@mjasnikovs/pi-task 0.28.2 → 0.29.0

package/README.md

@@ -184,6 +184,7 @@ Run `/task-config` to toggle pi-task's behavior in an editor dialog. Settings pe
 | **stuck reply retry** | 10 min | Inactivity ceiling on the **model stream**. A hung or silently-dropped stream throws nothing at all, so neither the connection-error retry (it needs a reported error) nor the **command timeout** (tool calls only) nor the dead-backend stall guard (a reachable endpoint reads as proof of life) can see it — an mx5 run lost ~2.9h to three of them while the model server stayed healthy. Measured as time since the **last stream event of any kind**, so a slow model emitting one token every 30s is never touched, and it pauses while a tool runs. On expiry the main session aborts the turn (through the same channel the command watchdog uses) and posts a resume reminder; a child is killed and routed into the existing connection-error retry. Choices: 5/10/20/30 min or **off**. Keep it generous on local backends — prompt processing on a large context legitimately emits nothing for minutes. |
 | **yolo mode** | off | **Unattended runs.** Wherever pi-task would stop and ask, it takes the option already marked RECOMMENDED, stamps the artifact `(YOLO)` so an audit can tell a machine decided, and shows no prompt at all — clarify/grill answers, the verify-FAIL picker (auto-**Accept**, recorded as a yolo debt), and the final-gate picker (autofix while the budget lasts, then leave the run FAILED). A question with no recommendation is **skipped**, never invented. For throwaway/test projects nobody is watching; a real run should decide these itself. |
 | **debug logs** | events | How much of a run is written to `.pi-tasks/*-debug.log`. **`events`** keeps decisions and guard actions — which phase ran, why a worker was retried, what the git-state guard restored, what a write-capable child changed on disk, why a gate returned FAIL — a few lines per task. **`full`** adds every line the child model emitted and every tool result; that's ~85% of the bytes (a real 247 KB `verify-debug.log` is 1315 lines, 521 of them tool dumps) and is what you want while actively debugging. **`off`** writes nothing. Nothing in pi-task ever reads these files back, so the setting cannot change how a run behaves — only whether you can explain it afterwards, and a log not written can't be recovered later. |
+| **watch: …** | all on | One toggle per tool in the live session, deciding whether **command timeout** applies to it. The list is discovered from `pi.getAllTools()` when the menu opens — built-ins first, then each extension's tools with the owning entry-point path in the description — so nothing is typed by hand and an uninstalled tool just stops being listed. Turn one **off** only for a tool that already owns a longer bounded, cancellable contract of its own (the guard exists because pi's `bash` has an optional timeout with *no* default — that reasoning doesn't transfer to a tool that has one). Two things to know before you do: a genuine hang in an unwatched tool is caught by nothing, since **stuck reply retry** is paused for the whole time any tool runs; and an unwatched tool is still killed as collateral if a *watched* sibling in the same turn overruns, because pi runs sibling tool calls concurrently and the abort ends the whole turn. Stored as exemptions, so the default and every tool pi-task has never seen stay guarded. |
 | **ext: …** | all off | One toggle per installed host `pi` extension, loading it into every child session by explicit path. Children otherwise run with extensions off, so a provider registered by an extension (e.g. `pi-lmstudio`) doesn't exist in them and they can't resolve the default model. Children also inherit the extension's tools and hooks, so only enable ones you trust. The list is strictly additive (discovery stays off), and an entry whose file is gone is skipped at spawn time, never fatal. |
 
 ## Configuration

package/dist/config/config.d.ts

@@ -61,6 +61,22 @@ export interface PiTaskConfig {
      * a true hang doesn't cost half an hour of dead time.
      */
     requestTimeoutMs: number;
+    /**
+     * Tools the generic command watchdog must NOT arm on, by exact name — for
+     * tools that own a stronger, domain-specific timeout and cancellation
+     * contract of their own and would otherwise be aborted mid-transaction at
+     * the generic ceiling. `bash` and every unlisted tool stay guarded.
+     *
+     * Stored as the EXEMPTIONS, not the guarded set, so the default (`[]`) and
+     * every tool pi-task has never seen are guarded — a new or renamed tool can
+     * never silently lose its watchdog.
+     *
+     * Populated from `/task-config`'s `watch:` rows, which are discovered from
+     * the live session via `pi.getAllTools()` (see config/tool-list.ts), so the
+     * names here are pi's own and never hand-typed. A stale entry left behind by
+     * an uninstalled tool matches nothing and is harmless.
+     */
+    commandTimeoutExemptTools: string[];
     /**
      * Inactivity ceiling (ms) on the MODEL STREAM before the stream watchdog
      * aborts the request (shared/stream-watchdog.ts). A hung or silently-dropped
@@ -148,6 +164,8 @@ export declare const COMMAND_TIMEOUT_OPTIONS: ReadonlyArray<{
  * one of the offered choices so the watchdog never arms on a nonsense value.
  */
 export declare function sanitizeRequestTimeoutMs(value: unknown): number;
+/** Keep only exact, unique Pi tool names from an advanced config override. */
+export declare function sanitizeCommandTimeoutExemptTools(value: unknown): string[];
 /**
  * The stream-watchdog choices offered by /task-config, in cycle order. Every
  * option is minutes, not seconds: the failure this guards costs hours, and the

package/dist/config/config.js

@@ -43,6 +43,23 @@ export function sanitizeRequestTimeoutMs(value) {
         value
         : DEFAULT_REQUEST_TIMEOUT_MS;
 }
+/** Keep only exact, unique Pi tool names from an advanced config override. */
+export function sanitizeCommandTimeoutExemptTools(value) {
+    if (!Array.isArray(value))
+        return [];
+    const result = [];
+    const seen = new Set();
+    for (const item of value) {
+        if (typeof item !== 'string')
+            continue;
+        const name = item.trim();
+        if (!/^[A-Za-z0-9_][A-Za-z0-9_.:-]*$/.test(name) || seen.has(name))
+            continue;
+        seen.add(name);
+        result.push(name);
+    }
+    return result;
+}
 /**
  * The stream-watchdog choices offered by /task-config, in cycle order. Every
  * option is minutes, not seconds: the failure this guards costs hours, and the
@@ -76,6 +93,7 @@ const DEFAULTS = {
     searchProvider: 'exa',
     extensionWhitelist: [],
     requestTimeoutMs: DEFAULT_REQUEST_TIMEOUT_MS,
+    commandTimeoutExemptTools: [],
     streamInactivityMs: DEFAULT_STREAM_INACTIVITY_MS,
     // OFF: auto-answering is for unattended throwaway runs only.
     yoloMode: false,
@@ -110,6 +128,7 @@ if (!G.loaded) {
             delete parsed.searchProvider;
         parsed.extensionWhitelist = sanitizeExtensionWhitelist(parsed.extensionWhitelist);
         parsed.requestTimeoutMs = sanitizeRequestTimeoutMs(parsed.requestTimeoutMs);
+        parsed.commandTimeoutExemptTools = sanitizeCommandTimeoutExemptTools(parsed.commandTimeoutExemptTools);
         parsed.streamInactivityMs = sanitizeStreamInactivityMs(parsed.streamInactivityMs);
         // A hand-edited `"yoloMode": "false"` is a truthy string — it must not
         // silently switch a watched run into unattended auto-pick. Only a real

