gentle-pi 4.2.0 → 4.3.0

package/tests/pi-update-launcher.test.ts

@@ -5,7 +5,7 @@ import { test } from 'node:test';
 const PI = '@earendil-works/pi-coding-agent';
 // A virtual symlink filesystem: listed global links point into a pnpm store.
 // The store's adjacent peer is a sibling, not Shell/node_modules/Pi.
-function launch(args: string[], scenario = 'owned') {
+function launch(args: string[], scenario = 'owned', piVersion = '1.2.0') {
  const adjacent = scenario.startsWith('adjacent');
  const npm = scenario.startsWith('npm-');
  const nodeModules = '/global/v11/selected/node_modules';
@@ -31,7 +31,7 @@ function launch(args: string[], scenario = 'owned') {
    source = source.replace('const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));', ${JSON.stringify(`const packageRoot = '${shellRoot}';`)});
    source = source.replace('const bundled = resolveBundledInstall({ packageRoot, platform: process.platform, fs: bundledFs, verifying });', 'const bundled = undefined;');
    source = source.replace('runtime = resolvePiRuntime({', ${JSON.stringify(`runtime = ({ kind: '${adjacent ? 'bundled' : 'env'}', command: '${adjacent ? 'node' : piRoot + '/dist/bundle/cli.js'}', args: ${JSON.stringify(adjacent ? [piRoot + '/dist/bundle/cli.js'] : [])} }); /*`)}).replace('nodeExecPath: process.execPath,\\n\\t\\t});', 'nodeExecPath: process.execPath, */');
-   source = source.replace('const versionProbe = spawnSync(versionProbePlan.command, versionProbePlan.args, {', 'const versionProbe = { stdout: "1.2.0" }; /*').replace('env: bundledEnv ?? process.env,\\n\\t});', 'env: bundledEnv ?? process.env, */');
+   source = source.replace('const versionProbe = spawnSync(versionProbePlan.command, versionProbePlan.args, {', 'const versionProbe = { stdout: "${piVersion}" }; /*').replace('env: bundledEnv ?? process.env,\\n\\t});', 'env: bundledEnv ?? process.env, */');
    source = source.replace('async function packageManagerAdapters() {', 'async function packageManagerAdapters() { return globalThis.fakeAdapters; } async function unusedAdapters() {');
    source = source.replace('let homeHadContentBeforeBootstrap = false;', 'if (passthrough.length === 1) { console.error("error: pi cannot self-update this installation. This installation is not managed by a global pnpm install."); process.exitCode = 1; return; } console.log("FORWARD " + JSON.stringify(passthrough)); return; let homeHadContentBeforeBootstrap = false;');
    return {format:'module', source, shortCircuit:true};
@@ -79,6 +79,25 @@ for (const scenario of ['ambiguous', 'malformed', 'npm-link', 'npm-file', 'share
  assert.doesNotMatch(result.stdout + result.stderr, /MUTATION/);
 });
 
+// `update` is how an old Pi gets replaced, so the minimum-version gate must not block it.
+test('public update replaces a Pi older than the required minimum', () => {
+ const result = launch(['update'], 'owned', '1.1.0');
+ assert.equal(result.status, 0, result.stderr);
+ assert.match(result.stdout, /MUTATION \["add","-g","@earendil-works\/pi-coding-agent@latest"\]/);
+ assert.doesNotMatch(result.stdout + result.stderr, /older than the required minimum/);
+ assert.equal(result.stderr, '');
+});
+
+test('an old Pi still fails the minimum-version gate outside a self update', () => {
+ for (const args of [['list'], ['update', '--extensions-only']]) {
+  const result = launch(args, 'owned', '1.1.0');
+  assert.equal(result.status, 1, result.stdout);
+  assert.equal(result.stdout, '');
+  assert.match(result.stderr, /pi version 1\.1\.0 is older than the required minimum 1\.2\.0\./);
+  assert.doesNotMatch(result.stdout, /MUTATION/);
+ }
+});
+
 test('public extensions-only update preserves the forwarded command', () => {
  const result = launch(['update', '--extensions-only']);
  assert.equal(result.status, 0, result.stderr);

