code-coordinator 0.5.523__tar.gz → 0.5.525__tar.gz

{code_coordinator-0.5.523 → code_coordinator-0.5.525}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.523
+Version: 0.5.525
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.523 → code_coordinator-0.5.525}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.523
+Version: 0.5.525
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.523 → code_coordinator-0.5.525}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.523",
+  "tag": "0.5.525",
   "distance": 0,
-  "node": "geeb81f140eb64e517c8fde27adf71ba0186f28da",
+  "node": "g055bba5413e260e4e732234df5915c68b3c23459",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-09-27"

{code_coordinator-0.5.523 → code_coordinator-0.5.525}/coord/ci_fix.py

@@ -37,6 +37,7 @@ import logging
 
 import httpx
 
+from coord import github_ops
 from coord.ci_store import CIFailureDetail
 from coord.config import Config
 from coord.merge_queue import QueuedMerge, _chain_work_ids
@@ -144,12 +145,87 @@ def _format_ci_failure_detail(detail: CIFailureDetail) -> list[str]:
     return lines
 
 
+# #3456: cap on the issue body threaded into a ci-fix briefing. Large
+# enough that a typical issue description plus an operator's follow-up
+# diagnosis both fit without truncation in the common case — only a
+# genuinely long body (or a long back-and-forth of appended notes) hits
+# the cap at all.
+ISSUE_BODY_MAX_CHARS = 6000
+
+
+def _bound_issue_body(body: str) -> tuple[str, bool]:
+    """Truncate *body* to the last :data:`ISSUE_BODY_MAX_CHARS` characters
+    when it exceeds that cap (#3456).
+
+    Keeps the TAIL, not the head: an operator's diagnosis on a CI-fix
+    streak is written INTO the issue body after the failure is understood
+    — i.e. appended below the original description (see the issue's own
+    evidence: "After the root cause was written into the issue body,
+    requeueing would have routed the next attempt through the same ci-fix
+    path"). Keeping the tail is what makes sure that operator-added
+    content survives a cut; the cost is that the original description
+    (often already echoed by the issue title anyway) is what gets dropped
+    for a body long enough to need cutting at all.
+
+    Returns ``(text, truncated)`` — mirrors
+    :func:`coord.ci_github._bound_log_excerpt`'s contract: *truncated* is
+    ``True`` iff the cut actually removed content, so the caller can make
+    the cut visible in the briefing text rather than silently handing over
+    a partial body.
+    """
+    if len(body) <= ISSUE_BODY_MAX_CHARS:
+        return body, False
+    return body[-ISSUE_BODY_MAX_CHARS:], True
+
+
+def _format_issue_body(issue_body: str) -> list[str]:
+    """Render *issue_body* into briefing lines (#3456) — see
+    :func:`_bound_issue_body` for the truncation contract.
+    """
+    body, truncated = _bound_issue_body(issue_body)
+    lines: list[str] = ["## Issue body", ""]
+    if truncated:
+        lines.append(
+            f"(truncated to the last {ISSUE_BODY_MAX_CHARS} characters — "
+            "operator notes are typically appended below the original "
+            "description, so keeping the tail keeps those over the part "
+            "already echoed by the issue title)"
+        )
+        lines.append("")
+    lines.append(body)
+    lines.append("")
+    return lines
+
+
+def _fetch_issue_body(entry: QueuedMerge) -> str:
+    """Best-effort fetch of *entry*'s issue body for the ci-fix briefing
+    (#3456) — the same body a Work-stage dispatch already auto-includes
+    (``coord.commands.dispatch``'s auto-briefing, ``coord.commands.
+    dispatch_workers``' smoke briefing) but a ci-fix dispatch never did:
+    any diagnosis an operator records on the issue (e.g. after reading the
+    real CI logs by hand) was invisible to the worker most likely to need
+    it, since workers can't run ``gh`` themselves to read it any other way.
+
+    Fails soft to ``""`` on any read failure (``gh`` missing, rate-limited,
+    a network blip, a malformed response) — same posture as
+    :func:`coord.ci_github.build_ci_failure_detail`: this is enrichment,
+    never a dispatch precondition, and a body fetch failure must never
+    block or delay the actual fix dispatch.
+    """
+    try:
+        issue_data = github_ops.get_issue(entry.repo_github, entry.issue_number)
+    except Exception:  # noqa: BLE001 — best-effort, see docstring
+        return ""
+    return str(issue_data.get("body") or "")
+
+
 def build_ci_fix_briefing(
     *,
     entry: QueuedMerge,
     checks_summary: str,
     attempt: int,
     detail: CIFailureDetail | None = None,
+    issue_body: str | None = None,
 ) -> str:
     """Assemble the CI-fix worker's briefing. Pure function — testable.
 
