@kylecheng3146/agent-ops 0.9.0 → 0.10.2

package/dist/runtime/src/task/debug-user-event.js

@@ -1,10 +1,13 @@
-import { lstat, readFile, readdir, realpath } from "node:fs/promises";
+import { constants } from "node:fs";
+import { lstat, open, readdir, realpath } from "node:fs/promises";
 import { homedir } from "node:os";
 import { isAbsolute, join, relative, sep } from "node:path";
 import { sha256 } from "../fs/hash.js";
 import { AgentOpsError } from "../fs/paths.js";
 export function debugUserControl(text) {
     const value = text.trim();
+    if (/^(?:不要給預算時間(?:\s+直接完整驗證與review)?|取消時間限制|no time limit)[。.!！]?$/iu.test(value))
+        return "unlimited";
     if (/^(?:暫停|暂停|先暫停|先暂停|停止|stop|pause)[。.!！]?$/iu.test(value))
         return "pause";
     if (/^(?:先)?只診斷(?:，等我補失敗時證據)?[。.!！]?$/u.test(value) || /^(?:先)?只诊断[。.!！]?$/u.test(value) || /^diagnos(?:e|is)[ -]only[.!]?$/iu.test(value))
@@ -37,6 +40,57 @@ function codexUserText(row) {
     catch { /* An ambiguous reply cannot authorize a control change. */ }
     return undefined;
 }
+/** Bound each row, not the transcript: assistant/tool output must not hide later human input. */
+async function* nativeLines(path) {
+    const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        if (!(await file.stat()).isFile())
+            return;
+        let pending = Buffer.alloc(0), oversized = false, index = 0;
+        const started = Date.now();
+        for await (const chunk of file.createReadStream({ autoClose: false })) {
+            if (Date.now() - started > 10_000)
+                throw new Error("Native transcript read timed out");
+            const bytes = chunk;
+            let start = 0;
+            while (start < bytes.length) {
+                const end = bytes.indexOf(10, start), stop = end < 0 ? bytes.length : end;
+                if (!oversized) {
+                    if (pending.length + stop - start > 1024 * 1024) {
+                        pending = Buffer.alloc(0);
+                        oversized = true;
+                    }
+                    else
+                        pending = Buffer.concat([pending, bytes.subarray(start, stop)]);
+                }
+                if (end < 0)
+                    break;
+                if (!oversized)
+                    yield { line: pending.toString("utf8"), index };
+                index++;
+                pending = Buffer.alloc(0);
+                oversized = false;
+                start = end + 1;
+            }
+        }
+        if (!oversized && pending.length > 0)
+            yield { line: pending.toString("utf8"), index };
+    }
+    finally {
+        await file.close();
+    }
+}
+async function ownedNativeSession(root, worktreeRoot, sessionId) {
+    if (process.env.CODEX_THREAD_ID !== sessionId || worktreeRoot === undefined)
+        return false;
+    const { readWorktreeRecord } = await import("../parallel/service.js");
+    const record = await readWorktreeRecord(worktreeRoot);
+    if (record === null || record.sessionId !== sessionId || record.agentId !== undefined || record.runId !== undefined)
+        return false;
+    const [main, worktree, recordMain, recordPath] = await Promise.all([root, worktreeRoot, record.mainRoot, record.path].map(path => realpath(path)));
+    const inside = relative(join(main, ".worktrees"), worktree);
+    return main === recordMain && worktree === recordPath && inside.length > 0 && !inside.startsWith("..") && !isAbsolute(inside);
+}
 /** Host transcripts are the user-event authority; CLI actor/text fields are never accepted. */
 /** `worktreeRoot` is the session's owned worktree: Claude stamps each row with the shell's cwd, which moves there after `cd`. */
 export async function readDebugUserEvent(root, sessionId, home = homedir(), kind = "latest", worktreeRoot) {
@@ -59,35 +113,46 @@ export async function readDebugUserEvent(root, sessionId, home = homedir(), kind
         catch { /* The host need not be installed. */ }
     }
     await visit(codex, 3);
+    const owned = await ownedNativeSession(root, worktreeRoot, sessionId).catch(() => false);
     for (const path of paths) {
         try {
             const stat = await lstat(path), canonical = await realpath(path);
             const fromHome = relative(canonicalHome, canonical);
-            if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 16 * 1024 * 1024 || fromHome.startsWith("..") || isAbsolute(fromHome))
-                continue;
-            const lines = (await readFile(path, "utf8")).split("\n");
-            const rows = lines.map(line => { try {
-                return JSON.parse(line);
-            }
-            catch {
-                return null;
-            } });
             const codexSource = path.startsWith(codex + sep);
-            if (codexSource && !rows.some(row => row?.type === "session_meta" && row.payload?.id === sessionId && row.payload?.cwd === root))
