@piagent/platform 1.6.0 → 1.7.1

package/packages/piagent-core/extensions/piagent-guard.ts

@@ -1,9 +1,11 @@
+import { observedFocusedTestSummary, retainFocusedVerification, unresolvedFocusedVerification } from "./acceptance-focused-verification.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import crypto from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { apiBaselineCriterionEvidence as apiBaselineEvidence } from "../runtime/verification/acceptance-api-baseline.js";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { StringEnum } from "@earendil-works/pi-ai";
 import { Type } from "typebox";
@@ -17,6 +19,7 @@ import {
   unresolvedExpansionReason
 } from "./shell-reach.ts";
 import { extractShellWritePathCandidates, shellHasFileWriteRedirection } from "./shell-write-targets.js";
+import { isProjectMutatingShellCommand, isReadOnlyTaskShellCommand } from "./readonly-inline-inspection.ts";
 import { commandMatchesVerifyPlan, createBashResultLedger, findMatchingObservedBashResult, readObservedBashResults } from "./runtime-evidence.js";
 import { findPackageRoot, findPlatformRoot, readJsonFile } from "./guard-io.js";
 import {
@@ -67,28 +70,25 @@ import {
 } from "./context-index-policy.js";
 import {
   DEFAULT_MAX_TASK_ATTEMPTS, activeSessionTask, bindSessionTask, createTaskRunId, hasGitEvidenceRoot, listTaskContracts,
-  pathWithinChangeEvidenceRoot, priorTaskAttempts, repositoryFileManifest, repositoryFileManifestDetails, resolveTaskContract, safeTaskId, summarizeAttempt, taskContractValidationErrors, taskDigestMigrationArchiveStatus,
+  priorTaskAttempts, repositoryFileManifest, repositoryFileManifestDetails, resolveTaskContract, safeTaskId, summarizeAttempt, taskContractValidationErrors, taskDigestMigrationArchiveStatus,
   workPlanDependencyError, workingTreeSnapshot, workingTreeSnapshotHasUnavailableEvidence, writeTaskContract
 } from "./task-state.js";
-import { classifyRecordedVerificationFailure, classifyVerificationFailure, latestObservedVerification, meaningfulVerificationCommands, selectCompletionRecoveryClassification, selectVerificationPlan } from "./verification-intelligence.js";
+import { classifyRecordedVerificationFailure, classifyVerificationFailure, latestObservedVerification, meaningfulVerificationCommands, recordedFailureForObservation, selectCompletionRecoveryClassification, selectVerificationPlan } from "./verification-intelligence.js";
 import { executionBackendToolDecision } from "./execution-backend.js";
 import { replayTaskCheckpoints } from "./task-journal.js";
 import type { FailureClassification } from "./failure-types.ts";
 import { recordCompletionAudit, recordMutationCheckpoint, recordTaskProgressCheckpoints, recordTaskStartCheckpoint, recordVerificationCheckpoint } from "./task-runtime-audit.js";
 import {
-  applyAcceptanceRecoveryProvenance,
-  acceptanceBaselineGuidance,
-  acceptanceProofGuidance,
-  acceptanceSemanticConflicts,
-  buildAcceptanceReceipt,
-  invalidateAcceptanceReceiptAfterMutation,
-  refreshAcceptanceReceipt
+  applyAcceptanceRecoveryProvenance, acceptanceBaselineGuidance, acceptanceProofGuidance, acceptanceSemanticConflicts,
+  buildAcceptanceReceipt, invalidateAcceptanceReceiptAfterMutation, refreshAcceptanceReceipt
 } from "./acceptance-receipt.js";
 import { acceptanceLanguageAdapterForPath, isAcceptanceTestPath } from "./acceptance-language-adapters.js";
 import { allVerifyCommandsPassCurrentTree, changedSnapshotFiles, compactTaskDetails, mergeObservedTaskContext, passingVerifyCommandsForDigest, taskDeltaFilesFromSnapshot } from "./task-contract-view.js";
 import { applyRuntimeLifecycleObservation, runtimeLifecycleMode, workingTreeEvidenceDigest } from "./task-lifecycle.js";
 import { completeTaskDigestRefresh } from "./task-digest-migration.js";
 import { WORKING_TREE_DIGEST_ALGORITHM, isCurrentWorkingTreeDigest, workingTreeObservation, workingTreeSnapshotUsesCurrentAlgorithm } from "./working-tree-digest.js";
+import { currentWorkspaceRevisionDigest } from "./workspace-revision.js";
+import { captureWorkspaceVerificationSnapshot } from "./workspace-verification-snapshot.js";
 import { appendJsonlBounded } from "./state-retention.js";
 import { ensurePrivateStateDirectory, resolveLocalStatePath } from "./local-state-path.js";
 import { hasDurableContextEvidence } from "./context-evidence.js";
@@ -104,12 +104,17 @@ import {
 import { cleanSessionNameInput, currentSessionName, hasOperatorSessionName } from "../runtime/session/message-signals.ts";
 import { buildSemanticCompactionInstructions } from "../runtime/session/system-prompt.ts";
 import { buildContextPreflight, buildUsageSnapshot, formatContextPreflight, formatCount, formatPercent, formatUsageSnapshot } from "../runtime/session/usage.ts";
+import { registerTaskUsageHooks } from "../runtime/product/task-usage-hooks.ts";
 import {
   formatToolResultCaptureStatus,
   readRecentToolResultCaptures
 } from "../runtime/session/tool-result-compaction.ts";
 import { RuntimeSessionState } from "../runtime/session/runtime-state.ts";
 import type { ObservedTaskContext } from "../runtime/session/runtime-state.ts";
+import { reuseCurrentTreeExactVerifier } from "../runtime/verification/exact-verifier-reuse.ts";
+import { IndependentAcceptanceRuntime } from "../runtime/verification/independent-acceptance-runtime.ts";
+import { independentAcceptanceState } from "./acceptance-independent-registry.js";
+import { independentVerificationRecovery } from "../runtime/recovery/independent-verification-recovery.ts";
 import {
   PIAGENT_TOOL_GROUPS,
   PIAGENT_TOOL_NAMES,
@@ -118,6 +123,7 @@ import {
 } from "../runtime/tools/tool-groups.ts";
 import type { PiagentToolGroup } from "../runtime/tools/tool-groups.ts";
 import { freshRequestParts, shortTaskLabel } from "../runtime/workflows/input-routing.ts";
+import { completedFollowupAcceptanceEvidenceFiles } from "../runtime/workflows/task-followup-policy.ts";
 import {
   automaticAcceptanceCriteria,
   automaticReviewLenses,
@@ -141,7 +147,8 @@ import { readRuntimeVersionMetadata, RuntimeSnapshotCapture } from "../runtime/m
 import { recordRuntimeSnapshotTelemetry } from "../runtime/model/snapshot-telemetry.ts";
 import { captureAuthenticatedModelCatalogFromContext } from "../runtime/model/authenticated-catalog.ts";
 import { normalizeOpenAiCodexReasoningPayload } from "../runtime/model/openai-codex-reasoning.ts";
-import { buildOpenAiCodexWireFingerprint } from "../runtime/model/provider-wire-fingerprint.ts";
+import { buildOpenAiCodexWireFingerprint, measureProviderPayload } from "../runtime/model/provider-wire-fingerprint.ts";
+import { registerFastModeCommand, ServiceTierRuntime } from "../runtime/model/service-tier-runtime.ts";
 import { ModelRouteRuntime, readModelRouteEvents } from "../runtime/model/model-route-runtime.ts";
 import { parentRoutingModeFromEnvironment, routingObjectiveFromEnvironment } from "../runtime/model/model-route-policy.ts";
 import { ModelSelectionProvenanceTracker } from "../runtime/model/model-selection-provenance.ts";
@@ -155,17 +162,21 @@ import { PhaseToolRuntime, phaseToolModeFromEnvironment } from "../runtime/tools
 import { parseApplyPatchTargets, registerApplyPatchTool } from "../runtime/tools/apply-patch-tool.ts";
 import { authorityReplacementState, ensureTaskAuthorityResumePolicy } from "../runtime/policy/authority-resume-policy.ts";
 import { taskAuthorityDecision } from "../runtime/policy/task-authority-runtime.ts";
-import { selectRecoveryDecision } from "../runtime/recovery/recovery-policy.ts";
+import { applyProofCapabilityHandoff, selectRecoveryDecision } from "../runtime/recovery/recovery-policy.ts";
 import type { RecoveryDecision } from "../runtime/recovery/recovery-policy.ts";
 import { inspectTaskResumeState } from "../runtime/recovery/resume-state.ts";
 import { SemanticRepairRuntime } from "../runtime/recovery/semantic-repair-runtime.ts";
 import { defaultRolePolicy } from "../runtime/orchestration/role-policy.ts";
 import { helpersMode } from "../runtime/orchestration/helper-lifecycle.ts";
+import { evaluateDirectSubagentDispatch, recordDirectSubagentResult, reserveDirectSubagentDispatch, taskHelperUsageMode } from "../runtime/orchestration/subagent-tool-policy.ts";
 import { buildLiveTaskStatus, formatLiveTaskStatus } from "../runtime/product/operator-projections.ts";
 import { buildTaskEfficiencyMetrics } from "../runtime/product/efficiency-metrics.ts";
 import { performanceReviewToolDecision, performanceReviewToolKind } from "../runtime/quality/performance-assurance.ts";
 import { expectedModelMutationProof } from "../runtime/quality/model-mutation-proof.ts";
+import { EditFreshnessGuard, editFreshnessModeFromEnvironment } from "../runtime/quality/edit-freshness-guard.ts";
 import { captureVerifierFileSnapshot } from "../runtime/inspection/verifier-snapshot-store.ts";
+import { finalGateConfig } from "./acceptance-diagnostic-policy.ts";
+import { fallbackBasePolicy } from "./fallback-base-policy.ts";
 import { prefixCompletions, registerPiagentTool, registerRuntimeCommand, registerRuntimeTool } from "../runtime/registration/extension-registration.ts";
 import { FRESH_COMMAND_ACTIONS, FRESH_COMMAND_HELP, ONBOARDING_COMMAND_ACTIONS, WORKFLOW_COMMAND_EXCLUSIONS } from "../runtime/registration/operator-catalogs.ts";
 import { registerPiagentStatusCommand } from "../runtime/registration/runtime-model-status.ts";
@@ -197,7 +208,6 @@ import type {
   ContextIndexSettings,
   ExecPolicyConfig,
   ExternalActionPolicyConfig,
-  FinalGateConfig,
   MemorySettings,
   OrchestrationMode,
   OrchestrationPolicySettings,
@@ -232,7 +242,7 @@ type TaskStartParameters = {
   riskLane: "tiny" | "normal" | "high-risk";
   intakeMode?: "model" | "runtime";
   changeMode?: "source-change" | "read-only";
-  mutationPolicy?: "required" | "forbidden";
+  mutationPolicy?: "required" | "allowed" | "forbidden";
   verifyGroup?: string;
   maxAttempts?: number;
   expectedOutput: string;
@@ -293,7 +303,6 @@ const TECH_OPTIONS: TechOption[] = [
   { id: "node-typescript", label: "Node TypeScript", role: "runtime", description: "Node.js TypeScript library/tooling project.", context7Query: "typescript node.js", topics: ["typescript", "node", "testing"] },
   { id: "python", label: "Python", role: "runtime", description: "Python app/library runtime.", context7Query: "python", topics: ["packaging", "typing", "testing"] }
 ];
-
 const PROFILE_TECH_ROLES: Record<string, TechRole[]> = {
   "web-frontend": ["frontend", "database"],
   "backend-api": ["backend", "database"],
