@piagent/platform 1.6.0 → 1.6.1

package/packages/piagent-core/extensions/task-lifecycle.js

@@ -195,3 +195,35 @@ export function applyRuntimeLifecycleObservation(task, observation, recordedAt =
   }
   return { changed, mode };
 }
+
+/**
+ * A default assisted read-only review is a presentation checkpoint, not a
+ * second reasoning pass. Once runtime-owned read evidence exists and the model
+ * emits its final handoff, completing this one exact checkpoint preserves the
+ * substantive answer instead of forcing a token-heavy retry. Custom/manual
+ * plans and every source-change review remain explicit.
+ */
+export function applyAssistedReadOnlyFinalHandoff(
+  task,
+  { durableReadEvidence = false, finalHandoffObserved = false } = {},
+  recordedAt = new Date().toISOString()
+) {
+  const mode = runtimeLifecycleMode(task);
+  if (mode !== "assisted-readonly" || !durableReadEvidence || !finalHandoffObserved) {
+    return { changed: false, mode };
+  }
+  const scout = task.workPlan.find((step) => step.id === "scout");
+  const review = task.workPlan.find((step) => step.id === "review");
+  if (scout?.status !== "done" || review?.status !== "in-progress") {
+    return { changed: false, mode };
+  }
+  return {
+    changed: setStep(
+      review,
+      "done",
+      "Runtime observed a final handoff grounded in durable read-only evidence.",
+      recordedAt
+    ),
+    mode
+  };
+}

package/packages/piagent-core/extensions/task-state.js

@@ -20,6 +20,7 @@ import {
 } from "./task-digest-state.js";
 export { taskDigestMigrationArchiveStatus } from "./task-digest-state.js";
 import { acceptanceReceiptWithoutWorkingTreeProof, normalizedTaskDigestFields, taskDigestContractValidationErrors } from "./task-digest-contract.js";
+import { unicodeCodePointLength } from "./verification-intelligence.js";
 import {
   WORKING_TREE_DIGEST_ALGORITHM,
   isCurrentWorkingTreeDigest,
@@ -42,11 +43,16 @@ import {
 export { isGitWorkingTree } from "./workspace-evidence-roots.js";
 
 export const TASK_CONTRACT_SCHEMA_VERSION = 2; export const DEFAULT_MAX_TASK_ATTEMPTS = 3;
+export const OPERATOR_REQUEST_MAX_CHARS = 8_000;
+export const TASK_SUMMARY_MAX_CHARS = 2_000;
+export const TASK_EXPECTED_OUTPUT_MAX_CHARS = 2_000;
+export const TASK_ACCEPTANCE_CRITERION_MAX_CHARS = 1_000;
+export const TASK_ACCEPTANCE_CRITERIA_MAX = 12;
 const TASK_OUTCOMES = ["pending", "completed", "blocked", "partial", "failed"], TERMINAL_TASK_OUTCOMES = new Set(["completed", "blocked", "partial", "failed"]);
 const REVIEW_LENSES = ["correctness", "tests", "scope", "security", "docs", "release", "package"];
 const TASK_CONTRACT_FIELDS = new Set([
   "schemaVersion", "taskRunId", "taskId", "sessionId", "sessionName", "changeMode", "mutationPolicy", "attempt", "maxAttempts",
-  "previousAttempts", "summary", "riskLane", "intakeMode", "expectedOutput", "acceptanceCriteria", "criterionGraph", "scope", "outOfScope",
+  "previousAttempts", "summary", "operatorRequest", "operatorRequestDigest", "riskLane", "intakeMode", "expectedOutput", "acceptanceCriteria", "criterionGraph", "scope", "outOfScope",
   "protectedPaths", "requiredContext", "contextManifest", "memoryCitations", "mcpCapabilities", "verifyGroup",
   "verifyCommands", "workPlan", "reviewLenses", "orchestration", "acceptanceReceipt", "authoritySnapshot", "workingTreeDigestAlgorithm", "workingTreeDigestMigration", "baselineChangedFiles", "baselineFileDigests",
   "observedChangedFiles", "finalWorkingTreeFiles", "finalFileDigests", "changedFiles", "verifyEvidence", "trace",
@@ -136,6 +142,10 @@ function stringArray(value) {
   return Array.isArray(value) ? [...new Set(value.filter((item) => typeof item === "string" && item.trim()).map((item) => item.trim()))] : [];
 }
 
+function exactCommandArray(value) {
+  return Array.isArray(value) ? [...new Set(value.filter((item) => typeof item === "string" && item.trim()))] : [];
+}
+
 function stringRecord(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return {};
   return Object.fromEntries(Object.entries(value)
@@ -151,6 +161,10 @@ function validTimestamp(value) {
   return typeof value === "string" && value.trim().length > 0 && Number.isFinite(Date.parse(value));
 }
 
