opencode-agent-skill 14.2.0-beta.1 → 14.4.0

package/pi/extensions/ues-child-runtime.ts

@@ -10,6 +10,15 @@ import {
   canonicalVerificationCommand,
   looksLikeVerificationCommand,
 } from "../../lib/verification-command.mjs";
+import {
+  applyAnchoredFileEdits,
+  diagnoseCode,
+  probeCodeIntelligence,
+  readAnchoredCode,
+  searchCodeIntelligence,
+} from "../../lib/code-intelligence/index.mjs";
+import { ingestDocument } from "../../lib/document-ingestion.mjs";
+import { compactContext, expandContext, searchContext } from "../../lib/reversible-context.mjs";
 
 const toolExecutionState = new Map<string, {
   startedAt: number;
@@ -190,6 +199,152 @@ export default function (pi: ExtensionAPI) {
     };
   });
 
+  const AnchoredEdit = Type.Object({
+    anchor: Type.String({ minLength: 1 }),
+    endAnchor: Type.Optional(Type.String({ minLength: 1 })),
+    replacement: Type.String(),
+  });
+
+  pi.registerTool({
+    name: "ues_code",
+    label: "UES Code Intelligence",
+    description:
+      "Bounded code/document/context intelligence for weak models: semantic/AST search, hash-anchored reads, optional LSP diagnostics, optional MarkItDown ingestion, and reversible context recovery.",
+    parameters: Type.Object({
+      action: Type.Union([
+        Type.Literal("status"),
+        Type.Literal("search"),
+        Type.Literal("read"),
+        Type.Literal("diagnostics"),
+        Type.Literal("document"),
+        Type.Literal("context-expand"),
+        Type.Literal("context-search"),
+      ]),
+      file: Type.Optional(Type.String()),
+      query: Type.Optional(Type.String()),
+      structuralPattern: Type.Optional(Type.String()),
+      language: Type.Optional(Type.String()),
+      startLine: Type.Optional(Type.Number({ minimum: 1 })),
+      endLine: Type.Optional(Type.Number({ minimum: 1 })),
+      ref: Type.Optional(Type.String()),
+      maxBytes: Type.Optional(Type.Number({ minimum: 1, maximum: 128000 })),
+    }),
+    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+      try {
+        let result: any;
+        if (params.action === "status") {
+          result = probeCodeIntelligence(params.file || "");
+        } else if (params.action === "search") {
+          if (!params.query) throw new Error("ues_code search requires query");
+          result = await searchCodeIntelligence(ctx.cwd, params.query, {
+            structuralPattern: params.structuralPattern,
+            language: params.language,
+            file: params.file,
+            maxResults: 12,
+          });
+        } else if (params.action === "read") {
+          if (!params.file) throw new Error("ues_code read requires file");
+          const startLine = Math.max(1, Math.trunc(Number(params.startLine || 1)));
+          const endLine = Math.max(startLine, Math.min(startLine + 399, Math.trunc(Number(params.endLine || startLine + 199))));
+          result = await readAnchoredCode(ctx.cwd, params.file, { startLine, endLine });
+          return {
+            content: [{ type: "text", text: [
+              `file: ${result.file}; lines: ${result.startLine}-${result.endLine}/${result.lineCount}; sourceHash: ${result.sourceHash}`,
+              "",
+              result.text,
+            ].join("\n") }],
+            details: { action: params.action, file: result.file, sourceHash: result.sourceHash, startLine: result.startLine, endLine: result.endLine },
+          };
+        } else if (params.action === "diagnostics") {
+          if (!params.file) throw new Error("ues_code diagnostics requires file");
+          result = await diagnoseCode(ctx.cwd, params.file, { timeoutMs: 3000, maxDiagnostics: 40 });
+        } else if (params.action === "document") {
+          if (!params.file) throw new Error("ues_code document requires file");
+          const document = await ingestDocument(ctx.cwd, params.file, { maxBytes: Math.min(Number(params.maxBytes || 4 * 1024 * 1024), 4 * 1024 * 1024) });
