gentle-pi 1.0.2 → 1.0.4

package/README.md

@@ -13,9 +13,9 @@
 
 **Turn Pi from a powerful coding agent into a controlled development harness.**
 
-`gentle-pi` installs **el Gentleman** in Pi: a senior-architect operating layer for Spec-Driven Development, focused subagents, strict TDD evidence, reviewable work units, safety guards, and project/user skill discovery.
+`gentle-pi` installs **el Gentleman** in Pi: a senior-architect operating layer for Spec-Driven Development, focused subagents, strict TDD evidence, reviewable work units, safety guards, project/user skill discovery, and bounded native review.
 
-Pi already has strong tools. `gentle-pi` adds the discipline for using them well.
+Pi already has strong tools. `gentle-pi` adds the discipline for using them well, then binds review and delivery decisions to Git-derived evidence instead of agent narration.
 
 `gentle-pi` is the Pi-native package from the [Gentle-AI ecosystem](https://github.com/Gentleman-Programming/gentle-ai), built by [Gentleman Programming](https://github.com/Gentleman-Programming): the broader open-source project for turning AI coding agents into disciplined engineering environments with SDD workflows, skills, memory integrations, model routing, and review guardrails across multiple agents.
 
@@ -57,6 +57,8 @@ Most coding-agent sessions fail for operational reasons, not model reasons:
 | **Skill discovery registry**   | Maintains `.atl/skill-registry.md` from project and user skills so review/comment/PR workflows do not silently miss the right skill.          |
 | **Skill creation workflow**    | Provides the `gentle-ai-skill-creator`/`gentle-ai-skill-improver` skills, `/skill-creation` prompt, and packaged style guide for LLM-first skills. |
 | **Delivery skills**            | Includes issue-first PRs, chained PRs, work-unit commits, cognitive docs, comment writing, and Judgment Day review.                           |
+| **Bounded native review**      | Freezes one candidate, dispatches only controller-selected lenses, records native authority, and reuses the same content-bound receipt at delivery gates. |
+| **Verified native runtime**    | Provisions the exact package-local Gentle AI v2.1.4 binary, verifies pinned archive/binary integrity, and rejects PATH, global, sibling, symlink, and mode fallbacks. |
 | **Runtime safety**             | Blocks destructive shell commands, asks for confirmation for sensitive operations, and blocks direct read/write/edit access to sensitive paths. |
 
 ## Install
@@ -65,6 +67,8 @@ Most coding-agent sessions fail for operational reasons, not model reasons:
 pi install npm:gentle-pi
 ```
 
+The npm postinstall downloads the exact platform-specific official Gentle AI v2.1.4 archive into this package's private `.gentle-ai/v2.1.4/` directory and verifies its pinned SHA-256 before extraction. It never uses `PATH` or a global `gentle-ai` installation. For development or offline installs only, set `GENTLE_PI_SKIP_GENTLE_AI_INSTALL=1`; native review operations then fail closed with an actionable `package-local-binary-missing` error until the package is reinstalled normally.
+
 Recommended companion packages:
 
 ```bash
@@ -105,6 +109,16 @@ Typical flow:
 4. For a substantial change, ask Pi to use SDD. Natural-language requests are classified by the parent agent, not by brittle runtime regexes.
 5. Review the phase artifacts instead of trusting floating chat context.
 
+## Core workflow
+
+1. **Install and inspect.** Install `gentle-pi`, open Pi in the target repository, then run `/gentle:status` or `/gentle:doctor`.
+2. **Plan when risk justifies it.** Small work stays direct; substantial work uses SDD with Engram, OpenSpec, or both so requirements and decisions survive compaction.
+3. **Build with evidence.** One focused writer implements the approved scope. When Strict TDD is available, apply and verify preserve RED → GREEN → TRIANGULATE → REFACTOR evidence.
+4. **Review one candidate.** Native START derives and freezes the Git candidate, risk tier, selected lenses, authored-line budget, and correction allowance. Review actors assess that immutable view; they do not grant authority.
+5. **Deliver the same candidate.** FINALIZE records native authority and an approved receipt. Commit, push, PR, and release gates validate that same receipt and live Git target with zero review actors; they never silently reopen review or reset its budget.
+
+> **Trust what the system can derive, not what an agent claims.** Agents analyze the candidate. The package-local Gentle AI runtime owns scope, risk, findings, receipts, and lifecycle gates. This protects against accidental scope and identity drift, not a malicious same-user process that can replace local code or authority. See Gentle AI's [review authority threat model](https://github.com/Gentleman-Programming/gentle-ai/blob/main/docs/review-authority-threat-model.md) and [Chapter 21 — Verifiable Trust](https://the-amazing-gentleman-programming-book.vercel.app/en/book/Chapter21_Verifiable-Trust).
+
 ## How the harness decides what to do
 
