atris 3.43.0 → 3.45.1

package/commands/improve.js

@@ -918,10 +918,15 @@ function formatImproveReport(result = {}) {
 }
 
 // ---------------------------------------------------------------------------
-// atris improve revisions — the gauge for the north-star metric:
-// operator revisions after landing = 0. an agent landing is a commit carrying
-// the atris co-author trailer (atris-builder[bot]); if a human commit touches
-// any of the same files within 72 hours, that landing failed the guarantee.
+// atris improve revisions: the gauge for the north-star metric:
+// operator revisions after landing = 0. an agent landing is a commit whose
+// Co-authored-by trailer matches a known agent signature (atris-builder[bot],
+// claude, cursor, codex, chatgpt, openai), case-insensitive, and only on
+// those trailer lines. commits with no trailer still count as human, so the
+// metric overcounts revisions; accepted on purpose.
+//
+// if a human commit touches any of the same files within 72 hours, that
+// landing failed the guarantee.
 //
 // renames are NOT followed: `git log --follow` is per-file and would cost one
 // subprocess per file per landing, so a post-landing rename reads as "no
@@ -930,9 +935,26 @@ function formatImproveReport(result = {}) {
 const REVISIONS_SCHEMA = 'atris.improve_revisions.v1';
 const REVISION_WINDOW_HOURS = 72;
 const REVISION_WINDOW_MS = REVISION_WINDOW_HOURS * 60 * 60 * 1000;
-const AGENT_TRAILER_MARKER = 'atris-builder[bot]';
+const AGENT_TRAILER_MARKERS = [
+  'atris-builder[bot]',
+  'claude',
+  'cursor',
+  'codex',
+  'chatgpt',
+  'openai',
+];
 const DEFAULT_REVISIONS_DAYS = 14;
 
+function isAgentCommitBody(body) {
+  const markers = AGENT_TRAILER_MARKERS.map((m) => m.toLowerCase());
+  for (const line of String(body || '').split(/\r?\n/)) {
+    if (!/^\s*co-authored-by\s*:/i.test(line)) continue;
+    const lower = line.toLowerCase();
+    if (markers.some((m) => lower.includes(m))) return true;
+  }
+  return false;
+}
+
 function parseRevisionsArgs(argv = []) {
   const args = Array.isArray(argv) ? argv : [];
   const opts = { days: DEFAULT_REVISIONS_DAYS, json: false, help: false };
@@ -999,7 +1021,7 @@ function collectRevisionSignals(root, options = {}) {
         at: String(at || '').trim(),
         ms: timestampMs(at),
         subject: String(subject || '').trim(),
-        isAgent: String(body || '').includes(AGENT_TRAILER_MARKER),
+        isAgent: isAgentCommitBody(body),
       };
     })
     .filter((c) => c.hash && c.ms != null);
@@ -1350,6 +1372,7 @@ module.exports = {
   runLoopDoctor,
   collectRevisionSignals,
   formatRevisionsReport,
+  isAgentCommitBody,
   runLocalFallback,
   summarizeLocalMissionRun,
   LOCAL_FALLBACK_ARGS,

package/commands/init.js

@@ -602,9 +602,12 @@ function initAtris() {
 
 
   // Copy team members (MEMBER.md format — directory per member with skills/tools/context)
-  const starterMembers = ['navigator', 'executor', 'validator', 'mission-lead', 'improver'];
+  const starterMembers = ['navigator', 'executor', 'validator', 'mission-lead', 'improver', 'customer-lead'];
+  const starterMemberFiles = ['MEMBER.md', 'SOUL.md', 'START_HERE.md'];
+  const starterMemberDirs = ['skills', 'tools', 'context'];
   starterMembers.forEach(name => {
-    const sourceFile = path.join(__dirname, '..', 'atris', 'team', name, 'MEMBER.md');
+    const sourceMemberDir = path.join(__dirname, '..', 'atris', 'team', name);
+    const sourceFile = path.join(sourceMemberDir, 'MEMBER.md');
     const targetMemberDir = path.join(teamDir, name);
     const targetFile = path.join(targetMemberDir, 'MEMBER.md');
     const legacyFile = path.join(teamDir, `${name}.md`);
@@ -614,11 +617,17 @@ function initAtris() {
 
