gentle-pi 2.6.0 → 2.6.2

package/extensions/gentle-agents.ts

@@ -30,7 +30,6 @@ import { openInExternalEditor } from "./gentle-shell.ts";
 import { resolveGentlePiAgentHome } from "../lib/agent-home.ts";
 import { assertResearchCheckpoint, parseResearchPersistence, RESEARCH_PERSISTENCE_ENTRY, canonicalArtifactPath, researchAgent, renderResearchCapabilities, RESEARCH_CHILD_TOOLS_ENV, RESEARCH_SELECTION_ENV, RESEARCH_ARTIFACT_ENV, parseResearchArtifactIntent, researchArtifactCall, researchArtifactReadback, type ResearchArtifactIntent, type ResearchWriteIdentity } from "../lib/sdd-research-capabilities.ts";
 import { CHILD_METRICS_EVENT, CHILD_METRICS_REVOKED, childEvent, launchSelection, type LaunchSelection } from "../lib/runtime-metrics-children.ts";
-import { lookupPiCatalogName } from "../lib/runtime-metrics-pi-identity.ts";
 import { runtimeMetricsEnvAllows, type RuntimeMetricsPolicyDeps } from "../lib/runtime-metrics-policy.ts";
 
 // Gentle Agents: subagents as isolated `pi --mode rpc` children, a task
@@ -198,9 +197,12 @@ export async function admitManagedRemediation(request: TaskRequest, input: unkno
 				task.error = "Managed remediation lacks complete passing planned-command evidence";
 			}
 			if (payload.outcome === "passed" && state.settlement && state.settlement.state !== "blocked") task.status = TASK_STATUS.COMPLETED;
-			if (!state.settlement || state.settlement.state === "blocked") {
+			if (!state.settlement) {
 				task.status = TASK_STATUS.FAILED;
 				task.error = "Native remediation settlement unresolved; retain exact history for reconciliation";
+			} else if (state.settlement.state === "blocked") {
+				task.status = TASK_STATUS.FAILED;
+				task.error = `Native remediation settlement blocked(${state.settlement.reason ?? "unspecified"}); current native admission decides any later attempt`;
 			}
 			await persist(task);
 		},
@@ -244,7 +246,6 @@ export interface AgentsDeps extends RunnerDeps {
 	runtimeMetricsPolicy?: RuntimeMetricsPolicyDeps;
 	metricsNow?: () => number;
 	metricsSchedule?: RunnerDeps["schedule"];
-	lookupPiCatalogName?: typeof lookupPiCatalogName;
 }
 
 export function agentRuntimePaths(home: string, agentHome = join(home, ".pi", "agent")): { sessions: string; transcripts: string } {
@@ -633,7 +634,6 @@ export default function gentleAgents(pi: ExtensionAPI, env: NodeJS.ProcessEnv =
 	const stoppingTaskIds = new Set<string>();
 	const yieldedTaskIds = new Set<string>();
 	const metricsNow = deps.metricsNow ?? (() => performance.now());
-	const catalogLookup = deps.lookupPiCatalogName ?? lookupPiCatalogName;
 	let metricsOwner = {};
 	const metricTasks = new Map<string, { selection?: LaunchSelection; started: number; launched: boolean; finished: boolean; current(): boolean; valid(): boolean }>();
 	const unsubscribeMetrics = pi.events.on(CHILD_METRICS_REVOKED, id => {
@@ -1121,7 +1121,6 @@ export default function gentleAgents(pi: ExtensionAPI, env: NodeJS.ProcessEnv =
 			onLaunch: () => { metrics.launched = true; request.onLaunch?.(); },
 			...(observe ? { canCollectResponseObservations: metrics.valid, prepareResponseObservations: async () => {
 				if (metrics.finished || owner !== metricsOwner || request.parentSessionId !== activeSessionId() || !runtimeMetricsEnvAllows(deps.env)) return false;
-				void catalogLookup({ provider: "openai", modelId: "gpt-4o" }).catch(() => {});
 				if (!metrics.valid()) return false;
 				metrics.selection = launchSelection(request.agent, request.model, request.thinking);
 				metrics.started = metricsNow();

package/extensions/gentle-ai.ts

@@ -1839,7 +1839,15 @@ async function resolveSelectedNativeSddChangeStartup(
 	}
 	if (selection.phase === "remediate") {
 		if (status.nextRecommended !== "remediate" || status.remediationState?.failedEvidenceRevision !== selection.failedEvidenceRevision) throw new Error("Stale remediation selection");
-	} else if (status.nextRecommended !== selection.phase || status.dependencies[selection.phase] !== "ready" || status.blockedReasons.length > 0) {
+	} else if (status.nextRecommended !== selection.phase || status.dependencies[selection.phase] !== "ready" || (status.blockedReasons.length > 0 && selection.phase !== "verify")) {
+		// Native's contract gates terminal, archive, and apply work on a
+		// non-empty `blockedReasons`, and it deliberately keeps the `verify`
+		// route runnable, because the blocker can name the evidence refresh
+		// that is its own remedy ("failed verification evidence is incomplete;
+		// rerun SDD verification", gentle-ai#3538). Vetoing that route made the
+		// native-recommended phase unreachable (gentle-pi#972). The other
+		// phases still fail closed, and every blocker stays in the injected
+		// status for reporting.
 		throw new Error(`SDD selection native status blocks phase ${selection.phase}; it cannot execute.`);
 	}
 	return { selection, status };
@@ -5601,6 +5609,33 @@ function completeNativeStart(
 	};
 }
 
