jules-orchestrator-kit 0.72.2 → 0.72.3

package/.agent/rules/jules-protocol.md

@@ -13,7 +13,8 @@ This document outlines the hard constraints and system prompting best practices
 - **Git Base Drift (Stale Merge-Base Reverts)**: If `main` advances during a session, `git diff main pr-N` shows branch *divergence*, not the applied patch. Merging blindly can silently revert unrelated files updated on `main`.
 - **Edge Isolates (Runtime Boundary Breaches)**: Edge environments (e.g. Cloudflare `workerd`) enforce strict limits (128 MB RAM, 10 MiB bundle cap). Jules may import heavy native libraries (`sharp`, `canvas`) that pass Node tests in the VM but crash worker deployment.
 - **CMS/DB Credentials (Visual & E2E Test Failures)**: Cloud VMs lack live CMS API keys, DB credentials, and display servers. Headful E2E or visual screenshot tests (e.g. Playwright) fail with 500 errors.
-- **CLI Dry-Run Drift (Misleading Pull Diffs)**: Running `jules remote pull --session <id>` (dry-run without `--apply`) on a session that crashed or made no commits can output cached or unrelated diffs.
+- **Runtime Environment & Resource Gates (KVM / 4 vCPU / 8 GiB RAM / No Swap)**: The execution sandbox runs in KVM on Ubuntu 24.04.2 LTS (`x86_64`, kernel 6.8.0, hostname `devbox`, user `jules`, uid=1001, passwordless `sudo`) with the target repo mounted at `/workspace`. Memory is capped via cgroup v2 `memory.max` at 8 GiB with swap completely disabled (`memory.swap.max = 0`); exceeding resident memory triggers the Linux kernel OOM killer (Exit code 137) immediately. Writable OverlayFS quota is 20–30 GiB. PID 1 is a headless supervisor without `systemd` (`systemctl` and `service` commands fail), so background services must be launched directly via bash (`cmd &`).
+- **Bootstrap Ingestion Hierarchy**: The startup harness parses only the Task Prompt / Issue Context, root `AGENTS.md`, and root `README.md`. Sub-package `AGENTS.md` manifests are discovered dynamically during file traversal (not during bootstrap planning), and IDE/agent configs (`.agent/rules/`, `.cursorrules`, `CLAUDE.md`, `.jules.yml`) are ignored by the harness. Critical invariants must be stated in root `AGENTS.md` or injected into the task envelope.
 
 ## 2. System Prompting & Guardrail Best Practices
 
@@ -22,7 +23,7 @@ To maximize the ratio of mergeable PRs vs. failed or hallucinated sessions:
 1. **Strict File Scoping:** Constrain file I/O using explicit glob patterns in session prompts.
 2. **Immutable Boundary Directives:** Explicitly forbid modification of `*.lock` files, database migration histories, and core configuration files.
 3. **Deterministic Test Verification Mandate:** Require explicit verification commands with zero-exit-code constraints before PR generation is permitted.
-4. **Sub-Package `AGENTS.md` Hierarchy:** Place localized `AGENTS.md` files at sub-package boundaries in monorepos to restrict dependency resolution graphs and operational blast radius.
+4. **Sub-Package `AGENTS.md` Hierarchy:** Place localized `AGENTS.md` files at sub-package boundaries in monorepos to restrict dependency resolution graphs and operational blast radius. Note: Sub-package manifests are discovered during file traversal, not during initial bootstrap planning, so critical repo-wide invariants must remain in root `AGENTS.md`.
 5. **Evidence-Based PR Requirement:** Require every PR to include commands run, exit codes, coverage/performance deltas, and risk assessments.
 6. **No-Weakening Rule:** Explicitly forbid deleting tests, reducing assertion strength, disabling lint/type checks, or ignoring security warnings.
 7. **Benchmark Threshold Rule:** Performance changes must include multiple benchmark runs, median comparison, and a minimum improvement threshold (e.g. ≥ 5%).
@@ -31,7 +32,7 @@ To maximize the ratio of mergeable PRs vs. failed or hallucinated sessions:
 10. **Stop-on-Uncertainty Rule:** If the task cannot be completed safely within scope, the agent must stop without opening a PR rather than guessing.
 11. **Pre-Dispatch Grounding Mandate:** Verify all file paths, script names, and exported symbols against the live repository tree before writing them into a prompt.
 12. **Programmatic CI Scope Guarding:** Enforce prompt constraints at the CI level using an unbypassable `Agent Scope Guard` workflow that evaluates diffs against a protected paths manifest (`.agent/protected-paths.json`).
-13. **Google Labs Exploration Budget Protocol:** Execute tasks across 3 discrete phases: (1) Discovery & Symbol Tracing (silent inspection, write NO code), (2) Oracle & Test Formulation, and (3) Surgical Implementation & Verification.
+13. **Google Labs Exploration Budget Protocol ("Use deep planning mode"):** Execute tasks across 3 discrete phases: (1) Discovery & Symbol Tracing (silent inspection, write NO code), (2) Oracle & Test Formulation, and (3) Surgical Implementation & Verification. Incorporate "Use deep planning mode" in task envelopes to steer model attention toward methodical verification before code modification.
 14. **Critic Agent Steering (Adversarial Pre-Review):** Jules' internal Critic Agent must evaluate proposed patches for edge-case regressions, $O(n^2)$ bottlenecks, unhandled parameters, and layout shifts (CLS) prior to PR submission. When modifying test suites or error handling, the agent must deliberately mutate production code and induce real failure conditions to prove that tests and catch blocks actually fail as intended (preventing tautological tests).
 15. **Web Excellence & Frontend Guardrails:** Enforce quantitative Core Web Vitals (LCP < 1.2s, CLS < 0.05), WCAG 2.2 AA/AAA semantic accessibility, Schema.org JSON-LD compliance, and Playwright multi-viewport responsive testing.
 16. **Airtight Positive Enclosures ("Pink Elephant" Rule):** Replace long negative constraint lists with strict positive operational perimeters (`ONLY modify [Target/Module]`) to prevent attention-drift in deep context windows.

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.72.3] - 2026-09-08
+*A directive not understood is silence; a tag not stripped is a backdoor.*
+
+Hardens prompt boundaries against Unicode Tag ASCII smuggling, expands clinical vocabulary to mitigate Vertex AI false-positive aborts, injects deep planning directives, and grounds runtime VM/cgroup constraints:
+- **Unicode Tag Plane & ASCII Smuggling Defense (`src/prompt-guard.mjs`, `src/security.mjs`)**: Gemini Pro tokenizes invisible Unicode Tag characters (`U+E0000` to `U+E007F`) as operational ASCII tokens. Both `ZERO_WIDTH_AND_BIDI_REGEX` and `INVISIBLE_CHARS` now strip and scan Plane 14 tag characters (`[\u{E0000}-\u{E007F}]`), preventing hidden prompt injections in GitHub issues/PR comments and credential hiding in diffs.
+- **Vertex AI Safety Classifier Mitigations (`src/prompt-guard.mjs`)**: Upstream Vertex AI content moderation (`HARM_CATEGORY_DANGEROUS_CONTENT`) frequently aborts sessions upon encountering aggressive process management syntax. `STERILE_VOCABULARY_MAP` now clinicalizes `kill -9` $\rightarrow$ `terminate with SIGTERM`, `SIGKILL` $\rightarrow$ `SIGTERM`, `reap zombie processes` $\rightarrow$ `collect child processes`, and `exploit_payload` $\rightarrow$ `test_payload`.
+- **Deep Planning Mode Directive Injection (`src/task-optimizer.mjs`, `src/web-templates.mjs`)**: Integrated the model-steering phrase `"Use deep planning mode."` into the Exploration Budget Protocol envelopes, reinforcing phased reasoning prior to code mutation.
+- **Grounded VM & cgroup Invariant Documentation (`.agent/rules/jules-protocol.md`)**: Formally documented KVM sandbox boundaries: Ubuntu 24.04.2 LTS (`x86_64`), cgroup v2 hard limit 8 GiB RAM with zero swap (`memory.swap.max = 0`), 20–30 GiB OverlayFS writable quota, `/workspace` repo mount, headless supervisor init (no systemd), and the three-source startup ingestion hierarchy (Task Prompt, root `AGENTS.md`, and root `README.md`).
+
 ## [0.72.2] - 2026-09-08
 *A test suite that writes to stderr did not write silence.*
 

package/README.md

@@ -49,32 +49,28 @@
 <a id="quickstart"></a>
 ## Quickstart
 
-Get running in any repository in 3 commands. `init` asks seven questions and
-fills in a sensible answer for each; `--yes` accepts all of them, detects the
-stack, and probes the test command it picked before writing it down.
+Configure any repository in three steps. `init` inspects project manifests, detects the stack, probes the test runner, and scaffolds repository guardrails:
 
 ```bash
-# 1. Scaffold config, AGENTS.md, role prompts and guardrails
-#    (auto-detects Python, Rust, Go, Node, PHP, etc.)
-#    Drop --yes to choose provider, plan, profile and workflows yourself.
+# 1. Scaffold configuration, AGENTS.md, role prompts, and guardrails
+#    Auto-detects Python, Rust, Go, Bun, Deno, Node, PHP, .NET, etc.
+#    Omit --yes to select provider, plan tier, and verification profile interactively.
 npx jules-orchestrator-kit init --yes
 ```
 
 ```bash
-# 2. Commit what init wrote — .agent/config.yml is protected by BUILTIN_PROTECT,
-#    so leaving it uncommitted makes the first gate reject your tree
+# 2. Commit the scaffolded configuration
+#    .agent/config.yml is protected by scope guards; committing establishes the trusted base policy.
 git add .agent AGENTS.md SPEC.md CONSTRAINTS.md .gitignore && git commit -m "chore: add agent config"
 ```
 
 ```bash
-# 3. Author a scoped, verified task envelope with guardrails & secret scrubbing
-#    Interactive by default. Pass the prompt to skip straight to review:
-npx jules-orchestrator-kit task create -p "Refactor the invoice module"
+# 3. Author a scoped, verified task envelope
+#    Interactive by default. Pass --prompt and --verify to define requirements directly:
+npx jules-orchestrator-kit task create -p "Refactor invoice calculation" --verify "npm test"
 ```
 
-`init` reads the repository, not a template: it detects the stack, picks a
-provider this machine can actually reach, and generates a CI workflow for the
-toolchain the project uses. Nothing about your setup is assumed.
+`init` derives configuration directly from repository manifests, connects reachable agent providers, and generates CI workflows matching the project toolchain.
 
 ```bash
 # Which agents can this machine dispatch to, and what is missing for the rest?
@@ -87,14 +83,12 @@ npx jules-orchestrator-kit profile --set max
 ```
 
 > [!TIP]
-> **Not sure what to run next?**  
-> `agentctl` with no arguments reads the repository state and prints the single
-> next step — missing git repo, missing API key, empty queue, tasks ready to
-> dispatch — instead of a wall of commands.
+> **Context-Aware Next Step:**  
+> Running `agentctl` without arguments inspects the local repository state (git status, active API keys, queued tasks) and prints the immediate next action.
 
 > [!TIP]
-> **Prefer a global CLI?**  
-> Install globally to access `agentctl` directly:
+> **Global Installation:**  
+> Install globally for direct command access:
 > ```bash
 > npm install -g jules-orchestrator-kit
 > agentctl init && agentctl task create && agentctl queue
@@ -109,35 +103,30 @@ npx jules-orchestrator-kit profile --set max
 <a id="any-repository"></a>
 ## Using It In Any Repository
 
-Four things differ between projects, and the kit resolves each one from the
-repository rather than from a template.
+The kit derives configuration directly from repository manifests across five core dimensions:
 
-| What differs | How it is resolved | Inspect / override |
+| Dimension | Resolution Mechanism | Inspect / Override |
 | :--- | :--- | :--- |
-| **Which suites to run** | A monorepo change resolves to the sub-projects it touches (`verify.scope: affected`), widening back to the root command as soon as it reaches a shared file. Off by default, on for repositories `init` detects as monorepos. | `agentctl check --json` · `verify.scope` in `.agent/config.yml` |
-| **The stack** | `detectStack()` recognises 24+ ecosystems (Cargo, Go, Python/Django, Maven/Gradle, .NET, PHP/Laravel, Ruby, Elixir, Swift, Flutter/Dart, CMake, Bun, Deno, Node + Turbo/pnpm/Nx workspaces) and derives the setup, lint, test and build commands from the manifest it finds. | `agentctl doctor` · `verify:` in `.agent/config.yml` |
-| **The agent** | `provider:` selects Google Jules (hosted REST), the Claude Code CLI, the Codex CLI or the Gemini CLI. Readiness means a credential for the hosted one and a binary on `PATH` for the local ones — never both. | `agentctl providers` · `agentctl init --provider <name>` |
-| **How hard to verify** | `verify.profile` expands at load time into a stage pipeline that skips gates the runtime cannot support, and says which and why. | `agentctl profile` · `agentctl profile --set max` |
-| **Where CI runs** | A workflow is *generated* for the detected stack — the project's toolchain plus Node for the CLI — not copied from this repository. | `agentctl ci init [--target github\|gitlab]` |
+| **Monorepo Scope** | Monorepo diffs resolve to affected sub-projects (`verify.scope: affected`), widening to root commands when shared files change. Activated automatically when monorepo manifests are detected. | `agentctl check --json`<br/>`verify.scope` in `.agent/config.yml` |
+| **Stack & Tooling** | `detectPolyglotStack()` inspects 26+ ecosystems (Cargo, Go, Python, Bun, Deno, Maven, Gradle, .NET, PHP, Ruby, Elixir, Swift, Flutter, CMake, Make, Turbo/pnpm/Nx) and extracts native test and build commands. | `agentctl doctor`<br/>`verify:` in `.agent/config.yml` |
+| **Agent Provider** | Supports Google Jules (hosted REST), Claude Code CLI, OpenAI Codex CLI, and Gemini CLI. Validates environment credentials for hosted APIs and `PATH` binaries for local agents. | `agentctl providers`<br/>`agentctl init --provider <name>` |
+| **Verification Depth** | `verify.profile` (`minimal`, `standard`, `max`) expands dynamically into stack-compatible verification stages, reporting explicit skip reasons for unsupported platform checks. | `agentctl profile`<br/>`agentctl profile --set max` |
+| **CI Generation** | Generates tailored CI workflows containing the project's native runtime and toolchain rather than copying a fixed template. | `agentctl ci init [--target github\|gitlab]` |
 
