pi-crew 0.11.53 → 0.11.55

package/src/runtime/pi-spawn.ts

@@ -80,6 +80,24 @@ function isWithinAllowedPrefixes(resolvedPath: string): boolean {
 		logInternalError("pi-spawn.allowlist-prefixes.local-bin", error, undefined, "debug");
 	}
 
+	// S-4 (Wave G): Pi-managed install layout (the official Pi installer).
+	// The installer ships a launcher at ~/.pi/agent/bin/pi (verified live:
+	// `which pi` → ~/.pi/agent/bin/pi on a Pi-installer host) and execs the
+	// release tree under ~/.pi/agent/install/releases/<ver>/node_modules/.
+	// Neither is covered by the npm-style prefixes above, so PATH validation
+	// would reject the primary non-npm install layout without these entries.
+	// Both are user-owned single-user dirs — same trust class as
+	// ~/.npm-global/bin above. Deliberately NOT ~/.pi/agent as a whole so the
+	// extensions/ and cache/ subdirs never become auto-executable prefixes.
+	try {
+		const piAgentDir = path.join(os.homedir(), ".pi", "agent");
+		allowedPrefixes.push(path.join(piAgentDir, "bin").toLowerCase());
+		allowedPrefixes.push(path.join(piAgentDir, "install").toLowerCase());
+	} catch (error) {
+		// R17-B3: probe failure → prefix simply not allowed.
+		logInternalError("pi-spawn.allowlist-prefixes.pi-managed", error, undefined, "debug");
+	}
+
 	// Canonicalize prefixes (macOS: /var/folders/... realpath → /private/var/folders/...).
 	// validateExplicitBin() compares fs.realpathSync(resolved) against this list —
 	// without the canonical forms, any prefix reached through a symlink (macOS
@@ -312,6 +330,98 @@ function validateExplicitBin(explicit: string): string | undefined {
 	return resolved;
 }
 
+/**
+ * which(1)-equivalent resolution of a bare command name against PATH.
+ * Returns the first hit (absolute path), or undefined when PATH has no match.
+ * On win32 the PATHEXT extensions are tried in order — spawn itself does NOT
+ * do PATHEXT resolution (see the Issue #33 note on resolveNpmGlobalRoot).
+ * @internal — exported for unit tests (S-4).
+ */
+export function resolveCommandOnPath(command: string): string | undefined {
+	const rawPath = process.env.PATH;
+	if (!rawPath) return undefined;
+	const extensions =
+		process.platform === "win32" ? (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter((ext) => ext.length > 0) : [""];
+	for (const dir of rawPath.split(path.delimiter)) {
+		if (dir.length === 0) continue;
+		for (const ext of extensions) {
+			const candidate = path.resolve(dir, `${command}${ext}`);
+			try {
+				// statSync (symlink-following) rejects missing entries and
+				// directories named `pi`; accessSync(X_OK) enforces executability
+				// exactly like which(1) on posix.
+				if (!fs.statSync(candidate).isFile()) continue;
+				if (process.platform !== "win32") fs.accessSync(candidate, fs.constants.X_OK);
+				return candidate;
+			} catch {
+				// Not present / not a file / not executable — keep scanning PATH.
+			}
+		}
+	}
+	return undefined;
+}
+
+/**
+ * S-4 (Wave G): validate a PATH-resolved bare-"pi" hit with the same
+ * predicate as PI_TEAMS_PI_BIN (validateExplicitBin). Throws on an
+ * out-of-prefix hit — or an out-of-prefix symlink target — so the worker is
+ * skipped loudly with a diagnostic instead of silently spawning whatever
+ * the inherited PATH served (the pre-S-4 bare-"pi" fallback validated
+ * nothing). Returns the validated hit.
+ * Hardening (2026-10-31, LOW ruling): a FOUND, prefix-valid hit whose
+ * realpath probe then fails for a NON-prefix reason (transient EACCES /
+ * TOCTOU / symlink loop) ALSO throws — returning undefined here made the
+ * caller degrade to the unvalidated bare-"pi" command, the exact S-4
+ * primitive this guard exists to close. A found-and-prefix-valid candidate
+ * must never degrade to the unvalidated fallback.
+ * @internal — exported for unit tests.
+ */
+export function validatePathResolvedPi(hit: string): string | undefined {
+	if (!isWithinAllowedPrefixes(hit)) {
+		throw new Error(
+			`PATH-resolved 'pi' at '${hit}' is outside allowed prefixes. ` +
+				`Allowed: npm global bin, project node_modules/.bin, APPDATA/npm, ~/.npm-global/bin, ~/.local/bin, ~/.pi/agent (Pi-managed install), or process execPath directory. ` +
+				`Refusing to spawn an unvalidated PATH hit — install pi via npm -g or the Pi installer, pin PI_TEAMS_PI_BIN inside an allowed prefix, or extend the allowlist with NPM_CONFIG_PREFIX.`,
+		);
+	}
+	try {
+		const real = fs.realpathSync(hit);
+		if (!isWithinAllowedPrefixes(real)) {
+			throw new Error(`PATH-resolved 'pi' at '${hit}' symlink target '${real}' is outside allowed prefixes.`);
+		}
+	} catch (e) {
+		if (e instanceof Error && e.message.includes("allowed prefixes")) throw e;
+		// S-4 hardening: loud skip-with-diagnostic, NEVER a silent degrade to
+		// bare "pi" (spawn would re-resolve the name against the inherited PATH
+		// with zero validation). The raw cause rides in the message.
+		throw new Error(
+			`PATH-resolved 'pi' at '${hit}' passed the prefix allowlist but could not be realpath-validated: ${e instanceof Error ? e.message : String(e)}. ` +
+				`Refusing to degrade to the unvalidated bare-'pi' fallback — treat this as a skip-and-diagnose (transient EACCES/TOCTOU or a symlink loop).`,
+		);
+	}
+	return hit;
+}
+
+/**
+ * S-4 (Wave G): the bare-"pi" fallback. resolvePiCliScript() missed, and the
+ * legacy behavior handed spawn("pi") to inherited-PATH resolution with NO
+ * validation. Now: resolve the hit ourselves and validate it with the same
+ * allowlist as PI_TEAMS_PI_BIN — an unvalidated/hijacked hit throws (worker
+ * skipped with a clear diagnostic, same UX as an invalid PI_TEAMS_PI_BIN),
+ * and a validated hit is spawned by absolute path so the child cannot
+ * re-resolve a different binary under a mutated env. On win32 a validated
+ * hit only proves PATH sanity — spawn cannot exec PATHEXT targets (pi.cmd)
+ * without a shell — so the legacy bare "pi" command is kept as before.
+ * @internal — exported for unit tests.
+ */
+export function resolvePathFallbackCommand(args: string[]): PiSpawnCommand {
+	const hit = resolveCommandOnPath("pi");
+	if (!hit) return { command: "pi", args };
+	const validated = validatePathResolvedPi(hit);
+	if (validated && process.platform !== "win32") return { command: validated, args };
+	return { command: "pi", args };
+}
+
 export function getPiSpawnCommand(args: string[]): PiSpawnCommand {
 	const explicit = getCrewEnv("PI_TEAMS_PI_BIN")?.trim();
 	if (explicit) {
@@ -332,8 +442,8 @@ export function getPiSpawnCommand(args: string[]): PiSpawnCommand {
 	}
 	// Linux/macOS: also resolve the full path so child processes can find 'pi' even if
 	// PATH is minimal (e.g. in detached background-runner processes). Fall back to "pi"
-	// only if resolution fails.
+	// only if resolution fails — S-4: the fallback itself now validates the PATH hit.
 	const script = resolvePiCliScript();
 	if (script) return { command: process.execPath, args: [script, ...args] };
-	return { command: "pi", args };
+	return resolvePathFallbackCommand(args);
 }

package/src/runtime/task-runner/child-executor.ts

@@ -868,6 +868,13 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 				agentId: task.id,
 				artifactsRoot: manifest.artifactsRoot,
 				eventsPath: manifest.eventsPath, // I5: scratchpad metric events from the worker
+				// FINDING B (2026-10-31): thread the run's DISPATCHER (leader session)
+				// PUBLIC verify key into the worker's PI_CREW_MAILBOX_VERIFY_KEYS env —
+				// async runs execute here in the detached runner (different keypair),
+				// and without this the leader's respond/steering rows fail the
+				// worker's sig verify and drop as noise. Absent on pre-FINDING-B
+				// manifests (spawn keeps the singular spawner key only).
+				dispatcherVerifyKey: manifest.dispatcherVerifyKey,
 				attempt: i,
 				steeringFile: resolveRealContainedPath(`${manifest.artifactsRoot}/steering`, `${task.id}.jsonl`),
 				onSpawn: (pid) => {

package/src/runtime/task-runner.ts

@@ -196,6 +196,23 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 								})),
 							}
 						: {}),
+					// S-1 (shared-cwd-untracked-harness, HIGH, 2026-10-31): host-owned
+					// task records at gate time — the gate refuses the deterministic
+					// skip when a WRITE-role task EXECUTED in the gate's own cwd
+					// (gitignored node_modules shims sit outside every pinned binding,
+					// so a shared-cwd executor's tampered harness could grade its own
+					// gate). Host in-memory records ONLY — the gate must never read the
+					// worker-mutable tasks.json itself. The verifier's own record is
+					// excluded: the gate runs BEFORE its spawn.
+					taskRecords: ctx.tasks
+						.filter((t) => t.id !== ctx.task.id)
+						.map((t) => ({
+							taskId: t.id,
+							role: t.role,
+							status: t.status,
+							cwd: t.cwd,
+							worktreePath: t.worktree?.path,
+						})),
 					signal: input.signal,
 					classifier: {
 						enabled: resolveClassifierEnabled(input.runtimeConfig?.classifierEnabled),

package/src/runtime/verification/verification-gates.ts

@@ -197,18 +197,112 @@ const ALLOWED_GATE_COMMAND_PATTERNS: readonly RegExp[] = [
 	/^(?:gradle|\.\/gradlew)\s+(?:build|check|test)(?:\s|$)/,
 	/^(?:mvn|\.\/mvnw)\s+(?:package|test|verify)(?:\s|$)/,
 	/^make\s+(?:build|check|lint|test)(?:\s|$)/,
-	/^(?:echo|false|printenv|printf|true)(?:\s|$)/,
+	// S-3 (deep review 2026-10-31): `printenv` removed — no built-in gate needs
+	// it, and it turns any allowlisted gate into an environment-dump read
+	// primitive whose output is captured into world-readable artifacts
+	// (sanitize survivors + PRESERVE_ENV vars included).
+	/^(?:echo|false|printf|true)(?:\s|$)/,
+	// S-3: reader commands stay allowlisted ONLY as cwd-scoped evidence
+	// extractors — their path arguments are additionally restricted by
+	// validateGateReaderPathArgs below (no absolute or ~-prefixed paths).
 	/^(?:grep|head|rg|tail)(?:\s|$)/,
 ];
 
 const NODE_EVAL_MODE_PATTERN = /(?:^|\s)["']?(?:(?:-e|-p)(?!-)|--(?:eval|print)(?:=|\s|["']|$))/;
 
