@piagent/platform 1.6.0 → 1.7.1

package/packages/piagent-core/extensions/verification-intelligence.js

@@ -11,10 +11,25 @@ import {
   validateFailureClassification,
   validateFailureEvidence
 } from "./failure-types.ts";
-import { isCurrentWorkingTreeDigest } from "./working-tree-digest.js";
+import { isCurrentWorkingTreeDigest, WORKING_TREE_DIGEST_ALGORITHM } from "./working-tree-digest.js";
+import { currentWorkspaceRevisionDigest, isWorkspaceRevisionDigest } from "./workspace-revision.js";
+
+export const MAX_VERIFY_COMMANDS = 2;
+export const MAX_VERIFY_COMMAND_CHARS = 900;
+export const MAX_VERIFY_COMMAND_BYTES = 900;
+export const MAX_VERIFY_COMMAND_TOTAL_BYTES = MAX_VERIFY_COMMANDS * MAX_VERIFY_COMMAND_BYTES;
+export const MAX_VERIFY_COMMAND_TOTAL_CHARS = MAX_VERIFY_COMMANDS * MAX_VERIFY_COMMAND_CHARS;
+
+export function unicodeCodePointLength(value) {
+  return Array.from(String(value ?? "")).length;
+}
+
+export function utf8ByteLength(value) {
+  return Buffer.byteLength(String(value ?? ""), "utf8");
+}
 
 function uniqueStrings(values) {
-  return [...new Set((Array.isArray(values) ? values : []).filter((value) => typeof value === "string" && value.trim()).map((value) => value.trim()))];
+  return [...new Set((Array.isArray(values) ? values : []).filter((value) => typeof value === "string" && value.trim()))];
 }
 
 export function meaningfulVerificationCommands(commands = []) {
@@ -27,6 +42,25 @@ export function meaningfulVerificationCommands(commands = []) {
   });
 }
 
+export function verifierCommandBoundsError(commands = []) {
+  const supplied = (Array.isArray(commands) ? commands : []).filter((command) => typeof command === "string");
+  if (supplied.some((command) => /[\r\n]/.test(command))) {
+    return "Exact verify commands must be single-line values without CR or LF characters; move multiline logic into a checked-in script before task intake.";
+  }
+  const normalized = uniqueStrings(supplied);
+  if (normalized.length > MAX_VERIFY_COMMANDS) {
+    return `Verify plans support at most ${MAX_VERIFY_COMMANDS} exact commands; consolidate or shorten the project verifier before task intake.`;
+  }
+  const oversized = normalized.find((command) => unicodeCodePointLength(command) > MAX_VERIFY_COMMAND_CHARS);
+  if (oversized) return `An exact verify command exceeds ${MAX_VERIFY_COMMAND_CHARS} characters; shorten it or move verifier logic into a checked-in script before task intake.`;
+  const oversizedTraffic = normalized.find((command) => utf8ByteLength(command) > MAX_VERIFY_COMMAND_BYTES);
+  if (oversizedTraffic) return `An exact verify command exceeds ${MAX_VERIFY_COMMAND_BYTES} UTF-8 bytes; shorten it or move verifier logic into a checked-in script before task intake.`;
+  if (normalized.reduce((total, command) => total + utf8ByteLength(command), 0) > MAX_VERIFY_COMMAND_TOTAL_BYTES) {
+    return `Exact verify commands exceed the ${MAX_VERIFY_COMMAND_TOTAL_BYTES}-byte aggregate limit; consolidate or shorten the project verifier before task intake.`;
+  }
+  return undefined;
+}
+
 /** Return the last durably recorded observed execution for each exact command. */
 export function latestObservedVerificationEvidence(evidence = []) {
   const latest = new Map();
@@ -63,13 +97,18 @@ export function latestObservedVerification(evidence = []) {
   return latest;
 }
 
-export function verificationEvidenceProvesStableTree(entry, digest) {
+export function verificationEvidenceProvesStableTree(entry, digest, workspaceRevisionDigest) {
+  const revisionRequired = workspaceRevisionDigest !== undefined
+    || entry?.preWorkspaceRevisionDigest !== undefined || entry?.workspaceRevisionDigest !== undefined;
   return isCurrentWorkingTreeDigest(digest)
     && entry?.observed === true
     && entry.matchedProfileCommand === true
     && entry.exitCode === 0
+    && entry.isError !== true
     && entry.preWorkingTreeDigest === digest
-    && entry.workingTreeDigest === digest;
+    && entry.workingTreeDigest === digest
+    && (!revisionRequired || (isWorkspaceRevisionDigest(workspaceRevisionDigest)
+      && entry.preWorkspaceRevisionDigest === workspaceRevisionDigest && entry.workspaceRevisionDigest === workspaceRevisionDigest));
 }
 
 export function verificationRunIdentity(cwd, command, changedFiles = []) {
@@ -83,6 +122,24 @@ export function verificationRunIdentity(cwd, command, changedFiles = []) {
     .digest("hex");
 }
 
