carthagent 1.0.7 → 1.1.0-beta.1

package/tools/test-native-slash-commands.py

@@ -0,0 +1,242 @@
+#!/usr/bin/env python3
+"""Bounded actual-slash PTY acceptance for the active Carthagent native plugin."""
+import argparse
+import fcntl
+import hashlib
+import importlib.util
+import json
+import os
+from pathlib import Path
+import pty
+import select
+import signal
+import struct
+import subprocess
+import termios
+import time
+
+def load_local_module(name, filename):
+    spec = importlib.util.spec_from_file_location(name, Path(__file__).with_name(filename))
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+Screen = load_local_module('native_terminal_semantics', 'native-terminal-semantics.py').Screen
+_env = load_local_module('native_slash_acceptance_env', 'native-slash-acceptance-env.py')
+TUI_ENV_KEYS = _env.TUI_ENV_KEYS
+assert_clean_child_environment = _env.assert_clean_child_environment
+fixture_environment = _env.fixture_environment
+
+
+class Tui:
+    def __init__(self, binary, fixture, session_id, env):
+        self.master, slave = pty.openpty()
+        self.rows, self.columns = 45, 130
+        fcntl.ioctl(slave, termios.TIOCSWINSZ,
+                    struct.pack('HHHH', self.rows, self.columns, 0, 0))
+        child_env = {**env, 'TERM': 'xterm-256color', 'COLORTERM': 'truecolor',
+                     'OPENCODE_PASSWORD': fixture['password']}
+        assert_clean_child_environment(child_env)
+        self.child = subprocess.Popen([binary, '--server', fixture['baseUrl'],
+            '--session', session_id], cwd=fixture['cwd'], env=child_env,
+            stdin=slave, stdout=slave, stderr=slave, start_new_session=True)
+        os.close(slave)
+        self.screen = Screen(rows=self.rows, columns=self.columns)
+        self.raw = bytearray()
+        self.stopped = False
+
+    def drain(self, seconds=.15):
+        end = time.monotonic() + seconds
+        while time.monotonic() < end:
+            if select.select([self.master], [], [], .04)[0]:
+                try: data = os.read(self.master, 65536)
+                except OSError: return
+                if not data: return
+                self.raw.extend(data)
+                self.screen.feed(data)
+            elif self.child.poll() is not None:
+                raise AssertionError(f'native TUI exited early: {self.child.returncode}')
+
+    def wait_for(self, predicate, description, timeout=12):
+        end = time.monotonic() + timeout
+        while time.monotonic() < end:
+            self.drain(.1)
+            if predicate():
+                self.drain(.12)
+                return
+        raise AssertionError(f'timed out waiting for {description}:\n{self.screen.visible()}')
+
+    def submit_slash(self, command, marker=None, select_next=False, extra_enter=False, use_tab=False):
+        # Native OpenCode opens slash completion on the first Enter; the second
+        # Enter accepts the exact typed command and invokes the plugin handler.
+        before = len(self.raw)
+        command_name, separator, arguments = command.partition(' ')
+        if select_next:
+            # Enter opens the duplicate command list; selecting the second exact
+            # /stats entry must dispatch the CTG handler rather than host stats.
