@kylecheng3146/agent-ops 0.10.2 → 0.11.1

package/README.md

@@ -12,6 +12,19 @@ pre-1.0 interface.
 The CLI is published as `@kylecheng3146/agent-ops` as a pre-1.0 interface;
 command behavior may change before 1.0.
 
+## Criteria advisory before implementation
+
+Every new task, including DEBUG and native run parent/child tasks, waits for one
+independent advisory review of its goal, criteria and assigned surface before
+implementation. Read the suggestions, decide which to adopt, and record reasons
+through `task revise`. Revisions do not automatically re-review.
+
+The advisory has no time/token budget; explicit cancellation stops work. Genuine
+execution errors report NOT_RUN and allow work. Detailed reports remain private;
+`task status` shows their snapshot and whether they are historical. Explicitly
+rerun with `agent-ops review --criteria --task <id> --rerun --yes`.
+Final verification, two-round review and finish remain required.
+
 ## Executable acceptance and native goal runs (0.6.0)
 
 Criteria can use `behavioral`, `invariant` or `review-only` acceptance contracts.

package/dist/packages/cli/src/args.js

@@ -66,6 +66,10 @@ function parseHookTarget(option, value) {
 export function parseArgs(argv) {
     if (argv[0] === "run")
         return parseRunArgs(argv.slice(1));
+    if (argv[0] === "task" && argv[1] === "debug")
+        throw new CliArgumentError("TASK_DEBUG_REMOVED", "task debug was removed in 0.11.0. A DEBUG task is task create --debug with a behavioral " +
+            "criterion whose redCheckIds fail at the baseline and pass on the candidate; then verify, review and finish as usual. " +
+            "Declare an escape origin, if known, with task revise --escape-of.");
     let command;
     let action;
     let scope;
@@ -78,10 +82,6 @@ export function parseArgs(argv) {
     let intent;
     let taskGoal;
     let debug = false;
-    let debugAction;
-    let payloadFile;
-    let commandId;
-    let eventId;
     let sessionId;
     let base;
     let parentBase;
@@ -113,6 +113,7 @@ export function parseArgs(argv) {
     let json = false;
     let yes = false;
     let rerun = false;
+    let criteriaReview = false;
     let tree = false;
     let helpSeen = false;
     let versionSeen = false;
@@ -233,30 +234,6 @@ export function parseArgs(argv) {
                     duplicate(token);
                 debug = true;
                 break;
-            case "--debug-action": {
-                if (debugAction !== undefined)
-                    duplicate(token);
-                const value = readOptionValue(argv, index++, token);
-                if (!["status", "hypothesis", "strategy", "investigate", "checkpoint", "resume", "extend", "origin"].includes(value))
-                    invalidValue(token, value);
-                debugAction = value;
-                break;
-            }
-            case "--payload-file":
-                if (payloadFile !== undefined)
-                    duplicate(token);
-                payloadFile = readOptionValue(argv, index++, token);
-                break;
-            case "--command-id":
-                if (commandId !== undefined)
-                    duplicate(token);
-                commandId = readOptionValue(argv, index++, token);
-                break;
-            case "--event-id":
-                if (eventId !== undefined)
-                    duplicate(token);
-                eventId = readOptionValue(argv, index++, token);
-                break;
             case "--tree": {
                 if (tree)
                     duplicate(token);
@@ -485,6 +462,11 @@ export function parseArgs(argv) {
                 index += 1;
                 break;
             }
+            case "--criteria":
+                if (criteriaReview)
+                    throw new CliArgumentError("CLI_DUPLICATE_OPTION", "--criteria may appear only once.");
+                criteriaReview = true;
+                break;
             case "--rerun":
                 if (rerun) {
                     duplicate(token);
@@ -530,7 +512,7 @@ export function parseArgs(argv) {
                         "complete",
                         "create",
                         "export",
-                        "status", "revise", "replan", "pin-finding", "debug"
+                        "status", "revise", "replan", "pin-finding"
                     ].includes(token)) {
                     action = token;
                     break;
@@ -674,8 +656,8 @@ export function parseArgs(argv) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--target-version may be used only with update.");
     }
     if (base !== undefined && command !== "verify" && command !== "review" &&
-        command !== "batch" && !(command === "task" && (action === "complete" || action === "debug"))) {
-        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--base may be used only with verify, review, batch, task complete or task debug.");
+        command !== "batch" && !(command === "task" && action === "complete")) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--base may be used only with verify, review, batch or task complete.");
