fix(TASK-018): harden verdict_gate fault routing and widen default_lanes fallback

Adversary finding 1: verdict_gate treated any lane report CONTAINING
'PIPELINE-FAULT:' as a lane fault, so a real review quoting the marker
silently bypassed red-finding counting and sentinel parsing. Lane-fault
detection is now precise — only a report that IS the lane_fault.py
marker (starts with it) routes to the fault rule. Adds the missing
regression tests: reds block despite MERGE-READY, NEEDS-HUMAN without
reds passes with attention, probe INCONCLUSIVE blocks with the
environment note, a gate crash fails closed, and a quoting report is
routed to the red rule, not the fault rule.

Adversary finding 2: default_lanes overwrote caller-forced lanes and
dropped the security lane the deterministic signals guaranteed. The
fallback now unions its defaults with caller-forced lanes (canonicalized
via the same aliases build_items uses) and forces security on
auth/deps/exec signals or hardened posture — selection degrades wider,
never narrower, and stays deterministic via a fixed lane order. Tests
cover forced-lane survival, alias canonicalization, unknown-name
tolerance, each security signal, and determinism.

assets/agents/review-gauntlet/graph.yaml

@@ -235,7 +235,7 @@ nodes:
   default_lanes:
     id: default_lanes
     type: script
-    description: Deterministic lane-selection fallback (reached only via select_lanes' fallback) — forces code-review + adversary, plus probe when consumer_surface, when the additive LLM judgment dies. Selection degrades WIDER, never narrower; the degradation note flows into lanes_summary via build_items.
+    description: Deterministic lane-selection fallback (reached only via select_lanes' fallback) — when the additive LLM judgment dies, forces code-review + adversary, plus probe when consumer_surface, plus security on attack-surface signals (auth/deps/exec) or hardened posture, unioned with any caller-forced lanes. Selection degrades WIDER, never narrower; the degradation note flows into lanes_summary via build_items.
     script: scripts/default_lanes.py
     timeout: 30
     next: build_items

assets/agents/review-gauntlet/scripts/default_lanes.py

@@ -3,10 +3,13 @@
 
 Reached ONLY via select_lanes' `fallback:` route, when the additive LLM
 judgment dies after retries. Emits `forced_lanes` — code-review + adversary,
-plus probe when the deterministic signals flagged a consumer-facing
-surface — which build_items honors exactly, so selection degrades WIDER,
-never narrower. The degradation note goes into `lanes_degraded`; build_items
-folds it into lanes_summary so the final report names the degradation.
+plus probe when the deterministic signals flagged a consumer-facing surface,
+plus security when the attack-surface signals (auth/deps/exec) or a hardened
+posture demand it, unioned with any lanes the caller forced (canonicalized
+with the same aliases build_items uses) — which build_items honors exactly,
+so selection degrades WIDER, never narrower. The degradation note goes into
+`lanes_degraded`; build_items folds it into lanes_summary so the final
+report names the degradation.
 """
 
 import json
@@ -14,6 +17,27 @@ import os
 
 MAX_DETAIL_CHARS = 500
 
+# Keep in sync with build_items.ALIASES — a caller-forced lane must
+# canonicalize the same way here as it would on the non-degraded path.
+ALIASES = {
+    "code-review": "code-review",
+    "code_review": "code-review",
+    "code-reviewer": "code-review",
+    "adversary": "adversary",
+    "adversarial": "adversary",
+    "adversarial-review": "adversary",
+    "security": "security",
+    "security-review": "security",
+    "security-reviewer": "security",
+    "probe": "probe",
+    "usage": "probe",
+    "usage-pattern": "probe",
+    "usage-pattern-testing": "probe",
+}
+
+# Stable emission order keeps the fallback deterministic.
+LANE_ORDER = ["code-review", "adversary", "security", "probe"]
+
 
 def load_state():
     if path := os.environ.get("GRAPH_STATE_FILE"):
@@ -24,9 +48,24 @@ def load_state():
 
