gentle-pi 2.2.0 → 2.3.0

package/tests/orchestrator-rdd-ownership.test.ts

@@ -0,0 +1,103 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import test from "node:test";
+
+const ROOT = join(import.meta.dirname, "..");
+const ASSETS = join(ROOT, "assets");
+const BOUNDARY =
+	"Gentle AI dynamically supplies runtime-specific RDD instructions via generated Pi APPEND_SYSTEM composition. Follow only those exact native instructions; if absent or unsupported, this package does not invent or fall back.";
+
+function read(relativePath: string): string {
+	return readFileSync(join(ROOT, relativePath), "utf8");
+}
+
+const core = read("assets/orchestrator.md");
+const delegation = read("assets/orchestrator-delegation.md");
+const staticPrompts = `${core}\n${delegation}`;
+
+test("static prompts omit stale native RDD lifecycle mirrors", () => {
+	for (const marker of [
+		"Authority-First Terminal Procedure",
+		"reconcile-terminal-mirrors",
+		"Native Bounded Review Orchestration",
+		"Continue after a stop reason code",
+		"gentle-ai review status",
+		"next_transition",
+		"start -> finalize -> validate",
+		"review.capture-result",
+		"review.validate",
+		"reviewGate.result",
+	]) {
+		assert.ok(!staticPrompts.includes(marker), `stale RDD marker remains: ${marker}`);
+	}
+});
+
+test("lossless blocking prompts route every closed single-select envelope through the native closed tool", () => {
+	for (const clause of [
+		"For every strictly closed single-select envelope",
+		"ask_user_choice",
+		"envelope-owned canonical option token as opaque `value`",
+		"returns exactly one `value`",
+		"externally owned open/free-text questionnaire",
+		"never for a closed domain",
+		"exact captured provider-owned choice invocation",
+	]) {
+		assert.ok(delegation.includes(clause), `lossless prompt is missing: ${clause}`);
+	}
+});
+
+test("static prompts declare one dynamic Gentle AI RDD ownership boundary", () => {
+	assert.equal(staticPrompts.split(BOUNDARY).length - 1, 1, "expected one dynamic RDD ownership boundary");
+	assert.ok(core.includes(BOUNDARY), "the Pi parent prompt owns the single boundary");
+	assert.ok(!delegation.includes(BOUNDARY), "generic delegation detail must not gain RDD text");
+});
+
+test("rendered parent prompt keeps the RDD boundary while omitting lifecycle mirrors", async () => {
+	const { __testing } = await import("../extensions/gentle-ai.ts");
+	const rendered = __testing.getOrchestratorPrompt();
+	assert.ok(rendered.includes(BOUNDARY));
+	for (const marker of ["Authority-First Terminal Procedure", "reconcile-terminal-mirrors", "next_transition"]) {
+		assert.ok(!rendered.includes(marker), `rendered parent prompt leaked: ${marker}`);
+	}
+	assert.ok(Buffer.byteLength(rendered, "utf8") <= 8192, "the rendered parent prompt must stay below the reduced 8 KiB budget");
+});
+
+test("static prompts retain normal SDD and delegated-work guidance", () => {
+	for (const heading of ["## SDD Workflow (lazy-loaded)", "## Memory Contract"]) {
+		assert.ok(core.includes(heading), `core lost ${heading}`);
+	}
+	for (const heading of [
+		"### Delegation Rules",
+		"#### Background Subagent Policy",
+		"#### Allowed edit surfaces (MANDATORY)",
+		"### 3. SDD (optional)",
+	]) {
+		assert.ok(delegation.includes(heading), `delegation lost ${heading}`);
+	}
+});
+
+test("always-on parent prompt requires a narrow writer edit surface before launch", () => {
+	assert.match(core, /Before launching (?:a )?bounded writer/i);
+	assert.match(core, /`gentle-ai-worker`/);
+	assert.match(core, /`worker`/);
+	assert.match(core, /## Allowed edit surfaces/);
+	assert.match(core, /repository-relative/i);
+	assert.match(core, /never `\.`|never a bare repository root/i);
+	assert.match(core, /do not ask the human to author paths or globs/i);
+});
+
+test("review integration documents the opaque Pi adapter and Go-owned authority boundary", () => {
+	const docs = read("docs/review-integration.md");
+	for (const marker of [
+		"Buffer → Buffer/error",
+		"exact Go-issued materialize/submission tokens",
+		"typed Pi transport refusal fails closed",
+		"Go owns worktree, lineage, candidate freeze, lens selection, correction, validator, approval burn, and review semantics",
+		"Delivery commands remain ordinary repository-policy operations.",
+		"package has no durable receipt or policy authority",
+		"static assets intentionally omit lifecycle instructions",
+	]) {
+		assert.ok(docs.includes(marker), `review integration doc is missing: ${marker}`);
+	}
+});

package/tests/package-manifest.test.ts

@@ -114,10 +114,10 @@ test("package verification names the native review runtime boundary and packaged
 	const manifest = readPackageJson();
 
 	assert.ok(manifest.files?.includes("lib/"), "the published package must include the native review runtime module directory");
-	assert.ok(manifest.files?.includes("runtime/"), "the published package must include the generated JavaScript transaction runtime");
+	assert.ok(manifest.files?.includes("runtime/"), "the published package must include generated JavaScript runtime modules");
 	assert.match(verifier, /"lib\/native-review-cli\.ts"/, "package verification must require the native review adapter from the packaged runtime");
-	assert.match(verifier, /"runtime\/git-commit-transaction\.mjs"/, "package verification must require the installed JavaScript transaction runtime");
-	assert.match(verifier, /build-git-commit-transaction-runner\.mjs.*--check/s, "package verification must reject generated-runtime drift");
+	assert.match(verifier, /"runtime\/native-review-cli\.mjs"/, "package verification must require the generated native review adapter");
+	assert.match(verifier, /build-runtime-modules\.mjs.*--check/s, "package verification must reject generated-runtime drift");
 	assert.match(verifier, /"tests\/fixtures\/native-review-cli\/v2\.1\.3\/start\.json"/, "package verification must retain the pinned native decoder fixture");
 	assert.match(
 		readFileSync(join(PACKAGE_ROOT, "extensions", "gentle-ai.ts"), "utf8"),
@@ -187,36 +187,31 @@ test("npm publication is bound to the exact package tag and triggering commit",
 	assert.doesNotMatch(releaseSkill, /--ref "\$\{tag\}"|-f dist-tag=/);
 });
 
-test("publication gate is isolated from graph-v1 authority storage", () => {
+test("Pi delivery relay is absent from the packaged extension", () => {
 	const extension = readFileSync(join(PACKAGE_ROOT, "extensions", "gentle-ai.ts"), "utf8");
-	const gate = readFileSync(join(PACKAGE_ROOT, "lib", "review-publication-gate.ts"), "utf8");
-	const transaction = readFileSync(join(PACKAGE_ROOT, "lib", "review-transaction.ts"), "utf8");
 
-	assert.match(extension, /from "\.\.\/lib\/review-publication-gate\.ts"/);
-	assert.match(transaction, /from "\.\/review-publication-gate\.ts"/);
-	assert.doesNotMatch(gate, /review-(?:transaction|object-store|graph-schema|lock|snapshot)/);
-	assert.doesNotMatch(transaction, /export function evaluateReleaseFastPathV1|export function resolveConfiguredPushDestinationV1/);
+	assert.doesNotMatch(extension, /review-publication-gate/);
 });
 
-test("installed commit transaction runner loads JavaScript only and has deterministic build checks", () => {
+test("generated runtime modules and packed-package checks are deterministic", () => {
 	const packageJson = readPackageJson();
-	const runner = readFileSync(join(PACKAGE_ROOT, "scripts", "run-git-commit-transaction.mjs"), "utf8");
+	const generator = readFileSync(join(PACKAGE_ROOT, "scripts", "build-runtime-modules.mjs"), "utf8");
 	const packedRunner = readFileSync(join(PACKAGE_ROOT, "scripts", "test-packed-runner.mjs"), "utf8");
 	const ci = readFileSync(join(PACKAGE_ROOT, ".github", "workflows", "ci.yml"), "utf8");
-	assert.equal(packageJson.scripts?.["build:transaction-runner"], "node scripts/build-git-commit-transaction-runner.mjs --write");
-	assert.equal(packageJson.scripts?.["check:transaction-runner"], "node scripts/build-git-commit-transaction-runner.mjs --check");
-	assert.equal(packageJson.scripts?.["test:packed-runner"], "node scripts/test-packed-runner.mjs");
-	assert.match(packageJson.scripts?.prepublishOnly ?? "", /pnpm run test:packed-runner/);
-	assert.match(ci, /pnpm run test:packed-runner/);
+	assert.equal(packageJson.scripts?.["build:runtime-modules"], "node scripts/build-runtime-modules.mjs --write");
+	assert.equal(packageJson.scripts?.["check:runtime-modules"], "node scripts/build-runtime-modules.mjs --check");
+	assert.equal(packageJson.scripts?.["test:packed-package"], "node scripts/test-packed-runner.mjs");
+	assert.match(packageJson.scripts?.prepublishOnly ?? "", /pnpm run test:packed-package/);
+	assert.match(ci, /pnpm run check:runtime-modules/);
+	assert.match(ci, /pnpm run test:packed-package/);
+	assert.match(generator, /Generated by scripts\/build-runtime-modules\.mjs/);
 	assert.match(packedRunner, /\["install"[^\]]*"--ignore-scripts=false"/s, "packed install must explicitly enable postinstall");
 	assert.doesNotMatch(packedRunner, /\["install"[^\]]*"--ignore-scripts"(?!\=false)/s);
 	assert.match(packedRunner, /execFileSync\("where\.exe", \["npm"\]/);
 	assert.match(packedRunner, /could not resolve npm-cli\.js without a command shell/);
 	assert.doesNotMatch(packedRunner, /ComSpec|cmd\.exe/);
 	assert.match(packedRunner, /review", "capabilities", "--contract", "gentle-ai\.review-integration\/v2"/);
-	assert.match(runner, /\.\.\/runtime\/git-commit-transaction\.mjs/);
-	assert.doesNotMatch(runner, /\.ts["']/);
-	assert.doesNotMatch(runner, /experimental-strip-types/);
+	assert.doesNotMatch(packedRunner, /git-commit-transaction|transaction runner/i);
 });
 
 test("package manifest ships and runs the checked-in package-local Gentle AI installer", () => {
@@ -266,20 +261,20 @@ test("package manifest installs pi-pretty through a wrapper without bundling nat
 	);
 });
 
-test("package verification binds the published Gentle AI v2.4.0 runtime pin", () => {
+test("package verification binds the published Gentle AI v2.5.0 runtime pin", () => {
 	const installer = readFileSync(join(PACKAGE_ROOT, "scripts", "gentle-ai-installer.mjs"), "utf8");
 	const binary = readFileSync(join(PACKAGE_ROOT, "lib", "gentle-ai-binary.ts"), "utf8");
 	const verifier = readFileSync(join(PACKAGE_ROOT, "scripts", "verify-package-files.mjs"), "utf8");
 