+            os.write(self.master, command_name.encode('utf8') + b'\r')
+            self.drain(.35)
+            os.write(self.master, b'\x1b[B\x1b[B')
+            self.drain(.2)
+            os.write(self.master, b'\r')
+        else:
+            os.write(self.master, command_name.encode('utf8'))
+            self.drain(.35)
+            os.write(self.master, b'\t')
+            self.drain(.15)
+            if separator:
+                os.write(self.master, (' ' + arguments).encode('utf8'))
+                self.drain(.12)
+            os.write(self.master, b'\r')
+        if extra_enter:
+            self.drain(.12)
+            os.write(self.master, b'\r')
+        if marker:
+            self.wait_for(lambda: marker in self.screen.visible(), f'dispatched {command}')
+        return {'typed': command, 'ptyBytes': len(self.raw) - before,
+                'visibleTail': self.screen.visible()[-500:]}
+
+    def send_prompt(self, text, marker):
+        os.write(self.master, text.encode('utf8') + b'\r')
+        self.wait_for(lambda: marker in self.screen.visible(), f'assistant marker {marker}')
+
+    def stop(self):
+        if self.stopped:
+            return
+        self.stopped = True
+        if self.child.poll() is None:
+            try: os.killpg(self.child.pid, signal.SIGTERM)
+            except ProcessLookupError: pass
+            try: self.child.wait(timeout=4)
+            except subprocess.TimeoutExpired:
+                os.killpg(self.child.pid, signal.SIGKILL)
+                self.child.wait(timeout=4)
+        try: os.close(self.master)
+        except OSError: pass
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--binary', required=True)
+    parser.add_argument('--owned-root', required=True)
+    parser.add_argument('--release-manifest', required=True)
+    parser.add_argument('--fixture', required=True, help='JSON line emitted by native-fixture.mjs')
+    parser.add_argument('--artifact')
+    args = parser.parse_args()
+    fixture = json.loads(Path(args.fixture).read_text())
+    env = fixture_environment(os.environ, Path(fixture['temp']) / 'tui-home',
+                             Path(args.owned_root).resolve(),
+                             Path(args.release_manifest).resolve())
+    env = {key: value for key, value in env.items() if key in TUI_ENV_KEYS}
+    env['OPENCODE_SERVER_PASSWORD'] = fixture['password']
+    env['OPENCODE_SERVER_USERNAME'] = 'opencode'
+    assert_clean_child_environment(env)
+    binary = str(Path(args.binary).resolve())
+    digest = hashlib.sha256(Path(binary).read_bytes()).hexdigest()
+    tui = Tui(binary, fixture, fixture['sessionID'], env)
+    checks = {}
+    try:
+        tui.wait_for(lambda: '┃' in tui.screen.visible(), 'active session composer')
+        if 'getting started' in tui.screen.visible().lower():
+            for _ in range(2):
+                os.write(tui.master, b'\x1b')
+                tui.drain(.25)
+        tui.send_prompt('SLASH_FIXTURE_SEED <script>alert("x")</script> & "quoted"',
+                        'FIXTURE_REPLY')
+
+        export_name = 'slash-acceptance.html'
+        checks['exportDispatch'] = tui.submit_slash(f'/export {export_name}', 'Session exported')
+        exported = Path(fixture['cwd']) / export_name
+        end = time.monotonic() + 8
+        while not exported.exists() and time.monotonic() < end: time.sleep(.05)
+        html = exported.read_text(encoding='utf8')
+        assert '&lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt; &amp; &quot;quoted&quot;' in html
+        assert '<script>alert("x")</script>' not in html
+        checks['exportHtmlEscapesFullConversation'] = {'path': export_name,
+            'bytes': exported.stat().st_size, 'escapedPromptPresent': True,
+            'activeScriptAbsent': True, 'completeDocument': html.startswith('<!doctype html>') and html.endswith('</html>')}
+
+        stats_start = len(tui.raw)
+        os.write(tui.master, b'/stats')
+        tui.drain(.3)
+        stats_result = tui.submit_slash('/stats details')
+        tui.drain(.2)
+        visible = tui.screen.visible()
+        stats_status = 'PASS' if 'Input tokens: not reported' in visible and 'Cost: not reported' in visible else 'FAIL'
+        stats_details = {'dialogRendered': stats_status == 'PASS',
