@xaccefy/pi-casefile 0.8.3 → 0.9.1

package/src/index.ts

@@ -1,7 +1,7 @@
 /**
  * Casefile — offensive security case tracker for Pi.
  *
- * Tools: CaseAdd, CaseUpdate, PromoteFinding, EvidenceAdd, CoverageAdd, CoverageReport, ChainSuggest, CaseGet, CaseList, CaseSearch, CaseLink, CaseUnlink, CaseContext, PipelineSubmit, ScratchpadInit, ScratchpadResume, ScratchpadCheckpoint, ScratchpadWrite, ScratchpadRead, ScratchpadPhaseDone, ScratchpadClear
+ * Tools: CaseAdd, CaseUpdate, PromoteFinding, ConfirmFinding, EvidenceAdd, CoverageAdd, CoverageReport, ChainSuggest, CaseGet, CaseList, CaseSearch, CaseLink, CaseUnlink, CaseContext, PipelineSubmit, ScratchpadInit, ScratchpadResume, ScratchpadCheckpoint, ScratchpadWrite, ScratchpadRead, ScratchpadPhaseDone, ScratchpadClear
  * Command: /casefile — interactive dashboard
  * Event: before_agent_start — injects cyber workflow once per session, refreshes the active case list per prompt
  */
@@ -12,10 +12,22 @@ import { dirname, join } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { matchesKey, Text, truncateToWidth } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
-
+import {
+  CANARY_ASSESSMENT_VALUES,
+  CONFIRM_DIFFERENTIAL_VALUES,
+  CONFIRM_VERDICT_VALUES,
+  SEVERITY_MATCH_VALUES,
+  validateMainAgentVerdict,
+} from "./evidence.ts";
+import {
+  controlTargetAuthorizationError,
+  type HarnessVerifyResult,
+  replayDifferential,
+} from "./harness-verify.ts";
 import {
   addCaseResult,
   addEvidenceItemResult,
+  applyConfirmationResult,
   assertPromotable,
   type CaseConfidence,
   type CaseInput,
@@ -41,8 +53,10 @@ import {
   getCasefilePath,
   LINK_KIND_VALUES,
   linkCasesResult,
+  type MainAgentVerification,
+  type PendingConfirmation,
+  type PocEvidenceRun,
   PRIORITY_VALUES,
-  promoteFindingResult,
   readActiveCases,
   readCasefile,
   recordCoverageResult,
@@ -50,14 +64,15 @@ import {
   SEVERITY_VALUES,
   STATUS_VALUES,
   searchCases,
-  suggestChains,
+  storePendingConfirmation,
   unlinkCasesResult,
   updateCaseResult,
-  writeCaseContext,
 } from "./ledger.ts";
+import { suggestChainsAsync, writeCaseContextAsync } from "./ledger-worker.ts";
 import { pipeline_submit, SUBMIT_STAGES, type SubmitStage } from "./pipeline-submit.ts";
 import { type PocRun, type PocRunOptions, runPoc } from "./poc-runner.ts";
 import {
+  detectWorkspaceRoot,
   PHASE_ORDER,
   type ScratchpadPhase,
   type ScratchpadResume,
@@ -68,8 +83,13 @@ import {
   scratchpad_read,
   scratchpad_resume,
   scratchpad_write,
+  setScratchpadRoot,
 } from "./scratchpad.ts";
-import { STATIC_CYBER_WORKFLOW, STATIC_CYBER_WORKFLOW_LITE } from "./workflow.ts";
+import {
+  STATIC_CYBER_WORKFLOW,
+  STATIC_CYBER_WORKFLOW_LITE,
+  STATIC_CYBER_WORKFLOW_OMP,
+} from "./workflow.ts";
 
 // ── Schemas ───────────────────────────────────────────────────────────
 
@@ -153,15 +173,21 @@ const EvidenceAddSchema = Type.Object(
     artifact_path: Type.Optional(
       Type.String({
         description:
-          "Path to the artifact file on disk. Stored as basename + SHA-256 hash " +
-          "(full path is never persisted).",
+          "Path to a regular, non-symlink artifact inside the workspace. The bytes are copied durably and stored as basename + SHA-256 (full source path is never persisted).",
       }),
     ),
   },
   { additionalProperties: false },
 );
 
-// ── Tool: PromoteFinding ─────────────────────────────────────────────
+// ── Tool: PromoteFinding (phase 1) / ConfirmFinding (phase 2) ──────────
+//
+// Confirmation is TWO-PHASE: a worker may run PromoteFinding (the harness runs
+// the PoC 2x + control, validates nonce-bound evidence.json, and records the
+// bundle), but only the MAIN coordinator agent may review/re-execute and commit
+// a verdict via ConfirmFinding. Zero exit is necessary run integrity and
+// markers are diagnostic only; the machine records predicate/canary
+// differentials and the main agent owns the semantic vulnerability judgment.
 
 const PromoteSchema = Type.Object(
   {
@@ -169,39 +195,88 @@ const PromoteSchema = Type.Object(
     poc_path: Type.String({
       description: "Absolute path to the PoC script on disk",
     }),
-    verification_marker: Type.String({
-      minLength: 1,
-      description:
-        "Unique string the PoC must print AFTER verifying the exploit worked (data extracted, callback received, payload reflected). The gate checks output contains this marker — exit code 0 alone is NOT sufficient; the marker prevents fluke exit 0 and mocked PoCs. Example: 'VULN_CONFIRMED_<case-id>'. Never print it unconditionally or before the exploit check.",
-    }),
-    disconfirmation_path: Type.String({
-      description:
-        "REQUIRED for EVERY promotion: absolute path to a disconfirmation script that tries to disprove the finding; it must complete and exit non-zero (finding survived disproof).",
-    }),
     control_path: Type.String({
       description:
-        "REQUIRED for EVERY promotion: absolute path to the SAME script as poc_path (sha256-enforced). The harness runs it in control mode against control_target and blocks if verification_marker appears.",
+        "REQUIRED: absolute path to the SAME script as poc_path (sha256-equality is ENFORCED). The harness runs it with PI_POC_MODE=control and PI_POC_TARGET=control_target.",
     }),
     control_target: Type.String({
       minLength: 1,
       description:
-        "REQUIRED for EVERY promotion: target passed to the same PoC in control mode. Must be distinct from the case target and lack the vulnerability (patched replica, second account, baseline endpoint).",
-    }),
-    control_liveness_marker: Type.String({
-      minLength: 1,
-      description:
-        "REQUIRED for EVERY promotion: a unique string the control script must print AFTER successfully reaching/exercising the control target (e.g. 'CONTROL_REACHED_<case-id>'). The harness blocks promotion if the control output lacks it — a control that never reached its target (unreachable host, wrong port, early exit) is not a clean verdict. Must differ from verification_marker.",
+        "REQUIRED: a distinct baseline target that lacks the vulnerability and is operator-approved through PI_POC_CONTROL_TARGETS (patched replica, second account, baseline service).",
     }),
     local: Type.Optional(
       Type.Boolean({
         description:
-          "Run with network access (Docker sandbox with --network host — still read-only FS, dropped capabilities, unprivileged user) instead of the isolated --network none sandbox. True host execution is NOT agent-selectable: it requires the operator to set PI_POC_ALLOW_LOCAL=1, and is used only as a fallback when Docker is unavailable.",
+          "Run with network access instead of --network none. Requires operator authorization via PI_POC_ALLOW_NETWORK=1. True host fallback additionally requires PI_POC_ALLOW_LOCAL=1.",
+      }),
+    ),
+    oob: Type.Optional(
+      Type.Boolean({
+        description:
+          "Reserved for source-separated out-of-band verification. Currently fails closed because a loopback listener reachable by the PoC cannot prove target causation.",
       }),
     ),
   },
   { additionalProperties: false },
 );
 
+const ConfirmSchema = Type.Object(
+  {
+    id: Type.String({ description: "Case ID with a pending confirmation" }),
+    verdict: Type.Object(
+      {
+        verdict: Type.String({ enum: [...CONFIRM_VERDICT_VALUES] }),
+        reasoning: Type.String({
+          description: "Why the evidence does or does not demonstrate the claim",
+        }),
+        evidence_reviewed: Type.Array(Type.String(), {
+          description: "Files/evidence the main agent actually reviewed",
+        }),
+        re_execution_note: Type.Optional(
+          Type.String({
+            description:
+              "What the main agent observed during review and the fresh harness-owned target/control replay. Mandatory for CONFIRMED.",
+          }),
+        ),
+        differential: Type.String({
+          enum: [...CONFIRM_DIFFERENTIAL_VALUES],
+          description: "Target vs control evidence comparison. CONFIRMED requires target_only.",
+        }),
+        severity_match: Type.Optional(
+          Type.String({
+            enum: [...SEVERITY_MATCH_VALUES],
+            description: "Claimed severity vs what the evidence shows",
+          }),
+        ),
+        disconfirmation_attempt: Type.Optional(
+          Type.String({
+            description:
+              "The main agent's own failed attempt to disprove — becomes the case's disconfirmation",
+          }),
+        ),
+        canary_assessment: Type.Optional(
+          Type.String({
+            enum: [...CANARY_ASSESSMENT_VALUES],
+            description:
+              "verified when the replay carried a harness-generated reflection canary; otherwise not_applicable with a concrete reason",
+          }),
+        ),
+        canary_reason: Type.Optional(
+          Type.String({
+            description:
+              "Why a causal reflection canary is not meaningful for this exploit class. Required when canary_assessment=not_applicable.",
+          }),
+        ),
+        model: Type.Optional(
+          Type.String({ description: "Which model judged (recorded for the accuracy ledger)" }),
+        ),
+      },
+      { additionalProperties: false },
+    ),
+  },
+  { additionalProperties: false },
+);
+
 // ── Tool: CaseGet ─────────────────────────────────────────────────────
 
 /** id-only schema, shared by CaseGet / CaseContext. */
@@ -604,6 +679,19 @@ function buildCaseListContext(records: CaseRecord[]): string {
   return lines.join("\n");
 }
 
+/**
+ * Detect the extension host. OMP is a fork of Pi: both load the same
+ * `pi`-manifest extensions, but subagent dispatch differs (pi-subagents'
+ * `subagent({workflowScript})` vs OMP's native `task`). The entry script path
+ * carries the host package: `@oh-my-pi/pi-coding-agent/dist/cli.js` under OMP,
+ * `@earendil-works/pi-coding-agent` under Pi.
+ */
+export function detectHost(): "omp" | "pi" {
+  const argv = process.argv.join(" ");
+  if (argv.includes("@oh-my-pi")) return "omp";
+  return "pi";
+}
+
 /**
  * Builds the per-prompt injection. The cyber workflow is session-scope data —
  * it never changes — so the caller passes includeWorkflow=true exactly once
@@ -611,7 +699,8 @@ function buildCaseListContext(records: CaseRecord[]): string {
  * case list DOES change as cases are added, so it is refreshed every prompt.
  *
  * mode selects the workflow text: "lite" injects the single-agent workflow
- * (no subagent dispatch), anything else gets the full subagent pipeline.
+ * (no subagent dispatch), anything else gets the full subagent pipeline,
+ * rendered for the host's dispatch convention (pi-subagents vs OMP task).
  */
 function buildAgentInjection(
   active: CaseRecord[],
@@ -620,7 +709,12 @@ function buildAgentInjection(
 ): string {
   const caseList = buildCaseListContext(active);
   if (!includeWorkflow) return caseList;
-  const workflow = mode === "lite" ? STATIC_CYBER_WORKFLOW_LITE : STATIC_CYBER_WORKFLOW;
+  const workflow =
+    mode === "lite"
+      ? STATIC_CYBER_WORKFLOW_LITE
+      : detectHost() === "omp"
+        ? STATIC_CYBER_WORKFLOW_OMP
+        : STATIC_CYBER_WORKFLOW;
   // Workflow FIRST for prominence, then case list as reference data.
   return caseList ? `${workflow}\n\n${caseList}` : workflow;
 }
@@ -681,6 +775,20 @@ export function parseXpModeArg(args: string, current: XpMode): XpMode {
 // ── Main extension ────────────────────────────────────────────────────
 
