pi-crew 0.9.12 → 0.9.14

package/src/runtime/child-pi.ts

@@ -17,6 +17,7 @@ import { sanitizeEnvSecrets } from "../utils/env-filter.ts";
 import { registerChildProcess, unregisterChildProcess } from "../extension/crew-cleanup.ts";
 import { classifyProcessCrash } from "./crash-classification.ts";
 import { resolveRealContainedPath } from "../utils/safe-paths.ts";
+import { extractText } from "./pi-json-output.ts";
 
 const POST_EXIT_STDIO_GUARD_MS = DEFAULT_CHILD_PI.postExitStdioGuardMs;
 const FINAL_DRAIN_MS = DEFAULT_CHILD_PI.finalDrainMs;
@@ -218,11 +219,24 @@ export interface ChildPiRunResult {
 	stdout: string;
 	stderr: string;
 	error?: string;
+	/** RAW (uncapped) final assistant text, captured at stream-parse time BEFORE
+	 *  the 16K transcript compaction. This is the AUTHORITATIVE worker output —
+	 *  it becomes results/<id>.txt so downstream dependencies are not bounded by
+	 *  the transcript's telemetry cap. Undefined when no assistant text was seen
+	 *  (mock paths, error paths) — callers MUST fall back to transcript-derived
+	 *  finalText. See research-findings/output-handling-deep-dive.md §A. */
+	rawFinalText?: string;
 	exitStatus?: WorkerExitStatus;
 	/** True if the agent was hard-aborted (max_turns + grace exceeded). */
 	aborted?: boolean;
 	/** True if the agent was steered to wrap up (hit soft turn limit) but finished in time. */
 	steered?: boolean;
+	/** #7 hardening: bounded digest of intermediate findings (last N tool results or
+	 *  assistant text lines) from the run. Populated by ChildPiLineObserver so that
+	 *  workers that exhaust their budget on tool calls (never emit final assistant
+	 *  text) still produce a non-empty result. Consumers should prefer rawFinalText
+	 *  first — this is a last-resort fallback. */
+	intermediateFindings?: string;
 }
 
 export function buildChildPiSpawnOptions(cwd: string, env: NodeJS.ProcessEnv): SpawnOptions {
@@ -512,6 +526,18 @@ function compactChildPiLine(line: string): { persistedLine: string; event?: unkn
 export class ChildPiLineObserver {
 	private buffer = "";
 	private readonly input: ChildPiRunInput;
+	/** RAW (uncapped) assistant-text fragments, accumulated in arrival order.
+	 *  Mirrors {@link parsePiJsonOutput}'s textEvents/finalText extraction but
+	 *  operates on the RAW event stream instead of the 16K-compacted transcript.
+	 *  This is the source of the AUTHORITATIVE result.txt; the transcript stays
+	 *  compacted (memory bound). */
+	private readonly rawTextEvents: string[] = [];
+	/** #7 hardening: bounded digest of intermediate findings. When a worker spends
+	 *  its entire budget on tool calls (never emits a final assistant text),
+	 *  getRawFinalText() returns undefined but this digest captures the last
+	 *  display lines (tool results, stdout fragments) before budget exhaustion.
+	 *  Capped at MAX_INTERMEDIATE_DIGEST_LINES so result artifacts stay bounded. */
+	private readonly intermediateFindings: string[] = [];
 
 	constructor(input: ChildPiRunInput) {
 		this.input = input;
@@ -531,8 +557,50 @@ export class ChildPiLineObserver {
 		this.emitLine(line);
 	}
 
+	/** Last non-empty RAW assistant text (mirrors {@link parsePiJsonOutput}'s
+	 *  finalText semantics but uncapped). Undefined when no assistant text was
+	 *  seen by this observer. {@link extractText} already drops empty fragments,
+	 *  so the last entry is the final assistant utterance. */
+	getRawFinalText(): string | undefined {
+		return this.rawTextEvents.length > 0 ? this.rawTextEvents[this.rawTextEvents.length - 1] : undefined;
+	}
+
+	/** #7 hardening: returns a bounded digest of intermediate findings accumulated
+	 *  during the run. This is NOT the final answer — it is a best-effort capture
+	 *  of the last assistant text or tool-result display lines before budget
+	 *  exhaustion. Only populated when getRawFinalText() would return undefined.
+	 *  @param maxChars - maximum total characters to return (default 500). */
+	getIntermediateFindings(maxChars = 500): string {
+		const MAX_INTERMEDIATE_DIGEST_LINES = 20;
+		if (this.intermediateFindings.length === 0) return "";
+		// Take the last N lines and join, then cap.
+		const lines = this.intermediateFindings.slice(-MAX_INTERMEDIATE_DIGEST_LINES);
+		const joined = lines.join("\n");
+		if (joined.length <= maxChars) return joined;
+		// Return the tail within the budget.
+		return joined.slice(-maxChars);
+	}
+
 	private emitLine(line: string): void {
 		if (!line.trim()) return;
+		// Parse the RAW line once so we can BOTH compact it (telemetry transcript,
+		// 16K-capped memory bound) AND capture the uncapped assistant text for the
+		// authoritative result. Non-JSON lines contribute no assistant text.
+		try {
+			const rawParsed = JSON.parse(line);
+			const rawTexts = extractText(rawParsed);
+			if (rawTexts.length > 0) {
+				this.rawTextEvents.push(...rawTexts);
+				// Also capture raw assistant text as intermediate findings — the last raw
+				// text may be a partial answer before the worker ran out of budget.
+				const last = rawTexts[rawTexts.length - 1];
+				if (last.trim().length > 0) {
+					this.intermediateFindings.push(last.trim());
+				}
+			}
+		} catch {
+			// Not valid JSON — compactChildPiLine handles the raw-text fallback below.
+		}
 		const compact = compactChildPiLine(line);
 		if (compact.event !== undefined) {
 			try {
@@ -548,6 +616,10 @@ export class ChildPiLineObserver {
 			} catch (error) {
 				logInternalError("child-pi.on-stdout-line", error, `line=${compact.displayLine}`);
 			}
+			// #7 hardening: capture display lines (tool results, stdout) as intermediate
+			// findings. This ensures we capture tool output even when no assistant text
+			// is emitted (budget exhausted on tool calls).
+			this.intermediateFindings.push(compact.displayLine!.trim());
 		}
 	}
 }
@@ -795,6 +867,51 @@ export async function runChildPi(input: ChildPiRunInput): Promise<ChildPiRunResu
 					} catch (error) {
 						logInternalError("child-pi.response-timeout-term", error, `pid=${child.pid}`);
 					}
+					// #3 hardening: if the child never exits (zombie) and neither the
+					// 'exit' nor 'close' event ever fires, the promise would hang forever.
+					// SIGKILL fires ~3s after SIGTERM via hardKillTimer in killProcessPid,
+					// but on platforms where SIGKILL also fails (e.g. permission issues),
+					// add a bounded safety settle so the promise always resolves. Using
+					// hardKillMs + 2s as the safety window: enough for SIGKILL to work
+					// normally, but forces settle if the process is truly immortal.
+					// NOTE: we do NOT clear hardKillTimer here (that would defeat its purpose);
+					// we intentionally add a parallel safety path.
+					const SAFETY_SETTLE_MS = HARD_KILL_MS + 2000;
+					const safetyTimer = setTimeout(() => {
+						if (settled || childExited) return;
+						logInternalError(
+							"child-pi.settle-safety-fired",
+							new Error(`Child did not exit within ${SAFETY_SETTLE_MS}ms of kill; forcing settle`),
+							`pid=${child.pid}, responseTimeoutMs=${responseTimeoutMs}`,
+						);
+						// Verify the child is still alive before forcing settle.
+						// If it somehow exited between childExited=false and here, the
+						// settled/childExited guard prevents double-settle (harmless but noisy).
+						try {
+							process.kill(child.pid!, 0);
+							// Child still alive — force settle with timeout error.
+							const timeoutErr = `Child Pi produced no new output for ${responseTimeoutMs}ms; killed but did not exit within ${SAFETY_SETTLE_MS}ms (possible zombie).`;
+							settle({
+								exitCode: null,
+								stdout,
+								stderr,
+								error: timeoutErr,
+								exitStatus: {
+									exitCode: null,
+									cancelled: abortRequested,
+									timedOut: true,
+									killed: hardKilled,
+									cleanupErrors,
+									finalDrainMs,
+									crashClass: "timeout",
+								},
+							});
+						} catch {
+							// ESRCH / EPERM — child is already gone. The 'exit'/'close' handler
+							// will fire shortly (or already fired in a race). Let it settle normally.
+						}
+					}, SAFETY_SETTLE_MS);
+					safetyTimer.unref();
 				}, responseTimeoutMs);
 				noResponseTimer.unref();
 			};
@@ -919,6 +1036,8 @@ export async function runChildPi(input: ChildPiRunInput): Promise<ChildPiRunResu
 				try {
 					resolve({
 						...result,
+						rawFinalText: lineObserver.getRawFinalText(),
+						intermediateFindings: lineObserver.getIntermediateFindings(),
 						exitStatus: result.exitStatus ?? {
 							exitCode: result.exitCode,
 							cancelled: abortRequested,

