Design a canonical review-result boundary for deterministic archive eligibility

[jrpbuilds]

Parent

Part of #46.

Relationships

Follows #50, which resolved the archive boundary by documenting that archive legality cannot yet be represented deterministically and keeping it out of lifecycle/eligibleActions.

Goal

Design a canonical, durable representation of review results so SpecOps can truthfully derive archive legality from state, instead of keeping the passed-review-before-archive invariant as coordinator-owned prompt guidance.

The desired end state is the second half of the #50 invariant:

If OpenSpec durably records that review passed, archive legality becomes a canonically derivable fact — and only then may lifecycle/eligibleActions emit it.

Problem

SpecOps policy requires a successful review before archiving, but review PASS/FAIL lives only in coordinator conversation state. OpenSpec exposes structural archive readiness, which proves nothing about review outcomes. #50 therefore ruled that:

• specops_archive and specops_archive_instructions expose the operation and structural context only;
• no archive.allowed legality fact may be manufactured from structural readiness;
• the passed-review-before-archive invariant stays minimal coordinator prompt guidance (see "The archive boundary" in docs/architecture.md).

This issue is the separately scoped change that replaces that prompt-level invariant with durable state.

Scope

• Survey options for where a review verdict could durably live (e.g. an OpenSpec-owned review record in the change directory vs a SpecOps-owned durable file), with the constraint that OpenSpec remains the durable source of workflow truth wherever a fact is actually represented there.
• Define the minimal schema: verdict (pass/fail), scope (which review run, which change), and recency relative to subsequent mutations — sufficient to prove every archive prerequisite.
• Define staleness rules: a recorded verdict must be invalidated by post-review changes (artifact edits, task changes, worktree mutations already tracked by the review guard) so stale passes cannot authorize archiving.
• Wire the canonical derivation: once a trustworthy source exists, extend workflow-state.ts/planning-completion.ts consumers so lifecycle and eligibleActions may emit an archive action exactly when the durable proof exists.
• Preserve the current fail-safe: absent or malformed review state must keep archive illegal, never default it to allowed.
• Update docs/architecture.md (the archive boundary section and decision table) once the boundary changes.
• Replace the coordinator prompt invariant only after deterministic tooling genuinely covers the protected behaviour.

Design constraints

• Do not add persistent review state merely to make a status field possible; the design must prove every archive prerequisite from canonical input state.
• Deterministic legality, not recommendation: deriving that archive is legal never implies the Coordinator should archive.
• Keep the shared layer a small pure derivation, not a transition framework.
• No judgement-driven decisions (review breadth, remediation strategy) move into TypeScript.

Acceptance criteria

• A durable, trustworthy source for review results is designed and implemented, with staleness invalidation.
• Archive legality is canonically derived and emitted in lifecycle/eligibleActions only when every prerequisite is durably provable.
• Absent, stale, or malformed review state keeps archive illegal and fails closed with a clear reason.
• Tests prove a recorded pass cannot authorize archiving after subsequent mutations.
• Tests do not assume archive legality from review success unless that success is represented in the canonical input state.
• docs/architecture.md archive boundary section and the coordinator prompt invariant are updated together.

Out of scope

• Rewriting coordinator/reviewer prompts beyond replacing the single archive invariant.
• Automatic archiving or dispatch.
• Changing the review evidence protocol or review breadth policy.