feat: four verified defect fixes, built in parallel worktrees

Four independent slices, each with a test that fails without its fix, each
adversarially verified by a separate agent that BROKE the fix and confirmed
the test went red. 4 of 4 PASS.

1. THE FILE QUEUE BACKEND HAD NO CRASH RECOVERY. `--reap` was redis-only, so
   a dead worker's item sat in processing/ forever and an unattended fleet
   stalled on it. Reproduced before the fix: --reap exited 2, item stranded.
   file_reap() now requeues items whose mtime is older than the visibility
   timeout. A FRESH item is never touched -- requeuing a live build means the
   user's work is built twice. Verifier's mutation 1 (revert the dispatch)
   reproduced the original defect verbatim: 8 failures, first one naming the
   stranded item. 17 assertions, no broker needed.

   Disclosed ceiling, not hidden: mtime-as-claim-time means a consumer that
   rewrote its own item file would reset the clock and never be reaped. No
   current consumer does; it is documented in both the header and the
   function docblock.

2. "ANCHORED 0 of 9" NEEDED TO READ AS HISTORY, NOT A REGRESSION. All 9
   receipts predate the base_sha fix and can never be anchored -- that is
   frozen history, not a live defect, and nothing should try to rewrite them.
   classify_unanchored() now buckets by_design / historical / regression /
   live so a genuinely NEW break is distinguishable from old receipts.
   Verifier ran three mutations; collapsing everything to "historical" (the
   green-wash direction) trips 4 assertions.

3. THE GATE LADDER HAD NO PROGRAMMATIC SURFACE. `loki gates --json` existed
   with zero consumers and no dashboard route. Added a read-only endpoint
   following a sibling GET's auth scope exactly. An UNMEASURED gate
   serializes as null, never 0 -- zero is a claim that the gate ran and never
   fired. The agent also found the module docstring documented rationale but
   not one field, and added the shape.

4. ACCEPTANCE-CRITERION IDS WERE MINTED AND DROPPED. The receipt now records
   criteria_declared -- the AC ids present in the spec. Named
   criteria_declared, NOT criteria_met, because we do not measure
   satisfaction yet and the field name must not imply we do. Absent when the
   spec has none; never invented.

Merge note worth recording: I applied three of the four diffs and missed
worktree 2, and the merged tree reported 8 failures in a suite that passed
9/9 in isolation. Running the suites after merging is what caught it -- a
"they all passed in their worktrees" summary would have shipped a
half-applied change.

Gate green 73/0. Four suites: 17 + 9 + 12 + 67 assertions.

Author: asklokesh

autonomy/lib/gate_policy.py

@@ -20,6 +20,29 @@
 blocking stays an explicit operator act via the named environment variable,
 because a tool that silently starts blocking is the thing operators most
 reasonably fear.
+
+Shape (assess() and --json, schema_version 1). This is the contract the
+dashboard endpoint GET /api/gate-policy and tests/test_gate_policy_endpoint.py
+both read against, so field names here are load-bearing:
+
+  schema_version int    1
+  status         str    "measured"
+  ledger         str    "present" | "absent" -- whether the per-gate failure
+                        ledger .loki/quality/gate-failure-count.json was read
+  gates          list   one record per known gate, blocking gates first, each
+                        group sorted by name:
+    gate         str    gate name (e.g. "code_review")
+    mode         str    "blocking" | "advisory" -- for a promotable gate this
+                        depends on the ENVIRONMENT at call time
+    promotable   bool   True when a real promotion knob exists in run.sh
+    audit_hits   int|null  failures counted for this gate. null means
+                        UNMEASURED -- no ledger, or no entry for this gate.
+                        NEVER 0 for an unmeasured gate: 0 is the positive claim
+                        that the gate ran and never fired, which is the false
+                        green an absent measurement always produces.
+    why          str    one-line description of what the gate checks
+    promote_with str|null  "VAR=value" to make an advisory gate blocking; null
+                        when the gate already blocks
 """
 
 import json

autonomy/lib/outcome_ledger.py

@@ -93,6 +93,92 @@
     "diff_range_mismatch": "the base..head diff does not match the receipt's file set",
 }
 
