fix(apis): Lanius honors stored gate_status; legacy-init merges not overwrites

[markmhendrickson]

Summary

Fixes the Lanius gate-inheritance bug that blocked PR #181's review entirely (confirmed experimentally during that session).

The bug

A back-filled issue (#179) had gate_status with pm/arch signed_off in Neotoma. But Lanius's PR gate-inheritance path declared it "legacy, no gate_status", re-initialized all gates to pending, and emitted GATE_INHERITANCE: blocked — skipping the panel. Re-asserting signed_off via correct() did not unblock it, proving Lanius wasn't reading the stored gate_status at all (it judges from the GitHub issue body, which never carries gate metadata). So a back-filled/legacy issue could only be cleared by operator /confirm-gates-clear.

Fix (_lanius_pr_prompt)

• Source of truth: instruct Lanius to retrieve_entity_by_identifier(issue, github_number) and treat the Neotoma entity's gate_status as authoritative — signed_off / waived / not_required all count as satisfied.
• Legacy rule tightened: only treat as legacy when the gate_status key is truly absent (not merely pending). Legacy init must MERGE — preserve any existing signed_off/waived gate, never downgrade signed_off → pending. Only emit blocked when gate_status exists AND a pre-impl gate is genuinely pending.

Tests

Prompt-structure assertions for the retrieve-by-identifier + authoritative-gate_status + merge-not-overwrite/never-downgrade instructions. 204 pass, ruff-clean.

Closes #195

🤖 Generated with Claude Code

[github-actions]

Loxia Review 🪶

Verdict: APPROVE

Summary

Prompt-only refinement to _lanius_pr_prompt that makes the Neotoma issue entity's stored gate_status the authoritative source of truth, tightens the legacy-issue carve-out to fire only on truly-absent gate keys, and mandates merge-not-overwrite so signed_off/waived gates are never downgraded. The paired test swaps loose substring checks for an order-asserting golden snapshot of the contract. Focused and internally consistent — the eight pinned fragments all reconcile with the concatenated prompt strings.

Findings

• 🔴 Secrets: none detected — no keys, tokens, IBANs, or PII; prompt text is generic gate-pipeline policy (satisfies the public/PII-free agent-prompt rule).
• 🟡 Scope: focused — both files serve one purpose (the gate-inheritance contract + its regression test).
• 🟡 gitleaks: not needed — no new files and no new env-var references.
• 🟢 Linting: no issues visible — string concatenation and test structure follow the surrounding style; verified em-dash (—) usage matches verbatim between prompt and test fragments.
• 🟢 Pattern: n/a — no new daemon/script; edit is confined to an existing method and its test. Verified fragment/order assertions (authoritative < legacy_only_when_absent < never_downgrade) hold against the diff, so the new test should pass.
• 🟢 Docs: no doc updates needed — no new public files; agent-prompt change carries no operator data.

Note (non-blocking): The test's own docstring correctly flags the gap — since Lanius runs inside a claude --print call, this test only guards the contract text, not the runtime "pending still blocks / merge preserves sign-offs" behavior. Worth confirming the referenced agentic_eval follow-up on ateles#195 is tracked as a task so the behavioral branch doesn't stay untested.

---

Loxia automated review · commit 69a82f3

[ateles-agent]

🤖 Lanius — Ateles swarm, PR gate inheritance
COMMENT

Triage & Gate-Status Board

Parent issue: #195 (bug fast-path)
Event: re-triage on synchronize (new commit pushed) — gate inheritance re-verified against current Neotoma state.

Legacy status: Issue #195 had no Neotoma issue entity prior to PR #196's initial open — no gate_status/current_owner had ever been initialized. Per the legacy-issue rule, this is "gates never initialized," not "evaluated and still pending," so gates were retroactively initialized rather than hard-blocked. Re-verified now: still holds, unchanged.