 export default function casefileExtension(pi: ExtensionAPI) {
+  // Process role is immutable for this extension instance. A worker may spawn
+  // shells, but unsetting PI_SUBAGENT_CHILD in a child shell cannot upgrade the
+  // already-loaded extension or reveal a tool that was omitted at startup.
+  const startedAsSubagent = process.env.PI_SUBAGENT_CHILD === "1";
+  const isSubagentProcess = () => startedAsSubagent || process.env.PI_SUBAGENT_CHILD === "1";
+  // Pin the workspace root ONCE at extension load. Every scratchpad / pipeline
+  // / PoC-path lookup otherwise re-walks the ambient cwd on each call — a
+  // mid-session `cd` would split state across two .scratchpad roots and
+  // misroot the hunt file-existence filter. The PoC runner reads PI_POC_ROOT
+  // (set only when the operator hasn't pinned it explicitly).
+  const workspaceRoot = detectWorkspaceRoot();
+  setScratchpadRoot(workspaceRoot);
+  process.env.PI_POC_ROOT ??= workspaceRoot;
+
   // ── Diagnostic Error Handler Middleware ──
   const originalRegisterTool = pi.registerTool.bind(pi);
   pi.registerTool = (spec: any) => {
@@ -821,7 +929,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
     name: "EvidenceAdd",
     label: "Add Evidence Item",
     description:
-      "Record a role-typed, artifact-backed evidence item on a case (observation, reproduction, impact, refutation, cleanup). Artifact files are stored as basename + SHA-256 — the full path is never persisted. refutation items justify a kill; cleanup items track engagement cleanup before REPORT.",
+      "Record a role-typed, artifact-backed evidence item on a case. Artifact reads are restricted to regular, non-symlink files inside the workspace; bytes are copied durably and stored as basename + SHA-256. refutation items justify a kill; cleanup items track engagement cleanup before REPORT.",
     promptSnippet: "Record a role-typed evidence item",
     promptGuidelines: [
       "Use EvidenceAdd for artifact-backed evidence: raw responses, logs, screenshots, disproof attempts — anything a claim should trace back to.",
@@ -887,13 +995,15 @@ export default function casefileExtension(pi: ExtensionAPI) {
         description:
           "The attack class tested (e.g. sql-injection, xss, idor, ssti, ssrf, auth-bypass, ...).",
       }),
-      scope: Type.Union(
-        COVERAGE_SCOPE_VALUES.map((s) => Type.Literal(s)),
-        {
-          description:
-            "'wide' if the verdict applies to the whole deployment/account/host (recorded ONCE, applies to every asset of the deployment — do NOT re-test it per asset); 'local' if specific to this one asset.",
-        },
-      ),
+      // Provider-safe string enum (per the header rule): Type.Union(Type.Literal)
+      // serializes to anyOf/const, which some providers drop — scope would
+      // arrive undefined and every explicit 'wide' verdict would silently
+      // persist as 'local', under-reporting tested classes.
+      scope: Type.String({
+        enum: [...COVERAGE_SCOPE_VALUES],
+        description:
+          "'wide' if the verdict applies to the whole deployment/account/host (recorded ONCE, applies to every asset of the deployment — do NOT re-test it per asset); 'local' if specific to this one asset.",
+      }),
       note: Type.String({
         description:
           "Short note of the tests ACTUALLY RUN and the verdict: techniques tried · result · key gap. A verdict guessed without testing can hide a real issue.",
@@ -1021,71 +1131,49 @@ export default function casefileExtension(pi: ExtensionAPI) {
     },
   });
 
