bin, spec: pipeline providers, SHA-bound approvals, Codex gate in review, rig-before-approval, epic merge wait

[mkovero]

Pipeline rework from 2026-09-01..03 (22 commits) that was never opened as a PR. main has been running the older bin/ scripts since: separate codex-qa.sh passes that can't target one PR, approvals not bound to the reviewed SHA, no recovery of interrupted revisions, no provider selection. Several failures hit on 2026-09-15 are ones this branch addresses.

What it changes (13 files, +838 / −398, bin/ and .agents/ only)

area	change
agent providers	AC_PROVIDER / AC_<ROLE>_PROVIDER (claude | codex, default claude) via a shared provider runner in common.sh; QA stays model-bound
Codex QA	bin/codex-qa.sh removed; independent Codex review moves into review.sh and a codex_gate in master.sh, run before the merge gate
approvals	QA approval bound to the reviewed head SHA; same-tip verdict reclassification allowed
rig	requires-rig stops before approval; spec routes rig-only evidence around the developer
handbacks	developer design/UX handbacks routed before PR lookup; rounds reset after a design handback; revise.sh may hand an issue back to design
epics	AC_WAIT_MERGE waits at a child until merged, requires an actual merge before advancing, stops on non-terminal child state; new bin/integrate.sh for conflicted epic PRs
recovery	resumes interrupted work; recovers interrupted Codex revisions (captures revise.sh exit, continues in the same worktree)
specs	AGENTS.md, qa.md, developer.md, codex-qa.md, architect.md: rig evidence before approval, bounded file reading, UX changes within the architect manifest

Checked on 2026-09-15 against current main (190c51b)

• git merge --no-commit origin/fix-qa-rig-routing into origin/main: exit 0, no conflicts (only .agents/qa.md auto-merged). Main's only bin//.agents/ changes since the branch base (7511c39) are two docs commits.
• bash -n bin/*.sh on the merged tree: clean.
• shellcheck -x -S warning bin/*.sh: main has 8 warnings. The merged tree has 9. The only warning this branch adds is bin/integrate.sh:29 SC2164 (a bare cd). The SC2209 hits in review.sh (mode=full, mode=delta) are intentional string literals.
• Not run end to end. bin/ has no test harness, and no pipeline was driven with these scripts on this date.

Overlap

• PR spec, master: headless roles must not background gates; tell a stalled revise from a declined one #457 (fix-headless-agent-gates) edits the same qa_loop needs-work → revise block in master.sh. This branch rewrites the revise.sh call right above it (revise_rc, continue in same worktree). spec, master: headless roles must not background gates; tell a stalled revise from a declined one #457 also edits the same four spec files. Whichever merges second needs a rebase. spec, master: headless roles must not background gates; tell a stalled revise from a declined one #457's master.sh part may be partly redundant with this branch's interrupted-revision recovery; its spec rule (headless roles must not background gates) is not covered here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FuCG3RuLHArnC8snRZVDYG