@xaccefy/pi-casefile 0.8.2 → 0.8.3

package/src/pipeline-submit.ts

@@ -18,7 +18,7 @@
  */
 
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { getRunDir, getScratchpadRoot, scratchpad_write } from "./scratchpad.ts";
 
@@ -204,19 +204,43 @@ function statePath(runId: string): string {
 function readState(runId: string): SubmitState {
   const p = statePath(runId);
   if (!existsSync(p)) return { repairs: {}, accepted_findings: [] };
-  try {
-    const raw = JSON.parse(readFileSync(p, "utf8")) as Partial<SubmitState>;
-    return {
-      repairs: raw.repairs ?? {},
-      accepted_findings: raw.accepted_findings ?? [],
-    };
-  } catch {
-    return { repairs: {}, accepted_findings: [] };
+  const raw = JSON.parse(readFileSync(p, "utf8")) as Partial<SubmitState>;
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new Error(`Corrupt pipeline-submit state for ${runId}: root must be an object`);
+  }
+  const repairs = raw.repairs ?? {};
+  if (typeof repairs !== "object" || repairs === null || Array.isArray(repairs)) {
+    throw new Error(`Corrupt pipeline-submit state for ${runId}: repairs must be an object`);
+  }
+  for (const [k, v] of Object.entries(repairs)) {
+    if (typeof k !== "string" || typeof v !== "number" || !Number.isInteger(v) || v < 0) {
+      throw new Error(`Corrupt pipeline-submit state for ${runId}: invalid repair counter`);
+    }
+  }
+  const accepted = raw.accepted_findings ?? [];
+  if (!Array.isArray(accepted)) {
+    throw new Error(
+      `Corrupt pipeline-submit state for ${runId}: accepted_findings must be an array`,
+    );
   }
+  for (const [i, item] of accepted.entries()) {
+    if (typeof item !== "object" || item === null || Array.isArray(item)) {
+      throw new Error(
+        `Corrupt pipeline-submit state for ${runId}: accepted_findings[${i}] invalid`,
+      );
+    }
+  }
+  return {
+    repairs: repairs as Record<string, number>,
+    accepted_findings: accepted as FindingRef[],
+  };
 }
 
 function writeState(runId: string, state: SubmitState): void {
-  writeFileSync(statePath(runId), JSON.stringify(state, null, 2), "utf8");
+  const p = statePath(runId);
+  const tmp = `${p}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(tmp, JSON.stringify(state, null, 2), "utf8");
+  renameSync(tmp, p);
 }
 
 /** Project root containing the scratchpad (file-existence checks resolve here). */
@@ -272,6 +296,109 @@ function isNonEmptyString(v: unknown): v is string {
   return typeof v === "string" && v.trim().length > 0;
 }
 