package/dist/config/register.d.ts

@@ -2,6 +2,7 @@ import type { ExtensionAPI, ExtensionCommandContext } from '@earendil-works/pi-c
 import type { Component } from '@earendil-works/pi-tui';
 import { type PiTaskConfig } from './config.js';
 import { type InstalledExtension } from './extension-list.js';
+import { type GuardableTool } from './tool-list.js';
 type Theme = ExtensionCommandContext['ui']['theme'];
 /**
  * Frames a child component (the settings list) in a rounded border with a title
@@ -46,6 +47,15 @@ export declare function extensionItems(extensions: InstalledExtension[], whiteli
 }[];
 /** Apply an extension toggle to the config's whitelist (idempotent both ways). */
 export declare function applyExtensionToggle(whitelist: readonly string[], entryPath: string, on: boolean): string[];
+export declare function toolItems(tools: readonly GuardableTool[], exempt: readonly string[]): {
+    id: string;
+    label: string;
+    description: string;
+    currentValue: string;
+    values: string[];
+}[];
+/** Apply a per-tool watchdog toggle to the exemption list (idempotent both ways). */
+export declare function applyToolToggle(exempt: readonly string[], toolName: string, watched: boolean): string[];
 /**
  * Tallest body the settings list can render, so {@link BorderedBox} can pad
  * every frame to it and hold the border still. Mirrors SettingsList's own
@@ -68,6 +78,6 @@ export type PanelItem = {
  */
 export declare function createSettingsPanel(items: PanelItem[], theme: Theme, onChange: (id: string, newValue: string) => void, onCancel: () => void): BorderedBox;
 /** The full settings row list for the current config, in menu order. */
-export declare function panelItems(cfg: PiTaskConfig, installed: InstalledExtension[]): PanelItem[];
+export declare function panelItems(cfg: PiTaskConfig, installed: InstalledExtension[], tools?: readonly GuardableTool[]): PanelItem[];
 export declare function registerConfig(pi: ExtensionAPI): void;
 export {};

package/dist/config/register.js

@@ -4,6 +4,7 @@ import { readPkgVersion } from '../shared/pkg-version.js';
 import { SEARCH_PROVIDERS, SEARCH_PROVIDER_LABELS, providerForLabel } from '../workers/search-types.js';
 import { COMMAND_TIMEOUT_OPTIONS, DEBUG_LOG_OPTIONS, getConfig, sanitizeDebugLogs, saveConfig, STREAM_INACTIVITY_OPTIONS } from './config.js';
 import { listInstalledExtensions } from './extension-list.js';
+import { listGuardableTools } from './tool-list.js';
 // Version in the title so a bug report or screenshot says which build it came
 // from without anyone having to go look it up.
 const CONFIG_TITLE = `pi-task ${readPkgVersion()} settings`;
@@ -215,6 +216,35 @@ export function applyExtensionToggle(whitelist, entryPath, on) {
     const rest = whitelist.filter(p => p !== entryPath);
     return on ? [...rest, entryPath] : rest;
 }
+/**
+ * One /task-config toggle per tool in the live session, so the command watchdog
+ * can be turned off for a single tool without unguarding `bash` with it.
+ *
+ * The list is DISCOVERED (see tool-list.ts), never typed: the id carries the
+ * exact tool name pi reports, which is the same string the watchdog matches on.
+ * A tool that is uninstalled simply stops being listed, and a stale name left in
+ * the config matches nothing.
+ */
+const TOOL_ID_PREFIX = 'tool:';
+export function toolItems(tools, exempt) {
+    return tools.map(t => ({
+        id: TOOL_ID_PREFIX + t.name,
+        label: `watch: ${t.name}`,
+        description: `Apply the command timeout to this tool. Leave it on unless the tool runs its own `
+            + `bounded, cancellable work for longer than the timeout — turning it off means a `
+            + `genuine hang in this tool will never be caught, and nothing else is watching `
+            + `while a tool runs. ${t.origin}`,
+        // Stored inverted: the config records the EXEMPTIONS, so an empty list
+        // (and any tool pi-task has never heard of) stays guarded by default.
+        currentValue: exempt.includes(t.name) ? 'off' : 'on',
+        values: ['on', 'off']
+    }));
+}
+/** Apply a per-tool watchdog toggle to the exemption list (idempotent both ways). */
+export function applyToolToggle(exempt, toolName, watched) {
+    const rest = exempt.filter(n => n !== toolName);
+    return watched ? rest : [...rest, toolName];
+}
 /** Overlay width; the list gets `- 4` of it, the description `- 4` again. */
 const OVERLAY_WIDTH = 68;
 /** Settings rows shown at once before the list scrolls. */
@@ -259,7 +289,7 @@ export function createSettingsPanel(items, theme, onChange, onCancel) {
     return new BorderedBox(list, CONFIG_TITLE, s => theme.fg('borderMuted', s), s => theme.fg('accent', theme.bold(s)), settingsBodyHeight(items.map(i => i.description), MAX_VISIBLE, OVERLAY_WIDTH - 8));
 }
 /** The full settings row list for the current config, in menu order. */
-export function panelItems(cfg, installed) {
+export function panelItems(cfg, installed, tools = []) {
     return [
         ...ITEMS.map(({ id, label, description, values }) => ({
             id: id,
@@ -268,17 +298,30 @@ export function panelItems(cfg, installed) {
             currentValue: displayValue(cfg, id, Boolean(values)),
             values: values ?? ['on', 'off']
         })),
+        ...toolItems(tools, cfg.commandTimeoutExemptTools),
         ...extensionItems(installed, cfg.extensionWhitelist)
     ];
 }
-async function handleTaskConfig(_args, ctx) {
-    const cfg = { ...getConfig(), extensionWhitelist: [...getConfig().extensionWhitelist] };
+async function handleTaskConfig(_args, ctx, getTools = () => []) {
+    const cfg = {
+        ...getConfig(),
+        extensionWhitelist: [...getConfig().extensionWhitelist],
+        commandTimeoutExemptTools: [...getConfig().commandTimeoutExemptTools]
+    };
     // Enumerated live at open so an installed extension appears and an
     // uninstalled one vanishes without pi-task doing any bookkeeping. A failed
     // enumeration only costs the extension toggles, never the whole menu.
     const installed = await listInstalledExtensions({ cwd: ctx.cwd }).catch(() => []);
+    // Same contract for tools, and for the same reason — plus one pi-specific
+    // one: getAllTools() throws until the extension runtime is initialized, so
+    // it can only be read here, when the menu opens, never at registration.
+    const tools = getTools();
     if (ctx.mode !== 'tui') {
         const lines = ITEMS.map(({ id, label, values }) => `${label.padEnd(22)} ${displayValue(cfg, id, Boolean(values))}`);
+        for (const t of tools) {
+            const state = cfg.commandTimeoutExemptTools.includes(t.name) ? 'off' : 'on';
+            lines.push(`${('watch: ' + t.name).padEnd(22)} ${state}`);
+        }
         for (const e of installed) {
             const state = cfg.extensionWhitelist.includes(e.path) ? 'on' : 'off';
             lines.push(`${('ext: ' + e.label).padEnd(22)} ${state}`);
@@ -286,10 +329,13 @@ async function handleTaskConfig(_args, ctx) {
         ctx.ui.notify(lines.join('  |  '), 'info');
         return;
     }
-    await ctx.ui.custom((_tui, theme, _kb, done) => createSettingsPanel(panelItems(cfg, installed), theme, (id, newValue) => {
+    await ctx.ui.custom((_tui, theme, _kb, done) => createSettingsPanel(panelItems(cfg, installed, tools), theme, (id, newValue) => {
         if (id.startsWith(EXT_ID_PREFIX)) {
             cfg.extensionWhitelist = applyExtensionToggle(cfg.extensionWhitelist, id.slice(EXT_ID_PREFIX.length), newValue === 'on');
         }
+        else if (id.startsWith(TOOL_ID_PREFIX)) {
+            cfg.commandTimeoutExemptTools = applyToolToggle(cfg.commandTimeoutExemptTools, id.slice(TOOL_ID_PREFIX.length), newValue === 'on');
+        }
         else if (id === 'searchProvider') {
             const provider = providerForLabel(newValue);
             if (provider)
@@ -321,7 +367,11 @@ async function handleTaskConfig(_args, ctx) {
 export function registerConfig(pi) {
     registerBridgeCommand(pi, 'task-config', {
         description: 'Configure pi-task settings (remote control, auto-commit, verify work, enforce '
-            + 'guidelines, research, timeouts, extensions for helper sessions).',
-        handler: handleTaskConfig
+            + 'guidelines, research, timeouts, per-tool command watchdog, extensions for helper '
+            + 'sessions).',
+        // `pi` is closed over rather than taken from ctx: ExtensionCommandContext
+        // has no tool accessor, and the read must happen inside the handler
+        // anyway (getAllTools throws until the runtime is initialized).
+        handler: (args, ctx) => handleTaskConfig(args, ctx, () => listGuardableTools(pi))
     });
 }

