@kendoo.agentdesk/agentdesk 0.29.2 → 0.30.0

package/CHANGELOG.md

@@ -8,10 +8,17 @@ All user-facing changes to AgentDesk. Each entry is tagged:
 
 Internal refactors, infrastructure changes, and architectural notes are not listed here.
 
-## [0.29.2] — 2026-09-21
+## [0.30.0] — 2026-09-21
+
+### Changed
+- `[CLI]` A review approval now refers to one verified commit. Before the reviewers are asked, the engine itself runs the project's `test`/`build`/`lint` commands (from project settings, or the `package.json` scripts) inside the session sandbox. A failing check goes straight back to EXECUTION with the real output as findings; the reviewers only see work whose checks pass, and their prompt shows what the engine observed. If the code changes after an approval, the approval no longer counts and the session ends for human review instead of reporting success. In a session worktree, uncommitted changes block review.
+- `[CLI]` The SUMMARY phase is now enforced read-only: it can no longer edit files, commit, move `HEAD`, push, or open a PR.
+- `[UI]` The session feed shows each verification command the engine ran and its result.
+
+## [0.29.3] — 2026-09-21
 
 ### Fixed
-- `[CLI]` The dashboard's new task-lookup (which recommends resuming, continuing, or starting fresh for a task id) could miss a workspace that already had unfinished local work, then try to check out its branch a second time and fail with `fatal: '...' is already used by worktree at ...`. Lookups now match by the repo's actual path instead of a locally-derived project label that could go stale.
+- `[CLI]` The dashboard's new task-lookup (which recommends resuming, continuing, or starting fresh for a task id) could miss a workspace that already had unfinished local work, then try to check out its branch a second time and fail with `fatal: '...' is already used by worktree at ...`. Lookups now match by the repo's actual path instead of a locally-derived project label that could go stale. (Published as 0.29.3 — 0.29.2 got stuck mid-publish on the registry.)
 
 ## [0.29.1] — 2026-09-20
 

package/README.md

@@ -265,6 +265,8 @@ Valid values: `"default"`, `"opus"`, `"sonnet"`, `"haiku"`. `"default"` resolves
 
 The `REVIEW` phase is a read-only completeness check (no code changes) — it verifies the implementation meets requirements, flags missed documentation updates or silently-deferred scope. If gaps are found, the orchestrator loops back to `EXECUTION` once before moving on. The `SUMMARY` phase writes the final tracker comments and session protocol.
 
+Before the reviewers are asked, the engine runs the project's own checks itself — `commands.test`, `commands.build` and `commands.lint` from project settings, or the `test`/`build`/`lint` scripts in `package.json` when those are unset — inside the session sandbox, at the current commit. A failing check goes straight back to `EXECUTION` with the real output as findings; the reviewers are only asked once the checks pass. An approval is pinned to that commit: if the code changes afterwards, the approval no longer counts and the session ends for human review instead of reporting success. In a session worktree, uncommitted changes block review too — an approval refers to a committed revision. `SUMMARY` cannot commit, move `HEAD`, or push; it writes messages only.
+
 ## How It Works
 
 All agents collaborate in a single Claude process — each with distinct roles, ground rules, and areas of expertise.
@@ -317,7 +319,7 @@ Once running, a "Run Team" button appears on [agentdesk.live](https://agentdesk.
 - **Credentials prerequisite** — scoped sessions push code over HTTPS using a per-project GitHub token. `agentdesk init` saves it to the project's `.env` as `GITHUB_TOKEN`; if you skip that step, the session refuses to start with an actionable message. SSH-only remotes (`git@github.com:...`) are also rejected — the sandbox intentionally isolates `~/.ssh`. Switch the origin to `https://github.com/<owner>/<repo>.git` or run without scoped isolation.
 - **Outbound only** — no ports opened on your machine
 - **Project allowlist** — only runs on projects registered via `agentdesk init`
-- **No arbitrary commands** — only spawns Claude with a fixed set of allowed tools
+- **No arbitrary commands** — spawns Claude with a fixed set of allowed tools, plus the project's own configured `test`/`build`/`lint` commands (run inside the same sandbox, before each review) — nothing the server can push
 - **Metadata-only logs** — session logs in `~/.agentdesk/logs/` contain timestamps and file paths, never sensitive data
 - **Fail closed** — unknown projects or exceeded session limits are rejected
 