+export function verificationEvidenceProvesCurrentWorkspace(entry, digest, cwd) {
+  return verificationEvidenceProvesStableTree(entry, digest, currentWorkspaceRevisionDigest(cwd));
+}
+
+/** Historical projections are readable; they do not grant runtime completion/reuse. */
+export function verificationProjectionWorkspaceRevision(task, options = {}) {
+  return options.workspaceRevisionDigest !== undefined ? options.workspaceRevisionDigest
+    : task?.verifyEvidence?.some((entry) => entry.preWorkspaceRevisionDigest !== undefined || entry.workspaceRevisionDigest !== undefined)
+      ? currentWorkspaceRevisionDigest(options.cwd) : undefined;
+}
+
+export function allConfiguredVerifierEvidenceCurrent(task, digest, workspaceRevisionDigest) {
+  if (task?.workingTreeDigestAlgorithm !== WORKING_TREE_DIGEST_ALGORITHM || !isCurrentWorkingTreeDigest(digest)) return false;
+  const commands = meaningfulVerificationCommands(task?.verifyCommands ?? []);
+  const latest = latestObservedVerificationEvidence(task?.verifyEvidence);
+  return commands.length > 0 && commands.every((command) => verificationEvidenceProvesStableTree(latest.get(command.trim()), digest, workspaceRevisionDigest));
+}
+
 const STRUCTURED_SIGNALS = {
   "scope-violation": "structured-scope",
   "protected-path": "structured-protected-path",
@@ -92,7 +149,8 @@ const STRUCTURED_SIGNALS = {
   environment: "structured-environment",
   "flaky-infrastructure": "structured-flaky-infrastructure",
   "stale-verifier": "structured-stale-verifier",
-  "missing-verifier": "structured-missing-verifier"
+  "missing-verifier": "structured-missing-verifier",
+  "verification-gap": "structured-verification-gap"
 };
 
 function parsedSignals(text, exitCode, structuredEvents) {
@@ -100,7 +158,10 @@ function parsedSignals(text, exitCode, structuredEvents) {
   const lower = text.toLowerCase();
   const signals = structuredEvents.map((event) => STRUCTURED_SIGNALS[event]).filter(Boolean);
   const add = (signal, pattern) => { if (pattern.test(lower)) signals.push(signal); };
-  add("scope-diagnostic", /\b(outside (?:its |the )?declared scope|scope violation|protected path|symlink escape)\b/);
+  // Task scope is advisory. Only concrete filesystem-safety wording may be
+  // inferred from unstructured output; scope policy must arrive as a trusted
+  // structured event so ordinary assertion text cannot stop recovery.
+  add("scope-diagnostic", /\b(protected path|symlink escape)\b/);
   add("policy-diagnostic", /\b(policy (?:blocked|denied|violation)|capability lock|guard blocked)\b/);
   add("permission-diagnostic", /\b(eacces|eperm|permission denied|not authorized|unauthorized|forbidden)\b/);
   add("provider-rate-limit", /\b(?:http\s*)?429\b|\brate[ -]?limit(?:ed|ing)?\b/);
@@ -153,6 +214,7 @@ function categoryForEvidence(evidence) {
   if (signals.has("structured-provider") || signals.has("provider-rate-limit") || signals.has("provider-transport")) return "provider-network";
   if (signals.has("structured-environment") || signals.has("environment-diagnostic")) return "environment";
   if (signals.has("structured-flaky-infrastructure") || signals.has("local-port-conflict") || signals.has("transient-infrastructure")) return "flaky-infrastructure";
+  if (signals.has("structured-verification-gap")) return "unknown";
   if (signals.has("structured-stale-verifier") || signals.has("structured-missing-verifier") || signals.has("dependency-config-diagnostic")) return "dependency-config";
   if (["typescript-diagnostic", "python-type-diagnostic", "go-compile-diagnostic", "rust-compile-diagnostic", "generic-compile-diagnostic"].some((signal) => signals.has(signal))) return "compile-typecheck";
   if (signals.has("test-assertion-diagnostic")) return "test-assertion";
@@ -191,7 +253,7 @@ const RECORDED_CATEGORY_HINTS = Object.freeze({
   environment: "command not found in runtime environment",
   "provider-network": "provider API request timed out",
   "permission-policy": "permission denied by policy",
-  "scope-protected-path": "outside declared scope",
+  "scope-protected-path": "protected path is forbidden",
   "flaky-infrastructure": "EADDRINUSE: port is already in use"
 });
 
@@ -202,29 +264,54 @@ export function classifyRecordedVerificationFailure(summary, exitCode = 1) {
   return classifyVerificationFailure(hint ? `${text}\n${hint}` : text, exitCode);
 }
 
