gentle-pi 1.0.6 → 1.2.0

package/README.md

@@ -58,7 +58,7 @@ Most coding-agent sessions fail for operational reasons, not model reasons:
 | **Skill creation workflow**    | Provides the `gentle-ai-skill-creator`/`gentle-ai-skill-improver` skills, `/skill-creation` prompt, and packaged style guide for LLM-first skills. |
 | **Delivery skills**            | Includes issue-first PRs, chained PRs, work-unit commits, cognitive docs, comment writing, and Judgment Day review.                           |
 | **Bounded native review**      | Freezes one candidate, dispatches only controller-selected lenses, records native authority, and reuses the same content-bound receipt at delivery gates. |
-| **Verified native runtime**    | Provisions the exact package-local Gentle AI v2.1.5 binary, verifies pinned archive/binary integrity, and rejects PATH, global, sibling, symlink, and mode fallbacks. |
+| **Verified native runtime**    | Provisions the exact package-local Gentle AI v2.1.11 binary, verifies pinned archive/binary integrity, negotiates `review-integration/v1`, and rejects PATH, global, sibling, symlink, and mode fallbacks. |
 | **Runtime safety**             | Blocks destructive shell commands, asks for confirmation for sensitive operations, and blocks direct read/write/edit access to sensitive paths. |
 
 ## Install
@@ -67,7 +67,7 @@ Most coding-agent sessions fail for operational reasons, not model reasons:
 pi install npm:gentle-pi
 ```
 
-The npm postinstall downloads the exact platform-specific official Gentle AI v2.1.5 archive into this package's private `.gentle-ai/v2.1.5/` directory and verifies its pinned SHA-256 before extraction. It never uses `PATH` or a global `gentle-ai` installation. For development or offline installs only, set `GENTLE_PI_SKIP_GENTLE_AI_INSTALL=1`; native review operations then fail closed with an actionable `package-local-binary-missing` error until the package is reinstalled normally.
+The npm postinstall downloads the exact platform-specific official Gentle AI v2.1.11 archive into this package's private `.gentle-ai/v2.1.11/` directory and verifies its pinned archive and executable SHA-256 values before extraction. It never uses `PATH` or a global `gentle-ai` installation. For development or offline installs only, set `GENTLE_PI_SKIP_GENTLE_AI_INSTALL=1`; native review operations then fail closed with an actionable `package-local-binary-missing` error until the package is reinstalled normally.
 
 Recommended companion packages:
 
@@ -99,6 +99,8 @@ pi
 /gentle:models             Assign global model/effort routing to SDD/custom agents.
 /gentle:persona            Switch between gentleman and neutral persona modes.
 /gentle:banner             Configure startup rose, text logo, and color preset.
+/gentle:commit-status      Inspect an unresolved durable commit transaction.
+/gentle:commit-abort       Abandon safe recovery state without changing HEAD or the index.
 ```
 
 Typical flow:
@@ -155,13 +157,21 @@ Review actors are dispatched only through parent `subagent_run` calls in `mode:
 
 ### Review authority recovery and reset safety
 
-Legacy pre-graph authority is never migrated. `gentle_review inspect` reports an exact repository-bound destructive reset challenge; only that authorized RESET or RECOVER can quarantine graph-v1 and compact-v2 authority, initialize an empty graph-v1 incarnation, and require fresh review. Interrupted destructive recovery remains blocked until explicit forward recovery. Existing graph-v1 ordinary lineages remain readable, gate-validatable, and exportable but are read-only; Judgment Day remains mutable on graph-v1.
+Legacy pre-graph authority is never migrated. `gentle_review inspect` reports an exact repository-bound destructive reset challenge for legacy corruption; after that fresh interactive authorization, RESET and RECOVER_LOCK route to the audited native `gentle-ai review reclaim` operation and RECOVER routes to native `gentle-ai review recover`, so every destructive transition is executed and audited by the native authority store. Native inputs the request did not carry return a `native-input-required` envelope instead of being invented. Existing graph-v1 ordinary lineages remain readable and gate-validatable but are read-only; Judgment Day remains mutable on graph-v1.
 
-A **non-destructive supersession** is available only for an eligible, immutable graph-v1 source and an independently approved compact-v2 successor with identical repository, change, target, scope, untracked, policy, ledger, and receipt bindings. First call `prepare-supersession`, review its exact English challenge, then call `supersede` only after fresh interactive approval. Headless approval, a changed challenge, a stale binding, unsupported data, or ambiguous authority fails closed and leaves the change `resolve-review` blocked.
+`gentle_review abandon`, `quarantine-legacy`, and `reconcile-authority` remain explicit v2.1.11 maintenance routes. Pi derives and displays the published six-line abandon binding only for a caller-specified compact lineage, revision, and snapshot identity; the native CLI re-derives pristine compact-v2 eligibility. Legacy quarantine accepts only `historical findings freeze changed unrelated transaction state` with disposition `quarantine-malformed-freeze-event` and uses its exact eight-line binding. Both require fresh interactive approval and fail closed headlessly.
 
