@kylecheng3146/agent-ops 0.10.2 → 0.11.1

package/dist/packages/cli/src/commands/task.js

@@ -1,8 +1,15 @@
+import { renderCriteriaReview } from "../../../../runtime/src/review/criteria.js";
 import { lstat, readFile } from "node:fs/promises";
 import { taskContractHash } from "../../../../runtime/src/task/contract.js";
 import { AgentOpsError } from "../../../../runtime/src/fs/paths.js";
 import { renderTaskMarkdown, safeTaskText } from "../../../../runtime/src/task/render.js";
 import { errorEnvelope, okEnvelope } from "../output.js";
+async function withCriteriaStatus(envelope, options) {
+    const item = envelope.data?.record;
+    const advice = item === undefined ? null : await options.criteriaStatus?.(item).catch(() => null);
+    return advice == null || envelope.data === null ? envelope : { ...envelope, data: { ...envelope.data, criteriaReview: advice,
+            text: envelope.data.text + "\n\n" + renderCriteriaReview(advice) } };
+}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -47,10 +54,10 @@ async function withEscape(envelope, escape, service) {
         ...facts.map(fact => `- ${fact.path}: ${fact.surface}`),
         ...(proof === undefined ? [] : [proof.status === "proven"
                 ? `Proof: rule ${proof.rule} replays at the escaped commit; backtest ${proof.backtest.fires}/${proof.backtest.commits} commits (${proof.backtest.rate}).`
-                : proof.status === "unproven" ? `Proof: ${proof.code} - ${proof.reason} Finish refuses this until a tracked rule proves it.`
+                : proof.status === "unproven" ? `Proof: ${proof.code} - ${proof.reason} Advisory: finish does not wait for it; add a tracked rule to prove it.`
                     : proof.status === "lesson" ? `Lesson (unproven, does not block): ${proof.reason}`
-                        : proof.check === null ? "Proof: ESCAPE_RULE_UNPROVEN - name the red-to-green check with --escape-promote <runnerId:checkId>."
-                            : `Proof: promoted check ${proof.check} must be a proven redCheckId of this task. Config proposal (not written):\n${JSON.stringify(proposal, null, 2)}`]),
+                        : proof.check === null ? "Proof: ESCAPE_RULE_UNPROVEN (advisory) - name the red-to-green check with --escape-promote <runnerId:checkId>."
+                            : `Proof: promoted check ${proof.check} should be a proven redCheckId of this task (advisory). Config proposal (not written):\n${JSON.stringify(proposal, null, 2)}`]),
         `Ledger record: ${escape.path} (commit it with the fix).`,
         escape.blame.length === 0 ? "Blame hints: none (the fix only adds lines; an omission has no author)."
             : `Blame hints (a hint only): ${escape.blame.map(hint => `${hint.commit.slice(0, 12)} (${hint.lines} line${hint.lines === 1 ? "" : "s"})`).join(", ")}`
@@ -98,7 +105,7 @@ function taskAction(args) {
             "complete",
             "create",
             "export",
-            "status", "revise", "replan", "pin-finding", "debug"
+            "status", "revise", "replan", "pin-finding"
         ].includes(args.action)) {
         throw new AgentOpsError("TASK_ACTION_INVALID", "A supported task action is required.");
     }
@@ -110,7 +117,7 @@ function taskEnvelope(action, code, message, record) {
         message,
         record,
         contractHash: taskContractHash(record.task),
-        text: renderTaskMarkdown(record) + "\nContract: " + taskContractHash(record.task) + (record.debug === undefined ? "" : "\nDEBUG: " + JSON.stringify(record.debug))
+        text: renderTaskMarkdown(record) + "\nContract: " + taskContractHash(record.task)
     });
 }
 function renderTaskList(records) {
@@ -129,8 +136,6 @@ export async function runTaskCommand(options) {
             if (options.args.title === undefined) {
                 throw new AgentOpsError("TASK_TITLE_REQUIRED", "Task creation requires --title.");
             }
-            if (options.args.debug)
-                await options.service.assertDebugBaseline();
             const worktree = sessionId === undefined || options.sessionWorktree === undefined
                 ? undefined
                 : await options.sessionWorktree(sessionId);
@@ -156,17 +161,15 @@ export async function runTaskCommand(options) {
                 requireSurface: true
             });
             const escape = origin === undefined ? undefined : await (worktree?.service ?? options.service).declareEscape(record.task.id);
-            // An explicit CLI DEBUG intake may be the only start signal on hosts
-            // without a prompt hook (notably agy). The native session owns the clock;
-            // foregroundStart is idempotent for a repeated hook or command.