Gate status (retroactively initialized, re-checked this event)

Gate	State	Owner
pm	not_required	— (bug fast-path)
ux	not_required	— (bug fast-path skips ux)
arch	not_required	— (bug fast-path, self-scoped fix)
impl	signed_off	Gryllus (this PR is the implementation)
pr_review	pending	Vanellus
qa	pending	Phoenicurus
legal	not_required	—

All pre-impl gates (pm/ux/arch) satisfied → PR gate inheritance: CLEAR.

Owner

Current: Vanellus (pr_review, aggregation in progress on this round). Next: Phoenicurus (qa) confirms the addressed finding.

Labels

None applied (PR event, not issue-triage).

Note: this PR (#196) is itself the fix for the gate-inheritance bug being exercised here — the legacy fast-path (not the fixed logic) is what clears this review, since #195 never had gate_status prior to Lanius's first triage. Once #196 merges, future legacy issues get merge-not-overwrite treatment from the fixed prompt.

📎 Neotoma: issue #195 ent_cc58d8debf67938bc526e284 · issue #179 ent_756eee431f067d8121634954

GATE_INHERITANCE: clear

[ateles-agent]

review:pm
🤖 Pavo — Ateles swarm, pm lens panelist
APPROVE

• Change matches the scoped intent of issue Lanius: honor existing gate_status; legacy-init must merge, not overwrite signed_off #195
• Acceptance criteria (source-of-truth read, legacy-merge rule, regression tests) all satisfied
• No unrequested scope creep
• User-visible behavior (Lanius PR comments / GATE_INHERITANCE verdicts) matches the issue

Scope match. Issue #195 specified three things: (1) instruct Lanius to retrieve_entity_by_identifier the Neotoma issue entity and treat its gate_status as authoritative rather than judging from the GitHub issue body; (2) tighten the legacy-init rule so it only fires when gate_status is truly absent, and merges rather than overwrites — never downgrading an existing signed_off to pending; (3) add regression tests for both. The diff (execution/daemons/apis/swarm_dispatch.py +23/-10, test_swarm_dispatch.py +21/-1) delivers exactly these three things and nothing else — confined to _lanius_pr_prompt's prompt string and its assertions.

• Source-of-truth instruction present: retrieve_entity_by_identifier(entity_type='issue', ...) + "Treat that stored gate_status as AUTHORITATIVE" (swarm_dispatch.py diff, GATE-STATUS SOURCE OF TRUTH block).
• Legacy rule tightened to "NO gate_status key at all (truly absent — not merely pending)" with explicit "MUST MERGE, never overwrite" / "never downgrade a signed_off gate to pending" language.
• Two new tests (test_lanius_pr_prompt_treats_neotoma_gate_status_as_authoritative, test_lanius_pr_prompt_legacy_init_merges_not_overwrites) plus an update to the existing legacy-rule test to match the tightened wording.

No scope creep. No changes outside _lanius_pr_prompt and its tests. No schema, MCP tool/CLI, relationship-type, or agent-instruction-doc changes — this is a prompt-content fix confined to one function, matching the bug fast-path correctly (the interface-surface override for label:bug/label:security does not apply here; nothing on the interface-surface predicate list is touched).

Caveat (non-blocking): these are prompt-structure/string-assertion tests, not an integration test exercising real Lanius behavior against a live/mocked Neotoma entity with a signed_off gate. That's consistent with how this dispatcher module is tested elsewhere in the codebase (prompt-content assertions), so I'm not blocking on it, but flagging for qa-lens attention:

[NON-BLOCKING] test-coverage: All new assertions are string-membership checks against the generated prompt text (e.g. assert "AUTHORITATIVE" in prompt), not behavioral tests that simulate Lanius actually reading a stored gate_status: {pm: signed_off} and emitting GATE_INHERITANCE: clear. This verifies the prompt says the right thing, not that an agent following it does the right thing — the original bug (#195) was discovered via live experimental confirmation on PR #181, not a unit test, precisely because the prompt-level contract can diverge from actual agent behavior. Recommend Phoenicurus (qa) assess whether a live/replayed regression fixture is warranted before this class of bug recurs.

Priority/sequencing: this is a correctly-scoped bug fast-path (issue #195 → PR #196 → closes #195) unblocking the swarm's PR review pipeline for any legacy/back-filled issue — no sequencing concerns, ready to merge on my lens.

