@kylecheng3146/agent-ops 0.1.14 → 0.1.16

package/dist/packages/cli/src/commands/update.js

@@ -2,13 +2,15 @@ import { applyUpdatePlan, createUpdatePlan } from "../../../../runtime/src/insta
 import { okEnvelope } from "../output.js";
 import { formatOperationPlan } from "../plan-output.js";
 import { toPublicUpdatePlan } from "../public-plan.js";
-export function formatUpdatePlan(plan) {
+import { formatTrustChange, planTrustGrant } from "./trust.js";
+export function formatUpdatePlan(plan, trust) {
     const detectedVerification = plan.installation.detectedVerification;
     return formatOperationPlan({
         title: "Update plan",
         metadata: [
             `Target version: ${plan.targetVersion}`,
             `Harness: ${plan.installation.harness.join(", ")}`,
+            ...(trust === undefined ? [] : formatTrustChange(trust)),
             `Schema migrations: ${plan.migrationSteps.length === 0
                 ? "none"
                 : plan.migrationSteps
@@ -24,14 +26,27 @@ export function formatUpdatePlan(plan) {
         operations: toPublicUpdatePlan(plan).installation.operations
     });
 }
-function updateError(code, message, plan) {
+function updateError(code, message, plan, trust, applied = false) {
     return {
         code,
         status: "error",
-        data: { applied: false, plan: toPublicUpdatePlan(plan), message },
+        data: { applied, plan: toPublicUpdatePlan(plan, trust), message },
         errors: [{ code, message }]
     };
 }
+async function trustChange(options, plan) {
+    if (plan.installation.scope === "user") {
+        return { action: "skipped", reason: "user-scope" };
+    }
+    if (options.calculateTrustBinding === undefined ||
+        options.trustStore === undefined) {
+        return { action: "skipped", reason: "not-configured" };
+    }
+    const binding = await options.calculateTrustBinding(plan.installation.config);
+    return binding === null
+        ? { action: "skipped", reason: "no-verification-commands" }
+        : await planTrustGrant(binding, options.trustStore);
+}
 export async function runUpdateCommand(options) {
     const plan = await createUpdatePlan({
         root: options.root,
@@ -55,25 +70,37 @@ export async function runUpdateCommand(options) {
             ? {}
             : { hookTargets: options.hookTargets ?? options.args.hookTargets })
     });
+    const trust = await trustChange(options, plan);
     if (options.args.dryRun) {
         return okEnvelope("UPDATE_PLAN_READY", {
             applied: false,
-            plan: toPublicUpdatePlan(plan),
+            plan: toPublicUpdatePlan(plan, trust),
             message: "Update plan calculated; no files were changed.",
-            text: formatUpdatePlan(plan)
+            text: formatUpdatePlan(plan, trust)
         });
     }
     if (!options.args.yes && !options.isTTY) {
-        return updateError("UPDATE_CONFIRMATION_REQUIRED", "Non-interactive update requires --yes.", plan);
+        return updateError("UPDATE_CONFIRMATION_REQUIRED", "Non-interactive update requires --yes.", plan, trust);
     }
     if (!options.args.yes &&
-        !(await options.confirm(plan))) {
-        return updateError("UPDATE_CANCELLED", "Update was cancelled; no files were changed.", plan);
+        !(await options.confirm(plan, trust))) {
+        return updateError("UPDATE_CANCELLED", "Update was cancelled; no files were changed.", plan, trust);
     }
     await applyUpdatePlan(options.root, plan);
+    if (trust.action === "grant") {
+        try {
+            if (options.trustStore === undefined) {
+                throw new Error("Trust store is unavailable.");
+            }
+            await options.trustStore.grant(trust.binding);
+        }
+        catch {
+            return updateError("UPDATE_TRUST_FAILED", "Update was applied, but repository trust was not granted. Run `agent-ops trust grant --yes`.", plan, trust, true);
+        }
+    }
     return okEnvelope("UPDATE_APPLIED", {
         applied: true,
-        plan: toPublicUpdatePlan(plan),
+        plan: toPublicUpdatePlan(plan, trust),
         message: `Managed installation updated to ${plan.targetVersion}.`
     });
 }

