Review and verify changes

Current status: later planned feature track.

A Change Capsule is a portable contract for the selected result. It binds organization, repository, base, exact patch and PR-head digests; task, agent, model, image, environment, policy, Workstream, Run, candidate, and checkpoint lineage; check receipts, capabilities, denials, interventions, approvals, cost, evidence gaps, protected Effects, signature, keys, schema, and disposition.

The open verifier operates offline without an account. A required GitHub check rejects missing, stale, altered, incomplete, or unapproved Capsules. Material PR-head changes invalidate the old status. Third-party CI/security tools can verify the same schema. Tamper fixtures must cover patch, head, checks, policy, evidence, and approvals.

Example: approval for patch A cannot authorize a modified patch B simply because both occupy the same pull request.

See Capsule requirement.