package/cli/engine/evidence.mjs

@@ -0,0 +1,182 @@
+// The engine's own evidence for an approval.
+//
+// REVIEW's verdict is an agent's structured claim. Before the engine asks for
+// that claim it runs the project's own checks (test/build/lint) at a known
+// revision, and afterwards it only accepts "APPROVED" if the checks passed and
+// the code has not moved since. Discipline belongs in the system; judgement
+// belongs with the agents.
+//
+// Pure decisions (resolveChecks, evaluateApproval, evidenceFindings, the
+// renderers) are unit-tested without spawning anything. runChecks takes an
+// injectable runner so the session loop is testable with scripted results.
+
+import { execFileSync, spawn } from "node:child_process";
+import { killTree } from "../proc.mjs";
+
+export const ENGINE_REVIEWER = "AgentDesk";
+export const CHECK_ORDER = Object.freeze(["test", "build", "lint"]);
+export const DEFAULT_CHECK_TIMEOUT_MS = 15 * 60 * 1000;
+export const OUTPUT_TAIL_BYTES = 4096;
+
+export const shortRev = revision => String(revision || "").slice(0, 7);
+
+// config.commands.{test,build,lint} win; the project's detected commands fill
+// the gaps; a slot with neither is simply not a check.
+export function resolveChecks({ config = {}, project = {} } = {}) {
+  const detected = { test: project.testCommand, build: project.buildCommand, lint: project.lintCommand };
+  const checks = [];
+  for (const name of CHECK_ORDER) {
+    const configured = config.commands?.[name];
+    const command = typeof configured === "string" && configured.trim() ? configured.trim() : (detected[name] || null);
+    if (command) checks.push({ name, command });
+  }
+  return checks;
+}
+
+export function checkTimeoutMs(config = {}) {
+  const v = Number(config.checkTimeoutMs);
+  return Number.isFinite(v) && v > 0 ? v : DEFAULT_CHECK_TIMEOUT_MS;
+}
+
+// Worktree sessions commit into a private Git dir (worktree-git.mjs); the
+// engine must look where the agents commit, so the session's GIT_* env is
+// overlaid on a scrubbed environment.
+function gitEnv(extra = {}) {
+  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" };
+  for (const key of Object.keys(env)) if (/^GIT_(DIR|WORK_TREE|COMMON_DIR|INDEX_FILE|OBJECT_DIRECTORY|ALTERNATE_OBJECT_DIRECTORIES|CONFIG_COUNT|CONFIG_KEY_\d+|CONFIG_VALUE_\d+|CONFIG_PARAMETERS)$/.test(key)) delete env[key];
+  return { ...env, ...extra };
+}
+
+function git(cwd, args, extra) {
+  return execFileSync("git", args, { cwd, env: gitEnv(extra), encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 30000 }).trim();
+}
+
+// Independent lookups: a repository with an unborn branch has no HEAD yet
+// but can still have a dirty tree.
+export function gitState(cwd, extraEnv = {}) {
+  let revision = null, clean = null;
+  try { revision = git(cwd, ["rev-parse", "HEAD"], extraEnv) || null; } catch {}
+  try { clean = git(cwd, ["status", "--porcelain"], extraEnv) === ""; } catch {}
+  return { revision, clean };
+}
+
+export function plainSpawnCommand({ command, cwd, env }) {
+  return spawn("/bin/sh", ["-c", command], { cwd, env, stdio: ["ignore", "pipe", "pipe"], shell: false, detached: true });
+}
+
+// spawnCommand({ command, cwd, env }) → ChildProcess with piped stdout/stderr.
+export function createCheckRunner({ spawnCommand, tailBytes = OUTPUT_TAIL_BYTES } = {}) {
+  return function runCheck({ command, cwd, env, timeoutMs = DEFAULT_CHECK_TIMEOUT_MS, signal }) {
+    return new Promise(resolve => {
+      const startedAt = Date.now();
+      let child;
+      try { child = spawnCommand({ command, cwd, env }); }
+      catch (error) { return resolve({ exitCode: null, output: "", timedOut: false, durationMs: 0, error: error.message }); }
+      let tail = "";
+      const append = chunk => { tail = (tail + chunk.toString()).slice(-tailBytes); };
+      child.stdout?.on("data", append);
+      child.stderr?.on("data", append);
+      let timedOut = false, settled = false;
+      const timer = setTimeout(() => { timedOut = true; killTree(child, { graceMs: 1000 }); }, timeoutMs);
+      const onAbort = () => killTree(child, { graceMs: 0 });
+      signal?.addEventListener("abort", onAbort, { once: true });
+      const finish = (exitCode, error) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+        resolve({ exitCode, output: tail.trim(), timedOut, durationMs: Date.now() - startedAt, ...(error && { error }) });
+      };
+      child.once("error", err => finish(null, err.message));
+      child.once("close", (code, sig) => finish(code, sig && !timedOut ? `terminated by ${sig}` : undefined));
+    });
+  };
+}
+
+// Runs the checks in order at the current revision. `runCheck` is the
