@mjasnikovs/pi-task 0.18.30 → 0.18.31

package/dist/task/auto-orchestrator.d.ts

@@ -45,6 +45,14 @@ export interface AutoDeps extends GateDeps {
      * Leave-failed / Accept, exactly the pre-autofix behavior.
      */
     finalGateFix?: FinalGateFixFn;
+    /**
+     * Paths currently uncommitted in the working tree (`git status` shape), used to
+     * detect SUB-FIXES a non-converging final-gate autofix left behind (mx5 run 13
+     * PROMPT 4 item 3). Every task is committed by the time the final gate runs, so
+     * anything dirty here is the fix pass's own work. Absent → the stranded-fix
+     * handling is skipped entirely (prior behavior).
+     */
+    pendingChanges?: (cwd: string) => Promise<string[]>;
 }
 /**
  * Expand any @file references in the feature text by appending each referenced

package/dist/task/auto-orchestrator.js

@@ -24,12 +24,12 @@ import { SessionUI, registerBridgeCommand, publishLifecycleNotice } from '../rem
 import { pushNotify } from '../remote/push.js';
 import { startAutoLoader } from './widget.js';
 import { getParentContextWindow, resolveContextUsage } from './context-usage.js';
-import { buildGateDeps } from './gate-deps.js';
+import { buildGateDeps, collectTreeChanges } from './gate-deps.js';
 import { runGatesForTask } from './task-gates.js';
 import { gitUnmergedPaths, gitStashRef } from './auto-commit.js';
 import { runFinalIntegrationGate } from './final-gate.js';
 import { describeDebt } from './accept-debt.js';
-import { classifyFinalGateAnswer, MAX_FINAL_GATE_AUTOFIX, FINAL_LEAVE_LABEL, FINAL_LEAVE_VALUE, FINAL_ACCEPT_LABEL, FINAL_ACCEPT_VALUE, FINAL_AUTOFIX_LABEL, FINAL_AUTOFIX_VALUE } from './final-gate-fix.js';
+import { classifyFinalGateAnswer, MAX_FINAL_GATE_AUTOFIX, FINAL_LEAVE_LABEL, FINAL_LEAVE_VALUE, FINAL_ACCEPT_LABEL, FINAL_ACCEPT_VALUE, FINAL_AUTOFIX_LABEL, FINAL_AUTOFIX_VALUE, STRANDED_FIX_COMMIT, strandedFixNote } from './final-gate-fix.js';
 import { getConfig } from '../config/config.js';
 import { isYoloMode, yoloPickAnswer, yoloFinalGateChoice, YOLO_STAMP } from './yolo.js';
 import { configureResearchRun } from '../workers/research-cache.js';
@@ -904,7 +904,14 @@ function defaultDeps(ctx, cwd, signal, title) {
         // run-level half of the same verification story.
         finalGate: (cwd2, planText) => getConfig().verifyWork ?
             runFinalIntegrationGate(cwd2, undefined, undefined, undefined, planText)
-            : Promise.resolve({ ok: true, reason: 'disabled' })
+            : Promise.resolve({ ok: true, reason: 'disabled' }),
+        // Uncommitted paths, for the stranded-sub-fix handling around the final-gate
+        // picker (mx5 run 13 PROMPT 4 item 3). Every task is committed by the time
+        // the gate runs, so whatever is dirty here belongs to the fix pass.
+        pendingChanges: async (cwd2) => {
+            const changes = await collectTreeChanges(cwd2, signal);
+            return [...changes.modified, ...changes.added, ...changes.deleted].sort();
+        }
     };
 }
 // ─── Loop ────────────────────────────────────────────────────────────────────
@@ -1009,6 +1016,21 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                     // after MAX_FINAL_GATE_AUTOFIX attempts that still FAIL the
                     // autofix card is withdrawn so the loop cannot run unbounded.
                     let fixAttempts = 0;
+                    // Sub-fixes a non-converging autofix attempt left uncommitted.
+                    // Refreshed after every attempt; drives the picker note and the
+                    // accept-time commit (mx5 run 13 PROMPT 4 item 3).
+                    let stranded = [];
+                    const refreshStranded = async () => {
+                        if (!deps.pendingChanges)
+                            return;
+                        try {
+                            stranded = await deps.pendingChanges(cwd);
+                        }
+                        catch {
+                            // Inconclusive: say nothing rather than claim a clean tree.
+                            stranded = [];
+                        }
+                    };
                     while (!fin.ok) {
                         const canAutofix = deps.finalGateFix !== undefined && fixAttempts < MAX_FINAL_GATE_AUTOFIX;
                         // The picker question shows the debts (the HUMAN weighs them);
@@ -1019,7 +1041,11 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                             + '(the project’s own test/build/static commands, run unaided).'
                             + (fixAttempts > 0 ?
                                 `\n\nAutofix attempts so far: ${fixAttempts}/${MAX_FINAL_GATE_AUTOFIX}.`
-                                : '');
+                                : '')
+                            // Never let a partial repair be invisible at the moment
+                            // the human decides (run 13: a bunfig fix that made
+                            // `bun run test` pass 116/116 was stranded by an ACCEPT).
+                            + strandedFixNote(stranded);
                         // YOLO: keep autofixing WHILE the card is still offered — the
                         // loop withdraws it after MAX_FINAL_GATE_AUTOFIX, so the cap
                         // that bounds a non-converging fix pass still bounds this —
@@ -1058,7 +1084,30 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                         const choice = classifyFinalGateAnswer(answer);
                         if (choice.action === 'accept') {
                             await recGate('final-gate: FAIL accepted by user');
-                            active.ui.notify(`${id}: final integration gate FAIL accepted by user — completing.`, 'warning');
+                            // STRANDED SUB-FIXES: the run completes here, so anything
+                            // the fix pass repaired but never committed would be lost
+                            // to the next `git checkout` while HEAD keeps the defect
+                            // it fixed. Commit it as its own, named commit — the
+                            // ACCEPT is a decision about the FAILING gate, never an
+                            // instruction to throw away work (mx5 run 13 item 3).
+                            if (stranded.length > 0) {
+                                try {
+                                    const sha = await deps.commit(cwd, STRANDED_FIX_COMMIT(id));
+                                    await recGate(`final-gate: committed ${stranded.length} stranded fix-pass change(s)`
+                                        + `${sha ? ` as ${sha}` : ''} — ${stranded.slice(0, 8).join(', ')}`);
+                                }
+                                catch (err) {
+                                    // Never break the completion path over this — but
+                                    // say so, so the changes are not silently lost.
+                                    await recGate(`final-gate: could NOT commit ${stranded.length} stranded fix-pass `
+                                        + `change(s) (${err instanceof Error ? err.message : String(err)}) — `
+                                        + `they remain UNCOMMITTED in the working tree: ${stranded.slice(0, 8).join(', ')}`);
+                                }
+                            }
+                            active.ui.notify(`${id}: final integration gate FAIL accepted by user — completing.`
+                                + (stranded.length > 0 ?
+                                    ` ${stranded.length} uncommitted fix-pass change(s) committed separately.`
+                                    : ''), 'warning');
                             break;
                         }
                         if (choice.action === 'autofix' && canAutofix) {
@@ -1077,6 +1126,14 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                                 break;
                             }
                             await recGate(`final-gate: autofix attempt ${fixAttempts} failed — ${fix.reason.slice(0, 200)}`);
+                            // The attempt's edits survive a non-convergence (only a
+                            // guard trip discards). Find out what they are NOW, so
+                            // the next picker shows them and an ACCEPT can commit them.
+                            await refreshStranded();
+                            if (stranded.length > 0) {
+                                await recGate(`final-gate: autofix attempt ${fixAttempts} left ${stranded.length} `
+                                    + `uncommitted change(s) — ${stranded.slice(0, 8).join(', ')}`);
+                            }
                             active.ui.notify(`${id}: final-gate autofix did not converge — ${fix.reason.slice(0, 140)}`, 'warning');
                             // Work from the FRESH gate failure when the fix pass got
                             // as far as re-running the gate; otherwise keep the last.
@@ -1102,8 +1159,19 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                         await recGate(yoloFinal !== null ?
                             `final-gate: left failed — autofix budget spent, nobody to ask ${YOLO_STAMP}`
                             : 'final-gate: left failed (user)');
+                        // Leaving the run failed hands the working tree back to the
+                        // user, so uncommitted fix-pass edits are theirs to keep or
+                        // drop — but they must be VISIBLE, not discovered later by a
+                        // stray `git status` (mx5 run 13 item 3).
+                        if (stranded.length > 0) {
+                            await recGate(`final-gate: ${stranded.length} uncommitted fix-pass change(s) left in the `
+                                + `working tree — ${stranded.slice(0, 8).join(', ')}`);
+                        }
                         await updateTaskFrontMatter(cwd, id, { state: 'failed' });
-                        announceDone(active, `${id} finished all tasks but FAILED the final integration gate — ${fin.reason.slice(0, 200)} — fix and /task-auto-resume (the gate re-runs).`, 'error');
+                        announceDone(active, `${id} finished all tasks but FAILED the final integration gate — ${fin.reason.slice(0, 200)} — fix and /task-auto-resume (the gate re-runs).`
+                            + (stranded.length > 0 ?
+                                ` NOTE: ${stranded.length} uncommitted fix-pass change(s) are in your working tree (${stranded.slice(0, 4).join(', ')}).`
+                                : ''), 'error');
                         return;
                     }
                 }