     if (fs.existsSync(sourceFile)) {
       fs.mkdirSync(targetMemberDir, { recursive: true });
-      fs.mkdirSync(path.join(targetMemberDir, 'skills'), { recursive: true });
-      fs.mkdirSync(path.join(targetMemberDir, 'tools'), { recursive: true });
-      fs.mkdirSync(path.join(targetMemberDir, 'context'), { recursive: true });
-      fs.copyFileSync(sourceFile, targetFile);
-      markReady('team', name, `✓ Created team/${name}/ (MEMBER.md + skills/ + tools/ + context/)`);
+      starterMemberDirs.forEach(dirName => {
+        const sourceDir = path.join(sourceMemberDir, dirName);
+        const targetDir = path.join(targetMemberDir, dirName);
+        fs.mkdirSync(targetDir, { recursive: true });
+        if (fs.existsSync(sourceDir)) fs.cpSync(sourceDir, targetDir, { recursive: true });
+      });
+      starterMemberFiles.forEach(fileName => {
+        const source = path.join(sourceMemberDir, fileName);
+        if (fs.existsSync(source)) fs.copyFileSync(source, path.join(targetMemberDir, fileName));
+      });
+      markReady('team', name, `✓ Created team/${name}/ (identity + skills/ + tools/ + context/)`);
     }
   });
 

package/commands/mission.js

@@ -46,6 +46,7 @@ const {
   renderEmailLine,
   renderMorningCardRow,
 } = require('../lib/receipt-block');
+const { findCachedMissionStepReceipt } = require('../lib/receipt-evidence');
 const {
   pruneRuns,
   runsPruneLines,
@@ -79,7 +80,7 @@ const {
   missionVerifierTimeoutMs,
   resolveDefaultVerifier,
 } = require('../lib/default-verifier');
-const { redirectToWorkspaceRoot } = require('../lib/mission-root');
+const { resolveWorkspaceRoot, redirectToWorkspaceRoot } = require('../lib/mission-root');
 const { readJson, writeJson } = require('../lib/json-file');
 const {
   normalizeHumanAsks,
@@ -908,6 +909,11 @@ function loadMissionMap(root = process.cwd()) {
   return map;
 }
 
+function hasLocalMissionState(root = process.cwd()) {
+  return readJsonLines(statePaths(root).missionsJsonl)
+    .some((mission) => mission && mission.id && mission.cloud !== true);
+}
+
 function terminalNextAction(status) {
   if (status === 'complete') return 'mission complete';
   if (status === 'stopped') return 'mission stopped';
@@ -9151,6 +9157,8 @@ async function executeMissionRunTicksPhase(context) {
       const tickStart = stampIso();
       const tickWorktreeBefore = gitWorktreeSnapshot(cwd);
       let result = { status: 'skipped', reason: 'unknown', tick_index: tickIdx, ran: false, started_at: tickStart };
+      let cachedStep = findCachedMissionStepReceipt(cwd, { missionId: mission.id, tickIndex: tickIdx });
+      let cachedVerifierResult = cachedStep ? cachedStep.verifier_result : null;
       const tickSelection = resolveMissionTickRunner(runtimeMission, cwd);
       const tickRuntimeMission = tickSelection.mission;
       const tickRunnerName = String(tickRuntimeMission.runner || '').trim().toLowerCase();
@@ -9182,7 +9190,17 @@ async function executeMissionRunTicksPhase(context) {
       }
 
       // Active-hours gate
-      if (engineBackedTick && !tickEngineId) {
+      if (cachedStep) {
+        result = {
+          ...result,
+          ...cachedStep.tick,
+          tick_index: tickIdx,
+          cached: true,
+          reason: 'receipt-cache-hit',
+          ran: cachedStep.tick.ran !== false,
+          status: cachedStep.tick.status || 'ran',
+        };
+      } else if (engineBackedTick && !tickEngineId) {
         result = { ...result, status: 'errored', reason: 'no-ready-engine' };
       } else if (!isWithinActiveHours(mission.active_hours)) {
         result = { ...result, status: 'skipped', reason: 'quiet-hours' };
@@ -9399,7 +9417,7 @@ async function executeMissionRunTicksPhase(context) {
         }
       }
 
