gentle-pi 2.0.0 → 2.1.1

package/lib/gentle-ai-binary.ts

@@ -1,7 +1,16 @@
 import { createHash } from "node:crypto";
 import { existsSync, lstatSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { resolveGentleAiReleaseAsset } from "../scripts/gentle-ai-installer.mjs";
+import {
+	GENTLE_AI_INSTALL_METHOD,
+	GENTLE_AI_WINDOWS_SOURCE_MODULE,
+	GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM,
+	GENTLE_AI_WINDOWS_SOURCE_PACKAGE_PATH,
+	GENTLE_AI_WINDOWS_SOURCE_TAG,
+	isGentleAiWindowsGoVersionSupported,
+	isWindowsGoSumdbSourceTarget,
+	resolveGentleAiReleaseAsset,
+} from "../scripts/gentle-ai-installer.mjs";
 import { fileURLToPath } from "node:url";
 
 export const GENTLE_AI_BINARY_MISSING_CODE = "package-local-binary-missing";
@@ -49,6 +58,50 @@ function assertPosixExecutable(path: string, platform: string): void {
 	}
 }
 
+function signedReleaseManifest(asset: { name: string; sha256: string; binarySha256: string }): Record<string, string> {
+	return { version: GENTLE_AI_VERSION, asset: asset.name, assetSha256: asset.sha256, binarySha256: asset.binarySha256 };
+}
+
+function windowsSourceManifest(manifest: Record<string, unknown>, binarySha256: string, platform: string): Record<string, string> {
+	if (!isWindowsGoSumdbSourceTarget(platform, process.arch)) throw new Error("unsupported Windows source architecture");
+	const architecture = process.arch === "x64" ? "x64" : "arm64";
+	const goVersion = manifest.goVersion;
+	if (manifest.moduleChecksum !== GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM || typeof goVersion !== "string" || !isGentleAiWindowsGoVersionSupported(goVersion)) throw new Error("invalid Windows source provenance");
+	return {
+		version: GENTLE_AI_VERSION,
+		method: GENTLE_AI_INSTALL_METHOD.GO_SUMDB_SOURCE_BUILD,
+		package: GENTLE_AI_WINDOWS_SOURCE_PACKAGE_PATH,
+		module: GENTLE_AI_WINDOWS_SOURCE_MODULE,
+		tag: GENTLE_AI_WINDOWS_SOURCE_TAG,
+		architecture,
+		binarySha256,
+		moduleChecksum: GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM,
+		goVersion,
+		goos: "windows",
+		goarch: process.arch === "x64" ? "amd64" : "arm64",
+		buildMode: "exe",
+		compiler: "gc",
+		cgoEnabled: "0",
+	};
+}
+
+function expectedRuntimeManifest(platform: string, binarySha256: string, manifest: Record<string, unknown>): Record<string, string> {
+	if (platform === "win32") return windowsSourceManifest(manifest, binarySha256, platform);
+	const asset = resolveGentleAiReleaseAsset(platform, process.arch);
+	if (binarySha256 !== asset.binarySha256) throw new Error("runtime binary does not match pinned release digest");
+	return signedReleaseManifest(asset);
+}
+
+function isCanonicalManifest(contents: string, manifest: Record<string, unknown>, expected: Record<string, string>): boolean {
+	return contents === `${JSON.stringify(expected)}\n`
+		&& Object.keys(manifest).length === Object.keys(expected).length
+		&& Object.entries(expected).every(([key, value]) => manifest[key] === value);
+}
+
+function sameFile(before: ReturnType<typeof lstatSync>, after: ReturnType<typeof lstatSync>): boolean {
+	return before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs;
+}
+
 export function resolveGentleAiBinary(
 	packageRoot = dirname(dirname(fileURLToPath(import.meta.url))),
 	platform = process.platform,
@@ -66,22 +119,16 @@ export function resolveGentleAiBinary(
 		assertRegularNonSymlink(binaryPath);
 		assertPosixExecutable(binaryPath, platform);
 		assertRegularNonSymlink(manifestPath);
-		const before = lstatSync(binaryPath);
-		const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as Record<string, unknown>;
-		const asset = resolveGentleAiReleaseAsset(platform, process.arch);
-		if (
-			Object.keys(manifest).length !== 4 ||
-			["version", "asset", "assetSha256", "binarySha256"].some((key) => !(key in manifest)) ||
-			manifest.version !== GENTLE_AI_VERSION ||
-			manifest.asset !== asset.name ||
-			manifest.assetSha256 !== asset.sha256 ||
-			typeof manifest.binarySha256 !== "string" ||
-			manifest.binarySha256 !== asset.binarySha256 ||
-			!/^[0-9a-f]{64}$/.test(manifest.binarySha256) ||
-			sha256(readBinary(binaryPath)) !== manifest.binarySha256
-		) throw new Error("invalid runtime integrity manifest");
-		const after = lstatSync(binaryPath);
-		if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) throw new Error("runtime replaced during verification");
+		const beforeBinary = lstatSync(binaryPath);
+		const beforeManifest = lstatSync(manifestPath);
+		const manifestContents = readFileSync(manifestPath, "utf8");
+		const manifest = JSON.parse(manifestContents) as Record<string, unknown>;
+		const binarySha256 = sha256(readBinary(binaryPath));
+		const expected = expectedRuntimeManifest(platform, binarySha256, manifest);
+		if (!isCanonicalManifest(manifestContents, manifest, expected)) throw new Error("invalid runtime integrity manifest");
+		const afterBinary = lstatSync(binaryPath);
+		const afterManifest = lstatSync(manifestPath);
+		if (!sameFile(beforeBinary, afterBinary) || !sameFile(beforeManifest, afterManifest)) throw new Error("runtime replaced during verification");
 		assertPosixExecutable(binaryPath, platform);
 		return binaryPath;
 	} catch {

