pi-session-mcp 0.8.3 → 0.12.0

package/docs/evaluation/2026-10-17-profile-evaluation-evidence.md

@@ -0,0 +1,155 @@
+# Profile evaluation evidence — 2026-10-17
+
+This is the historical pre-live record. The subsequently authorized eight-run
+[live screening](2026-10-17-live-screening.md) has separate immutable evidence.
+
+The final source-bound full suite passed **1,459 tests**, with **6 skipped** and
+zero failures across **60 files**. The standalone offline command passed **308
+tests** with zero failures or skips. Typecheck, both builds, schema drift checks
+and audits passed. Source digest:
+`sha256:686887d57899c2e55593bb7dd98b78be08ea0fc6c471a6dd4eab3298f890d160`.
+
+This record covers the provider-free implementation and synthetic oracle
+calibration. **No live Pi candidate evaluation was started.** It establishes no
+model ranking, production approval, OS isolation, accepted ADR, or release.
+
+Source base: `406dae7e6b99aa5715960490e869bd3fc668cca2`; branch
+`eval/pi-profile-evaluation-2026-10-17`. Package `0.8.3`, Pi SDK and its six sibling
+packages `1.2.0`; Node.js `22.23.2`, npm `12.2.0`, Linux x64. The uncommitted
+implementation is bound by the source digest in the final machine records.
+
+The preflight independently confirmed the assignment's remote main/release
+snapshot, merged PRs #80/#82/#83, open issues #79/#81, no open PRs and green CI
+on main. It read current configuration, adapter, tool-selection, existing
+acceptance scripts, shipped skills, roadmap and ADRs 0002/0003/0006/0007/0008.
+No isolation runtime change conflicts with Sprint 4: none was implemented.
+
+## Implementation and checks
+
+The suite reuses the real server, adapter seam, fake/scripted runtime, registry,
+compiled-entry helper and existing stdio/lifecycle/skill/extension tests. It adds
+versioned structural schemas plus strict cross-field validation, public synthetic
+fixtures, independent oracles, immutable snapshot review, route-specific comparison,
+source-bound approvals and separately supervised oracle subprocesses.
+
+Final counts, exit codes, source digests and source-stability checks are in
+[checks.json](evidence-2026-10-17/checks.json) and
+[offline.json](evidence-2026-10-17/offline.json). The offline output includes every
+planned screening slot and explicit NOT_RUN/BLOCKED state. The final full-suite
+record is [full-tests.json](evidence-2026-10-17/full-tests.json).
+The first development full-suite attempt failed because Vitest discovered the
+plain Node synthetic tester fixture as a suite; renaming it `page-check.mjs`
+resolved that collection failure. It is retained separately in the check history.
+A later default-parallel run failed one existing SIGKILL-recovery test with
+`ownership_lock_unavailable`; its immutable attempt is retained as
+[full-attempt-default.json](evidence-2026-10-17/full-attempt-default.json).
+The isolated recovery file passed all 31 tests. The final full run passed with
+`--maxWorkers=2` and unchanged source before/after execution. The cause of the
+intermittent default-parallel failure is not established; production locking and
+CI test concurrency were not changed. The two-process setting concerns this
+verification run, not a Pi product session limit.
+
+Checks executed: lockfile installation, strict typecheck, CLI and server builds,
+complete provider-free Vitest suite, deterministic evaluation subset, plan CLI,
+rejection of unapproved live invocation, structural-schema drift check, root and
+production-only npm audits, optional UI-tooling audit, diff whitespace and evidence
+leak scan. Raw test output is not published. All recorded metrics concern the
+harness or synthetic reference calibration, not a live model.
+
+The real evaluation transport was exercised through a compiled production server,
+MCP stdio and the embedded SDK with a loopback-only scripted SSE endpoint and a
+placeholder credential. Exact provider/model/effort, complete JSON receipt,
+close/list-empty and observed Linux cleanup passed. This is transport evidence;
+it is not an external model run or a Claude Code live-orchestration result.
+
+Negative tests execute scripted forbidden tool requests, hostile AGENTS context,
+ungranted MCP calls, resource-load failures, provider/timeout/lost-response cases,
+malformed/truncated receipts, no whole-run mutation retry, abort/EOF/close/SIGTERM,
+parallel independent copies/results, and stubborn oracle children. Review fixes
+have regression coverage: oracle deadlines and cancellation, separate oracle child
+cleanup, final-diff failure clearing acceptance, and route-specific aggregation.
+An unverified oracle cleanup stops all later combinations, and explicitly selected
+Chromium executable configuration crosses the oracle-process boundary.
+
+## Profile and task-view decisions
+
+All live acceptance fractions are **0 accepted / 0 started**. Offline assertions
+qualify the evaluation machinery, not the candidate route's task quality.