package/src/runtime/goal-achievement.ts

@@ -0,0 +1,131 @@
+/**
+ * #2 (assessment): goal-achievement detection — kills the "false-green" lie.
+ *
+ * The v0.9.13 assessment found run team_20260626170635 reported terminal-success
+ * ("completed") while its verifier wrote: "did NOT apply ANY of the three
+ * security fixes. git diff --stat for all 6 target files is empty… Tests are
+ * green only because nothing was changed." The run status LIED.
+ *
+ * This module assesses whether a completed run actually achieved its goal, so
+ * the false-green is no longer SILENT. It is deliberately conservative:
+ *   - read-only / doc-only workflows are never accused (they legitimately make
+ *     no project-code edits; their outputs land in gitignored .crew/),
+ *   - a false-green is only flagged for CODE-MUTATING runs (executor /
+ *     test-engineer steps) in a git repo whose working tree is empty,
+ *   - status is downgraded to "failed" ONLY when a corroborating signal (a
+ *     task that actually failed) confirms it; otherwise the suspicion is
+ *     exposed via `goalAchieved=false` + a prominent event + manifest note,
+ *     without breaking a legitimately-no-op run.
+ */
+import { spawnSync } from "node:child_process";
+import type { TeamRunManifest, TeamTaskState } from "../state/types.ts";
+import type { WorkflowConfig } from "../workflows/workflow-config.ts";
+import { findRepoRoot } from "../utils/paths.ts";
+
+/**
+ * Roles whose job is to EDIT project source/test files (changes that appear in
+ * `git status`). Deliberately NARROW: writer/verifier/security-reviewer write
+ * reports (often to gitignored .crew/), so an empty diff is NOT a failure
+ * signal for them. Only executor/test-engineer MUST touch project code.
+ */
+export const MUTATING_ROLES = new Set<string>(["executor", "test-engineer"]);
+
+export type GoalAchieved = boolean | "unknown";
+
+export interface GoalAchievementAssessment {
+	achieved: GoalAchieved;
+	reason: string;
+	/** human-readable corroborating signals (for events/manifest) */
+	signals: string[];
+}
+
+/** Does this workflow contain any code-mutating role step? */
+export function workflowIsMutating(workflow: WorkflowConfig | undefined): boolean {
+	const steps = workflow?.steps ?? [];
+	return steps.some((step) => typeof step?.role === "string" && MUTATING_ROLES.has(step.role));
+}
+
+/** Is the working tree of the repo containing `cwd` clean (no changes)? Throws-safe. */
+export function isGitWorkingTreeClean(cwd: string): { clean: boolean; repoRoot: string } | { clean: "unknown"; repoRoot: undefined } {
+	try {
+		const repoRoot = findRepoRoot(cwd);
+		if (!repoRoot) return { clean: "unknown", repoRoot: undefined };
+		// `git status --porcelain` → empty stdout means a clean working tree.
+		const res = spawnSync("git", ["-C", repoRoot, "status", "--porcelain"], { encoding: "utf8", timeout: 5_000 });
+		if (res.error || res.status !== 0) return { clean: "unknown", repoRoot: undefined };
+		return { clean: res.stdout.trim().length === 0, repoRoot };
+	} catch {
+		return { clean: "unknown", repoRoot: undefined };
+	}
+}
+
+/**
+ * Assess whether a completed run achieved its goal. Pure function over manifest
+ * + tasks + workflow — no side effects, easy to unit-test.
+ */
+export function assessGoalAchievement(
+	manifest: TeamRunManifest,
+	tasks: TeamTaskState[],
+	workflow: WorkflowConfig | undefined,
+): GoalAchievementAssessment {
+	// (1) Only code-mutating workflows can be false-green. Read-only/doc runs
+	//     legitimately make no project edits — never accuse them.
+	if (!workflowIsMutating(workflow)) {
+		return { achieved: "unknown", reason: "read-only / doc-only workflow (no executor/test-engineer steps)", signals: [] };
+	}
+
+	// (2) Need a git repo to inspect the working tree.
+	const tree = isGitWorkingTreeClean(manifest.cwd);
+	if (tree.clean === "unknown" || !tree.repoRoot) {
+		return { achieved: "unknown", reason: "not a git repo or git unavailable", signals: [] };
+	}
+
+	// (3) Non-empty working tree → the mutating run made edits. Achieved.
+	if (!tree.clean) {
+		return { achieved: true, reason: "git working tree has changes (mutating run edited project files)", signals: [`repoRoot=${tree.repoRoot}`] };
+	}
+
+	// (4) Mutating run + CLEAN working tree → suspicious. The executor's job was
+	//     to edit code and it left zero diff. This is the false-green signature.
+	const failedTask = tasks.find((t) => t.status === "failed");
+	const signals = ["git working tree clean despite mutating workflow"];
+	if (failedTask) signals.push(`corroborating failed task: ${failedTask.id} (${failedTask.role})`);
+
+	return {
+		// `false` = false-green detected. Whether to downgrade status is decided
+		// by the caller based on the corroborating failed-task signal.
+		achieved: false,
+		reason: "code-mutating run completed but made no project edits (false-green)",
+		signals,
+	};
+}
+
+/**
+ * Apply an assessment to a run result: set manifest.goalAchieved + note, and
+ * decide whether to downgrade status. Returns the (possibly mutated) manifest.
+ *
+ * Downgrade rule (conservative): only flip "completed" → "failed" when a
+ * corroborating failed-task signal is present. Otherwise expose goalAchieved
+ * = false + a manifest note + let the caller emit an event, but leave status
+ * intact so a legitimately-no-op mutating run is not broken.
+ */
+export function applyGoalAchievement(
+	manifest: TeamRunManifest,
+	assessment: GoalAchievementAssessment,
+): { manifest: TeamRunManifest; downgraded: boolean } {
+	const note = assessment.achieved === false
+		? `goal-achievement: FALSE-GREEN — ${assessment.reason}. ${assessment.signals.join("; ")}`
+		: assessment.achieved === true
+			? `goal-achievement: OK — ${assessment.reason}`
+			: `goal-achievement: unknown — ${assessment.reason}`;
+
+	const updated: TeamRunManifest = { ...manifest, goalAchieved: assessment.achieved, goalAchievementNote: note };
+
+	// Downgrade only on the highest-confidence false-green: a failed task
+	// corroborates that the run genuinely did not succeed.
+	const hasCorroboratingFailure = assessment.signals.some((s) => s.startsWith("corroborating failed task"));
+	if (assessment.achieved === false && hasCorroboratingFailure && updated.status === "completed") {
+		return { manifest: { ...updated, status: "failed" }, downgraded: true };
+	}
+	return { manifest: updated, downgraded: false };
+}

