Frontier-simplify 2.2.0

Frontier-simplify 2.2.0 makes follow-up reviews converge on the contract instead of one newly found path per round. The motivating case (#44) was one consumer PR that took fifteen reviews, seven of them in a row on the same receipt invariant.

• Contracts, not cases (#45). A contract defect is reported as one invariant plus a producer/sink table, enumerated once. Follow-ups verify the table row by row; rows found outside it are counted as MISSED.
• Redesign stop (#46). Each contract ends in - invariant: KEY | family N | STATUS | sentence. If the same key stays open in two consecutive recorded reviews, a follow-up returns exit 12 before reserving an attempt and writes REDESIGN-REQUIRED.md from the skill's template. The next review judges the redesign first.
• Witness ledger (#47). Reproductions the reviewer saves in review_evidence/ are preserved outside the checkout. Each one reruns on the next head before any model starts; a failure returns exit 13 without using an attempt. witnesses runs the same check as a preflight. Witnesses can be retired with a reason or disputed.
• Supplementary mode (#48). After the automatic three attempts, --supplementary --granted-by WHO --budget N records an explicit grant. Every round prints the PR's cumulative count and time. A spent budget writes HANDOFF.md asking for one decision. Finding IDs cited from reviews run outside the runner are flagged.
• Pre-existing defects (#49). Base reproduction plus a classification: introduced, inside the change's new contract (offered with a scope-reduction alternative), or outside it and routed separately.

Exits 12 and 13 reserve nothing and launch no reviewer. None of the new lines the host reads can close a finding or authorize a merge, and a review that omits them stops nothing.

Verification

Release commit: 8b71fd32a8d86fa9d3adaf19fa1a0c0a84f10de9 (merge of #50; its tree is identical to the PR head 4dbae41).

• Main CI ran the full offline selftest on Ubuntu and macOS. Both jobs succeeded on a rerun. The first macOS attempt failed sigint-records-one-failure-and-cleans-children and sigint-leftover-lock-does-not-claim-running (protocol 171/2); the identical SIGTERM and timeout cases passed in that same run. The identical tree passed in the PR checks on both platforms, and six local protocol runs, two at a time, gave 173/0 each. The intermittent SIGINT failure on hosted macOS is unresolved.
• On that tree, locally on macOS: full selftest.sh 205 passed, 0 failed (protocol 173/0); the new selftest-followup.py 58/0; every other selftest-*.py and generate.py --selftest exit 0. Each new guard was mutation-checked: removing it turns its tests red.
• The change was reviewed through this runner by codex gpt-6.1-sol in three automatic rounds, using the features it adds. Round 1 found three blockers (a tree-supplied witness helper, phase-1 restarts bypassing the stops, adapter output order) and wrote witnesses for them. The round 2 and 3 prechecks reran those witnesses inside the reviewer's sandbox before any model started. Rounds 2 and 3 recorded all three closed, with no remediation regression and no first-review enumeration misses. The third attempt ended in the designed handoff.

Not run: a live claude executor review, and a measured replay of the #44 estimate (recorded as NOT_RUN). Witnesses are reviewer-written code run by the host; set REVIEW_WITNESS_WRAPPER to run them inside a sandbox.

Install from the tagged source archives using the README. No separate registry package or uploaded binary asset is supplied.