@xaccefy/pi-casefile 0.8.3 → 0.9.1

package/src/ledger.ts

@@ -11,8 +11,33 @@
  */
 
 import { createHash, randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import {
+  evidenceNonceMatches,
+  type MainAgentVerdict,
+  normalizeEvidence,
+  type PoCEvidence,
+  parsePoCEvidence,
+  validateMainAgentVerdict,
+} from "./evidence.ts";
+import { type HarnessVerifyResult, verifyUrlBindingError } from "./harness-verify.ts";
+import {
+  assertSafeRegularFile,
+  ensureSafeStateDirectory,
+  readSafeFile,
+  writeSafeFileExclusive,
+} from "./safe-state.ts";
 import {
   findWorkspaceRoot,
   getScratchpadRoot,
@@ -46,6 +71,51 @@ export type CasePriority = (typeof PRIORITY_VALUES)[number];
 
 /** Cap on hashed evidence artifacts (10 MiB) — keeps readFileSync bounded. */
 const EVIDENCE_ARTIFACT_MAX_BYTES = 10 * 1024 * 1024;
+/** PoC evidence has a tighter runner-side cap and must remain equally bounded on re-read. */
+const POC_EVIDENCE_MAX_BYTES = 256 * 1024;
+/** Avoid racing an active or just-finished PoC whose bundle is not committed yet. */
+export const POC_EVIDENCE_GC_GRACE_MS = 24 * 60 * 60 * 1000;
+/** Immutable module-start role; child shells cannot upgrade this process by unsetting an env var. */
+const PROCESS_STARTED_AS_SUBAGENT = process.env.PI_SUBAGENT_CHILD === "1";
+
+function pathIsWithin(root: string, candidate: string): boolean {
+  const rel = relative(root, candidate);
+  return rel === "" || (!isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep}`));
+}
+
+function readWorkspaceArtifact(inputPath: string): { path: string; bytes: Buffer } {
+  const workspace = realpathSync(detectWorkspaceRoot());
+  const requested = resolve(workspace, inputPath);
+  if (!existsSync(requested)) {
+    throw new Error(`Evidence artifact not found on disk: ${inputPath}`);
+  }
+  const direct = lstatSync(requested);
+  if (direct.isSymbolicLink()) {
+    throw new Error(`Evidence artifact must not be a symbolic link: ${inputPath}`);
+  }
+  const canonical = realpathSync(requested);
+  if (!pathIsWithin(workspace, canonical)) {
+    throw new Error(
+      `Evidence artifact must stay inside the workspace (${workspace}): ${inputPath}`,
+    );
+  }
+  const stat = statSync(canonical);
+  if (!stat.isFile()) {
+    throw new Error(`Evidence artifact is not a regular file: ${inputPath}`);
+  }
+  if (stat.size > EVIDENCE_ARTIFACT_MAX_BYTES) {
+    throw new Error(
+      `Evidence artifact too large (${stat.size} bytes; max ${EVIDENCE_ARTIFACT_MAX_BYTES}): ${inputPath}`,
+    );
+  }
+  const bytes = readFileSync(canonical);
+  if (bytes.byteLength > EVIDENCE_ARTIFACT_MAX_BYTES) {
+    throw new Error(
+      `Evidence artifact too large (${bytes.byteLength} bytes; max ${EVIDENCE_ARTIFACT_MAX_BYTES}): ${inputPath}`,
+    );
+  }
+  return { path: canonical, bytes };
+}
 
 /** Role-typed evidence roles (Black-cat style). cleanup = engagement cleanup item. */
 export const EVIDENCE_ROLE_VALUES = [
@@ -157,6 +227,13 @@ export type CaseRecord = {
   id: string;
   title: string;
   status: CaseStatus;
+  /**
+   * True once the case has EVER reached investigating or confirmed. The kill
+   * gate keys off this, not the current status: a demotion
+   * (investigating/confirmed -> hypothesis) must not let an advanced case die
+   * with a keyword in free text instead of artifact-backed refutation evidence.
+   */
+  everAdvanced: boolean;
   confidence: CaseConfidence;
   severity?: CaseSeverity;
   priority?: CasePriority;
@@ -182,8 +259,12 @@ export type CaseRecord = {
   pocVerified?: PocVerificationRecord;
   /** Verification of a disconfirmation run (set only by promoteFindingResult). */
   disconfirmationVerified?: PocVerificationRecord;
-  /** Verification of a control-target run (set only by promoteFindingResult; anti-cheat gate). */
+  /** Verification of a control-target run (set only by the confirmation gate). */
   controlVerified?: PocVerificationRecord;
+  /** Phase-1 evidence bundle awaiting main-agent review (ConfirmFinding). */
+  pendingConfirmation?: PendingConfirmation;
+  /** Last phase-2 verdict (legacy field name retained for database compatibility). */
+  confirmerVerdict?: ConfirmerVerdictRecord;
   /** ISO timestamp when CaseContext first wrote the context bundle. */
   reportedAt?: string;
   /** Path to the final report file (set by writeCaseContext; the reporter agent writes the file). */
@@ -210,6 +291,75 @@ export type PocVerificationRecord = {
   target?: string;
 };
 
+/** One harness-observed PoC run with its validated, nonce-bound evidence. */
+export type PocEvidenceRun = {
+  mode: "poc" | "control";
+  target: string;
+  /** The run's PI_POC_NONCE — evidence.nonce must equal it (binds evidence to the run). */
+  nonce: string;
+  ranAt: string;
+  exitCode: number;
+  sandbox: boolean;
+  completed: boolean;
+  outputComplete: boolean;
+  /** Display-sliced output (diagnostic; zero exit is necessary, not proof). */
+  output: string;
+  evidence: PoCEvidence;
+  evidenceSha256: string;
+  /** Absolute path to the PRESERVED copy of this run's evidence.json (the
+   * runner copies the temp file into a durable .pi/poc-evidence/ dir; the
+   * reproduction item references it so the stored hash stays verifiable). */
+  evidencePath?: string;
+};
+
+/** Harness-observed out-of-band interactions (Tier 1, docs/poc-trust-model.md). */
+export type OobVerification = {
+  attempted: boolean;
+  targetHits: number;
+  controlHits: number;
+  /** True only when the PoC runner cannot directly reach the listener. */
+  sourceSeparated?: boolean;
+  note: string;
+};
+
+export type PendingConfirmation = {
+  caseId: string;
+  ranAt: string;
+  pocPath: string;
+  /** SHA-256 of the PoC script AT RUN TIME — re-hashed at confirm to catch edits. */
+  pocSha256: string;
+  controlPath: string;
+  controlTarget: string;
+  targetRuns: [PocEvidenceRun, PocEvidenceRun];
+  controlRun: PocEvidenceRun;
+  /** Harness's own replay of evidence.verify (public targets). Absent = legacy bundle. */
+  harnessVerified?: HarnessVerifyResult;
+  /** Harness-owned OOB listener log for the run (opt-in blind classes). */
+  callbackVerified?: OobVerification;
+};
+
+/** Fresh machine transcript produced inside the main agent's ConfirmFinding call. */
+export type MainAgentVerification = {
+  at: string;
+  result: HarnessVerifyResult;
+};
+
+/** Persisted main-agent verdict; `confirmer` naming is retained for DB compatibility. */
+export type MainAgentVerdictRecord = MainAgentVerdict & {
+  at: string;
+  reviewer: "main_agent";
+  /** Harness-owned phase-2 replay bound to this verdict. */
+  phase2Verification?: MainAgentVerification;
+  /** What the machine actually established; semantic vulnerability judgment remains main-agent-owned. */
+  proofStrength?: "predicate_differential" | "canary_differential";
+};
+
+/** @deprecated Compatibility alias for the legacy database/API field name. */
+export type ConfirmerVerdictRecord = MainAgentVerdictRecord;
+
+/** Pending confirmation expires after 1h — re-run PromoteFinding for a fresh bundle. */
+export const PENDING_CONFIRM_TTL_MS = 60 * 60 * 1000;
+
 export type CaseInput = {
   title: string;
   status?: CaseStatus;
@@ -239,6 +389,8 @@ type NormalizedCaseInput = Partial<CaseInput> & {
   pocVerified?: CaseRecord["pocVerified"];
   disconfirmationVerified?: CaseRecord["disconfirmationVerified"];
   controlVerified?: CaseRecord["controlVerified"];
+  pendingConfirmation?: CaseRecord["pendingConfirmation"];
+  confirmerVerdict?: CaseRecord["confirmerVerdict"];
   reportedAt?: string;
   reportPath?: string;
 };
@@ -319,6 +471,101 @@ function detectWorkspaceRoot(): string {
   );
 }
 
