aidp 0.32.0 → 0.34.0

data/lib/aidp/execute/work_loop_runner.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "prompt_manager"
+require_relative "prompt_evaluator"
 require_relative "checkpoint"
 require_relative "checkpoint_display"
 require_relative "guard_policy"
@@ -10,6 +11,8 @@ require_relative "agent_signal_parser"
 require_relative "steps"
 require_relative "../harness/test_runner"
 require_relative "../errors"
+require_relative "../style_guide/selector"
+require_relative "../security"
 
 module Aidp
   module Execute
@@ -38,7 +41,10 @@ module Aidp
       }.freeze
       include Aidp::MessageDisplay
 
-      attr_reader :iteration_count, :project_dir, :current_state
+      # Expose state for testability
+      attr_accessor :iteration_count, :step_name, :options, :persistent_tasklist
+      attr_reader :project_dir, :current_state, :state_history, :test_runner, :prompt_manager, :checkpoint
+      attr_writer :guard_policy, :prompt_manager, :style_guide_selector
 
       MAX_ITERATIONS = 50 # Safety limit
       CHECKPOINT_INTERVAL = 5 # Record checkpoint every N iterations
@@ -54,6 +60,7 @@ module Aidp
         @checkpoint = Checkpoint.new(project_dir)
         @checkpoint_display = CheckpointDisplay.new(prompt: @prompt)
         @guard_policy = GuardPolicy.new(project_dir, config.guards_config)
+        @work_context = {}
         @persistent_tasklist = PersistentTasklist.new(project_dir)
         @iteration_count = 0
         @step_name = nil
@@ -65,9 +72,18 @@ module Aidp
 
         # Initialize thinking depth manager for intelligent model selection
         require_relative "../harness/thinking_depth_manager"
-        @thinking_depth_manager = options[:thinking_depth_manager] || Aidp::Harness::ThinkingDepthManager.new(config)
+        @thinking_depth_manager = options[:thinking_depth_manager] || Aidp::Harness::ThinkingDepthManager.new(config, root_dir: @project_dir)
         @consecutive_failures = 0
         @last_tier = nil
+
+        # Initialize style guide selector for intelligent section selection
+        @style_guide_selector = options[:style_guide_selector] || Aidp::StyleGuide::Selector.new(project_dir: project_dir)
+
+        # FIX for issue #391: Initialize prompt evaluator for iteration threshold assessment
+        @prompt_evaluator = options[:prompt_evaluator] || PromptEvaluator.new(config)
+
+        # Initialize security adapter for Rule of Two enforcement
+        @security_adapter = options[:security_adapter] || Aidp::Security::WorkLoopAdapter.new(project_dir: project_dir)
       end
 
       # Execute a step using fix-forward work loop pattern
@@ -75,6 +91,7 @@ module Aidp
       # Never rolls back - only moves forward through fixes
       def execute_step(step_name, step_spec, context = {})
         @step_name = step_name
+        @work_context = context
         @iteration_count = 0
         transition_to(:ready)
 
@@ -137,6 +154,11 @@ module Aidp
         @current_state = :ready
         @state_history.clear
 
+        # Begin security tracking for this agentic work unit
+        work_unit_id = "agentic_#{@step_name}_#{SecureRandom.hex(4)}"
+        @security_adapter.begin_work_unit(work_unit_id: work_unit_id, context: context)
+        display_security_status
+
         create_initial_prompt(step_spec, context)
 
         loop do
@@ -148,6 +170,10 @@ module Aidp
             display_message("⚠️  Max iterations (#{MAX_ITERATIONS}) reached for #{@step_name}", type: :warning)
             display_state_summary
             archive_and_cleanup
+
+            # End security tracking for this work unit
+            @security_adapter.end_work_unit
+
             return build_agentic_payload(
               agent_result: nil,
               response: build_max_iterations_result,
@@ -161,13 +187,57 @@ module Aidp
 
           transition_to(:apply_patch)
 
+          # Preview provider/model selection and queued checks for this iteration
+          preview_provider, preview_model, _model_data = select_model_for_current_tier
+          prompt_length = @prompt_manager.read&.length || 0
+          checks_summary = planned_checks_summary
+          display_iteration_overview(preview_provider, preview_model, prompt_length, checks_summary)
+          log_iteration_status("running",
+            provider: preview_provider,
+            model: preview_model,
+            prompt_length: prompt_length,
+            checks: checks_summary)
+
+          # Check security policy before agent call (Rule of Two enforcement)
+          # Agent calls enable egress capability
+          begin
+            @security_adapter.check_agent_call_allowed!(operation: :agent_execution)
+          rescue Aidp::Security::PolicyViolation => e
+            # Security policy violation - cannot proceed with agent call
+            Aidp.logger.error("work_loop", "Security policy violation",
+              step: @step_name,
+              iteration: @iteration_count,
+              error: e.message)
+            display_message("  🛡️  Security policy violation: #{e.message}", type: :error)
+            display_message("  Cannot proceed - Rule of Two would be violated", type: :error)
+
+            # End security tracking and return error
+            @security_adapter.end_work_unit
+            return build_agentic_payload(
+              agent_result: nil,
+              response: {status: "error", message: "Security policy violation: #{e.message}"},
+              summary: nil,
+              completed: false,
+              terminate: true
+            )
+          end
+
           # Wrap agent call in exception handling for true fix-forward
           begin
-            agent_result = apply_patch
+            agent_result = apply_patch(preview_provider, preview_model)
           rescue Aidp::Errors::ConfigurationError
             # Configuration errors should crash immediately (crash-early principle)
             # Re-raise without catching
             raise
+          rescue Aidp::Security::PolicyViolation => e
+            # Security violations should not continue - they are policy failures
+            Aidp.logger.error("work_loop", "Security policy violation during agent call",
+              step: @step_name,
+              iteration: @iteration_count,
+              error: e.message)
+            display_message("  🛡️  Security violation: #{e.message}", type: :error)
+            @security_adapter.end_work_unit
+            raise
           rescue => e
             # Convert exception to error result for fix-forward handling
             Aidp.logger.error("work_loop", "Exception during agent call",
@@ -246,20 +316,48 @@ module Aidp
 
