pi-session-mcp 0.8.3 → 0.12.0

package/docs/evaluation/extension-ablation-2026-10-20/setup.md

@@ -0,0 +1,140 @@
+# Extension ablation setup and dry load — 2026-10-21
+
+This record covers plan Task 9 Step 3: it records the results of Steps 1 and 2,
+the extension template install and the provider-free dry load. No model turn,
+provider call or spend took place.
+`$EVAL` stands for `~/.cache/pi-session-mcp/extension-ablation/2026-10-21`; the
+template and the dry-load output live there and are not tracked.
+
+## Template
+
+Installed with:
+
+```text
+npm install --prefix $EVAL/template/npm --ignore-scripts --no-audit --no-fund --save-exact pi-lens@4.4.3 pi-cache-optimizer@2.9.3
+```
+
+| Item | Value |
+| --- | --- |
+| Top-level versions | `pi-lens` 4.4.3, `pi-cache-optimizer` 2.9.3 |
+| Packages installed | 130 |
+| Entries in `package-lock.json` `packages` | 145 |
+| `package-lock.json` SHA-256 | `12493eaf8bdf77128a6c1786e67cc3966f322e6dc4095c4a9873242c87b999a1` |
+
+Host: Node v26.11.1, npm 12.2.1, Linux. `prlimit`, `strace` and `bwrap` are
+present, Yama `ptrace_scope` is 1, and codegraph is v1.6.2.
+
+## Dry load
+
+Command:
+
+```text
+npm run eval:extensions -- --dry-load --tasks <provisional tasks> --template $EVAL/template --out $EVAL/dry-load
+```
+
+Task 10 has not curated tasks yet (ruling R63). The dry load therefore used two
+provisional tasks, one review and one implementation, on the `pi-session-mcp`
+workspace alias. They are untracked under `eval/results/`. Task 10 re-runs the
+dry load with the final tasks file and fixes `scopeIgnore` from that run before
+approval.
+
+### First run (commit f791878): every pairing failed
+
+Root causes and fixes, all in commit 02cffa3 (spec Amendments 2026-10-21):
+
+1. codegraph's MCP server ran its update check against GitHub from every fresh
+   sandbox home, which produced unexpected connects in both arms. Fix:
+   `DO_NOT_TRACK=1`, `CODEGRAPH_NO_UPDATE_CHECK=1` and `CODEGRAPH_TELEMETRY=0`
+   in the scope environment, passed to MCP servers through `envFrom` (R65). A
+   direct probe confirmed it: without these variables one connect to github.com,
+   with `DO_NOT_TRACK=1` none.
+2. `pi-lens` 4.4.3 keeps `ast_grep_search` and `ast_grep_outline` inactive until
+   `pi_lens_activate_tools` runs (situational tools), so review sessions failed
+   with `extension_tool_missing`. Fix: review profiles are granted the five
+   always-active read tools (R66).
+3. The `io_uring` counter took an injected `ENOSYS` that `strace` split into
+   unfinished and resumed halves for a successful setup (R67). Fix: a split call
+   is joined with its resumed line and counts only on a non-negative return
+   value.
+
+### Second run (commit 02cffa3): every pairing ok
+
+- `extension_tool_missing` did not occur.
+- Inet connects 0, unexpected connects 0, outside writes 0, unresolved writes 0,
+  denied write attempts 0, unresolved egress 0, `io_uring` setups 0.
+- No file was created in any scratch clone, so no `scopeIgnore` entry is needed
+  for this repository.
+
+Active tools per pairing (sorted, from the private report):
+
+| Pairing | Profile | Active tools |
+| --- | --- | --- |
+| `pl-code-deepseek` | `code-deepseek` | `bash`, `edit`, `effective_config`, `find`, `grep`, `lens_diagnostics`, `ls`, `mcp_codegraph_explore`, `module_report`, `pi_lens_activate_tools`, `project_report`, `read`, `read_enclosing`, `read_symbol`, `symbol_search`, `write` |
+| `pl-code` | `code` | `bash`, `edit`, `effective_config`, `find`, `grep`, `lens_diagnostics`, `ls`, `mcp_codegraph_explore`, `module_report`, `pi_lens_activate_tools`, `project_report`, `read`, `read_enclosing`, `read_symbol`, `symbol_search`, `write` |
+| `pl-review-grok` | `review-grok` | `find`, `grep`, `ls`, `mcp_codegraph_explore`, `module_report`, `project_report`, `read`, `read_enclosing`, `read_symbol`, `symbol_search` |
+| `pl-review` | `review` | `find`, `grep`, `ls`, `mcp_codegraph_explore`, `module_report`, `project_report`, `read`, `read_enclosing`, `read_symbol`, `symbol_search` |
+| `co-code` | `code` | `bash`, `edit`, `find`, `grep`, `ls`, `mcp_codegraph_explore`, `read`, `write` |
+| `co-review` | `review` | `find`, `grep`, `ls`, `mcp_codegraph_explore`, `read` |
+
+## Observations for the analysis
+
+- `pi-cache-optimizer` registers no tools, so its arm B has the same tool list
+  as arm A.