@@ -159,6 +235,11 @@ def build_ci_fix_briefing(
     empty of anything beyond the check name (see :func:`_detail_has_content`),
     the briefing is byte-identical to before #3114, still carrying
     ``checks_summary``.
+
+    *issue_body* (#3456) is the issue's current body, fetched by
+    :func:`_fetch_issue_body` at dispatch time — optional and additive,
+    same shape as *detail*: ``None`` or blank leaves the briefing
+    byte-identical to before #3456.
     """
     lines: list[str] = [
         f"# CI failure fix: {entry.repo_github} branch `{entry.branch}`",
@@ -172,6 +253,8 @@ def build_ci_fix_briefing(
         f"    {checks_summary}",
         "",
     ]
+    if issue_body is not None and issue_body.strip():
+        lines.extend(_format_issue_body(issue_body))
     if detail is not None and _detail_has_content(detail):
         lines.extend(_format_ci_failure_detail(detail))
     lines += [
@@ -353,9 +436,10 @@ def dispatch_ci_fix(
         return None
 
     summary = checks_summary or entry.error or "CI checks failed"
+    issue_body = _fetch_issue_body(entry)
     briefing = build_ci_fix_briefing(
         entry=entry, checks_summary=summary, attempt=entry.ci_fix_dispatches + 1,
-        detail=detail,
+        detail=detail, issue_body=issue_body,
     )
 
     from coord.auto_loop import _dispatch_fix  # noqa: PLC0415

{code_coordinator-0.5.523 → code_coordinator-0.5.525}/coord/ci_github.py

@@ -120,19 +120,50 @@ _RUST_ERROR_RE = re.compile(r"\berror(\[E\d+\])?:")
 _RUST_LOCATION_RE = re.compile(r"-->")
 _RUST_WARNING_RE = re.compile(r"\bwarning:")
 
+# #3456: GitHub Actions appends this EXACT line to every failing step's log,
+# regardless of what actually failed — it is the annotation `_ERROR_
+# ANNOTATION_RE` would otherwise happily match as tier-1 signal, and on a
+# job whose real failure produces no OTHER `##[error]` line (e.g. a `cargo
+# test` failure — rustc's own test-harness panic output carries no `##[
+# error]` prefix at all), this generic wrapper line was the ONLY thing
+# selected: "exit code 1", not the failing test. Excluded from the
+# `annotation` tier entirely so the more specific `rust_test_failure` tier
+# below (or, failing that, `no_diagnostics_matched`) wins instead.
+_EXIT_CODE_ANNOTATION_RE = re.compile(r"##\[error\]Process completed with exit code \d+\.?\s*$")
+
+# #3456: a rust test-harness failure never carries a `##[error]` prefix, so
+# none of it was reachable by any tier before this — the harness prints a
+# per-test `---- <test path> stdout ----` header immediately followed by the
+# `panicked at ...` message, then (once every test has run) a `failures:`
+# roll-up naming every failing test, then a final `test result: FAILED. ...`
+# summary line. All four are treated as one priority tier: whichever of
+# them shows up is unambiguously more useful than the generic exit-code
+# annotation above.
+_RUST_TEST_STDOUT_HEADER_RE = re.compile(r"^-+\s.*\sstdout\s-+\s*$")
+_RUST_PANICKED_RE = re.compile(r"panicked at")
+_RUST_TEST_RESULT_RE = re.compile(r"\btest result: FAILED\b")
+_RUST_FAILURES_HEADER_RE = re.compile(r"^failures:\s*$")
+
 # How many lines past a matched rust-diagnostic line to look for its `-->`
 # location before giving up — rustc always emits it on the very next
 # non-blank line; a small window tolerates the odd blank line without
 # accidentally stealing a `-->` that belongs to a LATER diagnostic.
 _RUST_LOCATION_LOOKAHEAD = 4
 