+export function operatorRequestDigest(value) {
+  return `operator-request-v1:${crypto.createHash("sha256").update(String(value ?? "")).digest("hex")}`;
+}
+
 function normalizedTimestamp(value, fallback) {
   return validTimestamp(value) ? value : fallback;
 }
@@ -191,6 +205,16 @@ export function taskContractValidationErrors(input) {
   if (typeof input.taskId === "string" && safeTaskId(input.taskId) !== input.taskId) errors.push("taskId must be normalized");
   if (typeof input.summary === "string" && input.summary.trim().length < 10) errors.push("summary must be at least 10 characters");
   if (typeof input.expectedOutput === "string" && input.expectedOutput.trim().length < 10) errors.push("expectedOutput must be at least 10 characters");
+  const hasOperatorRequest = input.operatorRequest !== undefined;
+  const hasOperatorRequestDigest = input.operatorRequestDigest !== undefined;
+  if (hasOperatorRequest !== hasOperatorRequestDigest) errors.push("operatorRequest and operatorRequestDigest must be present together");
+  if (hasOperatorRequest) {
+    if (typeof input.operatorRequest !== "string" || !input.operatorRequest.trim()) errors.push("operatorRequest must be a non-empty string");
+    else {
+      if (unicodeCodePointLength(input.operatorRequest) > OPERATOR_REQUEST_MAX_CHARS) errors.push(`operatorRequest must contain at most ${OPERATOR_REQUEST_MAX_CHARS} Unicode characters`);
+      if (input.operatorRequestDigest !== operatorRequestDigest(input.operatorRequest)) errors.push("operatorRequestDigest does not match operatorRequest");
+    }
+  }
   for (const field of ["createdAt", "updatedAt"]) {
     if (typeof input[field] === "string" && !validTimestamp(input[field])) errors.push(`${field} must be a valid timestamp`);
   }
@@ -402,6 +426,8 @@ export function normalizeTaskContract(input, options = {}) {
     maxAttempts: positiveInteger(input.maxAttempts, DEFAULT_MAX_TASK_ATTEMPTS, 10),
     previousAttempts: Array.isArray(input.previousAttempts) ? input.previousAttempts.slice(-10).map((item) => pickFields(item, PREVIOUS_ATTEMPT_FIELDS)) : [],
     summary: typeof input.summary === "string" ? input.summary : "",
+    operatorRequest: typeof input.operatorRequest === "string" && input.operatorRequest.trim() ? input.operatorRequest : undefined,
+    operatorRequestDigest: typeof input.operatorRequestDigest === "string" && input.operatorRequestDigest.trim() ? input.operatorRequestDigest : undefined,
     riskLane: ["tiny", "normal", "high-risk"].includes(input.riskLane) ? input.riskLane : "normal",
     intakeMode: ["model", "runtime"].includes(input.intakeMode) ? input.intakeMode : "model",
     expectedOutput: typeof input.expectedOutput === "string" ? input.expectedOutput : "", acceptanceCriteria: stringArray(input.acceptanceCriteria),
@@ -413,7 +439,7 @@ export function normalizeTaskContract(input, options = {}) {
     memoryCitations: Array.isArray(input.memoryCitations) ? input.memoryCitations.map((item) => pickFields(item, CITATION_FIELDS)) : [],
     mcpCapabilities: stringArray(input.mcpCapabilities),
     verifyGroup: typeof input.verifyGroup === "string" && input.verifyGroup.trim() ? input.verifyGroup.trim() : undefined,
-    verifyCommands: stringArray(input.verifyCommands),
+    verifyCommands: exactCommandArray(input.verifyCommands),
     workPlan: Array.isArray(input.workPlan) ? input.workPlan.map((item) => pickFields(item, WORK_PLAN_FIELDS)) : [],
     reviewLenses: stringArray(input.reviewLenses),
     acceptanceReceipt: normalizeAcceptanceReceipt(legacyDigestContract
@@ -691,6 +717,10 @@ function changedPathsFromNameStatus(output, observeRename) {
 }
 
