gentle-pi 2.4.0 → 2.5.0

package/runtime/review-risk-assessment.mjs

@@ -0,0 +1,340 @@
+// Generated by scripts/build-runtime-modules.mjs. Do not edit.
+// gentle-pi#662: pure decoding, tier mapping, and verification-plan logic for
+// the native read-only `gentle-ai review assess` command (gentle-ai#4295).
+// Kept independent of the native review CLI wrapper (`lib/native-review-cli.ts`)
+// so the decoder and the verificationPlan table can be unit-tested without a
+// child process, and so the parent tool and the delegation asset agree on one
+// deterministic mapping.
+//
+// Native reference (gentle-ai#4295, landing in parallel with this change):
+// `gentle-ai review assess --cwd <repo> [--base-ref <ref> --committed-only] --json`
+// prints `{"schema":"gentle-ai.review-assessment/v1","risk":"passive|medium|high",
+// "reasons":[{"code":"…","path":"…","detail":"…"}],"changed_paths":1,
+// "changed_lines":1,"candidate":{"kind":"current-changes|base-diff","base_ref":"…"}}`.
+// A non-zero exit or a failure envelope means the candidate could not be
+// assessed; hosts treat that as `high`. Older binaries without the verb (or
+// any other decode/process failure) fail closed the same way -- see
+// `verificationTierForUnassessable` below.
+
+export const REVIEW_ASSESSMENT_SCHEMA = "gentle-ai.review-assessment/v1"         ;
+
+export const REVIEW_ASSESSMENT_RISK = {
+	PASSIVE: "passive",
+	MEDIUM: "medium",
+	HIGH: "high",
+}         ;
+
+
+export const REVIEW_ASSESSMENT_CANDIDATE_KIND = {
+	CURRENT_CHANGES: "current-changes",
+	BASE_DIFF: "base-diff",
+}         ;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+function isRecord(value         )                                   {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function decodeReason(value         )                         {
+	if (!isRecord(value)) throw new TypeError("review assessment reason must be an object");
+	const { code, path, detail } = value;
+	if (typeof code !== "string" || code.length === 0) throw new TypeError("review assessment reason.code must be a non-empty string");
+	if (typeof path !== "string") throw new TypeError("review assessment reason.path must be a string");
+	if (typeof detail !== "string") throw new TypeError("review assessment reason.detail must be a string");
+	return Object.freeze({ code, path, detail });
+}
+
+function decodeCandidate(value         )                            {
+	if (!isRecord(value)) throw new TypeError("review assessment candidate must be an object");
+	const { kind, base_ref: baseRef } = value;
+	if (kind !== REVIEW_ASSESSMENT_CANDIDATE_KIND.CURRENT_CHANGES && kind !== REVIEW_ASSESSMENT_CANDIDATE_KIND.BASE_DIFF) {
+		throw new TypeError("review assessment candidate.kind must be current-changes or base-diff");
+	}
+	if (baseRef !== undefined && (typeof baseRef !== "string" || baseRef.length === 0)) {
+		throw new TypeError("review assessment candidate.base_ref must be a non-empty string when present");
+	}
+	return Object.freeze({ kind, baseRef: baseRef                       });
+}
+
+/**
+ * Decodes and validates one `gentle-ai.review-assessment/v1` envelope. Rejects
+ * any other schema, an unrecognized risk value, or a malformed shape -- the
+ * native review CLI wrapper turns a thrown error here into the same
+ * schema-incompatible failure it already produces for every other decoded
+ * native response.
+ */
+export function decodeReviewAssessmentV1(value         )                     {
+	if (!isRecord(value)) throw new TypeError("review assessment must be an object");
+	if (value.schema !== REVIEW_ASSESSMENT_SCHEMA) throw new TypeError(`review assessment schema must be ${REVIEW_ASSESSMENT_SCHEMA}`);
+	const { risk, reasons, changed_paths: changedPaths, changed_lines: changedLines, candidate } = value;
+	if (risk !== REVIEW_ASSESSMENT_RISK.PASSIVE && risk !== REVIEW_ASSESSMENT_RISK.MEDIUM && risk !== REVIEW_ASSESSMENT_RISK.HIGH) {
+		throw new TypeError("review assessment risk must be passive, medium, or high");
+	}
+	if (!Array.isArray(reasons)) throw new TypeError("review assessment reasons must be an array");
+	if (!Number.isSafeInteger(changedPaths) || (changedPaths          ) < 0) throw new TypeError("review assessment changed_paths must be a non-negative integer");
+	if (!Number.isSafeInteger(changedLines) || (changedLines          ) < 0) throw new TypeError("review assessment changed_lines must be a non-negative integer");
+	return Object.freeze({
+		schema: REVIEW_ASSESSMENT_SCHEMA,
+		risk,
+		reasons: Object.freeze(reasons.map(decodeReason)),
+		changedPaths: changedPaths          ,
+		changedLines: changedLines          ,
+		candidate: decodeCandidate(candidate),
+	});
+}
+
+// ---------------------------------------------------------------------------
+// Verification-plan tiering (gentle-pi#662).
+// ---------------------------------------------------------------------------
+
+export const VERIFICATION_TIER = {
+	PASSIVE: "passive",
+	MEDIUM: "medium",
+	HIGH: "high",
