gentle-pi 2.6.0 → 2.6.2

package/tests/runtime-metrics.test.ts

@@ -16,31 +16,32 @@ function response(responseId = "local-response"): FinalResponse {
 	};
 }
 
-test("selected provider is independent from response provider without relabeling", async () => {
-	const { lookupPiCatalogName } = await import("../lib/runtime-metrics-pi-identity.ts");
-	const { OPENAI_CODEX_MODELS } = await import("@earendil-works/pi-ai/providers/openai-codex.models");
-	const model = Object.values(OPENAI_CODEX_MODELS)[0];
-	await lookupPiCatalogName({ provider: model.provider, modelId: model.id });
+test("selected provider is independent from response provider without relabeling", () => {
 	const metrics = new RuntimeMetrics();
-	assert.equal(recordRaw(metrics, { ...response(), selectedProvider: model.provider,
-		selectedModelId: model.id, provider: "anthropic" }), "recorded");
+	assert.equal(recordRaw(metrics, { ...response(), selectedProvider: "openai-codex",
+		selectedModelId: "gpt-5.6-terra", provider: "anthropic" }), "recorded");
 	const [row] = metrics.snapshot();
-	assert.equal(row.selectedModelId, model.id);
-	assert.equal(row.selectedProvider, model.provider);
+	assert.equal(row.selectedModelId, "gpt-5.6-terra");
+	assert.equal(row.selectedProvider, "openai-codex");
 	assert.equal(row.provider, "anthropic");
-	assert.equal(recordRaw(metrics, { ...response("private"), selectedProvider: "private-provider",
-		selectedModelId: model.id }), "recorded");
-	assert.equal(metrics.snapshot()[1].selectedProvider, "custom");
+	// The provider dimension stays independent of a specific id's privacy outcome
+	// at record time; the pair is only coupled to a schema-conformant custom/custom
+	// model object later, at native encode time (see runtime-metrics-native.test.ts).
+	assert.equal(recordRaw(metrics, { ...response("private"), selectedProvider: "openai-codex",
+		selectedModelId: "private-internal-finetune" }), "recorded");
+	assert.equal(metrics.snapshot()[1].selectedProvider, "openai-codex");
 	assert.equal(metrics.snapshot()[1].selectedModelId, "custom");
 });
 
-test("mirrored registry identities survive an unavailable Pi catalog", () => {
-	const metrics = new RuntimeMetrics({ classifyModel: () => ({ classification: "unknown", modelId: "unknown" }) });
-	assert.equal(metrics.record({ ...response(), selectedProvider: "openai-codex", selectedModelId: "gpt-5.6-terra",
-		responseModelId: "gpt-5.6-sol" }), "recorded");
+test("open-weight models on arbitrary providers are reported by name, not squashed to a closed enum", () => {
+	const metrics = new RuntimeMetrics();
+	assert.equal(recordRaw(metrics, { ...response(), provider: "nan", selectedProvider: "nan",
+		selectedModelId: "deepseek-v4-flash", responseModelId: "glm5.3-flash" }), "recorded");
 	const [row] = metrics.snapshot();
-	assert.equal(row.selectedModelId, "gpt-5.6-terra");
-	assert.equal(row.responseModelId, "gpt-5.6-sol");
+	assert.equal(row.provider, "nan");
+	assert.equal(row.selectedProvider, "nan");
+	assert.equal(row.selectedModelId, "deepseek-v4-flash");
+	assert.equal(row.responseModelId, "glm5.3-flash");
 });
 
 // Deliberately bypass static types to exercise the runtime boundary.
@@ -96,7 +97,9 @@ test("effort selections and absence states remain distinct", () => {
 test("only closed dimensions survive; no prompt-based executor inference", () => {
 	const metrics = new RuntimeMetrics();
 	assert.equal(recordRaw(metrics, {
-		...response(), provider: "private-provider", modelFamily: "private-model-id",
+		// Free text with spaces/case never matches the schema provider pattern,
+		// unlike a genuine open-weight provider slug (see the dedicated test above).
+		...response(), provider: "Private Provider Free Text", modelFamily: "private-model-id",
 		executor: "SDD apply executor", systemPrompt: "reviewer", errorMessage: "private failure",
 	}), "recorded");
 	const [row] = metrics.snapshot();

