[DIC-21] quarantine-eval CLI — DecaySignal → QuarantineDecision (#6032)

[an0mium]

Slice

Adds the aragora quarantine-eval CLI subcommand — the operator surface for DIC-21 (fail-closed quarantine policy, issue #6032).

Every other DIC-18..28 item already has a CLI command (dic18_truth_map.py, dic19_proof_units.py, dic20_decay_monitor.py, dic24_genealogy.py, dic26_coherence.py, dic28_crux_garden.py). DIC-21 was the only one missing an operator surface despite having a complete Python implementation (aragora/epistemic/quarantine_policy.py) already on main.

Files changed (3, net +348 LOC — no deletions):

• aragora/cli/commands/dic21_quarantine.py — new CLI command implementation (125 lines)
• aragora/cli/parser.py — registers _add_quarantine_eval_parser() at line ~225 with comment # DIC-21 / #6032 (+41 lines)
• tests/cli/test_dic21_quarantine.py — 17 hermetic tests (182 lines)

The command reads a DecaySignal JSON file (from aragora decay-monitor output), applies apply_quarantine_policy(), and emits the QuarantineDecision as text or --json. No queue writes, no live-routing calls.

Gating

• Flag: ARAGORA_QUARANTINE_POLICY_ENABLED (default OFF)
• Without the flag: exits 1 and names the flag in stderr — no silent fallback
• live_swap is permanently blocked for all unit classes (enforced inside apply_quarantine_policy, not in the CLI)
• No effect on live queue paths, dispatch, or boss loop
• vision-layer label only; not boss-ready or autonomous

Tests

tests/cli/test_dic21_quarantine.py — 17 tests, all pass

Flag gating (3): flag off → exit 1 + stderr names flag; truthy values (1/true/yes/on) → exit 0
Input validation (3): missing file, bad JSON, missing code_unit_id → exit 1
Text output (2): unit_id and action visible in stdout
JSON output (2): valid JSON with required keys; provenance_hash is 64-char hex for non-report-only
Policy routing (4): high integrity → report_only; low integrity → fail_closed; live_dispatch class
                     uses stricter threshold (0.6 vs 0.4); live-swap request is blocked

Run locally with:

ARAGORA_QUARANTINE_POLICY_ENABLED=1 pytest tests/cli/test_dic21_quarantine.py -v --noconftest

Validation

• ruff check — all checks passed
• ruff format --check — 2 files already formatted
• 17/17 tests pass (no conftest needed; test stubs yaml at module level)
• Branch rebased cleanly onto current origin/main (cherry-picked 2 commits; diff is pure addition)

Out of scope

• DIC-22 repair pipeline CLI (a separate slice)
• Live queue routing or dispatch changes
• boss-ready promotion (blocked until proof-first Foreman gate opens)
• Any modification to aragora/epistemic/quarantine_policy.py (already tested and on main)

---

Generated by Claude Code