pi-session-mcp 0.8.3 → 0.12.0

package/docs/evaluation/plan-continuation-2026-10-17/prior-integrity.json

@@ -0,0 +1,25 @@
+{
+  "status": "PASS",
+  "prior_dossiers": [
+    {
+      "dossier": "live-screening-2026-10-17",
+      "files_verified": 35,
+      "status": "PASS"
+    },
+    {
+      "dossier": "extension-audit-2026-10-17",
+      "files_verified": 22,
+      "status": "PASS"
+    },
+    {
+      "dossier": "node24-followup-2026-10-17",
+      "files_verified": 46,
+      "status": "PASS"
+    },
+    {
+      "dossier": "client-reconnect-2026-10-17",
+      "files_verified": 5,
+      "status": "PASS"
+    }
+  ]
+}

package/docs/evaluation/plan-continuation-2026-10-17/proposal-validation.json

@@ -0,0 +1,14 @@
+{
+  "status": "PASS",
+  "manifest_approved": false,
+  "budget_approved": false,
+  "unapproved_live_gate": "BLOCKED",
+  "hypothetical_approved_structure_and_source": "PASS",
+  "model_starts": 0,
+  "provider_calls": 0,
+  "notes": [
+    "Approval fixture objects existed only in memory during validation.",
+    "Operator authorization must precede setting approved and recomputing the budget manifest digest.",
+    "No connectivity or authentication-validity probe was made."
+  ]
+}

package/docs/evaluation/plan-continuation-2026-10-17/receipt-contract-update.patch

