Module review_sync 

Hosted review-signature sync bridge.

heddle review sign records a ReviewSignatures state-attachment LOCALLY. weft#549 rejects a client-pushed attachment in the pack, so a signature only reaches the hosted server through the caller-authenticated, PoP-signed StateReviewService::SignState RPC (which binds the signing key to the authenticated caller). This module replays our local signatures over that RPC after a successful heddle push, mirroring crate::client::discussion_sync:

• Push (write path): for the pushed state(s), forward each review signature WE authored to the hosted SignState. The signature bytes were computed over the deterministic [objects::object::state_review::signing_payload], byte-identical to the server’s reconstruction, so the exact signature the local review sign wrote verifies unchanged server-side. weft relaxes the signed_at skew gate for this authenticated install path, so a signature minted long before the push still lands.
• Pull (read path): none needed — the server-minted ReviewSignatures attachment rides the pull pack like any server-owned attachment, so a clone / pull materializes it and the local review show reads it directly.

Fail-closed self filter

Only signatures whose actor is the local principal are forwarded. The actor is resolved from Repository::get_principal (env → config → git) — the SAME source review sign stamped the actor with — NOT config().principal alone, which is empty in git-overlay / env-identity repos and would silently drop our own signatures. When the principal is unresolvable we warn and skip (we cannot tell which signatures are ours).

Retry discipline

The mirror (.heddle/collaboration/hosted-review-mirror.json) records both synced and permanently-rejected (state, signature) pairs. A transient failure (network / server unavailable / state not yet on the server) is left for the next push to retry; a permanent rejection (bad signature, key not owned by the caller) is recorded so it stops retrying and warning every push.

Functions

push_review_signatures

Replay local review signatures we authored to the hosted StateReviewService.