@kylecheng3146/agent-ops 0.1.20 → 0.1.22

package/dist/runtime/src/install/plan.js

@@ -71,7 +71,7 @@ async function detectVerificationCommands(root) {
         .filter((proposal) => proposal.confidence === "high")
         .map(verificationCommandFromProposal);
 }
-function buildConfig(profiles, existing, reviewTargets = [], detectedCommands = []) {
+function buildConfig(profiles, existing, reviewTargets = [], detectedCommands = [], completionGateEnabled = false) {
     // Absent reviewRoles means external review is disabled; an empty selection
     // must therefore omit the field rather than write an empty array.
     const reviewRoles = reviewTargets.length > 0
@@ -88,6 +88,9 @@ function buildConfig(profiles, existing, reviewTargets = [], detectedCommands =
         features: existing?.features ?? {
             stopVerification: {
                 enabled: false
+            },
+            completionGate: {
+                enabled: completionGateEnabled
             }
         },
         pathMappings: existing?.pathMappings ?? [],
@@ -95,7 +98,7 @@ function buildConfig(profiles, existing, reviewTargets = [], detectedCommands =
         ...(reviewRoles === undefined ? {} : { reviewRoles: [...reviewRoles] })
     };
 }
-async function planConfig(root, profiles, existingManifest, suppliedConfig, reviewTargets = []) {
+async function planConfig(root, profiles, existingManifest, suppliedConfig, reviewTargets = [], completionGateEnabled = false) {
     const current = await readCurrentFile(root, CONFIG_PATH);
     const owned = findOwnedArtifact(existingManifest, CONFIG_PATH);
     if (current !== null && owned === undefined) {
@@ -131,7 +134,7 @@ async function planConfig(root, profiles, existingManifest, suppliedConfig, revi
         existingConfig.verification.commands.length === 0
         ? await detectVerificationCommands(root)
         : [];
-    const config = buildConfig(profiles, existingConfig, reviewTargets, detectedCommands);
+    const config = buildConfig(profiles, existingConfig, reviewTargets, detectedCommands, completionGateEnabled);
     const content = `${JSON.stringify(config, null, 2)}\n`;
     return {
         operation: {
@@ -376,6 +379,18 @@ export async function createInstallPlan(options) {
         ? resolveProfiles(options.profiles)
         : resolveCapabilities(options.existingConfig.value);
     assertLoopProfileSupport(options.scope, options.harness, resolved.capabilities);
+    const completionGateEnabled = options.existingConfig?.value.features.completionGate.enabled ??
+        options.completionGateEnabled === true;
+    if (completionGateEnabled &&
+        (options.scope !== "project" ||
+            !options.harness.includes("agy") ||
+            !resolved.capabilities.includes("project-loop"))) {
+        throw new AgentOpsError("COMPLETION_GATE_UNSUPPORTED", "The completion gate requires project scope with the agy harness and loop profile.");
+    }
+    if (completionGateEnabled &&
+        !resolved.capabilities.includes("completion-gate")) {
+        resolved.capabilities.push("completion-gate");
+    }
     await assertCodexLoopConfiguration(options.root, options.harness, resolved.capabilities);
     const existing = await readExistingManifest(options.root);
     assertCompatibleManifest(existing?.manifest ?? null, options.scope, options.harness, options.allowHarnessChange === true);
@@ -461,7 +476,7 @@ export async function createInstallPlan(options) {
         : [];
     const operations = [];
     const artifacts = [];
-    const config = await planConfig(options.root, resolved.profiles, existing?.manifest ?? null, options.existingConfig, options.reviewTargets ?? []);
+    const config = await planConfig(options.root, resolved.profiles, existing?.manifest ?? null, options.existingConfig, options.reviewTargets ?? [], completionGateEnabled);
     operations.push(config.operation);
     artifacts.push(config.record);
     for (const artifact of contribution.artifacts) {

package/dist/runtime/src/install/profiles.js

@@ -33,5 +33,8 @@ export function resolveCapabilities(config) {
     if (config.features.stopVerification.enabled) {
         resolved.capabilities.push("optional-stop-verify");
     }
+    if (config.features.completionGate.enabled) {
+        resolved.capabilities.push("completion-gate");
+    }
     return resolved;
 }

package/dist/runtime/src/review/execute.js

@@ -15,6 +15,14 @@ import { buildAdversarialPrompt, buildReviewPrompt } from "./runner.js";
  * review while looking like an unavailable target.
  */
 export const DEFAULT_REVIEW_TIMEOUT_MS = 900_000;
+export class ReviewInterruptedError extends Error {
+    signal;
+    constructor(signal) {
+        super("Independent review was interrupted.");
+        this.name = "ReviewInterruptedError";
+        this.signal = signal;
+    }
+}
 // USER is load-bearing, not cosmetic: a credential store keyed by account name
 // — the macOS keychain claude reads — cannot be opened without it, and its
 // absence surfaces as "Not logged in" on an install that is logged in.
@@ -81,8 +89,7 @@ const REQUIRED_HELP_FLAGS = {
  */
 const ADVANCING = new Set([
     "missing-executable",
-    "spawn-failed",
-    "timeout"
+    "spawn-failed"
 ]);
 const DIAGNOSTIC_MAX_CHARS = 200;
 /**
@@ -114,6 +121,16 @@ function rejectedCallReason(output) {
     }
     return "capability-unavailable";
 }
+function throwIfInterrupted(target, options, failureClass) {
+    if (failureClass !== "aborted" && options.signal?.aborted !== true) {
+        return;
+    }
+    const signal = typeof options.signal?.reason === "string"
+        ? options.signal.reason
+        : undefined;
+    options.onProgress?.(`${target}: review interrupted${signal === undefined ? "" : ` by ${signal}`}`);
+    throw new ReviewInterruptedError(signal);
+}
 async function snapshotRepository(request, destination, options) {
     const cloned = await runVerificationCommand({
         id: `review-snapshot-${request.label}`,
@@ -125,8 +142,10 @@ async function snapshotRepository(request, destination, options) {
         timeoutMs: Math.min(options.timeoutMs ?? DEFAULT_REVIEW_TIMEOUT_MS, 60_000)
     }, {
         cwd: dirname(destination),
-        ...(options.runner === undefined ? {} : { runner: options.runner })
+        ...(options.runner === undefined ? {} : { runner: options.runner }),
+        ...(options.signal === undefined ? {} : { signal: options.signal })
     });
+    throwIfInterrupted(request.target, options, cloned.failureClass);
     if (cloned.status !== "PASS") {
         return firstComplaint(cloned.stderr, cloned.stdout) ??
             `git clone failed (${cloned.failureClass})`;
@@ -184,6 +203,8 @@ async function attemptTarget(request, options) {
             return skip("capability-unavailable", "no read-only mode is available for this target", "skipping");
         }
         const environment = isolatedReviewEnvironment(target, attemptDirectory, options.env ?? process.env);
+        throwIfInterrupted(target, options);
+        options.onProgress?.(`${target}: checking reviewer capability`);
         const capability = await runVerificationCommand({
             id: `review-capability-${request.label}`,
             command: invocation.command,
@@ -196,8 +217,10 @@ async function attemptTarget(request, options) {
             cwd: attemptDirectory,
             ...(options.runner === undefined ? {} : { runner: options.runner }),
             env: environment,
-            replaceEnv: true
+            replaceEnv: true,
+            ...(options.signal === undefined ? {} : { signal: options.signal })
         });
+        throwIfInterrupted(target, options, capability.failureClass);
         const help = `${capability.stdout}\n${capability.stderr}`;
         const missingFlags = (REQUIRED_HELP_FLAGS[target] ?? []).filter((flag) => !help.includes(flag));
         if (capability.status !== "PASS" ||
@@ -238,6 +261,8 @@ async function attemptTarget(request, options) {
         if (invocation === undefined) {
             return skip("capability-unavailable", "review invocation disappeared", "skipping");
         }
+        throwIfInterrupted(target, options);
+        options.onProgress?.(`${target}: review started (timeout: ${Math.ceil((options.timeoutMs ?? DEFAULT_REVIEW_TIMEOUT_MS) / 1_000)}s)`);
         const spawned = await runVerificationCommand({
             id: `review-${request.label}`,
             command: invocation.command,
@@ -254,8 +279,13 @@ async function attemptTarget(request, options) {
                 : { outputLimitBytes: options.outputLimitBytes }),
             stdin: invocation.stdin,
             env: environment,
-            replaceEnv: true
+            replaceEnv: true,
+            ...(options.signal === undefined ? {} : { signal: options.signal })
         });
+        throwIfInterrupted(target, options, spawned.failureClass);
+        if (spawned.failureClass === "timeout") {
+            return skip("timeout", "the reviewer exceeded its timeout");
+        }
         if (ADVANCING.has(spawned.failureClass)) {
             return {
                 ...skip("missing-cli", `the process did not complete: ${spawned.failureClass}`),
@@ -273,6 +303,9 @@ async function attemptTarget(request, options) {
             return skip(rejectedCallReason(output), firstComplaint(spawned.stderr, spawned.stdout) ??
                 `the call was rejected with exit ${spawned.exitCode ?? "unknown"} and no output`);
         }
+        if (spawned.failureClass === "signal-exit") {
+            return skip("capability-unavailable", `the reviewer exited after ${spawned.signal ?? "an unknown signal"}`);
+        }
         const payload = extractReviewObject(target, spawned.stdout);
         const parsed = payload === undefined
             ? undefined
@@ -343,8 +376,8 @@ export function createReviewExecutor(options) {
                     prompt: buildAdversarialPrompt({ ...request.invocation, harness: target }, primary)
                 }, options);
                 if (outcome.kind === "skip") {
-                    // Recorded, not just reported: progress is suppressed under --json,
-                    // and without this a PASS with no `adversarial` field cannot be told
+                    // Recorded, not just reported: stderr progress is transient, and
+                    // without this a PASS with no `adversarial` field cannot be told
                     // apart from a PASS that had no second target to challenge it.
                     attempts.push({
                         target,

package/dist/runtime/src/review/render.js

@@ -7,9 +7,11 @@ function lineList(values) {
     return values.length === 0 ? ["- none"] : values.map((value) => `- ${safe(value)}`);
 }
 export function renderReviewResult(result) {
+    const plannedTargets = result.plannedTargets ?? [result.harness];
     const lines = [
         `Independent review: ${result.status}`,
-        `Reviewer: ${result.harness}; model: ${safe(result.model)}; effort: ${safe(result.effort)}.`
+        `Reviewer: ${result.harness}; model: ${safe(result.model)}; effort: ${safe(result.effort)}.`,
+        `Planned reviewers: ${plannedTargets.length === 0 ? "none" : plannedTargets.join(" → ")}.`
     ];
     if (result.scope !== undefined) {
         lines.push(result.scope.mode === "base"

package/dist/runtime/src/review/runner.js

@@ -160,6 +160,7 @@ function safeReport(report) {
 export async function runIndependentReview(options) {
     const base = {
         harness: options.invocation.harness,
+        plannedTargets: options.invocation.plannedTargets ?? [options.invocation.harness],
         model: options.invocation.model,
         effort: options.invocation.effort,
         prompt: buildReviewPrompt(options.invocation),

package/dist/runtime/src/schema/validate.js

@@ -328,7 +328,7 @@ export function validateConfig(value) {
     if (!isRecord(root.features)) {
         return failure("INVALID_TYPE", "$.features", "features must be an object.");
     }
-    const featuresUnknown = unknownFieldFailure(root.features, ["stopVerification"], "$.features");
+    const featuresUnknown = unknownFieldFailure(root.features, ["completionGate", "stopVerification"], "$.features");
     if (featuresUnknown !== undefined) {
         return featuresUnknown;
     }
@@ -342,6 +342,16 @@ export function validateConfig(value) {
     if (typeof root.features.stopVerification.enabled !== "boolean") {
         return failure("INVALID_FEATURE", "$.features.stopVerification.enabled", "stopVerification.enabled must be a boolean.");
     }
+    if (!isRecord(root.features.completionGate)) {
+        return failure("INVALID_TYPE", "$.features.completionGate", "completionGate must be an object.");
+    }
+    const completionGateUnknown = unknownFieldFailure(root.features.completionGate, ["enabled"], "$.features.completionGate");
+    if (completionGateUnknown !== undefined) {
+        return completionGateUnknown;
+    }
+    if (typeof root.features.completionGate.enabled !== "boolean") {
+        return failure("INVALID_FEATURE", "$.features.completionGate.enabled", "completionGate.enabled must be a boolean.");
+    }
     if (!isRecord(root.verification)) {
         return failure("INVALID_TYPE", "$.verification", "verification must be an object.");
     }

package/dist/runtime/src/task/service.js

@@ -77,6 +77,9 @@ export class TaskService {
             !/^[a-f0-9]{64}$/u.test(input.policyConfigHash)) {
             throw taskError("TASK_POLICY_CONFIG_INVALID", "Policy config hash must be a lowercase SHA-256 digest.");
         }
+        if (input.sessionId !== undefined) {
+            assertSessionId(input.sessionId);
+        }
         const task = {
             schemaVersion: TASK_SCHEMA_VERSION,
             id: this.#generateId(),
@@ -118,6 +121,20 @@ export class TaskService {
                 policyConfigHash: input.policyConfigHash ?? null
             };
             state.tasks.push(record);
+            if (input.sessionId !== undefined) {
+                const currentIndex = state.sessions.findIndex(({ sessionId }) => sessionId === input.sessionId);
+                const attachment = {
+                    sessionId: input.sessionId,
+                    taskId: record.task.id,
+                    attachedAt: now
+                };
+                if (currentIndex === -1) {
+                    state.sessions.push(attachment);
+                }
+                else {
+                    state.sessions[currentIndex] = attachment;
+                }
+            }
             return cloneRecord(record);
         });
     }

package/dist/runtime/src/verify/spawn.js

@@ -270,6 +270,9 @@ function hasAcknowledgedShell(command) {
 export async function runVerificationCommand(command, options) {
     const now = options.now ?? Date.now;
     const startedAt = now();
+    if (options.signal?.aborted === true) {
+        return emptyResult(command.id, "aborted", elapsedMilliseconds(startedAt, now()));
+    }
     if (!hasAcknowledgedShell(command)) {
         return emptyResult(command.id, "shell-risk-unacknowledged", elapsedMilliseconds(startedAt, now()));
     }
@@ -298,21 +301,35 @@ export async function runVerificationCommand(command, options) {
     const timeout = new Promise((resolve) => {
         timer = setTimeout(() => resolve({ kind: "timeout" }), timeoutMs);
     });
+    let removeAbortListener = () => { };
+    const aborted = new Promise((resolve) => {
+        const signal = options.signal;
+        if (signal === undefined) {
+            return;
+        }
+        const onAbort = () => resolve({ kind: "abort" });
+        signal.addEventListener("abort", onAbort, { once: true });
+        removeAbortListener = () => signal.removeEventListener("abort", onAbort);
+    });
     const outcome = await Promise.race([
         running.completion.then((completion) => ({
             kind: "completion",
             completion
         })),
-        timeout
+        timeout,
+        aborted
     ]);
+    removeAbortListener();
     if (timer !== undefined) {
         clearTimeout(timer);
     }
     let completion;
     let timedOut = false;
+    let wasAborted = false;
     let terminationFailed = false;
-    if (outcome.kind === "timeout") {
-        timedOut = true;
+    if (outcome.kind === "timeout" || outcome.kind === "abort") {
+        timedOut = outcome.kind === "timeout";
+        wasAborted = outcome.kind === "abort";
         try {
             await running.terminateTree(terminationGrace);
         }
@@ -330,14 +347,19 @@ export async function runVerificationCommand(command, options) {
         settleCapturedOutput(stdout, terminationGrace),
         settleCapturedOutput(stderr, terminationGrace)
     ]);
-    const classified = timedOut
+    const classified = wasAborted
         ? {
             status: terminationFailed ? "UNKNOWN" : "FAIL",
-            failureClass: terminationFailed
-                ? "termination-failed"
-                : "timeout"
+            failureClass: "aborted"
         }
-        : classifyCompletion(completion, capturedStdout.failed || capturedStderr.failed);
+        : timedOut
+            ? {
+                status: terminationFailed ? "UNKNOWN" : "FAIL",
+                failureClass: terminationFailed
+                    ? "termination-failed"
+                    : "timeout"
+            }
+            : classifyCompletion(completion, capturedStdout.failed || capturedStderr.failed);
     return {
         commandId: command.id,
         status: classified.status,

package/docs/en/guides/configuration.md

@@ -6,10 +6,12 @@ Use `--harness all` to select agy, Codex, Claude Code, and opencode, or pass a
 comma-separated subset such as `codex,opencode`. `both` remains an input alias
 for the legacy Codex plus Claude selection.
 
-Project agy, Codex, and opencode installations share the managed supplemental
-`AGENTS.md` routing block and the `.agent-ops/AGENTS.md` rules artifact. The
-block loads the managed baseline while project-specific instructions remain
-authoritative. Claude uses the corresponding `CLAUDE.md` route and
+Project agy uses a managed supplemental `GEMINI.md` routing block and
+`.agent-ops/GEMINI.md` baseline. This follows the official agy CLI rule that a
+workspace-root `GEMINI.md` or `AGENTS.md` is loaded at startup. Codex and
+opencode share the corresponding `AGENTS.md` route and `.agent-ops/AGENTS.md`
+artifact. Each block loads the managed baseline while project-specific
+instructions remain authoritative. Claude uses the corresponding `CLAUDE.md` route and
 `.agent-ops/CLAUDE.md` artifact. Opencode additionally gets
 the agent-ops-owned `.opencode/plugins/agent-ops.js` file; `opencode.json` is
 never modified. The plugin is generated with the installed absolute runtime
@@ -53,6 +55,12 @@ A bare review uses the built-in `change-quality` criterion; `--task` uses the
 task criteria and requires fresh PASS evidence for required checks. The full
 report is printed, and PASS persists only a source-fingerprint attestation.
 
+`--review-target` belongs to `init` and configures that persistent chain.
+For one run, `review --harness <target>` narrows the chain to exactly one
+already-configured target; it never enables a target absent from project
+policy. The configured model, effort, and timeout still apply. Review JSON
+includes `plannedTargets` in the actual host-adjusted order.
+
 Every attempt starts from a fresh session and disposable repository clone with
 native read-only mode.
 Claude uses complete safe-mode isolation. Codex and Agy preserve their existing
@@ -86,6 +94,12 @@ failure, oversized output, or unparseable output. Every attempt and reason is
 preserved in human and JSON output. A `PASS` or `FAIL` verdict is **terminal**,
 so the chain cannot shop for a passing review.
 
+Capability checks and model starts are reported on stderr, including under
+`--json`; stdout remains one final JSON envelope and raw reviewer output is
+never streamed. SIGINT or SIGTERM terminates the active reviewer process tree,
+does not advance the fallback chain, and never writes an attestation. An
+exhausted timeout chain reports `timeout`, not `missing-cli`.
+
 If Claude Code is the host (`CLAUDECODE` is set), `claude` is moved to the end
 of the chain. It still runs when it is the only configured target, with a
 `reviewer == host` warning.
@@ -147,6 +161,21 @@ user hooks live in `.gemini/config/hooks.json`. User-scope rules modify the
 shared Gemini rule surface at `.gemini/GEMINI.md`. agy 1.1.12 or newer is
 required for machine-readable `/hooks` diagnostics.
 
+For `agy` plus `loop`, the interactive installer recommends
+`features.completionGate.enabled`; non-interactive installs require the explicit
+`--completion-gate` flag. The gate uses the documented `conversationId`,
+`terminationReason`, and `fullyIdle` Stop fields and returns the documented
+`decision: "continue"` only for a final changed conversation that lacks current
+task, verification, or review proof. Pure Q&A, analysis, read-only diagnostics,
+error stops, max-step stops, and non-idle stops continue normally. It does not
+change Codex, Claude Code, or OpenCode Stop behavior. For headless execution use
+`agent-ops agy-run -- <agy arguments>`; a user-approved one-time escape is
+`agent-ops allow-stop --session <conversationId>` and is guarded by agy's
+documented `force_ask` decision.
+
+Official references: [agy CLI workspace rule files](https://www.antigravity.google/docs/cli/best-practices/)
+and [Antigravity hook contracts](https://www.antigravity.google/docs/hooks/).
+
 The full Codex/Claude loop runs `SessionStart`, `UserPromptSubmit`, `PreToolUse`,
 `PermissionRequest`, `PostToolUse`, `PreCompact`, `PostCompact`,
 `SubagentStart`, and `SubagentStop`, but never adds `Stop`. It blocks only
@@ -183,8 +212,9 @@ classified invalid installed configuration. The managed OpenCode
 `tool.execute.before` plugin can throw its documented command-policy denial or
 unavailable-runtime error for its supported Bash surface. Codex is explicitly
 non-enforcing (`unknown`). These are agent-ops output and plugin contracts, not
-proof that a host honors a denial. `SessionStart` and `Stop` failure paths stay
-fail-open for every adapter.
+proof that a host honors a denial. `SessionStart` and ordinary Stop verification
+failure paths stay fail-open. Only the explicitly enabled agy completion gate
+fails closed at final Stop.
 
 Claude's invalid-config fallback has four safeguards: (1) an absent project
 configuration stays fail-open, so only an invalid `.agent-ops/config.json` can
@@ -196,7 +226,7 @@ that shell variable. The variable is read only from the hook-process environment
 and cannot be set in agent-ops configuration, a manifest, or managed files.
 
 `guardrails` installs command policy but does not enable Stop verification. Stop
-is a separate config-v2 feature and must be explicitly enabled with at least
+is a separate config-v3 feature and must be explicitly enabled with at least
 one confirmed command:
 
 ```json

package/docs/en/spec/README.md

@@ -4,12 +4,12 @@ This is the normative English specification for bounded, evidence-driven work.
 
 The harness adapter rules cover agy, Codex, Claude Code, and opencode. The
 opencode integration is a generated local plugin; it does not manage
-`opencode.json`. agy shares project `AGENTS.md` routing, uses native hooks, and
+`opencode.json`. agy uses project `GEMINI.md` routing, uses native hooks, and
 is explicitly degraded where its lifecycle surface is smaller than the full
 loop.
 
-Configuration is versioned independently from the manifest. Config v1 migrates
-to config v2 with Stop verification disabled; changing the capability requires
+Configuration is versioned independently from the manifest. Older configs migrate
+to config v3 with Stop verification and the agy completion gate disabled; changing a capability requires
 a confirmed project `agent-ops update`, which also refreshes trust when
 verifiers exist. Stop verification is
 explicit, trusted, report-only, and never completes a task. Dry-run plans keep

package/docs/en/spec/harness-adapters.md

@@ -108,6 +108,7 @@ The current registration matrix is intentionally asymmetric:
 | --- | --- | --- | --- | --- |
 | lifecycle-summary | degraded | supported | supported | degraded |
 | command-policy | supported | unknown | supported | supported |
+| completion-gate | supported | unsupported | unsupported | unsupported |
 | optional-stop-verify | degraded | unsupported | supported | degraded |
 
 For runtime-failure handling, only `command-policy` is fail-closed. Claude
@@ -118,11 +119,14 @@ surface. Codex remains `unknown` and never emits a denial. Fixture tests assert
 these wire and plugin shapes only; they do not prove that a host honors a
 denial. Every `SessionStart` and `Stop` failure path remains fail-open.
 
-The agy adapter uses project `AGENTS.md` routing alongside Codex and OpenCode;
+The agy adapter uses native project `GEMINI.md` routing to
+`.agent-ops/GEMINI.md`;
 at user scope it manages `.agent-ops/GEMINI.md` and a managed block in the
 shared `.gemini/GEMINI.md` rule surface. Its native hooks use camelCase input,
-return `decision: "deny"` for command-policy blocks, and never force a Stop
-continuation. On Windows the generated command is invoked through `cmd /c`.
+return `decision: "deny"` for command-policy blocks, and, only when the
+completion gate is explicitly enabled, return `decision: "continue"` for an
+unproven final changed conversation. Read-only conversations stop normally.
+On Windows the generated command is invoked through `cmd /c`.
 
 Stop verification is explicit, trusted, report-only, and disabled by default.
 Every Stop result continues the native harness and may carry only bounded

package/docs/en/spec/review.md

@@ -31,6 +31,12 @@ when an installation supports multiple harnesses.
 - Positive: `review --harness claude` resolves one target.
 - Negative: `Run one review invocation against every installed harness implicitly.`
 
+The explicit target MUST already exist in the configured independent-review
+role. It narrows the configured chain to one target while preserving model,
+effort, and timeout policy. Without `--harness`, host-aware ordering applies to
+the complete configured chain. Every result carries that order as
+`plannedTargets`.
+
 ## REVIEW-READONLY-001
 
 A review target MUST be launched with its own read-only mechanism, and a target
@@ -48,6 +54,11 @@ different CLI from the hosting CLI; when no other usable target exists,
 same-target fresh review is allowed but MUST render as `DEGRADED: isolated
 self-review`. A resumed development session is never an independent review.
 
+Capability and model-start progress goes to stderr even when stdout is JSON.
+Raw reviewer output remains bounded and unstreamed. SIGINT or SIGTERM aborts
+the active process tree without fallback or attestation; timeout remains a
+distinct NOT_RUN reason rather than being flattened to `missing-cli`.
+
 ## REVIEW-CHAIN-001
 
 Configured targets form an ordered fallback chain that MUST advance only when

package/docs/zh-TW/guides/configuration.md

@@ -6,9 +6,11 @@
 `codex,opencode` 這類逗號分隔的子集。`both` 仍是 legacy Codex 加 Claude
 selection 的 input alias。
 
-Project agy、Codex 與 opencode installation 共用 managed supplemental
-`AGENTS.md` routing block 與 `.agent-ops/AGENTS.md` rules artifact。該 block
-只載入 managed baseline，並保留 project-specific instructions 的權威性。
+Project agy 使用 managed supplemental `GEMINI.md` routing block 與
+`.agent-ops/GEMINI.md` baseline；這符合 agy CLI 官方文件所述，啟動時會讀取
+workspace root 的 `GEMINI.md` 或 `AGENTS.md`。Codex 與 opencode 共用
+`AGENTS.md` route 與 `.agent-ops/AGENTS.md` artifact。這些 block 只載入
+managed baseline，並保留 project-specific instructions 的權威性。
 Claude 使用對應的 `CLAUDE.md` route 與 `.agent-ops/CLAUDE.md` artifact。Opencode 另外取得
 agent-ops 擁有的 `.opencode/plugins/agent-ops.js`；不會修改 `opencode.json`。
 Plugin 使用安裝時的 absolute runtime path 產生，因此請透過
@@ -47,6 +49,11 @@ Claude 與 Codex lifecycle support 為 `supported`，OpenCode 從 app initializa
 `--task` 使用 task criteria，並要求必要驗證的最新 PASS evidence。完整 report
 會顯示給人看，PASS 後只持久化 source-fingerprint attestation。
 
+`--review-target` 只屬於 `init`，用來設定持久 fallback chain。單次執行可用
+`review --harness <target>`，將 chain 縮窄為一個已在 project policy 啟用的
+target；它不會臨時啟用未設定的 reviewer。既有 model、effort 與 timeout 仍會
+沿用，review JSON 的 `plannedTargets` 會列出經 host 調整後的實際順序。
+
 每次嘗試都從全新 session、一次性 repository clone 與原生唯讀模式啟動。Claude 使用完整 safe-mode
 隔離；Codex 與 Agy 為了支援既有 OAuth 登入而保留登入環境，因此 context
 隔離較弱。Agy 會取得一次性 clone，即使 sandboxed plan mode 寫入 cwd，也無法
@@ -75,6 +82,11 @@ agent-ops 刻意不傳會繞過權限邊界的 `--dangerously-skip-permissions`
 都會保留每次 attempt 及原因。`PASS` 或 `FAIL` 判定是**終局**，因此不會產生
 自動化的 review shopping。
 
+Capability check 與模型啟動進度都寫到 stderr，包括 `--json` 模式；stdout
+仍只有最終 JSON envelope，且不會串流 reviewer 原始輸出。SIGINT 或 SIGTERM
+會終止目前 reviewer 的完整 process tree、不進入 fallback，也不寫入
+attestation。整條 chain 逾時時回報 `timeout`，不會誤報 `missing-cli`。
+
 若 host 是 Claude Code（`CLAUDECODE` 已設定），`claude` 會被移到鏈尾。
 當它是唯一設定的目標時仍會執行，並附上 `reviewer == host` 警告。
 
@@ -131,6 +143,20 @@ agy 會安裝原生 `PreInvocation` 與 `PreToolUse(run_command)` 子集，docto
 位於 `.gemini/config/hooks.json`；user scope 會修改共享 Gemini rule surface
 `.gemini/GEMINI.md`。機器可讀的 `/hooks` 診斷要求 agy 1.1.12 以上。
 
+`agy` 搭配 `loop` 時，互動式 installer 會建議啟用
+`features.completionGate.enabled`；非互動安裝必須明確傳入
+`--completion-gate`。閘門使用官方定義的 `conversationId`、
+`terminationReason` 與 `fullyIdle` Stop 欄位，只有在本次 conversation 產生
+Git-visible net change 且缺少當前 task、驗證或 review 證據時，才回傳官方定義的
+`decision: "continue"`。純問答、分析、唯讀診斷、錯誤、max-step 與 non-idle Stop
+都正常結束；本版不改變 Codex、Claude Code 或 OpenCode 的 Stop 行為。Headless
+請使用 `agent-ops agy-run -- <agy arguments>`；使用者可核准一次
+`agent-ops allow-stop --session <conversationId>`，該命令由官方定義的
+`force_ask` 強制詢問。
+
+官方依據：[agy CLI workspace rule file](https://www.antigravity.google/docs/cli/best-practices/)
+與 [Antigravity hook contract](https://www.antigravity.google/docs/hooks/)。
+
 完整 Codex/Claude loop 會執行 `SessionStart`、`UserPromptSubmit`、`PreToolUse`、
 `PermissionRequest`、`PostToolUse`、`PreCompact`、`PostCompact`、
 `SubagentStart` 與 `SubagentStop`，但永遠不加入 `Stop`。它只攔截
@@ -164,8 +190,8 @@ hook 文件](https://code.claude.com/docs/en/hooks)。
 OpenCode `tool.execute.before` plugin 可在其支援的 Bash surface
 上 throw 文件化的 command-policy denial 或 unavailable-runtime error。Codex 明確
 不執行強制措施（`unknown`）。這些是 agent-ops 的 output 與 plugin contract，不
-證明 host 會實際遵守 denial。所有 adapter 的 `SessionStart` 與 `Stop` failure path
-都維持 fail-open。
+證明 host 會實際遵守 denial。所有 `SessionStart` 與一般 Stop verification failure
+path 都維持 fail-open；只有明確啟用的 agy completion gate 會在 final Stop fail-closed。
 
 Claude 的無效 config fallback 有四項防護：(1) 缺少 project configuration 時保持
 fail-open，因此只有無效的 `.agent-ops/config.json` 能進入 fallback；(2) manifest
@@ -176,7 +202,7 @@ hook-process environment 讀取，不能由 agent-ops configuration、manifest
 managed file 設定。
 
 `guardrails` 只安裝 command policy，不會啟用 Stop verification。Stop 是獨立的
-config v2 feature，必須明確啟用且至少提供一個已確認的 command：
+config v3 feature，必須明確啟用且至少提供一個已確認的 command：
 
 ```json
 {

package/docs/zh-TW/spec/README.md

@@ -3,12 +3,12 @@
 此目錄是英文規範的繁體中文導讀；規範 rule ID 以英文版本為準。
 
 Harness adapter 規則涵蓋 agy、Codex、Claude Code 與 opencode。opencode 整合是
-產生的 local plugin，不管理 `opencode.json`。agy 在 project scope 共用
-`AGENTS.md` routing、使用原生 hooks，對不足以完整支援 loop 的 lifecycle
+產生的 local plugin，不管理 `opencode.json`。agy 在 project scope 使用
+`GEMINI.md` routing 與原生 hooks，對不足以完整支援 loop 的 lifecycle
 能力明確標示 degraded。
 
-Configuration 與 manifest 分開版本化。Config v1 會遷移為預設 disabled Stop
-verification 的 config v2；變更 capability 後必須執行經確認的 project
+Configuration 與 manifest 分開版本化。舊 config 會遷移為 Stop verification 與
+agy completion gate 預設 disabled 的 config v3；變更 capability 後必須執行經確認的 project
 `agent-ops update`，有 verifier 時會一併更新 trust。Stop verification 必須明確啟用、具備 trust、
 為 report-only，且永遠不會完成 task。Dry-run plan 會隱藏 foreign settings
 內容；routing migration 一旦套用即為單向。

package/docs/zh-TW/spec/harness-adapters.md

@@ -92,6 +92,7 @@ script，也不得改變一般 permission request。
 | --- | --- | --- | --- | --- |
 | lifecycle-summary | degraded | supported | supported | degraded |
 | command-policy | supported | unknown | supported | supported |
+| completion-gate | supported | unsupported | unsupported | unsupported |
 | optional-stop-verify | degraded | unsupported | supported | degraded |
 
 Runtime-failure 處理中，只有 `command-policy` 為 fail-closed。當已安裝的 config
@@ -101,11 +102,13 @@ denial 或 unavailable-runtime error。Codex 維持 `unknown` 且絕不輸出 de
 Fixture test 只斷言這些 wire 與 plugin shape；它們不證明 host 會實際遵守 denial。
 每個 `SessionStart` 與 `Stop` failure path 都維持 fail-open。
 
-agy adapter 在 project scope 與 Codex、OpenCode 共用 `AGENTS.md` routing；user
+agy adapter 在 project scope 使用原生 `GEMINI.md` routing 到
+`.agent-ops/GEMINI.md`；user
 scope 管理 `.agent-ops/GEMINI.md` 與 shared `.gemini/GEMINI.md` rule surface。
 其 native hook 使用 camelCase input，command-policy block 回傳
-`decision: "deny"`，且不會強迫 Stop 繼續。在 Windows 透過 `cmd /c` 呼叫產生的
-command。
+`decision: "deny"`。只有明確啟用 completion gate 時，未具完備證據的 final
+changed conversation 才回傳 `decision: "continue"`；唯讀 conversation 正常
+結束。在 Windows 透過 `cmd /c` 呼叫產生的 command。
 
 Stop verification 必須明確啟用、具備 trust、為 report-only 且預設 disabled。
 每個 Stop 結果都會讓 native harness 繼續，最多攜帶有界 command evidence，永遠