@mjasnikovs/pi-task 0.18.29 → 0.18.31

package/dist/task/script-escape.d.ts

@@ -0,0 +1,83 @@
+/**
+ * script-escape — deterministic detection of CHECK SCRIPTS THAT CANNOT FAIL.
+ *
+ * The failure this closes (mx5 run 13, PROMPT 4 item 4): the shipped package.json
+ * declared, verbatim,
+ *     "lint": "prettier … && eslint --fix … && (tsc --noEmit 2>&1 | grep -qv 'TS18003' || true)"
+ * The typecheck is neutered twice over — its output is piped into an INVERTED grep
+ * (so the status becomes "some line did not match", never tsc's verdict), and the
+ * whole group is closed with `|| true` (so the script exits 0 unconditionally). Every
+ * consumer of that script — the repo-health verify gate, the final integration gate,
+ * a human reading a green CI line — is reading a constant, not a measurement.
+ *
+ * It was harmless in run 13 only by luck: tsc happened to be clean (validated). The
+ * class is not harmless — this is the same defect as run-8's F2 skip-escape, moved
+ * one level out. findSkipEscapes (skip-escape.ts) scans a spec's own VERIFY block;
+ * nothing scanned the SCRIPT DEFINITIONS those VERIFY blocks then invoke by name, so
+ * `bun run lint` could be authored into a no-op and every gate would salute it.
+ *
+ * TWO SHAPES, both crisp, both scoped to CHECK-CLASS script names:
+ *
+ *   A. ALWAYS-ZERO TAIL — the script's last command cannot fail (`… || true`,
+ *      `… || :`, `… || exit 0`, `…; exit 0`, a trailing `|| echo` fallback). A
+ *      shell script's status is its last command's status, so this is a proof, not
+ *      a heuristic: the script exits 0 no matter what the checker found.
+ *
+ *   B. INVERTED-GREP LAUNDERING — a checker piped into `grep -qv` / `grep -vq`.
+ *      "Some line of the output does NOT match X" is never a checker's verdict; it
+ *      is true of virtually any non-empty output, including a wall of errors.
+ *
+ * Deliberately NOT flagged, because each is legitimate and FP-measured against the
+ * real corpus (pi-task, aiz-server, aiz-client, gofer, mx5):
+ *   - `|| exit 1` — a HARDENING, the opposite of an escape (aiz-server).
+ *   - any `||`/pipe in a NON-check script (`clean`, `dev`, `start`, `copy-fonts`) —
+ *     a teardown `rm -rf dist || true` is correct and common.
+ *   - pipes into formatters/reporters (`| tap-spec`, `| tee`) — those propagate
+ *     status or are presentational; only inverted grep is unambiguous.
+ *   - a plain `| grep -q "expected"` — that is a real assertion on output.
+ */
+/** One neutered check script. */
+export interface ScriptEscapeFinding {
+    /** The script's name as declared (e.g. `lint`). */
+    name: string;
+    /** The script's body, verbatim. */
+    body: string;
+    /** Why it cannot fail (human- and prompt-readable). */
+    reason: string;
+}
+/**
+ * Judge one script definition. Returns null when the script is not check-class, or
+ * is check-class but can genuinely fail.
+ */
+export declare function judgeScript(name: string, body: string): ScriptEscapeFinding | null;
+/**
+ * Scan a parsed `scripts` map (package.json shape) for neutered check scripts.
+ * A non-object, or a map with no check-class scripts, yields no findings.
+ */
+export declare function findScriptEscapes(scripts: unknown): ScriptEscapeFinding[];
+/**
+ * Scan a package.json's TEXT. Invalid JSON yields no findings — a manifest that does
+ * not parse is a different problem, and guessing at its contents is how a scanner
+ * earns false positives.
+ */
+export declare function findScriptEscapesInManifest(manifestText: string): ScriptEscapeFinding[];
+/**
+ * Scan ARBITRARY text (a spec, a design doc) for script definitions written as JSON
+ * pairs — the form a spec uses when it dictates a script for the implementer to add
+ * (`"lint": "tsc --noEmit || true"`). This is what lets the critique catch the
+ * neutered script at SPEC time, before any task writes it into a manifest.
+ *
+ * Deliberately narrow: only `"name": "body"` pairs on one line, only check-class
+ * names. Prose describing a script in words extracts nothing.
+ */
+export declare function findScriptEscapesInText(text: string): ScriptEscapeFinding[];
+/**
+ * Verify-child prompt lines (probe+rule pattern): one per neutered script, naming
+ * the script, its body, and why it cannot fail.