+export type PocEvidenceGcResult = {
+  scanned: number;
+  removed: number;
+  skipped: boolean;
+  reason?: string;
+};
+
+/**
+ * Delete only old harness evidence copies that no ledger row or pending
+ * confirmation bundle references. Malformed pending JSON fails closed because
+ * it may contain paths we cannot safely identify.
+ */
+function gcOrphanedPocEvidenceForDb(db: DatabaseSync, nowMs = Date.now()): PocEvidenceGcResult {
+  const evidenceDir = join(detectWorkspaceRoot(), ".pi", "poc-evidence");
+  if (!existsSync(evidenceDir)) return { scanned: 0, removed: 0, skipped: false };
+  try {
+    const dirStat = lstatSync(evidenceDir);
+    if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) {
+      return {
+        scanned: 0,
+        removed: 0,
+        skipped: true,
+        reason: "poc-evidence is not a regular directory",
+      };
+    }
+
+    const protectedNames = new Set<string>();
+    const items = db
+      .prepare("SELECT artifact_path FROM evidence_items WHERE artifact_path IS NOT NULL")
+      .all() as { artifact_path: string }[];
+    for (const item of items) protectedNames.add(basename(item.artifact_path));
+
+    const collectPendingPaths = (value: unknown): void => {
+      if (Array.isArray(value)) {
+        for (const item of value) collectPendingPaths(item);
+        return;
+      }
+      if (typeof value !== "object" || value === null) return;
+      for (const [key, nested] of Object.entries(value)) {
+        if (key === "evidencePath" && typeof nested === "string") {
+          protectedNames.add(basename(nested));
+        } else {
+          collectPendingPaths(nested);
+        }
+      }
+    };
+
+    const pendingRows = db
+      .prepare(
+        "SELECT pending_confirmation_json FROM cases WHERE pending_confirmation_json IS NOT NULL",
+      )
+      .all() as { pending_confirmation_json: string }[];
+    for (const row of pendingRows) {
+      let pending: unknown;
+      try {
+        pending = JSON.parse(row.pending_confirmation_json);
+      } catch {
+        return {
+          scanned: 0,
+          removed: 0,
+          skipped: true,
+          reason: "malformed pending confirmation JSON",
+        };
+      }
+      collectPendingPaths(pending);
+    }
+
+    let scanned = 0;
+    let removed = 0;
+    for (const entry of readdirSync(evidenceDir, { withFileTypes: true })) {
+      if (!entry.name.endsWith(".evidence.json") || !entry.isFile()) continue;
+      scanned++;
+      if (protectedNames.has(entry.name)) continue;
+      const candidate = join(evidenceDir, entry.name);
+      const file = lstatSync(candidate);
+      if (!file.isFile() || nowMs - file.mtimeMs < POC_EVIDENCE_GC_GRACE_MS) continue;
+      unlinkSync(candidate);
+      removed++;
+    }
+    return { scanned, removed, skipped: false };
+  } catch (error) {
+    return {
+      scanned: 0,
+      removed: 0,
+      skipped: true,
+      reason: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
+/** Run the same conservative orphan sweep used when the ledger opens. */
+export function gcOrphanedPocEvidence(nowMs = Date.now()): PocEvidenceGcResult {
+  return gcOrphanedPocEvidenceForDb(getDb(), nowMs);
+}
+
 export function getCasefilePath(): string {
   if (ledgerPathOverride) return ledgerPathOverride;
   // Trim BEFORE the truthiness check: a whitespace-only value must not
@@ -347,11 +594,18 @@ function getDb(): DatabaseSync {
 
   const dbPath = getCasefilePath();
   const dbDir = dirname(dbPath);
-  if (!existsSync(dbDir)) {
+  const workspace = detectWorkspaceRoot();
+  const defaultStateDir = join(workspace, ".pi");
+  if (resolve(dbDir) === resolve(defaultStateDir)) {
+    ensureSafeStateDirectory(workspace, [".pi"]);
+  } else if (!existsSync(dbDir)) {
     try {
       mkdirSync(dbDir, { recursive: true });
     } catch {}
   }
+  for (const candidate of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
+    assertSafeRegularFile(candidate, "Casefile database state");
+  }
 
   const db = new DatabaseSync(dbPath);
   // Give parallel agents a short write wait instead of immediate SQLITE_BUSY.
@@ -371,6 +625,7 @@ function getDb(): DatabaseSync {
       id TEXT PRIMARY KEY,
       title TEXT NOT NULL,
       status TEXT NOT NULL,
+      ever_advanced INTEGER NOT NULL DEFAULT 0,
       confidence TEXT NOT NULL,
       severity TEXT,
       priority TEXT,
@@ -390,6 +645,8 @@ function getDb(): DatabaseSync {
       poc_verified_json TEXT, -- JSON object
       disconfirmation TEXT,
       disconfirmation_verified_json TEXT, -- JSON object
+      pending_confirmation_json TEXT, -- JSON object
+      confirmer_verdict_json TEXT, -- JSON object
       reported_at TEXT,
       report_path TEXT,
       created_at TEXT NOT NULL,
@@ -428,6 +685,21 @@ function getDb(): DatabaseSync {
   if (!caseCols.some((c) => c.name === "control_verified_json")) {
     db.exec("ALTER TABLE cases ADD COLUMN control_verified_json TEXT");
   }
+  if (!caseCols.some((c) => c.name === "pending_confirmation_json")) {
+    db.exec("ALTER TABLE cases ADD COLUMN pending_confirmation_json TEXT");
+  }
+  if (!caseCols.some((c) => c.name === "confirmer_verdict_json")) {
+    db.exec("ALTER TABLE cases ADD COLUMN confirmer_verdict_json TEXT");
+  }
+  if (!caseCols.some((c) => c.name === "ever_advanced")) {
+    db.exec("ALTER TABLE cases ADD COLUMN ever_advanced INTEGER NOT NULL DEFAULT 0");
+    // Backfill: a case that is (or was) past hypothesis has reached an
+    // advanced state. Terminal rows can no longer be mutated, but marking them
+    // keeps the flag consistent for history/context reads.
+    db.exec(
+      "UPDATE cases SET ever_advanced = 1 WHERE status IN ('investigating','confirmed','blocked','killed','reported')",
+    );
+  }
 
   // Role-typed, artifact-backed evidence items (Black-cat style evidence chain).
   db.exec(`
@@ -473,6 +745,9 @@ function getDb(): DatabaseSync {
   db.exec(`CREATE INDEX IF NOT EXISTS idx_cases_priority ON cases(priority)`);
 
   dbInstance = db;
+  // Best-effort housekeeping: failures and ambiguous state fail closed and do
+  // not prevent the ledger from opening.
+  gcOrphanedPocEvidenceForDb(db);
   return db;
 }
 
@@ -507,6 +782,7 @@ function mapRow(
     id: row.id,
     title: row.title,
     status: row.status as CaseStatus,
+    everAdvanced: row.ever_advanced === 1,
     confidence: row.confidence as CaseConfidence,
     severity: row.severity as CaseSeverity | undefined,
     priority: row.priority as CasePriority | undefined,
@@ -528,6 +804,8 @@ function mapRow(
     pocVerified: safeParseObject(row.poc_verified_json),
     disconfirmationVerified: safeParseObject(row.disconfirmation_verified_json),
     controlVerified: safeParseObject(row.control_verified_json),
+    pendingConfirmation: safeParseObject(row.pending_confirmation_json),
+    confirmerVerdict: safeParseObject(row.confirmer_verdict_json),
     reportedAt: row.reported_at || undefined,
     reportPath: row.report_path || undefined,
     evidenceItems,
@@ -673,16 +951,20 @@ function validateCase(record: CaseRecord): void {
     );
   }
   // Keep this gate in lockstep with promoteFindingResult: a case may only be
-  // CONFIRMED when it has evidence, a PoC, demonstrated impact, and a severity.
+  // CONFIRMED when it has evidence, a PoC, demonstrated impact, a severity,
+  // and a named target (what host/repo/scope this affects).
   if (
     record.status === "confirmed" &&
     (!record.evidence ||
       !record.poc ||
       !record.impact ||
       !record.severity ||
+      !record.target ||
       !record.disconfirmation)
   ) {
-    throw new Error("Confirmed cases require evidence, poc, impact, severity, and disconfirmation");
+    throw new Error(
+      "Confirmed cases require evidence, poc, impact, severity, target, and disconfirmation",
+    );
   }
   if (record.status === "blocked" && (record.blockers ?? []).length === 0) {
     throw new Error("Blocked cases require at least one blocker");
@@ -698,9 +980,6 @@ function validateCase(record: CaseRecord): void {
       "Killed cases require evidence, next step, blockers, or assumptions explaining why",
     );
   }
-  // A case becomes REPORTED only after the report FILE exists on disk (the
-  // report writer writes it at the path CaseContext recorded). Require both
-  // here so validation stays consistent with the confirmed→reported gate.
   // A case becomes REPORTED only after a report FILE that passes the content
   // gate exists on disk (the report writer writes it at the path CaseContext
   // recorded). Existence is not enough: any non-empty file — or a directory —
@@ -774,21 +1053,33 @@ const REPORT_REQUIRED_SECTIONS = ["summary", "impact", "remediation"];
  * text (workflow.ts imports this) must not drift apart.
  */
 export const KILL_REASON_VALUES = [
+  "unreachable",
   "intended_behavior",
   "duplicate",
   "framework_protection",
+  "input_validation_blocks",
+  "requires_privilege_attacker_lacks",
   "exploit_unreliable",
   "insufficient_impact",
   "environmental_issue",
   "not_applicable",
   "out_of_scope",
-  "skeptic-disproven",
+  "test_artifact",
   "no_attack_path",
   "refuted",
 ] as const;
 export type KillReason = (typeof KILL_REASON_VALUES)[number];
 
