gentle-pi 2.1.2 → 2.2.0

package/scripts/test-packed-runner.mjs

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { existsSync, mkdtempSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 const root = fileURLToPath(new URL("..", import.meta.url));
 const temporary = mkdtempSync(join(tmpdir(), "gentle-pi-packed-runner-"));
@@ -58,7 +59,20 @@ try {
 	if (versions.length !== 1) throw new Error("packed install did not contain exactly one package-local Gentle AI version");
 	const executable = join(packageRoot, ".gentle-ai", versions[0].name, process.platform === "win32" ? "gentle-ai.exe" : "gentle-ai");
 	const capabilities = JSON.parse(execFileSync(executable, ["review", "capabilities", "--contract", "gentle-ai.review-integration/v2"], { cwd: installDirectory, encoding: "utf8" }));
-	if (!["gentle-ai.review-integration.capabilities/v2"].includes(capabilities.schema) || capabilities.contract !== "gentle-ai.review-integration/v2" || capabilities.package?.version !== versions[0].name.slice(1)) throw new Error("package-local Gentle AI returned incompatible capabilities");
+	// Decode with the PACKED consumer's own decoder rather than comparing the
+	// schema string against a list hand-copied into this script. The copy was a
+	// second, silent pin: it accepted only `capabilities/v2`, so the moment the
+	// pinned provider advertised an additive minor this E2E rejected a pairing
+	// that gentle-pi reads correctly, and it would have done so again on the
+	// next minor. Using the shipped decoder makes the assertion what it always
+	// meant to be — the packed consumer can read the packed provider — and it
+	// checks the whole envelope (protocol major/minor, required operations,
+	// gates, projections, advertised schemas, mandatory features, and the
+	// self-reported executable digest) instead of one string.
+	const { decodeReviewCapabilitiesV2 } = await import(pathToFileURL(join(packageRoot, "runtime", "review-integration-v2.mjs")).href);
+	const executableDigest = `sha256:${createHash("sha256").update(readFileSync(executable)).digest("hex")}`;
+	const decoded = decodeReviewCapabilitiesV2(capabilities, executableDigest);
+	if (decoded.contract !== "gentle-ai.review-integration/v2" || decoded.packageVersion !== versions[0].name.slice(1)) throw new Error("package-local Gentle AI returned incompatible capabilities");
 	const packageManifest = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
 	process.stdout.write(`packed runner E2E passed (gentle-pi ${packageManifest.version ?? "unknown"}; Gentle AI ${capabilities.package?.version ?? "unknown"}; ${result.states.length} states)\n`);
 } finally {