+ */
+export declare function scriptEscapeVerifyFindings(findings: ScriptEscapeFinding[]): string[];
+/**
+ * Render findings as a critique/rewrite defect block — same shape as
+ * skipEscapeDefectText: a numbered list the rewrite must resolve.
+ */
+export declare function scriptEscapeDefectText(findings: ScriptEscapeFinding[]): string;

package/dist/task/script-escape.js

@@ -0,0 +1,189 @@
+/**
+ * script-escape — deterministic detection of CHECK SCRIPTS THAT CANNOT FAIL.
+ *
+ * The failure this closes (mx5 run 13, PROMPT 4 item 4): the shipped package.json
+ * declared, verbatim,
+ *     "lint": "prettier … && eslint --fix … && (tsc --noEmit 2>&1 | grep -qv 'TS18003' || true)"
+ * The typecheck is neutered twice over — its output is piped into an INVERTED grep
+ * (so the status becomes "some line did not match", never tsc's verdict), and the
+ * whole group is closed with `|| true` (so the script exits 0 unconditionally). Every
+ * consumer of that script — the repo-health verify gate, the final integration gate,
+ * a human reading a green CI line — is reading a constant, not a measurement.
+ *
+ * It was harmless in run 13 only by luck: tsc happened to be clean (validated). The
+ * class is not harmless — this is the same defect as run-8's F2 skip-escape, moved
+ * one level out. findSkipEscapes (skip-escape.ts) scans a spec's own VERIFY block;
+ * nothing scanned the SCRIPT DEFINITIONS those VERIFY blocks then invoke by name, so
+ * `bun run lint` could be authored into a no-op and every gate would salute it.
+ *
+ * TWO SHAPES, both crisp, both scoped to CHECK-CLASS script names:
+ *
+ *   A. ALWAYS-ZERO TAIL — the script's last command cannot fail (`… || true`,
+ *      `… || :`, `… || exit 0`, `…; exit 0`, a trailing `|| echo` fallback). A
+ *      shell script's status is its last command's status, so this is a proof, not
+ *      a heuristic: the script exits 0 no matter what the checker found.
+ *
+ *   B. INVERTED-GREP LAUNDERING — a checker piped into `grep -qv` / `grep -vq`.
+ *      "Some line of the output does NOT match X" is never a checker's verdict; it
+ *      is true of virtually any non-empty output, including a wall of errors.
+ *
+ * Deliberately NOT flagged, because each is legitimate and FP-measured against the
+ * real corpus (pi-task, aiz-server, aiz-client, gofer, mx5):
+ *   - `|| exit 1` — a HARDENING, the opposite of an escape (aiz-server).
+ *   - any `||`/pipe in a NON-check script (`clean`, `dev`, `start`, `copy-fonts`) —
+ *     a teardown `rm -rf dist || true` is correct and common.
+ *   - pipes into formatters/reporters (`| tap-spec`, `| tee`) — those propagate
+ *     status or are presentational; only inverted grep is unambiguous.
+ *   - a plain `| grep -q "expected"` — that is a real assertion on output.
+ */
+/**
+ * Script names whose whole purpose is to FAIL when something is wrong. A neutered
+ * `clean` or `dev` is nobody's business; a neutered `lint` silently disarms every
+ * gate that runs it. Suffixed variants (`test:ct`, `lint:fix`, `check-types`) match.
+ */
+const CHECK_SCRIPT_RE = /^(?:lint|test|check|verify|validate|typecheck|types?|tsc|ci|audit|coverage|e2e|build|compile|fmt:check|format:check)(?:[:_-].*)?$/i;
+/** `|| exit 1` and friends HARDEN a script — never mistake one for an escape. */
+const HARDENING_TAIL_RE = /\|\|\s*exit\s+[1-9]\d*\s*$/;
+/** Tails that make the script's exit status unconditionally 0. */
+const ALWAYS_ZERO_TAILS = [
+    { re: /\|\|\s*true\s*$/, what: '`|| true`' },
+    { re: /\|\|\s*:\s*$/, what: '`|| :`' },
+    { re: /\|\|\s*exit\s+0\s*$/, what: '`|| exit 0`' },
+    { re: /;\s*true\s*$/, what: '`; true`' },
+    { re: /;\s*exit\s+0\s*$/, what: '`; exit 0`' },
+    { re: /\|\|\s*echo\b[^|&;]*$/, what: 'a trailing `|| echo …` fallback' }
+];
+/** A checker piped into an INVERTED grep: status becomes "something didn't match". */
+const INVERTED_GREP_RE = /\|\s*grep\s+(?:-\w*v\w*|-\w+\s+-\w*v\w*)/;
+/**
+ * Strip trailing subshell/group closers and separators so the tail patterns see the
+ * real last command. mx5's script ends `… || true)` — without this the `)` hides it.
