@xaccefy/pi-casefile 0.8.2 → 0.9.0

package/src/index.ts

@@ -11,11 +11,17 @@ import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { matchesKey, Text, truncateToWidth } from "@earendil-works/pi-tui";
-import { Type } from "@sinclair/typebox";
-
+import { Type } from "typebox";
+import {
+  CONFIRM_DIFFERENTIAL_VALUES,
+  CONFIRM_VERDICT_VALUES,
+  type ConfirmerVerdict,
+  SEVERITY_MATCH_VALUES,
+} from "./evidence.ts";
 import {
   addCaseResult,
   addEvidenceItemResult,
+  applyConfirmationResult,
   assertPromotable,
   type CaseConfidence,
   type CaseInput,
@@ -41,8 +47,9 @@ import {
   getCasefilePath,
   LINK_KIND_VALUES,
   linkCasesResult,
+  type PendingConfirmation,
+  type PocEvidenceRun,
   PRIORITY_VALUES,
-  promoteFindingResult,
   readActiveCases,
   readCasefile,
   recordCoverageResult,
@@ -50,6 +57,7 @@ import {
   SEVERITY_VALUES,
   STATUS_VALUES,
   searchCases,
+  storePendingConfirmation,
   suggestChains,
   unlinkCasesResult,
   updateCaseResult,
@@ -58,6 +66,7 @@ import {
 import { pipeline_submit, SUBMIT_STAGES, type SubmitStage } from "./pipeline-submit.ts";
 import { type PocRun, type PocRunOptions, runPoc } from "./poc-runner.ts";
 import {
+  detectWorkspaceRoot,
   PHASE_ORDER,
   type ScratchpadPhase,
   type ScratchpadResume,
@@ -68,8 +77,13 @@ import {
   scratchpad_read,
   scratchpad_resume,
   scratchpad_write,
+  setScratchpadRoot,
 } from "./scratchpad.ts";
-import { STATIC_CYBER_WORKFLOW, STATIC_CYBER_WORKFLOW_LITE } from "./workflow.ts";
+import {
+  STATIC_CYBER_WORKFLOW,
+  STATIC_CYBER_WORKFLOW_LITE,
+  STATIC_CYBER_WORKFLOW_OMP,
+} from "./workflow.ts";
 
 // ── Schemas ───────────────────────────────────────────────────────────
 
@@ -109,6 +123,11 @@ const CommonFields = {
         "Falsification conditions — what would disprove this hypothesis (REQUIRED on CaseAdd)",
     }),
   ),
+  disconfirmation: Type.Optional(
+    Type.String({
+      description: "Documented attempt to disprove the finding before confirmation",
+    }),
+  ),
 };
 
 // ── Tool: CaseAdd ─────────────────────────────────────────────────────
@@ -156,7 +175,14 @@ const EvidenceAddSchema = Type.Object(
   { additionalProperties: false },
 );
 
-// ── Tool: PromoteFinding ─────────────────────────────────────────────
+// ── Tool: PromoteFinding (phase 1) / ConfirmFinding (phase 2) ──────────
+//
+// Confirmation is TWO-PHASE because tools cannot dispatch subagents: the
+// coordinator runs PromoteFinding (harness runs the PoC 2x + control,
+// validates nonce-bound evidence.json, records the bundle), dispatches the
+// confirmer subagent (fresh context, re-executes the verify request), then
+// commits the verdict via ConfirmFinding. Exit codes and markers are
+// diagnostics — the gate is evidence + verdict.
 
 const PromoteSchema = Type.Object(
   {
@@ -164,25 +190,14 @@ const PromoteSchema = Type.Object(
     poc_path: Type.String({
       description: "Absolute path to the PoC script on disk",
     }),
-    verification_marker: Type.String({
-      minLength: 1,
-      description:
-        "Unique string the PoC must print AFTER verifying the exploit worked (data extracted, callback received, payload reflected). The gate checks output contains this marker — exit code 0 alone is NOT sufficient; the marker prevents fluke exit 0 and mocked PoCs. Example: 'VULN_CONFIRMED_<case-id>'. Never print it unconditionally or before the exploit check.",
-    }),
-    disconfirmation_path: Type.Optional(
-      Type.String({
-        description:
-          "Absolute path to a disconfirmation script that tries to disprove the finding; must exit non-zero (failure to disprove). REQUIRED for severity high/critical findings.",
-      }),
-    ),
     control_path: Type.String({
       description:
-        "REQUIRED for EVERY promotion (sandboxed and live alike): absolute path to a control-target script that runs the SAME PoC against a control that lacks the vulnerability (patched replica, second account, baseline endpoint). The harness blocks promotion if the verification_marker appears in the control output — an unconditional-marker/mock PoC cannot pass. Best form: the same parameterized script, branching on the PI_POC_MODE env var (poc | control) the harness sets on every run.",
+        "REQUIRED: absolute path to the SAME script as poc_path (sha256-equality is ENFORCED). The harness runs it with PI_POC_MODE=control and PI_POC_TARGET=control_target.",
     }),
-    control_liveness_marker: Type.String({
+    control_target: Type.String({
       minLength: 1,
       description:
-        "REQUIRED for EVERY promotion: a unique string the control script must print AFTER successfully reaching/exercising the control target (e.g. 'CONTROL_REACHED_<case-id>'). The harness blocks promotion if the control output lacks it — a control that never reached its target (unreachable host, wrong port, early exit) is not a clean verdict. Must differ from verification_marker.",
+        "REQUIRED: a distinct baseline target that lacks the vulnerability (patched replica, second account, baseline endpoint).",
     }),
     local: Type.Optional(
       Type.Boolean({
@@ -194,6 +209,51 @@ const PromoteSchema = Type.Object(
   { additionalProperties: false },
 );
 