-Supersession records are append-only under `authority-supersession-v1`; they do not rewrite graph-v1 history. An exact retry is idempotent. A divergent retry or conflict fails closed and requires a new operation. RESET/RECOVER stay destructive and never run as a fallback from supersession. Rollback can stop recognizing a record but does not delete it, re-enable graph-v1 mutation, or select another successor.
+`gentle_review reconcile-authority` accepts one predecessor lineage and revision, one successor lineage and revision, an actor, and a reason. Pi derives the exact seven-line `gentle-ai.review-reconcile-authorization/v1` binding, or appends exactly `anomalies=unchanged_target,malformed_recovery_authorization` for the published dual anomaly in that order. Native code re-derives every anomaly; malformed bindings, changed revisions, unavailable native support, cancellation, and native refusal fail closed through typed envelopes.
 
-Pre-commit, pre-push, pre-PR, and release gates revalidate the recovered source, successor, receipt, policy, scope, intended-untracked proof, and live target. Recovery does not grant a new budget or bypass dangerous-command authorization, publication checks, historical graph-v1 receipt validation, or graph export.
+Reconciliation is intentionally narrow: native code may quarantine only the bound invalid compact-v2 recovery successor and persists the returned audit record; the predecessor stays untouched. Pi never recreates the retired `prepare-supersession`/`supersede` authority writer and never falls back to RESET or RECOVER.
+
+`gentle_review repair-legacy-alias` is the sole v2.1.11 route for `unsupported historical v1 operation alias`. The model supplies only lineage, actor, and reason. Pi freshly reads the native inventory, derives the canonical repository, exact legacy revision, fixed diagnostic, and fixed `quarantine-approved-historical-alias` disposition, displays the LF-only eight-line binding, and requires a new interactive approval. Native re-derives eligibility and quarantines rather than rewriting or validating the historical chain.
+
+`review dispose-result` is deliberately unsupported by Pi pending a separate design; it has no controller operation or fallback. All maintenance routes fail closed headlessly and never auto-run against legacy history.
+
+Native ordinary gates revalidate provider-selected authority, receipt, scope, intended-untracked proof, and the live target. Pi preserves a graph-v1 gate path only for explicit Judgment Day and historical graph receipt validation. Recovery grants no new budget and cannot bypass dangerous-command or publication checks. Legacy graph bundle export/import is retired.
+
+This is the post-U8 boundary, not the final architecture. [Issue #191](https://github.com/Gentleman-Programming/gentle-pi/issues/191) is the immediate final unit in this same delivery: extract the remaining Pi command-projection and lifecycle-gate surface from `review-transaction.ts`, repoint runtime enforcement, then delete only dependencies proven unreachable without weakening graph-v1 Judgment Day. The branch-wide High-tier 4R runs after that extraction, before the single size-exception PR.
 
 `reviewer` is not an installed subagent name. It is a routing intent. Select the concrete lens by risk profile:
 
@@ -189,9 +199,9 @@ flowchart TD
     D --> F
     E --> F
     F --> G["Independent verification"]
-    G --> H["INSPECT authority"]
-    H -->|Applicable invalid authority| X["Blocked: explicit recovery required"]
-    H -->|Clean or unrelated history| I["START freezes candidate, scope, tier, lenses, and budget"]
+    G --> H["Target-scoped native status"]
+    H -->|Ambiguous or corrupted| X["Blocked: native maintainer action"]
+    H -->|Unrelated| I["START freezes candidate, scope, tier, lenses, and budget"]
 
     subgraph Ordinary_review["Ordinary bounded review"]
         I --> R["reviewing"]
@@ -203,16 +213,17 @@ flowchart TD
         C2 --> C3["Apply scoped fix"]
         C3 --> V["validating"]
         V -->|Validator passes| A1
-        V -->|Fails; attempt and budget remain| C1
-        V -->|Malformed, out of scope, or exhausted| E1["escalated"]
+		V -->|Fails, malformed, or out of scope| E1["escalated"]
     end
 
     A1 --> P["Receipt binds the exact candidate tree"]
     P --> PC["Stage reviewed paths"]
-    PC --> G1{"pre-commit validate"}
-    G1 -->|allow| CM["Commit"]
-    G1 -->|scope changed| N["Start a new lineage"]
-    G1 -->|invalidated or escalated| X
+    PC --> G1{"durable commit transaction"}
+    G1 --> HK["Run effective pre-commit hook once"]
+    HK --> NV{"validate exact post-hook tree"}
+    NV -->|allow| CM["Commit through hook proxies and prove HEAD tree"]
+    NV -->|scope changed| N["Review post-hook tree; exact retry skips completed hook"]
+    NV -->|invalidated or escalated| X
     CM --> G2{"pre-push validate"}
     G2 -->|allow| PS["Push"]
     G2 -->|deny| X
@@ -230,9 +241,13 @@ flowchart TD
 
 Lifecycle gates never launch review actors. They rederive Git and publication targets, validate the existing receipt, and authorize one exact command. Any target drift, stale evidence, malformed authority, or unprovable state blocks delivery instead of silently reopening review.
 
-Native contract pairing is exact: this adapter supports `gentle-ai 2.1.5` only from its package-local verified binary and rechecks that version before every native operation. Production native operations resolve an absolute package-owned path and never fall back to `PATH` or a global executable. Once v2.1.5 has written review authority, rollback MUST preserve every native store and receipt and MUST NOT run a downgraded binary against that repository. Disable the Pi route or roll forward to a compatible authority-aware release instead; deleting authority data or reinstalling an older binary is not a rollback path.
+Native contract pairing is exact: this adapter resolves only the integrity-verified package-local Gentle AI v2.1.11 executable, independently hashes it, then negotiates `gentle-ai.review-integration/v1` outside the repository. Capabilities are cached by that executable digest. Every START, target status, FINALIZE, validate, and BIND-SDD request passes the same contract identifier. Current protocol 1.0 envelopes decode exactly against the vendored schemas; `recover` routes only the provider-selected `action_disposition`, and optional additions require a future compatible schema/minor that the provider explicitly advertises and the consumer negotiates.
+
+Target status owns `current_target`, `unrelated`, `ambiguous`, and `corrupted` applicability and returns one native action. Pi does not reconstruct ordinary authority from provider-private files or choose a lineage from repository-wide history. Restart recovery rebuilds only the derived candidate view from the native Git/content projection, including intended-untracked paths, symlinks, and immutable gitlink identities. Native failure envelopes retain their exact mutation outcome, replayability, required inputs, request digest, and next action. After an unknown or lost mutating result, Pi calls target status before any replay decision and returns only the provider-declared action.
+
+Direct authorized `git commit` commands use a durable recovery record under the Git common directory. The package runs the effective pre-commit hook once, captures the post-hook index, performs final native validation against that tree, suppresses only the already-completed pre-commit hook while preserving message/post hooks through proxies, and proves `HEAD^{tree}` before the tool result succeeds. Any unresolved, interrupted, failed, or mismatched transaction blocks push, PR, and release. Recovery never resets HEAD or the index automatically.
 
-Gentle AI v2.1.5 supports `gentle-ai review start --projection staged`, and upstream `main` now documents that focused-index workflow. The current `gentle-pi` adapter intentionally submits `projection: "workspace"` and does not expose staged projection yet. Native binary capability is not automatically a Pi adapter contract; package support still requires an adapter update, parity fixtures, and bounded validation.
+Once v2.1.11 has written review authority, rollback MUST preserve every native store and receipt and MUST NOT run a downgraded binary against that repository. Disable the Pi route or roll forward to a compatible authority-aware release instead; deleting authority data or reinstalling an older binary is not a rollback path.
 
 ### FINALIZE wrapper input
 
@@ -268,13 +283,13 @@ Refuter proof may be independent concrete reproduction evidence; it does not nee
 
 When native IDs are assigned to inferential findings, the first FINALIZE returns their canonical rows and a content-derived request hash without mutation; the second replays identical lens input with that hash and one complete refuter batch.
 
-Ordinary permits up to three failed targeted attempts within the original cumulative budget; each attempt is one correction plus one targeted validator. FINALIZE requires a positive forecast before editing and derives actual correction lines from Git. Initial lenses are never rerun, while frozen findings and genesis scope remain unchanged.
+Ordinary permits one correction transaction within the original budget. FINALIZE requires a positive forecast before editing and derives actual correction lines from Git; one targeted validator and final verification close that transaction. Initial lenses are never rerun, while frozen findings and genesis scope remain unchanged.
 
 The validator checks original criteria and correction regression only and cannot add scope or findings. Final evidence is hashed during FINALIZE, never at START.
 
 Compact ordinary has five states: `reviewing`, `correction_required`, `validating`, `approved`, and `escalated`.
 
-Each validator invocation cannot change claims, add findings, request fixes, launch actors, or request another attempt. Native FINALIZE alone returns `correction_required` while another bounded attempt remains.
+The validator cannot change claims, add findings, request fixes, launch actors, or request another attempt. A failed correction escalates instead of opening another review budget.
 
 Compact authority uses content-derived CAS under the Git common directory. Exact retries are idempotent; stale/semantic retries, terminal mutation, and same-lineage graph-v1/compact-v2 ambiguity fail closed.
 
@@ -290,9 +305,9 @@ Judgment Day alone may iterate discovery and scoped re-judgment, for at most two
 
 Findings surviving round two escalate; no third-round transition exists.
 
-Compact gate validation is read-only. It loads authority and receipt, derives the live target, then reloads authority and rederives target/publication evidence immediately before allow.
+Native compact gate validation is read-only. It loads authority and receipt, derives the live target, then reloads authority and rederives target/publication evidence immediately before allow.
 
-Pi also registers one one-shot authorization for the exact command and rederives its full publication target before registration, before bash-time native validation, and again after that validation before allowing the command. For `gh pr create`, the effective repository follows GitHub CLI precedence (`--repo`, then `GH_REPO`, then local inference), and both that source/value and the exact advertised remote head commit are bound and rechecked against reviewed local `HEAD`. Publication `ls-remote` probes are shell-free, output-bounded, time-bounded, and cancellation-aware. The complete bash-time publication/native revalidation uses one aggregate bounded deadline combined with Pi's cancellation signal when available. First-push, push destination, exact PR base/head, repository identity, release, and dangerous-command protections remain fail closed.
+Pi also registers one one-shot authorization for the exact command and rederives its full publication target before registration, before bash-time native validation, and again after that validation before allowing the command. The Pi-owned `lib/review-publication-gate.ts` module owns typed publication targets, configured push-destination binding, release projection, release fast-path evaluation, and publication rechecks without depending on graph-v1 authority storage. For `gh pr create`, the effective repository follows GitHub CLI precedence (`--repo`, then `GH_REPO`, then local inference), and both that source/value and the exact advertised remote head commit are bound and rechecked against reviewed local `HEAD`. Publication `ls-remote` probes are shell-free, output-bounded, time-bounded, and cancellation-aware. The complete bash-time publication/native revalidation uses one aggregate bounded deadline combined with Pi's cancellation signal when available. First-push, push destination, exact PR base/head, repository identity, release, and dangerous-command protections remain fail closed.
 Native pre-push to an existing branch is supported only when the effective push URL and repository identity equal the fetch URL and identity used by the exact `<remote>/<destination-branch>` selector, and its advertised commit equals the command update's old object. Split fetch/push topology is unsupported because PR #1216 introduced the upstream v2.1.1 `--base-ref` contract that v2.1.3 inherits unchanged: that contract resolves the selector through fetch-side remote-tracking state, and probing `pushurl` does not change selector resolution. Pi fails closed before native validation with `native-split-fetch-push-unsupported-until-upstream-supports-explicit-push-base`. Native pre-PR remains fetch-side and may use advertised remote selectors. Residual gap (separate follow-up): native first-push authorization remains unsupported until Pi has a persisted explicit advertised-base source. A missing destination fails closed with `native-first-push-unsupported-until-persisted-advertised-base-exists`; Pi never guesses a base from an upstream, default branch, or nearest ancestor.
 
 Native SDD readiness is true only for `verify` or `archive` with empty blockers and a published `reviewGate.result: "allow"`; review/resolve-review, missing gate evidence, and every non-allow or stale result remain blocked.
@@ -303,7 +318,7 @@ Dangerous-command safety remains independent and authoritative.
 
 SDD completion adds no review or Judgment Day pass.
 
-Review transactions, validation, and SDD perform no commit, push, PR creation, release, or publication.
+Review operations, validation, and SDD perform no push, PR creation, release, or publication. The separate durable commit runner may create exactly one local commit only after final native pre-commit validation and post-commit tree proof.
 
 `review-refuter` uses exactly `read`, `grep`, and `find` in a package-managed isolated installation. Project and user overrides may shadow the package asset; `gentle-pi` preserves those definitions and does not claim their effective permissions are package-compliant.
 
