code-mower 0.5.0b43__tar.gz → 0.5.0b44__tar.gz

{code_mower-0.5.0b43 → code_mower-0.5.0b44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.5.0b43
+Version: 0.5.0b44
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -103,11 +103,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b43
+pipx install --python python3.12 code-mower==0.5.0b44
 code-mower --version
 ```
 
-`0.5.0b43` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b44` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -155,7 +155,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b43`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b44`.
 
 ## Optional: Plan Before Coding
 
@@ -310,9 +310,9 @@ builder provenance, start with
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.43` from
+The current public beta is `v0.5.0-beta.44` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b43` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b44` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b43 → code_mower-0.5.0b44}/README.md

@@ -88,11 +88,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b43
+pipx install --python python3.12 code-mower==0.5.0b44
 code-mower --version
 ```
 
-`0.5.0b43` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b44` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -140,7 +140,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b43`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b44`.
 
 ## Optional: Plan Before Coding
 
@@ -295,9 +295,9 @@ builder provenance, start with
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.43` from
+The current public beta is `v0.5.0-beta.44` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b43` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b44` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b43 → code_mower-0.5.0b44}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "0.5.0b43"
+version = "0.5.0b44"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.11"
 readme = "README.md"

{code_mower-0.5.0b43 → code_mower-0.5.0b44}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "0.5.0b43"
+__version__ = "0.5.0b44"

{code_mower-0.5.0b43 → code_mower-0.5.0b44}/src/code_mower/calibration/auto_discovery.py

@@ -12,6 +12,7 @@ from typing import Any, Mapping, Sequence
 from .corpus import parse_int
 from .identity import safe_slug
 from .run_status import RUN_STATUS_BLOCKED, RUN_STATUS_PASS, RUN_STATUS_UNKNOWN
+from ..provider_runners import is_fixture_verdict_comment
 
 AUTO_DISCOVERY_SCHEMA = "code_mower.calibrationAutoDiscover.v1"
 TRUTH_EXPECTATION_UNKNOWN = "unknown"
@@ -147,6 +148,8 @@ def _audit_runs_from_comments(comments: Sequence[Any]) -> list[dict[str, Any]]:
         body = str(comment.get("body") or "")
         if not body:
             continue
+        if is_fixture_verdict_comment(body):
+            continue
         for match in AUDIT_STATE_RE.finditer(body):
             state = match.group("state")
             reviewer = _provider_from_audit_state(match.group("provider"), state)

{code_mower-0.5.0b43 → code_mower-0.5.0b44}/src/code_mower/claude_audit_pr.py

@@ -32,11 +32,13 @@ if __package__ in {None, "", "tools"}:
         from tools.audit_progress import AuditProgress, run_subprocess_with_progress
         from tools.claude_cli_environment import clean_claude_cli_env, env_flag
         from tools.provider_runners import (
+            audit_runtime_quarantine_reason as _audit_runtime_quarantine_reason,
             clip_text as _clip_text,
             fetch_pull_request,
             fetch_base_ref_sha as _shared_fetch_base_ref_sha,
             fetch_pr_head_sha as _shared_fetch_pr_head_sha,
             fetch_pr_head_sha_unless_local_matches as _shared_fetch_pr_head_sha_unless_local_matches,
+            is_fixture_structured_verdict as _is_fixture_structured_verdict,
             limit_comment_body,
             one_line as _one_line,
             parse_repo_paths as _parse_repo_paths,
@@ -58,11 +60,13 @@ if __package__ in {None, "", "tools"}:
         from audit_progress import AuditProgress, run_subprocess_with_progress  # type: ignore
         from claude_cli_environment import clean_claude_cli_env, env_flag  # type: ignore
         from provider_runners import (  # type: ignore
+            audit_runtime_quarantine_reason as _audit_runtime_quarantine_reason,
             clip_text as _clip_text,
             fetch_pull_request,
             fetch_base_ref_sha as _shared_fetch_base_ref_sha,
             fetch_pr_head_sha as _shared_fetch_pr_head_sha,
             fetch_pr_head_sha_unless_local_matches as _shared_fetch_pr_head_sha_unless_local_matches,
+            is_fixture_structured_verdict as _is_fixture_structured_verdict,
             limit_comment_body,
             one_line as _one_line,
             parse_repo_paths as _parse_repo_paths,
@@ -82,11 +86,13 @@ else:  # pragma: no cover - exercised after package extraction.
     from .claude_cli_environment import clean_claude_cli_env, env_flag
     from .provider_runners import (
         FetchedHeadMismatch,
+        audit_runtime_quarantine_reason as _audit_runtime_quarantine_reason,
         clip_text as _clip_text,
         fetch_base_ref_sha as _shared_fetch_base_ref_sha,
         fetch_pull_request,
         fetch_pr_head_sha as _shared_fetch_pr_head_sha,
         fetch_pr_head_sha_unless_local_matches as _shared_fetch_pr_head_sha_unless_local_matches,
+        is_fixture_structured_verdict as _is_fixture_structured_verdict,
         limit_comment_body,
         one_line as _one_line,
         parse_repo_paths as _parse_repo_paths,
@@ -445,6 +451,29 @@ def _apply_claude_verdict_guardrails(
     return _unknown_structured_verdict(reason), reason
 