+const ConfirmSchema = Type.Object(
+  {
+    id: Type.String({ description: "Case ID with a pending confirmation" }),
+    verdict: Type.Object(
+      {
+        verdict: Type.String({ enum: [...CONFIRM_VERDICT_VALUES] }),
+        reasoning: Type.String({
+          description: "Why the evidence does or does not demonstrate the claim",
+        }),
+        evidence_reviewed: Type.Array(Type.String(), {
+          description: "Files/evidence the confirmer actually reviewed",
+        }),
+        re_executed: Type.Boolean({
+          description:
+            "True iff the confirmer re-sent the verify request itself. Mandatory for CONFIRMED.",
+        }),
+        re_execution_note: Type.Optional(
+          Type.String({ description: "What the confirmer observed when re-executing" }),
+        ),
+        differential: Type.String({
+          enum: [...CONFIRM_DIFFERENTIAL_VALUES],
+          description: "Target vs control evidence comparison. CONFIRMED requires target_only.",
+        }),
+        severity_match: Type.Optional(
+          Type.String({
+            enum: [...SEVERITY_MATCH_VALUES],
+            description: "Claimed severity vs what the evidence shows",
+          }),
+        ),
+        disconfirmation_attempt: Type.Optional(
+          Type.String({
+            description:
+              "The confirmer's own failed attempt to disprove — becomes the case's disconfirmation",
+          }),
+        ),
+        model: Type.Optional(
+          Type.String({ description: "Which model judged (recorded for the accuracy ledger)" }),
+        ),
+      },
+      { additionalProperties: false },
+    ),
+  },
+  { additionalProperties: false },
+);
+
 // ── Tool: CaseGet ─────────────────────────────────────────────────────
 
 /** id-only schema, shared by CaseGet / CaseContext. */
@@ -596,6 +656,19 @@ function buildCaseListContext(records: CaseRecord[]): string {
   return lines.join("\n");
 }
 
+/**
+ * Detect the extension host. OMP is a fork of Pi: both load the same
+ * `pi`-manifest extensions, but subagent dispatch differs (pi-subagents'
+ * `subagent({workflowScript})` vs OMP's native `task`). The entry script path
+ * carries the host package: `@oh-my-pi/pi-coding-agent/dist/cli.js` under OMP,
+ * `@earendil-works/pi-coding-agent` under Pi.
+ */
+export function detectHost(): "omp" | "pi" {
+  const argv = process.argv.join(" ");
+  if (argv.includes("@oh-my-pi")) return "omp";
+  return "pi";
+}
+
 /**
  * Builds the per-prompt injection. The cyber workflow is session-scope data —
  * it never changes — so the caller passes includeWorkflow=true exactly once
@@ -603,7 +676,8 @@ function buildCaseListContext(records: CaseRecord[]): string {
  * case list DOES change as cases are added, so it is refreshed every prompt.
  *
  * mode selects the workflow text: "lite" injects the single-agent workflow
- * (no subagent dispatch), anything else gets the full subagent pipeline.
+ * (no subagent dispatch), anything else gets the full subagent pipeline,
+ * rendered for the host's dispatch convention (pi-subagents vs OMP task).
  */
 function buildAgentInjection(
   active: CaseRecord[],
@@ -612,7 +686,12 @@ function buildAgentInjection(
 ): string {
   const caseList = buildCaseListContext(active);
   if (!includeWorkflow) return caseList;
-  const workflow = mode === "lite" ? STATIC_CYBER_WORKFLOW_LITE : STATIC_CYBER_WORKFLOW;
+  const workflow =
+    mode === "lite"
+      ? STATIC_CYBER_WORKFLOW_LITE
+      : detectHost() === "omp"
+        ? STATIC_CYBER_WORKFLOW_OMP
+        : STATIC_CYBER_WORKFLOW;
   // Workflow FIRST for prominence, then case list as reference data.
   return caseList ? `${workflow}\n\n${caseList}` : workflow;
 }
@@ -673,6 +752,15 @@ export function parseXpModeArg(args: string, current: XpMode): XpMode {
 // ── Main extension ────────────────────────────────────────────────────
 