package/dist/task/final-gate-fix.d.ts

@@ -58,6 +58,31 @@ export declare function parseFinalFixMarker(text: string): {
     blocked: boolean;
     note?: string;
 };
+/**
+ * STRANDED SUB-FIXES (mx5 run 13, PROMPT 4 item 3).
+ *
+ * A fix attempt that does not converge keeps its edits: they are NOT discarded
+ * (only a guard trip discards), and `deps.commit` runs only on `fix.ok`. So a
+ * partial fix that genuinely repaired something sits in the working tree, uncommitted,
+ * and if the user then ACCEPTs the FAIL the run completes around it — leaving HEAD
+ * broken while the repair is invisible unless someone runs `git status`.
+ *
+ * That is exactly what run 13 shipped: the fix child's bunfig.toml change made
+ * `bun run test` pass 116/116, attempt 1 did not converge overall, the user accepted
+ * the FAIL, and the tree still shows the file modified while HEAD's `bun run test` is
+ * broken. The repair and the breakage were BOTH real; only the repair was discarded
+ * by default.
+ *
+ * The rule: a partial fix is either committed (its own commit, named in the trail) or
+ * explicitly surfaced — never silently stranded.
+ */
+/** Commit subject for partial fixes committed alongside an accepted gate FAIL. */
+export declare const STRANDED_FIX_COMMIT: (runId: string) => string;
+/**
+ * The picker/trail line describing what a non-converging fix pass left behind.
+ * Empty string when the tree is clean — the caller then says nothing at all.
+ */
+export declare function strandedFixNote(paths: string[]): string;
 export interface FinalFixResult {
     /** true → the fix child ran AND the re-run gate passed. */
     ok: boolean;

package/dist/task/final-gate-fix.js

@@ -161,6 +161,39 @@ export function parseFinalFixMarker(text) {
     }
     return { blocked: false, note: last[2].trim() || undefined };
 }
+/**
+ * STRANDED SUB-FIXES (mx5 run 13, PROMPT 4 item 3).
+ *
+ * A fix attempt that does not converge keeps its edits: they are NOT discarded
+ * (only a guard trip discards), and `deps.commit` runs only on `fix.ok`. So a
+ * partial fix that genuinely repaired something sits in the working tree, uncommitted,
+ * and if the user then ACCEPTs the FAIL the run completes around it — leaving HEAD
+ * broken while the repair is invisible unless someone runs `git status`.
+ *
+ * That is exactly what run 13 shipped: the fix child's bunfig.toml change made
+ * `bun run test` pass 116/116, attempt 1 did not converge overall, the user accepted
+ * the FAIL, and the tree still shows the file modified while HEAD's `bun run test` is
+ * broken. The repair and the breakage were BOTH real; only the repair was discarded
+ * by default.
+ *
+ * The rule: a partial fix is either committed (its own commit, named in the trail) or
+ * explicitly surfaced — never silently stranded.
+ */
+/** Commit subject for partial fixes committed alongside an accepted gate FAIL. */
+export const STRANDED_FIX_COMMIT = (runId) => `FINAL GATE PARTIAL FIX (${runId}) — accepted with gate still failing`;
+/**
+ * The picker/trail line describing what a non-converging fix pass left behind.
+ * Empty string when the tree is clean — the caller then says nothing at all.
+ */
+export function strandedFixNote(paths) {
+    if (paths.length === 0)
+        return '';
+    const shown = paths.slice(0, 8).join(', ');
+    return (`\n\nUNCOMMITTED: the fix pass left ${paths.length} change(s) in the working tree `
+        + `(${shown}${paths.length > 8 ? ', …' : ''}). These are NOT in HEAD. Accepting will `
+        + `commit them as their own commit so they are not lost; leaving the run failed keeps `
+        + `them in your working tree.`);
+}
 /**
  * Run one bounded final-gate fix attempt: snapshot discovery → child → write-guard
  * stack (diff capture → frozen-path revert → deletion guard → shrink guard → probe

package/dist/task/foreign-path.d.ts

@@ -0,0 +1,96 @@
+import type { AddedLine } from './probe-gaming.js';
+/** One leaked absolute path found in a committed file. */
+export interface ForeignPathFinding {
+    /** Repo-relative file the leaked path was committed into. */
+    file: string;
+    /** The absolute path exactly as written in the file. */
+    absolute: string;
+    /** The repo-relative path its tail resolves to (the repair target). */
+    repoPath: string;
+    /** The leading segments that are foreign to this host (e.g. `/workspace`). */
+    foreignPrefix: string;
+    /** The verbatim line carrying the leak, trimmed. */
+    line: string;
+}
+/**
+ * Resolve a repo-relative path to the real thing it names, honouring the
+ * extensionless module specifiers config files use (`src/client/api` →
+ * `src/client/api.ts`). Returns the resolved repo-relative path, or null.
+ *
+ * This mirrors how the tools that CONSUME these paths (vite/tsconfig aliases,
+ * bundler resolvers) look them up — without it the mx5 true positive
+ * `/workspace/src/client/api` would be missed, since only `src/client/api.ts` exists.
+ */
+export declare function resolveRepoPath(rel: string, exists: (rel: string) => boolean): string | null;
+/**
+ * Scan a task's added lines for sandbox-leaked absolute paths.
+ *
+ * `existsOnHost` answers for an ABSOLUTE path; `existsInRepo` for a REPO-RELATIVE
+ * one. Both are injected so the detector is pure and unit-testable against a
+ * synthetic tree.
+ *
+ * The tail search strips the FEWEST leading segments that still resolve, so the
+ * finding names the smallest foreign prefix (`/workspace`, not `/workspace/src`)
+ * and the largest repo-relative target — the reading that matches how a mount
+ * actually shadows a tree.
+ */
+export declare function findForeignPaths(lines: AddedLine[], existsOnHost: (abs: string) => boolean, existsInRepo: (rel: string) => boolean): ForeignPathFinding[];
+/**
+ * The repair for one finding: the leaked absolute path rewritten relative to the
+ * FILE that carries it, in the `./`-prefixed form config resolvers expect. A target
+ * in a parent directory keeps its `../` form (already relative, no prefix needed).
+ */
+export declare function relativeRepairFor(finding: ForeignPathFinding): string;
+/**
+ * Apply every finding for ONE file to that file's text, as literal substitutions.
+ * Returns the new text and the substitutions made; `text` is returned untouched
+ * when nothing applied (the caller then writes nothing).
+ *
+ * Deliberately a plain string replacement of a path literal for a path literal: it
+ * cannot reflow, reformat, or restructure the file, so a rewrite that turns out to
+ * be semantically wrong is still trivially reviewable in the diff. A finding whose
+ * absolute string is no longer present (the file moved on) is skipped.
+ */
+export declare function applyForeignPathRepairs(text: string, findings: ForeignPathFinding[]): {
+    text: string;
+    applied: Array<{
+        from: string;
+        to: string;
+    }>;
+};
+/** IO seam for the repair pass; injected so the orchestration is unit-testable. */
+export interface ForeignPathRepairIO {
+    readFile: (rel: string) => Promise<string>;
+    writeFile: (rel: string, text: string) => Promise<void>;
+    /** Does this repo-relative path exist? Used to RE-VALIDATE each repair. */
+    existsInRepo: (rel: string) => boolean;
+}
+export interface ForeignPathRepairResult {
+    /** Human-readable repairs actually written, e.g. `cfg.ts: /workspace/src → ./src`. */
+    repaired: string[];
+    /** Findings left alone — these become the verify finding. */
+    remaining: ForeignPathFinding[];
+}
+/**
+ * Deterministically repair what can be repaired, and hand back the rest.
+ *
+ * Every repair is RE-VALIDATED before it is written: the file-relative form is
+ * resolved back to a repo path and must land on the same real file the finding
+ * named. A repair that does not re-resolve is dropped and its finding stays in
+ * `remaining`, where the verify block will raise it for a human or an AUTOFIX
+ * round. An unreadable or unwritable file does the same. Nothing here can turn a
+ * working path into a broken one — the only edit it makes is swapping a path that
+ * provably does not resolve for one that provably does.
+ */
+export declare function repairForeignPaths(findings: ForeignPathFinding[], io: ForeignPathRepairIO): Promise<ForeignPathRepairResult>;
+/**
+ * Verify-child prompt lines: one per leak, naming the file, the leaked path, and
+ * the real repo path it shadows. Empty findings → empty array (caller emits no
+ * block), matching every other probe's contract.
+ */
+export declare function foreignPathVerifyFindings(findings: ForeignPathFinding[]): string[];
+/**
+ * Render findings as a critique/enforce defect block — the same shape as
+ * skipEscapeDefectText: a numbered list the rewrite must resolve.
+ */
+export declare function foreignPathDefectText(findings: ForeignPathFinding[]): string;

