gentle-pi 2.2.0 → 2.4.0

package/tests/opaque-pi-reviewer-adapter.test.ts

@@ -0,0 +1,266 @@
+import assert from "node:assert/strict";
+import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import {
+	OPAQUE_PI_REVIEWER_ARGV,
+	OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE,
+	OpaquePiReviewerTransportError,
+	resolvePiLaunch,
+	runOpaquePiReviewer,
+} from "../lib/opaque-pi-reviewer-adapter.ts";
+
+const FAKE_PI = `#!/usr/bin/env node
+const fs = require("node:fs");
+const path = require("node:path");
+const argv = process.argv.slice(2);
+const chunks = [];
+process.stdin.on("data", (chunk) => chunks.push(chunk));
+process.stdin.on("end", () => {
+	const stdin = Buffer.concat(chunks);
+	if (process.env.OPAQUE_PI_STDIN_CAPTURE) fs.writeFileSync(process.env.OPAQUE_PI_STDIN_CAPTURE, stdin);
+	const mode = process.env.OPAQUE_PI_MODE || "ok";
+	const log = {
+		argv,
+		cwd: process.cwd(),
+		entries_before: fs.readdirSync(process.cwd()),
+		entries_after: fs.readdirSync(process.cwd()),
+	};
+	if (process.env.OPAQUE_PI_LOG) fs.appendFileSync(process.env.OPAQUE_PI_LOG, JSON.stringify(log) + "\\n");
+	if (mode === "break-cleanup" || process.env.OPAQUE_PI_BREAK_CLEANUP === "true") {
+		fs.chmodSync(path.dirname(process.cwd()), 0o500);
+	}
+	if (mode === "empty") process.exit(0);
+	if (mode === "hang") { setTimeout(() => process.exit(0), 10_000); return; }
+	if (mode === "nonzero") { process.stderr.write("opaque pi failed\\n"); process.exit(7); }
+	process.stdout.write(Buffer.from(process.env.OPAQUE_PI_OUTPUT_B64 || "", "base64"));
+});
+`;
+
+const PROMPT_BYTES = Buffer.concat([
+	Buffer.from("opaque prompt\r\n\u0000", "utf8"),
+	Buffer.from([0x01, 0xff, 0xfe, 0x00]),
+]);
+const OUTPUT_BYTES = Buffer.concat([
+	Buffer.from("opaque output\r\n\u0000", "utf8"),
+	Buffer.from([0x07, 0xff, 0xfe, 0x00]),
+]);
+
+interface OpaqueHarness {
+	directory: string;
+	pi: string;
+	logPath: string;
+	stdinCapturePath: string;
+	environment: NodeJS.ProcessEnv;
+}
+
+interface OpaquePiLog {
+	argv: string[];
+	cwd: string;
+	entries_before: string[];
+	entries_after: string[];
+}
+
+function harness(t: test.TestContext, overrides: Record<string, string> = {}): OpaqueHarness {
+	const directory = mkdtempSync(join(tmpdir(), "gentle-pi-opaque-reviewer-"));
+	t.after(() => rmSync(directory, { recursive: true, force: true }));
+	const pi = join(directory, "pi");
+	writeFileSync(pi, FAKE_PI);
+	chmodSync(pi, 0o755);
+	const logPath = join(directory, "pi.log");
+	const stdinCapturePath = join(directory, "stdin.bin");
+	return {
+		directory,
+		pi,
+		logPath,
+		stdinCapturePath,
+		environment: {
+			...process.env,
+			OPAQUE_PI_LOG: logPath,
+			OPAQUE_PI_STDIN_CAPTURE: stdinCapturePath,
+			OPAQUE_PI_OUTPUT_B64: OUTPUT_BYTES.toString("base64"),
+			...overrides,
+		},
+	};
+}
+
+function readLog(path: string): OpaquePiLog[] {
+	if (!existsSync(path)) return [];
+	return readFileSync(path, "utf8")
+		.split("\n")
+		.filter((line) => line.length > 0)
+		.map((line) => JSON.parse(line) as OpaquePiLog);
+}
+
+async function rejectsWithTransportError(
+	promise: Promise<unknown>,
+	kind: (typeof OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE)[keyof typeof OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE],
+): Promise<OpaquePiReviewerTransportError> {
+	let caught: OpaquePiReviewerTransportError | undefined;
+	await assert.rejects(promise, (error: unknown) => {
+		assert.ok(error instanceof OpaquePiReviewerTransportError, `expected OpaquePiReviewerTransportError, received ${String(error)}`);
+		caught = error;
+		return error.kind === kind;
+	});
+	return caught!;
+}
+
+test("the opaque adapter streams arbitrary prompt and stdout bytes verbatim through the fixed Pi subprocess", async (t) => {
+	const fixture = harness(t);
+	const result = await runOpaquePiReviewer(PROMPT_BYTES, {
