gentle-pi 4.2.0 → 4.3.0

package/tests/review-risk-assessment.test.ts

@@ -18,6 +18,7 @@ import {
 	isSmallWriterProfile,
 	resolveWriterProfile,
 	verificationPlan,
+	verificationRisk,
 	REVIEW_ASSESSMENT_SCHEMA,
 	VERIFICATION_TIER,
 	RDD_LINE,
@@ -389,9 +390,11 @@ test("verificationPlan: an omitted nativeReviewOutcome under rdd on defaults to
 	}
 });
 
-test("verificationPlan: on+closed+medium+small -> verifier (the small-model bias still applies)", () => {
+// Changed with verification by named risk: the small-model bias is gone, so a
+// small writer on a medium plan no longer gets an independent verifier.
+test("verificationPlan: on+closed+medium+small -> no verifier (the writer's model never adds one)", () => {
 	const plan = verificationPlan({ rddLine: RDD_LINE.ON, risk: VERIFICATION_TIER.MEDIUM, writerProfile: WRITER_PROFILE.SMALL, nativeReviewOutcome: NATIVE_REVIEW_OUTCOME.CLOSED });
-	assert.equal(plan.independentVerifier, true);
+	assert.equal(plan.independentVerifier, false);
 	assert.equal(plan.writerSelfVerification, true);
 });
 
@@ -401,9 +404,12 @@ test("verificationPlan: on+declined+medium+large -> no verifier (medium, large)"
 	assert.equal(plan.writerSelfVerification, true);
 });
 
-test("verificationPlan: on+declined+medium+small -> verifier", () => {
+// Changed with verification by named risk: no small-model bias, so a declined
+// review over a medium plan keeps the writer's self-verification only.
+test("verificationPlan: on+declined+medium+small -> no verifier", () => {
 	const plan = verificationPlan({ rddLine: RDD_LINE.ON, risk: VERIFICATION_TIER.MEDIUM, writerProfile: WRITER_PROFILE.SMALL, nativeReviewOutcome: NATIVE_REVIEW_OUTCOME.DECLINED });
-	assert.equal(plan.independentVerifier, true);
+	assert.equal(plan.independentVerifier, false);
+	assert.equal(plan.writerSelfVerification, true);
 });
 
 test("verificationPlan: on+declined+high -> verifier", () => {
@@ -468,30 +474,62 @@ for (const rddLine of [RDD_LINE.OFF, RDD_LINE.UNKNOWN]) {
 		}
 	});
 
-	test(`verificationPlan: rdd ${rddLine}, medium risk -> independent verifier only for a small writer profile`, () => {
-		const large = verificationPlan({ rddLine, risk: VERIFICATION_TIER.MEDIUM, writerProfile: WRITER_PROFILE.LARGE });
-		assert.equal(large.writerSelfVerification, true);
-		assert.equal(large.structuralReadbackOnly, false);
-		assert.equal(large.independentVerifier, false);
+	// Changed with verification by named risk: the small-model bias is gone, so
+	// medium never adds a verifier, whatever the writer profile.
+	test(`verificationPlan: rdd ${rddLine}, medium risk -> writer self-verification only, for every writer profile`, () => {
+		for (const writerProfile of PROFILES) {
+			const plan = verificationPlan({ rddLine, risk: VERIFICATION_TIER.MEDIUM, writerProfile });
+			assert.equal(plan.writerSelfVerification, true, `profile ${writerProfile}`);
+			assert.equal(plan.structuralReadbackOnly, false);
+			assert.equal(plan.independentVerifier, false, `profile ${writerProfile}`);
+		}
+	});
 
-		const small = verificationPlan({ rddLine, risk: VERIFICATION_TIER.MEDIUM, writerProfile: WRITER_PROFILE.SMALL });
-		assert.equal(small.writerSelfVerification, true);
-		assert.equal(small.structuralReadbackOnly, false);
-		assert.equal(small.independentVerifier, true, "the small-model bias raises medium to high for verification purposes");
+	// The plan risk is high only through an agent escalation (verificationRisk),
+	// so high still means writer self-verification plus one independent verifier.
+	test(`verificationPlan: rdd ${rddLine}, high (escalated) risk -> writer self-verification plus independent verifier`, () => {
+		for (const writerProfile of PROFILES) {
+			const plan = verificationPlan({ rddLine, risk: VERIFICATION_TIER.HIGH, writerProfile });
+			assert.equal(plan.writerSelfVerification, true, `rdd ${rddLine}, profile ${writerProfile}`);
+			assert.equal(plan.structuralReadbackOnly, false);
+			assert.equal(plan.independentVerifier, true, `rdd ${rddLine}, profile ${writerProfile}`);
+			assert.match(plan.reason, /escalat/);
+		}
 	});
 
-	test(`verificationPlan: rdd ${rddLine}, high or unassessable risk -> writer self-verification plus independent verifier, always`, () => {
-		for (const risk of [VERIFICATION_TIER.HIGH, VERIFICATION_TIER.UNASSESSABLE]) {
-			for (const writerProfile of PROFILES) {
-				const plan = verificationPlan({ rddLine, risk, writerProfile });
-				assert.equal(plan.writerSelfVerification, true, `rdd ${rddLine}, risk ${risk}, profile ${writerProfile}`);
-				assert.equal(plan.structuralReadbackOnly, false);
-				assert.equal(plan.independentVerifier, true, `rdd ${rddLine}, risk ${risk}, profile ${writerProfile}`);
-			}
+	// Changed with verification by named risk: a failed or unrecognized
+	// assessment informs only; it is no longer treated as high.
+	test(`verificationPlan: rdd ${rddLine}, unassessable risk -> writer self-verification only, no verifier`, () => {
+		for (const writerProfile of PROFILES) {
+			const plan = verificationPlan({ rddLine, risk: VERIFICATION_TIER.UNASSESSABLE, writerProfile });
+			assert.equal(plan.writerSelfVerification, true, `rdd ${rddLine}, profile ${writerProfile}`);
+			assert.equal(plan.structuralReadbackOnly, false);
+			assert.equal(plan.independentVerifier, false, `rdd ${rddLine}, profile ${writerProfile}`);
 		}
 	});
 }
 
+test("verificationPlan: the writer's model never changes the plan, for every rdd line, risk, and outcome", () => {
+	for (const rddLine of RDD_LINES) {
+		for (const risk of RISKS) {
+			for (const nativeReviewOutcome of Object.values(NATIVE_REVIEW_OUTCOME)) {
+				const small = verificationPlan({ rddLine, risk, writerProfile: WRITER_PROFILE.SMALL, nativeReviewOutcome });
+				const large = verificationPlan({ rddLine, risk, writerProfile: WRITER_PROFILE.LARGE, nativeReviewOutcome });
+				assert.deepEqual(small, large, `rdd ${rddLine}, risk ${risk}, outcome ${nativeReviewOutcome}`);
+			}
+		}
+	}
+});
+
+test("verificationRisk: only an escalation makes the plan high; a native high or unassessable tier informs as medium", () => {
+	const escalation = { item: 2 as const, reason: "weakens the permission check" };
+	for (const nativeRisk of RISKS) assert.equal(verificationRisk(nativeRisk, escalation), VERIFICATION_TIER.HIGH, `escalated ${nativeRisk}`);
+	assert.equal(verificationRisk(VERIFICATION_TIER.PASSIVE, undefined), VERIFICATION_TIER.PASSIVE);
+	assert.equal(verificationRisk(VERIFICATION_TIER.MEDIUM, undefined), VERIFICATION_TIER.MEDIUM);
+	assert.equal(verificationRisk(VERIFICATION_TIER.HIGH, undefined), VERIFICATION_TIER.MEDIUM, "a native high alone never adds a verifier");
+	assert.equal(verificationRisk(VERIFICATION_TIER.UNASSESSABLE, undefined), VERIFICATION_TIER.MEDIUM, "a failed assessment alone never adds a verifier");
+});
+
 test("verificationPlan: an unknown rdd line never lowers a tier relative to off", () => {
 	for (const risk of RISKS) {
 		for (const writerProfile of PROFILES) {
@@ -567,12 +605,14 @@ test("resolveWriterProfile: an unknown or omitted profile fails closed to small,
 });
 
 // ---------------------------------------------------------------------------
-// Tool-level fail-closed path: the `gentle_review` tool's `assess` operation
+// Tool-level unassessable path: the `gentle_review` tool's `assess` operation
 // (`extensions/gentle-ai.ts`, gentle-pi#662) must treat a native CLI without
 // the `assess` verb (an older binary) or a rejected `assess` call (a process
-// failure) the same way -- risk "unassessable", which `verificationPlan`
-// treats as `high`. `assess` is exposed as a `gentle_review` operation, not a
-// dedicated tool, so the fixed `gentle_*` tool registry stays unchanged.
+// failure) the same way -- native risk "unassessable", which informs only:
+// the plan is medium and adds no independent verifier unless the agent
+// escalates a named high-risk item. `assess` is exposed as a `gentle_review`
+// operation, not a dedicated tool, so the fixed `gentle_*` tool registry stays
+// unchanged.
 
 function reviewControllerTool(nativeReviewCli: Partial<NativeReviewCli> | null): { execute: (id: string, params: Record<string, unknown>, signal: AbortSignal | undefined, onUpdate: undefined, ctx: ExtensionContext) => Promise<{ content: readonly { type: string; text: string }[]; details: unknown }> } {
 	const tools = new Map<string, any>();
@@ -591,27 +631,37 @@ function reviewControllerTool(nativeReviewCli: Partial<NativeReviewCli> | null):
 
 const ctx = { cwd: process.cwd() } as ExtensionContext;
 
