@hcflabs/pi-subagent 27.11.0 → 28.0.0

package/README.md

@@ -153,7 +153,7 @@ Use isolated mode for checked implementation. An isolated request has one durabl
 }
 ```
 
-`dependsOn` controls scheduling. `contextFrom` also schedules dependencies and supplies completed text outputs in order. Do not repeat a task in both fields. Changesets require focused checks; graphs with changesets require final checks. The canonical root `package.json` must have a test script. The runner adds `pnpm test` to final checks if absent.
+`dependsOn` controls scheduling. `contextFrom` also schedules dependencies and supplies completed text outputs in order. Do not repeat a task in both fields. Changesets require focused checks; graphs with changesets require final checks. Admission selects one Full suite for the repository and adds it to the final checks if absent. See [Full suite](#full-suite).
 
 Workers use Main's pinned committed branch, HEAD, and tree, not staged, unstaged, or untracked edits. Branch or HEAD changes block new waves. Candidates must be committed with no tracked or untracked changes. Ignored generated files permit candidacy but prevent automatic cleanup.
 
@@ -174,6 +174,24 @@ Reuse assumes that checks use only tracked content. Ignored files, for example `
 
 The extension sends follow-ups when a candidate becomes ready, a worker needs attention, and the wave finishes. A missed follow-up does not authorize replay. Read [Isolated contract](./docs/orchestration.md#isolated-contract) and [Exact integration actions](./docs/orchestration.md#exact-integration-actions) for graph, judgment, revision, refresh, and release details.
 
+### Full suite
+
+Each isolated request with a changeset task must pass one Full suite on the combined tip before promotion. Admission selects it in this order:
+
+1. The `repoSuites` entry for the repository in the config file.
+2. `pnpm test`, when the root `package.json` has a non-empty `scripts.test`.
+3. `make test`, when the root `GNUmakefile`, `makefile`, or `Makefile` declares a literal `test` target, such as `test:` or `test::`.
+
+If no source applies, the request fails before it saves state. A read or parse error also fails. It never counts as an absent source. The extension reads the Makefile as text and never runs Make to find targets, because Make can run repository code. Generated, included, or pattern targets are not found. Use `repoSuites` for them:
+
+```json
+{ "repoSuites": { "/home/me/code/service": { "command": "uv", "args": ["run", "pytest", "-q"] } } }
+```
+
+The key is the absolute path of the primary checkout. Two keys for the same checkout block the request. The command runs without a shell. To use a shell, name it as the command.
+
+Admission saves the selected suite and its source with the request. Validation, resume, and recovery use the saved suite, so a later config change does not change an admitted request. Validation rejects a combined tip that changes the selected `package.json` test script or Makefile. A dry run shows the selected suite.
+
 ### Inspect work
 
 Open `/subagent` to browse direct work on this session branch and isolated requests in the current canonical Git checkout, including other sessions. The menu groups rows under **Direct**, **Isolated**, and **Orphaned** headers. Each isolated row shows the request ID, the status, and a short goal summary. **Refresh** or a header reloads saved status without recovery or mutation. Invalid state IDs stay preserved with a warning. Direct recovery remains available outside Git or without isolated inventory.
@@ -217,6 +235,7 @@ Package-owned: `~/.pi/agent/config/pi-subagent/config.json`. Missing files silen
 | `timeout.idleMinutes` | Direct worker and ephemeral child idle timeout | Positive; within Node's timer range | `10` |
 | `timeout.maxMinutes` | Ephemeral child hard runtime | Greater than idle; within Node's timer range | `30` |
 | `roleDefaults` | Shared resources for built-in and user Roles | Object with `extensions`, `tools`, or `skills` arrays; same validation as Role fields | — |
+| `repoSuites` | Full suite for isolated changesets in one repository | Object keyed by the absolute path of the primary checkout. Each value is `{ "command": "<executable>", "args": [...] }` | — |
 
 `roleDefaults` entries precede Role entries; merging removes duplicates before resource resolution. Use it for a provider extension that every child needs. Limits come only from this file. Requests cannot override or replenish them. Durable requests keep recorded policy; a lower current correction limit can tighten recovery. There is no whole-run timeout.
 
@@ -225,6 +244,7 @@ The extension reports each new problem once per session. It reads config at laun
 - Unknown keys warn and are ignored. A likely misspelling, such as `maxToken` for missing `maxTokens`, counts as invalid for that key.
 - Invalid `maxSubagents`, `maxTurns`, `maxCorrections`, or `timeout` values warn and use finite defaults. If maximum timeout does not exceed idle timeout, the whole `timeout` uses defaults.
 - Unknown or invalid `roleDefaults` keys warn; only those keys are ignored, so Roles receive fewer default resources.
+- An invalid `repoSuites` value blocks delegation. One bad entry blocks the whole value, so a bad entry cannot select a different Full suite.
 - Invalid or misspelled `maxTokens` blocks delegation. Malformed JSON, invalid UTF-8, files above 64 KiB, and unreadable files also block delegation. The extension does not fall back to unlimited tokens.
 
 `/subagent` remains available during a block. Correct the file to enable delegation. The next worker or isolated Role launch fails while the block remains; running workers retain their original limits. If the problem existed at session start, also run `/reload`, because that session took default execution limits.
@@ -281,7 +301,7 @@ The executor accepts concurrency, turn/token, idle/hard-runtime limits, and abor
 
 Private durable state lives under `config/pi-subagent/state/`. Isolated worker sessions use mode `0600` under `config/pi-subagent/leases/`; worker umask stays unchanged. Reads stop at 16 MiB. Larger sessions require inspection and cannot prove completion.
 
-Sessions are removed only after exact worker-tab cleanup. They can contain prompts and answers: do not share them. State v5 rejects v4 and older files without migration. Preserve old state and recover its work manually.
+Sessions are removed only after exact worker-tab cleanup. They can contain prompts and answers: do not share them. State v6 rejects v5 and older files without migration. An unfinished v4 or v5 request blocks new isolated work in its repository. Finish or recover isolated requests with the earlier version before you upgrade. Preserve old state and recover its work manually.
 
 ## Limits and recovery
 

package/dist/full-suite.d.ts

@@ -0,0 +1,34 @@
+import type { AdmittedFullSuite, CheckCommand } from "./schema.ts";
+export type { AdmittedFullSuite };
+/** Make reads the first of these files that exists. */
+declare const MAKEFILE_NAMES: readonly ["GNUmakefile", "makefile", "Makefile"];
+/** The root `package.json` test script, or `undefined` when the file or the script is absent. A malformed file throws. */
+export declare function packageTestScript(root: string): string | undefined;
+/**
+ * Return true when the Makefile text declares a literal `test` target, for example `test:` or `test check::`.
