@mjasnikovs/pi-task 0.18.30 → 0.18.32

package/dist/task/auto-orchestrator.d.ts

@@ -45,6 +45,14 @@ export interface AutoDeps extends GateDeps {
      * Leave-failed / Accept, exactly the pre-autofix behavior.
      */
     finalGateFix?: FinalGateFixFn;
+    /**
+     * Paths currently uncommitted in the working tree (`git status` shape), used to
+     * detect SUB-FIXES a non-converging final-gate autofix left behind (mx5 run 13
+     * PROMPT 4 item 3). Every task is committed by the time the final gate runs, so
+     * anything dirty here is the fix pass's own work. Absent → the stranded-fix
+     * handling is skipped entirely (prior behavior).
+     */
+    pendingChanges?: (cwd: string) => Promise<string[]>;
 }
 /**
  * Expand any @file references in the feature text by appending each referenced

package/dist/task/auto-orchestrator.js

@@ -24,15 +24,15 @@ import { SessionUI, registerBridgeCommand, publishLifecycleNotice } from '../rem
 import { pushNotify } from '../remote/push.js';
 import { startAutoLoader } from './widget.js';
 import { getParentContextWindow, resolveContextUsage } from './context-usage.js';
-import { buildGateDeps } from './gate-deps.js';
+import { buildGateDeps, collectTreeChanges } from './gate-deps.js';
 import { runGatesForTask } from './task-gates.js';
 import { gitUnmergedPaths, gitStashRef } from './auto-commit.js';
 import { runFinalIntegrationGate } from './final-gate.js';
 import { describeDebt } from './accept-debt.js';
-import { classifyFinalGateAnswer, MAX_FINAL_GATE_AUTOFIX, FINAL_LEAVE_LABEL, FINAL_LEAVE_VALUE, FINAL_ACCEPT_LABEL, FINAL_ACCEPT_VALUE, FINAL_AUTOFIX_LABEL, FINAL_AUTOFIX_VALUE } from './final-gate-fix.js';
+import { classifyFinalGateAnswer, MAX_FINAL_GATE_AUTOFIX, FINAL_LEAVE_LABEL, FINAL_LEAVE_VALUE, FINAL_ACCEPT_LABEL, FINAL_ACCEPT_VALUE, FINAL_AUTOFIX_LABEL, FINAL_AUTOFIX_VALUE, STRANDED_FIX_COMMIT, strandedFixNote } from './final-gate-fix.js';
 import { getConfig } from '../config/config.js';
 import { isYoloMode, yoloPickAnswer, yoloFinalGateChoice, YOLO_STAMP } from './yolo.js';
-import { configureResearchRun } from '../workers/research-cache.js';
+import { configureResearchRun, resumeResearchRun } from '../workers/research-cache.js';
 import { CONTRACT_EXTRACT_PROMPT, parseContractLines, keepGroundedContracts, appendContracts } from './contracts.js';
 import { reconcileTitleSources } from './decompose-fidelity.js';
 import { REQUIREMENT_EXTRACT_PROMPT, COVERAGE_MAP_PROMPT, parseRequirementLines, keepGroundedRequirements, capRequirements, enumerateObligationPassages, uncoveredPassages, extractionRetryHint, parseCoverageMap, accountCoverage, isCrossCuttingRequirement, appendCarriedRequirements, buildRequirementsLedger } from './requirements.js';
@@ -904,7 +904,14 @@ function defaultDeps(ctx, cwd, signal, title) {
         // run-level half of the same verification story.
         finalGate: (cwd2, planText) => getConfig().verifyWork ?
             runFinalIntegrationGate(cwd2, undefined, undefined, undefined, planText)
-            : Promise.resolve({ ok: true, reason: 'disabled' })
+            : Promise.resolve({ ok: true, reason: 'disabled' }),
+        // Uncommitted paths, for the stranded-sub-fix handling around the final-gate
+        // picker (mx5 run 13 PROMPT 4 item 3). Every task is committed by the time
+        // the gate runs, so whatever is dirty here belongs to the fix pass.