+            if (!stat.isFile() || stat.isSymbolicLink() || (!codexSource && stat.size > 16 * 1024 * 1024) || fromHome.startsWith("..") || isAbsolute(fromHome))
                 continue;
-            for (let index = rows.length - 1; index >= 0; index--) {
-                const row = rows[index];
+            let matchedSession = false, event;
+            for await (const { line, index } of nativeLines(path)) {
+                let row;
+                try {
+                    row = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (codexSource && row?.type === "session_meta") {
+                    if (row.payload?.id !== sessionId || (row.payload?.cwd !== root && !owned)) {
+                        event = undefined;
+                        matchedSession = false;
+                        break;
+                    }
+                    matchedSession = true;
+                }
                 const text = codexSource ? codexUserText(row) :
                     row?.type === "user" && row.sessionId === sessionId && (row.cwd === root || (worktreeRoot !== undefined && row.cwd === worktreeRoot)) && row.message?.role === "user" &&
                         row.isMeta !== true && (row.origin === undefined || row.origin?.kind === "human") ? row.message.content : undefined;
                 if (typeof text !== "string" || text.length > 64 * 1024 || (kind === "control" && debugUserControl(text) === null))
                     continue;
                 const timestamp = Date.parse(row.timestamp);
-                if (!Number.isFinite(timestamp))
-                    break;
-                const sourceDigest = sha256(lines[index]);
-                return { id: sha256(relative(home, path) + ":" + index + ":" + sourceDigest), sourceDigest, text, timestamp };
+                if (!Number.isFinite(timestamp)) {
+                    event = undefined;
+                    continue;
+                }
+                const sourceDigest = sha256(line);
+                event = { id: sha256(relative(home, path) + ":" + index + ":" + sourceDigest), sourceDigest, text, timestamp };
             }
+            if (event !== undefined && (!codexSource || matchedSession))
+                return event;
         }
         catch { /* An unavailable native source cannot grant time. */ }
     }

package/dist/runtime/src/task/debug.js

@@ -14,13 +14,14 @@ import { resolveReviewScope } from "../review/scope.js";
 import { runVerificationCommand } from "../verify/spawn.js";
 import { checkTaskVerificationEvidence } from "./completion.js";
 import { taskContractHash, criterionContractHash } from "./contract.js";
-import { DEBUG_EXTENSION_MS, debugProofDigest, debugRemainingMs, debugRounds, debugStopCause } from "./debug-state.js";
+import { DEBUG_EXTENSION_MS, debugSpentMs, debugProofDigest, debugRemainingMs, debugRounds, debugStopCause } from "./debug-state.js";
 import { FileTaskStore } from "./store.js";
 import { debugUserControl, readDebugUserEvent } from "./debug-user-event.js";
 import { readWorktreeRecord } from "../parallel/service.js";
 import { evaluateGuardrail } from "../guardrails/evaluate.js";
 import { sameDebugText } from "./debug-intake.js";
 import { nativeProcessIdentity } from "../run/transport.js";
+import { declareEscape, LEDGER_DIRECTORY, removeEscapeRecord, resolveOrigin } from "../escape/link.js";
 function fail(code, message) { throw new AgentOpsError(code, message); }
 const bounded = (v) => typeof v === "string" && v.trim().length > 0 && v.length <= 4096 && !v.includes("\0");
 const session = (v) => bounded(v) && v.length <= 256;
@@ -93,7 +94,8 @@ export class DebugService {
         const records = await this.options.tasks.list();
         const materials = new Set(records.flatMap(r => r.task.criteria.flatMap(c => c.acceptance?.bindings.flatMap(b => b.materials.map(m => m.path)) ?? [])));
         const paths = new Set([...await collectBaseChangePaths(this.options.gitRunner, state.baselineCommit), ...(await collectChangeSurface(this.options.gitRunner)).paths]);
-        const product = [...paths].filter(path => !materials.has(path) && !/(?:^|\/)(?:tests?|fixtures)(?:\/|$)|(?:\.test|\.spec)\./u.test(path)).sort();
+        // The escape ledger is data about the fix, not a repair candidate.
+        const product = [...paths].filter(path => !materials.has(path) && !path.startsWith(LEDGER_DIRECTORY + "/") && !/(?:^|\/)(?:tests?|fixtures)(?:\/|$)|(?:\.test|\.spec)\./u.test(path)).sort();
         const entries = [];
         for (const path of product) {
             try {
@@ -142,7 +144,13 @@ export class DebugService {
         await this.#mutate(root, next);
         return await this.root(root.task.id);
     }
-    async #evidence(taskId, reference) {
+    /**
+     * `sealed` admits a strategy switch's citation of this issue's own sealed
+     * regression history: a scope revision stales every current reference while
+     * verification stays stopped until the switch is recorded. Hypotheses and
+     * delivery still need evidence for the current contract and candidate.
+     */
+    async #evidence(taskId, reference, sealed = false) {
         const { task, config, sourceFingerprint } = await this.#scope(taskId);
         const store = new FileEvidenceStore(this.options.root, this.options.root);
         const checked = validateEvidence(await store.load(reference));
@@ -152,9 +160,16 @@ export class DebugService {
         const root = await this.root(taskId);
         const head = await this.options.gitRunner.run(["rev-parse", "HEAD"]);
         const candidate = new TextDecoder().decode(head.stdout).trim();
-        if (head.exitCode !== 0 || e.taskId !== taskId || e.taskContractHash !== taskContractHash(task.task) || e.configHash !== calculateConfigHash(config) ||
-            e.sourceFingerprint !== sourceFingerprint || p === undefined || p.pairedCommit !== (p.phase === "baseline" ? candidate : root.debug.baselineCommit) || p.commit !== (p.phase === "baseline" ? root.debug.baselineCommit : candidate) ||
-            !task.task.criteria.some(c => c.id === e.criterionId && p.criterionContractHash === criterionContractHash(c) && c.acceptance?.bindings.some(b => b.runnerId === e.commandId && sha256(canonicalJson({ runnerId: b.runnerId, materials: b.materials })) === p.bindingHash) && c.acceptance?.mode === "behavioral" && c.acceptance.baselineCommit === root.debug.baselineCommit))
+        const current = p !== undefined && e.taskContractHash === taskContractHash(task.task) && e.configHash === calculateConfigHash(config) &&
+            e.sourceFingerprint === sourceFingerprint && p.pairedCommit === (p.phase === "baseline" ? candidate : root.debug.baselineCommit) &&
+            p.commit === (p.phase === "baseline" ? root.debug.baselineCommit : candidate);
+        const historical = sealed && p !== undefined && (p.phase === "baseline" ? p.commit : p.pairedCommit) === root.debug.baselineCommit &&
+            root.debug.receipts.some(r => r.kind === "verify" && r.taskId === taskId && r.references.includes(reference));
+        if (head.exitCode !== 0 || e.taskId !== taskId || p === undefined || !(current || historical) ||
+            !task.task.criteria.some(c => c.id === e.criterionId && c.acceptance?.mode === "behavioral" && c.acceptance.baselineCommit === root.debug.baselineCommit &&
+                (current
+                    ? p.criterionContractHash === criterionContractHash(c) && c.acceptance.bindings.some(b => b.runnerId === e.commandId && sha256(canonicalJson({ runnerId: b.runnerId, materials: b.materials })) === p.bindingHash)
+                    : c.acceptance.bindings.some(b => b.runnerId === e.commandId))))
             return fail("TASK_DEBUG_EVIDENCE_STALE", "Evidence must discriminate the original issue at its immutable baseline and current candidate.");
         const source = await readPrivateFile(join(this.options.root, p.executionArtifact), this.options.root);
         if (source === null || p.executionArtifact !== ".agent-ops/tasks/acceptance/" + sha256(source) + ".json")
@@ -240,9 +255,30 @@ export class DebugService {
             fail("TASK_DEBUG_STRATEGY_INVALID", "Document a substantive different verification method and evidence-backed reason.");
         if (debugStopCause(root.debug) !== "strategy-required" || root.debug.strategy !== null || root.debug.operation !== null)
             fail("TASK_DEBUG_STRATEGY_NOT_ALLOWED", "Exactly one strategy switch is allowed after two stagnant repair rounds.");
-        await this.#evidence(taskId, input.reference);
+        await this.#evidence(taskId, input.reference, true);
         await this.#mutate(root, { ...root.debug, strategy: { from: input.from, to: input.to, reason: input.reason, references: [input.reference], afterRound: debugRounds(root.debug) }, checkpoint: null });
     }
+    /** Escape Loop: where the confirmed cause came from, bound into the contract before review. */
+    async origin(taskId, input) {
+        const root = await this.root(taskId);
+        if (root.task.id !== taskId)
+            fail("ESCAPE_ORIGIN_INVALID", "Declare the origin on the original issue task.");
+        if (root.status !== "active" || root.debug.operation !== null)
+            fail("TASK_DEBUG_BUSY", "Origin needs an active idle issue.");
+        if (debugRemainingMs(root.debug) === 0)
+            fail("TASK_DEBUG_BUDGET_EXHAUSTED", "The original issue's active budget is exhausted.");
+        if (!root.debug.hypotheses.some(h => h.status === "confirmed"))
+            fail("ESCAPE_ORIGIN_EARLY", "Declare the origin only after discriminating evidence confirms a hypothesis.");
+        const origin = await resolveOrigin(this.options.gitRunner, input);
+        const record = await this.options.tasks.revise(taskId, { expectedContractHash: taskContractHash(root.task), origin, debugOrigin: true,
+            reason: `Declare issue origin: ${origin.kind === "escape-of" ? "escape-of " + origin.commit : origin.kind}.` });
+        if (origin.kind !== "escape-of") {
+            await removeEscapeRecord(this.options.root, taskId);
+            return { record };
+        }
+        return { record, escape: await declareEscape({ root: this.options.root, git: this.options.gitRunner, taskId, origin,
+                base: root.debug.baselineCommit, now: new Date().toISOString() }) };
+    }
     async remaining(taskId) { return debugRemainingMs((await this.root(taskId)).debug); }
     async #userEvent(sessionId, home, kind = "latest") {
         const record = await readWorktreeRecord(this.options.root);
@@ -277,9 +313,9 @@ export class DebugService {
         const attached = await this.options.tasks.status({ sessionId });
         if (attached.task.debug?.rootTaskId !== root.task.id || root.status !== "active")
             fail("TASK_DEBUG_CONTROL_INVALID", "Human control must belong to the active attached original issue.");
-        if (action === "resume" && debugRemainingMs(root.debug) === 0) {
+        if (action === "unlimited" || ((action === "resume" || action === "repair") && debugRemainingMs(root.debug) === 0)) {
             try {
-                await this.extend(taskId, sessionId, event.id);
+                await this.extend(taskId, sessionId, event.id, home);
             }
             catch (error) {
                 if (!(error instanceof AgentOpsError) || !["TASK_DEBUG_GRANT_INVALID", "TASK_DEBUG_GRANT_UNSUPPORTED"].includes(error.code))
@@ -351,10 +387,14 @@ export class DebugService {
         // EVIDENCE-SURFACE-001: intake may start without a surface, the first repair may not.
         if (kind === "verify" && task.task.surfaceRequired === true && task.task.surface === undefined && productDigest !== sha256(canonicalJson([])))
             fail("SURFACE_MISSING", "Add the surface audit with task revise --surface-file before verifying the first repair.");
-        const previousCandidate = root.debug.receipts.filter(r => r.kind === "verify" && (r.outcome === "PASS" || r.outcome === "FAIL")).at(-1)?.productDigest ?? sha256("[]");
+        const previousVerify = root.debug.receipts.filter(r => r.kind === "verify" && (r.outcome === "PASS" || r.outcome === "FAIL")).at(-1);
+        const previousCandidate = previousVerify?.productDigest ?? sha256("[]");
         const cause = debugStopCause(root.debug);
         // Recovery reruns the original verifier; changed product content still needs fresh proof.
-        if (cause !== null && !(["environment", "permission"].includes(cause) && (kind === "investigate" || kind === "verify")) && !(cause === "iterations" && kind === "review" && productDigest === previousCandidate))
+        // At the round limit an unchanged PASS candidate may be re-verified (not a new round), e.g. after an
+        // escape-ledger update moved the source fingerprint; a FAIL cannot be re-run into proof at the cap.
+        if (cause !== null && !(["environment", "permission"].includes(cause) && (kind === "investigate" || kind === "verify")) &&
+            !(cause === "iterations" && productDigest === previousCandidate && (kind === "review" || (kind === "verify" && previousVerify?.outcome === "PASS"))))
             fail("TASK_DEBUG_STOP_REQUIRED", `Runtime stop predicate: ${cause}. Record a checkpoint; resume alone cannot reset it.`);
         const processIdentity = await nativeProcessIdentity(process.pid);
         if (processIdentity === null)
@@ -564,17 +604,20 @@ export class DebugService {
             fail("TASK_DEBUG_RECOVERY_CONFIRMATION_REQUIRED", "Owned debug checkpoint/path/source/contract/config mismatch. Preserve the checkout and obtain user confirmation before recovery.");
         await this.options.tasks.attach(sessionId, root.task.id);
     }
-    async extend(taskId, sessionId, eventId) {
+    async extend(taskId, sessionId, eventId, home) {
         const root = await this.root(taskId), attached = await this.options.tasks.status({ sessionId });
         if (attached.task.debug?.rootTaskId !== root.task.id || root.debug.operation !== null)
             fail("TASK_DEBUG_GRANT_INVALID", "Extension belongs to the original issue and its native session; a running operation cannot be extended.");
-        const event = await this.#userEvent(sessionId);
+        const event = await this.#userEvent(sessionId, home);
         if (eventId !== "latest" && eventId !== event.id)
             fail("TASK_DEBUG_GRANT_INVALID", "The requested event is not the current native human event.");
         if (root.debug.grants.some(g => g.eventId === event.id))
             return;
-        const otherCause = debugStopCause({ ...root.debug, consumedMs: 0, budgetMs: 86_400_000,
+        const otherCause = debugStopCause({ ...root.debug, consumedMs: 0, foreground: null, operation: null, budgetMs: 86_400_000,
             ...(root.debug.control === undefined ? {} : { control: { ...root.debug.control, paused: false } }) });
+        const unlimited = debugUserControl(event.text) === "unlimited";
+        if (unlimited && (root.status !== "active" || event.timestamp < Date.parse(root.createdAt)))
+            fail("TASK_DEBUG_GRANT_INVALID", "Only a current native human event can waive the active original issue time limit.");
         const foregroundActive = root.debug.foreground !== undefined && root.debug.foreground !== null;
         const remainingAtEvent = debugRemainingMs(root.debug, event.timestamp);
         const sealedAtCandidates = [Date.parse(root.updatedAt), root.debug.receipts.at(-1)?.finishedAt ?? Number.NaN].filter(Number.isFinite);
@@ -582,8 +625,8 @@ export class DebugService {
         const exhaustedAtEvent = foregroundActive
             ? remainingAtEvent === 0
             : debugRemainingMs(root.debug) === 0 && event.timestamp > lastSealedAt;
-        if (!exhaustedAtEvent || (otherCause !== null && !["environment", "permission"].includes(otherCause)) || !/^(?:繼續|继续|continue)[。.!！]?$/iu.test(event.text.trim()))
+        if ((!unlimited && !exhaustedAtEvent) || (otherCause !== null && !["environment", "permission"].includes(otherCause)) || !["resume", "repair", "unlimited"].includes(debugUserControl(event.text) ?? ""))
             fail("TASK_DEBUG_GRANT_INVALID", "Only a contemporaneous human continue event extends exhausted time; other blockers remain authoritative.");
-        await this.#mutate(root, { ...root.debug, grants: [...root.debug.grants, { eventId: event.id, sessionId, sourceDigest: event.sourceDigest, grantedMs: DEBUG_EXTENSION_MS }], checkpoint: null });
+        await this.#mutate(root, { ...root.debug, grants: [...root.debug.grants, { eventId: event.id, sessionId, sourceDigest: event.sourceDigest, grantedMs: unlimited ? null : DEBUG_EXTENSION_MS, spentAtGrantMs: debugSpentMs(root.debug, event.timestamp) }], checkpoint: null });
     }
 }

package/dist/runtime/src/task/service.js

@@ -19,6 +19,9 @@ import { createDebugState, DEBUG_DEFAULTS } from "./debug-state.js";
 import { DebugService } from "./debug.js";
 import { sameDebugText } from "./debug-intake.js";
 import { isCovers, parseSurface } from "../surface/schema.js";
+import { declareEscape, resolveOrigin } from "../escape/link.js";
+import { configProposal } from "../escape/rules.js";
+import { logGateCatch } from "../logging/local-log.js";
 const SESSION_ID_PATTERN = /^[^\0\r\n]{1,256}$/u;
 function defaultTaskId() {
     return `task-${randomUUID()}`;
@@ -130,6 +133,7 @@ export class TaskService {
             id: this.#generateId(),
             ...(surface === undefined ? {} : { surface }),
             ...(input.requireSurface === true ? { surfaceRequired: true } : {}),
+            ...(input.origin === undefined ? {} : { origin: structuredClone(input.origin) }),
             title: input.title,
             ...(input.intent === undefined ? {} : { intent: input.intent }),
             criteria,
@@ -149,6 +153,10 @@ export class TaskService {
                 throw taskError("TASK_DEBUG_DISABLED", "Task debug routing is explicitly disabled.");
             debugSettings = config.features.debug ?? DEBUG_DEFAULTS;
             task.debug = { rootTaskId: task.id, facts: [...(input.debug.facts ?? [])], unknowns: [...(input.debug.unknowns ?? [])] };
+            if (input.origin !== undefined)
+                throw taskError("ESCAPE_ORIGIN_DEBUG_ACTION", "A DEBUG issue declares its origin with task debug --debug-action origin after a confirmed hypothesis.");
+            if (input.parentTaskId === undefined)
+                task.originRequired = true;
         }
         const validation = validateTask(task);
         if (!validation.ok) {
@@ -262,8 +270,16 @@ export class TaskService {
             throw taskError("TASK_NOT_ACTIVE", "Only active tasks can revise acceptance.");
         if (taskContractHash(previous.task) !== input.expectedContractHash)
             throw taskError("TASK_CONTRACT_CHANGED", "Task contract changed.");
-        if (input.criteria === undefined && input.surface === undefined)
-            throw taskError("TASK_REVISION_INVALID", "Revision requires criteria, a surface, or both.");
+        // With none of them, a revision only rebinds the task to the current configuration (checked below).
+        const rebindOnly = input.criteria === undefined && input.surface === undefined && input.origin === undefined;
+        if (rebindOnly && this.#completion === undefined)
+            throw taskError("TASK_REVISION_INVALID", "Revision requires criteria, a surface, an origin, or a combination.");
+        if (input.origin !== undefined && previous.task.debug !== undefined && input.debugOrigin !== true)
+            throw taskError("ESCAPE_ORIGIN_DEBUG_ACTION", "A DEBUG issue declares its origin with task debug --debug-action origin after a confirmed hypothesis.");
+        // Re-declaring the same origin only refreshes its ledger record; the contract and its proof stand.
