atris 3.37.0 → 3.38.0

package/commands/worktree.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
 const { stampLatestOpenBriefForWorktree } = require('../lib/brief-ledger');
+const { isConductorArtifact } = require('../lib/conductor-artifacts');
 
 const REGEN_ADAPTER_FILES = ['AGENTS.md', 'CLAUDE.md', 'GEMINI.md'];
 const COMMAND_MAX_BUFFER_BYTES = 64 * 1024 * 1024;
@@ -261,11 +262,16 @@ function baseBranchName(ref) {
   return String(ref || '').replace(/^refs\/heads\//, '').replace(/^origin\//, '');
 }
 
-function statusCounts(root, { ignoredUnstagedFiles = new Set(), ignoredUntrackedFiles = new Set() } = {}) {
+function statusCounts(root, {
+  ignoredUnstagedFiles = new Set(),
+  ignoredUntrackedFiles = new Set(),
+  ignoreUntracked = null,
+} = {}) {
   if (!fs.existsSync(root)) return null;
   // -uall expands untracked directories to individual files so ignoredUntrackedFiles
-  // can match exact paths (plain porcelain collapses them to "?? dir/").
-  const statusArgs = ignoredUntrackedFiles.size ? ['status', '--porcelain', '-uall'] : ['status', '--porcelain'];
+  // and ignoreUntracked can match exact paths (plain porcelain collapses them to "?? dir/").
+  const expandUntracked = ignoredUntrackedFiles.size || typeof ignoreUntracked === 'function';
+  const statusArgs = expandUntracked ? ['status', '--porcelain', '-uall'] : ['status', '--porcelain'];
   const result = runGit(statusArgs, { cwd: root, check: false });
   if (result.status !== 0) return null;
   let staged = 0;
@@ -276,6 +282,7 @@ function statusCounts(root, { ignoredUnstagedFiles = new Set(), ignoredUntracked
     if (ignoredUnstagedFiles.has(file) && line[0] === ' ' && line[1] !== ' ') continue;
     if (line.startsWith('??')) {
       if (ignoredUntrackedFiles.has(file)) continue;
+      if (typeof ignoreUntracked === 'function' && ignoreUntracked(file)) continue;
       untracked += 1;
       continue;
     }
@@ -285,6 +292,16 @@ function statusCounts(root, { ignoredUnstagedFiles = new Set(), ignoredUntracked
   return { staged, unstaged, untracked };
 }
 
+// Remove conductor plumbing from the index after a broad `git add -A`, so the commit
+// records engine output only. Paths that were never staged are simply not listed.
+function unstageConductorArtifacts(root) {
+  const staged = runGit(['diff', '--cached', '--name-only'], { cwd: root, check: false });
+  if (staged.status !== 0) return [];
+  const drop = String(staged.stdout || '').split(/\r?\n/).filter(Boolean).filter(isConductorArtifact);
+  if (drop.length) runGit(['reset', '-q', 'HEAD', '--', ...drop], { cwd: root, check: false });
+  return drop;
+}
+
 function changedFiles(root, args) {
   const result = runGit([...args, '--', ...REGEN_ADAPTER_FILES], { cwd: root, check: false });
   if (result.status !== 0) return new Set();
@@ -472,6 +489,14 @@ function createOrFindPr(root, branch, targetRef, title, dryRun) {
     `Target: ${targetBranch}`,
   ].join('\n');
   if (dryRun) return `dry-run: gh pr create --base ${targetBranch} --head ${branch}`;
+  // An engine that produced nothing leaves a branch level with its base. Asking
+  // GitHub for a PR there fails with "No commits between ...", and that throw used
+  // to escape the flight and abort the whole run. Say it plainly instead.
+  const ahead = runGit(['rev-list', '--count', `${targetRef}..HEAD`], { cwd: root, check: false });
+  if (ahead.status === 0 && String(ahead.stdout || '').trim() === '0') {
+    console.log('pr: skipped (no commits ahead of base)');
+    return '';
+  }
   const created = spawnSync(
     'gh',
     ['pr', 'create', '--base', targetBranch, '--head', branch, '--title', title, '--body', body],
@@ -498,6 +523,36 @@ function shipHelp() {
   console.log('  recommended flight verify: npm run test:fast && node --test <focused files>');
 }
 