package/tests/sdd-managed-runtime-settlement.test.ts

@@ -185,9 +185,11 @@ test("history pruning retains admitted unsettled and uncertain task payloads", a
 	const dir = await mkdtemp(join(tmpdir(), "remediation-history-")); t.after(() => rm(dir, { recursive: true, force: true }));
 	await saveTask(dir, { id: "retained", agent: "sdd-remediate", status: "failed", createdAt: 1, sddRemediation: { token: "opaque", settlementUncertain: true, settle: { requestId: "exact" } } } as unknown as TaskRecord, emptyThread());
 	for (const state of ["blocked", "complete"] as const) await saveTask(dir, { id: state, agent: "sdd-remediate", status: "failed", createdAt: 2, sddRemediation: { acquireResult: { state } } } as unknown as TaskRecord, emptyThread());
+	await saveTask(dir, { id: "settled-blocked", agent: "sdd-remediate", status: "failed", createdAt: 3, sddRemediation: { settlement: { state: "blocked", reason: "maintainer_decision" } } } as unknown as TaskRecord, emptyThread());
 	await pruneHistory(dir, 0);
 	const stored = await loadHistory(dir);
 	assert.equal(stored.length, 1); assert.equal(stored[0].task.sddRemediation.settle.requestId, "exact");
+	assert.ok(!stored.some(entry => entry.task.id === "settled-blocked"), "a known blocked settlement is prunable like any terminal task");
 });
 
 
@@ -214,6 +216,41 @@ test("native refusal or uncertain settlement is not a completed managed correcti
 	assert.equal(task.status, "failed");
 	assert.match(task.error, /settlement/);
 });
+test("a received blocked settlement names the block; a lost settlement reply retains unresolved history", async () => {
+	const known = await admissionFixture({ sddAttemptSettle: async () => ({ state: "blocked", reason: "maintainer_decision" }) });
+	known.task.status = "completed";
+	await known.admitted.finalizeRemediation(known.task, { spawned: true, exited: true, cleanupConfirmed: true });
+	assert.equal(known.task.status, "failed");
+	assert.match(known.task.error, /blocked\(maintainer_decision\)/);
+	assert.doesNotMatch(known.task.error, /unresolved/);
+	assert.equal(remediationUnresolved(known.task), false);
+
+	const unspecified = await admissionFixture({ sddAttemptSettle: async () => ({ state: "blocked" }) });
+	unspecified.task.status = "completed";
+	await unspecified.admitted.finalizeRemediation(unspecified.task, { spawned: true, exited: true, cleanupConfirmed: true });
+	assert.equal(unspecified.task.status, "failed");
+	assert.match(unspecified.task.error, /blocked\(unspecified\)/, "a settlement without a reason is distinguishable from one whose reason is literally blocked");
+	assert.doesNotMatch(unspecified.task.error, /unresolved/);
+
+	let attempts = 0;
+	const uncertain = await admissionFixture({ sddAttemptSettle: async () => { attempts++; throw new Error("lost reply"); } });
+	uncertain.task.status = "completed";
+	await uncertain.admitted.finalizeRemediation(uncertain.task, { spawned: true, exited: true, cleanupConfirmed: true });
+	assert.equal(attempts, 2);
+	assert.equal(uncertain.task.status, "failed");
+	assert.match(uncertain.task.error, /unresolved/);
+	assert.equal(remediationUnresolved(uncertain.task), true);
+});
+test("remediationUnresolved treats a received settlement as terminal, regardless of state, unless uncertain", () => {
+	// A terminal acquire result keeps the final branch false, so the token and
+	// actor-claim assertions below discriminate on those fields alone.
+	const base = { acquire: {}, acquireResult: { state: "complete" } } as unknown as TaskRecord["sddRemediation"];
+	assert.equal(remediationUnresolved({ sddRemediation: { ...base } } as unknown as TaskRecord), false);
+	assert.equal(remediationUnresolved({ sddRemediation: { ...base, settlement: { state: "blocked", reason: "maintainer_decision" } } } as unknown as TaskRecord), false);
+	assert.equal(remediationUnresolved({ sddRemediation: { ...base, settlement: { state: "blocked", reason: "maintainer_decision" }, settlementUncertain: true } } as unknown as TaskRecord), true);
+	assert.equal(remediationUnresolved({ sddRemediation: { ...base, actorClaimed: true } } as unknown as TaskRecord), true);
+	assert.equal(remediationUnresolved({ sddRemediation: { ...base, token: "retained" } } as unknown as TaskRecord), true);
+});
 
