space-architect 7.0.0 → 8.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d521b0afec00484bfba5b35e26e9f0a603807fb75f3569fa61b0a0b5ff9b3ab
-  data.tar.gz: d21ecd2d8dd8458b0ec2e89d4cc2ee45a5a70eafc53955b8d2b3c365b55efe3b
+  metadata.gz: b63abfece4c105ef5b2befd0d8c4e4301d8d5cade10570cd2f41bd0641b8c4be
+  data.tar.gz: 6b932ae13952dad48f81a2ee68ed52b7cee28ef8edc4a99e7a06f23952c4f107
 SHA512:
-  metadata.gz: e27a4154359d6f41370287eb86eeb2881d415dd0ce7e5d6c3c3f241ff338f168a7393456d63faa5e3970e3a72eb927ae4db13d4f407e50e320d90ed54c79dc7e
-  data.tar.gz: 024047dcd39a0de008284fc256c3f7fb08ea8585e0cd0cae53f0e990b70f9e47341325cf92668ef632bf76ef2e34e5d082ccd98eba94af52c4f659c251afd9f8
+  metadata.gz: 3cbb55f4fab850bc9fb7b4cf55bb318bf846d54c3f78a399c50b76d325ddbcd12ad52072d224d75a25b6e5830c8fffa6d7e6f51ad522aae231bb2b374ac3980e
+  data.tar.gz: 4adfa615512c8f6652b85d5948c0a58c9851d30711fc2a1a7f870060601bb6fe0fab9af4ade0c8eebfb5e93a67bf60d1d6516e12fcd0ba96595d530049e0d0da