package/lib/native-review-cli.ts

@@ -106,6 +106,7 @@ export interface NativeReviewCli {
 	reviewStatus(request: NativeReviewStatusRequest): Promise<NativeReviewStatusResult>;
 	capabilities?(request?: NativeCapabilitiesRequest): Promise<ReviewCapabilitiesV2>;
 	targetStatus?(request: NativeTargetStatusRequest): Promise<ReviewStatusV3>;
+	answerConsent?(request: NativeReviewConsentAnswerRequest): Promise<NativeReviewConsentAnswerResult>;
 	reclaim?(request: NativeReviewReclaimRequest): Promise<NativeReviewRecoveryResult>;
 	recover?(request: NativeReviewRecoverRequest): Promise<NativeReviewRecoveryResult>;
 	abandon?(request: NativeReviewAbandonRequest): Promise<NativeReviewRecoveryResult>;
@@ -370,7 +371,22 @@ export interface NativeReviewVerificationEvidenceV2 {
 	recordDigest: string;
 }
 
-export interface NativeStartRequest { cwd: string; baseRef?: string; committedOnly?: boolean; lineageId?: string; policyPath?: string; focus?: string; projection?: "workspace" | "staged"; signal?: AbortSignal; }
+export interface NativeStartRequest { cwd: string; baseRef?: string; committedOnly?: boolean; lineageId?: string; policyPath?: string; focus?: string; targetIdentity?: string; projection?: "workspace" | "staged"; signal?: AbortSignal; }
+export const NATIVE_REVIEW_CONSENT_ANSWER = { GRANTED: "granted", DECLINED: "declined" } as const;
+export type NativeReviewConsentAnswer = (typeof NATIVE_REVIEW_CONSENT_ANSWER)[keyof typeof NATIVE_REVIEW_CONSENT_ANSWER];
+export interface NativeReviewConsentAnswerRequest { cwd: string; consent: ReviewConsentV2; answer: NativeReviewConsentAnswer; signal?: AbortSignal; }
+export interface NativeReviewConsentDeclinedResult {
+	kind: "declined";
+	targetIdentity: string;
+	projection: "workspace" | "staged";
+	riskLevel: "medium" | "high";
+	changedFiles: number;
+	changedLines: number;
+	consent: "declined_this_candidate";
+	raw: Readonly<Record<string, unknown>>;
+}
+export interface NativeReviewConsentStartedResult { kind: "started"; start: NativeStartResult; }
+export type NativeReviewConsentAnswerResult = NativeReviewConsentStartedResult | NativeReviewConsentDeclinedResult;
 export interface NativeFinalizeLensResult { lens: string; document: unknown; }
 export interface NativeFinalizeRequest extends NativeReviewFinalizeCapturedResults {
 	cwd: string;
@@ -559,7 +575,13 @@ const REVIEW_RISK_SUBJECT_BY_SIGNAL: Readonly<Record<string, string>> = Object.f
 // an unmapped signal degrades to this rather than dropping the path entirely.
 const REVIEW_RISK_UNKNOWN_SIGNAL_SUBJECT = "a sensitive area";
 
