@kylecheng3146/agent-ops 0.2.1 → 0.2.3

package/README.md

@@ -301,12 +301,12 @@ the project configuration defines those workflows.
 
 ### External review
 
-`agent-ops review` can hand the review to another agent CLI, so the work is not
-judged by the agent that produced it. Enable it during `agent-ops init` (the
-default is off). A bare review applies the built-in `change-quality` criterion
-to a deterministic worktree (or `--base`) scope. `--task` reviews keep their
-task criteria and require current verification evidence. The detailed report
-is displayed; a minimal source-fingerprint attestation is persisted after PASS.
+`agent-ops review --task <id> --yes` can hand a complete task-bound review to
+agent CLIs, so the work is not judged only by the agent that produced it.
+Enable review targets during `agent-ops init` (the default is off). Every task
+criterion and its original description are reviewed; partial criteria,
+generic reviews, and missing `--yes` are rejected. Current verification
+evidence is required before any reviewer starts.
 
 Each attempt uses a fresh temporary session and disposable repository clone, a
 small allowlisted environment, and a target-native read-only mode. Claude
@@ -315,14 +315,26 @@ persistence, while Agy runs in sandboxed plan mode. Codex and Agy preserve their
 existing login environment, so their context isolation is intentionally weaker
 than Claude's. `opencode` is not a review target.
 
-The chain prefers a reviewer CLI different from the hosting CLI. If none is
-usable, a fresh same-target session is allowed but is rendered as
-`DEGRADED: isolated self-review`; a development session is never resumed.
-
-The first valid `PASS` or `FAIL` is final. Attempts that produce no verdict —
-including login failures and unparseable output — advance to the next target
-and remain visible in the result's `attempts`. `--yes` is still required for
-every run, since each run spends another provider's quota.
+Exactly two fresh sessions are planned. With three configured targets, the
+explicit `AGENT_OPS_HOST` is excluded and `agy` is primary when available; with
+two targets both run in configured order; with one target the same CLI is run
+twice. The first session is the necessary review. Only its PASS starts the
+second adversarial session, which receives the first full redacted report as
+untrusted data. The first FAIL or NOT_RUN stops; a second FAIL is final FAIL,
+and a missing second verdict is NOT_RUN. A same-target pair is still
+independent because the sessions and clones are fresh.
+
+Host network or loopback restrictions return `REVIEW_NOT_RUN` before any
+reviewer is started. A trusted outer host runner may rerun the exact same
+command once with both capabilities; the result remains NOT_RUN if that host
+is unavailable. There is no automatic permission bypass inside the repository.
+Reviewer attempts and preflight diagnostics remain visible in JSON. `--yes` is
+required because a complete run spends provider quota twice.
+
+After a complete PASS, the full redacted primary and adversarial reports are
+stored privately under `.agent-ops/reviews/`; the source-fingerprint attestation
+stores only the task, reviewer/session identities, report digests, and artifact
+reference. Any artifact or attestation write failure is NOT_RUN, never PASS.
 
 Authentication is diagnosed, never guessed:
 