+# How many lines past a `---- <test> stdout ----` header to sweep into the
+# same unit — enough to capture the `thread '...' panicked at ...:LINE:COL:`
+# line plus a short assertion message, without running so far that a SECOND
+# test's header (or unrelated harness noise) gets swept in too.
+_RUST_TEST_FAILURE_LOOKAHEAD = 6
+
 
 def _select_diagnostic_units(lines: list[str]) -> tuple[
-    list[list[str]], list[list[str]], list[list[str]]
+    list[list[str]], list[list[str]], list[list[str]], list[list[str]]
 ]:
-    """Classify *lines* into (annotation, rust_diagnostic, warning) unit
-    lists, each unit a small list of original line strings kept atomic so
-    budget truncation never splits an `error:`/`-->` pair apart (#3245).
+    """Classify *lines* into (annotation, rust_test_failure, rust_diagnostic,
+    warning) unit lists, each unit a small list of original line strings
+    kept atomic so budget truncation never splits an `error:`/`-->` pair —
+    or a rust test panic header/message pair — apart (#3245, #3456).
 
     Each source line is claimed by at most one bucket, checked in priority
     order, so a line matching a higher-priority pattern is never
@@ -142,10 +173,47 @@ def _select_diagnostic_units(lines: list[str]) -> tuple[
 
     annotation: list[list[str]] = []
     for i, line in enumerate(lines):
+        # #3456: the generic "step failed" wrapper line is deliberately
+        # never claimed here (see `_EXIT_CODE_ANNOTATION_RE`'s comment) —
+        # left unclaimed (not even added to `claimed`) since nothing else
+        # matches it anyway.
+        if _EXIT_CODE_ANNOTATION_RE.search(line):
+            continue
         if _ERROR_ANNOTATION_RE.search(line):
             annotation.append([line])
             claimed.add(i)
 
+    # #3456: rust test-harness failures — a stdout header sweeps in the
+    # panic message that follows it; a bare `panicked at`/`test result:
+    # FAILED`/`failures:` line (no preceding header, e.g. a `cargo run`
+    # panic outside the test harness) stands alone as its own unit.
+    rust_test_failure: list[list[str]] = []
+    for i, line in enumerate(lines):
+        if i in claimed:
+            continue
+        if _RUST_TEST_STDOUT_HEADER_RE.match(line.strip()):
+            claimed.add(i)
+            unit = [line]
+            end = min(i + 1 + _RUST_TEST_FAILURE_LOOKAHEAD, len(lines))
+            for j in range(i + 1, end):
+                if j in claimed:
+                    break
+                candidate = lines[j]
+                if not candidate.strip() or _RUST_TEST_STDOUT_HEADER_RE.match(candidate.strip()):
+                    # Blank line or the next test's header — stop before
+                    # sweeping in unrelated content.
+                    break
+                unit.append(candidate)
+                claimed.add(j)
+            rust_test_failure.append(unit)
+        elif (
+            _RUST_PANICKED_RE.search(line)
+            or _RUST_TEST_RESULT_RE.search(line)
+            or _RUST_FAILURES_HEADER_RE.match(line.strip())
+        ):
+            claimed.add(i)
+            rust_test_failure.append([line])
+
     rust_diag: list[list[str]] = []
     for i, line in enumerate(lines):
         if i in claimed or not _RUST_ERROR_RE.search(line):
@@ -173,7 +241,7 @@ def _select_diagnostic_units(lines: list[str]) -> tuple[
         claimed.add(i)
         warning.append([line])
 
