ai-engineering-loop 1.0.7 → 1.0.9

package/.claude/agents/devil-advocate.md

@@ -7,25 +7,26 @@ model: inherit
 
 You are the Devil's Advocate for the AI Engineering Loop. You are read-only. You never modify application source and never commit.
 
-## When to invoke
+## Budget (hard stop)
 
-- **After Maker verification.** Tests passed. Review the diff against the Goal Contract.
-- **Explicit review request.** The user or orchestrator asks for a devil's advocate pass.
+Finish in at most 8 tool calls, then emit the Finding Ledger. Do not explore the rest of the repo. Do not spawn children. Do not run git log.
 
 ## Input barrier
 
-Use only the spawn prompt plus:
+Use only:
 
-- Goal Contract
-- `.ai-engineering-loop/` (`architecture.md`, `conventions.md`, `verification.md`)
-- The git diff (path in the prompt, or `git diff <base>...HEAD`)
-- Verification logs (exit code, stdout, test counts)
+1. The diff file path in the spawn prompt. Read that file first. Do not run git diff if a diff path was given.
+2. Goal Contract path (if given).
+3. Verification log path (if given).
+4. At most 8 source files that appear as paths in the diff.
 
-Do not ask for Maker rationale. Do not treat parent narration as evidence.
+Skip: `*.css`, files named like `*-css.ts` or `report-css.ts`, generated/vendor dirs, and any file where the diff hunk already contains enough evidence. Prefer quoting the hunk over opening the whole file.
+
+Do not ask for Maker rationale.
 
 ## Output
 
-Return a Finding Ledger as a fenced JSON block:
+Return a Finding Ledger as a fenced JSON block and stop:
 
 ```json
 {
@@ -42,19 +43,11 @@ Return a Finding Ledger as a fenced JSON block:
       "acceptanceCriteria": "AC-1",
       "failureScenario": "Concrete failing case",
       "reproduction": "Steps to reproduce",
-      "evidence": "What you read in the diff or source",
+      "evidence": "Hunk or line you read",
       "concreteAlternativeDiff": "diff snippet"
     }
   ]
 }
 ```
 
-Rules:
-
-- `validity` is VALID or INVALID.
-- `severity` is BLOCKER, HIGH, MEDIUM, or LOW.
-- `disposition` is STRONG, ACCEPTABLE, or WEAK.
-- Every VALID BLOCKER or HIGH finding must include `concreteAlternativeDiff`.
-- Empty `findings` is allowed when the diff is clean against the Goal Contract.
-
-Use Read, Grep, Glob, and read-only Bash (`git diff`, `git log`, `git show`). Do not write files.
+Rules: validity VALID or INVALID; severity BLOCKER, HIGH, MEDIUM, or LOW; disposition STRONG, ACCEPTABLE, or WEAK. VALID BLOCKER or HIGH must include concreteAlternativeDiff. Empty findings is allowed.

package/.claude/agents/judge.md

@@ -46,4 +46,4 @@ Return a fenced JSON block:
 
 `verdict` must be exactly PASS, ITERATE, or ESCALATE.
 
-Use Read and read-only git. Do not edit source.
+Budget: at most 4 tool calls. Read the ledger and Goal Contract first. Open source only to fact-check a cited location. Do not run git log. Do not edit source.

package/.claude/commands/ai-engineering-loop.md

@@ -1,10 +1,11 @@
 ---
 name: ai-engineering-loop
 description: Run the AI Engineering Loop (init, status, refresh, or full Maker then Devil's Advocate then Judge).
+allowed-tools: "Read, Grep, Glob, Edit, Write, Task, Bash(npm run *), Bash(npm test *), Bash(npx *), Bash(git *)"
 ---
 
 Follow `.claude/skills/ai-engineering-loop/SKILL.md`.
 
-Use the Task tool for Devil's Advocate and Judge. Pass only subagent_type, description, and prompt.
+Use the Task tool for Devil's Advocate and Judge. Pass subagent_type, description, and prompt. If the schema includes run_in_background, set it false. Wait for each Task to finish. Write the git diff to a file and pass that path; do not let the reviewer roam the repo.
 
 Arguments: init, status, refresh, or a task description.

package/.claude/skills/ai-engineering-loop/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: ai-engineering-loop
 description: Use when the user runs /ai-engineering-loop, asks to init or refresh living project context, or wants the Maker / Devil's Advocate / Judge engineering loop on Claude Code.
+allowed-tools: "Read, Grep, Glob, Edit, Write, Task, Bash(npm run *), Bash(npm test *), Bash(npx *), Bash(git *)"
 ---
 
 # AI Engineering Loop (Claude Code)
@@ -16,8 +17,10 @@ Claude Code talks to strict proxies (including Kiro). Follow this exactly:
    - `subagent_type`
    - `description`
    - `prompt`
+   - `run_in_background: false` only if that key exists on the Task schema. Never invent other keys.
 3. Do **not** add any other keys. Extra keys make Kiro return HTTP 400 `REQUEST_BODY_INVALID`.
 4. If no Task/Agent tool exists, review in this session and label it `CONTEXT_ISOLATION_ONLY`. Do not invent a tool name.
+5. If Bash or Write returns "cannot determine the safety" or HTTP 400 REQUEST_BODY_INVALID: stop that tool. Do not retry it. Continue with Read, Grep, and Glob. Tell the user to switch off auto permission mode (use default) or add a permissions.allow rule for the verification command, then start a new session.
 
 ## Commands
 
@@ -32,9 +35,12 @@ Parent session is Maker plus orchestrator. Spawn Devil's Advocate and Judge as *
 2. Stage 1: write a Goal Contract. Schema: `core/goal-contract.md`.
 3. Stages 2-4: Maker work in the parent. Surgical diff plus tests.
 4. Stage 5: run commands from `.ai-engineering-loop/verification.md`. Keep command, exit code, stdout, test counts. Vague "seems green" is invalid.
-5. Write artifact paths (Goal Contract, diff, verification log). Put those paths in child prompts. Do not paste Maker rationale.
-6. Stage 6: Task `subagent_type: devil-advocate` (fallback `general-purpose`). Prompt: artifact paths plus Finding Ledger contract from `agents/devil-advocate.md`.
-7. Stage 7: Task `subagent_type: judge` (fallback `general-purpose`). Prompt: Goal Contract, verification evidence, Finding Ledger. Verdict is PASS, ITERATE, or ESCALATE.
+5. Write artifacts, then spawn. Before Devil's Advocate:
+   - Write `git diff` to a file (for example `.ai-engineering-loop/tasks/current.diff`).
+   - Write changed paths (`git diff --name-only`) into the Task prompt as a short list.
+   - Put those paths in the child prompt. Do not paste Maker rationale.
+6. Stage 6: Task `subagent_type: devil-advocate`. Use `general-purpose` only if that type is rejected. If the Task schema includes `run_in_background`, set it false. Then wait for Task to return. Do not start Judge or more Maker work until the Finding Ledger is back. Prompt: diff file path, name-only list, Goal Contract path, verification log path, and "at most 8 tool calls; read the diff file; skip css and generated files".
+7. Stage 7: Task `subagent_type: judge` the same way (wait, no background). Prompt: Goal Contract, verification evidence, Finding Ledger.
 8. ITERATE with iteration under 3: fix in the parent, re-verify, spawn a **new** Devil's Advocate (do not resume the previous child).
 9. Stage 8: delivery from `.ai-engineering-loop/adapter.md`.
 

package/.grok/agents/devil-advocate.md

@@ -15,12 +15,11 @@ never inherit Maker conversational history.
 
 ## Input barrier
 
-Use only what the parent put in the spawn prompt plus these artifacts on disk:
+Use only:
 
-- Goal Contract
-- `.ai-engineering-loop/` (`architecture.md`, `conventions.md`, `verification.md`)
-- The git diff (path in the prompt, or `git diff <base>...HEAD`)
-- Deterministic verification logs (exit code, stdout, test counts)
+1. The diff file path in the spawn prompt. Read that file first.
+2. Goal Contract path and verification log path if given.
+3. At most 8 source files that appear as paths in the diff.
 
 Do not ask the parent for Maker rationale. Do not treat parent narration as evidence.
 
@@ -62,6 +61,10 @@ Rules:
 - Every VALID BLOCKER or HIGH finding must include `concreteAlternativeDiff`.
 - Empty `findings` is allowed when the diff is clean against the Goal Contract.
 
-## Tools
+## Budget (hard stop)
 
-Use read/search and read-only shell (`git diff`, `git log`, `git show`). Do not write files. Do not spawn subagents (Grok depth limit is 1).
+Finish in at most 8 tool calls, then emit the ledger. Do not run git log. Do not spawn children.
+
+Read the diff file path from the prompt first. Do not run git diff if that path was given. Open at most 8 files that appear in the diff. Skip `*.css`, `*report-css*`, generated/vendor, and files whose hunk already proves the finding.
+
+Use read/search and read-only shell only if the diff file is missing. Do not write files.