-	assert.match(installer, /INSTALLER_VERSION = "2\.4\.0"/);
+	assert.match(installer, /INSTALLER_VERSION = "2\.5\.0"/);
 	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_PACKAGE.*GENTLE_AI_WINDOWS_SOURCE_MODULE/);
-	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:XKkcy\+t76cyUKQnRwL1UnqHbhh8o416I8HQ1UsdvWSI="/);
+	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:0nvTLJFAf9ruBDwTvi\+aDrWt\/dt\/GKvUP2cFVB6c2DI="/);
 	assert.match(installer, /GOTOOLCHAIN: "local"/);
 	assert.match(installer, /GOSUMDB: "sum\.golang\.org"/);
 	assert.match(binary, /GENTLE_AI_VERSION = INSTALLER_VERSION/);
 	assert.match(binary, /GO_SUMDB_SOURCE_BUILD/);
 	assert.match(binary, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM/);
-	assert.match(verifier, /v2\.4\.0/);
+	assert.match(verifier, /v2\.5\.0/);
 });
 
 
@@ -981,6 +976,10 @@ test("gentle-ai-worker packages the exact scoped writer contract", () => {
 	const contextContract = readMarkdownSection(source, "Context contract");
 	assert.match(contextContract, /pre-existing untracked targets explicitly listed by the parent/);
 	assert.match(contextContract, /new files required by the delegated task/);
+	assert.match(contextContract, /derived candidate set the human can approve or narrow/);
+	assert.match(contextContract, /never an open request for the human to author paths or globs/);
+	assert.match(interactionContract, /closed set the human can approve, decline, or select from/);
+	assert.match(interactionContract, /never ask the human to author paths, globs, identifiers, or commands as free text/);
 
 	const implementationRules = readMarkdownSection(source, "Implementation rules");
 	assert.match(implementationRules, /`blocked` only for a non-human technical blocker/);
@@ -1129,7 +1128,7 @@ test("bounded implementation routing uses the same explicit fallback in both pol
 	);
 });
 
-test("orchestrator routes generic roles without reusing SDD or review agents", () => {
+test("orchestrator routes generic roles without static RDD lens routing", () => {
 	for (const file of ["orchestrator.md", "orchestrator-delegation.md"]) {
 		const routing = readFileSync(join(PACKAGE_ROOT, "assets", file), "utf8");
 		assert.match(routing, /generic non-SDD exploration[\s\S]*`gentle-ai-explore`/);
@@ -1139,12 +1138,16 @@ test("orchestrator routes generic roles without reusing SDD or review agents", (
 		);
 		assert.match(routing, /generic non-SDD (?:technical )?verification[\s\S]*`gentle-ai-verify`/);
 		assert.match(routing, /SDD roles stay inside SDD|Use `sdd-explore` and `sdd-verify` only inside SDD/);
-		assert.match(routing, /review lenses inside reviews|Use review lenses only inside explicit review transactions/);
-		assert.match(routing, /(?:truly local )?read-only check(?:ing)? of (?:known )?1-3 known files|1-3-file read-only check/);
+		assert.match(routing, /(?:truly local )?read-only check(?:ing)? of (?:known )?1[-–]3 known files|1[-–]3-file read-only check/);
 		assert.match(routing, /(?:verification that |verification commands →).*executes? or delegates?|executing\/delegating verification commands/);
 		assert.match(routing, /missing(?: or |\/)unusable[\s\S]*native `Agent`[\s\S]*(?:the )?same read-only/);
 		assert.match(routing, /report (?:the )?fallback/);
+		assert.doesNotMatch(routing, /review lenses? (?:inside|only inside)|review lens routing/i);
 	}
+
+	const core = readFileSync(join(PACKAGE_ROOT, "assets", "orchestrator.md"), "utf8");
+	assert.match(core, /Gentle AI dynamically supplies runtime-specific RDD instructions/);
+	assert.match(core, /this package does not invent or fall back/);
 });
 
 test("pi-pretty wrapper uses real package path resolution for pnpm symlink installs", () => {
@@ -1160,9 +1163,9 @@ test("pi-pretty wrapper uses real package path resolution for pnpm symlink insta
 	assert.match(wrapper, /quietToolsEnabled/);
 });
 
