devcouncil 0.2.0 → 0.3.1

package/src/devcouncil/verification/verifier.py

@@ -1,3 +1,4 @@
+import asyncio
 import hashlib
 import os
 import shutil
@@ -11,7 +12,7 @@ import re
 import shlex
 from dataclasses import dataclass, asdict
 from pathlib import Path
-from typing import List, Dict, Any, Optional, Tuple
+from typing import List, Dict, Any, Literal, Optional, Tuple
 
 from devcouncil.app.config import load_config
 
@@ -86,6 +87,14 @@ class Verifier:
         # When set, overrides the (measure, enforce, min_ratio) diff-coverage settings
         # that would otherwise come from config. Used by ad-hoc checks and tests.
         self._diff_coverage_override: Optional[Tuple[bool, bool, float]] = None
+        # Per-verify_task memos (primed at verify_task entry, cleared before it returns)
+        # so the hot path does not re-run `git ls-files` or re-load config repeatedly.
+        # None outside a verify_task call, so all other callers behave exactly as before.
+        self._untracked_cache: Optional[List[str]] = None
+        self._command_timeout_cache: Optional[int] = None
+        # Project dependency names (lower-cased), loaded once per verify_task and cleared
+        # in its finally so a reused Verifier re-reads them for a later task.
+        self._project_deps_cache: Optional[set] = None
 
     def _next_gap_id(self, task_id: str, suffix: str) -> str:
         """Generate unique gap IDs to prevent SQLite overwrites."""
@@ -125,15 +134,15 @@ class Verifier:
         changed.difference_update(self._load_task_snapshot_files(task_id))
         return sorted(changed)
 
-    def _task_produced_changes(self, task_id: str) -> bool:
-        """True when the task has a footprint beyond the current working-tree diff.
+    def _committed_task_diff(self, task_id: str) -> str:
+        """Diff of work committed since the task's ``before`` checkpoint, or "".
 
-        Used so the empty-diff guard does not misfire on already-committed work: in
-        ``dev go`` each task is committed and then re-verified by the reconciliation
-        pass, at which point ``git diff HEAD`` is empty even though the task was fully
-        implemented. We detect that via the task's ``before`` checkpoint ref (work
-        committed since the task started) and a non-empty ``after`` patch. A genuine
-        no-op run has neither, so it is still correctly flagged as empty.
+        When ``dev go`` commits a task's work (e.g. between self-repair attempts, or
+        before the reconciliation pass), the working-tree diff (``git diff HEAD``) is
+        empty even though the task is fully implemented. This recovers that committed
+        change so acceptance compilation/review still have something to reason about
+        instead of seeing an empty diff and skipping — which would mark every criterion
+        unproven and wrongly block correct, committed code.
         """
         # Literal of CheckpointService.REF_BEFORE (kept inline to avoid a circular
         # import: checkpoints.py imports Verifier).
@@ -146,15 +155,27 @@ class Verifier:
                 stderr=subprocess.DEVNULL,
             ).returncode == 0
             if has_ref:
-                diff = subprocess.check_output(
+                return subprocess.check_output(
                     ["git", "diff", before_ref],
                     cwd=self.project_root,
                     stderr=subprocess.DEVNULL,
                 ).decode("utf-8", errors="replace")
-                if diff.strip():
-                    return True
         except Exception:
             pass
+        return ""
+
+    def _task_produced_changes(self, task_id: str) -> bool:
+        """True when the task has a footprint beyond the current working-tree diff.
+
+        Used so the empty-diff guard does not misfire on already-committed work: in
+        ``dev go`` each task is committed and then re-verified by the reconciliation
+        pass, at which point ``git diff HEAD`` is empty even though the task was fully
+        implemented. We detect that via the task's ``before`` checkpoint ref (work
+        committed since the task started) and a non-empty ``after`` patch. A genuine
+        no-op run has neither, so it is still correctly flagged as empty.
+        """
+        if self._committed_task_diff(task_id).strip():
+            return True
         after_patch = self.project_root / ".devcouncil" / "checkpoints" / f"{task_id}-after.patch"
         try:
             return after_patch.exists() and bool(after_patch.read_text(encoding="utf-8", errors="replace").strip())
@@ -209,6 +230,11 @@ class Verifier:
         return self._filter_change_paths(sorted(files))
 
     def _get_untracked_files(self) -> List[str]:
+        # Per-verify_task memo: git ls-files is otherwise re-run via get_changed_files,
+        # _get_untracked_files_diff, and _classify_change_paths. verify_task primes this
+        # once; it is None for every other caller, so they recompute fresh as before.
+        if self._untracked_cache is not None:
+            return self._untracked_cache
         try:
             output = subprocess.check_output(
                 ["git", "ls-files", "--others", "--exclude-standard"],
@@ -415,11 +441,17 @@ class Verifier:
         return summary[: budget + len(salient) + 8]
 
     def _run_command(self, command: str, task_id: str = "verify") -> CommandResult:
-        try:
-            config = load_config(self.project_root)
-            timeout = config.execution.command_timeout
-        except Exception:
-            timeout = 300
+        # Per-verify_task memo: avoid re-loading config for the timeout on every command
+        # in the expected_tests / allowed_commands / compiled-check loops. Falls back to
+        # loading config when called outside verify_task (cache is None).
+        if self._command_timeout_cache is not None:
+            timeout = self._command_timeout_cache
+        else:
+            try:
+                config = load_config(self.project_root)
+                timeout = config.execution.command_timeout
+            except Exception:
+                timeout = 300
 
         env = self._verification_env()
         argv = self._split_command(command)
@@ -664,553 +696,729 @@ class Verifier:
                     pass
 