 export default function casefileExtension(pi: ExtensionAPI) {
+  // Pin the workspace root ONCE at extension load. Every scratchpad / pipeline
+  // / PoC-path lookup otherwise re-walks the ambient cwd on each call — a
+  // mid-session `cd` would split state across two .scratchpad roots and
+  // misroot the hunt file-existence filter. The PoC runner reads PI_POC_ROOT
+  // (set only when the operator hasn't pinned it explicitly).
+  const workspaceRoot = detectWorkspaceRoot();
+  setScratchpadRoot(workspaceRoot);
+  process.env.PI_POC_ROOT ??= workspaceRoot;
+
   // ── Diagnostic Error Handler Middleware ──
   const originalRegisterTool = pi.registerTool.bind(pi);
   pi.registerTool = (spec: any) => {
@@ -692,16 +780,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
         ) {
           hint = `\n\nHint: A database access error occurred on the casefile SQLite ledger.\nTo troubleshoot:\n  1. Check filesystem read/write permissions for the database path: ${getCasefilePath()}.\n  2. If using a locked folder, you can override the ledger location by setting:\n     export PI_CASEFILE_PATH=/your/writable/directory/casefile.db`;
         }
-        return {
-          content: [
-            {
-              type: "text" as const,
-              text: `${spec.name} failed: ${message}${hint}`,
-            },
-          ],
-          isError: true,
-          details: { error: message },
-        };
+        throw new Error(`${spec.name} failed: ${message}${hint}`, { cause: err });
       }
     };
     originalRegisterTool(spec);
@@ -888,13 +967,15 @@ export default function casefileExtension(pi: ExtensionAPI) {
         description:
           "The attack class tested (e.g. sql-injection, xss, idor, ssti, ssrf, auth-bypass, ...).",
       }),
-      scope: Type.Union(
-        COVERAGE_SCOPE_VALUES.map((s) => Type.Literal(s)),
-        {
-          description:
-            "'wide' if the verdict applies to the whole deployment/account/host (recorded ONCE, applies to every asset of the deployment — do NOT re-test it per asset); 'local' if specific to this one asset.",
-        },
-      ),
+      // Provider-safe string enum (per the header rule): Type.Union(Type.Literal)
+      // serializes to anyOf/const, which some providers drop — scope would
+      // arrive undefined and every explicit 'wide' verdict would silently
+      // persist as 'local', under-reporting tested classes.
+      scope: Type.String({
+        enum: [...COVERAGE_SCOPE_VALUES],
+        description:
+          "'wide' if the verdict applies to the whole deployment/account/host (recorded ONCE, applies to every asset of the deployment — do NOT re-test it per asset); 'local' if specific to this one asset.",
+      }),
       note: Type.String({
         description:
           "Short note of the tests ACTUALLY RUN and the verdict: techniques tried · result · key gap. A verdict guessed without testing can hide a real issue.",
@@ -1023,110 +1104,59 @@ export default function casefileExtension(pi: ExtensionAPI) {
   });
 
