feat: add durable issue development loop

[codeacme17]

Summary

Adds a first-class, auditable issue-dev-loop for continuously turning eligible Echo UI issues into verified Draft pull requests while preserving codeacme17 as the only human who may mark Ready, approve, or merge.

What is included

• loops/issue-dev-loop/ contract, compact state, append-only logs, per-run timing, screenshot/evidence layout, combo trigger, and evolve policy
• explicit portable $implement handoff and attestation gates for every product-code change
• isolated fresh-context PR reviewer plus executor response/adjudication protocol
• COMMENT-only reviews; accepted findings are repaired and replied to, rejected findings receive a reasoned reply
• one-to-one durable bindings between review findings, GitHub inline comment IDs, executor decisions, fixes, and replies
• exact-head GitHub Actions evidence artifacts and UI screenshot provenance
• atomic cross-worktree issue claiming, fail-closed rollback, and explicit orphan-claim recovery
• durable GitHub state journal in issue [Loop] issue-dev-loop state journal #105 for active checkpoints and terminal records
• blocking owner notifications with verified RESUME <run-id> responses
• owner-only Ready/approval/merge observation; no agent merge, auto-merge, or branch-protection bypass
• evolve requests after 5–10 runs or repeated failure patterns

Identities and owner boundary

• Executor / PR automation: @Ethandasw
• Fresh COMMENT-only reviewer: @Traviinam
• Human owner: @codeacme17
• Durable state journal: issue [Loop] issue-dev-loop state journal #105
• Executor and reviewer use isolated GitHub CLI configuration directories; the global gh profile is not changed
• gh auth setup-git is not used

This bootstrap PR was created by codeacme17 before the isolated bot accounts were activated. Future issue-loop PRs are authored by Ethandasw, reviewed COMMENT-only by Traviinam, and remain Draft until codeacme17 reviews and merges them.

Verification

• Exact reviewed head: e25b21285b920583f4361ea236092328acbf8acb
• pnpm loop:issue-dev:test: 86/86 passed
• pnpm lint: passed
• pnpm loop:issue-dev:validate: passed, 64 files checked
• git diff --check 470017ab68b4da855a346b5a673ad98ddfec8236..e25b21285b920583f4361ea236092328acbf8acb: passed
• bootstrap-evidence exact-head CI: passed

Independent review history

1. Traviinam COMMENT-only review on 1ef5ef6
   • Ethandasw adjudication and reply
2. Traviinam COMMENT-only review on 792dc80
   • Ethandasw adjudication and reply
3. Traviinam final COMMENT-only closure review on exact head e25b212
   • Standards: PASS
   • Spec: PASS
   • Actionable findings: 0

Owner handoff

This PR intentionally remains Draft. codeacme17 must inspect the implementation and evidence, then decide whether to mark it Ready and merge it. Neither bot is authorized to perform those actions.

[Traviinam]

Independent fresh-context review of head 5f72389.

IDR-1 [P1] Child Git processes can fall back to global credentials. Evidence: loops/issue-dev-loop/scripts/lib/github-identity.mjs lines 100-109 inject the credential helper only when the immediate executable is git. Expected: apply role-scoped Git credential configuration to every descendant process.

IDR-2 [P1] Push restrictions are bypassable and do not enforce the issue-branch boundary. Evidence: loops/issue-dev-loop/scripts/lib/github-identity.mjs lines 88-97 only recognize direct git push and blacklist a few forms; git -C . push, plus refspecs, --all, omitted destinations, and arbitrary branches remain possible. Expected: parse Git global options and allow only one explicit codex/issue-number destination with no force or wildcard behavior.

IDR-3 [P1] Forbidden GitHub authority is not enforced by the router. Evidence: loops/issue-dev-loop/scripts/lib/github-identity.mjs runs non-Git commands unchanged, allowing executor merge/approve and reviewer approve paths. Expected: reject merge, auto-merge, approval, and equivalent protected GitHub operations for non-owner roles.

[Ethandasw]

Executor response to review #106 (review)

IDR-1 — accepted and resolved in edffa5c. Role-scoped Git configuration is now inherited by every child process; system/global Git config is excluded and the only effective helper is gh auth git-credential for the selected profile.

IDR-2 — accepted and resolved in edffa5c. Push handling is a strict allowlist: only one explicit codex/issue- branch to origin, optionally with -u or --set-upstream. Force, plus-refspec, --all, omitted destination, protected/arbitrary branch, and git-global-option bypasses are covered by rejection tests.

