Review every new snapshot with an agent from the other vendor

TODO.md

@@ -6,14 +6,8 @@
 
 # M3 — Second vendor and review
 
-- Review profiles and triggers
-  Reviews are done by a separate agent session, never the implementer, by default from a different vendor. Each review targets a snapshot and is cached by tree sha; when the task's tree moves on, existing reviews are marked stale. A review profile (security, performance, privacy, visual UX, plan conformance, ...) has a prompt, vendor, model, output schema and capture config; workflow stages reference profiles by name. Triggers: on `ask_human` (the inbox item appears at once and the review attaches when done, even if the item was resolved first), before merge, on demand, and periodically on elapsed time or diff size, debounced to turn boundaries or a quiet period. A `request_review(scope, concerns[], profile?)` MCP tool lets agents ask for one.
-- Decide the periodic review thresholds
-  The defaults for elapsed time and diff size, with per-project overrides.
 - Visual review output
   Structured output that leans visual rather than quoting code: a summary; highlights, each with a category, severity and anchors to files or lines so the UI can jump to them; Mermaid diagrams of changed data flow, call graphs, state machines and schemas; screenshots or recordings of the running result (Playwright MCP for web projects, `xcrun simctl io` screenshot and recordVideo for iOS simulator projects); before/after pairs from the base ref and the current snapshot where possible. The UI should encourage, in increasing order: file diffs, diff stats, an agent-generated summary, agent highlights with visual explanations.
-- Cross-vendor review
-  A review profile whose vendor differs from the implementer's.
 
 # M4 — Merging and history