+// per-check runner (createCheckRunner or a scripted stand-in).
+export async function runChecks({ checks = [], cwd, env = {}, gitEnv: extraGitEnv = {}, runCheck, timeoutMs = DEFAULT_CHECK_TIMEOUT_MS, signal, requireClean = false }) {
+  const startedAt = Date.now();
+  const { revision, clean } = gitState(cwd, extraGitEnv);
+  const results = [];
+  let aborted = false;
+  for (const check of checks) {
+    if (signal?.aborted) { aborted = true; break; }
+    const r = await runCheck({ ...check, cwd, env, timeoutMs, signal });
+    results.push({
+      name: check.name, command: check.command,
+      exitCode: r.exitCode ?? null, durationMs: r.durationMs ?? 0, timedOut: !!r.timedOut,
+      output: String(r.output || "").slice(-OUTPUT_TAIL_BYTES),
+      ...(r.error && { error: r.error }),
+    });
+    if (signal?.aborted) { aborted = true; break; }
+  }
+  const checksPassed = results.every(r => r.exitCode === 0 && !r.timedOut);
+  const dirty = requireClean && clean === false;
+  return {
+    revision, clean, requireClean, checked: checks.length > 0,
+    startedAt, durationMs: Date.now() - startedAt, results, aborted,
+    passed: !aborted && checksPassed && !dirty,
+  };
+}
+
+// An approval stands only on: an explicit APPROVED, passing checks, and the
+// same revision the checks and reviewers saw.
+export function evaluateApproval({ verdict, evidence, headNow }) {
+  if (!verdict || verdict.outcome !== "APPROVED") return { approved: false, reason: "review did not approve" };
+  if (evidence && !evidence.passed) return { approved: false, reason: evidence.aborted ? "verification was cancelled" : "engine checks did not pass" };
+  if (evidence?.revision && headNow && evidence.revision !== headNow) {
+    return { approved: false, reason: `code changed after verification (${shortRev(evidence.revision)} → ${shortRev(headNow)})` };
+  }
+  return { approved: true, reason: null };
+}
+
+const seconds = ms => `${(Number(ms || 0) / 1000).toFixed(1)}s`;
+
+function describeResult(r) {
+  if (r.timedOut) return `TIMED OUT after ${seconds(r.durationMs)}`;
+  if (r.exitCode === 0) return `passed in ${seconds(r.durationMs)}`;
+  return `FAILED (${r.exitCode == null ? r.error || "no exit code" : `exit ${r.exitCode}`}) in ${seconds(r.durationMs)}`;
+}
+
+// Findings in the REVIEW verdict shape, so a failed check flows through the
+// same retry path as a reviewer's finding.
+export function evidenceFindings(evidence) {
+  const findings = [];
+  if (!evidence) return findings;
+  if (evidence.requireClean && evidence.clean === false) {
+    findings.push({ reviewer: ENGINE_REVIEWER, title: "Uncommitted changes in the session worktree", detail: "Commit or discard them before review — an approval refers to a committed revision." });
+  }
+  for (const r of evidence.results || []) {
+    if (r.exitCode === 0 && !r.timedOut) continue;
+    const title = r.timedOut ? `\`${r.command}\` timed out after ${seconds(r.durationMs)}` : `\`${r.command}\` failed (${r.exitCode == null ? r.error || "no exit code" : `exit ${r.exitCode}`})`;
+    findings.push({ reviewer: ENGINE_REVIEWER, title, detail: r.output || "(no output)" });
+  }
+  return findings;
+}
+
+export function formatEvidenceForPrompt(evidence) {
+  if (!evidence) return "";
+  const where = evidence.revision ? ` at ${shortRev(evidence.revision)}` : "";
+  const tree = evidence.clean == null ? "" : ` (tree ${evidence.clean ? "clean" : "has uncommitted changes"})`;
+  if (!evidence.checked) {
+    return `No verification commands are configured for this project (commands.test/build/lint in .agentdesk.json)${where}${tree} — reviewers must run the checks themselves and report the output.`;
+  }
+  const lines = [`Engine verification${where}${tree}:`];
+  for (const r of evidence.results) {
+    lines.push(`- \`${r.command}\` — ${describeResult(r)}`);
+    if (r.exitCode !== 0 || r.timedOut) for (const l of String(r.output || "(no output)").split("\n")) lines.push(`  ${l}`);
+  }
+  if (evidence.aborted) lines.push("- (verification was cancelled before every check ran)");
+  return lines.join("\n");
+}
+
+export function renderEvidenceSection(evidence) {
+  if (!evidence) return "";
+  const lines = ["## Evidence", `- Revision: ${evidence.revision ? shortRev(evidence.revision) : "(no repository)"}`];
+  if (evidence.clean != null) lines.push(`- Tree: ${evidence.clean ? "clean" : "uncommitted changes"}`);
+  if (!evidence.checked) lines.push("- Checks: none configured");
+  for (const r of evidence.results || []) lines.push(`- ${r.name}: \`${r.command}\` — ${describeResult(r)}`);
+  lines.push(`- Result: ${evidence.passed ? "passed" : "not passed"}`, "");
+  return lines.join("\n");
+}

