@xaccefy/pi-casefile 0.10.0 → 0.11.0

package/src/index.ts

@@ -1,30 +1,23 @@
 /**
  * Casefile — offensive security case tracker for Pi.
  *
- * Tools: CaseAdd, CaseUpdate, PromoteFinding, ConfirmFinding, EvidenceAdd, CoverageAdd, CoverageReport, CaseGet, CaseList, CaseSearch, CaseLink, CaseUnlink, CaseContext, ScratchpadInit, ScratchpadResume, ScratchpadCheckpoint, ScratchpadWrite, ScratchpadRead, ScratchpadPhaseDone, ScratchpadClear
+ * Tools: CaseAdd, CaseUpdate, PromoteFinding, ConfirmFinding, EvidenceAdd, CoverageAdd, CaseGet, CaseList, CaseSearch, CaseLink, CaseUnlink, CaseContext, ScratchpadWrite, ScratchpadRead, ScratchpadClear
  * Command: /casefile — interactive dashboard
  * Event: before_agent_start — injects the recon workflow once per session, refreshes the active case list per prompt
  */
 
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
-import { join } from "node:path";
 import type { ExtensionAPI, ToolDefinition } from "@earendil-works/pi-coding-agent";
 import { matchesKey, Text, truncateToWidth } from "@earendil-works/pi-tui";
 import { type TSchema, Type } from "typebox";
 import {
-  CANARY_ASSESSMENT_VALUES,
   CONFIRM_DIFFERENTIAL_VALUES,
   CONFIRM_VERDICT_VALUES,
   SEVERITY_MATCH_VALUES,
   validateMainAgentVerdict,
 } from "./evidence.ts";
-import {
-  controlTargetAuthorizationError,
-  type HarnessVerifyResult,
-  replayDifferential,
-  replayIntraTarget,
-} from "./harness-verify.ts";
+import { type HarnessVerifyResult, replayIntraTarget } from "./harness-verify.ts";
 import {
   addCaseResult,
   addEvidenceItemResult,
@@ -43,7 +36,6 @@ import {
   type CoverageItem,
   type CoverageScope,
   countCases,
-  coverageSummary,
   EVIDENCE_ROLE_VALUES,
   type EvidenceItem,
   type EvidenceRole,
@@ -54,8 +46,6 @@ import {
   getCasefilePath,
   LINK_KIND_VALUES,
   linkCasesResult,
-  type MainAgentVerification,
-  type OobVerification,
   type PendingConfirmation,
   type PocEvidenceRun,
   PRIORITY_VALUES,
@@ -69,27 +59,15 @@ import {
   storePendingConfirmation,
   unlinkCasesResult,
   updateCaseResult,
+  writeCaseContext,
 } from "./ledger.ts";
-import { writeCaseContext } from "./ledger.ts";
-import {
-  type OobOracleConfig,
-  type ProvisionedCallback,
-  provisionCallback,
-  readOobOracleConfig,
-  verifyOobDifferential,
-} from "./oob-oracle.ts";
 import { type PocRun, type PocRunOptions, runPoc } from "./poc-runner.ts";
 import {
   detectWorkspaceRoot,
   SCRATCHPAD_PHASES,
   type ScratchpadPhase,
-  type ScratchpadResume,
-  scratchpad_checkpoint,
   scratchpad_clear,
-  scratchpad_init,
-  scratchpad_phase_done,
   scratchpad_read,
-  scratchpad_resume,
   scratchpad_write,
   setScratchpadRoot,
 } from "./scratchpad.ts";
@@ -144,6 +122,21 @@ const CommonFields = {
         "The security invariant this finding violates — the rule broken (e.g. 'a user cannot read another user's orders'). Confirmation checks the invariant is actually violated, not just that a request returned 200.",
     }),
   ),
+  retry_policy: Type.Optional(
+    Type.Object(
+      {
+        max_attempts: Type.Number({
+          description: "Max attempts a phase may take for this case (integer 1–10)",
+        }),
+        fallback_models: Type.Optional(
+          Type.Array(Type.String(), {
+            description: "Fallback model identifiers to try when the primary model fails (≤8)",
+          }),
+        ),
+      },
+      { additionalProperties: false },
+    ),
+  ),
 };
 
 // ── Tool: CaseAdd ─────────────────────────────────────────────────────
@@ -190,15 +183,53 @@ const EvidenceAddSchema = Type.Object(
   { additionalProperties: false },
 );
 
+// ── Tool: CoverageAdd ─────────────────────────────────────────────────
+
+const CoverageAddSchema = Type.Object(
+  {
+    case_id: Type.String({
+      description: "Case ID (the finding case or target's main case) to record coverage under",
+    }),
+    asset: Type.String({
+      description:
+        "The asset tested — copy it verbatim from the case target where shown. For scope=wide use the deployment-wide identifier.",
+    }),
+    class: Type.String({
+      description:
+        "The attack class tested (e.g. sql-injection, xss, idor, ssti, ssrf, auth-bypass, ...).",
+    }),
+    // Provider-safe string enum (per the header rule): Type.Union(Type.Literal)
+    // serializes as anyOf/const, which some providers drop — scope would
+    // arrive undefined and every explicit 'wide' verdict would silently
+    // persist as 'local', under-reporting tested classes.
+    scope: Type.String({
+      enum: [...COVERAGE_SCOPE_VALUES],
+      description:
+        "'wide' if the verdict applies to the whole deployment/account/host (recorded ONCE, applies to every asset of the deployment — do NOT re-test it per asset); 'local' if specific to this one asset.",
+    }),
+    note: Type.String({
+      description: "Short note: techniques tried · result · key gap.",
+    }),
+    evidence_item_id: Type.Optional(
+      Type.String({
+        description:
+          "Optional artifact-backed evidence item (EvidenceAdd, on this case) backing the tested verdict. Cells without one render as unbacked.",
+      }),
+    ),
+  },
+  { additionalProperties: false },
+);
+
 // ── Tool: PromoteFinding (phase 1) / ConfirmFinding (phase 2) ──────────
 //
 // Confirmation is TWO-PHASE and main-agent-owned: PromoteFinding runs the PoC
-// 2x + control, validates nonce-bound evidence.json, and records the pending
-// bundle; ConfirmFinding then performs the main coordinator's review/replay and
+// twice against the case target, validates nonce-bound evidence.json, replays
+// the attack and baseline requests itself, and records the pending bundle;
+// ConfirmFinding then performs the main coordinator's semantic review and
 // commits or refuses the verdict. Subagents may gather or challenge evidence,
 // but they cannot run validation or confirmation gates. Zero exit is necessary
-// run integrity and markers are diagnostic only; the machine records
-// predicate/canary differentials and the main agent owns the semantic judgment.
+// run integrity and markers are diagnostic only; the machine records the
+// predicate differential and the main agent owns the semantic judgment.
 