-    return annotation, rust_diag, warning
+    return annotation, rust_test_failure, rust_diag, warning
 
 
 def _extract_relevant_log_lines(text: str) -> tuple[str, bool, bool]:
@@ -189,30 +257,42 @@ def _extract_relevant_log_lines(text: str) -> tuple[str, bool, bool]:
     Extraction is by relevance, in priority order, matching the issue's fix
     shape:
 
-    1. ``##[error]`` GitHub Actions annotation lines
-    2. Rust diagnostics — ``error[E....]:``/``error:`` paired with the
-       ``-->`` file:line that follows
-    3. ``warning:`` lines, only if budget remains after 1-2
+    1. ``##[error]`` GitHub Actions annotation lines — EXCEPT the generic
+       ``Process completed with exit code N.`` wrapper GitHub Actions
+       appends to every failing step regardless of cause (#3456): it
+       carries zero diagnostic value, and on a job whose real failure
+       never emits any OTHER ``##[error]`` line (a rust test panic, say),
+       it used to be the ONLY thing this function ever surfaced.
+    2. Rust test-harness failures (#3456) — a ``---- <test> stdout ----``
+       header (with the ``panicked at ...`` message that follows it), a
+       bare ``panicked at`` line, a ``failures:`` roll-up, or the final
+       ``test result: FAILED`` summary line
+    3. Rust compiler diagnostics — ``error[E....]:``/``error:`` paired with
+       the ``-->`` file:line that follows
+    4. ``warning:`` lines, only if budget remains after 1-3
 
     Everything else — including the runner's own echo of a script step's
-    source and post-job cleanup — is never a candidate, because it can
-    only ever match one of these patterns by (extremely unlikely)
-    coincidence.
+    source and post-job cleanup, and the excluded exit-code wrapper line —
+    is never a candidate, because it can only ever match one of these
+    patterns by (extremely unlikely) coincidence.
 
     Returns ``(excerpt, truncated, matched)``:
 
     - *matched* is ``False`` when nothing in any tier matched anywhere in
       *text* — the caller renders an explicit "no diagnostics" note rather
-      than a misleadingly-empty excerpt.
+      than a misleadingly-empty excerpt. Note this can now be ``False`` for
+      a log whose ONLY `##[error]` line was the excluded exit-code wrapper —
+      correctly so, since that line alone told the caller nothing a
+      "no diagnostics matched" note doesn't already convey just as well.
     - *truncated* is ``True`` when the matched units together exceed
       :data:`CI_FIX_LOG_MAX_LINES`/:data:`CI_FIX_LOG_MAX_BYTES` and lower-
-      priority units (warnings first, then any tier-1/2 overflow) had to be
-      dropped to fit — same "make the cut visible" contract as
+      priority units (warnings first, then any earlier-tier overflow) had
+      to be dropped to fit — same "make the cut visible" contract as
       :func:`_bound_log_excerpt`.
     """
     lines = text.splitlines()
-    annotation, rust_diag, warning = _select_diagnostic_units(lines)
-    units = annotation + rust_diag + warning
+    annotation, rust_test_failure, rust_diag, warning = _select_diagnostic_units(lines)
+    units = annotation + rust_test_failure + rust_diag + warning
     if not units:
         return "", False, False
 