package/dist/task/gate-deps.js

@@ -13,6 +13,7 @@
  * path-revisit disabled because re-running the same check IS the job), each with a
  * status widget and a per-gate debug log under .pi-tasks/.
  */
+import { existsSync } from 'node:fs';
 import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
 import { tasksDir, readTaskFile, appendGateRecord } from './task-io.js';
@@ -34,6 +35,9 @@ import { parseTreeChanges, parseNameStatusChanges, formatTreeChanges } from './w
 import { taskThatIntroduced, findCrossTaskDeletions } from './task-provenance.js';
 import { findTestRebuiltAssemblies, testAssemblyVerifyFindings } from './test-assembly.js';
 import { runBoundedLintFix } from './lint-fix.js';
+import { findForeignPaths, foreignPathVerifyFindings, repairForeignPaths } from './foreign-path.js';
+import { findScriptEscapesInManifest, scriptEscapeVerifyFindings } from './script-escape.js';
+import { assessRunnerGlobs, runnerGlobVerifyFindings } from './runner-globs.js';
 import { captureGitState, reconcileGitState } from './git-state-guard.js';
 import { runWorker } from '../workers/pi-worker-core.js';
 import { formatLoopHint } from './child-runner.js';
@@ -123,6 +127,121 @@ export async function collectAddedLines(cwd, signal) {
     }
     return lines;
 }
+/**
+ * Deterministic sandbox-path-leak pass (see foreign-path.ts, mx5 run 13 PROMPT 4
+ * item 1): find absolute paths the task committed that resolve nowhere on this
+ * machine while the real file sits in the repo, REPAIR the ones whose relative
+ * form provably resolves, and return verify findings for whatever is left.
+ *
+ * The repair runs here, before the verify child, for the same reason lint-fix
+ * does: the defect is mechanical and the correct target is already known, so
+ * spending an AUTOFIX round (or a human) on a path substitution is waste. What it
+ * cannot repair still reaches the child under rule 4e. Failures degrade to no
+ * findings — a sharpener, never a blocker.
+ */
+async function collectForeignPathFindings(cwd, signal, logDebug) {
+    const lines = await collectAddedLines(cwd, signal);
+    if (lines.length === 0)
+        return [];
+    const findings = findForeignPaths(lines, abs => existsSync(abs), rel => existsSync(path.join(cwd, rel)));
+    if (findings.length === 0)
+        return [];
+    const { repaired, remaining } = await repairForeignPaths(findings, {
+        readFile: rel => fsp.readFile(path.join(cwd, rel), 'utf8'),
+        writeFile: (rel, text) => fsp.writeFile(path.join(cwd, rel), text, 'utf8'),
+        existsInRepo: rel => existsSync(path.join(cwd, rel))
+    });
+    for (const r of repaired)
+        logDebug?.(`sandbox path leak repaired — ${r}`);
+    for (const f of remaining) {
+        logDebug?.(`sandbox path leak NOT repaired — ${f.file}: ${f.absolute}`);
+    }
+    return foreignPathVerifyFindings(remaining);
+}
+/** Manifests whose `scripts` the check-script scanner understands. */
+const MANIFEST_RE = /(^|\/)package\.json$/;
+/**
+ * Deterministic neutered-check-script pass (see script-escape.ts, mx5 run 13 PROMPT
+ * 4 item 4): check-class scripts that cannot report failure, in a manifest THIS
+ * task changed.
+ *
+ * Scoped to manifests the task touched, so the finding lands on the task that
+ * authored the script rather than being re-served to every later task. A script
+ * neutered by an earlier task is the whole-repo final gate's business, which
+ * re-checks the shipped manifest at run end regardless of who wrote it.
+ *
+ * Failures degrade to no findings — a sharpener, never a blocker.
+ */
+async function collectScriptEscapeFindings(cwd, signal) {
+    const changed = await collectChangedFiles(cwd, signal);
+    const manifests = changed.map(f => f.path).filter(p => MANIFEST_RE.test(p));
+    const findings = [];
+    for (const rel of manifests) {
+        try {
+            findings.push(...findScriptEscapesInManifest(await fsp.readFile(path.join(cwd, rel), 'utf8')));
+        }
+        catch {
+            // unreadable/absent manifest — nothing to report
+        }
+    }
+    return scriptEscapeVerifyFindings(findings);
+}
+/** Playwright config filenames, in the order playwright itself resolves them. */
+const PLAYWRIGHT_CONFIGS = [
+    'playwright.config.ts',
+    'playwright.config.js',
+    'playwright.config.mts',
+    'playwright-ct.config.ts',
+    'playwright-ct.config.js'
+];
+/** Read a repo file as text, or null when absent/unreadable. */
+async function readOrNull(cwd, rel) {
+    try {
+        return await fsp.readFile(path.join(cwd, rel), 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Deterministic test-runner glob-collision pass (see runner-globs.ts, mx5 runs 7 AND
+ * 13, PROMPT 4 item 2): the manifest declares both `bun test` and `playwright test`
+ * without a provably disjoint file set, so `bun test` imports the playwright specs
+ * and dies during collection.
+ *
+ * Whole-repo rather than diff-scoped, unlike the neutered-script probe: a collision
+ * is a property of the PAIR of declarations, and the task that completes the pair is
+ * rarely the one that will be blamed by a diff. It is cheap (two small file reads)
+ * and silent unless both runners are actually declared. Failures degrade to no
+ * findings — a sharpener, never a blocker.
+ */
+async function collectRunnerGlobFindings(cwd) {
+    const manifestText = await readOrNull(cwd, 'package.json');
+    if (manifestText === null)
+        return [];
+    let scripts;
+    try {
+        const parsed = JSON.parse(manifestText);
+        const raw = parsed?.scripts;
+        if (typeof raw !== 'object' || raw === null)
+            return [];
+        scripts = raw;
+    }
+    catch {
+        return [];
+    }
+    let playwrightConfig = null;
+    for (const name of PLAYWRIGHT_CONFIGS) {
+        playwrightConfig = await readOrNull(cwd, name);
+        if (playwrightConfig !== null)
+            break;
+    }
+    return runnerGlobVerifyFindings(assessRunnerGlobs({
+        scripts,
+        bunfig: await readOrNull(cwd, 'bunfig.toml'),
+        playwrightConfig
+    }));
+}
 /**
  * The working tree's current changes as a summary (write-guard shape): what a
  * write-capable gate child changed, given the tree was clean when it started.
@@ -497,6 +616,28 @@ export function buildGateDeps(params) {
                 // destroyed (typically to green a check). Injected under rule 4d and
                 // carried on a FAIL so an ACCEPT records durable debts.
                 crossTaskDeletionProbe: () => collectTaskTreeChanges(cwd2, signal).then(changes => findCrossTaskDeletions(changes, taskId, rel => taskThatIntroduced(cwd2, rel))),
+                // Deterministic sandbox-path-leak probe (mx5 run 13 PROMPT 4 item
+                // 1): absolute paths committed from the authoring child's own
+                // environment (`/workspace/src/shared`) that resolve nowhere here.
+                // Repaired deterministically where the relative form provably
+                // resolves; the remainder is injected under rule 4e, whose point is
+                // that such a path breaks the BUILD — so the checks that would have
+                // caught it report nothing rather than failing.
+                foreignPathProbe: () => collectForeignPathFindings(cwd2, signal, msg => void fsp
+                    .appendFile(path.join(tasksDir(cwd2), 'verify-debug.log'), `${new Date().toISOString()} ${msg}\n`)
+                    .catch(() => { })),
+                // Deterministic neutered-check-script probe (mx5 run 13 PROMPT 4
+                // item 4): a check script this task authored that cannot fail
+                // (`… || true`, an inverted-grep launder). Injected under rule 4f,
+                // because the child provably cannot find this by running the
+                // script — it passes, which IS the defect.
+                scriptEscapeProbe: () => collectScriptEscapeFindings(cwd2, signal),
+                // Deterministic runner glob-collision probe (mx5 runs 7 AND 13,
+                // PROMPT 4 item 2): both `bun test` and `playwright test` declared
+                // with no proof their file sets are disjoint. Injected under rule
+                // 4g — the collision kills the suite during COLLECTION, which does
+                // not look like a test failure.
+                runnerGlobProbe: () => collectRunnerGlobFindings(cwd2),
                 // Deterministic prohibition probe: paths the spec forbids modifying
                 // that the task's diff modified anyway become prompt-level findings
                 // under the no-waiver rule — the child otherwise rarely runs `git