           # Check task completion status
           task_completion_result = check_task_completion
+          agent_completed = agent_marked_complete?(agent_result)
+
+          # FIX for issue #391: Comprehensive logging at completion decision point
+          Aidp.log_debug("work_loop", "completion_decision_point",
+            iteration: @iteration_count,
+            all_checks_pass: all_checks_pass,
+            agent_marked_complete: agent_completed,
+            task_completion_complete: task_completion_result[:complete],
+            task_completion_reason: task_completion_result[:reason],
+            test_success: test_results[:success],
+            lint_success: lint_results[:success],
+            formatter_success: formatter_results[:success],
+            build_success: build_results[:success],
+            doc_success: doc_results[:success])
 
           if all_checks_pass
             transition_to(:pass)
 
-            if agent_marked_complete?(agent_result)
+            if agent_completed
               # Check if tasks are complete
               if task_completion_result[:complete]
+                Aidp.log_debug("work_loop", "completion_approved",
+                  iteration: @iteration_count,
+                  reason: task_completion_result[:reason])
+
                 transition_to(:done)
                 record_final_checkpoint(all_results)
                 display_task_summary
                 display_message("✅ Step #{@step_name} completed after #{@iteration_count} iterations", type: :success)
                 display_state_summary
+                log_iteration_status("completed",
+                  provider: preview_provider,
+                  model: preview_model,
+                  prompt_length: prompt_length,
+                  checks: checks_summary,
+                  task_status: "complete",
+                  completion_reason: task_completion_result[:reason])
                 archive_and_cleanup
 
+                # End security tracking for this work unit
+                @security_adapter.end_work_unit
+
                 return build_agentic_payload(
                   agent_result: agent_result,
                   response: build_success_result(agent_result),
@@ -269,16 +367,36 @@ module Aidp
                 )
               else
                 # All checks passed but tasks not complete
+                Aidp.log_debug("work_loop", "completion_blocked_tasks_incomplete",
+                  iteration: @iteration_count,
+                  reason: task_completion_result[:reason],
+                  message: task_completion_result[:message])
+
                 display_message("  All checks passed but tasks not complete", type: :warning)
                 display_message("  #{task_completion_result[:message]}", type: :warning)
                 display_task_summary
+                log_iteration_status("checks_passed_tasks_incomplete",
+                  provider: preview_provider,
+                  model: preview_model,
+                  prompt_length: prompt_length,
+                  checks: checks_summary,
+                  task_status: "incomplete",
+                  task_completion_reason: task_completion_result[:reason])
                 transition_to(:next_patch)
 
                 # Append task completion requirement to PROMPT.md
                 append_task_requirement_to_prompt(task_completion_result[:message])
               end
             else
+              Aidp.log_debug("work_loop", "completion_blocked_agent_not_complete",
+                iteration: @iteration_count)
+
               display_message("  All checks passed but work not marked complete", type: :info)
+              log_iteration_status("checks_passed_waiting_agent_completion",
+                provider: preview_provider,
+                model: preview_model,
+                prompt_length: prompt_length,
+                checks: checks_summary)
               transition_to(:next_patch)
             end
           else
@@ -289,9 +407,154 @@ module Aidp
             diagnostic = diagnose_failures(all_results)
 
             transition_to(:next_patch)
+            log_iteration_status("checks_failed",
+              provider: preview_provider,
+              model: preview_model,
+              prompt_length: prompt_length,
+              checks: checks_summary,
+              failures: failure_summary_for_log(all_results))
             prepare_next_iteration(all_results, diagnostic)
           end
+
+          # FIX for issue #391: Evaluate prompt effectiveness at iteration thresholds
+          # After 10+ iterations, assess whether the prompt is leading to progress
+          evaluate_prompt_effectiveness(all_results)
+        end
+      end
+
+      # Evaluate prompt effectiveness at iteration thresholds
+      # FIX for issue #391: Provides feedback when work loop is stuck
+      # Note: Errors during evaluation are logged but don't fail the work loop
+      def evaluate_prompt_effectiveness(all_results)
+        return unless @prompt_evaluator.should_evaluate?(@iteration_count)
+
+        Aidp.log_debug("work_loop", "evaluating_prompt_effectiveness",
+          iteration: @iteration_count)
+
+        display_message("📊 Evaluating prompt effectiveness (iteration #{@iteration_count})...", type: :info)
+
+        task_summary = build_task_summary_for_evaluation
+        prompt_content = @prompt_manager.read
+
+        evaluation = @prompt_evaluator.evaluate(
+          prompt_content: prompt_content,
+          iteration_count: @iteration_count,
+          task_summary: task_summary,
+          recent_failures: all_results,
+          step_name: @step_name
+        )
+
+        display_prompt_evaluation_results(evaluation)
+
+        # If prompt is deemed ineffective, append suggestions to PROMPT.md
+        unless evaluation[:effective]
+          append_evaluation_feedback_to_prompt(evaluation)
+        end
+
+        Aidp.log_info("work_loop", "prompt_evaluation_complete",
+          iteration: @iteration_count,
+          effective: evaluation[:effective],
+          confidence: evaluation[:confidence])
+      rescue => e
+        # Don't let evaluation errors break the work loop
+        Aidp.log_warn("work_loop", "prompt_evaluation_error",
+          iteration: @iteration_count,
+          error: e.message,
+          error_class: e.class.name)
+        display_message("  ⚠️  Prompt evaluation skipped due to error: #{e.message}", type: :muted)
+      end
+
+      def build_task_summary_for_evaluation
+        all_tasks = @persistent_tasklist.all
+        return {} if all_tasks.empty?
+
+        {
+          total: all_tasks.size,
+          done: all_tasks.count { |t| t.status == :done },
+          in_progress: all_tasks.count { |t| t.status == :in_progress },
+          pending: all_tasks.count { |t| t.status == :pending },
+          abandoned: all_tasks.count { |t| t.status == :abandoned }
+        }
+      end
+
+      def display_prompt_evaluation_results(evaluation)
+        # Skip display if evaluation was skipped
+        if evaluation[:skipped]
+          display_message("  ℹ️  Prompt evaluation skipped: #{evaluation[:skip_reason]}", type: :muted)
+          return
+        end
+
+        if evaluation[:effective]
+          display_message("  ✅ Prompt appears effective, continuing...", type: :success)
+        else
+          display_message("  ⚠️  Prompt may need improvement:", type: :warning)
+
+          if evaluation[:issues]&.any?
+            display_message("  Issues identified:", type: :info)
+            evaluation[:issues].each { |issue| display_message("    - #{issue}", type: :warning) }
+          end
+
+          if evaluation[:suggestions]&.any?
+            display_message("  Suggestions:", type: :info)
+            evaluation[:suggestions].take(3).each { |s| display_message("    - #{s}", type: :info) }
+          end
+
+          if evaluation[:likely_blockers]&.any?
+            display_message("  Likely blockers:", type: :warning)
+            evaluation[:likely_blockers].each { |b| display_message("    - #{b}", type: :error) }
+          end
+        end
+
+        display_message("  Confidence: #{(evaluation[:confidence] * 100).round}%", type: :muted)
+      end
+
+      def append_evaluation_feedback_to_prompt(evaluation)
+        feedback_section = build_evaluation_feedback_section(evaluation)
+
+        @prompt_manager.append(feedback_section)
+
+        Aidp.log_debug("work_loop", "appended_evaluation_feedback",
+          iteration: @iteration_count,
+          feedback_size: feedback_section.length)
+      end
+
+      def build_evaluation_feedback_section(evaluation)
+        parts = []
+        parts << "\n\n## ⚠️ Work Loop Progress Assessment (Iteration #{@iteration_count})"
+        parts << ""
+        parts << "The work loop has been running for #{@iteration_count} iterations without completion."
+        parts << "An automated assessment identified the following:"
+        parts << ""
+
+        if evaluation[:issues]&.any?
+          parts << "### Issues Identified"
+          evaluation[:issues].each { |i| parts << "- #{i}" }
+          parts << ""
+        end
+
+        if evaluation[:suggestions]&.any?
+          parts << "### Suggestions for Progress"
+          evaluation[:suggestions].each { |s| parts << "- #{s}" }
+          parts << ""
+        end
+
+        if evaluation[:recommended_actions]&.any?
+          parts << "### Recommended Actions"
+          evaluation[:recommended_actions].each do |action|
+            parts << "- [#{action[:priority]&.upcase || "MEDIUM"}] #{action[:action]}"
+            parts << "  Rationale: #{action[:rationale]}" if action[:rationale]
+          end
+          parts << ""
         end
+
+        parts << "### Next Steps"
+        parts << "Please address the above issues and either:"
+        parts << "1. Complete the remaining work and mark STATUS: COMPLETE"
+        parts << "2. File tasks for remaining work and complete them systematically"
+        parts << "3. If blocked, explain the blocker clearly in your response"
+        parts << ""
+
+        parts.join("\n")
       end
 
       def run_decider_agentic_unit(context)
@@ -499,8 +762,8 @@ module Aidp
       end
 
       # Apply patch - send PROMPT.md to agent
-      def apply_patch
-        send_to_agent
+      def apply_patch(selected_provider = nil, selected_model = nil)
+        send_to_agent(selected_provider: selected_provider, selected_model: selected_model)
       end
 