package/dist/packages/cli/src/context.js

@@ -43,7 +43,7 @@ async function loadOptionalConfig(path) {
         throw error;
     }
 }
-export async function loadEffectiveConfig(root, scope) {
+export async function loadEffectiveConfig(root, scope, projectOverride) {
     const home = process.env.AGENT_OPS_HOME ?? homedir();
     const userPath = join(home, ".agent-ops", "config.json");
     const projectPath = join(root, ".agent-ops", "config.json");
@@ -69,7 +69,9 @@ export async function loadEffectiveConfig(root, scope) {
             });
         }
     }
-    const project = await loadOptionalConfig(projectPath);
+    const project = projectOverride === undefined
+        ? await loadOptionalConfig(projectPath)
+        : { sourcePath: projectPath, config: projectOverride };
     if (project !== null) {
         layers.push({
             source: "project",
@@ -154,15 +156,18 @@ export async function repositoryTrust(root, config, cliVersion) {
     const home = process.env.AGENT_OPS_HOME ?? homedir();
     const state = localStatePaths(home);
     try {
-        const binding = await calculateTrustBinding({
-            repositoryPath: root,
-            remoteUrl: repositoryRemoteUrl(root),
-            configHash: calculateConfigHash(config),
-            runtimeHash: sha256(cliVersion)
-        });
+        const binding = await repositoryTrustBinding(root, config, cliVersion);
         return (await new FileTrustStore(state.trustStore, state.anchorDirectory).status(binding)).status;
     }
     catch {
         return "UNTRUSTED";
     }
 }
+export async function repositoryTrustBinding(root, config, cliVersion) {
+    return await calculateTrustBinding({
+        repositoryPath: root,
+        remoteUrl: repositoryRemoteUrl(root),
+        configHash: calculateConfigHash(config),
+        runtimeHash: sha256(cliVersion)
+    });
+}

package/dist/packages/cli/src/public-plan.js

@@ -35,7 +35,7 @@ export function toPublicOperation(operation) {
 export function toPublicOperations(operations) {
     return operations.map(toPublicOperation);
 }
-export function toPublicInstallPlan(plan) {
+export function toPublicInstallPlan(plan, trust) {
     return {
         scope: plan.scope,
         harness: plan.harness,
@@ -43,21 +43,23 @@ export function toPublicInstallPlan(plan) {
         capabilities: plan.capabilities,
         manifest: plan.manifest,
         operations: toPublicOperations(plan.operations),
-        detectedVerification: plan.detectedVerification
+        detectedVerification: plan.detectedVerification,
+        ...(trust === undefined ? {} : { trust })
     };
 }
-export function toPublicUpdatePlan(plan) {
+export function toPublicUpdatePlan(plan, trust) {
     return {
         targetVersion: plan.targetVersion,
         migrationSteps: plan.migrationSteps,
-        installation: toPublicInstallPlan(plan.installation)
+        installation: toPublicInstallPlan(plan.installation, trust)
     };
 }
-export function toPublicUninstallPlan(plan) {
+export function toPublicUninstallPlan(plan, trust) {
     return {
         installed: plan.installed,
         manifest: plan.manifest,
         manifestHash: plan.manifestHash,
-        operations: toPublicOperations(plan.operations)
+        operations: toPublicOperations(plan.operations),
+        ...(trust === undefined ? {} : { trust })
     };
 }

package/dist/runtime/src/adapters/claude/config.js

@@ -12,6 +12,7 @@ const CLAUDE_LOOP_EVENTS = [
 ];
 const CLAUDE_HOOK_MARKER = "--managed-by=agent-ops";
 const CLAUDE_LOOP_LAUNCHER = "${CLAUDE_PROJECT_DIR}/.claude/hooks/agent-ops-loop.sh";
+const CLAUDE_WINDOWS_LOOP_LAUNCHER = "${CLAUDE_PROJECT_DIR}/.claude/hooks/agent-ops-loop.ps1";
 export function claudeSettingsTarget(scope) {
     return scope === "project"
         ? {
@@ -42,26 +43,35 @@ function matcherGroup(event, runtimePath) {
         hooks: [commandHook(event, runtimePath)]
     };
 }
-function loopMatcherGroup(event) {
+function powershellLoopCommand(event) {
+    return `& "${CLAUDE_WINDOWS_LOOP_LAUNCHER}" "${event}" "${CLAUDE_HOOK_MARKER}"`;
+}
+function loopMatcherGroup(event, platform) {
+    const hook = platform === "win32"
+        ? {
+            type: "command",
+            shell: "powershell",
+            command: powershellLoopCommand(event),
+            timeout: 30
+        }
+        : {
+            type: "command",
+            command: "bash",
+            args: [
+                CLAUDE_LOOP_LAUNCHER,
+                event,
+                CLAUDE_HOOK_MARKER
+            ],
+            timeout: 30
+        };
     return {
         ...(event === "PreToolUse" || event === "PermissionRequest"
             ? { matcher: "Bash" }
             : {}),
-        hooks: [
-            {
-                type: "command",
-                command: "bash",
-                args: [
-                    CLAUDE_LOOP_LAUNCHER,
-                    event,
-                    CLAUDE_HOOK_MARKER
-                ],
-                timeout: 30
-            }
-        ]
+        hooks: [hook]
     };
 }
-export function buildClaudeHookSettings(capabilities, runtimePath) {
+export function buildClaudeHookSettings(capabilities, runtimePath, platform = process.platform) {
     if (runtimePath.length === 0 ||
         runtimePath.length > 4096 ||
         runtimePath.includes("\0")) {
@@ -70,7 +80,7 @@ export function buildClaudeHookSettings(capabilities, runtimePath) {
     const hooks = {};
     if (capabilities.includes("project-loop")) {
         for (const event of CLAUDE_LOOP_EVENTS) {
-            hooks[event] = [loopMatcherGroup(event)];
+            hooks[event] = [loopMatcherGroup(event, platform)];
         }
     }
     else {
@@ -95,14 +105,20 @@ function isRecord(value) {
  * ours merely by carrying the marker string.
  */
 export function isClaudeManagedHandler(handler) {
-    if (!isRecord(handler) || !Array.isArray(handler.args)) {
+    if (!isRecord(handler) || handler.type !== "command") {
         return false;
     }
     return ((handler.command === "node" &&
+        Array.isArray(handler.args) &&
         handler.args[3] === CLAUDE_HOOK_MARKER) ||
         (handler.command === "bash" &&
+            Array.isArray(handler.args) &&
             handler.args[0] === CLAUDE_LOOP_LAUNCHER &&
-            handler.args[2] === CLAUDE_HOOK_MARKER));
+            handler.args[2] === CLAUDE_HOOK_MARKER) ||
+        (handler.shell === "powershell" &&
+            handler.args === undefined &&
+            typeof handler.command === "string" &&
+            CLAUDE_LOOP_EVENTS.some((event) => handler.command === powershellLoopCommand(event))));
 }
 function withoutOwnedHandlers(value) {
     if (!isRecord(value) || !Array.isArray(value.hooks)) {

package/dist/runtime/src/adapters/claude/output.js

@@ -8,6 +8,19 @@ function json(value) {
 export function claudeHookOutput(event, result) {
     const denialReason = result.remedy === undefined ? result.code : `${result.code}: ${result.remedy}`;
     if (event === "Stop" && result.evidence !== undefined) {
+        if (result.status === "FAIL") {
+            const failed = result.evidence.commandResults
+                .filter(({ exitCode }) => exitCode !== 0)
+                .map(({ commandId }) => commandId);
+            return json({
+                decision: "block",
+                reason: `agent-ops: ${result.code} reported FAIL for ${failed.join(", ")}. ` +
+                    "Resolve every failing item — an unsatisfied independent-review " +
+                    "gate is cleared by running `agent-ops review` to a PASS — then " +
+                    "stop again.",
+                evidence: result.evidence
+            });
+        }
         return json({
             systemMessage: `agent-ops: ${result.code}`,
             evidence: result.evidence

