feat(review): variant G on #3648's dispatch: Blocks: yes collects as CRITICAL, batched checklists by name (GSTA-167)

Integrates parts 1 and 2 with gstack-review-dispatch (#3648):
- lib/review-ledger.ts parseFindings: a prose voice's "Blocks: yes" makes its
  own line, or the finding on the line just before it, CRITICAL in
  merged.jsonl (normalizer v2, certified by round 5's G1), so judge refuses a
  lead that keeps it below the floor; with no finding before it the Blocks
  line is its own CRITICAL finding. "Blocks: no" never lowers a label.
- lib/review-brief.ts: the outside-voice brief no longer appends "Give each
  finding a severity"; the section's prompt now asks for Severity and Blocks,
  so the brief is the certified section prompt plus the branch diff.
- bin/gstack-review-dispatch render --checklists takes the plan's
  checklists= names (review/specialists/<name>.md) as well as paths and
  refuses an unknown one, since the batched reader is now every depth's
  specialist dispatch.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

bin/gstack-review-dispatch

@@ -24,7 +24,7 @@ const HELP = `gstack-review-dispatch — verbatim reviewer briefs and loss-free
       roles: ${BRIEF_ROLES.join(', ')}
       slots: --diff-base <sha> (every role but fix-check)  --exclude '<DIFF_CMD tail>'  --stack <s>  --test-fw <s>
              --learnings-file <f>  --checklist <path> (default <root>/review/specialists/<name>.md; red-team.md for red-team)
-             --checklists <a,b> (specialist-batched)  --findings-file <f> --specialists <n> (red-team)
+             --checklists <a,b> (specialist-batched: the plan's checklists= names, or paths)  --findings-file <f> --specialists <n> (red-team)
              --fix-list <f> --hunks <f> --tests <f> [--callers <f>] (fix-check)
       writes <out>/<role>[-<name>].prompt.md, records it in the ledger (default <out>/review-ledger.jsonl) and prints
       BRIEF: reader=<role/name> sha256=<h> bytes=<n> file=<path>. Pass that file's content as the reader's prompt, unchanged.
@@ -57,6 +57,8 @@ function render(): number {
   const diffBase = flag('--diff-base');
   const checklist = flag('--checklist') ?? (role === 'red-team' ? path.join(ROOT, 'review/specialists/red-team.md') : role === 'specialist' && name ? path.join(ROOT, 'review/specialists', `${name}.md`) : undefined);
   if (checklist && (role === 'specialist' || role === 'red-team') && !fs.existsSync(checklist)) throw new BriefError(`checklist not found: ${checklist}`);
+  const checklists = flag('--checklists')?.split(',').map(s => s.trim()).filter(Boolean).map(c => (c.includes('/') ? c : path.join(ROOT, 'review/specialists', `${c}.md`)));
+  for (const c of checklists ?? []) if (!fs.existsSync(c)) throw new BriefError(`checklist not found: ${c}`);
   let diff: string | undefined;
   if (role === 'outside-voice' && diffBase) {
     const r = spawnSync('git', ['-c', 'core.quotePath=false', 'diff', '--no-color', '--no-ext-diff', diffBase], { encoding: 'utf8', timeout: 60_000, maxBuffer: 256 * 1024 * 1024 });
@@ -65,7 +67,7 @@ function render(): number {
   }
   const slots: Slots = {
     name, diff_base: diffBase, exclude: flag('--exclude'), stack: flag('--stack'), test_fw: flag('--test-fw'),
-    learnings: readFile(flag('--learnings-file'), 'learnings'), checklist, checklists: flag('--checklists'),
+    learnings: readFile(flag('--learnings-file'), 'learnings'), checklist, checklists: checklists?.join(','),
     findings: readFile(flag('--findings-file'), 'findings'), specialists: flag('--specialists'), diff,
     fix_list: readFile(flag('--fix-list'), 'fix list'), hunks: readFile(flag('--hunks'), 'hunks'), tests: readFile(flag('--tests'), 'tests'), callers: readFile(flag('--callers'), 'callers'),
   };

docs/review-policy.md

@@ -413,7 +413,9 @@ ones, and the arm lost blockers. `bin/gstack-review-dispatch` closes both ends:
    `merged.jsonl` with the label exactly as written (a JSON line's `severity`, or a
    prose line's Critical, High, Medium, Low, P0-P3, FIXABLE or INVESTIGATE wherever it
    stands, headings and table rows included; a top-level list item under a label-only
-   heading takes that label). A phantom finding costs a fold; a lost one costs the gate.
+   heading takes that label). A prose voice's `Blocks: yes` collects as CRITICAL: on
+   its own line, or on the finding just before it; with no finding there it is one
+   (normalizer v2, GSTA-167). A phantom finding costs a fold; a lost one costs the gate.
 4. Lead judgment writes `judged.jsonl`; `judge` refuses a set that drops a merged
    finding, lowers its severity, folds it into a less severe duplicate, or adds or
    promotes one without a reason (`JUDGMENT_REJECTED`). A merged file missing any id

