atris 3.74.21 → 3.74.22

package/commands/autoland.js

@@ -449,7 +449,7 @@ function wishSweepSummaryLine(summary, error = null) {
   return line;
 }
 
-function evaluateQueue(root, { strictVerify, acceptAll }) {
+function evaluateQueue(root, { strictVerify, acceptAll, includeProtected }) {
   return readProjection(root)
     .filter((task) => task && task.status === 'review')
     .filter((task) => String(task.review?.approval_status || task.metadata?.approval_status || 'pending') === 'pending')
@@ -458,7 +458,7 @@ function evaluateQueue(root, { strictVerify, acceptAll }) {
     .map((task) => {
       const evaluation = evaluateAutoAccept(
         { ...task, workspace_root: root },
-        { strictVerify, acceptAll, executeVerify: false },
+        { strictVerify, acceptAll, includeProtected, executeVerify: false },
       );
       return {
         ...evaluation,
@@ -472,6 +472,7 @@ function protectedReviewWaiting(root, policy = {}, waiting = []) {
   return evaluateQueue(root, {
     strictVerify: policy.strict_verify !== false,
     acceptAll: Boolean(policy.accept_all),
+    includeProtected: Boolean(policy.accept_protected),
   })
     .filter((row) => /^denied_tag_/.test(String(row.reason || '')))
     .filter((row) => !alreadyWaiting.has(row.ref));
@@ -487,7 +488,8 @@ function showStatus(root, args, deps = {}) {
   const enabled = Boolean(policy && policy.enabled);
   const strictVerify = policy ? policy.strict_verify !== false : true;
   const acceptAll = Boolean(policy && policy.accept_all);
-  const results = evaluateQueue(root, { strictVerify, acceptAll })
+  const includeProtected = Boolean(policy && policy.accept_protected);
+  const results = evaluateQueue(root, { strictVerify, acceptAll, includeProtected })
     .filter((r) => r.reason !== 'not_in_review');
   const readyForRecheck = results.filter((r) => r.action === 'would_accept');
   const wouldLand = readyForRecheck.filter((r) => r.verification_pending !== true);
@@ -525,7 +527,8 @@ function showStatus(root, args, deps = {}) {
       : `on (flipped by ${policyOwner}${policy.enabled_at ? ` on ${String(policy.enabled_at).slice(0, 10)}` : ''})`)
     : 'off - everything waits for you';
   console.log(`  policy: ${policyText}`);
-  if (enabled && acceptAll) console.log('  bar: everything lands except the protected lanes (money, deploys, security, customer, outward)');
+  if (enabled && includeProtected) console.log('  bar: protected work (money, deploys, security, customer, outward) also lands itself; sends and payments still need you.');
+  else if (enabled && acceptAll) console.log('  bar: everything lands except the protected lanes (money, deploys, security, customer, outward)');
   console.log(`  heartbeat: ${autoland.heartbeatStatusText(root, policy)}`);
   if (policy && policy.imessage_to) console.log(`  daily message: ${policy.imessage_to} at ${policy.digest_hour ?? autoland.DEFAULT_DIGEST_HOUR}:00`);
   const reapTrouble = autoland.readState(root).last_reap_error;
@@ -634,6 +637,7 @@ function turnOn(root, args) {
     alarm_hours: Number.isFinite(alarmHours) && alarmHours > 0 ? alarmHours : autoland.DEFAULT_ALARM_HOURS,
     strict_verify: !args.includes('--no-strict-verify'),
     accept_all: acceptAll,
+    accept_protected: args.includes('--include-protected'),
     daily_experiment: previous.daily_experiment !== false,
   });
   const cronOk = autoland.installCron(root);
@@ -644,9 +648,11 @@ function turnOn(root, args) {
   });
   console.log('');
   console.log('autoland is on.');
-  if (acceptAll) console.log(`  everything in review now lands itself, accepted as ${owner}; only the protected lanes wait.`);
+  if (acceptAll && policy.accept_protected) console.log(`  everything in review now lands itself, accepted as ${owner}.`);
+  else if (acceptAll) console.log(`  everything in review now lands itself, accepted as ${owner}; only the protected lanes wait.`);
   else console.log(`  certified, verified, reversible work now lands itself, accepted as ${owner}.`);
-  console.log('  protected lanes (money, deploys, security, customer, outward) still wait for you.');
+  if (policy.accept_protected) console.log('  protected work (money, deploys, security, customer, outward) also lands itself; sends and payments still need you.');
+  else console.log('  protected lanes (money, deploys, security, customer, outward) still wait for you.');
   console.log(`  heartbeat: ${cronOk ? 'installed, runs hourly' : 'could not install cron; run atris autoland tick yourself'}`);
   if (policy.imessage_to) {
     console.log(`  daily message to ${policy.imessage_to} at ${policy.digest_hour}:00; anything waiting on you past ${policy.alarm_hours}h pings you.`);
@@ -1020,6 +1026,14 @@ function digestSentToday(state, now = new Date()) {
   return state.last_digest_date === utcDay(now) && state.last_digest_date !== utcDay(yesterday);
 }
 