+ */
+function tailOf(body) {
+    let s = body.trim();
+    while (true) {
+        const next = s.replace(/[)\s;]+$/, '').trimEnd();
+        if (next === s)
+            return s;
+        s = next;
+    }
+}
+/**
+ * Judge one script definition. Returns null when the script is not check-class, or
+ * is check-class but can genuinely fail.
+ */
+export function judgeScript(name, body) {
+    if (!CHECK_SCRIPT_RE.test(name))
+        return null;
+    if (typeof body !== 'string' || body.trim().length === 0)
+        return null;
+    const reasons = [];
+    const tail = tailOf(body);
+    if (!HARDENING_TAIL_RE.test(tail)) {
+        for (const { re, what } of ALWAYS_ZERO_TAILS) {
+            if (re.test(tail)) {
+                reasons.push(`it ends in ${what}, so the script exits 0 whatever the check reports`);
+                break;
+            }
+        }
+    }
+    if (INVERTED_GREP_RE.test(body)) {
+        reasons.push('it pipes a check into an INVERTED grep (`grep -v`), so the exit status becomes '
+            + '"some output line did not match" — true of almost any output, including errors');
+    }
+    if (reasons.length === 0)
+        return null;
+    return {
+        name,
+        body: body.trim(),
+        reason: reasons.join('; ')
+    };
+}
+/**
+ * Scan a parsed `scripts` map (package.json shape) for neutered check scripts.
+ * A non-object, or a map with no check-class scripts, yields no findings.
+ */
+export function findScriptEscapes(scripts) {
+    if (typeof scripts !== 'object' || scripts === null || Array.isArray(scripts))
+        return [];
+    const out = [];
+    for (const [name, body] of Object.entries(scripts)) {
+        const f = judgeScript(name, typeof body === 'string' ? body : '');
+        if (f)
+            out.push(f);
+    }
+    return out;
+}
+/**
+ * Scan a package.json's TEXT. Invalid JSON yields no findings — a manifest that does
+ * not parse is a different problem, and guessing at its contents is how a scanner
+ * earns false positives.
+ */
+export function findScriptEscapesInManifest(manifestText) {
+    try {
+        const parsed = JSON.parse(manifestText);
+        if (typeof parsed !== 'object' || parsed === null)
+            return [];
+        return findScriptEscapes(parsed.scripts);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Scan ARBITRARY text (a spec, a design doc) for script definitions written as JSON
+ * pairs — the form a spec uses when it dictates a script for the implementer to add
+ * (`"lint": "tsc --noEmit || true"`). This is what lets the critique catch the
+ * neutered script at SPEC time, before any task writes it into a manifest.
+ *
+ * Deliberately narrow: only `"name": "body"` pairs on one line, only check-class
+ * names. Prose describing a script in words extracts nothing.
+ */
+export function findScriptEscapesInText(text) {
+    const out = [];
+    const seen = new Set();
+    for (const m of text.matchAll(/"([A-Za-z0-9:_-]{1,40})"\s*:\s*"((?:[^"\\]|\\.)*)"/g)) {
+        const name = m[1];
+        // Unescape the JSON string body so shell operators read normally.
+        let body;
+        try {
+            body = JSON.parse(`"${m[2]}"`);
+        }
+        catch {
+            continue;
+        }
+        const key = `${name}=${body}`;
+        if (seen.has(key))
+            continue;
+        const f = judgeScript(name, body);
+        if (!f)
+            continue;
+        seen.add(key);
+        out.push(f);
+    }
+    return out;
+}
+/**
+ * Verify-child prompt lines (probe+rule pattern): one per neutered script, naming
+ * the script, its body, and why it cannot fail.
+ */
+export function scriptEscapeVerifyFindings(findings) {
+    return findings.map(f => `\`${f.name}\`: ${f.body} — ${f.reason}`);
+}
+/**
+ * Render findings as a critique/rewrite defect block — same shape as
+ * skipEscapeDefectText: a numbered list the rewrite must resolve.