-  // ── Tool: PromoteFinding ──
+  // ── Tool: PromoteFinding (phase 1) ──
 
   pi.registerTool({
     name: "PromoteFinding",
-    label: "Promote Finding",
+    label: "Run PoC Evidence",
     description:
-      "Run an on-disk PoC script (Docker sandbox or host-network sandbox) and, on exit 0 + verification marker present in output, promote an investigating case to confirmed. The verification_marker proves the exploit worked — exit code 0 alone is NOT sufficient. EVERY promotion REQUIRES disconfirmation_path, same-script control_path, distinct control_target, and control_liveness_marker. The harness blocks promotion if output capture is incomplete, if the control prints the vuln marker, if liveness is absent, or if control/disconfirmation crash. Host execution is never agent-selectable — local:true uses a host-network Docker sandbox; true host runs need PI_POC_ALLOW_LOCAL=1.",
-    promptSnippet: "Run a PoC and promote an investigating case to confirmed",
+      "Phase 1 of confirmation: run the same PoC twice against the case target and once against an operator-approved control_target, validate nonce-bound evidence.json with a response-body assertion, then have the harness execute one immutable HTTP request template against both target and control. The machine records a predicate differential, or a stronger canary differential when a reflection placeholder is requested and observed only on target; neither is automatically a vulnerability verdict. Exit 0 is necessary run integrity, never proof. Networked execution, controls, and private replay are operator-gated. Blind/OOB confirmation fails closed until source separation exists. Records a pending bundle for main-agent semantic review via ConfirmFinding.",
+    promptSnippet: "Phase 1: run PoC evidence (target x2 + control) and record the pending bundle",
     promptGuidelines: [
-      "Use PromoteFinding when an investigating case has a concrete PoC script on disk and you are ready to prove it.",
-      "Prerequisites: status='investigating' and non-empty poc, evidence, impact, severity, target, disconfirmation, plus an artifact-backed EvidenceAdd 'observation' item on the case (the initial signal, with artifact_path) — the PoC gate auto-records the reproduction item.",
-      "Default sandbox: docker run --rm --network none. Use local:true for network-dependent bugs (host-network sandbox; host execution needs operator PI_POC_ALLOW_LOCAL=1).",
-      "Gate: exit 0 AND verification_marker in the PoC output. The marker (e.g. 'VULN_CONFIRMED_<case-id>') must be printed only AFTER the exploit is verified (data extracted, callback received, payload reflected) — never unconditionally or before the exploit check. The marker check prevents fluke exit 0 (script crashed early) and mocked PoCs (target faked) from passing.",
-      "control_path (REQUIRED): the SAME script as poc_path (sha256-equality is ENFORCED). The harness runs it with PI_POC_MODE=control and PI_POC_TARGET=control_target. The control must not print the verification marker and must print the liveness marker.",
-      "control_target + control_liveness_marker (REQUIRED): control_target is the distinct baseline target. The liveness marker is printed only AFTER reaching/exercising it; absent liveness blocks promotion.",
-      "disconfirmation_path: a script that tries to disprove the finding; if it exits 0, promotion is blocked. REQUIRED for EVERY promotion — the prose disconfirmation field is not enough at any severity (a case filed low/medium must not skip the run and be re-raised afterwards).",
-      "Never CaseUpdate status='confirmed' directly — it is rejected. Always use PromoteFinding.",
+      "Use PromoteFinding when an investigating case has a concrete PoC script on disk and you are ready to subject its claim to the machine gate.",
+      "Prerequisites: status='investigating' and non-empty poc, evidence, impact, severity, target, plus an artifact-backed EvidenceAdd 'observation' item on the case (the initial signal, with artifact_path). The final disconfirmation comes from the main agent at confirm time.",
+      "The PoC MUST write evidence.json to $PI_POC_EVIDENCE_DIR: { nonce (echo $PI_POC_NONCE), claim, verify: { method, url, expect: { status?, body_contains/body_regex } }, observations }. A non-empty body predicate is mandatory; status-only evidence is rejected. verify.url must belong to the case target.",
+      "For reflection-capable requests, place {{PI_POC_CANARY}} exactly once in verify.url/body/header values and declare verify.canary={mode:'reflection',placeholder:'{{PI_POC_CANARY}}'}. The harness substitutes an unpredictable value only after the PoC exits and requires target-only reflection; the raw token is not persisted.",
+      "control_path (REQUIRED): the SAME script as poc_path. control_target must be pre-approved by the operator in PI_POC_CONTROL_TARGETS. The harness derives the control request from the target request, changes only its origin, and applies the same predicates to two conclusive responses.",
+      "local:true requires PI_POC_ALLOW_NETWORK=1. Private/internal harness replay additionally requires PI_POC_ALLOW_PRIVATE_REPLAY=1. Neither silently falls back to a model verdict.",
+      "Blind/OOB classes are not promotable through the built-in loopback listener because the PoC can self-call it; obtain a direct-response or state oracle, otherwise keep the case investigating.",
+      "After the bundle is recorded, return control to the main agent. The main agent must inspect the script/evidence, attempt disconfirmation, and call ConfirmFinding itself; that call performs a fresh harness-owned target/control replay. Never delegate phase 2 and never CaseUpdate status='confirmed' directly.",
     ],
     parameters: PromoteSchema,
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
-      // Validate promotability BEFORE running the PoC — a sandboxed run can take
-      // 30s (plus first-time image pull), so fail cheap when the case can't
-      // advance anyway (missing, wrong status, missing required fields, missing
-      // artifact-backed observation evidence).
+      // Validate promotability BEFORE running the PoC — each sandboxed run can
+      // take 30s (plus first-time image pull), so fail cheap when the case
+      // can't advance anyway (missing, wrong status, missing required fields,
+      // missing artifact-backed observation evidence).
       const caseId = params.id as string;
       const current = assertPromotable(caseId);
 
-      // Shared blocked-promotion shape: the case stays investigating and the
-      // caller gets the record back for context.
       const fail = (text: string, _extra?: Record<string, unknown>): never => {
         throw new Error(text);
       };
 
