charlesrhoward · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026
@@ -12,6 +12,8 @@ import {
   prepareGitHubTextFile,
   type GitHubFileContent,
 } from "@/lib/agents/github-file-content";
+import { isRecord } from "@/lib/workflows/pr-review-harness-utils";
+import { clearsReviewWithoutFindings } from "@/lib/workflows/pr-review-report-state";
 
 const PR_REVIEW_FILE_CONTENT_CHAR_LIMIT = GITHUB_FILE_CONTENT_CHAR_LIMIT;
 const PR_REVIEW_PATCH_CHAR_LIMIT = 4_000;
@@ -58,14 +60,16 @@ export function buildPRReviewTools(config: {
   const request = config.fetch ?? fetch;
   const contentOwner = config.headOwner ?? config.owner;
   const contentRepo = config.headRepo ?? config.repo;
+  let claimedIssues = false;
+  let acceptedReport: Record<string, unknown> | null = null;
   const reviewFindingSchema = z.object({
     severity: z.enum(["critical", "warning", "suggestion"]),
     title: z.string(),
     body: z.string(),
     path: z.string().optional(),
     line: z.number().int().positive().optional(),
   });
-  const reportReviewInputSchema = z
+  const reportObjectSchema = z
     .object({
       hasIssues: z.boolean(),
       summary: z
@@ -88,10 +92,31 @@ export function buildPRReviewTools(config: {
           code: z.ZodIssueCode.custom,
           path: ["findings"],
           message:
-            "findings must include at least one entry when hasIssues=true",
+            "findings must include at least one entry when hasIssues=true. Call reportReview again with each issue as an entry in findings. Setting hasIssues=false without listing the issues leaves the review without a verdict.",
         });
       }
     });
+  // The claim is read before validation, so a report the schema rejects for
+  // any reason (a missing summary, an unknown severity) still counts; such
+  // reports never reach `execute`. The JSON schema the model sees is the
+  // object schema's own.
+  const reportReviewInputSchema = z.preprocess((input) => {
+    if (isRecord(input) && input.hasIssues === true) claimedIssues = true;
+    return input;
+  }, reportObjectSchema);
+
+  // Once a report has claimed issues, only an accepted report that lists
+  // findings can authorize a merge: none accepted means every claim was
+  // rejected, and one that clears the review has dropped them.
+  const droppedFindingsRefusal = () =>
+    claimedIssues &&
+    (acceptedReport === null || clearsReviewWithoutFindings(acceptedReport))
+      ? {
+          success: false as const,
+          error:
+            "Not merged: this review said it found issues but its report lists none. Report each issue as a finding.",
+        }
+      : null;
 
   const tools = {
     getPullRequest: tool({
@@ -222,7 +247,10 @@ export function buildPRReviewTools(config: {
       description:
         "Record the structured review result for workflow orchestration. Call exactly once after analysis.",
       inputSchema: reportReviewInputSchema,
-      execute: async (input) => input,
+      execute: async (input) => {
+        acceptedReport = input;
+        return input;
+      },
     }),
   };
 
@@ -236,6 +264,7 @@ export function buildPRReviewTools(config: {
               commitTitle: z.string().optional(),
             }),
             execute: async ({ commitTitle }) =>
+              droppedFindingsRefusal() ??
               mergePullRequestIfSafe({
                 githubToken: config.githubToken,
                 owner: config.owner,
@@ -252,6 +281,7 @@ export function buildPRReviewTools(config: {
               commitTitle: z.string().optional(),
             }),
             execute: async ({ commitTitle }) =>
+              droppedFindingsRefusal() ??
               queuePullRequestAutoMerge({
                 githubToken: config.githubToken,
                 owner: config.owner,

@@ -38,6 +38,7 @@ import { resolveAutomationModel } from "@/lib/workflows/automation-job-model-res
 import {
   emitToOutgoing,
   noteObservabilityError,
+  recordFlowNodeResult,
 } from "@/lib/workflows/automation-job-flow-run-state";
 import {
   executeEditRoleNode,
@@ -476,7 +477,7 @@ export async function executeFlowAgentNode(
 
   const handoffText = JSON.stringify(handoff);
   state.outputs.set(node.id, { label, text: handoffText, handoff });
-  state.results.push({ ...result, text: handoff.summary });
+  recordFlowNodeResult(state, { ...result, text: handoff.summary }, nodeRole);
 
   return {
     ok: true as const,

@@ -332,6 +332,7 @@ export async function runAutomationJob(
       releasedScope: input.releasedScope,
       context,
       finalResult: flowExecution.result,
+      reviewResult: flowExecution.reviewResult,
       autoMergeRequest: flowExecution.autoMergeRequest ?? null,
       observabilityError: flowExecution.observabilityError,
       isPrReview,