package/cli/engine/hooks.mjs

@@ -19,6 +19,14 @@ export function isPublishCommand(command) {
   return PUBLISH_RE.test(String(command || ""));
 }
 
+// Commands that move HEAD or rewrite the tree. SUMMARY reports on an approved
+// revision; it must not be able to change which revision that is.
+const HISTORY_RE = /(^|[;&|]\s*)git\s+(commit|merge|rebase|reset|checkout|switch|cherry-pick|revert|am|apply|stash|restore|clean)\b/;
+
+export function isHistoryCommand(command) {
+  return HISTORY_RE.test(String(command || ""));
+}
+
 // The auditor whose sign-off gates publishing. "Sam's audit is a blocking
 // gate — not advisory" used to be prose; now it is the observable fact that a
 // Sam subagent finished in this EXECUTION phase (SubagentStop).
@@ -62,6 +70,16 @@ export function decidePreToolUse({ phase, input, state = {} }) {
     return { decision: "deny", reason: "REVIEW is read-only: report findings; fixes happen back in EXECUTION." };
   }
 
+  // The approval refers to one revision. SUMMARY may read it and talk about
+  // it; it may not edit, commit, move HEAD, or publish.
+  if (phase === "SUMMARY") {
+    if (MUTATING_TOOLS.has(tool)) return { decision: "deny", reason: "SUMMARY writes messages only — the approved revision must not change." };
+    const command = input?.tool_input?.command;
+    if (tool === "Bash" && (isPublishCommand(command) || isHistoryCommand(command))) {
+      return { decision: "deny", reason: "SUMMARY writes messages only — it cannot commit, move HEAD, or publish; the approved revision must not change." };
+    }
+  }
+
   if (phase === "EXECUTION" && tool === "Bash" && isPublishCommand(input?.tool_input?.command)) {
     const open = Array.isArray(state.openFindings) ? state.openFindings : [];
     if (state.awaitingAudit || open.length > 0) {

package/cli/engine/prompts.mjs

@@ -13,6 +13,7 @@ import { fileURLToPath } from "url";
 import { wrapUntrusted, PROMPT_SECURITY_HEADER, MEMORY_INSTRUCTIONS, loadProjectMemory } from "../prompt.mjs";
 import { generateContext } from "../detect.mjs";
 import { formatFindingsForRetry } from "./verdict.mjs";
+import { formatEvidenceForPrompt } from "./evidence.mjs";
 
 const here = dirname(fileURLToPath(import.meta.url));
 
@@ -133,7 +134,7 @@ function createTaskSection({ tracker, config, description }) {
 // Returns the full user prompt for one phase's query().
 export function renderPhasePrompt({
   phase, taskId, taskLink, description, createTask, tracker, config = {}, project = {},
-  sessionUrl, cwd, sessionMemory = "", retryVerdict = null,
+  sessionUrl, cwd, sessionMemory = "", retryVerdict = null, evidence = null,
 }) {
   const vars = {
     TASK_ID: taskId,
@@ -162,6 +163,9 @@ export function renderPhasePrompt({
   if (config.instructions) {
     body += `\n\n## ADDITIONAL INSTRUCTIONS\n\n${config.instructions}`;
   }
+  if (evidence) {
+    body += `\n\n## ENGINE VERIFICATION\n\nThe engine ran the project's own checks before this phase. Build on these observations; do not re-run the whole suite blind.\n\n${formatEvidenceForPrompt(evidence)}`;
+  }
   if (sessionMemory) {
     body += `\n\n## SESSION MEMORY (previous phases)\n\n${sessionMemory}`;
   }

