gentle-pi 2.1.2 → 2.3.0

package/tests/package-manifest.test.ts

@@ -17,7 +17,8 @@ import { applyModelConfig } from "../extensions/gentle-ai.ts";
 import { installSddAssets } from "../lib/sdd-preflight.ts";
 
 const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
-const REVIEW_REFUTER_FILE = "review-refuter.md";
+const MANAGED_EXEMPLAR_FILE = "gentle-ai-explore.md";
+const RETIRED_REFUTER_FILE = "review-refuter.md";
 const REVIEW_RISK_FILE = "review-risk.md";
 const V013_REVIEW_RISK_FIXTURE = join(
 	PACKAGE_ROOT,
@@ -49,17 +50,12 @@ const V014_MANAGED_ASSETS = join(
 	"migrations",
 	"managed-assets-v0.14.json",
 );
-const REVIEW_REFUTER_TOOLS = ["read", "grep", "find"];
-const FORBIDDEN_REFUTER_TOOLS = [
-	"bash",
-	"edit",
-	"write",
-	"task",
-	"subagent",
-	"subagent_run",
-	"mem_save",
-	"mem_update",
-];
+// gentle-pi#311 P5: the managed-asset installer mechanism tests use
+// gentle-ai-explore.md as their exemplar (packaged, absent from the v0.13
+// manifest) after review-refuter.md was retired together with every
+// Pi-authored adversarial review verdict.
+const MANAGED_EXEMPLAR_TOOLS = ["read", "grep", "find", "codegraph"];
+const RETIRED_ADVERSARIAL_AGENTS = ["review-refuter.md", "review-validator.md"];
 
 interface ManagedAssetsManifest {
 	schemaVersion: number;
@@ -118,10 +114,10 @@ test("package verification names the native review runtime boundary and packaged
 	const manifest = readPackageJson();
 
 	assert.ok(manifest.files?.includes("lib/"), "the published package must include the native review runtime module directory");
-	assert.ok(manifest.files?.includes("runtime/"), "the published package must include the generated JavaScript transaction runtime");
+	assert.ok(manifest.files?.includes("runtime/"), "the published package must include generated JavaScript runtime modules");
 	assert.match(verifier, /"lib\/native-review-cli\.ts"/, "package verification must require the native review adapter from the packaged runtime");
-	assert.match(verifier, /"runtime\/git-commit-transaction\.mjs"/, "package verification must require the installed JavaScript transaction runtime");
-	assert.match(verifier, /build-git-commit-transaction-runner\.mjs.*--check/s, "package verification must reject generated-runtime drift");
+	assert.match(verifier, /"runtime\/native-review-cli\.mjs"/, "package verification must require the generated native review adapter");
+	assert.match(verifier, /build-runtime-modules\.mjs.*--check/s, "package verification must reject generated-runtime drift");
 	assert.match(verifier, /"tests\/fixtures\/native-review-cli\/v2\.1\.3\/start\.json"/, "package verification must retain the pinned native decoder fixture");
 	assert.match(
 		readFileSync(join(PACKAGE_ROOT, "extensions", "gentle-ai.ts"), "utf8"),
@@ -191,36 +187,31 @@ test("npm publication is bound to the exact package tag and triggering commit",
 	assert.doesNotMatch(releaseSkill, /--ref "\$\{tag\}"|-f dist-tag=/);
 });
 
-test("publication gate is isolated from graph-v1 authority storage", () => {
+test("Pi delivery relay is absent from the packaged extension", () => {
 	const extension = readFileSync(join(PACKAGE_ROOT, "extensions", "gentle-ai.ts"), "utf8");
-	const gate = readFileSync(join(PACKAGE_ROOT, "lib", "review-publication-gate.ts"), "utf8");
-	const transaction = readFileSync(join(PACKAGE_ROOT, "lib", "review-transaction.ts"), "utf8");
 