+
+| Profile / view | Offline evidence | Technical limit | Decision |
+| --- | --- | --- | --- |
+| P1 scout | T1 source-path/contradiction oracle; T7 static infrastructure oracle; scripted read-only tool denials | No general filesystem read boundary; Luna transport NOT_RUN | Blocked/not established for model quality |
+| P1 docs-writer draft | T8 dated revision/conflict/Proposed oracle, read-only scope | Draft only; no publication or document-writing qualification | Blocked/not established |
+| P2 implementer | T2/T4 fail-before/pass-after and cause/countercase checks, immutable snapshots and diff gate | Coding tools have no enforced file-scope/OS boundary | Model quality NOT_RUN; any later synthetic result remains restricted |
+| P3 reviewer | T5 two seed defects, clean cases, source locations, precision/false-positive counts; T2/T4 fixed-result review receipts | Grok screening NOT_RUN; a clean test alone never approves review | Blocked/not established |
+| P4 UI writer | Actual Chromium calibration at both viewports; keyboard focus, preserved long text, Refresh error state, screenshots | Controller browser oracle; no live Sol repair was attempted | Harness verified; model quality NOT_RUN |
+| P4 tester | T6 existing weak check plus independent boundary probes and concrete coverage gaps | Read-only worker; controller runs approved checks; no repair | Blocked/not established for model quality |
+| Separate researcher / document writer with write rights | No pilot slot | Requires its own explicit external-data or document-write scope | Deferred |
+| T9 read and mutation continuation | Public handoff fixture; explicit blocked oracle | No observed controlled compaction through the current public MCP path, and no successful live baseline | BLOCKED |
+
+Read-only tool selection passed its controlled canaries. N2's **inner-method
+policy requirement failed**: granting an outer collector tool permits its inner
+`delete_all` method to reach the synthetic service. Baseline A grants no collector.
+A missing OS file-scope boundary is recorded as FAIL, not inferred as PASS from a
+clean diff. A diff gate cannot reverse an earlier write. Process cleanup evidence
+covers observed process identities/groups; deliberately detached processes that
+escape sampling are not contained. No real home, credential, production host,
+mount or network exfiltration target was probed.
+
+The source-bound [UI calibration record](evidence-2026-10-17/ui-reference/result.json)
+contains failing-before/passing-after checks for a controller-provided reference
+CSS fix. Its [375px](evidence-2026-10-17/ui-reference/T3-375.png) and
+[1280px](evidence-2026-10-17/ui-reference/T3-1280.png) screenshots are synthetic
+harness artifacts, not model results. Shortening the long fixture content is
+explicitly rejected by the oracle.
+
+## Existing routes and unknowns
+
+The sanitized [inventory](evidence-2026-10-17/inventory.json) was obtained with the
+public SDK catalog and `listCredentials` metadata only. Native registered routes:
+
+| Candidate | Exact configured provider / model | Effort | Auth / billing metadata |
+| --- | --- | --- | --- |
+| Luna | `openai-codex` / `gpt-6-luna` | low | OAuth / subscription |
+| Sol implementation | `openai-codex` / `gpt-6.1-sol` | medium | OAuth / subscription |
+| Sol review | `openai-codex` / `gpt-6.1-sol` | high | OAuth / subscription |
+| Grok | `xai` / `grok-4.7` | high | OAuth / subscription |
+| DeepSeek | `deepseek` / `deepseek-flash` | high | API-key metadata / billing unverified |
+| GLM alternative | `mistral` / `zai-glm-5-3` | high | API-key metadata / billing unverified |
+
+Credential validity, quota, model reachability and real transport effort resolution
+remain NOT_RUN. No auth resolution, refresh, login, new account, credit top-up or
+credential acquisition occurred. Existing skill aliases/digests are inventoried;
+loaded/read-by-model state is not claimed. Cursor requires its configured extension
+and is excluded from native baseline comparisons. No extension was installed or
+loaded for a candidate run.
+
+Unknown costs, usage, tool-error counts, manual rework and model revision remain
+null. No cost per accepted result can be computed. Controller starts, runtime
+and retries can be bounded; SDK-internal retries and provider billing are not
+metered through the production MCP contract.
+
+## First live wave and later stages
+
+The preserved [screening manifest](evidence-2026-10-17/manifest.json) is unapproved.
+It has Luna T1/T2, Sol T1/T2, optional DeepSeek T1/T2, and Grok T5 twice: at most
+eight session starts, sequential, zero controller retries, 180 seconds per run,
+1,440 seconds for the wave plus bounded cleanup. Proposed screening API budget:
+USD 5, with existing subscription quotas separately confirmed. This is an estimate,
+not a demonstrated provider-side cap. Matrix, usable existing routes, auth/billing
+declarations and budget require one explicit operator approval before execution.
