gentle-pi 4.2.0 → 4.4.0

package/tests/review-host-relay-routing.test.ts

@@ -10,9 +10,9 @@ import { localProfilePinPath, repoProfileDeclarationPath, writeProfilePinSync }
 import { createProfile, emptyProfilesFile, profilesFilePath, writeProfilesFileSync } from "../lib/agent-profiles.ts";
 import type { AgentModelConfig } from "../lib/model-routing-authority.ts";
 import { GENTLE_AI_DEV_BINARY_ENV, resolveGentleAiDevBinaryOverride } from "../lib/gentle-ai-binary.ts";
-import type { NativeReviewCli, NativeReviewUnachievableLensCaptureArtifact, NativeReviewUnachievableLensCaptureRequest } from "../lib/native-review-cli.ts";
+import { NativeReviewIntegrationError, type NativeReviewCli, type NativeReviewUnachievableLensCaptureArtifact, type NativeReviewUnachievableLensCaptureRequest } from "../lib/native-review-cli.ts";
 import { REVIEW_HOST_RELAY_FAILURE, REVIEW_HOST_RELAY_PI_TIMEOUT_ENV, REVIEW_HOST_RELAY_PI_TIMEOUT_MAX_MS, REVIEW_HOST_RELAY_SUBMISSION_MISSING_MESSAGE, REVIEW_HOST_RELAY_UNAVAILABLE_MESSAGE, ReviewHostRelayError, type ReviewHostRelayRequest } from "../lib/review-host-relay.ts";
-import { decodeReviewNextTransitionV3, decodeReviewStatusV3, type ReviewArtifactSubjectV2, type ReviewCaptureSubmissionV1, type ReviewCollectInputV3, type ReviewStatusV3 } from "../lib/review-integration-v2.ts";
+import { decodeReviewFailureV2, decodeReviewNextTransitionV3, decodeReviewStatusV3, type ReviewArtifactSubjectV2, type ReviewCaptureSubmissionV1, type ReviewCollectInputV3, type ReviewStatusV3 } from "../lib/review-integration-v2.ts";
 import type { InProcessReviewerRegistry } from "../lib/inprocess-reviewer.ts";
 
 // One-slot capture routing: the host relay runs only when the selected
@@ -405,7 +405,8 @@ test("a v9 host-mediated refuter slot routes through the host relay with its fix
 // review-refuter entry is refused typed, naming that exact key, never a
 // mid-relay transport failure.
 test("a missing review-refuter routing model is refused typed, naming the key, before any relay launch", async (t) => {
-	const cwd = repository(t);
+	const cwd = pinFixture(t);
+	isolatedAgentHome(t);
 	const lineageId = "relay-role-missing-model";
 	const input = hostMediatedRefuterCollectInput(lineageId);
 	const harness = nativeHarness([finalizeStatus(lineageId, [input])]);
@@ -444,6 +445,63 @@ async function runCaptureGroup(cwd: string, harness: RoutingHarness, lineageId:
 
 function prepared(request: ReviewHostRelayRequest) { return { request, promptByteLength: 64, resultByteLength: 32 }; }
 
