FE-876: Integration oracle — reachability gate + grounding seam

[kostandinang]

Stack Context

Stacks on FE-875 (#219). Sixth Arc-1 frontier (the dispatch-seam one) -- promotes FE-800's integration-blind follow-on to a frontier: a feature that exists but isn't wired into the running app (the orphan) should fail the verdict, not pass on green unit tests. Half A + the Half B seam land here.

What?

Assert product reachability at epic verification, building on app-runtime-probe (FE-875).

• Half A -- the gate (verify-epic, pi-actions.ts): Epic.probe?: ProbeTarget folds a runProbe result into the epic verdict -- done only when tests pass and the feature is reachable. not-reachable = the orphan; infra = harness fault. Gated behind tests passing (never boot a broken build); reachability rides the existing report.passed routing (no new Petri wiring); absent probe -> unchanged unit verdict.
• Half B -- the grounding seam (ProbeGrounder, types.ts + createPiActions): host-blind Epic.reachability? intent (architect-emittable, D160-K) + an injectable grounder that cook-time-resolves intent -> concrete ProbeTarget. verify-epic resolves probe ?? ground(reachability); a grounder that throws is an infra fault (visible, not a silent pass); intent without a grounder is inert.

Why?

The dogfood-spike (2026-06-16) showed the agent wired the feature reachable by discretion, not enforcement. This makes reachability an enforced, harness-owned, unshortcuttable gate. The split mirrors app-runtime-probe: the harness owns the check (Half A, off-seam, buildable now); the agent owns grounding the target (Half B). Half B lands the contract only -- the production grounder is an execute-mode agent reading the worktree, the coordination point with the unpublished pi-harness thread.

Tests

Real node:http apps booted in tmp epic sandboxes (no mocks), pi session stubbed -- reachable -> pass, 404 -> orphan-fail, failing-tests -> probe-never-boots, no-probe -> unchanged; Half B: intent -> grounded -> reachable, no-grounder -> no-op, grounder-throws -> infra, concrete-probe precedence.

Deferred (dispatch seam)

The production ProbeGrounder agent + architect emission of reachability intent -- land atomically with the pi-harness contract, so intent is enforced the moment it's emitted (and doesn't perturb the 3 reference fixtures first).

Co-authored-by: Amp amp@ampcode.com

[kostandinang]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• FE-878: Brunch serve — one-shot plan-then-cook capstone #222
• FE-877: Brownfield promotion — commit the cook result onto cook/<runId> #221
• FE-876: Integration oracle — reachability gate + grounding seam #220 👈 (View in Graphite)
• FE-875: App runtime probe — boot, probe, classify #219
• FE-872: Install-failure classification — infra-vs-test split #218
• FE-871: Brunch toolchain detection — detect + plan-emitter wiring #214
• FE-867: Agent extension host — dual-mode pi-harness contract #213
• FE-864: Brownfield feature delivery from spec — detect, classify, probe, oracle, promote, serve #212 : 2 other dependent PRs (#223 , #224 )
• FE-841: Pi agent foundations — in-process SDK, toolchain profiles #194 : 2 other dependent PRs (#198 , #211 )
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Medium Risk
Changes the epic pass/fail gate whenever probe or grounding is used, and boots real processes during verification—behavior is unchanged without probe config, but misconfigured probes could fail otherwise-good epics.

Overview
FE-876 extends verify-epic so an epic passes only when integration tests pass and (when configured) the merged worktree is reachable in a booted app—not just green unit tests.

Half A — concrete probe: Epic.probe?: ProbeTarget triggers buildProbeSpec + runProbe after tests succeed; not-reachable fails the epic (orphan wiring); infra marks harness/grounding faults. Failed tests skip the probe entirely. With no probe target, behavior is unchanged.

Half B — grounding seam: Optional Epic.reachability?: ReachabilityIntent plus injectable ProbeGrounder on createPiActions({ groundProbe }) resolves intent → ProbeTarget at cook time (probe wins if both are set). Intent without a grounder is inert; a throwing grounder surfaces as infra, not a silent pass. epic-verified reports now include reachability when a probe ran.

Tests boot real node:http sandboxes with a stubbed pi session. memory/PLAN.md marks integration-oracle Half A + B seam landed; production grounder + architect emission stay deferred with the pi-harness contract.

^{Reviewed by Cursor Bugbot for commit ce73674. Bugbot is set up for automated code reviews on this repo. Configure here.}