@mjasnikovs/pi-task 0.18.0 → 0.18.1

package/dist/task/gate-deps.js

@@ -24,6 +24,7 @@ import { runRepoHealthCheck } from './repo-health-check.js';
 import { runFinalIntegrationGate, discoverGateCommandLabels } from './final-gate.js';
 import { runFinalGateAutofix } from './final-gate-fix.js';
 import { researchResolution } from './verify-resolution.js';
+import { extractProhibitions, findProhibitionViolations } from './prohibition-probe.js';
 import { findSubstitutionSuspects } from './substitution-probe.js';
 import { runBoundedLintFix } from './lint-fix.js';
 import { captureGitState, reconcileGitState } from './git-state-guard.js';
@@ -290,6 +291,16 @@ export function buildGateDeps(params) {
                 // authored/changed become prompt-level findings mandating the child
                 // to drive the real artifact before trusting their green result.
                 probe: () => collectChangedFiles(cwd2, signal).then(findSubstitutionSuspects),
+                // Deterministic prohibition probe: paths the spec forbids modifying
+                // that the task's diff modified anyway become prompt-level findings
+                // under the no-waiver rule — the child otherwise rarely runs `git
+                // diff` and cannot even see the violation.
+                prohibitionProbe: () => {
+                    const banned = spec ? extractProhibitions(spec) : [];
+                    if (banned.length === 0)
+                        return Promise.resolve([]);
+                    return collectChangedFiles(cwd2, signal).then(files => findProhibitionViolations(banned, files));
+                },
                 // Git-state guard result of the most recent child run: a verdict
                 // computed on a tree the child itself mutated is discarded (the
                 // guard already restored the state — see git-state-guard.ts).

package/dist/task/prohibition-probe.d.ts

@@ -0,0 +1,53 @@
+/**
+ * prohibition-probe — deterministic detection of VIOLATED SPEC PROHIBITIONS,
+ * feeding the verify gate's prompt.
+ *
+ * The failure class (mx5 run 7, "New Listing page" task): the spec's CONSTRAINTS
+ * said "**Do NOT modify** any server-side code: `src/server/index.ts`, …"; the
+ * implementation modified `src/server/index.ts` anyway; the verify child SAW it
+ * ("VIOLATES 'Do NOT modify server-side code'"), waived it ("BUT: this is
+ * additive, tests pass with it"), and PASSed. Worse, the reproduction fixture
+ * showed the baseline child usually never LOOKS: 5/5 baseline runs consulted no
+ * diff at all and several affirmatively claimed the forbidden file was untouched.
+ *
+ * So — like the substitution probe (see substitution-probe.ts, whose A/B proved
+ * prompt language alone gets ~40% attention while a concrete deterministic
+ * finding gets 100%) — the fix is a deterministic pre-check whose finding is
+ * injected into the prompt: extract the concrete paths the spec forbids
+ * modifying, intersect with the task's changed files (pure git shape, already
+ * collected for the substitution probe), and hand the child each hit with the
+ * exact constraint wording.
+ *
+ * The finding is advisory, not an auto-FAIL, for one reason: prohibitions in
+ * real specs are prose and can be CONDITIONAL ("Do NOT modify `api.ts` beyond
+ * what is needed for the new endpoint") — a hard gate on prose extraction would
+ * false-FAIL legitimate work. The finding therefore carries the constraint line
+ * verbatim and the prompt's no-waiver rule (4b in verify-work.ts) forbids
+ * excusing an ABSOLUTE prohibition while directing conditional ones to be judged
+ * against their own stated exception. A violation that was fully reverted before
+ * verify produces no diff entry, so it never fires — reverted = not violated.
+ */
+import type { ChangedFile } from './substitution-probe.js';
+/** One "do not modify X" constraint extracted from the spec text. */
+export interface Prohibition {
+    /** The forbidden path exactly as the spec spells it (file or directory). */
+    path: string;
+    /** The full spec line carrying the prohibition, so the verify child judges
+     *  against the EXACT wording — including any exception clause it states. */
+    constraint: string;
+}
+/**
+ * Extract the concrete paths the spec explicitly forbids modifying: every
+ * backtick-quoted path-like token on a line that expresses a modification ban.
+ * Prose-only prohibitions ("do not modify server-side code" with no path named)
+ * extract nothing — the prompt-level rule still covers them.
+ */
+export declare function extractProhibitions(spec: string): Prohibition[];
+/**
+ * Intersect the spec's prohibitions with the task's changed files (git shape —
+ * the same collector the substitution probe uses). A prohibition matches a
+ * changed file exactly, or as a directory prefix (`src/server` covers
+ * `src/server/index.ts`). One finding line per violated file, carrying the
+ * constraint verbatim; empty array → no block in the prompt.
+ */
+export declare function findProhibitionViolations(prohibitions: Prohibition[], files: ChangedFile[]): string[];

