[viztor]

Phase P-T1b of docs/improvement-plan.md, stacked on #109.

An in-process harness that runs the plugin inside the real host, so the routing phases that follow (P-H, P-R1, P-R2) are measured against today's behaviour rather than against fakes. Additive only: no src/ change.

What changed

Item	Files	What it does
Harness, tier A	test/support/host.ts	A bare cordis Context with LlmRuntime and dsh-llm-pi-ai mounted with { providers }, for the internal/config waterfall and pi-ai's credential paths.
Harness, tier B	test/support/host.ts	dsh-app-boot's boot() with a temporary HOME, a test bundle (llm, llm-pi-ai, editor: ConfigEditor, settings: Settings, the plugin), a fake credentials service and a launch-environment snapshot. Rows carry package names through a stub module loader, because the plugin finds pi-ai by options.name. The apply order is fixed (plugin-first, as the binary does it, or pi-ai-first), because the loader starts rows in parallel. It also rebuilds hasProviderApiKey as providerWithApiKey.
Contract tests	test/host-waterfall.test.ts, test/host-shapes.test.ts, test/host-credentials.test.ts, test/host-editor-contracts.test.ts	Waterfall: the listener fires for another plugin's fiber, prepend puts it outermost, raw === _config holds for _reload/update/_commitVolatile but not for the editor candidate (F14), and a deep-frozen input is never mutated while the fiber keeps the return value (F12). Shapes: the profile shape, the Config defaults snapshot, recordKeyFor, no secret-role nodes, the loader's interpolation and pi's public exports. Credentials. Editor: configEditor.edit writes raw beside the YAML, _commitVolatile re-resolves through a prepended listener, and settings.describe and hasProviderApiKey get baselines.
Tier A smoke	test/host-harness.test.ts	listProviders() equals pi-ai's keys (F11), and each builder option is exercised once.
Characterization	test/host-characterization.test.ts	Today's behaviour on pi 1.1.0, with each row tagged KNOWN_DEFECT or INTENDED_CHANGE where P-R1 is expected to flip it. S0_TODAY is shared with the binary e2e.
Keyless matrix	test/support/keyless-matrix.ts, test/keyless-matrix.test.ts, test/e2e/keyless-matrix.e2e.ts	The 401-vs-404 cell table and a pure classifier, its unit test, and a gated live run.
Binary e2e	test/e2e/host-binary.e2e.ts, test/e2e/host/	Runs the probe bundle in the installed host, gated on DSH_HOST_E2E=1 and reading DSH_HOST_PREFIX.
CI	.github/workflows/ci.yml, package.json	The e2e-host job. Cell a: pi 1.1.0, pinned and patched, on PRs that touch the host seams, cordis.patch.yml or vite.config.ts. Cell b: whatever npm installs, nightly and on dispatch. Adds the test:e2e:host script.
Docs	AGENTS.md, CONTRIBUTING.md, docs/improvement-plan.md, test/support/src.ts, vite.config.ts	Repo map, e2e section and commands, the plan's P-T1b entry and status (in review), the test door, and the e2e config base.

Behaviour changes

• Plugin: none. This is a pinning phase, and no file under src/ changes.
• Test and CI only:
  • The e2e-host job also runs on pull requests that touch vite.config.ts. That file holds the pack config for lib/index.mjs and the test settings that the e2e config inherits.
  • When the binary e2e fails, its message now gives the real cause. It says "timed out" only when the test's own deadline killed the host, "killed by <signal>" for a crash, and gives the probe's fatal message whenever there is one. The dsh install helper reports spawn errors and signals instead of "exited null".

Review

Three lenses (correctness, tests, repo rules), three rounds. No reviewer was missing in any round.

Round	Found	Upheld	Fixed
1	25	25	25
2	6	6	6
3	4	4	4

Each round's upheld findings were fixed before the next round ran. Round 3's four findings are fixed in this commit:

• The endpoint: legacy wording is narrowed. Go's Google traffic stays on the modern cell under every family.
• whyRunFailed separates timeouts, signal deaths and fatal probe results.
• vite.config.ts is added to the e2e-host scope.
• The plan now says the harness itself rebuilds hasProviderApiKey.

Verification

Node	Step	Result
26.12.1	pnpm run check	0 errors, 21 warnings (limit 21)
26.12.1	vp test run	87 files, 1360 tests passed
26.12.1	vp test run --config vitest.mock.config.ts	3 files, 51 tests passed
26.12.1	pnpm run build	exit 0, ESM 2 files, 340.57 kB
26.12.1	scripts/check.ts	check passed (no ETARGET)
26.12.1	shuffle, seeds 1 / 42 / 1234	87 files, 1360 tests passed each
26.12.1	vp test run --coverage	96.47 / 92.55 / 96.52 / 96.47 against floors of 95.9 / 91.3 / 95.9 / 95.9
24.22.1	shuffle seed 7, mock suite	1360 tests and 51 tests passed
—	local-path and credential scan of the diff and new files	No local paths found. The only sk- hit is the fixture sk-ambient-go-not-a-key. A canary file gave the expected hits, so the scan did read its input.

The first five rows were run again right before the commit. The rest come from the implementation run on the same tree.

Note: the catalog freshness check fails on every branch until the vendor-catalog refresh lands on main. That failure is unrelated to this PR.

---

Generated by Claude Code

[viztor]

catalog freshness is red because src/catalog-data.ts is stale against the live vendor catalog: the vendor added a Go model (kimi-k3.1-pro) after this stack was branched. The failure doesn't come from this PR, which doesn't touch the catalog or its generator. The same check fails on every branch of the stack (#108, #109). No fix is ported here: the shim is generated, never edited by hand, and regenerating it needs models.opencode.ai.

The fix is the nightly scheduled run on main (it ran at about 09:30 UTC the last few days). It regenerates the shim and opens a chore/generated-refresh pull request. Once that is merged into main, I'll merge main up the stack, which turns this check green. A re-run before then would fail the same way, so I haven't spent one.

---

Generated by Claude Code

[viztor]

This phase's first reviews ran on the general reviewer because the dedicated reviewer was unavailable. It has now had the dedicated review.

Rounds (by lens: correctness, rules, matrix)

round	found	upheld	fixed
1	15	11 (correctness 4, rules 3, matrix 4)	11 (two pairs were the same issue from two lenses)
2	5	4 (correctness 2, rules 1, matrix 1)	4 (one pair was the same issue)
3	3	3 (correctness 1, matrix 2)	3

All upheld findings were low severity.

Fixed

• test/e2e/host-binary.e2e.ts: the hook's budget now comes from its own deadlines (two installs plus the boot), each install has its own deadline, and afterAll stops a host that a failed hook left running.
• test/support/host.ts: providerWithApiKey now runs upstream's credentialRef grammar check and throws the same TypeError, and its comment lists the deliberate differences. The pi-ai-first table now carries its own tags.
• .github/workflows/ci.yml: the pinned cell now forces cordis and the loader along with pi, uses both in its cache key and asserts both against HOST_VERSIONS.
• test/host-characterization.test.ts: there is now one test per row and facet in each apply order, titled with that order's tags. The fixture check that the two orders differ is now structural. The single facet that depends on the apply order now has its own [KNOWN_DEFECT] case, which boots no host.
• CONTRIBUTING.md: it now gives the same F-fact accounting as the plan. It also gives the right place for the dummy keys (the temporary home's credentials document) and says what P-R1 must do to the apply-order case in the same diff.
• docs/improvement-plan.md: it has the same F-fact accounting. It now gives the correct reason hasProviderApiKey is restated, its credential-mapping row names all three toPiCredential branches, and its Go Gemini bullet carries the P-R1 note.
• test/host-shapes.test.ts: new F5 pin (a route-level api and baseURL collapse pi's protocols onto one). New plugin-less F4 pin: an id pi cannot place is not listed, and a turn on it returns INVALID_CONFIG without sending a request.
• test/host-credentials.test.ts: covers toPiCredential's env and non-api-key branches. The env branch is checked through pi's Models.getAuth (when that branch was removed, the case failed). The citation is corrected to auth.ts:74-84.
• test/host-editor-contracts.test.ts: there is a case for the credentialRef grammar, and the F4 save case is now tagged with its fact number.
• test/host-waterfall.test.ts: the pi-ai save-check case is now tagged F8/F4.

Declined

No upheld finding was declined. The other findings (4 in round 1, 1 in round 2) did not survive verification, so they were left alone.

Nothing under src/ changed. All gate steps passed: check, unit, mock, build and the bundle gate.

Commit: 409b5e1

---

Generated by Claude Code