@kylecheng3146/agent-ops 0.5.3 → 0.6.0

package/README.md

@@ -12,6 +12,54 @@ pre-1.0 interface.
 The CLI is published as `@kylecheng3146/agent-ops` as a pre-1.0 interface;
 command behavior may change before 1.0.
 
+## Executable acceptance and native goal runs (0.6.0)
+
+Criteria can use `behavioral`, `invariant` or `review-only` acceptance contracts.
+Behavioral proof requires each designated red check to fail by assertion on its
+immutable baseline and every required check to pass on the candidate. Invariants
+can pass on both versions. Review-only requirements still need two fresh reviews
+against the original goal and an explicit `reviewOnlyReason` in the acceptance
+contract. Legacy criteria keep their existing verifier behavior.
+
+Configure and trust `verification.acceptanceRunners` in the repository. Tasks bind
+stable check IDs and explicit committed test/fixture/helper materials; they cannot
+override runner executables or arguments. Each version installs and builds its own
+declared dependencies. Fixture errors, skipped/retried checks, incomplete output and
+timeouts produce UNKNOWN. Review examines the checks themselves and every fallback.
+`task revise`, `task replan` and `task pin-finding` preserve goal and evidence history;
+`task status` and `doctor` distinguish mechanical coverage from review-only coverage.
+
+On macOS, a trusted clean main checkout can start an isolated native goal run:
+
+```sh
+agent-ops run "Implement the requested behavior" --host codex --time-budget 60m --jobs 2
+agent-ops run status <run-id>
+agent-ops run logs <run-id>
+agent-ops run respond <run-id> --question-id <id> --answer "Clarification"
+agent-ops run stop <run-id>
+agent-ops run resume <run-id>
+```
+
+`--host claude` uses Claude Code; `--wait` waits for a terminal or input state.
+The coordinator counts toward the two writer slots. Native processes write only
+under current leases in separate worktrees. Active time counts once across parallel
+workers and continues through proof and integration; resume retains earlier usage
+epochs. Missing token or cost counters remain unknown. Completion requires current
+verification, two fresh reviews, completed tasks and a receipt bound to the target.
+Setup runs in the background under registered process groups. Stop cancels native
+writers, local verification and setup; interrupted setup requires explicit resume.
+The coordinator can assess additional non-dangerous fixed commands through a
+policy request. This authorization is bound to the run, runtime, lease and budget;
+it creates no permanent repository trust. Policy transitions fence writers and
+journal delivery imports and contract synchronization before starting new leases.
+Native authorization decisions retain redacted command scope and rationale;
+missing provider decisions remain unknown. Repair compares actual check outcomes
+and outstanding finding pins rather than source fingerprints.
+
+Native lifecycle reachability and framework probe conditions are recorded in
+[the capability probe](docs/harness/native-goal-probe.md); these observations do not
+establish external adoption or a reduction in review cost.
+
 ## Quick start from npm
 
 Requires Node.js `>=22.14.0`. Install the published CLI globally:

package/dist/packages/cli/src/args.js

@@ -11,7 +11,8 @@ export const COMMAND_NAMES = [
     "review",
     "batch",
     "allow-stop",
-    "worktree"
+    "worktree",
+    "run"
 ];
 const COMMAND_SET = new Set(COMMAND_NAMES);
 const SCOPES = new Set(["project", "user"]);
@@ -61,6 +62,8 @@ function parseHookTarget(option, value) {
     return { harness: harness, surfaceId };
 }
 export function parseArgs(argv) {
+    if (argv[0] === "run")
+        return parseRunArgs(argv.slice(1));
     let command;
     let action;
     let scope;
@@ -78,6 +81,14 @@ export function parseArgs(argv) {
     const profiles = [];
     const reviewTargets = [];
     const criteria = [];
+    const criterionFiles = [];
+    let criteriaFile;
+    let planFile;
+    let expectedContract;
+    let expectedTreeContract;
+    let reason;
+    let baseline;
+    let findingReference;
     const evidence = [];
     let checkAuth = false;
     const checkAuthTargets = [];
@@ -202,6 +213,39 @@ export function parseArgs(argv) {
                 tree = true;
                 break;
             }
+            case "--criterion-file":
+                criterionFiles.push(readOptionValue(argv, index++, token));
+                break;
+            case "--criteria-file":
+                if (criteriaFile !== undefined)
+                    duplicate(token);
+                criteriaFile = readOptionValue(argv, index++, token);
+                break;
+            case "--plan-file":
+                if (planFile !== undefined)
+                    duplicate(token);
+                planFile = readOptionValue(argv, index++, token);
+                break;
+            case "--expected-contract":
+                if (expectedContract !== undefined)
+                    duplicate(token);
+                expectedContract = readOptionValue(argv, index++, token);
+                break;
+            case "--expected-tree-contract":
+                if (expectedTreeContract !== undefined)
+                    duplicate(token);
+                expectedTreeContract = readOptionValue(argv, index++, token);
+                break;
+            case "--reason":
+                if (reason !== undefined)
+                    duplicate(token);
+                reason = readOptionValue(argv, index++, token);
+                break;
+            case "--baseline":
+                if (baseline !== undefined)
+                    duplicate(token);
+                baseline = readOptionValue(argv, index++, token);
+                break;
             case "--criterion": {
                 criteria.push(readOptionValue(argv, index, token));
                 index += 1;
@@ -386,7 +430,7 @@ export function parseArgs(argv) {
                         "complete",
                         "create",
                         "export",
-                        "status"
+                        "status", "revise", "replan", "pin-finding"
                     ].includes(token)) {
                     action = token;
                     break;
@@ -409,6 +453,14 @@ export function parseArgs(argv) {
                     worktreeName = token;
                     break;
                 }
+                if (command === "task" && ["revise", "replan", "pin-finding"].includes(action ?? "") && taskId === undefined) {
+                    taskId = token;
+                    break;
+                }
+                if (command === "task" && action === "pin-finding" && findingReference === undefined) {
+                    findingReference = token;
+                    break;
+                }
                 if (command !== undefined) {
                     throw new CliArgumentError("CLI_UNEXPECTED_ARGUMENT", `Unexpected argument: ${token}`);
                 }
@@ -551,6 +603,20 @@ export function parseArgs(argv) {
     if (worktree !== undefined && command !== "init" && command !== "update") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--worktree may be used only with init or update.");
     }
+    const revisionAction = command === "task" && ["revise", "replan", "pin-finding"].includes(action ?? "");
+    if ((criterionFiles.length > 0 && !(command === "task" && (action === "create" || action === "pin-finding"))) ||
+        (criteriaFile !== undefined && !(command === "task" && action === "revise")) ||
+        (planFile !== undefined && !(command === "task" && action === "replan")) ||
+        (expectedContract !== undefined && !(command === "task" && (action === "revise" || action === "pin-finding"))) ||
+        (expectedTreeContract !== undefined && !(command === "task" && action === "replan")) ||
+        (reason !== undefined && !revisionAction) ||
+        (baseline !== undefined && !(command === "task" && (action === "create" || action === "revise"))))
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Acceptance options are not supported by this command.");
+    if (revisionAction && (taskId === undefined || evidence.length > 0 || title !== undefined || intent !== undefined || parentTaskId !== undefined || sessionId !== undefined || criteria.length > 0 || base !== undefined ||
+        (action === "revise" && (expectedContract === undefined || criteriaFile === undefined || reason === undefined)) ||
+        (action === "replan" && (expectedTreeContract === undefined || planFile === undefined || reason === undefined)) ||
+        (action === "pin-finding" && (expectedContract === undefined || findingReference === undefined || criterionFiles.length !== 1))))
+        throw new CliArgumentError("CLI_MISSING_VALUE", "Acceptance revision requires task, expected contract, payload and reason.");