+        pendingChanges: async (cwd2) => {
+            const changes = await collectTreeChanges(cwd2, signal);
+            return [...changes.modified, ...changes.added, ...changes.deleted].sort();
+        }
     };
 }
 // ─── Loop ────────────────────────────────────────────────────────────────────
@@ -1009,6 +1016,21 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                     // after MAX_FINAL_GATE_AUTOFIX attempts that still FAIL the
                     // autofix card is withdrawn so the loop cannot run unbounded.
                     let fixAttempts = 0;
+                    // Sub-fixes a non-converging autofix attempt left uncommitted.
+                    // Refreshed after every attempt; drives the picker note and the
+                    // accept-time commit (mx5 run 13 PROMPT 4 item 3).
+                    let stranded = [];
+                    const refreshStranded = async () => {
+                        if (!deps.pendingChanges)
+                            return;
+                        try {
+                            stranded = await deps.pendingChanges(cwd);
+                        }
+                        catch {
+                            // Inconclusive: say nothing rather than claim a clean tree.
+                            stranded = [];
+                        }
+                    };
                     while (!fin.ok) {
                         const canAutofix = deps.finalGateFix !== undefined && fixAttempts < MAX_FINAL_GATE_AUTOFIX;
                         // The picker question shows the debts (the HUMAN weighs them);
@@ -1019,7 +1041,11 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                             + '(the project’s own test/build/static commands, run unaided).'
                             + (fixAttempts > 0 ?
                                 `\n\nAutofix attempts so far: ${fixAttempts}/${MAX_FINAL_GATE_AUTOFIX}.`
-                                : '');
+                                : '')
+                            // Never let a partial repair be invisible at the moment
+                            // the human decides (run 13: a bunfig fix that made
+                            // `bun run test` pass 116/116 was stranded by an ACCEPT).
+                            + strandedFixNote(stranded);
                         // YOLO: keep autofixing WHILE the card is still offered — the
                         // loop withdraws it after MAX_FINAL_GATE_AUTOFIX, so the cap
                         // that bounds a non-converging fix pass still bounds this —
@@ -1058,7 +1084,30 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                         const choice = classifyFinalGateAnswer(answer);
                         if (choice.action === 'accept') {
                             await recGate('final-gate: FAIL accepted by user');
-                            active.ui.notify(`${id}: final integration gate FAIL accepted by user — completing.`, 'warning');
+                            // STRANDED SUB-FIXES: the run completes here, so anything
+                            // the fix pass repaired but never committed would be lost
+                            // to the next `git checkout` while HEAD keeps the defect
+                            // it fixed. Commit it as its own, named commit — the
+                            // ACCEPT is a decision about the FAILING gate, never an
+                            // instruction to throw away work (mx5 run 13 item 3).
+                            if (stranded.length > 0) {
+                                try {
+                                    const sha = await deps.commit(cwd, STRANDED_FIX_COMMIT(id));
+                                    await recGate(`final-gate: committed ${stranded.length} stranded fix-pass change(s)`
+                                        + `${sha ? ` as ${sha}` : ''} — ${stranded.slice(0, 8).join(', ')}`);
+                                }
+                                catch (err) {
+                                    // Never break the completion path over this — but
+                                    // say so, so the changes are not silently lost.
+                                    await recGate(`final-gate: could NOT commit ${stranded.length} stranded fix-pass `
+                                        + `change(s) (${err instanceof Error ? err.message : String(err)}) — `
+                                        + `they remain UNCOMMITTED in the working tree: ${stranded.slice(0, 8).join(', ')}`);
+                                }
+                            }
+                            active.ui.notify(`${id}: final integration gate FAIL accepted by user — completing.`
+                                + (stranded.length > 0 ?
+                                    ` ${stranded.length} uncommitted fix-pass change(s) committed separately.`
+                                    : ''), 'warning');
                             break;
                         }
                         if (choice.action === 'autofix' && canAutofix) {
@@ -1077,6 +1126,14 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                                 break;
                             }
                             await recGate(`final-gate: autofix attempt ${fixAttempts} failed — ${fix.reason.slice(0, 200)}`);
+                            // The attempt's edits survive a non-convergence (only a
+                            // guard trip discards). Find out what they are NOW, so
+                            // the next picker shows them and an ACCEPT can commit them.
