@popovych.co/witness 0.15.0 → 0.16.0

package/README.md

@@ -149,6 +149,9 @@ either.
 | `harness: claude-code \| pi` | **the judge** — which harness runs this repo's gate reviewers, is measured by `calibrate`, and is probed by `check`. Judgment resolves `harness:` → `PI_CODING_AGENT` → `CLAUDECODE` → `claude-code`; session lines (`next`'s handoff, `dispatch`'s relay, `init --agent auto`) resolve detection first, because those name the CLI you are about to type at. Committed, so it binds every teammate's gates; `witness init --agent` writes it once and never re-points it. Undeclared repos are judged by whichever agent's session is open — `witness check` and `witness status` say so |
 | `gates.reviewerTimeoutMs` | milliseconds per reviewer invocation (default 600000) |
 | `drive.sessionTimeoutMs` | milliseconds a `drive`-spawned session may run before SIGTERM (default 3600000) |
+| `autonomy: on \| off` | whether the CLI settles its own stops — through its recommendation or the arbiter it launches — and merges its own PRs once CI is green (default off). A committed repo fact: it counts only once HEAD says it, and the merge also needs the ship branch on origin to say it. `--manual` on a gate run keeps that run's stop for a human, and three stops always reach one: the look of a new screen, an unmet plan need and a trust grant |
+| `ship.merge: merge \| squash \| rebase` | how `witness ship` merges its own PR under `autonomy: on` (default merge) — only once the ship gate is approved and CI is green, and never when the approval lapsed or GitHub refuses |
+| `ship.ciSettleMs` | milliseconds a green check set must hold still before `witness ship` merges under autonomy (default 60000, at most 1800000) — gh's watch ends the moment nothing is pending, so a check that registers late would otherwise be missed. Green means at least one check passed and none failed, was cancelled or is pending |
 
 There is no `provider:` key. `witness gate` spawns the DECLARED harness's headless
 mode for every reviewer (Decisions 88, 105): claude-code renders bare Anthropic ids, pi
@@ -187,7 +190,7 @@ the wrong file refuses. There are no `WITNESS_*` env vars for configuration.
 | `start <plan-id>` | create/re-attach the plan's worktree (`.witness/worktrees/<id>`) — code only: the canon dirs are excluded from it, so a plan cannot go stale in there |
 | `next` | the one next action across every effort |
 | `drive [--flow <plan-id>] [--max-spawns <n>]` | schedule green-path work through headless sessions; you appear only at judgment stops. TTY-only — agents are what drive spawns, never what spawns drive |
-| `ship <plan-id>` | lanes → ship gate → PR → CI watch |
+| `ship <plan-id> [--manual]` | lanes → ship gate → PR → CI watch → under autonomy: merge on green · `--manual` keeps that run's stop and merge for a human |
 | `test-evidence` / `verify-red` | journal red/green criteria evidence from a worktree |
 | `adopt <path>` | absolve a finished hand-edit into the journal |
 | `abandon <plan-id \| effort-slug>` | wind a plan/effort down; reverts only specs that effort itself wrote |

