gentle-pi 4.2.0 → 4.4.0

package/tests/provider-contract-bundle.test.ts

@@ -45,6 +45,26 @@ function fixture120Entries(): Map<string, Buffer> {
 	return new Map(FIXTURE_1_2_0_PATHS.map((path) => [path, readFileSync(join(FIXTURE_1_2_0_ROOT, path))]));
 }
 
+// Fixture provenance: the gentle-ai provider contract bundle 1.4.0 archive
+// built by goreleaser (archives `review-provider-contract`) from gentle-ai
+// 9e6f24f6, extracted. Adds `routing` to the manifest: Pi's ODD routing steps.
+const FIXTURE_1_4_0_ROOT = join(import.meta.dirname, "fixtures", "provider-contract-bundle", "v1.4.0");
+const FIXTURE_1_4_0_PATHS = [...FIXTURE_1_2_0_PATHS, "routing/pi.md"] as const;
+
+function fixture140Entries(): Map<string, Buffer> {
+	return new Map(FIXTURE_1_4_0_PATHS.map((path) => [path, readFileSync(join(FIXTURE_1_4_0_ROOT, path))]));
+}
+
+// A valid 1.3.0-shaped bundle: the 1.4.0 fixture without the routing field and file.
+function contractOneThreeEntries(): Map<string, Buffer> {
+	const entries = withManifest(fixture140Entries(), (manifest) => {
+		manifest.contract_semver = "1.3.0";
+		delete manifest.routing;
+	});
+	entries.delete("routing/pi.md");
+	return entries;
+}
+
 function sha256Hex(bytes: Buffer): string {
 	return createHash("sha256").update(bytes).digest("hex");
 }
@@ -391,6 +411,104 @@ test("rejects an orchestration array on a 1.1.0 manifest", () => {
 	);
 });
 
+// --- routing (contract 1.4.0) ----------------------------------------------------------
+
+test("verifies the 1.4.0 fixture tree and exposes the mirrored pi routing text", () => {
+	const bundle = verifyProviderContractBundleTree(FIXTURE_1_4_0_ROOT);
+	assert.equal(bundle.contractSemver, "1.4.0");
+	assert.equal(bundle.entries.size, 10);
+	assert.deepEqual([...bundle.orchestration.keys()], [PI_RUNTIME_IDENTITY]);
+	assert.deepEqual([...bundle.routing.keys()], [PI_RUNTIME_IDENTITY]);
+	assert.equal(bundle.routing.get(PI_RUNTIME_IDENTITY), readFileSync(join(FIXTURE_1_4_0_ROOT, "routing/pi.md"), "utf8"));
+	assert.equal(bundle.entrySha256.get("routing/pi.md"), sha256Hex(readFileSync(join(FIXTURE_1_4_0_ROOT, "routing/pi.md"))));
+});
+
+test("verifies the 1.4.0 release archive in memory", () => {
+	withTemporaryDirectory((directory) => {
+		const archivePath = join(directory, "gentle-ai-review-provider-contract-1.4.0.tar.gz");
+		writeFileSync(archivePath, buildTarGz([...fixture140Entries()].map(([name, bytes]) => ({ name, bytes }))));
+		const { bundle } = verifyProviderContractBundleArchive(archivePath);
+		assert.equal(bundle.contractSemver, "1.4.0");
+		assert.deepEqual([...bundle.routing.keys()], [PI_RUNTIME_IDENTITY]);
+	});
+});
+
+test("a 1.3.0 bundle without routing still verifies with an empty routing inventory", () => {
+	const bundle = verifyProviderContractBundleEntries(contractOneThreeEntries());
+	assert.equal(bundle.contractSemver, "1.3.0");
+	assert.equal(bundle.entries.size, 9);
+	assert.equal(bundle.routing.size, 0);
+	assert.deepEqual([...bundle.orchestration.keys()], [PI_RUNTIME_IDENTITY]);
+});
+
+test("rejects a 1.4.0 manifest without the required routing array", () => {
+	const entries = withManifest(fixture140Entries(), (manifest) => {
+		delete manifest.routing;
+	});
+	assertRejects(entries, "manifest.routing is required from contract 1.4.0");
+});
+
+test("rejects a routing array on a 1.3.0 manifest", () => {
+	const entries = withManifest(fixture140Entries(), (manifest) => {
+		manifest.contract_semver = "1.3.0";
+	});
+	assertRejects(entries, "manifest.routing is not part of contract 1.3.0");
+});
+
+test("rejects a 1.4.0 routing entry whose runtime is not registered in manifest.runtimes", () => {
+	assertRejects(
+		withManifest(fixture140Entries(), (manifest) => {
+			const routing = manifest.routing as { runtime: string; file: { path: string } }[];
+			routing[0]!.runtime = "aider";
+			routing[0]!.file.path = "routing/aider.md";
+		}),
+		'manifest.routing[0].runtime "aider" is not registered in manifest.runtimes',
+	);
+});
+
+test("rejects a 1.4.0 routing entry that points outside routing/<runtime>.md", () => {
+	assertRejects(
+		withManifest(fixture140Entries(), (manifest) => {
+			(manifest.routing as { file: { path: string } }[])[0]!.file.path = "orchestration/pi.md";
+		}),
+		'manifest.routing[0].file.path must be "routing/pi.md"',
+	);
+});
+
+test("rejects a 1.4.0 routing entry whose file bytes do not match its manifest SHA-256", () => {
+	const entries = fixture140Entries();
+	const tampered = Buffer.from(entries.get("routing/pi.md") as Buffer);
+	tampered[tampered.length - 2] = 0x20;
+	entries.set("routing/pi.md", tampered);
+	assertRejects(entries, "does not match its manifest SHA-256");
+});
+
+test("rejects a 1.4.0 bundle missing its routing file", () => {
+	const entries = fixture140Entries();
+	entries.delete("routing/pi.md");
+	assertRejects(entries, "bundle inventory has 9 files; exactly 10 are expected");
+});
+
+test("the raw-entry bound leaves room for one routing file per runtime before the exact count decides", () => {
+	const entries = fixture140Entries();
+	for (let index = 0; index < 70; index += 1) entries.set(`extra/${index}.md`, Buffer.from("x\n"));
+	assertRejects(entries, "bundle inventory has 80 files; exactly 10 are expected");
+});
+
+test("generated 1.4.0 baselines record the mirrored routing entry", () => {
+	const bundle = verifyProviderContractBundleTree(FIXTURE_1_4_0_ROOT);
+	const capabilities = JSON.parse(
+		generateProviderContractBaselines(bundle).get("provider-capabilities.baseline.json") as string,
+	) as { routing: { runtime: string; path: string; sha256: string }[] };
+	assert.deepEqual(capabilities.routing, [
+		{ runtime: PI_RUNTIME_IDENTITY, path: "routing/pi.md", sha256: bundle.entrySha256.get("routing/pi.md") },
+	]);
+	const older = JSON.parse(
+		generateProviderContractBaselines(verifyProviderContractBundleTree(FIXTURE_1_2_0_ROOT)).get("provider-capabilities.baseline.json") as string,
+	) as { routing: unknown[] };
+	assert.deepEqual(older.routing, []);
+});
+
 // --- archive safety ------------------------------------------------------------------
 
 test("rejects a tar entry that escapes the bundle root", () => {

package/tests/provider-contract-mirror.test.ts

@@ -31,6 +31,10 @@ const FIXTURE_PATHS = [
 // release archive, extracted. gentle-pi#560 / gentle-ai#4056, #4057.
 const FIXTURE_1_2_0_ROOT = join(import.meta.dirname, "fixtures", "provider-contract-bundle", "v1.2.0");
 
+// Fixture provenance: the gentle-ai provider contract bundle 1.4.0 archive
+// built by goreleaser, extracted. Adds Pi's ODD routing block as routing/pi.md.
+const FIXTURE_1_4_0_ROOT = join(import.meta.dirname, "fixtures", "provider-contract-bundle", "v1.4.0");
+
 interface LockRecord {
 	schema: string;
 	acquisition: string;
@@ -124,6 +128,26 @@ test("mirrors a verified local 1.2.0 bundle tree, including its orchestration en
 	});
 });
 
+test("mirrors a verified local 1.4.0 bundle tree, including its routing entry, and the offline drift check passes", () => {
+	withTemporaryRoot((packageRoot) => {
+		mirrorProviderContractBundle(FIXTURE_1_4_0_ROOT, packageRoot);
+		const lock = JSON.parse(
+			readFileSync(join(packageRoot, PROVIDER_CONTRACT_MIRROR_ROOT, PROVIDER_CONTRACT_LOCK_FILE), "utf8"),
+		) as LockRecord;
+		assert.equal(lock.contract_semver, "1.4.0");
+		assert.equal(Object.keys(lock.entries).length, 10);
+		assert.ok("routing/pi.md" in lock.entries, "the mirrored lock must record routing/pi.md");
+		const mirrored = join(packageRoot, PROVIDER_CONTRACT_MIRROR_ROOT, "v1.4.0", "bundle", "routing", "pi.md");
+		assert.deepEqual(readFileSync(mirrored), readFileSync(join(FIXTURE_1_4_0_ROOT, "routing", "pi.md")));
+		assert.deepEqual(checkProviderContractMirror(packageRoot), []);
+
+		writeFileSync(mirrored, `${readFileSync(mirrored, "utf8")}tampered\n`);
+		const problems = checkProviderContractMirror(packageRoot);
+		assert.equal(problems.length, 1);
+		assert.match(problems[0] ?? "", /mirrored bundle failed verification: .*"routing\/pi\.md" does not match its manifest SHA-256/);
+	});
+});
+
 test("mirrors a verified local archive and records the archive digest in the lock", () => {
 	withTemporaryRoot((packageRoot) => {
 		const archivePath = join(packageRoot, "gentle-ai-review-provider-contract-1.1.0.tar.gz");

package/tests/quiet-tool-rendering.test.ts

@@ -1232,6 +1232,29 @@ test("quiet tool rendering preserves complete expanded text and delegates saniti
 	assert.doesNotMatch(image, /\x1b/);
 });
 
+test("quiet tool rendering re-renders expanded read-with-image results without crashing when lastComponent is passed (#1620)", () => {
+	const tools = registeredQuietTools();
+	const readTool = tools.get("read");
+	const result = {
+		content: [{ type: "image", data: "iVBORw0KGgo=", mimeType: "image/png" }],
+		details: { path: "image.png" },
+	};
+	const context = { args: { path: "image.png" }, cwd: "/repo", showImages: false, isError: false };
+
+	const initialComponent = readTool.renderResult(result, { expanded: true, isPartial: false }, passthroughTheme, context);
+	const initialOutput = renderToString(initialComponent);
+	assert.ok(initialOutput.includes(imageFallback("image/png")));
+
+	const reRenderComponent = readTool.renderResult(
+		result,
+		{ expanded: true, isPartial: false },
+		passthroughTheme,
+		{ ...context, lastComponent: initialComponent },
+	);
+	const reRenderOutput = renderToString(reRenderComponent);
+	assert.ok(reRenderOutput.includes(imageFallback("image/png")));
+});
+
 test("quiet tool rendering preserves directional visual preview rows at narrow widths", () => {
 	const tools = registeredQuietTools();
 	const bash = tools.get("bash");

package/tests/rdd-aware-verification-contract.test.ts

@@ -48,13 +48,18 @@ const ROUTING_SENTENCE =
 	'After the writer returns, call `gentle_review` with `{"operation":"assess"}` over the writer\'s diff and follow the returned plan, whatever the `Receipt-driven development:` line reads (`on`, `off`, or `unknown`), instead of judging non-triviality from the task description: the operation resolves the native risk tier and states exactly who verifies next.';
 const RDD_ON_SENTENCE =
 	"When the line reads `on`, the native review is an additional outside view of the change; it never replaces or skips the tier's verification, and the tier's verifier runs before review.";
-const TIER_TABLE_HEADER = "| Native risk tier | Verification (any RDD state) |";
+// Verification by named risk changed the tier table and replaced the
+// small-model bias sentence: the independent verifier runs only through an
+// `escalate` naming a Task Size high-risk item; a native high, a failed
+// assessment, and the writer's model or effort inform only.
+const TIER_TABLE_HEADER = "| Tier | Verification (any RDD state) |";
 const PASSIVE_TIER_ROW = "| passive | structural readback by the parent; no separate verifier, no tests |";
-const MEDIUM_TIER_ROW = "| medium | writer self-verification stands; a separate `gentle-ai-verify` run is added only when the writer profile is a small model (mini or low effort) |";
-const HIGH_TIER_ROW = "| high | writer self-verification plus a separate `gentle-ai-verify` run, always |";
-const UNASSESSABLE_TIER_ROW = "| unknown / assess failed | treated as high |";
-const SMALL_MODEL_BIAS_SENTENCE =
-	"The small-model bias raises the tier by one for verification purposes (medium becomes high); an unknown `Receipt-driven development:` line never lowers a tier below `off`.";
+const MEDIUM_TIER_ROW = "| medium | writer self-verification stands; no separate verifier, whatever model wrote the change |";
+const HIGH_TIER_ROW = "| high | only through `escalate` naming a Task Size high-risk item: writer self-verification plus one separate `gentle-ai-verify` run |";
+const UNASSESSABLE_TIER_ROW = "| native high, unknown, or assess failed | informs only: writer self-verification stands; escalate when a named high-risk item applies |";
+// odd/tasks/verifier-admission.md S6: the sentence names the runtime admission of the verifier launch.
+const NAMED_RISK_SENTENCE =
+	"The independent verifier runs only when the change touches a named Task Size high-risk item, passed as `escalate` (runtime admits its launch on a `Risk: item N` line or sentence, a feature-document task line, or past the context backstop); never for size, a native tier alone, a failed assessment, or the model or effort that wrote the change. An unknown `Receipt-driven development:` line never lowers a tier below `off`.";
 const SPOT_CHECK_SENTENCE =
 	"The parent spot check (re-running one reported command before delivery) stays required in every tier.";
 test("trigger 5 (Verification rule) routes every RDD line through assess and the risk tier", () => {
@@ -74,8 +79,9 @@ test("trigger 5 states the native risk tier table exactly once, with all four ro
 	}
 });
 
-test("trigger 5 states the small-model bias and the unknown-never-lowers-a-tier rule", () => {
-	assert.ok(delegation.includes(SMALL_MODEL_BIAS_SENTENCE), "trigger 5 is missing the small-model bias sentence");
+test("trigger 5 states the named-risk verifier rule and the unknown-never-lowers-a-tier rule", () => {
+	assert.ok(delegation.includes(NAMED_RISK_SENTENCE), "trigger 5 is missing the named-risk verifier sentence");
+	assert.ok(!delegation.includes("small-model bias"), "the retired small-model bias must not survive in any orchestrator module");
 });
 
 test("trigger 5 keeps the parent spot check requirement in every tier", () => {
@@ -99,10 +105,11 @@ test("trigger 5 never restates the retired #661 off/unknown non-trivial judgment
 	assert.doesNotMatch(delegation, /purely passive documentation with no behavior to verify/);
 });
 
+// S9 canon change (gentle-ai 87a3b2eb): the trigger section heading dropped "Mandatory".
 test("the Simple Delegation paragraph references trigger 3 instead of restating the on/off/unknown routing", () => {
 	assert.match(
 		delegation,
-		/per the RDD-aware Verification rule \(trigger 3 under Mandatory Delegation Triggers, gentle-pi#661\)/,
+		/per the RDD-aware Verification rule \(trigger 3 under Delegation Triggers, gentle-pi#661\)/,
 	);
 	assert.match(delegation, /the normative on\/off\/unknown routing lives in `orchestrator-verification.md`, not here/);
 });
@@ -223,7 +230,9 @@ test("worker asset keeps the existing Return contract fields", () => {
 // delegation asset, and docs/delegated-verification.md -- and they must say
 // the same thing about the behavior ASSESS implements: closure only from the
 // native `candidate.consumed` fact for this candidate, the runtime writer
-// profile with a caller fallback, the conservative small-model bias, the
+// profile with a caller fallback, a writer profile that never adds a verifier
+// (verification by named risk retired the small-model bias), the escalate-only
+// independent verifier, the
 // declined/unavailable/unknown fallback, and functional checks that a native
 // review never replaces. Assertions use short stable phrases, normalized for
 // case, quoting, and line wrapping, not whole paragraphs.
@@ -267,7 +276,8 @@ const SHARED_POLICY_PHRASES: ReadonlyArray<readonly [string, string]> = [
 	["caller closure claim is not authority", "a caller-supplied closed is not authority"],
 	["runtime writer profile", "runtime-recorded model and effort of the pending mutations"],
 	["caller profile is only a fallback", "only a fallback when no runtime evidence exists"],
-	["conservative small-model bias", "keeps the conservative small-model bias"],
+	["writer profile never adds a verifier", "the writer profile is reported but never adds a verifier"],
+	["independent verifier only through escalate", "only when escalate names a task size high-risk item"],
 	["native review never replaces verification (verify-always-rdd-high S1)", "native review is an additional outside view"],
 	["functional checks still run", "a native code review is not a substitute for applicable functional checks"],
 ];
@@ -280,6 +290,14 @@ test("the three verification policy surfaces carry the same ASSESS closure, prof
 	}
 });
 
+test("no verification policy surface still carries the retired small-model bias or unassessable-as-high rule", () => {
+	for (const [surface, text] of POLICY_SURFACES) {
+		for (const stale of ["small-model bias", "treated as high", "verified exactly like high", "fail closed to high"]) {
+			assert.ok(!text.includes(stale), `${surface} still carries the retired wording: "${stale}"`);
+		}
+	}
+});
+
 test("no verification policy surface still tells callers to pass closed explicitly (gentle-pi#1175)", () => {
 	for (const [surface, text] of POLICY_SURFACES) {
 		for (const stale of ["closed is never derived", "closed is never auto-derived", "closed is never inferred", "pass it explicitly", "pass it only right after"]) {

package/tests/rdd-status-line.test.ts

@@ -2,7 +2,10 @@ import assert from "node:assert/strict";
 import test from "node:test";
 import { __testing } from "../extensions/gentle-ai.ts";
 import {
+	NATIVE_REVIEW_ERROR_CODE,
 	NATIVE_REVIEW_MODE_OPERATION,
+	NATIVE_REVIEW_OPERATION,
+	NativeReviewCliError,
 	NATIVE_REVIEW_MODE_SOURCE,
 	type NativeReviewCli,
 	type NativeReviewModeRequest,
@@ -31,6 +34,7 @@ import {
 
 const {
 	renderRddStatusLine,
+	pinRddStatusLine,
 	resolveRddModeStatus,
 	resolveRddStatusLine,
 	getOrchestratorPrompt,
@@ -358,3 +362,78 @@ test("resolveRddModeStatus stays unknown when no status was ever read", async ()
 	const cli = fakeReviewMode(() => { throw new Error("never available"); });
 	assert.equal(await resolveRddModeStatus(cli, "/repo-never-known"), undefined);
 });
+
+// gentle-shell#2250: the one-shot unavailable notice must name the cause so a
+// user on a slow or foreign-owned filesystem can tell a timeout from a native
+// refusal instead of reading a generic "absent, timed out, or failed".
+function captureNotices(): { ctx: { hasUI: true; ui: { notify(message: string, level: string): void } }; messages: string[] } {
+	const messages: string[] = [];
+	return { ctx: { hasUI: true, ui: { notify(message: string) { messages.push(message); } } }, messages };
+}
+
+test("the unavailable notice names the native failure and its stderr", async () => {
+	clearRddStatusMemoForTesting();
+	const { ctx, messages } = captureNotices();
+	const cli = fakeReviewMode(() => {
+		throw new NativeReviewCliError(NATIVE_REVIEW_ERROR_CODE.NON_ZERO, NATIVE_REVIEW_OPERATION.MODE, true, false, "native process failed", {
+			operation: NATIVE_REVIEW_OPERATION.MODE,
+			error_code: NATIVE_REVIEW_ERROR_CODE.NON_ZERO,
+			exit_code: 1,
+			timed_out: false,
+			output_limit_exceeded: false,
+			stderr: "fatal: detected dubious ownership in repository",
+		});
+	});
+	assert.equal(await resolveRddModeStatus(cli, "/repo-native-failure", undefined, Date.now, ctx as never), undefined);
+	assert.equal(messages.length, 1);
+	assert.match(messages[0], /status is unavailable: native `gentle-ai review mode status` failed \(non-zero, exit 1\): fatal: detected dubious ownership in repository\./);
+	assert.match(messages[0], /keeps the last known status/);
+});
+
+test("the unavailable notice reports a timeout distinctly", async () => {
+	clearRddStatusMemoForTesting();
+	const { ctx, messages } = captureNotices();
+	const keepalive = setTimeout(() => {}, 2000);
+	try {
+		await resolveRddModeStatus(fakeReviewMode(() => new Promise<never>(() => {})), "/repo-timeout", AbortSignal.timeout(50), Date.now, ctx as never);
+	} finally {
+		clearTimeout(keepalive);
+	}
+	assert.equal(messages.length, 1);
+	assert.match(messages[0], new RegExp(`status is unavailable: native \`gentle-ai review mode status\` did not answer within ${RDD_STATUS_TIMEOUT_MS} ms\.`));
+});
+
+test("the unavailable notice reports an absent native review CLI", async () => {
+	clearRddStatusMemoForTesting();
+	const { ctx, messages } = captureNotices();
+	await resolveRddModeStatus(null, "/repo-absent", undefined, Date.now, ctx as never);
+	assert.equal(messages.length, 1);
+	assert.match(messages[0], /status is unavailable: the native gentle-ai review CLI is not available\./);
+});
+
+test("the unavailable notice still fires only once per session", async () => {
+	clearRddStatusMemoForTesting();
+	const { ctx, messages } = captureNotices();
+	const cli = fakeReviewMode(() => { throw new Error("boom"); });
+	await resolveRddModeStatus(cli, "/repo-once-a", undefined, Date.now, ctx as never);
+	await resolveRddModeStatus(cli, "/repo-once-b", undefined, Date.now, ctx as never);
+	assert.equal(messages.length, 1);
+	assert.match(messages[0], /status is unavailable: boom\./);
+});
+
+test("pinRddStatusLine keeps the session's first line until the off state changes (#2195)", () => {
+	const unknown = "Receipt-driven development: unknown (native status unavailable)";
+	const onGlobal = "Receipt-driven development: on (decided by global)";
+	const onClone = "Receipt-driven development: on (decided by clone)";
+	const off = "Receipt-driven development: off (decided by clone)";
+	const offGlobal = "Receipt-driven development: off (decided by global)";
+	assert.equal(pinRddStatusLine(undefined, onGlobal), onGlobal, "the first render of a session is the resolved line");
+	assert.equal(pinRddStatusLine(unknown, onGlobal), unknown, "unknown to on keeps the cached prompt prefix");
+	assert.equal(pinRddStatusLine(onGlobal, unknown), onGlobal, "on to unknown keeps the cached prompt prefix");
+	assert.equal(pinRddStatusLine(onGlobal, onClone), onGlobal, "a deciding-source change alone keeps the prefix");
+	assert.equal(pinRddStatusLine(off, offGlobal), off, "a source change while off keeps the prefix");
+	assert.equal(pinRddStatusLine(onGlobal, off), off, "turning RDD off re-renders, since it drops the review contract");
+	assert.equal(pinRddStatusLine(unknown, off), off, "unknown to off re-renders");
+	assert.equal(pinRddStatusLine(off, onGlobal), onGlobal, "turning RDD back on re-renders");
+	assert.equal(pinRddStatusLine(off, unknown), unknown, "off to unknown re-renders, since unknown keeps the review contract");
+});

package/tests/review-agent-end-preflight.test.ts

@@ -128,13 +128,18 @@ function toolContext(context: ExtensionContext): ExtensionToolContext {
 async function withSessionStartEnv<T>(callback: (cwd: string) => Promise<T>, initializeGit = true): Promise<T> {
 	const previousAgentHome = process.env.GENTLE_PI_AGENT_HOME;
 	const previousConfigHome = process.env.GENTLE_PI_CONFIG_HOME;
+	// Each call made three temp dirs and never removed them (87 left behind per suite run).
+	const created: string[] = [];
 	process.env.GENTLE_PI_AGENT_HOME = await mkdtemp(join(tmpdir(), "gentle-pi-session-baseline-agent-home-"));
+	created.push(process.env.GENTLE_PI_AGENT_HOME);
 	// Isolates both the model-config sweep and the dev-binary registration
 	// lookup from this machine's real ~/.pi/gentle-ai, so `session_start`'s
 	// unrelated notifications never leak into these assertions.
 	process.env.GENTLE_PI_CONFIG_HOME = await mkdtemp(join(tmpdir(), "gentle-pi-session-baseline-config-home-"));
+	created.push(process.env.GENTLE_PI_CONFIG_HOME);
 	try {
 		const cwd = await mkdtemp(join(tmpdir(), "gentle-pi-session-baseline-cwd-"));
+		created.push(cwd);
 		if (initializeGit) childProcess.execFileSync("git", ["init", "--quiet", cwd]);
 		await mkdir(join(cwd, "src"));
 		await writeFile(join(cwd, "src/example.ts"), "export const value = 1;");
@@ -144,6 +149,7 @@ async function withSessionStartEnv<T>(callback: (cwd: string) => Promise<T>, ini
 		else process.env.GENTLE_PI_AGENT_HOME = previousAgentHome;
 		if (previousConfigHome === undefined) delete process.env.GENTLE_PI_CONFIG_HOME;
 		else process.env.GENTLE_PI_CONFIG_HOME = previousConfigHome;
+		for (const dir of created) await rm(dir, { recursive: true, force: true });
 	}
 }
 