+ * This is a static check. It never runs Make, because Make can run repository code while it reads a file.
+ * Generated, included, or pattern targets are not found. Configure `repoSuites` for them.
+ */
+export declare function declaresMakeTest(text: string): boolean;
+/** The Makefile that Make would read in `root`, with its content hash. `undefined` when no Makefile exists. */
+export declare function makefileIdentity(root: string): {
+    file: (typeof MAKEFILE_NAMES)[number];
+    text: string;
+    sha256: string;
+} | undefined;
+/**
+ * Select the Full suite for `root`. The order is: the configured suite, then `pnpm test` when the root
+ * `package.json` has a non-empty `scripts.test`, then `make test` when the root Makefile declares `test`.
+ * A read or parse error throws. It never counts as an absent source.
+ */
+export declare function resolveFullSuite(root: string, configured?: CheckCommand): AdmittedFullSuite;
+/** Throw when the checkout at `root` changed the source of an admitted Full suite. A configured suite has no source file. */
+export declare function assertFullSuiteSource(suite: AdmittedFullSuite, root: string): void;
+export declare const sameCheck: (left: CheckCommand, right: CheckCommand) => boolean;
+/** A human-readable source label for plans and status. */
+export declare function describeFullSuite(suite: AdmittedFullSuite): string;
+/**
+ * The `repoSuites` entry for the primary checkout `primary`. Keys are compared by real path.
+ * Two keys for the same checkout throw, because the choice between them is not defined.
+ */
+export declare function configuredSuiteFor(repoSuites: Readonly<Record<string, CheckCommand>>, primary: string): CheckCommand | undefined;

package/dist/full-suite.js

@@ -0,0 +1,142 @@
+import { createHash } from "node:crypto";
+import { readdirSync, readFileSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+/** Make reads the first of these files that exists. */
+const MAKEFILE_NAMES = ["GNUmakefile", "makefile", "Makefile"];
+const MANIFEST_MAX_BYTES = 1024 * 1024;
+function readOptional(path) {
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT" || code === "ENOTDIR")
+            return undefined;
+        throw new Error(`Full suite detection cannot read ${path}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    if (Buffer.byteLength(text, "utf8") > MANIFEST_MAX_BYTES)
+        throw new Error(`Full suite detection refuses ${path}: the file is larger than 1 MiB.`);
+    return text;
+}
+/** The root `package.json` test script, or `undefined` when the file or the script is absent. A malformed file throws. */
+export function packageTestScript(root) {
+    const path = join(root, "package.json");
+    const text = readOptional(path);
+    if (text === undefined)
+        return undefined;
+    let manifest;
+    try {
+        manifest = JSON.parse(text);
+    }
+    catch (error) {
+        throw new Error(`Full suite detection cannot parse ${path}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest))
+        throw new Error(`Full suite detection found no JSON object in ${path}.`);
+    const scripts = manifest.scripts;
+    if (scripts === undefined)
+        return undefined;
+    if (!scripts || typeof scripts !== "object" || Array.isArray(scripts))
+        throw new Error(`Full suite detection found a malformed scripts field in ${path}.`);
+    const test = scripts.test;
+    if (test === undefined)
+        return undefined;
+    if (typeof test !== "string")
+        throw new Error(`Full suite detection found a test script that is not text in ${path}.`);
+    return test.trim() ? test : undefined;
+}
+/**
+ * Return true when the Makefile text declares a literal `test` target, for example `test:` or `test check::`.
+ * This is a static check. It never runs Make, because Make can run repository code while it reads a file.
+ * Generated, included, or pattern targets are not found. Configure `repoSuites` for them.
+ */
+export function declaresMakeTest(text) {
+    let continued = false;
+    for (const line of text.split(/\r?\n/)) {
+        const previous = continued;
+        continued = /(^|[^\\])(\\\\)*\\$/.test(line);
+        // Recipe lines start with a tab. Continuation lines belong to the line before them.
+        if (previous || line.startsWith("\t"))
+            continue;
+        const rule = /^([^#:=]+?)::?(?![=:])/.exec(line);
+        if (!rule)
+            continue;
+        if (rule[1].trim().split(/\s+/).includes("test"))
+            return true;
+    }
+    return false;
+}
+/** The Makefile that Make would read in `root`, with its content hash. `undefined` when no Makefile exists. */
+export function makefileIdentity(root) {
+    // Compare exact names. A case-insensitive file system would otherwise report Makefile as makefile.
+    let names;
+    try {
+        names = new Set(readdirSync(root));
+    }
+    catch (error) {
+        throw new Error(`Full suite detection cannot list ${root}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    for (const file of MAKEFILE_NAMES) {
+        if (!names.has(file))
+            continue;
+        const text = readOptional(join(root, file));
+        if (text !== undefined)
+            return { file, text, sha256: createHash("sha256").update(text).digest("hex") };
+    }
+    return undefined;
+}
+/**
+ * Select the Full suite for `root`. The order is: the configured suite, then `pnpm test` when the root
+ * `package.json` has a non-empty `scripts.test`, then `make test` when the root Makefile declares `test`.
+ * A read or parse error throws. It never counts as an absent source.
+ */
+export function resolveFullSuite(root, configured) {
+    if (configured)
+        return { check: { command: configured.command, args: [...configured.args] }, source: { kind: "config" } };
+    const testScript = packageTestScript(root);
+    if (testScript !== undefined)
+        return { check: { command: "pnpm", args: ["test"] }, source: { kind: "package-json", testScript } };
+    const makefile = makefileIdentity(root);
+    if (makefile && declaresMakeTest(makefile.text)) {
+        return { check: { command: "make", args: ["test"] }, source: { kind: "makefile", file: makefile.file, sha256: makefile.sha256 } };
+    }
+    throw new Error(`No Full suite is available for ${root}. Configure repoSuites in config/pi-subagent/config.json, add a package.json scripts.test, or add a Makefile test target.`);
+}
+/** Throw when the checkout at `root` changed the source of an admitted Full suite. A configured suite has no source file. */
+export function assertFullSuiteSource(suite, root) {
+    const { source } = suite;
+    if (source.kind === "package-json" && packageTestScript(root) !== source.testScript) {
+        throw new Error("Combined tip changed the admitted root package.json test script.");
+    }
+    if (source.kind === "makefile") {
+        const makefile = makefileIdentity(root);
+        if (makefile?.file !== source.file || makefile.sha256 !== source.sha256)
+            throw new Error(`Combined tip changed the admitted root ${source.file}.`);
+    }
+}
+export const sameCheck = (left, right) => left.command === right.command && left.args.length === right.args.length && left.args.every((arg, index) => arg === right.args[index]);
+/** A human-readable source label for plans and status. */
+export function describeFullSuite(suite) {
+    const command = [suite.check.command, ...suite.check.args].join(" ");
+    return suite.source.kind === "config" ? `${command} (from repoSuites config)`
+        : suite.source.kind === "package-json" ? `${command} (from package.json scripts.test)`
+            : `${command} (from ${suite.source.file} test target)`;
+}
+/**
+ * The `repoSuites` entry for the primary checkout `primary`. Keys are compared by real path.