+function requireStringArray(errors: string[], path: string, value: unknown, minItems = 0): void {
+  if (!Array.isArray(value)) {
+    errors.push(`${path}: missing or not an array`);
+    return;
+  }
+  if (value.length < minItems) errors.push(`${path}: needs at least ${minItems} item(s)`);
+  value.forEach((item, i) => {
+    if (!isNonEmptyString(item)) errors.push(`${path}[${i}]: missing or empty string`);
+  });
+}
+
+function asObject(value: unknown): Record<string, unknown> | undefined {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+}
+
+function validateReport(errors: string[], obj: Record<string, unknown>): void {
+  const findingSeverities = ["info", "low", "medium", "high", "critical"];
+  if (Array.isArray(obj.findings)) {
+    obj.findings.forEach((item, i) => {
+      const finding = asObject(item);
+      if (!finding) {
+        errors.push(`findings[${i}]: not an object`);
+        return;
+      }
+      for (const field of ["id", "vuln_class", "severity", "status"] as const) {
+        if (!isNonEmptyString(finding[field]))
+          errors.push(`findings[${i}].${field}: missing or empty`);
+      }
+      if (!isNonEmptyString(finding.file) && !isNonEmptyString(finding.endpoint)) {
+        errors.push(`findings[${i}]: provide file or endpoint`);
+      }
+      if (isNonEmptyString(finding.severity) && !findingSeverities.includes(finding.severity)) {
+        errors.push(`findings[${i}].severity: invalid value`);
+      }
+      if (isNonEmptyString(finding.status) && !["confirmed", "reported"].includes(finding.status)) {
+        errors.push(`findings[${i}].status: invalid value`);
+      }
+      if (finding.chain_with !== undefined)
+        requireStringArray(errors, `findings[${i}].chain_with`, finding.chain_with);
+    });
+  }
+
+  const coverage = asObject(obj.coverage);
+  if (coverage) {
+    const allowed = ["COVERED", "SKIPPED", "NOT_FOUND", "INCOMPLETE"];
+    for (const [key, value] of Object.entries(coverage)) {
+      if (!/^[a-z-]+$/.test(key)) errors.push(`coverage.${key}: invalid class key`);
+      if (typeof value !== "string" || !allowed.includes(value)) {
+        errors.push(`coverage.${key}: must be one of { ${allowed.join(" | ")} }`);
+      }
+    }
+  }
+
+  if (obj.chains !== undefined) {
+    if (!Array.isArray(obj.chains)) {
+      errors.push("chains: not an array");
+    } else {
+      obj.chains.forEach((item, i) => {
+        const chain = asObject(item);
+        if (!chain) {
+          errors.push(`chains[${i}]: not an object`);
+          return;
+        }
+        if (chain.title !== undefined && !isNonEmptyString(chain.title))
+          errors.push(`chains[${i}].title: missing or empty`);
+        if (chain.steps !== undefined)
+          requireStringArray(errors, `chains[${i}].steps`, chain.steps);
+        if (
+          chain.severity !== undefined &&
+          (!isNonEmptyString(chain.severity) ||
+            !(CHAIN_SEVERITIES as readonly string[]).includes(chain.severity))
+        ) {
+          errors.push(`chains[${i}].severity: invalid value`);
+        }
+        if (chain.blocked_by_controls !== undefined) {
+          requireStringArray(errors, `chains[${i}].blocked_by_controls`, chain.blocked_by_controls);
+        }
+      });
+    }
+  }
+
+  if (obj.patches_applied !== undefined) {
+    if (!Array.isArray(obj.patches_applied)) {
+      errors.push("patches_applied: not an array");
+    } else {
+      obj.patches_applied.forEach((item, i) => {
+        const patch = asObject(item);
+        if (!patch) {
+          errors.push(`patches_applied[${i}]: not an object`);
+          return;
+        }
+        for (const field of ["finding_id", "diff_summary", "re_attack_result"] as const) {
+          if (patch[field] !== undefined && !isNonEmptyString(patch[field])) {
+            errors.push(`patches_applied[${i}].${field}: missing or empty`);
+          }
+        }
+      });
+    }
+  }
+}
+
 function validateStage(stage: SubmitStage, obj: Record<string, unknown>): string[] {
   const spec = SPECS[stage];
   const errors: string[] = [];
@@ -334,10 +461,78 @@ function validateStage(stage: SubmitStage, obj: Record<string, unknown>): string
     }
   }
 
