fix: harden native review publication

Author: CompleteDotTech

AGENTS.md

@@ -32,8 +32,11 @@ pull requests against this repo. This is the agent-specific layer; read
 
 ## Repo-specific invariants (don't break these)
 
-- This is a **thin hosted forwarder**, not the app logic. Familiar/authority and
-  GitHub-App behavior lives in `coven-github` — don't reimplement it here.
+- This is the **hosted deployment adapter**, not the canonical product worker.
+  Familiar/authority rules, result contracts, and GitHub App product behavior
+  live in `coven-github`; keep only deployment-specific webhook verification,
+  evidence capture, runtime invocation, and safe GitHub transport here. Do not
+  fork or redefine the canonical contracts in this repository.
 - **Never commit webhook secrets, signing secrets, App private keys, or tokens.**
   Configuration comes from the deploy environment, not the repo.
 - **Always verify the GitHub webhook signature** (`X-Hub-Signature-256`) before

README.md

@@ -106,15 +106,22 @@ connection guide in
   signed delivery -> policy route -> delivery/task/result state without calling
   GitHub or `coven-code`.
 - Captures PR checkout metadata and changed-file patches before invoking
-  `coven-code`.
+  `coven-code`, including paginated file lists and patch-completeness checks.
 - Publishes PR results as native GitHub reviews: complete no-finding evidence
   approves, actionable findings request changes, and incomplete or
   contradictory evidence is published as a comment review. Findings are made
   inline only when their captured diff location is valid; all other findings
-  remain in the review body.
+  remain in the review body. Decisive reviews are bound to the captured commit
+  and require full changed-file coverage, a clean matching checkout, and
+  verified passing test evidence. They are created pending, then submitted only
+  after a fresh head check; a concurrent head change causes a COMMENT downgrade
+  or automatic dismissal.
 - Persists publication identities and review/comment IDs in the configured
-  state directory so retries do not duplicate output and a newer review links
-  to the prior covencat publication it supersedes.
+  state directory, reconciles HMAC-signed App-authored identities with GitHub,
+  and serializes publication per PR so retries and concurrent runs do not
+  duplicate output.
+  Newer reviews link to superseded covencat output and dismiss its prior
+  decisive state when GitHub permits it.
 - Publishes non-PR task results and operational notices as issue comments,
   including structured `reviewed_files`, `supporting_files`, findings, test
   evidence, no-findings rationale, and limitations.