core/docs/analysis/proposal-review-idle-integration-2026-06-08.md

Proposal-review idle integration — boundary ledger (IT)

As of: 2026-06-08 · core/config.py review_pending_proposals · ChatRuntime.idle_tick Builds on: the read-only reporter (core/proposal_review/, RPT — see proposal-review-reporter-2026-06-07.md).

Wires the read-only proposal-review reporter into the existing ChatRuntime.idle_tick() as an optional, gated, read-only sub-pass, so an idle engine can surface pending comprehension-failure review obligations alongside its existing learning passes — completing the loop without crossing into self-modification:

comprehension failure → proposal_only artifact → proposal-review report → idle_tick read-only visibility

The boundary (pinned)

Existing idle_tick remains the only idle_tick. Proposal review is read-only. This is NOT the L10 always-on heartbeat. It does NOT advance learning. It only surfaces review obligations.

It DOES	It does NOT
run a read-only sub-pass when review_pending_proposals is on	exist as a second idle loop / daemon
surface idle_summary() in IdleTickResult.proposal_review	mutate / move / delete any artifact
capture a reporter failure as safe=False	set did_work → so it never checkpoints
stay disabled (field None) by default	advance learning / ratify / mount / modify readers
—	become the always-on heartbeat over real uptime

How it works (IT-b)

• Gate: RuntimeConfig.review_pending_proposals: bool = False (opt-in, same pattern as consolidate_determinations / persist_session_state).
• Sub-pass: after the consolidation pass, iff gated on, idle_tick calls the pure core.proposal_review.idle_summary() (scan → report → dry-check) and stores the result in the additive optional IdleTickResult.proposal_review.
• Failure isolation: a reporter exception is caught and surfaced as ProposalReviewIdleSummary(safe=False, …, errors=("proposal_review_failed:<type>",)) — visible, never propagated, so it cannot corrupt the tick's state or return.
• No state change: the sub-pass never sets did_work, so the existing checkpoint logic is untouched; default-off leaves IdleTickResult byte-identical for existing callers.
• Contract documented in docs/runtime_contracts.md; contract tests in tests/test_idle_proposal_review.py (default-off shape, enabled summary, captured exception, no-checkpoint, other-passes-unperturbed) plus the unchanged existing idle suites.

What this is NOT — and what's next

This is L10-adjacent, not L10. The always-on heartbeat over real indefinite uptime — a process that drives idle_tick on its own — remains the separate, unbuilt lived-spine frontier and is not claimed here. The agreed next capability step is R3 (rates / time / state systems), not more reporter plumbing. The chain now stands:

R1/R2 organs → comprehension contemplation → proposal-review surface → idle_tick read-only visibility → R3