-function nativeRiskEvidenceSubject(reason: Record<string, unknown>): string {
+interface NativeRiskEvidenceReason {
+	readonly code?: string;
+	readonly signal?: string;
+	readonly path?: string;
+}
+
+function nativeRiskEvidenceSubject(reason: NativeRiskEvidenceReason): string {
 	const code = typeof reason.code === "string" ? reason.code : "";
 	if (code === "hot_path") {
 		const signal = typeof reason.signal === "string" ? reason.signal : "";
@@ -568,7 +590,7 @@ function nativeRiskEvidenceSubject(reason: Record<string, unknown>): string {
 	return REVIEW_RISK_SUBJECT_BY_CODE[code] ?? "";
 }
 
-function nativeRiskEvidencePhrase(reason: Record<string, unknown>): string {
+function nativeRiskEvidencePhrase(reason: NativeRiskEvidenceReason): string {
 	const path = typeof reason.path === "string" ? reason.path.trim() : "";
 	// An empty file is named first and described second. Every other subject
 	// reads "<what changed> in <path>", which for a file with no bytes would
@@ -581,7 +603,7 @@ function nativeRiskEvidencePhrase(reason: Record<string, unknown>): string {
 	return `${subject} in ${path}`;
 }
 
-export function nativeRiskEvidencePhrases(riskLevel: string, reasons: readonly Record<string, unknown>[]): readonly string[] {
+export function nativeRiskEvidencePhrases(riskLevel: string, reasons: readonly NativeRiskEvidenceReason[]): readonly string[] {
 	if (riskLevel !== "high" && riskLevel !== "medium") return [];
 	const phrases = reasons.map((reason) => nativeRiskEvidencePhrase(reason)).filter((phrase) => phrase !== "");
 	return riskLevel === "medium" ? [REVIEW_MEDIUM_RISK_REASON, ...phrases] : phrases;
@@ -1015,6 +1037,21 @@ function decodeNativeReviewStatus(value: unknown): NativeReviewStatusResult {
 	};
 }
 function isWindowsRepositoryPath(value: string): boolean { return /^[A-Za-z]:[\\/]/.test(value) || /^\\\\/.test(value); }
+export function normalizeNativeReviewCwd(value: string, platform: NodeJS.Platform = process.platform): string {
+	if (platform !== "win32") return value;
+	const gitBashDrive = /^\/([A-Za-z])(?:\/(.*))?$/.exec(value);
+	const windowsPath = gitBashDrive === null
+		? value
+		: `${gitBashDrive[1]!.toUpperCase()}:/${gitBashDrive[2] ?? ""}`;
+	if (!isWindowsRepositoryPath(windowsPath)) return windowsPath;
+	const normalized = win32.normalize(windowsPath);
+	return normalized.replace(/^([a-z]):/, (_match, drive: string) => `${drive.toUpperCase()}:`);
+}
+async function canonicalNativeReviewCwd(value: string): Promise<string> {
+	const normalized = normalizeNativeReviewCwd(value);
+	try { return await realpath(normalized); }
+	catch { return normalized; }
+}
 async function repositoryPathIdentity(value: string): Promise<string> {
 	const windowsPath = isWindowsRepositoryPath(value);
 	try { return `filesystem:${windowsPath ? (await realpath(value)).toLowerCase() : await realpath(value)}`; }
@@ -1121,6 +1158,7 @@ function nativeError(code: NativeReviewErrorCode, operation: NativeReviewOperati
 interface NativeJsonExecution {
 	body: Record<string, unknown>;
 	exitCode: number;
+	process: ExecFileResult;
 }
 
 export class NativeReviewCliV214 {
@@ -1337,12 +1375,13 @@ export class NativeReviewCliV214 {
 	// and always pass `--scope clone` so Pi's own kill-switch command surface
 	// never mutates the operator's global gentle-ai state across other clones.
 	async reviewMode(request: NativeReviewModeRequest): Promise<NativeReviewModeResult> {
-		await this.verifyVersion(request.cwd, request.signal, ["mode"]);
+		const cwd = await canonicalNativeReviewCwd(request.cwd);
+		await this.verifyVersion(cwd, request.signal, ["mode"]);
 		const mutating = request.operation !== NATIVE_REVIEW_MODE_OPERATION.STATUS;
 		const { body } = await this.execute(
 			NATIVE_REVIEW_OPERATION.MODE,
-			request.cwd,
-			["review", "mode", request.operation, "--cwd", request.cwd, ...(mutating ? ["--scope", "clone"] : []), "--json"],
+			cwd,
+			["review", "mode", request.operation, "--cwd", cwd, ...(mutating ? ["--scope", "clone"] : []), "--json"],
 			mutating,
 			request.signal,
 		);
@@ -1617,12 +1656,13 @@ export class NativeReviewIntegrationError extends Error {
 }
 
