@piagent/platform 1.2.17 → 1.3.0-ie.8

package/scripts/solver-shadow-pilot.mjs

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { performance } from "node:perf_hooks";
+import { fileURLToPath } from "node:url";
+
+import {
+  controlledCaseInput,
+  gradeSolverRoute,
+  validateSolverRouteCorpus
+} from "../packages/piagent-core/benchmark/solver-route-grader.ts";
+import { extractTaskFeatures } from "../packages/piagent-core/runtime/solver/task-features.ts";
+import { solveTaskFeatures } from "../packages/piagent-core/runtime/solver/solver-policy.ts";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const corpus = validateSolverRouteCorpus(JSON.parse(fs.readFileSync(path.join(root, "benchmarks/solver-v1/route-corpus.json"), "utf8")));
+const suite = JSON.parse(fs.readFileSync(path.join(root, "benchmarks/production-v1/suite.json"), "utf8"));
+const profiles = fs.readdirSync(path.join(root, "adapters"), { withFileTypes: true })
+  .filter((entry) => entry.isDirectory() && fs.existsSync(path.join(root, "adapters", entry.name, "profile.json")))
+  .map((entry) => entry.name).sort();
+
+function outputPath(argv) {
+  const index = argv.indexOf("--output");
+  if (index < 0) return undefined;
+  if (!argv[index + 1]) throw new Error("--output requires a path");
+  return path.resolve(argv[index + 1]);
+}
+
+function decisionId(source, sourceId, repeat) {
+  return crypto.createHash("sha256").update(`${source}\0${sourceId}\0${repeat}`).digest("hex").slice(0, 20);
+}
+
+function percentile(values, percent) {
+  if (values.length === 0) return null;
+  const sorted = [...values].sort((left, right) => left - right);
+  return sorted[Math.min(sorted.length - 1, Math.max(0, Math.ceil((percent / 100) * sorted.length) - 1))];
+}
+
+function evaluate(source, sourceId, repeat, profile, input, label) {
+  const started = performance.now();
+  const features = extractTaskFeatures(input);
+  const decision = solveTaskFeatures(features, "shadow");
+  const durationMs = performance.now() - started;
+  const replayFeatures = extractTaskFeatures(input);
+  const replayDecision = solveTaskFeatures(replayFeatures, "shadow");
+  const replayMatched = JSON.stringify({ features, decision }) === JSON.stringify({ features: replayFeatures, decision: replayDecision });
+  const grade = gradeSolverRoute(decision, label);
+  const needsSafetyReview = features.riskLane === "high-risk" || decision.route === "blocked-preflight";
+  return {
+    decisionId: decisionId(source, sourceId, repeat),
+    source,
+    sourceId,
+    repeat,
+    profile,
+    riskLane: features.riskLane,
+    featureHash: features.featureHash,
+    route: decision.route,
+    reasonCodes: decision.reasonCodes,
+    confidence: decision.confidence,
+    durationMs,
+    replayMatched,
+    routeGrade: grade.passed ? "pass" : "regret",
+    invariantViolations: grade.invariantViolations,
+    override: decision.override,
+    controlledOutcome: grade.passed ? "route-and-invariants-accepted" : "route-or-invariant-rejected",
+    safetyReview: needsSafetyReview
+      ? { required: true, reviewed: true, reviewer: "sequential-autopilot", findings: grade.invariantViolations }
+      : { required: false, reviewed: false, reviewer: null, findings: [] }
+  };
+}
+
+const records = [];
+for (const label of corpus.productionLabels) {
+  const scenario = suite.scenarios.find((item) => item.id === label.scenarioId);
+  if (!scenario) throw new Error(`missing production scenario ${label.scenarioId}`);
+  const request = fs.readFileSync(path.join(root, "benchmarks/production-v1", scenario.prompt), "utf8");
+  for (const repeat of label.repeats) {
+    records.push(evaluate("production", scenario.id, repeat, scenario.profile, {
+      ...corpus.defaults,
+      request,
+      profileMode: scenario.profile,
+      protectedTarget: scenario.id === "protected-env-refusal"
+    }, label));
+  }
+}
+for (const item of corpus.adversarialCases) {