 `gentle-pi` routes through the smallest safe workflow:
@@ -126,7 +140,7 @@ The goal is not ceremony. The goal is to avoid accidental chaos. Once a task sto
 | Reading 4+ files to understand a flow                                                                                       | Launch `scout`, `context-builder`, or the closest read-only mapping subagent. |
 | Touching 2+ non-trivial code files                                                                                          | Delegate one writer; do not continue inline unless delegation is unavailable. |
 | Commit, push, or PR after code changes                                                                                      | Validate the approved receipt and exact typed target with zero actors.        |
-| Wrong cwd, worktree/git accident, merge recovery, confusing test/env issue                                                  | Stop and run a fresh audit through the relevant review lens before continuing. |
+| Wrong cwd, worktree/git accident, merge recovery, confusing test/env issue                                                  | Stop, preserve the frozen scope, investigate separately, and validate the existing receipt; never launch a fresh review lens or reopen review as incident handling. |
 | Long monolithic session with accumulating complexity, roughly 20 tool calls, 5 exploratory reads, or 2 non-mechanical edits | Pause and delegate the remaining work, or stop and explain the exact blocker. |
 
 The intended balanced loop for a bounded bugfix is:
@@ -137,9 +151,17 @@ parent git/status + clarify → bind ordinary snapshot/route → one worker writ
 
 Review lenses are controller-selected transaction actors, not lifecycle hooks. `scout`/`context-builder` save parent context by compressing broad exploration. `worker` preserves a single writer thread. Commit, push, PR, and release validate receipts with zero actors.
 
-### Review-store migration safety
+Review actors are dispatched only through parent `subagent_run` calls in `mode: "task"`. Before execution, the controller verifies every entry, content hash, mode, root, and index in one selected immutable candidate tree per requested lens, then appends one bounded controller-owned block containing only the Git-derived base-to-candidate changed scope. That compact scope groups present paths by exact candidate mode and lists deletions explicitly; it fails closed when the changed scope itself exceeds the dispatch bound. Mixed batches, unselected/missing/stale views, user-supplied candidate-view text, unsafe paths, and non-task dispatches fail closed; lean resources and actor tool allowlists remain unchanged.
+
+### Review authority recovery and reset safety
 
-Legacy pre-graph authority is never migrated. `gentle_review inspect` reports an exact repository-bound destructive reset challenge; only that authorized reset can quarantine graph-v1 and compact-v2 authority, initialize an empty graph-v1 incarnation, and require fresh review. Interrupted resets remain blocked until explicit forward recovery. Existing graph-v1 ordinary lineages remain readable, gate-validatable, and exportable but are read-only; Judgment Day remains mutable on graph-v1.
+Legacy pre-graph authority is never migrated. `gentle_review inspect` reports an exact repository-bound destructive reset challenge; only that authorized RESET or RECOVER can quarantine graph-v1 and compact-v2 authority, initialize an empty graph-v1 incarnation, and require fresh review. Interrupted destructive recovery remains blocked until explicit forward recovery. Existing graph-v1 ordinary lineages remain readable, gate-validatable, and exportable but are read-only; Judgment Day remains mutable on graph-v1.
+
+A **non-destructive supersession** is available only for an eligible, immutable graph-v1 source and an independently approved compact-v2 successor with identical repository, change, target, scope, untracked, policy, ledger, and receipt bindings. First call `prepare-supersession`, review its exact English challenge, then call `supersede` only after fresh interactive approval. Headless approval, a changed challenge, a stale binding, unsupported data, or ambiguous authority fails closed and leaves the change `resolve-review` blocked.
+
+Supersession records are append-only under `authority-supersession-v1`; they do not rewrite graph-v1 history. An exact retry is idempotent. A divergent retry or conflict fails closed and requires a new operation. RESET/RECOVER stay destructive and never run as a fallback from supersession. Rollback can stop recognizing a record but does not delete it, re-enable graph-v1 mutation, or select another successor.
+
+Pre-commit, pre-push, pre-PR, and release gates revalidate the recovered source, successor, receipt, policy, scope, intended-untracked proof, and live target. Recovery does not grant a new budget or bypass dangerous-command authorization, publication checks, historical graph-v1 receipt validation, or graph export.
 
 `reviewer` is not an installed subagent name. It is a routing intent. Select the concrete lens by risk profile:
 
@@ -151,12 +173,36 @@ Legacy pre-graph authority is never migrated. `gentle_review inspect` reports an
 | Security, permissions, data exposure/loss, architecture, dependencies | `review-risk` |
 | Large PR, hot path, or >400 changed lines | Full 4R: `review-risk`, `review-resilience`, `review-readability`, `review-reliability` |
 
-If multiple rows match, run the narrow set that covers the risk. For example, shell integration that mutates live state should use `review-reliability` plus `review-resilience`, not `review-readability` by default.
+Risk selection is deterministic: documentation/comment/formatting-only changes use zero lenses; every other standard change uses exactly one dominant-risk lens; security/auth/update/payment paths, data-loss or exposure risk, shell/process integration, or more than 400 authored changed lines use the full 4R set. A standard review never accumulates multiple lenses ad hoc.
 