-function validateAllowedGateCommands(normalized: string, original: string): void {
+/** S-3 (deep review 2026-10-31): grep/head/rg/tail are allowlisted as
+ *  cwd-scoped evidence extractors. A path argument resolving outside the gate
+ *  cwd — absolute (`/etc/passwd`), home-relative (`~/notes`), Windows absolute
+ *  (`C:/Windows`, `\\\\host\\share`), or `..`-relative escaping it — is an
+ *  out-of-workspace read primitive, so it is rejected outright. Fail-closed:
+ *  simpler than allowlisting the cwd's absolute prefix, which quoting and `~`
+ *  expansion would defeat. Option flags (`-c`, `-rn`, …) and cwd-relative
+ *  paths (`src/`, `dist/index.mjs`) pass. */
+const GATE_READER_COMMAND_PATTERN = /^(?:grep|head|rg|tail)(?:\s|$)/;
+
+/** S-3 hardening (2026-10-31, LOW ruling): `rg --pre <cmd>` runs an arbitrary
+ *  preprocessor executable on every file the reader touches — an execution
+ *  primitive hiding inside a reader allowlist entry. Denied in both the
+ *  attached (`--pre=x`) and detached (`--pre x`) spellings. */
+const GATE_READER_PREPROCESSOR_PATTERN = /(?:^|\s)--pre(?:\s|=|$)/;
+
+/** S-3 hardening: Windows absolute forms — drive letter (`C:/…`, `C:\\…`) and
+ *  UNC (`\\\\host\\share`). */
+const WINDOWS_ABSOLUTE_ARG_PATTERN = /^[A-Za-z]:[\\/]/;
+
+/** S-3 hardening: lexical path containment — `child` inside `parent`? Exact
+ *  segment boundary on the `..` escape; path.relative never returns a bare
+ *  absolute path on the same tree. */
+function isPathWithin(parent: string, child: string): boolean {
+	const rel = path.relative(parent, child);
+	return rel === "" || (rel !== ".." && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel));
+}
+
+function validateGateReaderPathArgs(pipelineCommand: string, original: string, gateCwd?: string): void {
+	if (GATE_READER_PREPROCESSOR_PATTERN.test(pipelineCommand)) {
+		throw new Error(`Security: verification gate command rejected (reader --pre runs an arbitrary preprocessor): ${original}`);
+	}
+	for (const rawArg of pipelineCommand.split(/\s+/).slice(1)) {
+		// Strip at most one leading and one trailing quote char: `sh -c`
+		// expands quotes before path resolution, so `"/etc/passwd"` (and an
+		// unbalanced prefix like `"~/a` from a whitespace-split quoted path)
+		// must not slip through.
+		let arg = rawArg;
+		if (arg.startsWith('"') || arg.startsWith("'")) arg = arg.slice(1);
+		if (arg.endsWith('"') || arg.endsWith("'")) arg = arg.slice(0, -1);
+		if (arg.length === 0) continue;
+		if (arg.startsWith("/") || arg.startsWith("~")) {
+			throw new Error(
+				`Security: verification gate command rejected (reader path argument escapes the gate cwd — absolute and ~-prefixed paths are not allowed): ${original}`,
+			);
+		}
+		// Windows absolute forms — on POSIX a `C:/x` arg is a cwd-relative
+		// filename to US, but sh/spawn on win32 resolves it absolutely.
+		if (WINDOWS_ABSOLUTE_ARG_PATTERN.test(arg) || arg.startsWith("\\\\")) {
+			throw new Error(
+				`Security: verification gate command rejected (reader path argument is a Windows absolute path — must stay cwd-relative): ${original}`,
+			);
+		}
+		if (arg.startsWith("-")) {
+			// Flags are not paths we can resolve — but an ATTACHED value carrying a
+			// path separator (`-f/etc/x`, `--pre=/usr/bin/id`) smuggles an absolute
+			// path past the positional checks above, so reject any separator in a
+			// flag token (reader flags are pattern/count selectors — no slashes).
+			if (/[\\/]/.test(arg)) {
+				throw new Error(
+					`Security: verification gate command rejected (reader flag carries a path in its attached value): ${original}`,
+				);
+			}
+			continue;
+		}
+		// Positional argument (pattern or path): when the gate cwd is known,
+		// resolve against it and enforce containment (covers `a/../../etc/x`
+		// escapes that do not START with `..`); without a cwd (test helper), fall
+		// back to a lexical leading-`..` segment check.
+		if (gateCwd !== undefined) {
+			const resolved = path.resolve(gateCwd, arg);
+			if (!isPathWithin(gateCwd, resolved)) {
+				throw new Error(
+					`Security: verification gate command rejected (reader path argument resolves outside the gate cwd): ${original}`,
+				);
+			}
+		} else if (arg === ".." || arg.startsWith(`..${path.sep}`) || arg.startsWith("../")) {
+			throw new Error(
+				`Security: verification gate command rejected (reader path argument escapes the gate cwd — ..-relative paths are not allowed): ${original}`,
+			);
+		}
+	}
+}
+
+function validateAllowedGateCommands(normalized: string, original: string, gateCwd?: string): void {
 	const pipelineCommands = normalized.split("|").map((part) => part.trim());
 	for (const pipelineCommand of pipelineCommands) {
 		if (/^node(?:\s|$)/.test(pipelineCommand) && NODE_EVAL_MODE_PATTERN.test(pipelineCommand)) {
 			throw new Error(`Security: verification gate command rejected (Node eval/print mode is not allowed): ${original}`);
 		}
+		if (GATE_READER_COMMAND_PATTERN.test(pipelineCommand)) {
+			validateGateReaderPathArgs(pipelineCommand, original, gateCwd);
+		}
 		if (!pipelineCommand || !ALLOWED_GATE_COMMAND_PATTERNS.some((pattern) => pattern.test(pipelineCommand))) {
 			throw new Error(`Security: verification gate command rejected (command is not allowlisted): ${original}`);
 		}
@@ -222,11 +316,11 @@ function validateAllowedGateCommands(normalized: string, original: string): void
  * and stderr fd duplication (`2>&1`).
  */
 /** @internal — exported for injection-guard unit testing (Round 25). */
-export function __test__validateGateCommand(command: string): void {
-	validateGateCommand(command);
+export function __test__validateGateCommand(command: string, gateCwd?: string): void {
+	validateGateCommand(command, gateCwd);
 }
 
