@kylecheng3146/agent-ops 0.1.5 → 0.1.7

package/README.md

@@ -35,7 +35,7 @@ installation plan.
 
 The interactive multi-select screens start with no harness or profile selected.
 Choose at least one of `codex`, `claude`, and `opencode`, and at least one of
-the `core`, `advisory`, and `guardrails` profiles before confirming. For
+the `core`, `advisory`, `guardrails`, and `loop` profiles before confirming. For
 scripted use, `--harness all` selects all three harnesses; comma-separated
 selections such as `codex,opencode` are also supported. The legacy `both` value
 remains an alias for `codex,claude`.
@@ -64,6 +64,54 @@ agent-ops update --yes --json
 agent-ops uninstall --dry-run --json
 ```
 
+### Project-local loop
+
+`loop` is an explicit, project-only profile for Codex, Claude Code, or both.
+It requires a POSIX-compatible `bash`; the generated native launchers are
+`.sh` files, so Windows is not currently a supported loop host. Preview it
+first, then install only after reviewing the plan. `loop` also implies the
+`core` baseline, so the project retains the managed rules and routing files:
+
+```bash
+agent-ops init --dry-run --scope project --harness codex,claude --profile loop --json
+agent-ops init --scope project --harness codex,claude --profile loop --yes
+```
+
+It creates one small managed launcher per selected native host:
+
+- Codex: `.codex/hooks/agent-ops-loop.sh`, `.codex/config.toml` when absent,
+  `.codex/loop-goal.md`, `.codex/loop-state.md`, and
+  `.codex/loop-telemetry.jsonl`.
+- Claude Code: `.claude/hooks/agent-ops-loop.sh`, `.claude/loop-goal.md`,
+  `.claude/loop-state.md`, and `.claude/loop-telemetry.jsonl`.
+
+The launchers delegate to one installed Node runtime; agent-ops does not copy
+project-specific policy code into either hook directory. It adds an exact,
+hash-commented `.gitignore` block for the goal, state, and telemetry files.
+Those files and `.codex/config.toml` remain user-owned: update never overwrites
+them, and uninstall keeps them while removing only launchers, hook handlers,
+and the managed ignore block.
+
+The loop registers `SessionStart`, `UserPromptSubmit`, `PreToolUse`,
+`PermissionRequest`, `PostToolUse`, `PreCompact`, `PostCompact`,
+`SubagentStart`, and `SubagentStop`; it intentionally does not register
+`Stop`. On high-confidence matches, it blocks literal credential-shaped user
+prompts or Bash commands, plus dangerous Bash commands such as broad recursive
+deletion or `git reset --hard`. Codex uses its documented exit-code denial path; Claude Code
+uses its documented native JSON denial shapes. Permission and escalation
+requests are never auto-approved or denied by the loop, so the harness's normal
+approval prompt remains authoritative.
+
+Session context is bounded and derives from the redacted goal plus a telemetry
+count. Telemetry records only timestamp, event, outcome, and rule code; it
+never stores raw prompts, Bash commands, or credentials and is byte-rotated.
+Before compaction, the loop writes a bounded, redacted Git-status snapshot into
+its own block inside `loop-state.md`, preserving surrounding user text. This is
+a guardrail, not a complete sandbox or a replacement for each harness's own
+permissions. Review and trust the generated hook configuration in Codex and
+Claude Code before use. An existing Codex `.codex/config.toml` with an explicit
+`[features]` / `hooks = false` setting stops installation before any write.
+
 Use `--scope user` with user-home installations. Keep `--dry-run` for any
 operation you want to inspect before applying; non-interactive automation should
 pass `--yes` only after reviewing the plan. Add `--json` when another tool will
@@ -121,6 +169,12 @@ The commands after `init --yes` are post-apply operations. `doctor` reports
 `trust grant` runs, and `smoke-availability` until the configuration declares a
 verification command.
 
+`artifact-staleness` reports `DEGRADED` with `UPDATE_REQUIRED` when a toolkit
+upgrade or effective profile or capability change makes intact managed rules
+differ from the current baseline. Run `agent-ops update` to regenerate them.
+Missing, altered, or hash-mismatched managed artifacts remain `FAIL` under
+`artifacts`.
+
 Installing the `advisory` or `guardrails` profile registers the lifecycle and
 command-policy hooks implied by those profiles for the selected harnesses.