-test("gentle_review assess: an older binary without the assess verb fails closed to high", async () => {
+// The only input that makes the plan high: an agent escalation naming a Task
+// Size high-risk item. Tests whose subject is "closure or a decline never
+// removes the verifier the plan requires" pass it so a verifier is required.
+const ESCALATE = { escalate: { item: 3, reason: "changes a published export" } } as const;
+
+// Changed with verification by named risk: an unassessable candidate no longer
+// verifies like high; the plan is medium and the native tier stays visible.
+test("gentle_review assess: an older binary without the assess verb informs only (no verifier without escalate)", async () => {
 	const nativeReviewCli: Partial<NativeReviewCli> = {
 		reviewMode: async () => ({ operation: "status", scope: "clone", status: { global: "off", cloneLocal: "off", effective: "off", source: NATIVE_REVIEW_MODE_SOURCE.GLOBAL } }),
 		// assess intentionally absent: pre-gentle-ai#4295 binary.
 	};
 	const tool = reviewControllerTool(nativeReviewCli);
 	const result = await tool.execute("call-1", { operation: "assess" }, undefined, undefined, ctx);
-	const details = result.details as { risk: string; rddLine: string; plan: { writerSelfVerification: boolean; independentVerifier: boolean; structuralReadbackOnly: boolean } };
-	assert.equal(details.risk, VERIFICATION_TIER.UNASSESSABLE);
+	const details = result.details as { risk: string; nativeRisk: string; rddLine: string; plan: { writerSelfVerification: boolean; independentVerifier: boolean; structuralReadbackOnly: boolean } };
+	assert.equal(details.nativeRisk, VERIFICATION_TIER.UNASSESSABLE);
+	assert.equal(details.risk, VERIFICATION_TIER.MEDIUM);
 	assert.equal(details.rddLine, "off");
 	assert.equal(details.plan.writerSelfVerification, true);
-	assert.equal(details.plan.independentVerifier, true);
+	assert.equal(details.plan.independentVerifier, false, "a failed assessment alone never adds a verifier");
 	assert.equal(details.plan.structuralReadbackOnly, false);
-	const highEquivalent = verificationPlan({ rddLine: "off", risk: VERIFICATION_TIER.HIGH, writerProfile: WRITER_PROFILE.LARGE });
-	assert.equal(details.plan.writerSelfVerification, highEquivalent.writerSelfVerification, "unassessable must verify exactly like high");
-	assert.equal(details.plan.independentVerifier, highEquivalent.independentVerifier, "unassessable must verify exactly like high");
-	assert.equal(details.plan.structuralReadbackOnly, highEquivalent.structuralReadbackOnly, "unassessable must verify exactly like high");
-	assert.equal(JSON.parse(result.content[0].text).risk, VERIFICATION_TIER.UNASSESSABLE);
+	assert.equal(JSON.parse(result.content[0].text).nativeRisk, VERIFICATION_TIER.UNASSESSABLE);
+
+	const escalated = await tool.execute("call-1b", { operation: "assess", input: JSON.stringify(ESCALATE) }, undefined, undefined, ctx);
+	assert.equal((escalated.details as { risk: string }).risk, VERIFICATION_TIER.HIGH);
+	assert.equal((escalated.details as { plan: { independentVerifier: boolean } }).plan.independentVerifier, true, "an escalation over an unassessable candidate adds the verifier");
 });
 
-test("gentle_review assess: a rejected assess call fails closed to high, and RDD status read failure fails closed to unknown", async () => {
+// Changed with verification by named risk: a rejected assess call informs
+// only; the RDD status fail-closed half of this test is unchanged.
+test("gentle_review assess: a rejected assess call informs only, and RDD status read failure fails closed to unknown", async () => {
 	const nativeReviewCli: Partial<NativeReviewCli> = {
 		reviewMode: async () => {
 			throw new Error("native review mode is unavailable");
@@ -622,12 +672,13 @@ test("gentle_review assess: a rejected assess call fails closed to high, and RDD
 	};
 	const tool = reviewControllerTool(nativeReviewCli);
 	const result = await tool.execute("call-2", { operation: "assess" }, undefined, undefined, ctx);
-	const details = result.details as { risk: string; rddLine: string; reasons: readonly { code: string }[]; plan: { independentVerifier: boolean; writerSelfVerification: boolean } };
-	assert.equal(details.risk, VERIFICATION_TIER.UNASSESSABLE);
+	const details = result.details as { risk: string; nativeRisk: string; rddLine: string; reasons: readonly { code: string }[]; plan: { independentVerifier: boolean; writerSelfVerification: boolean } };
+	assert.equal(details.nativeRisk, VERIFICATION_TIER.UNASSESSABLE);
+	assert.equal(details.risk, VERIFICATION_TIER.MEDIUM);
 	assert.equal(details.rddLine, "unknown", "an unresolved RDD status must fail closed to unknown, never on or off");
 	assert.equal(details.reasons[0]?.code, "native-assess-unavailable");
 	assert.equal(details.plan.writerSelfVerification, true);
-	assert.equal(details.plan.independentVerifier, true);
+	assert.equal(details.plan.independentVerifier, false);
 });
 
 test("gentle_review assess: a successful native assessment is reflected directly in the returned plan", async () => {
@@ -658,7 +709,10 @@ test("gentle_review assess: baseRef without committedOnly is rejected", async ()
 	);
 });
 
-test("gentle_review assess: writerModelId/writerEffort in input select the writer profile, and an omitted profile fails closed to small", async () => {
+// Changed with verification by named risk: the writer profile is still
+// resolved and reported (omitted fails closed to small, gemini is large), but
+// it no longer adds a verifier to a medium plan.
+test("gentle_review assess: writerModelId/writerEffort in input select the reported writer profile, which never changes the plan", async () => {
 	const nativeReviewCli: Partial<NativeReviewCli> = {
 		reviewMode: async () => ({ operation: "status", scope: "clone", status: { global: "off", cloneLocal: "off", effective: "off", source: NATIVE_REVIEW_MODE_SOURCE.GLOBAL } }),
 		assess: async () => ({
@@ -672,12 +726,11 @@ test("gentle_review assess: writerModelId/writerEffort in input select the write
 	};
 	const tool = reviewControllerTool(nativeReviewCli);
 
-	// Omitted profile + medium + off -> fails closed to small -> independent
-	// verifier true (this is the fix for the fail-open finding: an omitted
-	// profile must never resolve as permissively as a known large model).
+	// Omitted profile + medium + off -> reported as small (fail closed), and
+	// still no independent verifier: the model never adds one.
 	const omitted = await tool.execute("call-5", { operation: "assess" }, undefined, undefined, ctx);
 	assert.equal((omitted.details as { writerProfile: string }).writerProfile, "small");
-	assert.equal((omitted.details as { plan: { independentVerifier: boolean } }).plan.independentVerifier, true, "an omitted writer profile must fail closed to small, not default to large");
+	assert.equal((omitted.details as { plan: { independentVerifier: boolean } }).plan.independentVerifier, false, "an omitted writer profile never adds a verifier");
 
