gentle-pi 4.0.0 → 4.2.0

package/lib/review-candidate-view-owner.ts

@@ -286,14 +286,15 @@ function posixPrivateModeProbe(path: string): boolean {
 }
 
 function directory(path: string, privateMode = false, platform: NodeJS.Platform = process.platform, classifyParentPrivacy = false): string {
-	const stat = lstatSync(path);
+	// 64-bit dev/ino may collide as Numbers; validate metadata and identity from one exact observation.
+	const stat = lstatSync(path, { bigint: true });
 	if (!stat.isDirectory() || stat.isSymbolicLink() || !samePath(realpathSync(path), path, platform)) throw new Error("Unsafe candidate owner directory");
 	if (privateMode && platform !== "win32") {
 		const uid = process.getuid?.();
 		if (uid === undefined) throw new Error("Unsafe candidate owner directory");
-		if (stat.uid !== uid || (stat.mode & 0o077) !== 0) {
+		if (stat.uid !== BigInt(uid) || (stat.mode & 0o077n) !== 0n) {
 			if (classifyParentPrivacy) {
-				if (stat.uid === uid && (stat.mode & 0o077) !== 0 && !posixPrivateModeProbe(path)) throw new PosixCandidateOwnerParentChmodIneffectiveError();
+				if (stat.uid === BigInt(uid) && (stat.mode & 0o077n) !== 0n && !posixPrivateModeProbe(path)) throw new PosixCandidateOwnerParentChmodIneffectiveError();
 				throw new PosixCandidateOwnerParentPrivacyError();
 			}
 			throw new Error("Unsafe candidate owner directory");
@@ -329,10 +330,11 @@ export function prepareCandidateOwnerParent(commonDir: string, platform: NodeJS.
 }
 
 function regular(path: string, privateMode = false, platform: NodeJS.Platform = process.platform): string {
-	const stat = lstatSync(path);
+	// Keep 64-bit identity exact without a second stat lookup racing the privacy checks.
+	const stat = lstatSync(path, { bigint: true });
 	const uid = process.getuid?.();
-	if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || !samePath(realpathSync(path), path, platform) || stat.size > 16384 ||
-		(privateMode && platform !== "win32" && (uid === undefined || stat.uid !== uid || (stat.mode & 0o777) !== 0o600))) throw new Error("Unsafe candidate owner file");
+	if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1n || !samePath(realpathSync(path), path, platform) || stat.size > 16384n ||
+		(privateMode && platform !== "win32" && (uid === undefined || stat.uid !== BigInt(uid) || (stat.mode & 0o777n) !== 0o600n))) throw new Error("Unsafe candidate owner file");
 	if (privateMode && platform === "win32") privateWindowsDacl(path, "file", false);
 	return `${stat.dev}:${stat.ino}`;
 }

package/lib/review-candidate-view.ts

@@ -1861,7 +1861,7 @@ export function decodeCandidateContextManifest(encoded: string, sha256: string):
 	if (actualSha256 !== sha256) throw new CandidateViewError("candidate context manifest integrity check failed", "candidate-context-manifest-integrity");
 	const text = bytes.toString("utf8");
 	if (!Buffer.from(text, "utf8").equals(bytes)) return invalidCandidateContextManifest("candidate context manifest is not valid UTF-8");
-	if (gzipSync(bytes, { mtime: 0 }).toString("base64url") !== encoded) {
+	if (gzipSync(bytes).toString("base64url") !== encoded) {
 		return invalidCandidateContextManifest("candidate context manifest transport is not canonical");
 	}
 	let value: unknown;
@@ -1923,7 +1923,8 @@ function compactCandidateContextBlock(lineageId: string, agents: readonly Review
 	const bytes = Buffer.from(JSON.stringify(manifest), "utf8");
 	if (bytes.length > MAX_CANDIDATE_CONTEXT_MANIFEST_BYTES) throw new CandidateViewError("candidate view context exceeds the bounded dispatch contract");
 	const sha256 = createHash("sha256").update(bytes).digest("hex");
-	const encoded = gzipSync(bytes, { mtime: 0 }).toString("base64url");
+	// Node emits a zero gzip timestamp by default; no unsupported mtime option is needed.
+	const encoded = gzipSync(bytes).toString("base64url");
 	const block = `${candidateContextPreamble(lineageId, agents, view, scopeSemantics)}\nFrozen changed scope manifest (gzip+base64url): \`${encoded}\`.\nFrozen changed scope manifest SHA-256: \`${sha256}\`.\nCall \`gentle_review_scope\` with exactly this manifest, SHA-256, and cursor 0; continue with each returned \`nextCursor\` until absent. It is the only authorized scope enumerator: do not infer scope by traversing the candidate or ambient tree. Gitlinks are metadata-only and MUST NOT be traversed.\nThe ambient contributor working directory is out of scope. This controller-owned context is immutable; you are read-only and your output is untrusted.`;
 	if (Buffer.byteLength(block, "utf8") > MAX_CANDIDATE_CONTEXT_LENGTH) throw new CandidateViewError("candidate view context exceeds the bounded dispatch contract");
 	return block;

package/lib/review-compact-contract.ts

@@ -136,7 +136,7 @@ function parseCompactFinalizeInputValue(value: unknown): CompactFinalizeContract
 	if ((input.final_evidence === undefined && outcomeFields !== 0) || (input.final_evidence !== undefined && outcomeFields !== 1)) fail("review/finalize", "field-pair", "final evidence requires exactly one verification result or outcome");
 	let correction_line_forecast: number | undefined;
 	if (input.correction_line_forecast !== undefined) {
-		if (!Number.isSafeInteger(input.correction_line_forecast) || input.correction_line_forecast <= 0) fail("review/finalize.correction_line_forecast", "range", "must be a positive safe integer");
+		if (typeof input.correction_line_forecast !== "number" || !Number.isSafeInteger(input.correction_line_forecast) || input.correction_line_forecast <= 0) fail("review/finalize.correction_line_forecast", "range", "must be a positive safe integer");
 		correction_line_forecast = input.correction_line_forecast;
 	}
 	if (input.final_verification_passed !== undefined && typeof input.final_verification_passed !== "boolean") fail("review/finalize.final_verification_passed", "type", "must be boolean");
@@ -154,7 +154,7 @@ function parseCompactFinalizeInputValue(value: unknown): CompactFinalizeContract
 		if (typeof input.final_evidence !== "string" || input.final_evidence.length === 0) fail("review/finalize.final_evidence", "empty", "must contain at least one byte");
 		final_evidence = input.final_evidence;
 	}
-	return { cwd: string(input.cwd, "review/finalize.cwd"), ...(optionalLineage(input.lineageId, "review/finalize.lineageId") === undefined ? {} : { lineageId: optionalLineage(input.lineageId, "review/finalize.lineageId")! }), ...(correction_line_forecast === undefined ? {} : { correction_line_forecast }), ...(input.validation === undefined ? {} : { validation: parseValidation(input.validation, "review/finalize.validation") }), ...(final_evidence === undefined ? {} : { final_evidence }), ...(input.final_verification_passed === undefined ? {} : { final_verification_passed: input.final_verification_passed }), ...(final_verification_outcome === undefined ? {} : { final_verification_outcome }), ...(input.reviewer_run_acknowledged === undefined ? {} : { reviewer_run_acknowledged: input.reviewer_run_acknowledged as boolean }) };
+	return { cwd: string(input.cwd, "review/finalize.cwd"), ...(optionalLineage(input.lineageId, "review/finalize.lineageId") === undefined ? {} : { lineageId: optionalLineage(input.lineageId, "review/finalize.lineageId")! }), ...(correction_line_forecast === undefined ? {} : { correction_line_forecast }), ...(input.validation === undefined ? {} : { validation: parseValidation(input.validation, "review/finalize.validation") }), ...(final_evidence === undefined ? {} : { final_evidence }), ...(typeof input.final_verification_passed !== "boolean" ? {} : { final_verification_passed: input.final_verification_passed }), ...(final_verification_outcome === undefined ? {} : { final_verification_outcome }), ...(typeof input.reviewer_run_acknowledged !== "boolean" ? {} : { reviewer_run_acknowledged: input.reviewer_run_acknowledged }) };
 }
 
 export function parseNativeCompactFinalizeInput(value: unknown): CompactFinalizeContractInput {

package/lib/review-host-relay.ts

@@ -34,13 +34,14 @@ import { spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { isAbsolute, join } from "node:path";
 import { completeSimple } from "@earendil-works/pi-ai/compat";
-import { resolveGentleAiBinary } from "./gentle-ai-binary.ts";
+import { gentleAiIsolationEnv, resolveGentleAiBinary } from "./gentle-ai-binary.ts";
 import {
 	INPROCESS_REVIEWER_FAILURE,
 	runInProcessReviewer,
 	type InProcessReviewerFailureCode,
 	type InProcessReviewerOutcome,
 	type InProcessReviewerRegistry,
+	type InProcessReviewerRequest,
 } from "./inprocess-reviewer.ts";
 import { REVIEW_PROVIDER_ROLE_CAPTURE_OPERATION, REVIEW_PROVIDER_ROLE_CAPTURE_OPERATIONS, type ReviewCaptureSubmissionV1, type ReviewCollectInputV3 } from "./review-integration-v2.ts";
 import { GENTLE_PI_REVIEW_RELAY_CONTRACT, GENTLE_PI_REVIEW_RELAY_CONTRACT_ENV } from "./review-relay-contract.ts";
@@ -386,6 +387,8 @@ export interface ReviewHostRelayRequest {
 	readonly selection?: string;
 	/** The routing entry's thinking label, forwarded verbatim to the completion. */
 	readonly thinking?: string;
+	/** Effective Pi transport preference, forwarded without forcing a provider default. */
+	readonly reviewerTransport?: InProcessReviewerRequest["transport"];
 	/**
 	 * The caller's live pi session id, forwarded into the in-process completion
 	 * request so an OpenCode-routed reviewer model carries its
@@ -498,7 +501,8 @@ function collectGentleAiProcess(
 		const startedAt = Date.now();
 		const child = spawn(file, [...arguments_], {
 			cwd: options.cwd,
-			env: options.env,
+			// S9: a bundled install keeps Gentle AI's state inside its prefix.
+			env: gentleAiIsolationEnv(options.env),
 			stdio: ["pipe", "pipe", "pipe"],
 			shell: false,
 			windowsHide: true,
@@ -737,6 +741,7 @@ export async function prepareReviewHostRelaySlot(
 			{
 				selection: preparedRequest.selection!,
 				...(preparedRequest.thinking === undefined ? {} : { thinking: preparedRequest.thinking }),
+				...(preparedRequest.reviewerTransport === undefined ? {} : { transport: preparedRequest.reviewerTransport }),
 				...(preparedRequest.reviewerSessionId === undefined ? {} : { sessionId: preparedRequest.reviewerSessionId }),
 				prompt: promptBytes,
 				timeoutMs: piTimeoutMs,

package/lib/review-integration-v2.ts

@@ -77,8 +77,8 @@ export type ReviewStartState = (typeof REVIEW_START_STATE)[keyof typeof REVIEW_S
 const START_ACTIONS = ["created", "resumed", "closed", "blocked-scope-action"] as const;
 const RISK_LEVELS = ["low", "medium", "high"] as const;
 const REVIEW_LENSES = ["review-risk", "review-resilience", "review-readability", "review-reliability"] as const;
-const RISK_REASON_CODES = ["configuration_change", "empty_content", "executable_change", "executable_mode", "hot_path", "large_change", "non_executable_only", "process_boundary", "process_scan_limit", "service_token", "shell_source"] as const;
-const RISK_SIGNALS = ["auth", "update", "security", "payments", "permissions", "shell_process"] as const;
+const RISK_REASON_CODES = ["agent_escalation", "configuration_change", "dangerous_sink", "empty_content", "executable_change", "executable_mode", "hot_path", "large_change", "non_executable_only", "process_boundary", "process_scan_limit", "service_token", "shell_source"] as const;
+const RISK_SIGNALS = ["auth", "update", "security", "payments", "permissions", "shell_process", "dangerous_sink", "agent_escalation"] as const;
 // "collect" and "execute" are the v2 envelope's projection of a live
 // transaction whose next_transition is mandatory: the root action names the
 // transition kind instead of reading as a terminal stop.
@@ -636,6 +636,23 @@ export interface ReviewEscalationV1 {
 	refuterOutcomes?: readonly ReviewEscalationRefuterOutcomeV1[];
 }
 
+function decodeReviewEscalationV1(value: unknown, label: string): ReviewEscalationV1 {
+	const source = exactRecord(value, label, ["cause", "finding_ids"], ["refuter_outcomes"]);
+	const escalation: ReviewEscalationV1 = {
+		cause: enumeration(source.cause, ESCALATION_CAUSES, `${label}.cause`),
+		findingIds: stringArray(source.finding_ids, `${label}.finding_ids`),
+	};
+	if (Object.hasOwn(source, "refuter_outcomes")) escalation.refuterOutcomes = array(source.refuter_outcomes, `${label}.refuter_outcomes`, (entry, itemLabel) => {
+		const row = exactRecord(entry, itemLabel, ["finding_id", "outcome", "proof"]);
+		return {
+			findingId: nonempty(row.finding_id, `${itemLabel}.finding_id`),
+			outcome: enumeration(row.outcome, ESCALATION_REFUTER_OUTCOMES, `${itemLabel}.outcome`),
+			proof: nonempty(row.proof, `${itemLabel}.proof`),
+		};
+	});
+	return escalation;
+}
+
 export interface ReviewStatusV3 {
 	/** Optional v7 diagnostic evidence, never routing or reconstructed authority. */
 	escalation?: ReviewEscalationV1;
@@ -2104,23 +2121,9 @@ export function decodeReviewStatusV3(value: unknown): ReviewStatusV3 {
 		};
 	}
 
-	let escalation: ReviewEscalationV1 | undefined;
-	if (Object.hasOwn(body, "escalation")) {
-		const label = "status.escalation";
-		const source = exactRecord(body.escalation, label, ["cause", "finding_ids"], ["refuter_outcomes"]);
-		escalation = {
-			cause: enumeration(source.cause, ESCALATION_CAUSES, `${label}.cause`),
-			findingIds: stringArray(source.finding_ids, `${label}.finding_ids`),
-		};
-		if (Object.hasOwn(source, "refuter_outcomes")) escalation.refuterOutcomes = array(source.refuter_outcomes, `${label}.refuter_outcomes`, (entry, itemLabel) => {
-			const row = exactRecord(entry, itemLabel, ["finding_id", "outcome", "proof"]);
-			return {
-				findingId: nonempty(row.finding_id, `${itemLabel}.finding_id`),
-				outcome: enumeration(row.outcome, ESCALATION_REFUTER_OUTCOMES, `${itemLabel}.outcome`),
-				proof: nonempty(row.proof, `${itemLabel}.proof`),
-			};
-		});
-	}
+	const escalation = Object.hasOwn(body, "escalation")
+		? decodeReviewEscalationV1(body.escalation, "status.escalation")
+		: undefined;
 
 	// status/v7 top-level optional digest (gentle-ai v2.6.0): resolves #4066's
 	// closed loop where `sdd-attempt finish` named a digest status never
@@ -2583,7 +2586,11 @@ function assertReviewApprovedAcknowledgementExecuteShapeV1(execute: ReviewNextTr
 	if (execute.arguments.length !== REVIEW_APPROVED_ACKNOWLEDGEMENT_ARGUMENTS.length) throw new TypeError(`acknowledgement.execute.arguments must carry exactly ${REVIEW_APPROVED_ACKNOWLEDGEMENT_ARGUMENTS.length} provider-issued arguments`);
 	const values = execute.arguments.map((argument, index) => { const name = REVIEW_APPROVED_ACKNOWLEDGEMENT_ARGUMENTS[index]!; if (argument.name !== name) throw new TypeError(`acknowledgement.execute.arguments[${index}].name must be ${name}`); const value = nonempty(argument.value, `acknowledgement.execute.arguments[${index}].value`); if (nonempty(argument.token, `acknowledgement.execute.arguments[${index}].token`) !== `--${name}=${value}`) throw new TypeError(`acknowledgement.execute.arguments[${index}].token must exactly match ${name}`); return value; });
 	if (execute.preconditions.length !== 1 || execute.preconditions[0]?.name !== "state" || execute.preconditions[0]?.value !== "approved") throw new TypeError("acknowledgement.execute.preconditions must be the single approved state precondition");
-	return { tokens: execute.arguments.map((argument) => argument.token!) as ReviewApprovedAcknowledgementExecuteTokensV1, values: values as readonly [string, string, string, string, string], lineageId: lineage(execute.binding.lineageId, "acknowledgement.execute.binding.lineage_id"), targetIdentity: sha256(execute.binding.targetIdentity, "acknowledgement.execute.binding.target_identity"), revision: sha256(execute.binding.revision, "acknowledgement.execute.binding.revision") };
+	const tokens = execute.arguments.map((argument) => argument.token!);
+	// The exact five-argument check above validates both vectors before tuple construction.
+	const tokenTuple: ReviewApprovedAcknowledgementExecuteTokensV1 = [tokens[0]!, tokens[1]!, tokens[2]!, tokens[3]!, tokens[4]!];
+	const valueTuple: readonly [string, string, string, string, string] = [values[0]!, values[1]!, values[2]!, values[3]!, values[4]!];
+	return { tokens: tokenTuple, values: valueTuple, lineageId: lineage(execute.binding.lineageId, "acknowledgement.execute.binding.lineage_id"), targetIdentity: sha256(execute.binding.targetIdentity, "acknowledgement.execute.binding.target_identity"), revision: sha256(execute.binding.revision, "acknowledgement.execute.binding.revision") };
 }
 
 /**
@@ -2682,6 +2689,26 @@ export interface ReviewLastEventReviewerResultV1 {
 	resultHash: string;
 }
 
+export interface ReviewTargetedValidatorCheckEvidenceV1 {
+	passed: boolean;
+	evidence: readonly string[];
+	regressions?: readonly {
+		id?: string;
+		location: string;
+		claim: string;
+		proofRefs: readonly string[];
+	}[];
+}
+
+export interface ReviewTargetedValidatorEvidenceV1 {
+	targetedValidationRequestHash: string;
+	correctionTargetIdentity: string;
+	originalCriteria: ReviewTargetedValidatorCheckEvidenceV1;
+	correctionRegression: ReviewTargetedValidatorCheckEvidenceV1;
+	followUps: readonly { observation: string; proofRefs: readonly string[] }[];
+	raw: Record<string, unknown>;
+}
+
 export interface ReviewLastEventClosureV1 {
 	schema: typeof REVIEW_LAST_EVENT_CLOSURE_SCHEMA;
 	operation: ReviewLastEventClosureOperation;
@@ -2692,6 +2719,8 @@ export interface ReviewLastEventClosureV1 {
 	targetIdentity?: string;
 	requestHash?: string;
 	correctionLines?: number;
+	escalation?: ReviewEscalationV1;
+	targetedValidatorEvidence?: ReviewTargetedValidatorEvidenceV1;
 	advisoryFindings?: ReviewAdvisoryFindingsV1;
 	reviewerResults?: readonly ReviewLastEventReviewerResultV1[];
 	statusContinuation?: ReviewStatusContinuationV1;
@@ -2835,18 +2864,67 @@ function decodeReviewLastEventReviewerResultV1(value: unknown, label: string): R
 	};
 }
 
+function decodeReviewTargetedValidatorCheckEvidenceV1(value: unknown, label: string): ReviewTargetedValidatorCheckEvidenceV1 {
+	const check = exactRecord(value, label, ["passed", "evidence"], ["regressions"]);
+	const regressions = Object.hasOwn(check, "regressions")
+		? array(check.regressions, `${label}.regressions`, (entry, entryLabel) => {
+			const row = exactRecord(entry, entryLabel, ["location", "claim", "proof_refs"], ["id"]);
+			return {
+				...(Object.hasOwn(row, "id") ? { id: nonempty(row.id, `${entryLabel}.id`) } : {}),
+				location: nonempty(row.location, `${entryLabel}.location`),
+				claim: nonempty(row.claim, `${entryLabel}.claim`),
+				proofRefs: stringArray(row.proof_refs, `${entryLabel}.proof_refs`, { minimum: 1 }),
+			};
+		}) : undefined;
+	return {
+		passed: boolean(check.passed, `${label}.passed`),
+		// Native admission rejects observations containing only Unicode whitespace.
+		evidence: stringArray(check.evidence, `${label}.evidence`, { minimum: 1, pattern: /[^\p{White_Space}]/u }),
+		...(regressions === undefined ? {} : { regressions }),
+	};
+}
+
+function decodeReviewTargetedValidatorEvidenceV1(value: unknown, label: string): ReviewTargetedValidatorEvidenceV1 {
+	const body = exactRecord(value, label, ["targeted_validation_request_hash", "correction_target_identity", "original_criteria", "correction_regression", "follow_ups"]);
+	return {
+		targetedValidationRequestHash: sha256(body.targeted_validation_request_hash, `${label}.targeted_validation_request_hash`),
+		correctionTargetIdentity: sha256(body.correction_target_identity, `${label}.correction_target_identity`),
+		originalCriteria: decodeReviewTargetedValidatorCheckEvidenceV1(body.original_criteria, `${label}.original_criteria`),
+		correctionRegression: decodeReviewTargetedValidatorCheckEvidenceV1(body.correction_regression, `${label}.correction_regression`),
+		followUps: array(body.follow_ups, `${label}.follow_ups`, (entry, entryLabel) => {
+			const row = exactRecord(entry, entryLabel, ["observation", "proof_refs"]);
+			return { observation: nonempty(row.observation, `${entryLabel}.observation`), proofRefs: stringArray(row.proof_refs, `${entryLabel}.proof_refs`, { minimum: 1 }) };
+		}),
+		raw: body,
+	};
+}
+
 export function decodeReviewLastEventClosureV1(value: unknown): ReviewLastEventClosureV1 {
-	const body = exactRecord(value, "last_event_closure", ["schema", "operation", "lineage_id", "state", "store_revision"], ["target_identity", "request_hash", "correction_lines", "action", "advisory_findings", "reviewer_results", "status_continuation", "acknowledgement"]);
+	const body = exactRecord(value, "last_event_closure", ["schema", "operation", "lineage_id", "state", "store_revision"], ["target_identity", "request_hash", "correction_lines", "action", "escalation", "targeted_validator_evidence", "advisory_findings", "reviewer_results", "status_continuation", "acknowledgement"]);
 	if (body.schema !== REVIEW_LAST_EVENT_CLOSURE_SCHEMA) throw new TypeError(`last_event_closure.schema must be ${REVIEW_LAST_EVENT_CLOSURE_SCHEMA}`);
 	const operation = enumeration(body.operation, Object.values(REVIEW_LAST_EVENT_CLOSURE_OPERATION), "last_event_closure.operation") as ReviewLastEventClosureOperation;
 	const state = enumeration(body.state, REVIEW_LAST_EVENT_TERMINAL_STATES, "last_event_closure.state") as ReviewLastEventClosureState;
+	if (Object.hasOwn(body, "targeted_validator_evidence") && (operation !== REVIEW_LAST_EVENT_CLOSURE_OPERATION.CAPTURE_VALIDATION || state !== "escalated")) {
+		throw new TypeError("last_event_closure targeted_validator_evidence requires escalated review/capture-validation");
+	}
+	// Diagnostic evidence is optional for older providers and never controls terminal authority.
+	const targetedValidatorEvidence = Object.hasOwn(body, "targeted_validator_evidence")
+		? decodeReviewTargetedValidatorEvidenceV1(body.targeted_validator_evidence, "last_event_closure.targeted_validator_evidence")
+		: undefined;
+	if (Object.hasOwn(body, "escalation") && state !== "escalated") throw new TypeError("last_event_closure escalation requires escalated state");
+	// Older native closures omit this diagnostic; its presence never grants a continuation.
+	const escalation = Object.hasOwn(body, "escalation")
+		? decodeReviewEscalationV1(body.escalation, "last_event_closure.escalation")
+		: undefined;
 	const shared = {
 		schema: REVIEW_LAST_EVENT_CLOSURE_SCHEMA,
 		operation,
 		lineageId: lineage(body.lineage_id, "last_event_closure.lineage_id"),
 		state,
 		storeRevision: sha256(body.store_revision, "last_event_closure.store_revision"),
-	};
+		...(escalation === undefined ? {} : { escalation }),
+		...(targetedValidatorEvidence === undefined ? {} : { targetedValidatorEvidence }),
+	} as const;
 	if (operation === REVIEW_LAST_EVENT_CLOSURE_OPERATION.CAPTURE_CORRECTION_PLAN) {
 		if (body.reviewer_results !== undefined) throw new TypeError("last_event_closure reviewer_results requires approved state");
 		if (body.action !== undefined || body.advisory_findings !== undefined || body.status_continuation !== undefined) throw new TypeError("last_event_closure correction-plan cannot carry action, advisory_findings, or status_continuation");