 const WORKING_TREE_STREAM_CHUNK_BYTES = 1024 * 1024;
+// This path cannot collide with enumerated project evidence because `.pi` is
+// intentionally excluded from workspace discovery. Its unavailable digest
+// turns a partial inventory into an explicitly non-proof-capable snapshot.
+const WORKING_TREE_ENUMERATION_EVIDENCE_PATH = ".pi/piagent-state/.working-tree-enumeration-unavailable";
 function unavailableWorkingTreeDigest(file, reason, stat) {
   return unavailableWorkingTreeHash(crypto.createHash("sha256")
     .update(`${file}\0${reason}\0${stat?.mode ?? ""}\0${stat?.size ?? ""}\0${stat?.mtimeMs ?? ""}\0${stat?.ctimeMs ?? ""}`)
@@ -770,7 +800,18 @@ function streamedWorkingTreeFileDigest(root, file, hasHead, protectedProjectPath
 export function workingTreeSnapshot(cwd, options = {}) {
   const snapshot = {};
   const isProtectedProjectPath = typeof options.isProtectedProjectPath === "function" ? options.isProtectedProjectPath : () => false;
-  const roots = gitEvidenceRoots(cwd);
+  let rootDetails;
+  try {
+    rootDetails = gitEvidenceRootDetails(cwd);
+  } catch (error) {
+    snapshot[WORKING_TREE_ENUMERATION_EVIDENCE_PATH] = unavailableWorkingTreeDigest(
+      WORKING_TREE_ENUMERATION_EVIDENCE_PATH,
+      `root-enumeration:${error?.code ?? "failed"}`
+    );
+    return snapshot;
+  }
+  const roots = rootDetails.roots;
+  const incompleteReasons = rootDetails.complete ? [] : ["root-enumeration-incomplete"];
   for (const root of roots) {
     const protectedAliases = new Set();
     const observeRename = (source, destination) => {
@@ -778,13 +819,33 @@ export function workingTreeSnapshot(cwd, options = {}) {
       if (paths.some((file) => file === ".pi/piagent-state" || file.startsWith(".pi/piagent-state/") || isProtectedProjectPath(prefixedGitPath(root.prefix, file))))
         paths.forEach((file) => protectedAliases.add(file));
     };
-    const hasHead = gitHasHead(root.cwd); for (const file of workingTreeFilesForGitRoot(root.cwd, observeRename)) {
-      const projectPath = prefixedGitPath(root.prefix, file);
-      snapshot[projectPath] = streamedWorkingTreeFileDigest(root.cwd, file, hasHead, isProtectedProjectPath(projectPath) || protectedAliases.has(file) ? projectPath : null);
+    try {
+      const hasHead = gitHasHead(root.cwd); for (const file of workingTreeFilesForGitRoot(root.cwd, observeRename)) {
+        const projectPath = prefixedGitPath(root.prefix, file);
+        snapshot[projectPath] = streamedWorkingTreeFileDigest(root.cwd, file, hasHead, isProtectedProjectPath(projectPath) || protectedAliases.has(file) ? projectPath : null);
+      }
+    } catch {
+      incompleteReasons.push(`git-root-enumeration-incomplete:${root.prefix || "."}`);
     }
-  } if (!isGitWorkingTree(cwd) && roots.length > 0) for (const file of nonGitWorkspaceFiles(cwd, roots.map((root) => root.prefix))) {
+  }
+  if (!roots.some((root) => root.prefix === "") && roots.length > 0) {
+    const looseDetails = nonGitWorkspaceFileDetails(
+      cwd,
+      roots.map((root) => root.prefix),
+      options.maxNonGitWorkspaceFiles
+    );
+    for (const file of looseDetails.files) {
       snapshot[file] = nonGitWorkspaceFileDigest(cwd, file, isProtectedProjectPath(file) ? file : null);
-  } return snapshot;
+    }
+    if (!looseDetails.complete) incompleteReasons.push("non-git-enumeration-incomplete");
+  }
+  if (incompleteReasons.length > 0) {
+    snapshot[WORKING_TREE_ENUMERATION_EVIDENCE_PATH] = unavailableWorkingTreeDigest(
+      WORKING_TREE_ENUMERATION_EVIDENCE_PATH,
+      incompleteReasons.sort().join(",")
+    );
+  }
+  return snapshot;
 }
 
 export function taskStateMigrationStatus(cwd) {

package/packages/piagent-core/extensions/verification-intelligence.js

@@ -13,8 +13,22 @@ import {
 } from "./failure-types.ts";
 import { isCurrentWorkingTreeDigest } from "./working-tree-digest.js";
 
+export const MAX_VERIFY_COMMANDS = 2;
+export const MAX_VERIFY_COMMAND_CHARS = 900;
+export const MAX_VERIFY_COMMAND_BYTES = 900;
+export const MAX_VERIFY_COMMAND_TOTAL_BYTES = MAX_VERIFY_COMMANDS * MAX_VERIFY_COMMAND_BYTES;
+export const MAX_VERIFY_COMMAND_TOTAL_CHARS = MAX_VERIFY_COMMANDS * MAX_VERIFY_COMMAND_CHARS;
+
+export function unicodeCodePointLength(value) {
+  return Array.from(String(value ?? "")).length;
+}
+
+export function utf8ByteLength(value) {
+  return Buffer.byteLength(String(value ?? ""), "utf8");
+}
+
 function uniqueStrings(values) {
-  return [...new Set((Array.isArray(values) ? values : []).filter((value) => typeof value === "string" && value.trim()).map((value) => value.trim()))];
+  return [...new Set((Array.isArray(values) ? values : []).filter((value) => typeof value === "string" && value.trim()))];
 }
 
 export function meaningfulVerificationCommands(commands = []) {
@@ -27,6 +41,25 @@ export function meaningfulVerificationCommands(commands = []) {
   });
 }
 