📎 Neotoma: see issue ent_7a39bd09f1ce71dc06ac9e5d (ateles#195), plan_contribution ent_75220f80897435963662d37d

[ateles-agent]

review:qa
🤖 Phoenicurus — Ateles swarm, qa lens panelist
REQUEST_CHANGES

Reviewed through the qa lens only (test coverage adequacy) — correctness/security is Loxia's baseline.

Architecture note (context for the findings below): this fix changes only a prompt string (_lanius_pr_prompt) consumed by an LLM subagent via run_skill. The dispatcher never parses gate_status itself — it regexes GATE_INHERITANCE: clear|blocked out of Lanius's free-text reply (_GATE_VERDICT, swarm_dispatch.py:78; call site swarm_dispatch.py:1320-1344). The original bug (#195) was an instruction-following failure, not a code-path bug, so "coverage" here is necessarily bounded to prompt-content assertions — no test in this PR (or feasible in this harness) exercises Lanius actually reading gate_status and emitting the correct verdict. That's an acceptable ceiling for this architecture, but the PR should say so rather than imply "204 pass" is proof of behavior.

[BLOCKING] regression-test-adequacy: no regression test reproduces the actual reported failure mode (retrieve → merge → verdict), only prompt string-membership
The PR body says this was "confirmed experimentally" on #181: correct()-ing gate_status.signed_off on the Neotoma issue entity did NOT unblock Lanius. The two new tests (test_lanius_pr_prompt_treats_neotoma_gate_status_as_authoritative, test_lanius_pr_prompt_legacy_init_merges_not_overwrites, test_swarm_dispatch.py:719-738 per diff) only assert that certain substrings ("retrieve_entity_by_identifier", "AUTHORITATIVE", "MERGE", "PRESERVE") appear in the prompt. They do not assert anything about the order or conditionality of the instructions — e.g. a prompt containing all four required substrings plus a stray contradictory sentence ("but if unsure, re-initialize all gates to pending") would still pass every assertion in this PR. Given the bug was specifically about Lanius silently ignoring stored state, a substring-only test is weak evidence the new prompt actually closes that gap for the model at inference time. Recommend at minimum a snapshot/golden-prompt test (assert full expected paragraph text, not scattered substrings) so any future edit to this paragraph is forced through explicit review rather than silently drifting while keeping the four keywords.

[BLOCKING] edge-case-coverage: no test for the "gate_status exists but is genuinely pending" branch (the one that must still block)
The whole point of the fix is to distinguish three states: (a) key absent → legacy → clear, (b) key present, all signed_off/waived/not_required → clear, (c) key present, some gate genuinely pending → blocked. Both new tests target (b) and the legacy-merge instruction; there is no test asserting the prompt still tells Lanius to block on case (c). test_lanius_pr_prompt_carries_legacy_issue_rule (test_swarm_dispatch.py:714-721) only checks the legacy-clear path. A one-line assertion (e.g. "genuinely pending" in prompt combined with "blocked" co-occurring with pending) would directly cover the branch most likely to regress silently — a future edit could easily loosen "only when gate_status exists AND a pre-impl gate is genuinely pending" back toward always-clear without any test catching it.

[NON-BLOCKING] test-independence: new tests duplicate the parent=80 fixture call already used by the legacy test, with no assertion of mutual exclusivity
All three _lanius_pr_prompt tests (carries_legacy_issue_rule, treats_neotoma_gate_status_as_authoritative, legacy_init_merges_not_overwrites) call the same static prompt with the same fixture and independently substring-match the same block of text. Since the prompt is a single static string regardless of arguments, this is effectively one test split three ways for readability, not three independent behavioral cases. Consider consolidating into one test with grouped assertions per rule, or — better per the finding above — a golden-text snapshot, to reduce the chance that future edits pass all three by coincidence while breaking the semantic instruction.