package/lib/review-publication-gate.ts

@@ -393,7 +393,7 @@ function deriveReleaseCiStatusForShaV1(options: {
 	} catch {
 		return { proven: false, status: null };
 	}
-	if (!isRecord(summary) || !Number.isSafeInteger(summary.total_count) || !Number.isSafeInteger(summary.returned) || !Array.isArray(summary.checks) || summary.total_count < 0 || summary.returned < 0 || summary.returned !== summary.checks.length || summary.total_count !== summary.checks.length) {
+	if (!isRecord(summary) || typeof summary.total_count !== "number" || typeof summary.returned !== "number" || !Number.isSafeInteger(summary.total_count) || !Number.isSafeInteger(summary.returned) || !Array.isArray(summary.checks) || summary.total_count < 0 || summary.returned < 0 || summary.returned !== summary.checks.length || summary.total_count !== summary.checks.length) {
 		return { proven: false, status: null };
 	}
 	if (summary.total_count > 0) {

package/lib/review-risk-assessment.ts

@@ -139,18 +139,23 @@ const DUE_REVIEW_REASONS: readonly ReviewDueReason[] = [REVIEW_DUE_REASON.HIGH_R
 
 /**
  * Rejects a review_due/review_due_reason/consumed combination the native
- * schema can never produce. `already_reviewed` takes precedence exactly when
- * the candidate is consumed, so the two must agree in both directions. A
- * contradictory envelope is never trusted, least of all as closure evidence.
- * Envelopes without the pair (older binaries) are not checked here.
+ * schema can never produce. A consumed candidate must report
+ * `already_reviewed`, but that reason can also describe an acknowledged
+ * committed predecessor followed by a passive delta (#1954). It does not
+ * prove this exact candidate was consumed; preserve native's explicit false.
+ * Native v2 requires consumed, so missing evidence with already_reviewed is
+ * still rejected. Envelopes without the pair (older binaries) are unchecked.
  */
 function validateReviewDueConsistency(reviewDue: boolean, reviewDueReason: ReviewDueReason, candidate: ReviewAssessmentCandidate): void {
 	if (reviewDue !== DUE_REVIEW_REASONS.includes(reviewDueReason)) {
 		throw new TypeError(`review assessment review_due ${reviewDue} contradicts review_due_reason ${reviewDueReason}`);
 	}
 	const alreadyReviewed = reviewDueReason === REVIEW_DUE_REASON.ALREADY_REVIEWED;
-	if (alreadyReviewed !== (candidate.consumed === true)) {
-		throw new TypeError("review assessment review_due_reason already_reviewed must be reported exactly when candidate.consumed is true");
+	if (candidate.consumed === true && !alreadyReviewed) {
+		throw new TypeError("review assessment candidate.consumed true requires review_due_reason already_reviewed");
+	}
+	if (alreadyReviewed && candidate.consumed === undefined) {
+		throw new TypeError("review assessment review_due_reason already_reviewed requires explicit candidate.consumed evidence");
 	}
 }
 
