Add statement-review commands

[Deicyde]

Part 6 of 8 in the split of #75. Draft; it merges after #216 (based on feat/readback-cards).

This PR replaces #75 as the stack's review-commands layer. #75 was split into eight stacked drafts and then simplified; its thread stays as the record of the earlier design and review, and the review of 765f2cb stays on #40. This layer lets a project check that a formalized statement says what its source says: review prepare writes blind Lean packets for an independent model, review record files the model's read-back of one packet as a card without running Lean, and review check, the one judge, fails until every Lean-mapped article has current cards and a review_approved equal to its review hash.

What it adds

• review prepare blueprint --lean-root . --packets DIR [--timeout] (_review_prepare): one full extraction, build_review_bundle's refusals, then write_review_packets: one packet per declaration under blind/, named by the SHA-256 of its bytes, plus an autoform-review-packets/v1 manifest for the coordinator.
• review record blueprint --packets DIR --article-id --declaration --testimony --model [--expected-card-hash] (_review_record): no Lean. read_review_packet takes the single manifest entry for the article and declaration and reads the packet its hash names, not the manifest's path; manifest, packet and testimony go through read_regular_file (non-blocking open, so a FIFO is refused unread); a gone article_id is refused (review-article-missing); Add read-back cards and the testimony validator #216's prepare_readback checks packet bytes and testimony, and publish_readback files the card under its lock and compare-and-swap.
• review check blueprint --lean-root . [--json] [--timeout] (_review_check, _current_review): reads graph and cards, extracts once, and refuses with review-snapshot-changed if the cards changed, the extraction's blueprint hash does not name the graph, or a Lean-mapped article, read again for its statement, no longer hashes as the graph recorded. It prints each article's hash to approve and labels each current approval.
• autoform_cli/review.py: build_review_bundle (in-memory evidence: title, statement, cited passage, packets), ReviewState/review_states (incomplete, unverifiable, unapproved, drift, approved; the one place approval is judged), review_findings (adds orphaned cards and approvals), canonical_statement. Lean-mapped articles need an article_id and must be declaration-sized leaves; a cited article needs an exact #L<start>-L<end> passage of an in-vault non-Markdown source; no article may cite blank lines.
• review_approved: sha256:<64 hex> frontmatter (graph.py). approvals.py: approval_statuses(states) labels every current approval self-approved, no network; JSON {label, node_id, review_hash}. Its docstring, the README and both CODEOWNERS examples (# /blueprint/ @OWNER) say authorization is repository policy (code-owner review of blueprint/, stale approvals dismissed, approval of the latest push).
• skeleton.py: the blueprint hash covers each article's cited passage (_source_passages, _blueprint_hash(graph, passages), public blueprint_hash(graph)), so review evidence binds the passage a reviewer reads; source_passage(files=) reads each cited file once, after main's link checks pass, and reports a failed read as that article's problem. OutputTransaction and _stage_output(stages=) own the review packet stages, and lean._OUTPUT_STAGE keeps a stage a killed writer left from being indexed as project source.
• Opt-in marker blueprint/.autoform-review (autoform-review-policy/v1), committed by new scaffolds. Both autoform-verify.yml copies check its hash, fail if cards or approvals exist without it, and with it run review check --lean-root . once. Review packet trees are managed output (lean.py; public skeleton.validate_managed_output with an exact schema=, refusing a symlinked manifest). Human Review gains the statement-review steps, Formalize runs review check after integration, the read-back guide gains "Return only testimony". Plain audit and doctor leave review_approved to review check.

What changed in this revision

Size: +2,683/-77 in 24 files before, +2,665/-70 in 23 files now.