 const PromoteSchema = Type.Object(
   {
@@ -206,38 +237,12 @@ const PromoteSchema = Type.Object(
     poc_path: Type.String({
       description: "Absolute path to the PoC script on disk",
     }),
-    control_path: Type.Optional(
-      Type.String({
-        description:
-          "Optional absolute path to the SAME script as poc_path (sha256-equality is ENFORCED). Defaults to poc_path. The harness runs it with PI_POC_MODE=control and PI_POC_TARGET=control_target.",
-      }),
-    ),
-    mode: Type.Optional(
-      Type.String({
-        enum: ["inter_host", "intra_target"],
-        description:
-          "Differential shape. 'inter_host' (default) proves target-dependence with a distinct patched control host — for body-carried proof (file read, injection exfil, info leak, reflection). 'intra_target' proves it with a legitimate same-host baseline request declared in the evidence — for access-control / business-logic classes (IDOR, auth bypass, privilege escalation, logic flaws) where the discriminating variable is identity or a parameter, not the host. In intra_target the evidence must set verify.mode='intra_target' and include a baseline; control_target/control_path are not used.",
-      }),
-    ),
-    control_target: Type.Optional(
-      Type.String({
-        minLength: 1,
-        description:
-          "REQUIRED for mode='inter_host': a distinct baseline target that lacks the vulnerability and is operator-approved through PI_POC_CONTROL_TARGETS (patched replica, second account, baseline service). Not used for mode='intra_target'.",
-      }),
-    ),
     local: Type.Optional(
       Type.Boolean({
         description:
           "Run with network access instead of --network none. Requires operator authorization via PI_POC_ALLOW_NETWORK=1. True host fallback additionally requires PI_POC_ALLOW_LOCAL=1.",
       }),
     ),
-    oob: Type.Optional(
-      Type.Boolean({
-        description:
-          "Blind/OOB confirmation via the operator-run oracle (PI_OOB_ORACLE_URL). The harness provisions per-run callback tokens, injects PI_POC_CALLBACK_DOMAIN into the runs, and polls the oracle itself: promotion requires target-token interactions, ZERO control-token interactions, attested source separation (PI_OOB_SOURCE_SEPARATED=1), and self-source/missing-src_ip interactions are rejected. Without an oracle this fails closed.",
-      }),
-    ),
   },
   { additionalProperties: false },
 );
@@ -257,12 +262,12 @@ const ConfirmSchema = Type.Object(
         re_execution_note: Type.Optional(
           Type.String({
             description:
-              "What the main agent observed during review and the fresh harness-owned target/control replay. Mandatory for CONFIRMED.",
+              "What the main agent observed during review of the runs and transcripts. Mandatory for CONFIRMED.",
           }),
         ),
         differential: Type.String({
           enum: [...CONFIRM_DIFFERENTIAL_VALUES],
-          description: "Target vs control evidence comparison. CONFIRMED requires target_only.",
+          description: "Attack vs baseline evidence comparison. CONFIRMED requires target_only.",
         }),
         severity_match: Type.Optional(
           Type.String({
@@ -276,19 +281,6 @@ const ConfirmSchema = Type.Object(
               "The main agent's own failed attempt to disprove — becomes the case's disconfirmation",
           }),
         ),
-        canary_assessment: Type.Optional(
-          Type.String({
-            enum: [...CANARY_ASSESSMENT_VALUES],
-            description:
-              "verified when the replay carried a harness-generated reflection canary; otherwise not_applicable with a concrete reason",
-          }),
-        ),
-        canary_reason: Type.Optional(
-          Type.String({
-            description:
-              "Why a causal reflection canary is not meaningful for this exploit class. Required when canary_assessment=not_applicable.",
-          }),
-        ),
         model: Type.Optional(
           Type.String({ description: "Which model judged (recorded for the accuracy ledger)" }),
         ),
@@ -385,7 +377,7 @@ const ScratchpadPhaseSchema = Type.String({
     "Pipeline phase: recon | hunt | trace | skeptic | validate | chain | patch | report (legacy gapfil is accepted for older runs)",
 });
 
-/** run_id-only schema, shared by Scratchpad Init / Resume / Clear. */
+/** run_id-only schema, shared by Scratchpad tools. */
 const RunIdSchema = Type.Object(
   {
     run_id: Type.String({ description: "Pipeline run identifier" }),
@@ -393,20 +385,6 @@ const RunIdSchema = Type.Object(
   { additionalProperties: false },
 );
 
-const ScratchpadCheckpointSchema = Type.Object(
-  {
-    run_id: Type.String({ description: "Run identifier" }),
-    phase: ScratchpadPhaseSchema,
-    ids: Type.Optional(
-      Type.Array(Type.String(), {
-        description: "Key IDs produced by this phase (case IDs, finding IDs)",
-      }),
-    ),
-    summary: Type.Optional(Type.String({ description: "One-line summary of phase completion" })),
-  },
-  { additionalProperties: false },
-);
-
 const ScratchpadWriteSchema = Type.Object(
   {
     run_id: Type.String({ description: "Run identifier" }),
@@ -428,14 +406,6 @@ const ScratchpadReadSchema = Type.Object(
   { additionalProperties: false },
 );
 
-const ScratchpadPhaseDoneSchema = Type.Object(
-  {
-    run_id: Type.String({ description: "Run identifier" }),
-    phase: ScratchpadPhaseSchema,
-  },
-  { additionalProperties: false },
-);
-
 interface Theme {
   fg(color: string, text: string): string;
   bold(text: string): string;
@@ -733,7 +703,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
   // already-loaded extension or reveal a tool that was omitted at startup.
   const startedAsSubagent = process.env.PI_SUBAGENT_CHILD === "1";
   const isSubagentProcess = () => startedAsSubagent || process.env.PI_SUBAGENT_CHILD === "1";
-  // Pin the workspace root ONCE at extension load. Every scratchpad / pipeline
+  // Pin the workspace root ONCE at extension load. Every scratchpad
   // / PoC-path lookup otherwise re-walks the ambient cwd on each call — a
   // mid-session `cd` would split state across two .scratchpad roots and
   // misroot the hunt file-existence filter. The PoC runner reads PI_POC_ROOT
@@ -790,7 +760,13 @@ export default function casefileExtension(pi: ExtensionAPI) {
     parameters: AddSchema,
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const result = addCaseResult(params as CaseInput);
+      const { retry_policy, ...rest } = params as Record<string, unknown>;
+      const result = addCaseResult({
+        ...(rest as CaseInput),
+        ...(retry_policy !== undefined
+          ? { retryPolicy: retry_policy as CaseInput["retryPolicy"] }
+          : {}),
+      });
       const record = result.record;
       return {
         content: [
@@ -842,8 +818,14 @@ export default function casefileExtension(pi: ExtensionAPI) {
     parameters: UpdateSchema,
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const { id, ...update } = params;
-      const result = updateCaseResult(id as string, update as CaseUpdate);
+      const { id, retry_policy, ...rest } = params as Record<string, unknown>;
+      const update = {
+        ...(rest as CaseUpdate),
+        ...(retry_policy !== undefined
+          ? { retryPolicy: retry_policy as CaseUpdate["retryPolicy"] }
+          : {}),
+      };
+      const result = updateCaseResult(id as string, update);
       const record = result.record;
       return {
         content: [
@@ -908,7 +890,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
         content: [
           {
             type: "text",
-            text: `Evidence item recorded:\n[${item.role}] ${item.summary}${item.artifactPath ? ` — ${item.artifactPath} sha256:${item.sha256?.slice(0, 12)}…` : ""}\n\n${formatCaseDetail(record)}`,
+            text: `Evidence item recorded:\n[${item.role}] ${item.summary}${item.artifactPath ? ` — ${item.artifactPath} sha256:${item.sha256?.slice(0, 12)}…` : ""}${item.containsSecret ? `\n⚠ Artifact contains suspected secrets (${item.secretFindings?.join(", ")}) — stored and hashed, but REDACT these values in any export or report.` : ""}\n\n${formatCaseDetail(record)}`,
           },
         ],
         details: { item, record },
@@ -938,158 +920,6 @@ export default function casefileExtension(pi: ExtensionAPI) {
     },
   });
 