+function deniedLaneForShip(root, branch, message) {
+  try {
+    const { DENIED_TAGS } = require('../lib/fleet');
+    const refs = new Set();
+    for (const source of [String(branch || ''), String(message || '')]) {
+      for (const m of source.toUpperCase().matchAll(/([A-Z]{2,6}-\d+)/g)) refs.add(m[1]);
+      for (const m of source.toLowerCase().matchAll(/([a-z]{2,6})-(\d+)/g)) refs.add(`${m[1].toUpperCase()}-${m[2]}`);
+    }
+    if (!refs.size) return null;
+    const projectionPath = path.join(findPrimaryRoot(root), '.atris', 'state', 'tasks.projection.json');
+    if (!fs.existsSync(projectionPath)) return null;
+    const projection = JSON.parse(fs.readFileSync(projectionPath, 'utf8'));
+    for (const task of projection.tasks || []) {
+      const ids = [task.display_id, task.legacy_ref].filter(Boolean).map(v => String(v).toUpperCase());
+      if (!ids.some(id => refs.has(id))) continue;
+      const tags = [task.tag, ...(task.metadata?.todo_tags || [])].filter(Boolean).map(t => String(t).toLowerCase());
+      const hit = tags.find(t => DENIED_TAGS.includes(t));
+      if (hit) return { taskId: ids[0], tag: hit };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+function findPrimaryRoot(root) {
+  const worktrees = listWorktrees(root);
+  return worktrees[0]?.path || root;
+}
+
 function shipWorktree(args) {
   if (hasFlag(args, '--help') || hasFlag(args, '-h') || args[0] === 'help') {
     shipHelp();
@@ -531,6 +586,17 @@ function shipWorktree(args) {
     console.error('blocked: ship from an isolated worktree, not the primary checkout');
     return 2;
   }
+  // Denied lanes are checked at dispatch, but a flight that was staffed
+  // before a task entered a denied lane (or killed mid-flight) could still
+  // ship: a payments command self-landed twice this way on 2026-07-26. The
+  // ship gate is the last door, so it re-checks.
+  if (!hasFlag(args, '--allow-denied-lane')) {
+    const denied = deniedLaneForShip(root, branch, message);
+    if (denied) {
+      console.error(`blocked: this branch carries ${denied.taskId} which sits in the protected ${denied.tag} lane; a human lands it (or pass --allow-denied-lane on written order)`);
+      return 2;
+    }
+  }
 