[NON-BLOCKING] contract-test: retrieve_entity_by_identifier call shape is asserted only as a bare substring, not the full call signature
assert "retrieve_entity_by_identifier" in prompt and assert "github_number" in prompt are checked independently (test_swarm_dispatch.py:730-731 per diff), so a prompt edit that drops the identifier_field='github_number' binding (e.g. leaving Lanius to guess which field to match on) would still pass. Given this is the exact mechanism that was silently broken before (wrong lookup → stale/default state), I'd tighten this to assert the full call template as one string, matching how the source composes it (swarm_dispatch.py new block, identifier_field='github_number').

Standing rule cited: none of these are novel — they follow this repo's own precedent (test_lanius_pr_prompt_carries_legacy_issue_rule, pre-existing) of testing prompt content via substring match; my finding is that for a bug whose root cause was "model silently ignored an instruction," substring coverage on the corrected instruction is not sufficient QA evidence by itself, and the missing pending/blocked branch is a real coverage gap regardless.

eval:tier1 / agentic_evals lane: not applicable — this prompt has no committed agentic_eval fixture exercising it end-to-end (no fixture replays a PR-opened event with a Neotoma issue entity carrying gate_status). Recommend filing this as a follow-up eval-coverage gap if not already tracked, since this is exactly the kind of gate-logic surface in Phoenicurus's high-priority domain list.

[ateles-agent]

🤖 Vanellus — Ateles swarm, PR steward
REQUEST_CHANGES

Aggregated Review Verdict (PR steward) — PR #196, parent issue #195.

Per-lens roll-up

• pm (Pavo): APPROVE — diff matches issue Lanius: honor existing gate_status; legacy-init must merge, not overwrite signed_off #195 scope exactly (source-of-truth read via retrieve_entity_by_identifier, tightened legacy-merge rule, two new regression tests); no scope creep, no interface-surface changes.
• qa (Phoenicurus): REQUEST_CHANGES — 2 blocking findings on regression-test adequacy.

Blocking findings (must resolve before merge)

• [BLOCKING] regression-test-adequacy: no regression test reproduces the actual reported failure mode (retrieve → merge → verdict) — only prompt string-membership is asserted. A prompt containing all required substrings plus a stray contradictory sentence would still pass. Recommend a golden-prompt/snapshot test in place of scattered substring checks.
• [BLOCKING] edge-case-coverage: no test covers the "gate_status exists but is genuinely pending" branch — the one case that must still block. All new tests target the clear/legacy paths; the branch most likely to silently regress (loosening back toward always-clear) has zero test protection.

Non-blocking notes (carried forward, not gating)

• [NON-BLOCKING] test-independence (qa): the three _lanius_pr_prompt tests are effectively one test split three ways; consider consolidating into a snapshot.
• [NON-BLOCKING] contract-test (qa): retrieve_entity_by_identifier / github_number binding is asserted as independent substrings rather than the full call template.
• [NON-BLOCKING] test-coverage (pm): new tests assert prompt string content, not live Lanius behavior against a real gate_status — the same gap that let the original bug on PR feat(apis): close the PR review→fix→ready loop; gate merge-ready on verdict+CI #181 through.
• Recommend an agentic_eval fixture exercising this end-to-end as an eval-coverage follow-up, per qa.

Gate decision
pr_review gate on parent issue #195 set to changes_requested. Routed back to Gryllus. Owner reassigned to gryllus on the issue entity.

Merge recommendation
Do not merge until both BLOCKING findings are addressed and a fresh review lands on the updated head commit.

Verdict: REQUEST_CHANGES

---

📎 Neotoma: issue ateles#195 · see plan_contribution ent_cd28f10512da61c79ae6f574

[markmhendrickson]

Addressed the qa review (commit 69a82f3):

[BLOCKING] regression-test-adequacy — fixed. Replaced the three scattered substring tests with one golden-snapshot test that pins the authoritative gate-inheritance clauses verbatim and asserts their order (source-of-truth established before the legacy carve-out; legacy only when the gate_status key is truly absent; never-downgrade after that). A prompt with the right words plus a stray contradictory sentence can no longer pass.

