agent-control-plane 0.1.0

package/tools/templates/pr-review-template.md

@@ -0,0 +1,62 @@
+You are the PR review and final-merge worker for `{REPO_SLUG}`.
+
+Before making any decision:
+
+1. Read `{REPO_ROOT}/AGENTS.md` and any repo-specific conventions or design docs relevant to the PR.
+2. Do not edit product code in this worktree. This is review and final-review only.
+3. Never run dependency bootstrap or workspace-mutating commands here.
+
+PR metadata:
+
+- PR: {PR_NUMBER} - {PR_TITLE}
+- URL: {PR_URL}
+- Base branch: {PR_BASE_REF}
+- Head branch: {PR_HEAD_REF}
+- Linked issue: {PR_LINKED_ISSUE_ID}
+- Risk classification: {PR_RISK}
+- Risk reason: {PR_RISK_REASON}
+- Review lane: {PR_AGENT_LANE}
+- Double-check stage: {PR_DOUBLE_CHECK_STAGE}
+- Review intent: {PR_REVIEW_STAGE_TEXT}
+- Merge state: {PR_MERGE_STATE_STATUS}
+- Infra-only CI bypass active: {PR_CHECKS_BYPASSED}
+
+Current GitHub checks:
+{PR_CHECKS_TEXT}
+
+Changed files:
+{PR_FILES_TEXT}
+
+PR body:
+{PR_BODY}
+
+Required flow:
+
+1. Stay local to this worktree. Do not rely on live GitHub mutations from inside the worker.
+2. Treat every review pass as independent, even if another agent reviewed this PR earlier.
+3. Review the diff for correctness, regressions, and mismatch with the PR summary:
+   - `openspec list` if the repo uses OpenSpec
+   - `git diff --stat origin/main...HEAD`
+   - `git diff --check origin/main...HEAD`
+   - if the diff includes locale resources, run the repo's locale validation command if one exists
+   - if the PR would touch too many non-test product files, treat that as a scope blocker and request a split
+   - if the PR changes auth, login, session, reset, or identity normalization paths, verify legacy flows still remain safe
+   - if the PR changes or removes a public endpoint, public route, or operator-visible workflow, search downstream consumers in `scripts/`, `docs/`, and specs before approving
+   - if a local command fails only because the detached review worktree lacks linked dependencies, treat that as an environment note rather than a product blocker
+4. If you find a concrete problem or verification fails:
+   - If GitHub checks are failing only because of infrastructure-only startup failures and `Infra-only CI bypass active` is `true`, do not block solely on those remote checks.
+   - Save a short blocker summary to `$ACP_RUN_DIR/pr-comment.md` with the exact heading `## PR final review blocker`.
+   - Write `$ACP_RESULT_FILE` exactly like this:
+     ```bash
+     cat > "$ACP_RESULT_FILE" <<'EOF'
+     OUTCOME=blocked
+     ACTION=requested-changes-or-blocked
+     PR_NUMBER={PR_NUMBER}
+     ISSUE_ID={PR_LINKED_ISSUE_ID}
+     EOF
+     ```
+5. If the PR is safe and your local final review passes:
+   - for `double-check-1`, write `OUTCOME=approved-local-review-passed` with `ACTION=host-advance-double-check-2`
+   - for `double-check-2` or `automerge`, write `OUTCOME=approved-local-review-passed` with `ACTION=host-approve-and-merge`
+   - for `human-review`, keep the same outcome and use `ACTION=host-await-human-review`
+6. Exit after recording the result file. The host reconciler owns the final transition.

package/tools/templates/scheduled-issue-prompt-template.md

@@ -0,0 +1,62 @@
+# Task
+
+Run the scheduled verification task for issue #{ISSUE_ID} in `{REPO_SLUG}`.
+
+# Issue Context
+
+- Title: {ISSUE_TITLE}
+- URL: {ISSUE_URL}
+
+{ISSUE_BODY}
+{ISSUE_BLOCKER_CONTEXT}
+
+# Scheduled Task Rules
+
+- This is a scheduled check/report cycle, not an implementation cycle.