-  // Chain items have their own inner contract (≥2 steps, severity enum).
+  if (stage === "trace") {
+    requireStringArray(errors, "call_chain", obj.call_chain, 1);
+    if (Array.isArray(obj.defenses_checked)) {
+      obj.defenses_checked.forEach((item, i) => {
+        const defense = asObject(item);
+        if (!defense) {
+          errors.push(`defenses_checked[${i}]: not an object`);
+          return;
+        }
+        if (!isNonEmptyString(defense.defense))
+          errors.push(`defenses_checked[${i}].defense: missing or empty`);
+        if (!isNonEmptyString(defense.location))
+          errors.push(`defenses_checked[${i}].location: missing or empty`);
+        if (
+          !isNonEmptyString(defense.verdict) ||
+          !["bypassed", "blocked", "not-present"].includes(defense.verdict)
+        ) {
+          errors.push(`defenses_checked[${i}].verdict: must be bypassed, blocked, or not-present`);
+        }
+      });
+    }
+  }
+
+  if (stage === "skeptic") {
+    requireStringArray(errors, "evidence_reviewed", obj.evidence_reviewed, 1);
+    if (obj.verdict === "DISPROVEN" && isNonEmptyString(obj.disproval_reason)) {
+      const allowed = [
+        "unreachable",
+        "framework_protection",
+        "input_validation_blocks",
+        "requires_privilege_attacker_lacks",
+        "intended_behavior",
+        "overstated_impact",
+        "duplicate",
+        "test_artifact",
+        "out_of_scope",
+      ];
+      if (!allowed.includes(obj.disproval_reason)) errors.push("disproval_reason: invalid value");
+    }
+  }
+
+  if (stage === "validate") {
+    if (obj.status === "killed" && isNonEmptyString(obj.kill_reason)) {
+      const allowed = [
+        "unreachable",
+        "framework_protection",
+        "input_validation_blocks",
+        "requires_privilege_attacker_lacks",
+        "poc_failed_3x",
+        "no_real_impact",
+        "intended_behavior",
+        "duplicate",
+      ];
+      if (!allowed.includes(obj.kill_reason)) errors.push("kill_reason: invalid value");
+    }
+    if (
+      obj.refinement_attempts !== undefined &&
+      (!Number.isInteger(obj.refinement_attempts) ||
+        (obj.refinement_attempts as number) < 1 ||
+        (obj.refinement_attempts as number) > 3)
+    ) {
+      errors.push("refinement_attempts: must be an integer from 1 to 3");
+    }
+  }
+
   if (stage === "chain" && Array.isArray(obj.chains)) {
     obj.chains.forEach((c, i) => {
-      const chain = c as Record<string, unknown>;
+      const chain = asObject(c);
+      if (!chain) {
+        errors.push(`chains[${i}]: not an object`);
+        return;
+      }
       if (!isNonEmptyString(chain.title)) errors.push(`chains[${i}].title: missing or empty`);
       if (
         !isNonEmptyString(chain.severity) ||
@@ -345,14 +540,17 @@ function validateStage(stage: SubmitStage, obj: Record<string, unknown>): string
       ) {
         errors.push(`chains[${i}].severity: must be one of { ${CHAIN_SEVERITIES.join(" | ")} }`);
       }
-      if (!Array.isArray(chain.steps) || chain.steps.length < 2) {
-        errors.push(`chains[${i}].steps: needs at least 2 case IDs`);
+      requireStringArray(errors, `chains[${i}].steps`, chain.steps, 2);
+      if (chain.blocked_by_controls !== undefined) {
+        requireStringArray(errors, `chains[${i}].blocked_by_controls`, chain.blocked_by_controls);
       }
       if (!isNonEmptyString(chain.narrative))
         errors.push(`chains[${i}].narrative: missing or empty`);
     });
   }
 
+  if (stage === "report") validateReport(errors, obj);
+
   return errors;
 }
 

package/src/poc-runner.ts

@@ -34,6 +34,12 @@ export type PocRun = {
   rawOutput?: string;
   /** True when `output` was truncated for display (rawOutput has more). */
   truncated?: boolean;
+  /** True iff child output capture was complete. False on maxBuffer/timeouts/spawn failures. */
+  outputComplete?: boolean;
+  /** Harness mode used for this run. */
+  mode?: string;
+  /** Harness target used for this run. */
+  target?: string;
   /**
    * True when the run never started because of harness infrastructure
    * failure (e.g. sandbox image pull failed) — set only by the runner,
@@ -106,8 +112,6 @@ const EXTENSION_MAP: Record<string, string> = {
 };
 
 const OUTPUT_MAX_CHARS = 4000;
-/** Sanitized output is kept whole (for marker checks) up to this size. */
-const RAW_OUTPUT_MAX_CHARS = 4 * 1024 * 1024;
 const TIMEOUT_MS = 30_000;
 /** Completion sentinel echoed after the PoC command inside the sandbox shell. */
 function makeSentinel(): string {
@@ -278,9 +282,16 @@ function sanitizeOutput(output: string): string {
 
