fix(3323): keep human-needed verification pending (#3339)

* fix: keep human-needed verification pending

* chore: add changeset for human verification gating

* docs: align ship verification status wording

sdk/src/phase-runner.ts

@@ -902,8 +902,7 @@ export class PhaseRunner {
         });
 
         if (decision === 'accept') {
-          outcome = 'passed';
-          break; // Treat as passed
+          break; // Acknowledged by caller, but still pending human verification.
         } else if (decision === 'retry' && gapRetryCount < maxGapRetries) {
           gapRetryCount++;
           continue;
@@ -1141,10 +1140,10 @@ export class PhaseRunner {
       const status = (data?.status ?? '').toLowerCase();
 
       if (status === 'pass' || status === 'passed') return 'passed';
+      if (status === 'human_needed') return 'human_needed';
       if (status === 'fail' || status === 'gaps_found') return 'gaps_found';
       if (status === 'missing') {
-        // VERIFICATION.md doesn't exist yet — treat session success as passed
-        return 'passed';
+        return 'gaps_found';
       }
       // Unknown status — log and treat as gaps_found to be safe
       this.logger?.warn(`Unknown verification status '${status}' for phase ${phaseNumber}, treating as gaps_found`);
@@ -1219,8 +1218,8 @@ export class PhaseRunner {
       this.logger?.warn(`Unexpected verification callback return value: ${String(decision)}, falling back to accept`);
       return 'accept';
     } catch (err) {
-      this.logger?.warn(`Verification callback threw, auto-accepting: ${err instanceof Error ? err.message : String(err)}`);
-      return 'accept'; // Auto-approve on error
+      this.logger?.warn(`Verification callback threw, keeping human verification pending: ${err instanceof Error ? err.message : String(err)}`);
+      return 'accept'; // Treat as acknowledged; caller remains pending.
     }
   }
 }