-### Verification profiles
+### Verification Profiles
 
-| Profile | Runs | Use when |
+| Profile | Stages | Recommended Use |
 | :--- | :--- | :--- |
-| `minimal` | setup → tests | The suite is slow, the stack is unfamiliar, or it is day one. |
-| `standard` | setup → lint → tests → build → anti-tamper on the diff | The everyday gate. Scaffolded by default. |
-| `max` | everything above → mutation scoring → V8 diff coverage *(Node runtimes only)* → 3-pass flakiness probe | The change is consequential, or an agent has been getting green too easily. |
+| `minimal` | Setup → Tests | Large/slow test suites or initial project onboarding. |
+| `standard` | Setup → Lint → Tests → Build → Diff Anti-Tamper | Default gate for routine pull requests. |
+| `max` | All stages above → AST Mutation Scoring → V8 Diff Coverage *(Node)* → 3-Pass Flakiness Probe | High-risk refactors or critical infrastructure changes. |
 
-Nothing in a profile is Node-specific by assumption. Gates a runtime cannot
-support are skipped with a stated reason rather than failing the diff — a Cargo
-repository on `max` runs mutation and stability probing and is never asked for
-`NODE_V8_COVERAGE`.
+Verification profiles evaluate gates dynamically per runtime. Unsupported platform checks (such as V8 coverage on Cargo or Go projects) are bypassed with explicit diagnostic logs rather than failing the gate.
 
-### No provider? Still useful
+### Standalone Local Verification
 
-Every gate below runs locally with no API key, no CLI and no network:
-`agentctl check`, `mutate`, `coverage`, `probe`, `assert`, `evidence`, `rules`,
-`doctor`. The provider is only needed to *dispatch* work, not to verify it.
+All security, integrity, and test gates execute locally without external network access or API keys:
+`agentctl check`, `agentctl gate`, `agentctl mutate`, `agentctl coverage`, `agentctl probe`, `agentctl evidence`, `agentctl doctor`. Agent providers are required only for dispatching autonomous tasks.
 
 <br/>
 
@@ -195,20 +184,20 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 
 ## Core Capabilities
 
-* **Provider-Agnostic:** Dispatches to Google Jules (hosted REST), the Claude Code CLI, the OpenAI Codex CLI or the Gemini CLI. `agentctl providers` probes each one — a credential for the hosted provider, a binary on `PATH` for the local ones — and every verification gate works with no provider configured at all.
-* **Vendor-Neutral Configuration:** Every `JULES_*` environment variable also answers to an `AGENT_*` spelling (`AGENT_API_KEY`, `AGENT_REPO`, `AGENT_SWARM_CONCURRENCY`). The legacy name always wins where both are set, so adding an alias cannot change a working setup.
-* **One-Word Verification Depth:** `verify.profile: minimal | standard | max` expands at load time into a stack-aware pipeline — `max` adds mutation scoring, flakiness probing and, where the runtime emits it, V8 diff coverage. A Cargo repository is never asked for `NODE_V8_COVERAGE`.
-* **Generated, Not Copied, CI:** `agentctl ci init` writes a GitHub Actions or GitLab job carrying the toolchain the detected stack needs (`setup-python`, `setup-go`, `setup-java`, …) plus Node for the CLI itself.
-* **Zero Runtime Dependencies:** Built exclusively on Node.js 20+ built-in modules (`node:fs`, `node:child_process`, `node:crypto`, `node:path`, `node:http`, `node:tty`, `node:test`).
+* **Multi-Provider Dispatch:** Dispatches to Google Jules (hosted REST API), Claude Code CLI, OpenAI Codex CLI, and Gemini CLI. `agentctl providers` inspects environment credentials and binary availability across providers.
+* **Vendor-Neutral Configuration:** Supports both `JULES_*` and `AGENT_*` environment variables (`AGENT_API_KEY`, `AGENT_REPO`, `AGENT_SWARM_CONCURRENCY`), with legacy `JULES_*` variables taking precedence.
+* **Dynamic Verification Profiles:** Configured via `verify.profile: minimal | standard | max`. Automatically schedules linting, unit testing, build stages, AST mutation testing, and stability probing suited to the project toolchain.
+* **Stack-Native Generated CI:** `agentctl ci init` generates GitHub Actions and GitLab CI configurations containing the project's exact toolchain (`setup-python`, `setup-go`, `setup-bun`, etc.) alongside Node.js for CLI execution.
+* **Zero Runtime Dependencies:** Implemented strictly using native Node.js 20+ standard modules (`node:fs`, `node:child_process`, `node:crypto`, `node:path`, `node:http`, `node:readline`, `node:test`).
 * **Cross-Platform Parity:** Verified 100% green across Linux, macOS (Darwin), and Windows on Node 20, 22, and 24.
-* **Autonomous Self-Healing Loop:** Captures test stderr/stdout, fingerprints error traces, and feeds structured context back into automated repair turns (up to 3 attempts) before human escalation.
-* **Fail-Closed Verification:** A change that ran no verification command at all is rejected, not approved — "nothing to run" is not a pass. Repositories using only the scope and secret phases opt out explicitly with `verify.required: false`.
-* **Anti-Tamper That Reads Semantics:** Counting assertions cannot see a value check swapped for a truthiness check. The guard tracks assertions that name an expected value, so weakening a test is a violation even when the line count is unchanged.
-* **Binary-Aware Scanning:** Files git renders as `Binary files ... differ` are read directly for structured credentials, and their real size is charged against the diff ceiling, so a leading NUL byte cannot hide a token and a committed blob cannot walk past the payload governor.
-* **Fail-Closed Security & Secret Redaction:** Evaluates explicit Deny rules before Allow rules against canonicalized, case-folded paths. Redacts high-entropy keys and base64-encoded credentials (such as Kubernetes `Secret` manifests).
-* **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, with a `node --check` syntax-verification gate that transparently escalates a FAST-tier result to the primary provider if it left broken JS on disk.
-* **Terminal UI & Diagnostic Matrix (`agentctl doctor`):** Interactive terminal dashboard, task sidecar manager, and automated transactional self-repair.
-* **Verified Test Suite:** Tested with **1403 unit tests across 196 suites**, green on every supported platform.
+* **Autonomous OODA Repair Loop:** Captures test stdout/stderr traces, fingerprints failure patterns, and executes automated repair cycles (up to 3 turns) before requesting human intervention.
+* **Fail-Closed Verification:** Rejects diffs that execute zero verification commands unless explicitly waived with `verify.required: false`.
+* **Semantic Anti-Tamper Guard:** Detects test tampering across languages: weakened assertions, removed assertions, vacuous tautologies (`expect(true).toBe(true)`), and assertions nested inside dead conditions (`if False:`, `if (false)`, `if 0:`).
+* **Binary & Symlink Payload Inspection:** Inspects binary diffs and symlink targets directly, charging real byte sizes against the diff ceiling to prevent payload governor bypasses.
+* **Fail-Closed Security & Secret Scrubbing:** Evaluates Deny-before-Allow rules against canonicalized paths. Detects high-entropy strings and base64-encoded credentials (e.g. Kubernetes manifests).
+* **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, backed by syntax-check fallback recovery.
+* **Terminal UI & Diagnostics (`agentctl doctor`):** Interactive terminal dashboard, VFS lock management, and automated system diagnostics.
+* **Mechanically Verified:** Comprehensive test suite of **1410 unit tests across 196 suites**, with 59 activation-coverage canaries and 100% pass rate.
 