package/scripts/verify-package-files.mjs

@@ -12,6 +12,17 @@ const requiredPaths = [
   "assets/orchestrator-delegation.md",
   "assets/orchestrator-memory.md",
   "assets/orchestrator-skills.md",
+  "assets/sdd-orchestrator-workflow.md",
+  "assets/agents/gentle-ai-explore.md",
+  "assets/agents/gentle-ai-verify.md",
+  "assets/agents/gentle-ai-worker.md",
+  "assets/agents/jd-fix-agent.md",
+  "assets/agents/jd-judge-a.md",
+  "assets/agents/jd-judge-b.md",
+  "assets/agents/review-readability.md",
+  "assets/agents/review-reliability.md",
+  "assets/agents/review-resilience.md",
+  "assets/agents/review-risk.md",
   "assets/agents/sdd-apply.md",
   "assets/agents/sdd-archive.md",
   "assets/agents/sdd-design.md",
@@ -24,8 +35,7 @@ const requiredPaths = [
   "assets/agents/sdd-sync.md",
   "assets/agents/sdd-tasks.md",
   "assets/agents/sdd-verify.md",
-  "assets/agents/review-refuter.md",
-  "assets/agents/review-validator.md",
+  "assets/chains/4r-review.chain.md",
   "assets/chains/sdd-full.chain.md",
   "assets/chains/sdd-plan.chain.md",
   "assets/chains/sdd-verify.chain.md",
@@ -35,6 +45,7 @@ const requiredPaths = [
   "assets/support/sdd-status-contract.md",
   "assets/support/strict-tdd.md",
   "assets/support/strict-tdd-verify.md",
+  "docs/native-authority-architecture.md",
   "docs/skill-style-guide.md",
   "docs/review-integration.md",
   "extensions/gentle-ai.ts",
@@ -43,22 +54,46 @@ const requiredPaths = [
   "lib/gentle-ai-binary.ts",
   "lib/git-commit-transaction.ts",
   "lib/native-review-cli.ts",
+  "lib/provider-contract-bundle.ts",
+  "lib/review-host-relay.ts",
   "lib/review-integration-v2.ts",
+  "lib/review-relay-contract.ts",
   "lib/sdd-preflight.ts",
 	"runtime/gentle-ai-binary.mjs",
 	"runtime/git-commit-transaction.mjs",
 	"runtime/native-review-cli.mjs",
 	"runtime/review-integration-v2.mjs",
+	"runtime/review-relay-contract.mjs",
 	"scripts/build-git-commit-transaction-runner.mjs",
+  "scripts/check-provider-contract.mjs",
   "scripts/gentle-ai-installer.mjs",
   "scripts/install-gentle-ai.mjs",
+  "scripts/mirror-provider-contract.mjs",
   "scripts/run-git-commit-transaction.mjs",
 	"scripts/test-packed-runner.mjs",
   "tests/fixtures/native-review-cli/v2.1.3/start.json",
-  "prompts/gcl.md",
-  "prompts/gis.md",
-  "prompts/gpr.md",
-  "prompts/gwr.md",
+  "tests/fixtures/provider-contract-bundle/v1.1.0/README.md",
+  "tests/fixtures/provider-contract-bundle/v1.1.0/manifest.json",
+  "tests/fixtures/provider-contract-bundle/v1.1.0/schemas/lens.schema.json",
+  "tests/fixtures/provider-contract-bundle/v1.1.0/schemas/refuter.schema.json",
+  "tests/fixtures/provider-contract-bundle/v1.1.0/schemas/targeted-validator.schema.json",
+  "tests/fixtures/provider-contract-bundle/v1.1.0/vectors/lens.json",
+  "tests/fixtures/provider-contract-bundle/v1.1.0/vectors/refuter.json",
+  "tests/fixtures/provider-contract-bundle/v1.1.0/vectors/targeted-validator.json",
+  // Provider contract mirror (gentle-pi#311 P1/P2). Presence is enforced here;
+  // exact bytes are pinned by the lock-driven scripts/check-provider-contract.mjs
+  // drift check, which runs in the same pnpm test flow.
+  "contracts/review-provider-contract-mirror/provider-contract.lock.json",
+  "contracts/review-provider-contract-mirror/v1.1.0/bundle/README.md",
+  "contracts/review-provider-contract-mirror/v1.1.0/bundle/manifest.json",
+  "contracts/review-provider-contract-mirror/v1.1.0/bundle/schemas/lens.schema.json",
+  "contracts/review-provider-contract-mirror/v1.1.0/bundle/schemas/refuter.schema.json",
+  "contracts/review-provider-contract-mirror/v1.1.0/bundle/schemas/targeted-validator.schema.json",
+  "contracts/review-provider-contract-mirror/v1.1.0/bundle/vectors/lens.json",
+  "contracts/review-provider-contract-mirror/v1.1.0/bundle/vectors/refuter.json",
+  "contracts/review-provider-contract-mirror/v1.1.0/bundle/vectors/targeted-validator.json",
+  "contracts/review-provider-contract-mirror/v1.1.0/generated/provider-capabilities.baseline.json",
+  "contracts/review-provider-contract-mirror/v1.1.0/generated/provider-roles.baseline.json",
   "prompts/skill-creation.md",
   "skills/_shared/review-ledger-contract.md",
   "skills/branch-pr/SKILL.md",
@@ -68,6 +103,7 @@ const requiredPaths = [
   "skills/gentle-ai/SKILL.md",
   "skills/issue-creation/SKILL.md",
   "skills/judgment-day/SKILL.md",
+  "skills/rdd-defect-workflow/SKILL.md",
   "skills/release/SKILL.md",
   "skills/skill-creator/SKILL.md",
   "skills/skill-improver/SKILL.md",
@@ -83,13 +119,13 @@ const contractHashes = {
   "contracts/review-integration/v1/fixtures/capabilities-v1.4.fixture.json": "84e0db457b76b97b35c2be772dfc647f9eab66810ea98f64fed85645c3c266ba",
   "contracts/review-integration/v1/fixtures/capabilities-v1.5.fixture.json": "0cc952af3767c393bde9e4785e4071615a529fd672bc94da4fcc204780524a27",
   "contracts/review-integration/v1/fixtures/capabilities.fixture.json": "b3ca822189a236f2d891628c665ca23e308bf5185a1701e1f07231bd970461bb",
-  "contracts/review-integration/v1/fixtures/consent.fixture.json": "b2ff4809b9eb75a54206800dca13f96396976aca7387e45f765ac6ec98029cd1",
+  "contracts/review-integration/v1/fixtures/consent.fixture.json": "28c7c86b55f8c9dbae3a1baa8fe298c4f3a14664aba21cd4051c7f579a61a4e9",
   "contracts/review-integration/v1/fixtures/failure.fixture.json": "e72b6ab5e3c529abac47bd324444f84ca90f67ef0a67189f5fd8d24d199a2759",
   "contracts/review-integration/v1/fixtures/final-verification-incident.fixture.json": "f8bc06549e62b0bee5cf2ecde625e18da178dd18c9d3023b7d7e8fd0ebbba646",
   "contracts/review-integration/v1/fixtures/operation.fixture.json": "3547748a4df57382178064abbdb1cf12f1d58a75c0e9d6452fdd9beb3aaeac3a",
   "contracts/review-integration/v1/fixtures/repair-preflight.fixture.json": "7168cb53ad470066d0b3edc3b7911d1aebff91abd41ecc3d822f8ffa5cea6cb1",
-  "contracts/review-integration/v1/fixtures/start-v2.fixture.json": "388c7c21374b89afe2d42d64bd1987d17ec0e2c7151cab1c56a08969ffb2ea0e",
-  "contracts/review-integration/v1/fixtures/start.fixture.json": "f369160ac26eb3427b57de2dd01c9d8c81e51c8a2bd546446780129d31b1945b",
+  "contracts/review-integration/v1/fixtures/start-v2.fixture.json": "2699660832c0d944184d5d314f08774ab9a02f5b8a7a4c2a07983440e0e346ad",
+  "contracts/review-integration/v1/fixtures/start.fixture.json": "3b963b221cd1560eb8872cbabbb5407096f593ced2f13eb9cb06eb61e4cca4d1",
   "contracts/review-integration/v1/fixtures/status-ambiguous.fixture.json": "ee695fd58ba72adfb3b51dfd16432a177498173a45bfcb594d6bdc53bfa32e6e",
   "contracts/review-integration/v1/fixtures/status-corrupted.fixture.json": "4cfc0048c28a39cec8a32fecfaad66e56e5c1248263ceb4ce66b6717981880b2",
   "contracts/review-integration/v1/fixtures/status-recover.fixture.json": "714f762f72380ce93d567626cafbaa536ab3aae02af73d3d40ca123f1f30d8b0",
@@ -100,7 +136,7 @@ const contractHashes = {
   "contracts/review-integration/v1/fixtures/status-v2-recover.fixture.json": "178331fc7177d2316fd4f56610ac295f7da2780be96b233b72935d5f476610f2",
