fix: harden Agent Harness on a 62-file legal workload

.omo/evidence/20260722-legal-runtime-e2e/README.md

@@ -0,0 +1,47 @@
+# Legal Runtime E2E QA
+
+Date: 2026-07-22
+
+Base: `7404ba5cc67ae5689ce5ace07ac8a35ef55b3522`
+
+## What Was Tested
+
+- Replayed one historical complaint-material organization task through the production `createLocalGateway` surface in an isolated workspace and isolated `PILOT_HOME`.
+- Reconstructed 15 OCR/text attachments from the archived accepted input. The archive did not contain the original PDF/XLSX binaries.
+- Loaded a temporary legal Domain Plugin with `UserPromptSubmit` dynamic context, one required XLSX artifact contract, a legal review Skill, and a `PreModelRequest` patch.
+- Drove the bundled Spreadsheet Skill through scaffold, builder editing, build, inspect, audit, render, and final artifact placement.
+- Independently imported the final workbook with Codex `@oai/artifact-tool`, inspected workbook/sheet/table structure, scanned formula errors, rendered every worksheet, and visually reviewed the renders.
+- Ran the Spreadsheet Skill self-test and focused AgentLoop/artifact regression tests.
+- Ran the complete test suite and isolated a pre-existing `networkFetch` cancellation failure exposed by the gate.
+
+## What Was Observed
+
+- The first bounded rerun loaded the legal Skill, read all 15 inputs once, and called `read_file` immediately after spreadsheet scaffold. It ended at `max_turns` without creating the required workbook. This reproduced a generic Harness defect: a final tool-calling turn could reach the max-turn branch before required artifact validation ran.
+- A failing-first regression test returned `max_turns` on the old production path. After the fix, the same scenario returns `tool_error` with the missing artifact path.
+- The final rerun completed normally with 17 model requests and 37 successful tool calls. It created the required workbook at the exact contracted path and ran inspect/audit/render before completion.
+- Independent workbook inspection found three worksheets and three tables. Used ranges were `A1:I26`, `A1:G18`, and `A1:H26`. Formula-error search matched zero cells.
+- Visual review found readable titles, headers, wrapped long text, risk colors, and no overlapping or clipped cells across all three worksheet renders and the eight-page print render.
+- Spreadsheet self-test passed create, LibreOffice recalculation, inspect, prefixed-OOXML normalization, clean audit, existing-workbook edit-copy, intentional formula-error detection, CSV/TSV, compatibility preflight, and two-page render.
+- The first complete suite run passed 155 tests but cancelled all seven `networkFetch` tests because awaited retry/timeout timers were unreferenced and allowed a short-lived Node process to exit. Removing `unref()` from timers owned by an awaited request changed the focused network result from 0/7 completed to 7/7 passed.
+- The final complete suite passed 162/162 with zero failures, cancellations, or skips.
+
+## Why It Is Enough
+
+- The Gateway replay exercises dynamic prompt injection, plugin Skill loading, ToolGuard freshness, artifact contracts, max-turn termination, and spreadsheet delivery together on a real historical legal workload.
+- The focused test pins the exact generic max-turn/artifact regression without depending on legal content.
+- The Spreadsheet self-test exercises the missing-table-style round trip that previously crashed after LibreOffice recalculation.
+- The existing network tests exercise retry success, retry-after bounds, error normalization, request timeout, and parent abort propagation without relying on external network access.
+- Independent artifact-tool inspection and visual review do not rely on the PilotDeck agent's own success report.
+
+## What Was Omitted
+
+- Original legal text, model credentials, provider configuration, raw session JSONL, generated builder source, and the resulting legal workbook are intentionally excluded from git.
+- Original PDF/XLSX visual fidelity was not tested because the archive contains only OCR/text conversions.
+- The temporary legal Domain Plugin used 16,384 output tokens and 20 max turns for the successful run. These are domain workflow/test settings, not PilotDeck Core defaults.
+- `context_budget` status remained based on the model catalog's 65,536-token default reservation before the `PreModelRequest` patch. This is conservative status/accounting behavior and is left for a separate lifecycle-budget change because it did not invalidate this delivery.
+
+## Cleanup
+
+- Both Gateway runs were disposed by the driver.
+- No server, tmux session, browser context, container, or bound port was left running.
+- All temporary inputs, isolated homes, generated workbooks, render outputs, and verifier files were moved from `/tmp` to the macOS Trash with explicit paths. The source archive was retained. No user PilotDeck config or main-worktree file was modified.