-      if (tickEngineId) {
+      if (tickEngineId && !cachedStep) {
         result.rate_limit_info = lastRateLimit;
         const engineHealth = recordMissionEngineTickOutcome(tickEngineId, result, cwd);
         if (engineHealth) result.engine_health = engineHealth.health;
@@ -9415,12 +9433,18 @@ async function executeMissionRunTicksPhase(context) {
         tickIdx,
         frozen,
       };
-      await verifyMissionRunTickPhase(context);
-      result = context.currentTick.result;
-      const verifierResult = context.currentTick.verifierResult;
+      let verifierResult = null;
+      if (cachedStep) {
+        verifierResult = cachedVerifierResult;
+        if (verifierResult) result.verifier_passed = verifierResult.passed;
+      } else {
+        await verifyMissionRunTickPhase(context);
+        result = context.currentTick.result;
+        verifierResult = context.currentTick.verifierResult;
+      }
       pauseReason = context.pauseReason;
       context.currentTick = null;
-      let receiptPath = null;
+      let receiptPath = cachedStep ? cachedStep.receipt_path : null;
 
       // Review-lane drain: always-on loops sweep the agent-safe review actions
       // each tick so proof-backed work reaches certified on cadence with zero
@@ -9430,27 +9454,32 @@ async function executeMissionRunTicksPhase(context) {
           ? { skipped: true, reason: 'no-drain-flag' }
           : runReviewLaneDrain(cwd);
       }
-      const tickWorktree = worktreeReceipt(tickWorktreeBefore, gitWorktreeSnapshot(cwd), { verifier: frozen.verifier, baseline: runWorktreeBaseline });
+      const tickWorktree = cachedStep?.tick?.worktree
+        || worktreeReceipt(tickWorktreeBefore, gitWorktreeSnapshot(cwd), { verifier: frozen.verifier, baseline: runWorktreeBaseline });
 
       // Layer classification needs the receipt text AND the worktree receipt, so it
       // runs here — after both exist — covering the claude and atris2 branches alike.
-      const tickReceiptText = result.atris2?.receipt_text || result.claude?.receipt_text || result.drill?.receipt_text || '';
-      const layerInfo = extractLayerFromReceiptText(tickReceiptText, tickWorktree?.new_since_baseline_sample);
-      result.layer = layerInfo.layer;
-      result.layer_source = layerInfo.source;
+      if (!(cachedStep && cachedStep.tick && cachedStep.tick.layer)) {
+        const tickReceiptText = result.atris2?.receipt_text || result.claude?.receipt_text || result.drill?.receipt_text || '';
+        const layerInfo = extractLayerFromReceiptText(tickReceiptText, tickWorktree?.new_since_baseline_sample);
+        result.layer = layerInfo.layer;
+        result.layer_source = layerInfo.source;
+      }
 
       // Persist tick to mission state + write structured receipt
       const finishedAt = stampIso();
-      const tickRecord = { ...result, started_at: tickStart, finished_at: finishedAt, worktree: tickWorktree };
+      const tickRecord = { ...result, started_at: result.started_at || tickStart, finished_at: result.finished_at || finishedAt, worktree: tickWorktree };
       ticks.push(tickRecord);
-      receiptPath = writeReceipt(runtimeMission, {
-        kind: 'mission_run_tick',
-        tick: tickRecord,
-        frozen,
-        verifier_result: verifierResult,
-        rate_limit_info: lastRateLimit,
-        worktree: tickWorktree,
-      });
+      if (!receiptPath) {
+        receiptPath = writeReceipt(runtimeMission, {
+          kind: 'mission_run_tick',
+          tick: tickRecord,
+          frozen,
+          verifier_result: verifierResult,
+          rate_limit_info: lastRateLimit,
+          worktree: tickWorktree,
+        });
+      }
 
       const xpReadyAction = missionXpReadyAction(mission, receiptPath);
       const budgetRemainingSeconds = missionFullBudgetRemainingSeconds(mission);
@@ -9938,56 +9967,72 @@ function tickMission(args) {
     const tickStart = stampIso();
     const lastTickIndex = Number(mission.last_tick_index || 0);
     const tickIdx = lastTickIndex + 1;
-    const tickWorktreeBefore = gitWorktreeSnapshot(cwd);
-    const worktreeBaseline = loadMissionWorktreeBaseline(mission.id, cwd);
-    const protectedLaneGuard = inspectMissionTickProtectedDiff(mission, tickWorktreeBefore, cwd);
-
+    // Interrupt between writeReceipt and saveMission leaves a completed receipt
+    // for this tick_index while last_tick_index stays behind. Reuse it on resume
+    // instead of re-deriving the step from scratch.
+    const cachedStep = findCachedMissionStepReceipt(cwd, { missionId: mission.id, tickIndex: tickIdx });
     const effectiveVerifier = effectiveMissionVerifier(mission);
     const verifierCommand = verify
       ? String(verifyOverride || effectiveVerifier || '').trim()
       : '';
-    if (verifierCommand) assertMissionVerifier(verifierCommand, asJson);
+    if (!cachedStep && verifierCommand) assertMissionVerifier(verifierCommand, asJson);
 
