@mjasnikovs/pi-task 0.18.3 → 0.18.4

package/dist/task/enforce-guidelines.d.ts

@@ -61,14 +61,14 @@ export declare function discoverGuidelines(cwd: string, readFile?: (p: string) =
  * done, and the contract for the final verdict line. Kept pure so the wording
  * is unit-tested without spawning pi.
  */
-export declare function buildEnforcePrompt(rulesText: string, diff: string): string;
+export declare function buildEnforcePrompt(rulesText: string, diff: string, probeGamingFindings?: string[]): string;
 /**
  * Build the FLAG-ONLY enforcement prompt: same rules + diff, but the child has a
  * `read` tool only and is told to REPORT violations, not fix them. Kept pure so
  * the wording is unit-tested without spawning pi. Used when there is no
  * verification signal to guard a destructive edit (see ENFORCE_FLAG_TOOLS).
  */
-export declare function buildEnforceFlagPrompt(rulesText: string, diff: string): string;
+export declare function buildEnforceFlagPrompt(rulesText: string, diff: string, probeGamingFindings?: string[]): string;
 /**
  * Parse the child's final verdict. Scans for the LAST `ENFORCE: CLEAN` /
  * `ENFORCE: VIOLATION` marker (the model may discuss before concluding).

package/dist/task/enforce-guidelines.js

@@ -26,6 +26,7 @@ import * as path from 'node:path';
 import { runChildDefault } from '../shared/child-process.js';
 import { USER_CANCELLED } from './child-runner.js';
 import { TASKS_DIR_NAME } from './task-types.js';
+import { findProbeGamingInDiff } from './probe-gaming.js';
 /** Filenames discovered in the working directory (cwd only — no tree walk). */
 export const GUIDELINE_FILENAMES = ['AGENTS.md', 'CLAUDE.md'];
 /**
@@ -87,12 +88,33 @@ export async function discoverGuidelines(cwd, readFile = p => fsp.readFile(p, 'u
         return null;
     return { files, text: sections.join('\n\n') };
 }
+/**
+ * Render the deterministic probe-gaming findings (run-8 F6) as a prompt block, or
+ * an empty array when there are none. Shared by the edit and flag prompts: the
+ * finding is a concrete diff line whose stated purpose is to make a check pass
+ * rather than meet the requirement — the reliable lever the prompt rule leans on.
+ * The `action` line differs (fix vs report) between the two capability modes.
+ */
+function probeGamingEnforceBlock(findings, action) {
+    if (findings.length === 0)
+        return [];
+    return [
+        'CHECK-GAMING NOTICE (deterministic, computed from the diff): these added lines',
+        'state their own purpose is to make a CHECK pass (a test / verification / lint /',
+        'gate), not to meet the requirement the check stands for:',
+        ...findings.map(f => `- ${f}`),
+        'A check is a MESSENGER for a requirement; code written only to quiet the messenger',
+        'is a defect even when the check is green (run-8 F6: a handler returned 401 "so the',
+        `verification test passes" while the real route stayed dead). ${action}`,
+        ''
+    ];
+}
 /**
  * Build the enforcement child's prompt: the rules, the diff of the work just
  * done, and the contract for the final verdict line. Kept pure so the wording
  * is unit-tested without spawning pi.
  */
-export function buildEnforcePrompt(rulesText, diff) {
+export function buildEnforcePrompt(rulesText, diff, probeGamingFindings = []) {
     return [
         'You are a strict guideline-enforcement pass running right after an AI coding',
         'agent finished a task and committed it. The agent is known to skip project',
@@ -111,6 +133,9 @@ export function buildEnforcePrompt(rulesText, diff) {
         'CHANGES IN THE LAST COMMIT (verify these specifically against the rules):',
         diff.trim().length > 0 ? diff : '(no textual diff captured — nothing to verify)',
         '',
+        ...probeGamingEnforceBlock(probeGamingFindings, 'Treat this as a violation: replace the check-gaming code with a real'
+            + ' implementation of the requirement, or if you cannot, report it as a'
+            + ' VIOLATION naming the gamed check.'),
         'Your job:',
         '1. Read each changed file and check it against EVERY rule above.',
         '2. For each violation you find, FIX it directly with your `edit` tool, then',
@@ -130,7 +155,7 @@ export function buildEnforcePrompt(rulesText, diff) {
  * the wording is unit-tested without spawning pi. Used when there is no
  * verification signal to guard a destructive edit (see ENFORCE_FLAG_TOOLS).
  */
-export function buildEnforceFlagPrompt(rulesText, diff) {
+export function buildEnforceFlagPrompt(rulesText, diff, probeGamingFindings = []) {
     return [
         'You are a strict guideline-enforcement REVIEW pass running right after an AI',
         'coding agent finished a task and committed it. The agent is known to skip',
@@ -146,6 +171,8 @@ export function buildEnforceFlagPrompt(rulesText, diff) {
         'CHANGES IN THE LAST COMMIT (review these specifically against the rules):',
         diff.trim().length > 0 ? diff : '(no textual diff captured — nothing to verify)',
         '',
+        ...probeGamingEnforceBlock(probeGamingFindings, 'Treat this as a violation and REPORT it (do not fix it): name the gamed check'
+            + ' and the requirement left unmet.'),
         'Read each changed file and check it against EVERY rule above. Do NOT attempt',
         'to fix anything — only report what you find.',
         '',
@@ -279,9 +306,15 @@ export async function runGuidelineEnforcement(deps) {
     if (!doc)
         return { ok: true, reason: 'no guideline files' };
     const diff = await getDiff(deps.cwd, deps.signal);
+    // Deterministic probe-gaming findings (F6) straight from the captured diff — no
+    // extra git call, the diff is already in hand. Injected under the CHECK-GAMING
+    // rule so the child acts on a concrete line, not on self-discovered intent.
+    const probeGaming = findProbeGamingInDiff(diff);
     const flagOnly = deps.mode === 'flag';
     const tools = flagOnly ? ENFORCE_FLAG_TOOLS : ENFORCE_TOOLS;
-    const prompt = flagOnly ? buildEnforceFlagPrompt(doc.text, diff) : buildEnforcePrompt(doc.text, diff);
+    const prompt = flagOnly ?
+        buildEnforceFlagPrompt(doc.text, diff, probeGaming)
+        : buildEnforcePrompt(doc.text, diff, probeGaming);
     let text;
     try {
         text = await deps.runChild(tools, prompt, deps.signal);