+for (const failAt of [0, 1, 2]) {
+	for (const typed of [true, false]) {
+		test(`grouped STATUS failure preserves ${typed ? "decoded diagnostics" : "untyped behavior"} at call ${failAt + 1}`, async (t) => {
+			t.after(() => __testing.setReviewHostRelayGroupRunnersForTesting());
+			const cwd = repository(t), lineageId = "relay-group-status-failure", inputs = groupInputs(lineageId);
+			const failure = decodeReviewFailureV2({
+				schema: "gentle-ai.review-integration.failure/v2", contract: "gentle-ai.review-integration/v2",
+				operation: "review.status", phase: "native_running", code: "native_operation_timeout",
+				message: "The negotiated review operation exceeded its aggregate time budget.",
+				mutation_outcome: "not_started", authority_applicability: "current_target", retry_safe: false,
+				replayability: "manual_action_required", required_inputs: [], next_action: "explicit-maintainer-action",
+				cause: "STATUS budget exhausted", context: { binding_revision: { expected: SHA, current: PHASE_REVISION } },
+			});
+			const error = typed ? new NativeReviewIntegrationError(failure) : Object.assign(new Error(failure.message), {
+				failureEnvelope: { raw: { secret: "must not be projected" } }, stdout: "private stdout", stderr: "private stderr",
+			});
+			const harness = nativeHarness([]);
+			let calls = 0, preparations = 0, submissions = 0;
+			harness.native.targetStatus = async () => {
+				const index = calls++;
+				if (index === failAt) throw error;
+				return finalizeStatus(lineageId, index === 0 ? inputs : inputs.slice(index - 1));
+			};
+			__testing.setReviewHostRelayGroupRunnersForTesting(async (requests) => {
+				preparations += 1;
+				return requests.map(prepared);
+			}, async (result) => {
+				submissions += 1;
+				return { promptByteLength: result.promptByteLength, resultByteLength: result.resultByteLength, submission: "{}" };
+			});
+			const result = await runCaptureGroup(cwd, harness, lineageId, inputs);
+			assert.equal(result.outcome, "native-status-failed");
+			assert.equal(result.status, "blocked");
+			assert.equal(result.reason, failure.message);
+			assert.equal(calls, failAt + 1, "no STATUS retry");
+			assert.equal(preparations, failAt === 0 ? 0 : 1);
+			assert.equal(submissions, Math.max(0, failAt - 1), "no submission after STATUS failure");
+			assert.equal(result.mutation_performed, submissions > 0);
+			assert.equal(result.mutation_outcome, submissions > 0 ? "partial" : "none");
+			if (failAt > 0) {
+				const progress = result.host_relay as { reviewers: unknown[] };
+				assert.equal(progress.reviewers.length, submissions);
+			}
+			if (typed) {
+				assert.deepEqual(result.native_failure, failure.raw);
+				assert.equal(result.replayability, failure.replayability);
+				assert.equal(result.next_action, failure.nextAction);
+			} else {
+				assert.equal(result.native_failure, undefined);
+				assert.equal(result.replayability, undefined);
+				assert.equal(result.next_action, undefined);
+				assert.doesNotMatch(JSON.stringify(result), /must not be projected|private stdout|private stderr/);
+			}
+		});
+	}
+}
+
 test("grouped capture forecasts once, reaches a four-reviewer barrier, and reconciles unclosed submissions", async (t) => {
 	t.after(() => __testing.setReviewHostRelayGroupRunnersForTesting());
 	const cwd = repository(t), lineageId = "relay-group", inputs = groupInputs(lineageId), lenses = inputs.map((input) => input.arguments.find((argument) => argument.name === "lens")!.value);
@@ -1343,3 +1401,89 @@ test("a pinned profile missing a required group role is refused typed before any
 	assert.equal(modelLookups, 0, "the typed refusal fires before any model resolution");
 	assert.equal(authAttempts, 0, "the typed refusal fires before any provider auth");
 });
+
+// gentle-pi#2271: review-refuter and review-validator are provider review
+// roles, not installable agents, so nothing seeds their routing entries and
+// profiles never carry them. When the routing snapshot in effect (saved
+// routing, pin, or session binding) has no model for one of them, the relay
+// uses Pi's persisted default model, as the routing panel already promises.
+// Lens reviewers keep their fail-closed rule.
+function isolatedAgentHome(t: test.TestContext, settings?: Record<string, unknown>): void {
+	const agentHome = mkdtempSync(join(tmpdir(), "gentle-pi-relay-agent-home-"));
+	const previous = process.env.GENTLE_PI_AGENT_HOME;
+	process.env.GENTLE_PI_AGENT_HOME = agentHome;
+	t.after(() => {
+		if (previous === undefined) delete process.env.GENTLE_PI_AGENT_HOME;
+		else process.env.GENTLE_PI_AGENT_HOME = previous;
+		rmSync(agentHome, { recursive: true, force: true });
+	});
+	if (settings !== undefined) writeFileSync(join(agentHome, "settings.json"), `${JSON.stringify(settings, null, 2)}\n`);
+}
+
+const PI_DEFAULT_SETTINGS = { defaultProvider: "pidefault", defaultModel: "default-model", defaultThinkingLevel: "medium" };
+
+async function relayedRefuterRequest(t: test.TestContext, cwd: string, lineageId: string): Promise<ReviewHostRelayRequest[]> {
+	t.after(() => __testing.setReviewHostRelayRunnerForTesting());
+	const harness = nativeHarness([finalizeStatus(lineageId, [hostMediatedRefuterCollectInput(lineageId)])]);
+	const relayed: ReviewHostRelayRequest[] = [];
+	__testing.setReviewHostRelayRunnerForTesting(async (request) => {
+		relayed.push(request);
+		return { promptByteLength: 64, resultByteLength: 32, submission: '{"admission_decision":"completed"}' };
+	});
+	await runCapture(cwd, harness, lineageId);
+	return relayed;
+}
+
+test("a refuter slot with no routing entry uses Pi's persisted default model and effort", async (t) => {
+	const cwd = pinFixture(t);
+	isolatedAgentHome(t, PI_DEFAULT_SETTINGS);
+
+	const relayed = await relayedRefuterRequest(t, cwd, "relay-role-default");
+
+	assert.equal(relayed.length, 1);
+	assert.equal(relayed[0]!.routingKey, "review-refuter");
+	assert.equal(relayed[0]!.selection, "pidefault/default-model");
+	assert.equal(relayed[0]!.thinking, "medium");
+});
+
+test("a pinned profile that omits the refuter role uses Pi's persisted default model instead of refusing", async (t) => {
+	const cwd = pinFixture(t);
+	isolatedAgentHome(t, PI_DEFAULT_SETTINGS);
+	pinLocal(cwd, "pinned-complete");
+
+	const relayed = await relayedRefuterRequest(t, cwd, "relay-role-pin-default");
+
+	assert.equal(relayed.length, 1);
+	assert.equal(relayed[0]!.selection, "pidefault/default-model");
+});
+
+test("a configured review-refuter routing entry still wins over Pi's persisted default", async (t) => {
+	const cwd = pinFixture(t);
+	isolatedAgentHome(t, PI_DEFAULT_SETTINGS);
+	writeFileSync(join(process.env.GENTLE_PI_CONFIG_HOME!, "models.json"), `${JSON.stringify({ ...GLOBAL_MODELS, "review-refuter": { model: "global/refuter-model", thinking: "high" } }, null, 2)}\n`);
+
+	const relayed = await relayedRefuterRequest(t, cwd, "relay-role-configured");
+
+	assert.equal(relayed.length, 1);
+	assert.equal(relayed[0]!.selection, "global/refuter-model");
+	assert.equal(relayed[0]!.thinking, "high");
+});
+
+test("a lens slot with no routing entry never borrows Pi's persisted default model", async (t) => {
+	t.after(() => __testing.setReviewHostRelayRunnerForTesting());
+	const cwd = pinFixture(t);
+	isolatedAgentHome(t, PI_DEFAULT_SETTINGS);
+	pinLocal(cwd, "pinned-partial");
+	const lineageId = "relay-lens-no-default";
+	const harness = nativeHarness([finalizeStatus(lineageId, [relayCollectInput(lineageId, "review-reliability", 0)])]);
+	const relayed: ReviewHostRelayRequest[] = [];
+	__testing.setReviewHostRelayRunnerForTesting(async (request) => {
+		relayed.push(request);
+		return { promptByteLength: 64, resultByteLength: 32, submission: '{"admission_decision":"completed"}' };
+	});
+
+	await runCapture(cwd, harness, lineageId);
+
+	assert.equal(relayed.length, 1);
+	assert.equal(relayed[0]!.selection, undefined);
+});