       # Check if agent marked work complete
@@ -549,7 +812,9 @@ module Aidp
         # Traditional prompt building (fallback or when optimization disabled)
         template_content = load_template(step_spec["templates"]&.first)
         prd_content = load_prd
-        style_guide = load_style_guide
+        # Use provider-aware style guide loading - skips for Claude/Copilot,
+        # selects relevant STYLE_GUIDE sections for other providers
+        style_guide = load_style_guide_for_provider(context)
         user_input = format_user_input(context[:user_input])
         deterministic_outputs = Array(context[:deterministic_outputs])
         previous_summary = context[:previous_agent_summary]
@@ -729,7 +994,7 @@ module Aidp
         parts.join("\n")
       end
 
-      def send_to_agent
+      def send_to_agent(selected_provider: nil, selected_model: nil)
         prompt_content = @prompt_manager.read
         return {status: "error", message: "PROMPT.md not found"} unless prompt_content
 
@@ -737,9 +1002,11 @@ module Aidp
         full_prompt = build_work_loop_header(@step_name, @iteration_count) + "\n\n" + prompt_content
 
         # Select model based on thinking depth tier
-        provider_name, model_name, _model_data = select_model_for_current_tier
+        provider_name = selected_provider
+        model_name = selected_model
+        provider_name, model_name, _model_data = select_model_for_current_tier if provider_name.nil? || model_name.nil?
 
-        if provider_name.nil? || model_name.nil?
+        if provider_name.nil?
           Aidp.logger.error("work_loop", "Failed to select model for tier",
             tier: @thinking_depth_manager.current_tier,
             step: @step_name,
@@ -750,39 +1017,213 @@ module Aidp
         # Log model selection
         tier = @thinking_depth_manager.current_tier
         if @last_tier != tier
-          display_message("  💡 Using tier: #{tier} (#{provider_name}/#{model_name})", type: :info)
+          model_label = model_name || "auto"
+          display_message("  💡 Using tier: #{tier} (#{provider_name}/#{model_label})", type: :info)
           @last_tier = tier
         end
 
         # CRITICAL: Change to project directory before calling provider
         # This ensures Claude CLI runs in the correct directory and can create files
         Dir.chdir(@project_dir) do
-          # Send to provider via provider_manager with selected model
-          @provider_manager.execute_with_provider(
-            provider_name,
-            full_prompt,
-            {
-              step_name: @step_name,
-              iteration: @iteration_count,
-              project_dir: @project_dir,
-              model: model_name,
-              tier: @thinking_depth_manager.current_tier
-            }
-          )
+          # Execute with sanitized environment (secrets stripped) when security is enabled
+          # This ensures agent processes cannot access registered secrets directly
+          execute_block = lambda do
+            @provider_manager.execute_with_provider(
+              provider_name,
+              full_prompt,
+              {
+                step_name: @step_name,
+                iteration: @iteration_count,
+                project_dir: @project_dir,
+                model: model_name,
+                tier: @thinking_depth_manager.current_tier
+              }
+            )
+          end
+
+          if @security_adapter.enabled?
+            @security_adapter.with_sanitized_environment(&execute_block)
+          else
+            execute_block.call
+          end
+        end
+      end
+
+      def display_iteration_overview(provider_name, model_name, prompt_length, checks_summary = nil)
+        tier = @thinking_depth_manager.current_tier
+        checks = checks_summary
+        checks ||= summarize_checks(@test_runner.planned_commands) if @test_runner.respond_to?(:planned_commands)
+        model_label = model_name || "auto"
+        context_labels = iteration_context_labels
+
+        display_message("    • Step: #{@step_name} | Tier: #{tier} | Model: #{provider_name}/#{model_label}", type: :info)
+        display_message("    • Prompt size: #{prompt_length} chars | State: #{STATES[@current_state]}", type: :info)
+        display_message("    • Upcoming checks: #{checks}", type: :info) if checks && !checks.empty?
+        display_message("    • Context: #{context_labels.join(" | ")}", type: :info) if context_labels.any?
+
+        # Display output filtering configuration if enabled
+        filtering_info = summarize_output_filtering
+        display_message("    • Output filtering: #{filtering_info}", type: :info) if filtering_info
+      end
+
+      # Summarize output filtering configuration
+      def summarize_output_filtering
+        return nil unless @config.respond_to?(:output_filtering_enabled?) && @config.output_filtering_enabled?
+
+        iteration = @test_runner.respond_to?(:iteration_count) ? @test_runner.iteration_count : 0
+
+        test_mode = if @config.respond_to?(:test_output_mode)
+          @config.test_output_mode
+        elsif iteration > 1
+          :failures_only
+        else
+          :full
+        end
+
+        lint_mode = if @config.respond_to?(:lint_output_mode)
+          @config.lint_output_mode
+        elsif iteration > 1
+          :failures_only
+        else
+          :full
+        end
+
+        if test_mode == :full && lint_mode == :full
+          nil # Don't show message when no filtering is active
+        else
+          "test=#{test_mode}, lint=#{lint_mode}"
+        end
+      rescue
+        nil
+      end
+
+      # Display output filtering statistics after test/lint runs
+      def display_filtering_stats
+        return unless @test_runner.respond_to?(:filter_stats)
+
+        stats = @test_runner.filter_stats
+        return if stats[:total_input_bytes].zero?
+
+        reduction = ((stats[:total_input_bytes] - stats[:total_output_bytes]).to_f / stats[:total_input_bytes] * 100).round(1)
+        return if reduction <= 0
+
+        display_message("    📉 Token optimization: #{reduction}% reduction " \
+                       "(#{format_bytes(stats[:total_input_bytes])} → #{format_bytes(stats[:total_output_bytes])})", type: :info)
+      rescue
+        # Silently ignore errors in stats display
+      end
+
+      def format_bytes(bytes)
+        if bytes >= 1024 * 1024
+          "#{(bytes / 1024.0 / 1024.0).round(1)}MB"
+        elsif bytes >= 1024
+          "#{(bytes / 1024.0).round(1)}KB"
+        else
+          "#{bytes}B"
+        end
+      end
+
+      def summarize_checks(planned)
+        labels = {
+          tests: "tests",
+          lints: "linters",
+          formatters: "formatters",
+          builds: "builds",
+          docs: "docs"
+        }
+
+        summaries = planned.map do |category, commands|
+          count = Array(commands).size
+          next if count.zero?
+
+          label = labels[category] || category.to_s
+          cmd_names = Array(commands).map do |cmd|
+            cmd.is_a?(Hash) ? cmd[:command] : cmd
+          end
+
+          if cmd_names.size <= 2
+            "#{label} (#{cmd_names.join(", ")})"
+          else
+            "#{label} (#{cmd_names.first(2).join(", ")} +#{cmd_names.size - 2} more)"
+          end
+        end.compact
+
+        summaries.join(" | ")
+      rescue => e
+        Aidp.log_warn("work_loop", "summarize_checks_failed", error: e.message)
+        nil
+      end
+
+      def planned_checks_summary
+        return nil unless @test_runner.respond_to?(:planned_commands)
+
+        summarize_checks(@test_runner.planned_commands)
+      end
+
+      def failure_summary_for_log(all_results)
+        Array(all_results).each_with_object([]) do |(category, results), summary|
+          next if results[:success]
+
+          failures = results[:required_failures] || results[:failures] || []
+          count = failures.size
+          commands = Array(failures).map { |f| f[:command] }.compact
+
+          summary << if commands.any?
+            "#{category}: #{count} (#{commands.first(2).join(", ")})"
+          else
+            "#{category}: #{count}"
+          end
         end
+      rescue => e
+        Aidp.log_warn("work_loop", "failure_summary_for_log_failed", error: e.message)
+        []
       end
 