-const KILL_REASON_PATTERN = new RegExp(`\\b(${KILL_REASON_VALUES.join("|")})\\b`, "i");
+/**
+ * Matches a kill reason whether the agent wrote the canonical token
+ * ("out_of_scope"), a spaced form ("out of scope"), or hyphenated
+ * ("out-of-scope") — the underscore spelling is machine vocabulary; free text
+ * must not be rejected just because it reads naturally.
+ */
+const KILL_REASON_PATTERN = new RegExp(
+  `\\b(${KILL_REASON_VALUES.map((v) => v.replace(/_/g, "[ _-]+")).join("|")})\\b`,
+  "i",
+);
 
 function validateTransition(
   from: CaseStatus,
@@ -813,28 +1104,34 @@ function validateTransition(
 
   if (to === "killed") {
     // Black-cat rule: a kill must be justified. Valid iff (a) a refutation
-    // evidence item exists for this case, or (b) — only for hypothesis-stage
-    // cases — the update states a kill reason from the KILLED catalog
-    // vocabulary (matches workflow.ts). Once a case reached investigating or
-    // confirmed, a keyword in free text is NOT enough: the kill must be backed
-    // by a real refutation evidence item (EvidenceAdd role=refutation — the
-    // disprove attempt that ended the lead).
+    // evidence item exists for this case, or (b) — only for cases that have
+    // NEVER reached investigating/confirmed — the update states a kill reason
+    // from the KILLED catalog vocabulary (matches workflow.ts). Once a case
+    // reached investigating or confirmed (everAdvanced — immune to demotion
+    // round-trips), a keyword in free text is NOT enough: the kill must be
+    // backed by a real refutation evidence item (EvidenceAdd role=refutation —
+    // the disprove attempt that ended the lead).
     const items = current ? listEvidenceItems(current.id) : [];
     if (!items.some((e) => e.role === "refutation" && e.sha256)) {
-      const advanced = current?.status === "investigating" || current?.status === "confirmed";
-      const text = [update.nextStep, (update.assumptions ?? []).join(" "), update.evidence]
+      const advanced = current?.everAdvanced === true;
+      const text = [
+        update.nextStep,
+        (update.assumptions ?? []).join(" "),
+        (update.blockers ?? []).join(" "),
+        update.evidence,
+      ]
         .filter(Boolean)
         .join(" ");
       if (advanced || !KILL_REASON_PATTERN.test(text)) {
         throw new Error(
           advanced
-            ? "Cannot kill an investigating/confirmed case without ARTIFACT-BACKED refutation evidence: add " +
+            ? "Cannot kill an advanced case (ever reached investigating/confirmed) without ARTIFACT-BACKED refutation evidence: add " +
                 "EvidenceAdd role=refutation with artifact_path (sha256 required — the disprove attempt " +
                 "that ended this lead) before killing."
             : "Cannot kill without justification: add refutation evidence (EvidenceAdd role=refutation, " +
-                "artifact_path recommended) or state a kill reason in assumptions/nextStep " +
+                "artifact_path recommended) or state a kill reason in assumptions/nextStep/blockers " +
                 "(intended_behavior, duplicate, framework_protection, out_of_scope, " +
-                "skeptic-disproven, no_attack_path, ...)",
+                "insufficient_impact, no_attack_path, ...)",
         );
       }
     }
@@ -862,7 +1159,7 @@ function validateTransition(
     },
     investigating: {
       confirmed: () =>
-        "investigating → confirmed requires a verified PoC run; use the promote_finding tool",
+        "investigating → confirmed requires a verified PoC run; use the PromoteFinding tool",
       hypothesis: () => null,
     },
     confirmed: {
@@ -923,6 +1220,12 @@ function buildRecord(input: NormalizedCaseInput, existing?: CaseRecord): CaseRec
     id,
     title,
     status: input.status ?? existing?.status ?? "hypothesis",
+    // Once a case has been investigating/confirmed it never forgets — the kill
+    // gate must not be defeatable by demoting first.
+    everAdvanced:
+      existing?.everAdvanced === true ||
+      input.status === "investigating" ||
+      input.status === "confirmed",
     confidence: input.confidence ?? existing?.confidence ?? "low",
     severity: input.severity ?? existing?.severity,
     priority: input.priority ?? existing?.priority,
@@ -948,6 +1251,8 @@ function buildRecord(input: NormalizedCaseInput, existing?: CaseRecord): CaseRec
         : existing?.disconfirmation,
     disconfirmationVerified: input.disconfirmationVerified ?? existing?.disconfirmationVerified,
     controlVerified: input.controlVerified ?? existing?.controlVerified,
+    pendingConfirmation: input.pendingConfirmation ?? existing?.pendingConfirmation,
+    confirmerVerdict: input.confirmerVerdict ?? existing?.confirmerVerdict,
     reportedAt: input.reportedAt ?? existing?.reportedAt,
     reportPath: input.reportPath ?? existing?.reportPath,
     evidenceItems: existing?.evidenceItems ?? [],
@@ -1207,8 +1512,12 @@ function titleTokenRarityWeights(titles: string[]): Map<string, number> {
   const n = titles.length;
   const weights = new Map<string, number>();
   for (const [token, docs] of df) {
-    // +1 smoothing: tokens unique to one doc stay above the baseline.
-    weights.set(token, 1 + Math.log((n + 1) / (docs + 1)));
+    // ln((n+1)/(docs+1)) — NO +1 baseline. A token in every title scores ~0
+    // (ln 1), a token in one title scores ln((n+1)/2) > 1 for n >= 3. The old
+    // `1 + ln(...)` made every weight >= 1, so the weighted half of the hybrid
+    // gate was vacuous (weightedSum >= sharedCount always) and generic
+    // vocabulary could never be down-weighted.
+    weights.set(token, Math.log((n + 1) / (docs + 1)));
   }
   return weights;
 }
@@ -1258,21 +1567,24 @@ function upsertCase(db: DatabaseSync, record: CaseRecord) {
   // wipe case_links when updating an existing primary key.
   const stmt = db.prepare(`
     INSERT INTO cases (
-      id, title, status, confidence, severity, priority, target, endpoint, bugClass,
+      id, title, status, ever_advanced, confidence, severity, priority, target, endpoint, bugClass,
       summary, evidence, impact, nextStep, poc, remediation,
       references_json, blockers_json, tags_json, assumptions_json, poc_verified_json,
       disconfirmation, disconfirmation_verified_json, disprove_if_json, control_verified_json,
+      pending_confirmation_json, confirmer_verdict_json,
       reported_at, report_path, created_at, updated_at
     ) VALUES (
-      ?, ?, ?, ?, ?, ?, ?, ?, ?,
+      ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
       ?, ?, ?, ?, ?, ?,
       ?, ?, ?, ?, ?,
       ?, ?, ?, ?,
+      ?, ?,
       ?, ?, ?, ?
     )
     ON CONFLICT(id) DO UPDATE SET
       title = excluded.title,
       status = excluded.status,
+      ever_advanced = excluded.ever_advanced,
       confidence = excluded.confidence,
       severity = excluded.severity,
       priority = excluded.priority,
@@ -1294,6 +1606,8 @@ function upsertCase(db: DatabaseSync, record: CaseRecord) {
       disconfirmation_verified_json = excluded.disconfirmation_verified_json,
       disprove_if_json = excluded.disprove_if_json,
       control_verified_json = excluded.control_verified_json,
+      pending_confirmation_json = excluded.pending_confirmation_json,
+      confirmer_verdict_json = excluded.confirmer_verdict_json,
       reported_at = excluded.reported_at,
       report_path = excluded.report_path,
       created_at = excluded.created_at,
@@ -1304,6 +1618,7 @@ function upsertCase(db: DatabaseSync, record: CaseRecord) {
     record.id,
     record.title,
     record.status,
+    record.everAdvanced ? 1 : 0,
     record.confidence,
     record.severity || null,
     record.priority || null,
@@ -1325,6 +1640,8 @@ function upsertCase(db: DatabaseSync, record: CaseRecord) {
     record.disconfirmationVerified ? JSON.stringify(record.disconfirmationVerified) : null,
     JSON.stringify(record.disproveIf),
     record.controlVerified ? JSON.stringify(record.controlVerified) : null,
+    record.pendingConfirmation ? JSON.stringify(record.pendingConfirmation) : null,
+    record.confirmerVerdict ? JSON.stringify(record.confirmerVerdict) : null,
     record.reportedAt || null,
     record.reportPath || null,
     record.createdAt,
@@ -1372,22 +1689,29 @@ export function addEvidenceItemResult(
   if (!summary) throw new Error("Evidence summary must not be empty");
 