package/dist/task/phases.js

@@ -27,6 +27,7 @@ import { parseGrillQuestions, parseAutoAnswer, autoAnswerHasTag, parseVerifyTool
 import { compressTitle } from './title-label.js';
 import { parseVerifyBlock, validateSpecShape, stripSpecPreamble, isCritiqueClean } from './spec-validation.js';
 import { findSkipEscapes, skipEscapeDefectText } from './skip-escape.js';
+import { findScriptEscapesInText, scriptEscapeDefectText } from './script-escape.js';
 import { findSynthesizedWiring, wiringProbeText, readReferencedDocs } from './wiring-claims.js';
 import { findAbsenceConflicts, absenceProbeText, siblingTitlesFromPlanContext } from './verify-reconcile.js';
 import { findFrozenPathConflicts, frozenConflictProbeText } from './frozen-conflict.js';
@@ -939,6 +940,17 @@ export async function phaseCritique(deps, spec, refined, qa, planContext, resear
     if (grepOnlyProbe) {
         deps.logDebug?.('grep-theater VERIFY flagged in spec: ' + grepOnly.map(f => f.target).join(' | '));
     }
+    // DETERMINISTIC neutered-check-script probe (mx5 run 13, PROMPT 4 item 4): a
+    // spec that DICTATES a check script which cannot fail — `"lint": "… || true"`,
+    // or a checker laundered through an inverted grep. Whatever task implements
+    // that spec writes the disarmed script into package.json, and from then on
+    // every gate that runs it (repo-health verify, the final integration gate)
+    // reads a constant. Cheapest to kill here, in the spec, before it is authored.
+    const scriptEscapes = findScriptEscapesInText(spec);
+    const scriptProbe = scriptEscapes.length > 0 ? scriptEscapeDefectText(scriptEscapes) : null;
+    if (scriptProbe) {
+        deps.logDebug?.('neutered check script dictated by spec: ' + scriptEscapes.map(f => f.name).join(' | '));
+    }
     let triageDefects = null;
     if (parseVerifyBlock(spec) !== null) {
         const tTriage = Date.now();
@@ -956,15 +968,17 @@ export async function phaseCritique(deps, spec, refined, qa, planContext, resear
         deps.recordSubStep?.('triage', Date.now() - tTriage);
         if (verdict !== null) {
             // A deterministic skip-escape, synthesized-wiring, plan-contradiction,
-            // unsatisfiable-pair, or grep-theater finding overrides a CLEAN triage: the draft must
-            // be rewritten to resolve it even if the model judged the rest clean
-            // (the model does not self-discover any of them reliably).
+            // unsatisfiable-pair, grep-theater, or neutered-check-script finding
+            // overrides a CLEAN triage: the draft must be rewritten to resolve it
+            // even if the model judged the rest clean (the model does not
+            // self-discover any of them reliably).
             if (isCritiqueClean(verdict)) {
                 if (skipDefects === null
                     && wiringProbe === null
                     && absenceProbe === null
                     && frozenProbe === null
-                    && grepOnlyProbe === null) {
+                    && grepOnlyProbe === null
+                    && scriptProbe === null) {
                     return spec;
                 }
             }
@@ -974,9 +988,17 @@ export async function phaseCritique(deps, spec, refined, qa, planContext, resear
         }
     }
     // Merge the deterministic skip-escape + synthesized-wiring + plan-contradiction
-    // + unsatisfiable-pair + grep-theater defects with any triage defects for the
-    // rewrite (all are forced FOCUS items).
-    const rewriteDefects = [skipDefects, wiringProbe, absenceProbe, frozenProbe, grepOnlyProbe, triageDefects]
+    // + unsatisfiable-pair + grep-theater + neutered-script defects with any triage
+    // defects for the rewrite (all are forced FOCUS items).
+    const rewriteDefects = [
+        skipDefects,
+        wiringProbe,
+        absenceProbe,
+        frozenProbe,
+        grepOnlyProbe,
+        scriptProbe,
+        triageDefects
+    ]
         .filter(Boolean)
         .join('\n\n') || null;
     const tRewrite = Date.now();

package/dist/task/runner-globs.d.ts

@@ -0,0 +1,74 @@
+/**
+ * runner-globs — deterministic detection of TWO TEST RUNNERS FIGHTING OVER THE SAME
+ * FILES, checked as soon as a project declares both rather than discovered at run end.
+ *
+ * The failure this closes — SECOND occurrence, runs 7 AND 13: a project declares both
+ * `bun test` and `playwright test`. Bun's runner scans the whole project for
+ * `*.test.*` / `*.spec.*`; Playwright's component/e2e specs ARE `*.spec.tsx`. So
+ * `bun test` imports Playwright spec files, which import `@playwright/test` outside a
+ * Playwright runner, and the whole suite dies on a module it was never meant to load.
+ *
+ * Run 7 found it in the final gate. Run 13 found it in the final gate AGAIN — and the
+ * fix (a `pathIgnorePatterns` line in bunfig.toml) was still sitting UNCOMMITTED in
+ * the working tree when the run ended, so HEAD shipped with `bun run test` broken. A
+ * defect that recurs across runs and survives its own fix is not a discovery problem;
+ * it is a missing invariant. This module states the invariant so it can be checked the
+ * moment both runners are declared:
+ *
+ *     if two runners are declared, their file sets must be provably DISJOINT
+ *
+ * Disjointness has exactly two mechanical forms, and this module accepts either:
+ *   - EXCLUSION: the scanning runner is configured to ignore the other's files
+ *     (bunfig `[test] pathIgnorePatterns`), or
+ *   - NAMING: the other runner's files are named so the scanner never claims them
+ *     (Playwright `testMatch` on a suffix outside `*.test.*` / `*.spec.*`, e.g. `.e2e.ts`).
+ *
+ * Guard direction: UNKNOWN steps aside. A missing/unparseable manifest, one runner
+ * only, or a Playwright config whose testMatch cannot be read all return `unknown` —
+ * the check may cost time, never work.
+ */
+export type GlobCollisionStatus = 'collision' | 'disjoint' | 'unknown';
+export interface GlobCollisionAssessment {
+    status: GlobCollisionStatus;
+    /** Human- and prompt-readable explanation; '' when there is nothing to say. */
+    detail: string;
+    /** The script names that invoke each runner (for naming the finding). */
+    scanningScripts: string[];
+    otherScripts: string[];
+}
+export interface RunnerGlobInputs {
+    /** The manifest's `scripts` map. */
+    scripts: Record<string, string>;
+    /** bunfig.toml text, or null when absent. */
+    bunfig: string | null;
+    /** playwright config text (any of the playwright*.config.* files), or null. */
+    playwrightConfig: string | null;
+}
+/**
+ * Bun's declared ignore patterns (`[test] pathIgnorePatterns = [...]`). Returns null
+ * when bunfig is absent or the key is not present — absent is not "empty", it is
+ * unknown-shaped, and the caller distinguishes them.
+ */
+export declare function parsePathIgnorePatterns(bunfig: string | null): string[] | null;
+/**
+ * Playwright's `testMatch`, when the config states one. Null → the default, which
+ * matches `*.spec.*` and `*.test.*` — precisely Bun's claimed set.
+ */
+export declare function parseTestMatch(playwrightConfig: string | null): string[] | null;
+/** Playwright's `testDir`, when stated (used to explain the collision concretely). */
+export declare function parseTestDir(playwrightConfig: string | null): string | null;
+/**
+ * Assess whether the declared runners can collide. See the module doc for the
+ * invariant and the two accepted forms of disjointness.
+ */
+export declare function assessRunnerGlobs(input: RunnerGlobInputs): GlobCollisionAssessment;
+/**
+ * Verify-child prompt lines for a collision. Empty for any non-collision status —
+ * the caller emits no block.
+ */
+export declare function runnerGlobVerifyFindings(a: GlobCollisionAssessment): string[];
+/**
+ * A plan-time contract line: the invariant, recorded so slices that add a runner
+ * inherit it instead of rediscovering the collision. Empty when not applicable.
+ */
+export declare function runnerGlobContractLine(a: GlobCollisionAssessment): string;

