project-statelisted

# Project-state snapshot Read the [shared review contract](../../contracts/review-contract.md) before executing this workflow. Its evidence, candidate ledger, execution and verdict rules apply throughout. A decision-grade picture of where the repo stands and what's risky. Read-only; no changes, no merges, no closing issues. ## Stage 1 — Collect (cheap, mostly `gh` + git) ```bash gh pr list --state open --json number,title,isDraft,reviewDecision,statusCheckRollup,updatedAt --limit 100 gh pr status gh issue list --state open --json number,title,labels,updatedAt --limit 100 gh run list --limit 20 # recent CI git for-each-ref --sort=-committerdate refs/remotes --format='%(refname:short) %(committerdate:relative)' ``` Classify PRs: ready-to-merge / awaiting-review / changes-requested / CI-failing / draft / **stale** (no update in N weeks) / conflicting. ## Stage 2 — Risk lenses (parallel where useful, host-configured models) - **Dependency & supply-chain posture:** use the allowlisted scanner wrapper if available; distinguish advisory matches from exploitable findings. Or spawn `dependency-supply-chain-reviewer` on the manifests. - **Security posture:** spot-check for committed secrets (only through the allowlisted scanner wrapper), missing branch protection / unpinned CI actions, absent `SECURITY.md`. - **Architecture hotspots:** spawn `architecture-reviewer` in repo mode to name the riskiest coupling/drift and tech-debt centers. - **House-r