@kylecheng3146/agent-ops 0.11.3 → 0.11.4

package/README.md

@@ -53,8 +53,14 @@ agent-ops run logs <run-id>
 agent-ops run respond <run-id> --question-id <id> --answer "Clarification"
 agent-ops run stop <run-id>
 agent-ops run resume <run-id>
+agent-ops run land <run-id> [--task <task-id>]... --yes
 ```
 
+`run land` merges the delivered children of a paused, blocked or budget-limited
+run ahead of the rest: it verifies them, runs the two-round review and finishes
+with a receipt in a separate landing worktree, while the run stays resumable and
+its final proof re-verifies the whole goal.
+
 `--host claude` uses Claude Code; `--wait` waits for a terminal or input state.
 The coordinator counts toward the two writer slots. Native processes write only
 under current leases in separate worktrees. Active time counts once across parallel
@@ -268,7 +274,8 @@ question through `agent-ops run respond`. A start refused with
 `WORKTREE_NESTED` falls back to the subtask flow; `RUN_REPO_UNTRUSTED` stops and
 asks you. A run that ends without completing is reported with its status, last
 log events, and the `agent-ops run resume <id>` / `agent-ops run stop <id>`
-commands; it is never resumed automatically. agy keeps the subtask flow.
+commands (plus `agent-ops run land <id> --yes` when it has delivered tasks); it
+is never resumed or landed automatically. agy keeps the subtask flow.
 Init and update pre-authorize `agent-ops run` for Claude Code and Codex.
 
 ```bash

package/dist/packages/cli/src/args.js

@@ -922,7 +922,7 @@ export function parseArgs(argv) {
     };
 }
 function parseRunArgs(argv) {
-    const actions = ["start", "status", "logs", "resume", "stop", "respond"];
+    const actions = ["start", "status", "logs", "resume", "stop", "respond", "land"];
     if (argv.includes("--help") || argv.includes("-h"))
         return { command: "help", helpTopic: "run", profiles: [], dryRun: false, json: false, yes: false, rerun: false };
     const action = actions.includes(argv[0]) ? argv[0] : "start";
@@ -937,21 +937,30 @@ function parseRunArgs(argv) {
             positional = token;
             continue;
         }
-        if (seen.has(token) && token !== "--retry-approval")
+        if (seen.has(token) && token !== "--retry-approval" && token !== "--task")
             duplicate(token);
         seen.add(token);
         if (token === "--json") {
             args.json = true;
             continue;
         }
+        if (token === "--yes") {
+            args.yes = true;
+            continue;
+        }
         if (token === "--wait") {
             args.wait = true;
             continue;
         }
-        if (!["--host", "--goal-file", "--time-budget", "--jobs", "--question-id", "--answer", "--answer-file", "--retry-approval", "--retry-delivery"].includes(token))
+        if (!["--host", "--goal-file", "--time-budget", "--jobs", "--question-id", "--answer", "--answer-file", "--retry-approval", "--retry-delivery", "--task"].includes(token))
             throw new CliArgumentError("CLI_UNKNOWN_OPTION", `Unknown run option: ${token}`, token);
         const value = readOptionValue(argv, i++, token);
         switch (token) {
+            case "--task":
+                if (!/^[A-Za-z0-9._:/-]{1,256}$/u.test(value) || args.landTaskIds?.includes(value))
+                    invalidValue(token, value);
+                args.landTaskIds = [...(args.landTaskIds ?? []), value];
+                break;
             case "--retry-delivery":
                 if (!/^task-[a-z0-9-]{1,128}$/u.test(value))
                     invalidValue(token, value);
@@ -991,6 +1000,12 @@ function parseRunArgs(argv) {
     }
     if (args.retryApprovalIds !== undefined && action !== "resume")
         throw new CliArgumentError("CLI_INVALID_OPTION", "--retry-approval requires run resume.");
+    if (args.landTaskIds !== undefined && action !== "land")
+        throw new CliArgumentError("CLI_INVALID_OPTION", "--task requires run land.");
+    if (args.yes !== (action === "land"))
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", action === "land"
+            ? "Run land requires --yes to authorize its verification and both reviewer sessions."
+            : "--yes is accepted only by run land.");
     if (args.retryDeliveryTaskId !== undefined && (action !== "resume" || args.retryApprovalIds !== undefined))
         throw new CliArgumentError("CLI_INVALID_OPTION", "--retry-delivery requires run resume without --retry-approval.");
     if (action === "start") {

package/dist/packages/cli/src/cli.js

@@ -130,6 +130,7 @@ The URL carries an access token; do not share it.
        agent-ops run resume <run-id> [--retry-approval <auth-event-id>]... [--json]
        agent-ops run resume <run-id> --retry-delivery <task-id> [--json]
        agent-ops run respond <run-id> --question-id <id> <--answer <text>|--answer-file <path>> [--json]
+       agent-ops run land <run-id> [--task <task-id>]... --yes [--json]
 