-function validateGateCommand(command: string): void {
+function validateGateCommand(command: string, gateCwd?: string): void {
 	// Round 25 (VULN-3): check the ORIGINAL command for raw newlines BEFORE
 	// normalization. The regex below runs on the NORMALIZED command (which
 	// collapses \s+ incl. newlines to a single space), so a newline would be
@@ -246,7 +340,7 @@ function validateGateCommand(command: string): void {
 	if (DANGEROUS_SHELL_PATTERNS.test(normalized)) {
 		throw new Error(`Security: verification gate command rejected (dangerous shell pattern): ${command}`);
 	}
-	validateAllowedGateCommands(normalized, command);
+	validateAllowedGateCommands(normalized, command, gateCwd);
 }
 
 /** U13 (upgrade spec 2026-10-09): exported so the deterministic verify_gate
@@ -259,7 +353,9 @@ export async function executeCommand(
 	timeoutMs: number = 120000,
 ): Promise<{ exitCode: number | null; output: string; durationMs: number }> {
 	// SECURITY: Validate command before shell execution to prevent injection.
-	validateGateCommand(command);
+	// The execution cwd IS the gate cwd for reader-path containment — thread it
+	// down so `..`-relative escapes resolve against where the command runs.
+	validateGateCommand(command, cwd);
 
 	const start = Date.now();
 	let output = "";

package/src/runtime/verification/verify-gate.ts

@@ -79,6 +79,14 @@
  *     (worktree mode — the gate's pristine tree structurally excludes that
  *     work), the skip is refused and the LLM verifier spawns with the guard
  *     note (dependencyWorktreeProbes → reason "unverified_worktree_work").
+ *   - S-1 (2026-10-31, HIGH): in SHARED-CWD mode the bindings still cannot
+ *     see GITIGNORED content in the gate cwd itself — the gate runs its checks
+ *     in the same directory a WRITE-role executor just wrote to, and a
+ *     tampered gitignored harness (node_modules shims) grades its own gate.
+ *     When host-owned task records show a write-role task EXECUTED in the
+ *     gate cwd, the skip is refused and the LLM verifier spawns (taskRecords
+ *     → reason "shared-cwd-untracked-harness") — fresh AND memoized PASS
+ *     verdicts, mirroring the W2 guard.
  *
  * SAFETY: a gate that cannot run (disabled by env, no checks resolved,
  * executor failure) degrades to "spawn the LLM verifier as today" — the
@@ -94,9 +102,14 @@
  */
 import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
+import * as path from "node:path";
 import { getCrewEnvBool, getCrewEnvInt } from "../../config/env-vars.ts";
 import type { MetricRegistry } from "../../observability/metric-registry.ts";
 import { assertWorktreePointerTrusted, buildGitSafeEnv, hardenGitArgs } from "../../worktree/git-hardening.ts";
+// Static edge is graph-free: role-permission.ts is already in the index.bundle
+// value-import graph (task-runner/pre-execution.ts imports it), so this adds no
+// bundle-graph file (check-lazy-imports budget) — same rationale as below.
+import { permissionForRole } from "../role-permission.ts";
 import type { VerifierPreGateResult } from "./classifier-pre-gate.ts";
 import { executeCommand } from "./verification-gates.ts";
 // Static edge is graph-free: verification-integrity.ts is already in the
@@ -732,6 +745,129 @@ function resolveWorktreeGuardDecision(
 	};
 }
 