     let verifierResult = null;
-    if (protectedLaneGuard.allowed && verify && verifierCommand) {
-      verifierResult = runVerifier(verifierCommand);
-    }
-    const tickWorktree = worktreeReceipt(tickWorktreeBefore, gitWorktreeSnapshot(cwd), { verifier: verifierCommand || effectiveVerifier, baseline: worktreeBaseline });
-
-    // Same layer classification as the run-tick path; manual ticks carry their
-    // receipt text in --summary.
-    const layerInfo = extractLayerFromReceiptText(summary || '', tickWorktree?.new_since_baseline_sample);
-    const guardPauseReason = protectedLaneGuard.unreadable
-      ? 'mission-diff-unreadable'
-      : 'protected-lane-review';
-    const tickRecord = {
-      status: protectedLaneGuard.allowed ? 'ran' : protectedLaneGuard.status,
-      reason: protectedLaneGuard.allowed ? 'tick-recorded' : guardPauseReason,
-      tick_index: tickIdx,
-      ran: protectedLaneGuard.allowed,
-      started_at: tickStart,
-      claude: { skipped: true, reason: 'orchestrator-is-caller-session' },
-      summary: summary || null,
-      layer: layerInfo.layer,
-      layer_source: layerInfo.source,
-      verifier_passed: verifierResult ? !!verifierResult.passed : null,
-      protected_lane_guard: protectedLaneGuard,
-      finished_at: stampIso(),
-      worktree: tickWorktree,
-    };
-    const receiptPath = writeReceipt(mission, {
-      kind: 'mission_tick',
-      tick: tickRecord,
-      frozen: {
-        verifier: verifierCommand || effectiveVerifier || '',
-        lane: mission.lane || 'workspace',
+    let tickRecord = null;
+    let receiptPath = null;
+    if (cachedStep) {
+      tickRecord = {
+        ...cachedStep.tick,
+        cached: true,
+        reason: 'receipt-cache-hit',
+      };
+      verifierResult = cachedStep.verifier_result;
+      receiptPath = cachedStep.receipt_path;
+    } else {
+      const tickWorktreeBefore = gitWorktreeSnapshot(cwd);
+      const worktreeBaseline = loadMissionWorktreeBaseline(mission.id, cwd);
+      const protectedLaneGuard = inspectMissionTickProtectedDiff(mission, tickWorktreeBefore, cwd);
+
+      if (protectedLaneGuard.allowed && verify && verifierCommand) {
+        verifierResult = runVerifier(verifierCommand);
+      }
+      const tickWorktree = worktreeReceipt(tickWorktreeBefore, gitWorktreeSnapshot(cwd), { verifier: verifierCommand || effectiveVerifier, baseline: worktreeBaseline });
+
+      // Same layer classification as the run-tick path; manual ticks carry their
+      // receipt text in --summary.
+      const layerInfo = extractLayerFromReceiptText(summary || '', tickWorktree?.new_since_baseline_sample);
+      const guardPauseReason = protectedLaneGuard.unreadable
+        ? 'mission-diff-unreadable'
+        : 'protected-lane-review';
+      tickRecord = {
+        status: protectedLaneGuard.allowed ? 'ran' : protectedLaneGuard.status,
+        reason: protectedLaneGuard.allowed ? 'tick-recorded' : guardPauseReason,
+        tick_index: tickIdx,
+        ran: protectedLaneGuard.allowed,
         started_at: tickStart,
-      },
-      verifier_result: verifierResult,
-      protected_lane_guard: protectedLaneGuard,
-      rate_limit_info: null,
-      worktree: tickWorktree,
-    });
+        claude: { skipped: true, reason: 'orchestrator-is-caller-session' },
+        summary: summary || null,
+        layer: layerInfo.layer,
+        layer_source: layerInfo.source,
+        verifier_passed: verifierResult ? !!verifierResult.passed : null,
+        protected_lane_guard: protectedLaneGuard,
+        finished_at: stampIso(),
+        worktree: tickWorktree,
+      };
+      receiptPath = writeReceipt(mission, {
+        kind: 'mission_tick',
+        tick: tickRecord,
+        frozen: {
+          verifier: verifierCommand || effectiveVerifier || '',
+          lane: mission.lane || 'workspace',
+          started_at: tickStart,
+        },
+        verifier_result: verifierResult,
+        protected_lane_guard: protectedLaneGuard,
+        rate_limit_info: null,
+        worktree: tickWorktree,
+      });
+    }
 