   // ── Tool: PromoteFinding ──
+  // ── Tool: PromoteFinding (phase 1) ──
 
   pi.registerTool({
     name: "PromoteFinding",
-    label: "Promote Finding",
+    label: "Run PoC Evidence",
     description:
-      "Run an on-disk PoC script (Docker sandbox or host-network sandbox) and, on exit 0 + verification marker present in output, promote an investigating case to confirmed. The verification_marker proves the exploit actually worked — exit code 0 alone is NOT sufficient. EVERY promotion (sandboxed and live alike) REQUIRES: (1) a disconfirmation_path script that must exit non-zero (the finding survived the attempt to disprove it); (2) a control_path that is the SAME script as the PoC (sha256-enforced — a separately written control file is rejected), run in control mode via PI_POC_MODE; (3) a control_liveness_marker the control must print after reaching its target. The harness blocks promotion if the vuln marker appears in the (untruncated) control output, if the liveness marker is absent, or if the control/disconfirmation scripts crash. Host execution is never agent-selectable — local:true uses a host-network Docker sandbox; true host runs need the operator's PI_POC_ALLOW_LOCAL=1.",
-    promptSnippet: "Run a PoC and promote an investigating case to confirmed",
+      "Phase 1 of confirmation: run the PoC twice against the case target plus once against control_target (same script, sha256-enforced), then validate the nonce-bound evidence.json each run writes to $PI_POC_EVIDENCE_DIR. Records a pending confirmation bundle (expires in 1h) and returns the confirmer dispatch instruction. Exit codes and markers are DIAGNOSTICS — the gate is evidence + confirmer verdict. After PromoteFinding: dispatch the confirmer subagent, then commit its verdict with ConfirmFinding. Host execution is never agent-selectable — local:true uses a host-network Docker sandbox; true host runs need PI_POC_ALLOW_LOCAL=1.",
+    promptSnippet: "Phase 1: run PoC evidence (target x2 + control) and record the pending bundle",
     promptGuidelines: [
       "Use PromoteFinding when an investigating case has a concrete PoC script on disk and you are ready to prove it.",
-      "Prerequisites: status='investigating' and non-empty poc, evidence, impact, severity, target, disconfirmation, plus an artifact-backed EvidenceAdd 'observation' item on the case (the initial signal, with artifact_path) — the PoC gate auto-records the reproduction item.",
+      "Prerequisites: status='investigating' and non-empty poc, evidence, impact, severity, target, plus an artifact-backed EvidenceAdd 'observation' item on the case (the initial signal, with artifact_path). The disconfirmation comes from the confirmer at confirm time.",
+      "The PoC MUST write evidence.json to $PI_POC_EVIDENCE_DIR: { nonce (echo $PI_POC_NONCE), claim, verify: { method, url, expect: { status/body_contains/body_regex } }, observations }. The harness validates it and binds it to the run — missing/invalid/misnonced evidence blocks promotion.",
+      "control_path (REQUIRED): the SAME script as poc_path (sha256-equality is ENFORCED). The harness runs it with PI_POC_MODE=control and PI_POC_TARGET=control_target. The control's evidence must DIFFER from the target's (not target-dependent → blocked).",
       "Default sandbox: docker run --rm --network none. Use local:true for network-dependent bugs (host-network sandbox; host execution needs operator PI_POC_ALLOW_LOCAL=1).",
-      "Gate: exit 0 AND verification_marker in the PoC output. The marker (e.g. 'VULN_CONFIRMED_<case-id>') must be printed only AFTER the exploit is verified (data extracted, callback received, payload reflected) — never unconditionally or before the exploit check. The marker check prevents fluke exit 0 (script crashed early) and mocked PoCs (target faked) from passing.",
-      "control_path (REQUIRED for EVERY promotion): the SAME script as poc_path (sha256-equality is ENFORCED — a separately written control file is rejected). One parameterized script — read the target from the PI_POC_TARGET env var and branch on PI_POC_MODE (poc | control) — the control run is literally the same script in control mode against a control lacking the vuln (patched replica, second account, baseline endpoint). The harness blocks promotion if the verification_marker appears in the control run's output (checked on the untruncated output) — an unconditional-marker PoC cannot pass this.",
-      "control_liveness_marker (REQUIRED): a unique string the control script prints only AFTER reaching/exercising the control target (e.g. 'CONTROL_REACHED_<case-id>'). The harness blocks promotion if the control output lacks it — a control pointed at an unreachable host, wrong port, or exiting before the check is NOT a clean verdict.",
-      "disconfirmation_path: a script that tries to disprove the finding; if it exits 0, promotion is blocked. REQUIRED for EVERY promotion — the prose disconfirmation field is not enough at any severity (a case filed low/medium must not skip the run and be re-raised afterwards).",
-      "Never CaseUpdate status='confirmed' directly — it is rejected. Always use PromoteFinding.",
+      "After the bundle is recorded, dispatch the confirmer subagent (agents/confirmer.md, fresh context, different model) and commit its verdict with ConfirmFinding. Never CaseUpdate status='confirmed' directly.",
     ],
     parameters: PromoteSchema,
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
-      // Validate promotability BEFORE running the PoC — a sandboxed run can take
-      // 30s (plus first-time image pull), so fail cheap when the case can't
-      // advance anyway (missing, wrong status, missing required fields, missing
-      // artifact-backed observation evidence).
+      // Validate promotability BEFORE running the PoC — each sandboxed run can
+      // take 30s (plus first-time image pull), so fail cheap when the case
+      // can't advance anyway (missing, wrong status, missing required fields,
+      // missing artifact-backed observation evidence).
       const caseId = params.id as string;
       const current = assertPromotable(caseId);
 
-      // Shared blocked-promotion shape: the case stays investigating and the
-      // caller gets the record back for context.
-      const fail = (text: string, extra?: Record<string, unknown>) => ({
-        content: [{ type: "text" as const, text }],
-        isError: true,
-        details: { record: getCaseById(caseId), ...extra },
-      });
-
-      // Reject empty/whitespace markers BEFORE any PoC run — it's a param
-      // error, so fail cheap instead of burning a (up to 30s) sandboxed run.
-      const marker = (params.verification_marker as string | undefined)?.trim();
-      if (!marker) {
-        return fail(
-          "verification_marker is empty or whitespace. " +
-            "A non-empty marker printed only AFTER the PoC confirms exploitation is required — " +
-            "exit code 0 alone is not sufficient. Case remains investigating.",
-        );
-      }
+      const fail = (text: string, _extra?: Record<string, unknown>): never => {
+        throw new Error(text);
+      };
 