   "contracts/review-integration/v1/fixtures/status-v2-repair.fixture.json": "89083cad752fca38da09e919825d0b80641a8a029364ba1869e5b58ef2e59a1d",
   "contracts/review-integration/v1/fixtures/status-v2-unrelated.fixture.json": "c178b338dcd5d30888acef37a9d752bd0932d6dedfffb61b0596a9cceabeb692",
-  "contracts/review-integration/v1/fixtures/status-v2.fixture.json": "5410d8bbae1b7152a43b3a5c4c880e9e98a5e47b76d910456f5ef13f19836f3a",
+  "contracts/review-integration/v1/fixtures/status-v2.fixture.json": "33c5032dcd5d916b4bff73781495640da83893b2f2b334465cbb40c18e1b85f4",
   "contracts/review-integration/v1/fixtures/status.fixture.json": "555054d8046a896162995dcb117752f9cd1ef903fb9ebaad29af1b7e7f319bb3",
   "contracts/review-integration/v1/fixtures/verification-evidence.fixture.json": "b30e3863548845b90e256d92193435d02da458bf8f15a4c33d023cd1f6894a5f",
   "contracts/review-integration/v1/schemas/admitted-result.schema.json": "7796e8dbba331434594108c902dfab7ec46f691fa447a9259a78f2448111b0de",
@@ -113,33 +149,34 @@ const contractHashes = {
   "contracts/review-integration/v1/schemas/capabilities-v1.5.schema.json": "abc783821524dcc33339495284805a85f79b3352efb7358c95016ed164bd7f24",
   "contracts/review-integration/v1/schemas/capabilities.schema.json": "ad333177494a251beac153f74bd751fa77126a9968aad69e64fc2abf15cff0f7",
   "contracts/review-integration/v1/schemas/consent.schema.json": "f8f2edec17568124488482c2aee399909111fe0cce2cba426fb29efd2c7c1cd0",
+  "contracts/review-integration/v1/schemas/correction-plan-request.schema.json": "77bf357afc9bee288d64ce64e87b4e13347b1d0ed5e824a9cea6dc0621b40ed1",
   "contracts/review-integration/v1/schemas/failure.schema.json": "0ce29f61408fc21d72640fffdb215a608a820c29f3e5ff62d9cc295ed0451937",
   "contracts/review-integration/v1/schemas/final-verification-incident.schema.json": "39b1ec178b1d3bc8da9a3d92dadd8092385000f2a6930b5bfcb4a84dbc6493ca",
-  "contracts/review-integration/v1/schemas/operation.schema.json": "6cf15b54977fea7301b9a5c766e709f8a912fda33560365de6dfcab4d2ecbce0",
+  "contracts/review-integration/v1/schemas/operation.schema.json": "495d66c6cdb6b2b634bc580b80125073d802226186db9f000456e111315ac0da",
   "contracts/review-integration/v1/schemas/projection.schema.json": "7168a3eba929dde2b8f0b7723ee51d5a5421102bdeefe892578c263debd08db2",
-  "contracts/review-integration/v1/schemas/repair.schema.json": "febb747dc68f8ded5974b6dd94051ec3cfdb5a886ccb853b1ce53aaf2e41efc0",
+  "contracts/review-integration/v1/schemas/repair.schema.json": "2939a9f6e68e5b6964db541d7b1a75054113c75a6f836a158ce0f37e1c4ebe32",
   "contracts/review-integration/v1/schemas/result-artifact-v2.schema.json": "38895aae2f6ca4980b1a8e157fee8503920820d5f6be3c757c0fa04e8430cd6b",
   "contracts/review-integration/v1/schemas/result-artifact.schema.json": "91296bd2c261fd2fe03bffd63efe58badd4927e0d0d8480cd4213f651ecacdf6",
   "contracts/review-integration/v1/schemas/start-v2.schema.json": "ec8550cd93bbe84af1ce87dfd7abfa9e24692f42b20f8f0bf9cac1d4b88ea46c",
   "contracts/review-integration/v1/schemas/start.schema.json": "4296aebbd4128ce51945a2f6d3228aa77ac7215c802978d559bff5279ec56229",
-  "contracts/review-integration/v1/schemas/status-v2.schema.json": "63e8988ce276d948ea8305008a3d27c4e26dff664cf54fffed9e188f465d92d1",
-  "contracts/review-integration/v1/schemas/status.schema.json": "67f3bddf5f5feeb3213bce489de8548546163b2e1d49a0e3965c0091dabc8c39",
+  "contracts/review-integration/v1/schemas/status-v2.schema.json": "dd9914b647a1d9edc4ecdcbed4f0c800b39ec290912d5c2a4cc6ba3098d5f21e",
+  "contracts/review-integration/v1/schemas/status.schema.json": "250d2c646b8822b38eaefafd2bfdefa1134cc23a00e553a7201f33257573149a",
   "contracts/review-integration/v1/schemas/targeted-validation-request.schema.json": "52b91154693b4dd66983fc91ecf7197503555f2c9e85cac626cffd3035c53d65",
   "contracts/review-integration/v1/schemas/verification-evidence.schema.json": "fd15890bf2ef1db95d771ee7f468e9e64014351d7940f65604eb24f41e68a22f",
   "contracts/review-integration/v2/fixtures/capabilities.fixture.json": "17c150d851c15b3f0c20d18c2e2741eb2232ffa24f35aa71d6d30e90a85e42b7",
-  "contracts/review-integration/v2/fixtures/consent.fixture.json": "a6d3ddc979d3dba202e4bf4ea5ca468ade1284f564f9325c313f4f9a9796f0ad",
-  "contracts/review-integration/v2/fixtures/start.fixture.json": "34b21328fa910e03af2fac8e816c5b510ba146201da0cd4ef1693d39a6344ba0",
-  "contracts/review-integration/v2/fixtures/status.fixture.json": "d5438578f2969f17635fecea94c7ef46d14c78fa668e50df48c4254254d5e935",
+  "contracts/review-integration/v2/fixtures/consent.fixture.json": "203cc96d5c29ba0f27b5c4db04c2e88566e0a923d3a0cdb317f78d9065349075",
+  "contracts/review-integration/v2/fixtures/start.fixture.json": "bd82bfb386c01809d8f1c5cb3a4b3b540f7cb23a55209505680daeb43b4e8642",
+  "contracts/review-integration/v2/fixtures/status.fixture.json": "4cd77906bacdca35d8f99773de147211d2b05fe34dd1b999011ead09e84be7a5",
   "contracts/review-integration/v2/schemas/admitted-result.schema.json": "c6a9c880191d65c46d9cfc8a0812af16b636573a8f6e57ea34aa16d6f6bb9735",
   "contracts/review-integration/v2/schemas/artifact-subject.schema.json": "3e71a81340ea6149b03afa71530d10ce654c415fa21d4e07f0c9c25b3d2d70a3",
   "contracts/review-integration/v2/schemas/capabilities.schema.json": "7ab061ed27bd3b929d6033cc20f56097e851f4454ca14a815255748b50191248",
   "contracts/review-integration/v2/schemas/consent.schema.json": "b2b4465338497f11927de91cb2e5da12b6cb4a1039afe05aebe1abbf53b21858",
-  "contracts/review-integration/v2/schemas/failure.schema.json": "1c53da8c543cc5e03fbbfc700d4fc80cadb3b0e5e72c6d77a7790008671d0962",
-  "contracts/review-integration/v2/schemas/operation.schema.json": "beee02046ec1d5b8c89e3d7de35f897c275830e43c67ecd162886bfd0138ace6",
-  "contracts/review-integration/v2/schemas/repair.schema.json": "9e842d1ded797a91ede16b2054a38708b2d1fc7a0d6217541f84c0f2f5a2e73e",
-  "contracts/review-integration/v2/schemas/start.schema.json": "86ddfcfe1912489abef7461613d692ea53a4d7d73d444d5f6dbbd7f9866a2c37",
-  "contracts/review-integration/v2/schemas/status.schema.json": "132b15dd7a0514aa451373bd4b3c02a1491b7b11cf5b9ce43bc300b549397ac9",
-  "docs/review-integration.md": "4ee3493303b03c7cb761f35865722b1691f164f72e6f94574512c42832ff04f2",
+  "contracts/review-integration/v2/schemas/failure.schema.json": "a56a2f715c3138d6f2cee37257cd6e758a15d4e0b1215745951d85831d148967",
+  "contracts/review-integration/v2/schemas/operation.schema.json": "1c0128a0576064d4338ee0a1945e9d0d0569c1a7a2140217b2539af5d1a9ed1e",
+  "contracts/review-integration/v2/schemas/repair.schema.json": "98a85fd45a8ae7f6211ffeeb3f9c478fa1dd1c17f385751f15f2111e6c3ab167",
+  "contracts/review-integration/v2/schemas/start.schema.json": "2991e3fcca672d9257d61b6a336fb34e58b15a8e03f8a09a7adf892cae6a8085",
+  "contracts/review-integration/v2/schemas/status.schema.json": "c4dcc736cfc6300560a3c4262d2d982368529d5c49d58d499552a3b0beef9212",
+  "docs/review-integration.md": "189f9b128cafaf225d2b6be53111f893ca46eb687fb9e5e051a84727b6a34bbc",
 };
 
