pi-aia-asf 0.17.5 → 0.17.6

package/CHANGELOG.md

@@ -7,6 +7,54 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.17.6] - 2026-11-09
+
+### Fixed — a gate that crashes is not a gate that passed
+
+Both tool handlers were fenced with `catch { return undefined }`, which had two consequences of
+exactly the kind ASF bans:
+
+- A failure inside the **suite recorder** lost the run silently, after which the publish and
+  completion floors demanded a run that could never register — an unclosable gap with no visible
+  cause.
+- Because pi's own semantics for a crashing `tool_call` handler are *block*, returning "allow"
+  overrode them: anything that made the earlier code throw — a config read, the activation
+  observer — disabled the **irreversibility floor** for that call.
+
+Now:
+
+- `reportGateError(gate, e)` records a `gate-error` ledger entry and tells the agent once, as a
+  steer: *"That is not a pass — the check failed to execute."* Guidance, never a stop.
+- When the gate dies **before** the blockers ran, `failSafeBlock(input)` re-runs just the rules
+  whose `failSafe` is `block`, from the raw tool input alone, with no context to fail on. A secret
+  in a tracked file is still refused when the gate itself is broken; ordinary work is never
+  stopped by an internal error.
+- A fail-safe rule that *itself* throws refuses ("could not run") rather than reporting nothing
+  found.
+
+Three assertions pin this, each mutation-tested: removing the report, the fail-closed call, or the
+crash-refusal each fails a test.
+
+- `lib/gates/blockers.d.mts` still declared `RULE_TEXT`, `refusalStage` and `__resetRefusals` after
+  they moved to `lib/gates/refusals.mjs` in 0.17.5 — a `.ts` could import them, typecheck, and get
+  `undefined` at runtime. The declarations now match the modules.
+
+### Removed
+
+- Dead export `SOURCE_EXTENSIONS` from `lib/activation.mjs` (no importer).
+
+### Documented
+
+- **The loaded copy is not the shipped copy** (07-release.md step 7 + hygiene rule): `pi` loads
+  extensions once at process start, so a session open across a release keeps enforcing the previous
+  version and quoting text that no longer exists in the source. Confirm which build is loaded — a
+  string unique to the new release, and the process start time — before concluding a released gate
+  is broken. That is the difference between "the fix did not work" and "the fix is not running", and
+  it cost hours chasing a phantom bug in 0.17.5.
+- `06i-completeness.md` pointed its drift example at `lib/gates/ledger.mjs` / `deriveSuiteRun()`;
+  those moved to `lib/gates/suite-runs.mjs` in 0.17.5, and the doc — which is about not trusting
+  stale references — was itself stale.
+
 ## [0.17.5] - 2026-11-08
 
 ### Fixed — the publish floor could be satisfied by a green that proved nothing

package/lib/activation.mjs

@@ -177,5 +177,3 @@ export function activationDecision({ call, activeRun, passiveRunId = null } = {}
   return { activate: true };
 }
 
-/** Exported for the tests and for `/asf` diagnostics. */
-export const SOURCE_EXTENSIONS = SOURCE_EXT;

package/lib/extension/evidence.ts

@@ -27,6 +27,30 @@ export function queueSteer(text: string) {
   pendingSteers.push(text);
 }
 
+/**
+ * An internal gate error must never be able to look like a pass.
+ *
+ * Every ASF handler is fenced, because an observer must not break the work it
+ * watches. Fencing *without* reporting is exactly how the 2026-11-07 loop became
+ * possible: a gate demanded something, the code that would have shown why
+ * swallowed its own error, and the agent was steered forever toward an action
+ * that could not register. So a swallowed error is (a) recorded as evidence and
+ * (b) told to the agent once, as a steer — guidance, never a stop.
+ *
+ * The settle gate has a stronger channel (it returns the entry inline, so the
+ * agent sees it in the same turn); the tool handlers do not, so they use this.
+ */
+export function reportGateError(gate: string, e: unknown) {
+  const message = String((e as Error | null)?.message || e || "unknown");
+  appendEvidence({ kind: "gate-error", gate, error: message.slice(0, 300) });
+  const cls = (e as { code?: string } | null)?.code || (e as Error | null)?.name || "unknown";
+  queueSteer(
+    `ASF: the ${gate} hit an internal error (${cls}: ${message.slice(0, 140)}) and did not run. ` +
+      `That is not a pass — the check failed to execute. Re-issue the action; if it repeats, ` +
+      `this is an ASF bug to report, not a rule to satisfy.`,
+  );
+}
+
 