+No unapproved connectivity or PONG probe is inserted before the eight slots.
+
+The later pilot has at most 18 slots and requires hash-bound accepted screening
+records on the selected exact routes. T9 remains blocked. Fixed-result T2/T4
+reviews replace pilot slots or require a revised matrix. One optional ablation
+has at most four additional runs and a proposed USD 5 budget; pilot budget is
+USD 15. The ceiling is 30 runs, not a required workload. No measured live baseline
+bottleneck exists, so ablation selection, package audits and model runs are NOT_RUN.
+GLM replaces a comparison slot; Astra is an explicit escalation; Cursor and
+Antigravity stay separate, excluded harness comparisons.
+
+No push, PR, merge, publication, deployment, global production-profile change,
+new sandbox, public MCP function, ADR acceptance or release change occurred.
+The complete relative changed-file list is
+[changed-files.txt](evidence-2026-10-17/changed-files.txt).

package/docs/evaluation/2026-10-17-test-coverage.md

@@ -0,0 +1,127 @@
+# Test coverage register — 2026-10-17
+
+This is the historical state before the subsequent
+[seven-extension audit and OpenWiki component tests](extension-audit-2026-10-17/README.md).
+The subsequent approved [Node 24 follow-up](node24-followup-2026-10-17/README.md)
+adds isolated installation and component checks of the four missing packages and
+Cursor. Earlier inventory-only or blocked statuses remain historical records.
+The later [client reconnect record](client-reconnect-2026-10-17/README.md)
+also verifies the two existing Claude MCP connections under Node 24.
+The [plan continuation](plan-continuation-2026-10-17/README.md) records the later
+T1/T5 instruction clarification, unchanged acceptance logic and provider-free
+checks under a new source binding; the historical rows below are preserved.
+The later [permission policy checks](permission-gates-2026-10-17/README.md)
+exercise seven public policy queries and four genuine SDK hook decisions, with
+no tool executor or model turn. This adds a bounded technical gate result to the
+earlier extension load checks.
+The later authorized [live re-screen](live-rescreen-2026-10-17/README.md) again
+uses baseline A only: five starts, three task acceptances, no selected worker
+skills/extensions/external MCP grants, and one planned Grok repetition blocked.
+The later [extension functional dossier](extension-functions-2026-10-17/README.md)
+adds actual candidate functions with separately named hooks, tools, standalone MCP
+paths and remaining blockers. It supersedes load-only conclusions for those named
+functions while preserving this historical register. No additional live model evaluation was run.
+The original run evidence and machine-readable register are preserved; the new
+dossier records the later checks and remaining runtime blockers separately.
+
+The eight live runs tested **baseline A with no selected Pi extensions, no selected
+worker skills and no external worker MCP grants**. They exercised the real
+`pi-session-mcp` server and native model routes. Local contract tests separately
+exercised synthetic extension packages and MCP children. No production extension
+or external MCP service was qualified by this wave.
+
+This register consolidates the [historical offline record](2026-10-17-profile-evaluation-evidence.md)
+and [live screening report](2026-10-17-live-screening.md). The
+[machine-readable register](test-coverage-2026-10-17.json) pins their underlying
+evidence with hashes and includes exact source-test references and N1–N8 limits.
+Compiling this register started **zero additional live evaluations**.
+
+## What actually ran
+
+| Component | Execution and evidence | Result and limits |
+| --- | --- | --- |
+| `pi-session-mcp` 0.8.3 with Pi SDK 1.2.0 | Eight real compiled-server MCP stdio sessions, exact provider/model/effort binding, prompt and polling, close and empty-session check | 8/8 harness PASS; 4/8 task gates PASS; observed cleanup PASS. This qualifies the exercised path, not every MCP method or event ordering. |
+| Native model routes | `openai-codex/gpt-6-luna` low: T1/T2; `openai-codex/gpt-6.1-sol` medium: T1/T2; `deepseek/deepseek-flash` high: T1/T2; `xai/grok-4.7` high: T5 twice | Three accepted backend fixes and one accepted review. Detailed rejected receipt checks remain in the live report. |
+| Pi built-in tool selection | Read-only: `read`, `grep`, `find`, `ls`; coding additionally `bash`, `edit`, `write` | These are the configured allowlists. The archived live records do not expose per-tool execution counts; availability must not be described as proof each tool was invoked. |
+| Controller MCP methods | `pi_capabilities_get`, `pi_session_start`, `pi_session_prompt`, `pi_turn_get`, `pi_session_close`, `pi_session_list` | Exercised by the live runner. Abort was not needed in the completed live wave; abort/EOF/error paths have separate local regression coverage. |
+| T3 browser reference calibration | Real local Vite/Chromium through Playwright; 375px/1280px, preserved content, keyboard focus, initial and post-Refresh error states, screenshots | Failing reference before and passing reference after a controller-provided CSS fix. Not a live model UI repair or a browser MCP integration test. |
+
+Live inputs, eight claims and results, accepted snapshots and patches, diagnostics,
+comparison, [audit](live-screening-2026-10-17/audit.json) and
+[integrity index](live-screening-2026-10-17/integrity.json) are archived together.