@@ -0,0 +1,40 @@
+--- a/eval/profiles/oracles.ts
++++ b/eval/profiles/oracles.ts
+@@ -9,11 +9,11 @@
+   allowed_paths: string[]; prompt: string; oracle_kind: string;
+ }
+ export const taskDefinitions: TaskDefinition[] = [
+-  {id:'T1',title:'Codebase explanation',family:'code-understanding',profiles:['P1'],views:['scout','docs-writer'],allowed_paths:[],prompt:'Return exactly two claims: {id:"api-data-flow",paths:[...],symbols:[...],text} and {id:"stale-doc",paths:[...],document_status:number,source_status:number,text}. Cite API, service and data files in order; list only symbols defined in those files. Cite README.md and src/api/records.ts for the discrepancy. Do not modify files.',oracle_kind:'source-and-receipt'},
++  {id:'T1',title:'Codebase explanation',family:'code-understanding',profiles:['P1'],views:['scout','docs-writer'],allowed_paths:[],prompt:'Return one JSON object with a claims array containing exactly two claims: {id:"api-data-flow",paths:[...],symbols:[...],text} and {id:"stale-doc",paths:[...],document_status:number,source_status:number,text}. For api-data-flow, paths must contain exactly three source paths in execution order: API handler file, service file, data-store file. symbols must contain exactly three entries: the API handler function name, the service function name, and the data-store lookup in Object.method notation. Omit container objects, imported aliases, Map methods and other local helpers. Derive the names and paths from source. For stale-doc, cite README.md and src/api/records.ts and use numeric HTTP status values. Do not modify files.',oracle_kind:'source-and-receipt'},
+   {id:'T2',title:'Backend contract fix',family:'backend-fix',profiles:['P2','P3'],views:['implementer','reviewer'],allowed_paths:['contract.mjs'],prompt:'Implementer: fix parseLimit so negative values use the default and preserve valid values. Reviewer: inspect the supplied immutable fixed diff and return {reviewed_files:[...],target_hash,findings:[{path,line,summary,preconditions,impact}]}; include the exact changed path and supplied target hash, with an empty findings array when no defect remains. No edits in reviewer view.',oracle_kind:'external-test-and-review'},
+   {id:'T3',title:'Responsive accessible UI',family:'ui',profiles:['P4'],views:['ui-writer'],allowed_paths:['src/App.jsx','src/style.css'],prompt:'Fix narrow viewport overflow and visible keyboard focus. Verify 375px and 1280px viewports, keyboard focus, and the visible error alert before and after activating Refresh. Save screenshots for both viewports.',oracle_kind:'browser-execution'},
+   {id:'T4',title:'Multi-module debugging',family:'debugging',profiles:['P2','P3'],views:['implementer','reviewer'],allowed_paths:['src/tax.mjs'],prompt:'Implementer: fix checkout tax calculation at its cause in src/tax.mjs; include the empty-cart counterexample. Reviewer: inspect the supplied immutable fixed diff and return {reviewed_files:[...],target_hash,findings:[{path,line,summary,preconditions,impact}]}; include the exact changed path and supplied target hash, with an empty findings array when no defect remains. No edits in reviewer view.',oracle_kind:'external-test-and-review'},
+-  {id:'T5',title:'Independent security review',family:'review',profiles:['P3'],views:['reviewer'],allowed_paths:[],prompt:'Return findings [{path,line,summary,preconditions,impact}] and clean_cases [{path,status}]. Provide one entry per defect and assess clean.ts. Review sources read-only.',oracle_kind:'structured-findings'},
++  {id:'T5',title:'Independent security review',family:'review',profiles:['P3'],views:['reviewer'],allowed_paths:[],prompt:'Return one JSON object with findings [{path,line,summary,preconditions,impact}] and clean_cases [{path,status}]. Provide one finding per defect, with a source line, preconditions and impact. Assess clean.ts exactly once in clean_cases. For a file with no finding, use exactly status:"no finding"; do not also report a finding on a file assessed as clean. Review sources read-only.',oracle_kind:'structured-findings'},
+   {id:'T6',title:'Regression test gap',family:'testing',profiles:['P4'],views:['tester'],allowed_paths:[],prompt:'Return coverage_gaps [{case,test}] for zero, negative, non-integer and maximum input values. Give each executable call, report product_code_changed:false, and do not change product code.',oracle_kind:'test-execution-and-coverage'},
+   {id:'T7',title:'Infrastructure source review',family:'infrastructure-review',profiles:['P1'],views:['scout'],allowed_paths:[],prompt:'Return findings [{path,line,claim,impact}]. Identify the relative config mount and shell failure-propagation risks using source citations. Do not assert current host, production or live state; perform no operations.',oracle_kind:'source-and-receipt'},
+   {id:'T8',title:'Evidence-based documentation draft',family:'documentation',profiles:['P1'],views:['docs-writer'],allowed_paths:[],prompt:'Return claims [{source,revision,date,text}] and summary. Cite ADR revision 2 dated 2026-10-10 and runbook revision 1 dated 2026-10-12 in chronological order, preserve Proposed status, explain their conflict and uncertainty, and state the newer runbook does not change ADR status. Do not publish.',oracle_kind:'source-and-receipt'},
+--- a/test/profile-oracles.test.ts
++++ b/test/profile-oracles.test.ts
+@@ -27,6 +27,10 @@
+       expect((await evaluateTask('T1',root,receipt)).status).toBe('PASS');
+       expect((await evaluateTask('T1',root,{claims:[receipt.claims[0],{...receipt.claims[1],document_status:404,source_status:200}]})).status).toBe('FAIL');
+       expect((await evaluateTask('T1',root,{claims:[...receipt.claims,{id:'imaginary-helper',paths:[],symbols:['inventedFunction'],text:'inventedFunction exists'}]})).status).toBe('FAIL');
++      const containerOnly={...receipt.claims[0],symbols:['handle','getRecord','recordStore']};
++      expect((await evaluateTask('T1',root,{claims:[containerOnly,receipt.claims[1]]})).checks.find(c=>c.id==='api-data-flow')?.status).toBe('FAIL');
++      const reversedFlow={...receipt.claims[0],paths:[...receipt.claims[0]!.paths].reverse()};
++      expect((await evaluateTask('T1',root,{claims:[reversedFlow,receipt.claims[1]]})).checks.find(c=>c.id==='api-data-flow')?.status).toBe('FAIL');
+     } finally { await rm(root,{recursive:true,force:true}); }
+   });
+   it('independent T2 test fails before and passes after reference behavior is applied', async () => {
+@@ -73,6 +77,10 @@
+       expect(falsePositive.status).toBe('FAIL');
+       expect(falsePositive.metrics?.false_positives_on_clean_cases).toBe(1);
+       expect(falsePositive.metrics?.false_positives).toBe(1);
++      const unspecifiedStatus=await evaluateTask('T5',root,{...receipt,clean_cases:[{path:'clean.ts',status:'clean'}]});
++      expect(unspecifiedStatus.checks.find(c=>c.id==='clean-counterexample')?.status).toBe('FAIL');
++      const duplicateClean=await evaluateTask('T5',root,{...receipt,clean_cases:[...receipt.clean_cases,...receipt.clean_cases]});
++      expect(duplicateClean.checks.find(c=>c.id==='clean-counterexample')?.status).toBe('FAIL');
+     } finally { await rm(root,{recursive:true,force:true}); }
+   });
+   it('runs independent boundary probes for tester view and rejects gaps-by-keyword alone', async () => {

package/docs/evaluation/plan-continuation-2026-10-17/review.json

@@ -0,0 +1,8 @@
+{
+  "kind": "independent-read-only-receipt-and-rescreen-review",
+  "status": "PASS",
+  "blocking_findings": [],
+  "conclusion": "Prompts clarify format without supplying symbol names or seed defects. Acceptance logic is unchanged; new negative assertions preserve strictness. Source, task hashes and budget binding were independently recomputed. Both proposals are unapproved. Six starts are correct because the new source requires fresh T2 results.",
+  "reviewer_mutations": 0,
+  "reviewer_provider_calls": 0
+}

package/docs/evaluation/plan-continuation-2026-10-17/source-delta.json

@@ -0,0 +1,14 @@
+{
+  "kind": "receipt-contract-clarification",
+  "previous_source_digest": "sha256:686887d57899c2e55593bb7dd98b78be08ea0fc6c471a6dd4eab3298f890d160",
+  "new_source_digest": "sha256:a4524626851448908b8d21ecbd7248c9956ce830406e81c45fda46c8eb6fffc5",
+  "changed_source_paths": [
+    "eval/profiles/oracles.ts",
+    "test/profile-oracles.test.ts"
+  ],
+  "oracle_acceptance_implementation_changed": false,
+  "fixture_contents_changed": false,
+  "historical_source_reconstructed_and_hash_verified": true,
+  "historical_results_reclassified": false,
+  "new_live_calls": 0
+}

package/docs/evaluation/profile-evaluation.md

@@ -0,0 +1,297 @@
+# Synthetic execution-profile evaluation
+
+For the current result matrix, publication verification and historical-source
+distinctions, see the [evaluation overview](README.md).
+
+This development-only suite evaluates the current local stdio → embedded Pi SDK
+path. It does not replace Claude Code orchestration, qualify production use,
+accept ADR 0008, add a sandbox, or change production profile aliases. No live
+model run is authorized by the checked-in plan.
+
+For the subsequently authorized eight-run screening and its preserved inputs,
+see the [live report](2026-10-17-live-screening.md). The
+[coverage register](2026-10-17-test-coverage.md) states exactly which extensions,
+MCP paths and skills ran, were inventoried only, or remain untested.
+
+The follow-on [extension dossier](extension-audit-2026-10-17/README.md) records
+the seven exact candidate audits, real resolver checks, OpenWiki headless
+component evidence and remaining installation/compatibility blockers.
+
+The later approved [Node 24 follow-up](node24-followup-2026-10-17/README.md)
+records actual client interpreter migration, isolated installation and headless
+checks of the four missing candidates, and the restricted Cursor component test.
+It supersedes the earlier missing-package and Node-22 blockers for that scope.
+The subsequent [existing-client reconnect record](client-reconnect-2026-10-17/README.md)
+confirms both remaining Claude connections running Node 24 and no matching old
+Node-22 server left at the final observation.
+
+The [original-plan continuation](plan-continuation-2026-10-17/README.md) clarifies
+T1/T5 receipt instructions without relaxing their oracles and prepares a separate
+six-start re-screen. Its new source binding does not reclassify historical runs;
+the role pilot remains gated on new accepted screening evidence.
+The subsequently authorized [live re-screen](live-rescreen-2026-10-17/README.md)
+started five of six planned slots, accepted three tasks and qualified the Sol
+route for a separately approved synthetic pilot. Luna and Grok did not qualify;
+the remaining Grok slot was blocked by the runner's fail gate.
+
+The later [extension function checks](extension-functions-2026-10-17/README.md)
+separate actual candidate tool/hook execution from the earlier load checks, and
+record the exact tested Pi, standalone MCP and synthetic-host paths. These checks
+submit no external model turns and do not measure a B/C quality ablation.
+
+## Preflight and implementation
+
+The 2026-10-17 preflight confirmed `origin/main`
+`406dae7e6b99aa5715960490e869bd3fc668cca2`, release `v0.8.3`, and all seven
+Pi package pins at `1.2.0`. PRs #80, #82 and #83 were merged; there were no open
+PRs; issues #79 and #81 remained open. CI for that main commit passed. ADR 0008
+remained Proposed. The original local checkout was older and clean; implementation
+uses a separate branch/worktree. No roadmap, accepted decision, release field,
+production registration, credential store, or external repository was edited.
+The explicit evaluation assignment authorizes this synthetic development harness;
+Sprint 4's prohibition on isolation runtime changes remains in force.
+
+Reusable components are `PiSessionAdapter`, `SdkPiSessionAdapter`, the session
+registry, strict MCP contracts, fake/scripted runtimes, the compiled-entry helper,
+real stdio fixture servers, and existing skill/extension/lifecycle tests. New
+components are task/run/result contracts, nine public synthetic fixtures,
+controller-side oracles, approval-bound execution, sanitized records, and comparison
+rows. The research attachments were not needed. No additional root runtime or
+development dependency is required. Optional browser tooling has its own exact
+pins and lockfile outside the candidate fixture.
+
+## Commands
+
+Use Node.js >=22.19.0 and the repository lockfile:
+
+```sh
+npm ci
+npm run eval:profiles -- --plan
+npm run eval:profiles -- --offline
+npm run eval:schemas
+node scripts/profile-evaluation-schemas.mjs --check
+```
+
+The first command installs development dependencies. The npm evaluation entry
+compiles into an owned temporary build and removes it afterward. Explicit schema
+generation and runner unit tests use the ignored `.profile-eval/` directory. Plan
+execution leaves repository files unchanged and creates
+no workspace, session, provider request, registration, or result directory. Its
+JSON contains no prompts. Without a mode it plans. Offline runs execute a bounded
+provider-free Vitest subset with a fresh empty Pi agent directory and no provider
+credential environment. Local loopback scripted HTTP endpoints are test doubles,
+not external models. Offline results go to a new `eval/results/<opaque-id>/`.
+An explicit `--output <new-directory>` also must name a fresh directory; existing
+attempts are never overwritten. The parent of an explicit output must exist.
+The complete repository `npm test` remains the broader final check. On the
+implementation host the final full verification used `--maxWorkers=2` after a
+default-parallel run hit an intermittent existing recovery-lock failure; both
+attempts are preserved in the evidence report. This is test-load calibration,
+not a product session limit.
+
+To inspect a deliberately selected existing configuration without auth resolution:
+
+```sh
+npm run eval:profiles -- --plan --inventory "$PI_SESSION_MCP_CONFIG"
+```
+
+Inventory loads configured aliases and the public SDK catalog, lists credential
+**metadata only**, and hashes selected skill directories. It never calls
+`getAuth`, `checkAuth`, login, token refresh, or a model. Metadata existence does
+not establish credential validity, remaining quota, provider reachability, effort
+support, or successful transport resolution. Extension providers are not loaded
+for inventory; Cursor can therefore be absent from the native catalog despite a
+configured extension. Billing stays unknown unless subscription metadata proves
+its kind. Environment-based auth may exist without a stored credential entry.
+
+## Tasks and independent acceptance
+
+Only `eval/fixtures/Tn/public/` is copied to the candidate workspace. Hidden
+expectations, independent assertions and evaluation code stay controller-side.
+This separation is an evaluation convention, **not a filesystem read boundary**.
+A writer receives a full disposable fixture copy without `.git`, hooks, local Git
+configuration, `.env`, Pi project state, or credentials. Every attempt gets its own
+copy and a path-free scope ID. Symlinks and special files in fixture copies are
+rejected. Snapshots record content, modes, directory entries and symlink targets
+without following worker-created symlinks. The final diff is checked independently.
+
+| Task | Profile / view | Oracle |
+| --- | --- | --- |
+| T1 code paths and stale documentation | P1 scout | Source-linked ordered path and contradictory source/document claims |
+| T2 backend contract | P2 implementer | Independent failing baseline and passing repaired behavioral tests; exact diff scope |
+| T3 React/Vite UI | P4 UI writer | 375×800 and 1280×800, overflow, error alert, keyboard focus, screenshots |
+| T4 multi-module cause | P2 implementer | Direct cause-module assertion plus checkout and empty-cart countercase |
+| T5 immutable review | P3 reviewer | Both independent seeded defects, source locations, preconditions/impact, clean cases and extra findings |
+| T6 tester | P4 tester | Concrete coverage gaps, weak test and external boundary probes; zero candidate mutations |
+| T7 infrastructure sources | P1 scout | Static mount and masked shell-exit findings; no operational or current-host claims |
+| T8 documentation | P1 docs-writer draft | Revision/date/source conflict and Proposed status; no publication |
+| T9 context continuation | P1 read / P2 mutation | BLOCKED without an actual observed, controlled compaction event |
+
+P3 can additionally review frozen T2/T4 results. Accepted P2 results retain a
+`<run-id>.snapshot` tree, its digest, and a relative-label patch. A later approved
+P3 run names `review_target: {path, hash}` within `eval/results/`, uses the
+unchanging copied result plus `review.patch`, and must return its target hash,
+reviewed files and findings. Passing repaired tests alone does not accept a review.
+A changed target or candidate mutation invalidates the run.
+
+The older roles remain separate views: scout→P1, implementer→P2, reviewer→P3,
+docs-writer→P1 draft-only, tester→P4 read-only. A document-writing candidate and
+researcher with an external data path are deferred. Tester has no shell tool:
+its approved executable checks run in the controller oracle. UI writer has the
+coding toolset. No role name creates a production alias.
+
+For optional actual browser checks, see the fixture tooling package. Install
+only its locked local development dependencies, then provision the matching
+browser explicitly. The runner never installs packages or downloads a browser.
+A missing browser runtime is BLOCKED, not evidence of UI failure or success.