+ * Two keys for the same checkout throw, because the choice between them is not defined.
+ */
+export function configuredSuiteFor(repoSuites, primary) {
+    const matches = Object.entries(repoSuites).filter(([key]) => {
+        try {
+            return realpathSync.native(key) === primary;
+        }
+        catch {
+            return key === primary;
+        }
+    });
+    if (matches.length > 1)
+        throw new Error(`repoSuites has ${matches.length} entries for ${primary}: ${matches.map(([key]) => key).join(", ")}. Keep one entry.`);
+    return matches[0]?.[1];
+}

package/dist/index.d.ts

@@ -94,6 +94,16 @@ export interface ResolvedRoleSkills {
 export declare function parseRoleName(value: unknown, source?: string): RoleName;
 /** Validate `config.json` `roleDefaults` with the same rules as Role fields; `label` prefixes errors. */
 export declare function parseRoleDefaults(value: unknown, label?: string): RoleDefaults;
+/** A configured Full suite: one executable and its argument list. No shell runs unless the executable is a shell. */
+export interface RepoSuite {
+    command: string;
+    args: string[];
+}
+/**
+ * Strict `repoSuites`: any bad entry makes the whole value invalid, and the field disables delegation.
+ * Dropping one bad entry could select a different Full suite without notice.
+ */
+export declare function parseRepoSuites(raw: unknown): Record<string, RepoSuite>;
 export interface SubagentConfig {
     maxSubagents: number;
     maxTurns: number;
@@ -104,6 +114,8 @@ export interface SubagentConfig {
         maxMinutes: number;
     };
     roleDefaults: RoleDefaults;
+    /** Full suite overrides for isolated changesets, keyed by absolute primary checkout path. */
+    repoSuites: Record<string, RepoSuite>;
 }
 export declare const DEFAULT_SUBAGENT_CONFIG: Readonly<SubagentConfig>;
 /**
@@ -121,6 +133,7 @@ export declare function createSubagentConfigStore(agentDir?: string): import("@h
         maxMinutes: number;
     }>;
     roleDefaults: import("@hcflabs/pi-config-store").Field<RoleDefaults>;
+    repoSuites: import("@hcflabs/pi-config-store").Field<Record<string, RepoSuite>>;
 }>>;
 /**
  * Report `roleDefaults` issues at each session start, and return a function that reports them after a lazy

package/dist/index.js

@@ -194,6 +194,41 @@ const roleDefaultsField = (raw, report) => {
     }
     return defaults;
 };
+const MAX_REPO_SUITES = 200;
+const MAX_SUITE_ARGS = 128;
+const MAX_SUITE_TEXT = 16_000;
+/**
+ * Strict `repoSuites`: any bad entry makes the whole value invalid, and the field disables delegation.
+ * Dropping one bad entry could select a different Full suite without notice.
+ */
+export function parseRepoSuites(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        throw new Error("must be a JSON object keyed by absolute primary checkout paths");
+    const entries = Object.entries(raw);
+    if (entries.length > MAX_REPO_SUITES)
+        throw new Error(`has ${entries.length} entries; the limit is ${MAX_REPO_SUITES}`);
+    const suites = {};
+    for (const [key, value] of entries) {
+        const label = JSON.stringify(key);
+        if (!isAbsolute(key) || key.length > 4096 || /[\u0000-\u001f\u007f]/.test(key))
+            throw new Error(`key ${label} must be an absolute path without control characters`);
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error(`${label} must be an object with command and args`);
+        for (const field of Object.keys(value)) {
+            if (field !== "command" && field !== "args")
+                throw new Error(`${label} has unknown key ${JSON.stringify(field)}; expected command and args`);
+        }
+        const { command, args } = value;
+        if (typeof command !== "string" || !command.trim() || command !== command.trim() || command.length > MAX_SUITE_TEXT || /[\u0000-\u001f\u007f]/.test(command)) {
+            throw new Error(`${label}.command must be one executable name or path without spaces at the ends or control characters`);
+        }
+        if (!Array.isArray(args) || args.length > MAX_SUITE_ARGS || args.some((arg) => typeof arg !== "string" || arg.length > MAX_SUITE_TEXT || arg.includes("\0"))) {
+            throw new Error(`${label}.args must be a list of at most ${MAX_SUITE_ARGS} strings without NUL`);
+        }
+        suites[key] = { command, args: [...args] };
+    }
+    return suites;
+}
 export const DEFAULT_SUBAGENT_CONFIG = Object.freeze({
     maxSubagents: 5,
     maxTurns: DEFAULT_MAX_TURNS,
@@ -201,6 +236,7 @@ export const DEFAULT_SUBAGENT_CONFIG = Object.freeze({
     maxCorrections: 1,
     timeout: Object.freeze({ idleMinutes: 10, maxMinutes: 30 }),
     roleDefaults: Object.freeze({}),
+    repoSuites: Object.freeze({}),
 });
 const timeoutMinutes = parsers.number({ greaterThan: 0, max: 2_147_483_647 / 60_000 });
 const timeoutField = (raw, report) => {
@@ -229,6 +265,7 @@ export function createSubagentConfigStore(agentDir = getAgentDir()) {
             maxCorrections: field(parsers.integer({ min: 0 }), DEFAULT_SUBAGENT_CONFIG.maxCorrections),
             timeout: field(timeoutField, DEFAULT_SUBAGENT_CONFIG.timeout),
             roleDefaults: field(roleDefaultsField, DEFAULT_SUBAGENT_CONFIG.roleDefaults),
+            repoSuites: field((raw) => parseRepoSuites(raw), DEFAULT_SUBAGENT_CONFIG.repoSuites, { onInvalid: "disable" }),
         },
     });
 }

package/dist/runner.d.ts

@@ -2,7 +2,7 @@ import { type DiscardGuards, type DiscardPlan } from "./discard.ts";
 import { type EphemeralSubagentExecutor } from "./ephemeral.ts";
 import type { PruneOwnership } from "./prune.ts";
 import { IntegrationGit } from "./integration-git.ts";
-import { type AllocationKind, type CheckCommand, type ChangesetTaskRequest, type CleanupKind, type ExecuteRequest, type ExecutionPolicySnapshot, type HostAllocationIntent, type HostAllocationPlan, type ModelClass, type ReviewEvidence, type ResumeRequest, type RunState, type TaskAttempt, type TaskRequest, type TaskState, type WorktreeAllocationIntent, type WorktreeAllocationPlan, type WorkspaceIdentity } from "./schema.ts";