 
 test("remediation actor preserves separately authorized memory artifact tools", async () => {

package/tests/sdd-selection-transport.test.ts

@@ -218,6 +218,63 @@ test("selected native v2 failures fail closed without consulting the local resol
 	);
 });
 
+function nativeStartup(
+	serialized: unknown,
+	cwd: string,
+	agentName: string,
+	native: { sddStatus: (request: unknown) => Promise<unknown> },
+) {
+	return (__testing as unknown as {
+		resolveSelectedNativeSddChangeStartup(
+			serialized: unknown, cwd: string, agentName: string,
+			native: { sddStatus?: (request: unknown) => Promise<unknown> },
+		): Promise<{ selection: { changeName: string; workspaceRoot: string; phase: string }; status: NativeSddStatusV2 }>;
+	}).resolveSelectedNativeSddChangeStartup(serialized, cwd, agentName, native);
+}
+
+function verifyRefreshAuthority(root: string, blockedReasons: readonly string[]) {
+	return {
+		schemaName: "gentle-ai.sdd-status", schemaVersion: 2, changeName: "alpha", artifactStore: "openspec",
+		planningHome: { mode: "repo-local", path: join(root, "openspec") }, changeRoot: join(root, "openspec/changes/alpha"),
+		actionContext: { mode: "repo-local", workspaceRoot: root, allowedEditRoots: [root] },
+		dependencies: { proposal: "all_done", specs: "all_done", design: "all_done", tasks: "all_done", apply: "all_done", verify: "ready", archive: "blocked" },
+		phaseInstructions: { apply: ["done"], verify: ["rerun SDD verification"], remediate: ["failed evidence"], archive: ["blocked"] },
+		blockedReasons: [...blockedReasons], nextRecommended: "verify",
+	};
+}
+
+test("a native verify evidence-refresh route starts under its own blocker while every other phase stays closed", async (t) => {
+	const root = workspace(t);
+	const refreshReason = "failed verification evidence is incomplete; rerun SDD verification";
+	const authority = verifyRefreshAuthority(root, [refreshReason]);
+	const startup = await nativeStartup(
+		JSON.stringify({ changeName: "alpha", workspaceRoot: root, phase: "verify" }),
+		root,
+		"sdd-verify",
+		{ sddStatus: async () => authority },
+	);
+	assert.deepEqual(startup.selection, { changeName: "alpha", workspaceRoot: root, phase: "verify" });
+	assert.equal(startup.status, authority, "the validated native status is injected whole, blockers included");
+	assert.deepEqual(startup.status.blockedReasons, [refreshReason], "the blocking reason is preserved for reporting");
+
+	for (const phase of ["apply", "archive"] as const) {
+		const gated = {
+			...verifyRefreshAuthority(root, [refreshReason]),
+			nextRecommended: phase,
+			dependencies: { ...authority.dependencies, [phase]: "ready", verify: "all_done" },
+		};
+		await assert.rejects(
+			() => nativeStartup(
+				JSON.stringify({ changeName: "alpha", workspaceRoot: root, phase }),
+				root,
+				`sdd-${phase}`,
+				{ sddStatus: async () => gated },
+			),
+			/native status blocks phase/i,
+		);
+	}
+});
+
 test("a throwing SDD selection flag reader fails closed without resolving an unselected status", (t) => {
 	const root = workspace(t);
 	assert.equal(__testing.readSddChangeFlag({ getFlag: () => false } as never), undefined);

package/tests/skill-collision-prefixes.test.ts

@@ -33,8 +33,8 @@ for (const [dir, expectedName] of Object.entries(PREFIXED_NAMES)) {
 	});
 }
 