+	UNASSESSABLE: "unassessable",
+}         ;
+
+
+export const RDD_LINE = {
+	ON: "on",
+	OFF: "off",
+	UNKNOWN: "unknown",
+}         ;
+
+
+export const WRITER_PROFILE = {
+	SMALL: "small",
+	LARGE: "large",
+}         ;
+
+
+// gentle-pi#668: whether the native review actually reached a terminal
+// outcome for the current candidate. The `on` branch of `verificationPlan`
+// (the writer self-verifies, the native review is the independent check, no
+// separate verifier) holds only for `CLOSED` -- a human decline for this
+// candidate, a clone-local RDD disable, a refused START/STATUS, or any other
+// non-terminal outcome falls back to the exact same risk-gated path as `off`.
+// `UNKNOWN` is the fail-closed default for an omitted outcome: never treated
+// as `CLOSED`.
+export const NATIVE_REVIEW_OUTCOME = {
+	CLOSED: "closed",
+	DECLINED: "declined",
+	UNAVAILABLE: "unavailable",
+	UNKNOWN: "unknown",
+}         ;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+/**
+ * Builds the risk-gated verification plan shared by the `off`/`unknown` RDD
+ * lines and by an `on` line whose native review did not close for this
+ * candidate (gentle-pi#668). `gatePrefix` supplies the sentence fragment
+ * naming which branch fired, up to and including the word "and"; the
+ * tier-specific clause is appended after it.
+ */
+function riskGatedPlan(gatePrefix        , risk                  , writerProfile               )                   {
+	if (risk === VERIFICATION_TIER.PASSIVE) {
+		return Object.freeze({
+			writerSelfVerification: false,
+			structuralReadbackOnly: true,
+			independentVerifier: false,
+			reason: `${gatePrefix} the native assessment reports passive risk: a structural readback by the parent is the complete check, with no separate verifier and no tests.`,
+		});
+	}
+
+	if (risk === VERIFICATION_TIER.MEDIUM) {
+		const smallModelBias = writerProfile === WRITER_PROFILE.SMALL;
+		return Object.freeze({
+			writerSelfVerification: true,
+			structuralReadbackOnly: false,
+			independentVerifier: smallModelBias,
+			reason: smallModelBias
+				? `${gatePrefix} the native assessment reports medium risk, but the small-model bias raises it one tier to high for verification purposes: the writer self-verifies and a separate independent verifier also runs.`
+				: `${gatePrefix} the native assessment reports medium risk with a large writer profile: the writer's self-verification stands and no separate verifier is required.`,
+		});
+	}
+
+	// high or unassessable.
+	return Object.freeze({
+		writerSelfVerification: true,
+		structuralReadbackOnly: false,
+		independentVerifier: true,
+		reason: risk === VERIFICATION_TIER.UNASSESSABLE
+			? `${gatePrefix} the native risk assessment could not be produced, so the candidate is treated as high risk: the writer self-verifies and a separate independent verifier always runs.`
+			: `${gatePrefix} the native assessment reports high risk: the writer self-verifies and a separate independent verifier always runs.`,
+	});
+}
+
+// Names why an `on` line falls back to the risk-gated path, for every
+// non-closed native review outcome (gentle-pi#668). `UNKNOWN` covers both an
+// omitted outcome and a caller-supplied one this decoder does not
+// recognize -- both fail closed the same way.
+function nonClosedOutcomeClause(outcome                     )         {
+	switch (outcome) {
+		case NATIVE_REVIEW_OUTCOME.DECLINED:
+			return "the native review was declined for this candidate";
+		case NATIVE_REVIEW_OUTCOME.UNAVAILABLE:
+			return "the native review is unavailable for this candidate";
+		default:
+			return "the native review outcome for this candidate is unknown";
+	}
+}
+
+/**
+ * Computes who verifies a delegated writer's change, exactly as
+ * gentle-pi#662/#668 specify:
+ *
+ * - `rdd: "on"` AND the native review reached `NATIVE_REVIEW_OUTCOME.CLOSED`
+ *   for this candidate: the writer self-verifies and no independent verifier
+ *   runs, because the closed native review is the check -- except `passive`,
+ *   which gets a structural readback by the parent instead.
+ * - `rdd: "on"` with any other outcome (`declined`, `unavailable`, or the
+ *   fail-closed `unknown` default for an omitted/unrecognized outcome): the
+ *   `on` branch never held for this candidate, so the risk-gated path below
+ *   applies exactly as `off` -- declining a review is candidate-scoped and
+ *   never lowers the bar below the RDD-off path.
+ * - `rdd: "off"` or `"unknown"` (both gate identically, so an unknown RDD line
+ *   never lowers a tier relative to `off`; `nativeReviewOutcome` is ignored
+ *   entirely on these lines):
+ *   - `passive`: structural readback by the parent only; no verifier, no
+ *     tests.
+ *   - `medium`: the writer self-verifies; a separate independent verifier
+ *     runs only when `writerProfile` is `"small"` -- the small-model bias
+ *     raises the tier by one for verification purposes (medium -> high). An
+ *     unknown or omitted writer profile resolves to `"small"` before it
+ *     reaches this function (see `resolveWriterProfile`), so an unrecognized
+ *     profile never lowers a tier below what a known small model would get.
+ *   - `high` or `unassessable` (a failed or unrecognized native assessment is
+ *     always treated as high): the writer self-verifies and an independent
+ *     verifier always runs.
+ */
+export function verificationPlan(input                       )                   {
+	const { rddLine, risk, writerProfile } = input;
+
+	if (rddLine === RDD_LINE.ON) {
+		const outcome = input.nativeReviewOutcome ?? NATIVE_REVIEW_OUTCOME.UNKNOWN;
+		if (outcome === NATIVE_REVIEW_OUTCOME.CLOSED) {
+			if (risk === VERIFICATION_TIER.PASSIVE) {
+				return Object.freeze({
+					writerSelfVerification: false,
+					structuralReadbackOnly: true,
+					independentVerifier: false,
+					reason: "receipt-driven development is on and the native review closed for this candidate; the assessment also reports passive risk: a structural readback by the parent replaces both the writer's self-verification and any separate verifier.",
+				});
+			}
+			return Object.freeze({
+				writerSelfVerification: true,
+				structuralReadbackOnly: false,
+				independentVerifier: false,
+				reason: "receipt-driven development is on and the native review closed for this candidate: the writer's self-verification is the record and the closed native review was the independent check the writer cannot influence, so no separate verifier is required.",
+			});
+		}
+		// The on branch holds only while the native review reaches a terminal
+		// outcome for this candidate. Anything else -- declined, unavailable, or
+		// unknown -- falls back to the exact same risk-gated path as off.
+		return riskGatedPlan(
+			`receipt-driven development is on, but ${nonClosedOutcomeClause(outcome)}, so the risk-gated path applies exactly as receipt-driven development off, and`,
+			risk,
+			writerProfile,
+		);
+	}
+
+	// rddLine is "off" or "unknown" here -- both gate on the native risk
+	// assessment identically, so an unknown RDD line never lowers a tier, and
+	// neither line ever consults nativeReviewOutcome.
+	return riskGatedPlan(`receipt-driven development is ${rddLine} and`, risk, writerProfile);
+}
+
+// ---------------------------------------------------------------------------
+// Small-writer-profile predicate (gentle-pi#662).
+// ---------------------------------------------------------------------------
+
+/**
+ * The minimal shape of `lib/agents-config.ts`'s `ResolvedProfile` this
+ * predicate needs: the resolved model reference and its resolved effort
+ * (`ResolvedProfile.thinking`, one of `ThinkingLevel`).
+ */
+
+
+
+
+
+// Matches `mini` only as a whole token of the model id -- delimited by the
+// string start/end or one of `-_./:` or whitespace -- never a bare substring.
+// `gpt-5.4-mini`, `o4-mini`, `openai/gpt-5.4-mini`, `claude-mini`, and
+// `mini-high` all match; `gemini`, `gemini-2.5-pro`, and `gemini-2.5-flash`
+// do not, because their `mini` is preceded by `ge`, not a delimiter.
+const SMALL_MODEL_ID_TOKEN = /(?:^|[-_./:\s])mini(?:$|[-_./:\s])/i;
+
+/**
+ * A writer profile counts as a "small model" for the medium-risk bias when:
+ * - its resolved effort is `low`, or
+ * - its resolved model id carries `mini` as a whole token (see
+ *   `SMALL_MODEL_ID_TOKEN`), or
+ * - it carries NO signal at all -- no profile object, or a profile with
+ *   neither a model id nor a resolved effort. An unknown or omitted writer
+ *   profile fails closed to small rather than defaulting to large, so a
+ *   caller that cannot resolve the writer's profile never gets a weaker
+ *   verification plan than a known small model would (gentle-pi#662).
+ *
+ * A profile that carries a model id or an effort, just not a matching one
+ * (for example `{model: {id: "claude-sonnet-5"}, thinking: "high"}`), is
+ * "known large" and returns `false` -- fail-closed applies only to a truly
+ * unknown/omitted profile, not to an explicitly resolved large one.
+ */
+export function isSmallWriterProfile(profile                                    )          {
+	if (profile === undefined) return true;
+	if (profile.thinking === "low") return true;
+	const modelId = profile.model?.id;
+	if (typeof modelId === "string") return SMALL_MODEL_ID_TOKEN.test(modelId);
+	// No model id was resolved. Fail closed to small only when effort is also
+	// unknown -- there is no signal at all to call this a known large model.
+	return profile.thinking === undefined;
+}
+
+/**
+ * Maps a resolved writer profile to the `writerProfile` input `verificationPlan`
+ * expects. An unknown or omitted profile never lowers a tier: it resolves to
+ * `"small"`, exactly like `isSmallWriterProfile` (gentle-pi#662).
+ */
+export function resolveWriterProfile(profile                                    )                {
+	return isSmallWriterProfile(profile) ? WRITER_PROFILE.SMALL : WRITER_PROFILE.LARGE;
+}