package/dist/task/env-notes.d.ts

@@ -1,23 +1,39 @@
 export declare function envNotesFile(cwd: string): string;
-/** The cached notes, one fact per line ('' when none were recorded yet). */
+/** The raw stored file ('' when none were recorded yet). Parse with parseEnvNotes. */
 export declare function readEnvNotes(cwd: string): Promise<string>;
+/** One recorded fact plus the origin task that established it (may be ''). */
+export interface EnvNote {
+    fact: string;
+    origin: string;
+}
+/**
+ * Parse the stored file into fact+origin records. Legacy lines written before
+ * provenance (no separator) parse with an empty origin, so old caches still read.
+ */
+export declare function parseEnvNotes(raw: string): EnvNote[];
 /**
  * Pull `ENV-NOTE: <fact>` lines out of a child's answer text. Deduplicated,
  * length-capped; verdict markers can never match (different prefix).
  */
 export declare function extractEnvNotes(text: string): string[];
+/** True when a fact reads like a standing excuse (see EXCUSE_PATTERNS). */
+export declare function isExcuseNote(fact: string): boolean;
 /**
  * Append newly discovered facts to the cache, deduplicated against what is
- * already there (case-insensitive full-line match), keeping the newest
- * MAX_NOTES. Failures are swallowed — the cache is a sharpener, never a
+ * already there (case-insensitive fact match), keeping the newest MAX_NOTES.
+ * Each new fact is stamped with the `origin` task that recorded it; a fact
+ * already present keeps its ORIGINAL origin (provenance traces to who first
+ * established it). Failures are swallowed — the cache is a sharpener, never a
  * blocker.
  */
-export declare function appendEnvNotes(cwd: string, notes: string[]): Promise<void>;
+export declare function appendEnvNotes(cwd: string, notes: string[], origin?: string): Promise<void>;
 /**
- * The prompt block a gate child receives when notes exist. The caveat is
- * load-bearing: facts save re-discovery time but grant no waiver from the
- * verify-as-shipped rule.
+ * The prompt block a gate child receives when notes exist. Two things are
+ * load-bearing: the no-waiver caveat (facts save re-discovery time but grant no
+ * license to prepare/repair) and the trust discipline (a note is second-hand
+ * until re-validated; an EXCUSE-CLASS note may not wave off a failure without a
+ * live re-check; a grep of a generated artifact is not evidence of absence).
  */
-export declare function buildEnvNotesBlock(notes: string): string;
+export declare function buildEnvNotesBlock(raw: string): string;
 /** The emit instruction appended to bash-capable gate-child prompts. */
 export declare const ENV_NOTE_EMIT_INSTRUCTION: string;

