@kylecheng3146/agent-ops 0.10.2 → 0.11.0

package/dist/runtime/src/verify/service.js

@@ -1,4 +1,4 @@
-import { taskContractHash } from "../task/contract.js";
+import { executionContractHash, taskContractHash } from "../task/contract.js";
 import { replayAcceptance } from "./acceptance-replay.js";
 import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
 import { validateTaskAgainstConfig } from "../schema/validate.js";
@@ -61,7 +61,9 @@ export class VerificationService {
                 failureClass: result.failureClass,
                 sourceFingerprint,
                 toolVersions: this.#options.toolVersions ?? {},
-                ...(task.goal === undefined && (task.contractRevision ?? 0) === 0 && task.criteria.every(c => c.acceptance === undefined) ? {} : { taskContractHash: taskContractHash(task) }),
+                // Surfaced tasks are always bound, so a later surface-only revision of a goal-less one keeps it; legacy tasks stay unbound.
+                ...(task.goal === undefined && (task.contractRevision ?? 0) === 0 && task.criteria.every(c => c.acceptance === undefined) &&
+                    task.surfaceRequired === undefined ? {} : { taskContractHash: executionContractHash(task) }),
                 config: this.#options.config
             });
             references.push(await this.#options.evidenceStore.save(evidence));
@@ -70,10 +72,7 @@ export class VerificationService {
     }
     async #runCommand(task, command) {
         const startedAt = (this.#options.now ?? (() => new Date().toISOString()))();
-        const remaining = task.debug === undefined ? undefined : await this.#options.taskService.debugService().remaining(task.id);
-        if (remaining === 0)
-            throw verificationError("TASK_DEBUG_BUDGET_EXHAUSTED", "The original issue's active budget is exhausted.");
-        const result = await executeConfiguredCommand(remaining === undefined ? command : { ...command, timeoutMs: Math.min(command.timeoutMs ?? 300_000, remaining) }, {
+        const result = await executeConfiguredCommand(command, {
             cwd: await this.#commandCwd(command),
             runner: this.#options.processRunner,
             trusted: this.#options.trusted
@@ -110,11 +109,6 @@ export class VerificationService {
         };
     }
     async verify(taskId) {
-        const stored = await this.#options.taskService.status({ taskId });
-        return stored.task.debug === undefined ? await this.#verify(taskId) :
-            await this.#options.taskService.debugService().verification(taskId, () => this.#verify(taskId));
-    }
-    async #verify(taskId) {
         const stored = await this.#options.taskService.status({ taskId });
         if (stored.status === "archived") {
             throw verificationError("TASK_NOT_ACTIVE", "An archived task cannot be verified.");
@@ -153,8 +147,7 @@ export class VerificationService {
             results.push(await this.#runCommand(validation.value, commandById(this.#options.config, commandId)));
         }
         const acceptance = validation.value.criteria.some(c => c.acceptance !== undefined && c.acceptance.mode !== "review-only")
-            ? await replayAcceptance({ ...this.#options, task: validation.value, sourceFingerprint,
-                ...(stored.task.debug === undefined ? {} : { remainingMs: () => this.#options.taskService.debugService().remaining(taskId) }) }) : [];
+            ? await replayAcceptance({ ...this.#options, task: validation.value, sourceFingerprint }) : [];
         let status = aggregateVerificationStatus([...results, ...acceptance.map(a => ({ required: true, status: a.status }))]);
         let sourceChanged = false;
         const postflightScope = await resolveReviewScope({
@@ -197,16 +190,6 @@ export class VerificationService {
             }
         }
         else {
-            if (stored.task.debug !== undefined && !sourceChanged) {
-                const failures = {};
-                for (const result of results) {
-                    const references = await this.#persistEvidence(validation.value, commandById(this.#options.config, result.commandId), result.startedAt, result.finishedAt, result, sourceFingerprint);
-                    relevantCriteria(validation.value, result.commandId).forEach((criterion, index) => { const reference = references[index]; if (reference !== undefined)
-                        failures[criterion.id] = [...(failures[criterion.id] ?? []), reference]; });
-                }
-                if (Object.keys(failures).length > 0)
-                    await this.#options.taskService.recordEvidence(taskId, failures);
-            }
             const required = [...results.filter((result) => result.required), ...acceptance.map(a => ({ commandId: a.runnerId, required: true,
                     status: a.status, failureClass: a.failureClass, exitCode: null, timedOut: false, testCount: null,
                     diagnostic: a.criterionId + ":" + a.phase + ":" + a.failureClass, evidenceReferences: [a.reference], startedAt: "", finishedAt: "" }))];

package/dist/runtime/src/verify/source-fingerprint.js

@@ -3,17 +3,30 @@ import { join } from "node:path";
 import { sha256 } from "../fs/hash.js";
 import { AgentOpsError } from "../fs/paths.js";
 import { resolveGitCommit } from "./change-surface.js";
+/**
+ * Escape-ledger records are committed after the fix; a commit touching only them leaves the base-mode fingerprint alone.
+ * Only top-level task records qualify: rules/ steer the surface gate and stay fingerprinted.
+ */
+const ledgerRecord = (path) => /^\.agent-ops-escapes\/task-[A-Za-z0-9-]+\.json$/u.test(path);
+/** HEAD's tree without the ledger, so a ledger-only commit yields the same digest. */
+async function ledgerFreeTree(runner) {
+    const result = await runner.run(["ls-tree", "-r", "--full-tree", "-z", "HEAD"]);
+    if (result.exitCode !== 0)
+        throw new AgentOpsError("CHANGE_SURFACE_GIT_FAILED", "Git could not list the HEAD tree.");
+    const entries = Buffer.from(result.stdout).toString("utf8").split("\0").filter(entry => entry !== "" && !ledgerRecord(entry.split("\t", 2)[1]));
+    return sha256(entries.join("\0"));
+}
 export async function calculateSourceFingerprint(root, scope, runner) {
-    const head = await resolveGitCommit(runner, "HEAD");
     if (scope.mode === "base") {
         return sha256(JSON.stringify({
-            domain: "agent-ops-source-v1",
+            domain: "agent-ops-source-v2",
             mode: scope.noChange === true ? "goal-no-change" : "base",
-            head,
+            tree: await ledgerFreeTree(runner),
             base: scope.resolvedBase,
-            paths: [...scope.changedFiles]
+            paths: scope.changedFiles.filter(path => !ledgerRecord(path))
         }));
     }
+    const head = await resolveGitCommit(runner, "HEAD");
     const paths = [];
     for (const path of scope.changedFiles) {
         const absolute = join(root, ...path.split("/"));

package/docs/en/guides/task-debug.md

@@ -1,135 +1,41 @@
 # Task DEBUG investigations
 
-Project `init` and `update` add `features.debug` by default:
-`{"enabled":true,"budgetMs":3600000,"maxRounds":5}` (sixty minutes). Explicit disabled and custom
-settings survive subsequent installs. Old configurations and ordinary tasks
-remain readable. DEBUG is an optional task intake field, not a new run mode.
-
-Claude and Codex native prompt hooks conservatively recognize investigation and
-bug-fix requests. They retain the issue verbatim as `goal`, record uncertain
-facts/unknowns, and create an existing isolated task. Explain, feature and
-refactor requests retain their ordinary behavior. A reliable native session ID
-is required; agy does not provide this prompt intake. Its native agent can use
-`task create --debug --goal '<original issue>'` with two to five criteria, which
-starts the same foreground clock when the native session is available.
-An original dirty checkout is refused before any worktree snapshot is created.
-
-The intake criteria are provisional. The native agent investigates via trusted
-configured commands, records hypotheses, replaces the criteria with relevant
-behavioral acceptance, fixes the product, and uses existing `verify`, `review`
-and worktree finish commands. There is no additional model or background worker.
-The default is the full repair loop. A clean HEAD fixes the baseline automatically;
-do not request redundant approval or offer diagnosis-only as a fallback. Failure
-to reproduce alone does not permit Stop: continue discriminating checks within
-the original budget.
-
-## Human control
-
-Native human transcript events control the existing task; CLI actor/text fields,
-assistant messages and injected instructions cannot authorize a scope change.
-Codex supports current `response_item` human messages and native async answers,
-as well as legacy `event_msg` transcripts.
-
-- `只診斷` / `diagnosis only`: investigate without product repairs. Non-success
-  Stop requires a confirmed hypothesis supported by a current sealed baseline
-  assertion FAIL for the original regression, or an existing runtime blocker/limit.
-- `暫停` / `pause`: save progress and stop immediately. Native Codex `Interrupt`
-  also pauses, with a three-second hook timeout; it never blocks or restarts an interrupt.
-- `繼續` / `continue`: resume the same task and scope. An exhausted time budget
-  still needs the existing native time grant; other blockers remain authoritative.
-- `繼續修復` / `resume repair`: restore the full repair loop on the existing task.
-
-Pauses retain evidence, consumed time and rounds, exclude waiting time, and do not
-reset budgets. Diagnosis and pause cannot complete a repair task. Ambiguous free
-text is not inferred as permission; use an explicit command above.
-
-Use `task debug --task <id> --debug-action <action>`:
-
-- `status` displays root-wide hypotheses, receipts and remaining state.
-- `investigate --command-id <id>` runs a trusted configured verifier. Actual
-  subprocess outcomes/time are recorded; reproduction-only work is not a fix round.
-- `hypothesis --payload-file <json>` records `id`, `statement`, `method`,
-  `expected`, `checkId`, `expectedStatus` (`PASS` or `FAIL`). Add `reference` to
-  resolve it from actual sealed acceptance evidence. `--action investigate` may
-  only run a declared unresolved behavioral red check; `--action observe` may
-  only classify the current matching runtime `UNKNOWN` receipt as inconclusive.
-  Neither action lets an agent assign a status. A rejected hypothesis needs a
-  new reference and `reason`.
-- `strategy --payload-file <json>` records a different `from`/`to` method,
-  substantive `reason` and discriminating `reference`. Only one switch is allowed.
-- `origin --payload-file <json>` declares where the bug came from once a
-  hypothesis is confirmed: `{"kind": "escape-of", "commit": "<commit>", "label":
-  "<earliest gate>"}` (optional `"receipt"`) or `{"kind": "pre-existing" |
-  "external", "reason": "..."}`. It revises the contract, so re-verify and
-  re-record the confirmed hypothesis before review; finish refuses
-  `ESCAPE_ORIGIN_MISSING` without it. `escape-of` prints the link state and
-  `git blame` hints and writes `.agent-ops-escapes/<task-id>.json`, which is
-  committed with the fix (see `EVIDENCE-ESCAPE-001`). A surface label also
-  needs a tracked `.agent-ops-escapes/rules/<rule-id>.json` rule that replays
-  at the escaped commit, and a criteria/verify label needs `"promote":
-  "<runnerId:checkId>"`; finish refuses `ESCAPE_RULE_UNPROVEN` otherwise (see
-  `EVIDENCE-ESCAPE-002`).
-- `checkpoint --session <id>` saves the current bound source/policy/stop cause.
-- `resume --session <id>` recovers a matching owned worktree checkpoint. Mismatches
-  require human confirmation and remain preserved; this command cannot waive them.
-- `extend --session <native-id> --event-id latest` reads the current native human
-  continue or resume-repair event. After time exhaustion it grants a full twenty
-  minutes from that event, retaining consumed time and overrun in the grant snapshot
-  without waiving any other blocker. No actor/text flag can
-  authorize a grant. Missing native transcripts fail closed as unsupported.
-
-Limits belong to the original root across revisions, children and sessions.
-Repeating an active issue's text from a new session reattaches that root (or
-resumes the worktree holding it) instead of starting a fresh budget. A
-resolved hypothesis cannot return under a new id with the same statement and
-method; reopen the original with new discriminating evidence.
-Controlled investigation, verification and acquired review execution consume
-active time; observable review-slot waiting is excluded. Claude, Codex, and agy
-use their native session lifecycle to account foreground reasoning, tool use,
-and edits. Accepted idle Stop closes the foreground clock. Rejected Codex Stop
-keeps the clock running, including repeated Stop (`stop_hook_active: true`). OpenCode has no supported
-foreground lifecycle and remains unsupported. Time between stopped turns is
-paused. An interrupted unsealed operation remains blocked until its persisted process
-identity proves death; only then is an UNKNOWN environment receipt sealed and
-the elapsed interval retained.
-
-Only changed product candidates followed by verification count toward repair
-rounds. Test/fixture edits do not. New paired original-regression outcomes or
-new discriminating hypothesis outcomes count as progress; renaming a task or
-hypothesis does not. Two stagnant rounds require the strategy switch; two more
-stop, subject to the global round/time ceilings.
-The switch may cite this issue's own sealed regression evidence from an earlier
-contract revision, because a scope revision stales current evidence while
-verification stays stopped; hypotheses and delivery still need fresh evidence.
-At the round limit an unchanged candidate may still be reviewed, and re-verified
-when its last verification passed; a failing or changed candidate stays stopped.
-
-Success requires baseline assertion red and candidate green for the original
-regression, required related checks, a supported confirmed hypothesis, and two
-fresh independent reviews bound to the current source, contract, config and
-meaningful DEBUG proof. Missing IDs, setup failure, skip, timeout and UNKNOWN
-never prove reproduction. Proof changes invalidate review. Completed tasks and
-worktree finish retain the existing attestation/integration requirements.
-
-On Claude, agy and native Codex, Stop checks an active DEBUG issue even without Git net diff,
-with or without the completion gate. Without the gate this check alone runs,
-with one targeted task/config reload on a gate fault. A second failure emits an
-explicit `UNKNOWN` / incomplete diagnostic with `agent-ops doctor` recovery,
-permits non-success Stop and preserves the task, evidence and budgets. It never
-attests completion or retries indefinitely.
-A valid runtime stop checkpoint permits non-success Stop while retaining the
-active task. `allow-stop` cannot waive DEBUG. Gates are never automatically
-enabled for unsupported hosts: the generic Codex completion gate remains
-unsupported, while its DEBUG-specific Stop uses native `decision: "block"`
-with a continuation reason. `continue: false` would stop the harness and is not
-used to continue DEBUG. OpenCode Stop is unsupported. This feature
-persists foreground progress, and does not promise
-execution after the native conversation closes. Native transcripts are trusted
-host evidence, not protection against an attacker with the same filesystem
-authority.
-
-An explicit native human `no time limit` / `取消時間限制` instruction removes the
-original issue time cap via the same native-only `extend --event-id latest`
-authority. The grant records `grantedMs: null` and the spent snapshot; original
-budget, consumption, prior grants, iteration limits and evidence gates remain.
-Ordinary command and review stall timeouts remain in force.
+A DEBUG task is an ordinary task whose acceptance proves the original
+regression: a behavioral criterion whose `redCheckIds` fail with an assertion at
+the baseline commit and pass on the candidate. Nothing else is special about it.
+
+```sh
+agent-ops task create --debug --title "Fix cart scroll" \
+  --goal '<the issue, verbatim>' \
+  --surface-file surface.json \
+  --criterion-file regression.json --criterion-file related.json
+```
+
+- `--debug` needs `--goal` and at least one behavioral criterion with
+  `redCheckIds`; otherwise creation fails with `TASK_DEBUG_RED_CHECK_REQUIRED`.
+  The surface audit is required as for any task.
+- The baseline is the commit the task was created on; `task revise --baseline
+  <ref>` moves it (for example off the wrong branch) and voids earlier evidence.
+- Then fix, commit, `verify`, two-round `review` and `worktree finish` exactly
+  as for any task. Setup failure, skip, timeout and UNKNOWN never prove
+  reproduction; the red check must fail on an assertion at the baseline.
+
+## Escape origin (advisory)
+
+If you know where the bug came from, record it like any task:
+`task revise --escape-of <commit> --escape-label <label>`. It writes `.agent-ops-escapes/<task-id>.json` and
+prints the link state, `git blame` hints and any rule proof
+(`ESCAPE_RULE_UNPROVEN` and friends). None of it blocks finish; see
+`EVIDENCE-ESCAPE-001` and `EVIDENCE-ESCAPE-002`.
+
+## Removed in 0.11.0
+
+`task debug` (hypotheses, strategy switches, investigate, checkpoint, resume,
+extend, origin), the 60-minute budget and five-round limit, native control
+words (只診斷, 暫停, 繼續, 繼續修復, 取消時間限制), automatic DEBUG intake from
+prompt hooks, the DEBUG-specific Stop block and the Codex `Interrupt` hook are
+gone. `task debug` now fails with `TASK_DEBUG_REMOVED`.
+
+Older state still loads: tasks keep their `debug` tag, stored budget and
+hypothesis state is ignored, `originRequired` no longer blocks finish, and a
+config's `features.debug` is accepted and dropped by the next `update`.

package/docs/en/spec/acceptance-and-evidence.md

@@ -18,10 +18,11 @@ Executable acceptance MUST bind the current contract to immutable replay evidenc
   build and test build. Tasks provide stable check IDs and explicit committed
   test/fixture/helper materials. Each checkout installs and builds its own version
   before candidate materials are overlaid. Tasks cannot override runner commands.
-- A generic runner must emit exactly the union of `checkIds` requested by criteria
-  sharing its runner, baseline and materials; unexpected rows are UNKNOWN. If a
-  runner always emits its full suite, bind the full emitted set while keeping
-  `redCheckIds` limited to the actual regression assertions.
+- A generic runner must emit every `checkId` requested by criteria sharing its
+  runner, baseline and materials, each exactly once; missing or duplicate rows are
+  UNKNOWN. Other rows are ignored, so a binding may list only its red checks. A
+  failing unrequested row still disagrees with a PASS aggregate through the
+  runner's exit code, which makes the candidate UNKNOWN, never green.
 - Fixture, collection, build, timeout, cancellation, truncated output, missing or
   duplicate IDs, retries and skips MUST NOT establish red or green. Complete raw
   execution artifacts are digest-bound to the contract, materials and commits.
@@ -34,9 +35,15 @@ Executable acceptance MUST bind the current contract to immutable replay evidenc
   counters and cannot supply mechanical proof by itself. Pytest requires one
   ordered setup/call/teardown lifecycle per nodeid; the Rust protocol requires
   explicit attempts. Missing metadata MUST NOT default to a successful attempt.
-- Baselines are immutable creation commits, or failed candidates for finding pins.
-  Revise/replan preserve the original goal, every mapped requirement and previous
-  contracts/evidence. New contracts require new proof and both fresh reviews.
+- Baselines are creation commits, or failed candidates for finding pins.
+  `task revise --baseline <ref>` moves every typed criterion's baseline (and the
+  task's creation commit) at once to a commit that is an ancestor of HEAD, for example after a task was opened on the
+  wrong branch, and voids its verification. Revise/replan preserve the original
+  goal, every mapped requirement and previous contracts/evidence.
+- Verification evidence binds an execution hash of the criteria only. A revise
+  that changes the surface or origin keeps it; a criteria or configuration change
+  voids it. Evidence from before 0.11 bound the full contract hash and still
+  matches an unchanged contract. Every new contract needs both fresh reviews.
 - `task pin-finding` validates saved report digest/index provenance. Recurrence
   explicitly names an existing pin. A sixth criterion returns a replan obligation
   without changing state; the mapped replan must retain the pin and all requirements.
@@ -76,7 +83,7 @@ Each child worktree MUST record its modification intent before editing.
 
 Every new task MUST record a surface audit of where else its change lands before writing criteria, and review MUST NOT run while discovery finds an unclassified place.
 
-- Trigger: Creating a task (`task create`, a run plan, or before a DEBUG task's first repair), revising its surface, or reviewing it.
+- Trigger: Creating a task (`task create`, including `--debug`, or a run plan), revising its surface, or reviewing it.
 - Action: Search four axes with recorded fixed-string queries or `n/a: reason`, classify every hit as included, excluded (glob + reason) or UNKNOWN, give every surface row an observable `behavior`, and declare each shared contract compatible or breaking. Pass it with `task create|revise --surface-file <json>`.
 - Evidence: The surface is stored on the task, bound into its contract hash with revision history, replayed by `git grep -F` before review, and handed to both reviewers under the `surface-coverage` criterion.
 - Positive: `A diff token hits three copy-pasted sibling pages; the audit includes them with their behavior before review runs.`
@@ -118,8 +125,11 @@ Every new task MUST record a surface audit of where else its change lands before
   dismissals. Reviewers see each dismissal with its hit count, flagged when it
   hid a file an earlier `SURFACE_UNCLASSIFIED` block named.
   Results are cached by HEAD, base, diff, query set and config hash.
+- `verify` runs the same gate after verification and prints its result as
+  advisory lines (`Surface: PASS`, or the code and unclassified paths), so the
+  surface is fixed before review; only review enforces it.
 - Review returns NOT_RUN with: `SURFACE_MISSING` (no or unparseable surface;
-  also refused at create for non-DEBUG tasks), `SURFACE_UNCLASSIFIED`,
+  also refused at create), `SURFACE_UNCLASSIFIED`,
   `SURFACE_QUERY_TOO_BROAD` (one recorded query over 200 files),
   `SURFACE_EXCLUSION_TOO_BROAD` (one glob over 10 files, or any file in the
   diff), `SURFACE_DISMISSAL_TOO_BROAD` (over 128 dismissals),
@@ -137,17 +147,15 @@ Every new task MUST record a surface audit of where else its change lands before
 
 ## EVIDENCE-ESCAPE-001
 
-Every DEBUG fix MUST declare where its bug came from before review, and a declared escape MUST be linked, labelled and recorded mechanically.
+A bug fix SHOULD declare where its bug came from when known, and a declared escape MUST be linked, labelled and recorded mechanically. The declaration is advisory: it never blocks finish.
 
-- Trigger: A DEBUG hypothesis is confirmed, or a normal task fixes a bug that passed earlier gates.
-- Action: Declare `origin` with `task debug --debug-action origin --payload-file <json>`: `{"kind": "escape-of", "commit": "<commit>", "label": "<label>"}` (optional `"receipt"`), or `{"kind": "pre-existing" | "external", "reason": "..."}`. A normal task may opt in with `task create|revise --escape-of <commit> --escape-label <label> [--escape-receipt <id>]`. Commit the `.agent-ops-escapes/<task-id>.json` record with the fix.
-- Evidence: `origin` is bound into the task contract hash; finish, `task complete` and the completion gate refuse a DEBUG task created after this rule without it as `ESCAPE_ORIGIN_MISSING`; both reviewers receive the link state, labels, facts and residual risks under the `escape-label` criterion.
-- Positive: `Hypothesis confirmed; origin escape-of 864dbbe2 label surface; replay marks the missed page surface-unseen; the record is committed with the fix.`
-- Negative: `Finish a DEBUG fix without an origin, or relabel a surface-excluded miss as review because the reviewer "should have noticed".`
+- Trigger: A DEBUG task (`task create --debug`) or any task fixes a bug that passed earlier gates and its origin is known.
+- Action: Declare `origin` with `task create|revise --escape-of <commit> --escape-label <label> [--escape-receipt <id>]`, the same for DEBUG and normal tasks. `pre-existing` and `external` origins (with a `reason`) recorded by 0.10 `task debug` still load; an undeclared origin is counted as such. Commit the `.agent-ops-escapes/<task-id>.json` record with the fix.
+- Evidence: `origin` is bound into the task contract hash; both reviewers receive the link state, labels, facts and residual risks under the `escape-label` criterion. A task without an origin still finishes; 0.10 tasks marked `originRequired` are no longer refused (`ESCAPE_ORIGIN_MISSING` was removed in 0.11.0).
+- Positive: `Regression red at the baseline, green on the fix; origin escape-of 864dbbe2 label surface; replay marks the missed page surface-unseen; the record is committed with the fix.`
+- Negative: `Relabel a surface-excluded miss as review because the reviewer "should have noticed".`
 
-- The declaration comes after a confirmed hypothesis (`ESCAPE_ORIGIN_EARLY`
-  otherwise), inside the DEBUG budget. It is a contract revision: re-verify,
-  re-record the confirmed hypothesis with the new evidence, then review.
+- The declaration is a contract revision: re-verify, then review.
   Re-declaring replaces the record. The output lists `git blame` hint commits
   for lines the fix changed or removed; blame is a hint only, because an
   omission bug lives in lines nobody wrote.
@@ -181,13 +189,13 @@ Every DEBUG fix MUST declare where its bug came from before review, and a declar
 
 ## EVIDENCE-ESCAPE-002
 
-A surface escape MUST become a proven, tracked rule before its fix finishes, and learned rules MUST only tighten the surface gate.
+A surface escape SHOULD become a proven, tracked rule, and learned rules MUST only tighten the surface gate. The proof is advisory: it never blocks finish.
 
 - Trigger: A declared escape-of origin (EVIDENCE-ESCAPE-001), or a past escape backfilled with `task create --escape-of <commit> --escape-label <label> --escape-fix <fix-commit>`.
-- Action: For a `surface`, `surface-unseen` or `surface-excluded` label, commit a rule `.agent-ops-escapes/rules/<rule-id>.json` shaped `{"id", "escape", "label", "trigger": {"paths", "tokens"}, "expand": {"paths", "queries"}, "noExclude"}` and re-declare the origin. For `criteria` or `verify`, name the fixing task's red-to-green check with `--escape-promote <runnerId:checkId>` (DEBUG payload `"promote"`). Other labels record a lesson.
-- Evidence: Finish, `task complete` and the completion gate re-run the proof and refuse `ESCAPE_RULE_UNPROVEN`, `ESCAPE_RULE_TOO_BROAD` or `SURFACE_BUDGET_EXCEEDED`; the ledger record stores the proving rule, its content hash and its backtest fires, commits and rate.
+- Action: For a `surface`, `surface-unseen` or `surface-excluded` label, commit a rule `.agent-ops-escapes/rules/<rule-id>.json` shaped `{"id", "escape", "label", "trigger": {"paths", "tokens"}, "expand": {"paths", "queries"}, "noExclude"}` and re-declare the origin. For `criteria` or `verify`, name the fixing task's red-to-green check with `--escape-promote <runnerId:checkId>` (origin field `"promote"`). Other labels record a lesson.
+- Evidence: Declaring the origin runs the proof and prints `ESCAPE_RULE_UNPROVEN`, `ESCAPE_RULE_TOO_BROAD` or `SURFACE_BUDGET_EXCEEDED` when it fails; since 0.11.0 finish no longer refuses them. The ledger record stores the proving rule, its content hash and its backtest fires, commits and rate.
 - Positive: `Escape surface-unseen; rule image-size-siblings fires on the escaped commit, its query hits both missed sibling pages there, and fires on 2 of the last 200 commits.`
-- Negative: `Finish a surface escape whose rule never fires on the escaped commit, or add a rule field that excludes paths.`
+- Negative: `Report a surface escape as proven when its rule never fires on the escaped commit, or add a rule field that excludes paths.`
 
 - Rules are data only and need no trust: triggers and expands become argv
   `git grep -F` queries and path globs, never shell or regex. The strict schema
@@ -257,7 +265,7 @@ New verification evidence uses schema 3. Schema 2 remains readable and its exit-
 
 Existing task files remain readable without migration. Legacy tasks without a config baseline, arbitrary evidence references, or unfinished archived children must be recreated and verified/reviewed before completion. Repeating completion also revalidates the evidence; an old completed status alone is insufficient. Runtime callers must supply `TaskServiceOptions.completion`; omitting this repository context fails closed for completion while leaving read-only task operations available.
 
-Before committing, use the default worktree scope for verify, review and completion. After committing, use the same `--base <git-ref>` on all three commands to produce fresh proof for that committed range; `TaskServiceOptions.completion.base` selects it for runtime callers. Base mode requires a clean worktree. Without a worktree change surface or an explicit base, completion returns `TASK_COMPLETION_SCOPE_REQUIRED`. The agy Stop gate still checks worktree-scoped proof: complete and stop before committing, or use its user-approved one-time permit after inspecting a completed base-scoped task.
+Before committing, use the default worktree scope for verify, review and completion. After committing, use the same `--base <git-ref>` on all three commands to produce fresh proof for that committed range. When `--base` is absent and the tree is clean, verify and review choose it: a session worktree uses its merge-base with the target branch (which follows a finish rebase), elsewhere the task's creation commit when it is an ancestor of HEAD. Base-mode source fingerprints ignore escape-ledger task records (`.agent-ops-escapes/task-*.json`; rules stay fingerprinted), so committing the ledger keeps verification and review current; fingerprints from 0.10 differ, so re-verify once after upgrading; `TaskServiceOptions.completion.base` selects it for runtime callers. Base mode requires a clean worktree. Without a worktree change surface or an explicit base, completion returns `TASK_COMPLETION_SCOPE_REQUIRED`. The agy Stop gate still checks worktree-scoped proof: complete and stop before committing, or use its user-approved one-time permit after inspecting a completed base-scoped task.
 
 This enforces the toolkit's completion command, not a host's natural-language completion claim. It does not prevent a process with the same filesystem authority from editing task/evidence files directly, and it does not lock Git or external source writers.
 

package/docs/en/spec/harness-adapters.md

@@ -118,17 +118,12 @@ installed configuration; the managed OpenCode `tool.execute.before` plugin can
 throw its documented denial or unavailable-runtime error for its supported Bash
 surface. Codex remains `unknown` and never emits a denial. Fixture tests assert
 these wire and plugin shapes only; they do not prove that a host honors a
-denial. `SessionStart` and ordinary `Stop` failures remain fail-open. Active
-DEBUG Stop faults instead retry one targeted reload, then explicitly report
-UNKNOWN/incomplete and preserve the original state before non-success Stop.
-
-Codex DEBUG lifecycle semantics were rechecked on 2026-10-11 against the
-[official hooks reference](https://learn.chatgpt.com/docs/hooks#stop): Stop
-`decision: "block"` with `reason` schedules a continuation; `continue: false`
-halts it. `stop_hook_active` identifies a prior continuation and cannot waive
-the DEBUG check. Native `Interrupt` pauses with a three-second timeout and
-never blocks or restarts the human interruption. This DEBUG-specific policy
-does not enable Codex's generic completion gate or optional Stop verifier.
+denial. `SessionStart` and `Stop` failures remain fail-open.
+
+Since 0.11.0 no hook is DEBUG-specific: prompts never open DEBUG tasks, Stop
+never holds a session for one, and Codex `Interrupt` is no longer registered
+(a stale registration from an older install is a no-op until `update`). Codex
+still has no generic completion gate or optional Stop verifier.
 Codex separately trusts each exact native hook definition. After managed hook
 updates, review new or changed definitions in `/hooks`; agent-ops repository
 trust alone does not make an unreviewed native hook active.
@@ -197,6 +192,9 @@ removes only `run` and keeps `loop`.
 resumability and concrete remediation. An unchanged cleanup failure retains its
 original cause. Trust, native identity, generation and denial failures remain
 fail-closed; a sealed proof never erases a native or organization denial.
+The JSON `state` of `run status` and `run logs` omits the event history and goal
+text, keeping `eventCount` and `goalHash`, so repeated polling stays small;
+`run logs` returns the events themselves.
 
 Manual resume of a receipt-bound integration validates the exact sealed proof,
 receipt digest and transaction, owner/generation, candidate/target ancestry and

package/docs/en/spec/loop-engineering.md

@@ -18,7 +18,7 @@
   still measure setup, proof, review and integration. Legacy finite runs upgrade
   only on manual resume, retaining the old limit, intervals, elapsed time, usage
   epochs and blocker history. Reads and installation never upgrade or awaken runs.
-  Command/review timeouts, provider quotas, DEBUG budgets and no-progress/stop
+  Command/review timeouts, provider quotas and no-progress/stop
   controls remain independent and effective. Explicit --time-budget is rejected.
   Missing counters remain UNKNOWN; partial usage is not a complete cost estimate.
 - Questions pause work and require an explicit answer. Repair preserves the goal
@@ -72,10 +72,16 @@
 - Convergence compares actual per-check statuses and outstanding finding pins.
   Source fingerprints, timing and diagnostics alone cannot establish progress.
 
-With `jobs=1`, child execution MUST wait for confirmed coordinator process death.
-The coordinator retains its task and native session identity, and resumes under a
-new generation after child deliveries. Native registration, recovery and start
-MUST enforce at most one active agent; changing task slot accounting alone is insufficient.
+For any `jobs` value, the coordinator MUST yield only through an explicit
+`action=wait` request sent after it has planned its children; the supervisor
+never stops a coordinator that is still planning. A wait confirms coordinator
+process death, frees its slot and drops its native thread, so the coordinator does
+not poll `run status` while children work. Recovery leaves a waiting coordinator
+stopped; once every child is delivered, complete or blocked, it restarts under a
+new generation in a fresh native session whose instructions list each child's
+status and delivered commit. With `jobs=1`, child execution MUST wait for that
+confirmed death. Native registration, recovery and start MUST enforce at most
+`jobs` active agents; changing task slot accounting alone is insufficient.
 
 This module defines the bounded loop used to plan, implement, verify, and hand off work.
 

package/docs/zh-TW/guides/task-debug.md

@@ -1,83 +1,37 @@
 # Task DEBUG 調查
 
-`init` / `update` 預設加入 `features.debug`：啟用、60 分鐘、5 輪。
-之後保留明確關閉與自訂設定；舊設定和一般 task 保持相容。
+DEBUG task 就是一般 task，只是驗收條件要證明原始回歸：一條 behavioral criterion，
+其 `redCheckIds` 在 baseline commit 以 assertion 失敗、在 candidate 通過。除此之外沒有任何特殊流程。
 
-Claude / Codex prompt hook 會保守辨識調查與修復問題，保留原始 `goal`，
-建立既有隔離 task。說明、功能與重構請求照原流程。
-缺少可靠 session ID，或 agy 沒有 prompt 事件時，使用原生 Agent 執行
-`task create --debug --goal '<原始問題>'`；只要有 native session，CLI intake
-會啟動同一個前景時鐘。原始 dirty checkout 不會被自動複製。
+```sh
+agent-ops task create --debug --title "修購物車無法捲動" \
+  --goal '<原始問題，逐字>' \
+  --surface-file surface.json \
+  --criterion-file regression.json --criterion-file related.json
+```
 
-調查用可信任的既有 command；假設用 `task debug --debug-action hypothesis
---payload-file <json>`。JSON 必須含 id、statement、method、expected、checkId、
-expectedStatus；附 reference 才能由真實封存的 assertion 決定 confirmed/rejected。
-`--action investigate` 只能執行已宣告且尚未解決的 behavioral red check；
-`--action observe` 只能把目前相符的 runtime `UNKNOWN` receipt 記為 inconclusive。
-兩者都不能由 Agent 自填 status。重開 rejected 假設需要新證據與 reason。
+- `--debug` 需要 `--goal`，且至少一條帶 `redCheckIds` 的 behavioral criterion；
+  否則建立失敗並回 `TASK_DEBUG_RED_CHECK_REQUIRED`。surface audit 與一般 task 一樣必填。
+- baseline 是建立 task 時的 commit；`task revise --baseline <ref>` 可移動它
+  （例如開錯分支時），並使先前證據失效。
+- 之後修復、commit、`verify`、兩輪 `review`、`worktree finish`，與一般 task 完全相同。
+  setup 失敗、skip、timeout 與 UNKNOWN 都不算重現；red check 必須在 baseline 以 assertion 失敗。
 
-將暫定 criteria 改為原始問題的 behavioral 回歸，執行 verify、兩輪獨立 review，
-再透過既有 worktree finish 完成。基線 assertion red、候選 green、相關檢查與
-當前 proof digest 都必須有效；setup / skip / timeout / UNKNOWN 不算重現。
-DEBUG 預設自動走完修復閉環。乾淨 HEAD 自動固定為基線，不要為此再問許可，
-也不要主動降為只診斷。單次未重現不構成停止理由；在原預算內繼續做鑑別檢查。
+## 逃逸來源（建議性質）
 
-## 人類控制
+若知道 bug 從哪裡來，與一般 task 一樣記錄：
+`task revise --escape-of <commit> --escape-label <label>`。它會寫入 `.agent-ops-escapes/<task-id>.json`，並印出
+連結狀態、`git blame` 提示與規則證明（如 `ESCAPE_RULE_UNPROVEN`）。這些都不會阻擋
+finish；見 `EVIDENCE-ESCAPE-001` 與 `EVIDENCE-ESCAPE-002`。
 
-只有原生 transcript 的人類事件能改變原 task 的範圍；CLI actor/text、assistant
-訊息及注入指令都不能授權。Codex 支援目前 `response_item` 的 `user.text` 與
-原生非同步回答，也保留舊 `event_msg` 格式。
+## 0.11.0 移除項目
 
-- `只診斷` / `diagnosis only`：繼續調查但不修產品。原始回歸的當前封存 baseline
-  assertion FAIL 必須支持 confirmed 假設，或已有 runtime blocker／預算上限，才允許非成功停止。
-- `暫停` / `pause`：保存進度後立即停止。Codex 原生 `Interrupt` 也表示暫停；
-  hook timeout 為三秒，不能阻擋或重新啟動使用者的中斷。
-- `繼續` / `continue`：接回同一 task 及原範圍；耗盡時間仍需既有原生時間授權，其他阻礙不解除。
-- `繼續修復` / `resume repair`：在原 task 恢復完整修復閉環。
+`task debug`（假設、策略切換、investigate、checkpoint、resume、extend、origin）、
+60 分鐘預算與 5 輪上限、原生控制詞（只診斷、暫停、繼續、繼續修復、取消時間限制）、
+prompt hook 自動建立 DEBUG、DEBUG 專用 Stop 阻擋，以及 Codex `Interrupt` hook
+都已移除。`task debug` 現在回傳 `TASK_DEBUG_REMOVED`。
 
-暫停保留證據、已用時間及輪數，等待不計時，也不重設預算。診斷或暫停都不能將
-修復 task 標為完成；模糊文字不推測為授權，請使用上述明確指令。
+舊狀態仍可讀取：task 保留 `debug` 標記，已存的預算與假設狀態會被忽略，
+`originRequired` 不再阻擋 finish，config 的 `features.debug` 仍被接受並在下次 `update` 時移除。
 
-預算與輪數屬於整個原始 root，revision、child、session 不重設。新 session 重送同一個 active issue 文字時，會接回原本的 root（或 resume 持有它的 worktree），不會另開新預算。已確認或已否決的假設不能換 id、用相同陳述與方法重開；請帶新的鑑別證據重開原假設。
-受控調查、驗證與取得 slot 後的 review 計時；review 排隊不計時。
-Claude、Codex 與 agy 都使用可信 native session lifecycle，在 `UserPromptSubmit`
-或原生 session 開始前景時鐘，並在 idle `Stop` 結束。因此該輪的 Agent 推理、
-工具與修改都計入，停止回合之間的使用者等待不計入。Codex 被拒絕的 Stop 仍繼續
-計時，重複 Stop 的 `stop_hook_active: true` 不會繞過 DEBUG gate。opencode 沒有支援
-的前景 lifecycle，不可宣稱完整的 active-time 預算。
-中斷且沒有封存結果的操作，必須等持久化 process identity 證實程序已死亡後，
-才封存 UNKNOWN environment receipt；這段經過時間仍會保留，不會退還不明時間。
-測試材料修改不算修復輪；兩輪停滯需要一次實質策略切換，再兩輪停滯停止。
-範圍改版會讓現有證據失效、而驗證在登記策略切換前仍停止，因此策略切換可引用同一原始任務已封存的歷史回歸證據；假設確認與最終交付仍需新版契約的新證據。
-達到回合上限後，未變更的候選仍可審查；上次驗證通過時也可重新驗證（例如只更新 escape ledger），不計為新回合。驗證失敗或產品內容變更的候選仍維持停止。
-
-假設確認後以 `origin --payload-file <json>` 宣告 bug 來源：`{"kind": "escape-of",
-"commit": "<commit>", "label": "<最早關卡>"}`（可選 `"receipt"`），或 `{"kind":
-"pre-existing" | "external", "reason": "..."}`。它會修訂 contract，因此 review 前要重新
-verify 並重新記錄已確認的假設；沒有它時 finish 以 `ESCAPE_ORIGIN_MISSING` 拒絕。
-`escape-of` 會印出連結狀態與 `git blame` 提示，並寫入 `.agent-ops-escapes/<task-id>.json`，
-與修復一起 commit（見 `EVIDENCE-ESCAPE-001`）。surface 標記還需要一條在被逃逸 commit
-重放成立、受追蹤的 `.agent-ops-escapes/rules/<rule-id>.json` 規則；criteria/verify 標記需要
-`"promote": "<runnerId:checkId>"`；否則 finish 以 `ESCAPE_RULE_UNPROVEN` 拒絕（見
-`EVIDENCE-ESCAPE-002`）。
-
-checkpoint 保存 task/session/source/contract/config/cause；resume 只接受同一
-擁有者 worktree 的匹配 checkpoint，保留 dirty 內容及預算。失配需要人類確認。
-時間耗盡後明確「繼續」或「繼續修復」可透過 `extend --event-id latest` 讀取原生人類事件，
-從該事件取得完整 20 分鐘，並以 grant 快照保留既有消耗與超時；沒有可信事件來源則回報 unsupported，其他阻礙不被解除。
-
-Claude / agy / 原生 Codex 的 Stop 都會檢查無 Git 差異的 active DEBUG task，不論是否安裝 completion gate。
-DEBUG gate 故障先針對 task/config 重新載入一次；仍失敗則明確回報 `UNKNOWN／未完成`
-與 `agent-ops doctor` 恢復方法，允許非成功停止並保留 task、證據及預算，不無限重試。
-有效停止 checkpoint 只允許非成功停止，task 仍 active；allow-stop 不能繞過。
-Codex 的一般 completion gate 仍 unsupported；DEBUG 專用 Stop 以原生
-`decision: "block"` 與 reason 續跑，不能使用會停止 harness 的 `continue: false`。
-已接受的 Stop 結束前景時鐘；opencode Stop unsupported。
-只承諾前景對話與持久化進度，不承諾對話關閉後繼續，也不宣稱抵擋同檔案權限攻擊。
-
-完整命令及細節見英文 [Task DEBUG](../../en/guides/task-debug.md)。
-
-原生人類明確要求「取消時間限制」或 `no time limit` 時，可透過同一個
-`extend --event-id latest` 原生授權入口取消原任務總時限。grant 記錄
-`grantedMs: null` 與已用時間快照；原預算、消耗、舊 grant、回合限制及
-驗證與 review 關卡均保留。個別命令與 review 的防卡死逾時仍有效。
+完整說明見英文 [Task DEBUG](../../en/guides/task-debug.md)。