pi-orchestrator-config 4.22.2 → 4.22.4

package/agents/git-expert.md

@@ -44,11 +44,20 @@ Before ANY `git commit`, if `review_loop_enforcement` is `true`:
 {{SETTINGS:dco,commit_trailer,use_worktrees,allow_push_to_protected_branches}}
 
 - If `dco` is `true`: add `--signoff` to `git commit`. Skip if already present.
-- If `commit_trailer` is a string (e.g. `"Assisted-by"`): append trailer to the commit message.
-  Format: `TRAILER: PI (MODEL) <noreply@pi.dev>` — replace MODEL with your actual model id
-  (e.g. `litellm/claude-opus-4-6`). NEVER write the literal string `$PI_MODEL`; quoted heredocs
-  and single-quoted messages do not expand it and the trailer lands broken. Skip if already present.
-  If the value contains commas, use the first name.
+- If `commit_trailer` is a string (e.g. `"Assisted-by"`): every commit you make MUST carry that
+  trailer, and who writes it depends on the commit shape:
+  - `git commit -m "…"` → the enforcement hook appends `TRAILER: PI (<model>)`.
+    Do not write it yourself.
+  - `echo … | git commit -F -` → the hook appends it. Do not write it yourself.
+  - `git commit -F <file>` (message written to a file, including heredoc-to-file) → the hook never
+    sees the file's contents, so append the trailer yourself with the already-resolved id:
+    `printf '\n\nTRAILER: PI (%s)\n' "$PI_MODEL" >> <file>` and then commit. The shell expands
+    `$PI_MODEL` while writing the file, so no placeholder can reach the message.
+  Never write a bare `MODEL` placeholder and never leave an unexpanded `$PI_MODEL` in a `-m` message:
+  the enforcement hook **refuses** such a commit (it reports the placeholder line back), and it also
+  refuses a commit shape it cannot inspect when the message shows no trailer. The fix is always to
+  write the trailer yourself with the real id, then commit again.
+  Skip only when the message already carries that trailer.
 - If `use_worktrees` is `true`: BLOCK `git checkout` (except `git checkout -- <file>`) and `git switch`.
   Use `git worktree add .worktrees/NAME -b BRANCH DEFAULT_BRANCH` instead
   (detect default branch via `git symbolic-ref refs/remotes/origin/HEAD`, fallback to `main`).

package/extensions/orchestrator/enforcement-helpers.ts

@@ -6,13 +6,14 @@
 import { createLogger } from "../shared/logger.js";
 import { createHash } from "node:crypto";
 import { lstatSync, realpathSync, mkdirSync, rmdirSync } from "node:fs";
+import { homedir } from "node:os";
 import { execFileSync } from "node:child_process";
 import * as path from "node:path";
 import { join } from "node:path";
 import { getProjectDataDir } from "./utils.js";
 import { getGlobalSettingsPath, getSettingsPath, loadGlobalSettings, loadProjectSettings } from "./project-settings.js";
 import { readSettingsFile, writeSettingsFile } from "./settings-tui-helpers.js";
-import { DANGEROUS, executableText, getCurrentBranch, isConflictResolutionCommand, segmentRunsGit, tokenize } from "./git-helpers.js";
+import { DANGEROUS, WRAPPER_VALUE_OPTIONS, executableText, getCurrentBranch, isConflictResolutionCommand, segmentRunsGit, tokenize } from "./git-helpers.js";
 
 const enfLog = createLogger("enforcement");
 enfLog.debug("enforcement-helpers module loaded");
@@ -313,7 +314,7 @@ function gitCsIn(segment: string): string[] {
 }
 
 /** Words that run whatever follows them, so an assignment behind one still counts. */
-const WRAPPER_WORDS = new Set(["sudo", "command", "exec", "time", "nohup", "nice", "stdbuf", "setsid", "timeout"]);
+const WRAPPER_WORDS = new Set(["sudo", "command", "exec", "time", "nohup", "nice", "stdbuf", "setsid", "timeout", "rtk"]);
 
 /** env options whose value is a separate word. */
 const ENV_VALUE_OPTIONS = new Set([
@@ -324,6 +325,26 @@ const ENV_VALUE_OPTIONS = new Set([
 const GIT_INDEX_VARS = new Set(["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_COMMON_DIR"]);
 const GIT_INDEX_OPTIONS = new Set(["--git-dir", "--work-tree", "--namespace"]);
 
