@kylecheng3146/agent-ops 0.10.2 → 0.11.0

package/dist/runtime/src/review/execute.js

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { chmod, copyFile, lstat, mkdir, mkdtemp, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { chmod, copyFile, lstat, mkdir, mkdtemp, readFile, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { runVerificationCommand } from "../verify/spawn.js";
@@ -37,6 +37,14 @@ export const DEFAULT_STALL_IDLE_MS = 90_000;
  * round timeout or caller cancellation may stop a silent agy review.
  */
 export const AGY_STALL_IDLE_MS = Number.POSITIVE_INFINITY;
+/**
+ * agy logs this once its turn is over and the answer is on stdout. Some runs
+ * then never exit (the language server shutdown hangs), which would hold a
+ * finished round until the full round timeout and report it as NOT_RUN.
+ */
+const AGY_TURN_FINISHED = /Stream goroutine exited for \S+, sending completion signal/u;
+/** How long a finished agy turn may take to exit before it is stopped. */
+export const AGY_EXIT_GRACE_MS = 30_000;
 /**
  * A call the service dropped before answering. It produced no verdict, so
  * one fresh retry is not review shopping.
@@ -238,6 +246,55 @@ function watchForStall(logFile, parent, idleMs) {
         }
     };
 }
+/**
+ * Stops an agy round that finished its turn but did not exit. Only the log's
+ * completion line starts the grace window, so a long silent generation is
+ * never cut off; the round timeout still caps a reviewer that never finishes.
+ */
+function watchForFinishedTurn(logFile, graceMs) {
+    const controller = new AbortController();
+    let fired = false;
+    let grace;
+    const check = async () => {
+        if (logFile === undefined || grace !== undefined)
+            return;
+        try {
+            if (!AGY_TURN_FINISHED.test(await readFile(logFile, "utf8")))
+                return;
+        }
+        catch {
+            return;
+        }
+        if (grace !== undefined)
+            return;
+        clearInterval(poll);
+        grace = setTimeout(() => {
+            fired = true;
+            controller.abort("finished-without-exit");
+        }, graceMs);
+        grace.unref();
+    };
+    const poll = setInterval(() => {
+        void check();
+    }, Math.max(20, Math.min(5_000, Math.floor(graceMs / 3))));
+    poll.unref();
+    return {
+        signal: controller.signal,
+        fired: () => fired,
+        stop: () => {
+            clearInterval(poll);
+            if (grace !== undefined)
+                clearTimeout(grace);
+        }
+    };
+}
+/** A finished agy turn that was stopped for not exiting counts as completed. */
+function finishedTurnCompletion(target, spawned, watch, graceMs, options) {
+    if (!watch.fired() || spawned.failureClass !== "aborted" || options.signal?.aborted === true)
+        return spawned;
+    options.onProgress?.(`${target}: finished its turn but did not exit within ${Math.max(1, Math.round(graceMs / 1_000))}s → stopped it and read its answer`);
+    return { ...spawned, failureClass: "none" };
+}
 function throwIfInterrupted(target, options, failureClass) {
     if (failureClass !== "aborted" && options.signal?.aborted !== true) {
         return;
@@ -507,6 +564,8 @@ async function attemptTarget(request, options) {
         const stallIdleMs = options.stallIdleMs ??
             (target === "agy" ? AGY_STALL_IDLE_MS : DEFAULT_STALL_IDLE_MS);
         const stallWatch = watchForStall(heartbeatLog, options.signal, stallIdleMs);
+        const exitGraceMs = options.agyExitGraceMs ?? AGY_EXIT_GRACE_MS;
+        const finishedWatch = watchForFinishedTurn(agyLog, exitGraceMs);
         let spawned;
         try {
             spawned = await runVerificationCommand({
@@ -526,13 +585,15 @@ async function attemptTarget(request, options) {
                 stdin: invocation.stdin,
                 env: environment,
                 replaceEnv: true,
-                signal: stallWatch.signal,
+                signal: AbortSignal.any([stallWatch.signal, finishedWatch.signal]),
                 onActivity: stallWatch.beat
             });
         }
         finally {
             stallWatch.stop();
+            finishedWatch.stop();
         }
+        spawned = finishedTurnCompletion(target, spawned, finishedWatch, exitGraceMs, options);
         // Ahead of `throwIfInterrupted`, which reads the same `aborted` failure
         // class as a user interrupt. A stall is this executor's own abort, and
         // ends one target rather than the whole review.
@@ -607,6 +668,7 @@ async function attemptTarget(request, options) {
                 if (nudge !== undefined) {
                     options.onProgress?.(`${target}: turn ended without answering${denied.length > 0 ? ` (denied ${denied.join(", ")})` : ""} → resuming the conversation once`);
                     const nudgeWatch = watchForStall(nudgeLog, options.signal, stallIdleMs);
+                    const nudgeFinished = watchForFinishedTurn(nudgeLog, exitGraceMs);
                     let second;
                     try {
                         second = await runVerificationCommand({
@@ -626,13 +688,15 @@ async function attemptTarget(request, options) {
                             stdin: nudge.stdin,
                             env: environment,
                             replaceEnv: true,
-                            signal: nudgeWatch.signal,
+                            signal: AbortSignal.any([nudgeWatch.signal, nudgeFinished.signal]),
                             onActivity: nudgeWatch.beat
                         });
                     }
                     finally {
                         nudgeWatch.stop();
+                        nudgeFinished.stop();
                     }
+                    second = finishedTurnCompletion(target, second, nudgeFinished, exitGraceMs, options);
                     usage = sumUsage(usage, extractUsage(target, second.stdout, second.stderr));
                     throwIfInterrupted(target, options, second.failureClass);
                     nudged = { log: nudgeLog, stdout: second.stdout };
@@ -712,7 +776,7 @@ export function createReviewExecutor(options) {
     const clock = options.now ?? (() => Date.now());
     return async (request) => {
         const deadlineAt = clock() +
-            Math.min(options.chainTimeoutMs ?? DEFAULT_REVIEW_CHAIN_TIMEOUT_MS, await options.remainingBudgetMs?.() ?? Infinity);
+            (options.chainTimeoutMs ?? DEFAULT_REVIEW_CHAIN_TIMEOUT_MS);
         const remainingMs = () => deadlineAt - clock();
         /**
          * The options one stage runs under: its own timeout, or what is left of

package/dist/runtime/src/run/verification.js

@@ -4,7 +4,7 @@ import { sha256 } from "../fs/hash.js";
 import { AgentOpsError } from "../fs/paths.js";
 import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
 import { redactSecrets } from "../security/redact.js";
-import { taskContractHash } from "../task/contract.js";
+import { evidenceMatchesContract, taskContractHash } from "../task/contract.js";
 import { FileEvidenceStore } from "../verify/evidence.js";
 import { deriveFailureObservation } from "./convergence.js";
 /** Preserve actual failed command reports, which are not completion evidence. */
@@ -50,7 +50,7 @@ export async function observeRunFailure(state, root, records, taskId, code, pend
             for (const phase of saved.report.acceptance ?? []) {
                 const proof = await evidence.load(phase.reference);
                 const criterion = record.task.criteria.find(c => c.id === phase.criterionId);
-                if (proof?.acceptance === undefined || proof.taskContractHash !== taskContractHash(record.task) || criterion?.acceptance === undefined || criterion.acceptance.mode === "review-only")
+                if (proof?.acceptance === undefined || !evidenceMatchesContract(proof.taskContractHash, record.task) || criterion?.acceptance === undefined || criterion.acceptance.mode === "review-only")
                     continue;
                 const bindings = criterion.acceptance.bindings.filter(b => b.runnerId === phase.runnerId);
                 acceptance.push({ ...phase, criterionId: record.task.id + ":" + phase.criterionId, checks: proof.acceptance.checks,

package/dist/runtime/src/schema/validate.js

@@ -1,4 +1,3 @@
-import { validDebugSettings, validDebugIntake } from "../task/debug-state.js";
 import { CONFIG_SCHEMA_VERSION, EVIDENCE_SCHEMA_VERSION, MANIFEST_SCHEMA_VERSION, TASK_SCHEMA_VERSION } from "../contracts.js";
 import { acceptanceError, runnerError, commitIdentity } from "./acceptance.js";
 import { parseSurface } from "../surface/schema.js";
@@ -339,8 +338,9 @@ export function validateConfig(value) {
     if (featuresUnknown !== undefined) {
         return featuresUnknown;
     }
-    if (root.features.debug !== undefined && !validDebugSettings(root.features.debug))
-        return failure("INVALID_FEATURE", "$.features.debug", "Debug requires enabled, bounded budgetMs and maxRounds.");
+    // Pre-0.11 DEBUG budget settings: still accepted, now ignored.
+    if (root.features.debug !== undefined && !isRecord(root.features.debug))
+        return failure("INVALID_FEATURE", "$.features.debug", "features.debug must be an object.");
     if (root.features.office !== undefined) {
         if (!isRecord(root.features.office)) {
             return failure("INVALID_TYPE", "$.features.office", "office must be an object.");
@@ -571,12 +571,17 @@ export function validateCriterion(value, path) {
     }
     return success(value);
 }
+/** The DEBUG tag a task keeps: its root and the issue's recorded facts and unknowns. */
+function validDebugTag(value) {
+    return isRecord(value) && Object.keys(value).every(k => ["rootTaskId", "facts", "unknowns"].includes(k)) &&
+        typeof value.rootTaskId === "string" && value.rootTaskId.length > 0 && isStringArray(value.facts) && isStringArray(value.unknowns);
+}
 export function validateTask(value) {
     const root = validateRoot(value, ["criteria", "id", "intent", "goal", "contractRevision", "parentTaskId", "schemaVersion", "title", "debug", "surface", "surfaceRequired", "origin", "originRequired"], isRecord(value) && value.schemaVersion === 1 ? 1 : TASK_SCHEMA_VERSION);
     if (isFailure(root)) {
         return root;
     }
-    if (root.debug !== undefined && (!validDebugIntake(root.debug) || root.schemaVersion !== TASK_SCHEMA_VERSION || root.goal === undefined))
+    if (root.debug !== undefined && (!validDebugTag(root.debug) || root.schemaVersion !== TASK_SCHEMA_VERSION || root.goal === undefined))
         return failure("INVALID_DEBUG_TASK", "$.debug", "Debug tasks require immutable goal and bounded root intake.");
     if (root.surfaceRequired !== undefined && root.surfaceRequired !== true)
         return failure("INVALID_SURFACE", "$.surfaceRequired", "surfaceRequired is either absent or true.");
@@ -591,7 +596,7 @@ export function validateTask(value) {
     if (root.origin !== undefined && !validOrigin(root.origin))
         return failure("INVALID_ORIGIN", "$.origin", "origin is escape-of {commit, label, receipt?} or pre-existing/external {reason}.");
     if (root.originRequired !== undefined && (root.originRequired !== true || root.debug === undefined))
-        return failure("INVALID_ORIGIN", "$.originRequired", "originRequired is either absent or true on a DEBUG task.");
+        return failure("INVALID_ORIGIN", "$.originRequired", "originRequired (pre-0.11, now ignored) is either absent or true on a DEBUG task.");
     if (root.contractRevision !== undefined && (!Number.isSafeInteger(root.contractRevision) || root.contractRevision < 0))
         return failure("INVALID_CONTRACT_REVISION", "$.contractRevision", "Invalid contract revision.");
     if (root.goal !== undefined && (!isNonEmptyString(root.goal) || Buffer.byteLength(root.goal, "utf8") > 65536))

package/dist/runtime/src/task/completion.js

@@ -2,52 +2,14 @@ import { calculateConfigHash } from "../config/hash.js";
 import { findReviewAttestation } from "../review/attestation.js";
 import { validateEvidence, validateTaskAgainstConfig } from "../schema/validate.js";
 import { isPassingVerificationEvidence } from "../verify/evidence.js";
-import { taskContractHash } from "./contract.js";
-import { acceptanceCoverage, coverageDigest } from "../verify/acceptance-coverage.js";
-import { loadDebugProof, debugProofDigest, debugRemainingMs } from "./debug-state.js";
-import { escapeCompletionProblem } from "../escape/link.js";
-import { RULES_DIRECTORY } from "../escape/rules.js";
+import { evidenceMatchesContract, taskContractHash } from "./contract.js";
+import { acceptanceCoverage } from "../verify/acceptance-coverage.js";
 export async function checkTaskCompletionEvidence(stored, options) {
-    const debug = stored.task.debug === undefined ? undefined : await loadDebugProof(options.root, stored.task.debug.rootTaskId);
-    if (debug?.control?.paused === true || debug?.control?.mode === "diagnose")
-        return { status: "FAIL", code: "TASK_DEBUG_SCOPE_RESTRICTED", remedy: "The human restricted this issue to pause or diagnosis. Preserve the active task; only a native human resume repair event authorizes repair completion." };
     const problem = await checkTaskVerificationEvidence(stored, options);
     if (problem !== null)
         return problem;
     const attestation = await findReviewAttestation(options.root, options.sourceFingerprint, stored.task.id);
-    if (debug !== undefined) {
-        const coverage = await acceptanceCoverage(stored, options.config, options.sourceFingerprint, options.evidenceStore);
-        const { FileTaskStore } = await import("./store.js");
-        const { join } = await import("node:path");
-        const reviewedRecords = (await new FileTaskStore(join(options.root, ".agent-ops/tasks/state.json"), options.root).read()).tasks.filter(r => attestation?.taskContracts?.[r.task.id] !== undefined);
-        const currentCoverage = [];
-        for (const record of reviewedRecords) {
-            const rows = await acceptanceCoverage(record, options.config, options.sourceFingerprint, options.evidenceStore);
-            currentCoverage.push(...rows.map(row => ({ ...row, criterionId: attestation?.tree === undefined ? row.criterionId : record.task.id + ":" + row.criterionId })));
-        }
-        const refs = new Set(coverage.filter(c => c.mode === "behavioral" && c.status === "proven").flatMap(c => c.evidenceReferences));
-        if (attestation?.coverageDigest !== coverageDigest(currentCoverage) || debug.operation !== null || debugRemainingMs(debug) === 0 || !debug.hypotheses.some(h => h.status === "confirmed" && h.supporting.some(ref => refs.has(ref))) ||
-            attestation?.debugProofs?.[stored.task.id] !== debugProofDigest(debug))
-            return { status: "FAIL", code: "TASK_DEBUG_PROOF_REQUIRED", remedy: "Confirm the original cause with current discriminating regression proof, then obtain two fresh independent reviews bound to that debug proof." };
-    }
-    // Fails closed: the Escape Loop needs every DEBUG fix to say where the bug came from.
-    if (stored.task.originRequired === true && stored.task.origin === undefined)
-        return { status: "FAIL", code: "ESCAPE_ORIGIN_MISSING", remedy: "Declare the issue origin with task debug --debug-action origin --payload-file <json> (escape-of <commit> + label, pre-existing or external + reason) after the hypothesis is confirmed, then re-verify, re-record the hypothesis and obtain review." };
-    // Escape Loop R2: a declared escape finishes only with its proof (rule replay + backtest, or a promoted red-to-green check).
-    const origin = stored.task.origin, base = debug?.baselineCommit ?? stored.createdSourceCommit;
-    if (origin?.kind === "escape-of" && base !== undefined) {
-        const escape = await escapeCompletionProblem({ root: options.root, taskId: stored.task.id, origin, base });
-        if (escape !== null && "code" in escape)
-            return { status: "FAIL", code: escape.code, remedy: `${escape.reason} Add or fix a tracked ${RULES_DIRECTORY}/<id>.json rule, re-declare the origin and commit the record.` };
-        if (escape !== null) {
-            const [runnerId, checkId] = escape.check.split(":");
-            const proven = new Set((await acceptanceCoverage(stored, options.config, options.sourceFingerprint, options.evidenceStore))
-                .filter(row => row.status === "proven").map(row => row.criterionId));
-            if (!stored.task.criteria.some(c => proven.has(c.id) && c.acceptance?.mode === "behavioral" &&
-                c.acceptance.bindings.some(b => b.runnerId === runnerId && (b.redCheckIds ?? []).includes(checkId))))
-                return { status: "FAIL", code: "ESCAPE_RULE_UNPROVEN", remedy: `The promoted check ${escape.check} must be a redCheckId of a proven behavioral criterion of this task (red baseline, green candidate).` };
-        }
-    }
+    // Escape origin and its rule proof are advisory: task create/revise --escape-of report them, completion does not wait on them.
     if (attestation === null || attestation.taskId !== stored.task.id ||
         ((stored.task.criteria.some(c => c.acceptance !== undefined) || (stored.task.contractRevision ?? 0) > 0 || stored.task.goal !== undefined) &&
             (attestation.schemaVersion !== 3 || attestation.taskContracts?.[stored.task.id] !== taskContractHash(stored.task))) ||
@@ -86,7 +48,7 @@ export async function checkTaskVerificationEvidence(stored, options) {
                 if (evidence.taskId === stored.task.id && evidence.criterionId === criterion.id &&
                     evidence.commandId === command.id && evidence.configHash === configHash &&
                     evidence.sourceFingerprint === sourceFingerprint &&
-                    ((stored.task.goal === undefined && (stored.task.contractRevision ?? 0) === 0 && stored.task.criteria.every(c => c.acceptance === undefined)) || evidence.taskContractHash === taskContractHash(stored.task)) &&
+                    ((stored.task.goal === undefined && (stored.task.contractRevision ?? 0) === 0 && stored.task.criteria.every(c => c.acceptance === undefined)) || evidenceMatchesContract(evidence.taskContractHash, stored.task)) &&
                     (latest === undefined || Date.parse(evidence.finishedAt) > Date.parse(latest.finishedAt) ||
                         (Date.parse(evidence.finishedAt) === Date.parse(latest.finishedAt) && !isPassingVerificationEvidence(command, evidence)))) {
                     latest = evidence;

package/dist/runtime/src/task/contract.js

@@ -15,6 +15,17 @@ export function taskContractHash(task) {
         ...(task.origin === undefined ? {} : { origin: task.origin }),
         ...(task.originRequired === undefined ? {} : { originRequired: true }) }));
 }
+/**
+ * What verification actually ran: the criteria. Surface, origin, goal and revision
+ * changes leave it alone, so they need a fresh review but not a fresh verify.
+ */
+export function executionContractHash(task) {
+    return sha256(canonicalJson({ domain: "agent-ops-execution-v1", criteria: task.criteria.map(criterionContractHash) }));
+}
+/** Verification evidence binds the execution hash; evidence from before 0.11 bound the full contract. */
+export function evidenceMatchesContract(hash, task) {
+    return hash !== undefined && (hash === executionContractHash(task) || hash === taskContractHash(task));
+}
 export function treeContractHash(tasks) {
     return sha256(canonicalJson(tasks.map(task => ({ id: task.id, hash: taskContractHash(task) }))
         .sort((a, b) => a.id.localeCompare(b.id))));

package/dist/runtime/src/task/service.js

@@ -6,18 +6,14 @@ import { validateEvidence, validateTask, validateTaskAgainstConfig } from "../sc
 import { renderTaskMarkdown } from "./render.js";
 import { checkTaskCompletionEvidence, findIncompleteSubtask } from "./completion.js";
 import { calculateConfigHash, FileEvidenceStore, isPassingVerificationEvidence } from "../verify/evidence.js";
-import { collectChangeSurface } from "../verify/change-surface.js";
 import { resolveReviewScope } from "../review/scope.js";
 import { calculateSourceFingerprint } from "../verify/source-fingerprint.js";
 import { acceptanceCoverage } from "../verify/acceptance-coverage.js";
 import { loadFindingPin } from "./pin-finding.js";
 import { findReviewAttestation } from "../review/attestation.js";
 import { advanceFailureFingerprint } from "../verify/fingerprint.js";
-import { taskContractHash, treeContractHash } from "./contract.js";
+import { evidenceMatchesContract, executionContractHash, taskContractHash, treeContractHash } from "./contract.js";
 import { commitIdentity } from "../schema/acceptance.js";
-import { createDebugState, DEBUG_DEFAULTS } from "./debug-state.js";
-import { DebugService } from "./debug.js";
-import { sameDebugText } from "./debug-intake.js";
 import { isCovers, parseSurface } from "../surface/schema.js";
 import { declareEscape, resolveOrigin } from "../escape/link.js";
 import { configProposal } from "../escape/rules.js";
@@ -92,15 +88,6 @@ export class TaskService {
         this.#now = options.now ?? (() => new Date().toISOString());
         this.#completion = options.completion;
     }
-    debugService() {
-        if (this.#completion === undefined)
-            throw taskError("TASK_DEBUG_CONTEXT_REQUIRED", "Debug operations require repository context.");
-        return new DebugService({ store: this.#store, tasks: this, ...this.#completion });
-    }
-    async assertDebugBaseline() {
-        if (this.#completion === undefined || (await collectChangeSurface(this.#completion.gitRunner)).paths.length > 0)
-            throw taskError("TASK_DEBUG_BASELINE_DIRTY", "Preserve user edits; debug intake needs a clean committed baseline before worktree allocation.");
-    }
     async create(input) {
         if (input.policyConfigHash !== undefined &&
             !/^[a-f0-9]{64}$/u.test(input.policyConfigHash)) {
@@ -109,12 +96,6 @@ export class TaskService {
         if (input.sessionId !== undefined) {
             assertSessionId(input.sessionId);
         }
-        // A new session must not restart an active issue's budget and rounds.
-        if (input.debug !== undefined && input.parentTaskId === undefined && input.goal !== undefined) {
-            const existing = await this.activeDebugRoot(input.goal);
-            if (existing !== null)
-                return input.sessionId === undefined ? existing : await this.attach(input.sessionId, existing.task.id);
-        }
         let createdSourceCommit = input.createdSourceCommit;
         if (createdSourceCommit === undefined && this.#completion !== undefined) {
             const head = await this.#completion.gitRunner.run(["rev-parse", "--verify", "HEAD"]);
@@ -142,21 +123,11 @@ export class TaskService {
                 ? {}
                 : { parentTaskId: input.parentTaskId })
         };
-        let debugSettings;
-        if (input.debug !== undefined) {
-            if (input.goal === undefined || createdSourceCommit === undefined || this.#completion === undefined)
-                throw taskError("TASK_DEBUG_CONTEXT_REQUIRED", "Debug intake requires the original issue and a committed baseline.");
-            if ((await collectChangeSurface(this.#completion.gitRunner)).paths.length > 0)
-                throw taskError("TASK_DEBUG_BASELINE_DIRTY", "Preserve original user edits; investigate read-only or ask for an explicit committed baseline.");
-            const config = await this.#completion.loadConfig();
-            if (config.features.debug?.enabled === false)
-                throw taskError("TASK_DEBUG_DISABLED", "Task debug routing is explicitly disabled.");
-            debugSettings = config.features.debug ?? DEBUG_DEFAULTS;