package/dist/task/runner-globs.js

@@ -0,0 +1,155 @@
+/**
+ * runner-globs — deterministic detection of TWO TEST RUNNERS FIGHTING OVER THE SAME
+ * FILES, checked as soon as a project declares both rather than discovered at run end.
+ *
+ * The failure this closes — SECOND occurrence, runs 7 AND 13: a project declares both
+ * `bun test` and `playwright test`. Bun's runner scans the whole project for
+ * `*.test.*` / `*.spec.*`; Playwright's component/e2e specs ARE `*.spec.tsx`. So
+ * `bun test` imports Playwright spec files, which import `@playwright/test` outside a
+ * Playwright runner, and the whole suite dies on a module it was never meant to load.
+ *
+ * Run 7 found it in the final gate. Run 13 found it in the final gate AGAIN — and the
+ * fix (a `pathIgnorePatterns` line in bunfig.toml) was still sitting UNCOMMITTED in
+ * the working tree when the run ended, so HEAD shipped with `bun run test` broken. A
+ * defect that recurs across runs and survives its own fix is not a discovery problem;
+ * it is a missing invariant. This module states the invariant so it can be checked the
+ * moment both runners are declared:
+ *
+ *     if two runners are declared, their file sets must be provably DISJOINT
+ *
+ * Disjointness has exactly two mechanical forms, and this module accepts either:
+ *   - EXCLUSION: the scanning runner is configured to ignore the other's files
+ *     (bunfig `[test] pathIgnorePatterns`), or
+ *   - NAMING: the other runner's files are named so the scanner never claims them
+ *     (Playwright `testMatch` on a suffix outside `*.test.*` / `*.spec.*`, e.g. `.e2e.ts`).
+ *
+ * Guard direction: UNKNOWN steps aside. A missing/unparseable manifest, one runner
+ * only, or a Playwright config whose testMatch cannot be read all return `unknown` —
+ * the check may cost time, never work.
+ */
+/** `bun test` — the scanning runner: it claims every `*.test.*` / `*.spec.*` it finds. */
+const BUN_TEST_RE = /\bbun\s+(?:--\S+\s+)*test\b/;
+/** `playwright test` (incl. `bunx`/`npx`/`pnpm exec` prefixes). */
+const PLAYWRIGHT_RE = /\bplaywright\s+test\b/;
+/** The suffixes Bun's test runner claims by default. */
+const BUN_CLAIMED_SUFFIX_RE = /\.(?:test|spec)\./;
+/** Scripts that invoke a given runner, by name. */
+function scriptsMatching(scripts, re) {
+    return Object.entries(scripts)
+        .filter(([, body]) => typeof body === 'string' && re.test(body))
+        .map(([name]) => name);
+}
+/**
+ * Bun's declared ignore patterns (`[test] pathIgnorePatterns = [...]`). Returns null
+ * when bunfig is absent or the key is not present — absent is not "empty", it is
+ * unknown-shaped, and the caller distinguishes them.
+ */
+export function parsePathIgnorePatterns(bunfig) {
+    if (bunfig === null)
+        return null;
+    const m = /^[ \t]*pathIgnorePatterns[ \t]*=[ \t]*\[([\s\S]*?)\]/m.exec(bunfig);
+    if (!m)
+        return null;
+    return [...m[1].matchAll(/["']([^"']+)["']/g)].map(x => x[1]);
+}
+/**
+ * Playwright's `testMatch`, when the config states one. Null → the default, which
+ * matches `*.spec.*` and `*.test.*` — precisely Bun's claimed set.
+ */
+export function parseTestMatch(playwrightConfig) {
+    if (playwrightConfig === null)
+        return null;
+    const m = /\btestMatch\s*:\s*(\[[\s\S]*?\]|['"][^'"]+['"]|\/[^/\n]+\/[gimsuy]*)/.exec(playwrightConfig);
+    if (!m)
+        return null;
+    const found = [...m[1].matchAll(/["']([^"']+)["']/g)].map(x => x[1]);
+    return found.length > 0 ? found : [m[1]];
+}
+/** Playwright's `testDir`, when stated (used to explain the collision concretely). */
+export function parseTestDir(playwrightConfig) {
+    if (playwrightConfig === null)
+        return null;
+    const m = /\btestDir\s*:\s*['"]([^'"]+)['"]/.exec(playwrightConfig);
+    return m ? m[1].replace(/^\.\//, '').replace(/\/+$/, '') : null;
+}
+/**
+ * Does an ignore pattern plausibly cover Playwright's spec files? Deliberately
+ * generous — this decides whether to STAY SILENT, and a guard that may only cost
+ * time should resolve ambiguity toward silence. A pattern naming a `spec`/`test`
+ * suffix, or the Playwright testDir, counts.
+ */
+function ignoreCoversSpecs(patterns, testDir) {
+    return patterns.some(p => {
+        if (BUN_CLAIMED_SUFFIX_RE.test(p) || /\bspec\b|\btest\b/.test(p))
+            return true;
+        return testDir !== null && testDir.length > 0 && p.includes(testDir);
+    });
+}
+/**
+ * Assess whether the declared runners can collide. See the module doc for the
+ * invariant and the two accepted forms of disjointness.
+ */
+export function assessRunnerGlobs(input) {
+    const scripts = input.scripts ?? {};
+    const scanningScripts = scriptsMatching(scripts, BUN_TEST_RE);
+    const otherScripts = scriptsMatching(scripts, PLAYWRIGHT_RE);
+    const base = { scanningScripts, otherScripts };
+    // Only one runner (or none) — nothing to collide.
+    if (scanningScripts.length === 0 || otherScripts.length === 0) {
+        return { status: 'unknown', detail: '', ...base };
+    }
+    // NAMING form: Playwright's own testMatch keeps its files outside Bun's claim.
+    const testMatch = parseTestMatch(input.playwrightConfig);
+    if (testMatch !== null && !testMatch.some(p => BUN_CLAIMED_SUFFIX_RE.test(p))) {
+        return {
+            status: 'disjoint',
+            detail: `playwright testMatch (${testMatch.join(', ')}) names files outside bun test's `
+                + `\`*.test.*\` / \`*.spec.*\` claim — the two runners cannot pick up each other's files`,
+            ...base
+        };
+    }
+    // EXCLUSION form: bun is told to ignore them.
+    const ignore = parsePathIgnorePatterns(input.bunfig);
+    const testDir = parseTestDir(input.playwrightConfig);
+    if (ignore !== null && ignoreCoversSpecs(ignore, testDir)) {
+        return {
+            status: 'disjoint',
+            detail: `bunfig [test] pathIgnorePatterns (${ignore.join(', ')}) excludes the playwright `
+                + `spec files from bun test's scan`,
+            ...base
+        };
+    }
+    // Both declared, neither form of disjointness present.
+    return {
+        status: 'collision',
+        detail: `\`${scanningScripts.join('`, `')}\` runs bun test, which scans the whole project for `
+            + '`*.test.*` / `*.spec.*`, and `'
+            + otherScripts.join('`, `')
+            + '` runs playwright, whose specs use those same suffixes'
+            + (testDir ? ` (testDir: ${testDir})` : '')
+            + '. bun test will import the playwright specs and die on `@playwright/test` outside '
+            + 'its runner. Declare disjoint file sets: add a bunfig.toml `[test] '
+            + 'pathIgnorePatterns` entry excluding the playwright specs, or give them a suffix '
+            + 'bun does not claim (e.g. `*.e2e.ts` via playwright `testMatch`)',
+        ...base
+    };
+}
+/**
+ * Verify-child prompt lines for a collision. Empty for any non-collision status —
+ * the caller emits no block.
+ */
+export function runnerGlobVerifyFindings(a) {
+    return a.status === 'collision' ? [a.detail] : [];
+}
+/**
+ * A plan-time contract line: the invariant, recorded so slices that add a runner
+ * inherit it instead of rediscovering the collision. Empty when not applicable.
+ */
+export function runnerGlobContractLine(a) {
+    if (a.scanningScripts.length === 0 || a.otherScripts.length === 0)
+        return '';
+    return (`Test-runner file sets MUST be disjoint: \`${a.scanningScripts.join('`, `')}\` (bun test, `
+        + `scans \`*.test.*\`/\`*.spec.*\` project-wide) and \`${a.otherScripts.join('`, `')}\` `
+        + `(playwright) must not claim the same files — enforce via bunfig \`[test] `
+        + `pathIgnorePatterns\` or a playwright \`testMatch\` suffix bun does not scan.`);
+}

