@kylecheng3146/agent-ops 0.1.7 → 0.1.8

package/dist/runtime/src/verify/evidence.js

@@ -3,6 +3,7 @@ import { EVIDENCE_SCHEMA_VERSION } from "../contracts.js";
 import { sha256 } from "../fs/hash.js";
 import { AgentOpsError } from "../fs/paths.js";
 import { calculateConfigHash } from "../config/hash.js";
+import { evaluateTestCount } from "./test-count.js";
 export { calculateConfigHash } from "../config/hash.js";
 import { validateEvidence } from "../schema/validate.js";
 import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
@@ -34,10 +35,24 @@ export function buildVerificationEvidence(input) {
         finishedAt: input.finishedAt,
         exitCode: input.exitCode,
         testCount: input.testCount,
+        status: input.status,
+        failureClass: redactSecrets(input.failureClass),
+        sourceFingerprint: input.sourceFingerprint,
         toolVersions: redactRecord(input.toolVersions),
         configHash: calculateConfigHash(input.config)
     });
 }
+/** Confirms that a persisted PASS still matches the current command contract. */
+export function isPassingVerificationEvidence(command, evidence) {
+    if (evidence.status !== "PASS" ||
+        evidence.exitCode !== 0 ||
+        evidence.failureClass !== "none" ||
+        command.evidence.kind === "file") {
+        return false;
+    }
+    return command.evidence.kind !== "test-count" ||
+        evaluateTestCount(evidence.testCount, command.evidence.minimum).status === "PASS";
+}
 export class FileEvidenceStore {
     #root;
     #anchorDirectory;
@@ -66,4 +81,25 @@ export class FileEvidenceStore {
         }
         return relativePath;
     }
+    async load(reference) {
+        const segments = reference.split("/");
+        if (!reference.startsWith(".agent-ops/tasks/evidence/") ||
+            segments.some((segment) => segment.length === 0 ||
+                segment === "." ||
+                segment === ".." ||
+                !/^[A-Za-z0-9._-]+$/u.test(segment))) {
+            return null;
+        }
+        const path = join(this.#root, ...segments);
+        const source = await readPrivateFile(path, this.#anchorDirectory);
+        if (source === null) {
+            return null;
+        }
+        try {
+            return JSON.parse(source);
+        }
+        catch {
+            throw new AgentOpsError("EVIDENCE_INVALID", "Stored evidence is not valid JSON.");
+        }
+    }
 }

package/dist/runtime/src/verify/scope.js

@@ -1,4 +1,3 @@
-import { AgentOpsError } from "../fs/paths.js";
 function sortedUnique(values) {
     return [...new Set(values)].sort();
 }
@@ -18,7 +17,7 @@ function sameVerifierIds(left, right) {
 }
 function fallbackSelection(reason, evidence) {
     if (evidence.requiredVerifierIds.length === 0) {
-        throw new AgentOpsError("VERIFICATION_SCOPE_EMPTY", `Verification scope fallback (${reason}) has no required commands.`);
+        return { verifierIds: [], fallback: true, reason, evidence };
     }
     return {
         verifierIds: evidence.requiredVerifierIds,

package/dist/runtime/src/verify/service.js

@@ -1,6 +1,8 @@
 import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
 import { validateTaskAgainstConfig } from "../schema/validate.js";
 import { collectChangeSurface } from "./change-surface.js";
+import { resolveReviewScope, reviewScopeSignature } from "../review/scope.js";
+import { calculateSourceFingerprint } from "./source-fingerprint.js";
 import { buildVerificationEvidence } from "./evidence.js";
 import { createFailureFingerprint } from "./fingerprint.js";
 import { aggregateVerificationStatus, executeConfiguredCommand } from "./command-executor.js";
@@ -41,7 +43,7 @@ export class VerificationService {
         }
         return await resolveContainedPath(this.#options.root, command.cwd);
     }
-    async #persistEvidence(task, command, startedAt, finishedAt, result, exitCode) {
+    async #persistEvidence(task, command, startedAt, finishedAt, result, sourceFingerprint) {
         const references = [];
         for (const criterion of relevantCriteria(task, command.id)) {
             const evidence = buildVerificationEvidence({
@@ -51,8 +53,11 @@ export class VerificationService {
                 scope: this.#options.scope,
                 startedAt,
                 finishedAt,
-                exitCode,
+                exitCode: result.exitCode,
                 testCount: result.testCount,
+                status: result.status,
+                failureClass: result.failureClass,
+                sourceFingerprint,
                 toolVersions: this.#options.toolVersions ?? {},
                 config: this.#options.config
             });
@@ -84,7 +89,6 @@ export class VerificationService {
                 diagnostics: result.diagnostic
             });
         const finishedAt = (this.#options.now ?? (() => new Date().toISOString()))();
-        const evidenceReferences = await this.#persistEvidence(task, command, startedAt, finishedAt, result, result.exitCode);
         return {
             commandId: command.id,
             required: command.required,
@@ -94,7 +98,9 @@ export class VerificationService {
             timedOut: result.timedOut,
             testCount: result.testCount,
             diagnostic: fingerprint?.diagnostics ?? "",
-            evidenceReferences
+            evidenceReferences: [],
+            startedAt,
+            finishedAt
         };
     }
     async verify(taskId) {
@@ -107,23 +113,72 @@ export class VerificationService {
             throw verificationError("VERIFICATION_INPUT_INVALID", validation.errors[0]?.message ??
                 "Task and verification configuration are incompatible.");
         }
-        const surface = await collectChangeSurface(this.#options.gitRunner);
+        const reviewScope = await resolveReviewScope({
+            root: this.#options.root,
+            runner: this.#options.gitRunner,
+            ...(this.#options.base === undefined ? {} : { base: this.#options.base })
+        });
+        const sourceFingerprint = await calculateSourceFingerprint(this.#options.root, reviewScope, this.#options.gitRunner);
+        const worktreeSurface = reviewScope.mode === "worktree"
+            ? await collectChangeSurface(this.#options.gitRunner)
+            : { staged: [], unstaged: [], untracked: [], paths: reviewScope.changedFiles };
+        const surface = worktreeSurface;
         const selection = selectVerificationScope(surface.paths, this.#options.config);
         const results = [];
         for (const commandId of selection.verifierIds) {
             results.push(await this.#runCommand(validation.value, commandById(this.#options.config, commandId)));
         }
-        const status = aggregateVerificationStatus(results);
+        let status = aggregateVerificationStatus(results);
+        let sourceChanged = false;
+        const postflightScope = await resolveReviewScope({
+            root: this.#options.root,
+            runner: this.#options.gitRunner,
+            ...(this.#options.base === undefined ? {} : { base: this.#options.base })
+        });
+        const postflightFingerprint = await calculateSourceFingerprint(this.#options.root, postflightScope, this.#options.gitRunner);
+        if (reviewScopeSignature(reviewScope) !== reviewScopeSignature(postflightScope) ||
+            sourceFingerprint !== postflightFingerprint) {
+            status = "UNKNOWN";
+            sourceChanged = true;
+        }
         let signal = null;
         if (status === "PASS") {
+            const taskEvidence = {};
+            for (const [index, result] of results.entries()) {
+                const command = commandById(this.#options.config, result.commandId);
+                const references = await this.#persistEvidence(validation.value, command, result.startedAt, result.finishedAt, result, sourceFingerprint);
+                results[index] = { ...result, evidenceReferences: references };
+                for (const [criterionIndex, criterion] of relevantCriteria(validation.value, result.commandId).entries()) {
+                    const reference = references[criterionIndex];
+                    if (reference !== undefined) {
+                        taskEvidence[criterion.id] = [
+                            ...(taskEvidence[criterion.id] ?? []),
+                            reference
+                        ];
+                    }
+                }
+            }
+            if (Object.keys(taskEvidence).length > 0) {
+                await this.#options.taskService.recordEvidence(taskId, taskEvidence);
+            }
             await this.#options.taskService.clearFailure(taskId);
         }
         else {
             const required = results.filter((result) => result.required);
-            const gating = required.length > 0 ? required : results;
+            const gating = required;
             const failed = gating.find((result) => result.status !== "PASS");
             if (failed === undefined) {
-                throw verificationError("VERIFICATION_RESULT_INVALID", "Verification failed without a gating result.");
+                if (!sourceChanged) {
+                    throw verificationError("VERIFICATION_RESULT_INVALID", "Verification failed without a required result.");
+                }
+                const advanced = await this.#options.taskService.recordFailure(taskId, createFailureFingerprint({
+                    commandId: "source-snapshot",
+                    failureClass: "source-changed-during-verification",
+                    exitCategory: "no-exit",
+                    diagnostics: "source changed during verification"
+                }));
+                signal = advanced.signal;
+                return { taskId, status, surface, selection, results, signal, reviewScope, sourceFingerprint };
             }
             const advanced = await this.#options.taskService.recordFailure(taskId, createFailureFingerprint({
                 commandId: failed.commandId,
@@ -139,7 +194,9 @@ export class VerificationService {
             surface,
             selection,
             results,
-            signal
+            signal,
+            reviewScope,
+            sourceFingerprint
         };
     }
 }

package/dist/runtime/src/verify/source-fingerprint.js

@@ -0,0 +1,49 @@
+import { readFile, lstat } from "node:fs/promises";
+import { join } from "node:path";
+import { sha256 } from "../fs/hash.js";
+import { AgentOpsError } from "../fs/paths.js";
+import { resolveGitCommit } from "./change-surface.js";
+export async function calculateSourceFingerprint(root, scope, runner) {
+    const head = await resolveGitCommit(runner, "HEAD");
+    if (scope.mode === "base") {
+        return sha256(JSON.stringify({
+            domain: "agent-ops-source-v1",
+            mode: "base",
+            head,
+            base: scope.resolvedBase,
+            paths: [...scope.changedFiles]
+        }));
+    }
+    const paths = [];
+    for (const path of scope.changedFiles) {
+        const absolute = join(root, ...path.split("/"));
+        let entry;
+        try {
+            entry = await lstat(absolute);
+        }
+        catch (error) {
+            if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
+                paths.push({ path, kind: "deleted" });
+                continue;
+            }
+            throw error;
+        }
+        if (!entry.isFile()) {
+            throw new AgentOpsError("SOURCE_SNAPSHOT_UNAVAILABLE", "Review source contains an unsupported entry.");
+        }
+        const bytes = await readFile(absolute);
+        paths.push({
+            path,
+            kind: "file",
+            executable: (entry.mode & 0o111) !== 0,
+            hash: sha256(bytes)
+        });
+    }
+    return sha256(JSON.stringify({
+        domain: "agent-ops-source-v1",
+        mode: "worktree",
+        head,
+        base: null,
+        paths
+    }));
+}

package/dist/runtime/src/verify/spawn.js

@@ -139,13 +139,17 @@ export class NodeVerificationProcessRunner {
             cwd: request.cwd,
             detached: this.#platform !== "win32",
             env: {
-                ...process.env,
+                ...(request.replaceEnv === true ? {} : process.env),
                 ...(request.env ?? {})
             },
             shell: request.shell,
-            stdio: ["ignore", "pipe", "pipe"],
+            stdio: [request.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"],
             windowsHide: true
         });
+        if (request.stdin !== undefined && child.stdin !== null) {
+            child.stdin.on("error", () => { });
+            child.stdin.end(request.stdin);
+        }
         let settled = false;
         const completion = new Promise((resolve) => {
             child.once("error", (error) => {
@@ -263,7 +267,9 @@ export async function runVerificationCommand(command, options) {
             args: [...command.args],
             cwd: options.cwd,
             shell: command.shell === true,
-            ...(options.env === undefined ? {} : { env: options.env })
+            ...(options.env === undefined ? {} : { env: options.env }),
+            ...(options.replaceEnv === true ? { replaceEnv: true } : {}),
+            ...(options.stdin === undefined ? {} : { stdin: options.stdin })
         });
     }
     catch {

package/docs/en/guides/configuration.md

@@ -41,19 +41,25 @@ Enable it during `agent-ops init`, or by hand:
 ```json
 {
   "reviewRoles": [
-    { "role": "independent-review", "targets": ["codex", "agy"] }
+    { "role": "independent-review", "targets": ["claude"] }
   ]
 }
 ```
 
-`targets` is an **ordered fallback chain**. Supported targets and the read-only
-flags they are launched with:
+`targets` is an **ordered fallback chain**. Every review locks to the
+staged/unstaged/untracked surface (or a clean `--base <ref>...HEAD` range),
+requires fresh PASS evidence for required checks, and prints a complete native
+schema report without persisting it.
+
+Every attempt starts from a fresh temporary cwd with a narrow environment. The
+following target identities may be configured; only Claude currently meets the
+complete context-isolation contract and can execute automatically:
 
 | Target | Invocation | Read-only |
 | --- | --- | --- |
-| `codex` | `codex exec` | `-s read-only` |
-| `agy` (Antigravity) | `agy -p` | `--sandbox --mode plan` |
-| `claude` | `claude -p` | `--permission-mode plan` |
+| `codex` | `codex exec` | retained; `capability-unavailable` |
+| `agy` (Antigravity) | `agy -p` | retained; `capability-unavailable` |
+| `claude` | `claude -p` | `--permission-mode plan --safe-mode` |
 
 `opencode` is **not** a review target even though it is a supported harness.
 Its `--agent plan` is rejected as a subagent and silently falls back to a
@@ -72,9 +78,11 @@ of the chain. It still runs when it is the only configured target, with a
 `reviewer == host` warning.
 
 Criterion descriptions come from the task bound to the current session, so a
-review needs an attached task; `--criterion` filters those ids. Results are
-appended to the task's evidence with a `review:<target>:` prefix, and only
-while the task is active — a completed task is printed, never rewritten.
+review needs an attached task created under the current policy configuration;
+`--criterion` filters those ids. Run `agent-ops verify` first: review rejects
+stale, failed, or source-mismatched required evidence before any model call.
+Compact PASS evidence is appended with a `review:<target>:` prefix; the full
+human-readable report is transient. Completed tasks are never rewritten.
 
 `--yes` is still required for every review run: init selection decides which
 targets are permitted, `--yes` decides whether to spend money now.

package/docs/zh-TW/guides/configuration.md

@@ -36,18 +36,23 @@ Claude 與 Codex lifecycle support 為 `supported`，OpenCode 從 app initializa
 ```json
 {
   "reviewRoles": [
-    { "role": "independent-review", "targets": ["codex", "agy"] }
+    { "role": "independent-review", "targets": ["claude"] }
   ]
 }
 ```
 
-`targets` 是**有序的後備鏈**。支援的目標與其唯讀旗標：
+`targets` 是**有序的後備鏈**。每次 review 都鎖定 staged／unstaged／untracked
+變更（或乾淨的 `--base <ref>...HEAD`），並要求必要驗證的最新 PASS evidence；
+完整原生 schema report 會顯示給人看，但不會持久化。
+
+每次嘗試都從新的暫存 cwd 與最小環境啟動。目前只有 Claude 具備完整的
+context-isolation 合約，能自動執行：
 
 | 目標 | 呼叫方式 | 唯讀 |
 | --- | --- | --- |
-| `codex` | `codex exec` | `-s read-only` |
-| `agy`（Antigravity）| `agy -p` | `--sandbox --mode plan` |
-| `claude` | `claude -p` | `--permission-mode plan` |
+| `codex` | `codex exec` | 保留設定；`capability-unavailable` |
+| `agy`（Antigravity）| `agy -p` | 保留設定；`capability-unavailable` |
+| `claude` | `claude -p` | `--permission-mode plan --safe-mode` |
 
 `opencode` **不是** review 目標，即使它是支援的 harness。它的 `--agent plan`
 會被判定為 subagent 而遭拒，並靜默退回可寫入的 agent，因此無法滿足唯讀前置
@@ -61,9 +66,11 @@ Claude 與 Codex lifecycle support 為 `supported`，OpenCode 從 app initializa
 若 host 是 Claude Code（`CLAUDECODE` 已設定），`claude` 會被移到鏈尾。
 當它是唯一設定的目標時仍會執行，並附上 `reviewer == host` 警告。
 
-criterion 描述來自當前 session 綁定的 task，所以 review 需要已附加的 task；
-`--criterion` 用來篩選這些 id。結果會以 `review:<target>:` 前綴附加到 task 的
-evidence，且僅在 task 為 active 時寫入 —— 已完成的 task 只印出，絕不改寫。
+criterion 描述來自當前 session 綁定的 task，所以 review 需要已附加、且建立時的
+policy 設定仍相同的 task；`--criterion` 用來篩選 id。請先執行
+`agent-ops verify`：必要 evidence 若失敗、過期或來源不符，review 會在 model 呼叫前停止。
+僅 compact PASS evidence 會以 `review:<target>:` 附加；完整人類可讀 report 是暫存的。
+已完成的 task 絕不改寫。
 
 每次執行 review 仍需 `--yes`：init 的勾選決定「允許哪些目標」，
 `--yes` 決定「現在是否要花錢」。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kylecheng3146/agent-ops",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Evidence-driven development loops for Codex, Claude Code, and opencode",
   "type": "module",
   "license": "MIT",

package/schemas/evidence.schema.json

@@ -15,13 +15,16 @@
     "startedAt",
     "finishedAt",
     "exitCode",
+    "status",
+    "failureClass",
+    "sourceFingerprint",
     "testCount",
     "toolVersions",
     "configHash"
   ],
   "properties": {
     "schemaVersion": {
-      "const": 1
+      "const": 2
     },
     "taskId": {
       "$ref": "#/$defs/id"
@@ -62,6 +65,18 @@
       "minimum": 0,
       "maximum": 9007199254740991
     },
+    "status": {
+      "enum": ["PASS", "FAIL", "UNKNOWN"]
+    },
+    "failureClass": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 256,
+      "pattern": "^[^\\u0000]*$"
+    },
+    "sourceFingerprint": {
+      "$ref": "#/$defs/hash"
+    },
     "toolVersions": {
       "type": "object",
       "additionalProperties": {

package/schemas/review-report.schema.json

@@ -0,0 +1,48 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/kylecheng3146/agent-ops/schemas/review-report.schema.json",
+  "title": "Agent Ops detailed independent review report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["summary", "results", "findings", "residualRisks", "changedFilesInspected", "supportingFilesInspected"],
+  "properties": {
+    "summary": { "$ref": "#/$defs/text" },
+    "results": { "type": "array", "items": { "$ref": "#/$defs/result" } },
+    "findings": { "type": "array", "items": { "$ref": "#/$defs/finding" } },
+    "residualRisks": { "type": "array", "items": { "$ref": "#/$defs/text" } },
+    "changedFilesInspected": { "type": "array", "items": { "$ref": "#/$defs/path" }, "uniqueItems": true },
+    "supportingFilesInspected": { "type": "array", "items": { "$ref": "#/$defs/path" }, "uniqueItems": true }
+  },
+  "$defs": {
+    "text": { "type": "string", "minLength": 1, "maxLength": 16384, "pattern": "[^\\s\\u0000]" },
+    "path": { "type": "string", "minLength": 1, "maxLength": 4096, "pattern": "^(?!/)(?!.*\\\\)(?!.*(?:^|/)\\.\\.(?:/|$))[A-Za-z0-9._/-]+$" },
+    "result": {
+      "type": "object", "additionalProperties": false,
+      "required": ["criterionId", "status", "summary", "evidence"],
+      "properties": {
+        "criterionId": { "$ref": "#/$defs/text" },
+        "status": { "enum": ["PASS", "FAIL"] },
+        "summary": { "$ref": "#/$defs/text" },
+        "evidence": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/text" } }
+      }
+    },
+    "location": {
+      "type": "object", "additionalProperties": false, "required": ["path"],
+      "properties": { "path": { "$ref": "#/$defs/path" }, "line": { "type": "integer", "minimum": 1 } }
+    },
+    "finding": {
+      "type": "object", "additionalProperties": false,
+      "required": ["severity", "blocking", "title", "details", "locations", "evidence", "recommendation", "criterionIds"],
+      "properties": {
+        "severity": { "enum": ["critical", "important", "minor"] },
+        "blocking": { "type": "boolean" },
+        "title": { "$ref": "#/$defs/text" },
+        "details": { "$ref": "#/$defs/text" },
+        "locations": { "type": "array", "items": { "$ref": "#/$defs/location" } },
+        "evidence": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/text" } },
+        "recommendation": { "$ref": "#/$defs/text" },
+        "criterionIds": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/text" } }
+      }
+    }
+  }
+}