 <br/>
 
@@ -452,22 +441,14 @@ const result = await fast.dispatch({ prompt: "Fix a typo." }, { root: process.cw
 | **Staged Diff Fidelity & Indentation Dead Guards** | `src/git.mjs`, `src/security.mjs` | Query cached index in staged mode (`git diff --cached <base>`), detect literal falsity dead guards (`if False:`, `if (false)`, `if 0:`), and support indentation-aware block traversal for Python test suites. | **v0.72.1** *(Shipped)* |
 | **Cold-Start Hardened Kernel & Tamper Defense** | `src/config.mjs`, `src/engine.mjs`, `src/git.mjs`, `src/security.mjs` | Full remediation of 22 cold-start audit findings (F01–F22): authoritative base policy resolution, ephemeral snapshot worktree isolation, canonical root test tamper guard, conditional assertion defense, multi-target Cargo test aggregation, Python src-layout injection, and complete repository uninstall documentation. | **v0.72.0** *(Shipped)* |
 | **Silence Is Not A Suite & Scaffolding Linter Fixes** | `src/ops/test-collection.mjs`, `src/wizard-init.mjs`, `src/config.mjs` | Reject zero-output test suite commands, quote-aware YAML parser with scalar emission, test de-registration detection (`TEST_DEREGISTERED`), and active waiver telemetry banner. | **v0.71.0** *(Shipped)* |
-| **Diagnostics That Reach the Operator** | `src/security.mjs`, `src/engine.mjs`, `bin/agentctl.mjs` | Secret findings name the file and line, a failed verify stage reports its command, exit code and output, and `queue`/`swarm` name each failed task and exit `1` rather than reporting success for a run that dispatched nothing. | **v0.41.1** *(Shipped)* |
-| **One Scaffolding Path & First-Install Fixes** | `src/scaffold.mjs`, `src/security.mjs` | `agentctl init` and `jules-init` scaffold from one source and write the runtime `.gitignore` entries, so the kit's own bookkeeping no longer reaches its own gate; a lockfile bump no longer fails closed as a secret leak. | **v0.41.1** *(Shipped)* |
-| **Queue Runner Fidelity** | `src/dag-engine.mjs`, `src/engine.mjs` | Queue selection is by task shape rather than file extension, so manifests and READMEs are skipped instead of dispatched, and `--dry-run` leaves the queue untouched. | **v0.38.2** *(Shipped)* |
-| **Release Gate Enforcement & Wizard Smoke Test** | `.github/workflows/jules-audit.yml`, `scripts/release.mjs`, `test/wizard-smoke.test.mjs` | Doc-sync gate runs in CI rather than by hand, releases block on a green CI matrix for `HEAD`, per-test deadlines turn a hang into a failure, and the real `init` wizard is driven end to end over a fake TTY. | **v0.38.1** *(Shipped)* |
-| **Multi-OS CI Matrix & TUI Hardening** | `scripts/run-tests.mjs`, `src/state.mjs`, `src/git.mjs` | Automated 9-job CI matrix across Linux, macOS, and Windows on Node 20/22/24 with raw-mode TUI resilience and native Windows command quoting. | **v0.38.0** *(Shipped)* |
-| **Base64 Secret Detection & Budget Fix** | `src/security.mjs`, `src/budget.mjs` | Secret scanner decodes base64 before matching structured patterns (K8s secrets), and `budget reset` preserves confirmed provider sessions. | **v0.37.0** *(Shipped)* |
-| **Universal AI Crawler Policy & llms.txt** | `src/web-templates.mjs` (`web-ai-access`) | Cross-surface consistency for crawler directives (`robots.txt`, meta tags, `X-Robots-Tag`) and `llms.txt` local route integrity. | **v0.36.0** *(Shipped)* |
-| **Silence Governor & Flaky Test Swarm** | `src/webhook.mjs`, `src/flaky-ledger.mjs` | Notification alert throttling with interruption budgeting, and automated anti-flakiness swarm coordinator. | **v0.35.0** *(Shipped)* |
-| **Rolling 24h Quota & Plan Concurrency** | `src/state.mjs`, `src/config.mjs` | Rolling 24-hour quota accounting matching vendor reset windows and true concurrency limits (3/15/60). | **v0.34.0** *(Shipped)* |
-| **Cost Router & Guided First Run** | `src/router.mjs`, `src/ops/next-step.mjs` | Heuristic task classifier routing trivial tasks to fast models, and guided single-command first run workflow. | **v0.33.0** *(Shipped)* |
-| **DAG Task Queue & Specialist Roles** | `src/dag-engine.mjs`, `src/evidence.mjs` | Kahn's-algorithm dependency queue execution (`queue --dag`), specialist role prompts (`overseer`, `bolt`, `sentinel`, `janitor`), and SHA-256 evidence manifests. | **v0.32.5** *(Shipped)* |
-| **Warm Session Resumption & PR Bundler** | `src/provider.mjs`, `src/engine.mjs` | Multi-turn warm session context streaming via `POST /v1alpha/sessions/{id}:sendMessage` & evidence PR descriptions. | **v0.31.0** *(Shipped)* |
-| **TDD Harness & Prompt Falsifiability Linter** | `agentctl test-gen`, `agentctl task optimize` | Automated RED-state test generator, `scope.deny` test locking, and prompt testability linter with fuzzy path resolution. | **v0.31.0** *(Shipped)* |
-| **Atomic Git Checkpoint & Rollback** | `agentctl rollback` (`src/ops/checkpoint.mjs`) | Pre-flight git HEAD/stash snapshotting, atomic rollback restoration, and 10-session pruning rotation. | **v0.31.0** *(Shipped)* |
-| **Terminal UI Engine** | `src/tui.mjs`, `src/key-decoder.mjs` | Zero-dependency terminal capabilities detector, sequence key decoder, and interactive prompt widgets. | **v0.30.0** *(Shipped)* |
-| **PR Review Auto-Remediation Loop** | `agentctl review-repair` (`src/review-repair.mjs`) | Ingests GitHub PR review comments (`CHANGES_REQUESTED`), extracts line/file context, and dispatches automated repair turns. | **v0.27.0** *(Shipped)* |
+| **Terminal State Classification & Error Diagnostics** | `src/engine.mjs`, `src/session-ops.mjs` | Triple-verdict session resolution (terminal, blocked, timed-out), diagnostic extraction for failed session retries (`AssertionError`, tracebacks), and 22-case session polling contract. | **v0.70.0** *(Shipped)* |
+| **Expected-Value Scanning & Safe Scaffolding** | `src/security.mjs`, `src/wizard-init.mjs` | Multi-language expected-value first assertions (JUnit/PHPUnit), prefix-aware test rename verification, and rejection of empty/trivial verification oracles. | **v0.69.0** *(Shipped)* |
+| **Dialect Hardening & Scope Protection** | `src/security.mjs`, `src/config.mjs`, `scripts/guard-reach-check.mjs` | Unreadable test dialects fail closed, lockfiles and toolchain pins guarded against silent tampering, and 59-canary activation coverage gate in CI. | **v0.63.0** *(Shipped)* |
+| **Process-Group Reaping & Subprocess Lifecycles** | `scripts/run-tests.mjs`, `src/git.mjs` | Tree-wide process group cleanup on interruption and zero-output test collection guards. | **v0.60.0** *(Shipped)* |
+
+<br/>
+
+> For the complete history of all shipped milestones (v0.20.0 – v0.72.2), see [ROADMAP_V1.md](ROADMAP_V1.md).
 