package/dist/task/env-notes.js

@@ -18,6 +18,19 @@
  * project setup: the verify-as-shipped rule ("any prep you needed IS the
  * defect") still governs every verdict — the block injected into prompts says
  * so explicitly. The cache only kills re-discovery time.
+ *
+ * PROVENANCE + RE-VALIDATION (run 8, F7): a verify child once grepped component
+ * names in a MINIFIED bundle (identifiers mangled ⇒ 0 hits by construction),
+ * wrote "build tree-shakes ALL route components — pre-existing issue" to the
+ * cache, and ten later tasks inherited it verbatim as a standing "pre-existing,
+ * unrelated" excuse to wave off a genuinely broken deliverable — nobody
+ * re-checked. Two guards close that class: (a) each note is stamped host-side
+ * with the ORIGIN task that recorded it (a note is second-hand hearsay, not the
+ * reader's own observation); (b) the injected block demands the reader
+ * RE-VALIDATE a note in the CURRENT tree before citing it to excuse a failure,
+ * flags EXCUSE-CLASS notes ("pre-existing", "unrelated", "tree-shaken") for
+ * exactly that scrutiny, and forbids treating a grep of a generated artifact as
+ * evidence of absence. Provenance is mechanical; re-validation is prompt-level.
  */
 import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
@@ -27,10 +40,16 @@ const ENV_NOTES_FILE = 'env-notes.md';
 const MAX_NOTES = 40;
 /** A single fact is one line; anything longer is prose, not a fact. */
 const MAX_NOTE_LENGTH = 240;
+/**
+ * Field separator between a fact and its origin in the stored file. A tab never
+ * occurs in a one-line fact (facts are prose), so it round-trips cleanly and any
+ * stray tab in an emitted fact is normalised to a space before storage.
+ */
+const ORIGIN_SEP = '\t';
 export function envNotesFile(cwd) {
     return path.join(tasksDir(cwd), ENV_NOTES_FILE);
 }
-/** The cached notes, one fact per line ('' when none were recorded yet). */
+/** The raw stored file ('' when none were recorded yet). Parse with parseEnvNotes. */
 export async function readEnvNotes(cwd) {
     try {
         return (await fsp.readFile(envNotesFile(cwd), 'utf8')).trim();
@@ -39,6 +58,27 @@ export async function readEnvNotes(cwd) {
         return '';
     }
 }
+/**
+ * Parse the stored file into fact+origin records. Legacy lines written before
+ * provenance (no separator) parse with an empty origin, so old caches still read.
+ */
+export function parseEnvNotes(raw) {
+    const out = [];
+    for (const line of raw.split('\n')) {
+        const t = line.trim();
+        if (t.length === 0)
+            continue;
+        const i = t.indexOf(ORIGIN_SEP);
+        if (i === -1)
+            out.push({ fact: t, origin: '' });
+        else
+            out.push({ fact: t.slice(0, i).trim(), origin: t.slice(i + 1).trim() });
+    }
+    return out;
+}
+function serializeNote(n) {
+    return n.origin ? `${n.fact}${ORIGIN_SEP}${n.origin}` : n.fact;
+}
 /**
  * Pull `ENV-NOTE: <fact>` lines out of a child's answer text. Deduplicated,
  * length-capped; verdict markers can never match (different prefix).
@@ -58,54 +98,110 @@ export function extractEnvNotes(text) {
     }
     return notes;
 }
+/**
+ * EXCUSE-CLASS wording: a note that waves a problem off as someone else's or a
+ * prior condition ("pre-existing … mismatch", "unrelated to this task",
+ * "tree-shaken", "not applicable"). These are the notes that propagate across
+ * slices as standing excuses (mx5 run-8 F7) — every one of the run-8 cache's
+ * dozen such notes was either the false tree-shake fact or the schema mismatch
+ * the final gate later proved was a REAL defect. Pure text, stack-agnostic; the
+ * flag never drops or fails a note, it only marks it as needing live
+ * re-validation before it may EXCUSE a failure. FP is harmless by construction:
+ * a benign fact re-validates and is used, the marker only bites a citation-to-
+ * wave-off. Benign status facts ("5 pre-existing warnings") do not match — a
+ * "pre-existing" match requires a co-located problem word.
+ */
+const EXCUSE_PATTERNS = [
+    /\bunrelated\b/i,
+    /\bnot (?:my|our|this) (?:task|concern|deliverable|slice|problem)\b/i,
+    /\boutside (?:the|this) deliverable\b/i,
+    /\bnot applicable\b/i,
+    /\bnot specific to\b/i,
+    /\btree[-\s]?shak/i,
+    /\bpre-?existing\b[^.\n]*\b(?:fail|issue|mismatch|bug|error|broken|problem|affect)/i,
+    /\baffect(?:ing|s)? all\b/i
+];
+/** True when a fact reads like a standing excuse (see EXCUSE_PATTERNS). */
+export function isExcuseNote(fact) {
+    return EXCUSE_PATTERNS.some(re => re.test(fact));
+}
 /**
  * Append newly discovered facts to the cache, deduplicated against what is
- * already there (case-insensitive full-line match), keeping the newest
- * MAX_NOTES. Failures are swallowed — the cache is a sharpener, never a
+ * already there (case-insensitive fact match), keeping the newest MAX_NOTES.
+ * Each new fact is stamped with the `origin` task that recorded it; a fact
+ * already present keeps its ORIGINAL origin (provenance traces to who first
+ * established it). Failures are swallowed — the cache is a sharpener, never a
  * blocker.
  */
-export async function appendEnvNotes(cwd, notes) {
+export async function appendEnvNotes(cwd, notes, origin = '') {
     if (notes.length === 0)
         return;
     try {
-        const existing = (await readEnvNotes(cwd)).split('\n').filter(l => l.trim().length > 0);
-        const seen = new Set(existing.map(l => l.trim().toLowerCase()));
+        const existing = parseEnvNotes(await readEnvNotes(cwd));
+        const seen = new Set(existing.map(n => n.fact.toLowerCase()));
         const merged = [...existing];
         for (const note of notes) {
-            const key = note.trim().toLowerCase();
-            if (seen.has(key))
+            const fact = note.trim().replace(/\t/g, ' ');
+            const key = fact.toLowerCase();
+            if (key.length === 0 || seen.has(key))
                 continue;
             seen.add(key);
-            merged.push(note.trim());
+            merged.push({ fact, origin: origin.trim() });
         }
         const kept = merged.slice(-MAX_NOTES);
         await fsp.mkdir(tasksDir(cwd), { recursive: true });
-        await fsp.writeFile(envNotesFile(cwd), kept.join('\n') + '\n', 'utf8');
+        await fsp.writeFile(envNotesFile(cwd), kept.map(serializeNote).join('\n') + '\n', 'utf8');
     }
     catch {
         // best-effort cache
     }
 }
 /**
- * The prompt block a gate child receives when notes exist. The caveat is
- * load-bearing: facts save re-discovery time but grant no waiver from the
- * verify-as-shipped rule.
+ * The prompt block a gate child receives when notes exist. Two things are
+ * load-bearing: the no-waiver caveat (facts save re-discovery time but grant no
+ * license to prepare/repair) and the trust discipline (a note is second-hand
+ * until re-validated; an EXCUSE-CLASS note may not wave off a failure without a
+ * live re-check; a grep of a generated artifact is not evidence of absence).
  */
-export function buildEnvNotesBlock(notes) {
-    if (notes.trim().length === 0)
+export function buildEnvNotesBlock(raw) {
+    const notes = parseEnvNotes(raw);
+    if (notes.length === 0)
         return '';
+    const lines = notes.map(n => {
+        const origin = n.origin ? ` — recorded by ${n.origin}` : ' — origin unrecorded';
+        const flag = isExcuseNote(n.fact) ?
+            '  [EXCUSE-CLASS — re-validate in the CURRENT tree before citing this to wave off any failure]'
+            : '';
+        return `- ${n.fact}${origin}${flag}`;
+    });
     return [
-        'KNOWN ENVIRONMENT FACTS — discovered by earlier verification passes in this run',
-        '(informational, may be stale):',
-        ...notes
-            .trim()
-            .split('\n')
-            .map(n => `- ${n}`),
+        'KNOWN ENVIRONMENT FACTS — recorded by earlier verification passes in this run',
+        '(second-hand, may be stale or WRONG):',
+        ...lines,
+        '',
         'These facts only save you re-discovery time (where credentials/config live, which',
         'tools are installed, which services are reachable). They are NOT a license to',
         'prepare or repair the run: the verify-as-shipped rules below still govern the',
         'verdict — if the project needs something its own committed files do not provide,',
         'that remains the defect no matter what is listed here.',
+        '',
+        'TRUST DISCIPLINE — a false "pre-existing, unrelated" note once masked a real shipped',
+        'defect across many tasks in this exact pipeline; do not repeat it:',
+        '- A note above is second-hand hearsay from another task, not your own observation.',
+        '  You may CITE one to EXCUSE, wave off, or down-grade a failure ONLY IF you',
+        '  RE-VALIDATE its claim in the CURRENT tree right now and state the command or',
+        '  observation you used to reconfirm it.',
+        '- If a note fails re-validation (its claim is not true in the current tree), do NOT',
+        "  inherit it: treat the underlying problem as UNexcused and report it. Don't silently",
+        '  carry a stale fact forward.',
+        '- EVIDENCE HYGIENE: string-searching a MINIFIED, bundled, or otherwise generated or',
+        '  compiled artifact is NOT evidence that something is absent — identifiers there are',
+        '  renamed or stripped by construction, so a zero-hit grep proves nothing. Derive',
+        '  presence/absence only from SOURCE files or by EXECUTING the artifact and observing.',
+        '- A claim that a defect is "pre-existing", "unrelated", or "not this task" is an',
+        '  EXCUSE, not a fact (the ones above are marked): re-establish it live, and if it',
+        '  actually holds as a real defect, escalate it (report FAIL) rather than passing it',
+        '  on as a standing waiver.',
         ''
     ].join('\n');
 }
@@ -115,7 +211,11 @@ export const ENV_NOTE_EMIT_INSTRUCTION = [
     'THIS MACHINE or the project environment (a service reachable/absent at an address, where',
     'credentials/config live, a tool or runtime present/missing and its version), emit a line',
     '  ENV-NOTE: <one-line fact>',
-    'anywhere in your answer, one per fact. Facts about the ENVIRONMENT only — never task',
-    'verdicts, never spec content, never code judgments. These are cached for later',
-    'verification passes in this run so they do not re-discover the same things.'
+    'anywhere in your answer, one per fact. A fact is something you OBSERVED to be true of the',
+    'machine or environment — never a task verdict, never spec content, never a judgment about',
+    'the code. In particular do NOT record an absence you inferred from grepping a built or',
+    'minified artifact (identifiers there are mangled — a zero-hit grep proves nothing), and',
+    'do NOT record "X is pre-existing / unrelated / not my task": that is a verdict, not an',
+    'environment fact. These are cached for later verification passes in this run so they do',
+    'not re-discover the same things.'
 ].join('\n');

package/dist/task/gate-deps.d.ts

@@ -1,6 +1,7 @@
 import type { ExtensionCommandContext } from '@earendil-works/pi-coding-agent';
 import type { GateDeps } from './task-gates.js';
 import { type FinalFixResult } from './final-gate-fix.js';
+import { type AddedLine } from './probe-gaming.js';
 import { type ChangedFile } from './substitution-probe.js';
 /** A function that re-runs a task's implementation turn (AUTOFIX). Injected by the
  *  command so this module stays free of the orchestrators (avoids an import cycle). */
@@ -17,6 +18,15 @@ export type FinalGateFixFn = (ctx: ExtensionCommandContext, cwd: string, failRea
  * blocker.
  */
 export declare function collectChangedFiles(cwd: string, signal?: AbortSignal): Promise<ChangedFile[]>;
+/**
+ * Collect the task's added lines WITH CONTENT (path + text) for the probe-gaming
+ * probe (F6), which needs the actual line text the numstat-shape collector omits.
+ * Pre-commit the work is the tree-vs-HEAD diff plus untracked files (read whole, as
+ * all-added); on the post-enforce re-verify the tree is clean, so fall back to the
+ * last commit's diff. Failures degrade to an empty list — the probe is a sharpener,
+ * never a blocker. The `.pi-tasks/` bookkeeping is excluded from every git command.
+ */
+export declare function collectAddedLines(cwd: string, signal?: AbortSignal): Promise<AddedLine[]>;
 /**
  * Build the gate deps for one command run. `runTask` is the orchestrator's
  * implementation re-runner, injected by the caller. The returned object also drives