+ */
+export function scriptEscapeDefectText(findings) {
+    return [
+        'NEUTERED CHECK SCRIPT — this spec defines a check script that CANNOT FAIL, so every',
+        'gate that runs it reads a constant instead of a measurement (mx5 run 13 shipped',
+        '`"lint": "… && (tsc --noEmit 2>&1 | grep -qv \'TS18003\' || true)"` — the typecheck',
+        'was fully disarmed, and it went unnoticed only because tsc happened to be clean).',
+        "Rewrite each so it PROPAGATES the checker's exit status: drop the `|| true` /",
+        '`; exit 0` tail, and never launder a checker through an inverted grep. If a',
+        'specific diagnostic must genuinely be tolerated, suppress THAT diagnostic in the',
+        "checker's own config — never blanket-zero the whole script's exit code:",
+        ...findings.map((f, i) => `  ${i + 1}. "${f.name}": "${f.body}" — ${f.reason}`)
+    ].join('\n');
+}

package/dist/task/task-gates.d.ts

@@ -127,6 +127,14 @@ export interface GateDeps {
      * and surfaces it if still open. Best-effort; absent in tests → no ledger written.
      */
     recordAcceptDebt?: (cwd: string, taskId: string, reason: string) => Promise<void>;
+    /**
+     * Record a durable YOLO-ACCEPTED debt: the same ACCEPT branch, but reached by an
+     * unattended auto-pick (yolo mode) rather than a human. Separate dep — and
+     * separate ledger origin — because collapsing the two would let an auto-pick
+     * read as "a human blessed this" in the final gate's run-end report. Best-effort;
+     * absent in tests → no ledger written.
+     */
+    recordYoloAcceptDebt?: (cwd: string, taskId: string, reason: string) => Promise<void>;
     /**
      * Record a durable ENFORCE-REVERT debt (mx5 run 10 item 3): the enforce re-verify
      * FAILED and the enforce edits were reverted, but the FAIL indicts the ORIGINAL

package/dist/task/task-gates.js

@@ -1,5 +1,6 @@
 import { resolutionOptions, classifyResolutionAnswer } from './verify-resolution.js';
 import { SessionUI } from '../remote/bridge.js';
+import { isYoloMode, yoloVerifyResolution, YOLO_STAMP } from './yolo.js';
 /**
  * How many times a verify FAIL may be auto-fixed UNATTENDED (the research
  * recommended AUTOFIX, so pi re-runs the impl turn without prompting) before the
@@ -178,8 +179,19 @@ export async function runGatesForTask(ctxIn, deps, p) {
                 && !isFrozenBlocked
                 && recOutcome.recommend === 'autofix'
                 && autoFixCount < MAX_AUTO_AUTOFIX;
+            // YOLO: the picker is unreachable with nobody watching, and by the time
+            // we are here the unattended AUTOFIX budget is ALREADY spent (autoFixNow
+            // is false) — so the only option left that terminates is ACCEPT, recorded
+            // as its own 'yolo-accepted' debt. Deliberately NOT a re-entry into
+            // autofix: MAX_AUTO_AUTOFIX exists to break a non-converging loop, and an
+            // auto-pick here would restart the budget from the site that proves it ran out.
+            const yoloChoice = autoFixNow ? null : yoloVerifyResolution(isYoloMode());
             let choice;
-            if (autoFixNow) {
+            if (yoloChoice !== null) {
+                choice = yoloChoice;
+                await rec(`resolution: auto-ACCEPTED despite verify FAIL — autofix budget spent, nobody to ask ${YOLO_STAMP}`);
+            }
+            else if (autoFixNow) {
                 autoFixCount += 1;
                 await rec(`resolution: auto-AUTOFIX (recommended, unattended ${autoFixCount}/${MAX_AUTO_AUTOFIX})`);
                 active.ui.notify(`${p.tag}: verify FAIL on "${p.title}" — auto-fixing (recommended, ${autoFixCount}/${MAX_AUTO_AUTOFIX})…`, 'info');
@@ -193,7 +205,9 @@ export async function runGatesForTask(ctxIn, deps, p) {
                 return { kind: 'paused', ctx: active, reason: failReason };
             }
             if (choice.action === 'accept') {
-                await rec('resolution: user ACCEPTED the work despite verify FAIL');
+                const byYolo = yoloChoice !== null;
+                if (!byYolo)
+                    await rec('resolution: user ACCEPTED the work despite verify FAIL');
                 // Durable debt: the human blessed a FAILing artifact as-is, so the
                 // defect ships and nothing else revisits it (mx5 run 4 B3 / run 8
                 // TASK_0012). Record it to the run ledger; the final integration gate
@@ -202,7 +216,15 @@ export async function runGatesForTask(ctxIn, deps, p) {
                 // the contradiction named) — don't double-enter it in the ledger.
                 if (!frozenDebtRecorded) {
                     try {
-                        await deps.recordAcceptDebt?.(p.cwd, p.taskId, failReason);
+                        // Provenance splits here, mandatorily: an auto-pick writes the
+                        // 'yolo-accepted' origin, never the plain 'accepted' one that
+                        // asserts a human weighed the failing artifact.