-const COMPLETION_SCOPE_BOUNDARY = /(?:^changes within task scope\b|^read-only task has observed changes\b|\boutside (?:(?:its|the|task) )?(?:declared )?scope\b|\bscope violation\b|\bprotected(?:\/read-only| or read-only)? paths?\b|\bread-only path\b)/i;
+const COMPLETION_POLICY_BOUNDARY = /(?:^read-only task has observed changes\b|^mutation-forbidden task has observed changes\b|\bprotected(?:\/read-only| or read-only)? paths?\b|\bread-only path\b)/i;
 
 export function classifyCompletionGateFailure(missing = [], summary = "", exitCode = 1) {
   const missingItems = Array.isArray(missing) ? missing.map((item) => String(item)) : [];
-  // Scope, protected-path, and read-only mutation boundaries are structural
-  // completion failures. They must outrank verifier/acceptance diagnostics and
-  // remain non-retryable even when the latest exact verifier exited zero.
-  if (missingItems.some((item) => COMPLETION_SCOPE_BOUNDARY.test(item))) {
-    return classifyVerificationFailure("Completion gate rejected a scope or protected-path boundary.", 1, {
-      structuredEvents: ["scope-violation"]
+  // Protected-path and read-only mutation boundaries are structural
+  // completion failures. Task scope is advisory and never enters this path.
+  if (missingItems.some((item) => COMPLETION_POLICY_BOUNDARY.test(item))) {
+    return classifyVerificationFailure("Completion gate rejected a protected-path or read-only boundary.", 1, {
+      structuredEvents: ["protected-path"]
     });
   }
   if (missingItems.some((item) => /^critical acceptance evidence\b/i.test(item))) {
-    return classifyVerificationFailure("AssertionError: critical acceptance behavioral proof is missing", 1);
+    // A missing proof is not an observed assertion failure. In particular,
+    // analyzer abstention cannot fabricate source-repair eligibility.
+    return classifyVerificationFailure("Completion gate lacks required behavioral verification evidence.", 1, {
+      structuredEvents: ["verification-gap"]
+    });
   }
   return classifyRecordedVerificationFailure(summary, exitCode);
 }
 
 export function selectCompletionRecoveryClassification(recordedClassification, missing = [], summary = "", exitCode = 1) {
   const gateClassification = classifyCompletionGateFailure(missing, summary, exitCode);
-  return gateClassification.category === "scope-protected-path"
-    ? gateClassification
-    : recordedClassification ?? gateClassification;
+  if (gateClassification.category === "scope-protected-path" || exitCode === 0) return gateClassification;
+  try { return recordedClassification ? validateFailureClassification(recordedClassification) : gateClassification; }
+  catch { return gateClassification; }
+}
+
+/** Reuse a checkpoint classification only for the exact current failed run. */
+export function recordedFailureForObservation(checkpoints, observed, currentTreeDigest, workspaceRevisionDigest) {
+  if (observed?.observed !== true || observed.matchedProfileCommand !== true || observed.exitCode === 0
+    || !isCurrentWorkingTreeDigest(observed.preWorkingTreeDigest) || observed.preWorkingTreeDigest !== observed.workingTreeDigest
+    || (currentTreeDigest !== undefined && currentTreeDigest !== observed.workingTreeDigest)) return undefined;
+  const revisionRequired = workspaceRevisionDigest !== undefined || observed.preWorkspaceRevisionDigest !== undefined || observed.workspaceRevisionDigest !== undefined;
+  if (revisionRequired && (!isWorkspaceRevisionDigest(workspaceRevisionDigest)
+    || observed.preWorkspaceRevisionDigest !== workspaceRevisionDigest || observed.workspaceRevisionDigest !== workspaceRevisionDigest)) return undefined;
+  const observedAt = observed.observedAt ?? observed.recordedAt;
+  if (typeof observedAt !== "string" || !Number.isFinite(Date.parse(observedAt))) return undefined;
+  const checkpoint = (Array.isArray(checkpoints) ? checkpoints : []).filter((item) => {
+    const binding = item?.evidence?.verificationObservation;
+    return item?.phase === "verify" && item.status === "failed" && binding
+      && binding.command === observed.command?.trim() && binding.observedAt === observedAt
+      && binding.exitCode === observed.exitCode && binding.preWorkingTreeDigest === observed.preWorkingTreeDigest
+      && binding.workingTreeDigest === observed.workingTreeDigest
+      && (!revisionRequired || (binding.preWorkspaceRevisionDigest === workspaceRevisionDigest && binding.workspaceRevisionDigest === workspaceRevisionDigest));
+  }).at(-1);
+  try { return checkpoint ? validateFailureClassification(checkpoint.evidence.failureClassification) : undefined; }
+  catch { return undefined; }
 }
 