@@ -625,9 +640,14 @@ Memory contract for SDD delegation:
 | ------------------------------ | ---------------------------------------------------------------------------------------------------------- |
 | `extensions/gentle-ai.ts`      | Injects identity, orchestrates native review authority and lifecycle gates, refreshes global SDD assets, registers commands, applies model/persona config, and enforces runtime safety. |
 | `lib/native-review-cli.ts`     | Strict package-local adapter for Gentle AI START, FINALIZE, VALIDATE, SDD binding, and status contracts.     |
+| `lib/review-integration-v1.ts` | Strict consumer decoder for negotiated capabilities, operations, target status, projections, and failures.  |
+| `lib/git-commit-transaction.ts` | Durable hook/native-validation/commit/recovery transaction with publication blocking and HEAD proof.        |
 | `lib/review-candidate-view.ts` | Builds immutable changed-scope actor views while preserving full-tree, path, mode, symlink, and index integrity. |
+| `lib/review-canonical.ts`      | Permanent Pi-owned canonical JSON and domain-hash primitives for consumer-side identities.                   |
+| `lib/review-repository.ts`     | Permanent Pi-owned Git common-directory identity, safe Git environment, and authority-root binding.          |
 | `lib/gentle-ai-binary.ts`      | Resolves and verifies the confined package-local Gentle AI runtime without global or PATH fallback.          |
 | `scripts/gentle-ai-installer.mjs` | Downloads, verifies, extracts, and atomically promotes the pinned native runtime for six platform targets. |
+| `contracts/review-integration/v1/` | Byte-identical v2.1.11 provider schemas and conformance fixtures, hash-checked before packaging.       |
 | `extensions/startup-banner.ts` | Shows and configures the startup intro, color presets, compact runtime panel, and collaboration credit.     |
 | `extensions/sdd-init.ts`       | Registers `/sdd-init` for OpenSpec initialization.                                                         |
 | `extensions/skill-registry.ts` | Maintains `.atl/skill-registry.md` from project/user skills and closes file watchers on shutdown.          |
@@ -638,6 +658,8 @@ Memory contract for SDD delegation:
 | `skills/`                      | Gentle AI delivery and collaboration skills.                                                               |
 | `prompts/`                     | Gentle-prefixed prompt templates, including `/skill-creation`.                                             |
 | `docs/skill-style-guide.md`    | Normative style guide used by the packaged skill creation/improvement skills.                              |
+| `docs/native-authority-architecture.md` | Post-U8 ownership boundary, reproducible slimming metrics, Windows evidence, and exact #191 seam.     |
+| `docs/review-integration.md`   | Negotiated provider/consumer contract and the current Gentle Pi adoption boundary.                         |
 
 ## Development
 

package/assets/agents/jd-judge-a.md

@@ -2,6 +2,7 @@
 name: jd-judge-a
 description: Judgment Day blind adversarial reviewer A. Read-only; reports findings and does not fix code.
 tools:
+  - "*": false
   - read
   - grep
   - glob

package/assets/agents/jd-judge-b.md

@@ -2,6 +2,7 @@
 name: jd-judge-b
 description: Judgment Day blind adversarial reviewer B. Read-only; independently reports findings and does not fix code.
 tools:
+  - "*": false
   - read
   - grep
   - glob

package/assets/agents/review-readability.md

@@ -2,6 +2,7 @@
 name: review-readability
 description: R2 Readability reviewer — naming, complexity, intention, maintainability, review size, and context clarity.
 tools:
+  - "*": false
   - read
   - grep
   - glob

package/assets/agents/review-refuter.md

@@ -2,6 +2,7 @@
 name: review-refuter
 description: One-shot read-only verifier for the complete inferential-severe frozen-row list.
 tools:
+  - "*": false
   - read
   - grep
   - find

package/assets/agents/review-reliability.md

@@ -2,6 +2,7 @@
 name: review-reliability
 description: R3 Reliability reviewer — behavior-first tests, coverage value, edge cases, determinism, contracts, and regressions.
 tools:
+  - "*": false
   - read
   - grep
   - glob

package/assets/agents/review-resilience.md

@@ -2,6 +2,7 @@
 name: review-resilience
 description: R4 Resilience reviewer — fallbacks, retry/backoff, graceful degradation, observability, load, rollback, and SLO risks.
 tools:
+  - "*": false
   - read
   - grep
   - glob

package/assets/agents/review-risk.md

@@ -2,6 +2,7 @@
 name: review-risk
 description: R1 Risk reviewer — security, privilege boundaries, data exposure, dependency risks, and merge-blocking vulnerabilities.
 tools:
+  - "*": false
   - read
   - grep
   - glob

package/assets/agents/review-validator.md

@@ -2,6 +2,7 @@
 name: review-validator
 description: Per-attempt targeted proof validator for exact frozen rows.
 tools:
+  - "*": false
   - read
   - grep
   - find

package/assets/orchestrator-delegation.md

@@ -179,17 +179,19 @@ If multiple rows match, run the narrow set that covers the risk. Example: shell
 
 ### Compact Controller Routing
 
-Call `gentle_review` INSPECT before START. On `clean`, new ordinary review uses compact v2:
+Call `gentle_review` INSPECT before START. INSPECT delegates to negotiated target-scoped native status. When applicability is `unrelated` and native action is `start`, new ordinary review uses compact v2:
 
 ```json
-{"operation":"start","lineageId":"<optional-lineage>","input":"{\"mode\":\"ordinary\",\"policyHash\":\"<hash>\"}"}
+{"operation":"start","input":"{\"mode\":\"ordinary\",\"policyPath\":\"<optional-repository-local-path>\"}"}
 ```
 
 Use `start -> finalize -> validate` for ordinary review. START derives complete Git/untracked scope, lineage, tier, selected lenses, authored changed lines, and the correction budget. Use graph-v1 `judgment-day` only when explicitly selected.
 