     async def verify_task(self, task: Task, requirements: List[Requirement]) -> Tuple[List[Gap], List[Any]]:
+        logger.info("verify_task: task=%s requirements=%d", task.id, len(requirements))
         self._gap_counter = 0
         gaps: List[Gap] = []
         evidence_to_save: List[Any] = []
+        # Prime the per-call memos: compute the untracked-file list once (otherwise
+        # re-run by get_changed_files, get_diff, and _classify_change_paths) and load the
+        # command timeout once (otherwise re-loaded by _run_command on every command).
+        # Both are cleared before this method returns.
+        self._untracked_cache = self._get_untracked_files()
+        ac_samples, ac_repair_attempts = 1, 1
+        try:
+            _cfg = load_config(self.project_root)
+            self._command_timeout_cache = _cfg.execution.command_timeout
+            ac_samples = max(1, _cfg.verification.acceptance_checks.samples)
+            ac_repair_attempts = max(0, _cfg.verification.acceptance_checks.repair_attempts)
+            ac_per_criterion = bool(_cfg.verification.acceptance_checks.per_criterion)
+        except Exception:
+            self._command_timeout_cache = 300
+            ac_per_criterion = False
         changed_files = self.get_task_changed_files(task.id)
         diff_content = self.get_diff()
+        # When the working tree is clean but the task's work was committed (dev go commits
+        # between repair attempts and before reconciliation), fall back to the committed
+        # checkpoint diff. Otherwise acceptance compilation/review below — gated on a
+        # non-empty diff_content — would be skipped, leaving every criterion unproven and
+        # wrongly blocking correct, already-committed code.
+        if not diff_content.strip():
+            committed_diff = self._committed_task_diff(task.id)
+            if committed_diff.strip():
+                diff_content = committed_diff
         diff_empty = not bool(diff_content.strip())
-        # "Work present" is broader than the current working-tree diff: a task whose
-        # changes were already committed (e.g. `dev go`'s per-task commit, then the
-        # final reconciliation pass where `git diff HEAD` is empty) still counts as
-        # implemented. A genuine no-op run has neither a working diff nor committed
-        # changes since the task's checkpoint.
-        work_present = (not diff_empty) or self._task_produced_changes(task.id)
-
-        # Empty-diff guard. If the task declares files to create or modify but produced
-        # NO work at all, there is nothing to prove — an agent must not be able to
-        # declare victory having written nothing (or after a transient git error that
-        # degraded the diff to ""). This is the single most dangerous false-pass for
-        # autonomy, so it blocks regardless of which commands ran.
-        expects_change = any(pf.allowed_change != "read_only" for pf in task.planned_files)
-        if not work_present and expects_change:
-            gaps.append(Gap(
-                id=self._next_gap_id(task.id, "NODIFF"),
-                severity="high",
-                gap_type="task_not_implemented",
-                task_id=task.id,
-                description=(
-                    f"Task {task.id} declares files to create or modify, but produced no "
-                    "changes. Verification cannot prove work that does not exist."
-                ),
-                evidence=[f"planned files expecting change: {sorted(p.path for p in task.planned_files if p.allowed_change != 'read_only')}"],
-                recommended_fix=(
-                    "Implement the planned changes so the diff is non-empty, then re-verify. "
-                    "If you did make changes, ensure they are saved and visible to git "
-                    "(not reverted, stashed, or written outside the project root)."
-                ),
-                blocking=True,
-            ))
-
-        if diff_content:
-            added_files, deleted_files = self._classify_change_paths(changed_files)
-            diff_ev = DiffEvidence(
-                task_id=task.id,
-                changed_files=changed_files,
-                added_files=added_files,
-                deleted_files=deleted_files,
-                diff_summary=f"Diff captured for {len(changed_files)} files."
+        # Launch the two independent LLM passes — acceptance compilation and the advisory
+        # implementation review — concurrently as soon as the diff is available, instead
+        # of awaiting them sequentially later. Each depends only on (task, requirements,
+        # diff_content), so there is no data hazard; each result is awaited (with its
+        # existing try/except) at the point it is consumed below. The create-time guards
+        # match the consume-time guards exactly, so every task created is always awaited.
+        compile_future: Optional["asyncio.Task[Dict[str, List[str]]]"] = None
+        if self.acceptance_compiler and diff_content and task.acceptance_criterion_ids:
+            # Prefer the self-consistency interface; fall back to single-shot ``compile`` so
+            # older compiler doubles/implementations keep working.
+            if hasattr(self.acceptance_compiler, "compile_candidates"):
+                _compile_coro = self.acceptance_compiler.compile_candidates(
+                    task, requirements, diff_content, samples=ac_samples,
+                    per_criterion=ac_per_criterion,
+                )
+            else:
+                _compile_coro = self.acceptance_compiler.compile(task, requirements, diff_content)
+            compile_future = asyncio.create_task(_compile_coro)
+        review_future: Optional["asyncio.Task[Any]"] = None
+        if self.reviewer and diff_content:
+            review_future = asyncio.create_task(
+                self.reviewer.review_changes(task, requirements, diff_content)
             )
-            evidence_to_save.append(diff_ev)
-
-        # 1. Planned-file coverage check
-        planned_paths = {pf.path for pf in task.planned_files}
-        changed_set = set(changed_files)
-        for pf in task.planned_files:
-            if pf.path not in changed_set and pf.allowed_change != "read_only":
-                gaps.append(Gap(
-                    id=self._next_gap_id(task.id, "FILE"),
-                    severity="medium",
-                    gap_type="planned_file_not_changed",
-                    task_id=task.id,
-                    description=f"Planned file {pf.path} was not modified.",
-                    recommended_fix=f"Modify {pf.path} as planned or update the task.",
-                    blocking=False,
-                    file=pf.path,
-                ))
-
-        # 2. Orphan-diff detection
-        for cf in changed_files:
-            if cf not in planned_paths:
+        try:
+            # "Work present" is broader than the current working-tree diff: a task whose
+            # changes were already committed (e.g. `dev go`'s per-task commit, then the
+            # final reconciliation pass where `git diff HEAD` is empty) still counts as
+            # implemented. A genuine no-op run has neither a working diff nor committed
+            # changes since the task's checkpoint.
+            work_present = (not diff_empty) or self._task_produced_changes(task.id)
+
+            # Empty-diff guard. If the task declares files to create or modify but produced
+            # NO work at all, there is nothing to prove — an agent must not be able to
+            # declare victory having written nothing (or after a transient git error that
+            # degraded the diff to ""). This is the single most dangerous false-pass for
+            # autonomy, so it blocks regardless of which commands ran.
+            expects_change = any(pf.allowed_change != "read_only" for pf in task.planned_files)
+            if not work_present and expects_change:
                 gaps.append(Gap(
-                    id=self._next_gap_id(task.id, "ORPHAN"),
+                    id=self._next_gap_id(task.id, "NODIFF"),
                     severity="high",
-                    gap_type="orphan_diff",
+                    gap_type="task_not_implemented",
                     task_id=task.id,
-                    description=f"File {cf} was modified but not planned for this task.",
-                    evidence=[cf],
-                    recommended_fix=f"Revert changes to {cf} or add it to the task's planned files.",
+                    description=(
+                        f"Task {task.id} declares files to create or modify, but produced no "
+                        "changes. Verification cannot prove work that does not exist."
+                    ),
+                    evidence=[f"planned files expecting change: {sorted(p.path for p in task.planned_files if p.allowed_change != 'read_only')}"],
+                    recommended_fix=(
+                        "Implement the planned changes so the diff is non-empty, then re-verify. "
+                        "If you did make changes, ensure they are saved and visible to git "
+                        "(not reverted, stashed, or written outside the project root)."
+                    ),
                     blocking=True,
-                    file=cf,
                 ))
 
-        gaps.extend(self._check_semantic_diff(task))
-
-        # 3. Dependency change detection
-        dep_changes = self._check_dependency_changes(changed_files)
-        for dep_file in dep_changes:
-            if dep_file not in planned_paths:
-                gaps.append(Gap(
-                    id=self._next_gap_id(task.id, "DEP"),
-                    severity="high",
-                    gap_type="dependency_risk",
+            if diff_content:
+                added_files, deleted_files = self._classify_change_paths(changed_files)
+                diff_ev = DiffEvidence(
                     task_id=task.id,
-                    description=f"Dependency file {dep_file} was modified without being in planned files.",
-                    evidence=[dep_file],
-                    recommended_fix=f"Justify the dependency change or revert {dep_file}.",
-                    blocking=True,
-                    file=dep_file,
-                ))
+                    changed_files=changed_files,
+                    added_files=added_files,
+                    deleted_files=deleted_files,
+                    diff_summary=f"Diff captured for {len(changed_files)} files."
+                )
+                evidence_to_save.append(diff_ev)
 