package/dist/runtime/src/hooks/stop-service.js

@@ -1,5 +1,8 @@
 import { calculateConfigHash } from "../config/hash.js";
 import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
+import { findReviewAttestation } from "../review/attestation.js";
+import { resolveReviewScope } from "../review/scope.js";
+import { calculateSourceFingerprint } from "../verify/source-fingerprint.js";
 import { aggregateVerificationStatus, executeConfiguredCommand } from "../verify/command-executor.js";
 import { collectChangeSurface } from "../verify/change-surface.js";
 import { selectVerificationScope } from "../verify/scope.js";
@@ -15,6 +18,7 @@ function commandById(config, commandId) {
     }
     return command;
 }
+export const REVIEW_GATE_COMMAND_ID = "independent-review";
 export class StopVerificationService {
     #options;
     constructor(options) {
@@ -39,6 +43,35 @@ export class StopVerificationService {
             throw stopError("STOP_VERIFICATION_UNCONFIRMED", "Stop verification configuration is stale or unconfirmed.");
         }
     }
+    /**
+     * Reports whether the current source state carries a passing independent
+     * review. Returns null when no gate applies: an unchanged tree, or a
+     * repository this service cannot inspect. Infrastructure that cannot answer
+     * stays fail-open — only a resolvable change surface with no attestation
+     * fails closed.
+     */
+    async #reviewGate() {
+        if ((this.#options.config.reviewRoles ?? []).length === 0) {
+            return null;
+        }
+        let fingerprint;
+        try {
+            const scope = await resolveReviewScope({
+                root: this.#options.root,
+                runner: this.#options.gitRunner
+            });
+            fingerprint = await calculateSourceFingerprint(this.#options.root, scope, this.#options.gitRunner);
+        }
+        catch {
+            return null;
+        }
+        const attestation = await findReviewAttestation(this.#options.root, fingerprint);
+        return {
+            commandId: REVIEW_GATE_COMMAND_ID,
+            exitCode: attestation === null ? 1 : 0,
+            testCount: null
+        };
+    }
     async verify() {
         this.#assertReady();
         const surface = await collectChangeSurface(this.#options.gitRunner);
@@ -57,13 +90,19 @@ export class StopVerificationService {
             });
             executions.push(result);
         }
-        const results = executions.map(({ commandId, exitCode, testCount }) => ({
-            commandId,
-            exitCode,
-            testCount
-        }));
+        const reviewGate = await this.#reviewGate();
+        const results = [
+            ...executions.map(({ commandId, exitCode, testCount }) => ({
+                commandId,
+                exitCode,
+                testCount
+            })),
+            ...(reviewGate === null ? [] : [reviewGate])
+        ];
         return {
-            status: aggregateVerificationStatus(executions),
+            status: reviewGate !== null && reviewGate.exitCode !== 0
+                ? "FAIL"
+                : aggregateVerificationStatus(executions),
             results
         };
     }

package/dist/runtime/src/install/codex-loop.js

@@ -36,6 +36,12 @@ export function loopLauncherPath(harness) {
 export function loopLauncherArtifactId(harness) {
     return `${harness}-loop-launcher`;
 }
+export function loopWindowsLauncherPath(harness) {
+    return `${loopRoot(harness)}/hooks/agent-ops-loop.ps1`;
+}
+export function loopWindowsLauncherArtifactId(harness) {
+    return `${harness}-loop-launcher-windows`;
+}
 function assertRuntimePath(runtimePath) {
     if (runtimePath.length === 0 ||
         runtimePath.length > 4096 ||
@@ -47,6 +53,9 @@ function assertRuntimePath(runtimePath) {
 function shellQuote(value) {
     return `'${value.replaceAll("'", "'\"'\"'")}'`;
 }
+function powershellQuote(value) {
+    return `'${value.replaceAll("'", "''")}'`;
+}
 function loopEntryPath(hookRuntimePath) {
     assertRuntimePath(hookRuntimePath);
     return `${hookRuntimePath.slice(0, -"hook-entry.js".length)}loop-entry.js`;
@@ -61,6 +70,17 @@ export function buildLoopLauncher(harness, hookRuntimePath) {
         ""
     ].join("\n");
 }
+export function buildPowerShellLoopLauncher(harness, hookRuntimePath) {
+    const runtimePath = loopEntryPath(hookRuntimePath);
+    return [
+        `# agent-ops: generated ${harness} Windows loop v1`,
+        "$ErrorActionPreference = \"Stop\"",
+        `$runtimePath = ${powershellQuote(runtimePath)}`,
+        `& node $runtimePath ${harness} @args`,
+        "exit $LASTEXITCODE",
+        ""
+    ].join("\n");
+}
 function statePaths(harness) {
     const root = loopRoot(harness);
     return [
@@ -120,12 +140,22 @@ export function planLoopContribution(options) {
     if (options.hookRuntimePath === undefined) {
         throw new AgentOpsError("LOOP_RUNTIME_REQUIRED", "The loop profile requires the installed hook runtime path.");
     }
-    return {
-        artifacts: harnesses.map((harness) => ({
+    const artifacts = harnesses.flatMap((harness) => [
+        {
             id: loopLauncherArtifactId(harness),
             path: loopLauncherPath(harness),
             content: buildLoopLauncher(harness, options.hookRuntimePath ?? "")
-        })),
+        },
+        ...(harness === "claude"
+            ? [{
+                    id: loopWindowsLauncherArtifactId(harness),
+                    path: loopWindowsLauncherPath(harness),
+                    content: buildPowerShellLoopLauncher(harness, options.hookRuntimePath ?? "")
+                }]
+            : [])
+    ]);
+    return {
+        artifacts,
         blocks: [
             {
                 id: LOOP_MARKER_ID,