 /** Split sanitized output into the raw (whole) and display (sliced) halves. */
 function splitOutput(raw: string): { rawOutput: string; output: string; truncated: boolean } {
-  const rawOutput = raw.slice(0, RAW_OUTPUT_MAX_CHARS);
   const truncated = raw.length > OUTPUT_MAX_CHARS;
-  return { rawOutput, output: raw.slice(0, OUTPUT_MAX_CHARS), truncated };
+  return { rawOutput: raw, output: raw.slice(0, OUTPUT_MAX_CHARS), truncated };
+}
+
+function runProvenance(env?: Record<string, string>): Pick<PocRun, "mode" | "target"> {
+  return { mode: env?.PI_POC_MODE, target: env?.PI_POC_TARGET };
+}
+
+function outputWasComplete(result: { error?: Error; signal: string | null }): boolean {
+  return !result.error && result.signal === null;
 }
 
 /** Reject control characters in harness-supplied PoC env values. */
@@ -427,6 +438,8 @@ function runSandboxed(
         sandbox: true,
         completed: false,
         infraError: true,
+        outputComplete: false,
+        ...runProvenance(env),
       };
     }
     copyFileSync(pocPath, `${workspaceDir}/${sourceName}`);
@@ -463,6 +476,8 @@ function runSandboxed(
       ranAt,
       sandbox: true,
       completed,
+      outputComplete: outputWasComplete(result),
+      ...runProvenance(env),
     };
   } finally {
     // Best-effort: remove any container still running after a timeout/kill.
@@ -521,6 +536,8 @@ function runLocal(pocPath: string, language: PocLanguage, env?: Record<string, s
     ranAt,
     sandbox: false,
     completed,
+    outputComplete: outputWasComplete(result),
+    ...runProvenance(env),
   };
 }
 

package/src/scratchpad.ts

@@ -24,7 +24,16 @@
  * `--fresh` clears it via scratchpad_clear().
  */
 
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { dirname, join, resolve } from "node:path";
 
 // ── Types ────────────────────────────────────────────────────────────
@@ -152,9 +161,21 @@ function sanitizeName(name: string, label: string): string {
   return safe;
 }
 
+function runDirName(runId: string): string {
+  const safe = sanitizeName(runId, "run_id");
+  if (safe === runId) return safe;
+  const suffix = createHash("sha256").update(runId).digest("hex").slice(0, 12);
+  return `${safe.slice(0, 80)}-${suffix}`;
+}
+
+/** Pre-hash-suffix naming used by older scratchpad versions (sanitize only). */
+function legacyRunDirName(runId: string): string {
+  return sanitizeName(runId, "run_id");
+}
+
 /** The directory for a specific run. */
 export function getRunDir(runId: string, projectRoot?: string): string {
-  return join(getScratchpadRoot(projectRoot), sanitizeName(runId, "run_id"));
+  return join(getScratchpadRoot(projectRoot), runDirName(runId));
 }
 