-        # When DevCouncil can compile its own per-criterion checks, THOSE are the
-        # authority and the planner's expected_tests are demoted to advisory — so a
-        # bogus planner command (irrelevant linters, npm on a Python project, tests
-        # that reference missing files) can no longer block correct work.
-        compiler_active = bool(self.acceptance_compiler and diff_content and task.acceptance_criterion_ids)
-
-        # 4. Run verification commands
-        command_results: List[CommandResult] = []
-        evidence_results: List[CommandResult] = []
-        genuine_failure = False  # a command that actually ran and failed (real defect signal)
-        had_unrunnable = False   # a command that could not run (missing tool / missing tests)
-        # Genuine test failures demoted to non-blocking only because a compiler is active.
-        # That demotion is legitimate ONLY if the compiler actually produces per-criterion
-        # checks to take authority; re-promoted below if it produces none.
-        demoted_failures: List[Gap] = []
-        for cmd_type, cmds in self._commands_for_task(task).items():
-            for cmd in cmds:
-                applicable, skip_reason = self._command_applicable(cmd)
-                if not applicable:
-                    # Wrong-stack command (e.g. `npm test` on a Python repo): skip it
-                    # entirely rather than running and failing for a stack reason — an
-                    # advisory note so the skip is visible (no silent drop).
+            # 1. Planned-file coverage check
+            planned_paths = {pf.path for pf in task.planned_files}
+            changed_set = set(changed_files)
+            for pf in task.planned_files:
+                if pf.path not in changed_set and pf.allowed_change != "read_only":
                     gaps.append(Gap(
-                        id=self._next_gap_id(task.id, "SKIP"),
-                        severity="low",
-                        gap_type="skipped_verification_command",
+                        id=self._next_gap_id(task.id, "FILE"),
+                        severity="medium",
+                        gap_type="planned_file_not_changed",
                         task_id=task.id,
-                        description=f"Skipped verification command '{cmd}': {skip_reason}.",
-                        evidence=[skip_reason],
-                        recommended_fix=(
-                            "Replace it with a command for this repo's stack, or remove it "
-                            "from .devcouncil/config.yaml / the task's expected_tests."
-                        ),
+                        description=f"Planned file {pf.path} was not modified.",
+                        recommended_fix=f"Modify {pf.path} as planned or update the task.",
                         blocking=False,
-                        suggested_command=cmd,
+                        file=pf.path,
                     ))
-                    continue
-                result = self._run_command(cmd, task_id=task.id)
-                command_results.append(result)
-                evidence_to_save.append(result)
-                if self._command_can_prove_acceptance(cmd_type, cmd):
-                    evidence_results.append(result)
-                if result.exit_code != 0:
-                    if self._command_is_malformed(result):
-                        had_unrunnable = True
-                        # The verification command itself could not run (e.g. a
-                        # SyntaxError in a `python -c` one-liner, or a missing test
-                        # tool). This proves nothing about the implementation, so do
-                        # not report it as a code failure — surface it as a plan/
-                        # command defect the user can regenerate instead.
+
+            # 2. Orphan-diff detection
+            for cf in changed_files:
+                if cf not in planned_paths:
+                    gaps.append(Gap(
+                        id=self._next_gap_id(task.id, "ORPHAN"),
+                        severity="high",
+                        gap_type="orphan_diff",
+                        task_id=task.id,
+                        description=f"File {cf} was modified but not planned for this task.",
+                        evidence=[cf],
+                        recommended_fix=f"Revert changes to {cf} or add it to the task's planned files.",
+                        blocking=True,
+                        file=cf,
+                    ))
+
+            gaps.extend(self._check_semantic_diff(task, requirements))
+
+            # 3. Dependency change detection
+            dep_changes = self._check_dependency_changes(changed_files)
+            for dep_file in dep_changes:
+                if dep_file not in planned_paths:
+                    gaps.append(Gap(
+                        id=self._next_gap_id(task.id, "DEP"),
+                        severity="high",
+                        gap_type="dependency_risk",
+                        task_id=task.id,
+                        description=f"Dependency file {dep_file} was modified without being in planned files.",
+                        evidence=[dep_file],
+                        recommended_fix=f"Justify the dependency change or revert {dep_file}.",
+                        blocking=True,
+                        file=dep_file,
+                    ))
+
+            # When DevCouncil can compile its own per-criterion checks, THOSE are the
+            # authority and the planner's expected_tests are demoted to advisory — so a
+            # bogus planner command (irrelevant linters, npm on a Python project, tests
+            # that reference missing files) can no longer block correct work.
+            compiler_active = bool(self.acceptance_compiler and diff_content and task.acceptance_criterion_ids)
+
+            # 4. Run verification commands
+            command_results: List[CommandResult] = []
+            evidence_results: List[CommandResult] = []
+            genuine_failure = False  # a command that actually ran and failed (real defect signal)
+            had_unrunnable = False   # a command that could not run (missing tool / missing tests)
+            # Genuine test failures demoted to non-blocking only because a compiler is active.
+            # That demotion is legitimate ONLY if the compiler actually produces per-criterion
+            # checks to take authority; re-promoted below if it produces none.
+            demoted_failures: List[Gap] = []
+            for cmd_type, cmds in self._commands_for_task(task).items():
+                for cmd in cmds:
+                    applicable, skip_reason = self._command_applicable(cmd)
+                    if not applicable:
+                        # Wrong-stack command (e.g. `npm test` on a Python repo): skip it
+                        # entirely rather than running and failing for a stack reason — an
+                        # advisory note so the skip is visible (no silent drop).
                         gaps.append(Gap(
-                            id=self._next_gap_id(task.id, "BADCMD"),
-                            severity="medium",
-                            gap_type="invalid_verification_command",
+                            id=self._next_gap_id(task.id, "SKIP"),
+                            severity="low",
+                            gap_type="skipped_verification_command",
                             task_id=task.id,
-                            description=(
-                                f"Verification command could not run (not a code failure): '{cmd}'. "
-                                "It appears malformed or its tooling is unavailable, so this command "
-                                "proves nothing either way."
-                            ),
-                            evidence=[result.summary[:500]],
+                            description=f"Skipped verification command '{cmd}': {skip_reason}.",
+                            evidence=[skip_reason],
                             recommended_fix=(
-                                "Regenerate the task's verification commands with 'dev repair', or edit "
-                                "them to be a single runnable command (e.g. 'python -m pytest <file>')."
+                                "Replace it with a command for this repo's stack, or remove it "
+                                "from .devcouncil/config.yaml / the task's expected_tests."
                             ),
-                            # Non-blocking: a command that cannot run is not evidence of a
-                            # defect. If it was the *only* check for an acceptance criterion,
-                            # that criterion is independently caught as unproven (blocking).
                             blocking=False,
                             suggested_command=cmd,
-                            stdout_path=result.stdout_path or None,
-                            stderr_path=result.stderr_path or None,
                         ))
-                    else:
-                        # A verification command that genuinely failed. Lint/typecheck
-                        # commands (from the config fallback) report style/type opinion,
-                        # not a correctness defect, so they are ADVISORY — blocking a
-                        # behaviorally-correct task on `flake8`/`mypy`/`ruff` is the
-                        # false-block the benchmark surfaced. A real test failure still
-                        # gates (unless compiled checks supersede it).
-                        is_quality_gate = cmd_type in {"lint", "typecheck"} or self._is_quality_only_command(cmd)
-                        blocking = (not compiler_active) and not is_quality_gate
-                        if blocking:
-                            genuine_failure = True
-                        fail_file, fail_line = self._failure_location(result)
-                        gap = Gap(
-                            id=self._next_gap_id(task.id, cmd_type.upper()),
-                            severity="high" if blocking else "medium",
-                            gap_type="quality_gate_failed" if is_quality_gate else "test_failed",
-                            task_id=task.id,
-                            description=(
-                                f"{'Quality gate' if is_quality_gate else 'Command'} '{cmd}' "
-                                f"failed with exit code {result.exit_code}"
-                                + (" (advisory: style/type, not a correctness gate)." if is_quality_gate else ".")
-                            ),
-                            evidence=[result.summary[:500]],
-                            recommended_fix=f"Fix the issues reported by '{cmd}'.",
-                            blocking=blocking,
-                            suggested_command=cmd,
-                            file=fail_file,
-                            line=fail_line,
-                            stdout_path=result.stdout_path or None,
-                            stderr_path=result.stderr_path or None,
-                        )
-                        gaps.append(gap)
-                        # A real test failure demoted only because the compiler is active:
-                        # remember it so we can re-promote if the compiler yields no checks.
-                        if compiler_active and not is_quality_gate and not blocking:
-                            demoted_failures.append(gap)
-
-        # 4b. Compiled acceptance checks — precise, DevCouncil-owned per-criterion
-        # evidence. Derive one runnable check per acceptance criterion from the
-        # criterion text + the diff, instead of trusting planner-authored
-        # expected_tests (which the benchmark showed often reference absent tools or
-        # test files). Each check maps 1:1 to its criterion, replacing the coarse
-        # "any command passed -> every criterion proven" mapping.
-        compiled_pass: Dict[str, bool] = {}
-        # Per-AC bookkeeping so the unproven-AC gap can attach ONLY the check(s) that
-        # targeted that criterion (and the specific failing result), instead of dumping
-        # every command summary. Keys are AC ids; values track the compiled command(s)
-        # and any failing CommandResults for that AC.
-        compiled_cmds_by_ac: Dict[str, List[str]] = {}
-        failing_results_by_ac: Dict[str, List[CommandResult]] = {}
-        if self.acceptance_compiler and diff_content and task.acceptance_criterion_ids:
-            try:
-                compiled = await self.acceptance_compiler.compile(task, requirements, diff_content)
-            except Exception as exc:  # pragma: no cover - best effort
-                logger.warning("Acceptance compiler failed for %s: %s", task.id, exc)
-                compiled = {}
-            for ac_id, cmds in compiled.items():
-                # Defensive: drop any wrong-stack compiled check so it can't fail an AC
-                # for a stack reason (the compiler is told not to emit these).
-                cmds = [c for c in cmds if self._command_applicable(c)[0]]
-                ac_ok = bool(cmds)
-                compiled_cmds_by_ac[ac_id] = list(cmds)
-                for cmd in cmds:
+                        continue
                     result = self._run_command(cmd, task_id=task.id)
                     command_results.append(result)
                     evidence_to_save.append(result)
+                    if self._command_can_prove_acceptance(cmd_type, cmd):
+                        evidence_results.append(result)
                     if result.exit_code != 0:
-                        ac_ok = False
-                        failing_results_by_ac.setdefault(ac_id, []).append(result)
                         if self._command_is_malformed(result):
                             had_unrunnable = True
+                            # The verification command itself could not run (e.g. a
+                            # SyntaxError in a `python -c` one-liner, or a missing test
+                            # tool). This proves nothing about the implementation, so do
+                            # not report it as a code failure — surface it as a plan/
+                            # command defect the user can regenerate instead.
+                            gaps.append(Gap(
+                                id=self._next_gap_id(task.id, "BADCMD"),
+                                severity="medium",
+                                gap_type="invalid_verification_command",
+                                task_id=task.id,
+                                description=(
+                                    f"Verification command could not run (not a code failure): '{cmd}'. "
+                                    "It appears malformed or its tooling is unavailable, so this command "
+                                    "proves nothing either way."
+                                ),
+                                evidence=[result.summary[:500]],
+                                recommended_fix=(
+                                    "Regenerate the task's verification commands with 'dev repair', or edit "
+                                    "them to be a single runnable command (e.g. 'python -m pytest <file>')."
+                                ),
+                                # Non-blocking: a command that cannot run is not evidence of a
+                                # defect. If it was the *only* check for an acceptance criterion,
+                                # that criterion is independently caught as unproven (blocking).
+                                blocking=False,
+                                suggested_command=cmd,
+                                stdout_path=result.stdout_path or None,
+                                stderr_path=result.stderr_path or None,
+                            ))
                         else:
-                            genuine_failure = True
+                            # A verification command that genuinely failed. Lint/typecheck
+                            # commands (from the config fallback) report style/type opinion,
+                            # not a correctness defect, so they are ADVISORY — blocking a
+                            # behaviorally-correct task on `flake8`/`mypy`/`ruff` is the
+                            # false-block the benchmark surfaced. A real test failure still
+                            # gates (unless compiled checks supersede it).
+                            is_quality_gate = cmd_type in {"lint", "typecheck"} or self._is_quality_only_command(cmd)
+                            blocking = (not compiler_active) and not is_quality_gate
+                            if blocking:
+                                genuine_failure = True
                             fail_file, fail_line = self._failure_location(result)
-                            gaps.append(Gap(
-                                id=self._next_gap_id(task.id, "ACCHK"),
-                                severity="high",
-                                gap_type="test_failed",
+                            gap = Gap(
+                                id=self._next_gap_id(task.id, cmd_type.upper()),
+                                severity="high" if blocking else "medium",
+                                gap_type="quality_gate_failed" if is_quality_gate else "test_failed",
                                 task_id=task.id,
-                                description=f"Acceptance check for {ac_id} failed: '{cmd}' (exit {result.exit_code}).",
+                                description=(
+                                    f"{'Quality gate' if is_quality_gate else 'Command'} '{cmd}' "
+                                    f"failed with exit code {result.exit_code}"
+                                    + (" (advisory: style/type, not a correctness gate)." if is_quality_gate else ".")
+                                ),
                                 evidence=[result.summary[:500]],
-                                recommended_fix=f"Fix the implementation so acceptance criterion {ac_id} holds.",
-                                blocking=True,
-                                acceptance_criterion_id=ac_id,
+                                recommended_fix=f"Fix the issues reported by '{cmd}'.",
+                                blocking=blocking,
                                 suggested_command=cmd,
                                 file=fail_file,
                                 line=fail_line,
                                 stdout_path=result.stdout_path or None,
                                 stderr_path=result.stderr_path or None,
-                            ))
-                compiled_pass[ac_id] = ac_ok
-
-        # The compiler only earns the authority to demote a genuinely-failing planner
-        # test if it produced a per-criterion check for EVERY targeted AC. A partial
-        # compile is not enough: the uncovered ACs fall back to the coarse signal, so a
-        # demoted real failure + coarse-proven remainder would otherwise slip past the
-        # gate. If coverage is incomplete (or zero — empty compile / all-wrong-stack /
-        # a compile exception swallowed to {}), re-promote the demoted failures.
-        compiler_covered_all = bool(task.acceptance_criterion_ids) and all(
-            compiled_cmds_by_ac.get(ac_id) for ac_id in task.acceptance_criterion_ids
-        )
-        if compiler_active and not compiler_covered_all and demoted_failures:
-            for gap in demoted_failures:
-                gap.blocking = True
-                gap.severity = "high"
-                genuine_failure = True
-                logger.info(
-                    "Re-promoted demoted test failure %s to blocking: acceptance compiler "
-                    "did not produce a check for every criterion of task %s.",
-                    gap.id, task.id,
-                )
-
-        # 5. Acceptance-criteria evidence mapping (precise, per criterion).
-        # Quality-only commands (lint/typecheck) are excluded: a passing `mypy`/`ruff
-        # check`/`tsc` exercises no behavior, so it must not coarse-prove a behavioral AC
-        # — the same false-confidence the per-criterion checks exist to prevent.
-        successful_commands = [
-            result for result in evidence_results
-            if result.exit_code == 0 and not self._is_quality_only_command(result.command)
-        ]
-        # Coarse fallback (used only when no compiled per-criterion check exists for an
-        # AC): a criterion may be marked proven by a passing acceptance-capable command
-        # ONLY when the task actually produced work. Without this guard a no-op run
-        # whose unrelated command happens to pass would "prove" every criterion against
-        # zero changes.
-        coarse_proof_available = work_present and bool(successful_commands)
-        if task.acceptance_criterion_ids:
-            req_by_ac = {ac.id: req.id for req in requirements for ac in req.acceptance_criteria}
-            unproven_acs: List[str] = []
-            coarse_proven_acs: List[str] = []
-            for ac_id in task.acceptance_criterion_ids:
-                # An AC is proven if its compiled check passed; if no compiled check
-                # exists for it, fall back to the coarse signal (any expected_test passed).
-                proven = compiled_pass.get(ac_id)
-                coarse = False
-                if proven is None:
-                    proven = coarse_proof_available
-                    coarse = proven  # proven only by the coarse, not-AC-specific signal
-                if proven:
-                    if coarse:
-                        coarse_proven_acs.append(ac_id)
-                    # Don't persist a "passed" record for a coarse-proven criterion during a
-                    # run that also has a genuine blocking failure — the gate already fails,
-                    # and a stored "passed" would mislead audits that read evidence directly.
-                    if not (coarse and genuine_failure):
-                        evidence_to_save.append(TestEvidence(
-                            requirement_id=req_by_ac.get(ac_id, task.requirement_ids[0] if task.requirement_ids else ""),
+                            )
+                            gaps.append(gap)
+                            # A real test failure demoted only because the compiler is active:
+                            # remember it so we can re-promote if the compiler yields no checks.
+                            if compiler_active and not is_quality_gate and not blocking:
+                                demoted_failures.append(gap)
+
+            # 4b. Compiled acceptance checks — precise, DevCouncil-owned per-criterion
+            # evidence. Derive one runnable check per acceptance criterion from the
+            # criterion text + the diff, instead of trusting planner-authored
+            # expected_tests (which the benchmark showed often reference absent tools or
+            # test files). Each check maps 1:1 to its criterion, replacing the coarse
+            # "any command passed -> every criterion proven" mapping.
+            compiled_pass: Dict[str, bool] = {}
+            # Per-AC bookkeeping so the unproven-AC gap can attach ONLY the check(s) that
+            # targeted that criterion (and the specific failing result), instead of dumping
+            # every command summary. Keys are AC ids; values track the compiled command(s)
+            # and any failing CommandResults for that AC.
+            compiled_cmds_by_ac: Dict[str, List[str]] = {}
+            failing_results_by_ac: Dict[str, List[CommandResult]] = {}
+            # Per-AC vote tally for proven criteria: {ac_id: (passes, decisive, repaired)}.
+            # Recorded into the stored TestEvidence so an audit can see HOW a criterion was
+            # proven (single check vs. majority of independent checks; whether a check had to
+            # be repaired to run) instead of just "passed".
+            compiled_vote: Dict[str, Tuple[int, int, bool]] = {}
+            # ACs whose independently-generated checks split (some pass, some fail) with no
+            # majority. Per policy this is inconclusive — neither proof nor a defect — so the
+            # AC is surfaced NON-blocking below instead of false-blocking on a lone bad check.
+            inconclusive_acs: set[str] = set()
+            if compile_future is not None:
+                try:
+                    compiled = await compile_future
+                except Exception as exc:  # pragma: no cover - best effort
+                    logger.warning("Acceptance compiler failed for %s: %s", task.id, exc)
+                    compiled = {}
+                ac_meta = {ac.id: ac for req in requirements for ac in req.acceptance_criteria}
+                for ac_id, raw_cmds in compiled.items():
+                    # Defensive: drop any wrong-stack candidate so it can't fail an AC for a
+                    # stack reason (the compiler is told not to emit these).
+                    candidates = [c for c in raw_cmds if self._command_applicable(c)[0]]
+                    compiled_cmds_by_ac[ac_id] = list(candidates)
+                    if not candidates:
+                        compiled_pass[ac_id] = False
+                        continue
+                    # Run each INDEPENDENT candidate; a check that merely failed to RUN
+                    # (malformed/unrunnable) is regenerated from the launcher error up to
+                    # ``ac_repair_attempts`` times — safe, because a check that never ran
+                    # proves nothing, so repairing it cannot weaken the gate.
+                    passes = 0
+                    genuine_fails = 0
+                    repaired = False  # a check had to be regenerated before it ran
+                    fail_results: List[Tuple[str, CommandResult]] = []
+                    for cmd in candidates:
+                        result = self._run_command(cmd, task_id=task.id)
+                        command_results.append(result)
+                        evidence_to_save.append(result)
+                        attempts = 0
+                        _repair = getattr(self.acceptance_compiler, "repair", None)
+                        while (
+                            result.exit_code != 0
+                            and self._command_is_malformed(result)
+                            and attempts < ac_repair_attempts
+                            and _repair is not None
+                        ):
+                            attempts += 1
+                            ac_desc = ac_meta[ac_id].description if ac_id in ac_meta else ac_id
+                            try:
+                                fixed = await _repair(
+                                    ac_id, ac_desc, cmd, result.summary[:800], diff_content
+                                )
+                            except Exception:
+                                fixed = None
+                            if not fixed or not self._command_applicable(fixed)[0]:
+                                break
+                            cmd = fixed
+                            compiled_cmds_by_ac[ac_id].append(cmd)
+                            result = self._run_command(cmd, task_id=task.id)
+                            command_results.append(result)
+                            evidence_to_save.append(result)
+                        if result.exit_code == 0:
+                            passes += 1
+                            if attempts > 0:
+                                repaired = True
+                        elif self._command_is_malformed(result):
+                            # Still couldn't run after repair: proves nothing either way.
+                            had_unrunnable = True
+                            failing_results_by_ac.setdefault(ac_id, []).append(result)
+                        else:
+                            genuine_fails += 1
+                            fail_results.append((cmd, result))
+                            failing_results_by_ac.setdefault(ac_id, []).append(result)
+                    decisive = passes + genuine_fails
+                    # Majority vote over the checks that actually ran. Proven iff a strict
+                    # majority pass; unanimous failure of independent checks is strong evidence
+                    # of a real defect and blocks; a split is inconclusive (handled below).
+                    ac_proven = decisive > 0 and passes > genuine_fails
+                    compiled_pass[ac_id] = ac_proven
+                    if ac_proven:
+                        compiled_vote[ac_id] = (passes, decisive, repaired)
+                        continue
+                    if passes == 0 and genuine_fails > 0:
+                        genuine_failure = True
+                        cmd, result = fail_results[0]
+                        fail_file, fail_line = self._failure_location(result)
+                        agree = (
+                            f" {genuine_fails}/{decisive} independent checks agreed it fails."
+                            if decisive > 1 else ""
+                        )
+                        gaps.append(Gap(
+                            id=self._next_gap_id(task.id, "ACCHK"),
+                            severity="high",
+                            gap_type="test_failed",
+                            task_id=task.id,