+The source digest remained
+`sha256:686887d57899c2e55593bb7dd98b78be08ea0fc6c471a6dd4eab3298f890d160`.
+
+## Extensions and skills: local fixtures versus production packages
+
+| Exact identity | What was executed | What this establishes |
+| --- | --- | --- |
+| `npm:pi-extension-fixture@1.0.0` | Private local fixture loaded by the installed SDK, with an in-memory fixture provider; [SDK extension tests](../../test/sdk-extension-contract.test.ts) | Provider registration and completed prompt, RPC input hook, read-only allowlist despite `setActiveTools`, coding tool advertisement, literal slash-command forwarding and shutdown event. No external provider or real-world extension package is qualified. |
+| `npm:pi-skill-fixture@1.0.0` | Private extension/skills/prompts fixture and explicit skill folders; [SDK skill tests](../../test/sdk-skill-contract.test.ts), included in the full suite | Explicit selection/order, concurrent and empty selections, package/late-discovery non-widening, duplicate-name protection, invalid selection rejection, sanitized errors and lifecycle cleanup. Some fault paths use injected lifecycle seams. These are contract tests, not worker-quality tests with production skills. |
+| `npm:fixture-ext@1.2.3` | Temporary package manifests/files in [resolver tests](../../test/pi-extensions.test.ts) | Exact installed version and package resolution; missing/malformed manifests, version mismatch, invalid entries and escaping symlinks. This is a resolver fixture, not an independently evaluated published extension. |
+| `npm:pi-cursor-sdk@0.5.3` | Configuration identity inventoried only during the original eight-run wave | **NOT_RUN in that wave**. The later [component dossier](extension-functions-2026-10-17/cursor/README.md) adds local activation tests; actual Cursor model/cloud/MCP sessions remain unqualified. |
+| `pi-session-review`, `pi-session-implementation` | Configured skill aliases inventoried only | **NOT_RUN as worker skills**. Recorded digests are null, so no content hash or successful loading is established by this inventory. None of the eight live profiles selected these skills. |
+
+The controlling agent read and applied `pi-session-orchestration` for orchestration
+and cleanup. That is controller procedure; it is not a worker skill treatment or
+a measured skill-quality improvement. No extension was newly installed for this
+evaluation. Fixtures were copied into owned temporary test directories.
+
+`pi-lens`, `context-mode`, a cache optimizer, a permission-system experiment and
+research tooling remain **NOT_RUN**. No B/C ablation, package/telemetry/data-path
+audit or benchmark of these candidates was completed.
+
+## MCP coverage
+
+| MCP surface | Tested scope | Result and limit |
+| --- | --- | --- |
+| Local synthetic stdio service | [Fixture child](../../test/fixtures/mcp-stdio-server.mjs), [stdio tests](../../test/mcp-stdio-e2e.test.ts) and [bridge tests](../../test/mcp-session-tools.test.ts): granted dispatch, ungranted-call denial, argument/output schema checks, paginated discovery, missing/empty/looping/capability-less discovery, `isError`, sanitized JSON-RPC errors, lost response, timeout/cancellation, per-session resources and EOF/SIGTERM/SIGKILL cleanup | Real local process and MCP SDK transport, with synthetic payloads and scripted model responses. This does not establish behavior of any production MCP service. The fixture also includes deliberate deny/error/timeout tools; their catalog presence does not mean every tool was successfully granted. |
+| Outer tool grant with inner method | In-memory synthetic `collector` connection in [boundary tests](../../test/profile-boundaries.test.ts), observed forwarding of `method:delete_all` | **N2 boundary FAIL**: there is no independent inner-method authorization filter. The regression test passes by observing this missing boundary. It did not contact a production service or delete real data. Baseline A grants no collector. |
+| Production `codegraph_explore` / Graphify | No Pi-worker integration call in this evaluation | **NOT_RUN**. The routing document's statement that production profiles have this grant is not runtime evidence. The temporary baseline profiles omitted external MCP grants. |
+| Other production external MCP services, including Cursor's own MCP connections | No selected live grant, service call or service-specific test | **NOT_RUN**. Connector availability in the controller does not establish availability or behavior inside Pi workers. |
+
+## Negative cases and task coverage
+
+The [exact N1–N8 map](../../test/fixtures/profile-evaluation/coverage.json) separates
+test execution from the required property being assessed:
+
+| Requirement | Recorded property result | Scope |
+| --- | --- | --- |