 export function chooseVerificationScope(profileVerifyCommands = {}, changedFiles = []) {
@@ -235,8 +322,8 @@ export function chooseVerificationScope(profileVerifyCommands = {}, changedFiles
     || /^(?:README|CHANGELOG|CONTRIBUTING|SECURITY)(?:\.|$)/i.test(file);
   const hasDocs = files.some(isDocumentationFile);
   const hasDocsOnly = files.length > 0 && files.every(isDocumentationFile);
-  const hasFrontend = files.some((file) => /(^|\/)(?:app|pages|components|frontend|web|client)(\/|$)|\.(?:tsx|jsx|css|scss|vue|svelte)$/i.test(file));
-  const hasBackend = files.some((file) => /(^|\/)(?:api|server|backend|services)(\/|$)|\.(?:go|py|rs|java|kt|cs|rb|php|sql)$/i.test(file));
+  const hasFrontend = files.some((file) => /(^|[\/_-])(?:app|pages|components|frontend|web|client)(?=[\/_-]|$)|\.(?:tsx|jsx|css|scss|vue|svelte)$/i.test(file));
+  const hasBackend = files.some((file) => /(^|[\/_-])(?:api|server|backend|services)(?=[\/_-]|$)|\.(?:go|py|rs|java|kt|cs|rb|php|sql)$/i.test(file));
   const selectedGroups = [];
   if (hasDocsOnly && groups.docs) {
     selectedGroups.push("docs");
@@ -310,5 +397,7 @@ export function selectVerificationPlan(profile, requestedGroup, changeMode, cwd,
       error: `Verify group ${group ?? "(none)"} has no meaningful command. Configure .pi/piagent-profile.json before source changes.`
     };
   }
+  const boundsError = verifierCommandBoundsError(commands);
+  if (boundsError) return { group, commands, error: boundsError };
   return { group, commands };
 }

