codna 0.1.0__py3-none-any.whl

codna/agent-core/vendor/cline/algenta/artifacts.test.ts

@@ -0,0 +1,133 @@
+import { expect, test } from "bun:test";
+import { determineTerminalState } from "./server/artifacts";
+import type {
+	GovernHookEvidence,
+	SessionRecord,
+	ToolCallEvidence,
+} from "./server/contracts";
+
+function buildSession(): SessionRecord {
+	return {
+		sessionId: "session_test",
+		agentRunId: "run_test",
+		owner: "owner",
+		channel: "api",
+		repositoryScope: "repo_test",
+		approvalProfile: "repository_fix_gated",
+		idempotencyKey: null,
+		replayOfRunId: null,
+		workingDir: "/work",
+		prompt: "fix it",
+		injectedContext: "",
+		suppressExploration: false,
+		enableSpawnAgent: false,
+		enableAgentTeams: false,
+		engine: {
+			enabled: true,
+			url: "http://127.0.0.1:18600",
+			repositoryId: "repo_test",
+			snapshotId: "snap_test",
+			apiKey: "key_test",
+			requiredTools: ["simulate_patch"],
+			expectedCalls: [],
+			failOnZeroCalls: true,
+			requireGovernHook: true,
+		},
+		policy: {
+			profile: "repository_fix_gated",
+			requestedPolicy: {},
+			effectivePolicy: {},
+			toolPolicies: {},
+			allowedWriteScope: ["patch_artifact"],
+			disallowedWriteScope: [],
+			wildcardAutoApproveUsed: false,
+		},
+		authorization: {
+			caller: "local_user",
+			workflow_identity: null,
+			repository_allowed: true,
+			branch_allowed: true,
+		},
+		state: "completed",
+		createdAt: "2026-06-30T00:00:00Z",
+		updatedAt: "2026-06-30T00:00:00Z",
+		events: [],
+		artifacts: {},
+		secondaryReasons: [],
+		terminalState: null,
+		approvalEvents: [],
+		lastResult: {},
+		lastUsage: {},
+		lastMessages: [],
+	};
+}
+
+function toolEvidence(
+	name: string,
+	statuses: string[],
+	count = 1,
+): Record<string, ToolCallEvidence> {
+	return {
+		[name]: {
+			count,
+			first_event_id: "evt_1",
+			last_event_id: "evt_2",
+			statuses,
+		},
+	};
+}
+
+const OBSERVED_GOVERN_HOOK: GovernHookEvidence = {
+	status: "observed",
+	verdict: "apply_patch",
+	event_id: "evt_gate",
+	policy_version: "advisory",
+};
+
+test("govern hook satisfies simulate evidence after a successful edit", () => {
+	const result = determineTerminalState(buildSession(), {
+		toolCallsByName: toolEvidence("apply_patch", ["started", "succeeded"]),
+		governHook: OBSERVED_GOVERN_HOOK,
+	});
+	expect(result.terminalState).toBe("succeeded");
+	expect(result.secondaryReasons).toEqual([]);
+});
+
+test("missing govern-hook-backed simulate evidence still fails closed", () => {
+	const session = buildSession();
+	session.engine.requireGovernHook = false;
+	const result = determineTerminalState(session, {
+		toolCallsByName: toolEvidence("apply_patch", ["started", "succeeded"]),
+		governHook: { status: "unobserved" },
+	});
+	expect(result.terminalState).toBe("engine_evidence_missing");
+});
+
+test("govern hook alone does not satisfy simulate evidence without a successful edit", () => {
+	const result = determineTerminalState(buildSession(), {
+		toolCallsByName: {},
+		governHook: OBSERVED_GOVERN_HOOK,
+	});
+	expect(result.terminalState).toBe("engine_evidence_missing");
+});
+
+test("local validation accepts successful run_commands as simulate evidence", () => {
+	const session = buildSession();
+	session.approvalProfile = "local_validation";
+	session.policy.profile = "local_validation";
+	session.policy.allowedWriteScope = ["patch_artifact", "working_tree"];
+	const result = determineTerminalState(session, {
+		toolCallsByName: toolEvidence("run_commands", ["started", "succeeded"]),
+		governHook: OBSERVED_GOVERN_HOOK,
+	});
+	expect(result.terminalState).toBe("succeeded");
+	expect(result.secondaryReasons).toEqual([]);
+});
+
+test("repository fix gated still requires an editor-style write tool", () => {
+	const result = determineTerminalState(buildSession(), {
+		toolCallsByName: toolEvidence("run_commands", ["started", "succeeded"]),
+		governHook: OBSERVED_GOVERN_HOOK,
+	});
+	expect(result.terminalState).toBe("engine_evidence_missing");
+});

