feat(cli): COR-447/448/449 fast mode, plugin hash pin, instruction omit

[echobt]

Batch 56 · Designeur FE/Code GO — Code/CLI only (Chat web SPA untouched).

Paper: W-0 · vol2 W-0

Linear: COR-447 · COR-448 · COR-449

Comp AI gates — implemented in code AND covered by tests

#	Gate	Where it is implemented	Where it is proven
1	COR-447 fail-closed org /fast	src/cortex-engine/src/org_policy.rs (FastModePolicy), src/cortex-engine/src/fast_mode.rs (apply_fast_mode → RefusedByOrgPolicy), src/cortex-tui/src/runner/event_loop/commands.rs (apply_fast_mode keeps the session on Standard)	fast_mode::tests::a_disabled_organization_refuses_fast_mode, …::a_refusal_is_independent_of_the_current_state, …::an_unparseable_or_unreadable_policy_fails_closed, views::minimal_session::tests::harness_snapshots::snapshot_org_disabled_fast_mode_copy
2	COR-448 hash mismatch fail-closed	src/cortex-plugins/src/command_pin.rs (verify_command_hash, HASH_MISMATCH), src/cortex-cli/src/plugin_cmd/install.rs (enforce_command_pin_with, checked before anything reaches the plugin root)	command_pin::tests::a_mismatch_fails_closed_with_the_review_copy, …::a_malformed_hash_is_rejected_before_any_work, plugin_cmd::install::tests::an_accepted_hash_installs_and_a_changed_manifest_does_not, …::organization_policy_requires_the_pin
3	COR-449 managed policy never omit	src/cortex-engine/src/instruction_scopes.rs (InstructionPlan::new drops Managed from the skip set; load never opens a skipped file), …/subagent/executor.rs (apply_instruction_plan)	instruction_scopes::tests::managed_policy_is_never_omitted, …::a_skipped_scope_is_never_read, …::managed_policy_loads_even_when_nothing_else_does, subagent::types::tests::subagent_omission_never_drops_managed_policy, handlers::task::tests::test_task_params_omit_instructions

COR-447 — Remote Fast chip + /fast fail-closed

• Remote (cloud / self-hosted) sessions show Remote · Fast mode on on the status line and a Fast chip in the composer model chip (Cortex Mini 1 (medium) · Fast) while fast mode is on. A remote session on the default path shows Remote · Standard; a local session shows neither.
• In-session /fast (and /fast on|off) follows the host setting where organization policy allows it. An unknown token is an error, never a silent toggle.
• When the organization disabled fast mode, the request is refused with exactly:
  • Fast mode is disabled for your organization. Contact your admin.
  • Staying on Standard.
    The session stays on Standard, nothing is re-sent after the refusal, and there is no client bypass flag. Turning fast mode off is always allowed.

COR-448 — --accept-command hash pin

• plugin install and plugin update accept --accept-command <sha256>, pinning exactly the command set a prior --json review displayed. --json prints the review (id, version, every command with aliases/args, hooks, tools) plus its command_hash, without installing.
• On mismatch the install fails closed with exactly:
  Command hash mismatch. Manifest may have changed. Re-run with --json and accept the new hash.
  The package never reaches the plugin root, the previously installed package is left untouched, no trust is renewed, and there is no -y shortcut that accepts a changed manifest.
• Accepted hashes are appended to {cortex_home}/audit/events.jsonl as plugin_command_accepted.
• Organization policy can require the pin for every member (plugin_install: "require_accept_command").

COR-449 — omit user/project instruction documents

• Subagent frontmatter (omit_instructions / omit-instructions) and the Task tool JSON (omit_instructions: [...]) opt in to skipping instruction documents: user, project, local, managed.
• Organization-managed policy is never omitted. A request that names managed is accepted, recorded, and ignored — the managed document still loads.
• A skipped document is never opened, so it cannot reach the prompt by another path.
• An unknown scope name is an error rather than a silent no-op, so a typo cannot omit the wrong documents.
• Omissions are appended to the audit journal as instructions_omitted; a request that named managed policy is recorded as managed_policy_never_omitted.

Policy resolution fails closed

CORTEX_ORG_POLICY_DIR/policy.json drives both keys. A document that exists but cannot be read, cannot be parsed, or carries an unrecognized value denies the restricted behavior. Only an absent document (or absent key) leaves the host default. See docs/configuration/policy.md.

Scope

• Code/CLI only. No Chat web SPA change, no cortex-app-server API change.
• Copy stays Cortex-only: no competitor or provider names in code, UI strings, or this body. Domain is cortex.foundation.
• Reused existing patterns: the paint_status_marker header row (as /share does), the CommandResult::{Toggle,SetValue} command path, the plugin install lock/staging flow, and the subagent system-prompt assembly.

Test plan

• cargo fmt --all -- --check
• ./scripts/clippy.sh (clean under -D warnings)
• cargo test --locked -p cortex-engine -p cortex-plugins -p cortex-agents -p cortex-tui -p cortex-cli --lib — 3915 passed, 0 failed
• cargo test --locked -p cortex-cli --test cli_schema — 4 passed (--accept-command parse coverage)
• TUI snapshot/buffer assertions for every surface touched: snapshot_remote_fast_chip_and_status_line, snapshot_fast_chip_is_absent_off_and_locally, snapshot_org_disabled_fast_mode_copy, fast_command_toggles_and_parses_on_off
• ./scripts/check-cli-version.sh
• cargo test --workspace (CI)
• cargo audit (CI)

Attestation

• Security reviewed — policy resolution and both fail-closed paths reviewed; no secrets, tokens, or keyring dumps in the change. Audit records carry ids, hashes, and scope names only — never prompt text or file bodies.
• Product-facing errors — user-visible refusals use the Cortex product copy quoted above. No raw provider, SDK, or transport names.
• TUI verified — every TUI surface touched is exercised by a headless buffer/snapshot test at 40×12 and 120×40.
• Tests added — unit tests cover each fail-closed decision; TUI changes include buffer assertions. No mocks that report success.
• No secrets — no API keys, WorkOS secrets, R2/AWS credentials, or .env files included.

