gentle-pi 2.5.0 → 2.6.0

package/tests/native-review-cli.test.ts

@@ -7,12 +7,16 @@ import {
 	decodeReviewConsentV3,
 } from "../lib/review-integration-v2.ts";
 import {
+	decodeNativeSddStatusV2,
 	NATIVE_REVIEW_DEFAULT_MAX_BUFFER_BYTES,
 	NATIVE_REVIEW_ERROR_CODE,
 	NativeReviewCliError,
 	NativeReviewCliV216,
+	NativeReviewIntegrationError,
 	createNodeExecFileAdapter,
+	isNativeReviewUnachievableVerbRefused,
 	type ExecFileAdapter,
+	type NativeTargetStatusRequest,
 } from "../lib/native-review-cli.ts";
 
 const fixture = (name: string): Record<string, unknown> => JSON.parse(
@@ -56,6 +60,100 @@ function client(adapter: ExecFileAdapter): NativeReviewCliV216 {
 	return new NativeReviewCliV216(adapter, "/package/.gentle-ai/gentle-ai", 30_000, 1024 * 1024);
 }
 
+// Structural test data follows the 2026-09-11 native 2.7.1-0.20260911070137-350f31554a4b
+// capture: seven dependencies and four phaseInstructions groups, not a legacy alias.
+function nativeSddStatus(changeName = "complete-native-review-lifecycle", workspaceRoot = "/repo"): Record<string, unknown> {
+	return {
+		schemaName: "gentle-ai.sdd-status",
+		schemaVersion: 2,
+		changeName,
+		artifactStore: "openspec",
+		planningHome: { mode: "repo-local", path: `${workspaceRoot}/openspec` },
+		changeRoot: `${workspaceRoot}/openspec/changes/${changeName}`,
+		actionContext: { mode: "repo-local", workspaceRoot, allowedEditRoots: [workspaceRoot] },
+		dependencies: { proposal: "all_done", specs: "all_done", design: "all_done", tasks: "all_done", apply: "all_done", verify: "all_done", archive: "ready" },
+		phaseInstructions: {
+			apply: ["Apply is complete."],
+			verify: ["Verification is complete."],
+			remediate: ["Bind remediation to failed evidence."],
+			archive: ["Archive the selected change."],
+		},
+		blockedReasons: [],
+		nextRecommended: "archive",
+	};
+}
+
+test("native SDD status executes its exact selected-root argv and returns only a validated v2 authority", async () => {
+	const body = nativeSddStatus();
+	const queue = queuedAdapter([{ stdout: JSON.stringify(body) }]);
+	const status = await (client(queue.adapter) as unknown as {
+		sddStatus(request: { changeName: string; workspaceRoot: string }): Promise<Record<string, unknown>>;
+	}).sddStatus({ changeName: "complete-native-review-lifecycle", workspaceRoot: "/repo" });
+
+	assert.deepEqual(status, body);
+	assert.deepEqual(queue.calls, [{
+		file: "/package/.gentle-ai/gentle-ai",
+		arguments: ["sdd-status", "complete-native-review-lifecycle", "--cwd", "/repo", "--json", "--instructions"],
+		cwd: "/repo",
+		timeoutMs: 30_000,
+	}]);
+});
+
+test("native SDD status rejects malformed v2 identities, dependencies, instructions, and blockers", async () => {
+	const invalidInstructions = { apply: ["ok"], verify: ["ok"], remediate: ["ok"], archive: [42] };
+	assert.doesNotThrow(() => decodeNativeSddStatusV2(
+		{ ...nativeSddStatus(), phaseInstructions: { ...invalidInstructions, archive: ["ok"] } },
+		{ changeName: "complete-native-review-lifecycle", workspaceRoot: "/repo" },
+	));
+	const malformed = [
+		{ ...nativeSddStatus(), schemaName: "gentle-pi.sdd-status" },
+		{ ...nativeSddStatus(), schemaVersion: 1 },
+		{ ...nativeSddStatus(), changeName: "other-change" },
+		{ ...nativeSddStatus(), artifactStore: "future-store" },
+		{ ...nativeSddStatus(), planningHome: { mode: "future-mode", path: "/repo/openspec" } },
