fix(autofix): make the brake's BLOCKED handoff a first-class round outcome

.github/scripts/run-autofix-review-verification.sh

@@ -354,7 +354,19 @@ run_check_no_ab 'cross-package contract verification failed' \
 assert_verification_tree
 
 if git diff --quiet "origin/${BRANCH}...${BRANCH}"; then
-  # No new commit. That is only legitimate as a deliberate no-action.
+  # No new commit. A handoff with no failure.md is the deliberate kind: the
+  # agent stopped under instruction (the growth-brake BLOCKED stop) and
+  # deferred this item to a human. Name it — "produced nothing" is what a
+  # crash looks like, and the report must tell the two apart. (When
+  # failure.md coexists, the round came through a failure path — harness
+  # death or a pre-verdict crash — and keeps the failed classification.)
+  if [[ -s "${WORKDIR}/handoff.md" && ! -s "${WORKDIR}/failure.md" ]]; then
+    echo "🤝 Branch unchanged with a handoff — the agent stopped under instruction and deferred this item to a human:"
+    cat "${WORKDIR}/handoff.md"
+    echo "outcome=handoff" >> "${GITHUB_OUTPUT}"
+    exit 0
+  fi
+  # Otherwise no commit is only legitimate as a deliberate no-action.
   if [[ -s "${WORKDIR}/no-action.md" ]]; then
     echo "🟰 No action needed:"
     cat "${WORKDIR}/no-action.md"

.github/workflows/qwen-autofix.yml

@@ -5768,7 +5768,14 @@ jobs:
             echo "verified_head=${VERIFIED_HEAD}" >> "${GITHUB_OUTPUT}"
           fi
           case "${OUTCOME}" in
-            fixed|noop) ;;
+            # handoff is a deliberate verdict, not a failure: the agent
+            # stopped under instruction (the growth-brake BLOCKED stop) and
+            # deferred the item to a human. Failing the job here would leave
+            # a red review-address check, which the next scan counts as NEW
+            # feedback — turning one deliberate stop into a self-feeding
+            # loop. The 'Report dry-run / failure' step still posts the
+            # handoff comment and the eval marker for this outcome.
+            fixed|noop|handoff) ;;
             *) exit 1 ;;
           esac
 
@@ -6472,7 +6479,7 @@ jobs:
 
       - name: 'Report dry-run / failure'
         if: |-
-          ${{ always() && (needs.route.outputs.dry_run == 'true' || failure() || cancelled()) }}
+          ${{ always() && (needs.route.outputs.dry_run == 'true' || failure() || cancelled() || steps.final_verify.outputs.outcome == 'handoff') }}
         env:
           OUTCOME: '${{ steps.final_verify.outputs.outcome }}'
           COMMITTED: '${{ steps.final_verify.outputs.committed }}'
@@ -6561,7 +6568,11 @@ jobs:
           # consumes a round.
           POST_HANDOFF=false
           if [[ "${DRY_RUN}" != "true" && "${STALE:-}" != "true" && -n "${GITHUB_TOKEN:-}" && "${OUTCOME:-unknown}" != "fixed" && "${OUTCOME:-unknown}" != "noop" ]]; then
-            if [[ "${OUTCOME:-unknown}" == "failed" || "${JOB_STATUS:-}" != "success" ]]; then
+            # handoff rounds end with a SUCCESS job status (a deliberate
+            # verdict), so they must trigger on the outcome itself — without
+            # this clause nothing would post and the loop would go silent on
+            # exactly the rounds that most need a visible human handoff.
+            if [[ "${OUTCOME:-unknown}" == "failed" || "${OUTCOME:-unknown}" == "handoff" || "${JOB_STATUS:-}" != "success" ]]; then
               POST_HANDOFF=true
             fi
           fi
@@ -6735,6 +6746,15 @@ jobs:
                   MARK_ROUND="${MAX_ROUNDS}"
                 fi
               else
+                if [[ "${OUTCOME:-}" == 'handoff' ]]; then
+                  # A deliberate stop, not a failed fix: the agent stopped
+                  # under instruction and deferred the item to a human. No
+                  # stale-base retry (there is no fix to re-attempt) and the
+                  # headline says what actually happened — the old
+                  # "could not produce a passing fix" wording reported the
+                  # brake's decision as a failure and buried the handoff.
+                  HEADLINE="🤖 AutoFix stopped this item under instruction and deferred it to a human (round ${MARK_ROUND}/${MAX_ROUNDS}) — the agent's handoff note below names the decision and the options. The loop stays engaged and still picks up new feedback and base conflicts, but will not retry this item on its own."
+                else
                 # The gate ran and rejected the agent's fix (a build/test
                 # failure). Before handing to a human, check whether the PR is
                 # merely BEHIND main: a build that fails on something main
@@ -6804,6 +6824,7 @@ jobs:
                   fi
                   HEADLINE="🤖 Could not produce a passing fix for this feedback (round ${MARK_ROUND}/${MAX_ROUNDS})${GATE_CLAUSE}. This item now needs a human; the loop stays engaged and still picks up new feedback and base conflicts, but will not retry this item on its own."
                 fi
+                fi
               fi
             elif [[ "${PREPARE_OUTCOME}" != 'success' && "${PREPARE_OUTCOME}" != 'failure' ]]; then
               # NEWEST is empty because Prepare never RAN TO A VERDICT — an
@@ -6906,7 +6927,7 @@ jobs:
               done <<< "${PRIOR_HEADS}"
               if [[ "${CONSEC_FAIL}" -ge "${CONSECUTIVE_FAILURE_CAP}" ]]; then
                 MARK_ROUND="${MAX_ROUNDS}"
-                HEADLINE="🤖 AutoFix stopped after ${CONSEC_FAIL} consecutive rounds that failed to push anything (timeouts and/or gate rejections). Retrying at the same per-round budget is not converging — this usually means the PR is too large or conflicts with a fast-moving \`main\`. A human should rebase, split, or reduce it, then comment \`${RETRY_COMMAND}\` to re-arm. Until then future scans will skip this PR."
+                HEADLINE="🤖 AutoFix stopped after ${CONSEC_FAIL} consecutive rounds that pushed nothing (failed rounds, timeouts, gate rejections, or stops under instruction). Retrying at the same per-round budget is not converging — this usually means the PR is too large or conflicts with a fast-moving \`main\`. A human should rebase, split, or reduce it, then comment \`${RETRY_COMMAND}\` to re-arm. Until then future scans will skip this PR."
               fi
               # CUMULATIVE timeout breaker — the sibling of the consecutive
               # one above, for the failure shape it cannot see: timeouts