package/tests/review-host-relay.test.ts

@@ -539,7 +539,11 @@ test("every in-process reviewer refusal maps to its typed relay failure code, ca
 		{ code: INPROCESS_REVIEWER_FAILURE.AUTH_UNAVAILABLE, kind: REVIEW_HOST_RELAY_FAILURE.REVIEWER_AUTH_UNAVAILABLE },
 		{ code: INPROCESS_REVIEWER_FAILURE.THINKING_INVALID, kind: REVIEW_HOST_RELAY_FAILURE.REVIEWER_THINKING_INVALID },
 		{ code: INPROCESS_REVIEWER_FAILURE.TOOL_CALL_ATTEMPTED, kind: REVIEW_HOST_RELAY_FAILURE.REVIEWER_TOOL_CALL },
-		{ code: INPROCESS_REVIEWER_FAILURE.EMPTY_OUTPUT, kind: REVIEW_HOST_RELAY_FAILURE.REVIEWER_EMPTY_OUTPUT, evidence: { stopReason: "stop" } },
+		{ code: INPROCESS_REVIEWER_FAILURE.EMPTY_OUTPUT, kind: REVIEW_HOST_RELAY_FAILURE.REVIEWER_EMPTY_OUTPUT, evidence: {
+			reviewerModel: "nan/deepseek-v4-flash", stopReason: "length",
+			usage: { input: 12, output: 64, reasoning: 64, cacheRead: 0, cacheWrite: 0, totalTokens: 76 },
+			content: { blocks: 1, textBlocks: 0, thinkingBlocks: 1, textChars: 0, thinkingChars: 16 },
+		} },
 		{ code: INPROCESS_REVIEWER_FAILURE.OUTPUT_TOO_LARGE, kind: REVIEW_HOST_RELAY_FAILURE.REVIEWER_OUTPUT_TOO_LARGE },
 		{ code: INPROCESS_REVIEWER_FAILURE.PROVIDER_FAILED, kind: REVIEW_HOST_RELAY_FAILURE.PI_FAILED },
 	];
@@ -550,7 +554,10 @@ test("every in-process reviewer refusal maps to its typed relay failure code, ca
 		assert.equal(error.message, message);
 		assert.equal(error.mutationOutcome, "none");
 		assert.equal(existsSync(fixture.submitCapturePath), false, `${code} must never reach submission`);
-		if (evidence !== undefined) assert.deepEqual(error.reviewerEvidence, evidence, `${code} must carry its outcome evidence`);
+		if (evidence !== undefined) {
+			assert.deepEqual(error.reviewerEvidence, evidence, `${code} must carry its outcome evidence`);
+			assert.doesNotMatch(JSON.stringify(error.reviewerEvidence), /errorMessage|thinkingSignature|rawStopReason|authorization|providerPayload/);
+		}
 	}
 });
 

