specpi 0.10.0

package/extensions/tool-wishlist/registry.mjs

@@ -0,0 +1,99 @@
+import { VALIDATOR_CATALOG } from "./validators.mjs";
+
+const STOP_WORDS = new Set([
+    "a",
+    "an",
+    "and",
+    "capability",
+    "for",
+    "missing",
+    "need",
+    "needed",
+    "of",
+    "support",
+    "the",
+    "to",
+    "tool",
+    "tools",
+]);
+
+const VALIDATORS = new Set(Object.keys(VALIDATOR_CATALOG));
+
+function compact(value, maxLength) {
+    return String(value ?? "")
+        .normalize("NFKC")
+        .replace(/[\u0000-\u001f\u007f]+/g, " ")
+        .replace(/\s+/g, " ")
+        .trim()
+        .slice(0, maxLength);
+}
+
+function normalizeToken(token) {
+    if (token.length > 4 && token.endsWith("s") && !token.endsWith("ss")) {
+        return token.slice(0, -1);
+    }
+
+    return token;
+}
+
+export function normalizeCapability(value) {
+    const tokens = compact(value, 120)
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, " ")
+        .split(" ")
+        .filter(Boolean)
+        .map(normalizeToken)
+        .filter((token) => !STOP_WORDS.has(token));
+
+    return [...new Set(tokens)].slice(0, 10).join("-") || "uncategorized-gap";
+}
+
+export function validateCapabilityRegistry(registry) {
+    if (registry?.schema !== 1 || !Array.isArray(registry.capabilities)) {
+        throw new Error("schema or capabilities array is invalid");
+    }
+
+    const ids = new Set();
+    const aliases = new Set();
+    for (const item of registry.capabilities) {
+        if (
+            typeof item?.id !== "string" ||
+            normalizeCapability(item.id) !== item.id ||
+            typeof item.title !== "string" ||
+            item.title.trim().length < 3 ||
+            !Array.isArray(item.aliases) ||
+            typeof item.shippedVersion !== "string" ||
+            typeof item.shippedAt !== "string" ||
+            !Number.isFinite(Date.parse(item.shippedAt)) ||
+            !Array.isArray(item.validations) ||
+            item.validations.length === 0 ||
+            item.validations.some((validator) => !VALIDATORS.has(validator))
+        ) {
+            throw new Error(`invalid capability entry: ${item?.id || "unknown"}`);
+        }
+
+        if (ids.has(item.id) || aliases.has(item.id)) {
+            throw new Error(`duplicate capability registry key: ${item.id}`);
+        }
+
+        ids.add(item.id);
+        for (const alias of item.aliases) {
+            if (
+                typeof alias !== "string" ||
+                normalizeCapability(alias) !== alias ||
+                ids.has(alias) ||
+                aliases.has(alias)
+            ) {
+                throw new Error(`duplicate or invalid capability alias: ${alias}`);
+            }
+
+            aliases.add(alias);
+        }
+    }
+
+    return registry;
+}
+
+export function isValidValidatorName(value) {
+    return VALIDATORS.has(value);
+}

package/extensions/tool-wishlist/validators.mjs

@@ -0,0 +1,345 @@
+#!/usr/bin/env node
+/**
+ * Closed capability validators for the SpecPi improvement loop.
+ *
+ * Every shipped capability links to at least one validator from this catalog.
+ * Validators are deterministic, offline, bounded in time, and never touch the
+ * live Pi agent directory: each run proves its capability in temporary state.
+ *
+ * CLI: node validators.mjs <validator> [--state-dir <dir>] [--cwd <dir>] [--browser-runtime <dir>]
+ * Exit 0 proves the validator; any other exit code fails the capability gate.
