From 6baf1510899a528c4ecdd042ce8d4d3cea4b411d Mon Sep 17 00:00:00 2001
From: "John A. Hoeven" <admin@jhoeven.net>
Date: Wed, 10 Jun 2026 03:07:16 +0200
Subject: [PATCH] =?UTF-8?q?Add=20review=5Fpause()=20=E2=80=94=20OHIOD=20lo?=
 =?UTF-8?q?g=20review=20gate=20between=20tiers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After each tier completes, grep the tier log for WARN/ERROR lines and
display them. If issues are found, block until the OHIOD confirms they
have reviewed before the next tier begins. Clean runs auto-continue.

Not bypassed by CE_INSTALL_NO_CONFIRM — this is a safety gate, not a
convenience prompt. Fires whether tiers are run standalone or from the
full-stack orchestrator.

Suggested by DT.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 ce-base.sh       |  1 +
 ce-basic.sh      |  1 +
 ce-minimal.sh    |  1 +
 lib/ce-common.sh | 26 ++++++++++++++++++++++++++
 4 files changed, 29 insertions(+)

diff --git a/ce-base.sh b/ce-base.sh
index a11e837..ca517d1 100644
--- a/ce-base.sh
+++ b/ce-base.sh
@@ -72,5 +72,6 @@ confirm_proceed
 phase_install
 phase_verify
 print_summary
+review_pause "Tier 0 — Base" "${LOG_FILE}"
 
 log_info "=== TIER 0 COMPLETE ==="
diff --git a/ce-basic.sh b/ce-basic.sh
index f7ea808..9000cb0 100644
--- a/ce-basic.sh
+++ b/ce-basic.sh
@@ -79,5 +79,6 @@ confirm_proceed
 phase_install
 phase_verify
 print_summary
+review_pause "Tier 2 — Basic" "${LOG_FILE}"
 
 log_info "=== TIER 2 COMPLETE ==="
diff --git a/ce-minimal.sh b/ce-minimal.sh
index 932b6fd..4ab0a6e 100644
--- a/ce-minimal.sh
+++ b/ce-minimal.sh
@@ -85,5 +85,6 @@ confirm_proceed
 phase_install
 phase_verify
 print_summary
+review_pause "Tier 1 — Minimal" "${LOG_FILE}"
 
 log_info "=== TIER 1 COMPLETE ==="
diff --git a/lib/ce-common.sh b/lib/ce-common.sh
index 53d450b..9373178 100644
--- a/lib/ce-common.sh
+++ b/lib/ce-common.sh
@@ -149,3 +149,29 @@ print_summary() {
         done
     fi
 }
+
+# review_pause <label> [log_file]
+# Greps the tier log for WARN/ERROR lines and displays them.
+# If issues found: blocks until OHIOD confirms reviewed.
+# If clean: logs OK and continues without prompting.
+# Not bypassed by CE_INSTALL_NO_CONFIRM — this is an OHIOD safety gate.
+review_pause() {
+    local label="${1:-this step}"
+    local log="${2:-${LOG_FILE}}"
+    local issues
+
+    issues="$(grep -E '\[(WARN |ERROR)\]' "${log}" 2>/dev/null || true)"
+
+    echo ""
+    if [[ -n "${issues}" ]]; then
+        log_warn "=== REVIEW REQUIRED — ${label} ==="
+        echo ""
+        echo "${issues}"
+        echo ""
+        read -r -p "Address any issues above. Ready to proceed? [y/N] " confirm
+        [[ "${confirm,,}" == "y" ]] \
+            || { log_info "Stopped at ${label} — address issues and re-run from this tier."; exit 0; }
+    else
+        log_info "${label} — no issues found, continuing."
+    fi
+}