package/cli/engine/session.mjs

@@ -28,6 +28,11 @@ import { agentsForPhase, modelForPhase, soloDefinition } from "./agents/index.mj
 import { renderPhasePrompt, renderSoloPrompt } from "./prompts.mjs";
 import { renderMemorySection } from "./schemas.mjs";
 import { verdictFromResult } from "./verdict.mjs";
+import {
+  resolveChecks, runChecks, createCheckRunner, evaluateApproval, evidenceFindings,
+  renderEvidenceSection, gitState, checkTimeoutMs, shortRev,
+} from "./evidence.mjs";
+import { spawnSandboxedCommand } from "./spawn.mjs";
 import { buildQueryOptions, defaultRunQuery } from "./query.mjs";
 import { armPublishGate, onSubagentStopped } from "./hooks.mjs";
 import { prepareWorkspace } from "../worktrees.mjs";
@@ -132,6 +137,7 @@ async function executeSession({
   onEvent, apiKey, serverUrl, sessionId, onChild, abortSignal,
   soloAgent = null, childStrategy = null,
   runQuery = defaultRunQuery,
+  runCheck = null,
   authCheck = checkClaudeAuth,
   sourceCwd = cwd, workspaceRecord, workspaceStateDir, resumingWorkspace = false,
   workspaceGitEnv = {},
@@ -226,6 +232,74 @@ async function executeSession({
   let reviewRetries = 0, phaseRuns = 0, lastVerdict = null, lastPhase = null;
   let isolationLogged = false;
 
+  // --- evidence (engine-owned) ---------------------------------------------
+  // The engine runs the project's checks itself before every REVIEW and pins
+  // any approval to the revision they ran at. In a session worktree the tree
+  // must be clean too: an approval refers to a committed revision.
+  const checks = resolveChecks({ config, project });
+  const requireClean = !!workspaceRecord;
+  const runOneCheck = runCheck || createCheckRunner({
+    spawnCommand: ({ command, cwd: checkCwd, env }) => spawnSandboxedCommand({
+      command, cwd: checkCwd, env, sandbox, onChild,
+      extraWritePaths: workspaceStateDir ? [workspaceStateDir, workspaceRecord.tree || cwd] : [],
+    }),
+  });
+  const headNow = () => gitState(cwd, workspaceGitEnv).revision;
+  let approvedRevision = null;
+
+  const reportEvidence = evidence => {
+    emit({ type: "session:evidence", phase: "REVIEW", revision: evidence.revision, clean: evidence.clean,
+      passed: evidence.passed, checked: evidence.checked, results: evidence.results });
+    const at = evidence.revision ? ` at ${shortRev(evidence.revision)}` : "";
+    if (!evidence.checked) {
+      emit({ type: "agent:message", agent: "Jane", tag: "SAY", message: `No verification commands configured (commands.test/build/lint) — review relies on the reviewers alone${at}.` });
+    }
+    for (const r of evidence.results) {
+      const took = `${(r.durationMs / 1000).toFixed(1)}s`;
+      const status = r.timedOut ? `timed out after ${took}` : r.exitCode === 0 ? `passed (${took})` : `FAILED (exit ${r.exitCode ?? "?"}, ${took})`;
+      emit({ type: "agent:message", agent: "Jane", tag: "ACT", message: `Ran \`${r.command}\`${at} — ${status}` });
+    }
+    if (evidence.requireClean && evidence.clean === false) {
+      emit({ type: "agent:message", agent: "Jane", tag: "SAY", message: "Uncommitted changes in the session worktree — review cannot approve an uncommitted state." });
+    }
+  };
+
+  // One place decides what a REVIEW outcome means for the loop, whether the
+  // verdict came from the reviewers or was synthesised from failed checks.
+  function settleReview(verdict) {
+    lastVerdict = verdict;
+    reviewResolved = verdict.approved === true;
+    if (reviewResolved) approvedRevision = verdict.headNow || verdict.revision || null;
+    state.openFindings = reviewResolved ? [] : verdict.findings;
+    try { writeFileSync(findingsPath, JSON.stringify(verdict, null, 2)); } catch {}
+    if (reviewResolved) return;
+    if (verdict.outcome === "MISSING") {
+      emit({ type: "session:error", code: "REVIEW_VERDICT_MISSING", message: `REVIEW ended without a verdict (${verdict.reason}) — treating as not approved.` });
+    } else if (verdict.outcome === "APPROVED") {
+      emit({ type: "session:error", code: "REVIEW_STALE", message: `Review approved ${shortRev(verdict.revision)} but the code is now at ${shortRev(verdict.headNow)} — the approval does not carry over.` });
+    }
+    const count = `${verdict.findings.length} finding(s)`;
+    if (reviewRetries < MAX_REVIEW_RETRIES) {
+      reviewRetries++;
+      const why = verdict.engineOnly ? `Verification failed (${count})` : `Review did not approve (${verdict.outcome}, ${count})`;
+      emit({ type: "agent:message", agent: "Jane", tag: "SAY", message: `${why} — returning to EXECUTION (retry ${reviewRetries}/${MAX_REVIEW_RETRIES}).` });
+      queue.unshift("EXECUTION", "REVIEW");
+    } else {
+      const why = verdict.engineOnly ? "Verification still failing" : "Review still unresolved";
+      emit({ type: "agent:message", agent: "Jane", tag: "SAY", message: `${why} after ${reviewRetries} retry — ending session for human review.` });
+    }
+  }
+
+  // An approval is void the moment the code moves past the reviewed revision.
+  const invalidateApproval = now => {
+    reviewResolved = false;
+    emit({ type: "session:error", code: "REVIEW_STALE", message: `Code changed after approval (${shortRev(approvedRevision)} → ${shortRev(now)}) — the approval no longer applies; ending for human review.` });
+    if (lastVerdict) {
+      lastVerdict = { ...lastVerdict, approved: false, approvalReason: "code changed after approval", headNow: now };
+      try { writeFileSync(findingsPath, JSON.stringify(lastVerdict, null, 2)); } catch {}
+    }
+  };
+
   const queue = solo ? ["SOLO"] : [...PHASES];
 