+// gentle-ai#4003: every Pi-side teardown step that fails after the native
+// burn is deferred cleanup, not a failed acknowledgement. Only the
+// already-sanitized CandidateViewError surface is relayed; anything else is
+// reduced to the step's fixed code so no path or command text reaches the
+// caller. The candidate-view hint is out-of-band on purpose: no controller
+// operation exposes a cleanup-only retry, and replaying acknowledge-approved
+// would hit the already-burned lineage.
+const POST_BURN_CLEANUP = {
+	candidateView: { code: "candidate-view-cleanup-failed", nextAction: "retry-candidate-view-cleanup-or-remove-the-view-out-of-band" },
+	retainedSelection: { code: "retained-selection-cleanup-failed", nextAction: "retained-selection-clears-on-the-next-terminal-status" },
+} as const;
+
+function deferredPostBurnCleanup(step: (typeof POST_BURN_CLEANUP)[keyof typeof POST_BURN_CLEANUP], cleanup: () => void): Record<string, unknown> | undefined {
+	try {
+		cleanup();
+		return undefined;
+	} catch (error) {
+		return {
+			status: "deferred",
+			diagnostics: error instanceof CandidateViewError
+				? { code: error.reason, message: error.message }
+				: { code: step.code },
+			next_action: step.nextAction,
+		};
+	}
+}
+
 function nativeOperationFailure(operation: ReviewControllerOperation | "gentle_review_capture", error: unknown): Record<string, unknown> {
 	const value = error as { mutationOutcome?: unknown; nextAction?: unknown; diagnostics?: unknown; auditRecord?: unknown; launchAttempted?: unknown; candidateViewPreNative?: unknown; failureEnvelope?: { raw?: unknown; mutationOutcome?: unknown; replayability?: unknown; nextAction?: unknown; code?: unknown; continuation?: { command?: unknown } } };
 	if (isRecord(value.failureEnvelope) && isRecord(value.failureEnvelope.raw)) {
@@ -7335,42 +7370,50 @@ async function executeReviewControllerOperation(
 		} catch (error) {
 			return nativeOperationFailure(parameters.operation, error);
 		}
+		let acknowledged: NativeReviewAcknowledgeApprovedOutcome | void;
 		try {
 			// gentle-ai #3947: the burn answers with one review-acknowledged/v1
 			// envelope bound to exactly this lineage, target, and revision, and
 			// the burn is reported from that envelope, never from a later
 			// STATUS. Every published release up to v2.5.0-rc.3 still burns in
 			// silence, and that result stays byte-identical.
-			const acknowledged = await acknowledgementCli.acknowledgeApproved({
+			acknowledged = await acknowledgementCli.acknowledgeApproved({
 				argumentTokens,
 				cwd: defaultCwd,
 				binding: { lineageId: parameters.lineageId, targetIdentity: status.targetIdentity, revision: status.authority.revision },
 				...(signal === undefined ? {} : { signal }),
 			});
-			clearRetainedNativeUntrackedSelection(retainedUntrackedSelections, defaultCwd, parameters.lineageId);
-			// The registry owns restoring writability of its 0555 views before
-			// removal; a terminal approved cleanup keeps the lineage projection.
-			candidateViews?.cleanupTerminal(parameters.lineageId, "approved", defaultCwd);
-			// gentle-pi#668: `closed` is never auto-derived or recorded here --
-			// a parent that wants the on-path passes nativeReviewOutcome:
-			// "closed" explicitly on its next assess call for this candidate.
-			return {
-				operation: parameters.operation,
-				status: "closed",
-				outcome: "native-approved-acknowledgement-completed",
-				lineage_id: parameters.lineageId,
-				target_identity: status.targetIdentity,
-				...(acknowledged === undefined ? {} : { consumed_revision: acknowledged.consumedRevision }),
-				authority: "burned",
-				...(acknowledged === undefined ? {} : { burn_evidence: acknowledged.schema }),
-				delivery: "ordinary-repository-policy",
-				mutation_performed: true,
-				mutation_outcome: "committed",
-			};
 		} catch (error) {
 			if (!nativeMutationRequiresStatus(error)) return nativeOperationFailure(parameters.operation, error);
 			return await reconcileNativeMutationFailure(parameters.operation, error, acknowledgementCli, target, retainedUntrackedSelections);
 		}
+		// gentle-ai#4003: from here the native burn is the committed authority
+		// outcome. Both Pi-side teardown steps run outside the mutation-result
+		// try/catch and each one is guarded on its own, so a cleanup failure is
+		// reported as deferred cleanup and never as a failed acknowledgement
+		// that would invite a replay of a burned operation.
+		const retainedSelectionCleanup = deferredPostBurnCleanup(POST_BURN_CLEANUP.retainedSelection, () => clearRetainedNativeUntrackedSelection(retainedUntrackedSelections, defaultCwd, parameters.lineageId));
+		// The registry owns restoring writability of its 0555 views before
+		// removal; a terminal approved cleanup keeps the lineage projection.
+		const candidateViewCleanup = deferredPostBurnCleanup(POST_BURN_CLEANUP.candidateView, () => candidateViews?.cleanupTerminal(parameters.lineageId, "approved", defaultCwd));
+		// gentle-pi#668: `closed` is never auto-derived or recorded here --
+		// a parent that wants the on-path passes nativeReviewOutcome:
+		// "closed" explicitly on its next assess call for this candidate.
+		return {
+			operation: parameters.operation,
+			status: "closed",
+			outcome: "native-approved-acknowledgement-completed",
+			lineage_id: parameters.lineageId,
+			target_identity: status.targetIdentity,
+			...(acknowledged === undefined ? {} : { consumed_revision: acknowledged.consumedRevision }),
+			authority: "burned",
+			...(acknowledged === undefined ? {} : { burn_evidence: acknowledged.schema }),
+			delivery: "ordinary-repository-policy",
+			mutation_performed: true,
+			mutation_outcome: "committed",
+			...(retainedSelectionCleanup === undefined ? {} : { retained_selection_cleanup: retainedSelectionCleanup }),
+			...(candidateViewCleanup === undefined ? {} : { candidate_view_cleanup: candidateViewCleanup }),
+		};
 	}
 	if (parameters.operation === REVIEW_CONTROLLER_OPERATION.ANSWER_CONSENT) {
 		const input = parseControllerJson(requiredControllerString(parameters, "input"), parameters.operation);