package/dist/runtime/src/install/harness.js

@@ -136,7 +136,7 @@ const DESCRIPTORS = {
         hookPath: ".claude/settings.json",
         surfaces: claudeSurfaces,
         ownSettingsKeys: ["hooks"],
-        buildHooks: (capabilities, runtimePath) => buildClaudeHookSettings(capabilities, runtimePath),
+        buildHooks: (capabilities, runtimePath, platform) => buildClaudeHookSettings(capabilities, runtimePath, platform),
         mergeHooks: (existing, managed) => mergeClaudeSettings(existing, managed),
         stripHooks: (existing) => stripClaudeManagedHooks(existing),
         isManagedHandler: isClaudeManagedHandler,
@@ -244,7 +244,7 @@ export function managedRules(descriptor, context) {
         ""
     ];
     if (context.capabilities.includes("rules")) {
-        lines.push("For every change:", "", "1. Define two to five mechanically verifiable acceptance criteria.", "2. Inspect the smallest relevant scope and preserve unrelated changes.", "3. Apply the smallest safe change.", "4. Run evidence-producing verification for every criterion.", "5. Obtain independent review before claiming completion, via", "   `agent-ops review` (or the CLI's equivalent invocation). Never call a", "   review-target CLI (agy, codex, claude) directly — direct calls skip", "   the enforced read-only sandbox flags and can hang or fail on command", "   permission prompts.", "", "Treat `.agent-ops/config.json` as verifier authority. Discovery output is", "only a proposal until a user confirms it. Repository commands require an", "explicit matching trust record; installation approval never grants trust.", "");
+        lines.push("For every change:", "", "1. Define two to five mechanically verifiable acceptance criteria.", "2. Inspect the smallest relevant scope and preserve unrelated changes.", "3. Apply the smallest safe change.", "4. Run evidence-producing verification for every criterion.", "5. Obtain independent review before claiming completion, via", "   `agent-ops review --yes` (or the CLI's equivalent invocation). Never call a", "   review-target CLI (agy, codex, claude) directly — direct calls skip", "   the enforced read-only sandbox flags and can hang or fail on command", "   permission prompts.", "", "Treat `.agent-ops/config.json` as verifier authority. Discovery output is", "only a proposal until a user confirms it. Repository commands require an", "exact matching trust record. Confirmed project init/update grants it", "automatically when verification commands are configured.", "");
     }
     if (context.capabilities.includes("lifecycle-summary")) {
         lines.push("Advisory lifecycle summaries and local logs are informational. Advisory", "failures must remain fail-open and cannot become verification evidence.", "");

package/dist/runtime/src/install/hooks.js

@@ -34,7 +34,7 @@ export function planHookRegistration(options) {
         return null;
     }
     const path = options.path ?? hookRegistrationPath(options.harness, options.scope);
-    const managed = descriptor.control.buildHooks(options.capabilities, options.runtimePath);
+    const managed = descriptor.control.buildHooks(options.capabilities, options.runtimePath, options.platform);
     const events = Object.keys(managed.hooks);
     if (events.length === 0) {
         return null;