package/tests/primary-session-prompt.test.ts

@@ -0,0 +1,101 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test, { after, before } from "node:test";
+import { __testing } from "../extensions/gentle-ai.ts";
+
+// gentle-ai R3 (odd/tasks/pi-routing-from-bundle.md): the harness ODD step
+// lines 1-7, the phase-reporting line, and the resume line come from the
+// mirrored provider contract bundle's routing/pi.md instead of a hand-copied
+// literal, and the rendered primary-session prompt stays byte-identical.
+//
+// The golden was captured from the base commit (main 4372ff2d, after R1) before the steps moved into the
+// bundle, with the inputs below and the package assets root normalized. When a
+// prompt change is intended, regenerate it with
+// UPDATE_PRIMARY_SESSION_PROMPT_GOLDEN=1 and review the golden diff.
+
+const REPO_ROOT = join(import.meta.dirname, "..");
+const GOLDEN_PATH = join(REPO_ROOT, "tests", "fixtures", "primary-session-prompt", "gentleman.golden.md");
+const ACTIVE_TOOLS = ["read", "bash", "edit", "write", "subagent_run"] as const;
+const MIRROR_ROOT = join(REPO_ROOT, "contracts", "review-provider-contract-mirror");
+
+let scratch: string;
+const previousEnvironment = new Map<string, string | undefined>();
+before(() => {
+	scratch = mkdtempSync(join(tmpdir(), "gentle-pi-primary-prompt-"));
+	for (const key of ["GENTLE_PI_CONFIG_HOME", "GENTLE_PI_BACKGROUND_SUBAGENTS"]) previousEnvironment.set(key, process.env[key]);
+	process.env.GENTLE_PI_CONFIG_HOME = join(scratch, "config");
+	delete process.env.GENTLE_PI_BACKGROUND_SUBAGENTS;
+});
+after(() => {
+	for (const [key, value] of previousEnvironment) {
+		if (value === undefined) delete process.env[key];
+		else process.env[key] = value;
+	}
+	rmSync(scratch, { recursive: true, force: true });
+});
+
+function renderPrimaryPrompt(): string {
+	const prompt = __testing.buildGentlePrompt("gentleman", join(scratch, "project"), ACTIVE_TOOLS);
+	return prompt.replaceAll(join(REPO_ROOT, "assets"), "{{GENTLE_PI_ASSETS_ROOT}}");
+}
+
+function mirroredRoutingText(): string {
+	const lock = JSON.parse(readFileSync(join(MIRROR_ROOT, "provider-contract.lock.json"), "utf8")) as { contract_semver: string };
+	return readFileSync(join(MIRROR_ROOT, `v${lock.contract_semver}`, "bundle", "routing", "pi.md"), "utf8");
+}
+
+// Writes a one-file mirror whose lock records `entrySha256` for routing/pi.md.
+function tempRoutingMirror(text: string, entrySha256 = createHash("sha256").update(text, "utf8").digest("hex")): string {
+	const root = mkdtempSync(join(scratch, "mirror-"));
+	const routingDir = join(root, "v9.9.9", "bundle", "routing");
+	mkdirSync(routingDir, { recursive: true });
+	writeFileSync(join(routingDir, "pi.md"), text, "utf8");
+	writeFileSync(join(root, "provider-contract.lock.json"), JSON.stringify({ contract_semver: "9.9.9", entries: { "routing/pi.md": entrySha256 } }), "utf8");
+	return root;
+}
+
+test("the rendered primary-session prompt is byte-identical to the golden captured from the base", () => {
+	const rendered = renderPrimaryPrompt();
+	if (process.env.UPDATE_PRIMARY_SESSION_PROMPT_GOLDEN === "1") writeFileSync(GOLDEN_PATH, rendered, "utf8");
+	assert.equal(rendered, readFileSync(GOLDEN_PATH, "utf8"));
+});
+
+test("the ODD steps, phase reporting, and resume lines come from the mirrored routing/pi.md without its blank lines", () => {
+	const routing = mirroredRoutingText();
+	const section = routing.slice(routing.indexOf("### ODD protocol"), routing.indexOf("\n### Task Size"));
+	const expected = section.split("\n").slice(1).filter((line) => line !== "");
+	assert.equal(expected.length, 9);
+	assert.equal(__testing.readMirroredOddProtocolSteps(), expected.join("\n"));
+	assert.ok(renderPrimaryPrompt().includes(`Run these steps in this order on every request:\n${expected.join("\n")}\n\nHarness principles:`));
+	assert.ok(routing.includes(`${expected[6]}\n\n${expected[7]}\n\n${expected[8]}`), "the bundle separates step 7, phase reporting, and resume with blank lines");
+});
+
+test("extensions/gentle-ai.ts no longer carries the ODD step lines as string literals", () => {
+	const source = readFileSync(join(REPO_ROOT, "extensions", "gentle-ai.ts"), "utf8");
+	for (const literal of ["1. **Authorize.**", "5. **Track before the first write.**", "7. **Close.**", "Phase reporting: the Gentle Shell prompt label", "Resume an interrupted feature with"]) {
+		assert.ok(!source.includes(literal), `extensions/gentle-ai.ts still hard-codes ${JSON.stringify(literal)}`);
+	}
+});
+
+test("a changed mirrored routing block changes the rendered steps", () => {
+	const routing = mirroredRoutingText().replace("1. **Authorize.** ", "1. **Authorize.** Changed upstream. ");
+	const mirror = tempRoutingMirror(routing);
+	assert.match(__testing.readMirroredOddProtocolSteps(mirror), /^1\. \*\*Authorize\.\*\* Changed upstream\. /);
+});
+
+test("a tampered or missing mirrored routing/pi.md fails closed with an explicit error", () => {
+	const unavailable = /Gentle Shell cannot render its ODD steps: the mirrored provider bundle's routing\/pi\.md is missing, unreadable, or fails digest verification/;
+	assert.throws(() => __testing.readMirroredOddProtocolSteps(tempRoutingMirror(mirroredRoutingText(), "0".repeat(64))), unavailable);
+	assert.throws(() => __testing.readMirroredOddProtocolSteps(join(scratch, "absent-mirror")), unavailable);
+});
+
+test("a routing block whose ODD protocol section changed shape fails closed", () => {
+	const unexpectedShape = /routing\/pi\.md ODD protocol section has an unexpected shape/;
+	const withoutResume = mirroredRoutingText().replace(/\nResume an interrupted feature[^\n]*\n/, "\n");
+	assert.throws(() => __testing.readMirroredOddProtocolSteps(tempRoutingMirror(withoutResume)), unexpectedShape);
+	const withoutSection = mirroredRoutingText().replace("### ODD protocol (MANDATORY, in this order, on every request)", "### ODD protocol");
+	assert.throws(() => __testing.readMirroredOddProtocolSteps(tempRoutingMirror(withoutSection)), unexpectedShape);
+});

