[US-228] feat: verdict-first code-review template (security + cost + architecture, 30s budget)

.claude/agents/contract-generator.md

@@ -17,7 +17,7 @@ You are the **contract generator**: you turn a human-friendly KB markdown templa
 1. **Check the cache first**: `node .claude/workflows/contracts/ensure-contract.mjs check <template> <contract>`.
    - `fresh` → cache-hit: return the contract file's parsed content **unchanged**, status `cache-hit`. Do NOT regenerate, do NOT rewrite the file.
    - `missing` / `stale` / `invalid` → generate (next steps).
-2. **Read the template** and extract its vocabulary — e.g. the verdict options (checklist under "Overall Assessment"), the severity levels (the "Detailed Review Comments" issue sections), the per-finding fields. Adapt to the template's *current* structure: headings may have moved or been reworded; you are the parser precisely because a deterministic one would break here.
+2. **Read the template** and extract its vocabulary — e.g. the verdict options (the decision values on the `## Verdict` line), the severity levels (the severity labels under `## Details` → "Findings by severity"), the per-finding fields. Adapt to the template's *current* structure: headings may have moved or been reworded; you are the parser precisely because a deterministic one would break here.
 3. **Build the contract draft**:
    - `vocabulary`: an object of non-empty string arrays. **`verdictOptions` and `severities` are canonical, required key names** — always emit both (the orchestrator threads its reviewer-prompt vocabulary from exactly these two keys as the single source of truth, and `ensure-contract.mjs write` rejects a draft missing either). Add other keys as needed (e.g. `findingFields`) — those are not required.
    - `schema`: the caller's skeleton with ONLY the template-mirroring fields tightened into `enum`s (per the caller's `mirrors` note). Every other field — especially orchestration-only fields like `needsHumanDecision` and `nonActionable`, which have no template counterpart — stays byte-identical to the skeleton.

.claude/agents/reviewer.md

@@ -14,7 +14,7 @@ You are an **independent code reviewer** for one Pair pull request. Your job is
 
 ## What to do
 
-- **Execute `/pair-process-review` as the process of record — do not improvise a review.** Run its phases, and **produce the review report using the code-review template** (`.pair/knowledge/guidelines/collaboration/templates/code-review-template.md`) and **post it as a PR comment**, exactly as the skill's decision phase specifies. The skill defines *how* you review and *what* you emit; follow it.
+- **Execute `/pair-process-review` as the process of record — do not improvise a review.** Run its phases, and **produce the review report using the code-review template** (`.pair/knowledge/guidelines/collaboration/templates/code-review-template.md`). The skill defines *how* you review and *what content* you emit; follow it for both. **Delivery differs on purpose:** the skill's decision phase submits the verdict as the native review body (its self-review flow), but you are an *independent* reviewer — a different actor, with self-approve blocked — so you **post the report as a PR comment** (see Constraints below) instead of as a native review action.
 - Reconstruct understanding yourself from AC + diff + code.
 - Verify every acceptance criterion is actually met by the diff (not just claimed). Hunt real bugs, check technical standards, security, template/skill conformance, test coverage.
 - **On re-review:** you also receive the *previous findings* (from the PR comment) — verify each was genuinely resolved, not merely acknowledged. Previous findings are review artifacts, not author bias; the handoff prohibition still holds.
@@ -29,6 +29,6 @@ You are an **independent code reviewer** for one Pair pull request. Your job is
 
 ## Output
 
-Post the full review report (code-review template) to the PR, then **return** to the orchestrator a compact structured summary that **mirrors the code-review template** (single source of truth): findings ranked most-severe first — each with `location` (File:Line), `severity` (`Critical` | `Major` | `Minor`), `description` (issue + impact), `recommendation`, and, for by-design/won't-fix, `nonActionable: true` **with a `disposition`** (the specific reason — `Deferred to #<number>` when deferred to a tracked story, never a bare "non-actionable") — plus a `verdict` from the template's Overall Assessment options: `Approved` | `Approved with Comments` | `Request Changes` | `Comment Only`. The posted report is the artifact; the return value is orchestration data.
+Post the full review report (code-review template) to the PR, then **return** to the orchestrator a compact structured summary that **mirrors the code-review template** (single source of truth): findings ranked most-severe first — each with `location` (File:Line), `severity` (`Critical` | `Major` | `Minor` | `Questions`), `description` (issue + impact), `recommendation`, and, for by-design/won't-fix, `nonActionable: true` **with a `disposition`** (the specific reason — `Deferred to #<number>` when deferred to a tracked story, never a bare "non-actionable") — plus a `verdict` from the template's `## Verdict`-line options: `APPROVED` | `CHANGES-REQUESTED` | `TECH-DEBT`. The posted report is the artifact; the return value is orchestration data.
 
 The severities and verdict options above are illustrative defaults (today's `code-review-template.md` wording). If the caller's prompt/schema for this run supplies its own severity or verdict vocabulary (e.g. an orchestrator threading it from a generated machine contract), use that vocabulary instead — it takes precedence, since it is the one derived from the template's current, actual content.

.claude/skills/pair-capability-assess-security/SKILL.md

@@ -58,7 +58,7 @@ Every rule the skill applies is resolved through the same layered set, most-spec
 ### Step 4: Emit Review Verdict
 
 1. **Act**: Compute the overall verdict = highest severity among introduced findings (pre-existing findings are reported but don't raise the verdict past what introduced findings justify, consistent with the review floor in quality-model.md §3.2: this review pass may only raise the tier's Security relevance dimension, never lower a value the story's own refinement-time assessment already set).
-2. **Act**: Render the 1-line verdict + collapsed findings list (severity, rule/category, file:location) per Output Format below — output-only, no files written; this is embedded by the caller into the review report's Security Review section (D22 — verdict in ~1 line, details in `<details>`).
+2. **Act**: Render the 1-line verdict + collapsed findings list (severity, rule/category, file:location) per Output Format below — output-only, no files written; this is embedded by the caller into the review body's five Security sections (D22 — verdict in ~1 line, details in `<details>`).
 3. **Verify**: Verdict emitted. If any **introduced** finding is red → flag explicitly for the caller: this is the AC4 signal that drives `/pair-process-review`'s CHANGES-REQUESTED decision (the decision itself stays `/pair-process-review`'s, per its own Step 5.2 table — this skill only reports the finding).
 
 ## Audit Mode (one-shot)
@@ -133,7 +133,7 @@ SECURITY AUDIT COMPLETE:
 When composed by `/pair-process-review` (Phase 2):
 
 - **Input**: `/pair-process-review` invokes `/pair-capability-assess-security` with `$mode: review` against the PR diff.
-- **Output**: Returns the verdict + collapsed findings (Review Mode output above). `/pair-process-review` embeds it verbatim into the review report's Security Review section and, if any introduced finding is red, factors it into its own CHANGES-REQUESTED decision (Step 5.2).
+- **Output**: Returns the verdict + collapsed findings (Review Mode output above). `/pair-process-review` embeds it verbatim into the review body's five Security sections and, if any introduced finding is red, factors it into its own CHANGES-REQUESTED decision (Step 5.2).
 - **Persistence**: None — review mode writes nothing.
 
 When invoked **independently** in audit mode: