@kylecheng3146/agent-ops 0.10.2 → 0.11.0

package/dist/packages/cli/src/args.js

@@ -66,6 +66,10 @@ function parseHookTarget(option, value) {
 export function parseArgs(argv) {
     if (argv[0] === "run")
         return parseRunArgs(argv.slice(1));
+    if (argv[0] === "task" && argv[1] === "debug")
+        throw new CliArgumentError("TASK_DEBUG_REMOVED", "task debug was removed in 0.11.0. A DEBUG task is task create --debug with a behavioral " +
+            "criterion whose redCheckIds fail at the baseline and pass on the candidate; then verify, review and finish as usual. " +
+            "Declare an escape origin, if known, with task revise --escape-of.");
     let command;
     let action;
     let scope;
@@ -78,10 +82,6 @@ export function parseArgs(argv) {
     let intent;
     let taskGoal;
     let debug = false;
-    let debugAction;
-    let payloadFile;
-    let commandId;
-    let eventId;
     let sessionId;
     let base;
     let parentBase;
@@ -233,30 +233,6 @@ export function parseArgs(argv) {
                     duplicate(token);
                 debug = true;
                 break;
-            case "--debug-action": {
-                if (debugAction !== undefined)
-                    duplicate(token);
-                const value = readOptionValue(argv, index++, token);
-                if (!["status", "hypothesis", "strategy", "investigate", "checkpoint", "resume", "extend", "origin"].includes(value))
-                    invalidValue(token, value);
-                debugAction = value;
-                break;
-            }
-            case "--payload-file":
-                if (payloadFile !== undefined)
-                    duplicate(token);
-                payloadFile = readOptionValue(argv, index++, token);
-                break;
-            case "--command-id":
-                if (commandId !== undefined)
-                    duplicate(token);
-                commandId = readOptionValue(argv, index++, token);
-                break;
-            case "--event-id":
-                if (eventId !== undefined)
-                    duplicate(token);
-                eventId = readOptionValue(argv, index++, token);
-                break;
             case "--tree": {
                 if (tree)
                     duplicate(token);
@@ -530,7 +506,7 @@ export function parseArgs(argv) {
                         "complete",
                         "create",
                         "export",
-                        "status", "revise", "replan", "pin-finding", "debug"
+                        "status", "revise", "replan", "pin-finding"
                     ].includes(token)) {
                     action = token;
                     break;
@@ -674,8 +650,8 @@ export function parseArgs(argv) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--target-version may be used only with update.");
     }
     if (base !== undefined && command !== "verify" && command !== "review" &&
-        command !== "batch" && !(command === "task" && (action === "complete" || action === "debug"))) {
-        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--base may be used only with verify, review, batch, task complete or task debug.");
+        command !== "batch" && !(command === "task" && action === "complete")) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--base may be used only with verify, review, batch or task complete.");
     }
     if ((parentBase !== undefined || width !== undefined) && command !== "batch") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", `${parentBase !== undefined ? "--parent-base" : "--width"} may be used only with batch.`);
@@ -714,13 +690,6 @@ export function parseArgs(argv) {
     const revisionAction = command === "task" && ["revise", "replan", "pin-finding"].includes(action ?? "");
     if ((taskGoal !== undefined || debug) && !(command === "task" && action === "create"))
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--goal and --debug apply only to task create.");
-    if ((debugAction !== undefined || commandId !== undefined || eventId !== undefined || payloadFile !== undefined) && !(command === "task" && action === "debug"))
-        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Debug operation options apply only to task debug.");
-    if (command === "task" && action === "debug" && (taskId === undefined || debugAction === undefined || title !== undefined || intent !== undefined ||
-        parentTaskId !== undefined || criteria.length > 0 || evidence.length > 0 ||
-        ((debugAction === "hypothesis" || debugAction === "strategy" || debugAction === "origin") !== (payloadFile !== undefined)) ||
-        ((debugAction === "investigate") !== (commandId !== undefined)) || ((debugAction === "extend") !== (eventId !== undefined))))
-        throw new CliArgumentError("CLI_MISSING_VALUE", "Task debug requires --task, --debug-action and the operation's exact payload/command/event options.");
     if ((criterionFiles.length > 0 && !(command === "task" && (action === "create" || action === "pin-finding"))) ||
         (criteriaFile !== undefined && !(command === "task" && action === "revise")) ||
         (surfaceFile !== undefined && !(command === "task" && (action === "create" || action === "revise"))) ||
@@ -739,7 +708,7 @@ export function parseArgs(argv) {
     if (command === "escapes" && argv.some(token => token !== "escapes" && token !== "--json"))
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "escapes accepts only --json; it is a read-only report.");
     if (revisionAction && (taskId === undefined || evidence.length > 0 || title !== undefined || intent !== undefined || parentTaskId !== undefined || sessionId !== undefined || criteria.length > 0 || base !== undefined ||
-        (action === "revise" && (expectedContract === undefined || (criteriaFile === undefined && surfaceFile === undefined && escapeOf === undefined) || reason === undefined)) ||
+        (action === "revise" && (expectedContract === undefined || (criteriaFile === undefined && surfaceFile === undefined && escapeOf === undefined && baseline === undefined) || reason === undefined)) ||
         (action === "replan" && (expectedTreeContract === undefined || planFile === undefined || reason === undefined)) ||
         (action === "pin-finding" && (expectedContract === undefined || findingReference === undefined || criterionFiles.length !== 1))))
         throw new CliArgumentError("CLI_MISSING_VALUE", "Acceptance revision requires task, expected contract, payload and reason.");
@@ -902,10 +871,6 @@ export function parseArgs(argv) {
         ...(intent === undefined ? {} : { intent }),
         ...(taskGoal === undefined ? {} : { goal: taskGoal }),
         ...(debug ? { debug: true } : {}),
-        ...(debugAction === undefined ? {} : { debugAction }),
-        ...(payloadFile === undefined ? {} : { payloadFile }),
-        ...(commandId === undefined ? {} : { commandId }),
-        ...(eventId === undefined ? {} : { eventId }),
         ...(reviewTargets.length === 0 ? {} : { reviewTargets }),
         ...(completionGate === undefined ? {} : { completionGate }),
         ...(office === undefined ? {} : { office }),