+- Do not modify code, do not create a commit, do not open a PR, and do not change production state.
+- Use the issue body as the source of truth for what to verify and which commands or checks to run.
+- If the issue body is too vague to run a safe scheduled check, treat that as an alert and report it instead of inventing scope.
+- Work only inside the dedicated worktree for this issue.
+- The dedicated worktree may use an agent branch name. That is acceptable for scheduled checks.
+- The host prepared this run against baseline commit `{ISSUE_BASELINE_HEAD_SHA}`. Treat that fixed SHA as the source of truth for the run.
+- Before commands start, confirm the dedicated worktree `HEAD` exactly matches `{ISSUE_BASELINE_HEAD_SHA}`.
+- The host may prepare linked dependencies or generated artifacts that are expected for this scheduled run.
+- Only alert if the checked-out commit is wrong or if there are unexpected tracked or untracked product changes beyond those expected worker artifacts.
+
+# Verification
+
+- Run the narrowest commands or health checks that satisfy the scheduled task.
+- Prefer deterministic read-only commands.
+- For prod or system-health checks, do not perform destructive operations.
+- Retry transient network-dependent failures before declaring an alert unless the issue defines a stricter rule.
+- Capture concrete pass/fail evidence: commands run, key output, and the main signal you relied on.
+
+# Result Contract
+
+- Write `$ACP_RUN_DIR/issue-comment.md` with a short Markdown report containing:
+  - `## Scheduled check result`
+  - `Outcome: pass` or `Outcome: alert`
+  - `Commands run`
+  - `Evidence`
+  - `Next due behavior remains host-controlled by schedule`
+- If everything is healthy, write `$ACP_RESULT_FILE` exactly like this:
+  ```bash
+  cat > "$ACP_RESULT_FILE" <<'EOF'
+  OUTCOME=reported
+  ACTION=host-comment-scheduled-report
+  ISSUE_ID={ISSUE_ID}
+  EOF
+  ```
+- If any check fails, the schedule definition is ambiguous, credentials are missing, or you detect a regression, still report instead of blocking the lane. Write `$ACP_RESULT_FILE` exactly like this:
+  ```bash
+  cat > "$ACP_RESULT_FILE" <<'EOF'
+  OUTCOME=reported
+  ACTION=host-comment-scheduled-alert
+  ISSUE_ID={ISSUE_ID}
+  EOF
+  ```
+
+# Stop
+
+- Stop after writing the Markdown report and the result file.
+- The host reconciler will post the report comment, keep the issue open, clean the session, and let the next run be driven by the stored schedule.

package/tools/tests/test-agent-control-plane-npm-cli.sh

@@ -0,0 +1,279 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FLOW_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+CLI_SCRIPT="${FLOW_ROOT}/npm/bin/agent-control-plane.js"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "${tmpdir}"' EXIT
+
+platform_home="${tmpdir}/platform"
+home_dir="${tmpdir}/home"
+fake_bin="${tmpdir}/fake-bin"
+mkdir -p "${platform_home}" "${home_dir}"
+mkdir -p "${fake_bin}"
+
+cat >"${fake_bin}/gh" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "${1:-}" == "auth" && "${2:-}" == "status" ]]; then
+  echo "gh auth ok"
+  exit 0
+fi
+
+if [[ "${1:-}" == "auth" && "${2:-}" == "login" ]]; then
+  echo "gh auth login stub"
+  exit 0
+fi
+
+echo "gh stub: unsupported invocation: $*" >&2
+exit 0
+EOF
+
+cat >"${fake_bin}/jq" <<'EOF'
+#!/usr/bin/env bash
+exit 0
+EOF
+
+cat >"${fake_bin}/codex" <<'EOF'
+#!/usr/bin/env bash
+if [[ "${1:-}" == "--version" ]]; then
+  echo "codex stub 0.0.0"
+  exit 0
+fi
+
+if [[ "${1:-}" == "login" && "${2:-}" == "status" ]]; then
+  echo "codex login ok"
+  exit 0
+fi
+
+echo "codex stub"
+exit 0
+EOF
+
+chmod +x "${fake_bin}/gh" "${fake_bin}/jq" "${fake_bin}/codex"
+
+help_output="$(
+  HOME="${home_dir}" \
+  AGENT_PLATFORM_HOME="${platform_home}" \
+  node "${CLI_SCRIPT}" help
+)"
+
+grep -q '^Usage:$' <<<"${help_output}"
+grep -q '^  setup' <<<"${help_output}"
+grep -q '^  sync' <<<"${help_output}"
+grep -q '^  profile-smoke' <<<"${help_output}"
+grep -q '^  launchd-install' <<<"${help_output}"
+grep -q '^  remove' <<<"${help_output}"
+
+version_output="$(
+  HOME="${home_dir}" \
+  AGENT_PLATFORM_HOME="${platform_home}" \
+  node "${CLI_SCRIPT}" version
+)"
+
+grep -q '^0\.1\.0$' <<<"${version_output}"
+
+HOME="${home_dir}" \
+AGENT_PLATFORM_HOME="${platform_home}" \
+node "${CLI_SCRIPT}" sync >/dev/null
+
+test -f "${platform_home}/runtime-home/skills/openclaw/agent-control-plane/SKILL.md"
+test -f "${platform_home}/runtime-home/tools/bin/flow-runtime-doctor.sh"
+test -f "${platform_home}/runtime-home/skills/openclaw/agent-control-plane/tools/bin/codex-quota"
+test -f "${platform_home}/runtime-home/skills/openclaw/agent-control-plane/tools/vendor/codex-quota-manager/scripts/auto-switch.sh"
+
+doctor_output="$(
+  HOME="${home_dir}" \
+  AGENT_PLATFORM_HOME="${platform_home}" \
+  node "${CLI_SCRIPT}" doctor
+)"
+
+grep -q '^CONTROL_PLANE_NAME=agent-control-plane$' <<<"${doctor_output}"
+grep -q '^SOURCE_READY=yes$' <<<"${doctor_output}"
+
+init_output="$(
+  HOME="${home_dir}" \
+  AGENT_PLATFORM_HOME="${platform_home}" \
+  node "${CLI_SCRIPT}" init \
+    --profile-id alpha \
+    --repo-slug example-owner/alpha \
+    --allow-missing-repo \
+    --skip-anchor-sync \
+    --skip-workspace-sync
+)"
+
+grep -q '^PROJECT_INIT_STATUS=ok$' <<<"${init_output}"
+grep -q '^PROFILE_ID=alpha$' <<<"${init_output}"
+grep -q "^RUNTIME_HOME=${platform_home}/runtime-home$" <<<"${init_output}"
+
+profile_smoke_output="$(
+  HOME="${home_dir}" \
+  AGENT_PLATFORM_HOME="${platform_home}" \
+  node "${CLI_SCRIPT}" profile-smoke --profile-id alpha
+)"
+
+grep -q '^PROFILE_ID=alpha$' <<<"${profile_smoke_output}"
+grep -q '^PROFILE_STATUS=ok$' <<<"${profile_smoke_output}"
+
+runtime_status_output="$(
+  HOME="${home_dir}" \
+  AGENT_PLATFORM_HOME="${platform_home}" \
+  node "${CLI_SCRIPT}" runtime status --profile-id alpha
+)"
+
+grep -q '^PROFILE_ID=alpha$' <<<"${runtime_status_output}"
+grep -q "^CONFIG_YAML=${platform_home}/control-plane/profiles/alpha/control-plane.yaml$" <<<"${runtime_status_output}"
+
+launchd_help="$(
+  HOME="${home_dir}" \
+  AGENT_PLATFORM_HOME="${platform_home}" \
+  node "${CLI_SCRIPT}" launchd-install --help
+)"
+
+grep -q '^Usage:$' <<<"${launchd_help}"