codna/agent-core/vendor/cline/algenta/execution.test.ts

@@ -0,0 +1,63 @@
+import { expect, test } from "bun:test";
+import type { SessionRecord } from "./server/contracts";
+import { buildRunAgentArgs } from "./server/execution";
+
+function session(overrides: Partial<SessionRecord> = {}): SessionRecord {
+	return {
+		sessionId: "session_123",
+		agentRunId: "run_123",
+		owner: "owner",
+		channel: "api",
+		repositoryScope: "repo",
+		approvalProfile: "repository_fix_gated",
+		idempotencyKey: null,
+		replayOfRunId: null,
+		workingDir: "/work",
+		prompt: "Inspect the repository",
+		injectedContext: "",
+		suppressExploration: false,
+		enableSpawnAgent: false,
+		enableAgentTeams: false,
+		engine: {
+			enabled: false,
+			requiredTools: [],
+			expectedCalls: [],
+			failOnZeroCalls: false,
+			requireGovernHook: false,
+		},
+		policy: {
+			profile: "repository_fix_gated",
+			requestedPolicy: {},
+			effectivePolicy: {},
+			toolPolicies: {},
+			allowedWriteScope: ["patch_artifact"],
+			disallowedWriteScope: [],
+			wildcardAutoApproveUsed: false,
+		},
+		authorization: {
+			caller: "local_user",
+			workflow_identity: null,
+			repository_allowed: true,
+			branch_allowed: true,
+		},
+		state: "created",
+		createdAt: "2026-01-01T00:00:00.000Z",
+		updatedAt: "2026-01-01T00:00:00.000Z",
+		events: [],
+		artifacts: {},
+		secondaryReasons: [],
+		terminalState: null,
+		approvalEvents: [],
+		...overrides,
+	};
+}
+
+test("buildRunAgentArgs preserves explicit triage task kind", () => {
+	const args = buildRunAgentArgs(session({ taskKind: "triage" }));
+	expect(args.task_kind).toBe("triage");
+});
+
+test("buildRunAgentArgs defaults task kind to fix", () => {
+	const args = buildRunAgentArgs(session());
+	expect(args.task_kind).toBe("fix");
+});

codna/agent-core/vendor/cline/algenta/fallback.test.ts

@@ -0,0 +1,73 @@
+import { expect, test } from "bun:test";
+import {
+	explorationSuppressed,
+	runFailedOrNoChange,
+	shouldEscalateTier2,
+} from "./fallback";
+import type { SessionRecord, TerminalState } from "./server/contracts";
+
+type FallbackSession = Pick<
+	SessionRecord,
+	"workingDir" | "terminalState" | "suppressExploration" | "toolProfile"
+>;
+
+function buildSession(
+	overrides: Partial<FallbackSession> = {},
+): FallbackSession {
+	return {
+		workingDir: "/tmp/repo",
+		terminalState: "succeeded",
+		suppressExploration: false,
+		toolProfile: undefined,
+		...overrides,
+	};
+}
+
+test("no-exploration tool profile is escalation-eligible", () => {
+	expect(
+		explorationSuppressed(
+			buildSession({ toolProfile: "no_exploration_local_validation" }),
+		),
+	).toBe(true);
+});
+
+test("plugin evidence failure counts as a miss even when git changed", () => {
+	const session = buildSession({
+		toolProfile: "no_exploration_local_validation",
+		terminalState: "plugin_evidence_missing",
+	});
+	expect(runFailedOrNoChange(session, { hasWorkingTreeChanges: true })).toBe(true);
+	expect(shouldEscalateTier2(session, { hasWorkingTreeChanges: true })).toBe(true);
+});
+
+test("engine evidence failure counts as a miss even when git changed", () => {
+	const session = buildSession({
+		toolProfile: "no_exploration_local_validation",
+		terminalState: "engine_evidence_missing",
+	});
+	expect(runFailedOrNoChange(session, { hasWorkingTreeChanges: true })).toBe(true);
+	expect(shouldEscalateTier2(session, { hasWorkingTreeChanges: true })).toBe(true);
+});
+
+test("constrained no-change run escalates", () => {
+	const session = buildSession({
+		toolProfile: "no_exploration_local_validation",
+		terminalState: "succeeded",
+	});
+	expect(shouldEscalateTier2(session, { hasWorkingTreeChanges: false })).toBe(true);
+});
+
+test("successful constrained run with changes does not escalate", () => {
+	const session = buildSession({
+		toolProfile: "no_exploration_local_validation",
+		terminalState: "succeeded",
+	});
+	expect(shouldEscalateTier2(session, { hasWorkingTreeChanges: true })).toBe(false);
+});
+
+test("unconstrained retryable failure does not escalate", () => {
+	const session = buildSession({
+		terminalState: "plugin_evidence_missing" satisfies TerminalState,
+	});
+	expect(shouldEscalateTier2(session, { hasWorkingTreeChanges: true })).toBe(false);
+});