+        // DEBUG = an ordinary task whose original regression is proven red at the baseline and green on the candidate.
+        if (input.debug !== undefined && input.parentTaskId === undefined) {
+            if (!criteria.some(c => c.acceptance?.mode === "behavioral" && c.acceptance.bindings.some(b => (b.redCheckIds ?? []).length > 0)))
+                throw taskError("TASK_DEBUG_RED_CHECK_REQUIRED", "A DEBUG task needs a behavioral criterion whose redCheckIds fail at the baseline and pass on the candidate.");
             task.debug = { rootTaskId: task.id, facts: [...(input.debug.facts ?? [])], unknowns: [...(input.debug.unknowns ?? [])] };
-            if (input.origin !== undefined)
-                throw taskError("ESCAPE_ORIGIN_DEBUG_ACTION", "A DEBUG issue declares its origin with task debug --debug-action origin after a confirmed hypothesis.");
-            if (input.parentTaskId === undefined)
-                task.originRequired = true;
         }
         const validation = validateTask(task);
         if (!validation.ok) {
@@ -192,13 +163,10 @@ export class TaskService {
                         throw taskError("TASK_GOAL_IMMUTABLE", "Subtasks must retain their parent original goal.");
                     validation.value.goal = parent.task.goal;
                 }
-                if (parent.task.debug !== undefined) {
-                    if (input.debug !== undefined)
-                        throw taskError("TASK_DEBUG_ROOT_IMMUTABLE", "A child cannot create a new issue budget.");
+                if (parent.task.debug !== undefined)
                     validation.value.debug = structuredClone(parent.task.debug);
-                }
             }
-            if (input.requireSurface === true && validation.value.debug === undefined) {
+            if (input.requireSurface === true) {
                 const parentSurface = state.tasks.find(record => record.task.id === input.parentTaskId)?.task.surface;
                 const surfacedParent = parentSurface !== undefined && !isCovers(parentSurface);
                 if (surface === undefined || isCovers(surface) !== surfacedParent)
@@ -208,7 +176,6 @@ export class TaskService {
             }
             const record = {
                 task: validation.value,
-                ...(input.debug === undefined ? {} : { debug: createDebugState(task.id, createdSourceCommit, debugSettings, this.#completion.root) }),
                 ...(createdSourceCommit === undefined ? {} : { createdSourceCommit }),
                 status: "active",
                 evidence: {},
@@ -271,26 +238,28 @@ export class TaskService {
         if (taskContractHash(previous.task) !== input.expectedContractHash)
             throw taskError("TASK_CONTRACT_CHANGED", "Task contract changed.");
         // With none of them, a revision only rebinds the task to the current configuration (checked below).
-        const rebindOnly = input.criteria === undefined && input.surface === undefined && input.origin === undefined;
+        const rebindOnly = input.criteria === undefined && input.surface === undefined && input.origin === undefined && input.baseline === undefined;
         if (rebindOnly && this.#completion === undefined)
             throw taskError("TASK_REVISION_INVALID", "Revision requires criteria, a surface, an origin, or a combination.");
-        if (input.origin !== undefined && previous.task.debug !== undefined && input.debugOrigin !== true)
-            throw taskError("ESCAPE_ORIGIN_DEBUG_ACTION", "A DEBUG issue declares its origin with task debug --debug-action origin after a confirmed hypothesis.");
         // Re-declaring the same origin only refreshes its ledger record; the contract and its proof stand.
         if (input.criteria === undefined && input.surface === undefined && input.origin !== undefined &&
             canonicalJson(input.origin) === canonicalJson(previous.task.origin ?? null))
             return previous;
         const surface = input.surface === undefined ? previous.task.surface : parseSurface(input.surface);
-        const baseline = input.baseline ?? previous.createdSourceCommit;
-        const criteria = input.criteria === undefined ? structuredClone(previous.task.criteria) : structuredClone(input.criteria).map(criterion => {
+        // An explicit --baseline moves every typed criterion (e.g. a task opened on the wrong branch); its evidence is then void.
+        const moved = input.baseline === undefined ? undefined : await this.#resolveCommit(input.baseline);
+        const baseline = moved ?? previous.createdSourceCommit;
+        const criteria = (input.criteria === undefined ? structuredClone(previous.task.criteria) : structuredClone(input.criteria)).map(criterion => {
             if (criterion.acceptance === undefined)
                 return criterion;
-            const sha = criterion.acceptance.baselineCommit ?? baseline;
+            if (input.criteria === undefined && moved === undefined)
+                return criterion;
+            const sha = moved ?? criterion.acceptance.baselineCommit ?? baseline;
             if (sha === undefined)
                 throw taskError("BASELINE_REQUIRED", "Legacy tasks need an explicit baseline before typed acceptance.");
             const old = previous.task.criteria.find(c => c.id === criterion.id)?.acceptance;
-            if (old !== undefined && sha !== old.baselineCommit)
-                throw taskError("BASELINE_IMMUTABLE", "Create a replacement criterion instead of changing its baseline.");
+            if (moved === undefined && old !== undefined && sha !== old.baselineCommit)
+                throw taskError("BASELINE_IMMUTABLE", "Create a replacement criterion, or move every baseline with --baseline.");
             return { ...criterion, acceptance: { ...criterion.acceptance, baselineCommit: sha } };
         });
         const next = { ...previous.task, schemaVersion: TASK_SCHEMA_VERSION,
@@ -319,7 +288,13 @@ export class TaskService {
             const current = findTask(state, taskId);
             if (current.status !== "active" || JSON.stringify(current) !== JSON.stringify(previous))
                 throw taskError("TASK_CONTRACT_CHANGED", "Concurrent revision preserved; retry from current task.");
-            const result = { ...current, task: next, evidence: {}, failureFingerprint: null,
+            // Surface, origin or goal-only revisions keep what verification ran; review is still voided by the new contract hash.
+            const sameExecution = executionContractHash(next) === executionContractHash(current.task) && policyConfigHash === current.policyConfigHash;
+            // Review references never carry over: the new contract needs fresh review.
+            const verified = Object.fromEntries(Object.entries(current.evidence)
+                .map(([id, refs]) => [id, refs.filter(ref => !ref.startsWith("review:"))]).filter(([, refs]) => refs.length > 0));
+            const result = { ...current, task: next, evidence: sameExecution ? verified : {},
+                failureFingerprint: sameExecution ? current.failureFingerprint : null, ...(moved === undefined ? {} : { createdSourceCommit: moved }),
                 policyConfigHash, completionBase: null, updatedAt: now,
                 revisions: [...(current.revisions ?? []), { previousTask: current.task, previousEvidence: current.evidence,
                         previousFailure: current.failureFingerprint, previousHash: input.expectedContractHash,
@@ -329,6 +304,15 @@ export class TaskService {
             return cloneRecord(withoutReview);
         });
     }
+    /** A moved baseline must be a real commit in the candidate's history, so red-to-green still proves this change. */
+    async #resolveCommit(ref) {
+        const git = this.#completion?.gitRunner;
+        const resolved = git === undefined ? undefined : await git.run(["rev-parse", "--verify", "--end-of-options", `${ref}^{commit}`]);
+        const sha = resolved?.exitCode === 0 ? resolved.stdout.toString().trim() : "";
+        if (!commitIdentity(sha) || (await git.run(["merge-base", "--is-ancestor", sha, "HEAD"])).exitCode !== 0)
+            throw taskError("TASK_BASELINE_INVALID", "--baseline must resolve to a commit that is an ancestor of HEAD.");
+        return sha;
+    }
     async replan(taskId, input) {
         if (input.reason.trim() === "" || input.reason.includes("\0") || input.reason.length > 8192 ||
             input.tasks.length === 0 || input.tasks.length > 128)
@@ -461,8 +445,6 @@ export class TaskService {
                 if (record.policyConfigHash !== parent.policyConfigHash || !validateTask(task).ok) {
                     throw taskError("TASK_DELIVERY_INVALID", `Task ${task.id} has an incompatible policy or definition.`);
                 }
-                if (parent.task.debug !== undefined && (task.goal !== parent.task.goal || JSON.stringify(task.debug) !== JSON.stringify(parent.task.debug) || record.debug !== undefined))
-                    throw taskError("TASK_DEBUG_ROOT_MISMATCH", "A delivery must retain the original issue identity and cannot import an independent debug budget.");
                 const existing = state.tasks.find((item) => item.task.id === task.id);
                 if (existing !== undefined) {
                     if (JSON.stringify(existing.task) !== JSON.stringify(task)) {
@@ -488,11 +470,6 @@ export class TaskService {
             }
         });
     }
-    /** The active DEBUG root already holding this original issue, if any. */
-    async activeDebugRoot(goal) {
-        return (await this.list()).find((record) => record.status === "active" && record.task.debug?.rootTaskId === record.task.id &&
-            record.task.goal !== undefined && sameDebugText(record.task.goal, goal)) ?? null;
-    }
     async list(filter = {}) {
         const state = await this.#store.read();
         return state.tasks
@@ -721,7 +698,7 @@ export class TaskService {
                 validation.value.criterionId === criterionId && validation.value.commandId === commandId &&
                 validation.value.configHash === configHash && validation.value.sourceFingerprint === sourceFingerprint &&
                 (!(snapshot.task.goal !== undefined || (snapshot.task.contractRevision ?? 0) > 0 || snapshot.task.criteria.some(c => c.acceptance !== undefined)) ||
-                    validation.value.taskContractHash === taskContractHash(snapshot.task))
+                    evidenceMatchesContract(validation.value.taskContractHash, snapshot.task))
                 ? validation.value : null;
         };
         for (const criterion of snapshot.task.criteria) {

package/dist/runtime/src/task/store.js

@@ -4,7 +4,6 @@ import { AgentOpsError } from "../fs/paths.js";
 import { validateTask } from "../schema/validate.js";
 import { readPrivateFile, withPrivateFileLock, writePrivateFile } from "../security/permissions.js";
 import { taskContractHash } from "./contract.js";
-import { assertDebugState } from "./debug-state.js";
 import { commitIdentity, acceptanceSourcePath } from "../schema/acceptance.js";
 const DEFAULT_MAX_BYTES = 1024 * 1024;
 const SESSION_ID_PATTERN = /^[^\0\r\n]{1,256}$/u;
@@ -78,11 +77,9 @@ function parseTaskRecord(value) {
     if (!task.ok) {
         return invalidState("Task state contains an invalid task.");
     }
-    if (value.debug !== undefined) {
-        assertDebugState(value.debug);
-        if (value.debug.rootTaskId !== task.value.id || task.value.debug?.rootTaskId !== task.value.id)
-            return invalidState("Debug counters belong only to the original issue root.");
-    }
+    // Pre-0.11 DEBUG budget/hypothesis state: accepted, then dropped on load.
+    if (value.debug !== undefined && !isRecord(value.debug))
+        return invalidState("Task state contains an invalid task record.");
     if (!["active", "archived", "complete"].includes(String(value.status)) ||
         !isTimestamp(value.createdAt) ||
         !isTimestamp(value.updatedAt) ||
@@ -188,7 +185,6 @@ function parseTaskRecord(value) {
     }
     return {
         task: task.value,
-        ...(value.debug === undefined ? {} : { debug: value.debug }),
         ...(value.noChangePaths === undefined ? {} : { noChangePaths: value.noChangePaths }),
         ...(value.createdSourceCommit === undefined ? {} : { createdSourceCommit: value.createdSourceCommit }),
         ...(value.revisions === undefined ? {} : { revisions: value.revisions }),

package/dist/runtime/src/verify/acceptance-coverage.js

@@ -2,10 +2,9 @@ import { calculateConfigHash, canonicalJson } from "../config/hash.js";
 import { readPrivateFile } from "../security/permissions.js";
 import { join } from "node:path";
 import { sha256 } from "../fs/hash.js";
-import { criterionContractHash, taskContractHash } from "../task/contract.js";
+import { criterionContractHash, evidenceMatchesContract } from "../task/contract.js";
 /** Only current, paired check evidence discharges a mechanical contract. */
 export async function acceptanceCoverage(record, config, sourceFingerprint, store) {
-    const contract = taskContractHash(record.task);
     const configHash = calculateConfigHash(config);
     const rows = [];
     for (const criterion of record.task.criteria) {
@@ -18,7 +17,7 @@ export async function acceptanceCoverage(record, config, sourceFingerprint, stor
             const evidence = await store.load(reference);
             if (evidence?.schemaVersion === 4 && evidence.taskId === record.task.id &&
                 evidence.criterionId === criterion.id && evidence.configHash === configHash &&
-                evidence.sourceFingerprint === sourceFingerprint && evidence.taskContractHash === contract &&
+                evidence.sourceFingerprint === sourceFingerprint && evidenceMatchesContract(evidence.taskContractHash, record.task) &&
                 evidence.acceptance?.criterionContractHash === criterionContractHash(criterion)) {
                 matching.push({ reference, evidence });
             }

package/dist/runtime/src/verify/acceptance-protocol.js

@@ -167,9 +167,10 @@ export function aggregateAcceptanceRun(run, requestedCheckIds) {
     const duplicateCheckIds = sortedUnique([...counts.entries()].filter(([, count]) => count > 1).map(([id]) => id));
     const unexpectedCheckIds = sortedUnique(run.results.filter((result) => !expected.has(result.checkId)).map((result) => result.checkId));
     const missingCheckIds = requested.filter((id) => !counts.has(id));
-    if (duplicateCheckIds.length > 0 || unexpectedCheckIds.length > 0 || missingCheckIds.length > 0) {
-        return unknown(run, run.results, duplicateCheckIds.length > 0 ? ACCEPTANCE_FAILURE.duplicate :
-            missingCheckIds.length > 0 ? ACCEPTANCE_FAILURE.missing : ACCEPTANCE_FAILURE.unexpected, ["The observed checks do not match the requested checks exactly."], missingCheckIds, duplicateCheckIds, unexpectedCheckIds);
+    // Checks the runner emits beyond the requested ones are ignored: a binding may list only its red checks.
+    // An unrequested failure still surfaces through the runner's exit code, which replay reconciles.
+    if (duplicateCheckIds.length > 0 || missingCheckIds.length > 0) {
+        return unknown(run, run.results, duplicateCheckIds.length > 0 ? ACCEPTANCE_FAILURE.duplicate : ACCEPTANCE_FAILURE.missing, ["The observed checks do not include every requested check exactly once."], missingCheckIds, duplicateCheckIds, unexpectedCheckIds);
     }
     const requestedResults = requested.map((id) => run.results.find((result) => result.checkId === id));
     if (run.diagnostics.length > 0) {

package/dist/runtime/src/verify/acceptance-replay.js

@@ -8,7 +8,7 @@ import { canonicalJson } from "../config/hash.js";
 import { sha256 } from "../fs/hash.js";
 import { removeTemporary } from "../fs/temporary.js";
 import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
-import { criterionContractHash, taskContractHash } from "../task/contract.js";
+import { criterionContractHash, executionContractHash } from "../task/contract.js";
 import { aggregateAcceptanceRun, makeAcceptanceCheck, makeAcceptanceRun } from "./acceptance-protocol.js";
 import { collectNodeAcceptance, collectJestAcceptance, collectVitestAcceptance, collectPytestAcceptance, collectRustAcceptance } from "./adapters/index.js";
 import { buildVerificationEvidence } from "./evidence.js";
@@ -118,12 +118,9 @@ export async function replayAcceptance(options) {
             const env = replayEnvironment(checkout, phase, executionId);
             let timedOut;
             const command = async (executable, args, cwd, stage, own) => {
-                const remaining = await options.remainingMs?.();
-                if (remaining === 0)
-                    throw new AgentOpsError("TASK_DEBUG_BUDGET_EXHAUSTED", "The original issue's active budget is exhausted.");
                 const limit = own ?? ACCEPTANCE_TIMEOUTS[stage];
                 const result = await runVerificationCommand({ id: group.runner.id, command: executable, args: [...args], cwd: ".", required: true,
-                    evidence: { kind: "exit-code" }, timeoutMs: Math.min(limit, remaining ?? Infinity) }, { cwd, runner: options.processRunner, env, replaceEnv: true,
+                    evidence: { kind: "exit-code" }, timeoutMs: limit }, { cwd, runner: options.processRunner, env, replaceEnv: true,
                     outputLimitBytes: 1024 * 1024, ...(options.signal === undefined ? {} : { signal: options.signal }) });
                 if (result.failureClass === "timeout" && timedOut === undefined)
                     timedOut = stage === "git"
@@ -217,7 +214,7 @@ export async function replayAcceptance(options) {
                 failure = aggregate?.failureClass ?? output.failureClass;
             }
             catch (error) {
-                failure = error instanceof AgentOpsError && error.code === "TASK_DEBUG_BUDGET_EXHAUSTED" ? "debug-budget-exhausted" : error instanceof Error && /^[a-z-]+$/u.test(error.message) ? error.message : "replay-unavailable";
+                failure = error instanceof Error && /^[a-z-]+$/u.test(error.message) ? error.message : "replay-unavailable";
             }
             finally {
                 await removeTemporary(temp);
@@ -245,7 +242,7 @@ export async function replayAcceptance(options) {
                     scope: options.scope, startedAt, finishedAt, exitCode: output?.exitCode ?? null, testCount: checks.length,
                     status, failureClass: status === "PASS" ? "none" : phase === "baseline" && aggregate?.status === "PASS" ? "non-discriminating" : failure,
                     sourceFingerprint: options.sourceFingerprint, toolVersions: { node: process.version }, config: options.config,
-                    taskContractHash: taskContractHash(options.task), acceptance: { criterionContractHash: criterionContractHash(criterion),
+                    taskContractHash: executionContractHash(options.task), acceptance: { criterionContractHash: criterionContractHash(criterion),
                         bindingHash: sha256(canonicalJson({ runnerId: group.runner.id, materials: group.binding.materials })), phase, commit, pairedCommit: phase === "baseline" ? candidate : group.baseline, materialDigest, executionDigest, executionArtifact, checks } });
                 const reference = await options.evidenceStore.save(evidence);
                 reports.push({ criterionId: criterion.id, runnerId: group.runner.id, phase, status, failureClass: evidence.failureClass, reference,