+ */
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+export const VALIDATOR_CATALOG = Object.freeze({
+    "browser-runtime-smoke": Object.freeze({
+        description: "Launches the managed browser runtime and proves exact and changed-pixel visual comparisons",
+        timeoutMs: 2 * 60 * 1000,
+    }),
+    "wishlist-state-smoke": Object.freeze({
+        description:
+            "Drives the wishlist core API in a temporary state directory through record, select, retire with journal, reopen, metrics, and history",
+        timeoutMs: 2 * 60 * 1000,
+    }),
+    "command-guard-smoke": Object.freeze({
+        description:
+            "Classifies safe, destructive, malformed, protected-path, and nested-shell fixtures with the real command-guard policy",
+        timeoutMs: 2 * 60 * 1000,
+    }),
+    "scope-drift-monitor-smoke": Object.freeze({
+        description:
+            "Proves bounded scope paths and observed outside-scope mutation detection in a temporary repository",
+        timeoutMs: 2 * 60 * 1000,
+    }),
+    "guided-experiment-worktrees-smoke": Object.freeze({
+        description:
+            "Proves detached experiment creation, byte-exact appliable export of committed and uncommitted work measured from the recorded base commit, disclosure of ignored work a patch cannot carry, base isolation, and explicit discard",
+        timeoutMs: 2 * 60 * 1000,
+    }),
+    "completion-challenge-smoke": Object.freeze({
+        description: "Proves structured readiness validation and deterministic unresolved-evidence rejection",
+        timeoutMs: 2 * 60 * 1000,
+    }),
+});
+
+export function validatorNames() {
+    return Object.keys(VALIDATOR_CATALOG);
+}
+
+function parseEnvironment(args) {
+    const environment = {};
+    for (let index = 0; index < args.length; index += 1) {
+        const flag = args[index];
+        const value = args[index + 1];
+        if (flag === "--state-dir") {
+            environment.stateDir = value;
+        } else if (flag === "--cwd") {
+            environment.cwd = value;
+        } else if (flag === "--browser-runtime") {
+            environment.browserRuntime = value;
+        } else {
+            throw new Error(`Unknown validator flag: ${flag}`);
+        }
+
+        if (value === undefined) {
+            throw new Error(`Validator flag ${flag} requires a value`);
+        }
+
+        index += 1;
+    }
+
+    return environment;
+}
+
+function runBrowserRuntimeSmoke(environment) {
+    if (!environment.browserRuntime) {
+        throw new Error("browser-runtime-smoke requires --browser-runtime <managed-runtime-dir>");
+    }
+
+    const smokeScript = fileURLToPath(new URL("../browser/smoke.mjs", import.meta.url));
+    const result = spawnSync(process.execPath, [smokeScript, environment.browserRuntime], {
+        encoding: "utf8",
+        timeout: VALIDATOR_CATALOG["browser-runtime-smoke"].timeoutMs,
+    });
+    if (result.status !== 0) {
+        throw new Error(`${(result.stderr || result.stdout || "browser smoke exited non-zero").trim().slice(0, 300)}`);
+    }
+
+    return (result.stdout || "Browser runtime smoke passed").trim().split("\n").at(-1);
+}
+
+async function runWishlistStateSmoke() {
+    const core = await import("./core.mjs");
+    const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "specpi-wishlist-state-smoke-"));
+    try {
+        const gap = {
+            capability: "Wishlist state smoke",
+            scenario: "A validator exercises the wishlist lifecycle end to end",
+            limitation: "The lifecycle under test must be observable without touching live state",
+            impact: "degraded",
+            workaround: "Manual state inspection",
+            suggestedFix: "tool",
+        };
+        await core.setCollectionMode({ stateDir, mode: "on" });
+        await core.recordCapabilityGap({
+            stateDir,
+            sessionId: "smoke-session-one",
+            runId: "run-one",
+            cwd: "/smoke/project-a",
+            gap,
+            now: "2026-01-01T00:00:00.000Z",
+        });
+        await core.recordCapabilityGap({
+            stateDir,
+            sessionId: "smoke-session-two",
+            runId: "run-two",
+            cwd: "/smoke/project-b",
+            gap,
+            now: "2026-01-02T00:00:00.000Z",