codna/agent-core/vendor/cline/algenta/fallback.ts

@@ -0,0 +1,83 @@
+import { execFileSync } from "node:child_process";
+import type { SessionRecord, TerminalState } from "./server/contracts";
+
+export const FALLBACK_NO_EXPLORATION_PROFILES = new Set([
+	"no_exploration_local_validation",
+	"no_exploration_no_shell",
+]);
+
+const RETRYABLE_TERMINAL_STATES = new Set<TerminalState>([
+	"failed",
+	"aborted",
+	"plugin_evidence_missing",
+	"engine_evidence_missing",
+]);
+
+type FallbackSession = Pick<
+	SessionRecord,
+	"workingDir" | "terminalState" | "suppressExploration" | "toolProfile"
+>;
+
+/** Authoritative "did the agent change anything", mirroring the engine's before/after tree diff. */
+export function workingTreeHasChanges(workingDir: string): boolean {
+	try {
+		const out = execFileSync("git", ["-C", workingDir, "status", "--porcelain"], {
+			encoding: "utf8",
+		});
+		return out.trim().length > 0;
+	} catch {
+		// Not a git tree → can't prove a change; treat as a miss so we try harder, never hard-fail.
+		return false;
+	}
+}
+
+/** Revert any partial Tier-1 edits so Tier-2 starts from the materialized git baseline. Best-effort. */
+export function resetWorkingTree(workingDir: string): void {
+	try {
+		execFileSync("git", ["-C", workingDir, "checkout", "--", "."], { stdio: "ignore" });
+		execFileSync("git", ["-C", workingDir, "clean", "-fd"], { stdio: "ignore" });
+	} catch {
+		// A non-git tree, or an already-clean one, is fine — Tier-2 runs regardless.
+	}
+}
+
+/** True only when the run had exploration suppressed — i.e. an escalation is actually available. */
+export function explorationSuppressed(session: FallbackSession): boolean {
+	return (
+		Boolean(session.suppressExploration) ||
+		(typeof session.toolProfile === "string" &&
+			FALLBACK_NO_EXPLORATION_PROFILES.has(session.toolProfile))
+	);
+}
+
+function endedInRetryableTerminalState(
+	terminalState: TerminalState | null,
+): boolean {
+	return terminalState !== null && RETRYABLE_TERMINAL_STATES.has(terminalState);
+}
+
+/** Tier-1 missed if the run failed in a retryable way OR left the working tree unchanged. */
+export function runFailedOrNoChange(
+	session: Pick<FallbackSession, "workingDir" | "terminalState">,
+	options?: { hasWorkingTreeChanges?: boolean },
+): boolean {
+	if (endedInRetryableTerminalState(session.terminalState)) {
+		return true;
+	}
+	const hasWorkingTreeChanges =
+		options?.hasWorkingTreeChanges ?? workingTreeHasChanges(session.workingDir);
+	return !hasWorkingTreeChanges;
+}
+
+/** Tier-2 is allowed only for constrained runs and only when Tier-1 missed. */
+export function shouldEscalateTier2(
+	session: FallbackSession,
+	options?: { hasWorkingTreeChanges?: boolean },
+): boolean {
+	return (
+		explorationSuppressed(session) &&
+		runFailedOrNoChange(session, {
+			hasWorkingTreeChanges: options?.hasWorkingTreeChanges,
+		})
+	);
+}

