gentle-pi 2.7.0 → 3.0.0

package/tests/profile-pin.test.ts

@@ -0,0 +1,370 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test, { after } from "node:test";
+import { createProfile, emptyProfilesFile, profilesFilePath, writeProfilesFileSync } from "../lib/agent-profiles.ts";
+import {
+	PROFILE_PIN_KIND,
+	PROFILE_PIN_VERSION,
+	REPO_PROFILE_DECLARATION_GITIGNORE_RULES,
+	clearProfilePinSync,
+	evaluateProfilePin,
+	localProfilePinPath,
+	normalizeProfilePin,
+	parseProfilePinText,
+	readProfilePin,
+	readProfilePinResult,
+	readProfilePinStatus,
+	repoProfileDeclarationPath,
+	resolveProfilePin,
+	serializeProfilePin,
+	setProfilePinWorktreeResolverForTesting,
+	writeProfilePinSync,
+} from "../lib/agent-profile-pin.ts";
+import type { AgentModelConfig } from "../lib/model-routing-authority.ts";
+import type { WorktreeIdentity } from "../lib/session-worktree-registry.ts";
+
+// Per-repository agent-model profile pins: two layers holding only a profile name,
+// resolved at launch against the global profiles store. These tests never touch
+// Git; the worktree identity is injected, which is also how the launch path binds
+// the pin to the repository the child will work in.
+
+const root = mkdtempSync(join(tmpdir(), "gentle-pi-profile-pin-"));
+after(() => rmSync(root, { recursive: true, force: true }));
+
+function identityAt(name: string): WorktreeIdentity {
+	return { root: join(root, name, "worktree"), commonDir: join(root, name, "git-common") };
+}
+
+function storeAt(configHome: string, profiles: Record<string, AgentModelConfig>): void {
+	const file = Object.entries(profiles).reduce(
+		(current, [name, config]) => createProfile(current, name, config),
+		emptyProfilesFile(),
+	);
+	writeProfilesFileSync(profilesFilePath(configHome), file);
+}
+
+test("pin paths follow the shared clone and the worktree", () => {
+	assert.equal(localProfilePinPath("/clone/.git"), join("/clone/.git", "gentle-ai", "profile-pin.json"));
+	assert.equal(repoProfileDeclarationPath("/clone"), join("/clone", ".pi", "gentle-ai", "profile.json"));
+});
+
+test("the suggested ignore rules expose only the repository declaration", () => {
+	const repo = join(root, "ignored-declaration");
+	mkdirSync(repo, { recursive: true });
+	execFileSync("git", ["init", "--quiet", repo]);
+	writeFileSync(join(repo, ".gitignore"), ".pi/\n");
+	writeProfilePinSync(repoProfileDeclarationPath(repo), "team");
+	writeFileSync(join(repo, ".pi", "gentle-ai", "private.json"), "private\n");
+	writeFileSync(join(repo, ".pi", "other.json"), "other\n");
+	writeFileSync(
+		join(repo, ".gitignore"),
+		`.pi/\n${REPO_PROFILE_DECLARATION_GITIGNORE_RULES.join("\n")}\n`,
+	);
+	const visible = execFileSync(
+		"git",
+		["-C", repo, "ls-files", "--others", "--exclude-standard", "--", ".pi"],
+		{ encoding: "utf8" },
+	).trim().split(/\r?\n/).filter(Boolean);
+	assert.deepEqual(visible, [".pi/gentle-ai/profile.json"]);
+});
+
+test("the pin artifact is byte-identical for the same profile", () => {
+	const text = serializeProfilePin("deep-work");
+	assert.equal(
+		text,
+		[
+			"{",
+			`  "kind": "${PROFILE_PIN_KIND}",`,
+			`  "version": ${PROFILE_PIN_VERSION},`,
+			'  "profile": "deep-work"',
+			"}",
+			"",
+		].join("\n"),
+	);
+	assert.equal(serializeProfilePin("deep-work"), text, "stable key order and indentation");
+	assert.deepEqual(parseProfilePinText(text), { status: "valid", profile: "deep-work" });
+});
+
+test("the pin parser rejects foreign kinds, versions, names, and malformed input", () => {
+	const invalid = [
+		"{",
+		"[]",
+		"null",
+		'"deep-work"',
+		JSON.stringify({ kind: "gentle-pi.agent_model_profiles", version: 1, profile: "deep-work" }),
+		JSON.stringify({ kind: PROFILE_PIN_KIND, version: 2, profile: "deep-work" }),
+		JSON.stringify({ kind: PROFILE_PIN_KIND, version: 1 }),
+		JSON.stringify({ kind: PROFILE_PIN_KIND, version: 1, profile: "not a name" }),
+		JSON.stringify({ kind: PROFILE_PIN_KIND, version: 1, profile: "__proto__" }),
+		JSON.stringify({ kind: PROFILE_PIN_KIND, version: 1, profile: "" }),
+	];
+	for (const text of invalid) assert.deepEqual(parseProfilePinText(text), { status: "invalid" }, text);
+});
+
+test("writeProfilePinSync creates parents, round-trips, and leaves no temp file behind", () => {
+	const path = join(root, "write", "gentle-ai", "profile-pin.json");
+	writeProfilePinSync(path, "deep-work");
+	assert.equal(readFileSync(path, "utf8"), serializeProfilePin("deep-work"));
+	assert.equal(readProfilePin(path), "deep-work");
+	writeProfilePinSync(path, "team");