+		piExecutable: fixture.pi,
+		environment: fixture.environment,
+		timeoutMs: 10_000,
+	});
+
+	assert.equal(result.promptByteLength, PROMPT_BYTES.length);
+	assert.equal(result.stdoutByteLength, OUTPUT_BYTES.length);
+	assert.deepEqual(result.stdout, OUTPUT_BYTES);
+	assert.deepEqual(readFileSync(fixture.stdinCapturePath), PROMPT_BYTES);
+
+	const calls = readLog(fixture.logPath);
+	assert.equal(calls.length, 1);
+	assert.deepEqual(calls[0]!.argv, [...OPAQUE_PI_REVIEWER_ARGV]);
+	assert.deepEqual(calls[0]!.entries_before, []);
+	assert.deepEqual(calls[0]!.entries_after, []);
+	assert.notEqual(calls[0]!.cwd, process.cwd());
+	assert.equal(existsSync(calls[0]!.cwd), false, "the empty scratch directory is removed after success");
+});
+
+test("the opaque adapter returns typed transport errors for launch, nonzero, empty, timeout, and cancellation", async (t) => {
+	const fixture = harness(t);
+	await rejectsWithTransportError(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: join(fixture.directory, "missing-pi"), environment: fixture.environment, timeoutMs: 10_000 }),
+		OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.LAUNCH_FAILED,
+	);
+
+	const nonzero = await rejectsWithTransportError(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: fixture.pi, environment: { ...fixture.environment, OPAQUE_PI_MODE: "nonzero" }, timeoutMs: 10_000 }),
+		OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.NONZERO_EXIT,
+	);
+	assert.equal(nonzero.exitCode, 7);
+	assert.deepEqual(nonzero.stderr, Buffer.from("opaque pi failed\n"));
+
+	await rejectsWithTransportError(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: fixture.pi, environment: { ...fixture.environment, OPAQUE_PI_MODE: "empty" }, timeoutMs: 10_000 }),
+		OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.EMPTY_OUTPUT,
+	);
+
+	const timedOut = await rejectsWithTransportError(
+		runOpaquePiReviewer(PROMPT_BYTES, { piExecutable: fixture.pi, environment: { ...fixture.environment, OPAQUE_PI_MODE: "hang" }, timeoutMs: 300 }),
+		OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.TIMED_OUT,
+	);
+	assert.equal(timedOut.timedOut, true);
+
+	const controller = new AbortController();
+	const cancellation = runOpaquePiReviewer(PROMPT_BYTES, {
+		piExecutable: fixture.pi,
+		environment: { ...fixture.environment, OPAQUE_PI_MODE: "hang" },
+		timeoutMs: 10_000,
+		signal: controller.signal,
+	});
+	setTimeout(() => controller.abort(), 100).unref();
+	const cancelled = await rejectsWithTransportError(cancellation, OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.CANCELLED);
+	assert.equal(cancelled.cancelled, true);
+});
+
+test("the opaque adapter leaves no prompt or result file in scratch and reports cleanup failure as transport-only", async (t) => {
+	const fixture = harness(t);
+	const scratchParent = mkdtempSync(join(tmpdir(), "gentle-pi-opaque-reviewer-cleanup-"));
+	const originalTmpdir = process.env.TMPDIR;
+	process.env.TMPDIR = scratchParent;
+	try {
+		const error = await rejectsWithTransportError(
+			runOpaquePiReviewer(PROMPT_BYTES, {
+				piExecutable: fixture.pi,
+				environment: { ...fixture.environment, OPAQUE_PI_MODE: "break-cleanup" },
+				timeoutMs: 10_000,
+			}),
+			OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.CLEANUP_FAILED,
+		);
+		assert.match(error.message, /scratch directory/i);
+	} finally {
+		if (originalTmpdir === undefined) delete process.env.TMPDIR;
+		else process.env.TMPDIR = originalTmpdir;
+		chmodSync(scratchParent, 0o700);
+		rmSync(scratchParent, { recursive: true, force: true });
+	}
+});
+
+test("the opaque adapter preserves primary nonzero and timeout errors when scratch cleanup also fails", async (t) => {
+	const fixture = harness(t);
+	const scratchParent = mkdtempSync(join(tmpdir(), "gentle-pi-opaque-reviewer-primary-failure-"));
+	const originalTmpdir = process.env.TMPDIR;
+	process.env.TMPDIR = scratchParent;
+	try {
+		const nonzero = await rejectsWithTransportError(
+			runOpaquePiReviewer(PROMPT_BYTES, {
+				piExecutable: fixture.pi,
+				environment: { ...fixture.environment, OPAQUE_PI_MODE: "nonzero", OPAQUE_PI_BREAK_CLEANUP: "true" },
+				timeoutMs: 10_000,
+			}),
+			OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.NONZERO_EXIT,
+		);
+		assert.equal(nonzero.exitCode, 7);
+		assert.deepEqual(nonzero.stderr, Buffer.from("opaque pi failed\n"));
+		chmodSync(scratchParent, 0o700);
+
+		const timedOut = await rejectsWithTransportError(
+			runOpaquePiReviewer(PROMPT_BYTES, {
+				piExecutable: fixture.pi,
+				environment: { ...fixture.environment, OPAQUE_PI_MODE: "hang", OPAQUE_PI_BREAK_CLEANUP: "true" },
+				timeoutMs: 300,
+			}),
+			OPAQUE_PI_REVIEWER_TRANSPORT_FAILURE.TIMED_OUT,
+		);
+		assert.equal(timedOut.timedOut, true);
+	} finally {
+		if (originalTmpdir === undefined) delete process.env.TMPDIR;
+		else process.env.TMPDIR = originalTmpdir;
+		chmodSync(scratchParent, 0o700);
+		rmSync(scratchParent, { recursive: true, force: true });
+	}
+});
+
+test("the opaque adapter has no review lifecycle imports or identifiers", () => {
+	const adapterPath = fileURLToPath(new URL("../lib/opaque-pi-reviewer-adapter.ts", import.meta.url));
+	const source = readFileSync(adapterPath, "utf8");
+	assert.doesNotMatch(source, /review-integration|gentle-ai|materialize|submit/i);
+	for (const identifier of ["lineage", "target", "revision", "receipt", "lens", "order", "subject", "schema", "capture", "submission", "status", "model", "provider", "profile"]) {
+		assert.doesNotMatch(source, new RegExp(`\\b${identifier}\\b`, "i"), `adapter must not contain lifecycle identifier ${identifier}`);
+	}
+});
+
+// #468 / #519: on Windows a bare `pi` resolves to pi.cmd, pi.ps1, or a POSIX
+// shim, none of which Node can spawn with shell:false (EINVAL or ENOENT). The
+// relay already runs inside Pi, so the host's own JavaScript entry is spawned
+// through process.execPath instead. Other platforms keep today's exact shape.
+test("the Pi launch shape spawns the host entry through process.execPath on win32 and stays byte-identical elsewhere", () => {
+	const host = {
+		execPath: "C:\\Program Files\\nodejs\\node.exe",
+		entry: "C:\\Users\\dev\\AppData\\Local\\pnpm\\global\\5\\node_modules\\@earendil-works\\pi-coding-agent\\dist\\bundle\\cli.js",
+	};
+	const windows = resolvePiLaunch(undefined, "win32", host);
+	assert.deepEqual(windows, { file: host.execPath, arguments: [host.entry, ...OPAQUE_PI_REVIEWER_ARGV] });
+	assert.notEqual(windows.file, "pi");
+	assert.equal(windows.arguments.includes("pi"), false);
+	for (const platform of ["linux", "darwin", "freebsd"] as const) {
+		assert.deepEqual(resolvePiLaunch(undefined, platform, host), { file: "pi", arguments: [...OPAQUE_PI_REVIEWER_ARGV] }, platform);
+		assert.deepEqual(resolvePiLaunch("/opt/pi/bin/pi", platform, host), { file: "/opt/pi/bin/pi", arguments: [...OPAQUE_PI_REVIEWER_ARGV] }, platform);
+	}
+	assert.deepEqual(resolvePiLaunch("C:\\tools\\pi.exe", "win32", host), { file: "C:\\tools\\pi.exe", arguments: [...OPAQUE_PI_REVIEWER_ARGV] });
+	for (const entry of [undefined, "", "cli.js", "dist/bundle/cli.js"]) {
+		assert.throws(() => resolvePiLaunch(undefined, "win32", { execPath: host.execPath, entry }), /host entry/, `entry ${JSON.stringify(entry)} must fail closed instead of spawning a bare pi`);
+	}
+});
+
+test("the default Pi launch resolves from the running host process", () => {
+	const launch = resolvePiLaunch(undefined);
+	if (process.platform === "win32") {
+		assert.deepEqual(launch, { file: process.execPath, arguments: [process.argv[1]!, ...OPAQUE_PI_REVIEWER_ARGV] });
+	} else {
+		assert.deepEqual(launch, { file: "pi", arguments: [...OPAQUE_PI_REVIEWER_ARGV] });
+	}
+});