-  // ── Tool: CoverageAdd ──
-
-  const CoverageAddSchema = Type.Object(
-    {
-      case_id: Type.String({
-        description: "Case ID (the pipeline-run or finding case) to record coverage under",
-      }),
-      asset: Type.String({
-        description:
-          "The asset tested — copy it verbatim from the case target where shown. For scope=wide use the deployment-wide identifier.",
-      }),
-      class: Type.String({
-        description:
-          "The attack class tested (e.g. sql-injection, xss, idor, ssti, ssrf, auth-bypass, ...).",
-      }),
-      // Provider-safe string enum (per the header rule): Type.Union(Type.Literal)
-      // serializes to anyOf/const, which some providers drop — scope would
-      // arrive undefined and every explicit 'wide' verdict would silently
-      // persist as 'local', under-reporting tested classes.
-      scope: Type.String({
-        enum: [...COVERAGE_SCOPE_VALUES],
-        description:
-          "'wide' if the verdict applies to the whole deployment/account/host (recorded ONCE, applies to every asset of the deployment — do NOT re-test it per asset); 'local' if specific to this one asset.",
-      }),
-      note: Type.String({
-        description:
-          "Short note of the tests ACTUALLY RUN and the verdict: techniques tried · result · key gap. A verdict guessed without testing can hide a real issue.",
-      }),
-      evidence_item_id: Type.Optional(
-        Type.String({
-          description:
-            "Evidence item id backing this tested verdict (must be an artifact-backed EvidenceAdd item on this case). Cells without a backing item render as 'unbacked' in CoverageReport — 'tested' claims must be machine-checkable, not prose-only.",
-        }),
-      ),
-    },
-    { additionalProperties: false },
-  );
-
-  registerCaseTool({
-    name: "CoverageAdd",
-    label: "Record Coverage",
-    description:
-      "Record what you tested so it is not re-tested. Call AFTER finishing a CLASS of issue, for BOTH outcomes (found or clean — a clean result is just as important to record). scope=wide: the verdict is a property of the whole deployment, recorded once and applied to every later asset (do NOT re-test per asset); scope=local: specific to this one asset. The cell's existence marks that class tested for that asset.",
-    promptSnippet: "Record a tested attack class (coverage)",
-    promptGuidelines: [
-      "Record a coverage cell after you finish testing a class on an asset — found OR clean. Clean results are what make 'every class is COVERED' machine-checkable.",
-      "scope=wide for deployment-wide verdicts (record once, applies to every asset of the deployment — do NOT re-test it per asset). scope=local for single-asset verdicts.",
-      "The note must describe tests you ACTUALLY RAN, not assumptions. A verdict guessed without testing can hide a real issue.",
-      "Coverage cells live on the pipeline-run case (or the target's main case); CoverageReport shows the matrix.",
-    ],
-    parameters: CoverageAddSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const item = recordCoverageResult(params.case_id as string, {
-        asset: params.asset as string,
-        class: params.class as string,
-        scope: (params.scope ?? "local") as CoverageScope,
-        note: params.note as string,
-        evidenceItemId: params.evidence_item_id as string | undefined,
-      });
-      const record = getCaseById(params.case_id as string);
-      if (!record) throw new Error(`Case not found after coverage insert: ${params.case_id}`);
-      return {
-        content: [
-          {
-            type: "text",
-            text: `Coverage recorded: [${item.scope}] ${item.asset} × ${item.class} — ${item.note}\n\n${formatCaseDetail(record)}`,
-          },
-        ],
-        details: { item, record },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(
-        theme,
-        "CoverageAdd",
-        `${(args.asset as string) ?? ""} [${(args.class as string) ?? ""}]`,
-      );
-    },
-
-    renderResult(result, _opts, theme) {
-      const details = result.details as { item?: CoverageItem } | undefined;
-      if (!details?.item) {
-        return new Text(theme.fg("error", "✗ CoverageAdd failed"), 0, 0);
-      }
-      return new Text(
-        theme.fg("success", "✓ ") +
-          theme.fg("dim", `[${details.item.scope}] `) +
-          truncateToWidth(`${details.item.asset} × ${details.item.class}`, 50),
-        0,
-        0,
-      );
-    },
-  });
-
-  // ── Tool: CoverageReport ──
-
-  const CoverageReportSchema = Type.Object(
-    {
-      case_id: Type.String({ description: "Case ID to render the coverage matrix for" }),
-    },
-    { additionalProperties: false },
-  );
-
-  registerCaseTool({
-    name: "CoverageReport",
-    label: "Coverage Matrix",
-    description:
-      "Render the machine-checkable coverage matrix for a case: which (asset × attack-class) cells are tested, with wide-verdict propagation. Run before deciding HUNT coverage is done — the plateau stop (zero new classes testable) must be visible in the matrix, not asserted in prose.",
-    promptSnippet: "Show which attack classes were tested where",
-    promptGuidelines: [
-      "Run CoverageReport before claiming 'every class is COVERED/SKIPPED/NOT_FOUND' — the claim must match the matrix.",
-      "A class with a wide clean verdict covers every asset — do NOT re-test it per asset.",
-      "Classes tested with no cell recorded are invisible: record coverage as you finish each class (CoverageAdd).",
-    ],
-    parameters: CoverageReportSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const summary = coverageSummary(params.case_id as string);
-      const lines: string[] = [`Coverage matrix for ${params.case_id}:`];
-      for (const asset of summary.assets) {
-        lines.push(`\n## ${asset}`);
-        for (const cell of summary.byAsset[asset] ?? []) {
-          lines.push(
-            `- [${cell.scope}] ${cell.class} — ${cell.note}${cell.testedBy ? ` (by ${cell.testedBy})` : ""}` +
-              (cell.evidenceItemId
-                ? ""
-                : " ⚠ unbacked (link an artifact-backed evidence item via CoverageAdd evidence_item_id)"),
-          );
-        }
-      }
-      if (summary.items.length === 0) {
-        lines.push("\n(no coverage recorded yet — run CoverageAdd as each class is tested)");
-      }
-      return {
-        content: [{ type: "text", text: lines.join("\n") }],
-        details: { summary },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "CoverageReport", (args.case_id as string) ?? "");
-    },
-
-    renderResult(result, _opts, theme) {
-      const details = result.details as { summary?: { items?: CoverageItem[] } } | undefined;
-      const n = details?.summary?.items?.length ?? 0;
-      return new Text(theme.fg("success", `✓ ${n} coverage cell(s)`), 0, 0);
-    },
-  });
-
   // ── Tool: PromoteFinding (phase 1) ──
 
