Deathcharge · Deathcharge · Aug 11, 2026 · Aug 8, 2026 · Aug 11, 2026
@@ -47,6 +47,7 @@ jobs:
           samsarix-campaign schema --kind plan-approval > /tmp/plan-approval.schema.json
           samsarix-campaign schema --kind approval-policy > /tmp/approval-policy.schema.json
           samsarix-campaign schema --kind plan-approval-set > /tmp/plan-approval-set.schema.json
+          samsarix-campaign schema --kind plan-review > /tmp/plan-review.schema.json
           samsarix-campaign schema --kind adapter > /tmp/adapter.schema.json
           samsarix-campaign schema --kind handoff > /tmp/handoff.schema.json
           samsarix-campaign schema --kind media-package > /tmp/media-package.schema.json
@@ -101,6 +102,8 @@ jobs:
           samsarix-campaign plan check examples/launch-plan.json --policy examples/content-policy.json --json
           samsarix-campaign plan preview examples/launch-plan.json --json
           samsarix-campaign plan diff examples/launch-plan.json examples/launch-plan.json --json --exit-code
+          samsarix-campaign plan review create examples/launch-plan.json --decision request-changes --by "CI brand reviewer" --at 2026-08-03T13:45:00Z --finding "Support the opening launch claim." --item 1 --platform linkedin --suggestion "Link the benchmark or narrow the claim." --output /tmp/plan.review.json --json
+          samsarix-campaign plan review verify examples/launch-plan.json /tmp/plan.review.json --json
           samsarix-campaign plan approval create examples/launch-plan.json --policy examples/content-policy.json --by "CI reviewer" --at 2026-08-03T14:15:00Z --output /tmp/plan.approval.json --json
           samsarix-campaign plan approval verify examples/launch-plan.json /tmp/plan.approval.json --policy examples/content-policy.json --json
           samsarix-campaign plan approval create examples/launch-plan.json --policy examples/content-policy.json --by "CI release owner" --at 2026-08-03T15:00:00Z --output /tmp/plan.release.approval.json --json

@@ -2,6 +2,20 @@
 
 All notable changes to this project are documented here.
 
+## 0.16.0 - 2026-08-08
+
+- Added immutable `plan-review` v1 records for source-bound `comment`, `request-changes`, and
+  `reject` feedback without conflating negative review state with quality-gated approval.
+- Added deterministic `scr_*` identities and full canonical hashes, one to fifty bounded findings,
+  optional item/platform targets and suggestions, exclusive export, strict loading, tamper
+  detection, and stale-source verification.
+- Added optional exact JPEG/PNG media binding so visual feedback can identify the same bounded
+  `scm_*` snapshot used by exact-media approval and handoff workflows.
+- Added `plan review create/verify`, stable valid/blocking JSON semantics and exit codes, a public
+  typed API, bundled Draft 2020-12 schema, installed-wheel CI journey, and security/adoption docs.
+- Documented current Buffer, Sprout Social, and Planable feedback patterns, the unsigned reviewer
+  label boundary, and canonical CSV import as the next separate onboarding milestone.
+
 ## 0.15.0 - 2026-08-08
 
 - Added reusable approval-policy v1 profiles with role minimums, a total minimum, optional

@@ -3,7 +3,8 @@
 Samsarix Creative Spirals is a local-first CLI and typed Python library that turns approved source
 drafts into copy-ready files for X, LinkedIn, Bluesky, Mastodon, and Discord. It validates campaign
 input, supports deliberate per-platform copy, applies platform-aware limits, checks complete launch sequences, and exports review bundles,
-publisher-neutral CSV, and portable calendars. Portable image references, semantic diffs, and
+publisher-neutral CSV, and portable calendars. Portable image references, source-bound review
+feedback, semantic diffs, and
 deterministic link attribution, portable content-policy profiles, source-bound campaign and plan
 approval records, and multi-role approval policies make exact changes and guardrails visible before
 handoff.
@@ -17,7 +18,8 @@ show the current quality, schedule, approval, handoff, and optional publication
 It is for solo creators, developer advocates, and small content teams that want a scriptable
 review/export step without connecting social accounts or sending draft content to a service.
 
