pi-map/openspec/changes/archive/2026-06-11-project-map-prompt-injection/tasks.md

Tasks: Project Map Prompt Injection

Status

Field	Value
Phase	Tasks
Based on	Design
Next	Apply

Delivery slices

Slice 1: Injection policy scaffold and config surface

Scope: mode/config scaffolding, pre-init hint behavior, canonical helper boundaries Review goal: establish the policy control surface without yet wiring the full runtime pipeline

Tasks:

1. Add a shared prompt-injection policy helper/module
2. Add config support for injection mode, context-budget percent, and absolute cap using additive flat JSON keys compatible with existing .pi-project-map.json loading
3. Decide and document how existing contextBudget interacts with the new injection-budget knobs
4. Implement pre-init startup-hint behavior with no synthetic artifact injection
5. Define canonical marker/block construction for injected root-pair content
6. Add/update tests for config loading and pre-init hint behavior

Slice 2: Root-pair preload and budgeted expansion

Scope: post-init preload, budget calculation, artifact selection under cap Review goal: make automatic injection materially real after init

Tasks:

1. Implement guaranteed root-pair preload after init
2. Implement effective-budget calculation using percent + absolute cap with smaller-wins semantics
3. Implement active-model context-window discovery and explicit absolute-cap fallback when metadata is unavailable
4. Implement deterministic budgeted expansion beyond the root pair
5. Keep retrieval explicitly out of this injection path
6. Add/update tests for root-pair guarantee, context-window fallback, and budget-capped expansion

Slice 3: Reinjection avoidance and relevant-turn checks

Scope: outgoing-context scanning, relevant-turn triggers, compaction/artifact invalidation Review goal: avoid wasteful reinjection while preserving strong guidance

Tasks:

1. Implement canonical marker scanning over event.messages
2. Add fallback inspection of final provider payload when needed
3. Implement relevant-turn reinjection triggers for strong mode
4. Reinject after compaction and after root-pair artifact changes
5. Add/update integration tests for dedupe, reinjection suppression, and reinjection after invalidation
6. Include synthetic event-sequence coverage for edit-intent, architecture-sensitive reasoning, compaction, and artifact-change heuristics

Slice 4: Mode semantics, visibility, and strict-path behavior

Scope: off/advisory/strong/strict semantics, mixed visibility, strict bypass behavior Review goal: make the mode ladder operational and reviewable

Tasks:

1. Implement mode-specific behavior for off, advisory, strong, and strict
2. Define and enforce the spec meaning of a missing protocol path during sensitive actions
3. Keep startup hints user-visible and artifact injection agent-visible by default
4. Implement strict-mode explicit bypass-justification behavior for sensitive edits/architectural claims
5. Add/update integration tests for visibility, protocol-path detection, and mode differences
6. Verify that strong remains the default behavior

Slice 5: Documentation and runtime alignment

Scope: docs, runtime guidance text, implementation notes Review goal: align user-facing/runtime-facing guidance with the frozen spec

Tasks:

1. Update runtime guidance strings to reflect init-hint behavior, root-pair preload, trust boundary, and mode ladder
2. Update docs/skill guidance for the prompt-injection policy
3. Keep retrieval guidance separate from these docs or clearly reference it as separate
4. Document the opinionated default budget and configurability
5. Summarize integration-test expectations and known risks

Acceptance checklist

• Before init, only a lightweight project_map_init hint is injected
• No synthetic map/index artifact content is injected before init
• After init, root .pi-map.index.md and root .pi-map.md are always guaranteed before budgeted expansion
• Expansion uses a hybrid cap with both relative and absolute knobs, smaller effective budget wins
• Default budget is 15% of active context window, capped at 100k tokens
• Reinjection avoidance is based on canonical marker scanning in actual outgoing context
• strong checks only relevant turns, not every trivial turn
• Modes off, advisory, strong, and strict are implemented with the agreed semantics
• Mixed visibility behavior is preserved
• Retrieval behavior remains separate from this spec’s implementation scope
• Extensive integration tests validate context scanning and reinjection behavior
• npm run typecheck passes
• npm test passes
• npm run lint passes (N/A: repo has no ESLint config; pre-existing repository gap, not a change regression)

Review workload note

This change mixes runtime hook behavior, prompt budgeting, context dedupe, visibility policy, and strict-mode enforcement. Keep delivery narrow and test-heavy. Avoid collapsing this into one oversized implementation slice.