+function acceptCommandArgs(policy) {
+  const args = ['task', 'auto-accept-certified', '--json', '--certify-first'];
+  if (policy.accept_protected) args.push('--include-protected');
+  if (policy.accept_all) args.push('--all');
+  else if (policy.strict_verify === false) args.push('--no-strict-verify');
+  return args;
+}
+
 async function runTickBody(root, { json, policy, receipt, engineValidationDeps = {} }) {
 
   try {
@@ -1044,9 +1058,7 @@ async function runTickBody(root, { json, policy, receipt, engineValidationDeps =
   // Refresh origin once, before anything is accepted: the landing proof reads
   // origin's target, and a stale ref would call landed work unlanded.
   refreshLandingRefs(root);
-  const cliArgs =['task', 'auto-accept-certified', '--json', '--certify-first'];
-  if (policy.accept_all) cliArgs.push('--all');
-  else if (policy.strict_verify === false) cliArgs.push('--no-strict-verify');
+  const cliArgs = acceptCommandArgs(policy);
   const pendingReviewRows = readProjection(root)
     .filter((task) => task && task.status === 'review')
     .filter((task) => String(task.review?.approval_status || task.metadata?.approval_status || 'pending') === 'pending')
@@ -1442,7 +1454,7 @@ function showHelp() {
   console.log('');
   console.log('finished work that passed its checks and two independent reviews lands');
   console.log('automatically with a receipt. money, deploys, security, customer, and');
-  console.log('outward-facing work always waits for you.');
+  console.log('outward-facing work waits for you unless you include protected work.');
   console.log('');
   console.log('recommended agent flight checks:');
   console.log('  fast suite: npm run test:fast');
@@ -1456,6 +1468,7 @@ function showHelp() {
   console.log('  atris autoland on --all            lower the bar: everything lands except');
   console.log('                                     the protected lanes; a failing recorded');
   console.log('                                     check still blocks');
+  console.log('  atris autoland on --include-protected  include protected work in the policy');
   console.log('  atris autoland off                 back to approving every item');
   console.log('  atris autoland digest [--send]     the daily message, now');
   console.log('  atris autoland tick [--json]       one heartbeat (what the hourly cron runs)');
@@ -1501,6 +1514,7 @@ module.exports = {
   hasAgentJargon,
   runEngineAnswerValidation,
   runTickBody,
+  acceptCommandArgs,
   runSshAgentSweep,
   sshAgentSweepNote,
   showStatus,