package/dist/arbiter.js

@@ -0,0 +1,189 @@
+import { decidedBy } from './autonomy.js';
+import { loadLocalConfig } from './config.js';
+import { openDeferrals } from './deferral.js';
+import { serializeDoc } from './fm.js';
+import { resolveJudge } from './harness.js';
+import { latestRecap, policyPins } from './journal.js';
+import { loadMatrix, resolveModel, SESSION_DEFAULT } from './model.js';
+import { PLACEHOLDER } from './recommend.js';
+import { ok, refuse, v } from './refusal.js';
+import { invokeReviewerAsync, parseVerdictText, promptsSha, resolvePrompt } from './reviewer.js';
+import { effortOf, effortSpecs } from './reviewed.js';
+import { anchorRecurrence, gateRuns, roundBudget } from './rounds.js';
+import { findById } from './scan.js';
+import { canonicalJson } from './sha.js';
+// How a later mode (plan A2's recap check) adds its own prompt without a second invoker.
+export const PROMPT_OF = { decision: 'arbiter' };
+const TEXT_MAX = 600;
+function renderOptions(menu) {
+    return menu.flatMap((o, i) => [
+        `${i + 1}. ${o.command}`,
+        ...(o.why ? [`   why: ${o.why}`] : []),
+        ...(o.judgeFirst ? [`   judge-first: ${o.judgeFirst}`] : []),
+        ...(o.when ? [`   when: ${o.when}`] : []),
+        ...(o.tradeoff ? [`   tradeoff: ${o.tradeoff}`] : []),
+        ...(o.note ? [`   note: ${o.note}`] : []),
+    ]).join('\n');
+}
+function readRuling(text, n) {
+    const rawR = parseVerdictText(text);
+    if (!rawR.ok)
+        return rawR;
+    const raw = rawR.value;
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        return refuse([v('ruling', 'not-an-object', JSON.stringify(raw).slice(0, 120), '{"choice": <n>, "reason": "…"}')]);
+    }
+    const r = raw;
+    const rows = [];
+    if (typeof r.choice !== 'number' || !Number.isInteger(r.choice) || r.choice < 1 || r.choice > n) {
+        rows.push(v('choice', 'not-an-option', String(r.choice), `an option number from 1 to ${n}`));
+    }
+    if (typeof r.reason !== 'string' || r.reason.trim() === '' || r.reason.length > TEXT_MAX) {
+        rows.push(v('reason', 'invalid', typeof r.reason === 'string' ? `${r.reason.length} chars` : String(r.reason), `a non-empty reason of at most ${TEXT_MAX} characters`));
+    }
+    // An empty note is an absent one: the contract marks it optional, and a reroll spent on
+    // `"note": ""` would park a flow over a field that carried nothing.
+    const note = typeof r.note === 'string' && r.note.trim() === '' ? undefined : r.note;
+    if (note !== undefined && note !== null && (typeof note !== 'string' || note.length > TEXT_MAX)) {
+        rows.push(v('note', 'invalid', typeof note === 'string' ? `${note.length} chars` : String(note), `an optional note of at most ${TEXT_MAX} characters`));
+    }
+    if (rows.length > 0)
+        return refuse(rows);
+    return ok({ choice: r.choice, reason: r.reason, ...(typeof note === 'string' ? { note } : {}) });
+}
+export async function arbitrate(ctx, root, cfg, req) {
+    const lensR = resolvePrompt(PROMPT_OF[req.mode]);
+    if (!lensR.ok)
+        return lensR;
+    const lens = lensR.value;
+    const hxR = resolveJudge(ctx.env, cfg.raw);
+    if (!hxR.ok)
+        return refuse(hxR.violations);
+    const harness = hxR.value.harness;
+    const localR = loadLocalConfig(root);
+    if (!localR.ok)
+        return localR;
+    const modelR = resolveModel(cfg, loadMatrix(root, harness.name));
+    if (!modelR.ok)
+        return refuse(modelR.violations);
+    const chain = modelR.value.chain;
+    let prompt = `${lens.contents}\n${req.evidence.map((s) => `\n## ${s.title}\n\n${s.body}\n`).join('')}\n## Options\n\n${renderOptions(req.menu)}\n`;
+    let rung = 0;
+    for (let attempt = 0;; attempt++) {
+        let text;
+        for (;;) {
+            const id = chain[rung];
+            const r = await invokeReviewerAsync(ctx, harness, {
+                cwd: root, prompt, model: id === SESSION_DEFAULT ? undefined : id, lens: 'arbiter',
+                timeoutMs: cfg.gates.reviewerTimeoutMs, extensions: localR.value.reviewerExtensions,
+            });
+            if (r.ok) {
+                text = r.value.text;
+                break;
+            }
+            if (rung >= chain.length - 1)
+                return refuse(r.violations);
+            rung += 1;
+        }
+        const ruling = readRuling(text, req.menu.length);
+        if (ruling.ok) {
+            return ok({ ...ruling.value, model: chain[rung], prompts_sha: promptsSha([{ name: 'arbiter', contents: lens.contents }]) });
+        }
+        if (attempt === 0) {
+            // One self-repair reroll on the same rung, in the shape runBattery gives a lens.
+            prompt += `\n## Previous attempt rejected\n\n${ruling.violations.map((x) => `- ${x.field}: ${x.rule} — got ${x.got}; want ${x.want}`).join('\n')}\n\nRe-emit the complete corrected JSON object.\n`;
+            continue;
+        }
+        return refuse([v('arbiter', 'arbiter-malformed', ruling.violations[0]?.got ?? '', 'a JSON object with choice and reason naming one listed option'), ...ruling.violations]);
+    }
+}
+// The block minus every act the arbiter may never take: anything but a decision (which
