gentle-pi v2.0.0

gentle-pi v2.0.0

The first breaking release of the RDD line: gentle-pi stops speaking gentle-ai.review-integration/v1 entirely and negotiates contract v2 only against the pinned Gentle AI v2.2.2 binary. Frozen Git trees replace the Base64 candidate payload, evidence capture becomes a first-class ordered step, and Pi can finally finalize a reviewed candidate end to end.

Highlights

• Contract v2 only, v1 lane deleted (#231): contracts/review-integration/v2/ is mirrored byte-identically from Gentle AI v2.2.2 (9 schemas, 4 fixtures), and lib/review-integration-v2.ts replaces the old module with 11 exact-key decoders covering capabilities/v2, start/v3, status/v3, consent/v2, failure/v2, operation/v2, repair/v2, and the projection and artifact-subject envelopes. No v1 identity remains in lib/, runtime/, or tests/; the v1 schema files stay on disk only as $ref targets for v2 schemas.
• Pi can finalize a reviewed candidate (#231): review.capture-result and review.capture-evidence are wired through the production controller. FINALIZE requires exactly one review.capture-evidence input before any targeted validation, re-queries STATUS after capture, and fails closed on a premature external.run_targeted_validation — the exact status → capture-evidence → status → finalize ordering is proven by the runtime harness against the real extension.
• Reviewer dispatch binds field-wise to the frozen trees (#231): dispatch consumes the provider-issued artifact_subject, base_tree, candidate_tree, and ordered changed_path_manifest from next_transition.collect.inputs[], comparing status, old_mode, new_mode, deleted, type_changed, mode_only, and intended_untracked instead of sorted path-set equality. Mode-only and type-change drift are rejected even when paths match, and a candidate tree that diverges between START and dispatch fails closed rather than exposing a substituted view.
• Lens agents get no shell (#231): the four review lens agents resolve to exactly read, grep, and glob. Bash and every mutation tool are denied, and the candidate is reachable only through Read against a chmod-read-only worktree.
• All three correction outcomes execute through production (#231): passed unlocks one provider-bound targeted-validation request, verification_failed keeps the transaction open and charges nothing, and procedural_tooling_failed requires terminal escalated authority. Reused failed-evidence identity is rejected through assertDistinctCorrectionEvidence.
• Negotiation fails loud, never quiet (#231): a half-upgraded .gentle-ai/ install fails hard naming the expected v2.2.2 version instead of degrading to an older runtime, the capability cache is digest-keyed against an independently hashed executable, and GENTLE_PI_REQUIRE_NATIVE_BINARY=1 turns an absent pinned binary into an exception instead of a green self-skip.
• Three latent v1 decoder gaps fixed while porting (#231): FAILURE_NEXT_ACTIONS omitted review.repair and rejected valid failure envelopes the published schema allows; decodeEligibility did not accept disposition plus binding for review.retry_final_verification; and decodeFailureContext only ever implemented the scope_change branch, silently dropping legitimate binding_revision payloads.

Upgrade notes

• Breaking: gentle-pi no longer negotiates gentle-ai.review-integration/v1. Installations carrying an older Gentle AI binary fail closed with an actionable error naming the expected v2.2.2 version; reinstall normally to provision it.
• pi install npm:gentle-pi@2.0.0 provisions the pinned Gentle AI v2.2.2 binary and verifies its archive and executable SHA-256 before extraction.
• RDD remains an unstable development line. The stable version without native RDD is still pi install npm:gentle-pi@0.14.0.
• Two mirrored skill assets (skills/gentle-ai/SKILL.md, skills/_shared/review-ledger-contract.md) are deliberately left to their upstream sync; cross-process evidence-directory immutability remains provider-owned.

Verification

• The exact release boundary passed the full suite (920 tests, 919 passing, one expected Windows-only skip), the runtime harness, generated-runtime regeneration for all 4 modules, and package verification (129 required files and 64 byte-identical v2.2.2 contract artifacts).
• Independent SDD verification returned PASS against 5/5 requirements and 15/15 scenarios with zero blockers and zero critical findings, 4/4 corrective objectives proven through production callers, and TDD compliance 7/7.
• The change was archived and its delta specs folded into the main spec tree. The review gate is recorded as disabled/unmanaged: the maintainer's global RDD switch was off at release, so no receipt approval was issued or implied.