gsd-pi 2.81.0-dev.72a81bdf3 → 2.82.0-dev.2841a1e44

package/src/resources/extensions/gsd/auto-post-unit.ts

@@ -7,8 +7,8 @@
  *
  * Split into two functions called sequentially by auto-loop with
  * the verification gate between them:
- *   1. postUnitPreVerification() — commit, doctor, state rebuild, worktree sync, artifact verification
- *   2. postUnitPostVerification() — DB dual-write, hooks, triage, quick-tasks
+ *   1. postUnitPreVerification() — closeout git for non-task units, doctor, state rebuild, worktree sync, artifact verification
+ *   2. postUnitPostVerification() — post-verified task git, DB dual-write, hooks, triage, quick-tasks
  *
  * Extracted from the pre-loop agent_end handler in auto.ts.
  */
@@ -62,8 +62,7 @@ import { runSafely } from "./auto-utils.js";
 import type { AutoSession, SidecarItem } from "./auto/session.js";
 import { getEvidence, clearEvidenceFromDisk } from "./safety/evidence-collector.js";
 import { validateFileChanges } from "./safety/file-change-validator.js";
-// crossReferenceEvidence available for future use when verification_evidence is stored in DB
-// import { crossReferenceEvidence, type ClaimedEvidence } from "./safety/evidence-cross-ref.js";
+import { crossReferenceEvidence, type ClaimedEvidence } from "./safety/evidence-cross-ref.js";
 import { validateContent } from "./safety/content-validator.js";
 import { resolveSafetyHarnessConfig } from "./safety/safety-harness.js";
 import { resolveExpectedArtifactPath as resolveArtifactForContent } from "./auto-artifact-paths.js";
@@ -222,6 +221,10 @@ export function _shouldDispatchQuickTaskForTest(
     state.currentUnit.type !== "quick-task";
 }
 
+export function shouldDeferCloseoutGitAction(unitType: string): boolean {
+  return unitType === "execute-task";
+}
+
 /** Unit types that only touch `.gsd/` internal state files (no code changes).
  *  Auto-commit is skipped for these — their state files are picked up by the
  *  next actual task commit via `smartStage()`. */
@@ -466,6 +469,139 @@ export async function autoCommitUnit(
   }
 }
 