@@ -259,6 +264,53 @@ export const VERIFICATION_TIER = {
 } as const;
 export type VerificationTier = (typeof VERIFICATION_TIER)[keyof typeof VERIFICATION_TIER];
 
+// ---------------------------------------------------------------------------
+// Agent-raised risk (gentle-shell#1494). The agent that made the change may
+// raise its risk to high by citing one item of the high-risk list in the
+// always-on Task Size section; it can never lower a tier. Lowering stays with
+// the deterministic native assessment.
+// ---------------------------------------------------------------------------
+
+export const HIGH_RISK_ITEMS = Object.freeze({
+	1: "data or irreversible effects",
+	2: "security",
+	3: "changing or removing contracts others already consume",
+	4: "concurrency",
+	5: "delivery or environment",
+	6: "no test would catch a regression",
+} as const);
+export type HighRiskItem = keyof typeof HIGH_RISK_ITEMS;
+
+export interface AgentRiskEscalation {
+	readonly item: HighRiskItem;
+	readonly reason: string;
+}
+
+export const AGENT_RISK_ESCALATION_REASON_MAX = 500;
+
+export function decodeAgentRiskEscalation(value: unknown): AgentRiskEscalation {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) {
+		throw new Error("escalate must be an object with item and reason");
+	}
+	const record = value as Record<string, unknown>;
+	const unexpected = Object.keys(record).find((key) => key !== "item" && key !== "reason");
+	if (unexpected !== undefined) throw new Error(`escalate does not accept ${unexpected}`);
+	const { item, reason } = record;
+	if (typeof item !== "number" || !Number.isInteger(item) || !(item in HIGH_RISK_ITEMS)) {
+		throw new Error("escalate item must be an integer from 1 to 6 naming a high-risk item");
+	}
+	if (typeof reason !== "string" || reason.trim() === "" || reason.length > AGENT_RISK_ESCALATION_REASON_MAX) {
+		throw new Error(`escalate reason must be a non-empty string of at most ${AGENT_RISK_ESCALATION_REASON_MAX} characters`);
+	}
+	return Object.freeze({ item: item as HighRiskItem, reason });
+}
+
+/** Raises passive or medium to high when the agent escalated; never lowers. */
+export function escalatedRisk(risk: VerificationTier, escalation: AgentRiskEscalation | undefined): VerificationTier {
+	if (escalation === undefined) return risk;
+	return risk === VERIFICATION_TIER.PASSIVE || risk === VERIFICATION_TIER.MEDIUM ? VERIFICATION_TIER.HIGH : risk;
+}
+
 export const RDD_LINE = {
 	ON: "on",
 	OFF: "off",
@@ -363,59 +415,33 @@ function nonClosedOutcomeClause(outcome: NativeReviewOutcome): string {
 }
 
 /**
- * Computes who verifies a delegated writer's change, exactly as
- * gentle-pi#662/#668 specify:
+ * Computes who verifies a delegated writer's change. Verification follows the
+ * native risk tier whatever the RDD line and native review outcome
+ * (verify-always-rdd-high S1, superseding the gentle-pi#662/#668 on-path): the
+ * native review is an additional outside view and never replaces or skips the
+ * tier's verification. `nativeReviewOutcome` only shapes the reason text.
  *
- * - `rdd: "on"` AND the native review reached `NATIVE_REVIEW_OUTCOME.CLOSED`
- *   for this candidate: the writer self-verifies and no independent verifier
- *   runs, because the closed native review is the check -- except `passive`,
- *   which gets a structural readback by the parent instead.
- * - `rdd: "on"` with any other outcome (`declined`, `unavailable`, or the
- *   fail-closed `unknown` default for an omitted/unrecognized outcome): the
- *   `on` branch never held for this candidate, so the risk-gated path below
- *   applies exactly as `off` -- declining a review is candidate-scoped and
- *   never lowers the bar below the RDD-off path.
- * - `rdd: "off"` or `"unknown"` (both gate identically, so an unknown RDD line
- *   never lowers a tier relative to `off`; `nativeReviewOutcome` is ignored
- *   entirely on these lines):
- *   - `passive`: structural readback by the parent only; no verifier, no
- *     tests.
- *   - `medium`: the writer self-verifies; a separate independent verifier
- *     runs only when `writerProfile` is `"small"` -- the small-model bias
- *     raises the tier by one for verification purposes (medium -> high). An
- *     unknown or omitted writer profile resolves to `"small"` before it
- *     reaches this function (see `resolveWriterProfile`), so an unrecognized
- *     profile never lowers a tier below what a known small model would get.
- *   - `high` or `unassessable` (a failed or unrecognized native assessment is
- *     always treated as high): the writer self-verifies and an independent
- *     verifier always runs.
+ * - `passive`: structural readback by the parent only; no verifier, no tests.
+ * - `medium`: the writer self-verifies; a separate independent verifier runs
+ *   only when `writerProfile` is `"small"` -- the small-model bias raises the
+ *   tier by one for verification purposes (medium -> high). An unknown or
+ *   omitted writer profile resolves to `"small"` before it reaches this
+ *   function (see `resolveWriterProfile`), so an unrecognized profile never
+ *   lowers a tier below what a known small model would get.
+ * - `high` or `unassessable` (a failed or unrecognized native assessment is
+ *   always treated as high): the writer self-verifies and an independent
+ *   verifier always runs.
  */
 export function verificationPlan(input: VerificationPlanInput): VerificationPlan {
 	const { rddLine, risk, writerProfile } = input;
 