package/.grok/skills/ai-engineering-loop/SKILL.md

@@ -51,8 +51,8 @@ Run `npx ai-engineering-loop <command>` in the target repo. Do not commit unless
    - Goal Contract path
    - `git diff <base>...HEAD` (file)
    - verification log (file)
-6. Stage 6: `spawn_subagent` Devil's Advocate. `background: false`. `capability_mode: "execute"`. Do **not** pass `resume_from`. Prompt contains only artifact paths + `agents/devil-advocate.md` output contract.
-7. Stage 7: `spawn_subagent` Judge with the ledger the DA returned plus the same artifacts. Prompt follows `agents/judge.md`.
+6. Stage 6: `spawn_subagent` Devil's Advocate. `background: false`. `capability_mode: "execute"`. Do **not** pass `resume_from`. Wait for the child. Prompt: diff file path, name-only file list, Goal Contract path, verification log path, plus "at most 8 tool calls; skip css and generated files".
+7. Stage 7: `spawn_subagent` Judge the same way (`background: false`, wait). Prompt follows `agents/judge.md`.
 8. If Judge says `ITERATE` and iteration < 3, Maker fixes in the parent, re-verify, spawn a **fresh** DA (new spawn, no resume).
 9. Stage 8: delivery adapter from `.ai-engineering-loop/adapter.md`.
 

package/README.md

@@ -6,7 +6,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/egagofur/ai-engineering-loop/pulls)
 [![AI Engineering](https://img.shields.io/badge/AI-Engineering%20Loop-orange.svg)](https://github.com/egagofur/ai-engineering-loop)
-[![Release](https://img.shields.io/badge/release-v1.0.7-purple.svg)](https://github.com/egagofur/ai-engineering-loop/releases)
+[![Release](https://img.shields.io/badge/release-v1.0.9-purple.svg)](https://github.com/egagofur/ai-engineering-loop/releases)
 
 **A Reusable, Framework-Agnostic AI Engineering Operating System for Autonomous Coding Agents**
 
@@ -201,8 +201,10 @@ API Error: 400 [kiro/claude-sonnet-5] REQUEST_BODY_INVALID
 | Loop role | Claude Code `subagent_type` | Task keys |
 |---|---|---|
 | Orchestrator / Maker | parent session | n/a |
-| Devil's Advocate | `devil-advocate` (fallback `general-purpose`) | `subagent_type`, `description`, `prompt` |
-| Judge | `judge` (fallback `general-purpose`) | `subagent_type`, `description`, `prompt` |
+| Devil's Advocate | `devil-advocate` (fallback `general-purpose`) | `subagent_type`, `description`, `prompt`, wait (no background) |
+| Judge | `judge` (fallback `general-purpose`) | same, after DA returns |
+
+Parent writes `git diff` to a file and passes that path. DA is capped at 8 tool calls and skips css/generated blobs so review does not take tens of minutes.
 
 Repo-local Claude Code files:
 
@@ -210,6 +212,8 @@ Repo-local Claude Code files:
 - `.claude/skills/ai-engineering-loop/SKILL.md`
 - `.claude/commands/ai-engineering-loop.md` → `/ai-engineering-loop`
 
+On Kiro auto mode, pre-allow verification Bash or the safety classifier 400s the session. Copy `templates/repo-config/claude-permissions.json` into the target repo `.claude/settings.local.json` `permissions.allow` list. If Bash returns "cannot determine the safety", do not retry; switch permission mode to default and start a new session.
+
 See [docs/claude-code-feasibility.md](docs/claude-code-feasibility.md).
 
 ---

package/bin/ai-engineering-loop.js

@@ -15,7 +15,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { execSync } = require('child_process');
 
-const VERSION = '1.0.7';
+const VERSION = '1.0.9';
 const CWD = process.cwd();
 const CONTEXT_DIR = path.join(CWD, '.ai-engineering-loop');
 

package/docs/claude-code-feasibility.md

@@ -21,8 +21,10 @@ This is separate from 9router bugs that reject any Anthropic `system` field. Tho
 | Loop role | Claude Code type | Task keys allowed |
 |---|---|---|
 | Orchestrator / Maker | parent session | n/a |
-| Devil's Advocate | `devil-advocate` (fallback `general-purpose`) | `subagent_type`, `description`, `prompt` |
-| Judge | `judge` (fallback `general-purpose`) | `subagent_type`, `description`, `prompt` |
+| Devil's Advocate | `devil-advocate` (fallback `general-purpose`) | `subagent_type`, `description`, `prompt`, `run_in_background: false` |
+| Judge | `judge` (fallback `general-purpose`) | same; wait for DA first |
+
+Parent must write `git diff` to a file and pass that path. DA budget: 8 tool calls, skip css/generated, no git log. Do not leave DA running in the background.
 
 Do not pass Grok keys (`spawn_subagent`, `capability_mode`, `resume_from`, `isolation`, `background`) on Claude Code.
 
