pi-crew 0.9.67 → 0.10.1

package/src/runtime/verification/spec-sandbox.ts

@@ -0,0 +1,255 @@
+/**
+ * spec-sandbox.ts — hardened re-run sandbox for strict-mode spec checks
+ * (ADR-6 §4, WP-6 step 4).
+ *
+ * Executes ONLY snapshot-frozen acceptance commands (never the live
+ * state/specs/<id>.json) under layered isolation:
+ *   - env: BASE_ALLOWLIST pattern minus credential-carrying keys — NO
+ *     provider API keys, NO PI_CREW_BROKER_*, NO session tokens (asserted by
+ *     capturing the child env in tests);
+ *   - cwd: pinned to the run's workspace root;
+ *   - resources: `sh -c 'ulimit -v 262144; ulimit -t 30; exec …'`
+ *     (256 MiB address space, 30 CPU-seconds);
+ *   - wall-clock: 60s — SIGTERM → 200ms → SIGKILL escalation;
+ *   - network: `unshare -rn` wrapper on Linux (user-namespace + map-root;
+ *     plain -n needs CAP_SYS_ADMIN and fails EPERM unprivileged, which would
+ *     brick every strict re-run).
+ *
+ * FAIL-CLOSED: wrapper-launch failure fails that acceptance closed — NEVER
+ * silently degrades to pass or to running without isolation. macOS has no
+ * unshare equivalent → launch-failed there too (platform honesty: the gate
+ * emits a loud platform warning; strict re-runs are Linux-only in v1).
+ *
+ * LEAK DISCIPLINE: results are DIGEST-ONLY. stdout/stderr text never leaves
+ * this module — events, logs, and artifacts see exit code / signal / digest /
+ * stderr-LENGTH only (error paths included: timeouts, signals, launch
+ * failures).
+ */
+
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { sanitizeEnvSecrets } from "../../utils/env-filter.ts";
+import { BASE_ALLOWLIST } from "../child-pi/child-pi-spawn.ts";
+
+/** Config-capped ceilings (ADR-6 §4) — NOT user-facing knobs in v1. The
+ *  `limits` override on runSpecCheck is an internal test seam. */
+export interface SpecSandboxLimits {
+	addressSpaceKb: number; // ulimit -v (256 MiB)
+	cpuSeconds: number; // ulimit -t
+	wallClockMs: number; // 60s hard wall clock
+	sigkillGraceMs: number; // SIGTERM → 200ms → SIGKILL
+	maxOutputBytes: number; // stdout buffer cap (digest still computed over capped buffer)
+}
+
+export const SPEC_SANDBOX_LIMITS: SpecSandboxLimits = {
+	addressSpaceKb: 262_144,
+	cpuSeconds: 30,
+	wallClockMs: 60_000,
+	sigkillGraceMs: 200,
+	maxOutputBytes: 4 * 1024 * 1024,
+};
+
+/** Credential-shaped keys are scrubbed EVEN IF an allowlist entry matches —
+ *  belt-and-suspenders against future BASE_ALLOWLIST additions. */
+const CREDENTIAL_KEY_PATTERN = /(API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|_BEARER|^PI_CREW_BROKER)/i;
+
+/** Sandbox env: BASE_ALLOWLIST pattern minus credential-carrying keys, then
+ *  the generic secret scrubber (deny-list). The scrubbed map IS the result —
+ *  never merged back into the selection (a merge-back resurrects keys the
+ *  scrubber dropped). */
+export function buildSpecSandboxEnv(env: NodeJS.ProcessEnv = process.env): Record<string, string> {
+	const selected: Record<string, string> = {};
+	for (const key of BASE_ALLOWLIST) {
+		if (CREDENTIAL_KEY_PATTERN.test(key)) continue;
+		const value = env[key];
+		if (value !== undefined) selected[key] = value;
+	}
+	const scrubbed = sanitizeEnvSecrets(selected);
+	const result: Record<string, string> = {};
+	for (const [key, value] of Object.entries(scrubbed)) {
+		if (CREDENTIAL_KEY_PATTERN.test(key)) continue;
+		result[key] = value;
+	}
+	result.FORCE_COLOR = "0";
+	return result;
+}
+
+export type SpecCheckOutcomeKind =
+	| "passed"
+	| "digest-mismatch"
+	| "exit-mismatch"
+	| "output-capped"
+	| "timeout"
+	| "launch-failed"
+	| "network-blocked";
+
+/** Digest-only result — raw command output NEVER persists (leak discipline). */
+export interface SpecCheckOutcome {
+	outcome: SpecCheckOutcomeKind;
+	actualDigest?: string;
+	exitCode?: number | null;
+	signal?: string;
+	durationMs: number;
+	stderrLength?: number;
+	/** stdout exceeded maxOutputBytes — digest comparison invalid (the authored
+	 *  expectedDigest is over FULL stdout); surfaced so the failure is
+	 *  distinguishable from real tampering (round-1 review). */
+	stdoutCapped?: boolean;
+}
+
+export interface SpecCheckCommand {
+	command: string;
+	/** sha-256 hex of raw stdout. Optional — exit-code-only checks omit it. */
+	expectedDigest?: string;
+	/** Default 0 when neither digest nor exit code is declared. */
+	expectedExitCode?: number;
+}
+
+/** `unshare -rn` is Linux-only; strict re-runs fail closed elsewhere. */
+export function isSpecSandboxSupported(): boolean {
+	return process.platform === "linux";
+}
+
+export async function runSpecCheck(
+	check: SpecCheckCommand,
+	options: { cwd: string; limits?: Partial<SpecSandboxLimits>; wrapperOverride?: string },
+): Promise<SpecCheckOutcome> {
+	const limits = { ...SPEC_SANDBOX_LIMITS, ...options.limits };
+	const wrapper = options.wrapperOverride ?? "unshare";
+	const start = Date.now();
+	if (!isSpecSandboxSupported()) {
+		// Platform honesty: macOS/Windows have no unshare equivalent → fail
+		// closed, never silently run without isolation.
+		return { outcome: "launch-failed", durationMs: Date.now() - start, stderrLength: 0 };
+	}
+	// `exec` so ulimits apply to the command's own process. The user command
+	// rides as $0 (argv, never string-interpolated — arbitrary quoting is safe
+	// and compound commands like `a && b` keep their shell semantics).
+	const inner = `ulimit -v ${limits.addressSpaceKb}; ulimit -t ${limits.cpuSeconds}; exec sh -c "$0"`;
+	return await new Promise<SpecCheckOutcome>((resolve) => {
+		const child = spawn(wrapper, ["-rn", "sh", "-c", inner, check.command], {
+			cwd: options.cwd,
+			env: buildSpecSandboxEnv(),
+			stdio: ["ignore", "pipe", "pipe"],
+			detached: true, // own process group — group-wide kill reaches grandchildren holding the stdio pipes (CORE-10 pattern)
+		});
+		let stdout = "";
+		let stderrLen = 0;
+		let stdoutCapped = false;
+		let settled = false;
+		let termTimer: NodeJS.Timeout | undefined;
+		let killTimer: NodeJS.Timeout | undefined;
+		const finish = (outcome: SpecCheckOutcome): void => {
+			if (settled) return;
+			settled = true;
+			if (termTimer) clearTimeout(termTimer);
+			if (killTimer) clearTimeout(killTimer);
+			resolve(outcome);
+		};
+		termTimer = setTimeout(() => {
+			try {
+				if (child.pid) process.kill(-child.pid, "SIGTERM");
+			} catch {
+				child.kill("SIGTERM");
+			}
+		}, limits.wallClockMs);
+		termTimer.unref();
+		killTimer = setTimeout(() => {
+			try {
+				if (child.pid) process.kill(-child.pid, "SIGKILL");
+			} catch {
+				child.kill("SIGKILL");
+			}
+		}, limits.wallClockMs + limits.sigkillGraceMs);
+		killTimer.unref();
+		child.stdout?.on("data", (chunk: Buffer) => {
+			if (stdout.length >= limits.maxOutputBytes) {
+				stdoutCapped = true;
+				return;
+			}
+			stdout += chunk.toString("utf8");
+			if (stdout.length > limits.maxOutputBytes) {
+				stdout = stdout.slice(0, limits.maxOutputBytes);
+				stdoutCapped = true;
+			}
+		});
+		child.stderr?.on("data", (chunk: Buffer) => {
+			stderrLen += chunk.length;
+		});
+		child.on("error", (err) => {
+			// Wrapper-launch failure (unshare missing/EACCES/EPERM) — fail closed.
+			const outcome: SpecCheckOutcome =
+				(err as NodeJS.ErrnoException).code === "ENOENT"
+					? { outcome: "launch-failed", durationMs: Date.now() - start, stderrLength: stderrLen }
+					: { outcome: "launch-failed", durationMs: Date.now() - start, stderrLength: stderrLen };
+			finish(outcome);
+		});
+		child.on("exit", () => {
+			// Survivor kill (round-1): a passing command can background a process
+			// that outlives the check. Must run on EXIT, not CLOSE — a survivor
+			// holding the stdout pipe delays `close` until it dies, which would
+			// make this kill a no-op by construction.
+			try {
+				if (child.pid) process.kill(-child.pid, "SIGKILL");
+			} catch {
+				/* group already reaped — fine */
+			}
+		});
+		child.on("close", (code, signal) => {
+			const durationMs = Date.now() - start;
+			if (signal === "SIGTERM" || signal === "SIGKILL") {
+				finish({ outcome: "timeout", signal: signal ?? undefined, durationMs, stderrLength: stderrLen });
+				return;
+			}
+			const actualDigest = createHash("sha256").update(stdout, "utf8").digest("hex");
+			const expectedExit = check.expectedExitCode ?? 0;
+			if (stdoutCapped && check.expectedDigest !== undefined) {
+				// The authored expectedDigest is over FULL stdout — comparing the
+				// capped prefix is invalid. Fail with the distinct honest outcome.
+				finish({
+					outcome: "output-capped",
+					actualDigest,
+					exitCode: code,
+					signal: signal ?? undefined,
+					durationMs,
+					stderrLength: stderrLen,
+					stdoutCapped: true,
+				});
+				return;
+			}
+			const exitOk = code === expectedExit;
+			const digestOk = check.expectedDigest === undefined || actualDigest === check.expectedDigest;
+			if (!exitOk) {
+				finish({
+					outcome: "exit-mismatch",
+					actualDigest: check.expectedDigest !== undefined ? actualDigest : undefined,
+					exitCode: code,
+					signal: signal ?? undefined,
+					durationMs,
+					stderrLength: stderrLen,
+				});
+				return;
+			}
+			if (!digestOk) {
+				finish({
+					outcome: "digest-mismatch",
+					actualDigest,
+					exitCode: code,
+					signal: signal ?? undefined,
+					durationMs,
+					stderrLength: stderrLen,
+				});
+				return;
+			}
+			finish({
+				outcome: "passed",
+				actualDigest: check.expectedDigest !== undefined || stdoutCapped ? actualDigest : undefined,
+				exitCode: code,
+				signal: signal ?? undefined,
+				durationMs,
+				stderrLength: stderrLen,
+				...(stdoutCapped ? { stdoutCapped: true } : {}),
+			});
+		});
+	});
+}

package/src/runtime/verification/verification-gates.ts

@@ -12,6 +12,7 @@
 import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { getCrewEnv } from "../../config/env-vars.ts";
 import { writeArtifact } from "../../state/stores/artifact-store.ts";
 import type { GreenLevel, VerificationCommandResult, VerificationContract } from "../../state/types.ts";
 import { WINDOWS_ESSENTIAL_ENV_VARS } from "../../utils/env-allowlist.ts";
@@ -66,7 +67,7 @@ const VERIFICATION_ENV_ALLOWLIST: readonly string[] = [
 /** Whether env sanitization for verification is enabled (opt-out: enabled by default). */
 export function isVerificationEnvSanitizeEnabled(): boolean {
 	// Opt-out: explicitly disabled via env var set to '0'.
-	if (process.env.PI_CREW_VERIFICATION_SANITIZE_ENV === "0" || process.env.PI_TEAMS_VERIFICATION_SANITIZE_ENV === "0") {
+	if (getCrewEnv("PI_CREW_VERIFICATION_SANITIZE_ENV") === "0" || getCrewEnv("PI_TEAMS_VERIFICATION_SANITIZE_ENV") === "0") {
 		return false;
 	}
 	return true;
@@ -82,7 +83,7 @@ function buildVerificationEnv(): Record<string, string> {
 	if (!isVerificationEnvSanitizeEnabled()) {
 		return { ...process.env, FORCE_COLOR: "0" };
 	}
-	const preserveRaw = process.env.PI_CREW_VERIFICATION_PRESERVE_ENV ?? process.env.PI_TEAMS_VERIFICATION_PRESERVE_ENV ?? "";
+	const preserveRaw = getCrewEnv("PI_CREW_VERIFICATION_PRESERVE_ENV") ?? "";
 	const preserve = preserveRaw
 		.split(",")
 		.map((s) => s.trim())

package/src/runtime/verification/verification-worktree.ts

@@ -25,6 +25,7 @@ import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { getCrewEnv } from "../../config/env-vars.ts";
 
 export interface VerificationWorktree {
 	/** Absolute path to the pristine worktree directory. */
@@ -37,7 +38,7 @@ export interface VerificationWorktree {
 
 /** Whether the worktree sandbox is enabled (env var opt-in). */
 export function isWorktreeSandboxEnabled(): boolean {
-	const v = process.env.PI_CREW_VERIFICATION_WORKTREE ?? process.env.PI_TEAMS_VERIFICATION_WORKTREE;
+	const v = getCrewEnv("PI_CREW_VERIFICATION_WORKTREE");
 	return v === "1" || v === "true";
 }
 