   let artifactPath: string | undefined;
+
   let sha256: string | undefined;
   if (input.artifactPath) {
-    if (!existsSync(input.artifactPath)) {
-      throw new Error(`Evidence artifact not found on disk: ${input.artifactPath}`);
-    }
-    const stat = statSync(input.artifactPath);
-    if (!stat.isFile()) {
-      throw new Error(`Evidence artifact is not a regular file: ${input.artifactPath}`);
-    }
-    if (stat.size > EVIDENCE_ARTIFACT_MAX_BYTES) {
-      throw new Error(
-        `Evidence artifact too large (${stat.size} bytes; max ${EVIDENCE_ARTIFACT_MAX_BYTES}): ${input.artifactPath}`,
-      );
+    const artifact = readWorkspaceArtifact(input.artifactPath);
+    artifactPath = basename(artifact.path);
+    sha256 = createHash("sha256").update(artifact.bytes).digest("hex");
+    // Durable copy: artifact_path stores the basename only (path-leak guard),
+    // so the bytes must survive somewhere re-verifiable by the sha256. Copy
+    // into <ledger-dir>/evidence-items/<sha256>.bin — the location is
+    // derivable from the hash column, so no new column or path persistence.
+    const ledgerDir = dirname(getCasefilePath());
+    const evidenceDir = ensureSafeStateDirectory(ledgerDir, ["evidence-items"]);
+    const durable = join(evidenceDir, `${sha256}.bin`);
+    if (!assertSafeRegularFile(durable, "Durable evidence artifact")) {
+      writeSafeFileExclusive(durable, artifact.bytes);
+    } else {
+      const durableHash = createHash("sha256")
+        .update(readSafeFile(durable, "Durable evidence artifact"))
+        .digest("hex");
+      if (durableHash !== sha256) {
+        throw new Error(`Durable evidence artifact hash mismatch: ${durable}`);
+      }
     }
-    artifactPath = basename(input.artifactPath);
-    sha256 = createHash("sha256").update(readFileSync(input.artifactPath)).digest("hex");
   }
 
   const item: EvidenceItem = {
@@ -1621,6 +1945,8 @@ export function updateCaseResult(id: string, update: CaseUpdate): CaseUpdateResu
         pocVerified: undefined,
         disconfirmationVerified: undefined,
         controlVerified: undefined,
+        confirmerVerdict: undefined,
+        pendingConfirmation: undefined,
       };
     }
 
@@ -1682,67 +2008,188 @@ export function updateCaseResult(id: string, update: CaseUpdate): CaseUpdateResu
   });
 }
 
-export type PocVerification = PocVerificationRecord & {
-  /** True iff child output capture was complete. False on maxBuffer/timeouts/spawn failures. */
-  outputComplete?: boolean;
-  /** Harness mode used for the run: poc, control, or disconfirmation. */
-  mode?: string;
-  /** Target passed to the PoC through PI_POC_TARGET. */
-  target?: string;
-  /**
-   * Sanitized but UNTRUNCATED output, used for marker presence/absence
-   * checks. Never persisted to the ledger (stripRaw drops it) — a cheating
-   * script must not hide its marker in the slice, and the DB must not grow
-   * with megabytes of run output.
-   */
-  rawOutput?: string;
-};
-
-/** Drop the transient rawOutput before persisting a verification record. */
-function stripRaw(v: PocVerification): PocVerificationRecord {
-  const { rawOutput: _raw, ...rest } = v;
-  return rest;
+function validateRunEvidence(run: PocEvidenceRun, label: string): void {
+  if (!run.completed) {
+    throw new Error(`${label} did not complete; a crash is not evidence`);
+  }
+  if (!run.outputComplete) {
+    throw new Error(`${label} output capture was incomplete; evidence checks are unsafe`);
+  }
+  if (run.exitCode !== 0) {
+    throw new Error(
+      `${label} exited with ${run.exitCode}; exit 0 is required for a complete run but is never sufficient proof`,
+    );
+  }
+  if (!run.evidence || !run.evidenceSha256) {
+    throw new Error(
+      `${label} has no evidence.json — the PoC must write evidence to $PI_POC_EVIDENCE_DIR`,
+    );
+  }
+  if (!evidenceNonceMatches(run.evidence, run.nonce)) {
+    throw new Error(`${label} evidence nonce mismatch — evidence not bound to this run`);
+  }
+  const parsed = parsePoCEvidence(run.evidence);
+  if (!parsed.ok) {
+    throw new Error(`${label} evidence contract invalid: ${parsed.error}`);
+  }
+  if (!run.evidencePath) {
+    throw new Error(`${label} has no durable evidencePath; ephemeral evidence cannot confirm`);
+  }
+  const artifact = readWorkspaceArtifact(run.evidencePath);
+  if (artifact.bytes.byteLength > POC_EVIDENCE_MAX_BYTES) {
+    throw new Error(
+      `${label} durable evidence exceeds ${POC_EVIDENCE_MAX_BYTES} bytes; evidence cannot be revalidated safely`,
+    );
+  }
+  const durableHash = createHash("sha256").update(artifact.bytes).digest("hex");
+  if (durableHash !== run.evidenceSha256) {
+    throw new Error(`${label} durable evidence hash does not match evidenceSha256`);
+  }
+  let durableRaw: unknown;
+  try {
+    durableRaw = JSON.parse(artifact.bytes.toString("utf8"));
+  } catch (error) {
+    throw new Error(`${label} durable evidence is not valid JSON: ${(error as Error).message}`);
+  }
+  const durable = parsePoCEvidence(durableRaw);
+  if (!durable.ok) {
+    throw new Error(`${label} durable evidence contract invalid: ${durable.error}`);
+  }
+  if (
+    normalizeEvidence(durable.evidence) !== normalizeEvidence(run.evidence) ||
+    JSON.stringify(durable.evidence.observations) !== JSON.stringify(run.evidence.observations)
+  ) {
+    throw new Error(`${label} durable evidence bytes do not match the stored evidence object`);
+  }
 }
 
-function assertVerificationRecord(
-  label: string,
-  v: PocVerification | undefined,
-  expectedMode: string,
-  expectedTarget: string,
-): asserts v is PocVerification {
-  if (!v) throw new Error(`${label} verification is required`);
-  if (!v.path || typeof v.path !== "string") throw new Error(`${label} verification path missing`);
-  if (!Number.isInteger(v.exitCode)) throw new Error(`${label} verification exitCode invalid`);
-  if (!v.ranAt || Number.isNaN(Date.parse(v.ranAt))) {
-    throw new Error(`${label} verification ranAt must be an ISO timestamp`);
-  }
-  if (typeof v.sandbox !== "boolean") throw new Error(`${label} verification sandbox flag missing`);
-  if (v.completed !== true) throw new Error(`${label} verification did not complete`);
-  if (v.outputComplete !== true) {
+/** Determinism + differential on normalized evidence (nonce/observations stripped). */
+function assertEvidenceDifferential(bundle: PendingConfirmation): void {
+  const [r1, r2] = bundle.targetRuns;
+  if (normalizeEvidence(r1.evidence) !== normalizeEvidence(r2.evidence)) {
+    throw new Error(
+      "Target runs produced inconsistent evidence — the exploit did not reproduce deterministically",
+    );
+  }
+  if (normalizeEvidence(r1.evidence) === normalizeEvidence(bundle.controlRun.evidence)) {
     throw new Error(
-      `${label} verification output capture was incomplete; marker checks are unsafe`,
+      "Control run produced identical evidence to the target — the claimed impact is not target-dependent",
     );
   }
-  if (typeof v.rawOutput !== "string") {
-    throw new Error(`${label} verification rawOutput is required for full-output marker checks`);
+}
+
+function assertMachineConfirmation(bundle: PendingConfirmation): void {
+  const oob = bundle.callbackVerified;
+  if (oob?.attempted) {
+    if (oob.targetHits === 0) {
+      throw new Error(
+        `OOB VERIFY FAILED: no interaction with the target-run callback token. ${oob.note}`,
+      );
+    }
+    if (oob.controlHits > 0) {
+      throw new Error(
+        `OOB VERIFY FAILED: the control-run callback token received ${oob.controlHits} interaction(s) — the callback is not target-dependent. ${oob.note}`,
+      );
+    }
+    if (oob.sourceSeparated !== true) {
+      throw new Error(
+        "OOB VERIFY FAILED: callback source separation was not established. " +
+          "A loopback listener reachable by the PoC is diagnostic telemetry, not proof that the target caused the interaction.",
+      );
+    }
+    return;
   }
-  if (v.mode !== expectedMode) {
+
+  assertHarnessTargetOnly(
+    bundle.harnessVerified,
+    "HARNESS DIFFERENTIAL FAILED",
+    "no machine-owned target/control replay was recorded",
+  );
+}
+
+function assertHarnessTargetOnly(
+  harness: HarnessVerifyResult | undefined,
+  label: string,
+  missingNote: string,
+): asserts harness is HarnessVerifyResult {
+  if (
+    !harness?.attempted ||
+    harness.pass !== true ||
+    harness.differential !== "target_only" ||
+    harness.target?.matched !== true ||
+    harness.control?.matched !== false
+  ) {
+    throw new Error(`${label}: ${harness?.note ?? missingNote}`);
+  }
+}
+
+function assertHarnessCanary(
+  harness: HarnessVerifyResult | undefined,
+  required: boolean,
+  label: string,
+): void {
+  if (!required) return;
+  if (
+    harness?.canary?.attempted !== true ||
+    harness.canary.pass !== true ||
+    harness.canary.targetObserved !== true ||
+    harness.canary.controlObserved !== false ||
+    harness.proofStrength !== "canary_differential"
+  ) {
+    throw new Error(`${label}: ${harness?.canary?.note ?? "required canary transcript missing"}`);
+  }
+}
+
+function assertMainAgentVerification(
+  bundle: PendingConfirmation,
+  verification: MainAgentVerification | undefined,
+): asserts verification is MainAgentVerification {
+  if (!verification) {
     throw new Error(
-      `${label} verification mode mismatch: expected ${expectedMode}, got ${v.mode ?? "unset"}`,
+      "MAIN-AGENT REPLAY REQUIRED: ConfirmFinding must produce a fresh harness-owned target/control transcript",
     );
   }
-  if (v.target !== expectedTarget) {
+  const at = Date.parse(verification.at);
+  const bundleAt = Date.parse(bundle.ranAt);
+  const now = Date.now();
+  if (
+    !Number.isFinite(at) ||
+    !Number.isFinite(bundleAt) ||
+    at < bundleAt ||
+    at > now + 30_000 ||
+    now - at > 5 * 60 * 1000
+  ) {
     throw new Error(
-      `${label} verification target mismatch: expected ${expectedTarget}, got ${v.target ?? "unset"}`,
+      "MAIN-AGENT REPLAY FAILED: transcript timestamp must be valid, newer than phase 1, and no more than 5 minutes old",
     );
   }
+  assertHarnessTargetOnly(
+    verification.result,
+    "MAIN-AGENT REPLAY FAILED",
+    "no fresh phase-2 target/control replay was recorded",
+  );
+  assertHarnessCanary(
+    verification.result,
+    bundle.targetRuns[0].evidence.verify.canary !== undefined,
+    "MAIN-AGENT CANARY FAILED",
+  );
+  const targetUrl = verification.result.target?.url;
+  const controlUrl = verification.result.control?.url;
+  const targetIdentity = bundle.targetRuns[0].target;
+  if (!targetUrl || verifyUrlBindingError(targetUrl, targetIdentity)) {
+    throw new Error("MAIN-AGENT REPLAY FAILED: target transcript is not bound to the case target");
+  }
+  if (!controlUrl || verifyUrlBindingError(controlUrl, bundle.controlTarget)) {
+    throw new Error("MAIN-AGENT REPLAY FAILED: control transcript is not bound to control_target");
+  }
 }
 