+export function verifierCommandBoundsError(commands = []) {
+  const supplied = (Array.isArray(commands) ? commands : []).filter((command) => typeof command === "string");
+  if (supplied.some((command) => /[\r\n]/.test(command))) {
+    return "Exact verify commands must be single-line values without CR or LF characters; move multiline logic into a checked-in script before task intake.";
+  }
+  const normalized = uniqueStrings(supplied);
+  if (normalized.length > MAX_VERIFY_COMMANDS) {
+    return `Verify plans support at most ${MAX_VERIFY_COMMANDS} exact commands; consolidate or shorten the project verifier before task intake.`;
+  }
+  const oversized = normalized.find((command) => unicodeCodePointLength(command) > MAX_VERIFY_COMMAND_CHARS);
+  if (oversized) return `An exact verify command exceeds ${MAX_VERIFY_COMMAND_CHARS} characters; shorten it or move verifier logic into a checked-in script before task intake.`;
+  const oversizedTraffic = normalized.find((command) => utf8ByteLength(command) > MAX_VERIFY_COMMAND_BYTES);
+  if (oversizedTraffic) return `An exact verify command exceeds ${MAX_VERIFY_COMMAND_BYTES} UTF-8 bytes; shorten it or move verifier logic into a checked-in script before task intake.`;
+  if (normalized.reduce((total, command) => total + utf8ByteLength(command), 0) > MAX_VERIFY_COMMAND_TOTAL_BYTES) {
+    return `Exact verify commands exceed the ${MAX_VERIFY_COMMAND_TOTAL_BYTES}-byte aggregate limit; consolidate or shorten the project verifier before task intake.`;
+  }
+  return undefined;
+}
+
 /** Return the last durably recorded observed execution for each exact command. */
 export function latestObservedVerificationEvidence(evidence = []) {
   const latest = new Map();
@@ -100,7 +133,10 @@ function parsedSignals(text, exitCode, structuredEvents) {
   const lower = text.toLowerCase();
   const signals = structuredEvents.map((event) => STRUCTURED_SIGNALS[event]).filter(Boolean);
   const add = (signal, pattern) => { if (pattern.test(lower)) signals.push(signal); };
-  add("scope-diagnostic", /\b(outside (?:its |the )?declared scope|scope violation|protected path|symlink escape)\b/);
+  // Task scope is advisory. Only concrete filesystem-safety wording may be
+  // inferred from unstructured output; scope policy must arrive as a trusted
+  // structured event so ordinary assertion text cannot stop recovery.
+  add("scope-diagnostic", /\b(protected path|symlink escape)\b/);
   add("policy-diagnostic", /\b(policy (?:blocked|denied|violation)|capability lock|guard blocked)\b/);
   add("permission-diagnostic", /\b(eacces|eperm|permission denied|not authorized|unauthorized|forbidden)\b/);
   add("provider-rate-limit", /\b(?:http\s*)?429\b|\brate[ -]?limit(?:ed|ing)?\b/);
@@ -191,7 +227,7 @@ const RECORDED_CATEGORY_HINTS = Object.freeze({
   environment: "command not found in runtime environment",
   "provider-network": "provider API request timed out",
   "permission-policy": "permission denied by policy",
-  "scope-protected-path": "outside declared scope",
+  "scope-protected-path": "protected path is forbidden",
   "flaky-infrastructure": "EADDRINUSE: port is already in use"
 });
 
@@ -202,16 +238,15 @@ export function classifyRecordedVerificationFailure(summary, exitCode = 1) {
   return classifyVerificationFailure(hint ? `${text}\n${hint}` : text, exitCode);
 }
 
-const COMPLETION_SCOPE_BOUNDARY = /(?:^changes within task scope\b|^read-only task has observed changes\b|\boutside (?:(?:its|the|task) )?(?:declared )?scope\b|\bscope violation\b|\bprotected(?:\/read-only| or read-only)? paths?\b|\bread-only path\b)/i;
+const COMPLETION_POLICY_BOUNDARY = /(?:^read-only task has observed changes\b|^mutation-forbidden task has observed changes\b|\bprotected(?:\/read-only| or read-only)? paths?\b|\bread-only path\b)/i;
 