package/dist/runtime/src/install/ownership.js

@@ -2,7 +2,7 @@ import { applyManagedBlock, managedBlockMarkers } from "../fs/managed-block.js";
 import { AgentOpsError } from "../fs/paths.js";
 import { harnessDescriptor, harnessHookPath, routingBlockId, selectHarnessHookSurface, rulesArtifactId } from "./harness.js";
 import { isOpencodePluginPath } from "../adapters/opencode/config.js";
-import { LOOP_MARKER_ID, LOOP_MARKER_VERSION, loopIgnoreContent, loopLauncherArtifactId, loopLauncherPath, selectedLoopHarnesses } from "./codex-loop.js";
+import { LOOP_MARKER_ID, LOOP_MARKER_VERSION, loopIgnoreContent, loopLauncherArtifactId, loopWindowsLauncherArtifactId, loopWindowsLauncherPath, loopLauncherPath, selectedLoopHarnesses } from "./codex-loop.js";
 function expectedMarker(manifest, id, markerId) {
     const descriptor = harnessDescriptor(id);
     const markers = managedBlockMarkers(markerId, 1, "html");
@@ -76,10 +76,13 @@ export function assertSupportedManifestOwnership(manifest, root) {
     const requiredArtifactPaths = new Set([
         pathKey(".agent-ops/config.json")
     ]);
+    const optionalArtifactPaths = new Set();
     const expectedMarkers = new Map();
     const expectedMarkerPaths = new Set();
     const loopHarnesses = selectedLoopHarnesses(harnesses);
-    const hasLoopArtifacts = manifest.artifacts.some(({ id }) => loopHarnesses.some((harness) => id === loopLauncherArtifactId(harness)));
+    const hasLoopArtifacts = manifest.artifacts.some(({ id }) => loopHarnesses.some((harness) => id === loopLauncherArtifactId(harness) ||
+        (harness === "claude" &&
+            id === loopWindowsLauncherArtifactId(harness))));
     const hasLoopMarker = manifest.markers.some(({ id }) => id === LOOP_MARKER_ID);
     const hasLoop = hasLoopArtifacts || hasLoopMarker;
     if (hasLoop &&
@@ -140,6 +143,16 @@ export function assertSupportedManifestOwnership(manifest, root) {
                 ids: new Set([loopLauncherArtifactId(harness)])
             });
             requiredArtifactPaths.add(pathKey(path));
+            if (harness === "claude") {
+                const windowsPath = loopWindowsLauncherPath(harness);
+                expectedArtifactPaths.set(pathKey(windowsPath), {
+                    path: windowsPath,
+                    ids: new Set([loopWindowsLauncherArtifactId(harness)])
+                });
+                // Older loop manifests predate the Windows launcher. Accept them so
+                // update and uninstall remain backward-compatible.
+                optionalArtifactPaths.add(pathKey(windowsPath));
+            }
         }
         expectedMarkerPaths.add(pathKey(".gitignore"));
         expectedMarkers.set(LOOP_MARKER_ID, expectedLoopMarker(manifest));
@@ -148,13 +161,16 @@ export function assertSupportedManifestOwnership(manifest, root) {
         ? recordedOpencodePluginPath ??
             harnessHookPath("opencode", manifest.scope, root)
         : null;
-    const optionalArtifactCount = opencodePluginPath !== null &&
-        expectedArtifactPaths.has(pathKey(opencodePluginPath))
-        ? 1
-        : 0;
-    if ((manifest.artifacts.length !== requiredArtifactPaths.size &&
-        manifest.artifacts.length !== requiredArtifactPaths.size +
-            optionalArtifactCount) ||
+    if (opencodePluginPath !== null &&
+        expectedArtifactPaths.has(pathKey(opencodePluginPath))) {
+        optionalArtifactPaths.add(pathKey(opencodePluginPath));
+    }
+    const optionalArtifactCount = [...optionalArtifactPaths].filter((path) => expectedArtifactPaths.has(path)).length;
+    const manifestArtifactPaths = new Set(manifest.artifacts.map(({ path }) => pathKey(path)));
+    if ([...requiredArtifactPaths].some((path) => !manifestArtifactPaths.has(path)) ||
+        manifest.artifacts.length < requiredArtifactPaths.size ||
+        manifest.artifacts.length >
+            requiredArtifactPaths.size + optionalArtifactCount ||
         manifest.markers.length !== expectedMarkerPaths.size) {
         throw manifestOwnershipError();
     }