+            'observedNativeStatsInstead': 'Usage statistics' in visible,
+            'rendered': visible[-1000:]}
+        if stats_status == 'PASS':
+            os.write(tui.master, b'\r')
+            tui.drain(.2)
+        else:
+            os.write(tui.master, b'\x1b')
+            tui.drain(.3)
+        stats_result = {'typed': '/stats details',
+            'ptyBytes': len(tui.raw) - stats_start,
+            'visibleTail': tui.screen.visible()[-500:]}
+        checks['statsDispatch'] = {**stats_result, 'status': stats_status}
+        checks['statsActualSessionAndUnknownHandling'] = stats_details
+
+        checks['guideTaskDispatch'] = tui.submit_slash('/guide framed task marker', 'GUIDE_FIXTURE_REPLY')
+        checks['guideToggleDispatch'] = tui.submit_slash('/guide ')
+        toggle_prompt = 'GUIDE_TOGGLE_SENTINEL exact text'
+        os.write(tui.master, b'\x15')
+        tui.drain(.1)
+        tui.send_prompt(toggle_prompt, 'FIXTURE_REPLY')
+        tui.drain(.3)
+        provider_log = Path(fixture['providerLog'])
+        provider_prompts = json.loads(provider_log.read_text()) if provider_log.exists() else []
+        toggle_provider_prompt = next((text for text in provider_prompts if toggle_prompt in text), '')
+        toggle_status = 'PASS' if toggle_provider_prompt == toggle_prompt else 'FAIL'
+        checks['guideToggleObserved'] = {'status': toggle_status,
+            'providerPromptReceived': bool(toggle_provider_prompt),
+            'framingDisabled': toggle_provider_prompt == toggle_prompt,
+            'providerPromptExcerpt': toggle_provider_prompt[:300]}
+        checks['rawDispatch'] = tui.submit_slash('/raw RAW_SENTINEL exact text', 'RAW_FIXTURE_REPLY')
+        provider_prompts = json.loads(provider_log.read_text()) if provider_log.exists() else []
+        raw_prompt = next((text for text in provider_prompts if 'RAW_SENTINEL' in text), '')
+        checks['rawFramingBypass'] = {'status': 'PASS' if 'Deliver this task in phases' not in raw_prompt and raw_prompt.endswith('RAW_SENTINEL exact text') else 'FAIL',
+            'providerPromptExcerpt': raw_prompt[:500]}
+        guide_prompt = next((text for text in provider_prompts if 'framed task marker' in text), '')
+        checks['guideTaskFraming'] = {'status': 'PASS' if 'Deliver this task in phases' in guide_prompt else 'FAIL',
+            'providerPromptExcerpt': guide_prompt[:500]}
+
+        checks['workflowRoute'] = tui.submit_slash('/workflow', 'CARTHAGENT · WORKFLOW')
+        # The plugin route is persistent; subsequent slash text is not submitted
+        # from that custom renderer. Other views are exercised from independent
+        # sessions by the surrounding route-level harness, not claimed here.
+        tui.stop()
+        for command, expected, key in (
+                ('/architecture', 'CARTHAGENT · ARCHITECTURE', 'architectureRoute'),
+                ('/evidence', 'CARTHAGENT · EVIDENCE', 'evidenceRoute')):
+            route_tui = Tui(binary, fixture, fixture['sessionID'], env)
+            try:
+                route_tui.wait_for(lambda: '┃' in route_tui.screen.visible(), 'route session composer')
+                checks[key] = route_tui.submit_slash(command, expected)
+            finally:
+                route_tui.stop()
+        submitted = checks['submittedSlashes'] = [
+            '/export slash-acceptance.html', '/stats', '/guide framed task marker', '/guide ',
+            '/raw RAW_SENTINEL exact text', '/workflow', '/architecture', '/evidence']
+        assert len(submitted) == len(set(submitted)), 'slash submission evidence contains duplicate commands'
+        failures = [name for name, value in checks.items()
+                    if isinstance(value, dict) and value.get('status') == 'FAIL']
+        result = {'status': 'PASS' if not failures else 'PARTIAL', 'failures': failures,
+            'scope': 'Linux POSIX PTY; actual native plugin slash submissions; offline loopback provider',
+            'binarySha256': digest, 'sessionID': fixture['sessionID'],
+            'pluginReadiness': fixture['pluginReadiness'], 'providerRequests': fixture['providerRequests'],
+            'checks': checks}
+        rendered = json.dumps(result, indent=2, ensure_ascii=False) + '\n'
+        print(rendered, end='')
+        if args.artifact:
+            Path(args.artifact).write_text(rendered, encoding='utf8')
+        if failures:
+            return 2
+    finally:
+        tui.stop()
+
+
+if __name__ == '__main__':
+    main()

package/tools/test-native-swe-host.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-/** Real OpenCode 2.0.32 offline SWE acceptance: advertised tools edit and verify a broken fixture. */
+/** Real OpenCode 2.0.32 offline SWE acceptance through the composed production delivery workflow. */
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
@@ -8,64 +8,130 @@ import { nativeFixture } from './native-fixture.mjs';
 import { runNativeEvaluation } from '../lib/opencode/evaluation.mjs';
 
 let runResult;
+let reviewRequests = 0;
+let reviewerSource = '';
+let prePlanTools = [];
 const host = await nativeFixture({
-  plugin: join(import.meta.dirname, '../lib/opencode/evaluation-budget-plugin'),
-  plugins: process.argv[2] ? [process.argv[2]] : [join(import.meta.dirname, '../plugins/carthagent')],
-  env: { CTG_EVALUATION_MAX_TURNS: '8', CTG_EVALUATION_MAX_COST: '1' },
+  plugin: process.argv[2] ?? join(import.meta.dirname, '../plugins/carthagent'),
+  pluginOptions: { reviewModel: { providerID: 'ctg-fixture', id: 'fixture' } },
+  plugins: [join(import.meta.dirname, '../lib/opencode/evaluation-budget-plugin')],
+  env: {
+    CTG_EVALUATION_MAX_TURNS: '30', CTG_EVALUATION_MAX_COST: '1',
+    CTG_SESSION_OPTIONS: JSON.stringify({ maxTools:60, maxSeconds:180, maxRepairs:20 }),
+  },
   respond(body, res) {
-    const tools = body.tools || [];
-    const edit = tools.find(tool => tool.function?.name === 'edit');
-    const shell = tools.find(tool => tool.function?.name === 'shell');
-    assert.ok(edit, 'OpenCode must advertise its actual edit tool schema to the local provider');
-    assert.ok(shell, 'OpenCode must advertise its actual shell tool schema to the local provider');
+    const reviewText = JSON.stringify(body.messages ?? []);
     const root = host.cwd;
     const fixedFile = join(root, 'src/value.mjs');
-    const testFile = join(root, 'src/value.test.mjs');
-    const source = 'export const value = 42;\n';
-    const testCommand = `cd ${JSON.stringify(root)} && ${JSON.stringify(process.execPath)} --test --test-reporter=tap ${JSON.stringify(testFile)}; code=$?; printf '\\nCTG_EXIT_CODE=%s\\n' "$code"; exit "$code"`;
-    const messages = body.messages;
+    const messages = body.messages ?? [];
+    const tools = (body.tools ?? []).map(tool => tool.function?.name);
     const calls = [];
     const results = new Map();
     for (const message of messages) {
-      for (const call of message.tool_calls || []) calls.push({ id:call.id, name:call.function?.name });
+      for (const call of message.tool_calls ?? []) calls.push({ id:call.id, name:call.function?.name, arguments:call.function?.arguments });
       if (message.role === 'tool' && message.tool_call_id) results.set(message.tool_call_id, String(message.content));
     }
     const completed = calls.filter(call => results.has(call.id)).map(call => ({ ...call, output:results.get(call.id) }));
-    const editIndex = completed.findIndex(call => call.name === 'edit');
-    const shellCalls = completed.filter(call => call.name === 'shell');
-    const baseline = shellCalls.find(call => editIndex < 0 || completed.indexOf(call) < editIndex);
-    const repair = editIndex >= 0 ? completed[editIndex] : undefined;
-    const postEditChecks = repair ? shellCalls.filter(call => completed.indexOf(call) > editIndex) : [];
-    const baselineObservedRed = Boolean(baseline && /(?:exit(?:ed)? with code\s*[:=]?\s*1|exit code\s*[:=]?\s*1|CTG_EXIT_CODE=1)/i.test(baseline.output)
-      && /(?:not ok 1|ℹ\s*fail\s+1|#\s*fail\s+1)/i.test(baseline.output));
-    const successfulCheck = postEditChecks.some(call => /(?:exit(?:ed)? with code\s*[:=]?\s*0|exit code\s*[:=]?\s*0|CTG_EXIT_CODE=0)/i.test(call.output)
-      && /(?:ℹ\s*pass\s+1|#\s*pass\s+1)/i.test(call.output)
-      && /(?:ℹ\s*fail\s+0|#\s*fail\s+0)/i.test(call.output));
-    // A successful native edit tool result is completion evidence; unlike shell,
-    // the edit tool does not emit an operating-system exit code.
-    const editDone = Boolean(repair && !/\b(?:error|failed)\b/i.test(repair.output));
-    const name = !baseline ? 'shell' : !repair ? 'edit' : !successfulCheck ? 'shell' : null;
-    if (!name && !(baselineObservedRed && editDone && successfulCheck)) throw Error(`Native tool chronology did not establish red shell -> completed edit -> distinct green shell check: ${JSON.stringify(completed.map(({name,output})=>({name,output:output.slice(-1200)})))}`);
-    const args = name === 'edit'
-      ? { path: fixedFile, oldString: 'export const value = 0;\n', newString: source }
-      : { command: testCommand, workdir: root, timeout: 15_000 };
-    if (name === 'edit') assert.ok(baselineObservedRed, 'native shell tool must observe the initially failing test before editing');
-    const toolCall = { index:0, id:`fixture-call-${host.requests.length}`, type:'function', function:{name,arguments:JSON.stringify(args)} };
-    const delta = successfulCheck && editDone && baselineObservedRed
-      ? { role:'assistant', content:'Fixed the implementation and confirmed the test passes.' }
-      : { role:'assistant', content:null, tool_calls:[toolCall] };
-    const finish = successfulCheck && editDone && baselineObservedRed ? 'stop' : 'tool_calls';
-    res.writeHead(200, { 'content-type':'text/event-stream', 'cache-control':'no-cache', connection:'keep-alive' });
-    const chunk = (choice, usage) => `data: ${JSON.stringify({id:`native-swe-${host.requests.length}`,object:'chat.completion.chunk',created:1,model:'fixture',choices:[choice],...(usage?{usage}:{})})}\n\n`;
-    res.write(chunk({index:0,delta,finish_reason:null}));
-    res.end(`${chunk({index:0,delta:{},finish_reason:finish},{prompt_tokens:20,completion_tokens:8,total_tokens:28})}data: [DONE]\n\n`);
+    const done = name => completed.filter(call => call.name === name);
+    const executeCalls = done('execute');
+    const codeOf = call => {
+      try { return JSON.parse(call.arguments ?? '{}').code ?? ''; }
+      catch { return String(call.arguments ?? ''); }
+    };
+    const executed = source => executeCalls.some(call => codeOf(call).includes(source));
+    const execution = (code) => dispatch('execute', { code });
+    if (messages.some(message => message.role === 'user' && String(message.content).includes('CTG_SWE_DELIVERY_FIXTURE')) && !executed('delivery_plan') && !prePlanTools.length) {
+      prePlanTools = tools;
+    }
+    if (reviewText.includes('Snapshot SHA-256:') && reviewText.includes('REVIEW_JSON:')) {
+      const snapshot = reviewText.match(/Snapshot SHA-256: ([a-f0-9]+)/)?.[1];
+      const head = reviewText.match(/HEAD: ([a-f0-9]+)/)?.[1];
+      reviewRequests++;
+      reviewerSource = reviewText;
+      if (!snapshot || !head) throw Error('Reviewer prompt omitted exact source identity');
+      res.writeHead(200, { 'content-type': 'text/event-stream' });
+      const content = `Deterministic review receipt plumbing fixture.\nREVIEW_JSON: ${JSON.stringify({version:1,snapshot,head,findings:[]})}\nVERDICT: APPROVE`;
+      const chunk = (delta, finish_reason = null, usage) => `data: ${JSON.stringify({id:`native-review-${host.requests.length}`,object:'chat.completion.chunk',created:1,model:'fixture',choices:[{index:0,delta,finish_reason}],...(usage?{usage}:{})})}\n\n`;
+      res.end(`${chunk({role:'assistant',content})}${chunk({},'stop',{prompt_tokens:20,completion_tokens:8,total_tokens:28})}data: [DONE]\n\n`);
+      return;
+    }
+    if (JSON.stringify([...messages].reverse().find(message => message.role === 'user')).includes('STALE_FINISH_ATTEMPT')) {