• Restacked on the rebuilt Treat every published page as untrusted #215, now 5e75131 (eebe543, on main ec84968, with main 400eb64 merged for Load a blueprint reached through a link that cannot be read #371; ec84968 has Extract Lean skeletons one probe per root module #213 and Run skeleton probes in parallel and isolate probe failures #214).
• review.canonical_statement reads the article again. The rebuilt Treat every published page as untrusted #215's graph keeps no article bytes (BlueprintSnapshot, graph.snapshot and graph.article_text are gone; each Node keeps source_sha256), so _parsed_text rereads the article through read_regular_file and refuses with review-snapshot-changed (exit 2 from review prepare and review check) unless it still hashes as load_graph recorded. The previous revision cut the statement from the bytes the graph captured, so a statement edited after the snapshot was judged as the snapshot parsed it. test_check_judges_the_statement_its_snapshot_parsed became test_check_refuses_a_statement_edited_after_its_snapshot, which expects exit 2 and review-snapshot-changed where it expected exit 1 and review-drift, and test_canonical_statement_is_the_span_the_audit_and_the_box_read reads the article from disk instead of graph.article_text. The README's review check paragraph names this third comparison, and _current_review's docstring and the affected test docstrings say the same.
• The unquoting, the .MD and urlsplit skips, and the NUL, symlink-loop, directory and unreadable-file reports the previous revision added to skeleton.source_passage now come from main's link checks (Report malformed Sources and dependency links instead of crashing #337, Finish the Sources-link fixes from #337 #347). source_passage keeps main's checks, in main's order, and reads the file through the files= cache only after they pass. Where they differ, main's rule holds: a Markdown link that names no regular file is reported, and the suffix is judged on the file the link resolves to.
• _LINE_LOCATOR is main's \d+ again, with main's int() ValueError guard (Report malformed Sources and dependency links instead of crashing #337), in place of the nine-digit bound: a line number with more than nine digits is a locator, as on main, so one past the end of its file is reported as that article's problem ("names no lines of its file") where the bound skipped the link. The README sentence on the bound and the comment above _LINE_LOCATOR went with it.
• tests/test_skeleton.py is no longer changed: main's tests already cover the link cases the previous revision added (a directory, %00, a symlink loop, NOTES.MD, an unclosed IPv6 host, and a 5000-digit line number, which main expects to name no lines).
• _add_probe_timeout_argument, shared by skeleton, review prepare and review check, carries main's --timeout help ("the probe helper's build", not "lookup and build"): the merged Run skeleton probes in parallel and isolate probe failures #214 dropped the helper cache and its lookup.
• Textual merges with main: the README's Lean-indexing paragraph adds review packet folders to Skip rendered sites in every Lean capture #336's rewording; lean.py adds _IGNORED_OUTPUT_SCHEMAS after Skip rendered sites in every Lean capture #336's PUBLICATION_* constants; _validate_managed_output's exact schema= sits beside Check that a manifest's schema is a string before looking it up #357's string check; the review parser and dispatch follow skeleton directly, since Remove autoform unused-hypotheses in favor of Batteries' unusedArguments linter #352 removed unused-hypotheses.
• Unchanged from the previous revision: approvals bind each declaration's statement hash (Extract Lean skeletons one probe per root module #213; _review_declaration passes statement_hash as skeleton_hash), so a proof-only change, sorry to a proof included, keeps cards and review_approved current (test_an_approval_survives_a_proof_edit_but_not_a_statement_edit).

What changed since #75

• Size: +3,997/-44 in 28 files at a74dba2, Add verified statement-review bundles #75's head when it was split, now +2,665/-70 in 23 (code 1,553 to 1,059 lines, tests 2,161 to 1,362, docs and workflows 283 to 244).
• Every command derives its evidence: no bundle file, no review prepare -o, no review check --bundle, no audit --review or --review-bundle. The bundle schema, loader, writer and validators are gone; ReviewBundle is in-memory only, and audit.py, doctor.py and readback.py are untouched.
• review record runs no Lean and re-reads no article: the scoped extraction, the post-Lean reload and the pre-write article re-read are gone. A card filed from stale packets is filed and reported readback-invalid by the next review check; a stale record that names --expected-card-hash can replace a current card with an invalid one (Git restores it).
• canonical_statement is now the site's statement box reading (article_parts(published_page(...))): the old stripper dropped comments in indented code, which Treat every published page as untrusted #215's site shows, so the approval did not bind text the box showed.
• Approval state lives in review_states; current_approvals and the per-approval attestation fields are gone. Review refusals from prepare and check name the article and code. Rebased on main 8638db9: textual merges with main's elaboration-limit sentence in the README, its module-import-impact imports in __main__.py and its "renew the complete claim set" step in Formalize. The README's list of what Lean indexing skips now names review packet folders, and Formalize hands every article whose read-backs or approval the result made stale, import-edit repairs included, to Human Review. From ae2db51: one import conflict in __main__.py (Publish blueprint sites transactionally #165), and the statement-box test now builds files with Publish blueprint sites transactionally #165's capture. Main's audit step in the verify workflows (Run the CI audit probe without any project code #190) is kept.