package/tests/review-candidate-view.test.ts

@@ -1326,6 +1326,55 @@ test("candidate view recursively protects nested content and worktree metadata,
 	}
 });
 
+// macOS File Provider (iCloud-synced Desktop/Documents) asynchronously resets
+// directory modes to exactly 0700 while leaving file modes intact.
+function simulateFileProviderDirectoryReset(root: string, directories: readonly string[]): void {
+	for (const directory of directories) chmodSync(join(root, directory), 0o700);
+}
+
+test("candidate view repairs owner-only directories reset by macOS File Provider and stays verifiable", { skip: process.platform === "win32" }, (t) => {
+	const contributorRoot = repository(t);
+	mkdirSync(join(contributorRoot, "nested", "deeper"), { recursive: true });
+	writeFileSync(join(contributorRoot, "nested", "deeper", "candidate.txt"), "candidate\n");
+	const view = createCandidateView({ contributorRoot });
+	try {
+		simulateFileProviderDirectoryReset(view.root, ["nested/deeper", "nested", "."]);
+		view.verify();
+		for (const directory of [".", "nested", "nested/deeper"]) assert.equal(lstatSync(join(view.root, directory)).mode & 0o777, 0o555, directory);
+		assert.equal(lstatSync(join(view.root, "nested", "deeper", "candidate.txt")).mode & 0o777, 0o444);
+	} finally {
+		view.cleanup();
+	}
+});
+
+test("candidate view does not repair owner-only directories carrying special mode bits", { skip: process.platform === "win32" }, (t) => {
+	const contributorRoot = repository(t);
+	mkdirSync(join(contributorRoot, "nested"), { recursive: true });
+	writeFileSync(join(contributorRoot, "nested", "candidate.txt"), "candidate\n");
+	const view = createCandidateView({ contributorRoot });
+	try {
+		chmodSync(join(view.root, "nested"), 0o1700);
+		assert.throws(() => view.verify(), /candidate view directory is unsafe or writable/);
+	} finally {
+		view.cleanup();
+	}
+});
+
+test("candidate view refuses an ignored entry injected into an owner-only directory it would repair", { skip: process.platform === "win32" }, (t) => {
+	const contributorRoot = repository(t);
+	mkdirSync(join(contributorRoot, "nested"), { recursive: true });
+	writeFileSync(join(contributorRoot, ".gitignore"), "*.log\n");
+	writeFileSync(join(contributorRoot, "nested", "candidate.txt"), "candidate\n");
+	const view = createCandidateView({ contributorRoot });
+	try {
+		simulateFileProviderDirectoryReset(view.root, ["nested"]);
+		writeFileSync(join(view.root, "nested", "injected.log"), "injected\n");
+		assert.throws(() => view.verify(), /candidate view directory contains unexpected entries/);
+	} finally {
+		view.cleanup();
+	}
+});
+
 test("candidate view registry rejects unsafe, moved, writable, stale, and unselected lens contexts before dispatch", (t) => {
 	const contributorRoot = repository(t);
 	writeFileSync(join(contributorRoot, "tracked.txt"), "candidate\n");