-      // Control-target anti-cheat is mandatory for EVERY promotion — sandboxed
-      // and live alike. It is the only deterministic check that the marker is
-      // target-dependent; skipping it for the default sandboxed mode would let
-      // an unconditional-marker PoC pass untouched. Check BEFORE paying for the
-      // PoC run.
-      const controlPath = (params.control_path as string | undefined)?.trim();
+      const controlPath = (params.control_path as string | undefined)?.trim() ?? "";
+      const controlTarget = (params.control_target as string | undefined)?.trim() ?? "";
       if (!controlPath) {
         return fail(
-          "control_path is REQUIRED for every promotion (sandboxed and live alike): a script that runs " +
-            "the SAME PoC against a control lacking the vuln (patched replica, second account, baseline endpoint). " +
-            "The harness verifies the verification_marker is absent from the control run's output — that is what " +
-            "proves the marker is target-dependent. Write the control script and retry.",
+          "control_path is REQUIRED: the SAME script as poc_path (sha256-equality is ENFORCED), run by the harness with PI_POC_MODE=control and PI_POC_TARGET=control_target.",
           { missingControl: true },
         );
       }
-
-      // The control must ALSO prove it reached its target: without a liveness
-      // marker, a control pointed at an unreachable host / wrong port / early
-      // exit would show "marker absent" for reasons unrelated to the vuln.
-      const livenessMarker = (params.control_liveness_marker as string | undefined)?.trim();
-      if (!livenessMarker) {
-        return fail(
-          "control_liveness_marker is REQUIRED for every promotion: a unique string the control script " +
-            "prints ONLY AFTER reaching/exercising the control target (e.g. 'CONTROL_REACHED_<case-id>'). " +
-            "The harness blocks promotion if the control output lacks it — a control that never reached its " +
-            "target proves nothing. Must differ from verification_marker.",
-          { missingLivenessMarker: true },
-        );
-      }
-      if (livenessMarker === marker) {
+      if (!controlTarget) {
         return fail(
-          "control_liveness_marker must differ from verification_marker — the liveness marker proves the " +
-            "control reached its target, the verification marker proves the vuln fired. Use distinct strings.",
-          { livenessEqualsMarker: true },
+          "control_target is REQUIRED: a distinct baseline target that lacks the vulnerability.",
+          { missingControlTarget: true },
         );
       }
-
-      // EXECUTED disconfirmation is required for EVERY promotion — the prose
-      // `disconfirmation` field cannot carry the disprove-attempt. Making it
-      // unconditional (not severity-keyed) also kills the ordering attack:
-      // a case filed as low/medium could previously skip the run, promote,
-      // then be re-raised to high/critical with no executed disproof.
-      const disconfirmationPath = (params.disconfirmation_path as string | undefined)?.trim();
-      if (!disconfirmationPath) {
+      if (controlTarget === current.target) {
         return fail(
-          "disconfirmation_path is REQUIRED for every promotion: a script that tries to " +
-            "disprove the finding and must exit non-zero (the finding survived the attempt). " +
-            "The prose disconfirmation field is not enough. Write the disconfirmation script and retry.",
-          { missingDisconfirmation: true },
+          "control_target must differ from the case target; a control run against the vulnerable target proves nothing.",
+          { controlTargetEqualsCaseTarget: true },
         );
       }
 
-      // Same-file contract (anti-cheat): the control must be the SAME script as
-      // the PoC, differing only via the harness-set PI_POC_MODE env var. Two
-      // agent-written files (poc prints the marker unconditionally, control
-      // prints the liveness marker) pass every string check — the "same script"
-      // recommendation in the docs is now enforced: sha256(control) must equal
-      // sha256(poc). Hash BEFORE any run so a mismatch fails cheap.
+      // Same-file contract (anti-cheat): control must be the SAME bytes as the
+      // PoC, differing only via the harness-set env. Check BEFORE any run.
       const pocPath = (params.poc_path as string | undefined)?.trim() ?? "";
       let pocHash: string | undefined;
       let controlHash: string | undefined;
@@ -1141,146 +1171,185 @@ export default function casefileExtension(pi: ExtensionAPI) {
       }
       if (pocHash !== controlHash) {
         return fail(
-          "CONTROL CHECK FAILED: control_path must be the SAME script as poc_path " +
-            "(sha256 mismatch). The control run is only meaningful as the same PoC " +
-            "pointed at a control target via PI_POC_MODE=control — a separately written " +
-            "control file proves nothing (the model writes both files). Parameterize " +
-            "one script: branch on PI_POC_MODE (poc | control) and read the target from " +
-            "PI_POC_TARGET. Case remains investigating.",
-          { run: undefined, controlHashMismatch: true },
+          "CONTROL CHECK FAILED: control_path must be the SAME script as poc_path (sha256 mismatch). Case remains investigating.",
+          { controlHashMismatch: true },
         );
       }
 