+                            await refreshStranded();
+                            if (stranded.length > 0) {
+                                await recGate(`final-gate: autofix attempt ${fixAttempts} left ${stranded.length} `
+                                    + `uncommitted change(s) — ${stranded.slice(0, 8).join(', ')}`);
+                            }
                             active.ui.notify(`${id}: final-gate autofix did not converge — ${fix.reason.slice(0, 140)}`, 'warning');
                             // Work from the FRESH gate failure when the fix pass got
                             // as far as re-running the gate; otherwise keep the last.
@@ -1102,8 +1159,19 @@ export async function runAutoLoop(ctx, cwd, id, deps) {
                         await recGate(yoloFinal !== null ?
                             `final-gate: left failed — autofix budget spent, nobody to ask ${YOLO_STAMP}`
                             : 'final-gate: left failed (user)');
+                        // Leaving the run failed hands the working tree back to the
+                        // user, so uncommitted fix-pass edits are theirs to keep or
+                        // drop — but they must be VISIBLE, not discovered later by a
+                        // stray `git status` (mx5 run 13 item 3).
+                        if (stranded.length > 0) {
+                            await recGate(`final-gate: ${stranded.length} uncommitted fix-pass change(s) left in the `
+                                + `working tree — ${stranded.slice(0, 8).join(', ')}`);
+                        }
                         await updateTaskFrontMatter(cwd, id, { state: 'failed' });
-                        announceDone(active, `${id} finished all tasks but FAILED the final integration gate — ${fin.reason.slice(0, 200)} — fix and /task-auto-resume (the gate re-runs).`, 'error');
+                        announceDone(active, `${id} finished all tasks but FAILED the final integration gate — ${fin.reason.slice(0, 200)} — fix and /task-auto-resume (the gate re-runs).`
+                            + (stranded.length > 0 ?
+                                ` NOTE: ${stranded.length} uncommitted fix-pass change(s) are in your working tree (${stranded.slice(0, 4).join(', ')}).`
+                                : ''), 'error');
                         return;
                     }
                 }
@@ -1328,9 +1396,14 @@ async function handleTaskAutoResume(_args, ctx) {
     ctx.ui.notify(`Resuming ${id}…`, 'info');
     await updateTaskFrontMatter(cwd, id, { state: 'in_progress' });
     autoRunning = true;
-    // Fresh per-run research-cache id for the resumed run (F10); a resume re-fetches
-    // rather than reusing the interrupted run's digest — safe, only slightly less reuse.
-    configureResearchRun(getConfig().researchCache);
+    // Reuse the interrupted run's research-cache id when the cache proves it still
+    // describes the same dependency surface (F10). mx5 run 13 resumed three times and
+    // each resume's fresh id discarded a working 201-entry cache; anything inconclusive
+    // still falls back to a fresh id and a re-fetch. See resumeResearchRun.
+    const research = await resumeResearchRun(cwd, getConfig().researchCache);
+    if (research.reused) {
+        logPlanDebug(cwd, `research cache: resume reused ${research.entries} entr(ies)`);
+    }
     const abort = new AbortController();
     // Resume only runs the loop (runTask); no planning children, so the loader
     // title is unused here — pass the id for clarity if that ever changes.

package/dist/task/final-gate-fix.d.ts

@@ -58,6 +58,31 @@ export declare function parseFinalFixMarker(text: string): {
     blocked: boolean;
     note?: string;
 };
+/**
+ * STRANDED SUB-FIXES (mx5 run 13, PROMPT 4 item 3).
+ *
+ * A fix attempt that does not converge keeps its edits: they are NOT discarded
+ * (only a guard trip discards), and `deps.commit` runs only on `fix.ok`. So a
+ * partial fix that genuinely repaired something sits in the working tree, uncommitted,
+ * and if the user then ACCEPTs the FAIL the run completes around it — leaving HEAD
+ * broken while the repair is invisible unless someone runs `git status`.
+ *
+ * That is exactly what run 13 shipped: the fix child's bunfig.toml change made
+ * `bun run test` pass 116/116, attempt 1 did not converge overall, the user accepted
+ * the FAIL, and the tree still shows the file modified while HEAD's `bun run test` is
+ * broken. The repair and the breakage were BOTH real; only the repair was discarded
+ * by default.