+                            description=f"Acceptance check for {ac_id} failed: '{cmd}' (exit {result.exit_code}).{agree}",
+                            evidence=[result.summary[:500]],
+                            recommended_fix=f"Fix the implementation so acceptance criterion {ac_id} holds.",
+                            blocking=True,
                             acceptance_criterion_id=ac_id,
-                            command="(devcouncil acceptance check)",
-                            status="passed",
-                            evidence_summary=(
-                                "Acceptance criterion proven only by a COARSE signal (a passing "
-                                "acceptance-capable command, not a per-criterion check); behavior "
-                                "not precisely verified."
-                                if coarse else
-                                "Acceptance criterion proven by a per-criterion compiled check."
-                            ),
+                            suggested_command=cmd,
+                            file=fail_file,
+                            line=fail_line,
+                            stdout_path=result.stdout_path or None,
+                            stderr_path=result.stderr_path or None,
                         ))
-                else:
-                    unproven_acs.append(ac_id)
-            # Surface coarse proof as a first-class advisory: these criteria passed only
-            # because some acceptance-capable command exited 0, not because a check tied
-            # to the criterion passed. Non-blocking, but no longer invisible.
-            if coarse_proven_acs:
-                gaps.append(Gap(
-                    id=self._next_gap_id(task.id, "COARSE"),
-                    severity="low",
-                    gap_type="coarse_acceptance_proof",
-                    task_id=task.id,
-                    description=(
-                        "Verification mode = COARSE for "
-                        f"{', '.join(coarse_proven_acs)}: proven by a passing acceptance-capable "
-                        "command, not a per-criterion check. Behavior is not precisely verified."
-                    ),
-                    evidence=[f"coarse-proven: {', '.join(coarse_proven_acs)}"],
-                    recommended_fix=(
-                        "Add a verification command (or test) that exercises each listed criterion "
-                        "specifically, so DevCouncil can compile a per-criterion check instead of "
-                        "relying on the coarse fallback."
-                    ),
-                    blocking=False,
-                ))
-            if unproven_acs:
-                # Block only on positive evidence of a problem. If verification was
-                # attempted but every failure was unrunnable (missing tooling / tests)
-                # and nothing genuinely failed, that is a verification defect, not a
-                # code defect — surface it as a non-blocking "could not verify".
-                couldnt_verify = had_unrunnable and not genuine_failure and work_present
-                ac_by_id = {ac.id: ac for req in requirements for ac in req.acceptance_criteria}
-                # Methods that can be proven by running code; only these block the gate
-                # when unproven. Inherently-manual criteria (manual/llm_review) and
-                # optional ones are surfaced for human review instead of false-blocking
-                # the autonomous loop — the gate still demands evidence for BEHAVIOR.
-                automatable_methods = {"unit_test", "integration_test", "static_check"}
-                for ac_id in unproven_acs:
-                    ac = ac_by_id.get(ac_id)
-                    method = ac.verification_method if ac else "unit_test"
-                    is_automatable = (ac.required if ac else True) and method in automatable_methods
-                    if not is_automatable:
-                        blocks = False
-                        optional = "" if (ac is None or ac.required) else " optional"
-                        fix = (
-                            f"This{optional} criterion's verification method is '{method}'; it cannot be "
-                            "proven by running code. Review it manually (it does not block the gate)."
-                        )
-                        suffix = f" (non-blocking: {method})"
-                    elif couldnt_verify:
-                        blocks = False
-                        fix = ("Could not verify this criterion: the verification commands did not run "
-                               "(missing tooling or tests). Regenerate them with 'dev repair' to confirm the work.")
-                        suffix = " (verification commands could not run)"
-                    else:
-                        blocks = True
-                        fix = "Add or fix a verification command that proves this acceptance criterion."
-                        suffix = ""
-                    # Concrete, AC-scoped evidence instead of "all command summaries":
-                    #  * if a compiled check targeted this AC, attach its command(s) and
-                    #    the specific failing result;
-                    #  * otherwise an explicit "no check compiled" marker so the agent
-                    #    knows it must author one, not hunt through unrelated output.
-                    ac_compiled = compiled_cmds_by_ac.get(ac_id, [])
-                    ac_failures = failing_results_by_ac.get(ac_id, [])
-                    ac_evidence: List[str] = []
-                    suggested_cmd: Optional[str] = None
-                    if ac_compiled:
-                        suggested_cmd = ac_compiled[0]
-                        ac_evidence.extend(f"compiled check: {c}" for c in ac_compiled)
-                        ac_evidence.extend(r.summary[:500] for r in ac_failures)
+                    elif passes > 0 and genuine_fails > 0:
+                        # Independent checks disagree with no majority: neither proof nor a
+                        # defect. Mark inconclusive so the unproven-AC gap below is NON-blocking
+                        # (never false-block on a lone bad check, never auto-pass a real bug).
+                        inconclusive_acs.add(ac_id)
+
+            # The compiler only earns the authority to demote a genuinely-failing planner
+            # test if it produced a per-criterion check for EVERY targeted AC. A partial
+            # compile is not enough: the uncovered ACs fall back to the coarse signal, so a
+            # demoted real failure + coarse-proven remainder would otherwise slip past the
+            # gate. If coverage is incomplete (or zero — empty compile / all-wrong-stack /
+            # a compile exception swallowed to {}), re-promote the demoted failures.
+            compiler_covered_all = bool(task.acceptance_criterion_ids) and all(
+                compiled_cmds_by_ac.get(ac_id) for ac_id in task.acceptance_criterion_ids
+            )
+            if compiler_active and not compiler_covered_all and demoted_failures:
+                for gap in demoted_failures:
+                    gap.blocking = True
+                    gap.severity = "high"
+                    genuine_failure = True
+                    logger.info(
+                        "Re-promoted demoted test failure %s to blocking: acceptance compiler "
+                        "did not produce a check for every criterion of task %s.",
+                        gap.id, task.id,
+                    )
+
+            # 5. Acceptance-criteria evidence mapping (precise, per criterion).
+            # Quality-only commands (lint/typecheck) are excluded: a passing `mypy`/`ruff
+            # check`/`tsc` exercises no behavior, so it must not coarse-prove a behavioral AC
+            # — the same false-confidence the per-criterion checks exist to prevent.
+            successful_commands = [
+                result for result in evidence_results
+                if result.exit_code == 0 and not self._is_quality_only_command(result.command)
+            ]
+            # Coarse fallback (used only when no compiled per-criterion check exists for an
+            # AC): a criterion may be marked proven by a passing acceptance-capable command
+            # ONLY when the task actually produced work. Without this guard a no-op run
+            # whose unrelated command happens to pass would "prove" every criterion against
+            # zero changes.
+            coarse_proof_available = work_present and bool(successful_commands)
+            if task.acceptance_criterion_ids:
+                req_by_ac = {ac.id: req.id for req in requirements for ac in req.acceptance_criteria}
+                unproven_acs: List[str] = []
+                coarse_proven_acs: List[str] = []
+                for ac_id in task.acceptance_criterion_ids:
+                    # An AC is proven if its compiled check passed; if no compiled check
+                    # exists for it, fall back to the coarse signal (any expected_test passed).
+                    proven: Optional[bool] = compiled_pass.get(ac_id)
+                    coarse = False
+                    if proven is None:
+                        proven = coarse_proof_available
+                        coarse = proven  # proven only by the coarse, not-AC-specific signal
+                    if proven:
+                        if coarse:
+                            coarse_proven_acs.append(ac_id)
+                        # Don't persist a "passed" record for a coarse-proven criterion during a
+                        # run that also has a genuine blocking failure — the gate already fails,
+                        # and a stored "passed" would mislead audits that read evidence directly.
+                        if not (coarse and genuine_failure):
+                            proof_mode: Literal["compiled", "vote", "coarse", ""]
+                            if coarse:
+                                proof_summary = (
+                                    "Acceptance criterion proven only by a COARSE signal (a passing "
+                                    "acceptance-capable command, not a per-criterion check); behavior "
+                                    "not precisely verified."
+                                )
+                                proof_mode = "coarse"
+                            else:
+                                # Make the per-criterion proof auditable: single check vs. majority
+                                # of independent checks, and whether a check had to be repaired to run.
+                                passes_n, decisive_n, was_repaired = compiled_vote.get(ac_id, (1, 1, False))
+                                proof_mode = "vote" if decisive_n > 1 else "compiled"
+                                how = (
+                                    f"a majority vote of independent compiled checks ({passes_n}/{decisive_n} passed)"
+                                    if decisive_n > 1 else
+                                    "a per-criterion compiled check"
+                                )
+                                repaired_note = " (one check was regenerated from its launcher error to run)" if was_repaired else ""
+                                proof_summary = f"Acceptance criterion proven by {how}.{repaired_note}"
+                            evidence_to_save.append(TestEvidence(
+                                requirement_id=req_by_ac.get(ac_id, task.requirement_ids[0] if task.requirement_ids else ""),
+                                acceptance_criterion_id=ac_id,
+                                command="(devcouncil acceptance check)",
+                                status="passed",
+                                evidence_summary=proof_summary,
+                                mode=proof_mode,
+                            ))
                     else:
-                        ac_evidence.append(
-                            f"no DevCouncil check compiled for {ac_id} "
-                            f"(expected verification method: {method})"
-                        )
+                        unproven_acs.append(ac_id)
+                # Surface coarse proof as a first-class advisory: these criteria passed only
+                # because some acceptance-capable command exited 0, not because a check tied
+                # to the criterion passed. Non-blocking, but no longer invisible.
+                if coarse_proven_acs:
                     gaps.append(Gap(
-                        id=self._next_gap_id(task.id, "AC"),
-                        severity="high" if blocks else "medium",
-                        gap_type="acceptance_criteria_unproven",
-                        requirement_id=self._requirement_id_for_ac(requirements, ac_id),
+                        id=self._next_gap_id(task.id, "COARSE"),
+                        severity="low",
+                        gap_type="coarse_acceptance_proof",
                         task_id=task.id,
                         description=(
-                            f"Acceptance criterion {ac_id} has no passing verification evidence "
-                            f"for task {task.id}.{suffix}"
+                            "Verification mode = COARSE for "
+                            f"{', '.join(coarse_proven_acs)}: proven by a passing acceptance-capable "
+                            "command, not a per-criterion check. Behavior is not precisely verified."
                         ),
-                        evidence=ac_evidence,
-                        recommended_fix=fix,
-                        blocking=blocks,
-                        acceptance_criterion_id=ac_id,
-                        expected_verification_method=method,
-                        suggested_command=suggested_cmd,
+                        evidence=[f"coarse-proven: {', '.join(coarse_proven_acs)}"],
+                        recommended_fix=(
+                            "Add a verification command (or test) that exercises each listed criterion "
+                            "specifically, so DevCouncil can compile a per-criterion check instead of "
+                            "relying on the coarse fallback."
+                        ),
+                        blocking=False,
                     ))
-        elif task.requirement_ids:
-            gaps.append(Gap(
-                id=self._next_gap_id(task.id, "NOAC"),
-                severity="high",
-                gap_type="acceptance_criteria_unproven",
-                requirement_id=task.requirement_ids[0],
-                task_id=task.id,
-                description=f"Task {task.id} is linked to requirements but no acceptance criteria.",
-                recommended_fix="Link the task to specific acceptance_criterion_ids before verification.",
-                blocking=True,
-            ))
-
-        # 5b. Diff↔coverage gate. A green suite is only acceptance evidence if it
-        # exercised the lines the diff changed. This catches the failure the README
-        # promises to stop: tests "pass" while the new logic is never run (unrelated
-        # suite, code never imported, untouched branch). Measured only when the target
-        # repo has coverage tooling and the diff has measurable Python changes; absent
-        # that, it degrades silently rather than blocking correct work.
-        measure_cov, enforce_cov, min_ratio = self._diff_coverage_settings()
-        any_passing = bool(successful_commands) or any(compiled_pass.values())
-        coverage_measured = False
-        coverage_skipped_reason: Optional[str] = None
-        if not measure_cov:
-            coverage_skipped_reason = "diff coverage disabled in config"
-        elif not diff_content:
-            coverage_skipped_reason = "no diff to measure"
-        elif not task.acceptance_criterion_ids:
-            coverage_skipped_reason = "task has no acceptance criteria"
-        elif not any_passing:
-            coverage_skipped_reason = "no passing verification command to instrument"
-        if measure_cov and diff_content and task.acceptance_criterion_ids and any_passing:
-            cov = self.measure_diff_coverage(task, diff_content)
-            if not cov.measured:
-                coverage_skipped_reason = cov.reason or "diff coverage could not be measured"
-            if cov.measured:
-                coverage_measured = True
-                coverage_skipped_reason = None
-                evidence_to_save.append(DiffCoverageEvidence(
+                if unproven_acs:
+                    # Block only on positive evidence of a problem. If verification was
+                    # attempted but every failure was unrunnable (missing tooling / tests)
+                    # and nothing genuinely failed, that is a verification defect, not a
+                    # code defect — surface it as a non-blocking "could not verify".
+                    couldnt_verify = had_unrunnable and not genuine_failure and work_present
+                    ac_by_id = {ac.id: ac for req in requirements for ac in req.acceptance_criteria}
+                    # Methods whose criteria HARD-BLOCK the gate when unproven: only those
+                    # that assert BEHAVIOR. Inherently-manual criteria (manual/llm_review),
+                    # optional ones, and quality-only `static_check` criteria (PEP 8 /
+                    # docstring / formatting) are surfaced for review instead of
+                    # false-blocking the autonomous loop. static_check is a quality gate,
+                    # not a correctness gate — mirroring how lint/type COMMAND failures are
+                    # already demoted to advisory — and the compiler often cannot author a
+                    # reliable style check (or the criterion lands on a no-diff process task),
+                    # which otherwise blocks correct, style-conforming code.
+                    automatable_methods = {"unit_test", "integration_test"}
+                    for ac_id in unproven_acs:
+                        ac = ac_by_id.get(ac_id)
+                        method = ac.verification_method if ac else "unit_test"
+                        is_automatable = (ac.required if ac else True) and method in automatable_methods
+                        if not is_automatable:
+                            blocks = False
+                            optional = "" if (ac is None or ac.required) else " optional"
+                            fix = (
+                                f"This{optional} criterion's verification method is '{method}'; it cannot be "
+                                "proven by running code. Review it manually (it does not block the gate)."
+                            )
+                            suffix = f" (non-blocking: {method})"
+                        elif ac_id in inconclusive_acs:
+                            # Independently-generated checks split with no majority — inconclusive,
+                            # so this does not block (a lone bad check must not fail correct code).
+                            blocks = False
+                            fix = ("Auto-generated acceptance checks disagreed on this criterion (some "
+                                   "passed, some failed). Add a precise verification command that "
+                                   "unambiguously proves it so the result is decisive.")
+                            suffix = " (auto-checks inconclusive)"
+                        elif couldnt_verify:
+                            blocks = False
+                            fix = ("Could not verify this criterion: the verification commands did not run "
+                                   "(missing tooling or tests). Regenerate them with 'dev repair' to confirm the work.")
+                            suffix = " (verification commands could not run)"
+                        else:
+                            blocks = True
+                            fix = "Add or fix a verification command that proves this acceptance criterion."
+                            suffix = ""
+                        # Concrete, AC-scoped evidence instead of "all command summaries":
+                        #  * if a compiled check targeted this AC, attach its command(s) and
+                        #    the specific failing result;
+                        #  * otherwise an explicit "no check compiled" marker so the agent
+                        #    knows it must author one, not hunt through unrelated output.
+                        ac_compiled = compiled_cmds_by_ac.get(ac_id, [])
+                        ac_failures = failing_results_by_ac.get(ac_id, [])
+                        ac_evidence: List[str] = []
+                        suggested_cmd: Optional[str] = None
+                        if ac_compiled:
+                            suggested_cmd = ac_compiled[0]
+                            ac_evidence.extend(f"compiled check: {c}" for c in ac_compiled)
+                            ac_evidence.extend(r.summary[:500] for r in ac_failures)
+                        else:
+                            ac_evidence.append(
+                                f"no DevCouncil check compiled for {ac_id} "
+                                f"(expected verification method: {method})"
+                            )
+                        gaps.append(Gap(
+                            id=self._next_gap_id(task.id, "AC"),
+                            severity="high" if blocks else "medium",
+                            gap_type="acceptance_criteria_unproven",
+                            requirement_id=self._requirement_id_for_ac(requirements, ac_id),
+                            task_id=task.id,
+                            description=(
+                                f"Acceptance criterion {ac_id} has no passing verification evidence "
+                                f"for task {task.id}.{suffix}"
+                            ),
+                            evidence=ac_evidence,
+                            recommended_fix=fix,
+                            blocking=blocks,
+                            acceptance_criterion_id=ac_id,
+                            expected_verification_method=method,
+                            suggested_command=suggested_cmd,
+                        ))
+            elif task.requirement_ids:
+                gaps.append(Gap(
+                    id=self._next_gap_id(task.id, "NOAC"),
+                    severity="high",
+                    gap_type="acceptance_criteria_unproven",
+                    requirement_id=task.requirement_ids[0],
                     task_id=task.id,
-                    tool=cov.tool,
-                    measured=True,
-                    changed_lines=cov.changed_executable_lines,
-                    covered_lines=cov.covered_changed_lines,
-                    coverage_ratio=cov.ratio,
-                    uncovered_by_file=cov.uncovered_by_file,
-                    absent_files=cov.absent_files,
-                    summary=cov.summary(),
+                    description=f"Task {task.id} is linked to requirements but no acceptance criteria.",
+                    recommended_fix="Link the task to specific acceptance_criterion_ids before verification.",
+                    blocking=True,
                 ))
-                failing = cov.covered_changed_lines == 0 if min_ratio <= 0 else cov.ratio < min_ratio
-                if failing:
-                    first_file = next(iter(cov.uncovered_by_file), None)
-                    first_lines = cov.uncovered_by_file.get(first_file or "", [])
-                    target_cmds = self._coverage_target_commands(task)
-                    gaps.append(Gap(
-                        id=self._next_gap_id(task.id, "DIFFCOV"),
-                        severity="high" if enforce_cov else "medium",
-                        gap_type="diff_not_exercised",
+
+            # 5b. Diff↔coverage gate. A green suite is only acceptance evidence if it
+            # exercised the lines the diff changed. This catches the failure the README
+            # promises to stop: tests "pass" while the new logic is never run (unrelated
+            # suite, code never imported, untouched branch). Measured only when the target
+            # repo has coverage tooling and the diff has measurable Python changes; absent
+            # that, it degrades silently rather than blocking correct work.
+            measure_cov, enforce_cov, min_ratio = self._diff_coverage_settings()
+            any_passing = bool(successful_commands) or any(compiled_pass.values())
+            coverage_measured = False
+            coverage_skipped_reason: Optional[str] = None
+            if not measure_cov:
+                coverage_skipped_reason = "diff coverage disabled in config"
+            elif not diff_content:
+                coverage_skipped_reason = "no diff to measure"
+            elif not task.acceptance_criterion_ids:
+                coverage_skipped_reason = "task has no acceptance criteria"
+            elif not any_passing:
+                coverage_skipped_reason = "no passing verification command to instrument"
+            if measure_cov and diff_content and task.acceptance_criterion_ids and any_passing:
+                cov = self.measure_diff_coverage(task, diff_content)
+                if not cov.measured:
+                    coverage_skipped_reason = cov.reason or "diff coverage could not be measured"
+                if cov.measured:
+                    coverage_measured = True
+                    coverage_skipped_reason = None
+                    evidence_to_save.append(DiffCoverageEvidence(
                         task_id=task.id,
-                        description=(
-                            f"Verification commands passed but exercised "
-                            f"{cov.covered_changed_lines}/{cov.changed_executable_lines} changed line(s): "
-                            f"{cov.summary()}. The acceptance criteria are not proven because the new "
-                            "logic was never executed by the tests."
-                        ),
-                        evidence=[cov.summary()] + [
-                            f"{path}: lines {lines}" for path, lines in list(cov.uncovered_by_file.items())[:5]
-                        ],
-                        recommended_fix=(
-                            "Add or extend a test that executes the changed lines, then re-verify. "
-                            "A passing suite that does not run the new code is not acceptance evidence."
-                        ),
-                        # Off by default (signal first); teams opt into blocking via
-                        # verification.diff_coverage.enforce.
-                        blocking=enforce_cov,
-                        file=first_file,
-                        line=first_lines[0] if first_lines else None,
-                        suggested_command=target_cmds[0] if target_cmds else None,
+                        tool=cov.tool,
+                        measured=True,
+                        changed_lines=cov.changed_executable_lines,
+                        covered_lines=cov.covered_changed_lines,
+                        coverage_ratio=cov.ratio,
+                        uncovered_by_file=cov.uncovered_by_file,
+                        absent_files=cov.absent_files,
+                        summary=cov.summary(),
                     ))
+                    failing = cov.covered_changed_lines == 0 if min_ratio <= 0 else cov.ratio < min_ratio
+                    if failing:
+                        first_file = next(iter(cov.uncovered_by_file), None)
+                        first_lines = cov.uncovered_by_file.get(first_file or "", [])
+                        target_cmds = self._coverage_target_commands(task)
+                        gaps.append(Gap(
+                            id=self._next_gap_id(task.id, "DIFFCOV"),
+                            severity="high" if enforce_cov else "medium",
+                            gap_type="diff_not_exercised",
+                            task_id=task.id,
+                            description=(
+                                f"Verification commands passed but exercised "
+                                f"{cov.covered_changed_lines}/{cov.changed_executable_lines} changed line(s): "
+                                f"{cov.summary()}. The acceptance criteria are not proven because the new "
+                                "logic was never executed by the tests."
+                            ),
+                            evidence=[cov.summary()] + [
+                                f"{path}: lines {lines}" for path, lines in list(cov.uncovered_by_file.items())[:5]
+                            ],
+                            recommended_fix=(
+                                "Add or extend a test that executes the changed lines, then re-verify. "
+                                "A passing suite that does not run the new code is not acceptance evidence."
+                            ),
+                            # Off by default (signal first); teams opt into blocking via
+                            # verification.diff_coverage.enforce.
+                            blocking=enforce_cov,
+                            file=first_file,
+                            line=first_lines[0] if first_lines else None,
+                            suggested_command=target_cmds[0] if target_cmds else None,
+                        ))
 