+        if (input.criteria === undefined && input.surface === undefined && input.origin !== undefined &&
+            canonicalJson(input.origin) === canonicalJson(previous.task.origin ?? null))
+            return previous;
         const surface = input.surface === undefined ? previous.task.surface : parseSurface(input.surface);
         const baseline = input.baseline ?? previous.createdSourceCommit;
         const criteria = input.criteria === undefined ? structuredClone(previous.task.criteria) : structuredClone(input.criteria).map(criterion => {
@@ -278,7 +294,8 @@ export class TaskService {
             return { ...criterion, acceptance: { ...criterion.acceptance, baselineCommit: sha } };
         });
         const next = { ...previous.task, schemaVersion: TASK_SCHEMA_VERSION,
-            contractRevision: (previous.task.contractRevision ?? 0) + 1, criteria, ...(surface === undefined ? {} : { surface }) };
+            contractRevision: (previous.task.contractRevision ?? 0) + 1, criteria, ...(surface === undefined ? {} : { surface }),
+            ...(input.origin === undefined ? {} : { origin: structuredClone(input.origin) }) };
         const checked = validateTask(next);
         if (!checked.ok)
             throw taskError("TASK_INVALID", checked.errors[0]?.message ?? "Invalid criterion revision.");
@@ -293,6 +310,8 @@ export class TaskService {
                 throw taskError("TASK_INVALID", configured.errors[0]?.message ?? "Invalid binding.");
             policyConfigHash = calculateConfigHash(config);
         }
+        if (rebindOnly && policyConfigHash === previous.policyConfigHash)
+            throw taskError("TASK_REVISION_INVALID", "Nothing to revise: criteria, surface, origin and configuration are unchanged.");
         if (criteria.some(c => c.acceptance !== undefined))
             await this.#retainBaselines(next);
         const now = assertTimestamp(this.#now());
@@ -680,7 +699,10 @@ export class TaskService {
     async recordVerificationEvidence(snapshot, evidenceInput, sourceFingerprint) {
         if (snapshot.status === "active") {
             const result = await this.recordEvidence(snapshot.task.id, evidenceInput);
-            await this.clearFailure(snapshot.task.id);
+            // A verified red turning green is a gate catch (advisory, fail-open).
+            if (await this.clearFailure(snapshot.task.id) &&
+                (await this.#completion?.loadConfig().catch(() => undefined))?.profiles.includes("advisory") === true)
+                await logGateCatch("VERIFY_RED_GREEN", snapshot.task.id);
             return result;
         }
         const completion = this.#completion;
@@ -804,18 +826,48 @@ export class TaskService {
             return structuredClone(advanced);
         });
     }
+    /** Escape Loop: resolve a declared commit-ish through this repository's Git (argv only). */
+    async resolveOrigin(value) {
+        if (this.#completion === undefined)
+            throw taskError("ESCAPE_CONTEXT_REQUIRED", "Escape linking requires repository context.");
+        return await resolveOrigin(this.#completion.gitRunner, value);
+    }
+    /** Link a normal task's escape-of origin and write its tracked ledger record. */
+    async declareEscape(taskId) {
+        const completion = this.#completion;
+        const record = await this.status({ taskId });
+        const origin = record.task.origin;
+        if (completion === undefined || origin?.kind !== "escape-of" || record.createdSourceCommit === undefined)
+            throw taskError("ESCAPE_CONTEXT_REQUIRED", "Escape linking needs an escape-of origin, a creation commit and repository context.");
+        return await declareEscape({ root: completion.root, git: completion.gitRunner, taskId, origin,
+            base: record.createdSourceCommit, now: assertTimestamp(this.#now()) });
+    }
+    /** Escape Loop R2: printed only, never written; the promoted check becomes a required verifier through update. */
+    async escapeConfigProposal(check) {
+        let config;
+        try {
+            config = await this.#completion?.loadConfig();
+        }
+        catch {
+            config = undefined;
+        }
+        return configProposal(check, config);
+    }
+    /** True when a recorded verification failure was cleared (red to green). */
     async clearFailure(taskId) {
         const now = assertTimestamp(this.#now());
-        await this.#store.mutate((state) => {
+        return await this.#store.mutate((state) => {
             const current = findTask(state, taskId);
             if (current.failureFingerprint === null) {
-                return;
+                return false;
             }
             replaceTask(state, {
                 ...current,
                 updatedAt: now,
                 failureFingerprint: null
             });
+            // A source change mid-run is not a red the code fixed.
+            return current.failureFingerprint.commandId !== "source-snapshot";
         });
     }
     async coverage(taskId) {

package/dist/runtime/src/verify/acceptance-replay.js

@@ -1,4 +1,4 @@
-import { lstat, mkdir, mkdtemp, readFile, realpath, rm, writeFile, chmod } from "node:fs/promises";
+import { lstat, mkdir, mkdtemp, readFile, realpath, writeFile, chmod } from "node:fs/promises";
 import { join, delimiter, isAbsolute } from "node:path";
 import { tmpdir } from "node:os";
 import { writePrivateFile } from "../security/permissions.js";
@@ -6,6 +6,7 @@ import { redactSecrets } from "../security/redact.js";
 import { randomUUID } from "node:crypto";
 import { canonicalJson } from "../config/hash.js";
 import { sha256 } from "../fs/hash.js";
+import { removeTemporary } from "../fs/temporary.js";
 import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
 import { criterionContractHash, taskContractHash } from "../task/contract.js";
 import { aggregateAcceptanceRun, makeAcceptanceCheck, makeAcceptanceRun } from "./acceptance-protocol.js";
