Fail closed when scripted orchestrator apply triples mismatch

[jmjava]

Summary

• scripts/run_orchestration.py now asserts (outcome, applied, apply_source) after each run_job and exits 1 on mismatch (stderr) or 0 on success. Printed rows are not a pass.
• Expected triples: keep jobs stay on premium; accept/repair/escalate apply local; reject holds; rewrite applies premium. The rewrite fixture is a proven golden-with-comment so a comment-only fence cannot silently score blocked.
• tests/test_orchestration_exit.py sabotages EXPECTED or mocks a wrong run_job outcome and requires main() to exit 1. CI “Scripted orchestrator” already invokes this script without continue-on-error.

This is leftover #3 / T-S01 from the 2026-09-10 slm-setup impact list. New branch off origin/main. No A8/A9, no downstairs GPU, no Halo 4.

Test plan

• PYTHONPATH=src .venv/bin/python -m unittest discover -s tests -v (122 tests)
• python scripts/run_orchestration.py exits 0 and prints "jobs": 8
• Sabotaged EXPECTED for keep_incident → SystemExit(1)
• Mocked delegate_accept outcome rejected → SystemExit(1)
• Confirm GitHub Actions “Scripted orchestrator” stays green on this branch

Made with Cursor