@lazyingart/agintiflow 0.20.291 → 0.20.296

package/docs/supervision-campaign-ledger.md

@@ -431,3 +431,121 @@ punctuation search literal, added regression coverage, passed four unit tests,
 and committed a clean tree at `b956470`. The independent migration-safety
 contract also passed. The complete npm suite passes, and the runtime fix is
 released in AgInTiFlow `0.20.291`.
+
+### Explicit test evidence and security-review completion
+
+`security-labshare-050` asked a fresh DeepSeek Pro session to harden a small
+standard-library laboratory service from an imperfect, outcome-level prompt.
+The agent removed a default credential, bounded artifact and dataset paths,
+kept export execution shell-free, redacted audit credentials, protected the
+public status response, added focused tests, and committed a clean repair. The
+hidden acceptance contract then exposed a remaining audit-log injection path:
+newlines in an actor or artifact field could forge additional physical records.
+
+During the retained-session repair, AgInTi fixed the production source but
+committed it before adding the explicitly requested regression test. This was a
+runtime contract defect, not a model-quality failure. The mutation parser did
+not recognize contextual requests such as "add a regression test," and the SCS
+evidence contract did not convert "run the tests" into a fresh test obligation.
+Consequently, source and Git evidence could satisfy the phase too early.
+
+AgInTiFlow now recognizes explicit English and Chinese test-file mutations,
+requires fresh test evidence for explicit run/rerun-test requests, and keeps
+task-owned commit completion closed until that evidence exists. The regression
+suite reproduces the stale persisted contract and proves no commit is offered
+after source mutation but before a fresh passing test. It avoids broad keyword
+matching, so phrases such as "create a canvas preview for this smoke test" do
+not invent a test-file mutation.
+
+The same release accepts genuinely observational Git evidence when no
+consequential Git action is required, permits only the exact bounded Python
+cache-cleanup forms used by project hygiene, and treats masked values such as
+`token=***` as safe status evidence without weakening detection of real
+credential assignments. The security-review skill now covers control-character
+log injection and requires a standalone note to distinguish deployment
+boundary, threat model, controls, residual risks, non-goals, and verification.
+
+The retained session completed `SECURITY.md` after a valid secret-content
+block, passed the exact hidden contract and all 13 visible tests, and left a
+clean target repository at `ef3c099`. Focused regressions and the complete npm
+suite pass. These runtime and skill fixes are released in AgInTiFlow
+`0.20.292`.
+
+### Retained storage live authority poisoning
+
+`retained-storage-live-poison-047` exercised the native integration storage
+authority after independent audit addenda, using a dictated but realistic
+operator prompt. The defect was an AgInTiFlow core integration-storage
+authority gap: live retained handles and named bindings were mostly checked,
+but the public limitation record omitted the generic `resolveBeneath:false`
+fact, and protected file success paths could return after cleanup awaits
+without one final permanent-poison check.
+
+The storage authority now reports `procfsRequired:true`,
+`resolveBeneath:false`, and `noXdev:false` truthfully across retained
+directory/file/lock limitation records. Live retained owner, mode, fstat, and
+named-binding divergence remains `INTEGRATION_STORAGE_POISONED`, not an
+availability failure, and protected read/write/sync paths check permanent
+poison again immediately before returning success.
+
+External verification used the module-mocked retained-storage smoke for live
+fstat, owner, mode, named-binding, concurrent poison, close/admission, cleanup,
+and residual-FD adversaries. Retained durable-common, retained file-lock,
+production-mount, integration authorities, runtime authority,
+session-persistence, syntax, and whitespace checks passed on the working tree.
+
+### Authoritative read-only routine first
+
+`authoritative-readonly-routine-001` reproduced the LabCanvas status failure
+from sessions `web-agent-labcanvas-cb6fe7cd-3464-42f7-99e4-b24c376e0115` and
+`web-agent-labcanvas-6d0b04bc-79e8-4fd8-87b4-4d8e651dcd72`. The first session
+had no selected routine and spent 25 model requests and 23 tools on broad
+workspace/private-store exploration. The second session received a disclosed
+canonical read-only routine, but AgInTiFlow still kept
+`requiredProjectCommands` empty, then continued through 32 model requests and
+32 tools after the status snapshot.
+
+The defect was an AgInTiFlow core execution-contract/SCS handoff gap, with a
+separate upstream routine-disclosure improvement already handled by
+AgenticApp. AgInTiFlow now promotes an authoritative read-only routine's first
+safe command into the exact required command batch, records an observed
+nonzero status snapshot as read-only evidence instead of a failed verifier,
+retains forbidden raw/private evidence scopes, and closes the following turn to
+`finish` once normal SCS evidence is sufficient.
+
+The focused regression uses a weak status prompt and a project-neutral
+`sample-status` routine. It proves the first model turn sees only the exact
+status command plus `finish`, a JSON status command exiting 1 still satisfies
+the read-only evidence contract, the second turn is finish-only, and no
+private/raw exploratory command is dispatched. `npm run smoke:progressive-tools`,
+`npm run smoke:scs-evidence`, `npm run smoke:truthful-completion`, and
+`npm run check` pass on the working tree.
+
+Fresh compact retest `web-agent-labcanvas-2ebe5aef-83c8-4134-abcd-bec630a4ecb9`
+reduced the flow to 6 model requests and 5 tool starts and used the canonical
+compact status command, but both valid `finish` calls were rejected because the
+human-facing status said `Still retrying: echomind_daily_pdf` and named a
+`next attempt`. That was still an AgInTiFlow core completion-semantic defect:
+the validator treated an observed external retry state as the agent promising
+unfinished work. The completion predicate now rejects pending work only when it
+is tied to the current task/report/validation/change or an agent-promised
+future action. Read-only status answers may truthfully report external
+pending/retrying/next-attempt state after sufficient evidence exists.
+
+Installed retest `web-agent-labcanvas-5e6eb6b6-fb8d-419d-a549-aa4098252064`
+then proved the next core gap. AgInTiFlow ran the same canonical compact
+health command exactly once and avoided raw/private exploration, but the
+finish-only verified-completion turns kept returning empty content and no tool
+calls with `finishReason=length` at the inherited 768-token output cap. After
+the bounded empty-response repair was exhausted, the runtime emitted the
+generic verified fallback `Evidence: command` instead of summarizing the
+authoritative JSON status snapshot.
+
+That defect is still AgInTiFlow core completion-loop behavior, not AgenticApp
+or a WeChat-specific routine. Verified-completion turns now have their own
+final-answer output floor and explicit finish-only instruction. If a provider
+still returns empty final responses after verified evidence exists, the
+fallback derives a concise public answer from the successful bounded command
+output. JSON status snapshots summarize visible delivered/retrying schedule
+states, ingress reachability, queue counts, and top-level health while keeping
+the original SCS checks for genuinely unfinished agent work.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.291",
+  "version": "0.20.296",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-coding-tools.js