 requiredPaths.push(...Object.keys(contractHashes));
@@ -157,12 +194,19 @@ function listFilesRecursively(directory) {
 // byte-pinned contract artifact but lives outside this walk root). Reports
 // the two drift directions separately so a new unlisted file and a stale
 // hash-map entry are both visible.
+//
+// `contracts/review-provider-contract-mirror/**` is deliberately excluded:
+// that subtree has exactly one byte authority — the mirror's own lock record,
+// enforced by scripts/check-provider-contract.mjs in the same pnpm test flow —
+// so listing it here would create a second, drift-prone pin for the same bytes.
+const PROVIDER_CONTRACT_MIRROR_PREFIX = "contracts/review-provider-contract-mirror/";
+
 export function reconcileContractsOnDisk(packageRoot, hashes) {
   const contractsRoot = join(packageRoot, "contracts");
   const walked = existsSync(contractsRoot)
-    ? listFilesRecursively(contractsRoot).map((absolutePath) =>
-        relative(packageRoot, absolutePath).split(sep).join("/"),
-      )
+    ? listFilesRecursively(contractsRoot)
+        .map((absolutePath) => relative(packageRoot, absolutePath).split(sep).join("/"))
+        .filter((relativePath) => !relativePath.startsWith(PROVIDER_CONTRACT_MIRROR_PREFIX))
     : [];
   const listed = Object.keys(hashes).filter((relativePath) => relativePath.startsWith("contracts/"));
   const walkedSet = new Set(walked);
@@ -174,6 +218,31 @@ export function reconcileContractsOnDisk(packageRoot, hashes) {
   };
 }
 