 
+def _fixture_structured_quarantine_reason(parsed: ClaudeVerdict) -> Optional[str]:
+    if _is_fixture_structured_verdict(parsed.summary, list(parsed.findings)):
+        return "fixture-shaped structured verdict rejected by guardrail"
+    return None
+
+
+def _quarantine_is_test_only(reason: Optional[str]) -> bool:
+    return reason == "PYTEST_CURRENT_TEST is set"
+
+
+def _comment_with_runtime_quarantine_note(comment_body: str, reason: str) -> str:
+    note = (
+        "\nRuntime quarantine: local verdict artifact was quarantined because "
+        f"{reason}. Posting UNKNOWN so the lane requeues visibly.\n"
+    )
+    marker = f"\n\n{STALE_TRAILER}"
+    if marker in comment_body:
+        body = comment_body.replace(marker, note + "\n" + STALE_TRAILER, 1)
+    else:
+        body = comment_body.rstrip() + note + "\n" + STALE_TRAILER + "\n"
+    return limit_comment_body(body, STALE_TRAILER, provider_name="Claude")
+
+
 def _write_claude_raw_output_sidecar(
     artifact_path: Optional[Path],
     attempts: List[Dict[str, Any]],
@@ -996,6 +1025,9 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
             parsed=parsed,
         )
         if not config.dry_run:
+            quarantine_reason = _audit_runtime_quarantine_reason(
+                comment_body=comment_body,
+            )
             artifact_path = write_audit_verdict_artifact(
                 lane_id="claude-audit",
                 repo=repo,
@@ -1005,6 +1037,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
                 verdict=result.verdict,
                 trailer=result.trailer,
                 comment_body=comment_body,
+                quarantine_reason=quarantine_reason,
             )
             result.verdict_artifact_path = artifact_path
             if artifact_path is not None:
@@ -1013,17 +1046,35 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
                     file=sys.stderr,
                     flush=True,
                 )
-            posted = post_pr_comment(repo, pr_number, comment_body, token=config.github_token)
-            result.posted_comment_url = posted.get("html_url")
-            _record_posted_comment_url(
-                result.verdict_artifact_path,
-                result.posted_comment_url,
-            )
-            print(
-                f"posted {repo}#{pr_number} verdict=STALE "
-                f"url={result.posted_comment_url}",
-                file=sys.stderr,
-            )
+            if quarantine_reason:
+                print(
+                    "  runtime guard quarantined verdict artifact: "
+                    f"{quarantine_reason}",
+                    file=sys.stderr,
+                    flush=True,
+                )
+            if quarantine_reason and _quarantine_is_test_only(quarantine_reason):
+                print("  skipped GitHub post for pytest-only quarantine", file=sys.stderr, flush=True)
+            else:
+                if quarantine_reason:
+                    result.verdict = "UNKNOWN"
+                    result.trailer = STALE_TRAILER
+                    comment_body = _comment_with_runtime_quarantine_note(
+                        comment_body,
+                        quarantine_reason,
+                    )
+                    result.comment_body = comment_body
+                posted = post_pr_comment(repo, pr_number, comment_body, token=config.github_token)
+                result.posted_comment_url = posted.get("html_url")
+                _record_posted_comment_url(
+                    result.verdict_artifact_path,
+                    result.posted_comment_url,
+                )
+                print(
+                    f"posted {repo}#{pr_number} verdict=STALE "
+                    f"url={result.posted_comment_url}",
+                    file=sys.stderr,
+                )
         config.progress.emit(
             "audit",
             status="finish",
@@ -1082,6 +1133,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
     claude_stdout = ""
     claude_stderr = ""
     attempt_prompt = prompt
+    final_fixture_reason: Optional[str] = None
     t0 = time.time()
     for attempt in range(1, MAX_CLAUDE_AUDIT_ATTEMPTS + 1):
         parsed_candidate, attempt_stdout, attempt_stderr = run_claude_audit(
@@ -1094,6 +1146,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
             parsed_candidate,
             diff_context.changed_files,
         )
+        final_fixture_reason = _fixture_structured_quarantine_reason(parsed_candidate)
         raw_output_attempts.append(
             {
                 "attempt": attempt,
@@ -1172,6 +1225,10 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
     )
 