{code_coordinator-0.5.523 → code_coordinator-0.5.525}/coord/config.py

@@ -307,12 +307,34 @@ class SmokeTestsConfig:
     `default_command` is the shell command the smoke agent runs (e.g.
     `make smoke` or `pytest tests/smoke`). Per-repo overrides flow through
     `Repo.test_command` already; this is the fallback when none is set.
+
+    `native_execution_capabilities` (#3455) lists which bare capabilities
+    (e.g. `"windows"`) merely mean "some machine can build/cross-compile
+    for this" and do NOT by themselves prove a Test leg runs on that OS
+    natively. `dell64` declared `windows` while its coord agent ran inside
+    WSL (Linux); a #[cfg(target_os = "windows")] test compiled out and the
+    Test stage reported `pass` for a failure GitHub's `windows-latest`
+    runner caught every time (quadraui#1077). A machine must ALSO declare
+    `coord.config.native_execution_capability(cap)` (e.g. `windows-native`)
+    to certify it runs *that* capability's suite natively — see
+    `coord.smoke.unverified_native_capabilities`, consulted at THREE points
+    so the gap can't be closed by prompt-cooperation alone: routing
+    (`coord.smoke.rank_smoke_machines` prefers a native-verified candidate
+    over a bare one when both exist), dispatch (the briefing tells the
+    worker to caveat its own marker), and verdict-recording
+    (`coord.notify._record_smoke_verdict`'s PASS branches independently
+    recompute this and record `test_confirmation="native_unverified"`
+    regardless of what the worker's marker text says). Defaults to
+    `["windows"]`, the one capability the incident this exists for actually
+    involved; add more here (e.g. a future `"macos"` cross-build path)
+    without any code change.
     """
 
     auto_queue: bool = False
     default_command: str | None = None
     timeout_seconds: int = 600
     capability_rules: list[SmokeRule] = field(default_factory=list)
+    native_execution_capabilities: list[str] = field(default_factory=lambda: ["windows"])
 
 
 @dataclass
@@ -1904,6 +1926,25 @@ def provider_capability(provider_type: str) -> str:
     return f"provider:{provider_type}"
 
 
+def native_execution_capability(capability: str) -> str:
+    """The ``capabilities:`` string a machine must ALSO declare, alongside
+    *capability* itself, to certify it runs *capability*'s tests on a
+    genuinely native host rather than merely building/cross-compiling for
+    it (#3455).
+
+    ``native_execution_capability("windows") == "windows-native"``. Same
+    config-only-declaration shape as :func:`provider_capability` — a
+    machine that lists ``windows`` in ``capabilities:`` can build for
+    Windows (a WSL/Linux agent satisfies that today), but only one that
+    ALSO lists ``windows-native`` has told the coordinator its Test-stage
+    runs actually execute there. Single source of truth for the naming
+    convention: `coord.smoke.unverified_native_capabilities` is the only
+    caller, so the two can never disagree about the string (#2096, "one
+    question, one answer").
+    """
+    return f"{capability}-native"
+
+
 def model_plausible_for_provider_type(model: str, provider_type: str) -> bool:
     """Namespace-shape sanity check: could *model* plausibly belong to
     *provider_type* (#1798)?
@@ -3498,6 +3539,14 @@ def _parse_smoke_tests(raw: Any) -> SmokeTestsConfig:
             raise ConfigError("smoke_tests.timeout_seconds must be a positive integer")
         cfg.timeout_seconds = value
 
+    if "native_execution_capabilities" in raw:
+        value = raw["native_execution_capabilities"]
+        if not isinstance(value, list) or not all(isinstance(c, str) for c in value):
+            raise ConfigError(
+                "smoke_tests.native_execution_capabilities must be a list of strings"
+            )
+        cfg.native_execution_capabilities = value
+
     rules_raw = raw.get("capability_rules", []) or []
     if not isinstance(rules_raw, list):
         raise ConfigError("smoke_tests.capability_rules must be a list")

