gentle-pi v2.1.0

gentle-pi v2.1.0

The first release on top of the contract v2 baseline: consent stops being a clone-wide latch and becomes a provider-owned, candidate-scoped negotiation; approved pre-commit receipts are visible to the lifecycle interceptor again; and Windows gets a trusted runtime build path instead of no runtime at all.

Highlights

• Consent is provider-owned and candidate-scoped (#241, closes #236): the native provider now owns consent applicability and decides it before review authority is created. Pi returns the complete gentle-ai.review-integration.consent/v2 envelope to the parent, which localizes it and answers with exactly one explicit granted or declined token bound to the provider target identity. Replay and target drift fail closed, a declined candidate creates no review lineage, and low-risk structural readback stays silent. The previous behavior — asking after START through a clone-wide latch, with authority creatable before consent — is gone.
• Pre-commit authorization restored (#239, closes #204, #225): lib/review-candidate-view.ts distinguishes an exact staged-index projection from a committed range and from a dirty workspace snapshot, so valid staged candidates restore instead of being rejected — with drift checks intact through a fresh Git write-tree comparison that fails closed on mismatch. extensions/gentle-ai.ts discovers and consumes exact approved native pre-commit receipts when Pi holds no in-session authorization, minting a one-shot command- and cwd-bound authorization that cannot be re-consumed within the same session. Stale bindings, mislabeled dirty workspaces, and tree drift still fail closed, and disabled/unmanaged delivery never restores stale authority.
• Kill-switch parity across lifecycle boundaries (#241): disabling RDD now clears pending lifecycle and consent state instead of leaving it latched, and the mode is rechecked at runtime rather than trusted from session start. Work continues organically under a disabled switch with no fabricated approval.
• Trusted Windows runtime (#244, closes #240): when upstream signed Windows assets are unavailable, the installer builds the exact Gentle AI v2.2.2 Windows runtime from the trusted Go module on x64 and arm64. The build environment is sealed, source provenance is bound to the pinned SumDB checksum, and module metadata, architecture, version, and executable hash are all verified. Only package-local validated bundles are published, under cooperative installer locking with rollback and crash recovery, and there is no ambient gentle-ai fallback.

Upgrade notes

• pi install npm:gentle-pi@2.1.0 provisions the same pinned Gentle AI v2.2.2 binary as 2.0.0; no contract change and no migration is required from 2.0.0.
• Consent prompt is new but non-breaking: medium- and high-risk candidates now surface one blocking consent question per candidate. Both answers are scoped to that exact candidate and persist nothing, so a decline is not the kill switch and does not suppress the question for a later candidate.
• Windows trust boundary: source builds rely on the local Go toolchain plus Go SumDB verification for the exact module, tag, and pinned checksum. This is not equivalent to Authenticode or a signed upstream archive, and it does not protect against a malicious same-user process jointly replacing package code, binary, and manifest.
• RDD remains an unstable development line. The stable version for normal use without native RDD is still pi install npm:gentle-pi@0.14.0.

Verification

• The exact release boundary af8b46bc passed the full suite (960 tests, 959 passing, one expected Windows-only skip), package verification (129 required files and 64 byte-identical v2.2.2 contract artifacts), and all 13 packed-runner states.
• Publication ran from default main through the trusted publish workflow with OIDC and signed provenance; the annotated tag, dispatch commit, checkout, and manifest version all resolved to the same af8b46bc.
• The review gate is recorded as disabled/unmanaged: the maintainer's global RDD switch was off at release, so no receipt approval was issued or implied. Local verification was delegated to CI on that exact release SHA, where the RDD-dependent suites run with the switch at its default.

Full changelog: v2.0.0...v2.1.0