+/** Command words that hand a quoted string to a shell, which then really runs it. */
+const SHELL_WORDS = new Set(["bash", "sh", "zsh", "dash", "ksh", "eval"]);
+
+/** True when this segment RUNS a shell (behind any wrapper/assignment/env prefix).
+ *  A quoted argument containing shell-looking text is not a shell run: only the
+ *  command word counts. */
+function runsNestedShell(tokens: string[]): boolean {
+  for (let i = 0; i < tokens.length; i++) {
+    const tok = tokens[i];
+    if (WRAPPER_WORDS.has(tok) || tok === "env" || /^[A-Za-z_][A-Za-z0-9_]*=/.test(tok)) continue;
+    if (tok.startsWith("-")) {
+      // env's own options sit between `env` and the command it runs.
+      if (!tok.includes("=") && ENV_VALUE_OPTIONS.has(tok.split("=")[0])) i++;
+      continue;
+    }
+    return SHELL_WORDS.has(tok.replace(/^[()]+/, "").replace(/.*\//, ""));
+  }
+  return false;
+}
+
 /**
  * Anything that points git at a repository other than the working directory: the
  * GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE environment variables, or the equivalent
@@ -336,21 +357,47 @@ const GIT_INDEX_OPTIONS = new Set(["--git-dir", "--work-tree", "--namespace"]);
  * only count in git's global option region, before the subcommand, so
  * `git add -- --work-tree=x` is a filename too.
  */
-function gitIndexOverride(command: string): string | null {
+/** What a scan looks for: the environment variables, git global options, and
+ *  `-c` config keys that select the repository or identity git runs with. */
+interface GitOverrideTargets {
+  /** Variables that count in assignment position. */
+  env: Set<string>;
+  /** Long options in git's global region, before the subcommand. */
+  flags: Set<string>;
+  /** Keys of `-c <key>=<value>` / `--config-env=<key>=<VAR>`. */
+  configKeys: Set<string>;
+}
+
+const NO_KEYS: Set<string> = new Set();
+
+/**
+ * The one assignment/option walk behind both git override guards
+ * (gitIndexOverride and gitIdentityOverride). Returns a label for what it found,
+ * or null.
+ *
+ * Position matters. An environment variable only counts in *assignment
+ * position* — `GIT_DIR=/x git add a.txt`, optionally through `env` — so
+ * `git add GIT_INDEX_FILE=notes` stages a file with that name. Options only
+ * count in git's global region before the subcommand, so
+ * `git add -- --work-tree=x` is a filename too.
+ */
+function scanGitOverrides(command: string, targets: GitOverrideTargets): string | null {
   const assignment = /^[A-Za-z_][A-Za-z0-9_]*=/;
+  const nameOf = (tok: string) => tok.split("=")[0];
   for (const seg of unquotedSegments(command)) {
     const tokens = tokenize(seg.text);
-    const nameOf = (tok: string) => tok.split("=")[0];
     let i = 0;
     // `export GIT_INDEX_FILE=/x` sets it for later commands in the same shell,
     // so it points git at another index just as an inline assignment does. This
     // segment does not run git itself, so it is checked before that requirement.
-    if (tokens[i] === "export") {
+    // The executable view of a nested shell wraps a segment in `(`, so `(export`
+    // is the same word.
+    if (tokens[i]?.replace(/^\(+/, "") === "export") {
       i++;
       while (i < tokens.length) {
         const name = nameOf(tokens[i]);
-        if (GIT_INDEX_VARS.has(name)) {
-          enfLog.warn("git_index_override", "source", name, "via", "export");
+        if (targets.env.has(name)) {
+          enfLog.warn("git_override", "source", name, "via", "export");
           return name;
         }
         i++;
@@ -358,17 +405,30 @@ function gitIndexOverride(command: string): string | null {
       continue;
     }
     // `echo GIT_INDEX_FILE=/x` only prints the name. An override is something
-    // git is actually run with, so the segment has to run git for it to count.
-    if (!segmentRunsGit(seg.text)) continue;
+    // git is actually run with, so the segment has to run git for it to count —
+    // directly, or through a nested shell that this segment RUNS
+    // (`GIT_AUTHOR_EMAIL=x bash -c 'git commit'`), whose assignment lives here
+    // but whose git runs inside. A quoted argument merely MENTIONING a command
+    // (`gh pr create --body "…git -c user.email=x commit…"`) is prose: the
+    // segment runs `gh`, not a shell, so it is not followed.
+    if (!segmentRunsGit(seg.text) && !(runsNestedShell(tokens) && segmentRunsGit(executableText(seg.text)))) continue;
     // Leading `VAR=value` assignments, then the same again after `env`. A
     // wrapper that runs the rest — `sudo`, `command`, `exec`, `time` — sits in
     // front of both, and can be chained.
     for (let round = 0; round < 4; round++) {
-      while (i < tokens.length && WRAPPER_WORDS.has(tokens[i])) i++;
+      // A wrapper runs the rest, and its OWN options sit in between: in
+      // `rtk -v GIT_AUTHOR_EMAIL=x git commit` the assignment follows rtk's
+      // option, so stepping only over the wrapper word hid it (Qodo, PR #996).
+      while (i < tokens.length && WRAPPER_WORDS.has(tokens[i])) {
+        i++;
+        while (i < tokens.length && tokens[i].startsWith("-") && tokens[i] !== "-") {
+          i += WRAPPER_VALUE_OPTIONS.has(tokens[i]) ? 2 : 1;
+        }
+      }
       while (i < tokens.length && assignment.test(tokens[i])) {
         const name = nameOf(tokens[i]);
-        if (GIT_INDEX_VARS.has(name)) {
-          enfLog.warn("git_index_override", "source", name);
+        if (targets.env.has(name)) {
+          enfLog.warn("git_override", "source", name);
           return name;
         }
         i++;
@@ -384,14 +444,30 @@ function gitIndexOverride(command: string): string | null {
         i++;
       }
     }
-    const g = tokens.indexOf("git");
+    // A segment can start mid-subshell, so `(git` is the git word too.
+    const g = tokens.findIndex((t) => t.replace(/^[()]+|[()]+$/g, "") === "git");
     if (g === -1) continue;
     for (let k = g + 1; k < tokens.length; k++) {
       const tok = tokens[k];
       if (!tok.startsWith("-") || tok === "-") break;
+      // `-c <key>=<value>`, `-c<key>=<value>`, `--config-env=<key>=<VAR>` apply to
+      // this one command only — no config file is written, the effect is the same.
+      let setting: string | undefined;
+      if (tok === "-c") setting = tokens[++k];
+      else if (tok.startsWith("-c")) setting = tok.slice(2);
+      else if (tok.startsWith("--config-env=")) setting = tok.slice("--config-env=".length);
+      if (setting !== undefined) {
+        const key = (setting.split("=")[0] ?? "").toLowerCase();
+        if (targets.configKeys.has(key)) {
+          const label = tok.startsWith("--config-env") ? `--config-env ${key}` : `-c ${key}`;
+          enfLog.warn("git_override", "source", label);
+          return label;
+        }
+        continue;
+      }
       const name = nameOf(tok);
-      if (GIT_INDEX_OPTIONS.has(name)) {
-        enfLog.warn("git_index_override", "source", name);
+      if (targets.flags.has(name)) {
+        enfLog.warn("git_override", "source", name);
         return name;
       }
       if (!tok.includes("=") && tokens[k + 1] && !tokens[k + 1].startsWith("-")) k++;
@@ -400,6 +476,168 @@ function gitIndexOverride(command: string): string | null {
   return null;
 }
 