     if not config.dry_run:
+        quarantine_reason = _audit_runtime_quarantine_reason(
+            comment_body=comment_body,
+            fixture_reason=final_fixture_reason if parsed.verdict == "UNKNOWN" else None,
+        )
         artifact_path = write_audit_verdict_artifact(
             lane_id="claude-audit",
             repo=repo,
@@ -1181,6 +1238,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
             verdict=result_verdict,
             trailer=trailer,
             comment_body=comment_body,
+            quarantine_reason=quarantine_reason,
         )
         result.verdict_artifact_path = artifact_path
         if artifact_path is not None:
@@ -1190,21 +1248,39 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
                 flush=True,
             )
             _write_claude_raw_output_sidecar(artifact_path, raw_output_attempts)
-        posted = post_pr_comment(repo, pr_number, comment_body, token=config.github_token)
-        result.posted_comment_url = posted.get("html_url")
-        _record_posted_comment_url(
-            result.verdict_artifact_path,
-            result.posted_comment_url,
-        )
-        print(
-            f"posted {repo}#{pr_number} verdict={result_verdict} "
-            f"url={result.posted_comment_url}",
-            file=sys.stderr,
-        )
+        if quarantine_reason:
+            print(
+                "  runtime guard quarantined verdict artifact: "
+                f"{quarantine_reason}",
+                file=sys.stderr,
+                flush=True,
+            )
+        if quarantine_reason and _quarantine_is_test_only(quarantine_reason):
+            print("  skipped GitHub post for pytest-only quarantine", file=sys.stderr, flush=True)
+        else:
+            if quarantine_reason:
+                result.verdict = "UNKNOWN"
+                result.trailer = STALE_TRAILER
+                comment_body = _comment_with_runtime_quarantine_note(
+                    comment_body,
+                    quarantine_reason,
+                )
+                result.comment_body = comment_body
+            posted = post_pr_comment(repo, pr_number, comment_body, token=config.github_token)
+            result.posted_comment_url = posted.get("html_url")
+            _record_posted_comment_url(
+                result.verdict_artifact_path,
+                result.posted_comment_url,
+            )
+            print(
+                f"posted {repo}#{pr_number} verdict={result_verdict} "
+                f"url={result.posted_comment_url}",
+                file=sys.stderr,
+            )
     config.progress.emit(
         "audit",
         status="finish",
-        detail=f"{repo}#{pr_number} verdict={result_verdict}",
+        detail=f"{repo}#{pr_number} verdict={result.verdict}",
     )
     return result
 

{code_mower-0.5.0b43 → code_mower-0.5.0b44}/src/code_mower/cli.py

@@ -14,7 +14,7 @@ from pathlib import Path
 if __package__ in {None, ""}:
     raise SystemExit(
         "code_mower.cli is a packaged entrypoint. Install Code Mower with "
-        "`pipx install code-mower==0.5.0b43`, or run source checkouts with "
+        "`pipx install code-mower==0.5.0b44`, or run source checkouts with "
         "`PYTHONPATH=src python -m code_mower.cli`."
     )
 

{code_mower-0.5.0b43 → code_mower-0.5.0b44}/src/code_mower/code_mower_telemetry.py

@@ -18,12 +18,16 @@ if __package__ in {None, ""}:
     sys.path.insert(0, str(module_dir.parent))
     if module_dir.name == "code_mower":  # pragma: no cover - extracted direct CLI.
         from code_mower import audit_handoff_log
+        from code_mower.provider_runners import is_fixture_verdict_artifact
     else:
         from tools import audit_handoff_log
+        from tools.provider_runners import is_fixture_verdict_artifact
 elif __package__ == "tools":
     from tools import audit_handoff_log
+    from tools.provider_runners import is_fixture_verdict_artifact
 else:  # pragma: no cover - exercised after package extraction.
     from . import audit_handoff_log
+    from .provider_runners import is_fixture_verdict_artifact
 