package/tests/orchestrator-budget.test.ts

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test, { after } from "node:test";
@@ -9,8 +9,8 @@ import test, { after } from "node:test";
 // orchestrator-lazy-diet migration tests
 //
 // Locks the split of the always-on `assets/orchestrator.md` into a thin core
-// plus three path-substituted lazy reference files (see design.md "Core
-// budget rebuilt from measured drafts" and "Appendix: drafted core texts").
+// plus lazy reference files (see design.md "Core budget rebuilt from measured
+// drafts" and "Appendix: drafted core texts").
 //
 // `getOrchestratorPrompt`'s rendered return value is memoized in a
 // module-level cache (first-read-wins for the process lifetime — see design.md
@@ -19,17 +19,19 @@ import test, { after } from "node:test";
 // ambient environment variables, so production runtime asset resolution stays
 // deterministic. The representative production assets directory below is
 // populated by COPYING the real repo assets (dynamically, at test-run time)
-// into a short-path tmpdir — this isolates byte-budget measurement from the
-// real repo's absolute path length while keeping content representative of
-// production. Tests that need to inspect the real repo files directly (the
-// disposition-mapped union sweep, the core-alone token assertions) read
-// `assets/*.md` directly via `readFileSync`, sidestepping the cache entirely.
+// into short and deliberately long tmpdir paths. This isolates byte-budget
+// measurement from the real repo's absolute path length while keeping content
+// representative of production. Tests that need to inspect the real repo files
+// directly (the disposition-mapped union sweep, the core-alone token
+// assertions) read `assets/*.md` directly via `readFileSync`, sidestepping the
+// cache entirely.
 // ---------------------------------------------------------------------------
 
 const REPO_ROOT = join(import.meta.dirname, "..");
 const REAL_ASSETS_DIR = join(REPO_ROOT, "assets");
 const FIXTURE_PATH = join(import.meta.dirname, "fixtures", "orchestrator.pre-diet.md");
-const BUDGET_BYTES = 10240;
+const BUDGET_BYTES = 8192;
+const MIN_CONTROLLED_LONG_ASSETS_ROOT_CHARS = 93;
 
 const LAZY_ASSET_NAMES = [
 	"orchestrator.md",
@@ -38,42 +40,56 @@ const LAZY_ASSET_NAMES = [
 	"orchestrator-memory.md",
 	"orchestrator-skills.md",
 ] as const;
+const LAZY_REFERENCE_FILE_NAMES = LAZY_ASSET_NAMES.slice(1);
 
-const representativeProductionAssetsDir = mkdtempSync(join(tmpdir(), "gp-b-"));
-for (const name of LAZY_ASSET_NAMES) {
-	const src = join(REAL_ASSETS_DIR, name);
-	writeFileSync(
-		join(representativeProductionAssetsDir, name),
-		existsSync(src) ? readFileSync(src) : `stub placeholder for ${name} (not authored yet)\n`,
-	);
+function copyRequiredLazyAssets(destination: string): void {
+	for (const name of LAZY_ASSET_NAMES) {
+		const source = join(REAL_ASSETS_DIR, name);
+		assert.ok(existsSync(source), `missing packaged lazy asset: ${name}`);
+		copyFileSync(source, join(destination, name));
+	}
 }
-const { __testing } = await import("../extensions/gentle-ai.ts");
 
-const MIN_REALISTIC_INSTALL_ASSETS_PATH_CHARS = 59;
+const representativeProductionAssetsDir = mkdtempSync(join(tmpdir(), "gp-b-"));
+copyRequiredLazyAssets(representativeProductionAssetsDir);
+const { __testing } = await import("../extensions/gentle-ai.ts");
 
