pi-aia-asf 0.17.4 → 0.17.6

package/CHANGELOG.md

@@ -7,13 +7,96 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.17.4] - 2026-11-07
+## [0.17.6] - 2026-11-09
 
-### Added
+### Fixed — a gate that crashes is not a gate that passed
+
+Both tool handlers were fenced with `catch { return undefined }`, which had two consequences of
+exactly the kind ASF bans:
+
+- A failure inside the **suite recorder** lost the run silently, after which the publish and
+  completion floors demanded a run that could never register — an unclosable gap with no visible
+  cause.
+- Because pi's own semantics for a crashing `tool_call` handler are *block*, returning "allow"
+  overrode them: anything that made the earlier code throw — a config read, the activation
+  observer — disabled the **irreversibility floor** for that call.
+
+Now:
+
+- `reportGateError(gate, e)` records a `gate-error` ledger entry and tells the agent once, as a
+  steer: *"That is not a pass — the check failed to execute."* Guidance, never a stop.
+- When the gate dies **before** the blockers ran, `failSafeBlock(input)` re-runs just the rules
+  whose `failSafe` is `block`, from the raw tool input alone, with no context to fail on. A secret
+  in a tracked file is still refused when the gate itself is broken; ordinary work is never
+  stopped by an internal error.
+- A fail-safe rule that *itself* throws refuses ("could not run") rather than reporting nothing
+  found.
 
-- (describe changes for 0.17.4)
+Three assertions pin this, each mutation-tested: removing the report, the fail-closed call, or the
+crash-refusal each fails a test.
 
-## [0.18.0] - 2026-11-07
+- `lib/gates/blockers.d.mts` still declared `RULE_TEXT`, `refusalStage` and `__resetRefusals` after
+  they moved to `lib/gates/refusals.mjs` in 0.17.5 — a `.ts` could import them, typecheck, and get
+  `undefined` at runtime. The declarations now match the modules.
+
+### Removed
+
+- Dead export `SOURCE_EXTENSIONS` from `lib/activation.mjs` (no importer).
+
+### Documented
+
+- **The loaded copy is not the shipped copy** (07-release.md step 7 + hygiene rule): `pi` loads
+  extensions once at process start, so a session open across a release keeps enforcing the previous
+  version and quoting text that no longer exists in the source. Confirm which build is loaded — a
+  string unique to the new release, and the process start time — before concluding a released gate
+  is broken. That is the difference between "the fix did not work" and "the fix is not running", and
+  it cost hours chasing a phantom bug in 0.17.5.
+- `06i-completeness.md` pointed its drift example at `lib/gates/ledger.mjs` / `deriveSuiteRun()`;
+  those moved to `lib/gates/suite-runs.mjs` in 0.17.5, and the doc — which is about not trusting
+  stale references — was itself stale.
+
+## [0.17.5] - 2026-11-08
+
+### Fixed — the publish floor could be satisfied by a green that proved nothing
+
+`push-without-recorded-green` asked for "a recorded full-suite green run in this
+session" and accepted **any** green: a run from before the last edit, or a green
+from earlier in the session that a red had since overtaken. It also disagreed
+with the completion floor, which already required a passing run *started after
+the last source change* — so the two ASF floors had different ideas about what
+"green" means, and the weaker one guarded the only irreversible action.
+
+The floor is now the same rule in both places: the **last** full run, green, and
+started after the last source mutation. Passive mode keeps it — "no steering"
+suspends guidance, not the irreversibility floor. The refusal now names which
+condition failed (`no full-suite run recorded` / `the last full suite run exited
+1` / `the last full-suite green predates the most recent source change`), so the
+autonomous exit is the specific action that closes it.
+
+New assertions drive the real `tool_call`/`tool_result` pair rather than a
+hand-built context, which is what pins the *recorder*: a floor whose demanded
+action does not actually close it is the 2026-11-07 bug class, and the previous
+tests could not see that path at all. Six mutations of the new guards (accept a
+red, accept a stale green, take the oldest full run, drop the mutation clock,
+never record the run, never set the clock) each fail at least one test.
+
+### Changed — two modules split to stay inside the limit ASF enforces
+
+`lib/gates/ledger.mjs` (327 lines) and `lib/gates/blockers.mjs` (301) crossed the
+300-line file limit, so the two halves that changed for different reasons were
+separated: `lib/gates/suite-runs.mjs` (suite-run recognition and the green-run
+rule) and `lib/gates/refusals.mjs` (the refusal ladder and its per-rule text).
+Both are imported explicitly — no re-export shim with two ways to reach one
+function.
+
+### Removed — `deriveHealthRun`
+
+It recognised a health run by matching `/asf health` in a command's text, which
+is the class of bug that produced the endless loop of 2026-11-07: a human slash
+command the agent has no tool for. The `asf_health` tool appends the `health-run`
+ledger entry directly, so nothing called it and nothing tested it.
+
+## [0.17.4] - 2026-11-07
 
 ### Changed — ASF now passes its own health gate, and the gate measures the right tree
 

package/lib/activation.mjs

@@ -177,5 +177,3 @@ export function activationDecision({ call, activeRun, passiveRunId = null } = {}
   return { activate: true };
 }
 
-/** Exported for the tests and for `/asf` diagnostics. */
-export const SOURCE_EXTENSIONS = SOURCE_EXT;

package/lib/extension/commands/session.ts

@@ -9,7 +9,7 @@ import type { AsfPhase, AsfScale, AsfState } from "../types.ts";
 import { projectName, runRoot } from "../paths.ts";
 import { loadState, saveState } from "../state.ts";
 import { newRunId } from "../run.ts";
-import { __resetRefusals } from "../../gates/blockers.mjs";
+import { __resetRefusals } from "../../gates/refusals.mjs";
 
 export interface PhaseChange {
   phase: AsfPhase;

package/lib/extension/evidence.ts

@@ -27,6 +27,30 @@ export function queueSteer(text: string) {
   pendingSteers.push(text);
 }
 
+/**
+ * An internal gate error must never be able to look like a pass.
+ *
+ * Every ASF handler is fenced, because an observer must not break the work it
+ * watches. Fencing *without* reporting is exactly how the 2026-11-07 loop became
+ * possible: a gate demanded something, the code that would have shown why
+ * swallowed its own error, and the agent was steered forever toward an action
+ * that could not register. So a swallowed error is (a) recorded as evidence and
+ * (b) told to the agent once, as a steer — guidance, never a stop.
+ *
+ * The settle gate has a stronger channel (it returns the entry inline, so the
+ * agent sees it in the same turn); the tool handlers do not, so they use this.
+ */
+export function reportGateError(gate: string, e: unknown) {
+  const message = String((e as Error | null)?.message || e || "unknown");
+  appendEvidence({ kind: "gate-error", gate, error: message.slice(0, 300) });
+  const cls = (e as { code?: string } | null)?.code || (e as Error | null)?.name || "unknown";
+  queueSteer(
+    `ASF: the ${gate} hit an internal error (${cls}: ${message.slice(0, 140)}) and did not run. ` +
+      `That is not a pass — the check failed to execute. Re-issue the action; if it repeats, ` +
+      `this is an ASF bug to report, not a rule to satisfy.`,
+  );
+}
+
 
 export function appendEvidence(entry: Record<string, unknown>) {
   const res = ledger.append(entry);

package/lib/extension/handlers/tool-call.ts

@@ -15,13 +15,13 @@
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { classifyToolCall, activationDecision } from "../../activation.mjs";
-import { evaluateBlockers, BLOCKERS } from "../../gates/blockers.mjs";
-import { deriveSuiteRun } from "../../gates/ledger.mjs";
+import { evaluateBlockers, BLOCKERS, failSafeBlock } from "../../gates/blockers.mjs";
+import { deriveSuiteRun } from "../../gates/suite-runs.mjs";
 import { readProjectConfig } from "../../gates/config.mjs";
 import { projectName, runRoot } from "../paths.ts";
 import { loadState, saveState } from "../state.ts";
 import { openAutoRun, gitDirty, numberConfig } from "../run.ts";
-import { appendEvidence, queueSteer } from "../evidence.ts";
+import { appendEvidence, queueSteer, reportGateError } from "../evidence.ts";
 import { gateStats, pendingSuiteRuns, suiteRuns, recordVerdict } from "../gate-state.ts";
 import { authority } from "../gate-state.ts";
 import { runtime, BLIND_EDIT_NUDGE_AFTER } from "../runtime.ts";
@@ -47,6 +47,11 @@ function nudgeBlindEdits(file: Awaited<ReturnType<typeof loadState>>, path: stri
 async function observeActivation(toolName: string, input: Input): Promise<void> {
   const call = classifyToolCall(toolName, input);
   if (!call.mutates || !call.source) return;
+  // The mutation clock the publish floor compares the suite runs against. Set for
+  // EVERY source mutation, a passive run included: "no steering" is not "no floor"
+  // — the irreversibility floor holds in passive mode, so it must not be able to
+  // publish on a green that predates the edit.
+  runtime.lastMutationAt = Date.now();
   const project = projectName();
   const file = await loadState(project);
   const decision = activationDecision({ call, activeRun: file.current, passiveRunId: file.current?.passiveRunId });
@@ -207,7 +212,15 @@ export function registerToolCallHandler(pi: ExtensionAPI): void {
 
       const config = readProjectConfig(runRoot());
       const res = evaluateBlockers(toolName, input, {
-        ctx: { suiteRuns, dirty: () => gitDirty(), impactStated: runtime.impactStated, trackedPaths: undefined },
+        ctx: {
+          suiteRuns,
+          dirty: () => gitDirty(),
+          impactStated: runtime.impactStated,
+          trackedPaths: undefined,
+          // The publish floor is the settle floor: the LAST full run, green, and
+          // started after the last source change — not "any green this session".
+          lastMutationAt: runtime.lastMutationAt,
+        },
         enabled: blockerSwitches(config),
       });
       emitVerdicts(res);
@@ -217,10 +230,14 @@ export function registerToolCallHandler(pi: ExtensionAPI): void {
       if (park) await parkRun(park);
       if (!res.block) return undefined;
       return await handleBlock({ pi, res: res as Refusal["res"], park, config });
-    } catch {
-      // An observer must never break the thing it observes. The fail-safe for
-      // the secret rule lives inside evaluateBlockers, where it is explicit.
-      return undefined;
+    } catch (e) {
+      // An observer must never break the thing it observes — so this does not
+      // stop the work. But it must not look like a clean pass either, and it must
+      // not hand anyone a way past the irreversibility floor: an error raised
+      // before the blockers ran is re-checked against the rules that guard
+      // irreversible actions, from the raw tool input alone.
+      reportGateError("tool_call gate", e);
+      return failSafeBlock((event as { input?: Input } | null)?.input || {});
     }
   });
 }

package/lib/extension/handlers/tool-result.ts

@@ -8,8 +8,8 @@
  */
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { deriveSuiteRun } from "../../gates/ledger.mjs";
-import { appendEvidence } from "../evidence.ts";
+import { deriveSuiteRun } from "../../gates/suite-runs.mjs";
+import { appendEvidence, reportGateError } from "../evidence.ts";
 import { pendingSuiteRuns, suiteRuns } from "../gate-state.ts";
 import { runtime } from "../runtime.ts";
 
@@ -52,7 +52,11 @@ export function registerToolResultHandler(pi: ExtensionAPI): void {
       pendingSuiteRuns.delete(id);
       completeSuiteRun(ev, pending);
       return undefined;
-    } catch {
+    } catch (e) {
+      // Swallowing this one silently is how the publish floor becomes an
+      // unclosable gap: the run happened, the recorder failed, and the gate then
+      // demands a run that can never register.
+      reportGateError("suite recorder", e);
       return undefined;
     }
   });

package/lib/extension/run.ts

@@ -14,7 +14,7 @@ import { appendEvidence } from "./evidence.ts";
 import { loadState, saveState } from "./state.ts";
 import { projectName } from "./paths.ts";
 import { runtime } from "./runtime.ts";
-import { __resetRefusals } from "../gates/blockers.mjs";
+import { __resetRefusals } from "../gates/refusals.mjs";
 import type { AsfState } from "./types.ts";
 
 export function newRunId(): string {
@@ -74,6 +74,7 @@ export async function openAutoRun(trigger: string, path: string | null): Promise
   __resetRefusals();
   runtime.blindMutations = 0;
   runtime.blindNudged = false;
+  runtime.lastMutationAt = Date.now();
   appendEvidence({ kind: "run-open", runId: state.runId, auto: true, trigger, project });
   runtime.pendingCard = { text: cardFor(state), reason: "activation" };
   return state;

package/lib/extension/runtime.ts

@@ -28,6 +28,14 @@ export interface RuntimeState {
   /** P6: source mutations since the last test run in this run. */
   blindMutations: number;
   blindNudged: boolean;
+  /**
+   * In-process mirror of the active run's `lastMutationAt`, kept so an exit
+   * floor can ask "did a test run start after the last edit?" without a file
+   * read on every tool call. Session-scoped on purpose, exactly like the suite
+   * runs it is compared against: after a restart there are no recorded runs and
+   * no mutations, so the two clocks can only disagree about the past.
+   */
+  lastMutationAt: number;
   passiveHeartbeatWritten: boolean;
   lastScaleWasSmall: boolean;
   /** Re-anchoring is count-limited per run. */
@@ -44,6 +52,7 @@ export const runtime: RuntimeState = {
   lastReanchorAt: 0,
   blindMutations: 0,
   blindNudged: false,
+  lastMutationAt: 0,
   passiveHeartbeatWritten: false,
   lastScaleWasSmall: false,
   reanchorsThisRun: 0,

package/lib/gates/blockers.d.mts

@@ -34,9 +34,8 @@ export function evaluateBlockers(
   verdicts: BlockerVerdict[];
   steers?: Array<{ gate: string; reason: string }>;
 };
-export const RULE_TEXT: Record<string, string>;
-export function refusalStage(gate: string, fingerprint: string): number;
-export function __resetRefusals(): void;
+/** Re-run the fail-safe-block rules from the raw input alone, when the gate itself could not run. */
+export function failSafeBlock(input: Record<string, unknown>): { block: true; reason: string } | undefined;
 export function blockSecretWrite(input: Record<string, unknown>, ctx?: Record<string, unknown>): BlockerVerdict;
 export function blockTestSubset(input: Record<string, unknown>, ctx?: Record<string, unknown>): BlockerVerdict;
 export function blockPushWithoutGreen(input: Record<string, unknown>, ctx?: Record<string, unknown>): BlockerVerdict;

package/lib/gates/blockers.mjs

@@ -20,6 +20,11 @@
  * rule and wrong for the convenience rules, so `failSafe` is explicit below.
  */
 
+// The green-run rule lives with the ledger that records the runs, so the exit
+// floors and the recorder cannot drift apart.
+import { greenFullRun } from "./suite-runs.mjs";
+import { refusalStage, RULE_TEXT } from "./refusals.mjs";
+
 // ─── (a) secret written to a tracked path ──────────────────────────────────
 //
 // No self-service bypass: the autonomous exit (do not write the secret) costs
@@ -100,15 +105,17 @@ export function blockPushWithoutGreen(input, ctx = {}) {
   if (!command || !PUSH_CMD.test(command)) return { fired: false, scanned: 0 };
   if (ctx.dryRun || /--dry-run\b/.test(command)) return { fired: false, scanned: 1, detail: "dry run" };
 
-  const green = (ctx.suiteRuns || []).some((r) => r.scope === "full" && r.exitCode === 0);
-  if (green) return { fired: false, scanned: 1, detail: "full suite green this session" };
+  // The LAST full run, green, and started after the last source change. A green
+  // that any earlier run left behind is not evidence about the code being pushed.
+  const green = greenFullRun(ctx.suiteRuns, ctx.lastMutationAt);
+  if (green.ok) return { fired: false, scanned: 1, detail: "last full suite run green, after the last edit" };
 
   return {
     fired: true,
     scanned: 1,
     rule: "push-without-recorded-green",
     reason:
-      `refusing to push/publish: this session has no recorded full-suite green run. ` +
+      `refusing to push/publish: ${green.why}. ` +
       `Autonomous exit: run the full suite, and once it exits 0 this is unblocked. ` +
       `The gate never moves — the suite does.`,
   };
@@ -134,54 +141,6 @@ export function blockDestructiveGitDirty(input, ctx = {}) {
   };
 }
 
-// ─── The refusal ladder (P3) ───────────────────────────────────────────────
-//
-// 53% of the refusals the agent ever received (9 of 17) were it walking into the
-// same wall again — `secret-in-tracked-file` fired 3 of its 4 times as a repeat,
-// all on test files with realistic-looking placeholder keys. A remedy in a
-// message that is re-issued identically is not made to stick, so the ladder
-// changes what the agent is *told* before it ever changes what it is *asked*:
-//
-//   1st fire  → refuse + autonomous exit (the text already carried this)
-//   2nd same  → refuse + the rule text itself, so the why and the sanctioned
-//               alternative reach the context instead of just the veto
-//   3rd same  → park for the PO: insisting three times on an irreversible action
-//               with no safe path is exactly the park case, not a nag
-
-/** Normative text per refusal, injected on the second identical fire. */
-export const RULE_TEXT = {
-  "secret-in-tracked-file":
-    "Secrets never go into tracked files, including tests. The sanctioned form is " +
-    "a fixture constant that cannot be a real key (sk-test-not-a-real-key), an " +
-    "environment variable name read at runtime, or a git-ignored .env. A key " +
-    "shape that a scanner can match is a key shape that a scanner will match.",
-  "destructive-git-dirty-tree":
-    "A destructive git command against a dirty tree discards work that exists " +
-    "nowhere else. Commit it, or stash it with a message, then re-run the " +
-    "destructive step. The gate is not protecting the tree from you; it is " +
-    "protecting the only copy of the change.",
-  "push-without-recorded-green":
-    "Nothing is published or pushed without a recorded full-suite green run in " +
-    "this session. The gate never moves — the suite does. Run the full suite; " +
-    "when it exits 0 this is unblocked, and the published artifact is then " +
-    "verified from the registry rather than assumed.",
-};
-
-const refusals = new Map();
-
-/** Which fire of this identical refusal is this? 1 = first time. */
-export function refusalStage(gate, fingerprint) {
-  const key = `${gate}|${String(fingerprint || "").slice(0, 200)}`;
-  const n = (refusals.get(key) || 0) + 1;
-  refusals.set(key, n);
-  return n;
-}
-
-/** Test hook, and the same reset a new run performs. */
-export function __resetRefusals() {
-  refusals.clear();
-}
-
 // ─── Registry ──────────────────────────────────────────────────────────────
 
 /**
@@ -201,6 +160,30 @@ export const BLOCKERS = [
   { name: "destructive-git-dirty-tree", run: blockDestructiveGitDirty, failSafe: "allow", switch: "gate.block.destructiveGit", criticality: "medium", bypassable: true, mode: "block" },
 ];
 
+/**
+ * The floor that must not fail open.
+ *
+ * A fenced handler that returns "allow" on its own internal error hands anyone
+ * who can make the *other* code throw a way past the irreversibility floor — the
+ * secret rule would be disabled by a bug in a config read. So when the gate
+ * could not run, the rules whose `failSafe` is `block` are re-run from the raw
+ * tool input alone, with no context to fail on; and if even one of those throws,
+ * that is a refusal, not a pass.
+ */
+export function failSafeBlock(input) {
+  for (const b of BLOCKERS) {
+    if (b.failSafe !== "block") continue;
+    let res;
+    try {
+      res = b.run(input, {});
+    } catch {
+      res = { fired: true, reason: `${b.name} could not run, and it guards an irreversible action.` };
+    }
+    if (res?.fired) return { block: true, reason: `${b.name}: ${res.reason || "refused"}` };
+  }
+  return undefined;
+}
+
 function str(input, keys) {
   if (!input || typeof input !== "object") return null;
   for (const k of keys) {

package/lib/gates/ledger.d.mts

@@ -3,20 +3,15 @@
  * JavaScript on purpose; this file is the boundary index.ts may rely on, so a
  * field that is not declared here is a type error at the call site rather than
  * a silent `any`.
+ *
+ * Suite-run recognition lives in `suite-runs.d.mjs` (split out in 0.17.5): the
+ * ledger stores entries, the observer decides what a tool call proved.
  */
 export interface LedgerEntry {
   kind: string;
   at?: string;
   [field: string]: unknown;
 }
-export interface SuiteRunEntry extends LedgerEntry {
-  kind: "suite-run";
-  command: string;
-  exitCode: number;
-  durationMs: number;
-  testCount: number | "unknown";
-  scope: "full" | "subset";
-}
 export interface Ledger {
   entries: LedgerEntry[];
   rejected: string[];
@@ -27,12 +22,6 @@ export interface Ledger {
 }
 export function createLedger(): Ledger;
 export function validateEntry(entry: unknown): string | null;
-export function deriveSuiteRun(
-  command: unknown,
-  outcome?: { exitCode?: number; durationMs?: number; output?: string },
-): SuiteRunEntry | null;
-export function isTestCommand(command: unknown): boolean;
-export function deriveHealthRun(command: unknown, opts?: { verdict?: string; scanned?: number; level?: string }): LedgerEntry | null;
 export function sessionFacts(
   ledger: Ledger,
   opts?: { scale?: "small" | "standard" | "major"; webTouched?: boolean },

package/lib/gates/ledger.mjs

@@ -125,100 +125,6 @@ export function createLedger() {
   };
 }
 
-// ─── Derivation from observed tool traffic ─────────────────────────────────
-//
-// These functions turn "the extension watched a tool run" into an entry. They
-// are the only way entries get created, which is the whole point.
-
-/**
- * Recognise a full test-suite run from a bash invocation and its outcome.
- * Returns null when the command is not a test run — an unrecognised command is
- * not evidence, and is not silently counted as one either.
- */
-/**
- * Test-runner recognition. The first version matched `npm test`/vitest/jest/
- * pytest/go/cargo/make only; on the real traces that missed 64% of test
- * invocations (custom runners: `bash test/run-all.sh`, `node test-runner.js`,
- * `timeout 300 node tests/e2e/x.test.js`). Under the completion floor a missed
- * runner is a false "no test ran" steer, so the net is wide and the subset rule
- * is explicit: a run naming one test file is a subset, a runner script is full.
- */
-const TEST_RUNNER = new RegExp(
-  [
-    String.raw`(^|[\s&;|(])(npm|pnpm|yarn|bun)\s+(run\s+)?test(:[\w-]+)?\b`,
-    String.raw`\b(vitest|jest|pytest|mocha|ava|tap|rspec|phpunit|minitest|nextest)\b`,
-    String.raw`\b(go|cargo|deno|bun|dotnet|mvn|gradle|gradlew|mix|swift|zig|make|just|tox|nox)\s+test\b`,
-    String.raw`\bpython3?\s+-m\s+(pytest|unittest)\b`,
-    String.raw`\bnpx\s+(playwright|vitest|jest|mocha)\s+test\b|\bnpx\s+(vitest|jest|mocha)\b`,
-    String.raw`\bnode\s+--test\b`,
-    // runner scripts: run-all.sh, test-runner.js, run_tests.py, scripts/test.sh
-    String.raw`(^|[\s/])(run[-_]?all|test[-_]?runner|run[-_]?tests?|tests?)\.(sh|js|mjs|cjs|ts|py)\b`,
-    // a test file executed directly: node tests/x.test.js, tsx foo.spec.ts
-    String.raw`\b(node|tsx|ts-node|bun|deno\s+run|python3?)\s+[^\s|;&]*\.(test|spec)\.(js|mjs|cjs|ts|tsx|py)\b`,
-    String.raw`\b(node|tsx|bun|python3?)\s+[^\s|;&]*(^|/)(tests?|__tests__|spec)/[^\s|;&]+\.(js|mjs|cjs|ts|py)\b`,
-  ].join("|"),
-);
-/** A lint/typecheck/format is a check, never a test run. */
-const CHECK_ONLY_CMD = /^\s*(npm\s+run\s+)?(lint|typecheck|check|format|prettier|eslint|tsc|biome)\b/;
-
-export function isTestCommand(command) {
-  if (typeof command !== "string") return false;
-  if (CHECK_ONLY_CMD.test(command) && !/\btest\b/.test(command)) return false;
-  return TEST_RUNNER.test(command);
-}
-
-export function deriveSuiteRun(command, { exitCode = 0, durationMs = 0, output = "" } = {}) {
-  if (typeof command !== "string") return null;
-  if (!isTestCommand(command)) return null;
-  const directFile = /\b(node|tsx|ts-node|bun|deno\s+run|python3?)\s+[^\s|;&]*(\.(test|spec)\.(js|mjs|cjs|ts|tsx|py)|(^|\/)(tests?|__tests__|spec)\/[^\s|;&]+\.(js|mjs|cjs|ts|py))\b/.test(command)
-    && !/(run[-_]?all|test[-_]?runner|run[-_]?tests?)\./.test(command);
-  const isSubset = directFile || /--\s*(grep|testPathPattern|filter)\b|-t\s+\S+|\brun\s+\S+\.spec\b|--to-grep|-k\s+\S+|--testNamePattern/.test(command);
-  const parsed = parseTestCounts(output);
-  return {
-    kind: "suite-run",
-    command: command.slice(0, 400),
-    exitCode,
-    durationMs,
-    // Runner output differs (vitest, jest, pytest, go test). Counts are recorded
-    // only where they can actually be read — never inferred, never 0 by default.
-    testCount: parsed == null ? "unknown" : parsed,
-    scope: isSubset ? "subset" : "full",
-    impactStated: false, // filled by the caller when the impact area was declared
-  };
-}
-
-function parseTestCounts(output) {
-  if (!output || typeof output !== "string") return null;
-  const patterns = [
-    /\bTests:\s*(\d+)\s+passed\b/,            // jest
-    /(\d+)\s+tests?\s+passed/,                 // vitest / pytest style
-    /(\d+)\s+passing\b/,                       // mocha
-    /\bok\s+\.\.\.\s+(\d+)\s+tests?/,          // go test
-  ];
-  for (const re of patterns) {
-    const m = output.match(re);
-    if (m) return Number(m[1]);
-  }
-  return null;
-}
-
-/** Recognise an `/asf health` invocation from the command text. */
-export function deriveHealthRun(command, { verdict, scanned, level } = {}) {
-  if (typeof command !== "string" || !/asf\s+health\b/.test(command)) return null;
-  return {
-    kind: "health-run",
-    level: level || guessLevel(command),
-    verdict: verdict || "unknown",
-    scanned: typeof scanned === "number" ? scanned : 0,
-  };
-}
-
-function guessLevel(command) {
-  if (/--major\b/.test(command)) return "major";
-  if (/--small\b/.test(command)) return "small";
-  return "standard";
-}
-
 // ─── What the completion gate may conclude ─────────────────────────────────
 
