feat(ai): AI-task reliability, robustness & security hardening (27 fixes)

[ocervell]

AI-task reliability / robustness / security hardening — the full remediation of the
2026-06-30 deep review (docs/superpowers/specs/2026-06-30-ai-task-reliability-review.md).

27 / 29 findings fixed, one focused PR per finding, merged here across 7 rounds.
H8 excluded (overlaps feat/sensitive-options); H3 deferred to a design decision (event-driven
human-wait — see the review doc's H3 proposal).

🔴 Critical

• C1 fix(ai): sanitize LLM-supplied subagent opts to prevent guardrail bypass (C1) #1239 — sanitize LLM-supplied subagent opts (deny control keys + force dangerous=False)
• C2 fix(ai): make shell guardrail wrapper-aware and fix destructive-command deny (C2, H6) #1238 — wrapper-aware shell guardrail (stop exec-wrapper command laundering)
• C3 fix(ai): idempotency marker stops Celery redelivery replay (C3) #1254 — celery_id idempotency marker; redelivery no longer replays/re-bills a turn

🟠 High

• H1 fix(ai): bound retries on persistent rate-limit to prevent infinite loop (H1) #1235 — bound retries on persistent 429 (no infinite loop)
• H2 fix(ai): make history trim/compact tool-pair-aware to avoid orphan tool messages (H2) #1244 — tool-pair-aware trim/compact (no orphan-tool 400s)
• H4 fix(ai): cap subagent recursion depth & per-turn fan-out (H4) #1248 — cap subagent recursion depth + per-turn fan-out
• H5 fix(ai): cover plain-chat & max-iter remote turns with pending docs (H5) #1249 — persist pending docs for plain-chat & max-iter remote turns
• H6 fix(ai): make shell guardrail wrapper-aware and fix destructive-command deny (C2, H6) #1238 — fix rm -rf /*-class destructive-command deny
• H7 fix(ai): correlate permission prompts by prompt_uuid to stop stale auto-approval (H7) #1237 — correlate permission prompts by prompt_uuid (no stale auto-approve)
• H9 fix(ai): make "allow this command" a true one-shot, not a session rule (H9) #1243 — "allow this command" is a true one-shot, not a session rule
• H10 fix(ai): fail closed when guardrail prompts are exhausted (H10) #1242 — fail closed when guardrail ask-prompts are exhausted

🟡 Medium

• M1 fix(ai): cap unbounded shell output into history (M1) #1256 — cap unbounded shell output into history
• M2 fix(ai): surface/prevent persistence-less subagent spawns (M2) #1252 — don't silently spawn persistence-less subagents on empty drivers
• M3 fix(ai): model-window-aware history trim budget (M3) #1255 — model-window-aware history trim budget
• M4 fix(ai): 400s fail fast except orphan-tool repair (M4) #1251 — 400s fail fast (keep orphan-tool repair)
• M5 fix(ai): token-count fallback when LLM usage missing (M5) #1247 — token-count fallback when LLM usage is absent
• M6 fix(ai): default-safe target/path guardrail dimensions (M6) #1246 — default-safe target/path guardrail dimensions (no fail-open on missing catch-all)
• M7 fix(ai): gate privileged add_finding types at the guardrail (M7) #1260 — gate privileged add_finding types (block injected trusted-target minting)
• M8 fix(ai): normalize encoded IPs before SSRF/metadata deny (M8) #1253 — normalize encoded IPs before SSRF/metadata deny
• M9 fix(ai): treat output-flag destinations as writes (M9) #1257 — treat curl -o/wget -O output paths as writes
• M10 fix(ai): close the answer/timeout race and stop stale pending docs accumulating (M10) #1245 — channel hygiene: answer/timeout race + stale-pending GC
• M11 fix(ai): extensible exec-wrapper peeling closes the C2 laundering class (M11) #1264 — extensible exec-wrapper peeling (closes the C2 laundering class)
• M12 fix(ai): give allow_all real session-wide scope vs one-shot allow (M12) #1258 — allow_all grants real session-wide scope vs a one-shot allow

🔵 Pertinence / cleanup

• D1 fix(ai): fix unsubstituted template vars + phantom tool in prompts (D1) #1259 — substitute prompt template vars; drop phantom run_query example
• D2 fix(ai): stop discarding exploit mode; wire + document it (D2) #1263 — stop discarding exploit mode; wire + document it
• D3 chore(ai): remove vestigial code (D3) #1262 — remove vestigial code (ACTION_TOOL_MAP, orphan _maybe_encrypt, dead render branch)
• D4 refactor(ai): cheap fast-path for mode detection, LLM only when ambiguous (D4) #1261 — cheap fast-path for mode detection (LLM only when ambiguous)

---

Every PR added focused tests and proved no regression against a git-stash baseline (guardrail
tests needing shfmt/safecmd fail identically on base — CI is the arbiter). ~20 follow-up
items the agents surfaced are ranked in the review doc's "round-2 candidates" backlog — the
standout being the permission_engine-unset full bypass (candidate Critical).