-When INSPECT or START reports `blocked-legacy` or `blocked-mixed`, do not retry START and do not present migration as an option. Explain that the old receipts, approvals, ledgers, and lineages will lose authority, then request explicit user authorization for the exact returned `reset_request.confirmation`. RESET and RECOVER independently require a fresh operation-bound confirmation through the interactive Pi UI and fail closed in headless execution. The UI boundary cannot cryptographically attest the human's identity, so its residual trust is the operator controlling that Pi session; challenge freshness and repository/inventory binding remain runtime-enforced. Only after authorization, call RESET with the exact serialized `reset_request`; RESET and RECOVER internally INSPECT authority, and only a returned `clean` inspection with `start-fresh-ordinary-review-after-verified-clean` permits an immediate fresh ordinary START. If INSPECT reports `reset-in-progress`, use its durable original `reset_request` for authorized RECOVER.
+When target status is `current_target`, follow its single native action. `ambiguous` requires native lineage selection and `corrupted` requires native authority repair; Pi never guesses, resets, quarantines, migrates, or creates a lineage implicitly. Legacy/Pi ordinary authority stays compatibility-read-only. A `blocked-legacy` result requires explicit authorization for its exact compatibility challenge. Destructive RESET/RECOVER exists only for that historical lane and requires exact fresh interactive authorization; it is never a normal-lane fallback.
 
-A `lineage_created: false` result or a pre-authority validation error proves no lineage was created. After ambiguous output, replay the exact START or FINALIZE; compact CAS returns the exact committed revision or rejects stale/semantic retry. Never choose a different lineage merely because output was lost.
+Preserve the negotiated failure envelope exactly. `mutation_outcome: not_started` proves no mutation. For `unknown` or lost mutating output, the controller immediately calls target-scoped status and returns its exact action; it never emits a generic replay instruction. Replay the exact START or FINALIZE only when that provider result declares `exact_replay_safe` for the same canonical request and required lineage. Never choose a lineage merely because output was lost.
+
+Before authority access, `mutation_outcome: not_started` means no lineage was created. In the historical lane only, authorized RESET and RECOVER route to the audited native `gentle-ai review reclaim` and `gentle-ai review recover` operations; missing native inputs return `native-input-required` and are never invented, and INSPECT follows every committed native recovery record.
 
 Ordinary review runs the selected zero, one, or four lenses exactly once against `initial_review_tree`.
 
@@ -205,13 +207,13 @@ Inferential blockers use exactly one complete read-only refuter batch.
 
 Invalid, missing, duplicate, unknown, or inconclusive refuter output escalates without a replacement refuter.
 
-Ordinary permits up to three failed targeted attempts within the original cumulative budget. Each attempt uses one correction and one targeted validator; FINALIZE requires a positive pre-edit forecast and accounts Git-derived actual lines cumulatively.
+Ordinary permits one correction transaction within the original budget. FINALIZE requires a positive pre-edit forecast and accounts Git-derived actual lines. After the bounded edit, run one targeted validator and final verification; failure escalates without another correction or review budget.
 
-Initial lenses never rerun. Every attempt preserves frozen findings and genesis scope: the original candidate, paths, untracked set, and correction IDs. Targeted validation checks original criteria and correction regression only and adds no scope.
+Initial lenses never rerun. The correction preserves frozen findings and genesis scope: the original candidate, paths, untracked set, and correction IDs. Targeted validation checks original criteria and correction regression only and adds no scope.
 
 Final evidence is hashed during FINALIZE, not supplied at START.
 
-Each validator invocation cannot change claims, add findings, request fixes, launch actors, or request another attempt. Native FINALIZE alone returns `correction_required` while another bounded attempt remains.
+The validator cannot change claims, add findings, request fixes, launch actors, or request another attempt.
 
 Compact ordinary uses only `reviewing`, `correction_required`, `validating`, `approved`, and `escalated`.
 
@@ -225,9 +227,9 @@ Judgment Day alone may iterate discovery and scoped re-judgment, for at most two
 
 Findings surviving round two escalate; no third-round transition exists.
 
-Graph-v1 ordinary authority remains readable/gate-valid/exportable but read-only. Judgment Day remains mutable on graph-v1. Same-lineage graph/compact ambiguity fails closed and reset quarantines both.
+Graph-v1 ordinary authority remains readable and gate-valid but read-only. Legacy graph bundle export/import is retired. Judgment Day remains mutable on graph-v1, and native target status owns mixed-authority ambiguity and maintainer action.
 