+      # FIX for issue #391: Added completion_reason and task_completion_reason parameters for better logging
+      def log_iteration_status(status, provider:, model:, prompt_length:, checks: nil, failures: nil, task_status: nil,
+        completion_reason: nil, task_completion_reason: nil)
+        context_labels = iteration_context_labels
+        metadata = {
+          step: @step_name,
+          iteration: @iteration_count,
+          state: STATES[@current_state],
+          tier: @thinking_depth_manager.current_tier,
+          provider: provider,
+          model: model,
+          prompt_length: prompt_length,
+          checks: checks,
+          failures: failures,
+          task_status: task_status,
+          completion_reason: completion_reason,
+          task_completion_reason: task_completion_reason
+        }
+
+        metadata.merge!(iteration_context_metadata)
+        metadata.delete_if { |_, value| value.nil? || (value.respond_to?(:empty?) && value.empty?) }
+
+        message = "Iteration #{@iteration_count} for #{@step_name}: #{status}"
+        message += " | #{context_labels.join(" | ")}" if context_labels.any?
+
+        Aidp.log_info("work_loop_iteration",
+          message,
+          **metadata)
+      rescue => e
+        Aidp.log_warn("work_loop", "failed_to_log_iteration_status", error: e.message)
+      end
+
+      # FIX for issue #391: Enhanced work loop header with upfront task filing requirements
       def build_work_loop_header(step_name, iteration)
         parts = []
         parts << "# Work Loop: #{step_name} (Iteration #{iteration})"
         parts << ""
         parts << "## Instructions"
         parts << "You are working in a work loop. Your responsibilities:"
-        parts << "1. Read the task description below to understand what needs to be done"
-        parts << "2. **Write/edit code files** to implement the required changes"
-        parts << "3. Run tests to verify your changes work correctly"
-        parts << "4. Update the task list in PROMPT.md as you complete items"
-        parts << "5. When ALL tasks are complete and tests pass, mark the step COMPLETE"
+        parts << "1. **FIRST**: File tasks for all work items (see Task Filing section below)"
+        parts << "2. Read the task description below to understand what needs to be done"
+        parts << "3. **Write/edit CODE files** to implement the required changes"
+        parts << "4. Run tests to verify your changes work correctly"
+        parts << "5. Update task status as you complete items"
+        parts << "6. When ALL tasks are complete and tests pass, mark the step COMPLETE"
         parts << ""
         parts << "## Important Notes"
         parts << "- You have full file system access - create and edit files as needed"
@@ -790,29 +1231,53 @@ module Aidp
         parts << "- After you finish, tests and linters will run automatically"
         parts << "- If tests/linters fail, you'll see the errors in the next iteration and can fix them"
         parts << ""
+        parts << "## ⚠️  Code Changes Required"
+        parts << "**IMPORTANT**: This implementation requires actual code changes."
+        parts << "- Documentation-only changes will NOT be accepted as complete"
+        parts << "- Configuration-only changes will NOT be accepted as complete"
+        parts << "- You must modify/create code files (.rb, .py, .js, etc.) to implement the feature/fix"
+        parts << "- Tests should accompany code changes"
+        parts << ""
 
