Treating must-fix as a stop-gate the same way as block is the design decision that makes this actually work, because otherwise the agent just declares victory and walks. The health check with no timeout hanging forever is a great catch, and the fact it forced named tests for the public functions is what turns "I fixed it" into something verifiable. Do you gate on a fixed severity list, or can the agent negotiate a finding down to a suggestion, which feels like it could reopen the same escape hatch?