+| N1 | PASS | Scripted forbidden `write`, `edit`, `bash` requests rejected after hostile synthetic AGENTS context; canary unchanged. |
+| N2 | **FAIL** | Outer MCP grants do not filter arbitrary inner methods. Ungranted outer-call rejection is separately covered and passes. |
+| N3 | PASS | Strict inputs and server-side alias/profile resolution; loaded configuration snapshot. |
+| N4 | PASS | Implemented missing/invalid skill, extension binding and MCP startup/discovery gates. |
+| N5 | PASS | Covered errors/timeouts, malformed/truncated receipts, lost acknowledgement, no controller mutation retry and selection mismatch. |
+| N6 | PASS | Covered abort/EOF/close/SIGTERM/SIGKILL cleanup cases, including observed real child processes. |
+| N7 | PASS | Two controlled concurrent synthetic run scopes and separate per-session resources. The paid live wave itself was sequential. |
+| N8 | PASS | Same controlled hostile-context/tool-denial evidence; not a general prompt-injection guarantee. |
+
+All nine task families have public fixtures. T1/T2/T5 were the only live model
+tasks. T3 had real browser reference calibration; T4/T6/T7/T8 have local oracle
+tests but no live candidate runs. T9's public handoff fixture exists, but controlled
+compaction remains BLOCKED: no observable controlled event was supplied.
+
+The full provider-free suite passed 1,459 tests, with six skipped, zero failed,
+across 60 files. The offline subset passed 308 tests with no skips or failures.
+These suites overlap; their counts must not be added. The historical evidence
+preserves earlier failed attempts and subsequent final checks. The full suite
+includes SDK skill-contract tests; that file is not part of the shorter offline
+subset's explicit file list.
+
+OS sandboxing, general filesystem read/write isolation, arbitrary multi-user
+isolation and containment of deliberately detached unsampled processes are not
+established. Coding file-scope boundaries remain FAIL. Clean final diffs do not
+prove prevention of earlier or out-of-scope access.
+
+## Record completeness
+
+The record includes approval/budget bindings, source/task/profile hashes, exact
+routes, timing, result states, checks, scoped artifacts and cleanup. It deliberately
+does not retain raw model receipts, full prompts, credentials or raw provider
+errors. Consequently, exact rejected receipt contents cannot be reconstructed;
+the second Grok clean-case rejection cannot establish a general model weakness.
+
+Actual cost, token usage, SDK-internal retry counts and live per-tool execution
+counts remain unavailable. The USD 5 budget was advisory and its actual financial
+compliance cannot be demonstrated. No additional paid run was made to fill these
+logging gaps.

package/docs/evaluation/README.md

@@ -0,0 +1,123 @@
+# Pi profile evaluation: current status and evidence
+
+This development-only evaluation adds reproducible synthetic tasks, independent
+acceptance checks, provider-free boundary tests and explicitly approved live
+screening. It does not change production profiles, the public MCP contract, SDK
+pins, release version or the proposed isolation decision in ADR 0008.
+
+Start here for current status. The [maintainer guide](profile-evaluation.md)
+explains the runner, task contracts, technical limits and approval gates.
+Dated dossiers below describe what actually ran at their recorded revisions;
+their historical PASS/FAIL decisions are not current-source qualifications.
+
+## What ran
+
+The separately requested [token-footprint calibration](token-footprint-2026-10-17/README.md)
+records 80 provider-free transport cases, 50 filter cases and ten adverse report
+controls. A separate synthetic Codex request probe measures client projection
+only on its declared local fixture route. The approved real-provider
+[M1 pilot](token-footprint-2026-10-17/m1-pilot/README.md) passed on 2026-10-18 on
+its third attempt, with two harness fixes recorded; it measured **controller**
+usage for its one Codex route (171,034 / 219,683 / 396,699 cumulative input
+tokens for L1 / L2 / L3, mostly cached). Worker usage remains unknown, and so do
+token usage and cost of the historical profile screenings below. A dedicated development
+executor preserves the existing gate and adds exact schedule approval. This is
+not a new live wave or production optimization. Sprint 5 added
+[decision inputs](s5-decision-inputs-2026-10-18/README.md) (including a
+provider-free Claude Code projection probe),
+[tool-definition measurements](tool-definitions-2026-10-18/README.md) and an
+unapproved [A/B proposal](m1-ab-proposal-2026-10-18/README.md).
+Sprint 6 added the provider-free [ledger and event-bridge
+evaluation](ledger-event-bridge-2026-10-21/README.md) with a Claude Code
+client-level rewake probe; its real-model measurement is not approved.