lib/review-brief.ts

@@ -117,7 +117,7 @@ function renderRole(role: BriefRole, slots: Slots, t: SectionTexts): string {
       return fill(t.native, [['DIFF_BASE=$(git merge-base origin/<base> HEAD)', `DIFF_BASE=${diffBase}`]], role);
     case 'outside-voice': {
       const body = fill(t.outside, [['DIFF_BASE=$(git merge-base origin/<base> HEAD)', `DIFF_BASE=${diffBase}`]], role);
-      return [body, '', 'Give each finding a severity: Critical, High, Medium or Low.', '', `## Branch diff (git diff ${diffBase})`, FENCE + 'diff', (slots.diff ?? '').trim(), FENCE].join('\n');
+      return [body, '', `## Branch diff (git diff ${diffBase})`, FENCE + 'diff', (slots.diff ?? '').trim(), FENCE].join('\n');
     }
     case 'fix-check':
       return renderFixCheckPrompt({ fixList: need(slots, 'fix_list'), touchedHunks: need(slots, 'hunks'), testResults: need(slots, 'tests'), callers: slots.callers ?? '' });

lib/review-ledger.ts

@@ -8,7 +8,8 @@
  *   judgment  each lead-judgment change: an added or promoted finding, with its reason
  *   judge     the verdict on the parent's judged set (ok, or the dropped and downgraded ids)
  *
- * Findings reach merged.jsonl only through collect, with each voice's label exactly as written.
+ * Findings reach merged.jsonl only through collect, with each voice's label exactly as written,
+ * except that a prose voice's `Blocks: yes` collects as CRITICAL (GSTA-167 normalizer v2).
  * The parent's judged set may add or promote a finding and may fold a duplicate into one at least
  * as severe; it never drops or downgrades one. verify replays every check from the ledger alone.
  */
@@ -53,29 +54,47 @@ const LABEL_HEADING = new RegExp(`^(?:#{1,6}\\s*|\\*\\*)(${LABELS})(?:\\s+(?:fin
 const HEADING = /^(?:#{1,6}\s|\*\*[^*]+\*\*:?$)/;
 const LIST_ITEM = /^(?:[-*+]|\d+[.)])\s+\S/;
 const stronger = (a: string, b: string) => ((rank(a) ?? 0) >= (rank(b) ?? 0) ? a : b);
+/** A prose voice's `Blocks: yes` (GSTA-167 normalizer v2): the finding is CRITICAL whatever its label; `Blocks: no` never lowers one. */
+const BLOCKS_YES = /(?<![A-Za-z0-9])Blocks:?\**:?\s*\**\s*yes(?![A-Za-z0-9])/i;
 
 export interface MergedLine { id: string; reader: string; label: string; raw: string; output_sha256: string }
 
-/** One reader's findings as written: a JSON object per line (severity kept as written); else each prose line carrying a severity or FIXABLE/INVESTIGATE label, and each top-level list item under a label-only heading (the stronger of the two labels). */
+/**
+ * One reader's findings as written: a JSON object per line (severity kept as written); else each prose line carrying a severity or
+ * FIXABLE/INVESTIGATE label, and each top-level list item under a label-only heading (the stronger of the two labels). A
+ * `Blocks: yes` makes its own line CRITICAL, or the finding on the line just before it; with no finding there it is one.
+ */
 export function parseFindings(reader: string, output: string): Array<{ label: string; raw: string }> {
   const out: Array<{ label: string; raw: string }> = [];
   let section: string | null = null;
+  let previous: { label: string; raw: string } | null = null;
+  let previousText = '';
   for (const line of output.replace(/\r\n/g, '\n').split('\n')) {
     const t = line.trim();
-    if (!t || /^NO FINDINGS\.?$/.test(t) || /^Recommendation:/i.test(t)) continue;
+    if (!t) continue;
+    const before: { label: string; raw: string } | null = previous;
+    const beforeText = previousText;
+    previous = null;
+    previousText = t;
+    if (/^NO FINDINGS\.?$/.test(t) || /^Recommendation:/i.test(t)) continue;
+    if (BLOCKS_YES.test(t) && !ANY_LABEL.test(t) && !t.startsWith('{')) {
+      if (before) { before.label = 'CRITICAL'; before.raw += ` | ${t}`; previous = before; }
+      else out.push(previous = { label: 'CRITICAL', raw: beforeText ? `${beforeText} | ${t}` : t });
+      continue;
+    }
     const heading = LABEL_HEADING.exec(t);
     if (heading) { section = heading[1]!; continue; }
     if (line === line.trimStart() && HEADING.test(t)) section = null;
     if (t.startsWith('{')) {
       try {
         const o = JSON.parse(t) as Record<string, unknown>;
-        if (typeof o.severity === 'string') { out.push({ label: o.severity, raw: t }); continue; }
+        if (typeof o.severity === 'string') { out.push(previous = { label: o.severity, raw: t }); continue; }
       } catch { /* prose that starts with a brace */ }
     }
     const inline = ANY_LABEL.exec(t)?.[1];
     const inherited = section && line === line.trimStart() && LIST_ITEM.test(t) ? section : undefined;
     const label = inline && inherited ? stronger(inherited, inline) : inline ?? inherited;
-    if (label) out.push({ label, raw: t });
+    if (label) out.push(previous = { label: BLOCKS_YES.test(t) ? 'CRITICAL' : label, raw: t });
   }
   return out;
 }

