bug(verifier): isolated scratch contract prevents required verification probes #3254

Before submitting

• I searched open and closed issues and did not find a report of this problem.
• I reviewed this report and removed credentials, tokens, private paths, hostnames, and other sensitive data.

Problem

A high-risk change requires an independent gentle-ai-verify run. The verifier cannot emit evidence because its isolation contract requires a scratch copy while its execution constraints reject the writes needed to prepare and run the required probes. The attempt stops before tests or probes run.

Steps to reproduce

1. Use gentle-pi 4.7.0 with Pi 1.5.2 on macOS.
2. Complete a high-risk repository change whose assessment requires an independent verifier.
3. Delegate gentle-ai-verify with focused tests, build, and disposable database probes in an isolated scratch copy.
4. Observe that the verifier refuses execution because the required scratch workflow and permitted write surfaces are incompatible.

Expected and actual behavior

Expected: the verifier creates an isolated temporary copy, performs required temporary writes only there, runs the authorized checks, and returns evidence.

Actual: setup stops with zero tests and zero probes. Writer checks and native review cannot satisfy the separate independent-verification gate, so delivery remains blocked.

gentle-pi version

4.7.0

Pi version

1.5.2

Operating system

macOS

Relevant logs or error output (optional)

Verifier unavailable: governing isolation instructions require scratch copies while prohibiting the required probe writes outside scratch. Zero tests/probes ran.