test(lease): assert pi carve-out capability

packages/mosaic/src/lease-broker/invariant_r_unittest.py

@@ -54,6 +54,15 @@ PI_PROVEN_READ_ONLY_TOOLS: Final = frozenset({"read", "grep", "find", "ls"})
 PI_MUTATING_TOOLS: Final = frozenset({"bash", "edit", "write"})
 PI_MEASURED_BUILTINS: Final = PI_PROVEN_READ_ONLY_TOOLS | PI_MUTATING_TOOLS
 
+# Pi 0.84.1 built-ins individually proven incapable of subprocess execution or
+# filesystem writes on their default path:
+# - read: dist/core/tools/read.js:26-29 dispatches only read/access operations.
+# - ls: dist/core/tools/ls.js:19-22 dispatches only exists/stat/readdir operations.
+# grep and find are deliberately absent: grep.js:99/148 and find.js:161/203
+# reach ensureTool(..., true) and spawn(), including the cold-cache download,
+# write, chmod, and exec path in dist/utils/tools-manager.js:285-313.
+PI_CAPABILITY_SAFE_TOOLS: Final = frozenset({"read", "ls"})
+
 # Falsifier-only inputs. They are intentionally undocumented outside this test:
 # normal CI leaves them unset; the W-A evidence run uses them to prove that the
 # suite turns red for a nonexistent Claude carve-out or a Pi built-in override.
@@ -189,6 +198,18 @@ class InvariantRTest(unittest.TestCase):
             "every unpinned Claude carve-out must exist and be in the exact proven read-only allow-list",
         )
 
+    def test_pi_carve_out_has_no_exec_or_write_capability(self) -> None:
+        carve_out = set(READ_ONLY_TOOLS["pi"])
+
+        capability_unsafe = carve_out - set(PI_CAPABILITY_SAFE_TOOLS)
+        self.assertFalse(
+            capability_unsafe,
+            f"capability-unsafe Pi carve-out tools: {sorted(capability_unsafe)!r}; "
+            "Pi 0.84.1 grep.js:99/148 and find.js:161/203 reach "
+            "ensureTool(..., true) and spawn(), whose cold-cache path downloads, "
+            "writes, chmods, and execs",
+        )
+
     def test_pi_carve_out_resolves_to_real_unshadowed_builtins(self) -> None:
         carve_out = set(READ_ONLY_TOOLS["pi"])
         self.assertEqual(