+// ─── S-1 (shared-cwd untracked harness, HIGH, 2026-10-31): task-record guard ──
+
+/** S-1: host-owned view of ONE task record at gate time (a structural subset
+ *  of TeamTaskState — the state layer is not imported here). Callers pass the
+ *  records for every task in the run EXCEPT the verifier itself (the gate
+ *  runs BEFORE the verifier's own spawn — including it would fire the guard
+ *  on every shared-cwd run). */
+export interface VerifierGateTaskRecord {
+	taskId: string;
+	/** Role as the HOST recorded it at dispatch. Write-capability comes from
+	 *  the role-permission WRITE_ROLES allowlist — the same list that gates
+	 *  worker tool access, so "a role that can write files" is exactly "a
+	 *  role that can plant a gitignored harness shim". */
+	role: string;
+	/** Lifecycle status at gate time. "queued" never started and "skipped"
+	 *  never ran — every other status (incl. "cancelled": an aborted worker
+	 *  may still have written) counts as EXECUTED, fail-closed. */
+	status: string;
+	/** The cwd the task executes in. */
+	cwd: string;
+	/** Present when the task ran in its own worktree (worktree mode) — its
+	 *  writes live outside the gate cwd and the W2 probe path owns them. */
+	worktreePath?: string;
+}
+
+/** S-1: statuses proving a worker actually ran (see VerifierGateTaskRecord.status). */
+const EXECUTED_TASK_STATUSES: ReadonlySet<string> = new Set(["running", "waiting", "completed", "failed", "cancelled", "needs_attention"]);
+
+/** S-1: same-directory compare — exact string first (host records derive both
+ *  sides from the same manifest cwd string), realpath fallback for textual
+ *  variants (symlinks / Windows \\?\\ prefixes). Unresolvable ⇒ NOT equal: a
+ *  record whose cwd cannot be resolved carries no evidence it ran here.
+ * Guard hardening (2026-10-31, M-ruling): a record cwd that is a realpath'd
+ *  ANCESTOR of the gate cwd also counts — worker writes are NOT OS-scoped to
+ *  the task cwd, so a WRITE-role task running at a monorepo root (task
+ *  cwd=/ws) wrote into the gate's cwd (/ws/pi-crew) all the same. */
+function taskRecordSharesGateCwd(recordCwd: string, gateCwd: string): boolean {
+	if (recordCwd === gateCwd) return true;
+	try {
+		const realRecord = fs.realpathSync.native(recordCwd);
+		const realGate = fs.realpathSync.native(gateCwd);
+		if (realRecord === realGate) return true;
+		// Ancestor containment: is realGate strictly inside realRecord? (Symlink
+		// loops / unresolvable sides already fell to the catch below — the
+		// existing fail-closed fallback pattern.)
+		const rel = path.relative(realRecord, realGate);
+		return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+	} catch {
+		return false;
+	}
+}
+
+/** S-1 hardening (2026-10-31, security HIGH follow-up): the tool-granting
+ *  layer normalizes underscore→hyphen role keys before its permission lookup
+ *  (agents/agent-config.ts normalizeRoleKey + permissionForRole, F10), so a
+ *  dispatched `test_engineer` / `cold_verifier` / `chain_executor` role is
+ *  WRITE-capable at the worker — but the guard's un-normalized lookup here
+ *  default-denied it to read_only, leaving the guard inert for exactly the
+ *  roles it exists to catch (the S-1 exploit preserved). Mirrored locally
+ *  (3 lines) instead of imported: agent-config.ts is not in this module's
+ *  bundle-graph budget (see the check-lazy-imports precedent comments above).
+ *  TODO(role-key-normalization): un-normalized permissionForRole copies also
+ *  exist at task-runner/pre-execution.ts:248, spawn-policy.ts:184 and
+ *  task-runner/prompt-builder.ts:29 — centralize normalizeRoleKey next to
+ *  permissionForRole (role-permission.ts) and consume it from every site. */
+function normalizeRoleKeyForGuard(role: string): string {
+	return role.includes("_") ? role.replaceAll("_", "-") : role;
+}
+
+/** S-1: task ids whose execution wrote into the gate cwd through paths no
+ *  pinned binding can see: write-capable role + EXECUTED + no worktree of
+ *  its own + same cwd (or an ancestor of it). Tracked writes are already