-            if (options.args.debug && sessionId !== undefined) {
-                await (worktree?.service ?? options.service).debugService().foregroundStart(record.task.id, sessionId);
-            }
-            const created = await withEscape(taskEnvelope(action, "TASK_CREATED", sessionId === undefined
+            const initialAdvice = await options.onTaskCreated?.(record, worktree?.path);
+            let created = await withEscape(taskEnvelope(action, "TASK_CREATED", sessionId === undefined
                 ? `Created task ${record.task.id}.`
                 : record.task.parentTaskId === undefined
                     ? `Created and attached task ${record.task.id}.`
                     : `Created subtask ${record.task.id}; the session stays on the top of its task tree.`, record), escape, worktree?.service ?? options.service);
+            if (initialAdvice !== undefined && created.data !== null)
+                created = { ...created, data: { ...created.data, criteriaReview: initialAdvice,
+                        text: created.data.text + "\n\n" + renderCriteriaReview(initialAdvice) } };
             if (worktree === undefined || created.data === null)
                 return created;
             return {
@@ -187,42 +190,6 @@ export async function runTaskCommand(options) {
                 }
             };
         }
-        if (action === "debug") {
-            const id = requireTaskId(options.args), service = options.service.debugService();
-            if (options.args.debugAction === "origin") {
-                const declared = await service.origin(id, await jsonFile(options.args.payloadFile));
-                return await withEscape(taskEnvelope(action, "TASK_DEBUG_ORIGIN_DECLARED", "Origin bound into the contract; re-verify, re-record the confirmed hypothesis, then review.", declared.record), declared.escape, options.service);
-            }
-            switch (options.args.debugAction) {
-                case "hypothesis":
-                    await service.hypothesis(id, await jsonFile(options.args.payloadFile));
-                    break;
-                case "strategy":
-                    await service.strategy(id, await jsonFile(options.args.payloadFile));
-                    break;
-                case "investigate":
-                    await service.investigate(id, options.args.commandId, options.trusted === true);
-                    break;
-                case "checkpoint":
-                    if (sessionId === undefined)
-                        throw new AgentOpsError("TASK_SESSION_REQUIRED", "Debug checkpoint requires a session.");
-                    await service.checkpoint(id, sessionId);
-                    break;
-                case "resume":
-                    if (sessionId === undefined)
-                        throw new AgentOpsError("TASK_SESSION_REQUIRED", "Debug resume requires a session.");
-                    await service.resume(id, sessionId);
-                    break;
-                case "extend":
-                    if (sessionId === undefined)
-                        throw new AgentOpsError("TASK_SESSION_REQUIRED", "Debug extension requires a native session.");
-                    await service.extend(id, sessionId, options.args.eventId);
-                    break;
-                case "status": break;
-                default: throw new AgentOpsError("TASK_DEBUG_ACTION_INVALID", "A supported debug operation is required.");
-            }
-            return taskEnvelope(action, "TASK_DEBUG_UPDATED", "Original issue debug state preserved.", await service.root(id));
-        }
         if (action === "revise") {
             const payload = options.args.criteriaFile === undefined ? undefined : await jsonFile(options.args.criteriaFile);
             if (payload !== undefined && !Array.isArray(payload))
@@ -235,7 +202,7 @@ export async function runTaskCommand(options) {
                 ...(origin === undefined ? {} : { origin }),
                 reason: options.args.reason, ...(options.args.baseline === undefined ? {} : { baseline: options.args.baseline })
             });
-            return await withEscape(taskEnvelope(action, "TASK_REVISED", "Contract revised; obtain new verification and fresh review.", record), origin === undefined ? undefined : await options.service.declareEscape(record.task.id), options.service);
+            return await withCriteriaStatus(await withEscape(taskEnvelope(action, "TASK_REVISED", "Contract revised; obtain a fresh review, and new verification if the criteria or configuration changed.", record), origin === undefined ? undefined : await options.service.declareEscape(record.task.id), options.service), options);
         }
         if (action === "replan") {
             const payload = await jsonFile(options.args.planFile);
@@ -245,7 +212,13 @@ export async function runTaskCommand(options) {
                 expectedTreeContractHash: options.args.expectedTreeContract, reason: options.args.reason,
                 tasks: payload
             });
-            return okEnvelope("TASK_REPLANNED", { action, message: "Task tree split atomically; reverify and review.", records, text: renderTaskList(records) });
+            const advice = [];
+            for (const record of records) {
+                const result = await options.onTaskCreated?.(record);
+                if (result !== undefined)
+                    advice.push(renderCriteriaReview(result));
+            }
+            return okEnvelope("TASK_REPLANNED", { action, message: "Task tree split atomically; reverify and review.", records, text: [renderTaskList(records), ...advice].join("\n\n") });
         }
         if (action === "pin-finding") {
             const criterion = parseCriterion(JSON.stringify(await jsonFile(options.args.criterionFiles[0])));
@@ -278,9 +251,9 @@ export async function runTaskCommand(options) {
             const reviewOnly = coverage.rows.filter(row => row.mode === "review-only").length;
             const legacy = coverage.rows.filter(row => row.mode === "legacy").length;
             const envelope = taskEnvelope(action, "TASK_STATUS", `Read task ${record.task.id}.`, record);
-            return { ...envelope, data: { ...envelope.data, coverage, treeContractHash: await options.service.treeContract(record.task.id),
+            return await withCriteriaStatus({ ...envelope, data: { ...envelope.data, coverage, treeContractHash: await options.service.treeContract(record.task.id),
                     text: envelope.data.text + "\nAcceptance: " + proven + "/" + mechanical + " mechanical proven; " + reviewOnly + " review-only; " + legacy + " legacy; originally mechanical " + coverage.originalMechanical +
-                        "; reviewed " + coverage.reviewed + "; undischarged " + coverage.rows.filter(row => row.status !== "proven" && !coverage.reviewed).length } };
+                        "; reviewed " + coverage.reviewed + "; undischarged " + coverage.rows.filter(row => row.status !== "proven" && !coverage.reviewed).length } }, options);
         }
         if (action === "attach") {
             if (sessionId === undefined) {

package/dist/packages/cli/src/commands/verify.js

@@ -96,12 +96,16 @@ export async function runVerifyCommand(options) {
     try {
         const taskId = await resolveTaskId(options), activity = options.activity;
         const report = publicReport(await withActivity(activity?.commonDir, { kind: "verify", root: activity?.root ?? "", taskId, ...(activity?.sessionId === undefined ? {} : { sessionId: activity.sessionId }) }, async () => await options.service.verify(taskId)));
-        const text = formatReport(report);
+        // A broken surface check must not hide the verification result.
+        const surface = options.surface === undefined ? [] : await options.surface(taskId).catch(() => []);
+        const text = formatReport(report) + surface.map(line => `${safe(line)}\n`).join("");
+        const advisory = surface.length === 0 ? {} : { surface };
         if (report.status === "PASS") {
             return okEnvelope("VERIFICATION_PASSED", {
                 message: "Required verification passed.",
                 report,
-                text
+                text,
+                ...advisory
             });
         }
         const code = report.status === "FAIL"
@@ -113,7 +117,7 @@ export async function runVerifyCommand(options) {
         return {
             code,
             status: "error",
-            data: { message, report, text },
+            data: { message, report, text, ...advisory },
             errors: [{ code, message }]
         };
     }

package/dist/packages/cli/src/criteria-review.js

@@ -0,0 +1,63 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
+import { runCriteriaReview, readCriteriaReview, renderCriteriaReview } from "../../../runtime/src/review/criteria.js";
+import { registeredRunProofRunner } from "../../../runtime/src/verify/spawn.js";
+import { appendLocalLog } from "../../../runtime/src/logging/local-log.js";
+import { localStatePaths } from "../../../runtime/src/security/permissions.js";
+import { TaskService } from "../../../runtime/src/task/service.js";
+import { FileTaskStore } from "../../../runtime/src/task/store.js";
+import { loadEffectiveConfig, runPolicyContext } from "./context.js";
+async function parentScope(root, task) {
+    const read = async (path, id) => (await new TaskService(new FileTaskStore(join(path, ".agent-ops/tasks/state.json"), path)).status({ taskId: id })).task;
+    if (task.parentTaskId !== undefined)
+        return await read(root, task.parentTaskId);
+    if (task.surface !== undefined && "covers" in task.surface) {
+        const run = await runPolicyContext(root);
+        const coordinator = run?.state.workers.find(worker => worker.workerId === run.state.coordinatorId);
+        if (run?.state.rootTaskId != null && coordinator?.worktree != null)
+            return await read(coordinator.worktree, run.state.rootTaskId);
+    }
+    return undefined;
+}
+export async function criteriaReviewStatus(root, task) {
+    return await readCriteriaReview(root, task, await parentScope(root, task).catch(() => undefined));
+}
+/** Only production creation/explicit review installs this hook; TaskService stays model-free. */
+export async function reviewCreatedCriteria(root, task, rerun = false) {
+    const controller = new AbortController();
+    const interrupt = (signal) => { controller.abort(signal); };
+    const int = () => interrupt("SIGINT"), term = () => interrupt("SIGTERM");
+    process.once("SIGINT", int);
+    process.once("SIGTERM", term);
+    try {
+        const config = await loadEffectiveConfig(root, "project").catch(() => undefined);
+        const role = config?.config.reviewRoles?.find(role => role.role === "independent-review");
+        const host = process.env.AGENT_OPS_HOST;
+        const target = role?.targets.find(target => target !== host) ?? role?.targets[0];
+        const parent = await parentScope(root, task).catch(() => undefined);
+        process.stderr.write(`Criteria advisory for ${task.id}: waiting for one independent reviewer (no time budget; Ctrl-C cancels).\n`);
+        let result = await runCriteriaReview({ root, task, parent, target, model: role?.model, effort: role?.effort,
+            rerun, signal: controller.signal, runner: registeredRunProofRunner(),
+            unavailableCode: config === undefined ? "CRITERIA_REVIEW_CONFIG_UNAVAILABLE" : target === undefined && role !== undefined ? "CRITERIA_REVIEW_NO_INDEPENDENT_TARGET" : "CRITERIA_REVIEW_UNCONFIGURED",
+            log: async (report, path) => {
+                const state = localStatePaths(process.env.AGENT_OPS_HOME ?? homedir());
+                await appendLocalLog(join(state.logDirectory, "events.ndjson"), { type: "criteria-review", taskId: task.id,
+                    attemptId: report.attemptId, status: report.status, code: report.code, durationMs: report.durationMs,
+                    invocations: report.invocations, recommendations: report.advice?.recommendations.length ?? 0,
+                    report: path, usage: { ...report.usage } }, { anchorDirectory: state.anchorDirectory });
+            } });
+        const latest = await new TaskService(new FileTaskStore(join(root, ".agent-ops/tasks/state.json"), root)).status({ taskId: task.id }).catch(() => undefined);
+        const currentView = latest === undefined ? null : await criteriaReviewStatus(root, latest.task);
+        if (currentView?.report.attemptId === result.report.attemptId)
+            result = { ...result, stale: currentView.stale };
+        if (controller.signal.aborted)
+            throw new AgentOpsError("CRITERIA_REVIEW_CANCELLED", "Criteria review cancelled; stop before implementation.");
+        process.stderr.write(renderCriteriaReview(result) + "\n");
+        return result;
+    }
+    finally {
+        process.removeListener("SIGINT", int);
+        process.removeListener("SIGTERM", term);
+    }
+}

package/dist/packages/cli/src/default-base.js

@@ -0,0 +1,26 @@
+import { readWorktreeRecord } from "../../../runtime/src/parallel/service.js";
+import { collectChangeSurface, resolveGitCommit } from "../../../runtime/src/verify/change-surface.js";
+/**
+ * The base verify and review use when `--base` is absent, so committed work is
+ * judged as a range without the agent having to copy it. A dirty tree keeps the
+ * working-tree mode; a session worktree compares against its merge-base with the
+ * target branch (which follows a finish rebase); elsewhere the task's creation
+ * commit counts when it is an ancestor of HEAD.
+ */
+export async function defaultBase(root, runner, createdSourceCommit) {
+    if ((await collectChangeSurface(runner)).paths.length > 0)
+        return undefined;
+    const head = await resolveGitCommit(runner, "HEAD");
+    const record = await readWorktreeRecord(root);
+    let base;
+    if (record !== null) {
+        const merge = await runner.run(["merge-base", "HEAD", record.targetBranch]);
+        base = merge.exitCode === 0 ? Buffer.from(merge.stdout).toString("utf8").trim() : record.base;
+    }
+    else {
+        const created = await createdSourceCommit().catch(() => undefined);
+        if (created !== undefined && (await runner.run(["merge-base", "--is-ancestor", created, "HEAD"])).exitCode === 0)
+            base = created;
+    }
+    return base === undefined || base === "" || base === head ? undefined : base;
+}

package/dist/packages/cli/src/hook-process.js

@@ -14,7 +14,6 @@ import { evaluateWorktreeEnter } from "../../../runtime/src/parallel/enter.js";
 import { evaluateWorktreeWrite, resolveMainRoot } from "../../../runtime/src/parallel/guard.js";
 import { ensureSessionWorktree, recordSessionOrigin } from "../../../runtime/src/parallel/service.js";
 import { CompletionGateService } from "../../../runtime/src/hooks/completion-gate.js";
-import { closeDebugSession, debugStopGate, interruptDebugSession, routeDebugPrompt, startDebugSession } from "./debug-intake.js";
 import { TaskService } from "../../../runtime/src/task/service.js";
 import { FileTaskStore } from "../../../runtime/src/task/store.js";
 import { FileEvidenceStore } from "../../../runtime/src/verify/evidence.js";
@@ -269,8 +268,6 @@ async function closeOfficeSession(io, dependencies) {
                 root, harness: "claude", event: "SessionEnd", input, validated: true,
                 ...(typeof fields.session_id === "string" ? { sessionId: fields.session_id } : {})
             });
-        if (typeof fields.session_id === "string")
-            await closeDebugSession(root, fields.session_id, "claude").catch(() => undefined);
     }
     catch {
         // Office never blocks a session, least of all one that is ending.