package/dist/task/script-escape.d.ts

@@ -0,0 +1,83 @@
+/**
+ * script-escape — deterministic detection of CHECK SCRIPTS THAT CANNOT FAIL.
+ *
+ * The failure this closes (mx5 run 13, PROMPT 4 item 4): the shipped package.json
+ * declared, verbatim,
+ *     "lint": "prettier … && eslint --fix … && (tsc --noEmit 2>&1 | grep -qv 'TS18003' || true)"
+ * The typecheck is neutered twice over — its output is piped into an INVERTED grep
+ * (so the status becomes "some line did not match", never tsc's verdict), and the
+ * whole group is closed with `|| true` (so the script exits 0 unconditionally). Every
+ * consumer of that script — the repo-health verify gate, the final integration gate,
+ * a human reading a green CI line — is reading a constant, not a measurement.
+ *
+ * It was harmless in run 13 only by luck: tsc happened to be clean (validated). The
+ * class is not harmless — this is the same defect as run-8's F2 skip-escape, moved
+ * one level out. findSkipEscapes (skip-escape.ts) scans a spec's own VERIFY block;
+ * nothing scanned the SCRIPT DEFINITIONS those VERIFY blocks then invoke by name, so
+ * `bun run lint` could be authored into a no-op and every gate would salute it.
+ *
+ * TWO SHAPES, both crisp, both scoped to CHECK-CLASS script names:
+ *
+ *   A. ALWAYS-ZERO TAIL — the script's last command cannot fail (`… || true`,
+ *      `… || :`, `… || exit 0`, `…; exit 0`, a trailing `|| echo` fallback). A
+ *      shell script's status is its last command's status, so this is a proof, not
+ *      a heuristic: the script exits 0 no matter what the checker found.
+ *
+ *   B. INVERTED-GREP LAUNDERING — a checker piped into `grep -qv` / `grep -vq`.
+ *      "Some line of the output does NOT match X" is never a checker's verdict; it
+ *      is true of virtually any non-empty output, including a wall of errors.
+ *
+ * Deliberately NOT flagged, because each is legitimate and FP-measured against the
+ * real corpus (pi-task, aiz-server, aiz-client, gofer, mx5):
+ *   - `|| exit 1` — a HARDENING, the opposite of an escape (aiz-server).
+ *   - any `||`/pipe in a NON-check script (`clean`, `dev`, `start`, `copy-fonts`) —
+ *     a teardown `rm -rf dist || true` is correct and common.
+ *   - pipes into formatters/reporters (`| tap-spec`, `| tee`) — those propagate
+ *     status or are presentational; only inverted grep is unambiguous.
+ *   - a plain `| grep -q "expected"` — that is a real assertion on output.
+ */
+/** One neutered check script. */
+export interface ScriptEscapeFinding {
+    /** The script's name as declared (e.g. `lint`). */
+    name: string;
+    /** The script's body, verbatim. */
+    body: string;
+    /** Why it cannot fail (human- and prompt-readable). */
+    reason: string;
+}
+/**
+ * Judge one script definition. Returns null when the script is not check-class, or
+ * is check-class but can genuinely fail.
+ */
+export declare function judgeScript(name: string, body: string): ScriptEscapeFinding | null;
+/**
+ * Scan a parsed `scripts` map (package.json shape) for neutered check scripts.
+ * A non-object, or a map with no check-class scripts, yields no findings.
+ */
+export declare function findScriptEscapes(scripts: unknown): ScriptEscapeFinding[];
+/**
+ * Scan a package.json's TEXT. Invalid JSON yields no findings — a manifest that does
+ * not parse is a different problem, and guessing at its contents is how a scanner
+ * earns false positives.
+ */
+export declare function findScriptEscapesInManifest(manifestText: string): ScriptEscapeFinding[];
+/**
+ * Scan ARBITRARY text (a spec, a design doc) for script definitions written as JSON
+ * pairs — the form a spec uses when it dictates a script for the implementer to add
+ * (`"lint": "tsc --noEmit || true"`). This is what lets the critique catch the
+ * neutered script at SPEC time, before any task writes it into a manifest.
+ *
+ * Deliberately narrow: only `"name": "body"` pairs on one line, only check-class
+ * names. Prose describing a script in words extracts nothing.
+ */
+export declare function findScriptEscapesInText(text: string): ScriptEscapeFinding[];
+/**
+ * Verify-child prompt lines (probe+rule pattern): one per neutered script, naming
+ * the script, its body, and why it cannot fail.
+ */
+export declare function scriptEscapeVerifyFindings(findings: ScriptEscapeFinding[]): string[];
+/**
+ * Render findings as a critique/rewrite defect block — same shape as
+ * skipEscapeDefectText: a numbered list the rewrite must resolve.
+ */
+export declare function scriptEscapeDefectText(findings: ScriptEscapeFinding[]): string;

package/dist/task/script-escape.js

@@ -0,0 +1,189 @@
+/**
+ * script-escape — deterministic detection of CHECK SCRIPTS THAT CANNOT FAIL.
+ *
+ * The failure this closes (mx5 run 13, PROMPT 4 item 4): the shipped package.json
+ * declared, verbatim,
+ *     "lint": "prettier … && eslint --fix … && (tsc --noEmit 2>&1 | grep -qv 'TS18003' || true)"
+ * The typecheck is neutered twice over — its output is piped into an INVERTED grep
+ * (so the status becomes "some line did not match", never tsc's verdict), and the
+ * whole group is closed with `|| true` (so the script exits 0 unconditionally). Every
+ * consumer of that script — the repo-health verify gate, the final integration gate,
+ * a human reading a green CI line — is reading a constant, not a measurement.
+ *
+ * It was harmless in run 13 only by luck: tsc happened to be clean (validated). The
+ * class is not harmless — this is the same defect as run-8's F2 skip-escape, moved
+ * one level out. findSkipEscapes (skip-escape.ts) scans a spec's own VERIFY block;
+ * nothing scanned the SCRIPT DEFINITIONS those VERIFY blocks then invoke by name, so
+ * `bun run lint` could be authored into a no-op and every gate would salute it.
+ *
+ * TWO SHAPES, both crisp, both scoped to CHECK-CLASS script names:
+ *
+ *   A. ALWAYS-ZERO TAIL — the script's last command cannot fail (`… || true`,
+ *      `… || :`, `… || exit 0`, `…; exit 0`, a trailing `|| echo` fallback). A
+ *      shell script's status is its last command's status, so this is a proof, not
+ *      a heuristic: the script exits 0 no matter what the checker found.
+ *
+ *   B. INVERTED-GREP LAUNDERING — a checker piped into `grep -qv` / `grep -vq`.
+ *      "Some line of the output does NOT match X" is never a checker's verdict; it
+ *      is true of virtually any non-empty output, including a wall of errors.
+ *
+ * Deliberately NOT flagged, because each is legitimate and FP-measured against the
+ * real corpus (pi-task, aiz-server, aiz-client, gofer, mx5):
+ *   - `|| exit 1` — a HARDENING, the opposite of an escape (aiz-server).
+ *   - any `||`/pipe in a NON-check script (`clean`, `dev`, `start`, `copy-fonts`) —
+ *     a teardown `rm -rf dist || true` is correct and common.
+ *   - pipes into formatters/reporters (`| tap-spec`, `| tee`) — those propagate
+ *     status or are presentational; only inverted grep is unambiguous.
+ *   - a plain `| grep -q "expected"` — that is a real assertion on output.
+ */
+/**
+ * Script names whose whole purpose is to FAIL when something is wrong. A neutered
+ * `clean` or `dev` is nobody's business; a neutered `lint` silently disarms every
+ * gate that runs it. Suffixed variants (`test:ct`, `lint:fix`, `check-types`) match.
+ */
+const CHECK_SCRIPT_RE = /^(?:lint|test|check|verify|validate|typecheck|types?|tsc|ci|audit|coverage|e2e|build|compile|fmt:check|format:check)(?:[:_-].*)?$/i;
+/** `|| exit 1` and friends HARDEN a script — never mistake one for an escape. */
+const HARDENING_TAIL_RE = /\|\|\s*exit\s+[1-9]\d*\s*$/;
+/** Tails that make the script's exit status unconditionally 0. */
+const ALWAYS_ZERO_TAILS = [
+    { re: /\|\|\s*true\s*$/, what: '`|| true`' },
+    { re: /\|\|\s*:\s*$/, what: '`|| :`' },
+    { re: /\|\|\s*exit\s+0\s*$/, what: '`|| exit 0`' },
+    { re: /;\s*true\s*$/, what: '`; true`' },
+    { re: /;\s*exit\s+0\s*$/, what: '`; exit 0`' },
+    { re: /\|\|\s*echo\b[^|&;]*$/, what: 'a trailing `|| echo …` fallback' }
+];
+/** A checker piped into an INVERTED grep: status becomes "something didn't match". */
+const INVERTED_GREP_RE = /\|\s*grep\s+(?:-\w*v\w*|-\w+\s+-\w*v\w*)/;
+/**
+ * Strip trailing subshell/group closers and separators so the tail patterns see the
+ * real last command. mx5's script ends `… || true)` — without this the `)` hides it.
+ */
+function tailOf(body) {
+    let s = body.trim();
+    while (true) {
+        const next = s.replace(/[)\s;]+$/, '').trimEnd();
+        if (next === s)
+            return s;
+        s = next;
+    }
+}
+/**
+ * Judge one script definition. Returns null when the script is not check-class, or
+ * is check-class but can genuinely fail.
+ */
+export function judgeScript(name, body) {
+    if (!CHECK_SCRIPT_RE.test(name))
+        return null;
+    if (typeof body !== 'string' || body.trim().length === 0)
+        return null;
+    const reasons = [];
+    const tail = tailOf(body);
+    if (!HARDENING_TAIL_RE.test(tail)) {
+        for (const { re, what } of ALWAYS_ZERO_TAILS) {
+            if (re.test(tail)) {
+                reasons.push(`it ends in ${what}, so the script exits 0 whatever the check reports`);
+                break;
+            }
+        }
+    }
+    if (INVERTED_GREP_RE.test(body)) {
+        reasons.push('it pipes a check into an INVERTED grep (`grep -v`), so the exit status becomes '
+            + '"some output line did not match" — true of almost any output, including errors');
+    }
+    if (reasons.length === 0)
+        return null;
+    return {
+        name,
+        body: body.trim(),
+        reason: reasons.join('; ')
+    };
+}
+/**
+ * Scan a parsed `scripts` map (package.json shape) for neutered check scripts.
+ * A non-object, or a map with no check-class scripts, yields no findings.
+ */
+export function findScriptEscapes(scripts) {
+    if (typeof scripts !== 'object' || scripts === null || Array.isArray(scripts))
+        return [];
+    const out = [];
+    for (const [name, body] of Object.entries(scripts)) {
+        const f = judgeScript(name, typeof body === 'string' ? body : '');
+        if (f)
+            out.push(f);
+    }
+    return out;
+}
+/**
+ * Scan a package.json's TEXT. Invalid JSON yields no findings — a manifest that does
+ * not parse is a different problem, and guessing at its contents is how a scanner
+ * earns false positives.
+ */
+export function findScriptEscapesInManifest(manifestText) {
+    try {
+        const parsed = JSON.parse(manifestText);
+        if (typeof parsed !== 'object' || parsed === null)
+            return [];
+        return findScriptEscapes(parsed.scripts);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Scan ARBITRARY text (a spec, a design doc) for script definitions written as JSON
+ * pairs — the form a spec uses when it dictates a script for the implementer to add
+ * (`"lint": "tsc --noEmit || true"`). This is what lets the critique catch the
+ * neutered script at SPEC time, before any task writes it into a manifest.
+ *
+ * Deliberately narrow: only `"name": "body"` pairs on one line, only check-class
+ * names. Prose describing a script in words extracts nothing.
+ */
+export function findScriptEscapesInText(text) {
+    const out = [];
+    const seen = new Set();
+    for (const m of text.matchAll(/"([A-Za-z0-9:_-]{1,40})"\s*:\s*"((?:[^"\\]|\\.)*)"/g)) {
+        const name = m[1];
+        // Unescape the JSON string body so shell operators read normally.
+        let body;
+        try {
+            body = JSON.parse(`"${m[2]}"`);
+        }
+        catch {
+            continue;
+        }
+        const key = `${name}=${body}`;
+        if (seen.has(key))
+            continue;
+        const f = judgeScript(name, body);
+        if (!f)
+            continue;
+        seen.add(key);
+        out.push(f);
+    }
+    return out;
+}
+/**
+ * Verify-child prompt lines (probe+rule pattern): one per neutered script, naming
+ * the script, its body, and why it cannot fail.
+ */
+export function scriptEscapeVerifyFindings(findings) {
+    return findings.map(f => `\`${f.name}\`: ${f.body} — ${f.reason}`);
+}
+/**
+ * Render findings as a critique/rewrite defect block — same shape as
+ * skipEscapeDefectText: a numbered list the rewrite must resolve.
+ */
+export function scriptEscapeDefectText(findings) {
+    return [
+        'NEUTERED CHECK SCRIPT — this spec defines a check script that CANNOT FAIL, so every',
+        'gate that runs it reads a constant instead of a measurement (mx5 run 13 shipped',
+        '`"lint": "… && (tsc --noEmit 2>&1 | grep -qv \'TS18003\' || true)"` — the typecheck',
+        'was fully disarmed, and it went unnoticed only because tsc happened to be clean).',
+        "Rewrite each so it PROPAGATES the checker's exit status: drop the `|| true` /",
+        '`; exit 0` tail, and never launder a checker through an inverted grep. If a',
+        'specific diagnostic must genuinely be tolerated, suppress THAT diagnostic in the',
+        "checker's own config — never blanket-zero the whole script's exit code:",
+        ...findings.map((f, i) => `  ${i + 1}. "${f.name}": "${f.body}" — ${f.reason}`)
+    ].join('\n');
+}