test/review-dispatch.test.ts

@@ -73,6 +73,19 @@ describe('gstack-review-dispatch render: briefs from the sections, slots only',
     expect(fs.readFileSync(path.join(out, 'review-ledger.jsonl'), 'utf8')).toContain('"event":"rendered"');
     expect(run(['render', '--role', 'specialist', '--name', 'no-such-specialist', '--out', out, '--diff-base', SHA]).stderr).toContain('BRIEF_RENDER_FAILED: checklist not found');
   });
+
+  // Value: protects=the lean ensemble's one batched reader (GSTA-167 part 2) gets checklist paths when the parent passes the plan's
+  //   checklists= names as printed; fails_when=the brief names bare checklist words a reader cannot open, or an unknown name
+  //   renders; seam=gstack-review-dispatch render
+  test('specialist-batched takes the DISPATCH checklists= names and writes each checklist path into the brief', () => {
+    const out = tmp();
+    const r = run(['render', '--role', 'specialist-batched', '--out', out, '--diff-base', SHA, '--checklists', 'testing,security,state-machines']);
+    expect(r.status, r.stderr).toBe(0);
+    const root = path.join(import.meta.dir, '..');
+    const lists = ['testing', 'security', 'state-machines'].map(n => path.join(root, 'review/specialists', `${n}.md`)).join(', ');
+    expect(fs.readFileSync(field(r.stdout, 'file'), 'utf8')).toContain(`Read each checklist at ${lists} (tag each finding's`);
+    expect(run(['render', '--role', 'specialist-batched', '--out', out, '--diff-base', SHA, '--checklists', 'testing,maintenance']).stderr).toContain('BRIEF_RENDER_FAILED: checklist not found');
+  });
 });
 
 describe('gstack-review-dispatch sent, collect, judge and verify: nothing changed on the way in or out', () => {
@@ -214,6 +227,31 @@ describe('gstack-review-dispatch sent, collect, judge and verify: nothing change
     expect(judge(m, [{ id: 'r#1', severity: 'INFORMATIONAL', reason: 'a real defect' }]).ok).toBe(true);
   });
 
+  // Value: protects=normalizer v2 in production (GSTA-167 part 1, certified by round 5's G1): a prose voice's Blocks: yes reaches
+  //   merged.jsonl as CRITICAL, so judge refuses a lead that keeps it below the floor; Blocks: no never lowers a label;
+  //   fails_when=a Blocks: yes finding is collected at its Medium or INVESTIGATE label, a Blocks line with no finding before it is
+  //   lost, or Blocks: no demotes; seam=parseFindings, judge
+  test('a prose voice\'s Blocks: yes collects as CRITICAL, on its own line or the finding just before it; Blocks: no never lowers', () => {
+    const out = [
+      '1. Retry loop drops the last row (queue.ts:78). Severity: Medium · Blocks: yes',
+      '2. INVESTIGATE: lock order in pool.ts:12',
+      '   Blocks: yes',
+      '3. FIXABLE: stale cache key (cache.ts:4)',
+      '   Severity: High',
+      '   Blocks: no',
+      '4. Token never expires (auth.ts:9)',
+      '   Fix: check exp',
+      '   **Blocks:** yes',
+      'Recommendation: Fix the retry loop because it loses rows',
+    ].join('\n');
+    const got = parseFindings('outside-voice', out);
+    expect(got.map(g => g.label)).toEqual(['CRITICAL', 'CRITICAL', 'FIXABLE', 'High', 'CRITICAL']);
+    expect(got[1]!.raw).toBe('2. INVESTIGATE: lock order in pool.ts:12 | Blocks: yes');
+    expect(got[4]!.raw).toBe('Fix: check exp | **Blocks:** yes');
+    const m: MergedLine[] = got.map((g, i) => ({ id: `o#${i + 1}`, reader: 'outside-voice', label: g.label, raw: g.raw, output_sha256: 'h' }));
+    expect(judge(m, m.map(x => ({ id: x.id, severity: x.label === 'CRITICAL' ? 'Medium' : x.label }))).downgraded).toEqual(['o#1', 'o#2', 'o#5']);
+  });
+
   test('verify on a ledger that kept no prompts says so and exits 3', () => {
     const d = tmp();
     const ledger = path.join(d, 'ledger.jsonl');