@kylecheng3146/agent-ops 0.11.2 → 0.11.4

package/README.md

@@ -17,7 +17,9 @@ command behavior may change before 1.0.
 Every new task, including DEBUG and native run parent/child tasks, waits for one
 independent advisory review of its goal, criteria and assigned surface before
 implementation. Read the suggestions, decide which to adopt, and record reasons
-through `task revise`. Revisions do not automatically re-review.
+through `task revise`. The first revision that changes criteria, intent or
+goal reruns the advisory once; surface-only revisions do not, and later
+reruns are explicit (`review --criteria --rerun`).
 
 The advisory has no time/token budget; explicit cancellation stops work. Genuine
 execution errors report NOT_RUN and allow work. Detailed reports remain private;
@@ -51,8 +53,14 @@ agent-ops run logs <run-id>
 agent-ops run respond <run-id> --question-id <id> --answer "Clarification"
 agent-ops run stop <run-id>
 agent-ops run resume <run-id>
+agent-ops run land <run-id> [--task <task-id>]... --yes
 ```
 
+`run land` merges the delivered children of a paused, blocked or budget-limited
+run ahead of the rest: it verifies them, runs the two-round review and finishes
+with a receipt in a separate landing worktree, while the run stays resumable and
+its final proof re-verifies the whole goal.
+
 `--host claude` uses Claude Code; `--wait` waits for a terminal or input state.
 The coordinator counts toward the two writer slots. Native processes write only
 under current leases in separate worktrees. Active time counts once across parallel
@@ -266,7 +274,8 @@ question through `agent-ops run respond`. A start refused with
 `WORKTREE_NESTED` falls back to the subtask flow; `RUN_REPO_UNTRUSTED` stops and
 asks you. A run that ends without completing is reported with its status, last
 log events, and the `agent-ops run resume <id>` / `agent-ops run stop <id>`
-commands; it is never resumed automatically. agy keeps the subtask flow.
+commands (plus `agent-ops run land <id> --yes` when it has delivered tasks); it
+is never resumed or landed automatically. agy keeps the subtask flow.
 Init and update pre-authorize `agent-ops run` for Claude Code and Codex.
 
 ```bash

package/dist/packages/cli/src/args.js

@@ -922,7 +922,7 @@ export function parseArgs(argv) {
     };
 }
 function parseRunArgs(argv) {
-    const actions = ["start", "status", "logs", "resume", "stop", "respond"];
+    const actions = ["start", "status", "logs", "resume", "stop", "respond", "land"];
     if (argv.includes("--help") || argv.includes("-h"))
         return { command: "help", helpTopic: "run", profiles: [], dryRun: false, json: false, yes: false, rerun: false };
     const action = actions.includes(argv[0]) ? argv[0] : "start";
@@ -937,21 +937,30 @@ function parseRunArgs(argv) {
             positional = token;
             continue;
         }
-        if (seen.has(token) && token !== "--retry-approval")
+        if (seen.has(token) && token !== "--retry-approval" && token !== "--task")
             duplicate(token);
         seen.add(token);
         if (token === "--json") {
             args.json = true;
             continue;
         }
+        if (token === "--yes") {
+            args.yes = true;
+            continue;
+        }
         if (token === "--wait") {
             args.wait = true;
             continue;
         }
-        if (!["--host", "--goal-file", "--time-budget", "--jobs", "--question-id", "--answer", "--answer-file", "--retry-approval", "--retry-delivery"].includes(token))
+        if (!["--host", "--goal-file", "--time-budget", "--jobs", "--question-id", "--answer", "--answer-file", "--retry-approval", "--retry-delivery", "--task"].includes(token))
             throw new CliArgumentError("CLI_UNKNOWN_OPTION", `Unknown run option: ${token}`, token);
         const value = readOptionValue(argv, i++, token);
         switch (token) {
+            case "--task":
+                if (!/^[A-Za-z0-9._:/-]{1,256}$/u.test(value) || args.landTaskIds?.includes(value))
+                    invalidValue(token, value);
+                args.landTaskIds = [...(args.landTaskIds ?? []), value];
+                break;
             case "--retry-delivery":
                 if (!/^task-[a-z0-9-]{1,128}$/u.test(value))
                     invalidValue(token, value);
@@ -991,6 +1000,12 @@ function parseRunArgs(argv) {
     }
     if (args.retryApprovalIds !== undefined && action !== "resume")
         throw new CliArgumentError("CLI_INVALID_OPTION", "--retry-approval requires run resume.");
+    if (args.landTaskIds !== undefined && action !== "land")
+        throw new CliArgumentError("CLI_INVALID_OPTION", "--task requires run land.");
+    if (args.yes !== (action === "land"))
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", action === "land"
+            ? "Run land requires --yes to authorize its verification and both reviewer sessions."
+            : "--yes is accepted only by run land.");
     if (args.retryDeliveryTaskId !== undefined && (action !== "resume" || args.retryApprovalIds !== undefined))
         throw new CliArgumentError("CLI_INVALID_OPTION", "--retry-delivery requires run resume without --retry-approval.");
     if (action === "start") {

package/dist/packages/cli/src/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { reviewCreatedCriteria, criteriaReviewStatus } from "./criteria-review.js";
+import { reviewCreatedCriteria, reviewRevisedCriteria, criteriaReviewStatus } from "./criteria-review.js";
 import { renderCriteriaReview } from "../../../runtime/src/review/criteria.js";
 import { advancePhaseObserver, productionRunContext } from "./run-deps.js";
 import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
@@ -520,6 +520,7 @@ else {
                         service: taskService,
                         onTaskCreated: async (record, createdRoot) => await reviewCreatedCriteria(createdRoot ?? root, record.task),
                         criteriaStatus: async (record) => await criteriaReviewStatus(root, record.task),
+                        onTaskRevised: async (record) => await reviewRevisedCriteria(root, record.task),
                         ...(policyConfigHash === undefined ? {} : { policyConfigHash }),
                         ...(sessionId === undefined ? {} : { sessionId }),
                         ...(fromMain

package/dist/packages/cli/src/cli.js

@@ -130,6 +130,7 @@ The URL carries an access token; do not share it.
        agent-ops run resume <run-id> [--retry-approval <auth-event-id>]... [--json]
        agent-ops run resume <run-id> --retry-delivery <task-id> [--json]
        agent-ops run respond <run-id> --question-id <id> <--answer <text>|--answer-file <path>> [--json]
+       agent-ops run land <run-id> [--task <task-id>]... --yes [--json]
 
 New runs have no total time cap. Manual resume upgrades legacy finite runs and keeps accounting.
 Command/review timeouts, provider limits and stop controls remain effective.
@@ -144,6 +145,10 @@ Status includes phase, original cause, recorded sealed proof, cleanup state,
 resumability and remediation. Resume revalidates authority and sealed artifacts;
 receipt-bound recovery executes only missing cleanup steps. Resolve the saved
 blocker before retrying: unchanged cleanup inputs are refused.
+land merges delivered children of a paused, blocked or budget-limited run ahead
+of the rest: it verifies them, runs the two-round review and finishes with a
+receipt, leaving the run resumable. --task picks a subset; each one's
+dependencies must be picked too or already landed.
 `,
     init: `Usage: agent-ops init [options]
 

package/dist/packages/cli/src/commands/advance.js

@@ -102,7 +102,7 @@ export async function runAdvanceCommand(options) {
     if (parent.status !== "active" || parent.task.parentTaskId !== undefined) {
         throw new AgentOpsError("ADVANCE_PARENT_INVALID", "Advance requires an active root task in the coordinator worktree.");
     }
-    const children = await integrateSessionChildren(deps, record, parent.task.id);
+    const children = await integrateSessionChildren(deps, record, parent.task.id, undefined, options.children);
     const step = options.step ?? runAdvanceStep;
     for (let attempt = 0; attempt < 2; attempt += 1) {
         const target = await git(deps, mainRoot, ["rev-parse", `${record.targetBranch}^{commit}`]);
@@ -159,6 +159,7 @@ export async function runAdvanceCommand(options) {
             ...(noChangePaths === undefined ? {} : { noChangePaths }) });
         const sourceFingerprint = await calculateSourceFingerprint(record.path, scope, runner(deps, record.path));
         const finalProof = { target, head, sourceFingerprint, children,
+            ...(options.children === undefined ? {} : { keepChildren: true }),
             ...(noChangePaths === undefined ? {} : { noChange: { sourceCommit: head,
                     contractDigest: await deps.tasks(record.path).treeContract(parent.task.id), reviewScope: scope,
                     artifactRefs: Object.values((await deps.tasks(record.path).status({ taskId: parent.task.id })).evidence).flat() } }) };

package/dist/packages/cli/src/commands/init.js

@@ -127,13 +127,10 @@ export async function runInitCommand(options) {
             : { worktree: worktreeConfig })
     });
     const trust = await trustChange(options, plan);
-    // An installation with no verifier looks finished and is not: every task
-    // completion needs current PASS evidence from a required verifier, so the
-    // loop can never close. Detection stays conservative on purpose — it will
-    // not guess a test command — which makes saying so out loud the whole fix.
+    // Empty commands block legacy criteria, not typed acceptance backed by runners.
     const verificationWarnings = plan.config.verification.commands.length === 0
         ? [
-            "No verification command is configured, so no task can be completed. " +
+            "No verification command is configured; legacy criteria need a required verifier. " +
                 "Add verification.commands to .agent-ops/config.json." +
                 (plan.verificationBlockers.length === 0
                     ? ""