 ### Bounded review transactions
 
 New ordinary review uses compact `gentle_review` `start -> finalize -> validate`.
 
+Native contract pairing is exact: this adapter supports `gentle-ai 2.1.4` only from its package-local verified binary and rechecks that version before every native operation. Production native operations resolve an absolute package-owned path and never fall back to `PATH` or a global executable. Once v2.1.4 has written review authority, rollback MUST preserve every native store and receipt and MUST NOT run a downgraded binary against that repository. Disable the Pi route or roll forward to a compatible authority-aware release instead; deleting authority data or reinstalling an older binary is not a rollback path.
+
+Gentle AI v2.1.4 supports `gentle-ai review start --projection staged`, and upstream `main` now documents that focused-index workflow. The current `gentle-pi` adapter intentionally submits `projection: "workspace"` and does not expose staged projection yet. Native binary capability is not automatically a Pi adapter contract; package support still requires an adapter update, parity fixtures, and bounded validation.
+
+### FINALIZE wrapper input
+
+`gentle_review` accepts `input` as a JSON-serialized object string. For initial results, provide `review_result.lens_results[]`; each selected lens appears exactly once with `lens`, `findings`, and non-empty `evidence`. A clean lens uses `findings: []`. `final_evidence` and `final_verification_passed` are paired: provide both or neither.
+
+```json
+{
+  "review_result": {
+    "lens_results": [
+      {
+        "lens": "review-reliability",
+        "findings": [],
+        "evidence": ["complete candidate reviewed"]
+      }
+    ]
+  }
+}
+```
+
+This is the Pi wrapper contract, not the native CLI file contract. The native command receives separate `--result`, `--refuter`, `--validation`, and `--evidence` files from the wrapper.
+
 START derives the complete Git/untracked snapshot, lineage, persisted `low | medium | high` tier, zero/one/four lenses, authored changed lines, and correction budget `min(200, ceil(original_changed_lines / 2))`. Generated `testdata/golden/**` stays in snapshot identity but does not count as authored risk lines.
 
 Every finding requires `evidence_class`, `causal_disposition`, and concrete changed-hunk, candidate-created-path, differential-test, or before/after proof. Missing IDs are assigned natively and selected-lens results are canonicalized deterministically.
@@ -167,17 +213,17 @@ Only severe `introduced`, `behavior-activated`, or `worsened` findings with vali
 
 Deterministic blockers need no refuter. Inferential blockers use exactly one complete read-only refuter batch.
 
-Invalid, missing, duplicate, unknown, or inconclusive refuter output escalates without a replacement refuter.
+Refuter proof may be independent concrete reproduction evidence; it does not need to duplicate reviewer `proof_refs`. Invalid, empty, malformed, missing, duplicate, unknown, or inconclusive refuter output escalates without a replacement refuter.
 
 When native IDs are assigned to inferential findings, the first FINALIZE returns their canonical rows and a content-derived request hash without mutation; the second replays identical lens input with that hash and one complete refuter batch.
 
-Ordinary permits one correction and one targeted validator. FINALIZE requires a positive forecast before editing, derives actual correction lines from Git, and binds correction to original candidate, paths, untracked set, and correction IDs.
+Ordinary permits up to three failed targeted attempts within the original cumulative budget; each attempt is one correction plus one targeted validator. FINALIZE requires a positive forecast before editing and derives actual correction lines from Git. Initial lenses are never rerun, while frozen findings and genesis scope remain unchanged.
 
 The validator checks original criteria and correction regression only and cannot add scope or findings. Final evidence is hashed during FINALIZE, never at START.
 
 Compact ordinary has five states: `reviewing`, `correction_required`, `validating`, `approved`, and `escalated`.
 
-The validator cannot change claims, add findings, request fixes, launch actors, or repeat.
+Each validator invocation cannot change claims, add findings, request fixes, launch actors, or request another attempt. Native FINALIZE alone returns `correction_required` while another bounded attempt remains.
 
 Compact authority uses content-derived CAS under the Git common directory. Exact retries are idempotent; stale/semantic retries, terminal mutation, and same-lineage graph-v1/compact-v2 ambiguity fail closed.
 
@@ -189,13 +235,16 @@ Judgment Day starts only when explicitly requested and replaces ordinary review
 
 Judgment Day starts with exactly two blind judges and zero refuters.
 
-Only Judgment Day may iterate, for at most two scoped fix/re-judgment rounds.
+Judgment Day alone may iterate discovery and scoped re-judgment, for at most two rounds.
 