+		{ ...nativeSddStatus(), planningHome: { mode: "repo-local", path: "/outside" } },
+		{ ...nativeSddStatus(), changeRoot: "bad\nroot" },
+		{ ...nativeSddStatus(), actionContext: { mode: "repo-local", workspaceRoot: "/other", allowedEditRoots: ["/other"] } },
+		{ ...nativeSddStatus(), actionContext: { mode: "future-mode", workspaceRoot: "/repo", allowedEditRoots: ["/repo"] } },
+		{ ...nativeSddStatus(), actionContext: { mode: "repo-local", workspaceRoot: "/repo", allowedEditRoots: ["/outside"] } },
+		{ ...nativeSddStatus(), dependencies: { apply: "all_done", verify: "all_done", archive: "future" } },
+		{ ...nativeSddStatus(), phaseInstructions: invalidInstructions },
+		{ ...nativeSddStatus(), blockedReasons: "not-an-array" },
+		{ ...nativeSddStatus(), nextRecommended: "unknown" },
+		{ ...nativeSddStatus(), instructions: {}, phaseInstructions: undefined },
+		{ ...nativeSddStatus(), phaseInstructions: null },
+	];
+	for (const body of malformed) {
+		await assert.rejects(
+			() => (client(queuedAdapter([{ stdout: JSON.stringify(body) }]).adapter) as unknown as {
+				sddStatus(request: { changeName: string; workspaceRoot: string }): Promise<Record<string, unknown>>;
+			}).sddStatus({ changeName: "complete-native-review-lifecycle", workspaceRoot: "/repo" }),
+			(error: unknown) => error instanceof NativeReviewCliError && error.code === NATIVE_REVIEW_ERROR_CODE.SCHEMA_INCOMPATIBLE,
+		);
+	}
+});
+
+test("native v2 read-only decoding preserves omitted optional phaseInstructions", () => {
+	const body = nativeSddStatus();
+	delete body.phaseInstructions;
+	assert.equal(decodeNativeSddStatusV2(body, { changeName: "complete-native-review-lifecycle", workspaceRoot: "/repo" }), body);
+});
+
+test("native SDD status keeps malformed JSON, timeout, and nonzero execution fail-closed", async () => {
+	for (const [result, code] of [
+		[{ stdout: "not-json" }, NATIVE_REVIEW_ERROR_CODE.MALFORMED_JSON],
+		[{ stdout: "", timedOut: true }, NATIVE_REVIEW_ERROR_CODE.TIMEOUT],
+		[{ stdout: "{}", exitCode: 1 }, NATIVE_REVIEW_ERROR_CODE.NON_ZERO],
+	] as const) {
+		await assert.rejects(
+			() => (client(queuedAdapter([result]).adapter) as unknown as {
+				sddStatus(request: { changeName: string; workspaceRoot: string }): Promise<Record<string, unknown>>;
+			}).sddStatus({ changeName: "complete-native-review-lifecycle", workspaceRoot: "/repo" }),
+			(error: unknown) => error instanceof NativeReviewCliError && error.code === code && error.mutationOutcome === "none",
+		);
+	}
+});
+
 test("negotiated STATUS accepts the pinned v5 receipt before routing its transition", async () => {
 	const status = fixture("status-v5.captured.json");
 	const queue = queuedAdapter([{ stdout: JSON.stringify(status) }]);
@@ -133,6 +231,125 @@ test("provider-owned refuter and targeted-validator vectors accept only their ma
 	);
 });
 
+// gentle-pi#638: the host relay's deterministic-failure exit declares the
+// bound slot unachievable through the native verb instead of leaving the
+// operator to re-spend an identical reviewer run. The invocation names the
+// slot's frozen binding fields (--lineage/--target/--expected-revision/
+// --request-hash), the machine-readable --reason, an optional bounded
+// --detail, and the opaque --repository-context the slot carried; Go
+// verifies all of them against the frozen authority before recording
+// anything (internal/cli/review_capture_unachievable.go).