package/dist/packages/cli/src/commands/review.js

@@ -2,7 +2,7 @@ import { buildReviewPacket } from "../../../../runtime/src/review/packet.js";
 import { runIndependentReview } from "../../../../runtime/src/review/runner.js";
 import { renderReviewResult } from "../../../../runtime/src/review/render.js";
 import { reviewReportResults } from "../../../../runtime/src/review/report.js";
-import { findPriorFailingFindings, findReviewAttestation, invalidateReviewAttestation, readReviewReportArtifact, reviewReportDigest, saveReviewAttestation, saveReviewReportArtifact } from "../../../../runtime/src/review/attestation.js";
+import { countFailedReviewRounds, findPriorFailingFindings, REVIEW_ROUND_CAP, findReviewAttestation, invalidateReviewAttestation, readReviewReportArtifact, reviewReportDigest, saveReviewAttestation, saveReviewReportArtifact } from "../../../../runtime/src/review/attestation.js";
 import { detectHostTarget, planReviewTargets, resolveReviewRole } from "../../../../runtime/src/review/roles.js";
 import { evidenceMatchesContract, taskContractHash, treeContractHash, goalHash } from "../../../../runtime/src/task/contract.js";
 import { acceptanceCoverage, coverageDigest } from "../../../../runtime/src/verify/acceptance-coverage.js";
@@ -649,6 +649,20 @@ export async function runReviewCommand(options) {
         ? await treeContext(options)
         : await taskContext(options);
     options = { ...options, noChangePaths: options.noChangePaths ?? context?.records.find(r => r.task.id === context.taskId)?.noChangePaths };
+    // Before any scope, surface or reviewer cost: a contract that keeps failing
+    // needs a new approach, not another round of one-by-one fixes.
+    if (context !== undefined && options.root !== undefined) {
+        const own = context.records.find(r => r.task.id === context.taskId).task;
+        if (await countFailedReviewRounds(options.root, context.taskId, taskContractHash(own)) >= REVIEW_ROUND_CAP) {
+            const result = { ...resultBase, status: "NOT_RUN", reason: "round-cap", taskId: context.taskId };
+            const message = "Independent review was not run.";
+            return { code: "REVIEW_NOT_RUN", status: "error", errors: [{ code: "REVIEW_NOT_RUN", message }], data: { message, result,
+                    text: renderReviewResult(result) +
+                        `Review failed ${REVIEW_ROUND_CAP} times under this contract. Stop fixing findings one by one: reconsider ` +
+                        "the approach, then record the new plan (criteria or intent) with a reason, or ask the user how to proceed:\n" +
+                        `  agent-ops task revise --task ${context.taskId} --expected-contract ${taskContractHash(own)} --reason "<what changed in the approach>"\n` } };
+        }
+    }
     const evidenceRequirements = (options.args.evidence ?? []).map((value) => {
         const separator = value.indexOf("=");
         return {

package/dist/packages/cli/src/commands/run.js

@@ -9,7 +9,7 @@ function actionOf(args) {
     const value = dynamic(args).runAction ?? dynamic(args).action;
     if (value === undefined || value === "start")
         return "start";
-    if (["status", "logs", "resume", "stop", "respond"].includes(String(value)))
+    if (["status", "logs", "resume", "stop", "respond", "land"].includes(String(value)))
         return value;
     throw new AgentOpsError("RUN_ACTION_INVALID", `Unsupported run action: ${String(value)}`);
 }
@@ -109,6 +109,14 @@ export async function runRunCommand(options) {
         }
         if (action === "resume")
             return okEnvelope("RUN_RESUMED", data(action, await options.service.resume(runId, options.args.retryApprovalIds, true, options.args.retryDeliveryTaskId)));
+        if (action === "land") {
+            if (options.service.land === undefined)
+                throw new AgentOpsError("RUN_LAND_UNSUPPORTED", "This CLI cannot land run deliveries.");
+            const landed = await options.service.land(runId, options.args.landTaskIds);
+            const message = `Landed ${landed.taskIds.join(", ")} from run ${runId}. Receipt: ${landed.receipt}.\n` +
+                `The run stays ${landed.state.status}; continue the rest with: agent-ops run resume ${runId}`;
+            return okEnvelope("RUN_LANDED", { ...data(action, { state: landed.state, message }), landedTaskIds: landed.taskIds, receipt: landed.receipt });
+        }
         if (action === "stop")
             return okEnvelope("RUN_STOP_REQUESTED", data(action, await options.service.stop(runId, options.args.answer ?? "user requested stop")));
         const questionId = options.args.questionId;

package/dist/packages/cli/src/commands/task.js

@@ -6,7 +6,12 @@ import { renderTaskMarkdown, safeTaskText } from "../../../../runtime/src/task/r
 import { errorEnvelope, okEnvelope } from "../output.js";
 async function withCriteriaStatus(envelope, options) {
     const item = envelope.data?.record;
-    const advice = item === undefined ? null : await options.criteriaStatus?.(item).catch(() => null);
+    // A status read is best effort; a cancelled advisory round must still stop the caller.
+    const advice = item === undefined ? null : await options.criteriaStatus?.(item).catch((error) => {
+        if (error instanceof AgentOpsError && error.code === "CRITERIA_REVIEW_CANCELLED")
+            throw error;
+        return null;
+    });
     return advice == null || envelope.data === null ? envelope : { ...envelope, data: { ...envelope.data, criteriaReview: advice,
             text: envelope.data.text + "\n\n" + renderCriteriaReview(advice) } };
 }
@@ -202,7 +207,8 @@ export async function runTaskCommand(options) {
                 ...(origin === undefined ? {} : { origin }),
                 reason: options.args.reason, ...(options.args.baseline === undefined ? {} : { baseline: options.args.baseline })
             });
-            return await withCriteriaStatus(await withEscape(taskEnvelope(action, "TASK_REVISED", "Contract revised; obtain a fresh review, and new verification if the criteria or configuration changed.", record), origin === undefined ? undefined : await options.service.declareEscape(record.task.id), options.service), options);
+            // The revision is saved first: an advisory NOT_RUN keeps TASK_REVISED, and a cancelled round throws with it kept.
+            return await withCriteriaStatus(await withEscape(taskEnvelope(action, "TASK_REVISED", "Contract revised; obtain a fresh review, and new verification if the criteria or configuration changed.", record), origin === undefined ? undefined : await options.service.declareEscape(record.task.id), options.service), options.onTaskRevised === undefined ? options : { ...options, criteriaStatus: options.onTaskRevised });
         }
         if (action === "replan") {
             const payload = await jsonFile(options.args.planFile);

package/dist/packages/cli/src/criteria-review.js

@@ -1,7 +1,7 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
-import { runCriteriaReview, readCriteriaReview, renderCriteriaReview } from "../../../runtime/src/review/criteria.js";
+import { runCriteriaReview, readCriteriaReview, renderCriteriaReview, revisionReviewDue } from "../../../runtime/src/review/criteria.js";
 import { registeredRunProofRunner } from "../../../runtime/src/verify/spawn.js";
 import { appendLocalLog } from "../../../runtime/src/logging/local-log.js";
 import { localStatePaths } from "../../../runtime/src/security/permissions.js";
@@ -24,7 +24,7 @@ export async function criteriaReviewStatus(root, task) {
     return await readCriteriaReview(root, task, await parentScope(root, task).catch(() => undefined));
 }
 /** Only production creation/explicit review installs this hook; TaskService stays model-free. */
-export async function reviewCreatedCriteria(root, task, rerun = false) {
+export async function reviewCreatedCriteria(root, task, rerun = false, trigger) {
     const controller = new AbortController();
     const interrupt = (signal) => { controller.abort(signal); };
     const int = () => interrupt("SIGINT"), term = () => interrupt("SIGTERM");
@@ -38,7 +38,7 @@ export async function reviewCreatedCriteria(root, task, rerun = false) {
         const parent = await parentScope(root, task).catch(() => undefined);
         process.stderr.write(`Criteria advisory for ${task.id}: waiting for one independent reviewer (no time budget; Ctrl-C cancels).\n`);
         let result = await runCriteriaReview({ root, task, parent, target, model: role?.model, effort: role?.effort,
-            rerun, signal: controller.signal, runner: registeredRunProofRunner(),
+            rerun, ...(trigger === undefined ? {} : { trigger }), signal: controller.signal, runner: registeredRunProofRunner(),
             unavailableCode: config === undefined ? "CRITERIA_REVIEW_CONFIG_UNAVAILABLE" : target === undefined && role !== undefined ? "CRITERIA_REVIEW_NO_INDEPENDENT_TARGET" : "CRITERIA_REVIEW_UNCONFIGURED",
             log: async (report, path) => {
                 const state = localStatePaths(process.env.AGENT_OPS_HOME ?? homedir());
@@ -61,3 +61,8 @@ export async function reviewCreatedCriteria(root, task, rerun = false) {
         process.removeListener("SIGTERM", term);
     }
 }
+/** A revise that changed what the advice judged reruns it once; otherwise it reports the current advisory. */
+export async function reviewRevisedCriteria(root, task) {
+    const view = await criteriaReviewStatus(root, task);
+    return revisionReviewDue(view) ? await reviewCreatedCriteria(root, task, true, "revise") : view;
+}

package/dist/packages/cli/src/run-deps.js

@@ -9,7 +9,8 @@ import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { sha256 } from "../../../runtime/src/fs/hash.js";
 import { resolveCheckouts, readWorktreeRecord, sessionWorktreeName } from "../../../runtime/src/parallel/service.js";
 import { createLaunchdDescriptor, LaunchdController, readBootIdentity, readGuiLoginIdentity } from "../../../runtime/src/run/macOS.js";
-import { FileRunRepository, RunService, validateDeliveryRetry } from "../../../runtime/src/run/service.js";
+import { FileRunRepository, RunService, landingMarkerLive, validateDeliveryRetry } from "../../../runtime/src/run/service.js";
+import { landRun } from "../../../runtime/src/run/land.js";
 import { readPrivateFile, writePrivateFile } from "../../../runtime/src/security/permissions.js";
 import { collectChangeSurface } from "../../../runtime/src/verify/change-surface.js";
 import { worktreeDependencies, gitRunner, trustStore } from "./parallel-deps.js";
@@ -28,6 +29,7 @@ import { nativeProcessIdentity } from "../../../runtime/src/run/transport.js";
 import { redactSecrets } from "../../../runtime/src/security/redact.js";
 import { RunControlService } from "../../../runtime/src/run/controls.js";
 import { recordRunPhase } from "../../../runtime/src/run/phase.js";
+import { runAdvanceCommand } from "./commands/advance.js";
 /** Worktree construction happens before a native lease exists; it must never write global trust. */
 export async function runWorktreeDependencies(deps, state) {
     state = await ensureRunPolicy(new FileRunRepository(join(state.commonDir, "agent-ops/runs"), state.commonDir), state);
@@ -213,6 +215,8 @@ export async function productionRunContext(cwd, options = {}) {
     };
     const resume = async (runId, retryApprovalIds = [], upgradeBudget = true, retryDeliveryTaskId) => {
         const before = await service.status(runId);
+        if (landingMarkerLive(before.landing))
+            throw new AgentOpsError("RUN_LANDING_IN_PROGRESS", `Run ${runId} is landing delivered work; wait for run land to finish.`);
         const retry = retryDeliveryTaskId === undefined ? null : validateDeliveryRetry(before, retryDeliveryTaskId);
         const runtimeHash = await runRuntimeHash();
         const policy = await readRunPolicy(before, before.policyBinding?.runtimeHash ?? runtimeHash, Date.now(), true);
@@ -315,6 +319,18 @@ export async function productionRunContext(cwd, options = {}) {
         }
         return { state, message: `Run ${runId} stopped; registered native process death was confirmed.` };
     };
+    const land = async (runId, taskIds) => {
+        if (checkouts.currentRoot !== checkouts.mainRoot)
+            throw new AgentOpsError("WORKTREE_NESTED", "Land a run from the main checkout.");
+        return await landRun({ repository, runId, ...(taskIds === undefined ? {} : { taskIds }), deps,
+            advance: async (input) => {
+                const result = await runAdvanceCommand({ ...input, deps });
+                const receipt = result.data?.receipt;
+                if (result.status !== "ok" || typeof receipt !== "string")
+                    throw new AgentOpsError(result.code, "Landing proof did not finish with a receipt.");
+                return { receipt };
+            } });
+    };
     const respond = async (runId, questionId, answer) => {
         const state = await service.status(runId);
         if (!state.questions.some(q => q.questionId === questionId && q.answeredAt === null))
@@ -331,7 +347,7 @@ export async function productionRunContext(cwd, options = {}) {
         }
     };
     return { ...checkouts, targetBranch: target.stdout.trim(), ownerSessionId: randomUUID(), repository,
-        service: { start, resume, stop, respond, status: service.status.bind(service), logs: service.logs.bind(service) },
+        service: { start, resume, stop, respond, land, status: service.status.bind(service), logs: service.logs.bind(service) },
         waitForCompletion: async (runId) => {
             for (;;) {
                 const state = await service.status(runId);

package/dist/packages/cli/src/run-entry.js

@@ -113,7 +113,7 @@ export function coordinatorWakeNote(state, coordinator) {
 export function workerInstructionLines() {
     return ["Keep the original goal fixed. Read this repository's AGENTS.md and use its existing verifier authority.",
         "Plan 2–5 substantive acceptance criteria. Submit a plan request before changing product files; the supervisor creates the task with the fixed goal.",
-        "Read the criteria advisory before implementation. Decide which suggestions to adopt and use task revise with reasons (including rejected advice). A revision does not automatically rerun criteria review; formal final proof remains required.",
+        "Read the criteria advisory before implementation. Decide which suggestions to adopt and use task revise with reasons (including rejected advice). The first revision that changes criteria, intent or goal reruns criteria review once and waits for it; later ones do not. Formal final proof remains required.",
         "For every mechanically testable requirement use a configured acceptance runner; explicit review-only fallback requires a recorded reason and fresh goal review.",
         "Implement, run targeted fast checks on changed code, commit and submit action=handoff so the supervisor runs full verification outside your context window. Do not poll full-suite verification in a loop. Repair failed checks and pin mechanically testable review findings into regression criteria. Never disable a mandatory policy verifier.",
         "Only registered run workers may write. Use isolated worktrees and supervisor-issued leases; do not launch an unregistered writing subagent.",

package/dist/runtime/src/install/doctor.js

@@ -380,17 +380,15 @@ async function checkRegistrationDrift(root, manifest, config) {
     }
 }
 /**
- * Whether anything can ever be verified here. Completion requires current PASS
- * evidence from a required verifier, so an empty list is not a light
- * configuration — it is a loop that cannot close, and an installation reaches
- * that state quietly whenever stack detection declines to guess.
+ * Legacy criteria need required verifiers; typed acceptance can use runners
+ * even when no ordinary verification command is configured.
  */
 function checkVerificationCommands(config) {
     if (config === undefined) {
         return check("verification-commands", "UNKNOWN", "Configuration could not be read, so verifiers are unknown.");
     }
     if (config.verification.commands.length === 0) {
-        return check("verification-commands", "DEGRADED", "No verification command is configured, so no task can be completed.", 
+        return check("verification-commands", "DEGRADED", "No verification command is configured; legacy criteria need a required verifier.", 
         // Codeless on purpose: the fix is an edit to the configuration file, not
         // an agent-ops command, and a code here would force a non-zero exit on
         // every installation whose stack detection declined to guess.

package/dist/runtime/src/install/harness.js

@@ -347,7 +347,8 @@ function autoRunInstruction(descriptor, context) {
         "report the `agent-ops run status",
         "<id>` state and code, the last `agent-ops run logs <id>` events, and the",
         "exact `agent-ops run resume <id>` and `agent-ops run stop <id>` commands,",
-        "then stop: never resume automatically or take over the run's work.",
+        "plus `agent-ops run land <id> --yes` when it has delivered tasks,",
+        "then stop: never resume or land automatically or take over the run's work.",
         ""
     ];
 }
@@ -367,7 +368,7 @@ export function managedRules(descriptor, context) {
     if (context.capabilities.includes("task"))
         lines.push("To fix a bug, run `agent-ops task create --debug --goal <verbatim issue>` with a", "behavioral criterion whose `redCheckIds` fail at the baseline and pass on the", "candidate, then verify, review and finish as for any task. If you know where the", "bug came from, record it with `task revise --escape-of <commit> --escape-label", "<label>`; the origin is advisory and never blocks finish.", "");
     if (context.capabilities.includes("rules")) {
-        lines.push("   Every production task creation waits for one independent criteria advisory", "   before implementation (also DEBUG and native run parents/children). It has", "   no time/token budget; real launch/auth/output errors report NOT_RUN and", "   allow work, while explicit cancellation means stop. Read the private report,", "   decide which advice to adopt, and use task revise with reasons (including", "   rejections). Revise does not rerun it. Explicit rerun only:", "   `agent-ops review --criteria --task <id> --rerun --yes`.", "   Start task creation/criteria review through the trusted outer host when", "   the host sandbox blocks reviewer auth/network, using the same outer-host", "   invocation described below for review. Never bypass a native denial.", "   This advisory never replaces verify, final two-round review or finish.", "", "For every change:", "", "1. Audit the change's surfaces first (EVIDENCE-SURFACE-001): dependents,", "   duplicates, other paths to the same concept, and shared state/data", "   contracts, each with recorded fixed-string queries or n/a: reason; pass", "   them with `task create --surface-file <json>`. An exclusion says why", "   the surface is unaffected; \"out of scope\" is not a reason. A derived", "   discovery query whose hits are all incidental may be dismissed once with", "   a reason in `dismissed` instead of excluding each file. Then define", "   two to five mechanically verifiable acceptance criteria.", "2. Inspect the smallest relevant scope within the audited surfaces and", "   preserve unrelated changes.", "3. Apply the smallest safe change.", "4. Run evidence-producing verification for every criterion.", "5. Obtain complete independent review before claiming completion, via", "   `agent-ops review --task <task-id> --yes` (or the CLI's equivalent invocation).", "   Never call a", "   review-target CLI (agy, codex, claude) directly — direct calls skip", "   the enforced read-only sandbox flags and can hang or fail on command", "   permission prompts.", "   Start this command through the trusted outer host runner as its first", "   and only invocation. On Codex, the outer tool request must use", "   `sandbox_permissions: \"require_escalated\"` so network and loopback", "   are available; in that same request, unset", "   `CODEX_SANDBOX_NETWORK_DISABLED` and set `AGENT_OPS_HOST` when three", "   targets are configured. The Codex shell form is", "   `env -u CODEX_SANDBOX_NETWORK_DISABLED AGENT_OPS_HOST=<current-host> agent-ops review --task <task-id> --yes`.", "   Keep it a plain command line: to keep the output add `--output <file>`", "   (the JSON envelope is written there and one line is printed) instead of", "   a shell redirect, which the host can only allow by matching the whole", "   command string, task id included.", "   Do not run it once in the restricted sandbox and retry; changing the", "   variable inside that sandbox is not elevation.", "   Review runs exactly two fresh sessions: with three configured targets,", "   set `AGENT_OPS_HOST` to the current CLI id so it is excluded; with two", "   targets both run in configured order; with one target it runs twice.", "   The first session is necessary; a PASS then requires an adversarial", "   re-check carrying the first report. A first FAIL or NOT_RUN stops.", "", "Treat `.agent-ops/config.json` as verifier authority. Discovery output is", "only a proposal until a user confirms it. Repository commands require an", "exact matching trust record. Confirmed project init/update grants it", "automatically when verification commands are configured.", "");
+        lines.push("   Every production task creation waits for one independent criteria advisory", "   before implementation (also DEBUG and native run parents/children). It has", "   no time/token budget; real launch/auth/output errors report NOT_RUN and", "   allow work, while explicit cancellation means stop. Read the private report,", "   decide which advice to adopt, and use task revise with reasons (including", "   rejections). The first revise that changes criteria, intent or goal", "   reruns it once and waits; surface-only revises do not. Later reruns are", "   explicit only: `agent-ops review --criteria --task <id> --rerun --yes`.", "   Start task creation/revise/criteria review through the trusted outer host when", "   the host sandbox blocks reviewer auth/network, using the same outer-host", "   invocation described below for review. Never bypass a native denial.", "   This advisory never replaces verify, final two-round review or finish.", "", "For every change:", "", "1. Audit the change's surfaces first (EVIDENCE-SURFACE-001): dependents,", "   duplicates, other paths to the same concept, and shared state/data", "   contracts, each with recorded fixed-string queries or n/a: reason; pass", "   them with `task create --surface-file <json>`. An exclusion says why", "   the surface is unaffected; \"out of scope\" is not a reason. A derived", "   discovery query whose hits are all incidental may be dismissed once with", "   a reason in `dismissed` instead of excluding each file. Then define", "   two to five mechanically verifiable acceptance criteria.", "2. Inspect the smallest relevant scope within the audited surfaces and", "   preserve unrelated changes.", "3. Apply the smallest safe change.", "4. Run evidence-producing verification for every criterion.", "5. Obtain complete independent review before claiming completion, via", "   `agent-ops review --task <task-id> --yes` (or the CLI's equivalent invocation).", "   Never call a", "   review-target CLI (agy, codex, claude) directly — direct calls skip", "   the enforced read-only sandbox flags and can hang or fail on command", "   permission prompts.", "   Start this command through the trusted outer host runner as its first", "   and only invocation. On Codex, the outer tool request must use", "   `sandbox_permissions: \"require_escalated\"` so network and loopback", "   are available; in that same request, unset", "   `CODEX_SANDBOX_NETWORK_DISABLED` and set `AGENT_OPS_HOST` when three", "   targets are configured. The Codex shell form is", "   `env -u CODEX_SANDBOX_NETWORK_DISABLED AGENT_OPS_HOST=<current-host> agent-ops review --task <task-id> --yes`.", "   Keep it a plain command line: to keep the output add `--output <file>`", "   (the JSON envelope is written there and one line is printed) instead of", "   a shell redirect, which the host can only allow by matching the whole", "   command string, task id included.", "   Do not run it once in the restricted sandbox and retry; changing the", "   variable inside that sandbox is not elevation.", "   Review runs exactly two fresh sessions: with three configured targets,", "   set `AGENT_OPS_HOST` to the current CLI id so it is excluded; with two", "   targets both run in configured order; with one target it runs twice.", "   The first session is necessary; a PASS then requires an adversarial", "   re-check carrying the first report. A first FAIL or NOT_RUN stops.", "", "Treat `.agent-ops/config.json` as verifier authority. Discovery output is", "only a proposal until a user confirms it. Repository commands require an", "exact matching trust record. Confirmed project init/update grants it", "automatically when verification commands are configured.", "");
     }
     if (context.capabilities.includes("task")) {
         lines.push("Split a change that exceeds five acceptance criteria into subtasks:", "`agent-ops task create --parent <task-id>` records one, and", "`agent-ops task status --parent <task-id>` lists them. Each subtask", "carries its own criteria and verification; final review covers all", "tasks together when their worktrees are integrated;", "completing one never completes its parent.", "", ...autoRunInstruction(descriptor, context), "To review every active subtask of a parent together, run", "`agent-ops batch --parent <task-id> --yes` instead of one review per", "subtask. It needs what review needs: start it through the trusted outer", "host runner as its first and only invocation, with the same Codex", "elevation, and keep `--output <file>` instead of a shell redirect. It", "verifies, one task at a time, each task that lacks fresh evidence, and", "reviews a few tasks at once. Do not commit or edit the worktree while it", "runs: a moved HEAD voids every verify and review in the batch.", "For subagents in separate worktrees, use `task advance` instead.", "", "Delegate a subtask whose scope spans unknown files, broad scans, or an", "independent workstream instead of doing it inline. Name the bounded", "scope, the artifact to return, and the acceptance criteria it serves.", subagentInstruction(descriptor), "Read every returned artifact back yourself: integration, verification,", "and review stay with the coordinator.", "", "One writer at a time. `agent-ops verify` and `agent-ops review`", "fingerprint the working tree and report UNKNOWN when anything else", "writes it during the run, so delegate edits to one subagent at a time,", "or give each writer its own Git worktree and merge before verifying.", "Read-only delegation has no such limit and may run in parallel.", "", "Parallel conversations in one repository each need their own worktree.", "When `.agent-ops/config.json` sets `worktree.mode` to `auto`, run", "`agent-ops task create` from the main checkout before your first edit:", "it creates this session's worktree and puts the task there (`agent-ops", "worktree add <name> --session <session-id>` does the same without a", "task). Work only inside the printed path", "(Claude Code: EnterWorktree with that path; otherwise use it as every", "command's working directory). Commit, then run verify and review for", "each task with the printed `--base`; do not run `task complete` in the", "worktree. Leave it (Claude Code: ExitWorktree with action keep) and run", "`agent-ops worktree finish <name>` from the main checkout: it completes", "every task in the worktree, subtasks first, then merges. A finish that", "reports an incomplete task names it; verify or review that task again", "in the worktree and finish again. A finish that reports a conflict is", "resolved once, as a new task whose criteria cover both intents; if its", "verification or review fails, reset as instructed and report.", "", "For a session with writing subagents, record each child task's complete", "modification intent with `task create --intent <text>` before editing.", "Each child commits and runs local `verify --task` in its own worktree.", "From the main checkout run `agent-ops task advance --task <parent-id>", "--session <session-id> --yes` through the trusted outer host runner,", "unsetting `CODEX_SANDBOX_NETWORK_DISABLED` on Codex. Advance integrates", "child commits and intent into the coordinator worktree, verifies every", "task on the final candidate, then runs one two-round tree review.", "Only `NOT_RUN / scope-too-large` falls back to per-task two-round review;", "a substantive FAIL must be fixed. After PASS, advance writes a local", "receipt under the main checkout's Git common directory and calls finish.", "If the target moves, it retries the final gate once. An unresolved", "failure preserves worktrees and cannot be reported as finished.", "");

package/dist/runtime/src/install/plan.js

@@ -88,7 +88,7 @@ function buildConfig(profiles, existing, reviewTargets = [], detectedCommands =
     const verification = existing?.verification !== undefined &&
         existing.verification.commands.length > 0
         ? existing.verification
-        : { commands: [...detectedCommands] };
+        : { ...existing?.verification, commands: [...detectedCommands] };
     // Pre-0.11 DEBUG budget settings are dropped on rewrite.
     const existingFeatures = existing === undefined ? undefined : (({ debug: _legacyDebug, ...rest }) => rest)(existing.features);
     const effectiveWorktree = worktree !== undefined

package/dist/runtime/src/parallel/finish.js

@@ -318,9 +318,12 @@ export async function finishWorktree(deps, options) {
     return await withActivity(commonDir, { kind: "finish", root: record.path, sessionId: record.sessionId, worktree: name }, async () => await withFinishLock(deps, commonDir, async () => {
         const listing = await git(deps, mainRoot, ["worktree", "list", "--porcelain"], "WORKTREE_LIST_FAILED", "Cannot list cleanup worktrees.");
         const records = await Promise.all(parseWorktreeListPorcelain(listing).map(child => readWorktreeRecord(child.path)));
+        const keepChildren = options.finalProof?.keepChildren === true;
         const sessionChildren = records
-            .filter((child) => child !== null && child.path !== record.path && child.sessionId === record.sessionId &&
-            (child.agentId !== undefined || (record.runId !== undefined && child.runId === record.runId)));
+            .filter((child) => child !== null && child.path !== record.path && (keepChildren
+            ? options.finalProof.children.some(({ name }) => name === child.name)
+            : child.sessionId === record.sessionId &&
+                (child.agentId !== undefined || (record.runId !== undefined && child.runId === record.runId))));
         if (options.finalProof?.recovery === true && record.runId !== undefined) {
             const saved = await new FileRunRepository(join(commonDir, "agent-ops/runs"), commonDir).read(record.runId);
             if (["receipt-written", "cleaned"].includes(saved?.integration?.status ?? ""))
@@ -579,7 +582,7 @@ export async function finishWorktree(deps, options) {
                 // this session began would leave it reading the merge as its own change.
                 // Only this worktree leaves the session; its other roots stay covered.
                 await mainGate.afterFinish(record.sessionId, record.path, after);
-                if (options.finalProof !== undefined) {
+                if (options.finalProof !== undefined && !keepChildren) {
                     for (const child of sessionChildren) {
                         await mainGate.afterFinish(record.sessionId, child.path, after);
                     }
@@ -593,7 +596,7 @@ export async function finishWorktree(deps, options) {
         await attempt("trust", async () => await deps.trust.revoke(record.path, worktreeConfig));
         if (receiptOptions !== undefined)
             await markRunIntegration(commonDir, record, "receipt-written", "trust");
-        if (options.finalProof !== undefined) {
+        if (options.finalProof !== undefined && !keepChildren) {
             for (const child of sessionChildren) {
                 await attempt(`child ${child.name}`, async () => {
                     const pinnedHead = await assertPinnedChild(child);

package/dist/runtime/src/parallel/integrate.js

@@ -156,11 +156,13 @@ async function previous(record) {
     return value;
 }
 /** Integrate only this session's agent-owned branches; local proof is never promoted as final proof. */
-export async function integrateSessionChildren(deps, coordinator, parentTaskId, eligibleRunWorkerIds) {
-    const statuses = await listWorktrees(deps, coordinator.mainRoot);
-    const children = statuses.map(({ record }) => record)
+export async function integrateSessionChildren(deps, coordinator, parentTaskId, eligibleRunWorkerIds, 
+/** Another session's children chosen by the caller (`run land`); replaces the session filter only. */
+explicitChildren) {
+    const statuses = explicitChildren === undefined ? await listWorktrees(deps, coordinator.mainRoot) : [];
+    const children = (explicitChildren ?? statuses.map(({ record }) => record)
         .filter((record) => record.name !== coordinator.name && record.sessionId === coordinator.sessionId &&
-        (record.agentId !== undefined || (coordinator.runId !== undefined && record.runId === coordinator.runId)))
+        (record.agentId !== undefined || (coordinator.runId !== undefined && record.runId === coordinator.runId))))
         .filter(record => eligibleRunWorkerIds === undefined || (record.workerId !== undefined && eligibleRunWorkerIds.includes(record.workerId)))
         .sort((a, b) => a.name.localeCompare(b.name));
     const integrated = await previous(coordinator);

package/dist/runtime/src/review/attestation.js

@@ -444,13 +444,11 @@ function blockingFindings(artifact) {
     return findings;
 }
 /**
- * Blocking findings of this task's most recent decided review, when that
- * review failed. NOT_RUN artifacts decide nothing and are skipped; a newer
- * PASS settles the earlier findings, so none are returned. Any unreadable
- * record is ignored: these are a hint for the next reviewer, and without them
- * the review simply runs as it always has.
+ * This task's decided reviews: PASS, or FAIL with a report. NOT_RUN artifacts
+ * decide nothing and are skipped, as is any unreadable record: callers use
+ * these as hints, and without them review simply runs as it always has.
  */
-export async function findPriorFailingFindings(root, taskId) {
+async function decidedTaskReviews(root, taskId) {
     const directory = join(root, ...REVIEW_ATTESTATION_DIRECTORY.split("/"));
     let names;
     try {
@@ -460,7 +458,7 @@ export async function findPriorFailingFindings(root, taskId) {
         return [];
     }
     // ponytail: linear scan of every report; index by task if the directory grows large.
-    let latest;
+    const decided = [];
     for (const name of names) {
         // `<fingerprint>` or `<fingerprint>.<task id>`, then the suffix.
         const key = name.slice(0, -REVIEW_REPORT_ARTIFACT_SUFFIX.length);
@@ -475,23 +473,47 @@ export async function findPriorFailingFindings(root, taskId) {
                 continue;
             }
             const value = JSON.parse(source);
-            const decided = value.status === "PASS" ||
-                (value.status === "FAIL" && value.report !== undefined);
             if (![1, 2].includes(value?.schemaVersion) ||
                 value.sourceFingerprint !== fingerprint ||
                 value.taskId !== taskId ||
-                !decided ||
+                !(value.status === "PASS" || (value.status === "FAIL" && value.report !== undefined)) ||
                 !Number.isFinite(Date.parse(value.createdAt))) {
                 continue;
             }
-            if (latest === undefined || Date.parse(value.createdAt) > Date.parse(latest.createdAt)) {
-                latest = value;
-            }
+            decided.push(value);
         }
         catch {
             continue;
         }
     }
+    return decided;
+}
+/** After this many failed reviews of one contract, review stops and asks for a rethink. */
+export const REVIEW_ROUND_CAP = 3;
+/**
+ * Failed reviews of this task under its current contract since its latest
+ * PASS. Each source fingerprint keeps one report, so re-reviewing unchanged
+ * code does not add a round; a contract revision starts the count again.
+ */
+export async function countFailedReviewRounds(root, taskId, contractHash) {
+    const reviews = await decidedTaskReviews(root, taskId);
+    const lastPass = Math.max(-Infinity, ...reviews.filter(review => review.status === "PASS")
+        .map(review => Date.parse(review.createdAt)));
+    return reviews.filter(review => review.status === "FAIL" && review.taskContractHash === contractHash &&
+        Date.parse(review.createdAt) > lastPass).length;
+}
+/**
+ * Blocking findings of this task's most recent decided review, when that
+ * review failed. A newer PASS settles the earlier findings, so none are
+ * returned.
+ */
+export async function findPriorFailingFindings(root, taskId) {
+    let latest;
+    for (const value of await decidedTaskReviews(root, taskId)) {
+        if (latest === undefined || Date.parse(value.createdAt) > Date.parse(latest.createdAt)) {
+            latest = value;
+        }
+    }
     if (latest?.status !== "FAIL") {
         return [];
     }

package/dist/runtime/src/review/criteria.js

@@ -74,13 +74,14 @@ async function readReport(path, root) {
     if (Buffer.byteLength(source) > 512 * 1024)
         throw new Error("Advisory artifact exceeds limit.");
     const value = JSON.parse(source);
-    if (!record(value) || Object.keys(value).some(key => !["kind", "taskId", "attemptId", "snapshotHash", "snapshot", "status", "code", "startedAt", "durationMs", "invocations", "ownerPid", "ownerIdentity", "target", "advice", "usage"].includes(key)) ||
+    if (!record(value) || Object.keys(value).some(key => !["kind", "taskId", "attemptId", "snapshotHash", "snapshot", "status", "code", "startedAt", "durationMs", "invocations", "ownerPid", "ownerIdentity", "target", "advice", "usage", "trigger"].includes(key)) ||
         value.kind !== "criteria-advisory" || !validText(value.taskId) || typeof value.attemptId !== "string" || !/^[a-f0-9-]{36}$/u.test(value.attemptId) ||
         !Number.isSafeInteger(value.ownerPid) || value.ownerPid < 1 ||
         (value.ownerIdentity !== null && !validText(value.ownerIdentity)) ||
         !validText(value.code) || !validText(value.startedAt) || !Number.isFinite(Date.parse(value.startedAt)) ||
         !Number.isSafeInteger(value.durationMs) || value.durationMs < 0 || ![0, 1].includes(value.invocations) ||
         (value.target !== undefined && !["agy", "claude", "codex"].includes(String(value.target))) ||
+        (value.trigger !== undefined && !["create", "rerun", "revise"].includes(String(value.trigger))) ||
         (value.usage !== undefined && (!record(value.usage) || Object.entries(value.usage).some(([key, n]) => !["inputTokens", "outputTokens", "cacheReadTokens", "cacheWriteTokens", "totalTokens", "costUsd"].includes(key) || typeof n !== "number" || !Number.isFinite(n) || n < 0))) ||
         typeof value.snapshotHash !== "string" || !/^[a-f0-9]{64}$/u.test(value.snapshotHash) || !record(value.snapshot) ||
         !["RUNNING", "COMPLETED", "NOT_RUN", "CANCELLED"].includes(String(value.status)) ||
@@ -101,12 +102,28 @@ async function ownerAlive(report) {
         return error.code !== "ESRCH";
     }
 }
+/**
+ * The surface audit is reviewed but is not what the advice is about: classifying
+ * one more discovery hit must not make the criteria look unreviewed. The stored
+ * snapshot is redacted, so the current one is redacted the same way.
+ */
+function criteriaCore(snapshot) {
+    const { surface: _surface, ...core } = snapshot;
+    return canonicalJson(core);
+}
+function coreChanged(report, snapshot) {
+    return criteriaCore(report.snapshot) !== criteriaCore(redactData(snapshot));
+}
+/** One automatic round after a substantive revise; after it only an explicit --rerun makes another due. */
+export function revisionReviewDue(view) {
+    return view !== null && view.stale && view.report.trigger !== "revise" && view.report.status !== "RUNNING";
+}
 export async function readCriteriaReview(root, task, parent) {
     try {
         const path = reportPath(root, task.id), report = await readReport(path, root);
         if (report === null || report.taskId !== task.id)
             return null;
-        return { report, reportPath: path, stale: report.snapshotHash !== sha256(canonicalJson(criteriaSnapshot(task, parent))), warnings: [] };
+        return { report, reportPath: path, stale: coreChanged(report, criteriaSnapshot(task, parent)), warnings: [] };
     }
     catch {
         return null;
@@ -119,7 +136,7 @@ export function renderCriteriaReview(view) {
         "Private report: " + view.reportPath, (report.advice === undefined ? undefined : safeTaskText(report.advice.summary)) ?? "No completed advice is available.",
         ...(report.advice?.recommendations ?? []).map(r => `[${safeTaskText(r.criterionId)}] ${safeTaskText(r.issue)}\nSuggestion: ${safeTaskText(r.recommendation)}\nWhy: ${safeTaskText(r.reason)}`),
         ...(report.advice?.limitations ?? []).map(s => "Limitation: " + safeTaskText(s)), ...view.warnings,
-        "Advisory only. Decide which suggestions to adopt; use task revise and record reasons, including rejections. Revision does not rerun this review. Final verification and two-round review are still required."
+        "Advisory only. Decide which suggestions to adopt; use task revise and record reasons, including rejections. The first revise that changes criteria, intent or goal reruns this review once; later ones need an explicit --rerun. Final verification and two-round review are still required."
     ].join("\n");
 }
 function cancelled(signal) {
@@ -134,10 +151,10 @@ export async function runCriteriaReview(options) {
     let report = { kind: "criteria-advisory", taskId: task.id, attemptId: randomUUID(), snapshotHash,
         snapshot: redactData(snapshot), status: "RUNNING", code: "CRITERIA_REVIEW_RUNNING",
         startedAt: new Date().toISOString(), durationMs: 0, invocations: 0, ownerPid: process.pid, ownerIdentity: await nativeProcessIdentity(process.pid),
-        ...(options.target === undefined ? {} : { target: options.target }) };
+        ...(options.target === undefined ? {} : { target: options.target }), trigger: options.trigger ?? (options.rerun ? "rerun" : "create") };
     const newAttempt = report;
     const warnings = [];
-    const view = () => ({ report, reportPath: path, stale: report.snapshotHash !== snapshotHash, warnings });
+    const view = () => ({ report, reportPath: path, stale: coreChanged(report, snapshot), warnings });
     let claimed = false;
     try {
         for (;;) {

package/dist/runtime/src/review/report.js

@@ -64,7 +64,8 @@ function location(value, path, errors) {
 }
 function finding(value, path, errors) {
     if (!isRecord(value) || !exactFields(value, [
-        "severity", "blocking", "title", "details", "locations", "evidence", "recommendation", "criterionIds"
+        "severity", "blocking", "title", "details", "locations", "evidence", "recommendation", "criterionIds",
+        ...("origin" in value ? ["origin"] : [])
     ], path, errors)) {
         return undefined;
     }
@@ -73,8 +74,10 @@ function finding(value, path, errors) {
         !Array.isArray(value.locations) || value.locations.length > MAX_ARRAY ||
         !textArray(value.evidence) || value.evidence.length === 0 || !isText(value.recommendation) ||
         !textArray(value.criterionIds) || new Set(value.criterionIds).size !== value.criterionIds.length ||
-        (value.severity === "critical" && value.blocking !== true) ||
-        (value.severity === "minor" && value.blocking !== false)) {
+        (value.origin !== undefined && value.origin !== "introduced" && value.origin !== "pre-existing") ||
+        (value.origin === "pre-existing" ? value.blocking !== false :
+            (value.severity === "critical" && value.blocking !== true) ||
+                (value.severity === "minor" && value.blocking !== false))) {
         invalid(errors, path, "INVALID_FINDING", "Finding is invalid.");
         return undefined;
     }
@@ -90,7 +93,8 @@ function finding(value, path, errors) {
         locations: locations,
         evidence: [...value.evidence],
         recommendation: value.recommendation,
-        criterionIds: [...value.criterionIds]
+        criterionIds: [...value.criterionIds],
+        ...(value.origin === undefined ? {} : { origin: value.origin })
     };
 }
 export function validateReviewReport(value, requestedCriterionIds, changedFiles) {

package/dist/runtime/src/review/runner.js

@@ -22,6 +22,12 @@ const CONTRACT_INSTRUCTIONS = [
         "every changed path is still required and is checked on your reply.",
     "Report every blocking defect you find in this one reply, not only the " +
         "first: each defect left for a later round costs another full review.",
+    "A defect is pre-existing when it is present identically at the base and " +
+        "this change did not introduce, expose, worsen or depend on it. Report " +
+        "only pre-existing defects you meet while reading for this review; do not " +
+        "search for them. Give each one origin 'pre-existing' and blocking false, " +
+        "whatever its severity: it goes to followup, not to this change. Every " +
+        "other finding has origin 'introduced'.",
     "Every FAIL criterion must have at least one blocking finding whose " +
         "criterionIds includes it. Blocking findings may reference only FAIL " +
         "criteria.",
@@ -30,7 +36,8 @@ const CONTRACT_INSTRUCTIONS = [
         "summary:string,evidence:string[]}],findings:[{severity:'critical'|" +
         "'important'|'minor',blocking:boolean,title:string,details:string," +
         "locations:[{path:string,line?:integer}],evidence:string[]," +
-        "recommendation:string,criterionIds:string[]}],residualRisks:string[]," +
+        "recommendation:string,criterionIds:string[]," +
+        "origin?:'introduced'|'pre-existing'}],residualRisks:string[]," +
         "changedFilesInspected:string[],supportingFilesInspected:string[]}. " +
         "All descriptive strings and evidence arrays must be non-empty."
 ];
@@ -290,7 +297,8 @@ export function redactReviewReport(report) {
             })),
             evidence: finding.evidence.map((value) => safeTaskText(redactSecrets(value))),
             recommendation: safeTaskText(redactSecrets(finding.recommendation)),
-            criterionIds: finding.criterionIds.map((value) => safeTaskText(redactSecrets(value)))
+            criterionIds: finding.criterionIds.map((value) => safeTaskText(redactSecrets(value))),
+            ...(finding.origin === undefined ? {} : { origin: finding.origin })
         })),
         residualRisks: report.residualRisks.map((value) => safeTaskText(redactSecrets(value))),
         changedFilesInspected: report.changedFilesInspected.map((value) => safeTaskText(redactSecrets(value))),

package/dist/runtime/src/run/land.js

@@ -0,0 +1,145 @@
+import { randomUUID } from "node:crypto";
+import { hostname } from "node:os";
+import { join } from "node:path";
+import { calculateConfigHash } from "../config/hash.js";
+import { sha256 } from "../fs/hash.js";
+import { AgentOpsError } from "../fs/paths.js";
+import { listWorktrees } from "../parallel/manage.js";
+import { addWorktree, readWorktreeRecord, removeCheckout, sessionWorktreeName } from "../parallel/service.js";
+import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
+import { landingMarkerLive, MAX_EVENTS } from "./service.js";
+const LIVE_WORKER = ["assigned", "starting", "running", "idle", "handing-off"];
+const LANDABLE = ["paused", "blocked", "budget-limited"];
+/** Inside the landing worktree; names the run that owns it so another run never reuses it. */
+const OWNER_FILE = join(".agent-ops", "tasks", "run-landing.json");
+export function assertLandable(state) {
+    if (!LANDABLE.includes(state.status) || state.rootTaskId === null ||
+        state.workers.some(worker => LIVE_WORKER.includes(worker.status)))
+        throw new AgentOpsError("RUN_LAND_STATE_INVALID", `Run ${state.runId} is ${state.status}; land needs a paused, blocked or budget-limited run with a root task and no live worker.`);
+}
+/** Unlanded delivered children, or the requested ones; every dependency must be selected or already landed. */
+export function selectLanding(state, requested) {
+    const landed = new Set((state.landings ?? []).flatMap(landing => landing.taskIds));
+    const eligible = state.tasks.filter(task => task.taskId !== state.rootTaskId && task.status === "delivered" &&
+        task.sourceCommit !== null && !landed.has(task.taskId));
+    for (const id of requested ?? [])
+        if (!eligible.some(task => task.taskId === id))
+            throw new AgentOpsError("RUN_LAND_TASK_INVALID", `${id} is not an unlanded delivered task of run ${state.runId}.`);
+    const selected = requested === undefined ? eligible : eligible.filter(task => requested.includes(task.taskId));
+    if (selected.length === 0)
+        throw new AgentOpsError("RUN_LAND_NOTHING", `Run ${state.runId} has no unlanded delivered task.`);
+    const ids = new Set(selected.map(task => task.taskId));
+    for (const task of selected)
+        for (const dependency of task.dependencies)
+            if (!ids.has(dependency) && !landed.has(dependency))
+                throw new AgentOpsError("RUN_LAND_DEPENDENCY_OPEN", `${task.taskId} depends on ${dependency}, which is neither selected nor landed.`);
+    return selected;
+}
+/**
+ * One landing session per attempt: a non-hex first letter keeps it apart from
+ * UUID sessions, and a fresh path per attempt never reuses a removed checkout.
+ */
+export function landingSessionId(runId, nonce = randomUUID()) {
+    return `l${sha256(`${runId}:${nonce}`).slice(0, 7)}${LANDING_SUFFIX}${runId}`;
+}
+const LANDING_SUFFIX = "-land-";
+async function git(deps, cwd, args) {
+    const result = await deps.git(cwd, args);
+    if (result.exitCode !== 0)
+        throw new AgentOpsError("RUN_LAND_GIT_FAILED", `${args.join(" ")}: ${result.stderr.trim()}`);
+    return result.stdout.trim();
+}
+/** The worker checkout whose committed head is the frozen delivery. */
+async function deliveredCheckout(deps, state, task) {
+    for (const worker of state.workers.filter(worker => worker.taskId === task.taskId && worker.worktree !== null)) {
+        const record = await readWorktreeRecord(worker.worktree);
+        if (record !== null && await git(deps, record.path, ["rev-parse", "HEAD"]) === task.sourceCommit)
+            return record;
+    }
+    throw new AgentOpsError("RUN_LAND_DELIVERY_MISSING", `No preserved checkout of ${task.taskId} is at its delivered commit ${task.sourceCommit}.`);
+}
+async function ownerOf(path) {
+    try {
+        const owner = JSON.parse(await readPrivateFile(join(path, OWNER_FILE), path) ?? "null");
+        return typeof owner?.runId === "string" ? owner.runId : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Worktrees kept by this run's failed attempts are removed first; one that claims the run without proof is refused. */
+async function freshLandingWorktree(deps, state, sessionId) {
+    const claimed = (await listWorktrees(deps, state.root)).map(({ record }) => record)
+        .filter(record => record.sessionId.endsWith(LANDING_SUFFIX + state.runId));
+    for (const record of claimed)
+        if (await ownerOf(record.path) !== state.runId)
+            throw new AgentOpsError("RUN_LAND_WORKTREE_FOREIGN", `${record.path} claims run ${state.runId} without its owner record; it was left untouched.`);
+    for (const record of claimed)
+        await removeCheckout(deps, record, true);
+    const record = (await addWorktree(deps, { cwd: state.root, name: sessionWorktreeName(sessionId), sessionId,
+        from: state.targetBranch, targetBranch: state.targetBranch })).record;
+    await writePrivateFile(join(record.path, OWNER_FILE), JSON.stringify({ runId: state.runId }), record.path);
+    return record;
+}
+async function createLandingRoot(deps, state, record, selected) {
+    const config = await deps.loadConfig(record.path);
+    const required = config.verification.commands.filter(command => command.required).map(command => command.id);
+    if (required.length === 0)
+        throw new AgentOpsError("RUN_LAND_VERIFIER_REQUIRED", "Landing proof needs at least one required verification command.");
+    const coordinator = state.workers.find(worker => worker.workerId === state.coordinatorId)?.worktree ?? null;
+    const root = coordinator === null ? null : await deps.tasks(coordinator).status({ taskId: state.rootTaskId }).catch(() => null);
+    const ids = selected.map(task => task.taskId);
+    const base = await git(deps, record.path, ["rev-parse", "HEAD"]);
+    const criteria = [
+        { id: "landed-verifiers", description: "Every required project verifier passes on the integrated candidate of the landed tasks.", verifierIds: required },
+        { id: "landed-coherent", verifierIds: [],
+            description: "The landed subset is coherent on its own: it exposes no half-finished behavior and references no work of an undelivered run task.",
+            acceptance: { mode: "review-only", baselineCommit: base, bindings: [],
+                reviewOnlyReason: "partial-landing coherence: whether a subset stands alone without the undelivered tasks is a reviewer judgment, not a mechanical check" } }
+    ];
+    // Typed acceptance needs repository context; the target head is the landing baseline.
+    const created = await deps.tasks(record.path, base).create({
+        title: `Land ${ids.join(", ")} from ${state.runId}`,
+        goal: `Land delivered tasks ${ids.join(", ")} of run ${state.runId} ahead of the rest of its goal:\n${state.goal}`.slice(0, 64_000),
+        intent: "Merge only the frozen deliveries of the listed run tasks; the run, its root task and its checkouts stay as they are.",
+        criteria, createdSourceCommit: base, policyConfigHash: calculateConfigHash(config), sessionId: record.sessionId,
+        ...(root?.task.surface === undefined ? {} : { surface: root.task.surface })
+    });
+    return created.task.id;
+}
+/**
+ * `agent-ops run land`: prove and merge delivered children of a stopped run
+ * while the run stays resumable. Landed tasks remain delivered, so a later
+ * resume and finalize re-verify the whole goal on the new target.
+ */
+export async function landRun(options) {
+    const now = options.now ?? (() => new Date().toISOString());
+    let selected = [];
+    const held = await options.repository.mutate(options.runId, current => {
+        if (landingMarkerLive(current.landing))
+            throw new AgentOpsError("RUN_LANDING_IN_PROGRESS", `Run ${current.runId} is already landing delivered work.`);
+        assertLandable(current);
+        selected = selectLanding(current, options.taskIds);
+        return { ...current, landing: { processId: process.pid, hostname: hostname(), startedAt: now() } };
+    });
+    const taskIds = selected.map(task => task.taskId);
+    try {
+        const children = [];
+        for (const task of selected)
+            children.push(await deliveredCheckout(options.deps, held, task));
+        const sessionId = landingSessionId(held.runId);
+        const record = await freshLandingWorktree(options.deps, held, sessionId);
+        const parentTaskId = await createLandingRoot(options.deps, held, record, selected);
+        const { receipt } = await options.advance({ cwd: held.root, sessionId, parentTaskId, children });
+        const target = await git(options.deps, held.root, ["rev-parse", `${held.targetBranch}^{commit}`]);
+        const state = await options.repository.mutate(options.runId, current => ({ ...current, landing: null,
+            landings: [...(current.landings ?? []), { taskIds, receipt, target, landedAt: now() }],
+            events: [...current.events, { id: randomUUID(), at: now(), type: "integration", code: "RUN_PARTIAL_LANDED",
+                    workerId: null, taskId: null, detail: `Landed ${taskIds.join(", ")} at ${target}; receipt ${receipt}.` }].slice(-MAX_EVENTS) }));
+        return { state, taskIds, receipt };
+    }
+    catch (cause) {
+        await options.repository.mutate(options.runId, current => ({ ...current, landing: null })).catch(() => undefined);
+        throw cause;
+    }
+}

package/dist/runtime/src/run/service.js

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir } from "node:fs/promises";
+import { hostname } from "node:os";
 import { basename, join } from "node:path";
 import { sha256 } from "../fs/hash.js";
 import { AgentOpsError } from "../fs/paths.js";
@@ -10,6 +11,28 @@ import { redactSecrets } from "../security/redact.js";
 export const RUN_PHASES = ["planning", "implementing", "verifying", "reviewing", "integrating"];
 /** Writer slots are deliberately bounded; the coordinator may occupy one. */
 export const MAX_ACTIVE_WORKERS = 2;
+/**
+ * A marker from another host is treated as live: its process cannot be probed.
+ *
+ * ponytail: a reused pid on this host reads as live; clear the marker by hand if that ever bites.
+ */
+export function landingMarkerLive(marker) {
+    if (marker == null)
+        return false;
+    if (marker.hostname !== hostname())
+        return true;
+    try {
+        process.kill(marker.processId, 0);
+        return true;
+    }
+    catch (cause) {
+        return cause.code === "EPERM";
+    }
+}
+function refuseWhileLanding(state) {
+    if (landingMarkerLive(state.landing))
+        throw new AgentOpsError("RUN_LANDING_IN_PROGRESS", `Run ${state.runId} is landing delivered work; wait for run land to finish.`);
+}
 const RUN_ID = /^[a-z][a-z0-9-]{7,63}$/u;
 const ID = /^[A-Za-z0-9._:/-]{1,256}$/u;
 const SHA = /^[a-f0-9]{40,64}$/u;
@@ -127,6 +150,15 @@ export function assertRunState(value) {
         return invalid("Run phase or task progress is invalid.");
     if (state.policyBinding !== undefined && !validPolicyBinding(state.policyBinding))
         return invalid("Invalid run policy binding.");
+    if (state.landings !== undefined && (!boundedArray(state.landings, 512) || state.landings.some(l => !plain(l) ||
+        !boundedArray(l.taskIds, 512) || l.taskIds.length === 0 || l.taskIds.some(id => !ID.test(String(id))) ||
+        typeof l.receipt !== "string" || l.receipt.length === 0 || l.receipt.length > 4096 ||
+        !SHA.test(String(l.target)) || !Number.isFinite(Date.parse(String(l.landedAt))))))
+        return invalid("Invalid run landing record.");
+    if (state.landing != null && (!plain(state.landing) || !Number.isSafeInteger(state.landing.processId) ||
+        state.landing.processId < 1 || typeof state.landing.hostname !== "string" || state.landing.hostname.length > 256 ||
+        !Number.isFinite(Date.parse(String(state.landing.startedAt)))))
+        return invalid("Invalid run landing marker.");
     if (state.proofProcess != null && (!plain(state.proofProcess) || !Number.isSafeInteger(state.proofProcess.processId) ||
         state.proofProcess.processId < 1 || typeof state.proofProcess.processIdentity !== "string" ||
         state.proofProcess.processIdentity.length === 0 || state.proofProcess.processIdentity.length > 256))
@@ -442,6 +474,7 @@ export class RunService {
     }
     async resume(runId, retryApprovalIds = [], upgradeBudget = true, retryDeliveryTaskId, expectedFailureId) {
         const state = await this.#repository.mutate(runId, async (current) => {
+            refuseWhileLanding(current);
             if (retryDeliveryTaskId !== undefined && retryApprovalIds.length > 0)
                 throw new AgentOpsError("RUN_DELIVERY_RETRY_INVALID", "Delivery and approval retries require separate explicit controls.");
             const retry = retryDeliveryTaskId === undefined ? null : validateDeliveryRetry(current, retryDeliveryTaskId, Date.parse(this.#now()));
@@ -491,6 +524,7 @@ export class RunService {
         const cleanAnswer = bounded(answer.trim(), "answer", MAX_GOAL_LENGTH);
         const state = await this.#repository.mutate(runId, (current) => {
             const question = current.questions.find((item) => item.questionId === cleanQuestion);
+            refuseWhileLanding(current);
             if (current.status !== "awaiting-input" || current.disableRestart)
                 throw new AgentOpsError("RUN_NOT_AWAITING_INPUT", "Respond cannot restart a stopped or terminal run.");
             if (question === undefined)

package/docs/en/spec/harness-adapters.md

@@ -174,7 +174,8 @@ removes only `run` and keeps `loop`.
   ends without completing (blocked, budget exhausted, stopped, failing review)
   is reported with its `run status` state and code, its last `run logs` events,
   and the exact `agent-ops run resume <id>` and `agent-ops run stop <id>`
-  commands, and is never resumed automatically or taken over by the session.
+  commands, plus `agent-ops run land <id> --yes` when it has delivered tasks,
+  and is never resumed or landed automatically or taken over by the session.
   With worktree auto mode, the Claude `PreToolUse` worktree guard allows a
   write to exactly `.agent-ops/state/run-goal.md` in the main checkout without
   creating a worktree. Confirmed init/update pre-authorizes `agent-ops run`:

package/docs/en/spec/loop-engineering.md

@@ -73,6 +73,19 @@
   Interrupted controlled proof MUST record bounded redacted exit/signal, result
   failure stage and subprocess diagnostics without treating invalid output or a
   nonzero successful envelope as proof.
+- `run land <id> [--task <task-id>]... --yes` MAY merge delivered children of a
+  paused, blocked or budget-limited run with no live worker ahead of the rest.
+  Every selected task's dependencies MUST be selected or already landed
+  (`RUN_LAND_DEPENDENCY_OPEN`). Proof runs in a fresh landing worktree from the
+  target under a generated root task (required verifiers plus a review-only
+  coherence criterion, the run root's surface), then the usual verification,
+  two-round tree review and receipt-bound finish. The run's checkouts are pinned
+  and never removed; landed tasks stay delivered, the run stays resumable and
+  records `landings[]` and `RUN_PARTIAL_LANDED`, and its final proof re-verifies
+  the whole goal on the new target. While landing, a marker refuses resume,
+  respond and another land (`RUN_LANDING_IN_PROGRESS`); a marker of a process
+  that no longer exists does not block. A failure leaves the target unchanged
+  and keeps the landing worktree until the next land removes it.
   Initial recovery after a current manual resume MAY ignore an owned Codex limit
   snapshot received before activation whose native update second strictly predates
   that resume. Automatic restarts, unknown/equal/future timestamps, clock rollback,

package/docs/en/spec/review.md

@@ -5,14 +5,14 @@
 - Trigger: Production task criteria become ready before implementation.
 - Action: Await one scoped advisory and let the writer record adoption/rejection reasons.
 - Evidence: Private snapshot report plus safe local status/usage log; no completion attestation.
-- Positive: `A revised task shows historical advice and only an explicit rerun spends another round.`
-- Negative: `Automatically re-review every revise or treat advice as final PASS proof.`
+- Positive: `Adopting advice rewrites a criterion; that revise reruns the advisory once and shows the new advice.`
+- Negative: `Re-review every revise, including surface-only ones, or treat advice as final PASS proof.`
 
 Every production task creation (including DEBUG, replan children and native run root/child tasks) MUST wait for one independent criteria advisory before implementation. A fresh session uses one configured independent-review target, preferring a different target from the host. It receives only the original goal, assigned intent/covers, criteria and surface audit in an empty disposable workspace. It MUST NOT inspect repository files or run tests. Missing goals are insufficient information; child completeness is scoped to its assignment. Verification materials/import validity remain deferred until implementation; reasoned review-only acceptance is valid.
 
 The advisory has no agent-ops execution deadline, stall cutoff or token budget. Provider limitations, genuine launch/auth/output errors and explicit cancellation remain effective. Errors produce NOT_RUN and permit work; cancellation preserves the task and MUST stop implementation. Native review processes remain registered and stoppable. Normal verification and final two-round review retain their existing deadlines and gates.
 
-Task creation shows advice and a private report reference. The writer decides which recommendations to adopt and records acceptance/rejection reasons through task revise (a same-criteria revision may record rejected advice). Requirements that are ambiguous or expand scope require user clarification. Reports bind the original task/goal/criteria/surface snapshot; task status and revise show historical reports as stale when those inputs change. A revision MUST NOT automatically re-review. Repeated initial requests reuse the first attempt, including NOT_RUN; only explicit `agent-ops review --criteria --task <id> --rerun --yes` starts another fresh single round. Without --rerun the same command reads/waits for the current attempt.
+Task creation shows advice and a private report reference. The writer decides which recommendations to adopt and records acceptance/rejection reasons through task revise (a same-criteria revision may record rejected advice). Requirements that are ambiguous or expand scope require user clarification. Reports bind the original task/goal/criteria/surface snapshot and record their trigger (`create`, `rerun` or `revise`; absent on older reports). Task status and revise show a report as stale when the goal, intent, criteria or assigned scope change; a surface-only change leaves it current. The first saved revision that makes the current report stale, when that report was not itself revise-triggered, MUST wait for one automatic fresh round (trigger `revise`) and show its advice; the revision is kept whether that round completes, reports NOT_RUN or is cancelled. Further revisions MUST NOT automatically re-review until an explicit rerun. Repeated initial requests reuse the first attempt, including NOT_RUN; outside that one automatic round, only explicit `agent-ops review --criteria --task <id> --rerun --yes` starts another fresh single round. Without --rerun the same command reads/waits for the current attempt.
 
 Detailed redacted reports remain private in `.agent-ops/reviews/criteria-<task-id>*.json`; the local log contains only status, duration, counts, reported usage and report reference. CLI invocation counts are distinct from provider model calls, which may be unreported. Report/log failures MUST NOT roll back a task or fabricate evidence. These advisory artifacts MUST NOT satisfy verify, final review or finish.
 
@@ -112,6 +112,40 @@ successful refutation MUST make the run FAIL.
   replays the recorded queries and reads every listed `valueChanges` consumer;
   this is the only exception to "do not survey the repository".
 
+## REVIEW-ORIGIN-001
+
+A defect the change did not cause MUST NOT block the change; it MUST be
+reported as `origin: "pre-existing"` with `blocking: false` and flow to the
+followup ledger.
+
+- Trigger: A reviewer meets a defect while reading for the review.
+- Action: Mark it pre-existing only when it is present identically at the base
+  and the change did not introduce, expose, worsen or depend on it. Report only
+  defects met on the normal read path; do not search for old ones.
+- Evidence: The report validator rejects a pre-existing finding with
+  `blocking: true` at any severity, including critical. A finding without
+  `origin` means introduced and keeps the old severity rules, so stored reports
+  stay valid. Nonblocking findings of a delivered PASS reach followup as before.
+- Positive: `A critical injection in an untouched helper is reported as pre-existing, nonblocking, and collected into followup.`
+- Negative: `A caller in an unchanged file breaks because of this change and is marked pre-existing because its lines were not edited.`
+
+## REVIEW-ROUNDS-001
+
+Review MUST stop after three failed reviews of one task contract and ask for a
+new approach instead of another fix round.
+
+- Trigger: `review` (directly or through `batch`, `task advance` or a run) for a
+  task with three or more FAIL reports bound to its current task contract hash
+  and newer than its latest PASS.
+- Action: Return NOT_RUN `round-cap` before resolving scope or starting any
+  reviewer, printing the exact `task revise` command. Reconsider the approach and
+  revise the criteria or intent with a reason, or ask the user.
+- Evidence: NOT_RUN reports never count; each source fingerprint keeps one
+  report, so re-reviewing unchanged code adds nothing; a contract revision or a
+  newer PASS starts the count again. The cap is a constant, not configuration.
+- Positive: `Third FAIL on the same contract; the agent revises the intent to a different design and reviews again.`
+- Negative: `Keep committing one fix per finding through a fifth review of the same contract.`
+
 ## REVIEW-HOST-001
 
 A host that cannot provide network and loopback capability MUST fail closed

package/docs/zh-TW/spec/harness-adapters.md

@@ -150,8 +150,8 @@ byte-identical。Update MUST 保留此 profile，除非提供 `--auto-run on|off
   一行說明該 code，並退回 subtask flow；`RUN_REPO_UNTRUSTED` 則停止並詢問使用者。
   未完成即結束的 run（blocked、budget exhausted、stopped、review 失敗）須回報其
   `run status` state 與 code、最後的 `run logs` event，以及確切的
-  `agent-ops run resume <id>` 與 `agent-ops run stop <id>` command，且永不自動
-  resume 或由 session 接手。在 worktree auto mode 下，Claude `PreToolUse`
+  `agent-ops run resume <id>` 與 `agent-ops run stop <id>` command；有已交付 task
+  時另附 `agent-ops run land <id> --yes`，且永不自動 resume、land 或由 session 接手。在 worktree auto mode 下，Claude `PreToolUse`
   worktree guard 允許在 main checkout 寫入恰為 `.agent-ops/state/run-goal.md`
   的路徑，且不建立 worktree。確認後的 init/update 會預先授權 `agent-ops run`：
   Claude Code 為 `Bash(agent-ops run *)`，Codex 為

package/docs/zh-TW/spec/loop-engineering.md

@@ -22,6 +22,7 @@
 - 執行中的 run 僅在原始 repository trust、config、可執行 runtime 與操作範圍完全相同時，自動續期過期的有限授權。續期以 digest 綁定前一版本並保留既有評估，拒絕無效／倒退時鐘；並行 stop、denial 或 scope 變更使續期失敗。權限已變更或撤銷時須沿既有 trust/resume 流程取得真正授權；續期不授予永久 trust，也不消除 denial。明確 resume 先核對不可變 renewal lineage，再同步 policy。回答問題也沿用相同恢復檢查；兩者皆不得復活已被明確拒絕的工作。
 - `run resume <id> --retry-approval <auth-event-id>` MAY 明確重試以額度不足 wrapper 失敗的 Codex 自動審批。每筆指定失敗 MUST 保有原始 private artifact、digest、worker identity 與 policy lineage；真正或未指定的拒絕仍阻擋。多筆失敗可重複旗標。成功確認會留存並在後續 resume 重新驗證；此操作不授予命令權限，原生審批必須重跑，既有 writer 死亡、checkout、trust 與預算檢查仍適用。
 - `run resume <id> --retry-delivery <task-id>` MAY 在修復 harness 原因後，明確重新排程一個被 `RUN_FINAL_PROOF_INTERRUPTED` 阻擋的 child。MUST 核對同一筆中斷 handoff、所有 writer 與 proof 已確認停止、所屬 checkout 乾淨及目前 trust/policy；保留 run、task、goal、baselines、commits、耗用與失敗歷史，記錄已確認的 attempt，並要求新 native generation 及正常交付驗證。MUST NOT 直接標記交付、解除其他阻擋或確認命令拒絕；approval retry 是獨立操作。一般 resume 保留 no-progress 阻擋。受控 proof 中斷 MUST 記錄有界且已遮蔽的 exit/signal、失敗階段與子程序診斷；無效輸出或非零退出的成功 envelope 不得視為證據。
+- `run land <id> [--task <task-id>]... --yes` MAY 在 run 為 paused、blocked 或 budget-limited 且無存活 worker 時，先行合併已交付的 child。每個選取 task 的依賴 MUST 已選取或已落地（`RUN_LAND_DEPENDENCY_OPEN`）。證明在由 target 建立的全新 landing worktree 中進行，使用自動產生的 root task（required verifier 加上 review-only 一致性條件，surface 沿用 run root），再走一般驗證、兩輪 tree review 與綁定 receipt 的 finish。run 的 checkout 只被釘住、永不移除；已落地 task 維持 delivered，run 仍可 resume 並記錄 `landings[]` 與 `RUN_PARTIAL_LANDED`，其最終證明會在新 target 上重新驗證整個 goal。落地期間的標記會拒絕 resume、respond 與另一次 land（`RUN_LANDING_IN_PROGRESS`）；已不存在的程序留下的標記不會阻擋。失敗時 target 不變，landing worktree 保留到下次 land 移除。
 - 當次人工 resume 的初始恢復 MAY 忽略啟用前收到、且 native 更新秒數嚴格早於該次 resume 的本執行緒 Codex 額度快照。自動重啟、未知／同秒／未來時間、時鐘倒退，以及啟用開始後收到的所有額度事件仍有效。Native 啟用 MUST 確認 goal 為 active，才能啟動或轉向 turn。人工 resume 可解除衍生的 `RUN_POLICY_DISABLED` task 阻擋，但保留 ID、耗用、歷史及其他產品失敗。
 - 收斂判斷比較實際 per-check 狀態及未解除的 finding pins；source fingerprint、時間或診斷文字本身不能算進展。
 

package/docs/zh-TW/spec/review.md

@@ -1,20 +1,20 @@
 # 審查
 
-English source version: 2026-10-23. Revalidate: when the English specification changes.
+English source version: 2026-10-27. Revalidate: when the English specification changes.
 
 ## REVIEW-CRITERIA-001
 
 - Trigger: 正式 task 的 criteria 就緒、尚未開始實作。
 - Action: 等待一輪限定範圍的 advisory，由 writer 記錄採納或拒絕理由。
 - Evidence: 私人快照報告與安全 local 狀態／用量 log；不產生完成證明。
-- Positive: `修訂後顯示歷史建議；只有明確 rerun 才再花一輪。`
-- Negative: `每次 revise 都自動重審，或把建議當正式 PASS 證明。`
+- Positive: `依建議改寫 criterion；該次 revise 自動重跑一輪 advisory 並顯示新建議。`
+- Negative: `每次 revise（包含只改 surface）都重審，或把建議當正式 PASS 證明。`
 
 每個正式 task 建立入口（含 DEBUG、replan 新子任務及 native run root/child）MUST 在首次實作前等待一輪獨立 criteria advisory。使用設定的 independent-review target 與全新 session，優先選擇不同於 host 的 target；只提供原始 goal、指派 intent/covers、criteria 與 surface audit，並在空白暫存工作區執行。MUST NOT 掃描 repository 或跑測試。缺 goal 須明示資訊不足；子任務只對指派範圍判完整性。材料是否存在、是否載入產品程式留待實作驗證；有理由的 review-only 條件合法。
 
 advisory 不設 agent-ops 執行 deadline、stall cutoff 或 token budget。provider 限制、真正啟動／認證／輸出錯誤與人工取消仍有效。錯誤回報 NOT_RUN 後可繼續；人工取消保留 task 並 MUST 停止實作。native 審查程序仍受註冊與停止機制管理。一般 verify 與正式雙輪 review 的既有時間限制及 gate 保持有效。
 
-task 建立回應呈現建議與私人報告位置。writer 自行判斷採納，透過 task revise 記錄採納及拒絕理由（可用相同 criteria 修訂記錄拒絕建議）。需求歧義或擴大範圍才向使用者澄清。報告綁定 task／goal／criteria／surface 快照；輸入改變後 status 與 revise 顯示歷史報告已過期。修訂 MUST NOT 自動重審。重複初審請求重用第一次嘗試，包含 NOT_RUN；只有明確執行 `agent-ops review --criteria --task <id> --rerun --yes` 才開始新的一輪。省略 --rerun 時讀取／等待目前嘗試。
+task 建立回應呈現建議與私人報告位置。writer 自行判斷採納，透過 task revise 記錄採納及拒絕理由（可用相同 criteria 修訂記錄拒絕建議）。需求歧義或擴大範圍才向使用者澄清。報告綁定 task／goal／criteria／surface 快照，並記錄觸發來源（`create`、`rerun` 或 `revise`；舊報告沒有此欄位）。goal、intent、criteria 或指派範圍改變後，status 與 revise 顯示報告已過期；只改 surface 時報告仍視為最新。第一次讓目前報告過期的已儲存修訂，若該報告本身不是 revise 觸發，MUST 等待一輪自動的新審查（觸發來源 `revise`）並顯示建議；不論該輪完成、回報 NOT_RUN 或被取消，修訂都會保留。之後的修訂 MUST NOT 自動重審，直到明確 rerun 為止。重複初審請求重用第一次嘗試，包含 NOT_RUN；除了那一輪自動審查，只有明確執行 `agent-ops review --criteria --task <id> --rerun --yes` 才開始新的一輪。省略 --rerun 時讀取／等待目前嘗試。
 
 詳細報告經遮蔽後私存於 `.agent-ops/reviews/criteria-<task-id>*.json`；local log 只記狀態、耗時、數量、可得用量及報告參照。CLI 呼叫數與 provider 模型呼叫數分開，後者可能未回報。報告／log 故障 MUST NOT 回滾 task 或偽造證據。advisory 產物 MUST NOT 滿足 verify、正式 review 或 finish。
 
@@ -100,6 +100,26 @@ PASS MUST 交給第二個規劃的 target 嘗試反駁，且反駁成立時 MUST
 - Note: 只有一個設定 target 時，會在全新 session 再呼叫同一 target。FAIL 已是終局，不再複查。
 - Note: 有 surface 的 task，第二輪也會在 `surface-coverage` 下搜尋未列出的 surface 與情境：檢查五個固定情境維度，每個軸向最多可新增 3 個 `git grep -F` 查詢。第一輪重放記錄的查詢並閱讀每個列出的 `valueChanges` consumer；這是「不要普查 repository」唯一的例外。
 
+## REVIEW-ORIGIN-001
+
+不是本次變更造成的缺陷 MUST NOT 擋下變更；MUST 以 `origin: "pre-existing"`、`blocking: false` 回報，並流入 followup ledger。
+
+- Trigger: reviewer 在審查閱讀過程中碰到缺陷。
+- Action: 只有當缺陷在 base 以相同形式存在，且本次變更沒有引入、暴露、加劇或依賴它時，才標為 pre-existing。只回報正常閱讀路徑上碰到的缺陷；不主動搜尋舊問題。
+- Evidence: report validator 拒絕任何 severity（包含 critical）的 pre-existing finding 帶 `blocking: true`。沒有 `origin` 的 finding 視為 introduced，沿用原本的 severity 規則，因此既有 report 仍然有效。已交付 PASS 的 nonblocking finding 照舊進入 followup。
+- Positive: `未改動 helper 裡的 critical injection 標為 pre-existing、nonblocking，並收進 followup。`
+- Negative: `未改動檔案中的 caller 因本次變更而壞掉，卻因為那幾行沒被修改就標為 pre-existing。`
+
+## REVIEW-ROUNDS-001
+
+同一份 task contract 的 review 失敗三次後 MUST 停止，要求換方案，而不是再修一輪。
+
+- Trigger: 對某 task 執行 `review`（直接執行，或經由 `batch`、`task advance`、run），且該 task 在目前 task contract hash 下、最近一次 PASS 之後已有三份以上 FAIL report。
+- Action: 在解析 scope 或啟動任何 reviewer 之前回傳 NOT_RUN `round-cap`，並印出完整的 `task revise` 指令。重新檢討做法，附上理由修訂 criteria 或 intent，或詢問使用者。
+- Evidence: NOT_RUN report 不計入；每個 source fingerprint 只保留一份 report，所以對未改動的程式碼重跑不會增加次數；contract 修訂或較新的 PASS 會讓計數歸零。上限是常數，不是設定項。
+- Positive: `同一份 contract 第三次 FAIL；agent 把 intent 改成另一種設計後再審。`
+- Negative: `同一份 contract 審到第五次，仍然每個 finding 修一個 commit。`
+
 ## REVIEW-HOST-001
 
 Host 缺少 network 或 loopback 能力時，MUST 在任何 reviewer invocation 前

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kylecheng3146/agent-ops",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "description": "Evidence-driven development loops for agy, Codex, Claude Code, and opencode",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",

package/schemas/review-report.schema.json

@@ -41,7 +41,8 @@
         "locations": { "type": "array", "items": { "$ref": "#/$defs/location" } },
         "evidence": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/text" } },
         "recommendation": { "$ref": "#/$defs/text" },
-        "criterionIds": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/text" } }
+        "criterionIds": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/text" } },
+        "origin": { "enum": ["introduced", "pre-existing"] }
       }
     }
   }