+The Browser plugin was not available during implementation, so regular Playwright
+is the browser path. Browser assertions execute outside the worker; screenshots
+alone never pass T3. Browser test failures and unavailable tooling stay distinct.
+
+## Contracts, records and provenance
+
+`eval/profiles/schemas.ts` is the authoritative strict contract, version `1.0.0`.
+The five checked-in JSON Schemas describe structural task, run, result, manifest
+and budget shapes. Zod additionally enforces cross-field bindings, profile/view
+pairs, stage limits and gates; JSON Schema alone is insufficient. Task hashes bind
+prompt hashes, public fixture snapshots, view mapping and expectations via the
+source digest. The source digest covers current source, scripts, tests, evaluation
+contracts and fixtures, package manifests/lockfiles and compiler configurations.
+This binds uncommitted implementation bytes as well as the base commit.
+
+| Status | Meaning |
+| --- | --- |
+| PASS | The named executed assertion met its criterion |
+| FAIL | An executed requirement was violated; a missing required protection is not a pass |
+| BLOCKED | A known prerequisite is absent |
+| NOT_RUN | Execution did not start |
+| INCONCLUSIVE | Execution started but evidence cannot decide the result |
+
+Harness, task, boundary and recommendation fields are separate. A successful MCP
+turn, exit zero, screenshot, or worker success statement cannot accept the task.
+Missing credentials are a BLOCKED prerequisite, not an implementation failure.
+Truncated, malformed, missing or failed acknowledgements cannot produce acceptance.
+The runner never retries a whole mutation attempt. SDK-internal retries are a
+separate existing production behavior; the MCP contract exposes no count or switch.
+`max_retries: 0` bounds controller restarts, not unobservable SDK provider retries.
+
+The runner supplies task/source/fixture/profile/skill/extension digests, requested
+route, auth/billing declarations, view, repetition, budget, timestamps, scope ID,
+external check exit codes, observed diffs and artifact hashes. The real server's
+postchecked session supplies provider/model/effort labels and the observed turn
+state/truncation flag. These labels do not prove the provider's internal model
+revision; that value remains null. Tool counts, provider usage, dollar cost and
+manual rework remain null when not observed. In particular missing usage is never
+zero. Controller-call counts and elapsed time are measured locally. Cost per
+accepted result is null without a reliable meter. No dollar ceiling is promised
+from a runner estimate; a provider-side cap is a separate operator control.
+
+Records never store full prompts, raw assistant text, raw provider errors,
+authentication values, private absolute paths or public session/turn IDs. They
+contain relative artifacts, hashes, stable codes, booleans and counts. Failed
+fixtures remain in the runner's own temporary scope, identified by scope ID; a
+sanitized diagnostic artifact is retained in the result directory. Successful
+fixtures are removed only after checking the private ownership marker. No cleanup
+searches or deletes unrelated temporary resources. Raw Vitest JSON is transient;
+only its sanitized counts and exit status enter the offline evidence.
+
+## Technical boundaries and negative evidence
+
+`test/fixtures/profile-evaluation/coverage.json` maps N1–N8 to exact provider-free
+tests. Tests use scripted tool requests, not model obedience:
+
+- Read-only sessions actually attempt write/edit/bash after reading injected
+  AGENTS content; unavailable tools cannot mutate the synthetic canary.
+- Ungranted outer MCP tool calls do not contact the test service. A separate
+  collector canary shows that granting the outer tool **does not filter inner
+  methods**: N2's required inner-method protection is FAIL. No such collector is
+  granted in baseline A.
+- Strict inputs reject raw model/permission/skill/extension overrides; configured
+  resources, missing skills/extensions and MCP discovery fail visibly.
+- Timeout, provider errors, lost responses, invalid/truncated receipts, abort,
+  EOF, close, SIGTERM and simultaneous independent scopes are checked separately.
+
+Read-only is tool selection, not general file-read confinement. Workspace aliases
+and Git worktrees are not OS sandboxes. Coding tools can write outside their task;
+there is no server-enforced allowed-file set. The diff gate can reject adoption
+but cannot undo an already executed mutation. Coding `boundary_status` therefore
+records FAIL for that absent file-scope protection even when a synthetic task's
+actual diff is acceptable. This suite installs no OS boundary and performs no
+home/credential/production target write probe. There is no claimed multi-user
+isolation inside the trusted-peer server. Extensions, MCP children and Cursor
+can introduce other execution paths.
+
