Add accepted callable REVIEW ratchets

[stef-k]

Human-reviewed callable REVIEWs currently recur unchanged on subsequent checks. This adds one independent, source-controlled reviewed ceiling for callable size, nesting, and complexity: ordinary thresholds and measurements remain unchanged, values within an accepted ceiling pass, and growth reviews again.

The runner applies the shared ratchet using its existing single AnalysisFacts pass. Durable identity is normalized root-relative physical path + embedded language + lexical callable identity + guard, without persisted SourceRange. Active ambiguous matches fail closed; renamed, moved, disappeared, or coordinate-qualified callbacks can become stale and require explicit pruning/re-review. Filesystem safety and atomic writes reuse baseline_files; LOC and Markdown schemas/lifecycles remain independent.

Acceptance targets one current REVIEW in one explicit file with --accept-callable-review GUARD LANGUAGE CALLABLE --reason TEXT. It records the exact measurement and cannot replace/increase an existing ceiling. Separate --update-callable-review-baseline maintenance only lowers/removes existing entries; --prune-stale-callable-reviews explicitly enables stale pruning. Writes reject Git selectors, CI/JSON analysis, and other baseline modes. Normal analysis stays read-only and preserves incomplete-provider evidence. CLI/storage canonically use cyclomaticComplexity, explicitly mapped to the existing complexity result/policy ID; the alternative spelling is rejected.

Full/debug findings add accepted measurement, ratchet status, and reason; compact omits accepted PASS noise and human growth output shows current versus accepted values. README, configuration/usage/workflow/design decisions, changelog, and bundled skill/callable policies document the settled contract and anti-gaming rules.

Implements #132 only; candidate issues #133 and #134 remain outside scope. This PR stays draft and unmerged for independent review.

Validation

• 148 relevant baseline/identity/guard/lifecycle/output/scope/provider regression tests passed, including 24 new focused tests.

• Full repository suite: 357 tests passed on Python 3.12/Linux.

• 16 baseline-free human/full/debug/compact, CI, and mixed incomplete invocations were byte-identical to current main (1af5ce0c01ee1e070f335acd69d3b6451ba7d8fe).

• python -m compileall -q src skills research tests and git diff --check origin/main passed.

• Wheel and sdist built; twine check passed for both. Fresh installed artifacts passed analysis, targeted acceptance, read-only compact output, growth rejection, maintenance lowering/removal, and bundled-skill checks.

• Installed Code Guard over the complete branch scope (--base-ref origin/main --json --json-mode compact): REVIEW, 16 selected/analyzed files, no FAIL/INCOMPLETE.

• Exact-head CI passed for d7e52096026dd6af87f086735a6d66d7e455f2b8: Linux/macOS/Windows production analysis, Python 3.10–3.14 compatibility and its required aggregate, CodeQL, and package build/validation. PyPI publishing was correctly skipped for a draft PR.

Code Guard review judgments

Finding	Measurement	Retained rationale
src/agent_code_guard/code_guard.py file LOC	590; review 400, fail 600	The public CLI/analysis orchestrator remains cohesive; measurement and baseline persistence remain in their dedicated modules.
code_guard.parser callable size	111; review 80	One linear CLI argument/help declaration, preserving the existing parser boundary.
code_guard.run_analysis callable size	95; review 80	One runner-owned transaction for loaded configuration, lazy shared facts, guard dispatch, and incomplete evidence.
code_guard.run_analysis complexity	32; review 15	Explicit enabled/applicable guard and evidence branches belong to that same analysis transaction.

These REVIEWs were inspected under the existing LOC, callable-size, and complexity policies. No allowances, thresholds, exclusions, or exceptions were added or relaxed for this repository to silence them. Independent review remains outstanding.