package/dist/config/tool-list.d.ts

@@ -0,0 +1,50 @@
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+/**
+ * The tools /task-config offers a command-watchdog toggle for, discovered from
+ * the live session rather than named by hand.
+ *
+ * WHY DISCOVERY AND NOT A HAND-EDITED NAME LIST: the watchdog arms on ANY tool
+ * (see task/command-watchdog.ts), which is correct for `bash` — pi's bash takes
+ * an OPTIONAL `timeout` with no default, so an unbounded command runs forever —
+ * but wrong for an extension tool that already owns a longer, bounded contract
+ * of its own. Those tools get aborted mid-transaction at the generic ceiling.
+ * The operator has to be able to say "not this one", and the only identity that
+ * survives a rename or an uninstall is the one pi itself reports.
+ *
+ * MEASURED against pi 0.83.0 (`pi.getAllTools()`), not assumed:
+ *   - built-ins report `source: "builtin"`, `path: "<builtin:bash>"`
+ *   - extension tools report the extension's real entry-point path — the SAME
+ *     identity `extensionWhitelist` keys on (see extension-list.ts)
+ *   - `getAllTools()` THROWS during extension loading ("Extension runtime not
+ *     initialized"); it is only callable from `session_start` onward, which is
+ *     why this is read when the menu opens and never at registration.
+ *   - `getActiveTools()` is a strict SUBSET (4 of 7 built-ins in a plain
+ *     session), so it is the wrong source: a tool the model isn't currently
+ *     offered is still a tool the watchdog would arm on if it ran.
+ */
+export interface GuardableTool {
+    /** Exact tool name — the watchdog's key, and what the config stores. */
+    name: string;
+    /** Provenance shown in the menu, e.g. "built in" or "npm:pi-fable". */
+    origin: string;
+}
+/**
+ * Every tool in the live session, built-ins first and each extension's tools in
+ * registration order after them, so the menu reads owner-by-owner.
+ *
+ * Pure over the ToolInfo list so the ordering and labelling are unit-testable
+ * without a running pi; {@link listGuardableTools} supplies the live one.
+ */
+export declare function toGuardableTools(tools: readonly {
+    name: string;
+    sourceInfo: {
+        source: string;
+        path: string;
+    };
+}[]): GuardableTool[];
+/**
+ * The live tool list, or `[]` if pi cannot answer. Enumeration failing must cost
+ * only the per-tool rows, never the whole settings menu — the same contract
+ * listInstalledExtensions() has in the command handler.
+ */
+export declare function listGuardableTools(pi: ExtensionAPI): GuardableTool[];

package/dist/config/tool-list.js

@@ -0,0 +1,53 @@
+/** `source` values pi reports for its own tools rather than an extension's. */
+const BUILTIN_SOURCE = 'builtin';
+/**
+ * Human provenance for a tool's source metadata. `source` is pi's own word for
+ * where the owner came from ("builtin", "npm:...", "auto", "cli"); the two
+ * discovery-shaped values are spelled out because "auto" tells the operator
+ * nothing about which extension they are about to unguard.
+ */
+function toolOrigin(source, path) {
+    if (source === BUILTIN_SOURCE)
+        return 'built in';
+    if (source === 'auto')
+        return `discovered (${path})`;
+    if (source === 'cli')
+        return `-e flag (${path})`;
+    return `${source} (${path})`;
+}
+/**
+ * Every tool in the live session, built-ins first and each extension's tools in
+ * registration order after them, so the menu reads owner-by-owner.
+ *
+ * Pure over the ToolInfo list so the ordering and labelling are unit-testable
+ * without a running pi; {@link listGuardableTools} supplies the live one.
+ */
+export function toGuardableTools(tools) {
+    const builtins = [];
+    const rest = [];
+    const seen = new Set();
+    for (const t of tools) {
+        // A duplicate name cannot be told apart by the watchdog (it only ever
+        // sees `toolName`), so a second registration must not add a second row
+        // that silently toggles the first one's guard.
+        if (seen.has(t.name))
+            continue;
+        seen.add(t.name);
+        const entry = { name: t.name, origin: toolOrigin(t.sourceInfo.source, t.sourceInfo.path) };
+        (t.sourceInfo.source === BUILTIN_SOURCE ? builtins : rest).push(entry);
+    }
+    return [...builtins, ...rest];
+}
+/**
+ * The live tool list, or `[]` if pi cannot answer. Enumeration failing must cost
+ * only the per-tool rows, never the whole settings menu — the same contract
+ * listInstalledExtensions() has in the command handler.
+ */
+export function listGuardableTools(pi) {
+    try {
+        return toGuardableTools(pi.getAllTools());
+    }
+    catch {
+        return [];
+    }
+}

package/dist/shared/command-watchdog.d.ts

@@ -18,8 +18,15 @@
  * TIMER STATE MACHINE is identical, and lives here once. What differs is only
  * the `onFire` side effect, which each adapter supplies:
  *
- *   main session — ctx.abort() cancels just that tool call and the session
- *                  survives to receive a follow-up reminder turn.
+ *   main session — ctx.abort() ends the whole agent operation, not just the one
+ *                  tool call (pi types it "Abort the current agent operation"),
+ *                  and pi runs sibling tool calls CONCURRENTLY by default. So an
+ *                  overrun kills every tool in flight in that turn — including
+ *                  one exempted via commandTimeoutExemptTools, which only stops
+ *                  a timer being armed FOR that tool, not its being collateral
+ *                  when a guarded sibling trips. There is no per-call
+ *                  cancellation channel to do better with. The session itself
+ *                  survives to receive the follow-up reminder turn.
  *   child        — there is no per-tool cancellation channel into a child, so
  *                  the whole child is killed and re-spawned with
  *                  {@link commandTimeoutHint} prepended. Coarser by necessity:
@@ -38,6 +45,8 @@ export interface WatchdogDeps {
      * 0 (or any non-positive value) means the watchdog is off and never arms.
      */
     getTimeoutMs: () => number;
+    /** Optional exact policy for tools with their own bounded execution contract. */
+    shouldWatch?: (toolName: string) => boolean;
     schedule: (fn: () => void, ms: number) => TimerHandle;
     cancel: (handle: TimerHandle) => void;
     /** Invoked when a command overruns: each adapter aborts/kills here. */

