docs: acceptance checklist against PIEXTENSIO-3 contract

- record baseline, module map, category status, and pinned canonical revisions
- list owned residual gaps: upstream enrollment and human-decision seams, lifecycle ordering enumerations, negative v24 fixture

docs/adr/piextensio-12-acceptance.md

@@ -0,0 +1,94 @@
+# PIEXTENSIO-12 v0.1 acceptance checklist
+
+Status of the Shadow-first AI Bash Authorization Judge v0.1 against the
+PIEXTENSIO-3 implementation acceptance contract (canonical resolution
+984df7a2), recorded after slice 5. This file tracks what is satisfied,
+what is intentionally out of scope, and the residual gaps with their
+owning decision.
+
+## Repaired baseline (I1–I4)
+
+- I1 `@types/node` present; `pnpm -r check` exits 0 in every package. **PASS**
+- I2 test matrix discovered and executed: 9 files / 85 tests (ai-judge),
+  3 files / 48 tests (inner-cmd); zero failed/skipped/todo/only. **PASS**
+- I3 gate runner: clean env (`env -i`, no credentials, fakes only) —
+  `pnpm -r check` + `pnpm -r test` green from the working lockfile. **PASS**
+- I4 version identity: workspace and global runtime both resolve
+  `@gotgenes/pi-permission-system` 25.4.0. **PASS**
+
+## Module map (PIEXTENSIO-5 seven root modules)
+
+| Module | File | Deterministic tests | Status |
+|---|---|---|---|
+| index | `src/index.ts` | `test/lifecycle.test.ts` | present |
+| config | `src/config.ts` | `test/config.test.ts` | present |
+| evidence | `src/evidence.ts`, `src/conversation.ts` | `test/evidence.test.ts`, `test/conversation.test.ts` | present |
+| prompt | `src/prompt.ts` | `test/prompt.test.ts` | present |
+| model | `src/model.ts` | `test/model.test.ts` | present |
+| review | `src/review.ts` | `test/review.test.ts` | present |
+| judge | `src/judge.ts` | `test/judge.test.ts` | present |
+| analyzer (separate governance consumer) | `src/analyzer/` | `test/analyzer/analyze.test.ts` | present |
+
+No eighth live module was invented.
+
+## Category-by-category
+
+1. **Pure builders** — evidence whitelist/exclusions, 16-item/12,000-char
+   caps, latest-user preservation, head truncation, compaction flagging;
+   versioned prompt snapshot with authority rules and quoted untrusted
+   rendering; review key set at the sink with the privacy denylist. **PASS**
+2. **Mocked model** — one completion, zero retries, no prose fallback,
+   stable codes across capability shapes; 256/257 output boundary; usage
+   legitimacy (missing/implausible → model_error). **PASS**
+3. **Lifecycle** — one root registration; headless child never registers;
+   session-id mismatch defers; per-request model capture (between-request
+   switch changes the next call); shutdown aborts in-flight work. **PASS**
+   (partial: ready/start ordering permutations and fake-timer teardown
+   assertions are not yet enumerated — see Residual gaps.)
+4. **Failure path / truth table** — every gate independently forces defer
+   with a distinct reason; v0.1 production state never grants authority
+   for any mode × telemetry combination. **PASS**
+5. **Review trail** — metadata-only events keyed by requestId; result
+   written before return; leak sentinel asserts neither command text nor
+   conversation text reaches review rows. **PASS** (reconstructed join —
+   ADR 0005; enrollment and human-decided events are upstream gaps.)
+6. **Permission-system integration** — registerAuthorizer seam consumed
+   end-to-end (live smoke: rounds 1–3, forwarded preflight rows).
+   **PARTIAL**: the negative v24 Enforce fixture and the two-track
+   floor tests are not mechanized; live E2E evidence substitutes.
+7. **Manual Shadow** — human-governed; three fixed-window replay rounds
+   archived under `docs/research/rounds/` with the comparison matrix,
+   false-allow denominator, and blind-deny protocol. **PASS as diagnostic**
+   (promotion floor deliberately unreachable — no 100-row cohort, by
+   design, until upstream seams close).
+
+## Pinned safety contracts (M6)
+
+| Contract | Canonical revision |
+|---|---|
+| PIEXTENSIO-4 prompt boundary | 3cc3af7f-ad8d-4764-be52-ebff04982a50 |
+| PIEXTENSIO-5 module map | 6931027b-d191-4357-8c26-3c3bbe29cd8a |
+| PIEXTENSIO-9 review trail | de571cfe-6ff2-412a-b7f5-157250014d49 |
+| PIEXTENSIO-10 promotion | 0eb13dc2-bfed-42bb-82c1-e642cbf55c52 |
+| PIEXTENSIO-11 budgets | c0b0028d-8321-4d8b-895e-8fecd9c36a8e |
+
+The timeout defaults/range and reason bound in code match PIEXTENSIO-11's
+normative values (15,000 ms default, 5,000–30,000 ms accepted, 240 code
+points, 256 output tokens).
+
+## Residual gaps (owned, not silently dropped)
+
+- Upstream seams (PIEXTENSIO-9): `authorizer_link.invoked` enrollment and
+  `permission_request.human_decided` do not exist in permission-system
+  25.4; the analyzer reconstructs both (ADR 0005) and the truth table
+  treats `reviewAcknowledged` as structurally false. Promotion remains
+  mechanically impossible — the designed v0.1 posture.
+- Lifecycle ordering permutations and fake-timer teardown assertions
+  (PIEXTENSIO-3 cat.3 enumerations) are thinner than the contract's full
+  list; current coverage exercises the load-bearing paths (registration,
+  mismatch, model switch, shutdown abort).
+- The negative v24 fixture (cat.6) is satisfied by construction — the
+  truth table cannot grant authority against any host surface — but not
+  by a dedicated CI fixture against a real v24 package.
+- Live cohort identity changed with slice 4 (prompt v2 + conversation
+  evidence); rounds 1–3 are diagnostic data for the v1 candidate only.