+// removes `witness abandon` — the CLI never discards work, D168), any trust grant (D154),
+// any command whose id the CLI could not resolve (the arbiter fills a note, never an id),
+// and every approve over a failed deterministic check — it may overrule a reviewer, never a
+// check. `amendment-ack` alone is the exception: approving IS its acknowledgement.
+// The design gate is the exception that holds whatever the evidence says: the look is the
+// human's (§3 G2), so no approve of it is ever offered — at the bound, on a fallback round or
+// past a spent ladder the arbiter may revise, reset upstream, repair or park, never stamp.
+export function menuFor(block, run) {
+    const failed = run.checks.filter((c) => !c.ok);
+    const approveBarred = run.gate === 'design' || (failed.length > 0 && !failed.every((c) => c.name === 'amendment-ack'));
+    return block.options.filter((o) => o.command.startsWith('witness decide ') &&
+        !/ --trust-cmds\b/.test(o.command) &&
+        !PLACEHOLDER.test(o.command.replace(' --note "<why>"', '')) &&
+        !(approveBarred && / --approve\b/.test(o.command)));
+}
+const anchorText = (a) => (typeof a === 'string' ? a : `omission:${a.scope}`);
+const HISTORY_RUNS = 10;
+// The evidence the arbiter reads, composed by the CLI from the journal and canon. It never
+// carries a session transcript: none exists to carry, and the author's narration is
+// exactly what the arbiter must not hear (anti-goal 1).
+export function decisionEvidence(root, canon, stop) {
+    const { gate, target, entries, run, block } = stop;
+    const findings = (run.verdicts ?? []).flatMap((rv) => rv.findings.map((f) => ({ reviewer: rv.reviewer, f })));
+    const sections = [
+        {
+            title: 'The stop',
+            body: [
+                `gate: ${gate} · target: ${target}`,
+                `round: ${run.round} of ${roundBudget(entries, gate)}`,
+                `rule: ${block.rule}`,
+                `standing: ${run.standing ?? 'none'}`,
+                `model: reviewers answered on ${run.model} · pinned ${run.pin ?? run.model}`,
+            ].join('\n'),
+        },
+        {
+            title: 'Checks',
+            body: run.checks.length === 0 ? 'none'
+                : run.checks.map((c) => `- ${c.name}: ${c.ok ? 'ok' : 'FAILED'}${c.detail ? ` — ${c.detail}` : ''}`).join('\n'),
+        },
+        {
+            title: 'Findings',
+            body: findings.length === 0 ? 'none'
+                : findings.map(({ reviewer, f }) => `- [${reviewer} · ${f.blocking ? 'blocking' : 'non-blocking'}] ${anchorText(f.anchor)} — ${f.claim}${f.contradicts_pin !== undefined ? ` · contradicts pin #${f.contradicts_pin}` : ''}`).join('\n'),
+        },
+    ];
+    const history = [];
+    const runs = gateRuns(entries, gate).slice(-HISTORY_RUNS);
+    for (const r of runs) {
+        const blocks = [...new Set((r.verdicts ?? []).flatMap((rv) => rv.findings.filter((f) => f.blocking).map((f) => anchorText(f.anchor))))];
+        history.push(`- round ${r.round} · @${r.reviewed_sha.slice(0, 7)} · ${r.outcome}${blocks.length ? ` · blocking: ${blocks.join(' · ')}` : ''}`);
+        const at = entries.indexOf(r);
+        for (const e of entries.slice(at + 1)) {
+            if (e.t === 'gate-run' && e.gate === gate)
+                break;
+            if (e.t !== 'human-decision' || e.gate !== gate)
+                continue;
+            const d = e;
+            history.push(`  - ${d.decision} · ${decidedBy(d)}${d.rule ? ` · ${d.rule}` : ''}${d.note ? ` · ${d.note}` : ''}`);
+        }
+    }
+    const current = [...new Set(findings.filter(({ f }) => f.blocking).map(({ f }) => anchorText(f.anchor)))];
+    for (const a of current)
+        history.push(`- recurrence: ${a} · found in ${anchorRecurrence(entries, gate, a)} round(s) of this budget`);
+    for (const d of openDeferrals(entries))
+        history.push(`- open obligation ${d.id} · ${d.anchor} · ${d.kind}`);
+    for (const p of policyPins(entries))
+        history.push(`- pin #${p.ordinal}: ${p.text}`);
+    sections.push({ title: 'Round history', body: history.length === 0 ? 'none' : history.join('\n') });
+    if (gate === 'ship' || gate === 'decompose') {
+        const effort = gate === 'decompose' ? target : effortOf(root, target);
+        const recap = effort !== undefined ? latestRecap(root, effort) : undefined;
+        const scope = [`### The effort's recap\n\n${recap ? canonicalJson(recap) : 'none recorded'}`];
+        if (gate === 'ship') {
+            const plan = findById(canon, target);
+            const parent = plan ? findById(canon, String(plan.meta.parent)) : undefined;
+            if (parent)
+                scope.push(`### The spec: ${String(parent.meta.id)}\n\n${serializeDoc({ meta: parent.meta, body: parent.body })}`);
+            if (plan)
+                scope.push(`### The plan: ${target}\n\n${serializeDoc({ meta: plan.meta, body: plan.body })}`);
+        }
+        else {
+            for (const s of effortSpecs(root, canon, target)) {
+                scope.push(`### The spec: ${String(s.meta.id)}\n\n${serializeDoc({ meta: s.meta, body: s.body })}`);
+            }
+        }
+        sections.push({ title: 'Scope', body: scope.join('\n\n') });
+    }
+    return sections;
+}

