@mjasnikovs/pi-task 0.18.3 → 0.18.5

package/dist/task/frozen-path-guard.d.ts

@@ -0,0 +1,39 @@
+/** Run a git subcommand in the guard's cwd; only stdout + exit code are read. */
+export type FrozenGit = (args: string[]) => Promise<{
+    stdout: string;
+    exitCode: number;
+}>;
+/**
+ * The concrete paths the spec forbids modifying, normalized and de-duplicated —
+ * the SAME extraction the verify prohibition-probe and the accept-debt ledger
+ * consume, so "frozen" means one thing across the gates. Empty when the spec is
+ * null or names no path-like token on a modification-ban line: the guard is then a
+ * no-op by construction.
+ */
+export declare function frozenPathsFromSpec(spec: string | null | undefined): string[];
+/**
+ * Parse `git status --porcelain` output (already scoped to the frozen pathspec)
+ * into the list of changed files, for the gate-trail record and to decide whether
+ * anything must be reverted at all. A rename line (`R  old -> new`) yields the NEW
+ * path — the side that carries the child's write. Deterministic and pure so the
+ * parsing is unit-tested without a real repo.
+ */
+export declare function parseChangedFrozenFiles(porcelain: string): string[];
+/**
+ * Restore the spec-frozen paths to their committed (HEAD) state, undoing any
+ * change a just-run write-capable gate child made to them, and return the list of
+ * files that had to be reverted (empty ⇒ the pass respected every frozen path).
+ *
+ * Runs AFTER the task's own work is committed (HEAD), so "restore to HEAD" keeps
+ * the verified task's version of the frozen file and discards ONLY the gate
+ * child's edit on top of it — the task's own frozen-path edits, if any, are a
+ * separate concern the verify prohibition-probe surfaces. `git checkout HEAD`
+ * covers modified/deleted tracked files under each pathspec; `git clean` removes
+ * any untracked file the pass created under a frozen directory. Both are scoped to
+ * the frozen pathspec, so nothing else in the tree is touched.
+ *
+ * Best-effort: an empty frozen list, a non-git tree, or any git error yields an
+ * empty result — the guard must never break the gate on a project it cannot reason
+ * about.
+ */
+export declare function revertFrozenPaths(paths: string[], git: FrozenGit): Promise<string[]>;