 /**
- * Gate for promotion to confirmed: case must exist, be investigating, and have
- * poc/evidence/impact/severity. Returns the record when promotable, throws
- * otherwise. Exported so PromoteFinding can validate BEFORE paying for a
- * (potentially slow) sandboxed PoC run.
+ * Gate for phase 1 of promotion: case must exist, be investigating, and have
+ * poc/evidence/impact/severity/target. The disconfirmation is provided by the
+ * main agent at confirm time, so it is NOT a precondition here. Returns the
+ * record when promotable, throws otherwise. Exported so PromoteFinding can
+ * validate BEFORE paying for (potentially slow) sandboxed PoC runs.
  */
 export function assertPromotable(id: string): CaseRecord {
   const current = getCaseById(id);
@@ -1750,7 +2197,7 @@ export function assertPromotable(id: string): CaseRecord {
     throw new Error(`Case not found: ${id}`);
   }
   if (current.status !== "investigating") {
-    throw new Error(`promote_finding requires an investigating case (current: ${current.status})`);
+    throw new Error(`PromoteFinding requires an investigating case (current: ${current.status})`);
   }
   if (!current.poc) {
     throw new Error("CONFIRMED requires poc; set poc on the case first");
@@ -1769,15 +2216,10 @@ export function assertPromotable(id: string): CaseRecord {
       "CONFIRMED requires target (what host/repo/scope this affects); set target on the case first",
     );
   }
-  if (!current.disconfirmation) {
-    throw new Error(
-      "CONFIRMED requires disconfirmation (your attempt to disprove the finding); set disconfirmation on the case first",
-    );
-  }
   // Evidence-chain closure: the observation item must be ARTIFACT-BACKED. A
   // summary-only observation is agent prose about itself — promotion requires
   // a real file with its SHA-256 as the initial signal. (The reproduction item
-  // is always artifact-backed: the PoC gate writes it from verification.path.)
+  // is always artifact-backed: the gate writes it from the evidence hash.)
   if (!current.evidenceItems.some((e) => e.role === "observation" && e.sha256)) {
     throw new Error(
       "Evidence chain incomplete: CONFIRMED requires an artifact-backed observation evidence item " +
@@ -1788,171 +2230,302 @@ export function assertPromotable(id: string): CaseRecord {
   return current;
 }
 
-export function promoteFindingResult(
-  id: string,
-  verification: PocVerification,
-  disconfirmationVerification?: PocVerification,
-  controlVerification?: PocVerification,
-  marker?: string,
-  controlLivenessMarker?: string,
-): CaseUpdateResult {
+/**
+ * Phase 1: record the harness-observed evidence bundle on the case. The whole
+ * contract is validated here — same-file control, nonce binding, run
+ * completion, determinism across the two target runs, and the target/control
+ * differential — so a bundle that cannot promote is rejected before the
+ * main agent performs phase-2 review.
+ */
+export function storePendingConfirmation(id: string, bundle: PendingConfirmation): CaseRecord {
   const db = getDb();
   return withImmediateTransaction(db, () => {
-    const current = assertPromotable(id);
-    const caseTarget = current.target ?? "";
-
-    // Anti-cheat, enforced at the ledger level (not just the tool) for EVERY
-    // promotion — sandboxed and live alike. The control run must be the same
-    // script against a DISTINCT baseline target, with complete captured output.
-    const liveness = controlLivenessMarker?.trim();
-    if (!liveness) {
+    const current = getCaseById(id);
+    if (!current) throw new Error(`Case not found: ${id}`);
+    if (current.status !== "investigating") {
       throw new Error(
-        "Every promotion requires controlLivenessMarker: a non-empty string the control run must print " +
-          "after reaching its target. PromoteFinding requires control_path + control_liveness_marker.",
+        `Pending confirmation requires an investigating case (current: ${current.status})`,
       );
     }
-    const verificationMarker = marker?.trim();
-    if (!verificationMarker) {
+    if (bundle.caseId !== id) throw new Error("Pending confirmation caseId mismatch");
+    if (bundle.targetRuns.length !== 2 || !bundle.controlRun) {
+      throw new Error("Pending confirmation requires two target runs and one control run");
+    }
+    if (!bundle.pocPath || !bundle.controlPath || !bundle.controlTarget) {
+      throw new Error("Pending confirmation requires pocPath, controlPath, and controlTarget");
+    }
+    // Control-target binding (machine-verified here, not just in the tool
+    // layer): the control run must actually have targeted the declared
+    // control_target, that target must differ from the target runs' target,
+    // and the control target must differ from the case's target — otherwise
+    // "the control demonstrated nothing on the vulnerable target" passes.
+    const targetRunTarget = bundle.targetRuns[0]?.target;
+    if (!targetRunTarget || bundle.targetRuns.some((r) => r.target !== targetRunTarget)) {
       throw new Error(
-        "Every promotion requires verificationMarker: the marker the PoC must print after exploitation. " +
-          "promoteFindingResult refuses to promote on exit 0 alone.",
+        "Pending confirmation requires both target runs against the same case target",
       );
     }
-
-    assertVerificationRecord("PoC", verification, "poc", caseTarget);
-    if (!controlVerification?.target?.trim()) {
-      throw new Error("Every promotion requires a controlVerification target");
+    if (!bundle.controlRun.target || bundle.controlRun.target !== bundle.controlTarget) {
+      throw new Error(
+        "CONTROL BINDING FAILED: controlRun.target must equal control_target — a control run " +
+          "against a different host than the one declared proves nothing.",
+      );
     }
-    if (controlVerification.target === caseTarget) {
+    if (bundle.controlRun.target === targetRunTarget) {
       throw new Error(
-        "Every promotion requires a distinct control target; the control run cannot use the case target",
+        "CONTROL BINDING FAILED: the control run targeted the same host as the target runs — " +
+          "the claimed impact is not target-dependent.",
       );
     }
-    assertVerificationRecord("Control", controlVerification, "control", controlVerification.target);
-    assertVerificationRecord(
-      "Disconfirmation",
-      disconfirmationVerification,
-      "disconfirmation",
-      caseTarget,
-    );
-
-    if (verification.exitCode !== 0) {
+    if (bundle.controlTarget === current.target) {
       throw new Error(
-        `PoC verification failed (exit ${verification.exitCode}); cannot promote to confirmed`,
+        "CONTROL BINDING FAILED: control_target must differ from the case target; a control run " +
+          "against the vulnerable target proves nothing.",
       );
     }
-
-    // Same-file contract: the control must be the SAME script as the PoC
-    // (differing only via PI_POC_MODE / PI_POC_TARGET). The tool enforces this
-    // before running; the ledger re-checks so a direct caller cannot bypass it.
+    // Same-file contract re-checked at store time (the tool already checked).
     let pocHash: string | undefined;
     let controlHash: string | undefined;
     try {
-      pocHash = createHash("sha256").update(readFileSync(verification.path)).digest("hex");
-      controlHash = createHash("sha256")
-        .update(readFileSync(controlVerification.path))
-        .digest("hex");
+      pocHash = createHash("sha256").update(readFileSync(bundle.pocPath)).digest("hex");
+      controlHash = createHash("sha256").update(readFileSync(bundle.controlPath)).digest("hex");
     } catch {
       pocHash = undefined;
       controlHash = undefined;
     }
     if (!pocHash || !controlHash || pocHash !== controlHash) {
       throw new Error(
-        "Every promotion requires controlVerification from the SAME script as the PoC " +
-          "(sha256 of controlVerification.path must equal sha256 of verification.path). " +
-          "A separately written control file proves nothing.",
+        "CONTROL CHECK FAILED: control_path must be the SAME script as poc_path " +
+          "(sha256 mismatch). A separately written control file proves nothing.",
       );
     }
-
-    const controlOutput = controlVerification.rawOutput ?? "";
-    if (controlOutput.includes(verificationMarker) || !controlOutput.includes(liveness)) {
-      throw new Error(
-        "Every promotion requires a valid controlVerification: a control-target run of the same " +
-          `PoC whose output does not contain the marker "${verificationMarker}"` +
-          ` and whose output DOES contain the control liveness marker "${liveness}"` +
-          " (the control must actually reach its target — a failed/early control is not a clean verdict)" +
-          ". PromoteFinding requires control_path + control_liveness_marker.",
+    if (bundle.pocSha256 && bundle.pocSha256 !== pocHash) {
+      throw new Error("pocSha256 does not match the PoC file on disk");
+    }
+    for (const run of [...bundle.targetRuns, bundle.controlRun]) {
+      validateRunEvidence(run, `${run.mode} run`);
+    }
+    assertEvidenceDifferential(bundle);
+    if (!bundle.callbackVerified?.attempted) {
+      for (const run of bundle.targetRuns) {
+        const bindingError = verifyUrlBindingError(run.evidence.verify.url, targetRunTarget);
+        if (bindingError) throw new Error(`TARGET BINDING FAILED: ${bindingError}`);
+      }
+      const controlBindingError = verifyUrlBindingError(
+        bundle.controlRun.evidence.verify.url,
+        bundle.controlTarget,
       );
+      if (controlBindingError) {
+        throw new Error(`CONTROL BINDING FAILED: ${controlBindingError}`);
+      }
     }
+    // A clean exit and model-authored evidence are necessary inputs, never the
+    // proof. Promotion requires a harness-observed target/control differential
+    // or a harness-owned OOB interaction differential.
+    assertMachineConfirmation(bundle);
+
+    const next = buildRecord({ pendingConfirmation: bundle }, current);
+    validateCase(next);
+    upsertCase(db, next);
+    return next;
+  });
+}
 