@@ -307,7 +316,6 @@ const PROFILE_TECH_ROLES: Record<string, TechRole[]> = {
   docs: ["docs"],
   generic: ["runtime"]
 };
-
 const DEFAULT_MEMORY_SETTINGS: Required<MemorySettings> = {
   enabled: true,
   mode: "manual",
@@ -320,7 +328,6 @@ const DEFAULT_MEMORY_SETTINGS: Required<MemorySettings> = {
   maxInjectedChars: 4000,
   externalPackages: []
 };
-
 const DEFAULT_CONTEXT_INDEX_SETTINGS: Required<ContextIndexSettings> = {
   enabled: true,
   path: CONTEXT_INDEX_FILE,
@@ -331,21 +338,19 @@ const DEFAULT_CONTEXT_INDEX_SETTINGS: Required<ContextIndexSettings> = {
   includeTechStack: true,
   includeMemoryPointers: true
 };
-
 const DEFAULT_RUNTIME_POLICY: Required<RuntimePolicySettings> = {
   execPolicy: "enforce",
   contextBudget: "enforce",
   toolRegistry: "advisory",
   finalGate: "enforce"
 };
-
 const DEFAULT_ORCHESTRATION_POLICY: ResolvedOrchestrationPolicy = {
   defaultMode: "solo-first",
-  maxConcurrentSubagents: 2,
+  maxConcurrentSubagents: 1,
   defaultReviewLenses: ["correctness", "tests", "scope"],
   roleModelGuidance: {
     planner: "Use the strongest available model for decomposition, architecture, risk, and acceptance criteria.",
-    worker: "Use the fastest reliable model for a bounded, already-planned single write set.",
+    worker: "Disabled by default. The parent model owns all implementation and mutation.",
     reviewer: "Use a model or thinking setting decorrelated from the worker when review quality matters.",
     watchdog: "Use a strong model only for final risk review, security, release, or high-impact changes."
   },
@@ -357,14 +362,13 @@ const DEFAULT_ORCHESTRATION_POLICY: ResolvedOrchestrationPolicy = {
     readBeforeTask: true
   },
   rules: [
-    "Default to one parent agent; do not start a swarm for ordinary implementation.",
-    "Use subagents only for bounded read-only scout, planning, review, or a single approved worker.",
-    "Parallel read-only review is allowed when the diff is non-trivial; parallel writers require explicit user approval and isolation.",
+    "Default to the parent model working directly; a helper is an exceptional token optimization, not a reasoning phase.",
+    "Use at most one fresh read-only helper only when runtime evidence proves at least two independent lanes and at least 30% projected net token savings.",
+    "Never delegate implementation, inherit parent history, retry a deterministic helper failure, or run parallel helpers/writers.",
     "Treat Field Guide memory as advisory; verify every durable fact against current repository files.",
     "Keep review lenses explicit so cheap review work catches drift before release."
   ]
 };
-
 const PERMISSION_PROFILE_MODES = ["read-only", "workspace-write", "trusted-full-access"] as const;
 const PERMISSION_PROFILE_ALIASES: Record<string, PermissionProfileMode> = {
   readonly: "read-only",
@@ -385,183 +389,11 @@ const WRITE_TOOL_NAMES = new Set(["write", "edit"]);
 const SHELL_TOOL_NAMES = new Set(["bash", "shell", "exec"]);
 const MAX_MCP_PROXY_ARGS_CHARS = 131_072;
 const SESSION_PERMISSION_OVERRIDES = new Map<string, PermissionProfileMode>();
-
-// The policy used when `policies/base-policy.json` cannot be read. It runs in
-// exactly the case where something is already wrong, so it must never be the
-// looser of the two: this copy had drifted behind the file and silently dropped
-// `.pi/piagent-state/**` -- the guard's own state -- along with the `sudo ` and
-// `chmod -R 777` blocks. A missing policy file is a reason to be stricter, not a
-// quiet downgrade. `tests/policy-core.test.mjs` fails if this drifts again.
-const DEFAULT_POLICY: BasePolicy = {
-  protectedPaths: [".git/**", "**/auth.json", "**/.env", "**/.env.*", "**/node_modules/**", "**/dist/**", ".pi/piagent-state/**", ".pi/settings.json", ".pi/piagent-profile.json", ".pi/piagent-profile.lock.json", CONTEXT_INDEX_FILE],
-  shellProtectedPaths: [".git/**", "**/auth.json", "**/.env", "**/.env.*", ".pi/piagent-state/**", ".pi/settings.json", ".pi/piagent-profile.json", ".pi/piagent-profile.lock.json", CONTEXT_INDEX_FILE],
-  blockedCommandPatterns: ["rm -rf /", "rm -rf ~", "rm -rf $HOME", "git reset --hard", "git clean -fd", "sudo ", "chmod -R 777"],
-  requireConfirmationPatterns: ["deploy", "release", "publish", "migration", "gh pr merge", "git push"],
-  defaultRequiredContext: ["AGENTS.md", "README.md"],
-  permissionProfiles: {
-    defaultMode: "workspace-write",
-    allowedModes: ["read-only", "workspace-write", "trusted-full-access"]
-  },
-  execPolicy: {
-    defaultMode: "enforce",
-    bannedPrefixSuggestions: [
-      ["python"],
-      ["python3"],
-      ["node"],
-      ["node", "-e"],
-      ["bash"],
-      ["bash", "-lc"],
-      ["sh"],
-      ["sh", "-c"],
-      ["zsh"],
-      ["zsh", "-lc"],
-      ["git"],
-      ["sudo"],
-      ["env"]
-    ],
-    rules: [
-      {
-        id: "prompt-git-add-broad",
-        action: "prompt",
-        match: "regex",
-        value: "(?:^|\\s)git\\s+(?:-C\\s+\\S+\\s+)?add\\s+(?:(?:--all|-A)(?:\\s+(?:\\.|:/))?|--\\s+(?:\\.|:/)|(?:\\.|:/))(?:\\s|$)",
-        reason: "Broad git staging can include unrelated or sensitive changes; inspect git status/diff and confirm the exact scope first."
-      }
-    ]
-  },
-  contextBudget: {
-    defaultMode: "enforce",
-    contextDeltaShadow: "sample",
-    maxContextFileChars: 50000,
-    maxMemoryFileChars: 20000,
-    maxManifestFiles: 80,
-    warnFragmentChars: 4000
-  },
-  toolRegistry: {
-    defaultMode: "advisory",
-    alwaysAllowedTools: [
-      "piagent_tools",
-      "piagent_context_engine",
-      "piagent_context",
-      "piagent_permission_status",
-      "piagent_exec_policy_check",
-      "piagent_context_budget",
-      "piagent_tool_policy_check",
-      "piagent_task_gate_check",
-      "piagent_usage_snapshot",
-      "piagent_orchestration_policy",
-      "piagent_memory_status",
-      "piagent_memory_note",
-      "piagent_memory_search",
-      "piagent_memory_citation_record",
-      "piagent_context_index_status",
-      "piagent_context_index_record",
-      "piagent_context_index_search",
-      "piagent_profile_options",
-      "piagent_profile_apply",
-      "piagent_profile_tech_options",
-      "piagent_profile_tech_apply",
-      "piagent_profile_tech_context_record",
-      "piagent_project_onboarding_record",
-      "piagent_task_start",
-      "piagent_task_progress",
-      "piagent_source_checkout",
-      "piagent_context_record",
-      "piagent_verify_record",
-      "piagent_trace_record"
-    ],
-    toolCapabilities: {
-      bash: ["shell"],
-      shell: ["shell"],
-      exec: ["shell"],
-      read: ["filesystem-readonly"],
-      grep: ["filesystem-readonly"],
-      find: ["filesystem-readonly"],
-      ls: ["filesystem-readonly"],
-      write: ["filesystem-write"],
-      edit: ["filesystem-write"],
-      apply_patch: ["filesystem-write"],
-      browser: ["browser"],
-      github: ["github"]
-    }
-  },
-  externalActionPolicy: {
-    defaultMode: "enforce",
-    providerKeywords: [
-      "github",
-      "gitlab",
-      "bitbucket",
-      "vercel",
-      "netlify",
-      "cloudflare",
-      "aws",
-      "gcp",
-      "azure",
-      "slack",
-      "teams",
-      "jira",
-      "linear",
-      "notion",
-      "figma",
-      "stripe",
-      "supabase",
-      "firebase"
-    ],
-    writeVerbs: [
-      "add",
-      "approve",
-      "archive",
-      "assign",
-      "close",
-      "comment",
-      "create",
-      "delete",
-      "deploy",
-      "dispatch",
-      "merge",
-      "open",
-      "post",
-      "publish",
-      "push",
-      "release",
-      "remove",
-      "reopen",
-      "run",
-      "send",
-      "submit",
-      "trigger",
-      "update",
-      "upload",
-      "write"
-    ],
-    safeVerbs: [
-      "fetch",
-      "find",
-      "get",
-      "inspect",
-      "list",
-      "read",
-      "search",
-      "show",
-      "view"
-    ]
-  },
-  finalGate: {
-    defaultMode: "enforce",
-    requireTaskContract: true,
-    requireContextManifest: true,
-    requireVerifyEvidence: true,
-    requireTrace: true,
-    requirePassingVerify: true
-  },
-  orchestrationPolicy: DEFAULT_ORCHESTRATION_POLICY
-};
-
+const DEFAULT_POLICY = fallbackBasePolicy(CONTEXT_INDEX_FILE, DEFAULT_ORCHESTRATION_POLICY);
 // Which platform supplies the adapters is fixed by where this file is installed,
 // so it is resolved once here rather than threaded through every profile load.
 const PLATFORM_ROOT = findPlatformRoot(path.dirname(fileURLToPath(import.meta.url)));
 const UPDATE_CHECK_MODULE = fileURLToPath(new URL("./update-check.js", import.meta.url));
-
 // The installed version, read from the package this file ships in. A maintainer
 // working in the repository is not running a release and has nothing to update
 // to, so only a tree Pi or npm placed is given a version to compare.
@@ -569,7 +401,6 @@ function installedPlatformVersion(): string | undefined {
   if (!isInstalledPlatform(PLATFORM_ROOT)) return undefined;
   return readJsonFile<{ version?: string }>(path.join(PLATFORM_ROOT, "package.json"))?.version;
 }
-
 function updateAvailabilityNotice(): string | undefined {
   const installed = installedPlatformVersion();
   if (!installed) return undefined;
@@ -1016,7 +847,12 @@ function inspectPathInputsFromInput(
   const seen = new Set<string>();
   const walked = walkStringInputs(input, [], 0, includeFilesystemContentFields);
   for (const item of walked.items) {
-    const normalized = normalizeRelative(cwd, item.value);
+    const relative = normalizeRelative(cwd, item.value);
+    // `path.relative(root, root)` is the empty string. Treat that canonical
+    // project-root spelling as `.` so a capability such as `**/*` admits
+    // `ls .` and an absolute path equal to cwd. The empty candidate matched no
+    // scope and made fresh helpers unable to inspect even their own project.
+    const normalized = relative === "" ? "." : relative;
     if (normalized === undefined) continue;
     const key = `${item.field}\0${normalized}`;
     if (seen.has(key)) continue;
@@ -1126,6 +962,7 @@ function evaluatePathLikeToolAccess(
     forceScopeAware?: boolean;
     forceWrite?: boolean;
     allowAmbiguousFilesystemContentFields?: boolean;
+    sourceCheckoutReadRoots?: string[];
   } = {}
 ): { block: boolean; reason?: string } {
   const scopeAwareTool = options.forceScopeAware === true || ["read", "write", "edit", "grep", "find", "ls"].includes(toolName)
@@ -1167,9 +1004,13 @@ function evaluatePathLikeToolAccess(
   }
 