package/src/runtime/workflow-phase-advance.ts

@@ -0,0 +1,100 @@
+/**
+ * Workflow-phase advancement for the team-run scheduler loop.
+ *
+ * Extracted from team-runner.ts (2026-08, Phase 2.6 maintainability split —
+ * CORE-4 extraction 6). Pure code motion: advanceWorkflowPhases moved
+ * verbatim.
+ */
+import { appendEventAsync } from "../state/event-log/event-log.ts";
+import type { SchedulerContext } from "./scheduler-context.ts";
+import { type PhaseGuardContext, transitionPhase } from "./workflow-state.ts";
+
+/**
+ * CORE-4 extraction 6: advance workflow phases whose tasks are all in
+ * terminal state.
+ *
+ * Iterates phases starting at `ctx.wfMachine.currentPhaseIndex`; for each phase
+ * whose tasks are all terminal, determines the transition status (failed if
+ * any task failed/cancelled, else completed), applies the phase transition,
+ * emits `workflow.phase_completed`/`workflow.phase_failed`/
+ * `workflow.phase_guard_blocked` events, and advances `currentPhaseIndex`.
+ *
+ * Reads `ctx.tasks`, `ctx.manifest` (read-only). Mutates `ctx.wfMachine`
+ * in-place (phase status + currentPhaseIndex). The caller syncs the local
+ * `wfMachine` from ctx after the call.
+ *
+ * @param ctx  The scheduler context.
+ */
+export async function advanceWorkflowPhases(ctx: SchedulerContext): Promise<void> {
+	let wfMachine = ctx.wfMachine;
+	const tasks = ctx.tasks;
+	const manifest = ctx.manifest;
+	// Advance workflow phases whose tasks are all in terminal state
+	const terminalStatuses = new Set(["completed", "failed", "skipped", "cancelled", "needs_attention"]);
+	const phaseTaskMap = new Map<string, string[]>();
+	for (const task of tasks) {
+		if (!task.stepId) continue;
+		const existing = phaseTaskMap.get(task.stepId) ?? [];
+		existing.push(task.id);
+		phaseTaskMap.set(task.stepId, existing);
+	}
+	// W5-4: by-id map once for the phase loop (was O(phases × phaseTasks × tasks)).
+	const taskById = new Map(tasks.map((t) => [t.id, t] as const));
+	for (let pi = wfMachine.currentPhaseIndex; pi < wfMachine.phases.length; pi++) {
+		const phase = wfMachine.phases[pi]!;
+		const phaseTaskIds = phaseTaskMap.get(phase.name) ?? [];
+		if (phaseTaskIds.length === 0) continue;
+		const allTerminal = phaseTaskIds.every((taskId) => {
+			const task = taskById.get(taskId);
+			return task ? terminalStatuses.has(task.status) : false;
+		});
+		if (!allTerminal) break;
+		if (phase.status !== "completed" && phase.status !== "failed" && phase.status !== "skipped") {
+			const completedArtifacts = manifest.artifacts.filter((a) => a.kind === "result" || a.kind === "summary").map((a) => a.path);
+			const previousPhaseStatus = pi > 0 ? (wfMachine.phases[pi - 1]?.status ?? "pending") : "completed";
+			const wfContext: PhaseGuardContext = {
+				completedArtifacts,
+				previousPhaseStatus,
+				taskResults: tasks
+					.filter((t) => t.status === "completed" || t.status === "needs_attention")
+					.map((t) => ({
+						taskId: t.id,
+						status: t.status,
+						outputPath: t.resultArtifact?.path,
+					})),
+			};
+			// Determine phase transition status based on individual task outcomes
+			const phaseTasks = phaseTaskIds
+				.map((taskId) => taskById.get(taskId))
+				.filter((t): t is NonNullable<typeof t> => t !== undefined);
+			const hasFailedOrCancelled = phaseTasks.some((t) => t.status === "failed" || t.status === "cancelled");
+			const phaseStatus = hasFailedOrCancelled ? "failed" : "completed";
+			const transition = transitionPhase(wfMachine, pi, phaseStatus, wfContext);
+			wfMachine = transition.machine;
+			if (transition.guardResult && !transition.guardResult.allowed) {
+				await appendEventAsync(manifest.eventsPath, {
+					type: "workflow.phase_guard_blocked",
+					runId: manifest.runId,
+					message: `Workflow phase '${phase.name}' guard blocked: ${transition.guardResult.reason ?? "unknown"}`,
+					data: {
+						phaseIndex: pi,
+						phaseName: phase.name,
+						reason: transition.guardResult.reason,
+					},
+				});
+				break;
+			}
+			await appendEventAsync(manifest.eventsPath, {
+				type: phaseStatus === "failed" ? "workflow.phase_failed" : "workflow.phase_completed",
+				runId: manifest.runId,
+				message: `Workflow phase '${phase.name}' ${phaseStatus}.`,
+				data: { phaseIndex: pi, phaseStatus },
+			});
+		}
+		wfMachine = { ...wfMachine, currentPhaseIndex: pi + 1 };
+	}
+	ctx.wfMachine = wfMachine;
+}
+
+/** @internal 1.9(b) test export — exercise advanceWorkflowPhases directly. */
+export const __test__advanceWorkflowPhases = advanceWorkflowPhases;

package/src/runtime/workspace-tree.ts

@@ -262,6 +262,11 @@ const emptyResult = (rootPath: string): WorkspaceTree => ({
  * long active runs while eliminating redundant walks.
  */
 const TREE_CACHE_TTL_MS = 30_000;
+// R5-L3 (Round 5 LOW-3): FIFO cap at insertion (mirrors knowledgeCache in
+// knowledge-injection.ts). Expired entries are only overwritten on re-access,
+// so distinct cwd/option keys would otherwise accumulate for the process
+// lifetime. A miss just re-walks the tree — same as a TTL expiry.
+const TREE_CACHE_MAX_ENTRIES = 64;
 interface CachedTree {
 	tree: WorkspaceTree;
 	expiresAt: number;
@@ -305,6 +310,10 @@ export async function buildWorkspaceTree(cwd: string, options?: WorkspaceTreeOpt
 			tree: result,
 			expiresAt: Date.now() + TREE_CACHE_TTL_MS,
 		});
+		if (treeCache.size > TREE_CACHE_MAX_ENTRIES) {
+			const oldest = treeCache.keys().next().value;
+			if (oldest !== undefined) treeCache.delete(oldest);
+		}
 		return result;
 	} catch {
 		return emptyResult(rootPath);

