fix: BUG-001: workflow success can hide missing task evidence and failed agent execution

[andrei-hasna]

Objective

BUG-001: workflow success can hide missing task evidence and failed agent execution

Observed while launching platform-socializer on 2026-06-30.

Affected Socializer route: socializer-launch-backend-ready-drain (loop d449c31542ba), template todos-task-worker-verifier, provider codewith, worktree-mode required.

Symptoms:

• Workflow 786e16b5c0e9 for task 318fc023-58dd-47a0-b94e-6997cd9ce469 is marked succeeded, but adversarial audit reported worker/verifier shell execution was blocked before simple commands could run; Todos task remains pending and has no evidence comments.
• Workflows 8290b6d405d1 / eda80e8a and 93f937c12ced / f8919326 reached worker+verifier succeeded but left weak or missing task-level evidence.
• Route work-item state shows succeeded/admitted even when the task remains pending, which lets the ready queue continue while launch gates are not actually proven.

Expected:

• Worker/verifier agent failures or blocked tool execution must fail the workflow or mark the route item failed, not succeeded.
• The template should persist concise worker/verifier stdout summaries or evidence paths, and/or enforce a final task evidence gate before route success.
• Completion should require independent verifier completion and visible task evidence.

Current workaround:

• Paused Socializer backend drain d449c31542ba. UI lane remains active because c49bef80 has visible worker and independent verifier evidence.

Do not include secrets. Repro evidence is in /home/hasna/.hasna/loops/runs/platform-socializer and task comments for f8919326, 318fc023, 680d728f, 9ca7457e, f1b34411, eda80e8a.

Verification

• policy source: base 35c9ec6 (immutable commit — agent-proof)
• install: pass
• typecheck: pass
• build: pass
• test: pass

---

Run run_93bb8a518732 · backend codewith · task 1db49c9f-63d5-422c-959b-da16a65c7718
🏭 Generated by @hasnaxyz/factory

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}