-        # 6. Secret scan
-        if diff_content:
-            gaps.extend(self.secret_scanner.scan_diff(diff_content, task.id))
-
-        # 7. LLM Implementation Review (ADVISORY ONLY).
-        # DevCouncil's authority is executable evidence, not model confidence — so
-        # an LLM reviewer must never block on its own say-so. Subjective reviewers
-        # over-flag correct code (false negatives that erode trust in "blocked"),
-        # so review findings are surfaced as non-blocking signals. A genuine
-        # requirement gap is caught by the acceptance-criteria evidence checks
-        # above; the review just adds human-facing context.
-        if self.reviewer and diff_content:
-            try:
-                review_result = await self.reviewer.review_changes(task, requirements, diff_content)
-                for finding in review_result.findings:
-                    finding.id = self._next_gap_id(task.id, "REVIEW")
-                    finding.blocking = False
-                    gaps.append(finding)
-            except Exception as e:
-                logger.error("Implementation review failed: %s", e)
-
-        # 8. Open live-review cards
-        for card in unresolved_blocking_cards(self.project_root, task_id=task.id):
-            gaps.append(Gap(
-                id=self._next_gap_id(task.id, "LIVE"),
-                severity="critical",
-                gap_type="architecture_drift",
-                task_id=task.id,
-                description=f"Open critical live-review card remains: {card.summary}",
-                evidence=[card.id, card.message_for_agent],
-                recommended_fix=(
-                    f"Address the critique card, then run `dev watch resolve {card.id}` "
-                    "or mark it ignored with justification outside the verification gate."
-                ),
-                blocking=True,
-            ))
-
-        self.last_outcome = VerificationOutcome(
-            mode="compiled" if self.acceptance_compiler else "coarse",
-            compiler_active=compiler_active,
-            diff_empty=diff_empty,
-            coverage_measured=coverage_measured,
-            coverage_skipped_reason=coverage_skipped_reason,
-        )
-        return gaps, evidence_to_save
+            # 6. Secret scan
+            if diff_content:
+                gaps.extend(self.secret_scanner.scan_diff(diff_content, task.id))
+
+            # 7. LLM Implementation Review (ADVISORY ONLY).
+            # DevCouncil's authority is executable evidence, not model confidence — so
+            # an LLM reviewer must never block on its own say-so. Subjective reviewers
+            # over-flag correct code (false negatives that erode trust in "blocked"),
+            # so review findings are surfaced as non-blocking signals. A genuine
+            # requirement gap is caught by the acceptance-criteria evidence checks
+            # above; the review just adds human-facing context.
+            if review_future is not None:
+                try:
+                    review_result = await review_future
+                    for finding in review_result.findings:
+                        finding.id = self._next_gap_id(task.id, "REVIEW")
+                        finding.blocking = False
+                        gaps.append(finding)
+                except Exception as e:
+                    logger.error("Implementation review failed: %s", e)
+
+            # 8. Open live-review cards
+            for card in unresolved_blocking_cards(self.project_root, task_id=task.id):
+                gaps.append(Gap(
+                    id=self._next_gap_id(task.id, "LIVE"),
+                    severity="critical",
+                    gap_type="architecture_drift",
+                    task_id=task.id,
+                    description=f"Open critical live-review card remains: {card.summary}",
+                    evidence=[card.id, card.message_for_agent],
+                    recommended_fix=(
+                        f"Address the critique card, then run `dev watch resolve {card.id}` "
+                        "or mark it ignored with justification outside the verification gate."
+                    ),
+                    blocking=True,
+                ))
 