+                        if (byYolo) {
+                            await deps.recordYoloAcceptDebt?.(p.cwd, p.taskId, failReason);
+                        }
+                        else {
+                            await deps.recordAcceptDebt?.(p.cwd, p.taskId, failReason);
+                        }
                     }
                     catch {
                         // recording must never break the gate sequence
@@ -220,7 +242,7 @@ export async function runGatesForTask(ctxIn, deps, p) {
                         // recording must never break the gate sequence
                     }
                 }
-                active.ui.notify(`${p.tag}: accepted "${p.title}" despite verify FAIL (${failReason.slice(0, 120)}) — proceeding.`, 'warning');
+                active.ui.notify(`${p.tag}: accepted "${p.title}" despite verify FAIL (${failReason.slice(0, 120)}) — proceeding.${byYolo ? ` ${YOLO_STAMP}` : ''}`, 'warning');
                 break;
             }
             // AUTOFIX: re-run the implementation turn with the failure (and any typed

package/dist/task/verify-work.d.ts

@@ -68,7 +68,20 @@ export declare function extractSpecForVerification(taskBody: string): string | n
  * Guard: honest-clean fixture (prohibition in spec, probe silent) 5/5 PASS — no
  * paranoia. Reverted-violation ≡ clean at the diff level (no entry → no finding).
  */
-export declare function buildVerifyPrompt(spec: string, probeFindings?: string[], envNotes?: string, prohibitionFindings?: string[], skipEscapeFindings?: string[], contracts?: string, testAssemblyFindings?: string[], probeGamingFindings?: string[], crossTaskDeletionFindings?: string[]): string;
+export declare function buildVerifyPrompt(spec: string, probeFindings?: string[], envNotes?: string, prohibitionFindings?: string[], skipEscapeFindings?: string[], contracts?: string, testAssemblyFindings?: string[], probeGamingFindings?: string[], crossTaskDeletionFindings?: string[], 
+/**
+ * The mx5 run-13 (PROMPT 4) probes, grouped rather than appended as three more
+ * positional parameters — this signature was already at its limit. Each key is
+ * an independent finding list; absent/empty emits no block.
+ */
+projectSurface?: {
+    /** Sandbox-leaked absolute paths (rule 4e) — see foreign-path.ts. */
+    foreignPaths?: string[];
+    /** Check scripts that cannot fail (rule 4f) — see script-escape.ts. */
+    scriptEscapes?: string[];
+    /** Colliding test-runner globs (rule 4g) — see runner-globs.ts. */
+    runnerGlobs?: string[];
+}): string;
 /**
  * Parse the child's verdict. Scans for the LAST `WORK-VERIFIED: PASS|FAIL|UNOBSERVED`
  * marker (the model discusses before concluding, and bash output may echo the word
@@ -146,6 +159,31 @@ export interface VerificationDeps {
      * 0/5), and carried structurally on a FAIL outcome so an ACCEPT records each as
      * a durable debt. ABSENT or empty → no block. */
     crossTaskDeletionProbe?: () => Promise<CrossTaskDeletion[]>;
+    /**
+     * DETERMINISTIC sandbox-path-leak probe (see foreign-path.ts, mx5 run 13
+     * PROMPT 4 item 1): absolute paths this task committed that exist only inside
+     * the authoring child's own environment — `/workspace/src/shared` in a vite
+     * alias — while the real file sits at `src/shared` here. The probe REPAIRS
+     * what it can deterministically first; only leaks it could not repair reach
+     * this hook, injected under rule 4e (MANDATORY + verdict-gating, the same
+     * shape as 4d — a leak makes the affected command fail to BUILD, so the
+     * checks that would notice never run at all). ABSENT or empty → no block. */
+    foreignPathProbe?: () => Promise<string[]>;
+    /**
+     * DETERMINISTIC neutered-check-script probe (see script-escape.ts, mx5 run 13
+     * PROMPT 4 item 4): check-class scripts in a manifest THIS task changed whose
+     * exit status cannot be non-zero (`… || true`, an inverted-grep launder). The
+     * damage is second-order — the script still "passes", so the gates that run it
+     * report success without measuring anything — which is exactly why the child
+     * cannot discover it by running the check. ABSENT or empty → no block. */
+    scriptEscapeProbe?: () => Promise<string[]>;
+    /**
+     * DETERMINISTIC test-runner glob-collision probe (see runner-globs.ts, mx5 runs
+     * 7 AND 13, PROMPT 4 item 2): the manifest declares two runners whose file sets
+     * are not provably disjoint, so the scanning one imports the other's specs and
+     * dies during COLLECTION. Injected under rule 4g. UNKNOWN (one runner, or
+     * disjointness proven) yields nothing. ABSENT or empty → no block. */
+    runnerGlobProbe?: () => Promise<string[]>;
     /**
      * Result of the git-state guard for the MOST RECENT runChild call (see
      * git-state-guard.ts): did the child mutate repo state (stash/checkout/file

package/dist/task/verify-work.js

@@ -140,7 +140,14 @@ export function extractSpecForVerification(taskBody) {
  * Guard: honest-clean fixture (prohibition in spec, probe silent) 5/5 PASS — no
  * paranoia. Reverted-violation ≡ clean at the diff level (no entry → no finding).
