@kylecheng3146/agent-ops 0.2.2 → 0.2.4

package/README.md

@@ -301,12 +301,12 @@ the project configuration defines those workflows.
 
 ### External review
 
-`agent-ops review` can hand the review to another agent CLI, so the work is not
-judged by the agent that produced it. Enable it during `agent-ops init` (the
-default is off). A bare review applies the built-in `change-quality` criterion
-to a deterministic worktree (or `--base`) scope. `--task` reviews keep their
-task criteria and require current verification evidence. The detailed report
-is displayed; a minimal source-fingerprint attestation is persisted after PASS.
+`agent-ops review --task <id> --yes` can hand a complete task-bound review to
+agent CLIs, so the work is not judged only by the agent that produced it.
+Enable review targets during `agent-ops init` (the default is off). Every task
+criterion and its original description are reviewed; partial criteria,
+generic reviews, and missing `--yes` are rejected. Current verification
+evidence is required before any reviewer starts.
 
 Each attempt uses a fresh temporary session and disposable repository clone, a
 small allowlisted environment, and a target-native read-only mode. Claude
@@ -315,14 +315,28 @@ persistence, while Agy runs in sandboxed plan mode. Codex and Agy preserve their
 existing login environment, so their context isolation is intentionally weaker
 than Claude's. `opencode` is not a review target.
 
-The chain prefers a reviewer CLI different from the hosting CLI. If none is
-usable, a fresh same-target session is allowed but is rendered as
-`DEGRADED: isolated self-review`; a development session is never resumed.
-
-The first valid `PASS` or `FAIL` is final. Attempts that produce no verdict —
-including login failures and unparseable output — advance to the next target
-and remain visible in the result's `attempts`. `--yes` is still required for
-every run, since each run spends another provider's quota.
+Exactly two fresh sessions are planned. With three configured targets, the
+explicit `AGENT_OPS_HOST` is excluded and `agy` is primary when available; with
+two targets both run in configured order; with one target the same CLI is run
+twice. The first session is the necessary review. Only its PASS starts the
+second adversarial session, which receives the first full redacted report as
+untrusted data. The first FAIL or NOT_RUN stops; a second FAIL is final FAIL,
+and a missing second verdict is NOT_RUN. A same-target pair is still
+independent because the sessions and clones are fresh.
+
+Host network or loopback restrictions return `REVIEW_NOT_RUN` before any
+reviewer is started. The managed instructions require a trusted outer host
+runner to start the exact same command with both capabilities on its first
+invocation; an in-sandbox retry is not an elevation. The result remains
+`NOT_RUN` if that host is unavailable. There is no repository-level permission
+bypass.
+Reviewer attempts and preflight diagnostics remain visible in JSON. `--yes` is
+required because a complete run spends provider quota twice.
+
+After a complete PASS, the full redacted primary and adversarial reports are
+stored privately under `.agent-ops/reviews/`; the source-fingerprint attestation
+stores only the task, reviewer/session identities, report digests, and artifact
+reference. Any artifact or attestation write failure is NOT_RUN, never PASS.
 
 Authentication is diagnosed, never guessed:
 

package/dist/packages/cli/src/args.js

@@ -74,6 +74,7 @@ export function parseArgs(argv) {
     const criteria = [];
     const evidence = [];
     let checkAuth = false;
+    const checkAuthTargets = [];
     let completionGate;
     let dryRun = false;
     let json = false;
@@ -205,6 +206,18 @@ export function parseArgs(argv) {
                 }
                 checkAuth = true;
                 break;
+            case "--check-auth-target": {
+                const value = readOptionValue(argv, index, token);
+                if (!REVIEW_TARGETS.has(value)) {
+                    invalidValue(token, value);
+                }
+                if (checkAuthTargets.includes(value)) {
+                    duplicate(`${token} ${value}`);
+                }
+                checkAuthTargets.push(value);
+                index += 1;
+                break;
+            }
             case "--completion-gate":
                 if (completionGate !== undefined) {
                     duplicate(token);
@@ -322,6 +335,7 @@ export function parseArgs(argv) {
             sessionId !== undefined ||
             base !== undefined ||
             checkAuth ||
+            checkAuthTargets.length > 0 ||
             dryRun ||
             yes) {
             throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Only --json may be combined with global help or version.");
@@ -367,9 +381,15 @@ export function parseArgs(argv) {
     if (checkAuth && command !== "doctor") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--check-auth may be used only with doctor.");
     }
+    if (checkAuthTargets.length > 0 && command !== "doctor") {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--check-auth-target may be used only with doctor.");
+    }
+    if (checkAuthTargets.length > 0 && !checkAuth) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--check-auth-target requires --check-auth.");
+    }
     if (reviewTargets.length > 0 && command !== "init") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", command === "review"
-            ? "--review-target configures init; for one review run, use --harness <target>."
+            ? "--review-target configures init; review uses the configured reviewer pair."
             : "--review-target may be used only with init.");
     }
     if (completionGate !== undefined && command !== "init") {
@@ -425,18 +445,20 @@ export function parseArgs(argv) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Verify accepts only scope, task or session, base, and json options.");
     }
     if (command === "review" &&
-        (title !== undefined || sessionId !== undefined)) {
-        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Review accepts harness, criteria, evidence, scope, dry-run, json, and yes options.");
+        (title !== undefined || sessionId !== undefined || dryRun)) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Review accepts task, base, json, and yes options.");
     }
-    if (command === "review" &&
-        taskId === undefined &&
-        (criteria.length > 0 || evidence.length > 0)) {
-        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Review criteria and evidence require --task.");
+    if (command === "review" && taskId === undefined) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Review requires --task for the complete task-bound review.");
     }
-    if (command === "review" &&
-        harness !== undefined &&
-        (harness.length !== 1 || !REVIEW_TARGETS.has(harness[0] ?? ""))) {
-        invalidValue("--harness", harness.join(","));
+    if (command === "review" && !yes) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Review requires --yes to authorize both reviewer sessions.");
+    }
+    if (command === "review" && harness !== undefined) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Complete review uses the configured reviewer pair; omit --harness.");
+    }
+    if (command === "review" && (criteria.length > 0 || evidence.length > 0)) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Complete review covers every task criterion; omit --criterion and --evidence.");
     }
     if (command === "allow-stop" &&
         (sessionId === undefined ||
@@ -469,6 +491,7 @@ export function parseArgs(argv) {
         ...(sessionId === undefined ? {} : { sessionId }),
         ...(base === undefined ? {} : { base }),
         ...(checkAuth ? { checkAuth } : {}),
+        ...(checkAuthTargets.length === 0 ? {} : { checkAuthTargets }),
         dryRun,
         json,
         yes

package/dist/packages/cli/src/bin.js

@@ -15,6 +15,7 @@ import { FileTrustStore } from "../../../runtime/src/security/trust.js";
 import { localStatePaths } from "../../../runtime/src/security/permissions.js";
 import { calculateConfigHash } from "../../../runtime/src/config/hash.js";
 import { FileEvidenceStore } from "../../../runtime/src/verify/evidence.js";
+import { calculateSourceFingerprint } from "../../../runtime/src/verify/source-fingerprint.js";
 import { VerificationService } from "../../../runtime/src/verify/service.js";
 import { NodeVerificationProcessRunner } from "../../../runtime/src/verify/spawn.js";
 import { runCli } from "./cli.js";
@@ -31,7 +32,8 @@ import { runTaskCommand } from "./commands/task.js";
 import { runReviewCommand } from "./commands/review.js";
 import { createReviewExecutor, ReviewInterruptedError } from "../../../runtime/src/review/execute.js";
 import { probeReviewTarget } from "../../../runtime/src/review/probe.js";
-import { detectHostTarget, orderChain, resolveReviewRole } from "../../../runtime/src/review/roles.js";
+import { resolveReviewScope } from "../../../runtime/src/review/scope.js";
+import { resolveReviewRole } from "../../../runtime/src/review/roles.js";
 import { runTrustCommand } from "./commands/trust.js";
 import { runVerifyCommand } from "./commands/verify.js";
 import { runAllowStopCommand } from "./commands/allow-stop.js";
@@ -308,7 +310,10 @@ else {
                         },
                         ...(args.checkAuth === true
                             ? { checkReviewTargetAuth: true }
-                            : {})
+                            : {}),
+                        ...(args.checkAuthTargets === undefined
+                            ? {}
+                            : { checkAuthTargets: args.checkAuthTargets })
                     });
                 }
                 if (args.command === "uninstall") {
@@ -386,12 +391,10 @@ else {
                 }
                 if (args.command === "review") {
                     const reviewSessionId = process.env.AGENT_OPS_SESSION_ID;
+                    const reviewGit = gitRunner(root);
                     const reviewConfig = (await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config;
                     const reviewRole = resolveReviewRole("independent-review", reviewConfig.reviewRoles ?? []);
-                    const selectedReviewTarget = args.harness?.[0];
-                    const plannedReviewTargets = orderChain(selectedReviewTarget === undefined
-                        ? reviewRole?.targets ?? []
-                        : [selectedReviewTarget], detectHostTarget(process.env));
+                    const configuredReviewTargets = reviewRole?.targets ?? [];
                     const controller = new AbortController();
                     let interruptedBy;
                     const interrupt = (signal) => {
@@ -414,15 +417,15 @@ else {
                             ...(reviewConfig.reviewRoles === undefined
                                 ? {}
                                 : { roles: reviewConfig.reviewRoles }),
-                            targets: plannedReviewTargets,
+                            targets: configuredReviewTargets,
                             root,
-                            gitRunner: gitRunner(root),
+                            gitRunner: reviewGit,
                             policyConfigHash: calculateConfigHash(reviewConfig),
                             currentPolicyConfigHash: async () => calculateConfigHash((await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config),
                             config: reviewConfig,
                             evidenceStore: new FileEvidenceStore(root, root),
                             execute: createReviewExecutor({
-                                targets: plannedReviewTargets,
+                                targets: configuredReviewTargets,
                                 cwd: root,
                                 ...(reviewRole?.model === undefined
                                     ? {}
@@ -433,6 +436,15 @@ else {
                                 ...(reviewRole?.timeoutMs === undefined
                                     ? {}
                                     : { timeoutMs: reviewRole.timeoutMs }),
+                                preflightTarget: async (target) => await probeReviewTarget(target, { cwd: root, deep: true }),
+                                verifySourceFingerprint: async (expected) => {
+                                    const currentScope = await resolveReviewScope({
+                                        root,
+                                        runner: reviewGit,
+                                        ...(args.base === undefined ? {} : { base: args.base })
+                                    });
+                                    return await calculateSourceFingerprint(root, currentScope, reviewGit) === expected;
+                                },
                                 signal: controller.signal,
                                 onProgress: (line) => {
                                     process.stderr.write(`${line}\n`);

package/dist/packages/cli/src/cli.js

@@ -32,14 +32,14 @@ Commands:
 
 Options:
   --scope <project|user>
-  --harness <all|both|agy|claude|codex|opencode|comma-separated>  Init/update/uninstall; review accepts one configured target
+  --harness <all|both|agy|claude|codex|opencode|comma-separated>  Init/update/uninstall; review uses configured targets
   --hook-target <harness=surface-id>  Repeatable advanced init/update option
   --profile <core|advisory|guardrails|loop>  Repeatable
-  --review-target <codex|agy|claude>  Repeatable init option; external review
-                                      targets in fallback-chain order
+  --review-target <codex|agy|claude>  Repeatable init option; review pair order
   --completion-gate                  Init only: enable the project-loop completion gate
-  --check-auth                        Doctor only: probe each review target's
+  --check-auth                        Doctor only: probe selected review targets'
                                       authentication with one real call
+  --check-auth-target <target>        Repeatable doctor filter with --check-auth
   --task <id>
   --parent <task-id>                  Task create: record a subtask of this
                                       task; task status: list its subtasks
@@ -159,18 +159,16 @@ Options:
   --base <git-ref>   Verify a clean committed range
   --json
 `,
-    review: `Usage: agent-ops review [options]
+    review: `Usage: agent-ops review --task <id> --yes [options]
 
-Run one independent read-only review against the configured target chain.
+Run the complete task-bound review: one necessary reviewer followed by one
+fresh adversarial reviewer from the configured pair.
 
 Options:
-  --task <id>
-  --session <id>
-  --criterion <id>     Repeatable: review only these task criteria
-  --harness <target>   One configured review target
-  --base <git-ref>
+  --task <id>          Required task whose original criteria are reviewed
+  --base <git-ref>     Review a clean committed range
   --json
-  --yes                Authorize the review call
+  --yes                Required authorization for both reviewer sessions
 `,
     "allow-stop": `Usage: agent-ops allow-stop --session <id> [options]
 
@@ -234,7 +232,11 @@ export async function runCli(argv, io, services) {
             return writeAndReturn(io, errorEnvelope("CLI_COMMAND_UNAVAILABLE", `Command is not implemented yet: ${args.command}`), args.json, 1);
         }
         const result = await execute(args);
-        return writeAndReturn(io, result, args.json, result.status === "ok" ? 0 : 1);
+        return writeAndReturn(io, result, args.json, result.status === "ok"
+            ? 0
+            : result.code === "REVIEW_NOT_RUN"
+                ? 2
+                : 1);
     }
     catch (error) {
         if (error instanceof CliArgumentError) {

package/dist/packages/cli/src/commands/review.js

@@ -1,8 +1,8 @@
 import { buildReviewPacket } from "../../../../runtime/src/review/packet.js";
 import { runIndependentReview } from "../../../../runtime/src/review/runner.js";
 import { renderReviewResult } from "../../../../runtime/src/review/render.js";
-import { invalidateReviewAttestation, saveReviewAttestation } from "../../../../runtime/src/review/attestation.js";
-import { resolveReviewRole } from "../../../../runtime/src/review/roles.js";
+import { invalidateReviewAttestation, reviewReportDigest, saveReviewAttestation, saveReviewReportArtifact } from "../../../../runtime/src/review/attestation.js";
+import { detectHostTarget, planReviewTargets, resolveReviewRole } from "../../../../runtime/src/review/roles.js";
 import { AgentOpsError } from "../../../../runtime/src/fs/paths.js";
 import { assertSafeSupportingPaths, isReviewerPolicyPath, resolveReviewScope, reviewScopeSignature } from "../../../../runtime/src/review/scope.js";
 import { calculateSourceFingerprint } from "../../../../runtime/src/verify/source-fingerprint.js";
@@ -222,6 +222,12 @@ function sourceChangedResult(result) {
         ...(result.plannedTargets === undefined
             ? {}
             : { plannedTargets: result.plannedTargets }),
+        ...(result.sourceFingerprint === undefined
+            ? {}
+            : { sourceFingerprint: result.sourceFingerprint }),
+        ...(result.hostTarget === undefined
+            ? {}
+            : { hostTarget: result.hostTarget }),
         ...(result.scope === undefined ? {} : { scope: result.scope }),
         ...(result.independence === undefined
             ? {}
@@ -230,11 +236,90 @@ function sourceChangedResult(result) {
             ? {}
             : { sessionIsolation: result.sessionIsolation }),
         ...(result.attempts === undefined ? {} : { attempts: result.attempts }),
+        ...(result.report === undefined ? {} : { report: result.report }),
+        ...(result.adversarial === undefined
+            ? {}
+            : { adversarial: result.adversarial }),
         ...(result.verification === undefined
             ? {}
             : { verification: result.verification })
     };
 }
+function hasCompleteReviewEvidence(result) {
+    const attempts = result.attempts;
+    const plannedTargets = result.plannedTargets;
+    return result.status === "PASS" &&
+        result.report !== undefined &&
+        result.adversarial !== undefined &&
+        result.adversarial.refuted === false &&
+        result.sessionIsolation === "fresh" &&
+        plannedTargets !== undefined &&
+        plannedTargets.length === 2 &&