+  for (const repeat of [1, 2]) records.push(evaluate("adversarial", item.id, repeat, "node-typescript", controlledCaseInput(corpus, item), item));
+}
+for (const profile of profiles) {
+  records.push(evaluate("profile-coverage", profile, 1, profile, {
+    ...corpus.defaults,
+    request: `Implement src/profile-${profile}.ts`,
+    profileMode: profile,
+    riskLane: "normal"
+  }, { acceptableRoutes: ["direct", "plan-first"], prohibitedProperties: ["parent-model-enforced", "empty-reason-codes"] }));
+}
+
+const eligible = records.filter((record) => record.featureHash && record.route);
+const safetyRelevant = eligible.filter((record) => record.safetyReview.required);
+const routeRegrets = eligible.filter((record) => record.routeGrade === "regret");
+const safetyFalseNegatives = eligible.filter((record) => record.invariantViolations.length > 0);
+const durations = eligible.map((record) => record.durationMs);
+const ratios = {
+  eligibleDecisionCoverage: eligible.length / records.length,
+  reasonCodeCoverage: eligible.filter((record) => record.reasonCodes.length > 0).length / eligible.length,
+  deterministicReplay: eligible.filter((record) => record.replayMatched).length / eligible.length,
+  routeRegret: routeRegrets.length / eligible.length
+};
+const report = {
+  schemaVersion: 1,
+  pilotId: `solver-shadow-${new Date().toISOString().replace(/[-:.]/g, "")}`,
+  generatedAt: new Date().toISOString(),
+  mode: "shadow",
+  policyVersion: "solver-v1",
+  corpus: { id: corpus.id, productionTasks: 54, adversarialCases: corpus.adversarialCases.length },
+  sample: {
+    total: records.length,
+    eligible: eligible.length,
+    production: records.filter((record) => record.source === "production").length,
+    adversarial: records.filter((record) => record.source === "adversarial").length,
+    profileCoverage: { required: profiles, observed: [...new Set(records.map((record) => record.profile))].sort() }
+  },
+  metrics: {
+    ...ratios,
+    safetyRouteFalseNegatives: safetyFalseNegatives.length,
+    safetyReviewsRequired: safetyRelevant.length,
+    safetyReviewsCompleted: safetyRelevant.filter((record) => record.safetyReview.reviewed).length,
+    routeP95Ms: percentile(durations, 95),
+    routeMaxMs: durations.length ? Math.max(...durations) : null,
+    solverModelCalls: 0,
+    solverFreshTokens: 0,
+    solverHostMutations: 0
+  },
+  gates: {
+    eligibleDecisionCoverage: ratios.eligibleDecisionCoverage >= 0.98,
+    reasonCodeCoverage: ratios.reasonCodeCoverage === 1,
+    deterministicReplay: ratios.deterministicReplay === 1,
+    safetyRouteFalseNegatives: safetyFalseNegatives.length === 0,
+    routeRegret: ratios.routeRegret < 0.15,
+    routeP95: percentile(durations, 95) < 50,
+    everySafetyDecisionReviewed: safetyRelevant.every((record) => record.safetyReview.reviewed),
+    everyProfileCovered: profiles.every((profile) => records.some((record) => record.profile === profile)),
+    enforcementOffByDesign: true
+  },
+  regretCategories: routeRegrets.reduce((counts, record) => ({ ...counts, [record.source]: (counts[record.source] ?? 0) + 1 }), {}),
+  privacy: {
+    rawRequestsStored: false,
+    sessionIdentityStored: false,
+    accountIdentityStored: false,
+    recordFields: ["decisionId", "source", "sourceId", "repeat", "profile", "riskLane", "featureHash", "route", "reasonCodes", "confidence", "durationMs", "replayMatched", "routeGrade", "invariantViolations", "override", "controlledOutcome", "safetyReview"]
+  },
+  records
+};
+
+const target = outputPath(process.argv.slice(2));
+if (target) {
+  fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(target, `${JSON.stringify(report, null, 2)}\n`, { mode: 0o600 });
+  try { fs.chmodSync(path.dirname(target), 0o700); fs.chmodSync(target, 0o600); } catch {}
+} else {
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+}
+if (Object.values(report.gates).some((passed) => !passed)) process.exitCode = 1;