+# HISTORICAL vs LIVE: the distinction that stops an old receipt from reading as
+# a regression.
+#
+# `ANCHORED 0 of 9` is alarming until you know WHY. Two very different things
+# produce it, and a flat count of reasons cannot tell them apart:
+#
+#   FROZEN   The receipt file itself lacks the anchor. base_sha was written as
+#            "" and that JSON is on disk forever. No future fix can anchor it,
+#            and rewriting a receipt to make a metric look better is the exact
+#            dishonesty this module exists to refuse. These are HISTORY.
+#   LIVE     The receipt records real shas; only the ENVIRONMENT cannot resolve
+#            them right now -- a shallow clone, an unmerged branch, or a file
+#            set that still has uncommitted edits. These can anchor later, with
+#            no change to the receipt.
+#
+# Measured on this repo: all 9 receipts are frozen (8 base_sha_empty, 1
+# greenfield_no_baseline) and were generated 2026-07-27 and 2026-07-31, BEFORE
+# proof-generator learned to read .loki/state/start-sha (commit 99ce689d,
+# 2026-08-07). So the zero is fully explained by history.
+# Frozen because the GENERATOR failed to record something it should have. These
+# are the only two where recency is meaningful: before the fix they are history,
+# after it they are a live bug in proof-generator.
+FROZEN_GENERATOR_REASONS = frozenset({
+    "head_sha_empty",
+    "base_sha_empty",
+})
+
+# Frozen BY DESIGN, and correct at any date. A genuinely greenfield repo has no
+# earlier commit to diff against, and a receipt written over uncommitted work
+# honestly has base == head. Neither can ever anchor, and neither is a defect --
+# so recency must NOT be applied to them. Calling a correct greenfield receipt a
+# regression would be a false alarm on the signal added to prevent false alarms.
+FROZEN_BY_DESIGN_REASONS = frozenset({
+    "greenfield_no_baseline",
+    "change_not_committed",
+})
+
+FROZEN_REASONS = FROZEN_GENERATOR_REASONS | FROZEN_BY_DESIGN_REASONS
+
+# The two sets must stay disjoint. If a reason appeared in both, classification
+# would depend on which branch is checked first -- and a by-design case that
+# drifted into the generator set would start alarming as a regression the moment
+# someone reordered the checks. Assert the invariant rather than trusting order.
+assert not (FROZEN_GENERATOR_REASONS & FROZEN_BY_DESIGN_REASONS), \
+    "a reason cannot be both a generator failure and correct by design"
+
+# The commit that taught proof-generator to resolve base_sha from
+# .loki/state/start-sha when the env var is absent. A receipt generated at or
+# after this instant should carry a real baseline, so a FROZEN reason on one is
+# NOT history -- it is a live regression in the generator.
+#
+# Recency is the discriminator because it is the only one the receipts actually
+# support: they carry generated_at (verified on all 9), and loki_version tracks
+# releases rather than this fix. A frozen-vs-live split ALONE would file a newly
+# broken receipt under history, which is the green-wash this guards against.
+BASE_SHA_FIX_UTC = "2026-08-07T13:39:32Z"  # 99ce689d, committed 09:39:32 -04:00
+
+
+def classify_unanchored(reason, generated_at):
+    """Bucket an unanchored receipt: historical, regression, or live.
+
+    Returns one of:
+      "by_design"  -- unanchorable and CORRECT: a greenfield run with no earlier
+                      commit, or a receipt over uncommitted work. Never a defect,
+                      at any date, so recency is not applied.
+      "historical" -- the generator failed to record an anchor, in a receipt
+                      written BEFORE the fix. History, and never anchorable now.
+      "regression" -- the same generator failure AFTER the fix. The anchor is
+                      being dropped again. This is the only bucket that alarms.
+      "live"       -- the receipt is fine; the environment cannot resolve it yet.
+    """
+    if reason in FROZEN_BY_DESIGN_REASONS:
+        return "by_design"
+    if reason not in FROZEN_GENERATOR_REASONS:
+        return "live"
+    # No timestamp means we cannot place it relative to the fix. Refuse to call
+    # it history, because that is the direction that hides a regression.
+    #
+    # ponytail: lexicographic compare, correct only for the "...Z" ISO form the
+    # generator writes (verified on all 9 receipts). An offset-form timestamp
+    # would sort below the constant and read as historical -- the hiding
+    # direction. Parse properly only if a generator ever emits offsets.
+    if not generated_at:
+        return "regression"
+    return "historical" if generated_at < BASE_SHA_FIX_UTC else "regression"
+
 
 def _git(args, cwd, timeout=30):
     """Run a git command read-only. Returns (rc, stdout). Never raises.
@@ -315,6 +401,9 @@ def outcome_for_receipt(proof_path, cwd):
     state, reason = resolve_anchor(base_sha, head_sha, files, cwd)
     rec["anchor"] = {"state": state, "reason": reason}
     if state != "anchored":
+        # An old receipt is not a regression. Classify so a reader can tell a
+        # frozen pre-fix receipt from a generator that started dropping anchors.
+        rec["anchor"]["klass"] = classify_unanchored(reason, rec["generated_at"])
         rec["outcome"] = UNKNOWN
         rec["reason"] = ANCHOR_REASONS.get(reason, reason or "not anchored")
         rec["commands"] = [
@@ -381,18 +470,28 @@ def summarize(records):
     # as "no data" instead of "your receipts are not recording a landed sha",
     # which is an actionable defect.
     reasons = {}
+    klasses = {"by_design": 0, "historical": 0, "regression": 0, "live": 0}
     for r in records:
         a = r.get("anchor") or {}
         if a.get("state") and a["state"] != "anchored":
             key = a.get("reason") or "unknown"
             reasons[key] = reasons.get(key, 0) + 1
+            k = a.get("klass")
+            if k in klasses:
+                klasses[k] += 1
 