 Claude Code and Codex use their native JSON settings files; opencode uses the agent-ops-owned
@@ -132,11 +186,24 @@ scope, the opencode plugin is placed under
 `$XDG_CONFIG_HOME/opencode/` or `$OPENCODE_CONFIG_DIR/` when that location is
 inside the managed user root. The shims call `agent-ops hook <harness> <event>`
 through the installed absolute runtime path. Advisory failures remain
-fail-open; command-policy failures are fail-closed only where the native
-harness can block the tool. Claude and Codex lifecycle summaries are
-`supported`; OpenCode's app-scoped initialization is `degraded` rather than
-per-session coverage. Codex command denial remains `unknown` until native
-blocking is confirmed.
+fail-open. Runtime-failure enforcement is deliberately narrow: Claude Code can
+emit its documented `PreToolUse` denial shape for a classified invalid installed
+configuration, and the managed OpenCode `tool.execute.before` plugin throws
+its documented command-policy denial or unavailable-runtime error for its
+supported Bash surface. Codex command policy is `unknown` and explicitly
+non-enforcing for the ordinary `guardrails` profile. The project-local `loop`
+profile uses its separate native hook policy described above. These are output
+and plugin contracts, not proof that a host
+honors a denial. Claude and Codex lifecycle summaries are `supported`; OpenCode's
+app-scoped initialization is `degraded` rather than per-session coverage.
+
+Claude's invalid-config fallback has four safeguards: only an invalid (not
+absent) `.agent-ops/config.json` can reach it; a safely read manifest must list
+the current harness; `AGENT_OPS_DISABLE=1` must not be set; and Claude's denial
+reason names the config file with a repair or temporary shell-disable remedy.
+`AGENT_OPS_DISABLE=1` is a human-shell recovery variable only. Agent-ops never
+reads it from configuration, a manifest, or another file it writes. Every
+`SessionStart` and `Stop` failure path remains fail-open.
 
 `guardrails` enables command policy only; it does not imply Stop verification.
 Stop verification is an explicit, disabled-by-default config feature. Enable it
@@ -173,6 +240,15 @@ files authoritative. Existing installations with the previous canonical
 wording are migrated by `agent-ops update`; changed managed blocks still fail
 closed.
 
+### Rejected proposals and deliberate boundaries
+
+The following proposals are deliberately rejected: emitting a model-visible
+`SessionStart` advisory summary, inspecting user-authored Markdown link
+integrity in `doctor`, and creating backups for agent-authored rule edits.
+Transactional backups remain limited to agent-ops apply operations. Agent-ops
+also does not add a git-workflow instruction to the generated baseline, which
+stays project-neutral.
+
 Dry-run plans keep harness settings writes opaque: human and JSON output expose
 only the expected hash, content hash, and a safe summary. Use
 `--hook-target <harness>=<surface-id>` when selecting a non-default discovered
@@ -185,6 +261,28 @@ For a full command reference, run `agent-ops --help`. The `task`, `verify`, and
 `review` commands support acceptance tracking and independent verification when
 the project configuration defines those workflows.
 
+### External review
+
+`agent-ops review` can hand the review to another agent CLI, so the work is not
+judged by the agent that produced it. Enable it during `agent-ops init` (the
+default is off) and pick an ordered fallback chain of targets: `codex`, `agy`
+(Antigravity), and `claude`. Each is launched with its own read-only flag, and a
+target without one is skipped rather than run unsandboxed — which is why
+`opencode` is not a review target despite being a supported harness.
+
+The first target that actually runs produces the verdict. A `FAIL` is final:
+the chain never retries elsewhere after a real verdict. `--yes` is still
+required for every run, since each run spends another provider's quota.
+
+Authentication is diagnosed, never guessed:
+
+```bash
+agent-ops doctor              # presence only: no tokens, no network
+agent-ops doctor --check-auth # one real print call per configured target
+```
+
+See [Configuration](docs/en/guides/configuration.md) for the full contract.
+
 ## Project principles
 
 - Define verifiable success before making changes.

package/dist/packages/cli/src/args.js

@@ -12,7 +12,9 @@ export const COMMAND_NAMES = [
 ];
 const COMMAND_SET = new Set(COMMAND_NAMES);
 const SCOPES = new Set(["project", "user"]);
-const PROFILES = new Set(["advisory", "core", "guardrails"]);
+const PROFILES = new Set(["advisory", "core", "guardrails", "loop"]);
+// opencode is absent: it has no read-only flag, so it cannot review.
+const REVIEW_TARGETS = new Set(["agy", "claude", "codex"]);
 export class CliArgumentError extends Error {
     code;
     option;
@@ -65,8 +67,10 @@ export function parseArgs(argv) {
     let title;
     let sessionId;
     const profiles = [];
+    const reviewTargets = [];
     const criteria = [];
     const evidence = [];
+    let checkAuth = false;
     let dryRun = false;
     let json = false;
     let yes = false;
@@ -121,6 +125,18 @@ export function parseArgs(argv) {
                 index += 1;
                 break;
             }
+            case "--review-target": {
+                const value = readOptionValue(argv, index, token);
+                if (!REVIEW_TARGETS.has(value)) {
+                    invalidValue(token, value);
+                }
+                if (reviewTargets.includes(value)) {
+                    duplicate(`${token} ${value}`);
+                }
+                reviewTargets.push(value);
+                index += 1;
+                break;
+            }
             case "--task": {
                 if (taskId !== undefined) {
                     duplicate(token);
@@ -163,6 +179,12 @@ export function parseArgs(argv) {
                 index += 1;
                 break;
             }
+            case "--check-auth":
+                if (checkAuth) {
+                    duplicate(token);
+                }
+                checkAuth = true;
+                break;
             case "--dry-run":
                 if (dryRun) {
                     duplicate(token);
@@ -249,7 +271,9 @@ export function parseArgs(argv) {
             title !== undefined ||
             criteria.length > 0 ||
             evidence.length > 0 ||
+            reviewTargets.length > 0 ||
             sessionId !== undefined ||
+            checkAuth ||
             dryRun ||
             yes) {
             throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Only --json may be combined with global help or version.");
@@ -284,6 +308,12 @@ export function parseArgs(argv) {
         command !== "update") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--hook-target may be used only with init or update.");
     }
+    if (checkAuth && command !== "doctor") {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--check-auth may be used only with doctor.");
+    }
+    if (reviewTargets.length > 0 && command !== "init") {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--review-target may be used only with init.");
+    }
     if (command === "task") {
         if (harness !== undefined ||
             profiles.length > 0 ||
@@ -345,9 +375,11 @@ export function parseArgs(argv) {
         ...(taskId === undefined ? {} : { taskId }),
         ...(targetVersion === undefined ? {} : { targetVersion }),
         ...(title === undefined ? {} : { title }),
+        ...(reviewTargets.length === 0 ? {} : { reviewTargets }),
         ...(criteria.length === 0 ? {} : { criteria }),
         ...(evidence.length === 0 ? {} : { evidence }),
         ...(sessionId === undefined ? {} : { sessionId }),
+        ...(checkAuth ? { checkAuth } : {}),
         dryRun,
         json,
         yes

package/dist/packages/cli/src/bin.js

@@ -29,6 +29,9 @@ import { formatInstallPlan, runInitCommand } from "./commands/init.js";
 import { formatUninstallPlan, runUninstallCommand } from "./commands/uninstall.js";
 import { runTaskCommand } from "./commands/task.js";
 import { runReviewCommand } from "./commands/review.js";
+import { createReviewExecutor } from "../../../runtime/src/review/execute.js";
+import { probeReviewTarget } from "../../../runtime/src/review/probe.js";
+import { resolveReviewRole } from "../../../runtime/src/review/roles.js";
 import { runTrustCommand } from "./commands/trust.js";
 import { runVerifyCommand } from "./commands/verify.js";
 import { formatUpdatePlan, runUpdateCommand } from "./commands/update.js";
@@ -131,6 +134,7 @@ else {
                     const config = (await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config;
                     return await runDoctorCommand({
                         root,
+                        toolkitVersion: CLI_VERSION,
                         probes: {
                             hookRegistration: async () => hookRegistrationSatisfied({
                                 harness: await installedHarness(root),
@@ -138,8 +142,12 @@ else {
                                 sources: await hookSources(root, args.scope === "user" ? "user" : "project")
                             }),
                             repositoryTrust: async () => repositoryTrustStatus(await repositoryTrust(root, config, CLI_VERSION)),
-                            smokeAvailability: () => smokeAvailabilityStatus(config)
-                        }
+                            smokeAvailability: () => smokeAvailabilityStatus(config),
+                            reviewTarget: async (target, deep) => await probeReviewTarget(target, { cwd: root, deep })
+                        },
+                        ...(args.checkAuth === true
+                            ? { checkReviewTargetAuth: true }
+                            : {})
                     });
                 }
                 if (args.command === "uninstall") {
@@ -157,6 +165,7 @@ else {
                         adapters: commonHarnessAdapters(),
                         registry: new NpmRegistryClient(),
                         isTTY,
+                        toolkitVersion: CLI_VERSION,
                         hookRuntimePath: HOOK_RUNTIME_PATH,
                         ...(args.hookTargets === undefined
                             ? {}
@@ -177,9 +186,37 @@ else {
                     });
                 }
                 if (args.command === "review") {
+                    const reviewSessionId = process.env.AGENT_OPS_SESSION_ID;
+                    const reviewConfig = (await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config;
+                    const reviewRole = resolveReviewRole("independent-review", reviewConfig.reviewRoles ?? []);
                     return await runReviewCommand({
                         args,
-                        authorized: args.yes
+                        authorized: args.yes,
+                        tasks: taskService,
+                        ...(reviewSessionId === undefined
+                            ? {}
+                            : { sessionId: reviewSessionId }),
+                        ...(reviewConfig.reviewRoles === undefined
+                            ? {}
+                            : { roles: reviewConfig.reviewRoles }),
+                        execute: createReviewExecutor({
+                            targets: reviewRole?.targets ?? [],
+                            cwd: root,
+                            ...(reviewRole?.model === undefined
+                                ? {}
+                                : { model: reviewRole.model }),
+                            ...(reviewRole?.effort === undefined
+                                ? {}
+                                : { effort: reviewRole.effort }),
+                            ...(reviewRole?.timeoutMs === undefined
+                                ? {}
+                                : { timeoutMs: reviewRole.timeoutMs }),
+                            onProgress: (line) => {
+                                if (!args.json) {
+                                    process.stderr.write(`${line}\n`);
+                                }
+                            }
+                        })
                     });
                 }
                 if (args.command === "config") {

package/dist/packages/cli/src/cli.js

@@ -2,6 +2,7 @@ import { CliArgumentError, parseArgs } from "./args.js";
 import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { errorEnvelope, okEnvelope, writeEnvelope } from "./output.js";
 import { completeInitChoices } from "./wizard.js";
+import { probeReviewTarget } from "../../../runtime/src/review/probe.js";
 import { BANNER } from "./ui.js";
 export function renderWelcome(color) {
     const cyan = color ? "\u001b[36m" : "";
@@ -31,7 +32,11 @@ Options:
   --scope <project|user>
   --harness <all|both|claude|codex|opencode|comma-separated>  Init/update
   --hook-target <harness=surface-id>  Repeatable advanced init/update option
-  --profile <core|advisory|guardrails>  Repeatable
+  --profile <core|advisory|guardrails|loop>  Repeatable
+  --review-target <codex|agy|claude>  Repeatable init option; external review
+                                      targets in fallback-chain order
+  --check-auth                        Doctor only: probe each review target's
+                                      authentication with one real call
   --task <id>
   --target-version <version>          Update target version (offline-capable)
   --title <text>
@@ -76,7 +81,13 @@ export async function runCli(argv, io, services) {
     }
     try {
         if (args.command === "init") {
-            args = await completeInitChoices(args, args.json ? { ...io, isTTY: false } : io);
+            args = await completeInitChoices(args, args.json ? { ...io, isTTY: false } : io, {
+                probeReviewTarget: async (target) => (await probeReviewTarget(target, {
+                    cwd: process.cwd(),
+                    deep: true
+                })) === "ok",
+                warn: (message) => io.writeStderr(`${message}\n`)
+            });
         }
         const execute = args.command === "help" || args.command === "version"
             ? services.execute

package/dist/packages/cli/src/codex-loop-process.js

@@ -0,0 +1,70 @@
+import { PROJECT_LOOP_EVENTS, runProjectLoop } from "../../../runtime/src/hooks/codex-loop.js";
+const MAX_LOOP_INPUT_BYTES = 64 * 1024;
+function isLoopHarness(value) {
+    return value === "claude" || value === "codex";
+}
+function isLoopEvent(value) {
+    return (value !== undefined &&
+        PROJECT_LOOP_EVENTS.includes(value));
+}
+async function readStdin(stream) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of stream) {
+        const buffer = Buffer.isBuffer(chunk)
+            ? chunk
+            : Buffer.from(String(chunk), "utf8");
+        total += buffer.byteLength;
+        if (total > MAX_LOOP_INPUT_BYTES) {
+            return null;
+        }
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks, total).toString("utf8");
+}
+function parseInput(source) {
+    if (source === null) {
+        return null;
+    }
+    try {
+        return JSON.parse(source);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Process boundary for the generated Bash launchers. Invalid input stays
+ * fail-open; the runtime owns every policy decision and output shape.