@@ -1680,6 +1680,45 @@ try {
     mixedValidationCleanupAdvice.autoRecover === true,
     "unrequested cleanup should be skipped without pausing substantive work"
   );
+  const pythonCacheCleanupArgs = {
+    command:
+      "find . -type d -name __pycache__ -prune -exec rm -rf {} + ; find . -type f -name '*.pyc' -delete; git status --short",
+  };
+  assert(
+    isUnrequestedCleanupCommand(
+      "run_command",
+      pythonCacheCleanupArgs,
+      { goal: "Repair the service, run its tests, and commit the intentional work." },
+      {}
+    ),
+    "post-acceptance Python cache deletion was not recognized as optional housekeeping"
+  );
+  const pythonCacheCleanupAdvice = buildPermissionAdvice({
+    toolName: "run_command",
+    args: pythonCacheCleanupArgs,
+    guard: {
+      category: "destructive",
+      reason: "Destructive shell commands require Allow destructive actions.",
+    },
+    config: {
+      ...dockerWorkspacePolicy,
+      goal: "Repair the service, run its tests, and commit the intentional work.",
+    },
+    state: { sessionId: "coding-python-cache-cleanup-smoke" },
+  });
+  assert(
+    pythonCacheCleanupAdvice.autoRecover === true,
+    "ignored Python cache cleanup should be skipped without pausing a completed task"
+  );
+  assert(
+    !isUnrequestedCleanupCommand(
+      "run_command",
+      { command: "find . -type f -delete" },
+      { goal: "Repair the service and commit the result." },
+      {}
+    ),
+    "broad find deletion was incorrectly classified as optional Python cache cleanup"
+  );
   assert(
     !isUnrequestedCleanupCommand(
       "run_command",