data/CHANGELOG.md

@@ -5,6 +5,94 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [8.0.0] - 2026-10-09
+
+### Changed
+
+- **pi is the only dispatch harness.** The `claude-code` and `opencode`
+  backends are deleted, along with everything that only served them: the
+  per-harness `DEFAULT_MODELS` map (one `Harness::DEFAULT_MODEL`:
+  `accounts/fireworks/models/glm-5p3-flash`), the three-way thinking-level
+  dispatch, the `--allowed-tools`/`--append-allowed-tools` flags and their
+  #89 resolution machinery (the frozen lanes block records `name`/`repo`/
+  `touch` only), `dispatch --as-job` with its `--host`/`--token`/
+  `--backend-url`/`--job-model`/`--api-key-ref` flags, and the backward-
+  compat `Dispatcher` wrapper. The `Harness.for` seam stays: any name but
+  `pi` — including a stored legacy harness in an old space.yaml — raises an
+  actionable error naming `pi` as the only valid harness. The push kwargs
+  (`--push-url`/`--push-token`/`--push-host`) and `--quiet` now apply to pi
+  dispatches, with liveness lines parsed from pi's own JSONL stream.
+- **`PiHarness` reaches parity with the old default backend:** a liveness
+  line per run (first assistant-role JSONL event carrying `model`; OK when
+  it matches the pin, WARN on no growth / no assistant model within the
+  budget / pinned-vs-streamed mismatch; incremental scan, `--quiet`
+  suppressible), stdout tee through a pipe to the run log and — when push
+  is wired — streamed to the ingest endpoint, and TERM→grace→KILL timeout
+  escalation unchanged.
+- **A vendored builder-guard extension ships with every dispatch.**
+  `lib/space_architect/pi/builder-guard.ts` is copied byte-for-byte into the
+  run's build dir and injected via `pi -e`, denying git-write subcommands
+  (parsed per command segment — `git -C <path> commit` is caught, `git log
+  --grep=commit` passes) and `bash -n`-unparseable commands before they run.
+  The deny reason tells the builder what was denied and what to do instead;
+  the architect CLI owns all commits.
+- **Research runs run on pi too.** The research supervisor constructs a
+  `PiHarness` per run (sessions under `build/research/<id>/`), passes the
+  same vendored guard, and defaults to the pi default model; read-only
+  remains prompt-enforced. `run.detached` research classification keys off
+  pi's terminal assistant `stopReason` instead of a stream-json `result`
+  event.
+
+### Fixed
+
+- **`architect research wait` works on pi runs.** `Research::Mux` and
+  `Research::Renderer` now speak pi's JSONL event vocabulary natively (the
+  last claude-code stream-json dialect in the gem): the tail breaks on
+  `agent_settled`, `wait` classifies via the last assistant `stopReason` plus
+  `agent_settled.aborted` and the final assistant text (no final text →
+  `:failed` "no final assistant text"), and the report is the final assistant
+  message's joined text blocks. The shared pi-shape predicates live in one
+  new module, `Research::PiEvents` (last assistant message/stopReason, joined
+  text, run span from `session.timestamp` → last assistant `timestamp`,
+  `turn_end` count) — `Supervisor#classify` consumes it too. The renderer's
+  §5.3 verbosity ladder, `--thinking`, and `--jsonl` passthrough are
+  unchanged, fed by pi events (`message_end`, `tool_execution_start/end`)
+  with the terminal line built from native facts (no fabricated fields).
+
+## [7.1.0] - 2026-08-16
+
+One iteration of the Architect Loop (I01, space
+20260816-architect-rehearse-friction) closing the rehearse rerun tax: a heavy
+rehearsal now yields its verdict vector, per-gate reasons, and full raw output
+from one execution plus file reads.
+
+### Added
+
+- **`architect rehearse` writes a durable transcript and prints a bounded
+  summary.** Previously the CLI wrote an unbounded report to stdout only, so
+  every re-view of a run — a tail window, a grep filter, a verdict count —
+  re-ran the whole gate suite. Every non-EMPTY rehearsal now writes its full
+  report (each gate's command, dir, exit code, verdict, reason, complete
+  stdout+stderr, and scope-asymmetry findings) to a uniquely named file under
+  `build/rehearse/` and prints that path; the terminal report itself is now
+  bounded — one line per gate carrying its AC label, gate id, verdict, and
+  exit code regardless of how many lines the command spans, inline output
+  capped to the last 20 lines with an elision marker naming the transcript —
+  and always ends with a summary block (one line per gate, a tally by
+  verdict, and the transcript path) positioned last, so a `tail` of stdout
+  captures the whole outcome.
+- **`execute_gates` dedups identical executions.** Gates that share an
+  identical `(cmd, resolved dir)` pair now execute once; each is still
+  evaluated against its own `expect` and classified independently, the
+  group's effective timeout is the largest any member declares, and the
+  report/transcript name the shared execution so byte-identical output
+  doesn't read as a copy-paste bug. `run_gates` (judge time) shares this for
+  free — dedup lives in `execute_gates`, the one instrument both call.
+- **docs/RELEASING.md.** The release process, retraced from the v7.0.0
+  landing: preconditions, the release-prep commit, the human-run PR/merge and
+  signed-tag steps, what the tag-push automation covers, and local-install
+  verification (including the stale-binstub PATH hazard).
+
 ## [7.0.0] - 2026-08-14
 
 Three iterations of the Architect Loop run against this repo's own tooling, each

data/README.md

@@ -343,7 +343,8 @@ architect integrate my-feature --lanes lane-a    # merge passing lanes → proje
 
 ### Streaming builder output 📡
 
-`architect dispatch` can push the builder's stream-json to an ingest server for
+`architect dispatch` can push the builder's pi JSONL event stream to an ingest
+server for
 live viewing:
 
 ```sh
@@ -367,8 +368,9 @@ can be combined with `--detach` (the push tees the live pipe in-process).
 ### Research lanes 🔭
 
 When an iteration needs facts the repo doesn't already have, fan out parallel
-**read-only** research lanes — detached `claude -p` researchers (no
-Edit/Write/Bash) that you supervise:
+**read-only** research lanes — detached `pi -p --mode json` researchers
+(read-only by prompt contract; the supervisor-injected guard denies git writes)
+that you supervise:
 