   try {
@@ -242,6 +316,27 @@ async function executeSession({
       const model = modelForPhase(phase === "SOLO" ? "EXECUTION" : phase, config.phaseModels);
       emit({ type: "phase:change", phase: phase === "SOLO" ? "EXECUTION" : phase, model: model || "default" });
 
+      // Verification runs before the reviewers are asked. If it fails, the
+      // reviewers are not asked at all: the failing output goes straight back
+      // to EXECUTION as findings, through the same retry path.
+      let evidence = null;
+      if (phase === "REVIEW") {
+        evidence = await runChecks({ checks, cwd, env: buildChildEnv({ dotenv, sandboxEnv: sandbox.env, extra: workspaceGitEnv }),
+          gitEnv: workspaceGitEnv, runCheck: runOneCheck, timeoutMs: checkTimeoutMs(config), signal: abortController.signal, requireClean });
+        if (abortController.signal.aborted) { aborted = true; break; }
+        reportEvidence(evidence);
+        appendMemory(renderEvidenceSection(evidence));
+        if (!evidence.passed) {
+          settleReview({ outcome: "NEEDS_MORE_WORK", findings: evidenceFindings(evidence), deferred: [], unverifiedClaims: [], reason: null,
+            revision: evidence.revision, headNow: evidence.revision, evidence, approved: false, approvalReason: "engine checks did not pass", engineOnly: true });
+          continue;
+        }
+      }
+      if (phase === "SUMMARY" && reviewResolved && approvedRevision) {
+        const now = headNow();
+        if (now !== approvedRevision) invalidateApproval(now);
+      }
+
       const { agents, allowedTools, lead } = solo
         ? soloDefinition(solo)
         : agentsForPhase({ phase, team, phaseModels: config.phaseModels });
@@ -252,7 +347,8 @@ async function executeSession({
           createTask: phase === "INTAKE" ? createTask : false,
           tracker, config, project, sessionUrl, cwd,
           sessionMemory: memoryText(),
-          retryVerdict: phase === "EXECUTION" && lastVerdict && lastVerdict.outcome !== "APPROVED" ? lastVerdict : null,
+          retryVerdict: phase === "EXECUTION" && lastVerdict && !lastVerdict.approved ? lastVerdict : null,
+          evidence,
         });
       if (workspaceRecord) {
         prompt += `\n\n## SESSION WORKSPACE\nAll file reads, writes, shell commands and Git operations must use ${cwd}.\nThe session branch ${workspaceRecord.branch} is already checked out; use it instead of creating or switching branches. The starting branch is ${workspaceRecord.baseRef}. Keep this branch until the session ends. Runtime session memory lives at ${memoryPath}.\n`;
@@ -319,24 +415,10 @@ async function executeSession({
 