package/dist/shared/command-watchdog.js

@@ -18,8 +18,15 @@
  * TIMER STATE MACHINE is identical, and lives here once. What differs is only
  * the `onFire` side effect, which each adapter supplies:
  *
- *   main session — ctx.abort() cancels just that tool call and the session
- *                  survives to receive a follow-up reminder turn.
+ *   main session — ctx.abort() ends the whole agent operation, not just the one
+ *                  tool call (pi types it "Abort the current agent operation"),
+ *                  and pi runs sibling tool calls CONCURRENTLY by default. So an
+ *                  overrun kills every tool in flight in that turn — including
+ *                  one exempted via commandTimeoutExemptTools, which only stops
+ *                  a timer being armed FOR that tool, not its being collateral
+ *                  when a guarded sibling trips. There is no per-call
+ *                  cancellation channel to do better with. The session itself
+ *                  survives to receive the follow-up reminder turn.
  *   child        — there is no per-tool cancellation channel into a child, so
  *                  the whole child is killed and re-spawned with
  *                  {@link commandTimeoutHint} prepended. Coarser by necessity:
@@ -105,11 +112,14 @@ export class CommandWatchdog {
     }
     /** Arm a timer for a starting tool. No-op when the watchdog is off. */
     onStart(toolCallId, toolName) {
+        // Disarm first so a live policy/config change cannot leave a timer from
+        // a duplicate start armed after the tool becomes exempt or watchdog-off.
+        this.disarm(toolCallId);
+        if (this.deps.shouldWatch?.(toolName) === false)
+            return;
         const ms = this.deps.getTimeoutMs();
         if (!(ms > 0))
             return;
-        // A duplicate start for the same id must not leak the previous timer.
-        this.disarm(toolCallId);
         const handle = this.deps.schedule(() => this.fire(toolCallId, toolName, ms), ms);
         this.active.set(toolCallId, handle);
     }

package/dist/task/command-watchdog.d.ts

@@ -15,8 +15,11 @@ import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
  * the whole process tree on abort — then a follow-up user turn tells the model
  * what happened so it retries with a timeout instead of hanging again.
  *
- * Tool-agnostic: it arms on ANY tool, honouring "any command can run forever",
- * though in practice only bash runs long enough to trip it.
+ * Tool-agnostic by default: it arms on every tool except exact names listed in
+ * `commandTimeoutExemptTools`, which /task-config fills from the live tool list
+ * (config/tool-list.ts). Exemptions are for tools that already own a bounded
+ * timeout and cancellation contract — the guard's whole justification is that
+ * pi's bash has NO default timeout, which says nothing about a tool that does.
  *
  * SCOPE — this covers the main session ONLY, which is where the implementation
  * turn runs (orchestrator hands the spec off via sendUserMessage). Gate

package/dist/task/command-watchdog.js

@@ -16,8 +16,11 @@ import { CommandWatchdog, realTimerDeps, reminderMessage } from '../shared/comma
  * the whole process tree on abort — then a follow-up user turn tells the model
  * what happened so it retries with a timeout instead of hanging again.
  *
- * Tool-agnostic: it arms on ANY tool, honouring "any command can run forever",
- * though in practice only bash runs long enough to trip it.
+ * Tool-agnostic by default: it arms on every tool except exact names listed in
+ * `commandTimeoutExemptTools`, which /task-config fills from the live tool list
+ * (config/tool-list.ts). Exemptions are for tools that already own a bounded
+ * timeout and cancellation contract — the guard's whole justification is that
+ * pi's bash has NO default timeout, which says nothing about a tool that does.
  *
  * SCOPE — this covers the main session ONLY, which is where the implementation
  * turn runs (orchestrator hands the spec off via sendUserMessage). Gate
@@ -64,6 +67,7 @@ export function registerCommandWatchdog(pi) {
     const ctxByCall = new Map();
     const watchdog = new CommandWatchdog({
         getTimeoutMs: () => getConfig().requestTimeoutMs,
+        shouldWatch: toolName => !getConfig().commandTimeoutExemptTools.includes(toolName),
         ...realTimerDeps,
         onFire: (toolCallId, toolName, timeoutMs) => {
             const ctx = ctxByCall.get(toolCallId);

