gentle-pi 2.4.0 → 2.6.0

package/tests/review-controller-workspace-root.test.ts

@@ -6,9 +6,9 @@ import { join } from "node:path";
 import test from "node:test";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { __testing, createGentleAiExtension } from "../extensions/gentle-ai.ts";
-import type { NativeReviewCli } from "../lib/native-review-cli.ts";
+import { NativeReviewIntegrationError, type NativeReviewCli } from "../lib/native-review-cli.ts";
 import { CandidateViewRegistry } from "../lib/review-candidate-view.ts";
-import type { AuthorityRepairAssessmentV1, ReviewStatusV3 } from "../lib/review-integration-v2.ts";
+import { decodeReviewFailureV2, type AuthorityRepairAssessmentV1, type ReviewStatusV3 } from "../lib/review-integration-v2.ts";
 
 interface RegisteredTool {
 	execute: (
@@ -240,6 +240,49 @@ test("INSPECT and STATUS operate on the explicit workspace root while the sessio
 	assert.deepEqual(observedCwds, [realpathSync(worktree), realpathSync(worktree), sessionCwd]);
 });
 
+// gentle-pi#599: inspect without an explicit workspaceRoot against a parent
+// repository that wraps an untracked nested Git repository fails at the
+// native preflight with a decoded, actionable `invalid_request` envelope. The
+// facade used to discard that envelope's cause, code, retry_safe, and
+// next_action in favor of a generic `native-status-unavailable` outcome
+// indistinguishable from authority corruption. It must preserve the native
+// envelope instead.
+test("inspect without workspaceRoot preserves the native invalid_request cause for a nested foreign Git repository", async (t) => {
+	const sessionCwd = repository(t);
+	const { controller } = runtime(fakeNative({
+		targetStatus: async () => {
+			throw new NativeReviewIntegrationError(decodeReviewFailureV2({
+				schema: "gentle-ai.review-integration.failure/v2",
+				contract: "gentle-ai.review-integration/v2",
+				operation: "review.status",
+				phase: "preflight",
+				code: "invalid_request",
+				message: "The negotiated review request is invalid.",
+				mutation_outcome: "not_started",
+				authority_applicability: "not_evaluated",
+				retry_safe: true,
+				replayability: "not_replayable",
+				required_inputs: [],
+				next_action: "correct_request",
+				cause: "untracked directory \"engram\" holds another Git repository that is not a linked worktree of this one, so it cannot enter the review candidate: add it to .gitignore, move it outside this repository, or register it as a linked worktree",
+			}));
+		},
+	}));
+	const result = await controller.execute("inspect-nested-foreign-repo", { operation: "inspect" }, undefined, undefined, context(sessionCwd));
+	const details = result.details as {
+		status?: string;
+		outcome?: string;
+		next_action?: string;
+		native_failure?: { code?: string; cause?: string; retry_safe?: boolean };
+	};
+	assert.equal(details.status, "blocked");
+	assert.equal(details.outcome, "native-status-unavailable");
+	assert.equal(details.native_failure?.code, "invalid_request");
+	assert.equal(details.native_failure?.retry_safe, true);
+	assert.match(details.native_failure?.cause ?? "", /engram/);
+	assert.equal(details.next_action, "correct_request");
+});
+
 test("START freezes the candidate from the explicit workspace root and returns the actor binding envelope", async (t) => {
 	const sessionCwd = repository(t);
 	writeFileSync(join(sessionCwd, "unrelated.ts"), "export const unrelated = true;\n");

package/tests/review-controller.test.ts

@@ -208,7 +208,7 @@ test("controller SDD status treats removed OpenSpec recovery authority and delet
 	const status = await __testing.resolveControllerSddStatus(fixture.repository, changeName, false, "openspec");
 
 	assert.equal(status.dependencies.archive, "blocked");
-	assert.equal(status.nextRecommended, "Active change not found: recover-legacy-review-authority.");
+	assert.equal(status.nextRecommended, "blocked");
 	assert.match(status.blockedReasons.join("\n"), /active change not found/i);
 });
 
@@ -363,6 +363,7 @@ test("general STATUS returns the typed native-status-unsupported boundary withou
 		mutation_performed: false,
 		inventory_complete: false,
 		next_action: "require-upstream-read-only-native-status-inventory",
+		remediation_command: "gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --agent pi --next-transition",
 		evidence: {
 			native_contract: "gentle-ai/2.1.4",
 			general_status: "unsupported",
@@ -371,6 +372,30 @@ test("general STATUS returns the typed native-status-unsupported boundary withou
 	});
 });
 
+test("gentle-pi#185: general STATUS on a non-negotiated native CLI names the exact status command to run", async (t) => {
+	// The legacy `correctionForecast` restoration guard this issue originally
+	// reported (extensions/gentle-ai.ts, then around line 5329) was scoped to
+	// `targetStatus !== undefined` and skipped restoring a candidate view when
+	// the native CLI lacked negotiated STATUS support, reproducing the #176
+	// empty-registry failure. That entire manual FINALIZE lifecycle (and the
+	// `correctionForecast` guard with it) has since been replaced by the
+	// STATUS/capture-driven flow: every operation now checks negotiated STATUS
+	// support up front, so no candidate-view restoration is ever attempted on
+	// a non-negotiated CLI. This test proves the current equivalent boundary
+	// (`nativeStatusUnsupported`) fails closed with an actionable envelope
+	// instead of a bare machine token, so a non-negotiated CLI can never
+	// surface as a silent empty-registry failure.
+	const fixture = createRepository(t);
+	const { controller } = registerRuntime();
+	const result = await controllerCall(controller, extensionContext(fixture.repository), { operation: "status" });
+	assert.equal(result.status, "blocked");
+	assert.equal(result.outcome, "native-status-unsupported");
+	assert.equal(
+		result.remediation_command,
+		"gentle-ai review status --cwd <repo> --contract gentle-ai.review-integration/v2 --agent pi --next-transition",
+	);
+});
+
 test("failed START gives exact mode and serialization guidance and creates no lineage", async (t) => {
 	const fixture = createRepository(t);
 	const { controller } = registerRuntime();

package/tests/review-host-relay-restart-parity.test.ts

@@ -72,6 +72,21 @@ function relayCollectInput(lineageId, lens, order) {
 			{ name: "agent", value: "pi", token: "--agent=pi" },
 			{ name: "materialize", value: "true", token: "--materialize=true" },
 		],
+		// gentle-pi#638: the artifact subject is what makes the slot declarable —
+		// its subject_hash is the --request-hash the capture-unachievable verb
+		// binds to. A slot without one cannot be declared, only retried.
+		artifactSubject: {
+			schema: "gentle-ai.review-artifact-subject/v2",
+			subjectHash: `sha256:${String(order).repeat(64)}`,
+			lineageId,
+			authorityRevision: SHA,
+			targetIdentity: SHA,
+			baseTree: TREE,
+			candidateTree: TREE,
+			changedPathManifestSha256: SHA,
+			lens,
+			selectedOrder: order,
+		},
 		submission: providerSubmission(lineageId, lens, order),
 	};
 }
@@ -146,6 +161,7 @@ const { ReviewHostRelayError, REVIEW_HOST_RELAY_FAILURE } = await import(${JSON.
 const statusQueue = JSON.parse(await readFile(statusFile, "utf8"));
 const relayRequests = [];
 const statusCalls = [];
+const unachievableCalls = [];
 let captureCalls = 0;
 