   for (const item of inspectedPaths) {
+    const fieldAccessMode = filesystemFieldAccessMode(toolName, item.field, writesFilesystem);
+    const sourceCheckoutReadRoot = fieldAccessMode === "read"
+      ? grantedSourceCheckoutRootForPath(cwd, item.path, options.sourceCheckoutReadRoots ?? [])
+      : undefined;
     if (scopeAwareTool && isFilesystemScopeField(item.field)) {
       const boundary = inspectRepositoryPathBoundary(cwd, item.path);
-      if (boundary.reason) return { block: true, reason: `Blocked ${toolName}: ${boundary.reason}` };
+      if (boundary.reason && !sourceCheckoutReadRoot) return { block: true, reason: `Blocked ${toolName}: ${boundary.reason}` };
     }
     const resolvedPath = resolveRepositoryPathCandidate(cwd, item.path);
     const readMatched = matchesProtectedPath(item.path, readProtectedPaths)
@@ -1181,7 +1022,6 @@ function evaluatePathLikeToolAccess(
       };
     }
 
-    const fieldAccessMode = filesystemFieldAccessMode(toolName, item.field, writesFilesystem);
     if (fieldAccessMode === "write") {
       const readOnlyMatched = matchesProtectedPath(item.path, readOnlyPaths)
         ?? (resolvedPath ? matchesProtectedPath(resolvedPath, readOnlyPaths) : undefined);
@@ -1205,7 +1045,8 @@ function evaluatePathLikeToolAccess(
           reason: `Blocked ${toolName} write outside resolved filesystem scope from ${item.field}: ${item.path}`
         };
       }
-    } else if (scopeAwareTool && filesystemRead && isFilesystemScopeField(item.field) && !matchesAnyPath(item.path, filesystemRead)) {
+    } else if (scopeAwareTool && filesystemRead && isFilesystemScopeField(item.field)
+      && !sourceCheckoutReadRoot && !matchesAnyPath(item.path, filesystemRead)) {
       return {
         block: true,
         reason: `Blocked ${toolName} read outside resolved filesystem scope from ${item.field}: ${item.path}`
@@ -1236,6 +1077,21 @@ function evaluatePathLikeToolAccess(
   return { block: false };
 }
 
+function grantedSourceCheckoutRootForPath(cwd: string, candidate: string, roots: string[]): string | undefined {
+  if (roots.length === 0) return undefined;
+  const absolute = path.resolve(cwd, normalizePathCandidate(candidate));
+  let canonical: string;
+  try {
+    canonical = fs.realpathSync.native(absolute);
+  } catch {
+    return undefined;
+  }
+  return roots.find((root) => {
+    const relative = path.relative(root, canonical);
+    return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+  });
+}
+
 function stateRoot(cwd: string): string {
   return path.join(cwd, ".pi", "piagent-state");
 }
@@ -1437,16 +1293,6 @@ function externalActionPolicyConfig(policy: BasePolicy): Required<ExternalAction
   };
 }
 
-function finalGateConfig(policy: BasePolicy): Required<FinalGateConfig> {
-  return {
-    defaultMode: policy.finalGate?.defaultMode ?? DEFAULT_POLICY.finalGate?.defaultMode ?? "enforce",
-    requireTaskContract: policy.finalGate?.requireTaskContract ?? true,
-    requireContextManifest: policy.finalGate?.requireContextManifest ?? true,
-    requireVerifyEvidence: policy.finalGate?.requireVerifyEvidence ?? true,
-    requireTrace: policy.finalGate?.requireTrace ?? true,
-    requirePassingVerify: policy.finalGate?.requirePassingVerify ?? true
-  };
-}
 
 function boundedInteger(value: unknown, fallback: number, minimum: number, maximum: number): number {
   const numberValue = typeof value === "number" ? value : Number(value);
@@ -1513,7 +1359,7 @@ function resolveOrchestrationPolicy(profile: ProjectProfile, policy: BasePolicy)
   };
   return {
     defaultMode: normalizeOrchestrationMode(configured.defaultMode, defaultPolicy.defaultMode),
-    maxConcurrentSubagents: boundedInteger(configured.maxConcurrentSubagents, defaultPolicy.maxConcurrentSubagents, 0, 6),
+    maxConcurrentSubagents: Math.min(1, boundedInteger(configured.maxConcurrentSubagents, defaultPolicy.maxConcurrentSubagents, 0, 1)),
     defaultReviewLenses: normalizeReviewLenses(configured.defaultReviewLenses, defaultPolicy.defaultReviewLenses),
     roleModelGuidance,
     fieldGuide: {
@@ -1839,56 +1685,14 @@ function isTaskMutationTool(toolName: string, input: Record<string, unknown>): b
     .some((token) => tokens.has(token));
 }
 
-function isReadOnlyTaskShellCommand(
-  command: string,
-  segments: Array<{ words: string[] }>
-): boolean {
-  if (/[<>]|`|\$\(/.test(command)) {
-    return false;
+function shellTouchesGrantedSourceCheckout(cwd: string, command: string, roots: string[]): boolean {
+  if (roots.length === 0) return false;
+  for (const root of roots) {
+    const relative = path.relative(cwd, root).split(path.sep).join("/");
+    if (command.includes(root) || (relative && command.includes(relative))) return true;
   }
-  const safeCommands = new Set(["pwd", "ls", "find", "rg", "grep", "cat", "sed", "head", "tail", "wc", "stat", "file", "test", "[", "which"]);
-  const safeGitSubcommands = new Set(["status", "diff", "log", "show", "ls-files", "rev-parse"]);
-  return segments.length > 0 && segments.every((segment) => {
-    const words = segment.words.filter(Boolean);
-    const executable = path.basename(words[0] ?? "");
-    if (executable === "sed" && words.some((word) => /^-.*i/.test(word))) return false;
-    if (executable === "find" && words.some((word) => ["-delete", "-exec", "-execdir", "-ok", "-okdir", "-fprint", "-fprint0", "-fprintf", "-fls"].includes(word))) return false;
-    if (safeCommands.has(executable)) return true;
-    if (executable === "git") return safeGitSubcommands.has(words[1] ?? "");
-    if (executable === "command") return words[1] === "-v";
-    return false;
-  });
-}
-
-const PROJECT_MUTATING_EXECUTABLES = new Set([
-  "apply_patch", "bash", "chmod", "chown", "cp", "dd", "install", "ln", "make", "mkdir", "mv", "prename", "rename",
-  "node", "patch", "perl", "php", "python", "python3", "rm", "rmdir", "rsync", "ruby", "scp", "sh",
-  "tee", "touch", "truncate", "zsh"
-]);
-
-function isProjectMutatingShellCommand(command: string, segments: Array<{ words: string[] }>): boolean {
-  if (shellHasFileWriteRedirection(command)) return true;
-  const noAliases = new Map<string, string>();
-  for (const segment of segments) {
-    const words = segment.words.filter(Boolean);
-    if (words.length === 0) continue;
-    if (externalExecutableIndex(words, PROJECT_MUTATING_EXECUTABLES, noAliases) !== undefined) return true;
-    const executable = path.basename(words[0] ?? "").toLowerCase();
-    if (executable === "find" && words.some((word) => ["-delete", "-exec", "-execdir", "-ok", "-okdir", "-fprint", "-fprint0", "-fprintf", "-fls"].includes(word))) return true;
-    if (executable === "sed" && words.some((word) => /^-[^-]*i/.test(word) || word === "--in-place" || word.startsWith("--in-place="))) return true;
-    if (executable === "git") {
-      const subcommand = words.slice(1).find((word, index, values) => {
-        if (!word.startsWith("-")) return index === 0 || !["-C", "-c", "--git-dir", "--work-tree"].includes(values[index - 1]);
-        return false;
-      });
-      if (["apply", "checkout", "clean", "mv", "reset", "restore", "rm", "switch"].includes(subcommand ?? "")) return true;
-    }
-    if (["npm", "pnpm", "yarn", "bun"].includes(executable)) {
-      const subcommand = words.find((word, index) => index > 0 && !word.startsWith("-"));
-      if (["add", "ci", "install", "link", "remove", "uninstall", "update", "upgrade"].includes(subcommand ?? "")) return true;
-    }
-  }
-  return false;
+  return extractShellPathCandidates(command)
+    .some((candidate) => Boolean(grantedSourceCheckoutRootForPath(cwd, normalizeRelative(cwd, candidate) ?? candidate, roots)));
 }
 