 // Raised when negotiated START answers `consent/v2` (action:
-// "consent_required") instead of `start/v3`. Pi stays headless and never
-// sends `--consent relay`, so this is a blocking question surfaced to the
-// caller rather than answered on its behalf.
+// "consent_required") instead of `start/v3`. The provider has frozen no
+// authority yet: Pi must relay this complete candidate-scoped question and may
+// answer only through one of the exact invocations carried by the envelope.
 export class NativeReviewConsentRequiredError extends Error {
 	readonly consent: ReviewConsentV2;
 	readonly launchAttempted = true;
+	readonly mutationOutcome = "none";
 	constructor(consent: ReviewConsentV2) {
 		super(consent.headline);
 		this.name = "NativeReviewConsentRequiredError";
@@ -1630,6 +1670,117 @@ export class NativeReviewConsentRequiredError extends Error {
 	}
 }
 
+// Raised when the provider-issued consent invocation no longer matches the
+// binding Pi is answering for. Every one of these guards runs before the
+// provider is launched, so the failure is local and nothing was mutated. It
+// carries its own identity precisely so callers never report it as a provider
+// outage: an opaque `native-operation-failed` here sent issue #247 chasing a
+// missing `--cwd` that Pi does forward.
+export class NativeReviewConsentBindingError extends Error {
+	readonly reason: string;
+	readonly launchAttempted = false;
+	readonly mutationOutcome = "none";
+	constructor(reason: string, message: string) {
+		super(message);
+		this.name = "NativeReviewConsentBindingError";
+		this.reason = reason;
+	}
+}
+
+function splitNativeConsentInvocation(invocation: string): readonly string[] {
+	const words: string[] = [];
+	let current = "";
+	let quote: "'" | '"' | undefined;
+	let escaping = false;
+	let started = false;
+	for (const character of invocation.trim()) {
+		if (escaping) {
+			current += character;
+			escaping = false;
+			started = true;
+			continue;
+		}
+		if (character === "\\" && quote !== "'") {
+			escaping = true;
+			started = true;
+			continue;
+		}
+		if (quote !== undefined) {
+			if (character === quote) quote = undefined;
+			else current += character;
+			started = true;
+			continue;
+		}
+		if (character === "'" || character === '"') {
+			quote = character;
+			started = true;
+			continue;
+		}
+		if (/\s/.test(character)) {
+			if (started) {
+				words.push(current);
+				current = "";
+				started = false;
+			}
+			continue;
+		}
+		current += character;
+		started = true;
+	}
+	if (quote !== undefined || escaping) throw new TypeError("Native consent invocation has invalid quoting");
+	if (started) words.push(current);
+	return words;
+}
+
+function exactConsentOption(arguments_: readonly string[], name: string): string {
+	const values: string[] = [];
+	for (let index = 0; index < arguments_.length; index += 1) {
+		const token = arguments_[index]!;
+		if (token === name) {
+			const value = arguments_[index + 1];
+			if (value === undefined) throw new NativeReviewConsentBindingError("consent-invocation-option-invalid", `Native consent invocation ${name} is missing its value`);
+			values.push(value);
+			index += 1;
+		} else if (token.startsWith(`${name}=`)) values.push(token.slice(name.length + 1));
+	}
+	if (values.length !== 1) throw new NativeReviewConsentBindingError("consent-invocation-option-invalid", `Native consent invocation requires exactly one ${name}`);
+	return values[0]!;
+}
+
+function consentInvocationArguments(request: NativeReviewConsentAnswerRequest): readonly string[] {
+	const choice = request.consent.choices.find((candidate) => candidate.answer === request.answer);
+	if (choice === undefined) throw new NativeReviewConsentBindingError("consent-answer-unknown", "Native consent answer must be granted or declined");
+	const words = splitNativeConsentInvocation(choice.invocation);
+	if (words[0] !== "gentle-ai" || words[1] !== "review" || words[2] !== "start") throw new NativeReviewConsentBindingError("consent-invocation-not-start", "Native consent invocation is not a provider review START");
+	const arguments_ = words.slice(1);
+	if (exactConsentOption(arguments_, "--contract") !== REVIEW_INTEGRATION_CONTRACT) throw new NativeReviewConsentBindingError("consent-invocation-contract-changed", "Native consent invocation contract changed");
+	if (exactConsentOption(arguments_, "--cwd") !== request.cwd) throw new NativeReviewConsentBindingError("consent-invocation-cwd-changed", "Native consent invocation repository binding changed");
+	if (exactConsentOption(arguments_, "--target") !== request.consent.targetIdentity) throw new NativeReviewConsentBindingError("consent-invocation-target-changed", "Native consent invocation target binding changed");
+	if (exactConsentOption(arguments_, "--projection") !== request.consent.projection) throw new NativeReviewConsentBindingError("consent-invocation-projection-changed", "Native consent invocation projection binding changed");
+	if (exactConsentOption(arguments_, "--consent") !== request.answer || arguments_.at(-1) !== request.answer) throw new NativeReviewConsentBindingError("consent-invocation-answer-changed", "Native consent invocation answer binding changed");
+	return arguments_;
+}
+
+function decodeDeclinedConsentStart(value: unknown, expected: NativeReviewConsentAnswerRequest): NativeReviewConsentDeclinedResult {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new TypeError("Native declined consent result must be an object");
+	const body = value as Record<string, unknown>;
+	if (body.operation !== "review/start" || body.action !== "declined" || body.consent !== "declined_this_candidate") throw new TypeError("Native declined consent result has an invalid identity");
+	if (body.target_identity !== expected.consent.targetIdentity || body.projection !== expected.consent.projection || body.risk_level !== expected.consent.riskLevel) throw new TypeError("Native declined consent result target binding changed");
+	if (body.lenses_required !== false || !Array.isArray(body.selected_lenses) || body.selected_lenses.length !== 0 || !Array.isArray(body.lens_bindings) || body.lens_bindings.length !== 0) throw new TypeError("Native declined consent result must create no review authority");
+	if (typeof body.changed_files !== "number" || !Number.isSafeInteger(body.changed_files) || body.changed_files < 0 || typeof body.changed_lines !== "number" || !Number.isSafeInteger(body.changed_lines) || body.changed_lines < 0) throw new TypeError("Native declined consent result has invalid change counts");
+	if (body.lineage_id !== "" || body.state !== "" || body.correction_budget !== 0) throw new TypeError("Native declined consent result cannot carry review authority");
+	return {
+		kind: "declined",
+		targetIdentity: expected.consent.targetIdentity,
+		projection: expected.consent.projection,
+		riskLevel: expected.consent.riskLevel,
+		changedFiles: body.changed_files,
+		changedLines: body.changed_lines,
+		consent: "declined_this_candidate",
+		raw: body,
+	};
+}
+
 type NativeExecutableDigestResolver = (path: string) => string;
 const nativeCapabilitiesByDigest = new Map<string, Promise<ReviewCapabilitiesV2>>();
 