package/extensions/runtime-metrics.ts

@@ -1,6 +1,5 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { EFFORTS, ORCHESTRATOR_AGENT_CLASS, RuntimeMetrics, UNKNOWN_AGENT_CLASS, type FinalResponse, type TokenMeasurement } from "../lib/runtime-metrics.ts";
-import { classifyPiCatalogName, lookupPiCatalogName } from "../lib/runtime-metrics-pi-identity.ts";
 import { CHILD_METRICS_EVENT, CHILD_METRICS_REVOKED, snapshotChildEvent, type ChildLaunchBucket } from "../lib/runtime-metrics-children.ts";
 import { RuntimeMetricsAttempt } from "../lib/runtime-metrics-delivery.ts";
 import { sendNativeRuntimeEvent, type NativeRuntimeTransportDeps } from "../lib/runtime-metrics-native.ts";
@@ -12,10 +11,8 @@ import { runtimeMetricsEnvAllows } from "../lib/runtime-metrics-policy.ts";
  * Pi hooks lack request correlation: latency and SDK-zero presence are unknown.
  */
 export default function runtimeMetrics(pi: ExtensionAPI, env = process.env,
-	{ lookup = lookupPiCatalogName, classify = classifyPiCatalogName, native, send = sendNativeRuntimeEvent,
-		now = () => performance.now(), shutdownWaitMs = 1500 }:
-	{ lookup?: typeof lookupPiCatalogName; classify?: typeof classifyPiCatalogName; native?: NativeRuntimeTransportDeps;
-		send?: typeof sendNativeRuntimeEvent; now?: () => number; shutdownWaitMs?: number } = {}): void {
+	{ native, send = sendNativeRuntimeEvent, now = () => performance.now(), shutdownWaitMs = 1500 }:
+	{ native?: NativeRuntimeTransportDeps; send?: typeof sendNativeRuntimeEvent; now?: () => number; shutdownWaitMs?: number } = {}): void {
 	const allows = () => env.GENTLE_PI_AGENTS_CHILD !== "1" && runtimeMetricsEnvAllows(env);
 	if (!allows()) return;
 	type Selection = Pick<FinalResponse, "selectedModelId" | "selectedProvider" | "effort">;
@@ -24,7 +21,7 @@ export default function runtimeMetrics(pi: ExtensionAPI, env = process.env,
 	let requestSeen = false;
 	let ambiguous = false;
 	let live: { id: string; started: number; ctx: ExtensionContext; attempt: RuntimeMetricsAttempt;
-		seen: WeakSet<object>; children: Set<string>; catalog: boolean } | undefined;
+		seen: WeakSet<object>; children: Set<string> } | undefined;
 	const missing = { state: "unavailable" } as const;
 	function invalidate() { selection = undefined; ambiguous = true; }
 	function dispose() { live?.attempt.dispose(); live = undefined; active = false; invalidate(); }
@@ -32,15 +29,10 @@ export default function runtimeMetrics(pi: ExtensionAPI, env = process.env,
 		if (!allows() || live?.id !== ctx.sessionManager.getSessionId()) dispose();
 		return live;
 	}
-	function refreshCatalog(owner: NonNullable<typeof live>, input: { provider: unknown; modelId: unknown }) {
-		void lookup(input).then(result => {
-			if (live === owner && result.classification === "catalog_public") owner.catalog = true;
-		}, () => { /* A later classification callback may retry the bounded load. */ });
-	}
 	function submit(owner: NonNullable<typeof live>, responses: FinalResponse[], launches?: ChildLaunchBucket[]) {
 		if (!responses.length || live !== owner || !current(owner.ctx)) return;
 		// Ephemeral event-local accounting only; source IDs never enter these rows.
-		const metrics = new RuntimeMetrics({ classifyModel: classify });
+		const metrics = new RuntimeMetrics();
 		for (const [index, row] of responses.entries()) metrics.record({ ...row, responseId: String(index) });
 		const rows = metrics.snapshot();
 		if (!rows.length) return;
@@ -71,10 +63,8 @@ export default function runtimeMetrics(pi: ExtensionAPI, env = process.env,
 	pi.on("session_start", (_event, ctx) => {
 		dispose();
 		if (!allows()) return;
-		const owner = { id: ctx.sessionManager.getSessionId(), started: now(), ctx,
-			attempt: new RuntimeMetricsAttempt(), seen: new WeakSet<object>(), children: new Set<string>(), catalog: false };
-		live = owner;
-		refreshCatalog(owner, { provider: "openai", modelId: "gpt-4o" });
+		live = { id: ctx.sessionManager.getSessionId(), started: now(), ctx,
+			attempt: new RuntimeMetricsAttempt(), seen: new WeakSet<object>(), children: new Set<string>() };
 	});
 	pi.on("session_shutdown", (_event, ctx) => {
 		const teardown = () => { dispose(); offChild(); offRevoke(); };
@@ -95,8 +85,10 @@ export default function runtimeMetrics(pi: ExtensionAPI, env = process.env,
 		if (!active || ambiguous) return;
 		let effort: FinalResponse["effort"] = "unavailable";
 		try { const value = pi.getThinkingLevel(); if (EFFORTS.includes(value)) effort = value; } catch { /* No evidence. */ }
-		selection = { selectedProvider: owner.catalog ? ctx.model?.provider as FinalResponse["provider"] ?? "unknown" : "unknown",
-			selectedModelId: owner.catalog && typeof ctx.model?.id === "string" && ctx.model.id.length <= 128 ? ctx.model.id : undefined, effort };
+		// No catalog gate: the selection is taken as-is (bounded to 128 chars) and
+		// the schema-driven normalizer decides what actually leaves the machine.
+		selection = { selectedProvider: typeof ctx.model?.provider === "string" && ctx.model.provider.length <= 128 ? ctx.model.provider : undefined,
+			selectedModelId: typeof ctx.model?.id === "string" && ctx.model.id.length <= 128 ? ctx.model.id : undefined, effort };
 	});
 	function token(value: unknown): TokenMeasurement {
 		return typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= 1_000_000_000
@@ -109,7 +101,6 @@ export default function runtimeMetrics(pi: ExtensionAPI, env = process.env,
 			if (!owner || message.role !== "assistant" || message.stopReason === "pending" || message.stopReason === "deferred"
 				|| owner.seen.has(message)) return;
 			owner.seen.add(message);
-			refreshCatalog(owner, { provider: "openai", modelId: "gpt-4o" });
 			const selected = active && !ambiguous ? selection : undefined;
 			submit(owner, [{ kind: "final_assistant_response", responseId: "0",
 				selectedProvider: selected?.selectedProvider ?? "unknown", selectedModelId: selected?.selectedModelId,