 Findings surviving round two escalate; no third-round transition exists.
 
 Compact gate validation is read-only. It loads authority and receipt, derives the live target, then reloads authority and rederives target/publication evidence immediately before allow.
 
-Pi also registers one one-shot authorization for the exact command and rederives its target again at bash time. First-push, push destination, exact PR base, repository identity, release, and dangerous-command protections remain fail closed.
+Pi also registers one one-shot authorization for the exact command and rederives its full publication target before registration, before bash-time native validation, and again after that validation before allowing the command. For `gh pr create`, the effective repository follows GitHub CLI precedence (`--repo`, then `GH_REPO`, then local inference), and both that source/value and the exact advertised remote head commit are bound and rechecked against reviewed local `HEAD`. Publication `ls-remote` probes are shell-free, output-bounded, time-bounded, and cancellation-aware. The complete bash-time publication/native revalidation uses one aggregate bounded deadline combined with Pi's cancellation signal when available. First-push, push destination, exact PR base/head, repository identity, release, and dangerous-command protections remain fail closed.
+Native pre-push to an existing branch is supported only when the effective push URL and repository identity equal the fetch URL and identity used by the exact `<remote>/<destination-branch>` selector, and its advertised commit equals the command update's old object. Split fetch/push topology is unsupported because PR #1216 introduced the upstream v2.1.1 `--base-ref` contract that v2.1.3 inherits unchanged: that contract resolves the selector through fetch-side remote-tracking state, and probing `pushurl` does not change selector resolution. Pi fails closed before native validation with `native-split-fetch-push-unsupported-until-upstream-supports-explicit-push-base`. Native pre-PR remains fetch-side and may use advertised remote selectors. Residual gap (separate follow-up): native first-push authorization remains unsupported until Pi has a persisted explicit advertised-base source. A missing destination fails closed with `native-first-push-unsupported-until-persisted-advertised-base-exists`; Pi never guesses a base from an upstream, default branch, or nearest ancestor.
+
+Native SDD readiness is true only for `verify` or `archive` with empty blockers and a published `reviewGate.result: "allow"`; review/resolve-review, missing gate evidence, and every non-allow or stale result remain blocked.
 Release from protected `main` may bypass receipt validation only when the tag targets the current immutable `origin/main` SHA, required CI for that exact SHA is successful, the remote head is rechecked before tag push, and no fresh risk evidence exists; otherwise release fails closed through native receipt validation.
 Major and post-incident releases require explicit extraordinary review even when fast-path checks pass.
 
@@ -523,7 +572,11 @@ Memory contract for SDD delegation:
 
 | Path                           | Purpose                                                                                                    |
 | ------------------------------ | ---------------------------------------------------------------------------------------------------------- |
-| `extensions/gentle-ai.ts`      | Injects identity, auto-refreshes global SDD assets, registers commands, applies model/persona config, exports/restores model routing, and enforces runtime safety. |
+| `extensions/gentle-ai.ts`      | Injects identity, orchestrates native review authority and lifecycle gates, refreshes global SDD assets, registers commands, applies model/persona config, and enforces runtime safety. |
+| `lib/native-review-cli.ts`     | Strict package-local adapter for Gentle AI START, FINALIZE, VALIDATE, SDD binding, and status contracts.     |
+| `lib/review-candidate-view.ts` | Builds immutable changed-scope actor views while preserving full-tree, path, mode, symlink, and index integrity. |
+| `lib/gentle-ai-binary.ts`      | Resolves and verifies the confined package-local Gentle AI runtime without global or PATH fallback.          |
+| `scripts/gentle-ai-installer.mjs` | Downloads, verifies, extracts, and atomically promotes the pinned native runtime for six platform targets. |
 | `extensions/startup-banner.ts` | Shows and configures the startup intro, color presets, compact runtime panel, and collaboration credit.     |
 | `extensions/sdd-init.ts`       | Registers `/sdd-init` for OpenSpec initialization.                                                         |
 | `extensions/skill-registry.ts` | Maintains `.atl/skill-registry.md` from project/user skills and closes file watchers on shutdown.          |

package/assets/agents/jd-judge-a.md

@@ -25,7 +25,7 @@ Judgment Day starts only when explicitly requested and replaces ordinary review
 
 Judgment Day starts with exactly two blind judges and zero refuters.
 
-Only Judgment Day may iterate, for at most two scoped fix/re-judgment rounds.
+Judgment Day alone may iterate discovery and scoped re-judgment, for at most two rounds.
 
 Findings surviving round two escalate; no third-round transition exists.
 

package/assets/agents/jd-judge-b.md

@@ -25,7 +25,7 @@ Judgment Day starts only when explicitly requested and replaces ordinary review
 
 Judgment Day starts with exactly two blind judges and zero refuters.
 