-	assert.match(extension, /from "\.\.\/lib\/review-publication-gate\.ts"/);
-	assert.match(transaction, /from "\.\/review-publication-gate\.ts"/);
-	assert.doesNotMatch(gate, /review-(?:transaction|object-store|graph-schema|lock|snapshot)/);
-	assert.doesNotMatch(transaction, /export function evaluateReleaseFastPathV1|export function resolveConfiguredPushDestinationV1/);
+	assert.doesNotMatch(extension, /review-publication-gate/);
 });
 
-test("installed commit transaction runner loads JavaScript only and has deterministic build checks", () => {
+test("generated runtime modules and packed-package checks are deterministic", () => {
 	const packageJson = readPackageJson();
-	const runner = readFileSync(join(PACKAGE_ROOT, "scripts", "run-git-commit-transaction.mjs"), "utf8");
+	const generator = readFileSync(join(PACKAGE_ROOT, "scripts", "build-runtime-modules.mjs"), "utf8");
 	const packedRunner = readFileSync(join(PACKAGE_ROOT, "scripts", "test-packed-runner.mjs"), "utf8");
 	const ci = readFileSync(join(PACKAGE_ROOT, ".github", "workflows", "ci.yml"), "utf8");
-	assert.equal(packageJson.scripts?.["build:transaction-runner"], "node scripts/build-git-commit-transaction-runner.mjs --write");
-	assert.equal(packageJson.scripts?.["check:transaction-runner"], "node scripts/build-git-commit-transaction-runner.mjs --check");
-	assert.equal(packageJson.scripts?.["test:packed-runner"], "node scripts/test-packed-runner.mjs");
-	assert.match(packageJson.scripts?.prepublishOnly ?? "", /pnpm run test:packed-runner/);
-	assert.match(ci, /pnpm run test:packed-runner/);
+	assert.equal(packageJson.scripts?.["build:runtime-modules"], "node scripts/build-runtime-modules.mjs --write");
+	assert.equal(packageJson.scripts?.["check:runtime-modules"], "node scripts/build-runtime-modules.mjs --check");
+	assert.equal(packageJson.scripts?.["test:packed-package"], "node scripts/test-packed-runner.mjs");
+	assert.match(packageJson.scripts?.prepublishOnly ?? "", /pnpm run test:packed-package/);
+	assert.match(ci, /pnpm run check:runtime-modules/);
+	assert.match(ci, /pnpm run test:packed-package/);
+	assert.match(generator, /Generated by scripts\/build-runtime-modules\.mjs/);
 	assert.match(packedRunner, /\["install"[^\]]*"--ignore-scripts=false"/s, "packed install must explicitly enable postinstall");
 	assert.doesNotMatch(packedRunner, /\["install"[^\]]*"--ignore-scripts"(?!\=false)/s);
 	assert.match(packedRunner, /execFileSync\("where\.exe", \["npm"\]/);
 	assert.match(packedRunner, /could not resolve npm-cli\.js without a command shell/);
 	assert.doesNotMatch(packedRunner, /ComSpec|cmd\.exe/);
 	assert.match(packedRunner, /review", "capabilities", "--contract", "gentle-ai\.review-integration\/v2"/);
-	assert.match(runner, /\.\.\/runtime\/git-commit-transaction\.mjs/);
-	assert.doesNotMatch(runner, /\.ts["']/);
-	assert.doesNotMatch(runner, /experimental-strip-types/);
+	assert.doesNotMatch(packedRunner, /git-commit-transaction|transaction runner/i);
 });
 
 test("package manifest ships and runs the checked-in package-local Gentle AI installer", () => {
@@ -270,20 +261,20 @@ test("package manifest installs pi-pretty through a wrapper without bundling nat
 	);
 });
 
-test("package verification binds the published Gentle AI v2.2.2 runtime pin", () => {
+test("package verification binds the published Gentle AI v2.5.0 runtime pin", () => {
 	const installer = readFileSync(join(PACKAGE_ROOT, "scripts", "gentle-ai-installer.mjs"), "utf8");
 	const binary = readFileSync(join(PACKAGE_ROOT, "lib", "gentle-ai-binary.ts"), "utf8");
 	const verifier = readFileSync(join(PACKAGE_ROOT, "scripts", "verify-package-files.mjs"), "utf8");
 