package/src/schema/config-schema.ts

@@ -17,12 +17,21 @@ export const PiTeamsAutonomyProfileSchema = Type.Union([
 
 export const PiTeamsAutonomousConfigSchema = Type.Object(
 	{
-		profile: Type.Optional(PiTeamsAutonomyProfileSchema),
-		enabled: Type.Optional(Type.Boolean()),
-		injectPolicy: Type.Optional(Type.Boolean()),
-		preferAsyncForLongTasks: Type.Optional(Type.Boolean()),
-		allowWorktreeSuggestion: Type.Optional(Type.Boolean()),
-		magicKeywords: Type.Optional(Type.Record(Type.String({ minLength: 1 }), Type.Array(Type.String({ minLength: 1 })))),
+		profile: Type.Optional(
+			Type.Union([Type.Literal("manual"), Type.Literal("suggested"), Type.Literal("assisted"), Type.Literal("aggressive")], {
+				sensitive: true,
+			}),
+		),
+		enabled: Type.Optional(Type.Boolean({ sensitive: true })),
+		injectPolicy: Type.Optional(Type.Boolean({ sensitive: true })),
+		preferAsyncForLongTasks: Type.Optional(Type.Boolean({ sensitive: true })),
+		allowWorktreeSuggestion: Type.Optional(Type.Boolean({ sensitive: true })),
+		// S19-5 (Wave 1A): magicKeywords alone flips effective autonomous mode on
+		// (effectiveAutonomousConfig defaults profile "suggested" when only
+		// magicKeywords is present) — untrusted project config must not set it.
+		magicKeywords: Type.Optional(
+			Type.Record(Type.String({ minLength: 1 }), Type.Array(Type.String({ minLength: 1 })), { sensitive: true }),
+		),
 	},
 	{ additionalProperties: false },
 );
@@ -56,14 +65,16 @@ export const PiTeamsModelFallbackConfigSchema = Type.Object(
 export const PiTeamsRuntimeConfigSchema = Type.Object(
 	{
 		mode: Type.Optional(
-			Type.Union([Type.Literal("auto"), Type.Literal("scaffold"), Type.Literal("child-process"), Type.Literal("live-session")]),
+			Type.Union([Type.Literal("auto"), Type.Literal("scaffold"), Type.Literal("child-process"), Type.Literal("live-session")], {
+				sensitive: true,
+			}),
 		),
-		preferLiveSession: Type.Optional(Type.Boolean()),
-		allowChildProcessFallback: Type.Optional(Type.Boolean()),
+		preferLiveSession: Type.Optional(Type.Boolean({ sensitive: true })),
+		allowChildProcessFallback: Type.Optional(Type.Boolean({ sensitive: true })),
 		maxTurns: Type.Optional(Type.Integer({ minimum: 1 })),
 		graceTurns: Type.Optional(Type.Integer({ minimum: 1 })),
 		taskTimeoutMs: Type.Optional(Type.Integer({ minimum: 1 })),
-		inheritContext: Type.Optional(Type.Boolean()),
+		inheritContext: Type.Optional(Type.Boolean({ sensitive: true })),
 		promptMode: Type.Optional(Type.Union([Type.Literal("replace"), Type.Literal("append")])),
 		groupJoin: Type.Optional(Type.Union([Type.Literal("off"), Type.Literal("group"), Type.Literal("smart")])),
 		groupJoinAckTimeoutMs: Type.Optional(Type.Integer({ minimum: 1 })),
@@ -83,14 +94,14 @@ export const PiTeamsRuntimeConfigSchema = Type.Object(
 			),
 		),
 		excludeContextBash: Type.Optional(Type.Boolean()),
-		agentExtensions: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+		agentExtensions: Type.Optional(Type.Array(Type.String({ minLength: 1 }), { sensitive: true })),
 		isolationPolicy: Type.Optional(
 			Type.Object(
 				{
 					isolatedRoles: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
 					defaultRuntime: Type.Optional(Type.Union([Type.Literal("live-session"), Type.Literal("child-process")])),
 				},
-				{ additionalProperties: false },
+				{ additionalProperties: false, sensitive: true },
 			),
 		),
 		modelFallback: Type.Optional(PiTeamsModelFallbackConfigSchema),
@@ -102,16 +113,19 @@ export const PiTeamsControlConfigSchema = Type.Object(
 	{
 		enabled: Type.Optional(Type.Boolean()),
 		needsAttentionAfterMs: Type.Optional(Type.Integer({ minimum: 1 })),
+		// F19-3 (Round 19 parity): read at agent-control.ts with defaults 3/10.
+		consecutiveFailureThreshold: Type.Optional(Type.Integer({ minimum: 1 })),
+		longRunningMinutes: Type.Optional(Type.Integer({ minimum: 1 })),
 	},
 	{ additionalProperties: false },
 );
 