package/scripts/smoke-dynamic-step-budget.js

@@ -9251,7 +9251,7 @@ try {
   const verifiedCompletionText = JSON.stringify(verifiedCompletionRequest?.messages || []);
   assert(
     verifiedCompletionRequest?.mode === "verified-completion" &&
-      verifiedCompletionRequest?.maxOutputTokens === 768,
+      verifiedCompletionRequest?.maxOutputTokens === 2048,
     "fresh passing evidence did not narrow the final response turn"
   );
   assert(
@@ -13546,6 +13546,91 @@ Do not prefix, suffix, wrap, redirect, pipe, or combine that validator command.`
     "a partial multi-artifact task entered task-owned Git completion before its deliverables existed"
   );
 
+  const securityWorkspace = path.join(tempRoot, "security-test-before-commit");
+  await fs.mkdir(securityWorkspace, { recursive: true });
+  await fs.writeFile(path.join(securityWorkspace, "labshare.py"), "def record_access():\n    pass\n");
+  const securityGoal = [
+    "Independent acceptance failed: audit fields permit newline log injection.",
+    "Add a focused regression test, fix the root cause, run the full visible tests,",
+    "review the diff, and commit only this corrective work.",
+  ].join(" ");
+  const securityState = {
+    goal: securityGoal,
+    commandCwd: securityWorkspace,
+    plan: "Patch the source and regression test, run the full suite, then commit the verified work.",
+    messages: [
+      {
+        role: "tool",
+        content: JSON.stringify({
+          ok: true,
+          toolName: "apply_patch",
+          path: "labshare.py",
+          goalRevision: 1,
+          projectMutationRevision: 1,
+        }),
+      },
+      {
+        role: "tool",
+        content: JSON.stringify({
+          ok: true,
+          toolName: "run_command",
+          exitCode: 0,
+          args: { command: "git status --short" },
+          stdout: " M labshare.py\n",
+          goalRevision: 1,
+          projectMutationRevision: 1,
+        }),
+      },
+    ],
+    meta: {
+      taskProfile: "security",
+      goalContract: {
+        revision: 1,
+        currentRequest: securityGoal,
+        taskGoal: securityGoal,
+        activeGoal: securityGoal,
+        activeGoalRevision: 1,
+        history: [{ revision: 1, refreshExecutionContract: true }],
+        lifecycle: [{ at: new Date(Date.now() - 2000).toISOString() }],
+      },
+      // Reproduce the pre-fix persisted contract that recognized a mutation
+      // but failed to classify the requested regression test as file work.
+      activeExecutionContract: {
+        revision: 1,
+        startedMutationRevision: 0,
+        materialMutationRevision: 1,
+        requiresWorkspaceMutation: true,
+        requiresFileMutation: false,
+      },
+      projectVerification: {
+        mutationRevision: 1,
+        mutationHistory: [
+          {
+            revision: 1,
+            at: new Date().toISOString(),
+            toolName: "apply_patch",
+            paths: ["labshare.py"],
+            goalRevision: 1,
+          },
+        ],
+      },
+    },
+  };
+  const securityCompletionContract = completionTaskContract(
+    { goal: securityGoal, taskProfile: "security", commandCwd: securityWorkspace },
+    securityState
+  );
+  const preTestSecurityRuntime = nextStepRuntimeConfig(
+    { goal: securityGoal, taskProfile: "security", commandCwd: securityWorkspace },
+    securityState
+  );
+  assert(
+    securityCompletionContract.requiresFileMutation === true &&
+      securityCompletionContract.requiredEvidence.some((item) => item.category === "test") &&
+      preTestSecurityRuntime.taskOwnedCommitPending !== true,
+    "a regression-test repair entered task-owned Git completion before fresh test evidence"
+  );
+
   await fs.rm(tempRoot, { recursive: true, force: true });
   console.log("smoke-dynamic-step-budget ok");
 } catch (error) {