 	    let status = 'running';
 	    let nextAction = (verifierCommand || effectiveVerifier)
@@ -9995,7 +10040,8 @@ function tickMission(args) {
 	      : (mission.always_on && missionTaskSpine(mission)?.has_task
 	        ? nextCandidateTickAction(mission)
 	        : 'attach task, verifier, or proof');
-	    const nextGoalChain = advanceMissionGoalChain(mission.goal_chain, summary, verifierResult);
+	    const nextGoalChain = advanceMissionGoalChain(mission.goal_chain, summary || tickRecord.summary, verifierResult);
+	    const protectedLaneGuard = tickRecord.protected_lane_guard || { allowed: true };
 	    if (!protectedLaneGuard.allowed) {
 	      status = 'paused';
 	      nextAction = protectedLaneGuard.unreadable
@@ -10072,9 +10118,10 @@ function tickMission(args) {
     const atrisGoalState = refreshAtrisGoalController(process.cwd(), { missionId: outputMission.id });
     const codexGoalState = refreshCodexGoalController(process.cwd());
     printJsonOrText(
-      { ok: true, action: 'mission_tick', mission: outputMission, tick: tickRecord, verifier_result: verifierResult, blocker, receipt_path: receiptPath, log_path: logPath, atris_goal_state: atrisGoalState, codex_goal_state: codexGoalState, continuation_goal: continuationGoal, operator_summary_warning: operatorSummaryWarning },
+      { ok: true, action: 'mission_tick', mission: outputMission, tick: tickRecord, verifier_result: verifierResult, blocker, receipt_path: receiptPath, log_path: logPath, atris_goal_state: atrisGoalState, codex_goal_state: codexGoalState, continuation_goal: continuationGoal, operator_summary_warning: operatorSummaryWarning, cached: Boolean(tickRecord.cached) },
       [
-        ...missionTickResultLines(outputMission, tickIdx, receiptPath, verifierResult, summary),
+        ...(tickRecord.cached ? [`Reused receipt for tick ${tickIdx}: ${receiptPath}`] : []),
+        ...missionTickResultLines(outputMission, tickIdx, receiptPath, verifierResult, summary || tickRecord.summary),
         ...(missionBlockerReceiptLine(blocker) ? [missionBlockerReceiptLine(blocker)] : []),
         ...(continuationGoal?.mission ? [`Next goal: ${continuationGoal.mission.objective}`] : []),
       ],
@@ -11026,8 +11073,16 @@ function answerMissionHumanAsk(ref, askIndex, answer, note = '') {
 }
 
 function missionCommand(args) {
-  const subcommand = args[0] || 'status';
-  const rest = args.slice(1);
+  const simpleCardArgs = args.filter((value) => value !== '--json');
+  const isBareMission = simpleCardArgs.length === 0;
+  if (args[0] === 'answer') {
+    return require('./human-missions').answerCommand(args.slice(1));
+  }
+  if (isBareMission && !hasLocalMissionState(resolveWorkspaceRoot())) {
+    return require('./human-missions').currentMissionCommand(args);
+  }
+  const subcommand = isBareMission ? 'status' : (args[0] || 'status');
+  const rest = isBareMission ? args : args.slice(1);
   // Every mission verb resolves its state store from process.cwd(). Running one
   // from a subdirectory used to create a nested .atris store the fleet never
   // reads (proven footgun: a nested .atris appeared under