-    const pocOutput = verification.rawOutput ?? "";
-    if (!pocOutput.includes(verificationMarker)) {
+/**
+ * Phase 2: commit (or refuse) the promotion on the main agent's verdict.
+ *
+ * CONFIRMED requires the full bundle to still hold (completion, nonce,
+ * determinism, differential), the PoC script to be unchanged since the runs
+ * (pocSha256 — otherwise the main agent reviewed different bytes), and a
+ * verdict accompanied by a fresh harness-owned target-only replay, a concrete
+ * review note, and a disconfirmation attempt. NOT_CONFIRMED records the
+ * verdict and keeps the case investigating — no tie-breaker.
+ */
+export function applyConfirmationResult(
+  id: string,
+  verdictInput: MainAgentVerdict,
+  phase2Verification?: MainAgentVerification,
+  authority: { startedAsSubagent: boolean } = {
+    startedAsSubagent: PROCESS_STARTED_AS_SUBAGENT || process.env.PI_SUBAGENT_CHILD === "1",
+  },
+): CaseUpdateResult {
+  if (authority.startedAsSubagent) {
+    throw new Error(
+      "ConfirmFinding is reserved for the main/coordinator agent; worker processes cannot commit confirmation",
+    );
+  }
+  const db = getDb();
+  return withImmediateTransaction(db, () => {
+    const current = getCaseById(id);
+    if (!current) throw new Error(`Case not found: ${id}`);
+    if (current.status !== "investigating") {
+      throw new Error(`ConfirmFinding requires an investigating case (current: ${current.status})`);
+    }
+    const bundle = current.pendingConfirmation;
+    if (!bundle) {
+      throw new Error("No pending confirmation on this case — run PromoteFinding first");
+    }
+    // Fail closed on an unparseable ranAt: Date.parse(garbage) is NaN, and
+    // NaN > TTL is false — a malformed timestamp must NOT make the bundle
+    // immortal. Treat it as expired (re-run PromoteFinding for a fresh one).
+    const ranAtMs = Date.parse(bundle.ranAt);
+    if (!Number.isFinite(ranAtMs) || Date.now() - ranAtMs > PENDING_CONFIRM_TTL_MS) {
       throw new Error(
-        `PoC verification output does not contain the verification marker "${verificationMarker}"; ` +
-          "exit 0 alone cannot promote to confirmed",
+        "Pending confirmation expired or has an invalid timestamp (1h TTL) — re-run PromoteFinding for a fresh bundle",
       );
     }
+    const parsed = validateMainAgentVerdict(verdictInput);
+    if (!parsed.ok) throw new Error(`Invalid main-agent confirmation verdict: ${parsed.error}`);
+    const verdict = parsed.verdict;
+    const canaryRequested = bundle.targetRuns[0].evidence.verify.canary !== undefined;
+    if (verdict.verdict === "CONFIRMED") {
+      if (canaryRequested && verdict.canary_assessment !== "verified") {
+        throw new Error(
+          "CONFIRMED canary mismatch: evidence requested a harness canary, so canary_assessment must be verified",
+        );
+      }
+      if (!canaryRequested && verdict.canary_assessment !== "not_applicable") {
+        throw new Error(
+          "CONFIRMED canary mismatch: this evidence has no canary template; record canary_assessment=not_applicable and explain why",
+        );
+      }
+    }
+    const recorded: MainAgentVerdictRecord = {
+      ...verdict,
+      at: new Date().toISOString(),
+      reviewer: "main_agent",
+      phase2Verification: verdict.verdict === "CONFIRMED" ? phase2Verification : undefined,
+      proofStrength:
+        verdict.verdict === "CONFIRMED"
+          ? canaryRequested
+            ? "canary_differential"
+            : "predicate_differential"
+          : undefined,
+    };
 
-    if (disconfirmationVerification.exitCode === 0) {
-      throw new Error(
-        "Every promotion requires an executed disconfirmation run that completed and exited non-zero " +
-          "(the finding survived the attempt to disprove it). PromoteFinding requires disconfirmation_path for every promotion.",
+    if (verdict.verdict === "NOT_CONFIRMED") {
+      const note = `main agent NOT_CONFIRMED${verdict.model ? ` (${verdict.model})` : ""}: ${verdict.reasoning}`;
+      const next = buildRecord(
+        {
+          confirmerVerdict: recorded,
+          pendingConfirmation: undefined,
+          assumptions: [...(current.assumptions ?? []), note],
+        },
+        current,
       );
+      // buildRecord's nullish fallback preserves the old value; consume the
+      // rejected attempt explicitly so a retry must produce fresh evidence.
+      next.pendingConfirmation = undefined;
+      validateCase(next);
+      upsertCase(db, next);
+      return { record: next, changed: true };
     }
 