package/tests/review-json-arguments.test.ts

@@ -53,7 +53,7 @@ test("public Anthropic non-strict adapter preserves the complete review tool dec
 	assert.deepEqual(controller.required, ["operation"]);
 	assert.deepEqual(Object.keys(controller.properties).sort(), ["operation", "lineageId", "selectionBinding", "intendedUntracked", "untrackedScope", "changeName", "idempotencyKey", "transition", "input", "outputPath", "inputPath", "operationId", "lineageIds", "workspaceRoot"].sort());
 	assert.ok(controller.properties.input.anyOf.some((schema: any) => schema.type === "object"));
-	assert.match(controller.properties.input.description, /START\/ASSESS only/);
+	assert.match(controller.properties.input.description, /START\/ASSESS\/answer-consent/);
 	assert.deepEqual(controller.properties.operation.enum, tools.get("gentle_review").parameters.properties.operation.enum);
 	for (const name of ["gentle_review_capture", "gentle_review_capture_group"]) {
 		const schema = emitted.get(name);
@@ -66,7 +66,7 @@ test("public Anthropic non-strict adapter preserves the complete review tool dec
 	let nativeCalls = 0;
 	const native = new Proxy({}, { get() { return async () => { nativeCalls++; }; } }) as NativeReviewCli;
 	for (const operation of ["start", "assess", "answer-consent", "inspect", "reset", "recover"]) {
-		const inputs = operation === "start" || operation === "assess" ? [null] : [null, { consentBinding: "opaque", answer: "granted" }];
+		const inputs = operation === "start" || operation === "assess" || operation === "answer-consent" ? [null] : [null, { consentBinding: "opaque", answer: "granted" }];
 		for (const input of inputs) {
 			const args = validateToolArguments({ ...tools.get("gentle_review"), parameters: controller }, { type: "toolCall", id: "provider-shell", name: "gentle_review", arguments: { operation, input } });
 			assert.deepEqual(args.input, input, "provider-shell validation accepts and retains this input");
@@ -89,6 +89,23 @@ test("registered review schemas admit START/ASSESS objects and ordered capture o
 	assert.deepEqual(__testing.parseReviewCaptureGroupParameters(args).collectBindings, [JSON.stringify(binding), ordered[1]]);
 });
 
+test("answer-consent admits JSON object input and coerces it cleanly (#2375)", async () => {
+	const input = { consentBinding: "bound-1", answer: "granted" };
+	assert.deepEqual(validate("gentle_review", { operation: "answer-consent", input }).input, input);
+	assert.equal(
+		__testing.parseReviewControllerParameters(validate("gentle_review", { operation: "answer-consent", input })).input,
+		JSON.stringify(input),
+	);
+	const native = { targetStatus: async () => ({ targetIdentity: "t1" }) } as unknown as NativeReviewCli;
+	const outcome = await __testing.executeReviewControllerOperation(
+		validate("gentle_review", { operation: "answer-consent", input }),
+		process.cwd(),
+		native,
+	);
+	assert.equal(outcome.operation, "answer-consent");
+	assert.match(String(outcome.outcome), /consent-binding-stale/);
+});
+
 test("validated ASSESS objects reach the mocked native facade with parsed fields", async () => {
 	const requests: unknown[] = [];
 	const native = { assess: async (request: unknown) => { requests.push(request); throw new Error("mock assessment unavailable"); } } as unknown as NativeReviewCli;
@@ -132,7 +149,7 @@ test("actual validation rejects arrays, null and coerced primitives rather than
 });
 
 test("all other controller operations keep object input fail-closed at the facade boundary (#1698)", async () => {
-	const operations = (tools.get("gentle_review").parameters.properties.operation.enum as string[]).filter((operation) => operation !== "start" && operation !== "assess" && operation !== "select-intended-untracked");
+	const operations = (tools.get("gentle_review").parameters.properties.operation.enum as string[]).filter((operation) => operation !== "start" && operation !== "assess" && operation !== "answer-consent" && operation !== "select-intended-untracked");
 	let calls = 0;
 	const native = new Proxy({}, { get() { return async () => { calls++; throw new Error("unexpected native execution"); }; } }) as NativeReviewCli;
 	for (const operation of operations) {