package/commands/pull.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const { loadCredentials } = require('../utils/auth');
+const { loadCredentials, abortOnAuthFailure } = require('../utils/auth');
 const { apiRequestJson } = require('../utils/api');
 const { findAllMembers } = require('./member');
 const { loadConfig } = require('../utils/config');
@@ -358,15 +358,18 @@ async function pullBusiness(slug) {
   const autoWake = process.argv.includes('--auto-wake');
   if (autoWake) {
     const statusResult = await apiRequestJson(`/business/${businessId}/ai-computer/status`, { method: 'GET', token: creds.token });
+    abortOnAuthFailure(statusResult);
     const computerStatus = statusResult.ok && statusResult.data ? statusResult.data.status : 'unknown';
     if (computerStatus !== 'running' || !(statusResult.data && statusResult.data.endpoint)) {
       process.stdout.write('  Waking EC2 computer... ');
       _coldWake = true;
-      await apiRequestJson(`/business/${businessId}/ai-computer/wake`, { method: 'POST', token: creds.token });
+      const wake = await apiRequestJson(`/business/${businessId}/ai-computer/wake`, { method: 'POST', token: creds.token });
+      abortOnAuthFailure(wake, true);
       const wakeStart = Date.now();
       while (Date.now() - wakeStart < 90000) {
         await new Promise((r) => setTimeout(r, 3000));
         const s = await apiRequestJson(`/business/${businessId}/ai-computer/status`, { method: 'GET', token: creds.token });
+        abortOnAuthFailure(s, true);
         if (s.ok && s.data && s.data.status === 'running' && s.data.endpoint) {
           const elapsed = Math.floor((Date.now() - wakeStart) / 1000);
           console.log(`awake (${elapsed}s)`);

package/commands/push.js

@@ -2,7 +2,7 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const readline = require('readline');
-const { loadCredentials } = require('../utils/auth');
+const { loadCredentials, abortOnAuthFailure } = require('../utils/auth');
 const { apiRequestJson } = require('../utils/api');
 const { loadBusinesses, saveBusinesses, businessMatchesSlug } = require('./business');
 const { loadManifest, saveManifest, buildManifest, computeLocalHashes, isIgnoredSyncPath, filterSyncFiles } = require('../lib/manifest');
@@ -527,15 +527,18 @@ async function pushAtris() {
   const autoWake = process.argv.includes('--auto-wake');
   if (autoWake) {
     const statusResult = await apiRequestJson(`/business/${businessId}/ai-computer/status`, { method: 'GET', token: creds.token });
+    abortOnAuthFailure(statusResult);
     const computerStatus = statusResult.ok && statusResult.data ? statusResult.data.status : 'unknown';
     if (computerStatus !== 'running' || !(statusResult.data && statusResult.data.endpoint)) {
       process.stdout.write('  Waking EC2 computer... ');
       _coldWake = true;
-      await apiRequestJson(`/business/${businessId}/ai-computer/wake`, { method: 'POST', token: creds.token });
+      const wake = await apiRequestJson(`/business/${businessId}/ai-computer/wake`, { method: 'POST', token: creds.token });
+      abortOnAuthFailure(wake, true);
       const wakeStart = Date.now();
       while (Date.now() - wakeStart < 90000) {
         await new Promise((r) => setTimeout(r, 3000));
         const s = await apiRequestJson(`/business/${businessId}/ai-computer/status`, { method: 'GET', token: creds.token });
+        abortOnAuthFailure(s, true);
         if (s.ok && s.data && s.data.status === 'running' && s.data.endpoint) {
           const elapsed = Math.floor((Date.now() - wakeStart) / 1000);
           console.log(`awake (${elapsed}s)`);

package/commands/slop.js

@@ -134,10 +134,12 @@ function addProjectRule(rule, root = process.cwd()) {
 }
 
 // Map<absFile, Set<changedLineNumber>> from the working-tree (or --cached) git diff.
-function gitChangedLines(staged, cwd = process.cwd()) {
+function gitChangedLines(staged, cwd = process.cwd(), range = null) {
   const map = new Map();
   let out;
-  try { out = execFileSync('git', ['diff', '--unified=0', ...(staged ? ['--cached'] : [])], { encoding: 'utf8', cwd }); }
+  try {
+    out = execFileSync('git', ['diff', '--unified=0', ...(staged ? ['--cached'] : []), ...(range ? [range] : [])], { encoding: 'utf8', cwd });
+  }
   catch { return map; }
   let cur = null;
   for (const line of out.split('\n')) {
@@ -239,6 +241,35 @@ function scanFile(file, rules = RULES, pairRules = PAIR_RULES) {
   return findings;
 }
 