-      // Reject empty/whitespace markers BEFORE any PoC run — it's a param
-      // error, so fail cheap instead of burning a (up to 30s) sandboxed run.
-      const marker = (params.verification_marker as string | undefined)?.trim();
-      if (!marker) {
-        return fail(
-          "verification_marker is empty or whitespace. " +
-            "A non-empty marker printed only AFTER the PoC confirms exploitation is required — " +
-            "exit code 0 alone is not sufficient. Case remains investigating.",
-        );
-      }
-
-      // Control-target anti-cheat is mandatory for EVERY promotion — sandboxed
-      // and live alike. It is the only deterministic check that the marker is
-      // target-dependent; skipping it for the default sandboxed mode would let
-      // an unconditional-marker PoC pass untouched. Check BEFORE paying for the
-      // PoC run.
-      const controlPath = (params.control_path as string | undefined)?.trim();
+      const controlPath = (params.control_path as string | undefined)?.trim() ?? "";
+      const controlTarget = (params.control_target as string | undefined)?.trim() ?? "";
       if (!controlPath) {
         return fail(
-          "control_path is REQUIRED for every promotion (sandboxed and live alike): a script that runs " +
-            "the SAME PoC against a control lacking the vuln (patched replica, second account, baseline endpoint). " +
-            "The harness verifies the verification_marker is absent from the control run's output — that is what " +
-            "proves the marker is target-dependent. Write the control script and retry.",
+          "control_path is REQUIRED: the SAME script as poc_path (sha256-equality is ENFORCED), run by the harness with PI_POC_MODE=control and PI_POC_TARGET=control_target.",
           { missingControl: true },
         );
       }
-
-      const controlTarget = (params.control_target as string | undefined)?.trim();
       if (!controlTarget) {
         return fail(
-          "control_target is REQUIRED for every promotion: a distinct baseline target that lacks the vulnerability.",
+          "control_target is REQUIRED: a distinct baseline target that lacks the vulnerability.",
           { missingControlTarget: true },
         );
       }
@@ -1095,49 +1183,23 @@ export default function casefileExtension(pi: ExtensionAPI) {
           { controlTargetEqualsCaseTarget: true },
         );
       }
-
-      // The control must ALSO prove it reached its target: without a liveness
-      // marker, a control pointed at an unreachable host / wrong port / early
-      // exit would show "marker absent" for reasons unrelated to the vuln.
-      const livenessMarker = (params.control_liveness_marker as string | undefined)?.trim();
-      if (!livenessMarker) {
-        return fail(
-          "control_liveness_marker is REQUIRED for every promotion: a unique string the control script " +
-            "prints ONLY AFTER reaching/exercising the control target (e.g. 'CONTROL_REACHED_<case-id>'). " +
-            "The harness blocks promotion if the control output lacks it — a control that never reached its " +
-            "target proves nothing. Must differ from verification_marker.",
-          { missingLivenessMarker: true },
-        );
-      }
-      if (livenessMarker === marker) {
+      if (params.local === true && process.env.PI_POC_ALLOW_NETWORK !== "1") {
         return fail(
-          "control_liveness_marker must differ from verification_marker — the liveness marker proves the " +
-            "control reached its target, the verification marker proves the vuln fired. Use distinct strings.",
-          { livenessEqualsMarker: true },
+          "Networked PoC execution is operator-gated. Set PI_POC_ALLOW_NETWORK=1 to authorize the host-network sandbox for this session.",
+          { networkNotAuthorized: true },
         );
       }
-
-      // EXECUTED disconfirmation is required for EVERY promotion — the prose
-      // `disconfirmation` field cannot carry the disprove-attempt. Making it
-      // unconditional (not severity-keyed) also kills the ordering attack:
-      // a case filed as low/medium could previously skip the run, promote,
-      // then be re-raised to high/critical with no executed disproof.
-      const disconfirmationPath = (params.disconfirmation_path as string | undefined)?.trim();
-      if (!disconfirmationPath) {
+      const controlAuthorization = controlTargetAuthorizationError(controlTarget);
+      if (controlAuthorization) {
         return fail(
-          "disconfirmation_path is REQUIRED for every promotion: a script that tries to " +
-            "disprove the finding and must exit non-zero (the finding survived the attempt). " +
-            "The prose disconfirmation field is not enough. Write the disconfirmation script and retry.",
-          { missingDisconfirmation: true },
+          `CONTROL AUTHORIZATION FAILED: ${controlAuthorization}. ` +
+            "The operator must set PI_POC_CONTROL_TARGETS to the exact approved control host/origin before this control can anchor confirmation.",
+          { controlNotAuthorized: true },
         );
       }
 
-      // Same-file contract (anti-cheat): the control must be the SAME script as
-      // the PoC, differing only via the harness-set PI_POC_MODE env var. Two
-      // agent-written files (poc prints the marker unconditionally, control
-      // prints the liveness marker) pass every string check — the "same script"
-      // recommendation in the docs is now enforced: sha256(control) must equal
-      // sha256(poc). Hash BEFORE any run so a mismatch fails cheap.
+      // Same-file contract (anti-cheat): control must be the SAME bytes as the
+      // PoC, differing only via the harness-set env. Check BEFORE any run.
       const pocPath = (params.poc_path as string | undefined)?.trim() ?? "";
       let pocHash: string | undefined;
       let controlHash: string | undefined;
@@ -1152,134 +1214,137 @@ export default function casefileExtension(pi: ExtensionAPI) {
       }
       if (pocHash !== controlHash) {
         return fail(
-          "CONTROL CHECK FAILED: control_path must be the SAME script as poc_path " +
-            "(sha256 mismatch). The control run is only meaningful as the same PoC " +
-            "pointed at a distinct control_target via PI_POC_MODE=control and PI_POC_TARGET. " +
-            "A separately written control file proves nothing. Case remains investigating.",
-          { run: undefined, controlHashMismatch: true },
+          "CONTROL CHECK FAILED: control_path must be the SAME script as poc_path (sha256 mismatch). Case remains investigating.",
+          { controlHashMismatch: true },
         );
       }
 