@@ -143,6 +143,7 @@ export type FlowExecutorDeps = {
 export type FlowExecutionSuccess = {
   success: true;
   result: AutomationAgentResult;
+  reviewResult: AutomationAgentResult | null;
   autoMergeRequest: FlowAutoMergeRequest | null;
   observabilityError: string | null;
 };
@@ -486,6 +487,7 @@ export async function executeResolvedFlow(input: {
     result: mergeAutomationAgentResults(
       state.results as AutomationAgentResult[]
     ),
+    reviewResult: state.reviewResult,
     autoMergeRequest: state.autoMergeRequest,
     observabilityError: state.observabilityError,
   };

@@ -8,7 +8,10 @@
  */
 
 import type { FlowGraph } from "@/lib/types";
-import type { FlowExecutionToken } from "@/lib/workflows/automation-job-types";
+import type {
+  AutomationAgentResult,
+  FlowExecutionToken,
+} from "@/lib/workflows/automation-job-types";
 import { FAILURE_HANDLE_ID, getOutgoingEdges } from "@/lib/flows/graph";
 import type { FlowReportHandoff } from "./flow-report-handoff";
 
@@ -49,6 +52,14 @@ export type FlowRunState = {
   /** Aggregated agent results */
   results: unknown[];
 
+  /**
+   * The last review node's own result. The flow's verdict comes from it, not
+   * from the merged transcript: a later review node re-reviews what an
+   * earlier one reported, and its clean report must not read as one that
+   * dropped the earlier node's findings.
+   */
+  reviewResult: AutomationAgentResult | null;
+
   /** First observability error encountered */
   observabilityError: string | null;
 
@@ -63,6 +74,16 @@ export type FlowRunState = {
   expectedTriggerHeadSha: string | null;
 };
 
+/** Adds an agent node's result; a review node's also becomes the verdict. */
+export function recordFlowNodeResult(
+  state: FlowRunState,
+  result: AutomationAgentResult,
+  role: string | null
+) {
+  state.results.push(result);
+  if (role === "review") state.reviewResult = result;
+}
+
 /**
  * Creates an initialized flow-run state container.
  */
@@ -86,6 +107,7 @@ export function createFlowRunState(input: {
     incomingCounts,
     processed: new Set(),
     results: [],
+    reviewResult: null,
     observabilityError: null,
     autoMergeRequest: null,
     expectedTriggerHeadSha: input.initialHeadSha,

@@ -44,6 +44,8 @@ export type FlowSuccessFinalizationInput = {
   releasedScope: ReleasedAutomationScope;
   context: JobContext;
   finalResult: AutomationAgentResult;
+  /** The last review node's own result; the verdict is read from it. */
+  reviewResult?: AutomationAgentResult | null;
   autoMergeRequest: FlowAutoMergeRequest | null;
   observabilityError?: string | null;
   isPrReview: boolean;
@@ -69,6 +71,23 @@ export type FlowSuccessFinalizationInput = {
   ) => Promise<AutomationJobRunResult>;
 };
 
+/**
+ * The verdict is the last review node's own; what the flow's fix nodes
+ * applied comes from the whole run.
+ */
+function extractFlowReviewResult(
+  finalResult: AutomationAgentResult,
+  reviewResult: AutomationAgentResult | null | undefined
+) {
+  const flow = extractPrReviewHarnessResult(finalResult);
+  if (!reviewResult) return flow;
+  const { autofix } = flow;
+  return {
+    ...extractPrReviewHarnessResult(reviewResult),
+    ...(autofix ? { autofix } : {}),
+  };
+}
+
 /**
  * Finalize a successful flow execution.
  *
@@ -83,6 +102,7 @@ export async function finalizeFlowSuccess(
     releasedScope,
     context,
     finalResult,
+    reviewResult,
     autoMergeRequest,
     observabilityError,
     isPrReview,
@@ -94,7 +114,7 @@ export async function finalizeFlowSuccess(
   } = input;
 
   const reviewHarnessResult = isPrReview
-    ? extractPrReviewHarnessResult(finalResult)
+    ? extractFlowReviewResult(finalResult, reviewResult)
     : null;
   const reviewOutcome = reviewHarnessResult?.reviewOutcome ?? null;
   const reviewCommentPosted = isPrReview

@@ -240,7 +240,7 @@ export function normalizeAutomationAgentResult(result: {
       inputTokens?: number | null;
       outputTokens?: number | null;
     } | null;
-    toolCalls?: Array<{ toolName: string; input: unknown }>;
+    toolCalls?: Array<{ toolName: string; input: unknown; invalid?: boolean }>;
     toolResults?: unknown[];
   }>;
 }): AutomationAgentResult {
@@ -252,6 +252,7 @@ export function normalizeAutomationAgentResult(result: {
       toolCalls: (step.toolCalls || []).map((toolCall) => ({
         toolName: toolCall.toolName,
         input: toolCall.input,
+        ...(toolCall.invalid === true ? { invalid: true } : {}),
       })),
       toolResults: step.toolResults,
     })),