 export const PiTeamsWorktreeConfigSchema = Type.Object(
 	{
-		setupHook: Type.Optional(Type.String({ minLength: 1 })),
+		setupHook: Type.Optional(Type.String({ minLength: 1, sensitive: true })),
 		setupHookTimeoutMs: Type.Optional(Type.Integer({ minimum: 1 })),
 		linkNodeModules: Type.Optional(Type.Boolean()),
-		seedPaths: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+		seedPaths: Type.Optional(Type.Array(Type.String({ minLength: 1 }), { sensitive: true })),
 	},
 	{ additionalProperties: false },
 );
@@ -144,7 +158,11 @@ export const GoalWrapWorkflowConfigSchema = Type.Object(
 	{ additionalProperties: false },
 );
 
-export const PiTeamsGoalWrapConfigSchema = Type.Record(Type.String({ minLength: 1 }), GoalWrapWorkflowConfigSchema);
+// S19-2 (Wave 1A): the whole goalWrap subtree is user-only — a project config
+// must not enable silent auto-wrap, pick the evaluator model, or set
+// budgetUnlimited (unbounded provider spend). Marking the Record is terminal:
+// the walk collapses the subtree to the single top-level path `goalWrap`.
+export const PiTeamsGoalWrapConfigSchema = Type.Record(Type.String({ minLength: 1 }), GoalWrapWorkflowConfigSchema, { sensitive: true });
 
 export const AgentOverrideSchema = Type.Object(
 	{
@@ -160,8 +178,8 @@ export const AgentOverrideSchema = Type.Object(
 
 export const PiTeamsAgentsConfigSchema = Type.Object(
 	{
-		disableBuiltins: Type.Optional(Type.Boolean()),
-		overrides: Type.Optional(Type.Record(Type.String({ minLength: 1 }), AgentOverrideSchema)),
+		disableBuiltins: Type.Optional(Type.Boolean({ sensitive: true })),
+		overrides: Type.Optional(Type.Record(Type.String({ minLength: 1 }), AgentOverrideSchema, { sensitive: true })),
 	},
 	{ additionalProperties: false },
 );
@@ -169,8 +187,8 @@ export const PiTeamsAgentsConfigSchema = Type.Object(
 export const PiTeamsToolsConfigSchema = Type.Object(
 	{
 		enableClaudeStyleAliases: Type.Optional(Type.Boolean()),
-		enableSteer: Type.Optional(Type.Boolean()),
-		terminateOnForeground: Type.Optional(Type.Boolean()),
+		enableSteer: Type.Optional(Type.Boolean({ sensitive: true })),
+		terminateOnForeground: Type.Optional(Type.Boolean({ sensitive: true })),
 	},
 	{ additionalProperties: false },
 );
@@ -184,8 +202,8 @@ export const PiTeamsTelemetryConfigSchema = Type.Object(
 