+async function runCloseoutGitAction(
+  pctx: PostUnitContext,
+  unit: NonNullable<AutoSession["currentUnit"]>,
+): Promise<"continue" | "dispatched"> {
+  const { s, ctx, pi, pauseAuto } = pctx;
+  const prefs = loadEffectiveGSDPreferences()?.preferences;
+  const uokFlags = resolveUokFlags(prefs);
+  const turnAction: TurnGitActionMode = uokFlags.gitops ? uokFlags.gitopsTurnAction : "commit";
+  const traceId = s.currentTraceId ?? `turn:${unit.startedAt}`;
+  const turnId = s.currentTurnId ?? `${unit.type}/${unit.id}/${unit.startedAt}`;
+
+  s.lastGitActionFailure = null;
+  s.lastGitActionStatus = null;
+
+  try {
+    let taskContext: TaskCommitContext | undefined;
+
+    if (turnAction === "commit" && unit.type === "execute-task") {
+      taskContext = await buildTaskCommitContextForUnit(s.basePath, unit.id);
+    }
+
+    // Invalidate the nativeHasChanges cache before auto-commit (#1853).
+    // The cache has a 10-second TTL and is keyed by basePath. A stale
+    // `false` result causes autoCommit to skip staging entirely.
+    _resetHasChangesCache();
+
+    const skipLifecycleCommit =
+      turnAction === "commit" && LIFECYCLE_ONLY_UNITS.has(unit.type);
+
+    if (skipLifecycleCommit) {
+      debugLog("postUnit", {
+        phase: "git-action-skipped",
+        reason: "lifecycle-only-unit",
+        unitType: unit.type,
+        unitId: unit.id,
+      });
+    } else {
+      const gitResult = runTurnGitAction({
+        basePath: s.basePath,
+        action: turnAction,
+        unitType: unit.type,
+        unitId: unit.id,
+        taskContext,
+      });
+
+      if (uokFlags.gitops) {
+        writeTurnGitTransaction({
+          basePath: s.basePath,
+          traceId,
+          turnId,
+          unitType: unit.type,
+          unitId: unit.id,
+          stage: "publish",
+          action: turnAction,
+          push: uokFlags.gitopsTurnPush,
+          status: gitResult.status,
+          error: gitResult.error,
+          metadata: {
+            dirty: gitResult.dirty,
+            commitMessage: gitResult.commitMessage,
+            snapshotLabel: gitResult.snapshotLabel,
+          },
+        });
+      }
+
+      if (gitResult.status === "failed") {
+        s.lastGitActionFailure = gitResult.error ?? `git ${turnAction} failed`;
+        s.lastGitActionStatus = "failed";
+        if (uokFlags.gitops && uokFlags.gates) {
+          const parsed = parseUnitId(unit.id);
+          const gateRunner = new UokGateRunner();
+          gateRunner.register({
+            id: "closeout-git-action",
+            type: "closeout",
+            execute: async () => ({
+              outcome: "fail",
+              failureClass: "git",
+              rationale: `turn git action "${turnAction}" failed`,
+              findings: gitResult.error ?? "unknown git failure",
+            }),
+          });
+          await gateRunner.run("closeout-git-action", {
+            basePath: s.basePath,
+            traceId,
+            turnId,
+            milestoneId: parsed.milestone ?? undefined,
+            sliceId: parsed.slice ?? undefined,
+            taskId: parsed.task ?? undefined,
+            unitType: unit.type,
+            unitId: unit.id,
+          });
+        }
+
+        const failureMsg = `Git ${turnAction} failed: ${(gitResult.error ?? "unknown error").split("\n")[0]}`;
+        ctx.ui.notify(failureMsg, "error");
+        debugLog("postUnit", {
+          phase: "git-action-failed-blocking",
+          action: turnAction,
+          error: gitResult.error ?? "unknown error",
+        });
+        await pauseAuto(ctx, pi);
+        return "dispatched";
+      }
+
+      s.lastGitActionStatus = "ok";
+
+      if (turnAction === "commit" && gitResult.commitMessage) {
+        ctx.ui.notify(`Committed: ${gitResult.commitMessage.split("\n")[0]}`, "info");
+      } else if (turnAction === "snapshot" && gitResult.snapshotLabel) {
+        ctx.ui.notify(`Snapshot recorded: ${gitResult.snapshotLabel}`, "info");
+      }
+    }
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    s.lastGitActionFailure = message;
+    s.lastGitActionStatus = "failed";
+    debugLog("postUnit", { phase: "git-action", error: message, action: turnAction });
+    ctx.ui.notify(`Git ${turnAction} failed: ${message.split("\n")[0]}`, uokFlags.gitops ? "error" : "warning");
+    if (uokFlags.gitops) {
+      await pauseAuto(ctx, pi);
+      return "dispatched";
+    }
+  }
+
+  // GitHub sync (non-blocking, opt-in)
+  await runSafely("postUnit", "github-sync", async () => {
+    const { runGitHubSync } = await import("../github-sync/sync.js");
+    await runGitHubSync(s.basePath, unit.type, unit.id);
+  });
+
+  return "continue";
+}
+
 /**
  * Pre-verification processing: parallel worker signal check, cache invalidation,
  * auto-commit, doctor run, state rebuild, worktree sync, artifact verification.
@@ -476,7 +612,7 @@ export async function autoCommitUnit(
  * - "retry" — artifact verification failed, s.pendingVerificationRetry set for loop re-iteration
  */
 export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreVerificationOpts): Promise<"dispatched" | "continue" | "retry"> {
-  const { s, ctx, pi, buildSnapshotOpts, stopAuto, pauseAuto } = pctx;
+  const { s, ctx, pi, stopAuto, pauseAuto } = pctx;
 
   // ── Parallel worker signal check ──
   const milestoneLock = process.env.GSD_MILESTONE_LOCK;
@@ -502,135 +638,22 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
     await new Promise(r => setTimeout(r, 100));
   }
 
