fix(goals): decode quality-gate output as UTF-8 instead of the process codepage

[Drexuxux]

What

A /goal quality gate runs whatever command the operator configured, so its output is arbitrary bytes. run_gate captured it in text mode with no encoding:

proc = subprocess.run(
    gate.command, shell=True, capture_output=True, text=True,
    timeout=max(1, int(gate.timeout_seconds)), cwd=cwd or None,
)

That decodes with locale.getpreferredencoding() under the default errors="strict". One byte the decoder rejects — a test runner's checkmarks or CJK on a non-UTF-8 Windows console, a stray binary byte anywhere in the stream — kills subprocess's reader thread. proc.stdout comes back as None, the or "" fallback right below turns that into an empty tail, and an unhandled traceback lands on stderr:

Exception in thread Thread-3 (_readerthread):
  ...
UnicodeDecodeError: 'charmap' codec can't decode byte 0x90 in position 19: character maps to <undefined>
run_gate -> passed=True exit=0 tail=''

The verdict itself survives — it rides on the exit code. What is lost is the tail, and the tail is the whole point of the retry loop: evaluate_gates stores it as last_output_tail and feeds it back so the agent can fix what broke. Empty, the agent is told a gate failed and handed nothing to act on, so it burns max_retries and the goal auto-pauses with quality gate exhausted N retries.

workspace_fingerprint has the same two calls. There a non-ASCII path in git status --porcelain empties the fingerprint, which silently disables the unchanged-gate skip — the rule that exists so a stalled agent can't spin re-running an identical red suite.

The fix

Decode as UTF-8 with errors="replace" at all three call sites. That is what git and modern toolchains actually emit, and it is already the house style: 262 of the repo's 299 text-mode subprocess calls pass an explicit encoding. errors="replace" also means genuinely undecodable bytes degrade to replacement characters instead of destroying the surrounding diagnostics.

Same class as the open working_diff and cron-script decode fixes; this is the /goal gate path, which none of them touch.

Tests and results

test_run_gate_keeps_diagnostics_when_a_byte_will_not_decode runs a gate that prints a realistic failure line with one undecodable byte embedded and exits 1, then asserts the diagnostic text reaches the tail. It fails on main — AssertionError: gate diagnostics were lost to a decode failure (tail='') — and passes with the fix. The byte chosen is invalid under strict UTF-8 as well as the Windows ANSI codepages, so the test pins the behaviour on Linux CI, not only on the platform where I found it.

The three goals suites (test_goal_gates.py, test_goals.py, test_kanban_goal_mode.py) run to 57 passed with the fix versus 56 on main — the one added test — with the same single pre-existing failure both ways: test_run_gate_fail_captures_output, which shells out with POSIX syntax (echo broken >&2; exit 3) and does not run on a Windows shell. It is untouched by this change.

[teknium1]

Merged in #81963 — clean cherry-pick with authorship (goals run_gate + workspace_fingerprint decodes). Thanks!