package/runtime/telemetry-trigger.mjs

@@ -0,0 +1,152 @@
+// Generated by scripts/build-runtime-modules.mjs. Do not edit.
+import { spawn as nodeSpawn } from "node:child_process";
+
+// gentle-ai#4309 owns anonymous usage telemetry end to end: install and
+// heartbeat events, the notice, every kill switch, and the wire contract.
+// gentle-pi#677 only nudges the local binary once per process, best-effort,
+// and never surfaces the outcome to the user. This module is the pure,
+// testable core of that nudge (`shouldTriggerTelemetry`,
+// `spawnTelemetryTrigger`) plus the decode helper the foreground
+// `/gentle:telemetry` slash command uses to relay `<op> --json` output
+// (`decodeTelemetryTriggerDecision`).
+
+export const TELEMETRY_TRIGGER_KILL_TIMEOUT_MS = 3_000;
+
+export const TELEMETRY_TRIGGER_CONTRACT = "gentle-ai.telemetry-trigger/v1";
+
+export const TELEMETRY_TRIGGER_DECISIONS = [
+	"enrolled",
+	"sent_install",
+	"sent_heartbeat",
+	"rate_limited",
+	"backoff",
+	"disabled",
+]         ;
+
+
+
+
+
+
+
+
+/**
+ * Decodes `gentle-ai telemetry trigger --json` stdout. An older binary
+ * without the verb prints `unknown telemetry command` and exits non-zero, so
+ * its stdout never parses as JSON here; that -- along with malformed JSON, a
+ * mismatched schema, an unrecognized decision, or a missing/non-string
+ * source -- means "nothing to do" and returns undefined rather than
+ * throwing.
+ */
+export function decodeTelemetryTriggerDecision(stdout        )                                         {
+	let parsed         ;
+	try {
+		parsed = JSON.parse(stdout);
+	} catch {
+		return undefined;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return undefined;
+	const record = parsed                           ;
+	if (record.schema !== TELEMETRY_TRIGGER_CONTRACT) return undefined;
+	if (typeof record.decision !== "string") return undefined;
+	if (!(TELEMETRY_TRIGGER_DECISIONS                     ).includes(record.decision)) return undefined;
+	if (typeof record.source !== "string" || record.source.length === 0) return undefined;
+	return {
+		schema: TELEMETRY_TRIGGER_CONTRACT,
+		decision: record.decision                            ,
+		source: record.source,
+	};
+}
+
+
+
+function telemetryKillSwitchReason(env                                              )                                        {
+	if (env.DO_NOT_TRACK === "1") return "do-not-track";
+	if (env.GENTLE_AI_TELEMETRY === "0") return "telemetry-disabled";
+	if (env.CI === "true") return "ci";
+	return undefined;
+}
+
+/**
+ * True unless one of Gentle Pi's own kill switches is set
+ * (`DO_NOT_TRACK=1`, `GENTLE_AI_TELEMETRY=0`, or `CI=true`). The binary
+ * enforces its own opt-out and rate limiting independently; this predicate
+ * only decides whether Gentle Pi spawns the trigger at all.
+ */
+export function shouldTriggerTelemetry(env                                              )          {
+	return telemetryKillSwitchReason(env) === undefined;
+}
+
+// A minimal structural subset of node:child_process's ChildProcess, mirroring
+// the ChildLike/Spawn seam already used by lib/agents-runner.ts: narrow
+// enough that tests can stub it without touching a real process.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+/**
+ * Nudges `<executable> telemetry trigger --json`, detached and
+ * fire-and-forget. Never throws, never awaits the child's exit, and never
+ * blocks session start: a missing binary, an old binary without the verb, or
+ * a spawn failure all just report `{ spawned: false, ... }`. A 3 s timer
+ * kills a runaway child; the timer is unref'd so it can never keep the host
+ * process alive on its own, matching the detached child's own `unref()`.
+ */
+export function spawnTelemetryTrigger(options                              )                         {
+	const killSwitch = telemetryKillSwitchReason(options.env);
+	if (killSwitch !== undefined) return { spawned: false, reason: killSwitch };
+	const spawnImpl = options.spawn ?? (nodeSpawn                                    );
+	try {
+		const child = spawnImpl(options.executable, ["telemetry", "trigger", "--json"], {
+			cwd: options.cwd,
+			env: options.env,
+			detached: true,
+			stdio: "ignore",
+		});
+		child.on("error", () => {
+			// Fire-and-forget: a spawn-time or runtime child error never surfaces
+			// to the caller and never affects session start.
+		});
+		const killTimer = setTimeout(() => {
+			try {
+				child.kill();
+			} catch {
+				// Best effort only; the child may already have exited.
+			}
+		}, TELEMETRY_TRIGGER_KILL_TIMEOUT_MS);
+		killTimer.unref?.();
+		child.unref();
+		return { spawned: true, reason: "spawned" };
+	} catch {
+		return { spawned: false, reason: "spawn-error" };
+	}
+}

package/scripts/build-runtime-modules.mjs

@@ -10,7 +10,9 @@ const sources = [
 	"gentle-ai-binary",
 	"review-relay-contract",
 	"review-integration-v2",
+	"review-risk-assessment",
 	"native-review-cli",
+	"telemetry-trigger",
 ];
 const header = "// Generated by scripts/build-runtime-modules.mjs. Do not edit.\n";
 

