fix(review): recover the model's JSON from reasoning-model output

[asdd-agent]

What this changes

The review runtime discarded a valid review when the model returned its JSON object wrapped in reasoning prose, code fences, or a separate reasoning_content field. The old first-brace-to-last-brace recovery captured an invalid span, so a real review degraded to a "human should review manually" placeholder.

Extraction now uses a real JSON parser (.github/asdd/runtime/extract-json.py) that recovers the review object wherever the model put it, and still emits nothing on genuine non-JSON so the gate keeps failing closed. The adapter reads the answer across content (string or array of parts), legacy text, and message.reasoning_content, and logs a key-safe redacted diagnostic on a persistent failure.

The fix is at the shared adapter (openai-compat.sh), so it also covers the operator-run fixed-prompt agents that call it through run-agent.sh (triage, support, review-contributor, review-merge). The Goose-run operate agents take a different path and are unaffected.

Spec: docs/specs/robust-review-json-extraction.md. Test: .github/asdd/runtime/extract-json.test.sh, wired into validation/run-base.py (base suite green).

Authorship

• Authored by a human.
• Authored or co-authored by an AI agent under human direction. The agent identity is named below and each agent commit carries the Agent: trailer.

Agent identity (if any): asdd-agent · Instructed by (human handle): welsbach

Impact

• Non-normative: a fix that does not change the standard's text, the governance rules, or the review contract (generic.sh still validates the merged object and fails closed when extraction yields nothing).
• Normative.

Checklist

• Commits are signed off (DCO).
• Conventional Commit message(s).

[github-actions]

ASDD review - advisory (recommendation: comment)

Produced by an automated agent under human direction. Advisory only: a human approves and merges.
Nothing here merges automatically.

The review runtime returned invalid output; a human should review manually. Security scan (deterministic + SAST): no new issues. Impact scan: 1 finding(s), 0 block.

SECURITY - ok

No findings.

IMPACT - concerns

• warn: This change touches a behavioural surface (a gate, lens, agent prompt, or the runtime seam: .github/asdd/runtime/extract-json.py, .github/asdd/runtime/extract-json.test.sh, .github/asdd/runtime/openai-compat.sh, validation/run-base.py). If it changes behaviour adopters rely on for conformance, it is normative: declare it and add an impact analysis and target version. If it preserves behaviour, no action.

---

_{Generated by the ASDD advisory review. Mode: live.}