+        result.harness === plannedTargets[0] &&
+        result.adversarial.target === plannedTargets[1] &&
+        attempts !== undefined &&
+        attempts.length === 2 &&
+        attempts.every((attempt, index) => attempt.target === plannedTargets[index] &&
+            attempt.status === "PASS" &&
+            attempt.sessionId !== undefined);
+}
+async function persistReviewEvidence(options, result, sourceFingerprint, context) {
+    if (options.root === undefined || sourceFingerprint === undefined) {
+        return result;
+    }
+    const complete = hasCompleteReviewEvidence(result);
+    const artifactResult = result.status === "PASS" && !complete
+        ? {
+            ...result,
+            status: "NOT_RUN",
+            reason: "adversarial-review-missing"
+        }
+        : result;
+    let reportArtifact;
+    try {
+        reportArtifact = await saveReviewReportArtifact(options.root, artifactResult, sourceFingerprint, context?.taskId);
+    }
+    catch {
+        return {
+            ...result,
+            status: "NOT_RUN",
+            reason: "evidence-write-failed"
+        };
+    }
+    if (!complete) {
+        return artifactResult;
+    }
+    if (result.status !== "PASS" || context?.allCriteriaReviewed === false) {
+        return result;
+    }
+    try {
+        const attempts = result.attempts;
+        const plannedTargets = result.plannedTargets;
+        await saveReviewAttestation(options.root, {
+            schemaVersion: 2,
+            ...(context === undefined ? {} : { taskId: context.taskId }),
+            harness: result.harness,
+            status: "PASS",
+            sourceFingerprint,
+            reviewTargets: [plannedTargets[0], plannedTargets[1]],
+            reviewSessionIds: [attempts[0].sessionId, attempts[1].sessionId],
+            sessionIsolation: "fresh",
+            primaryReportDigest: reviewReportDigest(result.report),
+            adversarialReportDigest: reviewReportDigest(result.adversarial.report),
+            reportArtifact,
+            ...(result.hostTarget === undefined ? {} : { hostTarget: result.hostTarget }),
+            createdAt: new Date().toISOString()
+        });
+    }
+    catch {
+        return {
+            ...result,
+            status: "NOT_RUN",
+            reason: "evidence-write-failed"
+        };
+    }
+    return result;
+}
 export async function runReviewCommand(options) {
     const role = resolveReviewRole(options.role ?? "independent-review", options.roles ?? []);
     const selectedHarness = harness(options.args.harness);
@@ -243,17 +328,30 @@ export async function runReviewCommand(options) {
         !configuredTargets.includes(selectedHarness)) {
         throw new AgentOpsError("REVIEW_TARGET_NOT_CONFIGURED", `${selectedHarness} is not enabled for independent-review. Configure it with init --review-target ${selectedHarness}.`);
     }
-    const plannedTargets = selectedHarness === undefined
+    const configuredSelection = selectedHarness === undefined
         ? options.targets ?? configuredTargets
         : [selectedHarness];
+    const targetPlan = planReviewTargets(configuredSelection, detectHostTarget(options.env ?? process.env));
+    const hostTarget = detectHostTarget(options.env ?? process.env);
+    const plannedTargets = targetPlan.reason === undefined
+        ? targetPlan.targets
+        : configuredSelection;
     const target = plannedTargets[0] ?? selectedHarness ?? "codex";
     const resultBase = {
         harness: target,
         plannedTargets,
         model: role?.model ?? options.model ?? "configured",
         effort: role?.effort ?? options.effort ?? "configured",
-        prompt: ""
+        prompt: "",
+        ...(hostTarget === undefined ? {} : { hostTarget })
     };
+    if (targetPlan.reason !== undefined) {
+        return notRunEnvelope({
+            ...resultBase,
+            status: "NOT_RUN",
+            reason: targetPlan.reason
+        });
+    }
     const context = await taskContext(options);
     const evidenceRequirements = (options.args.evidence ?? []).map((value) => {
         const separator = value.indexOf("=");
@@ -358,6 +456,8 @@ export async function runReviewCommand(options) {
         invocation: {
             harness: target,
             plannedTargets,
+            ...(sourceFingerprint === undefined ? {} : { sourceFingerprint }),
+            ...(hostTarget === undefined ? {} : { hostTarget }),
             model: role?.model ?? options.model ?? "configured",
             effort: role?.effort ?? options.effort ?? "configured",
             packet,
@@ -408,55 +508,46 @@ export async function runReviewCommand(options) {
             if (reviewScopeSignature(scope) !== reviewScopeSignature(postflight) ||
                 (options.policyConfigHash !== undefined && currentHash !== options.policyConfigHash) ||
                 postflightFingerprint !== sourceFingerprint) {
-                return notRunEnvelope(sourceChangedResult(result));
+                const changed = await persistReviewEvidence(options, sourceChangedResult(result), sourceFingerprint, context);
+                return notRunEnvelope(changed);
             }
         }
         catch {
-            return notRunEnvelope(sourceChangedResult(result));
+            const changed = await persistReviewEvidence(options, sourceChangedResult(result), sourceFingerprint, context);
+            return notRunEnvelope(changed);
         }
     }
+    const persisted = await persistReviewEvidence(options, result, sourceFingerprint, context);
+    if (persisted.status === "NOT_RUN") {
+        return notRunEnvelope(persisted);
+    }
+    const finalResult = persisted;
     // Evidence is only appended while the task is active: a completed record
     // must stay exactly as it was verified.
     if (context !== undefined &&
         options.tasks !== undefined &&
-        result.status === "PASS" &&
+        finalResult.status === "PASS" &&
         context.active &&
-        result.results !== undefined) {
-        await options.tasks.recordEvidence(context.taskId, Object.fromEntries(result.results.map((item) => [
+        finalResult.results !== undefined) {
+        await options.tasks.recordEvidence(context.taskId, Object.fromEntries(finalResult.results.map((item) => [
             item.criterionId,
-            item.evidence.map((reference) => `review:${result.harness}:${reference}`)
+            item.evidence.map((reference) => `review:${finalResult.harness}:${reference}`)
         ])));
     }
-    // The attestation is what a Stop gate reads. It is keyed by the verified
-    // source fingerprint, so it stops satisfying the gate the moment the tree
-    // changes again.
-    if (options.root !== undefined &&
-        result.status === "PASS" &&
-        sourceFingerprint !== undefined &&
-        (context === undefined || context.allCriteriaReviewed)) {
-        await saveReviewAttestation(options.root, {
-            schemaVersion: 1,
-            ...(context === undefined ? {} : { taskId: context.taskId }),
-            harness: result.harness,
-            status: "PASS",
-            sourceFingerprint,
-            createdAt: new Date().toISOString()
-        });
-    }
-    const message = result.status === "PASS"
+    const message = finalResult.status === "PASS"
         ? "Independent review passed."
-        : result.status === "FAIL"
+        : finalResult.status === "FAIL"
             ? "Independent review failed."
             : "Independent review was not run.";
     const data = {
         message,
-        result,
-        text: renderReviewResult(result)
+        result: finalResult,
+        text: renderReviewResult(finalResult)
     };
-    if (result.status === "PASS") {
+    if (finalResult.status === "PASS") {
         return okEnvelope("REVIEW_RESULT", data);
     }
-    const code = result.status === "FAIL" ? "REVIEW_FAILED" : "REVIEW_NOT_RUN";
+    const code = finalResult.status === "FAIL" ? "REVIEW_FAILED" : "REVIEW_NOT_RUN";
     return {
         code,
         status: "error",

package/dist/runtime/src/adapters/claude/output.js

@@ -40,7 +40,8 @@ export function claudeHookOutput(event, result) {
                 decision: "block",
                 reason: `agent-ops: ${result.code} reported FAIL for ${failed.join(", ")}. ` +
                     "Resolve every failing item — an unsatisfied independent-review " +
-                    "gate is cleared by running `agent-ops review` to a PASS — then " +
+                    "gate is cleared by running `agent-ops review --task <task-id> --yes` " +
+                    "to a PASS — then " +
                     "stop again.",
                 evidence: result.evidence
             });

package/dist/runtime/src/install/doctor.js

@@ -4,7 +4,7 @@ import { sha256 } from "../fs/hash.js";
 import { parseInstallManifest, PROJECT_MANIFEST_PATH } from "../fs/manifest.js";
 import { resolveContainedPath } from "../fs/paths.js";
 import { validateConfig } from "../schema/validate.js";
-import { BIND_DEPENDENT_TARGETS, detectHostRestriction } from "../review/host-sandbox.js";
+import { detectHostRestriction } from "../review/host-sandbox.js";
 import { assertExpectedManagedBlock, assertSupportedManifestOwnership } from "./ownership.js";
 import { isOpencodeManagedPlugin } from "../adapters/opencode/config.js";
 import { harnessDescriptor, managedRules } from "./harness.js";
@@ -409,14 +409,20 @@ async function checkHostSandbox(detect) {
             "target can answer. Any authentication verdict below is unreliable.", undefined, "Run agent-ops outside the sandbox, or grant it escalated execution.");
     }
     if (restriction === "bind-blocked") {
-        return check("host-sandbox", "DEGRADED", `This process cannot open a loopback listener, so review targets that ` +
-            `need one (${BIND_DEPENDENT_TARGETS.join(", ")}) run last and may be ` +
-            "unable to answer.", undefined, "Run agent-ops outside the sandbox, or grant it escalated execution.");
+        return check("host-sandbox", "DEGRADED", "This process cannot open a loopback listener, so review fails closed " +
+            "with host-required before any reviewer starts.", undefined, "Run agent-ops outside the sandbox, or grant it escalated execution.");
     }
     return check("host-sandbox", "PASS", "No host sandbox restriction affects review targets.");
 }
-async function checkReviewTargets(config, probe, checkAuth) {
-    const targets = config?.reviewRoles?.find((role) => role.role === "independent-review")?.targets ?? [];
+async function checkReviewTargets(config, probe, checkAuth, selectedTargets = []) {
+    const configuredTargets = config?.reviewRoles?.find((role) => role.role === "independent-review")?.targets ?? [];
+    const unconfigured = selectedTargets.filter((target) => !configuredTargets.includes(target));
+    if (unconfigured.length > 0) {
+        return check("review-targets", "FAIL", `Review target selection is not configured: ${unconfigured.join(", ")}.`, undefined, "Configure the target with agent-ops init --review-target, then retry.");
+    }
+    const targets = selectedTargets.length > 0
+        ? selectedTargets
+        : configuredTargets;
     if (targets.length === 0) {
         return check("review-targets", "PASS", "External review disabled. Re-run agent-ops init to enable.");
     }
@@ -445,6 +451,10 @@ async function checkReviewTargets(config, probe, checkAuth) {
             failures.push(check("review-targets", "FAIL", `${target} did not answer in time.`, undefined, "Re-run: agent-ops doctor --check-auth"));
             continue;
         }
+        if (result === "capability-unavailable") {
+            failures.push(check("review-targets", "FAIL", `${target} could not complete its read-only capability probe.`, undefined, "Run agent-ops review on a host with network and loopback permission, then retry."));
+            continue;
+        }
         if (checkAuth && result !== "ok") {
             failures.push(check("review-targets", "FAIL", `${target} is installed but not authenticated, or it rejected the call.`, undefined, `Run: ${target} login`));
         }
@@ -483,7 +493,7 @@ export async function doctorInstallation(options) {
             : []),
         await checkProbe("repository-trust", options.probes?.repositoryTrust),
         await checkProbe("smoke-availability", options.probes?.smokeAvailability),
-        await checkReviewTargets(config.config, options.probes?.reviewTarget, options.checkReviewTargetAuth === true),
+        await checkReviewTargets(config.config, options.probes?.reviewTarget, options.checkReviewTargetAuth === true, options.checkAuthTargets),
         await checkHostSandbox(options.probes?.hostRestriction),
         checkVerificationCommands(config.config)
     ];

package/dist/runtime/src/install/harness.js

@@ -296,7 +296,7 @@ export function managedRules(descriptor, context) {
         ""
     ];
     if (context.capabilities.includes("rules")) {
-        lines.push("For every change:", "", "1. Define two to five mechanically verifiable acceptance criteria.", "2. Inspect the smallest relevant scope and preserve unrelated changes.", "3. Apply the smallest safe change.", "4. Run evidence-producing verification for every criterion.", "5. Obtain independent review before claiming completion, via", "   `agent-ops review --yes` (or the CLI's equivalent invocation). Never call a", "   review-target CLI (agy, codex, claude) directly — direct calls skip", "   the enforced read-only sandbox flags and can hang or fail on command", "   permission prompts.", "   Set `AGENT_OPS_HOST` to the current CLI id when invoking review so", "   agent-ops tries a different CLI first and uses isolated self-review", "   only when no other configured reviewer is usable.", "", "Treat `.agent-ops/config.json` as verifier authority. Discovery output is", "only a proposal until a user confirms it. Repository commands require an", "exact matching trust record. Confirmed project init/update grants it", "automatically when verification commands are configured.", "");
+        lines.push("For every change:", "", "1. Define two to five mechanically verifiable acceptance criteria.", "2. Inspect the smallest relevant scope and preserve unrelated changes.", "3. Apply the smallest safe change.", "4. Run evidence-producing verification for every criterion.", "5. Obtain complete independent review before claiming completion, via", "   `agent-ops review --task <task-id> --yes` (or the CLI's equivalent invocation).", "   Never call a", "   review-target CLI (agy, codex, claude) directly — direct calls skip", "   the enforced read-only sandbox flags and can hang or fail on command", "   permission prompts.", "   Start this command through the trusted outer host runner as its first", "   and only invocation. On Codex, the outer tool request must use", "   `sandbox_permissions: \"require_escalated\"` so network and loopback", "   are available; in that same request, unset", "   `CODEX_SANDBOX_NETWORK_DISABLED` and set `AGENT_OPS_HOST` when three", "   targets are configured. The Codex shell form is", "   `env -u CODEX_SANDBOX_NETWORK_DISABLED AGENT_OPS_HOST=<current-host> agent-ops review --task <task-id> --yes`.", "   Do not run it once in the restricted sandbox and retry; changing the", "   variable inside that sandbox is not elevation.", "   Review runs exactly two fresh sessions: with three configured targets,", "   set `AGENT_OPS_HOST` to the current CLI id so it is excluded; with two", "   targets both run in configured order; with one target it runs twice.", "   The first session is necessary; a PASS then requires an adversarial", "   re-check carrying the first report. A first FAIL or NOT_RUN stops.", "", "Treat `.agent-ops/config.json` as verifier authority. Discovery output is", "only a proposal until a user confirms it. Repository commands require an", "exact matching trust record. Confirmed project init/update grants it", "automatically when verification commands are configured.", "");
     }
     if (context.capabilities.includes("task")) {
         lines.push("Split a change that exceeds five acceptance criteria into subtasks:", "`agent-ops task create --parent <task-id>` records one, and", "`agent-ops task status --parent <task-id>` lists them. Each subtask", "carries its own criteria, verification, and independent review;", "completing one never completes its parent.", "");