   let oneLapProof = null;
   try {
@@ -552,7 +618,10 @@ function shipWorktree(args) {
   refreshRemoteRef(root, targetRef);
   const skippedAdapters = restoreRegeneratedAdapterChurn(root, message, { dryRun });
   const ignoredUnstagedFiles = dryRun ? new Set(skippedAdapters) : new Set();
-  const counts = statusCounts(root, { ignoredUnstagedFiles }) || { staged: 0, unstaged: 0, untracked: 0 };
+  // Conductor plumbing must not make the checkout look dirty, or a flight where the
+  // engine wrote nothing commits the fleet's own prompt file and calls it work.
+  const counts = statusCounts(root, { ignoredUnstagedFiles, ignoreUntracked: isConductorArtifact })
+    || { staged: 0, unstaged: 0, untracked: 0 };
   const dirty = counts.staged || counts.unstaged || counts.untracked;
   if (dirty && !message) {
     console.error('blocked: --message is required when there are local changes to commit');
@@ -563,6 +632,9 @@ function shipWorktree(args) {
     console.log(`commit: ${message}`);
     if (!dryRun) {
       runGit(['add', '-A'], { cwd: root });
+      // `add -A` sweeps in the fleet's own prompt file and friends. Drop them from the
+      // index so a work commit carries work, not harness plumbing. Safe when absent.
+      unstageConductorArtifacts(root);
       if (!proofTreeMatches('index')) return 3;
       runGit(['commit', '-m', message], { cwd: root });
       if (!proofTreeMatches('head')) return 3;
@@ -578,7 +650,12 @@ function shipWorktree(args) {
     if (!dryRun) runCommand(verify, { cwd: root });
     const afterVerifyRows = dryRun ? [] : statusSnapshot(root);
     const verifyDelta = newStatusRows(beforeVerify, afterVerifyRows);
-    const afterVerify = dryRun ? { staged: 0, unstaged: 0, untracked: 0 } : statusCounts(root) || { staged: 0, unstaged: 0, untracked: 0 };
+    // This check exists to catch a verifier that writes files. Conductor plumbing was
+    // already present before the verifier ran, so counting it here blocks a clean ship.
+    const afterVerify = dryRun
+      ? { staged: 0, unstaged: 0, untracked: 0 }
+      : statusCounts(root, { ignoreUntracked: isConductorArtifact })
+        || { staged: 0, unstaged: 0, untracked: 0 };
     if (!dryRun && (afterVerify.staged || afterVerify.unstaged || afterVerify.untracked)) {
       console.error(
         `blocked: verifier left checkout dirty staged=${afterVerify.staged} ` +
@@ -687,8 +764,10 @@ function guard(args) {
     console.error('run: atris worktree start --member <member>|--agent <name> --task "<short task>" --claim');
     return 2;
   }
-  // The CLI's own worktree metadata (written by `worktree start`) must not count as dirt.
-  const counts = statusCounts(root, { ignoredUntrackedFiles: new Set(['.atris/agent-worktree.json']) });
+  // Conductor plumbing (worktree metadata, the fleet prompt written for this very
+  // engine, runtime scratch, the brief ledger) must not count as dirt — otherwise the
+  // harness blocks the engine with the harness's own files.
+  const counts = statusCounts(root, { ignoreUntracked: isConductorArtifact });
   if (counts && (counts.staged || counts.unstaged || counts.untracked) && !hasFlag(args, '--allow-dirty')) {
     console.error(`blocked: checkout is dirty staged=${counts.staged} unstaged=${counts.unstaged} untracked=${counts.untracked}`);
     return 3;
@@ -880,20 +959,14 @@ function worktreeCommand(args = []) {
 
 module.exports = {
   branchName,
-  statusSnapshot,
-  newStatusRows,
   createAgentWorktree,
+  deniedLaneForShip,
   createOrFindPr,
   cleanupWorktrees,
-  defaultShipTarget,
   defaultStartBase,
-  defaultWorktreePath,
   listWorktrees,
   parseWorktrees,
-  REGEN_ADAPTER_FILES,
   normalizeTargetRef,
-  restoreRegeneratedAdapterChurn,
-  prMergeRef,
   slugify,
   statusCounts,
   swarloClaim,

package/commands/xp.js

@@ -2353,6 +2353,7 @@ async function xpCommand(...args) {
   });
   if (!result.ok) {
     console.error(`Failed to load XP graph: ${result.error || result.status}`);
+    console.error('Run: atris xp --local  to render your AgentXP from proof receipts in this workspace.');
     process.exit(1);
   }
 
@@ -2366,14 +2367,8 @@ async function xpCommand(...args) {
 
 module.exports = {
   xpCommand,
-  buildContributionRows,
   buildCareerXpProjection,
-  buildAllCareerXpProjection,
-  buildCareerXpSessionCapsule,
-  collectAllLocalXpProjection,
   collectLocalXpProjection,
-  buildAgentXpSyncPacket,
   syncAgentXp,
-  receiptFromTaskEpisode,
   render,
 };

package/commands/youtube.js

@@ -452,13 +452,11 @@ async function youtubeCommand(argv = process.argv.slice(3), deps = {}) {
 module.exports = {
   DEFAULT_QUERY,
   DEFAULT_TIMEOUT_MS,
-  showYoutubeHelp,
   parseYoutubeArgs,
   buildYoutubePayload,
   extractLocalTranscript,
   processYoutube,
   shouldRetryWithLocalTranscript,
   formatYoutubeResult,
-  formatTimestampFromMs,
   youtubeCommand,
 };

