feat(gates): catch at analysis time what three model passes caught in review

[MyAlterLego]

A full-surface run of a ~3,600-file TypeScript monorepo was authored by one model, adversarially reviewed by a second, then audited by a third. The review corrected 48% of 96 findings (22 refuted, 14 downgraded). The audit then found two whole unmodelled control actions, a systemic authority defect, and a seeded super-admin account.

Every one of those errors was findable at analysis time. This PR makes them findable mechanically, instead of depending on the next reviewer being strong enough — because the review kept doing work the analysis should have done.

---

The evidence that motivated each gate

What went wrong	Why it survived	Now caught by
4 findings claimed a control was absent; all 4 were false	Read the use of a flag, never the declaration or the mount	stpa controls + Prioritize absence check
A belief was credited as a working control when 2 of 3 code paths read the role from the caller's token	sourcedFrom named a hop, not an origin	stpa evidence trust roots
Two generic RPC bridges missed by two passes and a review	A :param route collapsed into one REST control action	dynamic-dispatch-route modality
Prose said "44 tombstones"; the grid held 66	A number typed by hand, invalidated by a later correction	stpa evidence derived numbers
0 of 96 verdicts were upgrades	Reviewers briefed only to refute	stpa verify upgrade duty
A reviewer's correction was reverted by the apply step	Nothing checked that verdicts reached the artifact	stpa verify exit 7

---

New: stpa controls (exit 8)

ControlStructureScan.ts already emits a guards category. In that run it produced 2,508 guard candidates and the analysis consumed zero of them.

For two of the four false absence claims, the scan had already flagged a guard in the very file the finding called unguarded — including WWW-Authenticate inside the auth middleware the finding said did not exist. The evidence was on disk the whole time. Nothing looked at it.

This does the one comparison nobody was doing. Nothing to fill in by hand — a gate that costs busywork gets bypassed with --warn-only. On a collision it prints the guard lines and gives three exits: the guard is the control (withdraw the finding), the guard doesn't cover this path (cite why), or it's noise (cite and dismiss). All three require having read the line.

It cannot prove an absence. It proves you did not look, which is the actual failure mode.

New: stpa evidence (exit 9)

Trust roots. Every process-model belief must name where its evidence bottoms out: database · iam · network · human · attacker-input · unverified. A run credited "roles are re-read from the database on every request"; true for loginRequired, false for identityHasRole()/hasClaim(), which decrypt the role out of the caller's own token — so six remediations saying "gate this on an operator role" were placebos. "the session" and "the token" are hops; expand until it terminates. unverified is a legitimate answer that forces the dependent band provisional.

On the live analysis this immediately exposed that 20 of 38 beliefs are unverified — a quality signal the old model had no way to express.

Derived numbers. No count the tools compute may be typed into prose. --fix-numbers rewrites stale ones. Excludes tool-generated files and third-party audit documents (rewriting someone else's audit to match artifacts you changed afterwards would falsify their record).

Extended

• DiscoveryGate — dynamic-dispatch-route [FORGOTTEN]. Fires with 4 hits on the exact file that hid the RPC bridges.
• VerifyGate — upgrade/inventoryGap verdicts, a warning at zero upgrades, and an apply-reflection check: refutations must be tombstoned, downgrades and provisionals stamped.
• Prioritize — absence claims must cite a line read or a sweep run.
• RenderReport — §7c Corrections from corrections.json.
• Start.md — Q1 is model selection as an author+attacker pairing, so the same model cannot land in both slots and fail stpa verify after the analysis is paid for. STRIDE removed from the intake and FullAnalysis — a same-model per-element pass is a circular cross-check; a real dual-method assessment belongs in its own skill.

---

Verification

Each gate tested positively and negatively — passes on the corrected artifacts, fails when its evidence is stripped:

controls   collisions 0 -> exit 0   | citation stripped -> exit 8
evidence   38/38 trust roots        | one removed        -> exit 9
verify     74/74 reviewed           | stamp removed      -> exit 7
prioritize absence evidence present | evidence removed   -> exit 1
discovery  dynamic-dispatch: 4 hits in sessions/routes/index.ts

Two false-positive classes were found by running the gates and fixed: "443 open" matching a port range, and "closes 12 findings" cluster-leverage counts read as totals. Both mattered — a gate that cries wolf is a gate that gets disabled.

Two bugs in my own gates, found the same way. The absence check first demanded file:line for an absence, which is incoherent; it now accepts a named negative search. And VerifyGate's apply check read 06-remediation.json (Prioritize's output, findings under waves[].items[]) instead of remediation.json, so every verdict looked unapplied.

The apply-reflection gate also caught a live instance of the bug it was written for, mid-implementation: re-merging reviews after the apply step had run left 11 verdicts filed but unstamped.

Notes

• Branched from main; independent of fix: compose gate read the wrong directory; report CSS escape emitted the wrong glyph #4, which it supersedes on ComposeChains (same one-line fix, harmless in either merge order).
• No dependencies added. All gates offline.
• Exit codes: 8 controls, 9 evidence, 7 verify apply-reflection. 1–6 were taken.
• stpa run chains both new gates before plan and propagates their exits.