+import { type AdmittedFullSuite, type AllocationKind, type CheckCommand, type ChangesetTaskRequest, type CleanupKind, type ExecuteRequest, type ExecutionPolicySnapshot, type HostAllocationIntent, type HostAllocationPlan, type ModelClass, type ReviewEvidence, type ResumeRequest, type RunState, type TaskAttempt, type TaskRequest, type TaskState, type WorktreeAllocationIntent, type WorktreeAllocationPlan, type WorkspaceIdentity } from "./schema.ts";
 import { FileRunStore } from "./store.ts";
 /** One durable follow-up per attempt; this instruction permits a worker commit, never discarded work. */
 export declare const COMMIT_NUDGE_INSTRUCTION = "Your turn ended with uncommitted changes in your worktree. Commit the intended changes now so the worktree is clean, or explain in your reply why they must not be committed. Do not discard work.";
@@ -100,6 +100,8 @@ export type ResolvedRoute = Pick<VerifiedLaunch, "role" | "modelClass" | "model"
 /** A dry-run result: the normalized request and the resolved routes; no state exists for it. */
 export interface ExecutePlan {
     request: ExecuteRequest;
+    /** The Full suite for a request with changeset tasks. */
+    fullSuite?: AdmittedFullSuite;
     root: string;
     main: WorkspaceIdentity;
     routes: readonly ResolvedRoute[];
@@ -311,9 +313,11 @@ export declare class IsolatedRunner {
     private readonly integrationGit;
     private readonly textExecutor;
     private readonly currentPolicy;
+    /** The configured `repoSuites`, read at admission only. */
+    private readonly repoSuites;
     private readonly productiveLifecycles;
     private readonly followupControls;
-    constructor(coordinatorRuntime: CoordinatorRuntime, hostRuntime: HostRuntime, gitRuntime: GitRuntime, store: FileRunStore | undefined, textExecutor: EphemeralSubagentExecutor, policy?: ExecutionPolicySnapshot, currentPolicy?: () => ExecutionPolicySnapshot, integrationGit?: IntegrationGit);
+    constructor(coordinatorRuntime: CoordinatorRuntime, hostRuntime: HostRuntime, gitRuntime: GitRuntime, store: FileRunStore | undefined, textExecutor: EphemeralSubagentExecutor, policy?: ExecutionPolicySnapshot, currentPolicy?: () => ExecutionPolicySnapshot, integrationGit?: IntegrationGit, repoSuites?: () => Readonly<Record<string, CheckCommand>>);
     listRequests(root: string): Promise<{
         requests: Array<{
             id: string;

package/dist/runner.js

@@ -1,7 +1,8 @@
-import { readFileSync, realpathSync } from "node:fs";
+import { realpathSync } from "node:fs";
 import { dirname } from "node:path";
 import { inspectDiscard, primaryCheckout, removeDiscardResources } from "./discard.js";
 import { utf8Prefix } from "./ephemeral.js";
+import { assertFullSuiteSource, configuredSuiteFor, resolveFullSuite, sameCheck } from "./full-suite.js";
 import { createChildWorktree, finalizeChildWorktree, inspectWorktreeDirty } from "./worktree.js";
 import { runGit } from "./git-process.js";
 import { IntegrationGit } from "./integration-git.js";
@@ -19,23 +20,8 @@ export const CLEANUP_SAFETY_BUDGET_MS = 30_000;
 export const TERMINATION_SAFETY_BUDGET_MS = 15_000;
 export const STATUS_INSPECTION_BUDGET_MS = 5_000;
 const ALLOCATION_KINDS = ["worktree", "workspace", "worker_tab", "agent"];
-const FULL_SUITE = { command: "pnpm", args: ["test"] };
 const MAX_RETAINED_INTEGRATION_GENERATIONS = 2;
-function requireRootSuite(root) {
-    let manifest;
-    try {
-        manifest = JSON.parse(readFileSync(`${root}/package.json`, "utf8"));
-    }
-    catch {
-        throw new Error("Canonical root package.json with a test script is required for isolated changesets.");
-    }
-    if (!manifest || typeof manifest !== "object" || !('scripts' in manifest)
-        || !manifest.scripts || typeof manifest.scripts !== "object"
-        || !('test' in manifest.scripts) || typeof manifest.scripts.test !== "string"
-        || !manifest.scripts.test.trim())
-        throw new Error("Canonical root test script is missing.");
-    return manifest.scripts.test;
-}
+const MAX_FINAL_CHECKS = 32;
 /** Run one launch action and surface cleanup failure, including after action failure or abort. */
 export async function withTransientLaunch(handle, operation) {
     let failed = false;
@@ -616,12 +602,15 @@ export class IsolatedRunner {
     integrationGit;
     textExecutor;
     currentPolicy;
+    /** The configured `repoSuites`, read at admission only. */
+    repoSuites;
     productiveLifecycles = new Map();
     followupControls = new Map();
     constructor(coordinatorRuntime, hostRuntime, gitRuntime, store = new FileRunStore(), textExecutor, policy = {
         maxSubagents: 5, maxTurns: 50, childIdleMs: 600_000, childMaxMs: 1_800_000,
         maxCorrections: 1,
-    }, currentPolicy = () => policy, integrationGit = new IntegrationGit()) {
+    }, currentPolicy = () => policy, integrationGit = new IntegrationGit(), repoSuites = () => ({})) {
+        this.repoSuites = repoSuites;
         this.coordinatorRuntime = coordinatorRuntime;
         this.hostRuntime = hostRuntime;
         this.gitRuntime = gitRuntime;
@@ -833,11 +822,17 @@ export class IsolatedRunner {
         const root = realpathSync.native(prepared.root);
         if (root !== prepared.root)
             throw new Error("Preflight repository root must be canonical.");
+        let fullSuite;
         if (request.tasks.some((task) => task.kind === "changeset")) {
-            requireRootSuite(root);
-            if (!request.finalChecks.some((check) => check.command === FULL_SUITE.command
-                && check.args.length === 1 && check.args[0] === FULL_SUITE.args[0])) {
-                request.finalChecks = [FULL_SUITE, ...request.finalChecks];
+            // Main is clean and committed here, so the working files are the committed sources.