-      // local:true now means "network access": with the operator's
-      // PI_POC_ALLOW_LOCAL=1 opt-in the run executes on the host; WITHOUT the
-      // opt-in it uses a Docker sandbox with --network host (same FS/cap/user
-      // isolation) and fails closed when Docker is unavailable too. Host
-      // execution is never agent-selectable on its own.
+      // ── OOB callback (Tier 1, opt-in for blind classes) ──
+      const oobRequested = params.oob === true;
+      if (oobRequested) {
+        return fail(
+          "OOB confirmation is fail-closed: the built-in loopback listener is reachable by the PoC and cannot prove the target caused a callback. A source-separated, operator-owned callback service is required before blind findings can be promoted.",
+          { oobSourceSeparationRequired: true },
+        );
+      }
       const runOptions = (pocMode: string, target: string): PocRunOptions => ({
         network: params.local === true ? "host" : "none",
         local: params.local === true,
-        env: { PI_POC_MODE: pocMode, PI_POC_TARGET: target },
+        env: {
+          PI_POC_MODE: pocMode,
+          PI_POC_TARGET: target,
+        },
       });
 
       const caseTarget = current.target ?? "";
-      const run = runPoc(pocPath, runOptions("poc", caseTarget));
-
-      // Fail closed without throwing: non-zero PoC must leave the case investigating.
-      if (run.exitCode !== 0) {
-        return fail(
-          `PoC failed (exit ${run.exitCode}). Case remains investigating.\nOutput:\n${run.output}`,
-          { run },
-        );
-      }
-
-      // Defense-in-depth: exit 0 implies the run completed (sandbox wrapper /
-      // local spawn semantics), but never trust a run the runner says crashed.
-      if (!run.completed || !run.outputComplete) {
-        return fail(
-          `PoC did NOT complete or output capture was incomplete. Case remains investigating.\nOutput:\n${run.output}`,
-          { run, pocCrashed: true },
-        );
-      }
-
-      // Verification marker check: exit code 0 alone is NOT sufficient.
-      // The PoC must print the verification_marker, proving the exploit
-      // actually worked — not just that the script ran. The check runs on
-      // rawOutput (untruncated) so a script printing its marker past the
-      // 4000-char display window cannot hide it.
-      const pocOut = run.rawOutput ?? run.output;
-      if (!pocOut.includes(marker)) {
-        return fail(
-          `PoC exited 0 but the verification marker "${marker}" was NOT found in the output.\n` +
-            `This means the script ran but did not prove exploitation. The marker must be printed only AFTER the PoC verifies the exploit worked (data extracted, callback received, payload reflected, etc.).\n` +
-            `Do not print the marker unconditionally — print it only when the exploit is confirmed.\n\nOutput:\n${run.output}`,
-          { run, markerMissing: true },
-        );
-      }
+      let targetRuns!: [PocEvidenceRun, PocEvidenceRun];
+      let control!: PocEvidenceRun;
+      let harnessVerified!: HarnessVerifyResult;
+      // Determinism: TWO target runs + one control run. Exit 0 is run
+      // integrity only; nonce-bound body evidence and the harness-owned
+      // target/control replay form the machine gate.
+      const run1 = runPoc(pocPath, runOptions("poc", caseTarget));
+      const run2 = runPoc(pocPath, runOptions("poc", caseTarget));
+      const controlRun = runPoc(controlPath, runOptions("control", controlTarget));
 
-      // Run disconfirmation script — must exit NON-0 (finding survived the attempt to disprove).
-      let disconfirmationRun: PocRun | undefined;
-      if (disconfirmationPath) {
-        disconfirmationRun = runPoc(disconfirmationPath, runOptions("disconfirmation", caseTarget));
-        if (!disconfirmationRun.completed || !disconfirmationRun.outputComplete) {
+      const evidenceRun = (r: PocRun, mode: "poc" | "control", target: string): PocEvidenceRun => {
+        if (!r.completed || !r.outputComplete) {
           return fail(
-            `Disconfirmation script did NOT complete (spawn error, killed, or timeout — no completion marker). ` +
-              `A crash is not a survived disproof: fix the disconfirmation script and retry.\n` +
-              `Output:\n${disconfirmationRun.output}`,
-            { run, disconfirmationRun, disconfirmationCrashed: true },
+            `${mode} run did not complete or output capture was incomplete` +
+              (r.infraError ? ` (infra: ${r.output.trim()})` : "") +
+              ". A crash is not evidence. Case remains investigating.",
+            { run: r, pocCrashed: true },
           );
         }
-        if (disconfirmationRun.exitCode === 0) {
+        if (r.evidenceError) {
           return fail(
-            `Disconfirmation script exited 0 (finding was disproven). ` +
-              `Case remains investigating.\nOutput:\n${disconfirmationRun.output}`,
-            { run, disconfirmationRun },
+            `EVIDENCE CONTRACT FAILED (${mode} run): ${r.evidenceError}. ` +
+              "The PoC must write evidence.json to $PI_POC_EVIDENCE_DIR — { nonce (echo $PI_POC_NONCE), claim, verify: { method, url, expect: { status?, body_contains / body_regex } }, observations }; a response-body assertion is mandatory — " +
+              "the file is bound to this run and validated by the harness. Case remains investigating.",
+            { run: r, evidenceError: r.evidenceError },
           );
         }
-      }
+        if (!r.evidence || !r.evidenceSha256 || !r.nonce) {
+          return fail(`${mode} run produced no evidence. Case remains investigating.`, {
+            run: r,
+          });
+        }
+        return {
+          mode,
+          target,
+          nonce: r.nonce,
+          ranAt: r.ranAt,
+          exitCode: r.exitCode,
+          sandbox: r.sandbox,
+          completed: r.completed,
+          outputComplete: r.outputComplete,
+          output: r.output ?? "",
+          evidence: r.evidence,
+          evidenceSha256: r.evidenceSha256,
+          evidencePath: r.evidencePath,
+        };
+      };
 