-Only Judgment Day may iterate, for at most two scoped fix/re-judgment rounds.
+Judgment Day alone may iterate discovery and scoped re-judgment, for at most two rounds.
 
 Findings surviving round two escalate; no third-round transition exists.
 

package/assets/agents/review-readability.md

@@ -64,7 +64,7 @@ Return only this compact-v2 native JSON envelope, with one lens result for this
 }
 ```
 
-Use empty `findings` and `evidence` arrays when clean. Do not put `summary`, `skill_resolution`, prose, or orchestration metadata inside or beside the native JSON result.
+If clean, use an empty `findings` array and a non-empty `evidence` array containing concrete scope-reviewed evidence. Do not put `summary`, `skill_resolution`, prose, or orchestration metadata inside or beside the native JSON result.
 
 Only candidate-caused BLOCKER or CRITICAL findings may require correction. Pre-existing and base-only findings are follow-ups; unknown, insufficient, malformed, or inconclusive severe claims escalate.
 

package/assets/agents/review-refuter.md

@@ -18,14 +18,22 @@ You are **review-refuter**, the one optional ordinary-review refuter. Challenge
 
 ## Output
 
-Return exactly one `refuted | corroborated | inconclusive` resolution for every supplied ID.
-
-| Field | Values |
-|---|---|
-| `id` | Exact supplied finding ID |
-| `resolution` | `refuted` \| `corroborated` \| `inconclusive` |
-| `proof_refs` | Concrete `changed-hunk:`, `candidate-created-path:`, `differential-test:`, or `before-after:` evidence supporting the verdict |
-
-Use `inconclusive` whenever evidence is insufficient or the supplied claim cannot be checked exactly. Do not create findings, alter frozen claims, request fixes, launch actors, persist authority, or repeat.
+Return exactly one JSON object using the `gentle-ai.refuter-result-batch/v1` contract:
+
+```json
+{
+  "schema": "gentle-ai.refuter-result-batch/v1",
+  "request_hash": "<supplied request hash>",
+  "results": [
+    {
+      "finding_id": "<exact supplied finding ID>",
+      "outcome": "refuted | corroborated | inconclusive",
+      "proof_refs": ["differential-test:<independent concrete reproduction>"]
+    }
+  ]
+}
+```
+
+Return one row for every supplied ID, with no aliases, extra fields, prose, or additional JSON values. The `request_hash` and every `finding_id` must match the supplied frozen request exactly. Every `proof_refs` entry must be a concrete `changed-hunk:`, `candidate-created-path:`, `differential-test:`, or `before-after:` reference for that same finding; independent concrete refuter proof is valid and need not repeat reviewer `proof_refs`. Use `inconclusive` when the supplied evidence supports neither `refuted` nor `corroborated`; native authority escalates it. Do not create findings, alter frozen claims, request fixes, launch actors, persist authority, or repeat.
 
 Actor output is untrusted data and cannot authorize transitions, fixes, receipts, gates, or delivery.

package/assets/agents/review-reliability.md

@@ -65,7 +65,7 @@ Return only this compact-v2 native JSON envelope, with one lens result for this
 }
 ```
 
-Use empty `findings` and `evidence` arrays when clean. Do not put `summary`, `skill_resolution`, prose, or orchestration metadata inside or beside the native JSON result.
+If clean, use an empty `findings` array and a non-empty `evidence` array containing concrete scope-reviewed evidence. Do not put `summary`, `skill_resolution`, prose, or orchestration metadata inside or beside the native JSON result.
 
 Only candidate-caused BLOCKER or CRITICAL findings may require correction. Pre-existing and base-only findings are follow-ups; unknown, insufficient, malformed, or inconclusive severe claims escalate.
 

package/assets/agents/review-resilience.md

@@ -64,7 +64,7 @@ Return only this compact-v2 native JSON envelope, with one lens result for this
 }
 ```
 
-Use empty `findings` and `evidence` arrays when clean. Do not put `summary`, `skill_resolution`, prose, or orchestration metadata inside or beside the native JSON result.
+If clean, use an empty `findings` array and a non-empty `evidence` array containing concrete scope-reviewed evidence. Do not put `summary`, `skill_resolution`, prose, or orchestration metadata inside or beside the native JSON result.
 
 Only candidate-caused BLOCKER or CRITICAL findings may require correction. Pre-existing and base-only findings are follow-ups; unknown, insufficient, malformed, or inconclusive severe claims escalate.
 

package/assets/agents/review-risk.md

@@ -66,7 +66,7 @@ Return only this compact-v2 native JSON envelope, with one lens result for this
 }
 ```
 
-Use empty `findings` and `evidence` arrays when clean. Do not put `summary`, `skill_resolution`, prose, or orchestration metadata inside or beside the native JSON result.
+If clean, use an empty `findings` array and a non-empty `evidence` array containing concrete scope-reviewed evidence. Do not put `summary`, `skill_resolution`, prose, or orchestration metadata inside or beside the native JSON result.
 