@@ -13,6 +14,8 @@ import { collectNodeAcceptance, collectJestAcceptance, collectVitestAcceptance,
 import { buildVerificationEvidence } from "./evidence.js";
 import { collectChangeSurface, resolveGitCommit } from "./change-surface.js";
 import { runVerificationCommand } from "./spawn.js";
+/** Limits for runner steps without their own timeoutMs: installs are slow, git plumbing is not. */
+export const ACCEPTANCE_TIMEOUTS = { setup: 600_000, build: 300_000, testBuild: 300_000, run: 300_000, git: 60_000 };
 async function executableIdentity(command, cwd, env) {
     const paths = isAbsolute(command) ? [command] : command.includes("/") ? [join(cwd, command)] :
         (env.PATH ?? "").split(delimiter).filter(Boolean).map(path => join(path, command));
@@ -113,13 +116,21 @@ export async function replayAcceptance(options) {
             const temp = await mkdtemp(join(tmpdir(), "agent-ops-acceptance-"));
             const checkout = join(temp, "repository");
             const env = replayEnvironment(checkout, phase, executionId);
-            const command = async (executable, args, cwd, timeoutMs = 60_000) => {
+            let timedOut;
+            const command = async (executable, args, cwd, stage, own) => {
                 const remaining = await options.remainingMs?.();
                 if (remaining === 0)
                     throw new AgentOpsError("TASK_DEBUG_BUDGET_EXHAUSTED", "The original issue's active budget is exhausted.");
-                return await runVerificationCommand({ id: group.runner.id, command: executable, args: [...args], cwd: ".", required: true,
-                    evidence: { kind: "exit-code" }, timeoutMs: Math.min(timeoutMs, remaining ?? Infinity) }, { cwd, runner: options.processRunner, env, replaceEnv: true,
+                const limit = own ?? ACCEPTANCE_TIMEOUTS[stage];
+                const result = await runVerificationCommand({ id: group.runner.id, command: executable, args: [...args], cwd: ".", required: true,
+                    evidence: { kind: "exit-code" }, timeoutMs: Math.min(limit, remaining ?? Infinity) }, { cwd, runner: options.processRunner, env, replaceEnv: true,
                     outputLimitBytes: 1024 * 1024, ...(options.signal === undefined ? {} : { signal: options.signal }) });
+                if (result.failureClass === "timeout" && timedOut === undefined)
+                    timedOut = stage === "git"
+                        ? `Runner ${group.runner.id} ${phase}: git checkout exceeded ${limit} ms.`
+                        : `Runner ${group.runner.id} ${phase}: ${stage} step ${executable} exceeded ${limit} ms; raise ` +
+                            (stage === "run" ? "verification.acceptanceRunners[].timeoutMs" : `the step's timeoutMs in verification.acceptanceRunners[].${stage}`) + ".";
+                return result;
             };
             let aggregate;
             let failure = "replay-unavailable";
@@ -133,13 +144,14 @@ export async function replayAcceptance(options) {
             try {
                 for (const [cwd, args] of [[temp, ["clone", "--no-hardlinks", "--quiet", "--", options.root, checkout]],
                     [checkout, ["fetch", "--quiet", "--", options.root, commit]], [checkout, ["checkout", "--detach", "--quiet", commit]]]) {
-                    const result = await command("git", args, cwd);
+                    const result = await command("git", args, cwd, "git");
                     if (result.status !== "PASS")
                         throw new Error("checkout-unavailable");
                 }
                 const cwd = group.runner.cwd === "." ? checkout : await resolveContainedPath(checkout, group.runner.cwd);
-                for (const step of [...(group.runner.setup ?? []), ...(group.runner.build ?? [])]) {
-                    const result = await command(step.command, step.args, cwd, step.timeoutMs);
+                for (const [stage, step] of [...(group.runner.setup ?? []).map(step => ["setup", step]),
+                    ...(group.runner.build ?? []).map(step => ["build", step])]) {
+                    const result = await command(step.command, step.args, cwd, stage, step.timeoutMs);
                     steps.push({ command: step.command, args: step.args, status: result.status, failureClass: result.failureClass, stderr: result.stderr });
                     if (result.status !== "PASS")
                         throw new Error("setup-or-build-unavailable");
@@ -172,7 +184,7 @@ export async function replayAcceptance(options) {
                     await chmod(path, material.mode);
                 }
                 for (const step of group.runner.testBuild ?? []) {
-                    const result = await command(step.command, step.args, cwd, step.timeoutMs);
+                    const result = await command(step.command, step.args, cwd, "testBuild", step.timeoutMs);
                     steps.push({ command: step.command, args: step.args, status: result.status, failureClass: result.failureClass, stderr: result.stderr });
                     if (result.status !== "PASS")
                         throw new Error("test-build-unavailable");
@@ -194,7 +206,7 @@ export async function replayAcceptance(options) {
                     throw new Error("missing-executable");
                 executionDigest = sha256(canonicalJson({ commit, materialDigest, runner: group.runner, argv, dependencies,
                     executable: identity, platform: process.platform, arch: process.arch, environment: sha256(canonicalJson(env)) }));
-                output = await command(group.runner.command, argv, cwd, group.runner.timeoutMs);
+                output = await command(group.runner.command, argv, cwd, "run", group.runner.timeoutMs);
                 run = collected(group.runner, output, checkout, { executionId, phase,
                     frameworkVersion: group.runner.adapter === "node" ? process.version : "dependency-lock:" + sha256(canonicalJson(dependencies)) });