   if (!startedAsSubagent)
@@ -1097,19 +927,15 @@ export default function casefileExtension(pi: ExtensionAPI) {
       name: "PromoteFinding",
       label: "Run PoC Evidence",
       description:
-        "Main-agent phase 1 of confirmation: run the same PoC twice against the case target and once against an operator-approved control_target, validate nonce-bound evidence.json with a response-body assertion, then have the harness execute one immutable HTTP request template against both target and control. control_path defaults to poc_path; if supplied, sha256 equality is enforced. The machine records a predicate differential, or a stronger canary differential when a reflection placeholder is requested and observed only on target; neither is automatically a vulnerability verdict. Exit 0 is necessary run integrity, never proof. Networked execution, controls, and private replay are operator-gated. Blind/OOB confirmation fails closed until source separation exists. Records a pending bundle for main-agent semantic review via ConfirmFinding. Worker/subagent processes are rejected.",
-      promptSnippet:
-        "Phase 1: run PoC evidence (target x2 + control) and record the pending bundle",
+        "Main-agent phase 1 of confirmation: run the same PoC twice against the case target, validate nonce-bound evidence.json with a response-body assertion, then have the harness replay the attack request and a legitimate same-host baseline request itself. The machine records a predicate differential (attack matched, baseline did not); that is not automatically a vulnerability verdict. Exit 0 is necessary run integrity, never proof. Networked execution and private replay are operator-gated. Records a pending bundle for main-agent semantic review via ConfirmFinding. Worker/subagent processes are rejected.",
+      promptSnippet: "Phase 1: run PoC evidence (target x2) and record the pending bundle",
       promptGuidelines: [
         "Use PromoteFinding only from the main/coordinator agent when an investigating case has a concrete PoC script on disk and you are ready to subject its claim to the machine gate.",
         "Prerequisites: status='investigating' and non-empty poc, evidence, impact, severity, target, plus an artifact-backed EvidenceAdd 'observation' item on the case (the initial signal, with artifact_path). The final disconfirmation comes from the main agent at confirm time.",
-        "The PoC MUST write evidence.json to $PI_POC_EVIDENCE_DIR: { nonce (echo $PI_POC_NONCE), claim, verify: { method, url, expect: { status?, body_contains/body_regex } }, observations }. A non-empty body predicate is mandatory; status-only evidence is rejected. verify.url must belong to the case target.",
-        "For reflection-capable requests, place {{PI_POC_CANARY}} exactly once in verify.url/body/header values and declare verify.canary={mode:'reflection',placeholder:'{{PI_POC_CANARY}}'}. The harness substitutes an unpredictable value only after the PoC exits and requires target-only reflection; the raw token is not persisted.",
-        "control_path is optional and defaults to poc_path; if supplied, it must be the SAME script as poc_path. control_target must be pre-approved by the operator in PI_POC_CONTROL_TARGETS. The harness derives the control request from the target request, changes only its origin, and applies the same predicates to two conclusive responses.",
-        "oob=true unlocks blind/OOB classes (SSRF, blind XSS, XXE): the harness provisions per-run callback tokens via the operator's oracle (PI_OOB_ORACLE_URL), injects PI_POC_CALLBACK_DOMAIN into the runs, and polls the oracle itself — target-token interactions with ZERO control-token interactions are required. Promotion additionally requires attested source separation (PI_OOB_SOURCE_SEPARATED=1); without it the verification stays diagnostic.",
+        "The PoC MUST write evidence.json to $PI_POC_EVIDENCE_DIR: { nonce (echo $PI_POC_NONCE), claim, verify: { method, url, expect: { status?, body_contains/body_regex } }, observations, baseline }. A non-empty body predicate is mandatory; status-only evidence is rejected. verify.url and baseline.url must belong to the case target.",
+        "baseline is a legitimate same-host request whose response must NOT satisfy the attack predicate — your own account's resource for IDOR, the request without the payload for injection. It must differ from the attack request (identity or a parameter, not just whitespace).",
         "local:true requires PI_POC_ALLOW_NETWORK=1. Private/internal harness replay additionally requires PI_POC_ALLOW_PRIVATE_REPLAY=1. Neither silently falls back to a model verdict.",
-        "Blind/OOB classes fail closed unless the operator configured an OOB oracle; self-interactions (PI_OOB_SELF_IPS) are rejected and never counted as target hits.",
-        "After the bundle is recorded, stay in the main agent: inspect the script/evidence, attempt disconfirmation, and call ConfirmFinding itself; that call performs a fresh harness-owned target/control replay. Never delegate validation/confirmation and never CaseUpdate status='confirmed' directly.",
+        "After the bundle is recorded, stay in the main agent: inspect the script/evidence, attempt disconfirmation, and call ConfirmFinding yourself. Never delegate validation/confirmation and never CaseUpdate status='confirmed' directly.",
       ],
       parameters: PromoteSchema,
 
@@ -1126,167 +952,65 @@ export default function casefileExtension(pi: ExtensionAPI) {
         const caseId = params.id as string;
         const current = assertPromotable(caseId);
 
-        const fail = (text: string, _extra?: Record<string, unknown>): never => {
+        const fail = (text: string): never => {
           throw new Error(text);
         };
 
         const pocPath = (params.poc_path as string | undefined)?.trim() ?? "";
-        const controlPath = (params.control_path as string | undefined)?.trim() || pocPath;
-        const controlTarget = (params.control_target as string | undefined)?.trim() ?? "";
-        const mode: "inter_host" | "intra_target" =
-          (params.mode as string | undefined) === "intra_target" ? "intra_target" : "inter_host";
-        const isIntra = mode === "intra_target";
         if (!pocPath) {
-          return fail("poc_path is REQUIRED: absolute path to the PoC script run by the harness.", {
-            missingPocPath: true,
-          });
+          return fail("poc_path is REQUIRED: absolute path to the PoC script run by the harness.");
         }
         const caseTarget = current.target ?? "";
-        // ── OOB callback (Tier 1, opt-in for blind classes) ──
-        // The operator-run oracle owns the evidence channel; the harness owns
-        // the secret (per-run token, provisioned before the runs and injected
-        // as env — the value does not exist when the script was written).
-        // Without an oracle this stays fail-closed.
-        const oobRequested = params.oob === true;
-        // Intra-target + OOB is rejected up front: intra_target's
-        // discriminating variable is identity/parameter on the SAME host;
-        // mixing it with a callback differential would make precedence
-        // ambiguous. OOB is for inter-host/blind classes.
-        if (isIntra && oobRequested) {
-          return fail(
-            "mode:'intra_target' cannot be combined with oob:true — intra-target proof uses a same-host baseline request, not a callback channel. Use one or the other.",
-            { intraOobConflict: true },
-          );
-        }
-        let oobConfig: OobOracleConfig | undefined;
-        let targetCallback: ProvisionedCallback | undefined;
-        let controlCallback: ProvisionedCallback | undefined;
-        if (oobRequested) {
-          const oracle = readOobOracleConfig();
-          if (!oracle.config) {
-            return fail(`OOB CONFIRMATION UNAVAILABLE: ${oracle.error}`, {
-              oobOracleNotConfigured: true,
-            });
-          }
-          oobConfig = oracle.config;
-          // Provision both identities concurrently — each is an oracle round trip.
-          [targetCallback, controlCallback] = await Promise.all([
-            provisionCallback(oobConfig),
-            provisionCallback(oobConfig),
-          ]);
-        }
-        // OOB-only bundles (blind classes, no operator-approved control host)
-        // prove target-dependence via the token differential instead.
-        const oobOnly = oobRequested && !controlTarget;
-        if (!isIntra && !oobOnly) {
-          if (!controlTarget) {
-            return fail(
-              "control_target is REQUIRED for inter-host mode: a distinct baseline target that lacks the vulnerability. For access-control/logic bugs use mode='intra_target' with an evidence baseline instead; for blind/OOB classes pass oob=true (with or without a control target).",
-              { missingControlTarget: true },
-            );
-          }
-          if (controlTarget === current.target) {
-            return fail(
-              "control_target must differ from the case target; a control run against the vulnerable target proves nothing.",
-              { controlTargetEqualsCaseTarget: true },
-            );
-          }
-        }
         if (params.local === true && process.env.PI_POC_ALLOW_NETWORK !== "1") {
           return fail(
             "Networked PoC execution is operator-gated. Set PI_POC_ALLOW_NETWORK=1 to authorize the host-network sandbox for this session.",
-            { networkNotAuthorized: true },
           );
         }
-        if (!isIntra && !oobOnly) {
-          const controlAuthorization = controlTargetAuthorizationError(controlTarget);
-          if (controlAuthorization) {
-            return fail(
-              `CONTROL AUTHORIZATION FAILED: ${controlAuthorization}. ` +
-                "The operator must set PI_POC_CONTROL_TARGETS to the exact approved control host/origin before this control can anchor confirmation.",
-              { controlNotAuthorized: true },
-            );
-          }
-        }
 
-        // Anti-cheat: hash the PoC (always) and, for inter-host, require the
-        // control script to be the SAME bytes (differing only via harness env).
+        // Anti-cheat: hash the PoC so the recorded bundle is bound to the exact
+        // bytes that ran (re-verified at confirm time).
         let pocHash: string | undefined;
         try {
           pocHash = createHash("sha256").update(readFileSync(pocPath)).digest("hex");
         } catch (e) {
-          return fail(`Cannot read PoC script: ${(e as Error).message}`, {
-            sameFileCheckFailed: true,
-          });
-        }
-        if (!isIntra && !oobOnly) {
-          let controlHash: string | undefined;
-          try {
-            controlHash = createHash("sha256").update(readFileSync(controlPath)).digest("hex");
-          } catch (e) {
-            return fail(
-              `Cannot read control script for the same-file check: ${(e as Error).message}`,
-              { sameFileCheckFailed: true },
-            );
-          }
-          if (pocHash !== controlHash) {
-            return fail(
-              "CONTROL CHECK FAILED: control_path must be the SAME script as poc_path (sha256 mismatch). Case remains investigating.",
-              { controlHashMismatch: true },
-            );
-          }
+          return fail(`Cannot read PoC script: ${(e as Error).message}`);
         }
 