package/tests/provider-contract-bundle.test.ts

@@ -45,6 +45,26 @@ function fixture120Entries(): Map<string, Buffer> {
 	return new Map(FIXTURE_1_2_0_PATHS.map((path) => [path, readFileSync(join(FIXTURE_1_2_0_ROOT, path))]));
 }
 
+// Fixture provenance: the gentle-ai provider contract bundle 1.4.0 archive
+// built by goreleaser (archives `review-provider-contract`) from gentle-ai
+// 9e6f24f6, extracted. Adds `routing` to the manifest: Pi's ODD routing steps.
+const FIXTURE_1_4_0_ROOT = join(import.meta.dirname, "fixtures", "provider-contract-bundle", "v1.4.0");
+const FIXTURE_1_4_0_PATHS = [...FIXTURE_1_2_0_PATHS, "routing/pi.md"] as const;
+
+function fixture140Entries(): Map<string, Buffer> {
+	return new Map(FIXTURE_1_4_0_PATHS.map((path) => [path, readFileSync(join(FIXTURE_1_4_0_ROOT, path))]));
+}
+
+// A valid 1.3.0-shaped bundle: the 1.4.0 fixture without the routing field and file.
+function contractOneThreeEntries(): Map<string, Buffer> {
+	const entries = withManifest(fixture140Entries(), (manifest) => {
+		manifest.contract_semver = "1.3.0";
+		delete manifest.routing;
+	});
+	entries.delete("routing/pi.md");
+	return entries;
+}
+
 function sha256Hex(bytes: Buffer): string {
 	return createHash("sha256").update(bytes).digest("hex");
 }
@@ -391,6 +411,104 @@ test("rejects an orchestration array on a 1.1.0 manifest", () => {
 	);
 });
 
+// --- routing (contract 1.4.0) ----------------------------------------------------------
+
+test("verifies the 1.4.0 fixture tree and exposes the mirrored pi routing text", () => {
+	const bundle = verifyProviderContractBundleTree(FIXTURE_1_4_0_ROOT);
+	assert.equal(bundle.contractSemver, "1.4.0");
+	assert.equal(bundle.entries.size, 10);
+	assert.deepEqual([...bundle.orchestration.keys()], [PI_RUNTIME_IDENTITY]);
+	assert.deepEqual([...bundle.routing.keys()], [PI_RUNTIME_IDENTITY]);
+	assert.equal(bundle.routing.get(PI_RUNTIME_IDENTITY), readFileSync(join(FIXTURE_1_4_0_ROOT, "routing/pi.md"), "utf8"));
+	assert.equal(bundle.entrySha256.get("routing/pi.md"), sha256Hex(readFileSync(join(FIXTURE_1_4_0_ROOT, "routing/pi.md"))));
+});
+
+test("verifies the 1.4.0 release archive in memory", () => {
+	withTemporaryDirectory((directory) => {
+		const archivePath = join(directory, "gentle-ai-review-provider-contract-1.4.0.tar.gz");
+		writeFileSync(archivePath, buildTarGz([...fixture140Entries()].map(([name, bytes]) => ({ name, bytes }))));
+		const { bundle } = verifyProviderContractBundleArchive(archivePath);
+		assert.equal(bundle.contractSemver, "1.4.0");
+		assert.deepEqual([...bundle.routing.keys()], [PI_RUNTIME_IDENTITY]);
+	});
+});
+
+test("a 1.3.0 bundle without routing still verifies with an empty routing inventory", () => {
+	const bundle = verifyProviderContractBundleEntries(contractOneThreeEntries());
+	assert.equal(bundle.contractSemver, "1.3.0");
+	assert.equal(bundle.entries.size, 9);
+	assert.equal(bundle.routing.size, 0);
+	assert.deepEqual([...bundle.orchestration.keys()], [PI_RUNTIME_IDENTITY]);
+});
+
+test("rejects a 1.4.0 manifest without the required routing array", () => {
+	const entries = withManifest(fixture140Entries(), (manifest) => {
+		delete manifest.routing;
+	});
+	assertRejects(entries, "manifest.routing is required from contract 1.4.0");
+});
+
+test("rejects a routing array on a 1.3.0 manifest", () => {
+	const entries = withManifest(fixture140Entries(), (manifest) => {
+		manifest.contract_semver = "1.3.0";
+	});
+	assertRejects(entries, "manifest.routing is not part of contract 1.3.0");
+});
+
+test("rejects a 1.4.0 routing entry whose runtime is not registered in manifest.runtimes", () => {
+	assertRejects(
+		withManifest(fixture140Entries(), (manifest) => {
+			const routing = manifest.routing as { runtime: string; file: { path: string } }[];
+			routing[0]!.runtime = "aider";
+			routing[0]!.file.path = "routing/aider.md";
+		}),
+		'manifest.routing[0].runtime "aider" is not registered in manifest.runtimes',
+	);
+});
+
+test("rejects a 1.4.0 routing entry that points outside routing/<runtime>.md", () => {
+	assertRejects(
+		withManifest(fixture140Entries(), (manifest) => {
+			(manifest.routing as { file: { path: string } }[])[0]!.file.path = "orchestration/pi.md";
+		}),
+		'manifest.routing[0].file.path must be "routing/pi.md"',
+	);
+});
+
+test("rejects a 1.4.0 routing entry whose file bytes do not match its manifest SHA-256", () => {
+	const entries = fixture140Entries();
+	const tampered = Buffer.from(entries.get("routing/pi.md") as Buffer);
+	tampered[tampered.length - 2] = 0x20;
+	entries.set("routing/pi.md", tampered);
+	assertRejects(entries, "does not match its manifest SHA-256");
+});
+
+test("rejects a 1.4.0 bundle missing its routing file", () => {
+	const entries = fixture140Entries();
+	entries.delete("routing/pi.md");
+	assertRejects(entries, "bundle inventory has 9 files; exactly 10 are expected");
+});
+
+test("the raw-entry bound leaves room for one routing file per runtime before the exact count decides", () => {
+	const entries = fixture140Entries();
+	for (let index = 0; index < 70; index += 1) entries.set(`extra/${index}.md`, Buffer.from("x\n"));
+	assertRejects(entries, "bundle inventory has 80 files; exactly 10 are expected");
+});
+
+test("generated 1.4.0 baselines record the mirrored routing entry", () => {
+	const bundle = verifyProviderContractBundleTree(FIXTURE_1_4_0_ROOT);
+	const capabilities = JSON.parse(
+		generateProviderContractBaselines(bundle).get("provider-capabilities.baseline.json") as string,
+	) as { routing: { runtime: string; path: string; sha256: string }[] };
+	assert.deepEqual(capabilities.routing, [
+		{ runtime: PI_RUNTIME_IDENTITY, path: "routing/pi.md", sha256: bundle.entrySha256.get("routing/pi.md") },
+	]);
+	const older = JSON.parse(
+		generateProviderContractBaselines(verifyProviderContractBundleTree(FIXTURE_1_2_0_ROOT)).get("provider-capabilities.baseline.json") as string,
+	) as { routing: unknown[] };
+	assert.deepEqual(older.routing, []);
+});
+
 // --- archive safety ------------------------------------------------------------------
 
 test("rejects a tar entry that escapes the bundle root", () => {

package/tests/provider-contract-mirror.test.ts

@@ -31,6 +31,10 @@ const FIXTURE_PATHS = [
 // release archive, extracted. gentle-pi#560 / gentle-ai#4056, #4057.
 const FIXTURE_1_2_0_ROOT = join(import.meta.dirname, "fixtures", "provider-contract-bundle", "v1.2.0");
 
+// Fixture provenance: the gentle-ai provider contract bundle 1.4.0 archive
+// built by goreleaser, extracted. Adds Pi's ODD routing block as routing/pi.md.
+const FIXTURE_1_4_0_ROOT = join(import.meta.dirname, "fixtures", "provider-contract-bundle", "v1.4.0");
+
 interface LockRecord {
 	schema: string;
 	acquisition: string;
@@ -124,6 +128,26 @@ test("mirrors a verified local 1.2.0 bundle tree, including its orchestration en
 	});
 });
 
+test("mirrors a verified local 1.4.0 bundle tree, including its routing entry, and the offline drift check passes", () => {
+	withTemporaryRoot((packageRoot) => {
+		mirrorProviderContractBundle(FIXTURE_1_4_0_ROOT, packageRoot);
+		const lock = JSON.parse(
+			readFileSync(join(packageRoot, PROVIDER_CONTRACT_MIRROR_ROOT, PROVIDER_CONTRACT_LOCK_FILE), "utf8"),
+		) as LockRecord;
+		assert.equal(lock.contract_semver, "1.4.0");
+		assert.equal(Object.keys(lock.entries).length, 10);
+		assert.ok("routing/pi.md" in lock.entries, "the mirrored lock must record routing/pi.md");
+		const mirrored = join(packageRoot, PROVIDER_CONTRACT_MIRROR_ROOT, "v1.4.0", "bundle", "routing", "pi.md");
+		assert.deepEqual(readFileSync(mirrored), readFileSync(join(FIXTURE_1_4_0_ROOT, "routing", "pi.md")));
+		assert.deepEqual(checkProviderContractMirror(packageRoot), []);
+
+		writeFileSync(mirrored, `${readFileSync(mirrored, "utf8")}tampered\n`);
+		const problems = checkProviderContractMirror(packageRoot);
+		assert.equal(problems.length, 1);
+		assert.match(problems[0] ?? "", /mirrored bundle failed verification: .*"routing\/pi\.md" does not match its manifest SHA-256/);
+	});
+});
+
 test("mirrors a verified local archive and records the archive digest in the lock", () => {
 	withTemporaryRoot((packageRoot) => {
 		const archivePath = join(packageRoot, "gentle-ai-review-provider-contract-1.1.0.tar.gz");

package/tests/quiet-tool-rendering.test.ts

@@ -1232,6 +1232,29 @@ test("quiet tool rendering preserves complete expanded text and delegates saniti
 	assert.doesNotMatch(image, /\x1b/);
 });
 