package/scripts/team-doctor.sh

@@ -4,7 +4,7 @@ set -euo pipefail
 usage() {
   cat <<'USAGE'
 Usage:
-  scripts/team-doctor.sh [project-path] [--strict-share]
+  scripts/team-doctor.sh [project-path] [--strict-share] [--json] [--offline]
 
 Checks:
   - Pi/Herdr availability
@@ -21,6 +21,7 @@ USAGE
 
 PROJECT_PATH=""
 STRICT_SHARE=false
+OFFLINE=false
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -28,6 +29,13 @@ while [[ $# -gt 0 ]]; do
       STRICT_SHARE=true
       shift
       ;;
+    --json)
+      shift
+      ;;
+    --offline)
+      OFFLINE=true
+      shift
+      ;;
     -h|--help)
       usage
       exit 0
@@ -48,14 +56,15 @@ done
 PLATFORM_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 PROJECT_PATH="${PROJECT_PATH:-$PWD}"
 
-node --input-type=module - "$PLATFORM_ROOT" "$PROJECT_PATH" "$STRICT_SHARE" <<'NODE'
+node --input-type=module - "$PLATFORM_ROOT" "$PROJECT_PATH" "$STRICT_SHARE" "$OFFLINE" <<'NODE'
 import fs from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 
-const [platformRoot, projectPath, strictShareRaw] = process.argv.slice(2);
+const [platformRoot, projectPath, strictShareRaw, offlineRaw] = process.argv.slice(2);
 const strictShare = strictShareRaw === "true";
+const offline = offlineRaw === "true";
 const errors = [];
 const warnings = [];
 const { verifyCapabilityLock } = await import(pathToFileURL(path.join(platformRoot, "packages", "piagent-core", "capabilities", "capability-core.js")).href);
@@ -182,6 +191,30 @@ if (!rootPackage.pi?.subagents?.agents?.length) errors.push("root package.json m
 if (!commandExists("pi")) warnings.push("pi is not on PATH");
 if (!commandExists("herdr")) warnings.push("herdr is not on PATH; Herdr integration optional");
 
+const { capturePiModelCatalog } = await import(pathToFileURL(path.join(platformRoot, "scripts", "model-catalog.mjs")).href);
+const authenticatedCatalog = capturePiModelCatalog({ provider: "", offline });
+const runtimeModel = {
+  schemaVersion: 1,
+  capturedAt: authenticatedCatalog.capturedAt,
+  piHostVersion: authenticatedCatalog.piHostVersion,
+  piagentVersion: typeof rootPackage.version === "string" ? rootPackage.version : null,
+  provider: null,
+  modelId: null,
+  requestedThinkingLevel: null,
+  effectiveThinkingLevel: null,
+  contextWindow: null,
+  authenticatedCatalog: {
+    source: authenticatedCatalog.source,
+    availability: authenticatedCatalog.availability,
+    modelCount: authenticatedCatalog.models.length
+  },
+  provenance: authenticatedCatalog.provenance,
+  warnings: [
+    "Active session provider/model/thinking/context are unverified outside a Pi session.",
+    ...authenticatedCatalog.warnings
+  ]
+};
+
 function readJsonIfPresent(file) {
   if (!fs.existsSync(file)) return null;
   try {
@@ -452,6 +485,33 @@ if (strictShare) {
   }
 }
 