package/dist/task/verify-work.d.ts

@@ -68,7 +68,20 @@ export declare function extractSpecForVerification(taskBody: string): string | n
  * Guard: honest-clean fixture (prohibition in spec, probe silent) 5/5 PASS — no
  * paranoia. Reverted-violation ≡ clean at the diff level (no entry → no finding).
  */
-export declare function buildVerifyPrompt(spec: string, probeFindings?: string[], envNotes?: string, prohibitionFindings?: string[], skipEscapeFindings?: string[], contracts?: string, testAssemblyFindings?: string[], probeGamingFindings?: string[], crossTaskDeletionFindings?: string[]): string;
+export declare function buildVerifyPrompt(spec: string, probeFindings?: string[], envNotes?: string, prohibitionFindings?: string[], skipEscapeFindings?: string[], contracts?: string, testAssemblyFindings?: string[], probeGamingFindings?: string[], crossTaskDeletionFindings?: string[], 
+/**
+ * The mx5 run-13 (PROMPT 4) probes, grouped rather than appended as three more
+ * positional parameters — this signature was already at its limit. Each key is
+ * an independent finding list; absent/empty emits no block.
+ */
+projectSurface?: {
+    /** Sandbox-leaked absolute paths (rule 4e) — see foreign-path.ts. */
+    foreignPaths?: string[];
+    /** Check scripts that cannot fail (rule 4f) — see script-escape.ts. */
+    scriptEscapes?: string[];
+    /** Colliding test-runner globs (rule 4g) — see runner-globs.ts. */
+    runnerGlobs?: string[];
+}): string;
 /**
  * Parse the child's verdict. Scans for the LAST `WORK-VERIFIED: PASS|FAIL|UNOBSERVED`
  * marker (the model discusses before concluding, and bash output may echo the word
@@ -146,6 +159,31 @@ export interface VerificationDeps {
      * 0/5), and carried structurally on a FAIL outcome so an ACCEPT records each as
      * a durable debt. ABSENT or empty → no block. */
     crossTaskDeletionProbe?: () => Promise<CrossTaskDeletion[]>;
+    /**
+     * DETERMINISTIC sandbox-path-leak probe (see foreign-path.ts, mx5 run 13
+     * PROMPT 4 item 1): absolute paths this task committed that exist only inside
+     * the authoring child's own environment — `/workspace/src/shared` in a vite
+     * alias — while the real file sits at `src/shared` here. The probe REPAIRS
+     * what it can deterministically first; only leaks it could not repair reach
+     * this hook, injected under rule 4e (MANDATORY + verdict-gating, the same
+     * shape as 4d — a leak makes the affected command fail to BUILD, so the
+     * checks that would notice never run at all). ABSENT or empty → no block. */
+    foreignPathProbe?: () => Promise<string[]>;
+    /**
+     * DETERMINISTIC neutered-check-script probe (see script-escape.ts, mx5 run 13
+     * PROMPT 4 item 4): check-class scripts in a manifest THIS task changed whose
+     * exit status cannot be non-zero (`… || true`, an inverted-grep launder). The
+     * damage is second-order — the script still "passes", so the gates that run it
+     * report success without measuring anything — which is exactly why the child
+     * cannot discover it by running the check. ABSENT or empty → no block. */
+    scriptEscapeProbe?: () => Promise<string[]>;
+    /**
+     * DETERMINISTIC test-runner glob-collision probe (see runner-globs.ts, mx5 runs
+     * 7 AND 13, PROMPT 4 item 2): the manifest declares two runners whose file sets
+     * are not provably disjoint, so the scanning one imports the other's specs and
+     * dies during COLLECTION. Injected under rule 4g. UNKNOWN (one runner, or
+     * disjointness proven) yields nothing. ABSENT or empty → no block. */
+    runnerGlobProbe?: () => Promise<string[]>;
     /**
      * Result of the git-state guard for the MOST RECENT runChild call (see
      * git-state-guard.ts): did the child mutate repo state (stash/checkout/file