-test("v2.2.0 release package and runtime stop before publication", () => {
+test("v2.3.0 release package and runtime stop before publication", () => {
 	const packageJson = readPackageJson();
-	assert.equal(packageJson.version, "2.2.0", "the release manifest must remain explicitly pinned to v2.2.0");
+	assert.equal(packageJson.version, "2.3.0", "the release manifest must remain explicitly pinned to v2.3.0");
 	assert.equal(
 		packageJson.scripts?.test,
 		"node --experimental-strip-types --test tests/*.test.ts && pnpm run check:provider-contract && pnpm run test:harness",
@@ -1192,17 +1195,16 @@ test("bounded review keeps the Judgment Day skill contract at canon metadata ver
 	assert.doesNotMatch(frontmatter, /^  version: "1\.4"$/m);
 });
 
-test("README documents bounded review transactions and the honest installed permission boundary", () => {
+test("README documents dynamic Gentle AI RDD ownership and the installed permission boundary", () => {
 	const readme = readFileSync(join(PACKAGE_ROOT, "README.md"), "utf8");
 	for (const clause of [
-		"New ordinary review uses compact `gentle_review` `start -> finalize -> validate`.",
-		"Native compact gate validation is read-only.",
-		"Release from protected `main` may bypass receipt validation only when the tag targets the current immutable `origin/main` SHA, required CI for that exact SHA is successful, the remote head is rechecked before tag push, and no fresh risk evidence exists; otherwise release fails closed through native receipt validation.",
+		"Gentle AI dynamically supplies runtime-specific RDD instructions",
+		"does not define an RDD lifecycle",
 		"Dangerous-command safety remains independent and authoritative.",
-		"Adversarial review roles (the refuter and the targeted validator) are never Pi-authored",
 		"package-managed isolated installation",
 		"Project and user overrides may shadow a package asset",
 	]) {
-		assert.ok(readme.includes(clause), `README missing review v2 clause: ${clause}`);
+		assert.ok(readme.includes(clause), `README missing dynamic RDD clause: ${clause}`);
 	}
+	assert.doesNotMatch(readme, /New ordinary review uses compact `gentle_review` `start -> finalize -> validate`\./);
 });

package/tests/provider-defect-handoff.test.ts

@@ -46,13 +46,6 @@ const DELEGATION_CHOICE1_ORDER = [
 	"execute the shared candidate-scoped continuation below",
 ] as const;
 
-const SDD_CHOICE1_ORDER = [
-	"Complete a definitive lookup across open and closed issues",
-	"Derive the evidence channel only from the installed build string",
-	"If the installed build predates the relevant published fix",
-	"perform no further GitHub mutation and no blind retry",
-] as const;
-
 // ---------------------------------------------------------------------------
 // 1 — assets/orchestrator-delegation.md structural presence
 // ---------------------------------------------------------------------------
@@ -101,6 +94,12 @@ test("orchestrator-delegation.md states the admissibility-before-relay rule", ()
 	assert.match(DELEGATION, /The test is what produced the failure, not what the work was doing when it happened/i);
 });
 
+test("orchestrator-delegation.md excludes local consent lifecycle outcomes from provider-defect reporting", () => {
+	assert.match(DELEGATION, /`consent-binding-expired` and `consent-binding-already-consumed` are local lifecycle outcomes, not Gentle AI provider defects/i);
+	assert.match(DELEGATION, /An unknown consent binding is reportable only when independent evidence proves a fresh, same-session, unconsumed binding was lost/i);
+	assert.match(DELEGATION, /Never infer that evidence from the old combined stale-binding message/i);
+});
+
 test("orchestrator-delegation.md states the never-offer-to-repair rule", () => {
 	assert.match(
 		DELEGATION,
@@ -231,125 +230,23 @@ test("orchestrator-delegation.md does NOT reference the rc.3 canon", () => {
 });
 
 // ---------------------------------------------------------------------------
-// 3 — assets/sdd-orchestrator-workflow.md structural presence
+// 3 — SDD points to the single complete handoff contract
 // ---------------------------------------------------------------------------
 