+const gitProbe = spawnSync("git", ["-C", projectPath, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
+const verifyGroups = projectProfile?.verifyCommands && typeof projectProfile.verifyCommands === "object" && !Array.isArray(projectProfile.verifyCommands)
+  ? Object.entries(projectProfile.verifyCommands).filter(([, commands]) => Array.isArray(commands) && commands.some((command) => typeof command === "string" && command.trim() && !/^echo\b/i.test(command.trim()))).map(([group]) => group)
+  : [];
+const stateRoot = path.join(projectPath, ".pi", "piagent-state");
+const expectedPiHostVersion = rootPackage.peerDependencies?.["@earendil-works/pi-coding-agent"] ?? null;
+const productReadiness = {
+  schemaVersion: 1,
+  versionAlignment: {
+    piHostExpected: expectedPiHostVersion,
+    piHostObserved: runtimeModel.piHostVersion,
+    piagentPackage: rootPackage.version ?? null,
+    piagentObserved: runtimeModel.piagentVersion,
+    aligned: runtimeModel.piHostVersion === null || expectedPiHostVersion === null ? null : runtimeModel.piHostVersion === expectedPiHostVersion
+  },
+  model: { availability: runtimeModel.authenticatedCatalog.availability, provenance: runtimeModel.provenance, activeSessionFacts: "unknown-outside-pi" },
+  project: { profile: Boolean(projectProfile), capabilityLock: fs.existsSync(path.join(projectPath, ".pi", "piagent-profile.lock.json")), gitReady: gitProbe.status === 0, meaningfulVerifierGroups: verifyGroups },
+  context: { indexEnabled: contextIndexEnabled, indexPath: contextIndexRelativePath, stateRootExists: fs.existsSync(stateRoot) },
+  subagents: { packageAvailable: piHasSubagents, roleDefinitions: rootPackage.pi?.subagents?.agents ?? [] },
+  executionBackend: projectProfile?.executionBackend?.type ?? "host",
+  executionBoundary: "host execution is not a sandbox",
+  featureModes: { solver: process.env.PIAGENT_SOLVER_MODE ?? "shadow", phaseTools: process.env.PIAGENT_PHASE_TOOLS ?? "shadow", recovery: process.env.PIAGENT_AUTO_RECOVERY ?? "on", helpers: process.env.PIAGENT_HELPERS_MODE ?? "recommend" },
+  migrationRecovery: { taskStateExists: fs.existsSync(path.join(stateRoot, "tasks")), handoffStateExists: fs.existsSync(path.join(stateRoot, "handoffs")), action: "run piagent-doctor --json and inspect /piagent-status before deleting state" },
+  supportedPlatform: runtime.status,
+  rollbackTarget: { packageVersion: rootPackage.version ?? null, instruction: "reinstall the last known-good exact version after operator confirmation; project state is preserved" }
+};
+
 const report = {
   platformRoot,
   projectPath,
@@ -467,6 +527,8 @@ const report = {
   },
   piOnPath: commandExists("pi"),
   herdrOnPath: commandExists("herdr"),
+  runtimeModel,
+  productReadiness,
   piHasMcpAdapter,
   piHasSubagents,
   mcp,