+const UNACHIEVABLE_TARGET = `sha256:${"1".repeat(64)}`;
+const UNACHIEVABLE_REVISION = `sha256:${"3".repeat(64)}`;
+const UNACHIEVABLE_REQUEST_HASH = `sha256:${"0".repeat(64)}`;
+const UNACHIEVABLE_ARTIFACT = { schema: "gentle-ai.review-capture-unachievable/v1", lineage_id: "relay-lineage", target_identity: UNACHIEVABLE_TARGET, lens: "review-reliability", selected_order: 0, reason: "relay_transport_bound_exceeded", recorded: true };
+function unachievableRequest(cwd = "/repo") {
+	return { cwd, lineageId: "relay-lineage", targetIdentity: UNACHIEVABLE_TARGET, expectedRevision: UNACHIEVABLE_REVISION, requestHash: UNACHIEVABLE_REQUEST_HASH, reason: "relay_transport_bound_exceeded" };
+}
+
+test("capture-unachievable declares the exact slot binding and decodes its recorded artifact", async () => {
+	const queue = queuedAdapter([{ stdout: JSON.stringify(UNACHIEVABLE_ARTIFACT) }]);
+	const result = await client(queue.adapter).captureUnachievableLens({ ...unachievableRequest(), detail: "killed after 2256004ms against a 2256000ms relay bound", repositoryContext: "rctx1_" + "e".repeat(64) });
+	assert.deepEqual(result, { schema: "gentle-ai.review-capture-unachievable/v1", lineageId: "relay-lineage", targetIdentity: UNACHIEVABLE_TARGET, lens: "review-reliability", selectedOrder: 0, reason: "relay_transport_bound_exceeded", recorded: true });
+	// gentle-pi#822: --repository-context is authoritative and mutually exclusive with a path, so a declaration carrying one names no --cwd; the process still runs from request.cwd.
+	assert.deepEqual(queue.calls[0]?.arguments, ["review", "capture-unachievable", "--lineage", "relay-lineage", "--target", UNACHIEVABLE_TARGET, "--expected-revision", UNACHIEVABLE_REVISION, "--request-hash", UNACHIEVABLE_REQUEST_HASH, "--reason", "relay_transport_bound_exceeded", "--detail", "killed after 2256004ms against a 2256000ms relay bound", "--repository-context", "rctx1_" + "e".repeat(64)]);
+	assert.equal(queue.calls[0]?.cwd, "/repo", "the process working directory stays request.cwd even when --cwd is not passed as an argument");
+	assert.equal(queue.calls[0]?.timeoutMs, undefined, "the mutating declaration runs without the read-only negotiation timeout");
+
+	// the optional detail and repository context are genuinely optional
+	const bare = queuedAdapter([{ stdout: JSON.stringify(UNACHIEVABLE_ARTIFACT) }]);
+	await client(bare.adapter).captureUnachievableLens(unachievableRequest());
+	assert.deepEqual(bare.calls[0]?.arguments, ["review", "capture-unachievable", "--lineage", "relay-lineage", "--target", UNACHIEVABLE_TARGET, "--expected-revision", UNACHIEVABLE_REVISION, "--request-hash", UNACHIEVABLE_REQUEST_HASH, "--reason", "relay_transport_bound_exceeded", "--cwd", "/repo"]);
+	assert.equal(bare.calls[0]?.cwd, "/repo");
+});
+
+test("capture-unachievable measures detail in UTF-8 bytes, not UTF-16 code units", async () => {
+	const atLimit = queuedAdapter([{ stdout: JSON.stringify(UNACHIEVABLE_ARTIFACT) }]);
+	await client(atLimit.adapter).captureUnachievableLens({ ...unachievableRequest(), detail: "é".repeat(256) });
+	assert.equal(atLimit.calls.length, 1, "256 two-byte characters are exactly the 512-byte limit and must pass");
+
+	const oneCharBeyond = queuedAdapter([]);
+	await assert.rejects(() => client(oneCharBeyond.adapter).captureUnachievableLens({ ...unachievableRequest(), detail: "é".repeat(257) }), TypeError);
+	assert.equal(oneCharBeyond.calls.length, 0, "257 two-byte characters are 514 bytes and are refused before any process launches");
+
+	const shortButHeavy = queuedAdapter([]);
+	await assert.rejects(() => client(shortButHeavy.adapter).captureUnachievableLens({ ...unachievableRequest(), detail: "é".repeat(300) }), TypeError);
+	assert.equal(shortButHeavy.calls.length, 0, "300 code units pass a .length check but encode to 600 bytes and must throw");
+});
+
+test("capture-unachievable validates its request and artifact shape before and after the invocation", async () => {
+	for (const request of [
+		{ ...unachievableRequest(), lineageId: "" },
+		{ ...unachievableRequest(), targetIdentity: "not-a-sha" },
+		{ ...unachievableRequest(), expectedRevision: " " },
+		{ ...unachievableRequest(), requestHash: "sha256:short" },
+		{ ...unachievableRequest(), reason: "" },
+		{ ...unachievableRequest(), detail: "x".repeat(513) },
+		{ ...unachievableRequest(), repositoryContext: "no\u0000context" },
+	]) {
+		const queue = queuedAdapter([]);
+		await assert.rejects(() => client(queue.adapter).captureUnachievableLens(request), TypeError);
+		assert.equal(queue.calls.length, 0, "a malformed declaration is refused before any process launches");
+	}
+
+	for (const artifact of [
+		{ ...UNACHIEVABLE_ARTIFACT, schema: "gentle-ai.review-capture-unachievable/v2" },
+		{ ...UNACHIEVABLE_ARTIFACT, recorded: false },
+		{ ...UNACHIEVABLE_ARTIFACT, selected_order: -1 },
+	]) {
+		const queue = queuedAdapter([{ stdout: JSON.stringify(artifact) }]);
+		await assert.rejects(() => client(queue.adapter).captureUnachievableLens(unachievableRequest()));
+		assert.equal(queue.calls.length, 1);
+	}
+});
+
+test("an older binary's unknown-verb refusal classifies as a capability signal, not a capture failure", async () => {
+	const queue = queuedAdapter([{ stdout: "", stderr: 'Error: unknown review command "capture-unachievable"\n', exitCode: 1 }]);
+	const error = await client(queue.adapter).captureUnachievableLens(unachievableRequest()).then(() => undefined, (caught: unknown) => caught);
+	assert.ok(error instanceof NativeReviewCliError, "an empty-stdout refusal rejects with the typed CLI error carrying stderr diagnostics");
+	assert.equal(isNativeReviewUnachievableVerbRefused(error), true);
+
+	// Every other stderr — a typed binding-mismatch refusal, a timeout, or a
+	// clean run — is a real outcome, never a capability signal.