 const EXPLICIT_SHELL_MUTATORS = new Set([
@@ -2062,18 +1866,20 @@ function recordObservedTaskVerification(
   },
   pendingContext: ObservedTaskContext[],
   maxManifestFiles: number, shellSnapshotBefore?: Record<string, string>,
-  eventTree?: ReturnType<typeof workingTreeObservation>,
-  readProtectedPaths: string[] = []
+  eventTree?: ReturnType<typeof captureWorkspaceVerificationSnapshot>,
+  readProtectedPaths: string[] = [], preWorkspaceRevisionDigest?: string, diagnosticFocused = false
 ): TaskContract | undefined {
   const task = activeSessionTask(ctx.cwd, ctx.sessionManager.getSessionId()) as TaskContract | undefined;
   if (!task || task.trace.outcome !== "pending") return;
   const command = String(observed.normalizedCommand ?? observed.command ?? "").trim();
   const observedAtMs = Date.parse(observed.recordedAt ?? "");
   const taskCreatedAtMs = Date.parse(task.createdAt);
+  const matchedProfileCommand = commandMatchesVerifyPlan(command, task.verifyCommands);
+  const focusedTest = diagnosticFocused && observedFocusedTestSummary(observed.outputText);
   if (
     !command
     || !observed.commandHash
-    || !commandMatchesVerifyPlan(command, task.verifyCommands)
+    || (!matchedProfileCommand && !focusedTest)
     || !Number.isFinite(observedAtMs)
     || !Number.isFinite(taskCreatedAtMs)
     || observedAtMs < taskCreatedAtMs
@@ -2082,6 +1888,7 @@ function recordObservedTaskVerification(
   if (!eventTree?.proofCapable) return;
   const currentDigests = eventTree.snapshot as Record<string, string>;
   const currentDigest = eventTree.digest;
+  const workspaceRevisionDigest = eventTree.workspaceRevisionDigest ?? undefined;
   const preWorkingTreeDigest = shellSnapshotBefore && workingTreeSnapshotUsesCurrentAlgorithm(shellSnapshotBefore) ? workingTreeEvidenceDigest(shellSnapshotBefore) : undefined;
   const exitCode = Number.isInteger(observed.exitCode) ? observed.exitCode as number : observed.isError ? 1 : 0;
   const classification = classifyVerificationFailure(observed.outputText, exitCode);
@@ -2089,6 +1896,7 @@ function recordObservedTaskVerification(
     evidence.command.trim() === command
     && evidence.exitCode === exitCode
     && evidence.workingTreeDigest === currentDigest && evidence.observedAt === observed.recordedAt
+    && evidence.workspaceRevisionDigest === workspaceRevisionDigest && evidence.preWorkspaceRevisionDigest === preWorkspaceRevisionDigest
   ));
   const contextAdded = mergeObservedTaskContext(task, pendingContext, maxManifestFiles, redactText);
   if (!duplicate) {
@@ -2097,16 +1905,17 @@ function recordObservedTaskVerification(
     task.verifyEvidence.push({
       command: redactText(command),
       exitCode,
-      summary: `Runtime observed configured verifier exit ${exitCode} (${classification.category}${classification.retryable ? ", retryable" : ""}).`,
+      summary: `Runtime observed ${matchedProfileCommand ? "configured" : "focused"} verifier exit ${exitCode} (${classification.category}${classification.retryable ? ", retryable" : ""}).`,
       recordedAt: evidenceRecordedAt,
       observed: true,
       observedAt,
       isError: observed.isError === true,
-      matchedProfileCommand: true,
+      matchedProfileCommand,
       preWorkingTreeDigest,
-      workingTreeDigest: currentDigest
+      workingTreeDigest: currentDigest,
+      preWorkspaceRevisionDigest, workspaceRevisionDigest
     });
-    task.verifyEvidence = task.verifyEvidence.slice(-100);
+    task.verifyEvidence = diagnosticFocused ? retainFocusedVerification(task.verifyEvidence, currentDigest, workspaceRevisionDigest) : task.verifyEvidence.slice(-100);
     try {
       captureVerifierFileSnapshot({
         projectRoot: ctx.cwd, taskId: task.taskId, taskRunId: task.taskRunId, sessionId: task.sessionId,
@@ -2119,18 +1928,20 @@ function recordObservedTaskVerification(
     }
   }
 
-  const hasChanges = taskChangedFileEvidence(ctx.cwd, task, currentDigests).expected.length > 0;
-  const allPassing = hasChanges && allVerifyCommandsPassCurrentTree(task, currentDigest);
-  const lifecycle = hasChanges
+  const taskLocalDelta = taskChangedFileEvidence(ctx.cwd, task, currentDigests).expected;
+  const hasChanges = taskLocalDelta.length > 0;
+  const verificationCanSettleSourceTask = hasChanges || task.mutationPolicy === "allowed";
+  const allPassing = verificationCanSettleSourceTask && allVerifyCommandsPassCurrentTree(task, currentDigest, workspaceRevisionDigest ?? null);
+  const lifecycle = verificationCanSettleSourceTask
     ? applyRuntimeLifecycleObservation(task, allPassing ? "verification-complete" : "verification-pending", nowIso())
     : { changed: false, mode: runtimeLifecycleMode(task) };
   const acceptance = refreshAcceptanceReceipt(task, {
-    cwd: ctx.cwd,
-    changedFiles: taskChangedFileEvidence(ctx.cwd, task, currentDigests).expected,
+    cwd: ctx.cwd, apiBaselineEvidence,
+    changedFiles: taskAcceptanceEvidenceFiles(ctx.cwd, task, currentDigests, taskLocalDelta),
     currentWorkingTreeDigest: currentDigest
   });
   task.acceptanceReceipt = acceptance.task.acceptanceReceipt;
-  if (!task.workingTreeDigestMigration || (shellSnapshotBefore && changedSnapshotFiles(shellSnapshotBefore, currentDigests).length === 0)) Object.assign(task, completeTaskDigestRefresh(task, currentDigest));
+  if (!task.workingTreeDigestMigration || (shellSnapshotBefore && changedSnapshotFiles(shellSnapshotBefore, currentDigests).length === 0)) Object.assign(task, completeTaskDigestRefresh(task, currentDigest, workspaceRevisionDigest ?? null));
   if (duplicate && contextAdded.length === 0 && !lifecycle.changed) return task;
 
   const written = writeTask(ctx.cwd, task);
@@ -2160,7 +1971,8 @@ function recordObservedTaskVerification(
       retryable: classification.retryable,
       failureClassification: classification,
       preWorkingTreeDigest,
-      workingTreeDigest: currentDigest
+      workingTreeDigest: currentDigest,
+      preWorkspaceRevisionDigest, workspaceRevisionDigest
     }
   });
   return written;
@@ -2210,14 +2022,14 @@ function completionTaskProjection(
     failureReason: undefined,
     ruledOut: undefined,
     trace: {
-      outcome: "completed",
+      outcome: "completed" as const,
       notes: "Runtime finalized from observed context, working-tree changes, current verification, and completed work-plan evidence.",
       recordedAt: nowIso()
     }
   };
   return refreshAcceptanceReceipt(projected, {
-    cwd,
-    changedFiles,
+    cwd, apiBaselineEvidence,
+    changedFiles: taskAcceptanceEvidenceFiles(cwd, projected, finalFileDigests, changedFiles),
     currentWorkingTreeDigest: workingTreeEvidenceDigest(finalFileDigests)
   }).task as TaskContract;
 }
@@ -3630,6 +3442,20 @@ function taskChangedFileEvidence(
   };
 }
 