@@ -132,7 +132,9 @@ export type AutomationAgentUsage = {
 export type AutomationAgentResult = {
   text: string;
   steps: Array<{
-    toolCalls?: Array<{ toolName: string; input: unknown }>;
+    // `invalid` marks a call the SDK rejected (its input failed the tool's
+    // schema); the call is kept so a reader can tell what was attempted.
+    toolCalls?: Array<{ toolName: string; input: unknown; invalid?: boolean }>;
     toolResults?: unknown[];
   }>;
   usage: AutomationAgentUsage | null;

@@ -10,6 +10,10 @@ import {
   toReviewFindings,
   toStringArray,
 } from "./pr-review-harness-utils";
+import {
+  readReviewReportState,
+  type ReviewReportState,
+} from "./pr-review-report-state";
 
 function extractLastToolInput(
   result: AutomationAgentReviewResult,
@@ -153,8 +157,9 @@ export function extractPrAutofixOutcome(
 
 /**
  * True when the reviewer finished without filing `reportReview` and nothing
- * else reported a problem. The "no issues" in that result is a default, not a
- * finding, so it must never be published as a clean verdict or allow a merge.
+ * else reported a problem, or filed one that dropped the issues it had
+ * claimed. The "no issues" in that result is a default, not a finding, so it
+ * must never be published as a clean verdict or allow a merge.
  */
 export function isPrReviewVerdictMissing(
   harnessResult: Pick<PrReviewHarnessResult, "source" | "reviewOutcome"> | null
@@ -166,22 +171,32 @@ export function isPrReviewVerdictMissing(
   );
 }
 
+function buildReportedHarnessResult(
+  result: AutomationAgentReviewResult,
+  reportState: Exclude<ReviewReportState, { kind: "missing" }>
+): PrReviewHarnessResult {
+  const { report } = reportState;
+  return {
+    source: reportState.kind === "filed" ? "structured" : "dropped_findings",
+    fallbackText: toOptionalString(result.text),
+    reviewOutcome: {
+      hasIssues: report.hasIssues === true,
+      summary: toOptionalString(report.summary) ?? result.text ?? "",
+      commentBody: toOptionalString(report.commentBody),
+      affectedFiles: toStringArray(report.affectedFiles),
+      findings: toReviewFindings(report.findings),
+    },
+  };
+}
+
 export function extractPrReviewHarnessResult(
   result: AutomationAgentReviewResult
 ): PrReviewHarnessResult {
-  const report = extractLastToolInput(result, "reportReview");
+  const reportState = readReviewReportState(result.steps);
   const autofix = extractPrAutofixOutcome(result);
-  if (report) {
+  if (reportState.kind !== "missing") {
     return {
-      source: "structured",
-      fallbackText: toOptionalString(result.text),
-      reviewOutcome: {
-        hasIssues: report.hasIssues === true,
-        summary: toOptionalString(report.summary) ?? result.text ?? "",
-        commentBody: toOptionalString(report.commentBody),
-        affectedFiles: toStringArray(report.affectedFiles),
-        findings: toReviewFindings(report.findings),
-      },
+      ...buildReportedHarnessResult(result, reportState),
       ...(autofix ? { autofix } : {}),
     };
   }

@@ -13,6 +13,8 @@ export function buildPrReviewContractNote(source: PrReviewContractSource) {
   switch (source) {
     case "legacy_post_comment":
       return "Note: Structured review output was missing, so Mogplex used the legacy review comment as fallback output.";
+    case "dropped_findings":
+      return "Note: The reviewer said it found issues but its report did not list them, so there is no verdict. The text below is its summary only. Rerun the review for a full result.";
     case "legacy_text":
       return "Note: The reviewer finished without filing its structured report, so there is no verdict. The text below is its closing summary only. Rerun the review for a full result.";
     case "structured":

@@ -3,7 +3,7 @@ import type { ReviewFinding } from "@/lib/types";
 export type AutomationAgentReviewResult = {
   text: string;
   steps: Array<{
-    toolCalls?: Array<{ toolName: string; input: unknown }>;
+    toolCalls?: Array<{ toolName: string; input: unknown; invalid?: boolean }>;
     toolResults?: unknown[];
   }>;
 };
@@ -32,6 +32,7 @@ export type PrAutofixOutcome = {
 
 export type PrReviewContractSource =
   | "structured"
+  | "dropped_findings"
   | "legacy_post_comment"
   | "legacy_text";