Review findings it answers

• Add verified statement-review bundles #40 blocker 1, check half: review check judges one snapshot of graph and cards (dd33f01). The record half (d6d8d16, by ArmelRandy) and the audit half are dropped: the record compares nothing with Lean, and audit has no review path.
• Add verified statement-review bundles #40 blocker 2, policy half: the drift-checksum and repository-policy text, written for this split; a pasted hash prints self-approved.
• Add verified statement-review bundles #40 blocker 6: verify extracts once (91c9287, by ArmelRandy); the record half, moved out earlier as batch filing, is closed here: a record costs no extraction.
• Item 2: a blank cited passage is refused by prepare and check alike (c4effb3, b78d71e), now for every origin. Item 3's bundle half is moot (no bundle file); the manifest reader refuses nested and long-number JSON as unreadable.
• Item 4, verify half: removing the AUTOFORM_REVIEW_ENABLED gate fails a test (17ad389). d04b976 (card filed while Lean runs) is dropped: there is no Lean window. Item 6: a gone article_id is refused, without advice (the advice was old Harden card publication and review record #218's, dropped).
• Item 8, part: packet, testimony and now manifest refused unread when not regular files (5be882a). The record's article re-read (ca63de9 and five follow-ups) is dropped; an edit during a record is caught by the next check.
• Deferred finding b747ef3: article shape is checked without a children scan, with its scale test. 412a479 and 21b71ca went with audit --review.

Until the next layers land

• render has no review flags and the site shows no review state until Show statement review on the site #217. Every current approval reads self-approved until Label statement approvals by the repository's code-owner review policy #219 checks the repository's code-owner policy; Pages runs no statement review until Label statement approvals by the repository's code-owner review policy #219, and the opt-in gate test covers only the verify workflow.
• The bundled example's verify workflow gains the statement-review steps but pins 0288506 and has no marker, so review check does not run there; the pin bump is a post-merge follow-up.

Validation

Run 39103606387 on 1648bdf5 passed every job: Windows inspection, subprocess, and publication hardening, real Lean (fixture toolchain), real Lean skeleton suite (fixture toolchain), real REPL (fixture toolchain), test (3.10), test (3.13).

New: tests/test_review_cli.py (14 tests, 23 cases; 31 tests at a74dba2) and tests/test_review_bundle.py (24 tests, 47 cases; 29 there). Added: 2 tests in tests/test_scaffold.py, 1 each in tests/test_doctor.py, tests/test_graph_scale.py and tests/test_skill_examples.py, 1 test and a packets row in tests/test_lean_sources.py. tests/test_readback.py, which a74dba2 changed, is untouched.

Where #40's review went

Blockers are #40's review of 765f2cb; items are the open-items comment and its follow-up.

Finding	Carried by
Blocker 1: split snapshot in check and record	this PR (check, the blueprint hash over cited passages), #217 (render); record half dropped (record runs no Lean)
Blocker 2: a pasted hash passes as approval	this PR (policy text, self-approved), #217 (label on the site), #219 (policy-enforced label from one repository-policy check); per-approval attribution dropped
Blocker 3: card writes under concurrent edits	#216 (flock plus compare-and-swap); post-lock re-walk dropped
Blocker 4: testimony that hides text	#216 (plain text, flat TeX allowlist)
Blocker 5: unbounded Markdown parsing	#216 (no parser; linear scans within 32 KiB and 500 lines)
Blocker 6: repeated Lean work	#214 (parallel probes), this PR (verify extracts once, record runs no Lean), #217 (render extracts once), #219 (Pages passes its own report)
Item 1: Pages mkdocs-material pin	#212
Item 2: blank passage in derived evidence	this PR, #217
Item 3: input nested too deep to decode	#212, #215, #216, this PR; bundle parts dropped (no bundle)
Item 4: mutant-killing tests	this PR, #219 (gate test over both workflows); testimony half moot (no Markdown), batch parts moved out
Item 5: text between paired dollar signs	#216
Item 6: a record whose article_id is gone	this PR (refusal); advice dropped with old #218
Item 7: records-manifest recipe	moved out (batch filing)
Item 8: record and audit hardening	#216 (cards), this PR (regular-file reads); the record's article re-read dropped, 9bd0052 moved out
Item 9: history	the split: #216, this PR, #217 and #219 are one commit each; #215 adds its rebuild on main, a merge and a review commit to its layer commit
Item 10: probe per module and its cost	#213 (design), #214 (parallel probes)

Stack

#	PR	Layer
1	#212	Fix roadmap loading, Lean index edge cases and undecodable JSON (merged)
2	#213	Extract Lean skeletons one probe per root module (merged)
3	#214	Run skeleton probes in parallel and isolate probe failures (merged)
4	#215	Treat every published page as untrusted
5	#216	Add read-back cards and the testimony validator
6	#284	Add statement-review commands
7	#217	Show statement review on the site
8	#219	Label statement approvals by the repository's code-owner review policy