+function taskAcceptanceEvidenceFiles(
+  cwd: string,
+  task: TaskContract,
+  currentDigests: Record<string, string>,
+  taskLocalDelta: string[] = taskChangedFileEvidence(cwd, task, currentDigests).expected
+): string[] {
+  return completedFollowupAcceptanceEvidenceFiles(
+    task,
+    listTaskContracts(cwd) as TaskContract[],
+    taskLocalDelta,
+    currentDigests
+  );
+}
+
 function exactReviewPathCoverage(expectedPaths: string[], reviewedPaths: string[] | undefined): boolean {
   const expected = [...new Set(expectedPaths)].sort();
   const reviewed = [...new Set(reviewedPaths ?? [])].sort();
@@ -3668,8 +3494,9 @@ function evaluateTaskGate(
   warnings: string[];
   currentWorkingTreeDigest?: string;
   changedFileEvidence?: ReturnType<typeof taskChangedFileEvidence>;
+  acceptanceProof?: { mode: "enforce" | "diagnostic"; pendingCriterionIds: string[]; missing: string[] };
 } {
-  const finalGate = finalGateConfig(policy);
+  const finalGate = finalGateConfig(policy, DEFAULT_POLICY);
   const missing: string[] = [];
   const warnings: string[] = [];
   if (!task) {
@@ -3677,14 +3504,24 @@ function evaluateTaskGate(
   }
   const currentDigests = options.currentDigests ?? workingTreeSnapshot(cwd) as Record<string, string>;
   const currentWorkingTreeDigest = options.currentWorkingTreeDigest ?? workingTreeEvidenceDigest(currentDigests);
+  const independentState = independentAcceptanceState(cwd, task, currentWorkingTreeDigest);
+  if (independentState.block) missing.push(independentState.block);
+  const compositeFacts = new Set<string>();
+  for (const [id, assessment] of independentState.assessments) {
+    if (assessment.verdict !== "pass") missing.push(`independent contract evidence (${id}:${assessment.verdict}${assessment.executionDiagnostics?.reasons.length ? `; ${assessment.executionDiagnostics.reasons.join(", ")}` : ""})`);
+    else if (assessment.assurance === "bounded-composite-contract-tested" && Array.isArray(assessment.factKinds)) {
+      for (const kind of assessment.factKinds) if (typeof kind === "string") compositeFacts.add(kind);
+    }
+  }
+  const compositeContext = compositeFacts.has("context-current"), compositeVerifier = compositeFacts.has("project-verifier-current");
   if (task.workingTreeDigestAlgorithm !== WORKING_TREE_DIGEST_ALGORITHM || task.workingTreeDigestMigration?.status === "verification-refresh-required" || !workingTreeSnapshotUsesCurrentAlgorithm(currentDigests) || !isCurrentWorkingTreeDigest(currentWorkingTreeDigest) || currentWorkingTreeDigest !== workingTreeEvidenceDigest(currentDigests) || Object.values(task.baselineFileDigests).some((digest) => !isCurrentWorkingTreeDigest(digest)) || (task.workingTreeDigestMigration && (!taskDigestMigrationArchiveStatus(cwd, task).valid || replayTaskCheckpoints(cwd, task.taskRunId, task).corruptions.length > 0))) missing.push("current working-tree digest evidence");
   if (workingTreeSnapshotHasUnavailableEvidence(currentDigests)) missing.push("complete working-tree content evidence");
   if (taskContractValidationErrors(task).length > 0) missing.push("valid session-bound task contract v2");
   if (task.attempt > task.maxAttempts) missing.push(`attempt within maxAttempts (${task.attempt}/${task.maxAttempts})`);
   const plannedVerifyCommands = meaningfulVerificationCommands(task.verifyCommands);
-  if (task.changeMode === "source-change" && plannedVerifyCommands.length === 0) missing.push("meaningful verify command");
-  if (finalGate.requireContextManifest && !hasDurableContextEvidence(task)) missing.push("context manifest");
-  if (task.changeMode === "source-change" && finalGate.requireVerifyEvidence && task.verifyEvidence.length === 0) missing.push("verify evidence");
+  if (task.changeMode === "source-change" && plannedVerifyCommands.length === 0 && !compositeVerifier) missing.push("meaningful verify command");
+  if (finalGate.requireContextManifest && !hasDurableContextEvidence(task) && !compositeContext) missing.push("context manifest");
+  if (task.changeMode === "source-change" && finalGate.requireVerifyEvidence && task.verifyEvidence.length === 0 && !compositeVerifier) missing.push("verify evidence");
   if (task.verifyEvidence.some((evidence) => evidence.observed !== true)) {
     warnings.push("Unobserved verify evidence is ignored by the passing verify gate.");
   }
@@ -3699,48 +3536,74 @@ function evaluateTaskGate(
     warnings.push("Verification evidence from a different working-tree snapshot is stale and is ignored.");
   }
   let missingVerifyCommands: string[] = [];
-  if (task.changeMode === "source-change" && finalGate.requirePassingVerify && plannedVerifyCommands.length > 0) {
-    const passingCommands = passingVerifyCommandsForDigest(task, currentWorkingTreeDigest);
+  if (task.changeMode === "source-change" && finalGate.requirePassingVerify && plannedVerifyCommands.length > 0 && !compositeVerifier) {
+    const passingCommands = passingVerifyCommandsForDigest(task, currentWorkingTreeDigest, currentWorkspaceRevisionDigest(cwd));
     missingVerifyCommands = plannedVerifyCommands.filter((command) => !passingCommands.has(command.trim()));
     if (missingVerifyCommands.length > 0) missing.push(`observed passing verify evidence for every configured command (${missingVerifyCommands.length} missing)`);
   }
+  if (finalGate.acceptanceProofMode === "diagnostic" && unresolvedFocusedVerification(task.verifyEvidence, currentWorkingTreeDigest, currentWorkspaceRevisionDigest(cwd)).length > 0) missing.push("current passing rerun of failed focused verification");
   if (finalGate.requireTrace && task.trace.outcome !== "completed") missing.push("completed final trace");
   const incompleteSteps = (task.workPlan ?? []).filter((step) => step.status === "pending" || step.status === "in-progress" || step.status === "failed");
   if (task.trace.outcome === "completed" && incompleteSteps.length > 0) {
     missing.push(`completed work plan (${incompleteSteps.map((step) => `${step.id}:${step.status}`).join(", ")})`);
   }
   const changedFileEvidence = taskChangedFileEvidence(cwd, task, currentDigests);
+  const acceptanceEvidenceFiles = taskAcceptanceEvidenceFiles(cwd, task, currentDigests, changedFileEvidence.expected);
   if (task.changeMode === "source-change" && task.trace.outcome === "completed" && task.mutationPolicy !== "forbidden") {
-    if (task.changedFiles.length === 0) missing.push("changed files");
+    if (task.mutationPolicy !== "allowed" && task.changedFiles.length === 0) missing.push("changed files");
     if (changedFileEvidence.undeclared.length > 0) missing.push(`declared observed changes (${changedFileEvidence.undeclared.join(", ")})`);
     if (changedFileEvidence.unsupportedClaims.length > 0) missing.push(`supported changed-file claims (${changedFileEvidence.unsupportedClaims.join(", ")})`);
-    if (changedFileEvidence.outsideScope.length > 0) missing.push(`changes within task scope (${changedFileEvidence.outsideScope.join(", ")})`);
+    if (changedFileEvidence.outsideScope.length > 0) {
+      warnings.push(`Task focus expanded beyond the initial scope (${changedFileEvidence.outsideScope.join(", ")}).`);
+    }
   }
   if ((task.changeMode === "read-only" || task.mutationPolicy === "forbidden") && changedFileEvidence.expected.length > 0) {
     missing.push(`mutation-forbidden task has observed changes (${changedFileEvidence.expected.join(", ")})`);
   }
   const acceptance = refreshAcceptanceReceipt(task, {
-    cwd,
-    changedFiles: changedFileEvidence.expected,
+    cwd, apiBaselineEvidence,
+    changedFiles: acceptanceEvidenceFiles,
     currentWorkingTreeDigest
   });
   const semanticEnforcement = taskAuthorityDecision(task, "CAP-13", "block").allowed;
-  if (semanticEnforcement && acceptance.criticalMissing.length > 0) {
-    missing.push(`critical acceptance evidence (${acceptance.criticalMissing.map((criterion) => `${criterion.id}:${criterion.obligation}`).join(", ")})`);
-  }
+  // Runtime-derived critical proof gates completion. A zero-delta review
+  // uses its strictly bound evidence scope without claiming a new mutation.
+  // Neutral artifacts with missing content proof use source-proof-required;
+  // unsupported language policy remains under the existing CAP-13 authority.
+  const proofMissing: string[] = [];
+  const runtimeCriticalProofEnforcement = task.changeMode === "source-change"
+    && task.acceptanceReceipt?.source === "runtime";
+  const abstainedIds = new Set(acceptance.adapterAbstained.map((criterion) => criterion.id));
+  const independentIds = new Set(acceptance.independentRequired.map((criterion) => criterion.id));
+  const sourceProofIds = new Set(acceptance.sourceProofRequired.map((criterion) => criterion.id));
+  const adapterCritical = acceptance.criticalMissing.filter((criterion) => abstainedIds.has(criterion.id) && !independentIds.has(criterion.id));
+  const linkedCritical = acceptance.criticalMissing.filter((criterion) => !abstainedIds.has(criterion.id) && !independentIds.has(criterion.id) && !sourceProofIds.has(criterion.id));
+  if ((semanticEnforcement || runtimeCriticalProofEnforcement) && sourceProofIds.size > 0) proofMissing.push(`critical acceptance evidence source-proof-required (${acceptance.sourceProofRequired.map((criterion) => `${criterion.id}:${criterion.obligation}`).join(", ")}); remedy: source proof remains unestablished after current focused tests passed; seek assessment, not source repair without a counterexample`);
+  if ((semanticEnforcement || runtimeCriticalProofEnforcement) && independentIds.size > 0) proofMissing.push(`critical acceptance evidence independent-required (${acceptance.independentRequired.map((criterion) => `${criterion.id}:${criterion.obligation}`).join(", ")}); remedy: an approved independent assessment must cover every clause; missing proof is not an observed source defect`);
+  if ((semanticEnforcement || runtimeCriticalProofEnforcement) && linkedCritical.length > 0) proofMissing.push(`critical acceptance evidence (${linkedCritical.map((criterion) => `${criterion.id}:${criterion.obligation}`).join(", ")})`);
+  if (semanticEnforcement && adapterCritical.length > 0) proofMissing.push(`critical acceptance evidence adapter-unresolved (${adapterCritical.map((criterion) => `${criterion.id}:${criterion.obligation}`).join(", ")}); remedy: add a direct-relative focused test or configure a deterministic adapter`);
   const acceptanceConflicts = acceptanceSemanticConflicts(task, {
     cwd,
-    changedFiles: changedFileEvidence.expected
+    changedFiles: acceptanceEvidenceFiles
   });
   if (semanticEnforcement && acceptanceConflicts.length > 0) {
     missing.push(`acceptance semantic conflicts (${acceptanceConflicts.join(", ")})`);
   }
-  const normalMissing = acceptance.missing.filter((criterion) => criterion.priority !== "critical");
-  if (!semanticEnforcement && (acceptance.criticalMissing.length > 0 || acceptanceConflicts.length > 0)) warnings.push("Acceptance projection is advisory under the pinned task authority and cannot block completion.");
+  const criticalIds = new Set(acceptance.criticalMissing.map((criterion) => criterion.id));
+  const normalMissing = acceptance.missing.filter((criterion) => !criticalIds.has(criterion.id));
+  if (semanticEnforcement && acceptance.adapterAbstained.length > 0) {
+    warnings.push(`Acceptance proof adapter abstained; rigorous criteria remain pending and hand off without an automatic model retry: ${acceptance.adapterAbstained.map((criterion) => `${criterion.id}:${criterion.obligation}`).join(", ")}`);
+  }
+  if (!semanticEnforcement && (adapterCritical.length > 0 || acceptanceConflicts.length > 0)) warnings.push("Adapter-unknown acceptance proof and semantic conflicts remain advisory under the pinned task authority; known runtime-linked critical proof still gates source-task completion.");
   if (normalMissing.length > 0) {
     warnings.push(`Acceptance criteria pending evidence: ${normalMissing.map((criterion) => `${criterion.id}:${criterion.obligation}`).join(", ")}`);
   }
-  return { decision: missing.length === 0 ? "pass" : "fail", missing, missingVerifyCommands, warnings, currentWorkingTreeDigest, changedFileEvidence };
+  const acceptanceProof = { mode: finalGate.acceptanceProofMode,
+    pendingCriterionIds: acceptance.missing.map(criterion => criterion.id), missing: proofMissing };
+  if (finalGate.acceptanceProofMode === "diagnostic" && acceptanceProof.pendingCriterionIds.length > 0) {
+    warnings.push(`Diagnostic acceptance: ${acceptanceProof.pendingCriterionIds.length} criteria remain unproved; no quality claim. ${proofMissing.join("; ")}`);
+  } else missing.push(...proofMissing);
+  return { decision: missing.length === 0 ? "pass" : "fail", missing, missingVerifyCommands, warnings, currentWorkingTreeDigest, changedFileEvidence, ...(finalGate.acceptanceProofMode === "diagnostic" ? { acceptanceProof } : {}) };
 }
 
 function appendTrace(cwd: string, payload: Record<string, unknown>): void {
@@ -3912,14 +3775,28 @@ export default function piagentGuard(pi: ExtensionAPI) {
   const routingObjective = routingObjectiveFromEnvironment(process.env.PIAGENT_ROUTING_OBJECTIVE);
   const autoContextEnabled = environmentFeatureEnabled("PIAGENT_AUTO_CONTEXT");
   const autoRecoveryEnabled = environmentFeatureEnabled("PIAGENT_AUTO_RECOVERY");
-  const runtimeState = new RuntimeSessionState({
-    maxObservedContext: contextBudgetConfig(policy).maxManifestFiles
-  });
+  const independentVerificationConfigPath = process.env.PIAGENT_INDEPENDENT_VERIFICATION_CONFIG,
+    runtimeState = new RuntimeSessionState({ maxObservedContext: contextBudgetConfig(policy).maxManifestFiles });
+  const independentAcceptance = new IndependentAcceptanceRuntime({ state: runtimeState, installedRoot: PLATFORM_ROOT,
+    configPath: independentVerificationConfigPath,
+    writeTask,
+    activeTask: (ctx) => activeSessionTask(ctx.cwd, ctx.sessionManager.getSessionId()) as TaskContract | undefined,
+    authorizeSourceRead: (ctx, sourcePath) => {
+      if (!ctx.isProjectTrusted()) return false;
+      const profile = loadProfileFromContext(ctx), paths = effectiveProtectedPaths(policy, profile);
+      const capabilities = verifyProjectCapabilityState(extensionDir, ctx.cwd, true, { sessionId: ctx.sessionManager.getSessionId() });
+      if (!capabilities.ok) return false;
+      const permission = resolvePermissionProfile(profile, policy, permissionOverrideFromContext(ctx));
+      return !evaluatePathLikeToolAccess(ctx.cwd, "read", { path: sourcePath }, paths.writeProtectedPaths, paths.readProtectedPaths,
+        paths.readOnlyPaths, permission.mode === "trusted-full-access" ? undefined : capabilities.filesystemRead).block;
+    } });
+  const editFreshnessGuard = new EditFreshnessGuard(editFreshnessModeFromEnvironment(process.env.PIAGENT_EDIT_FRESHNESS));
   const sourceMutationGuardBindings = createSourceMutationGuardBindings(policy, loadProfileFromContext);
   const runtimeSnapshotCapture = new RuntimeSnapshotCapture(), runtimeVersions = readRuntimeVersionMetadata(PLATFORM_ROOT);
   const solverShadow = solverMode === "off" ? undefined : new SolverShadowRuntime(solverMode);
   const modelRouteRuntime = new ModelRouteRuntime(parentRoutingMode, routingObjective);
   const modelSelectionProvenance = new ModelSelectionProvenanceTracker();
+  const serviceTierRuntime = new ServiceTierRuntime({ environmentValue: process.env.PIAGENT_FAST_MODE });
   const trajectoryRuntime = new TrajectoryRuntime(), phaseToolRuntime = new PhaseToolRuntime(pi, dynamicToolsEnabled ? phaseToolModeFromEnvironment(process.env.PIAGENT_PHASE_TOOLS) : "off", telemetry, (ctx) => {
     const task = activeSessionTask(ctx.cwd, ctx.sessionManager.getSessionId()) as TaskContract | undefined; return task && authorityReplacementState(ctx.cwd, task).required ? "new-attempt-required" : task?.workingTreeDigestMigration?.status;
   }, (ctx) => {
@@ -3963,8 +3840,25 @@ export default function piagentGuard(pi: ExtensionAPI) {
         providerReasoningReasonCode: normalized.reasonCode
       });
     }
+    const serviceTier = serviceTierRuntime.applyProviderRequest(
+      pi,
+      ctx,
+      normalized.changed ? normalized.payload : event.payload
+    );
+    if (serviceTier.receipt.enabled || serviceTier.observationChanged) {
+      telemetry(ctx, {
+        event: "provider_request_service_tier",
+        fastMode: serviceTier.receipt.mode,
+        requestedServiceTier: serviceTier.receipt.requestedServiceTier,
+        observedRequestServiceTier: serviceTier.receipt.observedRequestServiceTier,
+        providerResponseServiceTier: serviceTier.receipt.providerResponseServiceTier,
+        providerResponseEvidence: serviceTier.receipt.providerResponseEvidence,
+        applied: serviceTier.receipt.applied,
+        reasonCode: serviceTier.receipt.reasonCode
+      });
+    }
     const wire = buildOpenAiCodexWireFingerprint({
-      payload: normalized.changed ? normalized.payload : event.payload,
+      payload: serviceTier.payload,
       provider: ctx.model?.provider,
       modelId: ctx.model?.id,
       workingDirectory: ctx.cwd,
@@ -3989,10 +3883,11 @@ export default function piagentGuard(pi: ExtensionAPI) {
         providerTextVerbosity: wire.textVerbosity,
         providerToolChoiceKind: wire.toolChoiceKind,
         providerToolChoiceHash: wire.toolChoiceHash,
-        requestPrefixFingerprint: wire.requestPrefixFingerprint
+        requestPrefixFingerprint: wire.requestPrefixFingerprint,
+        payloadMeasurement: measureProviderPayload(serviceTier.payload)
       });
     }
-    return normalized.changed ? normalized.payload : undefined;
+    return normalized.changed || serviceTier.changed ? serviceTier.payload : undefined;
   });
 