{code_coordinator-0.5.523 → code_coordinator-0.5.525}/coord/confirm_test.py

@@ -314,8 +314,21 @@ INCONCLUSIVE_KINDS = frozenset({
 # * ``TEST_CONFIRMATION_BASELINE_RED`` — `ConfirmationResult.baseline_red`
 #   (#2170): the suite failed identically on the merge-base, so nothing was
 #   learned about the BRANCH specifically, but a real run did happen.
+# * ``TEST_CONFIRMATION_NATIVE_UNVERIFIED`` (#3455) — the claimed pass ran on
+#   a machine that declares only the bare/build side of a capability this
+#   leg required (`coord.smoke.SmokeTestsConfig.native_execution_
+#   capabilities`, e.g. `"windows"`), not the paired `coord.config.
+#   native_execution_capability` proof it runs that suite on genuinely native
+#   hardware — a WSL-hosted `windows` machine being the canonical case
+#   (`dell64` / quadraui#1077). Distinct from `UNCONFIRMED`: a confirmation
+#   run may well have executed and even agreed with the claim, but "agreed"
+#   here still means "on a non-native host", so platform-conditional code the
+#   real target OS would exercise never ran anywhere in this leg. Recorded
+#   by `coord.notify._record_smoke_verdict`'s PASS branches regardless of
+#   what the worker's own `SMOKE:` marker text says — see `coord.smoke.
+#   native_unverified_for_verdict`.
 #
-# ``None`` (the column default) is a fifth, implicit state: no confirmation
+# ``None`` (the column default) is a sixth, implicit state: no confirmation
 # question was ever asked about this write at all — a headless smoke
 # FAILURE, a human `coord test --passed` write that has not yet been reaped
 # by a notify pass, a mute-leg park, ``TEST_STATE_BLOCKED``, ... None of
@@ -326,6 +339,7 @@ TEST_CONFIRMATION_CONFIRMED = "confirmed"
 TEST_CONFIRMATION_UNCONFIRMED = "unconfirmed"
 TEST_CONFIRMATION_REFUTED = "refuted"
 TEST_CONFIRMATION_BASELINE_RED = "baseline_red"
+TEST_CONFIRMATION_NATIVE_UNVERIFIED = "native_unverified"
 
 #: Every value `test_confirmation` may hold — for validation / display sites
 #: that want to assert exhaustiveness rather than silently falling through.
@@ -334,6 +348,7 @@ TEST_CONFIRMATION_VALUES = frozenset({
     TEST_CONFIRMATION_UNCONFIRMED,
     TEST_CONFIRMATION_REFUTED,
     TEST_CONFIRMATION_BASELINE_RED,
+    TEST_CONFIRMATION_NATIVE_UNVERIFIED,
 })
 
 #: #3378: the canonical prefix a ``test_reason`` carries when a ``skipped``
@@ -1464,6 +1479,7 @@ __all__ = [
     "STALE_WORKTREE_MAX_AGE_HOURS",
     "TEST_CONFIRMATION_BASELINE_RED",
     "TEST_CONFIRMATION_CONFIRMED",
+    "TEST_CONFIRMATION_NATIVE_UNVERIFIED",
     "TEST_CONFIRMATION_REFUTED",
     "TEST_CONFIRMATION_UNCONFIRMED",
     "TEST_CONFIRMATION_VALUES",

{code_coordinator-0.5.523 → code_coordinator-0.5.525}/coord/gates.py

@@ -47,6 +47,7 @@ from typing import TYPE_CHECKING
 
 from coord.confirm_test import (
     TEST_CONFIRMATION_BASELINE_RED,
+    TEST_CONFIRMATION_NATIVE_UNVERIFIED,
     TEST_CONFIRMATION_UNCONFIRMED,
 )
 from coord.models import WORK_LIKE_TYPES, effective_issue_number
@@ -1065,6 +1066,13 @@ def format_gate_report(report: GateReport) -> str:
                     suffix = " (UNCONFIRMED — suite never ran)"
                 elif confirmation == TEST_CONFIRMATION_BASELINE_RED:
                     suffix = " (baseline-red — branch not at fault, #2170)"
+                elif confirmation == TEST_CONFIRMATION_NATIVE_UNVERIFIED:
+                    # #3455: this leg ran on a machine that declares only the
+                    # bare/build side of a required capability (e.g. a
+                    # WSL-hosted `windows` machine) — a plain "passed" here
+                    # would read exactly like a genuinely native-hardware
+                    # green, which this is not.
+                    suffix = " (NOT NATIVELY VERIFIED — #3455)"
                 lines.append(
                     "  test   : passed"
                     + (f" (recorded on {test.assignment_id})" if test.assignment_id else "")