  */
-export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFindings, skipEscapeFindings, contracts, testAssemblyFindings, probeGamingFindings, crossTaskDeletionFindings) {
+export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFindings, skipEscapeFindings, contracts, testAssemblyFindings, probeGamingFindings, crossTaskDeletionFindings, 
+/**
+ * The mx5 run-13 (PROMPT 4) probes, grouped rather than appended as three more
+ * positional parameters — this signature was already at its limit. Each key is
+ * an independent finding list; absent/empty emits no block.
+ */
+projectSurface = {}) {
+    const { foreignPaths: foreignPathFindings, scriptEscapes: scriptEscapeFindings, runnerGlobs: runnerGlobFindings } = projectSurface;
     const probeBlock = probeFindings && probeFindings.length > 0 ?
         [
             'SELF-VERIFICATION NOTICE (deterministic, computed by the orchestrator from the diff):',
@@ -216,6 +223,57 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFind
             ''
         ]
         : [];
+    const foreignPathBlock = foreignPathFindings && foreignPathFindings.length > 0 ?
+        [
+            'SANDBOX PATH LEAK NOTICE (deterministic, computed by the orchestrator by',
+            "resolving every absolute path in the task's diff against THIS machine): this",
+            'task committed absolute paths that do not exist here, while the real file they',
+            'name sits inside this repo:',
+            ...foreignPathFindings.map(f => `- ${f}`),
+            "These are paths from the authoring agent's OWN environment, baked into a file",
+            'that ships. The command that reads such a path does not fail a check — it fails',
+            'to BUILD, so the checks that would have caught it never run and report nothing',
+            '(mx5 run 13: a leaked `/workspace` vite alias made `test:ct` collect 63 tests',
+            'and run 0, and the suite stayed dead for the rest of the run). A green or',
+            'EMPTY result from any command that reads these files is therefore NOT evidence.',
+            'Run the affected command yourself and confirm it actually EXECUTES work — count',
+            'the tests/steps that ran, not the exit code. Unless the leaked path resolves on',
+            'this machine, the verdict is FAIL naming the file and the path (rule 4e).',
+            ''
+        ]
+        : [];
+    const scriptEscapeBlock = scriptEscapeFindings && scriptEscapeFindings.length > 0 ?
+        [
+            'NEUTERED CHECK SCRIPT NOTICE (deterministic, computed by the orchestrator from',
+            'the manifest THIS task changed): these check scripts cannot report failure —',
+            'their exit status is 0 no matter what the checker finds:',
+            ...scriptEscapeFindings.map(f => `- ${f}`),
+            'You CANNOT discover this by running the script: it passes, which is the whole',
+            'defect (mx5 run 13 shipped a `lint` whose typecheck was disarmed by an inverted',
+            'grep and a `|| true` tail; every gate that ran it reported success without',
+            'measuring anything). A green result from one of these scripts is NOT evidence',
+            'for any acceptance criterion. To judge the area it claims to cover, run the',
+            'underlying checker DIRECTLY and unmodified (e.g. `tsc --noEmit` rather than',
+            '`npm run lint`) and judge THAT output. Unless the task spec explicitly requires',
+            'the script to tolerate failure, the verdict is FAIL naming the script (rule 4f).',
+            ''
+        ]
+        : [];
+    const runnerGlobBlock = runnerGlobFindings && runnerGlobFindings.length > 0 ?
+        [
+            'TEST-RUNNER GLOB COLLISION NOTICE (deterministic, computed by the orchestrator',
+            "from the manifest's declared runners and their config): two test runners claim",
+            'the same files:',
+            ...runnerGlobFindings.map(f => `- ${f}`),
+            "The scanning runner will import the other's spec files and abort on a module",
+            'loaded outside its own runner — so the suite dies WHOLESALE rather than',
+            'reporting failures (this is the THIRD occurrence: mx5 runs 7 and 13). Run both',
+            'test commands yourself and confirm each collects and runs its own files and only',
+            'its own. A run that errors during collection has verified nothing, whatever its',
+            'exit code says (rule 4g).',
+            ''
+        ]
+        : [];
     const testAssemblyBlock = testAssemblyFindings && testAssemblyFindings.length > 0 ?