package/tests/review-loadout-rdd-off-sdk.test.ts

@@ -0,0 +1,258 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import type { AssistantMessage, JsonObject, Tool, ToolCall } from "@earendil-works/pi-ai";
+import type { NativeReviewCli } from "../lib/native-review-cli.ts";
+
+// gentle-pi S11 T1: with receipt-driven development off, the orchestrator only
+// ever calls gentle_review ASSESS, so the parent request carries a short ASSESS
+// guideline and leaves the capture, capture-group, and scope declarations out.
+// With RDD on, the request is exactly what the registered tools declare. Both
+// paths run through a real Pi SDK session and inspect the provider request.
+
+const HIDDEN_WHEN_OFF = ["gentle_review_capture", "gentle_review_capture_group", "gentle_review_scope"] as const;
+
+interface RecordedRequest { systemPrompt: string; tools: Tool[] }
+interface SessionRun {
+	requests: RecordedRequest[];
+	registered: Map<string, { description: string; promptGuidelines?: readonly string[] }>;
+	assessResults: Array<{ isError: boolean; details: unknown }>;
+	errors: string[];
+}
+
+type RddMode = "on" | "off" | "throws";
+
+const NATIVE_CONTINUATION = {
+	operation: "review.status",
+	command: "gentle-ai review status --agent pi --next-transition",
+	arguments: [{ name: "--agent", value: "pi" }, { name: "--next-transition" }],
+};
+
+function nativeCli(mode: () => RddMode): NativeReviewCli {
+	return {
+		reviewMode: async () => {
+			const effective = mode();
+			if (effective === "throws") throw new Error("native review mode is unavailable");
+			return { operation: "status", scope: "clone", status: { global: effective, cloneLocal: "", effective, source: "global" } };
+		},
+		assess: async () => ({
+			schema: "gentle-ai.review-assessment/v1",
+			risk: "high",
+			reviewDue: true,
+			reviewDueReason: "high_risk",
+			nextTransition: NATIVE_CONTINUATION,
+			reasons: [],
+			changedPaths: 1,
+			changedLines: 3,
+			candidate: { kind: "current-changes", baseRef: undefined },
+		}),
+	} as unknown as NativeReviewCli;
+}
+
+async function runSession(
+	root: string,
+	label: string,
+	bindings: Record<string, string>,
+	mode: () => RddMode,
+	beforeSecondPrompt: () => void = () => {},
+): Promise<SessionRun> {
+	const sdk = await import("@earendil-works/pi-coding-agent");
+	const ai = await import("@earendil-works/pi-ai");
+	const { createGentleAiExtension } = await import("../extensions/gentle-ai.ts");
+	const cwd = join(root, `repo-${label}`);
+	mkdirSync(cwd);
+	const gitEnv = { PATH: process.env.PATH, HOME: root, GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: join(root, "gitconfig") };
+	writeFileSync(gitEnv.GIT_CONFIG_GLOBAL, "");
+	execFileSync("git", ["init", "--initial-branch=fixture"], { cwd, env: gitEnv, stdio: "ignore" });
+	execFileSync("git", ["-c", "user.name=SDK Fixture", "-c", "user.email=fixture@example.invalid", "commit", "--allow-empty", "-m", "fixture"], { cwd, env: gitEnv, stdio: "ignore" });
+	const run: SessionRun = { requests: [], registered: new Map(), assessResults: [], errors: [] };
+	let next: { name: string; arguments: JsonObject } | undefined;
+	let calls = 0;
+	const model = { id: "driver", name: "Local driver", provider: "loadout-fixture", api: "loadout-fixture", baseUrl: "http://invalid.local", reasoning: false, input: ["text"], contextWindow: 1_000_000, maxTokens: 1024, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 } } as const;
+	const manager = sdk.SessionManager.inMemory(cwd);
+	const settings = sdk.SettingsManager.inMemory({ compaction: { enabled: false }, retry: { enabled: false }, cacheWarming: "off", packages: [] });
+	const runtime = await sdk.ModelRuntime.create({ credentials: new ai.InMemoryCredentialStore(), modelsPath: null, modelsStorePath: join(root, `models-${label}.json`), refreshOnCreate: false, allowModelNetwork: false });
+	const loader = new sdk.DefaultResourceLoader({
+		cwd, agentDir: bindings.PI_CODING_AGENT_DIR, settingsManager: settings,
+		noExtensions: true, noSkills: true, noPromptTemplates: true, noThemes: true, noContextFiles: true,
+		extensionFactories: [(pi) => {
+			const registerTool = pi.registerTool.bind(pi);
+			pi.registerTool = ((definition: { name: string; description: string; promptGuidelines?: readonly string[] }) => {
+				run.registered.set(definition.name, definition);
+				return registerTool(definition as never);
+			}) as typeof pi.registerTool;
+			createGentleAiExtension({
+				nativeReviewCli: nativeCli(mode),
+				candidateViews: null,