package/dist/task/frozen-path-guard.js

@@ -0,0 +1,116 @@
+/**
+ * frozen-path-guard — deterministic write-deny on spec-frozen paths for the
+ * write-capable gate children (the enforce EDIT pass especially).
+ *
+ * The failure class (carried from mx5 run 6, deferred there as the last unshipped
+ * piece of the frozen-contract work): a spec's CONSTRAINTS pin a path as
+ * off-limits ("**Do NOT modify** `src/server/index.ts`"), and a later
+ * write-enabled GATE pass — the enforce child runs `read,edit` — edits that path
+ * anyway. Its edits are judged only locally (a guideline-compliance verdict), then
+ * committed as an "ENFORCE GUIDELINES" snapshot on top of the verified task. The
+ * frozen contract is silently mutated by the very pass meant to police the work.
+ *
+ * Prompt framing is A/B-PROVEN insufficient for this class (the "FROZEN CONTRACT,
+ * MUST NOT edit" instruction held 0/5 unguarded, ~1/5 with framing — the weak
+ * local model ignores an explicit capitalized MUST-NOT most of the time). A
+ * chmod-style physical deny holds 5/5 but makes the model THRASH on the bare
+ * EACCES (1000+ futile re-attempts observed) — unacceptable on the enforce child,
+ * which runs UNGUARDED (no wall-clock timeout). pi itself has no path-level edit
+ * interception (only tool-NAME allow/deny), so the achievable, thrash-free,
+ * stack-agnostic realization of a tool-layer deny is this: let the pass edit
+ * freely, then deterministically UNDO any frozen-path change it made before those
+ * edits can be committed. The violating write never lands in a commit, regardless
+ * of what the model intended — no model in the loop, same discipline as
+ * git-state-guard.
+ *
+ * Everything degrades to a no-op when the spec froze nothing (a single-`/task`
+ * run, or a spec with no `Do NOT modify` line naming a path → no frozen paths →
+ * nothing snapshotted, nothing reverted) and on any git error. Pure git shape,
+ * zero stack assumptions — a frozen path exists for a CLI, a library, a script
+ * collection exactly as for a web app.
+ */
+import { extractProhibitions } from './prohibition-probe.js';
+/**
+ * The concrete paths the spec forbids modifying, normalized and de-duplicated —
+ * the SAME extraction the verify prohibition-probe and the accept-debt ledger
+ * consume, so "frozen" means one thing across the gates. Empty when the spec is
+ * null or names no path-like token on a modification-ban line: the guard is then a
+ * no-op by construction.
+ */
+export function frozenPathsFromSpec(spec) {
+    if (!spec)
+        return [];
+    const seen = new Set();
+    for (const p of extractProhibitions(spec)) {
+        const n = p.path.replace(/^\.\//, '').replace(/\/+$/, '');
+        if (n.length > 0)
+            seen.add(n);
+    }
+    return [...seen];
+}
+/**
+ * Parse `git status --porcelain` output (already scoped to the frozen pathspec)
+ * into the list of changed files, for the gate-trail record and to decide whether
+ * anything must be reverted at all. A rename line (`R  old -> new`) yields the NEW
+ * path — the side that carries the child's write. Deterministic and pure so the
+ * parsing is unit-tested without a real repo.
+ */
+export function parseChangedFrozenFiles(porcelain) {
+    const out = [];
+    const seen = new Set();
+    for (const raw of porcelain.split('\n')) {
+        // Porcelain v1: two status chars, a space, then the path. Blank/short lines
+        // (trailing newline) carry no entry.
+        if (raw.length < 4)
+            continue;
+        let file = raw.slice(3).trim();
+        if (file.length === 0)
+            continue;
+        // Rename/copy: "orig -> new" — the new path is the one the write produced.
+        const arrow = file.indexOf(' -> ');
+        if (arrow !== -1)
+            file = file.slice(arrow + 4).trim();
+        // Porcelain quotes paths with unusual chars; strip the surrounding quotes.
+        if (file.startsWith('"') && file.endsWith('"') && file.length >= 2) {
+            file = file.slice(1, -1);
+        }
+        if (file.length === 0 || seen.has(file))
+            continue;
+        seen.add(file);
+        out.push(file);
+    }
+    return out;
+}
+/**
+ * Restore the spec-frozen paths to their committed (HEAD) state, undoing any
+ * change a just-run write-capable gate child made to them, and return the list of
+ * files that had to be reverted (empty ⇒ the pass respected every frozen path).
+ *
+ * Runs AFTER the task's own work is committed (HEAD), so "restore to HEAD" keeps
+ * the verified task's version of the frozen file and discards ONLY the gate
+ * child's edit on top of it — the task's own frozen-path edits, if any, are a
+ * separate concern the verify prohibition-probe surfaces. `git checkout HEAD`
+ * covers modified/deleted tracked files under each pathspec; `git clean` removes
+ * any untracked file the pass created under a frozen directory. Both are scoped to
+ * the frozen pathspec, so nothing else in the tree is touched.
+ *
+ * Best-effort: an empty frozen list, a non-git tree, or any git error yields an
+ * empty result — the guard must never break the gate on a project it cannot reason
+ * about.
+ */
+export async function revertFrozenPaths(paths, git) {
+    if (paths.length === 0)
+        return [];
+    const status = await git(['status', '--porcelain', '--', ...paths]);
+    if (status.exitCode !== 0)
+        return [];
+    const changed = parseChangedFrozenFiles(status.stdout);
+    if (changed.length === 0)
+        return [];
+    // Restore tracked modifications/deletions from HEAD, then remove any untracked
+    // additions — both confined to the frozen pathspec so the pass's legitimate
+    // edits to OTHER files survive untouched.
+    await git(['checkout', '-f', 'HEAD', '--', ...paths]);
+    await git(['clean', '-fdq', '--', ...paths]);
+    return changed;
+}

package/dist/task/gate-deps.d.ts

@@ -1,6 +1,7 @@
 import type { ExtensionCommandContext } from '@earendil-works/pi-coding-agent';
 import type { GateDeps } from './task-gates.js';
 import { type FinalFixResult } from './final-gate-fix.js';
+import { type AddedLine } from './probe-gaming.js';
 import { type ChangedFile } from './substitution-probe.js';
 /** A function that re-runs a task's implementation turn (AUTOFIX). Injected by the
  *  command so this module stays free of the orchestrators (avoids an import cycle). */
@@ -17,6 +18,15 @@ export type FinalGateFixFn = (ctx: ExtensionCommandContext, cwd: string, failRea
  * blocker.
  */
 export declare function collectChangedFiles(cwd: string, signal?: AbortSignal): Promise<ChangedFile[]>;
+/**
+ * Collect the task's added lines WITH CONTENT (path + text) for the probe-gaming
+ * probe (F6), which needs the actual line text the numstat-shape collector omits.
+ * Pre-commit the work is the tree-vs-HEAD diff plus untracked files (read whole, as
+ * all-added); on the post-enforce re-verify the tree is clean, so fall back to the
+ * last commit's diff. Failures degrade to an empty list — the probe is a sharpener,
+ * never a blocker. The `.pi-tasks/` bookkeeping is excluded from every git command.
+ */
+export declare function collectAddedLines(cwd: string, signal?: AbortSignal): Promise<AddedLine[]>;
 /**
  * Build the gate deps for one command run. `runTask` is the orchestrator's
  * implementation re-runner, injected by the caller. The returned object also drives