+	assert.equal(isNativeReviewUnachievableVerbRefused(new Error('unknown review command "capture-unachievable"')), false, "only the captured native stderr classifies");
+	const typedRefusal = new NativeReviewCliError(NATIVE_REVIEW_ERROR_CODE.NON_ZERO, "review/capture-unachievable", true, true, "native capture-unachievable refused", { operation: "review/capture-unachievable", error_code: NATIVE_REVIEW_ERROR_CODE.NON_ZERO, exit_code: 1, timed_out: false, output_limit_exceeded: false, stderr: "Error: review capture-unachievable binding does not match the current reviewing authority [invalid_request]" });
+	assert.equal(isNativeReviewUnachievableVerbRefused(typedRefusal), false);
+});
+
+test("nonzero targeted-validator capture preserves its dot-form typed failure", async () => {
+	const failure = {
+		schema: "gentle-ai.review-integration.failure/v2",
+		contract: "gentle-ai.review-integration/v2",
+		operation: "review.capture-validation",
+		phase: "native_running",
+		code: "targeted_validation_failed",
+		message: "the targeted validator rejected the candidate",
+		mutation_outcome: "unknown",
+		authority_applicability: "current_target",
+		retry_safe: false,
+		replayability: "status_required",
+		required_inputs: [],
+		next_action: "review.status",
+	};
+	const queue = queuedAdapter([{ stdout: JSON.stringify(failure), exitCode: 1 }]);
+	await assert.rejects(
+		() => client(queue.adapter).captureProviderRole({
+			captureOperation: "review.capture-validation",
+			argumentTokens: ["--repository-context=rctx1_" + "a".repeat(64), "--agent=pi", "--execute=true"],
+			cwd: "/repo",
+		}),
+		(error: unknown) => {
+			if (!(error instanceof NativeReviewIntegrationError)) return false;
+			assert.equal(error.failureEnvelope.operation, "review.capture-validation");
+			assert.equal(error.mutationOutcome, "unknown");
+			assert.equal(error.nextAction, "review.status");
+			assert.deepEqual(error.failureEnvelope.raw, failure);
+			return true;
+		},
+	);
+	assert.deepEqual(queue.calls[0]?.arguments, ["review", "capture-validation", "--repository-context=rctx1_" + "a".repeat(64), "--agent=pi", "--execute=true"]);
+});
+
 test("malformed closure output remains a typed schema failure and never authorizes a retry", async () => {
 	const queue = queuedAdapter([{ stdout: JSON.stringify({ schema: "gentle-ai.review-last-event-closure/v1", operation: "review/capture-result" }) }]);
 	await assert.rejects(
@@ -247,7 +464,8 @@ test("negotiated STATUS rejects malformed committed selectors before launching a
 		{ cwd: "/repo", baseRef: "refs/heads/main", committedOnly: "true" },
 	]) {
 		const queue = queuedAdapter([]);
-		await assert.rejects(() => client(queue.adapter).targetStatus(request), TypeError);
+		// gentle-pi#822: these fixtures are intentionally mistyped (a numeric baseRef, a string committedOnly) — the repo's `as unknown as` idiom keeps the invalid shapes reaching the validator instead of widening the request type.
+		await assert.rejects(() => client(queue.adapter).targetStatus(request as unknown as NativeTargetStatusRequest), TypeError);
 		assert.equal(queue.calls.length, 0);
 	}
 });
@@ -568,8 +786,8 @@ test("capture-result receives the controller AbortSignal without an automatic mu
 	assert.equal(receivedTimeout, undefined);
 });
 
-test("native review client leaves SDD status resolution to the local SDD engine", () => {
-	assert.equal("sddStatus" in client(queuedAdapter([]).adapter), false);
+test("native review client exposes native v2 SDD status without adding review lifecycle behavior", () => {
+	assert.equal(typeof (client(queuedAdapter([]).adapter) as unknown as { sddStatus?: unknown }).sddStatus, "function");
 });
 
 test("read-only authority inventory rejects a repository identity mismatch after decoding", async () => {
@@ -782,3 +1000,59 @@ test("acknowledge-approved keeps its fail-closed stderr and typed refusal discip