+- On the coding profiles `pi_lens_activate_tools` is active, so coding arm B can
+  activate the AST tools mid-session. Review arm B cannot.
+
+## Dry load with the final tasks (Task 10 Step 5)
+
+Commit 1c228ad (dependency mounts, ruling R68; base-only clone history, ruling
+R69) with the final tasks file (not published).
+
+Dependencies: task `i-task-6` declares `backend/.venv` with lockfile
+`backend/uv.lock`. The deps directory `$EVAL/deps/i-task-6` holds:
+
+- `mounts/backend/.venv`, built with `uv sync --frozen --offline
+  --no-install-project` (`UV_PROJECT_ENVIRONMENT`) from a temporary checkout at
+  the base commit, which was removed afterwards.
+- `lock/backend/uv.lock`, SHA-256
+  `(recorded, not published)`, equal to
+  the base commit's lockfile.
+- `runtime/`, a copy of uv's CPython 3.12.13, which the venv's interpreter link
+  points to.
+
+No network was used (local uv cache).
+
+| Run | Tasks loaded | Purpose |
+| --- | --- | --- |
+| 1 | The full tasks file; the dry load loads one task per pairing (`r-psm-smoke` for review pairings, `i-task-5` for implementation pairings) | All six pairings with the final file |
+| 2 | A subset with `r-task-3` and `i-task-6` | Also loads the pynode-app worktree and the real venv mount |
+
+Both runs: every pairing ok, no clone writes, no inet connects, no unexpected
+connects, no outside or unresolved writes, no denied writes, no `io_uring`
+setups. Active tool lists are as in the earlier section.
+
+Result: no extension writes into a clone, so no task gets a `scopeIgnore` entry
+from the dry load. `i-task-6` carries 29 `scopeIgnore` prefixes for the
+worker's own test caches (pytest and ruff caches, `__pycache__` directories
+present at the base commit), ruling R72.
+
+## Final tasks (after the oracle rework)
+
+- Dependencies now also exist for `i-task-7`, with the same layout as
+  `i-task-6` and built offline the same way. The lockfile SHA-256 is
+  `(recorded, not published)`; the two
+  base commits share the lockfile.
+- Dry loads at commit a054cf3 with `--deps`: the full tasks file and a subset
+  (`r-task-4`, `i-task-7`). Every pairing ok, no clone writes, no connects.
+  The later commits changed only oracle fields and validation, which the dry
+  load does not exercise.
+- Oracle checks inside the real sandbox (bwrap with the dependency binds, the
+  production oracle code, no strace): `i-task-6` and `i-task-7` are not
+  accepted at the base commit and accepted with the solution, with nothing out
+  of scope.
+- Sandbox environment additions (ruling R73): six offline variables for Go, uv
+  and npm (`GOPROXY=off`, `GOTOOLCHAIN=local`, `UV_OFFLINE=1`, `UV_NO_SYNC=1`,
+  `UV_PYTHON_DOWNLOADS=never`, `npm_config_offline=true`).
+- Verdict patterns are linear (ruling R80) and were timed on 89 adversarial
+  64 KiB inputs per pattern (worst case 2.9 ms). The full review scoring was
+  quadratic on long lines (6.3 s on one 64 KiB line) and has been linear since
+  commit b442979 (worst case about 90 ms on 25 adversarial 64 KiB texts, checked
+  by a differential fuzz against the old code).

package/docs/evaluation/extension-ablation-repeat-2026-10-21/README.md

@@ -0,0 +1,142 @@
+# Extension ablation repeat: pi-lens on `code` with three replicates
+
+Status: final. This report covers the repeat of the `pl-code` pairing
+(plan `docs/superpowers/plans/2026-10-21-extension-ablation-repeat.md`, spec
+amendments R90 and R92). Every number comes from `evidence/` (`summary.json`,
+`runs/*.json`, `ledger.json`, `integrity.json`, `approvals/`), written at commit
+`c9da9cb`. Setup and dry load are in [`setup.md`](setup.md).
+
+## Summary for the operator
+
+- **Recommendation: inconclusive.** Each arm solves all three tasks by the
+  majority rule (A 3 of 3, B 3 of 3), so B is not better on any task, and B
+  costs 1.47 times as much as A. With pi-lens, arm B was accepted in one more
+  run than arm A (8 of 9 against 7 of 9). Under the pre-registered rule that
+  extra run on `i-task-6` changes no task outcome.