package/lib/agents-history.ts

@@ -16,7 +16,13 @@ export function remediationUnresolved(task: TaskRecord): boolean {
 	const state = task.sddRemediation;
 	if (!state) return false;
 	if (state.acquireUncertain || state.settlementUncertain) return true;
-	if (state.settlement) return state.settlement.state === "blocked";
+	// A received settlement is a definite native outcome, whatever its state
+	// (including "blocked"): it is terminal task history, never local
+	// ambiguity. Native admission is the sole authority over any later
+	// attempt for the same cwd/change; only genuinely uncertain outcomes, or
+	// no settlement at all with a still-retained token/claimed actor, are
+	// unresolved.
+	if (state.settlement) return false;
 	return !!state.token || !!state.actorClaimed || !["blocked", "complete"].includes(state.acquireResult?.state ?? "");
 }
 

package/lib/native-review-cli.ts

@@ -966,6 +966,20 @@ export const NATIVE_CLI_CONTRACTS = Object.freeze({
 	// so this row repeats 2.7.0. riskEvidence and hint remain dark because
 	// neither is proven to reach the negotiated START path Pi consumes.
 	"2.8.0": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
+	// v2.8.1 only changed runtime telemetry model attribution (gentle-ai#4536);
+	// the closed fields Pi consumes did not change between 2.8.0 and 2.8.1, so
+	// this row repeats 2.8.0 exactly. riskEvidence and hint remain dark
+	// because neither is proven to reach the negotiated START path Pi consumes.
+	"2.8.1": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
+	// v2.8.2 shipped OpenCode SDD preflight plugin fixes, community-tools RTK
+	// acquisition, and Claude Code Stop telemetry. The provider contract semver
+	// stays 1.2.0; the same pin re-mirrors bundle bytes that had drifted under
+	// that semver (lens inspection.status "unavailable", targeted-validator
+	// regressions/inspection members, seven Pi stop reason codes). None of
+	// those touch the closed START/STATUS fields this row negotiates, so it
+	// repeats 2.8.1 exactly. riskEvidence and hint remain dark because neither
+	// is proven to reach the negotiated START path Pi consumes.
+	"2.8.2": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
 });
 