package/scripts/gentle-ai-installer.mjs

@@ -36,7 +36,7 @@ const WINDOWS_SYSTEM_ROOT = "C:\\Windows";
 // version check below) derives from this constant instead of repeating the
 // literal, so a pin bump cannot leave a stale copy behind. See
 // scripts/install-gentle-ai.mjs for the incident that motivated this.
-export const INSTALLER_VERSION = "2.6.0";
+export const INSTALLER_VERSION = "2.7.0";
 export const RELEASE_BASE_URL = `https://github.com/Gentleman-Programming/gentle-ai/releases/download/v${INSTALLER_VERSION}/`;
 export const GENTLE_AI_INSTALL_METHOD = Object.freeze({
 	SIGNED_RELEASE_ASSET: "signed-release-asset",
@@ -45,10 +45,10 @@ export const GENTLE_AI_INSTALL_METHOD = Object.freeze({
 export const GENTLE_AI_WINDOWS_SOURCE_PACKAGE_PATH = "github.com/gentleman-programming/gentle-ai/v2/cmd/gentle-ai";
 export const GENTLE_AI_WINDOWS_SOURCE_MODULE = "github.com/gentleman-programming/gentle-ai/v2";
 export const GENTLE_AI_WINDOWS_SOURCE_TAG = `v${INSTALLER_VERSION}`;
-// `go mod download -json github.com/gentleman-programming/gentle-ai/v2@v2.6.0`
+// `go mod download -json github.com/gentleman-programming/gentle-ai/v2@v2.7.0`
 // with GOSUMDB=sum.golang.org reports this exact module SumDB checksum, and the
-// tag resolves to commit c24a724a, the published v2.6.0 release head.
-export const GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:scGoZYnPHh4oCVqlcfQAOSpm22Ii5lmB0kBbiBKvNZk=";
+// tag resolves to commit 4e4470b3, the published v2.7.0 release head.
+export const GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:SE4KCLo3y1qWaTq+7HJKZ1DkAAAl+w+82YY0+qQkFwM=";
 export const GENTLE_AI_WINDOWS_SOURCE_PACKAGE = `${GENTLE_AI_WINDOWS_SOURCE_PACKAGE_PATH}@${GENTLE_AI_WINDOWS_SOURCE_TAG}`;
 export const GENTLE_AI_WINDOWS_MINIMUM_GO_VERSION = "1.25.10";
 export const GENTLE_AI_GO_TOOLCHAIN_UNAVAILABLE_CODE = "GENTLE_AI_GO_TOOLCHAIN_UNAVAILABLE";
@@ -67,7 +67,7 @@ export class GentleAiInstallerError extends Error {
 // Sentinel used while a re-pinned gentle-ai release is not yet published. A
 // sentinel digest can never match a real SHA-256, so installation fails closed,
 // and verify-package-files.mjs refuses to pack/publish while any digest below
-// still holds it. The v2.6.0 digests are pinned from the published release:
+// still holds it. The v2.7.0 digests are pinned from the published release:
 // archive sha256 values verified against the minisign-signed checksums.txt and