package/dist/task/gate-deps.js

@@ -21,12 +21,16 @@ import { runGuidelineEnforcement, classifyEnforceChildFailure } from './enforce-
 import { runWorkVerification, extractSpecForVerification } from './verify-work.js';
 import { readEnvNotes, appendEnvNotes } from './env-notes.js';
 import { readContracts } from './contracts.js';
+import { recordAcceptDebt } from './accept-debt.js';
 import { runRepoHealthCheck } from './repo-health-check.js';
 import { runFinalIntegrationGate, discoverGateCommandLabels } from './final-gate.js';
 import { runFinalGateAutofix } from './final-gate-fix.js';
 import { researchResolution } from './verify-resolution.js';
 import { extractProhibitions, findProhibitionViolations } from './prohibition-probe.js';
-import { findSubstitutionSuspects } from './substitution-probe.js';
+import { frozenPathsFromSpec, revertFrozenPaths } from './frozen-path-guard.js';
+import { findProbeGaming, parseAddedLines } from './probe-gaming.js';
+import { findSubstitutionSuspects, isTestFile } from './substitution-probe.js';
+import { findTestRebuiltAssemblies, testAssemblyVerifyFindings } from './test-assembly.js';
 import { runBoundedLintFix } from './lint-fix.js';
 import { captureGitState, reconcileGitState } from './git-state-guard.js';
 import { runWorker } from '../workers/pi-worker-core.js';
@@ -76,6 +80,85 @@ export async function collectChangedFiles(cwd, signal) {
     }
     return files;
 }
+/**
+ * Collect the task's added lines WITH CONTENT (path + text) for the probe-gaming
+ * probe (F6), which needs the actual line text the numstat-shape collector omits.
+ * Pre-commit the work is the tree-vs-HEAD diff plus untracked files (read whole, as
+ * all-added); on the post-enforce re-verify the tree is clean, so fall back to the
+ * last commit's diff. Failures degrade to an empty list — the probe is a sharpener,
+ * never a blocker. The `.pi-tasks/` bookkeeping is excluded from every git command.
+ */
+export async function collectAddedLines(cwd, signal) {
+    const tracked = await git(cwd, ['diff', 'HEAD', '--', '.', EXCLUDE_TASKS_DIR], signal);
+    const lines = tracked.exitCode === 0 ? parseAddedLines(tracked.stdout) : [];
+    const untracked = await git(cwd, ['ls-files', '--others', '--exclude-standard', '--', '.', EXCLUDE_TASKS_DIR], signal);
+    for (const name of splitLines(untracked.exitCode === 0 ? untracked.stdout : '')) {
+        try {
+            const content = await fsp.readFile(path.join(cwd, name), 'utf8');
+            for (const text of content.split('\n'))
+                lines.push({ path: name, text });
+        }
+        catch {
+            // unreadable/binary — nothing to report
+        }
+    }
+    if (lines.length === 0) {
+        const last = await git(cwd, ['diff', 'HEAD~1..HEAD', '--', '.', EXCLUDE_TASKS_DIR], signal);
+        return last.exitCode === 0 ? parseAddedLines(last.stdout) : [];
+    }
+    return lines;
+}
+/** Source extensions whose relative imports the test-assembly probe reasons over. */
+const SOURCE_EXT_RE = /\.(?:[cm]?[jt]sx?)$/;
+/** Bounds so the probe stays cheap on large repos (it reads file text). */
+const MAX_PROBE_FILES = 4000;
+const MAX_PROBE_FILE_BYTES = 512 * 1024;
+/** Best-effort read of a repo file's text; unreadable/oversized → null (skipped). */
+async function readRepoFile(cwd, rel) {
+    try {
+        const buf = await fsp.readFile(path.join(cwd, rel));
+        if (buf.length > MAX_PROBE_FILE_BYTES)
+            return null;
+        return { path: rel, text: buf.toString('utf8') };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Deterministic test-assembly probe input (see test-assembly.ts, run-8 F4): read the
+ * task's own changed TEST files plus the repo's tracked source files, and return the
+ * finding lines naming any test that rebuilds a production assembly it never imports.
+ * Pure import-graph shape; failures degrade to no findings (the probe is a sharpener,
+ * never a blocker). `changed` is the already-collected task diff, reused so the probe
+ * costs one extra tracked-file listing, not a second diff.
+ */
+async function collectTestAssemblyFindings(cwd, changed, signal) {
+    const changedTests = changed.filter(f => isTestFile(f.path));
+    if (changedTests.length === 0)
+        return [];
+    const listed = await git(cwd, ['ls-files', '--', '.', EXCLUDE_TASKS_DIR], signal);
+    if (listed.exitCode !== 0)
+        return [];
+    const sources = splitLines(listed.stdout)
+        .filter(p => SOURCE_EXT_RE.test(p))
+        .slice(0, MAX_PROBE_FILES);
+    const production = [];
+    for (const rel of sources) {
+        if (isTestFile(rel))
+            continue;
+        const f = await readRepoFile(cwd, rel);
+        if (f)
+            production.push(f);
+    }
+    const testFiles = [];