+function gitIndexOverride(command: string): string | null {
+  const found = scanGitOverrides(command, { env: GIT_INDEX_VARS, flags: GIT_INDEX_OPTIONS, configKeys: NO_KEYS });
+  if (found) enfLog.warn("git_index_override", "source", found);
+  return found;
+}
+
+/** Environment variables that set who a commit is recorded as. */
+const GIT_IDENTITY_VARS = new Set([
+  "GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL", "GIT_COMMITTER_NAME", "GIT_COMMITTER_EMAIL",
+]);
+
+/** Git config keys that set who a commit is recorded as. */
+const GIT_IDENTITY_KEYS = new Set([
+  "user.name", "user.email", "author.name", "author.email", "committer.name", "committer.email",
+]);
+
+/** `git config` flags that only READ: `git config --get user.email` changes nothing. */
+const CONFIG_READ_FLAGS = new Set(["--get", "--get-all", "--get-regexp", "--list", "-l"]);
+
+/** `git config` flags that remove a key: no value follows, yet the identity moves. */
+const CONFIG_UNSET_FLAGS = new Set(["--unset", "--unset-all"]);
+
+/**
+ * True when a bash command WRITES into a path matching `targetSrc` (a regex
+ * source): a redirect (`>`, `>>`, `>|`) or `tee`/`sponge` taking it as an
+ * argument. Deliberately NARROW (user decision on issue #949 R3): broad
+ * write-verb co-occurrence taxed legitimate work and any text guard is
+ * bypassable anyway — this catches the lazy one-liner.
+ *
+ * Redirect STRUCTURE is read from the prose-masked command; quoted targets are
+ * invisible once masked, so those are matched on the raw command (Qodo #950 R5).
+ */
+export function bashWritesToPath(command: string, maskedCommand: string, targetSrc: string): boolean {
+  // `tee -a <path>` / `tee --append <path>`: tee's own options sit between it and
+  // the path it writes.
+  const STRUCTURAL = String.raw`>+\|?\s*\S*${targetSrc}|(?:^|[\s;&|(])(?:tee|sponge)(?:\s+-[A-Za-z-]+)*\s+\S*${targetSrc}`;
+  const QUOTED = String.raw`>+\s*["'][^"']*${targetSrc}|(?:^|[\s;&|(])(?:tee|sponge)(?:\s+-[A-Za-z-]+)*\s+["'][^"']*${targetSrc}`;
+  let result = new RegExp(STRUCTURAL, "i").test(maskedCommand) || new RegExp(QUOTED, "i").test(command);
+  if (!result) {
+    // A nested shell's script is code, not prose, so a redirect inside it
+    // (`bash -c 'echo x >> .git/config'`) still writes the file. Only segments
+    // that RUN a shell are read this way — a quoted argument merely describing
+    // a command stays prose (Qodo, PR #996).
+    for (const seg of unquotedSegments(command)) {
+      if (!runsNestedShell(tokenize(seg.text))) continue;
+      if (new RegExp(STRUCTURAL, "i").test(executableText(seg.text))) {
+        result = true;
+        break;
+      }
+    }
+  }
+  enfLog.debug("bash_writes_to_path", targetSrc, result);
+  return result;
+}
+
+
+const IDENTITY_TARGETS: GitOverrideTargets = {
+  env: GIT_IDENTITY_VARS,
+  flags: NO_KEYS,
+  configKeys: GIT_IDENTITY_KEYS,
+};
+
+/**
+ * Anything that sets the identity a commit is recorded under (issue #995): the
+ * `GIT_AUTHOR_*` / `GIT_COMMITTER_*` environment variables in assignment
+ * position, a
+ * per-command `git -c user.name=...`, a `git config` WRITE of an identity key,
+ * or `git commit --author`. The identity belongs to the human — an agent that
+ * can change it forges commits in someone else's name.
+ *
+ * Returns a label of what was found, or null.
+ *
+ * shortcut: a `-c` key held in a shell variable (`-c "$VAR=x"`) does not match,
+ * and a quoted value nested two shells deep is seen only if the outer view keeps
+ * it parseable — upgrade if either shows up in the wild.
+ */
+export function gitIdentityOverride(command: string): string | null {
+  // A nested shell string (`bash -c '...'`, `eval`) really runs, so both views
+  // are checked: the raw text keeps quoted option VALUES parseable
+  // (`-c "user.name=x"`), the executable view exposes what a nested shell runs.
+  const executable = executableText(command);
+  for (const text of executable && executable !== command ? [command, executable] : [command]) {
+    const found = scanGitOverrides(text, IDENTITY_TARGETS) ?? identityWritesIn(text);
+    if (found) {
+      enfLog.warn("git_identity_override", "source", found);
+      return found;
+    }
+  }
+  enfLog.debug("git_identity_override", "none", command.length);
+  return null;
+}
+
+/**
+ * The two identity writes the prefix scan cannot see: `git config <identity key>
+ * <value>` (written to disk for every later commit) and `git commit --author`
+ * (this one commit recorded as somebody else).
+ */
+function identityWritesIn(command: string): string | null {
+  // `git config user.email x` — the identity written to disk for every later commit.
+  for (const region of gitSubArgRegions(command, "config")) {
+    // Tokens come from the RAW region: tokenize() drops the quotes but keeps a
+    // quoted value as one token, so `git config user.email "a@b"` and
+    // `git config "user.email" a@b` are both seen, while a value that merely
+    // MENTIONS the key stays a single token and is never a key (Qodo, PR #996).
+    const tokens = tokenize(region);
+    if (tokens.some((t) => CONFIG_READ_FLAGS.has(t))) continue;
+    const at = tokens.findIndex((t) => GIT_IDENTITY_KEYS.has(t.toLowerCase()));
+    if (at === -1) continue;
+    // A key alone is a READ (`git config user.email` prints it): only a value
+    // after it, or an unset, changes the identity.
+    const writes = tokens.some((t) => CONFIG_UNSET_FLAGS.has(t))
+      || tokens.slice(at + 1).some((t) => !t.startsWith("-"));
+    if (writes) return `git config ${tokens[at].toLowerCase()}`;
+  }
+  // `git commit --author` — this one commit is recorded as somebody else.
+  for (const region of gitSubArgRegions(command, "commit")) {
+    // Raw region again: `--author 'A <a@b>'` and `"--author" x` are options the
+    // shell passes to git, while a `-m` message mentioning --author is ONE token.
+    const tokens = tokenize(region);
+    const at = tokens.findIndex((t) => t === "--author" || t.startsWith("--author="));
+    if (at === -1) continue;
+    // A bare `--author` with no value after it sets nothing.
+    if (tokens[at].includes("=") || (tokens[at + 1] !== undefined && !tokens[at + 1].startsWith("-"))) {
+      return "--author";
+    }
+  }
+  return null;
+}
+
+/**
+ * A path that IS git's identity configuration: `~/.gitconfig`, the XDG
+ * `~/.config/git/config`, or a repository's `.git/config`. Writing one of these
+ * changes the identity every later commit is recorded under, so agents are kept
+ * away from them entirely.
+ * The two home files count only under THIS user's home — a `.gitconfig` in
+ * /tmp or a docs fixture is not the identity git reads (Qodo, PR #996).
+ */
+/**
+ * Regex source matching a git identity config path as WRITTEN in a shell
+ * command — `$HOME`/`~`/absolute home forms and repo-local `.git/config`.
+ * One source of truth for the tripwire and its tests (Qodo, PR #996).
+ */
+export function gitIdentityConfigSrc(): string {
+  const homeSrc = homedir().replace(/\\/g, "/").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return String.raw`(?:(?:~|\$HOME|\$\{HOME\}|${homeSrc})/(?:\.gitconfig|\.config/git/config)|\.git/config)(?![A-Za-z0-9._-])`;
+}
+
+export function isGitIdentityConfigPath(p: string): boolean {
+  const norm = p.replace(/\\/g, "/").replace(/\/+$/, "");
+  const base = norm.slice(norm.lastIndexOf("/") + 1);
+  const dir = norm.slice(0, Math.max(norm.lastIndexOf("/"), 0));
+  const home = homedir().replace(/\\/g, "/").replace(/\/+$/, "");
+  const inHome = dir === home || dir === "~";
+  const result =
+    (inHome && base === ".gitconfig")
+    || norm === `${home}/.config/git/config`
+    || norm === "~/.config/git/config"
+    || /(?:^|\/)\.git\/config$/.test(norm);
+  enfLog.debug("is_git_identity_config_path", p, result);
+  return result;
+}
+
 /**
  * Every directory the command could plausibly run git in.
  *
@@ -2039,8 +2277,13 @@ function subArgSpans(command: string, sub: string): Array<{ start: number; end:
   const spans: Array<{ start: number; end: number; text: string; maskedText: string; stripped: string; masked: string }> = [];
   for (const m of masked.matchAll(re)) {
     const start = (m.index ?? 0) + m[0].length;
-    const rest = stripped.slice(start);
-    const end = rest.search(/[;&|\n]/);
+    // Boundaries are searched on the MASKED text, so a separator inside a quoted
+    // argument is prose, not the end of the invocation: in
+    // `git commit -m "message; more message" --author='A <a@b>'` the author
+    // option belongs to this commit and must stay inside its region (Qodo, PR
+    // #996). Masking is length-preserving, so the offset is valid on the
+    // original string and the region content still comes from it.
+    const end = masked.slice(start).search(/[;&|\n]/);
     const stop = end === -1 ? stripped.length : start + end;
     spans.push({
       start,
@@ -2363,24 +2606,103 @@ function bodyAlreadySigned(text: string): boolean {
   return false;
 }
 