+            const repoSuites = this.repoSuites();
+            const configured = Object.keys(repoSuites).length ? configuredSuiteFor(repoSuites, await primaryCheckout(root)) : undefined;
+            fullSuite = resolveFullSuite(root, configured);
+            if (!request.finalChecks.some((check) => sameCheck(check, fullSuite.check))) {
+                if (request.finalChecks.length >= MAX_FINAL_CHECKS) {
+                    throw new Error(`The Full suite ${formatCheckCommand(fullSuite.check)} cannot be added: the request already has ${MAX_FINAL_CHECKS} final checks.`);
+                }
+                request.finalChecks = [fullSuite.check, ...request.finalChecks];
             }
         }
         const preparedMain = runtimeIdentity(prepared.main, "Preflight Main identity");
@@ -846,22 +841,23 @@ export class IsolatedRunner {
         if (this.hasAnyActiveControl(root)) {
             throw new Error("Another Pi Subagent request has active changeset work in this repository.");
         }
-        return { request, policy, root, preparedMain, routes: prepared.routes ?? [] };
+        return { request, policy, root, preparedMain, routes: prepared.routes ?? [], ...(fullSuite ? { fullSuite } : {}) };
     }
     /** Dry run of execute: no state, lock, lease, worktree, or Herdr call. */
     async plan(value, cwd, outerSignal) {
-        const { request, root, preparedMain, routes } = await this.admitExecute(value, cwd, new ProductiveScope(outerSignal), true);
-        return { request, root, main: preparedMain, routes };
+        const { request, root, preparedMain, routes, fullSuite } = await this.admitExecute(value, cwd, new ProductiveScope(outerSignal), true);
+        return { request, root, main: preparedMain, routes, ...(fullSuite ? { fullSuite } : {}) };
     }
     async execute(value, cwd, outerSignal) {
         const scope = new ProductiveScope(outerSignal);
-        const { request, policy, root, preparedMain } = await this.admitExecute(value, cwd, scope, false);
+        const { request, policy, root, preparedMain, fullSuite } = await this.admitExecute(value, cwd, scope, false);
         return await this.withProductiveRun(root, async (lifecycle) => {
             const createdAt = this.coordinatorRuntime.now();
             const state = {
                 version: RUN_STATE_VERSION,
                 request,
                 policy,
+                ...(fullSuite ? { fullSuite } : {}),
                 correctionCount: 0,
                 root,
                 requestStartMain: preparedMain,
@@ -1478,12 +1474,12 @@ export class IsolatedRunner {
                 generation.status = "validating";
                 await this.saveProductive(handle); // Record the exact validation intent before running checks.
                 try {
-                    if (!request.finalChecks.some((check) => check.command === FULL_SUITE.command
-                        && check.args.length === 1 && check.args[0] === FULL_SUITE.args[0]))
-                        throw new Error("Canonical full-suite command was not recorded at admission.");
-                    if (requireRootSuite(generation.worktree.path) !== requireRootSuite(root)) {
-                        throw new Error("Combined tip changed the admitted canonical root test script.");
+                    const fullSuite = state.fullSuite;
+                    if (!fullSuite || !request.finalChecks.some((check) => sameCheck(check, fullSuite.check))) {
+                        throw new Error("The Full suite was not recorded at admission.");
                     }
+                    // The saved suite runs as admitted. A later config edit does not change it.
+                    assertFullSuiteSource(fullSuite, generation.worktree.path);
                     await this.requireExactIntegration(handle, generation, receipts, scope);
                     const sources = stagedCheckSources(generation, state.integration.candidates);
                     const checks = await this.runCheckBatch(handle, request.finalChecks, action.expectedTip, "final", scope, undefined, generation.worktree.path, request.finalChecks.map((check) => reusableCheckSource(check, action.expectedTip, sources)));

package/dist/schema.d.ts

@@ -1,5 +1,5 @@
 import { Type, type Static } from "typebox";
-export declare const RUN_STATE_VERSION = 5;
+export declare const RUN_STATE_VERSION = 6;
 export declare const MAX_TASKS = 8;
 export declare const MAX_EXECUTE_REQUEST_BYTES: number;
 export declare const MAX_PERSISTED_RUNTIME_TEXT_BYTES: number;
@@ -10,6 +10,24 @@ export declare const CheckCommandSchema: Type.TObject<{
     command: Type.TString;
     args: Type.TArray<Type.TString>;
 }>;
+/** The Full suite fixed at admission, with its source. Validation checks the same source again. */
+export declare const FullSuiteSchema: Type.TObject<{
+    check: Type.TObject<{
+        command: Type.TString;
+        args: Type.TArray<Type.TString>;
+    }>;
+    source: Type.TUnion<[Type.TObject<{
+        kind: Type.TLiteral<"config">;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"package-json">;
+        testScript: Type.TString;
+    }>, Type.TObject<{
+        kind: Type.TLiteral<"makefile">;
+        file: Type.TUnion<[Type.TLiteral<"GNUmakefile">, Type.TLiteral<"makefile">, Type.TLiteral<"Makefile">]>;
+        sha256: Type.TString;
+    }>]>;
+}>;
+export type AdmittedFullSuite = Static<typeof FullSuiteSchema>;
 /** One display form for a check command; quoted args keep argv boundaries visible. */
 export declare function formatCheckCommand({ command, args }: {
     command: string;
@@ -1756,7 +1774,7 @@ export type IntegrationState = Static<typeof IntegrationStateSchema>;
 declare const TerminalRunStatusSchema: Type.TUnion<[Type.TLiteral<"completed">, Type.TLiteral<"final_failed">, Type.TLiteral<"superseded">, Type.TLiteral<"aborted">]>;