-      // local:true now means "network access": with the operator's
-      // PI_POC_ALLOW_LOCAL=1 opt-in the run executes on the host; WITHOUT the
-      // opt-in it uses a Docker sandbox with --network host (same FS/cap/user
-      // isolation) and fails closed when Docker is unavailable too. Host
-      // execution is never agent-selectable on its own.
-      const runOptions = (pocMode: string): PocRunOptions => ({
+      const runOptions = (pocMode: string, target: string): PocRunOptions => ({
         network: params.local === true ? "host" : "none",
         local: params.local === true,
-        env: { PI_POC_MODE: pocMode, PI_POC_TARGET: current.target ?? "" },
+        env: { PI_POC_MODE: pocMode, PI_POC_TARGET: target },
       });
 
-      const run = runPoc(pocPath, runOptions("poc"));
-
-      // Fail closed without throwing: non-zero PoC must leave the case investigating.
-      if (run.exitCode !== 0) {
-        return fail(
-          `PoC failed (exit ${run.exitCode}). Case remains investigating.\nOutput:\n${run.output}`,
-          { run },
-        );
-      }
-
-      // Defense-in-depth: exit 0 implies the run completed (sandbox wrapper /
-      // local spawn semantics), but never trust a run the runner says crashed.
-      if (!run.completed) {
-        return fail(
-          `PoC did NOT complete (spawn error, killed, or timeout). Case remains investigating.\nOutput:\n${run.output}`,
-          { run, pocCrashed: true },
-        );
-      }
-
-      // Verification marker check: exit code 0 alone is NOT sufficient.
-      // The PoC must print the verification_marker, proving the exploit
-      // actually worked — not just that the script ran. The check runs on
-      // rawOutput (untruncated) so a script printing its marker past the
-      // 4000-char display window cannot hide it.
-      const pocOut = run.rawOutput ?? run.output;
-      if (!pocOut.includes(marker)) {
-        return fail(
-          `PoC exited 0 but the verification marker "${marker}" was NOT found in the output.\n` +
-            `This means the script ran but did not prove exploitation. The marker must be printed only AFTER the PoC verifies the exploit worked (data extracted, callback received, payload reflected, etc.).\n` +
-            `Do not print the marker unconditionally — print it only when the exploit is confirmed.\n\nOutput:\n${run.output}`,
-          { run, markerMissing: true },
-        );
-      }
+      const caseTarget = current.target ?? "";
+      // Determinism: TWO target runs + one control run. Exit codes are
+      // diagnostics; completion, evidence validity, determinism, and the
+      // differential are the gate.
+      const run1 = runPoc(pocPath, runOptions("poc", caseTarget));
+      const run2 = runPoc(pocPath, runOptions("poc", caseTarget));
+      const controlRun = runPoc(controlPath, runOptions("control", controlTarget));
 
-      // Run disconfirmation script — must exit NON-0 (finding survived the attempt to disprove).
-      let disconfirmationRun: PocRun | undefined;
-      if (disconfirmationPath) {
-        disconfirmationRun = runPoc(disconfirmationPath, runOptions("disconfirmation"));
-        if (!disconfirmationRun.completed) {
+      const evidenceRun = (r: PocRun, mode: "poc" | "control", target: string): PocEvidenceRun => {
+        if (!r.completed || !r.outputComplete) {
           return fail(
-            `Disconfirmation script did NOT complete (spawn error, killed, or timeout — no completion marker). ` +
-              `A crash is not a survived disproof: fix the disconfirmation script and retry.\n` +
-              `Output:\n${disconfirmationRun.output}`,
-            { run, disconfirmationRun, disconfirmationCrashed: true },
+            `${mode} run did not complete or output capture was incomplete` +
+              (r.infraError ? ` (infra: ${r.output.trim()})` : "") +
+              ". A crash is not evidence. Case remains investigating.",
+            { run: r, pocCrashed: true },
           );
         }
-        if (disconfirmationRun.exitCode === 0) {
+        if (r.evidenceError) {
           return fail(
-            `Disconfirmation script exited 0 (finding was disproven). ` +
-              `Case remains investigating.\nOutput:\n${disconfirmationRun.output}`,
-            { run, disconfirmationRun },
+            `EVIDENCE CONTRACT FAILED (${mode} run): ${r.evidenceError}. ` +
+              "The PoC must write evidence.json to $PI_POC_EVIDENCE_DIR — { nonce (echo $PI_POC_NONCE), claim, verify: { method, url, expect: { status / body_contains / body_regex } }, observations } — " +
+              "the file is bound to this run and validated by the harness. Case remains investigating.",
+            { run: r, evidenceError: r.evidenceError },
           );
         }
-      }
+        if (!r.evidence || !r.evidenceSha256 || !r.nonce) {
+          return fail(`${mode} run produced no evidence. Case remains investigating.`, { run: r });
+        }
+        return {
+          mode,
+          target,
+          nonce: r.nonce,
+          ranAt: r.ranAt,
+          exitCode: r.exitCode,
+          sandbox: r.sandbox,
+          completed: r.completed,
+          outputComplete: r.outputComplete,
+          output: r.output ?? "",
+          evidence: r.evidence,
+          evidenceSha256: r.evidenceSha256,
+          evidencePath: r.evidencePath,
+        };
+      };
 