+ *
+ * The rule: a partial fix is either committed (its own commit, named in the trail) or
+ * explicitly surfaced — never silently stranded.
+ */
+/** Commit subject for partial fixes committed alongside an accepted gate FAIL. */
+export declare const STRANDED_FIX_COMMIT: (runId: string) => string;
+/**
+ * The picker/trail line describing what a non-converging fix pass left behind.
+ * Empty string when the tree is clean — the caller then says nothing at all.
+ */
+export declare function strandedFixNote(paths: string[]): string;
 export interface FinalFixResult {
     /** true → the fix child ran AND the re-run gate passed. */
     ok: boolean;

package/dist/task/final-gate-fix.js

@@ -161,6 +161,39 @@ export function parseFinalFixMarker(text) {
     }
     return { blocked: false, note: last[2].trim() || undefined };
 }
+/**
+ * STRANDED SUB-FIXES (mx5 run 13, PROMPT 4 item 3).
+ *
+ * A fix attempt that does not converge keeps its edits: they are NOT discarded
+ * (only a guard trip discards), and `deps.commit` runs only on `fix.ok`. So a
+ * partial fix that genuinely repaired something sits in the working tree, uncommitted,
+ * and if the user then ACCEPTs the FAIL the run completes around it — leaving HEAD
+ * broken while the repair is invisible unless someone runs `git status`.
+ *
+ * That is exactly what run 13 shipped: the fix child's bunfig.toml change made
+ * `bun run test` pass 116/116, attempt 1 did not converge overall, the user accepted
+ * the FAIL, and the tree still shows the file modified while HEAD's `bun run test` is
+ * broken. The repair and the breakage were BOTH real; only the repair was discarded
+ * by default.
+ *
+ * The rule: a partial fix is either committed (its own commit, named in the trail) or
+ * explicitly surfaced — never silently stranded.
+ */
+/** Commit subject for partial fixes committed alongside an accepted gate FAIL. */
+export const STRANDED_FIX_COMMIT = (runId) => `FINAL GATE PARTIAL FIX (${runId}) — accepted with gate still failing`;
+/**
+ * The picker/trail line describing what a non-converging fix pass left behind.
+ * Empty string when the tree is clean — the caller then says nothing at all.
+ */
+export function strandedFixNote(paths) {
+    if (paths.length === 0)
+        return '';
+    const shown = paths.slice(0, 8).join(', ');
+    return (`\n\nUNCOMMITTED: the fix pass left ${paths.length} change(s) in the working tree `
+        + `(${shown}${paths.length > 8 ? ', …' : ''}). These are NOT in HEAD. Accepting will `
+        + `commit them as their own commit so they are not lost; leaving the run failed keeps `
+        + `them in your working tree.`);
+}
 /**
  * Run one bounded final-gate fix attempt: snapshot discovery → child → write-guard
  * stack (diff capture → frozen-path revert → deletion guard → shrink guard → probe

package/dist/task/foreign-path.d.ts

@@ -0,0 +1,96 @@
+import type { AddedLine } from './probe-gaming.js';
+/** One leaked absolute path found in a committed file. */
+export interface ForeignPathFinding {
+    /** Repo-relative file the leaked path was committed into. */
+    file: string;
+    /** The absolute path exactly as written in the file. */
+    absolute: string;
+    /** The repo-relative path its tail resolves to (the repair target). */
+    repoPath: string;
+    /** The leading segments that are foreign to this host (e.g. `/workspace`). */
+    foreignPrefix: string;
+    /** The verbatim line carrying the leak, trimmed. */
+    line: string;
+}
+/**
+ * Resolve a repo-relative path to the real thing it names, honouring the
+ * extensionless module specifiers config files use (`src/client/api` →
+ * `src/client/api.ts`). Returns the resolved repo-relative path, or null.
+ *
+ * This mirrors how the tools that CONSUME these paths (vite/tsconfig aliases,
+ * bundler resolvers) look them up — without it the mx5 true positive
+ * `/workspace/src/client/api` would be missed, since only `src/client/api.ts` exists.