package/dist/task/owned-freeze-conflict.d.ts

@@ -0,0 +1,95 @@
+import type { OwnedRequirement } from './requirements.js';
+/** A freeze whose scope is a CATEGORY of files, with the paths it carves out. */
+export interface CategoryFreeze {
+    /** The freeze line, verbatim. */
+    constraint: string;
+    /** The paths the category exempts — everything else is frozen. */
+    exempt: string[];
+}
+/**
+ * One unsatisfiable pair, keyed by the REQUIREMENT rather than by the path.
+ *
+ * Grouping matters for the resolution's size. mx5 run 18's TASK_0023 carries
+ * two owned build-contract clauses that between them name three frozen paths;
+ * per-path findings would demand three separate ownership grants (and the same
+ * pair twice over, because that spec states its freeze in CONSTRAINTS and again
+ * in ACCEPTANCE). Per requirement, the rewrite is told which files that one
+ * obligation names and grants only what it needs — which is what keeps
+ * `inv-no-spec-inflation` satisfiable at all.
+ */
+export interface OwnedFreezeConflict {
+    /** The owned requirement line, verbatim. */
+    requirement: string;
+    /** The files it names that this freeze covers. */
+    paths: string[];
+    /** The category freeze line, verbatim. */
+    constraint: string;
+    /** The paths that freeze exempts (the resolution has to widen this, or
+     *  move the requirement to a task whose scope already includes the file). */
+    exempt: string[];
+}
+/**
+ * Backtick-quoted path-shaped tokens in a text, INCLUDING the ones embedded in
+ * a backticked command (`bun run --watch src/server/index.ts` is one backtick
+ * span; the path inside it is what the requirement is about). Route literals
+ * (`/api`) and bare directories survive this filter — the caller decides what
+ * to do with them; `findOwnedFreezeConflicts` keeps only files.
+ */
+export declare function pathTokensIn(text: string): string[];
+/**
+ * Every CATEGORY freeze in the spec: a modification ban (or its passive/only-
+ * form equivalent) scoped to a class of files rather than to named paths. A
+ * freeze that only names paths is `frozen-conflict.ts`'s job, not this one.
+ */
+export declare function findCategoryFreezes(spec: string | null | undefined): CategoryFreeze[];
+/**
+ * The spec lines carrying an AUTHORITATIVE owned requirement: the machine-
+ * stamped ones, plus — when the run's ledger is supplied — any line carrying an
+ * owned quote verbatim (compose folding the quote in itself leaves no stamp).
+ */
+export declare function ownedRequirementLines(spec: string | null | undefined, owned?: OwnedRequirement[]): string[];
+export interface OwnedFreezeOptions {
+    /** The run's owned-requirement ledger, so belt-folded (unstamped) quotes
+     *  count too. Omitted → stamped lines only. */
+    owned?: OwnedRequirement[];
+    /**
+     * Is this repo-relative token an existing SOURCE file of the tree the spec
+     * will run against? Supplied by the caller (compose knows its cwd; the
+     * measured implementation is "tracked by git" — see `trackedSourceOracle`).
+     *
+     * Two false-positive classes die here, both observed at STEP 0 on the real
+     * TASK_0023 spec: route literals and build outputs (`/api`, `dist/`,
+     * `dist/app.css` — named by the very clause that is the true positive, but
+     * not files anyone can edit), and files a task is about to CREATE, which a
+     * freeze on the existing tree does not block. Omitted → every path-shaped
+     * token counts (the broad reading, reported alongside at STEP 0).
+     */
+    isSource?: (p: string) => boolean;
+}
+/**
+ * Every unsatisfiable pair in the composed spec: an AUTHORITATIVE owned
+ * requirement naming a file that a CATEGORY freeze in the same spec forbids
+ * touching. Deterministic, pure text (plus the caller's existence oracle).
+ * Empty when the spec froze no category or carries no owned requirement — the
+ * ordinary single-`/task` case degrades to a no-op.
+ */
+export declare function findOwnedFreezeConflicts(spec: string | null | undefined, opts?: OwnedFreezeOptions): OwnedFreezeConflict[];
+/**
+ * The measured `isSource` oracle: a token counts only when git tracks it in
+ * `cwd`. Tracked ⇒ it exists, it is not a build output, and it is not ignored —
+ * exactly the "source file" the category freezes talk about. `git` missing or
+ * the tree not a repo ⇒ every token counts (the broad reading), so the detector
+ * degrades toward firing rather than toward silent blindness.
+ */
+export declare function trackedSourceOracle(lsFiles: (p: string) => {
+    stdout: string;
+    exitCode: number;
+}): (p: string) => boolean;
+/**
+ * The forced critique-rewrite defect text, in the shape the existing four
+ * families use: MANDATORY, self-contained, naming the exact resolutions. Prose
+ * surrender and silently dropping the requirement are called out as
+ * non-resolutions because narrowing the clause is precisely what run 16 did and
+ * freezing its file is precisely what run 18 did.
+ */
+export declare function ownedFreezeConflictProbeText(conflicts: OwnedFreezeConflict[]): string;