 ```sh
 architect research dispatch 01-official-api.prompt.md 02-changelog.prompt.md

data/lib/space_architect/architect_project.rb

@@ -241,13 +241,6 @@ module Space::Architect
           lanes = s["lanes"] || []
           declared.each do |d|
             fields = { "name" => d["name"], "repo" => d["repo"], "touch_set" => Array(d["touch"]) }
-            # #89/AC3-AC4: the frozen lane's own tool grant, reviewable like every other
-            # boundary. Declared-only, like touch_set — worktree_add never touches these
-            # keys, so a re-materialize preserves them without threading them through
-            # recorded_lane_fields (unlike harness/model, which worktree_add resolves and
-            # overwrites on every call).
-            fields["allowed_tools"]        = d["allowed_tools"]        if d["allowed_tools"]
-            fields["append_allowed_tools"] = d["append_allowed_tools"] if d["append_allowed_tools"]
             existing = lanes.find { |l| l["name"] == d["name"] }
             existing ? existing.merge!(fields) : lanes << fields
           end
@@ -595,16 +588,17 @@ module Space::Architect
       text = path.read
 
       gates = parse_gates(text)
-      repo, base_dir, gate_results, scope_report =
+      repo, base_dir, gate_results, scope_report, transcript =
         if gates.empty?
-          [nil, nil, [], nil]
+          [nil, nil, [], nil, nil]
         else
           r   = resolve_rehearsal_repo(iteration, text, gates)
           dir = r ? space.path.join("repos", r) : nil
           raise Space::Core::Error, "directory does not exist: #{dir}" if dir && !dir.exist?
           results = execute_gates(gates, base_dir: dir, lane: nil, repo_root: nil)
                     .map { |g| g.merge(rehearsal: classify_rehearsal(g)) }
-          [r, dir, results, scope_asymmetry_report(results, text)]
+          scope = scope_asymmetry_report(results, text)
+          [r, dir, results, scope, write_rehearsal_transcript(entry, r, dir, results, scope, now)]
         end
 
       digest = gates_digest(text)
@@ -617,7 +611,8 @@ module Space::Architect
       end
 
       { iteration: iteration, repo: repo, base_dir: base_dir, gates: gate_results,
-        empty: gates.empty?, placeholder: untouched_ac_placeholder?(text), scope_asymmetry: scope_report }
+        empty: gates.empty?, placeholder: untouched_ac_placeholder?(text), scope_asymmetry: scope_report,
+        transcript: transcript }
     end
 
     # Emit grounding reads for the architect's SessionStart hook.
@@ -839,7 +834,7 @@ module Space::Architect
         variants: variant_lanes.map do |l|
           {
             name:               l["name"],
-            harness:            l["harness"] || "claude-code",
+            harness:            l["harness"] || "pi",
             model:              l["model"],
             effort:             l["effort"],
             base_sha:           l["base_sha"],
@@ -938,9 +933,8 @@ module Space::Architect
       end
     end
 
-    def dispatch(iteration, lane, model: nil, max_turns: 200,
-                 claude_bin: nil, harness: nil, opencode_bin: nil, effort: nil,
-                 allowed_tools: nil, append_allowed_tools: nil, force: false, quiet: false,
+    def dispatch(iteration, lane, model: nil, max_turns: 200, bin: nil, harness: nil, effort: nil,
+                 force: false, quiet: false,
                  detach: false, push_url: nil, push_token: nil, push_host: nil, run_creator: nil,
                  push_client: nil, timeout: nil, prompt: nil, now: Time.now)
       raise Space::Core::Error, "Specify --push-host or --push-url, not both" if push_host && push_url
@@ -957,12 +951,6 @@ module Space::Architect
 
       resolved_harness, resolved_model, resolved_effort =
         resolve_dispatch_harness(lane_entry, model: model, harness: harness, effort: effort, force: force, err: err)
-      resolved_allowed_tools, replace_tools, append_tools, tools_provenance =
-        resolve_allowed_tools(lane_entry, allowed_tools: allowed_tools, append_allowed_tools: append_allowed_tools)
-      err.puts(tools_provenance) if replace_tools || append_tools
-
-      raise Space::Core::Error, "--push-host is only supported with the claude-code harness" \
-        if push_host && resolved_harness != "claude-code"
 
       id = iteration_id(entry)
       wt_path = space.path.join(lane_entry["worktree"] || "build/#{id}-#{lane}/wt")
@@ -977,31 +965,31 @@ module Space::Architect
       # and the CLI owns the canonical copy — byte-for-byte, like variant_add.
       copy_and_validate_prompt!(prompt, prompt_path)
 