+test("quiet tool rendering re-renders expanded read-with-image results without crashing when lastComponent is passed (#1620)", () => {
+	const tools = registeredQuietTools();
+	const readTool = tools.get("read");
+	const result = {
+		content: [{ type: "image", data: "iVBORw0KGgo=", mimeType: "image/png" }],
+		details: { path: "image.png" },
+	};
+	const context = { args: { path: "image.png" }, cwd: "/repo", showImages: false, isError: false };
+
+	const initialComponent = readTool.renderResult(result, { expanded: true, isPartial: false }, passthroughTheme, context);
+	const initialOutput = renderToString(initialComponent);
+	assert.ok(initialOutput.includes(imageFallback("image/png")));
+
+	const reRenderComponent = readTool.renderResult(
+		result,
+		{ expanded: true, isPartial: false },
+		passthroughTheme,
+		{ ...context, lastComponent: initialComponent },
+	);
+	const reRenderOutput = renderToString(reRenderComponent);
+	assert.ok(reRenderOutput.includes(imageFallback("image/png")));
+});
+
 test("quiet tool rendering preserves directional visual preview rows at narrow widths", () => {
 	const tools = registeredQuietTools();
 	const bash = tools.get("bash");

package/tests/rdd-aware-verification-contract.test.ts

@@ -48,13 +48,18 @@ const ROUTING_SENTENCE =
 	'After the writer returns, call `gentle_review` with `{"operation":"assess"}` over the writer\'s diff and follow the returned plan, whatever the `Receipt-driven development:` line reads (`on`, `off`, or `unknown`), instead of judging non-triviality from the task description: the operation resolves the native risk tier and states exactly who verifies next.';
 const RDD_ON_SENTENCE =
 	"When the line reads `on`, the native review is an additional outside view of the change; it never replaces or skips the tier's verification, and the tier's verifier runs before review.";
-const TIER_TABLE_HEADER = "| Native risk tier | Verification (any RDD state) |";
+// Verification by named risk changed the tier table and replaced the
+// small-model bias sentence: the independent verifier runs only through an
+// `escalate` naming a Task Size high-risk item; a native high, a failed
+// assessment, and the writer's model or effort inform only.
+const TIER_TABLE_HEADER = "| Tier | Verification (any RDD state) |";
 const PASSIVE_TIER_ROW = "| passive | structural readback by the parent; no separate verifier, no tests |";
-const MEDIUM_TIER_ROW = "| medium | writer self-verification stands; a separate `gentle-ai-verify` run is added only when the writer profile is a small model (mini or low effort) |";
-const HIGH_TIER_ROW = "| high | writer self-verification plus a separate `gentle-ai-verify` run, always |";
-const UNASSESSABLE_TIER_ROW = "| unknown / assess failed | treated as high |";
-const SMALL_MODEL_BIAS_SENTENCE =
-	"The small-model bias raises the tier by one for verification purposes (medium becomes high); an unknown `Receipt-driven development:` line never lowers a tier below `off`.";
+const MEDIUM_TIER_ROW = "| medium | writer self-verification stands; no separate verifier, whatever model wrote the change |";
+const HIGH_TIER_ROW = "| high | only through `escalate` naming a Task Size high-risk item: writer self-verification plus one separate `gentle-ai-verify` run |";
+const UNASSESSABLE_TIER_ROW = "| native high, unknown, or assess failed | informs only: writer self-verification stands; escalate when a named high-risk item applies |";
+// odd/tasks/verifier-admission.md S6: the sentence names the runtime admission of the verifier launch.
+const NAMED_RISK_SENTENCE =
+	"The independent verifier runs only when the change touches a named Task Size high-risk item, passed as `escalate` (the runtime admits its launch on a `Risk: item N` line, a feature-document task line, or past the context backstop); never for size, a native tier alone, a failed assessment, or the model or effort that wrote the change. An unknown `Receipt-driven development:` line never lowers a tier below `off`.";
 const SPOT_CHECK_SENTENCE =
 	"The parent spot check (re-running one reported command before delivery) stays required in every tier.";
 test("trigger 5 (Verification rule) routes every RDD line through assess and the risk tier", () => {
@@ -74,8 +79,9 @@ test("trigger 5 states the native risk tier table exactly once, with all four ro
 	}
 });
 
-test("trigger 5 states the small-model bias and the unknown-never-lowers-a-tier rule", () => {
-	assert.ok(delegation.includes(SMALL_MODEL_BIAS_SENTENCE), "trigger 5 is missing the small-model bias sentence");
+test("trigger 5 states the named-risk verifier rule and the unknown-never-lowers-a-tier rule", () => {
+	assert.ok(delegation.includes(NAMED_RISK_SENTENCE), "trigger 5 is missing the named-risk verifier sentence");
+	assert.ok(!delegation.includes("small-model bias"), "the retired small-model bias must not survive in any orchestrator module");
 });
 
 test("trigger 5 keeps the parent spot check requirement in every tier", () => {
@@ -99,10 +105,11 @@ test("trigger 5 never restates the retired #661 off/unknown non-trivial judgment
 	assert.doesNotMatch(delegation, /purely passive documentation with no behavior to verify/);
 });
 