       if (phase === "REVIEW") {
         const verdict = verdictFromResult({ is_error: summary.isError, subtype: summary.subtype, structured_output: summary.structuredOutput });
-        lastVerdict = verdict;
-        reviewResolved = verdict.outcome === "APPROVED";
-        state.openFindings = reviewResolved ? [] : verdict.findings;
+        const now = headNow();
+        const approval = evaluateApproval({ verdict, evidence, headNow: now });
         appendMemory(renderMemorySection("REVIEW", summary.structuredOutput));
-        try { writeFileSync(findingsPath, JSON.stringify(verdict, null, 2)); } catch {}
-
-        if (!reviewResolved) {
-          if (verdict.outcome === "MISSING") {
-            emit({ type: "session:error", code: "REVIEW_VERDICT_MISSING", message: `REVIEW ended without a verdict (${verdict.reason}) — treating as not approved.` });
-          }
-          if (reviewRetries < MAX_REVIEW_RETRIES) {
-            reviewRetries++;
-            emit({ type: "agent:message", agent: "Jane", tag: "SAY", message: `Review did not approve (${verdict.outcome}, ${verdict.findings.length} finding(s)) — returning to EXECUTION (retry ${reviewRetries}/${MAX_REVIEW_RETRIES}).` });
-            queue.unshift("EXECUTION", "REVIEW");
-          } else {
-            emit({ type: "agent:message", agent: "Jane", tag: "SAY", message: `Review still unresolved after ${reviewRetries} retry — ending session for human review.` });
-          }
-        }
+        settleReview({ ...verdict, revision: evidence?.revision ?? null, headNow: now, evidence, approved: approval.approved, approvalReason: approval.reason });
         continue;
       }
 
@@ -354,6 +436,12 @@ async function executeSession({
     sandbox.cleanup();
   }
 
+  // Belt to SUMMARY's braces: nothing may have moved the approved revision.
+  if (!aborted && reviewResolved && approvedRevision) {
+    const now = headNow();
+    if (now !== approvedRevision) invalidateApproval(now);
+  }
+
   const duration = seconds(startedAt);
   const status = finalStatus({ aborted, crashed: handoff, reviewResolved });
   const resumePath = join(cwd, ".agentdesk-resume.md");
@@ -373,5 +461,6 @@ async function executeSession({
     handoff: status !== "complete",
     aborted, status, reviewResolved, lastPhase,
     verdict: lastVerdict,
+    approvedRevision: reviewResolved ? approvedRevision : null,
   };
 }

package/cli/engine/spawn.mjs

@@ -35,6 +35,34 @@ export function bundledClaudeDir() {
   }
 }
 
+// One isolation policy for everything a session runs — Claude itself and the
+// engine's own verification commands. Shared Git metadata is exposed
+// read-only and the worktree's private Git state is protected, so a check
+// command has exactly the reach a Bash tool call inside the session has.
+function wrapForSession({ cmd, args, cwd, env = {}, sandbox, extraReadPaths = [], extraWritePaths = [] }) {
+  const sharedGit = workspaceGitPaths(cwd);
+  const wrapped = wrapIsolatedSpawn({
+    cmd, args, cwd,
+    scratchHome: sandbox.home,
+    extraReadPaths: [bundledClaudeDir(), ...sharedGit, ...extraReadPaths].filter(Boolean),
+    extraWritePaths,
+    protectedPaths: sharedGit.length ? [...sharedGit, join(env.GIT_WORK_TREE || cwd, ".git"), ...(env.GIT_DIR ? [join(dirname(env.GIT_DIR), "..", "git-pending")] : [])] : [],
+  });
+  if (sharedGit.length && wrapped.isolation.policy !== "strict") throw new Error("Worktree sessions require strict kernel isolation; shared Git metadata cannot be exposed writable.");
+  return wrapped;
+}
+
+// Run one shell command under the session's isolation, in its own process
+// group, tracked for teardown. Used by the engine's verification checks.
+export function spawnSandboxedCommand({ command, cwd, env, sandbox, extraReadPaths = [], extraWritePaths = [], onChild }) {
+  installExitGuards();
+  const wrapped = wrapForSession({ cmd: "/bin/sh", args: ["-c", command], cwd, env, sandbox, extraReadPaths, extraWritePaths });
+  const child = spawn(wrapped.cmd, wrapped.args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], shell: false, detached: true });
+  trackChild(child);
+  onChild?.(child);
+  return child;
+}
+
 // Build the `spawnClaudeCodeProcess` callback for one session.
 //
 //   sandbox      — result of createScratchHome() (its `home` hosts the profile)
@@ -46,17 +74,7 @@ export function createSandboxedSpawn({ sandbox, onChild, extraReadPaths = [], ex
   let reported = false;
 
   return function spawnClaudeCodeProcess(opts) {
-    const sharedGit = workspaceGitPaths(opts.cwd);
-    const wrapped = wrapIsolatedSpawn({
-      cmd: opts.command,
-      args: opts.args,
-      cwd: opts.cwd,
-      scratchHome: sandbox.home,
-      extraReadPaths: [bundledClaudeDir(), ...sharedGit, ...extraReadPaths].filter(Boolean),
-      extraWritePaths,
-      protectedPaths: sharedGit.length ? [...sharedGit, join(opts.env.GIT_WORK_TREE || opts.cwd, ".git"), ...(opts.env.GIT_DIR ? [join(dirname(opts.env.GIT_DIR), "..", "git-pending")] : [])] : [],
-    });
-    if (sharedGit.length && wrapped.isolation.policy !== "strict") throw new Error("Worktree sessions require strict kernel isolation; shared Git metadata cannot be exposed writable.");
+    const wrapped = wrapForSession({ cmd: opts.command, args: opts.args, cwd: opts.cwd, env: opts.env, sandbox, extraReadPaths, extraWritePaths });
 