-      bin = resolved_harness == "claude-code" ? claude_bin : opencode_bin
+      # Vendor the builder guard into the lane's build dir (idempotent overwrite) and
+      # inject it via -e on every dispatch — blocking and detached alike. The guard
+      # denies git-write and bash-unparseable commands before evaluation; the builder
+      # itself never needs to remember to load it.
+      guard_path = build_dir.join("builder-guard.ts")
+      FileUtils.cp(vendored_guard_path, guard_path)
+
       harness_obj = Harness.for(resolved_harness, model: resolved_model, max_turns: max_turns, bin: bin,
                                                   config_dir: build_dir, effort: resolved_effort,
-                                                  allowed_tools: resolved_allowed_tools, force: force, err: err)
+                                                  guard_path: guard_path, force: force, err: err)
 
-      # Stamp launch time and the resolved harness/model/effort/allowed_tools onto the
+      # Stamp launch time and the resolved harness/model/effort onto the
       # lane entry: after every preflight validation has passed (a dispatch that raises
       # above records nothing) and before the blocking run or a detached dispatch
       # returns. A re-dispatch overwrites the prior values, so `architect status`
-      # always reads what actually ran on the last dispatch. #89/AC8: the resolved
-      # tool grant is recorded the same way, so a denial traces back to a grant a
-      # human can read — replace_tools/append_tools are the pre-composition components
-      # (not the harness's expanded ClaudeCodeHarness.resolve_tools result), so a later
-      # bare re-dispatch re-resolves from the same components instead of compounding.
+      # always reads what actually ran on the last dispatch.
       update_architect_block do |b|
         (b["iterations"] || []).each do |s|
           next unless s["name"] == iteration
           (s["lanes"] || []).each do |l|
             next unless l["name"] == lane
-            l["dispatched_at"]         = now.iso8601
-            l["harness"]               = resolved_harness
-            l["model"]                 = resolved_model
-            l["effort"]                = resolved_effort if resolved_effort
-            l["allowed_tools"]         = replace_tools    if replace_tools
-            l["append_allowed_tools"]  = append_tools     if append_tools
+            l["dispatched_at"] = now.iso8601
+            l["harness"]       = resolved_harness
+            l["model"]         = resolved_model
+            l["effort"]        = resolved_effort if resolved_effort
           end
         end
         b
@@ -1026,96 +1014,30 @@ module Space::Architect
 
         run_kwargs = { prompt_path: prompt_path, run_log_path: run_log_path, chdir: wt_path }
         run_kwargs[:timeout] = timeout if timeout
-        if resolved_harness == "claude-code"
-          run_kwargs[:push_url]    = push_url    if push_url
-          run_kwargs[:push_token]  = push_token  if push_token
-          run_kwargs[:push_client] = push_client if push_client
-          run_kwargs[:err]         = err         if quiet
-        end
+        run_kwargs[:push_url]    = push_url    if push_url
+        run_kwargs[:push_token]  = push_token  if push_token
+        run_kwargs[:push_client] = push_client if push_client
+        run_kwargs[:err]         = err         if quiet
         exit_code = harness_obj.run(**run_kwargs)
 
         result = { exit_code: exit_code, run_log: run_log_path, report: report_path, worktree: wt_path }
         result[:prompt_copied]  = prompt_path    if prompt
-        result[:timed_out]      = true           if exit_code == Harness::ClaudeCodeHarness::TIMEOUT_EXIT_CODE
+        result[:timed_out]      = true           if exit_code == Harness::PiHarness::TIMEOUT_EXIT_CODE
         result[:created_run_id] = created_run_id if created_run_id
         result[:push_url]       = push_url       if push_url
         result
       end
     end
 