 export interface NativeReviewProcessDiagnostics {

package/lib/runtime-metrics-children.ts

@@ -2,14 +2,12 @@ import { readFileSync, readdirSync } from "node:fs";
 import { parseAgentDefinition, type AgentDefinition, type ModelRef } from "./agents-config.ts";
 import type { ChildObservationSnapshot } from "./agents-runner.ts";
 import { FINISHED_STATUSES, type TaskStatus } from "./agents-protocol.ts";
-import { classifyRuntimeModelId, EFFORTS, parseAgentClass, RuntimeMetrics, UNKNOWN_AGENT_CLASS, validRuntimeResponse, type AgentClass, type FinalResponse, type RuntimeMetricBucket } from "./runtime-metrics.ts";
-import { classifyPiCatalogName } from "./runtime-metrics-pi-identity.ts";
+import { classifyRuntimeModelId, EFFORTS, normalizeRuntimeProvider, parseAgentClass, RuntimeMetrics, UNKNOWN_AGENT_CLASS, validRuntimeResponse, type AgentClass, type FinalResponse, type RuntimeMetricBucket } from "./runtime-metrics.ts";
 export const CHILD_METRICS_EVENT = "gentle:runtime-metrics:child/v1";
 // Local revocation notification invalidates active observations. Contains only
 // the local session join, never policy output.
 export const CHILD_METRICS_REVOKED = "gentle:runtime-metrics:revoked/v1";
 const missing = { state: "unavailable" } as const;
-const providers = ["anthropic", "openai", "openai-codex", "google", "google-vertex", "amazon-bedrock", "openrouter", "custom", "unknown"];
 const tokenFields = ["input", "output", "cacheRead", "cacheWrite", "reasoning", "totalTokens"] as const;
 /** Recognize only names from this package's fixed assets and the transport's
  * closed agent_class enum. Customized packaged agents retain their schema name;
@@ -44,11 +42,11 @@ export function classifyBuiltinAgent(agent: AgentDefinition): AgentClass {
 	} catch { return UNKNOWN_AGENT_CLASS; }
 }
 function provider(value: unknown): FinalResponse["provider"] {
-	return providers.includes(value as string) ? value as FinalResponse["provider"] : value ? "custom" : "unknown";
+	return normalizeRuntimeProvider(value);
 }
 function modelId(namespace: unknown, value: unknown): string {
 	if (value === "unknown" || value === undefined) return "unknown";
-	return classifyRuntimeModelId(namespace, value, classifyPiCatalogName);
+	return classifyRuntimeModelId(namespace, value);
 }
 function effort(value: unknown): FinalResponse["effort"] {
 	return EFFORTS.includes(value as FinalResponse["effort"]) ? value as FinalResponse["effort"] : "unavailable";

package/lib/runtime-metrics-native.ts

@@ -1,7 +1,7 @@
 import { spawn, type ChildProcessWithoutNullStreams, type SpawnOptionsWithoutStdio } from "node:child_process";
 import { resolveGentleAiBinary } from "./gentle-ai-binary.ts";
 import { runtimeMetricsEnvAllows } from "./runtime-metrics-policy.ts";
-import type { RuntimeMetricBucket } from "./runtime-metrics.ts";
+import { isPublicRuntimeModelId, normalizeRuntimeModel, type RuntimeMetricBucket } from "./runtime-metrics.ts";
 import type { ChildLaunchBucket } from "./runtime-metrics-children.ts";
 
 import schema from "../contracts/telemetry/runtime-aggregate-v1.schema.json" with { type: "json" };
@@ -10,11 +10,11 @@ export type NativeRuntimeResult = "stored" | "duplicate" | "discarded" | "disabl
 export const NATIVE_SEND_ACK_SCHEMA = "gentle-ai.telemetry-runtime-send/v1";
 const MAX_METRIC = schema.$defs.count.maximum;
 const count = (value: number) => Number.isSafeInteger(value) && value >= 0 && value <= MAX_METRIC;
+// Re-derives through the same schema-driven normalizer used at record time so
+// an already-classified (provider, id) pair is re-validated against the
+// transport's anyOf shape before it ever leaves the machine.
 function publicModel(provider: string, id: string) {
-	const matches = (rule: { const?: string; enum?: string[] }, value: string) => rule.const === value || rule.enum?.includes(value);
-	if (schema.$defs.model.oneOf.some(({ properties }) => matches(properties.provider, provider) && matches(properties.id, id))) return { provider, id };
-	const kind = !id || id === "unknown" ? "unknown" : "custom";
-	return { provider: kind, id: kind };
+	return normalizeRuntimeModel(provider, id);
 }
 
 /** Closed field projection of one event, not a session snapshot. Oversized or
@@ -34,14 +34,22 @@ export function encodeNativeRuntimeEvent(source: readonly RuntimeMetricBucket[],
 			};
 			const agentClass = schema.$defs.row.properties.agent_class.enum.includes(row.agentClass) ? row.agentClass : "unknown";
 			const effort = (value: string) => schema.$defs.effort.enum.includes(value) ? value : "unavailable";
-			const response = typeof row.responseModelId === "string" && row.responseModelId !== "unknown" && row.responseModelId !== "";
-			const selected = typeof row.selectedModelId === "string" && row.selectedModelId !== "unknown" && row.selectedModelId !== "";
+			// Evidence order: an actually-dispatched response model wins; otherwise
+			// the caller's own selection; otherwise the SDK-observed model the
+			// selection never captured (still labeled "selected" evidence, since
+			// the transport has no separate "observed" category). Never response
+			// evidence unless the response model itself normalizes to a public id.
+			const response = isPublicRuntimeModelId(row.responseModelId);
+			const selected = !response && isPublicRuntimeModelId(row.selectedModelId);
+			const observed = !response && !selected && isPublicRuntimeModelId(row.observedModelId);
 			const model = response ? publicModel(row.provider, row.responseModelId)
-				: selected ? publicModel(row.selectedProvider, row.selectedModelId) : { provider: "unknown", id: "unknown" };
+				: selected ? publicModel(row.selectedProvider, row.selectedModelId)
+				: observed ? publicModel(row.provider, row.observedModelId)
+				: { provider: "unknown", id: "unknown" };
 			const time = row.fullResponseMs;
 			if (!count(time.measured) || !Number.isFinite(time.sum) || time.sum < 0 || time.sum > MAX_METRIC
 				|| (!time.measured && time.sum !== 0)) throw new Error("Invalid duration");
-			return { model, model_evidence: response ? "response" : selected ? "selected" : "unknown",
+			return { model, model_evidence: response ? "response" : (selected || observed) ? "selected" : "unknown",
 				agent_kind: agentClass === "orchestrator" || agentClass === "unknown" ? agentClass : "built_in", agent_class: agentClass,
 				selected_effort: effort(row.effort), effective_effort: effort(row.providerThinkingLevel),
 				launches: null, responses: row.responses,

package/lib/runtime-metrics.ts

@@ -1,5 +1,4 @@
 import { readFileSync } from "node:fs";
-import { classifyPiCatalogName } from "./runtime-metrics-pi-identity.ts";
 
 const runtimeSchema = JSON.parse(readFileSync(new URL("../contracts/telemetry/runtime-aggregate-v1.schema.json", import.meta.url), "utf8"));
 
@@ -7,7 +6,6 @@ const runtimeSchema = JSON.parse(readFileSync(new URL("../contracts/telemetry/ru
 // Callers supply finalized assistant responses and authoritative classifications.
 // Never infer executor, usage availability, or measured timings from SDK defaults.
 const EXECUTORS = ["orchestrator", "worker", "reviewer", "unknown"] as const;
-const PROVIDERS = ["anthropic", "openai", "openai-codex", "google", "google-vertex", "amazon-bedrock", "openrouter", "custom", "unknown"] as const;
 // Stable families, not model IDs/versions: new models need no catalog update.
 // Callers map known native metadata to families; private aliases stay custom.
 const FAMILIES = ["claude", "gpt", "o-series", "gemini", "llama", "qwen", "deepseek", "kimi", "custom", "unknown"] as const;
@@ -42,38 +40,93 @@ function requiredAgentClass(value: string): AgentClass {
 export const UNKNOWN_AGENT_CLASS = requiredAgentClass("unknown");
 export const ORCHESTRATOR_AGENT_CLASS = requiredAgentClass("orchestrator");
 
-function registeredModels(): ReadonlySet<string> {
-	const rules: unknown = runtimeSchema?.$defs?.model?.oneOf;
-	if (!Array.isArray(rules) || !rules.length) throw new Error("Invalid runtime telemetry model schema");
-	const values = (rule: unknown, field: "provider" | "id"): string[] => {
-		if (!object(rule)) throw new Error("Invalid runtime telemetry model schema");
-		const properties = rule.properties;
-		if (!object(properties) || !object(properties[field])) throw new Error("Invalid runtime telemetry model schema");
-		const property = properties[field];
-		const candidates = typeof property.const === "string" ? [property.const] : property.enum;
-		if (!Array.isArray(candidates) || !candidates.length || candidates.some(value => typeof value !== "string")) {
-			throw new Error("Invalid runtime telemetry model schema");
-		}
-		return candidates as string[];
-	};
-	const models = new Set<string>();
-	for (const rule of rules) for (const provider of values(rule, "provider")) {
-		for (const id of values(rule, "id")) models.add(JSON.stringify([provider, id]));
+interface ModelFieldRule { pattern: RegExp; maxLength: number }
+
+function modelFieldRule(field: "provider" | "id"): ModelFieldRule {
+	// The length cap lives on $defs.model.properties.<field>; the shape pattern
+	// lives only on the first (public-pattern) branch of $defs.model.anyOf, next
+	// to the unknown/custom/opencode sentinel branches. Both are mirrored,
+	// byte-for-byte, from the Gentle AI transport schema.
+	const property: unknown = runtimeSchema?.$defs?.model?.properties?.[field];
+	if (!object(property) || typeof property.maxLength !== "number") {
+		throw new Error(`Invalid runtime telemetry model ${field} schema`);
 	}
-	return models;
+	const branches: unknown = runtimeSchema?.$defs?.model?.anyOf;
+	const patternProperty = Array.isArray(branches) && object(branches[0]) && object(branches[0].properties)
+		? branches[0].properties[field] : undefined;
+	if (!object(patternProperty) || typeof patternProperty.pattern !== "string") {
+		throw new Error(`Invalid runtime telemetry model ${field} schema`);
+	}
+	return { pattern: new RegExp(patternProperty.pattern), maxLength: property.maxLength };
 }
 
-const REGISTERED_MODELS = registeredModels();
+// Schema-driven, not a hardcoded TypeScript regex: the mirrored transport
+// contract owns the open family-pattern rules for provider/id shape. A
+// companion Gentle AI change keeps the Go side on the same patterns.
+const MODEL_PROVIDER_RULE = modelFieldRule("provider");
+const MODEL_ID_RULE = modelFieldRule("id");
 
-/** The mirrored transport registry is authoritative before the optional Pi
- * catalog. Unknown registry pairs still pass through the existing privacy
- * classifier, so private IDs can only become custom/unknown.
+/** Provider-only normalization, independent of any specific model id: trims,
+ * lowercases, and keeps the slug only when it matches the schema provider
+ * pattern within its maxLength. Non-string/empty input is "unknown"; a
+ * non-conforming non-empty string is "custom". Shared by the standalone
+ * provider dimension and by normalizeRuntimeModel's own provider handling.
  */
-export function classifyRuntimeModelId(provider: unknown, modelId: unknown,
-	classifyModel: typeof classifyPiCatalogName = classifyPiCatalogName): string {
-	if (typeof provider === "string" && typeof modelId === "string"
-		&& REGISTERED_MODELS.has(JSON.stringify([provider, modelId]))) return modelId;
-	return classifyModel({ provider, modelId }).modelId;
+export function normalizeRuntimeProvider(value: unknown): string {
+	if (typeof value !== "string") return "unknown";
+	const trimmed = value.trim();
+	if (!trimmed) return "unknown";
+	const lower = trimmed.toLowerCase();
+	return lower.length <= MODEL_PROVIDER_RULE.maxLength && MODEL_PROVIDER_RULE.pattern.test(lower) ? lower : "custom";
+}
+
+/** Generic, schema-driven family-pattern normalizer for a (provider, id)
+ * selection or response pair (gentle-pi#968 / gentle-ai#4536). Open-weight
+ * models on arbitrary providers are reported by name; private aliases and
+ * fine-tunes stay custom. Rules, identical to the mirrored Go/schema side:
+ *  - a non-string or empty provider or id fails closed to unknown/unknown;
+ *  - id: trim, keep the LAST "/"-separated segment, lowercase; public only
+ *    when it matches the schema id pattern within its maxLength, otherwise
+ *    "custom";
+ *  - provider: trim, lowercase; kept when it matches the schema provider
+ *    pattern, otherwise "custom";
+ *  - when the id is not public the provider becomes "custom" too, except
+ *    "opencode", which stays opencode/custom;
+ *  - the literal unknown/unknown and custom/custom pairs pass through.
+ */
+export function normalizeRuntimeModel(provider: unknown, id: unknown): { provider: string; id: string } {
+	if (typeof provider !== "string" || typeof id !== "string") return { provider: "unknown", id: "unknown" };
+	const providerTrimmed = provider.trim();
+	const idTrimmed = id.trim();
+	if (!providerTrimmed || !idTrimmed) return { provider: "unknown", id: "unknown" };
+	const providerLower = providerTrimmed.toLowerCase();
+	const idSegment = idTrimmed.split("/").pop() ?? "";
+	const idLower = idSegment.toLowerCase();
+	if (providerLower === "unknown" && idLower === "unknown") return { provider: "unknown", id: "unknown" };
+	if (providerLower === "custom" && idLower === "custom") return { provider: "custom", id: "custom" };
+	const idPublic = idLower.length <= MODEL_ID_RULE.maxLength && MODEL_ID_RULE.pattern.test(idLower);
+	const id_ = idPublic ? idLower : "custom";
+	let providerResult = normalizeRuntimeProvider(providerTrimmed);
+	if (!idPublic) providerResult = providerResult === "opencode" ? "opencode" : "custom";
+	return { provider: providerResult, id: id_ };
+}
+
+/** Thin wrapper over normalizeRuntimeModel for callers that only track the
+ * id dimension (the provider is used only to decide the closed unknown/empty
+ * fast path; a valid non-empty provider string never changes the id result).
+ */
+export function classifyRuntimeModelId(provider: unknown, modelId: unknown): string {
+	return normalizeRuntimeModel(provider, modelId).id;
+}
+
+/** True only for an id already in its normalized public form: it matches the
+ * schema id pattern within its maxLength (which, by construction, also
+ * excludes the "unknown"/"custom" sentinels, since neither matches any
+ * recognized family prefix). Used to pick the strongest available evidence
+ * tier among already-classified id dimensions (response/selected/observed).
+ */
+export function isPublicRuntimeModelId(value: unknown): value is string {
+	return typeof value === "string" && value.length > 0 && value.length <= MODEL_ID_RULE.maxLength && MODEL_ID_RULE.pattern.test(value);
 }
 
 type Missing = { state: "unavailable" | "unsupported" };
@@ -84,20 +137,23 @@ export interface FinalResponse {
 	/** Local dedupe only: 1..128 UTF-16 code units; never exported. */
 	responseId: string;
 	/** Caller-observed selected SDK model ID, never dispatched/response identity.
-	 * Catalog must be loaded before accounting; only public catalog names survive.
+	 * Normalized through normalizeRuntimeModel at record time; only an id
+	 * matching the schema family pattern survives as a public name.
 	 */
 	selectedModelId?: string;
 	/** Selection namespace, independent from observed response provider.
 	 * Omission preserves legacy same-provider callers; adapters must pass it explicitly.
 	 */
-	selectedProvider?: typeof PROVIDERS[number];
+	selectedProvider?: string;
 	agentClass?: AgentClass;
-	/** Public catalog names from SDK response metadata, never endpoint proof. */
+	/** SDK-observed model id from response metadata, never endpoint proof.
+	 * Normalized like selectedModelId; only a schema family match survives.
+	 */
 	observedModelId?: string;
 	responseModelId?: string;
 	providerThinkingLevel?: typeof EFFORTS[number];
 	executor: typeof EXECUTORS[number];
-	provider: typeof PROVIDERS[number];
+	provider: string;
 	modelFamily: typeof FAMILIES[number];
 	effort: typeof EFFORTS[number];
 	error: typeof ERRORS[number];
@@ -195,17 +251,14 @@ export class RuntimeMetrics {
 	#buckets = new Map<string, RuntimeMetricBucket>();
 	#maxResponses: number;
 	#maxBuckets: number;
-	#classifyModel: typeof classifyPiCatalogName;
 