-        // ── OOB callback tokens were provisioned above, before the runs ──
-        const runOptions = (pocMode: string, target: string): PocRunOptions => ({
+        const runOptions = (target: string): PocRunOptions => ({
           network: params.local === true ? "host" : "none",
           local: params.local === true,
           env: {
-            PI_POC_MODE: pocMode,
+            PI_POC_MODE: "poc",
             PI_POC_TARGET: target,
-            ...(oobRequested && targetCallback && controlCallback
-              ? {
-                  PI_POC_CALLBACK_DOMAIN:
-                    pocMode === "control" ? controlCallback.domain : targetCallback.domain,
-                }
-              : {}),
           },
         });
 
         // Determinism: TWO target runs. Exit 0 is run integrity only; nonce-bound
-        // body evidence plus the harness-owned differential replay (inter-host
-        // control, or intra-target same-host baseline) form the machine gate.
-        const run1 = runPoc(pocPath, runOptions("poc", caseTarget));
-        const run2 = runPoc(pocPath, runOptions("poc", caseTarget));
-
-        const evidenceRun = (
-          r: PocRun,
-          mode: "poc" | "control",
-          target: string,
-        ): PocEvidenceRun => {
+        // body evidence plus the harness-owned attack/baseline replay form the
+        // machine gate.
+        const run1 = runPoc(pocPath, runOptions(caseTarget));
+        const run2 = runPoc(pocPath, runOptions(caseTarget));
+
+        const evidenceRun = (r: PocRun, target: string): PocEvidenceRun => {
           if (!r.completed || !r.outputComplete) {
             return fail(
-              `${mode} run did not complete or output capture was incomplete` +
+              `PoC run did not complete or output capture was incomplete` +
                 (r.infraError ? ` (infra: ${r.output.trim()})` : "") +
                 ". A crash is not evidence. Case remains investigating.",
-              { run: r, pocCrashed: true },
             );
           }
           if (r.evidenceError) {
             return fail(
-              `EVIDENCE CONTRACT FAILED (${mode} run): ${r.evidenceError}. ` +
-                "The PoC must write evidence.json to $PI_POC_EVIDENCE_DIR — { nonce (echo $PI_POC_NONCE), claim, verify: { method, url, expect: { status?, body_contains / body_regex } }, observations }; a response-body assertion is mandatory — " +
+              `EVIDENCE CONTRACT FAILED: ${r.evidenceError}. ` +
+                "The PoC must write evidence.json to $PI_POC_EVIDENCE_DIR — { nonce (echo $PI_POC_NONCE), claim, verify: { method, url, expect: { status?, body_contains / body_regex } }, observations, baseline }; a response-body assertion is mandatory — " +
                 "the file is bound to this run and validated by the harness. Case remains investigating.",
-              { run: r, evidenceError: r.evidenceError },
             );
           }
           if (!r.evidence || !r.evidenceSha256 || !r.nonce) {
-            return fail(`${mode} run produced no evidence. Case remains investigating.`, {
-              run: r,
-            });
+            return fail("PoC run produced no evidence. Case remains investigating.");
           }
           return {
-            mode,
+            mode: "poc",
             target,
             nonce: r.nonce,
             ranAt: r.ranAt,
@@ -1302,100 +1026,33 @@ export default function casefileExtension(pi: ExtensionAPI) {
         };
 
         const targetRuns: [PocEvidenceRun, PocEvidenceRun] = [
-          evidenceRun(run1, "poc", caseTarget),
-          evidenceRun(run2, "poc", caseTarget),
+          evidenceRun(run1, caseTarget),
+          evidenceRun(run2, caseTarget),
         ];
 
-        // Reflection canary + OOB is rejected after run 1 (the canary is
-        // declared inside evidence.json): the canary path requires a harness
-        // response transcript, which OOB-only bundles never produce — the
-        // per-run callback token IS the causality signal there.
-        if (oobRequested && targetRuns.some((r) => r.evidence.verify.canary !== undefined)) {
-          return fail(
-            "verify.canary cannot be combined with oob:true — the per-run callback token already provides a harness-owned causality signal. Remove the {{PI_POC_CANARY}} placeholder and verify.canary from evidence.json, then re-promote.",
-            { canaryOobConflict: true },
-          );
-        }
         const allowPrivateReplay = process.env.PI_POC_ALLOW_PRIVATE_REPLAY === "1";
-        let harnessVerified: HarnessVerifyResult | undefined;
-        let controlRun: PocEvidenceRun | undefined;
-        if (isIntra) {
-          // Intra-target: prove target-dependence with the evidence's same-host
-          // baseline request — no separate control run. The harness sends attack +
-          // baseline to the case target and requires the proof on attack only.
-          const ev0 = targetRuns[0].evidence;
-          if (ev0.verify.mode !== "intra_target") {
-            return fail(
-              "INTRA-TARGET FAILED: the PoC's evidence.json must set verify.mode='intra_target' when promoting in intra-target mode.",
-              { intraModeMismatch: true },
-            );
-          }
-          if (!ev0.baseline) {
-            return fail(
-              "INTRA-TARGET FAILED: evidence.json must include a baseline — a legitimate same-host request whose response must NOT satisfy the attack predicate.",
-              { intraBaselineMissing: true },
-            );
-          }
-          harnessVerified = await replayIntraTarget(ev0, caseTarget, {
-            allowPrivate: allowPrivateReplay,
-          });
-        } else if (!oobOnly) {
-          // Inter-host (Tier 2): the harness executes the SAME request template
-          // against target and operator-approved control, applying the target's
-          // predicates to both. DNS is pinned at connect time.
-          controlRun = evidenceRun(
-            runPoc(controlPath, runOptions("control", controlTarget)),
-            "control",
-            controlTarget,
-          );
-          harnessVerified = await replayDifferential(
-            targetRuns[0].evidence,
-            caseTarget,
-            controlTarget,
-            { allowPrivate: allowPrivateReplay },
-          );
-        }
-        // OOB differential: poll the oracle for both run tokens. The ledger's
-        // assertMachineConfirmation consumes this BEFORE the response-diff
-        // requirement — blind classes pass via this path when the oracle saw
-        // the target token and NOT the control token under attested source
-        // separation.
-        let callbackVerified: OobVerification | undefined;
-        if (oobConfig && targetCallback && controlCallback) {
-          callbackVerified = (
-            await verifyOobDifferential({
-              targetToken: targetCallback.token,
-              controlToken: controlCallback.token,
-            })
-          ).verification;
-        }
+        // Intra-target differential: prove target-dependence with the evidence's
+        // same-host baseline request. The harness sends attack + baseline to the
+        // case target and requires the proof on attack only.
+        const harnessVerified: HarnessVerifyResult = await replayIntraTarget(
+          targetRuns[0].evidence,
+          caseTarget,
+          { allowPrivate: allowPrivateReplay },
+        );
         const bundle: PendingConfirmation = {
           caseId,
           ranAt: new Date().toISOString(),
           pocPath,
           pocSha256: pocHash,
-          mode,
           targetRuns,
           harnessVerified,
-          ...(callbackVerified && targetCallback && controlCallback
-            ? {
-                callbackVerified,
-                oobTokens: {
-                  targetToken: targetCallback.token,
-                  controlToken: controlCallback.token,
-                },
-              }
-            : {}),
-          ...(!(isIntra || oobOnly) ? { controlPath, controlTarget, controlRun } : {}),
         };
 
         let record: CaseRecord;
         try {
           record = storePendingConfirmation(caseId, bundle);
         } catch (e) {
-          return fail(`Pending confirmation rejected: ${(e as Error).message}`, {
-            storeRejected: true,
-          });
+          return fail(`Pending confirmation rejected: ${(e as Error).message}`);
         }
 