+// Programmatic scanner for landing gates. Callers provide the exact candidate
+// paths, so this never widens into a repo scan. An optional changed-lines map
+// keeps branch-diff gates on the lines the candidate actually added or edited.
+function scanPaths(targets, options = {}) {
+  const root = path.resolve(options.root || process.cwd());
+  const rules = options.rules || RULES.concat(loadProjectRules(root));
+  const pairRules = options.pairRules || PAIR_RULES;
+  const changedLines = options.changedLines instanceof Map ? options.changedLines : null;
+  const seen = new Set();
+  const files = [];
+  for (const target of Array.isArray(targets) ? targets : [targets]) {
+    if (!target) continue;
+    for (const file of walk(path.resolve(root, target), [])) {
+      const absolute = path.resolve(file);
+      if (seen.has(absolute)) continue;
+      seen.add(absolute);
+      files.push(absolute);
+    }
+  }
+  let findings = files.flatMap((file) => scanFile(file, rules, pairRules));
+  if (changedLines) {
+    findings = findings.filter((finding) => {
+      const lines = changedLines.get(path.resolve(finding.file));
+      return lines && lines.has(finding.line);
+    });
+  }
+  return { root, files, findings };
+}
+
 function detect(argv) {
   const json = argv.includes('--json');
   const quiet = argv.includes('--quiet');
@@ -583,4 +614,4 @@ function slopCommand(argv) {
   return 0;
 }
 
-module.exports = { slopCommand, detect, scanFile, RULES, PAIR_RULES, loadProjectRules, addProjectRule, gitChangedLines, applyFixes, installHook, findDeadCode, findOrphanedExports, listJsFiles };
+module.exports = { slopCommand, detect, scanFile, scanPaths, RULES, PAIR_RULES, loadProjectRules, addProjectRule, gitChangedLines, applyFixes, installHook, findDeadCode, findOrphanedExports, listJsFiles };

package/commands/task.js

@@ -11,6 +11,7 @@ const os = require('os');
 const { hasFlag } = require('../lib/arg-parser');
 const { taskProofState } = require('../lib/task-proof');
 const {
+  candidatePolicyGate,
   evaluateAutoAccept,
   isAgentCertified,
   isAutoCertifyVerifyCommandAllowed,
@@ -443,6 +444,21 @@ function failTask(label, reason, detail, exitCode = 2) {
   process.exit(exitCode);
 }
 