 /** The state.json path for a run. */
@@ -187,23 +208,42 @@ function ensureRunDirs(runDir: string): void {
 function readCheckpointRaw(runId: string, projectRoot?: string): ScratchpadCheckpoint | null {
   const statePath = getStatePath(runId, projectRoot);
   if (!existsSync(statePath)) return null;
-  try {
-    const raw = readFileSync(statePath, "utf8");
-    const cp = JSON.parse(raw) as ScratchpadCheckpoint;
-    // Backfill maps for phases not yet checkpointed (defensive).
-    if (!cp.phase_ids) cp.phase_ids = {} as Record<ScratchpadPhase, string[]>;
-    if (!cp.phase_summaries) cp.phase_summaries = {} as Record<ScratchpadPhase, string>;
-    return cp;
-  } catch {
-    return null;
+  const raw = readFileSync(statePath, "utf8");
+  const cp = JSON.parse(raw) as ScratchpadCheckpoint;
+  if (typeof cp !== "object" || cp === null || Array.isArray(cp)) {
+    throw new Error(`Corrupt scratchpad state for ${runId}: root must be an object`);
+  }
+  if (cp.run_id !== runId) {
+    throw new Error(`Corrupt scratchpad state for ${runId}: state belongs to ${cp.run_id}`);
+  }
+  if (!Array.isArray(cp.completed_phases)) {
+    throw new Error(`Corrupt scratchpad state for ${runId}: completed_phases must be an array`);
+  }
+  for (const phase of cp.completed_phases) {
+    if (!PHASE_ORDER.includes(phase)) {
+      throw new Error(`Corrupt scratchpad state for ${runId}: invalid phase ${phase}`);
+    }
+  }
+  if (!cp.phase_ids || typeof cp.phase_ids !== "object" || Array.isArray(cp.phase_ids)) {
+    cp.phase_ids = {} as Record<ScratchpadPhase, string[]>;
   }
+  if (
+    !cp.phase_summaries ||
+    typeof cp.phase_summaries !== "object" ||
+    Array.isArray(cp.phase_summaries)
+  ) {
+    cp.phase_summaries = {} as Record<ScratchpadPhase, string>;
+  }
+  return cp;
 }
 
 function writeCheckpointRaw(cp: ScratchpadCheckpoint, projectRoot?: string): void {
   cp.last_updated = new Date().toISOString();
   const statePath = getStatePath(cp.run_id, projectRoot);
   ensureRunDirs(getRunDir(cp.run_id, projectRoot));
-  writeFileSync(statePath, JSON.stringify(cp, null, 2), "utf8");
+  const tmp = `${statePath}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(tmp, JSON.stringify(cp, null, 2), "utf8");
+  renameSync(tmp, statePath);
 }
 
 // ── Public API ───────────────────────────────────────────────────────
@@ -268,6 +308,32 @@ export function scratchpad_read(
 /**
  * List all artifacts written for a phase.
  */
+export function scratchpad_runs(projectRoot?: string): string[] {
+  const root = getScratchpadRoot(projectRoot);
+  if (!existsSync(root)) return [];
+  const out: string[] = [];
+  for (const entry of readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const state = join(root, entry.name, "state.json");
+    if (!existsSync(state)) continue;
+    try {
+      const cp = JSON.parse(readFileSync(state, "utf8")) as { run_id?: unknown };
+      if (typeof cp.run_id !== "string") continue;
+      if (getRunDir(cp.run_id, projectRoot) === join(root, entry.name)) {
+        out.push(cp.run_id);
+      } else if (join(root, legacyRunDirName(cp.run_id)) === join(root, entry.name)) {
+        // Runs created before the hash-suffix naming used sanitizeName(runId)
+        // as the directory; keep surfacing them in bundle discovery. Safe ids
+        // were never suffixed, so only legacy unsafe ids can land here.
+        out.push(cp.run_id);
+      }
+    } catch {
+      // Corrupt runs are ignored during report bundle discovery; direct resume still fails closed.
+    }
+  }
+  return out;
+}
+
 export function scratchpad_list(
   runId: string,
   phase: ScratchpadPhase,

package/src/workflow.ts

@@ -38,15 +38,15 @@ Think like a real external attacker, not a code reviewer. Technical bugs are che
 