+- The indicative "enable" of the first wave (A 2/3, B 2/3, B cheaper, decided
+  by one timeout) does not hold up: over three replicates, B is not cheaper.
+- **Keep production as it is.** `code` runs without pi-lens today, and this
+  evidence gives no reason to change that.
+- Spend: USD 8.32 of the USD 10 hard budget (ledger `spentUsd` 8.3231724): 18
+  scored runs for USD 8.319 and one preflight PONG for USD 0.004. No run was
+  stopped by the trace audit, the budget or a timeout.
+
+## Method
+
+As in the first wave
+([`../extension-ablation-2026-10-20/README.md`](../extension-ablation-2026-10-20/README.md)),
+with these differences:
+
+- Pairing `pl-code` only: profile `code` (openai `gpt-6.1-sol`, thinking
+  medium, OAuth refreshed on the host before each run, R86). Arm A has no
+  extension and arm B has `pi-lens@4.4.3`.
+- The three pre-registered implementation tasks of the first wave
+  (`i-task-5`, `i-task-6`, `i-task-7`, same tasks file and oracles).
+- Three replicates per task and arm (R90): 18 runs, in replicate order. The
+  A/B order per task alternates within a replicate and flips between
+  replicates. Run ids end in `-r1` to `-r3`.
+- Decision rule (R92, owner decision 2026-10-21): an arm solves a task when at
+  least 2 of its 3 runs are accepted. A task counts only when both arms have all
+  three runs scored. The pre-registered rule is applied to the per-task
+  outcomes: B solves at least as many tasks as A, is strictly better on at
+  least one task, and B's cost over the counted tasks is at most 1.25 times A's.
+  If B solves fewer tasks, the result is do-not-enable; otherwise it is
+  inconclusive.
+- A new ledger with one wave, run in two chunks (`--max-runs 9`, then
+  `--resume`) under one owner approval (USD 10, budget stop).
+
+## Results per task
+
+| Task | A accepted | B accepted | A solves | B solves | Cost A, USD | Cost B, USD |
+| --- | --- | --- | --- | --- | --- | --- |
+| `i-task-5` | 3 of 3 | 3 of 3 | yes | yes | 2.372 | 3.031 |
+| `i-task-6` | 2 of 3 | 3 of 3 | yes | yes | 0.612 | 1.345 |
+| `i-task-7` | 2 of 3 | 2 of 3 | yes | yes | 0.387 | 0.572 |
+| **Total** | 7 of 9 | 8 of 9 | 3 tasks | 3 tasks | 3.371 | 4.948 |
+
+All three tasks counted and the pairing is complete. Cost ratio B/A: 1.47
+overall; per task 1.28 (`i-task-5`), 2.20 (`i-task-6`) and 1.48
+(`i-task-7`). Cache-read share: A 0.943, B 0.943.
+
+## Every run
+
+| Run | Task | Arm | Rep. | Accepted | Duration, s | Cost, USD | Output tokens | Unexpected connects |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| 007 | `i-task-5` | A | 1 | yes | 611 | 0.786 | 20817 | 0 |
+| 008 | `i-task-5` | B | 1 | yes | 813 | 1.081 | 26108 | 0 |
+| 009 | `i-task-6` | B | 1 | yes | 324 | 0.316 | 6629 | 9 |
+| 010 | `i-task-6` | A | 1 | yes | 257 | 0.260 | 5516 | 1 |
+| 011 | `i-task-7` | A | 1 | yes | 317 | 0.155 | 5603 | 1 |
+| 012 | `i-task-7` | B | 1 | yes | 508 | 0.292 | 9219 | 1 |
+| 042 | `i-task-5` | B | 2 | yes | 625 | 0.964 | 19419 | 0 |
+| 043 | `i-task-5` | A | 2 | yes | 660 | 0.868 | 22575 | 0 |
+| 044 | `i-task-6` | A | 2 | no | 27 | 0.086 | 551 | 0 |
+| 045 | `i-task-6` | B | 2 | yes | 329 | 0.348 | 6268 | 9 |
+| 046 | `i-task-7` | B | 2 | no | 28 | 0.054 | 501 | 0 |
+| 047 | `i-task-7` | A | 2 | no | 23 | 0.048 | 492 | 0 |
+| 077 | `i-task-5` | A | 3 | yes | 553 | 0.718 | 20236 | 0 |
+| 078 | `i-task-5` | B | 3 | yes | 664 | 0.986 | 23024 | 0 |
+| 079 | `i-task-6` | B | 3 | yes | 359 | 0.681 | 6268 | 9 |
+| 080 | `i-task-6` | A | 3 | yes | 257 | 0.265 | 5330 | 9 |
+| 081 | `i-task-7` | A | 3 | yes | 357 | 0.185 | 6801 | 1 |
+| 082 | `i-task-7` | B | 3 | yes | 397 | 0.227 | 7188 | 1 |
+
+Every run ended with terminal `completed`. No accepted run has an out-of-scope
+change.