-test("README documents legacy skill-name compatibility aliases", () => {
-	const readme = readFileSync(join(repoRoot, "README.md"), "utf8");
+test("technical reference documents legacy skill-name compatibility aliases", () => {
+	const readme = readFileSync(join(repoRoot, "docs", "readme-reference.md"), "utf8");
 	for (const [legacyName, prefixedName] of [
 		["branch-pr", "gentle-ai-branch-pr"],
 		["judgment-day", "gentle-ai-judgment-day"],

package/lib/runtime-metrics-pi-identity.ts

@@ -1,113 +0,0 @@
-import { findPackageJSON } from "node:module";
-
-// Catalog-name privacy classification ONLY. No identity issuance, route evidence,
-// registry reads, SDK hooks, auth resolution, network, or injected catalogs.
-export interface PiCatalogName {
-	readonly classification: "catalog_public" | "custom" | "unknown";
-	readonly modelId: string;
-}
-
-const UNKNOWN: PiCatalogName = Object.freeze({ classification: "unknown", modelId: "unknown" });
-const CUSTOM: PiCatalogName = Object.freeze({ classification: "custom", modelId: "custom" });
-// Initial provider coverage matches the accumulator. Other providers are custom;
-// additions require deliberate review. These are providers, not model-ID lists.
-const CATALOGS = ["anthropic", "openai", "openai-codex", "google", "google-vertex", "amazon-bedrock", "openrouter"] as const;
-const MAX_MODELS = 4096;
-const MAX_LOAD_ATTEMPTS = 3;
-
-function object(value: unknown): value is Record<string, unknown> {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-
-function text(value: unknown, max: number): value is string {
-	return typeof value === "string" && value.length > 0 && value.length <= max;
-}
-
-function key(provider: string, modelId: string): string {
-	return JSON.stringify([provider, modelId]);
-}
-
-async function loadCatalog(): Promise<ReadonlyMap<string, PiCatalogName>> {
-	// Node >=22.19 supports findPackageJSON. Verify ESM lookup from this module
-	// selects Pi's own pi-ai package; fail rather than silently use another copy.
-	const pi = import.meta.resolve("@earendil-works/pi-coding-agent");
-	const ownPackage = findPackageJSON("@earendil-works/pi-ai", import.meta.url);
-	if (!ownPackage || ownPackage !== findPackageJSON("@earendil-works/pi-ai", pi)) {
-		throw new Error("Pi catalog dependency mismatch");
-	}
-	const entries = new Map<string, PiCatalogName>();
-	let count = 0;
-	for (const provider of CATALOGS) {
-		// pi-ai 0.85.1 providers/* has an import-only export condition: use ESM,
-		// never require.resolve. Generated modules load packaged JSON, not registry
-		// overrides. Specifiers and export names come only from the fixed list.
-		const module = await import(`@earendil-works/pi-ai/providers/${provider}.models`);
-		const models: unknown = module[`${provider.replaceAll("-", "_").toUpperCase()}_MODELS`];
-		if (!object(models)) throw new Error("Invalid packaged model catalog");
-		for (const model of Object.values(models)) {
-			if (++count > MAX_MODELS) throw new RangeError("Packaged model catalog exceeds capacity");
-			if (!object(model) || model.provider !== provider || !text(model.id, 128)) {
-				throw new Error("Invalid packaged model name");
-			}
-			entries.set(key(provider, model.id), Object.freeze({ classification: "catalog_public", modelId: model.id }));
-		}
-	}
-	return entries;
-}
-
-export function createPiCatalogNameLookup(
-	load: () => Promise<ReadonlyMap<string, PiCatalogName>> = loadCatalog,
-	maxAttempts = MAX_LOAD_ATTEMPTS,
-): { lookup(input: unknown): Promise<PiCatalogName>; classify(input: unknown): PiCatalogName } {
-	let catalogPromise: Promise<ReadonlyMap<string, PiCatalogName>> | undefined;
-	let loadedCatalog: ReadonlyMap<string, PiCatalogName> | undefined;
-	let attempts = 0;
-	const classify = (input: unknown): PiCatalogName => {
-		if (!object(input) || !text(input.provider, 32) || !text(input.modelId, 128)) return UNKNOWN;
-		if (!CATALOGS.includes(input.provider as typeof CATALOGS[number])) return CUSTOM;
-		return loadedCatalog ? loadedCatalog.get(key(input.provider, input.modelId)) ?? CUSTOM : UNKNOWN;
-	};
-	const lookup = async (input: unknown): Promise<PiCatalogName> => {
-		if (!object(input) || !text(input.provider, 32) || !text(input.modelId, 128)) return UNKNOWN;
-		if (!CATALOGS.includes(input.provider as typeof CATALOGS[number])) return CUSTOM;
-		if (!loadedCatalog) {
-			if (!catalogPromise) {
-				if (attempts >= maxAttempts) throw new Error("Pi catalog load attempts exhausted");
-				attempts++;
-				catalogPromise = load().then(catalog => {
-					loadedCatalog = catalog;
-					return catalog;
-				}, error => {
-					catalogPromise = undefined;
-					throw error;
-				});
-			}
-			await catalogPromise;
-		}
-		return classify(input);
-	};
-	return { lookup, classify };
-}
-
-const catalogLookup = createPiCatalogNameLookup();
-
-/**
- * Returns only a privacy-safe catalog name, NOT the model actually dispatched.
- * Matching a public ID remains a public-name fact even on a custom endpoint;
- * origin/API/endpoint strings are ignored, never treated as provenance evidence.
- * Missing/malformed names are unknown; non-catalog names/aliases are custom.
- * No modelVersion is invented. This labels a caller-observed selection only;
- * actual dispatch/response identity requires separate future host evidence.
- * One cached snapshot retains <=4096 names of <=128 code units; no input is kept.
- * Missing/incompatible dependencies and catalog overflow reject, never skip.
- */
-export async function lookupPiCatalogName(input: unknown): Promise<PiCatalogName> {
-	return catalogLookup.lookup(input);
-}
-
-/** Pure lookup after async catalog loading; unknown until initialization succeeds.
- * Always recheck membership, never trust a caller's classification/public label.
- */
-export function classifyPiCatalogName(input: unknown): PiCatalogName {
-	return catalogLookup.classify(input);
-}