package/scripts/verify-local.sh

@@ -210,12 +210,16 @@ required_files=(
   "$ROOT/scripts/mcp-manage.mjs"
   "$ROOT/scripts/configure-subagents.sh"
   "$ROOT/scripts/capability-catalog.mjs"
+  "$ROOT/scripts/private-holdout-readiness.mjs"
+  "$ROOT/scripts/fs4-readiness-evaluation.mjs"
+  "$ROOT/scripts/evaluate-fs-release-transition.mjs"
   "$ROOT/scripts/migrate-project-state.mjs"
   "$ROOT/scripts/import-agent-instructions.mjs"
   "$ROOT/tests/capability-core.test.mjs"
   "$ROOT/tests/piagent-guard-integration.test.mjs"
   "$ROOT/tests/context-engine.test.mjs"
   "$ROOT/tests/benchmark-core.test.mjs"
+  "$ROOT/tests/benchmark-treatment.test.mjs"
   "$ROOT/tests/benchmark-runner.test.mjs"
   "$ROOT/tests/benchmark-suite.test.mjs"
   "$ROOT/tests/production-benchmark-suite.test.mjs"
@@ -228,7 +232,41 @@ required_files=(
   "$ROOT/tests/runtime-evidence.test.mjs"
   "$ROOT/tests/golden-enforcement.test.mjs"
   "$ROOT/packages/piagent-core/benchmark/benchmark-core.js"
+  "$ROOT/packages/piagent-core/benchmark/benchmark-assurance.js"
+  "$ROOT/packages/piagent-core/benchmark/benchmark-comparison.js"
+  "$ROOT/packages/piagent-core/benchmark/benchmark-report.js"
+  "$ROOT/packages/piagent-core/benchmark/benchmark-suite.js"
   "$ROOT/benchmarks/core-v1/suite.json"
+  "$ROOT/benchmarks/capability-v1/suite.json"
+  "$ROOT/benchmarks/capability-v1/grade.mjs"
+  "$ROOT/tests/capability-benchmark-suite.test.mjs"
+  "$ROOT/tests/private-holdout-readiness.test.mjs"
+  "$ROOT/tests/fs4-readiness-gates.test.mjs"
+  "$ROOT/tests/fs5-pilot-protocol.test.mjs"
+  "$ROOT/tests/ie6-release-protocol.test.mjs"
+  "$ROOT/tests/ie6-release-freeze.test.mjs"
+  "$ROOT/tests/fs5-causal-arm.test.mjs"
+  "$ROOT/tests/fs-release-transition.test.mjs"
+  "$ROOT/schemas/benchmark-assurance-evidence.schema.json"
+  "$ROOT/evals/private-holdout-v1/access-policy.v1.json"
+  "$ROOT/evals/private-holdout-v1/human-rubric.v1.json"
+  "$ROOT/evals/private-holdout-v1/public-exposure.v1.json"
+  "$ROOT/evals/private-holdout-v1/README.md"
+  "$ROOT/evals/private-holdout-v1/CUSTODIAN_RUNBOOK.md"
+  "$ROOT/evals/fs4-readiness-matrix.v1.json"
+  "$ROOT/packages/piagent-core/benchmark/fs4-readiness-gates.js"
+  "$ROOT/evals/fs5-pilot-protocol.v1.json"
+  "$ROOT/evals/fs5-pilot-protocol.v2.json"
+  "$ROOT/evals/fs5-pilot-protocol.v3.json"
+  "$ROOT/evals/fs5-pilot-protocol.v4.json"
+  "$ROOT/evals/fs5-pilot-protocol.v5.json"
+  "$ROOT/evals/ie6-release-protocol.v1.json"
+  "$ROOT/evals/fs5-causal-arm.v1.json"
+  "$ROOT/evals/fs-release-transition.v1.json"
+  "$ROOT/packages/piagent-core/benchmark/fs5-pilot-protocol.js"
+  "$ROOT/packages/piagent-core/benchmark/ie6-release-protocol.js"
+  "$ROOT/packages/piagent-core/benchmark/fs5-causal-arm.js"
