Portable review bundle and independent review

<!-- sflow-copilot-pause -->

Reuse a verified pause-aware entry supplied in this invocation before any mutation or selection change; otherwise first run singularity-flow session current --for-agent --json once; pause precedes Git. If paused: native Copilot, only /sf-pause off, never resume implicitly. Reuse binding/personalization.replyName; fresh operation checks/consent remain required.

<!-- sflow-output-contract: governed-review -->

Output contract: Present artifact references, hashes, identity warnings, and the exact confirmation before recording any decision. Summarize artifacts with verified Markdown-preview links; never paste document bodies, code or diffs into Copilot. For code, list touched paths and observed added/deleted/created line counts; unavailable stays unavailable. Use existing evidence, not extra calls solely for display. Summaries, links and opened previews are not human review or approval. For every next action, honor returned commandGuidance in order: Copilot, Shell, VS Code (model-free) using modelFreeCommand; if absent, say "not available for this action". Missing Copilot: "no verified equivalent". Never invent routes. Run a check only when a returned field or command asks for it; never decide from a step's name, kind or route that it applies. A refusal saying a check does not apply to this step is not a blocker: skip it and continue. Act on a result's act first: its state, do routes and any ask. A bounded result names agentOutput.read ranges and omittedFields text files; read all in one response with your file tool. If your host saved a result to a file you cannot open, run that command again with --for-agent --json; never read the host's copy with shell tools.

<!-- sflow-execution-boundary -->

Boundary: reuse entry ready/workId, cwd=repositoryPath; CLI/workItemRoot paths only; never $HOME. No duplicate lookup. Use exact CLI-returned paths. repositoryPath is command cwd, not a prefix for absolute file paths. Never rebase paths or strip .git/worktrees. Issued private/external files are exact exceptions to repository confinement, not wider read/write permission; writes still need authorization. Resolve relative paths only against their declared base. On failure, preserve the path and error; never search or recreate it.

Run singularity-flow review <phase> --format json for the explicit or active phase. Inspect artifacts, checks, decisions, diff/evidence; not retained source review or approval. HTML: singularity-flow review <phase> --format html --out <file>.

1. Run singularity-flow status --for-agent --json and singularity-flow phase show <phase> --for-agent --json. Author only the current in-progress phase with verified effective authoring skill /sf-review. Otherwise perform inspection steps 3–6 and handoff 10; never compose, publish or invent a review phase.
2. For that authoring phase only, read Story context and singularity-flow wm compose --phase <phase> --evidence; use its complete prompt. Never derive --task from Story text.
3. Read approved inputs, implementation summary, verification evidence, diff and cited source.
4. Review correctness, acceptance coverage, maintainability, architecture alignment, security, failures, observability, rollout, rollback, and tests.
5. Rank findings by severity with file/line references.
6. Do not silently fix findings unless explicitly asked.
7. Prepare/author that configured review phase, then singularity-flow phase prepublish <phase> --for-agent --json --publish-if-ready (includes draft-check). If unready, act on its commands.next and repairLoop.protocol; stay here. Correct every agent authoring finding now only when correction.sameTurn; route other producers to their owner. Never delete markers blindly, invent facts/padding, nest models or overwrite producers. Substantive findings need a separate human fix decision: publish them in the review, then offer the approver's post-submission /sf-reject --to <OWNING-STEP>, or singularity-flow upstream-issue raise --phase <OWNING-STEP> --about <ID> --problem "<TEXT>" for /sf-decide. Follow returned repairLoop.protocol; stop unchanged.
8. Use returned commands.publish when ready unless publishIfReady.published; absent: relay commands.next, stop. Race-time ARTIFACT_AUTHORING_INCOMPLETE: recheck once, retry once if ready, never loop. Never submit or approve.
9. If published, from publishIfReady.review summarize findings/status and give verified Markdown-preview links with generation/hashes and current reviewBinding. Read exact source/artifact bytes for the independent review, but never reproduce bodies/code/diffs in chat. Summaries/links are not human review; document reuse never reuses approval consent.
10. After authoring, refresh singularity-flow review <phase> --format json. Relay continuation.actions: phase and all three surfaces per the Output contract. Correction, review, human disposition and recovery precede Submit. If absent, singularity-flow nextsteps <WORK-ID> --for-agent --json. Never submit or approve automatically.