 </details>
 
@@ -479,7 +460,7 @@ const result = await fast.dispatch({ prompt: "Fix a typo." }, { root: process.cw
 
 ## 🧹 Complete Uninstall / Removing the Kit (Undo Init)
 
-If you need to completely remove `jules-orchestrator-kit` from a repository after running `agentctl init`, follow the procedure below. Note that `agentctl clean` is an operational maintenance command (cleaning ephemeral locks, temporary worktrees, and evidence caches), not an uninstaller.
+To completely remove `jules-orchestrator-kit` from a repository after running `agentctl init`, follow the procedure below. Note that `agentctl clean` performs operational maintenance (clearing ephemeral locks, temporary worktrees, and evidence caches), not an uninstaller.
 
 ### 1. Generated Assets & Manifest
 
@@ -554,6 +535,6 @@ npm uninstall -g jules-orchestrator-kit
 <br/>
 
 <div align="center">
-  <p><b>jules-orchestrator-kit</b> • Built with zero external dependencies for Google Jules and autonomous agent workflows.</p>
+  <p><b>jules-orchestrator-kit</b> • Zero runtime dependencies • MIT License • Universal safety and verification for autonomous coding agents.</p>
 </div>
 

package/ROADMAP_V1.md

@@ -11,13 +11,19 @@ The **jules-orchestrator-kit** is the zero-dependency safety gatekeeper and self
 ## 📌 Release Milestones Overview
 
 ```
- v0.72.2 (Current Stable) ──► v0.73.0 (Distributed Swarms & Leases) ──► v1.0.0 (Production Hardened Kernel)
- (Child Streams & Bun/Deno)   (Multi-Agent DAG & Resource Locks)       (Enterprise Telemetry & SLA)
+ v0.72.3 (Current Stable) ──► v0.73.0 (Distributed Swarms & Leases) ──► v1.0.0 (Production Hardened Kernel)
+ (ASCII Smuggle & Safety)    (Multi-Agent DAG & Resource Locks)       (Enterprise Telemetry & SLA)
 ```
 
 ---
 
-## ✅ Shipped Milestones (v0.20.0 – v0.72.2)
+## ✅ Shipped Milestones (v0.20.0 – v0.72.3)
+
+### v0.72.3: ASCII Smuggling Defense, Safety Filter Mitigations & Deep Planning Envelopes
+- [x] **Unicode Tag ASCII Smuggling Defense (`src/prompt-guard.mjs`, `src/security.mjs`)** — strips and detects Plane 14 Unicode Tag characters (`U+E0000`–`U+E007F`) across untrusted inputs and secret diffs.
+- [x] **Vertex AI Safety Moderation Mitigations (`src/prompt-guard.mjs`)** — clinicalizes `kill -9`, `SIGKILL`, zombie reaping, and exploit terms to prevent upstream `HARM_CATEGORY_DANGEROUS_CONTENT` aborts.
+- [x] **Deep Planning Mode Steering Directive (`src/task-optimizer.mjs`, `src/web-templates.mjs`)** — injects `"Use deep planning mode."` into exploration budget task envelopes.
+- [x] **Runtime Environment & Ingestion Directives (`.agent/rules/jules-protocol.md`)** — documented KVM 8 GiB swap=0 OOM limits, 20-30 GiB OverlayFS quota, `/workspace` mount, non-systemd supervisor, and startup ingestion hierarchy.
 