+// Compares every location that pins the Gentle AI version against the one
+// authoritative constant (scripts/gentle-ai-installer.mjs INSTALLER_VERSION),
+// returning a mismatch message per drifted location instead of a boolean.
+// This replaces a textual `.includes(...)` grep that could not have caught
+// the documented incident (scripts/install-gentle-ai.mjs header comment):
+// two hardcoded version copies drifted apart, and the installer reported
+// installing one version while writing another to disk. A textual grep only
+// verifies a string appears in a file; it cannot verify that two values
+// agree, which is exactly what this function checks instead.
+export function gentleAiVersionPinMismatches({ installerVersion, releaseBaseUrl, windowsSourceTag, libGentleAiVersion }) {
+  const mismatches = [];
+  if (libGentleAiVersion !== installerVersion) {
+    mismatches.push(
+      `lib/gentle-ai-binary.ts GENTLE_AI_VERSION ("${libGentleAiVersion}") does not match the authoritative scripts/gentle-ai-installer.mjs INSTALLER_VERSION ("${installerVersion}")`,
+    );
+  }
+  if (!releaseBaseUrl.includes(`/v${installerVersion}/`)) {
+    mismatches.push(`RELEASE_BASE_URL ("${releaseBaseUrl}") does not pin the authoritative v${installerVersion}`);
+  }
+  if (windowsSourceTag !== `v${installerVersion}`) {
+    mismatches.push(`GENTLE_AI_WINDOWS_SOURCE_TAG ("${windowsSourceTag}") does not match the authoritative v${installerVersion}`);
+  }
+  return mismatches;
+}
+
 // Reads the generator's `sources` array by regex rather than importing it,
 // so this script never needs the generator to export anything it doesn't
 // already export for its own `--write`/`--check` CLI use.
@@ -265,14 +334,16 @@ async function main() {
   });
 
   if (driftedContracts.length > 0) {
-    console.error("gentle-pi packaged review-integration/v1 and review-integration/v2 contract bytes drifted from the byte-identical Gentle AI v2.2.2 contract:");
+    console.error("gentle-pi packaged review-integration/v1 and review-integration/v2 contract bytes drifted from the byte-identical Gentle AI v2.4.0 contract:");
     for (const drift of driftedContracts) console.error(`- ${drift.relativePath}: expected ${drift.expected}, got ${drift.actual}`);
     process.exit(1);
   }
 
   // Release guard: refuse to pack/publish while any installer digest is not a real
   // pinned SHA-256 (for example the pre-release pending sentinel).
-  const { GENTLE_AI_RELEASE_ASSETS } = await import(new URL("./gentle-ai-installer.mjs", import.meta.url));
+  const { GENTLE_AI_RELEASE_ASSETS, INSTALLER_VERSION, RELEASE_BASE_URL, GENTLE_AI_WINDOWS_SOURCE_TAG } = await import(
+    new URL("./gentle-ai-installer.mjs", import.meta.url)
+  );
   const unpinnedDigests = Object.entries(GENTLE_AI_RELEASE_ASSETS).flatMap(([target, asset]) =>
     [["sha256", asset.sha256], ["binarySha256", asset.binarySha256]]
       .filter(([, digest]) => !/^[0-9a-f]{64}$/.test(digest))
@@ -295,14 +366,20 @@ async function main() {
     process.exit(1);
   }
 
