@kylecheng3146/agent-ops 0.5.2 → 0.6.0

package/dist/runtime/src/task/completion.js

@@ -2,8 +2,24 @@ import { calculateConfigHash } from "../config/hash.js";
 import { findReviewAttestation } from "../review/attestation.js";
 import { validateEvidence, validateTaskAgainstConfig } from "../schema/validate.js";
 import { isPassingVerificationEvidence } from "../verify/evidence.js";
+import { taskContractHash } from "./contract.js";
+import { acceptanceCoverage } from "../verify/acceptance-coverage.js";
 export async function checkTaskCompletionEvidence(stored, options) {
-    const { root, config, sourceFingerprint, evidenceStore } = options;
+    const problem = await checkTaskVerificationEvidence(stored, options);
+    if (problem !== null)
+        return problem;
+    const attestation = await findReviewAttestation(options.root, options.sourceFingerprint, stored.task.id);
+    if (attestation === null || attestation.taskId !== stored.task.id ||
+        ((stored.task.criteria.some(c => c.acceptance !== undefined) || (stored.task.contractRevision ?? 0) > 0 || stored.task.goal !== undefined) &&
+            (attestation.schemaVersion !== 3 || attestation.taskContracts?.[stored.task.id] !== taskContractHash(stored.task))) ||
+        (attestation.tree !== undefined && stored.task.criteria.some((criterion) => !attestation.tree.criterionIds.includes(`${stored.task.id}:${criterion.id}`)))) {
+        return { status: "FAIL", code: "REVIEW_REQUIRED", remedy: `Run agent-ops review --task ${stored.task.id} --yes for the whole task and current source.` };
+    }
+    return null;
+}
+/** The same mechanical proof check used by final completion and child delivery. */
+export async function checkTaskVerificationEvidence(stored, options) {
+    const { config, sourceFingerprint, evidenceStore } = options;
     if (stored.failureFingerprint !== null) {
         return { status: "FAIL", code: "VERIFICATION_FAILED", remedy: "Resolve the latest verification failure before completing the task." };
     }
@@ -12,8 +28,9 @@ export async function checkTaskCompletionEvidence(stored, options) {
         return { status: "FAIL", code: "TASK_STALE", remedy: "Recreate the task against the current config, then verify and review it." };
     }
     for (const criterion of stored.task.criteria) {
-        const commands = config.verification.commands.filter(({ id, required }) => criterion.verifierIds.includes(id) && required);
-        if (commands.length === 0) {
+        const commands = config.verification.commands.filter(({ id, required }) => required &&
+            (criterion.acceptance !== undefined || criterion.verifierIds.includes(id)));
+        if (commands.length === 0 && criterion.acceptance === undefined) {
             return { status: "FAIL", code: "REQUIRED_VERIFIER_MISSING", remedy: "Configure a required verifier for every criterion, then recreate, verify and review the task." };
         }
         for (const command of commands) {
@@ -30,6 +47,7 @@ export async function checkTaskCompletionEvidence(stored, options) {
                 if (evidence.taskId === stored.task.id && evidence.criterionId === criterion.id &&
                     evidence.commandId === command.id && evidence.configHash === configHash &&
                     evidence.sourceFingerprint === sourceFingerprint &&
+                    ((stored.task.goal === undefined && (stored.task.contractRevision ?? 0) === 0 && stored.task.criteria.every(c => c.acceptance === undefined)) || evidence.taskContractHash === taskContractHash(stored.task)) &&
                     (latest === undefined || Date.parse(evidence.finishedAt) > Date.parse(latest.finishedAt) ||
                         (Date.parse(evidence.finishedAt) === Date.parse(latest.finishedAt) && !isPassingVerificationEvidence(command, evidence)))) {
                     latest = evidence;
@@ -40,9 +58,9 @@ export async function checkTaskCompletionEvidence(stored, options) {
             }
         }
     }
-    const attestation = await findReviewAttestation(root, sourceFingerprint, stored.task.id);
-    if (attestation === null || attestation.taskId !== stored.task.id) {
-        return { status: "FAIL", code: "REVIEW_REQUIRED", remedy: `Run agent-ops review --task ${stored.task.id} --yes for the whole task and current source.` };
+    const coverage = await acceptanceCoverage(stored, config, sourceFingerprint, evidenceStore);
+    if (coverage.some(row => (row.mode === "behavioral" || row.mode === "invariant") && row.status !== "proven")) {
+        return { status: "FAIL", code: "ACCEPTANCE_EVIDENCE_REQUIRED", remedy: "Run current paired acceptance checks; UNKNOWN and non-discriminating checks do not prove a criterion." };
     }
     return null;
 }
@@ -53,6 +71,8 @@ export function findIncompleteSubtask(records, taskId) {
     while (previousSize !== descendants.size) {
         previousSize = descendants.size;
         for (const record of records) {
+            if (record.supersededBy !== undefined)
+                continue;
             if (record.task.parentTaskId !== undefined && descendants.has(record.task.parentTaskId)) {
                 descendants.add(record.task.id);
                 if (record.status === "active" || record.completedAt === null || record.failureFingerprint !== null)

package/dist/runtime/src/task/contract.js

@@ -0,0 +1,17 @@
+import { canonicalJson } from "../config/hash.js";
+import { sha256 } from "../fs/hash.js";
+export function goalHash(task) {
+    return sha256(task.goal ?? task.intent ?? task.title);
+}
+export function criterionContractHash(criterion) {
+    return sha256(canonicalJson(criterion));
+}
+export function taskContractHash(task) {
+    return sha256(canonicalJson({ goalHash: goalHash(task), title: task.title,
+        intent: task.intent ?? null, revision: task.contractRevision ?? 0,
+        criteria: task.criteria.map(criterionContractHash) }));
+}
+export function treeContractHash(tasks) {
+    return sha256(canonicalJson(tasks.map(task => ({ id: task.id, hash: taskContractHash(task) }))
+        .sort((a, b) => a.id.localeCompare(b.id))));
+}

package/dist/runtime/src/task/pin-finding.js

@@ -0,0 +1,81 @@
+import { readdir } from "node:fs/promises";
+import { join } from "node:path";
+import { AgentOpsError } from "../fs/paths.js";
+import { sha256 } from "../fs/hash.js";
+import { readPrivateFile } from "../security/permissions.js";
+import { reviewReportDigest, REVIEW_ATTESTATION_DIRECTORY, REVIEW_REPORT_ARTIFACT_SUFFIX } from "../review/attestation.js";
+import { validateReviewReport } from "../review/report.js";
+import { validateCriterion } from "../schema/validate.js";
+import { commitIdentity } from "../schema/acceptance.js";
+import { goalHash, taskContractHash } from "./contract.js";
+export async function loadFindingPin(root, record, reference, input, records = [record]) {
+    const checked = validateCriterion(input.finding !== undefined && input.acceptance !== undefined
+        ? { ...input, acceptance: { ...input.acceptance, baselineCommit: input.finding.candidateCommit } } : input, "$.criterion");
+    if (!checked.ok)
+        throw new AgentOpsError("TASK_PIN_CRITERION_INVALID", "Pin requires a valid acceptance criterion.");
+    const match = reference.match(/^([a-f0-9]{64}):(0|[1-9][0-9]{0,2})$/u);
+    if (match === null)
+        throw new AgentOpsError("TASK_FINDING_REFERENCE_INVALID", "Finding reference must be report digest:finding index.");
+    const digest = match[1];
+    const index = Number(match[2]);
+    const directory = join(root, ...REVIEW_ATTESTATION_DIRECTORY.split("/"));
+    let names;
+    try {
+        names = await readdir(directory);
+    }
+    catch {
+        names = [];
+    }
+    const hashes = new Set([taskContractHash(record.task), ...(record.revisions ?? []).flatMap(r => [r.previousHash, r.currentHash])]);
+    for (const name of names.filter(n => /^[a-f0-9]{64}(?:\.[a-z][a-z0-9-]{0,127})?\.reports\.json$/u.test(n)).sort()) {
+        const source = await readPrivateFile(join(directory, name), root);
+        if (source === null || Buffer.byteLength(source) > 512 * 1024)
+            continue;
+        let artifact;
+        try {
+            artifact = JSON.parse(source);
+        }
+        catch {
+            continue;
+        }
+        if (typeof artifact !== "object" || artifact === null || Array.isArray(artifact))
+            continue;
+        if (artifact.tree !== undefined && (typeof artifact.tree !== "object" || artifact.tree === null ||
+            !Array.isArray(artifact.tree.taskIds) || typeof artifact.tree.rootTaskId !== "string"))
+            continue;
+        if (artifact.schemaVersion !== 2 || artifact.status !== "FAIL" || !commitIdentity(artifact.candidateCommit) ||
+            artifact.taskContracts?.[record.task.id] === undefined || !hashes.has(artifact.taskContracts[record.task.id]) ||
+            name !== artifact.sourceFingerprint + (artifact.taskId === undefined ? "" : "." + artifact.taskId) + REVIEW_REPORT_ARTIFACT_SUFFIX)
+            continue;
+        const owner = artifact.tree === undefined ? record : records.find(r => r.task.id === artifact.tree.rootTaskId);
+        if (owner === undefined || artifact.goalHash !== goalHash(owner.task) ||
+            (artifact.tree === undefined ? artifact.taskId !== record.task.id : !artifact.tree.taskIds.includes(record.task.id)))
+            continue;
+        for (const report of [artifact.report, artifact.adversarial?.report]) {
+            if (typeof report !== "object" || report === null || !Array.isArray(report.results) ||
+                report.results.some(r => typeof r !== "object" || r === null || typeof r.criterionId !== "string"))
+                continue;
+            const valid = validateReviewReport(report, report.results.map(r => r.criterionId));
+            if (!valid.ok || reviewReportDigest(valid.value) !== digest || index >= valid.value.findings.length)
+                continue;
+            const finding = valid.value.findings[index];
+            if (input.acceptance === undefined || input.acceptance.mode === "invariant")
+                throw new AgentOpsError("TASK_PIN_ACCEPTANCE_REQUIRED", "Pinned findings require behavioral red checks or an explicit review-only contract.");
+            const pinId = sha256(digest + ":" + index);
+            const requestedPin = input.finding?.pinId;
+            const existing = record.task.criteria.find(c => c.finding?.pinId === (requestedPin ?? pinId));
+            if (requestedPin !== undefined && existing === undefined)
+                throw new AgentOpsError("TASK_PIN_UNKNOWN", "Explicit recurrence must name an existing pin ID.");
+            if (existing !== undefined && requestedPin === undefined) {
+                if (input.id !== existing.id)
+                    throw new AgentOpsError("TASK_PIN_EXISTS", "This finding already has a criterion; name its pin ID to record recurrence.");
+                return structuredClone(existing);
+            }
+            return { ...structuredClone(input), id: existing?.id ?? input.id,
+                acceptance: { ...input.acceptance, baselineCommit: existing?.acceptance?.baselineCommit ?? artifact.candidateCommit },
+                finding: existing?.finding ?? { pinId, reportDigest: digest, findingIndex: index,
+                    candidateCommit: artifact.candidateCommit, criterionIds: [...finding.criterionIds] } };
+        }
+    }
+    throw new AgentOpsError("TASK_FINDING_NOT_FOUND", "No saved failed report binds this finding to the task's goal, contract and candidate commit.");
+}

package/dist/runtime/src/task/render.js

@@ -26,6 +26,9 @@ export function renderTaskMarkdown(record) {
         ...(record.archivedAt === null
             ? []
             : [`Archived: ${record.archivedAt}`]),
+        ...(record.task.intent === undefined
+            ? []
+            : ["", "## Modification intent", "", safeTaskText(record.task.intent)]),
         "",
         "## Acceptance criteria",
         ""