+    for (const { path: rel } of changedTests) {
+        const f = await readRepoFile(cwd, rel);
+        if (f)
+            testFiles.push(f);
+    }
+    return testAssemblyVerifyFindings(findTestRebuiltAssemblies(testFiles, production));
+}
 /**
  * Build the gate deps for one command run. `runTask` is the orchestrator's
  * implementation re-runner, injected by the caller. The returned object also drives
@@ -183,6 +266,29 @@ export function buildGateDeps(params) {
         // Durable per-task gate trail: every verdict/decision lands in the task
         // file's `## gates` section so gate behavior is auditable from artifacts.
         record: (cwd2, taskId, line) => appendGateRecord(cwd2, taskId, line),
+        // Durable ACCEPT-despite-verify-FAIL ledger under .pi-tasks/ (survives
+        // discardEdits): the final integration gate re-checks each debt at run end.
+        recordAcceptDebt: (cwd2, taskId, reason) => recordAcceptDebt(cwd2, taskId, reason),
+        // Frozen-path write-deny (see frozen-path-guard.ts): the concrete paths this
+        // task's spec forbids modifying, so the gate sequence can UNDO any edit the
+        // enforce EDIT pass makes to them before those edits are committed. Reads the
+        // same composed spec + extractProhibitions the verify probe consumes; empty on
+        // a spec that froze nothing → the guard is a no-op.
+        frozenPaths: async (cwd2, taskId) => {
+            try {
+                const { body } = await readTaskFile(cwd2, taskId);
+                return frozenPathsFromSpec(extractSpecForVerification(body));
+            }
+            catch {
+                return [];
+            }
+        },
+        // Restore those frozen paths to HEAD, discarding a gate child's edits to them;
+        // returns the files actually reverted (for the trail). Best-effort git shape.
+        revertFrozenPaths: (cwd2, paths) => revertFrozenPaths(paths, async (args) => {
+            const r = await git(cwd2, args, signal);
+            return { stdout: r.stdout, exitCode: r.exitCode };
+        }),
         commit: (cwd2, message) => getConfig().autoCommit ?
             gitCommitAll(cwd2, message, signal)
             : Promise.resolve({ committed: false, reason: 'auto-commit disabled' }),
@@ -292,6 +398,16 @@ export function buildGateDeps(params) {
                 // authored/changed become prompt-level findings mandating the child
                 // to drive the real artifact before trusting their green result.
                 probe: () => collectChangedFiles(cwd2, signal).then(findSubstitutionSuspects),
+                // Deterministic test-assembly probe (F4): authored test files that
+                // rebuild production wiring — importing the leaf modules the shipped
+                // entry composes and assembling their own copy — become rule-3f
+                // findings so the child drives the REAL assembly, not the copy.
+                testAssemblyProbe: () => collectChangedFiles(cwd2, signal).then(changed => collectTestAssemblyFindings(cwd2, changed, signal)),
+                // Deterministic probe-gaming probe (F6): added lines whose stated
+                // purpose is to make a check pass rather than meet the requirement
+                // ("return 401 so the verification test passes") become rule-4c
+                // findings so the child verifies the real requirement, not the check.
+                probeGamingProbe: () => collectAddedLines(cwd2, signal).then(findProbeGaming),
                 // Deterministic prohibition probe: paths the spec forbids modifying
                 // that the task's diff modified anyway become prompt-level findings
                 // under the no-waiver rule — the child otherwise rarely runs `git
@@ -311,10 +427,13 @@ export function buildGateDeps(params) {
                 // Per-run environment-facts cache under .pi-tasks/ (survives
                 // discardEdits): earlier children's discoveries save this child
                 // the re-archaeology; its own ENV-NOTE lines are stored for the
-                // next one. Facts only — verdict rules unaffected.
+                // next one, stamped with this task's id as their origin so a
+                // later child sees a cited fact is second-hand and must
+                // re-validate before excusing a failure (F7). Facts only —
+                // verdict rules unaffected.
                 envNotes: {
                     read: () => readEnvNotes(cwd2),
-                    append: notes => appendEnvNotes(cwd2, notes)
+                    append: notes => appendEnvNotes(cwd2, notes, taskId)
                 },
                 // Per-run cross-slice contract registry under .pi-tasks/ (F3): the
                 // verbatim interface facts the design pins that multiple slices