-	assert.match(installer, /INSTALLER_VERSION = "2\.2\.2"/);
+	assert.match(installer, /INSTALLER_VERSION = "2\.5\.0"/);
 	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_PACKAGE.*GENTLE_AI_WINDOWS_SOURCE_MODULE/);
-	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:YZcI5dRvoHm82I2CULvgBkB2M3UQQGarYO\/u\/Nt5LSc="/);
+	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:0nvTLJFAf9ruBDwTvi\+aDrWt\/dt\/GKvUP2cFVB6c2DI="/);
 	assert.match(installer, /GOTOOLCHAIN: "local"/);
 	assert.match(installer, /GOSUMDB: "sum\.golang\.org"/);
-	assert.match(binary, /GENTLE_AI_VERSION = "2\.2\.2"/);
+	assert.match(binary, /GENTLE_AI_VERSION = INSTALLER_VERSION/);
 	assert.match(binary, /GO_SUMDB_SOURCE_BUILD/);
 	assert.match(binary, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM/);
-	assert.match(verifier, /v2\.2\.2/);
+	assert.match(verifier, /v2\.5\.0/);
 });
 
 
@@ -439,25 +430,52 @@ test("packaged agents use YAML list syntax for tool allowlists", () => {
 	}
 });
 
-test("package source defines review-refuter with the exact read-only boundary", () => {
-	const refuterPath = join(PACKAGE_ROOT, "assets", "agents", REVIEW_REFUTER_FILE);
-	assert.ok(existsSync(refuterPath), "gentle-pi must package review-refuter.md");
+// The Pi child-session tool registry exposes `find` for filesystem discovery
+// and has no `glob` or `webfetch` builtin (see tests/runtime-harness.mjs and
+// the working builtin `reviewer` canary in issue #62). A packaged agent that
+// declares a name the runtime cannot resolve does not fail loudly: the SDK
+// silently drops it and the child starts with a reduced allowlist, so the
+// agent reports itself blocked instead of naming the missing tool.
+const UNSUPPORTED_CHILD_SESSION_TOOLS = ["glob", "webfetch"];
 
-	const { name, tools } = readAgentDefinition(refuterPath);
-	assert.equal(name, "review-refuter");
-	assert.deepEqual(tools, REVIEW_REFUTER_TOOLS);
-	for (const tool of FORBIDDEN_REFUTER_TOOLS) {
-		assert.ok(!tools.includes(tool), `review-refuter must deny ${tool}`);
+test("packaged agents declare only tool names a Pi child session can resolve", () => {
+	const agentsDir = join(PACKAGE_ROOT, "assets", "agents");
+	const agentFiles = readdirSync(agentsDir).flatMap((entry) =>
+		entry.endsWith(".md") ? [join(agentsDir, entry)] : [],
+	);
+
+	assert.ok(agentFiles.length > 0, "gentle-pi must ship packaged agents");
+
+	for (const file of agentFiles) {
+		const { tools } = readAgentDefinition(file);
+		for (const unsupported of UNSUPPORTED_CHILD_SESSION_TOOLS) {
+			assert.ok(
+				!tools.includes(unsupported),
+				`${file} declares ${unsupported}, which no Pi child session exposes; use find for discovery`,
+			);
+		}
 	}
 });
 