@@ -1819,41 +1970,40 @@ export class NativeReviewCliV216 implements NativeReviewCli {
 		if (request.baseRef !== undefined && !isCanonicalProcessString(request.baseRef)) throw new TypeError("Native START baseRef must be a non-empty, trimmed, NUL-free string");
 		if (request.baseRef !== undefined && request.committedOnly !== true) throw new TypeError("Native START baseRef requires explicit committedOnly acknowledgement");
 		if (request.baseRef === undefined && request.committedOnly !== undefined) throw new TypeError("Native START committedOnly requires an explicit baseRef");
-		// A negotiated START requires exactly one --contract, --target, and
-		// --projection. The target is resolved here, from the same root START is
-		// about to run in, rather than threaded in by the caller: the caller's
-		// root and START's root differ whenever a candidate view is in play, and
-		// a target frozen from the wrong root would name a snapshot this START
-		// never inspects. targetStatus is read-only, so this costs one extra
-		// read and cannot create authority.
+		if (request.targetIdentity !== undefined && !/^sha256:[0-9a-f]{64}$/.test(request.targetIdentity)) throw new TypeError("Native START targetIdentity must be a canonical sha256 identity");
+		// The controller supplies the target it already projected from the
+		// authority workspace after proving its immutable actor view is identical.
+		// Direct adapter callers may omit it and retain the same-root projection.
 		const projection = request.projection ?? "workspace";
-		const target = await this.targetStatus({
+		const targetIdentity = request.targetIdentity ?? (await this.targetStatus({
 			cwd: request.cwd,
 			projection,
 			...(request.baseRef === undefined ? {} : { baseRef: request.baseRef }),
 			...(request.lineageId === undefined ? {} : { lineageId: request.lineageId }),
 			...(request.signal === undefined ? {} : { signal: request.signal }),
-		});
+		})).targetIdentity;
 		const execution = await this.negotiated(NATIVE_REVIEW_OPERATION.START, request.cwd, [
 			"review", "start", "--contract", REVIEW_INTEGRATION_CONTRACT, "--cwd", request.cwd,
-			"--target", target.targetIdentity, "--projection", projection,
+			"--target", targetIdentity, "--projection", projection,
 			...(request.baseRef === undefined ? [] : ["--base-ref", request.baseRef, "--committed-only"]),
 			...(request.lineageId === undefined ? [] : ["--lineage", request.lineageId]),
 			...(request.policyPath === undefined ? [] : ["--policy", request.policyPath]),
 			...(request.focus === undefined ? [] : ["--focus", request.focus]),
-			// A headless START that reviews without asking still succeeds; its
-			// consent notices are console output, never a failure signal.
-		], true, request.signal, REVIEW_CONSENT_NOTICES);
+			"--consent", "relay",
+		], true, request.signal);
 		// A negotiated v2 START may answer `consent/v2` (action:
 		// "consent_required") instead of `start/v3` when the provider needs an
-		// explicit answer it cannot infer. Discriminated BEFORE decode: the two
-		// envelopes share no required shape, and Pi never sends `--consent
-		// relay`, so this is always surfaced to the caller, never answered here.
+		// explicit answer it cannot infer. Discriminate before decode and surface
+		// the complete envelope; only the caller can map a human answer.
 		if (execution.body.action === "consent_required") {
-			throw new NativeReviewConsentRequiredError(decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewConsentV2(execution.body)));
+			const consent = decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewConsentV2(execution.body));
+			if (consent.targetIdentity !== targetIdentity || consent.projection !== projection) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native consent target binding mismatch");
+			throw new NativeReviewConsentRequiredError(consent);
 		}
 		const result = decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewStartV3(execution.body));
 		if (request.lineageId !== undefined && result.lineageId !== request.lineageId) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native start lineage mismatch");
+		const resultTarget = result.targetIdentity ?? result.repositoryContext?.targetIdentity;
+		if (resultTarget !== undefined && resultTarget !== targetIdentity) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native start target mismatch");
 		return {
 			lineageId: result.lineageId,
 			state: result.state as NativeStartResult["state"],
@@ -1882,6 +2032,36 @@ export class NativeReviewCliV216 implements NativeReviewCli {
 		};
 	}
 