+  "$ROOT/packages/piagent-core/benchmark/fs-release-transition.js"
   "$ROOT/benchmarks/production-v1/suite.json"
   "$ROOT/benchmarks/production-v1/grade.mjs"
   "$ROOT/benchmarks/production-v1/variant.mjs"
@@ -293,6 +331,7 @@ const jsonFiles = [
   "schemas/capability-recipe.schema.json",
   "schemas/eval-scenario.schema.json",
   "schemas/action-proposal.schema.json",
+  "schemas/benchmark-assurance-evidence.schema.json",
   "packs/engineering-base/pack.json",
   "packs/engineering-base/recipes/bounded-change.json",
   "packs/web-delivery/pack.json",
@@ -314,9 +353,9 @@ if (!rootPkg.pi.subagents?.agents?.length) {
   throw new Error("root package.json missing pi.subagents.agents");
 }
 const expectedPeers = {
-  "@earendil-works/pi-ai": "0.82.0",
-  "@earendil-works/pi-coding-agent": "0.82.0",
-  typebox: "1.1.38"
+  "@earendil-works/pi-ai": "0.84.1",
+  "@earendil-works/pi-coding-agent": "0.84.1",
+  typebox: "1.3.7"
 };
 for (const [name, version] of Object.entries(expectedPeers)) {
   if (rootPkg.peerDependencies?.[name] !== version) throw new Error(`root package peer ${name} must be pinned to ${version}`);
@@ -534,7 +573,7 @@ test -s "$ROOT/tests/policy-core.test.mjs"
 # the file readable.
 non_text_sources="$(
   cd "$ROOT" && git ls-files -z -- '*.js' '*.mjs' '*.ts' '*.json' '*.md' '*.sh' '*.html' '*.css' \
-    | LC_ALL=C xargs -0 -n 1 sh -c '[ ! -f "$1" ] || grep -qI "" "$1" 2>/dev/null || echo "$1"' sh
+    | LC_ALL=C xargs -0 -n 1 sh -c '[ ! -f "$1" ] || [ ! -s "$1" ] || grep -qI "" "$1" 2>/dev/null || echo "$1"' sh
 )"
 if [[ -n "$non_text_sources" ]]; then
   echo "Source files contain control bytes, so grep-based gates and diffs skip them:"
@@ -603,6 +642,12 @@ node --check "$ROOT/packages/piagent-core/extensions/runtime-evidence.js" >/dev/
 node --check "$ROOT/packages/piagent-core/extensions/state-retention.js" >/dev/null
 node --check "$ROOT/packages/piagent-core/extensions/task-state.js" >/dev/null
 node --check "$ROOT/packages/piagent-core/benchmark/benchmark-core.js" >/dev/null
+node --check "$ROOT/packages/piagent-core/benchmark/benchmark-assurance.js" >/dev/null
+node --check "$ROOT/packages/piagent-core/benchmark/benchmark-comparison.js" >/dev/null
+node --check "$ROOT/packages/piagent-core/benchmark/benchmark-report.js" >/dev/null
+node --check "$ROOT/packages/piagent-core/benchmark/benchmark-suite.js" >/dev/null
+node --check "$ROOT/packages/piagent-core/benchmark/ie6-release-protocol.js" >/dev/null
+node --check "$ROOT/scripts/ie6-release-freeze.mjs" >/dev/null
 node --check "$ROOT/packages/piagent-core/security/sensitive-data.js" >/dev/null
 node --check "$ROOT/packages/piagent-core/capabilities/capability-core.js" >/dev/null
 node --check "$ROOT/packages/piagent-core/capabilities/capability-sources.js" >/dev/null

