@kylecheng3146/agent-ops 0.2.1 → 0.2.3

package/dist/runtime/src/task/completion.js

@@ -40,7 +40,7 @@ export async function checkTaskCompletionEvidence(stored, options) {
     }
     const attestation = await findReviewAttestation(root, sourceFingerprint);
     if (attestation === null || attestation.taskId !== stored.task.id) {
-        return { status: "FAIL", code: "REVIEW_REQUIRED", remedy: "Run agent-ops review --yes for the whole task and current source." };
+        return { status: "FAIL", code: "REVIEW_REQUIRED", remedy: `Run agent-ops review --task ${stored.task.id} --yes for the whole task and current source.` };
     }
     return null;
 }

package/dist/runtime/src/task/service.js

@@ -124,7 +124,8 @@ export class TaskService {
                 completedAt: null,
                 archivedAt: null,
                 failureFingerprint: null,
-                policyConfigHash: input.policyConfigHash ?? null
+                policyConfigHash: input.policyConfigHash ?? null,
+                completionBase: null
             };
             state.tasks.push(record);
             if (input.sessionId !== undefined) {
@@ -235,10 +236,14 @@ export class TaskService {
                 }
             }
         }
+        let completionBase = null;
         const fingerprint = async () => {
             try {
                 const scope = await resolveReviewScope({ root: completion.root, runner: completion.gitRunner,
                     ...(completion.base === undefined ? {} : { base: completion.base }) });
+                // Recorded so the completion gate can recompute this exact range once
+                // the work is committed and the worktree has nothing left to measure.
+                completionBase = scope.mode === "base" ? scope.resolvedBase : null;
                 return await calculateSourceFingerprint(completion.root, scope, completion.gitRunner);
             }
             catch (error) {
@@ -282,7 +287,8 @@ export class TaskService {
                 status: "complete",
                 evidence,
                 updatedAt: now,
-                completedAt: now
+                completedAt: now,
+                completionBase
             };
             replaceTask(state, completed);
             return cloneRecord(completed);

package/dist/runtime/src/task/store.js

@@ -64,12 +64,13 @@ function parseTaskRecord(value) {
         "task",
         "updatedAt"
     ];
-    const allowedKeys = new Set([
-        baseKeys.join("\0"),
-        [...baseKeys, "failureFingerprint"].sort().join("\0"),
-        [...baseKeys, "policyConfigHash"].sort().join("\0"),
-        [...baseKeys, "failureFingerprint", "policyConfigHash"].sort().join("\0")
-    ]);
+    // Every record written before an optional field existed must still parse, so
+    // the accepted shapes are every combination of them.
+    const optionalKeys = ["completionBase", "failureFingerprint", "policyConfigHash"];
+    const allowedKeys = new Set(Array.from({ length: 1 << optionalKeys.length }, (_unused, mask) => [
+        ...baseKeys,
+        ...optionalKeys.filter((_key, position) => (mask & (1 << position)) !== 0)
+    ].sort().join("\0")));
     if (!isRecord(value) || !allowedKeys.has(Object.keys(value).sort().join("\0"))) {
         return invalidState("Task state contains an invalid task record.");
     }
@@ -138,6 +139,13 @@ function parseTaskRecord(value) {
         (typeof policyConfigHash !== "string" || !/^[a-f0-9]{64}$/u.test(policyConfigHash))) {
         return invalidState("Task state contains an invalid policy config hash.");
     }
+    const completionBase = value.completionBase === undefined
+        ? null
+        : value.completionBase;
+    if (completionBase !== null &&
+        (typeof completionBase !== "string" || !/^[a-f0-9]{40,64}$/u.test(completionBase))) {
+        return invalidState("Task state contains an invalid completion base.");
+    }
     return {
         task: task.value,
         status,
@@ -147,7 +155,8 @@ function parseTaskRecord(value) {
         completedAt: value.completedAt,
         archivedAt: value.archivedAt,
         failureFingerprint,
-        policyConfigHash
+        policyConfigHash,
+        completionBase
     };
 }
 function parseSession(value) {

