@kylecheng3146/agent-ops 0.2.1 → 0.2.3

package/dist/runtime/src/hooks/shell.js

@@ -2,19 +2,179 @@ import { normalizeHookEvent } from "./normalize.js";
 const MAX_COMMAND_LENGTH = 16 * 1024;
 const MAX_COMMANDS = 64;
 const MAX_WORDS = 256;
-function parseShellWords(input) {
-    if (input.length === 0 || input.length > MAX_COMMAND_LENGTH) {
-        return null;
+/** Substitutions nest; a deeper stack is pathological input, not a script. */
+const MAX_SUBSTITUTION_DEPTH = 8;
+/** Stands in for a substitution's value in the word that contained it. */
+const SUBSTITUTION_PLACEHOLDER = "_";
+/**
+ * Walks from the opening parenthesis of a `$(...)` to the one that closes it,
+ * honouring quotes on the way. A quoted `)` is text, not structure: counting it
+ * as structure loses the whole command, and a lost command is one the policy
+ * never sees.
+ */
+function scanParenthesis(input, open) {
+    let depth = 0;
+    let index = open;
+    while (index < input.length) {
+        const character = input[index];
+        if (character === "\\") {
+            index += 2;
+            continue;
+        }
+        if (character === "'") {
+            const end = input.indexOf("'", index + 1);
+            if (end < 0)
+                return null;
+            index = end + 1;
+            continue;
+        }
+        if (character === "\"") {
+            const end = scanDoubleQuote(input, index + 1);
+            if (end === null)
+                return null;
+            index = end + 1;
+            continue;
+        }
+        if (character === "`") {
+            const end = scanBacktick(input, index + 1);
+            if (end === null)
+                return null;
+            index = end + 1;
+            continue;
+        }
+        if (character === "(") {
+            depth += 1;
+        }
+        else if (character === ")") {
+            depth -= 1;
+            if (depth === 0)
+                return index;
+        }
+        index += 1;
+    }
+    return null;
+}
+/** Index of the `"` that closes the one already consumed. */
+function scanDoubleQuote(input, start) {
+    let index = start;
+    while (index < input.length) {
+        const character = input[index];
+        if (character === "\\") {
+            index += 2;
+            continue;
+        }
+        if (character === "`") {
+            const end = scanBacktick(input, index + 1);
+            if (end === null)
+                return null;
+            index = end + 1;
+            continue;
+        }
+        if (character === "$" && input[index + 1] === "(") {
+            const end = scanParenthesis(input, index + 1);
+            if (end === null)
+                return null;
+            index = end + 1;
+            continue;
+        }
+        if (character === "\"")
+            return index;
+        index += 1;
+    }
+    return null;
+}
+function scanBacktick(input, start) {
+    let index = start;
+    while (index < input.length) {
+        if (input[index] === "\\") {
+            index += 2;
+            continue;
+        }
+        if (input[index] === "`")
+            return index;
+        index += 1;
+    }
+    return null;
+}
+/**
+ * The substitutions in text the shell expands but does not tokenize as a
+ * command line — the body of an unquoted heredoc. Quotes there are literal
+ * characters; only `$(...)` and backticks run anything.
+ */
+function collectExpansions(input) {
+    const found = [];
+    let index = 0;
+    while (index < input.length) {
+        const character = input[index];
+        if (character === "\\") {
+            index += 2;
+            continue;
+        }
+        if (character === "$" && input[index + 1] === "(") {
+            const end = scanParenthesis(input, index + 1);
+            if (end === null)
+                return null;
+            found.push(input.slice(index + 2, end));
+            index = end + 1;
+            continue;
+        }
+        if (character === "`") {
+            const end = scanBacktick(input, index + 1);
+            if (end === null)
+                return null;
+            found.push(input.slice(index + 1, end));
+            index = end + 1;
+            continue;
+        }
+        index += 1;
+    }
+    return found;
+}
+/** Reads the `<<WORD`, `<<-WORD`, `<<'WORD'` that follows a `<<`. */
+function readHeredocHeader(input, start) {
+    let index = start;
+    if (input[index] === "-")
+        index += 1;
+    while (input[index] === " " || input[index] === "\t")
+        index += 1;
+    const quote = input[index];
+    if (quote === "'" || quote === "\"") {
+        const end = input.indexOf(quote, index + 1);
+        if (end < 0)
+            return null;
+        const delimiter = input.slice(index + 1, end);
+        return delimiter.length === 0
+            ? null
+            : { marker: { delimiter, expands: false }, end: end + 1 };
+    }
+    let delimiter = "";
+    while (index < input.length && /[A-Za-z0-9_.-]/u.test(input[index] ?? "")) {
+        delimiter += input[index];
+        index += 1;
     }
+    return delimiter.length === 0
+        ? null
+        : { marker: { delimiter, expands: true }, end: index };
+}
+/**
+ * One quote-aware pass over a command line. Everything that decides whether a
+ * character is structure or text — quotes, escapes, heredocs, substitutions —
+ * is decided here, once, so no later pass can disagree with this one about
+ * where a quote begins.
+ */
+function parseLine(input) {
     const commands = [];
+    const substitutions = [];
+    const pending = [];
     let words = [];
     let word = "";
-    let quote = null;
-    let escaped = false;
+    let started = false;
+    let index = 0;
     const finishWord = () => {
-        if (word.length > 0) {
+        if (started) {
             words.push(word);
             word = "";
+            started = false;
         }
     };
     const finishCommand = () => {
@@ -24,66 +184,154 @@ function parseShellWords(input) {
             words = [];
         }
     };
-    for (let index = 0; index < input.length; index += 1) {
+    const addText = (text) => {
+        word += text;
+        started = true;
+    };
+    while (index < input.length) {
         const character = input[index];
-        if (character === undefined) {
+        if (character === undefined || character === "\0") {
             return null;
         }
-        if (escaped) {
-            word += character;
-            escaped = false;
+        if (word.length > MAX_COMMAND_LENGTH) {
+            return null;
+        }
+        if (character === "\\") {
+            const next = input[index + 1];
+            if (next === undefined)
+                return null;
+            if (next !== "\n")
+                addText(next);
+            index += 2;
             continue;
         }
-        if (character === "\\" && quote !== "'") {
-            escaped = true;
+        if (character === "'") {
+            const end = input.indexOf("'", index + 1);
+            if (end < 0)
+                return null;
+            addText(input.slice(index + 1, end));
+            index = end + 1;
             continue;
         }
-        if (quote !== "'" &&
-            (character === "$" || character === "`")) {
-            return null;
+        if (character === "\"") {
+            const end = scanDoubleQuote(input, index + 1);
+            if (end === null)
+                return null;
+            const quoted = input.slice(index + 1, end);
+            const expansions = collectExpansions(quoted);
+            if (expansions === null)
+                return null;
+            substitutions.push(...expansions);
+            addText(quoted);
+            index = end + 1;
+            continue;
         }
-        if (quote !== null) {
-            if (character === quote) {
-                quote = null;
-            }
-            else {
-                word += character;
-            }
+        if (character === "$" && input[index + 1] === "(") {
+            const end = scanParenthesis(input, index + 1);
+            if (end === null)
+                return null;
+            substitutions.push(input.slice(index + 2, end));
+            addText(SUBSTITUTION_PLACEHOLDER);
+            index = end + 1;
             continue;
         }
-        if (character === "'" || character === "\"") {
-            quote = character;
+        if (character === "`") {
+            const end = scanBacktick(input, index + 1);
+            if (end === null)
+                return null;
+            substitutions.push(input.slice(index + 1, end));
+            addText(SUBSTITUTION_PLACEHOLDER);
+            index = end + 1;
             continue;
         }
-        if (/\s/.test(character)) {
-            finishWord();
-            if (character === "\n") {
-                finishCommand();
+        if (character === "<" && input[index + 1] === "<") {
+            const header = readHeredocHeader(input, index + 2);
+            if (header === null) {
+                // `<<` with no delimiter is a here-string or an unfinished line; either
+                // way there is no body to skip.
+                addText("<<");
+                index += 2;
+                continue;
             }
+            pending.push(header.marker);
+            addText(input.slice(index, header.end));
+            index = header.end;
             continue;
         }
-        if (character === ";" || character === "|" || character === "&") {
+        if (character === "\n") {
             finishCommand();
-            const next = input[index + 1];
-            if (next === character) {
-                index += 1;
+            index += 1;
+            while (pending.length > 0) {
+                const marker = pending.shift();
+                if (marker === undefined)
+                    break;
+                const body = [];
+                let closed = false;
+                while (index <= input.length) {
+                    const lineEnd = input.indexOf("\n", index);
+                    const line = lineEnd < 0 ? input.slice(index) : input.slice(index, lineEnd);
+                    index = lineEnd < 0 ? input.length : lineEnd + 1;
+                    if (line.trim() === marker.delimiter) {
+                        closed = true;
+                        break;
+                    }
+                    body.push(line);
+                    if (lineEnd < 0)
+                        break;
+                }
+                // An unterminated heredoc means the command is still being written.
+                if (!closed)
+                    return null;
+                if (marker.expands) {
+                    const expansions = collectExpansions(body.join("\n"));
+                    if (expansions === null)
+                        return null;
+                    substitutions.push(...expansions);
+                }
             }
             continue;
         }
-        if (character === "(" ||
-            character === ")" ||
-            character === "\0") {
-            return null;
+        if (/\s/u.test(character)) {
+            finishWord();
+            index += 1;
+            continue;
         }
-        word += character;
-        if (word.length > MAX_COMMAND_LENGTH) {
-            return null;
+        if (character === ";" || character === "|" || character === "&") {
+            finishCommand();
+            index += input[index + 1] === character ? 2 : 1;
+            continue;
+        }
+        // Grouping and subshells separate commands; their contents are commands.
+        if (character === "(" || character === ")") {
+            finishCommand();
+            index += 1;
+            continue;
         }
+        addText(character);
+        index += 1;
     }
-    if (escaped || quote !== null) {
+    finishCommand();
+    return pending.length > 0 ? null : { commands, substitutions };
+}
+function parseShellWords(input, depth = 0) {
+    if (input.length === 0 ||
+        input.length > MAX_COMMAND_LENGTH ||
+        depth > MAX_SUBSTITUTION_DEPTH) {
         return null;
     }
-    finishCommand();
+    const parsed = parseLine(input);
+    if (parsed === null) {
+        return null;
+    }
+    const commands = [...parsed.commands];
+    for (const substitution of parsed.substitutions) {
+        if (substitution.trim().length === 0)
+            continue;
+        const nested = parseShellWords(substitution, depth + 1);
+        if (nested === null)
+            return null;
+        commands.push(...nested);
+    }
     if (commands.length === 0 ||
         commands.length > MAX_COMMANDS ||
         commands.some((command) => command.length > MAX_WORDS)) {

package/dist/runtime/src/install/doctor.js

@@ -4,7 +4,7 @@ import { sha256 } from "../fs/hash.js";
 import { parseInstallManifest, PROJECT_MANIFEST_PATH } from "../fs/manifest.js";
 import { resolveContainedPath } from "../fs/paths.js";
 import { validateConfig } from "../schema/validate.js";
-import { BIND_DEPENDENT_TARGETS, detectHostRestriction } from "../review/host-sandbox.js";
+import { detectHostRestriction } from "../review/host-sandbox.js";
 import { assertExpectedManagedBlock, assertSupportedManifestOwnership } from "./ownership.js";
 import { isOpencodeManagedPlugin } from "../adapters/opencode/config.js";
 import { harnessDescriptor, managedRules } from "./harness.js";
@@ -409,14 +409,20 @@ async function checkHostSandbox(detect) {