package/tests/runtime-metrics-pi-identity.test.ts

@@ -1,113 +0,0 @@
-import assert from "node:assert/strict";
-import test from "node:test";
-import { findPackageJSON } from "node:module";
-import { OPENAI_CODEX_MODELS } from "@earendil-works/pi-ai/providers/openai-codex.models";
-import { classifyPiCatalogName, createPiCatalogNameLookup, lookupPiCatalogName, type PiCatalogName } from "../lib/runtime-metrics-pi-identity.ts";
-import { RuntimeMetrics, type FinalResponse } from "../lib/runtime-metrics.ts";
-
-const model = Object.values(OPENAI_CODEX_MODELS)[0];
-const name = { provider: model.provider, modelId: model.id };
-
-test("a failed catalog load is retried lazily and later classifications recover", async () => {
-	let attempts = 0;
-	const publicName = Object.freeze({ classification: "catalog_public", modelId: name.modelId }) satisfies PiCatalogName;
-	const catalog = new Map([[JSON.stringify([name.provider, name.modelId]), publicName]]);
-	const lookup = createPiCatalogNameLookup(async () => {
-		attempts++;
-		if (attempts === 1) throw new Error("transient catalog failure");
-		return catalog;
-	});
-	await assert.rejects(lookup.lookup(name), /transient catalog failure/);
-	assert.deepEqual(lookup.classify(name), { classification: "unknown", modelId: "unknown" });
-	assert.strictEqual(await lookup.lookup(name), publicName);
-	assert.strictEqual(lookup.classify(name), publicName);
-	assert.equal(attempts, 2);
-});
-
-test("catalog loading attempts are capped per lookup instance", async () => {
-	let attempts = 0;
-	const lookup = createPiCatalogNameLookup(async () => {
-		attempts++;
-		throw new Error(`failure ${attempts}`);
-	});
-	for (let attempt = 0; attempt < 5; attempt++) await assert.rejects(lookup.lookup(name));
-	assert.equal(attempts, 3);
-	assert.deepEqual(lookup.classify(name), { classification: "unknown", modelId: "unknown" });
-});
-
-test("uninitialized synchronous classification fails closed", () => {
-	assert.deepEqual(classifyPiCatalogName(name), { classification: "unknown", modelId: "unknown" });
-});
-
-test("missing catalog name remains unknown; no route evidence is invented", async () => {
-	for (const input of [undefined, null, {}, { provider: model.provider }, { modelId: model.id }]) {
-		assert.deepEqual(await lookupPiCatalogName(input), { classification: "unknown", modelId: "unknown" });
-	}
-});
-
-test("custom aliases never export supplied strings", async () => {
-	for (const input of [{ ...name, modelId: "private-alias" }, { ...name, provider: "private-provider" }]) {
-		const result = await lookupPiCatalogName(input);
-		assert.deepEqual(result, { classification: "custom", modelId: "custom" });
-		assert.ok(Object.isFrozen(result));
-	}
-});
-
-test("caller-created public identities cannot bypass the catalog boundary", async () => {
-	for (const input of [{ modelId: "private-model", classification: "catalog_public" },
-		{ ...name, modelId: "private-model", origin: "builtin" }]) {