     if (!reported) {
       reported = true;

package/cli/engine/verdict.mjs

@@ -64,7 +64,10 @@ export function verdictFromResult(result) {
 // reviewers' concrete list rather than re-deriving it.
 export function formatFindingsForRetry(verdict) {
   const lines = ["## Review findings to resolve", ""];
-  if (verdict.findings.length === 0 && verdict.unverifiedClaims.length === 0) {
+  if (verdict.approvalReason && verdict.outcome === "APPROVED") {
+    lines.push(`- **The reviewers approved, but the engine could not accept it** — ${verdict.approvalReason}. Re-verify at the current revision.`);
+  }
+  if (verdict.findings.length === 0 && verdict.unverifiedClaims.length === 0 && !verdict.approvalReason) {
     lines.push("- (review did not approve but listed no findings — re-verify every claim from the last execution)");
   }
   for (const f of verdict.findings) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.29.2",
+  "version": "0.30.0",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {
@@ -22,7 +22,7 @@
     "server": "node server/index.mjs",
     "build": "vite build",
     "preview": "vite preview",
-    "test": "node --test tests/server.test.mjs tests/agents.test.mjs tests/homepage.test.mjs tests/sessionUtils.test.mjs tests/tracker-url.test.mjs tests/session-preflight.test.mjs tests/access.test.mjs tests/project-ownership.test.mjs tests/random-hex.test.mjs tests/projects-registry.test.mjs tests/phase-loop.test.mjs tests/proc.test.mjs tests/crypto.test.mjs tests/dotenv.test.mjs tests/update-check.test.mjs tests/setup-helpers.test.mjs tests/project-key.test.mjs tests/tracker-project.test.mjs tests/tracker-check.test.mjs tests/config.test.mjs tests/engine-env.test.mjs tests/engine-events.test.mjs tests/engine-verdict.test.mjs tests/engine-hooks.test.mjs tests/engine-agents.test.mjs tests/session-isolation.test.mjs tests/engine-session.test.mjs tests/engine-prompts.test.mjs tests/engine-schemas.test.mjs tests/engine-claude-auth.test.mjs tests/worktrees.test.mjs tests/workspaces-api.test.mjs tests/engine-outcome.test.mjs tests/session-outcomes.test.mjs tests/outcome-hydration.test.mjs tests/mobile-outcomes.test.mjs tests/session-queue.test.mjs tests/useFollowScroll.test.mjs tests/session-usage.test.mjs tests/task-lookup.test.mjs",
+    "test": "node --test tests/server.test.mjs tests/agents.test.mjs tests/homepage.test.mjs tests/sessionUtils.test.mjs tests/tracker-url.test.mjs tests/session-preflight.test.mjs tests/access.test.mjs tests/project-ownership.test.mjs tests/random-hex.test.mjs tests/projects-registry.test.mjs tests/phase-loop.test.mjs tests/proc.test.mjs tests/crypto.test.mjs tests/dotenv.test.mjs tests/update-check.test.mjs tests/setup-helpers.test.mjs tests/project-key.test.mjs tests/tracker-project.test.mjs tests/tracker-check.test.mjs tests/config.test.mjs tests/engine-env.test.mjs tests/engine-events.test.mjs tests/engine-verdict.test.mjs tests/engine-hooks.test.mjs tests/engine-agents.test.mjs tests/session-isolation.test.mjs tests/engine-session.test.mjs tests/engine-prompts.test.mjs tests/engine-schemas.test.mjs tests/engine-claude-auth.test.mjs tests/worktrees.test.mjs tests/workspaces-api.test.mjs tests/engine-outcome.test.mjs tests/session-outcomes.test.mjs tests/outcome-hydration.test.mjs tests/mobile-outcomes.test.mjs tests/session-queue.test.mjs tests/useFollowScroll.test.mjs tests/session-usage.test.mjs tests/task-lookup.test.mjs tests/engine-evidence.test.mjs",
     "test:coverage": "node --test --experimental-test-coverage --test-coverage-include='cli/**' --test-coverage-include='server/**' --test-coverage-lines=60 --test-coverage-branches=62 tests/*.test.mjs",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",