-    // Machine-recorded reproduction evidence: the PoC gate itself writes the
-    // artifact-backed evidence item — confirmation is anchored to a real file
-    // with its SHA-256, not to agent prose in the evidence field.
-    let pocSha256: string | undefined;
+    // CONFIRMED — re-validate the whole bundle (defense in depth; the case may
+    // have been touched between phase 1 and the verdict).
+    for (const run of [...bundle.targetRuns, bundle.controlRun]) {
+      validateRunEvidence(run, `${run.mode} run`);
+    }
+    assertEvidenceDifferential(bundle);
+    assertMachineConfirmation(bundle);
+    assertHarnessCanary(bundle.harnessVerified, canaryRequested, "PHASE-1 CANARY FAILED");
+    let pocHash: string | undefined;
     try {
-      pocSha256 = createHash("sha256").update(readFileSync(verification.path)).digest("hex");
+      pocHash = createHash("sha256").update(readFileSync(bundle.pocPath)).digest("hex");
     } catch {
-      pocSha256 = undefined;
+      pocHash = undefined;
+    }
+    if (!pocHash || pocHash !== bundle.pocSha256) {
+      throw new Error(
+        "PoC script changed since the runs — re-run PromoteFinding (the main agent must review the exact bytes that ran)",
+      );
+    }
+    // The case target must still be the host the PoC ran against, and still
+    // differ from the control target. The evidence proves nothing about a
+    // target the case adopted after the runs.
+    const targetRun = bundle.targetRuns[0];
+    if (!current.target || current.target !== targetRun.target) {
+      throw new Error(
+        "Case target changed since the PoC runs — re-run PromoteFinding against the current target " +
+          `(bundle target: ${targetRun.target}, case target: ${current.target ?? "(none)"}).`,
+      );
+    }
+    if (current.target === bundle.controlTarget) {
+      throw new Error(
+        "Case target now equals the control target — the claimed impact is not target-dependent; " +
+          "re-run PromoteFinding with a distinct control_target.",
+      );
     }
 
-    // Cheap provenance guards on the observation item: it must be a DIFFERENT
-    // file than the PoC (same hash = the model re-used its PoC as "the initial
-    // signal"), a different basename, and it must predate the PoC run.
+    // The observation must predate the repro (provenance guard).
     const observation = current.evidenceItems.find((e) => e.role === "observation" && e.sha256);
-    if (observation) {
-      if (pocSha256 && observation.sha256 === pocSha256) {
-        throw new Error(
-          "Evidence chain invalid: the observation artifact is the same file as the PoC " +
-            "(identical sha256). The initial signal must be a separate captured artifact.",
-        );
-      }
-      if (observation.artifactPath && observation.artifactPath === basename(verification.path)) {
-        throw new Error(
-          "Evidence chain invalid: the observation artifact has the same basename as the PoC file. " +
-            "The initial signal must be a separate captured artifact.",
-        );
-      }
-      if (observation.createdAt > verification.ranAt) {
-        throw new Error(
-          "Evidence chain invalid: the observation item was recorded after the PoC ran " +
-            `(${observation.createdAt} > ${verification.ranAt}). The observation must predate the repro.`,
-        );
-      }
+    if (observation && observation.createdAt > bundle.targetRuns[0].ranAt) {
+      throw new Error(
+        "Evidence chain invalid: the observation item was recorded after the PoC ran " +
+          `(${observation.createdAt} > ${bundle.targetRuns[0].ranAt}). The observation must predate the repro.`,
+      );
     }
+
+    // Phase 1 proves the evidence floor. Phase 2 must freshly replay that same
+    // request inside the main agent's ConfirmFinding call; a caller-provided
+    // boolean is not accepted as proof of re-execution.
+    assertMainAgentVerification(bundle, phase2Verification);
+
     const reproductionItem: EvidenceItem = {
-      id: `ev_${stableShortId(`${id}\nreproduction\n${verification.ranAt}`)}`,
+      id: `ev_${stableShortId(`${id}\nreproduction\n${targetRun.ranAt}`)}`,
       caseId: id,
       role: "reproduction",
-      artifactPath: basename(verification.path),
-      sha256: pocSha256,
-      summary: `PoC run exit ${verification.exitCode} (sandbox: ${verification.sandbox}) — verification marker present in output`,
-      createdAt: verification.ranAt,
+      // The runner preserves each run's evidence.json in a durable dir
+      // (.pi/poc-evidence/) — the artifact the hash was computed over still
+      // exists, so the item stays artifact-backed and re-verifiable.
+      artifactPath: targetRun.evidencePath ? basename(targetRun.evidencePath) : "evidence.json",
+      sha256: targetRun.evidenceSha256,
+      summary: `PoC evidence accepted (2 target runs + control; ${recorded.proofStrength}) — main agent semantic confirmation${verdict.model ? ` (${verdict.model})` : ""}`,
+      createdAt: targetRun.ranAt,
     };
 
     const newEvidence =
       (current.evidence ? `${current.evidence}\n\n` : "") +
-      `### PoC Execution Capture (${verification.ranAt})\n` +
-      `- **Exit Code:** ${verification.exitCode}\n` +
-      `- **Sandbox:** ${verification.sandbox ? "yes" : "no"}\n` +
-      `- **Target:** ${verification.target}\n` +
-      `#### Execution Output\n\`\`\`\n${verification.output ?? ""}\n\`\`\``;
+      `### PoC Execution Capture (${targetRun.ranAt})\n` +
+      `- **Evidence sha256:** ${targetRun.evidenceSha256}\n` +
+      `- **Target:** ${targetRun.target}\n` +
+      `- **Machine evidence:** ${recorded.proofStrength} (a differential is not by itself proof of exploitation)\n` +
+      `- **Main-agent reviewer:** ${verdict.model ?? "unknown model"} — semantic confirmation\n` +
+      `#### Target Run Output\n\`\`\`\n${targetRun.output ?? ""}\n\`\`\``;
 
     const update: NormalizedCaseInput = {
       status: "confirmed",
-      pocVerified: stripRaw(verification),
-      disconfirmationVerified: stripRaw(disconfirmationVerification),
-      controlVerified: stripRaw(controlVerification),
+      pocVerified: {
+        path: bundle.pocPath,
+        exitCode: targetRun.exitCode,
+        ranAt: targetRun.ranAt,
+        output: targetRun.output,
+        sandbox: targetRun.sandbox,
+        completed: true,
+        outputComplete: true,
+        mode: "poc",
+        target: targetRun.target,
+      },
+      controlVerified: {
+        path: bundle.controlPath,
+        exitCode: bundle.controlRun.exitCode,
+        ranAt: bundle.controlRun.ranAt,
+        output: bundle.controlRun.output,
+        sandbox: bundle.controlRun.sandbox,
+        completed: true,
+        outputComplete: true,
+        mode: "control",
+        target: bundle.controlRun.target,
+      },
+      disconfirmation: verdict.disconfirmation_attempt,
+      confirmerVerdict: recorded,
+      pendingConfirmation: undefined,
       evidence: newEvidence,
     };
 
     const next = buildRecord(update, current);
+    next.pendingConfirmation = undefined; // buildRecord's ?? existing keeps it; clear explicitly
     validateCase(next);
-
     insertEvidenceItem(db, reproductionItem);
     upsertCase(db, next);
     next.evidenceItems = [...(next.evidenceItems ?? []), reproductionItem];
@@ -2031,8 +2604,21 @@ function eTLDPlus1(host: string): string {
   return parts.slice(-2).join(".");
 }
 
+/**
+ * Ruled-out phrasings that must not contribute to chain matching. Sentence
+ * granularity keeps the positive signals intact: "no CSRF token on /transfer"
+ * (a reason XSS→state-change chains) is NOT dropped — only explicit
+ * "this class is not a finding" sentences are.
+ */
+const CHAIN_NEGATION_RE =
+  /\b(not vulnerable|not susceptible|not exploitable|not present|not found|not affected|ruled out|no vulnerability|no vuln|no evidence of|absence of|false positive|not a finding|no issue found|dismissed|non-?vulnerable|not reachable)\b/i;
+
 function chainText(c: CaseRecord): string {
-  return [c.title, c.bugClass ?? "", c.evidence ?? ""].join(" ");
+  const raw = [c.title, c.bugClass ?? "", c.evidence ?? ""].join(" ");
+  return raw
+    .split(/[.;\n]+/)
+    .filter((s) => !CHAIN_NEGATION_RE.test(s))
+    .join(" ");
 }
 
 function hasChainClass(c: CaseRecord, re: RegExp): boolean {
@@ -2062,23 +2648,29 @@ function sameAssetOrRelated(a: CaseRecord, b: CaseRecord): boolean {
   return eTLDPlus1(ta) === eTLDPlus1(tb);
 }
 