 export function classifyCompletionGateFailure(missing = [], summary = "", exitCode = 1) {
   const missingItems = Array.isArray(missing) ? missing.map((item) => String(item)) : [];
-  // Scope, protected-path, and read-only mutation boundaries are structural
-  // completion failures. They must outrank verifier/acceptance diagnostics and
-  // remain non-retryable even when the latest exact verifier exited zero.
-  if (missingItems.some((item) => COMPLETION_SCOPE_BOUNDARY.test(item))) {
-    return classifyVerificationFailure("Completion gate rejected a scope or protected-path boundary.", 1, {
-      structuredEvents: ["scope-violation"]
+  // Protected-path and read-only mutation boundaries are structural
+  // completion failures. Task scope is advisory and never enters this path.
+  if (missingItems.some((item) => COMPLETION_POLICY_BOUNDARY.test(item))) {
+    return classifyVerificationFailure("Completion gate rejected a protected-path or read-only boundary.", 1, {
+      structuredEvents: ["protected-path"]
     });
   }
   if (missingItems.some((item) => /^critical acceptance evidence\b/i.test(item))) {
@@ -235,8 +270,8 @@ export function chooseVerificationScope(profileVerifyCommands = {}, changedFiles
     || /^(?:README|CHANGELOG|CONTRIBUTING|SECURITY)(?:\.|$)/i.test(file);
   const hasDocs = files.some(isDocumentationFile);
   const hasDocsOnly = files.length > 0 && files.every(isDocumentationFile);
-  const hasFrontend = files.some((file) => /(^|\/)(?:app|pages|components|frontend|web|client)(\/|$)|\.(?:tsx|jsx|css|scss|vue|svelte)$/i.test(file));
-  const hasBackend = files.some((file) => /(^|\/)(?:api|server|backend|services)(\/|$)|\.(?:go|py|rs|java|kt|cs|rb|php|sql)$/i.test(file));
+  const hasFrontend = files.some((file) => /(^|[\/_-])(?:app|pages|components|frontend|web|client)(?=[\/_-]|$)|\.(?:tsx|jsx|css|scss|vue|svelte)$/i.test(file));
+  const hasBackend = files.some((file) => /(^|[\/_-])(?:api|server|backend|services)(?=[\/_-]|$)|\.(?:go|py|rs|java|kt|cs|rb|php|sql)$/i.test(file));
   const selectedGroups = [];
   if (hasDocsOnly && groups.docs) {
     selectedGroups.push("docs");
@@ -310,5 +345,7 @@ export function selectVerificationPlan(profile, requestedGroup, changeMode, cwd,
       error: `Verify group ${group ?? "(none)"} has no meaningful command. Configure .pi/piagent-profile.json before source changes.`
     };
   }
+  const boundsError = verifierCommandBoundsError(commands);
+  if (boundsError) return { group, commands, error: boundsError };
   return { group, commands };
 }

package/packages/piagent-core/extensions/workspace-evidence-roots.js

@@ -2,14 +2,35 @@ import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
-const WORKSPACE_EVIDENCE_MAX_FILES = 2000;
+// Parent workspaces commonly carry shared plans, verifier scripts, and agent
+// configuration beside their child repositories. Keep the traversal bounded,
+// but leave enough room for a real multi-repository workspace instead of
+// silently dropping evidence at the former 2,000-file ceiling.
+const WORKSPACE_EVIDENCE_MAX_FILES = 20_000;
+// These names are not merely noisy build output: they carry repository
+// ownership, Piagent authority, or provider credentials. Evidence discovery
+// excludes them and the mutation guard protects them independently of task
+// focus, so broad monorepo access cannot create an unaudited private-state gap.
+export const WORKSPACE_PRIVATE_STATE_PATTERNS = Object.freeze([
+  "**/.git/**", "**/.hg/**", "**/.svn/**", "**/.pi/**",
+  "**/.aws/**", "**/.azure/**", "**/.docker/**", "**/.gnupg/**", "**/.kube/**", "**/.ssh/**",
+  "**/.git-credentials", "**/.netrc", "**/.npmrc", "**/.pypirc",
+  "**/.env", "**/.env.*",
+  "**/auth.json", "**/credential.json", "**/credentials.json", "**/secret.json", "**/secrets.json",
+  "**/token.json", "**/tokens.json"
+]);
 const WORKSPACE_EVIDENCE_SKIP_NAMES = new Set([
-  ".git", ".hg", ".svn", ".pi", "node_modules", "dist", "build", ".next", "coverage"
+  ".git", ".hg", ".svn", ".pi", "node_modules", "dist", "build", ".next", "coverage",
+  ".cache", ".npm", ".pnpm-store", ".yarn", ".turbo", ".aws", ".azure", ".docker",
+  ".gnupg", ".kube", ".ssh", ".ds_store", ".git-credentials", ".netrc", ".npmrc", ".pypirc"
 ]);
 const WORKSPACE_EVIDENCE_PRIORITY_NAMES = new Map([["plans", 0]]);
 
-function hiddenWorkspaceEvidenceSegment(value) {
-  return String(value ?? "").startsWith(".");
+function excludedWorkspaceEvidenceName(value) {
+  const name = String(value ?? "");
+  return WORKSPACE_EVIDENCE_SKIP_NAMES.has(name.toLowerCase())
+    || /^\.env(?:\.|$)/i.test(name)
+    || /^(?:auth|credentials?|secrets?|tokens?)\.json$/i.test(name);
 }
 
 export function gitOutput(cwd, args, options = {}) {
@@ -86,6 +107,15 @@ export function directChildGitEvidenceRoots(cwd) {
 
 export function gitEvidenceRootDetails(cwd) {
   if (isGitWorkingTree(cwd)) return { roots: [{ cwd, prefix: "" }], complete: true };
+  // A present Git marker combined with a failed Git probe is ambiguous (for
+  // example a broken worktree pointer or a transient command failure). Do not
+  // reinterpret that repository as an ordinary complete non-Git directory.
+  try {
+    fs.lstatSync(path.join(cwd, ".git"));
+    return { roots: [], complete: false };
+  } catch (error) {
+    if (error?.code !== "ENOENT") return { roots: [], complete: false };
+  }
   return directChildGitEvidenceRootDetails(cwd);
 }
 
@@ -93,9 +123,16 @@ export function gitEvidenceRoots(cwd) {
   return gitEvidenceRootDetails(cwd).roots;
 }
 