package/dist/autonomy.js

@@ -0,0 +1,84 @@
+import { boundReached, fellBack } from './rounds.js';
+import { cmd, kv } from './toon.js';
+export const KEPT_STOP_NAMES = {
+    'design-look': 'design look',
+    'unmet-need': 'unmet need',
+    'trust-grant': 'trust grant',
+};
+// Printed first on `next`, `start`, `gate` and `decide --show` whenever the repo has opted
+// in, so a skill learns the mode from CLI output and never from memory (A1, A8).
+export function autonomyLines(cfg) {
+    if (!cfg.autonomy)
+        return [];
+    return [kv('autonomy', 'on'),
+        kv('kept-stops', Object.keys(KEPT_STOP_NAMES).map((k) => KEPT_STOP_NAMES[k]).join(' · '))];
+}
+// `cmd`, not `kv`: a detail can carry a quoted command, and `kv` would quote the whole
+// line into something that no longer pastes (D120).
+export function keptStopLine(stop, detail) {
+    return cmd('kept-stop', `${KEPT_STOP_NAMES[stop]} — ${detail}`);
+}
+// The rules whose recommendation the CLI takes as it stands (design §7 A2's table). Each is
+// a fix with a right answer — revise here, revise upstream, approve over nits, re-run a
+// stale or malformed round — so no judgment is owed and none is spent.
+const TAKEN = new Set(['blocking-here', 'blocking-parent', 'bound-recurrence', 'non-blocking-only',
+    'stale-below-bound', 'malformed-rerun']);
+// An ordered first-match list, like recommend.ts's rule table, and dispatched by GATE before
+// RULE: the recommender's rules overlap, so a design stop with only non-blocking findings
+// matches `non-blocking-only` before `reserved-stop-clean` (E8), and a rule-keyed policy
+// would approve the one look the user kept for themselves.
+export function policyFor(facts) {
+    if (facts.at === 'start')
+        return { kind: 'human', stop: 'unmet-need' };
+    if (facts.at !== 'gate')
+        return { kind: 'take', command: facts.block.options[0].command };
+    const { gate, target, entries, run, block, untrusted } = facts;
+    const failed = run.checks.filter((c) => !c.ok);
+    const blocks = (run.verdicts ?? []).some((rv) => rv.findings.some((f) => f.blocking));
+    const clean = failed.length === 0 && !blocks;
+    // Option 1 only when it pastes: a placeholder (`<effort>`) means no upstream resolved,
+    // and filling an id is exactly what the arbiter may never do either — but it can pick
+    // another option, so the stop goes there rather than to a command that would refuse.
+    const first = () => {
+        const o = block.options[0];
+        return o !== undefined && o.runnable ? { kind: 'take', command: o.command } : { kind: 'arbiter' };
+    };
+    if (untrusted.length > 0)
+        return { kind: 'human', stop: 'trust-grant' };
+    // A verdict that describes bytes no longer there, or a round that judged nothing, is a free
+    // re-run before it is anything else: no human or arbiter can honestly act on it, and the
+    // standing and fallback arms below would hand it to one with the re-run filtered away.
+    if (block.rule === 'stale-below-bound' || block.rule === 'malformed-rerun')
+        return first();
+    if (gate === 'design' && clean)
+        return { kind: 'human', stop: 'design-look' };
+    if ((gate === 'ship' || gate === 'decompose') && clean && run.standing !== undefined)
+        return { kind: 'arbiter' };
+    if (fellBack(run))
+        return { kind: 'arbiter' };
+    // A trust failure granted since the stop: the check never ran, so the fix is a re-run,
+    // not a revise — sending the author back would have them "fix" a command nobody judged.
+    if (failed.some((c) => (c.untrusted?.length ?? 0) > 0) && !boundReached(entries, gate)) {
+        return { kind: 'take', command: `witness gate ${gate} ${target}` };
+    }
+    if (block.rule === 'checks-failed') {
+        // amendment-ack is the one check an approve clears, so approving is a judgment about the
+        // amendment against the ask — the arbiter's, never the rule's (§11 call 10).
+        return failed.every((c) => c.name === 'amendment-ack') ? { kind: 'arbiter' } : first();
+    }
+    if (TAKEN.has(block.rule) || block.rule.startsWith('anchor-recurrence-'))
+        return first();
+    // bound · bound-stale · ladder-spent · pin-contradiction · reserved-stop-clean · manual-stop
+    return { kind: 'arbiter' };
+}
+// Row 173. Who made a disposition, in one spelling for every surface that says so
+// (`decide --show`, `log`, `status`).
+export function decidedBy(d) {
+    if (d.selected === 'policy')
+        return 'policy';
+    if (d.selected === 'arbiter')
+        return `arbiter · ${d.arbiter?.model ?? 'unknown'}`;
+    if (d.selected === 'affirmation')
+        return 'human · affirmation';
+    return 'human';
+}

package/dist/cli.js

@@ -71,7 +71,7 @@ const VERB_USAGE = {
     rename: 'witness rename <old-id> <new-id>',
     satisfy: 'witness satisfy <doc-id> --need <text | index>',
     dismiss: 'witness dismiss <artifact> --deferral <id|index> --cause <superseded|lens-retired|judged-wrong> --note "<why>"',
-    ship: 'witness ship <plan-id>',
+    ship: 'witness ship <plan-id> [--manual]',
     start: 'witness start <plan-id>',
     status: 'witness status — flows · blocked docs · reconcile rows · pending gates (bare `witness` is the same screen)',
     sync: 'witness sync',