+
+remove_help="$(
+  HOME="${home_dir}" \
+  AGENT_PLATFORM_HOME="${platform_home}" \
+  node "${CLI_SCRIPT}" remove --help
+)"
+
+grep -q '^Usage:$' <<<"${remove_help}"
+
+setup_help="$(
+  HOME="${home_dir}" \
+  AGENT_PLATFORM_HOME="${platform_home}" \
+  node "${CLI_SCRIPT}" setup --help
+)"
+
+grep -q -- '--install-missing-deps' <<<"${setup_help}"
+grep -q -- '--no-install-missing-deps' <<<"${setup_help}"
+grep -q -- '--install-missing-backend' <<<"${setup_help}"
+grep -q -- '--no-install-missing-backend' <<<"${setup_help}"
+grep -q -- '--gh-auth-login' <<<"${setup_help}"
+grep -q -- '--no-gh-auth-login' <<<"${setup_help}"
+grep -q -- '--dry-run' <<<"${setup_help}"
+grep -q -- '--plan' <<<"${setup_help}"
+grep -q -- '--json' <<<"${setup_help}"
+
+setup_repo="${tmpdir}/setup-demo"
+mkdir -p "${setup_repo}"
+git -C "${setup_repo}" init -q -b main
+git -C "${setup_repo}" config user.name "ACP Test"
+git -C "${setup_repo}" config user.email "acp-test@example.com"
+printf '# setup demo\n' >"${setup_repo}/README.md"
+git -C "${setup_repo}" add README.md
+git -C "${setup_repo}" commit -q -m "init"
+git -C "${setup_repo}" remote add origin "https://github.com/example-owner/setup-demo.git"
+
+setup_output="$(
+  HOME="${home_dir}" \
+  AGENT_PLATFORM_HOME="${platform_home}" \
+  PATH="${fake_bin}:${PATH}" \
+  node "${CLI_SCRIPT}" setup \
+    --non-interactive \
+    --repo-root "${setup_repo}" \
+    --no-start-runtime \
+    --skip-anchor-sync \
+    --skip-workspace-sync
+)"
+
+grep -q '^SETUP_STATUS=ok$' <<<"${setup_output}"
+grep -q '^PROFILE_ID=setup-demo$' <<<"${setup_output}"
+grep -q '^REPO_SLUG=example-owner/setup-demo$' <<<"${setup_output}"
+grep -q '^CODING_WORKER=' <<<"${setup_output}"
+grep -q '^CORE_TOOLS_STATUS=ok$' <<<"${setup_output}"
+grep -q '^WORKER_BACKEND_COMMAND=' <<<"${setup_output}"
+grep -q '^WORKER_BACKEND_STATUS=ok$' <<<"${setup_output}"
+grep -q '^WORKER_SETUP_GUIDE_STATUS=' <<<"${setup_output}"
+grep -q '^WORKER_BACKEND_INSTALL_STATUS=' <<<"${setup_output}"
+grep -q '^WORKER_SETUP_DOCS_OPENED=' <<<"${setup_output}"
+grep -q '^WORKER_BACKEND_DOCS_URL=' <<<"${setup_output}"
+grep -q '^WORKER_BACKEND_AUTH_EXAMPLE=' <<<"${setup_output}"
+grep -q '^WORKER_BACKEND_VERIFY_EXAMPLE=' <<<"${setup_output}"
+grep -q '^GITHUB_AUTH_STATUS=' <<<"${setup_output}"
+grep -q '^FINAL_FIXUP_STATUS=' <<<"${setup_output}"
+grep -q '^FINAL_FIXUP_ACTIONS=' <<<"${setup_output}"
+grep -q '^DEPENDENCY_INSTALL_STATUS=' <<<"${setup_output}"
+grep -q '^GITHUB_AUTH_STEP_STATUS=' <<<"${setup_output}"
+grep -q '^PROJECT_INIT_STATUS=ok$' <<<"${setup_output}"
+grep -q '^DOCTOR_STATUS=ok$' <<<"${setup_output}"
+grep -q '^RUNTIME_START_STATUS=skipped$' <<<"${setup_output}"
+grep -q '^RUNTIME_START_REASON=not-requested$' <<<"${setup_output}"
+test -f "${platform_home}/control-plane/profiles/setup-demo/control-plane.yaml"
+
+setup_dry_run_output="$(
+  HOME="${home_dir}" \
+  AGENT_PLATFORM_HOME="${platform_home}" \
+  PATH="${fake_bin}:${PATH}" \
+  node "${CLI_SCRIPT}" setup \
+    --dry-run \
+    --non-interactive \
+    --repo-root "${setup_repo}" \
+    --no-start-runtime \
+    --skip-anchor-sync \
+    --skip-workspace-sync
+)"
+
+grep -q '^SETUP_STATUS=dry-run$' <<<"${setup_dry_run_output}"
+grep -q '^SETUP_MODE=dry-run$' <<<"${setup_dry_run_output}"
+grep -q '^PROJECT_INIT_STATUS=would-run$' <<<"${setup_dry_run_output}"
+grep -q '^DOCTOR_STATUS=would-run$' <<<"${setup_dry_run_output}"
+grep -q '^FINAL_FIXUP_STATUS=planned$' <<<"${setup_dry_run_output}"
+grep -q '^FINAL_FIXUP_ACTIONS=review-plan$' <<<"${setup_dry_run_output}"
+
+setup_json_output="$(
+  HOME="${home_dir}" \
+  AGENT_PLATFORM_HOME="${platform_home}" \
+  PATH="${fake_bin}:${PATH}" \
+  node "${CLI_SCRIPT}" setup \
+    --json \
+    --repo-root "${setup_repo}" \
+    --profile-id setup-json \
+    --no-start-runtime \
+    --skip-anchor-sync \
+    --skip-workspace-sync
+)"
+
+printf '%s' "${setup_json_output}" | node -e '
+  const fs = require("fs");
+  const data = JSON.parse(fs.readFileSync(0, "utf8"));
+  if (data.setupStatus !== "ok") process.exit(1);
+  if (data.setupMode !== "run") process.exit(1);
+  if (data.profileId !== "setup-json") process.exit(1);
+  if (data.projectInitStatus !== "ok") process.exit(1);
+  if (data.doctorStatus !== "ok") process.exit(1);
+  if (!data.workerBackend || !data.githubAuth || !data.finalFixup) process.exit(1);
+'
+
+setup_dry_run_json_output="$(
+  HOME="${home_dir}" \
+  AGENT_PLATFORM_HOME="${platform_home}" \
+  PATH="${fake_bin}:${PATH}" \
+  node "${CLI_SCRIPT}" setup \
+    --json \
+    --dry-run \
+    --repo-root "${setup_repo}" \
+    --profile-id dry-run-json \
+    --no-start-runtime \
+    --skip-anchor-sync \
+    --skip-workspace-sync
+)"
+
+printf '%s' "${setup_dry_run_json_output}" | node -e '
+  const fs = require("fs");
+  const data = JSON.parse(fs.readFileSync(0, "utf8"));
+  if (data.setupStatus !== "dry-run") process.exit(1);
+  if (data.setupMode !== "dry-run") process.exit(1);
+  if (data.profileId !== "dry-run-json") process.exit(1);
+  if (data.projectInitStatus !== "would-run") process.exit(1);
+  if (data.doctorStatus !== "would-run") process.exit(1);
+  if (!data.finalFixup || data.finalFixup.status !== "planned") process.exit(1);
+  if (data.dependencyInstall && data.dependencyInstall.status === "not-needed" && data.dependencyInstall.command !== "") process.exit(1);
+  if (data.workerBackend && data.workerBackend.installStatus === "not-needed" && data.workerBackend.installCommand !== "") process.exit(1);
+'
+
+test ! -e "${platform_home}/control-plane/profiles/dry-run-json/control-plane.yaml"

package/tools/tests/test-agent-github-update-labels-falls-back-to-repository-id.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SCRIPT_SRC="${FLOW_ROOT}/tools/bin/agent-github-update-labels"
+CONFIG_LIB_SRC="${FLOW_ROOT}/tools/bin/flow-config-lib.sh"
+SHELL_LIB_SRC="${FLOW_ROOT}/tools/bin/flow-shell-lib.sh"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+bin_dir="$tmpdir/bin"
+payload_file="$tmpdir/payload.json"
+mkdir -p "$bin_dir"
+
+cp "$SCRIPT_SRC" "$bin_dir/agent-github-update-labels"
+cp "$CONFIG_LIB_SRC" "$bin_dir/flow-config-lib.sh"
+cp "$SHELL_LIB_SRC" "$bin_dir/flow-shell-lib.sh"