-test("sdd-orchestrator-workflow.md carries the provider defect handoff section", () => {
+test("sdd-orchestrator-workflow.md points provider defects to the complete delegation contract", () => {
 	assert.match(SDD_WORKFLOW, /## Provider Defect Handoff/);
-});
-
-test("sdd-orchestrator-workflow.md references v2.4.0-rc.8 and the consent/v3 envelope", () => {
-	assert.match(SDD_WORKFLOW, /v2\.4\.0-rc\.8/);
-	assert.match(SDD_WORKFLOW, /gentle-ai\.review-integration\.consent\/v3/);
-});
-
-test("sdd-orchestrator-workflow.md lists all three semantic choice tokens in order", () => {
-	for (const token of CHOICE_TOKENS) {
-		assert.ok(
-			SDD_WORKFLOW.includes(`\`${token}\``),
-			`sdd-orchestrator-workflow.md missing semantic choice token: ${token}`,
-		);
-	}
-
-	const positions = CHOICE_TOKENS.map((token) => SDD_WORKFLOW.indexOf(`\`${token}\``));
-	for (const pos of positions) {
-		assert.notEqual(pos, -1, "a choice token is missing; ordering assertion is meaningless");
-	}
-	assert.ok(
-		positions[0] < positions[1],
-		`report_and_continue must appear before continue_without_reporting in sdd-orchestrator-workflow.md; got positions ${positions}`,
-	);
-	assert.ok(
-		positions[1] < positions[2],
-		`continue_without_reporting must appear before stop_here in sdd-orchestrator-workflow.md; got positions ${positions}`,
-	);
-});
-
-test("sdd-orchestrator-workflow.md preserves the rc.8 choice-1 ordering on the concise surface", () => {
-	assertChoice1Order(SDD_WORKFLOW, SDD_CHOICE1_ORDER, "sdd-orchestrator-workflow.md");
-});
-
-test("sdd-orchestrator-workflow.md references the full contract in orchestrator-delegation.md", () => {
 	assert.match(
 		SDD_WORKFLOW,
 		/The full contract lives in `assets\/orchestrator-delegation\.md` under `#### Gentle AI Provider Defect Handoff \(MANDATORY\)`/i,
 	);
-	// The pointer must resolve: the named heading has to exist on the delegation surface.
 	assert.match(DELEGATION, /^#### Gentle AI Provider Defect Handoff \(MANDATORY\)$/m);
+	assert.doesNotMatch(SDD_WORKFLOW, /`report_and_continue`|`continue_without_reporting`|`stop_here`/);
 });
 