-	constructor({ maxResponses = 1024, maxBuckets = 64, classifyModel = classifyPiCatalogName }:
-		{ maxResponses?: number; maxBuckets?: number; classifyModel?: typeof classifyPiCatalogName } = {}) {
+	constructor({ maxResponses = 1024, maxBuckets = 64 }: { maxResponses?: number; maxBuckets?: number } = {}) {
 		if (!Number.isInteger(maxResponses) || maxResponses < 1 || maxResponses > 1024
 			|| !Number.isInteger(maxBuckets) || maxBuckets < 1 || maxBuckets > 64) {
 			throw new RangeError("Invalid runtime metrics capacity");
 		}
 		this.#maxResponses = maxResponses;
 		this.#maxBuckets = maxBuckets;
-		this.#classifyModel = classifyModel;
 	}
 
 	record(response: FinalResponse): "recorded" | "duplicate" | "invalid" | "capacity" {
@@ -215,13 +268,13 @@ export class RuntimeMetrics {
 		const dimensions = {
 			hostAgent: "pi" as const,
 			agentClass: category(AGENT_CLASSES, response.agentClass, UNKNOWN_AGENT_CLASS),
-			observedModelId: classifyRuntimeModelId(response.provider, response.observedModelId, this.#classifyModel),
-			responseModelId: classifyRuntimeModelId(response.provider, response.responseModelId, this.#classifyModel),
+			observedModelId: classifyRuntimeModelId(response.provider, response.observedModelId),
+			responseModelId: classifyRuntimeModelId(response.provider, response.responseModelId),
 			providerThinkingLevel: category(EFFORTS, response.providerThinkingLevel, "unavailable"),
-			selectedModelId: classifyRuntimeModelId(selectedProvider, response.selectedModelId, this.#classifyModel),
-			selectedProvider: category(PROVIDERS, selectedProvider, typeof selectedProvider === "string" && selectedProvider ? "custom" : "unknown"),
+			selectedModelId: classifyRuntimeModelId(selectedProvider, response.selectedModelId),
+			selectedProvider: normalizeRuntimeProvider(selectedProvider),
 			executor: category(EXECUTORS, response.executor, "unknown"),
-			provider: category(PROVIDERS, response.provider, typeof response.provider === "string" && response.provider ? "custom" : "unknown"),
+			provider: normalizeRuntimeProvider(response.provider),
 			modelFamily: category(FAMILIES, response.modelFamily, typeof response.modelFamily === "string" && response.modelFamily ? "custom" : "unknown"),
 			effort: response.effort,
 			error: response.error,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "gentle-pi",
-	"version": "2.6.0",
+	"version": "2.6.2",
 	"description": "Turn Pi into el Gentleman: a senior-architect development harness with SDD/OpenSpec, subagents, strict TDD evidence, review guardrails, and skill discovery.",
 	"license": "MIT",
 	"type": "module",

package/runtime/native-review-cli.mjs

@@ -967,6 +967,20 @@ export const NATIVE_CLI_CONTRACTS = Object.freeze({
 	// so this row repeats 2.7.0. riskEvidence and hint remain dark because
 	// neither is proven to reach the negotiated START path Pi consumes.
 	"2.8.0": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
+	// v2.8.1 only changed runtime telemetry model attribution (gentle-ai#4536);
+	// the closed fields Pi consumes did not change between 2.8.0 and 2.8.1, so
+	// this row repeats 2.8.0 exactly. riskEvidence and hint remain dark
+	// because neither is proven to reach the negotiated START path Pi consumes.
+	"2.8.1": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
+	// v2.8.2 shipped OpenCode SDD preflight plugin fixes, community-tools RTK
+	// acquisition, and Claude Code Stop telemetry. The provider contract semver
+	// stays 1.2.0; the same pin re-mirrors bundle bytes that had drifted under
+	// that semver (lens inspection.status "unavailable", targeted-validator
+	// regressions/inspection members, seven Pi stop reason codes). None of
+	// those touch the closed START/STATUS fields this row negotiates, so it
+	// repeats 2.8.1 exactly. riskEvidence and hint remain dark because neither
+	// is proven to reach the negotiated START path Pi consumes.
+	"2.8.2": Object.freeze({ start: true, finalize: true, validate: true, bindSdd: true, status: true, inventory: true, reclaim: true, recover: true, abandon: true, quarantineLegacy: true, reconcileAuthority: true, repairLegacyAlias: true, mode: true, riskEvidence: false, hint: false, delivery: true }),
 });