 New runs have no total time cap. Manual resume upgrades legacy finite runs and keeps accounting.
 Command/review timeouts, provider limits and stop controls remain effective.
@@ -144,6 +145,10 @@ Status includes phase, original cause, recorded sealed proof, cleanup state,
 resumability and remediation. Resume revalidates authority and sealed artifacts;
 receipt-bound recovery executes only missing cleanup steps. Resolve the saved
 blocker before retrying: unchanged cleanup inputs are refused.
+land merges delivered children of a paused, blocked or budget-limited run ahead
+of the rest: it verifies them, runs the two-round review and finishes with a
+receipt, leaving the run resumable. --task picks a subset; each one's
+dependencies must be picked too or already landed.
 `,
     init: `Usage: agent-ops init [options]
 

package/dist/packages/cli/src/commands/advance.js

@@ -102,7 +102,7 @@ export async function runAdvanceCommand(options) {
     if (parent.status !== "active" || parent.task.parentTaskId !== undefined) {
         throw new AgentOpsError("ADVANCE_PARENT_INVALID", "Advance requires an active root task in the coordinator worktree.");
     }
-    const children = await integrateSessionChildren(deps, record, parent.task.id);
+    const children = await integrateSessionChildren(deps, record, parent.task.id, undefined, options.children);
     const step = options.step ?? runAdvanceStep;
     for (let attempt = 0; attempt < 2; attempt += 1) {
         const target = await git(deps, mainRoot, ["rev-parse", `${record.targetBranch}^{commit}`]);
@@ -159,6 +159,7 @@ export async function runAdvanceCommand(options) {
             ...(noChangePaths === undefined ? {} : { noChangePaths }) });
         const sourceFingerprint = await calculateSourceFingerprint(record.path, scope, runner(deps, record.path));
         const finalProof = { target, head, sourceFingerprint, children,
+            ...(options.children === undefined ? {} : { keepChildren: true }),
             ...(noChangePaths === undefined ? {} : { noChange: { sourceCommit: head,
                     contractDigest: await deps.tasks(record.path).treeContract(parent.task.id), reviewScope: scope,
                     artifactRefs: Object.values((await deps.tasks(record.path).status({ taskId: parent.task.id })).evidence).flat() } }) };

package/dist/packages/cli/src/commands/init.js

@@ -127,13 +127,10 @@ export async function runInitCommand(options) {
             : { worktree: worktreeConfig })
     });
     const trust = await trustChange(options, plan);
-    // An installation with no verifier looks finished and is not: every task
-    // completion needs current PASS evidence from a required verifier, so the
-    // loop can never close. Detection stays conservative on purpose — it will
-    // not guess a test command — which makes saying so out loud the whole fix.
+    // Empty commands block legacy criteria, not typed acceptance backed by runners.
     const verificationWarnings = plan.config.verification.commands.length === 0
         ? [
-            "No verification command is configured, so no task can be completed. " +
+            "No verification command is configured; legacy criteria need a required verifier. " +
                 "Add verification.commands to .agent-ops/config.json." +
                 (plan.verificationBlockers.length === 0
                     ? ""

package/dist/packages/cli/src/commands/run.js

@@ -9,7 +9,7 @@ function actionOf(args) {
     const value = dynamic(args).runAction ?? dynamic(args).action;
     if (value === undefined || value === "start")
         return "start";
-    if (["status", "logs", "resume", "stop", "respond"].includes(String(value)))
+    if (["status", "logs", "resume", "stop", "respond", "land"].includes(String(value)))
         return value;
     throw new AgentOpsError("RUN_ACTION_INVALID", `Unsupported run action: ${String(value)}`);
 }
@@ -109,6 +109,14 @@ export async function runRunCommand(options) {
         }
         if (action === "resume")
             return okEnvelope("RUN_RESUMED", data(action, await options.service.resume(runId, options.args.retryApprovalIds, true, options.args.retryDeliveryTaskId)));
+        if (action === "land") {
+            if (options.service.land === undefined)
+                throw new AgentOpsError("RUN_LAND_UNSUPPORTED", "This CLI cannot land run deliveries.");
+            const landed = await options.service.land(runId, options.args.landTaskIds);
+            const message = `Landed ${landed.taskIds.join(", ")} from run ${runId}. Receipt: ${landed.receipt}.\n` +
+                `The run stays ${landed.state.status}; continue the rest with: agent-ops run resume ${runId}`;
+            return okEnvelope("RUN_LANDED", { ...data(action, { state: landed.state, message }), landedTaskIds: landed.taskIds, receipt: landed.receipt });
+        }
         if (action === "stop")
             return okEnvelope("RUN_STOP_REQUESTED", data(action, await options.service.stop(runId, options.args.answer ?? "user requested stop")));
         const questionId = options.args.questionId;

package/dist/packages/cli/src/run-deps.js

@@ -9,7 +9,8 @@ import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { sha256 } from "../../../runtime/src/fs/hash.js";
 import { resolveCheckouts, readWorktreeRecord, sessionWorktreeName } from "../../../runtime/src/parallel/service.js";
 import { createLaunchdDescriptor, LaunchdController, readBootIdentity, readGuiLoginIdentity } from "../../../runtime/src/run/macOS.js";
-import { FileRunRepository, RunService, validateDeliveryRetry } from "../../../runtime/src/run/service.js";
+import { FileRunRepository, RunService, landingMarkerLive, validateDeliveryRetry } from "../../../runtime/src/run/service.js";
+import { landRun } from "../../../runtime/src/run/land.js";
 import { readPrivateFile, writePrivateFile } from "../../../runtime/src/security/permissions.js";
 import { collectChangeSurface } from "../../../runtime/src/verify/change-surface.js";
 import { worktreeDependencies, gitRunner, trustStore } from "./parallel-deps.js";
@@ -28,6 +29,7 @@ import { nativeProcessIdentity } from "../../../runtime/src/run/transport.js";
 import { redactSecrets } from "../../../runtime/src/security/redact.js";
 import { RunControlService } from "../../../runtime/src/run/controls.js";
 import { recordRunPhase } from "../../../runtime/src/run/phase.js";
+import { runAdvanceCommand } from "./commands/advance.js";
 /** Worktree construction happens before a native lease exists; it must never write global trust. */
 export async function runWorktreeDependencies(deps, state) {
     state = await ensureRunPolicy(new FileRunRepository(join(state.commonDir, "agent-ops/runs"), state.commonDir), state);
@@ -213,6 +215,8 @@ export async function productionRunContext(cwd, options = {}) {
     };
     const resume = async (runId, retryApprovalIds = [], upgradeBudget = true, retryDeliveryTaskId) => {
         const before = await service.status(runId);
+        if (landingMarkerLive(before.landing))
+            throw new AgentOpsError("RUN_LANDING_IN_PROGRESS", `Run ${runId} is landing delivered work; wait for run land to finish.`);
         const retry = retryDeliveryTaskId === undefined ? null : validateDeliveryRetry(before, retryDeliveryTaskId);
         const runtimeHash = await runRuntimeHash();
         const policy = await readRunPolicy(before, before.policyBinding?.runtimeHash ?? runtimeHash, Date.now(), true);
@@ -315,6 +319,18 @@ export async function productionRunContext(cwd, options = {}) {
         }
         return { state, message: `Run ${runId} stopped; registered native process death was confirmed.` };
     };
+    const land = async (runId, taskIds) => {
+        if (checkouts.currentRoot !== checkouts.mainRoot)
+            throw new AgentOpsError("WORKTREE_NESTED", "Land a run from the main checkout.");
+        return await landRun({ repository, runId, ...(taskIds === undefined ? {} : { taskIds }), deps,
+            advance: async (input) => {
+                const result = await runAdvanceCommand({ ...input, deps });
+                const receipt = result.data?.receipt;
+                if (result.status !== "ok" || typeof receipt !== "string")
+                    throw new AgentOpsError(result.code, "Landing proof did not finish with a receipt.");
+                return { receipt };
+            } });
+    };
     const respond = async (runId, questionId, answer) => {
         const state = await service.status(runId);
         if (!state.questions.some(q => q.questionId === questionId && q.answeredAt === null))
@@ -331,7 +347,7 @@ export async function productionRunContext(cwd, options = {}) {
         }
     };
     return { ...checkouts, targetBranch: target.stdout.trim(), ownerSessionId: randomUUID(), repository,
-        service: { start, resume, stop, respond, status: service.status.bind(service), logs: service.logs.bind(service) },
+        service: { start, resume, stop, respond, land, status: service.status.bind(service), logs: service.logs.bind(service) },
         waitForCompletion: async (runId) => {
             for (;;) {
                 const state = await service.status(runId);

package/dist/runtime/src/install/doctor.js

@@ -380,17 +380,15 @@ async function checkRegistrationDrift(root, manifest, config) {
     }
 }
 /**
- * Whether anything can ever be verified here. Completion requires current PASS
- * evidence from a required verifier, so an empty list is not a light
- * configuration — it is a loop that cannot close, and an installation reaches
- * that state quietly whenever stack detection declines to guess.
+ * Legacy criteria need required verifiers; typed acceptance can use runners
+ * even when no ordinary verification command is configured.
  */
 function checkVerificationCommands(config) {
     if (config === undefined) {
         return check("verification-commands", "UNKNOWN", "Configuration could not be read, so verifiers are unknown.");
     }
     if (config.verification.commands.length === 0) {
-        return check("verification-commands", "DEGRADED", "No verification command is configured, so no task can be completed.", 
+        return check("verification-commands", "DEGRADED", "No verification command is configured; legacy criteria need a required verifier.", 
         // Codeless on purpose: the fix is an edit to the configuration file, not
         // an agent-ops command, and a code here would force a non-zero exit on
         // every installation whose stack detection declined to guess.

package/dist/runtime/src/install/harness.js

@@ -347,7 +347,8 @@ function autoRunInstruction(descriptor, context) {
         "report the `agent-ops run status",
         "<id>` state and code, the last `agent-ops run logs <id>` events, and the",
         "exact `agent-ops run resume <id>` and `agent-ops run stop <id>` commands,",
-        "then stop: never resume automatically or take over the run's work.",
+        "plus `agent-ops run land <id> --yes` when it has delivered tasks,",
+        "then stop: never resume or land automatically or take over the run's work.",
         ""
     ];
 }

package/dist/runtime/src/install/plan.js

@@ -88,7 +88,7 @@ function buildConfig(profiles, existing, reviewTargets = [], detectedCommands =
     const verification = existing?.verification !== undefined &&
         existing.verification.commands.length > 0
         ? existing.verification
-        : { commands: [...detectedCommands] };
+        : { ...existing?.verification, commands: [...detectedCommands] };
     // Pre-0.11 DEBUG budget settings are dropped on rewrite.
     const existingFeatures = existing === undefined ? undefined : (({ debug: _legacyDebug, ...rest }) => rest)(existing.features);
     const effectiveWorktree = worktree !== undefined

package/dist/runtime/src/parallel/finish.js

@@ -318,9 +318,12 @@ export async function finishWorktree(deps, options) {
     return await withActivity(commonDir, { kind: "finish", root: record.path, sessionId: record.sessionId, worktree: name }, async () => await withFinishLock(deps, commonDir, async () => {
         const listing = await git(deps, mainRoot, ["worktree", "list", "--porcelain"], "WORKTREE_LIST_FAILED", "Cannot list cleanup worktrees.");
         const records = await Promise.all(parseWorktreeListPorcelain(listing).map(child => readWorktreeRecord(child.path)));
+        const keepChildren = options.finalProof?.keepChildren === true;
         const sessionChildren = records
-            .filter((child) => child !== null && child.path !== record.path && child.sessionId === record.sessionId &&
-            (child.agentId !== undefined || (record.runId !== undefined && child.runId === record.runId)));
+            .filter((child) => child !== null && child.path !== record.path && (keepChildren
+            ? options.finalProof.children.some(({ name }) => name === child.name)
+            : child.sessionId === record.sessionId &&
+                (child.agentId !== undefined || (record.runId !== undefined && child.runId === record.runId))));
         if (options.finalProof?.recovery === true && record.runId !== undefined) {
             const saved = await new FileRunRepository(join(commonDir, "agent-ops/runs"), commonDir).read(record.runId);
             if (["receipt-written", "cleaned"].includes(saved?.integration?.status ?? ""))
@@ -579,7 +582,7 @@ export async function finishWorktree(deps, options) {
                 // this session began would leave it reading the merge as its own change.
                 // Only this worktree leaves the session; its other roots stay covered.
                 await mainGate.afterFinish(record.sessionId, record.path, after);
-                if (options.finalProof !== undefined) {
+                if (options.finalProof !== undefined && !keepChildren) {
                     for (const child of sessionChildren) {
                         await mainGate.afterFinish(record.sessionId, child.path, after);
                     }
@@ -593,7 +596,7 @@ export async function finishWorktree(deps, options) {
         await attempt("trust", async () => await deps.trust.revoke(record.path, worktreeConfig));
         if (receiptOptions !== undefined)
             await markRunIntegration(commonDir, record, "receipt-written", "trust");
-        if (options.finalProof !== undefined) {
+        if (options.finalProof !== undefined && !keepChildren) {
             for (const child of sessionChildren) {
                 await attempt(`child ${child.name}`, async () => {
                     const pinnedHead = await assertPinnedChild(child);

package/dist/runtime/src/parallel/integrate.js

@@ -156,11 +156,13 @@ async function previous(record) {
     return value;
 }
 /** Integrate only this session's agent-owned branches; local proof is never promoted as final proof. */
-export async function integrateSessionChildren(deps, coordinator, parentTaskId, eligibleRunWorkerIds) {
-    const statuses = await listWorktrees(deps, coordinator.mainRoot);
-    const children = statuses.map(({ record }) => record)
+export async function integrateSessionChildren(deps, coordinator, parentTaskId, eligibleRunWorkerIds, 
+/** Another session's children chosen by the caller (`run land`); replaces the session filter only. */
+explicitChildren) {
+    const statuses = explicitChildren === undefined ? await listWorktrees(deps, coordinator.mainRoot) : [];
+    const children = (explicitChildren ?? statuses.map(({ record }) => record)
         .filter((record) => record.name !== coordinator.name && record.sessionId === coordinator.sessionId &&
-        (record.agentId !== undefined || (coordinator.runId !== undefined && record.runId === coordinator.runId)))
+        (record.agentId !== undefined || (coordinator.runId !== undefined && record.runId === coordinator.runId))))
         .filter(record => eligibleRunWorkerIds === undefined || (record.workerId !== undefined && eligibleRunWorkerIds.includes(record.workerId)))
         .sort((a, b) => a.name.localeCompare(b.name));
     const integrated = await previous(coordinator);

package/dist/runtime/src/run/land.js

@@ -0,0 +1,145 @@
+import { randomUUID } from "node:crypto";
+import { hostname } from "node:os";
+import { join } from "node:path";
+import { calculateConfigHash } from "../config/hash.js";
+import { sha256 } from "../fs/hash.js";
+import { AgentOpsError } from "../fs/paths.js";
+import { listWorktrees } from "../parallel/manage.js";
+import { addWorktree, readWorktreeRecord, removeCheckout, sessionWorktreeName } from "../parallel/service.js";
+import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
+import { landingMarkerLive, MAX_EVENTS } from "./service.js";
+const LIVE_WORKER = ["assigned", "starting", "running", "idle", "handing-off"];
+const LANDABLE = ["paused", "blocked", "budget-limited"];
+/** Inside the landing worktree; names the run that owns it so another run never reuses it. */
+const OWNER_FILE = join(".agent-ops", "tasks", "run-landing.json");
+export function assertLandable(state) {
+    if (!LANDABLE.includes(state.status) || state.rootTaskId === null ||
+        state.workers.some(worker => LIVE_WORKER.includes(worker.status)))
+        throw new AgentOpsError("RUN_LAND_STATE_INVALID", `Run ${state.runId} is ${state.status}; land needs a paused, blocked or budget-limited run with a root task and no live worker.`);
+}
+/** Unlanded delivered children, or the requested ones; every dependency must be selected or already landed. */
+export function selectLanding(state, requested) {
+    const landed = new Set((state.landings ?? []).flatMap(landing => landing.taskIds));
+    const eligible = state.tasks.filter(task => task.taskId !== state.rootTaskId && task.status === "delivered" &&
+        task.sourceCommit !== null && !landed.has(task.taskId));
+    for (const id of requested ?? [])
+        if (!eligible.some(task => task.taskId === id))
+            throw new AgentOpsError("RUN_LAND_TASK_INVALID", `${id} is not an unlanded delivered task of run ${state.runId}.`);
+    const selected = requested === undefined ? eligible : eligible.filter(task => requested.includes(task.taskId));
+    if (selected.length === 0)
+        throw new AgentOpsError("RUN_LAND_NOTHING", `Run ${state.runId} has no unlanded delivered task.`);
+    const ids = new Set(selected.map(task => task.taskId));
+    for (const task of selected)
+        for (const dependency of task.dependencies)
+            if (!ids.has(dependency) && !landed.has(dependency))
+                throw new AgentOpsError("RUN_LAND_DEPENDENCY_OPEN", `${task.taskId} depends on ${dependency}, which is neither selected nor landed.`);
+    return selected;
+}
+/**
+ * One landing session per attempt: a non-hex first letter keeps it apart from
+ * UUID sessions, and a fresh path per attempt never reuses a removed checkout.
+ */
+export function landingSessionId(runId, nonce = randomUUID()) {
+    return `l${sha256(`${runId}:${nonce}`).slice(0, 7)}${LANDING_SUFFIX}${runId}`;
+}
+const LANDING_SUFFIX = "-land-";
+async function git(deps, cwd, args) {
+    const result = await deps.git(cwd, args);
+    if (result.exitCode !== 0)
+        throw new AgentOpsError("RUN_LAND_GIT_FAILED", `${args.join(" ")}: ${result.stderr.trim()}`);
+    return result.stdout.trim();
+}
+/** The worker checkout whose committed head is the frozen delivery. */
+async function deliveredCheckout(deps, state, task) {
+    for (const worker of state.workers.filter(worker => worker.taskId === task.taskId && worker.worktree !== null)) {
+        const record = await readWorktreeRecord(worker.worktree);
+        if (record !== null && await git(deps, record.path, ["rev-parse", "HEAD"]) === task.sourceCommit)
+            return record;
+    }
+    throw new AgentOpsError("RUN_LAND_DELIVERY_MISSING", `No preserved checkout of ${task.taskId} is at its delivered commit ${task.sourceCommit}.`);
+}
+async function ownerOf(path) {
+    try {
+        const owner = JSON.parse(await readPrivateFile(join(path, OWNER_FILE), path) ?? "null");
+        return typeof owner?.runId === "string" ? owner.runId : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Worktrees kept by this run's failed attempts are removed first; one that claims the run without proof is refused. */
+async function freshLandingWorktree(deps, state, sessionId) {
+    const claimed = (await listWorktrees(deps, state.root)).map(({ record }) => record)
+        .filter(record => record.sessionId.endsWith(LANDING_SUFFIX + state.runId));
+    for (const record of claimed)
+        if (await ownerOf(record.path) !== state.runId)
+            throw new AgentOpsError("RUN_LAND_WORKTREE_FOREIGN", `${record.path} claims run ${state.runId} without its owner record; it was left untouched.`);
+    for (const record of claimed)