-    def _check_semantic_diff(self, task: Task) -> List[Gap]:
+            self.last_outcome = VerificationOutcome(
+                mode="compiled" if self.acceptance_compiler else "coarse",
+                compiler_active=compiler_active,
+                diff_empty=diff_empty,
+                coverage_measured=coverage_measured,
+                coverage_skipped_reason=coverage_skipped_reason,
+            )
+            return gaps, evidence_to_save
+        finally:
+            # Always drain the two background LLM tasks (even if the body raised
+            # before their await points) so neither is destroyed-while-pending nor
+            # logs 'exception never retrieved', and clear the per-call memos so a
+            # later non-verify_task call on this instance recomputes fresh.
+            for _fut in (compile_future, review_future):
+                if _fut is not None:
+                    if not _fut.done():
+                        _fut.cancel()
+                    try:
+                        await _fut
+                    except (asyncio.CancelledError, Exception):
+                        pass
+            self._untracked_cache = None
+            self._command_timeout_cache = None
+            # Reload project dependencies next run: a reused Verifier may verify a later
+            # task after pyproject/requirements changed on disk.
+            self._project_deps_cache = None
+
+    def _task_intent_text(self, task: Task, requirements: Optional[List[Requirement]]) -> str:
+        """Lowercased text describing what the task is meant to do — its title,
+        description, and the descriptions of its acceptance criteria. Used to tell an
+        INTENDED public-API change ("remove deprecated foo") from silent drift."""
+        parts = [task.title or "", task.description or ""]
+        if requirements:
+            ac_ids = set(task.acceptance_criterion_ids)
+            for req in requirements:
+                for ac in req.acceptance_criteria:
+                    if ac.id in ac_ids:
+                        parts.append(ac.description or "")
+        return " ".join(parts).lower()
+
+    def _check_semantic_diff(self, task: Task, requirements: Optional[List[Requirement]] = None) -> List[Gap]:
         gaps: List[Gap] = []
         semantic_path = self.project_root / ".devcouncil" / "semantic" / task.id
         after_path = semantic_path / "after.json"
@@ -1225,10 +1433,45 @@ class Verifier:
             return gaps
 
