Tie reviews to the exact reviewed version with a fingerprint

[taspinar]

What changed

• New scripts/lib/fingerprint.sh: the Git tree hash of the current file contents, for the whole working tree or an explicit set of paths (files, directories, symlinks). Uncommitted and untracked changes count; ignored files count only when Git tracks them; review and triage artifacts never count. It depends on content, not commits.
• review-feature.sh records the fingerprint as reviewed_tree, and reviewed_paths (null for a whole-tree review). Review artifacts accept reviewed_paths.
• triage-review.sh and apply-triage.sh refuse a stale review before starting an agent.
• New scripts/check-review.sh <review-json>: exit 0 when current, 1 when stale, 2 on an error. Ready for finish-planning.sh in wave 4.
• Review and triage runs also detect an agent changing the artifacts that fingerprints leave out.
• docs/development.md explains when a review becomes stale.
• New tests/fingerprint-test.sh; test fixtures now carry real fingerprints, and the triage and apply-triage suites cover stale reviews.

Issue / acceptance criteria

Closes #38

Risk

• Low
• Medium
• High

Verification evidence

• ./scripts/verify.sh passed (10 checks)
• Tests added/updated where appropriate (also passing under macOS system bash 3.2)
• Independent review completed when required
• Architecture/docs/ADR updated when required

Independent review: Codex (gpt-6-astra) through the isolated read-only profile. CHANGES REQUIRED:

• M1 (replacing the full snapshot with the fingerprint dropped detection of a reviewer changing review or triage artifacts): fixed with a separate artifact hash, with a regression test.
• MIN1 (explicit file sets did not exclude artifacts): fixed, with a test.
• MIN2 (dangling symlinks were treated as absent in file sets): fixed, with a test.

check-review.sh reported the new review as current right after it was written. Not re-reviewed after the fixes.

Agent involvement

Planner: —
Implementer: Claude (Opus 5.5)
Reviewer: Codex (gpt-6-astra)

Production impact

None.

🤖 Generated with Claude Code