package/packages/piagent-core/extensions/workflow-catalog.ts

@@ -0,0 +1,98 @@
+export const WORKFLOW_IDS = [
+  "task",
+  "scout",
+  "be-to-fe",
+  "discuss",
+  "plan",
+  "review",
+  "commit",
+  "pr",
+  "onboard",
+  "platform-improve"
+] as const;
+
+export type WorkflowId = typeof WORKFLOW_IDS[number];
+export type ContextWorkflow = "task" | "scout" | "discuss" | "plan" | "review" | "release" | "onboard"
+  | "usage" | "permission" | "context";
+
+export type WorkflowOption = {
+  id: WorkflowId;
+  aliases: readonly string[];
+  label: string;
+  description: string;
+  argumentHint: string;
+  requestRequired: boolean;
+  contextWorkflow: ContextWorkflow;
+  changeMode: "source-change" | "read-only" | "plan-only" | "clarification" | "git" | "onboarding" | "platform";
+  modelUse: "required";
+  recommendedFreshSession: boolean;
+};
+
+/** Surface-neutral workflow truth shared by context classification and runtime ingress. */
+export const WORKFLOW_OPTIONS: readonly WorkflowOption[] = [
+  { id: "task", aliases: ["task", "implement"], label: "Task", description: "Implement a bounded task", argumentHint: "<request>", requestRequired: true, contextWorkflow: "task", changeMode: "source-change", modelUse: "required", recommendedFreshSession: true },
+  { id: "scout", aliases: ["scout", "audit"], label: "Scout", description: "Read-only audit or research", argumentHint: "<area/spec/risk>", requestRequired: true, contextWorkflow: "scout", changeMode: "read-only", modelUse: "required", recommendedFreshSession: true },
+  { id: "be-to-fe", aliases: ["be-to-fe", "befe"], label: "BE → FE", description: "Implement frontend from a backend contract", argumentHint: "<BE spec/change + FE outcome>", requestRequired: true, contextWorkflow: "task", changeMode: "source-change", modelUse: "required", recommendedFreshSession: true },
+  { id: "discuss", aliases: ["discuss", "clarify"], label: "Discuss", description: "Clarify before planning or editing", argumentHint: "<rough idea>", requestRequired: true, contextWorkflow: "discuss", changeMode: "clarification", modelUse: "required", recommendedFreshSession: false },
+  { id: "plan", aliases: ["plan"], label: "Plan", description: "Create an implementation plan", argumentHint: "<goal>", requestRequired: true, contextWorkflow: "plan", changeMode: "plan-only", modelUse: "required", recommendedFreshSession: false },
+  { id: "review", aliases: ["review"], label: "Review", description: "Review a diff or source read-only", argumentHint: "<target or diff>", requestRequired: true, contextWorkflow: "review", changeMode: "read-only", modelUse: "required", recommendedFreshSession: false },
+  { id: "commit", aliases: ["commit"], label: "Commit", description: "Run the guarded local commit workflow", argumentHint: "[message]", requestRequired: false, contextWorkflow: "release", changeMode: "git", modelUse: "required", recommendedFreshSession: false },
+  { id: "pr", aliases: ["pr"], label: "PR", description: "Prepare a guarded pull request", argumentHint: "[title]", requestRequired: false, contextWorkflow: "release", changeMode: "git", modelUse: "required", recommendedFreshSession: false },
+  { id: "onboard", aliases: ["onboard", "onboard-project"], label: "Onboard", description: "Run first-read project onboarding", argumentHint: "[focus]", requestRequired: false, contextWorkflow: "onboard", changeMode: "onboarding", modelUse: "required", recommendedFreshSession: true },
+  { id: "platform-improve", aliases: ["platform-improve", "platform"], label: "Platform improve", description: "Improve Pi Agent Platform itself", argumentHint: "<goal + affected area>", requestRequired: true, contextWorkflow: "task", changeMode: "platform", modelUse: "required", recommendedFreshSession: true }
+] as const;
+
+export const WORKFLOW_ALIASES: Readonly<Record<string, WorkflowId>> = Object.freeze(Object.fromEntries(
+  WORKFLOW_OPTIONS.flatMap((option) => option.aliases.map((alias) => [alias, option.id] as const))
+));
+
+export function resolveWorkflowId(value: unknown): WorkflowId | null {
+  if (typeof value !== "string") return null;
+  return WORKFLOW_ALIASES[value.trim().toLowerCase()] ?? null;
+}
+
+export function workflowOption(value: unknown): WorkflowOption | null {
+  const id = resolveWorkflowId(value);
+  return id ? WORKFLOW_OPTIONS.find((option) => option.id === id) ?? null : null;
+}
+
+export function workflowCommandNames(options: { aliases?: boolean } = {}): string[] {
+  return options.aliases === false ? [...WORKFLOW_IDS] : Object.keys(WORKFLOW_ALIASES);
+}
+
+function escapedPattern(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** A regex fragment derived from the catalog, for command/projection boundaries. */
+export function workflowCommandPattern(options: { aliases?: boolean } = {}): string {
+  return workflowCommandNames(options).sort((left, right) => right.length - left.length)
+    .map(escapedPattern).join("|");
+}
+
+const NAMESPACED_WORKFLOW_COMMAND = new RegExp(
+  `^/(?:piagent-workflow|workflow)\\s+(${workflowCommandPattern()})(?=\\s|$)\\s*`, "i"
+);
+const DIRECT_WORKFLOW_COMMAND = new RegExp(
+  `^/(${workflowCommandPattern({ aliases: false })})(?=\\s|$)\\s*`, "i"
+);
+
+export function workflowIdFromCommand(input: unknown): WorkflowId | null {
+  const normalized = String(input ?? "").trim();
+  const match = NAMESPACED_WORKFLOW_COMMAND.exec(normalized) ?? DIRECT_WORKFLOW_COMMAND.exec(normalized);
+  return resolveWorkflowId(match?.[1]);
+}
+
+export function stripWorkflowCommand(input: string): string {
+  return String(input ?? "").replace(NAMESPACED_WORKFLOW_COMMAND, "").replace(DIRECT_WORKFLOW_COMMAND, "").trim();
+}
+
+export function workflowHelpLines(): string[] {
+  const aliasLines = WORKFLOW_OPTIONS.flatMap((option) => option.aliases.filter((alias) => alias !== option.id)
+    .map((alias) => `/workflow ${alias} → ${option.id}`));
+  return [
+    "namespace: /workflow",
+    ...WORKFLOW_OPTIONS.map((option) => `${option.id}: /workflow ${option.id} ${option.argumentHint} — ${option.description}`),
+    `aliases: ${aliasLines.join(" | ") || "none"}`
+  ];
+}