+The live child receives a minimal environment plus only the selected native
+provider's API-key variable where applicable; GitHub and SSH credentials are not
+forwarded as environment variables. Existing Pi authentication still runs under
+the same OS user and can be read by powerful tools. The lack of OS containment
+is unchanged. Live approval does not certify that risk away.
+
+Independent oracles execute in a separately bounded subprocess group. Timeout
+and abort terminate that group before the runner returns; its child cleanup is
+observed separately from the MCP server. This is lifecycle management, not OS
+containment.
+
+Lifecycle observation on Linux records sampled `/proc` descendant identities and
+start times, closes sessions, bounds transport shutdown, and signals only still
+matching owned identities. A short-lived process that daemonizes between samples
+can escape this observation. Passing cleanup establishes the controlled tested
+process paths, not arbitrary process-tree containment. Unsupported observation
+platforms yield INCONCLUSIVE. No production cleanup or isolation claim follows.
+
+## Live gates and maximum plan
+
+The first live wave requires one explicit operator approval of the **exact**
+matrix, usable existing routes, and budget. Export the plan's `manifest`, resolve
+its auth/billing declarations, set its approval only after that decision, and
+bind the approved budget's `manifest_digest` to SHA-256 of
+`JSON.stringify(validatedManifest)`, including schema-defaulted fields. Both
+`schema_version` fields must be `1.0.0`. The runner recomputes all source/task
+bindings before any session start. Changing routes, repetitions, fixtures, code,
+permissions, or the matrix requires a newly bound approval. Proposed budgets in
+offline output deliberately fail approval validation.
+
+```sh
+npm run eval:profiles -- --live --manifest approved-manifest.json --budget approved-budget.json
+```
+
+The executable screening manifest has at most eight slots: Luna T1/T2, Sol T1/T2,
+optional DeepSeek T1/T2, and Grok T5 twice. On this host the configured native
+OpenAI route is `openai-codex`; it is not silently replaced by `openai`.
+`eval/profiles/waves.json` records the later gated 18-slot pilot and optional
+four-run ablation, for at most 30 total. GLM replaces a comparison slot or needs
+new approval. Astra is only a justified escalation. Cursor/Antigravity comparisons
+are excluded. Pilot routes must come from hash-bound accepted screening result files in
+`screening_evidence`, with T1/T2 for coding/read candidates or both T5 repetitions
+for P3. Mixed-stage approval is rejected; views stay separate. T9 remains blocked; its one read and one mutation slot cannot provide two
+repetitions for either combination. Fixed-result review slots replace pilot slots
+or require a revised matrix, never silently exceed the stage budget.
+
+Proposed, unapproved budgets: screening USD 5, pilot USD 15, ablation USD 5.
+Screening is supervised and sequential, max eight session starts, zero whole-run
+retries, 180 seconds per run, 1,440 seconds for the wave plus bounded cleanup.
+A failed combination is blocked while independent combinations can continue.
+An observed scope violation, unverified process cleanup, abort, changed source or
+exhausted wave budget stops the wave and records remaining slots as blocked. Missing reliable usage requires an explicit unmetered-cost
+acknowledgement; a provider cap, if available, is declared separately. No new
+subscription, credit top-up, account or credential acquisition is implemented.
+
+Baseline A has no additional skill, extension or external MCP grant. Existing
+implementation/review skills are inventoried separately. There is currently no
+measured live bottleneck, so no ablation is justified, selected, installed or
+executed. B/C execution is deliberately blocked until a selected, already installed
+exact allowlist package has its package/peer/SDK/license/telemetry/data-path/headless
+audit. Necessary protections cannot be removed for an ablation. Optional candidates
+remain pi-lens, context-mode, cache optimizer for a measured cache issue, a separate
+permission-system gate experiment, and later explicitly scoped research tools.
+No inner agents, goal loops, default context compressors or workflow framework
+are introduced.
+
+A provisional selection requires all applicable mandatory contract/lifecycle
+checks, no critical task/scope error, and every mandatory task assertion in both
+repetitions. P3 additionally needs both seeds and no confirmed clean-case false
+positives. One failed combination does not reject all routes. Two repetitions are
+not a statistically defensible ranking; no score compensates for a boundary
+violation. Allowed decisions are suitable for the tested synthetic scope,
+restricted, blocked/not established, or rejected for that scope. The current
+provider-free evidence establishes no live-model selection.

