fix(guard_tree): a passing guard's UNMEASURED / SUMMARY lines reach the log — a bare PASS could not say "not measured here" (PMAT-3651)

docs/audits/quorum-PMAT-3651.json

@@ -0,0 +1,171 @@
+{
+  "ticket": "PMAT-3651",
+  "base": "origin/main",
+  "base_resolved": "origin/main",
+  "base_note": "no origin/origin/main exists; judged against the local ref",
+  "head": "09ea6b5a36f6a18a40735481f81b4d6d622e4910",
+  "diff_sha256": "16860b2a04b90581da01cab5f669a0edcafe29e53e8a5d86bd9416c11814e007",
+  "width": 3,
+  "executor": "agy",
+  "prompt_mode": "inline",
+  "prompt_bytes": 15106,
+  "author": {
+    "model": "claude-opus-5",
+    "family": "claude",
+    "source": "flag"
+  },
+  "agreed": true,
+  "lanes": [
+    {
+      "lane": 1,
+      "status": "SUCCESS",
+      "verdict": "PASS",
+      "summary": "The diff perfectly satisfies all acceptance criteria for PMAT-3651. `guard_tree.sh` correctly surfaces `UNMEASURED` and `SUMMARY` pass lines using `awk`, limiting output to 5 lines with a count for any extras, and only matches them as the first token. `check_fleet_pv_shapes_gate.sh` successfully re-prints its measured pass row with the `SUMMARY` prefix. The tests in `guard_tree_test.sh` are robust, verifying the cap, the mid-line exclusions, silent pass behavior, and importantly, including a mutation test to guarantee the assertions properly catch failures. Nothing out of scope (like closing #3567) is touched.",
+      "findings": [],
+      "raw_bytes": 3395,
+      "err_bytes": 0,
+      "envelope_status": "SUCCESS",
+      "verdict_source": "structured_output",
+      "grounding_check": "parity",
+      "model": "gemini-3.1-pro-high",
+      "model_measured": "gemini-3.1-pro-high",
+      "model_source": "measured",
+      "family": "gemini"
+    },
+    {
+      "lane": 2,
+      "status": "SUCCESS",
+      "verdict": "PASS",
+      "summary": "The diff perfectly aligns with PMAT-3651. It introduces the `surface_pass_summary` awk script in `guard_tree.sh` to extract and cap the necessary lines, modifies `check_fleet_pv_shapes_gate.sh` to correctly prefix `SUMMARY` on a `PASS` verdict so it's picked up by `guard_tree`, and includes extensive tests in `guard_tree_test.sh` that assert the surfacing, the 5-line cap, the mutant failure, and ignore midline matches. No requirements are violated.",
+      "findings": [
+        {
+          "claim": "The guard_tree.sh correctly surfaces lines starting with UNMEASURED or SUMMARY, indented and capped at 5 lines + count",
+          "file": "scripts/guard_tree.sh",
+          "grounding": "cited",
+          "line": 253
+        },
+        {
+          "claim": "check_fleet_pv_shapes_gate.sh pass row is prefixed with SUMMARY so that it reaches the log",
+          "file": "scripts/check_fleet_pv_shapes_gate.sh",
+          "grounding": "cited",
+          "line": 207
+        },
+        {
+          "claim": "guard_tree_test.sh adds tests for the surfaced rows, the cap, the midline negative case, and the mutant",
+          "file": "scripts/tests/guard_tree_test.sh",
+          "grounding": "cited",
+          "line": 557
+        }
+      ],
+      "raw_bytes": 4222,
+      "err_bytes": 0,
+      "envelope_status": "SUCCESS",
+      "verdict_source": "structured_output",
+      "grounding_check": "parity",
+      "model": "gemini-3.1-pro-low",
+      "model_measured": "gemini-3.1-pro-low",
+      "model_source": "measured",
+      "family": "gemini"
+    },
+    {
+      "lane": 3,
+      "status": "SUCCESS",
+      "verdict": "PASS",
+      "summary": "Lane 3 of 3 Independent Review for PMAT-3651: PASS. The diff satisfies all acceptance criteria in issue #3651. 1) guard_tree.sh surfaces lines starting with UNMEASURED or SUMMARY under PASS rows (indented '      ~ ', capped at 5 lines + (+N more) count). 2) check_fleet_pv_shapes_gate.sh re-prints passing rows as SUMMARY PASS verdict=... for log surfacing. 3) guard_tree_test.sh tests 22-27 pass cleanly, including non-vacuous mutation check 27. No gates weakened, no out-of-scope changes.",