package/dist/config.js

@@ -1,3 +1,4 @@
+import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 import { parse as parseYaml } from 'yaml';
@@ -137,6 +138,56 @@ export function resolveGates(raw) {
     }
     return ok({ reviewerTimeoutMs: val });
 }
+// Rows 171-175. Whether the CLI settles its own stops is a REPO fact — committed, read by
+// every teammate's CLI alike — so it lives here and never in config.local.yaml. Spelled as
+// the strings `on | off` and nothing else: YAML 1.1 reads `yes`/`on` as booleans and 1.2
+// does not, so accepting booleans would make the same file mean two things across parsers.
+export function resolveAutonomy(raw) {
+    const val = raw.autonomy;
+    if (val === undefined)
+        return ok(false);
+    if (val === 'on')
+        return ok(true);
+    if (val === 'off')
+        return ok(false);
+    return refuse([v('autonomy', 'invalid', String(val), 'on | off')]);
+}
+const MERGE_STYLES = ['merge', 'squash', 'rebase'];
+export const DEFAULT_CI_SETTLE_MS = 60_000;
+export const MAX_CI_SETTLE_MS = 1_800_000;
+// The rest of `ship.*` (test, lint, branch) is still read loosely at its consumers; only
+// the key with a closed value set is resolved here, and only when `ship` is a map.
+export function resolveShip(raw) {
+    const conf = raw.ship;
+    if (typeof conf !== 'object' || conf === null || Array.isArray(conf))
+        return ok({ merge: 'merge', ciSettleMs: DEFAULT_CI_SETTLE_MS });
+    const val = conf.merge;
+    if (val !== undefined && (typeof val !== 'string' || !MERGE_STYLES.includes(val))) {
+        return refuse([v('ship.merge', 'invalid', String(val), 'merge | squash | rebase')]);
+    }
+    const settle = conf.ciSettleMs;
+    // Bounded by the watch window (30 minutes): a longer settle can never be met, and past
+    // 2^31-1 ms a Node timer fires at once — the window would silently become zero.
+    if (settle !== undefined && (typeof settle !== 'number' || !Number.isInteger(settle) || settle < 0 || settle > MAX_CI_SETTLE_MS)) {
+        return refuse([v('ship.ciSettleMs', 'invalid', String(settle), `an integer from 0 to ${MAX_CI_SETTLE_MS} — milliseconds a green check set must hold before witness merges`)]);
+    }
+    return ok({ merge: (val ?? 'merge'), ciSettleMs: settle ?? DEFAULT_CI_SETTLE_MS });
+}
+// Row 171 (F11). Autonomy is a COMMITTED repo fact: on only when HEAD's witness.config.yaml
+// says so as well. A working-copy edit — the coding agent's, say — grants nothing, because
+// the setting it would grant is merge authority over that agent's own work. `autonomyAt` reads
+// any revision: the merge asks the shipped branch's remote copy (row 174), a fact the agent
+// cannot make true with a local commit.
+export function autonomyAt(root, rev) {
+    try {
+        const text = execFileSync('git', ['show', `${rev}:witness.config.yaml`], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+        return (parseYaml(text) ?? {}).autonomy === 'on';
+    }
+    catch {
+        return false;
+    }
+}
+const committedAutonomy = (root) => autonomyAt(root, 'HEAD');
 const LOCAL_KEYS = ['reviewerExtensions', 'opener'];
 export const localConfigPath = (root) => join(root, '.witness', 'config.local.yaml');
 export function loadLocalConfig(root) {
@@ -235,6 +286,13 @@ export function loadConfig(root) {
     const drive = resolveDrive(obj);
     if (!drive.ok)
         return refuse(drive.violations);
+    const autonomy = resolveAutonomy(obj);
+    if (!autonomy.ok)
+        return refuse(autonomy.violations);
+    const shipCfg = resolveShip(obj);
+    if (!shipCfg.ok)
+        return refuse(shipCfg.violations);
+    const uncommitted = autonomy.value && !committedAutonomy(root);
     return ok({
         schema,
         raw: obj,
@@ -243,6 +301,10 @@ export function loadConfig(root) {
         implement: implement.value,
         gates: gates.value,
         drive: drive.value,
-        warning: schema < SCHEMA_VERSION ? `schema ${schema} < ${SCHEMA_VERSION} — run witness migrate (reserved)` : undefined,
+        autonomy: autonomy.value && !uncommitted,
+        ship: shipCfg.value,
+        warning: schema < SCHEMA_VERSION ? `schema ${schema} < ${SCHEMA_VERSION} — run witness migrate (reserved)`
+            : uncommitted ? 'autonomy: on is not committed — it stays off until witness.config.yaml is committed'
+                : undefined,
     });
 }