     if (command === "task") {
         if (harness !== undefined ||
             profiles.length > 0 ||
@@ -711,6 +777,14 @@ export function parseArgs(argv) {
         ...(reviewTargets.length === 0 ? {} : { reviewTargets }),
         ...(completionGate === undefined ? {} : { completionGate }),
         ...(criteria.length === 0 ? {} : { criteria }),
+        ...(criterionFiles.length === 0 ? {} : { criterionFiles }),
+        ...(criteriaFile === undefined ? {} : { criteriaFile }),
+        ...(planFile === undefined ? {} : { planFile }),
+        ...(expectedContract === undefined ? {} : { expectedContract }),
+        ...(expectedTreeContract === undefined ? {} : { expectedTreeContract }),
+        ...(reason === undefined ? {} : { reason }),
+        ...(baseline === undefined ? {} : { baseline }),
+        ...(findingReference === undefined ? {} : { findingReference }),
         ...(evidence.length === 0 ? {} : { evidence }),
         ...(sessionId === undefined ? {} : { sessionId }),
         ...(base === undefined ? {} : { base }),
@@ -730,3 +804,92 @@ export function parseArgs(argv) {
         ...(worktree === undefined ? {} : { worktree })
     };
 }
+function parseRunArgs(argv) {
+    const actions = ["start", "status", "logs", "resume", "stop", "respond"];
+    if (argv.includes("--help") || argv.includes("-h"))
+        return { command: "help", helpTopic: "run", profiles: [], dryRun: false, json: false, yes: false, rerun: false };
+    const action = actions.includes(argv[0]) ? argv[0] : "start";
+    const args = { command: "run", action, runAction: action, profiles: [], dryRun: false, json: false, yes: false, rerun: false };
+    const seen = new Set();
+    let positional;
+    for (let i = actions.includes(argv[0]) ? 1 : 0; i < argv.length; i++) {
+        const token = argv[i];
+        if (!token.startsWith("-")) {
+            if (positional !== undefined)
+                throw new CliArgumentError("CLI_UNEXPECTED_ARGUMENT", "Quote the goal as one argument; control actions take one run ID.");
+            positional = token;
+            continue;
+        }
+        if (seen.has(token))
+            duplicate(token);
+        seen.add(token);
+        if (token === "--json") {
+            args.json = true;
+            continue;
+        }
+        if (token === "--wait") {
+            args.wait = true;
+            continue;
+        }
+        if (!["--host", "--goal-file", "--time-budget", "--jobs", "--question-id", "--answer", "--answer-file"].includes(token))
+            throw new CliArgumentError("CLI_UNKNOWN_OPTION", `Unknown run option: ${token}`, token);
+        const value = readOptionValue(argv, i++, token);
+        switch (token) {
+            case "--host":
+                if (value !== "claude" && value !== "codex")
+                    invalidValue(token, value);
+                args.host = value;
+                break;
+            case "--goal-file":
+                args.goalFile = value;
+                break;
+            case "--question-id":
+                args.questionId = value;
+                break;
+            case "--answer":
+                args.answer = value;
+                break;
+            case "--answer-file":
+                args.answerFile = value;
+                break;
+            case "--jobs":
+                if (value !== "1" && value !== "2")
+                    invalidValue(token, value);
+                args.jobs = Number(value);
+                break;
+            case "--time-budget": {
+                const match = value.match(/^([1-9][0-9]*)(s|m|h)$/u);
+                if (match === null)
+                    invalidValue(token, value);
+                const ms = Number(match[1]) * ({ s: 1000, m: 60000, h: 3600000 }[match[2]]);
+                if (!Number.isSafeInteger(ms) || ms > 86400000)
+                    invalidValue(token, value);
+                args.timeBudgetMs = ms;
+                break;
+            }
+        }
+    }
+    if (action === "start") {
+        args.goal = positional;
+        if ((args.goal === undefined) === (args.goalFile === undefined))
+            throw new CliArgumentError("RUN_GOAL_REQUIRED", "Provide exactly one quoted goal or --goal-file.");
+        if (args.host === undefined)
+            throw new CliArgumentError("RUN_HOST_REQUIRED", "Choose --host claude or --host codex.");
+        if (args.questionId !== undefined || args.answer !== undefined || args.answerFile !== undefined)
+            throw new CliArgumentError("CLI_INVALID_OPTION", "Answer options require run respond.");
+    }
+    else {
+        if (positional === undefined || !/^[a-z][a-z0-9-]{7,63}$/u.test(positional))
+            throw new CliArgumentError("RUN_ID_REQUIRED", "Control actions require a valid run ID.");
+        args.runId = positional;
+        if (args.host !== undefined || args.goalFile !== undefined || args.jobs !== undefined || args.timeBudgetMs !== undefined || args.wait)
+            throw new CliArgumentError("CLI_INVALID_OPTION", "Start options are not accepted by run control actions.");
+        if (action === "respond") {
+            if (args.questionId === undefined || (args.answer === undefined) === (args.answerFile === undefined))
+                throw new CliArgumentError("RUN_ANSWER_REQUIRED", "Respond requires --question-id and exactly one --answer or --answer-file.");
+        }
+        else if (args.questionId !== undefined || args.answer !== undefined || args.answerFile !== undefined)
+            throw new CliArgumentError("CLI_INVALID_OPTION", "Answer options require run respond.");
+    }
+    return args;
+}

package/dist/packages/cli/src/bin.js

@@ -1,4 +1,9 @@
 #!/usr/bin/env node
+import { productionRunContext } from "./run-deps.js";
+import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
+import { recordRunVerification } from "../../../runtime/src/run/verification.js";
+import { runOwnedLocalProof } from "./owned-run-step.js";
+import { runRunCommand } from "./commands/run.js";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
@@ -17,10 +22,10 @@ import { calculateConfigHash } from "../../../runtime/src/config/hash.js";
 import { FileEvidenceStore } from "../../../runtime/src/verify/evidence.js";
 import { calculateSourceFingerprint } from "../../../runtime/src/verify/source-fingerprint.js";
 import { VerificationService } from "../../../runtime/src/verify/service.js";
-import { NodeVerificationProcessRunner } from "../../../runtime/src/verify/spawn.js";
+import { registeredRunProofRunner } from "../../../runtime/src/verify/spawn.js";
 import { COMMAND_NAMES, parseArgs } from "./args.js";
 import { runCli } from "./cli.js";
-import { loadEffectiveConfig, repositoryTrust, repositoryTrustBinding } from "./context.js";
+import { loadEffectiveConfig, runPolicyContext, repositoryTrust, repositoryTrustBinding } from "./context.js";
 import { runHookProcess } from "./hook-process.js";
 import { gitRunner, trustStore, worktreeDependencies } from "./parallel-deps.js";
 import { selectYesNo, writeBanner } from "./ui.js";
@@ -165,7 +170,22 @@ function runAgy(args, options = {}) {
         ...(process.platform === "win32" ? { shell: true } : {})
     });
 }
-if (argv[0] === "agy-run") {
+let ownedProofExit = null;
+try {
+    ownedProofExit = await runOwnedLocalProof(argv);
+}
+catch (cause) {
+    const code = cause instanceof AgentOpsError ? cause.code : "RUN_LOCAL_PROOF_FAILED";
+    const message = cause instanceof AgentOpsError ? cause.message : "Local proof could not be registered safely.";
+    if (argv.includes("--json"))
+        process.stdout.write(JSON.stringify(errorEnvelope(code, message)) + "\n");
+    else
+        process.stderr.write(message + "\n");
+    ownedProofExit = 2;
+}
+if (ownedProofExit !== null)
+    process.exitCode = ownedProofExit;
+else if (argv[0] === "agy-run") {
     try {
         const root = process.cwd();
         const config = (await loadEffectiveConfig(root, "project")).config;
@@ -224,6 +244,13 @@ else {
                 const isTTY = !args.json &&
                     process.stdin.isTTY === true &&
                     process.stdout.isTTY === true;
+                if ((["init", "update"].includes(args.command) || (args.command === "trust" && args.action !== "status")) &&
+                    (process.env.AGENT_OPS_RUN_ID !== undefined || await runPolicyContext(process.cwd()) !== null))
+                    throw new AgentOpsError("RUN_POLICY_COORDINATOR_REQUIRED", "Run workers must request scoped policy review from the coordinator; permanent trust and host rules cannot be changed by the run.");
+                if (args.command === "run") {
+                    const context = await productionRunContext(root);
+                    return await runRunCommand({ args, ...context, root: context.mainRoot });
+                }
                 if (args.command === "init") {
                     const store = trustStore();
                     return await runInitCommand({
@@ -267,6 +294,17 @@ else {
                         root,
                         toolkitVersion: CLI_VERSION,
                         probes: {
+                            acceptanceCoverage: async () => {
+                                const service = new TaskService(new FileTaskStore(join(root, ".agent-ops/tasks/state.json"), root), { completion: { root, gitRunner: gitRunner(root), loadConfig: async () => config } });
+                                const records = (await service.list()).filter(r => r.status !== "archived");
+                                const rows = await Promise.all(records.map(r => service.coverage(r.task.id)));
+                                const criteria = rows.flatMap(row => row.rows);
+                                const mechanical = criteria.filter(c => c.mode === "behavioral" || c.mode === "invariant");
+                                return { status: "PASS", message: criteria.length + " criteria; " +
+                                        criteria.filter(c => c.mode === "legacy").length + " legacy; " + mechanical.filter(c => c.status === "proven").length + "/" + mechanical.length +
+                                        " mechanical proven; " + criteria.filter(c => c.mode === "review-only").length + " review-only; originally mechanical " + rows.reduce((n, r) => n + r.originalMechanical, 0) +
+                                        "; undischarged " + rows.reduce((n, r) => n + r.rows.filter(c => c.status !== "proven" && !r.reviewed).length, 0) };
+                            },
                             ...(doctorManifest?.harness.includes("agy") === true
                                 ? {
                                     agyRuntime: () => {
@@ -441,7 +479,8 @@ else {
                                     return {
                                         path: record.path,
                                         base: record.base,
-                                        service: new TaskService(new FileTaskStore(join(record.path, ".agent-ops", "tasks", "state.json"), record.path))
+                                        service: new TaskService(new FileTaskStore(join(record.path, ".agent-ops", "tasks", "state.json"), record.path), { completion: { root: record.path, gitRunner: gitRunner(record.path),
+                                                loadConfig: async () => (await loadEffectiveConfig(record.path, "project")).config } })
                                     };
                                 }
                             }
@@ -501,6 +540,7 @@ else {
                         config: reviewConfig,
                         evidenceStore: new FileEvidenceStore(root, root),
                         execute: inSlot(createReviewExecutor({
+                            runner: registeredRunProofRunner(),
                             targets: configuredReviewTargets,
                             cwd: root,
                             ...(reviewRole?.model === undefined
@@ -513,10 +553,11 @@ else {
                                 ? {}
                                 : { timeoutMs: reviewRole.timeoutMs }),
                             preflightTarget,
-                            verifySourceFingerprint: async (expected) => {
+                            verifySourceFingerprint: async (expected, scope) => {
                                 const currentScope = await resolveReviewScope({
                                     root,
                                     runner: reviewGit,
+                                    ...(scope?.mode === "base" && scope.noChange === true ? { noChangePaths: scope.changedFiles } : {}),
                                     ...(reviewArgs.base === undefined ? {} : { base: reviewArgs.base })
                                 });
                                 return await calculateSourceFingerprint(root, currentScope, reviewGit) === expected;
@@ -589,7 +630,7 @@ else {
                                     scope: batchScope,
                                     config: batchConfig,
                                     gitRunner: batchGit,
-                                    processRunner: new NodeVerificationProcessRunner(),
+                                    processRunner: registeredRunProofRunner(),
                                     taskService,
                                     evidenceStore: new FileEvidenceStore(root, root),
                                     trusted,
@@ -633,17 +674,23 @@ else {
                     return await runVerifyCommand({
                         args,
                         taskService,
-                        service: new VerificationService({
-                            root,
-                            scope: args.scope === "user" ? "user" : "project",
-                            config,
-                            gitRunner: gitRunner(root),
-                            processRunner: new NodeVerificationProcessRunner(),
-                            taskService,
-                            evidenceStore: new FileEvidenceStore(root, root),
-                            trusted: trustStatus === "TRUSTED",
-                            ...(args.base === undefined ? {} : { base: args.base })
-                        })
+                        service: { verify: async (taskId) => {
+                                const run = await runPolicyContext(root);
+                                const report = await new VerificationService({
+                                    root,
+                                    scope: args.scope === "user" ? "user" : "project",
+                                    config,
+                                    gitRunner: gitRunner(root),
+                                    processRunner: registeredRunProofRunner(),
+                                    taskService,
+                                    evidenceStore: new FileEvidenceStore(root, root),
+                                    trusted: trustStatus === "TRUSTED",
+                                    ...(args.base === undefined ? {} : { base: args.base })
+                                }).verify(taskId);
+                                if (run !== null)
+                                    await recordRunVerification(run.repository, run.state, run.worker?.workerId ?? run.state.coordinatorId, await taskService.status({ taskId }), report);
+                                return report;
+                            } }
                     });
                 }
                 if (args.command === "trust") {

package/dist/packages/cli/src/cli.js

@@ -25,10 +25,11 @@ Commands:
   doctor     Diagnose an installation
   update     Update managed artifacts
   uninstall  Remove managed artifacts
-  task <create|status|attach|complete|archive|export>
+  task <create|status|attach|revise|replan|pin-finding|advance|complete|archive|export>
              Manage independent task acceptance state
   verify     Run configured verification
   review     Run an independent review or show recorded reports
+  run        Start or control a supervised Claude/Codex native goal
   batch      Verify and review a parent task's subtasks together
   allow-stop Grant one fingerprint-bound completion-gate Stop permit (requires --session)
   agy-run    Run headless agy with a process-exit completion recheck
@@ -71,6 +72,14 @@ Options:
  * rejected.
  */
 export const COMMAND_HELP_TEXT = {
+    run: `Usage: agent-ops run [start] "<goal>" --host <claude|codex> [--jobs <1|2>] [--time-budget <60m>] [--wait] [--json]
+       agent-ops run [start] --goal-file <path> --host <claude|codex>
+       agent-ops run <status|logs|resume|stop> <run-id> [--json]
+       agent-ops run respond <run-id> --question-id <id> <--answer <text>|--answer-file <path>> [--json]
+
+Native goal state is observational. Completion requires current verification,
+two fresh reviews, task completion and a target-bound integration receipt.
+`,
     init: `Usage: agent-ops init [options]
 
 Plan or install agent-ops into this repository.
@@ -141,7 +150,7 @@ Options:
   --json
   --yes
 `,
-    task: `Usage: agent-ops task <create|status|attach|complete|archive|export|advance> [options]
+    task: `Usage: agent-ops task <create|status|attach|revise|replan|pin-finding|advance|complete|archive|export> [options]
 
 Manage independent task acceptance state. Task commands accept none of
 --harness, --profile or --dry-run. Only advance accepts --yes.
@@ -150,20 +159,38 @@ Options:
   --title <text>                        create
   --intent <text>                       create: intended behavior and constraints before editing
   --criterion <json>                    create, repeatable, two to five total
+  --criterion-file <path>               create: one criterion object, repeatable; pin-finding: exactly one
+  --criteria-file <path>                revise: replacement criterion array
+  --plan-file <path>                    replan: split-task array with requirement mappings
+  --expected-contract <hash>            revise, pin-finding: current task contract from status
+  --expected-tree-contract <hash>       replan: current tree contract from status
+  --reason <text>                       required for revise/replan; optional for pin-finding
+  --baseline <git-ref>                  create/revise: baseline for new mechanical requirements
   --parent <task-id>                    create: record a subtask; status: list subtasks
-  --task <id>                           status, attach, complete, archive, export, advance
+  --task <id>                           status, attach, revise, replan, pin-finding, complete, archive, export, advance
   --session <id>                        create, attach, status, advance
   --evidence <criterion-id=reference>   complete, repeatable
   --base <git-ref>                      complete: a clean committed range
   --yes                                 advance: authorize the two review sessions
   --json
 
-Each --criterion is one JSON object with exactly these keys:
+Each --criterion or --criterion-file supplies one criterion object. Legacy example:
 
   {"id":"kebab-id","description":"what must hold","verifierIds":["node-test"]}
 
-Every criterion needs at least one verifierIds entry naming a verification
-command id configured in .agent-ops/config.json. No other key is accepted.
+Each legacy criterion needs at least one verifierIds entry naming a verification
+command id configured in .agent-ops/config.json. Typed criteria additionally
+accept an acceptance object: mode (behavioral, invariant or review-only),
+bindings and optional baselineCommit/reviewOnlyReason. Mechanical bindings name
+configured acceptance runner IDs, checkIds, committed materials and optional
+redCheckIds; tasks cannot supply commands. Creation freezes the baseline.
+Review-only example (mandatory repository policy commands still run):
+
+  {"id":"judgment","description":"Meets the original goal","verifierIds":[],"acceptance":{"mode":"review-only","bindings":[],"reviewOnlyReason":"Requires independent judgment"}}
+
+Pin a saved finding with task pin-finding --task <id> <report-digest:index>
+--expected-contract <hash> --criterion-file <path>. Revise/replan preserve the
+original goal and immutable existing baselines; obtain new verify and review.
 `,
     verify: `Usage: agent-ops verify [options]
 

package/dist/packages/cli/src/commands/advance.js

@@ -9,6 +9,7 @@ import { renderReviewDetails, renderReviewHighlights } from "../../../../runtime
 import { calculateSourceFingerprint } from "../../../../runtime/src/verify/source-fingerprint.js";
 import { okEnvelope } from "../output.js";
 import { readFinishedReview } from "./review-show.js";
+import { prepareRunIntegration, readRunIntegrationProof, abandonPreparedRunIntegration } from "../../../../runtime/src/run/integration.js";
 /** The child process runs the existing CLI in the candidate checkout. */
 export async function runAdvanceStep(cwd, args) {
     const bin = process.argv[1];
@@ -87,6 +88,13 @@ export async function runAdvanceCommand(options) {
     if (record === null || record.sessionId !== options.sessionId || record.agentId !== undefined) {
         throw new AgentOpsError("ADVANCE_WORKTREE_MISSING", `No coordinator worktree for session ${options.sessionId}.`);
     }
+    const savedProof = await readRunIntegrationProof(commonDir, record);
+    if (savedProof !== null && await git(deps, mainRoot, ["rev-parse", `${record.targetBranch}^{commit}`]) === savedProof.head) {
+        const finished = await finishWorktree(deps, { cwd: mainRoot, name, finalProof: { ...savedProof, recovery: true } });
+        return okEnvelope("TASK_ADVANCED", { ...finished, text: "Recovered the sealed integration without moving the target again." });
+    }
+    if (savedProof !== null && await git(deps, mainRoot, ["rev-parse", `${record.targetBranch}^{commit}`]) !== savedProof.target)
+        await abandonPreparedRunIntegration(commonDir, record, deps.git);
     const parent = await deps.tasks(record.path).status({ taskId: options.parentTaskId });
     if (parent.status !== "active" || parent.task.parentTaskId !== undefined) {
         throw new AgentOpsError("ADVANCE_PARENT_INVALID", "Advance requires an active root task in the coordinator worktree.");
@@ -120,16 +128,26 @@ export async function runAdvanceCommand(options) {
             throw new AgentOpsError("ADVANCE_TASK_TREE_INVALID", "The candidate has unrelated or already completed tasks; final proof must cover one active tree.");
         }
         const ordered = all.filter(({ task }) => selected.has(task.id));
+        const noChangePaths = head === target ? parent.noChangePaths : undefined;
+        if (noChangePaths !== undefined)
+            for (const task of ordered)
+                await deps.tasks(record.path).recordEvidence(task.task.id, {}, undefined, noChangePaths);
         for (const task of ordered) {
             requirePass(await step(record.path, ["verify", "--task", task.task.id, "--base", target]), `Verify ${task.task.id}`);
         }
         const reviewMode = await reviewFinalTree(step, record.path, parent.task.id, ordered.map(({ task }) => task.id), target);
-        const scope = await resolveReviewScope({ root: record.path, runner: runner(deps, record.path), base: target });
+        const scope = await resolveReviewScope({ root: record.path, runner: runner(deps, record.path), base: target,
+            ...(noChangePaths === undefined ? {} : { noChangePaths }) });
         const sourceFingerprint = await calculateSourceFingerprint(record.path, scope, runner(deps, record.path));
+        const finalProof = { target, head, sourceFingerprint, children,
+            ...(noChangePaths === undefined ? {} : { noChange: { sourceCommit: head,
+                    contractDigest: await deps.tasks(record.path).treeContract(parent.task.id), reviewScope: scope,
+                    artifactRefs: Object.values((await deps.tasks(record.path).status({ taskId: parent.task.id })).evidence).flat() } }) };
+        await prepareRunIntegration(commonDir, record, finalProof);
         try {
             const finished = await finishWorktree(deps, {
                 cwd: mainRoot, name,
-                finalProof: { target, head, sourceFingerprint, children }
+                finalProof
             });
             if (finished.receipt === undefined)
                 throw new AgentOpsError("WORKTREE_RECEIPT_MISSING", "Finish returned without a final review receipt.");
@@ -144,8 +162,10 @@ export async function runAdvanceCommand(options) {
             });
         }
         catch (failure) {
-            if (failure instanceof AgentOpsError && failure.code === "WORKTREE_TARGET_MOVED" && attempt === 0)
+            if (failure instanceof AgentOpsError && failure.code === "WORKTREE_TARGET_MOVED" && attempt === 0) {
+                await abandonPreparedRunIntegration(commonDir, record, deps.git);
                 continue;
+            }
             throw failure;
         }
     }

package/dist/packages/cli/src/commands/review-show.js

@@ -18,7 +18,7 @@ function checkedArtifact(value, fingerprint, taskId) {
     if (typeof value !== "object" || value === null)
         invalid("Review artifact is unreadable.");
     const artifact = value;
-    if (artifact.schemaVersion !== 1 || artifact.sourceFingerprint !== fingerprint ||
+    if (![1, 2].includes(artifact.schemaVersion) || artifact.sourceFingerprint !== fingerprint ||
         artifact.taskId !== taskId || !["PASS", "FAIL", "NOT_RUN"].includes(artifact.status) ||
         !Array.isArray(artifact.attempts) ||
         (artifact.report !== undefined && !validReport(artifact.report, artifact)) ||