fix(queue): audit draft-dodge stand-down when agent is paused or frozen

Closes #6604

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: RealDiligent

src/queue/review-evasion.ts

@@ -79,8 +79,8 @@ type CloseEnforcementGateResult =
  *  grant rather than attempting a doomed mutation -- the reopen-reclose guard was the last holdout (#6603).
  *  The parameter stays nullable rather than required: it is the shape a future non-mutating caller would
  *  need, and narrowing it is a signature change #6603 deliberately left out of scope.
- *  `paused: null` records NO audit event on a paused/frozen repo -- draft-dodge's existing, preserved gap
- *  (every other guard here DOES audit a paused stand-down; draft-dodge simply never has). */
+ *  Every caller also passes a real `paused` object so a paused/frozen stand-down is audited the same way for
+ *  all five close-enforcement guards (#6604). */
 async function evaluateCloseEnforcementGate(args: {
   env: Env;
   installationId: number;
@@ -278,9 +278,10 @@ async function closeDraftDodgeAttemptIfBlocked(
         detail: `dry-run: would close draft-dodge attempt by ${draftDodgeAuthor} — prior gate failure on headSha ${pr.headSha} stands`,
         metadata: { ...gateMetadata, mode: "dry_run" },
       },
-      // Draft-dodge is the one guard of the 5 that records NO audit event on a paused/frozen repo -- a
-      // pre-existing gap this extraction preserves rather than fixes (a refactor must not change behavior).
-      paused: null,
+      paused: {
+        detail: `agent actions paused -- draft-dodge close not enforced for ${draftDodgeAuthor}`,
+        metadata: gateMetadata,
+      },
       permissionReadiness: {
         detail: `denied draft-dodge close for ${draftDodgeAuthor} — pull_requests: write not granted`,
         metadata: gateMetadata,

test/unit/queue-lifecycle-guards.test.ts

@@ -1367,7 +1367,9 @@ describe("converted_to_draft gate-close (draft-dodge prevention)", () => {
     await repositoriesModule.setGlobalAgentFrozen(env, true);
     await processJob(env, { type: "github-webhook", deliveryId: "draft-frozen", eventName: "pull_request", payload: draftPayload("contributor") });
     expect(calls.some((c) => c.method === "PATCH" && c.url.endsWith("/pulls/42"))).toBe(false); // never closed under freeze
-    expect(await env.DB.prepare("select count(*) as n from audit_events where event_type = ?").bind("github_app.draft_dodge_closed").first<{ n: number }>()).toMatchObject({ n: 0 });
+    const audit = await env.DB.prepare("select outcome, detail from audit_events where event_type = ?").bind("github_app.draft_dodge_closed").first<{ outcome: string; detail: string }>();
+    expect(audit?.outcome).toBe("denied");
+    expect(audit?.detail).toContain("agent actions paused -- draft-dodge close not enforced for contributor");
   });
 
   it("dry-run: audits a would-be draft-dodge close without touching GitHub (#killswitch-gap)", async () => {
@@ -1542,7 +1544,7 @@ describe("converted_to_draft gate-close (draft-dodge prevention)", () => {
     expect(calls.some((c) => c.includes("PATCH") && c.includes("/pulls/42"))).toBe(false);
   });
 
-  it("no-ops when the agent is paused (agentPaused=true)", async () => {
+  it("no-ops when the agent is paused (agentPaused=true) and audits the paused stand-down (#6604)", async () => {
     const calls: string[] = [];
     vi.stubGlobal("fetch", async (input: RequestInfo | URL, init?: RequestInit) => {
       const url = input.toString();
@@ -1558,6 +1560,9 @@ describe("converted_to_draft gate-close (draft-dodge prevention)", () => {
     await processJob(env, { type: "github-webhook", deliveryId: "draft-paused", eventName: "pull_request", payload: draftPayload("contributor") });
 
     expect(calls.some((c) => c.includes("PATCH") && c.includes("/pulls/42"))).toBe(false);
+    const audit = await env.DB.prepare("select outcome, detail from audit_events where event_type = ?").bind("github_app.draft_dodge_closed").first<{ outcome: string; detail: string }>();
+    expect(audit?.outcome).toBe("denied");
+    expect(audit?.detail).toContain("agent actions paused -- draft-dodge close not enforced for contributor");
   });
 
   it("no-ops when the agent autonomy is not configured (autonomy=null)", async () => {