.omo/evidence/20260722-legal-runtime-e2e/real-run-summary.json

@@ -0,0 +1,52 @@
+{
+  "baseCommit": "7404ba5cc67ae5689ce5ace07ac8a35ef55b3522",
+  "source": {
+    "kind": "archived accepted-input replay",
+    "attachmentCount": 15,
+    "attachmentFormat": "OCR/text reconstruction",
+    "originalBinariesAvailable": false
+  },
+  "boundedRun": {
+    "maxTurns": 12,
+    "modelRequests": 15,
+    "toolCalls": 32,
+    "finishReason": "max_turns",
+    "requiredArtifactCreated": false,
+    "observedFreshnessSequence": [
+      "spreadsheet scaffold",
+      "read_file(builder)",
+      "write_file(builder)"
+    ],
+    "diagnosis": "max-turn termination after tool results bypassed required artifact validation"
+  },
+  "finalRun": {
+    "maxTurns": 20,
+    "domainMaxOutputTokens": 16384,
+    "modelRequests": 17,
+    "toolCallsStarted": 37,
+    "toolCallsFinished": 37,
+    "finishReason": "completed",
+    "requiredArtifactCreated": true,
+    "workbook": {
+      "worksheetCount": 3,
+      "tableCount": 3,
+      "ranges": [
+        "A1:I26",
+        "A1:G18",
+        "A1:H26"
+      ],
+      "formulaErrors": 0,
+      "pilotdeckRenderPages": 8,
+      "independentWorksheetRenders": 3,
+      "visualReview": "passed"
+    }
+  },
+  "isolation": {
+    "pilotHome": "temporary isolated directory",
+    "workspace": "temporary isolated directory",
+    "memoryEnabled": false,
+    "telemetryEnabled": false,
+    "routerEnabled": false,
+    "mainWorktreeChanged": false
+  }
+}

.omo/evidence/20260722-legal-runtime-e2e/regression-summary.json

@@ -0,0 +1,26 @@
+{
+  "focused": {
+    "agentLoopArtifactAndNetwork": {
+      "passed": 17,
+      "failed": 0,
+      "cancelled": 0
+    }
+  },
+  "networkFailingFirst": {
+    "passed": 0,
+    "failed": 0,
+    "cancelled": 7,
+    "reason": "Promise resolution remained pending after unref timers allowed the Node event loop to exit"
+  },
+  "networkAfterFix": {
+    "passed": 7,
+    "failed": 0,
+    "cancelled": 0
+  },
+  "fullSuiteAfterFix": {
+    "passed": 162,
+    "failed": 0,
+    "cancelled": 0,
+    "skipped": 0
+  }
+}

.omo/evidence/20260722-legal-runtime-e2e/spreadsheet-self-test-summary.json

@@ -0,0 +1,24 @@
+{
+  "status": "ok",
+  "steps": [
+    "create",
+    "recalculate",
+    "inspect",
+    "inspect-prefixed-ooxml",
+    "audit-clean",
+    "edit-copy",
+    "audit-error",
+    "csv-tsv",
+    "compatibility-preflight",
+    "render"
+  ],
+  "formulaChecks": {
+    "margin": 0.3,
+    "projectedRevenue": 110000,
+    "formulaCount": 4,
+    "intentionalErrorDetected": true
+  },
+  "tableCount": 1,
+  "renderPageCount": 2,
+  "visualReview": "passed"
+}