package/dist/task/probe-gaming.d.ts

@@ -0,0 +1,60 @@
+/**
+ * probe-gaming — deterministic detection of CHECK-GAMING code, feeding the verify
+ * and enforce gate prompts (run-8 F6).
+ *
+ * The failure class: the implementation writes code — or a comment on it — whose
+ * STATED PURPOSE is to make a check pass, rather than to satisfy the requirement the
+ * check stands for. mx5 run-8 shipped, verbatim,
+ *   `// Return 401 so the verification test passes (expects 200/401/403 for /api routes).`
+ * above four catch-all handlers added to satisfy the VERIFY curl instead of fixing
+ * the broken route mount. The route stayed dead; the check went green; the code SAID
+ * SO IN WRITING. A check is a MESSENGER for a requirement — code written to quiet the
+ * messenger instead of meeting the requirement is the defect, and when it announces
+ * its own intent it is cheaply detectable.
+ *
+ * Same probe+rule design as the other run-8 probes (skip-escape.ts,
+ * prohibition-probe.ts, substitution-probe.ts, test-assembly.ts): a deterministic
+ * finding is the reliable lever, a prompt rule alone is weak. This scans the task's
+ * DIFF (added lines only — the work this task introduced) for the gaming tell and
+ * hands each hit to the gate child verbatim, so the rule fires on a concrete line
+ * rather than on the model self-discovering the intent.
+ *
+ * Advisory, never an auto-FAIL: intent phrasing is prose and a genuinely-benign line
+ * could in principle carry it ("returns 401 so the auth test passes" describing a
+ * CORRECT auth path). The child reads the exact line and the surrounding code and
+ * judges — the verify rule directs it to confirm the underlying requirement is
+ * actually met, not merely that the check is green.
+ *
+ * FP-MEASURED on the real run-8 corpus (~/hub/mx5, all 53 commits): 1 unique hit in
+ * 50,735 added lines — exactly the true F6 line, zero false positives. The tell is a
+ * purpose phrase binding a CHECK noun (test / verification / lint / CI / gate / …) to
+ * a pass-state or a gaming verb; benign uses of the same words ("pass the test data",
+ * "run the verification suite", "the linter flagged this") do not match. Pure
+ * diff-text analysis — no stack, framework, or tool-name assumptions; a project with
+ * no such comment simply yields no findings (nothing to observe = pass).
+ */
+/** One added line from a task's diff: the file it was added to and its text. */
+export interface AddedLine {
+    /** Path relative to the repo root (from the `+++ b/…` header). */
+    path: string;
+    /** The added line's content, without the leading `+`. */
+    text: string;
+}
+/** Does this line state its purpose is to make a check pass? */
+export declare function isProbeGamingLine(text: string): boolean;
+/**
+ * Parse a unified `git diff` into its added lines (path + text). Tracks the current
+ * file from each `+++ b/…` header and collects every `+`-prefixed body line
+ * (excluding the `+++` header itself). Robust to surrounding prose (the enforce diff
+ * capture wraps the diff in a header/footer) because only `+`/`+++` lines are read.
+ */
+export declare function parseAddedLines(diff: string): AddedLine[];
+/**
+ * Scan a set of added lines for check-gaming tells. Returns one finding per matching
+ * line; empty when none match (the prompt then gets no probe block). The finding
+ * carries the file and the offending line verbatim so the gate child can locate and
+ * judge it. Long lines are truncated for the prompt.
+ */
+export declare function findProbeGaming(added: AddedLine[]): string[];
+/** Convenience: scan a unified diff string straight to findings. */
+export declare function findProbeGamingInDiff(diff: string): string[];