 /**

package/lib/gates/refusals.d.mts

@@ -0,0 +1,12 @@
+/**
+ * Type surface for the refusal ladder (split out of `blockers.mjs` in 0.17.5).
+ */
+
+/** Normative text per refusal, injected on the second identical fire. */
+export const RULE_TEXT: Record<string, string>;
+
+/** Which fire of this identical refusal is this? 1 = first time. */
+export function refusalStage(gate: string, fingerprint: unknown): number;
+
+/** Test hook, and the same reset a new run performs. */
+export function __resetRefusals(): void;

package/lib/gates/refusals.mjs

@@ -0,0 +1,66 @@
+/**
+ * The refusal ladder (P3).
+ *
+ * 53% of the refusals the agent ever received (9 of 17) were it walking into the
+ * same wall again — `secret-in-tracked-file` fired 3 of its 4 times as a repeat,
+ * all on test files with realistic-looking placeholder keys. A remedy in a
+ * message that is re-issued identically is not made to stick, so the ladder
+ * changes what the agent is *told* before it ever changes what it is *asked*:
+ *
+ *   1st fire  → refuse + autonomous exit (the text already carried this)
+ *   2nd same  → refuse + the rule text itself, so the why and the sanctioned
+ *               alternative reach the context instead of just the veto
+ *   3rd same  → park for the PO: insisting three times on an irreversible action
+ *               with no safe path is exactly the park case, not a nag
+ *
+ * Split out of `blockers.mjs` (0.17.5): the blockers decide, this decides what
+ * the agent is told when it walks into one twice.
+ */
+
+// ─── The refusal ladder (P3) ───────────────────────────────────────────────
+//
+// 53% of the refusals the agent ever received (9 of 17) were it walking into the
+// same wall again — `secret-in-tracked-file` fired 3 of its 4 times as a repeat,
+// all on test files with realistic-looking placeholder keys. A remedy in a
+// message that is re-issued identically is not made to stick, so the ladder
+// changes what the agent is *told* before it ever changes what it is *asked*:
+//
+//   1st fire  → refuse + autonomous exit (the text already carried this)
+//   2nd same  → refuse + the rule text itself, so the why and the sanctioned
+//               alternative reach the context instead of just the veto
+//   3rd same  → park for the PO: insisting three times on an irreversible action
+//               with no safe path is exactly the park case, not a nag
+
+/** Normative text per refusal, injected on the second identical fire. */
+export const RULE_TEXT = {
+  "secret-in-tracked-file":
+    "Secrets never go into tracked files, including tests. The sanctioned form is " +
+    "a fixture constant that cannot be a real key (sk-test-not-a-real-key), an " +
+    "environment variable name read at runtime, or a git-ignored .env. A key " +
+    "shape that a scanner can match is a key shape that a scanner will match.",
+  "destructive-git-dirty-tree":
+    "A destructive git command against a dirty tree discards work that exists " +
+    "nowhere else. Commit it, or stash it with a message, then re-run the " +
+    "destructive step. The gate is not protecting the tree from you; it is " +
+    "protecting the only copy of the change.",
+  "push-without-recorded-green":
+    "Nothing is published or pushed without a recorded full-suite green run in " +
+    "this session. The gate never moves — the suite does. Run the full suite; " +
+    "when it exits 0 this is unblocked, and the published artifact is then " +
+    "verified from the registry rather than assumed.",
+};
+
+const refusals = new Map();
+
+/** Which fire of this identical refusal is this? 1 = first time. */
+export function refusalStage(gate, fingerprint) {
+  const key = `${gate}|${String(fingerprint || "").slice(0, 200)}`;
+  const n = (refusals.get(key) || 0) + 1;
+  refusals.set(key, n);
+  return n;
+}
+
+/** Test hook, and the same reset a new run performs. */
+export function __resetRefusals() {
+  refusals.clear();
+}