 **Web lookup (research):** web_search, web_fetch, exploit_search, context7, deepwiki, http_request
 
-**Subagent dispatch:** \`subagent({agent: "auditor"|"tracer"|"skeptic"|"exploit"|"chain"|"reporter", task: "..."})\` — dispatch specialists; do NOT do the specialist work yourself.
+**Subagent dispatch:** every launch uses \`subagent({ workflowScript: "return runs.run('stable-key', { agent: 'tracer', task: '...' })", context: 'fresh', async: true })\`. Parallel HUNT uses one workflowScript with \`return runs.all([{ key: 'run-class-attempt', agent: 'auditor', task: '...' }, ...])\`. Stable keys include run, stage, class/case, and attempt. Dispatch specialists; do NOT do their work yourself.
 
 ## Stage Machine (run in order — you are the coordinator)
 
 RECON (you, inline) → **HUNT** (auditor subagents, one per attack class, parallel) → TRACE (tracer) → SKEPTIC (high-confidence only) → VALIDATE (exploit) → CHAIN (chain) → REPORT (reporter)
 
-**HARD GATE — after RECON:** record the entry-point inventory, then STOP all inline reading/probing. Your very next tool call MUST be \`subagent({ tasks: [...] })\` dispatching HUNT auditors. If you catch yourself mapping a sink, reading a handler, or probing an endpoint beyond the recon inventory — that is HUNT work; stop, note it as a hunt task, and dispatch. Recon that bleeds into hunting is a pipeline violation, not progress.
+**HARD GATE — after RECON:** record the entry-point inventory, then STOP all inline reading/probing. Your next tool call MUST launch one async workflowScript whose \`runs.all([...])\` dispatches HUNT auditors. When its completion is delivered, submit each output through PipelineSubmit. If you catch yourself mapping a sink, reading a handler, or probing an endpoint beyond the recon inventory, stop and add it to a HUNT task.
 
-**Subagent crash handling:** a subagent that dies (SIGABRT, OOM, timeout) is a RETRY, not a verdict — re-dispatch the same task once with a stronger model (\`subagent({agent, model, task})\`); repetition-loop runs are a known failure mode on cheap models. Crash again → record \`blocked: <agent> crashed\` in the pipeline-run case and continue; never silently drop the stage.
+**Subagent crash handling:** a crash (SIGABRT, OOM, timeout) is a RETRY, not a verdict. Launch one new workflowScript with the same specialist task, a new stable attempt key, and a stronger model. Crash again → record \`blocked: <agent> crashed\` in the pipeline-run case and continue; never silently drop the stage.
 
 ## Case Lifecycle (State Machine)
 ${LIFECYCLE_DIAGRAM}
@@ -66,7 +66,7 @@ ${LIFECYCLE_DIAGRAM}
 | Advance To | Required Case Fields | On Disk |
 |-----------|---------------------|---------|
 | HYPOTHESIS → INVESTIGATING | evidence (observations), confidence | Notes on what was observed |
-| INVESTIGATING → **CONFIRMED** | evidence, poc, **impact** (content below), severity, **target**, **disconfirmation** (your documented disprove attempt) | PoC script, exit 0, **verification_marker in output** (proves the exploit ran, not just the script). Optional disconfirmation script exit non-0. |
+| INVESTIGATING → **CONFIRMED** | evidence, poc, **impact** (content below), severity, **target**, **disconfirmation** (your documented disprove attempt) | PoC script exit 0 with verification_marker; same-script control at a distinct control_target completes with liveness but no vuln marker; disconfirmation script completed and exited non-0. |
 | Any → KILLED | assumptions (why it died) | — |
 | CONFIRMED → REPORTED | CaseContext(id) succeeded (records report path) AND the reporter agent wrote the report file | Context bundle + report file |
 
@@ -120,7 +120,7 @@ If you cannot name a concrete attacker who gains something they should not have
 
 The finding must survive an attempt to disprove it. Two tiers, gated on \`confidence\` (severity comes later, from the PoC):
 