 ### v0.72.2: Child Process Stream Fidelity & Polyglot Build Detection
 - [x] **Child Process Stream Fidelity (`src/git.mjs`)** — `runCmd()` invokes native `spawnSync`, preserving both `stdout` and `stderr` streams on exit 0 so test runners emitting summaries to stderr (`bun test`) are fully recognized by `parseCollectedTests`.
@@ -221,8 +227,8 @@ The **jules-orchestrator-kit** is the zero-dependency safety gatekeeper and self
 ### v0.73.0: Distributed File Leases & Preemptive DAG Scheduling
 - [ ] **Atomic Filesystem Lease & Heartbeat Protocol (`src/engine.mjs`, `src/flaky-ledger.mjs`)** — Directory-mutex file leasing with heartbeat timestamps, stale-lock detection via PID liveness inspection, and tombstone rotation without third-party daemons or Redis.
 - [ ] **Preemptive Task Cancellation & Interface Fingerprints (`src/dag-engine.mjs`)** — Automatically aborts and yields downstream swarm tasks when upstream exported symbol interfaces diverge from their cryptographic SHA-256 fingerprints.
-- [ ] **POSIX/Win32 Process Group Guillotine (`src/engine.mjs`)** — Tree teardown via `process.kill(-pid, 'SIGKILL')` on POSIX and `taskkill /T /F /PID` on Windows to eliminate orphaned dev-servers and background watchers.
-- [ ] **Unicode Trojan Source & Homoglyph Fencing (`src/security.mjs`)** — Deterministic token scanner using V8 Unicode Property Escapes (`\p{Script=...}`) and NFKC normalization to block invisible Bidi overrides (CVE-2021-42574) and mixed-script homoglyphs.
+- [ ] **POSIX/Win32 Process Group Guillotine (`src/git.mjs:runCmd`, `src/engine.mjs`)** — Tree teardown via `process.kill(-pid, 'SIGKILL')` on POSIX and `taskkill /T /F /PID` on Windows in `runCmd` to eliminate orphaned test runners, dev-servers and background watchers on timeout (`ETIMEDOUT`).
+- [ ] **Unicode Trojan Source & Homoglyph Fencing (`src/security.mjs`)** — Deterministic token scanner using V8 Unicode Property Escapes (`\p{Script=...}`) and NFKC normalization to block invisible Bidi overrides (CVE-2021-42574, isolates partially patched in PR #21) and mixed-script homoglyphs.
 
 ---
 

package/bin/agentctl.mjs

@@ -293,6 +293,8 @@ async function main() {
           "check-premise": { type: "boolean" },
           idempotent: { type: "boolean" },
           author: { type: "string" },
+          "verify-cmd": { type: "string", short: "v" },
+          verify: { type: "string" },
           "dry-run": { type: "boolean", short: "d" },
           json: { type: "boolean", short: "j" },
         },
@@ -333,6 +335,7 @@ async function main() {
         requirePlanApproval: values["require-plan-approval"],
         checkPremise: values["check-premise"] || values.idempotent,
         author: values.author,
+        verifyCmd: values["verify-cmd"] || values.verify,
       };
 
       try {
@@ -1498,7 +1501,9 @@ async function main() {
       console.log(`--------------------------------------------------`);
       console.log(`  Project Root     : ${root}`);
       console.log(`  Config File      : ${config._file || "None (Using defaults)"}`);
-      console.log(`  Detected Stack   : ${detectStack(root).stack}`);
+      const stackInfo = detectStack(root);
+      const edgeSuffix = stackInfo.isEdgeRuntime ? ` (Edge: ${stackInfo.edgePlatform || "generic"})` : "";
+      console.log(`  Detected Stack   : ${stackInfo.stack}${edgeSuffix}`);
       console.log(`  Test Command     : ${config.verify.test || "(None)"}`);
       console.log(`  Build Command    : ${config.verify.build || "(None)"}`);
       console.log(`  Daily Budget     : ${formatBudgetLine(budgetStatus(config, root))}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.72.2",
+  "version": "0.72.3",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",

package/scripts/doc-sync-check.mjs

@@ -317,6 +317,21 @@ export function checkDocSync(root = process.cwd(), opts = {}) {
     }
   }
 
+  // 6. SECURITY.md — supported version table must name the current version series.
+  const security = readIfExists(join(root, "SECURITY.md"));
+  if (security === null) {
+    add("SECURITY present", false, "SECURITY.md not found");
+  } else {
+    const sem = version.split(".");
+    const expectedSeries = `v${sem[0]}.${sem[1]}.x`;
+    const secMatch = security.match(/\|\s*`v(\d+\.\d+)\.x`\s*\(Latest\)\s*\|/);
+    add(
+      "SECURITY supported version",
+      secMatch ? `v${secMatch[1]}.x` === expectedSeries : false,
+      secMatch ? `found v${secMatch[1]}.x, expected ${expectedSeries}` : "no `vX.Y.x (Latest)` marker found"
+    );
+  }
+
   return { ok: checks.every((c) => c.ok), version, checks };
 }
 

package/src/mcp.mjs

@@ -563,9 +563,11 @@ export async function handleMcpRequest(request, opts = {}) {
         };
       }
 
+      const isDryRun = Boolean(args.dryRun ?? opts?.dryRun ?? opts?.config?.dryRun);
+
       if (toolName === "jules_list_sessions") {
         const provider = createProvider(config.provider || "jules", config);
-        const res = await provider.listSessions({ root, pageSize: args.pageSize, pageToken: args.pageToken });
+        const res = await provider.listSessions({ root, pageSize: args.pageSize, pageToken: args.pageToken, dryRun: isDryRun });
         return {
           jsonrpc: "2.0",
           id,
@@ -584,7 +586,7 @@ export async function handleMcpRequest(request, opts = {}) {
           };
         }
         const provider = createProvider(config.provider || "jules", config);
-        const res = await provider.listActivities(args.sessionId, { root, pageSize: args.pageSize, pageToken: args.pageToken });
+        const res = await provider.listActivities(args.sessionId, { root, pageSize: args.pageSize, pageToken: args.pageToken, dryRun: isDryRun });
         return {
           jsonrpc: "2.0",
           id,
@@ -621,7 +623,7 @@ export async function handleMcpRequest(request, opts = {}) {
           };
         }
         const provider = createProvider(config.provider || "jules", config);
-        const res = await provider.archiveSession(args.sessionId, { root });
+        const res = await provider.archiveSession(args.sessionId, { root, dryRun: isDryRun });
         return {
           jsonrpc: "2.0",
           id,
@@ -640,7 +642,7 @@ export async function handleMcpRequest(request, opts = {}) {
           };
         }
         const provider = createProvider(config.provider || "jules", config);
-        const res = await provider.deleteSession(args.sessionId, { root });
+        const res = await provider.deleteSession(args.sessionId, { root, dryRun: isDryRun });
         return {
           jsonrpc: "2.0",
           id,

package/src/prompt-guard.mjs

@@ -6,7 +6,7 @@
  * neutralizes LLM control role markers and prompt injection patterns, and wraps inputs in strict tags.
  */
 