-      // Control-target anti-cheat check: the same PoC pointed at a control that
-      // lacks the vuln must NOT print the marker. The control script is
-      // agent-written, but the marker-absence check is harness-side and
-      // deterministic — the model cannot pass it by asserting success. The
-      // liveness-marker check closes the "control pointed at an unreachable
-      // host / exited early" hole: the control must prove it reached its target.
-      const controlRun = runPoc(controlPath, runOptions("control", controlTarget));
-      if (!controlRun.completed || !controlRun.outputComplete) {
-        return fail(
-          `CONTROL CHECK FAILED: the control-target script did NOT complete (spawn error, killed, or timeout). ` +
-            `A control run that never executed proves nothing about the marker — fix the control script and retry.\n` +
-            `Control output:\n${controlRun.output}`,
-          { run, controlRun, controlCrashed: true },
-        );
-      }
-      // Marker-absence + liveness checks run on the UNTRUNCATED control output.
-      const controlOut = controlRun.rawOutput ?? controlRun.output;
-      if (controlOut.includes(marker)) {
-        return fail(
-          `CONTROL CHECK FAILED: the verification marker "${marker}" appeared in the control-target run. ` +
-            `The PoC prints the marker without the vulnerable condition — a cheating PoC (unconditional marker) ` +
-            `or a broken check. Case remains investigating.\nControl output:\n${controlRun.output}`,
-          { run, controlRun, controlCheated: true },
-        );
-      }
-      if (!controlOut.includes(livenessMarker)) {
-        return fail(
-          `CONTROL CHECK FAILED: the control-target run completed but the control_liveness_marker "${livenessMarker}" ` +
-            `was NOT found in its output. The control must print the liveness marker only AFTER reaching/exercising ` +
-            `the control target — an unreachable host, wrong port, or early exit is not a valid control verdict. ` +
-            `Case remains investigating.\nControl output:\n${controlRun.output}`,
-          { run, controlRun, controlLivenessMissing: true },
-        );
-      }
+      targetRuns = [evidenceRun(run1, "poc", caseTarget), evidenceRun(run2, "poc", caseTarget)];
+      control = evidenceRun(controlRun, "control", controlTarget);
+
+      // Tier 2 (docs/poc-trust-model.md): the harness executes the SAME
+      // request template against target and operator-approved control, applying
+      // the target's predicates to both. DNS is pinned at connect time.
+      harnessVerified = await replayDifferential(
+        targetRuns[0].evidence,
+        caseTarget,
+        controlTarget,
+        { allowPrivate: process.env.PI_POC_ALLOW_PRIVATE_REPLAY === "1" },
+      );
 
-      // PocRun is structurally a PocVerification — pass the runs straight through.
-      const result = promoteFindingResult(
+      const bundle: PendingConfirmation = {
         caseId,
-        run,
-        disconfirmationRun,
-        controlRun,
-        marker,
-        livenessMarker,
-      );
-      const record = result.record;
+        ranAt: new Date().toISOString(),
+        pocPath,
+        pocSha256: pocHash,
+        controlPath,
+        controlTarget,
+        targetRuns,
+        controlRun: control,
+        harnessVerified,
+      };
+
+      let record: CaseRecord;
+      try {
+        record = storePendingConfirmation(caseId, bundle);
+      } catch (e) {
+        return fail(`Pending confirmation rejected: ${(e as Error).message}`, {
+          storeRejected: true,
+        });
+      }
+
       return {
         content: [
           {
             type: "text",
-            text: `PoC verified (exit ${run.exitCode}). Case promoted to confirmed:\n${formatCaseDetail(record)}`,
+            text:
+              `Phase 1 complete — evidence bundle recorded on ${caseId} (expires in 1h).\n` +
+              `Target runs: 2, Control run: 1 — all with validated nonce-bound evidence.json.\n` +
+              `Evidence sha256: ${targetRuns[0].evidenceSha256}\n` +
+              `PoC script sha256 (at run time): ${pocHash}\n` +
+              `Harness verify replay: ${harnessVerified.attempted ? (harnessVerified.pass ? `PASS (status ${harnessVerified.status})` : `FAILED — ${harnessVerified.note}`) : harnessVerified.note}\n` +
+              `\nMAIN-AGENT REVIEW REQUIRED (do not delegate): inspect case ${caseId}, PoC ${pocPath}, control ${controlTarget}, evidence ${targetRuns[0].evidenceSha256}, and PoC hash ${pocHash}. Hunt for a trivial predicate or fabricated differential and perform a concrete disconfirmation attempt, then call ConfirmFinding yourself. A CONFIRMED call performs and stores a fresh harness-owned target/control replay; NOT_CONFIRMED keeps the case investigating.`,
           },
         ],
-        details: { record, run },
+        details: {
+          record,
+          bundle: {
+            caseId,
+            ranAt: bundle.ranAt,
+            pocPath,
+            controlPath,
+            controlTarget,
+            pocSha256: pocHash,
+            evidenceSha256: targetRuns[0].evidenceSha256,
+            harnessVerified,
+          },
+        },
       };
     },
 
@@ -1287,13 +1352,113 @@ export default function casefileExtension(pi: ExtensionAPI) {
       return callLine(theme, "PromoteFinding", (args.id as string) ?? "");
     },
 
-    renderResult(result, _options, theme) {
-      const details = result.details as { run?: { exitCode: number } } | undefined;
-      const success = details?.run?.exitCode === 0;
-      return new Text(renderCaseResult(result, theme, success ? "✓ " : "✗ ", "✗ "), 0, 0);
+    renderResult(result, _opts, theme) {
+      const details = result.details as { bundle?: { evidenceSha256?: string } } | undefined;
+      if (!details?.bundle) {
+        return new Text(theme.fg("error", "✗ PromoteFinding failed"), 0, 0);
+      }
+      return new Text(
+        theme.fg("success", "✓ ") +
+          theme.fg("dim", "evidence bundle ") +
+          theme.fg("muted", details.bundle.evidenceSha256?.slice(0, 12) ?? ""),
+        0,
+        0,
+      );
     },
   });
 