+      return execution('const result = await tools.carthagent["delivery_finish"]({status:"verified",change:"Mutated fixture source after independent review.",review:"independent receipt is stale after source mutation",launch:"not applicable",limitations:[]}); return result');
+    }
+    const shell = () => dispatch('shell', {
+      command: 'node --test --test-reporter=tap src/value.test.mjs',
+      workdir: root,
+    });
+
+    if (!completed.length) {
+      assert.ok(tools.includes('execute'), 'production host must expose the Code Mode tool for discovery');
+      return execution('const result = await search({ query: "delivery plan acceptance checks review design tools", namespace: "carthagent", limit: 20 }); return result');
+    }
+    if (!executeCalls.some(call => codeOf(call).includes('delivery_finish'))) {
+      return execution('const result = await tools.carthagent["delivery_finish"]({status:"verified",change:"No implementation changes made.",review:"premature no-plan attempt",launch:"not applicable",limitations:[]}); return result');
+    }
+    if (!executed('delivery_finish')) throw Error('The no-plan verified finish call did not produce a tool response');
+    if (!executed('delivery_plan')) {
+      return execution(`const result = await tools.carthagent["delivery_plan"]({goal:"Repair fixture value so its test passes",assumptions:["The isolated Node test is the acceptance oracle."],artifacts:["src/value.mjs"],outputs:["src/value.mjs"],steps:[{id:"repair-value",title:"Repair the fixture value",checks:["fixture-test"]}],acceptance:[{requirement:"The exported value equals 42.",checks:["fixture-test"]}],checks:[{id:"fixture-test",kind:"test",argv:[${JSON.stringify(process.execPath)},"--test","src/value.test.mjs"],timeoutSeconds:20}]}); return {marker:"CTG_SWE_PLAN_ACCEPTED",result}`);
+    }
+    if (done('shell').length < 2) {
+      assert.ok(tools.includes('shell'), 'the valid standard delivery plan must unlock native shell');
+      return shell();
+    }
+    const baseline = done('shell')[1];
+    assert.match(baseline.output, /not ok 1|fail\s+1/i, 'native shell must observe red before any edit');
+    if (!done('edit').length) {
+      assert.ok(tools.includes('edit'), `production policy did not unlock the native edit tool after planning: ${tools.join(', ')}`);
+      return dispatch('edit', { path:fixedFile, oldString:'export const value = 0;\n', newString:'export const value = 42;\n' });
+    }
+    if (done('shell').length < 3) {
+      assert.ok(tools.includes('shell'), 'native shell must remain available for distinct post-edit verification');
+      return shell();
+    }
+    assert.match(done('shell')[2].output, /pass\s+1/i, 'post-edit native shell test must pass');
+    if (!executed('delivery_check')) {
+      return execution('return await tools.carthagent["delivery_check"]({id:"all"})');
+    }
+    if (!executeCalls.some(call => codeOf(call).includes('delivery_finish') && /premature attempt before progress/.test(codeOf(call)))) {
+      return execution('const result = await tools.carthagent["delivery_finish"]({status:"verified",change:"Changed fixture value from 0 to 42.",review:"premature attempt before progress",launch:"not applicable",limitations:[]}); return result');
+    }
+    if (!executed('delivery_progress')) {
+      return execution('const result = await tools.carthagent["delivery_progress"]({step:"repair-value",status:"done",note:"Native red/edit/green chronology completed."}); return {marker:"CTG_SWE_PROGRESS_DONE",result}');
+    }
+    const reviewCall = [...completed].reverse().find(call => call.name === 'execute'
+      && /delivery_review/.test(codeOf(call)) && /inspect/.test(codeOf(call)));