package/docs/evaluation/publication-2026-10-17/README.md

@@ -0,0 +1,88 @@
+# Publication verification — 2026-10-17
+
+This record covers the implementation prepared for the evaluation pull request.
+It is separate from the historical live screens and optional extension
+experiments. No new external model request, pilot or ablation was run for this
+publication step.
+
+## Final implementation
+
+The development-only runner implements versioned task/run/result/manifest/budget
+contracts, nine synthetic task families, independent task acceptance, explicit
+source/route/approval binding, bounded execution and observed process cleanup.
+The public MCP server, production profiles, SDK/dependency pins and release
+version remain unchanged. CI adds short provider-free plan and schema checks.
+
+PR review found a false-positive regression-oracle path: T2/T4 imported candidate
+code could call `process.exit(0)` before any assertions and still be accepted.
+The corrected oracle requires both a successful exit and an unpredictable
+completion token written only after all assertions over a dedicated pipe.
+The pipe adds no temporary completion files that could survive a worker timeout.
+Regressions exercise early exit in both tasks and preserve genuine-fix acceptance;
+existing bounded-worker timeout/abort tests cover the surrounding lifecycle.
+This completion protocol is a behavioral check, not a boundary against arbitrary
+hostile code sharing the evaluator process.
+
+The [check record](checks.json) contains exact commands, exit codes, aggregate test
+counts, source binding and hashes of locally retained raw logs. Logs are not
+published. The [review record](review.json) identifies the independent review,
+resolved findings and the limits of acceptance. The [integrity index](integrity.json)
+binds this publication record.
+
+## Source and historical decisions
+
+The initial eight-run wave used digest
+`sha256:686887d57899c2e55593bb7dd98b78be08ea0fc6c471a6dd4eab3298f890d160`.
+The later five-start re-screen and extension function checks used
+`sha256:a4524626851448908b8d21ecbd7248c9956ce830406e81c45fda46c8eb6fffc5`.
+Both describe uncommitted evaluation trees based on main commit
+`406dae7e6b99aa5715960490e869bd3fc668cca2` at execution time.
+The published oracle completion fix changes the source digest; the current value
+is in `checks.json`. Committing or merging also changes the Git base identity.
+
+Historical manifests, approvals, results and task decisions retain their original
+bindings and were not reclassified or reused. In particular, Sol's screening
+eligibility was established only at the re-screen revision; this publication
+claims no new-source model qualification. The old oracle's early-exit weakness
+is disclosed and fixed, without inferring that a particular historical worker
+exploited it. The old live results establish only the checks that actually ran.
+New live work needs a newly bound explicit matrix and budget approval.
+
+Some retained optional experiment scripts deliberately pin their historical tree
+or write a fixed immutable attempt name. They are provenance, not ordinary CI
+commands; they can refuse a changed source or an existing destination. The main
+plan/offline entrypoints always create their own current-source scopes. The
+current source checks do not silently re-execute historical optional packages or
+external model routes.
+
+## Public evidence export
+
+All intended files were checked for credentials, complete live prompts or
+transcripts, raw provider errors, private host paths and unintended vendor or
+scratch content. Exact provider/model inventory names, credential-presence
+booleans and auth-type metadata are intentionally retained; credential values and
+private configuration paths are absent.
+
+One archived Node-24 experiment runner contained a private interpreter path.
+The [derived export record](../node24-followup-2026-10-17/publication-export.json)
+identifies its replacement with `process.execPath`, preserves the original
+script/index hashes and discloses that the public script is a derived copy.
+The original script/index remain in the owned ignored publication scope. No
+historical run receipt was edited. The Node-24 index is explicitly marked as a publication export. A second
+[format-only export](../extension-audit-2026-10-17/publication-export.json) removes
+one redundant blank line at the end of an earlier Markdown report for staged
+whitespace validation; its original hash/index are retained in the same manner.
+No report prose or run receipt changed. All other earlier dossier files and
+indexes are preserved.
+
+Installed package prefixes, generated builds, raw logs, owned result workspaces
+and auth material are excluded from Git. Synthetic browser screenshots,
+accepted fixture snapshots, sanitized attempt receipts and lockfiles for the
+optional browser tooling are intentional evidence. The independent publication
+audit and final integrity checks are recorded alongside the verification.
+
+## Local acceptance result
+
+All final checks passed under Node 24.22.0: strict full suite **1,459 passed, six skipped**, offline subset **308 passed**, typecheck, CLI/server builds, plan mode and schema drift check. Root `npm audit` reported **zero vulnerabilities**. Node 22.23.2 also passed no-emit evaluation compilation and all eight oracle cases. The suites overlap and their counts are not additive.
+
+Current evaluated source digest: `sha256:922f78c2f4a2f85673606fb45a3776fa5246da47c1f7a7862fd87fe08727bbfe`. The final plan carries this digest and remains unapproved. Required remote CI is enforced through the pull request; this record is local verification, not a claim about an unobserved CI run.