 	if (rddLine === RDD_LINE.ON) {
 		const outcome = input.nativeReviewOutcome ?? NATIVE_REVIEW_OUTCOME.UNKNOWN;
-		if (outcome === NATIVE_REVIEW_OUTCOME.CLOSED) {
-			if (risk === VERIFICATION_TIER.PASSIVE) {
-				return Object.freeze({
-					writerSelfVerification: false,
-					structuralReadbackOnly: true,
-					independentVerifier: false,
-					reason: "receipt-driven development is on and the native review closed for this candidate; the assessment also reports passive risk: a structural readback by the parent replaces both the writer's self-verification and any separate verifier.",
-				});
-			}
-			return Object.freeze({
-				writerSelfVerification: true,
-				structuralReadbackOnly: false,
-				independentVerifier: false,
-				reason: "receipt-driven development is on and the native review closed for this candidate: the writer's self-verification is the record and the closed native review was the independent check the writer cannot influence, so no separate verifier is required.",
-			});
-		}
-		// The on branch holds only while the native review reaches a terminal
-		// outcome for this candidate. Anything else -- declined, unavailable, or
-		// unknown -- falls back to the exact same risk-gated path as off.
+		const clause = outcome === NATIVE_REVIEW_OUTCOME.CLOSED
+			? "the native review closed for this candidate"
+			: nonClosedOutcomeClause(outcome);
 		return riskGatedPlan(
-			`receipt-driven development is on, but ${nonClosedOutcomeClause(outcome)}, so the risk-gated path applies exactly as receipt-driven development off, and`,
+			`receipt-driven development is on and ${clause}; the native review is an additional outside view that never replaces verification, so the risk-gated path applies exactly as receipt-driven development off, and`,
 			risk,
 			writerProfile,
 		);

package/lib/review-sidebar-state.ts

@@ -2,6 +2,7 @@ import type { ExtensionAPI, ExtensionContext, ToolDefinition } from "@earendil-w
 import type { TSchema } from "typebox";
 import { NATIVE_REVIEW_ERROR_CODE, NativeReviewCliError } from "./native-review-cli.ts";
 import { sanitizeTerminalText } from "./terminal-theme.ts";
+import { measureStatusSidebar } from "./status-timing-diagnostics.ts";
 
 /** Ephemeral display data only; this event grants no review authority. */
 export const REVIEW_SIDEBAR_EVENT = "gentle-ai:review-sidebar";
@@ -163,7 +164,7 @@ export function createReviewSidebarPublisher(pi: ExtensionAPI) {
 	let generation = 0;
 	let scope: ReviewScope | undefined;
 	const publish = (id: string, snapshot: ReviewSidebarSnapshot) => {
-		try { pi.events?.emit(REVIEW_SIDEBAR_EVENT, { sessionId: id, snapshot }); } catch { /* Display only. */ }
+		try { measureStatusSidebar(() => pi.events?.emit(REVIEW_SIDEBAR_EVENT, { sessionId: id, snapshot })); } catch { /* Display only. */ }
 	};
 	return {
 		reset(ctx?: ExtensionContext) {

package/lib/review-transaction.ts

@@ -994,11 +994,80 @@ function operationForTransition(transition: ReviewTransition): ReviewOperation {
 	throw new ReviewIntegrityError(`Unsupported reducer transition: ${transition}`);
 }
 