-/**
- * Scan non-terminal cases for exploitable chains (CyberStrike-style detection
- * over XPI's case records). Emits ranked suggestions; the agent decides
- * whether to CaseLink or open an escalation case.
- */
 export function suggestChains(caseId?: string): ChainSuggestion[] {
   // Pair over ALL non-terminal cases; the caseId filter narrows the RESULTS
   // to suggestions involving that case (filtering the inputs first would drop
   // unlinked partner cases and kill cross-case pairing).
   const cases = readCasefile().filter((c) => c.status !== "killed" && c.status !== "reported");
+  // Already-linked pairs are existing knowledge, not a missed combination —
+  // suggesting them again is noise. One query for every link row.
+  const linkedPairs = new Set<string>();
+  const linkRows = getDb().prepare("SELECT source_id, target_id FROM case_links").all() as {
+    source_id: string;
+    target_id: string;
+  }[];
+  for (const row of linkRows) linkedPairs.add([row.source_id, row.target_id].sort().join("+"));
   const suggestions: ChainSuggestion[] = [];
   const seen = new Set<string>();
   const confirmed = (c: CaseRecord) => c.status === "confirmed";
   const confidenceFor = (a: CaseRecord, b?: CaseRecord) => {
     const both = confirmed(a) && (!b || confirmed(b));
     const one = confirmed(a) || (b ? confirmed(b) : false);
-    return both ? 90 : one ? 75 : 55;
+    const anyHypothesis = a.status === "hypothesis" || (b ? b.status === "hypothesis" : false);
+    if (both) return 90;
+    if (anyHypothesis) return 40; // unproven primitives chain weakly
+    return one ? 75 : 60;
   };
   const add = (
     pattern: ChainPattern,
@@ -2087,6 +2679,7 @@ export function suggestChains(caseId?: string): ChainSuggestion[] {
     rationale: string,
     kind?: CaseLinkKind,
   ) => {
+    if (b && linkedPairs.has([a.id, b.id].sort().join("+"))) return; // already known
     const key = b ? `${pattern}:${[a.id, b.id].sort().join("+")}` : `${pattern}:${a.id}`;
     if (seen.has(key)) return;
     seen.add(key);
@@ -2360,12 +2953,16 @@ function buildCaseWhere(options: CaseSearchOptions): {
 
   const query = options.query?.trim().toLowerCase();
   if (query) {
-    const likeParam = `%${query}%`;
+    // Escape LIKE wildcards so a query containing % or _ matches literally
+    // instead of acting as a pattern ("100%" must not match "1000"). The
+    // backslash is the escape char, so it is escaped first.
+    const escaped = query.replace(/[\\%_]/g, (m) => `\\${m}`);
+    const likeParam = `%${escaped}%`;
     if (options.field) {
-      where.push(`lower(${options.field}) LIKE ?`);
+      where.push(`lower(${options.field}) LIKE ? ESCAPE '\\'`);
       params.push(likeParam);
     } else {
-      const ors = SEARCH_FIELD_VALUES.map((c) => `lower(${c}) LIKE ?`).join(" OR ");
+      const ors = SEARCH_FIELD_VALUES.map((c) => `lower(${c}) LIKE ? ESCAPE '\\'`).join(" OR ");
       where.push(`(${ors})`);
       for (let i = 0; i < SEARCH_FIELD_VALUES.length; i++) params.push(likeParam);
     }
@@ -2405,8 +3002,12 @@ export function searchCases(options: CaseSearchOptions = {}): {
   total: number;
 } {
   const db = getDb();
-  const limit = Math.max(1, Math.min(options.limit ?? 50, 200));
-  const offset = Math.max(0, options.offset ?? 0);
+  // NaN is not clamped by Math.min/max (it passes through) and SQLite binds it
+  // as NULL, which disables LIMIT — fall back to the default instead.
+  const rawLimit = Number.isFinite(options.limit) ? options.limit : undefined;
+  const rawOffset = Number.isFinite(options.offset) ? options.offset : undefined;
+  const limit = Math.max(1, Math.min(rawLimit ?? 50, 200));
+  const offset = Math.max(0, rawOffset ?? 0);
 
   const { whereSql, orderSql, params } = buildCaseWhere(options);
 
@@ -2496,7 +3097,10 @@ export function formatCaseDetail(record: CaseRecord): string {
     } else if (Array.isArray(val)) {
       display = val.join(", ");
     } else if (typeof val === "object") {
-      display = JSON.stringify(val);
+      // Path-leak guard (consistent with buildCompleteRecord): verification
+      // objects and the pending bundle carry local script/evidence paths —
+      // show basenames only.
+      display = JSON.stringify(redactPaths(val));
     } else {
       display = String(val);
     }
@@ -2528,25 +3132,39 @@ const MAX_ARTIFACT_CHARS = 100_000;
  * must not balloon the report context into megabytes. */
 const MAX_TOTAL_ARTIFACT_CHARS = 400_000;
 
+/**
+ * Recursively redact local filesystem paths to basenames in a serialized
+ * object. Covers the verification records (path), the pending confirmation
+ * bundle (pocPath/controlPath) and preserved evidence copies (evidencePath) —
+ * the context bundle must never leak the researcher's local paths.
+ */
+function redactPaths(value: unknown, seen = new Set<object>()): unknown {
+  if (Array.isArray(value)) return value.map((v) => redactPaths(v, seen));
+  if (typeof value !== "object" || value === null) return value;
+  if (seen.has(value)) return value;
+  seen.add(value);
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(value)) {
+    if (
+      typeof v === "string" &&
+      (k === "path" || k === "pocPath" || k === "controlPath" || k === "evidencePath")
+    ) {
+      out[k] = basename(v) || v;
+    } else {
+      out[k] = redactPaths(v, seen);
+    }
+  }
+  return out;
+}
+
 function buildCompleteRecord(current: CaseRecord): string {
   const rows: string[] = [];
   for (const [k, v] of Object.entries(current)) {
     if (v === undefined || v === null || v === "") continue;
-    let display = typeof v === "object" ? JSON.stringify(v, null, 2) : String(v);
-    // Path-leak guard: the verification objects carry the researcher's local
-    // PoC/disconfirmation/control script paths — show basenames only (the dedicated
-    // log sections below already render them as basenames).
-    if (
-      (k === "pocVerified" || k === "disconfirmationVerified" || k === "controlVerified") &&
-      v &&
-      typeof v === "object"
-    ) {
-      const redacted = {
-        ...(v as Record<string, unknown>),
-        path: basename((v as { path?: string }).path ?? ""),
-      };
-      display = JSON.stringify(redacted, null, 2);
-    }
+    // Path-leak guard: verification objects + the pending bundle carry the
+    // researcher's local PoC/disconfirmation/control/evidence paths — show
+    // basenames only (the dedicated log sections do the same).
+    const display = typeof v === "object" ? JSON.stringify(redactPaths(v), null, 2) : String(v);
     rows.push(`- **${k}:** ${display.replace(/\n/g, "\n  ")}`);
   }
   return rows.join("\n");
@@ -2627,11 +3245,13 @@ function buildScratchpadSection(caseId: string): string {
     : "No scratchpad run found containing this case id (manual/CTF run without pipeline artifacts).";
 }
 
-export function writeCaseContext(id: string): {
+export type CaseContextResult = {
   path: string;
   contextPath: string;
   record: CaseRecord;
-} {
+};
+
+export function writeCaseContext(id: string): CaseContextResult {
   const current = getCaseById(id);
   if (!current) throw new Error(`Case not found: ${id}`);
   if (current.status !== "confirmed" && current.status !== "reported") {
@@ -2702,13 +3322,13 @@ export function writeCaseContext(id: string): {
     current.pocVerified
       ? mdSection(
           "PoC Verification Log",
-          `### PoC Run Verification\n- **Timestamp:** ${current.pocVerified.ranAt}\n- **Script:** \`${basename(current.pocVerified.path)}\`\n- **Sandbox:** ${current.pocVerified.sandbox ? "yes" : "no"}\n- **Exit Code:** ${current.pocVerified.exitCode}\n\n#### Output\n\`\`\`\n${current.pocVerified.output ?? ""}\n\`\`\``,
+          `### PoC Run Verification\n- **Timestamp:** ${current.pocVerified.ranAt}\n- **Script:** \`${basename(current.pocVerified.path)}\`\n- **Sandbox:** ${current.pocVerified.sandbox ? "yes" : "no"}\n- **Exit Code:** ${current.pocVerified.exitCode}\n- **Target:** ${current.pocVerified.target ?? "not recorded"}\n\n#### Output\n\`\`\`\n${current.pocVerified.output ?? ""}\n\`\`\``,
         )
       : undefined,
     current.controlVerified
       ? mdSection(
           "Control-Target Check (anti-cheat)",
-          `### Control Run Verification\n- **Timestamp:** ${current.controlVerified.ranAt}\n- **Script:** \`${basename(current.controlVerified.path)}\`\n- **Sandbox:** ${current.controlVerified.sandbox ? "yes" : "no"}\n- **Exit Code:** ${current.controlVerified.exitCode}\n- **Marker on control:** absent (required) — same PoC against a target lacking the vuln did NOT print the verification marker.\n\n#### Output\n\`\`\`\n${current.controlVerified.output ?? ""}\n\`\`\``,
+          `### Control Run Verification\n- **Timestamp:** ${current.controlVerified.ranAt}\n- **Script:** \`${basename(current.controlVerified.path)}\`\n- **Sandbox:** ${current.controlVerified.sandbox ? "yes" : "no"}\n- **Exit Code:** ${current.controlVerified.exitCode}\n- **Control target:** ${current.controlVerified.target ?? "not recorded"}\n- **Differential (machine-checked):** control evidence differs from the target runs' evidence — the claimed impact is target-dependent (assertEvidenceDifferential, re-checked at confirm).\n- **Note:** zero exit is necessary run integrity, never vulnerability proof; output markers are diagnostic only. The machine floor is the harness differential plus main-agent review.\n\n#### Output\n\`\`\`\n${current.controlVerified.output ?? ""}\n\`\`\``,
         )
       : undefined,
     mdSection("Disconfirmation Attempt", current.disconfirmation),