@kylecheng3146/agent-ops 0.1.6 → 0.1.8

package/dist/runtime/src/task/service.js

@@ -73,6 +73,10 @@ export class TaskService {
         this.#now = options.now ?? (() => new Date().toISOString());
     }
     async create(input) {
+        if (input.policyConfigHash !== undefined &&
+            !/^[a-f0-9]{64}$/u.test(input.policyConfigHash)) {
+            throw taskError("TASK_POLICY_CONFIG_INVALID", "Policy config hash must be a lowercase SHA-256 digest.");
+        }
         const task = {
             schemaVersion: TASK_SCHEMA_VERSION,
             id: this.#generateId(),
@@ -96,7 +100,8 @@ export class TaskService {
                 updatedAt: now,
                 completedAt: null,
                 archivedAt: null,
-                failureFingerprint: null
+                failureFingerprint: null,
+                policyConfigHash: input.policyConfigHash ?? null
             };
             state.tasks.push(record);
             return cloneRecord(record);
@@ -181,6 +186,46 @@ export class TaskService {
             return cloneRecord(completed);
         });
     }
+    /**
+     * Append evidence for some criteria without completing the task. Unlike
+     * `complete`, the input may be partial — an independent review covers the
+     * criteria it was asked about, not necessarily all of them. Only an active
+     * task accepts evidence: a completed record must stay exactly as it was
+     * verified.
+     */
+    async recordEvidence(taskId, evidenceInput) {
+        const now = assertTimestamp(this.#now());
+        return await this.#store.mutate((state) => {
+            const current = findTask(state, taskId);
+            if (current.status !== "active") {
+                throw taskError("TASK_NOT_ACTIVE", "Only an active task can record additional evidence.");
+            }
+            const criterionIds = new Set(current.task.criteria.map((criterion) => criterion.id));
+            const evidence = Object.fromEntries(Object.entries(current.evidence).map(([criterionId, references]) => [
+                criterionId,
+                [...references]
+            ]));
+            for (const [criterionId, references] of Object.entries(evidenceInput)) {
+                if (!criterionIds.has(criterionId)) {
+                    throw taskError("TASK_EVIDENCE_UNKNOWN_CRITERION", `Unknown criterion: ${criterionId}`);
+                }
+                if (references.length === 0 ||
+                    references.some((reference) => typeof reference !== "string" || reference.trim().length === 0)) {
+                    throw taskError("TASK_EVIDENCE_INVALID", `Evidence for ${criterionId} must be non-empty references.`);
+                }
+                evidence[criterionId] = [
+                    ...new Set([...(evidence[criterionId] ?? []), ...references])
+                ];
+            }
+            const updated = {
+                ...current,
+                evidence,
+                updatedAt: now
+            };
+            replaceTask(state, updated);
+            return cloneRecord(updated);
+        });
+    }
     async archive(taskId) {
         const now = assertTimestamp(this.#now());
         return await this.#store.mutate((state) => {

package/dist/runtime/src/task/store.js

@@ -64,9 +64,13 @@ function parseTaskRecord(value) {
         "task",
         "updatedAt"
     ];
-    if (!isRecord(value) ||
-        (!hasExactKeys(value, baseKeys) &&
-            !hasExactKeys(value, [...baseKeys, "failureFingerprint"]))) {
+    const allowedKeys = new Set([
+        baseKeys.join("\0"),
+        [...baseKeys, "failureFingerprint"].sort().join("\0"),
+        [...baseKeys, "policyConfigHash"].sort().join("\0"),
+        [...baseKeys, "failureFingerprint", "policyConfigHash"].sort().join("\0")
+    ]);
+    if (!isRecord(value) || !allowedKeys.has(Object.keys(value).sort().join("\0"))) {
         return invalidState("Task state contains an invalid task record.");
     }
     const task = validateTask(value.task);
@@ -127,6 +131,13 @@ function parseTaskRecord(value) {
             recordedAt: fingerprint.recordedAt
         };
     }
+    const policyConfigHash = value.policyConfigHash === undefined
+        ? null
+        : value.policyConfigHash;
+    if (policyConfigHash !== null &&
+        (typeof policyConfigHash !== "string" || !/^[a-f0-9]{64}$/u.test(policyConfigHash))) {
+        return invalidState("Task state contains an invalid policy config hash.");
+    }
     return {
         task: task.value,
         status,
@@ -135,7 +146,8 @@ function parseTaskRecord(value) {
         updatedAt: value.updatedAt,
         completedAt: value.completedAt,
         archivedAt: value.archivedAt,
-        failureFingerprint
+        failureFingerprint,
+        policyConfigHash
     };
 }
 function parseSession(value) {

package/dist/runtime/src/verify/change-surface.js

@@ -4,7 +4,7 @@ const WINDOWS_RESERVED_SEGMENT = /^(?:aux|com[1-9]|con|lpt[1-9]|nul|prn)(?:\..*)
 function sortedUnique(values) {
     return [...new Set(values)].sort();
 }
-function normalizePortablePath(path) {
+export function normalizePortablePath(path) {
     if (path.length === 0 ||
         path.includes("\\") ||
         path.startsWith("/") ||
@@ -31,7 +31,7 @@ function normalizePortablePath(path) {
     }
     return normalizedSegments.join("/");
 }
-function parseNulPaths(stdout) {
+export function parseNulPaths(stdout) {
     if (stdout.byteLength === 0) {
         return [];
     }
@@ -64,11 +64,19 @@ export async function collectChangeSurface(runner) {
         "diff",
         "--cached",
         "--name-only",
+        "--full-name",
+        "--no-renames",
+        "--no-ext-diff",
+        "--no-textconv",
         "-z"
     ]);
     const unstaged = await collectPaths(runner, [
         "diff",
         "--name-only",
+        "--full-name",
+        "--no-renames",
+        "--no-ext-diff",
+        "--no-textconv",
         "-z"
     ]);
     const untracked = await collectPaths(runner, [
@@ -84,3 +92,31 @@ export async function collectChangeSurface(runner) {
         paths: sortedUnique([...staged, ...unstaged, ...untracked])
     };
 }
+function decodeCommit(stdout) {
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(stdout).trim();
+    }
+    catch (error) {
+        throw new AgentOpsError("CHANGE_SURFACE_INVALID_OUTPUT", "Git commit output is not valid UTF-8.", { cause: error });
+    }
+    if (!/^[a-f0-9]{40,64}$/u.test(text)) {
+        throw new AgentOpsError("CHANGE_SURFACE_INVALID_OUTPUT", "Git did not return one commit object ID.");
+    }
+    return text;
+}
+export async function resolveGitCommit(runner, ref) {
+    const result = await runner.run([
+        "rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`
+    ]);
+    if (result.exitCode !== 0) {
+        throw new AgentOpsError("CHANGE_SURFACE_GIT_FAILED", "The requested base ref does not resolve to a commit.");
+    }
+    return decodeCommit(result.stdout);
+}
+export async function collectBaseChangePaths(runner, base) {
+    return await collectPaths(runner, [
+        "diff", "--name-only", "--full-name", "--no-renames", "--no-ext-diff",
+        "--no-textconv", "-z", `${base}...HEAD`
+    ]);
+}

package/dist/runtime/src/verify/command-executor.js

@@ -102,7 +102,10 @@ export async function executeConfiguredCommand(command, options) {
 }
 export function aggregateVerificationStatus(results) {
     const required = results.filter((result) => result.required);
-    const gating = required.length > 0 ? required : results;
+    if (required.length === 0) {
+        return "PASS";
+    }
+    const gating = required;
     if (gating.some((result) => result.status === "FAIL")) {
         return "FAIL";
     }

package/dist/runtime/src/verify/evidence.js

@@ -3,6 +3,7 @@ import { EVIDENCE_SCHEMA_VERSION } from "../contracts.js";
 import { sha256 } from "../fs/hash.js";
 import { AgentOpsError } from "../fs/paths.js";
 import { calculateConfigHash } from "../config/hash.js";
+import { evaluateTestCount } from "./test-count.js";
 export { calculateConfigHash } from "../config/hash.js";
 import { validateEvidence } from "../schema/validate.js";
 import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
@@ -34,10 +35,24 @@ export function buildVerificationEvidence(input) {
         finishedAt: input.finishedAt,
         exitCode: input.exitCode,
         testCount: input.testCount,
+        status: input.status,
+        failureClass: redactSecrets(input.failureClass),
+        sourceFingerprint: input.sourceFingerprint,
         toolVersions: redactRecord(input.toolVersions),
         configHash: calculateConfigHash(input.config)
     });
 }
+/** Confirms that a persisted PASS still matches the current command contract. */
+export function isPassingVerificationEvidence(command, evidence) {
+    if (evidence.status !== "PASS" ||
+        evidence.exitCode !== 0 ||
+        evidence.failureClass !== "none" ||
+        command.evidence.kind === "file") {
+        return false;
+    }
+    return command.evidence.kind !== "test-count" ||
+        evaluateTestCount(evidence.testCount, command.evidence.minimum).status === "PASS";
+}
 export class FileEvidenceStore {
     #root;
     #anchorDirectory;
@@ -66,4 +81,25 @@ export class FileEvidenceStore {
         }
         return relativePath;
     }
+    async load(reference) {
+        const segments = reference.split("/");
+        if (!reference.startsWith(".agent-ops/tasks/evidence/") ||
+            segments.some((segment) => segment.length === 0 ||
+                segment === "." ||
+                segment === ".." ||
+                !/^[A-Za-z0-9._-]+$/u.test(segment))) {
+            return null;
+        }
+        const path = join(this.#root, ...segments);
+        const source = await readPrivateFile(path, this.#anchorDirectory);
+        if (source === null) {
+            return null;
+        }
+        try {
+            return JSON.parse(source);
+        }
+        catch {
+            throw new AgentOpsError("EVIDENCE_INVALID", "Stored evidence is not valid JSON.");
+        }
+    }
 }

package/dist/runtime/src/verify/scope.js

@@ -1,4 +1,3 @@
-import { AgentOpsError } from "../fs/paths.js";
 function sortedUnique(values) {
     return [...new Set(values)].sort();
 }
@@ -18,7 +17,7 @@ function sameVerifierIds(left, right) {
 }
 function fallbackSelection(reason, evidence) {
     if (evidence.requiredVerifierIds.length === 0) {
-        throw new AgentOpsError("VERIFICATION_SCOPE_EMPTY", `Verification scope fallback (${reason}) has no required commands.`);
+        return { verifierIds: [], fallback: true, reason, evidence };
     }
     return {
         verifierIds: evidence.requiredVerifierIds,

package/dist/runtime/src/verify/service.js

@@ -1,6 +1,8 @@
 import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
 import { validateTaskAgainstConfig } from "../schema/validate.js";
 import { collectChangeSurface } from "./change-surface.js";
+import { resolveReviewScope, reviewScopeSignature } from "../review/scope.js";
+import { calculateSourceFingerprint } from "./source-fingerprint.js";
 import { buildVerificationEvidence } from "./evidence.js";
 import { createFailureFingerprint } from "./fingerprint.js";
 import { aggregateVerificationStatus, executeConfiguredCommand } from "./command-executor.js";
@@ -41,7 +43,7 @@ export class VerificationService {
         }
         return await resolveContainedPath(this.#options.root, command.cwd);
     }
-    async #persistEvidence(task, command, startedAt, finishedAt, result, exitCode) {
+    async #persistEvidence(task, command, startedAt, finishedAt, result, sourceFingerprint) {
         const references = [];
         for (const criterion of relevantCriteria(task, command.id)) {
             const evidence = buildVerificationEvidence({
@@ -51,8 +53,11 @@ export class VerificationService {
                 scope: this.#options.scope,
                 startedAt,
                 finishedAt,
-                exitCode,
+                exitCode: result.exitCode,
                 testCount: result.testCount,
+                status: result.status,
+                failureClass: result.failureClass,
+                sourceFingerprint,
                 toolVersions: this.#options.toolVersions ?? {},
                 config: this.#options.config
             });
@@ -84,7 +89,6 @@ export class VerificationService {
                 diagnostics: result.diagnostic
             });
         const finishedAt = (this.#options.now ?? (() => new Date().toISOString()))();
-        const evidenceReferences = await this.#persistEvidence(task, command, startedAt, finishedAt, result, result.exitCode);
         return {
             commandId: command.id,
             required: command.required,
@@ -94,7 +98,9 @@ export class VerificationService {
             timedOut: result.timedOut,
             testCount: result.testCount,
             diagnostic: fingerprint?.diagnostics ?? "",
-            evidenceReferences
+            evidenceReferences: [],
+            startedAt,
+            finishedAt
         };
     }
     async verify(taskId) {
@@ -107,23 +113,72 @@ export class VerificationService {
             throw verificationError("VERIFICATION_INPUT_INVALID", validation.errors[0]?.message ??
                 "Task and verification configuration are incompatible.");
         }
-        const surface = await collectChangeSurface(this.#options.gitRunner);
+        const reviewScope = await resolveReviewScope({
+            root: this.#options.root,
+            runner: this.#options.gitRunner,
+            ...(this.#options.base === undefined ? {} : { base: this.#options.base })
+        });
+        const sourceFingerprint = await calculateSourceFingerprint(this.#options.root, reviewScope, this.#options.gitRunner);
+        const worktreeSurface = reviewScope.mode === "worktree"
+            ? await collectChangeSurface(this.#options.gitRunner)
+            : { staged: [], unstaged: [], untracked: [], paths: reviewScope.changedFiles };
+        const surface = worktreeSurface;
         const selection = selectVerificationScope(surface.paths, this.#options.config);
         const results = [];
         for (const commandId of selection.verifierIds) {
             results.push(await this.#runCommand(validation.value, commandById(this.#options.config, commandId)));
         }
-        const status = aggregateVerificationStatus(results);
+        let status = aggregateVerificationStatus(results);
+        let sourceChanged = false;
+        const postflightScope = await resolveReviewScope({
+            root: this.#options.root,
+            runner: this.#options.gitRunner,
+            ...(this.#options.base === undefined ? {} : { base: this.#options.base })
+        });
+        const postflightFingerprint = await calculateSourceFingerprint(this.#options.root, postflightScope, this.#options.gitRunner);
+        if (reviewScopeSignature(reviewScope) !== reviewScopeSignature(postflightScope) ||
+            sourceFingerprint !== postflightFingerprint) {
+            status = "UNKNOWN";
+            sourceChanged = true;
+        }
         let signal = null;
         if (status === "PASS") {
+            const taskEvidence = {};
+            for (const [index, result] of results.entries()) {
+                const command = commandById(this.#options.config, result.commandId);
+                const references = await this.#persistEvidence(validation.value, command, result.startedAt, result.finishedAt, result, sourceFingerprint);
+                results[index] = { ...result, evidenceReferences: references };
+                for (const [criterionIndex, criterion] of relevantCriteria(validation.value, result.commandId).entries()) {
+                    const reference = references[criterionIndex];
+                    if (reference !== undefined) {
+                        taskEvidence[criterion.id] = [
+                            ...(taskEvidence[criterion.id] ?? []),
+                            reference
+                        ];
+                    }
+                }
+            }
+            if (Object.keys(taskEvidence).length > 0) {
+                await this.#options.taskService.recordEvidence(taskId, taskEvidence);
+            }
             await this.#options.taskService.clearFailure(taskId);
         }
         else {
             const required = results.filter((result) => result.required);
-            const gating = required.length > 0 ? required : results;
+            const gating = required;
             const failed = gating.find((result) => result.status !== "PASS");
             if (failed === undefined) {
-                throw verificationError("VERIFICATION_RESULT_INVALID", "Verification failed without a gating result.");
+                if (!sourceChanged) {
+                    throw verificationError("VERIFICATION_RESULT_INVALID", "Verification failed without a required result.");
+                }
+                const advanced = await this.#options.taskService.recordFailure(taskId, createFailureFingerprint({
+                    commandId: "source-snapshot",
+                    failureClass: "source-changed-during-verification",
+                    exitCategory: "no-exit",
+                    diagnostics: "source changed during verification"
+                }));
+                signal = advanced.signal;
+                return { taskId, status, surface, selection, results, signal, reviewScope, sourceFingerprint };
             }
             const advanced = await this.#options.taskService.recordFailure(taskId, createFailureFingerprint({
                 commandId: failed.commandId,
@@ -139,7 +194,9 @@ export class VerificationService {
             surface,
             selection,
             results,
-            signal
+            signal,
+            reviewScope,
+            sourceFingerprint
         };
     }
 }

package/dist/runtime/src/verify/source-fingerprint.js

@@ -0,0 +1,49 @@
+import { readFile, lstat } from "node:fs/promises";
+import { join } from "node:path";
+import { sha256 } from "../fs/hash.js";
+import { AgentOpsError } from "../fs/paths.js";
+import { resolveGitCommit } from "./change-surface.js";
+export async function calculateSourceFingerprint(root, scope, runner) {
+    const head = await resolveGitCommit(runner, "HEAD");
+    if (scope.mode === "base") {
+        return sha256(JSON.stringify({
+            domain: "agent-ops-source-v1",
+            mode: "base",
+            head,
+            base: scope.resolvedBase,
+            paths: [...scope.changedFiles]
+        }));
+    }
+    const paths = [];
+    for (const path of scope.changedFiles) {
+        const absolute = join(root, ...path.split("/"));
+        let entry;
+        try {
+            entry = await lstat(absolute);
+        }
+        catch (error) {
+            if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
+                paths.push({ path, kind: "deleted" });
+                continue;
+            }
+            throw error;
+        }
+        if (!entry.isFile()) {
+            throw new AgentOpsError("SOURCE_SNAPSHOT_UNAVAILABLE", "Review source contains an unsupported entry.");
+        }
+        const bytes = await readFile(absolute);
+        paths.push({
+            path,
+            kind: "file",
+            executable: (entry.mode & 0o111) !== 0,
+            hash: sha256(bytes)
+        });
+    }
+    return sha256(JSON.stringify({
+        domain: "agent-ops-source-v1",
+        mode: "worktree",
+        head,
+        base: null,
+        paths
+    }));
+}

package/dist/runtime/src/verify/spawn.js

@@ -139,13 +139,17 @@ export class NodeVerificationProcessRunner {
             cwd: request.cwd,
             detached: this.#platform !== "win32",
             env: {
-                ...process.env,
+                ...(request.replaceEnv === true ? {} : process.env),
                 ...(request.env ?? {})
             },
             shell: request.shell,
-            stdio: ["ignore", "pipe", "pipe"],
+            stdio: [request.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"],
             windowsHide: true
         });
+        if (request.stdin !== undefined && child.stdin !== null) {
+            child.stdin.on("error", () => { });
+            child.stdin.end(request.stdin);
+        }
         let settled = false;
         const completion = new Promise((resolve) => {
             child.once("error", (error) => {
@@ -263,7 +267,9 @@ export async function runVerificationCommand(command, options) {
             args: [...command.args],
             cwd: options.cwd,
             shell: command.shell === true,
-            ...(options.env === undefined ? {} : { env: options.env })
+            ...(options.env === undefined ? {} : { env: options.env }),
+            ...(options.replaceEnv === true ? { replaceEnv: true } : {}),
+            ...(options.stdin === undefined ? {} : { stdin: options.stdin })
         });
     }
     catch {

package/docs/en/guides/configuration.md

@@ -31,6 +31,74 @@ implies them. Advisory runs through the real SessionStart path and is
 fail-open. Claude and Codex lifecycle support is `supported`; OpenCode begins
 at app initialization and is honestly reported as `degraded`.
 
+### External review targets
+
+`agent-ops review` can call another agent CLI to review your work. It is
+disabled by default: an absent `reviewRoles` field, an absent
+`--review-target` flag, and the interactive question's default all mean off.
+Enable it during `agent-ops init`, or by hand:
+
+```json
+{
+  "reviewRoles": [
+    { "role": "independent-review", "targets": ["claude"] }
+  ]
+}
+```
+
+`targets` is an **ordered fallback chain**. Every review locks to the
+staged/unstaged/untracked surface (or a clean `--base <ref>...HEAD` range),
+requires fresh PASS evidence for required checks, and prints a complete native
+schema report without persisting it.
+
+Every attempt starts from a fresh temporary cwd with a narrow environment. The
+following target identities may be configured; only Claude currently meets the
+complete context-isolation contract and can execute automatically:
+
+| Target | Invocation | Read-only |
+| --- | --- | --- |
+| `codex` | `codex exec` | retained; `capability-unavailable` |
+| `agy` (Antigravity) | `agy -p` | retained; `capability-unavailable` |
+| `claude` | `claude -p` | `--permission-mode plan --safe-mode` |
+
+`opencode` is **not** a review target even though it is a supported harness.
+Its `--agent plan` is rejected as a subagent and silently falls back to a
+writable agent, so it cannot satisfy the read-only precondition. A target with
+no read-only flag is skipped rather than run unsandboxed.
+
+The chain advances only when no review happened — the executable is missing,
+the spawn failed, or the attempt timed out (120s per target by default,
+overridable with `timeoutMs`). A `FAIL` verdict is **terminal**: the chain
+never retries another target after a real verdict, because that would be
+automated review shopping. Unparseable output is terminal too, since it points
+at a prompt or CLI-version mismatch worth surfacing.
+
+If Claude Code is the host (`CLAUDECODE` is set), `claude` is moved to the end
+of the chain. It still runs when it is the only configured target, with a
+`reviewer == host` warning.
+
+Criterion descriptions come from the task bound to the current session, so a
+review needs an attached task created under the current policy configuration;
+`--criterion` filters those ids. Run `agent-ops verify` first: review rejects
+stale, failed, or source-mismatched required evidence before any model call.
+Compact PASS evidence is appended with a `review:<target>:` prefix; the full
+human-readable report is transient. Completed tasks are never rewritten.
+
+`--yes` is still required for every review run: init selection decides which
+targets are permitted, `--yes` decides whether to spend money now.
+
+Because target authentication is not sniffed from stderr, an unauthenticated
+CLI surfaces as one review failure. Diagnose it with:
+
+```bash
+agent-ops doctor              # presence only: no tokens, no network
+agent-ops doctor --check-auth # one real print call per target
+```
+
+`--check-auth` is a dedicated flag; `--yes` stays inert for doctor. Doctor
+reports what to do but never fixes it: every target authenticates through
+interactive OAuth, so there is no `--fix`. Run `<target> login` yourself.
+
 ### Project-local loop profile
 
 `--profile loop` is an opt-in project-scope profile. Select `codex`, `claude`,

package/docs/en/spec/review.md

@@ -22,11 +22,44 @@ A review result MUST preserve PASS, FAIL, or NOT_RUN and MUST NOT convert NOT_RU
 
 ## REVIEW-HARNESS-001
 
-A review invocation MUST resolve to exactly one concrete harness, even when an
-installation supports multiple harnesses.
+A review invocation MUST resolve to exactly one concrete review target, even
+when an installation supports multiple harnesses.
 
 - Trigger: Running `review` with a harness selection.
-- Action: Select one of `codex`, `claude`, or `opencode`; keep multi-harness installation separate from review execution.
+- Action: Select one of `codex`, `agy`, or `claude`; keep multi-harness installation separate from review execution.
 - Evidence: Argument parsing rejects `all`, `both`, and comma-separated multi-harness values for review.
-- Positive: `review --harness opencode` resolves one harness.
+- Positive: `review --harness claude` resolves one target.
 - Negative: `Run one review invocation against every installed harness implicitly.`
+
+## REVIEW-READONLY-001
+
+A review target MUST be launched with its own read-only mechanism, and a target
+without one MUST be skipped rather than run unsandboxed.
+
+- Trigger: Building a review invocation for a configured target.
+- Action: Pass `-s read-only` (codex), `--sandbox --mode plan` (agy), or `--permission-mode plan` (claude); treat any other target as ineligible.
+- Evidence: The spawned argv contains the target's read-only flags.
+- Positive: `opencode is not a review target: --agent plan silently falls back to a writable agent.`
+- Negative: `Trust the prompt to stop the reviewer from editing files.`
+
+## REVIEW-CHAIN-001
+
+Configured targets form an ordered fallback chain that MUST advance only when
+no review happened, and MUST NOT advance past a verdict.
+
+- Trigger: A configured target is missing, fails to spawn, or times out.
+- Action: Try the next target; on PASS, FAIL, or unparseable output, stop and report that outcome.
+- Evidence: The number of spawned attempts matches the failures that preceded the verdict.
+- Positive: `codex FAIL is final; agy is never asked for a second opinion.`
+- Negative: `Retry other targets after a FAIL until one reports PASS.`
+
+## REVIEW-CONTRACT-001
+
+A response that breaks the reply contract MUST be reported as NOT_RUN, not as
+FAIL.
+
+- Trigger: The reviewer omits, duplicates, or invents a criterion, or returns blank evidence.
+- Action: Report `NOT_RUN` with reason `unparseable-output`, write no evidence, and keep FAIL for judged inadequacy.
+- Evidence: The result reason distinguishes a protocol violation from a verdict.
+- Positive: `NOT_RUN: unparseable-output; one criterion was missing.`
+- Negative: `Record a failed review because the model's JSON was malformed.`