         return {
@@ -1404,15 +1061,12 @@ export default function casefileExtension(pi: ExtensionAPI) {
               type: "text",
               text:
                 `Phase 1 complete — evidence bundle recorded on ${caseId} (expires in 1h).\n` +
-                `Mode: ${mode}. ${isIntra ? "Target runs: 2, same-host baseline differential" : "Target runs: 2, Control run: 1"} — all with validated nonce-bound evidence.json.\n` +
+                `Target runs: 2, same-host baseline differential — all with validated nonce-bound evidence.json.\n` +
                 `Evidence sha256: ${targetRuns[0].evidenceSha256}\n` +
                 `PoC script sha256 (at run time): ${pocHash}\n` +
                 `Harness verify replay: ${harnessVerified?.attempted ? (harnessVerified.pass ? `PASS (status ${harnessVerified.status})` : `FAILED — ${harnessVerified.note}`) : (harnessVerified?.note ?? "not run")}
 ` +
-                (callbackVerified
-                  ? `OOB oracle: target-token hits ${callbackVerified.targetHits}, control-token hits ${callbackVerified.controlHits}, source-separated: ${String(callbackVerified.sourceSeparated)} — ${callbackVerified.note}\n`
-                  : "") +
-                `\nMAIN-AGENT REVIEW REQUIRED (do not delegate): inspect case ${caseId}, PoC ${pocPath}, ${isIntra ? "same-host baseline" : `control ${controlTarget}`}, evidence ${targetRuns[0].evidenceSha256}, and PoC hash ${pocHash}. Hunt for a trivial predicate or fabricated differential and perform a concrete disconfirmation attempt, then call ConfirmFinding yourself. A CONFIRMED call performs and stores a fresh harness-owned ${isIntra ? "attack/baseline" : "target/control"} replay; NOT_CONFIRMED keeps the case investigating.`,
+                `\nMAIN-AGENT REVIEW REQUIRED (do not delegate): inspect case ${caseId}, PoC ${pocPath}, the same-host baseline, evidence ${targetRuns[0].evidenceSha256}, and PoC hash ${pocHash}. Hunt for a trivial predicate or fabricated differential and perform a concrete disconfirmation attempt, then call ConfirmFinding yourself. NOT_CONFIRMED keeps the case investigating.`,
             },
           ],
           details: {
@@ -1420,10 +1074,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
             bundle: {
               caseId,
               ranAt: bundle.ranAt,
-              mode,
               pocPath,
-              controlPath: isIntra ? undefined : controlPath,
-              controlTarget: isIntra ? undefined : controlTarget,
               pocSha256: pocHash,
               evidenceSha256: targetRuns[0].evidenceSha256,
               harnessVerified,
@@ -1461,15 +1112,15 @@ export default function casefileExtension(pi: ExtensionAPI) {
       name: "ConfirmFinding",
       label: "Main-Agent Confirmation",
       description:
-        "Phase 2 of confirmation, reserved for the main/coordinator agent: commit or refuse promotion after independently re-testing the finding. On CONFIRMED, this tool performs a fresh harness-owned target/control replay; the verdict requires a target-only differential, a concrete re_execution_note and disconfirmation_attempt, a canary assessment, and the still-valid PromoteFinding bundle. The machine transcript is evidence, not the semantic vulnerability verdict. Worker/subagent processes are rejected. Three verdicts: CONFIRMED (you reproduced real impact), NOT_CONFIRMED (you POSITIVELY disproved it), INCONCLUSIVE (you could neither reproduce nor disprove — the case is preserved for manual review, never dropped).",
+        "Phase 2 of confirmation, reserved for the main/coordinator agent: commit or refuse promotion after independently reviewing the recorded evidence. The verdict requires a target-only differential, a concrete re_execution_note and disconfirmation_attempt, and the still-valid PromoteFinding bundle. The machine floor is the promote-time harness replay plus confirm-time bundle re-validation — there is no fresh network replay at verdict time, so weigh bundle age (1h TTL) in your review. The machine transcript is evidence, not the semantic vulnerability verdict. Worker/subagent processes are rejected. Three verdicts: CONFIRMED (you reproduced real impact), NOT_CONFIRMED (you POSITIVELY disproved it), INCONCLUSIVE (you could neither reproduce nor disprove — the case is preserved for manual review, never dropped).",
       promptSnippet: "Main agent: independently re-test, then commit or refuse PoC confirmation",
       promptGuidelines: [
         "Run only in the main/coordinator agent after PromoteFinding returns. Do not dispatch a worker to decide or author this verdict.",
-        "Verify with DISBELIEF: assume the finding is a false positive until your OWN re-test proves otherwise. Reproduce the exact observable yourself from the primary evidence (not the hunter's narrative), with a negative/baseline control — a difference you cannot tie to the control is not proof. ConfirmFinding itself re-sends the immutable verify request against target and operator-approved control so phase 2 has a harness-owned transcript.",
+        "Verify with DISBELIEF: assume the finding is a false positive until the recorded evidence proves otherwise. Read the PoC script, both run transcripts, the attack/baseline replay, and the evidence artifacts (not the hunter's narrative) — a difference you cannot tie to the baseline is not proof.",
         "Provenance: the proof must exercise THIS finding's own mechanism. Evidence obtained through a DIFFERENT bug (e.g. 'SQLi' proven by dumping the DB via an RCE) does not confirm it — that is INCONCLUSIVE at best.",
         "Kill the cheapest benign explanation: is this the technology's intended behavior? Did the attacker supply the 'secret' themselves (circular)? Is the claimed C/I/A impact actually demonstrated?",
         "Want a second pair of eyes? Dispatch a read-only skeptic subagent to re-test — it CANNOT confirm (only the main agent commits). You review its verdict and commit it here.",
-        "CONFIRMED requires differential: 'target_only', re_execution_note, and disconfirmation_attempt (your failed disproof). A verdict missing any of these is rejected. Set canary_assessment='verified' when the immutable request declared a canary; otherwise not_applicable with a reason.",
+        "CONFIRMED requires differential: 'target_only', re_execution_note, and disconfirmation_attempt (your failed disproof). A verdict missing any of these is rejected.",
         "NOT_CONFIRMED means you POSITIVELY disproved it (by-design, circular, mislabeled, no impact). Never mark NOT_CONFIRMED merely because you could not reproduce it.",
         "INCONCLUSIVE when you could neither reproduce nor disprove (needs auth, a second account, specific state, timing, or a blind/stored trigger you cannot observe). The case stays investigating and is preserved for manual review — dropping a real finding is worse than keeping an unproven one.",
         "Every verdict consumes the attempt: a fresh PromoteFinding run is required to try again. Never CaseUpdate status='confirmed' directly — always PromoteFinding + ConfirmFinding.",
@@ -1487,83 +1138,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
         if (!parsedVerdict.ok) {
           throw new Error(`Invalid main-agent confirmation verdict: ${parsedVerdict.error}`);
         }
-        let phase2Verification: MainAgentVerification | undefined;
-        if (parsedVerdict.verdict.verdict === "CONFIRMED") {
-          const current = getCaseById(caseId);
-          if (!current) throw new Error(`Case not found: ${caseId}`);
-          const bundle = current.pendingConfirmation;
-          if (!bundle) {
-            throw new Error("No pending confirmation on this case — run PromoteFinding first");
-          }
-          const allowPrivate = process.env.PI_POC_ALLOW_PRIVATE_REPLAY === "1";
-          const caseTargetForReplay = current.target ?? bundle.targetRuns[0].target;
-          let replay: HarnessVerifyResult;
-          if (bundle.mode === "intra_target") {
-            // Same-host attack-vs-baseline replay; no control target to authorize.
-            replay = await replayIntraTarget(bundle.targetRuns[0].evidence, caseTargetForReplay, {
-              allowPrivate,
-            });
-          } else if (bundle.callbackVerified?.attempted && bundle.oobTokens) {
-            // OOB differential: fresh harness-owned re-poll of BOTH run tokens.
-            // Re-polling at confirm time catches interactions that landed after
-            // phase 1 (e.g. a delayed control-token hit) — the verdict is bound
-            // to this fresh observation, not the stored one.
-            const { verification } = await verifyOobDifferential({
-              targetToken: bundle.oobTokens.targetToken,
-              controlToken: bundle.oobTokens.controlToken,
-            });
-            const oobPass =
-              verification.targetHits > 0 &&
-              verification.controlHits === 0 &&
-              verification.sourceSeparated === true;
-            replay = {
-              attempted: true,
-              pass: oobPass,
-              target: {
-                attempted: true,
-                matched: verification.targetHits > 0,
-                url: bundle.targetRuns[0].evidence.verify.url,
-                note: verification.note,
-              },
-              control: {
-                attempted: true,
-                matched: verification.controlHits > 0,
-                url: bundle.targetRuns[0].evidence.verify.url,
-                note: `${verification.controlHits} control-token interaction(s)`,
-              },
-              differential:
-                verification.targetHits > 0
-                  ? verification.controlHits === 0
-                    ? "target_only"
-                    : "both"
-                  : "neither",
-              note: `harness OOB re-poll: ${verification.note}`,
-            };
-          } else if (bundle.callbackVerified?.attempted) {
-            throw new Error(
-              "OOB bundle lacks its provisioned tokens (pre-token-storage ledger) — re-run PromoteFinding for a fresh bundle",
-            );
-          } else {
-            if (!bundle.controlTarget) {
-              throw new Error("inter-host confirmation requires a control target");
-            }
-            const controlAuthorizationError = controlTargetAuthorizationError(bundle.controlTarget);
-            if (controlAuthorizationError) {
-              throw new Error(`CONTROL AUTHORIZATION FAILED: ${controlAuthorizationError}`);
-            }
-            replay = await replayDifferential(
-              bundle.targetRuns[0].evidence,
-              caseTargetForReplay,
-              bundle.controlTarget,
-              { allowPrivate },
-            );
-          }
-          phase2Verification = {
-            at: new Date().toISOString(),
-            result: replay,
-          };
-        }
-        const result = applyConfirmationResult(caseId, parsedVerdict.verdict, phase2Verification, {
+        const result = applyConfirmationResult(caseId, parsedVerdict.verdict, {
           startedAsSubagent: isSubagentProcess(),
         });
         const record = result.record;
@@ -1602,6 +1177,65 @@ ${formatCaseDetail(record)}`,
       },
     });
 