-Compact gate validation is read-only and double-checks authority, target, publication refs, and evidence immediately before allow. Pi then registers one exact one-shot command authorization and rederives the target at bash time.
+Native compact gate validation is read-only and double-checks authority, target, publication refs, and evidence immediately before allow. Pi then registers one exact one-shot command authorization and rederives the target at bash time. The Pi-owned publication-gate module isolates typed targets, remote binding, release projection, and publication rechecks from graph-v1 authority storage; graph receipt validation remains reachable only for historical graph authority and explicit Judgment Day.
 Release from protected `main` may bypass receipt validation only when the tag targets the current immutable `origin/main` SHA, required CI for that exact SHA is successful, the remote head is rechecked before tag push, and no fresh risk evidence exists; otherwise release fails closed through native receipt validation.
 Major and post-incident releases require explicit extraordinary review even when fast-path checks pass.
 

package/assets/orchestrator.md

@@ -59,7 +59,7 @@ Mandatory Delegation Triggers — stop rules; once fired, delegate through the b
 
 1. **4-file rule** — 4+ files to understand → delegate a scout/mapping task.
 2. **Multi-file write rule** — 2+ non-trivial files touched → delegate one writer.
-3. **Lifecycle gate rule** — commit/push/PR/release validates an approved receipt and exact typed target with zero actors. Missing or changed authority fails closed; it never launches a same-lineage review.
+3. **Lifecycle gate rule** — commit/push/PR/release validates one receipt and exact target with zero actors. Direct commit uses the durable native-validated transaction; unresolved state blocks publication. Changed authority fails closed.
 4. **Incident rule** — diagnose wrong cwd/worktree/git/tooling incidents separately. An incident never reopens a closed review lineage or resets its budget.
 5. **Verification rule** — executing/delegating verification commands → `gentle-ai-verify`; only the 1-3-file read-only check stays inline.
 6. **Long-session rule** — ~20 tool calls, 5 exploratory reads, or 2 non-mechanical edits without delegation → pause and delegate.
@@ -108,9 +108,9 @@ For skill-shaped requests, do not treat injected `<available_skills>` as complet
 
 ## Bounded Review Transactions
 
-New ordinary review uses `gentle_review` `start -> finalize -> validate`. START freezes scope, findings, genesis, risk, and budget. FINALIZE permits up to three failed targeted attempts inside that cumulative budget without rerunning lenses.
+New ordinary review uses negotiated v1 `gentle_review` `start -> finalize -> validate`. Target status owns one action. START freezes scope, findings, risk, and budget. FINALIZE permits one correction; failure escalates.
 
-Compact gates use zero actors and rederive authority, the exact target, and publication evidence before allow. Pi adds exact one-shot command authorization and bash-time rederivation. Graph-v1 ordinary authority is read-only; Judgment Day remains graph-v1.
+Compact gates use zero actors and rederive authority, target, and evidence. Pi adds one-shot authorization. Legacy authority is read-only; Judgment Day is separate.
 Release from protected `main` may bypass receipt validation only when its immutable remote SHA and required CI are proven; otherwise native receipt validation applies.
 Major and post-incident releases require explicit extraordinary review even when fast-path checks pass.
 
@@ -118,6 +118,6 @@ Dangerous-command safety remains independent and authoritative.
 
 SDD completion adds no review or Judgment Day pass.
 
-Review transactions, validation, and SDD never deliver or publish.
+Review/SDD never publish. The durable transaction may create one local commit after native validation and HEAD proof.
 
 Controller and actor contract: `{{GENTLE_PI_DELEGATION_PATH}}`.

