Gentle AI v2.2.3-rc.4: Safer Review Recovery at Repository Scale

What's New

This immutable refresh is 15 commits ahead of v2.2.3-rc.3. It lets an unchanged candidate continue through organic delivery after review is declined, makes review startup scale to large repositories, and improves OpenCode and agent recovery guidance without weakening release protection.

Changes

Review lifecycle

• Candidate-scoped decline: Declining review creates no review lineage or receipt, but the exact unchanged candidate can continue under ordinary repository policy. Candidate drift asks again, and release remains protected. (#2045, #2046)
• Large-repository review start: START no longer materializes the complete repository path inventory. Reviewer references are checked exactly against the immutable base and candidate trees, so small candidates scale independently of repository size while directory and fabricated references fail safely. (#2058, #2061)
• Inconclusive scoped validation: An inconclusive validation is rejected without consuming the correction attempt or changing review state, allowing validation to be captured again after inspection access is restored.

OpenCode / agents

• Neutral reviewer recovery: OpenCode admission rejection now asks for reviewer relaunch without incorrectly attributing every rejection to severe changed-line anchoring. (#2000, 5fe75204)
• Provider-defect handoff: SDD agents use consent-first reporting and preserve consumer-project state instead of offering to switch repositories and repair Gentle AI directly. (#2060, #2062)
• Codex multi-agent v2: Generated Codex guidance targets the v2 lifecycle and waits for successful terminal completion before dependent work continues. (#2030)

Documentation

• OpenCode readonly workaround: If reviewer launch fails with Attempted to assign to readonly property, restart OpenCode with OPENCODE_EXPERIMENTAL=false opencode, reopen the same session, refresh gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --next-transition, and relaunch only the slot STATUS reoffers. This is a documented workaround for an unresolved upstream OpenCode issue, not an upstream fix. (#2065, #2066)
• README flows: New diagrams show organic and SDD paths converging on receipt-driven development.

Community Testing

1. Decline review for one candidate, confirm ordinary commit/push/PR delivery works while it is unchanged, then modify it and confirm consent is requested again. Confirm release remains blocked without review approval.
2. Start review for a small candidate in a repository with a large path inventory. Confirm valid immutable file references are accepted and directory or fabricated references are rejected.
3. Exercise OpenCode reviewer-admission rejection with incomplete inspection and no findings. Confirm the recovery message remains neutral and asks for relaunch.
4. If the readonly task-argument error appears, follow the documented restart and same-session STATUS recovery exactly, then report whether the pending slot relaunches successfully.
5. Exercise Codex multi-agent v2 completion and an inconclusive scoped validation; confirm dependent work waits for terminal success and validation can be retried without losing its correction attempt.

Validation

• Source: 0126077c23e8e542bf79f98dc427fbed96086517, 15 commits after v2.2.3-rc.3.
• Required CI: run 30586290865 passed all nine jobs for the exact source commit.
• Optional Windows suite: The non-gating Windows Full Suite run 30586290964 failed.

Distribution

This prerelease does not update Homebrew. Download the platform binary from the prerelease assets. Binaries are unsigned; integrity is provided only through SHA256SUMS.txt, so verify the downloaded file's SHA-256 before running it.