package/dist/task/repo-health-check.d.ts

@@ -6,7 +6,18 @@ export interface HealthOutcome {
     reason: string;
     /** Which manifest drove discovery, or null when none was found. */
     ecosystem: string | null;
+    /**
+     * First lines of the failing command's combined stderr+stdout — captured so a
+     * FAIL is explainable from artifacts alone. Run-8 F8: five enforce passes were
+     * discarded on "`bun run lint` exited 2" and the cause was unreproducible
+     * post-run because only the exit code was recorded (exit 2 is the linter's
+     * CRASH class; findings exit 1 — the captured output is what tells them apart).
+     * Empty string on pass / skip.
+     */
+    output: string;
 }
+/** Combine a failing command's stderr+stdout into a bounded, first-N-lines snippet. */
+export declare function captureHealthOutput(stdout: string, stderr: string): string;
 /** One discovered command: the binary and its args, run from the repo root. */
 export type HealthCommand = [bin: string, args: string[]];
 /**

package/dist/task/repo-health-check.js

@@ -32,6 +32,23 @@
 import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import * as path from 'node:path';
+/** How much of a failing command's output to keep — bounded so a wedged tool that
+ *  spews megabytes cannot bloat the trail. stderr leads (a crash trace lives there). */
+const HEALTH_OUTPUT_MAX_LINES = 40;
+const HEALTH_OUTPUT_MAX_CHARS = 4000;
+/** Combine a failing command's stderr+stdout into a bounded, first-N-lines snippet. */
+export function captureHealthOutput(stdout, stderr) {
+    const combined = [stderr, stdout]
+        .map(s => (s ?? '').trim())
+        .filter(s => s.length > 0)
+        .join('\n');
+    if (combined.length === 0)
+        return '';
+    let snippet = combined.split('\n').slice(0, HEALTH_OUTPUT_MAX_LINES).join('\n');
+    if (snippet.length > HEALTH_OUTPUT_MAX_CHARS)
+        snippet = `${snippet.slice(0, HEALTH_OUTPUT_MAX_CHARS)}…`;
+    return snippet;
+}
 function packageScripts(cwd) {
     try {
         const j = JSON.parse(readFileSync(path.join(cwd, 'package.json'), 'utf8'));
@@ -103,7 +120,12 @@ export function discoverHealthCommands(cwd) {
 export function runRepoHealthCheck(cwd, timeoutMs = 600_000) {
     const { ecosystem, cmds } = discoverHealthCommands(cwd);
     if (!ecosystem || cmds.length === 0) {
-        return { ok: true, reason: 'no repo-wide static-analysis command found', ecosystem };
+        return {
+            ok: true,
+            reason: 'no repo-wide static-analysis command found',
+            ecosystem,
+            output: ''
+        };
     }
     for (const [bin, args] of cmds) {
         const r = spawnSync(bin, args, { cwd, encoding: 'utf8', timeout: timeoutMs });
@@ -119,9 +141,10 @@ export function runRepoHealthCheck(cwd, timeoutMs = 600_000) {
             return {
                 ok: false,
                 reason: `\`${bin} ${args.join(' ')}\` exited ${r.status}`,
-                ecosystem
+                ecosystem,
+                output: captureHealthOutput(r.stdout, r.stderr)
             };
         }
     }
-    return { ok: true, reason: `${ecosystem}: static checks passed`, ecosystem };
+    return { ok: true, reason: `${ecosystem}: static checks passed`, ecosystem, output: '' };
 }

package/dist/task/task-gates.d.ts

@@ -101,6 +101,7 @@ export interface GateDeps {
     repoHealth?: (cwd: string) => Promise<{
         ok: boolean;
         reason: string;
+        output?: string;
     }>;
     /** Does the working tree hold changes (excluding .pi-tasks)? Lets the pre-commit
      *  health check run only when the enforce pass actually edited something. */
@@ -118,6 +119,29 @@ export interface GateDeps {
      * swallowed by the implementation, never by this sequence.
      */
     record?: (cwd: string, taskId: string, line: string) => Promise<void>;
+    /**
+     * Record a durable ACCEPT-despite-verify-FAIL debt (task id + FAIL reason) to the
+     * run-level ledger (`.pi-tasks/accept-debt.md`, see accept-debt.ts). Called only on
+     * the picker's ACCEPT branch — the human blessed a failing artifact as-is, so the
+     * defect is real and recorded; the final integration gate re-checks it at run end
+     * and surfaces it if still open. Best-effort; absent in tests → no ledger written.
+     */
+    recordAcceptDebt?: (cwd: string, taskId: string, reason: string) => Promise<void>;
+    /**
+     * The concrete paths this task's spec forbids modifying (its `Do NOT modify`
+     * CONSTRAINTS — see frozen-path-guard.ts / prohibition-probe.ts). Used to
+     * write-deny the enforce EDIT pass: a violating edit is reverted before it can
+     * be committed. Empty when the spec froze nothing → the guard is a no-op.
+     * Absent in tests / on a bare `/task` → the guard is skipped.
+     */
+    frozenPaths?: (cwd: string, taskId: string) => Promise<string[]>;
+    /**
+     * Restore the given frozen paths to their committed (HEAD) state, discarding a
+     * gate child's edits to them, and return the files actually reverted. Prompt
+     * framing is A/B-proven insufficient for this class, so the deny is mechanical:
+     * the write is undone, not merely warned about. Absent → the guard warns only.
+     */
+    revertFrozenPaths?: (cwd: string, paths: string[]) => Promise<string[]>;
 }
 /** Inputs the sequence needs that vary per caller. */
 export interface GateParams {