-> Maturity: **0.15 alpha.** Deterministic multi-role approval quorums, approval-bound static-image packets, publication reconciliation,
+> Maturity: **0.16 alpha.** Source-bound comments and negative review decisions, deterministic
+> multi-role approval quorums, approval-bound static-image packets, publication reconciliation,
 > deterministic link tracking, portable phrase policies, platform-native content variants,
 > federated-platform drafts, campaign-plan quality gates, whole-plan semantic review and local
 > approvals, portable image metadata, approved handoff verification, and
@@ -131,10 +133,10 @@ behavior.
 | `media` | no | Up to 20 portable JPEG/PNG references, with required alt text and at most four images targeted to each platform. |
 
 Media paths are metadata relative to the campaign file. Ordinary validate, preview, check, diff,
-approval, export, and handoff workflows do not dereference them. Add `--include-media` specifically
-to plan approval creation to inspect and bind the exact local JPEG/PNG bytes; a later handoff then
-packages those same approval-bound bytes automatically. References participate in campaign hashes,
-diffs, approvals, manifests, and adapter v2 output. See
+approval, export, and handoff workflows do not dereference them. Add `--include-media` to plan
+approval or plan review creation to inspect and bind the exact local JPEG/PNG bytes; a later handoff
+then packages those same approval-bound bytes automatically. References participate in campaign
+hashes, diffs, approvals, manifests, and adapter v2 output. See
 [Portable media references](docs/MEDIA.md) for targeting, path rules, platform rationale, and the
 filesystem/provider checks required of an external adapter.
 
@@ -159,6 +161,7 @@ samsarix-campaign schema --kind approval
 samsarix-campaign schema --kind plan-approval
 samsarix-campaign schema --kind approval-policy
 samsarix-campaign schema --kind plan-approval-set
+samsarix-campaign schema --kind plan-review
 samsarix-campaign schema --kind adapter
 samsarix-campaign schema --kind handoff
 samsarix-campaign schema --kind media-package
@@ -286,10 +289,32 @@ is accepted, including handoff, readiness, and publication workflows. Reviewer l
 remain unsigned metadata; repository controls provide the optional authenticated collaboration
 boundary. See [Approval policies and quorum evidence](docs/APPROVAL_POLICIES.md).
 