     }
     if ((parentBase !== undefined || width !== undefined) && command !== "batch") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", `${parentBase !== undefined ? "--parent-base" : "--width"} may be used only with batch.`);
@@ -711,16 +693,11 @@ export function parseArgs(argv) {
     if (worktree !== undefined && command !== "init" && command !== "update") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--worktree may be used only with init or update.");
     }
+    if (criteriaReview && (command !== "review" || action !== undefined || tree || base !== undefined || output !== undefined))
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--criteria requires review --task <id> --yes; omit show, tree, base and output.");
     const revisionAction = command === "task" && ["revise", "replan", "pin-finding"].includes(action ?? "");
     if ((taskGoal !== undefined || debug) && !(command === "task" && action === "create"))
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--goal and --debug apply only to task create.");
-    if ((debugAction !== undefined || commandId !== undefined || eventId !== undefined || payloadFile !== undefined) && !(command === "task" && action === "debug"))
-        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Debug operation options apply only to task debug.");
-    if (command === "task" && action === "debug" && (taskId === undefined || debugAction === undefined || title !== undefined || intent !== undefined ||
-        parentTaskId !== undefined || criteria.length > 0 || evidence.length > 0 ||
-        ((debugAction === "hypothesis" || debugAction === "strategy" || debugAction === "origin") !== (payloadFile !== undefined)) ||
-        ((debugAction === "investigate") !== (commandId !== undefined)) || ((debugAction === "extend") !== (eventId !== undefined))))
-        throw new CliArgumentError("CLI_MISSING_VALUE", "Task debug requires --task, --debug-action and the operation's exact payload/command/event options.");
     if ((criterionFiles.length > 0 && !(command === "task" && (action === "create" || action === "pin-finding"))) ||
         (criteriaFile !== undefined && !(command === "task" && action === "revise")) ||
         (surfaceFile !== undefined && !(command === "task" && (action === "create" || action === "revise"))) ||
@@ -739,7 +716,7 @@ export function parseArgs(argv) {
     if (command === "escapes" && argv.some(token => token !== "escapes" && token !== "--json"))
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "escapes accepts only --json; it is a read-only report.");
     if (revisionAction && (taskId === undefined || evidence.length > 0 || title !== undefined || intent !== undefined || parentTaskId !== undefined || sessionId !== undefined || criteria.length > 0 || base !== undefined ||
-        (action === "revise" && (expectedContract === undefined || (criteriaFile === undefined && surfaceFile === undefined && escapeOf === undefined) || reason === undefined)) ||
+        (action === "revise" && (expectedContract === undefined || (criteriaFile === undefined && surfaceFile === undefined && escapeOf === undefined && baseline === undefined) || reason === undefined)) ||
         (action === "replan" && (expectedTreeContract === undefined || planFile === undefined || reason === undefined)) ||
         (action === "pin-finding" && (expectedContract === undefined || findingReference === undefined || criterionFiles.length !== 1))))
         throw new CliArgumentError("CLI_MISSING_VALUE", "Acceptance revision requires task, expected contract, payload and reason.");
@@ -817,7 +794,7 @@ export function parseArgs(argv) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--intent may be used only with task create.");
     }
     if (command === "review" && action !== "show" && !yes) {
-        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Review requires --yes to authorize both reviewer sessions.");
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", criteriaReview ? "Criteria advisory requires --yes to authorize one reviewer session." : "Review requires --yes to authorize both reviewer sessions.");
     }
     if (command === "review" && harness !== undefined) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Complete review uses the configured reviewer pair; omit --harness.");
@@ -902,11 +879,8 @@ export function parseArgs(argv) {
         ...(intent === undefined ? {} : { intent }),
         ...(taskGoal === undefined ? {} : { goal: taskGoal }),
         ...(debug ? { debug: true } : {}),
-        ...(debugAction === undefined ? {} : { debugAction }),
-        ...(payloadFile === undefined ? {} : { payloadFile }),
-        ...(commandId === undefined ? {} : { commandId }),
-        ...(eventId === undefined ? {} : { eventId }),
         ...(reviewTargets.length === 0 ? {} : { reviewTargets }),
+        ...(criteriaReview ? { criteriaReview: true } : {}),
         ...(completionGate === undefined ? {} : { completionGate }),
         ...(office === undefined ? {} : { office }),
         ...(autoRun === undefined ? {} : { autoRun }),

package/dist/packages/cli/src/bin.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { reviewCreatedCriteria, criteriaReviewStatus } from "./criteria-review.js";
+import { renderCriteriaReview } from "../../../runtime/src/review/criteria.js";
 import { advancePhaseObserver, productionRunContext } from "./run-deps.js";
 import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { recordRunVerification } from "../../../runtime/src/run/verification.js";
@@ -47,9 +49,11 @@ import { memoizePreflight } from "../../../runtime/src/review/batch.js";
 import { createReviewExecutor, ReviewInterruptedError } from "../../../runtime/src/review/execute.js";
 import { probeReviewTargetDetailed } from "../../../runtime/src/review/probe.js";
 import { resolveReviewScope } from "../../../runtime/src/review/scope.js";
+import { runSurfaceGate } from "../../../runtime/src/surface/discovery.js";
 import { resolveReviewRole } from "../../../runtime/src/review/roles.js";
 import { runTrustCommand } from "./commands/trust.js";
 import { runVerifyCommand } from "./commands/verify.js";
+import { defaultBase } from "./default-base.js";
 import { runAdvanceCommand } from "./commands/advance.js";
 import { runReviewShowCommand } from "./commands/review-show.js";
 import { runEscapesCommand } from "./commands/escapes.js";
@@ -255,6 +259,16 @@ else {
                 const root = args.scope === "user"
                     ? process.env.AGENT_OPS_HOME ?? homedir()
                     : process.cwd();
+                // Committed work is judged as a range by default; see defaultBase.
+                if ((args.command === "verify" || (args.command === "review" && args.action !== "show" && !args.criteriaReview)) && args.base === undefined && args.scope !== "user") {
+                    const taskId = args.taskId;
+                    const base = await defaultBase(root, gitRunner(root), async () => taskId === undefined ? undefined :
+                        (await new TaskService(new FileTaskStore(join(root, ".agent-ops", "tasks", "state.json"), root)).status({ taskId })).createdSourceCommit)
+                        // Only a default: any failure leaves the command's own scope handling and errors in charge.
+                        .catch(() => undefined);
+                    if (base !== undefined)
+                        args = { ...args, base };
+                }
                 const isTTY = !args.json &&
                     process.stdin.isTTY === true &&
                     process.stdout.isTTY === true;
@@ -495,7 +509,8 @@ else {
                     return await runTaskCommand({
                         args,
                         service: taskService,
-                        ...(args.action !== "debug" ? {} : { trusted: await (async () => { const binding = await plannedTrustBinding(root, (await loadEffectiveConfig(root, "project")).config); return binding !== null && (await trustStore().status(binding)).status === "TRUSTED"; })() }),
+                        onTaskCreated: async (record, createdRoot) => await reviewCreatedCriteria(createdRoot ?? root, record.task),
+                        criteriaStatus: async (record) => await criteriaReviewStatus(root, record.task),
                         ...(policyConfigHash === undefined ? {} : { policyConfigHash }),
                         ...(sessionId === undefined ? {} : { sessionId }),
                         ...(fromMain
@@ -516,6 +531,11 @@ else {
                             : {})
                     });
                 }
+                if (args.command === "review" && args.criteriaReview) {
+                    const record = await taskService.status({ taskId: args.taskId });
+                    const criteriaReview = await reviewCreatedCriteria(root, record.task, args.rerun);
+                    return { status: "ok", code: "CRITERIA_REVIEW_ADVISORY", data: { criteriaReview, text: renderCriteriaReview(criteriaReview) }, errors: [] };
+                }
                 const probeTarget = async (target, budget) => await probeReviewTargetDetailed(target, {
                     cwd: root,
                     deep: true,
@@ -553,41 +573,16 @@ else {
                             reviewActivity = undefined;
                         }
                     });
-                    const debugRecord = reviewArgs.taskId === undefined ? undefined : await taskService.status({ taskId: reviewArgs.taskId });
-                    const inDebug = (executor) => debugRecord?.task.debug === undefined ? executor : async (request) => await taskService.debugService().review(debugRecord.task.id, () => executor(request));
                     const inSlot = (executor) => slotDir === undefined
-                        ? inDebug(executor)
+                        ? executor
                         : async (request) => await withReviewSlot({
                             dir: slotDir,
                             signal,
                             holder: { root, ...(reviewArgs.taskId === undefined ? {} : { taskId: reviewArgs.taskId }) },
-                            ...(debugRecord?.task.debug === undefined || reviewSessionId === undefined
-                                ? {}
-                                : (() => {
-                                    let paused = false;
-                                    const debug = taskService.debugService();
-                                    return {
-                                        onWaitStart: async () => {
-                                            if (paused)
-                                                return;
-                                            const current = await debug.root(debugRecord.task.id).catch(() => null);
-                                            if (current?.debug.foreground?.sessionId !== reviewSessionId)
-                                                return;
-                                            await debug.foregroundStop(debugRecord.task.id, reviewSessionId);
-                                            paused = true;
-                                        },
-                                        onWaitEnd: async () => {
-                                            if (!paused)
-                                                return;
-                                            await debug.foregroundStart(debugRecord.task.id, reviewSessionId);
-                                            paused = false;
-                                        }
-                                    };
-                                })()),
                             onWait: (line) => {
                                 process.stderr.write(`${progressPrefix}${line}\n`);
                             }
-                        }, async () => await inDebug(executor)(request));
+                        }, async () => await executor(request));
                     return {
                         args: reviewArgs,
                         authorized: reviewArgs.yes,
@@ -607,7 +602,6 @@ else {
                         config: reviewConfig,
                         evidenceStore: new FileEvidenceStore(root, root),
                         execute: inActivity(inSlot(createReviewExecutor({
-                            ...(debugRecord?.task.debug === undefined ? {} : { remainingBudgetMs: () => taskService.debugService().remaining(debugRecord.task.id) }),
                             runner: registeredRunProofRunner(),
                             targets: configuredReviewTargets,
                             cwd: root,
@@ -749,6 +743,20 @@ else {
                     return await runVerifyCommand({
                         args,
                         taskService,
+                        surface: async (taskId) => {
+                            const record = await taskService.status({ taskId });
+                            // A subtask's surface is its parent's; review checks the tree, so verify stays quiet here.
+                            if (record.task.parentTaskId !== undefined)
+                                return [];
+                            const scope = await resolveReviewScope({ root, runner: gitRunner(root), ...(args.base === undefined ? {} : { base: args.base }) });
+                            const gate = await runSurfaceGate({ root, taskId, surface: record.task.surface, required: record.task.surfaceRequired === true,
+                                ...(scope.mode === "base" ? { base: scope.resolvedBase } : {}), changedFiles: scope.changedFiles, configHash: calculateConfigHash(config) });
+                            if (gate.status === "PASS")
+                                return ["Surface: PASS"];
+                            const paths = gate.details.flatMap(d => typeof d === "object" && d !== null && "path" in d ? [String(d.path)] : []);
+                            return [`Surface (advisory; review would stop with ${gate.code}): ${gate.message}`,
+                                ...paths.slice(0, 20).map(path => `  - ${path}`), ...(paths.length > 20 ? [`  ... ${paths.length - 20} more`] : [])];
+                        },
                         activity: { commonDir: await officeCommonDir(root), root, ...(verifySessionId === undefined ? {} : { sessionId: verifySessionId }) },
                         service: { verify: async (taskId) => {
                                 const run = await runPolicyContext(root);

package/dist/packages/cli/src/cli.js

@@ -25,7 +25,7 @@ Commands:
   doctor     Diagnose an installation
   update     Update managed artifacts
   uninstall  Remove managed artifacts
-  task <create|status|attach|revise|replan|pin-finding|debug|advance|complete|archive|export>
+  task <create|status|attach|revise|replan|pin-finding|advance|complete|archive|export>
              Manage independent task acceptance state
   verify     Run configured verification
   review     Run an independent review or show recorded reports
@@ -59,6 +59,7 @@ Options:
   --width <n>                         Batch only: reviews allowed at once (default 2)
   --target-version <version>          Update target version (offline-capable)
   --title <text>
+  --criteria                          Review only: one pre-edit advisory, no time budget
   --criterion <json>                    Repeatable
   --evidence <criterion-id=reference>   Repeatable
   --session <id>
@@ -105,7 +106,7 @@ The URL carries an access token; do not share it.
        agent-ops run respond <run-id> --question-id <id> <--answer <text>|--answer-file <path>> [--json]
 
 New runs have no total time cap. Manual resume upgrades legacy finite runs and keeps accounting.
-Command/review timeouts, provider limits, DEBUG budgets and stop controls remain effective.
+Command/review timeouts, provider limits and stop controls remain effective.
 Native goal state is observational. Completion requires current verification,
 two fresh reviews, task completion and a target-bound integration receipt.
 --retry-approval explicitly retries an intact Codex approval-review usage-limit
@@ -188,7 +189,7 @@ Options:
   --json
   --yes
 `,
-    task: `Usage: agent-ops task <create|status|attach|revise|replan|pin-finding|debug|advance|complete|archive|export> [options]
+    task: `Usage: agent-ops task <create|status|attach|revise|replan|pin-finding|advance|complete|archive|export> [options]
 
 Manage independent task acceptance state. Task commands accept none of
 --harness, --profile or --dry-run. Only advance accepts --yes.
@@ -196,16 +197,12 @@ Manage independent task acceptance state. Task commands accept none of
 Options:
   --title <text>                        create
   --goal <text>                         create: immutable original issue/goal
-  --debug                               create: task-level investigation tag
-  --debug-action <status|hypothesis|strategy|investigate|checkpoint|resume|extend|origin>
-  --payload-file <path>                 debug hypothesis/strategy/origin: bounded JSON
-  --command-id <id>                     debug investigate: trusted configured command
-  --event-id <native-event-id|latest>    debug extend: authentic human continue event
+  --debug                               create: bug fix; needs --goal and a behavioral criterion with redCheckIds
   --intent <text>                       create: intended behavior and constraints before editing
   --criterion <json>                    create, repeatable, two to five total
   --criterion-file <path>               create: one criterion object, repeatable; pin-finding: exactly one
   --criteria-file <path>                revise: replacement criterion array
-  --surface-file <path>                 create (required unless --debug), revise: EVIDENCE-SURFACE-001
+  --surface-file <path>                 create (required), revise: EVIDENCE-SURFACE-001
                                         audit JSON, or {"covers":[surface-id]} under a surfaced parent
   --escape-of <commit>                  create, revise: the commit this bug escaped from (Escape Loop)
   --escape-label <label>                with --escape-of: requirement|surface|scenario|criteria|verify|review|flagged|out-of-model
@@ -216,12 +213,12 @@ Options:
   --expected-contract <hash>            revise, pin-finding: current task contract from status
   --expected-tree-contract <hash>       replan: current tree contract from status
   --reason <text>                       required for revise/replan; optional for pin-finding
-  --baseline <git-ref>                  create/revise: baseline for new mechanical requirements
+  --baseline <git-ref>                  create: baseline for typed criteria; revise: move every typed baseline
   --parent <task-id>                    create: record a subtask; status: list subtasks
   --task <id>                           status, attach, revise, replan, pin-finding, complete, archive, export, advance
-  --session <id>                        create, attach, status, advance, debug
+  --session <id>                        create, attach, status, advance
   --evidence <criterion-id=reference>   complete, repeatable
-  --base <git-ref>                      complete, debug: a clean committed range
+  --base <git-ref>                      complete: a clean committed range
   --yes                                 advance: authorize the two review sessions
   --json
 
@@ -233,7 +230,8 @@ Each legacy criterion needs at least one verifierIds entry naming a verification
 command id configured in .agent-ops/config.json. Typed criteria additionally
 accept an acceptance object: mode (behavioral, invariant or review-only),
 bindings and optional baselineCommit/reviewOnlyReason. Mechanical bindings name
-configured acceptance runner IDs, checkIds, committed materials and optional
+configured acceptance runner IDs, checkIds (the checks this criterion needs;
+other runner output is ignored), committed materials and optional
 redCheckIds; tasks cannot supply commands. Creation freezes the baseline.
 Review-only example (mandatory repository policy commands still run):
 
@@ -241,7 +239,8 @@ Review-only example (mandatory repository policy commands still run):
 
 Pin a saved finding with task pin-finding --task <id> <report-digest:index>
 --expected-contract <hash> --criterion-file <path>. Revise/replan preserve the
-original goal and immutable existing baselines; obtain new verify and review.
+original goal and existing baselines unless revise --baseline moves them all.
+A revise that keeps the criteria keeps verification; every revise needs review.
 `,
     verify: `Usage: agent-ops verify [options]
 