+    if (!reviewCall) return execution('return await tools.carthagent["delivery_review"]({action:"inspect"})');
+    const captureId = reviewCall.output.match(/"captureId"\s*:\s*"([^"]+)"/)?.[1]
+      ?? reviewCall.output.match(/"id"\s*:\s*"([0-9a-f-]{20,})"/)?.[1];
+    if (!captureId) throw Error(`Review inspect result did not expose capture ID: ${reviewCall.output}`);
+    if (!executeCalls.some(call => /delivery_review/.test(codeOf(call)) && /record/.test(codeOf(call)))) {
+      const coverage = [{ requirement:'The exported value equals 42.', assertions:'The fresh fixture-test runs node --test against src/value.test.mjs and asserts value === 42.', status:'demonstrated' }];
+      const probes = ['The original value 0 fails the assertion before editing.', 'After editing, the separate native shell invocation passes the same assertion.'];
+      return execution(`const result = await tools.carthagent["delivery_review"]({action:"record",captureId:${JSON.stringify(captureId)},coverage:${JSON.stringify(coverage)},probes:${JSON.stringify(probes)},findings:[],limitations:["Offline host proof uses model-authored workflow review; no independent reviewer service is configured.","This fixture verifies native workflow integration, not delivery-policy enforcement."]}); return {marker:"CTG_SWE_REVIEW_RECORDED",result}`);
+    }
+    if (done('execute').filter(call => codeOf(call).includes('delivery_finish') && /Fresh declared test/.test(codeOf(call))).length < 1) {
+      return execution('const result = await tools.carthagent["delivery_finish"]({status:"verified",change:"Changed fixture value from 0 to 42 to satisfy the existing assertion.",review:"Fresh declared test passed and model-authored coverage/probes were recorded; independent review was not configured.",launch:"Not applicable to this isolated module fixture.",limitations:["No independent reviewer service was configured; this is not independent review assurance.","This fixture acceptance does not claim delivery-policy enforcement."]}); return {marker:"CTG_SWE_FINISHED",result}');
+    }
+    return respondText('The fixture fix passed the declared check and the composed delivery workflow accepted its honest, limited handoff.');
+
+    function dispatch(name, args) {
+      if (!tools.includes(name)) throw Error(`Production delivery policy is withholding required native tool ${name}; advertised: ${tools.join(', ')}`);
+      const call = { index:0, id:`fixture-call-${host.requests.length}`, type:'function', function:{name,arguments:JSON.stringify(args)} };
+      res.writeHead(200, { 'content-type':'text/event-stream', 'cache-control':'no-cache', connection:'keep-alive' });
+      const chunk = (delta, finish_reason = null, usage) => `data: ${JSON.stringify({id:`native-swe-${host.requests.length}`,object:'chat.completion.chunk',created:1,model:'fixture',choices:[{index:0,delta,finish_reason}],...(usage?{usage}:{})})}\n\n`;
+      res.end(`${chunk({role:'assistant',tool_calls:[call]})}${chunk({},'tool_calls',{prompt_tokens:20,completion_tokens:8,total_tokens:28})}data: [DONE]\n\n`);
+      return call.id;
+    }
+    function respondText(text) {
+      res.writeHead(200, { 'content-type':'text/event-stream' });
+      const chunk = (delta, finish_reason = null, usage) => `data: ${JSON.stringify({id:`native-swe-${host.requests.length}`,object:'chat.completion.chunk',created:1,model:'fixture',choices:[{index:0,delta,finish_reason}],...(usage?{usage}:{})})}\n\n`;
+      res.end(`${chunk({role:'assistant',content:text})}${chunk({},'stop',{prompt_tokens:20,completion_tokens:8,total_tokens:28})}data: [DONE]\n\n`);
+    }
   },
 });
 
 try {
   const { client, cwd: directory, location, model, request } = host;