package/docs/evaluation/publication-2026-10-17/checks.json

@@ -0,0 +1,117 @@
+{
+  "kind": "evaluation-publication-provider-free-verification",
+  "status": "PASS",
+  "recorded_at": "2026-10-17T15:51:12.258293+00:00",
+  "node": "24.22.0",
+  "base_commit_at_verification": "406dae7e6b99aa5715960490e869bd3fc668cca2",
+  "source_digest": "sha256:922f78c2f4a2f85673606fb45a3776fa5246da47c1f7a7862fd87fe08727bbfe",
+  "plan_source_matches_final_source": true,
+  "plan_approved": false,
+  "new_external_evaluation_model_starts": 0,
+  "checks": [
+    {
+      "check": "typecheck",
+      "command": "npm run typecheck",
+      "started_at": "2026-10-17T15:48:24.466085+00:00",
+      "ended_at": "2026-10-17T15:48:25.281800+00:00",
+      "seconds": 0.816,
+      "exit_code": 0,
+      "log_sha256": "60a28c7e1de55c50e6aea0f8cb5c76dc212cdcbee09c43bcc6d8ad3141d3c0a6"
+    },
+    {
+      "check": "build-cli",
+      "command": "npm run build:cli",
+      "started_at": "2026-10-17T15:48:25.282037+00:00",
+      "ended_at": "2026-10-17T15:48:25.674514+00:00",
+      "seconds": 0.392,
+      "exit_code": 0,
+      "log_sha256": "5671644b334db36e7f462506ec2f89f12e4a51fe795afa2b9dbfc71350561ab8"
+    },
+    {
+      "check": "build",
+      "command": "npm run build",
+      "started_at": "2026-10-17T15:48:25.674744+00:00",
+      "ended_at": "2026-10-17T15:48:26.138291+00:00",
+      "seconds": 0.464,
+      "exit_code": 0,
+      "log_sha256": "d14756b62e2e0ac20fe41deebc125b56f99c658d834c8afe76ecc42e748fe2df"
+    },
+    {
+      "check": "schemas",
+      "command": "npm run eval:schemas -- --check",
+      "started_at": "2026-10-17T15:48:26.138531+00:00",
+      "ended_at": "2026-10-17T15:48:26.748727+00:00",
+      "seconds": 0.61,
+      "exit_code": 0,
+      "log_sha256": "17035341612f85467126cbbef228e9c173b899afc401ff3e266c51419c960ab5"
+    },
+    {
+      "check": "plan",
+      "command": "npm run eval:profiles -- --plan",
+      "started_at": "2026-10-17T15:48:26.748954+00:00",
+      "ended_at": "2026-10-17T15:48:28.034451+00:00",
+      "seconds": 1.286,
+      "exit_code": 0,
+      "log_sha256": "33fbbc0873485b89ee221e580520ee648cc084d7494d3036ab4b3e6afd99d999"
+    },
+    {
+      "check": "offline",
+      "command": "npm run eval:profiles -- --offline",
+      "started_at": "2026-10-17T15:48:28.034710+00:00",
+      "ended_at": "2026-10-17T15:48:53.723848+00:00",
+      "seconds": 25.689,
+      "exit_code": 0,
+      "log_sha256": "d20a2ce8e065267a5af923ba66058085655abfea615ca2c2857565f5d6607f33"
+    },
+    {
+      "check": "full-tests",
+      "command": "npm test -- --maxWorkers=2",
+      "started_at": "2026-10-17T15:48:53.724080+00:00",
+      "ended_at": "2026-10-17T15:50:31.535700+00:00",
+      "seconds": 97.812,
+      "exit_code": 0,
+      "log_sha256": "93cd5509c029a6d6dcaf28f033866b2021c65cf1ea1bb556b41edd0835c60b43"
+    }
+  ],
+  "full_suite": {
+    "passed": 1459,
+    "skipped": 6,
+    "total": 1465,
+    "failed": 0,
+    "files": 60
+  },
+  "offline_suite": {
+    "numTotalTests": 308,
+    "numPassedTests": 308,
+    "numFailedTests": 0,
+    "numPendingTests": 0,
+    "success": true
+  },
+  "node22_compatibility": {
+    "node": "22.23.2",
+    "typescript_no_emit_exit_code": 0,
+    "oracle_tests_passed": 8,
+    "oracle_tests_failed": 0,
+    "raw_oracle_report_sha256": "986260eafe1b808ede7cb92aa873fb0efbf1bbea79bdb35eacc04e5b0a45b757",
+    "intermediate_failure": "A transient implementation revision had TS2339 in an unreachable Buffer branch. The branch was removed before the final checks; this was a source type error, not a Node runtime incompatibility.",
+    "typescript_stdout_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+  },
+  "npm_audit": {
+    "exit_code": 0,
+    "vulnerabilities": {
+      "info": 0,
+      "low": 0,
+      "moderate": 0,
+      "high": 0,
+      "critical": 0,
+      "total": 0
+    },
+    "raw_output_sha256": "687369085f8fab131c8f37ef88efa248622d9b50dd5ccee8562495f1512c1caa"
+  },
+  "production_src_changed": false,
+  "dependency_pins_changed": false,
+  "release_version_changed": false,
+  "raw_logs_public": false,
+  "historical_live_replayed": false,
+  "test_node_options": "--unhandled-rejections=strict"
+}

package/docs/evaluation/publication-2026-10-17/integrity.json

@@ -0,0 +1,21 @@
+{
+  "kind": "publication-verification-integrity",
+  "files": [
+    {
+      "path": "README.md",
+      "hash": "sha256:9373133a4217d651aba6756476e43705e952b27ba26e520aecb3a2ad831bfd48"
+    },
+    {
+      "path": "checks.json",
+      "hash": "sha256:499daea467ab7b5d372999e5a0caf4d0ef3a694a2185dc7d40d982c7f638073f"
+    },
+    {
+      "path": "publication-scan.json",
+      "hash": "sha256:9d49832118cdb39f2d02423bc3d0b79f979852298ba2b3a62e1c36423070e1d6"
+    },
+    {
+      "path": "review.json",
+      "hash": "sha256:7a2756a4fdbcb1ec115374b080a072e9af7116f99fa7d4df18cfdf36bf49f464"
+    }
+  ]
+}