-test("forced package installation preserves same-path user-authored agents and separate shadows", () => {
+test("the retired Pi adversarial role agents are not packaged", () => {
+	// gentle-pi#311 P5: the refuter and targeted validator verdicts execute
+	// through Go-owned pi processes via provider-rendered self-contained
+	// vectors; the Pi-authored agent definitions must stay deleted.
+	for (const retired of RETIRED_ADVERSARIAL_AGENTS) {
+		assert.ok(!existsSync(join(PACKAGE_ROOT, "assets", "agents", retired)), `${retired} must stay deleted`);
+	}
+});
+
+test("forced package installation preserves same-path user-authored agents and separate shadows, including on retired asset paths", () => {
+	// The user-authored file below sits on the RETIRED review-refuter.md path:
+	// this also pins that gentle-pi#311 P5 asset retirement deletes only
+	// hash-proven package-managed copies, never user content.
 	const temporaryAgentHome = mkdtempSync(join(tmpdir(), "gentle-pi-refuter-home-"));
 	const temporaryProject = mkdtempSync(join(tmpdir(), "gentle-pi-refuter-project-"));
 	const previousAgentHome = process.env.GENTLE_PI_AGENT_HOME;
-	const samePathUserAgent = join(temporaryAgentHome, "agents", REVIEW_REFUTER_FILE);
-	const userShadow = join(temporaryAgentHome, "subagents", REVIEW_REFUTER_FILE);
-	const projectOverride = join(temporaryProject, ".pi", "agents", REVIEW_REFUTER_FILE);
+	const samePathUserAgent = join(temporaryAgentHome, "agents", RETIRED_REFUTER_FILE);
+	const userShadow = join(temporaryAgentHome, "subagents", RETIRED_REFUTER_FILE);
+	const projectOverride = join(temporaryProject, ".pi", "agents", RETIRED_REFUTER_FILE);
 	const userAgentSource = [
 		"---",
 		"name: review-refuter",
@@ -538,7 +556,7 @@ test("first forced sync migrates untouched v0.13 assets, preserves routing, and
 	const temporaryAgentHome = mkdtempSync(join(tmpdir(), "gentle-pi-v013-upgrade-"));
 	const previousAgentHome = process.env.GENTLE_PI_AGENT_HOME;
 	const installedReviewRisk = join(temporaryAgentHome, "agents", REVIEW_RISK_FILE);
-	const installedRefuter = join(temporaryAgentHome, "agents", REVIEW_REFUTER_FILE);
+	const installedExemplar = join(temporaryAgentHome, "agents", MANAGED_EXEMPLAR_FILE);
 	const managedAssetsManifest = join(
 		temporaryAgentHome,
 		"gentle-ai",
@@ -572,8 +590,8 @@ test("first forced sync migrates untouched v0.13 assets, preserves routing, and
 			"migration must update the package body without losing user routing",
 		);
 		assert.equal(
-			readFileSync(installedRefuter, "utf8"),
-			readFileSync(join(PACKAGE_ROOT, "assets", "agents", REVIEW_REFUTER_FILE), "utf8"),
+			readFileSync(installedExemplar, "utf8"),
+			readFileSync(join(PACKAGE_ROOT, "assets", "agents", MANAGED_EXEMPLAR_FILE), "utf8"),
 			"an asset missing from v0.13 must install normally",
 		);
 
@@ -582,8 +600,8 @@ test("first forced sync migrates untouched v0.13 assets, preserves routing, and
 		) as ManagedAssetsManifest;
 		assert.equal(manifest.assets[`agents/${REVIEW_RISK_FILE}`], sha256(migrated));
 		assert.equal(
-			manifest.assets[`agents/${REVIEW_REFUTER_FILE}`],
-			sha256(readFileSync(installedRefuter, "utf8")),
+			manifest.assets[`agents/${MANAGED_EXEMPLAR_FILE}`],
+			sha256(readFileSync(installedExemplar, "utf8")),
 		);
 
 		const userEditedMigration = migrated.replace(
@@ -684,23 +702,23 @@ test("first forced sync preserves a body-edited v0.13 asset byte-for-byte", () =
 test("forced package installation refreshes an asset recorded as package-managed", () => {
 	const temporaryAgentHome = mkdtempSync(join(tmpdir(), "gentle-pi-malformed-refuter-"));
 	const previousAgentHome = process.env.GENTLE_PI_AGENT_HOME;
-	const installedRefuter = join(temporaryAgentHome, "agents", REVIEW_REFUTER_FILE);
+	const installedExemplar = join(temporaryAgentHome, "agents", MANAGED_EXEMPLAR_FILE);
 	const managedAssetsManifest = join(
 		temporaryAgentHome,
 		"gentle-ai",
 		"managed-assets.json",
 	);
 	const previousPackageSource =
-		"---\nname: review-refuter\ntools:\n  - read\n  - bash\n---\nprevious package version\n";
+		"---\nname: gentle-ai-explore\ntools:\n  - read\n  - bash\n---\nprevious package version\n";
 	const routedPreviousPackageSource = previousPackageSource.replace(
-		"name: review-refuter\n",
-		"name: review-refuter\nmodel: openai/previous-package\nthinking: high\n",
+		"name: gentle-ai-explore\n",
+		"name: gentle-ai-explore\nmodel: openai/previous-package\nthinking: high\n",
 	);
 