package/dist/task/owned-freeze-conflict.js

@@ -0,0 +1,359 @@
+/**
+ * owned-freeze-conflict — the FIFTH unsatisfiable-pair family (nexttask 7):
+ * an AUTHORITATIVE owned requirement whose file falls inside a CATEGORY freeze
+ * written by the same spec.
+ *
+ * WHY frozen-conflict.ts does not see it (mx5 run 18, TASK_0023). The owned
+ * channel worked: `.pi-tasks/requirements-owned.md` carried the design clause
+ * "**Server:** `bun run --watch src/server/index.ts` — serves `/api` + static
+ * `dist/`." and the composed spec carried it verbatim under CONSTRAINTS, marked
+ * AUTHORITATIVE. The same CONSTRAINTS block then said "Do not modify
+ * `docker-compose.dev.yml`, …, or any source files outside of `package.json`",
+ * and the spec's ACCEPTANCE/VERIFY converted the behavioural half of the clause
+ * ("serves `/api` + static `dist/`") into a string-match on `package.json`. The
+ * only file that could implement it — `src/server/index.ts` — was frozen. The
+ * requirement was structurally unsatisfiable inside its owning task, VERIFY
+ * PASSed honestly, and the app shipped with no static route.
+ *
+ * The existing detector misses this shape twice over (both visible in its own
+ * header): its freeze side needs a NAMED path (`pathNamedIn`), and run 18's
+ * freeze names a CATEGORY ("any source files outside of `package.json`"); its
+ * statement side must match one of four measured phrasing families, and a plain
+ * behavioural claim matches none of them.
+ *
+ * HIGH-PRECISION BY CONSTRUCTION — the statement side needs no NLP:
+ *   - owned requirement lines are MACHINE-MARKED. `appendOwnedConstraints`
+ *     stamps every one it appends with "owned requirement from the source
+ *     design (AUTHORITATIVE; …)"; when compose folded the quote in by itself
+ *     the marker is absent, so the caller may also pass the run's ledger
+ *     entries and the quote is matched verbatim against the spec text.
+ *   - the requirement names its path literally, so the intersection is lexical.
+ *   - category freezes are a small closed lexical set ("any source files
+ *     outside of X", "any files other than X", "only X may be modified",
+ *     "no files outside X").
+ *
+ * ── STATUS: NOT WIRED. The critique seam FAILED its A/B, 2026-08-04. ─────────
+ *
+ * The detector is precise — 1 finding over 58 real composed specs, and it is the
+ * true positive (scripts/owned-freeze-conflict-fp-suite.ts, PASS; STEP 0 in
+ * scripts/owned-vs-freeze-baserate.ts). What failed is the LEVER built on it,
+ * for two independent reasons, both measured:
+ *
+ *  1. THE SEAM IS BLIND IN PRODUCTION. `appendOwnedConstraints` — the BRACES that
+ *     stamp the machine-marked owned bullet this detector keys on — runs AFTER
+ *     `critiqueWithFallback`, inside the `critique` step (phases.ts). When
+ *     critique runs, the stamped line does not exist yet; compose's own folding
+ *     is a PARAPHRASE ("The server watch command must match the contract exactly:
+ *     `…` — serves `/api` + static `dist/`"), so neither the stamp nor the
+ *     verbatim quote is there to match. Live: 0/40 compose drafts carried a
+ *     detectable pair while 11/40 carried the clause semantically. A critique-
+ *     time probe cannot see the shape it was designed for.
+ *  2. THE REWRITE RESOLVES IT BY DELETING THE REQUIREMENT. Forced through the
+ *     controlled critique seam on run 18's real TASK_0023 draft (n=20/arm):
+ *     pair-present 8/20 → 0/20, but the resolution was scoped ownership in only
+ *     9/20 — the other 11/20 removed the AUTHORITATIVE clause outright and
+ *     rationalised it ("this references an existing file; no edits are required
+ *     or permitted"), with 0 of the 11 reassigning it to the task that owns the
+ *     file. VERIFY behaviour-observation was 6/20 in BOTH arms: the delivered
+ *     spec still verifies the requirement by grepping `package.json`.
+ *
+ * Removal of the pair is not satisfaction of the requirement — the same lesson
+ * as the run-16 lever's delivery metric, one level down. Anything built here
+ * next has to act AFTER the braces, where the pair actually exists, and cannot
+ * be a model rewrite: the braces are the last spec-producing step.
+ *
+ * It is a pure text function so the base rate, the FP suite and the live A/B all
+ * measure the same object.
+ */
+import { PROHIBITION_RE } from './prohibition-probe.js';
+import { pathNamedIn } from './frozen-path-guard.js';
+/**
+ * The machine stamp `appendOwnedConstraints` writes on every owned requirement
+ * it appends to CONSTRAINTS. Matching the stamp — not the prose — is what keeps
+ * the statement side free of NLP.
+ */
+const OWNED_MARKER_RE = /owned\s+requirement\s+from\s+the\s+source\s+design/i;
+/**
+ * Modification verbs, shared by the active and passive freeze families. Scoped
+ * to modification exactly as `PROHIBITION_RE` is: a "do not CREATE any files
+ * other than X" line is a creation ban and freezes no existing file, so it must
+ * never be read as a category freeze (mx5 run 18 TASK_0009 ships that line).
+ */
+const MOD_VERB = 'modif|touch|edit|chang|alter|rewrit|overwrit';
+/**
+ * A category noun phrase with an exception: "any source files outside of X",
+ * "any existing file other than X", "no files except X". `\w+` slots absorb the
+ * qualifiers seen in the corpora (source/existing/other), bounded so the phrase
+ * cannot span a whole paragraph.
+ */
+const CATEGORY_NOUN = String.raw `(?:any|no)\s+(?:\w+\s+){0,3}?files?\b`;
+const EXCEPT_KEYWORD = String.raw `(?:outside(?:\s+of)?|other\s+than|except(?:\s+for)?|besides|apart\s+from|beyond)`;
+/**
+ * Active family: a modification ban whose object is the category phrase. The
+ * tempered gap forbids crossing a creation/addition verb, so the compound line
+ * "Do not create any files other than `X` and do not modify `Y`" — where the
+ * category belongs to the CREATE half — cannot be mis-read as a category freeze.
+ */
+const ACTIVE_CATEGORY_RE = new RegExp(String.raw `\b(?:do\s+not|do\s+NOT|don'?t|must\s+not|never)\s+(?:${MOD_VERB})\w*\b`
+    + String.raw `(?:(?!\b(?:creat|add|introduc|generat)\w*\b)[\s\S]){0,200}?`
+    + String.raw `\b${CATEGORY_NOUN}[^\n]{0,40}?\b${EXCEPT_KEYWORD}\b`, 'i');
+/**
+ * Passive family: "No files other than `package.json` are modified." — run 18's
+ * ACCEPTANCE line, identical in force to the CONSTRAINTS freeze above it.
+ */
+const PASSIVE_CATEGORY_RE = new RegExp(String.raw `\b${CATEGORY_NOUN}[^\n]{0,40}?\b${EXCEPT_KEYWORD}\b`
+    + String.raw `[^\n]{0,120}?\b(?:are|is|may|must|should|can|will)\s+(?:be\s+|been\s+)?(?:${MOD_VERB})\w*`, 'i');
+/**
+ * A SCOPED-OWNERSHIP grant — "You MAY edit `X` ONLY to …/ONLY as far as …" —
+ * which is the resolution this detector demands. Whatever else the spec says,
+ * the paths named on such a line are editable, so they can never be the frozen
+ * side of a pair. Without this the rewrite that grants ownership on a NEW line
+ * while leaving the category freeze in place would re-fire forever.
+ */
+const SCOPED_GRANT_RE = new RegExp(String.raw `\b(?:may|can|are\s+allowed\s+to|is\s+allowed\s+to)\s+(?:${MOD_VERB})\w*\b[^\n]{0,80}?\bonly\b`, 'i');
+/** "Only `X` may be modified" / "Only `X` is edited". */
+const ONLY_CATEGORY_RE = new RegExp(String.raw `\bonly\b[^\n]{0,60}?\b(?:may|must|should|can|will|is|are)\s+(?:be\s+)?(?:${MOD_VERB})\w*`, 'i');
+/**
+ * Backtick-quoted path-shaped tokens in a text, INCLUDING the ones embedded in
+ * a backticked command (`bun run --watch src/server/index.ts` is one backtick
+ * span; the path inside it is what the requirement is about). Route literals
+ * (`/api`) and bare directories survive this filter — the caller decides what
+ * to do with them; `findOwnedFreezeConflicts` keeps only files.
+ */
+export function pathTokensIn(text) {
+    return tokensWithOrigin(text).map(t => t.path);
+}
+function tokensWithOrigin(text) {
+    const out = [];
+    const seen = new Set();
+    for (const m of text.matchAll(/`([^`]+)`/g)) {
+        const span = m[1];
+        const fromCommand = /\s/.test(span.trim());
+        for (const raw of span.split(/[\s,;()"']+/)) {
+            const token = raw.trim().replace(/[.,;:]+$/, '');
+            if (token.length === 0 || !/^[\w.@~/-]+$/.test(token))
+                continue;
+            if (!(token.includes('/') || /\.[A-Za-z0-9]+$/.test(token) || token.startsWith('.'))) {
+                continue;
+            }
+            // A leading `/` is a route literal or an absolute path — never a
+            // repo-relative source file, and `/api` is named by the very clause
+            // that is the true positive, so this one is not hypothetical.
+            if (token.startsWith('/'))
+                continue;
+            const n = token.replace(/^\.\//, '').replace(/\/+$/, '');
+            if (n.length === 0 || seen.has(n))
+                continue;
+            seen.add(n);
+            out.push({ path: n, fromCommand });
+        }
+    }
+    return out;
+}
+/**
+ * Does the requirement claim anything about the files it names BEYOND quoting a
+ * command that mentions them?
+ *
+ * This is what separates the two build-contract clauses of mx5 run 18's
+ * TASK_0023, which are otherwise the same shape:
+ *
+ *   "**Client CSS:** `bunx @tailwindcss/cli -i src/client/index.css -o dist/app.css`"
+ *   "**Server:** `bun run --watch src/server/index.ts` — serves `/api` + static `dist/`."
+ *