Risk

Organization policy is a new surface. Both keys default to today's behavior when no policy document exists, so an unconfigured host is unchanged. A malformed document denies rather than allows, which is the intended direction. --accept-command is additive; existing installs without the flag behave as before unless policy requires the pin.

DRAFT only — do not merge.

[echobt]

@greptileai

[echobt]

@greptileai

[greptile-apps]

Greptile Summary

This PR adds organization-governed Fast mode, command-hash-pinned plugin installation and updates, and configurable instruction omission for subagents.

• Organization policy failures now use restrictive defaults.
• Plugin command reviews pin all reviewed command and hook details, and accepted-pin audit failures stop installation.
• Fast mode is passed into subsequent remote code-turn configuration.
• Subagent instruction discovery, frontmatter omissions, and managed-instruction failure handling are wired through execution.
• The rustls release-age exception now lasts through the required age boundary.

Confidence Score: 5/5

Safe to merge.

All previously reported threads are resolved and the current implementation reflects the stated fixes. There are no outstanding blocking issues.

Files Needing Attention: None.

_{Reviews (12): Last reviewed commit: "fix(ci): green the rebase — duplicate te..." | Re-trigger Greptile}

[echobt]

@greptileai

[echobt]

@greptileai

[echobt]

@greptileai review

[echobt]

@greptileai re-review after P1 fixes on ad4226b:

• fail-closed plugin install audit (plugin_command_accepted required)
• /fast wired into CodeTurnContext / turn request (not UI-only)
• COR-449: child discovers user/project/local sources; managed never omitted; frontmatter omit_instructions transferred (Task wins)
• org_policy: dangling symlink / metadata/read/parse → restrictive fallback
• command_pin: length-prefixed fields + hook function/priority/pattern in hash
• rustls release_age exception through 2026-09-21T15:11:18+00:00
• follow-up: rustfmt, tui_code_turn_context test arity, run_subagent CCN restored

[echobt]

@greptileai tip 3ad7fd6 — source-quality line-cap fix (executor split); prior P1s unchanged.

[echobt]

Designer cli — LOCK

PR: #74 · head 3ad7fd67 · draft COR-447/448/449 (fast mode / plugin hash pin / omit instructions)

Chrome QA (pass)

Runtime lock boards present at both 40×12 and 120×40:

• remote-fast · remote-standard · org-disabled-fast
• plugin-accept-command · command-hash-mismatch · omit-instructions

Pixel histogram + visual: ink palette only — #000 / #F5F5F5 / #6B7280 / #1F4945 (+ #1c1c1c/#3a3a3a/#606060 hairlines). Zero violet / cyan / competitor chrome.

Design status

• Linear COR-447 / COR-448 / COR-449 already Already designed (COR-35, not COR-5).
• COR-5 children: still 0 Need designer.

Alexa

Chrome is lockable for this tip — TUI surfaces OK to undraft/squash once Greptile + Protect clear. No HOLD on #74.

(#73 prior HARD HOLD still stands — missing runtime 40×12 for auto-approval / ci-cookbook / cloud-teleport / json-schema / plugin-marketplace / review-only; head bdc05483 unchanged.)

[echobt]

@greptileai tip 87574a3 — pub(super) on instruction_audit helpers (compile fix after line-cap split). P1s unchanged. 0 unresolved threads.

[echobt]

@greptileai tip 62d710182689 — hook JSON review fields + managed read fail-closed; pub(super) already on tip. Please re-score.

[echobt]

Designer cli — LOCK (reaffirm)

PR: #74 · tip 62d71018 · draft COR-447/448/449

Prior LOCK was on 3ad7fd67. Tip moved +2 commits (pub(super) instruction_audit · hook JSON review fields · managed-read fail-closed) — no TUI chrome / lock PNG delta (install.rs, instruction_scopes.rs, executor.rs, instruction_audit.rs only).

Chrome QA (pass @ tip)

Runtime boards still present at both 40×12 and 120×40:

• remote-fast · remote-standard · org-disabled-fast
• plugin-accept-command · command-hash-mismatch · omit-instructions

Pixel histogram: ink only — #000 / #F5F5F5 / #6B7280 / #1F4945 (+ hairline grays). Zero violet / cyan / competitor chrome.

Design status

• COR-447 / COR-448 / COR-449 already Already designed
• COR-5 children: still 0 Need designer

Alexa

Chrome remains lockable at tip 62d71018 — OK to undraft/squash once Greptile + Protect clear. No HOLD on #74.

[echobt]

@greptileai review the latest push (tip 0b067a9). Rebased onto main 6ed7a0a and fixed the CI reds: duplicate #[test] in instruction_scopes.rs, run_subagent complexity 35→11 via subagent/run_helpers.rs, and the three files the new code pushed past 1000 lines split into sibling modules (lock_v2_settings.rs, event_loop/fast_mode.rs). No thresholds relaxed.