package/scripts/smoke-integration-storage-authority.js

@@ -538,6 +538,7 @@ async function main() {
     assert.equal(authority.attestation.limitations.preEnablePrimitive, true);
     assert.equal(authority.attestation.limitations.procfsRequired, true);
     assert.equal(authority.attestation.limitations.openat2ResolveBeneath, false);
+    assert.equal(authority.attestation.limitations.resolveBeneath, false);
     assert.equal(authority.attestation.limitations.noXdev, false);
 
     const identity = await authority.identity();

package/scripts/smoke-model-roles.js

@@ -930,6 +930,22 @@ const refreshedSecurityContract = deriveScsTaskContract({
   goal: "Fix the security issue and run the regression tests.",
   taskProfile: "security",
 });
+const correctiveSecurityContract = deriveScsTaskContract({
+  goal: [
+    "Independent acceptance failed: audit fields permit newline log injection.",
+    "Reopen the exact repair, add a focused regression test, fix the root cause,",
+    "run the full visible tests, review the diff, and commit only this corrective work.",
+  ].join(" "),
+  taskProfile: "security",
+});
+assert(
+  correctiveSecurityContract.requiresWorkspaceMutation === true &&
+    correctiveSecurityContract.requiresFileMutation === true &&
+    correctiveSecurityContract.requiredEvidence.some((item) => item.category === "file") &&
+    correctiveSecurityContract.requiredEvidence.some((item) => item.category === "test") &&
+    correctiveSecurityContract.requiredGitActions.includes("commit"),
+  "a requested regression-test repair could enter Git completion without fresh file and test evidence"
+);
 const staleContractFinish = await reviewScsFinish(
   { mock: true },
   { provider: "mock", model: "mock-agent", taskProfile: "security" },
@@ -964,6 +980,11 @@ const staleContractFinish = await reviewScsFinish(
           exitCode: 0,
           args: { command: "python -m unittest discover -s tests -v" },
           stdout: "Ran 10 tests\nOK",
+          projectTest: {
+            passed: true,
+            command: "python -m unittest discover -s tests -v",
+            mutationRevision: 0,
+          },
         }),
       },
     ],
@@ -1056,6 +1077,20 @@ assert(
   evaluateScsEvidence(commitContract, gitStatusLedger).missingGitActions.includes("commit"),
   "the completion deficit did not identify the missing commit"
 );
+const readOnlyGitContract = {
+  requiresExternalEvidence: true,
+  requiredEvidence: [
+    { id: "command", category: "command", description: "read-only verification" },
+    { id: "git", category: "git", description: "existing commit verification" },
+  ],
+  requiredToolCalls: [],
+  requiredGitActions: [],
+  requiredProjectCommands: [],
+};
+assert(
+  evaluateScsEvidence(readOnlyGitContract, gitStatusLedger).ok,
+  "read-only Git evidence was rejected when the contract required no consequential Git action"
+);
 const committedEvaluation = evaluateScsEvidence(commitContract, gitCommitLedger);
 assert(
   committedEvaluation.missingGitActions.length === 0 &&
@@ -1231,7 +1266,14 @@ const checkedCodeEval = evaluateScsEvidence(
       messages: [
         {
           role: "tool",
-          content: JSON.stringify({ toolName: "run_command", ok: true, exitCode: 0, args: { command: "npm test" }, stdout: "ok" }),
+          content: JSON.stringify({
+            toolName: "run_command",
+            ok: true,
+            exitCode: 0,
+            args: { command: "npm test" },
+            stdout: "ok",
+            projectTest: { passed: true, command: "npm test", mutationRevision: 0 },
+          }),
         },
       ],
     },