+        });
+
+        const qualified = await core.refreshWishlist({ stateDir });
+        if (qualified.uniqueGaps !== 1 || qualified.occurrences !== 2) {
+            throw new Error("Expected one qualified gap with two occurrences");
+        }
+
+        const candidate = qualified.improvements[0];
+        if (!candidate?.qualified || candidate.canonicalKey !== "wishlist-state-smoke") {
+            throw new Error("Expected the recorded gap to qualify for improvement");
+        }
+
+        await core.appendWishlistDecision({
+            stateDir,
+            action: "select",
+            canonicalKey: candidate.canonicalKey,
+            note: "smoke selection",
+            now: "2026-01-02T06:00:00.000Z",
+        });
+        const retire = await core.appendWishlistDecision({
+            stateDir,
+            action: "retire",
+            canonicalKey: candidate.canonicalKey,
+            note: "wishlist state smoke retirement note",
+            now: "2026-01-03T00:00:00.000Z",
+            journal: {
+                schema: 1,
+                evidence: ["wishlist-state-smoke lifecycle completed in temporary state"],
+                gates: ["npm run check", "wishlist-state-smoke"],
+                changedFiles: ["extensions/tool-wishlist/core.mjs"],
+                changedFilesTruncated: false,
+                version: "smoke",
+            },
+        });
+
+        await core.recordCapabilityGap({
+            stateDir,
+            sessionId: "smoke-session-three",
+            runId: "run-three",
+            cwd: "/smoke/project-a",
+            gap,
+            now: "2026-01-04T00:00:00.000Z",
+        });
+        const reviewing = await core.refreshWishlist({ stateDir });
+        if (!reviewing.improvements[0]?.reviewNeeded) {
+            throw new Error("Expected a post-retirement review signal");
+        }
+
+        if (reviewing.metrics.retirements !== 1 || reviewing.metrics.openReviews !== 1) {
+            throw new Error("Expected one retirement and one open review");
+        }
+
+        const reopen = await core.appendWishlistDecision({
+            stateDir,
+            action: "reopen",
+            canonicalKey: candidate.canonicalKey,
+            note: "Reopened for review: 1 post-retirement signal(s)",
+            evidence: ["1 post-retirement signal(s) recorded after the retirement"],
+            now: "2026-01-05T00:00:00.000Z",
+        });
+        const reopened = await core.refreshWishlist({ stateDir });
+        const linked = core.linkReopenToRetirement(
+            reopened.decisions,
+            reopened.decisions.find((decision) => decision.id === reopen.decisionId),
+        );
+        if (linked?.id !== retire.decisionId) {
+            throw new Error("Expected the reopen to link to the latest retirement");
+        }
+
+        if (
+            reopened.metrics.retirements !== 1 ||
+            reopened.metrics.reopenRate !== 100 ||
+            reopened.metrics.medianDaysToRetire !== 2
+        ) {
+            throw new Error("Expected metrics to reflect one retirement, a full reopen rate, and a two-day median");
+        }
+
+        const history = core.renderWishlistHistory(reopened.events, reopened.decisions, candidate.canonicalKey);
+        if (
+            !history.includes("wishlist-state-smoke lifecycle completed in temporary state") ||
+            !history.includes("Linked retirement")
+        ) {
+            throw new Error("Expected the journal to render retirement evidence and the reopen linkage");
+        }
+
+        if (process.env.SPECPI_WISHLIST_SMOKE_FAULT === "expectation") {
+            throw new Error("Injected expectation fault: metrics.retirements should have been 999");
+        }
+
+        return "wishlist-state-smoke passed: record, select, retire with journal, reopen with linkage, metrics, and history verified in temporary state";
+    } finally {
+        fs.rmSync(stateDir, { recursive: true, force: true, maxRetries: 3 });
+    }
+}
+
+async function runCommandGuardSmoke() {
+    const smoke = await import("../command-guard/smoke.mjs");
+    if (typeof smoke.runCommandGuardSmoke !== "function") {
+        throw new Error("command guard smoke export is unavailable");
+    }
+
+    return smoke.runCommandGuardSmoke();
+}
+