{code_coordinator-0.5.523 → code_coordinator-0.5.525}/coord/notify.py

@@ -2358,12 +2358,114 @@ def _run_pass_confirmation(transition: Transition, entry: dict):
             record_inconclusive_confirmation(transition.repo_name, result.kind)
 
 
-def _confirmed_pass_verdict(
+def _native_unverified_capabilities(transition: Transition, entry: dict) -> list[str]:
+    """#3455: which of this smoke leg's required capabilities the machine
+    that ran it declares only the bare/build side of, not the paired
+    native-execution proof — recomputed HERE, independently of whatever the
+    worker's own ``SMOKE:`` marker text says, so a claimed pass can be
+    downgraded even when the worker never prints the caveat
+    `coord.smoke.build_smoke_briefing` asks for (a purely advisory,
+    worker-cooperation-dependent fix would leave that gap wide open — see
+    the #3455 review).
+
+    Best-effort and fail-open, matching every other diagnostic in this
+    module (`_run_pass_confirmation` et al.): a config load failure, an
+    unknown repo/machine, or a PR/diff lookup failure returns ``[]`` — this
+    must never turn "couldn't tell" into a false downgrade, and must never
+    abandon the caller's verdict-recording transition over a network blip.
+    """
+    from coord.config import load as _load_config  # noqa: PLC0415
+    from coord.smoke import (  # noqa: PLC0415
+        _fetch_touched_files,
+        native_unverified_for_verdict,
+    )
+
+    try:
+        config = _load_config()
+    except Exception as exc:  # noqa: BLE001
+        log.debug(
+            "smoke %s: could not load config for the #3455 native-"
+            "verification check (%s) — skipping it.",
+            transition.assignment_id, exc,
+        )
+        return []
+
+    repo = config.repo(transition.repo_name)
+    machine = next(
+        (m for m in config.machines if m.name == transition.machine_name), None
+    )
+    if repo is None or machine is None:
+        return []
+
+    branch = entry.get("branch")
+    if not branch:
+        return []
+
+    try:
+        touched_files = _fetch_touched_files(repo.github, branch)
+    except Exception as exc:  # noqa: BLE001
+        log.debug(
+            "smoke %s: could not fetch touched files for the #3455 native-"
+            "verification check (%s) — skipping it.",
+            transition.assignment_id, exc,
+        )
+        return []
+
+    return native_unverified_for_verdict(
+        repo=repo, machine=machine, smoke_cfg=config.smoke_tests,
+        touched_files=touched_files,
+    )
+
+
+def _downgrade_for_native_unverified(
+    state: str,
+    reason: str,
+    confirmation: str,
+    native_unverified: list[str] | None,
+) -> tuple[str, str, str]:
+    """#3455: a claimed pass on a leg whose machine declares only the bare
+    (build/cross-compile) side of a required capability — never the paired
+    native-execution proof (`coord.smoke.native_unverified_for_verdict`) —
+    must not read as a plain confirmed/unconfirmed pass. This is what
+    actually closes the loop the #3455 review found open: it fires
+    regardless of what the worker's own ``SMOKE:`` marker text says, so a
+    worker that never prints the caveat `coord.smoke.build_smoke_briefing`
+    asks for still gets a genuinely distinct, machine-readable
+    ``test_confirmation`` on the row.
+
+    Only applies to a ``state == "passed"`` result — a real ``failed``,
+    the #2579 ``TEST_STATE_CONTESTED``, or a ``baseline_red`` skip already
+    carry more urgent, more specific information and must never be
+    overwritten by this.
+    """
+    if state != "passed" or not native_unverified:
+        return state, reason, confirmation
+    from coord.confirm_test import (  # noqa: PLC0415
+        TEST_CONFIRMATION_NATIVE_UNVERIFIED,
+    )
+
+    caps = ", ".join(native_unverified)
+    return (
+        state,
+        f"{reason} — NOT NATIVELY VERIFIED for {caps} (#3455): this leg ran "
+        "on a machine that declares the bare capability but not native "
+        "execution for it, so a platform-conditional failure specific to "
+        f"real {caps} hardware would not have shown up here.",
+        TEST_CONFIRMATION_NATIVE_UNVERIFIED,
+    )
+
+
+def _confirmed_pass_verdict_core(
     transition: Transition, entry: dict, parent_id: str, *, claim_reason: str,
 ) -> tuple[str, str, str]:
     """#2464: the ``(test_state, test_reason, test_confirmation)`` to record
     for a *claimed* pass.
 