package/commands/mission.js

@@ -520,6 +520,13 @@ function recordMissionEngineTickOutcome(engineId, result, root = process.cwd())
 // a closed credit window is credit out. Never throws into the tick.
 function missionTickRunOutcome(result, verifierResult, maxSeconds) {
   if (result && result.status === 'ran') {
+    const review = verifierResult?.referee;
+    if (verifierResult?.passed === false && verifierResult.status === 0 && !verifierResult.timed_out
+      && review?.mode === 'engine-unavailable' && review.reason !== 'code changed during review') {
+      return { outcome: 'review unavailable', detail: review.timed_out
+        ? 'the build check passed, but the second review timed out'
+        : 'the build check passed, but the second review was unavailable' };
+    }
     return verifierResult && verifierResult.passed === false
       ? { outcome: 'failed', detail: 'the verifier failed' }
       : { outcome: 'landed' };
@@ -11103,7 +11110,8 @@ async function executeMissionRunTicksPhase(context) {
         next_push: result.next_push || undefined,
         engine: result.engine_id || runtimeMission.runner || mission.runner || null,
         task_type: 'executor',
-        verified_passed: verifierResult && typeof verifierResult.passed === 'boolean' ? verifierResult.passed : undefined,
+        verified_passed: missionTickRunOutcome(result, verifierResult).outcome === 'review unavailable'
+          ? undefined : verifierResult && typeof verifierResult.passed === 'boolean' ? verifierResult.passed : undefined,
         duration_ms: Math.max(0, (Date.parse(finishedAt) || 0) - (Date.parse(tickStart) || 0)),
       }).mission;
       if (rotateSessionForContext) {

package/commands/task.js

@@ -31,6 +31,7 @@ const {
   parseVerifyCommand,
   runVerifyCommand,
   DENIED_TAGS,
+  protectedLaneOf,
 } = require('../lib/auto-accept-certified');
 const { evaluateAcceptVerify, nonFalsifyingIssue } = require('../lib/accept-verify-gate');
 const { checkedCodeSha, runVerifyAtJobCode } = require('../lib/job-code-verify');
@@ -10247,6 +10248,7 @@ function cmdCertifyVerified(args, options = {}) {
   const asJson = wantsJson(args);
   const silent = options.silent === true;
   const verifyCache = options.verifyCache || null;
+  const includeProtected = options.includeProtected === true;
   const actor = String(flag(args, '--as') || 'autoland-verifier');
   const limitRaw = flag(args, '--limit');
   const max = limitRaw && limitRaw !== true ? Math.max(1, Number(limitRaw) || 6) : 6;
@@ -10284,7 +10286,7 @@ function cmdCertifyVerified(args, options = {}) {
       continue;
     }
     const tag = String(task.tag || '').toLowerCase();
-    if (DENIED_TAGS.has(tag)) {
+    if (!includeProtected && DENIED_TAGS.has(tag)) {
       results.push({ ref, action: 'skipped', reason: `denied_tag_${tag}` });
       continue;
     }
@@ -10302,7 +10304,7 @@ function cmdCertifyVerified(args, options = {}) {
     // second time per row before the real run. executeVerify: false as well,
     // an untrusted trust tier re-enables the strict block internally even
     // with strictVerify off, which is how this probe spawned a verify per row.
-    const evaluation = evaluateAutoAccept(task, { strictVerify: false, executeVerify: false });
+    const evaluation = evaluateAutoAccept(task, { strictVerify: false, includeProtected, executeVerify: false });
     if (evaluation.eligible) {
       results.push({ ref, action: 'skipped', reason: 'already_landable' });
       continue;
@@ -10415,6 +10417,7 @@ function cmdLanding(args) {
 function cmdAutoAcceptCertified(args) {
   const dryRun = hasFlag(args, '--dry-run');
   const acceptAll = hasFlag(args, '--all');
+  const includeProtected = hasFlag(args, '--include-protected');
   const certifyFirst = hasFlag(args, '--certify-first');
   const strictVerify = !hasFlag(args, '--no-strict-verify') && !acceptAll;
   const actorFlag = flag(args, '--as');
@@ -10479,7 +10482,7 @@ function cmdAutoAcceptCertified(args) {
   // never persisted: a later heartbeat must prove the checkout again.
   const verifyCache = new Map();
   const certification = certifyFirst && !dryRun
-    ? cmdCertifyVerified([], { verifyCache, silent: true })
+    ? cmdCertifyVerified([], { verifyCache, silent: true, includeProtected })
     : null;
 