-const ZERO_WIDTH_AND_BIDI_REGEX = /[\u200B-\u200F\u202A-\u202E\u2060-\u206F\uFEFF]/g;
+const ZERO_WIDTH_AND_BIDI_REGEX = /[\u200B-\u200F\u202A-\u202E\u2060-\u206F\uFEFF]|[\u{E0000}-\u{E007F}]/gu;
 const ANSI_ESCAPE_REGEX = /\u001B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g;
 
 const CONTROL_TAGS_REGEX = /<\|im_start\|>|<\|im_end\|>|<\|system\|>|<\|assistant\|>|<\|user\|>|<\|endoftext\|>|\[INST\]|\[\/INST\]|<<SYS>>|<\/SYS>>/gi;
@@ -27,15 +27,21 @@ const INJECTION_PATTERNS = [
  * to prevent false-positive safety classifier tripwires in Google VM environments.
  */
 export const STERILE_VOCABULARY_MAP = [
+  { pattern: /\bkill\s+-9\b/gi, replacement: "terminate with SIGTERM" },
+  { pattern: /\bSIGKILL\b/g, replacement: "SIGTERM" },
   { pattern: /\bkill\s+(?:the\s+)?processes\b/gi, replacement: "terminate the processes" },
   { pattern: /\bkill\s+(?:the\s+)?process\b/gi, replacement: "terminate the process" },
   { pattern: /\bkill\s+(?:the\s+)?pid\b/gi, replacement: "terminate the PID" },
+  { pattern: /\breap\s+(?:the\s+)?(?:zombie\s+)?processes\b/gi, replacement: "collect child processes" },
+  { pattern: /\breap\s+(?:the\s+)?(?:zombie\s+)?process\b/gi, replacement: "collect child process" },
+  { pattern: /\breap\s+(?:the\s+)?zombies\b/gi, replacement: "collect child processes" },
   { pattern: /\bamputate\s+(?:dead\s+|unused\s+)?code\b/gi, replacement: "prune unused code" },
   { pattern: /\bamputate\b/gi, replacement: "prune" },
   { pattern: /\bsabotage\s+(?:the\s+)?tests?\b/gi, replacement: "mutate test logic" },
   { pattern: /\bsabotage\b/gi, replacement: "mutate" },
   { pattern: /\bdestroy\s+(?:the\s+)?(state|cache|file|data|directory)\b/gi, replacement: "purge the $1" },
   { pattern: /\bwipe\s+(?:the\s+)?(state|cache|directory|disk|table)\b/gi, replacement: "clear the $1" },
+  { pattern: /\bexploit_payload\b/gi, replacement: "test_payload" },
 ];
 
 /**

package/src/security.mjs

@@ -3,7 +3,7 @@ import { isTestPath } from "./test-paths.mjs";
 import { dirname, join, basename } from "node:path";
 import { randomBytes } from "node:crypto";
 import { canonicalizePath, isWindowsAbsolutePath } from "./config.mjs";
-import { detectCrossPackageBoundaryViolations } from "./stack-detector.mjs";
+import { detectCrossPackageBoundaryViolations, detectEdgeRuntime } from "./stack-detector.mjs";
 
 export const HIGH_CONFIDENCE_PATTERNS = [
   /\bghp_[A-Za-z0-9_]{36,255}\b/g,
@@ -448,7 +448,8 @@ export function checkEdgeRuntimeImports(diffOrText = "", options = {}) {
 
   const isEdgeExplicit = options.isEdgeRuntime === true;
   const hasEdgeExport = /export\s+const\s+runtime\s*=\s*['"]edge['"]/i.test(diffOrText);
-  const isEdgeContext = isEdgeExplicit || hasEdgeExport;
+  const isEdgeDetected = options.root ? detectEdgeRuntime(options.root).isEdgeRuntime : false;
+  const isEdgeContext = isEdgeExplicit || hasEdgeExport || isEdgeDetected;
 
   if (!isEdgeContext) {
     return { ok: true, violations: [] };
@@ -526,9 +527,9 @@ export function checkCrossPackageImports(diffOrText = "", root = process.cwd(),
   };
 }
 
-// Zero-width and bidi-control characters. Inserting one mid-token defeats a
-// regex without changing how the value renders, copies, or authenticates.
-const INVISIBLE_CHARS = /[\u00AD\u200B-\u200F\u2028\u2029\u202A-\u202E\u2060-\u2064\uFEFF]/g;
+// Zero-width, bidi-control characters, and Unicode tag plane (U+E0000..U+E007F).
+// Inserting one mid-token defeats a regex without changing how the value renders, copies, or authenticates.
+const INVISIBLE_CHARS = /[\u00AD\u200B-\u200F\u2028\u2029\u202A-\u202E\u2060-\u2064\u2066-\u2069\uFEFF]|[\u{E0000}-\u{E007F}]/gu;
 
 // Unicode lookalikes that NFKD does NOT decompose. Full-width and other
 // compatibility forms are handled by String#normalize("NFKD") below; these are
@@ -552,6 +553,8 @@ const CONFUSABLE_TO_ASCII = new Map([
   ["K", "K"], // U+212A KELVIN SIGN
 ]);
 
+const CONFUSABLE_REGEX = new RegExp([...CONFUSABLE_TO_ASCII.keys()].join("|"), "g");
+
 /**
  * Reduces the confusable spellings a credential can hide behind to plain
  * ASCII before the secret patterns run (`SEC-04`).
@@ -577,9 +580,7 @@ function normalizeSecretText(str) {
     out = out.normalize("NFKD");
   } catch (_) {}
   out = out.replace(/[\u0300-\u036f]/g, "");
-  for (const [from, to] of CONFUSABLE_TO_ASCII) {
-    out = out.split(from).join(to);
-  }
+  out = out.replace(CONFUSABLE_REGEX, (m) => CONFUSABLE_TO_ASCII.get(m));
   return out;
 }
 

package/src/stack-detector.mjs

@@ -221,7 +221,10 @@ test("every source file parses", () => {
 }
 
 export function detectEdgeRuntime(projectRoot = process.cwd()) {
-  const isCloudflare = existsSync(join(projectRoot, "wrangler.toml")) || existsSync(join(projectRoot, "wrangler.json"));
+  const isCloudflare =
+    existsSync(join(projectRoot, "wrangler.toml")) ||
+    existsSync(join(projectRoot, "wrangler.json")) ||
+    existsSync(join(projectRoot, "wrangler.jsonc"));
   const isDeno = existsSync(join(projectRoot, "deno.json")) || existsSync(join(projectRoot, "deno.jsonc"));
   const isNetlify = existsSync(join(projectRoot, "netlify.toml"));
 
@@ -441,7 +444,7 @@ export function detectPolyglotStack(projectRoot = process.cwd()) {
 
   // 5. Python / Django / Elixir / Ruby / Java
   if (existsSync(join(projectRoot, "manage.py"))) {
-    return { ...container, stack: "django", testCmd: "python manage.py test --keepdb", buildCmd: "python manage.py check", triggerFile: "manage.py" };
+    return { ...container, stack: "django", testCmd: `${pythonBin()} manage.py test --keepdb`, buildCmd: `${pythonBin()} manage.py check`, triggerFile: "manage.py" };
   }
   if (existsSync(join(projectRoot, "pyproject.toml")) || existsSync(join(projectRoot, "requirements.txt")) || existsSync(join(projectRoot, "setup.py"))) {
     const triggerFile = existsSync(join(projectRoot, "pyproject.toml")) ? "pyproject.toml" : existsSync(join(projectRoot, "requirements.txt")) ? "requirements.txt" : "setup.py";

package/src/task-optimizer.mjs

@@ -4,6 +4,7 @@ import { checkScope } from "./security.mjs";
 import { detectStackOracles } from "./wizard-oracle.mjs";
 import { loadConfig } from "./config.mjs";
 import { sanitizePromptVocabulary } from "./prompt-guard.mjs";
+import { buildGuardrailFooter } from "./wizard-task.mjs";
 