-When a plan references real images and review must cover their exact pixels, create the plan
-approval with `--include-media`. Samsarix resolves each reference beneath its campaign directory,
-rejects symbolic links and unstable reads, validates bounded static JPEG/PNG structure and
-dimensions, and records a content-addressed `scm_*` snapshot in the approval. The portable ceiling
+Before approval, preserve comments or negative review decisions against the exact plan revision:
+
+```bash
+samsarix-campaign plan review create examples/launch-plan.json \
+  --decision request-changes \
+  --by "Brand reviewer" \
+  --finding "The launch claim needs supporting evidence." \
+  --item 1 --platform linkedin \
+  --suggestion "Link the benchmark or narrow the claim."
+samsarix-campaign plan review verify \
+  examples/launch-plan.json \
+  examples/launch-plan.json.scr_REVIEW_ID.review.json \
+  --json
+```
+
+`comment` is informational; current `request-changes` and `reject` records report `blocking: true`.
+Any source change makes prior feedback stale instead of silently applying it to a new revision.
+Review files are immutable, deterministic `scr_*` artifacts and can optionally bind exact image
+bytes with `--include-media`. Positive authorization stays in the quality-gated `plan approval`
+workflow. See [Source-bound plan feedback](docs/PLAN_FEEDBACK.md).
+
+When a plan references real images and review must cover their exact pixels, create the plan review
+or plan approval with `--include-media`. Samsarix resolves each reference beneath its campaign
+directory, rejects symbolic links and unstable reads, validates bounded static JPEG/PNG structure
+and dimensions, and records a content-addressed `scm_*` snapshot in that artifact. Only an approval
+can authorize a later handoff. The portable ceiling
 is 2,000,000 bytes per file, 36,152,319 pixels, 400 plan references, and 100 MB of unique image
 bytes per packet. Provider, account, and Mastodon-instance rules still require downstream
 revalidation.
@@ -404,18 +429,21 @@ samsarix-campaign plan diff BEFORE AFTER [--json] [--exit-code]
 samsarix-campaign plan approval create PLAN --by LABEL [--policy POLICY] [--at RFC3339] [--note TEXT] [--warnings-as-errors] [--include-media] [--output PATH] [--json]
 samsarix-campaign plan approval collect PLAN --approval-policy POLICY --approval ROLE=PATH [--approval ROLE=PATH ...] [--policy CONTENT_POLICY] [--output PATH] [--json]
 samsarix-campaign plan approval verify PLAN APPROVAL [--policy POLICY] [--json]
+samsarix-campaign plan review create PLAN --decision comment|request-changes|reject --by LABEL --finding TEXT [--finding TEXT ...] [--at RFC3339] [--item NUMBER] [--platform PLATFORM] [--suggestion TEXT] [--note TEXT] [--include-media] [--output PATH] [--json]
+samsarix-campaign plan review verify PLAN REVIEW [--fail-on-blocking] [--json]
 samsarix-campaign plan handoff create PLAN APPROVAL [--policy POLICY] [--at RFC3339] [--output DIRECTORY] [--json]
 samsarix-campaign plan handoff verify PLAN HANDOFF [--policy POLICY] [--json]
 samsarix-campaign plan publication init PLAN HANDOFF [--policy POLICY] [--at RFC3339] [--output PATH] [--json]
 samsarix-campaign plan publication verify PLAN HANDOFF PUBLICATION [--policy POLICY] [--at RFC3339] [--json]
 samsarix-campaign plan export PLAN [--output DIRECTORY] [--overwrite] [--json]
-samsarix-campaign schema [--kind campaign|content-policy|plan|approval|plan-approval|approval-policy|plan-approval-set|adapter|handoff|media-package|publication|readiness] [--output PATH]
+samsarix-campaign schema [--kind campaign|content-policy|plan|approval|plan-approval|approval-policy|plan-approval-set|plan-review|adapter|handoff|media-package|publication|readiness] [--output PATH]
 ```
 
 Successful commands return exit code `0`. Validation and I/O failures return `1`; invalid CLI
 usage returns `2`; a valid campaign that fails `check` returns `3`. Human-readable errors go to
-stderr. Exit `4` means a requested diff detected changes, an approval is stale/invalid, or a
-handoff is not current and intact, a publication ledger is incomplete/invalid, or a requested
+stderr. Exit `4` means a requested diff detected changes, an approval or plan review is
+stale/invalid, `plan review verify --fail-on-blocking` found a current negative decision, a handoff
+is not current and intact, a publication ledger is incomplete/invalid, or a requested
 approval/handoff/publication readiness stage is unmet.
 `plan status --require-stage quality` uses `3` when its quality/schedule gate is unmet. Without a
 required stage, status is informational. Quality, diff, approval, handoff, and readiness
@@ -470,12 +498,13 @@ console command. The package has no third-party runtime dependencies.
 - `plans.py` validates, builds, checks, and exports bounded multi-campaign sequences.
 - `review.py` computes semantic diffs and creates/verifies source-bound local approvals.
 - `plan_review.py` reviews and approves complete launch-plan state without publishing it.
+- `plan_feedback.py` records and verifies immutable feedback for exact plan revisions.
 - `approval_policy.py` validates reusable role/count policies and collects deterministic multi-reviewer approval evidence.
 - `media_package.py` captures, validates, indexes, and approval-binds opt-in static image bytes.
 - `handoff.py` creates and verifies exclusive approved-plan packets and exact artifact bytes.
 - `publication.py` initializes and verifies handoff-bound operator outcome ledgers.
 - `readiness.py` consolidates time-aware quality and evidence state and renders offline HTML.
-- `schema.py` exposes all authoring and evidence JSON Schemas bundled in the wheel, including approval policies and sets.
+- `schema.py` exposes all authoring and evidence JSON Schemas bundled in the wheel, including approval policies, sets, and plan reviews.
 - `cli.py` maps these operations to stable commands and exit codes.
 
 Build and check functions have no file or network side effects. Load, explicit schema output, and