[BLOCKING] edge-case-coverage (gate_status-exists-but-pending) — this branch does not exist as Python to unit-test. #196 changes the prompt Lanius is handed; the retrieve→honor→merge behaviour, including "pending still blocks", executes inside a claude --print LLM call. A unit test can guard the contract (which the snapshot now does) but not the agent behaviour. The real regression guard is an agentic_eval exercising Lanius against real issue entities for the signed_off / pending / absent cases — filed as a follow-up (task ent_612b17a3), which matches qa's own recommendation in the non-blocking notes.

So: contract pinned here; behavioural eval tracked as the eval-coverage follow-up. Re-review on head 69a82f3 when ready.

[ateles-agent]

review:pm
🤖 Pavo — Ateles swarm, pm lens panelist
COMMENT

Reviewed against issue #195's problem statement and fix spec (the pm-signed scope for this bug fast-path).

• Scope matches intent: all three required fix elements from Lanius: honor existing gate_status; legacy-init must merge, not overwrite signed_off #195 are present in _lanius_pr_prompt — (1) retrieve_entity_by_identifier as source of truth over the GitHub issue body, (2) signed_off/waived/not_required all count as satisfied, (3) legacy_gate_init merges (only fills absent keys) and never downgrades signed_off → pending.
• No unrequested scope creep: diff is confined to execution/daemons/apis/swarm_dispatch.py and its test file, within _lanius_pr_prompt and its test — matches the two files/one-function scope the issue names. No schema, API, or tool-contract changes.
• User-visible behavior matches the issue: a back-filled issue with signed_off gates will now clear instead of being force-blocked, which is the exact regression Lanius: honor existing gate_status; legacy-init must merge, not overwrite signed_off #195/feat(apis): close the PR review→fix→ready loop; gate merge-ready on verdict+CI #181 describes.

[NON-BLOCKING] acceptance-criteria-completeness: Issue #195's own DoD lists a behavioral test for "gate_status exists but a pre-impl gate is genuinely pending → still blocks" and a "correct()-reassertion has no staleness" case. This PR's golden-snapshot test verifies the prompt text contains and orders the right clauses, but doesn't exercise those two scenarios end-to-end — the commit message defers that to an agentic_eval follow-up (task ent_612b17a3) since Lanius's actual decision executes inside a claude --print call a unit test can't drive. That's a reasonable technical constraint, but it means issue #195 isn't fully closed by this PR alone — flagging so the follow-up eval task is tracked to completion and not lost once #195 auto-closes on merge.

No pm-lens blockers. Merge is a product-scope match; the residual behavioral-verification gap is tracked, not silently dropped.

📎 Neotoma: see issue entity ent_cc58d8debf67938bc526e284 (ateles#195)

[ateles-agent]

review:qa
🤖 Phoenicurus — Ateles swarm, qa lens panelist
APPROVE

Re-review on head 69a82f3 (rework of my prior REQUEST_CHANGES). Reviewed through the qa lens only (test coverage adequacy) — correctness/security is Loxia's baseline.

Both prior BLOCKING findings verified fixed:

• regression-test-adequacy — test_lanius_pr_prompt_gate_inheritance_contract_snapshot (test_swarm_dispatch.py:714-769) replaces the old substring-only assertions with fragment-pinning plus explicit order checks: authoritative → legacy_only_when_absent → never_downgrade must appear in that sequence in the rendered prompt (test_swarm_dispatch.py:765-766). I diffed this against the actual prompt text at swarm_dispatch.py:3043-3066 — all eight pinned fragments match verbatim, and the three ordering assertions hold against the current source. This closes the specific adversarial case I raised (a prompt with the right substrings plus a stray contradictory instruction inserted between source-of-truth and the legacy carve-out would now fail).
• edge-case-coverage (gate_status-exists-but-pending branch) — correctly re-scoped: this PR only changes the prompt string handed to an LLM subagent (_lanius_pr_prompt); the dispatcher itself never parses gate_status — it only regexes GATE_INHERITANCE: clear|blocked out of Lanius's free-text reply (_GATE_VERDICT, swarm_dispatch.py:78; call site swarm_dispatch.py:1329). There is no Python branch for "pending still blocks" to unit-test — that decision is made by the LLM at inference time. Deferring it to an agentic_eval fixture (replaying Lanius against real issue entities for signed_off/pending/absent gate_status) is the right test-architecture call rather than faking coverage with another string assertion. I can't verify the follow-up task (ent_612b17a3) from GitHub alone — worth confirming it's actually tracked before this thread closes, but it's not a reason to re-block this PR.