@@ -254,11 +253,14 @@ Options:
   --json
 `,
     review: `Usage: agent-ops review --task <id> --yes [options]
+       agent-ops review --criteria --task <id> --yes [--rerun]
        agent-ops review show --task <id> [--json]
 
 Run the complete task-bound review: one necessary reviewer followed by one
 fresh adversarial reviewer from the configured pair. Show reads recorded
 reports without running a reviewer, including from the main checkout.
+Criteria mode runs/reads one pre-edit advisory, with no time/token budget;
+only --rerun starts another attempt. It never replaces final proof.
 
 Options:
   --task <id>          Required task whose original criteria are reviewed

package/dist/packages/cli/src/codex-loop-process.js

@@ -1,6 +1,5 @@
 import { PROJECT_LOOP_EVENTS, resolveProjectLoopRoot, runProjectLoop } from "../../../runtime/src/hooks/codex-loop.js";
 import { officeEnabled, officeLoopPhaseHint } from "./office-entry.js";
-import { routeDebugPrompt } from "./debug-intake.js";
 const MAX_LOOP_INPUT_BYTES = 64 * 1024;
 function isLoopHarness(value) {
     return value === "claude" || value === "codex";
@@ -74,11 +73,6 @@ export async function runLoopProcess(argv, io, dependencies = {}) {
                 ? {}
                 : { telemetryMaxBytes: dependencies.telemetryMaxBytes })
         });
-        if (event === "UserPromptSubmit" && managedRoot !== null && result.exitCode === 0 && result.stdout === "" && result.stderr === "") {
-            const context = await routeDebugPrompt(managedRoot, input, harness).catch(error => `DEBUG intake unavailable: ${error instanceof Error ? error.message : "preserve current state"}`);
-            if (context !== null)
-                io.writeStdout(harness === "claude" ? JSON.stringify({ hookSpecificOutput: { hookEventName: "UserPromptSubmit", additionalContext: context } }) : context + "\n");
-        }
         if (result.stdout.length > 0) {
             io.writeStdout(result.stdout);
         }

package/dist/packages/cli/src/commands/review.js

@@ -4,7 +4,7 @@ import { renderReviewResult } from "../../../../runtime/src/review/render.js";
 import { reviewReportResults } from "../../../../runtime/src/review/report.js";
 import { findPriorFailingFindings, findReviewAttestation, invalidateReviewAttestation, readReviewReportArtifact, reviewReportDigest, saveReviewAttestation, saveReviewReportArtifact } from "../../../../runtime/src/review/attestation.js";
 import { detectHostTarget, planReviewTargets, resolveReviewRole } from "../../../../runtime/src/review/roles.js";
-import { taskContractHash, treeContractHash, goalHash } from "../../../../runtime/src/task/contract.js";
+import { evidenceMatchesContract, taskContractHash, treeContractHash, goalHash } from "../../../../runtime/src/task/contract.js";
 import { acceptanceCoverage, coverageDigest } from "../../../../runtime/src/verify/acceptance-coverage.js";
 import { resolveGitCommit } from "../../../../runtime/src/verify/change-surface.js";
 import { sha256 } from "../../../../runtime/src/fs/hash.js";
@@ -15,7 +15,6 @@ import { assertSafeSupportingPaths, isReviewerPolicyPath, resolveReviewScope, re
 import { calculateSourceFingerprint } from "../../../../runtime/src/verify/source-fingerprint.js";
 import { calculateConfigHash, isPassingVerificationEvidence } from "../../../../runtime/src/verify/evidence.js";
 import { validateEvidence } from "../../../../runtime/src/schema/validate.js";
-import { loadDebugProof, debugProofDigest } from "../../../../runtime/src/task/debug-state.js";
 import { logSurfaceResidualRisks, runSurfaceGate } from "../../../../runtime/src/surface/discovery.js";
 import { escapeReviewData } from "../../../../runtime/src/escape/link.js";
 import { logGateCatch } from "../../../../runtime/src/logging/local-log.js";
@@ -187,7 +186,7 @@ async function currentEvidence(options, context, criterionId, commandId, configH
             evidence.sourceFingerprint !== sourceFingerprint ||
             (context.records.some(r => r.task.id === (owner?.taskId ?? context.taskId) &&
                 (r.task.goal !== undefined || (r.task.contractRevision ?? 0) > 0 || r.task.criteria.some(c => c.acceptance !== undefined))) &&
-                evidence.taskContractHash !== taskContractHash(context.records.find(r => r.task.id === (owner?.taskId ?? context.taskId)).task))) {
+                !evidenceMatchesContract(evidence.taskContractHash, context.records.find(r => r.task.id === (owner?.taskId ?? context.taskId)).task))) {
             stale = true;
             continue;
         }
@@ -343,7 +342,7 @@ async function reviewEscapes(options, context, scope) {
         const origin = record.task.origin;
         if (origin === undefined)
             continue;
-        const base = record.debug?.baselineCommit ?? record.createdSourceCommit ?? (scope?.mode === "base" ? scope.resolvedBase : undefined);
+        const base = record.createdSourceCommit ?? (scope?.mode === "base" ? scope.resolvedBase : undefined);
         try {
             if (base === undefined)
                 throw new Error("no base");
@@ -770,7 +769,6 @@ export async function runReviewCommand(options) {
         }
         context.coverage = rows;
         context.binding = {
-            ...(context.records.every(r => r.task.debug === undefined) || options.root === undefined ? {} : { debugProofs: Object.fromEntries(await Promise.all(context.records.filter(r => r.task.debug !== undefined).map(async (r) => [r.task.id, debugProofDigest(await loadDebugProof(options.root, r.task.debug.rootTaskId))]))) }),
             taskContractHash: taskContractHash(context.records.find(r => r.task.id === context.taskId).task),
             taskContracts: Object.fromEntries(context.records.map(r => [r.task.id, taskContractHash(r.task)])),
             ...(context.treeTasks === undefined ? {} : { treeContractHash: treeContractHash(context.records.map(r => r.task)) }),
@@ -821,8 +819,7 @@ export async function runReviewCommand(options) {
                 executionPolicy: options.config,
                 ...(surfacePacket === undefined ? {} : { surface: surfacePacket }),
                 artifacts: contractArtifacts.map(({ path, digest }) => ({ path, digest })),
-                tasks: await Promise.all(context.records.map(async (r) => ({ task: r.task, revisions: r.revisions ?? [],
-                    ...(r.task.debug === undefined ? {} : { debugProof: await loadDebugProof(options.root, r.task.debug.rootTaskId) }) }))),
+                tasks: context.records.map(r => ({ task: r.task, revisions: r.revisions ?? [] })),
                 superseded: context.historyRecords ?? [] }));
             const digest = sha256(content);
             const path = ".agent-ops/tasks/review-contracts/" + digest + ".json";
@@ -926,9 +923,7 @@ export async function runReviewCommand(options) {
                     await options.tasks.treeContract(context.taskId) !== context.binding.treeContractHash) ||
                 (context !== undefined && options.tasks !== undefined &&
                     (await Promise.all(context.records.map(async (r) => taskContractHash((await options.tasks.status({ taskId: r.task.id })).task))))
-                        .some((hash, i) => hash !== taskContractHash(context.records[i].task))) ||
-                (context?.binding?.debugProofs !== undefined && options.root !== undefined &&
-                    (await Promise.all(context.records.filter(r => r.task.debug !== undefined).map(async (r) => debugProofDigest(await loadDebugProof(options.root, r.task.debug.rootTaskId)) !== context.binding.debugProofs[r.task.id]))).some(Boolean))) {
+                        .some((hash, i) => hash !== taskContractHash(context.records[i].task)))) {
                 const changed = await persistReviewEvidence(options, sourceChangedResult(result), sourceFingerprint, context);
                 return notRunEnvelope(changed);
             }

package/dist/packages/cli/src/commands/run.js

@@ -47,7 +47,9 @@ function data(action, result) {
     };
 }
 function stateData(action, state, message) {
-    return { action, runId: state.runId, state, recovery: describeRunRecovery(state), message, text: textFor(action, state, message) };
+    const { events, goal: _goal, ...brief } = state;
+    return { action, runId: state.runId, state: { ...brief, eventCount: events.length }, recovery: describeRunRecovery(state), message,
+        text: textFor(action, state, message) };
 }
 async function goalFromArgs(args, root) {
     if (args.goal !== undefined && args.goalFile !== undefined)