+	async answerConsent(request: NativeReviewConsentAnswerRequest): Promise<NativeReviewConsentAnswerResult> {
+		const arguments_ = consentInvocationArguments(request);
+		const execution = await this.negotiated(NATIVE_REVIEW_OPERATION.START, request.cwd, arguments_, true, request.signal);
+		if (request.answer === NATIVE_REVIEW_CONSENT_ANSWER.DECLINED) {
+			return decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeDeclinedConsentStart(execution.body, request));
+		}
+		const result = decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewStartV3(execution.body));
+		const answeredTarget = result.targetIdentity ?? result.repositoryContext?.targetIdentity;
+		if (answeredTarget !== request.consent.targetIdentity) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native consent answer target mismatch");
+		const lineageId = exactConsentOption(arguments_, "--lineage");
+		if (result.lineageId !== lineageId) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native consent answer lineage mismatch");
+		return { kind: "started", start: {
+			lineageId: result.lineageId,
+			state: result.state as NativeStartResult["state"],
+			riskLevel: result.riskLevel,
+			selectedLenses: result.selectedLenses,
+			changedFiles: result.changedFiles,
+			changedLines: result.changedLines,
+			correctionBudget: result.correctionBudget,
+			action: result.action as NativeStartAction,
+			lensesRequired: result.lensesRequired,
+			riskReasons: result.riskReasons.map((reason) => ({ ...reason })),
+			...(() => {
+				const evidence = nativeRiskEvidencePhrases(result.riskLevel, result.riskReasons);
+				return evidence.length === 0 ? {} : { riskEvidence: evidence };
+			})(),
+			raw: result.raw,
+		} };
+	}
+
 	private async stageDocument(directory: string, name: string, document: unknown): Promise<string> {
 		const path = join(directory, `${name}.json`);
 		await writeFile(path, JSON.stringify(document), { encoding: "utf8", mode: 0o600 });