@@ -307,12 +304,8 @@ async function promptSubmitted(harness, io, dependencies) {
         const prompt = fields.prompt;
         if (typeof prompt !== "string" || prompt.length === 0 || prompt.length > 64 * 1024 || prompt.includes("\0"))
             return 0;
-        if (evaluateGuardrail({ kind: "content", content: prompt, scope: root }).action !== "block") {
-            const context = await routeDebugPrompt(root, input, harness).catch(error => `DEBUG intake unavailable: ${error instanceof Error ? error.message : "preserve current state"}`);
-            if (context !== null)
-                io.writeStdout(harness === "claude" ? JSON.stringify({ hookSpecificOutput: { hookEventName: "UserPromptSubmit", additionalContext: context } }) : context + "\n");
+        if (evaluateGuardrail({ kind: "content", content: prompt, scope: root }).action !== "block")
             return 0;
-        }
         if (!config.profiles.includes("guardrails") && !config.profiles.includes("loop") && !config.profiles.includes("run"))
             return 0;
         const reason = "agent-ops blocked a suspected secret.";
@@ -329,28 +322,14 @@ async function promptSubmitted(harness, io, dependencies) {
 }
 export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
     const [harness, event] = argv;
-    if (harness === "codex" && event === "Interrupt") {
-        try {
-            const raw = await readStdin(io.stdin), input = parseInput(raw);
-            if (typeof input !== "object" || input === null || Array.isArray(input))
-                return 0;
-            const fields = input;
-            if (typeof fields.session_id !== "string" || fields.session_id.length === 0)
-                return 0;
-            const root = dependencies.root ?? (typeof fields.cwd === "string" ? fields.cwd : process.cwd());
-            await interruptDebugSession(root, fields.session_id, raw);
-        }
-        catch {
-            io.writeStdout(JSON.stringify({ systemMessage: "agent-ops: DEBUG interrupt progress could not be sealed; preserve the task and run agent-ops doctor before resuming." }));
-        }
+    // Pre-0.11 installs registered Interrupt only for DEBUG; it is now a no-op until update removes it.
+    if (harness === "codex" && event === "Interrupt")
         return 0;
-    }
     if (harness === "claude" && event === "SessionEnd")
         return await closeOfficeSession(io, dependencies);
     if ((harness === "claude" || harness === "codex") && event === "UserPromptSubmit")
         return await promptSubmitted(harness, io, dependencies);
-    // The generic completion gate requires an approval escape hatch. Codex
-    // only enforces DEBUG through runtime checkpoints and native human control.
+    // The generic completion gate requires an approval escape hatch, which Codex lacks.
     const completionGateInstalled = (harness === "agy" || harness === "claude") &&
         event === "Stop" &&
         argv.includes("--completion-gate");
@@ -400,18 +379,7 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
             }
         }
         let configOutcome = await hookConfigOutcome(root, dependencies.loadConfig);
-        const nativeStop = normalizeHookInput(harnessId, parsedInput);
-        if (harnessId === "codex" && hookEvent === "Stop" && configOutcome.kind === "invalid")
-            configOutcome = await hookConfigOutcome(root, dependencies.loadConfig);
         if (configOutcome.kind === "invalid") {
-            if (harnessId === "codex" && nativeStop?.event === "stop" && nativeStop.sessionId !== undefined) {
-                writeHookOutput(io, harnessDescriptor(harnessId).runtime.formatOutput("Stop", {
-                    action: "continue", status: "UNKNOWN", code: "TASK_DEBUG_GATE_UNAVAILABLE",
-                    remedy: "DEBUG remains incomplete: configuration failed after one targeted reload. Preserve the task, evidence and budgets; fix .agent-ops/config.json and run agent-ops doctor. No completion is attested."
-                }));
-                await closeDebugSession(root, nativeStop.sessionId, harnessId).catch(() => undefined);
-                return 0;
-            }
             if (completionGateInstalled) {
                 writeHookOutput(io, harnessDescriptor(harness).runtime.formatOutput("Stop", {
                     action: "block",
@@ -434,15 +402,6 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
             return 0;
         }
         const config = configOutcome.config;
-        if (harnessId === "codex" && hookEvent === "Stop" && nativeStop !== null && config.features.debug?.enabled === true) {
-            const result = await debugStopGate(root, config).handle(nativeStop);
-            if (result !== null) {
-                writeHookOutput(io, harnessDescriptor(harnessId).runtime.formatOutput("Stop", result));
-                if (result.action === "continue" && nativeStop.sessionId !== undefined)
-                    await closeDebugSession(root, nativeStop.sessionId, harnessId).catch(() => undefined);
-                return 0;
-            }
-        }
         if (completionGateInstalled && !config.features.completionGate.enabled) {
             writeHookOutput(io, harnessDescriptor(harness).runtime.formatOutput("Stop", {
                 action: "block",
@@ -457,8 +416,6 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
             : await dependencies.trust(root, config, cliVersion);
         const trusted = trustStatus === "TRUSTED";
         const normalized = normalizeHookInput(harnessId, parsedInput);
-        if (normalized?.event === "session-start" && normalized.sessionId !== undefined)
-            await startDebugSession(root, normalized.sessionId, harnessId).catch(() => undefined);
         if (dependencies.office !== undefined && config.features.office?.enabled === true) {
             if (normalized !== null) {
                 const phase = officePhaseHint(normalized) ?? (harnessId === "codex" ? officeLoopPhaseHint(parsedInput, root) : undefined);
@@ -554,43 +511,22 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
                 await recordSessionOrigin(dependencies.worktree, { cwd: root, sessionId }).catch(() => undefined);
             }
         }
-        let hookResult;
-        // Without the gate, DEBUG still refuses a Stop that has no valid stop
-        // checkpoint. Its own failure stays advisory, so it never blocks other work.
-        const debugStop = completionGate === undefined && hookEvent === "Stop" && normalized !== null &&
-            (harnessId === "agy" || harnessId === "claude" || harnessId === "codex") && config.features.debug?.enabled === true
-            ? await debugStopGate(root, config).handle(normalized)
-            : null;
-        if (debugStop !== null)
-            hookResult = debugStop;
-        const output = debugStop !== null
-            ? harnessDescriptor(harnessId).runtime.formatOutput("Stop", debugStop)
-            : await runHookCommand({
-                harness: harness,
-                event: hookEvent,
-                stdin: rawInput,
-                input: parsedInput,
-                config,
-                trusted,
-                onResult: result => { hookResult = result; },
-                ...(worktreeGuard === undefined ? {} : { worktreeGuard }),
-                ...(worktreeEnter === undefined ? {} : { worktreeEnter }),
-                ...(dependencies.advisory === undefined
-                    ? {}
-                    : { advisory: dependencies.advisory }),
-                ...(stopVerification === undefined ? {} : { stopVerification }),
-                ...(completionGate === undefined ? {} : { completionGate })
-            });
+        const output = await runHookCommand({
+            harness: harness,
+            event: hookEvent,
+            stdin: rawInput,
+            input: parsedInput,
+            config,
+            trusted,
+            ...(worktreeGuard === undefined ? {} : { worktreeGuard }),
+            ...(worktreeEnter === undefined ? {} : { worktreeEnter }),
+            ...(dependencies.advisory === undefined
+                ? {}
+                : { advisory: dependencies.advisory }),
+            ...(stopVerification === undefined ? {} : { stopVerification }),
+            ...(completionGate === undefined ? {} : { completionGate })
+        });
         writeHookOutput(io, output);
-        // A Stop can be advisory or gated, but the foreground clock only ends on
-        // the same trusted idle model_stop that the native decision accepted.
-        if (normalized?.event === "stop" &&
-            normalized.sessionId !== undefined &&
-            normalized.terminationReason === "model_stop" &&
-            normalized.fullyIdle === true &&
-            hookResult?.action === "continue") {
-            await closeDebugSession(root, normalized.sessionId, harnessId).catch(() => undefined);
-        }
     }
     catch {
         if (completionGateInstalled) {

package/dist/packages/cli/src/owned-run-step.js

@@ -22,7 +22,7 @@ export async function runOwnedLocalProof(argv) {
         if (existing.processAlive)
             throw new AgentOpsError("RUN_WORKER_PROOF_ACTIVE", "A registered proof command is already running for this worker.");
     }
-    const remaining = remainingRunTimeMs(state);
+    const remaining = argv[0] === "review" && argv.includes("--criteria") ? Infinity : remainingRunTimeMs(state);
     if (remaining <= 0)
         throw new AgentOpsError("RUN_BUDGET_EXHAUSTED", "No active run time remains for local proof.");
     const cli = fileURLToPath(new URL("./bin.js", import.meta.url));