package/dist/runtime/src/install/plan.js

@@ -71,7 +71,7 @@ async function detectVerificationCommands(root) {
         .filter((proposal) => proposal.confidence === "high")
         .map(verificationCommandFromProposal);
 }
-function formatConfig(profiles, existing, reviewTargets = [], detectedCommands = []) {
+function buildConfig(profiles, existing, reviewTargets = [], detectedCommands = []) {
     // Absent reviewRoles means external review is disabled; an empty selection
     // must therefore omit the field rather than write an empty array.
     const reviewRoles = reviewTargets.length > 0
@@ -80,10 +80,10 @@ function formatConfig(profiles, existing, reviewTargets = [], detectedCommands =
     const verification = existing?.verification !== undefined &&
         existing.verification.commands.length > 0
         ? existing.verification
-        : { commands: detectedCommands };
-    return `${JSON.stringify({
+        : { commands: [...detectedCommands] };
+    return {
         schemaVersion: CONFIG_SCHEMA_VERSION,
-        profiles,
+        profiles: [...profiles],
         verification,
         features: existing?.features ?? {
             stopVerification: {
@@ -92,8 +92,8 @@ function formatConfig(profiles, existing, reviewTargets = [], detectedCommands =
         },
         pathMappings: existing?.pathMappings ?? [],
         securityExceptions: existing?.securityExceptions ?? [],
-        ...(reviewRoles === undefined ? {} : { reviewRoles })
-    }, null, 2)}\n`;
+        ...(reviewRoles === undefined ? {} : { reviewRoles: [...reviewRoles] })
+    };
 }
 async function planConfig(root, profiles, existingManifest, suppliedConfig, reviewTargets = []) {
     const current = await readCurrentFile(root, CONFIG_PATH);
@@ -131,7 +131,8 @@ async function planConfig(root, profiles, existingManifest, suppliedConfig, revi
         existingConfig.verification.commands.length === 0
         ? await detectVerificationCommands(root)
         : [];
-    const content = formatConfig(profiles, existingConfig, reviewTargets, detectedCommands);
+    const config = buildConfig(profiles, existingConfig, reviewTargets, detectedCommands);
+    const content = `${JSON.stringify(config, null, 2)}\n`;
     return {
         operation: {
             kind: "write",
@@ -145,6 +146,7 @@ async function planConfig(root, profiles, existingManifest, suppliedConfig, revi
             hash: sha256(content),
             owner: "agent-ops"
         },
+        config,
         detectedVerification: detectedCommands
     };
 }
@@ -502,6 +504,7 @@ export async function createInstallPlan(options) {
                 path: hookPath,
                 capabilities: resolved.capabilities,
                 runtimePath: options.hookRuntimePath,
+                platform: options.platform,
                 currentSource: current?.content ?? null
             });
             if (planned === null) {
@@ -567,6 +570,7 @@ export async function createInstallPlan(options) {
         harness: options.harness,
         profiles: resolved.profiles,
         capabilities: resolved.capabilities,
+        config: config.config,
         manifest,
         operations,
         detectedVerification: config.detectedVerification

package/dist/runtime/src/install/probes.js

@@ -30,8 +30,8 @@ export function smokeAvailabilityStatus(config) {
     return config.verification.commands.length > 0 ? "PASS" : "UNKNOWN";
 }
 /**
- * Installation approval never grants trust, so an ungranted repository is
- * unconfigured rather than broken. A stale binding is a real failure.
+ * User-scope installs and projects without verification commands can remain
+ * untrusted without being broken. A stale binding is a real failure.
  */
 export function repositoryTrustStatus(trust) {
     return trust === "TRUSTED"