@piagent/platform 1.6.1 → 1.7.1

package/benchmarks/production-v3/prompts/revoked-session-cache.md

@@ -0,0 +1,10 @@
+Fix `src/backend/revocation-cache.js` without changing its exported API.
+
+`isCachedAccessUsable(entry, request)` must return true only when both inputs
+have matching non-empty tenant, user, and capability identifiers; the cached
+permission revision equals the current permission revision; evaluation is not
+in the future; and `request.now` is strictly before `entry.expiresAt`. A
+revocation at or before `request.now` invalidates the entry. Validate all time
+and revision fields as finite integers; `request.revokedAt` must be either null
+or a finite integer. Throw `TypeError` for malformed input. Do not mutate either
+argument. Run the configured verification.

package/benchmarks/production-v3/prompts/schema-migration.md

@@ -0,0 +1,6 @@
+Repair the v1-to-v2 settings migration in `src/data/migration.js`.
+
+Preserve intentional falsey values (`false`, `0`, and an empty string). Defaults
+are `enabled: true`, `retryLimit: 3`, and `label: "default"` only when the
+corresponding v1 field is nullish. A v2 input must be returned as an independent
+copy. Do not mutate input or change the API. Verify the project.

package/benchmarks/production-v3/prompts/stable-dedup.md

@@ -0,0 +1,6 @@
+Fix `deduplicateEvents(events)` in `src/data/dedup.js`.
+
+Return one event per `id`. The output order must follow the first appearance of
+each id, while the retained value for that id must be the event with the
+greatest numeric `sequence`. If sequences tie, retain the later occurrence.
+Do not mutate the input. Keep the exported API and verify the project.

package/benchmarks/production-v3/prompts/stale-search-response.md

@@ -0,0 +1,6 @@
+Fix stale request handling in `src/frontend/search-state.js`.
+
+Only a success or failure whose `requestId` equals the current state's
+`requestId` may complete the active search. Stale completions must return the
+existing state object unchanged. A matching failure clears loading but keeps
+the previous results. Preserve the reducer API and verify the project.

package/benchmarks/production-v3/prompts/tenant-cache-isolation.md

@@ -0,0 +1,6 @@
+Fix the cross-tenant collision in `src/backend/cache.js`.
+
+`TenantCache` must isolate entries by all three identity components:
+`tenantId`, `entity`, and `id`. String values containing punctuation must not
+create ambiguous keys. Preserve the class API and keep the patch local. Verify
+the project after the change.

package/benchmarks/production-v3/prompts/tenant-role-authorization.md

@@ -0,0 +1,6 @@
+Fix `src/backend/auth.js` without changing its exported API.
+
+`canManage(user, resource)` may return true only when the user is active, has
+role `owner` or `admin`, and `user.tenantId` and `resource.tenantId` are the
+same non-empty string. Missing input must be denied. Keep the change focused
+and run the project verification commands.

package/benchmarks/production-v3/prompts/unicode-search.md

@@ -0,0 +1,6 @@
+Make search matching robust in `src/frontend/unicode-search.js`.
+
+Matching must be case-insensitive, accent-insensitive for decomposable Unicode
+letters, trim outer whitespace, and collapse internal whitespace runs to one
+space. It must remain safe for nullish input. Preserve both exports and do not
+add dependencies. Run the project verification commands.

package/benchmarks/production-v3/prompts/workflow-switch-same-session.md

@@ -0,0 +1,30 @@
+Fix `src/platform/workflow-session.js` while preserving
+`reduceWorkflowSession(state, event)`.
+When `state` is omitted or `undefined`, the reducer uses the exported
+`initialWorkflowSession`.
+
+The reducer accepts two tagged event variants. Tagged event variant
+`workflow/select` requires field `workflow` to be a non-empty string. It
+changes only `currentWorkflow`; it must never clear prior messages or prevent
+later workflow changes.
+
+Tagged event variant `message/accepted` requires fields `id` and `text` to be
+non-empty strings. It is appended once with the workflow active for that
+message. For tagged event variant `message/accepted`, its optional `workflow`
+override, when supplied, must be a non-empty string. “Supplied” means the event
+has its own `workflow` property, so an own property whose value is `undefined`
+or `null` is malformed. Only when that property is absent is the current
+workflow used. Validate the required fields and any supplied override before
+applying duplicate handling. After that validation, a duplicate message id is
+an idempotent no-op returning the existing state object, even if its valid text
+or workflow differs. For a non-duplicate message with no own `workflow`
+override, `currentWorkflow` must be a non-empty string or the reducer throws
+`TypeError`. This active-workflow check occurs after duplicate handling, so a
+fully field-valid duplicate still returns the exact existing state even when
+`currentWorkflow` is `null`. A valid override selects that workflow for the
+message and future work.
+
+Preserve message order, do not mutate inputs, and throw `TypeError` for every
+malformed tagged-event required field or supplied override on either named
+event variant.
+Run the configured verification.

