_controller_handoff(role="review") no longer requires
  "Workspace mutations" and fails closed when any legacy
  "Workspace mutations:" line is present, regardless of value.
- New HANDOFF_REVIEW_MUTATION_FIELDS makes the nine precise categories
  required fields for review-role handoffs, matching the canonical
  schemas/review-merge-final-report.md field set.
- Tests cover approval, request-changes, merge, worktree cleanup,
  fetch-only, and blocked handoffs, plus rejection of
  "Workspace mutations: none" and non-none values.
- Author/create-issue/inventory roles keep their existing contracts.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

review_proofs.py

@@ -1593,6 +1593,20 @@ HANDOFF_BASE_FIELDS = (
     ("Safety", ("safety",)),
 )
 
+# Issue #320: reviewer handoffs replace the legacy ambiguous
+# "Workspace mutations" field with these precise mutation categories.
+HANDOFF_REVIEW_MUTATION_FIELDS = (
+    ("File edits by reviewer", ("file edits by reviewer",)),
+    ("Worktree/index mutations", ("worktree/index mutations",)),
+    ("Git ref mutations", ("git ref mutations",)),
+    ("MCP/Gitea mutations", ("mcp/gitea mutations",)),
+    ("Review mutations", ("review mutations",)),
+    ("Merge mutations", ("merge mutations",)),
+    ("Cleanup mutations", ("cleanup mutations",)),
+    ("External-state mutations", ("external-state mutations",)),
+    ("Read-only diagnostics", ("read-only diagnostics",)),
+)
+
 HANDOFF_ROLE_FIELDS = {
     "review": (
         ("Selected PR", ("selected pr",)),
@@ -1608,7 +1622,7 @@ HANDOFF_ROLE_FIELDS = {
         ("Merge result", ("merge result",)),
         ("Linked issue status", ("linked issue status", "linked issue")),
         ("Cleanup status", ("cleanup status", "cleanup")),
-    ),
+    ) + HANDOFF_REVIEW_MUTATION_FIELDS,
     "author": (
         ("Selected issue", ("selected issue",)),
         ("Issue lock proof", ("issue lock proof", "lock before diff")),
@@ -1759,6 +1773,25 @@ def assess_controller_handoff(report_text, role=None, local_edits=False):
             field for field in required
             if field[0] not in ("Workspace mutations", "Mutations")
         ]
+    if role == "review":
+        # Issue #320: reviewer handoffs use the precise mutation categories
+        # in HANDOFF_REVIEW_MUTATION_FIELDS instead of the legacy ambiguous
+        # "Workspace mutations" field, which is rejected below.
+        required = [
+            field for field in required
+            if field[0] != "Workspace mutations"
+        ]
+        if any(label.startswith("workspace mutations") for label in labels):
+            return {
+                "verdict": "incomplete",
+                "downgraded": True,
+                "missing_fields": [],
+                "reasons": [
+                    "review handoff must not include legacy "
+                    "'Workspace mutations' field; report the precise "
+                    "mutation categories instead (issue #320)"
+                ],
+            }
     required.extend(HANDOFF_ROLE_FIELDS.get(role or "", ()))
 
     missing = []