package/docs/en/guides/configuration.md

@@ -49,17 +49,19 @@ Enable it during `agent-ops init`, or by hand:
 }
 ```
 
-`targets` is an **ordered fallback chain**. Every review locks to the
-staged/unstaged/untracked surface (or a clean `--base <ref>...HEAD` range).
-A bare review uses the built-in `change-quality` criterion; `--task` uses the
-task criteria and requires fresh PASS evidence for required checks. The full
-report is printed, and PASS persists only a source-fingerprint attestation.
+`targets` is an ordered selection for the complete command
+`agent-ops review --task <id> --yes`. Every task criterion and its original
+description is reviewed against the staged/unstaged/untracked surface (or a
+clean `--base <ref>...HEAD` range). Current PASS evidence for required checks
+is required before a reviewer starts. Bare and partial reviews are not a
+complete task review and do not satisfy completion.
 
 `--review-target` belongs to `init` and configures that persistent chain.
-For one run, `review --harness <target>` narrows the chain to exactly one
-already-configured target; it never enables a target absent from project
-policy. The configured model, effort, and timeout still apply. Review JSON
-includes `plannedTargets` in the actual host-adjusted order.
+`review` does not accept target, criterion, or evidence overrides. Exactly two
+fresh sessions are planned: three configured targets require
+`AGENT_OPS_HOST=agy|claude|codex`, exclude that host, and prefer `agy` first;
+two targets run in configured order; one target runs twice. Review JSON includes
+`plannedTargets` in that actual order.
 
 Every attempt starts from a fresh session and disposable repository clone with
 native read-only mode.
@@ -74,9 +76,11 @@ repository even if sandboxed plan mode writes to its cwd:
 | `agy` | `agy --print <prompt>` | `--sandbox --mode plan` |
 | `claude` | `claude -p` | `--permission-mode plan --safe-mode` |
 
-The chain prefers a target different from the hosting CLI. If no other target
-is usable, a fresh same-target session is allowed but is reported as
-`DEGRADED: isolated self-review`; a development session is never resumed.
+The first session is the necessary review. A first PASS starts the second
+adversarial session with the first full redacted report as untrusted data. A
+first FAIL or NOT_RUN stops; a second FAIL is final FAIL, and a missing second
+verdict is NOT_RUN. A same-target pair is still independent because both
+sessions and clones are fresh; a development session is never resumed.
 
 `opencode` is **not** a review target even though it is a supported harness.
 Its `--agent plan` is rejected as a subagent and silently falls back to a
@@ -88,11 +92,11 @@ would consume the following flag instead. It deliberately does not pass
 `--dangerously-skip-permissions`, which overrides the permission boundary, or
 `--disable-slash-commands`, which disables plan-mode behavior.
 
-The chain advances whenever an attempt produces no valid verdict — including a
-missing executable, spawn failure, timeout (900s per target by default), login
-failure, oversized output, or unparseable output. Every attempt and reason is
-preserved in human and JSON output. A `PASS` or `FAIL` verdict is **terminal**,
-so the chain cannot shop for a passing review.
+Host network or loopback restrictions return `REVIEW_NOT_RUN` before any
+reviewer is started. A trusted outer host runner may rerun the exact same
+command once with both capabilities; an in-sandbox retry is not an elevation
+and cannot produce a PASS. Every attempt, preflight result, and diagnostic is
+preserved in human and JSON output.
 
 Capability checks and model starts are reported on stderr, including under
 `--json`; stdout remains one final JSON envelope and raw reviewer output is
@@ -100,16 +104,14 @@ never streamed. SIGINT or SIGTERM terminates the active reviewer process tree,
 does not advance the fallback chain, and never writes an attestation. An
 exhausted timeout chain reports `timeout`, not `missing-cli`.
 
-If Claude Code is the host (`CLAUDECODE` is set), `claude` is moved to the end
-of the chain. It still runs when it is the only configured target, with a
-`reviewer == host` warning.
-
-Criterion descriptions come from the task bound to the current session, so a
-review needs an attached task created under the current policy configuration;
-`--criterion` filters those ids. Run `agent-ops verify` first: review rejects
-stale, failed, or source-mismatched required evidence before any model call.
-Compact PASS evidence is appended with a `review:<target>:` prefix; the full
-human-readable report is transient. Completed tasks are never rewritten.
+The task ID is explicit and its criteria are always used; no session fallback
+or criterion filter can replace the original task requirements. Review rechecks
+the source fingerprint before the adversarial session and again before writing
+evidence. After a complete PASS, the full redacted reports are stored privately
+under `.agent-ops/reviews/`; the attestation stores only metadata and report
+digests. Any evidence write failure remains `REVIEW_NOT_RUN`. Compact PASS
+evidence is appended with a `review:<target>:` prefix, and completed tasks are
+never rewritten.
 
 `--yes` is still required for every review run: init selection decides which
 targets are permitted, `--yes` decides whether to spend money now.

package/docs/en/spec/review.md

@@ -22,20 +22,19 @@ A review result MUST preserve PASS, FAIL, or NOT_RUN and MUST NOT convert NOT_RU
 
 ## REVIEW-HARNESS-001
 
-A review invocation MUST resolve to exactly one concrete review target, even
-when an installation supports multiple harnesses.
+A complete review MUST use the configured independent-review target selection;
+the review command MUST NOT accept a per-run harness override.
 
-- Trigger: Running `review` with a harness selection.
-- Action: Select one of `codex`, `agy`, or `claude`; keep multi-harness installation separate from review execution.
-- Evidence: Argument parsing rejects `all`, `both`, and comma-separated multi-harness values for review.
-- Positive: `review --harness claude` resolves one target.
-- Negative: `Run one review invocation against every installed harness implicitly.`
+- Trigger: Running `review`.
+- Action: Resolve the configured targets and plan exactly two fresh sessions.
+- Evidence: Argument parsing rejects `--harness`, while `init --review-target` remains the configuration entry point.
+- Positive: `review --task <id> --yes` reports its configured `plannedTargets`.
+- Negative: `review --task <id> --yes --harness claude` changes the reviewer set.
 
-The explicit target MUST already exist in the configured independent-review
-role. It narrows the configured chain to one target while preserving model,
-effort, and timeout policy. Without `--harness`, host-aware ordering applies to
-the complete configured chain. Every result carries that order as
-`plannedTargets`.
+With three configured targets, `AGENT_OPS_HOST` MUST identify the current host;
+that target is excluded and `agy` is primary when available. With two targets,
+both run in configured order even if one is the host. With one target, it runs
+twice in fresh sessions.
 
 ## REVIEW-READONLY-001
 
@@ -49,10 +48,9 @@ without one MUST be skipped rather than run unsandboxed.
 - Negative: `Trust the prompt to stop the reviewer from editing files.`
 
 Every attempted review MUST run in a fresh session (`sessionIsolation:
-"fresh"`) and in a disposable repository clone. The reviewer chain prefers a
-different CLI from the hosting CLI; when no other usable target exists,
-same-target fresh review is allowed but MUST render as `DEGRADED: isolated
-self-review`. A resumed development session is never an independent review.
+"fresh"`) and in a disposable repository clone. A same-target pair remains
+independent because the sessions and clones are fresh. A resumed development
+session is never an independent review.
 
 Capability and model-start progress goes to stderr even when stdout is JSON.
 Raw reviewer output remains bounded and unstreamed. SIGINT or SIGTERM aborts
@@ -61,22 +59,22 @@ distinct NOT_RUN reason rather than being flattened to `missing-cli`.
 
 ## REVIEW-CHAIN-001
 
-Configured targets form an ordered fallback chain that MUST advance only when
-no review happened, and MUST NOT advance past a verdict.
+The two planned sessions MUST be ordered as a necessary review followed by an
+adversarial re-check. The first session MUST stop the run on FAIL or NOT_RUN;
+there is no fallback after that result.
 
-- Trigger: A configured target is missing, fails to spawn, or times out.
-- Action: Try the next target after unparseable output; stop and report the first PASS or FAIL.
-- Evidence: The number of spawned attempts matches the failures that preceded the verdict.
-- Positive: `codex FAIL is final; no other target is asked for a second opinion.`
-- Negative: `Retry other targets after a FAIL until one reports PASS.`
+- Trigger: The first target is missing, unauthenticated, unavailable, or returns a malformed report.
+- Action: Return NOT_RUN with the first attempt and do not start the second session.
+- Evidence: `attempts` contains the first diagnostic and has no second attempt.
+- Positive: `primary NOT_RUN` is final NOT_RUN.
+- Negative: `Run the second target after the necessary review did not run.`
 
 ## REVIEW-ADVERSARIAL-001
 
-A PASS MUST be offered to a different eligible target for refutation, and a
+A PASS MUST be offered to the second planned target for refutation, and a
 successful refutation MUST make the run FAIL.
 
-- Trigger: The primary target returns PASS and another eligible target has not
-  already been walked past. The host target never serves as the challenger.
+- Trigger: The primary target returns PASS.
 - Action: Send that target the prior report as untrusted data and ask it to
   refute the verdict; report FAIL when it does, and record the challenge as
   `adversarial` either way.
@@ -84,8 +82,37 @@ successful refutation MUST make the run FAIL.
   a challenger that produced no report appears on the attempt list instead.
 - Positive: `codex passed, claude found a blocking defect, the run failed.`
 - Negative: `Manufacture a refutation so the challenge looks effective.`
-- Note: With one usable target the primary verdict stands unchallenged. A FAIL
-  is already terminal and is never re-checked.
+- Note: With one configured target the same target is invoked again in a fresh
+  session. A FAIL is already terminal and is never re-checked.
+
+## REVIEW-HOST-001
+
+A host that cannot provide network and loopback capability MUST fail closed
+before any reviewer invocation.
+
+- Trigger: The host declares disabled network or the loopback probe fails.
+- Action: Return `REVIEW_NOT_RUN / host-required` with the host restriction.
+- Evidence: `attempts` is empty and no target preflight or reviewer process ran.
+- Positive: A trusted outer host runner can retry the exact command once with both capabilities.
+- Negative: Treat a child login error as proof that an authenticated reviewer is unavailable.
+
+There is no repository-level permission bypass. An unavailable outer host runner
+MUST leave the result NOT_RUN rather than manufacture PASS.
+
+## REVIEW-EVIDENCE-001
+
+A complete PASS MUST include the primary report, the adversarial report, two PASS
+attempts with fresh session IDs, a stable source fingerprint, and a private
+bounded report artifact before its attestation is written. Artifact or
+attestation write failure MUST return NOT_RUN.
+
+- Trigger: A reviewer chain reaches a PASS verdict.
+- Action: Validate both reports, both fresh attempts, the source fingerprint,
+  and the private bounded artifact before writing the attestation.
+- Evidence: The attestation and artifact agree on task, host, targets, session
+  IDs, report digests, and source fingerprint.
+- Positive: A complete pair writes the artifact and matching PASS attestation.
+- Negative: A partial PASS or failed evidence write becomes NOT_RUN.
 
 ## REVIEW-CONTRACT-001
 

package/docs/zh-TW/guides/configuration.md

@@ -44,15 +44,17 @@ Claude 與 Codex lifecycle support 為 `supported`，OpenCode 從 app initializa
 }
 ```
 
-`targets` 是**有序的後備鏈**。每次 review 都鎖定 staged／unstaged／untracked
-變更（或乾淨的 `--base <ref>...HEAD`）。裸跑使用內建 `change-quality` 準則；
-`--task` 使用 task criteria，並要求必要驗證的最新 PASS evidence。完整 report
-會顯示給人看，PASS 後只持久化 source-fingerprint attestation。
-
-`--review-target` 只屬於 `init`，用來設定持久 fallback chain。單次執行可用
-`review --harness <target>`，將 chain 縮窄為一個已在 project policy 啟用的
-target；它不會臨時啟用未設定的 reviewer。既有 model、effort 與 timeout 仍會
-沿用，review JSON 的 `plannedTargets` 會列出經 host 調整後的實際順序。
+`targets` 是完整指令 `agent-ops review --task <id> --yes` 的有序選擇。
+每一條 task criterion 與原始 description 都會針對 staged／unstaged／untracked
+變更（或乾淨的 `--base <ref>...HEAD`）審查；必要驗證的最新 PASS evidence
+必須在 reviewer 啟動前存在。裸跑或 partial review 不算完整 task review，也
+不能滿足 completion。
+
+`--review-target` 只屬於 `init`，用來設定持久 reviewer selection。`review` 不接受
+target、criterion 或 evidence override。每次恰好規劃兩個全新 session：設定三個
+target 時必須提供 `AGENT_OPS_HOST=agy|claude|codex`，排除該 host 並優先選 agy；
+設定兩個時依設定順序執行；設定一個時同一 CLI 執行兩次。review JSON 的
+`plannedTargets` 會列出實際順序。
 