+async function runWorkflowControlsSmoke(validator) {
+    const smoke = await import("../workflow-controls/smoke.mjs");
+    if (typeof smoke.runWorkflowControlsSmoke !== "function") {
+        throw new Error("workflow-controls smoke export is unavailable");
+    }
+
+    return smoke.runWorkflowControlsSmoke(validator);
+}
+
+async function runValidatorInProcess(validator, environment) {
+    if (validator === "browser-runtime-smoke") {
+        return runBrowserRuntimeSmoke(environment);
+    }
+
+    if (validator === "wishlist-state-smoke") {
+        return runWishlistStateSmoke();
+    }
+
+    if (validator === "command-guard-smoke") {
+        return runCommandGuardSmoke();
+    }
+
+    if (
+        validator === "scope-drift-monitor-smoke" ||
+        validator === "guided-experiment-worktrees-smoke" ||
+        validator === "completion-challenge-smoke"
+    ) {
+        return runWorkflowControlsSmoke(validator);
+    }
+
+    throw new Error(`Unknown validator: ${validator}`);
+}
+
+export function runValidator(validator, environment = {}, options = {}) {
+    const entry = VALIDATOR_CATALOG[validator];
+    if (!entry) {
+        return {
+            code: 2,
+            stdout: "",
+            stderr: `Unknown validator: ${validator}. Registered validators: ${validatorNames().join(", ")}`,
+        };
+    }
+
+    const args = [fileURLToPath(new URL("./validators.mjs", import.meta.url)), validator];
+    if (environment.stateDir) {
+        args.push("--state-dir", environment.stateDir);
+    }
+
+    if (environment.cwd) {
+        args.push("--cwd", environment.cwd);
+    }
+
+    if (environment.browserRuntime) {
+        args.push("--browser-runtime", environment.browserRuntime);
+    }
+
+    const timeoutMs = options.timeoutMs ?? entry.timeoutMs;
+    const result = spawnSync(process.execPath, args, {
+        encoding: "utf8",
+        timeout: timeoutMs,
+        cwd: options.cwd,
+    });
+    if (result.signal) {
+        return { code: 1, stdout: result.stdout ?? "", stderr: `${validator} timed out after ${timeoutMs}ms` };
+    }
+
+    return { code: result.status ?? 1, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
+}
+
+async function main() {
+    const [validator, ...flags] = process.argv.slice(2);
+    if (!validator || validator.startsWith("-")) {
+        console.error(
+            "Usage: node validators.mjs <validator> [--state-dir <dir>] [--cwd <dir>] [--browser-runtime <dir>]",
+        );
+        process.exitCode = 2;
+
+        return;
+    }
+
+    if (!VALIDATOR_CATALOG[validator]) {
+        console.error(`Unknown validator: ${validator}. Registered validators: ${validatorNames().join(", ")}`);
+        process.exitCode = 2;
+
+        return;
+    }
+
+    let environment;
+    try {
+        environment = parseEnvironment(flags);
+    } catch (error) {
+        console.error(error.message);
+        process.exitCode = 2;
+
+        return;
+    }
+
+    try {
+        console.log(await runValidatorInProcess(validator, environment));
+    } catch (error) {
+        console.error(`${validator} failed: ${error instanceof Error ? error.message : String(error)}`);
+        process.exitCode = 1;
+    }
+}
+
+const invokedDirectly =
+    Boolean(process.argv[1]) &&
+    (process.platform === "win32"
+        ? path.resolve(process.argv[1]).toLowerCase() === fileURLToPath(import.meta.url).toLowerCase()
+        : path.resolve(process.argv[1]) === fileURLToPath(import.meta.url));
+if (invokedDirectly) {
+    // No top-level await here: registry.mjs statically imports this module, and core.mjs
+    // dynamically imports it back. A pending top-level await would deadlock that cycle.
+    main().catch((error) => {
+        console.error(`validators.mjs failed: ${error instanceof Error ? error.message : String(error)}`);
+        process.exitCode = 1;
+    });
+}

package/extensions/ui-refresh/index.ts

@@ -0,0 +1,54 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+
+const REFRESH_WIDGET = "specpi-ui-prompt-refresh";
+
+/**
+ * Pi's regular-screen renderer can occasionally leave a newly mounted extension
+ * prompt queued until the next keyboard event, especially through Windows SSH
+ * terminals. Keep an invisible widget solely to obtain the documented TUI
+ * handle, then flush one immediate frame after each extension prompt mounts.