+
+## The three rejected runs: early stops
+
+Runs 044, 046 and 047 (two in arm A, one in arm B, all in replicate 2) each
+ended after 23 to 28 seconds with about 500 output tokens. Their tests did not
+pass, and their only connects were the five of the provider session. The worker
+ended its turn before implementing anything. The records keep only a hash of
+the assistant text, so the reason is not recorded. The first wave had the same
+pattern once (run 012 there, `i-task-7` arm B, 45 seconds). These early stops
+hit both arms, which is consistent with a property of the `code` route on these
+tasks rather than of pi-lens. They decide the per-run counts: without them both arms would have
+accepted every run.
+
+## Network activity outside the task
+
+Unexpected connects as counted in `summary.json`: A 12, B 29. They are the same
+two kinds of address as in the first wave, and only the two pynode-app tasks
+have them:
+
+- `127.0.0.1` port 5544, the pynode-app test Postgres port, reachable because
+  the sandbox shares the host network namespace. It appears once in every pynode-app
+  run of both arms except the three early stops.
+- The Fastly CDN that serves PyPI on port 443 (`151.101.{0,64,128,192}.223` and
+  four `2a04:4e42:...::223` IPv6 addresses): in all three arm B runs of
+  `i-task-6` and in one arm A run (080). As in the first wave, a worker
+  tried to reach PyPI from the shared network namespace. The offline variables
+  (R73) cover uv but not `pip`.
+
+The trace audit recorded no outside write, unresolved write or unresolved
+egress in any run. Denied write attempts are 0 except in four `i-task-7`
+runs, in both arms: 1,050 in run 011 (A), 1,386 in run 012 (B), 1,050 in run
+081 (A) and 1,050 in run 082 (B). As in the first wave, these are writes the
+kernel refused (`EROFS`, read-only mounts), most likely bytecode caches on the
+read-only Python runtime (likely, not proven). They are not out-of-scope
+writes and are not attributed to pi-lens.
+
+## What the repeat changes
+
+- The first wave's `pl-code` "enable" rested on one timeout (arm A on
+  `i-task-5`) and one early stop (arm B on `i-task-7`). In the repeat,
+  arm A solves `i-task-5` in all three runs, and early stops hit both arms.
+- On these tasks pi-lens neither raises the task-level success of `code` nor
+  saves cost. Arm B costs more on every task: on `i-task-5` through longer
+  sessions (34 to 44 messages against 26 to 33 in arm A), on `i-task-6`
+  mostly through run 079, whose uncached input (262,311 tokens against 70,748
+  in run 045, with the same output) doubled its cost.
+- Three replicates on three tasks are still a small sample. The result settles
+  the indicative "enable" as not supported, but gives no estimate of a small
+  effect either way.
+
+## Deviations and notes
+
+- The template's `package-lock.json` hash differs from the first wave's
+  (`01457bdb…` against `12493eaf…`). The top-level versions are equal, and npm
+  re-resolved transitive packages within their ranges (see `setup.md`).
+- The evidence is bound to commit `c9da9cb` with no source drift
+  (`integrity.json`). Later commits change documentation only.

package/docs/evaluation/extension-ablation-repeat-2026-10-21/setup.md

@@ -0,0 +1,69 @@
+# Extension ablation repeat: setup and dry load — 2026-10-21
+
+This record covers Task 2 of the repeat plan
+(`docs/superpowers/plans/2026-10-21-extension-ablation-repeat.md`): the
+extension template, the dependency directories and the provider-free dry load.
+No model turn, provider call or spend took place.
+`$EVAL` stands for `~/.cache/pi-session-mcp/extension-ablation-repeat/2026-10-21`;
+the template, the dependencies and the dry-load output live there and are not
+tracked.