package/dist/packages/cli/src/bin.js

@@ -47,9 +47,11 @@ import { memoizePreflight } from "../../../runtime/src/review/batch.js";
 import { createReviewExecutor, ReviewInterruptedError } from "../../../runtime/src/review/execute.js";
 import { probeReviewTargetDetailed } from "../../../runtime/src/review/probe.js";
 import { resolveReviewScope } from "../../../runtime/src/review/scope.js";
+import { runSurfaceGate } from "../../../runtime/src/surface/discovery.js";
 import { resolveReviewRole } from "../../../runtime/src/review/roles.js";
 import { runTrustCommand } from "./commands/trust.js";
 import { runVerifyCommand } from "./commands/verify.js";
+import { defaultBase } from "./default-base.js";
 import { runAdvanceCommand } from "./commands/advance.js";
 import { runReviewShowCommand } from "./commands/review-show.js";
 import { runEscapesCommand } from "./commands/escapes.js";
@@ -255,6 +257,16 @@ else {
                 const root = args.scope === "user"
                     ? process.env.AGENT_OPS_HOME ?? homedir()
                     : process.cwd();
+                // Committed work is judged as a range by default; see defaultBase.
+                if ((args.command === "verify" || (args.command === "review" && args.action !== "show")) && args.base === undefined && args.scope !== "user") {
+                    const taskId = args.taskId;
+                    const base = await defaultBase(root, gitRunner(root), async () => taskId === undefined ? undefined :
+                        (await new TaskService(new FileTaskStore(join(root, ".agent-ops", "tasks", "state.json"), root)).status({ taskId })).createdSourceCommit)
+                        // Only a default: any failure leaves the command's own scope handling and errors in charge.
+                        .catch(() => undefined);
+                    if (base !== undefined)
+                        args = { ...args, base };
+                }
                 const isTTY = !args.json &&
                     process.stdin.isTTY === true &&
                     process.stdout.isTTY === true;
@@ -495,7 +507,6 @@ else {
                     return await runTaskCommand({
                         args,
                         service: taskService,
-                        ...(args.action !== "debug" ? {} : { trusted: await (async () => { const binding = await plannedTrustBinding(root, (await loadEffectiveConfig(root, "project")).config); return binding !== null && (await trustStore().status(binding)).status === "TRUSTED"; })() }),
                         ...(policyConfigHash === undefined ? {} : { policyConfigHash }),
                         ...(sessionId === undefined ? {} : { sessionId }),
                         ...(fromMain
@@ -553,41 +564,16 @@ else {
                             reviewActivity = undefined;
                         }
                     });
-                    const debugRecord = reviewArgs.taskId === undefined ? undefined : await taskService.status({ taskId: reviewArgs.taskId });
-                    const inDebug = (executor) => debugRecord?.task.debug === undefined ? executor : async (request) => await taskService.debugService().review(debugRecord.task.id, () => executor(request));
                     const inSlot = (executor) => slotDir === undefined
-                        ? inDebug(executor)
+                        ? executor
                         : async (request) => await withReviewSlot({
                             dir: slotDir,
                             signal,
                             holder: { root, ...(reviewArgs.taskId === undefined ? {} : { taskId: reviewArgs.taskId }) },
-                            ...(debugRecord?.task.debug === undefined || reviewSessionId === undefined
-                                ? {}
-                                : (() => {
-                                    let paused = false;
-                                    const debug = taskService.debugService();
-                                    return {
-                                        onWaitStart: async () => {
-                                            if (paused)
-                                                return;
-                                            const current = await debug.root(debugRecord.task.id).catch(() => null);
-                                            if (current?.debug.foreground?.sessionId !== reviewSessionId)
-                                                return;
-                                            await debug.foregroundStop(debugRecord.task.id, reviewSessionId);
-                                            paused = true;
-                                        },
-                                        onWaitEnd: async () => {
-                                            if (!paused)
-                                                return;
-                                            await debug.foregroundStart(debugRecord.task.id, reviewSessionId);
-                                            paused = false;
-                                        }
-                                    };
-                                })()),
                             onWait: (line) => {
                                 process.stderr.write(`${progressPrefix}${line}\n`);
                             }
-                        }, async () => await inDebug(executor)(request));
+                        }, async () => await executor(request));
                     return {
                         args: reviewArgs,
                         authorized: reviewArgs.yes,
@@ -607,7 +593,6 @@ else {
                         config: reviewConfig,
                         evidenceStore: new FileEvidenceStore(root, root),
                         execute: inActivity(inSlot(createReviewExecutor({
-                            ...(debugRecord?.task.debug === undefined ? {} : { remainingBudgetMs: () => taskService.debugService().remaining(debugRecord.task.id) }),
                             runner: registeredRunProofRunner(),
                             targets: configuredReviewTargets,
                             cwd: root,
@@ -749,6 +734,20 @@ else {
                     return await runVerifyCommand({
                         args,
                         taskService,
+                        surface: async (taskId) => {
+                            const record = await taskService.status({ taskId });
+                            // A subtask's surface is its parent's; review checks the tree, so verify stays quiet here.
+                            if (record.task.parentTaskId !== undefined)
+                                return [];
+                            const scope = await resolveReviewScope({ root, runner: gitRunner(root), ...(args.base === undefined ? {} : { base: args.base }) });
+                            const gate = await runSurfaceGate({ root, taskId, surface: record.task.surface, required: record.task.surfaceRequired === true,
+                                ...(scope.mode === "base" ? { base: scope.resolvedBase } : {}), changedFiles: scope.changedFiles, configHash: calculateConfigHash(config) });
+                            if (gate.status === "PASS")
+                                return ["Surface: PASS"];
+                            const paths = gate.details.flatMap(d => typeof d === "object" && d !== null && "path" in d ? [String(d.path)] : []);
+                            return [`Surface (advisory; review would stop with ${gate.code}): ${gate.message}`,
+                                ...paths.slice(0, 20).map(path => `  - ${path}`), ...(paths.length > 20 ? [`  ... ${paths.length - 20} more`] : [])];
+                        },
                         activity: { commonDir: await officeCommonDir(root), root, ...(verifySessionId === undefined ? {} : { sessionId: verifySessionId }) },
                         service: { verify: async (taskId) => {
                                 const run = await runPolicyContext(root);

package/dist/packages/cli/src/cli.js

@@ -25,7 +25,7 @@ Commands:
   doctor     Diagnose an installation
   update     Update managed artifacts
   uninstall  Remove managed artifacts
-  task <create|status|attach|revise|replan|pin-finding|debug|advance|complete|archive|export>
+  task <create|status|attach|revise|replan|pin-finding|advance|complete|archive|export>
              Manage independent task acceptance state
   verify     Run configured verification
   review     Run an independent review or show recorded reports
@@ -105,7 +105,7 @@ The URL carries an access token; do not share it.
        agent-ops run respond <run-id> --question-id <id> <--answer <text>|--answer-file <path>> [--json]
 