-// Trailer-shaped line: `Token:` at line start (real newline, literal \n
-// escape, or command start), then the PI trailer identity. Anchoring to the
-// line start keeps mid-sentence prose and unrelated compound-command parts
-// untouched (Qodo 988d3a68) — only an actual trailer line is rewritten.
-const unexpandedTrailerLine = /(^|\n|\\n|-m\s+['"])([ \t]*[A-Za-z][A-Za-z0-9-]*:[ \t]*)PI \(\$PI_MODEL\)/g;
-
-/** #932: an agent may write the commit trailer with the literal `$PI_MODEL`
- *  (typically inside a quoted heredoc, where the shell cannot expand it).
- *  Rewrite the trailer identity to the resolved model id before the commit
- *  runs. Returns the fixed command, or null when nothing needed fixing.
- *  Scoped to `git commit` commands and to trailer-shaped lines only, so
- *  commit-message prose that legitimately mentions `$PI_MODEL` — bare or
- *  mid-sentence — and unrelated parts of compound commands are untouched. */
-export function fixUnexpandedCommitTrailer(command: string, modelId: string): string | null {
-	if (!command.includes("$PI_MODEL")) return null;
+// Trailer-shaped line: `Token:` at line start (real newline, literal \n escape, or
+// command start), then a PI trailer identity that is a PLACEHOLDER rather than a model
+// id. Detection only — the hook refuses such a commit instead of rewriting text it may
+// have misparsed (Qodo, PR #1004).
+const placeholderTrailerLine = /(^|\n|\\n|-m\s+['"])([ \t]*[A-Za-z][A-Za-z0-9-]*:[ \t]*)PI \(\$?\{?PI_MODEL\}?|MODEL\)/g;
+
+/** The trailer line carrying an unresolved placeholder, or null when the command has none.
+ *  A `Token:` anchor keeps prose that merely mentions the placeholder out of the result. */
+export function findPlaceholderTrailer(command: string): string | null {
+	if (!/(?:PI_MODEL|\bMODEL\b)/.test(command)) return null;
 	if (!/\bgit\s+commit\b/.test(command)) return null;
-	const fixed = command.replace(unexpandedTrailerLine, `$1$2PI (${modelId})`);
-	return fixed === command ? null : fixed;
+	const matches = [...command.matchAll(placeholderTrailerLine)];
+	const found = matches.at(-1);
+	if (!found) {
+		enfLog.debug("placeholder trailer none");
+		return null;
+	}
+	const line = `${(found[2] ?? "").trim()} PI (placeholder)`;
+	enfLog.warn("placeholder trailer found", line);
+	return line;
+}
+
+/** Trailers where git itself needs an address: `Co-authored-by` credits a person. */
+const TRAILERS_REQUIRING_EMAIL = new Set(["co-authored-by"]);
+
+/** The value appended after `<Trailer>:`. `Assisted-by` needs no address, `Co-authored-by`
+ *  does — hosting integrations only credit a co-author through `Name <email>`. */
+export function commitTrailerIdentity(trailerName: string, modelId: string): string {
+	const needsEmail = TRAILERS_REQUIRING_EMAIL.has(trailerName.trim().toLowerCase());
+	const identity = needsEmail ? `PI (${modelId}) <noreply@pi.dev>` : `PI (${modelId})`;
+	enfLog.debug("commit_trailer_identity", trailerName, needsEmail);
+	return identity;
+}
+
+/** Does a `-F <file>` commit message already carry the trailer?
+ *  The caller injects the reader so the decision is testable without touching disk —
+ *  the hook reads the file, it does not guess from the command text (Qodo, PR #1004). */
+export function messageFileTrailerState(
+	filePath: string,
+	trailerName: string,
+	read: (path: string) => string,
+): "has" | "missing" | "unreadable" {
+	try {
+		const state = commandHasTrailerByName(read(filePath).slice(0, 64_000), trailerName) ? "has" : "missing";
+		enfLog.debug("message_file_trailer", filePath, state);
+		return state;
+	} catch (error: any) {
+		// warn, not debug: trailer verification could not inspect the message, which is a
+		// degraded guarantee an operator needs to see (Qodo, PR #1004).
+		enfLog.warn("message_file_trailer unreadable", filePath, String(error?.message ?? error));
+		return "unreadable";
+	}
+}
+
+/** Append `<Trailer>: PI (<model>)` to the message of a real commit invocation.
+ *  Covers the two shapes whose message the hook can see — `echo … | git commit -F -`
+ *  and `git commit -m "…"` — and returns null when the trailer is already there or
+ *  the shape is not covered. Pure so the injection path is testable without a hook. */
+export function injectCommitTrailer(command: string, trailerName: string, modelId: string): string | null {
+	const identity = commitTrailerIdentity(trailerName, modelId);
+	// Pattern A: echo "..." | git commit -F -
+	const pipeIdx = command.lastIndexOf("|");
+	if (pipeIdx !== -1 && /git\s+commit\s+.*-F\s*-/.test(command.slice(pipeIdx))) {
+		const echoPart = command.slice(0, pipeIdx);
+		const gitPart = command.slice(pipeIdx);
+		const lastQuoteIdx = Math.max(echoPart.lastIndexOf('"'), echoPart.lastIndexOf("'"));
+		if (lastQuoteIdx > 0) {
+			if (commandHasTrailerByName(echoPart, trailerName)) {
+				enfLog.debug("inject_commit_trailer", "already present", trailerName);
+				return null;
+			}
+			const quoteChar = echoPart[lastQuoteIdx];
+			const escaped = quoteChar === "'"
+				? `${escapeForSingleQuote(trailerName)}: ${identity}`
+				: `${escapeForDoubleQuote(trailerName)}: ${identity}`;
+			enfLog.info("inject_commit_trailer", "piped", trailerName);
+			return echoPart.slice(0, lastQuoteIdx) + `\\n\\n${escaped.replace(/\n/g, "\\n")}` + echoPart.slice(lastQuoteIdx) + gitPart;
+		}
+		return null;
+	}
+	// Pattern B: git commit -m "..." or git commit -m '...'
+	const mFlagMatch = command.match(/git\s+commit\s+.*-m\s+(["'])([\s\S]*?)\1/);
+	if (!mFlagMatch) return null;
+	// Every `-m` is a message paragraph, so an existing trailer in ANY of them wins.
+	const allPayloads = [...command.matchAll(/-m\s+(["'])([\s\S]*?)\1/g)].map((m) => m[2] ?? "").join("\n");
+	if (commandHasTrailerByName(allPayloads, trailerName)) {
+		enfLog.debug("inject_commit_trailer", "already present", trailerName);
+		return null;
+	}
+	const quoteChar = mFlagMatch[1];
+	const escaped = quoteChar === "'"
+		? `${escapeForSingleQuote(trailerName)}: ${identity}`
+		: `${escapeForDoubleQuote(trailerName)}: ${identity}`;
+	const fullMatch = mFlagMatch[0];
+	const insertPos = command.indexOf(fullMatch) + fullMatch.length - 1;
+	enfLog.info("inject_commit_trailer", "inline", trailerName);
+	return command.slice(0, insertPos) + `\n\n${escaped}` + command.slice(insertPos);
 }
 