package/lib/review-candidate-view.ts

@@ -798,11 +798,15 @@ export class CandidateViewRegistry {
 		const base = head.tree === descriptor.baseTree ? head : resolveCandidateBaseTree(root, descriptor.baseTree, this.gitExecutor);
 		const committedOnly = head.tree === descriptor.currentCandidateTree && base.tree !== head.tree;
 		if (!committedOnly && head.tree !== descriptor.baseTree) throw new CandidateViewError("native projection base no longer matches HEAD");
-		// The descriptor's own `projection` label ("staged" = a committed range,
-		// "workspace" = dirty-inclusive) must agree with what Pi independently
-		// derives from the base/candidate/HEAD relationship. Neither trusting
-		// nor silently overriding a mislabeled claim is safe: fail closed.
-		if ((descriptor.projection === "staged") !== committedOnly) {
+		// Native `staged` covers both a committed HEAD range and the exact current
+		// index over HEAD. Re-derive the latter from Git instead of trusting the
+		// label; this also rejects dirty-inclusive snapshots mislabeled as staged.
+		const stagedIndex = !committedOnly && descriptor.baseTree === head.tree &&
+			git(root, ["write-tree"], process.env, this.gitExecutor) === descriptor.currentCandidateTree;
+		if (
+			(descriptor.projection === "staged" && !committedOnly && !stagedIndex) ||
+			(descriptor.projection === "workspace" && committedOnly)
+		) {
 			throw new CandidateViewError("native projection commit-state does not match its declared projection kind", "projection-kind-drift");
 		}
 		const tree = parseTree(root, descriptor.currentCandidateTree, this.gitExecutor);

package/lib/review-integration-v2.ts

@@ -1303,10 +1303,14 @@ export function decodeReviewConsentV2(value: unknown): ReviewConsentV2 {
 	if (body.action !== "consent_required") throw new TypeError("consent.action must be consent_required");
 	if (body.blocking !== true) throw new TypeError("consent.blocking must be true");
 
+	const targetIdentity = sha256(body.target_identity, "consent.target_identity");
 	const choicesArray = body.choices;
 	if (!Array.isArray(choicesArray) || choicesArray.length !== 2) throw new TypeError("consent.choices must have exactly 2 items");
 	const granted = decodeConsentChoice(choicesArray[0], "consent.choices[0]", "granted");
 	const declined = decodeConsentChoice(choicesArray[1], "consent.choices[1]", "declined");
+	for (const choice of [granted, declined]) {
+		if (!choice.invocation.includes(` --target ${targetIdentity} `)) throw new TypeError(`consent choice ${choice.answer} invocation must bind consent.target_identity`);
+	}
 
 	const offPathSource = exactRecord(body.off_path, "consent.off_path", ["note", "command"]);
 	if (offPathSource.command !== "gentle-ai review mode disable") throw new TypeError("consent.off_path.command is unsupported");
@@ -1317,7 +1321,7 @@ export function decodeReviewConsentV2(value: unknown): ReviewConsentV2 {
 		operation: "review.start",
 		action: "consent_required",
 		blocking: true,
-		targetIdentity: sha256(body.target_identity, "consent.target_identity"),
+		targetIdentity,
 		projection: enumeration(body.projection, REQUIRED_PROJECTIONS, "consent.projection"),
 		riskLevel: enumeration(body.risk_level, ["medium", "high"] as const, "consent.risk_level"),
 		changedFiles: integer(body.changed_files, "consent.changed_files"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gentle-pi",
-  "version": "2.0.0",
+  "version": "2.1.1",
   "description": "Turn Pi into el Gentleman: a senior-architect development harness with SDD/OpenSpec, subagents, strict TDD evidence, review guardrails, and skill discovery.",
   "license": "MIT",
   "type": "module",

package/runtime/gentle-ai-binary.mjs

@@ -2,7 +2,16 @@
 import { createHash } from "node:crypto";
 import { existsSync, lstatSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { resolveGentleAiReleaseAsset } from "../scripts/gentle-ai-installer.mjs";
+import {
+	GENTLE_AI_INSTALL_METHOD,
+	GENTLE_AI_WINDOWS_SOURCE_MODULE,
+	GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM,
+	GENTLE_AI_WINDOWS_SOURCE_PACKAGE_PATH,
+	GENTLE_AI_WINDOWS_SOURCE_TAG,
+	isGentleAiWindowsGoVersionSupported,
+	isWindowsGoSumdbSourceTarget,
+	resolveGentleAiReleaseAsset,
+} from "../scripts/gentle-ai-installer.mjs";
 import { fileURLToPath } from "node:url";
 
 export const GENTLE_AI_BINARY_MISSING_CODE = "package-local-binary-missing";
@@ -50,6 +59,50 @@ function assertPosixExecutable(path        , platform        )       {
 	}
 }
 