+  // ── Tool: CoverageAdd ──
+
+  registerCaseTool({
+    name: "CoverageAdd",
+    label: "Record Coverage Cell",
+    description:
+      "Record a tested (asset × attack-class) coverage cell on a case — for BOTH outcomes (found or clean). Clean results make 'every class is covered' machine-checkable. scope='wide' records a deployment-wide verdict ONCE (do not re-test per asset); 'local' is asset-specific. Cells can carry an artifact-backed evidence item; unbacked cells render as such in the report contract gate.",
+    promptSnippet: "Record a tested coverage cell (found or clean)",
+    promptGuidelines: [
+      "Use CoverageAdd whenever you finish testing a class on an asset — a clean 'no injection on /api/orders' verdict is just as load-bearing as a finding.",
+      "scope='wide' when the verdict is a property of the whole deployment (record once — do NOT re-test per asset); scope='local' for one asset.",
+      "Reference an artifact-backed EvidenceAdd item via evidence_item_id so the tested verdict is machine-checkable, not prose-only.",
+    ],
+    parameters: CoverageAddSchema,
+
+    async execute(_id, params, _signal, _onUpdate, _ctx) {
+      const item = recordCoverageResult(params.case_id as string, {
+        asset: params.asset as string,
+        class: params.class as string,
+        scope: params.scope as CoverageScope,
+        note: params.note as string,
+        evidenceItemId: params.evidence_item_id as string | undefined,
+      });
+      const record = getCaseById(params.case_id as string);
+      if (!record) throw new Error(`Case not found after coverage insert: ${params.case_id}`);
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Coverage cell recorded:\n[${item.scope}] ${item.asset} × ${item.class} — ${item.note}${item.evidenceItemId ? ` (backed by ${item.evidenceItemId})` : " (unbacked — attach an EvidenceAdd item to make it machine-checkable)"}\n\n${formatCaseDetail(record)}`,
+          },
+        ],
+        details: { item, record },
+      };
+    },
+
+    renderCall(args, theme) {
+      return callLine(
+        theme,
+        "CoverageAdd",
+        `${(args.case_id as string) ?? ""} ${(args.asset as string) ?? ""}×${(args.class as string) ?? ""}`,
+      );
+    },
+
+    renderResult(result, _opts, theme) {
+      const details = result.details as { item?: CoverageItem } | undefined;
+      if (!details?.item) {
+        return new Text(theme.fg("error", "✗ CoverageAdd failed"), 0, 0);
+      }
+      return new Text(
+        theme.fg("success", "✓ ") +
+          theme.fg("dim", `[${details.item.scope}] `) +
+          truncateToWidth(`${details.item.asset} × ${details.item.class}`, 60),
+        0,
+        0,
+      );
+    },
+  });
+
   // ── Tool: CaseGet ──
 
   registerCaseTool({
@@ -1831,15 +1465,15 @@ ${formatCaseDetail(record)}`,
     parameters: IdSchema,
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const { path, contextPath, record } = writeCaseContext(params.id as string);
+      const { path, contextPath, contractPath, record } = writeCaseContext(params.id as string);
       return {
         content: [
           {
             type: "text",
-            text: `Case context written: ${contextPath}\nReport path: ${path}\n${formatCase(record)}`,
+            text: `Case context written: ${contextPath}\nReport path: ${path}\nReport contract path: ${contractPath} — write the closed-schema JSON contract there (evidence_ids + coverage_refs must reference only this case's items); status='reported' is rejected until it validates.\n${formatCase(record)}`,
           },
         ],
-        details: { path, contextPath, record },
+        details: { path, contextPath, contractPath, record },
       };
     },
 
@@ -1857,153 +1491,6 @@ ${formatCaseDetail(record)}`,
     },
   });
 
