@kylecheng3146/agent-ops 0.1.19 → 0.1.21

package/docs/en/guides/configuration.md

@@ -2,21 +2,24 @@
 
 Keep project configuration explicit and layered. Choose scope, harness, and profile deliberately; do not infer trust or security exceptions from `--yes`.
 
-Use `--harness all` to select Codex, Claude Code, and opencode, or pass a
+Use `--harness all` to select agy, Codex, Claude Code, and opencode, or pass a
 comma-separated subset such as `codex,opencode`. `both` remains an input alias
 for the legacy Codex plus Claude selection.
 
-Project Codex and opencode installations share the managed supplemental
-`AGENTS.md` routing block and the `.agent-ops/AGENTS.md` rules artifact. The
-block loads the managed baseline while project-specific instructions remain
-authoritative. Claude uses the corresponding `CLAUDE.md` route and
+Project agy uses a managed supplemental `GEMINI.md` routing block and
+`.agent-ops/GEMINI.md` baseline. This follows the official agy CLI rule that a
+workspace-root `GEMINI.md` or `AGENTS.md` is loaded at startup. Codex and
+opencode share the corresponding `AGENTS.md` route and `.agent-ops/AGENTS.md`
+artifact. Each block loads the managed baseline while project-specific
+instructions remain authoritative. Claude uses the corresponding `CLAUDE.md` route and
 `.agent-ops/CLAUDE.md` artifact. Opencode additionally gets
 the agent-ops-owned `.opencode/plugins/agent-ops.js` file; `opencode.json` is
 never modified. The plugin is generated with the installed absolute runtime
 path, so update it through `agent-ops update` rather than editing it manually.
 
-At user scope, Codex and opencode keep separate routing files under `.codex/`
-and `.opencode/`; the global opencode plugin is placed under
+At user scope, agy uses `.agent-ops/GEMINI.md` and the shared Gemini surface
+`.gemini/GEMINI.md`; Codex and opencode keep separate routing files under
+`.codex/` and `.opencode/`. The global opencode plugin is placed under
 `.config/opencode/plugins/`, or under `$XDG_CONFIG_HOME/opencode/plugins/`
 when that variable points inside the managed user root. If OpenCode is
 configured with `$OPENCODE_CONFIG_DIR`, the plugin is placed under its
@@ -52,7 +55,8 @@ A bare review uses the built-in `change-quality` criterion; `--task` uses the
 task criteria and requires fresh PASS evidence for required checks. The full
 report is printed, and PASS persists only a source-fingerprint attestation.
 
-Every attempt starts from a fresh temporary cwd and native read-only mode.
+Every attempt starts from a fresh session and disposable repository clone with
+native read-only mode.
 Claude uses complete safe-mode isolation. Codex and Agy preserve their existing
 login environment to support normal OAuth sessions, so they provide weaker
 context isolation. Agy receives a disposable clone and cannot modify the source
@@ -64,6 +68,10 @@ repository even if sandboxed plan mode writes to its cwd:
 | `agy` | `agy --print <prompt>` | `--sandbox --mode plan` |
 | `claude` | `claude -p` | `--permission-mode plan --safe-mode` |
 
+The chain prefers a target different from the hosting CLI. If no other target
+is usable, a fresh same-target session is allowed but is reported as
+`DEGRADED: isolated self-review`; a development session is never resumed.
+
 `opencode` is **not** a review target even though it is a supported harness.
 Its `--agent plan` is rejected as a subagent and silently falls back to a
 writable agent, so it cannot satisfy the read-only precondition. A target with
@@ -135,7 +143,28 @@ Claude's generated settings select the PowerShell launcher. Codex also gets
 harness directory. A hash-commented `.gitignore` block ignores those local
 files.
 
-The loop runs `SessionStart`, `UserPromptSubmit`, `PreToolUse`,
+For agy, the loop uses the native `PreInvocation` and `PreToolUse(run_command)`
+subset and is reported as degraded. Project hooks live in `.agents/hooks.json`;
+user hooks live in `.gemini/config/hooks.json`. User-scope rules modify the
+shared Gemini rule surface at `.gemini/GEMINI.md`. agy 1.1.12 or newer is
+required for machine-readable `/hooks` diagnostics.
+
+For `agy` plus `loop`, the interactive installer recommends
+`features.completionGate.enabled`; non-interactive installs require the explicit
+`--completion-gate` flag. The gate uses the documented `conversationId`,
+`terminationReason`, and `fullyIdle` Stop fields and returns the documented
+`decision: "continue"` only for a final changed conversation that lacks current
+task, verification, or review proof. Pure Q&A, analysis, read-only diagnostics,
+error stops, max-step stops, and non-idle stops continue normally. It does not
+change Codex, Claude Code, or OpenCode Stop behavior. For headless execution use
+`agent-ops agy-run -- <agy arguments>`; a user-approved one-time escape is
+`agent-ops allow-stop --session <conversationId>` and is guarded by agy's
+documented `force_ask` decision.
+
+Official references: [agy CLI workspace rule files](https://www.antigravity.google/docs/cli/best-practices/)
+and [Antigravity hook contracts](https://www.antigravity.google/docs/hooks/).
+
+The full Codex/Claude loop runs `SessionStart`, `UserPromptSubmit`, `PreToolUse`,
 `PermissionRequest`, `PostToolUse`, `PreCompact`, `PostCompact`,
 `SubagentStart`, and `SubagentStop`, but never adds `Stop`. It blocks only
 high-confidence literal secrets in prompts or Bash commands, plus dangerous
@@ -171,8 +200,9 @@ classified invalid installed configuration. The managed OpenCode
 `tool.execute.before` plugin can throw its documented command-policy denial or
 unavailable-runtime error for its supported Bash surface. Codex is explicitly
 non-enforcing (`unknown`). These are agent-ops output and plugin contracts, not
-proof that a host honors a denial. `SessionStart` and `Stop` failure paths stay
-fail-open for every adapter.
+proof that a host honors a denial. `SessionStart` and ordinary Stop verification
+failure paths stay fail-open. Only the explicitly enabled agy completion gate
+fails closed at final Stop.
 
 Claude's invalid-config fallback has four safeguards: (1) an absent project
 configuration stays fail-open, so only an invalid `.agent-ops/config.json` can
@@ -184,7 +214,7 @@ that shell variable. The variable is read only from the hook-process environment
 and cannot be set in agent-ops configuration, a manifest, or managed files.
 
 `guardrails` installs command policy but does not enable Stop verification. Stop
-is a separate config-v2 feature and must be explicitly enabled with at least
+is a separate config-v3 feature and must be explicitly enabled with at least
 one confirmed command:
 
 ```json
@@ -237,6 +267,10 @@ To narrow an existing installation, pass the desired list to `agent-ops update
 --harness`; shared paths remain managed while removed harness-owned artifacts,
 markers, and hooks are reconciled.
 
+To remove only one integrated harness, use `agent-ops uninstall --harness agy`
+(or another installed id). The remaining manifest and shared paths stay in
+place; omit `--harness` to remove the complete managed installation.
+
 Installations using the previous canonical routing wording are migrated by
 `agent-ops update`. If a managed block was edited, the command fails closed
 until the change is reviewed.

package/docs/en/spec/README.md

@@ -2,11 +2,14 @@
 
 This is the normative English specification for bounded, evidence-driven work.
 
-The harness adapter rules cover Codex, Claude Code, and opencode. The opencode
-integration is a generated local plugin; it does not manage `opencode.json`.
+The harness adapter rules cover agy, Codex, Claude Code, and opencode. The
+opencode integration is a generated local plugin; it does not manage
+`opencode.json`. agy uses project `GEMINI.md` routing, uses native hooks, and
+is explicitly degraded where its lifecycle surface is smaller than the full
+loop.
 
-Configuration is versioned independently from the manifest. Config v1 migrates
-to config v2 with Stop verification disabled; changing the capability requires
+Configuration is versioned independently from the manifest. Older configs migrate
+to config v3 with Stop verification and the agy completion gate disabled; changing a capability requires
 a confirmed project `agent-ops update`, which also refreshes trust when
 verifiers exist. Stop verification is
 explicit, trusted, report-only, and never completes a task. Dry-run plans keep

package/docs/en/spec/harness-adapters.md

@@ -6,7 +6,9 @@ documentation](https://bun.sh/docs/runtime/shell) on 2026-07-31. Codex and
 Claude Code loop-hook behavior was checked against their [Codex hook
 documentation](https://developers.openai.com/codex/config-advanced#hooks) and
 [Claude Code hook documentation](https://code.claude.com/docs/en/hooks) on
-2026-08-03. Revalidate: when any vendor reference changes.
+2026-08-03. Agy hook behavior was checked against the [official Antigravity
+hook documentation](https://antigravity.google/docs/hooks) on 2026-08-28.
+Revalidate: when any vendor reference changes.
 
 ## HARNESS-ADAPTER-001
 
@@ -80,14 +82,17 @@ decoding, normalized events, native output encoding, and runtime-failure output.
 ## HARNESS-ADAPTER-006
 
 The project-local `loop` profile MUST be opt-in, project scoped, and use one
-shared runtime behind minimal Codex and Claude Code launchers. It MUST NOT copy
+shared runtime behind minimal Codex and Claude Code launchers; agy uses its
+native supported lifecycle subset and is reported as degraded. It MUST NOT copy
 policy into project-specific scripts or alter an ordinary permission request.
 
-- Trigger: A project selects `loop` with Codex, Claude Code, or both.
+- Trigger: A project selects `loop` with agy, Codex, Claude Code, or any combination.
 - Action: Generate only the selected `.codex/hooks/agent-ops-loop.sh` and/or
   Claude's `.claude/hooks/agent-ops-loop.sh` plus
   `.claude/hooks/agent-ops-loop.ps1` launchers, register the documented loop
-  lifecycle events except `Stop`, and preserve foreign hook groups. Block only
+  lifecycle events except `Stop`, and preserve foreign hook groups. For agy,
+  register only native `PreInvocation`/`PreToolUse(run_command)` hooks and do
+  not generate a shell launcher. Block only
   high-confidence literal credentials at `UserPromptSubmit` or Bash
   `PreToolUse`, and dangerous Bash commands at `PreToolUse`, using the documented native denial shape. Emit no
   decision for `PermissionRequest`, including escalated permissions.
@@ -99,11 +104,12 @@ policy into project-specific scripts or alter an ordinary permission request.
 
 The current registration matrix is intentionally asymmetric:
 
-| Capability | Codex | Claude Code | OpenCode |
-| --- | --- | --- | --- |
-| lifecycle-summary | supported | supported | degraded |
-| command-policy | unknown | supported | supported |
-| optional-stop-verify | unsupported | supported | degraded |
+| Capability | agy | Codex | Claude Code | OpenCode |
+| --- | --- | --- | --- | --- |
+| lifecycle-summary | degraded | supported | supported | degraded |
+| command-policy | supported | unknown | supported | supported |
+| completion-gate | supported | unsupported | unsupported | unsupported |
+| optional-stop-verify | degraded | unsupported | supported | degraded |
 
 For runtime-failure handling, only `command-policy` is fail-closed. Claude
 Code can emit its documented `PreToolUse` denial shape for a classified invalid
@@ -113,6 +119,15 @@ surface. Codex remains `unknown` and never emits a denial. Fixture tests assert
 these wire and plugin shapes only; they do not prove that a host honors a
 denial. Every `SessionStart` and `Stop` failure path remains fail-open.
 
+The agy adapter uses native project `GEMINI.md` routing to
+`.agent-ops/GEMINI.md`;
+at user scope it manages `.agent-ops/GEMINI.md` and a managed block in the
+shared `.gemini/GEMINI.md` rule surface. Its native hooks use camelCase input,
+return `decision: "deny"` for command-policy blocks, and, only when the
+completion gate is explicitly enabled, return `decision: "continue"` for an
+unproven final changed conversation. Read-only conversations stop normally.
+On Windows the generated command is invoked through `cmd /c`.
+
 Stop verification is explicit, trusted, report-only, and disabled by default.
 Every Stop result continues the native harness and may carry only bounded
 command evidence; it is never task-completion evidence.

package/docs/en/spec/review.md

@@ -42,6 +42,12 @@ without one MUST be skipped rather than run unsandboxed.
 - Positive: `agy receives sandboxed plan mode; opencode remains ineligible.`
 - Negative: `Trust the prompt to stop the reviewer from editing files.`
 
+Every attempted review MUST run in a fresh session (`sessionIsolation:
+"fresh"`) and in a disposable repository clone. The reviewer chain prefers a
+different CLI from the hosting CLI; when no other usable target exists,
+same-target fresh review is allowed but MUST render as `DEGRADED: isolated
+self-review`. A resumed development session is never an independent review.
+
 ## REVIEW-CHAIN-001
 
 Configured targets form an ordered fallback chain that MUST advance only when

package/docs/zh-TW/guides/configuration.md

@@ -2,20 +2,23 @@
 
 保持 project 設定明確且分層。請刻意選擇 scope、harness 與 profile；不要從 `--yes` 推論 trust 或安全例外。
 
-使用 `--harness all` 選取 Codex、Claude Code 與 opencode，或傳入
+使用 `--harness all` 選取 agy、Codex、Claude Code 與 opencode，或傳入
 `codex,opencode` 這類逗號分隔的子集。`both` 仍是 legacy Codex 加 Claude
 selection 的 input alias。
 
-Project Codex 與 opencode installation 共用 managed supplemental
-`AGENTS.md` routing block 與 `.agent-ops/AGENTS.md` rules artifact。該 block
-只載入 managed baseline，並保留 project-specific instructions 的權威性。
+Project agy 使用 managed supplemental `GEMINI.md` routing block 與
+`.agent-ops/GEMINI.md` baseline；這符合 agy CLI 官方文件所述，啟動時會讀取
+workspace root 的 `GEMINI.md` 或 `AGENTS.md`。Codex 與 opencode 共用
+`AGENTS.md` route 與 `.agent-ops/AGENTS.md` artifact。這些 block 只載入
+managed baseline，並保留 project-specific instructions 的權威性。
 Claude 使用對應的 `CLAUDE.md` route 與 `.agent-ops/CLAUDE.md` artifact。Opencode 另外取得
 agent-ops 擁有的 `.opencode/plugins/agent-ops.js`；不會修改 `opencode.json`。
 Plugin 使用安裝時的 absolute runtime path 產生，因此請透過
 `agent-ops update` 更新，不要手動編輯。
 
-User scope 下，Codex 與 opencode 的 routing file 分別位於 `.codex/` 與
-`.opencode/`；global opencode plugin 預設位於 `.config/opencode/plugins/`，
+User scope 下，agy 使用 `.agent-ops/GEMINI.md` 與共用 Gemini surface
+`.gemini/GEMINI.md`；Codex 與 opencode 的 routing file 分別位於 `.codex/` 與
+`.opencode/`。Global opencode plugin 預設位於 `.config/opencode/plugins/`，
 若 `$XDG_CONFIG_HOME` 指向 managed user root 內的目錄，則改用
 `$XDG_CONFIG_HOME/opencode/plugins/`。若 OpenCode 設定了
 `$OPENCODE_CONFIG_DIR`，則 plugin 會放在其 `plugins/` 目錄。只有 profile
@@ -46,7 +49,7 @@ Claude 與 Codex lifecycle support 為 `supported`，OpenCode 從 app initializa
 `--task` 使用 task criteria，並要求必要驗證的最新 PASS evidence。完整 report
 會顯示給人看，PASS 後只持久化 source-fingerprint attestation。
 
-每次嘗試都從新的暫存 cwd 與原生唯讀模式啟動。Claude 使用完整 safe-mode
+每次嘗試都從全新 session、一次性 repository clone 與原生唯讀模式啟動。Claude 使用完整 safe-mode
 隔離；Codex 與 Agy 為了支援既有 OAuth 登入而保留登入環境，因此 context
 隔離較弱。Agy 會取得一次性 clone，即使 sandboxed plan mode 寫入 cwd，也無法
 修改來源 repository：
@@ -57,6 +60,10 @@ Claude 與 Codex lifecycle support 為 `supported`，OpenCode 從 app initializa
 | `agy` | `agy --print <prompt>` | `--sandbox --mode plan` |
 | `claude` | `claude -p` | `--permission-mode plan --safe-mode` |
 
+review chain 優先選擇不同於 hosting CLI 的 target。沒有其他可用 target 時，才允許
+全新的同 CLI session，但輸出會標示 `DEGRADED: isolated self-review`；不得 resume
+開發 session。
+
 `opencode` **不是** review 目標，即使它是支援的 harness。它的 `--agent plan`
 會被判定為 subagent 而遭拒，並靜默退回可寫入的 agent，因此無法滿足唯讀前置
 條件。沒有唯讀旗標的目標會被跳過，不會在無沙箱狀態下執行。
@@ -121,7 +128,26 @@ launcher。Codex 只會在 `.codex/config.toml` 不存在時建立它。首次
 `loop-state.md` 與 `loop-telemetry.jsonl`；並以 hash-commented `.gitignore`
 block 忽略這些 local file。
 
-Loop 會執行 `SessionStart`、`UserPromptSubmit`、`PreToolUse`、
+agy 會安裝原生 `PreInvocation` 與 `PreToolUse(run_command)` 子集，doctor
+會將 loop 標示為 degraded。Project hook 位於 `.agents/hooks.json`，user hook
+位於 `.gemini/config/hooks.json`；user scope 會修改共享 Gemini rule surface
+`.gemini/GEMINI.md`。機器可讀的 `/hooks` 診斷要求 agy 1.1.12 以上。
+
+`agy` 搭配 `loop` 時，互動式 installer 會建議啟用
+`features.completionGate.enabled`；非互動安裝必須明確傳入
+`--completion-gate`。閘門使用官方定義的 `conversationId`、
+`terminationReason` 與 `fullyIdle` Stop 欄位，只有在本次 conversation 產生
+Git-visible net change 且缺少當前 task、驗證或 review 證據時，才回傳官方定義的
+`decision: "continue"`。純問答、分析、唯讀診斷、錯誤、max-step 與 non-idle Stop
+都正常結束；本版不改變 Codex、Claude Code 或 OpenCode 的 Stop 行為。Headless
+請使用 `agent-ops agy-run -- <agy arguments>`；使用者可核准一次
+`agent-ops allow-stop --session <conversationId>`，該命令由官方定義的
+`force_ask` 強制詢問。
+
+官方依據：[agy CLI workspace rule file](https://www.antigravity.google/docs/cli/best-practices/)
+與 [Antigravity hook contract](https://www.antigravity.google/docs/hooks/)。
+
+完整 Codex/Claude loop 會執行 `SessionStart`、`UserPromptSubmit`、`PreToolUse`、
 `PermissionRequest`、`PostToolUse`、`PreCompact`、`PostCompact`、
 `SubagentStart` 與 `SubagentStop`，但永遠不加入 `Stop`。它只攔截
 high-confidence 的 literal secret prompt 或 Bash command，以及危險 Bash command
@@ -154,8 +180,8 @@ hook 文件](https://code.claude.com/docs/en/hooks)。
 OpenCode `tool.execute.before` plugin 可在其支援的 Bash surface
 上 throw 文件化的 command-policy denial 或 unavailable-runtime error。Codex 明確
 不執行強制措施（`unknown`）。這些是 agent-ops 的 output 與 plugin contract，不
-證明 host 會實際遵守 denial。所有 adapter 的 `SessionStart` 與 `Stop` failure path
-都維持 fail-open。
+證明 host 會實際遵守 denial。所有 `SessionStart` 與一般 Stop verification failure
+path 都維持 fail-open；只有明確啟用的 agy completion gate 會在 final Stop fail-closed。
 
 Claude 的無效 config fallback 有四項防護：(1) 缺少 project configuration 時保持
 fail-open，因此只有無效的 `.agent-ops/config.json` 能進入 fallback；(2) manifest
@@ -166,7 +192,7 @@ hook-process environment 讀取，不能由 agent-ops configuration、manifest
 managed file 設定。
 
 `guardrails` 只安裝 command policy，不會啟用 Stop verification。Stop 是獨立的
-config v2 feature，必須明確啟用且至少提供一個已確認的 command：
+config v3 feature，必須明確啟用且至少提供一個已確認的 command：
 
 ```json
 {
@@ -215,6 +241,10 @@ config-hash 與 timestamp evidence，且永遠不會完成 task。Config v1 會
 `agent-ops update --harness`；shared path 會繼續受管理，被移除 harness
 擁有的 artifact、marker 與 hook 則會被安全同步。
 
+若只要移除單一已整合 harness，可使用
+`agent-ops uninstall --harness agy`（或其他已安裝 id）。剩餘 manifest 與
+shared path 會保留；省略 `--harness` 才會移除整套 managed installation。
+
 使用舊版 canonical routing wording 的 installation 會由
 `agent-ops update` 遷移；若 managed block 曾被修改，指令會 fail closed，
 直到該變更被檢查。

package/docs/zh-TW/spec/README.md

@@ -2,11 +2,13 @@
 
 此目錄是英文規範的繁體中文導讀；規範 rule ID 以英文版本為準。
 
-Harness adapter 規則涵蓋 Codex、Claude Code 與 opencode。opencode 整合是
-產生的 local plugin，不管理 `opencode.json`。
+Harness adapter 規則涵蓋 agy、Codex、Claude Code 與 opencode。opencode 整合是
+產生的 local plugin，不管理 `opencode.json`。agy 在 project scope 使用
+`GEMINI.md` routing 與原生 hooks，對不足以完整支援 loop 的 lifecycle
+能力明確標示 degraded。
 
-Configuration 與 manifest 分開版本化。Config v1 會遷移為預設 disabled Stop
-verification 的 config v2；變更 capability 後必須執行經確認的 project
+Configuration 與 manifest 分開版本化。舊 config 會遷移為 Stop verification 與
+agy completion gate 預設 disabled 的 config v3；變更 capability 後必須執行經確認的 project
 `agent-ops update`，有 verifier 時會一併更新 trust。Stop verification 必須明確啟用、具備 trust、
 為 report-only，且永遠不會完成 task。Dry-run plan 會隱藏 foreign settings
 內容；routing migration 一旦套用即為單向。

package/docs/zh-TW/spec/harness-adapters.md

@@ -2,7 +2,7 @@
 
 English source version: 2026-08-03. Revalidate: when the English specification or any vendor reference changes.
 
-本文件所述 OpenCode plugin 行為已於 2026-07-31 依據[官方 plugin 文件](https://opencode.ai/docs/plugins/)與[Bun shell 文件](https://bun.sh/docs/runtime/shell)檢查；Codex 與 Claude Code loop-hook 行為已於 2026-08-03 依據 [Codex hook 文件](https://developers.openai.com/codex/config-advanced#hooks) 與 [Claude Code hook 文件](https://code.claude.com/docs/en/hooks) 檢查。
+本文件所述 OpenCode plugin 行為已於 2026-07-31 依據[官方 plugin 文件](https://opencode.ai/docs/plugins/)與[Bun shell 文件](https://bun.sh/docs/runtime/shell)檢查；Codex 與 Claude Code loop-hook 行為已於 2026-08-03 依據 [Codex hook 文件](https://developers.openai.com/codex/config-advanced#hooks) 與 [Claude Code hook 文件](https://code.claude.com/docs/en/hooks) 檢查；agy hook 行為已於 2026-08-28 依據[官方 Antigravity hook 文件](https://antigravity.google/docs/hooks) 檢查。任何 vendor 參考變更時都必須重新驗證。
 
 ## HARNESS-ADAPTER-001
 
@@ -68,13 +68,15 @@ event、native output encode 與 runtime-failure output。
 ## HARNESS-ADAPTER-006
 
 Project-local `loop` profile MUST 是 opt-in、project scoped，並在最小的 Codex 與
-Claude Code launcher 後使用同一個 shared runtime。它 MUST NOT 將 policy 複製到
-project-specific script，也不得改變一般 permission request。
+Claude Code launcher 後使用同一個 shared runtime；agy 使用原生支援的 lifecycle
+子集，並明確回報為 degraded。它 MUST NOT 將 policy 複製到 project-specific
+script，也不得改變一般 permission request。
 
-- Trigger: Project 以 Codex、Claude Code 或兩者選擇 `loop`。
+- Trigger: Project 以 agy、Codex、Claude Code 或任意組合選擇 `loop`。
 - Action: 只產生選定的 `.codex/hooks/agent-ops-loop.sh` 與／或 Claude 的
   `.claude/hooks/agent-ops-loop.sh`、`.claude/hooks/agent-ops-loop.ps1` launcher，註冊文件化的 loop lifecycle event
-  （不含 `Stop`），並保留 foreign hook group。只在 `UserPromptSubmit` 或 Bash
+  （不含 `Stop`），並保留 foreign hook group。agy 只註冊原生
+  `PreInvocation`／`PreToolUse(run_command)` hook，不產生 shell launcher。只在 `UserPromptSubmit` 或 Bash
   `PreToolUse` 的 high-confidence literal credential，以及 `PreToolUse` 的危險 Bash command 時，使用
   文件化的 native denial shape 進行 blocking。對 `PermissionRequest`（包括
   escalated permission）不得輸出 decision。
@@ -86,11 +88,12 @@ project-specific script，也不得改變一般 permission request。
 