   function freshModelRouteBoundary(ctx: ExtensionContext): boolean {
@@ -4073,6 +3968,15 @@ export default function piagentGuard(pi: ExtensionAPI) {
     }
   }
 
+  function preferApplyPatchBeforeWriters(toolNames: string[]): string[] {
+    if (!toolNames.includes("apply_patch")) return [...toolNames];
+    const withoutPatch = toolNames.filter((toolName) => toolName !== "apply_patch");
+    const firstWriter = withoutPatch.findIndex((toolName) => toolName === "edit" || toolName === "write");
+    if (firstWriter < 0) return [...toolNames];
+    withoutPatch.splice(firstWriter, 0, "apply_patch");
+    return withoutPatch;
+  }
+
   function activateToolGroups(ctx: ExtensionContext, groups: PiagentToolGroup[], additive = false): string[] {
     const current = pi.getActiveTools();
     if (!dynamicToolsEnabled) return current;
@@ -4091,7 +3995,7 @@ export default function piagentGuard(pi: ExtensionAPI) {
       }
     }
     const ordered = [
-      ...current.filter((toolName) => selected.has(toolName) && !PIAGENT_TOOL_NAMES.has(toolName)),
+      ...preferApplyPatchBeforeWriters(current.filter((toolName) => selected.has(toolName) && !PIAGENT_TOOL_NAMES.has(toolName))),
       ...PIAGENT_TOOL_ORDER.filter((toolName) => selected.has(toolName))
     ];
     const unchanged = ordered.length === current.length && ordered.every((toolName, index) => toolName === current[index]);
@@ -4120,25 +4024,28 @@ export default function piagentGuard(pi: ExtensionAPI) {
     let recordedClassification: FailureClassification | undefined;
     try {
       const replay = replayTaskCheckpoints(ctx.cwd, task.taskRunId, task);
-      if (replay.corruptions.length === 0) {
-        const checkpoint = replay.checkpoints
-          .filter((item) => item.phase === "verify" && item.status === "failed")
-          .at(-1) as any;
-        recordedClassification = checkpoint?.evidence?.failureClassification as FailureClassification | undefined;
-      }
+      if (replay.corruptions.length === 0 && failed) recordedClassification = recordedFailureForObservation(
+        replay.checkpoints, failed, currentTreeDigest, currentWorkspaceRevisionDigest(ctx.cwd)
+      ) as FailureClassification | undefined;
     } catch {
       // A missing/corrupt journal cannot grant recovery mutation; the fallback
       // classifier remains fail-closed for unknown evidence.
     }
-    const classification = selectCompletionRecoveryClassification(
+    const gateClassification = selectCompletionRecoveryClassification(
       recordedClassification,
       gate?.missing,
       summary,
       failed?.exitCode ?? 1
     );
+    const independentRecovery = independentVerificationRecovery(ctx.cwd, task, currentTreeDigest ?? workingTreeEvidenceDigest(workingTreeSnapshot(ctx.cwd)));
+    const classification = gateClassification.category === "scope-protected-path"
+      ? gateClassification : independentRecovery?.classification ?? gateClassification;
     const trajectory = trajectoryRuntime.status(ctx.cwd, task.taskRunId);
-    const dependencyMutationAuthorized = task.scope.some((entry) => /(?:^|\/)(?:package(?:-lock)?\.json|pnpm-lock\.yaml|yarn\.lock|[^/]*(?:config|lock)[^/]*)$/i.test(entry));
-    return selectRecoveryDecision({
+    // Task scope is a retrieval/review hint, not filesystem authority. Recovery
+    // may update a dependency or config file when repository evidence requires
+    // it; protected-path and approval policy still run on the exact call.
+    const dependencyMutationAuthorized = true;
+    const selected = selectRecoveryDecision({
       featureEnabled: autoRecoveryEnabled && taskAuthorityDecision(task, "CAP-12", "model-turn").allowed,
       task: {
         taskId: task.taskId,
@@ -4150,13 +4057,16 @@ export default function piagentGuard(pi: ExtensionAPI) {
       classification,
       currentPhase: trajectory.enforcementSafe ? trajectory.phase ?? "verify" : "handoff",
       history: runtimeState.recoveryHistory(task.taskId),
-      proposedHypothesisRef: classification.reasonCodes[0] ? `reason:${classification.reasonCodes[0]}` : null,
+      proposedHypothesisRef: independentRecovery?.hypothesisRef ?? (classification.reasonCodes[0] ? `reason:${classification.reasonCodes[0]}` : null),
       exactVerifierAvailable: (gate?.missingVerifyCommands.length ?? task.verifyCommands.length) > 0,
       currentTreeMatchesEvidence: currentTreeDigest && latestExactVerifier?.workingTreeDigest
-        ? currentTreeDigest === latestExactVerifier.workingTreeDigest
+        ? currentTreeDigest === latestExactVerifier.workingTreeDigest && latestExactVerifier.preWorkspaceRevisionDigest === currentWorkspaceRevisionDigest(ctx.cwd)
+          && latestExactVerifier.workspaceRevisionDigest === latestExactVerifier.preWorkspaceRevisionDigest
         : true,
-      dependencyMutationAuthorized
+      dependencyMutationAuthorized,
+      independentDisposition: independentRecovery?.independentDisposition
     });
+    return applyProofCapabilityHandoff(selected, gate?.missing, Boolean(independentRecovery));
   }
 
   function trajectoryRecoveryOptions(ctx: ExtensionContext, task: TaskContract, options: any): any {
@@ -4194,6 +4104,7 @@ export default function piagentGuard(pi: ExtensionAPI) {
     resolveTaskAny: (cwd, reference) => resolveTaskContract(cwd, reference, undefined) as TaskContract | undefined,
     bindTask: bindSessionTask,
     writeTask,
+    appendTrace,
     capabilityState: (ctx) => verifyProjectCapabilityState(extensionDir, ctx.cwd, ctx.isProjectTrusted(), { allowRepin: true, forceFull: true, sessionId: ctx.sessionManager.getSessionId() }),
     permissionProfile: (ctx, profile) => resolvePermissionProfile(profile, policy, permissionOverrideFromContext(ctx)),
     legacyProjectWarning: legacyProjectStateWarning,
@@ -4221,7 +4132,15 @@ export default function piagentGuard(pi: ExtensionAPI) {
       })));
     },
     telemetry,
-    afterStart: async (ctx) => { sourceMutationGuardBindings.bind(ctx); await activityInspector.refresh(ctx); }
+    afterStart: async (ctx) => {
+      await independentAcceptance.activate(ctx);
+      const serviceTier = serviceTierRuntime.restore(ctx);
+      if (serviceTier.enabled && serviceTier.reasonCode === "provider-not-supported") {
+        ctx.ui.notify("Piagent Fast mode is enabled, but the active provider is not OpenAI Codex; no service tier was changed.", "warning");
+      }
+      sourceMutationGuardBindings.bind(ctx);
+      await activityInspector.refresh(ctx);
+    }
   });
 
   registerSessionHooks(pi, {
@@ -4235,12 +4154,17 @@ export default function piagentGuard(pi: ExtensionAPI) {
     flushObservedTaskContext,
     onTurnEnd: activityInspector.refresh,
     onAgentSettled: activityInspector.refresh,
-    beforeShutdown: (ctx) => {
+    beforeShutdown: async (ctx) => {
+      await independentAcceptance.clear(ctx);
+      serviceTierRuntime.forget(ctx);
       sourceMutationGuardBindings.unbind(ctx);
+      editFreshnessGuard.clear(ctx);
       activityInspector.dispose(ctx);
       sessionCapabilityDigests.delete(`${ctx.cwd}\0${ctx.sessionManager.getSessionId()}`);
     }
   });
+  registerTaskUsageHooks(pi, { activeTask: (ctx) => activeSessionTask(ctx.cwd, ctx.sessionManager.getSessionId()) as TaskContract | undefined, telemetry });
+  pi.on("turn_end", (event, ctx) => independentAcceptance.observeTurnEnd(ctx, event.message));
 
   registerInputHook(pi, {
     state: runtimeState,
@@ -4292,10 +4216,15 @@ export default function piagentGuard(pi: ExtensionAPI) {
 