+				processEnv: { ...bindings, GENTLE_AI_TELEMETRY: "0" },
+				resolveTelemetryTriggerBinary: () => { throw new Error("fixture"); },
+			})(pi);
+			pi.on("tool_result", (event) => {
+				if (event.toolName === "gentle_review") run.assessResults.push({ isError: event.isError, details: event.details });
+			});
+			pi.registerProvider("loadout-fixture", {
+				api: "loadout-fixture", apiKey: "fixture-only", baseUrl: "http://invalid.local",
+				models: [{ id: model.id, name: model.name, reasoning: false, input: ["text"], cost: model.cost, contextWindow: model.contextWindow, maxTokens: model.maxTokens }],
+				streamSimple(_model, context) {
+					run.requests.push({ systemPrompt: ai.getCurrentSystemPrompt(context.messages), tools: ai.getCurrentTools(context.messages) });
+					const stream = ai.createAssistantMessageEventStream();
+					const request = next;
+					next = undefined;
+					calls += 1;
+					const message: AssistantMessage = { role: "assistant", api: model.api, provider: model.provider, model: model.id, content: [], stopReason: "pending" as never, timestamp: Date.now(), usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } } };
+					queueMicrotask(() => {
+						stream.push({ type: "start", partial: message });
+						if (request) {
+							const toolCall: ToolCall = { type: "toolCall", id: `call-${calls}`, ...request };
+							message.content.push(toolCall);
+							stream.push({ type: "toolcall_start", contentIndex: 0, partial: message });
+							stream.push({ type: "toolcall_delta", contentIndex: 0, delta: JSON.stringify(request.arguments), partial: message });
+							stream.push({ type: "toolcall_end", contentIndex: 0, toolCall, partial: message });
+						}
+						message.stopReason = request ? "toolUse" : "stop";
+						stream.push({ type: "done", reason: message.stopReason, message });
+						stream.end();
+					});
+					return stream;
+				},
+			});
+		}],
+	});
+	await loader.reload();
+	assert.deepEqual(loader.getExtensions().errors, []);
+	const { session } = await sdk.createAgentSession({
+		cwd, agentDir: bindings.PI_CODING_AGENT_DIR, modelRuntime: runtime, model: model as never, thinkingLevel: "off", resourceLoader: loader,
+		tools: ["read", "gentle_review", ...HIDDEN_WHEN_OFF], sessionManager: manager, settingsManager: settings,
+	});
+	try {
+		await session.bindExtensions({ mode: "json", onError: (error) => run.errors.push(error.error) });
+		next = { name: "gentle_review", arguments: { operation: "assess", input: { escalate: { item: 4, reason: "Fixture process concurrency boundary" } } } };
+		await session.prompt("Assess the current change.", { source: "interactive" });
+		beforeSecondPrompt();
+		await session.prompt("Report the plan.", { source: "interactive" });
+	} finally {
+		await session.abort();
+		session.dispose();
+	}
+	return run;
+}
+
+const LEAN_GUIDELINE = /gentle_review only for \{"operation":"assess"\}/;
+
+function fixture(t: { after: (fn: () => void) => void }): { root: string; bindings: Record<string, string> } {
+	const root = realpathSync(mkdtempSync(join(tmpdir(), "gentle-review-loadout-")));
+	const profile = join(root, "profile");
+	mkdirSync(profile);
+	const bindings = {
+		PI_CODING_AGENT_DIR: profile, PI_CODING_AGENT_SESSION_DIR: join(root, "sessions"),
+		GENTLE_PI_AGENT_HOME: profile, GENTLE_PI_CONFIG_HOME: join(root, "config"),
+	};
+	const previous = Object.fromEntries(Object.keys(bindings).map((key) => [key, process.env[key]]));
+	Object.assign(process.env, bindings);
+	t.after(() => {
+		for (const [key, value] of Object.entries(previous)) {
+			if (value === undefined) delete process.env[key];
+			else process.env[key] = value;
+		}
+		rmSync(root, { recursive: true, force: true });
+	});
+	return { root, bindings };
+}
+
+function registeredGuidelines(run: SessionRun): string[] {
+	const guidelines = ["gentle_review", ...HIDDEN_WHEN_OFF].flatMap((name) => run.registered.get(name)?.promptGuidelines ?? []);
+	assert.ok(guidelines.length > 0);
+	return guidelines;
+}
+
+function assertLeanRequest(request: RecordedRequest, run: SessionRun): void {
+	assert.match(request.systemPrompt, /Receipt-driven development: off /);
+	assert.match(request.systemPrompt, LEAN_GUIDELINE);
+	assert.match(request.systemPrompt, /relay it unchanged but do not execute it while RDD is off/);
+	assert.match(request.systemPrompt, /assessment metadata does not authorize STATUS, another review lifecycle operation, or enabling RDD/);
+	assert.doesNotMatch(request.systemPrompt, /relay it unchanged and follow it/);