 
 PASS_VERDICTS = {"completed", "done", "pass", "passed", "success", "succeeded"}
@@ -31,7 +35,6 @@ BLOCKED_VERDICTS = {"block", "blocked", "fail", "failed", "failure"}
 VERDICT_ARTIFACT_SCHEMA = "code_mower.auditVerdictArtifact.v1"
 BENCHMARK_EVENT_SCHEMA = "code_mower.benchmarkEvent.v1"
 VERDICT_ARTIFACT_DIR_ENV = "CODE_MOWER_VERDICT_ARTIFACT_DIR"
-DEFAULT_VERDICT_ARTIFACT_DIR = Path.home() / ".cache" / "code-mower-audits" / "verdicts"
 SEVERITY_RE = re.compile(r"\b(P[0-3])=(\d+)\b")
 AUDIT_TRAILER_RE = re.compile(
     r"<!--\s*(?P<prefix>[A-Z0-9_]+_AUDIT_STATE)\s*:\s*(?P<label>[a-z0-9_.-]+)\s*-->",
@@ -43,7 +46,10 @@ def default_verdict_artifact_dir() -> Path:
     configured = os.environ.get(VERDICT_ARTIFACT_DIR_ENV, "").strip()
     if configured:
         return Path(configured).expanduser()
-    return DEFAULT_VERDICT_ARTIFACT_DIR
+    cache_home = os.environ.get("XDG_CACHE_HOME", "").strip()
+    if cache_home:
+        return Path(cache_home).expanduser() / "code-mower-audits" / "verdicts"
+    return Path.home() / ".cache" / "code-mower-audits" / "verdicts"
 
 
 def _normalize_repo_slug(value: str) -> str:
@@ -249,6 +255,8 @@ def export_reviewer_run_events_from_verdicts(
             raise ValueError(f"{path}: verdict artifact must be a JSON object")
         if payload.get("schema") != VERDICT_ARTIFACT_SCHEMA:
             continue
+        if is_fixture_verdict_artifact(payload):
+            continue
         artifact_repo = _normalize_repo_slug(
             str(payload.get("repo") or _repo_slug_from_artifact_path(path))
         )

{code_mower-0.5.0b43 → code_mower-0.5.0b44}/src/code_mower/codex_audit_pr.py

@@ -89,11 +89,13 @@ if __package__ in {None, "", "tools"}:
         from tools import reviewer_spend
         from tools.audit_progress import AuditProgress, run_subprocess_with_progress
         from tools.provider_runners import (
+            audit_runtime_quarantine_reason as _audit_runtime_quarantine_reason,
             clip_text as _clip_text,
             fetch_pull_request,
             fetch_base_ref as _shared_fetch_base_ref,
             fetch_pr_head as _shared_fetch_pr_head,
             fetch_pr_head_unless_local_matches as _shared_fetch_pr_head_unless_local_matches,
+            is_fixture_structured_verdict as _is_fixture_structured_verdict,
             limit_comment_body,
             one_line as _one_line,
             parse_repo_paths as _parse_repo_paths,
@@ -112,11 +114,13 @@ if __package__ in {None, "", "tools"}:
         import reviewer_spend  # type: ignore
         from audit_progress import AuditProgress, run_subprocess_with_progress  # type: ignore
         from provider_runners import (  # type: ignore
+            audit_runtime_quarantine_reason as _audit_runtime_quarantine_reason,
             clip_text as _clip_text,
             fetch_pull_request,
             fetch_base_ref as _shared_fetch_base_ref,
             fetch_pr_head as _shared_fetch_pr_head,
             fetch_pr_head_unless_local_matches as _shared_fetch_pr_head_unless_local_matches,
+            is_fixture_structured_verdict as _is_fixture_structured_verdict,
             limit_comment_body,
             one_line as _one_line,
             parse_repo_paths as _parse_repo_paths,
@@ -135,12 +139,14 @@ else:  # pragma: no cover - exercised after package extraction.
     from . import reviewer_spend
     from .audit_progress import AuditProgress, run_subprocess_with_progress
     from .provider_runners import (
+        audit_runtime_quarantine_reason as _audit_runtime_quarantine_reason,
         clip_text as _clip_text,
         create_temp_worktree as _shared_create_temp_worktree,
         fetch_base_ref as _shared_fetch_base_ref,
         fetch_pull_request,
         fetch_pr_head as _shared_fetch_pr_head,
         fetch_pr_head_unless_local_matches as _shared_fetch_pr_head_unless_local_matches,
+        is_fixture_structured_verdict as _is_fixture_structured_verdict,
         limit_comment_body,
         one_line as _one_line,
         parse_repo_paths as _parse_repo_paths,
@@ -240,6 +246,7 @@ class CodexVerdict:
     # (e.g. verdict=pass but P2 findings are present). This is not
     # rendered into the public PR comment; audit_pr() logs it to stderr.
     mismatch_note: str = ""
+    quarantine_reason: str = ""
 