 	// Explicit large profile + medium + off -> independent verifier false.
 	const explicitLarge = await tool.execute(
@@ -688,10 +741,12 @@ test("gentle_review assess: writerModelId/writerEffort in input select the write
 		ctx,
 	);
 	assert.equal((explicitLarge.details as { writerProfile: string }).writerProfile, "large");
-	assert.equal((explicitLarge.details as { plan: { independentVerifier: boolean } }).plan.independentVerifier, false, "an explicitly recorded large profile must not be forced into the small-model bias");
+	assert.equal((explicitLarge.details as { plan: { independentVerifier: boolean } }).plan.independentVerifier, false);
 
 	const small = await tool.execute("call-7", { operation: "assess", input: JSON.stringify({ writerEffort: "low" }) }, undefined, undefined, ctx);
-	assert.equal((small.details as { plan: { independentVerifier: boolean } }).plan.independentVerifier, true, "a low-effort writer profile must trigger the small-model bias");
+	assert.equal((small.details as { writerProfile: string }).writerProfile, "small");
+	assert.equal((small.details as { plan: { independentVerifier: boolean } }).plan.independentVerifier, false, "a low-effort writer profile never adds a verifier");
+	assert.deepEqual((small.details as { plan: unknown }).plan, (explicitLarge.details as { plan: unknown }).plan, "the writer's model never changes the plan");
 
 	// A gemini model id must resolve large, never small on the bare "mini" substring.
 	const gemini = await tool.execute("call-8", { operation: "assess", input: JSON.stringify({ writerModelId: "gemini-2.5-pro", writerEffort: "high" }) }, undefined, undefined, ctx);
@@ -699,6 +754,9 @@ test("gentle_review assess: writerModelId/writerEffort in input select the write
 	assert.equal((gemini.details as { plan: { independentVerifier: boolean } }).plan.independentVerifier, false);
 });
 
+// Changed with verification by named risk: a native high without escalate is
+// a medium plan (no verifier); the declined fallback still applies, and an
+// escalation still gets its verifier.
 test("gentle_review assess: an explicit nativeReviewOutcome:\"declined\" input falls back to the risk-gated plan even when RDD is on (gentle-pi#668)", async () => {
 	const nativeReviewCli: Partial<NativeReviewCli> = {
 		reviewMode: async () => ({ operation: "status", scope: "clone", status: { global: "on", cloneLocal: "", effective: "on", source: NATIVE_REVIEW_MODE_SOURCE.GLOBAL } }),
@@ -713,13 +771,19 @@ test("gentle_review assess: an explicit nativeReviewOutcome:\"declined\" input f
 	};
 	const tool = reviewControllerTool(nativeReviewCli);
 	const result = await tool.execute("call-9", { operation: "assess", input: JSON.stringify({ nativeReviewOutcome: "declined" }) }, undefined, undefined, ctx);
-	const details = result.details as { risk: string; rddLine: string; outcome_source: string; plan: { writerSelfVerification: boolean; independentVerifier: boolean; structuralReadbackOnly: boolean } };
-	assert.equal(details.risk, "high");
+	const details = result.details as { risk: string; nativeRisk: string; rddLine: string; outcome_source: string; plan: { writerSelfVerification: boolean; independentVerifier: boolean; structuralReadbackOnly: boolean } };
+	assert.equal(details.nativeRisk, "high");
+	assert.equal(details.risk, "medium", "a native high without escalate informs only");
 	assert.equal(details.rddLine, "on", "the rendered RDD line still reads on -- only the verification plan falls back");
 	assert.equal(details.outcome_source, "explicit");
 	assert.equal(details.plan.writerSelfVerification, true);
-	assert.equal(details.plan.independentVerifier, true, "a declined review for this candidate must re-enable the risk-gated independent verifier");
+	assert.equal(details.plan.independentVerifier, false, "a native high without escalate adds no verifier");
 	assert.equal(details.plan.structuralReadbackOnly, false);
+
+	const escalated = await tool.execute("call-9b", { operation: "assess", input: JSON.stringify({ nativeReviewOutcome: "declined", ...ESCALATE }) }, undefined, undefined, ctx);
+	const escalatedDetails = escalated.details as { risk: string; plan: { independentVerifier: boolean } };
+	assert.equal(escalatedDetails.risk, "high");
+	assert.equal(escalatedDetails.plan.independentVerifier, true, "a declined review keeps the verifier an escalation requires");
 });
 
 test("gentle_review assess: an unrecognized nativeReviewOutcome value is rejected", async () => {
@@ -763,16 +827,19 @@ test("gentle_review assess: derivation is bound to the exact candidate recorded,
 	__testing.clearNativeReviewOutcomeMemoForTesting();
 	let current = "target-a";
 	const tool = reviewControllerTool(assessOnNativeCli(() => current));
+	// Verification by named risk: the plan requires a verifier only through an
+	// escalation, so each call escalates to keep "never removes it" observable.
+	const escalated = { operation: "assess", input: JSON.stringify(ESCALATE) };
 
 	// Nothing recorded for candidate A yet -> unknown, risk-gated.
-	const before = (await tool.execute("call-11", { operation: "assess" }, undefined, undefined, ctx)).details as { nativeReviewOutcome: string; outcome_source: string; plan: { independentVerifier: boolean } };
+	const before = (await tool.execute("call-11", escalated, undefined, undefined, ctx)).details as { nativeReviewOutcome: string; outcome_source: string; plan: { independentVerifier: boolean } };
 	assert.equal(before.nativeReviewOutcome, "unknown");
 	assert.equal(before.outcome_source, "unknown");
 	assert.equal(before.plan.independentVerifier, true);
 