-**\`confidence: high\` → skeptic subagent (MANDATORY):** dispatch \`subagent({agent: "skeptic", task: "..."})\` BEFORE the exploit agent. It independently re-reads the source (or re-probes live), verifies scope, and tries to disprove. Its \`disconfirmation_attempt\` becomes the case's \`disconfirmation\` — stronger than self-disconfirmation. DISPROVEN → killed directly, no tie-breaker. Do NOT skip; do NOT self-disconfirm high-confidence findings.
+**\`confidence: high\` → skeptic subagent (MANDATORY):** dispatch it BEFORE the exploit agent with \`subagent({ workflowScript: "return runs.run('skeptic-<case>-1', { agent: 'skeptic', task: '...' })", context: 'fresh', async: true })\`. It independently re-reads the source (or re-probes live), verifies scope, and tries to disprove. Its \`disconfirmation_attempt\` becomes the case's \`disconfirmation\` — stronger than self-disconfirmation. DISPROVEN → killed directly, no tie-breaker. Do NOT skip; do NOT self-disconfirm high-confidence findings.
 
 **Below high → self-disconfirmation:** actively try to disprove your own finding; document it. Not a formality.
 
@@ -133,7 +133,7 @@ If the disconfirmation script (\`disconfirmation_path\`) exits 0, promotion is b
 
 **Evidence chain closure (before PromoteFinding):** promotion is rejected unless the case carries an **artifact-backed** \`observation\` evidence item (EvidenceAdd role=observation with \`artifact_path\` — the initial signal, stored with its SHA-256) in addition to the auto-recorded reproduction item. Record observations as you go, not at promote time.
 
-**Control-target check (anti-cheat, REQUIRED for EVERY promotion — sandboxed and live alike):** write \`control_path\` — the SAME script as the PoC (the harness enforces sha256 equality; a separately written control file is rejected — the same actor writes both files, so only one parameterized script counts). The script reads the target from the \`PI_POC_TARGET\` env var and branches on \`PI_POC_MODE\` (\`poc\` | \`control\` | \`disconfirmation\`) — the control run is literally the same script in control mode against a control lacking the vulnerability (patched replica, second account, baseline endpoint, WAF-blocked path). The harness blocks promotion if the verification_marker appears in the control output (checked on the UNTRUNCATED output — a script printing its marker past the 4000-char display window is caught). That is what proves the marker is target-dependent, not an unconditional print. Also pass \`control_liveness_marker\`: a unique string the control prints ONLY AFTER reaching/exercising the control target (e.g. \`CONTROL_REACHED_<case-id>\`); the harness blocks promotion if the control output lacks it — a control pointed at an unreachable host, wrong port, or exiting before the check is NOT a clean verdict. If the PoC cannot be pointed at a control (no replica exists), say so in \`disconfirmation\` and downgrade confidence accordingly — do not skip the check. **Local/live findings:** \`local:true\` runs in the Docker sandbox with \`--network host\` (still read-only FS, dropped capabilities, unprivileged user). True host execution is NOT agent-selectable: it requires the operator to set \`PI_POC_ALLOW_LOCAL=1\`, and is only a fallback when Docker is unavailable.
+**Differential control check (REQUIRED for EVERY promotion):** pass \`control_path\` (the SAME bytes as the PoC), a distinct \`control_target\`, and \`control_liveness_marker\`. The harness runs the same script with \`PI_POC_MODE=poc\` and the case target, then \`PI_POC_MODE=control\` and \`control_target\`. Control must complete, print liveness after reaching the baseline, and omit the vulnerability marker. Checks use complete captured output; crashed or truncated output blocks promotion. **Local/live findings:** \`local:true\` uses the host-network Docker sandbox. Bare host execution still needs operator \`PI_POC_ALLOW_LOCAL=1\`.
 