+	assert.equal(readProfilePin(path), "team");
+	assert.deepEqual(readdirSync(join(root, "write", "gentle-ai")).filter((entry) => entry.includes(".tmp")), []);
+	assert.equal(readProfilePin(join(root, "write", "absent.json")), undefined);
+});
+
+test("an invalid pin file reads as no pin, and an illegal name is refused before writing", () => {
+	const dir = join(root, "invalid");
+	mkdirSync(dir, { recursive: true });
+	const malformed = join(dir, "profile-pin.json");
+	writeFileSync(malformed, "{ not json\n");
+	assert.equal(readProfilePin(malformed), undefined);
+	writeFileSync(malformed, JSON.stringify({ kind: PROFILE_PIN_KIND, version: 1, profile: "bad name" }));
+	assert.equal(readProfilePin(malformed), undefined);
+	const refused = join(dir, "refused.json");
+	assert.throws(() => writeProfilePinSync(refused, "bad name"), /Invalid profile name/);
+	assert.equal(existsSync(refused), false);
+});
+
+test("readProfilePinStatus reads both layers and reports nothing outside a Git worktree", () => {
+	const identity = identityAt("status");
+	// A local pin alone: the declaration is still reported as absent rather than
+	// inferred from the layer that won.
+	mkdirSync(identity.commonDir, { recursive: true });
+	writeProfilePinSync(localProfilePinPath(identity.commonDir), "team");
+	const status = readProfilePinStatus(identity.root, () => identity);
+	assert.ok(status);
+	assert.equal(status.root, identity.root);
+	assert.equal(status.commonDir, identity.commonDir);
+	assert.equal(status.localPath, localProfilePinPath(identity.commonDir));
+	assert.equal(status.repoPath, repoProfileDeclarationPath(identity.root));
+	assert.deepEqual(status.local, { status: "valid", profile: "team" });
+	assert.deepEqual(status.repo, { status: "missing" });
+	assert.equal(readProfilePinStatus(identity.root, () => undefined), undefined);
+	assert.equal(
+		readProfilePinStatus(identity.root, () => {
+			throw new Error("git is unavailable");
+		}),
+		undefined,
+		"a failing resolver reads as no pin instead of failing the panel",
+	);
+});
+
+test("an ambient Git identity miss is retried after the directory becomes a repository", () => {
+	const repo = join(root, "late-git-init");
+	mkdirSync(repo, { recursive: true });
+	assert.equal(readProfilePinStatus(repo), undefined);
+	execFileSync("git", ["init", "--quiet", repo]);
+	const status = readProfilePinStatus(repo);
+	assert.ok(status, "a prior miss must not hide a Git identity that appeared later");
+	assert.equal(status.repoPath, repoProfileDeclarationPath(status.root));
+});
+
+test("an ambient Git identity is resolved again after the repository identity changes", () => {
+	const cwd = join(root, "replaced-repository");
+	const before = identityAt("replaced-before");
+	const afterReplacement = identityAt("replaced-after");
+	let calls = 0;
+	setProfilePinWorktreeResolverForTesting(() => {
+		calls += 1;
+		return calls === 1 ? before : afterReplacement;
+	});
+	try {
+		assert.equal(readProfilePinStatus(cwd)?.root, before.root);
+		assert.equal(readProfilePinStatus(cwd)?.root, afterReplacement.root);
+		assert.equal(calls, 2, "each status read observes the repository identity that exists now");
+	} finally {
+		setProfilePinWorktreeResolverForTesting();
+	}
+});
+
+test("resolveProfilePin prefers the local pin and returns role entries without the orchestrator", () => {
+	const identity = identityAt("precedence");
+	const configHome = join(root, "precedence", "config");
+	storeAt(configHome, {
+		"local-choice": {
+			orchestrator: { model: "nan/glm5.3" },
+			explore: { model: "openai/alpha", thinking: "minimal" },
+		},
+		"declared-choice": { explore: { model: "openai/beta" } },
+	});
+	writeProfilePinSync(localProfilePinPath(identity.commonDir), "local-choice");
+	writeProfilePinSync(repoProfileDeclarationPath(identity.root), "declared-choice");
+	const resolved = resolveProfilePin({ cwd: identity.root, configHome, resolveWorktree: () => identity });
+	assert.ok(resolved);
+	assert.equal(resolved.source, "local");
+	assert.equal(resolved.profile, "local-choice");
+	assert.equal(resolved.path, localProfilePinPath(identity.commonDir));
+	assert.deepEqual(resolved.modelProfiles, { explore: { model: "openai/alpha", thinking: "minimal" } });
+	assert.equal("orchestrator" in resolved.modelProfiles, false, "the orchestrator is not subagent routing");
+});
+
+test("resolveProfilePin falls back to the repository declaration", () => {
+	const identity = identityAt("declaration");
+	const configHome = join(root, "declaration", "config");
+	storeAt(configHome, { declared: { explore: { model: "openai/beta" } } });
+	writeProfilePinSync(repoProfileDeclarationPath(identity.root), "declared");
+	const resolved = resolveProfilePin({ cwd: identity.root, configHome, resolveWorktree: () => identity });
+	assert.ok(resolved);
+	assert.equal(resolved.source, "repo");
+	assert.equal(resolved.profile, "declared");
+	assert.equal(resolved.path, repoProfileDeclarationPath(identity.root));
+	assert.deepEqual(resolved.modelProfiles, { explore: { model: "openai/beta", thinking: undefined } });
+});
+
+test("a stale or invalid local layer does not mask a usable repository declaration", () => {
+	const identity = identityAt("stale");
+	const configHome = join(root, "stale", "config");
+	storeAt(configHome, { declared: { explore: { model: "openai/beta" } } });
+	writeProfilePinSync(repoProfileDeclarationPath(identity.root), "declared");
+	// The local pin names a profile the store no longer defines, which must degrade
+	// to the next layer instead of failing every launch in the clone.
+	writeProfilePinSync(localProfilePinPath(identity.commonDir), "deleted-profile");
+	assert.equal(
+		resolveProfilePin({ cwd: identity.root, configHome, resolveWorktree: () => identity })?.profile,
+		"declared",
+	);
+	writeFileSync(localProfilePinPath(identity.commonDir), "{ not json\n");
+	assert.equal(
+		resolveProfilePin({ cwd: identity.root, configHome, resolveWorktree: () => identity })?.profile,
+		"declared",
+	);
+});
+
+test("with no usable layer and no readable store, resolveProfilePin reports no pin", () => {
+	const identity = identityAt("absent");
+	const configHome = join(root, "absent", "config");
+	storeAt(configHome, { team: { explore: { model: "openai/alpha" } } });
+	// No pin file at all: today's global routing, and the store is not even read.
+	assert.equal(resolveProfilePin({ cwd: identity.root, configHome, resolveWorktree: () => identity }), undefined);
+	writeProfilePinSync(repoProfileDeclarationPath(identity.root), "team");
+	// A store that was deleted or corrupted leaves the pin unresolvable; the launch
+	// keeps the global routing instead of throwing.
+	const missingStore = join(root, "absent", "missing-config");
+	assert.equal(
+		resolveProfilePin({ cwd: identity.root, configHome: missingStore, resolveWorktree: () => identity }),
+		undefined,
+	);
+	const invalidStore = join(root, "absent", "invalid-config");
+	mkdirSync(invalidStore, { recursive: true });
+	writeFileSync(profilesFilePath(invalidStore), "{ not json\n");
+	assert.equal(
+		resolveProfilePin({ cwd: identity.root, configHome: invalidStore, resolveWorktree: () => identity }),
+		undefined,
+	);
+	// A session outside every Git worktree can never carry a pin.
+	assert.equal(resolveProfilePin({ cwd: identity.root, configHome, resolveWorktree: () => undefined }), undefined);
+});
+
+test("the read result separates a missing pin from a file that is not a pin", () => {
+	const dir = join(root, "read-result");
+	mkdirSync(dir, { recursive: true });
+	const missing = join(dir, "missing.json");
+	assert.deepEqual(readProfilePinResult(missing), { status: "missing" });
+	const invalid = join(dir, "invalid.json");
+	writeFileSync(invalid, "{ not json\n");
+	assert.deepEqual(readProfilePinResult(invalid), { status: "invalid" });
+	const valid = join(dir, "valid.json");
+	writeProfilePinSync(valid, "team");
+	assert.deepEqual(readProfilePinResult(valid), { status: "valid", profile: "team" });
+});
+
+test("clearProfilePinSync removes a pin and tolerates an already-missing file", () => {
+	const path = join(root, "clear", "gentle-ai", "profile-pin.json");
+	writeProfilePinSync(path, "team");
+	clearProfilePinSync(path);
+	assert.equal(existsSync(path), false);
+	assert.doesNotThrow(() => clearProfilePinSync(path), "clearing a missing pin is already the desired state");
+});
+
+test("evaluateProfilePin reports the winner, invalid files by path, and stale names without hiding a lower layer", () => {
+	const identity = identityAt("evaluate");
+	mkdirSync(identity.commonDir, { recursive: true });
+	// No layers at all: nothing wins and nothing is reported.
+	assert.deepEqual(evaluateProfilePin(readProfilePinStatus(identity.root, () => identity), { team: {} }), { invalid: [], stale: [] });
+	// A stale local layer is reported AND does not mask a usable declaration.
+	writeProfilePinSync(localProfilePinPath(identity.commonDir), "deleted-profile");
+	writeProfilePinSync(repoProfileDeclarationPath(identity.root), "declared");