+ *  covered by the W2 tree binding; this closes the GITIGNORED remainder
+ *  (node_modules shims) that every binding deliberately excludes. */
+function findSharedCwdUntrackedHarnessWriters(records: readonly VerifierGateTaskRecord[] | undefined, gateCwd: string): string[] {
+	if (!records || records.length === 0) return [];
+	const writers: string[] = [];
+	for (const record of records) {
+		if (record.worktreePath) continue;
+		if (!EXECUTED_TASK_STATUSES.has(record.status)) continue;
+		if (permissionForRole(normalizeRoleKeyForGuard(record.role)) !== "workspace_write") continue;
+		if (!taskRecordSharesGateCwd(record.cwd, gateCwd)) continue;
+		writers.push(record.taskId);
+	}
+	return writers;
+}
+
+/**
+ * S-1 guard (shared-cwd-untracked-harness): in shared-cwd mode the gate runs
+ * its checks in the SAME directory a WRITE-role executor just wrote to
+ * (worktree-manager returns { cwd: task.cwd } for non-worktree runs), and the
+ * dispatch-pinned bindings cover TRACKED content only — gitignored harness
+ * files (node_modules shims) sit outside every binding, so a tampered harness
+ * could grade its own gate and skip the LLM verifier. When the host's task
+ * records show any write-role task EXECUTED in the gate cwd, the
+ * deterministic skip is refused and the LLM verifier spawns with the guard
+ * note (reason "shared-cwd-untracked-harness") — fresh AND memoized PASS
+ * verdicts, exactly like the W2 worktree guard. Non-skip decisions pass
+ * through untouched. Worktree mode is unaffected (records carrying a
+ * worktreePath are skipped here; their uncommitted work is the W2 probe's
+ * job, and a clean dependency worktree keeps the skip).
+ *
+ * Residual (documented, same class as the W2 probe source): the records are
+ * the host's best view, re-read from tasks.json — a worker that forges its
+ * own record (role/status) in that file evades this guard; state-store
+ * integrity is a separate lane, not the gate's.
+ */
+function applySharedCwdHarnessGuard(
+	records: readonly VerifierGateTaskRecord[] | undefined,
+	gateCwd: string,
+	previous: { outcome: VerifyGateOutcome; decision: VerifierSpawnDecision; forcedSpawn: boolean },
+): { outcome: VerifyGateOutcome; decision: VerifierSpawnDecision; forcedSpawn: boolean } {
+	if (!previous.decision.skipVerifier || !records || records.length === 0) return previous;
+	const writers = findSharedCwdUntrackedHarnessWriters(records, gateCwd);
+	if (writers.length === 0) return previous;
+	const note = `shared-cwd-harness: write-role task(s) ${writers.join(", ")} executed in the gate's own cwd — gitignored harness files (e.g. node_modules shims) there sit outside every dispatch-pinned binding, so this PASS cannot certify the harness it ran; refusing the deterministic skip`;
+	return {
+		outcome: { ...previous.outcome, evidenceLines: [...previous.outcome.evidenceLines, note] },
+		decision: { skipVerifier: false, reason: "shared-cwd-untracked-harness", attachGateContext: true },
+		forcedSpawn: true,
+	};
+}
+
 export interface VerifierGatePreGateInput {
 	cwd: string;
 	/** Explicit checks take precedence over every other source (tool path /
@@ -770,6 +906,16 @@ export interface VerifierGatePreGateInput {
 	 *  that structurally excludes that work) and the LLM verifier spawns with
 	 *  the guard note (reason "unverified_worktree_work"). */
 	dependencyWorktreeProbes?: VerifierGateWorkProbe[];
+	/** S-1 (shared-cwd-untracked-harness, HIGH, 2026-10-31): host-owned records
+	 *  for every task in the run EXCEPT the verifier itself. When any record
+	 *  shows a write-capable role (role-permission WRITE_ROLES) that EXECUTED
+	 *  in the gate cwd with no worktree of its own (shared-cwd mode), a gate
+	 *  PASS — fresh OR memoized — refuses the skipVerifier decision (gitignored
+	 *  harness files in the gate cwd sit outside every dispatch-pinned binding)
+	 *  and the LLM verifier spawns with the guard note (reason
+	 *  "shared-cwd-untracked-harness"). Absent/empty ⇒ guard inert (pre-S-1
+	 *  behavior). */
+	taskRecords?: VerifierGateTaskRecord[];
 }
 