 	try {
 		process.env.GENTLE_PI_AGENT_HOME = temporaryAgentHome;
 		installSddAssets(PACKAGE_ROOT, true);
-		assert.ok(existsSync(installedRefuter), "a missing package asset must install");
+		assert.ok(existsSync(installedExemplar), "a missing package asset must install");
 		assert.ok(
 			existsSync(managedAssetsManifest),
 			"the installer must record ownership independently from the filename",
@@ -709,16 +727,16 @@ test("forced package installation refreshes an asset recorded as package-managed
 		const manifest = JSON.parse(
 			readFileSync(managedAssetsManifest, "utf8"),
 		) as ManagedAssetsManifest;
-		writeFileSync(installedRefuter, routedPreviousPackageSource);
-		manifest.assets[`agents/${REVIEW_REFUTER_FILE}`] = sha256(
+		writeFileSync(installedExemplar, routedPreviousPackageSource);
+		manifest.assets[`agents/${MANAGED_EXEMPLAR_FILE}`] = sha256(
 			routedPreviousPackageSource,
 		);
 		writeFileSync(managedAssetsManifest, JSON.stringify(manifest, null, 2));
 
 		installSddAssets(PACKAGE_ROOT, true);
 
-		const refreshed = readAgentDefinition(installedRefuter);
-		assert.deepEqual(refreshed.tools, REVIEW_REFUTER_TOOLS);
+		const refreshed = readAgentDefinition(installedExemplar);
+		assert.deepEqual(refreshed.tools, MANAGED_EXEMPLAR_TOOLS);
 		assert.doesNotMatch(refreshed.source, /^  - bash$/m);
 	} finally {
 		if (previousAgentHome === undefined) {
@@ -736,7 +754,7 @@ function assertManagedAgentUserEditIsPreserved(
 ): void {
 	const temporaryAgentHome = mkdtempSync(join(tmpdir(), "gentle-pi-managed-edit-"));
 	const previousAgentHome = process.env.GENTLE_PI_AGENT_HOME;
-	const installedRefuter = join(temporaryAgentHome, "agents", REVIEW_REFUTER_FILE);
+	const installedExemplar = join(temporaryAgentHome, "agents", MANAGED_EXEMPLAR_FILE);
 	const managedAssetsManifest = join(
 		temporaryAgentHome,
 		"gentle-ai",
@@ -746,15 +764,15 @@ function assertManagedAgentUserEditIsPreserved(
 	try {
 		process.env.GENTLE_PI_AGENT_HOME = temporaryAgentHome;
 		installSddAssets(PACKAGE_ROOT, true);
-		const installedSource = readFileSync(installedRefuter, "utf8");
+		const installedSource = readFileSync(installedExemplar, "utf8");
 		const userEditedSource = editSource(installedSource);
 		assert.notEqual(userEditedSource, installedSource, `${editLabel} must alter the asset`);
-		writeFileSync(installedRefuter, userEditedSource);
+		writeFileSync(installedExemplar, userEditedSource);
 
 		installSddAssets(PACKAGE_ROOT, true);
 