-    # Submit the lane's builder run as a job to the space-server's queue instead of
-    # running it locally: the sandboxed executor mounts the lane worktree + the repo
-    # checkout at their identical host absolute paths (so the worktree's gitdir
-    # pointer resolves) and runs the harness itself — no local run.jsonl, the
-    # transcript lives server-side. jobs_client: is the injectable seam (mirrors
-    # dispatch's run_creator:).
-    def dispatch_as_job(iteration, lane, host:, token:, backend_url:, model: nil, harness: nil,
-                        max_turns: 200, effort: nil, allowed_tools: nil, append_allowed_tools: nil,
-                        force: false, quiet: false,
-                        job_model: nil, api_key_ref: nil, prompt: nil, jobs_client: nil, now: Time.now)
-      err = quiet ? File.open(File::NULL, "w") : $stderr
-
-      entry = slice_entry(iteration)
-      lane_entry = (entry["lanes"] || []).find { |l| l["name"] == lane }
-      raise Space::Core::Error, "No lane '#{lane}' recorded for iteration '#{iteration}'" unless lane_entry
-      lane_entry = ensure_lane_materialized(iteration, lane)
-
-      resolved_harness, resolved_model, resolved_effort =
-        resolve_dispatch_harness(lane_entry, model: model, harness: harness, effort: effort, force: force, err: err)
-      raise Space::Core::Error, "--as-job only supports the claude-code harness (lane '#{lane}' resolves to '#{resolved_harness}')" \
-        unless resolved_harness == "claude-code"
-      raise Space::Core::Error, "--job-model is required with --as-job" unless job_model
-
-      # #89: same replace/append resolution as the local dispatch path — the sandboxed
-      # executor still runs `claude -p` with harness_args server-side.
-      resolved_allowed_tools, replace_tools, append_tools, tools_provenance =
-        resolve_allowed_tools(lane_entry, allowed_tools: allowed_tools, append_allowed_tools: append_allowed_tools)
-      err.puts(tools_provenance) if replace_tools || append_tools
-
-      id = iteration_id(entry)
-      wt_path = space.path.join(lane_entry["worktree"] || "build/#{id}-#{lane}/wt")
-      raise Space::Core::Error, "Worktree directory does not exist: #{wt_path}" unless wt_path.exist?
-
-      build_dir   = space.path.join("build", "#{id}-#{lane}")
-      prompt_path = build_dir.join("prompt.md")
-      copy_and_validate_prompt!(prompt, prompt_path)
-
-      repo_path   = space.path.join("repos", lane_entry["repo"])
-      harness_obj = Harness.for(resolved_harness, model: resolved_model, max_turns: max_turns,
-                                                  effort: resolved_effort, allowed_tools: resolved_allowed_tools,
-                                                  force: force, err: err)
-
-      spec = job_spec(iteration: iteration, lane: lane, wt_path: wt_path, build_dir: build_dir,
-        repo_path: repo_path, prompt_content: prompt_path.read, backend_url: backend_url,
-        job_model: job_model, api_key_ref: api_key_ref, harness_args: harness_obj.builder_args)
-
-      client = jobs_client || JobsClient.new(host, token)
-      job_id = client.create(spec)
-
-      # Dispatch bookkeeping, mirroring the local path's dispatched_at stamp: a
-      # re-dispatch overwrites the prior job_id, so `architect status` always
-      # reflects the last dispatch regardless of mode.
-      update_architect_block do |b|
-        (b["iterations"] || []).each do |s|
-          next unless s["name"] == iteration
-          (s["lanes"] || []).each do |l|
-            next unless l["name"] == lane
-            l["dispatched_at"] = now.iso8601
-            l["job_id"]        = job_id
-          end
-        end
-        b
-      end
-
-      result = { job_id: job_id, spec: spec }
-      result[:prompt_copied] = prompt_path if prompt
-      result
-    end
-
     private
 