+ * The first is satisfied by putting that command in `package.json`; nothing
+ * about `src/client/index.css` has to change, so the freeze does not make it
+ * impossible. The second attaches a BEHAVIOURAL claim to the quoted file, and
+ * that claim can only be satisfied inside the file. Prose outside the backtick
+ * spans — minus the label, the anchor tag and the machine marker — is the
+ * signal; two words of it are enough.
+ */
+function hasClaimOutsideCommand(requirement) {
+    const prose = requirement
+        .replace(/`[^`]*`/g, ' ')
+        .replace(/—\s*owned\s+requirement\s+from\s+the\s+source\s+design[\s\S]*$/i, ' ')
+        .replace(/\[[^\]]*\]/g, ' ')
+        .replace(/\*\*[^*]*\*\*/g, ' ')
+        .replace(/^[\s\-"']+/, ' ');
+    const words = prose.match(/\b[A-Za-z][A-Za-z-]{1,}\b/g) ?? [];
+    return words.length >= 2;
+}
+/**
+ * The clause the exception keyword governs: from the keyword to the first
+ * clause break (an em dash, a semicolon, or a sentence end). Everything else on
+ * the line — notably the "— all engine modules (`document.ts`, …) must remain
+ * untouched" tail of gofer-pixel's freeze — is NOT an exemption.
+ */
+function exemptClause(line) {
+    const m = new RegExp(String.raw `\b${EXCEPT_KEYWORD}\b`, 'i').exec(line);
+    if (!m)
+        return null;
+    const rest = line.slice(m.index + m[0].length);
+    const brk = /\s+[—–]\s+|;|\.\s+[A-Z]|\.$/.exec(rest);
+    return brk ? rest.slice(0, brk.index) : rest;
+}
+/**
+ * Every CATEGORY freeze in the spec: a modification ban (or its passive/only-
+ * form equivalent) scoped to a class of files rather than to named paths. A
+ * freeze that only names paths is `frozen-conflict.ts`'s job, not this one.
+ */
+export function findCategoryFreezes(spec) {
+    if (!spec)
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const raw of spec.split('\n')) {
+        const line = raw.trim();
+        if (line.length === 0 || seen.has(line))
+            continue;
+        const isCategory = ACTIVE_CATEGORY_RE.test(line)
+            || PASSIVE_CATEGORY_RE.test(line)
+            || (ONLY_CATEGORY_RE.test(line) && PROHIBITION_RE.test(line) === false);
+        if (!isCategory || SCOPED_GRANT_RE.test(line))
+            continue;
+        const clause = ONLY_CATEGORY_RE.test(line) && exemptClause(line) === null ? line : exemptClause(line);
+        seen.add(line);
+        out.push({ constraint: line, exempt: clause === null ? [] : pathTokensIn(clause) });
+    }
+    return out;
+}
+const basename = (p) => p.slice(p.lastIndexOf('/') + 1);
+/**
+ * Is `p` inside the freeze — i.e. NOT one of the exempted paths, a file under
+ * an exempted directory, or the same file spelled shorter?
+ *
+ * The last clause is load-bearing. gofer-pixel TASK_0011 exempts
+ * `src/components/Canvas.tsx` while its owned requirement quotes the design's
+ * table cell, which says just `Canvas.tsx` — the same file, and the spec is
+ * correctly formed. A bare basename is matched against the exempted paths'
+ * basenames; a path WITH a directory must match exactly or by prefix, so
+ * `src/a/config.ts` never counts as exempted by `src/b/config.ts`.
+ */
+function insideFreeze(p, exempt) {
+    return !exempt.some(e => e === p
+        || p.startsWith(`${e}/`)
+        || pathNamedIn(p, e)
+        || (!p.includes('/') && basename(e) === p));
+}
+/**
+ * The spec lines carrying an AUTHORITATIVE owned requirement: the machine-
+ * stamped ones, plus — when the run's ledger is supplied — any line carrying an
+ * owned quote verbatim (compose folding the quote in itself leaves no stamp).
+ */
+export function ownedRequirementLines(spec, owned = []) {
+    if (!spec)
+        return [];
+    const quotes = owned.map(o => o.quote.trim()).filter(q => q.length > 0);
+    const out = [];
+    const seen = new Set();
+    for (const raw of spec.split('\n')) {
+        const line = raw.trim();
+        if (line.length === 0 || seen.has(line))
+            continue;
+        if (!OWNED_MARKER_RE.test(line) && !quotes.some(q => line.includes(q)))
+            continue;
+        seen.add(line);
+        out.push(line);
+    }
+    return out;
+}
+/**
+ * Every unsatisfiable pair in the composed spec: an AUTHORITATIVE owned
+ * requirement naming a file that a CATEGORY freeze in the same spec forbids
+ * touching. Deterministic, pure text (plus the caller's existence oracle).
+ * Empty when the spec froze no category or carries no owned requirement — the
+ * ordinary single-`/task` case degrades to a no-op.
+ */
+export function findOwnedFreezeConflicts(spec, opts = {}) {
+    if (!spec)
+        return [];
+    const freezes = findCategoryFreezes(spec);
+    if (freezes.length === 0)
+        return [];
+    // Scoped ownership granted ANYWHERE in the spec settles the file, even when
+    // the grant is a line the rewrite added next to an untouched category
+    // freeze — otherwise a correctly resolved spec re-fires forever.
+    const granted = spec
+        .split('\n')
+        .filter(l => SCOPED_GRANT_RE.test(l))
+        .flatMap(l => pathTokensIn(l));
+    const out = [];
+    for (const requirement of ownedRequirementLines(spec, opts.owned)) {
+        // An owned requirement that is itself prohibition-shaped restates the
+        // freeze side; it can never be the thing the freeze makes impossible.
+        if (PROHIBITION_RE.test(requirement))
+            continue;
+        const claim = hasClaimOutsideCommand(requirement);
+        const named = tokensWithOrigin(requirement)
+            .filter(t => claim || !t.fromCommand)
+            .map(t => t.path)
+            .filter(p => !opts.isSource || opts.isSource(p));
+        if (named.length === 0)
+            continue;
+        // One finding per requirement: the FIRST freeze that covers any of its
+        // files. A spec that restates the same freeze under ACCEPTANCE (run 18
+        // does) must not double the rewrite's work.
+        for (const f of freezes) {
+            const paths = named.filter(p => insideFreeze(p, [...f.exempt, ...granted]));
+            if (paths.length === 0)
+                continue;
+            out.push({ requirement, paths, constraint: f.constraint, exempt: f.exempt });
+            break;
+        }
+    }
+    return out;
+}
+/**
+ * The measured `isSource` oracle: a token counts only when git tracks it in
+ * `cwd`. Tracked ⇒ it exists, it is not a build output, and it is not ignored —
+ * exactly the "source file" the category freezes talk about. `git` missing or
+ * the tree not a repo ⇒ every token counts (the broad reading), so the detector
+ * degrades toward firing rather than toward silent blindness.
+ */
+export function trackedSourceOracle(lsFiles) {
+    const cache = new Map();
+    return p => {
+        const hit = cache.get(p);
+        if (hit !== undefined)
+            return hit;
+        const r = lsFiles(p);
+        const ok = r.exitCode !== 0 ? true : r.stdout.trim().length > 0;
+        cache.set(p, ok);
+        return ok;
+    };
+}
+/**
+ * The forced critique-rewrite defect text, in the shape the existing four
+ * families use: MANDATORY, self-contained, naming the exact resolutions. Prose
+ * surrender and silently dropping the requirement are called out as
+ * non-resolutions because narrowing the clause is precisely what run 16 did and
+ * freezing its file is precisely what run 18 did.
+ */
+export function ownedFreezeConflictProbeText(conflicts) {
+    const items = conflicts.map(c => `- the spec carries the AUTHORITATIVE owned requirement `
+        + `"${c.requirement.slice(0, 200)}", which names ${c.paths.map(p => `\`${p}\``).join(', ')} — `
+        + `and the spec FREEZES ${c.paths.length > 1 ? 'those files' : 'that file'} with a CATEGORY freeze `
+        + `("${c.constraint.slice(0, 160)}"`
+        + (c.exempt.length > 0 ?
+            `, which exempts only ${c.exempt.map(e => `\`${e}\``).join(', ')}`
+            : '')
+        + ')');
+    return [
+        'UNSATISFIABLE-CONSTRAINT FINDING (deterministic; MUST be resolved, it overrides a CLEAN triage):',
+        ...items,
+        'An owned requirement is AUTHORITATIVE: it comes from the source design and this task',
+        'owns it. A category freeze that covers the only file which could satisfy it makes the',
+        'requirement structurally impossible INSIDE THIS TASK, and the task will still pass its',
+        'own VERIFY — because VERIFY can then only assert strings in the files it is allowed to',
+        'touch. Narrowing the requirement to what the unfrozen files can express, or dropping it,',
+        'is NOT a resolution.',
+        'REWRITE the spec to resolve it in exactly ONE of these two ways:',
+        '  (a) SCOPED OWNERSHIP — widen the category freeze for that file only:',
+        '      "You MAY edit `<path>` ONLY as far as the owned requirement requires; any other',
+        '      change to `<path>` is forbidden." Then make ACCEPTANCE state the requirement\'s',
+        '      BEHAVIOUR and make VERIFY exercise that behaviour, not the presence of a string.',
+        '  (b) REASSIGN — state that the owned requirement is not satisfiable in this task and',
+        "      belongs to the task that owns `<path>`, and remove it from this spec's",
+        '      CONSTRAINTS/ACCEPTANCE so it is not falsely claimed as met here.',
+        'Never ship both the category freeze and the owned requirement it makes impossible.'
+    ].join('\n');
+}