 /** Keep the first standalone valid footer, but use the current operation's model. */

package/extensions/orchestrator/enforcement.ts

@@ -20,7 +20,8 @@ import { getProjectTmpDir, resolveWorktreeRoot } from "./utils.js";
 import {
   conflictCandidateDirs,
   pushTargetsProtectedBranch,
-  fixUnexpandedCommitTrailer,
+  findPlaceholderTrailer,
+  messageFileTrailerState,
   maskQuotedRegions,
   isStdinFedShellStatement,
 } from "./enforcement-helpers.js";
@@ -46,12 +47,17 @@ import {
   checkPythonPipBlock,
   checkRemoteExecBlock,
   checkTempFileEnforcement,
+  bashWritesToPath,
   gitAddPathspecs,
+  gitIdentityConfigSrc,
+  gitIdentityOverride,
   gitSubArgRegions,
   hasGitAddBulk,
   hasGitAddForce,
+  injectCommitTrailer,
   injectSignoff,
   injectGhBodySignature,
+  isGitIdentityConfigPath,
   isReadOnlyStatement,
   isRealGitCommitOrPush,
   isRmInProjectTmp,
@@ -114,9 +120,23 @@ function writeRepeatState(state: { lastCmd: string; count: number }): void {
 
 
 
+/** Placeholder strings that are never a real model id — printing one in a trailer ships a bug. */
+const PLACEHOLDER_MODEL_IDS = new Set(["model", "pi_model", "$pi_model", "${pi_model}", "unknown"]);
+
 /** Resolve the model id used in commit/PR trailers (env first, then ctx). */
-function commitTrailerModelId(ctx: any): string {
-  return (process.env.PI_PRIMARY_MODEL || process.env.PI_MODEL || (ctx as any).model?.id || "unknown").replace(/[^a-zA-Z0-9._:@/ -]/g, "").trim() || "unknown";
+export function commitTrailerModelId(ctx: any): string {
+  for (const raw of [process.env.PI_PRIMARY_MODEL, process.env.PI_MODEL, (ctx as any).model?.id]) {
+    const trimmed = (raw ?? "").trim();
+    if (!trimmed) continue;
+    if (PLACEHOLDER_MODEL_IDS.has(trimmed.toLowerCase())) {
+      log.debug("commit_trailer: skipped placeholder model id", trimmed);
+      continue;
+    }
+    const clean = trimmed.replace(/[^a-zA-Z0-9._:@/ -]/g, "").trim();
+    if (clean) return clean;
+  }
+  log.warn("commit_trailer: no model id resolved — trailer identity is unknown");
+  return "unknown";
 }
 