+
+## Template
+
+Installed with:
+
+```text
+npm install --prefix $EVAL/template/npm --ignore-scripts --no-audit --no-fund --save-exact pi-lens@4.4.3 pi-cache-optimizer@2.9.3
+```
+
+| Item | Value |
+| --- | --- |
+| Top-level versions | `pi-lens` 4.4.3, `pi-cache-optimizer` 2.9.3 |
+| Packages installed | 130 |
+| Entries in `package-lock.json` `packages` | 145 |
+| `package-lock.json` SHA-256 | `01457bdb42de901522818ae2150edb7e172dd637b7f88b097cbc728b00036d07` |
+
+The top-level versions equal those of the first wave (2026-10-21), but the lock hash
+differs from the first wave's `12493eaf…`: npm re-resolved transitive packages
+within their declared ranges. Only arm B of `pl-code` loads the template, so
+the repeat measures `pi-lens` 4.4.3 with this transitive set.
+
+Host: Node v26.11.1, npm 12.2.1, Linux, codegraph v1.6.2; `prlimit`, `strace`
+and `bwrap` present.
+
+## Dependencies
+
+`i-task-6` and `i-task-7` declare `backend/.venv` with lockfile
+`backend/uv.lock` (ruling R68). Both directories under `$EVAL/deps/` were
+rebuilt with the R68 layout, offline from the local uv cache with
+`uv sync --frozen --offline --no-install-project`, from temporary checkouts at
+the respective base commits that were removed afterwards:
+
+| Task | Lock copy SHA-256 | Git blob id |
+| --- | --- | --- |
+| `i-task-6` | recorded, not published | recorded, not published |
+| `i-task-7` | recorded, not published | recorded, not published |
+
+Both equal the base commits' lockfile and the first wave's (2026-10-21) lock copies.
+`runtime/` holds the copy of uv's CPython that the venv's interpreter link
+points to.
+
+## Dry load
+
+Commit 75a0136 (replicates), with the tasks file of the first wave (2026-10-21)
+(`docs/evaluation/extension-ablation-2026-10-20/tasks.json`); `--dry-load` has
+no `--pairings` filter, so it loads all six pairings, `pl-code` among them.
+
+- Every pairing ok, granted tools present.
+- Connects 0, unexpected connects 0, outside writes 0, unresolved writes 0,
+  denied write attempts 0, unresolved egress 0, `io_uring` setups 0.
+- No file was created in any scratch clone.
+- `pl-code` arm B has the 16 tools of the first wave (2026-10-21): `bash`, `edit`,
+  `effective_config`, `find`, `grep`, `lens_diagnostics`, `ls`,
+  `mcp_codegraph_explore`, `module_report`, `pi_lens_activate_tools`,
+  `project_report`, `read`, `read_enclosing`, `read_symbol`, `symbol_search`,
+  `write`.
+
+The dry load loads `i-task-5` for implementation pairings, which declares no
+dependencies; the venv mounts are checked before the wave runs and again in
+every run of the two pynode-app tasks.

package/docs/evaluation/extension-audit-2026-10-17/README.md

@@ -0,0 +1,149 @@
+# Remaining Pi extensions — audit and component checks
+
+Date: 2026-10-17. This follow-on covers the six candidates named in AP6 plus the
+already configured Cursor extension: **seven exact package identities**. It does
+not invent the missing historical list of 25 packages or silently add forks.
+
+All seven received static package/identity, version, license, declared SDK/peer,
+install-script, data-path and headless reviews. The real production resolver was
+executed for all seven pins. **OpenWiki additionally passed two provider-free
+headless component cases** through the actual project adapter and installed Pi
+SDK 1.2.0. A fresh-scope reproduction also passed. This is partial runtime
+qualification, not a seven-extension runtime pass or a quality ablation.
+
+No global/user install, production profile, authentication store, SDK upgrade,
+deployment, external repository or approved screening result was changed. There
+were **zero additional paid candidate runs and zero external provider calls**.
+Registry metadata and published tarballs were downloaded for static inspection.
+The earlier eight-run wave and its unknown actual cost remain unchanged.