-  const installer = readFileSync(join(root, "scripts/gentle-ai-installer.mjs"), "utf8");
-  const binaryResolver = readFileSync(join(root, "lib/gentle-ai-binary.ts"), "utf8");
-  if (!installer.includes('INSTALLER_VERSION = "2.2.2"') || !binaryResolver.includes('GENTLE_AI_VERSION = "2.2.2"')) {
-    console.error("gentle-pi package-local Gentle AI version pins are not both v2.2.2.");
+  const { GENTLE_AI_VERSION } = await import(new URL("../lib/gentle-ai-binary.ts", import.meta.url));
+  const versionMismatches = gentleAiVersionPinMismatches({
+    installerVersion: INSTALLER_VERSION,
+    releaseBaseUrl: RELEASE_BASE_URL,
+    windowsSourceTag: GENTLE_AI_WINDOWS_SOURCE_TAG,
+    libGentleAiVersion: GENTLE_AI_VERSION,
+  });
+  if (versionMismatches.length > 0) {
+    console.error("gentle-pi Gentle AI version pins have drifted from the authoritative INSTALLER_VERSION:");
+    for (const mismatch of versionMismatches) console.error(`- ${mismatch}`);
     process.exit(1);
   }
 
-  console.log(`gentle-pi package resource check passed (${requiredPaths.length} files; ${Object.keys(contractHashes).length} exact byte-identical v2.2.2 contract artifacts).`);
+  console.log(`gentle-pi package resource check passed (${requiredPaths.length} files; ${Object.keys(contractHashes).length} exact byte-identical v2.4.0 contract artifacts).`);
 }
 
 const isMainModule = process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;

package/skills/_shared/review-ledger-contract.md

@@ -22,7 +22,7 @@ Generated files matching `testdata/golden/**` remain in snapshot identity but do
 
 Before status/START, consult effective review mode. `off` creates no authority or authorization and yields organic `disabled/unmanaged`, never approval. Ordinary START declares `--consent relay`; low risk stays silent. A medium/high `consent/v2` result always returns the complete raw provider envelope plus an opaque in-memory candidate binding to the parent, then stops without UI or provider follow-up. The parent localizes and presents it losslessly while preserving tokens, commands, target IDs, and invocations. One explicit `answer-consent` call accepts only that binding and `granted|declined`, consumes it before provider mutation, and rechecks repository/target/projection/lineage/answer binding. Ambiguity reconciles through STATUS, never replay. Grant is exact-candidate-only. Decline creates no lineage, authority, actor/candidate binding, latch, or pending authorization; the next candidate asks again. Old Pi clone latch files are inert.
 
-`finalize` canonicalizes selected-lens results, assigns missing lens/finding IDs, and performs only the legal transition from the current compact state. The five states are `reviewing`, `correction_required`, `validating`, `approved`, and `escalated`.
+Reviewer, refuter, and validator verdicts are admitted natively, never Pi-authored. `finalize` follows the provider's negotiated `next_transition` and supplies only the negotiated collection answers: a lens `review.capture-result` collect input rendered with `--agent=pi --materialize=true` is satisfied by the gentle-pi host relay, which prints the exact Go-materialized opaque prompt, launches a fresh locked-down print-mode `pi` subprocess in an empty scratch directory with every discovery surface disabled, and submits the untouched raw output bytes through the provider-owned submission form. The adversarial roles do not go through that relay: `review.capture-refuter` and `review.capture-validation` collect inputs render as self-contained authority-advancing vectors (binding tokens plus `--agent=pi --execute=true`, no submission descriptor); executing the exact rendered invocation makes Go materialize the role prompt, spawn its own locked-down `pi` process, and admit the raw verdict. Native Go owns validation, canonicalization, missing lens/finding ID assignment, persistence, and hashing, and performs only the legal transition from the current compact state. The five states are `reviewing`, `correction_required`, `validating`, `approved`, and `escalated`.
 
 `validate` loads the terminal receipt and authority, derives the named live Git gate, and runs with zero actors. It never mutates compact authority.
 
@@ -37,9 +37,7 @@ Every finding supplies `evidence_class`, `causal_disposition`, and concrete proo
 | `causal_disposition` | `introduced` \| `behavior-activated` \| `worsened` \| `pre-existing` \| `base-only` \| `unknown` |
 | `proof_refs` | Prefixed concrete proof references |
 
-Only severe `introduced`, `behavior-activated`, or `worsened` findings with valid proof can enter `correction_ids`. Deterministic candidate-caused blockers need no refuter. All inferential candidate-caused blockers use exactly one complete read-only refuter batch.
-
-If native IDs are assigned to inferential findings, FINALIZE first returns canonical rows plus a content-derived request hash without mutation; completion requires identical lens input, that hash, and one complete refuter batch.
+Only severe `introduced`, `behavior-activated`, or `worsened` findings with valid proof can enter `correction_ids`. Deterministic candidate-caused blockers need no refuter. All inferential candidate-caused blockers share exactly one complete read-only refuter batch, executed through the provider-rendered self-contained `review.capture-refuter` vector: Go materializes the refuter prompt, runs its own locked-down `pi` process, and admits the raw verdict. Pi never authors, edits, batches, or re-scores a refuter row.
 