+function refuseCandidatePolicyGate(label, gate) {
+  if (jsonModeActive()) {
+    printJson({ ok: false, command: label, ...gate });
+  } else {
+    console.error(`${label}: ${gate.reason}: ${gate.message}`);
+    if (Array.isArray(gate.offenders)) {
+      gate.offenders.forEach((offender) => console.error(`  ${offender}`));
+    }
+    if (Array.isArray(gate.lesson_ids) && gate.lesson_ids.length) {
+      console.error(`  lessons: ${gate.lesson_ids.join(', ')}`);
+    }
+  }
+  process.exit(1);
+}
+
 function proofFlagValue(args) {
   const proof = flag(args, '--proof');
   return typeof proof === 'string' ? proof.trim() : '';
@@ -5254,6 +5270,12 @@ function autoAcceptCertifiedSmallReviews(taskDb, db, projection) {
       results.push({ ...evaluation, action: 'queued', task_id: task?.id || item.id || null });
       continue;
     }
+    const policyGate = candidatePolicyGate(task, { executeDetectors: true });
+    if (!policyGate.ok) {
+      results.push({ ...policyGate, action: 'queued', task_id: task?.id || item.id || null });
+      continue;
+    }
+    evaluation.candidate_gate = policyGate.gate;
     const accepted = acceptReviewTask(taskDb, db, task.id, {
       actor: REVIEW_AUTO_ACCEPT_ACTOR,
       proof: evaluation.proof,
@@ -9436,6 +9458,16 @@ function cmdReady(args) {
   if (missionXpIssue) {
     failTask('atris task ready', MISSION_XP_END_TO_END_REASON, missionXpIssue);
   }
+  const readyPolicyTask = {
+    ...beforeTask,
+    workspace_root: process.cwd(),
+    metadata: {
+      ...(beforeTask && beforeTask.metadata || {}),
+      ...(resultFields.files ? { changed_files: resultFields.files } : {}),
+    },
+  };
+  const readyPolicyGate = candidatePolicyGate(readyPolicyTask, { executeDetectors: true });
+  if (!readyPolicyGate.ok) refuseCandidatePolicyGate('atris task ready', readyPolicyGate);
   const resultTrace = buildAutomaticResultTrace(taskDb, db, taskId, {
     actor,
     proof: String(proof),
@@ -9497,12 +9529,12 @@ function cmdReady(args) {
     handoff.codex_prompt = reviewChat.codex_prompt;
     handoff.verification_focus = reviewChat.verification_focus;
   }
-  // Mined policy lessons (atris lesson mine) coach the proof at submission
-  // time: evidence patterns that historically certify get suggested before
-  // the task stalls in the review lane. Advisory only — never blocks ready.
+  // Mined proof lessons without runnable detectors remain coaching. Promoted,
+  // path-scoped detector lessons already passed the hard gate above.
   const { readPolicyLessons, policyHintsForProof } = require('../lib/policy-lessons');
   const policyHints = policyHintsForProof(String(proof), readPolicyLessons(taskDb.workspaceRoot()), taskDb.workspaceRoot());
   if (policyHints.length) handoff.policy_hints = policyHints;
+  if (readyPolicyGate.gate.advisories.length) handoff.policy_gate = readyPolicyGate.gate;
   if (wantsJson(args)) {
     printJson({
       ok: true,
@@ -9998,6 +10030,11 @@ function cmdCertifyVerified(args, options = {}) {
       results.push({ ref, action: 'verify_failed', reason: run.reason, verify });
       continue;
     }
+    const policyGate = candidatePolicyGate(task, { verifyCache, executeDetectors: true });
+    if (!policyGate.ok) {
+      results.push({ ...policyGate, ref, action: 'skipped' });
+      continue;
+    }
     const builderProof = String(review.proof || metadata.latest_agent_proof || '').slice(0, 200);
     const readied = taskDb.readyTask(db, {
       id: task.id,
@@ -10036,7 +10073,12 @@ function cmdCertifyVerified(args, options = {}) {
     console.log('certify-verified: no review rows to consider.');
   } else {
     for (const r of results) {
-      console.log(`${r.action.padEnd(14)} ${r.ref}${r.verify ? `  \`${r.verify}\`` : ''}${r.reason ? `  (${r.reason})` : ''}`);
+      const gateDetail = r.reason === 'slop_gate' && Array.isArray(r.offenders)
+        ? `  [${r.offenders.join('; ')}]`
+        : (r.reason === 'lesson_gate' && Array.isArray(r.lesson_ids)
+          ? `  [lessons: ${r.lesson_ids.join(', ')}]`
+          : '');
+      console.log(`${r.action.padEnd(14)} ${r.ref}${r.verify ? `  \`${r.verify}\`` : ''}${r.reason ? `  (${r.reason})` : ''}${gateDetail}`);
     }
     console.log(`certified ${certified}; humans keep denied lanes and rows without a runnable check.`);
   }
@@ -10348,6 +10390,8 @@ function evaluateSweepAutoAccept(task, root) {
   if (denied) return { eligible: false, ref, reason: denied };
   const proof = autoAcceptSweepLatestProof(task);
   if (!proof) return { eligible: false, ref, reason: 'no_proof' };
+  const policyGate = candidatePolicyGate(task, { executeDetectors: true });
+  if (!policyGate.ok) return { ...policyGate, ref };
 
   // 1. An explicit, stored verifier (`atris task ready --verify`, or a prior
   // certify-verified stamp) is the strongest signal: re-run it live, right
@@ -10367,6 +10411,7 @@ function evaluateSweepAutoAccept(task, root) {
       policy: 'sweep_auto_accept_verified_command',
       proof,
       verify: storedVerify,
+      candidate_gate: policyGate.gate,
       proved_by: [`${storedVerify} exited 0`],
       happened: autoAcceptSweepHappened(task),
     };
@@ -10382,6 +10427,7 @@ function evaluateSweepAutoAccept(task, root) {
       policy: 'sweep_auto_accept_verified',
       proof,
       evidence: verifier.evidence,
+      candidate_gate: policyGate.gate,
       proved_by: verifier.proved_by,
       happened: autoAcceptSweepHappened(task),
     };
@@ -10405,6 +10451,7 @@ function evaluateSweepAutoAccept(task, root) {
           policy: 'sweep_auto_accept_verified_derived',
           proof,
           verify: derived,
+          candidate_gate: policyGate.gate,
           proved_by: [`${derived} exited 0`],
           happened: autoAcceptSweepHappened(task),
         };