+ */
+export default function registerPromptRefresh(pi: ExtensionAPI) {
+    let tui: { renderNow(force?: boolean): void } | undefined;
+    let refreshPending = false;
+
+    pi.on("session_start", (_event, ctx) => {
+        tui = undefined;
+        refreshPending = false;
+        if (ctx.mode !== "tui") {
+            return;
+        }
+
+        ctx.ui.setWidget(REFRESH_WIDGET, (activeTui) => {
+            tui = activeTui;
+
+            return {
+                invalidate() {},
+                render(): string[] {
+                    return [];
+                },
+            };
+        });
+    });
+
+    pi.on("ui_prompt_start", () => {
+        if (!tui || refreshPending) {
+            return;
+        }
+
+        refreshPending = true;
+        setImmediate(() => {
+            refreshPending = false;
+            tui?.renderNow();
+        });
+    });
+
+    pi.on("session_shutdown", (_event, ctx) => {
+        if (ctx.mode === "tui") {
+            ctx.ui.setWidget(REFRESH_WIDGET, undefined);
+        }
+
+        tui = undefined;
+        refreshPending = false;
+    });
+}

package/extensions/workflow-controls/challenge.mjs

@@ -0,0 +1,196 @@
+const MAX_REQUIREMENTS = 16;
+const MAX_LIST = 12;
+
+function compact(value, maximum = 360) {
+    return String(value ?? "")
+        .normalize("NFKC")
+        .replace(/[\u0000-\u001f\u007f]+/gu, " ")
+        .replace(/\s+/gu, " ")
+        .trim()
+        .slice(0, maximum);
+}
+
+function textList(value, name) {
+    if (!Array.isArray(value) || value.length > MAX_LIST) {
+        throw new Error(`${name} must contain at most ${MAX_LIST} items`);
+    }
+
+    return value.map((item) => compact(item)).filter(Boolean);
+}
+
+export function validateChallengeSubmission(value, facts = {}) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Completion challenge submission is malformed");
+    }
+
+    const verdicts = new Set(["ready-for-human-review", "incomplete", "blocked"]);
+    if (!verdicts.has(value.verdict)) {
+        throw new Error("Completion challenge verdict is invalid");
+    }
+
+    if (
+        !Array.isArray(value.requirements) ||
+        value.requirements.length === 0 ||
+        value.requirements.length > MAX_REQUIREMENTS
+    ) {
+        throw new Error(`Completion challenge requires 1-${MAX_REQUIREMENTS} requirement assessments`);
+    }
+
+    const requirements = value.requirements.map((item) => {
+        const requirement = compact(item?.requirement);
+        const evidence = compact(item?.evidence, 600);
+        if (!requirement || !["proven", "partial", "unproven"].includes(item?.status)) {
+            throw new Error("Completion challenge requirement assessment is invalid");
+        }
+
+        if (item.status === "proven" && !evidence) {
+            throw new Error("A proven requirement must cite concise evidence");
+        }
+
+        return { requirement, status: item.status, evidence };
+    });
+    const contradictions = textList(value.contradictions, "contradictions");
+    const falsePositiveChecks = textList(value.falsePositiveChecks, "falsePositiveChecks");
+    const scopeFindings = textList(value.scopeFindings, "scopeFindings");
+    const validationGaps = textList(value.validationGaps, "validationGaps");
+    const residualRisks = textList(value.residualRisks, "residualRisks");
+    const nextAction = compact(value.nextAction, 500);
+
+    if (value.verdict !== "ready-for-human-review" && !nextAction) {
+        throw new Error("Incomplete and blocked challenges require a concrete next action");
+    }
+
+    if (value.verdict === "ready-for-human-review") {
+        const unresolved = requirements.some((item) => item.status !== "proven");
+        if (unresolved) {
+            throw new Error("Ready verdict rejected: one or more requirements remain unresolved");
+        }
+
+        if (contradictions.length > 0) {
+            throw new Error("Ready verdict rejected: contradictory evidence remains");
+        }
+
+        if (validationGaps.length > 0) {
+            throw new Error("Ready verdict rejected: validation gaps remain");
+        }
+
+        if (Array.isArray(facts.pendingScope) && facts.pendingScope.length > 0) {
+            throw new Error("Ready verdict rejected: scope drift remains pending");
+        }
+
+        // An indeterminate snapshot means the facts the review was handed may be incomplete. It is a permanent
+        // condition outside a Git worktree, so rejecting outright would make a ready verdict unreachable there;
+        // instead the limitation must be disclosed rather than silently dropped.