-  // ── Tool: ScratchpadInit ──
-
-  registerCaseTool({
-    name: "ScratchpadInit",
-    label: "Init Scratchpad",
-    description:
-      "Initialize a crash-recoverable artifact store for a pipeline run. Creates the directory structure and an initial state.json checkpoint. Idempotent — safe to call on resume without --fresh; returns the existing checkpoint if the run already exists.",
-    promptSnippet: "Initialize the pipeline artifact store for a run",
-    promptGuidelines: [
-      "Call ScratchpadInit once at the start of a pipeline run (or on resume before ScratchpadResume).",
-      "The run_id is arbitrary but should be unique per pipeline run — typically <target>-<timestamp>.",
-      "On resume, ScratchpadInit returns the existing checkpoint without wiping it; pair with ScratchpadResume to skip completed phases.",
-    ],
-    parameters: RunIdSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const cp = scratchpad_init(params.run_id as string);
-      return {
-        content: [
-          {
-            type: "text",
-            text: `Scratchpad initialized for run ${cp.run_id}.\nCompleted phases: ${cp.completed_phases.length ? cp.completed_phases.join(", ") : "none"}`,
-          },
-        ],
-        details: { checkpoint: cp },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "ScratchpadInit", (args.run_id as string) ?? "");
-    },
-
-    renderResult(result, _opts, theme) {
-      const cp = (result.details as { checkpoint: { run_id: string } } | undefined)?.checkpoint;
-      return new Text(`${theme.fg("success", "✓ ")}ScratchpadInit ${cp?.run_id ?? ""}`, 0, 0);
-    },
-  });
-
-  // ── Tool: ScratchpadResume ──
-
-  registerCaseTool({
-    name: "ScratchpadResume",
-    label: "Resume Scratchpad",
-    description:
-      "Read the checkpoint and artifact listing for a pipeline run to decide where to resume. Returns the next phase to run (or null if done) and which phases already completed. Returns null if the run does not exist.",
-    promptSnippet: "Check pipeline resume state — which phases are done",
-    promptGuidelines: [
-      "Call ScratchpadResume at pipeline start to determine where to resume. If it returns a checkpoint, skip completed phases (check ScratchpadPhaseDone before each dispatch) and continue from next_phase.",
-      "If ScratchpadResume returns null, the run has no checkpoint — call ScratchpadInit to start fresh.",
-      "Use ScratchpadPhaseDone before dispatching each stage to avoid re-running completed phases (idempotent resume).",
-    ],
-    parameters: RunIdSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const resume = scratchpad_resume(params.run_id as string);
-      if (!resume) {
-        return {
-          content: [
-            {
-              type: "text",
-              text: `No scratchpad found for run ${params.run_id}. Call ScratchpadInit to start a new run.`,
-            },
-          ],
-          details: { resume: null },
-        };
-      }
-      const cp = resume.checkpoint;
-      return {
-        content: [
-          {
-            type: "text",
-            text:
-              `Resume run ${cp.run_id}:\n` +
-              `Completed phases: ${cp.completed_phases.length ? cp.completed_phases.join(", ") : "none"}\n` +
-              `Next phase: ${resume.next_phase ?? "none (run is done)"}`,
-          },
-        ],
-        details: { resume },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "ScratchpadResume", (args.run_id as string) ?? "");
-    },
-
-    renderResult(result, _opts, theme) {
-      const resume = (result.details as { resume: ScratchpadResume | null } | undefined)?.resume;
-      if (!resume) return new Text(theme.fg("warning", "↷ ScratchpadResume — no run found"), 0, 0);
-      return new Text(
-        theme.fg("success", "✓ ") +
-          `ScratchpadResume ${resume.checkpoint.run_id} → next: ${resume.next_phase ?? "done"}`,
-        0,
-        0,
-      );
-    },
-  });
-
-  // ── Tool: ScratchpadCheckpoint ──
-
-  registerCaseTool({
-    name: "ScratchpadCheckpoint",
-    label: "Checkpoint Phase",
-    description:
-      "Mark a pipeline phase as complete in the scratchpad state.json. Records the completion timestamp, key IDs, and an optional summary. Idempotent — re-checkpointing a phase overwrites its summary/IDs without duplicating the completed_phases entry.",
-    promptSnippet: "Record a pipeline phase as complete",
-    promptGuidelines: [
-      "Call ScratchpadCheckpoint after every phase completes: ScratchpadCheckpoint(run_id, phase, { ids, summary }).",
-      "ids are the key case/finding IDs the phase produced — used by resume to reconstruct state.",
-      "Keep completed_phases in pipeline order; the checkpoint sorts automatically.",
-    ],
-    parameters: ScratchpadCheckpointSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const cp = scratchpad_checkpoint(params.run_id as string, params.phase as ScratchpadPhase, {
-        ids: params.ids as string[] | undefined,
-        summary: params.summary as string | undefined,
-      });
-      return {
-        content: [
-          {
-            type: "text",
-            text:
-              `Phase ${params.phase} checkpointed for run ${cp.run_id}.\n` +
-              `Completed phases: ${cp.completed_phases.join(", ")}`,
-          },
-        ],
-        details: { checkpoint: cp },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "ScratchpadCheckpoint", `${args.run_id ?? ""} ${args.phase ?? ""}`);
-    },
-
-    renderResult(result, _opts, theme) {
-      const cp = (
-        result.details as { checkpoint: { run_id: string; completed_phases: string[] } } | undefined
-      )?.checkpoint;
-      return new Text(
-        theme.fg("success", "✓ ") +
-          `ScratchpadCheckpoint ${cp?.run_id ?? ""} — ${cp?.completed_phases.length ?? 0} phases done`,
-        0,
-        0,
-      );
-    },
-  });
-
   // ── Tool: ScratchpadWrite ──
 
   registerCaseTool({
@@ -2011,7 +1498,7 @@ ${formatCaseDetail(record)}`,
     label: "Write Artifact",
     description:
       "Write an intermediate artifact (recon map, trace output, verification log) to a phase's subdirectory in the scratchpad. Overwrites if the name exists. Artifact names are sanitized — path traversal is blocked.",
-    promptSnippet: "Save a pipeline artifact to the scratchpad",
+    promptSnippet: "Save a run artifact to the scratchpad",
     promptGuidelines: [
       "Agents write artifacts to the scratchpad, not to each other's output files (prevents an echo chamber).",
       "The casefile owns state transitions; the scratchpad owns artifacts. Use ScratchpadWrite for bulky intermediate outputs, not CaseUpdate.",
@@ -2057,7 +1544,7 @@ ${formatCaseDetail(record)}`,
     label: "Read Artifact",
     description:
       "Read an artifact from a phase's subdirectory in the scratchpad. Returns null if the artifact is missing. Use to resume a phase from a prior run's intermediate output.",
-    promptSnippet: "Read a pipeline artifact from the scratchpad",
+    promptSnippet: "Read a run artifact from the scratchpad",
     promptGuidelines: [
       "On resume, ScratchpadRead retrieves a prior phase's intermediate output so the next phase can proceed without re-running it.",
       "Returns null for missing artifacts — treat as 'not yet produced' rather than an error.",
@@ -2107,60 +1594,16 @@ ${formatCaseDetail(record)}`,
     },
   });
 
-  // ── Tool: ScratchpadPhaseDone ──
-
-  registerCaseTool({
-    name: "ScratchpadPhaseDone",
-    label: "Phase Done?",
-    description:
-      "Check whether a phase has already been checkpointed in the scratchpad — for idempotent re-run. Returns true if the phase is complete; skip re-dispatching it on resume.",
-    promptSnippet: "Check if a pipeline phase is already complete",
-    promptGuidelines: [
-      "Call ScratchpadPhaseDone before dispatching each stage to avoid re-running completed phases on resume.",
-      "A completed phase with a checkpoint is a no-op on re-run — skip it and continue to the next incomplete phase.",
-    ],
-    parameters: ScratchpadPhaseDoneSchema,
-
-    async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const done = scratchpad_phase_done(params.run_id as string, params.phase as ScratchpadPhase);
-      return {
-        content: [
-          {
-            type: "text",
-            text: `Phase ${params.phase} for run ${params.run_id}: ${done ? "DONE (skip on resume)" : "not done"}`,
-          },
-        ],
-        details: { phase: params.phase, done },
-      };
-    },
-
-    renderCall(args, theme) {
-      return callLine(theme, "ScratchpadPhaseDone", `${args.run_id ?? ""} ${args.phase ?? ""}`);
-    },
-
-    renderResult(result, _opts, theme) {
-      const done = (result.details as { done?: boolean } | undefined)?.done;
-      return new Text(
-        done
-          ? theme.fg("success", "✓ ScratchpadPhaseDone — done")
-          : theme.fg("warning", "↷ ScratchpadPhaseDone — not done"),
-        0,
-        0,
-      );
-    },
-  });
-
   // ── Tool: ScratchpadClear ──
 
   registerCaseTool({
     name: "ScratchpadClear",
     label: "Clear Run",
     description:
-      "Clear a single pipeline run's scratchpad directory. Used by --fresh for one run. Does not touch other runs. The run must be re-initialized with ScratchpadInit afterward.",
-    promptSnippet: "Clear one pipeline run's artifacts",
+      "Clear a single run's scratchpad directory to force a fresh start for that run. Does not touch other runs. Directories are recreated automatically on the next write.",
+    promptSnippet: "Clear one run's artifacts",
     promptGuidelines: [
-      "Use ScratchpadClear to force a fresh start for a single run (--fresh). It deletes that run's directory only.",
-      "After clearing, call ScratchpadInit to recreate the directory structure before writing artifacts.",
+      "Use ScratchpadClear to force a fresh start for a single run. It deletes that run's directory only.",
     ],
     parameters: RunIdSchema,
 
@@ -2170,7 +1613,7 @@ ${formatCaseDetail(record)}`,
         content: [
           {
             type: "text",
-            text: `Scratchpad cleared for run ${params.run_id}. Call ScratchpadInit to start a new run.`,
+            text: `Scratchpad cleared for run ${params.run_id}.`,
           },
         ],
         details: { run_id: params.run_id, cleared: true },