package/packages/piagent-core/extensions/workspace-evidence-roots.js

@@ -2,14 +2,35 @@ import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 
-const WORKSPACE_EVIDENCE_MAX_FILES = 2000;
+// Parent workspaces commonly carry shared plans, verifier scripts, and agent
+// configuration beside their child repositories. Keep the traversal bounded,
+// but leave enough room for a real multi-repository workspace instead of
+// silently dropping evidence at the former 2,000-file ceiling.
+const WORKSPACE_EVIDENCE_MAX_FILES = 20_000;
+// These names are not merely noisy build output: they carry repository
+// ownership, Piagent authority, or provider credentials. Evidence discovery
+// excludes them and the mutation guard protects them independently of task
+// focus, so broad monorepo access cannot create an unaudited private-state gap.
+export const WORKSPACE_PRIVATE_STATE_PATTERNS = Object.freeze([
+  "**/.git/**", "**/.hg/**", "**/.svn/**", "**/.pi/**",
+  "**/.aws/**", "**/.azure/**", "**/.docker/**", "**/.gnupg/**", "**/.kube/**", "**/.ssh/**",
+  "**/.git-credentials", "**/.netrc", "**/.npmrc", "**/.pypirc",
+  "**/.env", "**/.env.*",
+  "**/auth.json", "**/credential.json", "**/credentials.json", "**/secret.json", "**/secrets.json",
+  "**/token.json", "**/tokens.json"
+]);
 const WORKSPACE_EVIDENCE_SKIP_NAMES = new Set([
-  ".git", ".hg", ".svn", ".pi", "node_modules", "dist", "build", ".next", "coverage"
+  ".git", ".hg", ".svn", ".pi", "node_modules", "dist", "build", ".next", "coverage",
+  ".cache", ".npm", ".pnpm-store", ".yarn", ".turbo", ".aws", ".azure", ".docker",
+  ".gnupg", ".kube", ".ssh", ".ds_store", ".git-credentials", ".netrc", ".npmrc", ".pypirc"
 ]);
 const WORKSPACE_EVIDENCE_PRIORITY_NAMES = new Map([["plans", 0]]);
 
-function hiddenWorkspaceEvidenceSegment(value) {
-  return String(value ?? "").startsWith(".");
+function excludedWorkspaceEvidenceName(value) {
+  const name = String(value ?? "");
+  return WORKSPACE_EVIDENCE_SKIP_NAMES.has(name.toLowerCase())
+    || /^\.env(?:\.|$)/i.test(name)
+    || /^(?:auth|credentials?|secrets?|tokens?)\.json$/i.test(name);
 }
 
 export function gitOutput(cwd, args, options = {}) {
@@ -86,6 +107,15 @@ export function directChildGitEvidenceRoots(cwd) {
 
 export function gitEvidenceRootDetails(cwd) {
   if (isGitWorkingTree(cwd)) return { roots: [{ cwd, prefix: "" }], complete: true };
+  // A present Git marker combined with a failed Git probe is ambiguous (for
+  // example a broken worktree pointer or a transient command failure). Do not
+  // reinterpret that repository as an ordinary complete non-Git directory.
+  try {
+    fs.lstatSync(path.join(cwd, ".git"));
+    return { roots: [], complete: false };
+  } catch (error) {
+    if (error?.code !== "ENOENT") return { roots: [], complete: false };
+  }
   return directChildGitEvidenceRootDetails(cwd);
 }
 
@@ -93,9 +123,16 @@ export function gitEvidenceRoots(cwd) {
   return gitEvidenceRootDetails(cwd).roots;
 }
 
-export function nonGitWorkspaceFileDetails(cwd, gitRootPrefixes) {
+function workspaceEvidenceFileLimit(value) {
+  return Number.isInteger(value)
+    ? Math.max(1, Math.min(WORKSPACE_EVIDENCE_MAX_FILES, value))
+    : WORKSPACE_EVIDENCE_MAX_FILES;
+}
+
+export function nonGitWorkspaceFileDetails(cwd, gitRootPrefixes, maxFiles = WORKSPACE_EVIDENCE_MAX_FILES) {
   const files = [];
   let complete = true;
+  const limit = workspaceEvidenceFileLimit(maxFiles);
   const gitRoots = new Set(gitRootPrefixes.filter(Boolean));
   const orderedEntries = (entries) => [...entries].sort((left, right) => {
     const leftPriority = WORKSPACE_EVIDENCE_PRIORITY_NAMES.get(left.name.toLowerCase()) ?? 10;
@@ -103,7 +140,7 @@ export function nonGitWorkspaceFileDetails(cwd, gitRootPrefixes) {
     return leftPriority - rightPriority || left.name.localeCompare(right.name, "en-US");
   });
   function visit(directory, relativeDirectory) {
-    if (files.length >= WORKSPACE_EVIDENCE_MAX_FILES) {
+    if (files.length >= limit) {
       complete = false;
       return;
     }
@@ -115,15 +152,15 @@ export function nonGitWorkspaceFileDetails(cwd, gitRootPrefixes) {
       return;
     }
     for (const entry of orderedEntries(entries)) {
-      if (files.length >= WORKSPACE_EVIDENCE_MAX_FILES) {
+      if (files.length >= limit) {
         complete = false;
         return;
       }
-      // Loose files beside nested repositories are not governed by either
-      // repository's ignore/trust policy. Keep hidden editor, agent, cloud,
-      // credential, and cache state out of both manifests and change evidence
-      // instead of attempting to maintain an incomplete name blacklist.
-      if (WORKSPACE_EVIDENCE_SKIP_NAMES.has(entry.name) || hiddenWorkspaceEvidenceSegment(entry.name)) continue;
+      // A parent workspace can own real project source in hidden directories
+      // (for example shared verifier scripts). Evidence discovery therefore
+      // excludes explicit private/cache/credential names instead of treating
+      // every dot-prefixed path as non-project state.
+      if (excludedWorkspaceEvidenceName(entry.name)) continue;
       const relative = relativeDirectory ? `${relativeDirectory}/${entry.name}` : entry.name;
       if (gitRoots.has(relative.split("/")[0])) continue;
       const absolute = path.join(directory, entry.name);
@@ -141,8 +178,8 @@ export function nonGitWorkspaceFileDetails(cwd, gitRootPrefixes) {
   return { files: files.sort(), complete };
 }
 