 export const PiTeamsPolicyConfigSchema = Type.Object(
 	{
-		requireIntentForDestructiveActions: Type.Optional(Type.Boolean()),
-		disabledCapabilities: Type.Optional(Type.Array(Type.String())),
+		requireIntentForDestructiveActions: Type.Optional(Type.Boolean({ sensitive: true })),
+		disabledCapabilities: Type.Optional(Type.Array(Type.String(), { sensitive: true })),
 	},
 	{ additionalProperties: false },
 );
@@ -224,6 +242,9 @@ export const PiTeamsReliabilityConfigSchema = Type.Object(
 					jitterRatio: Type.Optional(Type.Number({ minimum: 0, maximum: 1 })),
 					exponentialFactor: Type.Optional(Type.Number({ minimum: 1, maximum: 5 })),
 					retryableErrors: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+					// F19-2 (Round 19 parity): parsed at config-validation.ts but
+					// additionalProperties:false previously rejected it at the schema level.
+					maxTotalSpawns: Type.Optional(Type.Integer({ minimum: 0 })),
 				},
 				{ additionalProperties: false },
 			),
@@ -248,9 +269,12 @@ export const PiTeamsOtlpConfigSchema = Type.Object(
 				minLength: 1,
 				maxLength: 2048,
 				pattern: "^https?://",
+				sensitive: true,
 			}),
 		),
-		headers: Type.Optional(Type.Record(Type.String({ minLength: 1, maxLength: 256 }), Type.String({ maxLength: 4096 }))),
+		headers: Type.Optional(
+			Type.Record(Type.String({ minLength: 1, maxLength: 256 }), Type.String({ maxLength: 4096 }), { sensitive: true }),
+		),
 		intervalMs: Type.Optional(Type.Integer({ minimum: 5000 })),
 	},
 	{ additionalProperties: false },
@@ -298,16 +322,31 @@ export const CrewBrokerConfigSchema = Type.Object(
 		pathHashLen: Type.Optional(Type.Integer({ minimum: 4, maximum: 32 })),
 		maxFrameBytes: Type.Optional(Type.Integer({ minimum: 1024, maximum: 1_048_576 })),
 		outboundQueueCap: Type.Optional(Type.Integer({ minimum: 32, maximum: 4096 })),
+		/** WP-2/R2 (ADR-0 2026-08-17-waiting-producer-ask item 7): gate for the
+		 *  broker wait.* methods. Default false — fail-closed. */
+		waitMethodsEnabled: Type.Optional(Type.Boolean()),
+	},
+	{ additionalProperties: false },
+);
+
+export const PiTeamsNestingConfigSchema = Type.Object(
+	{
+		// Privilege-raising flag (spawns grandchildren): project-level config must
+		// not be able to enable it — sensitive → user config only (ADR-5 §12 posture,
+		// same treatment as autonomous.enabled / broker gates).
+		enabled: Type.Optional(Type.Boolean({ sensitive: true })),
+		maxSlots: Type.Optional(Type.Integer({ minimum: 1, maximum: 64 })),
+		maxDepth: Type.Optional(Type.Integer({ minimum: 1, maximum: 10 })),
 	},
 	{ additionalProperties: false },
 );
 
 export const PiTeamsConfigSchema = Type.Object(
 	{
-		asyncByDefault: Type.Optional(Type.Boolean()),
-		executeWorkers: Type.Optional(Type.Boolean()),
+		asyncByDefault: Type.Optional(Type.Boolean({ sensitive: true })),
+		executeWorkers: Type.Optional(Type.Boolean({ sensitive: true })),
 		notifierIntervalMs: Type.Optional(Type.Number({ minimum: 1000 })),
-		requireCleanWorktreeLeader: Type.Optional(Type.Boolean()),
+		requireCleanWorktreeLeader: Type.Optional(Type.Boolean({ sensitive: true })),
 		ignoreMethod: Type.Optional(Type.Union([Type.Literal("gitignore"), Type.Literal("exclude")])),
 		autonomous: Type.Optional(PiTeamsAutonomousConfigSchema),
 		limits: Type.Optional(PiTeamsLimitsConfigSchema),
@@ -325,6 +364,7 @@ export const PiTeamsConfigSchema = Type.Object(
 		otlp: Type.Optional(PiTeamsOtlpConfigSchema),
 		ui: Type.Optional(PiTeamsUiConfigSchema),
 		broker: Type.Optional(CrewBrokerConfigSchema),
+		nesting: Type.Optional(PiTeamsNestingConfigSchema),
 	},
 	{ additionalProperties: false },
 );