-export function nonGitWorkspaceFileDetails(cwd, gitRootPrefixes) {
+function workspaceEvidenceFileLimit(value) {
+  return Number.isInteger(value)
+    ? Math.max(1, Math.min(WORKSPACE_EVIDENCE_MAX_FILES, value))
+    : WORKSPACE_EVIDENCE_MAX_FILES;
+}
+
+export function nonGitWorkspaceFileDetails(cwd, gitRootPrefixes, maxFiles = WORKSPACE_EVIDENCE_MAX_FILES) {
   const files = [];
   let complete = true;
+  const limit = workspaceEvidenceFileLimit(maxFiles);
   const gitRoots = new Set(gitRootPrefixes.filter(Boolean));
   const orderedEntries = (entries) => [...entries].sort((left, right) => {
     const leftPriority = WORKSPACE_EVIDENCE_PRIORITY_NAMES.get(left.name.toLowerCase()) ?? 10;
@@ -103,7 +140,7 @@ export function nonGitWorkspaceFileDetails(cwd, gitRootPrefixes) {
     return leftPriority - rightPriority || left.name.localeCompare(right.name, "en-US");
   });
   function visit(directory, relativeDirectory) {
-    if (files.length >= WORKSPACE_EVIDENCE_MAX_FILES) {
+    if (files.length >= limit) {
       complete = false;
       return;
     }
@@ -115,15 +152,15 @@ export function nonGitWorkspaceFileDetails(cwd, gitRootPrefixes) {
       return;
     }
     for (const entry of orderedEntries(entries)) {
-      if (files.length >= WORKSPACE_EVIDENCE_MAX_FILES) {
+      if (files.length >= limit) {
         complete = false;
         return;
       }
-      // Loose files beside nested repositories are not governed by either
-      // repository's ignore/trust policy. Keep hidden editor, agent, cloud,
-      // credential, and cache state out of both manifests and change evidence
-      // instead of attempting to maintain an incomplete name blacklist.
-      if (WORKSPACE_EVIDENCE_SKIP_NAMES.has(entry.name) || hiddenWorkspaceEvidenceSegment(entry.name)) continue;
+      // A parent workspace can own real project source in hidden directories
+      // (for example shared verifier scripts). Evidence discovery therefore
+      // excludes explicit private/cache/credential names instead of treating
+      // every dot-prefixed path as non-project state.
+      if (excludedWorkspaceEvidenceName(entry.name)) continue;
       const relative = relativeDirectory ? `${relativeDirectory}/${entry.name}` : entry.name;
       if (gitRoots.has(relative.split("/")[0])) continue;
       const absolute = path.join(directory, entry.name);
@@ -141,8 +178,8 @@ export function nonGitWorkspaceFileDetails(cwd, gitRootPrefixes) {
   return { files: files.sort(), complete };
 }
 
-export function nonGitWorkspaceFiles(cwd, gitRootPrefixes) {
-  return nonGitWorkspaceFileDetails(cwd, gitRootPrefixes).files;
+export function nonGitWorkspaceFiles(cwd, gitRootPrefixes, maxFiles = WORKSPACE_EVIDENCE_MAX_FILES) {
+  return nonGitWorkspaceFileDetails(cwd, gitRootPrefixes, maxFiles).files;
 }
 
 export function pathWithinNonGitWorkspaceEvidenceRoot(candidate, gitRootPrefixes) {
@@ -150,8 +187,7 @@ export function pathWithinNonGitWorkspaceEvidenceRoot(candidate, gitRootPrefixes
   const topSegment = segments[0];
   return Boolean(
     topSegment
-    && !WORKSPACE_EVIDENCE_SKIP_NAMES.has(topSegment)
-    && !segments.some(hiddenWorkspaceEvidenceSegment)
+    && !segments.some(excludedWorkspaceEvidenceName)
     && !gitRootPrefixes.includes(topSegment)
   );
 }