package/dist/packages/cli/src/args.js

@@ -74,6 +74,7 @@ export function parseArgs(argv) {
     const criteria = [];
     const evidence = [];
     let checkAuth = false;
+    const checkAuthTargets = [];
     let completionGate;
     let dryRun = false;
     let json = false;
@@ -205,6 +206,18 @@ export function parseArgs(argv) {
                 }
                 checkAuth = true;
                 break;
+            case "--check-auth-target": {
+                const value = readOptionValue(argv, index, token);
+                if (!REVIEW_TARGETS.has(value)) {
+                    invalidValue(token, value);
+                }
+                if (checkAuthTargets.includes(value)) {
+                    duplicate(`${token} ${value}`);
+                }
+                checkAuthTargets.push(value);
+                index += 1;
+                break;
+            }
             case "--completion-gate":
                 if (completionGate !== undefined) {
                     duplicate(token);
@@ -322,6 +335,7 @@ export function parseArgs(argv) {
             sessionId !== undefined ||
             base !== undefined ||
             checkAuth ||
+            checkAuthTargets.length > 0 ||
             dryRun ||
             yes) {
             throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Only --json may be combined with global help or version.");
@@ -367,9 +381,15 @@ export function parseArgs(argv) {
     if (checkAuth && command !== "doctor") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--check-auth may be used only with doctor.");
     }
+    if (checkAuthTargets.length > 0 && command !== "doctor") {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--check-auth-target may be used only with doctor.");
+    }
+    if (checkAuthTargets.length > 0 && !checkAuth) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--check-auth-target requires --check-auth.");
+    }
     if (reviewTargets.length > 0 && command !== "init") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", command === "review"
-            ? "--review-target configures init; for one review run, use --harness <target>."
+            ? "--review-target configures init; review uses the configured reviewer pair."
             : "--review-target may be used only with init.");
     }
     if (completionGate !== undefined && command !== "init") {
@@ -425,18 +445,20 @@ export function parseArgs(argv) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Verify accepts only scope, task or session, base, and json options.");
     }
     if (command === "review" &&
-        (title !== undefined || sessionId !== undefined)) {
-        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Review accepts harness, criteria, evidence, scope, dry-run, json, and yes options.");
+        (title !== undefined || sessionId !== undefined || dryRun)) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Review accepts task, base, json, and yes options.");
     }
-    if (command === "review" &&
-        taskId === undefined &&
-        (criteria.length > 0 || evidence.length > 0)) {
-        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Review criteria and evidence require --task.");
+    if (command === "review" && taskId === undefined) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Review requires --task for the complete task-bound review.");
     }
-    if (command === "review" &&
-        harness !== undefined &&
-        (harness.length !== 1 || !REVIEW_TARGETS.has(harness[0] ?? ""))) {
-        invalidValue("--harness", harness.join(","));
+    if (command === "review" && !yes) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Review requires --yes to authorize both reviewer sessions.");
+    }
+    if (command === "review" && harness !== undefined) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Complete review uses the configured reviewer pair; omit --harness.");
+    }
+    if (command === "review" && (criteria.length > 0 || evidence.length > 0)) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Complete review covers every task criterion; omit --criterion and --evidence.");
     }
     if (command === "allow-stop" &&
         (sessionId === undefined ||
@@ -469,6 +491,7 @@ export function parseArgs(argv) {
         ...(sessionId === undefined ? {} : { sessionId }),
         ...(base === undefined ? {} : { base }),
         ...(checkAuth ? { checkAuth } : {}),
+        ...(checkAuthTargets.length === 0 ? {} : { checkAuthTargets }),
         dryRun,
         json,
         yes

package/dist/packages/cli/src/bin.js

@@ -15,6 +15,7 @@ import { FileTrustStore } from "../../../runtime/src/security/trust.js";
 import { localStatePaths } from "../../../runtime/src/security/permissions.js";
 import { calculateConfigHash } from "../../../runtime/src/config/hash.js";
 import { FileEvidenceStore } from "../../../runtime/src/verify/evidence.js";
+import { calculateSourceFingerprint } from "../../../runtime/src/verify/source-fingerprint.js";
 import { VerificationService } from "../../../runtime/src/verify/service.js";
 import { NodeVerificationProcessRunner } from "../../../runtime/src/verify/spawn.js";
 import { runCli } from "./cli.js";
@@ -31,7 +32,8 @@ import { runTaskCommand } from "./commands/task.js";
 import { runReviewCommand } from "./commands/review.js";
 import { createReviewExecutor, ReviewInterruptedError } from "../../../runtime/src/review/execute.js";
 import { probeReviewTarget } from "../../../runtime/src/review/probe.js";
-import { detectHostTarget, orderChain, resolveReviewRole } from "../../../runtime/src/review/roles.js";
+import { resolveReviewScope } from "../../../runtime/src/review/scope.js";
+import { resolveReviewRole } from "../../../runtime/src/review/roles.js";
 import { runTrustCommand } from "./commands/trust.js";
 import { runVerifyCommand } from "./commands/verify.js";
 import { runAllowStopCommand } from "./commands/allow-stop.js";
@@ -308,7 +310,10 @@ else {
                         },
                         ...(args.checkAuth === true
                             ? { checkReviewTargetAuth: true }
-                            : {})
+                            : {}),
+                        ...(args.checkAuthTargets === undefined
+                            ? {}
+                            : { checkAuthTargets: args.checkAuthTargets })
                     });
                 }
                 if (args.command === "uninstall") {
@@ -386,12 +391,10 @@ else {
                 }
                 if (args.command === "review") {
                     const reviewSessionId = process.env.AGENT_OPS_SESSION_ID;
+                    const reviewGit = gitRunner(root);
                     const reviewConfig = (await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config;
                     const reviewRole = resolveReviewRole("independent-review", reviewConfig.reviewRoles ?? []);
-                    const selectedReviewTarget = args.harness?.[0];
-                    const plannedReviewTargets = orderChain(selectedReviewTarget === undefined
-                        ? reviewRole?.targets ?? []
-                        : [selectedReviewTarget], detectHostTarget(process.env));
+                    const configuredReviewTargets = reviewRole?.targets ?? [];
                     const controller = new AbortController();
                     let interruptedBy;
                     const interrupt = (signal) => {
@@ -414,15 +417,15 @@ else {
                             ...(reviewConfig.reviewRoles === undefined
                                 ? {}
                                 : { roles: reviewConfig.reviewRoles }),
-                            targets: plannedReviewTargets,
+                            targets: configuredReviewTargets,
                             root,
-                            gitRunner: gitRunner(root),
+                            gitRunner: reviewGit,
                             policyConfigHash: calculateConfigHash(reviewConfig),
                             currentPolicyConfigHash: async () => calculateConfigHash((await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config),
                             config: reviewConfig,
                             evidenceStore: new FileEvidenceStore(root, root),
                             execute: createReviewExecutor({
-                                targets: plannedReviewTargets,
+                                targets: configuredReviewTargets,
                                 cwd: root,
                                 ...(reviewRole?.model === undefined
                                     ? {}
@@ -433,6 +436,15 @@ else {
                                 ...(reviewRole?.timeoutMs === undefined
                                     ? {}
                                     : { timeoutMs: reviewRole.timeoutMs }),
+                                preflightTarget: async (target) => await probeReviewTarget(target, { cwd: root, deep: true }),
+                                verifySourceFingerprint: async (expected) => {
+                                    const currentScope = await resolveReviewScope({
+                                        root,
+                                        runner: reviewGit,
+                                        ...(args.base === undefined ? {} : { base: args.base })
+                                    });
+                                    return await calculateSourceFingerprint(root, currentScope, reviewGit) === expected;
+                                },
                                 signal: controller.signal,
                                 onProgress: (line) => {
                                     process.stderr.write(`${line}\n`);

package/dist/packages/cli/src/cli.js

@@ -32,14 +32,14 @@ Commands:
 
 Options:
   --scope <project|user>
-  --harness <all|both|agy|claude|codex|opencode|comma-separated>  Init/update/uninstall; review accepts one configured target
+  --harness <all|both|agy|claude|codex|opencode|comma-separated>  Init/update/uninstall; review uses configured targets
   --hook-target <harness=surface-id>  Repeatable advanced init/update option
   --profile <core|advisory|guardrails|loop>  Repeatable
-  --review-target <codex|agy|claude>  Repeatable init option; external review
-                                      targets in fallback-chain order
+  --review-target <codex|agy|claude>  Repeatable init option; review pair order
   --completion-gate                  Init only: enable the project-loop completion gate
-  --check-auth                        Doctor only: probe each review target's
+  --check-auth                        Doctor only: probe selected review targets'
                                       authentication with one real call
+  --check-auth-target <target>        Repeatable doctor filter with --check-auth
   --task <id>
   --parent <task-id>                  Task create: record a subtask of this
                                       task; task status: list its subtasks
@@ -159,18 +159,16 @@ Options:
   --base <git-ref>   Verify a clean committed range
   --json
 `,
-    review: `Usage: agent-ops review [options]
+    review: `Usage: agent-ops review --task <id> --yes [options]
 
-Run one independent read-only review against the configured target chain.
+Run the complete task-bound review: one necessary reviewer followed by one
+fresh adversarial reviewer from the configured pair.
 
 Options:
-  --task <id>
-  --session <id>
-  --criterion <id>     Repeatable: review only these task criteria
-  --harness <target>   One configured review target
-  --base <git-ref>
+  --task <id>          Required task whose original criteria are reviewed
+  --base <git-ref>     Review a clean committed range
   --json
-  --yes                Authorize the review call
+  --yes                Required authorization for both reviewer sessions
 `,
     "allow-stop": `Usage: agent-ops allow-stop --session <id> [options]
 
@@ -234,7 +232,11 @@ export async function runCli(argv, io, services) {
             return writeAndReturn(io, errorEnvelope("CLI_COMMAND_UNAVAILABLE", `Command is not implemented yet: ${args.command}`), args.json, 1);
         }
         const result = await execute(args);
-        return writeAndReturn(io, result, args.json, result.status === "ok" ? 0 : 1);
+        return writeAndReturn(io, result, args.json, result.status === "ok"
+            ? 0
+            : result.code === "REVIEW_NOT_RUN"
+                ? 2
+                : 1);
     }
     catch (error) {
         if (error instanceof CliArgumentError) {

package/dist/packages/cli/src/commands/review.js

@@ -1,8 +1,8 @@
 import { buildReviewPacket } from "../../../../runtime/src/review/packet.js";
 import { runIndependentReview } from "../../../../runtime/src/review/runner.js";
 import { renderReviewResult } from "../../../../runtime/src/review/render.js";
-import { invalidateReviewAttestation, saveReviewAttestation } from "../../../../runtime/src/review/attestation.js";
-import { resolveReviewRole } from "../../../../runtime/src/review/roles.js";
+import { invalidateReviewAttestation, reviewReportDigest, saveReviewAttestation, saveReviewReportArtifact } from "../../../../runtime/src/review/attestation.js";
+import { detectHostTarget, planReviewTargets, resolveReviewRole } from "../../../../runtime/src/review/roles.js";
 import { AgentOpsError } from "../../../../runtime/src/fs/paths.js";
 import { assertSafeSupportingPaths, isReviewerPolicyPath, resolveReviewScope, reviewScopeSignature } from "../../../../runtime/src/review/scope.js";
 import { calculateSourceFingerprint } from "../../../../runtime/src/verify/source-fingerprint.js";
@@ -222,6 +222,12 @@ function sourceChangedResult(result) {
         ...(result.plannedTargets === undefined
             ? {}
             : { plannedTargets: result.plannedTargets }),
+        ...(result.sourceFingerprint === undefined
+            ? {}
+            : { sourceFingerprint: result.sourceFingerprint }),
+        ...(result.hostTarget === undefined
+            ? {}
+            : { hostTarget: result.hostTarget }),
         ...(result.scope === undefined ? {} : { scope: result.scope }),
         ...(result.independence === undefined
             ? {}
@@ -230,11 +236,90 @@ function sourceChangedResult(result) {
             ? {}
             : { sessionIsolation: result.sessionIsolation }),
         ...(result.attempts === undefined ? {} : { attempts: result.attempts }),
+        ...(result.report === undefined ? {} : { report: result.report }),
+        ...(result.adversarial === undefined
+            ? {}
+            : { adversarial: result.adversarial }),
         ...(result.verification === undefined
             ? {}
             : { verification: result.verification })
     };
 }
+function hasCompleteReviewEvidence(result) {
+    const attempts = result.attempts;
+    const plannedTargets = result.plannedTargets;
+    return result.status === "PASS" &&
+        result.report !== undefined &&
+        result.adversarial !== undefined &&
+        result.adversarial.refuted === false &&
+        result.sessionIsolation === "fresh" &&
+        plannedTargets !== undefined &&
+        plannedTargets.length === 2 &&
+        result.harness === plannedTargets[0] &&
+        result.adversarial.target === plannedTargets[1] &&
+        attempts !== undefined &&
+        attempts.length === 2 &&
+        attempts.every((attempt, index) => attempt.target === plannedTargets[index] &&
+            attempt.status === "PASS" &&
+            attempt.sessionId !== undefined);
+}
+async function persistReviewEvidence(options, result, sourceFingerprint, context) {
+    if (options.root === undefined || sourceFingerprint === undefined) {
+        return result;
+    }
+    const complete = hasCompleteReviewEvidence(result);
+    const artifactResult = result.status === "PASS" && !complete
+        ? {
+            ...result,
+            status: "NOT_RUN",
+            reason: "adversarial-review-missing"
+        }
+        : result;
+    let reportArtifact;
+    try {
+        reportArtifact = await saveReviewReportArtifact(options.root, artifactResult, sourceFingerprint, context?.taskId);
+    }
+    catch {
+        return {
+            ...result,
+            status: "NOT_RUN",
+            reason: "evidence-write-failed"
+        };
+    }
+    if (!complete) {
+        return artifactResult;
+    }
+    if (result.status !== "PASS" || context?.allCriteriaReviewed === false) {
+        return result;
+    }
+    try {
+        const attempts = result.attempts;
+        const plannedTargets = result.plannedTargets;
+        await saveReviewAttestation(options.root, {
+            schemaVersion: 2,
+            ...(context === undefined ? {} : { taskId: context.taskId }),
+            harness: result.harness,
+            status: "PASS",
+            sourceFingerprint,
+            reviewTargets: [plannedTargets[0], plannedTargets[1]],
+            reviewSessionIds: [attempts[0].sessionId, attempts[1].sessionId],
+            sessionIsolation: "fresh",
+            primaryReportDigest: reviewReportDigest(result.report),
+            adversarialReportDigest: reviewReportDigest(result.adversarial.report),
+            reportArtifact,
+            ...(result.hostTarget === undefined ? {} : { hostTarget: result.hostTarget }),
+            createdAt: new Date().toISOString()
+        });
+    }
+    catch {
+        return {
+            ...result,
+            status: "NOT_RUN",
+            reason: "evidence-write-failed"
+        };
+    }
+    return result;
+}
 export async function runReviewCommand(options) {
     const role = resolveReviewRole(options.role ?? "independent-review", options.roles ?? []);
     const selectedHarness = harness(options.args.harness);
@@ -243,17 +328,30 @@ export async function runReviewCommand(options) {
         !configuredTargets.includes(selectedHarness)) {
         throw new AgentOpsError("REVIEW_TARGET_NOT_CONFIGURED", `${selectedHarness} is not enabled for independent-review. Configure it with init --review-target ${selectedHarness}.`);
     }
-    const plannedTargets = selectedHarness === undefined
+    const configuredSelection = selectedHarness === undefined
         ? options.targets ?? configuredTargets
         : [selectedHarness];
+    const targetPlan = planReviewTargets(configuredSelection, detectHostTarget(options.env ?? process.env));
+    const hostTarget = detectHostTarget(options.env ?? process.env);
+    const plannedTargets = targetPlan.reason === undefined
+        ? targetPlan.targets
+        : configuredSelection;
     const target = plannedTargets[0] ?? selectedHarness ?? "codex";
     const resultBase = {
         harness: target,
         plannedTargets,
         model: role?.model ?? options.model ?? "configured",
         effort: role?.effort ?? options.effort ?? "configured",
-        prompt: ""
+        prompt: "",
+        ...(hostTarget === undefined ? {} : { hostTarget })
     };
+    if (targetPlan.reason !== undefined) {
+        return notRunEnvelope({
+            ...resultBase,
+            status: "NOT_RUN",
+            reason: targetPlan.reason
+        });
+    }
     const context = await taskContext(options);
     const evidenceRequirements = (options.args.evidence ?? []).map((value) => {
         const separator = value.indexOf("=");
@@ -358,6 +456,8 @@ export async function runReviewCommand(options) {
         invocation: {
             harness: target,
             plannedTargets,
+            ...(sourceFingerprint === undefined ? {} : { sourceFingerprint }),
+            ...(hostTarget === undefined ? {} : { hostTarget }),
             model: role?.model ?? options.model ?? "configured",
             effort: role?.effort ?? options.effort ?? "configured",
             packet,
@@ -408,55 +508,46 @@ export async function runReviewCommand(options) {
             if (reviewScopeSignature(scope) !== reviewScopeSignature(postflight) ||
                 (options.policyConfigHash !== undefined && currentHash !== options.policyConfigHash) ||
                 postflightFingerprint !== sourceFingerprint) {
-                return notRunEnvelope(sourceChangedResult(result));
+                const changed = await persistReviewEvidence(options, sourceChangedResult(result), sourceFingerprint, context);
+                return notRunEnvelope(changed);
             }
         }
         catch {
-            return notRunEnvelope(sourceChangedResult(result));
+            const changed = await persistReviewEvidence(options, sourceChangedResult(result), sourceFingerprint, context);
+            return notRunEnvelope(changed);
         }
     }
+    const persisted = await persistReviewEvidence(options, result, sourceFingerprint, context);
+    if (persisted.status === "NOT_RUN") {
+        return notRunEnvelope(persisted);
+    }
+    const finalResult = persisted;
     // Evidence is only appended while the task is active: a completed record
     // must stay exactly as it was verified.
     if (context !== undefined &&
         options.tasks !== undefined &&
-        result.status === "PASS" &&
+        finalResult.status === "PASS" &&
         context.active &&
-        result.results !== undefined) {
-        await options.tasks.recordEvidence(context.taskId, Object.fromEntries(result.results.map((item) => [
+        finalResult.results !== undefined) {
+        await options.tasks.recordEvidence(context.taskId, Object.fromEntries(finalResult.results.map((item) => [
             item.criterionId,
-            item.evidence.map((reference) => `review:${result.harness}:${reference}`)
+            item.evidence.map((reference) => `review:${finalResult.harness}:${reference}`)
         ])));
     }
-    // The attestation is what a Stop gate reads. It is keyed by the verified
-    // source fingerprint, so it stops satisfying the gate the moment the tree
-    // changes again.
-    if (options.root !== undefined &&
-        result.status === "PASS" &&
-        sourceFingerprint !== undefined &&
-        (context === undefined || context.allCriteriaReviewed)) {
-        await saveReviewAttestation(options.root, {
-            schemaVersion: 1,
-            ...(context === undefined ? {} : { taskId: context.taskId }),
-            harness: result.harness,
-            status: "PASS",
-            sourceFingerprint,
-            createdAt: new Date().toISOString()
-        });
-    }
-    const message = result.status === "PASS"
+    const message = finalResult.status === "PASS"
         ? "Independent review passed."
-        : result.status === "FAIL"
+        : finalResult.status === "FAIL"
             ? "Independent review failed."
             : "Independent review was not run.";
     const data = {
         message,
-        result,
-        text: renderReviewResult(result)
+        result: finalResult,
+        text: renderReviewResult(finalResult)
     };
-    if (result.status === "PASS") {
+    if (finalResult.status === "PASS") {
         return okEnvelope("REVIEW_RESULT", data);
     }
-    const code = result.status === "FAIL" ? "REVIEW_FAILED" : "REVIEW_NOT_RUN";
+    const code = finalResult.status === "FAIL" ? "REVIEW_FAILED" : "REVIEW_NOT_RUN";
     return {
         code,
         status: "error",