 export declare const TERMINAL_RUN_STATUSES: readonly Static<typeof TerminalRunStatusSchema>[];
 declare const RunStateSchema: Type.TObject<{
-    version: Type.TLiteral<5>;
+    version: Type.TLiteral<6>;
     request: Type.TObject<{
         mode: Type.TLiteral<"isolated">;
         id: Type.TString;
@@ -1807,6 +1825,23 @@ declare const RunStateSchema: Type.TObject<{
         childMaxMs: Type.TNumber;
         maxCorrections: Type.TInteger;
     }>;
+    /** Present exactly when the request has a changeset task. */
+    fullSuite: Type.TOptional<Type.TObject<{
+        check: Type.TObject<{
+            command: Type.TString;
+            args: Type.TArray<Type.TString>;
+        }>;
+        source: Type.TUnion<[Type.TObject<{
+            kind: Type.TLiteral<"config">;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"package-json">;
+            testScript: Type.TString;
+        }>, Type.TObject<{
+            kind: Type.TLiteral<"makefile">;
+            file: Type.TUnion<[Type.TLiteral<"GNUmakefile">, Type.TLiteral<"makefile">, Type.TLiteral<"Makefile">]>;
+            sha256: Type.TString;
+        }>]>;
+    }>>;
     correctionCount: Type.TInteger;
     root: Type.TString;
     requestStartMain: Type.TObject<{
@@ -2429,7 +2464,7 @@ declare const RunStateSchema: Type.TObject<{
  */
 export declare const StatusOutputSchema: Type.TObject<{
     state: Type.TObject<{
-        version: Type.TLiteral<5>;
+        version: Type.TLiteral<6>;
         id: Type.TString;
         status: Type.TUnion<[Type.TLiteral<"pending">, Type.TLiteral<"running">, Type.TLiteral<"needs_attention">, Type.TLiteral<"completed">, Type.TLiteral<"final_failed">, Type.TLiteral<"superseded">, Type.TLiteral<"aborted">]>;
         accepted: Type.TBoolean;

package/dist/schema.js

@@ -2,7 +2,7 @@ import { isAbsolute } from "node:path";
 import { parseRoleName } from "./index.js";
 import { Type } from "typebox";
 import { Check, Errors } from "typebox/value";
-export const RUN_STATE_VERSION = 5;
+export const RUN_STATE_VERSION = 6;
 export const MAX_TASKS = 8;
 export const MAX_EXECUTE_REQUEST_BYTES = 256 * 1024;
 export const MAX_PERSISTED_RUNTIME_TEXT_BYTES = 8 * 1024;
@@ -26,6 +26,19 @@ export const CheckCommandSchema = Type.Object({
     command: TextSchema,
     args: Type.Array(Type.String({ maxLength: 16_000 }), { maxItems: 128 }),
 }, { additionalProperties: false });
+/** The Full suite fixed at admission, with its source. Validation checks the same source again. */
+export const FullSuiteSchema = Type.Object({
+    check: CheckCommandSchema,
+    source: Type.Union([
+        Type.Object({ kind: Type.Literal("config") }, { additionalProperties: false }),
+        Type.Object({ kind: Type.Literal("package-json"), testScript: Type.String({ minLength: 1, maxLength: 16_000 }) }, { additionalProperties: false }),
+        Type.Object({
+            kind: Type.Literal("makefile"),
+            file: Type.Union([Type.Literal("GNUmakefile"), Type.Literal("makefile"), Type.Literal("Makefile")]),
+            sha256: Type.String({ pattern: "^[0-9a-f]{64}$" }),
+        }, { additionalProperties: false }),
+    ]),
+}, { additionalProperties: false });
 /** One display form for a check command; quoted args keep argv boundaries visible. */
 export function formatCheckCommand({ command, args }) {
     return [command, ...args.map((arg) => JSON.stringify(arg))].join(" ");
@@ -420,6 +433,8 @@ const RunStateSchema = Type.Object({
     version: Type.Literal(RUN_STATE_VERSION),
     request: ExecuteRequestSchema,
     policy: ExecutionPolicySnapshotSchema,
+    /** Present exactly when the request has a changeset task. */
+    fullSuite: Type.Optional(FullSuiteSchema),
     correctionCount: Type.Integer({ minimum: 0 }),
     root: TextSchema,
     requestStartMain: WorkspaceSchema,
@@ -1015,6 +1030,13 @@ export function parseRunState(value) {
     const state = value;
     const request = parseExecuteRequest(state.request);
     parseIntegrationState(state.integration, request);
+    const changeset = request.tasks.some((task) => task.kind === "changeset");
+    if (changeset !== (state.fullSuite !== undefined))
+        throw new Error("A Full suite must be recorded exactly for a request with changeset tasks.");
+    if (state.fullSuite && !request.finalChecks.some(({ command, args }) => command === state.fullSuite.check.command
+        && args.length === state.fullSuite.check.args.length && args.every((arg, index) => arg === state.fullSuite.check.args[index]))) {
+        throw new Error("The recorded Full suite is not in the request final checks.");
+    }
     if (state.status !== "aborted" && state.integration.generations.some((generation) => generation.supersededFrom === "discarded")) {
         throw new Error("User-discarded generations require an aborted request.");
     }

package/dist/store.d.ts

@@ -53,7 +53,7 @@ export declare class FileRunStore {
         invalidIds: string[];
     }>;
     private stateEntries;
-    /** Read only version and request status; never migrate or interpret v4 worker evidence. */
+    /** Read only version and request status; never migrate or interpret v4 or v5 worker evidence. */
     assertLegacyAdmissionSafe(root: string): Promise<void>;
     list(root: string): Promise<{
         states: RunStateHandle[];

package/dist/store.js

@@ -18,8 +18,10 @@ const INITIAL_STATE_MAX_BYTES = 2 * 1024 * 1024;
 const STATE_MAX_BYTES = 128 * 1024 * 1024;
 const ADMISSION_MAX_FILES = 256;
 const ADMISSION_MAX_BYTES = STATE_MAX_BYTES;
-const V4_TERMINAL_STATUSES = new Set(["completed", "final_failed", "superseded", "aborted"]);
-const V4_UNFINISHED_STATUSES = new Set(["pending", "running", "needs_attention"]);
+// v4 and v5 use the same request statuses. Admission reads only the version and the status of older files.