 export function appendEvidence(entry: Record<string, unknown>) {
   const res = ledger.append(entry);

package/lib/extension/handlers/tool-call.ts

@@ -15,13 +15,13 @@
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { classifyToolCall, activationDecision } from "../../activation.mjs";
-import { evaluateBlockers, BLOCKERS } from "../../gates/blockers.mjs";
+import { evaluateBlockers, BLOCKERS, failSafeBlock } from "../../gates/blockers.mjs";
 import { deriveSuiteRun } from "../../gates/suite-runs.mjs";
 import { readProjectConfig } from "../../gates/config.mjs";
 import { projectName, runRoot } from "../paths.ts";
 import { loadState, saveState } from "../state.ts";
 import { openAutoRun, gitDirty, numberConfig } from "../run.ts";
-import { appendEvidence, queueSteer } from "../evidence.ts";
+import { appendEvidence, queueSteer, reportGateError } from "../evidence.ts";
 import { gateStats, pendingSuiteRuns, suiteRuns, recordVerdict } from "../gate-state.ts";
 import { authority } from "../gate-state.ts";
 import { runtime, BLIND_EDIT_NUDGE_AFTER } from "../runtime.ts";
@@ -230,10 +230,14 @@ export function registerToolCallHandler(pi: ExtensionAPI): void {
       if (park) await parkRun(park);
       if (!res.block) return undefined;
       return await handleBlock({ pi, res: res as Refusal["res"], park, config });
-    } catch {
-      // An observer must never break the thing it observes. The fail-safe for
-      // the secret rule lives inside evaluateBlockers, where it is explicit.
-      return undefined;
+    } catch (e) {
+      // An observer must never break the thing it observes — so this does not
+      // stop the work. But it must not look like a clean pass either, and it must
+      // not hand anyone a way past the irreversibility floor: an error raised
+      // before the blockers ran is re-checked against the rules that guard
+      // irreversible actions, from the raw tool input alone.
+      reportGateError("tool_call gate", e);
+      return failSafeBlock((event as { input?: Input } | null)?.input || {});
     }
   });
 }

package/lib/extension/handlers/tool-result.ts

@@ -9,7 +9,7 @@
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { deriveSuiteRun } from "../../gates/suite-runs.mjs";
-import { appendEvidence } from "../evidence.ts";
+import { appendEvidence, reportGateError } from "../evidence.ts";
 import { pendingSuiteRuns, suiteRuns } from "../gate-state.ts";
 import { runtime } from "../runtime.ts";
 
@@ -52,7 +52,11 @@ export function registerToolResultHandler(pi: ExtensionAPI): void {
       pendingSuiteRuns.delete(id);
       completeSuiteRun(ev, pending);
       return undefined;
-    } catch {
+    } catch (e) {
+      // Swallowing this one silently is how the publish floor becomes an
+      // unclosable gap: the run happened, the recorder failed, and the gate then
+      // demands a run that can never register.
+      reportGateError("suite recorder", e);
       return undefined;
     }
   });

package/lib/gates/blockers.d.mts

@@ -34,9 +34,8 @@ export function evaluateBlockers(
   verdicts: BlockerVerdict[];
   steers?: Array<{ gate: string; reason: string }>;
 };
-export const RULE_TEXT: Record<string, string>;
-export function refusalStage(gate: string, fingerprint: string): number;
-export function __resetRefusals(): void;
+/** Re-run the fail-safe-block rules from the raw input alone, when the gate itself could not run. */
+export function failSafeBlock(input: Record<string, unknown>): { block: true; reason: string } | undefined;
 export function blockSecretWrite(input: Record<string, unknown>, ctx?: Record<string, unknown>): BlockerVerdict;
 export function blockTestSubset(input: Record<string, unknown>, ctx?: Record<string, unknown>): BlockerVerdict;
 export function blockPushWithoutGreen(input: Record<string, unknown>, ctx?: Record<string, unknown>): BlockerVerdict;