     summary = {
         "receipts_total": total,
         "receipts_measured": len(measured),
         "receipts_unknown": len(unknown),
         "reverted": len(reverted),
         "unanchored_reasons": reasons,
+        # The count that turns an alarming zero into an explained one. A
+        # regression here is the only bucket that warrants action.
+        "unanchored_by_design": klasses["by_design"],
+        "unanchored_historical": klasses["historical"],
+        "unanchored_regression": klasses["regression"],
+        "unanchored_live": klasses["live"],
     }
     if measured:
         summary["change_failure_rate"] = round(len(reverted) / len(measured), 4)
@@ -442,6 +541,29 @@ def render_text(records, summary, note=None):
         out.append("  Why not anchored (a receipt must prove base..head IS the change):")
         for k, n in sorted(reasons.items(), key=lambda kv: -kv[1]):
             out.append(f"    {k:24} {n:3}   {ANCHOR_REASONS.get(k, '')}")
+
+    # Without this, ANCHORED 0 of N reads as a regression when it is history.
+    hist = summary.get("unanchored_historical", 0)
+    regr = summary.get("unanchored_regression", 0)
+    live = summary.get("unanchored_live", 0)
+    design = summary.get("unanchored_by_design", 0)
+    if hist or regr or live or design:
+        out.append("")
+        if design:
+            out.append(f"    {design} by design: a greenfield run or uncommitted"
+                       f" work has no baseline to diff against. Correct, not a"
+                       f" defect, and never anchorable.")
+        if hist:
+            out.append(f"    {hist} historical: written before the base_sha fix"
+                       f" ({BASE_SHA_FIX_UTC[:10]}); the receipt itself has no"
+                       f" baseline, so these can never anchor. Not a defect.")
+        if live:
+            out.append(f"    {live} live: the receipt records real shas; this"
+                       f" clone cannot resolve them yet. May anchor later.")
+        if regr:
+            out.append(f"    {regr} REGRESSION: written AFTER the fix and still"
+                       f" missing a baseline. The generator is dropping the"
+                       f" anchor -- this one is a defect.")
     out.append("")
     cfr = summary.get("change_failure_rate")
     if cfr == UNKNOWN:

autonomy/lib/proof-generator.py

@@ -1024,8 +1024,33 @@ def _collect_iterations(loki_dir):
     return {"count": count, "succeeded": n_completed, "failed": n_failed}
 
 
+# Acceptance-criterion ids as minted at intake ("- AC-<AXIS>-NNN: <text>", see
+# _brief_acceptance_criteria in autonomy/loki). Anchored and strict on purpose:
+# a loose pattern would count prose that merely mentions an id, and the whole
+# value of the id is that a citation points at exactly one criterion.
+_AC_ID_RE = re.compile(r"^- (AC-[A-Z]+-[0-9]{3}): ", re.MULTILINE)
+
+
+def _spec_criteria_declared(text):
+    """Return the acceptance-criterion ids the spec DECLARES, in spec order.
+
+    DECLARED, NOT SATISFIED. This records which criteria exist in the spec and
+    nothing more -- no check runs here, and no field in the receipt asserts that
+    any of these was met. Naming it criteria_met would be a lie we cannot back.
+
+    Empty list when the spec declares none (an older PRD, a hand-written spec,
+    or a run with no spec file at all). Never invented, never a placeholder.
+    """
+    if not text:
+        return []
+    # Deduped: an id is a citation target, so each must resolve to one criterion.
+    # A repeated id is a spec bug; counting it twice would not make it citable.
+    return list(dict.fromkeys(_AC_ID_RE.findall(text)))
+
+
 def _collect_spec(loki_dir, target_dir):
-    """Return spec dict {source, brief}. brief truncated to 600 chars."""
+    """Return spec dict {source, brief, criteria_declared}. brief truncated to
+    600 chars."""
     prd_path = os.environ.get("PRD_PATH", "").strip()
     source = ""
     brief = ""
@@ -1052,7 +1077,15 @@ def _collect_spec(loki_dir, target_dir):
     # Full brief here; the <=600 cap is applied AFTER redaction in generate()
     # so a secret straddling the cap cannot be sliced into an under-length
     # fragment that bypasses the redactor.
-    return {"source": source, "brief": brief}
+    #
+    # Criteria are parsed from the FULL spec text, not from the 600-char display
+    # cap: a PRD's acceptance-criteria block sits well past char 600, so parsing
+    # the capped brief would silently drop most of them.
+    return {
+        "source": source,
+        "brief": brief,
+        "criteria_declared": _spec_criteria_declared(brief),
+    }
 
 
 def _self_version():