@kylecheng3146/agent-ops 0.5.2 → 0.6.0

package/dist/packages/cli/src/commands/review.js

@@ -4,6 +4,12 @@ import { renderReviewResult } from "../../../../runtime/src/review/render.js";
 import { reviewReportResults } from "../../../../runtime/src/review/report.js";
 import { findPriorFailingFindings, findReviewAttestation, invalidateReviewAttestation, readReviewReportArtifact, reviewReportDigest, saveReviewAttestation, saveReviewReportArtifact } from "../../../../runtime/src/review/attestation.js";
 import { detectHostTarget, planReviewTargets, resolveReviewRole } from "../../../../runtime/src/review/roles.js";
+import { taskContractHash, treeContractHash, goalHash } from "../../../../runtime/src/task/contract.js";
+import { acceptanceCoverage, coverageDigest } from "../../../../runtime/src/verify/acceptance-coverage.js";
+import { resolveGitCommit } from "../../../../runtime/src/verify/change-surface.js";
+import { sha256 } from "../../../../runtime/src/fs/hash.js";
+import { readPrivateFile, writePrivateFile } from "../../../../runtime/src/security/permissions.js";
+import { redactSecrets } from "../../../../runtime/src/security/redact.js";
 import { AgentOpsError } from "../../../../runtime/src/fs/paths.js";
 import { assertSafeSupportingPaths, isReviewerPolicyPath, resolveReviewScope, reviewScopeSignature } from "../../../../runtime/src/review/scope.js";
 import { calculateSourceFingerprint } from "../../../../runtime/src/verify/source-fingerprint.js";
@@ -70,8 +76,11 @@ async function taskContext(options) {
         throw new AgentOpsError("REVIEW_CRITERIA_NOT_FOUND", "Every requested review criterion must exist on the selected task.");
     }
     return {
+        records: [record],
         taskId: record.task.id,
-        title: record.task.title,
+        title: record.task.intent === undefined
+            ? record.task.title
+            : `${record.task.title}\nModification intent: ${record.task.intent}`,
         active: record.status === "active",
         policyConfigHash: record.policyConfigHash,
         evidence: record.evidence,
@@ -80,6 +89,60 @@ async function taskContext(options) {
         allCriteriaReviewed: criteria.length === record.task.criteria.length
     };
 }
+async function treeContext(options) {
+    if (options.tasks === undefined || options.taskId === undefined) {
+        throw new AgentOpsError("REVIEW_TREE_TASK_REQUIRED", "Tree review requires a parent task.");
+    }
+    const all = await options.tasks.list();
+    const root = all.find(({ task }) => task.id === options.taskId);
+    if (root === undefined || root.status === "archived") {
+        throw new AgentOpsError("REVIEW_TREE_TASK_REQUIRED", "The selected review tree does not exist.");
+    }
+    const selected = new Set([root.task.id]);
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const record of all) {
+            if (record.status !== "archived" && record.task.parentTaskId !== undefined &&
+                selected.has(record.task.parentTaskId) && !selected.has(record.task.id)) {
+                selected.add(record.task.id);
+                changed = true;
+            }
+        }
+    }
+    const treeTasks = all.filter(({ task }) => selected.has(task.id));
+    const owners = new Map();
+    const evidence = {};
+    const criteria = treeTasks.flatMap((record) => record.task.criteria.map((criterion) => {
+        const id = `${record.task.id}:${criterion.id}`;
+        owners.set(id, { taskId: record.task.id, criterionId: criterion.id });
+        evidence[id] = record.evidence[criterion.id] ?? [];
+        return { id, description: `${record.task.title}: ${criterion.description}`, verifierIds: [...criterion.verifierIds] };
+    }));
+    if (treeTasks.some(({ policyConfigHash }) => policyConfigHash !== root.policyConfigHash)) {
+        throw new AgentOpsError("REVIEW_TREE_POLICY_MISMATCH", "Tree tasks must share one verifier policy.");
+    }
+    const historical = new Set([root.task.id]);
+    for (let size = 0; size !== historical.size;) {
+        size = historical.size;
+        for (const record of all)
+            if (record.task.parentTaskId !== undefined && historical.has(record.task.parentTaskId))
+                historical.add(record.task.id);
+    }
+    return {
+        historyRecords: all.filter(record => historical.has(record.task.id) && record.supersededBy !== undefined),
+        records: treeTasks,
+        taskId: root.task.id,
+        title: [root.task.title, ...treeTasks.map(({ task }) => `Task ${task.id}${task.parentTaskId === undefined ? "" : ` under ${task.parentTaskId}`}: ${task.title}\nModification intent: ${task.intent ?? task.title}`)].join("\n\n"),
+        active: treeTasks.every(({ status }) => status === "active"),
+        policyConfigHash: root.policyConfigHash,
+        evidence,
+        failureFingerprint: treeTasks.find(({ failureFingerprint }) => failureFingerprint !== null)?.failureFingerprint ?? null,
+        criteria,
+        allCriteriaReviewed: true,
+        treeTasks,
+        criterionOwners: owners
+    };
+}
 function newestEvidence(values) {
     return [...values].sort((left, right) => {
         const leftTime = Date.parse(left.evidence.finishedAt);
@@ -111,11 +174,15 @@ async function currentEvidence(options, context, criterionId, commandId, configH
             continue;
         }
         const evidence = validation.value;
-        if (evidence.taskId !== context.taskId ||
-            evidence.criterionId !== criterionId ||
+        const owner = context.criterionOwners?.get(criterionId);
+        if (evidence.taskId !== (owner?.taskId ?? context.taskId) ||
+            evidence.criterionId !== (owner?.criterionId ?? criterionId) ||
             evidence.commandId !== commandId ||
             evidence.configHash !== configHash ||
-            evidence.sourceFingerprint !== sourceFingerprint) {
+            evidence.sourceFingerprint !== sourceFingerprint ||
+            (context.records.some(r => r.task.id === (owner?.taskId ?? context.taskId) &&
+                (r.task.goal !== undefined || (r.task.contractRevision ?? 0) > 0 || r.task.criteria.some(c => c.acceptance !== undefined))) &&
+                evidence.taskContractHash !== taskContractHash(context.records.find(r => r.task.id === (owner?.taskId ?? context.taskId)).task))) {
             stale = true;
             continue;
         }
@@ -142,14 +209,18 @@ async function preflightReview(options, context, sourceFingerprint) {
     const configHash = calculateConfigHash(options.config);
     const commands = [];
     for (const criterion of context.criteria) {
-        for (const commandId of criterion.verifierIds ?? []) {
+        const owner = context.criterionOwners?.get(criterion.id);
+        const typed = context.records.find(r => r.task.id === (owner?.taskId ?? context.taskId))?.task.criteria
+            .find(c => c.id === (owner?.criterionId ?? criterion.id))?.acceptance !== undefined;
+        for (const commandId of new Set([...(criterion.verifierIds ?? []),
+            ...(typed ? options.config.verification.commands.filter(c => c.required).map(c => c.id) : [])])) {
             const command = options.config.verification.commands.find((candidate) => candidate.id === commandId);
             if (command === undefined) {
                 return { ok: false, reason: "missing-verification-evidence" };
             }
             const found = await currentEvidence(options, context, criterion.id, commandId, configHash, sourceFingerprint);
             const compatible = command.evidence.kind === "test-count"
-                ? found.current.filter(({ evidence }) => evidence.schemaVersion === 3)
+                ? found.current.filter(({ evidence }) => evidence.schemaVersion >= 3)
                 : found.current;
             if (command.required && found.current.length > 0 && compatible.length === 0) {
                 return { ok: false, reason: "stale-verification" };
@@ -210,9 +281,11 @@ export async function hasFreshVerification(options, taskId, base) {
     if (context === undefined) {
         return false;
     }
+    options = { ...options, noChangePaths: options.noChangePaths ?? context.records.find(r => r.task.id === context.taskId)?.noChangePaths };
     const scope = await resolveReviewScope({
         root: options.root,
         runner: options.gitRunner,
+        ...(options.noChangePaths === undefined ? {} : { noChangePaths: options.noChangePaths }),
         ...(base === undefined ? {} : { base })
     });
     const fingerprint = await calculateSourceFingerprint(options.root, scope, options.gitRunner);
@@ -304,7 +377,16 @@ async function reusableReview(options, sourceFingerprint, context) {
         return null;
     }
     const attestation = await findReviewAttestation(options.root, sourceFingerprint, context?.taskId);
-    if (attestation === null || attestation.taskId !== context?.taskId) {
+    if (attestation === null || attestation.taskId !== context?.taskId ||
+        (context?.binding !== undefined && (attestation.schemaVersion !== 3 ||
+            JSON.stringify(attestation.taskContracts) !== JSON.stringify(context.binding.taskContracts) ||
+            attestation.coverageDigest !== context.binding.coverageDigest))) {
+        return null;
+    }
+    if (context?.treeTasks !== undefined &&
+        (attestation.tree?.rootTaskId !== context.taskId ||
+            JSON.stringify(attestation.tree.taskIds) !== JSON.stringify(context.treeTasks.map(({ task }) => task.id)) ||
+            JSON.stringify(attestation.tree.criterionIds) !== JSON.stringify(context.criteria.map(({ id }) => id)))) {
         return null;
     }
     // The task's own policy baseline must still be the active one. This is
@@ -355,9 +437,19 @@ async function persistReviewEvidence(options, result, sourceFingerprint, context
             reason: "adversarial-review-missing"
         }
         : result;
-    let reportArtifact;
+    const taskIds = complete && context?.treeTasks !== undefined
+        ? context.treeTasks.map(({ task }) => task.id)
+        : [context?.taskId];
+    const tree = context?.treeTasks === undefined ? undefined : {
+        rootTaskId: context.taskId,
+        taskIds: context.treeTasks.map(({ task }) => task.id),
+        criterionIds: context.criteria.map(({ id }) => id)
+    };
+    const reportArtifacts = [];
     try {
-        reportArtifact = await saveReviewReportArtifact(options.root, artifactResult, sourceFingerprint, context?.taskId);
+        for (const taskId of taskIds) {
+            reportArtifacts.push({ taskId, path: await saveReviewReportArtifact(options.root, artifactResult, sourceFingerprint, taskId, complete ? tree : undefined, context?.binding === undefined ? undefined : { ...context.binding, taskContractHash: context.binding.taskContracts[taskId ?? context.taskId] }, context?.coverage) });
+        }
     }
     catch {
         return {
@@ -375,21 +467,25 @@ async function persistReviewEvidence(options, result, sourceFingerprint, context
     try {
         const attempts = result.attempts;
         const plannedTargets = result.plannedTargets;
-        await saveReviewAttestation(options.root, {
-            schemaVersion: 2,
-            ...(context === undefined ? {} : { taskId: context.taskId }),
-            harness: result.harness,
-            status: "PASS",
-            sourceFingerprint,
-            reviewTargets: [plannedTargets[0], plannedTargets[1]],
-            reviewSessionIds: [attempts[0].sessionId, attempts[1].sessionId],
-            sessionIsolation: "fresh",
-            primaryReportDigest: reviewReportDigest(result.report),
-            adversarialReportDigest: reviewReportDigest(result.adversarial.report),
-            reportArtifact,
-            ...(result.hostTarget === undefined ? {} : { hostTarget: result.hostTarget }),
-            createdAt: new Date().toISOString()
-        });
+        for (const artifact of reportArtifacts) {
+            await saveReviewAttestation(options.root, {
+                schemaVersion: context?.binding === undefined ? 2 : 3,
+                ...(context?.binding === undefined ? {} : { ...context.binding, taskContractHash: context.binding.taskContracts[artifact.taskId ?? context.taskId] }),
+                ...(artifact.taskId === undefined ? {} : { taskId: artifact.taskId }),
+                ...(tree === undefined ? {} : { tree }),
+                harness: result.harness,
+                status: "PASS",
+                sourceFingerprint,
+                reviewTargets: [plannedTargets[0], plannedTargets[1]],
+                reviewSessionIds: [attempts[0].sessionId, attempts[1].sessionId],
+                sessionIsolation: "fresh",
+                primaryReportDigest: reviewReportDigest(result.report),
+                adversarialReportDigest: reviewReportDigest(result.adversarial.report),
+                reportArtifact: artifact.path,
+                ...(result.hostTarget === undefined ? {} : { hostTarget: result.hostTarget }),
+                createdAt: new Date().toISOString()
+            });
+        }
     }
     catch {
         return {
@@ -432,7 +528,10 @@ export async function runReviewCommand(options) {
             reason: targetPlan.reason
         });
     }
-    const context = await taskContext(options);
+    const context = options.args.tree === true
+        ? await treeContext(options)
+        : await taskContext(options);
+    options = { ...options, noChangePaths: options.noChangePaths ?? context?.records.find(r => r.task.id === context.taskId)?.noChangePaths };
     const evidenceRequirements = (options.args.evidence ?? []).map((value) => {
         const separator = value.indexOf("=");
         return {
@@ -448,6 +547,7 @@ export async function runReviewCommand(options) {
             scope = await resolveReviewScope({
                 root: options.root,
                 runner: options.gitRunner,
+                ...(options.noChangePaths === undefined ? {} : { noChangePaths: options.noChangePaths }),
                 ...(options.args.base === undefined ? {} : { base: options.args.base })
             });
         }
@@ -505,7 +605,7 @@ export async function runReviewCommand(options) {
             // source was reviewed; it says nothing about the policy in force now or
             // about verification that has failed since, and both of those are
             // decided above.
-            const reused = options.args.rerun
+            const reused = options.args.rerun || context?.treeTasks !== undefined || context?.records.some(r => r.task.goal !== undefined || r.task.criteria.some(c => c.acceptance !== undefined) || (r.task.contractRevision ?? 0) > 0)
                 ? null
                 : await reusableReview(options, sourceFingerprint, context);
             if (reused !== null) {
@@ -518,16 +618,75 @@ export async function runReviewCommand(options) {
                     })
                 });
             }
-            await invalidateReviewAttestation(options.root, sourceFingerprint, context?.taskId);
+            for (const taskId of context?.treeTasks?.map(({ task }) => task.id) ?? [context?.taskId]) {
+                await invalidateReviewAttestation(options.root, sourceFingerprint, taskId);
+            }
             pendingInvalidation = false;
         }
     }
+    if (context !== undefined && sourceFingerprint !== undefined && options.config !== undefined &&
+        options.evidenceStore !== undefined && options.gitRunner !== undefined) {
+        const rows = [];
+        for (const record of context.records) {
+            const coverage = await acceptanceCoverage(record, options.config, sourceFingerprint, options.evidenceStore);
+            rows.push(...coverage.map(row => ({ ...row, criterionId: context.treeTasks === undefined
+                    ? row.criterionId : record.task.id + ":" + row.criterionId })));
+        }
+        context.coverage = rows;
+        context.binding = {
+            taskContractHash: taskContractHash(context.records.find(r => r.task.id === context.taskId).task),
+            taskContracts: Object.fromEntries(context.records.map(r => [r.task.id, taskContractHash(r.task)])),
+            ...(context.treeTasks === undefined ? {} : { treeContractHash: treeContractHash(context.records.map(r => r.task)) }),
+            goalHash: goalHash(context.records.find(r => r.task.id === context.taskId).task),
+            candidateCommit: await resolveGitCommit(options.gitRunner, "HEAD"), coverageDigest: coverageDigest(rows)
+        };
+    }
     const criteria = [
         ...(context?.criteria ?? GENERIC_CRITERIA)
     ];
+    if (context?.treeTasks !== undefined && criteria.length > 128) {
+        return notRunEnvelope({ ...resultBase, status: "NOT_RUN", reason: "scope-too-large" });
+    }
     let packet;
     try {
+        let contractManifest;
+        const contractArtifacts = [];
+        if (context?.binding !== undefined && options.root !== undefined) {
+            const historicalRefs = new Set([
+                ...[...context.records, ...(context.historyRecords ?? [])].flatMap(r => (r.revisions ?? []).flatMap(revision => Object.values(revision.previousEvidence).flat())),
+                ...(context.historyRecords ?? []).flatMap(r => Object.values(r.evidence).flat())
+            ]);
+            const refs = new Set([...context.records.flatMap(r => Object.values(r.evidence).flat()), ...historicalRefs].filter(ref => !ref.startsWith("review:")));
+            for (const path of refs) {
+                const loaded = await options.evidenceStore?.load(path);
+                if (loaded == null)
+                    continue;
+                if (!historicalRefs.has(path) && loaded.sourceFingerprint !== sourceFingerprint)
+                    continue;
+                const content = await readPrivateFile(options.root + "/" + path, options.root);
+                if (content !== null)
+                    contractArtifacts.push({ path, digest: sha256(content), content });
+                const executionPath = loaded.acceptance?.executionArtifact;
+                if (executionPath !== undefined && !contractArtifacts.some(artifact => artifact.path === executionPath)) {
+                    const execution = await readPrivateFile(options.root + "/" + executionPath, options.root);
+                    if (execution !== null)
+                        contractArtifacts.push({ path: executionPath, digest: sha256(execution), content: execution });
+                }
+            }
+            const content = redactSecrets(JSON.stringify({ binding: context.binding, coverage: context.coverage,
+                executionPolicy: options.config,
+                artifacts: contractArtifacts.map(({ path, digest }) => ({ path, digest })),
+                tasks: context.records.map(r => ({ task: r.task, revisions: r.revisions ?? [] })),
+                superseded: context.historyRecords ?? [] }, null, 2));
+            const digest = sha256(content);
+            const path = ".agent-ops/tasks/review-contracts/" + digest + ".json";
+            contractManifest = { path, digest, content };
+            // Validated before any manifest is written or handed to a snapshot.
+            buildReviewPacket({ request: context.title, criteria, artifactRefs: [], evidenceRequirements, contractManifest, contractArtifacts });
+            await writePrivateFile(options.root + "/" + path, content, options.root);
+        }
         packet = buildReviewPacket({
+            ...(contractManifest === undefined ? {} : { contractManifest, contractArtifacts }),
             request: context?.title ?? GENERIC_REQUEST,
             criteria,
             artifactRefs: scope?.changedFiles ?? [],
@@ -602,6 +761,7 @@ export async function runReviewCommand(options) {
             const postflight = await resolveReviewScope({
                 root: options.root,
                 runner: options.gitRunner,
+                ...(options.noChangePaths === undefined ? {} : { noChangePaths: options.noChangePaths }),
                 ...(options.args.base === undefined ? {} : { base: options.args.base })
             });
             const currentHash = options.currentPolicyConfigHash === undefined
@@ -610,7 +770,12 @@ export async function runReviewCommand(options) {
             const postflightFingerprint = await calculateSourceFingerprint(options.root, postflight, options.gitRunner);
             if (reviewScopeSignature(scope) !== reviewScopeSignature(postflight) ||
                 (options.policyConfigHash !== undefined && currentHash !== options.policyConfigHash) ||
-                postflightFingerprint !== sourceFingerprint) {
+                postflightFingerprint !== sourceFingerprint ||
+                (context?.binding?.treeContractHash !== undefined && options.tasks !== undefined &&
+                    await options.tasks.treeContract(context.taskId) !== context.binding.treeContractHash) ||
+                (context !== undefined && options.tasks !== undefined &&
+                    (await Promise.all(context.records.map(async (r) => taskContractHash((await options.tasks.status({ taskId: r.task.id })).task))))
+                        .some((hash, i) => hash !== taskContractHash(context.records[i].task)))) {
                 const changed = await persistReviewEvidence(options, sourceChangedResult(result), sourceFingerprint, context);
                 return notRunEnvelope(changed);
             }
@@ -632,12 +797,14 @@ export async function runReviewCommand(options) {
         finalResult.status === "PASS" &&
         context.active &&
         finalResult.results !== undefined) {
-        await options.tasks.recordEvidence(context.taskId, Object.fromEntries(finalResult.results.map((item) => [
-            item.criterionId,
-            item.evidence.map((reference) => `review:${finalResult.harness}:${reference}`)
-        ])), 
-        // What `worktree finish` completes this task against.
-        scope?.mode === "base" ? scope.resolvedBase : null);
+        for (const record of context.treeTasks ?? [await options.tasks.status({ taskId: context.taskId })]) {
+            await options.tasks.recordEvidence(record.task.id, Object.fromEntries(record.task.criteria.map((criterion) => {
+                const id = context.treeTasks === undefined
+                    ? criterion.id : `${record.task.id}:${criterion.id}`;
+                const result = finalResult.results?.find((item) => item.criterionId === id);
+                return [criterion.id, (result?.evidence ?? []).map((reference) => `review:${finalResult.harness}:${reference}`)];
+            })), scope?.mode === "base" ? scope.resolvedBase : null, scope?.mode === "base" && scope.noChange === true ? scope.changedFiles : undefined);
+        }
     }
     const message = finalResult.status === "PASS"
         ? "Independent review passed."

package/dist/packages/cli/src/commands/run.js

@@ -0,0 +1,111 @@
+import { readFile } from "node:fs/promises";
+import { AgentOpsError, resolveContainedPath } from "../../../../runtime/src/fs/paths.js";
+import { errorEnvelope, okEnvelope } from "../output.js";
+function dynamic(args) {
+    return args;
+}
+function actionOf(args) {
+    const value = dynamic(args).runAction ?? dynamic(args).action;
+    if (value === undefined || value === "start")
+        return "start";
+    if (["status", "logs", "resume", "stop", "respond"].includes(String(value)))
+        return value;
+    throw new AgentOpsError("RUN_ACTION_INVALID", `Unsupported run action: ${String(value)}`);
+}
+function runIdOf(args) {
+    const runId = args.runId ?? dynamic(args).taskId;
+    if (typeof runId !== "string" || runId.length === 0)
+        throw new AgentOpsError("RUN_ID_REQUIRED", "This run action requires a run id.");
+    return runId;
+}
+function textFor(action, state, message) {
+    const active = state.workers.filter((worker) => ["assigned", "starting", "running", "idle", "handing-off"].includes(worker.status)).length;
+    return [
+        message,
+        `Status: ${state.status}`,
+        `Host: ${state.host}`,
+        `Workers: ${active}/${state.jobs}`,
+        `Budget: ${Math.max(0, state.budget.limitMs - state.budget.accumulatedMs)}ms remaining`,
+        `Usage: ${state.budget.usage.tokens ?? "unknown"} tokens; ${state.budget.usage.usd === null ? "unknown" : "$" + state.budget.usage.usd} cost (${state.budget.usage.completeness})`,
+        action === "logs" ? "" : "Native goal completion is not final proof; verify, review, task state, and receipt are still required."
+    ].filter((line) => line.length > 0).join("\n");
+}
+function data(action, result) {
+    return {
+        action,
+        runId: result.state.runId,
+        state: result.state,
+        message: result.message,
+        text: textFor(action, result.state, result.message)
+    };
+}
+function stateData(action, state, message) {
+    return { action, runId: state.runId, state, message, text: textFor(action, state, message) };
+}
+async function goalFromArgs(args, root) {
+    if (args.goal !== undefined && args.goalFile !== undefined)
+        throw new AgentOpsError("RUN_GOAL_CONFLICT", "Use either a positional goal or --goal-file, not both.");
+    if (args.goalFile !== undefined) {
+        const path = await resolveContainedPath(root, args.goalFile);
+        return (await readFile(path, "utf8")).trim();
+    }
+    if (args.goal === undefined || args.goal.trim() === "")
+        throw new AgentOpsError("RUN_GOAL_REQUIRED", "Run start requires a non-empty goal.");
+    return args.goal.trim();
+}
+async function answerFromArgs(args, root) {
+    if (args.answer !== undefined && args.answerFile !== undefined)
+        throw new AgentOpsError("RUN_ANSWER_CONFLICT", "Use either --answer or --answer-file, not both.");
+    if (args.answerFile !== undefined)
+        return (await readFile(await resolveContainedPath(root, args.answerFile), "utf8")).trim();
+    if (args.answer === undefined || args.answer.trim() === "")
+        throw new AgentOpsError("RUN_ANSWER_REQUIRED", "Run respond requires a non-empty answer.");
+    return args.answer.trim();
+}
+/**
+ * External lifecycle surface. The command only starts/controls a supervisor;
+ * it never marks the task complete or treats a native process exit as proof.
+ */
+export async function runRunCommand(options) {
+    const action = actionOf(options.args);
+    try {
+        if (action === "start") {
+            const result = await options.service.start({
+                root: options.root,
+                commonDir: options.commonDir,
+                targetBranch: options.targetBranch,
+                goal: await goalFromArgs(options.args, options.root),
+                host: options.args.host ?? "codex",
+                ownerSessionId: options.ownerSessionId,
+                jobs: options.args.jobs,
+                timeBudgetMs: options.args.timeBudgetMs
+            });
+            const state = options.args.wait === true && options.waitForCompletion !== undefined
+                ? await options.waitForCompletion(result.state.runId)
+                : result.state;
+            const response = data(action, { ...result, state });
+            return okEnvelope(options.args.wait === true ? "RUN_FINISHED" : "RUN_STARTED", response);
+        }
+        const runId = runIdOf(options.args);
+        if (action === "status")
+            return okEnvelope("RUN_STATUS", stateData(action, await options.service.status(runId), `Read run ${runId}.`));
+        if (action === "logs") {
+            const state = await options.service.status(runId);
+            const events = await options.service.logs(runId);
+            return okEnvelope("RUN_LOGS", { ...stateData(action, state, `Read ${events.length} event(s) for run ${runId}.`), events });
+        }
+        if (action === "resume")
+            return okEnvelope("RUN_RESUMED", data(action, await options.service.resume(runId)));
+        if (action === "stop")
+            return okEnvelope("RUN_STOP_REQUESTED", data(action, await options.service.stop(runId, options.args.answer ?? "user requested stop")));
+        const questionId = options.args.questionId;
+        if (questionId === undefined || questionId.trim() === "")
+            throw new AgentOpsError("RUN_QUESTION_REQUIRED", "Run respond requires --question-id.");
+        return okEnvelope("RUN_RESPONDED", data(action, await options.service.respond(runId, questionId, await answerFromArgs(options.args, options.root))));
+    }
+    catch (cause) {
+        if (cause instanceof AgentOpsError)
+            return errorEnvelope(cause.code, cause.message);
+        throw cause;
+    }
+}

package/dist/packages/cli/src/commands/task.js

@@ -1,3 +1,5 @@
+import { lstat, readFile } from "node:fs/promises";
+import { taskContractHash } from "../../../../runtime/src/task/contract.js";
 import { AgentOpsError } from "../../../../runtime/src/fs/paths.js";
 import { renderTaskMarkdown, safeTaskText } from "../../../../runtime/src/task/render.js";
 import { errorEnvelope, okEnvelope } from "../output.js";
@@ -12,20 +14,21 @@ function parseCriterion(source) {
     catch {
         throw new AgentOpsError("TASK_CRITERION_INVALID", "Each --criterion value must be a JSON criterion object.");
     }
-    if (!isRecord(value) ||
-        Object.keys(value).sort().join(",") !==
-            "description,id,verifierIds" ||
-        typeof value.id !== "string" ||
-        typeof value.description !== "string" ||
-        !Array.isArray(value.verifierIds) ||
-        value.verifierIds.some((id) => typeof id !== "string")) {
-        throw new AgentOpsError("TASK_CRITERION_INVALID", "Each criterion requires only id, description, and verifierIds.");
+    if (!isRecord(value))
+        throw new AgentOpsError("TASK_CRITERION_INVALID", "Criterion must be an object.");
+    // TaskService normalizes the creation baseline, then uses the shared strict validator.
+    return value;
+}
+async function jsonFile(path) {
+    const status = await lstat(path);
+    if (!status.isFile() || status.isSymbolicLink() || status.size > 65536)
+        throw new AgentOpsError("TASK_PAYLOAD_INVALID", "Payload must be a regular JSON file at most 64 KiB.");
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch {
+        throw new AgentOpsError("TASK_PAYLOAD_INVALID", "Invalid JSON payload.");
     }
-    return {
-        id: value.id,
-        description: value.description,
-        verifierIds: [...value.verifierIds]
-    };
 }
 function parseEvidence(values) {
     const evidence = {};
@@ -57,7 +60,7 @@ function taskAction(args) {
             "complete",
             "create",
             "export",
-            "status"
+            "status", "revise", "replan", "pin-finding"
         ].includes(args.action)) {
         throw new AgentOpsError("TASK_ACTION_INVALID", "A supported task action is required.");
     }
@@ -68,7 +71,8 @@ function taskEnvelope(action, code, message, record) {
         action,
         message,
         record,
-        text: renderTaskMarkdown(record)
+        contractHash: taskContractHash(record.task),
+        text: renderTaskMarkdown(record) + "\nContract: " + taskContractHash(record.task)
     });
 }
 function renderTaskList(records) {
@@ -92,7 +96,11 @@ export async function runTaskCommand(options) {
                 : await options.sessionWorktree(sessionId);
             const record = await (worktree?.service ?? options.service).create({
                 title: options.args.title,
-                criteria: (options.args.criteria ?? []).map(parseCriterion),
+                ...(options.args.intent === undefined ? {} : { intent: options.args.intent }),
+                criteria: [...(options.args.criteria ?? []).map(parseCriterion),
+                    ...await Promise.all((options.args.criterionFiles ?? []).map(async (path) => await jsonFile(path)))]
+                    .map(c => c.acceptance === undefined || options.args.baseline === undefined ? c :
+                    { ...c, acceptance: { ...c.acceptance, baselineCommit: c.acceptance.baselineCommit ?? options.args.baseline } }),
                 ...(options.policyConfigHash === undefined
                     ? {}
                     : { policyConfigHash: options.policyConfigHash }),
@@ -126,6 +134,35 @@ export async function runTaskCommand(options) {
                 }
             };
         }
+        if (action === "revise") {
+            const payload = await jsonFile(options.args.criteriaFile);
+            if (!Array.isArray(payload))
+                throw new AgentOpsError("TASK_PAYLOAD_INVALID", "Criteria file must contain an array.");
+            const record = await options.service.revise(requireTaskId(options.args), {
+                expectedContractHash: options.args.expectedContract, criteria: payload,
+                reason: options.args.reason, ...(options.args.baseline === undefined ? {} : { baseline: options.args.baseline })
+            });
+            return taskEnvelope(action, "TASK_REVISED", "Contract revised; obtain new verification and fresh review.", record);
+        }
+        if (action === "replan") {
+            const payload = await jsonFile(options.args.planFile);
+            if (!Array.isArray(payload))
+                throw new AgentOpsError("TASK_PAYLOAD_INVALID", "Plan file must contain split task objects.");
+            const records = await options.service.replan(requireTaskId(options.args), {
+                expectedTreeContractHash: options.args.expectedTreeContract, reason: options.args.reason,
+                tasks: payload
+            });
+            return okEnvelope("TASK_REPLANNED", { action, message: "Task tree split atomically; reverify and review.", records, text: renderTaskList(records) });
+        }
+        if (action === "pin-finding") {
+            const criterion = parseCriterion(JSON.stringify(await jsonFile(options.args.criterionFiles[0])));
+            const pinned = await options.service.pinFinding(requireTaskId(options.args), options.args.expectedContract, options.args.findingReference, criterion, options.args.reason);
+            if (pinned.record === null)
+                return { code: "NEEDS_REPLAN", status: "error",
+                    data: { action, message: "Pin requires atomic replan to retain two to five criteria.", pendingCriterion: pinned.pendingCriterion, text: "NEEDS_REPLAN: include the pending criterion in task replan; no task was changed." },
+                    errors: [{ code: "NEEDS_REPLAN", message: "Replan the full current tree and pending pin." }] };
+            return taskEnvelope(action, "TASK_FINDING_PINNED", "Pinned saved finding; reverify and review the new contract.", pinned.record);
+        }
         if (action === "status") {
             if (options.args.taskId === undefined && sessionId === undefined) {
                 const parentTaskId = options.args.parentTaskId;
@@ -142,7 +179,15 @@ export async function runTaskCommand(options) {
             const record = await options.service.status(options.args.taskId === undefined
                 ? { sessionId }
                 : { taskId: options.args.taskId });
-            return taskEnvelope(action, "TASK_STATUS", `Read task ${record.task.id}.`, record);
+            const coverage = await options.service.coverage(record.task.id);
+            const proven = coverage.rows.filter(row => row.status === "proven").length;
+            const mechanical = coverage.rows.filter(row => row.mode === "behavioral" || row.mode === "invariant").length;
+            const reviewOnly = coverage.rows.filter(row => row.mode === "review-only").length;
+            const legacy = coverage.rows.filter(row => row.mode === "legacy").length;
+            const envelope = taskEnvelope(action, "TASK_STATUS", `Read task ${record.task.id}.`, record);
+            return { ...envelope, data: { ...envelope.data, coverage, treeContractHash: await options.service.treeContract(record.task.id),
+                    text: envelope.data.text + "\nAcceptance: " + proven + "/" + mechanical + " mechanical proven; " + reviewOnly + " review-only; " + legacy + " legacy; originally mechanical " + coverage.originalMechanical +
+                        "; reviewed " + coverage.reviewed + "; undischarged " + coverage.rows.filter(row => row.status !== "proven" && !coverage.reviewed).length } };
         }
         if (action === "attach") {
             if (sessionId === undefined) {

package/dist/packages/cli/src/commands/verify.js

@@ -7,6 +7,7 @@ function safe(value) {
 }
 function publicReport(report) {
     return {
+        ...(report.acceptance === undefined ? {} : { acceptance: report.acceptance }),
         taskId: report.taskId,
         status: report.status,
         surface: {