+
+## Exact matrix
+
+| Candidate pin | Installed here | Executed check | Result and next prerequisite |
+| --- | --- | --- | --- |
+| `pi-lens@4.4.3` | No | Published-artifact static review; real resolver | BLOCKED: `extension_not_installed`. Declared Node floor is satisfied; wildcard Pi peers do not prove SDK compatibility. A future isolated run must control LSP/tool auto-install, grammar downloads, format/autofix writes and lazy tool activation. |
+| `context-mode@1.0.169` | No | Published-artifact static review; real resolver | BLOCKED: `extension_not_installed`. Elastic-2.0, no Pi peer declaration. Its persistent session database, lazy MCP child and late tool registration require explicit host compatibility checks. No large-output bottleneck has been demonstrated. |
+| `pi-cache-optimizer@2.9.3` | No | Published-artifact static review; real resolver | BLOCKED: `extension_not_installed`. Peer range includes SDK 1.2.0; README validation against 1.3.0 is not local qualification. Disable warming before testing: it can ask Pi to make extra, potentially billable provider requests. |
+| `@gotgenes/pi-permission-system@40.3.0` | No | Published-artifact static review; real resolver | BLOCKED: `extension_not_installed`. Peer ranges include SDK 1.2.0. A future local test must exercise actual allow/deny/ask behavior, headless fail-closed handling and scoped logs. This is a decision layer, not an OS sandbox. |
+| `pi-web-access@0.41.0` | Yes | Installed-versus-published file hashes; actual production resolver | BLOCKED: `extension_load_failed`. Its declared `./dist` entry is a directory, while this resolver requires a regular file. Neither the package pin nor the production resolver was changed or bypassed. |
+| `openwiki@0.7.2` | Yes | Artifact binding; real resolver; actual SDK/adapter load, tool selection, local scripted turn and shutdown for read-only and coding | Component PASS, restricted scope. Six tools register; none are active in read-only, all six are active in coding. Writer/retrieval tools and its internal MCP child were not invoked. No quality benefit or single-writer enforcement is established. |
+| `pi-cursor-sdk@0.5.3` | Yes | Artifact binding; real resolver; engine and source review | Resolver PASS, runtime BLOCKED: package requires Node >=24; the evaluated process is Node 22.23.2. Cursor's own SDK tool/MCP surfaces and persistence remain separate from Pi tool selection. No model request or Node upgrade was attempted. |
+
+The matrix separates a reproducible resolver result from a runtime test that did
+not start. The Cursor engine mismatch is a manifest-based compatibility gate,
+not an observed import crash. Static peer-range inclusion is not a runtime PASS.
+The four absent packages remain absent: the assignment requires loading installed,
+exactly pinned allowlist entries and forbids solving missing installation by
+automatic global installation. Downloaded tarballs were not added to Pi's install.
+
+## OpenWiki headless component evidence
+
+The [result](openwiki-headless-result.json) and
+[input/probe bindings](openwiki-headless-bindings.json) record:
+
+- The actual installed `openwiki@0.7.2` entry loaded through the production
+  resolver and `SdkPiSessionAdapter`, using the real installed SDK 1.2.0.
+- A second, explicitly identified local test-only extension supplied an in-memory
+  fixture provider. This is test instrumentation, not B/C treatment selection or
+  an external model route. No model credential was supplied.
+- Fresh temporary HOME, agent/config/cache/data directories; telemetry opt-outs;
+  no selected worker skills, package prompts or themes.
+- Six `openwiki_*` tools registered. Read-only active tools stayed exactly
+  `read`, `grep`, `find`, `ls`; coding exposed the approved built-ins plus the
+  fixture tool and OpenWiki tools. The fixture's attempted tool widening did not
+  broaden the read-only selection.
+- Local scripted prompt completed; the fixture shutdown event ran. The candidate
+  tools were never invoked. Instrumented network and child-process entrypoints
+  recorded zero attempts; child exit was observed.
+
+The probe deliberately does not call `openwiki_begin` or any other writer tool.
+The installed entry starts its CLI/MCP bridge lazily from those callbacks, and
+its shutdown hook does nothing when no bridge exists. Consequently this test
+does not qualify that child, the wiki writer, connected sources, telemetry of
+writer operations, multiple sessions sharing its module-level bridge, or retrieval
+quality. Tool `executionMode: sequential` is a hint, not a concurrency lock.
+
+Reproduce from the repository root, with existing project dependencies and the
+same installed OpenWiki pin:
+
+```sh
+./node_modules/.bin/tsc -p tsconfig.eval.json
+node docs/evaluation/extension-audit-2026-10-17/run-openwiki-headless-probe.mjs
+```
+
+The [supervisor](run-openwiki-headless-probe.mjs) creates a fresh owned scope and
+result directory, supplies an isolated environment, bounds execution and observes
+child exit. The [probe](openwiki-headless-probe.mjs) exercises the actual adapter.
+The source-bound [reproduction result](openwiki-headless-reproduction.json)
+preserves the second fresh-scope check. These JavaScript guards are
+instrumentation, not an operating-system sandbox or proof that all native code
+could be contained.
+
+## Static findings that affect future tests
+
+`pi-lens` ships code diagnostics/navigation plus auxiliary execution paths for
+LSPs, formatters, autofix, grammar and tool acquisition. Its source has a project
+trust guard, but propagation of that guard through this host has not run. It
+tracks local diagnostics/session data; this audit does not prove the absence of
+all optional outbound telemetry. [Artifact findings](navigation-static-evidence.json),
+[registry/SRI inputs](navigation-cursor-registry.json),
+[upstream source](https://github.com/apmantza/pi-lens).