+
+| Evidence | Observed result | Interpretation |
+|---|---|---|
+| [Original provider-free suite](2026-10-17-profile-evaluation-evidence.md) | 1,459 passed, six skipped; overlapping offline subset 308 passed | Historical harness/oracle calibration, not model quality |
+| [First authorized live screen](2026-10-17-live-screening.md) | Eight starts; four accepted tasks | Baseline A: no selected third-party extensions, skills or external worker MCP grants |
+| [Later authorized re-screen](live-rescreen-2026-10-17/README.md) | Five starts; three accepted tasks; sixth planned slot blocked | Sol met that revision's T1/T2 screening gate; Luna and Grok did not |
+| [Extension function checks](extension-functions-2026-10-17/README.md) | Seven selected candidates; actual functions and partial/inconclusive results distinguished | Provider-free component checks; no measured live B/C benefit |
+| [Publication verification](publication-2026-10-17/README.md) | Current checks and oracle early-exit regression evidence | Applies to the publishable implementation, separately from the historical live source |
+| [Extension ablation](extension-ablation-2026-10-20/README.md) | Approved live waves (four), 15 of 35 planned runs scored, USD 8.34 spent of the USD 10 budget; `pl-code-deepseek` do-not-enable (A 3/3, B 2/3), `pl-code` enable by the pre-registered rule (A 2/3, B 2/3); review pairings descriptive only; pi-cache-optimizer not run | One run per task and arm: indicative, not significant; both verdicts hinge on a single timeout or early stop; no production change recommended |
+
+The two approved live waves used 13 starts in total. Their actual token usage and
+cost remain unknown; the USD 5 amounts were advisory, with no demonstrated hard
+provider cap. The PR that introduced these dossiers authorized no pilot, ablation
+or additional live call; the later extension ablation ran under its own approvals.
+Historical screening eligibility does not transfer across source bindings.
+
+## Selected extension functions
+
+| Exact installed candidate | Tested function | Remaining limit |
+|---|---|---|
+| `pi-lens@4.4.3` | Six `symbol_search` calls and one `project_report` call: expected cold-cache/retry responses | Warm fixture retrieval INCONCLUSIVE |
+| `context-mode@1.0.169` | Actual SDK `tool_result` hook persists a synthetic canary with fixture attribution | Restricted MCP probe BLOCKED by its guard; retrieval INCONCLUSIVE; compression NOT_RUN |
+| `pi-cache-optimizer@2.9.3` | Six payload, bypass, warming, headless-command and synthetic-statistics cases PASS | Fixture host; no measured cache savings or provider request |
+| `@gotgenes/pi-permission-system@40.3.0` | Seven policy queries and four actual SDK hook decisions PASS | No tool executor or OS boundary established |
+| `openwiki@0.7.2` | All six registered Pi lifecycle tools through the actual stdio child; 14 checks PASS | One synthetic repository/writer; retrieval and model quality untested |
+| `pi-web-access@0.41.0` | Standalone MCP raw fetch and stored-content lookup PASS | Pi loading BLOCKED by its manifest entry; search/source-check tools discovered only |
+| `pi-cursor-sdk@0.5.3` | Skill activation/resource enumeration and rejection cases PASS | Synthetic host; no Cursor agent, model, cloud or Cursor-owned MCP session |
+
+The [function dossier](extension-functions-2026-10-17/README.md) contains exact
+receipts, registered hooks/tools, process/network observations, failed attempts,
+runnable probes, independent reviews and integrity indexes. Other inventoried
+workflow packages remain untested; none was enabled as a default.
+
+## Reproduce the provider-free implementation
+
+Use the lockfile and Node.js >=22.19.0. Optional installed-package probes require
+the exact candidate pins and Node 24.22.0 documented in their component dossiers.
+They are not installation scripts and are not prerequisites for ordinary CI.
+
+```sh
+npm ci
+npm run typecheck
+npm run build:cli
+NODE_OPTIONS=--unhandled-rejections=strict npm test -- --maxWorkers=2
+npm run build
+npm run eval:profiles -- --plan
+npm run eval:profiles -- --offline
+npm run eval:schemas -- --check
+npm audit
+```
+
+The plan starts no session/provider and makes no fixture or result directory.
+Offline mode uses scripted/fake routes and owned synthetic scopes. Browser
+reference calibration has separate optional pinned tooling under
+`eval/fixtures/T3/tooling`; it is not a new production dependency.
+
+The publication review found that T2/T4 could previously accept an imported
+candidate calling `process.exit(0)` before assertions. The published oracle now
+requires an explicit completion result after all independent assertions. New
+regressions reject premature successful exit in both tasks and retain acceptance
+of genuine fixes. The new source digest and checks are recorded in
+[publication verification](publication-2026-10-17/README.md). Historical runs are
+preserved at their original source digests and have not been replayed or silently
+reclassified; no new pilot qualification is claimed for the changed source.