+      "findings": [
+        {
+          "claim": "guard_tree.sh surfaces lines starting with UNMEASURED or SUMMARY under PASS rows, capped at 5 lines plus (+N more) count",
+          "command": "bash scripts/tests/guard_tree_test.sh",
+          "file": "scripts/guard_tree.sh",
+          "grounding": "measured",
+          "line": 233,
+          "output": "PASS  22: a passing guard's UNMEASURED line is surfaced under its PASS row (no opt-in)\nPASS  23: a passing guard's SUMMARY line is surfaced; its other output is not\nPASS  24: the words mid-line (or as a prefix of another word) are not markers\nPASS  25: a silent passing guard prints its PASS row and nothing under it\nPASS  26: seven SUMMARY lines are capped at 5 plus a (+2 more) count\nPASS  27: mutant with the surfacing deleted loses rows 22 and 23 (the assertion can fail)\n29 checks, 0 failed"
+        },
+        {
+          "claim": "check_fleet_pv_shapes_gate.sh re-prints a measured PASS row with a SUMMARY prefix so guard_tree.sh captures and surfaces it in CI logs",
+          "command": "bash scripts/check_fleet_pv_shapes_gate.sh --self-test",
+          "file": "scripts/check_fleet_pv_shapes_gate.sh",
+          "grounding": "measured",
+          "line": 205,
+          "output": "=== fleet pv shapes gate: case table (stub pvs, no network, no real fleet binary) ===\nok    row 1  capable pv + Pass verdict -> PASS, row names the runner\nok    row 2  a measured PASS is re-printed as SUMMARY <row> for the guard-tree log\n...\nSELF-TEST PASSED: 11 rows"
+        }
+      ],
+      "raw_bytes": 5912,
+      "err_bytes": 100,
+      "envelope_status": "SUCCESS",
+      "verdict_source": "structured_output",
+      "grounding_check": "parity",
+      "model": "gemini-3.6-flash-high",
+      "model_measured": "gemini-3.6-flash-high",
+      "model_source": "measured",
+      "family": "gemini"
+    }
+  ],
+  "dissent": [],
+  "dedup": [
+    {
+      "file": "scripts/check_fleet_pv_shapes_gate.sh",
+      "line": 205,
+      "lanes_agreeing": [
+        3
+      ],
+      "claims": [
+        "check_fleet_pv_shapes_gate.sh re-prints a measured PASS row with a SUMMARY prefix so guard_tree.sh captures and surfaces it in CI logs"
+      ]
+    },
+    {
+      "file": "scripts/check_fleet_pv_shapes_gate.sh",
+      "line": 207,
+      "lanes_agreeing": [
+        2
+      ],
+      "claims": [
+        "check_fleet_pv_shapes_gate.sh pass row is prefixed with SUMMARY so that it reaches the log"
+      ]
+    },
+    {
+      "file": "scripts/guard_tree.sh",
+      "line": 233,
+      "lanes_agreeing": [
+        3
+      ],
+      "claims": [
+        "guard_tree.sh surfaces lines starting with UNMEASURED or SUMMARY under PASS rows, capped at 5 lines plus (+N more) count"
+      ]
+    },
+    {
+      "file": "scripts/guard_tree.sh",
+      "line": 253,
+      "lanes_agreeing": [
+        2
+      ],
+      "claims": [
+        "The guard_tree.sh correctly surfaces lines starting with UNMEASURED or SUMMARY, indented and capped at 5 lines + count"
+      ]
+    },
+    {
+      "file": "scripts/tests/guard_tree_test.sh",
+      "line": 557,
+      "lanes_agreeing": [
+        2
+      ],
+      "claims": [
+        "guard_tree_test.sh adds tests for the surfaced rows, the cap, the midline negative case, and the mutant"
+      ]
+    }
+  ],
+  "uncovered": [],
+  "coverage_source": "lanes",
+  "partial": false,
+  "partial_reasons": [],
+  "auto_merge": {
+    "checked": true,
+    "was_armed": false,
+    "disarmed": false,
+    "note": "auto-merge not armed"
+  },
+  "lint": {
+    "ok": true,
+    "output": "receipt complete: kind=artifact lanes=3 author=claude-opus-5/claude"
+  }
+}