   const taskDb = getTaskDb();
@@ -10514,7 +10517,7 @@ function cmdAutoAcceptCertified(args) {
       results.push({ ...proofBoundary, action: 'skipped' });
       continue;
     }
-    const evaluation = evaluateAutoAccept(task, { strictVerify, acceptAll, verifyCache });
+    const evaluation = evaluateAutoAccept(task, { strictVerify, acceptAll, includeProtected, verifyCache });
     if (!evaluation.eligible) {
       results.push({ ...evaluation, action: 'skipped' });
       continue;
@@ -10547,7 +10550,9 @@ function cmdAutoAcceptCertified(args) {
     }
     const accepted = acceptReviewTask(taskDb, db, task.id, {
       actor,
-      proof: evaluation.proof,
+      proof: includeProtected && protectedLaneOf(task)
+        ? `${evaluation.proof}\nprotected lane accepted by owner policy (${protectedLaneOf(task)})`
+        : evaluation.proof,
       reward: parsedReward.value,
       lesson: String(task.review?.lesson || task.metadata?.latest_agent_lesson || ''),
       nextTask: String(task.review?.next_task || task.metadata?.latest_agent_next_task || ''),
@@ -10632,7 +10637,17 @@ function autoAcceptSweepNormalizedTokens(value) {
   return [normalized, ...normalized.split(/[^a-z0-9-]+/).filter(Boolean)];
 }
 
-function autoAcceptSweepDeniedReason(task) {
+function autoAcceptSweepLane(task) {
+  for (const value of autoAcceptSweepLabelValues(task)) {
+    for (const token of autoAcceptSweepNormalizedTokens(value)) {
+      const lane = [...SWEEP_AUTO_ACCEPT_PROTECTED].find((denied) => token === denied || token.replace(/s$/, '') === denied);
+      if (lane) return lane;
+    }
+  }
+  return null;
+}
+
+function autoAcceptSweepDeniedReason(task, includeProtected = false) {
   for (const value of autoAcceptSweepLabelValues(task)) {
     const tokens = autoAcceptSweepNormalizedTokens(value);
     for (const token of tokens) {
@@ -10642,7 +10657,7 @@ function autoAcceptSweepDeniedReason(task) {
       const protectedLane = [...SWEEP_AUTO_ACCEPT_PROTECTED].find((denied) =>
         token === denied || token.replace(/s$/, '') === denied
       );
-      if (protectedLane) return 'protected_lane';
+      if (protectedLane && !includeProtected) return 'protected_lane';
     }
   }
   return null;
@@ -10689,7 +10704,7 @@ function autoAcceptSweepHappened(task) {
   );
 }
 