-  const prefs = loadEffectiveGSDPreferences()?.preferences;
-  const uokFlags = resolveUokFlags(prefs);
-
   // Turn-level git action (commit | snapshot | status-only)
   if (s.currentUnit) {
     const unit = s.currentUnit;
-    const turnAction: TurnGitActionMode = uokFlags.gitops ? uokFlags.gitopsTurnAction : "commit";
-    const traceId = s.currentTraceId ?? `turn:${unit.startedAt}`;
-    const turnId = s.currentTurnId ?? `${unit.type}/${unit.id}/${unit.startedAt}`;
-    s.lastGitActionFailure = null;
-    s.lastGitActionStatus = null;
-    try {
-      let taskContext: TaskCommitContext | undefined;
-
-      if (turnAction === "commit" && s.currentUnit.type === "execute-task") {
-        taskContext = await buildTaskCommitContextForUnit(s.basePath, s.currentUnit.id);
-      }
-
-      // Invalidate the nativeHasChanges cache before auto-commit (#1853).
-      // The cache has a 10-second TTL and is keyed by basePath.  A stale
-      // `false` result causes autoCommit to skip staging entirely, leaving
-      // code files only in the working tree where they are destroyed by
-      // `git worktree remove --force` during teardown.
-      _resetHasChangesCache();
-
-      const skipLifecycleCommit =
-        turnAction === "commit" && LIFECYCLE_ONLY_UNITS.has(s.currentUnit.type);
-
-      if (skipLifecycleCommit) {
-        debugLog("postUnit", {
-          phase: "git-action-skipped",
-          reason: "lifecycle-only-unit",
-          unitType: s.currentUnit.type,
-          unitId: s.currentUnit.id,
-        });
-      } else {
-        const gitResult = runTurnGitAction({
-          basePath: s.basePath,
-          action: turnAction,
-          unitType: s.currentUnit.type,
-          unitId: s.currentUnit.id,
-          taskContext,
-        });
-
-        if (uokFlags.gitops) {
-          writeTurnGitTransaction({
-            basePath: s.basePath,
-            traceId,
-            turnId,
-            unitType: unit.type,
-            unitId: unit.id,
-            stage: "publish",
-            action: turnAction,
-            push: uokFlags.gitopsTurnPush,
-            status: gitResult.status,
-            error: gitResult.error,
-            metadata: {
-              dirty: gitResult.dirty,
-              commitMessage: gitResult.commitMessage,
-              snapshotLabel: gitResult.snapshotLabel,
-            },
-          });
-        }
-
-        if (gitResult.status === "failed") {
-          s.lastGitActionFailure = gitResult.error ?? `git ${turnAction} failed`;
-          s.lastGitActionStatus = "failed";
-          if (uokFlags.gitops && uokFlags.gates) {
-            const parsed = parseUnitId(unit.id);
-            const gateRunner = new UokGateRunner();
-            gateRunner.register({
-              id: "closeout-git-action",
-              type: "closeout",
-              execute: async () => ({
-                outcome: "fail",
-                failureClass: "git",
-                rationale: `turn git action "${turnAction}" failed`,
-                findings: gitResult.error ?? "unknown git failure",
-              }),
-            });
-            await gateRunner.run("closeout-git-action", {
-              basePath: s.basePath,
-              traceId,
-              turnId,
-              milestoneId: parsed.milestone ?? undefined,
-              sliceId: parsed.slice ?? undefined,
-              taskId: parsed.task ?? undefined,
-              unitType: unit.type,
-              unitId: unit.id,
-            });
-          }
-
-          const failureMsg = `Git ${turnAction} failed: ${(gitResult.error ?? "unknown error").split("\n")[0]}`;
-          ctx.ui.notify(failureMsg, "error");
-          debugLog("postUnit", {
-            phase: "git-action-failed-blocking",
-            action: turnAction,
-            error: gitResult.error ?? "unknown error",
-          });
-          await pauseAuto(ctx, pi);
-          return "dispatched";
-        }
-
-        s.lastGitActionStatus = "ok";
-
-        if (turnAction === "commit" && gitResult.commitMessage) {
-          ctx.ui.notify(`Committed: ${gitResult.commitMessage.split("\n")[0]}`, "info");
-        } else if (turnAction === "snapshot" && gitResult.snapshotLabel) {
-          ctx.ui.notify(`Snapshot recorded: ${gitResult.snapshotLabel}`, "info");
-        }
-      }
-    } catch (e) {
-      const message = e instanceof Error ? e.message : String(e);
-      s.lastGitActionFailure = message;
-      s.lastGitActionStatus = "failed";
-      debugLog("postUnit", { phase: "git-action", error: message, action: turnAction });
-      ctx.ui.notify(`Git ${turnAction} failed: ${message.split("\n")[0]}`, uokFlags.gitops ? "error" : "warning");
-      if (uokFlags.gitops) {
-        await pauseAuto(ctx, pi);
+    if (shouldDeferCloseoutGitAction(unit.type)) {
+      debugLog("postUnit", {
+        phase: "git-action-deferred-until-verification",
+        unitType: unit.type,
+        unitId: unit.id,
+      });
+    } else {
+      const gitActionResult = await runCloseoutGitAction(pctx, unit);
+      if (gitActionResult === "dispatched") {
         return "dispatched";
       }
     }
 