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/policies/base-policy.json

@@ -3,7 +3,27 @@
   "name": "piagent-base-policy",
   "protectedPaths": [
     ".git/**",
+    "**/.git/**",
+    "**/.hg/**",
+    "**/.svn/**",
+    "**/.pi/**",
+    "**/.aws/**",
+    "**/.azure/**",
+    "**/.docker/**",
+    "**/.gnupg/**",
+    "**/.kube/**",
+    "**/.ssh/**",
+    "**/.git-credentials",
+    "**/.netrc",
+    "**/.npmrc",
+    "**/.pypirc",
     "**/auth.json",
+    "**/credential.json",
+    "**/credentials.json",
+    "**/secret.json",
+    "**/secrets.json",
+    "**/token.json",
+    "**/tokens.json",
     "**/.env",
     "**/.env.*",
     "**/node_modules/**",
@@ -16,7 +36,27 @@
   ],
   "shellProtectedPaths": [
     ".git/**",
+    "**/.git/**",
+    "**/.hg/**",
+    "**/.svn/**",
+    "**/.pi/**",
+    "**/.aws/**",
+    "**/.azure/**",
+    "**/.docker/**",
+    "**/.gnupg/**",
+    "**/.kube/**",
+    "**/.ssh/**",
+    "**/.git-credentials",
+    "**/.netrc",
+    "**/.npmrc",
+    "**/.pypirc",
     "**/auth.json",
+    "**/credential.json",
+    "**/credentials.json",
+    "**/secret.json",
+    "**/secrets.json",
+    "**/token.json",
+    "**/tokens.json",
     "**/.env",
     "**/.env.*",
     ".pi/piagent-state/**",
@@ -232,7 +272,7 @@
   },
   "orchestrationPolicy": {
     "defaultMode": "solo-first",
-    "maxConcurrentSubagents": 2,
+    "maxConcurrentSubagents": 1,
     "defaultReviewLenses": [
       "correctness",
       "tests",
@@ -240,7 +280,7 @@
     ],
     "roleModelGuidance": {
       "planner": "Use the strongest available model for decomposition, architecture, risk, and acceptance criteria.",
-      "worker": "Use the fastest reliable model for a bounded, already-planned single write set.",
+      "worker": "Disabled by default. The parent model owns all implementation and mutation.",
       "reviewer": "Use a model or thinking setting decorrelated from the worker when review quality matters.",
       "watchdog": "Use a strong model only for final risk review, security, release, or high-impact changes."
     },

package/packages/piagent-core/policy/authority-manifest.v1.json

@@ -34,7 +34,7 @@
         "CAP-11": "advisory",
         "CAP-12": "on",
         "CAP-13": "off",
-        "CAP-14": "recommend",
+        "CAP-14": "off",
         "CAP-15": "off",
         "CAP-16": "on",
         "CAP-17": "on"
@@ -80,7 +80,7 @@
         "CAP-11": "advisory",
         "CAP-12": "on",
         "CAP-13": "strict",
-        "CAP-14": "recommend",
+        "CAP-14": "off",
         "CAP-15": "off",
         "CAP-16": "on",
         "CAP-17": "on"
@@ -314,7 +314,7 @@
       "layer": "L3",
       "configKey": "helpers",
       "configSources": ["manifest", "PIAGENT_HELPERS_MODE"],
-      "defaultMode": "recommend",
+      "defaultMode": "off",
       "killSwitchMode": "off",
       "dependencies": ["CAP-02", "CAP-05", "CAP-08"],
       "modeMappings": [

package/packages/piagent-core/prompts/be-to-fe.md

@@ -26,13 +26,7 @@ Flow:
    - BE scout: read-only.
    - FE implementation: source-write.
    - Auth/data migration/external provider: high-risk, ask before implementation.
-4. Use bounded read-only subagents only when BE/FE mapping has independent lanes worth the extra token/tool cost:
-   - `piagent-scout` maps backend contract read-only;
-   - `piagent-scout` maps frontend touchpoints read-only;
-   - builtin `context-builder` may create handoff context when the BE→FE mapping touches multiple journeys/forms/contracts;
-   - `piagent-planner` produces the FE implementation plan when the contract touches multiple layers;
-   - `piagent-reviewer` reviews diff/verification after implementation.
-   Continue single-agent if subagents are unavailable, the task is tiny, or requirements are unresolved.
+4. Keep BE scouting and FE implementation in the parent by default. At most one fresh read-only `piagent-scout` may map either the BE contract or FE touchpoints only when runtime evidence proves two independent lanes and at least 30% projected total token savings after handoff/merge. Never launch two scouts, delegate FE writes/planning/review, inherit the parent transcript, or retry a deterministic helper failure.
 5. Scout backend contract read-only:
    - controller/route/handler;
    - request/response DTO/schema;
@@ -53,7 +47,7 @@ Flow:
    - route/page/component/form;
    - tests/e2e.
 9. Call `piagent_task_start` exactly once before FE source writes and reuse an active contract.
-10. Implement FE only with one writer by default.
+10. Implement FE in the parent; helper workers are disabled.
 11. Run every exact command returned in `task.verifyCommands` after the latest mutation. For a normal default plan, review the final diff and mark only its review step done with `piagent_task_progress`.
 12. Let runtime hooks record context, verification, trace, and final-gate state. Use recovery tools only if the runtime reports missing evidence.
 13. Do not paste full test/build/tool logs into chat or final output. Summarize the signal and quote only relevant failing lines.

package/packages/piagent-core/prompts/plan.md

@@ -17,7 +17,7 @@ Rules:
 4. Read `.pi/project-context.md`; if it is missing or still pending, recommend `/onboard-project run` before implementation.
 5. Read required context.
 6. Identify protected paths and external/high-risk actions.
-7. Decide whether subagents are useful enough to justify extra token/tool cost. If the bundled `pi-subagents` parent skill is available, use it for delegation patterns and safety boundaries. If `pi-subagents`/`subagent(...)` is available, use `piagent-scout` for independent read-only repo/spec mapping before medium/large plans. Use builtin `context-builder` when the task needs a handoff context/meta-prompt. Use `piagent-oracle` for architecture/risk challenge when the decision is non-obvious. Continue single-agent for tiny plans or unavailable subagent tooling.
+7. Keep planning in the parent. At most one fresh read-only helper may run only when runtime evidence proves two independent workstreams, no dependency on later parent output, and at least 30% projected total token savings after transfer/merge. Never delegate implementation, fork parent history, retry a deterministic helper failure, or add a helper only for review quality.
 8. Produce a compact task tree/workPlan with exact files, commands, owner role, review lenses, and verify gates.
 9. Do not implement yet unless the user explicitly asks.
 

