fix(core): constrain CTX packs to task-required sources

ARCHITECTURE.md

@@ -43,7 +43,7 @@ Recommended exit codes: `0` success; `2` validation failure; `3` unavailable/sta
 
 ## CTX context pack
 
-`factory context TASK-ID` first includes the exact tracked task contract and a concise global project constraint section. It invokes `ctx status --root <root> --json` and `ctx doctor --offline --root <root> --json` as appropriate, then `ctx pack <query> --root <root> --token-budget <limit> --json`. The query is derived from title, outcome, acceptance, and topic strings; it is never a command. Canonical required documents are read from their original files, checked against root containment, and admitted before optional CTX excerpts. The adapter records CTX generation, file and line provenance, and available hashes; it does not treat an excerpt as a permission to ignore original wording. On stale or insufficient retrieval, it returns `CONTEXT_BLOCKED` with an actionable diagnostic. It does not fill the pack with guessed material.
+`factory context TASK-ID` first includes the exact tracked task contract and a concise global project constraint section. It invokes `ctx status --root <root> --json` and `ctx doctor --offline --root <root> --json` as appropriate, then `ctx pack <query> --root <root> --token-budget <limit> --document <task-source>... --json`. The query is derived from title, outcome, acceptance, and topic strings; it is never a command. Repeated `--document` filters come from the task's declared `context.required` selection, so CTX ranks within task-local authority instead of adding unrelated corpus excerpts. Canonical required documents are read from their original files, checked against root containment, and admitted before CTX excerpts; declaring a source required never substitutes an excerpt for the exact original. The adapter records CTX generation, file and line provenance, and available hashes. On stale, missing, or insufficient retrieval, it returns `CONTEXT_BLOCKED` with an actionable diagnostic. It does not fill the pack with guessed material or hide post-retrieval excerpts to improve a relevance score.
 
 Default total task-context budgets (including contract and mandatory material) are 4,000 tokens for bounded, 8,000 for normal, and 15,000 for critical; these are design defaults to measure, not promises that CTX necessarily returns that many tokens. Reserve space for task contract and required sources before calling CTX with the remainder. The adapter enforces a byte ceiling as well as CTX's token budget, deduplicates overlapping excerpts, and never truncates an authoritative requirement mid-sentence. The pack is written atomically to `.factory/state/context/TASK-ID.md` with a sidecar receipt containing contract digest, source digests, CTX generation, timestamp, and retrieval mode. A worker verifies these before trusting the pack; if changed, regenerate it.
 
@@ -65,15 +65,15 @@ The tracked `.factory/completion.yaml` is authored before task implementation. I
 
 ## Failures and trust boundaries
 
-| Failure | Required response |
-| --- | --- |
-| CTX unavailable or index stale | Do not make up context; exact required files still available for manual work; context command exits blocked. |
-| Firstmate home absent or not registered | Publication blocked; preview shows required setup. |
-| tasks-axi CLI/version/backend incompatible | Publication blocked; no direct backlog file edit fallback. |
-| Contract changed during sync | Abort before writes where possible; report partial state if a write already occurred. |
-| Duplicate ID/body edited by another actor | Conflict, never clobber. |
-| Source path outside repo or symlink escape | Reject before reading or publishing. |
-| Project checks pass on obsolete commit | Mark stale; rerun against release candidate. |
-| Worker reports pass without evidence | Show unverified, not complete. |
+| Failure                                    | Required response                                                                                            |
+| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------ |
+| CTX unavailable or index stale             | Do not make up context; exact required files still available for manual work; context command exits blocked. |
+| Firstmate home absent or not registered    | Publication blocked; preview shows required setup.                                                           |
+| tasks-axi CLI/version/backend incompatible | Publication blocked; no direct backlog file edit fallback.                                                   |
+| Contract changed during sync               | Abort before writes where possible; report partial state if a write already occurred.                        |
+| Duplicate ID/body edited by another actor  | Conflict, never clobber.                                                                                     |
+| Source path outside repo or symlink escape | Reject before reading or publishing.                                                                         |
+| Project checks pass on obsolete commit     | Mark stale; rerun against release candidate.                                                                 |
+| Worker reports pass without evidence       | Show unverified, not complete.                                                                               |
 
 External repository files, CTX excerpts, and task bodies are untrusted as shell commands. The CLI never executes test commands solely because a contract specifies one; allowed project checks are defined by a reviewed, tracked verification configuration and executed only by an explicit operator/worker command. Do not store secrets or raw agent transcripts in a context pack or receipt.

BUILD_PLAN.md

@@ -87,9 +87,9 @@
 
 **Deliverable:** Pi's workflow classifies bounded/normal/critical risk, obtains precise review findings, and collects evidence appropriate to the task without rerunning no-mistakes' pipeline inside Factory.
 
-- [ ] Create tests/fixtures for critical auth isolation and normal API behavior, plus one simulated reviewer finding that causes repair and retest.
-- [ ] Run an actual worker task with only task/pack/evidence sources in a fresh context; inspect whether it needs missing docs.
-- [ ] **Gate:** P-06, P-07, and no change to Firstmate routing or shipping config by Factory.
+- [x] Create tests/fixtures for critical auth isolation and normal API behavior, plus one simulated reviewer finding that causes repair and retest.
+- [x] Run an actual worker task with only task/pack/evidence sources in a fresh context; inspect whether it needs missing docs.
+- [x] **Gate:** P-06 and P-07 via the tracked ten-pack/P-07 replay in `docs/probes/CP-06.md`; no change to Firstmate routing or shipping config by Factory.
 