+	const evaluation = evaluateProfilePin(readProfilePinStatus(identity.root, () => identity), { declared: {} });
+	assert.deepEqual(evaluation.winner, {
+		source: "repo",
+		profile: "declared",
+		path: repoProfileDeclarationPath(identity.root),
+	});
+	assert.deepEqual(evaluation.stale, [{
+		source: "local",
+		profile: "deleted-profile",
+		path: localProfilePinPath(identity.commonDir),
+	}]);
+	// A file that is not a pin is reported by its exact path, separately from a stale
+	// name, and still does not mask the declaration below it.
+	writeFileSync(localProfilePinPath(identity.commonDir), "{ not json\n");
+	const invalid = evaluateProfilePin(readProfilePinStatus(identity.root, () => identity), { declared: {} });
+	assert.deepEqual(invalid.invalid, [{ source: "local", path: localProfilePinPath(identity.commonDir) }]);
+	assert.deepEqual(invalid.winner, {
+		source: "repo",
+		profile: "declared",
+		path: repoProfileDeclarationPath(identity.root),
+	});
+});
+
+test("resolveProfilePin carries both read layers and the invalid and stale reports", () => {
+	const identity = identityAt("carry");
+	const configHome = join(root, "carry", "config");
+	storeAt(configHome, { declared: { explore: { model: "openai/beta" } } });
+	writeProfilePinSync(repoProfileDeclarationPath(identity.root), "declared");
+	// Create the local layer as a real pin first, then corrupt it, so the parent
+	// directory exists without depending on any other helper.
+	writeProfilePinSync(localProfilePinPath(identity.commonDir), "deleted-profile");
+	writeFileSync(localProfilePinPath(identity.commonDir), "{ not json\n");
+	const resolved = resolveProfilePin({ cwd: identity.root, configHome, resolveWorktree: () => identity });
+	assert.ok(resolved);
+	assert.equal(resolved.profile, "declared");
+	assert.deepEqual(resolved.status.local, { status: "invalid" });
+	assert.deepEqual(resolved.status.repo, { status: "valid", profile: "declared" });
+	assert.deepEqual(resolved.invalidLayers, [{ source: "local", path: localProfilePinPath(identity.commonDir) }]);
+	assert.deepEqual(resolved.staleLayers, []);
+});
+
+test("two worktrees of one clone read the same clone-local pin but keep their own declaration", () => {
+	const commonDir = join(root, "shared", "git-common");
+	const firstWorktree = join(root, "shared", "worktree-a");
+	const secondWorktree = join(root, "shared", "worktree-b");
+	writeProfilePinSync(localProfilePinPath(commonDir), "team");
+	const first = readProfilePinStatus(firstWorktree, () => ({ root: firstWorktree, commonDir }));
+	const second = readProfilePinStatus(secondWorktree, () => ({ root: secondWorktree, commonDir }));
+	assert.deepEqual(first?.local, { status: "valid", profile: "team" });
+	assert.deepEqual(second?.local, { status: "valid", profile: "team" }, "the local pin lives in the shared Git common directory");
+	assert.deepEqual(second?.repo, { status: "missing" }, "the declaration is per worktree, not shared with the sibling");
+});
+
+test("each status read resolves the current worktree identity and injected resolvers stay isolated", () => {
+	let calls = 0;
+	const injected = identityAt("memo-injected");
+	setProfilePinWorktreeResolverForTesting((cwd) => {
+		calls += 1;
+		return { root: join(cwd, "worktree"), commonDir: join(cwd, "git-common") };
+	});
+	try {
+		readProfilePinStatus(join(root, "memo-a"));
+		readProfilePinStatus(join(root, "memo-a"));
+		assert.equal(calls, 2, "each status read resolves the identity that exists now");
+		readProfilePinStatus(join(root, "memo-b"));
+		assert.equal(calls, 3, "a second directory resolves its own identity");
+		// A resolver injected per call remains independent from the ambient seam.
+		readProfilePinStatus(join(root, "memo-a"), () => injected);
+		assert.equal(calls, 3, "the injected resolver does not touch the ambient resolver");
+	} finally {
+		setProfilePinWorktreeResolverForTesting();
+	}
+});
+
+test("normalizeProfilePin accepts only a value-level pin this version writes", () => {
+	assert.equal(normalizeProfilePin({ kind: PROFILE_PIN_KIND, version: PROFILE_PIN_VERSION, profile: "deep-work" }), "deep-work");
+	assert.equal(normalizeProfilePin({ kind: PROFILE_PIN_KIND, version: 2, profile: "deep-work" }), undefined);
+	assert.equal(normalizeProfilePin({ kind: "other", version: PROFILE_PIN_VERSION, profile: "deep-work" }), undefined);
+	assert.equal(normalizeProfilePin({ kind: PROFILE_PIN_KIND, version: PROFILE_PIN_VERSION, profile: "bad name" }), undefined);
+	assert.equal(normalizeProfilePin("deep-work"), undefined);
+});