codna/agent-core/vendor/cline/algenta/fix-runner.ts

@@ -0,0 +1,27 @@
+// One-shot agentic fix runner — the executor behind `codna secure --fix`.
+// Reads the task from env, runs the vendored Cline agent against a working dir (edits in place),
+// prints `RESULT <json>`. The engine seam stays optional: with only an ANTHROPIC_API_KEY this
+// runs as a plain coding agent (no HTTP engine required).
+import { runAgent } from "./adapter";
+
+const res: Awaited<ReturnType<typeof runAgent>> = await runAgent({
+	working_dir: process.env.FIX_WORKING_DIR as string,
+	prompt: process.env.FIX_PROMPT as string,
+	task_kind: process.env.FIX_TASK_KIND === "triage" ? "triage" : "fix",
+	provider: process.env.FIX_PROVIDER || "anthropic",
+	...(process.env.FIX_MODEL ? { model: process.env.FIX_MODEL } : {}),
+	limits: {
+		maxIterations: Number(process.env.FIX_MAX_ITERATIONS || 20),
+		timeoutMs: Number(process.env.FIX_TIMEOUT_MS || 300000),
+	},
+});
+console.log(
+	"RESULT " +
+		JSON.stringify({
+			status: res.status,
+			iterations: res.iterations,
+			model: res.model,
+			text: res.text,
+			usage: res.usage,
+		}),
+);

codna/agent-core/vendor/cline/algenta/http.test.ts

@@ -0,0 +1,48 @@
+// B7 (PR10b): the agent-core sidecar requires the internal bearer when a token is
+// configured; it stays open for local loopback dev when none is set.
+import { afterEach, expect, test } from "bun:test";
+import { isAuthorizedRequest, isLocalRuntimeControlRequest } from "./server/http";
+
+const SAVED = { ...process.env };
+afterEach(() => {
+	process.env = { ...SAVED };
+});
+
+const req = (auth?: string) =>
+	({ headers: auth ? { authorization: auth } : {} }) as never;
+
+const controlReq = (runtimeId?: string, remoteAddress = "127.0.0.1") =>
+	({
+		headers: runtimeId ? { "x-codna-runtime-id": runtimeId } : {},
+		socket: { remoteAddress },
+	}) as never;
+
+test("open when no token is configured (loopback dev / backward compatible)", () => {
+	delete process.env.AGENT_CORE_AUTH_TOKEN;
+	delete process.env.AGENT_CORE_REQUIRE_AUTH;
+	expect(isAuthorizedRequest(req())).toBe(true);
+});
+
+test("with a token configured, only the matching bearer is authorized", () => {
+	process.env.AGENT_CORE_AUTH_TOKEN = "secret-123";
+	delete process.env.AGENT_CORE_REQUIRE_AUTH;
+	expect(isAuthorizedRequest(req())).toBe(false);
+	expect(isAuthorizedRequest(req("Bearer wrong"))).toBe(false);
+	expect(isAuthorizedRequest(req("secret-123"))).toBe(false); // missing "Bearer "
+	expect(isAuthorizedRequest(req("Bearer secret-123"))).toBe(true);
+});
+
+test("REQUIRE_AUTH=1 without a token fails closed", () => {
+	delete process.env.AGENT_CORE_AUTH_TOKEN;
+	process.env.AGENT_CORE_REQUIRE_AUTH = "1";
+	expect(isAuthorizedRequest(req("Bearer anything"))).toBe(false);
+});
+
+test("local runtime control requires local ownership and loopback caller", () => {
+	process.env.CODNA_LOCAL_RUNTIME = "1";
+	process.env.CODNA_RUNTIME_ID = "runtime-123";
+	expect(isLocalRuntimeControlRequest(controlReq("runtime-123", "127.0.0.1"))).toBe(true);
+	expect(isLocalRuntimeControlRequest(controlReq("runtime-123", "::ffff:127.0.0.1"))).toBe(true);
+	expect(isLocalRuntimeControlRequest(controlReq("wrong", "127.0.0.1"))).toBe(false);
+	expect(isLocalRuntimeControlRequest(controlReq("runtime-123", "10.0.0.5"))).toBe(false);
+});