+
+## Evidence handling and limits
+
+The [coverage register](2026-10-17-test-coverage.md) preserves the original wave's
+inventory separately from subsequent component checks. Earlier
+[package audits](extension-audit-2026-10-17/README.md),
+[Node 24 follow-up](node24-followup-2026-10-17/README.md),
+[client reconnect](client-reconnect-2026-10-17/README.md) and
+[permission gates](permission-gates-2026-10-17/README.md) remain dated evidence.
+
+For public portability, one archived runner's private interpreter path was
+replaced with `process.execPath`, retaining its exact version check. Its
+[explicit export record](node24-followup-2026-10-17/publication-export.json)
+preserves the original script/index hashes and identifies the derived copy.
+A [format-only export](extension-audit-2026-10-17/publication-export.json) trims
+one redundant Markdown end-of-file blank line. Run receipts were not changed. Scratch results, installed packages, credentials,
+raw test logs and temporary builds remain ignored. Public route inventory
+contains names, exact versions, credential-presence booleans and auth-type
+metadata only, with no credential values or private configuration paths.
+
+Read-only tool selection is not a filesystem read boundary; coding is not an OS
+sandbox. The collector inner-method boundary and coding file-scope boundary are
+not established. A clean diff cannot undo an earlier mutation. Guarded child
+process tests establish the named observed paths, not arbitrary containment.
+T9 controlled compaction, remaining live role/task views and quality ablations
+remain unqualified. Historical approval files describe completed waves and must
+not be reused as authorization for new calls.

package/docs/evaluation/client-reconnect-2026-10-17/README.md

@@ -0,0 +1,41 @@
+# Existing client reconnect after the Node 24 migration
+
+Date: 2026-10-17. The operator approved continuing with the remaining existing
+client reconnects after the [Node 24 migration](../node24-followup-2026-10-17/README.md).
+
+**Both remaining Claude Code connections now run the installed Pi-session MCP
+server under Node 24.22.0.** The final same-user process scan found two matching
+server processes under that runtime and none under Node 22. The previously
+observed old Codex server had already ended before this follow-up; it was not
+restarted or claimed as reconnected.
+
+Each Claude terminal had an empty prompt and no interrupt indicator before
+control. Its built-in `/mcp reconnect pi-session-mcp` command reported success
+and started a replacement server using the migrated registration. Both previous
+Node-22 server processes initially remained alive. Only after confirming the
+replacement under the same client parent, the exact installed entry, user and
+process identity, the old process received `SIGTERM` through its bounded shutdown
+handler. Both exited; no force kill was needed.
+Claude documents reconnecting local stdio servers through the client; they do not
+[automatically reconnect](https://code.claude.com/docs/en/mcp#automatic-reconnection).
+
+After that cleanup, both clients' `/mcp` panels showed `pi-session-mcp` connected.
+The panels were closed again. No client conversation, prompt draft or terminal
+transcript was copied into this dossier. Process identities and transition
+details remain in the private owned state scope named in the
+[sanitized reconnect record](reconnect.json).
+
+The final [registration verification](registration-verification.json) repeats
+offline Doctor, both clients' exact registration/ownership verification and a
+bounded fresh initialize / `tools/list` / `pi_capabilities_get` handshake. It
+starts no Pi session or model request. These checks supplement the observed
+existing-client reconnects; a fresh verification process alone is not counted as
+an existing-client reconnect.
+
+No model prompt, candidate extension tool, new evaluation session or additional
+paid quality run was requested. No registration, profile, auth store or runtime
+was edited in this follow-up. Direct client registrations continue to inherit
+their original child PATH; this result binds the server executable to Node 24.
+
+The [closure checks](checks.json) preserve the earlier evidence indexes and
+source binding. The [integrity index](integrity.json) covers this dossier.