 Refuter rows may cite independent concrete proof and do not need to repeat reviewer `proof_refs`. `pre-existing` and `base-only` findings become non-blocking follow-ups. `unknown`, insufficient evidence, malformed severe claims, empty/malformed proof, missing/duplicate/extra refuter rows, and inconclusive severe outcomes escalate. `WARNING` and `SUGGESTION` remain informational.
 
@@ -53,7 +51,7 @@ Before editing, `finalize` requires a positive correction-line forecast. A forec
 
 Initial lenses never rerun. The correction preserves frozen findings and genesis scope: the original candidate tree, paths, untracked set, and correction IDs. It cannot add scope.
 
-The targeted validator checks only the original criteria and one correction regression for the exact correction IDs. It cannot add findings, request another correction, launch actors, persist authority, or request another attempt. Failure escalates. Later observations are inert follow-ups.
+The targeted validator runs through the provider-rendered self-contained `review.capture-validation` vector — Go materializes its prompt, runs its own locked-down `pi` process, and admits the raw verdict — and checks only the original criteria and one correction regression for the exact correction IDs. It cannot add findings, request another correction, launch actors, persist authority, or request another attempt. Failure escalates. Later observations are inert follow-ups.
 
 Final verification evidence is supplied and hashed only during finalization. Failure escalates and never reopens review.
 
@@ -67,7 +65,7 @@ Permanent Pi-owned consumer infrastructure is limited to canonical identity prim
 
 ## Lifecycle gates
 
-Pre-commit, pre-push, pre-PR, and release validate an approved receipt against one exact typed command target with zero actors. Native validation uses `gentle-ai.review-integration/v1`, loads authority and receipt, derives live target/publication evidence, then immediately reloads authority and re-derives target/publication evidence before allow. Authorized direct commit uses the durable hook/native-validation transaction and unresolved recovery blocks publication. The Pi-owned `review-publication-gate` module isolates command projection and publication revalidation from graph-v1 authority storage without changing these guarantees.
+Pre-commit, pre-push, pre-PR, and release validate an approved receipt against one exact typed command target with zero actors. Native validation uses `gentle-ai.review-integration/v2`, loads authority and receipt, derives live target/publication evidence, then immediately reloads authority and re-derives target/publication evidence before allow. Authorized direct commit uses the durable hook/native-validation transaction and unresolved recovery blocks publication. The Pi-owned `review-publication-gate` module isolates command projection and publication revalidation from graph-v1 authority storage without changing these guarantees.
 
 PR #1216 introduced the v2.1.1 `<remote>/<branch>` selector contract that v2.1.2 inherits unchanged.
 

package/skills/gentle-ai/SKILL.md

@@ -73,11 +73,11 @@ For a standard change, choose exactly one dominant-risk lens using the fixed pre
 
 ## Bounded Review Transaction Contract
 
-Call `gentle_review` INSPECT before START. The package-local Gentle AI v2.1.11 executable negotiates `gentle-ai.review-integration/v1`; INSPECT is target-scoped status, not a Pi-built authority inventory. New ordinary review uses native compact-v2 `start -> finalize -> validate`. START receives a JSON-serialized ordinary input; an optional repository-local `policyPath` and an explicit `baseRef` paired with `committedOnly: true` are the only selectors. Native code derives Git scope, untracked paths, lineage, risk tier/reasons, lenses, authored lines, and correction budget. `judgment-day` remains explicit and separate.
+Call `gentle_review` INSPECT before START. The package-local Gentle AI v2.4.0 executable negotiates `gentle-ai.review-integration/v2`; INSPECT is target-scoped status, not a Pi-built authority inventory. New ordinary review uses native compact-v2 `start -> finalize -> validate`. START receives a JSON-serialized ordinary input; an optional repository-local `policyPath` and an explicit `baseRef` paired with `committedOnly: true` are the only selectors. Native code derives Git scope, untracked paths, lineage, risk tier/reasons, lenses, authored lines, and correction budget. `judgment-day` remains explicit and separate.
 
 If INSPECT or START reports `blocked-legacy` or `blocked-mixed`, explain that legacy authority cannot be migrated and request explicit user authorization for the exact destructive-reset challenge. RESET and RECOVER each require fresh operation-bound confirmation through the interactive Pi UI and fail closed headlessly. The UI cannot cryptographically attest the human's identity; its residual trust is the operator controlling that Pi session, while exact challenge binding remains runtime-enforced. Only after authorization, the controller routes RESET and RECOVER_LOCK to the audited native `gentle-ai review reclaim` operation and RECOVER to native `gentle-ai review recover`; supply the exact native inputs (`lineage`/`actor`/`reason`, or the predecessor lineage, expected predecessor revision, successor lineage, disposition, actor, and reason bindings). A `native-input-required` envelope is a request for those exact values — never invent them. After a committed native recovery record, INSPECT before any fresh ordinary START. For `reset-in-progress`, INSPECT still surfaces the durable original `reset_request` for the authorized RECOVER challenge.
 