package/packages/piagent-core/prompts/platform-improve.md

@@ -23,18 +23,14 @@ Flow:
 1. Use runtime automatic intake for a bounded platform change. If runtime pauses for broad, high-risk, or ambiguous scope, call `piagent_task_start` exactly once with project-relative path/glob scope and reuse an active contract.
 2. Read the narrow current implementation, its tests, and the relevant policy/schema/docs. Runtime hooks inject bounded navigation context when useful.
 3. Treat memory and generated context as advisory; verify against current files.
-4. Use bounded subagents only when independent lanes justify their extra token/tool cost:
-   - use `piagent-scout` for read-only code/package mapping;
-   - use `piagent-planner` for a plan when multiple modules are affected;
-   - use `piagent-reviewer` for diff, docs, and verification review;
-   - continue single-agent for small, localized edits.
+4. Keep platform analysis, planning, implementation, and review in the parent. At most one fresh read-only helper may map a genuinely independent lane only when runtime evidence projects at least 30% lower total tokens after handoff/merge. Do not delegate writes, fork parent history, run parallel helpers, or retry deterministic runtime/scope failures.
 5. If the task needs external repository context provided by the user, use a targeted read-only checkout when available.
 6. Produce an implementation matrix only when multiple platform areas are affected:
 
     | Area | Current behavior | Target behavior | Files/config | Verification |
     |---|---|---|---|---|
 
-7. Implement only the bounded target behavior with one writer by default.
+7. Implement only the bounded target behavior in the parent.
 8. If runtime behavior changes, update README/docs and add or adjust a decision note when appropriate.
 9. Run every exact command returned in `task.verifyCommands` after the latest mutation. For a normal default plan, review the final diff and mark only its review step done with `piagent_task_progress`.
 10. Let runtime hooks record context, verification, trace, and final-gate state. Use recovery tools only if the runtime reports missing evidence.

package/packages/piagent-core/prompts/review.md

@@ -14,13 +14,8 @@ Rules:
 1. Read the current diff and the narrow surrounding source/tests. Runtime hooks inject bounded navigation context when useful.
 2. Select review lenses from the actual change risk; do not load orchestration or diagnostic tools just to choose them.
 3. Stay read-only unless explicitly asked to write a report.
-4. Check protected paths, scope drift, acceptance behavior, and verify-command coverage.
-5. For a non-trivial diff, use bounded read-only reviewers only when independent lanes justify their token cost:
-   - correctness/edge cases;
-   - tests/verification;
-   - scope drift/protected paths;
-   - security/high-risk only when relevant.
-   If the user asks for a loop, use `/review-loop` semantics or equivalent parent-controlled max-round loop. Continue single-agent for tiny diffs or unavailable subagent tooling.
+4. Check protected paths, unrelated change drift, acceptance behavior, and verify-command coverage. Treat task scope as an initial focus, not write authority.
+5. Review directly in the parent. A non-trivial diff does not itself justify another model run. At most one fresh read-only reviewer is eligible only when a runtime estimate proves an independent lane and at least 30% projected total token savings after handoff/merge; never run parallel review or retry a deterministic helper failure. If the user explicitly asks for a loop, keep it parent-controlled and bounded.
 6. Report findings by severity.
 7. Do not call diagnostic Piagent tools for routine review and do not paste full diff/test/tool logs. Summarize the signal and quote only relevant lines.
 

package/packages/piagent-core/prompts/scout.md

@@ -15,7 +15,7 @@ Lean scouting flow:
 
 1. Read targeted current files and return cited evidence. Runtime hooks inject bounded navigation context when useful and enforce read boundaries.
 2. Create a read-only contract with `piagent_task_start` only for a broad governed scout that needs persisted scope or handoff. Tiny default scouts complete from observed reads; for a normal default scout, review the evidence and mark only the returned review step done with `piagent_task_progress`.
-3. Use memory, vendor documentation, or a read-only subagent only when current source is insufficient or the work has independent lanes. Verify advisory material against current files.
+3. Use memory or vendor documentation only when current source is insufficient. Keep scouting in the parent; a helper requires separate runtime proof of two independent lanes and at least 30% projected net token saving.
 4. A low-confidence search may trigger one bounded finder pass. Stop broad search when the requested evidence is covered.
 5. Do not call diagnostic Piagent tools for a routine scout. Load them only when the runtime reports a recovery need or the operator explicitly asks for diagnostics.
 6. Do not edit source or paste full command output. Summarize relevant evidence and unknowns.