+// S9 canon change (gentle-ai 87a3b2eb): the trigger section heading dropped "Mandatory".
 test("the Simple Delegation paragraph references trigger 3 instead of restating the on/off/unknown routing", () => {
 	assert.match(
 		delegation,
-		/per the RDD-aware Verification rule \(trigger 3 under Mandatory Delegation Triggers, gentle-pi#661\)/,
+		/per the RDD-aware Verification rule \(trigger 3 under Delegation Triggers, gentle-pi#661\)/,
 	);
 	assert.match(delegation, /the normative on\/off\/unknown routing lives in `orchestrator-verification.md`, not here/);
 });
@@ -223,7 +230,9 @@ test("worker asset keeps the existing Return contract fields", () => {
 // delegation asset, and docs/delegated-verification.md -- and they must say
 // the same thing about the behavior ASSESS implements: closure only from the
 // native `candidate.consumed` fact for this candidate, the runtime writer
-// profile with a caller fallback, the conservative small-model bias, the
+// profile with a caller fallback, a writer profile that never adds a verifier
+// (verification by named risk retired the small-model bias), the escalate-only
+// independent verifier, the
 // declined/unavailable/unknown fallback, and functional checks that a native
 // review never replaces. Assertions use short stable phrases, normalized for
 // case, quoting, and line wrapping, not whole paragraphs.
@@ -267,7 +276,8 @@ const SHARED_POLICY_PHRASES: ReadonlyArray<readonly [string, string]> = [
 	["caller closure claim is not authority", "a caller-supplied closed is not authority"],
 	["runtime writer profile", "runtime-recorded model and effort of the pending mutations"],
 	["caller profile is only a fallback", "only a fallback when no runtime evidence exists"],
-	["conservative small-model bias", "keeps the conservative small-model bias"],
+	["writer profile never adds a verifier", "the writer profile is reported but never adds a verifier"],
+	["independent verifier only through escalate", "only when escalate names a task size high-risk item"],
 	["native review never replaces verification (verify-always-rdd-high S1)", "native review is an additional outside view"],
 	["functional checks still run", "a native code review is not a substitute for applicable functional checks"],
 ];
@@ -280,6 +290,14 @@ test("the three verification policy surfaces carry the same ASSESS closure, prof
 	}
 });
 
+test("no verification policy surface still carries the retired small-model bias or unassessable-as-high rule", () => {
+	for (const [surface, text] of POLICY_SURFACES) {
+		for (const stale of ["small-model bias", "treated as high", "verified exactly like high", "fail closed to high"]) {
+			assert.ok(!text.includes(stale), `${surface} still carries the retired wording: "${stale}"`);
+		}
+	}
+});
+
 test("no verification policy surface still tells callers to pass closed explicitly (gentle-pi#1175)", () => {
 	for (const [surface, text] of POLICY_SURFACES) {
 		for (const stale of ["closed is never derived", "closed is never auto-derived", "closed is never inferred", "pass it explicitly", "pass it only right after"]) {

package/tests/rdd-status-line.test.ts

@@ -2,7 +2,10 @@ import assert from "node:assert/strict";
 import test from "node:test";
 import { __testing } from "../extensions/gentle-ai.ts";
 import {
+	NATIVE_REVIEW_ERROR_CODE,
 	NATIVE_REVIEW_MODE_OPERATION,
+	NATIVE_REVIEW_OPERATION,
+	NativeReviewCliError,
 	NATIVE_REVIEW_MODE_SOURCE,
 	type NativeReviewCli,
 	type NativeReviewModeRequest,
@@ -31,6 +34,7 @@ import {
 