package/benchmarks/production-v3/prompts/workspace-order.md

@@ -0,0 +1,7 @@
+Fix dependency ordering in `src/platform/workspace.js`.
+
+Return every workspace package exactly once with each in-repository dependency
+before its dependent. Ignore dependency names not present in the package list.
+Preserve input order whenever no dependency edge requires a different order.
+Throw an `Error` containing `cycle` when an in-repository cycle exists. Do not
+mutate input. Run project verification.

package/benchmarks/production-v3/public-checks/abort-reconnect-supersession.js

@@ -0,0 +1,34 @@
+test("request lifecycle ignores old epochs and settles only the active request", async () => {
+  const { initialRequestState, requestLifecycleReducer: reduce } = await import("../src/frontend/request-lifecycle.js");
+  const view = ({ activeRequestId, connectionEpoch, loading, results, error }) =>
+    ({ activeRequestId, connectionEpoch, loading, results, error });
+  const call = (state, action) => {
+    const before = structuredClone(state), event = structuredClone(action);
+    const next = reduce(state, action);
+    assert.deepEqual(state, before);
+    assert.deepEqual(action, event);
+    return next;
+  };
+  const base = { ...initialRequestState, connectionEpoch: 5, results: ["previous"], error: "previous-error" };
+  assert.equal(call(base, { type: "request/start", requestId: "old", epoch: 4 }), base);
+  const first = call(base, { type: "request/start", requestId: "a", epoch: 6 });
+  assert.deepEqual(view(first), { ...view(base), activeRequestId: "a", connectionEpoch: 6, loading: true, error: null });
+  for (const epoch of [5, 6]) assert.equal(call(first, { type: "connection/reconnect", epoch }), first);
+  const reconnected = call(first, { type: "connection/reconnect", epoch: 7 });
+  assert.deepEqual(view(reconnected), { ...view(first), activeRequestId: null, connectionEpoch: 7, loading: false, error: null });
+  assert.equal(call(reconnected, { type: "request/success", requestId: "a", epoch: 6, results: ["stale"] }), reconnected);
+  const active = call(reconnected, { type: "request/start", requestId: "b", epoch: 7 });
+  for (const type of ["request/success", "request/failure"]) {
+    assert.equal(call(active, { type, requestId: "a", epoch: 7, results: [], error: "stale" }), active);
+    assert.equal(call(active, { type, requestId: "b", epoch: 6, results: [], error: "stale" }), active);
+  }
+  const event = { type: "request/success", requestId: "b", epoch: 7, results: ["current"] };
+  const settled = call(active, event);
+  assert.deepEqual(view(settled), { ...view(active), activeRequestId: null, loading: false, results: ["current"], error: null });
+  assert.notEqual(settled.results, event.results);
+  assert.equal(call(settled, event), settled);
+  const failure = { type: "request/failure", requestId: "b", epoch: 7, error: "offline" };
+  const failed = call(active, failure);
+  assert.deepEqual(view(failed), { ...view(active), activeRequestId: null, loading: false, error: "offline" });
+  assert.equal(call(failed, failure), failed);
+});

package/benchmarks/production-v3/public-checks/expiry-boundary.js

@@ -0,0 +1,29 @@
+test("expiry rejects normalized impossible dates and non-ISO input", () => {
+  for (const value of ["04/15/2028", "2028-04-31T12:00:00Z", "1900-02-29T00:00:00Z",
+    "0003-02-29T00:00:00Z", new Date(NaN), null, 0, false, undefined]) {
+    assert.throws(() => isExpired(value, 0), TypeError, String(value));
+  }
+  for (const value of ["2000-02-29T00:00Z", "0000-02-29T00:00:00Z",
+    "0042-06-15T12:30:00Z", "2028-04-30T18:00:00.500+05:30"]) {
+    const instant = Date.parse(value);
+    assert.equal(isExpired(value, instant - 1), false);
+    assert.equal(isExpired(value, instant), true);
+  }
+});
+
+test("expiry distinguishes omitted now from explicit invalid values without early clock reads", () => {
+  assert.equal(isExpired.length, 1);
+  assert.equal(isExpired("1970-01-01T00:00:01Z", 0), false);
+  const original = Date.now;
+  let reads = 0;
+  Date.now = () => { reads += 1; return 1000; };
+  try {
+    for (const value of [undefined, null, false, "0", NaN, Infinity, new Date(NaN)]) {
+      assert.throws(() => isExpired("1970-01-01T00:00:01Z", value), TypeError);
+    }
+    assert.throws(() => isExpired("invalid"), TypeError);
+    assert.equal(reads, 0);
+    assert.equal(isExpired("1970-01-01T00:00:01Z"), true);
+    assert.equal(reads, 1);
+  } finally { Date.now = original; }
+});

