pi-gauntlet 5.0.6 → 5.0.7

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v5.0.7 - 2026-08-31
+
+- `subagent-driven-development`: the after-all-tasks whole-diff code review and the full verification set now run **concurrently by default** (async review dispatch + foreground verification in the same turn), gated by a fail-closed write-destination classifier over the plan's `**Verification:**` commands - a set that rewrites tracked files (write-mode formatters, autofixers, codegen, migrations) degrades to today's serial order with a one-line notice, never a prompt (gh-21).
+- Join discipline: no disposition of either result (fix dispatch, finding triage, verify-complete claim, `conformance-reviewer` dispatch) before both results are in hand; verification-result invalidation generalized to any post-join fix commit; new Red Flags line enforcing the join.
+
 ## v5.0.6 - 2026-08-27
 
 - using-git-worktrees: worktree creation never runs tests. Step 3 ("Verify Clean Baseline", full test suite) is replaced by "Verify Clean Base": a bare `git status --porcelain` check on the source checkout (untracked counts as dirty), run pre-creation on fresh paths; dirty -> report verbatim + ask, never test, never auto-stash. Report-only provenance note when branching off a non-default branch; Step 4 reports `Base: <ref> (clean)` instead of a test result; Step 2b's gitignore commit is pathspec-limited so proceed-with-dirt never absorbs staged changes. Rebase-time re-testing in "Keeping a Worktree Current" is unchanged. Fixes #16. Spec: `doc/specs/2026-08-27-gh-16-worktree-creation-no-tests.md`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-gauntlet",
-  "version": "5.0.6",
+  "version": "5.0.7",
   "description": "Opinionated, gated workflow skills, subagent personas, and runtime extensions for the pi coding agent.",
   "author": "Jacek Juraszek",
   "type": "module",

package/skills/subagent-driven-development/SKILL.md

@@ -63,7 +63,7 @@ For each task in `plan_tracker`:
 
 The spec is frozen at plan time and the orchestrator is its only writer during execution; if you do edit it mid-run, re-run writing-plans' anchor-resolution check before the next wave. An SR unable to read the spec at a cited anchor (missing file, unresolvable heading/range) returns a blocking finding — the contract is spec+task or stop, never a silent fallback to task-only review.
 
-After all tasks: run the whole-diff code review (`requesting-code-review`). Then [After All Tasks](#after-all-tasks-complete).
+After all tasks: proceed to [After All Tasks](#after-all-tasks-complete) - it owns the whole-diff code review dispatch and the full verification run (concurrent when the verification set classifies safe).
 
 ## Fix-Loop Rounds
 
@@ -219,8 +219,10 @@ For the fan-out + worktree + patch-integration + conflict mechanics, see `dispat
 ## After All Tasks Complete
 
 0. Call `phase_tracker({ action: "start", phase: "verify" })`. (The `implement` phase was started at execution start and auto-completes from `plan_tracker` once all tasks are done; this flow runs its own verify gate instead of `/skill:verification-before-completion`, so it must mark verify itself.)
-1. **Run the whole-diff code review.** Dispatch `/skill:requesting-code-review` against the worktree's full diff vs `main` (already covered in [The Process](#the-process) step "After all tasks"). Address Critical and Moderate findings before handoff. (Consumers wanting an in-flow project-specific audit re-add it as an explicit step in the gauntlet overrides file (see Project overrides), or run `/self-audit` manually.) Pass `SCOPED_TEST_COMMANDS: none` - the verify phase's full run (step 2) is the orchestrator's.
-2. **Run the full verification set — once.** Read the plan header's `**Verification:**` line and run it: tests + style + format (a single bundling entrypoint, or the listed individual commands). Green output is the fresh evidence verify requires; this is the only full run before conformance — task and wave gates ran scoped commands only. After conformance fix rounds land, re-run the set before re-dispatching the gate.
+1. **Classify, then dispatch both audits.** Classify the plan header's `**Verification:**` commands once per verify entry (post-fix re-runs are serial by nature — no re-classification): **unsafe** = anything that can rewrite tracked files — write-mode formatters (`--write`, `-w`), autofixers (`--fix`, `-u` snapshot updates), codegen, migrations regenerating checked-in artifacts; **safe** = commands that write only untracked/ignored paths — test runners, check-mode linters/formatters (`--check`, `--diff`), type checkers, builds only when their outputs are untracked; wrappers (`script/verify`, `package.json` aliases, `Makefile` targets) — read one level in, safe iff every invoked command classifies safe; deeper nesting or an undeterminable write destination → unsafe. The rule is the write destination; examples are illustrative, not authoritative. Unclear → serial. Orchestrator judgment, not config — no settings key, never a prompt.
+   - **Safe → concurrent (default).** Dispatch the whole-diff review per `/skill:requesting-code-review` against the worktree's full diff vs `main`, passing `SCOPED_TEST_COMMANDS: none` (the full run below is the orchestrator's): `subagent({ agent: "code-reviewer", context: "fresh", async: true, cwd: <worktree>, output: <absolute non-colliding $TMPDIR path>, task: <review template> })` — capture the returned run id; never a relative `output:` path (it lands untracked in the worktree). In the same turn, run the full `**Verification:**` set foreground in your own bash: tests + style + format (a single bundling entrypoint, or the listed individual commands). This is the only full run before conformance — task and wave gates ran scoped commands only.
+   - **Unsafe/unclear → serial.** Same two audits, review first (a plain synchronous dispatch), then the verification set, with one declarative notice naming the offender — e.g. `Serial review->verify: 'npm run fmt' writes tracked files.` Only the start order changes; step 2's join invariant is identical.
+2. **Join, then disposition.** Never busy-wait: after verification returns, check the review at most once via `subagent({ action: "status", id: <run id> })`; if still running, end the turn with no disposition — pi delivers the async completion, and the review output file is read only after terminal completion. If the async dispatch errored or the child died, re-dispatch the review serially (the verification result is already in hand). **No disposition of either result — no fix dispatch, no finding triage, no verify-complete claim, no `conformance-reviewer` dispatch — before both results are in hand and any fix-triggered re-run is green.** Post-join, address Critical and Moderate findings before handoff. Verification failed, review clean → dispatch fixes, then re-run the full set before any subsequent gate. Both audits dirty → strictly ordered, never merged: the review's certified `Parallel-safe:` fan-out first (when present, else sequential fixes), then the remaining verification failures sequentially, then one re-review and one full verification re-run — verification failures never join a `Parallel-safe:` group (they carry no finding IDs and no disjointness certification, and `dispatching-parallel-agents` forbids orchestrator-invented partitions). Both audits bind to the committed HEAD: any post-join fix commit — review-derived or conformance-derived — invalidates the verification result; re-run the full set before re-dispatching any gate. (Consumers wanting an in-flow project-specific audit re-add it via the gauntlet overrides file (see Project overrides), or run `/self-audit` manually.)
 3. **Close the loop — conformance check.** The review in step 1 is plan-vs-code (single-step); it inherits any requirement the plan already dropped. Before marking verify complete, dispatch a fresh-context **`conformance-reviewer`** — its **own** dispatch, never fused into the step-1 review — to confront the deliverable (code **and** docs) against the *origin* — the spec **and** the original prompt — per `verification-before-completion/reference/conformance-check.md`. Pass the spec path, the verbatim original prompt, and the full diff. Follow that reference for the partition rule, concern decomposition, and fix-loop mechanics; do not reimplement them here. The fix loop may drive `plan_tracker` to surface fix-wave progress (task naming and lifecycle per conformance-check.md's fix loop / the Fix fan-out Progress rule); it never calls `phase_tracker`. Call `phase_tracker({ action: "complete", phase: "verify" })` only when the reference says the handoff is durably complete: either a current `CONFORMS` result, or a current `## Closure / conformance` inventory whose carried-open concerns all come from valid deferred gaps, including `recommended: fix` gaps carried open because a declared precondition made the fix loop unavailable (`maxFixRounds: 0`, or no eligible named-branch worktree). A started positive-cap fix loop that blocks, fails, or exhausts its rounds with an open `fix` gap is escalation, not completion; on escalation, do not complete verify, stop and report.
 4. Summarize what was implemented (tasks completed, files changed, test counts, code-review verdict). Emit the `## Closure / conformance` block exactly as defined in `verification-before-completion/reference/conformance-check.md`: it must open with the two-line sentinel (`status: CONFORMS (0 open)` or `status: GAPS (N open)`, then `audited-base: <full HEAD SHA>`), then carry the exact durable concern schema by reference with no renamed or reformatted fields. `finishing-a-development-branch` Step 3.5 consumes that block verbatim.
 5. **Proceed to finishing — no confirmation prompt.** Once verify is complete per step 3's criterion, invoke `/skill:finishing-a-development-branch` immediately. Its Step 4 menu (squash / PR / keep / discard) is the human gate; a separate "ready to finish?" prompt only stacks a second stop in front of it. Carried-open concerns are resolved there per concern via the `## Closure / conformance` block from step 4. Manual testing is a follow-up after the finishing choice (on `<base-branch>` after a squash-merge, or on the PR branch), never a reason to hold this gate.
@@ -245,6 +247,7 @@ For the fan-out + worktree + patch-integration + conflict mechanics, see `dispat
 - Dispatching `code-reviewer` per task inside a wave (CR binds to the integrated wave diff)
 - Dispatching an implementer or code-reviewer without a `SCOPED_TEST_COMMANDS` value (commands or `none`)
 - About to run the full verification entrypoint during the implement phase — task and wave gates run scoped, plan-declared commands only; the full set belongs to verify
+- Dispositioning either after-all-tasks audit — fix dispatch, finding triage, verify-complete claim, or `conformance-reviewer` dispatch — before both the whole-diff review and the full verification run have completed
 
 ## Integration