     attr_reader :space
 
+    # The vendored builder-guard extension shipped in the gem (lib/space_architect/pi/).
+    def vendored_guard_path
+      Pathname.new(__dir__).join("pi/builder-guard.ts")
+    end
+
     # Compose a commit message. Without a custom message, the canonical default
     # (unchanged). With one, a short canonical prefix keeps the loop's commit
     # taxonomy grep-able while the author's first line owns the subject; any
@@ -1252,28 +1174,35 @@ module Space::Architect
     # same shell (capture_with_timeout's Process.spawn), same GateEvaluator,
     # same timeout handling (I09/AC3). repo_root/lane are nil outside a lane
     # context (rehearsal never has one — it always runs in the repo checkout).
+    #
+    # I01: gates sharing an identical (resolved cmd, resolved dir) pair execute
+    # once; the shared capture is fanned back out to every member, each still
+    # evaluated against its own `expect` and classified independently. A
+    # group's effective timeout is the largest any member declares, so no
+    # duplicate is cut short by another's shorter budget.
     def execute_gates(gates, base_dir:, lane:, repo_root:)
-      gates.map do |gate|
+      resolved = gates.map do |gate|
         g   = gate.transform_keys(&:to_s)
-        dir =
-          if (cwd = g["cwd"])
-            gate_cwd = space.path.join(cwd)
-            if lane && repo_root && (gate_cwd == repo_root || gate_cwd.to_s.start_with?("#{repo_root}/"))
-              base_dir.join(gate_cwd.relative_path_from(repo_root)).cleanpath
-            else
-              gate_cwd
-            end
-          else
-            base_dir
-          end
+        dir = resolve_gate_dir(g, base_dir: base_dir, lane: lane, repo_root: repo_root)
         raise Space::Core::Error, "directory does not exist: #{dir}" unless dir.exist?
+        [g, dir]
+      end
+
+      groups = resolved.group_by { |g, dir| [g["cmd"], dir.to_s] }
+      captures = groups.transform_values do |members|
+        timeout       = members.map { |g, _| g["timeout"] || DEFAULT_GATE_TIMEOUT }.max
+        sample_g, dir = members.first
+        capture_with_timeout(sample_g["cmd"], dir: dir, timeout: timeout).merge(timeout: timeout)
+      end
 
-        effective = g["timeout"] || DEFAULT_GATE_TIMEOUT
-        captured = capture_with_timeout(g["cmd"], dir: dir, timeout: effective)
+      resolved.map do |g, dir|
+        key      = [g["cmd"], dir.to_s]
+        captured = captures[key]
+        siblings = groups[key].map { |gg, _| gg["id"] } - [g["id"]]
 
         if captured[:timed_out]
           status = :fail
-          reason = "timed out after #{effective}s"
+          reason = "timed out after #{captured[:timeout]}s"
         else
           ev     = GateEvaluator.call(stdout: captured[:stdout], exit_code: captured[:exit_code], expect: g["expect"] || {})
           status = ev.pass? ? :pass : :fail
@@ -1282,8 +1211,67 @@ module Space::Architect
 
         { id: g["id"], ac: g["ac"].to_s, cmd: g["cmd"], expect: g["expect"],
           stdout: captured[:stdout], stderr: captured[:stderr], exit_code: captured[:exit_code],
-          dir: dir, status: status, reason: reason, timed_out: captured[:timed_out] }
+          dir: dir, status: status, reason: reason, timed_out: captured[:timed_out],
+          shared_with: siblings }
+      end
+    end
+
+    # The directory a single gate executes in: its own `cwd` (remapped into the
+    # lane worktree when it falls under repo_root) or the run's base_dir.
+    def resolve_gate_dir(g, base_dir:, lane:, repo_root:)
+      return base_dir unless (cwd = g["cwd"])
+
+      gate_cwd = space.path.join(cwd)
+      if lane && repo_root && (gate_cwd == repo_root || gate_cwd.to_s.start_with?("#{repo_root}/"))
+        base_dir.join(gate_cwd.relative_path_from(repo_root)).cleanpath
+      else
+        gate_cwd
+      end
+    end
+
+    # I01: the durable, unbounded counterpart to the CLI's bounded terminal
+    # report — one file per non-EMPTY rehearsal under build/rehearse/, holding
+    # every gate's full command, dir, exit code, verdict, reason, and complete
+    # stdout+stderr, plus the scope-asymmetry findings. The CLI prints this
+    # path so a rerun is never needed just to see output the terminal trimmed.
+    def write_rehearsal_transcript(entry, repo, base_dir, gate_results, scope_report, now)
+      dir  = space.path.join("build", "rehearse")
+      FileUtils.mkdir_p(dir)
+      path = dir.join("#{iteration_id(entry)}-#{now.strftime('%Y%m%dT%H%M%S.%6N')}.md")
+
+      lines = ["# Rehearsal transcript — #{entry['name']} — #{now.iso8601}"]
+      lines << (repo ? "Repo: #{repo} (#{base_dir})" : "Each gate ran in its own declared cwd")
+
+      gate_results.each do |g|
+        lines << ""
+        lines << "## #{g[:ac].empty? ? "(gate)" : g[:ac]} #{g[:id]} — #{g[:rehearsal].to_s.upcase} (exit #{g[:exit_code].inspect})"
+        lines << "cmd: #{g[:cmd]}"
+        lines << "dir: #{g[:dir]}"
+        lines << "reason: #{g[:reason]}" unless g[:reason].to_s.empty?
+        lines << "shared execution with: #{g[:shared_with].join(', ')} (identical cmd+dir, captured once)" if g[:shared_with]&.any?
+        lines << "--- stdout ---"
+        lines << g[:stdout].to_s
+        lines << "--- stderr ---"
+        lines << g[:stderr].to_s
+      end
+
+      if scope_report && (scope_report[:findings].any? || scope_report[:not_analyzable].any?)
+        lines << ""
+        lines << "## Scope-asymmetry check (grep-family gates only)"
+        scope_report[:findings].each do |f|
+          lines << "── #{f[:id]} (#{f[:repo]}): pattern #{f[:pattern].inspect} searched #{f[:paths].join(', ')}"
+          if f[:outside_lanes].any?
+            lines << "OUTSIDE ANY LANE'S TOUCH SET — no lane may legally fix these:"
+            f[:outside_lanes].each { |file| lines << "  #{file}" }
+          end
+          lines << "also matches (within a declared lane's touch set): #{f[:within_lanes].join(', ')}" if f[:within_lanes].any?
+          lines << "0 files elsewhere match" if f[:outside_lanes].empty? && f[:within_lanes].empty?
+        end
+        scope_report[:not_analyzable].each { |na| lines << "not analyzed — #{na[:id]}: #{na[:reason]}" }
       end
+
+      path.write("#{lines.join("\n")}\n")
+      path
     end
 