IDR-3 — accepted and resolved in edffa5c. Both roles reject merge; automation cannot author reviews; reviewer can publish only gh pr review --comment. Approval, change-request, mutating reviewer API, merge/review API endpoints, implicit POST fields, and GraphQL paths are rejected.

Verification: pnpm verify passed; 39/39 loop tests passed; live validate --activation passed for Ethandasw and Traviinam; effective credential helper smoke returned only gh auth git-credential.

Please re-review exact head edffa5c.

[Traviinam]

Independent fresh-context review of exact head 1ef5ef6. RVW-B2-1 P1: failed or crashed remote claim reservation can become stranded; add exact-SHA rollback and orphan recovery escalation. RVW-B2-2 P1: inline review membership is not one-to-one; bind each comment ID, path, line, and body to one durable finding and response. RVW-B2-3 P2: consider whether the machine-specific implement skill path must be attested rather than the portable implement identity. RVW-B2-4 P3: extract the duplicated GitHub issue-comment publisher. RVW-B2-5 P3: centralize repeated terminal lifecycle statuses. This COMMENT review is not an approval and does not authorize Ready or merge.

[Ethandasw]

Executor adjudication for review 4771430596. RVW-B2-1 accepted and fixed in 792dc80: failed labeling releases only an exact-SHA reservation, and a crash orphan returns claim_recovery for immediate owner escalation. RVW-B2-2 accepted and fixed in 792dc80: each inline comment now has a unique GitHub comment ID and a one-to-one finding, path, line, body, and response binding; duplicate-marker and page-101 regressions are tested. RVW-B2-3 rejected: a user-home absolute path is machine-specific and unsafe to encode in a portable open-source repository. The runbook requires the portable implement agent identity, a frozen handoff, unique invocation records, exact commit SHA, checks, and recorded implementation events. RVW-B2-4 accepted and fixed in 792dc80 by the shared postGitHubIssueComment helper. RVW-B2-5 accepted and fixed in 792dc80 by the shared lifecycle-status module. Verification: 86 of 86 loop tests passed, ESLint passed, loop validation passed for 64 files, and git diff check passed. PR remains Draft; only codeacme17 may Ready, approve, or merge.

[Traviinam]

Second independent fresh-context review of exact head 792dc80. RVW-B3-1 P1: REST read-then-delete of a claim ref is not atomic; use an exact force-with-lease deletion so an advanced branch cannot be removed. RVW-B3-2 P1: inline comment IDs and unique response ownership must be persisted in the review result, not held only in memory. RVW-B3-3 P3: checkpoint and finalization proof modules duplicate journal channel configuration; share one helper. This COMMENT review is not an approval and does not authorize Ready or merge.

[Ethandasw]

Executor adjudication for review 4771508553. RVW-B3-1 accepted and fixed in e25b212: rollback is now one server-side force-with-lease deletion bound to the exact reservation SHA; a changed ref fails the lease and is retained. RVW-B3-2 accepted and fixed in e25b212: review results persist inlineCommentId, bind ID, path, line, and body one-to-one, and reject reused executor response comment IDs. RVW-B3-3 accepted and fixed in e25b212: finalization proof now reuses checkpointJournalConfiguration. Verification: 86 of 86 loop tests passed, ESLint passed, loop validation passed for 64 files, and git diff check passed. PR remains Draft; only codeacme17 may Ready, approve, or merge.

[Traviinam]

Final fresh-context closure review for exact head e25b212. Standards PASS with zero actionable findings. Spec PASS with zero actionable findings. Confirmed atomic cross-worktree claim reservation, exact-SHA force-with-lease rollback, claim_recovery escalation, paginated durable one-to-one inline comment binding, unique executor response ownership, shared proof configuration, and owner-only Ready approval and merge boundaries. Local verification passed 86 of 86 loop tests, ESLint, 64-file structural validation, and git diff check. This COMMENT review is not an approval and does not authorize Ready or merge.

[Ethandasw]

@codeacme17 Owner review requested.

The issue-dev-loop bootstrap is now closed on exact head e25b21285b920583f4361ea236092328acbf8acb:

• exact-head bootstrap-evidence CI passed
• local loop tests passed 86/86
• lint and structural validation passed
• Traviinam completed the final COMMENT-only Standards + Spec review with zero actionable findings
• Ethandasw resolved and replied to all accepted findings from earlier review rounds

The PR remains Draft. Please inspect the implementation, evidence, and review history, then decide whether to mark it Ready and merge it. Neither automation identity will approve or merge this PR.