package/lib/gates/suite-runs.d.mts

@@ -0,0 +1,31 @@
+/**
+ * Type surface for suite-run recognition (the observer half of the ledger, split
+ * out of `ledger.mjs` in 0.17.5). The implementation is plain ESM JavaScript;
+ * this is what index.ts and the handlers may rely on.
+ */
+export interface SuiteRunEntry {
+  kind: "suite-run";
+  command: string;
+  exitCode: number;
+  durationMs: number;
+  testCount: number | "unknown";
+  scope: "full" | "subset";
+  impactStated: boolean;
+  at?: number;
+  [field: string]: unknown;
+}
+
+export function isTestCommand(command: unknown): boolean;
+export function deriveSuiteRun(
+  command: unknown,
+  outcome?: { exitCode?: number; durationMs?: number; output?: string },
+): SuiteRunEntry | null;
+
+/** The newest entry that was a FULL run (subset runs never satisfy an exit floor). */
+export function lastFullRun(suiteRuns?: SuiteRunEntry[]): SuiteRunEntry | null;
+
+/** The green an exit floor accepts, or why it does not. */
+export function greenFullRun(
+  suiteRuns?: SuiteRunEntry[],
+  since?: number,
+): { run: SuiteRunEntry | null; ok: boolean; why: string };

package/lib/gates/suite-runs.mjs

@@ -0,0 +1,119 @@
+/**
+ * Suite runs and health runs, derived from observed tool traffic.
+ *
+ * A suite run is a fact only because the extension *saw* the command and the
+ * exit code — never because the agent said it ran the tests. This module owns
+ * the recognition (what counts as a runner, what counts as a subset) and the
+ * one question the exit floors ask: is the LAST full run green, and did it
+ * start after the last source change?
+ *
+ * Split out of `ledger.mjs` (0.17.5) because the ledger is the entry store and
+ * this is the observer; they changed for different reasons and together they
+ * outgrew the file limit ASF enforces on everyone else.
+ */
+
+// ─── Derivation from observed tool traffic ─────────────────────────────────
+//
+// These functions turn "the extension watched a tool run" into an entry. They
+// are the only way entries get created, which is the whole point.
+
+/**
+ * Recognise a full test-suite run from a bash invocation and its outcome.
+ * Returns null when the command is not a test run — an unrecognised command is
+ * not evidence, and is not silently counted as one either.
+ */
+/**
+ * Test-runner recognition. The first version matched `npm test`/vitest/jest/
+ * pytest/go/cargo/make only; on the real traces that missed 64% of test
+ * invocations (custom runners: `bash test/run-all.sh`, `node test-runner.js`,
+ * `timeout 300 node tests/e2e/x.test.js`). Under the completion floor a missed
+ * runner is a false "no test ran" steer, so the net is wide and the subset rule
+ * is explicit: a run naming one test file is a subset, a runner script is full.
+ */
+const TEST_RUNNER = new RegExp(
+  [
+    String.raw`(^|[\s&;|(])(npm|pnpm|yarn|bun)\s+(run\s+)?test(:[\w-]+)?\b`,
+    String.raw`\b(vitest|jest|pytest|mocha|ava|tap|rspec|phpunit|minitest|nextest)\b`,
+    String.raw`\b(go|cargo|deno|bun|dotnet|mvn|gradle|gradlew|mix|swift|zig|make|just|tox|nox)\s+test\b`,
+    String.raw`\bpython3?\s+-m\s+(pytest|unittest)\b`,
+    String.raw`\bnpx\s+(playwright|vitest|jest|mocha)\s+test\b|\bnpx\s+(vitest|jest|mocha)\b`,
+    String.raw`\bnode\s+--test\b`,
+    // runner scripts: run-all.sh, test-runner.js, run_tests.py, scripts/test.sh
+    String.raw`(^|[\s/])(run[-_]?all|test[-_]?runner|run[-_]?tests?|tests?)\.(sh|js|mjs|cjs|ts|py)\b`,
+    // a test file executed directly: node tests/x.test.js, tsx foo.spec.ts
+    String.raw`\b(node|tsx|ts-node|bun|deno\s+run|python3?)\s+[^\s|;&]*\.(test|spec)\.(js|mjs|cjs|ts|tsx|py)\b`,
+    String.raw`\b(node|tsx|bun|python3?)\s+[^\s|;&]*(^|/)(tests?|__tests__|spec)/[^\s|;&]+\.(js|mjs|cjs|ts|py)\b`,
+  ].join("|"),
+);
+/** A lint/typecheck/format is a check, never a test run. */
+const CHECK_ONLY_CMD = /^\s*(npm\s+run\s+)?(lint|typecheck|check|format|prettier|eslint|tsc|biome)\b/;
+
+export function isTestCommand(command) {
+  if (typeof command !== "string") return false;
+  if (CHECK_ONLY_CMD.test(command) && !/\btest\b/.test(command)) return false;
+  return TEST_RUNNER.test(command);
+}
+
+export function deriveSuiteRun(command, { exitCode = 0, durationMs = 0, output = "" } = {}) {
+  if (typeof command !== "string") return null;
+  if (!isTestCommand(command)) return null;
+  const directFile = /\b(node|tsx|ts-node|bun|deno\s+run|python3?)\s+[^\s|;&]*(\.(test|spec)\.(js|mjs|cjs|ts|tsx|py)|(^|\/)(tests?|__tests__|spec)\/[^\s|;&]+\.(js|mjs|cjs|ts|py))\b/.test(command)
+    && !/(run[-_]?all|test[-_]?runner|run[-_]?tests?)\./.test(command);
+  const isSubset = directFile || /--\s*(grep|testPathPattern|filter)\b|-t\s+\S+|\brun\s+\S+\.spec\b|--to-grep|-k\s+\S+|--testNamePattern/.test(command);
+  const parsed = parseTestCounts(output);
+  return {
+    kind: "suite-run",
+    command: command.slice(0, 400),
+    exitCode,
+    durationMs,
+    // Runner output differs (vitest, jest, pytest, go test). Counts are recorded
+    // only where they can actually be read — never inferred, never 0 by default.
+    testCount: parsed == null ? "unknown" : parsed,
+    scope: isSubset ? "subset" : "full",
+    impactStated: false, // filled by the caller when the impact area was declared
+  };
+}
+
+/**
+ * The suite runs an exit floor reads.
+ *
+ * `some(green)` is not a floor: it lets a session publish on a green from
+ * before the last edit, and it lets a green from earlier in the session outrank
+ * a red that came after it. The floor is the LAST full run, and it must have
+ * started after the last source mutation — the same rule the settle floor uses
+ * (`run.ts`), so the two cannot disagree about what "green" means.
+ */
+export function lastFullRun(suiteRuns = []) {
+  if (!Array.isArray(suiteRuns)) return null;
+  for (let i = suiteRuns.length - 1; i >= 0; i--) {
+    const r = suiteRuns[i];
+    if (r && r.scope === "full") return r;
+  }
+  return null;
+}
+
+/** The green that opens an exit floor, or null with the reason it is not green. */
+export function greenFullRun(suiteRuns = [], since = 0) {
+  const run = lastFullRun(suiteRuns);
+  if (!run) return { run: null, ok: false, why: "no full-suite run recorded in this session" };
+  if (run.exitCode !== 0) return { run, ok: false, why: `the last full suite run exited ${run.exitCode}` };
+  if ((run.at ?? 0) < (Number(since) || 0)) {
+    return { run, ok: false, why: "the last full-suite green predates the most recent source change" };
+  }
+  return { run, ok: true, why: "" };
+}
+
+function parseTestCounts(output) {
+  if (!output || typeof output !== "string") return null;
+  const patterns = [
+    /\bTests:\s*(\d+)\s+passed\b/,            // jest
+    /(\d+)\s+tests?\s+passed/,                 // vitest / pytest style
+    /(\d+)\s+passing\b/,                       // mocha
+    /\bok\s+\.\.\.\s+(\d+)\s+tests?/,          // go test
+  ];
+  for (const re of patterns) {
+    const m = output.match(re);
+    if (m) return Number(m[1]);
+  }
+  return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-aia-asf",
-  "version": "0.17.4",
+  "version": "0.17.6",
   "description": "Ai Applied Agentic Software Factory — codifies the full software development flow: intake, research, spec capture, adversarial analysis, planning with approval gates, test-first implementation, and release. Requires pi-vigilant, pi-smart-web-search, pi-smart-fetch, and pi-aia-browser.",
   "keywords": [
     "pi-package",