-export function nonGitWorkspaceFiles(cwd, gitRootPrefixes) {
-  return nonGitWorkspaceFileDetails(cwd, gitRootPrefixes).files;
+export function nonGitWorkspaceFiles(cwd, gitRootPrefixes, maxFiles = WORKSPACE_EVIDENCE_MAX_FILES) {
+  return nonGitWorkspaceFileDetails(cwd, gitRootPrefixes, maxFiles).files;
 }
 
 export function pathWithinNonGitWorkspaceEvidenceRoot(candidate, gitRootPrefixes) {
@@ -150,8 +187,7 @@ export function pathWithinNonGitWorkspaceEvidenceRoot(candidate, gitRootPrefixes
   const topSegment = segments[0];
   return Boolean(
     topSegment
-    && !WORKSPACE_EVIDENCE_SKIP_NAMES.has(topSegment)
-    && !segments.some(hiddenWorkspaceEvidenceSegment)
+    && !segments.some(excludedWorkspaceEvidenceName)
     && !gitRootPrefixes.includes(topSegment)
   );
 }

package/packages/piagent-core/extensions/workspace-revision.js

@@ -0,0 +1,48 @@
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import { gitEvidenceRootDetails } from "./workspace-evidence-roots.js";
+
+export const WORKSPACE_REVISION_VERSION = "workspace-revision-v1";
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+const PREFIX = `${WORKSPACE_REVISION_VERSION}:`;
+export const isWorkspaceRevisionDigest = (value) => typeof value === "string" && /^workspace-revision-v1:[a-f0-9]{64}$/.test(value);
+
+function git(cwd, args) {
+  return execFileSync("git", ["-c", "core.fsmonitor=false", "--no-optional-locks", "-C", cwd, ...args], {
+    encoding: "utf8", timeout: 3000, maxBuffer: 8192, stdio: ["ignore", "pipe", "pipe"]
+  }).trim();
+}
+
+export function repositoryHeadIdentity(cwd) {
+  try {
+    const head = git(cwd, ["rev-parse", "--verify", "--quiet", "HEAD"]);
+    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(head)) throw new Error("Invalid repository revision");
+    return head;
+  } catch (error) {
+    if (error.status !== 1) throw error;
+    const reference = git(cwd, ["symbolic-ref", "--quiet", "HEAD"]);
+    if (!reference.startsWith("refs/heads/")) throw new Error("Invalid unborn repository");
+    try { git(cwd, ["show-ref", "--verify", "--quiet", reference]); }
+    catch (missing) { if (missing.status === 1) return `unborn:${reference}`; throw missing; }
+    throw new Error("Repository revision changed during capture");
+  }
+}
+
+/** Baseline identity, not a content digest or authenticated verifier receipt. */
+export function captureWorkspaceRevision(cwd) {
+  const root = fs.realpathSync.native(cwd);
+  const details = gitEvidenceRootDetails(root);
+  if (!details.complete || details.roots.length === 0 || details.roots.length > 128) throw new Error("Workspace baseline inventory is unavailable");
+  const repositories = details.roots.map((item) => Object.freeze({
+    prefix: item.prefix,
+    rootId: hash(fs.realpathSync.native(git(item.cwd, ["rev-parse", "--show-toplevel"]))),
+    head: repositoryHeadIdentity(item.cwd)
+  }));
+  const binding = Object.freeze({ version: WORKSPACE_REVISION_VERSION, projectId: hash(root), repositories: Object.freeze(repositories) });
+  return Object.freeze({ ...binding, digest: `${PREFIX}${hash(JSON.stringify(binding))}` });
+}
+
+export function currentWorkspaceRevisionDigest(cwd) {
+  try { return captureWorkspaceRevision(cwd).digest; } catch { return null; }
+}

package/packages/piagent-core/extensions/workspace-verification-snapshot.js

@@ -0,0 +1,13 @@
+import { workingTreeSnapshot } from "./task-state.js";
+import { workingTreeObservation } from "./working-tree-digest.js";
+import { currentWorkspaceRevisionDigest } from "./workspace-revision.js";
+
+/** Bracket content capture with baseline checks; neither alone proves current code. */
+export function captureWorkspaceVerificationSnapshot(cwd, options = {}) {
+  const before = currentWorkspaceRevisionDigest(cwd);
+  const observation = workingTreeObservation(workingTreeSnapshot(cwd, options));
+  const after = currentWorkspaceRevisionDigest(cwd);
+  const workspaceRevisionDigest = before !== null && before === after ? before : null;
+  return Object.freeze({ ...observation, workspaceRevisionDigest,
+    proofCapable: observation.proofCapable && workspaceRevisionDigest !== null });
+}