+    Callers should use the public :func:`_confirmed_pass_verdict` wrapper,
+    not this directly — it additionally applies the #3455 native-
+    verification downgrade (:func:`_downgrade_for_native_unverified`) this
+    core function knows nothing about.
+
     The Test stage's pass claim — whether it arrived as a ``SMOKE: pass``
     marker or as the worker calling ``coord test --passed`` on itself (#2217) —
     is a self-report by the thing being graded. This turns it into an
@@ -2544,6 +2646,38 @@ def _confirmed_pass_verdict(
     )
 
 
+def _confirmed_pass_verdict(
+    transition: Transition,
+    entry: dict,
+    parent_id: str,
+    *,
+    claim_reason: str,
+    native_unverified: list[str] | None = None,
+) -> tuple[str, str, str]:
+    """#2464/#3455: the ``(test_state, test_reason, test_confirmation)`` to
+    record for a *claimed* pass — :func:`_confirmed_pass_verdict_core`'s
+    out-of-band confirmation, with the #3455 native-verification downgrade
+    (:func:`_downgrade_for_native_unverified`) applied on top.
+
+    *native_unverified* — non-empty means this leg's machine declares only
+    the bare/build side of one or more of its required capabilities, not
+    the paired native-execution proof (`coord.smoke.native_unverified_for_
+    verdict`). This downgrade is unconditional on the worker's own
+    ``SMOKE:`` marker text: it fires purely from the machine/capability
+    facts, so a claimed pass this leg cannot actually back with native
+    hardware never records as a plain ``confirmed``/``unconfirmed`` pass —
+    see the #3455 review that made this the mandatory second half of the
+    fix (the briefing-text caveat alone changes nothing this repo's own
+    gates/merge-queue code ever reads back).
+    """
+    state, reason, confirmation = _confirmed_pass_verdict_core(
+        transition, entry, parent_id, claim_reason=claim_reason,
+    )
+    return _downgrade_for_native_unverified(
+        state, reason, confirmation, native_unverified,
+    )
+
+
 def _mechanical_mute_verdict(
     transition: Transition, entry: dict, parent_id: str,
 ) -> tuple[str, str, str] | None:
@@ -2725,6 +2859,7 @@ def _record_smoke_verdict(
             state, reason, confirmation = _confirmed_pass_verdict(
                 transition, entry, parent_id,
                 claim_reason="worker self-recorded via `coord test` (#2217)",
+                native_unverified=_native_unverified_capabilities(transition, entry),
             )
             record_test_verdict(
                 assignment_id=parent_id,
@@ -2814,6 +2949,7 @@ def _record_smoke_verdict(
         state, reason, confirmation = _confirmed_pass_verdict(
             transition, entry, parent_id,
             claim_reason="headless smoke reported SMOKE: pass",
+            native_unverified=_native_unverified_capabilities(transition, entry),
         )
         record_test_verdict(
             assignment_id=parent_id,
@@ -2842,7 +2978,9 @@ def _record_smoke_verdict(
     # away, with no leg spent and no tally incremented.
     mechanical = _mechanical_mute_verdict(transition, entry, parent_id)
     if mechanical is not None:
-        state, reason, confirmation = mechanical
+        state, reason, confirmation = _downgrade_for_native_unverified(
+            *mechanical, _native_unverified_capabilities(transition, entry),
+        )
         record_test_verdict(
             assignment_id=parent_id,
             test_state=state,