package/skills/aia-asf/references/06i-completeness.md

@@ -60,7 +60,7 @@ goes in the final message in plain words — never discovered by the user throug
 ## Your own artifacts are part of the deliverable (task-scoped drift)
 
 The plan and the spec tree are artifacts too, and they make checkable claims: a PLAN.md
-that names `lib/gates/ledger.mjs` or `deriveSuiteRun()` is asserting those exist. When the
+that names `lib/gates/suite-runs.mjs` or `deriveSuiteRun()` is asserting those exist. When the
 code has moved and the artifact has not, the delivery report describes something that is
 not there — which is the same defect as a stub, just further from the user's eye.
 

package/skills/aia-asf/references/07-release.md

@@ -63,6 +63,13 @@ in the absence of a user definition.
    - **Deployed app:** smoke-test in **production** (health endpoint, key user journey) — a deploy that breaks prod is not a successful release.
    - **Not applicable** (internal-only experiment, no runtime surface): say so explicitly in the report (06b Rule 11).
    - If the published artifact is broken: **fix forward** (new patch), never pretend the release succeeded.
+   - **The copy you are testing may not be the copy you shipped.** `pi` loads extensions once at
+     process start: a session that was already open keeps enforcing the *previous* version's
+     gates no matter what you publish, and its messages quote text that no longer exists in the
+     source. Before concluding a released gate is broken, confirm which build is loaded — compare
+     a string unique to the new release against the behaviour you saw, and check the process
+     start time (`ps -o lstart -p <pid>`). `/reload`, or a new session, is what picks up the new
+     code. This is the difference between "the fix did not work" and "the fix is not running".
 
 ## CI/CD offer
 
@@ -79,3 +86,4 @@ After a successful release (or for a new project), **offer** to set up a CI/CD p
 - The version in package.json, the git tag, and the npm release must match
 - If publishing fails partway, fix forward; never publish a second version with the same number
 - **Test on publish / in production, if applicable — always** (step 7)
+- **Never diagnose a gate from a session that predates the release** — confirm the loaded build first (step 7)