Refine the interactive apply model after design review. The permanence gate is
the push, not the commit: a local commit is private and reversible, and leaving
applied fixes uncommitted on a clean tree just creates a chore plus a window
where the user's next edits entangle with them.
- Stage 5c: when the working tree was clean before the review, commit the
applied fixes as one isolated `fix(review):` commit; on a dirty tree apply but
leave them for the user's commit (the fixes can't be isolated from WIP).
Never push, open PRs, or file tickets.
- Operating principle, After Review, the Applied report step, the output
template, the skill doc, and the plan all updated to commit-on-clean /
never-push (was "never commits or pushes").
- Contract tests updated to the new contract.
bun test: contract 29/0; full suite at the 47 pre-existing failures, zero new.
Simplification pass over ee7891ed found stale/contradictory prose the feature
commit missed:
- SKILL.md "After Review": dropped the "Review-only handoff / do not edit
project files" framing that contradicts Stage 5c default-mode apply; scoped
apply vs report-only by mode.
- ce-work / ce-work-beta followup: scoped the "review-only / does not mutate"
claim to the mode:agent invocation (true for the caller path) rather than
asserting it of the skill as a whole.
- docs/skills + output template: removed the stale safe_auto promotion bullet
and the deprecated report-only Mode-line value.
- contract test: de-duplicated the mutate-contract assertions across two tests
(each invariant asserted once in its relevant test) and fixed a misleading
comment.
Behavior preserved: contract tests 28/0; full suite at the 47 pre-existing
failures, zero new.
Re-introduce auto-fixing into ce-code-review as a lightweight, judgment-based
act policy (not the removed mode:autofix machinery). In default (interactive)
mode the review now applies the safe, verified fixes it is confident in and
reports them in an Applied section; in mode:agent it stays report-only and the
caller applies. It never commits or pushes — the human/caller owns permanence.
- Stage 5c "Act on findings (default mode only)": bias-to-act policy (apply
clear reversible improvements; push back if the reviewer is wrong; defer what
needs a decision), scope invariant (local-aligned/standalone only),
verify-then-keep (revert on red), no auto-commit, and prominent surfacing of
green-but-unverifiable edits (auth/contract/concurrency). No deny-list: a
code-review fix is a reversible edit, so downside is controlled after the fact
(revert + visible diff + commit checkpoint).
- Stage 6 + output template: Applied section (# | File | Fix | Reviewer +
validation line); applied findings keep their stable # and stay out of the
severity tables.
- Operating principles / Action Routing / autofix deprecation reframed:
autofix_class is signal, never an apply gate; mode:agent never mutates.
- ce-work and ce-work-beta apply step reframed from a conservative
"when unsure, skip" eligibility filter to the same bias-to-act policy.
- Contract test + numbering fixture cover the new behavior; skill doc updated
(also corrected pre-existing drift: removed safe_auto and four-modes framing).
Plan: docs/plans/2026-06-02-001-feat-ce-code-review-safe-autofix-plan.md
Trevin Chow