porch: verify-wedge — a reworked artifact can't re-enter verify after its approval gate has fired (rollback can't target current phase)

[amrmelsayed]

Problem

In a SPIR phase's build_verify cycle, once the approval gate has fired (gate_pending), there is no documented path for porch to re-enter the verify step after the artifact is reworked.

Concrete flow that hits the wedge:

1. Phase build completes, verify runs the 3-way consult, the approval gate fires (gate_pending).
2. The architect rejects-by-not-approving and directs the builder to rework the artifact.
3. The builder reworks the artifact and re-signals (porch done).
4. Porch does not re-run verify. It re-presents the same not-approved approval gate at the same iteration. The only porch next task is "Request human approval". The 3-way consult never re-runs against the reworked artifact.

Why recovery is blocked

• porch rollback <id> <current_phase> is rejected: "Cannot rollback forward. Current phase: X, target: X." rollback only rewinds to earlier phases.
• Rolling back to the previous phase (e.g., specify) would destroy that phase's correct, gate-approved artifact — wrong remedy for a verify-wedge in the current phase.
• The only forward move is approving the gate — which ships the reworked artifact with the 3-way consult having never run on it.

Observed

A SPIR plan phase: verify returned 3× REQUEST_CHANGES; porch fired plan-approval anyway (a separate verdict-aggregation symptom — the gate fires despite unanimous REQUEST_CHANGES); architect rejected and directed a full plan rewrite; builder rewrote and ran porch done; porch next returned gate_pending, phase: plan, iteration: 1, gate: plan-approval, tasks: ['Request human approval'] — no 3-way-consult task. The rewritten plan was never verify-consulted by porch.

Compounding interaction

The natural architect workaround — run the 3-way consult manually — is itself defeated by a sibling consult defect (consult --type plan --issue N resolves the artifact from the invoking workspace, not the builder's branch, so it reviews the stale on-main/on-integration-branch copy rather than the rework). Filed separately. Together, these two defects make the independent 3-way verify structurally unreachable for any reworked SPIR artifact — the protocol's core review guarantee silently degrades to single-reviewer architect inspection whenever a rework happens, with no signal of the degradation.

Impact

Every SPIR rework after the approval gate has fired loses its independent 3-way safety net. Both the verdict-aggregation defect (premature gate firing despite REQUEST_CHANGES) and this wedge (no rework-re-verify transition) need fixing for the rework loop to work; either alone breaks the trap.

[amrmelsayed]

Sibling: #777 (consult artifact-resolution + main-hardcoded). The two compound — the architect-supplied verify workaround for this wedge is itself broken by #777's workspace-rooted artifact resolution. Fixing either alone breaks the trap; fixing both restores the rework loop.

[amrmelsayed]

Sibling: #801 (porch approve state-push silently fails after auto-delete on PR merge — desyncs architect-side and builder-side porch views). Same afx/porch-lifecycle family as this issue: state transitions leaving an unreachable artifact / unsynced view.

[amrmelsayed]

Sibling: #802 (state-bookkeeping commits accumulate as orphan artifacts on builder branches when not auto-deleted on PR merge). Same porch state-machine family — leaves dead state-transition commits behind.