.qwen/skills/autofix/SKILL.md

@@ -359,8 +359,14 @@ silently overriding or silently complying.
   handoff that names the decision and lays out the options — split the PR (land
   the core, track the remaining findings as follow-up issues), redesign, or
   accept the current state with the tail deferred — plus your recommendation.
-  Continuing to patch, or deciding the split yourself, is exactly the wrong
-  move; the call is the maintainer's.
+  Write that handoff to `<workdir>/handoff.md` — English-only, no details
+  block — naming the decision, the options, your recommendation, and what was
+  tried; then stop without writing anything else: no commit, no
+  `address-summary.md`, no `no-action.md`, no `failure.md`. The harness
+  recognizes a handoff with no fix verdict as a deliberate deferral: the round
+  ends cleanly, the note is posted to the PR, and the item waits for the
+  maintainer instead of being re-run. Continuing to patch, or deciding the
+  split yourself, is exactly the wrong move; the call is the maintainer's.
 - Needs a maintainer's decision: a finding that turns on a judgment that is
   NOT yours to make — a product or scope tradeoff (is this acceptable for v1?
   should the PR be split?), two reviewers asking for opposite things, or whether
@@ -506,5 +512,7 @@ Finish with exactly one outcome:
   answered when you escalated. Each body is bilingual per GitHub Actions Rules.
   Omit the file when every inline finding was resolved.
 - No change: write `<workdir>/no-action.md` (bilingual per GitHub Actions Rules).
+- Stopped by the growth brake: write `<workdir>/handoff.md` per the
+  not-converging rule (English-only, no details block) — and commit nothing.
 - The GitHub Actions Rules' objective stop condition applies: write
   `<workdir>/failure.md` and do not commit.

.qwen/skills/autofix/scripts/run-agent.mjs

@@ -497,7 +497,10 @@ const apiErrorWithoutVerdict =
   result.status === 0 &&
   result.apiError &&
   !hasOutputVerdict &&
-  !existsSync(file(options.workdir, 'failure.md'));
+  !existsSync(file(options.workdir, 'failure.md')) &&
+  // A handoff is a verdict too: an agent that reached its BLOCKED stop must
+  // not be reclassified as a bare API blip by an error render in the tail.
+  !existsSync(file(options.workdir, 'handoff.md'));
 if (
   result.error ||
   result.signal ||
@@ -586,6 +589,20 @@ if (existsSync(file(options.workdir, 'failure.md'))) {
   process.exit(0);
 }
 
+// A handoff the AGENT itself wrote — the growth-brake BLOCKED stop: the
+// feedback told it to defer to a human, so the round ends without a fix
+// verdict. Same standing as failure.md: a real, human-facing outcome, NOT
+// the missing-output failure class (which once reported a deliberate stop as
+// "finished without required output file(s)" and buried the brake's decision
+// under a generic failure.md). Honored only when no spec output exists: a
+// round that also wrote address-summary.md or no-action.md published a
+// result, and that verdict outranks the handoff.
+if (!hasOutputVerdict && existsSync(file(options.workdir, 'handoff.md'))) {
+  const content = readFileSync(file(options.workdir, 'handoff.md'), 'utf8');
+  console.error(`Autofix agent wrote handoff.md:\n${content}`);
+  process.exit(0);
+}
+
 if (spec.exclusiveOutput && presentOutputs.length > 1) {
   const message = `Autofix agent wrote mutually exclusive output files: ${presentOutputs.join(', ')}.`;
   writeFailure(options.workdir, message);