package/scripts/smoke-progressive-tool-selection.js

@@ -5501,6 +5501,55 @@ assertStrict.equal(
   undefined,
   "an explicit task artifact root still activated generic repository grounding"
 );
+const scopedPathWriteDescriptor = {
+  type: "function",
+  function: {
+    name: "write_file",
+    description: "Write one workspace file.",
+    parameters: {
+      type: "object",
+      properties: {
+        path: { type: "string" },
+        content: { type: "string" },
+      },
+      required: ["path", "content"],
+      additionalProperties: false,
+    },
+  },
+};
+const scopedPathSurface = [
+  ...allTools.filter((item) => item.function.name !== "write_file"),
+  scopedPathWriteDescriptor,
+];
+const scopedPathTools = selectProgressiveTools(scopedPathSurface, {
+  config: {
+    provider: "deepseek",
+    progressiveTools: true,
+    scopedArtifactTask: true,
+    scopedArtifactRoot: scopedRuntime.scopedArtifactRoot,
+    commandCwd: "/workspace",
+  },
+  goal: scopedRuntimePrompt,
+  profile: "auto",
+  messages: [{ role: "user", content: scopedRuntimePrompt }],
+});
+const scopedWritePathPattern = scopedPathTools.find(
+  (item) => item.function.name === "write_file"
+)?.function?.parameters?.properties?.path?.pattern;
+assert(scopedWritePathPattern, "scoped artifact write tool omitted its path contract");
+const scopedWritePathRegex = new RegExp(scopedWritePathPattern);
+assert(
+  scopedWritePathRegex.test("output/wechat_worker/task/report.md"),
+  "scoped artifact write contract rejected its workspace-relative path"
+);
+assert(
+  scopedWritePathRegex.test("/workspace/output/wechat_worker/task/report.md"),
+  "scoped artifact write contract rejected the host-supplied exact absolute path"
+);
+assert(
+  !scopedWritePathRegex.test("/workspace/output/wechat_worker/other/report.md"),
+  "scoped artifact write contract accepted a sibling task path"
+);
 
 const longScopedTaskRoot = path.join(repoRoot, "output/wechat_worker/long-scoped-task");
 const longScopedScopeLine = `AGINTI_EVIDENCE_SCOPE_JSON: ${JSON.stringify({
@@ -7288,6 +7337,160 @@ async function runToolContractCase({
   }
 }
 