+          const block = await compactContext(ctx.cwd, document.markdown, {
+            kind: "document-ingestion",
+            source: document.file,
+            summary: `Normalized document from ${document.provider}`,
+          });
+          result = {
+            provider: document.provider,
+            file: document.file,
+            bytes: document.bytes,
+            optionalDependency: document.optionalDependency,
+            contextRef: block.ref,
+            originalChars: block.originalChars,
+            summary: block.levels.T1,
+          };
+        } else if (params.action === "context-expand") {
+          if (!params.ref) throw new Error("ues_code context-expand requires ref");
+          const expanded = await expandContext(ctx.cwd, params.ref, { maxBytes: params.maxBytes || 16000 });
+          return {
+            content: [{ type: "text", text: expanded.content }],
+            details: { action: params.action, ref: expanded.ref, start: expanded.start, returnedBytes: expanded.returnedBytes, truncated: expanded.truncated },
+          };
+        } else if (params.action === "context-search") {
+          if (!params.ref || !params.query) throw new Error("ues_code context-search requires ref and query");
+          result = await searchContext(ctx.cwd, params.ref, params.query, { maxBytes: params.maxBytes || 512000, maxMatches: 12 });
+        } else {
+          throw new Error("unsupported ues_code action");
+        }
+        const encoded = JSON.stringify(result, null, 2);
+        return {
+          content: [{ type: "text", text: encoded.length <= 32000 ? encoded : encoded.slice(0, 32000) + "\n...[bounded by ues_code]" }],
+          details: { action: params.action, bounded: encoded.length > 32000 },
+        };
+      } catch (error) {
+        return {
+          content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }],
+          details: { action: params.action },
+          isError: true,
+        };
+      }
+    },
+  });
+
+  pi.registerTool({
+    name: "ues_code_edit",
+    label: "UES Anchored Edit",
+    description:
+      "Apply fail-closed hash-anchored edits. A stale or mismatched anchor is rejected; re-read with ues_code instead of fuzzy retrying.",
+    parameters: Type.Object({
+      file: Type.String({ minLength: 1 }),
+      edits: Type.Array(AnchoredEdit, { minItems: 1, maxItems: 50 }),
+      dryRun: Type.Optional(Type.Boolean()),
+      diagnostics: Type.Optional(Type.Boolean()),
+    }),
+    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+      try {
+        const edited = await applyAnchoredFileEdits(ctx.cwd, params.file, params.edits, { dryRun: params.dryRun === true });
+        const diagnostics = params.diagnostics === true && params.dryRun !== true
+          ? await diagnoseCode(ctx.cwd, params.file, { timeoutMs: 3000, maxDiagnostics: 40 }).catch(() => null)
+          : null;
+        const result = {
+          file: edited.file,
+          applied: edited.applied,
+          dryRun: edited.dryRun,
+          sourceHash: edited.sourceHash,
+          outputHash: edited.outputHash,
+          diagnostics: diagnostics ? {
+            available: diagnostics.available,
+            provider: diagnostics.provider,
+            reason: diagnostics.reason,
+            count: diagnostics.diagnostics?.length || 0,
+            items: (diagnostics.diagnostics || []).slice(0, 40),
+          } : null,
+        };
+        return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }], details: result };
+      } catch (error) {
+        return {
+          content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }],
+          details: { file: params.file },
+          isError: true,
+        };
+      }
+    },
+  });
+
   pi.registerTool({
     name: "ues_evidence_get",
     label: "UES Evidence Get",

package/pi/extensions/ues.ts

@@ -28,6 +28,10 @@ import { adaptiveContextBudget } from "../../lib/adaptive-context-budget.mjs";
 import { clearSkillCompilerCache, compileSkillContext } from "../../lib/skill-compiler.mjs";
 import { clearAffectedTestCache, resolveAffectedTests } from "../../lib/affected-tests.mjs";
 import { findReusableVerification, listReusableVerification, recordVerification } from "../../lib/verification-broker.mjs";
+import { evaluateFastVerificationGate } from "../../lib/fast-verification-gate.mjs";
+import { auditCompletion } from "../../lib/completion-auditor.mjs";
+import { mcpExecutionPolicy } from "../../lib/mcp-tool-policy.mjs";
+import { McpHealthTracker } from "../../lib/mcp-health.mjs";
 import { runtimeWorkspaceFingerprint, runtimeWorkspaceSnapshot } from "../../lib/workspace-fingerprint.mjs";
 import { appendTrajectoryEvent, createTraceID } from "../../lib/trajectory.mjs";
 import {
@@ -135,6 +139,10 @@ const ACTIVE_CLI_CHILDREN = new Map<number, {
   proc: any;
   abort: () => boolean;
 }>();
+const MCP_HEALTH = new McpHealthTracker({
+  failureThreshold: 2,
+  cooldownMs: configuredDuration("UES_MCP_HEALTH_COOLDOWN_MS", 15_000, 1_000, 5 * 60_000),
+});
 
 function abortActiveCliChildren() {
   let aborted = 0;
@@ -165,7 +173,8 @@ function refreshHostBrowserToolNames(pi: ExtensionAPI) {
     typeof (pi as any).getAllTools === "function"
       ? (pi as any).getAllTools()
       : [];
-  HOST_BROWSER_TOOL_NAMES = selectBrowserMcpToolNames(tools, {
+  const healthyTools = tools.filter((tool: any) => MCP_HEALTH.available(String(tool?.name || "")));
+  HOST_BROWSER_TOOL_NAMES = selectBrowserMcpToolNames(healthyTools.length ? healthyTools : tools, {
     explicitNames: configuredBrowserToolNames(),
     limit: BROWSER_MCP_TOOL_LIMIT,
   });
@@ -247,6 +256,8 @@ function getAgentPrompt(agent: AgentName) {
     `- If \`ues_cli\` is unavailable, invoke the bundled CLI as \`${fallbackCli} ...\`; do not assume a global \`ocskill\` binary exists.`,
     "- Do not call OpenCode-only dispatch tools such as \`ues.dispatch_task\` or \`ues.dispatch_parallel\`.",
     "- Respect the original role's edit/read-only boundary and return evidence to the parent Pi session.",
+    "- Prefer ues_code for bounded semantic/AST search, hash-anchored reads and optional LSP diagnostics. Writer roles may use ues_code_edit only after an anchored read; stale anchors must be re-read rather than fuzzily retried.",
+    "- For PDF/DOCX/PPTX/XLSX evidence, ues_code action=document may use optional MarkItDown when installed; do not install it unless that capability is needed.",
     "",
   ].join("\n");
   const verdictContract =
@@ -542,8 +553,12 @@ async function runAgentCli(
   ];
   if (model) args.push("--model", model);
   if (thinkingLevel) args.push("--thinking", thinkingLevel);
+  const codeIntelligenceTools = WRITE_AGENTS.has(agent)
+    ? ["ues_code", "ues_code_edit"]
+    : ["ues_code"];
   const allowedTools = [...new Set([
     ...config.tools,
+    ...codeIntelligenceTools,
     ...extraTools,
     ...(runtimeOptions.compactToolOutput ? ["ues_evidence_get"] : []),
   ])];
@@ -1296,6 +1311,13 @@ async function runRoutedAgent(
     ? selectBrowserToolsForTask(HOST_BROWSER_TOOL_NAMES, task, role)
     : [];
   const taskPolicy = classifyEngineeringTask(task);
+  const fastBoundedContext =
+    attempt === 1 &&
+    taskPolicy.executionProfile === "fast" &&
+    taskPolicy.singleFileBounded === true &&
+    taskPolicy.risk === "low" &&
+    ["executor", "verifier"].includes(role) &&
+    !browserRequested;
   const budgetDecision = adaptiveContextBudget(taskPolicy, role, attempt, {
     disabled: !ADAPTIVE_CONTEXT_ENABLED,
   });
@@ -1363,6 +1385,18 @@ async function runRoutedAgent(
   let reusableVerification: any = null;
   let contextCacheHit = false;
   try {
+    if (fastBoundedContext) {
+      contextQuality = { schemaVersion: 1, profile: "fast-bounded", bounded: true };
+      enrichedTask = [
+        task,
+        "",
+        "## UES FAST bounded lane",
+        "This is a low-risk single-file task. Read the named target file first and avoid broad repository scans unless direct evidence shows the task is wider than declared.",
+        role === "executor"
+          ? "Implement every explicit acceptance branch, then run the narrowest behavioral check available. When the repository has no suitable JS/TS test, prefer a temporary .ues-cache/fast-acceptance.test.mjs probe and run `node --test .ues-cache/fast-acceptance.test.mjs`; cover every enumerated edge/error/idempotency/non-mutation requirement and remove only the temporary probe afterwards."
+          : "Verify every explicit acceptance clause independently. Read the final diff/target file, then run a narrow behavioral check. Compilation or syntax alone is not proof. If any enumerated edge/error/idempotency/non-mutation case lacks fresh executable evidence, return FAIL.",
+      ].join("\n");
+    } else {
     const cacheKey = cachedContextKey(
       cwd,
       task,
@@ -1466,6 +1500,7 @@ async function runRoutedAgent(
           ].filter(Boolean).join("\n")).join("\n")
         : "",
     ].filter(Boolean).join("\n");
+    }
   } catch (error) {
     contextError = error instanceof Error ? error.message : String(error);
     if (recentFailure) {
@@ -2350,6 +2385,7 @@ export default function (pi: ExtensionAPI) {
     clearAffectedTestCache();
     clearRepoGraphRuntimeCache();
     clearSemanticIndexRuntimeCache();
+    MCP_HEALTH.clear();
     abortActiveCliChildren();
     await RPC_POOL.stopAll().catch(() => {});
   });
@@ -2399,16 +2435,40 @@ export default function (pi: ExtensionAPI) {
   });
 
   pi.on("tool_call", async (event, ctx) => {
-    if (event.toolName !== "bash" && event.toolName !== "powershell") return undefined;
+    const toolName = String(event.toolName || "");
+    if (toolName !== "bash" && toolName !== "powershell") {
+      const allTools = typeof (pi as any).getAllTools === "function" ? (pi as any).getAllTools() : [];
+      const descriptor = allTools.find((tool: any) => String(tool?.name || "") === toolName);
+      const policy = mcpExecutionPolicy(descriptor || { name: toolName });
+      if (policy.confirmationRequired) {
+        const allowed = await approveRisk(ctx, `MCP/tool call: ${toolName}`, `mcp-destructive:${toolName}`);
+        if (!allowed) return { block: true, reason: `Blocked by UES MCP destructive-hint gate: ${toolName}` };
+      }
+      MCP_HEALTH.begin(String((event as any).toolCallId || ""), toolName, policy);
+      return undefined;
+    }
+
     const command = String((event.input as any)?.command || "");
     const risk = destructiveShellRisk(command);
     if (!risk.risky) return undefined;
-
     const allowed = await approveRisk(ctx, command, risk.id || "destructive");
     if (!allowed) return { block: true, reason: `Blocked by UES safety gate: ${risk.id}` };
     return undefined;
   });
 
+  pi.on("tool_result", async (event) => {
+    const toolName = String((event as any).toolName || "");
+    if (!toolName || toolName === "bash" || toolName === "powershell") return undefined;
+    MCP_HEALTH.finish(
+      String((event as any).toolCallId || ""),
+      {
+        isError: (event as any).isError === true,
+        text: toolResultText(event),
+      },
+    );
+    return undefined;
+  });
+
   pi.registerTool({
     name: "ues_cli",
     label: "UES CLI",
@@ -2919,9 +2979,19 @@ export default function (pi: ExtensionAPI) {
           recentFailure = diagnosis.output;
         }
 