 	// Candidate A recorded declined -> assess for A derives it.
 	__testing.recordNativeReviewOutcome(ctx.cwd, "target-a", "declined");
-	const forA = (await tool.execute("call-12", { operation: "assess" }, undefined, undefined, ctx)).details as { nativeReviewOutcome: string; outcome_source: string; plan: { independentVerifier: boolean } };
+	const forA = (await tool.execute("call-12", escalated, undefined, undefined, ctx)).details as { nativeReviewOutcome: string; outcome_source: string; plan: { independentVerifier: boolean } };
 	assert.equal(forA.nativeReviewOutcome, "declined");
 	assert.equal(forA.outcome_source, "derived");
 	assert.equal(forA.plan.independentVerifier, true, "a derived decline re-enables the independent verifier for the matching candidate");
@@ -781,14 +848,14 @@ test("gentle_review assess: derivation is bound to the exact candidate recorded,
 	// and since closed is never written, an acknowledged A can never leak a
 	// closed derivation into B either.
 	current = "target-b";
-	const forB = (await tool.execute("call-13", { operation: "assess" }, undefined, undefined, ctx)).details as { nativeReviewOutcome: string; outcome_source: string; plan: { independentVerifier: boolean } };
+	const forB = (await tool.execute("call-13", escalated, undefined, undefined, ctx)).details as { nativeReviewOutcome: string; outcome_source: string; plan: { independentVerifier: boolean } };
 	assert.equal(forB.nativeReviewOutcome, "unknown", "candidate B must never inherit candidate A's recorded outcome");
 	assert.equal(forB.outcome_source, "unknown");
 	assert.equal(forB.plan.independentVerifier, true);
 
 	// gentle-pi#1175: a caller-declared closed is only a claim. This older
 	// assessment carries no candidate.consumed, so it fails closed to unknown.
-	const closed = (await tool.execute("call-14", { operation: "assess", input: JSON.stringify({ nativeReviewOutcome: "closed" }) }, undefined, undefined, ctx)).details as { nativeReviewOutcome: string; outcome_source: string; plan: { independentVerifier: boolean; writerSelfVerification: boolean } };
+	const closed = (await tool.execute("call-14", { operation: "assess", input: JSON.stringify({ nativeReviewOutcome: "closed", ...ESCALATE }) }, undefined, undefined, ctx)).details as { nativeReviewOutcome: string; outcome_source: string; plan: { independentVerifier: boolean; writerSelfVerification: boolean } };
 	assert.equal(closed.nativeReviewOutcome, "unknown");
 	assert.equal(closed.outcome_source, "unknown");
 	assert.equal(closed.plan.writerSelfVerification, true);
@@ -836,6 +903,7 @@ function closureCli(options: ClosureCliOptions): Partial<NativeReviewCli> {
 
 interface AssessDetails {
 	risk: string;
+	nativeRisk: string;
 	nativeReviewOutcome: string;
 	outcome_source: string;
 	writerProfile: string;
@@ -882,8 +950,11 @@ test("gentle_review assess: already-reviewed predecessor remains medium and neve
 	}
 });
 
+// Verification by named risk: the closure tests below that check "closure or a
+// decline never removes the verifier" escalate, because only an escalation
+// makes the plan require one.
 test("gentle_review assess: native consumed true derives closed for this candidate", async () => {
-	const details = await assessWith(closureCli({ consumed: true }));
+	const details = await assessWith(closureCli({ consumed: true }), ESCALATE);
 	assert.equal(details.nativeReviewOutcome, "closed");
 	assert.equal(details.outcome_source, "derived");
 	assert.equal(details.plan.writerSelfVerification, true);
@@ -892,7 +963,7 @@ test("gentle_review assess: native consumed true derives closed for this candida
 
 test("gentle_review assess: a caller-declared closed without native consumed evidence fails closed to unknown", async () => {
 	for (const consumed of [false, undefined]) {
-		const details = await assessWith(closureCli({ consumed }), { nativeReviewOutcome: "closed" });
+		const details = await assessWith(closureCli({ consumed }), { nativeReviewOutcome: "closed", ...ESCALATE });
 		assert.equal(details.nativeReviewOutcome, "unknown", `consumed ${String(consumed)}`);
 		assert.equal(details.outcome_source, "unknown");
 		assert.equal(details.plan.independentVerifier, true);
@@ -900,7 +971,7 @@ test("gentle_review assess: a caller-declared closed without native consumed evi
 });
 
 test("gentle_review assess: a caller-declared closed corroborated by native consumed stays closed", async () => {
-	const details = await assessWith(closureCli({ consumed: true }), { nativeReviewOutcome: "closed" });
+	const details = await assessWith(closureCli({ consumed: true }), { nativeReviewOutcome: "closed", ...ESCALATE });
 	assert.equal(details.nativeReviewOutcome, "closed");
 	assert.equal(details.outcome_source, "derived", "closure is attributed to the native evidence, not to the caller's claim");
 	assert.equal(details.plan.independentVerifier, true, "closure never removes the risk-tier verifier");
@@ -908,7 +979,7 @@ test("gentle_review assess: a caller-declared closed corroborated by native cons
 