package/tests/quiet-tool-rendering.test.ts

@@ -71,6 +71,7 @@ function createPi(options: { throwOnToolConflict?: boolean } = {}) {
 	const hooks = new Map<string, any[]>();
 	return {
 		tools,
+		hooks,
 		pi: {
 			registerTool(tool: any) {
 				if (options.throwOnToolConflict && tools.has(tool.name)) {
@@ -232,9 +233,35 @@ test("pi-pretty suppresses overlapping tools before quiet tools register", async
 	);
 });
 
+test("pi-pretty preserves byte-exact model-visible read results when quiet tools suppress its renderer", async () => {
+	await withEnvAsync(
+		{ GENTLE_PI_QUIET_TOOLS: undefined, PRETTY_DISABLE_TOOLS: undefined },
+		async () => {
+			const { pi, hooks } = createPi();
+			await piPretty(pi as any, fakePiPrettyDeps as any);
+
+			const original = "[alpha]\ntarget=old\n\n[beta]\ntarget=old\n";
+			let event: any = {
+				toolName: "read",
+				content: [{ type: "text", text: original }],
+			};
+			for (const handler of hooks.get("tool_result") ?? []) {
+				const replacement = await handler(event, {});
+				if (replacement) event = { ...event, ...replacement };
+			}
+
+			assert.equal(event.content[0]?.text, original);
+		},
+	);
+});
+
 test("pi-pretty suppression is skipped when quiet tools are disabled", async () => {
 	await withEnvAsync(
-		{ GENTLE_PI_QUIET_TOOLS: "0", PRETTY_DISABLE_TOOLS: undefined },
+		{
+			GENTLE_PI_QUIET_TOOLS: "0",
+			PRETTY_DISABLE_TOOLS: undefined,
+			PRETTY_ENABLE_TOOLS: "ls",
+		},
 		async () => {
 			const { pi, tools } = createPi();
 
@@ -426,8 +453,8 @@ test("quiet tool rendering identifies only routine Gentle AI SDD and RDD command
 	assert.equal(gentleAiRoutineCommand({ command: "./.gentle-ai/v2.2.0/gentle-ai sdd-status rose --json" }), "sdd-status");
 	assert.equal(gentleAiRoutineCommand({ command: ".\\.gentle-ai\\v2.2.0\\gentle-ai.exe review status --next-transition" }), "review");
 	assert.equal(gentleAiRoutineCommand({ command: "C:\\package\\.gentle-ai\\v2.2.0\\gentle-ai.exe sdd-continue rose" }), "sdd-continue");
-	assert.equal(gentleAiRoutineCommand({ command: "gentle-ai sdd-attempt acquire --change fix-rose" }), "sdd-attempt");
-	assert.equal(gentleAiRoutineCommand({ command: "gentle-ai sdd-attempt settle --change fix-rose" }), "sdd-attempt");
+	assert.equal(gentleAiRoutineCommand({ command: "gentle-ai sdd-attempt acquire --change fix-rose" }), undefined);
+	assert.equal(gentleAiRoutineCommand({ command: "gentle-ai sdd-attempt settle --change fix-rose" }), undefined);
 	assert.equal(gentleAiRoutineCommand({ command: "gentle-ai review status --next-transition" }), "review");
 	assert.equal(gentleAiRoutineCommand({ command: "gentle-ai version" }), undefined);
 	assert.equal(gentleAiRoutineCommand({ command: "gentle-ai sdd-attempt inspect" }), undefined);
@@ -591,8 +618,8 @@ test("quiet tool rendering displays only finite safe Gentle AI operation paths",
 	const cases = [
 		["gentle-ai sdd-status change-123 --cwd /repo/private", "sdd status"],
 		["gentle-ai sdd-continue change-123 --json", "sdd continue"],
-		["gentle-ai sdd-attempt acquire --change change-123", "sdd attempt acquire"],
-		["gentle-ai sdd-attempt settle --change change-123 --actor maintainer", "sdd attempt settle"],
+		["gentle-ai sdd-attempt acquire --change change-123", "sdd attempt"],
+		["gentle-ai sdd-attempt settle --change change-123 --actor maintainer", "sdd attempt"],
 		["gentle-ai review capabilities --cwd /repo/private", "review capabilities"],
 		["gentle-ai review start --target sha256:secret --path src/private.ts", "review start"],
 		["gentle-ai review finalize --lineage lineage-secret --payload '{\"secret\":true}'", "review finalize"],

package/tests/review-contract-prompt.test.ts

@@ -62,6 +62,12 @@ test("before_agent_start injects the mirrored review execution contract for the
 	const { beforeAgentStart } = harness({} as NativeReviewCli);
 	const result = await beforeAgentStart(primaryEvent, ctx());
 	const expected = mirroredPiOrchestrationText();
+	assert.match(result.systemPrompt, /Substantial authorized work: use ODD/);
+	assert.match(result.systemPrompt, /Use configured TDD mode, source, and exact runner/);
+	assert.match(result.systemPrompt, /test presence does not enable it/);
+	assert.doesNotMatch(result.systemPrompt, /If tests exist, use strict TDD/);
+	assert.match(result.systemPrompt, /ODD \(Default Workflow, harness section above\) is mandatory on every request/);
+	assert.doesNotMatch(result.systemPrompt, /Prefer SDD\/OpenSpec artifacts/);
 	assert.match(result.systemPrompt, /## Gentle AI review execution contract \(mirrored provider bundle 1\.2\.0\)/);
 	assert.ok(result.systemPrompt.includes(expected), "the mirrored orchestration/pi.md text must appear verbatim");
 	assert.match(result.systemPrompt, /call `gentle_review` with {"operation":"inspect"}/);
@@ -97,6 +103,7 @@ test("before_agent_start does not inject the review execution contract for gentl
 	const { beforeAgentStart } = harness({} as NativeReviewCli);
 	const result = await beforeAgentStart({ agentName: "gentle-ai-worker", systemPrompt: "base" }, ctx());
 	assert.equal(result.systemPrompt, "base");
+	assert.doesNotMatch(result.systemPrompt, /Substantial authorized work: use ODD/);
 	assert.doesNotMatch(result.systemPrompt, /Gentle AI review execution contract/);
 });
 
@@ -104,12 +111,14 @@ test("before_agent_start does not inject the review execution contract for jd-fi
 	const { beforeAgentStart } = harness({} as NativeReviewCli);
 	const result = await beforeAgentStart({ agentName: "jd-fix-agent", systemPrompt: "base" }, ctx());
 	assert.equal(result.systemPrompt, "base");
+	assert.doesNotMatch(result.systemPrompt, /Substantial authorized work: use ODD/);
 	assert.doesNotMatch(result.systemPrompt, /Gentle AI review execution contract/);
 });
 
 test("before_agent_start does not inject the review execution contract for an SDD executor session", async () => {
 	const { beforeAgentStart } = harness({} as NativeReviewCli);
 	const result = await beforeAgentStart({ systemPrompt: "SDD apply executor body" }, ctx());
+	assert.doesNotMatch(result.systemPrompt, /Substantial authorized work: use ODD/);
 	assert.doesNotMatch(result.systemPrompt, /Gentle AI review execution contract/);
 });
 

package/tests/review-controller.test.ts

@@ -189,50 +189,6 @@ function createTerminalAuthority(fixture: RepositoryFixture, lineageId: string,
 	}
 }
 
-test("controller SDD status treats removed OpenSpec recovery authority and deleted marker as blocking", async (t) => {
-	const fixture = createRepository(t);
-	const changeName = "recover-legacy-review-authority";
-	const changeRoot = join(fixture.repository, "openspec", "changes", changeName);
-	mkdirSync(changeRoot, { recursive: true });
-	writeFileSync(join(fixture.repository, "app.ts"), "export const value = 2;\n");
-	git(fixture.repository, "add", "app.ts");
-	const completeTree = git(fixture.repository, "write-tree");
-	createTerminalAuthority(fixture, "archived-graph-source", completeTree);
-	const supersessionRoot = join(resolveRepositoryAuthorityV1(fixture.repository).store_root, "control", "authority-supersession-v1");
-	const marker = join(supersessionRoot, "recovery-required-v1", `${domainHashV1("openspec-change-name", changeName)}.json`);
-	mkdirSync(join(supersessionRoot, "recovery-required-v1"), { recursive: true });
-	writeFileSync(marker, "recovery-required");
-	rmSync(changeRoot, { recursive: true, force: true });
-	unlinkSync(marker);
-
-	const status = await __testing.resolveControllerSddStatus(fixture.repository, changeName, false, "openspec");
-
-	assert.equal(status.dependencies.archive, "blocked");
-	assert.equal(status.nextRecommended, "blocked");
-	assert.match(status.blockedReasons.join("\n"), /active change not found/i);
-});
-
-test("controller SDD status ignores recovery-required review markers after terminal burn", async (t) => {
-	const fixture = createRepository(t);
-	const changeName = "recover-legacy-review-authority";
-	const changeRoot = join(fixture.repository, "openspec", "changes", changeName);
-	mkdirSync(join(changeRoot, "specs", "review"), { recursive: true });
-	writeFileSync(join(changeRoot, "proposal.md"), "# Proposal\n");
-	writeFileSync(join(changeRoot, "specs", "review", "spec.md"), "# Spec\n");
-	writeFileSync(join(changeRoot, "design.md"), "# Design\n");
-	writeFileSync(join(changeRoot, "tasks.md"), "- [x] 1.1 Done\n");
-	writeFileSync(join(changeRoot, "verify-report.md"), "PASS\n");
-	writeFileSync(join(changeRoot, "sync-report.md"), "PASS\n");
-	const markerDirectory = join(resolveRepositoryAuthorityV1(fixture.repository).store_root, "control", "authority-supersession-v1", "recovery-required-v1");
-	mkdirSync(markerDirectory, { recursive: true });
-	writeFileSync(join(markerDirectory, `${domainHashV1("openspec-change-name", changeName)}.json`), "recovery-required");
-
-	const status = await __testing.resolveControllerSddStatus(fixture.repository, changeName, false, "openspec");
-
-	assert.equal(status.dependencies.archive, "ready");
-	assert.equal(status.nextRecommended, "sdd-archive");
-});
-
 test("controller keeps graph-v1 ordinary mutation read-only while preserving repository-file input confinement", async (t) => {
 	const fixture = createRepository(t);
 	const lineageId = "controller-file-validator";