+        const fastBoundedLane =
+          policy.executionProfile === "fast" &&
+          policy.singleFileBounded === true &&
+          policy.risk === "low" &&
+          !visualEvidenceNeeded(params.task) &&
+          !browserEvidenceNeeded(params.task, "executor");
+        const fastAttemptStartedAt = Date.now();
         const executorTask = [
           params.task,
           recentFailure ? "\nEvidence from diagnosis/previous failed verification:\n" + cap(recentFailure, 7000) : "",
+          fastBoundedLane
+            ? "\nFAST bounded rule: stay on the named file, implement every explicit branch, and produce fresh behavioral evidence before handoff. Prefer one focused project-native test command. If no JS/TS test exists, use a temporary .ues-cache/fast-acceptance.test.mjs and run node --test .ues-cache/fast-acceptance.test.mjs so the controller can independently reuse the successful tool-boundary receipt. Cover every enumerated error, boundary, idempotency and non-mutation case; syntax/build alone is insufficient."
+            : "",
           "\nImplement the smallest coherent change. Do not push, publish, deploy, rewrite history, or broaden scope without evidence.",
         ].filter(Boolean).join("\n");
 
@@ -2938,23 +3008,43 @@ export default function (pi: ExtensionAPI) {
           continue;
         }
 
-        const verification = await run(
-          "ues-verifier",
-          [
-            "Independently verify the current working tree against this task:",
-            params.task,
-            "",
-            "Implementation handoff (not proof by itself):",
-            implementation.output,
-          ].join("\n"),
-          attempt,
-          recentFailure || undefined,
-        );
-        if (isAbortedRun(verification)) return abortedResponse(verification, "verification");
+        let verification: RunResult;
+        let fastGate: any = null;
+        if (fastBoundedLane) {
+          const snapshot = runtimeWorkspaceSnapshot(cwd);
+          const receipts = await listReusableVerification(cwd, {
+            limit: 12,
+            maxAgeMs: 10 * 60_000,
+            previewBytes: 2200,
+            ...(snapshot.cacheable === true && snapshot.fingerprint ? { workspaceFingerprint: snapshot.fingerprint } : {}),
+          }).catch(() => ({ results: [] }));
+          fastGate = evaluateFastVerificationGate({ policy, implementation, receipts: receipts?.results || [], attemptStartedAtMs: fastAttemptStartedAt, visualRequired: false });
+        }
+        if (fastGate?.passed === true) {
+          verification = {
+            agent: "ues-deterministic-verifier", task: params.task, cwd, exitCode: 0,
+            output: ["FAST bounded verification reused fresh behavioral evidence captured at the tool boundary.", ...fastGate.behavioralReceipts.map((item: any) => "- " + item.command), "", "UES_VERDICT: PASS"].join("\n"),
+            stderr: "", verdict: "PASS", durationMs: 0, toolCalls: 0, toolNames: [],
+            report: { schemaVersion: 1, valid: true, verdict: "PASS", sections: { "checks-run": fastGate.behavioralReceipts.map((item: any) => item.command).join("\n"), "acceptance-criteria-proven": "Fresh behavioral verification receipt(s) exist at the post-implementation workspace fingerprint.", "completion-evidence": "Deterministic PASS receipt captured after this implementation attempt." } },
+            optimizations: { fastDeterministicVerification: true, behavioralReceiptCount: fastGate.behavioralReceipts.length },
+          };
+          steps.push(verification);
+          onUpdate?.({ content: [{ type: "text", text: "UES FAST verifier: reused " + fastGate.behavioralReceipts.length + " fresh behavioral receipt(s); skipped an extra verifier model turn" }], details: { mode: "execute", policy, fastGate, traceID } });
+        } else {
+          verification = await run(
+            "ues-verifier",
+            [
+              fastBoundedLane ? "FAST bounded verification: independently verify the final target file and every explicit acceptance branch. Run one narrow behavioral check; compilation/syntax alone is insufficient. Return FAIL if any enumerated edge/error/idempotency/non-mutation case lacks fresh executable evidence." : "Independently verify the current working tree against this task:",
+              params.task, "", "Implementation handoff (not proof by itself):", implementation.output,
+              fastGate?.reason ? "\nFAST receipt gate did not short-circuit because: " + fastGate.reason : "",
+            ].join("\n"), attempt, recentFailure || undefined,
+          );
+          if (isAbortedRun(verification)) return abortedResponse(verification, "verification");
+        }
         const verified = verification.exitCode === 0 && verification.verdict === "PASS";
-        await recordRuntimeOutcome(implementation, params.task, verified, attempt - 1);
         if (!verified) {
           recentFailure = verification.output;
+          await recordRuntimeOutcome(implementation, params.task, false, attempt - 1);
           continue;
         }
 