 		(error: unknown) => error instanceof NativeReviewCliError && error.code === NATIVE_REVIEW_ERROR_CODE.EMPTY_OUTPUT,
 	);
 });
+
+test("native continuation uses a distinct mutating operation and the same v2 decoder", async () => {
+	const queue = queuedAdapter([{ stdout: JSON.stringify(nativeSddStatus()) }, { stdout: "{}" }]);
+	const cli = client(queue.adapter);
+	const request = { changeName: "complete-native-review-lifecycle", workspaceRoot: "/repo" };
+	assert.equal((await cli.sddContinue(request)).nextRecommended, nativeSddStatus().nextRecommended);
+	assert.deepEqual(queue.calls[0]!.arguments, ["sdd-continue", request.changeName, "--cwd", "/repo", "--json", "--instructions"]);
+	assert.equal(queue.calls[0]!.timeoutMs, undefined);
+	await assert.rejects(() => cli.sddContinue(request), (error: unknown) => error instanceof NativeReviewCliError && error.mutating === true);
+});
+
+test("native discovery preserves nullable selection and rejects an invented selected identity", () => {
+	const discovery = { ...nativeSddStatus(), changeName: null, changeRoot: null, nextRecommended: "select-change" };
+	assert.equal(decodeNativeSddStatusV2(discovery, { workspaceRoot: "/repo" }).changeName, null);
+	assert.throws(() => decodeNativeSddStatusV2(discovery, { changeName: "alpha", workspaceRoot: "/repo" }), /identity/);
+});
+
+test("all twelve native actions retain their exact tokens without prose routing", () => {
+	for (const nextRecommended of ["apply", "verify", "remediate", "archive", "archived", "resolve-blockers", "sdd-new", "select-change", "propose", "spec", "design", "tasks"]) {
+		const status = { ...nativeSddStatus(), nextRecommended, ...(nextRecommended === "remediate" ? { remediationState: { required: true, complete: false, failedEvidenceRevision: `sha256:${"a".repeat(64)}` } } : {}) };
+		assert.equal(decodeNativeSddStatusV2(status, { workspaceRoot: "/repo" }).nextRecommended, nextRecommended);
+	}
+});
+
+
+test("compact SDD bracket transports exact selection and remediation binding", async () => {
+	const revision = `sha256:${"a".repeat(64)}`;
+	const queued = queuedAdapter([{ stdout: JSON.stringify({ state: "proceed", token: revision }) }, { stdout: '{"state":"complete"}' }]);
+	const cli = client(queued.adapter);
+	const request = { workspaceRoot: "/repo", changeName: "fix", requestId: "acquire-one", workUnit: "correction", evidenceGoal: "Observed correction", maxAttempts: 1, maxChangedLines: 300, remediatesEvidenceRevision: revision };
+	assert.deepEqual(await cli.sddAttemptAcquire(request), { state: "proceed", token: revision });
+	assert.deepEqual(queued.calls[0].arguments, ["sdd-attempt", "acquire", "--cwd", "/repo", "--change", "fix", "--request-id", "acquire-one", "--work-unit", "correction", "--evidence-goal", "Observed correction", "--max-attempts", "1", "--max-changed-lines", "300", "--remediates-evidence-revision", revision]);
+	assert.deepEqual(await cli.sddAttemptSettle({ workspaceRoot: "/repo", changeName: "fix", token: revision, requestId: "settle-one", outcome: "interrupted", diagnosis: "Child could not spawn", harnessDisposition: "invalidated", cleanupEvidence: "No process created", processEvidence: "Spawn rejected", remediatesEvidenceRevision: revision }), { state: "complete" });
+	assert.equal(queued.calls[1].arguments.includes("--evidence-revision"), false);
+	assert.equal(queued.calls[1].timeoutMs, undefined);
+});
+
+test("compact SDD refuses malformed result and invalid terminal evidence before execution", async () => {
+	const queued = queuedAdapter([{ stdout: '{"state":"proceed"}' }, { stdout: '{"state":"blocked","reason":"budget"}' }]);
+	const cli = client(queued.adapter);
+	const request = { workspaceRoot: "/repo", changeName: "fix", requestId: "one", workUnit: "correction", evidenceGoal: "Observed correction" };