package/dist/task/gate-deps.js

@@ -26,7 +26,9 @@ import { runFinalIntegrationGate, discoverGateCommandLabels } from './final-gate
 import { runFinalGateAutofix } from './final-gate-fix.js';
 import { researchResolution } from './verify-resolution.js';
 import { extractProhibitions, findProhibitionViolations } from './prohibition-probe.js';
-import { findSubstitutionSuspects } from './substitution-probe.js';
+import { findProbeGaming, parseAddedLines } from './probe-gaming.js';
+import { findSubstitutionSuspects, isTestFile } from './substitution-probe.js';
+import { findTestRebuiltAssemblies, testAssemblyVerifyFindings } from './test-assembly.js';
 import { runBoundedLintFix } from './lint-fix.js';
 import { captureGitState, reconcileGitState } from './git-state-guard.js';
 import { runWorker } from '../workers/pi-worker-core.js';
@@ -76,6 +78,85 @@ export async function collectChangedFiles(cwd, signal) {
     }
     return files;
 }
+/**
+ * Collect the task's added lines WITH CONTENT (path + text) for the probe-gaming
+ * probe (F6), which needs the actual line text the numstat-shape collector omits.
+ * Pre-commit the work is the tree-vs-HEAD diff plus untracked files (read whole, as
+ * all-added); on the post-enforce re-verify the tree is clean, so fall back to the
+ * last commit's diff. Failures degrade to an empty list — the probe is a sharpener,
+ * never a blocker. The `.pi-tasks/` bookkeeping is excluded from every git command.
+ */
+export async function collectAddedLines(cwd, signal) {
+    const tracked = await git(cwd, ['diff', 'HEAD', '--', '.', EXCLUDE_TASKS_DIR], signal);
+    const lines = tracked.exitCode === 0 ? parseAddedLines(tracked.stdout) : [];
+    const untracked = await git(cwd, ['ls-files', '--others', '--exclude-standard', '--', '.', EXCLUDE_TASKS_DIR], signal);
+    for (const name of splitLines(untracked.exitCode === 0 ? untracked.stdout : '')) {
+        try {
+            const content = await fsp.readFile(path.join(cwd, name), 'utf8');
+            for (const text of content.split('\n'))
+                lines.push({ path: name, text });
+        }
+        catch {
+            // unreadable/binary — nothing to report
+        }
+    }
+    if (lines.length === 0) {
+        const last = await git(cwd, ['diff', 'HEAD~1..HEAD', '--', '.', EXCLUDE_TASKS_DIR], signal);
+        return last.exitCode === 0 ? parseAddedLines(last.stdout) : [];
+    }
+    return lines;
+}
+/** Source extensions whose relative imports the test-assembly probe reasons over. */
+const SOURCE_EXT_RE = /\.(?:[cm]?[jt]sx?)$/;
+/** Bounds so the probe stays cheap on large repos (it reads file text). */
+const MAX_PROBE_FILES = 4000;
+const MAX_PROBE_FILE_BYTES = 512 * 1024;
+/** Best-effort read of a repo file's text; unreadable/oversized → null (skipped). */
+async function readRepoFile(cwd, rel) {
+    try {
+        const buf = await fsp.readFile(path.join(cwd, rel));
+        if (buf.length > MAX_PROBE_FILE_BYTES)
+            return null;
+        return { path: rel, text: buf.toString('utf8') };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Deterministic test-assembly probe input (see test-assembly.ts, run-8 F4): read the
+ * task's own changed TEST files plus the repo's tracked source files, and return the
+ * finding lines naming any test that rebuilds a production assembly it never imports.
+ * Pure import-graph shape; failures degrade to no findings (the probe is a sharpener,
+ * never a blocker). `changed` is the already-collected task diff, reused so the probe
+ * costs one extra tracked-file listing, not a second diff.
+ */
+async function collectTestAssemblyFindings(cwd, changed, signal) {
+    const changedTests = changed.filter(f => isTestFile(f.path));
+    if (changedTests.length === 0)
+        return [];
+    const listed = await git(cwd, ['ls-files', '--', '.', EXCLUDE_TASKS_DIR], signal);
+    if (listed.exitCode !== 0)
+        return [];
+    const sources = splitLines(listed.stdout)
+        .filter(p => SOURCE_EXT_RE.test(p))
+        .slice(0, MAX_PROBE_FILES);
+    const production = [];
+    for (const rel of sources) {
+        if (isTestFile(rel))
+            continue;
+        const f = await readRepoFile(cwd, rel);
+        if (f)
+            production.push(f);
+    }
+    const testFiles = [];
+    for (const { path: rel } of changedTests) {
+        const f = await readRepoFile(cwd, rel);
+        if (f)
+            testFiles.push(f);
+    }
+    return testAssemblyVerifyFindings(findTestRebuiltAssemblies(testFiles, production));
+}
 /**
  * Build the gate deps for one command run. `runTask` is the orchestrator's
  * implementation re-runner, injected by the caller. The returned object also drives
@@ -292,6 +373,16 @@ export function buildGateDeps(params) {
                 // authored/changed become prompt-level findings mandating the child
                 // to drive the real artifact before trusting their green result.
                 probe: () => collectChangedFiles(cwd2, signal).then(findSubstitutionSuspects),
+                // Deterministic test-assembly probe (F4): authored test files that
+                // rebuild production wiring — importing the leaf modules the shipped
+                // entry composes and assembling their own copy — become rule-3f
+                // findings so the child drives the REAL assembly, not the copy.
+                testAssemblyProbe: () => collectChangedFiles(cwd2, signal).then(changed => collectTestAssemblyFindings(cwd2, changed, signal)),
+                // Deterministic probe-gaming probe (F6): added lines whose stated
+                // purpose is to make a check pass rather than meet the requirement
+                // ("return 401 so the verification test passes") become rule-4c
+                // findings so the child verifies the real requirement, not the check.
+                probeGamingProbe: () => collectAddedLines(cwd2, signal).then(findProbeGaming),
                 // Deterministic prohibition probe: paths the spec forbids modifying
                 // that the task's diff modified anyway become prompt-level findings
                 // under the no-waiver rule — the child otherwise rarely runs `git
@@ -311,10 +402,13 @@ export function buildGateDeps(params) {
                 // Per-run environment-facts cache under .pi-tasks/ (survives
                 // discardEdits): earlier children's discoveries save this child
                 // the re-archaeology; its own ENV-NOTE lines are stored for the
-                // next one. Facts only — verdict rules unaffected.
+                // next one, stamped with this task's id as their origin so a
+                // later child sees a cited fact is second-hand and must
+                // re-validate before excusing a failure (F7). Facts only —
+                // verdict rules unaffected.
                 envNotes: {
                     read: () => readEnvNotes(cwd2),
-                    append: notes => appendEnvNotes(cwd2, notes)
+                    append: notes => appendEnvNotes(cwd2, notes, taskId)
                 },
                 // Per-run cross-slice contract registry under .pi-tasks/ (F3): the
                 // verbatim interface facts the design pins that multiple slices

