fix(factory): reserve validation for coordinator

factory/coordinator.md

@@ -44,7 +44,7 @@ REVIEWER 3/3 — editorial clarity and audience fit, using `doctrine/roles/revie
 
 Each reviewer runs in its own caught boundary with `output_schema` equal to `factory/schemas/review-findings.schema.json` and the universal one-repair protocol. The full concurrent dispatch/collection runs in an enclosing caught boundary. Run the shell/linter in its own caught boundary from `/workspace`, exactly `/usr/local/bin/lint-guide --json /workspace/guides/<slug>`; never invoke `go` or `go run`. Validate parsed linter JSON before use. A completed review wave means valid output from all 3 reviewers plus a successfully parsed linter result. A failed reviewer output, malformed output after repair, linter failure, or invalid linter JSON fails the wave and must not complete the wave and therefore do not increment `review_rounds`; it selects `failed` and routes to reporting.
 
-Only after a completed review wave increment actual `review_rounds` by one (maximum 3). Normalize semantic duplicates without dropping sources; linter blockers equal reviewer blockers. If there are no blockers, select `converged`. If blockers remain and `review_rounds < 3`, start exactly one revision in a caught boundary with all normalized findings, doctrine, current files, and the selected persona; forbid external research and outside edits. Its strict `output_schema` has only `completed` (boolean), `addressed` (array), and `disputed` (array). Apply one repair and revision completion verification, then always run a confirmatory review wave; a revision can never directly converge. Repeat while capacity remains. If the confirmatory third wave has final-round blockers, select `blocked`; do not revise again. Thus at most three review/revision rounds occur, represented by at most three complete waves, and the report records the actual count.
+Only after a completed review wave increment actual `review_rounds` by one (maximum 3). Normalize semantic duplicates without dropping sources; linter blockers equal reviewer blockers. If there are no blockers, select `converged`. If blockers remain and `review_rounds < 3`, start exactly one revision in a caught boundary with all normalized findings, doctrine, current files, and the selected persona; forbid external research and outside edits. Revision agents must not run validation commands; the coordinator owns post-edit file validation and the next complete review wave. Explicitly prohibit validation including `go`, `go run`, `npx`, Python, and `/usr/local/bin/lint-guide`; tell the revision agent to make only the requested allowed-path edits and return its structured result. Its strict `output_schema` has only `completed` (boolean), `addressed` (array), and `disputed` (array). Apply one repair and revision completion verification, then always run a confirmatory review wave; a revision can never directly converge. Repeat while capacity remains. If the confirmatory third wave has final-round blockers, select `blocked`; do not revise again. Thus at most three review/revision rounds occur, represented by at most three complete waves, and the report records the actual count.
 
 Deterministic scenario rulings: failed reviewer output -> `failed`, zero increment, report; malformed output -> one same-session repair then `failed` on exhaustion; successful revision -> mandatory confirmatory review wave; final-round blockers -> `blocked` with `review_rounds = 3`.
 

factory/tests/test-coordinator.sh

@@ -40,7 +40,9 @@ for phrase in \
   'outside /workspace/guides/<slug>' \
   "Presentation-only uncertainty never selects \`awaiting_scope\`" \
   'Missing exact UI labels, control names or locations, and equivalent Save/Update/Apply chrome are presentation-only' \
-  "Open questions alone do not select \`awaiting_scope\`"; do
+  "Open questions alone do not select \`awaiting_scope\`" \
+  'Revision agents must not run validation commands' \
+  "including \`go\`, \`go run\`, \`npx\`, Python, and \`/usr/local/bin/lint-guide\`"; do
   grep -Fq "$phrase" "$CONTRACT" || fail "missing contract: $phrase"
 done