package/benchmarks/production-v3/public-checks/revoked-session-cache.js

@@ -0,0 +1,20 @@
+// Public examples for the declared API. No private oracle values or solution.
+test("cached access uses the declared field names and all identity boundaries", async () => {
+  const { isCachedAccessUsable: usable } = await import("../src/backend/revocation-cache.js");
+  const entry = Object.freeze({ tenantId: "north", userId: "u1", capability: "edit",
+    permissionRevision: 4, evaluatedAt: 100, expiresAt: 200 });
+  const request = Object.freeze({ tenantId: "north", userId: "u1", capability: "edit",
+    currentPermissionRevision: 4, now: 150, revokedAt: null });
+  assert.equal(usable(entry, request), true);
+  for (const patch of [{ tenantId: "south" }, { userId: "u2" }, { capability: "delete" },
+    { currentPermissionRevision: 5 }, { now: 200 }, { revokedAt: 150 }]) {
+    assert.equal(usable(entry, Object.freeze({ ...request, ...patch })), false, JSON.stringify(patch));
+  }
+  assert.equal(usable({ ...entry, evaluatedAt: 151 }, request), false);
+  assert.equal(usable(entry, { ...request, now: 199, revokedAt: 200 }), true);
+  for (const bad of [null, [], {}, { ...request, now: 1.5 }, { ...request, revokedAt: undefined },
+    { ...request, capability: "" }, { ...request, currentPermissionRevision: "4" }]) {
+    assert.throws(() => usable(entry, bad), TypeError);
+  }
+  assert.throws(() => usable({ ...entry, expiresAt: Infinity }, request), TypeError);
+});