 /** Inject commit trailer into command (Assisted-by, Co-authored-by, etc.) */
@@ -124,18 +144,20 @@ function commitTrailerModelId(ctx: any): string {
 let bridgedUi: ReturnType<typeof createBridgedUi> | null = null;
 
 async function handleCommitTrailer(command: string, event: any, ctx: any, gitCwd: string): Promise<EnforcementResult> {
-  // #932: rewrite a literal `$PI_MODEL` in the trailer identity — an agent
-  // following the git-expert trailer instruction may write the placeholder
-  // verbatim (quoted heredocs and single-quoted -m strings never expand it).
-  // This runs BEFORE the setting check and pattern matching so heredoc/-F
-  // commits — which the injection patterns below do not cover — still get a
-  // correct trailer, and the dedup check below sees the already-fixed name.
-  const literalModelId = commitTrailerModelId(ctx);
-  const fixedCommand = fixUnexpandedCommitTrailer(command, literalModelId);
-  if (fixedCommand !== null) {
-    log.info("commit_trailer: replaced unexpanded $PI_MODEL literal with model id", literalModelId);
-    command = fixedCommand;
-    event.input.command = fixedCommand;
+  // A placeholder trailer is REFUSED, never rewritten: the hook cannot safely tell
+  // command text from message prose (a commit message quoting the very shape it
+  // parses, a `;` inside quotes, indented examples), and rewriting the wrong span
+  // corrupts a message or edits an unrelated command. The agent has the text, so it
+  // fixes it and retries (Qodo, PR #1004).
+  const placeholder = findPlaceholderTrailer(command);
+  if (placeholder) {
+    return {
+      block: true,
+      reason:
+        `⛔ Commit refused: the trailer carries an unresolved placeholder (${placeholder}). ` +
+        `Write \`TRAILER: PI (${commitTrailerModelId(ctx)})\` instead of a MODEL/$PI_MODEL placeholder ` +
+        "and re-run the commit.",
+    };
   }
 
   const trailerSetting = getSetting(gitCwd, "commit_trailer");
@@ -143,7 +165,6 @@ async function handleCommitTrailer(command: string, event: any, ctx: any, gitCwd
 
   const modelId = commitTrailerModelId(ctx);
 
-  const piIdentity = `PI (${modelId}) <noreply@pi.dev>`;
   let trailerName: string;
 
   if (trailerSetting.includes(",")) {
@@ -180,55 +201,54 @@ async function handleCommitTrailer(command: string, event: any, ctx: any, gitCwd
     trailerName = trailerSetting;
   }
 
-  // Pattern A: echo "..." | git commit -F -
-  const pipeIdx = command.lastIndexOf("|");
-  if (pipeIdx !== -1 && /git\s+commit\s+.*-F\s*-/.test(command.slice(pipeIdx))) {
-    const echoPart = command.slice(0, pipeIdx);
-    const gitPart = command.slice(pipeIdx);
-    const lastDoubleQuote = echoPart.lastIndexOf('"');
-    const lastSingleQuote = echoPart.lastIndexOf("'");
-    const lastQuoteIdx = Math.max(lastDoubleQuote, lastSingleQuote);
-    if (lastQuoteIdx > 0) {
-      // Determine quote context for correct escaping
-      const quoteChar = echoPart[lastQuoteIdx];
-      // Scope dedup to the echo/message-construction portion (before the pipe), which
-      // excludes the git args. Do NOT attempt to slice out the exact quoted substring
-      // by backward-scanning for a quote — escaped quotes (\") inside the message would
-      // misparse the boundary and cause a missed trailer -> duplicate injection.
-      if (commandHasTrailerByName(echoPart, trailerName)) {
-        log.debug("commit_trailer already present in echo message (by name) — skipping injection", trailerName);
-        return undefined;
-      }
-      const escaped = quoteChar === "'"
-        ? `${escapeForSingleQuote(trailerName)}: ${piIdentity}`
-        : `${escapeForDoubleQuote(trailerName)}: ${piIdentity}`;
-      event.input.command =
-        echoPart.slice(0, lastQuoteIdx) + `\\n\\n${escaped.replace(/\n/g, "\\n")}` + echoPart.slice(lastQuoteIdx) + gitPart;
-    }
+  const injected = injectCommitTrailer(command, trailerName, modelId);
+  if (injected !== null) {
+    event.input.command = injected;
+    return undefined;
   }
-  // Pattern B: git commit -m "..." or git commit -m '...'
-  else {
-    const mFlagMatch = command.match(/git\s+commit\s+.*-m\s+(["'])([\s\S]*?)\1/);
-    if (mFlagMatch) {
-      const quoteChar = mFlagMatch[1];
-      // Scope duplicate-by-name detection to the -m message payload only
-      // (mFlagMatch[2]) — not the whole command — so an unrelated arg/env var
-      // containing the trailer token does not wrongly skip injection.
-      const payload = mFlagMatch[2];
-      if (commandHasTrailerByName(payload, trailerName)) {
-        log.debug("commit_trailer already present in message (by name) — skipping injection", trailerName);
-        return undefined;
-      }
-      const escaped = quoteChar === "'"
-        ? `${escapeForSingleQuote(trailerName)}: ${piIdentity}`
-        : `${escapeForDoubleQuote(trailerName)}: ${piIdentity}`;
-      const fullMatch = mFlagMatch[0];
-      const insertPos = command.indexOf(fullMatch) + fullMatch.length - 1;
-      event.input.command =
-        command.slice(0, insertPos) + `\n\n${escaped}` + command.slice(insertPos);
+  // `git commit -F <file>`: the message is a file we CAN read, so check it instead of
+  // guessing. Refusing a message that already carries the trailer would block the very
+  // flow the git-expert instruction describes (Qodo, PR #1004).
+  const fileMessage = command.match(/git\s+commit\b[^\n]*?-F\s+(?!-)(["']?)([^\s"']+)\1/);
+  if (fileMessage && fileMessage[2]) {
+    // The read happens BEFORE the command runs, so a command that writes the same file
+    // would be verified against its OLD contents while git commits the new ones. Refuse
+    // that shape instead of trusting the stale read (Qodo, PR #1004).
+    const filePathSrc = fileMessage[2].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    if (bashWritesToPath(command, maskQuotedRegions(command), filePathSrc)) {
+      log.warn("commit_trailer: message file is written by the same command", fileMessage[2]);
+      return {
+        block: true,
+        reason:
+          `⛔ Commit refused: this command writes ${fileMessage[2]} and commits it in the same call, ` +
+          "so the message cannot be verified before it is read. Write the message (with the trailer) in one call and commit in the next.",
+      };
+    }
+    const candidate = path.isAbsolute(fileMessage[2]) ? fileMessage[2] : join(gitCwd, fileMessage[2]);
+    const state = messageFileTrailerState(candidate, trailerName, (p) => readFileSync(p, "utf8"));
+    if (state === "has") {
+      log.debug("commit_trailer: message file already carries the trailer", candidate);
+      return undefined;
+    }
+    if (state === "missing") {
+      return {
+        block: true,
+        reason:
+          `⛔ Commit refused: the message file ${fileMessage[2]} has no \`${trailerName}\` trailer. ` +
+          `Append it with the real id — \`printf '\\n\\n" + trailerName + ": PI (%s)\\n' \"$PI_MODEL\" >> " + fileMessage[2] + "\` — then re-run the commit.`,
+      };
     }
   }
-
+  // Other opaque shapes must carry the trailer already; refusing beats guessing.
+  if (!commandHasTrailerByName(command, trailerName)) {
+    return {
+      block: true,
+      reason:
+        `⛔ Commit refused: no \`${trailerName}\` trailer found and this commit shape is opaque to the hook ` +
+        `(the message is built in a way it cannot inspect). Add \`${trailerName}: PI (${modelId})\` to the message ` +
+        "yourself — e.g. `printf '\\n\\n" + trailerName + ": PI (%s)\\n' \"$PI_MODEL\" >> <file>` for `-F <file>` — then re-run the commit.",
+    };
+  }
   return undefined;
 }
 