         [
             'TEST-ASSEMBLY NOTICE (deterministic, computed by the orchestrator from pure',
@@ -255,6 +313,9 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFind
         ...crossTaskDeletionBlock,
         ...probeGamingBlock,
         ...skipEscapeBlock,
+        ...foreignPathBlock,
+        ...scriptEscapeBlock,
+        ...runnerGlobBlock,
         ...testAssemblyBlock,
         'How to verify — verify the REAL, shipped deliverable exactly as an unaided fresh',
         'checkout (or CI run) would experience it:',
@@ -388,6 +449,32 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFind
         '   tree). Otherwise the verdict is FAIL naming the deleted file and the task that',
         '   owns it.',
         '',
+        '4e. AN ABSOLUTE PATH TO PROJECT FILES IS A DEFECT — a committed path like',
+        "   `/workspace/src/shared` or `/home/<someone>/proj/src` names the authoring agent's",
+        '   OWN machine, not this one. Its distinctive damage is that it breaks the run BEFORE',
+        '   any check reports: a bad alias/config path makes the tool fail to RESOLVE or BUILD,',
+        '   so a suite "passes" having executed nothing. Treat a command that reports no',
+        '   failures but also no WORK — 0 tests run, 0 files emitted, an empty report — as',
+        '   unverified, never as green. Confirm the count of things that actually ran. A path',
+        '   to project-internal files must be relative to the file that carries it, or computed',
+        '   at runtime; if one does not resolve here, the verdict is FAIL naming file and path.',
+        '',
+        '4f. A CHECK THAT CANNOT FAIL PROVES NOTHING — before you cite a check script',
+        "   (`npm run lint`, `bun run test`) as evidence, read its DEFINITION in the project's",
+        '   manifest. A script ending in `|| true`, `; exit 0`, or piping a checker into an',
+        '   inverted grep exits 0 unconditionally: its green result is a constant, not a',
+        '   measurement, and running it again only reproduces the constant. When a script is',
+        '   built that way, run the underlying checker directly and judge its real output; and',
+        '   unless the spec required that tolerance, the script itself is a defect — the',
+        '   verdict is FAIL naming it.',
+        '',
+        '4g. TWO RUNNERS, ONE FILE SET, NO RESULTS — when a project declares more than one',
+        '   test runner, check that each collects only its own files. A runner that scans for',
+        "   `*.test.*` / `*.spec.*` project-wide will import another runner's specs and abort",
+        '   during COLLECTION. That failure mode looks nothing like a test failure: you get an',
+        '   import error, or a suite that reports zero tests. Always read how many tests each',
+        '   command actually COLLECTED and RAN; zero collected is never a pass.',
+        '',
         '5. The ONLY thing you may assume is already provided is a genuinely EXTERNAL running',
         '   service or network resource (a database server, an API host) that the project',
         '   documents as a prerequisite. Before you rely on that assumption, PROBE for the',
@@ -572,6 +659,39 @@ export async function runWorkVerification(deps) {
             crossDeletions = [];
         }
     }
+    // Sandbox-path-leak findings the deterministic repair could NOT fix, injected
+    // under rule 4e. A probe failure must never block verification.
+    let foreignPaths = [];
+    if (deps.foreignPathProbe) {
+        try {
+            foreignPaths = await deps.foreignPathProbe();
+        }
+        catch {
+            foreignPaths = [];
+        }
+    }
+    // Neutered check scripts in a manifest this task changed, injected under rule
+    // 4f. A probe failure must never block verification.
+    let scriptEscapes = [];
+    if (deps.scriptEscapeProbe) {
+        try {
+            scriptEscapes = await deps.scriptEscapeProbe();
+        }
+        catch {
+            scriptEscapes = [];
+        }
+    }
+    // Colliding test-runner globs, injected under rule 4g. A probe failure must
+    // never block verification.