package/benchmarks/production-v3/spend-control.v1.json

@@ -0,0 +1,121 @@
+{
+  "schemaVersion": 1,
+  "suiteId": "production-v3",
+  "purpose": "Bound provider spend while completing the exact 108-session Luna-medium Fast-vs-Fast production user-journey comparison, retaining valid product failures, and adjudicating the release claim only at S108.",
+  "rootSeed": "production-v3-seven-axis-v1-640",
+  "execution": {
+    "surfaces": ["piagent", "codex-cli"],
+    "model": "openai-codex/gpt-5.6-luna",
+    "thinking": "medium",
+    "serviceTier": "fast",
+    "repeats": 2,
+    "infrastructureRetries": 0,
+    "stopAfterFailedPair": false,
+    "campaignStopPolicy": "measurement-invalidating-only"
+  },
+  "stages": [
+    { "id": "S0", "cumulativeSessions": 0, "newSessions": 0, "mode": "preflight-only", "claimEligible": false },
+    { "id": "S12", "cumulativeSessions": 12, "newSessions": 12, "mode": "execute-and-pause", "claimEligible": false },
+    { "id": "S18", "cumulativeSessions": 18, "newSessions": 6, "mode": "resume-and-pause", "claimEligible": false },
+    { "id": "S54", "cumulativeSessions": 54, "newSessions": 36, "mode": "resume-and-pause", "claimEligible": false },
+    { "id": "S108", "cumulativeSessions": 108, "newSessions": 54, "mode": "resume-and-finalize", "claimEligible": true }
+  ],
+  "earlyDetection": {
+    "smokeDiversityStageId": "S12",
+    "fullFamilyCoverageStageId": "S18",
+    "fullCategoryCoverageStageId": "S54",
+    "expectedFirstRepeatScenarioIds": [
+      "cli-double-dash",
+      "chunked-record-boundary",
+      "protected-env-refusal",
+      "resumable-checkpoint-partial-failure",
+      "tenant-cache-isolation",
+      "billing-cutoff-clock-skew"
+    ],
+    "firstFullFamilyCoverageScenarioIds": [
+      "cli-double-dash",
+      "chunked-record-boundary",
+      "protected-env-refusal",
+      "resumable-checkpoint-partial-failure",
+      "tenant-cache-isolation",
+      "billing-cutoff-clock-skew",
+      "backend-frontend-contract-sync",
+      "stale-search-response",
+      "schema-migration"
+    ],
+    "requiredCategoryCoverage": ["backend", "frontend", "data", "platform", "reliability", "security", "fullstack"],
+    "requiredLifecycleCoverage": ["steady-state", "cold-start"],
+    "requiredDifficultyCoverage": ["small", "medium", "large"],
+    "requiredVariantRoleCoverage": ["boundary", "interaction", "adversarial-recovery"]
+  },
+  "productionGuards": {
+    "subagents": {
+      "required": true,
+      "maximumSessionsPerAttempt": 1,
+      "maximumTrafficShare": 0.05,
+      "requireExactAllAttemptEvidence": true,
+      "requireExplainedSessionCount": true
+    },
+    "partialFreshSpend": {
+      "requiredFromCumulativeSessions": 12,
+      "maximumPooledFreshRatio": 1.1,
+      "maximumObservedFamilyFreshRatio": 1.25,
+      "includeExactFailedAttempts": true
+    },
+    "providerFreeEvidence": {
+      "requiredBeforeFirstPaidSession": true,
+      "requiredLaneIds": ["architecture-conformance-v1", "runtime-conformance-v1", "long-horizon-v1", "webui-parity-v1"],
+      "requireCleanCommitAndTreeBinding": true,
+      "requireProductionConfigurationBinding": true,
+      "requireRunnerAndLaneConfigurationDigests": true
+    },
+    "campaignAccounting": {
+      "requiredBeforeFirstPaidSession": true,
+      "requireSingleOutputResumeLineage": true,
+      "includeEveryProviderStartedAttempt": true,
+      "unknownUsageFailsClosed": true
+    }
+  },
+  "enforcement": {
+    "runnerConsumesThisArtifact": true,
+    "runnerBindsFrozenSeedAndExecution": true,
+    "runnerWritesAtomicPrivateStageDiagnostic": true,
+    "runnerBlocksProductionResumeWhenStageDiagnosticFails": true,
+    "durableStageStateSurvivesMissingPauseMarker": true,
+    "completeLedgerFinalizesWithoutProviderPreflight": true,
+    "stageDiagnosticArtifact": "stage-diagnostic.json",
+    "automaticTerminalOrAbortRules": [
+      "dirty-release-source-before-auth-tool-or-provider-preflight",
+      "source-runtime-configuration-or-provider-wire-identity-drift",
+      "invalid-harness-grader-schema-or-lifecycle-outcome",
+      "infrastructure-error-or-unknown-provider-attempt-usage-via-runner-abort",
+      "corrupt-contradictory-or-incomplete-ledger-or-evidence-chain",
+      "candidate-provenance-drift-via-execution-guard"
+    ],
+    "stageAdvanceRules": [
+      "clean-release-source",
+      "all-accepted-production-v3-outcomes-remain-measurement-valid",
+      "no-model-thinking-or-provider-wire-parity-drift",
+      "fast-execution-configuration-parity-from-piagent-outbound-telemetry-and-codex-identity-bound-effective-thread-settings-with-no-default-fallback",
+      "complete-privacy-safe-causal-context-receipt-with-closed-session-lifecycle",
+      "source-bound-provider-free-architecture-runtime-long-horizon-and-webui-parity-receipts",
+      "no-accepted-usage-completeness-failure",
+      "no-infrastructure-retry",
+      "no-unknown-provider-attempt-usage",
+      "complete-durable-campaign-and-ledger-accounting"
+    ],
+    "finalAdjudicationRules": [
+      "quality-safety-reliability-workflow-category-and-paired-outcome-gates",
+      "exact-subagent-budget-at-most-one-session-per-attempt-and-five-percent-traffic",
+      "partial-stage-pooled-and-family-fresh-ratios-are-recorded-but-do-not-stop-a-valid-measurement",
+      "final-upper95-family-and-all-attempt-pooled-fresh-token-gates"
+    ],
+    "nonBlockingDiagnostics": [
+      "normalized-api-equivalent-text-token-cost",
+      "duration",
+      "host-load"
+    ],
+    "operatorRule": "S12, S18 and S54 are measurement-validity checkpoints only. Valid agent failures and unfavorable token ratios are retained and cannot stop the campaign. Only S108 adjudicates quality and claim gates, including the 0.60 upper-95 family-level guard and the 0.65 pooled all-attempt net fresh-token gate."
+  },
+  "claimBoundary": "Only the complete production-v3 S108 ledger may establish a public-regression product comparison against the stock Codex CLI baseline. The suite is not family-disjoint and cannot establish universal, private-generalization, causal, member-production, billed-cost, or actual provider-processing-tier claims. The net-35 ratio includes accepted plus exact failed/retry fresh tokens; provider response tier and subscription credits remain separate."
+}