 __testing.setReviewHostRelayRunnerForTesting(async (request) => {
@@ -156,6 +172,9 @@ __testing.setReviewHostRelayRunnerForTesting(async (request) => {
 	if (mode === "capture-fail") {
 		throw new ReviewHostRelayError(REVIEW_HOST_RELAY_FAILURE.PI_FAILED, "pi", "pi subprocess failed", { exitCode: 4 });
 	}
+	if (mode === "capture-timeout") {
+		throw new ReviewHostRelayError(REVIEW_HOST_RELAY_FAILURE.PI_TIMED_OUT, "pi", "pi reviewer subprocess exceeded the relay bound", { exitCode: null, timedOut: true, elapsedMs: 2256004, timeoutMs: 2256000 });
+	}
 	if (mode === "capture-ambiguous") {
 		throw Object.assign(new Error("capture response lost"), { mutationOutcome: "unknown", nextAction: "review.status" });
 	}
@@ -172,6 +191,27 @@ const nativeReviewCli = {
 		if (next === undefined) throw new Error("status queue exhausted");
 		return next;
 	},
+	captureUnachievableLens: async (request) => {
+		unachievableCalls.push({
+			cwd: request.cwd,
+			lineageId: request.lineageId,
+			targetIdentity: request.targetIdentity,
+			expectedRevision: request.expectedRevision,
+			requestHash: request.requestHash,
+			reason: request.reason,
+			...(request.detail === undefined ? {} : { detail: request.detail }),
+			...(request.repositoryContext === undefined ? {} : { repositoryContext: request.repositoryContext }),
+		});
+		return {
+			schema: "gentle-ai.review-capture-unachievable/v1",
+			lineageId: request.lineageId,
+			targetIdentity: request.targetIdentity,
+			lens: ${JSON.stringify(LENS)},
+			selectedOrder: ${JSON.stringify(ORDER)},
+			reason: request.reason,
+			recorded: true,
+		};
+	},
 };
 
 let result;
@@ -199,7 +239,7 @@ try {
 	error = caught instanceof Error ? { name: caught.name, message: caught.message } : String(caught);
 }
 
-await writeFile(outFile, JSON.stringify({ result, inspectResult, captureBinding, error, relayRequests, statusCalls, captureCalls }, null, 2));
+await writeFile(outFile, JSON.stringify({ result, inspectResult, captureBinding, error, relayRequests, statusCalls, captureCalls, unachievableCalls }, null, 2));
 `;
 }
 
@@ -225,6 +265,107 @@ function inspectCollectBinding(inspectResult) {
 const PENDING = collectStatus(LINEAGE, [relayCollectInput(LINEAGE, LENS, ORDER)]);
 const CONVERGED = collectStatus(LINEAGE, []);
 