+
+`context-mode` persists prompt/tool-derived events and compaction snapshots and
+starts its MCP bridge lazily at `before_agent_start`. That timing must be tested
+against this adapter's earlier composed tool allowlist. Its bootstrap can degrade
+best-effort; it must not be mistaken for a mandatory fail-closed policy. Its
+global postinstall includes repair of other clients' plugin/settings registries;
+no such script ran here. The shell HTTP routing regex is not a network security
+boundary. [Artifact findings](navigation-static-evidence.json),
+[upstream source](https://github.com/mksglu/context-mode).
+
+The permission package's local logs may include command/tool-input previews;
+name-based redaction is not a general secret detector. Cache-optimizer payload
+rewrites, persistence, warming and interactive mutations each need their own
+tests with synthetic events and no provider. These paths were reviewed, not
+executed. The detailed [permission/cache report](permission-cache-report.md) and
+[evidence](permission-cache-evidence.json) include exact pins and qualification
+cases. The independently downloaded tarballs matched both registry SHA-512 SRI
+and the other reviewer's SHA-256 hashes in
+[artifact verification](permission-cache-artifact-verification.json).
+
+Web Access is an external-data capability, not a free local navigation tool.
+Search, fetching, summarization, optional browser-cookie auth and local result
+state require an explicit research data path. The installed release's loader
+failure cannot be repaired by silently taking newer upstream source. OpenWiki
+is the verified LangChain package, distinct from `pi-openwiki`, and its workflow
+can write repository/wiki and personal state. Its documented standalone telemetry
+default is on; both telemetry opt-outs were set for the component probe. The
+earlier [web/OpenWiki static report](web-openwiki-report.md) records its own
+pre-smoke state; the component result above is the subsequent runtime evidence.
+
+Cursor has its own local SDK agent, host tools, MCP configuration and durable
+session stores. Pi's read-only allowlist does not disable those surfaces. Loading
+that extension is not a native provider/model switch. The exact installed package
+and Node requirement are recorded in [Cursor findings](cursor-static-evidence.json)
+and the [published manifest](https://registry.npmjs.org/pi-cursor-sdk/0.5.3).
+
+## Provenance, verification and remaining scope
+
+[Installed metadata](installed-packages.json) and
+[actual resolver outcomes](resolver-gates.json) cover all seven pins. Registry
+`latest` was recorded as a timestamped observation for absent candidates; installed
+Web Access, OpenWiki and Cursor were assessed at their existing pins. Verified
+tarball integrity binds the published artifacts. For the installed packages,
+[selected source files](installed-artifact-comparison.json) matched published
+artifact bytes in all 11 comparisons. This is not a full transitive dependency
+or supply-chain audit. The existing project source digest and eight-run evidence
+were preserved. Documentation and probe artifacts have their own integrity index.
+
+No live quality ablation was selected. The screening's strict receipt failures
+did not demonstrate an LSP, large-output or cache bottleneck, and the pilot gates
+remain unmet. T9 controlled compaction is still BLOCKED; context retention source
+code is not an observed compaction test. Actual spend of the previous screening
+remains unknown. New paid model runs need their own concrete matrix and budget;
+none are hidden inside these component checks.
+
+The runtime work left is specific: installed exact pins for four candidates,
+a compatible published entry/loader decision for Web Access, and a supported Node
+runtime for Cursor. OpenWiki writer/retrieval qualification needs a separate
+synthetic single-writer task. None of these prerequisites is recorded as passed.