     # I09/AC4, #90/AC5-AC6: resolve the repo to default for gates that declare no
@@ -1617,23 +1605,23 @@ module Space::Architect
     end
 
     # Resolve harness + model by precedence: explicit value > (dispatch only) the
-    # lane's stored value > space.yaml project.harness/project.model > the
-    # per-harness sensible default (model only, keyed on the resolved harness).
-    # Shared by worktree_add and dispatch so both read the same defaults. A stored
-    # model is only honored when its stored harness still matches the resolved
-    # harness — a dispatch-time harness override drops the old harness's stored
-    # model instead of leaking it into the new harness's run.
+    # lane's stored value > space.yaml project.harness/project.model > the pi
+    # default model. Shared by worktree_add and dispatch so both read the same
+    # defaults. A stored model is only honored when its stored harness still matches
+    # the resolved harness — a dispatch-time harness override drops the old harness's
+    # stored model instead of leaking it into the new harness's run. A stored
+    # legacy harness name survives resolution (so a stale space.yaml
+    # surfaces as Harness.for's actionable pi-only error, not a silent default).
     def resolve_harness_model(harness, model, stored_harness: nil, stored_model: nil)
       defaults = project_defaults
-      resolved_harness = (harness || stored_harness || defaults["harness"] || "claude-code").to_s
+      resolved_harness = (harness || stored_harness || defaults["harness"] || "pi").to_s
       stored_model = nil unless stored_harness.nil? || stored_harness.to_s == resolved_harness
-      resolved_model = model || stored_model || defaults["model"] || Harness.default_model_for(resolved_harness)
+      resolved_model = model || stored_model || defaults["model"] || Harness::DEFAULT_MODEL
       [resolved_harness, resolved_model]
     end
 
     # --prompt: the caller authors the lane prompt anywhere (a fresh scratch file) and
-    # the CLI owns the canonical copy — byte-for-byte, like variant_add. Shared by
-    # dispatch and dispatch_as_job so both refuse the same empty/stub prompt.
+    # the CLI owns the canonical copy — byte-for-byte, like variant_add.
     def copy_and_validate_prompt!(prompt, prompt_path)
       if prompt
         src = Pathname.new(prompt)
@@ -1648,8 +1636,8 @@ module Space::Architect
         if prompt_content.empty? || prompt_content == PROMPT_STUB.strip
     end
 