package/dist/task/prohibition-probe.js

@@ -0,0 +1,64 @@
+/**
+ * Does this line express a modification ban? Matches the active forms ("do not
+ * modify", "must not touch", "never edit", "don't change") and the passive form
+ * ("must not be modified"). Deliberately verb-scoped to modification — a "do not
+ * add a dependency" style rule names no path and is the prompt rule's job.
+ */
+const PROHIBITION_RE = /\b(?:do\s+not|don'?t|must\s+not|never)\s+(?:be\s+)?(?:modify|modified|touch|touched|edit|edited|change|changed|alter|altered|rewrite|rewritten|overwrite|overwritten|delete|deleted|remove|removed)\b/i;
+/**
+ * A backtick token counts as a path only when it is whitespace-free, uses path
+ * characters, and either contains a directory separator, has a file extension,
+ * or is a dotfile. Bare identifiers (`getOrder`), API routes with spaces
+ * (`POST /api/listings`), and code snippets are rejected — the probe would
+ * rather miss a `Makefile` than fire on prose.
+ */
+function looksLikePath(token) {
+    if (!/^[\w.@~/-]+$/.test(token))
+        return false;
+    return token.includes('/') || /\.[A-Za-z0-9]+$/.test(token) || token.startsWith('.');
+}
+/**
+ * Extract the concrete paths the spec explicitly forbids modifying: every
+ * backtick-quoted path-like token on a line that expresses a modification ban.
+ * Prose-only prohibitions ("do not modify server-side code" with no path named)
+ * extract nothing — the prompt-level rule still covers them.
+ */
+export function extractProhibitions(spec) {
+    const out = [];
+    const seen = new Set();
+    for (const line of spec.split('\n')) {
+        if (!PROHIBITION_RE.test(line))
+            continue;
+        for (const m of line.matchAll(/`([^`]+)`/g)) {
+            const token = m[1].trim();
+            if (!looksLikePath(token) || seen.has(token))
+                continue;
+            seen.add(token);
+            out.push({ path: token, constraint: line.trim() });
+        }
+    }
+    return out;
+}
+/** Normalise a path for comparison: strip leading ./ and trailing /. */
+const norm = (p) => p.replace(/^\.\//, '').replace(/\/+$/, '');
+/**
+ * Intersect the spec's prohibitions with the task's changed files (git shape —
+ * the same collector the substitution probe uses). A prohibition matches a
+ * changed file exactly, or as a directory prefix (`src/server` covers
+ * `src/server/index.ts`). One finding line per violated file, carrying the
+ * constraint verbatim; empty array → no block in the prompt.
+ */
+export function findProhibitionViolations(prohibitions, files) {
+    const findings = [];
+    for (const f of files) {
+        const fp = norm(f.path);
+        const hit = prohibitions.find(p => {
+            const pp = norm(p.path);
+            return fp === pp || fp.startsWith(`${pp}/`);
+        });
+        if (!hit)
+            continue;
+        findings.push(`${f.path} — modified by this task, but the spec forbids it: "${hit.constraint}"`);
+    }
+    return findings;
+}