 每次嘗試都從全新 session、一次性 repository clone 與原生唯讀模式啟動。Claude 使用完整 safe-mode
 隔離；Codex 與 Agy 為了支援既有 OAuth 登入而保留登入環境，因此 context
@@ -65,9 +67,11 @@ target；它不會臨時啟用未設定的 reviewer。既有 model、effort 與
 | `agy` | `agy --print <prompt>` | `--sandbox --mode plan` |
 | `claude` | `claude -p` | `--permission-mode plan --safe-mode` |
 
-review chain 優先選擇不同於 hosting CLI 的 target。沒有其他可用 target 時，才允許
-全新的同 CLI session，但輸出會標示 `DEGRADED: isolated self-review`；不得 resume
-開發 session。
+第一個 session 是必要 reviewer。只有第一個 PASS 才會啟動第二個 adversarial
+session，並將第一份完整 redacted report 以不可信資料傳入。第一個 FAIL 或
+NOT_RUN 立即停止；第二個 FAIL 是終局 FAIL，第二個無法取得 verdict 則為
+NOT_RUN。同 target pair 仍因 session 與 clone 全新而具獨立性；不得 resume 開發
+session。
 
 `opencode` **不是** review 目標，即使它是支援的 harness。它的 `--agent plan`
 會被判定為 subagent 而遭拒，並靜默退回可寫入的 agent，因此無法滿足唯讀前置
@@ -77,24 +81,22 @@ Agy 的 prompt 會直接作為 `--print` 的值；裸用 `-p` 會誤吞下一個
 agent-ops 刻意不傳會繞過權限邊界的 `--dangerously-skip-permissions`，也不傳會
 使 plan mode 失效的 `--disable-slash-commands`。
 
-只要沒有取得有效 verdict 就換下一家，包括執行檔不存在、spawn 失敗、逾時
-（每個目標預設 900 秒）、登入失敗、輸出過大或無法解析。文字與 JSON 輸出
-都會保留每次 attempt 及原因。`PASS` 或 `FAIL` 判定是**終局**，因此不會產生
-自動化的 review shopping。
+Host 缺少 network 或 loopback 權限時，會在啟動任何 reviewer 前回傳
+`REVIEW_NOT_RUN`。可信任的外部 host runner 可以用兩項權限重跑同一個完整
+指令一次；在原 sandbox 內重試不算升權，也不能產生 PASS。文字與 JSON 輸出
+都會保留每次 attempt、preflight 與 diagnostic。
 
 Capability check 與模型啟動進度都寫到 stderr，包括 `--json` 模式；stdout
 仍只有最終 JSON envelope，且不會串流 reviewer 原始輸出。SIGINT 或 SIGTERM
 會終止目前 reviewer 的完整 process tree、不進入 fallback，也不寫入
 attestation。整條 chain 逾時時回報 `timeout`，不會誤報 `missing-cli`。
 
-若 host 是 Claude Code（`CLAUDECODE` 已設定），`claude` 會被移到鏈尾。
-當它是唯一設定的目標時仍會執行，並附上 `reviewer == host` 警告。
-
-criterion 描述來自當前 session 綁定的 task，所以 review 需要已附加、且建立時的
-policy 設定仍相同的 task；`--criterion` 用來篩選 id。請先執行
-`agent-ops verify`：必要 evidence 若失敗、過期或來源不符，review 會在 model 呼叫前停止。
-僅 compact PASS evidence 會以 `review:<target>:` 附加；完整人類可讀 report 是暫存的。
-已完成的 task 絕不改寫。
+task ID 必須明確指定，且永遠使用該 task 的原始 criteria；不能用 session fallback
+或 criterion filter 取代需求。review 會在 adversarial session 前、以及寫入證據前
+重新確認 source fingerprint。完整 PASS 後，兩份完整 redacted report 會私密保存於
+`.agent-ops/reviews/`；attestation 只保存 metadata 與 report digest。任何 evidence
+寫入失敗都維持 `REVIEW_NOT_RUN`。Compact PASS evidence 仍以
+`review:<target>:` 附加，已完成的 task 絕不改寫。
 
 每次執行 review 仍需 `--yes`：init 的勾選決定「允許哪些目標」，
 `--yes` 決定「現在是否要花錢」。

package/docs/zh-TW/spec/review.md

@@ -24,18 +24,18 @@ English source version: 2026-07-23. Revalidate: when the English specification c
 
 ## REVIEW-HARNESS-001
 
-即使 installation 支援多個 harness，一次 review invocation MUST 解析成恰好一個 concrete review target。
+完整 review MUST 使用 configured independent-review target selection；review
+指令 MUST NOT 接受單次 harness override。
 
-- Trigger: 使用 harness selection 執行 `review`。
-- Action: 從 `codex`、`agy` 或 `claude` 中選一個；multi-harness installation 與 review execution 分開處理。
-- Evidence: argument parsing 會拒絕 review 使用 `all`、`both` 或逗號分隔的多 harness 值。
-- Positive: `review --harness claude` 解析成一個 target。
-- Negative: `讓一次 review invocation 隱式跑過所有已安裝 harness。`
+- Trigger: 執行 `review`。
+- Action: 解析設定的 targets，規劃恰好兩個全新 session。
+- Evidence: argument parsing 拒絕 `--harness`；`init --review-target` 仍是設定入口。
+- Positive: `review --task <id> --yes` 回報設定的 `plannedTargets`。
+- Negative: `review --task <id> --yes --harness claude` 改變 reviewer 集合。
 
-明確指定的 target MUST 已存在於 configured independent-review role。它只會將
-configured chain 縮窄為單一 target，並保留 model、effort 與 timeout policy。
-未提供 `--harness` 時，完整 configured chain 仍套用 host-aware ordering；每個
-結果都以 `plannedTargets` 保存這個實際順序。
+設定三個 target 時，`AGENT_OPS_HOST` MUST 指出目前 host；該 target 會被排除，
+若可用則 agy 為 primary。設定兩個時依順序執行，即使其中一個是 host；設定一個
+時，在全新 session 執行兩次。
 
 ## REVIEW-READONLY-001
 
@@ -48,9 +48,8 @@ review target MUST 以其自身的唯讀機制啟動；沒有唯讀機制的 tar
 - Negative: `信任 prompt 能阻止審查者修改檔案。`
 
 每次 review 都 MUST 使用全新 session（`sessionIsolation: "fresh"`）並在
-disposable repository clone 中執行。review chain 優先選擇不同於 hosting CLI 的
-target；沒有其他可用 target 時，才允許同 CLI 的 fresh review，但輸出 MUST 明確
-標示 `DEGRADED: isolated self-review`。不得 resume 開發 session 作為獨立審查。
+disposable repository clone 中執行。同 target pair 仍因 session 與 clone 全新而
+具獨立性。不得 resume 開發 session 作為獨立審查。
 
 Capability 與模型啟動進度即使在 JSON 模式也寫到 stderr；reviewer 原始輸出仍
 維持 bounded capture，不直接串流。SIGINT 或 SIGTERM 會中止 active process
@@ -59,24 +58,53 @@ tree，不 fallback、不寫 attestation；timeout 保留獨立 NOT_RUN reason
 
 ## REVIEW-CHAIN-001
 
-已設定的 targets 組成有序後備鏈，MUST 僅在「沒有審到」時換下一家，且 MUST NOT 在取得判定後繼續往下試。
+兩個規劃的 session MUST 依序為必要 reviewer 與 adversarial 複審。第一個
+session 遇到 FAIL 或 NOT_RUN MUST 立即停止；不會在該結果後 fallback。
 
-- Trigger: 某個已設定的 target 不存在、spawn 失敗或逾時。
-- Action: 無法解析輸出時試下一個 target；遇到第一個 PASS 或 FAIL 即停止並回報。
-- Evidence: spawn 次數等於判定之前的失敗次數。
-- Positive: `codex 的 FAIL 是終局；不會再問任何 target 第二意見。`
-- Negative: `FAIL 之後改試其他 target，直到有人回報 PASS。`
+- Trigger: 第一個 target 不存在、未登入、不可用或回傳 malformed report。
+- Action: 回傳含第一個 attempt 診斷的 NOT_RUN，不啟動第二個 session。
+- Evidence: `attempts` 有第一個 diagnostic 且沒有第二個 attempt。
+- Positive: `primary NOT_RUN` 是終局 NOT_RUN。
+- Negative: `必要 reviewer 沒跑成後仍啟動第二個 target`。
 
 ## REVIEW-ADVERSARIAL-001
 
-PASS MUST 交給另一個合格 target 嘗試反駁，且反駁成立時 MUST 使整體判定為 FAIL。
+PASS MUST 交給第二個規劃的 target 嘗試反駁，且反駁成立時 MUST 使整體判定為 FAIL。
 
-- Trigger: primary target 回報 PASS，且尚有未走過的合格 target。host target 永不擔任挑戰者。
+- Trigger: primary target 回報 PASS。
 - Action: 將前一份 report 以不可信資料交給該 target 並要求它反駁；反駁成立即回報 FAIL，且無論結果都記錄為 `adversarial`。
 - Evidence: `adversarial` 記載挑戰者與是否反駁成立；未能產出 report 的挑戰者則記錄在 attempt 清單。
 - Positive: `codex 判 PASS，claude 找到 blocking 缺陷，整體判定 FAIL。`
 - Negative: `為了讓複查看起來有效而編造反駁。`
-- Note: 只有一個可用 target 時，primary 判定不受挑戰即成立。FAIL 已是終局，不再複查。
+- Note: 只有一個設定 target 時，會在全新 session 再呼叫同一 target。FAIL 已是終局，不再複查。
+
+## REVIEW-HOST-001
+
+Host 缺少 network 或 loopback 能力時，MUST 在任何 reviewer invocation 前
+fail closed。
+
+- Trigger: host 宣告 network disabled 或 loopback probe 失敗。
+- Action: 回傳 `REVIEW_NOT_RUN / host-required` 與 host restriction。
+- Evidence: `attempts` 為空，沒有 target preflight 或 reviewer process 執行。
+- Positive: 可信任的外部 host runner 可在具兩項能力的主機重跑同一指令一次。
+- Negative: 把 child login error 當作 authenticated reviewer 不可用的證明。
+
+repository 不提供 permission bypass。外部 host runner 不可用時，結果 MUST 保持
+NOT_RUN，不得製造 PASS。
+
+## REVIEW-EVIDENCE-001
+
+完整 PASS MUST 在寫入 attestation 前具備 primary report、adversarial report、
+兩個帶 fresh session ID 的 PASS attempt、穩定 source fingerprint，以及私密且
+有大小上限的 report artifact。artifact 或 attestation 寫入失敗 MUST 回傳 NOT_RUN。
+
+- Trigger: reviewer chain 得到 PASS verdict。
+- Action: 寫入 attestation 前驗證兩份 report、兩個 fresh attempt、source
+  fingerprint 與私密且有大小上限的 artifact。
+- Evidence: attestation 與 artifact 的 task、host、targets、session IDs、report
+  digests 及 source fingerprint 完全一致。
+- Positive: 完整 pair 寫入 artifact 與相符的 PASS attestation。
+- Negative: 不完整 PASS 或 evidence 寫入失敗會降為 NOT_RUN。
 
 ## REVIEW-CONTRACT-001
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kylecheng3146/agent-ops",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Evidence-driven development loops for agy, Codex, Claude Code, and opencode",
   "type": "module",
   "license": "MIT",