-    # Resolve harness/model/effort for a dispatch (local or --as-job), shared so the
-    # two dispatch paths can never drift on precedence or thinking-level translation.
+    # Resolve harness/model/effort for a dispatch, so every dispatch path reads
+    # precedence and thinking-level translation from one place.
     def resolve_dispatch_harness(lane_entry, model:, harness:, effort:, force:, err:)
       model, suffix_level = Harness.parse_model_suffix(model)
       resolved_harness, resolved_model = resolve_harness_model(harness, model,
@@ -1669,69 +1657,9 @@ module Space::Architect
       [resolved_harness, resolved_model, resolved_effort]
     end
 
-    # #89/AC1-AC5: resolve the claude-code --allowedTools grant for a dispatch (local or
-    # --as-job), shared so both paths resolve precedence identically. The CLI flag beats
-    # the lane's recorded allowed_tools:/append_allowed_tools: (frozen-declaration or a
-    # prior dispatch's stamp) — resolved independently for replace vs. append, so a flag
-    # on one axis and a lane value on the other both apply (Objective A). Meaningless for
-    # opencode/pi (no equivalent grant mechanism) — still resolved/recorded for visibility,
-    # but Harness.for only wires it into the claude-code branch's argv.
-    def resolve_allowed_tools(lane_entry, allowed_tools:, append_allowed_tools:)
-      replace, replace_from =
-        if allowed_tools
-          [allowed_tools, "--allowed-tools flag"]
-        elsif lane_entry["allowed_tools"]
-          [lane_entry["allowed_tools"], "lane's allowed_tools:"]
-        else
-          [nil, "default"]
-        end
-
-      append, append_from =
-        if append_allowed_tools
-          [append_allowed_tools, "--append-allowed-tools flag"]
-        elsif lane_entry["append_allowed_tools"]
-          [lane_entry["append_allowed_tools"], "lane's append_allowed_tools:"]
-        end
-
-      final = Harness::ClaudeCodeHarness.resolve_tools(replace: replace, append: append)
-      provenance = "allowed-tools: #{replace_from}#{append_from ? " + #{append_from}" : ""} → #{final}"
-      [final, replace, append, provenance]
-    end
-
-    # Compose a dispatch --as-job spec per the space-server's job contract: prompt +
-    # workspace.dir (the lane worktree) + environment (deps/network/mounts/env or
-    # secrets) + harness (claude/backend/args) + provenance. mounts are src:dst with
-    # src == dst — the sandboxed executor requires the lane worktree AND the repo
-    # checkout mounted at their identical host absolute paths for the worktree's
-    # gitdir pointer to resolve.
-    def job_spec(iteration:, lane:, wt_path:, build_dir:, repo_path:, prompt_content:, backend_url:,
-                job_model:, api_key_ref:, harness_args:)
-      harness = { "type" => "claude", "backend" => { "base_url" => backend_url }, "args" => harness_args }
-      harness["model"] = job_model if job_model
-      harness["backend"]["api_key_ref"] = api_key_ref if api_key_ref
-
-      environment = {
-        "env"  => api_key_ref ? {} : { "ANTHROPIC_API_KEY" => "unused-for-keyless-backends" },
-        "deps" => ["git"],
-        "permissions" => {
-          "network" => true,
-          "mounts"  => ["#{build_dir}:#{build_dir}", "#{repo_path}:#{repo_path}"]
-        }
-      }
-      environment["secrets"] = [{ "ref" => api_key_ref, "name" => "ANTHROPIC_API_KEY" }] if api_key_ref
-
-      {
-        "prompt"      => prompt_content,
-        "workspace"   => { "dir" => wt_path.to_s },
-        "environment" => environment,
-        "harness"     => harness,
-        "provenance"  => { "space" => Space::Core::Slugger.slug(space.title), "iteration" => iteration, "lane" => lane }
-      }
-    end
-
     def recorded_lane_fields(lane_entry)
       {
-        harness: lane_entry["harness"] || "claude-code",
+        harness: lane_entry["harness"] || "pi",
         model:   lane_entry["model"],
         variant: lane_entry["variant"] || false,
         effort:  lane_entry["effort"]