package/contracts/review-integration/v1/fixtures/capabilities-v1.1.fixture.json

@@ -0,0 +1,239 @@
+{
+  "schema": "gentle-ai.review-integration.capabilities/v1.1",
+  "contract": "gentle-ai.review-integration/v1",
+  "protocol": {
+    "major": 1,
+    "minor": 1
+  },
+  "package": {
+    "name": "gentle-ai",
+    "version": "2.1.7-test",
+    "release_channel": "prerelease"
+  },
+  "build": {
+    "id": "sha256:444a9f0608eb22c4697fd2092f3afcfab040c0918343e7e04087730fd33fd5e1",
+    "go_version": "go1.25.10",
+    "module_version": "v2.1.7",
+    "vcs": "git",
+    "vcs_revision": "0123456789abcdef0123456789abcdef01234567",
+    "vcs_time": "2026-07-15T18:00:00Z",
+    "vcs_modified": "false"
+  },
+  "executable": {
+    "sha256": "sha256:dcc846103b16d365eaeeb9d7f289c23fc4f2897f23def1cb3fe7f05557b64705",
+    "evidence": "self-reported",
+    "verification": "compare-with-published-manifest"
+  },
+  "operations": [
+    "review.bind_sdd",
+    "review.capabilities",
+    "review.finalize",
+    "review.start",
+    "review.status",
+    "review.validate"
+  ],
+  "gates": [
+    "post-apply",
+    "pre-commit",
+    "pre-push",
+    "pre-pr",
+    "release"
+  ],
+  "projections": [
+    "staged",
+    "workspace"
+  ],
+  "schemas": [
+    "gentle-ai.review-authority-status/v1",
+    "gentle-ai.review-gate-request/v1",
+    "gentle-ai.review-integration.capabilities/v1.1",
+    "gentle-ai.review-integration.failure/v1",
+    "gentle-ai.review-integration.operation/v1",
+    "gentle-ai.review-integration.projection/v1",
+    "gentle-ai.review-integration.start/v1",
+    "gentle-ai.review-integration.status/v1",
+    "gentle-ai.review-receipt/v1",
+    "gentle-ai.review-receipt/v2",
+    "gentle-ai.review-result-artifact/v1",
+    "https://gentle-ai.dev/schema/review/refuter/v1",
+    "https://gentle-ai.dev/schema/review/reviewer/v1",
+    "https://gentle-ai.dev/schema/review/validator/v1"
+  ],
+  "features": {
+    "mandatory": [
+      {
+        "name": "compact_v2_authority",
+        "supported": true,
+        "requires": []
+      },
+      {
+        "name": "exact_receipt_replay",
+        "supported": true,
+        "requires": [
+          "compact_v2_authority"
+        ]
+      },
+      {
+        "name": "five_delivery_gates",
+        "supported": true,
+        "requires": [
+          "compact_v2_authority"
+        ]
+      },
+      {
+        "name": "immutable_snapshot",
+        "supported": true,
+        "requires": []
+      },
+      {
+        "name": "legacy_v1_target_scoped_read_only",
+        "supported": true,
+        "requires": [
+          "target_scoped_status"
+        ]
+      },
+      {
+        "name": "repository_independent_capabilities",
+        "supported": true,
+        "requires": []
+      },
+      {
+        "name": "restart_safe_projection",
+        "supported": true,
+        "requires": [
+          "target_scoped_status"
+        ]
+      },
+      {
+        "name": "sdd_receipt_binding",
+        "supported": true,
+        "requires": [
+          "compact_v2_authority"
+        ]
+      },
+      {
+        "name": "target_scoped_status",
+        "supported": true,
+        "requires": [
+          "repository_independent_capabilities"
+        ]
+      },
+      {
+        "name": "uniform_failure_envelope",
+        "supported": true,
+        "requires": [
+          "repository_independent_capabilities"
+        ]
+      }
+    ],
+    "optional": [
+      {
+        "name": "base_ref_workspace_overlay",
+        "supported": true,
+        "requires": [
+          "immutable_snapshot",
+          "restart_safe_projection"
+        ]
+      },
+      {
+        "name": "bounded_process_waits",
+        "supported": true,
+        "requires": [
+          "uniform_failure_envelope"
+        ]
+      },
+      {
+        "name": "exact_gate_receipt_discovery",
+        "supported": true,
+        "requires": [
+          "five_delivery_gates"
+        ]
+      },
+      {
+        "name": "native_low_risk_verification",
+        "supported": true,
+        "requires": [
+          "compact_v2_authority"
+        ]
+      },
+      {
+        "name": "native_next_transition",
+        "supported": true,
+        "requires": [
+          "target_scoped_status"
+        ]
+      },
+      {
+        "name": "risk_reasons",
+        "supported": true,
+        "requires": [
+          "repository_independent_capabilities"
+        ]
+      },
+      {
+        "name": "scope_change_diagnostics",
+        "supported": true,
+        "requires": [
+          "uniform_failure_envelope"
+        ]
+      }
+    ]
+  },
+  "bootstrap": {
+    "command": "gentle-ai review status --cwd \u003crepo\u003e --contract gentle-ai.review-integration/v1 --next-transition",
+    "target_selector_variants": [
+      {
+        "target_type": "staged",
+        "arguments": [
+          "--projection",
+          "staged"
+        ]
+      },
+      {
+        "target_type": "base_ref",
+        "arguments": [
+          "--base-ref",
+          "\u003cref\u003e"
+        ]
+      },
+      {
+        "target_type": "workspace_overlay_base_ref",
+        "arguments": [
+          "--workspace-overlay",
+          "--base-ref",
+          "\u003cref\u003e"
+        ]
+      },
+      {
+        "target_type": "workspace_overlay_base_tree",
+        "arguments": [
+          "--workspace-overlay",
+          "--base-tree",
+          "\u003ctree\u003e"
+        ]
+      }
+    ],
+    "required_feature": "native_next_transition",
+    "unsupported_outcome": "unsupported-capability",
+    "parent_only": true
+  },
+  "compatibility": {
+    "minimum_protocol_major": 1,
+    "maximum_protocol_major": 1,
+    "additive_minor_policy": "optional-fields-only",
+    "unknown_mandatory": "reject",
+    "unknown_optional": "ignore",
+    "modes": [
+      "compact-v2",
+      "legacy-v1"
+    ],
+    "legacy_window": {
+      "mode": "legacy-v1",
+      "state": "active",
+      "read_only": true,
+      "deprecation_started": true,
+      "removal": "not-scheduled",
+      "minimum_compatibility_releases": 1
+    }
+  }
+}