package/dist/task/verify-work.d.ts

@@ -38,11 +38,24 @@ export declare function extractSpecForVerification(taskBody: string): string | n
  * `probeFindings` are the deterministic self-verification probe results (see
  * substitution-probe.ts): the TEST-THE-COPY class is caught 5/5 only when the
  * prompt carries both the rule (3b) AND a concrete finding naming the suspect
- * file — the rule alone got 2/5 attention on the live model. The findings are
+ * file — the rule alone got 2/5 attention on the local model. The findings are
  * pure git shape (test files the task itself changed), so the mandate is
  * language- and framework-agnostic.
+ *
+ * `prohibitionFindings` are the deterministic prohibition probe results (see
+ * prohibition-probe.ts): spec-forbidden paths the task's diff modified anyway.
+ * Same probe+rule design, same reason: the VIOLATION-EXCUSAL class (mx5 run 7:
+ * child saw "Do NOT modify server-side code" violated, waived it as "additive,
+ * tests pass", PASSed) needs both the no-waiver rule (4b) AND the concrete diff
+ * fact — the baseline child usually never runs `git diff` at all, so without the
+ * finding it cannot even SEE the violation. A/B on the live local model
+ * (violated-but-working fixture, everything green, forbidden file modified
+ * additively): old prompt 5/5 false-PASS (several runs affirmatively claimed the
+ * forbidden file was untouched); rule+finding 5/5 FAIL naming the constraint.
+ * Guard: honest-clean fixture (prohibition in spec, probe silent) 5/5 PASS — no
+ * paranoia. Reverted-violation ≡ clean at the diff level (no entry → no finding).
  */
-export declare function buildVerifyPrompt(spec: string, probeFindings?: string[], envNotes?: string): string;
+export declare function buildVerifyPrompt(spec: string, probeFindings?: string[], envNotes?: string, prohibitionFindings?: string[]): string;
 /**
  * Parse the child's verdict. Scans for the LAST `WORK-VERIFIED: PASS|FAIL` marker
  * (the model discusses before concluding, and bash output may echo the word
@@ -82,6 +95,12 @@ export interface VerificationDeps {
      * into the child's prompt. A/B-proven load-bearing: the prompt rule alone caught
      * the class 2/5, rule + probe finding 5/5. ABSENT or empty → no probe block. */
     probe?: () => Promise<string[]>;
+    /**
+     * DETERMINISTIC prohibition probe (see prohibition-probe.ts): spec-forbidden
+     * paths the task's diff modified anyway, injected as prompt findings under the
+     * no-waiver rule (4b). Advisory, never auto-FAIL — real prohibitions can be
+     * conditional prose. ABSENT or empty → no prohibition block. */
+    prohibitionProbe?: () => Promise<string[]>;
     /**
      * Result of the git-state guard for the MOST RECENT runChild call (see
      * git-state-guard.ts): did the child mutate repo state (stash/checkout/file