         if @config.task_completion_required?
-          parts << "## Task Tracking (REQUIRED)"
-          parts << "**CRITICAL**: This work loop requires task tracking for completion."
+          parts << "## Task Filing (REQUIRED - DO THIS FIRST)"
+          parts << "**CRITICAL**: This work loop requires task tracking. You MUST file tasks before implementation."
+          parts << ""
+          parts << "### Step 1: File Tasks Immediately"
+          parts << "In your FIRST iteration, analyze the requirements and file tasks for ALL work:"
           parts << ""
-          parts << "You must:"
-          parts << "1. Create at least one task for this session using: `File task: \"description\"`"
-          parts << "2. Track all work items as tasks"
-          parts << "3. Update task status as you progress"
-          parts << "4. All tasks must be DONE or ABANDONED (with reason) before completion"
-          parts << "5. **IMPORTANT**: When you write STATUS: COMPLETE, also mark all your tasks as done!"
+          parts << "```text"
+          parts << "File task: \"Implement [feature/fix description]\" priority: high tags: implementation"
+          parts << "File task: \"Add unit tests for [feature]\" priority: high tags: testing"
+          parts << "File task: \"Add integration tests if needed\" priority: medium tags: testing"
+          parts << "```"
           parts << ""
-          parts << "**Important**: Tasks in the list exist due to careful planning and requirements analysis."
-          parts << "Do NOT abandon tasks due to perceived complexity or scope concerns - these factors were"
-          parts << "considered during planning. Only abandon tasks when truly obsolete (requirements changed,"
-          parts << "duplicate work, external blockers). When in doubt, mark in_progress and implement."
+          parts << "### Step 2: Work Through Tasks"
+          parts << "- Pick the highest priority pending task"
+          parts << "- Implement it completely"
+          parts << "- Mark it done: `Update task: task_id status: done`"
+          parts << "- Repeat until all tasks are complete"
           parts << ""
-          parts << "Task filing examples:"
+          parts << "### Step 3: Complete the Work Loop"
+          parts << "Only after ALL tasks are done:"
+          parts << "- Verify tests pass"
+          parts << "- Add STATUS: COMPLETE to PROMPT.md"
+          parts << ""
+          parts << "### Task Rules"
+          parts << "- **At least ONE task must be filed** - completion blocked without tasks"
+          parts << "- **At least ONE task must be DONE** - completion blocked if all abandoned"
+          parts << "- **Substantive work required** - doc-only changes rejected"
+          parts << ""
+          parts << "**Important**: Tasks exist due to careful planning. Do NOT abandon tasks due to"
+          parts << "perceived complexity - these factors were considered during planning. Only abandon"
+          parts << "when truly obsolete (requirements changed, duplicate, external blockers)."
+          parts << ""
+          parts << "### Task Filing Examples"
           parts << "- `File task: \"Implement user authentication\" priority: high tags: security,auth`"
           parts << "- `File task: \"Add tests for login flow\" priority: medium tags: testing`"
           parts << "- `File task: \"Update documentation\" priority: low tags: docs`"
           parts << ""
-          parts << "Task status update examples:"
+          parts << "### Task Status Update Examples"
           parts << "- `Update task: task_123_abc status: in_progress`"
           parts << "- `Update task: task_456_def status: done`"
           parts << "- `Update task: task_789_ghi status: abandoned reason: \"Requirements changed\"`"
@@ -832,6 +1297,24 @@ module Aidp
         parts.join("\n")
       end
 
+      def iteration_context_metadata
+        ctx = (@options || {}).merge(@work_context || {})
+        {
+          issue: issue_context_label(ctx),
+          pr: pr_context_label(ctx),
+          step_position: step_position_label(@step_name, ctx)
+        }.compact
+      end
+
+      def iteration_context_labels
+        meta = iteration_context_metadata
+        labels = []
+        labels << meta[:issue] if meta[:issue]
+        labels << meta[:pr] if meta[:pr]
+        labels << meta[:step_position] if meta[:step_position]
+        labels
+      end
+
       def prompt_marked_complete?
         prompt_content = @prompt_manager.read
         return false unless prompt_content
@@ -938,30 +1421,50 @@ module Aidp
 
       # Check if we should reinject the style guide at this iteration
       def should_reinject_style_guide?
+        # Skip reinjection for providers with instruction files (Claude, GitHub Copilot)
+        current_provider = @provider_manager&.current_provider
+        return false unless @style_guide_selector.provider_needs_style_guide?(current_provider)
+
         # Reinject on intervals (5, 10, 15, etc.) but not on iteration 1
         @iteration_count > 1 && (@iteration_count % STYLE_GUIDE_REMINDER_INTERVAL == 0)
       end
 
       # Create style guide reminder text
       def reinject_style_guide_reminder
-        style_guide = load_style_guide
+        current_provider = @provider_manager&.current_provider
+
+        # Skip for providers with instruction files
+        unless @style_guide_selector.provider_needs_style_guide?(current_provider)
+          Aidp.log_debug("work_loop", "skipping_style_guide_reminder",
+            provider: current_provider,
+            reason: "provider has instruction file")
+          return ""
+        end
+
         template_content = load_current_template
 