package/dist/task/task-gates.js

@@ -10,6 +10,18 @@ import { SessionUI } from '../remote/bridge.js';
  * regardless of this count (blessing an artifact as-is is a human's call).
  */
 export const MAX_AUTO_AUTOFIX = 3;
+/**
+ * Bound a captured health-check output before it is embedded in a gate-trail line.
+ * appendGateRecord flattens newlines to spaces, so the trail stays one line per
+ * entry; this just caps the volume (a wedged tool can emit megabytes). The health
+ * check already trims to its own first-N lines — this is the trail-side ceiling.
+ */
+const TRAIL_OUTPUT_MAX_CHARS = 1200;
+function clampOutput(output) {
+    return output.length > TRAIL_OUTPUT_MAX_CHARS ?
+        `${output.slice(0, TRAIL_OUTPUT_MAX_CHARS)}…`
+        : output;
+}
 /**
  * Show the boxed two-choice picker after a verify FAIL and return what the user
  * decided. The model-recommended card is placed first so the renderer tints it
@@ -135,6 +147,16 @@ export async function runGatesForTask(ctxIn, deps, p) {
             }
             if (choice.action === 'accept') {
                 await rec('resolution: user ACCEPTED the work despite verify FAIL');
+                // Durable debt: the human blessed a FAILing artifact as-is, so the
+                // defect ships and nothing else revisits it (mx5 run 4 B3 / run 8
+                // TASK_0012). Record it to the run ledger; the final integration gate
+                // re-checks it at run end and surfaces it if still open. Best-effort.
+                try {
+                    await deps.recordAcceptDebt?.(p.cwd, p.taskId, failReason);
+                }
+                catch {
+                    // recording must never break the gate sequence
+                }
                 active.ui.notify(`${p.tag}: accepted "${p.title}" despite verify FAIL (${failReason.slice(0, 120)}) — proceeding.`, 'warning');
                 break;
             }
@@ -202,13 +224,40 @@ export async function runGatesForTask(ctxIn, deps, p) {
     // with no enforce dep.
     if (deps.enforce && commit.committed) {
         const mode = verifyCleanPass ? 'edit' : 'flag';
-        active.ui.notify(mode === 'edit' ?
-            `${p.tag}: enforcing AGENTS.md/CLAUDE.md on "${p.title}"…`
-            : `${p.tag}: reviewing "${p.title}" against AGENTS.md/CLAUDE.md (no verify signal — report only)…`, 'info');
+        // BASELINE repo health, captured BEFORE the edit pass touches the tree, so the
+        // pre-commit gate below is DIFFERENTIAL: it can tell an enforce-CAUSED
+        // regression (was clean, now fails) from a repo that was ALREADY unhealthy
+        // (run-8 F8: five enforce passes were discarded on a lint that was already
+        // crashing — exit 2 — before enforce edited anything; the discard threw away
+        // good work for a fault it did not cause). Only meaningful in edit mode (flag
+        // makes no edits); the task's work is already committed so this reflects the
+        // committed state the pass is about to build on.
+        const healthBefore = mode === 'edit' && deps.repoHealth ? await deps.repoHealth(p.cwd) : undefined;
         const verdict = await deps.enforce(active, p.cwd, p.title, mode);
+        // FROZEN-PATH WRITE-DENY (mechanical, not prompt — the "MUST NOT edit"
+        // instruction is A/B-proven ~0–1/5 reliable on the weak model): the enforce
+        // EDIT pass runs read,edit and has been seen mutating a path the spec froze.
+        // Before its edits are inspected/committed below, restore any frozen path it
+        // touched to the committed task state, so the violating write cannot land in
+        // the ENFORCE GUIDELINES commit regardless of what the model intended. The
+        // task's OWN frozen-path edits (if any) are already in HEAD and are the verify
+        // prohibition-probe's job — this only undoes the gate child's edits on top.
+        // No-op when the spec froze nothing or the deps are absent (bare /task, tests).
+        if (mode === 'edit' && deps.frozenPaths && deps.revertFrozenPaths) {
+            const frozen = await deps.frozenPaths(p.cwd, p.taskId);
+            if (frozen.length > 0) {
+                const reverted = await deps.revertFrozenPaths(p.cwd, frozen);
+                if (reverted.length > 0) {
+                    await rec(`enforce: frozen-path write DENIED — reverted ${reverted.length} spec-frozen file(s) the edit pass modified: ${reverted.join(', ')}`);