   registerCompletionHook(pi, {
     state: runtimeState,
+    prepareIndependentAcceptance: (ctx, task, response) => independentAcceptance.prepare(ctx, task, response),
+    deferIndependentCompletion: (ctx, task, response, finalizer) => independentAcceptance.deferCompletion(ctx, task, response, finalizer),
+    projectIndependentLifecycle: (ctx, task, candidate) => independentAcceptance.projectLifecycle(ctx, task, candidate),
+    nativeRefusalFallbackAllowed: () => !independentVerificationConfigPath,
     maxManifestFiles: contextBudgetConfig(policy).maxManifestFiles,
     activeTask: (ctx) => activeSessionTask(ctx.cwd, ctx.sessionManager.getSessionId()) as TaskContract | undefined,
     flushObservedTaskContext,
     completionProjection: completionTaskProjection,
+    acceptanceEvidenceFiles: taskAcceptanceEvidenceFiles,
     evaluateGate: (cwd, task, currentDigests, currentDigest) => {
       const gate = evaluateTaskGate(cwd, task, policy, { currentDigests, currentWorkingTreeDigest: currentDigest });
       const repairBlock = (taskAuthorityDecision(task, "CAP-13", "block").allowed
@@ -4327,13 +4256,43 @@ export default function piagentGuard(pi: ExtensionAPI) {
     redactText,
     observedTaskContext: observedTaskContextFromToolResult,
     recordObservedTaskChanges,
-    recordObservedTaskVerification,
+    recordObservedTaskVerification: (...args) => recordObservedTaskVerification(...args, policy.finalGate?.acceptanceProofMode === "diagnostic"),
     extractLikelyPath: extractLikelyPathFromInput,
     mutationTargets: taskMutationTargets,
     isShellTool: (toolName) => SHELL_TOOL_NAMES.has(toolName),
     telemetry,
     activity: recordActivity,
     now: nowIso,
+    recordSubagentResult: (ctx, event, result) => {
+      const task = activeSessionTask(ctx.cwd, ctx.sessionManager.getSessionId()) as TaskContract | undefined;
+      const written = recordDirectSubagentResult(task, event, result, {
+        now: nowIso,
+        persist: (candidate) => writeTask(ctx.cwd, candidate),
+        trace: (payload) => appendTrace(ctx.cwd, payload),
+        sessionTrace: (payload) => appendSessionTrace(pi, payload)
+      });
+      telemetry(ctx, {
+        event: "helper_result_classified",
+        recordedAt: nowIso(),
+        taskRunId: written?.taskRunId,
+        toolCallId: event.toolCallId,
+        spawned: result.spawned,
+        failed: result.failed,
+        disposition: result.disposition,
+        reasonCode: result.reasonCode,
+        calls: result.calls,
+        tokens: result.tokens
+      });
+    },
+    observeEditFreshness: (ctx, event, metadata) => {
+      if (!metadata.successful || !metadata.taskRunId) return;
+      const protectedPaths = effectiveProtectedPaths(policy, loadProfileFromContext(ctx)).readProtectedPaths;
+      const source = event.toolName === "read" ? "read" : ["edit", "write", "apply_patch"].includes(event.toolName) ? "mutation" : undefined;
+      const candidates = source === "read" && metadata.targetPath ? [metadata.targetPath] : source === "mutation" ? metadata.mutationTargets : [];
+      const safeTargets = candidates.filter((file) => !matchesProtectedPath(file, protectedPaths));
+      const observed = source ? editFreshnessGuard.observe(ctx, metadata.taskRunId, safeTargets, source, nowIso()) : [];
+      if (observed.length) telemetry(ctx, { event: "edit_freshness_snapshot_observed", taskRunId: metadata.taskRunId, source, paths: observed.map(redactText) });
+    },
     completeSemanticRepair: (ctx, event, metadata) => {
       const task = activeSessionTask(ctx.cwd, ctx.sessionManager.getSessionId()) as TaskContract | undefined;
       return task && (taskAuthorityDecision(task, "CAP-13", "mutate").allowed
@@ -4354,10 +4313,43 @@ export default function piagentGuard(pi: ExtensionAPI) {
     activity: recordActivity,
     beforeAuthorize: (event, ctx) => {
       const toolInput = isPlainRecord(event.input) ? event.input : {};
+      const task = activeSessionTask(ctx.cwd, ctx.sessionManager.getSessionId()) as TaskContract | undefined;
+      const helperPreflight = evaluateDirectSubagentDispatch({
+        toolName: event.toolName,
+        toolInput,
+        cwd: ctx.cwd,
+        helpersMode: task ? taskHelperUsageMode(task) : helpersMode(),
+        taskPending: task?.trace.outcome === "pending",
+        dispatchAuthority: Boolean(task && taskAuthorityDecision(task, "CAP-14", "dispatch").allowed),
+        durableSubagentState: task?.orchestration?.subagents
+      });
+      if (helperPreflight.applicable && helperPreflight.dispatch && !helperPreflight.allowed) {
+        telemetry(ctx, {
+          event: "helper_dispatch_blocked",
+          recordedAt: nowIso(),
+          taskRunId: task?.taskRunId,
+          toolCallId: event.toolCallId,
+          reasonCode: helperPreflight.reasonCode,
+          role: helperPreflight.role,
+          requestCount: helperPreflight.requestCount
+        });
+        return { block: true, reason: `Blocked ${event.toolName}: ${helperPreflight.reason} Do not retry this helper; continue in the parent.` };
+      }
+      const verifierReuse = reuseCurrentTreeExactVerifier({ cwd: ctx.cwd, task, toolName: event.toolName, toolInput, sessionEntries: ctx.sessionManager.getEntries() as unknown[],
+        getHostProjectVerificationDigest: (snapshot, command) => task ? runtimeState.projectVerification.currentDigest(ctx, task, snapshot, command) : null });
+      if (verifierReuse.reused) {
+        telemetry(ctx, { event: "verifier_evidence_reused", recordedAt: nowIso(), taskRunId: task?.taskRunId, toolCallId: event.toolCallId, reasonCode: verifierReuse.reasonCode, commandDigest: verifierReuse.commandDigest, workingTreeDigest: verifierReuse.workingTreeDigest }); return;
+      }
       const targetInspection = authorizationMutationTargetInspection(ctx.cwd, event.toolName, toolInput);
       if (targetInspection.reason) return { block: true, reason: `Blocked ${event.toolName}: ${targetInspection.reason}.` };
+      if (task?.trace.outcome === "pending" && task.changeMode === "source-change" && (event.toolName === "edit" || targetInspection.exactLocalPatchExecutor)) {
+        const freshness = editFreshnessGuard.evaluate(ctx, task.taskRunId, targetInspection.targets);
+        if (freshness.decision === "stale") {
+          telemetry(ctx, { event: "edit_freshness_stale", taskRunId: task.taskRunId, toolCallId: event.toolCallId, enforce: freshness.enforce, paths: freshness.stalePaths.map(redactText) });
+          if (freshness.enforce) return { block: true, reason: `Blocked ${event.toolName}: the previously observed source snapshot is stale for ${freshness.stalePaths.map(redactText).join(", ")}. Reread the affected file once; no patch hunk was started.` };
+        }
+      }
       if (!["edit", "write"].includes(event.toolName) && !targetInspection.exactLocalPatchExecutor) return;
-      const task = activeSessionTask(ctx.cwd, ctx.sessionManager.getSessionId()) as TaskContract | undefined;
       if (!task || task.trace.outcome !== "pending" || task.changeMode !== "source-change") return;
       const semanticRepairEnabled = taskAuthorityDecision(task, "CAP-13", "mutate").allowed;
       const semanticRepairExactlyOff = !taskAuthorityDecision(task, "CAP-13", "observe").allowed;
@@ -4374,11 +4366,10 @@ export default function piagentGuard(pi: ExtensionAPI) {
       const currentDigest = workingTreeEvidenceDigest(currentSnapshot);
       const expectedReviewPaths = taskDeltaFilesFromSnapshot(task, currentSnapshot);
       const targets = targetInspection.targets;
-      const boundedInScopeMutation = targets.length > 0
-        && targets.every((file) => taskScopeIncludesPath(task.scope, file));
-      const verifierCurrent = allVerifyCommandsPassCurrentTree(task, currentDigest);
+      const boundedTargetMutation = targets.length > 0;
+      const verifierCurrent = allVerifyCommandsPassCurrentTree(task, currentDigest, currentWorkspaceRevisionDigest(ctx.cwd));
 
-      if (phase.phase === "verify" && boundedInScopeMutation && semanticRepairEnabled && semanticRepairRuntime.prepare({
+      if (phase.phase === "verify" && boundedTargetMutation && semanticRepairEnabled && semanticRepairRuntime.prepare({
         ctx, task, event, currentDigest, currentDeltaPaths: expectedReviewPaths, targetPaths: targets,
         verifierCurrent
       })) return;
@@ -4388,7 +4379,7 @@ export default function piagentGuard(pi: ExtensionAPI) {
       // model catches its own omission in the same task/run/session. The call
       // still traverses every normal authorization check; verify -> repair is
       // committed only by the tool-result hook after a successful tree change.
-      if (phase.phase === "verify" && boundedRecoveryEnabled && verifierCurrent && boundedInScopeMutation) {
+      if (phase.phase === "verify" && boundedRecoveryEnabled && verifierCurrent && boundedTargetMutation) {
         const authoredFileDigests = runtimeState.successfulModelMutationDigests(
           { taskId: task.taskId, taskRunId: task.taskRunId, sessionId: task.sessionId },
           currentSnapshot
@@ -4436,7 +4427,7 @@ export default function piagentGuard(pi: ExtensionAPI) {
         return reviewDecision;
       }
 