package/dist/task/phases.d.ts

@@ -132,7 +132,18 @@ export interface PhaseAutoAnswerDeps {
 export declare function phaseAutoAnswer(deps: PhaseDeps, refined: string, research: string, question: string, autoDeps?: PhaseAutoAnswerDeps): Promise<AutoAnswer>;
 export declare function phaseGrill(deps: PhaseDeps, ctx: ExtensionCommandContext, widgetState: WidgetState, refined: string, research: string): Promise<string>;
 export declare function phaseCompose(deps: PhaseDeps, refined: string, research: string, qa: string): Promise<string>;
-export declare function phaseCritique(deps: PhaseDeps, spec: string, refined: string, qa: string, planContext?: string, research?: string): Promise<string>;
+export declare function phaseCritique(deps: PhaseDeps, spec: string, refined: string, qa: string, planContext?: string, research?: string, 
+/**
+ * An additional deterministic defect block, forced into the rewrite exactly
+ * like the probes below and overriding a CLEAN triage the same way.
+ *
+ * This is the A/B seam for a probe that is not wired yet: the discipline
+ * here is "wire only on PASS" (memory/prompt4-spec-urls-failed.md), so a
+ * candidate probe has to be measurable through the SHIPPED critique path
+ * rather than through a hand-copied replica of it, or the two arms differ by
+ * more than the probe. Undefined in production.
+ */
+extraDefects?: string | null): Promise<string>;
 export declare function critiqueWithFallback(d: PhaseDeps, p: PhaseContext): Promise<string>;
 export declare const PHASES: PhaseConfig[];
 export declare function postCommitPhase(phase: PhaseConfig, deps: PhaseDeps, pc: PhaseContext, out: string): Promise<void>;

package/dist/task/phases.js

@@ -1269,7 +1269,18 @@ export async function phaseCompose(deps, refined, research, qa) {
         return { ok: true, value: stripped };
     }, problem => new Error(`compose_invalid: ${problem}`));
 }
-export async function phaseCritique(deps, spec, refined, qa, planContext, research) {
+export async function phaseCritique(deps, spec, refined, qa, planContext, research, 
+/**
+ * An additional deterministic defect block, forced into the rewrite exactly
+ * like the probes below and overriding a CLEAN triage the same way.
+ *
+ * This is the A/B seam for a probe that is not wired yet: the discipline
+ * here is "wire only on PASS" (memory/prompt4-spec-urls-failed.md), so a
+ * candidate probe has to be measurable through the SHIPPED critique path
+ * rather than through a hand-copied replica of it, or the two arms differ by
+ * more than the probe. Undefined in production.
+ */
+extraDefects) {
     // Fast triage before the expensive full rewrite. The rewrite regenerates
     // the entire spec from scratch and is the costliest tail of the pipeline
     // (observed up to ~240s). Most compose drafts are already good, so we first
@@ -1392,7 +1403,8 @@ export async function phaseCritique(deps, spec, refined, qa, planContext, resear
                     && absenceProbe === null
                     && frozenProbe === null
                     && grepOnlyProbe === null
-                    && scriptProbe === null) {
+                    && scriptProbe === null
+                    && (extraDefects ?? null) === null) {
                     return spec;
                 }
             }
@@ -1411,6 +1423,7 @@ export async function phaseCritique(deps, spec, refined, qa, planContext, resear
         frozenProbe,
         grepOnlyProbe,
         scriptProbe,
+        extraDefects ?? null,
         triageDefects
     ]
         .filter(Boolean)

package/dist/task/verify-quality.d.ts

@@ -11,6 +11,29 @@ export interface GrepOnlyVerifyFinding {
  * source (doc/config-only tasks).
  */
 export declare function findGrepOnlyVerify(spec: string): GrepOnlyVerifyFinding[];
+/** One VERIFY command, classified by what it can observe. */
+export interface VerifyCommandClass {
+    /** The command line, verbatim. */
+    raw: string;
+    /** Every pipeline segment is a STATIC head (grep/test/tsc/…) — it inspects
+     *  files and can never observe the deliverable's behaviour. */
+    staticOnly: boolean;
+    /**
+     * The command observes RUNTIME behaviour: an HTTP request, a port probe, a
+     * process it starts and watches. This is the distinction nexttask 7's M3
+     * turns on — mx5 run 18's TASK_0023 VERIFY is all `node -e "…package.json…"`,
+     * which EXECUTES node yet can only assert that a string is present in a
+     * config file, and the behavioural half of the owned requirement ("serves
+     * `/api` + static `dist/`") is exactly what it cannot see.
+     */
+    observesBehaviour: boolean;
+}
+/**
+ * Classify each command of a spec's VERIFY block. Shares `segmentHead` with the
+ * grep-theater detector, so "static" means one thing across the two measures.
+ * Empty when the spec has no runnable VERIFY block.
+ */
+export declare function classifyVerifyCommands(spec: string): VerifyCommandClass[];
 /**
  * Retry hint when the critique rewrite KEPT the grep-theater block it was told
  * to fix (live A/B: 1/5 rewrites ignored the injected defect). Prepended to the

package/dist/task/verify-quality.js

@@ -148,6 +148,28 @@ export function findGrepOnlyVerify(spec) {
     }
     return [...inspected.entries()].map(([target, lines]) => ({ target, lines }));
 }
+const BEHAVIOUR_RE = /\bcurl\b|\bwget\b|\bhttpie?\b|https?:\/\/|\bnc\s+-z\b|\bss\s+-|\blsof\b|127\.0\.0\.1|localhost|\bplaywright\b|\bfetch\(/i;
+/**
+ * Classify each command of a spec's VERIFY block. Shares `segmentHead` with the
+ * grep-theater detector, so "static" means one thing across the two measures.
+ * Empty when the spec has no runnable VERIFY block.
+ */
+export function classifyVerifyCommands(spec) {
+    const cmds = parseVerifyBlock(spec);
+    if (!cmds)
+        return [];
+    return cmds.map(({ raw }) => {
+        let staticOnly = true;
+        for (const segment of raw.split(/&&|\|\||;|\|/)) {
+            const s = segmentHead(segment);
+            if (s === null)
+                continue;
+            if (!STATIC_HEADS.has(s.head))
+                staticOnly = false;
+        }
+        return { raw, staticOnly, observesBehaviour: BEHAVIOUR_RE.test(raw) };
+    });
+}
 /**
  * Retry hint when the critique rewrite KEPT the grep-theater block it was told
  * to fix (live A/B: 1/5 rewrites ignored the injected defect). Prepended to the

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.28.2",
+    "version": "0.29.0",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",