+    let runnerGlobs = [];
+    if (deps.runnerGlobProbe) {
+        try {
+            runnerGlobs = await deps.runnerGlobProbe();
+        }
+        catch {
+            runnerGlobs = [];
+        }
+    }
     // Environment facts from earlier gate children (best-effort; a cache failure
     // must never block verification).
     let envNotes = '';
@@ -607,7 +727,11 @@ export async function runWorkVerification(deps) {
     for (let attempt = 1;; attempt++) {
         let text;
         try {
-            text = await deps.runChild(VERIFY_TOOLS, buildVerifyPrompt(deps.spec, findings, envNotes, prohibitions, skipEscapes, contracts, testAssembly, probeGaming, crossTaskDeletionVerifyFindings(crossDeletions)), deps.signal);
+            text = await deps.runChild(VERIFY_TOOLS, buildVerifyPrompt(deps.spec, findings, envNotes, prohibitions, skipEscapes, contracts, testAssembly, probeGaming, crossTaskDeletionVerifyFindings(crossDeletions), {
+                foreignPaths,
+                scriptEscapes,
+                runnerGlobs
+            }), deps.signal);
         }
         catch (err) {
             if (err instanceof Error && err.message === USER_CANCELLED)

package/dist/task/yolo.d.ts

@@ -0,0 +1,74 @@
+import type { AutoAnswer } from './parsers.js';
+import type { ResolutionChoice } from './verify-resolution.js';
+import type { FinalGateChoice } from './final-gate-fix.js';
+/**
+ * Visible provenance marker on EVERY artifact an auto-pick writes (gate trails,
+ * task-file Q&A, the debt ledger's reason text). A later audit reading only the
+ * artifacts must never mistake an auto-pick for a human decision — that is the
+ * same confusion the accept-debt origins were introduced to prevent.
+ */
+export declare const YOLO_STAMP = "(YOLO)";
+/** Is unattended auto-pick on for this run? The ONLY config read in this module. */
+export declare function isYoloMode(): boolean;
+/**
+ * What YOLO does at a question site:
+ *   - 'answer' — take this (the recommended option).
+ *   - 'skip'   — YOLO is on but there is nothing safe to take; leave the question
+ *                unanswered and move on, with `note` recorded as the reason.
+ *   - null     — YOLO is off: ask the human exactly as before.
+ */
+export type YoloPick = {
+    kind: 'answer';
+    answer: string;
+} | {
+    kind: 'skip';
+    note: string;
+} | null;
+/**
+ * The clarify/grill policy: take the RECOMMENDED option — which is positional,
+ * index 0 of the card list (question-box.ts tints it green), i.e. `suggested`,
+ * falling back to the B-side `alt` when a fork offers only that.
+ *
+ * `unsafe` is the step-aside channel: a caller that KNOWS the recommendation must
+ * not be auto-accepted passes why, and the question is skipped instead. Its one
+ * producer today is the anti-synthesis demotion — an answer proven to name a
+ * hallucinated API identifier. Auto-accepting that would re-promote exactly the
+ * invention the demotion was built to stop (it reached requirements AND the VERIFY
+ * block in mx5 run 13), so a machine may never take it; a human still can.
+ */
+export declare function yoloPickAnswer(enabled: boolean, opts: {
+    suggested?: string;
+    alt?: string;
+    unsafe?: string;
+}): YoloPick;
+/**
+ * The same policy expressed over an {@link AutoAnswer}, for the grill site. Only
+ * the ANTI-SYNTHESIS unknown is unsafe: the other two producers (an integration
+ * unknown research could not ground, a child that threw) carry an ordinary
+ * best-effort recommendation, which is precisely what a human would be shown as
+ * the green card. The variants are told apart by the union's `reason` tag — never
+ * by pattern-matching the answer text.
+ */
+export declare function yoloPickAutoAnswer(enabled: boolean, auto: AutoAnswer): YoloPick;
+/**
+ * The verify-FAIL picker policy: ACCEPT (and write a debt), never AUTOFIX.
+ *
+ * Not a preference — a bound. Every branch that REACHES this picker has already
+ * spent its unattended budget: the loop auto-runs AUTOFIX while the research
+ * recommends it, up to MAX_AUTO_AUTOFIX consecutive failures, and only then hands
+ * over. Answering AUTOFIX here would restart that budget from a site whose whole
+ * purpose is that the budget ran out. So YOLO takes the terminal option and
+ * records the defect ('yolo-accepted' — an origin a human never produces).
+ */
+export declare function yoloVerifyResolution(enabled: boolean): ResolutionChoice | null;
+/**
+ * The final-integration-gate policy: keep autofixing WHILE the picker still
+ * offers that card (the loop withdraws it after MAX_FINAL_GATE_AUTOFIX attempts),
+ * then leave the run FAILED.
+ *
+ * 'leave', not 'accept': an unattended run that cannot fix the whole-repo gate has
+ * not produced a working project, and the honest terminal state is a failed run a
+ * resume can re-enter — mx5 run 13 ended "FAIL accepted by user" on an app that
+ * 404'd at `/`, and that acceptance is what made the failure look like a success.
+ */
+export declare function yoloFinalGateChoice(enabled: boolean, canAutofix: boolean): FinalGateChoice | null;