 目前 registration matrix 刻意不對稱：
 
-| Capability | Codex | Claude Code | OpenCode |
-| --- | --- | --- | --- |
-| lifecycle-summary | supported | supported | degraded |
-| command-policy | unknown | supported | supported |
-| optional-stop-verify | unsupported | supported | degraded |
+| Capability | agy | Codex | Claude Code | OpenCode |
+| --- | --- | --- | --- | --- |
+| lifecycle-summary | degraded | supported | supported | degraded |
+| command-policy | supported | unknown | supported | supported |
+| completion-gate | supported | unsupported | unsupported | unsupported |
+| optional-stop-verify | degraded | unsupported | supported | degraded |
 
 Runtime-failure 處理中，只有 `command-policy` 為 fail-closed。當已安裝的 config
 被分類為無效時，Claude Code 可輸出文件化的 `PreToolUse` denial shape；受管理的
@@ -99,6 +102,14 @@ denial 或 unavailable-runtime error。Codex 維持 `unknown` 且絕不輸出 de
 Fixture test 只斷言這些 wire 與 plugin shape；它們不證明 host 會實際遵守 denial。
 每個 `SessionStart` 與 `Stop` failure path 都維持 fail-open。
 
+agy adapter 在 project scope 使用原生 `GEMINI.md` routing 到
+`.agent-ops/GEMINI.md`；user
+scope 管理 `.agent-ops/GEMINI.md` 與 shared `.gemini/GEMINI.md` rule surface。
+其 native hook 使用 camelCase input，command-policy block 回傳
+`decision: "deny"`。只有明確啟用 completion gate 時，未具完備證據的 final
+changed conversation 才回傳 `decision: "continue"`；唯讀 conversation 正常
+結束。在 Windows 透過 `cmd /c` 呼叫產生的 command。
+
 Stop verification 必須明確啟用、具備 trust、為 report-only 且預設 disabled。
 每個 Stop 結果都會讓 native harness 繼續，最多攜帶有界 command evidence，永遠
 不是 task-completion evidence。

package/docs/zh-TW/spec/review.md

@@ -42,6 +42,11 @@ review target MUST 以其自身的唯讀機制啟動；沒有唯讀機制的 tar
 - Positive: `agy 使用 sandboxed plan mode；opencode 仍不合格。`
 - Negative: `信任 prompt 能阻止審查者修改檔案。`
 
+每次 review 都 MUST 使用全新 session（`sessionIsolation: "fresh"`）並在
+disposable repository clone 中執行。review chain 優先選擇不同於 hosting CLI 的
+target；沒有其他可用 target 時，才允許同 CLI 的 fresh review，但輸出 MUST 明確
+標示 `DEGRADED: isolated self-review`。不得 resume 開發 session 作為獨立審查。
+
 ## REVIEW-CHAIN-001
 
 已設定的 targets 組成有序後備鏈，MUST 僅在「沒有審到」時換下一家，且 MUST NOT 在取得判定後繼續往下試。

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kylecheng3146/agent-ops",
-  "version": "0.1.19",
-  "description": "Evidence-driven development loops for Codex, Claude Code, and opencode",
+  "version": "0.1.21",
+  "description": "Evidence-driven development loops for agy, Codex, Claude Code, and opencode",
   "type": "module",
   "license": "MIT",
   "repository": "github:kylecheng3146/agent-ops",

package/schemas/config.schema.json

@@ -14,7 +14,7 @@
   ],
   "properties": {
     "schemaVersion": {
-      "const": 2
+      "const": 3
     },
     "profiles": {
       "type": "array",
@@ -75,8 +75,18 @@
     "features": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["stopVerification"],
+      "required": ["completionGate", "stopVerification"],
       "properties": {
+        "completionGate": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["enabled"],
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            }
+          }
+        },
         "stopVerification": {
           "type": "object",
           "additionalProperties": false,

package/schemas/manifest.schema.json

@@ -17,7 +17,7 @@
       "minItems": 1,
       "uniqueItems": true,
       "items": {
-        "enum": ["codex", "claude", "opencode"]
+        "enum": ["agy", "codex", "claude", "opencode"]
       }
     },
     "artifacts": {
@@ -127,7 +127,7 @@
           "$ref": "#/$defs/relativePath"
         },
         "harness": {
-          "enum": ["codex", "claude"]
+          "enum": ["agy", "codex", "claude"]
         },
         "events": {
           "type": "array",