+        # Use provider-aware style guide loading with context-based section selection
+        style_guide = load_style_guide_for_provider(@work_context)
+
         reminder = []
         reminder << "### 🔄 Style Guide & Template Reminder (Iteration #{@iteration_count})"
         reminder << ""
         reminder << "**IMPORTANT**: To prevent drift from project conventions, please review:"
         reminder << ""
 
-        if style_guide
-          reminder << "#### LLM Style Guide"
-          reminder << "```"
-          # Include first 1000 chars of style guide to keep context manageable
-          style_guide_preview = (style_guide.length > 1000) ? style_guide[0...1000] + "\n...(truncated)" : style_guide
+        if style_guide && !style_guide.empty?
+          reminder << "#### Relevant Style Guide Sections"
+          reminder << "```markdown"
+          # Include selected sections (already limited by selector)
+          style_guide_preview = if style_guide.length > 2000
+            style_guide[0...2000] + "\n...(truncated)"
+          else
+            style_guide
+          end
           reminder << style_guide_preview
           reminder << "```"
           reminder << ""
-          display_message("  [STYLE_GUIDE] Re-injecting LLM_STYLE_GUIDE at iteration #{@iteration_count}", type: :info)
+          display_message("  [STYLE_GUIDE] Re-injecting selected STYLE_GUIDE sections at iteration #{@iteration_count}", type: :info)
         end
 
         if template_content
@@ -1051,6 +1554,74 @@ module Aidp
         File.exist?(style_guide_path) ? File.read(style_guide_path) : nil
       end
 
+      # Load style guide content appropriate for the current provider and context
+      # Returns nil for providers with instruction files (Claude, GitHub Copilot)
+      # Returns selected STYLE_GUIDE sections for other providers
+      #
+      # @param context [Hash] Task context for keyword extraction
+      # @return [String, nil] Style guide content or nil if not needed
+      def load_style_guide_for_provider(context = {})
+        current_provider = @provider_manager&.current_provider
+
+        # Skip style guide for providers with their own instruction files
+        unless @style_guide_selector.provider_needs_style_guide?(current_provider)
+          Aidp.log_debug("work_loop", "skipping_style_guide",
+            provider: current_provider,
+            reason: "provider has instruction file")
+          return nil
+        end
+
+        # Extract keywords from context for intelligent section selection
+        keywords = extract_style_guide_keywords(context)
+
+        # Select relevant sections from STYLE_GUIDE.md
+        content = @style_guide_selector.select_sections(
+          keywords: keywords,
+          include_core: true,
+          max_lines: 500 # Limit to keep prompt size manageable
+        )
+
+        return nil if content.nil? || content.empty?
+
+        Aidp.log_debug("work_loop", "style_guide_selected",
+          provider: current_provider,
+          keywords: keywords,
+          content_lines: content.lines.count)
+
+        content
+      end
+
+      # Extract keywords from task context for style guide section selection
+      #
+      # @param context [Hash] Task context
+      # @return [Array<String>] Keywords for section selection
+      def extract_style_guide_keywords(context)
+        keywords = []
+
+        # Extract from step name
+        step_lower = @step_name.to_s.downcase
+        keywords << "testing" if step_lower.include?("test")
+        keywords << "implementation" if step_lower.include?("implement")
+        keywords << "refactor" if step_lower.include?("refactor")
+
+        # Extract from user input
+        user_input = context[:user_input]
+        if user_input.is_a?(Hash)
+          keywords.concat(@style_guide_selector.extract_keywords(user_input.values.join(" ")))
+        elsif user_input.is_a?(String)
+          keywords.concat(@style_guide_selector.extract_keywords(user_input))
+        end
+
+        # Extract from affected files
+        affected_files = context[:affected_files] || []
+        affected_files.each do |file|
+          keywords << "testing" if file.include?("spec") || file.include?("test")
+          keywords << "tty" if file.include?("cli") || file.include?("tui")
+        end
+
+        keywords.uniq
+      end
+
       def format_user_input(user_input)
         return nil if user_input.nil? || user_input.empty?
 
@@ -1145,6 +1716,29 @@ module Aidp
         display_message("")
       end
 
+      # Display security status for Rule of Two enforcement
+      def display_security_status
+        status = @security_adapter.status
+        return unless status[:enabled]
+
+        display_message("\n🔒 Security (Rule of Two):", type: :info)
+        display_message("  #{status[:status_string]}", type: :info)
+
+        if status[:state]
+          state = status[:state]
+          flags = []
+          flags << "untrusted_input (#{state[:untrusted_input_source]})" if state[:untrusted_input]
+          flags << "private_data (#{state[:private_data_source]})" if state[:private_data]
+          flags << "egress (#{state[:egress_source]})" if state[:egress]
+
+          if flags.any?
+            display_message("  Active flags: #{flags.join(", ")}", type: :info)
+          end
+        end
+
+        display_message("")
+      end
+
       # Display pending tasks from persistent tasklist
       def display_pending_tasks
         pending_tasks = @persistent_tasklist.pending
@@ -1221,46 +1815,113 @@ module Aidp
       end
 