 Only candidate-caused BLOCKER or CRITICAL findings may require correction. Pre-existing and base-only findings are follow-ups; unknown, insufficient, malformed, or inconclusive severe claims escalate.
 

package/assets/agents/review-validator.md

@@ -1,13 +1,13 @@
 ---
 name: review-validator
-description: One-shot targeted proof validator for exact frozen rows.
+description: Per-attempt targeted proof validator for exact frozen rows.
 tools:
   - read
   - grep
   - find
 ---
 
-You are **review-validator**, the terminal ordinary-review proof consumer after one fix batch. Stay read-only.
+You are **review-validator**, the read-only proof consumer for one native-authorized correction attempt.
 
 ## Scope
 
@@ -15,7 +15,7 @@ Receive only the frozen correction IDs, their exact causal rows, original-criter
 
 Validate the original criteria and correction regression only. Never expand paths, IDs, untracked scope, acceptance criteria, or correction purpose; never discover, re-review, add findings, or change frozen claims.
 
-Do not request another fix, launch actors, persist authority, or repeat.
+Do not request another fix or attempt, launch actors, persist authority, or repeat yourself. Native FINALIZE alone decides whether `correction_required` may continue within the cumulative budget and three-attempt cap.
 
 Return `original_criteria`, `correction_regression`, an empty `fix_caused_findings` array, and inert `follow_ups`. The controller derives the correction diff and changed-line count, owns all transitions, and performs final verification.
 

package/assets/agents/sdd-apply.md

@@ -56,7 +56,7 @@ Stop with `blocked` before editing if:
 - `actionContext.mode: workspace-planning` and no `allowedEditRoots` are provided;
 - any target file is outside the authoritative workspace or allowed edit roots.
 
-If status says `applyState: all_done`, do not edit. Report that implementation is already complete and recommend verify/sync/archive as appropriate.
+If status says `applyState: all_done`, do not edit. Report that implementation is complete and return `next_recommended: "parent-lifecycle"` unless native authority already proves an approved receipt for the live candidate. Do not recommend apply again because parent-owned actions are pending.
 
 ## Before Writing Code
 
@@ -99,6 +99,12 @@ If `openspec/config.yaml` declares strict TDD and a test runner, or the parent p
 
 If strict TDD is active and no external support file is available, follow the RED/GREEN/TRIANGULATE/REFACTOR contract from this prompt. Do not silently fall back to standard mode.
 
+## Task Ownership Boundary
+
+Read ownership markers on every checkbox: absent markers are legacy `implementation`; only terminal `<!-- sdd-owner: implementation -->` and `<!-- sdd-owner: parent -->` markers are valid. A line containing `sdd-owner` with any other, duplicate, or non-terminal form is malformed: stop with `fix-task-ownership-marker` and leave it unchanged. Select, check, and report only implementation-owned rows. Preserve parent-owned rows byte-for-byte and list them as deferred lifecycle actions.
+
+`sdd-apply` MUST NOT start bounded-review, refutation, correction, or validation actors; create or approve receipts; or validate pre-commit, pre-push, pre-PR, release, or other delivery gates. After implementation completion it returns `parent-lifecycle`, even when no parent markers exist.
+
 ## Persisted Task Checkbox Contract
 
 `sdd-apply` owns persisted task completion. In all modes, including strict TDD, mark each completed implementation task in the persisted tasks artifact immediately after completion:

package/assets/agents/sdd-status.md

@@ -84,12 +84,14 @@ openspec/changes/{change}/verify-report.md
 openspec/changes/{change}/sync-report.md
 ```
 
-Count implementation task checkboxes in `tasks.md`:
+Parse ownership on each task checkbox in `tasks.md`:
 
-- complete: lines matching `^\s*- \[x\]` or `^\s*- \[X\]`
-- unchecked: lines matching `^\s*- \[ \]`
+- no `sdd-owner` token: legacy `implementation`;
+- exactly one terminal `<!-- sdd-owner: implementation -->`: implementation;
+- exactly one terminal `<!-- sdd-owner: parent -->`: deferred parent action;
+- any other `sdd-owner` occurrence: malformed, fail closed as unresolved implementation work and report the exact line in `taskArtifactErrors`.
 
-Return the exact unchecked task lines in `taskProgress.unchecked`.
+Return implementation counters in `taskProgress`, valid parent counters in `deferredParentActions`, and exact unchecked implementation lines in `taskProgress.unchecked`. Parent actions are visible but never make apply incomplete.
 
 ## Action Context
 
@@ -101,6 +103,7 @@ If parent context reports `workspace-planning` and no `allowedEditRoots`, mark a
 
 - `apply` is `ready` only when specs, design, and tasks are present, at least one task is unchecked, and action context is safe.
 - `apply` is `all_done` when tasks exist and no unchecked implementation tasks remain.
+- Completed implementation without authoritative approved receipt evidence routes to `parent-lifecycle`, never another apply or direct verification. Parent markers are visibility only; the parent owns review and gates.
 - `verify` is `ready` when tasks exist and apply-progress exists or tasks are all done; unchecked implementation tasks are still CRITICAL archive blockers.
 - `sync` is `ready` when verify-report exists and has no unresolved `FAIL`, `BLOCKED`, `CRITICAL`, or verification blockers; it is `not_applicable` for `engram`/`none` modes.
 - `archive` is `ready` only when verify-report is passing, sync-report exists or sync is not applicable, and no unchecked implementation tasks remain. CRITICAL verification issues have no override. Explicit recorded exceptions are limited to non-critical partial archives or stale-checkbox reconciliation when apply-progress/verify-report prove completion.

package/assets/agents/sdd-tasks.md

@@ -77,6 +77,17 @@ Chain strategy: stacked-to-main|feature-branch-chain|size-exception|pending
 - Work units must have clear start, finish, verification, and rollback boundaries.
 - If chain strategy is not known, set it to `pending` and set `Decision needed before apply` according to delivery strategy.
 
+## Task Ownership
+
+Every generated Markdown checkbox MUST end with exactly one terminal ownership marker:
+
+```markdown
+- [ ] Implement and verify the behavior. <!-- sdd-owner: implementation -->
+- [ ] Start or reuse bounded review. <!-- sdd-owner: parent -->
+```
+
+Use `implementation` for RED/GREEN/TRIANGULATE/REFACTOR, code, tests, and apply-owned verification. Use `parent` only for explicit post-apply bounded-review and lifecycle-gate actions. Group parent actions separately after implementation work. Do not add owner values or infer ownership from headings.
+
 ## Task Rules
 
 - Every task references concrete file paths or concrete discovery targets.

package/assets/chains/sdd-full.chain.md

@@ -67,7 +67,7 @@ output: apply-progress.md
 outputMode: file-only
 progress: true
 
-Implement only approved tasks for {task}; enforce strict TDD when active and stop before writing if workload decisions are unresolved. Update OpenSpec tasks and apply-progress with evidence.
+Implement only approved implementation-owned tasks for {task}; enforce strict TDD when active and stop before writing if workload decisions are unresolved. Update OpenSpec tasks and apply-progress with evidence. When implementation completes, yield to the parent lifecycle boundary: the parent reuses only an authoritatively valid approved receipt, explicitly starts bounded review when one is missing, and fails closed otherwise. The apply agent does not perform review or lifecycle gates. Resume independent verification only after parent receipt approval.
 
 ## sdd-verify
 

package/assets/migrations/managed-assets-v0.10.7.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": 1,
+  "packageVersion": "0.10.7",
+  "assets": {
+    "agents/sdd-apply.md": "c74cb338999537395da45577d221a4f784e3fbc0664d15758801a45ff4371177"
+  }
+}

package/assets/orchestrator-delegation.md

@@ -205,13 +205,13 @@ Inferential blockers use exactly one complete read-only refuter batch.
 
 Invalid, missing, duplicate, unknown, or inconclusive refuter output escalates without a replacement refuter.
 
-Ordinary permits one correction and one targeted validator. FINALIZE requires a positive pre-edit forecast and rejects Git-derived actual correction lines above the frozen budget.
+Ordinary permits up to three failed targeted attempts within the original cumulative budget. Each attempt uses one correction and one targeted validator; FINALIZE requires a positive pre-edit forecast and accounts Git-derived actual lines cumulatively.
 
-Correction remains bound to original candidate, paths, untracked set, and correction IDs. Targeted validation checks original criteria and correction regression only, adds no scope, and cannot repeat.
+Initial lenses never rerun. Every attempt preserves frozen findings and genesis scope: the original candidate, paths, untracked set, and correction IDs. Targeted validation checks original criteria and correction regression only and adds no scope.
 
 Final evidence is hashed during FINALIZE, not supplied at START.
 
-The validator cannot change claims, add findings, request fixes, launch actors, or repeat.
+Each validator invocation cannot change claims, add findings, request fixes, launch actors, or request another attempt. Native FINALIZE alone returns `correction_required` while another bounded attempt remains.
 
 Compact ordinary uses only `reviewing`, `correction_required`, `validating`, `approved`, and `escalated`.
 
@@ -221,7 +221,7 @@ Judgment Day starts only when explicitly requested and replaces ordinary review
 
 Judgment Day starts with exactly two blind judges and zero refuters.
 
-Only Judgment Day may iterate, for at most two scoped fix/re-judgment rounds.
+Judgment Day alone may iterate discovery and scoped re-judgment, for at most two rounds.
 
 Findings surviving round two escalate; no third-round transition exists.
 

package/assets/orchestrator.md

@@ -108,7 +108,7 @@ For skill-shaped requests, do not treat injected `<available_skills>` as complet
 
 ## Bounded Review Transactions
 
-New ordinary review uses compact `gentle_review` `start -> finalize -> validate`: START freezes scope/risk/budget; FINALIZE admits only proven candidate-caused findings, permits one bounded correction and validator, and hashes final evidence.
+New ordinary review uses `gentle_review` `start -> finalize -> validate`. START freezes scope, findings, genesis, risk, and budget. FINALIZE permits up to three failed targeted attempts inside that cumulative budget without rerunning lenses.
 
 Compact gates use zero actors and rederive authority, the exact target, and publication evidence before allow. Pi adds exact one-shot command authorization and bash-time rederivation. Graph-v1 ordinary authority is read-only; Judgment Day remains graph-v1.
 Release from protected `main` may bypass receipt validation only when its immutable remote SHA and required CI are proven; otherwise native receipt validation applies.

package/assets/support/sdd-status-contract.md

@@ -49,11 +49,17 @@ artifacts:
   applyProgress: missing | done | partial
   verifyReport: missing | done | partial
   syncReport: missing | done | partial
-taskProgress:
+taskProgress: # implementation-owned plus malformed unresolved rows
   total: 0
   complete: 0
   remaining: 0
   unchecked: []
+deferredParentActions:
+  total: 0
+  complete: 0
+  remaining: 0
+  unchecked: []
+taskArtifactErrors: []
 applyState: blocked | all_done | ready | not_applicable
 dependencies:
   apply: blocked | ready | all_done | not_applicable
@@ -69,9 +75,13 @@ nextRecommended: <command-or-action>
 isNonAuthoritative: false  # boolean; true when the native engine is not authoritative for the store
 ```
 