@@ -2973,6 +3063,7 @@ export default function (pi: ExtensionAPI) {
           if (isAbortedRun(integrationResult)) return abortedResponse(integrationResult, "integration-verification");
           if (integrationResult.exitCode !== 0 || integrationResult.verdict !== "PASS") {
             recentFailure = integrationResult.output;
+            await recordRuntimeOutcome(implementation, params.task, false, attempt - 1);
             if (attempt < maxAttempts) continue;
             return {
               content: [{ type: "text", text: `Integration verification did not pass:\n\n${integrationResult.output}` }],
@@ -3000,6 +3091,7 @@ export default function (pi: ExtensionAPI) {
           if (isAbortedRun(visualResult)) return abortedResponse(visualResult, "visual-verification");
           if (visualResult.exitCode !== 0 || visualResult.verdict !== "PASS") {
             recentFailure = visualResult.output;
+            await recordRuntimeOutcome(implementation, params.task, false, attempt - 1);
             if (attempt < maxAttempts) continue;
             return {
               content: [{
@@ -3012,6 +3104,41 @@ export default function (pi: ExtensionAPI) {
           }
         }
 
+        const completionSnapshot = runtimeWorkspaceSnapshot(cwd);
+        const completionReceipts = await listReusableVerification(cwd, {
+          limit: 24,
+          maxAgeMs: 10 * 60_000,
+          previewBytes: 1200,
+          ...(completionSnapshot.cacheable === true && completionSnapshot.fingerprint
+            ? { workspaceFingerprint: completionSnapshot.fingerprint }
+            : {}),
+        }).catch(() => ({ results: [] }));
+        const freshReceipts = (completionReceipts?.results || []).filter((row: any) => {
+          const finished = Date.parse(row?.finishedAt || row?.receipt?.finishedAt || "");
+          return Number.isFinite(finished) && finished >= fastAttemptStartedAt;
+        });
+        const completionAudit = auditCompletion({
+          verification,
+          integration: integrationResult,
+          visual: visualResult,
+          requireIntegration: policy.requireIntegrationVerification === true,
+          requireVisual: visualEvidenceNeeded(params.task),
+          workspaceSnapshot: completionSnapshot,
+          behavioralReceipts: freshReceipts,
+          requireBehavioralReceipt: true,
+        });
+        if (!completionAudit.passed) {
+          recentFailure = "Completion auditor rejected PASS: " + completionAudit.failures.join(", ");
+          await recordRuntimeOutcome(implementation, params.task, false, attempt - 1);
+          if (attempt < maxAttempts) continue;
+          return {
+            content: [{ type: "text", text: recentFailure }],
+            details: { mode: "execute", policy, steps, attempts: attempt, completionAudit, traceID },
+            isError: true,
+          };
+        }
+
+        await recordRuntimeOutcome(implementation, params.task, true, attempt - 1);
         const memory = await rememberVerifiedTask(cwd, params.task, verification, integrationResult);
         const final = steps.at(-1);
         return {
@@ -3024,7 +3151,7 @@ export default function (pi: ExtensionAPI) {
               final?.output || verification.output,
             ].join("\n"),
           }],
-          details: { mode: "execute", policy, steps, attempts: attempt, memory, traceID },
+          details: { mode: "execute", policy, steps, attempts: attempt, memory, completionAudit, traceID },
         };
       }
 