@@ -755,6 +775,17 @@ export function registerEnforcement(pi: ExtensionAPI, inContainer?: boolean): vo
               "\u26d4 Direct modification of pi-config-settings blocked — it carries the dangerous-command allowlist. Change settings via the /pi-config-settings command or your own editor, never agent tools.",
           };
         }
+        // Git identity config is off-limits to agents too (issue #995): the
+        // identity a commit is recorded under belongs to the human, so no agent
+        // writes it by hand — same alias-proof resolution as the settings guard.
+        if (isGitIdentityConfigPath(resolved) || isGitIdentityConfigPath(toReal(resolved))) {
+          return {
+            block: true,
+            reason:
+              "\u26d4 Git identity config is off-limits to agents. The git identity belongs to the human — " +
+              "if it is wrong, tell the user to fix their own git config.",
+          };
+        }
       }
     }
 
@@ -788,12 +819,7 @@ export function registerEnforcement(pi: ExtensionAPI, inContainer?: boolean): vo
     const maskedCmd = maskQuotedRegions(command);
     if (
       cmdLower.includes("pi-config-settings") &&
-      (/>+\|?\s*\S*pi-config-settings/i.test(maskedCmd) ||
-        /(?:^|[\s;&|(])(?:tee|sponge)\s+\S*pi-config-settings/i.test(maskedCmd) ||
-        // Quoted redirect/tee TARGETS are invisible in the masked text —
-        // catch them on the raw command (Qodo PR #950 R5).
-        />+\s*["'][^"']*pi-config-settings/i.test(command) ||
-        /(?:^|[\s;&|(])(?:tee|sponge)\s+["'][^"']*pi-config-settings/i.test(command))
+      bashWritesToPath(command, maskedCmd, "pi-config-settings")
     ) {
       return {
         block: true,
@@ -802,6 +828,21 @@ export function registerEnforcement(pi: ExtensionAPI, inContainer?: boolean): vo
       };
     }
 
+    // Block bash WRITES targeting a git identity config file (issue #995) —
+    // same narrow tripwire shape as the settings one above. The home files
+    // count only under THIS user's home: a `.gitconfig` in /tmp is not the
+    // identity git reads (Qodo, PR #996). One pattern, shared with the tests.
+    const IDENTITY_CONFIG_SRC = gitIdentityConfigSrc();
+    if (bashWritesToPath(command, maskedCmd, IDENTITY_CONFIG_SRC)) {
+      log.error("git_identity_config_write_blocked");
+      return {
+        block: true,
+        reason:
+          "\u26d4 Bash command writing a git identity config (~/.gitconfig, ~/.config/git/config, .git/config) blocked. " +
+          "The git identity belongs to the human — if it is wrong, tell the user to fix their own git config.",
+      };
+    }
+
     // Block repeated identical commands (polling-by-spam) — orchestrator only.
     // Skip on acpx: async LLM agents are unavailable; foreground polls are expected.
     const parentSupportsAsyncLlm = supportsAsyncLlm(
@@ -896,6 +937,23 @@ export function registerEnforcement(pi: ExtensionAPI, inContainer?: boolean): vo
       }
     }
 
+    // The git identity belongs to the human (issue #995): an agent that can set
+    // user.name/user.email can forge a commit in someone else's name. Checked
+    // before the git-expert split below so it holds for EVERY agent, and before
+    // any git-repo lookup so it holds outside a repo too.
+    const identityOverride = gitIdentityOverride(command);
+    if (identityOverride) {
+      // error, not warn: the command was refused, not recovered from.
+      log.error("git_identity_override_blocked", "source", identityOverride);
+      return {
+        block: true,
+        reason:
+          `\u26d4 Git identity override blocked (${identityOverride}). The git identity belongs to the human: ` +
+          "never set user.name/user.email, GIT_AUTHOR_*/GIT_COMMITTER_*, --author, or `git config user.*`. " +
+          "If the identity is wrong, tell the user to fix their own git config.",
+      };
+    }
+
     // Enforce git commit/push only via git-expert agent.
     // Use isRealGitCommitOrPush (heredoc-stripped + command-position aware) so that
     // file CONTENT / string args / paths that merely MENTION "git commit" do not trip

package/extensions/orchestrator/git-helpers.ts

@@ -771,7 +771,7 @@ const GIT_EXECUTORS = new Set([
 ]);
 
 /** Wrapper options whose operand names something other than the command. */
-const WRAPPER_VALUE_OPTIONS = new Set([
+export const WRAPPER_VALUE_OPTIONS = new Set([
   "-u", "--user", "-g", "--group", "-h", "--host", "-p", "--prompt", "-r", "--role",
   "-t", "--type", "-U", "--other-user", "-C", "--chdir", "--preserve-env",
 ]);
@@ -811,15 +811,36 @@ export function segmentRunsGit(segment: string): boolean {
   return verdict;
 }
 
