fix: bind skill reviews to mother and team roots

server-tools/fifth-domain-lighthouse-mirror/public_mirror_agent.py

@@ -209,6 +209,10 @@ def review(event: dict[str, Any], state: Path, kind: str) -> dict[str, Any]:
     decision = required_string(event, "decision")
     if decision not in {"ACCEPT", "HOLD", "REJECT"}:
         raise MirrorError("INVALID_REVIEW_DECISION")
+    expected_kind = "TCS_MOTHER" if kind == "mother" else "GUANGHU_HUMAN_TEAM"
+    expected_root = "TCS-MOTHER-LPM-0001" if kind == "mother" else "TCS-0002∞"
+    if event.get("reviewer_kind") != expected_kind or event.get("reviewer_authority_root") != expected_root:
+        raise MirrorError("REVIEWER_KIND_OR_AUTHORITY_ROOT_MISMATCH")
     candidate = json.loads(candidate_path(state, module_id, contribution_id).read_text())
     if event.get("candidate_sha256") != candidate["candidate_sha256"]:
         raise MirrorError("CANDIDATE_HASH_MISMATCH")
@@ -218,7 +222,8 @@ def review(event: dict[str, Any], state: Path, kind: str) -> dict[str, Any]:
             raise MirrorError("MOTHER_ACCEPT_REQUIRED_BEFORE_TEAM_REVIEW")
     receipt = {
         "schema": f"guanghu.lighthouse-persona-skill-{kind}-review/v1",
-        "reviewer_kind": "TCS_MOTHER" if kind == "mother" else "GUANGHU_HUMAN_TEAM",
+        "reviewer_kind": expected_kind,
+        "reviewer_authority_root": expected_root,
         "reviewer_id": reviewer_id,
         "module_id": module_id,
         "contribution_id": contribution_id,
@@ -226,6 +231,7 @@ def review(event: dict[str, Any], state: Path, kind: str) -> dict[str, Any]:
         "decision": decision,
         "reason_code": event.get("reason_code", "NONE"),
         "external_effect": "NONE",
+        "authentication_state": "LOCAL_STRUCTURAL_ASSERTION_PENDING_SIGNED_PUBLICATION_GATE",
     }
     atomic_json(state / "reviews" / kind / f"{contribution_id}.json", receipt)
     return receipt