+function weakAuthoritativeRoutineGoal(command) {
+  return [
+    "AGINTI_EVIDENCE_SCOPE_JSON: {\"mode\":\"task\",\"request\":\"tell me phone and schedule status, read-only, dont send or change anything\"}",
+    "Matched established routines",
+    `- \`sample-status\` ready=true; commands=[${JSON.stringify(command)}, "node scripts/secondary-status.js --json"]; outputs=["status"]; guidance=For a read-only phone, message-intake, queue, or schedule question, run the canonical \`${command}\` command first. Treat the current status snapshot as authoritative. Do not inspect raw private stores, and do not send or mutate anything.`,
+    "Operating contract",
+    "- Forbidden evidence: raw/private ledgers are out of scope for this read-only answer.",
+  ].join("\n");
+}
+
+const authoritativeRoutineCommand = "node scripts/status.js status --json";
+const authoritativeRoutineGoal = weakAuthoritativeRoutineGoal(
+  authoritativeRoutineCommand
+);
+const authoritativeRoutineContract = completionTaskContract(
+  {
+    goal: authoritativeRoutineGoal,
+    taskProfile: "auto",
+  },
+  {
+    goal: authoritativeRoutineGoal,
+    meta: {
+      taskProfile: "auto",
+      goalContract: {
+        revision: 1,
+        currentRequest: authoritativeRoutineGoal,
+      },
+    },
+  }
+);
+assertStrict.deepEqual(
+  authoritativeRoutineContract.requiredProjectCommands,
+  [authoritativeRoutineCommand],
+  "authoritative read-only routine was not promoted to an exact required command"
+);
+assertStrict.deepEqual(
+  authoritativeRoutineContract.authoritativeRoutine?.forbiddenEvidenceScopes,
+  ["private", "raw"],
+  "authoritative read-only routine did not retain forbidden evidence scopes"
+);
+
+const hostedRequiredRoutineTools = selectProgressiveTools(allTools, {
+  config: {
+    provider: "deepseek",
+    toolSurfacePolicy: "full",
+    requiredProjectCommandPending: true,
+    requiredProjectCommand: authoritativeRoutineCommand,
+  },
+  goal: authoritativeRoutineGoal,
+  profile: "auto",
+});
+sameNames(
+  hostedRequiredRoutineTools,
+  ["run_command", "finish"],
+  "hosted/full policy did not constrain an authoritative routine first command"
+);
+assertStrict.deepEqual(
+  enumFor(hostedRequiredRoutineTools, "run_command", "command"),
+  [authoritativeRoutineCommand],
+  "authoritative routine command was not exposed as an exact enum"
+);
+
+let authoritativeRoutineStep = 0;
+const authoritativeRoutineRun = await runToolContractCase({
+  id: "authoritative-readonly-routine",
+  provider: "deepseek",
+  profile: "auto",
+  goal: authoritativeRoutineGoal,
+  allowShellTool: true,
+  maxSteps: 4,
+  toolCalls: [
+    contractCall("unused-authoritative", "finish", { result: "unused" }),
+  ],
+  expectSuccess: true,
+  setupWorkspace: async (workspace) => {
+    await fs.mkdir(path.join(workspace, "scripts"), { recursive: true });
+    await fs.writeFile(
+      path.join(workspace, "scripts", "status.js"),
+      [
+        "console.log(JSON.stringify({ phone: 'login-required', schedule: 'current', authoritative: true }));",
+        "process.exit(1);",
+        "",
+      ].join("\n"),
+      "utf8"
+    );
+  },
+  responseFactory: ({ payload }) => {
+    authoritativeRoutineStep += 1;
+    const offered = Array.isArray(payload.tools) ? names(payload.tools) : [];
+    if (authoritativeRoutineStep === 1) {
+      assertStrict.deepEqual(
+        offered,
+        ["run_command", "finish"],
+        "first authoritative routine turn exposed exploratory tools"
+      );
+      assertStrict.deepEqual(
+        enumFor(payload.tools, "run_command", "command"),
+        [authoritativeRoutineCommand],
+        "first authoritative routine turn did not constrain the exact command"
+      );
+      return assistantWithToolCalls([
+        contractCall("run-authoritative-status", "run_command", {
+          command: authoritativeRoutineCommand,
+        }),
+      ]);
+    }
+    assertStrict.deepEqual(
+      offered,
+      ["finish"],
+      "authoritative routine observation did not shrink the next turn to finish-only"
+    );
+    return assistantWithToolCalls([
+      contractCall("finish-authoritative-status", "finish", {
+        result: "The authoritative status snapshot says phone login is required and the schedule snapshot is current.",
+      }),
+    ]);
+  },
+});
+assertStrict.equal(
+  authoritativeRoutineRun.requests.length,
+  2,
+  "authoritative routine flow used more than two model requests"
+);
+assertStrict.equal(
+  authoritativeRoutineRun.events.filter(
+    (event) =>
+      event.type === "tool.started" &&
+      event.data?.toolName !== "finish"
+  ).length,
+  1,
+  "authoritative routine flow dispatched more than the canonical command"
+);
+assert(
+  authoritativeRoutineRun.events.some(
+    (event) =>
+      event.type === "tool.completed" &&
+      event.data?.toolName === "run_command" &&
+      event.data?.ok === false &&
+      event.data?.authoritativeReadOnlyRoutine === true &&
+      event.data?.authoritativeRoutineObserved === true
+  ),
+  "nonzero authoritative routine snapshot was not retained as observed evidence"
+);
+assert(
+  !authoritativeRoutineRun.events.some(
+    (event) =>
+      event.type === "tool.started" &&
+      /(?:^|[ /])(?:\\.private|private|raw|sqlite|jsonl)(?:$|[ /.-])/i.test(
+        String(event.data?.args?.command || "")
+      )
+  ),
+  "authoritative routine flow still dispatched private/raw exploratory commands"
+);
+
 const hiddenDryRun = await runToolContractCase({
   id: "native-hidden-dry-run",
   goal: "Create hidden-dry-run.txt containing unsafe if this tool dispatches.",
@@ -7647,6 +7850,7 @@ console.log(
         "finish-contract",
         "per-turn-contract-preserved",
         "schema-required-type-enum-extra",
+        "authoritative-readonly-routine-first",
         "native-hidden-dry-run-zero-dispatch",
         "text-fallback-unoffered-zero-dispatch",
         "strict-single-call-batch",