       # Check if tasks are required and all are completed or abandoned
-      # Returns {complete: boolean, message: string}
+      # Returns {complete: boolean, message: string, reason: string}
       # Note: Tasks are project-scoped, not session-scoped. This allows tasks created
       # in planning phases to be completed in build phases.
+      #
+      # FIX for issue #391: Prevent premature completion when tasks haven't been created
+      # The previous logic allowed completion with empty task list, which enabled
+      # the work loop to complete before actually implementing anything.
       def check_task_completion
-        return {complete: true, message: nil} unless @config.task_completion_required?
+        Aidp.log_debug("work_loop", "check_task_completion_start",
+          task_completion_required: @config.task_completion_required?,
+          iteration: @iteration_count)
+
+        unless @config.task_completion_required?
+          Aidp.log_debug("work_loop", "check_task_completion_skipped",
+            reason: "task_completion_not_required")
+          return {complete: true, message: nil, reason: "task_completion_not_required"}
+        end
 
         all_tasks = @persistent_tasklist.all
 
-        # If no tasks exist yet, allow completion - agent can work without tasks initially
-        # This supports workflows where no planning phase created tasks
+        Aidp.log_debug("work_loop", "check_task_completion_task_count",
+          total_tasks: all_tasks.size,
+          task_ids: all_tasks.map(&:id))
+
+        # FIX for issue #391: Require at least one task when task_completion is enabled
+        # Empty task list now blocks completion to prevent premature PR creation
+        # This ensures the agent has actually created and completed work items
         if all_tasks.empty?
-          return {complete: true, message: nil}
+          Aidp.log_debug("work_loop", "check_task_completion_empty_tasks",
+            reason: "no_tasks_filed",
+            iteration: @iteration_count)
+
+          # After multiple iterations, require tasks - agent should have filed some by now
+          if @iteration_count >= 3
+            return {
+              complete: false,
+              message: "No tasks have been filed yet. You must create at least one task using:\n" \
+                      "  File task: \"description\" priority: high|medium|low tags: tag1,tag2\n\n" \
+                      "Tasks help track progress and ensure complete implementation.",
+              reason: "no_tasks_after_iterations"
+            }
+          end
+
+          # In early iterations, allow progress but don't allow completion
+          return {
+            complete: false,
+            message: "Please file tasks to track your implementation work.",
+            reason: "no_tasks_early_iteration"
+          }
         end
 
         # Count tasks by status
         pending_tasks = all_tasks.select { |t| t.status == :pending }
         in_progress_tasks = all_tasks.select { |t| t.status == :in_progress }
         abandoned_tasks = all_tasks.select { |t| t.status == :abandoned }
-        all_tasks.select { |t| t.status == :done }
+        done_tasks = all_tasks.select { |t| t.status == :done }
+
+        Aidp.log_debug("work_loop", "check_task_completion_status_counts",
+          pending: pending_tasks.size,
+          in_progress: in_progress_tasks.size,
+          abandoned: abandoned_tasks.size,
+          done: done_tasks.size)
 
         # If tasks exist, all must be done or abandoned before completion
         incomplete_tasks = pending_tasks + in_progress_tasks
 
         if incomplete_tasks.any?
           task_list = incomplete_tasks.map { |t| "- #{t.description} (#{t.status}, session: #{t.session})" }.join("\n")
+          Aidp.log_debug("work_loop", "check_task_completion_incomplete",
+            incomplete_count: incomplete_tasks.size,
+            incomplete_ids: incomplete_tasks.map(&:id))
           return {
             complete: false,
-            message: "Tasks remain incomplete:\n#{task_list}\n\nComplete all tasks or abandon them with reason before marking work complete."
+            message: "Tasks remain incomplete:\n#{task_list}\n\nComplete all tasks or abandon them with reason before marking work complete.",
+            reason: "incomplete_tasks"
+          }
+        end
+
+        # FIX for issue #391: Require at least one done task, not just abandoned
+        # This prevents scenarios where all tasks are abandoned without any work
+        if done_tasks.empty? && abandoned_tasks.any?
+          Aidp.log_debug("work_loop", "check_task_completion_all_abandoned",
+            abandoned_count: abandoned_tasks.size)
+          return {
+            complete: false,
+            message: "All tasks have been abandoned with no completed work. " \
+                    "At least one task must be completed, or explain why no implementation is needed.",
+            reason: "all_tasks_abandoned"
           }
         end
 
         # If there are abandoned tasks, confirm with user
         if abandoned_tasks.any? && !all_abandoned_tasks_confirmed?(abandoned_tasks)
+          Aidp.log_debug("work_loop", "check_task_completion_unconfirmed_abandoned",
+            abandoned_count: abandoned_tasks.size)
           return {
             complete: false,
-            message: "Abandoned tasks require user confirmation. Please confirm abandoned tasks."
+            message: "Abandoned tasks require user confirmation. Please confirm abandoned tasks.",
+            reason: "unconfirmed_abandoned_tasks"
           }
         end
 
-        {complete: true, message: nil}
+        Aidp.log_debug("work_loop", "check_task_completion_success",
+          done_count: done_tasks.size,
+          abandoned_count: abandoned_tasks.size)
+
+        {complete: true, message: nil, reason: "all_tasks_complete"}
       end
 
       # Check if all abandoned tasks have been confirmed