-    // GitHub sync (non-blocking, opt-in)
-    await runSafely("postUnit", "github-sync", async () => {
-      const { runGitHubSync } = await import("../github-sync/sync.js");
-      await runGitHubSync(s.basePath, unit.type, unit.id);
-    });
-
     // Prune dead bg-shell processes
     await runSafely("postUnit", "prune-bg-shell", async () => {
       const { pruneDeadProcesses } = await import("../bg-shell/process-manager.js");
@@ -866,7 +889,7 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
       if (safetyConfig.enabled) {
         const { milestone: sMid, slice: sSid, task: sTid } = parseUnitId(s.currentUnit.id);
 
-        // File change validation (execute-task only, after auto-commit)
+        // File change validation (execute-task only, after unit execution)
         if (safetyConfig.file_change_validation && s.currentUnit.type === "execute-task" && sMid && sSid && sTid && isDbAvailable()) {
           try {
             const taskRow = getTask(sMid, sSid, sTid);
@@ -902,15 +925,42 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
             const bashCalls = actual.filter(e => e.kind === "bash");
             if (sMid && sSid && sTid && isDbAvailable()) {
               const taskRow = getTask(sMid, sSid, sTid);
-              const claimedCommands = getVerificationEvidence(sMid, sSid, sTid)
-                .map((row) => row.command)
-                .filter((command): command is string => typeof command === "string" && command.trim().length > 0);
-              if (taskRow?.status === "complete" && claimedCommands.length > 0 && bashCalls.length === 0) {
-                logWarning("safety", "task claimed verification command evidence but no execution tool calls were recorded");
-                ctx.ui.notify(
-                  `Safety: task ${sTid} claimed command evidence but no execution tool calls were recorded`,
-                  "warning",
-                );
+              if (taskRow?.status === "complete") {
+                const claimedEvidence: ClaimedEvidence[] = getVerificationEvidence(sMid, sSid, sTid)
+                  .map((row) => ({
+                    command: row.command,
+                    exitCode: row.exit_code,
+                    verdict: row.verdict,
+                  }))
+                  .filter((row) => typeof row.command === "string" && row.command.trim().length > 0);
+                const mismatches = crossReferenceEvidence(claimedEvidence, actual);
+
+                for (const mismatch of mismatches) {
+                  const logMessage = `evidence-xref: ${mismatch.reason}`;
+                  if (mismatch.severity === "error") {
+                    logError("safety", logMessage);
+                  } else {
+                    logWarning("safety", logMessage);
+                  }
+                }
+
+                if (claimedEvidence.length > 0 && bashCalls.length === 0) {
+                  logWarning("safety", "task claimed verification command evidence but no execution tool calls were recorded");
+                  ctx.ui.notify(
+                    `Safety: task ${sTid} claimed command evidence but no execution tool calls were recorded`,
+                    "warning",
+                  );
+                }
+
+                const blockingMismatch = mismatches.find((mismatch) => mismatch.severity === "error");
+                if (blockingMismatch) {
+                  ctx.ui.notify(
+                    `Safety: task ${sTid} claimed passing verification that failed in recorded execution`,
+                    "error",
+                  );
+                  await pauseAuto(ctx, pi);
+                  return "dispatched";
+                }
               }
             }
           } catch (e) {
@@ -1169,6 +1219,13 @@ export async function postUnitPostVerification(pctx: PostUnitContext): Promise<"
   const { s, ctx, pi, buildSnapshotOpts, lockBase, stopAuto, pauseAuto, updateProgressWidget } = pctx;
 