-Published v2.1.11 maintenance is explicit only: `abandon` requires the exact six-line pristine compact binding, `quarantine-legacy` accepts only the malformed freeze-findings diagnostic/disposition with its eight-line binding, and dual reconciliation appends exactly `anomalies=unchanged_target,malformed_recovery_authorization`. `repair-legacy-alias` accepts only lineage, actor, and reason; Pi re-derives its repository, exact revision, diagnostic, and disposition from fresh native inventory before displaying its eight-line binding for fresh UI approval. `review dispose-result` remains unsupported pending design. A `recover` route uses only negotiated `action_disposition`; it never substitutes one.
+Published v2.1.11 maintenance is explicit only: `abandon` requires the exact nine-line v2 discarded-work binding (lineage, revision, snapshot identity, reason, captured lens results, findings/evidence presence, actor), `quarantine-legacy` accepts only the malformed freeze-findings diagnostic/disposition with its eight-line binding, and dual reconciliation appends exactly `anomalies=unchanged_target,malformed_recovery_authorization`. `repair-legacy-alias` accepts only lineage, actor, and reason; Pi re-derives its repository, exact revision, diagnostic, and disposition from fresh native inventory before displaying its eight-line binding for fresh UI approval. `review dispose-result` remains unsupported pending design. A `recover` route uses only negotiated `action_disposition`; it never substitutes one.
 
 Preserve the negotiated native failure envelope exactly. Before authority access, `mutation_outcome: not_started` means no lineage was created. For `unknown` or lost mutating output, the controller immediately calls target-scoped status and returns its exact action; it never emits a generic replay instruction. Replay the exact START or FINALIZE only when that provider result declares `exact_replay_safe` for the same canonical request and required lineage. `mutation_outcome: committed` is never weakened, and Pi never chooses a lineage merely because output was lost.
 
@@ -119,7 +119,7 @@ Existing graph-v1 and legacy-v1 ordinary lineages remain compatibility-readable
 
 PR #1216 introduced the v2.1.1 `<remote>/<branch>` selector contract that v2.1.2 inherits unchanged.
 
-Native gates are read-only and always pass `--contract gentle-ai.review-integration/v1`. Pi registers one exact one-shot command authorization and rederives before and after bash-time native validation. Authorized direct `git commit` is rewritten through the package-owned durable transaction: run the effective pre-commit hook once, derive the post-hook index tree, validate that exact tree natively, preserve remaining hooks through proxies, commit without rerunning pre-commit, then prove `HEAD^{tree}`. An unresolved transaction blocks push, PR, and release; recovery never resets Git content automatically. Native pre-PR binds GitHub CLI repository precedence plus the exact advertised remote head equal to reviewed local `HEAD`. Publication probes remain shell-free, bounded, cancellation-aware, and fail closed on unsupported topology.
+Native gates are read-only and always pass `--contract gentle-ai.review-integration/v2`. Pi registers one exact one-shot command authorization and rederives before and after bash-time native validation. Authorized direct `git commit` is rewritten through the package-owned durable transaction: run the effective pre-commit hook once, derive the post-hook index tree, validate that exact tree natively, preserve remaining hooks through proxies, commit without rerunning pre-commit, then prove `HEAD^{tree}`. An unresolved transaction blocks push, PR, and release; recovery never resets Git content automatically. Native pre-PR binds GitHub CLI repository precedence plus the exact advertised remote head equal to reviewed local `HEAD`. Publication probes remain shell-free, bounded, cancellation-aware, and fail closed on unsupported topology.
 Release from protected `main` may bypass receipt validation only when the tag targets the current immutable `origin/main` SHA, required CI for that exact SHA is successful, the remote head is rechecked before tag push, and no fresh risk evidence exists; otherwise release fails closed through native receipt validation.
 Major and post-incident releases require explicit extraordinary review even when fast-path checks pass.
 
@@ -129,4 +129,4 @@ SDD completion adds no review or Judgment Day pass.
 
 Review operations, validation, and SDD perform no push, PR creation, release, or publication. Only the separate durable commit runner may create one local commit after exact native authorization and HEAD proof.
 
-The package ensures SDD agents and chains are available as global Pi runtime assets. Its isolated package-managed `review-refuter` uses exactly `read`, `grep`, and `find`. Project/user agent definitions are overrides and may shadow package assets; never rewrite or claim their effective permissions. Use `/gentle:install-sdd --force` only for recovery or intentional global refresh.
+The package ensures SDD agents and chains are available as global Pi runtime assets. Adversarial review roles (refuter, targeted validator) are never Pi-authored: the provider renders self-contained capture vectors and Go runs its own locked-down `pi` process on them. Project/user agent definitions are overrides and may shadow package assets; never rewrite or claim their effective permissions. Use `/gentle:install-sdd --force` only for recovery or intentional global refresh.