+function assertReducerInput(transition: ReviewTransition, input: unknown): asserts input is ReviewReducerInput {
+	const fail = (field: string): never => { throw new ReviewIntegrityError(`Graph reducer input ${field} is invalid`); };
+	const object = (value: unknown, field: string): Record<string, unknown> => {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) return fail(field);
+		return value as Record<string, unknown>;
+	};
+	const string = (value: unknown, field: string): void => { if (typeof value !== "string") fail(field); };
+	const boolean = (value: unknown, field: string): void => { if (typeof value !== "boolean") fail(field); };
+	const strings = (value: unknown, field: string): void => { if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) fail(field); };
+	const rows = (value: unknown, field: string): void => {
+		if (!Array.isArray(value)) return fail(field);
+		// The canonical row decoder checks every field, enum and duplicate ID.
+		createFrozenLedger(value);
+	};
+	const results = (value: unknown, field: string): void => {
+		if (!Array.isArray(value)) return fail(field);
+		for (const item of value) {
+			const result = object(item, field);
+			string(result.id, `${field}.id`);
+			if (!Object.values(RESOLUTION_OUTCOME).some((outcome) => outcome === result.outcome)) fail(`${field}.outcome`);
+		}
+	};
+	const body = object(input, "object");
+	switch (transition) {
+		case REVIEW_TRANSITION.ORDINARY_DISCOVERY: rows(body.rows, "rows"); break;
+		case REVIEW_TRANSITION.JUDGMENT_DAY_DISCOVERY: rows(body.judgeA, "judgeA"); rows(body.judgeB, "judgeB"); break;
+		case REVIEW_TRANSITION.ORDINARY_EVIDENCE:
+			results(body.deterministicResults, "deterministicResults");
+			if (body.refuterResults !== undefined) results(body.refuterResults, "refuterResults");
+			break;
+		case REVIEW_TRANSITION.ORDINARY_FIX:
+		case REVIEW_TRANSITION.JUDGMENT_DAY_FIX:
+			string(body.candidateTree, "candidateTree"); strings(body.fixedIds, "fixedIds"); string(body.fixDiff, "fixDiff");
+			if (body.changedPaths !== undefined) strings(body.changedPaths, "changedPaths");
+			break;
+		case REVIEW_TRANSITION.ORDINARY_NO_FIX: string(body.reason, "reason"); break;
+		case REVIEW_TRANSITION.ORDINARY_FINAL_VERIFICATION:
+		case REVIEW_TRANSITION.JUDGMENT_DAY_FINAL_VERIFICATION:
+			boolean(body.passed, "passed"); if (body.reason !== undefined) string(body.reason, "reason"); break;
+		case REVIEW_TRANSITION.ORDINARY_VALIDATION:
+		case REVIEW_TRANSITION.JUDGMENT_DAY_REJUDGMENT: {
+			const request = object(body.request, "request");
+			strings(request.requested_ids, "request.requested_ids"); rows(request.frozen_rows, "request.frozen_rows"); string(request.frozen_ledger_hash, "request.frozen_ledger_hash");
+			if (transition === REVIEW_TRANSITION.JUDGMENT_DAY_REJUDGMENT) {
+				for (const field of ["fix_diff", "fix_diff_hash", "candidate_tree"]) string(request[field], `request.${field}`);
+				if (typeof request.round !== "number" || !Number.isSafeInteger(request.round) || request.round < 1) fail("request.round");
+				results(body.judgeAResults, "judgeAResults"); results(body.judgeBResults, "judgeBResults");
+			} else {
+				results(body.results, "results");
+				const acceptance = object(request.original_acceptance_tests, "request.original_acceptance_tests");
+				boolean(acceptance.passed, "request.original_acceptance_tests.passed"); string(acceptance.evidence_hash, "request.original_acceptance_tests.evidence_hash");
+				strings(request.original_criterion_regressions, "request.original_criterion_regressions");
+				if (!Array.isArray(request.correction_regressions) || !Array.isArray(request.follow_ups)) return fail("request.validation arrays");
+				for (const value of request.correction_regressions) {
+					const regression = object(value, "request.correction_regressions");
+					string(regression.finding_id, "regression.finding_id"); string(regression.evidence_hash, "regression.evidence_hash"); boolean(regression.passed, "regression.passed");
+				}
+				for (const value of request.follow_ups) {
+					const followUp = object(value, "request.follow_ups");
+					for (const field of ["id", "location", "summary", "evidence_hash"]) string(followUp[field], `follow_up.${field}`);
+				}
+			}
+			break;
+		}
+		default: fail("transition");
+	}
+}
+
 function reduceReviewState(
 	state: ReviewStateV1,
 	transition: ReviewTransition,
-	input: ReviewReducerInput,
+	input: unknown,
 ): ReviewStateV1 {
+	assertReducerInput(transition, input);
 	switch (transition) {
 		case REVIEW_TRANSITION.ORDINARY_DISCOVERY:
 			return recordOrdinaryDiscovery(state, input as OrdinaryDiscoveryInput);
@@ -1456,8 +1525,8 @@ export class ReviewTransactionStore {
 		const existing = current ? (current.body.lineages as Array<Record<string, unknown>>).find((value) => value.lineage_id === next.lineage_id && value.mode === "graph") : undefined;
 		if (previous && !existing) throw new ReviewIntegrityError("Graph predecessor is missing");
 		if (!previous && existing) throw new ReviewIntegrityError("Graph lineage already exists");
-		const predecessor = existing?.head_event_id;
-		if (predecessor !== undefined && typeof predecessor !== "string") throw new ReviewIntegrityError("Graph head is invalid");
+		if (existing?.head_event_id !== undefined && typeof existing.head_event_id !== "string") throw new ReviewIntegrityError("Graph head is invalid");
+		const predecessor = typeof existing?.head_event_id === "string" ? existing.head_event_id : undefined;
 		const last = next.request_journal.at(-1);
 		const descriptor = (() => { try { return graph.readStoreDescriptor(); } catch { return undefined; } })();
 		const reducerTransition = eventContext?.transition ?? (predecessor === undefined ? "start" : last?.operation ?? "state-update");

package/lib/runtime-metrics-children.ts

@@ -18,7 +18,7 @@ const tokenFields = ["input", "output", "cacheRead", "cacheWrite", "reasoning",
  * Only the fixed package catalog is cached; runtime instructions are not retained.
  */
 let definitions: Array<{ name: string; fingerprint: string; fingerprintClass?: AgentClass }> | undefined;
-const packagedAgentClassAliases = new Map([["sdd-proposal", "sdd-propose"]] as const);
+const packagedAgentClassAliases = new Map<string, string>([["sdd-proposal", "sdd-propose"]]);
 function fingerprintAgentClassName(name: string): string {
 	const compatibilityName = name.startsWith("gentle-ai-") ? name.slice("gentle-ai-".length) : name;
 	return packagedAgentClassAliases.get(compatibilityName) ?? compatibilityName;

package/lib/runtime-metrics-native.ts

@@ -1,5 +1,5 @@
 import { spawn, type ChildProcessWithoutNullStreams, type SpawnOptionsWithoutStdio } from "node:child_process";
-import { resolveGentleAiBinary } from "./gentle-ai-binary.ts";
+import { gentleAiIsolationEnv, resolveGentleAiBinary } from "./gentle-ai-binary.ts";
 import { runtimeMetricsEnvAllows } from "./runtime-metrics-policy.ts";
 import { isPublicRuntimeModelId, normalizeRuntimeModel, type RuntimeMetricBucket } from "./runtime-metrics.ts";
 import type { ChildLaunchBucket } from "./runtime-metrics-children.ts";
@@ -105,7 +105,8 @@ export async function sendNativeRuntimeEvent(rows: readonly RuntimeMetricBucket[
 		const file = (deps.resolve ?? resolveGentleAiBinary)();
 		if (!runtimeMetricsEnvAllows(env)) return "disabled";
 		if (deps.signal?.aborted || deps.current?.() === false) return "discarded";
-		return await sendProcess(file, cwd, payload, env, deps.spawn ?? spawn, deps.signal);
+		// S9: a bundled install keeps Gentle AI's state inside its prefix.
+		return await sendProcess(file, cwd, payload, gentleAiIsolationEnv(env), deps.spawn ?? spawn, deps.signal);
 	} catch { return "discarded"; }
 	finally { busy = false; }
 }