   if (s.currentUnit) {
+    if (shouldDeferCloseoutGitAction(s.currentUnit.type)) {
+      const gitActionResult = await runCloseoutGitAction(pctx, s.currentUnit);
+      if (gitActionResult === "dispatched") {
+        return "stopped";
+      }
+    }
+
     try {
       const codebasePrefs = loadEffectiveGSDPreferences()?.preferences?.codebase;
       const refresh = ensureCodebaseMapFresh(

package/src/resources/extensions/gsd/auto-prompts.ts

@@ -806,14 +806,22 @@ export async function inlineDecisionsFromDb(
   try {
     const { isDbAvailable } = await import("./gsd-db.js");
     if (isDbAvailable()) {
-      const { queryDecisions, formatDecisionsForPrompt } = await import("./context-store.js");
+      // ADR-013 Phase 6 cutover (Stage 1): read decisions from the `memories`
+      // table. Both `queryDecisions` (legacy) and `queryDecisionsFromMemories`
+      // return identical Decision[] for active rows once Phase 5 dual-write is
+      // caught up. Switching the read here lets the destructive Phase 6 step
+      // (#5755) retire the legacy `decisions` table without changing prompt
+      // contents. Projection regen (`DECISIONS.md`) still sources from the
+      // legacy table — that switch lands separately to handle superseded
+      // history cleanly.
+      const { queryDecisionsFromMemories, formatDecisionsForPrompt } = await import("./context-store.js");
 
       // First query: try with both milestoneId and scope (if scope provided)
-      let decisions = queryDecisions({ milestoneId, scope });
+      let decisions = queryDecisionsFromMemories({ milestoneId, scope });
 
       // Cascade: if empty AND scope was provided, retry without scope
       if (decisions.length === 0 && scope) {
-        decisions = queryDecisions({ milestoneId });
+        decisions = queryDecisionsFromMemories({ milestoneId });
       }
 
       if (decisions.length > 0) {
@@ -3189,7 +3197,7 @@ export async function buildParallelResearchSlicesPrompt(
     subagentSections.push([
       `### ${slice.id}: ${slice.title}`,
       "",
-      `Use this as the prompt for a \`subagent\` call${modelSuffix} (agent: \`gsd-executor\` or the default agent):`,
+      `Use this as the prompt for a \`subagent\` call${modelSuffix} (agent: \`scout\`):`,
       "",
       "```",
       slicePrompt,
@@ -3271,7 +3279,7 @@ export async function buildGateEvaluatePrompt(
     subagentSections.push([
       `### ${def.id}: ${def.question}`,
       "",
-      `Use this as the prompt for a \`subagent\` call${modelSuffix}:`,
+      `Use this as the prompt for a \`subagent\` call${modelSuffix} (agent: \`tester\`):`,
       "",
       "```",
       subPrompt,

package/src/resources/extensions/gsd/auto-verification.ts

@@ -40,6 +40,7 @@ import { join } from "node:path";
 import { resolveUokFlags } from "./uok/flags.js";
 import { UokGateRunner } from "./uok/gate-runner.js";
 import { verificationRetryKey } from "./auto/verification-retry-policy.js";
+import { decideVerificationVerdict } from "./verification-verdict.js";
 
 export interface VerificationContext {
   s: AutoSession;
@@ -49,12 +50,6 @@ export interface VerificationContext {
 
 export type VerificationResult = "continue" | "retry" | "pause";
 
-function isInfraVerificationFailure(stderr: string): boolean {
-  return /\b(ENOENT|ENOTFOUND|ETIMEDOUT|ECONNRESET|EAI_AGAIN|spawn\s+\S+\s+ENOENT|command not found)\b/i.test(
-    stderr,
-  );
-}
-
 /**
  * Post-unit guard for `validate-milestone` units (#4094).
  *
@@ -196,7 +191,7 @@ async function countIncompleteSlices(basePath: string, milestoneId: string): Pro
 /**
  * Run the verification gate for the current execute-task unit.
  * Returns:
- * - "continue" — gate passed (or no checks configured), proceed normally
+ * - "continue" — host-owned verification passed, proceed normally
  * - "retry" — gate failed with retries remaining, s.pendingVerificationRetry set for loop re-iteration
  * - "pause" — gate failed with retries exhausted, pauseAuto already called
  */
@@ -260,6 +255,11 @@ export async function runPostUnitVerification(
       }
     }
 
