External anchor unavailable in sandbox: define UNVERIFIED handling and scope-gated merge #44

Template gap (consolidated)

Phase 4 treats the external validation command as a hard anchor ("do not start the rubric until it passes"). The Edge cases cover what to do when validation fails, but not when the anchor cannot run because the tool is absent or the wrong interpreter is on PATH in the sandbox (docker not installed; bare python resolving to 2.7; a venv-less interpreter with no pytest; ./gradlew dying on a sandbox file-lock). Read literally, the loop deadlocks or reports a false "build broken".

Rule to add to the template (Edge cases / Phase 4)

If the external anchor cannot run because the tool/interpreter is absent or broken in the environment, do not claim it green and do not iterate trying to fix the sandbox. Flag it UNVERIFIED, then gate on scope: if the PR modifies files the anchor would have validated, the anchor is required — mark UNVERIFIED, do not auto-merge, and hand off to CI/a human with the tool. If the PR touches none of those files (e.g. docs-only), record UNVERIFIED-not-applicable and continue, stating it in the self-review and PR body. Prefer the CI check on the exact PR head SHA as the real anchor where local execution is blocked.

The generator should also capability-check any named interpreter before relying on it (e.g. <py> -c "import pytest") and prefer the project's own venv.

Consolidates (close on merge)

• example-o-dev-loop#3 — docker compose config -q cannot run (docker absent)

Concrete per-repo instances kept open (the local fix still applies), cross-referenced here: example-|-dev-loop#1 (python is 2.7 → use python3), example-a-dev-loop#34 (prefer project .venv), example-s-dev-loop#1 (sandbox ./gradlew file-lock → CI anchor).

Consolidated upstream from per-loop self-audit findings. drafted by Claude on behalf of Daniel Stephenson