package/docs/evaluation/client-reconnect-2026-10-17/checks.json

@@ -0,0 +1,38 @@
+{
+  "kind": "existing-client-reconnect-closure-checks",
+  "status": "PASS",
+  "prior_evidence_integrity": [
+    {
+      "dossier": "live-screening-2026-10-17",
+      "files": 35,
+      "status": "PASS"
+    },
+    {
+      "dossier": "extension-audit-2026-10-17",
+      "files": 22,
+      "status": "PASS"
+    },
+    {
+      "dossier": "node24-followup-2026-10-17",
+      "files": 46,
+      "status": "PASS"
+    }
+  ],
+  "source_binding": {
+    "commit": "406dae7e6b99aa5715960490e869bd3fc668cca2",
+    "digest": "sha256:686887d57899c2e55593bb7dd98b78be08ea0fc6c471a6dd4eab3298f890d160"
+  },
+  "source_unchanged": true,
+  "actual_registration_verification": "PASS",
+  "final_same_user_installed_server_processes": {
+    "node24_22_0": 2,
+    "node22": 0
+  },
+  "terminal_ui_restored_empty_prompts": 2,
+  "json_parse": "PASS",
+  "private_home_literal_scan": "PASS",
+  "diff_whitespace": "PASS",
+  "original_checkout_clean": true,
+  "new_model_prompts_requested": 0,
+  "new_live_evaluation_runs": 0
+}

package/docs/evaluation/client-reconnect-2026-10-17/integrity.json

@@ -0,0 +1,30 @@
+{
+  "kind": "existing-client-reconnect-dossier-integrity",
+  "created_at": "2026-10-17T10:05:52.487669+00:00",
+  "source_binding": {
+    "commit": "406dae7e6b99aa5715960490e869bd3fc668cca2",
+    "digest": "sha256:686887d57899c2e55593bb7dd98b78be08ea0fc6c471a6dd4eab3298f890d160"
+  },
+  "files": [
+    {
+      "path": "README.md",
+      "hash": "sha256:eb51575bdc4f43ebddc14dd7da9947071ede3962c4d524a1f2d85a0d11d9b100"
+    },
+    {
+      "path": "checks.json",
+      "hash": "sha256:f208a98a7e298e412c72d5f85d00ebd0782a44547ca2fc15fefdfca4dced0d9e"
+    },
+    {
+      "path": "reconnect.json",
+      "hash": "sha256:db3a90db9b31ece6260f2345aedcef727f03ef3402d1f989a30f3073ac93c1b0"
+    },
+    {
+      "path": "registration-verification.json",
+      "hash": "sha256:4902ecdae57d975e9d21c11aadd88e7f8f368d0ed56f0766d492e87fad463e33"
+    },
+    {
+      "path": "review.json",
+      "hash": "sha256:e07eee236daf0a98d7d12a3be29ed462bf07aed03489dda9522ba781c091216f"
+    }
+  ]
+}

package/docs/evaluation/client-reconnect-2026-10-17/reconnect.json

@@ -0,0 +1,57 @@
+{
+  "kind": "actual-existing-client-mcp-reconnect",
+  "completed_at": "2026-10-17T10:04:59.094720+00:00",
+  "operator_authorization": "Continue with reconnecting the remaining existing MCP client connections after the Node migration.",
+  "scope": "client-reconnect-64bbe53b-17fa-46b8-9337-56f3eba5224c",
+  "status": "PASS",
+  "initial_process_scan": {
+    "old_node22_servers": 2,
+    "clients": "two Claude Code sessions",
+    "previously_observed_codex_old_server": "already absent before this follow-up"
+  },
+  "clients": [
+    {
+      "client": "claude-connection-A",
+      "idle_empty_prompt_before_control": true,
+      "command": "/mcp reconnect pi-session-mcp",
+      "reconnect_success_message": true,
+      "post_cleanup_mcp_panel_connected": true,
+      "status_panel_closed_after_check": true
+    },
+    {
+      "client": "claude-connection-B",
+      "idle_empty_prompt_before_control": true,
+      "command": "/mcp reconnect pi-session-mcp",
+      "reconnect_success_message": true,
+      "post_cleanup_mcp_panel_connected": true,
+      "status_panel_closed_after_check": true
+    }
+  ],
+  "transition": {
+    "new_node24_servers_started_by_existing_clients": 2,
+    "old_node22_processes_retained_after_client_reconnect": 2,
+    "old_processes_terminated_via_sigterm": 2,
+    "old_process_identity_revalidated_before_signal": true,
+    "new_replacement_same_parent_verified_before_signal": true,
+    "old_processes_termination_observed": true,
+    "new_processes_alive": true,
+    "force_kill_used": false
+  },
+  "final_process_scan": {
+    "same_user_installed_server_processes": 2,
+    "node24_22_0": 2,
+    "node22": 0
+  },
+  "other_configuration_changes": 0,
+  "model_prompts_submitted": 0,
+  "new_evaluation_sessions_started": 0,
+  "paid_quality_runs_added": 0,
+  "terminal_transcripts_archived": false,
+  "private_process_identity_journal": "stored only in the owned user-local state scope",
+  "limitations": [
+    "Runtime counts describe same-user processes with the exact installed Pi-session MCP entry at the observation time.",
+    "The previous Codex connection ended before this follow-up; no existing Codex connection was restarted or claimed as reconnected.",
+    "Built-in reconnect and status commands were used; no model prompt, Pi session start or candidate extension tool was requested.",
+    "Client connections still inherit their original PATH; only the server executable is pinned to Node 24."
+  ]
+}