+ */
+export async function runLoopProcess(argv, io, dependencies = {}) {
+    const [harness, event] = argv;
+    if (!isLoopHarness(harness) || !isLoopEvent(event)) {
+        return 0;
+    }
+    try {
+        const result = await runProjectLoop({
+            harness,
+            event,
+            input: parseInput(await readStdin(io.stdin)),
+            root: dependencies.root ?? process.cwd(),
+            ...(dependencies.now === undefined ? {} : { now: dependencies.now }),
+            ...(dependencies.gitStatus === undefined
+                ? {}
+                : { gitStatus: dependencies.gitStatus }),
+            ...(dependencies.telemetryMaxBytes === undefined
+                ? {}
+                : { telemetryMaxBytes: dependencies.telemetryMaxBytes })
+        });
+        if (result.stdout.length > 0) {
+            io.writeStdout(result.stdout);
+        }
+        if (result.stderr.length > 0) {
+            io.writeStderr(result.stderr);
+        }
+        return result.exitCode;
+    }
+    catch {
+        return 0;
+    }
+}

package/dist/packages/cli/src/commands/hook.js

@@ -7,6 +7,18 @@ export const HOOK_EVENTS = [
     "PreToolUse",
     "Stop"
 ];
+/**
+ * Keep adapter normalization at the command boundary so exceptional hook
+ * paths use the same native-event interpretation as normal dispatch.
+ */
+export function normalizeHookInput(harness, input) {
+    try {
+        return harnessDescriptor(harness).runtime.normalizeInput(input);
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Hooks are advisory infrastructure: every failure path stays fail-open with
  * exit code 0 so a broken toolkit can never wedge the harness.
@@ -24,7 +36,10 @@ export async function runHookCommand(options) {
             return { exitCode: 0, stdout: "", stderr: "" };
         }
         const descriptor = harnessDescriptor(options.harness);
-        const normalized = descriptor.runtime.normalizeInput(input);
+        const normalized = normalizeHookInput(options.harness, input);
+        if (normalized === null) {
+            return { exitCode: 0, stdout: "", stderr: "" };
+        }
         const stopRegistration = descriptor.control.registrations.find(({ capability }) => capability === "optional-stop-verify");
         const stopVerification = options.stopVerification !== undefined &&
             stopRegistration?.support !== "unsupported"

package/dist/packages/cli/src/commands/init.js

@@ -63,7 +63,10 @@ export async function runInitCommand(options) {
             : { hookRuntimePath: options.hookRuntimePath }),
         ...((options.hookTargets ?? args.hookTargets) === undefined
             ? {}
-            : { hookTargets: options.hookTargets ?? args.hookTargets })
+            : { hookTargets: options.hookTargets ?? args.hookTargets }),
+        ...(args.reviewTargets === undefined
+            ? {}
+            : { reviewTargets: args.reviewTargets })
     });
     if (args.dryRun) {
         return okEnvelope("INIT_PLAN_READY", {

package/dist/packages/cli/src/commands/review.js

@@ -3,18 +3,78 @@ import { runIndependentReview } from "../../../../runtime/src/review/runner.js";
 import { resolveReviewRole } from "../../../../runtime/src/review/roles.js";
 import { okEnvelope } from "../output.js";
 /**
- * Review runs against one harness. Argument parsing already rejects a
+ * Review runs against one target. Argument parsing already rejects a
  * multi-harness selection here, so the first entry is the whole selection.
+ * `opencode` is not a review target — it has no read-only flag — so selecting
+ * it leaves the target unresolved and the configured chain decides.
  */
 function harness(value) {
-    return value?.[0] ?? "codex";
+    const selected = value?.[0];
+    return selected === undefined || selected === "opencode"
+        ? undefined
+        : selected;
 }
-export async function runReviewCommand(options) {
-    const ids = options.args.criteria ?? [];
-    const criteria = ids.map((id) => ({
-        id,
-        description: id
+/**
+ * Criterion descriptions come from the task store, never from the id. A
+ * reviewer handed `criterion: tests` cannot review anything, so a review with
+ * no task context is reported as not run rather than run meaninglessly.
+ */
+async function taskContext(options) {
+    const tasks = options.tasks;
+    if (tasks === undefined) {
+        return undefined;
+    }
+    const query = options.taskId !== undefined
+        ? { taskId: options.taskId }
+        : options.sessionId === undefined
+            ? undefined
+            : { sessionId: options.sessionId };
+    if (query === undefined) {
+        return undefined;
+    }
+    let record;
+    try {
+        record = await tasks.status(query);
+    }
+    catch {
+        return undefined;
+    }
+    const requested = options.args.criteria ?? [];
+    const criteria = record.task.criteria
+        .filter((criterion) => requested.length === 0 || requested.includes(criterion.id))
+        .map((criterion) => ({
+        id: criterion.id,
+        description: criterion.description,
+        verifierIds: [...criterion.verifierIds]
     }));
+    if (criteria.length === 0 ||
+        (requested.length > 0 && criteria.length !== requested.length)) {
+        return undefined;
+    }
+    return {
+        taskId: record.task.id,
+        active: record.status === "active",
+        criteria
+    };
+}
+function notRunEnvelope(result) {
+    const message = "Independent review was not run.";
+    return {
+        code: "REVIEW_NOT_RUN",
+        status: "error",
+        data: {
+            message,
+            result,
+            text: [message, `Reason: ${result.reason ?? "unknown"}.`, ""].join("\n")
+        },
+        errors: [{ code: "REVIEW_NOT_RUN", message }]
+    };
+}
+export async function runReviewCommand(options) {
+    const role = resolveReviewRole(options.role ?? "independent-review", options.roles ?? []);
+    const selectedHarness = harness(options.args.harness);
+    const target = role?.targets[0] ?? selectedHarness ?? "codex";
+    const context = await taskContext(options);
     const evidenceRequirements = (options.args.evidence ?? []).map((value) => {
         const separator = value.indexOf("=");
         return {
@@ -22,11 +82,22 @@ export async function runReviewCommand(options) {
             requirement: separator < 0 ? value : value.slice(separator + 1)
         };
     });
-    const selectedHarness = harness(options.args.harness);
-    const role = resolveReviewRole(options.role ?? "independent-review", options.roles ?? []);
+    if (options.tasks !== undefined && context === undefined) {
+        return notRunEnvelope({
+            status: "NOT_RUN",
+            reason: "no-task-context",
+            harness: target,
+            model: role?.model ?? options.model ?? "configured",
+            effort: role?.effort ?? options.effort ?? "configured",
+            prompt: ""
+        });
+    }
+    const criteria = context?.criteria !== undefined
+        ? [...context.criteria]
+        : (options.args.criteria ?? []).map((id) => ({ id, description: id }));
     const result = await runIndependentReview({
         invocation: {
-            harness: role?.harness ?? selectedHarness,
+            harness: target,
             model: role?.model ?? options.model ?? "configured",
             effort: role?.effort ?? options.effort ?? "configured",
             packet: buildReviewPacket({
@@ -42,6 +113,17 @@ export async function runReviewCommand(options) {
             reason: "missing-cli"
         }))
     });
+    // Evidence is only appended while the task is active: a completed record
+    // must stay exactly as it was verified.
+    if (options.tasks !== undefined &&
+        context !== undefined &&
+        context.active &&
+        result.results !== undefined) {
+        await options.tasks.recordEvidence(context.taskId, Object.fromEntries(result.results.map((item) => [
+            item.criterionId,
+            item.evidence.map((reference) => `review:${target}:${reference}`)
+        ])));
+    }
     const message = result.status === "PASS"
         ? "Independent review passed."
         : result.status === "FAIL"
@@ -55,6 +137,11 @@ export async function runReviewCommand(options) {
             `Status: ${result.status}`,
             `Harness: ${result.harness}; model: ${result.model}; effort: ${result.effort}.`,
             ...(result.reason === undefined ? [] : [`Reason: ${result.reason}.`]),
+            ...(result.status === "NOT_RUN"
+                ? [
+                    "Run: agent-ops doctor --check-auth to verify target authentication."
+                ]
+                : []),
             ...(result.results === undefined
                 ? []
                 : result.results.map((item) => `${item.criterionId}: ${item.status} [${item.evidence.join(", ")}]`)),

package/dist/packages/cli/src/commands/update.js

@@ -38,6 +38,9 @@ export async function runUpdateCommand(options) {
         ...(options.targetVersion === undefined
             ? {}
             : { targetVersion: options.targetVersion }),
+        ...(options.toolkitVersion === undefined
+            ? {}
+            : { toolkitVersion: options.toolkitVersion }),
         ...(options.hookRuntimePath === undefined
             ? {}
             : { hookRuntimePath: options.hookRuntimePath }),