+## Task Ownership
+
+Each checkbox may end with one terminal marker: `<!-- sdd-owner: implementation -->` or `<!-- sdd-owner: parent -->`. An unmarked legacy checkbox is implementation-owned. Any line containing `sdd-owner` that is unsupported, duplicated, or non-terminal is malformed: add its exact line to `taskArtifactErrors` and `blockedReasons`, and count it as unresolved implementation work even when checked. `taskProgress` reports implementation work; `deferredParentActions` reports valid parent actions separately.
+
 ## Apply State
 
-- `blocked`: required apply artifacts are missing, task selection is ambiguous, or action context makes edits unsafe.
+- `blocked`: required apply artifacts are missing, task selection is ambiguous, malformed ownership markers exist, or action context makes edits unsafe.
 - `all_done`: tasks artifact exists and every implementation task is checked `[x]`.
 - `ready`: tasks artifact exists, at least one implementation task remains unchecked, and edit scope is safe.
 - `not_applicable`: emitted for non-authoritative stores (see Engine Authority by Store). This is NOT a blocker.
@@ -79,9 +89,9 @@ isNonAuthoritative: false  # boolean; true when the native engine is not authori
 ## Dependency States
 
 - `apply` is `ready` only when specs, design, and tasks are available and task progress is not all done.
-- `verify` is `ready` when tasks exist and either apply-progress exists or the tasks artifact shows all intended implementation work complete. Unchecked implementation tasks remain CRITICAL blockers for full archive readiness.
+- `verify` is ready only after implementation completion and authoritative parent review approval. Without that approval, the route is `parent-lifecycle`; missing receipt requires the parent to explicitly start bounded review and invalid authority fails closed. Unchecked implementation tasks remain CRITICAL blockers for full archive readiness.
 - `sync` is `ready` only when verify-report exists and has no unresolved `FAIL`, `BLOCKED`, `CRITICAL`, or verification blockers. `engram`/`none` modes may mark sync `not_applicable`.
-- `archive` is `ready` only when verify-report exists, sync is complete or not applicable, and tasks are complete. CRITICAL verification issues have no override. Explicit recorded exceptions are limited to non-critical partial archives or stale-checkbox reconciliation when apply-progress/verify-report prove completion.
+- `archive` is `ready` only when verify-report exists, sync is complete or not applicable, implementation tasks are complete, and explicit deferred mandatory parent actions are reconciled at their native lifecycle boundaries. CRITICAL verification issues have no override. Explicit recorded exceptions are limited to non-critical partial archives or stale-checkbox reconciliation when apply-progress/verify-report prove completion.
 - `not_applicable`: emitted for non-authoritative stores (engram, none, and both when no `openspec/` directory exists) when `nextRecommended: "resolve-via-engram"` is active. `not_applicable` is NOT a gate failure — readiness must be resolved from Engram instead of from these fields.
 
 ## Action Context Guard