-// Realistic-length assets path: mirrors an actual installed path such as
-// `~/.pi/agent/npm/node_modules/gentle-pi/assets`, so the budget assertion is
-// not laundered through an artificially short mkdtemp path. The helper is also
-// exercised in a fresh child process (`tests/fixtures/measure-orchestrator-prompt.mjs`)
-// to keep production cache behavior separate from fixture measurements.
-const realisticBaseDir = mkdtempSync(join(tmpdir(), "gp-realistic-"));
-const realisticDir = join(realisticBaseDir, ".pi", "agent", "npm", "node_modules", "gentle-pi", "assets");
-mkdirSync(realisticDir, { recursive: true });
+// A controlled long assets root proves the parent prompt remains within the
+// canonical budget independently of the checkout or installed-package path.
+// The child-process measurement keeps production cache behavior separate from
+// fixture measurements.
+// The root is built to one exact length rather than "tmpdir plus a long
+// suffix". The prompt declares the absolute root once, so it grows one byte
+// per root character, and a 48-character macOS tmpdir pushed the previous
+// construction to 164 characters where a 4-character Linux /tmp gave 121.
+// A fixed length makes every platform measure the same budget claim.
+const CONTROLLED_LONG_ASSETS_ROOT_CHARS = 128;
+const controlledLongBaseDir = mkdtempSync(join(tmpdir(), "gp-long-"));
+const controlledLongSegmentChars = CONTROLLED_LONG_ASSETS_ROOT_CHARS - join(controlledLongBaseDir, "x", "assets").length + 1;
 assert.ok(
-	realisticDir.length >= MIN_REALISTIC_INSTALL_ASSETS_PATH_CHARS,
-	`realistic scratch assets path is only ${realisticDir.length} chars, need >= ${MIN_REALISTIC_INSTALL_ASSETS_PATH_CHARS} to mirror a real install path`,
+	controlledLongSegmentChars >= 1,
+	`tmpdir ${tmpdir()} is too long to build a ${CONTROLLED_LONG_ASSETS_ROOT_CHARS}-char controlled assets root`,
 );
-for (const name of LAZY_ASSET_NAMES) {
-	const src = join(REAL_ASSETS_DIR, name);
-	writeFileSync(
-		join(realisticDir, name),
-		existsSync(src) ? readFileSync(src) : `stub placeholder for ${name} (not authored yet)\n`,
-	);
-}
+const controlledLongAssetsDir = join(
+	controlledLongBaseDir,
+	"path-independent-prompt-budget-".repeat(Math.ceil(controlledLongSegmentChars / 31)).slice(0, controlledLongSegmentChars),
+	"assets",
+);
+mkdirSync(controlledLongAssetsDir, { recursive: true });
+assert.equal(
+	controlledLongAssetsDir.length,
+	CONTROLLED_LONG_ASSETS_ROOT_CHARS,
+	`controlled long assets root is ${controlledLongAssetsDir.length} chars, want exactly ${CONTROLLED_LONG_ASSETS_ROOT_CHARS}`,
+);
+assert.ok(
+	controlledLongAssetsDir.length >= MIN_CONTROLLED_LONG_ASSETS_ROOT_CHARS,
+	`controlled long assets root is only ${controlledLongAssetsDir.length} chars, need >= ${MIN_CONTROLLED_LONG_ASSETS_ROOT_CHARS}`,
+);
+copyRequiredLazyAssets(controlledLongAssetsDir);
 
 after(() => {
 	rmSync(representativeProductionAssetsDir, { recursive: true, force: true });
-	rmSync(realisticBaseDir, { recursive: true, force: true });
+	rmSync(controlledLongBaseDir, { recursive: true, force: true });
 });
 
 function readRealAsset(name: string): string {
@@ -98,7 +114,7 @@ function measureOrchestratorPromptBytes(assetsDir: string): number {
 // 2.2 — Byte budget (Spec: Always-On Injection Byte Budget)
 // ---------------------------------------------------------------------------
 
-test("getOrchestratorPrompt return value stays within the 10,240 B budget (short-path stub sanity check)", () => {
+test("getOrchestratorPrompt return value stays within the canonical 8,192 B budget at a short assets root", () => {
 	const rendered = __testing.renderOrchestratorPrompt(representativeProductionAssetsDir);
 	const bytes = Buffer.byteLength(rendered, "utf8");
 	assert.ok(
@@ -107,33 +123,46 @@ test("getOrchestratorPrompt return value stays within the 10,240 B budget (short
 	);
 });
 