package/src/runtime/handoff-manager.ts

@@ -99,6 +99,9 @@ export interface HandoffSummary {
 
 	// Context snapshot
 	contextSnapshot: string;
+
+	/** Worker output text propagated through the chain (read from resultArtifact). */
+	outputText?: string;
 }
 
 /**
@@ -121,6 +124,9 @@ export interface TaskResult {
 	filesDeleted?: string[];
 	decisions?: Decision[];
 	error?: string;
+
+	/** Worker's textual output (read from resultArtifact during chain execution). */
+	outputText?: string;
 }
 
 /**
@@ -443,6 +449,7 @@ export class HandoffManager {
 			},
 
 			contextSnapshot,
+			...(result.outputText ? { outputText: result.outputText } : {}),
 		};
 	}
 

package/src/runtime/live-session-runtime.ts

@@ -4,8 +4,13 @@ import type { AgentConfig } from "../agents/agent-config.ts";
 import type { CrewRuntimeConfig } from "../config/config.ts";
 import type { TeamRunManifest, TeamTaskState, UsageState } from "../state/types.ts";
 import { appendEvent } from "../state/event-log.ts";
-import { buildMemoryBlock } from "./agent-memory.ts";
 import { trackTaskUsage } from "./usage-tracker.ts";
+// NOTE: buildMemoryBlock is intentionally NOT imported here. The agent memory
+// block is injected via renderTaskPrompt().full (the USER prompt), which is
+// shared by both the child-pi path (no system prompt) and the live-session
+// path. Adding it to liveSystemPrompt() too duplicated the entire memory
+// block (up to 200 lines) in both the user and system prompts. Keep memory
+// in a single place: the shared user prompt. See G3 fix.
 import { createStreamingOutput, type StreamingOutputHandle } from "./streaming-output.ts";
 import { registerLiveAgent, disposeLiveAgentSession, terminateLiveAgent, updateLiveAgentStatus, trackLiveAgentToolStart, trackLiveAgentToolEnd, trackLiveAgentTurnEnd, trackLiveAgentResponseText, markLiveAgentCompleted } from "./live-agent-manager.ts";
 import { applyLiveAgentControlRequest, applyLiveAgentControlRequests, type LiveAgentControlCursor } from "./live-agent-control.ts";
@@ -371,8 +376,10 @@ function compressSessionToolDescriptions(session: LiveSessionLike): void {
 	// is loaded and tree-shakeable, so adding the actual logic later is trivial.
 }
 
-function liveSystemPrompt(input: LiveSessionSpawnInput): string {
-	const memory = input.agent.memory ? buildMemoryBlock(input.agent.name, input.agent.memory, input.task.cwd, Boolean(input.agent.tools?.some((tool) => tool === "write" || tool === "edit"))) : "";
+export function liveSystemPrompt(input: LiveSessionSpawnInput): string {
+	// Agent MEMORY is intentionally omitted here — it is already injected via
+	// renderTaskPrompt().full (the user prompt, shared with the child-pi path).
+	// See the import-block note above and the G3 fix.
 	const role = input.task.role;
 	const styleBlock = buildCommunicationStyle(role);
 	const contractBlock = buildOutputContract(role);
@@ -390,7 +397,6 @@ function liveSystemPrompt(input: LiveSessionSpawnInput): string {
 		sensitiveConstraint,
 		"",
 		input.agent.systemPrompt || "Follow the user task exactly and report verification evidence.",
-		memory ? `\n${memory}` : "",
 	].filter(Boolean).join("\n");
 }
 

package/src/runtime/pi-json-output.ts

@@ -75,7 +75,11 @@ function textFromContent(content: unknown): string[] {
 	return text;
 }
 