package/tests/review-contract-prompt.test.ts

@@ -109,9 +109,12 @@ test("before_agent_start injects the mirrored review execution contract for the
 	assert.match(appended, /no meaningful RED, explain why and run proportionate ordinary functional or structural verification/);
 	assert.match(appended, /Never invent lifecycle evidence or skip checks/);
 	assert.doesNotMatch(appended, /If tests exist, use strict TDD/);
-	assert.match(appended, /ODD \(Default Workflow, harness section above\) is mandatory on every request/);
+	// S11 T3: deduplicated. The core pointer sentence restated the harness; the
+	// mandatory ODD entry is injected once, from the harness steps' header.
+	assert.match(appended, /Organic Driven Development \(ODD\) is the predefined workflow of this orchestrator\. Every request enters it/);
+	assert.doesNotMatch(appended, /ODD \(Default Workflow, harness section above\)/);
 	assert.doesNotMatch(appended, /Prefer SDD\/OpenSpec artifacts/);
-	assert.match(appended, /## Gentle AI review execution contract \(mirrored provider bundle 1\.3\.0\)/);
+	assert.match(appended, /## Gentle AI review execution contract \(mirrored provider bundle 1\.4\.0\)/);
 	assert.ok(appended.includes(expected), "the mirrored orchestration/pi.md text must appear verbatim");
 	assert.match(appended, /call `gentle_review` with {"operation":"inspect"}/);
 	assert.match(appended, /call `gentle_review` with operation `status`, the exact retained `lineageId`, and `workspaceRoot`/);

package/tests/review-controller-native-routing.test.ts

@@ -6,13 +6,24 @@ import fsp from "node:fs/promises";
 import os, { tmpdir } from "node:os";
 import { syncBuiltinESMExports } from "node:module";
 import { dirname, join, resolve, sep } from "node:path";
-import test from "node:test";
+import test, { after, before } from "node:test";
+import { setWindowsAclAuthorityForTesting } from "../lib/review-candidate-view-owner.ts";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { __testing, createGentleAiExtension, PendingReviewConsentRegistry } from "../extensions/gentle-ai.ts";
 import { CandidateViewError, CandidateViewRegistry } from "../lib/review-candidate-view.ts";
 import { NATIVE_REVIEW_ERROR_CODE, NativeReviewCliError, NativeReviewConsentRequiredError, type NativeReviewCli } from "../lib/native-review-cli.ts";
 import { decodeReviewLastEventClosureV1, decodeReviewConsentV3, decodeReviewStatusV3, type ReviewCollectInputV3, type ReviewStatusV3 } from "../lib/review-integration-v2.ts";
 
+// Coordination tests use fixture authority; real Windows ACL coverage lives
+// in review-candidate-view.test.ts, in a separate test process.
+let fixtureAclChecks = 0;
+before(() => {
+	if (process.platform === "win32") {
+		setWindowsAclAuthorityForTesting(() => { fixtureAclChecks++; });
+	}
+});
+after(() => setWindowsAclAuthorityForTesting());
+
 const SHA = `sha256:${"a".repeat(64)}`;
 const TREE = "b".repeat(40);
 
@@ -1076,7 +1087,9 @@ function reviewContext(cwd: string): ExtensionContext {
 
 function startStatus(cwd: string, baseRef?: string, intendedUntracked: readonly string[] = []): ReviewStatusV3 {
 	const candidateViews = new CandidateViewRegistry();
+	const checksBefore = fixtureAclChecks;
 	const view = candidateViews.create({ contributorRoot: cwd, intendedUntracked, ...(baseRef === undefined ? {} : { baseRef, committedOnly: true }) });
+	if (process.platform === "win32") assert.ok(fixtureAclChecks > checksBefore, "coordination candidates must use the fixture ACL authority");
 	try {
 		return {
 			contract: "gentle-ai.review-integration/v2",

package/tests/review-controller.test.ts

@@ -406,7 +406,7 @@ test("shipped controller fails closed while static prompts defer RDD lifecycle o
 	const core = readFileSync("assets/orchestrator.md", "utf8");
 	assert.match(core, new RegExp(boundary.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")));
 
-	for (const path of ["assets/orchestrator-delegation.md", "skills/gentle-ai/SKILL.md"]) {
+	for (const path of ["assets/orchestrator-delegation.md", "assets/orchestrator-delegation-reference.md", "skills/gentle-ai/SKILL.md"]) {
 		const contract = readFileSync(path, "utf8");
 		assert.doesNotMatch(contract, /INSPECT before START|start -> finalize -> validate|next_transition|review\.capture-result/is, path);
 	}