codna/agent-core/vendor/cline/algenta/mojo-gate.test.ts

@@ -0,0 +1,76 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { expect, test } from "bun:test";
+import { mojoGateAfterTool } from "./mojo-gate";
+import { type EngineContext, engineContext } from "./tools";
+
+const pexec = promisify(execFile);
+
+async function initRepo(): Promise<string> {
+	const repo = await mkdtemp(join(tmpdir(), "codna-mojo-gate-"));
+	await writeFile(join(repo, "sample.txt"), "before\n", "utf8");
+	await pexec("git", ["init"], { cwd: repo });
+	await pexec("git", ["config", "user.email", "gate@example.com"], { cwd: repo });
+	await pexec("git", ["config", "user.name", "Gate Test"], { cwd: repo });
+	await pexec("git", ["add", "."], { cwd: repo });
+	await pexec("git", ["commit", "-m", "initial"], { cwd: repo });
+	await writeFile(join(repo, "sample.txt"), "after\n", "utf8");
+	return repo;
+}
+
+test("run_commands edits are observed by the govern hook", async () => {
+	const repo = await initRepo();
+	const seen: { url?: string; body?: Record<string, unknown> } = {};
+	const originalFetch = globalThis.fetch;
+	globalThis.fetch = (async (url: unknown, init: RequestInit | undefined) => {
+		seen.url = String(url);
+		seen.body = JSON.parse(String(init?.body ?? "{}"));
+		return {
+			ok: true,
+			json: async () => ({
+				recommended_action: "apply_patch",
+				confidence: 0.97,
+				engine_version: "test-engine",
+			}),
+			text: async () => "",
+		} as unknown as Response;
+	}) as typeof fetch;
+
+	try {
+		const ctx: EngineContext = {
+			url: "http://127.0.0.1:18600",
+			repositoryId: "repo_test",
+			snapshotId: "snap_test",
+			apiKey: "test-key",
+			workingDir: repo,
+		};
+		const result = await engineContext.run(ctx, () =>
+			mojoGateAfterTool({
+				toolCall: { toolName: "run_commands" },
+				tool: { name: "run_commands" },
+				result: { output: "validator passed" },
+			} as Parameters<typeof mojoGateAfterTool>[0]),
+		);
+
+		expect(seen.url).toBe("http://127.0.0.1:18600/v1/repositories/repo_test/simulate-patch");
+		expect(seen.body?.snapshot_id).toBe("snap_test");
+		expect(String(seen.body?.patch_diff)).toContain("-before");
+		expect(String(seen.body?.patch_diff)).toContain("+after");
+		expect(result?.result?.output).toContain("[algenta-risk-gate]");
+		expect(result?.result?.output).toContain("gate PASSED");
+		expect(result?.result?.metadata).toEqual({
+			algenta_gate: {
+				action: "apply_patch",
+				confidence: 0.97,
+				mode: "advisory",
+				passed: true,
+			},
+		});
+	} finally {
+		globalThis.fetch = originalFetch;
+		await rm(repo, { recursive: true, force: true });
+	}
+});