         planned_paths = {pf.path for pf in task.planned_files}
-        for item in result.get("classifications", []):
+        classifications = result.get("classifications", [])
+        # Drift signal inputs: a public symbol re-added elsewhere is a move/rename (a
+        # legitimate refactor, not drift); and the task's own intent text lets a removal
+        # the task actually asked for ("remove deprecated foo") pass without false-blocking.
+        readded_public = {
+            item.get("name") for item in classifications
+            if item.get("type") == "exported_symbol_added" and item.get("name")
+        }
+        intent_text = self._task_intent_text(task, requirements)
+        for item in classifications:
             change_type = item.get("type", "")
             path = item.get("path", "")
-            if change_type == "public_api_change" and path not in planned_paths:
+            if change_type == "exported_symbol_removed":
+                # An executor deleting/renaming an existing PUBLIC symbol — even inside a
+                # file it is allowed to touch — is scope drift / a regression the focused
+                # task rarely intends. Block it UNLESS the symbol was re-added elsewhere
+                # (a move/rename) or the task text explicitly calls for the removal.
+                name = item.get("name", "")
+                moved = name in readded_public
+                intended = bool(name) and name.lower() in intent_text
+                gaps.append(Gap(
+                    id=self._next_gap_id(task.id, "DRIFT"),
+                    severity="high",
+                    gap_type="architecture_drift",
+                    task_id=task.id,
+                    description=(
+                        f"Public symbol '{name}' was removed from {path} — possible scope "
+                        "drift: the executor changed a public API the task did not call for."
+                    ),
+                    evidence=[f"{path}:{name}"],
+                    recommended_fix=(
+                        "Restore the removed public symbol. If its removal IS part of this "
+                        "task, state that in the task description / acceptance criteria so the "
+                        "change is an intended, reviewed decision rather than silent drift."
+                    ),
+                    blocking=(not moved and not intended),
+                    file=path,
+                ))
+            elif change_type == "public_api_change" and path not in planned_paths:
                 gaps.append(Gap(
                     id=self._next_gap_id(task.id, "SEM"),
                     severity="high",
@@ -1239,17 +1482,66 @@ class Verifier:
                     recommended_fix="Add file to planned_files and document acceptance criteria.",
                     blocking=not bool(task.acceptance_criterion_ids),
                 ))
-            elif change_type == "import_dependency_change" and path not in planned_paths:
+            elif change_type == "public_api_change" and path in planned_paths:
+                # The file is in scope, but the executor changed the SIGNATURE of an
+                # existing public symbol. Tasks legitimately change signatures of files
+                # they own, so this is ADVISORY only — surfaced so an audit/agent can see
+                # the public contract moved, not silently drifted.
                 gaps.append(Gap(
-                    id=self._next_gap_id(task.id, "IMP"),
+                    id=self._next_gap_id(task.id, "SIGDRIFT"),
                     severity="medium",
-                    gap_type="dependency_risk",
+                    gap_type="architecture_drift",
                     task_id=task.id,
-                    description=f"Import dependency change in {path}.",
-                    evidence=[path],
-                    recommended_fix="Confirm dependency change is intentional.",
+                    description=(
+                        f"Public API signature change in planned file {path}"
+                        + (f" ({item.get('name')})" if item.get("name") else "")
+                        + ". Confirm callers are updated and the change is intended."
+                    ),
+                    evidence=[f"{path}:{item.get('name', '')}"],
+                    recommended_fix=(
+                        "If the signature change is part of this task, note it in the task "
+                        "description / acceptance criteria; otherwise revert it."
+                    ),
                     blocking=False,
                 ))
+            elif change_type == "import_dependency_change":
+                # A NEW third-party top-level package added to the diff is supply-chain
+                # drift — block it. Everything else (stdlib, relative/local, or an
+                # already-declared/available dependency) stays advisory, and only on an
+                # unplanned file (an unplanned file is already orphan-blocked anyway).
+                statement = item.get("statement", "")
+                top = self._import_top_level(statement)
+                new_third_party = self._is_new_third_party_import(top)
+                if new_third_party:
+                    gaps.append(Gap(
+                        id=self._next_gap_id(task.id, "DEPADD"),
+                        severity="high",
+                        gap_type="dependency_risk",
+                        task_id=task.id,
+                        description=(
+                            f"New undeclared third-party dependency '{top}' imported in {path} "
+                            f"({statement.strip()}). Adding a dependency the task did not plan is "
+                            "supply-chain drift."
+                        ),
+                        evidence=[path, statement.strip()],
+                        recommended_fix=(
+                            f"Declare '{top}' in the project's dependencies and plan the change, "
+                            "or use an existing/standard-library alternative."
+                        ),
+                        blocking=True,
+                        file=path,
+                    ))
+                elif path not in planned_paths:
+                    gaps.append(Gap(
+                        id=self._next_gap_id(task.id, "IMP"),
+                        severity="medium",
+                        gap_type="dependency_risk",
+                        task_id=task.id,
+                        description=f"Import dependency change in {path}.",
+                        evidence=[path],
+                        recommended_fix="Confirm dependency change is intentional.",
+                        blocking=False,
+                    ))
             elif change_type == "config_schema_dependency_change" and path not in planned_paths:
                 gaps.append(Gap(
                     id=self._next_gap_id(task.id, "CFG"),
@@ -1263,6 +1555,102 @@ class Verifier:
                 ))
         return gaps
 