+ */
+export declare function resolveRepoPath(rel: string, exists: (rel: string) => boolean): string | null;
+/**
+ * Scan a task's added lines for sandbox-leaked absolute paths.
+ *
+ * `existsOnHost` answers for an ABSOLUTE path; `existsInRepo` for a REPO-RELATIVE
+ * one. Both are injected so the detector is pure and unit-testable against a
+ * synthetic tree.
+ *
+ * The tail search strips the FEWEST leading segments that still resolve, so the
+ * finding names the smallest foreign prefix (`/workspace`, not `/workspace/src`)
+ * and the largest repo-relative target — the reading that matches how a mount
+ * actually shadows a tree.
+ */
+export declare function findForeignPaths(lines: AddedLine[], existsOnHost: (abs: string) => boolean, existsInRepo: (rel: string) => boolean): ForeignPathFinding[];
+/**
+ * The repair for one finding: the leaked absolute path rewritten relative to the
+ * FILE that carries it, in the `./`-prefixed form config resolvers expect. A target
+ * in a parent directory keeps its `../` form (already relative, no prefix needed).
+ */
+export declare function relativeRepairFor(finding: ForeignPathFinding): string;
+/**
+ * Apply every finding for ONE file to that file's text, as literal substitutions.
+ * Returns the new text and the substitutions made; `text` is returned untouched
+ * when nothing applied (the caller then writes nothing).
+ *
+ * Deliberately a plain string replacement of a path literal for a path literal: it
+ * cannot reflow, reformat, or restructure the file, so a rewrite that turns out to
+ * be semantically wrong is still trivially reviewable in the diff. A finding whose
+ * absolute string is no longer present (the file moved on) is skipped.
+ */
+export declare function applyForeignPathRepairs(text: string, findings: ForeignPathFinding[]): {
+    text: string;
+    applied: Array<{
+        from: string;
+        to: string;
+    }>;
+};
+/** IO seam for the repair pass; injected so the orchestration is unit-testable. */
+export interface ForeignPathRepairIO {
+    readFile: (rel: string) => Promise<string>;
+    writeFile: (rel: string, text: string) => Promise<void>;
+    /** Does this repo-relative path exist? Used to RE-VALIDATE each repair. */
+    existsInRepo: (rel: string) => boolean;
+}
+export interface ForeignPathRepairResult {
+    /** Human-readable repairs actually written, e.g. `cfg.ts: /workspace/src → ./src`. */
+    repaired: string[];
+    /** Findings left alone — these become the verify finding. */
+    remaining: ForeignPathFinding[];
+}
+/**
+ * Deterministically repair what can be repaired, and hand back the rest.
+ *
+ * Every repair is RE-VALIDATED before it is written: the file-relative form is
+ * resolved back to a repo path and must land on the same real file the finding
+ * named. A repair that does not re-resolve is dropped and its finding stays in
+ * `remaining`, where the verify block will raise it for a human or an AUTOFIX
+ * round. An unreadable or unwritable file does the same. Nothing here can turn a
+ * working path into a broken one — the only edit it makes is swapping a path that
+ * provably does not resolve for one that provably does.
+ */
+export declare function repairForeignPaths(findings: ForeignPathFinding[], io: ForeignPathRepairIO): Promise<ForeignPathRepairResult>;
+/**
+ * Verify-child prompt lines: one per leak, naming the file, the leaked path, and
+ * the real repo path it shadows. Empty findings → empty array (caller emits no
+ * block), matching every other probe's contract.
+ */
+export declare function foreignPathVerifyFindings(findings: ForeignPathFinding[]): string[];
+/**
+ * Render findings as a critique/enforce defect block — the same shape as
+ * skipEscapeDefectText: a numbered list the rewrite must resolve.
+ */
+export declare function foreignPathDefectText(findings: ForeignPathFinding[]): string;

package/dist/task/gate-deps.js

@@ -13,6 +13,7 @@
  * path-revisit disabled because re-running the same check IS the job), each with a
  * status widget and a per-gate debug log under .pi-tasks/.
