feat(strategy): add fail-closed strategy review contract

[Pigbibi]

Summary

• add strategy_review.v1 schema and fail-closed validator
• export source revision, cost model, and data timestamp metadata
• add negative tests for operational/placeholder/failed-gate evidence

Validation

• QPK full: 571 passed, 1 skipped
• targeted: 11 passed
• no promotion/live/runtime changes

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 2 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Logic in scripts/validate_strategy_review.py

A top-level decision of fail is currently accepted even when all 12 hard gates are pass and blocking_reason_codes is empty. The validator only checks consistency for the pass path, so a producer can publish a self-contradictory packet whose gates and score say the strategy passed but whose final decision hard-rejects it. That will produce incorrect review outcomes and poison downstream audit/history data. (line 237)

Suggestion: Reject any non-pass decision unless at least one hard gate is fail/insufficient_evidence or explicit blocking reasons are present, and add a regression test for an all-pass / decision="fail" payload.

2. 🟡 [MEDIUM] Reliability in scripts/validate_strategy_review.py

The validator only requires evidence_refs when a hard gate is marked pass. A gate with status="fail" or status="insufficient_evidence" can still validate with empty evidence_refs (and even empty reason_codes), which means a strategy can be blocked without any auditable artifact trail explaining why the gate failed. That undercuts the stated fail-closed review contract and makes downstream review/debugging unreliable. (line 225)

Suggestion: Require non-empty reason_codes and evidence_refs for every hard gate whose status is not pass, and add a negative test covering a failed gate with no supporting evidence.

---

Review by Codex PR Review bot • PR