+  // ── Tool: ConfirmFinding (phase 2) ──
+
+  // Do not expose the commit capability in a worker process at all. The
+  // execute-time check remains as defense in depth if process state changes
+  // after registration or another integration forwards a stale tool handle.
+  if (!startedAsSubagent)
+    pi.registerTool({
+      name: "ConfirmFinding",
+      label: "Main-Agent Confirmation",
+      description:
+        "Phase 2 of confirmation, reserved for the main/coordinator agent: commit or refuse promotion after personally reviewing the machine bundle. On CONFIRMED, this tool performs a fresh harness-owned target/control replay; the verdict requires a target-only differential, a concrete re_execution_note and disconfirmation_attempt, a canary assessment, and the still-valid PromoteFinding bundle. The machine transcript is evidence, not the semantic vulnerability verdict. Worker/subagent processes are rejected. NOT_CONFIRMED records the review and keeps the case investigating.",
+      promptSnippet: "Main agent: independently review and commit or refuse PoC confirmation",
+      promptGuidelines: [
+        "Run only in the main/coordinator agent after PromoteFinding returns. Do not dispatch a worker to decide or author this verdict.",
+        "Personally inspect the PoC and preserved evidence and try a concrete disconfirmation before deciding. ConfirmFinding itself re-sends the immutable verify request against target and operator-approved control so phase 2 has a harness-owned transcript.",
+        "CONFIRMED requires differential: 'target_only', re_execution_note, and disconfirmation_attempt (the main agent's failed disproof). A verdict missing any of these is rejected.",
+        "Set canary_assessment='verified' when the immutable request declared a canary; otherwise set not_applicable and explain why a reflection canary is not meaningful for this exploit class.",
+        "NOT_CONFIRMED is final for that attempt — the case stays investigating with the main agent's reasoning recorded. A fresh PromoteFinding run is required for another attempt.",
+        "Never CaseUpdate status='confirmed' directly — it is rejected. Always use PromoteFinding + ConfirmFinding.",
+      ],
+      parameters: ConfirmSchema,
+
+      async execute(_id, params, _signal, _onUpdate, _ctx) {
+        if (isSubagentProcess()) {
+          throw new Error(
+            "ConfirmFinding is reserved for the main/coordinator agent. A worker or subagent may produce evidence but cannot confirm a PoC.",
+          );
+        }
+        const caseId = params.id as string;
+        const parsedVerdict = validateMainAgentVerdict(params.verdict);
+        if (!parsedVerdict.ok) {
+          throw new Error(`Invalid main-agent confirmation verdict: ${parsedVerdict.error}`);
+        }
+        let phase2Verification: MainAgentVerification | undefined;
+        if (parsedVerdict.verdict.verdict === "CONFIRMED") {
+          const current = getCaseById(caseId);
+          if (!current) throw new Error(`Case not found: ${caseId}`);
+          const bundle = current.pendingConfirmation;
+          if (!bundle) {
+            throw new Error("No pending confirmation on this case — run PromoteFinding first");
+          }
+          const controlAuthorizationError = controlTargetAuthorizationError(bundle.controlTarget);
+          if (controlAuthorizationError) {
+            throw new Error(`CONTROL AUTHORIZATION FAILED: ${controlAuthorizationError}`);
+          }
+          const replay = await replayDifferential(
+            bundle.targetRuns[0].evidence,
+            current.target ?? bundle.targetRuns[0].target,
+            bundle.controlTarget,
+            { allowPrivate: process.env.PI_POC_ALLOW_PRIVATE_REPLAY === "1" },
+          );
+          phase2Verification = {
+            at: new Date().toISOString(),
+            result: replay,
+          };
+        }
+        const result = applyConfirmationResult(caseId, parsedVerdict.verdict, phase2Verification, {
+          startedAsSubagent: isSubagentProcess(),
+        });
+        const record = result.record;
+        const promoted = record.status === "confirmed";
+        return {
+          content: [
+            {
+              type: "text",
+              text: promoted
+                ? `Main agent CONFIRMED. Case promoted:
+${formatCaseDetail(record)}`
+                : `Main agent NOT_CONFIRMED — case stays investigating (attempt recorded):
+${formatCaseDetail(record)}`,
+            },
+          ],
+          details: { record, promoted, changed: result.changed },
+        };
+      },
+
+      renderCall(args, theme) {
+        return callLine(theme, "ConfirmFinding", (args.id as string) ?? "");
+      },
+
+      renderResult(result, _opts, theme) {
+        const details = result.details as { promoted?: boolean } | undefined;
+        return new Text(
+          details?.promoted
+            ? theme.fg("success", "✓ Promoted")
+            : theme.fg("warning", "↷ Not confirmed"),
+          0,
+          0,
+        );
+      },
+    });
+
   // ── Tool: CaseGet ──
 
   pi.registerTool({
@@ -1536,7 +1701,9 @@ export default function casefileExtension(pi: ExtensionAPI) {
     parameters: ChainSuggestSchema,
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const suggestions = suggestChains((params.case_id as string | undefined) ?? undefined);
+      const suggestions = await suggestChainsAsync(
+        (params.case_id as string | undefined) ?? undefined,
+      );
       const lines: string[] = [
         suggestions.length
           ? `${suggestions.length} chain candidate(s):`
@@ -1582,7 +1749,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
     parameters: IdSchema,
 
     async execute(_id, params, _signal, _onUpdate, _ctx) {
-      const { path, contextPath, record } = writeCaseContext(params.id as string);
+      const { path, contextPath, record } = await writeCaseContextAsync(params.id as string);
       return {
         content: [
           {
@@ -2076,7 +2243,7 @@ export default function casefileExtension(pi: ExtensionAPI) {
     // the workflow + entire active-case ledger into every child dispatch is a
     // token multiplier (N subagents × workflow + growing case list per turn) —
     // workers get what they need via their task and tool guidelines.
-    if (process.env.PI_SUBAGENT_CHILD === "1") return;
+    if (isSubagentProcess()) return;
 
     const includeWorkflow = !workflowInjected;