package/dist/task/probe-gaming.d.ts

@@ -0,0 +1,60 @@
+/**
+ * probe-gaming — deterministic detection of CHECK-GAMING code, feeding the verify
+ * and enforce gate prompts (run-8 F6).
+ *
+ * The failure class: the implementation writes code — or a comment on it — whose
+ * STATED PURPOSE is to make a check pass, rather than to satisfy the requirement the
+ * check stands for. mx5 run-8 shipped, verbatim,
+ *   `// Return 401 so the verification test passes (expects 200/401/403 for /api routes).`
+ * above four catch-all handlers added to satisfy the VERIFY curl instead of fixing
+ * the broken route mount. The route stayed dead; the check went green; the code SAID
+ * SO IN WRITING. A check is a MESSENGER for a requirement — code written to quiet the
+ * messenger instead of meeting the requirement is the defect, and when it announces
+ * its own intent it is cheaply detectable.
+ *
+ * Same probe+rule design as the other run-8 probes (skip-escape.ts,
+ * prohibition-probe.ts, substitution-probe.ts, test-assembly.ts): a deterministic
+ * finding is the reliable lever, a prompt rule alone is weak. This scans the task's
+ * DIFF (added lines only — the work this task introduced) for the gaming tell and
+ * hands each hit to the gate child verbatim, so the rule fires on a concrete line
+ * rather than on the model self-discovering the intent.
+ *
+ * Advisory, never an auto-FAIL: intent phrasing is prose and a genuinely-benign line
+ * could in principle carry it ("returns 401 so the auth test passes" describing a
+ * CORRECT auth path). The child reads the exact line and the surrounding code and
+ * judges — the verify rule directs it to confirm the underlying requirement is
+ * actually met, not merely that the check is green.
+ *
+ * FP-MEASURED on the real run-8 corpus (~/hub/mx5, all 53 commits): 1 unique hit in
+ * 50,735 added lines — exactly the true F6 line, zero false positives. The tell is a
+ * purpose phrase binding a CHECK noun (test / verification / lint / CI / gate / …) to
+ * a pass-state or a gaming verb; benign uses of the same words ("pass the test data",
+ * "run the verification suite", "the linter flagged this") do not match. Pure
+ * diff-text analysis — no stack, framework, or tool-name assumptions; a project with
+ * no such comment simply yields no findings (nothing to observe = pass).
+ */
+/** One added line from a task's diff: the file it was added to and its text. */
+export interface AddedLine {
+    /** Path relative to the repo root (from the `+++ b/…` header). */
+    path: string;
+    /** The added line's content, without the leading `+`. */
+    text: string;
+}
+/** Does this line state its purpose is to make a check pass? */
+export declare function isProbeGamingLine(text: string): boolean;
+/**
+ * Parse a unified `git diff` into its added lines (path + text). Tracks the current
+ * file from each `+++ b/…` header and collects every `+`-prefixed body line
+ * (excluding the `+++` header itself). Robust to surrounding prose (the enforce diff
+ * capture wraps the diff in a header/footer) because only `+`/`+++` lines are read.
+ */
+export declare function parseAddedLines(diff: string): AddedLine[];
+/**
+ * Scan a set of added lines for check-gaming tells. Returns one finding per matching
+ * line; empty when none match (the prompt then gets no probe block). The finding
+ * carries the file and the offending line verbatim so the gate child can locate and
+ * judge it. Long lines are truncated for the prompt.
+ */
+export declare function findProbeGaming(added: AddedLine[]): string[];
+/** Convenience: scan a unified diff string straight to findings. */
+export declare function findProbeGamingInDiff(diff: string): string[];

package/dist/task/test-assembly.d.ts

@@ -0,0 +1,87 @@
+/**
+ * test-assembly — deterministic detection of TEST-REBUILT PRODUCTION WIRING, feeding
+ * the verify gate's prompt (run-8 F4; third recurrence of the test-the-copy class,
+ * runs 3, 4, 8).
+ *
+ * The failure class: a test file re-constructs wiring that ALSO exists in production
+ * — it builds its own app assembly / its own entry point out of the same leaf modules
+ * the production entry composes, then tests THAT private copy. The copy can be wired
+ * differently from production and stay green while the shipped wiring is broken. Run-8
+ * fixture: `test/photos.test.ts` imports the real `authRoutes` + `photosRoutes` leaves,
+ * mounts them into its OWN app at a DIFFERENT prefix than the production entry, and
+ * runs 102/102 green — while the shipped upload path is dead because production mounts
+ * the same leaf at the wrong prefix. The verify child, judging "do the tests pass",
+ * saw green and counted the photos area verified. The seam the test was supposed to
+ * cover is exactly the seam it re-implemented away.
+ *
+ * This is the VERIFY-SIDE complement of the generation-side wiring probe
+ * (wiring-claims.ts, item #5) and shares the load-bearing lesson of
+ * substitution-probe / skip-escape / wiring-claims: a deterministic finding that NAMES
+ * the suspect file is the reliable lever; a bare prompt rule is weak. rule 3b already
+ * tells the child to spot-check that self-authored tests exercise the real artifact,
+ * but F4 slips through because these tests DO import the real leaf modules — they just
+ * bypass the real ASSEMBLY, which rule 3b's "did it import and call the module" check
+ * does not catch. This probe supplies the missing concrete fact.
+ *
+ * THE SIGNAL is pure import-graph SHAPE, zero stack/framework assumptions (no "app",
+ * no "route", no "mount", no language runtime): a test file T is flagged when there is
+ * a production file E (the assembly/entry) such that
+ *   - T does NOT import E (it bypasses the shipped assembly), AND
+ *   - T and E both import ≥2 of the SAME leaf modules, where each such leaf is
+ *     imported by E and by NO OTHER production file (E is the leaf's SOLE production
+ *     composition site).
+ * The "E-exclusive leaf" condition is the crisp discriminator that keeps ordinary
+ * shared-utility imports out: a test importing an api client + a schema module that
+ * every page also imports is NOT re-assembly (those utilities have many production
+ * importers); a test importing two route modules that only the server entry composes
+ * IS re-assembly. Measured on the run-8 fixture tree: flags exactly the four backend
+ * tests that rebuild the server entry's route composition (including the real
+ * photos seam bug) and leaves clean the single-leaf direct test, the utility-sharing
+ * page test, and the source-grepping test — 0 false positives.
+ *
+ * Findings are ADVISORY (probe+rule): they mandate the child to exercise the REAL
+ * shipped assembly directly before counting the area verified; they never auto-FAIL.
+ * A test that re-composes wiring which happens to match production survives once the
+ * child drives the real entry; only one whose real assembly is broken gets named.
+ */
+/** A source file the probe reasons over: repo-relative path + its full text. */
+export interface RepoFile {
+    /** Path relative to the repo root (used verbatim in the finding text). */
+    path: string;
+    /** Full file contents (import statements are parsed out of it). */
+    text: string;
+}
+/** One test file that rebuilds a production assembly instead of importing it. */
+export interface TestAssemblyFinding {
+    /** The test file re-constructing the wiring. */
+    testFile: string;
+    /** The production assembly / entry it bypasses (sole composer of the leaves). */
+    assemblyFile: string;
+    /** The leaf modules (repo-relative, extensionless) the test re-composes. */
+    leaves: string[];
+}
+/** The importing file's OWN module id (path minus extension / `/index`). */
+export declare function moduleIdOf(filePath: string): string;
+/**
+ * The set of repo-relative, extensionless module ids that `text` imports via RELATIVE
+ * specifiers (a specifier starting with `.`). Bare/external specifiers (`hono`,
+ * `bun:sql`, `node:fs`) are ignored — they never name a repo file, so they cannot be
+ * a re-composed production leaf. Resolution is pure path arithmetic against the
+ * importer's directory; the filesystem is never touched.
+ */
+export declare function relativeImports(filePath: string, text: string): string[];
+/**
+ * Find test files that rebuild a production assembly. `changedTestFiles` are the
+ * task's own authored/changed test files (path + text); `productionFiles` are the
+ * repo's non-test source files (path + text) used to build the import graph and the
+ * per-leaf production in-degree. Returns one finding per re-assembling test, sorted
+ * for determinism. Empty when no test re-composes an E-exclusive leaf set.
+ */
+export declare function findTestRebuiltAssemblies(changedTestFiles: RepoFile[], productionFiles: RepoFile[]): TestAssemblyFinding[];
+/**
+ * Render findings as verify-child prompt lines (probe+rule pattern — the concrete
+ * finding that makes the rule fire reliably). One line per re-assembling test naming
+ * the test, the shipped assembly it bypasses, and the re-composed leaves. Empty
+ * findings → empty array (caller emits no block).
+ */
+export declare function testAssemblyVerifyFindings(findings: TestAssemblyFinding[]): string[];