-test("sdd-orchestrator-workflow.md states the rc.8 concise rules", () => {
-	// admissibility
-	assert.match(SDD_WORKFLOW, /Classify admissibility before relaying/i);
-	// never-repair
-	assert.match(
-		SDD_WORKFLOW,
-		/Never offer to switch to, inspect, modify, or directly repair the Gentle AI repository/i,
-	);
-	// consent
-	assert.match(SDD_WORKFLOW, /Ask the user first, in the active conversation language, for explicit consent to report the apparent defect/i);
-	// privacy
-	assert.match(SDD_WORKFLOW, /Privacy scrub immediately before the first GitHub operation/i);
-	// definitive lookup
-	assert.match(SDD_WORKFLOW, /Complete a definitive lookup across open and closed issues in `Gentleman-Programming\/gentle-ai`/i);
-	// evidence channel
-	assert.match(SDD_WORKFLOW, /recognized prerelease tags are `-rc\.` and `-main\.`; every other build is stable/i);
-	assert.match(SDD_WORKFLOW, /never recommend switching channels/i);
-	// outdated + regression
-	assert.match(SDD_WORKFLOW, /If the installed build predates the relevant published fix, recommend installing it and reproducing/i);
-	assert.match(SDD_WORKFLOW, /treat it as a possible regression/i);
-	assert.match(SDD_WORKFLOW, /never reopen automatically/i);
-	// confirmed creation
-	assert.match(SDD_WORKFLOW, /Confirmed creation requires the GitHub create operation to confirm a newly-created issue identity\/URL/i);
-	// uncertainty continuation
-	assert.match(SDD_WORKFLOW, /perform no further GitHub mutation and no blind retry/i);
-	assert.match(SDD_WORKFLOW, /execute the exact captured provider-owned decline invocation exactly once, validate it, re-enter native negotiated STATUS, and resume the already-held consumer continuation/i);
-	// exact decline
-	assert.match(SDD_WORKFLOW, /Both continue choices execute that exact captured decline invocation exactly once/i);
-	assert.match(SDD_WORKFLOW, /never synthesize the decline command, target, token, or consumer continuation from prose/i);
-	// scope/mode
-	assert.match(SDD_WORKFLOW, /Do not invoke `gentle-ai review mode disable` at clone or global scope within this handoff/i);
-	assert.match(SDD_WORKFLOW, /Do not turn RDD off or on within this handoff/i);
-	// resume
-	assert.match(SDD_WORKFLOW, /Resume after an installed published fix or an explicit maintainer-authorized, documented native recovery or reset/i);
-	assert.match(SDD_WORKFLOW, /Never resume against unpublished code/i);
-});
-
-test("sdd-orchestrator-workflow.md does NOT carry the gentle-report label discipline", () => {
-	assert.equal(
-		SDD_WORKFLOW.includes("gentle-report"),
-		false,
-		"sdd-orchestrator-workflow.md must not reference the removed gentle-report label",
-	);
-});
-
-test("sdd-orchestrator-workflow.md does NOT make published fixes the sole resumption route", () => {
-	assert.equal(
-		SDD_WORKFLOW.includes("Resume only after an installed published fix"),
-		false,
-		"sdd-orchestrator-workflow.md must not state the prohibited sole-resumption route",
-	);
-});
-
-test("sdd-orchestrator-workflow.md does NOT retain the rc.3 hard-stop that withholds the decline invocation", () => {
-	assert.equal(
-		SDD_WORKFLOW.includes("Any report ambiguity or failure is a hard stop: preserve all consumer state and do not execute the decline invocation"),
-		false,
-		"sdd-orchestrator-workflow.md must not retain the rc.3 hard-stop wedge",
-	);
-});
-
-test("both handoff surfaces invoke `gentle-ai review mode disable` exactly once", () => {
-	// The delegation surface carries the contract inside the canon block, so its
-	// section is bounded by the following `####` canon heading, not by `## `.
-	const surfaces = [
-		["orchestrator-delegation.md", DELEGATION, /#### Gentle AI Provider Defect Handoff[\s\S]*?(?=\n#### SDD Edit-Authority|$)/],
-		["sdd-orchestrator-workflow.md", SDD_WORKFLOW, /## Provider Defect Handoff[\s\S]*?(?=\n## |$)/],
-	] as const;
-	for (const [name, asset, sectionPattern] of surfaces) {
-		const section = asset.match(sectionPattern)?.[0] ?? "";
-		assert.ok(section.length > 0, `${name}: provider defect handoff section not found`);
-		const n = countOccurrences(section, "gentle-ai review mode disable");
-		assert.equal(n, 1, `${name} must invoke "gentle-ai review mode disable" exactly once; got ${n}`);
-	}
+test("the complete delegation handoff invokes `gentle-ai review mode disable` exactly once", () => {
+	const section = DELEGATION.match(
+		/#### Gentle AI Provider Defect Handoff[\s\S]*?(?=\n#### SDD Edit-Authority|$)/,
+	)?.[0] ?? "";
+	assert.ok(section.length > 0, "orchestrator-delegation.md: provider defect handoff section not found");
+	assert.equal(countOccurrences(section, "gentle-ai review mode disable"), 1);
 });