-function extractText(value: unknown): string[] {
+/** Extract assistant-text fragments from a parsed Pi JSON event.
+ *  Exported so {@link ChildPiLineObserver} can capture the RAW (uncapped)
+ *  assistant text for the authoritative result, mirroring the extraction
+ *  order this function uses inside {@link parsePiJsonOutput}. */
+export function extractText(value: unknown): string[] {
 	const obj = asRecord(value);
 	if (!obj) return [];
 	const message = asRecord(obj.message);

package/src/runtime/recovery-recipes.ts

@@ -72,3 +72,38 @@ export function buildRecoveryLedger(decisions: PolicyDecision[], previous: Recov
 	}
 	return { entries };
 }
+
+/**
+ * #4 (assessment): decide whether a FAILED task should be re-queued for a
+ * whole-task rerun, honoring limits.maxRetriesPerTask.
+ *
+ * Before #4, buildRecoveryLedger recorded `rerun_task` entries with
+ * state:"planned" but NOTHING ever executed them — the recovery ledger was
+ * decorative. This pure function drives the actual re-queue decision used in
+ * the run loop: when a task returns a failed STATUS (not a retryable throw,
+ * which #1's autoRetry/executeWithRetry already handles), re-queue it for a
+ * bounded whole-task rerun instead of immediately aborting the run.
+ *
+ * Default-off: maxRetriesPerTask defaults to 0 → never rerun (preserves prior
+ * behavior unless explicitly opted in). Bounded by retryCount < maxRetries.
+ */
+export interface RerunDecision {
+	rerun: boolean;
+	newRetryCount: number;
+	reason: string;
+}
+
+export function shouldRerunFailedTask(
+	task: { policy?: { retryCount?: number } },
+	limits?: { maxRetriesPerTask?: number },
+): RerunDecision {
+	const maxRetries = limits?.maxRetriesPerTask ?? 0;
+	const retryCount = task.policy?.retryCount ?? 0;
+	if (maxRetries <= 0) {
+		return { rerun: false, newRetryCount: retryCount, reason: "maxRetriesPerTask not set (opt-in) — no whole-task rerun" };
+	}
+	if (retryCount >= maxRetries) {
+		return { rerun: false, newRetryCount: retryCount, reason: `retryCount ${retryCount} >= maxRetriesPerTask ${maxRetries} — rerun budget exhausted` };
+	}
+	return { rerun: true, newRetryCount: retryCount + 1, reason: `whole-task rerun ${retryCount + 1}/${maxRetries}` };
+}

package/src/runtime/task-output-context.ts

@@ -14,6 +14,12 @@ export interface DependencyContextEntry {
 	status: string;
 	resultSummary: string;
 	resultPath?: string;
+	/** Absolute path to the FULL (untruncated) result, teed when the inline
+	 *  resultSummary was materially truncated (>TEE_THRESHOLD_MULTIPLIER). The
+	 *  downstream worker can `read` this to recover the dropped middle. Mirrors
+	 *  the sharedReads recovery path so dependency injection is no longer
+	 *  circular (re-reading resultPath used to yield the same truncated text). */
+	fullOutputPath?: string;
 	structuredResults?: Record<string, unknown>;
 	artifactsProduced?: string[];
 	usage?: { inputTokens: number; outputTokens: number; durationMs: number };
@@ -50,6 +56,16 @@ function containedExists(filePath: string, baseDir?: string): boolean {
  */
 export const MAX_RESULT_INLINE_BYTES = 32_000;
 