-function classifySegment(segment: string): boolean {
-  const words = tokenize(segment.trim());
+/**
+ * The index of the word that runs the segment's command: skips control keywords,
+ * inline assignments, and TRANSPARENT prefixes whose own options sit before the
+ * command they run (`rtk -v git add`). Every consumer that needs "what does this
+ * segment actually run" goes through here, so a prefix is never handled in one
+ * parser and forgotten in another (Qodo, PR #996).
+ */
+function skipToCommandWord(words: string[]): number {
   let k = 0;
   while (k < words.length) {
     // `function NAME { ... }` puts the name between the keyword and the body.
     if (words[k] === "function") { k += 2; continue; }
     if (SEGMENT_SKIP.has(words[k]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[k])) { k += 1; continue; }
+    // rtk runs exactly the command after it, so the next word decides. It is not
+    // an executor: `rtk grep git add f` runs grep, it does not stage.
+    if (words[k] === "rtk") {
+      k += 1;
+      while (k < words.length && words[k].startsWith("-") && words[k] !== "-") {
+        k += WRAPPER_VALUE_OPTIONS.has(words[k]) ? 2 : 1;
+      }
+      continue;
+    }
     break;
   }
+  return k;
+}
+
+function classifySegment(segment: string): boolean {
+  const words = tokenize(segment.trim());
+  const k = skipToCommandWord(words);
   if (k < words.length) {
     // A segment can start mid-subshell, so `(git` is still the git command.
     const head = words[k].replace(/^[()]+|[()]+$/g, "");
@@ -847,13 +868,7 @@ function executedGitCommands(cmd: string): string[][] {
   const kept: string[][] = [];
   for (const raw of cmd.split(/[\n;&|()]+/)) {
     const words = tokenize(raw.trim());
-    let k = 0;
-    while (k < words.length) {
-      // `function NAME { ... }` puts the name between the keyword and the body.
-      if (words[k] === "function") { k += 2; continue; }
-      if (SEGMENT_SKIP.has(words[k]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[k])) { k += 1; continue; }
-      break;
-    }
+    const k = skipToCommandWord(words);
     if (k >= words.length) continue;
     // A segment can start mid-subshell, so `(git` is still the git command.
     const head = words[k].replace(/^[()]+|[()]+$/g, "");
@@ -893,10 +908,8 @@ const GLOBAL_LONG_VALUE_OPTIONS = new Set(["--git-dir", "--work-tree", "--namesp
  */
 /** The index of the word that runs git, or -1. */
 function gitWordIndex(words: string[]): number {
-  let k = 0;
-  while (k < words.length) {
-    if (words[k] === "function") { k += 2; continue; }
-    if (SEGMENT_SKIP.has(words[k]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[k])) { k += 1; continue; }
+  const k = skipToCommandWord(words);
+  if (k < words.length) {
     const head = words[k].replace(/^[()]+|[()]+$/g, "");
     if (isGitWord(head)) return k;
     // A wrapper runs whatever follows it. `command -v git` prints the path

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-orchestrator-config",
-  "version": "4.22.2",
+  "version": "4.22.4",
   "description": "Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands",
   "keywords": [
     "pi-package"

package/rules/00-orchestrator-core.md

@@ -34,6 +34,8 @@ Outside slash commands, never use edit, write, or bash directly (except `codemod
 
 ## Before Implementation (MANDATORY)
 
+**For 2+ distinct actions, your first action is one `TaskBulkCreate` listing every step** — before the first edit or the first agent call (see `60-task-tracking.md`).
+
 Before ANY code changes, run the pre-implementation checklist:
 
 → **See the "Pre-Implementation Checklist" section below** — Do NOT skip this step.

package/rules/60-task-tracking.md

@@ -7,58 +7,37 @@
 
 ---
 
-## When to Create Tasks
+## When Tasks Are Required
 
-**BEFORE starting any multi-step workflow (3+ steps)**, use `TaskCreate` to list ALL steps first.
+The request needs **2+ distinct actions** — then tasks are required:
 
-**Use tasks for:** feature implementation, bug fixes with multiple files,
-workflows from `rules/05-issue-first-workflow.md` or `rules/20-code-review-loop.md`,
-multi-file refactoring, or any work involving more than 2 actions.
+- more than one file to change, or code plus tests plus docs
+- any workflow from `05-issue-first-workflow.md` or `20-code-review-loop.md`
+- the user lists several things to do ("do X, then Y", numbered items)
+- work conditioned on a future event ("after Qodo approves, deploy and test") — create the tasks now, put the trigger in the description, and block the dependents on it
 
-**Deferred missions count as multi-step work.** When the user assigns work
-conditional on a future event ("after X", "once Y", "when Z"), create the
-tasks IMMEDIATELY in that same turn — the trigger condition goes in the task
-description, and dependent tasks block on the trigger task. Never carry a
-deferred mission only in conversation memory: compaction or a session
-restart loses it silently.
+**No tasks:** a single-step action, a one-file/one-line change, a question, an explanation, read-only investigation.
 
-- ❌ BAD: "after Qodo approves, deploy and test" → acknowledged, no task
-- ✅ GOOD: `TaskCreate("Deploy X locally — trigger: Qodo R6 clean")` + blocked follow-ups
+## First Action
 
-**Skip tasks for:** single-step actions, questions/explanations, or trivial fixes.
+Plan the whole job in **one `TaskBulkCreate` call** listing every step — not one `TaskCreate` per step, and not after the first edit. `TaskCreate` is for a single step added later.
 
----
-
-## Task Granularity
+When `TaskCreate`'s own tool description suggests per-step calls, **this rule wins**: one bulk call for the whole job.
 
-Tasks MUST be **detailed and specific** — not high-level summaries.
+## Granularity
 
-- ❌ BAD: `Implement the fix` / `Review code` / `Create PR`
-- ✅ GOOD: `Edit extensions/orchestrator/utils.ts — add timeout parameter to fetchData()` / `Run code review loop (3 async reviewers)` / `Create PR with description`
+One concrete action per task: which file, which change.
 
----
+- ❌ `Implement the fix` / `Create PR`
+- ✅ `Edit extensions/orchestrator/utils.ts — add timeout parameter to fetchData()` / `Create PR with the test plan`
 
-## Task Lifecycle (MANDATORY)
+## Lifecycle
 
-Create all tasks BEFORE starting work via `TaskCreate`.
-Mark each `in_progress` before starting and `completed` immediately after finishing via `TaskUpdate`.
-Work through tasks in order — do not skip tasks or start new work while unchecked tasks exist (unless user explicitly pivots).
-
----
+`in_progress` before starting a task, `completed` immediately after. Work in order. Never abandon a task — drop a stale one with `TaskUpdate status: "deleted"`.
 
 ## Side Questions
 
-Answer the question, then resume the next unchecked task immediately — the persistent task list tells you exactly where you left off.
-
----
-
-## Integration & Key Rules
-
-Task tracking works alongside existing workflow rules — include issue-first, code review, and documentation steps as individual tasks.
-{{IF:task_reminder_enabled}}
-Tasks are code-enforced (reminders after 4+ ignored turns).
-{{/IF}}
-Never abandon tasks — if scope changes, use `TaskUpdate` with `status: "deleted"` to remove obsolete tasks; the task list is your contract.
+Answer the question, then resume the next unchecked task — the task list says where you left off.
 
 ---