 // freshly computed hashes; binary sha256 values computed from the extracted
 // executables.
@@ -109,15 +109,15 @@ async function downloadPinnedGentleAiAsset(asset, destination, options) {
 }
 
 // Windows is absent from signed release archives on purpose. gentle-ai stopped
-// distributing unsigned Windows builds in c4b764d0, so v2.6.0 publishes signed
+// distributing unsigned Windows builds in c4b764d0, so v2.7.0 publishes signed
 // Darwin/Linux archives only. Windows x64/arm64 uses the separately verified
 // exact-tag Go SumDB source-build path below; restore archive rows only when
 // upstream ships signed Windows assets.
 export const GENTLE_AI_RELEASE_ASSETS = Object.freeze({
-	"darwin/amd64": asset("gentle-ai_2.6.0_darwin_amd64.tar.gz", "e09389a4fa2de6a1999cf44bb7850d1f8bc166f330010b64c20aaab32bc68cb7", "a142e166a7638b1d9920ec01be2417a0257c52074395ed829bf5b989199b3f03", "gentle-ai"),
-	"darwin/arm64": asset("gentle-ai_2.6.0_darwin_arm64.tar.gz", "9999842e0ccb769101d51454b714f599535c551cde73411a1f72936ff635c13e", "ddc9ffb6aa64268f8de8ffe80056b58b97e3cf480dea849c38d97d7c2b2618f4", "gentle-ai"),
-	"linux/amd64": asset("gentle-ai_2.6.0_linux_amd64.tar.gz", "1dbf4e4ebc2b0d0e0f3f003a77ca2cf0fedc7b4d3e5f85939abeb877694630f0", "37e4ef32e869fa181b77346be160dfef35ff6fa40f26723d6dcd705ffb6d385d", "gentle-ai"),
-	"linux/arm64": asset("gentle-ai_2.6.0_linux_arm64.tar.gz", "9fc43679476486fb234c302c91f8e15fd7d878e43de1104c2ebdddd68baaa95b", "7ff61e615fe861fd1175bb9750b4c15c23dcdfeaa4a7ed0a96d5ec2bdf39e72f", "gentle-ai"),
+	"darwin/amd64": asset("gentle-ai_2.7.0_darwin_amd64.tar.gz", "5edf1e38894d6b2c1d257583cf4da23e2471812ed2efd0de33cbeef608339609", "e7aa77701e3cfd8a382a756ff2f257ba1a94ab4699050b3c3ac8e6237eb53950", "gentle-ai"),
+	"darwin/arm64": asset("gentle-ai_2.7.0_darwin_arm64.tar.gz", "a9efa8cf182d853b7d0115efbc73a83465d435ec429f6465bea9181ea8022fde", "497932a73664a958cf46b0b131277da4a41a48f8d7da4f777d1157f8ffa9f646", "gentle-ai"),
+	"linux/amd64": asset("gentle-ai_2.7.0_linux_amd64.tar.gz", "ff765a183247fe31d4739ff6df3d6874740979987ea310de3856c8a6e85375e9", "8748b9f18c05a831692abc0ae560fdc50a4e4c8f492705edcce7f65e067a7b12", "gentle-ai"),
+	"linux/arm64": asset("gentle-ai_2.7.0_linux_arm64.tar.gz", "d8e114cd4d226f6c974813a49fce4d3e2028f4880b87e08f270eadf0a0607561", "65dd6bd7249d5eb7a2c948eebd0aee1bf2e85e1a2123e9b3782e978b167c3875", "gentle-ai"),
 });
 