+        if (facts.snapshotIndeterminate === true && residualRisks.length === 0) {
+            throw new Error(
+                "Ready verdict rejected: the change snapshot was indeterminate, so the residual risk of unobserved changes must be disclosed",
+            );
+        }
+    }
+
+    return {
+        verdict: value.verdict,
+        requirements,
+        contradictions,
+        falsePositiveChecks,
+        scopeFindings,
+        validationGaps,
+        residualRisks,
+        nextAction,
+    };
+}
+
+export function boundedChallengeFacts(value = {}) {
+    const paths = (items) =>
+        Array.isArray(items)
+            ? items
+                  .map((item) => compact(item, 240))
+                  .filter(Boolean)
+                  .slice(0, 40)
+            : [];
+
+    return {
+        changedPaths: paths(value.changedPaths),
+        scopeEntries: paths(value.scopeEntries),
+        pendingScope: paths(value.pendingScope),
+        experiment: value.experiment
+            ? {
+                  id: compact(value.experiment.id, 36),
+                  name: compact(value.experiment.name, 48),
+                  acceptance: compact(value.experiment.acceptance, 600),
+                  baseCommit: compact(value.experiment.baseCommit, 64),
+              }
+            : undefined,
+        observedToolFailures: Math.max(0, Math.min(99, Number(value.observedToolFailures) || 0)),
+        snapshotIndeterminate: Boolean(value.snapshotIndeterminate),
+    };
+}
+
+export function challengePrompt(generation, facts) {
+    const bounded = boundedChallengeFacts(facts);
+    const lines = [
+        `[SPECPI COMPLETION CHALLENGE ${generation}]`,
+        "The user explicitly requested an adversarial completion review. Do not continue implementation in this turn.",
+        "Use only evidence already available in context and the bounded facts below. Identify uncertainty rather than inventing proof.",
+        "Answer all six questions through submit_completion_challenge as the final tool call:",
+        "1. Which requirement remains unproven?",
+        "2. What evidence contradicts the proposed result?",
+        "3. Could any check have passed for the wrong reason?",
+        "4. Did scope expand or remain pending?",
+        "5. Was runtime, visual, or platform validation required but omitted?",
+        "6. What residual risk must be disclosed?",
+        "",
+        `Changed paths: ${bounded.changedPaths.join(", ") || "none observed"}`,
+        `Declared scope: ${bounded.scopeEntries.join(", ") || "inactive"}`,
+        `Pending scope drift: ${bounded.pendingScope.join(", ") || "none"}`,
+        `Observed tool failures: ${bounded.observedToolFailures}`,
+        `Snapshot indeterminate: ${bounded.snapshotIndeterminate ? "yes" : "no"}`,
+    ];
+    if (bounded.experiment) {
+        lines.push(
+            `Experiment: ${bounded.experiment.name} (${bounded.experiment.id.slice(0, 8)})`,
+            `Experiment acceptance check: ${bounded.experiment.acceptance}`,
+            `Experiment base: ${bounded.experiment.baseCommit}`,
+        );
+    }
+
+    lines.push(
+        "A ready-for-human-review verdict is allowed only when every listed requirement is proven, no contradiction or validation gap remains, and no scope drift is pending. When the snapshot above is indeterminate, a ready verdict must also disclose the residual risk that some changes went unobserved. This verdict is a structured model review, not independent verification or completion authority.",
+    );
+
+    return lines.join("\n");
+}
+
+export function renderChallengeMarkdown(result, metadata = {}) {
+    const heading =
+        result.verdict === "ready-for-human-review"
+            ? "Ready for human review"
+            : result.verdict === "blocked"
+              ? "Blocked"
+              : "Incomplete";
+    const lines = [`## Completion Challenge — ${heading}`, "", `Generation: \`${metadata.generation ?? "unknown"}\``];
+    lines.push("", "### Requirements");
+    for (const item of result.requirements) {
+        lines.push(`- **${item.status}** — ${item.requirement}${item.evidence ? ` — ${item.evidence}` : ""}`);
+    }
+
+    const sections = [
+        ["Contradictions", result.contradictions],
+        ["Possible false-positive checks", result.falsePositiveChecks],
+        ["Scope findings", result.scopeFindings],
+        ["Validation gaps", result.validationGaps],
+        ["Residual risks", result.residualRisks],
+    ];
+    for (const [title, items] of sections) {
+        lines.push("", `### ${title}`);
+        lines.push(...(items.length > 0 ? items.map((item) => `- ${item}`) : ["- None recorded."]));
+    }
+
+    if (result.nextAction) {
+        lines.push("", "### Next action", "", result.nextAction);
+    }
+
+    lines.push("", "> This is a model-authored challenge result, not independent verification.");
+
+    return lines.join("\n");
+}