  */
+import { existsSync } from 'node:fs';
 import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
 import { tasksDir, readTaskFile, appendGateRecord } from './task-io.js';
@@ -34,6 +35,9 @@ import { parseTreeChanges, parseNameStatusChanges, formatTreeChanges } from './w
 import { taskThatIntroduced, findCrossTaskDeletions } from './task-provenance.js';
 import { findTestRebuiltAssemblies, testAssemblyVerifyFindings } from './test-assembly.js';
 import { runBoundedLintFix } from './lint-fix.js';
+import { findForeignPaths, foreignPathVerifyFindings, repairForeignPaths } from './foreign-path.js';
+import { findScriptEscapesInManifest, scriptEscapeVerifyFindings } from './script-escape.js';
+import { assessRunnerGlobs, runnerGlobVerifyFindings } from './runner-globs.js';
 import { captureGitState, reconcileGitState } from './git-state-guard.js';
 import { runWorker } from '../workers/pi-worker-core.js';
 import { formatLoopHint } from './child-runner.js';
@@ -123,6 +127,121 @@ export async function collectAddedLines(cwd, signal) {
     }
     return lines;
 }
+/**
+ * Deterministic sandbox-path-leak pass (see foreign-path.ts, mx5 run 13 PROMPT 4
+ * item 1): find absolute paths the task committed that resolve nowhere on this
+ * machine while the real file sits in the repo, REPAIR the ones whose relative
+ * form provably resolves, and return verify findings for whatever is left.
+ *
+ * The repair runs here, before the verify child, for the same reason lint-fix
+ * does: the defect is mechanical and the correct target is already known, so
+ * spending an AUTOFIX round (or a human) on a path substitution is waste. What it
+ * cannot repair still reaches the child under rule 4e. Failures degrade to no
+ * findings — a sharpener, never a blocker.
+ */
+async function collectForeignPathFindings(cwd, signal, logDebug) {
+    const lines = await collectAddedLines(cwd, signal);
+    if (lines.length === 0)
+        return [];
+    const findings = findForeignPaths(lines, abs => existsSync(abs), rel => existsSync(path.join(cwd, rel)));
+    if (findings.length === 0)
+        return [];
+    const { repaired, remaining } = await repairForeignPaths(findings, {
+        readFile: rel => fsp.readFile(path.join(cwd, rel), 'utf8'),
+        writeFile: (rel, text) => fsp.writeFile(path.join(cwd, rel), text, 'utf8'),
+        existsInRepo: rel => existsSync(path.join(cwd, rel))
+    });
+    for (const r of repaired)
+        logDebug?.(`sandbox path leak repaired — ${r}`);
+    for (const f of remaining) {
+        logDebug?.(`sandbox path leak NOT repaired — ${f.file}: ${f.absolute}`);
+    }
+    return foreignPathVerifyFindings(remaining);
+}
+/** Manifests whose `scripts` the check-script scanner understands. */
+const MANIFEST_RE = /(^|\/)package\.json$/;
+/**
+ * Deterministic neutered-check-script pass (see script-escape.ts, mx5 run 13 PROMPT
+ * 4 item 4): check-class scripts that cannot report failure, in a manifest THIS
+ * task changed.
+ *
+ * Scoped to manifests the task touched, so the finding lands on the task that
+ * authored the script rather than being re-served to every later task. A script
+ * neutered by an earlier task is the whole-repo final gate's business, which
+ * re-checks the shipped manifest at run end regardless of who wrote it.
+ *
+ * Failures degrade to no findings — a sharpener, never a blocker.