+    @staticmethod
+    def _import_top_level(statement: str) -> Optional[str]:
+        """Top-level package of an import statement, or None for relative/local/unparseable.
+
+        ``import requests`` / ``import os.path`` -> the first dotted component; ``from x.y
+        import z`` -> ``x``; ``from . import z`` / ``from .mod import z`` -> None (relative).
+        """
+        s = (statement or "").strip()
+        if s.startswith("import "):
+            first = s[len("import "):].split(",")[0].strip()
+            top = first.split(" as ")[0].strip().split(".")[0].strip()
+            return top or None
+        if s.startswith("from "):
+            rest = s[len("from "):].lstrip()
+            if rest.startswith("."):  # relative import -> local, never a new dependency
+                return None
+            mod = rest.split(" import ")[0].strip()
+            return (mod.split(".")[0].strip() or None) if mod else None
+        return None
+
+    def _is_new_third_party_import(self, top: Optional[str]) -> bool:
+        """True only when ``top`` is a genuinely new, undeclared third-party package.
+
+        Conservative on purpose (this gates a BLOCK): a module is NOT flagged when it is
+        the standard library, a declared project dependency, or already importable in the
+        environment (so import-name vs distribution-name mismatches like ``yaml``/``pyyaml``
+        never false-block). Only a package that is none of those — i.e. undeclared AND not
+        present — counts as supply-chain drift."""
+        if not top:
+            return False
+        if top in self._stdlib_modules():
+            return False
+        if top.lower() in self._project_dependencies():
+            return False
+        try:
+            import importlib.util
+            if importlib.util.find_spec(top) is not None:
+                return False  # already available in the environment; not a new dependency
+        except Exception:
+            # A find_spec error (e.g. a partially-installed parent) is ambiguous; do not
+            # block on ambiguity.
+            return False
+        return True
+
+    @staticmethod
+    def _stdlib_modules() -> frozenset:
+        names = getattr(sys, "stdlib_module_names", None)
+        return frozenset(names) if names else frozenset()
+
+    def _project_dependencies(self) -> set:
+        """Lower-cased distribution names declared by the project (pyproject/requirements/
+        package.json). Cached per Verifier instance; best-effort (parse errors are ignored)."""
+        cached = getattr(self, "_project_deps_cache", None)
+        if cached is not None:
+            return cached
+        deps: set = set()
+        split_re = r"[><=!~;\[\] ]"
+        pyproject = self.project_root / "pyproject.toml"
+        if pyproject.exists():
+            try:
+                import tomllib
+                data = tomllib.loads(pyproject.read_text(encoding="utf-8"))
+                project = data.get("project", {}) or {}
+                for dep in project.get("dependencies", []) or []:
+                    pkg = re.split(split_re, dep.strip())[0].strip().lower()
+                    if pkg:
+                        deps.add(pkg)
+                for group in (project.get("optional-dependencies", {}) or {}).values():
+                    for dep in group or []:
+                        pkg = re.split(split_re, dep.strip())[0].strip().lower()
+                        if pkg:
+                            deps.add(pkg)
+            except Exception:
+                pass
+        requirements = self.project_root / "requirements.txt"
+        if requirements.exists():
+            try:
+                for line in requirements.read_text(encoding="utf-8").splitlines():
+                    line = line.strip()
+                    if line and not line.startswith("#"):
+                        pkg = re.split(split_re, line)[0].strip().lower()
+                        if pkg:
+                            deps.add(pkg)
+            except Exception:
+                pass
+        package_json = self.project_root / "package.json"
+        if package_json.exists():
+            try:
+                data = json.loads(package_json.read_text(encoding="utf-8"))
+                for key in ("dependencies", "devDependencies", "optionalDependencies"):
+                    deps.update(k.lower() for k in (data.get(key) or {}).keys())
+            except Exception:
+                pass
+        self._project_deps_cache = deps
+        return deps
+
     # Signatures that mean the verification command itself could not run (or had
     # nothing to run), so its non-zero exit says nothing about whether the
     # implementation is correct — a tooling/plan defect, not a code defect.