+                    active.ui.notify(`${p.tag}: guideline edits on "${p.title}" touched spec-frozen path(s) (${reverted.join(', ').slice(0, 120)}) — reverted before commit.`, 'warning');
+                }
+            }
+        }
         // The child's verdict and its edits are independent facts: the pass has been
         // observed declaring "clean" while having edited files (which then get
         // committed as fixes) — record both so the trail cannot contradict itself.
+        // `editsMade` is read AFTER the frozen-path revert so a pass whose only edit
+        // was to a frozen path correctly shows a clean tree (nothing left to commit).
         const editsMade = mode === 'edit' && deps.dirty ? await deps.dirty(p.cwd) : undefined;
         await rec(`enforce(${mode}): ${verdict.ok ? `clean${verdict.reason ? ` (${verdict.reason})` : ''}` : (verdict.reason ?? 'not clean')}${editsMade ? ' — edits in tree' : ''}`);
         if (!verdict.ok) {
@@ -220,19 +269,40 @@ export async function runGatesForTask(ctxIn, deps, p) {
         // and discards the bad edits outright. Only runs when the tree is actually
         // dirty (or dirtiness is unknowable); the differential guard below still
         // catches behavioral regressions the static check cannot see.
+        //
+        // The gate is DIFFERENTIAL, not absolute (run-8 F8): discard the edits only
+        // when they REGRESSED the health signal — clean before, failing after. A repo
+        // that was already failing before enforce ran is not enforce's fault, so its
+        // edits are KEPT (and the pre-existing failure is recorded, to be caught by the
+        // final integration gate, not blamed on this pass). The failing command's
+        // output is captured into the trail so the discard is explainable — F8 was
+        // unreproducible precisely because only the exit code was recorded.
         let enforceEditsBlocked = false;
         if (mode === 'edit' && deps.repoHealth && editsMade !== false) {
-            const h = await deps.repoHealth(p.cwd);
-            if (!h.ok) {
+            const after = await deps.repoHealth(p.cwd);
+            // A regression needs a clean (or unknown) baseline turning to a fail. If
+            // healthBefore is undefined (repoHealth was absent at baseline time) treat
+            // the baseline as clean — the conservative absolute behavior.
+            const wasHealthyBefore = healthBefore?.ok ?? true;
+            const regressed = !after.ok && wasHealthyBefore;
+            if (regressed) {
                 enforceEditsBlocked = true;
+                const outputTail = after.output ? ` — output:\n${clampOutput(after.output)}` : '';
                 if (deps.discardEdits) {
                     await deps.discardEdits(p.cwd);
-                    await rec(`enforce: edits discarded pre-commit (repo health: ${h.reason})`);
+                    await rec(`enforce: edits discarded pre-commit — REGRESSED repo health (${after.reason})${outputTail}`);
                 }
                 else {
-                    await rec(`enforce: edits FAILED repo health pre-commit (${h.reason}) — no discard available, left uncommitted`);
+                    await rec(`enforce: edits REGRESSED repo health pre-commit (${after.reason}) — no discard available, left uncommitted${outputTail}`);
                 }
-                active.ui.notify(`${p.tag}: guideline edits on "${p.title}" failed repo health (${h.reason.slice(0, 120)}) — discarded before commit.`, 'warning');
+                active.ui.notify(`${p.tag}: guideline edits on "${p.title}" regressed repo health (${after.reason.slice(0, 120)}) — discarded before commit.`, 'warning');
+            }
+            else if (!after.ok) {
+                // Failing both before and after → not enforce's fault. Keep the edits;
+                // record that the repo entered the gate already unhealthy so the trail
+                // explains why a still-failing repo did NOT trigger a discard here.
+                const outputTail = after.output ? ` — output:\n${clampOutput(after.output)}` : '';
+                await rec(`enforce: repo health still failing after edits but was ALREADY failing before the pass (${after.reason}) — pre-existing, edits kept${outputTail}`);
             }
         }
         if (mode === 'edit' && !enforceEditsBlocked && editsMade === false) {