-function evaluateSweepAutoAccept(task, root) {
+function evaluateSweepAutoAccept(task, root, includeProtected = false) {
   const ref = taskRef(task);
   if (!task) return { eligible: false, ref, reason: 'task_not_found' };
   if (task.status !== 'review') return { eligible: false, ref, reason: 'not_in_review' };
@@ -10698,7 +10713,7 @@ function evaluateSweepAutoAccept(task, root) {
   const approval = String(review.approval_status || metadata.approval_status || 'pending').toLowerCase();
   if (approval !== 'pending') return { eligible: false, ref, reason: `approval_${approval}` };
   if (metadata.auto_accepted_at) return { eligible: false, ref, reason: 'already_auto_accepted' };
-  const denied = autoAcceptSweepDeniedReason(task);
+  const denied = autoAcceptSweepDeniedReason(task, includeProtected);
   if (denied) return { eligible: false, ref, reason: denied };
   const proof = autoAcceptSweepLatestProof(task);
   if (!proof) return { eligible: false, ref, reason: 'no_proof' };
@@ -10819,14 +10834,17 @@ function cmdSweep(args) {
   for (const item of pendingReview) {
     const fullProjection = enrichTaskProjection(taskDb.taskProjection(db, { taskId: item.id }));
     const task = fullProjection.tasks[0] || null;
-    const evaluation = evaluateSweepAutoAccept(task, root);
+    const includeProtected = hasFlag(args, '--include-protected');
+    const evaluation = evaluateSweepAutoAccept(task, root, includeProtected);
     if (!evaluation.eligible) {
       results.push({ ...evaluation, action: 'skipped', task_id: task?.id || item.id || null });
       continue;
     }
     const accepted = acceptReviewTask(taskDb, db, task.id, {
       actor,
-      proof: evaluation.proof,
+      proof: includeProtected && (protectedLaneOf(task) || autoAcceptSweepLane(task))
+        ? `${evaluation.proof}\nprotected lane accepted by owner policy (${protectedLaneOf(task) || autoAcceptSweepLane(task)})`
+        : evaluation.proof,
       reward: parsedReward.value,
       lesson: String(task.review?.lesson || task.metadata?.latest_agent_lesson || ''),
       nextTask: String(task.review?.next_task || task.metadata?.latest_agent_next_task || ''),

package/lib/auto-accept-certified.js

@@ -1177,6 +1177,7 @@ function evaluateAutoAccept(task, options = {}) {
     strictVerify = true,
     minPasses = AGENT_CERTIFICATION_REVIEW_PASSES,
     acceptAll = false,
+    includeProtected = false,
     executeVerify = true,
     verifyCache = null,
   } = options;
@@ -1200,7 +1201,7 @@ function evaluateAutoAccept(task, options = {}) {
   // strip, so a tag variant never slips money/deploy work past the human.
   const tag = String(task.tag || '').trim().toLowerCase();
   const deniedTag = deniedTagOf(task);
-  if (deniedTag) return { eligible: false, ref, reason: `denied_tag_${deniedTag}` };
+  if (deniedTag && !includeProtected) return { eligible: false, ref, reason: `denied_tag_${deniedTag}` };
 
   // A protected lane declared in prose is not a protection, it is a note.
   // WEB-410 said "PROTECTED LANE: auth/session minting ... never self-land"
@@ -1208,7 +1209,7 @@ function evaluateAutoAccept(task, options = {}) {
   // safety through a tag field that authors leave empty fails open, silently.
   // So read the declaration where authors actually write it.
   const declared = declaredProtectedLane(task);
-  if (declared) {
+  if (declared && !includeProtected) {
     return {
       eligible: false,
       ref,
@@ -1236,7 +1237,7 @@ function evaluateAutoAccept(task, options = {}) {
     // same outage as failing open, just quieter. Instead: when there is no
     // tag to route on, read the task text for the denied lanes themselves.
     // WEB-406 (Stripe checkout + paywall) landed untagged this way.
-    if (!tag) {
+    if (!tag && !includeProtected) {
       const sniffed = sniffedProtectedLane(task);
       if (sniffed) {
         return {

package/lib/roster-runs.js

@@ -21,7 +21,7 @@ const RUNS_FILE = path.join('.atris', 'state', 'roster_runs.jsonl');
 const ROTATED_NAME = /^roster_runs\.\d.*\.jsonl$/;
 const ROTATED_KEEP = 3;
 const ROTATED_READ = 2;
-const OUTCOMES = Object.freeze(['landed', 'failed', 'stalled', 'credit out']);
+const OUTCOMES = Object.freeze(['landed', 'failed', 'stalled', 'credit out', 'review unavailable']);
 const DEFAULT_DAYS = 7;
 const TAIL_BYTES = 512 * 1024;
 // Past this size the log is renamed aside before the append, never trimmed:
@@ -131,6 +131,7 @@ function runReason(run) {
   if (given) return given.slice(0, 240);
   if (run.outcome === 'stalled') return 'it did not finish in time';
   if (run.outcome === 'credit out') return 'the engine hit its usage limit';
+  if (run.outcome === 'review unavailable') return 'the second review was unavailable';
   return 'it failed and the tool gave no reason';
 }
 