-      if (targets.length === 0 || targets.some((file) => !taskScopeIncludesPath(task.scope, file))) return;
+      if (targets.length === 0) return;
       const result = trajectoryRuntime.sync(ctx.cwd, ctx.sessionManager.getSessionId(), task, {
         sourceHook: "tool-call",
         recoveryRequested: true,
@@ -4460,11 +4451,9 @@ export default function piagentGuard(pi: ExtensionAPI) {
       const targetInspection = authorizationMutationTargetInspection(ctx.cwd, event.toolName, toolInput);
       if (targetInspection.reason) return { block: true, reason: `Blocked ${event.toolName}: ${targetInspection.reason}.` };
       const targets = targetInspection.targets;
-      if ((["edit", "write"].includes(event.toolName) || targetInspection.patchCarrier) && (
-        targets.length === 0 || targets.some((file) => !taskScopeIncludesPath(task.scope, file))
-      )) {
+      if ((["edit", "write"].includes(event.toolName) || targetInspection.patchCarrier) && targets.length === 0) {
         runtimeState.denyPerformanceReviewTool(task.taskRunId);
-        return { block: true, reason: `Task ${task.taskId} semantic repair must stay inside its declared task scope.` };
+        return { block: true, reason: `Task ${task.taskId} semantic repair requires an exact statically bounded target.` };
       }
       const reviewDecision = performanceReviewToolDecision({
         toolName: event.toolName,
@@ -4492,6 +4481,30 @@ export default function piagentGuard(pi: ExtensionAPI) {
     },
     afterAuthorized: (event, ctx, metadata) => {
       const task = activeSessionTask(ctx.cwd, ctx.sessionManager.getSessionId()) as TaskContract | undefined;
+      const helperPreflight = evaluateDirectSubagentDispatch({
+        toolName: event.toolName,
+        toolInput: event.input,
+        cwd: ctx.cwd,
+        helpersMode: task ? taskHelperUsageMode(task) : helpersMode(),
+        taskPending: task?.trace.outcome === "pending",
+        dispatchAuthority: Boolean(task && taskAuthorityDecision(task, "CAP-14", "dispatch").allowed),
+        durableSubagentState: task?.orchestration?.subagents
+      });
+      if (helperPreflight.applicable && helperPreflight.dispatch && helperPreflight.allowed) {
+        const reserved = reserveDirectSubagentDispatch(task, metadata.toolCallId, {
+          now: nowIso,
+          persist: (candidate) => writeTask(ctx.cwd, candidate),
+          trace: (payload) => appendTrace(ctx.cwd, payload)
+        });
+        telemetry(ctx, {
+          event: "helper_dispatch_reserved",
+          recordedAt: nowIso(),
+          taskRunId: reserved?.taskRunId,
+          toolCallId: metadata.toolCallId,
+          role: helperPreflight.role,
+          requestCount: helperPreflight.requestCount
+        });
+      }
       if (task?.trace.outcome === "pending") {
         const snapshot = workingTreeSnapshot(ctx.cwd) as Record<string, string>;
         const currentDigest = workingTreeEvidenceDigest(snapshot);
@@ -4604,7 +4617,7 @@ export default function piagentGuard(pi: ExtensionAPI) {
     const governedTaskProfile = !profileMode.startsWith("unprofiled") && !profileMode.includes("unreadable");
     const taskContractRequired = governedTaskProfile
       && runtime.finalGate === "enforce"
-      && finalGateConfig(policy).requireTaskContract;
+      && finalGateConfig(policy, DEFAULT_POLICY).requireTaskContract;
     if (sessionTask?.trace.outcome === "pending" && (sessionTask.changeMode === "read-only" || sessionTask.mutationPolicy === "forbidden")
       && !SHELL_TOOL_NAMES.has(event.toolName) && isTaskMutationTool(event.toolName, toolInput)) {
       return {
@@ -4639,7 +4652,13 @@ export default function piagentGuard(pi: ExtensionAPI) {
       const execDecision = evaluateExecPolicy(command, profile, policy);
       authorizedShellCommand = command;
       authorizedShellSegments = execDecision.segments;
-      shellProjectMutation = isProjectMutatingShellCommand(command, execDecision.segments);
+      if (shellTouchesGrantedSourceCheckout(ctx.cwd, command, runtimeState.sourceCheckoutReadRoots(ctx))) {
+        return {
+          block: true,
+          reason: "Shared source checkouts are shell-inaccessible. Inspect the exact session-granted checkout with read, grep, find, or ls; cache mutation is never authorized."
+        };
+      }
+      shellProjectMutation = isProjectMutatingShellCommand(command, execDecision.segments, ctx.cwd);
       configuredVerifierShell = Boolean(sessionTask && commandMatchesVerifyPlan(command, sessionTask.verifyCommands));
       const shellWriteCandidates = extractShellWritePathCandidates(command);
       shellMutationTargetBounded = shellWriteCandidates.length > 0;
@@ -4655,7 +4674,7 @@ export default function piagentGuard(pi: ExtensionAPI) {
       const mutationForbidden = sessionTask?.trace.outcome === "pending"
         && (sessionTask.changeMode === "read-only" || sessionTask.mutationPolicy === "forbidden");
       const exactForbiddenTaskVerifier = mutationForbidden && sessionTask.changeMode === "source-change" && configuredVerifierShell;
-      if (mutationForbidden && !exactForbiddenTaskVerifier && !isReadOnlyTaskShellCommand(command, execDecision.segments)) {
+      if (mutationForbidden && !exactForbiddenTaskVerifier && !isReadOnlyTaskShellCommand(command, execDecision.segments, ctx.cwd)) {
         return {
           block: true,
           reason: `Task ${sessionTask.taskId} ${sessionTask.changeMode === "read-only" ? "is read-only; this shell command is not in the read-only inspection allowlist" : "forbids source mutation; this shell command is neither bounded inspection nor an exact configured verifier"}.`
@@ -4730,7 +4749,8 @@ export default function piagentGuard(pi: ExtensionAPI) {
       {
         forceScopeAware: authorizationTargetInspection.patchCarrier || Boolean(preparedInput.proxyToolName),
         forceWrite: authorizationTargetInspection.patchCarrier || preparedInput.proxyAction?.decision === "confirm",
-        allowAmbiguousFilesystemContentFields: !usesKnownExternalProvider && !isPiagentTool(event.toolName)
+        allowAmbiguousFilesystemContentFields: !usesKnownExternalProvider && !isPiagentTool(event.toolName),
+        sourceCheckoutReadRoots: runtimeState.sourceCheckoutReadRoots(ctx)
       }
     );
     if (pathDecision.block) {
@@ -4816,32 +4836,18 @@ export default function piagentGuard(pi: ExtensionAPI) {
           + " Call `piagent_task_start` once with explicit project-relative scope, then retry."
       };
     }
-    if (sessionTask?.trace.outcome === "pending" && sessionTask.changeMode === "source-change") {
-      if (
-        shellProjectMutation
-        && opaqueShellMutationNeedsBoundedTarget(authorizedShellCommand, authorizedShellSegments)
-        && !shellMutationTargetBounded
-        && !configuredVerifierShell
-      ) {
-        return {
-          block: true,
-          reason: `Task ${sessionTask.taskId} cannot run an opaque shell mutation whose write target is not statically bounded. Use edit/write/apply_patch, an explicit in-scope redirection, or the exact configured verifier.`
-        };
-      }
-      const outsideScope = mutationTargets.filter((file) => !taskScopeIncludesPath(sessionTask.scope, file));
-      if (outsideScope.length > 0) {
-        return {
-          block: true,
-          reason: `Task ${sessionTask.taskId} cannot mutate paths outside its declared scope: ${outsideScope.join(", ")}.`
-        };
-      }
-      const outsideEvidenceRoot = mutationTargets.filter((file) => !pathWithinChangeEvidenceRoot(ctx.cwd, file));
-      if (outsideEvidenceRoot.length > 0) {
-        return {
-          block: true,
-          reason: `Task ${sessionTask.taskId} cannot mutate paths outside a change evidence root: ${outsideEvidenceRoot.join(", ")}. In a parent workspace with separate repos, write under a child repo or a scoped workspace directory such as plans/**.`
-        };
-      }
+    if (
+      sessionTask?.trace.outcome === "pending"
+      && sessionTask.changeMode === "source-change"
+      && shellProjectMutation
+      && opaqueShellMutationNeedsBoundedTarget(authorizedShellCommand, authorizedShellSegments)
+      && !shellMutationTargetBounded
+      && !configuredVerifierShell
+    ) {
+      return {
+        block: true,
+        reason: `Task ${sessionTask.taskId} cannot run an opaque shell mutation whose write target is not statically bounded. Use edit/write/apply_patch, an explicit project-local redirection, or the exact configured verifier.`
+      };
     }
     if (runtime.contextBudget !== "off" && (["write", "edit"].includes(event.toolName) || authorizationTargetInspection.patchCarrier)) {
       const budgetTargets = authorizationTargetInspection.patchCarrier
@@ -4873,7 +4879,7 @@ export default function piagentGuard(pi: ExtensionAPI) {
       && sessionTask.changeMode === "source-change"
       && (shellProjectMutation || configuredVerifierShell)
     ) {
-      runtimeState.rememberShellMutationSnapshot(ctx, event.toolName, event.input);
+      runtimeState.rememberShellMutationSnapshot(ctx, event.toolName, event.input, event.toolCallId);
     }
     }
   });
@@ -4895,6 +4901,8 @@ export default function piagentGuard(pi: ExtensionAPI) {
     createTaskRunId, crypto, currentSessionName, defaultRolePolicy, defaultWorkPlan, digestJson,
     dynamicToolsEnabled, effectiveProtectedPaths, emitRuntimeMessage, ensureContextIndexV2, estimateContextTokens,
     evaluateExecPolicy, evaluateModelRoute, evaluateRetrievalRoute, evaluateRuntimeSolver, evaluateTaskGate, evaluateToolPolicy, execPolicyConfig,
+    prepareIndependentAcceptance: (ctx: ExtensionContext, task: TaskContract, response?: { origin: "assistant"; bytes: string }) =>
+      independentAcceptance.prepare(ctx, task, response),
     extensionDir, externalActionPolicyConfig, extractDocument, finalGateConfig, findMatchingObservedBashResult,
     formatContextPreflight, formatCount, formatLiveTaskStatus, formatPercent, formatTechOptionsText, formatTechSelectionSummary,
     formatToolResultCaptureStatus, formatUsageSnapshot, fs, hasGitEvidenceRoot, hasOperatorSessionName, helpersMode,
@@ -4912,7 +4920,7 @@ export default function piagentGuard(pi: ExtensionAPI) {
     safeTaskId, searchContextIndex, searchContextIndexV2, searchMemoryFiles, selectRuntimeAction,
     selectValueFromUi, selectVerificationPlan, semanticCompactionInstructions, sendWorkflowFollowUp, setPermissionOverrideForContext,
     semanticRepairCompletionBlock: (cwd: string, taskRunId: string) => semanticRepairRuntime.completionBlock(cwd, taskRunId),
-    freshRequestParts, shellArg, shortTaskLabel, solverShadow, summarizeAttempt, taskChangedFileEvidence,
+    freshRequestParts, shellArg, shortTaskLabel, solverShadow, summarizeAttempt, taskAcceptanceEvidenceFiles, taskChangedFileEvidence,
     techContextDirPath, techContextFilePath, techContextRelativePath, techOptionById, techStackPath,
     telemetry, toolRegistryConfig, trajectoryRuntime, uniqueStrings, usageExactCommands,
     validTaskScopePattern, validateNewWorkPlan, verifierCommandInstructions, verifyProjectCapabilityState, workingTreeEvidenceDigest,
@@ -4943,9 +4951,10 @@ export default function piagentGuard(pi: ExtensionAPI) {
 
   function commandArgs(raw: string): { action: string; rest: string; tokens: string[] } {
     const trimmed = String(raw ?? "").trim();
-    const tokens = trimmed.split(/\s+/).filter(Boolean);
-    const action = (tokens.shift() ?? "").toLowerCase();
-    return { action, rest: tokens.join(" "), tokens };
+    const match = /^(\S+)(?:\s+([\s\S]*))?$/.exec(trimmed);
+    const action = (match?.[1] ?? "").toLowerCase();
+    const rest = match?.[2] ?? "";
+    return { action, rest, tokens: rest.split(/\s+/).filter(Boolean) };
   }
 
   function shellArg(value: string): string {
@@ -4977,6 +4986,7 @@ export default function piagentGuard(pi: ExtensionAPI) {
   }
 
   registerPermissionCommands(pi, registrationDeps);
+  registerFastModeCommand(pi, serviceTierRuntime);
   const profileCommandApi = registerProfileCommands(pi, registrationDeps);
   registerMemoryMcpCommands(pi, registrationDeps);
   const contextCommandApi = registerContextCommands(pi, registrationDeps);