+	await assert.rejects(cli.sddAttemptAcquire(request), /schema incompatible/);
+	assert.deepEqual(await cli.sddAttemptAcquire(request), { state: "blocked", reason: "budget" });
+	await assert.rejects(cli.sddAttemptSettle({ ...request, token: `sha256:${"a".repeat(64)}`, outcome: "failed", diagnosis: "Test failed", harnessDisposition: "reused", cleanupEvidence: "Process exited", processEvidence: "Exit one" }), /evidence/i);
+	assert.equal(queued.calls.length, 2);
+});
+
+
+test("compact admission accepts native empty CAS and never redirects uncertainty into review", async () => {
+	const queued = queuedAdapter([{ stdout: '{"state":"blocked","reason":"budget"}' }, { stdout: "", timedOut: true }]);
+	const cli = client(queued.adapter);
+	const request = { workspaceRoot: "/repo", changeName: "fix", requestId: "one", workUnit: "fix", evidenceGoal: "Observed correction", expectedRevision: "" };
+	await cli.sddAttemptAcquire(request);
+	assert.equal(queued.calls[0].arguments[queued.calls[0].arguments.indexOf("--expected-revision") + 1], "");
+	await assert.rejects(cli.sddAttemptAcquire({ ...request, expectedRevision: undefined }), error => error instanceof NativeReviewCliError && error.mutationOutcome === "unknown" && error.nextAction === undefined);
+});

package/tests/native-review-parity.test.ts

@@ -511,13 +511,18 @@ test("launched answer-consent failures remain blocked after fresh-target STATUS
 	let answerCalls = 0;
 	fixture.native.answerConsent = async () => {
 		answerCalls += 1;
-		throw new NativeReviewCliError(
-			NATIVE_REVIEW_ERROR_CODE.NON_ZERO,
-			NATIVE_REVIEW_OPERATION.START,
-			true,
-			true,
-			"native review/start failed after launch",
-		);
+		throw {
+			name: "NativeReviewCliError",
+			code: NATIVE_REVIEW_ERROR_CODE.NON_ZERO,
+			mutationOutcome: "unknown",
+			nextAction: "review.status",
+			diagnostics: {
+				operation: NATIVE_REVIEW_OPERATION.START,
+				error_code: NATIVE_REVIEW_ERROR_CODE.NON_ZERO,
+				timed_out: false,
+				output_limit_exceeded: false,
+			},
+		};
 	};
 	const runtime = parityRuntime(fixture.native);
 	const blocked = await beginConsent(runtime, cwd);
@@ -533,6 +538,8 @@ test("launched answer-consent failures remain blocked after fresh-target STATUS
 		output_limit_exceeded: false,
 	});
 	assert.deepEqual(first.reconciliation, freshTargetStatus.raw);
+	assert.match(String(first.required_status_action), /Run target-scoped review\.status/);
+	assert.equal(first.next_action, "start");
 	assert.equal(statusRequests.length, 2, "the launched failure reconciles exactly once after the initial START status");
 	assert.equal(answerCalls, 1, "reconciliation must not replay answer-consent");
 

package/tests/native-sdd-attempt-authority.test.ts

@@ -147,7 +147,6 @@ test("workflow settle command line binds mandatory arguments and routing invaria
 		"--token <token>",
 		"--request-id <id>",
 		"--outcome <failed|interrupted|passed>",
-		"--evidence-revision <sha256:...>",
 		"--diagnosis <text>",
 		"--harness-disposition <reused|invalidated>",
 		"--cleanup-evidence <text>",
@@ -155,7 +154,13 @@ test("workflow settle command line binds mandatory arguments and routing invaria
 	]) {
 		assert.ok(settle.includes(arg), `settle command is missing ${arg}; command: ${settle}`);
 	}
-	assert.match(section, /never `none`/);
+	assert.ok(settle.includes("[--evidence-revision <sha256:...>]"));
+	assert.match(section, /Every settle field except `evidence-revision` is required/);
+	assert.match(
+		section,
+		/For `failed` or `passed`, include `--evidence-revision` with the `sha256:\.\.\.` evidence hash\./,
+	);
+	assert.match(section, /For `interrupted`, omit the entire `--evidence-revision` flag\./);
 	assert.match(section, /proceed\|blocked\|complete/);
 	assert.match(section, /--successor-lineage/);
 	assert.match(section, /--remediates-evidence-revision/);