+
+cat >"$bin_dir/gh" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "${1:-}" == "api" ]]; then
+  route="${2:-}"
+  if [[ "$route" == "repos/example/demo/issues/42" ]]; then
+    echo '{"message":"Not Found"}' >&2
+    exit 1
+  fi
+  if [[ "$route" == user/repos\?* ]]; then
+    printf '[[{"id":123,"full_name":"example/demo"}]]\n'
+    exit 0
+  fi
+  if [[ "$route" == "repositories/123/issues/42" ]]; then
+    if [[ " $* " == *" --method PATCH "* ]]; then
+      cat >"${TEST_PAYLOAD_FILE:?}"
+      exit 0
+    fi
+    printf '{"labels":[{"name":"agent-blocked"}]}\n'
+    exit 0
+  fi
+fi
+
+echo "unexpected gh invocation: $*" >&2
+exit 1
+EOF
+chmod +x "$bin_dir/gh" "$bin_dir/agent-github-update-labels"
+
+TEST_PAYLOAD_FILE="$payload_file" \
+PATH="$bin_dir:$PATH" \
+bash "$bin_dir/agent-github-update-labels" --repo-slug example/demo --number 42 --add agent-running --remove agent-blocked
+
+test "$(jq -r '.labels[0]' "$payload_file")" = "agent-running"
+test "$(jq '.labels | length' "$payload_file")" -eq 1
+
+echo "agent github update labels falls back to repository id test passed"

package/tools/tests/test-agent-project-claude-session-wrapper-clears-stale-sandbox-artifacts.sh

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SESSION_SRC="${FLOW_ROOT}/tools/bin/agent-project-run-claude-session"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+tools_dir="$tmpdir/tools"
+bin_dir="$tmpdir/bin"
+worktree="$tmpdir/worktree"
+runs_root="$tmpdir/runs"
+prompt_file="$tmpdir/prompt.md"
+session="acp-claude-stale-sandbox"
+run_dir="$runs_root/$session"
+sandbox_run_dir="$worktree/.openclaw-artifacts/$session"
+
+mkdir -p "$tools_dir" "$bin_dir" "$worktree" "$runs_root" "$sandbox_run_dir"
+cp "$SESSION_SRC" "$tools_dir/agent-project-run-claude-session"
+
+printf 'stale-result\n' >"$sandbox_run_dir/result.env"
+printf '{"timestamp":"old","status":"pass","command":"stale verification"}\n' >"$sandbox_run_dir/verification.jsonl"
+printf 'stale blocker\n' >"$sandbox_run_dir/issue-comment.md"
+
+cat >"$bin_dir/claude" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+cat >"${ACP_RESULT_FILE:?}" <<'RESULT'
+OUTCOME=implemented
+ACTION=host-publish-issue-pr
+RESULT
+printf '{"timestamp":"new","status":"pass","command":"fresh verification"}\n' >"${ACP_RUN_DIR:?}/verification.jsonl"
+printf 'mock claude finished\n'
+EOF
+
+chmod +x "$tools_dir/agent-project-run-claude-session" "$bin_dir/claude"
+
+git -C "$worktree" init -b test >/dev/null 2>&1
+printf 'Prompt body\n' >"$prompt_file"
+
+PATH="$bin_dir:$PATH" \
+bash "$tools_dir/agent-project-run-claude-session" \
+  --mode safe \
+  --session "$session" \
+  --worktree "$worktree" \
+  --prompt-file "$prompt_file" \
+  --runs-root "$runs_root" \
+  --adapter-id alpha \
+  --task-kind issue \
+  --task-id 123 \
+  --claude-model sonnet \
+  --claude-permission-mode dontAsk \
+  --claude-effort high \
+  --collect-file verification.jsonl \
+  --collect-file issue-comment.md \
+  >/dev/null
+
+for _ in $(seq 1 50); do
+  if ! tmux has-session -t "$session" 2>/dev/null; then
+    break
+  fi
+  sleep 0.2
+done
+