docs/roadmaps/entries/PMAT-3651.yaml

@@ -0,0 +1,17 @@
+- id: PMAT-3651
+  github_issue: 3651
+  item_type: task
+  title: 'guard_tree.sh drops a passing guard''s output — an UNMEASURED exit-0 reads as PASS in every CI log, so #3567''s verdict can never be observed'
+  status: planned
+  priority: critical
+  assigned_to: null
+  created: 2026-09-21T05:28:51Z
+  updated: 2026-09-21T05:28:51Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels:
+  - kind:code
+  notes: 'ACCEPTANCE (quoted from issue #3651 "What lands"): 1. guard_tree.sh: under a PASS row, surface every captured line whose first token is UNMEASURED or SUMMARY (indented "      ~ ", capped at 5 lines + a "(+N more)" count so a chatty guard cannot flood the log). Lines where the word is not the first token are not surfaced. A guard opts a pass-summary in by printing SUMMARY …; an UNMEASURED line is surfaced whether or not the guard opted in. 2. check_fleet_pv_shapes_gate.sh: its pass row is printed as SUMMARY PASS verdict=… so the measured row reaches the log. 3. scripts/tests/guard_tree_test.sh rows: UNMEASURED surfaced; SUMMARY surfaced; the word mid-line not surfaced; a silent pass prints only its PASS row; the cap; and a mutant with the surfacing removed goes RED. NOT in scope: closing #3567 (that needs one guard-tree run on an intel runner after this lands), and the fleet pv''s own verdict.'

docs/roadmaps/roadmap.yaml

@@ -18990,3 +18990,20 @@ roadmap:
   labels:
   - kind:code
   notes: 'ACCEPTANCE (hand-entered from issue #3627 done_when; minted on the PR branch so the AD-04 quorum can run -- pmat work status refuses a missing item). Done when: contracts/rmsnorm-kernel-v1.yaml Scale invariance obligation carries either the ε>0 formal or the α²·mean(x²) ≫ ε precondition; pv validate passes ~~regenerated with pv probar --binding~~ **WITHDRAWN 21:40Z** — b3 measured that pv probar --binding emits 7 #[ignore = "no binding available"] stubs for this contract; the tracked file''s 5 real tests were produced by the pre-monorepo external generator (20dda945b, 2026-02-18) and the header is false (class row: #3630). Instead: the tracked test is edited **directly**, the commit says so, and the file''s header is replaced by a true one (hand-maintained, contract-bound) the minimal input above ([0.0, -0.15964308], α=0.012254778) is a committed regression case that PASSES under the new assertion (i.e. the fixed test is exercised on the exact input that killed #3621), and a mutation that restores the ε=0 assertion turns it RED cargo'
+- id: PMAT-3651
+  github_issue: 3651
+  item_type: task
+  title: 'guard_tree.sh drops a passing guard''s output — an UNMEASURED exit-0 reads as PASS in every CI log, so #3567''s verdict can never be observed'
+  status: planned
+  priority: critical
+  assigned_to: null
+  created: 2026-09-21T05:28:51Z
+  updated: 2026-09-21T05:28:51Z
+  spec: null
+  acceptance_criteria: []
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels:
+  - kind:code
+  notes: 'ACCEPTANCE (quoted from issue #3651 "What lands"): 1. guard_tree.sh: under a PASS row, surface every captured line whose first token is UNMEASURED or SUMMARY (indented "      ~ ", capped at 5 lines + a "(+N more)" count so a chatty guard cannot flood the log). Lines where the word is not the first token are not surfaced. A guard opts a pass-summary in by printing SUMMARY …; an UNMEASURED line is surfaced whether or not the guard opted in. 2. check_fleet_pv_shapes_gate.sh: its pass row is printed as SUMMARY PASS verdict=… so the measured row reaches the log. 3. scripts/tests/guard_tree_test.sh rows: UNMEASURED surfaced; SUMMARY surfaced; the word mid-line not surfaced; a silent pass prints only its PASS row; the cap; and a mutant with the surfacing removed goes RED. NOT in scope: closing #3567 (that needs one guard-tree run on an intel runner after this lands), and the fleet pv''s own verdict.'

scripts/check_fleet_pv_shapes_gate.sh

@@ -148,6 +148,8 @@ STUB
     mkpv "$d/pv_ok" capable Pass
     out=$(FLEET_PV_BIN="$d/pv_ok" FLEET_PV_PIN="$d/pin" FLEET_PV_CONTRACTS="$d/contracts" RUNNER_NAME=probe-runner bash "$0" 2>&1); rc=$?
     [ "$rc" -eq 0 ] && grep -q '^PASS .*verdict=Pass.*runner=probe-runner' <<<"$out" && ok "capable pv + Pass verdict -> PASS, row names the runner" || nok "expected PASS row, got rc=$rc: $out"
+    # 1b. ...and re-prints it as SUMMARY, the line guard_tree.sh carries into the CI log (#3651)
+    [ "$rc" -eq 0 ] && grep -q '^SUMMARY PASS .*verdict=Pass.*runner=probe-runner.*version=' <<<"$out" && ok "a measured PASS is re-printed as SUMMARY <row> for the guard-tree log" || nok "expected a SUMMARY PASS row, got rc=$rc: $out"
 
     # 2. PLANTED VIOLATION: lint says Fail -> the guard is RED (verdict parsed, not grepped)
     mkpv "$d/pv_fail" capable Fail
@@ -165,7 +167,7 @@ STUB
 