package/dist/task/verify-work.js

@@ -120,11 +120,24 @@ export function extractSpecForVerification(taskBody) {
  * `probeFindings` are the deterministic self-verification probe results (see
  * substitution-probe.ts): the TEST-THE-COPY class is caught 5/5 only when the
  * prompt carries both the rule (3b) AND a concrete finding naming the suspect
- * file — the rule alone got 2/5 attention on the live model. The findings are
+ * file — the rule alone got 2/5 attention on the local model. The findings are
  * pure git shape (test files the task itself changed), so the mandate is
  * language- and framework-agnostic.
+ *
+ * `prohibitionFindings` are the deterministic prohibition probe results (see
+ * prohibition-probe.ts): spec-forbidden paths the task's diff modified anyway.
+ * Same probe+rule design, same reason: the VIOLATION-EXCUSAL class (mx5 run 7:
+ * child saw "Do NOT modify server-side code" violated, waived it as "additive,
+ * tests pass", PASSed) needs both the no-waiver rule (4b) AND the concrete diff
+ * fact — the baseline child usually never runs `git diff` at all, so without the
+ * finding it cannot even SEE the violation. A/B on the live local model
+ * (violated-but-working fixture, everything green, forbidden file modified
+ * additively): old prompt 5/5 false-PASS (several runs affirmatively claimed the
+ * forbidden file was untouched); rule+finding 5/5 FAIL naming the constraint.
+ * Guard: honest-clean fixture (prohibition in spec, probe silent) 5/5 PASS — no
+ * paranoia. Reverted-violation ≡ clean at the diff level (no entry → no finding).
  */
-export function buildVerifyPrompt(spec, probeFindings, envNotes) {
+export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFindings) {
     const probeBlock = probeFindings && probeFindings.length > 0 ?
         [
             'SELF-VERIFICATION NOTICE (deterministic, computed by the orchestrator from the diff):',
@@ -138,6 +151,19 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes) {
             ''
         ]
         : [];
+    const prohibitionBlock = prohibitionFindings && prohibitionFindings.length > 0 ?
+        [
+            'PROHIBITION NOTICE (deterministic, computed by the orchestrator from the',
+            "spec's own constraint lines and the task's diff): this task MODIFIED paths",
+            'the spec explicitly forbids modifying:',
+            ...prohibitionFindings.map(f => `- ${f}`),
+            'Read the exact constraint wording in the spec. Unless that wording itself',
+            'states an exception that covers this change, this is a violated prohibition:',
+            'rule 4b applies and the verdict is FAIL naming the forbidden path — even if',
+            'every test passes and the change looks harmless.',
+            ''
+        ]
+        : [];
     const envBlock = envNotes && envNotes.trim().length > 0 ? [buildEnvNotesBlock(envNotes)] : [];
     return [
         'You are a strict verification pass running right after an AI coding agent',
@@ -154,6 +180,7 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes) {
         '',
         ...envBlock,
         ...probeBlock,
+        ...prohibitionBlock,
         'How to verify — verify the REAL, shipped deliverable exactly as an unaided fresh',
         'checkout (or CI run) would experience it:',
         '',
@@ -218,6 +245,19 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes) {
         '4. Treat the ACCEPTANCE criteria as the bar. If a command fails, or its real output',
         '   contradicts an ACCEPTANCE criterion, the work has NOT verified.',
         '',
+        '4b. SPEC PROHIBITIONS ARE PART OF THE BAR — YOU HAVE NO WAIVER AUTHORITY: when the',
+        '   spec explicitly forbids something ("Do NOT modify X", "MUST NOT touch Y") and the',
+        '   shipped work does it anyway, that is a FAIL naming the violated constraint. You',
+        '   may not excuse a violation because it is additive, small, harmless, an improvement,',
+        '   or because every test still passes — "it works anyway" is exactly the waiver you do',
+        "   not have; relaxing a constraint is the spec owner's call, not yours. Check the",
+        "   task's own diff (git) against the spec's prohibitions — a forbidden file can be",
+        '   modified without any test noticing. Only two outcomes are not a FAIL: the',
+        '   violation was fully REVERTED (the shipped tree no longer violates), or the',
+        '   prohibition\'s own wording states an exception ("except…", "beyond what is needed',
+        '   for…") that covers the change — judged against that stated exception, not against',
+        '   your view of harmlessness.',
+        '',
         '5. The ONLY thing you may assume is already provided is a genuinely EXTERNAL running',
         '   service or network resource (a database server, an API host) that the project',
         '   documents as a prerequisite. Before you rely on that assumption, PROBE for the',
@@ -310,6 +350,15 @@ export async function runWorkVerification(deps) {
             findings = [];
         }
     }
+    let prohibitions = [];
+    if (deps.prohibitionProbe) {
+        try {
+            prohibitions = await deps.prohibitionProbe();
+        }
+        catch {
+            prohibitions = [];
+        }
+    }
     // Environment facts from earlier gate children (best-effort; a cache failure
     // must never block verification).
     let envNotes = '';
@@ -328,7 +377,7 @@ export async function runWorkVerification(deps) {
     for (let attempt = 1;; attempt++) {
         let text;
         try {
-            text = await deps.runChild(VERIFY_TOOLS, buildVerifyPrompt(deps.spec, findings, envNotes), deps.signal);
+            text = await deps.runChild(VERIFY_TOOLS, buildVerifyPrompt(deps.spec, findings, envNotes, prohibitions), deps.signal);
         }
         catch (err) {
             if (err instanceof Error && err.message === USER_CANCELLED)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.18.0",
+    "version": "0.18.1",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",