+if tmux has-session -t "$session" 2>/dev/null; then
+  echo "tmux session did not exit" >&2
+  exit 1
+fi
+
+test -f "$run_dir/result.env"
+test -f "$run_dir/verification.jsonl"
+grep -q '^OUTCOME=implemented$' "$run_dir/result.env"
+grep -q 'fresh verification' "$run_dir/verification.jsonl"
+if grep -q 'stale verification' "$run_dir/verification.jsonl"; then
+  echo "stale verification entry leaked into claude cycle" >&2
+  exit 1
+fi
+if [[ -e "$run_dir/issue-comment.md" ]]; then
+  echo "stale claude issue comment leaked into host run dir" >&2
+  exit 1
+fi
+if [[ -e "$sandbox_run_dir/issue-comment.md" ]]; then
+  echo "stale claude sandbox comment artifact was not cleared" >&2
+  exit 1
+fi
+
+echo "agent-project claude session wrapper clears stale sandbox artifacts test passed"

package/tools/tests/test-agent-project-claude-session-wrapper-does-not-retry-provider-quota.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FLOW_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SESSION_SRC="${FLOW_ROOT}/tools/bin/agent-project-run-claude-session"
+
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+tools_dir="$tmpdir/tools"
+bin_dir="$tmpdir/bin"
+worktree="$tmpdir/worktree"
+runs_root="$tmpdir/runs"
+prompt_file="$tmpdir/prompt.md"
+session="acp-issue-claude-provider-quota"
+run_dir="$runs_root/$session"
+
+mkdir -p "$tools_dir" "$bin_dir" "$worktree" "$runs_root"
+cp "$SESSION_SRC" "$tools_dir/agent-project-run-claude-session"
+
+cat >"$bin_dir/claude" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+attempt_file="${ACP_HOST_RUN_DIR:?}/attempt-count"
+attempt="0"
+if [[ -f "$attempt_file" ]]; then
+  attempt="$(cat "$attempt_file")"
+fi
+attempt="$((attempt + 1))"
+printf '%s' "$attempt" >"$attempt_file"
+
+printf '429 rate limit exceeded\n' >&2
+exit 1
+EOF
+
+chmod +x "$tools_dir/agent-project-run-claude-session" "$bin_dir/claude"
+
+git -C "$worktree" init -b test >/dev/null 2>&1
+printf 'Prompt body\n' >"$prompt_file"
+
+PATH="$bin_dir:$PATH" \
+bash "$tools_dir/agent-project-run-claude-session" \
+  --mode safe \
+  --session "$session" \
+  --worktree "$worktree" \
+  --prompt-file "$prompt_file" \
+  --runs-root "$runs_root" \
+  --adapter-id alpha \
+  --task-kind issue \
+  --task-id 123 \
+  --claude-model sonnet \
+  --claude-permission-mode dontAsk \
+  --claude-effort medium \
+  --claude-timeout-seconds 10 \
+  --claude-max-attempts 3 \
+  --claude-retry-backoff-seconds 0 \
+  >/dev/null
+
+for _ in $(seq 1 50); do
+  if ! tmux has-session -t "$session" 2>/dev/null; then
+    break
+  fi
+  sleep 0.2
+done
+
+if tmux has-session -t "$session" 2>/dev/null; then
+  echo "tmux session did not exit" >&2
+  exit 1
+fi
+
+grep -q '^RUNNER_STATE=failed$' "$run_dir/runner.env"
+grep -q '^ATTEMPT=1$' "$run_dir/runner.env"
+grep -q '^RESUME_COUNT=0$' "$run_dir/runner.env"
+grep -q '^1$' "$run_dir/attempt-count"
+if grep -q '\[claude-retry\]' "$run_dir/$session.log"; then
+  echo "provider quota failure unexpectedly retried" >&2
+  exit 1
+fi
+grep -q '__CLAUDE_EXIT__:1' "$run_dir/$session.log"
+
+echo "agent-project claude provider quota no-retry test passed"