+ */
+async function collectScriptEscapeFindings(cwd, signal) {
+    const changed = await collectChangedFiles(cwd, signal);
+    const manifests = changed.map(f => f.path).filter(p => MANIFEST_RE.test(p));
+    const findings = [];
+    for (const rel of manifests) {
+        try {
+            findings.push(...findScriptEscapesInManifest(await fsp.readFile(path.join(cwd, rel), 'utf8')));
+        }
+        catch {
+            // unreadable/absent manifest — nothing to report
+        }
+    }
+    return scriptEscapeVerifyFindings(findings);
+}
+/** Playwright config filenames, in the order playwright itself resolves them. */
+const PLAYWRIGHT_CONFIGS = [
+    'playwright.config.ts',
+    'playwright.config.js',
+    'playwright.config.mts',
+    'playwright-ct.config.ts',
+    'playwright-ct.config.js'
+];
+/** Read a repo file as text, or null when absent/unreadable. */
+async function readOrNull(cwd, rel) {
+    try {
+        return await fsp.readFile(path.join(cwd, rel), 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Deterministic test-runner glob-collision pass (see runner-globs.ts, mx5 runs 7 AND
+ * 13, PROMPT 4 item 2): the manifest declares both `bun test` and `playwright test`
+ * without a provably disjoint file set, so `bun test` imports the playwright specs
+ * and dies during collection.
+ *
+ * Whole-repo rather than diff-scoped, unlike the neutered-script probe: a collision
+ * is a property of the PAIR of declarations, and the task that completes the pair is
+ * rarely the one that will be blamed by a diff. It is cheap (two small file reads)
+ * and silent unless both runners are actually declared. Failures degrade to no
+ * findings — a sharpener, never a blocker.
+ */
+async function collectRunnerGlobFindings(cwd) {
+    const manifestText = await readOrNull(cwd, 'package.json');
+    if (manifestText === null)
+        return [];
+    let scripts;
+    try {
+        const parsed = JSON.parse(manifestText);
+        const raw = parsed?.scripts;
+        if (typeof raw !== 'object' || raw === null)
+            return [];
+        scripts = raw;
+    }
+    catch {
+        return [];
+    }
+    let playwrightConfig = null;
+    for (const name of PLAYWRIGHT_CONFIGS) {
+        playwrightConfig = await readOrNull(cwd, name);
+        if (playwrightConfig !== null)
+            break;
+    }
+    return runnerGlobVerifyFindings(assessRunnerGlobs({
+        scripts,
+        bunfig: await readOrNull(cwd, 'bunfig.toml'),
+        playwrightConfig
+    }));
+}
 /**
  * The working tree's current changes as a summary (write-guard shape): what a
  * write-capable gate child changed, given the tree was clean when it started.
@@ -497,6 +616,28 @@ export function buildGateDeps(params) {
                 // destroyed (typically to green a check). Injected under rule 4d and
                 // carried on a FAIL so an ACCEPT records durable debts.
                 crossTaskDeletionProbe: () => collectTaskTreeChanges(cwd2, signal).then(changes => findCrossTaskDeletions(changes, taskId, rel => taskThatIntroduced(cwd2, rel))),
+                // Deterministic sandbox-path-leak probe (mx5 run 13 PROMPT 4 item
+                // 1): absolute paths committed from the authoring child's own
+                // environment (`/workspace/src/shared`) that resolve nowhere here.
+                // Repaired deterministically where the relative form provably
+                // resolves; the remainder is injected under rule 4e, whose point is
+                // that such a path breaks the BUILD — so the checks that would have
+                // caught it report nothing rather than failing.
+                foreignPathProbe: () => collectForeignPathFindings(cwd2, signal, msg => void fsp
+                    .appendFile(path.join(tasksDir(cwd2), 'verify-debug.log'), `${new Date().toISOString()} ${msg}\n`)
+                    .catch(() => { })),
+                // Deterministic neutered-check-script probe (mx5 run 13 PROMPT 4
+                // item 4): a check script this task authored that cannot fail
+                // (`… || true`, an inverted-grep launder). Injected under rule 4f,
+                // because the child provably cannot find this by running the
+                // script — it passes, which IS the defect.
+                scriptEscapeProbe: () => collectScriptEscapeFindings(cwd2, signal),
+                // Deterministic runner glob-collision probe (mx5 runs 7 AND 13,
+                // PROMPT 4 item 2): both `bun test` and `playwright test` declared
+                // with no proof their file sets are disjoint. Injected under rule
+                // 4g — the collision kills the suite during COLLECTION, which does
+                // not look like a test failure.