 		assert.deepEqual(
-			readFileSync(installedRefuter),
+			readFileSync(installedExemplar),
 			Buffer.from(userEditedSource),
 			`${editLabel} must invalidate ownership and survive force refresh byte-for-byte`,
 		);
@@ -762,7 +780,7 @@ function assertManagedAgentUserEditIsPreserved(
 			readFileSync(managedAssetsManifest, "utf8"),
 		) as ManagedAssetsManifest;
 		assert.equal(
-			manifest.assets[`agents/${REVIEW_REFUTER_FILE}`],
+			manifest.assets[`agents/${MANAGED_EXEMPLAR_FILE}`],
 			undefined,
 			`${editLabel} must remove package ownership`,
 		);
@@ -779,8 +797,8 @@ function assertManagedAgentUserEditIsPreserved(
 test("forced package installation preserves a model-only edit to a managed agent", () => {
 	assertManagedAgentUserEditIsPreserved("a model-only user edit", (source) =>
 		source.replace(
-			"name: review-refuter\n",
-			"name: review-refuter\nmodel: private/user-model\n",
+			"name: gentle-ai-explore\n",
+			"name: gentle-ai-explore\nmodel: private/user-model\n",
 		),
 	);
 });
@@ -788,8 +806,8 @@ test("forced package installation preserves a model-only edit to a managed agent
 test("forced package installation preserves a thinking-only edit to a managed agent", () => {
 	assertManagedAgentUserEditIsPreserved("a thinking-only user edit", (source) =>
 		source.replace(
-			"name: review-refuter\n",
-			"name: review-refuter\nthinking: xhigh\n",
+			"name: gentle-ai-explore\n",
+			"name: gentle-ai-explore\nthinking: xhigh\n",
 		),
 	);
 });
@@ -797,8 +815,8 @@ test("forced package installation preserves a thinking-only edit to a managed ag
 test("forced package installation preserves an ordinary body edit to a managed agent", () => {
 	assertManagedAgentUserEditIsPreserved("an ordinary body edit", (source) =>
 		source.replace(
-			"Challenge the supplied inferential claims",
-			"Preserve this user-authored body change and challenge the supplied inferential claims",
+			"You are the read-only explorer for generic non-SDD work.",
+			"Preserve this user-authored body change. You are the read-only explorer for generic non-SDD work.",
 		),
 	);
 });
@@ -806,7 +824,7 @@ test("forced package installation preserves an ordinary body edit to a managed a
 test("package model assignment keeps only package-managed agents owned", () => {
 	const temporaryAgentHome = mkdtempSync(join(tmpdir(), "gentle-pi-model-ownership-"));
 	const previousAgentHome = process.env.GENTLE_PI_AGENT_HOME;
-	const installedRefuter = join(temporaryAgentHome, "agents", REVIEW_REFUTER_FILE);
+	const installedExemplar = join(temporaryAgentHome, "agents", MANAGED_EXEMPLAR_FILE);
 	const userAgent = join(temporaryAgentHome, "agents", "user-router.md");
 	const managedAssetsManifest = join(
 		temporaryAgentHome,
@@ -821,14 +839,14 @@ test("package model assignment keeps only package-managed agents owned", () => {
 		writeFileSync(userAgent, userAgentSource);
 
 		applyModelConfig(PACKAGE_ROOT, {
-			"review-refuter": { model: "package/selected-model", thinking: "high" },
+			"gentle-ai-explore": { model: "package/selected-model", thinking: "high" },
 			"user-router": { model: "user/selected-model", thinking: "low" },
 		});
 
-		const routedRefuter = readFileSync(installedRefuter, "utf8");
+		const routedExemplar = readFileSync(installedExemplar, "utf8");
 		const routedUserAgent = readFileSync(userAgent, "utf8");
-		assert.match(routedRefuter, /^model: package\/selected-model$/m);
-		assert.match(routedRefuter, /^thinking: high$/m);
+		assert.match(routedExemplar, /^model: package\/selected-model$/m);
+		assert.match(routedExemplar, /^thinking: high$/m);
 		assert.match(routedUserAgent, /^model: user\/selected-model$/m);
 		assert.match(routedUserAgent, /^thinking: low$/m);
 