package/dist/runtime/src/adapters/claude/output.js

@@ -40,7 +40,8 @@ export function claudeHookOutput(event, result) {
                 decision: "block",
                 reason: `agent-ops: ${result.code} reported FAIL for ${failed.join(", ")}. ` +
                     "Resolve every failing item — an unsatisfied independent-review " +
-                    "gate is cleared by running `agent-ops review` to a PASS — then " +
+                    "gate is cleared by running `agent-ops review --task <task-id> --yes` " +
+                    "to a PASS — then " +
                     "stop again.",
                 evidence: result.evidence
             });
@@ -53,6 +54,15 @@ export function claudeHookOutput(event, result) {
     if (result.action === "continue" && result.status === "PASS") {
         return { exitCode: 0, stdout: "", stderr: "" };
     }
+    // An advisory PreToolUse result carries nothing the user can act on: the
+    // command runs either way. Saying so on every unparsed command — a heredoc,
+    // a substitution — trains the reader to ignore the hook that also refuses
+    // stops. A result with a remedy still speaks.
+    if (event === "PreToolUse" &&
+        result.action === "continue" &&
+        result.remedy === undefined) {
+        return { exitCode: 0, stdout: "", stderr: "" };
+    }
     if (event === "PreToolUse" && result.action === "block") {
         return json({
             hookSpecificOutput: {

package/dist/runtime/src/hooks/completion-gate.js

@@ -3,7 +3,7 @@ import { sha256 } from "../fs/hash.js";
 import { AgentOpsError } from "../fs/paths.js";
 import { readPrivateFile, withPrivateFileLock, writePrivateFile } from "../security/permissions.js";
 import { checkTaskCompletionEvidence, findIncompleteSubtask } from "../task/completion.js";
-import { collectChangeSurface } from "../verify/change-surface.js";
+import { collectBaseChangePaths, collectChangeSurface } from "../verify/change-surface.js";
 import { calculateSourceFingerprint } from "../verify/source-fingerprint.js";
 const FINGERPRINT = /^[a-f0-9]{64}$/u;
 const SESSION = /^[^\0\r\n]{1,256}$/u;
@@ -76,6 +76,38 @@ export class CompletionGateService {
         const surface = await collectChangeSurface(this.#options.gitRunner);
         return await calculateSourceFingerprint(this.#options.root, { mode: "worktree", changedFiles: surface.paths }, this.#options.gitRunner);
     }
+    /**
+     * The fingerprint the task's evidence should carry. Committed work leaves an
+     * empty worktree surface: there is nothing left to measure there, and the
+     * evidence names the `--base` range `task complete` was given instead. That
+     * range is recomputed here rather than trusted, so evidence for a range that
+     * no longer ends at HEAD still fails.
+     */
+    async #evidenceFingerprint(completionBase) {
+        const worktree = await this.#fingerprint();
+        if (completionBase === null) {
+            return worktree;
+        }
+        const surface = await collectChangeSurface(this.#options.gitRunner);
+        if (surface.paths.length > 0) {
+            return worktree;
+        }
+        try {
+            const changedFiles = await collectBaseChangePaths(this.#options.gitRunner, completionBase);
+            if (changedFiles.length === 0) {
+                return worktree;
+            }
+            return await calculateSourceFingerprint(this.#options.root, {
+                mode: "base",
+                baseRef: completionBase,
+                resolvedBase: completionBase,
+                changedFiles
+            }, this.#options.gitRunner);
+        }
+        catch {
+            return worktree;
+        }
+    }
     async initialize(sessionId) {
         const fingerprint = await this.#fingerprint();
         const state = await this.#store.mutate(sessionId, (current) => current ?? {
@@ -103,7 +135,7 @@ export class CompletionGateService {
             event.event === "command-batch" ? event.commands : [];
         return commands.some(({ command, args }) => [command, ...args].includes("allow-stop"));
     }
-    async #validateTask(sessionId, sourceFingerprint) {
+    async #validateTask(sessionId) {
         let stored;
         try {
             stored = await this.#options.taskService.status({ sessionId });
@@ -120,7 +152,11 @@ export class CompletionGateService {
         if (unfinished !== undefined) {
             return gateResult("block", "FAIL", "COMPLETION_GATE_SUBTASK_INCOMPLETE", `Complete subtask ${unfinished.task.id} before its parent.`);
         }
-        const problem = await checkTaskCompletionEvidence(stored, { ...this.#options, sourceFingerprint });
+        const sourceFingerprint = await this.#evidenceFingerprint(stored.completionBase);
+        const problem = await checkTaskCompletionEvidence(stored, {
+            ...this.#options,
+            sourceFingerprint
+        });
         if (problem !== null) {
             return gateResult("block", problem.status, `COMPLETION_GATE_${problem.code}`, problem.remedy);
         }
@@ -154,7 +190,7 @@ export class CompletionGateService {
             return gateResult("block", "UNKNOWN", "COMPLETION_GATE_NOT_INITIALIZED", "The session baseline is unavailable; continue once so PreInvocation can initialize it.");
         }
         if (state.baselineFingerprint !== fingerprint && state.permitFingerprint !== fingerprint) {
-            const failure = await this.#validateTask(sessionId, fingerprint);
+            const failure = await this.#validateTask(sessionId);
             if (failure !== null)
                 return failure;
         }