+/**
+ * Tee-recovery multiplier (R2). A shared artifact is teed to disk — so the
+ * downstream worker can `read` the dropped middle — when its size exceeds
+ * this fraction of {@link MAX_RESULT_INLINE_BYTES}. Lowered from 2.0
+ * (64 KB) to 1.25 (40 KB) so the 32–64 KB band, where the head+tail split
+ * is already materially lossy for structured content, also gets a recovery
+ * path instead of losing the middle forever.
+ */
+export const TEE_THRESHOLD_MULTIPLIER = 1.25;
+
 /**
  * Read a file and return its content, truncating to a head+tail slice if it
  * exceeds {@link MAX_RESULT_INLINE_BYTES} characters. Multi-byte UTF-8
@@ -110,10 +126,11 @@ function writeTeeFile(fullOutputPath: string, content: string): boolean {
  * content AND (when tee was actually written) the absolute path to the full
  * file. Returns undefined if the file cannot be read at all.
  *
- * Tee threshold: only when content.length > 2 * MAX_RESULT_INLINE_BYTES
- * (the head+tail is materially lossy — small over-threshold files are not
- * teed because the inline content is mostly intact and the worker can live
- * with the 75/25 split). File content is read once and reused for both the
+ * Tee threshold: only when content.length > TEE_THRESHOLD_MULTIPLIER ×
+ * MAX_RESULT_INLINE_BYTES (R2: 1.25× = 40 KB; previously 2× = 64 KB). Below
+ * the tee threshold the head+tail split is mostly intact and the worker can
+ * live with it; at/above the threshold the dropped middle is recoverable via
+ * the teed full file. File content is read once and reused for both the
  * pipeline (truncation) and the tee write (full file).
  *
  * Truncation behavior is unchanged from the P0-A pipeline: ANSI strip +
@@ -131,8 +148,10 @@ export function readIfSmallWithTee(
 		const content = fs.readFileSync(safePath, "utf-8");
 		if (content.length > maxChars) {
 			let fullOutputPath: string | undefined;
-			// Tee only when truncation is materially lossy (>2× threshold).
-			if (opts.tee && content.length > maxChars * 2) {
+			// Tee when truncation is materially lossy (>TEE_THRESHOLD_MULTIPLIER ×
+			// threshold). R2: lowered from 2× (64 KB) to 1.25× (40 KB) so the
+			// 32–64 KB band also gets a recovery path.
+			if (opts.tee && content.length > maxChars * TEE_THRESHOLD_MULTIPLIER) {
 				if (writeTeeFile(opts.tee.fullOutputPath, content)) {
 					fullOutputPath = opts.tee.fullOutputPath;
 				}
@@ -267,13 +286,18 @@ export function collectDependencyOutputContext(manifest: TeamRunManifest, tasks:
 	const byStep = new Map(tasks.map((item) => [item.stepId, item]).filter((entry): entry is [string, TeamTaskState] => Boolean(entry[0])));
 	const byId = new Map(tasks.map((item) => [item.id, item]));
 	const dependencies = task.dependsOn.map((dep) => byStep.get(dep) ?? byId.get(dep)).filter((item): item is TeamTaskState => Boolean(item)).map((item) => {
-		const resultText = item.resultArtifact ? readIfSmall(item.resultArtifact.path, manifest.artifactsRoot) : undefined;
+		const fullOutputPath = item.resultArtifact ? teePathForArtifact(manifest.artifactsRoot, task.id, item.id) : undefined;
+		const teeResult = item.resultArtifact
+			? readIfSmallWithTee(item.resultArtifact.path, { baseDir: manifest.artifactsRoot, ...(fullOutputPath ? { tee: { fullOutputPath } } : {}) })
+			: undefined;
+		const resultText = teeResult?.content;
 		return {
 			taskId: item.id,
 			role: item.role,
 			status: item.status,
 			resultSummary: resultText ?? "",
 			resultPath: item.resultArtifact?.path,
+			...(teeResult?.fullOutputPath ? { fullOutputPath: teeResult.fullOutputPath } : {}),
 			structuredResults: resultText ? tryParseJson(resultText) : undefined,
 			artifactsProduced: listTaskArtifacts(manifest, item.id),
 			usage: aggregateUsage(item),
@@ -317,6 +341,11 @@ export function renderDependencyOutputContext(context: DependencyOutputContext):
 		parts.push("# Dependency Outputs", "");
 		for (const dep of context.dependencies) {
 			parts.push(`## ${dep.taskId} (${dep.role})`, `Status: ${dep.status}`, dep.resultPath ? `Result artifact: ${dep.resultPath}` : "", "", dep.resultSummary?.trim() || "(no result output)", "");
+			// P1-A dependency tee-recovery hint: when the dependency's result was
+			// materially truncated (>1.25× MAX_RESULT_INLINE_BYTES) the full RAW
+			// content was teed to fullOutputPath. Mirrors the sharedReads hint so the
+			// downstream worker can read the dropped middle instead of re-deriving.
+			if (dep.fullOutputPath) parts.push(`Full output (if you need the missing middle): ${dep.fullOutputPath}`, "");
 			if (dep.structuredResults) parts.push("Structured results:", JSON.stringify(dep.structuredResults, null, 2), "");
 			if (dep.artifactsProduced?.length) parts.push(`Artifacts produced: ${dep.artifactsProduced.join(", ")}`, "");
 			if (dep.usage) parts.push(`Usage: ${dep.usage.inputTokens} input tokens, ${dep.usage.outputTokens} output tokens, ${dep.usage.durationMs}ms`, "");

package/src/runtime/task-runner/prompt-builder.ts

@@ -120,7 +120,11 @@ export async function renderTaskPrompt(manifest: TeamRunManifest, step: Workflow
 		// O4: project knowledge (.crew/knowledge.md) — workers don't load the
 		// pi-crew extension (spawned with --no-extensions), so before_agent_start
 		// never fires for them. Inject here so every worker sees project knowledge.
-		buildKnowledgeFragment(task.cwd),
+		buildKnowledgeFragment(task.cwd, {
+			goal: manifest.goal,
+			taskText: step.task,
+			role: step.role,
+		}),
 	].filter(Boolean).join("\n");
 
