Integrate the repository-owned review suite into implement-epic-sequence

[shaug]

Parent epic: #4

Blocked by the completed review-code-change orchestration issue.

Goal

Update implement-epic-sequence to use the repository-owned review-code-change suite as its review dependency. Keep epic execution responsible for candidate preparation, fix application, remote feedback, merge gates, and bounded workflow control; move review judgment and rubric ownership entirely into the review suite.

The target skill was introduced by PR #2. Before implementation, verify that skills/implement-epic-sequence exists on the current base branch and re-read its live contents rather than relying on this issue's description of the original branch.

Required changes

Replace the review dependency

• Remove direct runtime references to code-review-pro and any other third-party review skill.
• Require review-code-change for the local adversarial review gate.
• Verify the repository-owned dependency is installed/available before starting a merge-inclusive epic run.
• If unavailable, stop with an explicit missing-dependency result; do not silently weaken the gate or substitute a generic reviewer.

Separate mechanics from judgment

Keep these responsibilities in implement-epic-sequence:

• determine when review occurs;
• capture/verify clean candidate and worktree integrity;
• provide live ticket, repository, diff, and validation artifacts;
• apply accepted fixes in the primary implementation context;
• commit, push, and rebuild evidence after changes;
• monitor CI, human review, connector review, and GitHub threads;
• enforce merge authority and cleanup;
• bound review/fix cycles.

Move or remove duplicated definitions of:

• correctness dimensions;
• solution-simplicity and code-simplicity rubrics;
• finding classification details owned by the shared contract;
• lens ordering and aggregation internals.

The canonical rubric must live in the review suite. implement-epic-sequence should consume its verdict and findings.

Review/fix behavior

• Invoke review-code-change with raw artifacts and a fresh/minimally inherited read-only context.
• Do not leak the implementation transcript, intended solution, prior conclusions, or suspected findings.
• Apply only blocking and strong-recommendation findings that are material, tractable, and ticket-scoped.
• Preserve deferred findings without expanding the active PR.
• After fixes, run affected and required validation, commit, push, and invoke the suite on the new candidate according to its re-review instructions.
• Use at most three full fix/re-review cycles by default.
• Keep the PR open and report unresolved material findings after the final cycle.

Candidate identity and base drift

Replace the universal exact head/base-pair invalidation rule with:

• all local review evidence is bound to the reviewed head;
• a head-changing edit, rebase, conflict resolution, or update invalidates head-bound evidence;
• when only the base advances, build or inspect the current merge candidate;
• retain head-bound review evidence when the effective diff and resulting tree are unchanged, no conflict or relevant overlap exists, and repository policy allows retention;
• rerun affected validation/review when the merge candidate changes or relevant base code overlaps;
• restart every required gate when repository policy explicitly demands it;
• record why evidence was retained or invalidated.

Do not weaken GitHub's required checks or the repository's configured human/connector policy.

Remote review gates

Preserve:

• thread-aware feedback reads;
• evidence-based disposition of every actionable conversation comment, formal review, connector finding, and inline thread;
• current-head connector verdict requirements when a connector is configured;
• no inference of approval from green CI;
• bounded connector feedback passes;
• immediate pre-merge refresh of head, merge candidate, checks, comments, reviews, and threads.

Human and connector review remain conditional on repository/user policy; the local repository-owned review suite is the default independent adversarial review.

Progressive disclosure

Reduce duplication among:

• skills/implement-epic-sequence/SKILL.md;
• references/review-and-merge-gates.md; and
• references/github.md.

Keep the core epic skill focused on the execution loop. Keep GitHub-specific review evidence in the GitHub adapter. Keep generic merge mechanics in the review/merge reference. Point to the review suite instead of copying its rubric.

Non-goals

• Change epic dependency selection, tracker ownership, implementation isolation, merge authority, cleanup, or closeout semantics unrelated to review.
• Add new review lenses.
• Make the review suite responsible for applying fixes or mutating GitHub.
• Remove required CI, human, or connector gates.
• Merge PR feat: add epic sequence implementation skill #2 or close this issue without the normal repository workflow.
• Preserve obsolete text solely for backward compatibility.

Evaluation requirements

Forward-test the integrated skill on representative scenarios:

1. A child PR with a correctness finding that is fixed and re-reviewed.
2. A solution-simplicity finding that triggers redesign before detailed review continues.
3. A code-simplicity improvement followed by targeted correctness recheck.
4. Unrelated base drift where the effective candidate is unchanged and evidence is retained with justification.
5. Relevant base drift or conflict where affected gates restart.
6. Missing review-code-change dependency that fails closed.
7. A clean candidate with required connector/human policy still enforced separately.

Use raw ticket/repository artifacts and fresh review contexts.

Acceptance criteria

• No runtime reference to code-review-pro or another third-party review skill remains in implement-epic-sequence.
• review-code-change is the single local adversarial-review dependency.
• Missing suite dependencies fail closed explicitly.
• Review rubric duplication is removed from the epic skill and references.
• The epic workflow consumes shared verdicts without owning lens internals.
• Fix application, revalidation, push, remote review, merge, and cleanup remain owned by the epic workflow.
• Review/fix cycles remain bounded to three by default.
• Head changes invalidate head-bound evidence.
• Base-only drift uses merge-candidate analysis and targeted invalidation.
• CI, human, connector, conversation, and thread gates are not weakened.
• Progressive disclosure keeps core and references concise and non-duplicative.
• All required integration forward tests pass.
• just format, just lint, and just test pass.
• README, skill metadata, and CHANGELOG are current.