package/dist/task/test-assembly.js

@@ -0,0 +1,163 @@
+/**
+ * test-assembly — deterministic detection of TEST-REBUILT PRODUCTION WIRING, feeding
+ * the verify gate's prompt (run-8 F4; third recurrence of the test-the-copy class,
+ * runs 3, 4, 8).
+ *
+ * The failure class: a test file re-constructs wiring that ALSO exists in production
+ * — it builds its own app assembly / its own entry point out of the same leaf modules
+ * the production entry composes, then tests THAT private copy. The copy can be wired
+ * differently from production and stay green while the shipped wiring is broken. Run-8
+ * fixture: `test/photos.test.ts` imports the real `authRoutes` + `photosRoutes` leaves,
+ * mounts them into its OWN app at a DIFFERENT prefix than the production entry, and
+ * runs 102/102 green — while the shipped upload path is dead because production mounts
+ * the same leaf at the wrong prefix. The verify child, judging "do the tests pass",
+ * saw green and counted the photos area verified. The seam the test was supposed to
+ * cover is exactly the seam it re-implemented away.
+ *
+ * This is the VERIFY-SIDE complement of the generation-side wiring probe
+ * (wiring-claims.ts, item #5) and shares the load-bearing lesson of
+ * substitution-probe / skip-escape / wiring-claims: a deterministic finding that NAMES
+ * the suspect file is the reliable lever; a bare prompt rule is weak. rule 3b already
+ * tells the child to spot-check that self-authored tests exercise the real artifact,
+ * but F4 slips through because these tests DO import the real leaf modules — they just
+ * bypass the real ASSEMBLY, which rule 3b's "did it import and call the module" check
+ * does not catch. This probe supplies the missing concrete fact.
+ *
+ * THE SIGNAL is pure import-graph SHAPE, zero stack/framework assumptions (no "app",
+ * no "route", no "mount", no language runtime): a test file T is flagged when there is
+ * a production file E (the assembly/entry) such that
+ *   - T does NOT import E (it bypasses the shipped assembly), AND
+ *   - T and E both import ≥2 of the SAME leaf modules, where each such leaf is
+ *     imported by E and by NO OTHER production file (E is the leaf's SOLE production
+ *     composition site).
+ * The "E-exclusive leaf" condition is the crisp discriminator that keeps ordinary
+ * shared-utility imports out: a test importing an api client + a schema module that
+ * every page also imports is NOT re-assembly (those utilities have many production
+ * importers); a test importing two route modules that only the server entry composes
+ * IS re-assembly. Measured on the run-8 fixture tree: flags exactly the four backend
+ * tests that rebuild the server entry's route composition (including the real
+ * photos seam bug) and leaves clean the single-leaf direct test, the utility-sharing
+ * page test, and the source-grepping test — 0 false positives.
+ *
+ * Findings are ADVISORY (probe+rule): they mandate the child to exercise the REAL
+ * shipped assembly directly before counting the area verified; they never auto-FAIL.
+ * A test that re-composes wiring which happens to match production survives once the
+ * child drives the real entry; only one whose real assembly is broken gets named.
+ */
+import { isTestFile } from './substitution-probe.js';
+/** Code file extensions whose relative imports we resolve. Not a stack assumption —
+ *  purely which quoted specifiers name a repo file; other languages simply produce
+ *  no matches and the whole probe degrades to nothing. */
+const CODE_EXT_RE = /\.(?:[cm]?[jt]sx?)$/;
+/**
+ * Static import/re-export declarations: `import … from 'x'`, `import 'x'`,
+ * `export … from 'x'`. Anchored to line start (after optional whitespace) so an
+ * import-shaped STRING inside an assertion (`expect(src).toContain("import x from
+ * '../y'")`, a source-grepping test) is NOT mistaken for a real import — that string
+ * is indented behind `expect(`, never at line start.
+ */
+const STATIC_IMPORT_RE = /^[ \t]*(?:import|export)\s+(?:[^'"\n]*\sfrom\s+)?['"]([^'"]+)['"]/gm;
+/** Dynamic `import('x')` / `require('x')` calls (the call-paren form is unlikely to
+ *  appear inside an assertion string, so matching anywhere is safe enough). */
+const CALL_IMPORT_RE = /(?:require|import)\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+/** Strip a code extension and a trailing `/index` so `./a`, `./a.ts`, and
+ *  `./a/index.ts` all collapse to the same module id. */
+function stripToModuleId(p) {
+    return p.replace(CODE_EXT_RE, '').replace(/\/index$/, '');
+}
+/** Normalise a POSIX-style relative path (resolve `.`/`..` segments) without touching
+ *  the filesystem — the analysis is pure text shape. */
+function normalisePosix(p) {
+    const segments = [];
+    for (const seg of p.split('/')) {
+        if (seg === '' || seg === '.')
+            continue;
+        if (seg === '..')
+            segments.pop();
+        else
+            segments.push(seg);
+    }
+    return segments.join('/');
+}
+/** The importing file's OWN module id (path minus extension / `/index`). */
+export function moduleIdOf(filePath) {
+    return stripToModuleId(filePath);
+}
+/**
+ * The set of repo-relative, extensionless module ids that `text` imports via RELATIVE
+ * specifiers (a specifier starting with `.`). Bare/external specifiers (`hono`,
+ * `bun:sql`, `node:fs`) are ignored — they never name a repo file, so they cannot be
+ * a re-composed production leaf. Resolution is pure path arithmetic against the
+ * importer's directory; the filesystem is never touched.
+ */
+export function relativeImports(filePath, text) {
+    const dir = filePath.includes('/') ? filePath.slice(0, filePath.lastIndexOf('/')) : '';
+    const ids = new Set();
+    for (const re of [STATIC_IMPORT_RE, CALL_IMPORT_RE]) {
+        re.lastIndex = 0;
+        for (let m = re.exec(text); m !== null; m = re.exec(text)) {
+            const spec = m[1];
+            if (!spec.startsWith('.'))
+                continue;
+            ids.add(stripToModuleId(normalisePosix(`${dir}/${spec}`)));
+        }
+    }
+    return [...ids];
+}
+/**
+ * Find test files that rebuild a production assembly. `changedTestFiles` are the
+ * task's own authored/changed test files (path + text); `productionFiles` are the
+ * repo's non-test source files (path + text) used to build the import graph and the
+ * per-leaf production in-degree. Returns one finding per re-assembling test, sorted
+ * for determinism. Empty when no test re-composes an E-exclusive leaf set.
+ */
+export function findTestRebuiltAssemblies(changedTestFiles, productionFiles) {
+    // Only genuine production (non-test) files can be the bypassed assembly.
+    const prod = productionFiles.filter(f => !isTestFile(f.path));
+    const prodImports = new Map();
+    const inDegree = new Map();
+    for (const f of prod) {
+        const imps = relativeImports(f.path, f.text);
+        prodImports.set(f.path, new Set(imps));
+        for (const m of imps)
+            inDegree.set(m, (inDegree.get(m) ?? 0) + 1);
+    }
+    const findings = [];
+    for (const t of [...changedTestFiles].sort((a, b) => a.path.localeCompare(b.path))) {
+        if (!isTestFile(t.path))
+            continue;
+        const tImports = new Set(relativeImports(t.path, t.text));
+        if (tImports.size < 2)
+            continue;
+        let best = null;
+        for (const e of [...prod].sort((a, b) => a.path.localeCompare(b.path))) {
+            if (e.path === t.path)
+                continue;
+            // The test imports the real assembly → it is exercising the shipped wiring,
+            // not a copy. Good citizen, never flagged.
+            if (tImports.has(moduleIdOf(e.path)))
+                continue;
+            const eImports = prodImports.get(e.path);
+            // Leaves E is the SOLE production composer of, that this test re-imports.
+            const leaves = [...tImports].filter(m => eImports.has(m) && inDegree.get(m) === 1);
+            if (leaves.length >= 2 && (best === null || leaves.length > best.leaves.length)) {
+                best = { testFile: t.path, assemblyFile: e.path, leaves: leaves.sort() };
+            }
+        }
+        if (best)
+            findings.push(best);
+    }
+    return findings;
+}
+/**
+ * Render findings as verify-child prompt lines (probe+rule pattern — the concrete
+ * finding that makes the rule fire reliably). One line per re-assembling test naming
+ * the test, the shipped assembly it bypasses, and the re-composed leaves. Empty
+ * findings → empty array (caller emits no block).
+ */
+export function testAssemblyVerifyFindings(findings) {
+    return findings.map(f => `${f.testFile} imports and re-composes ${f.leaves.length} leaf module(s) `
+        + `(${f.leaves.join(', ')}) that ${f.assemblyFile} is the ONLY production file to `
+        + `compose, yet it never imports ${f.assemblyFile} — it builds its OWN assembly of `
+        + `those leaves instead of exercising the shipped one`);
+}