 const {
 	renderRddStatusLine,
+	pinRddStatusLine,
 	resolveRddModeStatus,
 	resolveRddStatusLine,
 	getOrchestratorPrompt,
@@ -358,3 +362,78 @@ test("resolveRddModeStatus stays unknown when no status was ever read", async ()
 	const cli = fakeReviewMode(() => { throw new Error("never available"); });
 	assert.equal(await resolveRddModeStatus(cli, "/repo-never-known"), undefined);
 });
+
+// gentle-shell#2250: the one-shot unavailable notice must name the cause so a
+// user on a slow or foreign-owned filesystem can tell a timeout from a native
+// refusal instead of reading a generic "absent, timed out, or failed".
+function captureNotices(): { ctx: { hasUI: true; ui: { notify(message: string, level: string): void } }; messages: string[] } {
+	const messages: string[] = [];
+	return { ctx: { hasUI: true, ui: { notify(message: string) { messages.push(message); } } }, messages };
+}
+
+test("the unavailable notice names the native failure and its stderr", async () => {
+	clearRddStatusMemoForTesting();
+	const { ctx, messages } = captureNotices();
+	const cli = fakeReviewMode(() => {
+		throw new NativeReviewCliError(NATIVE_REVIEW_ERROR_CODE.NON_ZERO, NATIVE_REVIEW_OPERATION.MODE, true, false, "native process failed", {
+			operation: NATIVE_REVIEW_OPERATION.MODE,
+			error_code: NATIVE_REVIEW_ERROR_CODE.NON_ZERO,
+			exit_code: 1,
+			timed_out: false,
+			output_limit_exceeded: false,
+			stderr: "fatal: detected dubious ownership in repository",
+		});
+	});
+	assert.equal(await resolveRddModeStatus(cli, "/repo-native-failure", undefined, Date.now, ctx as never), undefined);
+	assert.equal(messages.length, 1);
+	assert.match(messages[0], /status is unavailable: native `gentle-ai review mode status` failed \(non-zero, exit 1\): fatal: detected dubious ownership in repository\./);
+	assert.match(messages[0], /keeps the last known status/);
+});
+
+test("the unavailable notice reports a timeout distinctly", async () => {
+	clearRddStatusMemoForTesting();
+	const { ctx, messages } = captureNotices();
+	const keepalive = setTimeout(() => {}, 2000);
+	try {
+		await resolveRddModeStatus(fakeReviewMode(() => new Promise<never>(() => {})), "/repo-timeout", AbortSignal.timeout(50), Date.now, ctx as never);
+	} finally {
+		clearTimeout(keepalive);
+	}
+	assert.equal(messages.length, 1);
+	assert.match(messages[0], new RegExp(`status is unavailable: native \`gentle-ai review mode status\` did not answer within ${RDD_STATUS_TIMEOUT_MS} ms\.`));
+});
+
+test("the unavailable notice reports an absent native review CLI", async () => {
+	clearRddStatusMemoForTesting();
+	const { ctx, messages } = captureNotices();
+	await resolveRddModeStatus(null, "/repo-absent", undefined, Date.now, ctx as never);
+	assert.equal(messages.length, 1);
+	assert.match(messages[0], /status is unavailable: the native gentle-ai review CLI is not available\./);
+});
+
+test("the unavailable notice still fires only once per session", async () => {
+	clearRddStatusMemoForTesting();
+	const { ctx, messages } = captureNotices();
+	const cli = fakeReviewMode(() => { throw new Error("boom"); });
+	await resolveRddModeStatus(cli, "/repo-once-a", undefined, Date.now, ctx as never);
+	await resolveRddModeStatus(cli, "/repo-once-b", undefined, Date.now, ctx as never);
+	assert.equal(messages.length, 1);
+	assert.match(messages[0], /status is unavailable: boom\./);
+});
+
+test("pinRddStatusLine keeps the session's first line until the off state changes (#2195)", () => {
+	const unknown = "Receipt-driven development: unknown (native status unavailable)";
+	const onGlobal = "Receipt-driven development: on (decided by global)";
+	const onClone = "Receipt-driven development: on (decided by clone)";
+	const off = "Receipt-driven development: off (decided by clone)";
+	const offGlobal = "Receipt-driven development: off (decided by global)";
+	assert.equal(pinRddStatusLine(undefined, onGlobal), onGlobal, "the first render of a session is the resolved line");
+	assert.equal(pinRddStatusLine(unknown, onGlobal), unknown, "unknown to on keeps the cached prompt prefix");
+	assert.equal(pinRddStatusLine(onGlobal, unknown), onGlobal, "on to unknown keeps the cached prompt prefix");
+	assert.equal(pinRddStatusLine(onGlobal, onClone), onGlobal, "a deciding-source change alone keeps the prefix");
+	assert.equal(pinRddStatusLine(off, offGlobal), off, "a source change while off keeps the prefix");
+	assert.equal(pinRddStatusLine(onGlobal, off), off, "turning RDD off re-renders, since it drops the review contract");
+	assert.equal(pinRddStatusLine(unknown, off), off, "unknown to off re-renders");
+	assert.equal(pinRddStatusLine(off, onGlobal), onGlobal, "turning RDD back on re-renders");
+	assert.equal(pinRddStatusLine(off, unknown), unknown, "off to unknown re-renders, since unknown keeps the review contract");
+});

package/tests/review-agent-end-preflight.test.ts

@@ -128,13 +128,18 @@ function toolContext(context: ExtensionContext): ExtensionToolContext {
 async function withSessionStartEnv<T>(callback: (cwd: string) => Promise<T>, initializeGit = true): Promise<T> {
 	const previousAgentHome = process.env.GENTLE_PI_AGENT_HOME;
 	const previousConfigHome = process.env.GENTLE_PI_CONFIG_HOME;
+	// Each call made three temp dirs and never removed them (87 left behind per suite run).
+	const created: string[] = [];
 	process.env.GENTLE_PI_AGENT_HOME = await mkdtemp(join(tmpdir(), "gentle-pi-session-baseline-agent-home-"));
+	created.push(process.env.GENTLE_PI_AGENT_HOME);
 	// Isolates both the model-config sweep and the dev-binary registration
 	// lookup from this machine's real ~/.pi/gentle-ai, so `session_start`'s
 	// unrelated notifications never leak into these assertions.
 	process.env.GENTLE_PI_CONFIG_HOME = await mkdtemp(join(tmpdir(), "gentle-pi-session-baseline-config-home-"));
+	created.push(process.env.GENTLE_PI_CONFIG_HOME);
 	try {
 		const cwd = await mkdtemp(join(tmpdir(), "gentle-pi-session-baseline-cwd-"));
+		created.push(cwd);
 		if (initializeGit) childProcess.execFileSync("git", ["init", "--quiet", cwd]);
 		await mkdir(join(cwd, "src"));
 		await writeFile(join(cwd, "src/example.ts"), "export const value = 1;");
@@ -144,6 +149,7 @@ async function withSessionStartEnv<T>(callback: (cwd: string) => Promise<T>, ini
 		else process.env.GENTLE_PI_AGENT_HOME = previousAgentHome;
 		if (previousConfigHome === undefined) delete process.env.GENTLE_PI_CONFIG_HOME;
 		else process.env.GENTLE_PI_CONFIG_HOME = previousConfigHome;
+		for (const dir of created) await rm(dir, { recursive: true, force: true });
 	}
 }
 