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.6.0",
+  "version": "1.7.1",
   "type": "module",
   "private": true,
   "license": "MIT",
@@ -33,8 +33,8 @@
     }
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "0.84.1",
-    "typebox": "1.3.7"
+    "@earendil-works/pi-coding-agent": "0.86.1",
+    "typebox": "1.3.27"
   },
   "peerDependenciesMeta": {
     "@earendil-works/pi-coding-agent": {

package/packages/piagent-core/policies/base-policy.json

@@ -3,7 +3,27 @@
   "name": "piagent-base-policy",
   "protectedPaths": [
     ".git/**",
+    "**/.git/**",
+    "**/.hg/**",
+    "**/.svn/**",
+    "**/.pi/**",
+    "**/.aws/**",
+    "**/.azure/**",
+    "**/.docker/**",
+    "**/.gnupg/**",
+    "**/.kube/**",
+    "**/.ssh/**",
+    "**/.git-credentials",
+    "**/.netrc",
+    "**/.npmrc",
+    "**/.pypirc",
     "**/auth.json",
+    "**/credential.json",
+    "**/credentials.json",
+    "**/secret.json",
+    "**/secrets.json",
+    "**/token.json",
+    "**/tokens.json",
     "**/.env",
     "**/.env.*",
     "**/node_modules/**",
@@ -16,7 +36,27 @@
   ],
   "shellProtectedPaths": [
     ".git/**",
+    "**/.git/**",
+    "**/.hg/**",
+    "**/.svn/**",
+    "**/.pi/**",
+    "**/.aws/**",
+    "**/.azure/**",
+    "**/.docker/**",
+    "**/.gnupg/**",
+    "**/.kube/**",
+    "**/.ssh/**",
+    "**/.git-credentials",
+    "**/.netrc",
+    "**/.npmrc",
+    "**/.pypirc",
     "**/auth.json",
+    "**/credential.json",
+    "**/credentials.json",
+    "**/secret.json",
+    "**/secrets.json",
+    "**/token.json",
+    "**/tokens.json",
     "**/.env",
     "**/.env.*",
     ".pi/piagent-state/**",
@@ -224,6 +264,7 @@
   },
   "finalGate": {
     "defaultMode": "enforce",
+    "acceptanceProofMode": "diagnostic",
     "requireTaskContract": true,
     "requireContextManifest": true,
     "requireVerifyEvidence": true,
@@ -232,7 +273,7 @@
   },
   "orchestrationPolicy": {
     "defaultMode": "solo-first",
-    "maxConcurrentSubagents": 2,
+    "maxConcurrentSubagents": 1,
     "defaultReviewLenses": [
       "correctness",
       "tests",
@@ -240,7 +281,7 @@
     ],
     "roleModelGuidance": {
       "planner": "Use the strongest available model for decomposition, architecture, risk, and acceptance criteria.",
-      "worker": "Use the fastest reliable model for a bounded, already-planned single write set.",
+      "worker": "Disabled by default. The parent model owns all implementation and mutation.",
       "reviewer": "Use a model or thinking setting decorrelated from the worker when review quality matters.",
       "watchdog": "Use a strong model only for final risk review, security, release, or high-impact changes."
     },

package/packages/piagent-core/policy/authority-manifest.v1.json

@@ -34,7 +34,7 @@
         "CAP-11": "advisory",
         "CAP-12": "on",
         "CAP-13": "off",
-        "CAP-14": "recommend",
+        "CAP-14": "off",
         "CAP-15": "off",
         "CAP-16": "on",
         "CAP-17": "on"
@@ -80,7 +80,7 @@
         "CAP-11": "advisory",
         "CAP-12": "on",
         "CAP-13": "strict",
-        "CAP-14": "recommend",
+        "CAP-14": "off",
         "CAP-15": "off",
         "CAP-16": "on",
         "CAP-17": "on"
@@ -314,7 +314,7 @@
       "layer": "L3",
       "configKey": "helpers",
       "configSources": ["manifest", "PIAGENT_HELPERS_MODE"],
-      "defaultMode": "recommend",
+      "defaultMode": "off",
       "killSwitchMode": "off",
       "dependencies": ["CAP-02", "CAP-05", "CAP-08"],
       "modeMappings": [