package/lib/accept-verify-gate.js

@@ -0,0 +1,122 @@
+'use strict';
+
+// The accept gate used to check that a task's verify field was non-empty, never
+// that it held something that could fail. An audit on 2026-07-26 found 131 of 802
+// accepted proofs (16.3%) were unfalsifiable at the moment they were signed off:
+// 54 an unfilled template sentence, 55 a bare `git diff --check`, 21 a path into a
+// deleted worktree, 1 a bare file path.
+//
+// This module answers one question before a task may be marked done: does the
+// stored verify command actually run, and does it pass? Parsing and execution reuse
+// lib/auto-accept-certified.js so there is one allow-list, not two.
+
+const { parseVerifyCommand, runVerifyCommandCached } = require('./auto-accept-certified');
+
+// Template text shipped in task scaffolding. Present verbatim in 54 accepted proofs.
+const TEMPLATE_PLACEHOLDERS = [
+  'concrete command, file, receipt, or verifier evidence',
+  'command, file, receipt, or verifier evidence',
+  '<command>',
+  'tbd',
+  'n/a',
+  'none',
+];
+
+// Commands that execute cleanly but cannot fail for the reason the task exists.
+// `git diff --check` reports whitespace and conflict markers; it is green on a
+// commit that deletes the feature. 55 accepted proofs stored exactly this.
+const NON_FALSIFYING_COMMANDS = [
+  /^git\s+diff\s+--check\s*$/i,
+  /^git\s+status\s*$/i,
+  /^git\s+log\b/i,
+  /^ls\b/i,
+  /^true\s*$/i,
+];
+
+function storedVerifyCommand(task) {
+  const metadata = (task && task.metadata) || {};
+  const candidates = [metadata.verify, metadata.latest_agent_verify];
+  for (const candidate of candidates) {
+    const text = String(candidate || '').trim();
+    if (text) return text;
+  }
+  return '';
+}
+
+function placeholderIssue(command) {
+  const lower = command.toLowerCase().trim();
+  if (TEMPLATE_PLACEHOLDERS.some((p) => lower === p || lower.startsWith(p))) {
+    return 'the verify field holds unfilled template text, not a command';
+  }
+  // A bare path is a receipt, not a check. `/tmp/x/proof.json` was one of the 131.
+  if (/^[./~]/.test(command) && !/\s/.test(command)) {
+    return 'the verify field holds a file path, not a command that can fail';
+  }
+  return '';
+}
+
+function nonFalsifyingIssue(command) {
+  if (NON_FALSIFYING_COMMANDS.some((re) => re.test(command.trim()))) {
+    return `\`${command.trim()}\` cannot fail for the reason this task exists — it passes on a commit that deletes the work`;
+  }
+  return '';
+}
+
+// Returns { ok, reason, detail, command, ran, exit_code }.
+// ok:true means the stored command parsed, ran, and exited 0.
+function evaluateAcceptVerify(task, workspaceRoot, { cache = null } = {}) {
+  const command = storedVerifyCommand(task);
+  // A task with no stored verify is out of scope here. Every one of the 131
+  // unfalsifiable proofs HAD a command; the defect is a stored check that cannot
+  // fail, not a missing one. Requiring a verify on every accept is a separate,
+  // larger policy change and blocking it here would only get this gate switched off.
+  if (!command) {
+    return { ok: true, reason: 'no_verify_command', detail: '', command: '', ran: false, unchecked: true };
+  }
+
+  const placeholder = placeholderIssue(command);
+  if (placeholder) return { ok: false, reason: 'verify_placeholder', detail: placeholder, command, ran: false };
+
+  const hollow = nonFalsifyingIssue(command);
+  if (hollow) return { ok: false, reason: 'verify_not_falsifying', detail: hollow, command, ran: false };
+
+  // Two different questions got fused here at first: "can this fail?" and "is this
+  // safe to execute at accept time?". Only the first is this gate's business.
+  // Refusing everything outside the execution allow-list flagged 455 accepted tasks,
+  // and sampling them found ordinary verifiers — `npm run type-check`, `npx vitest
+  // run` — sitting beside real prose. A gate that blocks real work gets switched off.
+  // So: refuse what provably cannot fail, run what can be run safely, and mark the
+  // rest unchecked rather than pretend a judgment we cannot make.
+  const parsed = parseVerifyCommand(command);
+  if (!parsed.ok) {
+    return {
+      ok: true,
+      reason: 'verify_not_runnable_here',
+      detail: `the stored verify command cannot be safely executed at accept time (${parsed.reason || 'unknown'}); it was not checked`,
+      command,
+      ran: false,
+      unchecked: true,
+    };
+  }
+
+  const result = runVerifyCommandCached(command, workspaceRoot, cache);
+  if (!result.ok) {
+    return {
+      ok: false,
+      reason: result.reason || 'verify_failed',
+      detail: result.reason === 'verify_workdir_missing' || result.reason === 'verify_worktree_missing'
+        ? 'the stored verify command points at a directory that no longer exists'
+        : `the stored verify command did not pass (${result.reason || 'nonzero exit'})`,
+      command,
+      ran: true,
+      exit_code: typeof result.status === 'number' ? result.status : null,
+    };
+  }
+
+  return { ok: true, reason: 'verify_passed', detail: '', command, ran: true, exit_code: 0 };
+}
+
+module.exports = {
+  storedVerifyCommand,
+  evaluateAcceptVerify,
+};