 New runs have no total time cap. Manual resume upgrades legacy finite runs and keeps accounting.
-Command/review timeouts, provider limits, DEBUG budgets and stop controls remain effective.
+Command/review timeouts, provider limits and stop controls remain effective.
 Native goal state is observational. Completion requires current verification,
 two fresh reviews, task completion and a target-bound integration receipt.
 --retry-approval explicitly retries an intact Codex approval-review usage-limit
@@ -188,7 +188,7 @@ Options:
   --json
   --yes
 `,
-    task: `Usage: agent-ops task <create|status|attach|revise|replan|pin-finding|debug|advance|complete|archive|export> [options]
+    task: `Usage: agent-ops task <create|status|attach|revise|replan|pin-finding|advance|complete|archive|export> [options]
 
 Manage independent task acceptance state. Task commands accept none of
 --harness, --profile or --dry-run. Only advance accepts --yes.
@@ -196,16 +196,12 @@ Manage independent task acceptance state. Task commands accept none of
 Options:
   --title <text>                        create
   --goal <text>                         create: immutable original issue/goal
-  --debug                               create: task-level investigation tag
-  --debug-action <status|hypothesis|strategy|investigate|checkpoint|resume|extend|origin>
-  --payload-file <path>                 debug hypothesis/strategy/origin: bounded JSON
-  --command-id <id>                     debug investigate: trusted configured command
-  --event-id <native-event-id|latest>    debug extend: authentic human continue event
+  --debug                               create: bug fix; needs --goal and a behavioral criterion with redCheckIds
   --intent <text>                       create: intended behavior and constraints before editing
   --criterion <json>                    create, repeatable, two to five total
   --criterion-file <path>               create: one criterion object, repeatable; pin-finding: exactly one
   --criteria-file <path>                revise: replacement criterion array
-  --surface-file <path>                 create (required unless --debug), revise: EVIDENCE-SURFACE-001
+  --surface-file <path>                 create (required), revise: EVIDENCE-SURFACE-001
                                         audit JSON, or {"covers":[surface-id]} under a surfaced parent
   --escape-of <commit>                  create, revise: the commit this bug escaped from (Escape Loop)
   --escape-label <label>                with --escape-of: requirement|surface|scenario|criteria|verify|review|flagged|out-of-model
@@ -216,12 +212,12 @@ Options:
   --expected-contract <hash>            revise, pin-finding: current task contract from status
   --expected-tree-contract <hash>       replan: current tree contract from status
   --reason <text>                       required for revise/replan; optional for pin-finding
-  --baseline <git-ref>                  create/revise: baseline for new mechanical requirements
+  --baseline <git-ref>                  create: baseline for typed criteria; revise: move every typed baseline
   --parent <task-id>                    create: record a subtask; status: list subtasks
   --task <id>                           status, attach, revise, replan, pin-finding, complete, archive, export, advance
-  --session <id>                        create, attach, status, advance, debug
+  --session <id>                        create, attach, status, advance
   --evidence <criterion-id=reference>   complete, repeatable
-  --base <git-ref>                      complete, debug: a clean committed range
+  --base <git-ref>                      complete: a clean committed range
   --yes                                 advance: authorize the two review sessions
   --json
 
@@ -233,7 +229,8 @@ Each legacy criterion needs at least one verifierIds entry naming a verification
 command id configured in .agent-ops/config.json. Typed criteria additionally
 accept an acceptance object: mode (behavioral, invariant or review-only),
 bindings and optional baselineCommit/reviewOnlyReason. Mechanical bindings name
-configured acceptance runner IDs, checkIds, committed materials and optional
+configured acceptance runner IDs, checkIds (the checks this criterion needs;
+other runner output is ignored), committed materials and optional
 redCheckIds; tasks cannot supply commands. Creation freezes the baseline.
 Review-only example (mandatory repository policy commands still run):
 
@@ -241,7 +238,8 @@ Review-only example (mandatory repository policy commands still run):
 
 Pin a saved finding with task pin-finding --task <id> <report-digest:index>
 --expected-contract <hash> --criterion-file <path>. Revise/replan preserve the
-original goal and immutable existing baselines; obtain new verify and review.
+original goal and existing baselines unless revise --baseline moves them all.
+A revise that keeps the criteria keeps verification; every revise needs review.
 `,
     verify: `Usage: agent-ops verify [options]
 

package/dist/packages/cli/src/codex-loop-process.js

@@ -1,6 +1,5 @@
 import { PROJECT_LOOP_EVENTS, resolveProjectLoopRoot, runProjectLoop } from "../../../runtime/src/hooks/codex-loop.js";
 import { officeEnabled, officeLoopPhaseHint } from "./office-entry.js";
-import { routeDebugPrompt } from "./debug-intake.js";
 const MAX_LOOP_INPUT_BYTES = 64 * 1024;
 function isLoopHarness(value) {
     return value === "claude" || value === "codex";
@@ -74,11 +73,6 @@ export async function runLoopProcess(argv, io, dependencies = {}) {
                 ? {}
                 : { telemetryMaxBytes: dependencies.telemetryMaxBytes })
         });
-        if (event === "UserPromptSubmit" && managedRoot !== null && result.exitCode === 0 && result.stdout === "" && result.stderr === "") {
-            const context = await routeDebugPrompt(managedRoot, input, harness).catch(error => `DEBUG intake unavailable: ${error instanceof Error ? error.message : "preserve current state"}`);
-            if (context !== null)
-                io.writeStdout(harness === "claude" ? JSON.stringify({ hookSpecificOutput: { hookEventName: "UserPromptSubmit", additionalContext: context } }) : context + "\n");
-        }
         if (result.stdout.length > 0) {
             io.writeStdout(result.stdout);
         }

package/dist/packages/cli/src/commands/review.js

@@ -4,7 +4,7 @@ import { renderReviewResult } from "../../../../runtime/src/review/render.js";
 import { reviewReportResults } from "../../../../runtime/src/review/report.js";
 import { findPriorFailingFindings, findReviewAttestation, invalidateReviewAttestation, readReviewReportArtifact, reviewReportDigest, saveReviewAttestation, saveReviewReportArtifact } from "../../../../runtime/src/review/attestation.js";
 import { detectHostTarget, planReviewTargets, resolveReviewRole } from "../../../../runtime/src/review/roles.js";
-import { taskContractHash, treeContractHash, goalHash } from "../../../../runtime/src/task/contract.js";
+import { evidenceMatchesContract, taskContractHash, treeContractHash, goalHash } from "../../../../runtime/src/task/contract.js";
 import { acceptanceCoverage, coverageDigest } from "../../../../runtime/src/verify/acceptance-coverage.js";
 import { resolveGitCommit } from "../../../../runtime/src/verify/change-surface.js";
 import { sha256 } from "../../../../runtime/src/fs/hash.js";
@@ -15,7 +15,6 @@ import { assertSafeSupportingPaths, isReviewerPolicyPath, resolveReviewScope, re
 import { calculateSourceFingerprint } from "../../../../runtime/src/verify/source-fingerprint.js";
 import { calculateConfigHash, isPassingVerificationEvidence } from "../../../../runtime/src/verify/evidence.js";
 import { validateEvidence } from "../../../../runtime/src/schema/validate.js";
-import { loadDebugProof, debugProofDigest } from "../../../../runtime/src/task/debug-state.js";
 import { logSurfaceResidualRisks, runSurfaceGate } from "../../../../runtime/src/surface/discovery.js";
 import { escapeReviewData } from "../../../../runtime/src/escape/link.js";
 import { logGateCatch } from "../../../../runtime/src/logging/local-log.js";
@@ -187,7 +186,7 @@ async function currentEvidence(options, context, criterionId, commandId, configH
             evidence.sourceFingerprint !== sourceFingerprint ||
             (context.records.some(r => r.task.id === (owner?.taskId ?? context.taskId) &&
                 (r.task.goal !== undefined || (r.task.contractRevision ?? 0) > 0 || r.task.criteria.some(c => c.acceptance !== undefined))) &&
-                evidence.taskContractHash !== taskContractHash(context.records.find(r => r.task.id === (owner?.taskId ?? context.taskId)).task))) {
+                !evidenceMatchesContract(evidence.taskContractHash, context.records.find(r => r.task.id === (owner?.taskId ?? context.taskId)).task))) {
             stale = true;
             continue;
         }
@@ -343,7 +342,7 @@ async function reviewEscapes(options, context, scope) {
         const origin = record.task.origin;
         if (origin === undefined)
             continue;
-        const base = record.debug?.baselineCommit ?? record.createdSourceCommit ?? (scope?.mode === "base" ? scope.resolvedBase : undefined);
+        const base = record.createdSourceCommit ?? (scope?.mode === "base" ? scope.resolvedBase : undefined);
         try {
             if (base === undefined)
                 throw new Error("no base");
@@ -770,7 +769,6 @@ export async function runReviewCommand(options) {
         }
         context.coverage = rows;
         context.binding = {
-            ...(context.records.every(r => r.task.debug === undefined) || options.root === undefined ? {} : { debugProofs: Object.fromEntries(await Promise.all(context.records.filter(r => r.task.debug !== undefined).map(async (r) => [r.task.id, debugProofDigest(await loadDebugProof(options.root, r.task.debug.rootTaskId))]))) }),
             taskContractHash: taskContractHash(context.records.find(r => r.task.id === context.taskId).task),
             taskContracts: Object.fromEntries(context.records.map(r => [r.task.id, taskContractHash(r.task)])),
             ...(context.treeTasks === undefined ? {} : { treeContractHash: treeContractHash(context.records.map(r => r.task)) }),
@@ -821,8 +819,7 @@ export async function runReviewCommand(options) {
                 executionPolicy: options.config,
                 ...(surfacePacket === undefined ? {} : { surface: surfacePacket }),
                 artifacts: contractArtifacts.map(({ path, digest }) => ({ path, digest })),
-                tasks: await Promise.all(context.records.map(async (r) => ({ task: r.task, revisions: r.revisions ?? [],
-                    ...(r.task.debug === undefined ? {} : { debugProof: await loadDebugProof(options.root, r.task.debug.rootTaskId) }) }))),
+                tasks: context.records.map(r => ({ task: r.task, revisions: r.revisions ?? [] })),
                 superseded: context.historyRecords ?? [] }));
             const digest = sha256(content);
             const path = ".agent-ops/tasks/review-contracts/" + digest + ".json";
@@ -926,9 +923,7 @@ export async function runReviewCommand(options) {
                     await options.tasks.treeContract(context.taskId) !== context.binding.treeContractHash) ||
                 (context !== undefined && options.tasks !== undefined &&
                     (await Promise.all(context.records.map(async (r) => taskContractHash((await options.tasks.status({ taskId: r.task.id })).task))))
-                        .some((hash, i) => hash !== taskContractHash(context.records[i].task))) ||
-                (context?.binding?.debugProofs !== undefined && options.root !== undefined &&
-                    (await Promise.all(context.records.filter(r => r.task.debug !== undefined).map(async (r) => debugProofDigest(await loadDebugProof(options.root, r.task.debug.rootTaskId)) !== context.binding.debugProofs[r.task.id]))).some(Boolean))) {
+                        .some((hash, i) => hash !== taskContractHash(context.records[i].task)))) {
                 const changed = await persistReviewEvidence(options, sourceChangedResult(result), sourceFingerprint, context);
                 return notRunEnvelope(changed);
             }

package/dist/packages/cli/src/commands/run.js

@@ -47,7 +47,9 @@ function data(action, result) {
     };
 }
 function stateData(action, state, message) {
-    return { action, runId: state.runId, state, recovery: describeRunRecovery(state), message, text: textFor(action, state, message) };
+    const { events, goal: _goal, ...brief } = state;
+    return { action, runId: state.runId, state: { ...brief, eventCount: events.length }, recovery: describeRunRecovery(state), message,
+        text: textFor(action, state, message) };
 }
 async function goalFromArgs(args, root) {
     if (args.goal !== undefined && args.goalFile !== undefined)

package/dist/packages/cli/src/commands/task.js

@@ -47,10 +47,10 @@ async function withEscape(envelope, escape, service) {
         ...facts.map(fact => `- ${fact.path}: ${fact.surface}`),
         ...(proof === undefined ? [] : [proof.status === "proven"
                 ? `Proof: rule ${proof.rule} replays at the escaped commit; backtest ${proof.backtest.fires}/${proof.backtest.commits} commits (${proof.backtest.rate}).`
-                : proof.status === "unproven" ? `Proof: ${proof.code} - ${proof.reason} Finish refuses this until a tracked rule proves it.`
+                : proof.status === "unproven" ? `Proof: ${proof.code} - ${proof.reason} Advisory: finish does not wait for it; add a tracked rule to prove it.`
                     : proof.status === "lesson" ? `Lesson (unproven, does not block): ${proof.reason}`
-                        : proof.check === null ? "Proof: ESCAPE_RULE_UNPROVEN - name the red-to-green check with --escape-promote <runnerId:checkId>."
-                            : `Proof: promoted check ${proof.check} must be a proven redCheckId of this task. Config proposal (not written):\n${JSON.stringify(proposal, null, 2)}`]),
+                        : proof.check === null ? "Proof: ESCAPE_RULE_UNPROVEN (advisory) - name the red-to-green check with --escape-promote <runnerId:checkId>."
+                            : `Proof: promoted check ${proof.check} should be a proven redCheckId of this task (advisory). Config proposal (not written):\n${JSON.stringify(proposal, null, 2)}`]),
         `Ledger record: ${escape.path} (commit it with the fix).`,
         escape.blame.length === 0 ? "Blame hints: none (the fix only adds lines; an omission has no author)."
             : `Blame hints (a hint only): ${escape.blame.map(hint => `${hint.commit.slice(0, 12)} (${hint.lines} line${hint.lines === 1 ? "" : "s"})`).join(", ")}`
@@ -98,7 +98,7 @@ function taskAction(args) {
             "complete",
             "create",
             "export",
-            "status", "revise", "replan", "pin-finding", "debug"
+            "status", "revise", "replan", "pin-finding"
         ].includes(args.action)) {
         throw new AgentOpsError("TASK_ACTION_INVALID", "A supported task action is required.");
     }
@@ -110,7 +110,7 @@ function taskEnvelope(action, code, message, record) {
         message,
         record,
         contractHash: taskContractHash(record.task),
-        text: renderTaskMarkdown(record) + "\nContract: " + taskContractHash(record.task) + (record.debug === undefined ? "" : "\nDEBUG: " + JSON.stringify(record.debug))
+        text: renderTaskMarkdown(record) + "\nContract: " + taskContractHash(record.task)
     });
 }
 function renderTaskList(records) {
@@ -129,8 +129,6 @@ export async function runTaskCommand(options) {
             if (options.args.title === undefined) {
                 throw new AgentOpsError("TASK_TITLE_REQUIRED", "Task creation requires --title.");
             }
-            if (options.args.debug)
-                await options.service.assertDebugBaseline();
             const worktree = sessionId === undefined || options.sessionWorktree === undefined
                 ? undefined
                 : await options.sessionWorktree(sessionId);
@@ -156,12 +154,6 @@ export async function runTaskCommand(options) {
                 requireSurface: true
             });
             const escape = origin === undefined ? undefined : await (worktree?.service ?? options.service).declareEscape(record.task.id);