-test(`getOrchestratorPrompt return value stays within the 10,240 B budget at a realistic (>= ${MIN_REALISTIC_INSTALL_ASSETS_PATH_CHARS} char) install path length`, () => {
-	const bytes = measureOrchestratorPromptBytes(realisticDir);
+test(`getOrchestratorPrompt keeps a controlled long (>= ${MIN_CONTROLLED_LONG_ASSETS_ROOT_CHARS} char) assets root within the canonical budget`, () => {
+	const rendered = __testing.renderOrchestratorPrompt(controlledLongAssetsDir);
+	const bytes = measureOrchestratorPromptBytes(controlledLongAssetsDir);
+	assert.equal(bytes, Buffer.byteLength(rendered, "utf8"), "child-process and direct render byte counts must match");
 	assert.ok(
 		bytes <= BUDGET_BYTES,
-		`getOrchestratorPrompt() returned ${bytes} B at a realistic ${realisticDir.length}-char ASSETS_DIR path, exceeds the ${BUDGET_BYTES} B budget`,
+		`getOrchestratorPrompt() returned ${bytes} B at controlled ${controlledLongAssetsDir.length}-char assets root, exceeds the ${BUDGET_BYTES} B budget`,
+	);
+	assert.equal(
+		rendered.split(controlledLongAssetsDir).length - 1,
+		1,
+		"the absolute assets root must be declared exactly once",
+	);
+	assert.ok(
+		rendered.includes(`Package assets root: \`${controlledLongAssetsDir}\`. Lazy asset paths below are relative to this root.`),
+		"the parent prompt must declare how to resolve relative lazy asset paths",
 	);
+	for (const name of LAZY_REFERENCE_FILE_NAMES) {
+		assert.ok(rendered.includes(`\`${name}\``), `lazy asset filename is missing: ${name}`);
+	}
+	assert.doesNotMatch(rendered, /\{\{/, "unresolved {{...}} placeholder leaked into the rendered prompt");
 });
 
 // ---------------------------------------------------------------------------
 // 2.3 — Disposition-mapped union sweep (Spec: No Normative Content Loss +
 // Pointer reachability)
 //
-// Every normative line of the frozen pre-diet fixture is assigned to exactly
-// one documented disposition: CORE_VERBATIM (byte-identical in the new
-// core), LAZY_VERBATIM (byte-identical in one specific lazy file), or OBSOLETE
-// (intentionally absent from every live model-facing asset). Section headings
-// that are reused unchanged as the new core's summary heading are
-// CORE_VERBATIM; section bodies that are condensed away in core are
-// LAZY_VERBATIM against their one target lazy file — never a blanket union
-// across all three.
+// Every normative line of the frozen pre-diet fixture is assigned to a
+// documented disposition: CORE_VERBATIM (byte-identical in the core),
+// LAZY_VERBATIM (byte-identical in one specific lazy file), OBSOLETE
+// (intentionally absent), or REPLACED (superseded by the focused #3417 asset
+// policy ratchets below). REPLACED preserves the historical fixture without
+// treating a retired prompt mirror as a current normative source.
 // ---------------------------------------------------------------------------
 
 type Target = "core" | "delegation" | "memory" | "skills";
 
 interface DispositionRange {
 	lines: [number, number];
-	target: Target | "obsolete";
+	target: Target | "obsolete" | "replaced";
 	label: string;
 }
 