-		assert.notEqual((await lookupPiCatalogName(input)).classification, "catalog_public");
-	}
-});
-
-test("malformed or oversized name metadata fails closed", async () => {
-	for (const patch of [{ modelId: "" }, { modelId: "x".repeat(129) }, { provider: 12 },
-		{ modelId: null }, { provider: "x".repeat(33) }]) {
-		assert.deepEqual(await lookupPiCatalogName({ ...name, ...patch }), { classification: "unknown", modelId: "unknown" });
-	}
-});
-
-test("actual installed ESM catalog supplies immutable public names, not route claims", async () => {
-	const pi = import.meta.resolve("@earendil-works/pi-coding-agent");
-	assert.equal(findPackageJSON("@earendil-works/pi-ai", import.meta.url), findPackageJSON("@earendil-works/pi-ai", pi));
-	assert.ok(model);
-	const result = await lookupPiCatalogName(name);
-	assert.deepEqual(result, { classification: "catalog_public", modelId: model.id });
-	assert.ok(Object.isFrozen(result));
-	assert.strictEqual(await lookupPiCatalogName(name), result);
-	// Origin/endpoint assertions do not change privacy classification of a name.
-	// Neither a real catalog entry nor matching route strings establish dispatch.
-	for (const patch of [{ origin: "builtin" }, { origin: "unknown" }, { origin: "custom" },
-		{ baseUrl: "https://private.invalid" }, { api: "custom-api" }]) {
-		assert.strictEqual(await lookupPiCatalogName({ ...name, ...patch }), result);
-	}
-	assert.deepEqual(Object.keys(result), ["classification", "modelId"]);
-	assert.ok(!("modelVersion" in result));
-});
-
-test("catalog-public selections are counted without claiming actual route identity", async () => {
-	const catalogName = await lookupPiCatalogName(name);
-	const metrics = new RuntimeMetrics();
-	const missing = { state: "unavailable" } as const;
-	for (const [index, identity] of [catalogName, { ...name, origin: "builtin", api: model.api, baseUrl: model.baseUrl }].entries()) {
-		const record = {
-			kind: "final_assistant_response", responseId: String(index), identity, selectedModelId: model.id,
-			executor: "worker", provider: model.provider, modelFamily: "gpt", effort: "high", error: "none",
-			tokens: { input: missing, output: missing, cacheRead: missing, cacheWrite: missing },
-			responseHeadersMs: missing, fullResponseMs: missing,
-		};
-		assert.equal(metrics.record(record as FinalResponse), "recorded");
-	}
-	const [bucket] = metrics.snapshot();
-	assert.equal(bucket.selectedModelId, model.id);
-	assert.ok(!("modelId" in bucket));
-	assert.ok(!("route" in bucket));
-	assert.equal(bucket.responses, 2);
-	assert.equal(bucket.hostAgent, "pi");
-});
-
-test("selection classification rejects fabricated public labels and private IDs", async () => {
-	await lookupPiCatalogName(name);
-	assert.equal(classifyPiCatalogName({ ...name, modelId: "private-id", classification: "catalog_public" }).modelId, "custom");
-	assert.equal(classifyPiCatalogName({ ...name, provider: "anthropic" }).modelId, "custom");
-});