+        await removeCheckout(deps, record, true);
+    const record = (await addWorktree(deps, { cwd: state.root, name: sessionWorktreeName(sessionId), sessionId,
+        from: state.targetBranch, targetBranch: state.targetBranch })).record;
+    await writePrivateFile(join(record.path, OWNER_FILE), JSON.stringify({ runId: state.runId }), record.path);
+    return record;
+}
+async function createLandingRoot(deps, state, record, selected) {
+    const config = await deps.loadConfig(record.path);
+    const required = config.verification.commands.filter(command => command.required).map(command => command.id);
+    if (required.length === 0)
+        throw new AgentOpsError("RUN_LAND_VERIFIER_REQUIRED", "Landing proof needs at least one required verification command.");
+    const coordinator = state.workers.find(worker => worker.workerId === state.coordinatorId)?.worktree ?? null;
+    const root = coordinator === null ? null : await deps.tasks(coordinator).status({ taskId: state.rootTaskId }).catch(() => null);
+    const ids = selected.map(task => task.taskId);
+    const base = await git(deps, record.path, ["rev-parse", "HEAD"]);
+    const criteria = [
+        { id: "landed-verifiers", description: "Every required project verifier passes on the integrated candidate of the landed tasks.", verifierIds: required },
+        { id: "landed-coherent", verifierIds: [],
+            description: "The landed subset is coherent on its own: it exposes no half-finished behavior and references no work of an undelivered run task.",
+            acceptance: { mode: "review-only", baselineCommit: base, bindings: [],
+                reviewOnlyReason: "partial-landing coherence: whether a subset stands alone without the undelivered tasks is a reviewer judgment, not a mechanical check" } }
+    ];
+    // Typed acceptance needs repository context; the target head is the landing baseline.
+    const created = await deps.tasks(record.path, base).create({
+        title: `Land ${ids.join(", ")} from ${state.runId}`,
+        goal: `Land delivered tasks ${ids.join(", ")} of run ${state.runId} ahead of the rest of its goal:\n${state.goal}`.slice(0, 64_000),
+        intent: "Merge only the frozen deliveries of the listed run tasks; the run, its root task and its checkouts stay as they are.",
+        criteria, createdSourceCommit: base, policyConfigHash: calculateConfigHash(config), sessionId: record.sessionId,
+        ...(root?.task.surface === undefined ? {} : { surface: root.task.surface })
+    });
+    return created.task.id;
+}
+/**
+ * `agent-ops run land`: prove and merge delivered children of a stopped run
+ * while the run stays resumable. Landed tasks remain delivered, so a later
+ * resume and finalize re-verify the whole goal on the new target.
+ */
+export async function landRun(options) {
+    const now = options.now ?? (() => new Date().toISOString());
+    let selected = [];
+    const held = await options.repository.mutate(options.runId, current => {
+        if (landingMarkerLive(current.landing))
+            throw new AgentOpsError("RUN_LANDING_IN_PROGRESS", `Run ${current.runId} is already landing delivered work.`);
+        assertLandable(current);
+        selected = selectLanding(current, options.taskIds);
+        return { ...current, landing: { processId: process.pid, hostname: hostname(), startedAt: now() } };
+    });
+    const taskIds = selected.map(task => task.taskId);
+    try {
+        const children = [];
+        for (const task of selected)
+            children.push(await deliveredCheckout(options.deps, held, task));
+        const sessionId = landingSessionId(held.runId);
+        const record = await freshLandingWorktree(options.deps, held, sessionId);
+        const parentTaskId = await createLandingRoot(options.deps, held, record, selected);
+        const { receipt } = await options.advance({ cwd: held.root, sessionId, parentTaskId, children });
+        const target = await git(options.deps, held.root, ["rev-parse", `${held.targetBranch}^{commit}`]);
+        const state = await options.repository.mutate(options.runId, current => ({ ...current, landing: null,
+            landings: [...(current.landings ?? []), { taskIds, receipt, target, landedAt: now() }],
+            events: [...current.events, { id: randomUUID(), at: now(), type: "integration", code: "RUN_PARTIAL_LANDED",
+                    workerId: null, taskId: null, detail: `Landed ${taskIds.join(", ")} at ${target}; receipt ${receipt}.` }].slice(-MAX_EVENTS) }));
+        return { state, taskIds, receipt };
+    }
+    catch (cause) {
+        await options.repository.mutate(options.runId, current => ({ ...current, landing: null })).catch(() => undefined);
+        throw cause;
+    }
+}

package/dist/runtime/src/run/service.js

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir } from "node:fs/promises";
+import { hostname } from "node:os";
 import { basename, join } from "node:path";
 import { sha256 } from "../fs/hash.js";
 import { AgentOpsError } from "../fs/paths.js";
@@ -10,6 +11,28 @@ import { redactSecrets } from "../security/redact.js";
 export const RUN_PHASES = ["planning", "implementing", "verifying", "reviewing", "integrating"];
 /** Writer slots are deliberately bounded; the coordinator may occupy one. */
 export const MAX_ACTIVE_WORKERS = 2;
+/**
+ * A marker from another host is treated as live: its process cannot be probed.
+ *
+ * ponytail: a reused pid on this host reads as live; clear the marker by hand if that ever bites.
+ */
+export function landingMarkerLive(marker) {
+    if (marker == null)
+        return false;
+    if (marker.hostname !== hostname())
+        return true;
+    try {
+        process.kill(marker.processId, 0);
+        return true;
+    }
+    catch (cause) {
+        return cause.code === "EPERM";
+    }
+}
+function refuseWhileLanding(state) {
+    if (landingMarkerLive(state.landing))
+        throw new AgentOpsError("RUN_LANDING_IN_PROGRESS", `Run ${state.runId} is landing delivered work; wait for run land to finish.`);
+}
 const RUN_ID = /^[a-z][a-z0-9-]{7,63}$/u;
 const ID = /^[A-Za-z0-9._:/-]{1,256}$/u;
 const SHA = /^[a-f0-9]{40,64}$/u;
@@ -127,6 +150,15 @@ export function assertRunState(value) {
         return invalid("Run phase or task progress is invalid.");
     if (state.policyBinding !== undefined && !validPolicyBinding(state.policyBinding))
         return invalid("Invalid run policy binding.");
+    if (state.landings !== undefined && (!boundedArray(state.landings, 512) || state.landings.some(l => !plain(l) ||
+        !boundedArray(l.taskIds, 512) || l.taskIds.length === 0 || l.taskIds.some(id => !ID.test(String(id))) ||
+        typeof l.receipt !== "string" || l.receipt.length === 0 || l.receipt.length > 4096 ||
+        !SHA.test(String(l.target)) || !Number.isFinite(Date.parse(String(l.landedAt))))))
+        return invalid("Invalid run landing record.");
+    if (state.landing != null && (!plain(state.landing) || !Number.isSafeInteger(state.landing.processId) ||
+        state.landing.processId < 1 || typeof state.landing.hostname !== "string" || state.landing.hostname.length > 256 ||
+        !Number.isFinite(Date.parse(String(state.landing.startedAt)))))
+        return invalid("Invalid run landing marker.");
     if (state.proofProcess != null && (!plain(state.proofProcess) || !Number.isSafeInteger(state.proofProcess.processId) ||
         state.proofProcess.processId < 1 || typeof state.proofProcess.processIdentity !== "string" ||
         state.proofProcess.processIdentity.length === 0 || state.proofProcess.processIdentity.length > 256))
@@ -442,6 +474,7 @@ export class RunService {
     }
     async resume(runId, retryApprovalIds = [], upgradeBudget = true, retryDeliveryTaskId, expectedFailureId) {
         const state = await this.#repository.mutate(runId, async (current) => {
+            refuseWhileLanding(current);
             if (retryDeliveryTaskId !== undefined && retryApprovalIds.length > 0)
                 throw new AgentOpsError("RUN_DELIVERY_RETRY_INVALID", "Delivery and approval retries require separate explicit controls.");
             const retry = retryDeliveryTaskId === undefined ? null : validateDeliveryRetry(current, retryDeliveryTaskId, Date.parse(this.#now()));
@@ -491,6 +524,7 @@ export class RunService {
         const cleanAnswer = bounded(answer.trim(), "answer", MAX_GOAL_LENGTH);
         const state = await this.#repository.mutate(runId, (current) => {
             const question = current.questions.find((item) => item.questionId === cleanQuestion);
+            refuseWhileLanding(current);
             if (current.status !== "awaiting-input" || current.disableRestart)
                 throw new AgentOpsError("RUN_NOT_AWAITING_INPUT", "Respond cannot restart a stopped or terminal run.");
             if (question === undefined)

package/docs/en/spec/harness-adapters.md

@@ -174,7 +174,8 @@ removes only `run` and keeps `loop`.
   ends without completing (blocked, budget exhausted, stopped, failing review)
   is reported with its `run status` state and code, its last `run logs` events,
   and the exact `agent-ops run resume <id>` and `agent-ops run stop <id>`
-  commands, and is never resumed automatically or taken over by the session.
+  commands, plus `agent-ops run land <id> --yes` when it has delivered tasks,
+  and is never resumed or landed automatically or taken over by the session.
   With worktree auto mode, the Claude `PreToolUse` worktree guard allows a
   write to exactly `.agent-ops/state/run-goal.md` in the main checkout without
   creating a worktree. Confirmed init/update pre-authorizes `agent-ops run`:

package/docs/en/spec/loop-engineering.md

@@ -73,6 +73,19 @@
   Interrupted controlled proof MUST record bounded redacted exit/signal, result
   failure stage and subprocess diagnostics without treating invalid output or a
   nonzero successful envelope as proof.
+- `run land <id> [--task <task-id>]... --yes` MAY merge delivered children of a
+  paused, blocked or budget-limited run with no live worker ahead of the rest.
+  Every selected task's dependencies MUST be selected or already landed
+  (`RUN_LAND_DEPENDENCY_OPEN`). Proof runs in a fresh landing worktree from the
+  target under a generated root task (required verifiers plus a review-only
+  coherence criterion, the run root's surface), then the usual verification,
+  two-round tree review and receipt-bound finish. The run's checkouts are pinned
+  and never removed; landed tasks stay delivered, the run stays resumable and
+  records `landings[]` and `RUN_PARTIAL_LANDED`, and its final proof re-verifies
+  the whole goal on the new target. While landing, a marker refuses resume,
+  respond and another land (`RUN_LANDING_IN_PROGRESS`); a marker of a process
+  that no longer exists does not block. A failure leaves the target unchanged
+  and keeps the landing worktree until the next land removes it.
   Initial recovery after a current manual resume MAY ignore an owned Codex limit
   snapshot received before activation whose native update second strictly predates
   that resume. Automatic restarts, unknown/equal/future timestamps, clock rollback,

package/docs/zh-TW/spec/harness-adapters.md

@@ -150,8 +150,8 @@ byte-identical。Update MUST 保留此 profile，除非提供 `--auto-run on|off
   一行說明該 code，並退回 subtask flow；`RUN_REPO_UNTRUSTED` 則停止並詢問使用者。
   未完成即結束的 run（blocked、budget exhausted、stopped、review 失敗）須回報其
   `run status` state 與 code、最後的 `run logs` event，以及確切的
-  `agent-ops run resume <id>` 與 `agent-ops run stop <id>` command，且永不自動
-  resume 或由 session 接手。在 worktree auto mode 下，Claude `PreToolUse`
+  `agent-ops run resume <id>` 與 `agent-ops run stop <id>` command；有已交付 task
+  時另附 `agent-ops run land <id> --yes`，且永不自動 resume、land 或由 session 接手。在 worktree auto mode 下，Claude `PreToolUse`
   worktree guard 允許在 main checkout 寫入恰為 `.agent-ops/state/run-goal.md`
   的路徑，且不建立 worktree。確認後的 init/update 會預先授權 `agent-ops run`：
   Claude Code 為 `Bash(agent-ops run *)`，Codex 為

package/docs/zh-TW/spec/loop-engineering.md

@@ -22,6 +22,7 @@
 - 執行中的 run 僅在原始 repository trust、config、可執行 runtime 與操作範圍完全相同時，自動續期過期的有限授權。續期以 digest 綁定前一版本並保留既有評估，拒絕無效／倒退時鐘；並行 stop、denial 或 scope 變更使續期失敗。權限已變更或撤銷時須沿既有 trust/resume 流程取得真正授權；續期不授予永久 trust，也不消除 denial。明確 resume 先核對不可變 renewal lineage，再同步 policy。回答問題也沿用相同恢復檢查；兩者皆不得復活已被明確拒絕的工作。
 - `run resume <id> --retry-approval <auth-event-id>` MAY 明確重試以額度不足 wrapper 失敗的 Codex 自動審批。每筆指定失敗 MUST 保有原始 private artifact、digest、worker identity 與 policy lineage；真正或未指定的拒絕仍阻擋。多筆失敗可重複旗標。成功確認會留存並在後續 resume 重新驗證；此操作不授予命令權限，原生審批必須重跑，既有 writer 死亡、checkout、trust 與預算檢查仍適用。
 - `run resume <id> --retry-delivery <task-id>` MAY 在修復 harness 原因後，明確重新排程一個被 `RUN_FINAL_PROOF_INTERRUPTED` 阻擋的 child。MUST 核對同一筆中斷 handoff、所有 writer 與 proof 已確認停止、所屬 checkout 乾淨及目前 trust/policy；保留 run、task、goal、baselines、commits、耗用與失敗歷史，記錄已確認的 attempt，並要求新 native generation 及正常交付驗證。MUST NOT 直接標記交付、解除其他阻擋或確認命令拒絕；approval retry 是獨立操作。一般 resume 保留 no-progress 阻擋。受控 proof 中斷 MUST 記錄有界且已遮蔽的 exit/signal、失敗階段與子程序診斷；無效輸出或非零退出的成功 envelope 不得視為證據。
+- `run land <id> [--task <task-id>]... --yes` MAY 在 run 為 paused、blocked 或 budget-limited 且無存活 worker 時，先行合併已交付的 child。每個選取 task 的依賴 MUST 已選取或已落地（`RUN_LAND_DEPENDENCY_OPEN`）。證明在由 target 建立的全新 landing worktree 中進行，使用自動產生的 root task（required verifier 加上 review-only 一致性條件，surface 沿用 run root），再走一般驗證、兩輪 tree review 與綁定 receipt 的 finish。run 的 checkout 只被釘住、永不移除；已落地 task 維持 delivered，run 仍可 resume 並記錄 `landings[]` 與 `RUN_PARTIAL_LANDED`，其最終證明會在新 target 上重新驗證整個 goal。落地期間的標記會拒絕 resume、respond 與另一次 land（`RUN_LANDING_IN_PROGRESS`）；已不存在的程序留下的標記不會阻擋。失敗時 target 不變，landing worktree 保留到下次 land 移除。
 - 當次人工 resume 的初始恢復 MAY 忽略啟用前收到、且 native 更新秒數嚴格早於該次 resume 的本執行緒 Codex 額度快照。自動重啟、未知／同秒／未來時間、時鐘倒退，以及啟用開始後收到的所有額度事件仍有效。Native 啟用 MUST 確認 goal 為 active，才能啟動或轉向 turn。人工 resume 可解除衍生的 `RUN_POLICY_DISABLED` task 阻擋，但保留 ID、耗用、歷史及其他產品失敗。
 - 收斂判斷比較實際 per-check 狀態及未解除的 finding pins；source fingerprint、時間或診斷文字本身不能算進展。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kylecheng3146/agent-ops",
-  "version": "0.11.3",
+  "version": "0.11.4",
   "description": "Evidence-driven development loops for agy, Codex, Claude Code, and opencode",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",