package/scripts/check-source-integrity.mjs

@@ -16,6 +16,9 @@ const CONTRACTS = [
       'name: "ues_dispatch"',
       "runRoutedAgent",
       "PiRpcWorkerPool",
+      "McpHealthTracker",
+      "MCP_HEALTH",
+      "auditCompletion",
       "CHILD_RUNTIME_EXTENSION",
       "isAbortedRun",
       "abortedResponse",
@@ -30,6 +33,10 @@ const CONTRACTS = [
       'pi.on("tool_call"',
       'pi.on("tool_result"',
       'name: "ues_evidence_get"',
+      'name: "ues_code"',
+      'name: "ues_code_edit"',
+      "applyAnchoredFileEdits",
+      "diagnoseCode",
       "recordVerification",
       "canonicalVerificationCommand",
       "destructiveShellRisk",
@@ -141,6 +148,61 @@ const CONTRACTS = [
     ],
   },
 
+  {
+    file: "lib/code-intelligence/edit-anchor.mjs",
+    minBytes: 2_500,
+    startsWith: "import ",
+    required: ["anchoredLines", "applyAnchoredEdits", "UES_STALE_ANCHOR"],
+  },
+  {
+    file: "lib/code-intelligence/index.mjs",
+    minBytes: 4_000,
+    startsWith: "import ",
+    required: ["readAnchoredCode", "applyAnchoredFileEdits", "searchCodeIntelligence", "diagnoseCode"],
+  },
+  {
+    file: "lib/code-intelligence/lsp-provider.mjs",
+    minBytes: 5_000,
+    startsWith: "import ",
+    required: ["diagnoseCode", "lspProviderStatus", "publishDiagnostics"],
+  },
+  {
+    file: "lib/completion-auditor.mjs",
+    minBytes: 2_500,
+    startsWith: "function text",
+    required: ["auditCompletion", "fresh-behavioral-receipt-missing", "missing-report-section"],
+  },
+  {
+    file: "lib/document-ingestion.mjs",
+    minBytes: 3_000,
+    startsWith: "import ",
+    required: ["ingestDocument", "documentIngestionSupport", "UES_MARKITDOWN_UNAVAILABLE"],
+  },
+  {
+    file: "lib/reversible-context.mjs",
+    minBytes: 2_500,
+    startsWith: "import ",
+    required: ["compactContext", "expandContext", "searchContext"],
+  },
+  {
+    file: "lib/mcp-tool-policy.mjs",
+    minBytes: 1_000,
+    startsWith: "function firstObject",
+    required: ["normalizeMcpAnnotations", "mcpExecutionPolicy", 'trust: "hint-only"'],
+  },
+  {
+    file: "lib/mcp-health.mjs",
+    minBytes: 4_000,
+    startsWith: "const TRANSIENT_ERROR",
+    required: ["McpHealthTracker", "mcpReconnectAdvice", "transient-idempotent-failure", "cooldownUntil"],
+  },
+  {
+    file: "test/v14.3-intelligence.test.mjs",
+    minBytes: 5_000,
+    startsWith: 'import test from "node:test"',
+    required: ["hash anchored edits fail closed", "completion auditor rejects narrative PASS", "verified memory snapshots ignore retrieval/touch noise", "MCP health only recommends reconnect"],
+  },
+
   {
     file: "lib/affected-tests.mjs",
     minBytes: 7_500,