 	// Dynamic suffix: goal, step, skills, task packet, dependency context, memory — changes per task

package/src/runtime/task-runner.ts

@@ -342,6 +342,8 @@ export async function runTeamTask(
 		let error: string | undefined;
 		let modelAttempts: ModelAttemptSummary[] | undefined;
 		let parsedOutput: ParsedPiJsonOutput | undefined;
+	let rawFinalText: string | undefined;
+		let intermediateFindings: string | undefined;
 		let finalStdout = "";
 		let transcriptPath: string | undefined;
 		let terminalEvidence: OperationTerminalEvidence[] = [];
@@ -717,6 +719,8 @@ export async function runTeamTask(
 					childResult.stdout,
 				);
 				parsedOutput = parsePiJsonOutput(transcriptText);
+				rawFinalText = childResult.rawFinalText;
+				intermediateFindings = childResult.intermediateFindings;
 				error =
 					childResult.error ||
 					(childResult.exitCode && childResult.exitCode !== 0
@@ -836,9 +840,18 @@ export async function runTeamTask(
 				kind: "result",
 				relativePath: `results/${task.id}.txt`,
 				content:
+					// Prefer the RAW (uncapped) final assistant text captured before the
+					// transcript's 16K compaction — this is the authoritative worker output.
+					// Fall back to transcript-derived finalText, then stdout/stderr, so a
+					// missing raw capture (mock/error path) never yields empty/garbage.
+					cleanResultText(rawFinalText) ??
 					cleanResultText(parsedOutput?.finalText) ??
 					cleanResultText(finalStdout) ??
 					cleanResultText(finalStderr) ??
+					// #7 hardening: if all real output paths are empty (worker exhausted
+					// budget on tool calls, no assistant text), use intermediate findings.
+					// intermediateFindings captures the last N tool-result display lines.
+					cleanResultText(intermediateFindings) ??
 					"(no output)",
 				producer: task.id,
 			});

package/src/runtime/team-runner.ts

@@ -15,7 +15,8 @@ import { withRunLock } from "../state/locks.ts";
 import { aggregateUsage, formatUsage } from "../state/usage.ts";
 import type { WorkflowConfig, WorkflowStep } from "../workflows/workflow-config.ts";
 import { evaluateCrewPolicy, summarizePolicyDecisions } from "./policy-engine.ts";
-import { buildRecoveryLedger } from "./recovery-recipes.ts";
+import { buildRecoveryLedger, shouldRerunFailedTask } from "./recovery-recipes.ts";
+import { assessGoalAchievement, applyGoalAchievement } from "./goal-achievement.ts";
 import { buildTaskGraphIndex, refreshTaskGraphQueues, taskGraphSnapshot } from "./task-graph-scheduler.ts";
 import { buildExecutionPlan as buildDagExecutionPlan, getReadyTasks as getDagReadyTasks, type TaskNode } from "./task-graph.ts";
 import { checkBranchFreshness } from "../worktree/branch-freshness.ts";
@@ -343,6 +344,16 @@ function retryPolicyFromConfig(config: CrewReliabilityConfig | undefined): Retry
 	return { ...DEFAULT_RETRY_POLICY, ...(config?.retryPolicy ?? {}) };
 }
 
+/**
+ * #1 (assessment): decide whether the per-task retry path (executeWithRetry) is used.
+ * Defaults to TRUE (opt-out) so transient worker hangs (ChildTimeout) are retried
+ * automatically. Previously opt-in, which left the entire retry+recovery stack dormant.
+ * Exported for unit testing.
+ */
+export function shouldUseRetry(reliability: CrewReliabilityConfig | undefined): boolean {
+	return reliability?.autoRetry !== false;
+}
+
 function failedTaskFrom(result: { tasks: TeamTaskState[] }, taskId: string): TeamTaskState | undefined {
 	return result.tasks.find((item) => item.id === taskId && item.status === "failed");
 }
@@ -452,6 +463,23 @@ export async function executeTeamRun(input: ExecuteTeamRunInput): Promise<{ mani
 