package/dist/task/verify-work.d.ts

@@ -61,7 +61,7 @@ export declare function extractSpecForVerification(taskBody: string): string | n
  * Guard: honest-clean fixture (prohibition in spec, probe silent) 5/5 PASS — no
  * paranoia. Reverted-violation ≡ clean at the diff level (no entry → no finding).
  */
-export declare function buildVerifyPrompt(spec: string, probeFindings?: string[], envNotes?: string, prohibitionFindings?: string[], skipEscapeFindings?: string[], contracts?: string): string;
+export declare function buildVerifyPrompt(spec: string, probeFindings?: string[], envNotes?: string, prohibitionFindings?: string[], skipEscapeFindings?: string[], contracts?: string, testAssemblyFindings?: string[], probeGamingFindings?: string[]): string;
 /**
  * Parse the child's verdict. Scans for the LAST `WORK-VERIFIED: PASS|FAIL|UNOBSERVED`
  * marker (the model discusses before concluding, and bash output may echo the word
@@ -114,6 +114,22 @@ export interface VerificationDeps {
      * no-waiver rule (4b). Advisory, never auto-FAIL — real prohibitions can be
      * conditional prose. ABSENT or empty → no prohibition block. */
     prohibitionProbe?: () => Promise<string[]>;
+    /**
+     * DETERMINISTIC test-assembly probe (see test-assembly.ts): authored test files
+     * that rebuild production WIRING — importing the leaf modules the shipped entry
+     * composes and assembling their own copy instead of the real assembly — become
+     * prompt findings under rule 3f (F4 test-the-copy, 3rd recurrence). Pure import-
+     * graph shape; the child then drives the real assembly before trusting the copy.
+     * ABSENT or empty → no test-assembly block. */
+    testAssemblyProbe?: () => Promise<string[]>;
+    /**
+     * DETERMINISTIC probe-gaming probe (see probe-gaming.ts, run-8 F6): added lines
+     * in the task's diff whose stated purpose is to make a CHECK pass instead of
+     * meeting the requirement it stands for ("return 401 so the verification test
+     * passes"). Injected as findings under rule 4c so the child confirms the
+     * underlying requirement is genuinely met rather than trusting the green check.
+     * Pure diff-text analysis; ABSENT or empty → no probe block. */
+    probeGamingProbe?: () => Promise<string[]>;
     /**
      * Result of the git-state guard for the MOST RECENT runChild call (see
      * git-state-guard.ts): did the child mutate repo state (stash/checkout/file