+// gentle-pi#638: the typed stop the provider renders once the slot is declared
+// unachievable — no collect inputs, one withdraw binding per declared slot.
+// Built in the same plain-object style as collectStatus: typed fields for the
+// controller, raw fields for the envelope passthrough.
+function unachievableStopStatus(lineageId, lens, order) {
+	const subjectHash = `sha256:${String(order).repeat(64)}`;
+	const repositoryContext = `rctx1_${"e".repeat(64)}`;
+	const withdrawArguments = [
+		{ name: "lineage", value: lineageId, token: `--lineage=${lineageId}` },
+		{ name: "expected-revision", value: SHA, token: `--expected-revision=${SHA}` },
+		{ name: "target", value: SHA, token: `--target=${SHA}` },
+		{ name: "repository-context", value: repositoryContext, token: `--repository-context=${repositoryContext}` },
+		{ name: "request-hash", value: subjectHash, token: `--request-hash=${subjectHash}` },
+		{ name: "withdraw", value: "true", token: "--withdraw=true" },
+	];
+	const withdrawCommand = `gentle-ai review capture-unachievable --lineage=${lineageId} --expected-revision=${SHA} --target=${SHA} --repository-context=${repositoryContext} --request-hash=${subjectHash} --withdraw=true`;
+	return {
+		...collectStatus(lineageId, []),
+		nextTransition: {
+			kind: "stop",
+			reasonCode: "unachievable_lens_slot",
+			unachievableLensSlots: [
+				{
+					lens,
+					selectedOrder: order,
+					subjectHash,
+					reason: "relay_transport_bound_exceeded",
+					withdraw: {
+						operation: "review.capture-unachievable",
+						command: withdrawCommand,
+						arguments: withdrawArguments,
+						binding: { targetIdentity: SHA, lineageId, revision: SHA },
+					},
+				},
+			],
+		},
+		raw: {
+			schema: "gentle-ai.review-integration.status/v5",
+			action: "stop",
+			lineage_id: lineageId,
+			target_identity: SHA,
+			next_transition: {
+				kind: "stop",
+				reason_code: "unachievable_lens_slot",
+				unachievable_lens_slots: [
+					{
+						lens,
+						selected_order: order,
+						subject_hash: subjectHash,
+						reason: "relay_transport_bound_exceeded",
+						withdraw: {
+							operation: "review.capture-unachievable",
+							command: withdrawCommand,
+							arguments: withdrawArguments,
+							binding: { lineage_id: lineageId, revision: SHA, target_identity: SHA, repository_context: repositoryContext },
+						},
+					},
+				],
+			},
+		},
+	};
+}
+const UNACHIEVABLE_STOP = unachievableStopStatus(LINEAGE, LENS, ORDER);
+
+// gentle-pi#638: the declared slot must not survive the restart as a reoffer.
+// Process A declares after the deterministic bound kill; fresh Process B sees
+// the provider's typed stop with the withdraw hint instead of the public
+// collectBinding it would have seen before the declaration.
+test("an unachievable declaration survives the controller restart as a typed stop, not a reoffer", async (t) => {
+	const cwd = repository(t);
+
+	// Process A: the deterministic relay bound kills the reviewer; the capture
+	// path declares the slot unachievable and renders the provider's stop. The
+	// worker always runs INSPECT first, so the queue carries the pending collect
+	// twice (inspect + capture selection) before the post-declaration stop.
+	const declared = runWorker(t, cwd, [PENDING, PENDING, UNACHIEVABLE_STOP], "capture-timeout");
+	assert.equal(declared.error, undefined, `declared run threw: ${JSON.stringify(declared.error)}`);
+	assert.equal(declared.captureCalls, 1, "Process A invokes one capture");
+	assert.equal(declared.relayRequests.length, 1, "Process A launches one relay transport");
+	assert.equal(declared.unachievableCalls.length, 1, "the declaration is recorded exactly once");
+	assert.deepEqual(declared.unachievableCalls, [{ cwd, lineageId: LINEAGE, targetIdentity: SHA, expectedRevision: SHA, requestHash: `sha256:${String(ORDER).repeat(64)}`, reason: "relay_transport_bound_exceeded", detail: "killed after 2256004ms against a 2256000ms relay bound", repositoryContext: `rctx1_${"e".repeat(64)}` }]);
+	assert.equal(declared.statusCalls.length, 3, "inspect and selection STATUS plus exactly one bound re-query");
+	assert.equal(declared.result.tool, "gentle_review_capture");
+	assert.equal(declared.result.status, "blocked");
+	assert.equal(declared.result.outcome, "unachievable-lens-slot-declared");
+	assert.equal(declared.result.mutation_performed, true);
+	assert.match(String(declared.result.next_action), /withdraw/);
+
+	// Process B (fresh): the provider's STATUS no longer reoffers the binding;
+	// INSPECT renders the typed stop whose hint is the withdraw command.
+	const inspect = runWorker(t, cwd, [UNACHIEVABLE_STOP], "inspect");
+	assert.equal(inspect.error, undefined, `inspect run threw: ${JSON.stringify(inspect.error)}`);
+	assert.equal(inspect.captureCalls, 0, "no capture runs without a reoffered binding");
+	assert.equal(inspect.relayRequests.length, 0, "INSPECT never launches the relay");
+	assert.equal(inspect.unachievableCalls.length, 0, "INSPECT never declares");
+	assert.equal(inspectCollectBinding(inspect.result), undefined, "the declared slot is not reoffered after restart");
+	assert.equal(inspect.result.status, "blocked");
+	assert.match(String(inspect.result.hint), /capture-unachievable/);
+	assert.match(String(inspect.result.hint), /--withdraw=true/);
+});
+
 test("a fresh controller process reoffers the exact public binding before one capture closes", async (t) => {
 	const cwd = repository(t);