.omo/evidence/20260722-pilotdeck-agent-runtime/README.md

@@ -0,0 +1,32 @@
+# PilotDeck Agent Runtime QA Evidence
+
+Date: 2026-07-22
+
+## What Was Tested
+
+1. TypeScript production build with `pnpm run build`.
+2. Forty-one focused tests covering dynamic context, mutable `PreModelRequest`, post-routing request rebuilds, domain activation, artifact validation/correction, session cleanup, prompt dispatch arbitration, cancellation, timeout, shutdown, and the public WebSocket trust boundary.
+3. A deterministic local-gateway integration test that loads a real project plugin command from `.pilotdeck/plugins`, injects current-request context and a model patch, registers a required `.xlsx` artifact, observes the first validation failure, and accepts completion only after the correction request creates the artifact.
+4. The complete compiled test inventory except the independently reproduced baseline timer file: 154 tests.
+5. The repository's unmodified `pnpm test` command, including the known baseline timer file.
+6. Diff hygiene with `git diff --check`, and a base comparison for the timer implementation and tests.
+
+## What Was Observed
+
+- `pnpm run build`: PASS.
+- Focused runtime controls: PASS, 41/41.
+- Local gateway/project plugin QA: PASS. Dynamic context was present on the first model request only; `maxOutputTokens` was patched to 1234; a missing `final.xlsx` produced an artifact correction request; completion followed creation of the required file.
+- Full regression inventory excluding `dist/tests/network/fetch.spec.js`: PASS, 154/154.
+- Unmodified `pnpm test`: 153 passed and 7 cancelled in `tests/network/fetch.spec.ts`; no test reported a failed assertion. The cancellation is independently reproducible on Node v22.22.0 because the only pending retry/timeout timers are `unref()`'d.
+- `git diff --exit-code origin/main -- src/network/fetch.ts tests/network/fetch.spec.ts`: PASS, proving this branch does not modify the cancelled baseline surface.
+- The user's main PilotDeck checkout retained its pre-existing uncommitted dynamic-context files; implementation and QA ran only in `/Users/da/Documents/PilotDeck-wt-agent-runtime`.
+
+## Why It Is Enough
+
+The focused suite proves state and security invariants at component boundaries. The local-gateway test additionally drives production assembly, project plugin discovery, command-hook execution, lifecycle parsing, context preparation, routing, model execution, artifact correction, transcript/session cleanup, and gateway disposal together. The 154-test regression pass covers every other compiled test surface in the repository.
+
+## What Was Omitted
+
+- No external model or network API was called; QA used a deterministic local fake model.
+- No real API keys, auth headers, environment dumps, or private user data were captured. The integration fixture uses the literal placeholder `test-key`.
+- The unrelated baseline network timer defect was not changed in this branch to keep the PR scoped to Agent runtime foundations.

.omo/evidence/20260722-pilotdeck-agent-runtime/baseline-known-failure.txt

@@ -0,0 +1,27 @@
+COMMAND
+pnpm test
+
+RESULT
+exit_code=1
+tests=160
+pass=153
+fail=0
+cancelled=7
+cancelled_file=tests/network/fetch.spec.ts
+
+ERROR
+Promise resolution is still pending but the event loop has already resolved
+
+BASE COMPARISON
+git diff --exit-code origin/main -- src/network/fetch.ts tests/network/fetch.spec.ts
+exit_code=0
+
+ENVIRONMENT
+node=v22.22.0
+pnpm=10.32.1
+
+CAUSE
+The baseline implementation calls unref() on the only retry and timeout timers.
+Node can therefore end the test event loop while those promises are pending.
+The same seven cancellations reproduce when this file is run alone. This branch
+does not modify the implementation or its tests.

.omo/evidence/20260722-pilotdeck-agent-runtime/focused-tests.txt

@@ -0,0 +1,32 @@
+COMMAND
+pnpm run build && node --test --test-force-exit --test-timeout 60000 \
+  dist/tests/agent/agent-loop-runtime-controls.spec.js \
+  dist/tests/agent/agent-session-cleanup.spec.js \
+  dist/tests/agent/local-gateway-runtime-controls.spec.js \
+  dist/tests/artifact/artifact-validation.spec.js \
+  dist/tests/context/dynamic-context-runtime.spec.js \
+  dist/tests/context/dynamic-context-store.spec.js \
+  dist/tests/extension/hooks/artifact-contract-output.spec.js \
+  dist/tests/extension/hooks/domain-plugin-runtime.spec.js \
+  dist/tests/extension/hooks/model-request-patch.spec.js \
+  dist/tests/gateway/internal-prompt-dispatch-integration.spec.js \
+  dist/tests/gateway/prompt-dispatch-gate.spec.js \
+  dist/tests/gateway/public-submit-turn-boundary.spec.js \
+  dist/tests/gateway/session-router-idle.spec.js \
+  dist/tests/lifecycle/pre-model-request-effects.spec.js
+
+RESULT
+exit_code=0
+tests=41
+pass=41
+fail=0
+cancelled=0
+duration_ms=770.365917
+
+KEY OBSERVATIONS
+- Project hook context was one-shot and survived a post-routing request rebuild.
+- PreModelRequest token patches were preserved and clamped to model capability.
+- Missing required artifacts triggered a bounded correction turn.
+- Internal prompts waited for the authoritative session idle state and fully drained.
+- Public WebSocket input could not spoof trusted in-process origin/signal fields.
+- SessionEnd cleared context/contracts even when hooks threw.

.omo/evidence/20260722-pilotdeck-agent-runtime/regression-suite.txt

@@ -0,0 +1,15 @@
+COMMAND
+find dist/tests -type f \( -name '*.test.js' -o -name '*.spec.js' \) \
+  ! -path '*/network/fetch.spec.js' -print0 \
+  | xargs -0 node --test --test-force-exit --test-timeout 60000
+
+RESULT
+exit_code=0
+tests=154
+pass=154
+fail=0
+cancelled=0
+duration_ms=27165.563583
+
+This is the complete compiled repository test inventory except the separately
+reproduced baseline timer file documented in baseline-known-failure.txt.

.omo/evidence/20260723-legal-hard-runtime/README.md

@@ -0,0 +1,48 @@
+# Legal Hard-Case Runtime QA
+
+Date: 2026-07-23
+
+Branch: `codex/legal-runtime-e2e`
+
+Base under test: `7404ba5cc67ae5689ce5ace07ac8a35ef55b3522`, subsequently merged with `origin/main` at `a3d1f7cf32219fea7a397a3ccaa40756cdcdaaed` before delivery.
+
+## What Was Tested
+
+- Drove the production PilotDeck Gateway in an isolated home and project against one fresh 62-file legal due-diligence workload: 37 DOCX, 16 PDF, 5 XLSX, 3 PNG, and 1 PPTX.
+- Loaded legal policy only through a temporary Domain Plugin/Skill. The repository changes are generic Harness and office-runtime behavior; no legal rules or case text are embedded in PilotDeck Core.
+- Exercised dynamic `UserPromptSubmit` and per-request model prompt patches throughout extraction, scan classification, topic evidence, reverse coverage, and final-integrity phases.
+- Required a concrete Markdown deliverable through the generic artifact contract, then independently checked source coverage, PPTX inspection, eight topic-evidence files, reverse coverage, and a final hash-bound integrity sentinel.
+- Replayed the difficult case from a fresh project, followed by one short recovery session after the original session accumulated heavy compaction history.
+- Ran backend regression, focused UI regression, production UI build, and all DOCX, Spreadsheet, PDF, and PPTX self-tests.
+
+## What Was Observed
+
+- The fresh primary run completed without a runtime error. It made 40 streamed model requests, applied the dynamic prompt patch to every request, completed 41 tool calls, and emitted the required artifact.
+- The state-driven prompt survived repeated compaction and detected the uninspected PPTX. Deterministic OOXML extraction covered all 9 slides and produced non-empty text for every slide.
+- The ledger closed all 62 sources with no missing or duplicate paths. Machine-readable sources were inspected; scan-only sources were explicitly classified instead of silently treated as reviewed.
+- The first artifact passed the runtime contract but manual review found missing topic-evidence files. A short recovery run created all eight topic files, the reverse-coverage report, and the final integrity sentinel, and updated the opinion.
+- The post-recovery independent hard verifier passed. The final opinion is 61,313 bytes with SHA-256 `fb8e30384b89faa0e975db0cf92aa8463b77d04ffe8da88302a9b8d16609b68a`.
+- Composite milestones caused unnecessary loops. Restricting each dynamic prompt milestone to one observable action produced reliable forward progress.
+- The hard run exposed generic runtime defects around transient provider termination, artifact reminders, zero-byte artifacts, extension watcher noise, Python bytecode generation, and intermittent empty LibreOffice conversion output. The fixes are covered by focused tests and full regressions.
+
+## Why It Is Enough
+
+- The real Gateway run proves that generic lifecycle hooks, dynamic prompt injection, Skills, tool execution, compaction recovery, and artifact contracts cooperate on a heterogeneous workload rather than only in unit tests.
+- The independent hard verifier does not trust the model's completion message. It derives pass/fail from files, coverage records, and the final opinion hash.
+- The legal workflow remains outside PilotDeck Core, demonstrating the intended architecture boundary: generic mechanism in the Harness, legal judgment and workflow in a Skill/Domain Plugin.
+- The office self-tests cover the exact conversion and extraction surfaces used by the hard case; backend and filtered UI regressions cover the surrounding product behavior.
+
+## What Was Omitted
+
+- Private legal text, source filenames, case identifiers, model/provider credentials, raw sessions, generated evidence prose, the opinion body, and raw Judge payloads are excluded from git.
+- Seventeen scan-only files were classified as unreadable scans in this text-first run; no claim is made that their image contents were semantically reviewed.
+- The external 321-checkpoint Judge result is recorded separately in `judge-status.json`. No checkpoint is claimed as passed unless a complete Judge response is available.
+- Full UI test and typecheck have upstream baseline failures documented in `known-ui-baselines.md`; the filtered suite and production build passed.
+
+## Evidence Index
+
+- `hard-run-summary.json`: sanitized production Gateway and dynamic-prompt metrics.
+- `hard-quality-gate.json`: content-free independent artifact and coverage checks.
+- `regression-summary.json`: backend, UI, office-skill, and build results.
+- `known-ui-baselines.md`: failures reproduced from byte-identical `origin/main` files/configuration.
+- `judge-status.json`: aggregate external Judge result and claim boundary.