 	try {
 		const result = await executeTeamRunCore(input, manifest, workflow);
+		// #2 (assessment): goal-achievement detection — kill the silent false-green.
+		// A code-mutating run that "completed" but left the git working tree clean
+		// (and/or had a failed task) is a false-green. We expose goalAchieved on the
+		// manifest + emit an event so the lie is never silent, and downgrade status
+		// to "failed" only when a failed task corroborates it (conservative).
+		const gaAssessment = assessGoalAchievement(result.manifest, result.tasks, workflow);
+		const gaApplied = applyGoalAchievement(result.manifest, gaAssessment);
+		if (gaApplied.manifest !== result.manifest) {
+			result.manifest = gaApplied.manifest;
+			try {
+				saveRunManifest(result.manifest);
+			} catch (persistError) {
+				logInternalError("team-runner.goalAchievement.persist", persistError instanceof Error ? persistError : new Error(String(persistError)), `runId=${manifest.runId}`);
+			}
+		}
+		appendEvent(manifest.eventsPath, { type: "run.goal_achievement", runId: manifest.runId, message: gaApplied.manifest.goalAchievementNote ?? "", data: { achieved: gaAssessment.achieved, downgraded: gaApplied.downgraded, reason: gaAssessment.reason, signals: gaAssessment.signals } });
+		if (gaApplied.downgraded) logInternalError("team-runner.goalAchievement.falseGreen", new Error(gaApplied.manifest.goalAchievementNote ?? "false-green detected"), `runId=${manifest.runId}`);
 		stopTeamHeartbeat();
 		resolveRunPromise(manifest.runId, result);
 		cleanupUsage();
@@ -602,6 +630,18 @@ async function executeTeamRunCore(
 
 		const failed = tasks.find((task) => task.status === "failed");
 		if (failed) {
+			// #4 (assessment): honor limits.maxRetriesPerTask — re-queue an eligible
+			// failed task for a bounded whole-task rerun instead of immediately
+			// aborting the run. Before #4, the recovery ledger recorded `rerun_task`
+			// entries with state:"planned" but never executed them (decorative).
+			// Default-off: maxRetriesPerTask=0 → original abort behavior preserved.
+			const rerun = shouldRerunFailedTask(failed, input.limits);
+			if (rerun.rerun) {
+				tasks = tasks.map((item) => item.id === failed.id ? { ...item, status: "queued" as const, policy: { ...(item.policy ?? {}), retryCount: rerun.newRetryCount }, error: undefined, finishedAt: undefined } : item);
+				await saveRunTasksAsync(manifest, tasks);
+				await appendEventAsync(manifest.eventsPath, { type: "recovery.rerun_task", runId: manifest.runId, taskId: failed.id, message: `Re-queuing failed task for whole-task rerun: ${rerun.reason}`, data: { attempt: rerun.newRetryCount, maxRetries: input.limits?.maxRetriesPerTask ?? 0, scenario: "task_failed" } });
+				continue; // loop re-processes the re-queued task
+			}
 			tasks = markBlocked(tasks, `Blocked by failed task '${failed.id}'.`);
 			await saveRunTasksAsync(manifest, tasks);
 			saveCrewAgents(manifest, recordsForMaterializedTasks(manifest, tasks, runtimeKind));
@@ -685,7 +725,12 @@ async function executeTeamRunCore(
 				const teamRole = input.team.roles.find((role) => role.name === task.role);
 				const perTaskRuntime = resolveTaskRuntimeKind(runtimeKind, task.role, input.runtimeConfig?.isolationPolicy);
 				const baseInput = { manifest, tasks, task, step, agent, signal: input.signal, executeWorkers: input.executeWorkers, runtimeKind: runtimeKind, taskRuntimeOverride: perTaskRuntime !== runtimeKind ? perTaskRuntime : undefined, runtimeConfig: input.runtimeConfig, parentContext: input.parentContext, parentModel: input.parentModel, modelRegistry: input.modelRegistry, modelOverride: input.modelOverride, teamRoleModel: teamRole?.model, teamRoleSkills: teamRole?.skills, skillOverride: input.skillOverride, limits: input.limits, onJsonEvent: input.onJsonEvent, workspaceId: input.workspaceId };
-				if (input.reliability?.autoRetry !== true) return withCorrelation(childCorrelation(manifest.runId, task.id), () => runTeamTask(baseInput));
+				// #1 (assessment): autoRetry now defaults ON (opt-out via reliability.autoRetry=false).
+				// The dominant v0.9.13 failure was ChildTimeout ("worker became unresponsive") with
+				// ZERO retries because this gate was opt-in. isRetryable() defaults to true when
+				// retryableErrors is empty, so transient hangs now retry up to maxAttempts (3) with
+				// exponential backoff. Set reliability.autoRetry=false to restore old single-shot behavior.
+				if (!shouldUseRetry(input.reliability)) return withCorrelation(childCorrelation(manifest.runId, task.id), () => runTeamTask(baseInput));
 				let lastFailed: { manifest: TeamRunManifest; tasks: TeamTaskState[] } | undefined;
 				let lastAttemptId: string | undefined;
 				const attemptsSoFar: TaskAttemptState[] = [...(task.attempts ?? [])];