             "target can answer. Any authentication verdict below is unreliable.", undefined, "Run agent-ops outside the sandbox, or grant it escalated execution.");
     }
     if (restriction === "bind-blocked") {
-        return check("host-sandbox", "DEGRADED", `This process cannot open a loopback listener, so review targets that ` +
-            `need one (${BIND_DEPENDENT_TARGETS.join(", ")}) run last and may be ` +
-            "unable to answer.", undefined, "Run agent-ops outside the sandbox, or grant it escalated execution.");
+        return check("host-sandbox", "DEGRADED", "This process cannot open a loopback listener, so review fails closed " +
+            "with host-required before any reviewer starts.", undefined, "Run agent-ops outside the sandbox, or grant it escalated execution.");
     }
     return check("host-sandbox", "PASS", "No host sandbox restriction affects review targets.");
 }
-async function checkReviewTargets(config, probe, checkAuth) {
-    const targets = config?.reviewRoles?.find((role) => role.role === "independent-review")?.targets ?? [];
+async function checkReviewTargets(config, probe, checkAuth, selectedTargets = []) {
+    const configuredTargets = config?.reviewRoles?.find((role) => role.role === "independent-review")?.targets ?? [];
+    const unconfigured = selectedTargets.filter((target) => !configuredTargets.includes(target));
+    if (unconfigured.length > 0) {
+        return check("review-targets", "FAIL", `Review target selection is not configured: ${unconfigured.join(", ")}.`, undefined, "Configure the target with agent-ops init --review-target, then retry.");
+    }
+    const targets = selectedTargets.length > 0
+        ? selectedTargets
+        : configuredTargets;
     if (targets.length === 0) {
         return check("review-targets", "PASS", "External review disabled. Re-run agent-ops init to enable.");
     }
@@ -445,6 +451,10 @@ async function checkReviewTargets(config, probe, checkAuth) {
             failures.push(check("review-targets", "FAIL", `${target} did not answer in time.`, undefined, "Re-run: agent-ops doctor --check-auth"));
             continue;
         }
+        if (result === "capability-unavailable") {
+            failures.push(check("review-targets", "FAIL", `${target} could not complete its read-only capability probe.`, undefined, "Run agent-ops review on a host with network and loopback permission, then retry."));
+            continue;
+        }
         if (checkAuth && result !== "ok") {
             failures.push(check("review-targets", "FAIL", `${target} is installed but not authenticated, or it rejected the call.`, undefined, `Run: ${target} login`));
         }
@@ -483,7 +493,7 @@ export async function doctorInstallation(options) {
             : []),
         await checkProbe("repository-trust", options.probes?.repositoryTrust),
         await checkProbe("smoke-availability", options.probes?.smokeAvailability),
-        await checkReviewTargets(config.config, options.probes?.reviewTarget, options.checkReviewTargetAuth === true),
+        await checkReviewTargets(config.config, options.probes?.reviewTarget, options.checkReviewTargetAuth === true, options.checkAuthTargets),
         await checkHostSandbox(options.probes?.hostRestriction),
         checkVerificationCommands(config.config)
     ];

package/dist/runtime/src/install/harness.js

@@ -296,7 +296,7 @@ export function managedRules(descriptor, context) {
         ""
     ];
     if (context.capabilities.includes("rules")) {
-        lines.push("For every change:", "", "1. Define two to five mechanically verifiable acceptance criteria.", "2. Inspect the smallest relevant scope and preserve unrelated changes.", "3. Apply the smallest safe change.", "4. Run evidence-producing verification for every criterion.", "5. Obtain independent review before claiming completion, via", "   `agent-ops review --yes` (or the CLI's equivalent invocation). Never call a", "   review-target CLI (agy, codex, claude) directly — direct calls skip", "   the enforced read-only sandbox flags and can hang or fail on command", "   permission prompts.", "   Set `AGENT_OPS_HOST` to the current CLI id when invoking review so", "   agent-ops tries a different CLI first and uses isolated self-review", "   only when no other configured reviewer is usable.", "", "Treat `.agent-ops/config.json` as verifier authority. Discovery output is", "only a proposal until a user confirms it. Repository commands require an", "exact matching trust record. Confirmed project init/update grants it", "automatically when verification commands are configured.", "");
+        lines.push("For every change:", "", "1. Define two to five mechanically verifiable acceptance criteria.", "2. Inspect the smallest relevant scope and preserve unrelated changes.", "3. Apply the smallest safe change.", "4. Run evidence-producing verification for every criterion.", "5. Obtain complete independent review before claiming completion, via", "   `agent-ops review --task <task-id> --yes` (or the CLI's equivalent invocation).", "   Never call a", "   review-target CLI (agy, codex, claude) directly — direct calls skip", "   the enforced read-only sandbox flags and can hang or fail on command", "   permission prompts.", "   Review runs exactly two fresh sessions: with three configured targets,", "   set `AGENT_OPS_HOST` to the current CLI id so it is excluded; with two", "   targets both run in configured order; with one target it runs twice.", "   The first session is necessary; a PASS then requires an adversarial", "   re-check carrying the first report. A first FAIL or NOT_RUN stops.", "", "Treat `.agent-ops/config.json` as verifier authority. Discovery output is", "only a proposal until a user confirms it. Repository commands require an", "exact matching trust record. Confirmed project init/update grants it", "automatically when verification commands are configured.", "");
     }
     if (context.capabilities.includes("task")) {
         lines.push("Split a change that exceeds five acceptance criteria into subtasks:", "`agent-ops task create --parent <task-id>` records one, and", "`agent-ops task status --parent <task-id>` lists them. Each subtask", "carries its own criteria, verification, and independent review;", "completing one never completes its parent.", "");

package/dist/runtime/src/review/attestation.js

@@ -1,9 +1,156 @@
 import { join } from "node:path";
 import { AgentOpsError } from "../fs/paths.js";
+import { sha256 } from "../fs/hash.js";
 import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
+import { redactSecrets } from "../security/redact.js";
+import { safeTaskText } from "../task/render.js";
+import { redactReviewReport } from "./runner.js";
 const FINGERPRINT_PATTERN = /^[a-f0-9]{64}$/u;
 const TASK_ID_PATTERN = /^[A-Za-z0-9._-]{1,128}$/u;
 export const REVIEW_ATTESTATION_DIRECTORY = ".agent-ops/reviews";
+export const REVIEW_REPORT_ARTIFACT_SUFFIX = ".reports.json";
+const REVIEW_TARGETS = new Set(["agy", "claude", "codex"]);
+const DIGEST_PATTERN = /^[a-f0-9]{64}$/u;
+const SESSION_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/u;
+const REPORT_ARTIFACT_MAX_BYTES = 512 * 1024;
+function isReviewTarget(value) {
+    return typeof value === "string" && REVIEW_TARGETS.has(value);
+}
+function safeText(value) {
+    return safeTaskText(redactSecrets(value));
+}
+function safeAttempt(attempt) {
+    return {
+        target: attempt.target,
+        status: attempt.status,
+        ...(attempt.sessionId === undefined ? {} : { sessionId: safeText(attempt.sessionId) }),
+        ...(attempt.reason === undefined ? {} : { reason: safeText(attempt.reason) }),
+        ...(attempt.diagnostic === undefined ? {} : { diagnostic: safeText(attempt.diagnostic) })
+    };
+}
+function safePreflight(attempt) {
+    return {
+        target: attempt.target,
+        status: attempt.status,
+        ...(attempt.reason === undefined ? {} : { reason: attempt.reason }),
+        ...(attempt.diagnostic === undefined ? {} : { diagnostic: safeText(attempt.diagnostic) })
+    };
+}
+function artifactPath(root, fingerprint) {
+    return join(root, ...REVIEW_ATTESTATION_DIRECTORY.split("/"), `${fingerprint}${REVIEW_REPORT_ARTIFACT_SUFFIX}`);
+}
+export function reviewReportDigest(report) {
+    return sha256(JSON.stringify(redactReviewReport(report)));
+}
+function reportArtifact(result, sourceFingerprint, taskId) {
+    return {
+        schemaVersion: 1,
+        sourceFingerprint,
+        ...(taskId === undefined ? {} : { taskId }),
+        status: result.status,
+        harness: result.harness,
+        plannedTargets: [...(result.plannedTargets ?? [result.harness])],
+        ...(result.hostTarget === undefined ? {} : { hostTarget: result.hostTarget }),
+        ...(result.hostRestriction === undefined
+            ? {}
+            : { hostRestriction: result.hostRestriction }),
+        ...(result.independence === undefined
+            ? {}
+            : { independence: result.independence }),
+        ...(result.sessionIsolation === undefined
+            ? {}
+            : { sessionIsolation: result.sessionIsolation }),
+        attempts: (result.attempts ?? []).map(safeAttempt),
+        preflight: (result.preflight ?? []).map(safePreflight),
+        ...(result.reason === undefined ? {} : { reason: safeText(result.reason) }),
+        ...(result.report === undefined
+            ? {}
+            : { report: redactReviewReport(result.report) }),
+        ...(result.adversarial === undefined
+            ? {}
+            : {
+                adversarial: {
+                    target: result.adversarial.target,
+                    refuted: result.adversarial.refuted,
+                    report: redactReviewReport(result.adversarial.report)
+                }
+            }),
+        createdAt: new Date().toISOString()
+    };
+}
+function matchingReportArtifact(value, attestation) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const record = value;
+    const attempts = record.attempts;
+    const plannedTargets = record.plannedTargets;
+    const adversarial = record.adversarial;
+    if (record.schemaVersion !== 1 ||
+        record.sourceFingerprint !== attestation.sourceFingerprint ||
+        record.status !== "PASS" ||
+        record.harness !== attestation.harness ||
+        record.harness !== attestation.reviewTargets[0] ||
+        record.taskId !== attestation.taskId ||
+        record.hostTarget !== attestation.hostTarget ||
+        !Array.isArray(plannedTargets) ||
+        plannedTargets.length !== 2 ||
+        plannedTargets[0] !== attestation.reviewTargets[0] ||
+        plannedTargets[1] !== attestation.reviewTargets[1] ||
+        !Array.isArray(attempts) ||
+        attempts.length !== 2 ||
+        !attempts.every((attempt, index) => typeof attempt === "object" &&
+            attempt !== null &&
+            attempt.target === attestation.reviewTargets[index] &&
+            attempt.status === "PASS" &&
+            typeof attempt.sessionId === "string" &&
+            SESSION_ID_PATTERN.test(attempt.sessionId)) ||
+        !Array.isArray(record.preflight) ||
+        typeof record.report !== "object" ||
+        record.report === null ||
+        typeof adversarial !== "object" ||
+        adversarial === null) {
+        return false;
+    }
+    const adversarialRecord = adversarial;
+    return (adversarialRecord.target === attestation.reviewTargets[1] &&
+        adversarialRecord.refuted === false &&
+        typeof adversarialRecord.report === "object" &&
+        adversarialRecord.report !== null &&
+        reviewReportDigest(record.report) ===
+            attestation.primaryReportDigest &&
+        reviewReportDigest(adversarialRecord.report) ===
+            attestation.adversarialReportDigest &&
+        attempts.every((attempt, index) => attempt.sessionId === attestation.reviewSessionIds[index]));
+}
+async function hasMatchingReportArtifact(root, attestation) {
+    const source = await readPrivateFile(artifactPath(root, attestation.sourceFingerprint), root);
+    if (source === null) {
+        return false;
+    }
+    try {
+        return matchingReportArtifact(JSON.parse(source), attestation);
+    }
+    catch {
+        return false;
+    }
+}
+export async function saveReviewReportArtifact(root, result, sourceFingerprint, taskId) {
+    if (!FINGERPRINT_PATTERN.test(sourceFingerprint)) {
+        throw new AgentOpsError("REVIEW_REPORT_ARTIFACT_INVALID", "Review report artifact has an invalid source fingerprint.");
+    }
+    if (taskId !== undefined && !TASK_ID_PATTERN.test(taskId)) {
+        throw new AgentOpsError("REVIEW_REPORT_ARTIFACT_INVALID", "Review report artifact has an invalid task id.");
+    }
+    const value = reportArtifact(result, sourceFingerprint, taskId);
+    const serialized = `${JSON.stringify(value, null, 2)}\n`;
+    if (Buffer.byteLength(serialized, "utf8") > REPORT_ARTIFACT_MAX_BYTES) {
+        throw new AgentOpsError("REVIEW_REPORT_ARTIFACT_TOO_LARGE", "Review report artifact exceeds the capture limit.");
+    }
+    const relativePath = `${REVIEW_ATTESTATION_DIRECTORY}/${sourceFingerprint}${REVIEW_REPORT_ARTIFACT_SUFFIX}`;
+    await writePrivateFile(artifactPath(root, sourceFingerprint), serialized, root);
+    return relativePath;
+}
 function attestationPath(root, fingerprint) {
     return join(root, ...REVIEW_ATTESTATION_DIRECTORY.split("/"), `${fingerprint}.json`);
 }
@@ -12,25 +159,47 @@ function parseAttestation(value) {
         return null;
     }
     const record = value;
-    if (record.schemaVersion !== 1 ||
+    if (record.schemaVersion !== 2 ||
         record.status !== "PASS" ||
         (record.taskId !== undefined &&
             (typeof record.taskId !== "string" ||
                 !TASK_ID_PATTERN.test(record.taskId))) ||
-        typeof record.harness !== "string" ||
-        !TASK_ID_PATTERN.test(record.harness) ||
+        !isReviewTarget(record.harness) ||
         typeof record.sourceFingerprint !== "string" ||
         !FINGERPRINT_PATTERN.test(record.sourceFingerprint) ||
+        !Array.isArray(record.reviewTargets) ||
+        record.reviewTargets.length !== 2 ||
+        !record.reviewTargets.every(isReviewTarget) ||
+        record.reviewTargets[0] !== record.harness ||
+        !Array.isArray(record.reviewSessionIds) ||
+        record.reviewSessionIds.length !== 2 ||
+        !record.reviewSessionIds.every((sessionId) => typeof sessionId === "string" && SESSION_ID_PATTERN.test(sessionId)) ||
+        record.sessionIsolation !== "fresh" ||
+        typeof record.primaryReportDigest !== "string" ||
+        !DIGEST_PATTERN.test(record.primaryReportDigest) ||
+        typeof record.adversarialReportDigest !== "string" ||
+        !DIGEST_PATTERN.test(record.adversarialReportDigest) ||
+        typeof record.reportArtifact !== "string" ||
+        record.reportArtifact !==
+            `${REVIEW_ATTESTATION_DIRECTORY}/${record.sourceFingerprint}${REVIEW_REPORT_ARTIFACT_SUFFIX}` ||
+        (record.hostTarget !== undefined && !isReviewTarget(record.hostTarget)) ||
         typeof record.createdAt !== "string" ||
         !Number.isFinite(Date.parse(record.createdAt))) {
         return null;
     }
     return {
-        schemaVersion: 1,
+        schemaVersion: 2,
         ...(record.taskId === undefined ? {} : { taskId: record.taskId }),
         harness: record.harness,
         status: "PASS",
         sourceFingerprint: record.sourceFingerprint,
+        reviewTargets: [record.reviewTargets[0], record.reviewTargets[1]],
+        reviewSessionIds: [record.reviewSessionIds[0], record.reviewSessionIds[1]],
+        sessionIsolation: "fresh",
+        primaryReportDigest: record.primaryReportDigest,
+        adversarialReportDigest: record.adversarialReportDigest,
+        reportArtifact: record.reportArtifact,
+        ...(record.hostTarget === undefined ? {} : { hostTarget: record.hostTarget }),
         createdAt: record.createdAt
     };
 }
@@ -39,6 +208,9 @@ export async function saveReviewAttestation(root, attestation) {
     if (validated === null) {
         throw new AgentOpsError("REVIEW_ATTESTATION_INVALID", "Review attestation is invalid.");
     }
+    if (!(await hasMatchingReportArtifact(root, validated))) {
+        throw new AgentOpsError("REVIEW_ATTESTATION_INVALID", "Review attestation has no matching report artifact.");
+    }
     const relativePath = `${REVIEW_ATTESTATION_DIRECTORY}/${validated.sourceFingerprint}.json`;
     await writePrivateFile(attestationPath(root, validated.sourceFingerprint), `${JSON.stringify(validated, null, 2)}\n`, root);
     return relativePath;
@@ -58,7 +230,10 @@ export async function findReviewAttestation(root, sourceFingerprint) {
     }
     try {
         const attestation = parseAttestation(JSON.parse(source));
-        return attestation?.sourceFingerprint === sourceFingerprint ? attestation : null;
+        return attestation?.sourceFingerprint === sourceFingerprint &&
+            await hasMatchingReportArtifact(root, attestation)
+            ? attestation
+            : null;
     }
     catch {
         return null;