     @property
     def blocker_count(self) -> int:
@@ -258,6 +265,7 @@ class CodexVerdict:
             "blocker_count": self.blocker_count,
             "findings": self.findings,
             "mismatch_note": self.mismatch_note,
+            "quarantine_reason": self.quarantine_reason,
         }
 
 
@@ -313,6 +321,23 @@ BLOCKED_TRAILER = "<!-- CODEX_AUDIT_STATE: codex-audit-blocked -->"
 AUDIT_RUN_TRAILER_PREFIX = "<!-- CODE_MOWER_AUDIT_RUN:"
 
 
+def _quarantine_is_test_only(reason: Optional[str]) -> bool:
+    return reason == "PYTEST_CURRENT_TEST is set"
+
+
+def _comment_with_runtime_quarantine_note(comment_body: str, reason: str) -> str:
+    note = (
+        "\nRuntime quarantine: local verdict artifact was quarantined because "
+        f"{reason}. Posting UNKNOWN so the lane requeues visibly.\n"
+    )
+    marker = f"\n\n{STALE_TRAILER}"
+    if marker in comment_body:
+        body = comment_body.replace(marker, note + "\n" + STALE_TRAILER, 1)
+    else:
+        body = comment_body.rstrip() + note + "\n" + STALE_TRAILER + "\n"
+    return limit_comment_body(body, STALE_TRAILER, provider_name="Codex")
+
+
 # ----- Structured verdict validation -----
 
 
@@ -446,6 +471,20 @@ def parse_structured_codex_verdict(data: Any) -> CodexVerdict:
             rendered_findings.append(raw_finding)
 
     blocker_count = p_counts[0] + p_counts[1] + p_counts[2]
+    if _is_fixture_structured_verdict(summary, raw_findings):
+        return CodexVerdict(
+            verdict="UNKNOWN",
+            prose=(
+                "(structured Codex verdict is unusable: fixture-shaped structured "
+                "verdict; requeue and retry)"
+            ),
+            p0_count=p_counts[0],
+            p1_count=p_counts[1],
+            p2_count=p_counts[2],
+            p3_count=p_counts[3],
+            findings=finding_lines,
+            quarantine_reason="fixture-shaped structured verdict",
+        )
     if blocker_count > 0:
         verdict = "BLOCKED"
         mismatch_note = (
@@ -1367,6 +1406,9 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
                 comment_body=comment_body, codex_stdout="", codex_stderr="",
             )
             if not config.dry_run:
+                quarantine_reason = _audit_runtime_quarantine_reason(
+                    comment_body=comment_body,
+                )
                 artifact_path = write_audit_verdict_artifact(
                     lane_id="codex-audit",
                     repo=repo,
@@ -1376,6 +1418,7 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
                     verdict=result.verdict,
                     trailer=result.trailer,
                     comment_body=comment_body,
+                    quarantine_reason=quarantine_reason,
                 )
                 result.verdict_artifact_path = artifact_path
                 if artifact_path is not None:
@@ -1395,9 +1438,27 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
                 # comment. See generated product-support wrapper
                 # finish_lock handling for the wrapper-side history and
                 # the general silent-success/silent-failure lesson.
-                posted = post_pr_comment(repo, pr_number, comment_body,
-                                          token=config.github_token)
-                result.posted_comment_url = posted.get("html_url")
+                if quarantine_reason:
+                    print(
+                        "  runtime guard quarantined verdict artifact: "
+                        f"{quarantine_reason}",
+                        file=sys.stderr,
+                        flush=True,
+                    )
+                if quarantine_reason and _quarantine_is_test_only(quarantine_reason):
+                    print("  skipped GitHub post for pytest-only quarantine", file=sys.stderr, flush=True)
+                else:
+                    if quarantine_reason:
+                        result.verdict = "UNKNOWN"
+                        result.trailer = STALE_TRAILER
+                        comment_body = _comment_with_runtime_quarantine_note(
+                            comment_body,
+                            quarantine_reason,
+                        )
+                        result.comment_body = comment_body
+                    posted = post_pr_comment(repo, pr_number, comment_body,
+                                              token=config.github_token)
+                    result.posted_comment_url = posted.get("html_url")
             config.progress.emit(
                 "audit",
                 status="finish",
@@ -1547,6 +1608,12 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
     )
 