 export interface VerifierGatePreGateResult {
@@ -877,7 +1023,14 @@ export async function runVerifierGatePreGate(input: VerifierGatePreGateInput): P
 			// W2: the guard runs on memo hits too — a recorded PASS for a pristine
 			// tree must not skip the verifier when the verified dependency work
 			// lives outside this tree (the original finding-3 memo-replay PoC).
-			const guarded = resolveWorktreeGuardDecision(input.dependencyWorktreeProbes, memoHit);
+			// S-1: the shared-cwd harness guard chains after it — a memoized PASS
+			// must not skip either when a write-role task executed in the gate cwd
+			// (gitignored harness tampering is invisible to the memo's tree key).
+			const guarded = applySharedCwdHarnessGuard(
+				input.taskRecords,
+				input.cwd,
+				resolveWorktreeGuardDecision(input.dependencyWorktreeProbes, memoHit),
+			);
 			incMetric(input.metricRegistry, "crew.verification.verify_gate_runs_total", "Deterministic verify_gate executions by verdict", {
 				verdict: guarded.outcome.verdict,
 			});
@@ -888,12 +1041,21 @@ export async function runVerifierGatePreGate(input: VerifierGatePreGateInput): P
 				{},
 			);
 			if (guarded.forcedSpawn) {
-				incMetric(
-					input.metricRegistry,
-					"crew.verification.verifier_gate_worktree_guard_total",
-					"W2: PASS-skip refusals — dependency worktree work the gate's evaluated tree does not contain",
-					{ result: "spawn_forced" },
-				);
+				if (guarded.decision.reason === "shared-cwd-untracked-harness") {
+					incMetric(
+						input.metricRegistry,
+						"crew.verification.verifier_gate_shared_cwd_guard_total",
+						"S-1: PASS-skip refusals — write-role execution in the gate's shared cwd (gitignored harness outside pinned bindings)",
+						{ result: "spawn_forced" },
+					);
+				} else {
+					incMetric(
+						input.metricRegistry,
+						"crew.verification.verifier_gate_worktree_guard_total",
+						"W2: PASS-skip refusals — dependency worktree work the gate's evaluated tree does not contain",
+						{ result: "spawn_forced" },
+					);
+				}
 			}
 			if (guarded.decision.skipVerifier) {
 				incMetric(
@@ -999,27 +1161,53 @@ export async function runVerifierGatePreGate(input: VerifierGatePreGateInput): P
 	// `input.classifier` stays on the interface (deprecated) because the dispatch
 	// call site in task-runner.ts passes it; removing the field is a follow-up
 	// that must land with that call site.
-	// ── W10-2: record the green verdict for same-tree memoization (AFTER the
-	// post-bookend — a drift-downgraded INCONCLUSIVE must never memoize).
-	if (outcome.verdict === "PASS" && recordVerifyGateMemo(input.cwd, checks, outcome)) {
-		incMetric(
-			input.metricRegistry,
-			"crew.verification.verify_gate_memo_records_total",
-			"W10-2 PASS verdicts recorded for same-tree memoization",
-			{},
-		);
-	}
 	const preGate: VerifierPreGateResult | undefined = undefined;
 	// W2: the guard runs on fresh verdicts too — a green gate in the verifier's
 	// own pristine worktree must not skip the verifier when the dependency work
 	// it certifies lives in other, uncommitted worktrees.
-	const guarded = resolveWorktreeGuardDecision(input.dependencyWorktreeProbes, outcome);
+	// S-1: the shared-cwd harness guard chains after it — a fresh PASS in a cwd a
+	// write-role task executed in must not skip either (gitignored harness
+	// tampering sits outside every binding this gate can pin).
+	const guarded = applySharedCwdHarnessGuard(
+		input.taskRecords,
+		input.cwd,
+		resolveWorktreeGuardDecision(input.dependencyWorktreeProbes, outcome),
+	);
 	if (guarded.forcedSpawn) {
+		if (guarded.decision.reason === "shared-cwd-untracked-harness") {
+			incMetric(
+				input.metricRegistry,
+				"crew.verification.verifier_gate_shared_cwd_guard_total",
+				"S-1: PASS-skip refusals — write-role execution in the gate's shared cwd (gitignored harness outside pinned bindings)",
+				{ result: "spawn_forced" },
+			);
+		} else {
+			incMetric(
+				input.metricRegistry,
+				"crew.verification.verifier_gate_worktree_guard_total",
+				"W2: PASS-skip refusals — dependency worktree work the gate's evaluated tree does not contain",
+				{ result: "spawn_forced" },
+			);
+		}
+	}
+	// ── W10-2: record the green verdict for same-tree memoization (AFTER the
+	// post-bookend — a drift-downgraded INCONCLUSIVE must never memoize; AFTER
+	// the guards — M-ruling 2026-10-31: a PASS refused by the shared-cwd
+	// harness guard was produced under a harness the gate cannot certify, so
+	// it must never memoize and replay as a skip in a later run whose
+	// taskRecords happen to be absent/empty. The W2 refusal does NOT suppress
+	// the record — its memo-hit path re-checks the probes on every replay,
+	// and the certified tree itself stays sound.)
+	if (
+		outcome.verdict === "PASS" &&
+		!(guarded.forcedSpawn && guarded.decision.reason === "shared-cwd-untracked-harness") &&
+		recordVerifyGateMemo(input.cwd, checks, outcome)
+	) {
 		incMetric(
 			input.metricRegistry,
-			"crew.verification.verifier_gate_worktree_guard_total",
-			"W2: PASS-skip refusals — dependency worktree work the gate's evaluated tree does not contain",
-			{ result: "spawn_forced" },
+			"crew.verification.verify_gate_memo_records_total",
+			"W10-2 PASS verdicts recorded for same-tree memoization",
+			{},
 		);
 	}
 	outcome = guarded.outcome;