-      // Control-target anti-cheat check: the same PoC pointed at a control that
-      // lacks the vuln must NOT print the marker. The control script is
-      // agent-written, but the marker-absence check is harness-side and
-      // deterministic — the model cannot pass it by asserting success. The
-      // liveness-marker check closes the "control pointed at an unreachable
-      // host / exited early" hole: the control must prove it reached its target.
-      const controlRun = runPoc(controlPath, runOptions("control"));
-      if (!controlRun.completed) {
-        return fail(
-          `CONTROL CHECK FAILED: the control-target script did NOT complete (spawn error, killed, or timeout). ` +
-            `A control run that never executed proves nothing about the marker — fix the control script and retry.\n` +
-            `Control output:\n${controlRun.output}`,
-          { run, controlRun, controlCrashed: true },
-        );
-      }
-      // Marker-absence + liveness checks run on the UNTRUNCATED control output.
-      const controlOut = controlRun.rawOutput ?? controlRun.output;
-      if (controlOut.includes(marker)) {
-        return fail(
-          `CONTROL CHECK FAILED: the verification marker "${marker}" appeared in the control-target run. ` +
-            `The PoC prints the marker without the vulnerable condition — a cheating PoC (unconditional marker) ` +
-            `or a broken check. Case remains investigating.\nControl output:\n${controlRun.output}`,
-          { run, controlRun, controlCheated: true },
-        );
-      }
-      if (!controlOut.includes(livenessMarker)) {
-        return fail(
-          `CONTROL CHECK FAILED: the control-target run completed but the control_liveness_marker "${livenessMarker}" ` +
-            `was NOT found in its output. The control must print the liveness marker only AFTER reaching/exercising ` +
-            `the control target — an unreachable host, wrong port, or early exit is not a valid control verdict. ` +
-            `Case remains investigating.\nControl output:\n${controlRun.output}`,
-          { run, controlRun, controlLivenessMissing: true },
-        );
-      }
+      const targetRuns: [PocEvidenceRun, PocEvidenceRun] = [
+        evidenceRun(run1, "poc", caseTarget),
+        evidenceRun(run2, "poc", caseTarget),
+      ];
+      const control = evidenceRun(controlRun, "control", controlTarget);
 