+                runnerGlobProbe: () => collectRunnerGlobFindings(cwd2),
                 // Deterministic prohibition probe: paths the spec forbids modifying
                 // that the task's diff modified anyway become prompt-level findings
                 // under the no-waiver rule — the child otherwise rarely runs `git

package/dist/task/phases.js

@@ -27,6 +27,7 @@ import { parseGrillQuestions, parseAutoAnswer, autoAnswerHasTag, parseVerifyTool
 import { compressTitle } from './title-label.js';
 import { parseVerifyBlock, validateSpecShape, stripSpecPreamble, isCritiqueClean } from './spec-validation.js';
 import { findSkipEscapes, skipEscapeDefectText } from './skip-escape.js';
+import { findScriptEscapesInText, scriptEscapeDefectText } from './script-escape.js';
 import { findSynthesizedWiring, wiringProbeText, readReferencedDocs } from './wiring-claims.js';
 import { findAbsenceConflicts, absenceProbeText, siblingTitlesFromPlanContext } from './verify-reconcile.js';
 import { findFrozenPathConflicts, frozenConflictProbeText } from './frozen-conflict.js';
@@ -939,6 +940,17 @@ export async function phaseCritique(deps, spec, refined, qa, planContext, resear
     if (grepOnlyProbe) {
         deps.logDebug?.('grep-theater VERIFY flagged in spec: ' + grepOnly.map(f => f.target).join(' | '));
     }
+    // DETERMINISTIC neutered-check-script probe (mx5 run 13, PROMPT 4 item 4): a
+    // spec that DICTATES a check script which cannot fail — `"lint": "… || true"`,
+    // or a checker laundered through an inverted grep. Whatever task implements
+    // that spec writes the disarmed script into package.json, and from then on
+    // every gate that runs it (repo-health verify, the final integration gate)
+    // reads a constant. Cheapest to kill here, in the spec, before it is authored.
+    const scriptEscapes = findScriptEscapesInText(spec);
+    const scriptProbe = scriptEscapes.length > 0 ? scriptEscapeDefectText(scriptEscapes) : null;
+    if (scriptProbe) {
+        deps.logDebug?.('neutered check script dictated by spec: ' + scriptEscapes.map(f => f.name).join(' | '));
+    }
     let triageDefects = null;
     if (parseVerifyBlock(spec) !== null) {
         const tTriage = Date.now();
@@ -956,15 +968,17 @@ export async function phaseCritique(deps, spec, refined, qa, planContext, resear
         deps.recordSubStep?.('triage', Date.now() - tTriage);
         if (verdict !== null) {
             // A deterministic skip-escape, synthesized-wiring, plan-contradiction,
-            // unsatisfiable-pair, or grep-theater finding overrides a CLEAN triage: the draft must
-            // be rewritten to resolve it even if the model judged the rest clean
-            // (the model does not self-discover any of them reliably).
+            // unsatisfiable-pair, grep-theater, or neutered-check-script finding
+            // overrides a CLEAN triage: the draft must be rewritten to resolve it
+            // even if the model judged the rest clean (the model does not
+            // self-discover any of them reliably).
             if (isCritiqueClean(verdict)) {
                 if (skipDefects === null
                     && wiringProbe === null
                     && absenceProbe === null
                     && frozenProbe === null
-                    && grepOnlyProbe === null) {
+                    && grepOnlyProbe === null
+                    && scriptProbe === null) {
                     return spec;
                 }
             }
@@ -974,9 +988,17 @@ export async function phaseCritique(deps, spec, refined, qa, planContext, resear
         }
     }
     // Merge the deterministic skip-escape + synthesized-wiring + plan-contradiction
-    // + unsatisfiable-pair + grep-theater defects with any triage defects for the
-    // rewrite (all are forced FOCUS items).
-    const rewriteDefects = [skipDefects, wiringProbe, absenceProbe, frozenProbe, grepOnlyProbe, triageDefects]
+    // + unsatisfiable-pair + grep-theater + neutered-script defects with any triage
+    // defects for the rewrite (all are forced FOCUS items).
+    const rewriteDefects = [
+        skipDefects,
+        wiringProbe,
+        absenceProbe,
+        frozenProbe,
+        grepOnlyProbe,
+        scriptProbe,
+        triageDefects
+    ]
         .filter(Boolean)
         .join('\n\n') || null;
     const tRewrite = Date.now();