                 aggregate = aggregateAcceptanceRun(run, requested);
@@ -208,7 +220,7 @@ export async function replayAcceptance(options) {
                 failure = error instanceof AgentOpsError && error.code === "TASK_DEBUG_BUDGET_EXHAUSTED" ? "debug-budget-exhausted" : error instanceof Error && /^[a-z-]+$/u.test(error.message) ? error.message : "replay-unavailable";
             }
             finally {
-                await rm(temp, { recursive: true, force: true });
+                await removeTemporary(temp);
             }
             const finishedAt = new Date().toISOString();
             const artifactContent = redactSecrets(JSON.stringify({ schemaVersion: 1, executionId, phase, commit,
@@ -236,7 +248,8 @@ export async function replayAcceptance(options) {
                     taskContractHash: taskContractHash(options.task), acceptance: { criterionContractHash: criterionContractHash(criterion),
                         bindingHash: sha256(canonicalJson({ runnerId: group.runner.id, materials: group.binding.materials })), phase, commit, pairedCommit: phase === "baseline" ? candidate : group.baseline, materialDigest, executionDigest, executionArtifact, checks } });
                 const reference = await options.evidenceStore.save(evidence);
-                reports.push({ criterionId: criterion.id, runnerId: group.runner.id, phase, status, failureClass: evidence.failureClass, reference });
+                reports.push({ criterionId: criterion.id, runnerId: group.runner.id, phase, status, failureClass: evidence.failureClass, reference,
+                    ...(timedOut === undefined || status === "PASS" ? {} : { detail: timedOut }) });
             }
         }
     }

package/docs/en/guides/configuration.md

@@ -115,7 +115,14 @@ Capability checks and model starts are reported on stderr, including under
 `--json`; stdout remains one final JSON envelope and raw reviewer output is
 never streamed. SIGINT or SIGTERM terminates the active reviewer process tree,
 does not advance the fallback chain, and never writes an attestation. An
-exhausted timeout chain reports `timeout`, not `missing-cli`.
+exhausted timeout chain reports `timeout`, not `missing-cli`. Each reviewer
+round may take 30 minutes by default (`reviewRoles[].timeoutMs` overrides it);
+a reviewer that prints nothing for the stall window is still stopped early.
+
+Acceptance runner steps without their own `timeoutMs` get 10 minutes for
+`setup`, 5 minutes each for `build`, `testBuild` and the runner itself, and
+1 minute for the git checkout. A step that times out is reported as
+`UNKNOWN` with the step, its limit and the `timeoutMs` field that raises it.
 
 The task ID is explicit and its criteria are always used; no session fallback
 or criterion filter can replace the original task requirements. Review rechecks
@@ -200,6 +207,14 @@ evidence. Give each editing conversation its own worktree instead:
   `.env` or `local.properties`); a file Git already checked out is never
   overwritten. Trust is inherited only when the main checkout is trusted and
   the worktree's effective config is identical.
+- An approved `agent-ops update` in the main checkout copies the new config
+  into every session worktree whose copy is still the previously trusted one,
+  and trusts it for the same commands; the plan lists the session worktrees
+  before you confirm. A hand-edited worktree config is left alone, and run
+  worktrees keep their own authorization. A task created under the old config is
+  not rebound automatically: review names the
+  `agent-ops task revise --task <id> --expected-contract <hash> --reason <text>`
+  that rebinds it (criteria and surface unchanged), then verify again.
 - `setup` commands run in the new worktree (default timeout ten minutes) for
   what Git does not carry, such as installed dependencies. They are part of
   the trusted config, so they need no separate approval; a failing step
@@ -260,7 +275,7 @@ evidence. Give each editing conversation its own worktree instead:
   (Claude Code refuses it inside an isolated worktree session). `agent-ops
   worktree finish <name>` completes every non-archived task in the worktree,
   subtasks before their parents, each against the base its PASS review
-  recorded (the worktree's base when none was recorded), before any rebase.
+  recorded (the worktree's base when none was recorded), before merging.
   If one cannot complete, nothing merges and the error names the task.
   Creating a subtask keeps the session attached to the top of its tree, and
   each task keeps its own review record, so a parent and a subtask reviewed
@@ -280,9 +295,13 @@ evidence. Give each editing conversation its own worktree instead:
   its files, so uncommitted changes there block it. When the main checkout is
   on another branch or detached, only the target's ref moves: the checkout, its
   files and its uncommitted changes are left alone. A target checked out in
-  another worktree is refused, naming that path. If the target moved, it rebases; a clean rebase whose own patch
-  is unchanged is re-verified before merging, and a conflict is reported with
-  the `refs/notes/agent-ops` intent of the work that landed first. The note
+  another worktree is refused, naming that path. If the target moved, it rebases the worktree and
+  stops with `WORKTREE_REBASED` before completing any task: earlier evidence
+  covered the old base, not the combination that would merge. Verify and
+  review again with the printed `--base`, then finish again; a task that was
+  already complete cannot take new evidence, so cover the rebased change with
+  a follow-up task. A conflict is reset and reported with the
+  `refs/notes/agent-ops` intent of the work that landed first. The note
   records every task of the worktree, subtasks indented under their parent,
   and a `session: <id>` line naming the session that finished it. Finish
   also resets that session's gate baseline to the merged source, so the