 ## CP-07 — Thin Pi command and status convenience
 

docs/CONTRACTS.md

@@ -80,7 +80,7 @@ evidence:
 delivery: project-default
 ```
 
-`depends_on` names local task IDs, is acyclic, and cannot name self. `advances` names completion IDs and may be empty only for a task explicitly marked `kind: enabling`; enabling tasks still have testable outcomes. `complexity` is `bounded | normal | critical`; `risk` is `bounded | normal | critical` and controls review policy, not a specific model name. `delivery` defaults to `project-default` and cannot override the actual Firstmate project mode; if the project mode conflicts with a task request, validation blocks publication. All required evidence categories are verified by evidence receipts rather than assumed from task closure.
+`depends_on` names local task IDs, is acyclic, and cannot name self. `advances` names completion IDs and may be empty only for a task explicitly marked `kind: enabling`; enabling tasks still have testable outcomes. `complexity` is `bounded | normal | critical`; `risk` is `bounded | normal | critical` and controls review policy, not a specific model name. `context.required` is the reviewed task-local authority selection: Factory reads every listed original exactly and passes the same paths as CTX document filters. Include each known source that can decide an acceptance or risk condition; do not add broad directories or unrelated documents as insurance. A worker that discovers an omitted decisive source names it, performs one targeted original read, and proposes that exact path for the contract before regeneration. `delivery` defaults to `project-default` and cannot override the actual Firstmate project mode; if the project mode conflicts with a task request, validation blocks publication. All required evidence categories are verified by evidence receipts rather than assumed from task closure.
 
 ## Task receipt: `.factory/state/evidence/SAVE-001.json`
 
@@ -100,7 +100,7 @@ delivery: project-default
       "artifact_sha256": "<64 hexadecimal characters>"
     }
   ],
-  "review": {"status": "pending", "artifact": null},
+  "review": { "status": "pending", "artifact": null },
   "recorded_at": "2026-09-26T00:00:00Z"
 }
 ```

docs/INTEGRATIONS.md

@@ -8,7 +8,7 @@ The user's archived CTX README describes a Python 3.12+ local CLI, source-proven
 
 CP-00 probes: detect `ctx`; create a disposable Git fixture with two normative Markdown docs; initialize and add docs according to local `ctx --help`; index with `--no-embeddings` so the test does not download anything; run status, offline doctor, pack, and exact lines; record actual JSON fields and failure codes. Confirm stale-source detection by changing a source after indexing. A user's globally installed model may then be tested separately. Do not index the Factory repo until its initial documents are approved.
 
-Context policy: required files are read exactly; CTX provides relevant additional passages with source provenance; changed docs invalidate a pack; unavailable local embedding may allow the explicitly reported lexical mode if it retrieves sufficient authority. Query text is data, never shell code. `ctx pack` is one context source, not a substitute for Git, `rg`, or project checks.
+Context policy: required files are read exactly. The installed `ctx pack` accepts repeated `--document` filters; Factory supplies the task's reviewed `context.required` paths so retrieval ranks only within task-local authority while exact originals remain in the pack. Changed docs invalidate a pack; unavailable local embedding may allow the explicitly reported lexical mode if it retrieves sufficient authority. Query text is data, never shell code. `ctx pack` is one context source, not a substitute for Git, `rg`, or project checks, and Factory does not post-filter CTX output to falsify provenance.
 
 ## Pi
 
@@ -30,14 +30,14 @@ no-mistakes documents a review → test → document → lint → push → PR 
 
 ## Probe matrix
 
-| Probe | Failure response |
-| --- | --- |
-| CTX actual version/JSON/CLI flags | Block context pack and show install-specific diagnostic. |
-| Pi installed import namespace and skill discovery | Keep CLI usable; defer extension/skill packaging. |
-| Firstmate home identity and registered project | Block sync. |
-| tasks-axi version, backend, dependency commands | Block sync; provide dry-run export for manual inspection only. |
-| no-mistakes gate in intended project mode | Block automated shipping claims; continue local deterministic checks. |
-| Windows/macOS path behavior | Report platform limitation honestly; do not claim cross-platform gate. |
+| Probe                                             | Failure response                                                       |
+| ------------------------------------------------- | ---------------------------------------------------------------------- |
+| CTX actual version/JSON/CLI flags                 | Block context pack and show install-specific diagnostic.               |
+| Pi installed import namespace and skill discovery | Keep CLI usable; defer extension/skill packaging.                      |
+| Firstmate home identity and registered project    | Block sync.                                                            |
+| tasks-axi version, backend, dependency commands   | Block sync; provide dry-run export for manual inspection only.         |
+| no-mistakes gate in intended project mode         | Block automated shipping claims; continue local deterministic checks.  |
+| Windows/macOS path behavior                       | Report platform limitation honestly; do not claim cross-platform gate. |
 
 ## Primary documents