     if not config.dry_run:
+        quarantine_reason = _audit_runtime_quarantine_reason(
+            comment_body=comment_body,
+            fixture_reason=(
+                parsed.quarantine_reason if parsed.verdict == "UNKNOWN" else None
+            ),
+        )
         artifact_path = write_audit_verdict_artifact(
             lane_id="codex-audit",
             repo=repo,
@@ -1556,6 +1623,7 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
             verdict=result_verdict,
             trailer=trailer,
             comment_body=comment_body,
+            quarantine_reason=quarantine_reason,
         )
         result.verdict_artifact_path = artifact_path
         if artifact_path is not None:
@@ -1568,16 +1636,34 @@ def audit_pr(config: AuditConfig, repo: str, pr_number: int) -> AuditResult:
         # at the STALE-handler call site. tl;dr: post_pr_comment() raising
         # is the only signal the wrapper's finish_lock has that posting
         # failed. Do not catch the exception here.
-        posted = post_pr_comment(repo, pr_number, comment_body,
-                                  token=config.github_token)
-        result.posted_comment_url = posted.get("html_url")
-        print(f"posted {repo}#{pr_number} verdict={result_verdict} "
-              f"url={result.posted_comment_url}", file=sys.stderr)
+        if quarantine_reason:
+            print(
+                "  runtime guard quarantined verdict artifact: "
+                f"{quarantine_reason}",
+                file=sys.stderr,
+                flush=True,
+            )
+        if quarantine_reason and _quarantine_is_test_only(quarantine_reason):
+            print("  skipped GitHub post for pytest-only quarantine", file=sys.stderr, flush=True)
+        else:
+            if quarantine_reason:
+                result.verdict = "UNKNOWN"
+                result.trailer = STALE_TRAILER
+                comment_body = _comment_with_runtime_quarantine_note(
+                    comment_body,
+                    quarantine_reason,
+                )
+                result.comment_body = comment_body
+            posted = post_pr_comment(repo, pr_number, comment_body,
+                                      token=config.github_token)
+            result.posted_comment_url = posted.get("html_url")
+            print(f"posted {repo}#{pr_number} verdict={result_verdict} "
+                  f"url={result.posted_comment_url}", file=sys.stderr)
 
     config.progress.emit(
         "audit",
         status="finish",
-        detail=f"{repo}#{pr_number} verdict={result_verdict}",
+        detail=f"{repo}#{pr_number} verdict={result.verdict}",
     )
     return result
 

{code_mower-0.5.0b43 → code_mower-0.5.0b44}/src/code_mower/provider_runners/__init__.py

@@ -36,6 +36,11 @@ from .pr_worktree import (
 from .repo_paths import parse_repo_paths
 from .text_schema import clip_text, one_line, require_exact_keys
 from .verdict_artifacts import (
+    audit_runtime_quarantine_reason,
+    fixture_verdict_comment_reason,
+    is_fixture_structured_verdict,
+    is_fixture_verdict_artifact,
+    is_fixture_verdict_comment,
     load_audit_verdict_artifact,
     repost_audit_verdict_artifact,
     write_audit_verdict_artifact,
@@ -59,11 +64,16 @@ __all__ = [
     "fetch_pr_head_sha_or_raise",
     "fetch_pr_head_sha_unless_local_matches",
     "fetch_pr_head_unless_local_matches",
+    "fixture_verdict_comment_reason",
+    "is_fixture_verdict_artifact",
+    "is_fixture_verdict_comment",
+    "is_fixture_structured_verdict",
     "local_checkout_matches_head",
     "load_audit_verdict_artifact",
     "local_head_sha",
     "limit_comment_body",
     "MAX_GITHUB_COMMENT_CHARS",
+    "audit_runtime_quarantine_reason",
     "clip_text",
     "DEFAULT_HOME_ENV_KEYS",
     "one_line",