+    const verdict = decideVerificationVerdict(s.currentUnit.type, result);
+    if (!verdict.passed) {
+      result.passed = false;
+    }
+
     if (uokFlags.gates) {
       const gateRunner = new UokGateRunner();
       gateRunner.register({
@@ -272,10 +272,12 @@ export async function runPostUnitVerification(
             : "verification",
           rationale: result.passed
             ? "verification checks passed"
-            : "verification checks failed",
+            : verdict.reason === "no-host-checks"
+              ? "no runnable host-owned verification checks discovered"
+              : "verification checks failed",
           findings: result.passed
             ? ""
-            : formatFailureContext(result),
+            : verdict.failureContext || formatFailureContext(result),
         }),
       });
 
@@ -343,13 +345,18 @@ export async function runPostUnitVerification(
             writeVerificationJSON(result, tasksDir, tid, s.currentUnit.id);
           } else {
             const nextAttempt = attempt + 1;
+            const includeRetryMetadata =
+              !result.passed &&
+              verdict.retryable &&
+              autoFixEnabled &&
+              nextAttempt <= maxRetries;
             writeVerificationJSON(
               result,
               tasksDir,
               tid,
               s.currentUnit.id,
-              nextAttempt,
-              maxRetries,
+              includeRetryMetadata ? nextAttempt : undefined,
+              includeRetryMetadata ? maxRetries : undefined,
             );
           }
         }
@@ -358,26 +365,6 @@ export async function runPostUnitVerification(
       }
     }
 
-    const advisoryFailure =
-      !result.passed &&
-      (result.discoverySource === "package-json" ||
-        result.checks.some((check) =>
-          isInfraVerificationFailure(check.stderr),
-        ));
-
-    if (advisoryFailure) {
-      s.verificationRetryCount.delete(retryKey);
-      s.verificationRetryFailureHashes.delete(retryKey);
-      s.pendingVerificationRetry = null;
-      ctx.ui.notify(
-        result.discoverySource === "package-json"
-          ? "Verification failed in auto-discovered package.json checks — treating as advisory."
-          : "Verification failed due to infrastructure/runtime environment issues — treating as advisory.",
-        "warning",
-      );
-      return "continue";
-    }
-
     // ── Post-execution checks (run after main verification passes for execute-task units) ──
     let postExecChecks: PostExecutionCheckJSON[] | undefined;
     let postExecBlockingFailure = false;
@@ -572,6 +559,17 @@ export async function runPostUnitVerification(
       s.verificationRetryFailureHashes.delete(retryKey);
       s.pendingVerificationRetry = null;
       return "continue";
+    } else if (verdict.reason === "no-host-checks") {
+      s.verificationRetryCount.delete(retryKey);
+      s.verificationRetryFailureHashes.delete(retryKey);
+      s.pendingVerificationRetry = null;
+      ctx.ui.notify(
+        "Verification gate FAILED — no runnable host-owned verification checks were discovered. Pausing for human review.",
+        "error",
+      );
+      process.stderr.write(`verification-gate: ${verdict.failureContext}\n`);
+      await pauseAuto(ctx, pi);
+      return "pause";
     } else if (postExecBlockingFailure) {
       // Post-execution failures are cross-task consistency issues — retrying the same task won't fix them.
       // Skip retry and pause immediately for human review.
@@ -589,7 +587,7 @@ export async function runPostUnitVerification(
       s.verificationRetryCount.set(retryKey, nextAttempt);
       s.pendingVerificationRetry = {
         unitId: s.currentUnit.id,
-        failureContext: formatFailureContext(result),
+        failureContext: verdict.failureContext || formatFailureContext(result),
         attempt: nextAttempt,
       };
       const failedCmds = result.checks
@@ -623,9 +621,13 @@ export async function runPostUnitVerification(
       return "pause";
     }
   } catch (err) {
-    // Gate errors are non-fatal
     logWarning("engine", `verification-gate error: ${(err as Error).message}`);
-    return "continue";
+    ctx.ui.notify(
+      `Verification gate errored before producing an authoritative verdict: ${(err as Error).message}`,
+      "error",
+    );
+    await pauseAuto(ctx, pi);
+    return "pause";
   }
 }