+	assert.match(request.systemPrompt, /Continue the returned verification plan/);
+	assert.match(request.systemPrompt, /tests, builds, and functional checks still run/);
+	for (const guideline of registeredGuidelines(run)) assert.equal(request.systemPrompt.includes(guideline), false, `RDD off must leave out: ${guideline.slice(0, 80)}`);
+	const names = request.tools.map((tool) => tool.name);
+	assert.ok(names.includes("gentle_review"));
+	for (const hidden of HIDDEN_WHEN_OFF) assert.equal(names.includes(hidden), false, `${hidden} is not declared while RDD is off`);
+	assert.doesNotMatch(request.tools.find((tool) => tool.name === "gentle_review")!.description, /gentle_review_capture/);
+}
+
+function assertRegisteredRequest(request: RecordedRequest, run: SessionRun): void {
+	for (const guideline of registeredGuidelines(run)) assert.ok(request.systemPrompt.includes(guideline), `the registered loadout keeps: ${guideline.slice(0, 80)}`);
+	assert.doesNotMatch(request.systemPrompt, LEAN_GUIDELINE);
+	for (const name of ["gentle_review", ...HIDDEN_WHEN_OFF]) {
+		const declared = request.tools.find((tool) => tool.name === name);
+		assert.ok(declared, `${name} is declared`);
+		assert.equal(declared.description, run.registered.get(name)?.description);
+	}
+}
+
+test("RDD off: the parent request carries only the lean ASSESS loadout; RDD on: the registered review loadout", { timeout: 30_000 }, async (t) => {
+	const { root, bindings } = fixture(t);
+	const off = await runSession(root, "off", bindings, () => "off");
+	const on = await runSession(root, "on", bindings, () => "on");
+	assert.deepEqual(off.errors, []);
+	assert.deepEqual(on.errors, []);
+	assert.equal(off.requests.length >= 3, true, "assess turn, tool result turn, follow-up turn");
+
+	for (const request of off.requests) assertLeanRequest(request, off);
+	// The prefix is stable across turns of the same session.
+	assert.equal(new Set(off.requests.map((request) => request.systemPrompt)).size, 1);
+	assert.equal(new Set(off.requests.map((request) => JSON.stringify(request.tools))).size, 1);
+	// ASSESS stays callable and returns its plan.
+	assert.equal(off.assessResults.length, 1);
+	assert.equal(off.assessResults[0].isError, false);
+	assert.equal((off.assessResults[0].details as { schema?: string }).schema, "gentle-pi.review-assessment-plan/v1");
+	const plan = off.assessResults[0].details as Record<string, unknown>;
+	assert.equal(plan.rddLine, "off");
+	assert.equal(plan.reviewDue, true);
+	assert.equal(plan.reviewDueReason, "high_risk");
+	assert.deepEqual(plan.nextTransition, NATIVE_CONTINUATION);
+	assert.equal((plan.plan as Record<string, unknown>).writerSelfVerification, true);
+	assert.equal((plan.plan as Record<string, unknown>).independentVerifier, true);
+
+	for (const request of on.requests) {
+		assert.match(request.systemPrompt, /Receipt-driven development: on /);
+		assertRegisteredRequest(request, on);
+	}
+	assert.equal(on.assessResults.length, 1);
+	assert.equal(on.assessResults[0].isError, false);
+
+	const bytes = (request: RecordedRequest) => ({
+		systemPrompt: Buffer.byteLength(request.systemPrompt),
+		tools: Buffer.byteLength(JSON.stringify(request.tools)),
+	});
+	t.diagnostic(`RDD off request bytes: ${JSON.stringify(bytes(off.requests[0]))}`);
+	t.diagnostic(`RDD on request bytes: ${JSON.stringify(bytes(on.requests[0]))}`);
+});
+
+test("an unknown RDD line keeps the registered loadout; turning RDD on mid-session restores it at the next run", { timeout: 30_000 }, async (t) => {
+	const { root, bindings } = fixture(t);
+	const { __testing } = await import("../extensions/gentle-ai.ts");
+	__testing.clearRddStatusMemoForTesting();
+	t.after(() => __testing.clearRddStatusMemoForTesting());
+
+	const unknown = await runSession(root, "unknown", bindings, () => "throws");
+	assert.deepEqual(unknown.errors, []);
+	for (const request of unknown.requests) {
+		assert.match(request.systemPrompt, /Receipt-driven development: unknown/);
+		assertRegisteredRequest(request, unknown);
+	}
+
+	let mode: RddMode = "off";
+	const flipped = await runSession(root, "flip", bindings, () => mode, () => {
+		mode = "on";
+		__testing.clearRddStatusMemoForTesting();
+	});
+	assert.deepEqual(flipped.errors, []);
+	const last = flipped.requests.at(-1)!;
+	for (const request of flipped.requests.slice(0, -1)) assertLeanRequest(request, flipped);
+	assert.match(last.systemPrompt, /Receipt-driven development: on /);
+	assertRegisteredRequest(last, flipped);
+});