@@ -158,13 +187,21 @@ const DISPOSITION_MAP: DispositionRange[] = [
 	{ lines: [25, 29], target: "delegation", label: "Language Boundary LB5 (exceptions)" },
 	{ lines: [31, 40], target: "core", label: "Mental Model" },
 	{ lines: [42, 42], target: "core", label: "Work Routing Ladder heading" },
-	{ lines: [44, 97], target: "delegation", label: "Work Routing Ladder body + Pi Subagent Model Routing" },
+	{
+		lines: [44, 97],
+		target: "replaced",
+		label: "Pre-RDD routing detail replaced by focused direct-delegation guidance (#3417)",
+	},
 	{
 		lines: [98, 107],
 		target: "obsolete",
 		label: "Size/risk-selected SDD tier replaced by explicit-request/accepted-proposal selection (#312)",
 	},
-	{ lines: [108, 108], target: "delegation", label: "SDD explicit-request trigger" },
+	{
+		lines: [108, 108],
+		target: "replaced",
+		label: "Earlier SDD trigger wording replaced by the focused SDD boundary (#3417)",
+	},
 	{
 		lines: [109, 110],
 		target: "obsolete",
@@ -179,8 +216,8 @@ const DISPOSITION_MAP: DispositionRange[] = [
 	},
 	{
 		lines: [128, 132],
-		target: "delegation",
-		label: "Mandatory Triggers heading + Pi trigger preamble + 4-file binding",
+		target: "replaced",
+		label: "Pre-RDD trigger wording replaced by focused direct-delegation guidance (#3417)",
 	},
 	{
 		lines: [133, 133],
@@ -189,8 +226,8 @@ const DISPOSITION_MAP: DispositionRange[] = [
 	},
 	{
 		lines: [134, 167],
-		target: "delegation",
-		label: "Mandatory Triggers remainder + Cost/Context Balance + Canonical Workflows",
+		target: "replaced",
+		label: "Pre-RDD trigger and workflow wording replaced by focused delegation guidance (#3417)",
 	},
 	{
 		lines: [169, 181],
@@ -199,8 +236,16 @@ const DISPOSITION_MAP: DispositionRange[] = [
 	},
 	{ lines: [183, 191], target: "core", label: "SDD Workflow pointer" },
 	{ lines: [193, 193], target: "core", label: "Memory Contract heading" },
-	{ lines: [195, 195], target: "core", label: "Memory Contract intro" },
-	{ lines: [197, 201], target: "core", label: "Memory Contract Non-SDD delegation" },
+	{
+		lines: [195, 195],
+		target: "replaced",
+		label: "Verbose memory introduction replaced by compact parent/subagent ownership (#3417)",
+	},
+	{
+		lines: [197, 201],
+		target: "replaced",
+		label: "Verbose non-SDD memory forwarding replaced by compact ownership (#3417)",
+	},
 	{ lines: [203, 230], target: "memory", label: "Memory Contract SDD phases table + artifact keys + lifecycle rule" },
 	{ lines: [232, 232], target: "core", label: "Skill Registry Protocol heading" },
 	{ lines: [234, 253], target: "skills", label: "Skill Registry Protocol detail" },
@@ -219,6 +264,11 @@ function isNormativeLine(line: string): boolean {
 }
 
 const fixtureLines = readFileSync(FIXTURE_PATH, "utf8").split("\n");
+// Fixture lines 187 and 191 predate the root-relative lazy-asset contract and
+// canonical-authority resolution. Keep their coverage by asserting the
+// intentionally updated production wording instead of weakening the range.
+const CURRENT_SDD_WORKFLOW_PATH = "`sdd-orchestrator-workflow.md`";
+const CURRENT_HARD_PREFLIGHT_INVARIANT = "Hard preflight invariant: `openspec/config.yaml`, existing SDD changes, installed `.pi`/global SDD assets, or a todo named \"preflight\" are not session preflight. Do not mark SDD preflight complete, start `sdd-init`, launch SDD subagents/chains, or move to explore/proposal/spec/design/tasks until this session has an injected `## SDD Session Preflight` block or a canonical-authority resolution. Defaults and capability constraints may resolve fields without confirmation prompts; preserve unresolved-choice and safety gates.";
 const SUPERSEDED_LIFECYCLE_REVIEW_LINES = new Set([
 	70,
 	// 74/77: the loose mode-choice background lines were replaced by the
@@ -240,6 +290,7 @@ const SUPERSEDED_LIFECYCLE_REVIEW_LINES = new Set([
 ]);
 