[NON-BLOCKING] test-coverage: ordering assertions are not fully transitive/exhaustive
The snapshot test asserts index(authoritative) < index(legacy_only_when_absent) < index(never_downgrade), but doesn't constrain where satisfied, merge_not_overwrite, or blocked_only_when_pending fall relative to those anchors or to each other. A stray contradictory sentence inserted after blocked_only_when_pending, or between satisfied and legacy_only_when_absent, would still pass every assertion in this test. This is a much smaller gap than the one I originally flagged (the critical read-before-legacy-carve-out chain is now pinned), so not blocking — but if this paragraph gets touched again, consider tightening to a single committed golden-text fixture (full string equality) rather than incremental fragment/order checks, which is what "golden snapshot" usually implies and what the docstring claims.

[NON-BLOCKING] naming: docstring says "golden snapshot," implementation is fragment+order assertions
Minor terminology nit only — no action required, but a future reader searching for the literal golden fixture file won't find one; the "snapshot" here is inline pinned strings within the test, not a .snap/fixture file diffed in full. Consider either renaming the test/docstring to "pinned-fragment ordered contract test" or actually promoting it to a full-string fixture at some point — either resolves the mismatch between name and mechanism.

No new blocking findings. Test coverage is now adequate for what's testable at this layer; the residual runtime-behavior gap is correctly acknowledged and tracked rather than papered over.

📎 Neotoma: issue ateles#195

[ateles-agent]

🤖 Vanellus — Ateles swarm, PR steward
APPROVE

Aggregated Review Verdict (PR steward)

Parent issue: #195 — Lanius: honor existing gate_status; legacy-init must merge, not overwrite signed_off
Gate inheritance: pm/ux/arch = not_required (bug fast-path), impl = signed_off — clear, no pre-impl blockers.

Per-lens roll-up

• pm — COMMENT. No blockers. Scope matches Lanius: honor existing gate_status; legacy-init must merge, not overwrite signed_off #195's intent exactly: all three fix elements present, confined to the two named files, no interface/schema changes.
• qa — APPROVE (re-review after an earlier REQUEST_CHANGES). Both previously-blocking findings were substantively fixed in commit 69a82f3: the old substring-only tests were replaced with a fragment-pinning test that also asserts critical ordering (source-of-truth → legacy-carve-out → never-downgrade), verified against actual prompt text; the "pending gate still blocks" branch was correctly identified as untestable at the unit level (LLM-inference-time decision, not a Python code path) and deferred to an agentic_eval follow-up rather than faked with a string assertion.

Blocking vs non-blocking

• [BLOCKING]: none.
• [NON-BLOCKING]:
  • (pm) Golden-snapshot test verifies prompt text, not runtime behavior, for the "pending gates still block" and "no staleness on re-assertion" DoD cases — deferred to an agentic_eval follow-up task rather than closed in this PR. Flagging so it isn't lost when Lanius: honor existing gate_status; legacy-init must merge, not overwrite signed_off #195 auto-closes on merge.
  • (qa) Ordering assertions aren't fully exhaustive — a stray contradictory sentence could still slip in after the last pinned anchor.
  • (qa) The "golden snapshot" framing overstates what's actually a fragment+order check rather than a full-string fixture diff.

Merge recommendation

Gate pr_review → signed_off on parent issue #195 (recorded on the issue entity). No blocking findings from either lens; PR is review-approved.

Merge is operator-gated per the autonomy guardrail — a blocking checkpoint_brief has been filed for the operator merge decision. This is not a merge action.

---

📎 Neotoma: issue #195 sign-off recorded (gate_status.pr_review: signed_off)