 /**
  * Calculates Levenshtein distance between two strings.
@@ -350,7 +351,7 @@ export function optimizeTaskPrompt(promptText, options = {}) {
   const isWeb = Boolean(options.web || (analysis.webIntent && analysis.webIntent.isWeb));
   const includeExplorationBudget = options.explorationBudget !== false;
   const includeCriticGuidance = options.criticGuidance !== false;
-  const verifyCmd = analysis.oracle.command || options.verifyCmd || "npm test";
+  const verifyCmd = analysis.oracle.command || options.verifyCmd || null;
 
   // Construct structured Markdown envelope
   const lines = [];
@@ -359,16 +360,24 @@ export function optimizeTaskPrompt(promptText, options = {}) {
 
   if (includeExplorationBudget) {
     lines.push("## Google Labs Exploration Budget Protocol (3-Phase Discovery)");
-    lines.push("To maximize diagnostic accuracy (Hit@5 57%), execute this task in 3 distinct phases:");
+    lines.push("Use deep planning mode. To maximize diagnostic accuracy (Hit@5 57%), execute this task in 3 distinct phases:");
     lines.push("1. **PHASE 1: DISCOVERY & SYMBOL TRACING (Stay Silent, Write NO Code)**");
     lines.push("   - Read target source files, definitions, and dependent call sites.");
     lines.push("   - Formulate diagnostic hypothesis and verify exact symbol signatures before making edits.");
     lines.push("2. **PHASE 2: ORACLE FORMULATION**");
-    lines.push(`   - Execute baseline verification: \`${verifyCmd}\`.`);
+    if (verifyCmd) {
+      lines.push(`   - Execute baseline verification: \`${verifyCmd}\`.`);
+    } else {
+      lines.push("   - Execute baseline verification: (None specified - define verification command).");
+    }
     lines.push("   - Identify specific test assertions, benchmarks, or status codes to satisfy.");
     lines.push("3. **PHASE 3: SURGICAL IMPLEMENTATION & VERIFICATION**");
     lines.push("   - Apply minimal, zero-bloat code modifications.");
-    lines.push(`   - Execute \`${verifyCmd}\` and verify 100% clean exit code 0.`);
+    if (verifyCmd) {
+      lines.push(`   - Execute \`${verifyCmd}\` and verify 100% clean exit code 0.`);
+    } else {
+      lines.push("   - Execute automated verification suite and verify 100% clean exit code 0.");
+    }
     lines.push("");
   }
 
@@ -376,6 +385,8 @@ export function optimizeTaskPrompt(promptText, options = {}) {
   lines.push(`- **Goal**: ${promptBody}`);
   if (analysis.oracle.command) {
     lines.push(`- **Verification Command**: \`${analysis.oracle.command}\` (Must pass cleanly with exit code 0)`);
+  } else {
+    lines.push("- **Verification Command**: (None) - WARNING: Missing test oracle.");
   }
   lines.push("- **Falsifiability Criteria**: Zero deleted tests, zero weakened assertions, zero lint errors.");
   lines.push("");
@@ -401,10 +412,26 @@ export function optimizeTaskPrompt(promptText, options = {}) {
     lines.push("");
   }
 
+  const root = options.rootDir || process.cwd();
+  let cfg = options.config;
+  if (!cfg) {
+    try {
+      cfg = loadConfig(root);
+    } catch (_) {
+      cfg = {};
+    }
+  }
+
   lines.push("## Standard Guardrails");
-  lines.push("- Do NOT modify package.json, lockfiles, or .github/ infrastructure files.");
-  lines.push("- Diff Payload Governor: Keep total diff payload under 75 KB (\`git diff | wc -c\`).");
-  lines.push(`- Verify before finishing: Execute \`${verifyCmd}\` and confirm zero errors.`);
+  const rawFooter = buildGuardrailFooter(cfg, {
+    baseBranch: options.baseBranch,
+    diffKb: options.diffKb,
+  }).trim();
+  const cleanedFooter = rawFooter.replace(/^---\s*\n?HARD CONSTRAINTS:\s*\n?/, "").trim();
+  lines.push(cleanedFooter);
+  if (verifyCmd) {
+    lines.push(`- Verify before finishing: Execute \`${verifyCmd}\` and confirm zero errors.`);
+  }
 
   const optimizedPrompt = lines.join("\n");
 

package/src/web-templates.mjs

@@ -920,7 +920,7 @@ export function synthesizeWebEnvelope(templateId, userParams = {}, options = {})
 
   if (explorationBudget) {
     lines.push("## Google Labs Exploration Budget Protocol (3-Phase Discovery)");
-    lines.push("To maximize diagnostic accuracy (Hit@5 57%), execute this task in 3 distinct phases:");
+    lines.push("Use deep planning mode. To maximize diagnostic accuracy (Hit@5 57%), execute this task in 3 distinct phases:");
     lines.push("1. **PHASE 1: DISCOVERY & SYMBOL TRACING (Stay Silent, Write NO Code)**");
     lines.push("   - Read target component files, CSS definitions, imports, and existing test specs.");
     lines.push("   - Formulate diagnostic hypothesis and verify symbol signatures before planning edits.");

package/src/wizard-oracle.mjs

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { detectStack, parseYaml } from "./config.mjs";
 import { runCmd } from "./git.mjs";
+import { pytestCmd } from "./stack-detector.mjs";
 
 /**
  * Check if a command-line binary is available on the system PATH.
@@ -92,7 +93,7 @@ export function detectStackOracles(root = process.cwd()) {
   }
 
   // Check Go module
-  if (stack.includes("go") || existsSync(join(root, "go.mod"))) {
+  if (stack === "go" || existsSync(join(root, "go.mod"))) {
     candidates.testCmd = candidates.testCmd || "go test ./...";
     candidates.buildCmd = candidates.buildCmd || "go build ./...";
     if (hasBinary("golangci-lint")) {
@@ -102,8 +103,8 @@ export function detectStackOracles(root = process.cwd()) {
   }
 
   // Check Python
-  if (stack.includes("pytest") || existsSync(join(root, "pyproject.toml")) || existsSync(join(root, "requirements.txt"))) {
-    candidates.testCmd = candidates.testCmd || "pytest";
+  if (stack === "python" || stack === "django" || existsSync(join(root, "pyproject.toml")) || existsSync(join(root, "requirements.txt"))) {
+    candidates.testCmd = candidates.testCmd || pytestCmd(process.env, root);
     candidates.buildCmd = candidates.buildCmd || "";
     if (hasBinary("flake8")) {
       candidates.lintCmd = candidates.lintCmd || "flake8 .";