package/dist/criteria.js

@@ -2,7 +2,7 @@ import { ensureTrusted } from './allowlist.js';
 import { loadConfig } from './config.js';
 import { matchesTag, sourceTags } from './matcher.js';
 import { ok } from './refusal.js';
-import { criteriaExcludes, execCommand, runFiltered, runFullSuite, runnerConfig } from './runner.js';
+import { criteriaExcludes, execCommand, runFiltered, runFullSuite, runnerConfig, untrustedOf } from './runner.js';
 import { canonicalSha } from './sha.js';
 export async function runCriteria(runRoot, ctx, doc, opts = {}) {
     const trustRoot = opts.trustRoot ?? runRoot;
@@ -21,12 +21,15 @@ export async function runCriteria(runRoot, ctx, doc, opts = {}) {
     const list = (Array.isArray(doc.meta.criteria) ? doc.meta.criteria : []);
     let suite = opts.suite;
     let suiteProblem;
+    let suiteUntrusted;
     if (rc.mode === 'full-suite' && suite === undefined && list.some((c) => typeof c.test === 'string')) {
         const res = await runFullSuite(runRoot, ctx, rc, trustRoot);
         if (res.ok)
             suite = res.value.tests;
-        else
+        else {
             suiteProblem = res.violations.map((x) => `${x.rule}: ${x.field}`).join('; ');
+            suiteUntrusted = untrustedOf(res.violations);
+        }
     }
     const src = rc.mode === 'filtered'
         ? sourceTags(runRoot, criteriaExcludes(cfg.value))
@@ -37,7 +40,8 @@ export async function runCriteria(runRoot, ctx, doc, opts = {}) {
         if (typeof c.test === 'string') {
             if (rc.mode === 'full-suite') {
                 if (!suite) {
-                    criteria.push({ id: cid, kind: 'test', ok: false, detail: suiteProblem ?? 'suite did not run' });
+                    criteria.push({ id: cid, kind: 'test', ok: false, detail: suiteProblem ?? 'suite did not run',
+                        ...(suiteUntrusted !== undefined ? { untrusted: suiteUntrusted } : {}) });
                     continue;
                 }
                 const mine = suite.filter((t) => matchesTag(t.name, id));
@@ -52,7 +56,9 @@ export async function runCriteria(runRoot, ctx, doc, opts = {}) {
                 const run = await runFiltered(runRoot, ctx, rc.template, id, trustRoot);
                 const count = src?.counts.get(id) ?? 0;
                 if (!run.ok) {
-                    criteria.push({ id: cid, kind: 'test', ok: false, detail: run.violations.map((x) => x.rule).join('; ') });
+                    const blocked = untrustedOf(run.violations);
+                    criteria.push({ id: cid, kind: 'test', ok: false, detail: run.violations.map((x) => x.rule).join('; '),
+                        ...(blocked !== undefined ? { untrusted: blocked } : {}) });
                 }
                 else if (count === 0) {
                     criteria.push({ id: cid, kind: 'test', ok: false, detail: 'no tagged test found in source (grep side)' });
@@ -74,6 +80,7 @@ export async function runCriteria(runRoot, ctx, doc, opts = {}) {
                 criteria.push({
                     id: cid, kind: 'cmd', ok: false,
                     detail: `untrusted-${trust} — run: witness trust ${id} (or set WITNESS_TRUST_CMDS=1)`,
+                    untrusted: c.cmd,
                 });
                 continue;
             }
@@ -93,3 +100,19 @@ export async function runCriteria(runRoot, ctx, doc, opts = {}) {
         criteria,
     });
 }
+// The drift-lane row both code gates journal — one renderer, so implement and ship cannot
+// disagree about it. `untrusted` (row 171) collects every command trust kept from running,
+// deduplicated in criterion order, so the trust stop reads it from the run's own record.
+export function laneCheck(lane) {
+    const untrusted = lane.ok
+        ? [...new Set(lane.value.criteria.flatMap((c) => (c.untrusted !== undefined ? [c.untrusted] : [])))]
+        : [];
+    return {
+        name: 'drift-lane',
+        ok: lane.ok && lane.value.ok,
+        detail: lane.ok
+            ? lane.value.criteria.map((c) => `${c.id}:${c.ok ? 'ok' : 'fail'}`).join(' · ')
+            : lane.violations.map((x) => `${x.field}:${x.rule}`).join(' · '),
+        ...(untrusted.length > 0 ? { untrusted } : {}),
+    };
+}

package/dist/evidence.js

@@ -6,7 +6,7 @@ import { entryLine, appendEntry, journalRel, readStream } from './journal.js';
 import { mergeReports, reportFiles } from './junit.js';
 import { extractCanonicalTags, matchesTag } from './matcher.js';
 import { ok, refuse, v } from './refusal.js';
-import { runFiltered, runFullSuite, runnerConfig } from './runner.js';
+import { runFiltered, runFullSuite, runnerConfig, untrustedOf } from './runner.js';
 import { git, stateCommit, tryGit } from './gitio.js';
 import { kv } from './toon.js';
 import { withTxn } from './txn.js';
@@ -269,7 +269,9 @@ export async function runRegression(runRoot, ctx, trustRoot, specIds, known) {
             memo.set(id, run);
         }
         if (!run.ok) {
-            out.push({ spec: id, state: 'unrunnable', detail: run.violations.map((x) => x.rule).join(' · ') });
+            const blocked = untrustedOf(run.violations);
+            out.push({ spec: id, state: 'unrunnable', detail: run.violations.map((x) => x.rule).join(' · '),
+                ...(blocked !== undefined ? { untrusted: blocked } : {}) });
             continue;
         }
         const failed = run.value.tests.filter((t) => !t.ok).length;