@@ -340,12 +341,15 @@ function summarizeRuns(runs, { days = DEFAULT_DAYS } = {}) {
     handed_over: list.filter((run) => run.handed_over_to).length,
     median_seconds: median(list.map((run) => Number(run.seconds)).filter((value) => value >= 0)),
   };
+  const reviewUnavailable = count('review unavailable');
+  if (reviewUnavailable) summary.review_unavailable = reviewUnavailable;
   const tokens = list.map((run) => run.tokens).filter((value) => Number.isFinite(value));
   if (tokens.length) summary.tokens = tokens.reduce((sum, value) => sum + value, 0);
   const parts = [`${summary.runs} run${summary.runs === 1 ? '' : 's'}`];
   if (summary.landed) parts.push(`${summary.landed} landed`);
   if (summary.stalled) parts.push(`${summary.stalled} stalled`);
   if (summary.failed) parts.push(`${summary.failed} failed`);
+  if (summary.review_unavailable) parts.push(`${summary.review_unavailable} review unavailable`);
   if (summary.credit_out) parts.push(`${summary.credit_out} credit out`);
   if (summary.median_seconds !== null) parts.push(`median ${durationText(summary.median_seconds)}`);
   summary.text = `last ${days} day${days === 1 ? '' : 's'}: ${parts.join(', ')}`;

package/lib/roster-suggest.js

@@ -26,7 +26,7 @@ const BOOT_TAIL_BYTES = 64 * 1024;
 // engine health already benches it, so credit out runs are left out.
 function judgedRuns(runs) {
   return runs
-    .filter((run) => run.outcome !== 'credit out')
+    .filter((run) => run.outcome !== 'credit out' && run.outcome !== 'review unavailable')
     .map((run, index) => ({ run, index }))
     .sort((a, b) => (Date.parse(b.run.at) - Date.parse(a.run.at)) || (b.index - a.index))
     .slice(0, SUGGEST_WINDOW_RUNS)

package/lib/roster-swap.js

@@ -261,7 +261,7 @@ function swapMember(root, memberName, engineWords, modelWords, options = {}) {
 // model this machine offers that can do the member's work, grouped by tool.
 // A model's last 7 days in the owner's words: the phone's swap card shows it
 // under the model, so it says finished, never the team's own word for it.
-const recordWords = seen => `${seen.landed} of ${seen.runs} finished this week`;
+const recordWords = seen => `${seen.landed} of ${seen.runs - (seen.review_unavailable || 0)} finished this week${seen.review_unavailable ? `, ${seen.review_unavailable} awaiting review` : ''}`;
 
 // The current model is on top; models with a record in the last 7 days come
 // next, most landed first; the rest keep --available's order.

package/lib/router-brain.js

@@ -219,7 +219,7 @@ function readRosterRunObservations(root, now) {
   if (!fs.existsSync(file) && !rotatedRunsPaths(root).length) return [];
   const source = path.relative(root, file);
   return readRosterRuns(root, { days: ROSTER_RUN_DAYS, ...(now !== undefined ? { now } : {}) }).flatMap((run) => {
-    if (run.outcome === 'credit out') return [];
+    if (run.outcome === 'credit out' || run.outcome === 'review unavailable') return [];
     const words = String(run.job || '').trim().toLowerCase().split(/\s+/);
     const role = ROSTER_JOB_ROLES[words[words.length - 1]];
     const atMs = Date.parse(run.at);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.74.21",
+  "version": "3.74.22",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "mcpName": "io.github.atrislabs/atris",
   "main": "bin/atris.js",