@@ -836,8 +854,8 @@ test("package model assignment keeps only package-managed agents owned", () => {
 			readFileSync(managedAssetsManifest, "utf8"),
 		) as ManagedAssetsManifest;
 		assert.equal(
-			manifest.assets[`agents/${REVIEW_REFUTER_FILE}`],
-			sha256(routedRefuter),
+			manifest.assets[`agents/${MANAGED_EXEMPLAR_FILE}`],
+			sha256(routedExemplar),
 			"package-controlled routing must update the managed asset hash coherently",
 		);
 		assert.equal(
@@ -848,8 +866,8 @@ test("package model assignment keeps only package-managed agents owned", () => {
 
 		installSddAssets(PACKAGE_ROOT, true);
 		assert.equal(
-			readFileSync(installedRefuter, "utf8"),
-			readFileSync(join(PACKAGE_ROOT, "assets", "agents", REVIEW_REFUTER_FILE), "utf8"),
+			readFileSync(installedExemplar, "utf8"),
+			readFileSync(join(PACKAGE_ROOT, "assets", "agents", MANAGED_EXEMPLAR_FILE), "utf8"),
 			"a routed package-managed agent must remain eligible for package refresh",
 		);
 		assert.equal(
@@ -958,6 +976,10 @@ test("gentle-ai-worker packages the exact scoped writer contract", () => {
 	const contextContract = readMarkdownSection(source, "Context contract");
 	assert.match(contextContract, /pre-existing untracked targets explicitly listed by the parent/);
 	assert.match(contextContract, /new files required by the delegated task/);
+	assert.match(contextContract, /derived candidate set the human can approve or narrow/);
+	assert.match(contextContract, /never an open request for the human to author paths or globs/);
+	assert.match(interactionContract, /closed set the human can approve, decline, or select from/);
+	assert.match(interactionContract, /never ask the human to author paths, globs, identifiers, or commands as free text/);
 
 	const implementationRules = readMarkdownSection(source, "Implementation rules");
 	assert.match(implementationRules, /`blocked` only for a non-human technical blocker/);
@@ -1106,7 +1128,7 @@ test("bounded implementation routing uses the same explicit fallback in both pol
 	);
 });
 
-test("orchestrator routes generic roles without reusing SDD or review agents", () => {
+test("orchestrator routes generic roles without static RDD lens routing", () => {
 	for (const file of ["orchestrator.md", "orchestrator-delegation.md"]) {
 		const routing = readFileSync(join(PACKAGE_ROOT, "assets", file), "utf8");
 		assert.match(routing, /generic non-SDD exploration[\s\S]*`gentle-ai-explore`/);
@@ -1116,12 +1138,16 @@ test("orchestrator routes generic roles without reusing SDD or review agents", (
 		);
 		assert.match(routing, /generic non-SDD (?:technical )?verification[\s\S]*`gentle-ai-verify`/);
 		assert.match(routing, /SDD roles stay inside SDD|Use `sdd-explore` and `sdd-verify` only inside SDD/);
-		assert.match(routing, /review lenses inside reviews|Use review lenses only inside explicit review transactions/);
-		assert.match(routing, /(?:truly local )?read-only check(?:ing)? of (?:known )?1-3 known files|1-3-file read-only check/);
+		assert.match(routing, /(?:truly local )?read-only check(?:ing)? of (?:known )?1[-–]3 known files|1[-–]3-file read-only check/);
 		assert.match(routing, /(?:verification that |verification commands →).*executes? or delegates?|executing\/delegating verification commands/);
 		assert.match(routing, /missing(?: or |\/)unusable[\s\S]*native `Agent`[\s\S]*(?:the )?same read-only/);
 		assert.match(routing, /report (?:the )?fallback/);
+		assert.doesNotMatch(routing, /review lenses? (?:inside|only inside)|review lens routing/i);
 	}
+
+	const core = readFileSync(join(PACKAGE_ROOT, "assets", "orchestrator.md"), "utf8");
+	assert.match(core, /Gentle AI dynamically supplies runtime-specific RDD instructions/);
+	assert.match(core, /this package does not invent or fall back/);
 });
 
 test("pi-pretty wrapper uses real package path resolution for pnpm symlink installs", () => {
@@ -1137,18 +1163,21 @@ test("pi-pretty wrapper uses real package path resolution for pnpm symlink insta
 	assert.match(wrapper, /quietToolsEnabled/);
 });
 