package/dist/gate.js

@@ -2,7 +2,7 @@ import { join } from 'node:path';
 import { EXIT, version } from './cli.js';
 import { loadConfig, loadLocalConfig } from './config.js';
 import { writeDoc } from './fm.js';
-import { crashPoint, guardTxn, withTxn } from './txn.js';
+import { crashPoint, guardTxn, pendingTxn, withTxn } from './txn.js';
 import { acquireLock } from './lock.js';
 import { appendEntry, entryLine, journalRel, policyPins, readStream } from './journal.js';
 import { untrustedCmdsFor } from './allowlist.js';
@@ -19,9 +19,10 @@ import { runBattery } from './battery.js';
 import { anchorMenu } from './verdict.js';
 import { ROUND_BOUND, appendKind, boundReached, fellBack, lastGateRun, liveExits, roundBudget, roundsSinceApprove, runsSinceReset, } from './rounds.js';
 export { liveExits } from './rounds.js';
-import { gateSettled } from './verbs/next.js';
+import { gateSettled, owedRun } from './verbs/next.js';
 import { prepareStamp, writeStamp } from './stamp.js';
 import { recommend, renderDecision } from './recommend.js';
+import { autonomyLines } from './autonomy.js';
 const GATES = new Map();
 export function registerGate(spec) { GATES.set(spec.gate, spec); }
 export function gateSpec(name) { return GATES.get(name); }
@@ -132,7 +133,27 @@ export function printDispatchArithmetic(ctx, root, gateName, target) {
     const steps = (doc.meta.steps ?? []).length;
     ctx.out(kv('dispatches', `${steps} step(s) ≈ ${Math.ceil(steps / budget)} dispatch(es) at budget ${budget}`));
 }
+// Row 173. The gate, then — under `autonomy: on` and not a `--manual` run — the settling of
+// the stop it produced or re-showed, in the same invocation, so a chat session and drive
+// meet one rule. Below that line nothing changes: with autonomy off this is `judge` alone.
 export async function runGate(ctx, gateName, target, flags) {
+    const code = await judge(ctx, gateName, target, flags);
+    if (code !== EXIT.FINDINGS && code !== EXIT.BLOCKED)
+        return code;
+    if (flags.manual)
+        return code;
+    const rootR = primaryRoot(ctx.cwd);
+    if (!rootR.ok)
+        return code;
+    const cfgR = loadConfig(rootR.value);
+    if (!cfgR.ok || !cfgR.value.autonomy || pendingTxn(rootR.value) !== undefined)
+        return code;
+    // A dynamic import: settle.ts reaches decide.ts, whose gates/index.js import would close a
+    // static cycle through this module — each gate's registerGate would run before GATES exists.
+    const { settleStop, settledCode } = await import('./settle.js');
+    return settledCode(code, await settleStop(ctx, rootR.value, cfgR.value, gateName, target));
+}
+async function judge(ctx, gateName, target, flags) {
     const rootR = primaryRoot(ctx.cwd);
     if (!rootR.ok) {
         renderRefusal(rootR.violations).forEach((l) => ctx.err(l));
@@ -152,6 +173,20 @@ export async function runGate(ctx, gateName, target, flags) {
         renderRefusal(cfgR.violations).forEach((l) => ctx.err(l));
         return EXIT.REFUSED;
     }
+    // `--manual` keeps this run's stop for a human, so for this run autonomy is off and the
+    // CLI does not claim otherwise.
+    if (!flags.manual)
+        autonomyLines(cfgR.value).forEach((l) => ctx.out(l));
+    // Row 173. Under autonomy the tail settles the stop, so the block is ITS to print — the
+    // human's when the stop is kept, nobody's when the CLI decides. Left in place for a stop
+    // the tail will not touch: a `--manual` run's, a parked or settled one, a malformed round.
+    const autonomous = cfgR.value.autonomy && !flags.manual;
+    const leftToTail = (es) => {
+        if (!autonomous)
+            return false;
+        const owed = owedRun(es, gateName);
+        return owed !== undefined && !owed.manual;
+    };
     const canon = loadCanon(root);
     const inputR = await spec.resolve(root, ctx, canon, cfgR.value, target);
     if (!inputR.ok) {
@@ -262,7 +297,10 @@ export async function runGate(ctx, gateName, target, flags) {
     // silently re-rendering; the verdicts are REPLAYED (`cached`), so no battery is spent.
     // Compared on `ok` alone: a detail carries run output on some gates (timings, paths), and
     // keying on it would append a round for every re-run of an unchanged tree.
-    const checkOk = (cs) => cs.map((c) => `${c.name}:${c.ok}`).sort().join('|');
+    // A check trust kept from running and one that ran and failed are both `ok: false`, but they
+    // are different judgments: granting the command flips the first into the second, and without
+    // this term the gate resumed the blocked round forever while the policy re-ran it (F3).
+    const checkOk = (cs) => cs.map((c) => `${c.name}:${c.ok}${(c.untrusted?.length ?? 0) > 0 ? ':blocked' : ''}`).sort().join('|');
     if ((kind.kind === 'resume' || kind.kind === 'changed-nothing') &&
         checkOk(kind.entry.checks) !== checkOk(input.checks) &&
         kind.entry.outcome !== 'malformed' && (kind.entry.verdicts?.length ?? 0) > 0) {
@@ -276,7 +314,10 @@ export async function runGate(ctx, gateName, target, flags) {
         ctx.err(`warning: reviewer setup changed — this run discards the settled approve on ${spec.gate} ${target}`);
     }
     if (kind.kind === 'resume') {
-        renderGateRun(ctx, kind.entry, 'resume', { entries, upstream: upstreamId });
+        renderGateRun(ctx, kind.entry, 'resume', {
+            entries, upstream: upstreamId,
+            ...(kind.entry.outcome === 'stopped' && leftToTail(entries) ? { help: false } : {}),
+        });
         printDispatchArithmetic(ctx, root, spec.gate, target);
         return kind.entry.outcome === 'passed' ? EXIT.OK : EXIT.FINDINGS;
     }
@@ -291,7 +332,8 @@ export async function runGate(ctx, gateName, target, flags) {
     if (boundReached(entries, spec.gate)) {
         ctx.out(kv('gate', spec.gate));
         ctx.out(kv('outcome', `round bound reached (${roundsSinceApprove(entries, spec.gate)} rounds since last approve)`));
-        renderChoices(ctx, spec.gate, target, entries, upstreamId);
+        if (!leftToTail(entries))
+            renderChoices(ctx, spec.gate, target, entries, upstreamId);
         return EXIT.BLOCKED;
     }
     if (!flags.fresh) {
@@ -400,7 +442,8 @@ export async function runGate(ctx, gateName, target, flags) {
         if (boundReached(entriesNow, spec.gate)) {
             ctx.out(kv('gate', spec.gate));
             ctx.out(kv('outcome', `round bound reached (${roundsSinceApprove(entriesNow, spec.gate)} rounds since last approve)`));
-            renderChoices(ctx, spec.gate, target, entriesNow, upstreamId);
+            if (!leftToTail(entriesNow))
+                renderChoices(ctx, spec.gate, target, entriesNow, upstreamId);
             return EXIT.BLOCKED;
         }
         const entry = {
@@ -470,7 +513,11 @@ export async function runGate(ctx, gateName, target, flags) {
             renderRefusal(txn.violations).forEach((l) => ctx.err(l));
             return EXIT.REFUSED;
         }
-        renderGateRun(ctx, entry, 'ran', { entries: [...entriesNow, entry], upstream: upstreamId });
+        const after = [...entriesNow, entry];
+        renderGateRun(ctx, entry, 'ran', {
+            entries: after, upstream: upstreamId,
+            ...(entry.outcome === 'stopped' && leftToTail(after) ? { help: false } : {}),
+        });
         printDispatchArithmetic(ctx, root, spec.gate, target);
         for (const d of discharged)
             ctx.out(kv('discharged', `${d.id} — no longer reported by this round`));

