@kylecheng3146/agent-ops 0.2.2 → 0.2.3

package/dist/runtime/src/review/attestation.js

@@ -1,9 +1,156 @@
 import { join } from "node:path";
 import { AgentOpsError } from "../fs/paths.js";
+import { sha256 } from "../fs/hash.js";
 import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
+import { redactSecrets } from "../security/redact.js";
+import { safeTaskText } from "../task/render.js";
+import { redactReviewReport } from "./runner.js";
 const FINGERPRINT_PATTERN = /^[a-f0-9]{64}$/u;
 const TASK_ID_PATTERN = /^[A-Za-z0-9._-]{1,128}$/u;
 export const REVIEW_ATTESTATION_DIRECTORY = ".agent-ops/reviews";
+export const REVIEW_REPORT_ARTIFACT_SUFFIX = ".reports.json";
+const REVIEW_TARGETS = new Set(["agy", "claude", "codex"]);
+const DIGEST_PATTERN = /^[a-f0-9]{64}$/u;
+const SESSION_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/u;
+const REPORT_ARTIFACT_MAX_BYTES = 512 * 1024;
+function isReviewTarget(value) {
+    return typeof value === "string" && REVIEW_TARGETS.has(value);
+}
+function safeText(value) {
+    return safeTaskText(redactSecrets(value));
+}
+function safeAttempt(attempt) {
+    return {
+        target: attempt.target,
+        status: attempt.status,
+        ...(attempt.sessionId === undefined ? {} : { sessionId: safeText(attempt.sessionId) }),
+        ...(attempt.reason === undefined ? {} : { reason: safeText(attempt.reason) }),
+        ...(attempt.diagnostic === undefined ? {} : { diagnostic: safeText(attempt.diagnostic) })
+    };
+}
+function safePreflight(attempt) {
+    return {
+        target: attempt.target,
+        status: attempt.status,
+        ...(attempt.reason === undefined ? {} : { reason: attempt.reason }),
+        ...(attempt.diagnostic === undefined ? {} : { diagnostic: safeText(attempt.diagnostic) })
+    };
+}
+function artifactPath(root, fingerprint) {
+    return join(root, ...REVIEW_ATTESTATION_DIRECTORY.split("/"), `${fingerprint}${REVIEW_REPORT_ARTIFACT_SUFFIX}`);
+}
+export function reviewReportDigest(report) {
+    return sha256(JSON.stringify(redactReviewReport(report)));
+}
+function reportArtifact(result, sourceFingerprint, taskId) {
+    return {
+        schemaVersion: 1,
+        sourceFingerprint,
+        ...(taskId === undefined ? {} : { taskId }),
+        status: result.status,
+        harness: result.harness,
+        plannedTargets: [...(result.plannedTargets ?? [result.harness])],
+        ...(result.hostTarget === undefined ? {} : { hostTarget: result.hostTarget }),
+        ...(result.hostRestriction === undefined
+            ? {}
+            : { hostRestriction: result.hostRestriction }),
+        ...(result.independence === undefined
+            ? {}
+            : { independence: result.independence }),
+        ...(result.sessionIsolation === undefined
+            ? {}
+            : { sessionIsolation: result.sessionIsolation }),
+        attempts: (result.attempts ?? []).map(safeAttempt),
+        preflight: (result.preflight ?? []).map(safePreflight),
+        ...(result.reason === undefined ? {} : { reason: safeText(result.reason) }),
+        ...(result.report === undefined
+            ? {}
+            : { report: redactReviewReport(result.report) }),
+        ...(result.adversarial === undefined
+            ? {}
+            : {
+                adversarial: {
+                    target: result.adversarial.target,
+                    refuted: result.adversarial.refuted,
+                    report: redactReviewReport(result.adversarial.report)
+                }
+            }),
+        createdAt: new Date().toISOString()
+    };
+}
+function matchingReportArtifact(value, attestation) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const record = value;
+    const attempts = record.attempts;
+    const plannedTargets = record.plannedTargets;
+    const adversarial = record.adversarial;
+    if (record.schemaVersion !== 1 ||
+        record.sourceFingerprint !== attestation.sourceFingerprint ||
+        record.status !== "PASS" ||
+        record.harness !== attestation.harness ||
+        record.harness !== attestation.reviewTargets[0] ||
+        record.taskId !== attestation.taskId ||
+        record.hostTarget !== attestation.hostTarget ||
+        !Array.isArray(plannedTargets) ||
+        plannedTargets.length !== 2 ||
+        plannedTargets[0] !== attestation.reviewTargets[0] ||
+        plannedTargets[1] !== attestation.reviewTargets[1] ||
+        !Array.isArray(attempts) ||
+        attempts.length !== 2 ||
+        !attempts.every((attempt, index) => typeof attempt === "object" &&
+            attempt !== null &&
+            attempt.target === attestation.reviewTargets[index] &&
+            attempt.status === "PASS" &&
+            typeof attempt.sessionId === "string" &&
+            SESSION_ID_PATTERN.test(attempt.sessionId)) ||
+        !Array.isArray(record.preflight) ||
+        typeof record.report !== "object" ||
+        record.report === null ||
+        typeof adversarial !== "object" ||
+        adversarial === null) {
+        return false;
+    }
+    const adversarialRecord = adversarial;
+    return (adversarialRecord.target === attestation.reviewTargets[1] &&
+        adversarialRecord.refuted === false &&
+        typeof adversarialRecord.report === "object" &&
+        adversarialRecord.report !== null &&
+        reviewReportDigest(record.report) ===
+            attestation.primaryReportDigest &&
+        reviewReportDigest(adversarialRecord.report) ===
+            attestation.adversarialReportDigest &&
+        attempts.every((attempt, index) => attempt.sessionId === attestation.reviewSessionIds[index]));
+}
+async function hasMatchingReportArtifact(root, attestation) {
+    const source = await readPrivateFile(artifactPath(root, attestation.sourceFingerprint), root);
+    if (source === null) {
+        return false;
+    }
+    try {
+        return matchingReportArtifact(JSON.parse(source), attestation);
+    }
+    catch {
+        return false;
+    }
+}
+export async function saveReviewReportArtifact(root, result, sourceFingerprint, taskId) {
+    if (!FINGERPRINT_PATTERN.test(sourceFingerprint)) {
+        throw new AgentOpsError("REVIEW_REPORT_ARTIFACT_INVALID", "Review report artifact has an invalid source fingerprint.");
+    }
+    if (taskId !== undefined && !TASK_ID_PATTERN.test(taskId)) {
+        throw new AgentOpsError("REVIEW_REPORT_ARTIFACT_INVALID", "Review report artifact has an invalid task id.");
+    }
+    const value = reportArtifact(result, sourceFingerprint, taskId);
+    const serialized = `${JSON.stringify(value, null, 2)}\n`;
+    if (Buffer.byteLength(serialized, "utf8") > REPORT_ARTIFACT_MAX_BYTES) {
+        throw new AgentOpsError("REVIEW_REPORT_ARTIFACT_TOO_LARGE", "Review report artifact exceeds the capture limit.");
+    }
+    const relativePath = `${REVIEW_ATTESTATION_DIRECTORY}/${sourceFingerprint}${REVIEW_REPORT_ARTIFACT_SUFFIX}`;
+    await writePrivateFile(artifactPath(root, sourceFingerprint), serialized, root);
+    return relativePath;
+}
 function attestationPath(root, fingerprint) {
     return join(root, ...REVIEW_ATTESTATION_DIRECTORY.split("/"), `${fingerprint}.json`);
 }
@@ -12,25 +159,47 @@ function parseAttestation(value) {
         return null;
     }
     const record = value;
-    if (record.schemaVersion !== 1 ||
+    if (record.schemaVersion !== 2 ||
         record.status !== "PASS" ||
         (record.taskId !== undefined &&
             (typeof record.taskId !== "string" ||
                 !TASK_ID_PATTERN.test(record.taskId))) ||
-        typeof record.harness !== "string" ||
-        !TASK_ID_PATTERN.test(record.harness) ||
+        !isReviewTarget(record.harness) ||
         typeof record.sourceFingerprint !== "string" ||
         !FINGERPRINT_PATTERN.test(record.sourceFingerprint) ||
+        !Array.isArray(record.reviewTargets) ||
+        record.reviewTargets.length !== 2 ||
+        !record.reviewTargets.every(isReviewTarget) ||
+        record.reviewTargets[0] !== record.harness ||
+        !Array.isArray(record.reviewSessionIds) ||
+        record.reviewSessionIds.length !== 2 ||
+        !record.reviewSessionIds.every((sessionId) => typeof sessionId === "string" && SESSION_ID_PATTERN.test(sessionId)) ||
+        record.sessionIsolation !== "fresh" ||
+        typeof record.primaryReportDigest !== "string" ||
+        !DIGEST_PATTERN.test(record.primaryReportDigest) ||
+        typeof record.adversarialReportDigest !== "string" ||
+        !DIGEST_PATTERN.test(record.adversarialReportDigest) ||
+        typeof record.reportArtifact !== "string" ||
+        record.reportArtifact !==
+            `${REVIEW_ATTESTATION_DIRECTORY}/${record.sourceFingerprint}${REVIEW_REPORT_ARTIFACT_SUFFIX}` ||
+        (record.hostTarget !== undefined && !isReviewTarget(record.hostTarget)) ||
         typeof record.createdAt !== "string" ||
         !Number.isFinite(Date.parse(record.createdAt))) {
         return null;
     }
     return {
-        schemaVersion: 1,
+        schemaVersion: 2,
         ...(record.taskId === undefined ? {} : { taskId: record.taskId }),
         harness: record.harness,
         status: "PASS",
         sourceFingerprint: record.sourceFingerprint,
+        reviewTargets: [record.reviewTargets[0], record.reviewTargets[1]],
+        reviewSessionIds: [record.reviewSessionIds[0], record.reviewSessionIds[1]],
+        sessionIsolation: "fresh",
+        primaryReportDigest: record.primaryReportDigest,
+        adversarialReportDigest: record.adversarialReportDigest,
+        reportArtifact: record.reportArtifact,
+        ...(record.hostTarget === undefined ? {} : { hostTarget: record.hostTarget }),
         createdAt: record.createdAt
     };
 }
@@ -39,6 +208,9 @@ export async function saveReviewAttestation(root, attestation) {
     if (validated === null) {
         throw new AgentOpsError("REVIEW_ATTESTATION_INVALID", "Review attestation is invalid.");
     }
+    if (!(await hasMatchingReportArtifact(root, validated))) {
+        throw new AgentOpsError("REVIEW_ATTESTATION_INVALID", "Review attestation has no matching report artifact.");
+    }
     const relativePath = `${REVIEW_ATTESTATION_DIRECTORY}/${validated.sourceFingerprint}.json`;
     await writePrivateFile(attestationPath(root, validated.sourceFingerprint), `${JSON.stringify(validated, null, 2)}\n`, root);
     return relativePath;
@@ -58,7 +230,10 @@ export async function findReviewAttestation(root, sourceFingerprint) {
     }
     try {
         const attestation = parseAttestation(JSON.parse(source));
-        return attestation?.sourceFingerprint === sourceFingerprint ? attestation : null;
+        return attestation?.sourceFingerprint === sourceFingerprint &&
+            await hasMatchingReportArtifact(root, attestation)
+            ? attestation
+            : null;
     }
     catch {
         return null;

package/dist/runtime/src/review/execute.js

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { chmod, copyFile, lstat, mkdir, mkdtemp, realpath, rm, stat } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
@@ -6,9 +7,10 @@ import { redactSecrets } from "../security/redact.js";
 import { extractReviewObject } from "./extract.js";
 import { buildTargetInvocation } from "./invocation.js";
 import { reviewReportResults, reviewReportStatus, validateReviewReport } from "./report.js";
-import { detectHostTarget, orderChain } from "./roles.js";
-import { BIND_DEPENDENT_TARGETS, detectHostRestriction } from "./host-sandbox.js";
+import { detectHostTarget, planReviewTargets } from "./roles.js";
+import { detectHostRestriction } from "./host-sandbox.js";
 import { buildAdversarialPrompt, buildReviewPrompt } from "./runner.js";
+import { MAX_ADVERSARIAL_PROMPT_BYTES } from "./runner.js";
 /**
  * Full repository reviews need far more headroom than the lightweight auth
  * probe. Five minutes was not enough: reviewing a real working tree, codex and
@@ -102,6 +104,20 @@ const ADVANCING = new Set([
     "spawn-failed"
 ]);
 const DIAGNOSTIC_MAX_CHARS = 200;
+function preflightUnavailableReason(result) {
+    switch (result) {
+        case "missing-executable":
+            return "missing-cli";
+        case "timeout":
+            return "timeout";
+        case "unauthenticated":
+            return "login-required";
+        case "ineligible":
+            return "capability-unavailable";
+        case "capability-unavailable":
+            return "capability-unavailable";
+    }
+}
 /**
  * The target's first line of complaint, redacted and clipped. It travels on the
  * attempt record rather than only in a progress line, because progress is
@@ -237,8 +253,10 @@ async function snapshotRepository(request, destination, options) {
  */
 async function attemptTarget(request, options) {
     const { target } = request;
-    const skip = (reason, diagnostic, verb = "trying next target") => ({
+    const sessionId = randomUUID();
+    const skip = (reason, diagnostic, verb = "stopping review") => ({
         kind: "skip",
+        sessionId,
         reason,
         diagnostic,
         message: `${target}: ${reason} → ${verb} (${diagnostic})`
@@ -424,52 +442,66 @@ async function attemptTarget(request, options) {
                 : firstComplaint(spawned.stdout, spawned.stderr) ??
                     "the answer carried no review report");
         }
-        return { kind: "verdict", report: parsed.value };
+        return { kind: "verdict", report: parsed.value, sessionId };
     }
     finally {
         await rm(attemptDirectory, { recursive: true, force: true });
     }
 }
-/**
- * Builds the `execute` callback `runIndependentReview` expects: walk the
- * configured targets in order and return the first real verdict. A PASS is then
- * handed to a different target to refute, so a single agreeable reviewer cannot
- * wave a change through on its own.
- */
+/** Builds the `execute` callback with one necessary and one adversarial review. */
 export function createReviewExecutor(options) {
     const report = options.onProgress ?? (() => { });
     const host = detectHostTarget(options.env ?? process.env);
-    const ordered = orderChain(options.targets, host);
+    const plan = planReviewTargets(options.targets, host);
+    const plannedTargets = plan.targets;
     return async (request) => {
-        // Asked before anything is spent. A reviewer inherits this process's
-        // sandbox, so a restriction found here is a restriction every target in
-        // the chain would hit — one at a time, minutes apart.
+        if (plan.reason !== undefined) {
+            report("host: three review targets require explicit AGENT_OPS_HOST");
+            return {
+                status: "NOT_RUN",
+                reason: plan.reason,
+                attempts: []
+            };
+        }
         const restriction = await detectHostRestriction({
             env: options.env ?? process.env,
             ...(options.probeBind === undefined ? {} : { probeBind: options.probeBind })
         });
-        if (restriction === "network-blocked") {
-            report("host: the sandbox around this process blocks network access, so no " +
-                "reviewer can answer → not running the chain");
+        if (restriction !== "none") {
+            report(`host: ${restriction}; external review host runner required`);
+            return {
+                status: "NOT_RUN",
+                reason: "host-required",
+                hostRestriction: restriction,
+                attempts: []
+            };
+        }
+        if (plannedTargets.length === 0) {
             return {
                 status: "NOT_RUN",
-                reason: "host-sandboxed",
-                ...(host === undefined ? {} : { harness: host }),
+                reason: "missing-cli",
                 attempts: []
             };
         }
-        // Only agy needs a loopback listener, so a bind-blocked host is not a dead
-        // end — it is a reason to spend the other targets first rather than
-        // discovering the same failure at the head of the chain every time.
-        const chain = restriction === "bind-blocked"
-            ? [
-                ...ordered.filter((target) => !BIND_DEPENDENT_TARGETS.includes(target)),
-                ...ordered.filter((target) => BIND_DEPENDENT_TARGETS.includes(target))
-            ]
-            : ordered;
-        if (restriction === "bind-blocked" && chain.join() !== ordered.join()) {
-            report("host: this process cannot open a loopback listener, so targets that " +
-                `need one run last (chain: ${chain.join(" → ")})`);
+        const preflight = [];
+        if (options.preflightTarget !== undefined) {
+            for (const target of new Set(plannedTargets)) {
+                const result = await options.preflightTarget(target);
+                if (result === "ok") {
+                    preflight.push({ target, status: "PASS" });
+                    continue;
+                }
+                const reason = preflightUnavailableReason(result);
+                const diagnostic = `target preflight returned ${result}`;
+                preflight.push({ target, status: "NOT_RUN", reason, diagnostic });
+                report(`${target}: preflight ${reason} (${diagnostic})`);
+                return {
+                    status: "NOT_RUN",
+                    reason,
+                    preflight,
+                    attempts: []
+                };
+            }
         }
         const expectedCriterionIds = request.invocation.packet.criteria.map((criterion) => criterion.id);
         const repositoryRoot = await realpath(options.cwd);
@@ -481,98 +513,136 @@ export function createReviewExecutor(options) {
                 : { changedFiles: request.invocation.scope.changedFiles })
         };
         const attempts = [];
-        let lastReason = "missing-cli";
-        /**
-         * Ask a target other than the one that passed — and other than the host —
-         * to refute the verdict. Returns undefined when no such target produced a
-         * report, which leaves the primary PASS standing unchallenged. Targets the
-         * primary pass already walked past are excluded: a CLI that could not
-         * answer the review prompt will not answer this one either.
-         */
-        const refute = async (primary, primaryTarget) => {
-            const walked = new Set(attempts.map((attempt) => attempt.target));
-            const candidates = chain.filter((target) => target !== primaryTarget && target !== host && !walked.has(target));
-            for (const [index, target] of candidates.entries()) {
-                const outcome = await attemptTarget({
-                    ...shared,
-                    target,
-                    label: `adversarial-${target}-${index}`,
-                    prompt: buildAdversarialPrompt({ ...request.invocation, harness: target }, primary)
-                }, options);
-                if (outcome.kind === "skip") {
-                    // Recorded, not just reported: stderr progress is transient, and
-                    // without this a PASS with no `adversarial` field cannot be told
-                    // apart from a PASS that had no second target to challenge it.
-                    attempts.push({
-                        target,
-                        status: "NOT_RUN",
-                        reason: outcome.attemptReason ?? outcome.reason,
-                        diagnostic: outcome.diagnostic
-                    });
-                    report(`${target}: adversarial re-check unavailable (${outcome.reason})`);
-                    continue;
-                }
-                const refuted = reviewReportStatus(outcome.report) === "FAIL";
-                report(`${target}: adversarial re-check ${refuted ? "refuted the PASS" : "upheld the PASS"}`);
-                return { target, refuted, report: outcome.report };
-            }
-            if (candidates.length > 0) {
-                report("no independent target completed an adversarial re-check");
-            }
-            return undefined;
+        const primaryTarget = plannedTargets[0];
+        const adversarialTarget = plannedTargets[1];
+        const primaryOutcome = await attemptTarget({
+            ...shared,
+            target: primaryTarget,
+            label: `${primaryTarget}-primary`,
+            prompt: buildReviewPrompt({ ...request.invocation, harness: primaryTarget })
+        }, options);
+        if (primaryOutcome.kind === "skip") {
+            attempts.push({
+                target: primaryTarget,
+                status: "NOT_RUN",
+                sessionId: primaryOutcome.sessionId,
+                reason: primaryOutcome.attemptReason ?? primaryOutcome.reason,
+                diagnostic: primaryOutcome.diagnostic
+            });
+            report(primaryOutcome.message);
+            return {
+                status: "NOT_RUN",
+                reason: primaryOutcome.reason,
+                preflight,
+                attempts
+            };
+        }
+        const primaryReport = primaryOutcome.report;
+        const primaryStatus = reviewReportStatus(primaryReport);
+        attempts.push({
+            target: primaryTarget,
+            status: primaryStatus,
+            sessionId: primaryOutcome.sessionId
+        });
+        const independence = primaryTarget === adversarialTarget
+            ? "same-target"
+            : "different-target";
+        const verdict = {
+            results: reviewReportResults(primaryReport),
+            report: primaryReport,
+            harness: primaryTarget,
+            attempts,
+            preflight,
+            independence,
+            sessionIsolation: "fresh"
         };
-        for (const [index, target] of chain.entries()) {
-            if (target === host) {
-                report(`${target}: no other usable CLI remained; running isolated self-review`);
+        if (primaryStatus === "FAIL") {
+            return { status: "FAIL", ...verdict };
+        }
+        if (request.invocation.sourceFingerprint !== undefined &&
+            options.verifySourceFingerprint !== undefined) {
+            let unchanged = false;
+            try {
+                unchanged = await options.verifySourceFingerprint(request.invocation.sourceFingerprint);
+            }
+            catch {
+                unchanged = false;
             }
-            const outcome = await attemptTarget({
-                ...shared,
-                target,
-                label: `${target}-${index}`,
-                prompt: buildReviewPrompt({ ...request.invocation, harness: target })
-            }, options);
-            if (outcome.kind === "skip") {
-                lastReason = outcome.reason;
-                attempts.push({
-                    target,
+            if (!unchanged) {
+                report("source changed after the necessary reviewer PASS; stopping review");
+                return {
                     status: "NOT_RUN",
-                    reason: outcome.attemptReason ?? outcome.reason,
-                    diagnostic: outcome.diagnostic
-                });
-                report(outcome.message);
-                continue;
+                    reason: "source-changed-during-review",
+                    report: primaryReport,
+                    preflight,
+                    independence,
+                    sessionIsolation: "fresh",
+                    attempts
+                };
             }
-            const reportValue = outcome.report;
-            const status = reviewReportStatus(reportValue);
-            attempts.push({ target, status });
-            const independence = host === undefined
-                ? "unknown"
-                : host === target
-                    ? "same-target"
-                    : "different-target";
-            const verdict = {
-                results: reviewReportResults(reportValue),
-                report: reportValue,
-                harness: target,
-                attempts,
+        }
+        const adversarialPrompt = buildAdversarialPrompt({ ...request.invocation, harness: adversarialTarget }, primaryReport);
+        if (Buffer.byteLength(adversarialPrompt, "utf8") > MAX_ADVERSARIAL_PROMPT_BYTES) {
+            const diagnostic = `the redacted primary report exceeds ${MAX_ADVERSARIAL_PROMPT_BYTES} bytes`;
+            attempts.push({
+                target: adversarialTarget,
+                status: "NOT_RUN",
+                reason: "output-too-large",
+                diagnostic
+            });
+            report(`${adversarialTarget}: output-too-large → stopping review (${diagnostic})`);
+            return {
+                status: "NOT_RUN",
+                reason: "output-too-large",
+                report: primaryReport,
+                preflight,
                 independence,
-                sessionIsolation: "fresh"
+                sessionIsolation: "fresh",
+                attempts
             };
-            if (status === "FAIL") {
-                return { status, ...verdict };
-            }
-            const adversarial = await refute(reportValue, target);
+        }
+        const adversarialOutcome = await attemptTarget({
+            ...shared,
+            target: adversarialTarget,
+            label: `${adversarialTarget}-adversarial`,
+            prompt: adversarialPrompt
+        }, options);
+        if (adversarialOutcome.kind === "skip") {
+            attempts.push({
+                target: adversarialTarget,
+                status: "NOT_RUN",
+                sessionId: adversarialOutcome.sessionId,
+                reason: adversarialOutcome.attemptReason ?? adversarialOutcome.reason,
+                diagnostic: adversarialOutcome.diagnostic
+            });
+            report(`${adversarialTarget}: adversarial re-check unavailable (${adversarialOutcome.reason})`);
             return {
-                status: adversarial?.refuted === true ? "FAIL" : "PASS",
-                ...verdict,
-                ...(adversarial === undefined ? {} : { adversarial })
+                status: "NOT_RUN",
+                reason: adversarialOutcome.reason,
+                report: primaryReport,
+                preflight,
+                independence,
+                sessionIsolation: "fresh",
+                attempts
             };
         }
+        const adversarialReport = adversarialOutcome.report;
+        const refuted = reviewReportStatus(adversarialReport) === "FAIL";
+        attempts.push({
+            target: adversarialTarget,
+            status: refuted ? "FAIL" : "PASS",
+            sessionId: adversarialOutcome.sessionId
+        });
+        report(`${adversarialTarget}: adversarial re-check ${refuted ? "refuted the PASS" : "upheld the PASS"}`);
         return {
-            status: "NOT_RUN",
-            reason: lastReason,
-            ...(attempts.length === 0 ? {} : { harness: attempts.at(-1)?.target }),
-            attempts
+            status: refuted ? "FAIL" : "PASS",
+            ...verdict,
+            attempts,
+            adversarial: {
+                target: adversarialTarget,
+                refuted,
+                report: adversarialReport
+            }
         };
     };
 }

package/dist/runtime/src/review/host-sandbox.js

@@ -39,8 +39,9 @@ export async function probeLoopbackBind() {
  */
 export async function detectHostRestriction(options = {}) {
     const env = options.env ?? process.env;
-    // Declared and total: no reviewer can reach its own API, so probing the
-    // narrower loopback capability would only add latency to a settled answer.
+    // Keep the host declaration distinct from the narrower loopback probe. The
+    // executor treats this signal as advisory because a target may use a
+    // transport that differs from this process.
     if (env.CODEX_SANDBOX_NETWORK_DISABLED === "1") {
         return "network-blocked";
     }

package/dist/runtime/src/review/probe.js

@@ -59,6 +59,9 @@ export async function probeReviewTarget(target, options) {
         if (spawned.timedOut) {
             return "timeout";
         }
+        if (/(?:operation not permitted|permission denied|bind(?:ing)?[^\n]*(?:failed|denied))/iu.test(`${spawned.stderr}\n${spawned.stdout}`)) {
+            return "capability-unavailable";
+        }
         if (!deep) {
             return spawned.status === "PASS" ? "ok" : "unauthenticated";
         }