package/tests/review-owner-identity.test.ts

@@ -0,0 +1,132 @@
+import assert from "node:assert/strict";
+import childProcess from "node:child_process";
+import { randomUUID } from "node:crypto";
+import fs from "node:fs";
+import { syncBuiltinESMExports } from "node:module";
+import { dirname, join, resolve } from "node:path";
+import test from "node:test";
+import { createCandidateOwner, prepareCandidateOwnerParent } from "../lib/review-candidate-view-owner.ts";
+
+function fixture(t: test.TestContext) {
+	fs.mkdirSync(resolve("tmp"), { recursive: true });
+	const base = fs.realpathSync(fs.mkdtempSync(join(resolve("tmp"), "owner-identity-")));
+	const commonDir = join(base, "common");
+	const parent = join(commonDir, "gentle-ai", "candidate-views");
+	fs.mkdirSync(parent, { recursive: true });
+	const boundary = [commonDir, dirname(parent), parent];
+	let user = "S-1-5-21-1-2-3-1001";
+	let identityFailure = "";
+	let replacedMarker = false;
+	const probes = { user: 0, administrator: 0, owner: [] as string[], dacl: [] as string[], enforce: [] as string[] };
+	const native = fs.realpathSync.native;
+	t.mock.method(fs.realpathSync, "native", (path: string) =>
+		path.startsWith("\\\\?\\GLOBALROOT\\SystemRoot\\System32") ? path : native(path));
+	t.mock.method(childProcess, "execFileSync", (command: string, args: string[], options: any) => {
+		const name = command.split(/[\\/]/).at(-1);
+		if (name === "whoami.exe") {
+			probes.user++;
+			return identityFailure === "user" ? "unavailable" : user;
+		}
+		if (name === "icacls.exe") {
+			probes.dacl.push(args[0]);
+			const directory = fs.lstatSync(args[0]).isDirectory();
+			const flags = directory ? "OICI" : "ID";
+			const dacl = `D:${directory ? "P" : ""}(A;${flags};FA;;;${user})(A;${flags};FA;;;SY)(A;${flags};FA;;;BA)`;
+			fs.writeFileSync(join(options.cwd, args[2]), dacl, "utf16le");
+			return "";
+		}
+		if (name === "powershell.exe") {
+			const script = Buffer.from(args.at(-1)!, "base64").toString("utf16le");
+			if (script.includes("RawSecurityDescriptor")) {
+				probes.administrator++;
+				return identityFailure === "administrator" ? "unavailable" : "S-1-5-21-1-2-3-500";
+			}
+			if (script.includes("SetAccessControl")) {
+				probes.enforce.push(options.env.GENTLE_PI_CANDIDATE_ACL_PATH);
+				return "";
+			}
+			const path = options.env.GENTLE_PI_CANDIDATE_OWNER_PATH;
+			probes.owner.push(path);
+			return replacedMarker && path.endsWith(".owner.json") ? "S-1-5-21-9-8-7-1002" : user;
+		}
+		throw new Error(`Unexpected subprocess: ${name}`);
+	});
+	syncBuiltinESMExports();
+	t.after(() => {
+		t.mock.restoreAll();
+		syncBuiltinESMExports();
+		fs.rmSync(base, { recursive: true, force: true });
+	});
+	return { commonDir, parent, boundary, probes,
+		changeUser: () => { user = "S-1-5-21-4-5-6-1002"; },
+		failIdentity: (kind: string) => { identityFailure = kind; },
+		replaceMarker: () => { replacedMarker = true; } };
+}
+
+test("Windows creation reuses identity only within one operation and preserves every filesystem probe", (t) => {
+	const f = fixture(t);
+	for (let operation = 1; operation <= 2; operation++) {
+		if (operation === 2) f.changeUser();
+		const root = join(f.parent, randomUUID());
+		const owner = createCandidateOwner(f.commonDir, root, "win32");
+		const marker = `${root}.owner.json`;
+		assert.equal(owner.root, root);
+		assert.deepEqual(JSON.parse(fs.readFileSync(marker, "utf8")), owner);
+		assert.equal(fs.existsSync(root), false);
+		assert.equal(f.probes.user, operation, "one fresh user SID per creation");
+		assert.equal(f.probes.administrator, operation, "one fresh administrator SID per creation");
+		assert.deepEqual(f.probes.owner.slice((operation - 1) * 4), [...f.boundary, marker]);
+		assert.deepEqual(f.probes.dacl.slice((operation - 1) * 4), [...f.boundary, marker]);
+		assert.deepEqual(f.probes.enforce, []);
+	}
+});
+
+test("Windows preparation retains fresh pre-write and post-write owner/DACL checks", (t) => {
+	const f = fixture(t);
+	assert.equal(prepareCandidateOwnerParent(f.commonDir, "win32"), f.parent);
+	assert.equal(f.probes.user, 1);
+	assert.equal(f.probes.administrator, 1);
+	assert.deepEqual(f.probes.owner, [...f.boundary, ...f.boundary.flatMap(path => [path, path])]);
+	assert.deepEqual(f.probes.dacl, f.boundary);
+	assert.deepEqual(f.probes.enforce, f.boundary);
+});
+
+for (const kind of ["user", "administrator"]) test(`Windows creation fails closed on fresh ${kind} identity failure`, (t) => {
+	const f = fixture(t);
+	const first = createCandidateOwner(f.commonDir, join(f.parent, randomUUID()), "win32");
+	const marker = `${first.root}.owner.json`;
+	const before = fs.readFileSync(marker, "utf8");
+	const stored = fs.readdirSync(f.parent);
+	f.failIdentity(kind);
+	const root = join(f.parent, randomUUID());
+	assert.throws(() => createCandidateOwner(f.commonDir, root, "win32"), /SID is unavailable/);
+	assert.equal(fs.existsSync(root), false);
+	assert.equal(fs.existsSync(`${root}.owner.json`), false);
+	assert.equal(fs.readFileSync(marker, "utf8"), before);
+	assert.deepEqual(fs.readdirSync(f.parent), stored);
+	assert.equal(f.probes.owner.length, 4);
+	assert.equal(f.probes.dacl.length, 4);
+});
+
+test("Windows creation rollback rechecks a replaced marker owner before removal", (t) => {
+	const f = fixture(t);
+	const write = fs.writeFileSync;
+	const root = join(f.parent, randomUUID());
+	const marker = `${root}.owner.json`;
+	t.mock.method(fs, "writeFileSync", (...args: any[]) => {
+		if (typeof args[0] === "number") {
+			f.replaceMarker();
+			throw new Error("fixture write failure");
+		}
+		return (write as any)(...args);
+	});
+	syncBuiltinESMExports();
+	assert.throws(() => createCandidateOwner(f.commonDir, root, "win32"), /fixture write failure/);
+	assert.equal(f.probes.user, 1);
+	assert.equal(f.probes.administrator, 1);
+	assert.deepEqual(f.probes.owner, [...f.boundary, marker, marker]);
+	assert.deepEqual(f.probes.dacl, [...f.boundary, marker]);
+	assert.equal(fs.existsSync(marker), true, "unproven marker survives rollback");
+	assert.equal(fs.readFileSync(marker, "utf8"), "");
+	assert.equal(fs.existsSync(root), false);
+});