 test("gentle_review assess: explicit declined, unavailable, or unknown beats native consumed (only ever raises the bar)", async () => {
 	for (const outcome of ["declined", "unavailable", "unknown"]) {
-		const details = await assessWith(closureCli({ consumed: true }), { nativeReviewOutcome: outcome });
+		const details = await assessWith(closureCli({ consumed: true }), { nativeReviewOutcome: outcome, ...ESCALATE });
 		assert.equal(details.nativeReviewOutcome, outcome);
 		assert.equal(details.outcome_source, "explicit");
 		assert.equal(details.plan.independentVerifier, true, `${outcome} must keep the risk-gated verifier`);
@@ -920,7 +991,7 @@ test("gentle_review assess: a recorded decline for the same candidate beats nati
 	__testing.clearNativeReviewOutcomeMemoForTesting();
 	__testing.recordNativeReviewOutcome(ctx.cwd, "target-a", "declined");
 	const cli = closureCli({ consumed: true, targetIdentity: () => "target-a" });
-	for (const input of [undefined, { nativeReviewOutcome: "closed" }]) {
+	for (const input of [ESCALATE, { nativeReviewOutcome: "closed", ...ESCALATE }]) {
 		const details = await assessWith(cli, input);
 		assert.equal(details.nativeReviewOutcome, "declined", JSON.stringify(input));
 		assert.equal(details.outcome_source, "derived");
@@ -936,29 +1007,33 @@ test("gentle_review assess: a different candidate never inherits closure or a re
 	const closedB = await assessWith(closureCli({ consumed: true, targetIdentity: () => "target-b" }));
 	assert.equal(closedB.nativeReviewOutcome, "closed");
 	// Candidate C follows B, but its own assessment is not consumed: B's closure never carries over.
-	const openC = await assessWith(closureCli({ consumed: false, targetIdentity: () => "target-c" }));
+	const openC = await assessWith(closureCli({ consumed: false, targetIdentity: () => "target-c" }), ESCALATE);
 	assert.equal(openC.nativeReviewOutcome, "unknown");
 	assert.equal(openC.outcome_source, "unknown");
 	assert.equal(openC.plan.independentVerifier, true);
 });
 
+// Changed with verification by named risk: an unassessable candidate is a
+// medium plan with no verifier unless escalated; it is still never closed.
 test("gentle_review assess: an unassessable candidate is never closed", async () => {
 	for (const input of [undefined, { nativeReviewOutcome: "closed" }]) {
 		const details = await assessWith(closureCli({ unassessable: true }), input);
-		assert.equal(details.risk, VERIFICATION_TIER.UNASSESSABLE);
+		assert.equal(details.nativeRisk, VERIFICATION_TIER.UNASSESSABLE);
+		assert.equal(details.risk, VERIFICATION_TIER.MEDIUM);
 		assert.equal(details.nativeReviewOutcome, "unknown");
-		assert.equal(details.plan.independentVerifier, true);
+		assert.equal(details.plan.independentVerifier, false);
 	}
 });
 
 test("gentle_review assess: derived closure only changes the RDD on-path; RDD off plans are unchanged", async () => {
 	for (const risk of ["passive", "medium", "high"] as const) {
 		for (const consumed of [true, false]) {
+			// The plan follows verificationRisk (native high without escalate is medium).
 			const off = await assessWith(closureCli({ rdd: "off", risk, consumed }), { writerModelId: "claude-sonnet-5", writerEffort: "high" });
-			const expectedOff = verificationPlan({ rddLine: RDD_LINE.OFF, risk, writerProfile: WRITER_PROFILE.LARGE });
+			const expectedOff = verificationPlan({ rddLine: RDD_LINE.OFF, risk: verificationRisk(risk, undefined), writerProfile: WRITER_PROFILE.LARGE });
 			assert.deepEqual(off.plan, { ...expectedOff }, `off ${risk} consumed ${consumed}`);
 			const on = await assessWith(closureCli({ rdd: "on", risk, consumed }), { writerModelId: "claude-sonnet-5", writerEffort: "high" });
-			const expectedOn = verificationPlan({ rddLine: RDD_LINE.ON, risk, writerProfile: WRITER_PROFILE.LARGE, nativeReviewOutcome: consumed ? NATIVE_REVIEW_OUTCOME.CLOSED : NATIVE_REVIEW_OUTCOME.UNKNOWN });
+			const expectedOn = verificationPlan({ rddLine: RDD_LINE.ON, risk: verificationRisk(risk, undefined), writerProfile: WRITER_PROFILE.LARGE, nativeReviewOutcome: consumed ? NATIVE_REVIEW_OUTCOME.CLOSED : NATIVE_REVIEW_OUTCOME.UNKNOWN });
 			assert.deepEqual(on.plan, { ...expectedOn }, `on ${risk} consumed ${consumed}`);
 		}
 	}
@@ -993,13 +1068,16 @@ function workspaceRoot(): string {
 
 const mediumOffCli = (): Partial<NativeReviewCli> => closureCli({ rdd: "off", risk: "medium" });
 