codna/agent-core/vendor/cline/algenta/mojo-gate.ts

@@ -0,0 +1,151 @@
+// Algenta govern hook — the calibrated-risk gate INSIDE the Cline agent loop.
+//
+// Cline's built-in tools let the agent EDIT files; this AgentExtension `afterTool` hook
+// makes every edit pass through the Algenta decision engine before the loop continues.
+// After each `apply_patch` / `editor` tool call it captures the cumulative working-tree
+// patch and asks the LOCAL engine (loopback HTTP — the self-hosted boundary, no cloud)
+// to simulate it with the Mojo Monte-Carlo engine and return the calibrated-risk verdict.
+// The verdict is fed back into the loop so the agent reacts to risk automatically —
+// without having to remember to call the `simulate_patch` tool itself.
+//
+// This complements the `simulate_patch` tool (a voluntary, run-completing check): the
+// hook is the involuntary governor that fires on EVERY edit.
+//
+// Mode (env ALGENTA_GATE_MODE):
+//   advisory (default) — append the verdict to the edit result the model sees; never
+//                        errors or stops. An in-loop signal with no behavior coercion
+//                        (shadow-first, the same discipline as AR-OPT-5 routing).
+//   enforce            — on a failed gate, mark the edit result `isError` so the agent
+//                        treats the edit as rejected and revises within the loop.
+//   block              — on a failed gate, stop the run (hard veto: a "do not apply"
+//                        verdict ends the run without leaving a bad edit).
+//
+// Fails OPEN: any engine/infra error leaves the edit untouched — governance must never
+// break the agent run. The plugin is only loaded when ALGENTA_ENGINE_URL is set
+// (see adapter.ts); the hook re-checks the engine config defensively.
+import type { AgentPlugin } from "@cline/core";
+import {
+	ENGINE,
+	enginePost,
+	REPO,
+	SNAPSHOT,
+	WORKING_DIR,
+	workingTreeDiff,
+} from "./tools";
+
+type AfterToolHook = NonNullable<
+	NonNullable<AgentPlugin["hooks"]>["afterTool"]
+>;
+type GateMode = "advisory" | "enforce" | "block";
+
+// Cline's mutating tools. local_validation / CI automation intentionally allow exact
+// restores and validator-driven rewrites through run_commands, so the govern hook must
+// observe those edits too; workingTreeDiff() already fails open when a shell command did
+// not actually change the repository.
+const EDIT_TOOLS = new Set(["apply_patch", "editor", "run_commands"]);
+
+function gateMode(): GateMode {
+	const m = (process.env.ALGENTA_GATE_MODE ?? "advisory").toLowerCase();
+	return m === "enforce" || m === "block" ? m : "advisory";
+}
+
+/** Render a tool result's output the way the runtime presents it to the model. */
+function renderOutput(o: unknown): string {
+	if (o === undefined || o === null) return "";
+	if (typeof o === "string") return o;
+	if (o instanceof Error) return o.message;
+	try {
+		return JSON.stringify(o);
+	} catch {
+		return String(o);
+	}
+}
+
+// Sequential single-run sidecar: skip re-simulating an unchanged cumulative diff so a
+// burst of edits that don't move the patch doesn't re-run the Mojo sim each time.
+let lastDiff = "";
+let lastVerdict: {
+	action: string;
+	confidence: unknown;
+	engine: unknown;
+} | null = null;
+
+export const mojoGateAfterTool: AfterToolHook = async (ctx) => {
+	// Govern only successful edits, and only when the local engine is configured.
+	if (!ENGINE() || !REPO()) return undefined;
+	const toolName = ctx.toolCall?.toolName ?? ctx.tool?.name;
+	if (!toolName || !EDIT_TOOLS.has(toolName)) return undefined;
+	if (ctx.result?.isError) return undefined;
+
+	try {
+		const patchDiff = await workingTreeDiff(WORKING_DIR());
+		if (!patchDiff.trim()) return undefined;
+
+		let verdict = lastVerdict;
+		if (patchDiff !== lastDiff || verdict === null) {
+			const env = await enginePost(
+				`/v1/repositories/${REPO()}/simulate-patch`,
+				{
+					snapshot_id: SNAPSHOT(),
+					patch_diff: patchDiff,
+				},
+			);
+			verdict = {
+				action: String(env.recommended_action ?? ""),
+				confidence: env.confidence,
+				engine: env.engine_version,
+			};
+			lastDiff = patchDiff;
+			lastVerdict = verdict;
+		}
+
+		const passed = verdict.action === "apply_patch";
+		const mode = gateMode();
+		const tag =
+			`[algenta-risk-gate] recommended_action=${verdict.action} ` +
+			`confidence=${verdict.confidence ?? "?"} engine=${verdict.engine ?? "?"} mode=${mode}`;
+		const metadata = {
+			...(ctx.result?.metadata ?? {}),
+			algenta_gate: {
+				action: verdict.action,
+				confidence: verdict.confidence,
+				mode,
+				passed,
+			},
+		};
+		const base = renderOutput(ctx.result?.output);
+
+		if (passed) {
+			// Gate satisfied — record the verdict; never alter control flow.
+			return {
+				result: { output: `${base}\n\n${tag} — gate PASSED ✓`, metadata },
+			};
+		}
+
+		// Gate FAILED.
+		const fail =
+			`${tag} — gate FAILED: the Algenta calibrated-risk simulation does not approve the ` +
+			`current working-tree patch. Reduce blast radius / likely-failing tests and revise ` +
+			`before finalizing.`;
+		if (mode === "block") {
+			// Surface the verdict in output too (not only the stop reason), so the
+			// run's evidence records that the gate fired even when it blocks.
+			return {
+				stop: true,
+				reason: fail,
+				result: { output: `${base}\n\n${fail}`, metadata },
+			};
+		}
+		return {
+			result: {
+				output: `${base}\n\n${fail}`,
+				isError: mode === "enforce",
+				metadata,
+			},
+		};
+	} catch (e) {
+		// Governance fails OPEN — never break the agent run on an engine/infra error.
+		console.error(`AGENT_CORE_GOVERN_ERROR ${(e as Error)?.message || String(e)}`);
+		return undefined;
+	}
+};