package/lib/gates/blockers.mjs

@@ -160,6 +160,30 @@ export const BLOCKERS = [
   { name: "destructive-git-dirty-tree", run: blockDestructiveGitDirty, failSafe: "allow", switch: "gate.block.destructiveGit", criticality: "medium", bypassable: true, mode: "block" },
 ];
 
+/**
+ * The floor that must not fail open.
+ *
+ * A fenced handler that returns "allow" on its own internal error hands anyone
+ * who can make the *other* code throw a way past the irreversibility floor — the
+ * secret rule would be disabled by a bug in a config read. So when the gate
+ * could not run, the rules whose `failSafe` is `block` are re-run from the raw
+ * tool input alone, with no context to fail on; and if even one of those throws,
+ * that is a refusal, not a pass.
+ */
+export function failSafeBlock(input) {
+  for (const b of BLOCKERS) {
+    if (b.failSafe !== "block") continue;
+    let res;
+    try {
+      res = b.run(input, {});
+    } catch {
+      res = { fired: true, reason: `${b.name} could not run, and it guards an irreversible action.` };
+    }
+    if (res?.fired) return { block: true, reason: `${b.name}: ${res.reason || "refused"}` };
+  }
+  return undefined;
+}
+
 function str(input, keys) {
   if (!input || typeof input !== "object") return null;
   for (const k of keys) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-aia-asf",
-  "version": "0.17.5",
+  "version": "0.17.6",
   "description": "Ai Applied Agentic Software Factory — codifies the full software development flow: intake, research, spec capture, adversarial analysis, planning with approval gates, test-first implementation, and release. Requires pi-vigilant, pi-smart-web-search, pi-smart-fetch, and pi-aia-browser.",
   "keywords": [
     "pi-package",

package/skills/aia-asf/references/06i-completeness.md

@@ -60,7 +60,7 @@ goes in the final message in plain words — never discovered by the user throug
 ## Your own artifacts are part of the deliverable (task-scoped drift)
 
 The plan and the spec tree are artifacts too, and they make checkable claims: a PLAN.md
-that names `lib/gates/ledger.mjs` or `deriveSuiteRun()` is asserting those exist. When the
+that names `lib/gates/suite-runs.mjs` or `deriveSuiteRun()` is asserting those exist. When the
 code has moved and the artifact has not, the delivery report describes something that is
 not there — which is the same defect as a stub, just further from the user's eye.
 

package/skills/aia-asf/references/07-release.md

@@ -63,6 +63,13 @@ in the absence of a user definition.
    - **Deployed app:** smoke-test in **production** (health endpoint, key user journey) — a deploy that breaks prod is not a successful release.
    - **Not applicable** (internal-only experiment, no runtime surface): say so explicitly in the report (06b Rule 11).
    - If the published artifact is broken: **fix forward** (new patch), never pretend the release succeeded.
+   - **The copy you are testing may not be the copy you shipped.** `pi` loads extensions once at
+     process start: a session that was already open keeps enforcing the *previous* version's
+     gates no matter what you publish, and its messages quote text that no longer exists in the
+     source. Before concluding a released gate is broken, confirm which build is loaded — compare
+     a string unique to the new release against the behaviour you saw, and check the process
+     start time (`ps -o lstart -p <pid>`). `/reload`, or a new session, is what picks up the new
+     code. This is the difference between "the fix did not work" and "the fix is not running".
 
 ## CI/CD offer
 
@@ -79,3 +86,4 @@ After a successful release (or for a new project), **offer** to set up a CI/CD p
 - The version in package.json, the git tag, and the npm release must match
 - If publishing fails partway, fix forward; never publish a second version with the same number
 - **Test on publish / in production, if applicable — always** (step 7)
+- **Never diagnose a gate from a session that predates the release** — confirm the loaded build first (step 7)