-test("v2.1.2 release package and runtime stop before publication", () => {
+test("v2.3.0 release package and runtime stop before publication", () => {
 	const packageJson = readPackageJson();
-	assert.equal(packageJson.version, "2.1.2", "the release manifest must remain explicitly pinned to v2.1.2");
+	assert.equal(packageJson.version, "2.3.0", "the release manifest must remain explicitly pinned to v2.3.0");
 	assert.equal(
 		packageJson.scripts?.test,
-		"node --experimental-strip-types --test tests/*.test.ts && pnpm run test:harness",
+		"node --experimental-strip-types --test tests/*.test.ts && pnpm run check:provider-contract && pnpm run test:harness",
 	);
 	assert.ok(packageJson.files?.includes("assets/"));
 	assert.ok(packageJson.files?.includes("contracts/"));
 
 	const verifier = readFileSync(join(PACKAGE_ROOT, "scripts", "verify-package-files.mjs"), "utf8");
-	assert.match(verifier, /assets\/agents\/review-refuter\.md/);
+	// gentle-pi#311 P5: the retired adversarial role agents must not be pinned
+	// as required package files, while the append-only migration history stays.
+	assert.doesNotMatch(verifier, /assets\/agents\/review-refuter\.md/);
+	assert.doesNotMatch(verifier, /assets\/agents\/review-validator\.md/);
 	assert.match(verifier, /assets\/migrations\/managed-assets-v0\.13\.json/);
 	assert.match(verifier, /assets\/migrations\/managed-assets-v0\.14\.json/);
 
@@ -1157,26 +1186,25 @@ test("v2.1.2 release package and runtime stop before publication", () => {
 	assert.doesNotMatch(runtime, /execFileSync\("(?:npm|pnpm)", \["publish"/);
 });
 
-test("bounded review keeps the Judgment Day skill contract at metadata version 1.4", () => {
+test("bounded review keeps the Judgment Day skill contract at canon metadata version 1.7", () => {
 	const frontmatter = readAgentFrontmatter(
 		join(PACKAGE_ROOT, "skills", "judgment-day", "SKILL.md"),
 	);
 
-	assert.match(frontmatter, /^  version: "1\.4"$/m);
-	assert.doesNotMatch(frontmatter, /^  version: "1\.5"$/m);
+	assert.match(frontmatter, /^  version: "1\.7"$/m);
+	assert.doesNotMatch(frontmatter, /^  version: "1\.4"$/m);
 });
 
-test("README documents bounded review transactions and the honest installed permission boundary", () => {
+test("README documents dynamic Gentle AI RDD ownership and the installed permission boundary", () => {
 	const readme = readFileSync(join(PACKAGE_ROOT, "README.md"), "utf8");
 	for (const clause of [
-		"New ordinary review uses compact `gentle_review` `start -> finalize -> validate`.",
-		"Native compact gate validation is read-only.",
-		"Release from protected `main` may bypass receipt validation only when the tag targets the current immutable `origin/main` SHA, required CI for that exact SHA is successful, the remote head is rechecked before tag push, and no fresh risk evidence exists; otherwise release fails closed through native receipt validation.",
+		"Gentle AI dynamically supplies runtime-specific RDD instructions",
+		"does not define an RDD lifecycle",
 		"Dangerous-command safety remains independent and authoritative.",
-		"`review-refuter` uses exactly `read`, `grep`, and `find`",
 		"package-managed isolated installation",
-		"Project and user overrides may shadow the package asset",
+		"Project and user overrides may shadow a package asset",
 	]) {
-		assert.ok(readme.includes(clause), `README missing review v2 clause: ${clause}`);
+		assert.ok(readme.includes(clause), `README missing dynamic RDD clause: ${clause}`);
 	}
+	assert.doesNotMatch(readme, /New ordinary review uses compact `gentle_review` `start -> finalize -> validate`\./);
 });