 def main():
     state = load_state()
-    forced = ["code-review", "adversary"]
+    lanes = {"code-review", "adversary"}
     if state.get("consumer_surface"):
-        forced.append("probe")
+        lanes.add("probe")
+    # The deterministic security signals are already in state when this
+    # fallback runs; a degraded selection must never drop the security lane
+    # build_items' hard rules would have selected.
+    if (
+        state.get("touches_auth")
+        or state.get("touches_deps")
+        or state.get("touches_exec")
+        or state.get("security_posture") == "hardened"
+    ):
+        lanes.add("security")
+    # Caller-forced lanes survive degradation — union, never overwrite.
+    for lane in state.get("forced_lanes") or []:
+        if canon := ALIASES.get(str(lane).strip().lower()):
+            lanes.add(canon)
+    forced = [lane for lane in LANE_ORDER if lane in lanes]
     raw = state.get("select_lanes_failure")
     detail = raw.strip().replace("\n", " ") if isinstance(raw, str) else ""
     if len(detail) > MAX_DETAIL_CHARS:

assets/agents/review-gauntlet/scripts/verdict_gate.py

@@ -5,9 +5,11 @@ Parses each configured lane's verdict SENTINEL with a regex — no LLM
 re-reads, no judgment. The gate's hard rules:
 
   - a missing sentinel is a LANE FAILURE and blocks — never a pass;
-  - a PIPELINE-FAULT lane result (the lane's agent died after retries) or a
-    PIPELINE-FAULT in signals_error (builder/parse fault) blocks — a
-    degraded pipeline is never a pass;
+  - a PIPELINE-FAULT lane result (the lane's agent died after retries;
+    detected only when the report IS the lane_fault.py marker, i.e. it
+    STARTS with it — a real review merely quoting the marker flows to the
+    normal rules) or a PIPELINE-FAULT in signals_error (builder/parse
+    fault) blocks — a degraded pipeline is never a pass;
   - any 🔴 finding in the code-review report blocks regardless of the
     lane's own verdict line;
   - NEEDS-HUMAN without 🔴 passes but is surfaced as attention required;
@@ -49,6 +51,13 @@ def main():
         )
         return line.strip()[:200]
 
+    def is_lane_fault(report):
+        # A genuine lane fault is the ENTIRE report emitted by lane_fault.py,
+        # which always begins with the marker. Matching the marker anywhere
+        # would let a real review that merely QUOTES "PIPELINE-FAULT:" bypass
+        # 🔴 counting and sentinel parsing.
+        return report.strip().startswith("PIPELINE-FAULT:")
+
     def lane_fault_blocker(lane, report):
         blockers.append(
             f"{lane}: PIPELINE-FAULT — the lane failed after retries and produced "
@@ -60,7 +69,7 @@ def main():
     cr = lane_report("code_review_results")
     if cr is None:
         record("code-review", "SKIPPED", "not selected")
-    elif "PIPELINE-FAULT:" in cr:
+    elif is_lane_fault(cr):
         lane_fault_blocker("code-review", cr)
         reports.append(("code-review", cr))
     else:
@@ -91,7 +100,7 @@ def main():
     adv = lane_report("adversary_results")
     if adv is None:
         record("adversary", "SKIPPED", "not selected")
-    elif "PIPELINE-FAULT:" in adv:
+    elif is_lane_fault(adv):
         lane_fault_blocker("adversary", adv)
         reports.append(("adversary", adv))
     else:
@@ -114,7 +123,7 @@ def main():
     sec = lane_report("security_results")
     if sec is None:
         record("security", "SKIPPED", "not selected")
-    elif "PIPELINE-FAULT:" in sec:
+    elif is_lane_fault(sec):
         lane_fault_blocker("security", sec)
         reports.append(("security", sec))
     else:
@@ -135,7 +144,7 @@ def main():
     pb = lane_report("probe_results")
     if pb is None:
         record("probe", "SKIPPED", "not selected")
-    elif "PIPELINE-FAULT:" in pb:
+    elif is_lane_fault(pb):
         lane_fault_blocker("probe", pb)
         reports.append(("probe", pb))
     else: