gentle-pi 3.7.0 → 4.1.0

package/runtime/review-integration-v2.mjs

@@ -78,8 +78,8 @@ export const REVIEW_START_STATE = {
 const START_ACTIONS = ["created", "resumed", "closed", "blocked-scope-action"]         ;
 const RISK_LEVELS = ["low", "medium", "high"]         ;
 const REVIEW_LENSES = ["review-risk", "review-resilience", "review-readability", "review-reliability"]         ;
-const RISK_REASON_CODES = ["configuration_change", "empty_content", "executable_change", "executable_mode", "hot_path", "large_change", "non_executable_only", "process_boundary", "process_scan_limit", "service_token", "shell_source"]         ;
-const RISK_SIGNALS = ["auth", "update", "security", "payments", "permissions", "shell_process"]         ;
+const RISK_REASON_CODES = ["agent_escalation", "configuration_change", "dangerous_sink", "empty_content", "executable_change", "executable_mode", "hot_path", "large_change", "non_executable_only", "process_boundary", "process_scan_limit", "service_token", "shell_source"]         ;
+const RISK_SIGNALS = ["auth", "update", "security", "payments", "permissions", "shell_process", "dangerous_sink", "agent_escalation"]         ;
 // "collect" and "execute" are the v2 envelope's projection of a live
 // transaction whose next_transition is mandatory: the root action names the
 // transition kind instead of reading as a terminal stop.
@@ -637,6 +637,23 @@ const ESCALATION_REFUTER_OUTCOMES = ["corroborated", "refuted", "inconclusive"]
 
 
 
+function decodeReviewEscalationV1(value         , label        )                     {
+	const source = exactRecord(value, label, ["cause", "finding_ids"], ["refuter_outcomes"]);
+	const escalation                     = {
+		cause: enumeration(source.cause, ESCALATION_CAUSES, `${label}.cause`),
+		findingIds: stringArray(source.finding_ids, `${label}.finding_ids`),
+	};
+	if (Object.hasOwn(source, "refuter_outcomes")) escalation.refuterOutcomes = array(source.refuter_outcomes, `${label}.refuter_outcomes`, (entry, itemLabel) => {
+		const row = exactRecord(entry, itemLabel, ["finding_id", "outcome", "proof"]);
+		return {
+			findingId: nonempty(row.finding_id, `${itemLabel}.finding_id`),
+			outcome: enumeration(row.outcome, ESCALATION_REFUTER_OUTCOMES, `${itemLabel}.outcome`),
+			proof: nonempty(row.proof, `${itemLabel}.proof`),
+		};
+	});
+	return escalation;
+}
+
 
 
 
@@ -2105,23 +2122,9 @@ export function decodeReviewStatusV3(value         )                 {
 		};
 	}
 
-	let escalation                                ;
-	if (Object.hasOwn(body, "escalation")) {
-		const label = "status.escalation";
-		const source = exactRecord(body.escalation, label, ["cause", "finding_ids"], ["refuter_outcomes"]);
-		escalation = {
-			cause: enumeration(source.cause, ESCALATION_CAUSES, `${label}.cause`),
-			findingIds: stringArray(source.finding_ids, `${label}.finding_ids`),
-		};
-		if (Object.hasOwn(source, "refuter_outcomes")) escalation.refuterOutcomes = array(source.refuter_outcomes, `${label}.refuter_outcomes`, (entry, itemLabel) => {
-			const row = exactRecord(entry, itemLabel, ["finding_id", "outcome", "proof"]);
-			return {
-				findingId: nonempty(row.finding_id, `${itemLabel}.finding_id`),
-				outcome: enumeration(row.outcome, ESCALATION_REFUTER_OUTCOMES, `${itemLabel}.outcome`),
-				proof: nonempty(row.proof, `${itemLabel}.proof`),
-			};
-		});
-	}
+	const escalation = Object.hasOwn(body, "escalation")
+		? decodeReviewEscalationV1(body.escalation, "status.escalation")
+		: undefined;
 
 	// status/v7 top-level optional digest (gentle-ai v2.6.0): resolves #4066's
 	// closed loop where `sdd-attempt finish` named a digest status never
@@ -2584,7 +2587,11 @@ function assertReviewApprovedAcknowledgementExecuteShapeV1(execute
 	if (execute.arguments.length !== REVIEW_APPROVED_ACKNOWLEDGEMENT_ARGUMENTS.length) throw new TypeError(`acknowledgement.execute.arguments must carry exactly ${REVIEW_APPROVED_ACKNOWLEDGEMENT_ARGUMENTS.length} provider-issued arguments`);
 	const values = execute.arguments.map((argument, index) => { const name = REVIEW_APPROVED_ACKNOWLEDGEMENT_ARGUMENTS[index] ; if (argument.name !== name) throw new TypeError(`acknowledgement.execute.arguments[${index}].name must be ${name}`); const value = nonempty(argument.value, `acknowledgement.execute.arguments[${index}].value`); if (nonempty(argument.token, `acknowledgement.execute.arguments[${index}].token`) !== `--${name}=${value}`) throw new TypeError(`acknowledgement.execute.arguments[${index}].token must exactly match ${name}`); return value; });
 	if (execute.preconditions.length !== 1 || execute.preconditions[0]?.name !== "state" || execute.preconditions[0]?.value !== "approved") throw new TypeError("acknowledgement.execute.preconditions must be the single approved state precondition");
-	return { tokens: execute.arguments.map((argument) => argument.token )                                                , values: values                                                     , lineageId: lineage(execute.binding.lineageId, "acknowledgement.execute.binding.lineage_id"), targetIdentity: sha256(execute.binding.targetIdentity, "acknowledgement.execute.binding.target_identity"), revision: sha256(execute.binding.revision, "acknowledgement.execute.binding.revision") };
+	const tokens = execute.arguments.map((argument) => argument.token );
+	// The exact five-argument check above validates both vectors before tuple construction.
+	const tokenTuple                                               = [tokens[0] , tokens[1] , tokens[2] , tokens[3] , tokens[4] ];
+	const valueTuple                                                    = [values[0] , values[1] , values[2] , values[3] , values[4] ];
+	return { tokens: tokenTuple, values: valueTuple, lineageId: lineage(execute.binding.lineageId, "acknowledgement.execute.binding.lineage_id"), targetIdentity: sha256(execute.binding.targetIdentity, "acknowledgement.execute.binding.target_identity"), revision: sha256(execute.binding.revision, "acknowledgement.execute.binding.revision") };
 }
 
 /**
@@ -2689,6 +2696,28 @@ const REVIEW_LAST_EVENT_CAUSAL_DISPOSITIONS = ["introduced", "behavior-activated
 
 
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -2836,18 +2865,67 @@ function decodeReviewLastEventReviewerResultV1(value         , label        )
 	};
 }
 
+function decodeReviewTargetedValidatorCheckEvidenceV1(value         , label        )                                         {
+	const check = exactRecord(value, label, ["passed", "evidence"], ["regressions"]);
+	const regressions = Object.hasOwn(check, "regressions")
+		? array(check.regressions, `${label}.regressions`, (entry, entryLabel) => {
+			const row = exactRecord(entry, entryLabel, ["location", "claim", "proof_refs"], ["id"]);
+			return {
+				...(Object.hasOwn(row, "id") ? { id: nonempty(row.id, `${entryLabel}.id`) } : {}),
+				location: nonempty(row.location, `${entryLabel}.location`),
+				claim: nonempty(row.claim, `${entryLabel}.claim`),
+				proofRefs: stringArray(row.proof_refs, `${entryLabel}.proof_refs`, { minimum: 1 }),
+			};
+		}) : undefined;
+	return {
+		passed: boolean(check.passed, `${label}.passed`),
+		// Native admission rejects observations containing only Unicode whitespace.
+		evidence: stringArray(check.evidence, `${label}.evidence`, { minimum: 1, pattern: /[^\p{White_Space}]/u }),
+		...(regressions === undefined ? {} : { regressions }),
+	};
+}
+
+function decodeReviewTargetedValidatorEvidenceV1(value         , label        )                                    {
+	const body = exactRecord(value, label, ["targeted_validation_request_hash", "correction_target_identity", "original_criteria", "correction_regression", "follow_ups"]);
+	return {
+		targetedValidationRequestHash: sha256(body.targeted_validation_request_hash, `${label}.targeted_validation_request_hash`),
+		correctionTargetIdentity: sha256(body.correction_target_identity, `${label}.correction_target_identity`),
+		originalCriteria: decodeReviewTargetedValidatorCheckEvidenceV1(body.original_criteria, `${label}.original_criteria`),
+		correctionRegression: decodeReviewTargetedValidatorCheckEvidenceV1(body.correction_regression, `${label}.correction_regression`),
+		followUps: array(body.follow_ups, `${label}.follow_ups`, (entry, entryLabel) => {
+			const row = exactRecord(entry, entryLabel, ["observation", "proof_refs"]);
+			return { observation: nonempty(row.observation, `${entryLabel}.observation`), proofRefs: stringArray(row.proof_refs, `${entryLabel}.proof_refs`, { minimum: 1 }) };
+		}),
+		raw: body,
+	};
+}
+
 export function decodeReviewLastEventClosureV1(value         )                           {
-	const body = exactRecord(value, "last_event_closure", ["schema", "operation", "lineage_id", "state", "store_revision"], ["target_identity", "request_hash", "correction_lines", "action", "advisory_findings", "reviewer_results", "status_continuation", "acknowledgement"]);
+	const body = exactRecord(value, "last_event_closure", ["schema", "operation", "lineage_id", "state", "store_revision"], ["target_identity", "request_hash", "correction_lines", "action", "escalation", "targeted_validator_evidence", "advisory_findings", "reviewer_results", "status_continuation", "acknowledgement"]);
 	if (body.schema !== REVIEW_LAST_EVENT_CLOSURE_SCHEMA) throw new TypeError(`last_event_closure.schema must be ${REVIEW_LAST_EVENT_CLOSURE_SCHEMA}`);
 	const operation = enumeration(body.operation, Object.values(REVIEW_LAST_EVENT_CLOSURE_OPERATION), "last_event_closure.operation")                                   ;
 	const state = enumeration(body.state, REVIEW_LAST_EVENT_TERMINAL_STATES, "last_event_closure.state")                               ;
+	if (Object.hasOwn(body, "targeted_validator_evidence") && (operation !== REVIEW_LAST_EVENT_CLOSURE_OPERATION.CAPTURE_VALIDATION || state !== "escalated")) {
+		throw new TypeError("last_event_closure targeted_validator_evidence requires escalated review/capture-validation");
+	}
+	// Diagnostic evidence is optional for older providers and never controls terminal authority.
+	const targetedValidatorEvidence = Object.hasOwn(body, "targeted_validator_evidence")
+		? decodeReviewTargetedValidatorEvidenceV1(body.targeted_validator_evidence, "last_event_closure.targeted_validator_evidence")
+		: undefined;
+	if (Object.hasOwn(body, "escalation") && state !== "escalated") throw new TypeError("last_event_closure escalation requires escalated state");
+	// Older native closures omit this diagnostic; its presence never grants a continuation.
+	const escalation = Object.hasOwn(body, "escalation")
+		? decodeReviewEscalationV1(body.escalation, "last_event_closure.escalation")
+		: undefined;
 	const shared = {
 		schema: REVIEW_LAST_EVENT_CLOSURE_SCHEMA,
 		operation,
 		lineageId: lineage(body.lineage_id, "last_event_closure.lineage_id"),
 		state,
 		storeRevision: sha256(body.store_revision, "last_event_closure.store_revision"),
-	};
+		...(escalation === undefined ? {} : { escalation }),
+		...(targetedValidatorEvidence === undefined ? {} : { targetedValidatorEvidence }),
+	}         ;
 	if (operation === REVIEW_LAST_EVENT_CLOSURE_OPERATION.CAPTURE_CORRECTION_PLAN) {
 		if (body.reviewer_results !== undefined) throw new TypeError("last_event_closure reviewer_results requires approved state");
 		if (body.action !== undefined || body.advisory_findings !== undefined || body.status_continuation !== undefined) throw new TypeError("last_event_closure correction-plan cannot carry action, advisory_findings, or status_continuation");

package/runtime/review-risk-assessment.mjs

@@ -11,6 +11,11 @@
 // prints `{"schema":"gentle-ai.review-assessment/v1","risk":"passive|medium|high",
 // "reasons":[{"code":"…","path":"…","detail":"…"}],"changed_paths":1,
 // "changed_lines":1,"candidate":{"kind":"current-changes|base-diff","base_ref":"…"}}`.
+// gentle-pi#1175: the native v2 `assess.schema.json` requires only `code` on a
+// reason (`path`/`detail` are optional) and adds `candidate.consumed`,
+// `review_due`, `review_due_reason`, and an opaque `next_transition`. Older
+// binaries (for example gentle-ai v3.7.0) predate those fields, so
+// they decode as optional and stay absent rather than being defaulted.
 // A non-zero exit or a failure envelope means the candidate could not be
 // assessed; hosts treat that as `high`. Older binaries without the verb (or
 // any other decode/process failure) fail closed the same way -- see
@@ -31,6 +36,41 @@ export const REVIEW_ASSESSMENT_CANDIDATE_KIND = {
 }         ;
 
 
+export const REVIEW_DUE_REASON = {
+	HIGH_RISK: "high_risk",
+	SLICE_BUDGET_REACHED: "slice_budget_reached",
+	PASSIVE: "passive",
+	UNDER_BUDGET: "under_budget",
+	ALREADY_REVIEWED: "already_reviewed",
+}         ;
+
+
+export const REVIEW_ASSESSMENT_NEXT_TRANSITION_OPERATION = "review.status"         ;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+/**
+ * The native, literally runnable `review status ... --next-transition`
+ * preflight continuation. Carried verbatim as an opaque value: hosts never
+ * rebuild, reorder, or synthesize it.
+ */
 
 
 
@@ -55,25 +95,104 @@ function isRecord(value         )                                   {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+function isNonEmptyString(value         )                  {
+	return typeof value === "string" && value.length > 0;
+}
+
 function decodeReason(value         )                         {
 	if (!isRecord(value)) throw new TypeError("review assessment reason must be an object");
 	const { code, path, detail } = value;
-	if (typeof code !== "string" || code.length === 0) throw new TypeError("review assessment reason.code must be a non-empty string");
-	if (typeof path !== "string") throw new TypeError("review assessment reason.path must be a string");
-	if (typeof detail !== "string") throw new TypeError("review assessment reason.detail must be a string");
-	return Object.freeze({ code, path, detail });
+	if (!isNonEmptyString(code)) throw new TypeError("review assessment reason.code must be a non-empty string");
+	if (path !== undefined && !isNonEmptyString(path)) throw new TypeError("review assessment reason.path must be a non-empty string when present");
+	if (detail !== undefined && !isNonEmptyString(detail)) throw new TypeError("review assessment reason.detail must be a non-empty string when present");
+	// Absent path/detail stay absent: never synthesized (gentle-pi#1175).
+	return Object.freeze({
+		code,
+		...(path === undefined ? {} : { path: path           }),
+		...(detail === undefined ? {} : { detail: detail           }),
+	});
 }
 
 function decodeCandidate(value         )                            {
 	if (!isRecord(value)) throw new TypeError("review assessment candidate must be an object");
-	const { kind, base_ref: baseRef } = value;
+	const { kind, base_ref: baseRef, consumed } = value;
 	if (kind !== REVIEW_ASSESSMENT_CANDIDATE_KIND.CURRENT_CHANGES && kind !== REVIEW_ASSESSMENT_CANDIDATE_KIND.BASE_DIFF) {
 		throw new TypeError("review assessment candidate.kind must be current-changes or base-diff");
 	}
-	if (baseRef !== undefined && (typeof baseRef !== "string" || baseRef.length === 0)) {
+	if (baseRef !== undefined && !isNonEmptyString(baseRef)) {
 		throw new TypeError("review assessment candidate.base_ref must be a non-empty string when present");
 	}
-	return Object.freeze({ kind, baseRef: baseRef                       });
+	if (consumed !== undefined && typeof consumed !== "boolean") {
+		throw new TypeError("review assessment candidate.consumed must be a boolean when present");
+	}
+	// An older binary omits consumed; it stays absent, never defaulted.
+	return Object.freeze({ kind, baseRef: baseRef                      , ...(consumed === undefined ? {} : { consumed: consumed            }) });
+}
+
+function isReviewDueReason(value         )                           {
+	return Object.values(REVIEW_DUE_REASON).includes(value                   );
+}
+
+// The native schema fixes review_due by reason: due for high_risk and
+// slice_budget_reached, not due for passive, under_budget, and
+// already_reviewed (gentle-pi#1175).
+const DUE_REVIEW_REASONS                             = [REVIEW_DUE_REASON.HIGH_RISK, REVIEW_DUE_REASON.SLICE_BUDGET_REACHED];
+
+/**
+ * Rejects a review_due/review_due_reason/consumed combination the native
+ * schema can never produce. A consumed candidate must report
+ * `already_reviewed`, but that reason can also describe an acknowledged
+ * committed predecessor followed by a passive delta (#1954). It does not
+ * prove this exact candidate was consumed; preserve native's explicit false.
+ * Native v2 requires consumed, so missing evidence with already_reviewed is
+ * still rejected. Envelopes without the pair (older binaries) are unchecked.
+ */
+function validateReviewDueConsistency(reviewDue         , reviewDueReason                 , candidate                           )       {
+	if (reviewDue !== DUE_REVIEW_REASONS.includes(reviewDueReason)) {
+		throw new TypeError(`review assessment review_due ${reviewDue} contradicts review_due_reason ${reviewDueReason}`);
+	}
+	const alreadyReviewed = reviewDueReason === REVIEW_DUE_REASON.ALREADY_REVIEWED;
+	if (candidate.consumed === true && !alreadyReviewed) {
+		throw new TypeError("review assessment candidate.consumed true requires review_due_reason already_reviewed");
+	}
+	if (alreadyReviewed && candidate.consumed === undefined) {
+		throw new TypeError("review assessment review_due_reason already_reviewed requires explicit candidate.consumed evidence");
+	}
+}
+
+function hasOnlyKeys(value                         , allowed                   )          {
+	return Object.keys(value).every((key) => allowed.includes(key));
+}
+
+function validateNextTransitionArgument(value         )       {
+	if (!isRecord(value) || !hasOnlyKeys(value, ["name", "value", "token"])) {
+		throw new TypeError("review assessment next_transition argument must be an object with only name, value, and token");
+	}
+	if (!isNonEmptyString(value.name)) throw new TypeError("review assessment next_transition argument name must be a non-empty string");
+	if (typeof value.value !== "string") throw new TypeError("review assessment next_transition argument value must be a string");
+	if (value.token !== undefined && !isNonEmptyString(value.token)) {
+		throw new TypeError("review assessment next_transition argument token must be a non-empty string when present");
+	}
+}
+
+/**
+ * Validates `next_transition` exactly as the native schema declares it and
+ * returns the native value itself, frozen -- validated, never rebuilt,
+ * reordered, or synthesized (gentle-pi#1175).
+ */
+function decodeNextTransition(value         )                                 {
+	if (!isRecord(value) || !hasOnlyKeys(value, ["operation", "command", "arguments"])) {
+		throw new TypeError("review assessment next_transition must be an object with only operation, command, and arguments");
+	}
+	if (value.operation !== REVIEW_ASSESSMENT_NEXT_TRANSITION_OPERATION) {
+		throw new TypeError(`review assessment next_transition.operation must be ${REVIEW_ASSESSMENT_NEXT_TRANSITION_OPERATION}`);
+	}
+	if (!isNonEmptyString(value.command)) throw new TypeError("review assessment next_transition.command must be a non-empty string");
+	if (!Array.isArray(value.arguments)) throw new TypeError("review assessment next_transition.arguments must be an array");
+	for (const argument of value.arguments) validateNextTransitionArgument(argument);
+	for (const argument of value.arguments) Object.freeze(argument);
+	Object.freeze(value.arguments);
+	return Object.freeze(value)                                             ;
 }
 
 /**
@@ -82,24 +201,55 @@ function decodeCandidate(value         )                            {
  * native review CLI wrapper turns a thrown error here into the same
  * schema-incompatible failure it already produces for every other decoded
  * native response.
+ *
+ * `review_due` and `review_due_reason` were added together natively: both
+ * absent (an older binary) or both present are accepted; only one of them is
+ * rejected. When present, the pair must agree with each other and with
+ * `candidate.consumed` (see `validateReviewDueConsistency`).
+ * `next_transition` is accepted only alongside `review_due: true`.
+ * Unknown extra top-level fields are ignored and never projected, so a newer
+ * binary stays decodable (gentle-pi#1175).
  */
 export function decodeReviewAssessmentV1(value         )                     {
 	if (!isRecord(value)) throw new TypeError("review assessment must be an object");
 	if (value.schema !== REVIEW_ASSESSMENT_SCHEMA) throw new TypeError(`review assessment schema must be ${REVIEW_ASSESSMENT_SCHEMA}`);
-	const { risk, reasons, changed_paths: changedPaths, changed_lines: changedLines, candidate } = value;
+	const {
+		risk,
+		reasons,
+		changed_paths: changedPaths,
+		changed_lines: changedLines,
+		candidate,
+		review_due: reviewDue,
+		review_due_reason: reviewDueReason,
+		next_transition: nextTransition,
+	} = value;
 	if (risk !== REVIEW_ASSESSMENT_RISK.PASSIVE && risk !== REVIEW_ASSESSMENT_RISK.MEDIUM && risk !== REVIEW_ASSESSMENT_RISK.HIGH) {
 		throw new TypeError("review assessment risk must be passive, medium, or high");
 	}
 	if (!Array.isArray(reasons)) throw new TypeError("review assessment reasons must be an array");
 	if (!Number.isSafeInteger(changedPaths) || (changedPaths          ) < 0) throw new TypeError("review assessment changed_paths must be a non-negative integer");
 	if (!Number.isSafeInteger(changedLines) || (changedLines          ) < 0) throw new TypeError("review assessment changed_lines must be a non-negative integer");
+	if ((reviewDue === undefined) !== (reviewDueReason === undefined)) {
+		throw new TypeError("review assessment review_due and review_due_reason must be both present or both absent");
+	}
+	if (reviewDue !== undefined && typeof reviewDue !== "boolean") throw new TypeError("review assessment review_due must be a boolean when present");
+	if (reviewDueReason !== undefined && !isReviewDueReason(reviewDueReason)) {
+		throw new TypeError(`review assessment review_due_reason must be one of ${Object.values(REVIEW_DUE_REASON).join(", ")}`);
+	}
+	if (nextTransition !== undefined && reviewDue !== true) {
+		throw new TypeError("review assessment next_transition is only valid when review_due is true");
+	}
+	const decodedCandidate = decodeCandidate(candidate);
+	if (reviewDue !== undefined) validateReviewDueConsistency(reviewDue           , reviewDueReason                   , decodedCandidate);
 	return Object.freeze({
 		schema: REVIEW_ASSESSMENT_SCHEMA,
 		risk,
 		reasons: Object.freeze(reasons.map(decodeReason)),
 		changedPaths: changedPaths          ,
 		changedLines: changedLines          ,
-		candidate: decodeCandidate(candidate),
+		candidate: decodedCandidate,
+		...(reviewDue === undefined ? {} : { reviewDue: reviewDue           , reviewDueReason: reviewDueReason                    }),
+		...(nextTransition === undefined ? {} : { nextTransition: decodeNextTransition(nextTransition) }),
 	});
 }
 
@@ -115,6 +265,53 @@ export const VERIFICATION_TIER = {
 }         ;
 
 
+// ---------------------------------------------------------------------------
+// Agent-raised risk (gentle-shell#1494). The agent that made the change may
+// raise its risk to high by citing one item of the high-risk list in the
+// always-on Task Size section; it can never lower a tier. Lowering stays with
+// the deterministic native assessment.
+// ---------------------------------------------------------------------------
+
+export const HIGH_RISK_ITEMS = Object.freeze({
+	1: "data or irreversible effects",
+	2: "security",
+	3: "changing or removing contracts others already consume",
+	4: "concurrency",
+	5: "delivery or environment",
+	6: "no test would catch a regression",
+}         );
+
+
+
+
+
+
+
+export const AGENT_RISK_ESCALATION_REASON_MAX = 500;
+
+export function decodeAgentRiskEscalation(value         )                      {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) {
+		throw new Error("escalate must be an object with item and reason");
+	}
+	const record = value                           ;
+	const unexpected = Object.keys(record).find((key) => key !== "item" && key !== "reason");
+	if (unexpected !== undefined) throw new Error(`escalate does not accept ${unexpected}`);
+	const { item, reason } = record;
+	if (typeof item !== "number" || !Number.isInteger(item) || !(item in HIGH_RISK_ITEMS)) {
+		throw new Error("escalate item must be an integer from 1 to 6 naming a high-risk item");
+	}
+	if (typeof reason !== "string" || reason.trim() === "" || reason.length > AGENT_RISK_ESCALATION_REASON_MAX) {
+		throw new Error(`escalate reason must be a non-empty string of at most ${AGENT_RISK_ESCALATION_REASON_MAX} characters`);
+	}
+	return Object.freeze({ item: item                , reason });
+}
+
+/** Raises passive or medium to high when the agent escalated; never lowers. */
+export function escalatedRisk(risk                  , escalation                                 )                   {
+	if (escalation === undefined) return risk;
+	return risk === VERIFICATION_TIER.PASSIVE || risk === VERIFICATION_TIER.MEDIUM ? VERIFICATION_TIER.HIGH : risk;
+}
+
 export const RDD_LINE = {
 	ON: "on",
 	OFF: "off",
@@ -219,59 +416,33 @@ function nonClosedOutcomeClause(outcome                     )         {
 }
 
 /**
- * Computes who verifies a delegated writer's change, exactly as
- * gentle-pi#662/#668 specify:
+ * Computes who verifies a delegated writer's change. Verification follows the
+ * native risk tier whatever the RDD line and native review outcome
+ * (verify-always-rdd-high S1, superseding the gentle-pi#662/#668 on-path): the
+ * native review is an additional outside view and never replaces or skips the
+ * tier's verification. `nativeReviewOutcome` only shapes the reason text.
  *
- * - `rdd: "on"` AND the native review reached `NATIVE_REVIEW_OUTCOME.CLOSED`
- *   for this candidate: the writer self-verifies and no independent verifier
- *   runs, because the closed native review is the check -- except `passive`,
- *   which gets a structural readback by the parent instead.
- * - `rdd: "on"` with any other outcome (`declined`, `unavailable`, or the
- *   fail-closed `unknown` default for an omitted/unrecognized outcome): the
- *   `on` branch never held for this candidate, so the risk-gated path below
- *   applies exactly as `off` -- declining a review is candidate-scoped and
- *   never lowers the bar below the RDD-off path.
- * - `rdd: "off"` or `"unknown"` (both gate identically, so an unknown RDD line
- *   never lowers a tier relative to `off`; `nativeReviewOutcome` is ignored
- *   entirely on these lines):
- *   - `passive`: structural readback by the parent only; no verifier, no
- *     tests.
- *   - `medium`: the writer self-verifies; a separate independent verifier
- *     runs only when `writerProfile` is `"small"` -- the small-model bias
- *     raises the tier by one for verification purposes (medium -> high). An
- *     unknown or omitted writer profile resolves to `"small"` before it
- *     reaches this function (see `resolveWriterProfile`), so an unrecognized
- *     profile never lowers a tier below what a known small model would get.
- *   - `high` or `unassessable` (a failed or unrecognized native assessment is
- *     always treated as high): the writer self-verifies and an independent
- *     verifier always runs.
+ * - `passive`: structural readback by the parent only; no verifier, no tests.
+ * - `medium`: the writer self-verifies; a separate independent verifier runs
+ *   only when `writerProfile` is `"small"` -- the small-model bias raises the
+ *   tier by one for verification purposes (medium -> high). An unknown or
+ *   omitted writer profile resolves to `"small"` before it reaches this
+ *   function (see `resolveWriterProfile`), so an unrecognized profile never
+ *   lowers a tier below what a known small model would get.
+ * - `high` or `unassessable` (a failed or unrecognized native assessment is
+ *   always treated as high): the writer self-verifies and an independent
+ *   verifier always runs.
  */
 export function verificationPlan(input                       )                   {
 	const { rddLine, risk, writerProfile } = input;
 
 	if (rddLine === RDD_LINE.ON) {
 		const outcome = input.nativeReviewOutcome ?? NATIVE_REVIEW_OUTCOME.UNKNOWN;
-		if (outcome === NATIVE_REVIEW_OUTCOME.CLOSED) {
-			if (risk === VERIFICATION_TIER.PASSIVE) {
-				return Object.freeze({
-					writerSelfVerification: false,
-					structuralReadbackOnly: true,
-					independentVerifier: false,
-					reason: "receipt-driven development is on and the native review closed for this candidate; the assessment also reports passive risk: a structural readback by the parent replaces both the writer's self-verification and any separate verifier.",
-				});
-			}
-			return Object.freeze({
-				writerSelfVerification: true,
-				structuralReadbackOnly: false,
-				independentVerifier: false,
-				reason: "receipt-driven development is on and the native review closed for this candidate: the writer's self-verification is the record and the closed native review was the independent check the writer cannot influence, so no separate verifier is required.",
-			});
-		}
-		// The on branch holds only while the native review reaches a terminal
-		// outcome for this candidate. Anything else -- declined, unavailable, or
-		// unknown -- falls back to the exact same risk-gated path as off.
+		const clause = outcome === NATIVE_REVIEW_OUTCOME.CLOSED
+			? "the native review closed for this candidate"
+			: nonClosedOutcomeClause(outcome);
 		return riskGatedPlan(
-			`receipt-driven development is on, but ${nonClosedOutcomeClause(outcome)}, so the risk-gated path applies exactly as receipt-driven development off, and`,
+			`receipt-driven development is on and ${clause}; the native review is an additional outside view that never replaces verification, so the risk-gated path applies exactly as receipt-driven development off, and`,
 			risk,
 			writerProfile,
 		);