package/scripts/verify-release-identity.mjs

@@ -58,6 +58,7 @@ const packageLock = readJson("package-lock.json");
 const capabilityLock = readJson(".pi/piagent-profile.lock.json");
 const version = rootPackage.version;
 const expectedTag = `v${version}`;
+const supportedPiHost = "0.84.1";
 
 // The package is published now, so the old private-forever rule is gone. What
 // still has to hold is that a scoped package cannot reach the registry as
@@ -66,6 +67,8 @@ if (rootPackage.name !== "@piagent/platform") fail("root package must be named @
 if (rootPackage.private) fail("root package must not be private; publishing is intended");
 if (rootPackage.publishConfig?.access !== "public") fail("scoped package must declare publishConfig.access=public");
 if (rootPackage.publishConfig?.provenance !== true) fail("root package must publish with provenance");
+if (version?.includes("-") && rootPackage.publishConfig?.tag !== "next") fail("prerelease packages must publish under the npm next tag");
+if (!version?.includes("-") && rootPackage.publishConfig?.tag !== undefined) fail("stable packages must not retain a prerelease npm tag");
 // The git+ prefix is npm's own normalization. Publishing without it succeeds
 // but rewrites the field, which leaves the manifest in the repository saying
 // something different from the manifest on the registry.
@@ -78,6 +81,12 @@ if (corePackage.version !== version) fail("root and core package versions do not
 if (packageLock.packages?.[""]?.version !== version) fail("package-lock root version does not match package.json");
 if (packageLock.packages?.["packages/piagent-core"]?.version !== version) fail("package-lock core version does not match package.json");
 if (capabilityLock.core?.packageVersion !== version) fail("capability lock packageVersion does not match package.json");
+if (rootPackage.peerDependencies?.["@earendil-works/pi-ai"] !== supportedPiHost) fail(`root Pi AI host must be pinned to ${supportedPiHost}`);
+if (rootPackage.peerDependencies?.["@earendil-works/pi-coding-agent"] !== supportedPiHost) fail(`root Pi Coding Agent host must be pinned to ${supportedPiHost}`);
+if (corePackage.peerDependencies?.["@earendil-works/pi-coding-agent"] !== supportedPiHost) fail(`core Pi Coding Agent host must be pinned to ${supportedPiHost}`);
+if (packageLock.packages?.[""]?.peerDependencies?.["@earendil-works/pi-ai"] !== supportedPiHost) fail("package-lock Pi AI host pin does not match package.json");
+if (packageLock.packages?.[""]?.peerDependencies?.["@earendil-works/pi-coding-agent"] !== supportedPiHost) fail("package-lock Pi Coding Agent host pin does not match package.json");
+if (packageLock.packages?.["packages/piagent-core"]?.peerDependencies?.["@earendil-works/pi-coding-agent"] !== supportedPiHost) fail("package-lock core Pi host pin does not match package.json");
 
 const changelog = fs.readFileSync(path.join(root, "CHANGELOG.md"), "utf8");
 if (!changelog.includes(`## ${expectedTag} -`)) fail(`CHANGELOG.md has no ${expectedTag} release section`);
@@ -102,7 +111,7 @@ for (const page of docsPages) {
 // the current number would make them false. Files that exist to list past
 // versions are exempt outright.
 const VERSION_HISTORY_FILES = new Set(["CHANGELOG.md", "docs/publishing-for-teams.md"]);
-const RELEASE_TAG_MENTION = /(?:@piagent\/platform@|Vt-mmm\/piagent@v?|--version )(\d+\.\d+\.\d+)/g;
+const RELEASE_TAG_MENTION = /(?:@piagent\/platform@|Vt-mmm\/piagent@v?|--version )(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/g;
 
 function proseFiles() {
   const files = fs.readdirSync(path.join(root, "docs")).filter((name) => name.endsWith(".md")).map((name) => `docs/${name}`);

package/templates/global/settings.json

@@ -9,9 +9,9 @@
     "openai-codex/gpt-5.4-mini:minimal",
     "openai-codex/gpt-5.4:xhigh",
     "openai-codex/gpt-5.5:high",
-    "openai-codex/gpt-5.6-luna:xhigh",
-    "openai-codex/gpt-5.6-sol:xhigh",
-    "openai-codex/gpt-5.6-terra:xhigh",
+    "openai-codex/gpt-5.6-luna:medium",
+    "openai-codex/gpt-5.6-terra:high",
+    "openai-codex/gpt-5.6-sol:high",
     "anthropic/claude-haiku-4-5:low",
     "anthropic/claude-sonnet-4-5:high",
     "anthropic/claude-sonnet-4-6:max",