+const LEGACY_VERSIONS = new Set([4, 5]);
+const LEGACY_TERMINAL_STATUSES = new Set(["completed", "final_failed", "superseded", "aborted"]);
+const LEGACY_UNFINISHED_STATUSES = new Set(["pending", "running", "needs_attention"]);
 const LOCK_OPTIONS = { realpath: false, stale: 30_000, update: 5_000, retries: 0 };
 const LIFECYCLE_LOCK_OPTIONS = {
     ...LOCK_OPTIONS,
@@ -317,7 +319,7 @@ export class FileRunStore {
             throw error;
         }
     }
-    /** Read only version and request status; never migrate or interpret v4 worker evidence. */
+    /** Read only version and request status; never migrate or interpret v4 or v5 worker evidence. */
     async assertLegacyAdmissionSafe(root) {
         const directory = this.stateDirectory(root);
         await this.assertSafeDestination(root, directory);
@@ -348,12 +350,12 @@ export class FileRunStore {
             }
             if (value.version === RUN_STATE_VERSION)
                 continue;
-            if (value.version !== 4 || !("status" in value) || typeof value.status !== "string"
-                || (!V4_TERMINAL_STATUSES.has(value.status) && !V4_UNFINISHED_STATUSES.has(value.status))) {
+            if (typeof value.version !== "number" || !LEGACY_VERSIONS.has(value.version) || !("status" in value) || typeof value.status !== "string"
+                || (!LEGACY_TERMINAL_STATUSES.has(value.status) && !LEGACY_UNFINISHED_STATUSES.has(value.status))) {
                 throw new Error(`Pi Subagent malformed or unsupported legacy state ${id} blocks safe admission. ${recovery}`);
             }
-            if (V4_UNFINISHED_STATUSES.has(value.status)) {
-                throw new Error(`Pi Subagent unfinished v4 request ${id} (${value.status}) blocks new isolated work. ${recovery}`);
+            if (LEGACY_UNFINISHED_STATUSES.has(value.status)) {
+                throw new Error(`Pi Subagent unfinished v${value.version} request ${id} (${value.status}) blocks new isolated work. ${recovery}`);
             }
         }
     }

package/docs/orchestration.md

@@ -81,7 +81,7 @@ Direct `changeset` is rejected; use isolated mode for checked integration. Resou
 
 ### Dry run
 
-Set `"dryRun": true` on a direct or isolated `delegate_task` request to check it without a launch. The dry run does the same checks as a launch: request shape, Role lookup, route and model with thinking level, Skills, tools, MCP allowlist, Role extensions, config, and `continueFrom` eligibility. For an isolated request, it also checks the task graph and that Main is clean and committed. If the request has a changeset task, it also checks the canonical root `package.json` test script and adds `pnpm test` to the final checks. A failed check gives the same error as a launch.
+Set `"dryRun": true` on a direct or isolated `delegate_task` request to check it without a launch. The dry run does the same checks as a launch: request shape, Role lookup, route and model with thinking level, Skills, tools, MCP allowlist, Role extensions, config, and `continueFrom` eligibility. For an isolated request, it also checks the task graph and that Main is clean and committed. If the request has a changeset task, it also selects the Full suite, adds it to the final checks, and shows it. A failed check gives the same error as a launch.
 
 The result is a bounded plan. It shows each task's Role, resolved `provider/model`, thinking level, access or kind, dependencies, and checks. An isolated plan also shows the final checks. The dry run makes no Herdr call, Herdr tab, session record, saved state, worktree, lease, checkout admission, or follow-up. The plan lists each check it cannot do without such an effect as `Not checked: <reason>`. Examples are the Herdr host preflight, checkout admission, and the stop of a continued agent.
 
@@ -257,7 +257,7 @@ Every task declares `id`, `kind`, `role`, `modelClass`, `requirements`, `deliver
 - A `changeset` task requires focused checks and owns one worktree, Herdr workspace, worker tab, and retained worker.
 - `dependsOn` controls ready waves; dependent tasks can run from a selected staged snapshot only after Main explicitly advances it.
 - `contextFrom` may reference completed text tasks only, implies scheduling dependencies, and preserves declaration order. It must not overlap `dependsOn`.
-- A graph containing changesets requires final checks. The repository root must have a `package.json` test script; admission prepends canonical `pnpm test` if absent from final checks. Combined validation rejects a changed root test script.
+- A graph containing changesets requires final checks. Admission selects one Full suite: the `repoSuites` config entry, then `pnpm test` for a root `package.json` test script, then `make test` for a literal Makefile `test` target. It prepends the suite to the final checks if absent and saves the suite with its source in state v6. Combined validation rejects a changed root test script or Makefile. A config change after admission does not change the saved suite.
 
 Admission and worker-wave dispatch pin Main's exact committed branch, HEAD, and tree without inspecting or modifying its staged, unstaged, or untracked edits. Worker allocation verifies the same committed identity around worktree creation, including resumed waves; staged-dependent waves verify their clean integration snapshot. A dirty Main can therefore produce a checked retained candidate, but branch/HEAD drift stops new waves. The runner executes ready worker tasks concurrently, inspects clean committed candidates, runs preliminary task checks and optional preliminary judgment, then records ready candidates for Main. **It does not automatically integrate them.**
 

package/extensions/isolated.ts

@@ -16,6 +16,7 @@ import { inspectPruneCandidates, listHerdrPanes, removePruneCandidates, type Pru
 import { runProcess as directRunProcess } from "../dist/process.js";
 import { RoleLaunchRuntime, type LaunchRuntimeOptions } from "../dist/launch-runtime.js";
 import { IsolatedRunner, nextIntegrationAction, type ExecutePlan, type OperationContext, type RunResponse } from "../dist/runner.js";
+import { describeFullSuite } from "../dist/full-suite.js";
 import {
 	IdOnlySchema,
 	ResumeRequestParameters,
@@ -29,6 +30,7 @@ import {
 	sameIdentity,
 	StatusOutputSchema,
 	type CheckBatchEvidence,
+	type CheckCommand,
 	type ExecuteRequest,
 	type ExecutionPolicySnapshot,
 	type ModelClass,
@@ -61,12 +63,14 @@ export type CreateIsolatedComponents = (options: {
 	executor: EphemeralSubagentExecutor;
 	policy: ExecutionPolicySnapshot;
 	currentPolicy(): ExecutionPolicySnapshot;
+	/** The configured Full suite overrides. Admission reads them after the policy check. */
+	repoSuites?(): Readonly<Record<string, CheckCommand>>;
 	onStateSaved(state: RunState): void;
 }) => IsolatedExtensionComponents;
 