-      // PocRun is structurally a PocVerification — pass the runs straight through.
-      const result = promoteFindingResult(
+      const bundle: PendingConfirmation = {
         caseId,
-        run,
-        disconfirmationRun,
-        controlRun,
-        marker,
-        livenessMarker,
+        ranAt: new Date().toISOString(),
+        pocPath,
+        pocSha256: pocHash,
+        controlPath,
+        controlTarget,
+        targetRuns,
+        controlRun: control,
+      };
+
+      let record: CaseRecord;
+      try {
+        record = storePendingConfirmation(caseId, bundle);
+      } catch (e) {
+        return fail(`Pending confirmation rejected: ${(e as Error).message}`, {
+          storeRejected: true,
+        });
+      }
+
+      return {
+        content: [
+          {
+            type: "text",
+            text:
+              `Phase 1 complete — evidence bundle recorded on ${caseId} (expires in 1h).\n` +
+              `Target runs: 2, Control run: 1 — all with validated nonce-bound evidence.json.\n` +
+              `Evidence sha256: ${targetRuns[0].evidenceSha256}\n` +
+              `PoC script sha256 (at run time): ${pocHash}\n\n` +
+              (detectHost() === "omp"
+                ? `DISPATCH THE CONFIRMER now: task({ context: 'fresh', tasks: [{ name: 'confirm-${caseId}-1', agent: 'confirmer', task: 'Verify the PoC evidence for case ${caseId} (poc_path=${pocPath}, control_target=${controlTarget}, evidence_sha256=${targetRuns[0].evidenceSha256}, poc_sha256=${pocHash}). Assume fabricated, prove real. Re-send the verify request yourself. Return the verdict.' }] })\n`
+                : `DISPATCH THE CONFIRMER now: subagent({ workflowScript: "return runs.run('confirm-${caseId}-1', { agent: 'confirmer', task: 'Verify the PoC evidence for case ${caseId} (poc_path=${pocPath}, control_target=${controlTarget}, evidence_sha256=${targetRuns[0].evidenceSha256}, poc_sha256=${pocHash}). Assume fabricated, prove real. Re-send the verify request yourself. Return the verdict.' })", context: 'fresh', async: true })\n`) +
+              "Then commit the verdict with ConfirmFinding(case_id, verdict) — CONFIRMED promotes, NOT_CONFIRMED keeps investigating.",
+          },
+        ],
+        details: {
+          record,
+          bundle: {
+            caseId,
+            ranAt: bundle.ranAt,
+            pocPath,
+            controlPath,
+            controlTarget,
+            pocSha256: pocHash,
+            evidenceSha256: targetRuns[0].evidenceSha256,
+          },
+        },
+      };
+    },
+
+    renderCall(args, theme) {
+      return callLine(theme, "PromoteFinding", (args.id as string) ?? "");
+    },
+
+    renderResult(result, _opts, theme) {
+      const details = result.details as { bundle?: { evidenceSha256?: string } } | undefined;
+      if (!details?.bundle) {
+        return new Text(theme.fg("error", "✗ PromoteFinding failed"), 0, 0);
+      }
+      return new Text(
+        theme.fg("success", "✓ ") +
+          theme.fg("dim", "evidence bundle ") +
+          theme.fg("muted", details.bundle.evidenceSha256?.slice(0, 12) ?? ""),
+        0,
+        0,
       );
+    },
+  });
+
+  // ── Tool: ConfirmFinding (phase 2) ──
+
+  pi.registerTool({
+    name: "ConfirmFinding",
+    label: "Commit Confirmer Verdict",
+    description:
+      "Phase 2 of confirmation: commit (or refuse) a promotion on the confirmer subagent's verdict. CONFIRMED requires a target-only differential, re_executed: true (the confirmer re-sent the verify request itself), a disconfirmation_attempt (becomes the case's disconfirmation), and the pending bundle from PromoteFinding still valid (nonce-bound evidence, determinism, control differential, PoC script unchanged — checked again at the ledger). NOT_CONFIRMED records the verdict and keeps the case investigating — no tie-breaker.",
+    promptSnippet: "Commit the confirmer verdict — promote or keep investigating",
+    promptGuidelines: [
+      "Run after PromoteFinding + the confirmer dispatch. The verdict comes from the confirmer subagent output, not from the writer.",
+      "CONFIRMED requires differential: 'target_only', re_executed: true, and disconfirmation_attempt (the confirmer's own failed disproof). A verdict missing any of these is rejected.",
+      "NOT_CONFIRMED is final for that attempt — the case stays investigating with the reasoning recorded in assumptions. Re-dispatch a new confirmer if you want a second opinion; every attempt is recorded.",
+      "Never CaseUpdate status='confirmed' directly — it is rejected. Always use PromoteFinding + ConfirmFinding.",
+    ],
+    parameters: ConfirmSchema,
+
+    async execute(_id, params, _signal, _onUpdate, _ctx) {
+      const caseId = params.id as string;
+      const result = applyConfirmationResult(caseId, params.verdict as ConfirmerVerdict);
       const record = result.record;
+      const promoted = record.status === "confirmed";
       return {
         content: [
           {
             type: "text",
-            text: `PoC verified (exit ${run.exitCode}). Case promoted to confirmed:\n${formatCaseDetail(record)}`,
+            text: promoted
+              ? `Confirmer CONFIRMED. Case promoted:
+${formatCaseDetail(record)}`
+              : `Confirmer NOT_CONFIRMED — case stays investigating (attempt recorded):
+${formatCaseDetail(record)}`,
           },
         ],
-        details: { record, run },
+        details: { record, promoted, changed: result.changed },
       };
     },
 
     renderCall(args, theme) {
-      return callLine(theme, "PromoteFinding", (args.id as string) ?? "");
+      return callLine(theme, "ConfirmFinding", (args.id as string) ?? "");
     },
 
-    renderResult(result, _options, theme) {
-      const details = result.details as { run?: { exitCode: number } } | undefined;
-      const success = details?.run?.exitCode === 0;
-      return new Text(renderCaseResult(result, theme, success ? "✓ " : "✗ ", "✗ "), 0, 0);
+    renderResult(result, _opts, theme) {
+      const details = result.details as { promoted?: boolean } | undefined;
+      return new Text(
+        details?.promoted
+          ? theme.fg("success", "✓ Promoted")
+          : theme.fg("warning", "↷ Not confirmed"),
+        0,
+        0,
+      );
     },
   });
 
@@ -1660,9 +1729,9 @@ export default function casefileExtension(pi: ExtensionAPI) {
           : result.verdict === "repair"
             ? `REPAIR (attempt ${result.repair_attempt}/2) — fix these and re-submit:\n  - ${result.errors.join("\n  - ")}`
             : `REJECTED — ${result.errors.join("\n")}`;
+      if (result.verdict !== "accepted") throw new Error(statusLine);
       return {
         content: [{ type: "text", text: statusLine }],
-        isError: result.verdict !== "accepted",
         details: result as unknown as Record<string, unknown>,
       };
     },