package/docs/evaluation/extension-audit-2026-10-17/checks.json

@@ -0,0 +1,38 @@
+{
+  "kind": "extension-dossier-verification",
+  "verified_at": "2026-10-17T09:07:30.397Z",
+  "source_binding": {
+    "commit": "406dae7e6b99aa5715960490e869bd3fc668cca2",
+    "digest": "sha256:686887d57899c2e55593bb7dd98b78be08ea0fc6c471a6dd4eab3298f890d160"
+  },
+  "status": "PASS",
+  "checks": {
+    "seven_exact_candidates": "PASS",
+    "seven_real_resolver_checks": "PASS",
+    "four_missing_installs_classified": "PASS",
+    "web_directory_entry_gate_reproduced": "PASS",
+    "cursor_node_engine_gate_documented": "PASS",
+    "openwiki_two_permission_profiles": "PASS",
+    "openwiki_fresh_scope_reproduction": "PASS",
+    "probe_hash_binding": "PASS",
+    "successful_owned_scope_cleanup": "PASS",
+    "selected_published_vs_installed_files": "PASS",
+    "prior_live_evidence_unchanged": "PASS",
+    "local_links": "PASS",
+    "json_parsing": "PASS",
+    "private_marker_scan": "PASS",
+    "independent_review": "PASS",
+    "whitespace_check": "PASS",
+    "probe_syntax_checks": "PASS"
+  },
+  "counts": {
+    "selected_artifact_file_comparisons": 11,
+    "prior_live_evidence_files": 35,
+    "checked_local_links": 18,
+    "json_files_before_this_record": 16
+  },
+  "additional_paid_candidate_starts": 0,
+  "full_test_suite_rerun": false,
+  "full_test_suite_reason": "Evaluated product/harness source unchanged; targeted resolver and actual headless adapter checks cover this follow-on.",
+  "quality_ablation": "NOT_RUN"
+}

package/docs/evaluation/extension-audit-2026-10-17/cursor-static-evidence.json

@@ -0,0 +1,93 @@
+{
+  "kind": "installed-cursor-static-audit",
+  "identity": "npm:pi-cursor-sdk@0.5.3",
+  "observed_at": "2026-10-17T09:03:44.754Z",
+  "manifest_hash": "sha256:66d2272b2b3a598c1b03510c3d2083e98fd974a8464ae3b034ed328a1c0774ed",
+  "engines": {
+    "node": ">=24"
+  },
+  "current_node": "22.23.2",
+  "node_engine_supported": false,
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-tui": "*",
+    "typebox": "*"
+  },
+  "license": "MIT",
+  "dependencies": {
+    "@cursor/sdk": "1.0.37",
+    "@hono/node-server": "2.1.3",
+    "@modelcontextprotocol/hono": "2.0.2",
+    "@modelcontextprotocol/server": "2.3.1",
+    "hono": "4.13.13"
+  },
+  "source_files": [
+    {
+      "file": "dist/index.js",
+      "hash": "sha256:9fd42e8582599655b72878672f911f8b5fa4cf7ac251e4c2fe77fc303c3377c4"
+    },
+    {
+      "file": "dist/cursor-provider-binding.js",
+      "hash": "sha256:3006bf5ab44f355dfb5117a27f071cc112f93299815ac3689e3a72a3af905c1f"
+    },
+    {
+      "file": "dist/model-discovery.js",
+      "hash": "sha256:c6f70d96d552fd168bb721f95e936ba1fc8351bfd67366cb963ea571b584e953"
+    },
+    {
+      "file": "dist/cursor-session-store.js",
+      "hash": "sha256:e7004f34a94a410737206fa09dcbd4e2131c7303bbc58482200f87db7c6148ef"
+    },
+    {
+      "file": "dist/cursor-config.js",
+      "hash": "sha256:bfa4d71188ba072abf4cb225a794ffe5f2af324d24ea5a3f27878baf1b1448a2"
+    },
+    {
+      "file": "dist/cursor-usage-ledger.js",
+      "hash": "sha256:d250d021068b1981e77af2b2e6f86e5a31d6c520ebd04acb1c63e5489faa0e5e"
+    },
+    {
+      "file": "dist/cursor-cloud-reporting.js",
+      "hash": "sha256:b8b62919df68b7757acea10e73cee73b09d2a831875f3cb353059b411f9196c6"
+    }
+  ],
+  "loading": "NOT_RUN",
+  "provider_calls": 0,
+  "findings": [
+    {
+      "id": "node-engine",
+      "status": "BLOCKED",
+      "fact": "Package requires Node >=24; evaluated process runs Node 22.23.2."
+    },
+    {
+      "id": "own-agent-loop",
+      "status": "restricted",
+      "fact": "Cursor runs its own SDK agent loop; Pi tool allowlists do not disable Cursor host/MCP tools."
+    },
+    {
+      "id": "network",
+      "status": "not-exercised",
+      "fact": "Source registers cursor.com provider; live model/catalog/cloud calls use Cursor services. Startup discovery declares allowNetwork:false."
+    },
+    {
+      "id": "storage",
+      "status": "not-exercised",
+      "fact": "Session-store source derives a durable Cursor SDK-agent store below a user-home cursor projects directory; Pi in-memory sessions do not remove extension-owned persistence."
+    },
+    {
+      "id": "telemetry",
+      "status": "not-established",
+      "fact": "Local usage-ledger and optional public billing/cloud reporting are present. No package-wide absence of telemetry is claimed."
+    },
+    {
+      "id": "headless",
+      "status": "NOT_RUN",
+      "fact": "Source supports no-UI branches, but unsupported current Node engine blocks runtime qualification in this environment."
+    }
+  ],
+  "sources": [
+    "https://registry.npmjs.org/pi-cursor-sdk/0.5.3",
+    "https://github.com/fitchmultz/pi-cursor-sdk"
+  ]
+}