package/scripts/smoke-scs-evidence-visibility.js

@@ -637,11 +637,23 @@ assert.equal(
   "an incidental safety-clause 'cannot' was misclassified as a current external blocker"
 );
 assert.equal(finishResultClaimsIncompleteWork("Completed and verified the requested report."), false);
+assert.equal(
+  finishResultClaimsIncompleteWork(
+    "Read-only status: Still retrying: external_pdf (quality_retry_pending; next attempt at 10:14). Nothing was sent or changed."
+  ),
+  false,
+  "an external retry status was misclassified as unfinished agent work"
+);
 assert.equal(
   finishResultClaimsIncompleteWork("The task is paused. A corrected implementation will be written next."),
   true,
   "future work was accepted as a completed result"
 );
+assert.equal(
+  finishResultClaimsIncompleteWork("The requested report is pending and I will complete it next."),
+  true,
+  "agent-owned pending report work was accepted as complete"
+);
 
 const outputFilenameContract = deriveScsTaskContract({
   goal: "Save the complete cited report as `CLAIM_LEVEL_CITATION_RESEARCH.md` and include `negative evidence` in the report.",

package/scripts/smoke-skills.js

@@ -132,6 +132,12 @@ for (const unrelated of [
 }
 assert(selectedIds("debug Docker deployment logs and port config").includes("devops-deployment"), "devops prompt did not select devops-deployment");
 assert(selectedIds("review auth security and secrets handling").includes("security-review"), "security prompt did not select security-review");
+const securitySkill = skills.find((skill) => skill.id === "security-review");
+assert(
+  securitySkill?.body.includes("carriage-return, newline") &&
+    securitySkill?.body.includes("residual risks and non-goals"),
+  "security skill omitted audit-record injection or structured security-note guidance"
+);
 assert(selectedIds("make a PowerPoint pitch deck").includes("presentation-slides"), "slides prompt did not select presentation-slides");
 const presentationSkill = skills.find((skill) => skill.id === "presentation-slides");
 assert(presentationSkill?.body.includes("Render every slide"), "presentation skill does not require every slide to be rendered");