+// Changed with verification by named risk (here and in the next two tests):
+// the runtime writer profile still wins and is reported, but a small profile
+// no longer adds a verifier to a medium plan.
 test("gentle_review assess: the runtime writer profile wins over contradicting caller input", async () => {
 	const small = receiptContext();
 	small.record({ toolCallId: "w1", writerModelId: "openai/gpt-5-mini", writerEffort: "high" });
 	const claimedLarge = await assessWith(mediumOffCli(), { writerModelId: "claude-sonnet-5", writerEffort: "high" }, small.context);
 	assert.equal(claimedLarge.writerProfile, "small");
 	assert.equal(claimedLarge.writerProfileSource, "runtime");
-	assert.equal(claimedLarge.plan.independentVerifier, true, "a caller can never talk a runtime mini writer into a large profile");
+	assert.equal(claimedLarge.plan.independentVerifier, false, "the reported profile never adds a verifier");
 
 	const large = receiptContext();
 	large.record({ toolCallId: "w1", writerModelId: "google/gemini-2.5-pro", writerEffort: "high" });
@@ -1022,7 +1100,7 @@ test("gentle_review assess: any small or unknown pending runtime writer makes th
 		const details = await assessWith(mediumOffCli(), { writerModelId: "claude-sonnet-5", writerEffort: "high" }, fixture.context);
 		assert.equal(details.writerProfile, "small", entry.name);
 		assert.equal(details.writerProfileSource, "runtime", entry.name);
-		assert.equal(details.plan.independentVerifier, true, entry.name);
+		assert.equal(details.plan.independentVerifier, false, entry.name);
 	}
 
 	const known = receiptContext();
@@ -1048,7 +1126,7 @@ test("gentle_review assess: without pending runtime receipts the caller input pa
 	const fallback = await assessWith(mediumOffCli(), undefined, fixture.context);
 	assert.equal(fallback.writerProfile, "small");
 	assert.equal(fallback.writerProfileSource, "fallback");
-	assert.equal(fallback.plan.independentVerifier, true);
+	assert.equal(fallback.plan.independentVerifier, false);
 
 	// No session at all behaves exactly the same way.
 	const noSession = await assessWith(mediumOffCli());
@@ -1093,14 +1171,17 @@ function nativeClient(adapter: ExecFileAdapter): NativeReviewCliV216 {
 	return new NativeReviewCliV216(adapter, "/package/.gentle-ai/gentle-ai", 30_000, 1024 * 1024);
 }
 
-test("gentle_review assess: stderr-only refusal preserves safe actionable diagnostics and fails closed", async () => {
+// Changed with verification by named risk: the refusal is reported as native
+// risk unassessable, which informs only (medium plan, no verifier).
+test("gentle_review assess: stderr-only refusal preserves safe actionable diagnostics and reports unassessable", async () => {
 	const queue = queuedAdapter([{ stdout: "", stderr: "untracked scope declaration required; use --untracked-scope=exclude or select; token=hidden-secret", exitCode: 1 }]);
 	const client = nativeClient(queue.adapter);
 	const tool = reviewControllerTool({ assess: client.assess.bind(client) });
 	const result = await tool.execute("refusal", { operation: "assess" }, undefined, undefined, ctx);
-	const details = result.details as { risk: string; reasons: { code: string; detail: string }[]; plan: { independentVerifier: boolean } };
-	assert.equal(details.risk, "unassessable");
-	assert.equal(details.plan.independentVerifier, true);
+	const details = result.details as { risk: string; nativeRisk: string; reasons: { code: string; detail: string }[]; plan: { independentVerifier: boolean } };
+	assert.equal(details.nativeRisk, "unassessable");
+	assert.equal(details.risk, "medium");
+	assert.equal(details.plan.independentVerifier, false);
 	assert.equal(details.reasons[0].code, NATIVE_REVIEW_ERROR_CODE.EMPTY_OUTPUT);
 	assert.match(details.reasons[0].detail, /untracked scope declaration required/);
 	assert.match(details.reasons[0].detail, /--untracked-scope=exclude/);
@@ -1133,8 +1214,9 @@ for (const [shape, sensitive] of [
 		const queue = queuedAdapter([{ stdout: "", stderr: `${sensitive}\nuntracked scope declaration required; use --untracked-scope=exclude or select`, exitCode: 1 }]);
 		const client = nativeClient(queue.adapter);
 		const result = await reviewControllerTool({ assess: client.assess.bind(client) }).execute("private-shape", { operation: "assess" }, undefined, undefined, ctx);
-		const details = result.details as { risk: string; reasons: { code: string; detail: string }[] };
-		assert.equal(details.risk, "unassessable");
+		// The failed assessment shows as nativeRisk; the plan risk is medium.
+		const details = result.details as { nativeRisk: string; reasons: { code: string; detail: string }[] };
+		assert.equal(details.nativeRisk, "unassessable");
 		assert.equal(details.reasons[0].code, NATIVE_REVIEW_ERROR_CODE.EMPTY_OUTPUT);
 		assert.doesNotMatch(JSON.stringify(result), /hidden|private_project| project|file\.ts|\/private\//);
 		assert.match(details.reasons[0].detail, /untracked scope declaration required; use --untracked-scope=exclude or select/);
@@ -1189,8 +1271,9 @@ test("facade assess leaves absent declarations to native and preserves stale-inv
 		const client = nativeClient(queue.adapter);
 		const tool = reviewControllerTool({ assess: client.assess.bind(client) });
 		const result = await tool.execute("stale", { operation: "assess", input: JSON.stringify(selection) }, undefined, undefined, ctx);
-		const details = result.details as { risk: string; reasons: { detail: string }[] };
-		assert.equal(details.risk, "unassessable");
+		// The failed assessment shows as nativeRisk; the plan risk is medium.
+		const details = result.details as { nativeRisk: string; reasons: { detail: string }[] };
+		assert.equal(details.nativeRisk, "unassessable");
 		assert.match(details.reasons[0].detail, /inventory changed/);
 		if (!("untrackedScope" in selection)) assert.deepEqual(queue.calls[0].arguments, ["review", "assess", "--cwd", process.cwd(), "--json"]);
 	}
@@ -1252,7 +1335,10 @@ test("gentle_review assess: consumed, reviewDue, reviewDueReason, and nextTransi
 	const client = nativeClient(queue.adapter);
 	const result = await reviewControllerTool({ assess: client.assess.bind(client) }).execute("new-envelope", { operation: "assess" }, undefined, undefined, ctx);
 	const details = result.details as Record<string, unknown> & { candidate: Record<string, unknown> };
-	assert.equal(details.risk, "high");
+	// Verification by named risk: the native high shows as nativeRisk; the
+	// plan risk is medium without an escalation. The projection is unchanged.
+	assert.equal(details.nativeRisk, "high");
+	assert.equal(details.risk, "medium");
 	assert.equal(details.candidate.consumed, false);
 	assert.equal(details.reviewDue, true);
 	assert.equal(details.reviewDueReason, "high_risk");
@@ -1275,8 +1361,9 @@ test("gentle_review assess: an older native envelope projects no consumed/review
 
