One independent review

Review in SDLC Studio is independent of the author, by construction. Every unit gets one reviewer who did not write it, one verdict in one ledger, and at most two rounds. The run then gets one signature.

One reviewer per unit

The reviewer is a fresh context, briefed by the tool rather than by the author:

critic.py brief --unit US0560 --seat qa

The brief carries the seat’s charter, the unit’s acceptance criteria as law, its diff scope - the declared Affects against the run’s base ref - and the history of the files it touches. A hand-written prompt carries none of that, and quietly swaps a bounded review for an unbounded one.

The verdict goes into one ledger:

critic.py record --unit US0560 --verdict REJECT --brief <fingerprint> \
  --reviewer "Sam (QA seat, a fresh context)" \
  --author   "Dani (Engineering seat)" \
  --issues   "[new] a blank title is saved as an empty task (tasks.ts:40)"

Reviewer and author must differ. A self-review is the context that wrote the code agreeing with itself, and it clears nothing. Conformance, the close, the signature and the sprint report all decide from this one ledger, so there is no second record to fall out of step with it.

Each finding carries its origin - [regression], [new] or [pre-existing] - decided by execution, and only the first two block. A review judges the unit’s own diff, not the state of the whole tree; Review and close has the full rule.

Two rounds, then carry

Round one reviews. Round two re-checks the fixes, and it comes from the reviewer who rejected, because it answers that reviewer’s findings. critic.py record refuses a third round.

A unit still rejected at the cap is carried: its findings are filed as a bug, the unit leaves the batch, and it is delivered again in a later run. The sprint report names it as a known issue. It is not argued over a third time.

The cap exists because more rounds bought little. Before v6, one run on this project spent 75% of its hours in review, across 18 rounds; the evidence page sets that measurement beside the capped runs that followed.

One signature per run

Nobody signs a unit. The close files a one-page report stating every known issue, and the operator reads it and signs the run once:

sprint.py sign --report RPT0001 --principal "You"

That one command moves each unit to Done or Fixed, each gated on its criteria having passed. It refuses a principal who authored a unit or is recorded as its reviewer, before anything is written. See sign once.

Why mechanical

Volume is the problem. When an agent authors most of the change, “please have someone review it” collapses under load, and the tempting shortcut is to let the author bless their own work. Making the separation mechanical removes the shortcut: a verdict whose reviewer is its author never counts as a review, and the signature refuses anybody who wrote or reviewed the work, so the human reads evidence someone else produced rather than re-reading every line.

What v6 took away

v5 could wrap each unit in more paper, some of it on by default and some opt-in: an evidence record beside the verdict, a separate sign-off per unit, a batch review, and a written repair plan after a REJECT. v6 retires all of it. The verdict ledger answers whether a unit was reviewed, and the run’s one signature answers whether it ships. Upgrading to v6 lists each retired verb with what replaced it.