 /** Construct the checked runtime while reusing the unified productive-assignment executor. */
 export const createIsolatedComponents: CreateIsolatedComponents = ({
-	pi, context, executor, policy, currentPolicy, onStateSaved,
+	pi, context, executor, policy, currentPolicy, repoSuites, onStateSaved,
 }) => {
 	const runProcess: DirectProcessRunner = async (command, args, options) => options.stdin === undefined
 		? await pi.exec(command, args, { cwd: options.cwd, signal: options.signal, timeout: options.timeoutMs })
@@ -96,6 +100,8 @@ export const createIsolatedComponents: CreateIsolatedComponents = ({
 			executor,
 			policy,
 			currentPolicy,
+			undefined,
+			repoSuites,
 		),
 	};
 };
@@ -473,7 +479,8 @@ function toolResult(response: RunResponse, ctx: ExtensionContext, rowsByRequest:
 }
 
 /** Bounded dry-run plan; a route missing from the coordinator report shows as unresolved. */
-export function formatExecutePlan({ request, root, main, routes }: ExecutePlan, hostChecked: boolean): { content: [{ type: "text"; text: string }]; details: unknown } {
+export function formatExecutePlan(plan: ExecutePlan, hostChecked: boolean): { content: [{ type: "text"; text: string }]; details: unknown } {
+	const { request, root, main, routes } = plan;
 	const route = (role: string, modelClass: ModelClass) => {
 		const found = routes.find((candidate) => candidate.role === role && candidate.modelClass === modelClass);
 		return found ? { model: found.model, thinkingLevel: found.thinkingLevel } : undefined;
@@ -495,6 +502,7 @@ export function formatExecutePlan({ request, root, main, routes }: ExecutePlan,
 			...(task.kind === "changeset" ? [`   checks: ${task.checks.map(formatCheckCommand).join("; ")}`,
 				...(task.judgment ? [`   judgment: ${label(task.judgment.role, task.judgment.modelClass)}`] : [])] : []),
 		].join("\n")),
+		...(plan.fullSuite ? [`Full suite: ${describeFullSuite(plan.fullSuite)}`] : []),
 		`Final checks: ${request.finalChecks.map(formatCheckCommand).join("; ") || "none"}`,
 		...(request.finalJudgment ? [`Final judgment: ${label(request.finalJudgment.role, request.finalJudgment.modelClass)}`] : []),
 		...notChecked.map((reason) => `Not checked: ${reason}.`),
@@ -507,6 +515,7 @@ export function formatExecutePlan({ request, root, main, routes }: ExecutePlan,
 				...route(task.role, task.modelClass), dependsOn: task.dependsOn, contextFrom: task.contextFrom,
 				...(task.kind === "changeset" ? { checks: task.checks, ...(task.judgment ? { judgment: { ...task.judgment, ...route(task.judgment.role, task.judgment.modelClass) } } : {}) } : {}) })),
 			finalChecks: request.finalChecks,
+			...(plan.fullSuite ? { fullSuite: plan.fullSuite } : {}),
 			...(request.finalJudgment ? { finalJudgment: { ...request.finalJudgment, ...route(request.finalJudgment.role, request.finalJudgment.modelClass) } } : {}),
 			notChecked,
 		},
@@ -533,6 +542,8 @@ export interface RegisterIsolatedOptions {
 	executor: EphemeralSubagentExecutor;
 	policy: ExecutionPolicySnapshot;
 	currentPolicy(): ExecutionPolicySnapshot;
+	/** The configured Full suite overrides for isolated changesets. */
+	repoSuites?(): Readonly<Record<string, CheckCommand>>;
 	/** Report new config issues, and throw when the config now blocks delegation, before each deferred Role launch. */
 	beforeRoleLaunch?(ctx: ExtensionContext): void;
 	componentsFactory?: CreateIsolatedComponents;
@@ -566,6 +577,7 @@ export function registerIsolatedExtension(pi: ExtensionAPI, options: RegisterIso
 		executor: options.executor,
 		policy: options.policy,
 		currentPolicy: options.currentPolicy,
+		...(options.repoSuites ? { repoSuites: options.repoSuites } : {}),
 		onStateSaved: (state) => {
 			savedRevision += 1;
 			for (const listener of stateListeners) listener(state);

package/extensions/subagent.ts

@@ -255,6 +255,8 @@ export default function subagentExtension(pi: ExtensionAPI): void {
 		executor,
 		policy: initialPolicy,
 		currentPolicy,
+		// Admission reads these after currentPolicy, which throws for a disabled config.
+		repoSuites: () => { const loaded = configStore.loadSync(); return loaded.status === "ok" ? loaded.value.repoSuites : {}; },
 		beforeRoleLaunch,
 	});
 	let directSequence = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hcflabs/pi-subagent",
-  "version": "27.11.0",
+  "version": "28.0.0",
   "description": "Delegate bounded direct work or durable checked isolated task graphs to Pi roles.",
   "keywords": [
     "pi-package",

package/skills/pi-subagent/SKILL.md

@@ -30,7 +30,7 @@ To build on a finished direct worker, add `continueFrom` with its reference (suc
 
 # Isolated requests
 
-Give the request a unique ID and goal. Give each task a unique ID, kind, Role, model class, bounded requirements, deliverable, `dependsOn`, and `contextFrom`. Changesets require focused task checks, and a graph containing changesets requires final checks. The root must have a `package.json` test script; `pnpm test` is added to final checks if missing and runs against the combined tip before Main promotion. Text context may name only completed text tasks, preserves declared order, and implies a scheduling dependency; do not repeat an edge in `dependsOn` and `contextFrom`.
+Give the request a unique ID and goal. Give each task a unique ID, kind, Role, model class, bounded requirements, deliverable, `dependsOn`, and `contextFrom`. Changesets require focused task checks, and a graph containing changesets requires final checks. Admission adds the repository's Full suite to final checks if missing: the `repoSuites` config entry, `pnpm test` for a root `package.json` test script, or `make test` for a Makefile `test` target. The suite runs against the combined tip before Main promotion. If no suite exists, tell the user to add one or configure `repoSuites`. Text context may name only completed text tasks, preserves declared order, and implies a scheduling dependency; do not repeat an edge in `dependsOn` and `contextFrom`.
 
 Every changeset becomes ready automatically after preliminary checks pass. While a locally owned changeset task is actively working, the user may open `/subagent` to queue bounded same-worker revisions or withdraw all still-pending instructions into the native editor and submit one replacement. Cancellation after withdrawal leaves the originals removed; already-claimed instructions cannot be recalled. Each revision must produce a new clean commit and rerun preliminary checks. If a worker's turn ends with uncommitted changes, the runner sends it one commit reminder per attempt; this uses no correction, and a worktree still dirty afterwards needs attention. When no queued revision remains, the runner seals and durably records the exact ready candidate without waiting for sibling workers. There is no guaranteed post-completion editing window, and late follow-ups fail visibly.