@@ -40,6 +42,39 @@ Repo files:
 | Task/Agent tool present, child result returned | `TRUE_INDEPENDENT_AGENT` |
 | No subagent tool | `CONTEXT_ISOLATION_ONLY` |
 
-## 4. What stays in Grok-only files
+## 4. Second 400 path: auto-mode Bash classifier
+
+A later failure looks like this:
+
+```
+Error: kr/claude-sonnet-5 is temporarily unavailable, so auto mode
+cannot determine the safety of Bash right now.
+API Error: 400 [kiro/claude-sonnet-5] REQUEST_BODY_INVALID
+```
+
+Read/Grep still work. The first Bash that needs the auto-mode safety classifier (`npm run typecheck`, `npm test`) is sent to Kiro. When that classifier request is invalid or the model is down, Claude Code retries and Kiro returns 400.
+
+Mitigations shipped in the skill:
+
+1. `allowed-tools` pre-approves `Bash(npm run *)`, `Bash(npm test *)`, `Bash(npx *)`, `Bash(git *)` so those commands skip the classifier when the skill or slash command is active.
+2. The skill tells the model not to retry Bash/Write after a classifier or 400 failure.
+3. Project allow rules (copy into `.claude/settings.local.json`):
+
+```json
+{
+  "permissions": {
+    "allow": [
+      "Bash(npm run *)",
+      "Bash(npm test *)",
+      "Bash(npx *)",
+      "Bash(git *)"
+    ]
+  }
+}
+```
+
+If 400 still happens on a fresh session with no Bash yet, it is the 9router `system` field bug, not this package.
+
+## 5. What stays in Grok-only files
 
 Grok spawn details live in `.grok/skills/ai-engineering-loop/SKILL.md`. Claude Code must not load that file as its skill. Claude Code discovers `.claude/` first.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-engineering-loop",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "A reusable, framework-agnostic AI Engineering Operating System for autonomous coding agents.",
   "main": "bin/ai-engineering-loop.js",
   "bin": {

package/templates/repo-config/claude-permissions.json

@@ -0,0 +1,10 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(npm run *)",
+      "Bash(npm test *)",
+      "Bash(npx *)",
+      "Bash(git *)"
+    ]
+  }
+}

package/tests/skill-host-compat.test.js

@@ -23,8 +23,10 @@ function parseFrontmatter(content, label) {
 
 test('Claude Code skill is Kiro-safe: no mermaid, latex, HTML breaks, or Grok tool keys', () => {
   const content = readRepo('.claude/skills/ai-engineering-loop/SKILL.md');
-  parseFrontmatter(content, 'claude skill');
+  const { fm } = parseFrontmatter(content, 'claude skill');
 
+  assert.match(fm, /^allowed-tools:/m);
+  assert.match(fm, /Bash\(npm run \*\)/);
   assert.doesNotMatch(content, /```mermaid/);
   assert.doesNotMatch(content, /\$\\/);
   assert.doesNotMatch(content, /<br\s*\/?>/i);
@@ -35,6 +37,10 @@ test('Claude Code skill is Kiro-safe: no mermaid, latex, HTML breaks, or Grok to
   assert.match(content, /subagent_type/);
   assert.match(content, /devil-advocate/);
   assert.match(content, /\bjudge\b/);
+  assert.match(content, /cannot determine the safety/);
+  assert.match(content, /run_in_background/);
+  assert.match(content, /current\.diff/);
+  assert.match(content, /8 tool calls/);
 });
 
 test('Claude Code agents exist with Claude tool names and Finding Ledger / verdict contracts', () => {
@@ -48,14 +54,20 @@ test('Claude Code agents exist with Claude tool names and Finding Ledger / verdi
   assert.doesNotMatch(da, /spawn_subagent|capability_mode|resume_from/);
   assert.doesNotMatch(judge, /spawn_subagent|capability_mode|resume_from/);
   assert.match(da, /Finding Ledger/);
+  assert.match(da, /8 tool calls/);
+  assert.match(da, /Skip: `\*\.css`/);
+  assert.match(da, /Do not run git log/);
   assert.match(judge, /PASS/);
   assert.match(judge, /ITERATE/);
   assert.match(judge, /ESCALATE/);
+  assert.match(judge, /4 tool calls/);
 });
 
 test('Claude Code slash command does not embed Grok spawn keys', () => {
   const cmd = readRepo('.claude/commands/ai-engineering-loop.md');
-  parseFrontmatter(cmd, 'claude command');
+  const { fm } = parseFrontmatter(cmd, 'claude command');
+  assert.match(fm, /^allowed-tools:/m);
+  assert.match(fm, /Bash\(npm run \*\)/);
   assert.doesNotMatch(cmd, /spawn_subagent|capability_mode|resume_from/);
   assert.match(cmd, /ai-engineering-loop/);
 });