 // A pinned asset is either a signed archive or, for a prerelease pin only,

package/scripts/test-packed-runner.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync, mkdtempSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
@@ -50,6 +51,27 @@ try {
 		stdio: "inherit",
 	});
 	const packageRoot = join(installDirectory, "node_modules", "gentle-pi");
+	const { nativeReviewAbandonAuthorization } = await import(pathToFileURL(join(packageRoot, "runtime", "native-review-cli.mjs")).href);
+	const abandonAuthorization = nativeReviewAbandonAuthorization({
+		lineage: "review-abc",
+		expectedRevision: "revision-9",
+		snapshotIdentity: "snapshot-1",
+		capturedLensResults: ["00-risk.json", "01-refuter.json"],
+		findingsPresent: true,
+		actor: "maintainer",
+		reason: "operator_disposition",
+	});
+	assert.equal(abandonAuthorization, [
+		"gentle-ai.review-abandon-authorization/v2",
+		"lineage=review-abc",
+		"revision=revision-9",
+		"snapshot_identity=snapshot-1",
+		"reason=operator_disposition",
+		"captured_lens_results=00-risk.json,01-refuter.json",
+		"findings_present=true",
+		"actor=maintainer",
+	].join("\n"));
+	assert.ok(!abandonAuthorization.includes("evidence_records_present"));
 	// Accept prerelease pins too: a stable-only pattern here was a second,
 	// silent pin that refused the first prerelease version directory.
 	const versions = readdirSync(join(packageRoot, ".gentle-ai"), { withFileTypes: true }).filter((entry) => entry.isDirectory() && /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z][0-9A-Za-z.]*)?$/.test(entry.name));

package/scripts/verify-package-files.mjs

@@ -46,6 +46,7 @@ const requiredPaths = [
   "assets/support/sdd-status-contract.md",
   "assets/support/strict-tdd.md",
   "assets/support/strict-tdd-verify.md",
+  "docs/delegated-verification.md",
   "docs/native-authority-architecture.md",
   "docs/skill-style-guide.md",
   "docs/review-integration.md",
@@ -59,10 +60,13 @@ const requiredPaths = [
   "lib/review-integration-v2.ts",
   "lib/review-relay-contract.ts",
   "lib/sdd-preflight.ts",
+  "lib/telemetry-trigger.ts",
 	"runtime/gentle-ai-binary.mjs",
 	"runtime/native-review-cli.mjs",
 	"runtime/review-integration-v2.mjs",
+	"runtime/review-risk-assessment.mjs",
 	"runtime/review-relay-contract.mjs",
+	"runtime/telemetry-trigger.mjs",
   "scripts/check-provider-contract.mjs",
   "scripts/gentle-ai-installer.mjs",
   "scripts/install-gentle-ai.mjs",
@@ -334,7 +338,7 @@ async function main() {
   });
 
   if (driftedContracts.length > 0) {
-    console.error("gentle-pi packaged review-integration/v1 and review-integration/v2 contract bytes drifted from the pinned v2.6.0 runtime's vendored Gentle AI contract artifacts:");
+    console.error("gentle-pi packaged review-integration/v1 and review-integration/v2 contract bytes drifted from the pinned v2.7.0 runtime's vendored Gentle AI contract artifacts:");
     for (const drift of driftedContracts) console.error(`- ${drift.relativePath}: expected ${drift.expected}, got ${drift.actual}`);
     process.exit(1);
   }
@@ -379,7 +383,7 @@ async function main() {
     process.exit(1);
   }
 