package/tests/review-candidate-view.test.ts

@@ -1326,6 +1326,55 @@ test("candidate view recursively protects nested content and worktree metadata,
 	}
 });
 
+// macOS File Provider (iCloud-synced Desktop/Documents) asynchronously resets
+// directory modes to exactly 0700 while leaving file modes intact.
+function simulateFileProviderDirectoryReset(root: string, directories: readonly string[]): void {
+	for (const directory of directories) chmodSync(join(root, directory), 0o700);
+}
+
+test("candidate view repairs owner-only directories reset by macOS File Provider and stays verifiable", { skip: process.platform === "win32" }, (t) => {
+	const contributorRoot = repository(t);
+	mkdirSync(join(contributorRoot, "nested", "deeper"), { recursive: true });
+	writeFileSync(join(contributorRoot, "nested", "deeper", "candidate.txt"), "candidate\n");
+	const view = createCandidateView({ contributorRoot });
+	try {
+		simulateFileProviderDirectoryReset(view.root, ["nested/deeper", "nested", "."]);
+		view.verify();
+		for (const directory of [".", "nested", "nested/deeper"]) assert.equal(lstatSync(join(view.root, directory)).mode & 0o777, 0o555, directory);
+		assert.equal(lstatSync(join(view.root, "nested", "deeper", "candidate.txt")).mode & 0o777, 0o444);
+	} finally {
+		view.cleanup();
+	}
+});
+
+test("candidate view does not repair owner-only directories carrying special mode bits", { skip: process.platform === "win32" }, (t) => {
+	const contributorRoot = repository(t);
+	mkdirSync(join(contributorRoot, "nested"), { recursive: true });
+	writeFileSync(join(contributorRoot, "nested", "candidate.txt"), "candidate\n");
+	const view = createCandidateView({ contributorRoot });
+	try {
+		chmodSync(join(view.root, "nested"), 0o1700);
+		assert.throws(() => view.verify(), /candidate view directory is unsafe or writable/);
+	} finally {
+		view.cleanup();
+	}
+});
+
+test("candidate view refuses an ignored entry injected into an owner-only directory it would repair", { skip: process.platform === "win32" }, (t) => {
+	const contributorRoot = repository(t);
+	mkdirSync(join(contributorRoot, "nested"), { recursive: true });
+	writeFileSync(join(contributorRoot, ".gitignore"), "*.log\n");
+	writeFileSync(join(contributorRoot, "nested", "candidate.txt"), "candidate\n");
+	const view = createCandidateView({ contributorRoot });
+	try {
+		simulateFileProviderDirectoryReset(view.root, ["nested"]);
+		writeFileSync(join(view.root, "nested", "injected.log"), "injected\n");
+		assert.throws(() => view.verify(), /candidate view directory contains unexpected entries/);
+	} finally {
+		view.cleanup();
+	}
+});
+
 test("candidate view registry rejects unsafe, moved, writable, stale, and unselected lens contexts before dispatch", (t) => {
 	const contributorRoot = repository(t);
 	writeFileSync(join(contributorRoot, "tracked.txt"), "candidate\n");

package/tests/review-contract-prompt.test.ts

@@ -109,9 +109,12 @@ test("before_agent_start injects the mirrored review execution contract for the
 	assert.match(appended, /no meaningful RED, explain why and run proportionate ordinary functional or structural verification/);
 	assert.match(appended, /Never invent lifecycle evidence or skip checks/);
 	assert.doesNotMatch(appended, /If tests exist, use strict TDD/);
-	assert.match(appended, /ODD \(Default Workflow, harness section above\) is mandatory on every request/);
+	// S11 T3: deduplicated. The core pointer sentence restated the harness; the
+	// mandatory ODD entry is injected once, from the harness steps' header.
+	assert.match(appended, /Organic Driven Development \(ODD\) is the predefined workflow of this orchestrator\. Every request enters it/);
+	assert.doesNotMatch(appended, /ODD \(Default Workflow, harness section above\)/);
 	assert.doesNotMatch(appended, /Prefer SDD\/OpenSpec artifacts/);
-	assert.match(appended, /## Gentle AI review execution contract \(mirrored provider bundle 1\.3\.0\)/);
+	assert.match(appended, /## Gentle AI review execution contract \(mirrored provider bundle 1\.4\.0\)/);
 	assert.ok(appended.includes(expected), "the mirrored orchestration/pi.md text must appear verbatim");
 	assert.match(appended, /call `gentle_review` with {"operation":"inspect"}/);
 	assert.match(appended, /call `gentle_review` with operation `status`, the exact retained `lineageId`, and `workspaceRoot`/);