@@ -504,6 +533,9 @@ for trust boundaries and failure behavior.
   system when verified identity is required.
 - Approval-set roles and distinct-reviewer checks operate on unsigned labels; they enforce a local
   artifact contract, not human identity, authorization, separation of duties, or non-repudiation.
+- Plan-review decisions and reviewer labels are also unsigned metadata. A current blocking result
+  is local evidence about one exact revision, not an authenticated workflow lock or proof that a
+  person supplied or resolved the findings.
 - Approved handoff hashes detect stale source and modified bytes but remain unsigned. They do not
   prove signer identity or authenticated provenance, and verification should occur immediately
   before a downstream consumer uses the same packet directory.
@@ -515,7 +547,7 @@ for trust boundaries and failure behavior.
   they do not prove provider acceptance, remote visibility, authorship, or continued availability.
 - Media transformation, per-account capabilities and mention resolution, cryptographic approvals,
   hosted collaboration, network publishing, click collection, and analytics reporting are outside
-  the 0.15 scope. Calendar, readiness, and publication files record
+  the 0.16 scope. Calendar, readiness, review, and publication files record
   intent and local evidence; they do not schedule or publish anything.
 
 Security reports belong at `support@samsarix.com`; see [SECURITY.md](SECURITY.md).

@@ -370,6 +370,33 @@ runs `31244227416` and `31244229167`; merge commit `acb21ce`; and post-merge run
 `c25e6ca`. Full review disposition, artifact evidence, compatibility notes, and limitations are in
 [`docs/PRODUCTIZATION.md`](docs/PRODUCTIZATION.md#015-policy-bound-approval-quorum-release-evidence).
 
+## Active milestone — 0.16 source-bound plan feedback
+
+- [x] Add immutable `comment`, `request-changes`, and `reject` records bound to one exact plan
+  revision, while keeping positive release authorization in the quality-gated approval contract.
+- [x] Add bounded structured findings, deterministic `scr_*` identity, tamper detection, optional
+  exact-media binding, exclusive export, current/stale verification, and stable blocking semantics.
+- [x] Expose CLI, typed API, bundled Draft 2020-12 schema, adversarial tests, and installed-wheel CI
+  coverage without adding runtime dependencies, accounts, network access, or mutable service state.
+- [x] Document current Buffer, Sprout Social, and Planable feedback workflows plus the unsigned
+  reviewer-label, local blocking, confidentiality, and resolution boundaries.
+- [ ] Complete hosted CI and automated review, record exact distribution hashes, merge to main, and
+  capture final rollback evidence.
+
+Connected review services keep comments, rejection notes, suggestions, notifications, accounts,
+and version activity beside a draft. Samsarix supplies the portable artifact portion: exact-revision
+feedback that can live in Git or an archive, turns stale automatically when source changes, and can
+bind reviewed image bytes without needing publisher credentials. Contract details and official
+sources are in [`docs/PLAN_FEEDBACK.md`](docs/PLAN_FEEDBACK.md).
+
+## Planned milestone — 0.17 canonical CSV and plan import
+
+Official Buffer and Planable workflows confirm that spreadsheet bulk authoring is a separate
+high-frequency use case. The next bounded slice should import a documented Samsarix CSV contract
+into normalized campaign files and a plan, report every row error without partial writes, preserve
+explicit UTC/timezone semantics, and round-trip through existing preview/check/diff/review/export
+gates. Provider-specific templates and direct upload remain separate adapters.
+
 ## Deliberate exclusions
 
 - No automatic publishing, OAuth token storage, analytics scraping, hosted draft database, or

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-The latest `0.15.x` release line is supported. Earlier pre-productization and
+The latest `0.16.x` release line is supported. Earlier pre-productization and
 Helix-branded snapshots are not supported.
 
 ## Reporting a vulnerability
@@ -46,6 +46,8 @@ files selected by the invoking user. The supported workflow:
 - validates bounded approval policies and deterministic multi-role approval sets, independently
   reverifies each embedded plan approval, and rejects duplicate evidence, missing role/count
   minimums, stale source, and mixed content-policy or exact-media bindings;
+- validates immutable plan-review records with at most 50 bounded findings, deterministic content
+  identity, exact plan/source verification, optional exact-media binding, and exclusive export;
 - creates approved handoff packets exclusively and verifies their current plan/approval identity,
   embedded approval-bound policy, producer version, fixed directory shape, exact regenerated
   bytes, declared sizes and SHA-256 values, regular-file types, and file stability during reads;
@@ -89,6 +91,13 @@ participated, and it does not enforce authorization or separation of duties. Use
 rules, required reviews, and CODEOWNERS for authenticated organizational controls; see
 `docs/APPROVAL_POLICIES.md`.
 
+Plan-review `reviewedBy`, decision, timestamp, findings, and suggestions are likewise untrusted
+metadata. A current `blocking` result means only that a valid local `request-changes` or `reject`
+record matches the exact current revision; it does not authenticate a reviewer, enforce a durable
+lock, prove notification or receipt, or determine whether feedback was resolved. Records may
+contain confidential claims, legal concerns, strategy, schedules, and media fingerprints. Protect
+them like campaign source and see `docs/PLAN_FEEDBACK.md`.
+
 Content policies perform literal substring checks on final rendered `PlatformDraft.content` only.
 They do not understand meaning, context, spelling variants, images, media alt text, facts, laws, or
 provider rules, and they cannot prove a post is safe or compliant. Rule phrases may disclose