+function signedReleaseManifest(asset                                                        )                         {
+	return { version: GENTLE_AI_VERSION, asset: asset.name, assetSha256: asset.sha256, binarySha256: asset.binarySha256 };
+}
+
+function windowsSourceManifest(manifest                         , binarySha256        , platform        )                         {
+	if (!isWindowsGoSumdbSourceTarget(platform, process.arch)) throw new Error("unsupported Windows source architecture");
+	const architecture = process.arch === "x64" ? "x64" : "arm64";
+	const goVersion = manifest.goVersion;
+	if (manifest.moduleChecksum !== GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM || typeof goVersion !== "string" || !isGentleAiWindowsGoVersionSupported(goVersion)) throw new Error("invalid Windows source provenance");
+	return {
+		version: GENTLE_AI_VERSION,
+		method: GENTLE_AI_INSTALL_METHOD.GO_SUMDB_SOURCE_BUILD,
+		package: GENTLE_AI_WINDOWS_SOURCE_PACKAGE_PATH,
+		module: GENTLE_AI_WINDOWS_SOURCE_MODULE,
+		tag: GENTLE_AI_WINDOWS_SOURCE_TAG,
+		architecture,
+		binarySha256,
+		moduleChecksum: GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM,
+		goVersion,
+		goos: "windows",
+		goarch: process.arch === "x64" ? "amd64" : "arm64",
+		buildMode: "exe",
+		compiler: "gc",
+		cgoEnabled: "0",
+	};
+}
+
+function expectedRuntimeManifest(platform        , binarySha256        , manifest                         )                         {
+	if (platform === "win32") return windowsSourceManifest(manifest, binarySha256, platform);
+	const asset = resolveGentleAiReleaseAsset(platform, process.arch);
+	if (binarySha256 !== asset.binarySha256) throw new Error("runtime binary does not match pinned release digest");
+	return signedReleaseManifest(asset);
+}
+
+function isCanonicalManifest(contents        , manifest                         , expected                        )          {
+	return contents === `${JSON.stringify(expected)}\n`
+		&& Object.keys(manifest).length === Object.keys(expected).length
+		&& Object.entries(expected).every(([key, value]) => manifest[key] === value);
+}
+
+function sameFile(before                              , after                              )          {
+	return before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs;
+}
+
 export function resolveGentleAiBinary(
 	packageRoot = dirname(dirname(fileURLToPath(import.meta.url))),
 	platform = process.platform,
@@ -67,22 +120,16 @@ export function resolveGentleAiBinary(
 		assertRegularNonSymlink(binaryPath);
 		assertPosixExecutable(binaryPath, platform);
 		assertRegularNonSymlink(manifestPath);
-		const before = lstatSync(binaryPath);
-		const manifest = JSON.parse(readFileSync(manifestPath, "utf8"))                           ;
-		const asset = resolveGentleAiReleaseAsset(platform, process.arch);
-		if (
-			Object.keys(manifest).length !== 4 ||
-			["version", "asset", "assetSha256", "binarySha256"].some((key) => !(key in manifest)) ||
-			manifest.version !== GENTLE_AI_VERSION ||
-			manifest.asset !== asset.name ||
-			manifest.assetSha256 !== asset.sha256 ||
-			typeof manifest.binarySha256 !== "string" ||
-			manifest.binarySha256 !== asset.binarySha256 ||
-			!/^[0-9a-f]{64}$/.test(manifest.binarySha256) ||
-			sha256(readBinary(binaryPath)) !== manifest.binarySha256
-		) throw new Error("invalid runtime integrity manifest");
-		const after = lstatSync(binaryPath);
-		if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) throw new Error("runtime replaced during verification");
+		const beforeBinary = lstatSync(binaryPath);
+		const beforeManifest = lstatSync(manifestPath);
+		const manifestContents = readFileSync(manifestPath, "utf8");
+		const manifest = JSON.parse(manifestContents)                           ;
+		const binarySha256 = sha256(readBinary(binaryPath));
+		const expected = expectedRuntimeManifest(platform, binarySha256, manifest);
+		if (!isCanonicalManifest(manifestContents, manifest, expected)) throw new Error("invalid runtime integrity manifest");
+		const afterBinary = lstatSync(binaryPath);
+		const afterManifest = lstatSync(manifestPath);
+		if (!sameFile(beforeBinary, afterBinary) || !sameFile(beforeManifest, afterManifest)) throw new Error("runtime replaced during verification");
 		assertPosixExecutable(binaryPath, platform);
 		return binaryPath;
 	} catch {