     # 5. no pin -> UNMEASURED, exit 0, the row says so and names the runner and infra#708
     out=$(FLEET_PV_BIN="$d/pv_ok" FLEET_PV_PIN="$d/no-such-pin" FLEET_PV_CONTRACTS="$d/contracts" RUNNER_NAME=never-converged bash "$0" 2>&1); rc=$?
-    [ "$rc" -eq 0 ] && grep -q '^UNMEASURED runner=never-converged.*infra#708' <<<"$out" && ! grep -q '^PASS' <<<"$out" && ok "no pin -> UNMEASURED row (exit 0, never a PASS line)" || nok "expected UNMEASURED row, got rc=$rc: $out"
+    [ "$rc" -eq 0 ] && grep -q '^UNMEASURED runner=never-converged.*infra#708' <<<"$out" && ! grep -qE '^(SUMMARY )?PASS' <<<"$out" && ok "no pin -> UNMEASURED row (exit 0, never a PASS line)" || nok "expected UNMEASURED row, got rc=$rc: $out"
 
     # 6. pv's own control silent (pc_shape != fired) -> RED even with verdict=Pass
     mkpv "$d/pv_silent" capable Pass silent
@@ -200,7 +202,15 @@ echo "=== shapes gate on the FLEET-PINNED pv, on this runner (check_fleet_pv_sha
 # The row is the verdict. No trailer may begin with PASS unless the row did: a trailer
 # reading "PASS-OR-UNMEASURED" is exactly what a consumer's grep would misread (the
 # self-test's row 5 refused it).
+# A measured PASS is re-printed as `SUMMARY <row>`: guard_tree.sh surfaces SUMMARY
+# and UNMEASURED lines under a passing guard (#3651), so the runner, pv, version,
+# verdict and corpus reach the CI log instead of a bare "PASS" (#3567). UNMEASURED
+# needs no SUMMARY -- guard_tree surfaces it unasked.
 row=$(judge 2>&1); rc=$?
 printf '%s\n' "$row"
-case "$rc" in 0) printf '%s\n' "${row%% *}";; 1) echo "FAIL" >&2;; *) echo "ENV (rc=$rc)" >&2;; esac
+case "$rc" in
+    0) case "$row" in "PASS "*) printf 'SUMMARY %s\n' "$row" ;; *) printf '%s\n' "${row%% *}" ;; esac ;;
+    1) echo "FAIL" >&2 ;;
+    *) echo "ENV (rc=$rc)" >&2 ;;
+esac
 exit "$rc"

scripts/guard_tree.sh

@@ -233,6 +233,30 @@ advertises_self_test() {
 # process group with it, a pool that is torn down) leaves rows and no verdict,
 # and the parent turns a MISSING verdict into a FAILURE -- fail-closed. The
 # one thing a run-all dispatcher may never do is drop a guard quietly.
+# A PASS ROW IS NOT A VERDICT WHEN THE GUARD SAID "NOT MEASURED" (#3651).
+# A passing guard's output was dropped: only its label reached the log. Twelve
+# guards exit 0 on UNMEASURED by design (a runner without the tool must not red
+# every PR), so `PASS  <guard> [run]` meant either "measured and passed" or "not
+# measured here", and the log could not say which -- main run 35561048727 showed
+# check_fleet_pv_shapes_gate.sh as a bare PASS on gx10-build, and #3567's
+# criterion (the verdict measured inside a runner) was unobservable anywhere.
+#
+# So under a PASS row, every captured line whose FIRST token is UNMEASURED or
+# SUMMARY is surfaced, indented `      ~ `. UNMEASURED needs no opt-in: a guard
+# that says it did not measure is heard whether or not it meant to be. SUMMARY
+# is how a guard puts its measured row (runner, tool, version, verdict, corpus)
+# into the log. The word anywhere else on a line is not a marker. Capped at 5
+# lines plus a count, so a chatty guard cannot bury the rows around it.
+surface_pass_summary() { # surface_pass_summary <capture-file>
+    awk '
+        /^(UNMEASURED|SUMMARY)([[:space:]]|$)/ {
+            n++
+            if (n <= 5) printf "      ~ %s\n", $0
+        }
+        END { if (n > 5) printf "      ~ (+%d more UNMEASURED/SUMMARY line(s))\n", n - 5 }
+    ' "$1"
+}
+
 worker_run_one() {
     spec="$1"
     w_idx="${spec%%:*}"
@@ -254,6 +278,7 @@ worker_run_one() {
         w_total=$((w_total + 1))
         if "$@" >"$w_cap" 2>&1; then
             printf 'PASS  %s\n' "$label" >> "$w_rows"
+            surface_pass_summary "$w_cap" >> "$w_rows"
         else
             w_failed=$((w_failed + 1))
             printf 'FAIL  %s\n' "$label" >> "$w_rows"