package/dist/gates/implement.js

@@ -9,7 +9,7 @@ import { git, stateDirs } from '../gitio.js';
 import { latestRecap, readStream } from '../journal.js';
 import { findById } from '../scan.js';
 import { changedFiles, changedTestSpecs, diffBase, evidenceForDiff, runRegression, screensDir } from '../evidence.js';
-import { runCriteria } from '../criteria.js';
+import { laneCheck, runCriteria } from '../criteria.js';
 import { diffReviewedSha, effortOf, implementReviewedSha } from '../reviewed.js';
 import { worktreePath } from '../worktree.js';
 import { registerGate } from '../gate.js';
@@ -123,6 +123,7 @@ registerGate({
         // criteria, arbitrary trust-gated commands, inside an unattended gate.
         const foreign = changedTestSpecs(wt, base, String(plan.meta.parent));
         const regression = await runRegression(wt, ctx, root, foreign, (id) => findById(canon, id) !== undefined);
+        const regressionUntrusted = [...new Set(regression.flatMap((r) => (r.untrusted !== undefined ? [r.untrusted] : [])))];
         checks.push({
             name: 'regression',
             // `unknown` does not fail: witness cannot judge an obligation for a spec it does not
@@ -132,15 +133,9 @@ registerGate({
             detail: regression.length === 0
                 ? 'no foreign spec tests touched'
                 : regression.map((r) => `${r.spec}:${r.state}`).join(' · '),
+            ...(regressionUntrusted.length > 0 ? { untrusted: regressionUntrusted } : {}),
         });
-        const lane = await runCriteria(wt, ctx, parent, { trustRoot: root });
-        checks.push({
-            name: 'drift-lane',
-            ok: lane.ok && lane.value.ok,
-            detail: lane.ok
-                ? lane.value.criteria.map((c) => `${c.id}:${c.ok ? 'ok' : 'fail'}`).join(' · ')
-                : lane.violations.map((x) => `${x.field}:${x.rule}`).join(' · '),
-        });
+        checks.push(laneCheck(await runCriteria(wt, ctx, parent, { trustRoot: root })));
         const effort = effortOf(root, planId);
         const recap = effort ? latestRecap(root, effort) : undefined;
         return ok({