-            // An explicit CLI DEBUG intake may be the only start signal on hosts
-            // without a prompt hook (notably agy). The native session owns the clock;
-            // foregroundStart is idempotent for a repeated hook or command.
-            if (options.args.debug && sessionId !== undefined) {
-                await (worktree?.service ?? options.service).debugService().foregroundStart(record.task.id, sessionId);
-            }
             const created = await withEscape(taskEnvelope(action, "TASK_CREATED", sessionId === undefined
                 ? `Created task ${record.task.id}.`
                 : record.task.parentTaskId === undefined
@@ -187,42 +179,6 @@ export async function runTaskCommand(options) {
                 }
             };
         }
-        if (action === "debug") {
-            const id = requireTaskId(options.args), service = options.service.debugService();
-            if (options.args.debugAction === "origin") {
-                const declared = await service.origin(id, await jsonFile(options.args.payloadFile));
-                return await withEscape(taskEnvelope(action, "TASK_DEBUG_ORIGIN_DECLARED", "Origin bound into the contract; re-verify, re-record the confirmed hypothesis, then review.", declared.record), declared.escape, options.service);
-            }
-            switch (options.args.debugAction) {
-                case "hypothesis":
-                    await service.hypothesis(id, await jsonFile(options.args.payloadFile));
-                    break;
-                case "strategy":
-                    await service.strategy(id, await jsonFile(options.args.payloadFile));
-                    break;
-                case "investigate":
-                    await service.investigate(id, options.args.commandId, options.trusted === true);
-                    break;
-                case "checkpoint":
-                    if (sessionId === undefined)
-                        throw new AgentOpsError("TASK_SESSION_REQUIRED", "Debug checkpoint requires a session.");
-                    await service.checkpoint(id, sessionId);
-                    break;
-                case "resume":
-                    if (sessionId === undefined)
-                        throw new AgentOpsError("TASK_SESSION_REQUIRED", "Debug resume requires a session.");
-                    await service.resume(id, sessionId);
-                    break;
-                case "extend":
-                    if (sessionId === undefined)
-                        throw new AgentOpsError("TASK_SESSION_REQUIRED", "Debug extension requires a native session.");
-                    await service.extend(id, sessionId, options.args.eventId);
-                    break;
-                case "status": break;
-                default: throw new AgentOpsError("TASK_DEBUG_ACTION_INVALID", "A supported debug operation is required.");
-            }
-            return taskEnvelope(action, "TASK_DEBUG_UPDATED", "Original issue debug state preserved.", await service.root(id));
-        }
         if (action === "revise") {
             const payload = options.args.criteriaFile === undefined ? undefined : await jsonFile(options.args.criteriaFile);
             if (payload !== undefined && !Array.isArray(payload))
@@ -235,7 +191,7 @@ export async function runTaskCommand(options) {
                 ...(origin === undefined ? {} : { origin }),
                 reason: options.args.reason, ...(options.args.baseline === undefined ? {} : { baseline: options.args.baseline })
             });
-            return await withEscape(taskEnvelope(action, "TASK_REVISED", "Contract revised; obtain new verification and fresh review.", record), origin === undefined ? undefined : await options.service.declareEscape(record.task.id), options.service);
+            return await withEscape(taskEnvelope(action, "TASK_REVISED", "Contract revised; obtain a fresh review, and new verification if the criteria or configuration changed.", record), origin === undefined ? undefined : await options.service.declareEscape(record.task.id), options.service);
         }
         if (action === "replan") {
             const payload = await jsonFile(options.args.planFile);

package/dist/packages/cli/src/commands/verify.js

@@ -96,12 +96,16 @@ export async function runVerifyCommand(options) {
     try {
         const taskId = await resolveTaskId(options), activity = options.activity;
         const report = publicReport(await withActivity(activity?.commonDir, { kind: "verify", root: activity?.root ?? "", taskId, ...(activity?.sessionId === undefined ? {} : { sessionId: activity.sessionId }) }, async () => await options.service.verify(taskId)));
-        const text = formatReport(report);
+        // A broken surface check must not hide the verification result.
+        const surface = options.surface === undefined ? [] : await options.surface(taskId).catch(() => []);
+        const text = formatReport(report) + surface.map(line => `${safe(line)}\n`).join("");
+        const advisory = surface.length === 0 ? {} : { surface };
         if (report.status === "PASS") {
             return okEnvelope("VERIFICATION_PASSED", {
                 message: "Required verification passed.",
                 report,
-                text
+                text,
+                ...advisory
             });
         }
         const code = report.status === "FAIL"
@@ -113,7 +117,7 @@ export async function runVerifyCommand(options) {
         return {
             code,
             status: "error",
-            data: { message, report, text },
+            data: { message, report, text, ...advisory },
             errors: [{ code, message }]
         };
     }

package/dist/packages/cli/src/default-base.js

@@ -0,0 +1,26 @@
+import { readWorktreeRecord } from "../../../runtime/src/parallel/service.js";
+import { collectChangeSurface, resolveGitCommit } from "../../../runtime/src/verify/change-surface.js";
+/**
+ * The base verify and review use when `--base` is absent, so committed work is
+ * judged as a range without the agent having to copy it. A dirty tree keeps the
+ * working-tree mode; a session worktree compares against its merge-base with the
+ * target branch (which follows a finish rebase); elsewhere the task's creation
+ * commit counts when it is an ancestor of HEAD.
+ */
+export async function defaultBase(root, runner, createdSourceCommit) {
+    if ((await collectChangeSurface(runner)).paths.length > 0)
+        return undefined;
+    const head = await resolveGitCommit(runner, "HEAD");
+    const record = await readWorktreeRecord(root);
+    let base;
+    if (record !== null) {
+        const merge = await runner.run(["merge-base", "HEAD", record.targetBranch]);
+        base = merge.exitCode === 0 ? Buffer.from(merge.stdout).toString("utf8").trim() : record.base;
+    }
+    else {
+        const created = await createdSourceCommit().catch(() => undefined);
+        if (created !== undefined && (await runner.run(["merge-base", "--is-ancestor", created, "HEAD"])).exitCode === 0)
+            base = created;
+    }
+    return base === undefined || base === "" || base === head ? undefined : base;
+}