-  console.log(`gentle-pi package resource check passed (${requiredPaths.length} files; ${Object.keys(contractHashes).length} exact byte-pinned contract artifacts for the v2.6.0 runtime).`);
+  console.log(`gentle-pi package resource check passed (${requiredPaths.length} files; ${Object.keys(contractHashes).length} exact byte-pinned contract artifacts for the v2.7.0 runtime).`);
 }
 
 const isMainModule = process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;

package/skills/_shared/review-ledger-contract.md

@@ -20,7 +20,9 @@ Risk routing is deterministic:
 
 Generated files matching `testdata/golden/**` remain in snapshot identity but do not count as authored risk lines. Ordinary tests, fixtures, and snapshots are never broadly excluded. The correction budget is frozen as `min(200, ceil(original_changed_lines / 2))`.
 
-Before status/START, consult effective review mode. `off` creates no authority or authorization and yields organic `disabled/unmanaged`, never approval. Ordinary START declares `--consent relay`; low risk stays silent. A medium/high `consent/v2` result always returns the complete raw provider envelope plus an opaque in-memory candidate binding to the parent, then stops without UI or provider follow-up. The parent localizes and presents it losslessly while preserving tokens, commands, target IDs, and invocations. One explicit `answer-consent` call accepts only that binding and `granted|declined`, consumes it before provider mutation, and rechecks repository/target/projection/lineage/answer binding. Ambiguity reconciles through STATUS, never replay. Grant is exact-candidate-only. Decline creates no lineage, authority, actor/candidate binding, latch, or pending authorization; the next candidate asks again. Old Pi clone latch files are inert.
+Before status/START, consult effective review mode. `off` creates no authority or authorization and yields organic `disabled/unmanaged`, never approval. Ordinary START declares `--consent relay`; low risk stays silent. A medium/high `consent/v3` result carries the complete raw two-choice provider envelope plus an opaque in-memory candidate binding. In an eligible interactive parent Pi session, the host displays both provider labels and effects unchanged plus one clearly separate host-owned action: **Run this review and allow reviews for this Pi session**. The first two actions stay candidate-only. Direct human selection of the third action executes that fresh envelope's exact existing `granted` invocation through `answer-consent`, then grants only future fresh validated envelopes for the same live SessionManager object, exact nonempty session ID, and canonical Git worktree root. Every envelope is consumed once before provider mutation and rechecks repository, target, projection, lineage, answer binding, and live session identity; ambiguity reconciles through STATUS and never replays.
+
+The host grant lives only in a schema-checked `globalThis[Symbol.for(...)]` WeakMap registry. Reload preserves the SessionManager and reconnects the grant; quit, new, resume, fork, explicit revoke, or process restart removes it. `/tree` retains it. Child-agent processes, headless/RPC/unsupported UI, explicit cross-repository `workspaceRoot`, model prose, and tool arguments cannot offer, create, or consume it. It grants no provider mode, verdict, cost forecast, acknowledgement, maintenance, delivery, or cross-repository authority. If host UI is cancelled, fails, or cannot prove current Git/session identity, the original unresolved provider envelope is returned unchanged. If that envelope reaches the parent, localize and present its original two choices losslessly; never append the host action to the decoded provider contract. Decline creates no lineage, authority, standing grant, latch, or pending authorization; the next candidate asks again. Old Pi clone latch files are inert, and Pi writes no asked latch.
 
 Reviewer, refuter, and validator verdicts are admitted natively, never Pi-authored. `finalize` follows the provider's negotiated `next_transition` and supplies only the negotiated collection answers: a lens `review.capture-result` collect input rendered with `--agent=pi --materialize=true` is satisfied by the gentle-pi host relay, which prints the exact Go-materialized opaque prompt, launches a fresh locked-down print-mode `pi` subprocess in an empty scratch directory with every discovery surface disabled, and submits the untouched raw output bytes through the provider-owned submission form. The adversarial roles do not go through that relay: `review.capture-refuter` and `review.capture-validation` collect inputs render as self-contained authority-advancing vectors (binding tokens plus `--agent=pi --execute=true`, no submission descriptor); executing the exact rendered invocation makes Go materialize the role prompt, spawn its own locked-down `pi` process, and admit the raw verdict. Native Go owns validation, canonicalization, missing lens/finding ID assignment, persistence, and hashing, and performs only the legal transition from the current compact state. The five states are `reviewing`, `correction_required`, `validating`, `approved`, and `escalated`.