 **PoC audit (anti-cheat, before PromoteFinding):** have an independent eye on the PoC script itself. For \`confidence: high\` findings the skeptic agent re-reads the PoC file (not just the source) hunting for: unconditional marker prints, trivially-true checks (accepting any 200, grepping for always-present strings), hardcoded expected values, and local mocks of the target. Record the audit result as an EvidenceAdd \`observation\` item (or \`refutation\` if it found a cheat → kill). The model that writes the check must not be the only one that reads it. The deterministic backstops are code, not prompts: the control run (mandatory, marker-absence + liveness-presence checks) and, for high/critical, the executed disconfirmation run.
 
@@ -210,7 +210,7 @@ Reproduce at least twice or via two methods.
 ## At REPORT
 
 1. **Run CaseContext(case_id)** — writes the context bundle (complete record, PoC + disconfirmation logs, links, pipeline artifacts) and records the report path.
-2. **Dispatch the reporter subagent**: \`subagent({agent: "reporter", task: "Write the final report for case <id>. case_id=<id>, context_path=<path from CaseContext>, report_path=<path from CaseContext>, program_name=<program if known>. Apply the fixed report format rules in your prompt (title convention, body template, tone rules). Output: the report file written to report_path + CaseUpdate(status: 'reported')."})\`. It writes the polished report and flips the case to REPORTED.
+2. **Dispatch the reporter subagent** with \`subagent({ workflowScript: "return runs.run('report-<case>-1', { agent: 'reporter', task: 'Write the final report. case_id=<id>, context_path=<context path>, report_path=<report path>, program_name=<if known>.' })", context: 'fresh', async: true })\`. It writes the polished report and flips the case to REPORTED.
 3. **Report-readiness gate** (YOU check this on the reporter's output before accepting; on failure, re-dispatch with the gap list):
 - Deterministic reproduction by another researcher
 - Steps realistic in production
@@ -277,7 +277,7 @@ Write the final report as a self-contained markdown file at the report path Case
 - **No finding is confirmed until its target is verified in scope** per the program's scope instruction. Out-of-scope findings are killed, not confirmed.
 - **No finding is validated without a reachability trace** showing REACHABLE.
 - **High-confidence findings: do your own adversarial disconfirmation.** No skeptic subagent in lite mode — actively try to disprove your own finding and document the attempt in \`disconfirmation\`. Failing to disprove is the expected outcome.
-- **Confirmed requires** evidence + poc + impact + severity + target + disconfirmation, and a PoC that exited 0 **with the verification_marker in the output**. **Every promotion also requires control_path + control_liveness_marker**: the same PoC run against a control lacking the vuln must NOT print the marker AND must print the liveness marker (harness-side checks) — this is what stops unconditional-marker, mock-target, and dead-control cheats. \`local:true\` uses a host-network sandbox; host execution needs the operator's \`PI_POC_ALLOW_LOCAL=1\`. No mocks for the exploitation step.
+- **Confirmed requires** evidence + poc + impact + severity + target + disconfirmation. Every promotion also requires \`disconfirmation_path\`, same-script \`control_path\`, a distinct \`control_target\`, and \`control_liveness_marker\`. The PoC must print the verification marker; the completed control must print liveness and omit it. \`local:true\` uses a host-network sandbox; bare host execution needs operator \`PI_POC_ALLOW_LOCAL=1\`. No mocks.
 - **Severity is derived from proven PoC impact, not theory.** Under-claiming is safe; over-claiming gets the finding rejected at triage.
 - **Evidence-first:** every claim must be traceable to observed/reproduced behavior, source code, or documented platform behavior.
 - **Design & runtime check (mandatory before CONFIRMED):** actively search the target's docs, git history, changelog, and runtime/framework docs for evidence the behavior is BY DESIGN or already FIXED IN THE RUNTIME. Found it → KILL (\`intended_behavior\` / \`framework_protection\`), unless the documented intent is itself the flaw with real attacker impact. Not found → document the search in \`disconfirmation\` as non-intentionality proof.