 for (const range of DISPOSITION_MAP) {
+	if (range.target === "replaced") continue;
 	test(
 		`disposition-mapped union: ${range.label} (fixture:${range.lines[0]}-${range.lines[1]}) -> ${range.target}`,
 		() => {
@@ -251,6 +302,12 @@ for (const range of DISPOSITION_MAP) {
 				const raw = fixtureLines[ln - 1];
 				if (raw === undefined || !isNormativeLine(raw)) continue;
 				const trimmed = raw.trim();
+				const expected =
+					ln === 187
+						? CURRENT_SDD_WORKFLOW_PATH
+						: ln === 191
+							? CURRENT_HARD_PREFLIGHT_INVARIANT
+							: trimmed;
 				if (SUPERSEDED_LIFECYCLE_REVIEW_LINES.has(ln)) {
 					assert.ok(
 						!targetContent.includes(trimmed),
@@ -266,8 +323,8 @@ for (const range of DISPOSITION_MAP) {
 					continue;
 				}
 				assert.ok(
-					targetContent.includes(trimmed),
-					`normative line lost: fixture:${ln} "${trimmed}" not found verbatim in ${TARGET_FILE[range.target]} (disposition: ${range.target}, section: ${range.label})`,
+					targetContent.includes(expected),
+					`normative line lost: fixture:${ln} "${expected}" not found verbatim in ${TARGET_FILE[range.target]} (disposition: ${range.target}, section: ${range.label})`,
 				);
 			}
 		},
@@ -279,32 +336,28 @@ for (const range of DISPOSITION_MAP) {
 // string alone, no lazy union.
 // ---------------------------------------------------------------------------
 
-test("core-alone: load-bearing delegation tokens present without lazy union", () => {
+test("core-alone: load-bearing direct-delegation tokens remain without lazy union", () => {
 	const core = readRealAsset("orchestrator.md");
 	assert.match(core, /4-file rule/);
 	assert.match(core, /Multi-file write rule/);
-	assert.match(core, /Lifecycle gate rule/);
 	assert.match(core, /Incident rule/);
+	assert.match(core, /Verification rule/);
 	assert.match(core, /Long-session rule/);
-	assert.match(core, /Review actor rule/);
 });
 
-test("core-alone: receipt-only lifecycle and independent safety are present without lazy union", () => {
+test("core-alone: dynamic Gentle AI ownership replaces package lifecycle instructions", () => {
 	const core = readRealAsset("orchestrator.md");
-	assert.match(core, /start -> finalize -> validate/i);
-	assert.match(core, /Compact gates use zero actors/i);
-	assert.match(core, /Release from protected `main` may bypass receipt validation only when/i);
-	assert.match(core, /Major and post-incident releases require explicit extraordinary review/i);
-	assert.match(core, /Dangerous-command safety remains independent and authoritative/i);
-	assert.match(core, /SDD completion adds no review or Judgment Day pass/i);
+	assert.match(core, /injects the mirrored provider-bundle review execution contract into this session's system prompt at start/);
+	assert.match(core, /Absent that mirrored contract, this package invents no lifecycle instructions/);
+	assert.doesNotMatch(core, /start -> finalize -> validate/i);
+	assert.doesNotMatch(core, /receipt validation/i);
 });
 
-test("lazy bounded-review contract lists all four review lens names", () => {
-	const content = `${readRealAsset("orchestrator.md")}\n${readRealAsset("orchestrator-delegation.md")}`;
-	assert.match(content, /review-risk/);
-	assert.match(content, /review-reliability/);
-	assert.match(content, /review-resilience/);
-	assert.match(content, /review-readability/);
+test("lazy delegation detail has no native RDD controller markers", () => {
+	const delegation = readRealAsset("orchestrator-delegation.md");
+	for (const marker of ["next_transition", "review.capture-result", "reconcile-terminal-mirrors"]) {
+		assert.ok(!delegation.includes(marker), `stale RDD marker retained: ${marker}`);
+	}
 });
 
 test("live orchestrator assets remove the stale strong-gate retry contract", () => {
@@ -345,20 +398,11 @@ test("relocated lazy bodies are not double-delivered in the always-on core", ()
 	);
 });
 
-test("relocated lazy files are reachable via in-core pointer paths", () => {
+test("relocated lazy files are reachable via root-relative in-core filenames", () => {
 	const rendered = __testing.getOrchestratorPrompt();
-	assert.ok(
-		rendered.includes(join(REAL_ASSETS_DIR, "orchestrator-delegation.md")),
-		"core is missing a reachable pointer to orchestrator-delegation.md",
-	);
-	assert.ok(
-		rendered.includes(join(REAL_ASSETS_DIR, "orchestrator-memory.md")),
-		"core is missing a reachable pointer to orchestrator-memory.md",
-	);
-	assert.ok(
-		rendered.includes(join(REAL_ASSETS_DIR, "orchestrator-skills.md")),
-		"core is missing a reachable pointer to orchestrator-skills.md",
-	);
+	for (const name of LAZY_REFERENCE_FILE_NAMES) {
+		assert.ok(rendered.includes(`\`${name}\``), `core is missing a reachable pointer to ${name}`);
+	}
 });
 
 // ---------------------------------------------------------------------------