Context
PR #8711 exposed a real production misalignment: a third-party check ("Contributor trust", app slug `superagent-security`) concluded `action_required`, GitHub reported `mergeable_state: unstable`, and ORB's four decision surfaces each did something different — the unified comment said "Manual Review", the planner posted an APPROVE review claiming "gate satisfied and CI green", the review-state label said ready-to-merge, the merge was silently never planned (`mergeableClean` requires `"clean"`), and the correct hold reason was written only to the internal `audit_events` table. A human had to notice and merge manually.
A full adversarial audit of the disposition pipeline (comment renderer, disposition planner, executor, label propagation) plus a parallel audit of the calibration/self-learning stack produced this epic. Three tracks:
A — disposition alignment (the bug class): every surface re-derives its own predicate over `mergeableState`; comment treats `{dirty,behind,unstable}` as held, merge requires `=== "clean"`, approve only excludes `"dirty"`, and the hold-label logic reads mergeableState not at all.
B — calibration data quality: rule-fired signals only record when a gate is in `block` mode (defaults are advisory/off → corpus starvation), and only AI-judgment codes ever receive `confirmed` overrides (every other rule's precision is structurally biased toward 0 as data accumulates).
C — activation + dead-end closure: the self-tune/review-memory/knob-autotune loops are fully built, held-out-validated, and all flag-OFF in production; two reporting surfaces (track-record rollup, counterfactual-replay results) are computed but never scheduled/persisted.
Immediate operational mitigation (already applied, config-only): `gate.advisoryCheckRuns` now declares the "Contributor trust" check on the affected deployment, routing a flagged PR to the loud manual-review hold path (#4372) instead of the silent stall.
Sub-issues
Attached as native sub-issues; blocked-by edges reflect real ordering constraints only.
Boundaries
No behavior changes to close/merge authority semantics beyond what each sub-issue explicitly scopes. Calibration data-model changes must stay additive (no rewriting recorded history).
Context
PR #8711 exposed a real production misalignment: a third-party check ("Contributor trust", app slug `superagent-security`) concluded `action_required`, GitHub reported `mergeable_state: unstable`, and ORB's four decision surfaces each did something different — the unified comment said "Manual Review", the planner posted an APPROVE review claiming "gate satisfied and CI green", the review-state label said ready-to-merge, the merge was silently never planned (`mergeableClean` requires `"clean"`), and the correct hold reason was written only to the internal `audit_events` table. A human had to notice and merge manually.
A full adversarial audit of the disposition pipeline (comment renderer, disposition planner, executor, label propagation) plus a parallel audit of the calibration/self-learning stack produced this epic. Three tracks:
A — disposition alignment (the bug class): every surface re-derives its own predicate over `mergeableState`; comment treats `{dirty,behind,unstable}` as held, merge requires `=== "clean"`, approve only excludes `"dirty"`, and the hold-label logic reads mergeableState not at all.
B — calibration data quality: rule-fired signals only record when a gate is in `block` mode (defaults are advisory/off → corpus starvation), and only AI-judgment codes ever receive `confirmed` overrides (every other rule's precision is structurally biased toward 0 as data accumulates).
C — activation + dead-end closure: the self-tune/review-memory/knob-autotune loops are fully built, held-out-validated, and all flag-OFF in production; two reporting surfaces (track-record rollup, counterfactual-replay results) are computed but never scheduled/persisted.
Immediate operational mitigation (already applied, config-only): `gate.advisoryCheckRuns` now declares the "Contributor trust" check on the affected deployment, routing a flagged PR to the loud manual-review hold path (#4372) instead of the silent stall.
Sub-issues
Attached as native sub-issues; blocked-by edges reflect real ordering constraints only.
Boundaries
No behavior changes to close/merge authority semantics beyond what each sub-issue explicitly scopes. Calibration data-model changes must stay additive (no rewriting recorded history).