package/lib/activity-stream.js

@@ -154,13 +154,11 @@ function buildHeartbeat(pulseReceipts, now = Date.now()) {
 }
 
 module.exports = {
-  pickTs,
   clip,
   normalizePulse,
   normalizeScorecard,
   normalizeTaskEpisode,
   normalizeXp,
-  normalizeMissionEvent,
   buildActivityStream,
   buildHeartbeat,
 };

package/lib/auto-accept-certified.js

@@ -458,11 +458,29 @@ function runVerifyCommand(verify, workspaceRoot) {
   if (!pythonPathCheck.ok) return pythonPathCheck;
   const result = spawnSync(parsed.argv[0], parsed.argv.slice(1), {
     cwd: cwdCheck.cwd,
-    env: parsed.env ? { ...process.env, ...parsed.env } : process.env,
+    env: verifyCommandEnv(parsed.env),
     shell: false,
     encoding: 'utf8',
     timeout: 120000,
   });
+  // "I could not run the check" is not "the check failed". Collapsing the two
+  // let a broken harness read as broken code: under cron's PATH every
+  // `npm run ...` verifier returned ENOENT, mapped to verify_failed, and 16
+  // landable tasks were skipped silently every hour for 20 days. A verifier
+  // the harness cannot execute must be loud and must never look like a
+  // verdict on the work.
+  const unrunnable = unrunnableVerifyReason(result);
+  if (unrunnable) {
+    return {
+      ok: false,
+      reason: 'verify_unrunnable',
+      unrunnable_cause: unrunnable,
+      alarm: true,
+      command: parsed.argv.join(' '),
+      status: result.status,
+      stderr: String(result.stderr || '').slice(0, 400),
+    };
+  }
   return {
     ok: result.status === 0,
     reason: result.status === 0 ? 'verify_passed' : 'verify_failed',
@@ -471,6 +489,36 @@ function runVerifyCommand(verify, workspaceRoot) {
   };
 }
 
+// Verifiers run with shell:false, so the child gets no PATH resolution beyond
+// whatever the parent inherited. Cron has no Homebrew PATH — that is why every
+// cron entry hardcodes an absolute node path. `npm`, `npx` and friends live in
+// the same bin directory as the node binary currently executing, so seeding
+// PATH with it makes recorded checks runnable from cron with zero config: no
+// crontab PATH line to keep in sync, no new env var.
+function verifyCommandEnv(extraEnv) {
+  const base = extraEnv ? { ...process.env, ...extraEnv } : { ...process.env };
+  const binDir = path.dirname(process.execPath);
+  const current = String(base.PATH || '');
+  const alreadyPresent = current.split(path.delimiter).includes(binDir);
+  if (binDir && !alreadyPresent) {
+    base.PATH = current ? `${binDir}${path.delimiter}${current}` : binDir;
+  }
+  return base;
+}
+
+// ENOENT: the binary is not on PATH at all. ETIMEDOUT: the 120s ceiling cut it
+// off before it could reach a verdict. Neither is evidence about the diff.
+function unrunnableVerifyReason(result) {
+  const code = result && result.error ? result.error.code : null;
+  if (code === 'ENOENT') return 'command_not_found';
+  if (code === 'ETIMEDOUT' || result.signal === 'SIGTERM') return 'verify_timed_out';
+  if (code) return String(code).toLowerCase();
+  // spawnSync reports a null status with no error object when the child was
+  // killed outright; treat that as unrunnable rather than a silent failure.
+  if (result && result.status === null) return 'no_exit_status';
+  return null;
+}
+
 function runVerifyCommandCached(verify, workspaceRoot, cache = null) {
   if (!(cache instanceof Map)) return runVerifyCommand(verify, workspaceRoot);
   const key = `${path.resolve(workspaceRoot || process.cwd())}\u0000${String(verify || '').trim()}`;
@@ -507,6 +555,61 @@ function receiptEvidenceBlock(task, ref) {
   return null;
 }
 
+// Authors declare protected lanes in the task text, not the tag field. Match
+// only explicit, deliberate declarations — an unanchored "security" would
+// snag every task that merely mentions the word and wedge the loop shut,
+// which is its own failure mode. Kept narrow on purpose.
+const PROTECTED_LANE_PHRASES = [
+  'protected lane',
+  'never self-land',
+  'never self land',
+  'do not self-land',
+  'human accepts',
+  'human must accept',
+  'human review required',
+  'orchestrator reviews pre-land',
+  'reviews pre-land',
+];
+
+function declaredProtectedLane(task) {
+  const haystack = [
+    task.title,
+    task.objective,
+    task.metadata && task.metadata.protected_lane_note,
+  ]
+    .map((v) => String(v || ''))
+    .join('\n')
+    .toLowerCase();
+  if (!haystack.trim()) return null;
+  const phrase = PROTECTED_LANE_PHRASES.find((p) => haystack.includes(p));
+  return phrase ? { phrase } : null;
+}
+
+// Only consulted when a task carries no tag at all, so this never overrides an
+// author who did classify their work. Terms are concrete nouns from the denied
+// lanes — things you can only be touching on purpose. Deliberately excludes
+// broad words like "auth", "user", or "api" that appear in ordinary frontend
+// work and would hold the whole queue.
+const PROTECTED_LANE_TERMS = [
+  ['billing', ['stripe', 'checkout url', 'checkout_url', 'invoice', 'paywall', 'subscription', 'wallet', 'credit card', 'pricing tier']],
+  ['security', ['session minting', 'mints a', 'service token', 'api key', 'credential', 'secret key', 'csrf', 'access token']],
+  ['deploy', ['render deploy', 'production deploy', 'deploy to prod', 'migration apply']],
+  ['customer', ['send email to', 'customer email', 'outbound email', 'notify users']],
+];
+
+function sniffedProtectedLane(task) {
+  const haystack = [task.title, task.objective]
+    .map((v) => String(v || ''))
+    .join('\n')
+    .toLowerCase();
+  if (!haystack.trim()) return null;
+  for (const [lane, terms] of PROTECTED_LANE_TERMS) {
+    const term = terms.find((t) => haystack.includes(t));
+    if (term) return { lane, term };
+  }
+  return null;
+}
+
 function evaluateAutoAccept(task, options = {}) {
   const {
     strictVerify = true,
@@ -539,12 +642,47 @@ function evaluateAutoAccept(task, options = {}) {
     tag === d || tag.split(/[^a-z0-9]+/).some((w) => w === d || w.replace(/s$/, '') === d));
   if (deniedTag) return { eligible: false, ref, reason: `denied_tag_${deniedTag}` };
 
+  // A protected lane declared in prose is not a protection, it is a note.
+  // WEB-410 said "PROTECTED LANE: auth/session minting ... never self-land"
+  // in its own title, carried tag 'endgame', and auto-landed anyway. Routing
+  // safety through a tag field that authors leave empty fails open, silently.
+  // So read the declaration where authors actually write it.
+  const declared = declaredProtectedLane(task);
+  if (declared) {
+    return {
+      eligible: false,
+      ref,
+      reason: 'declared_protected_lane',
+      declared_lane: declared.phrase,
+      next_action: 'this task declares a protected lane in its own text; a human accepts it with `atris task accept <ref> --as <human>`',
+    };
+  }
+
   // accept-all: the protected lanes above are the only human gate. No
   // certification, pass-count, reviewer, or proof-quality bar — but work
   // is never marked done against evidence it isn't: a proof naming an
   // unmerged draft PR still blocks, and a recorded check that FAILS still
   // blocks (absence of a check does not).
   if (acceptAll) {
+    // In this lane the tag IS the safety system — the only human gate. But
+    // most rows carry no tag at all (13 of 16 in the 2026-07-25 sweep), so
+    // refusing every untagged task would wedge the loop shut, which is the
+    // same outage as failing open, just quieter. Instead: when there is no
+    // tag to route on, read the task text for the denied lanes themselves.
+    // WEB-406 (Stripe checkout + paywall) landed untagged this way.
+    if (!tag) {
+      const sniffed = sniffedProtectedLane(task);
+      if (sniffed) {
+        return {
+          eligible: false,
+          ref,
+          reason: 'untagged_protected_lane_text',
+          declared_lane: sniffed.lane,
+          matched: sniffed.term,
+          next_action: `no tag to route on and the text reads as the ${sniffed.lane} lane; tag it or accept explicitly as a human`,
+        };
+      }
+    }
     const proof = latestProof(task);
     if (proofHasUnmergedPullRequestBoundary(proof)) {
       return unmergedPullRequestBoundaryResult(ref, proof);
@@ -570,8 +708,12 @@ function evaluateAutoAccept(task, options = {}) {
       // into "lands unchecked" the morning after it clears the worktree.
       // A check that merely isn't in the runnable allowlist counts as no
       // check at all.
+      // verify_unrunnable blocks for the same reason worktree_missing does:
+      // it used to arrive here as verify_failed, so leaving it out would turn
+      // "the harness could not run the check" into "landed unchecked".
       if ((tierRequiresStrictVerify && !verifyResult.ok)
         || verifyResult.reason === 'verify_failed'
+        || verifyResult.reason === 'verify_unrunnable'
         || verifyResult.reason === 'verify_worktree_missing') {
         return { eligible: false, ref, reason: verifyResult.reason, verify, ...verifyResult };
       }
@@ -663,8 +805,9 @@ function evaluateAutoAccept(task, options = {}) {
 
 module.exports = {
   AGENT_CERTIFICATION_REVIEW_PASSES,
-  AUTO_ACCEPT_HIGH_CONFIDENCE_PASSES,
   DENIED_TAGS,
+  declaredProtectedLane,
+  sniffedProtectedLane,
   evaluateAutoAccept,
   isAutoCertifyVerifyCommandAllowed,
   isAgentCertified,

package/lib/autoland.js

@@ -661,7 +661,6 @@ module.exports = {
   composeDigest,
   composeLiveUpdate,
   cronInstalled,
-  cronMarker,
   dueForAlarm,
   digestLine,
   dejargon,
@@ -669,7 +668,6 @@ module.exports = {
   installCron,
   liveAcceptAuthorization,
   markAlerted,
-  missionDigestLine,
   operatorReady,
   hasAgentJargon,
   voicePatterns: Object.freeze({
@@ -685,7 +683,6 @@ module.exports = {
   sendImessage,
   statePath,
   uninstallCron,
-  waitingHours,
   waitingOnHuman,
   writePolicy,
   writeState,