Remediation: the consumption controller, the exit gate and the triage measurement

[tom-snyder]

Phase 7: the remediation tier. anvil remediate turns a sealed audit's findings into draft pull requests whose body is the evidence, and never merges.

What it does

• Consumption controller (internal/remediation): enqueues every patchable finding of a sealed audit (every Lane B unconfirmed one included), then per fix group leases, triages, generates, anchors SEARCH/REPLACE edits in the exact scanned blob, applies with git apply --3way, climbs the validation ladder, runs the exploit oracle, commits with three trailers and opens a draft pull request from a fork. The lease is renewed at every step boundary; a crash is recovered from the trailers.
• Triage gate: its verdict is its own statement in triage_verdict, never written over Lane B's evidence. It is off by default: its precision is unmeasured.
• Generation runs in its own process (anvil generate-isolated) whose whole environment is one marker variable; only the model endpoint's socket is allowed. Endpoints have a trust tier; a public hosted one is refused unless allowed, and warns.
• The target is untrusted: the build and tests run in bubblewrap on an export of the patched tree (no .git, no network, nothing else visible); git runs with hooks, fsmonitor and helpers off; only source files may be patched.
• Exploit oracle: the only road to "verified fixed"; it counts only mutated payloads that are live exploits on the scanned code. Nothing implements its replayer until Phase 8, so every proposal is labelled unverified-security for now.
• Pull requests: drafts only, at most three open per repository, supersession with a linking comment, stale closing, acceptance rate with its Wilson interval. The forge client can reach six routes and none merges; a push token that can write the upstream is refused.
• Store migration 0003 (additive): audit_record.audit_id, triage_verdict, remediation_log, fix_pr. A repository scan now records its base commit.
• anvil triage PATH runs the triage gate over a tree and records nothing; the triage-precision measurement drives it.

Evidence

• The remediation exit gate: docs/gates/remediation.json, fourteen structural rows, each citing a test that was seen failing under a deliberate mutation. TestNoGateTestCanSkip refuses a skip in any cited test; two stale conditional skips in internal/handoff became failures.
• Same-family adversarial review: docs/reviews/remediation-gate.md. Four blocking findings, all fixed and closed on the critic's re-check; eleven others fixed.
• Register: the owner's decisions of 2026-10-04 (patch-quality bars signed, CWE-Bench-Java skipped for v1, every GPU run deferred to after Phase 9); a new pre-registered row, triage-precision, whose CPU-only sample is drawn (1,034 labelled Lane B candidates on Juliet, base rate 0.415).

Not proven here

No model has run the tier, and no real repository has been touched (an in-process forge only). Patch quality, task cards and triage precision wait for the GPU runs after Phase 9; batch size waits for real pull requests. Where a host lacks bubblewrap or unprivileged user namespaces, the build sandbox refuses to run, and its test proves the refusal rather than the confinement (docs/controls.md, U12).