.omo/evidence/20260723-legal-hard-runtime/hard-quality-gate.json

@@ -0,0 +1,42 @@
+{
+  "command": "node /tmp/pilotdeck-legal-benchmark-runner.mjs verify-hard <isolated-project>",
+  "observedAt": "2026-07-23",
+  "passed": true,
+  "checks": {
+    "sourceFileCount": 62,
+    "ledgerExists": true,
+    "ledgerFileCount": 62,
+    "missingSourcePathCount": 0,
+    "duplicateLedgerPathCount": 0,
+    "uninspectedMachineReadableCount": 0,
+    "pptxRecordInspected": true,
+    "pptxManifestExists": true,
+    "pptxManifestValid": true,
+    "pptxSlideCount": 9,
+    "stalePptxNotInspectedLanguage": false,
+    "topicEvidence": {
+      "required": 8,
+      "present": 8,
+      "nonEmpty": 8,
+      "sizesBytes": [4760, 9306, 5187, 5377, 7577, 6396, 7155, 7245]
+    },
+    "reverseCoverageReportExists": true,
+    "reverseCoverageReportBytes": 12893,
+    "finalIntegritySentinelExists": true,
+    "finalIntegritySentinelBoundToCurrentOpinionSha": true,
+    "errorCount": 0
+  },
+  "manualSemanticChecks": {
+    "topicEvidenceUniqueSourceIdsPerFile": "8-24",
+    "topicEvidenceIncludesConflictOrVerificationLanguage": true,
+    "topicEvidenceIncludesLegalOrRiskAnalysis": true,
+    "reverseReportCoversAllEightSourceFolders": true,
+    "reverseReportCoversAllEightTopics": true,
+    "opinionDistinctSourceIdExpressions": 65,
+    "opinionContainsPlaceholders": false,
+    "opinionContainsStalePptxLanguage": false,
+    "materialConflictsPreserved": true,
+    "uncertainLegalCitationsMarkedForPartnerVerification": true
+  },
+  "privacy": "Only counts, booleans, sizes, and hashes are recorded; private legal content is omitted."
+}