package/dist/task/verify-work.js

@@ -139,7 +139,7 @@ export function extractSpecForVerification(taskBody) {
  * Guard: honest-clean fixture (prohibition in spec, probe silent) 5/5 PASS — no
  * paranoia. Reverted-violation ≡ clean at the diff level (no entry → no finding).
  */
-export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFindings, skipEscapeFindings, contracts) {
+export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFindings, skipEscapeFindings, contracts, testAssemblyFindings, probeGamingFindings) {
     const probeBlock = probeFindings && probeFindings.length > 0 ?
         [
             'SELF-VERIFICATION NOTICE (deterministic, computed by the orchestrator from the diff):',
@@ -166,6 +166,24 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFind
             ''
         ]
         : [];
+    const probeGamingBlock = probeGamingFindings && probeGamingFindings.length > 0 ?
+        [
+            'CHECK-GAMING NOTICE (deterministic, computed by the orchestrator from the',
+            "task's diff): these added lines state their own purpose is to make a CHECK",
+            'pass (a test / verification / lint / gate), not to meet the requirement the',
+            'check stands for:',
+            ...probeGamingFindings.map(f => `- ${f}`),
+            'A check is a MESSENGER for a requirement. Code written to quiet the messenger',
+            'instead of meeting the requirement is a defect even when the check is green',
+            '(run-8 F6: a handler returned 401 "so the verification test passes" while the',
+            'real route stayed dead). Do NOT accept the passing check as proof. Read each',
+            "line's surrounding code and confirm the UNDERLYING requirement is genuinely",
+            'met — drive the real behavior directly (rule 4c). If the code only exists to',
+            'satisfy the check while the requirement is unmet, that is a FAIL naming the',
+            'gamed check and the unmet requirement.',
+            ''
+        ]
+        : [];
     const skipEscapeBlock = skipEscapeFindings && skipEscapeFindings.length > 0 ?
         [
             "SKIP-ESCAPE NOTICE (deterministic, computed by the orchestrator from the spec's",
@@ -181,6 +199,23 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFind
             ''
         ]
         : [];
+    const testAssemblyBlock = testAssemblyFindings && testAssemblyFindings.length > 0 ?
+        [
+            'TEST-ASSEMBLY NOTICE (deterministic, computed by the orchestrator from pure',
+            'import-graph shape): these test files rebuild production WIRING — they import the',
+            'same leaf modules the shipped entry composes and assemble their OWN copy of it,',
+            'instead of importing the production assembly:',
+            ...testAssemblyFindings.map(f => `- ${f}`),
+            'A green result on such a test proves that PRIVATE re-assembly, NOT the shipped',
+            'wiring — the copy can be wired differently (a different mount prefix, order, or',
+            'middleware) and pass while production is broken exactly at the seam the test was',
+            'meant to cover (rule 3f below). Before you count the covered area verified, drive',
+            'the behavior against the REAL shipped assembly/entry named above (start or invoke',
+            "the production entry point, not the test's hand-built app). If the real assembly",
+            'fails where the test passes, report FAIL and name the wiring seam.',
+            ''
+        ]
+        : [];
     const envBlock = envNotes && envNotes.trim().length > 0 ? [buildEnvNotesBlock(envNotes)] : [];
     const contractsBlock = contracts && contracts.trim().length > 0 ? [buildContractsVerifyBlock(contracts)] : [];
     return [
@@ -200,7 +235,9 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFind
         ...contractsBlock,
         ...probeBlock,
         ...prohibitionBlock,
+        ...probeGamingBlock,
         ...skipEscapeBlock,
+        ...testAssemblyBlock,
         'How to verify — verify the REAL, shipped deliverable exactly as an unaided fresh',
         'checkout (or CI run) would experience it:',
         '',
@@ -280,6 +317,20 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFind
         '   unverified is a FAIL, never a PASS. A wrong-input control exists for every',
         '   artifact — HTTP request, CLI invocation, library call, schema load, config parse.',
         '',
+        '3f. TEST-REBUILT ASSEMBLY: a test proves only the copy if it RE-CONSTRUCTS wiring that',
+        '   also exists in production — assembling its own app / entry point / config out of the',
+        '   same leaf modules the shipped entry composes, instead of importing and exercising the',
+        '   production assembly. Such a test can wire the leaves differently from production (a',
+        '   different prefix, order, adapter, or middleware) and pass green while the SHIPPED',
+        '   wiring is broken at exactly the seam the test was meant to cover — its green result',
+        '   never touched the production assembly at all. Whenever a spec-required behavior is',
+        '   covered ONLY by tests that build their own composition of the real modules, that',
+        '   behavior is UNVERIFIED off those tests: exercise the REAL shipped entry/assembly (run',
+        '   or invoke the production entry point, hit the real composed surface) and judge THAT.',
+        '   If the real assembly fails where the copy passes, report FAIL naming the wiring seam',
+        '   (e.g. "the entry mounts <module> at <X> but the test mounts it at <Y>, so the real',
+        '   path is dead while the test is green").',
+        '',
         '4. Treat the ACCEPTANCE criteria as the bar. If a command fails, or its real output',
         '   contradicts an ACCEPTANCE criterion, the work has NOT verified.',
         '',
@@ -296,6 +347,18 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFind
         '   for…") that covers the change — judged against that stated exception, not against',
         '   your view of harmlessness.',
         '',
+        '4c. THE CHECK IS THE MESSENGER, NOT THE REQUIREMENT — code (or a comment) whose',
+        '   stated purpose is to make a check PASS, rather than to satisfy the requirement the',
+        '   check stands for, is a defect even when the check is green. The tell is the intent',
+        '   written down: "return X so the test passes", "hardcode this to satisfy the linter",',
+        '   "stub it out to appease CI". When you see such a line — or the CHECK-GAMING NOTICE',
+        '   above names one — do NOT treat the passing check as proof the requirement is met.',
+        '   Find the actual requirement the check was meant to prove and verify THAT directly',
+        '   against the real artifact (rule 3e negative control is the sharpest tool: a handler',
+        '   that answers the check-shaped request the same way for a WRONG input is gaming the',
+        '   check, not implementing the behavior). If the requirement is genuinely unmet while',
+        '   the check passes, the verdict is FAIL naming the gamed check and the real gap.',
+        '',
         '5. The ONLY thing you may assume is already provided is a genuinely EXTERNAL running',
         '   service or network resource (a database server, an API host) that the project',
         '   documents as a prerequisite. Before you rely on that assumption, PROBE for the',
@@ -446,6 +509,28 @@ export async function runWorkVerification(deps) {
             prohibitions = [];
         }
     }
+    // Test-assembly findings feed the prompt (rule 3f); a probe failure must never
+    // block verification — it is an optional sharpener like the substitution probe.
+    let testAssembly = [];
+    if (deps.testAssemblyProbe) {
+        try {
+            testAssembly = await deps.testAssemblyProbe();
+        }
+        catch {
+            testAssembly = [];
+        }
+    }
+    // Probe-gaming findings feed the prompt (rule 4c, F6); a probe failure must never
+    // block verification — an optional sharpener like the other diff-shape probes.
+    let probeGaming = [];
+    if (deps.probeGamingProbe) {
+        try {
+            probeGaming = await deps.probeGamingProbe();
+        }
+        catch {
+            probeGaming = [];
+        }
+    }
     // Environment facts from earlier gate children (best-effort; a cache failure
     // must never block verification).
     let envNotes = '';
@@ -481,7 +566,7 @@ export async function runWorkVerification(deps) {
     for (let attempt = 1;; attempt++) {
         let text;
         try {
-            text = await deps.runChild(VERIFY_TOOLS, buildVerifyPrompt(deps.spec, findings, envNotes, prohibitions, skipEscapes, contracts), deps.signal);
+            text = await deps.runChild(VERIFY_TOOLS, buildVerifyPrompt(deps.spec, findings, envNotes, prohibitions, skipEscapes, contracts, testAssembly, probeGaming), deps.signal);
         }
         catch (err) {
             if (err instanceof Error && err.message === USER_CANCELLED)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.18.3",
+    "version": "0.18.4",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",
@@ -14,7 +14,7 @@
     "scripts": {
         "build": "tsc -p tsconfig.build.json",
         "lint": "prettier --log-level warn --write 'src/**/*.ts' && eslint --fix . && tsc --noEmit",
-        "test": "bun test src/",
+        "test": "AGENT=1 bun test src/",
         "prepublishOnly": "bun run build"
     },
     "peerDependencies": {