 test("gentle_review assess: an unassessable projection omits reason.path instead of emitting an empty string", async () => {
 	const result = await reviewControllerTool({}).execute("no-assess", { operation: "assess" }, undefined, undefined, ctx);
-	const details = result.details as { risk: string; reasons: Record<string, unknown>[] };
-	assert.equal(details.risk, VERIFICATION_TIER.UNASSESSABLE);
+	// Verification by named risk: the failed assessment shows as nativeRisk.
+	const details = result.details as { nativeRisk: string; reasons: Record<string, unknown>[] };
+	assert.equal(details.nativeRisk, VERIFICATION_TIER.UNASSESSABLE);
 	assert.equal(details.reasons.length, 1);
 	assert.equal(Object.hasOwn(details.reasons[0], "path"), false);
 	assert.equal(typeof details.reasons[0].detail, "string");

package/tests/review-session-standing-permission-controller.test.ts

@@ -4,7 +4,8 @@ import { mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { PassThrough } from "node:stream";
-import test from "node:test";
+import test, { after, before } from "node:test";
+import { setWindowsAclAuthorityForTesting } from "../lib/review-candidate-view-owner.ts";
 import { Text, visibleWidth } from "@earendil-works/pi-tui";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { createGentleAiExtension } from "../extensions/gentle-ai.ts";
@@ -19,6 +20,16 @@ import {
 	presentReviewConsentUi,
 } from "../lib/review-consent-ui.ts";
 
+// Coordination tests use fixture authority; real Windows ACL coverage lives
+// in review-candidate-view.test.ts, in a separate test process.
+let fixtureAclChecks = 0;
+before(() => {
+	if (process.platform === "win32") {
+		setWindowsAclAuthorityForTesting(() => { fixtureAclChecks++; });
+	}
+});
+after(() => setWindowsAclAuthorityForTesting());
+
 function consentFixture(): Record<string, unknown> {
 	const path = join(process.cwd(), "tests", "fixtures", "devbinary", "consent-v3.captured.json");
 	return JSON.parse(readFileSync(path, "utf8")) as Record<string, unknown>;
@@ -173,10 +184,12 @@ function siblingWorktree(t: test.TestContext, parentRoot: string): string {
 
 function startStatus(cwd: string, intendedUntracked: readonly string[] = []): ReviewStatusV3 {
 	const views = new CandidateViewRegistry();
+	const checksBefore = fixtureAclChecks;
 	const candidate = views.create({
 		contributorRoot: cwd,
 		...(intendedUntracked.length === 0 ? {} : { intendedUntracked }),
 	});
+	if (process.platform === "win32") assert.ok(fixtureAclChecks > checksBefore, "coordination candidates must use the fixture ACL authority");
 	try {
 		return {
 			contract: "gentle-ai.review-integration/v2",

package/tests/review-session-standing-permission.test.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -100,6 +100,32 @@ test("review session Git identity lookups hide every Windows child process", asy
 	}
 });
 
+test("synchronous repository discovery stays silent outside Git", (t) => {
+	const cwd = realpathSync(mkdtempSync(join(tmpdir(), "gentle-pi-non-git-identity-")));
+	t.after(() => rmSync(cwd, { recursive: true, force: true }));
+	const moduleUrl = new URL("../lib/review-session-standing-permission.ts", import.meta.url).href;
+	const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.toUpperCase().startsWith("GIT_")));
+	const child = spawnSync(process.execPath, ["--experimental-strip-types", "--input-type=module", "-e", `
+		import { resolveCanonicalGitRepositoryIdentitySync } from ${JSON.stringify(moduleUrl)};
+		const identity = resolveCanonicalGitRepositoryIdentitySync(process.cwd());
+		console.log(JSON.stringify({ identity: identity ?? null }));
+	`], { cwd, env, encoding: "utf8", timeout: 10_000 });
+	assert.equal(child.error, undefined);
+	assert.equal(child.status, 0, child.stderr);
+	assert.deepEqual(JSON.parse(child.stdout), { identity: null });
+	assert.equal(child.stderr, "", "a caught Git failure must not write over the TUI editor");
+});
+
+test("synchronous repository discovery preserves clone identity across worktrees", (t) => {
+	const root = repository(t);
+	const sibling = siblingWorktree(t, root);
+	const unrelated = repository(t);
+	const identity = resolveCanonicalGitRepositoryIdentitySync(root);
+	assert.match(identity ?? "", /^sha256:/);
+	assert.equal(resolveCanonicalGitRepositoryIdentitySync(sibling), identity);
+	assert.notEqual(resolveCanonicalGitRepositoryIdentitySync(unrelated), identity);
+});
+
 test("headless, child, empty-session, and non-Git contexts cannot offer or consume standing permission", async (t) => {
 	const root = repository(t);
 	const manager = {};