package/dist/task/verify-work.js

@@ -140,7 +140,14 @@ export function extractSpecForVerification(taskBody) {
  * Guard: honest-clean fixture (prohibition in spec, probe silent) 5/5 PASS — no
  * paranoia. Reverted-violation ≡ clean at the diff level (no entry → no finding).
  */
-export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFindings, skipEscapeFindings, contracts, testAssemblyFindings, probeGamingFindings, crossTaskDeletionFindings) {
+export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFindings, skipEscapeFindings, contracts, testAssemblyFindings, probeGamingFindings, crossTaskDeletionFindings, 
+/**
+ * The mx5 run-13 (PROMPT 4) probes, grouped rather than appended as three more
+ * positional parameters — this signature was already at its limit. Each key is
+ * an independent finding list; absent/empty emits no block.
+ */
+projectSurface = {}) {
+    const { foreignPaths: foreignPathFindings, scriptEscapes: scriptEscapeFindings, runnerGlobs: runnerGlobFindings } = projectSurface;
     const probeBlock = probeFindings && probeFindings.length > 0 ?
         [
             'SELF-VERIFICATION NOTICE (deterministic, computed by the orchestrator from the diff):',
@@ -216,6 +223,57 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFind
             ''
         ]
         : [];
+    const foreignPathBlock = foreignPathFindings && foreignPathFindings.length > 0 ?
+        [
+            'SANDBOX PATH LEAK NOTICE (deterministic, computed by the orchestrator by',
+            "resolving every absolute path in the task's diff against THIS machine): this",
+            'task committed absolute paths that do not exist here, while the real file they',
+            'name sits inside this repo:',
+            ...foreignPathFindings.map(f => `- ${f}`),
+            "These are paths from the authoring agent's OWN environment, baked into a file",
+            'that ships. The command that reads such a path does not fail a check — it fails',
+            'to BUILD, so the checks that would have caught it never run and report nothing',
+            '(mx5 run 13: a leaked `/workspace` vite alias made `test:ct` collect 63 tests',
+            'and run 0, and the suite stayed dead for the rest of the run). A green or',
+            'EMPTY result from any command that reads these files is therefore NOT evidence.',
+            'Run the affected command yourself and confirm it actually EXECUTES work — count',
+            'the tests/steps that ran, not the exit code. Unless the leaked path resolves on',
+            'this machine, the verdict is FAIL naming the file and the path (rule 4e).',
+            ''
+        ]
+        : [];
+    const scriptEscapeBlock = scriptEscapeFindings && scriptEscapeFindings.length > 0 ?
+        [
+            'NEUTERED CHECK SCRIPT NOTICE (deterministic, computed by the orchestrator from',
+            'the manifest THIS task changed): these check scripts cannot report failure —',
+            'their exit status is 0 no matter what the checker finds:',
+            ...scriptEscapeFindings.map(f => `- ${f}`),
+            'You CANNOT discover this by running the script: it passes, which is the whole',
+            'defect (mx5 run 13 shipped a `lint` whose typecheck was disarmed by an inverted',
+            'grep and a `|| true` tail; every gate that ran it reported success without',
+            'measuring anything). A green result from one of these scripts is NOT evidence',
+            'for any acceptance criterion. To judge the area it claims to cover, run the',
+            'underlying checker DIRECTLY and unmodified (e.g. `tsc --noEmit` rather than',
+            '`npm run lint`) and judge THAT output. Unless the task spec explicitly requires',
+            'the script to tolerate failure, the verdict is FAIL naming the script (rule 4f).',
+            ''
+        ]
+        : [];
+    const runnerGlobBlock = runnerGlobFindings && runnerGlobFindings.length > 0 ?
+        [
+            'TEST-RUNNER GLOB COLLISION NOTICE (deterministic, computed by the orchestrator',
+            "from the manifest's declared runners and their config): two test runners claim",
+            'the same files:',
+            ...runnerGlobFindings.map(f => `- ${f}`),
+            "The scanning runner will import the other's spec files and abort on a module",
+            'loaded outside its own runner — so the suite dies WHOLESALE rather than',
+            'reporting failures (this is the THIRD occurrence: mx5 runs 7 and 13). Run both',
+            'test commands yourself and confirm each collects and runs its own files and only',
+            'its own. A run that errors during collection has verified nothing, whatever its',
+            'exit code says (rule 4g).',
+            ''
+        ]
+        : [];
     const testAssemblyBlock = testAssemblyFindings && testAssemblyFindings.length > 0 ?
         [
             'TEST-ASSEMBLY NOTICE (deterministic, computed by the orchestrator from pure',
@@ -255,6 +313,9 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFind
         ...crossTaskDeletionBlock,
         ...probeGamingBlock,
         ...skipEscapeBlock,
+        ...foreignPathBlock,
+        ...scriptEscapeBlock,
+        ...runnerGlobBlock,
         ...testAssemblyBlock,
         'How to verify — verify the REAL, shipped deliverable exactly as an unaided fresh',
         'checkout (or CI run) would experience it:',
@@ -388,6 +449,32 @@ export function buildVerifyPrompt(spec, probeFindings, envNotes, prohibitionFind
         '   tree). Otherwise the verdict is FAIL naming the deleted file and the task that',
         '   owns it.',
         '',
+        '4e. AN ABSOLUTE PATH TO PROJECT FILES IS A DEFECT — a committed path like',
+        "   `/workspace/src/shared` or `/home/<someone>/proj/src` names the authoring agent's",
+        '   OWN machine, not this one. Its distinctive damage is that it breaks the run BEFORE',
+        '   any check reports: a bad alias/config path makes the tool fail to RESOLVE or BUILD,',
+        '   so a suite "passes" having executed nothing. Treat a command that reports no',
+        '   failures but also no WORK — 0 tests run, 0 files emitted, an empty report — as',
+        '   unverified, never as green. Confirm the count of things that actually ran. A path',
+        '   to project-internal files must be relative to the file that carries it, or computed',
+        '   at runtime; if one does not resolve here, the verdict is FAIL naming file and path.',
+        '',
+        '4f. A CHECK THAT CANNOT FAIL PROVES NOTHING — before you cite a check script',
+        "   (`npm run lint`, `bun run test`) as evidence, read its DEFINITION in the project's",
+        '   manifest. A script ending in `|| true`, `; exit 0`, or piping a checker into an',
+        '   inverted grep exits 0 unconditionally: its green result is a constant, not a',
+        '   measurement, and running it again only reproduces the constant. When a script is',
+        '   built that way, run the underlying checker directly and judge its real output; and',
+        '   unless the spec required that tolerance, the script itself is a defect — the',
+        '   verdict is FAIL naming it.',
+        '',
+        '4g. TWO RUNNERS, ONE FILE SET, NO RESULTS — when a project declares more than one',
+        '   test runner, check that each collects only its own files. A runner that scans for',
+        "   `*.test.*` / `*.spec.*` project-wide will import another runner's specs and abort",
+        '   during COLLECTION. That failure mode looks nothing like a test failure: you get an',
+        '   import error, or a suite that reports zero tests. Always read how many tests each',
+        '   command actually COLLECTED and RAN; zero collected is never a pass.',
+        '',
         '5. The ONLY thing you may assume is already provided is a genuinely EXTERNAL running',
         '   service or network resource (a database server, an API host) that the project',
         '   documents as a prerequisite. Before you rely on that assumption, PROBE for the',
@@ -572,6 +659,39 @@ export async function runWorkVerification(deps) {
             crossDeletions = [];
         }
     }
+    // Sandbox-path-leak findings the deterministic repair could NOT fix, injected
+    // under rule 4e. A probe failure must never block verification.
+    let foreignPaths = [];
+    if (deps.foreignPathProbe) {
+        try {
+            foreignPaths = await deps.foreignPathProbe();
+        }
+        catch {
+            foreignPaths = [];
+        }
+    }
+    // Neutered check scripts in a manifest this task changed, injected under rule
+    // 4f. A probe failure must never block verification.
+    let scriptEscapes = [];
+    if (deps.scriptEscapeProbe) {
+        try {
+            scriptEscapes = await deps.scriptEscapeProbe();
+        }
+        catch {
+            scriptEscapes = [];
+        }
+    }
+    // Colliding test-runner globs, injected under rule 4g. A probe failure must
+    // never block verification.
+    let runnerGlobs = [];
+    if (deps.runnerGlobProbe) {
+        try {
+            runnerGlobs = await deps.runnerGlobProbe();
+        }
+        catch {
+            runnerGlobs = [];
+        }
+    }
     // Environment facts from earlier gate children (best-effort; a cache failure
     // must never block verification).
     let envNotes = '';
@@ -607,7 +727,11 @@ export async function runWorkVerification(deps) {
     for (let attempt = 1;; attempt++) {
         let text;
         try {
-            text = await deps.runChild(VERIFY_TOOLS, buildVerifyPrompt(deps.spec, findings, envNotes, prohibitions, skipEscapes, contracts, testAssembly, probeGaming, crossTaskDeletionVerifyFindings(crossDeletions)), deps.signal);
+            text = await deps.runChild(VERIFY_TOOLS, buildVerifyPrompt(deps.spec, findings, envNotes, prohibitions, skipEscapes, contracts, testAssembly, probeGaming, crossTaskDeletionVerifyFindings(crossDeletions), {
+                foreignPaths,
+                scriptEscapes,
+                runnerGlobs
+            }), deps.signal);
         }
         catch (err) {
             if (err instanceof Error && err.message === USER_CANCELLED)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.18.30",
+    "version": "0.18.31",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",