-  await host.active('ctg.evaluation-budget', location);
-  await host.active('carthagent', location);
   await mkdir(join(directory, 'src'), { recursive: true });
   await writeFile(join(directory, 'src/value.mjs'), 'export const value = 0;\n');
   await writeFile(join(directory, 'src/value.test.mjs'), [
@@ -75,19 +141,36 @@ try {
     "test('fixture value is repaired', () => assert.equal(value, 42));",
     '',
   ].join('\n'));
+  const git = (...args) => {
+    const result = spawnSync('git', args, { cwd: directory, encoding: 'utf8' });
+    assert.equal(result.status, 0, `git ${args.join(' ')} failed: ${result.stderr}`);
+    return result.stdout.trim();
+  };
+  git('init', '--initial-branch=main');
+  git('add', 'src/value.mjs', 'src/value.test.mjs');
+  git('-c', 'user.name=CTG fixture', '-c', 'user.email=fixture@example.invalid', 'commit', '-m', 'SWE fixture baseline');
+  await host.active('ctg.evaluation-budget', location);
+  await host.active('carthagent', location);
+  await assert.rejects(readFile(join(directory, 'unplanned.txt')), 'no unplanned shell execution was issued or created its requested file');
   const baseline = spawnSync(process.execPath, ['--test', '--test-reporter=tap', join(directory, 'src/value.test.mjs')], { cwd: directory, encoding: 'utf8' });
   assert.notEqual(baseline.status, 0, `fixture acceptance starts red: ${baseline.stdout}${baseline.stderr}`);
 
   const result = runResult = await runNativeEvaluation({
     client, directory,
-    prompt: `Use the advertised edit tool to fix src/value.mjs so the test passes, then use the advertised shell tool to run ${JSON.stringify(process.execPath)} --test src/value.test.mjs. Do not claim success unless the test output confirms it.\nFIXTURE_ROOT=${directory}`,
-    provider: model.providerID, model: model.id, timeoutSeconds: 60, maxTurns: 8, maxCost: 1,
+    agent: 'ship',
+    metadata: { 'carthagent.options': { maxTools:60, maxSeconds:180, maxRepairs:20 } },
+    prompt: `CTG_SWE_DELIVERY_FIXTURE. Discover the registered CTG tools with search; author and follow a valid required-verification delivery plan with a declared test check. Respect standard production tool policy: observe the failing baseline, make the native edit only after the plan unlocks it, run a distinct passing native shell check, record progress, run the declared check, inspect and record honest review coverage/probes, and finish with limitations. Do not claim independent review or delivery-policy enforcement.\nFIXTURE_ROOT=${directory}`,
+    provider: model.providerID, model: model.id, timeoutSeconds: 180, maxTurns: 30, maxCost: 1,
   });
   assert.equal(result.runtime, 'opencode-2');
-  assert.equal(result.opencodeVersion, '2.0.32');
+  const hostInfo = await client.server.info(request());
+  assert.equal(result.compatibilityVersion, '2.0.32');
+  assert.equal(result.runtimeVersion, hostInfo.version, 'evaluator reports the actual connected server version');
+  assert.equal(result.opencodeVersion, hostInfo.version, 'legacy version field retains actual-server semantics');
   assert.equal(result.exitCode, 0, JSON.stringify(result));
   assert.equal(result.outcome, 'succeeded');
-  assert.ok(result.productiveTurns >= 4, JSON.stringify(result));
+  assert.equal(prePlanTools.includes('shell'), false, 'native host withholds shell before a valid standard plan');
+  assert.ok(result.productiveTurns >= 8, JSON.stringify(result));
   assert.ok(result.tools.edit >= 1, JSON.stringify(result));
   assert.ok(result.tools.shell >= 2, JSON.stringify(result));
   assert.ok(Number.isFinite(result.cost) && result.cost >= 0, JSON.stringify(result));
@@ -96,33 +179,119 @@ try {
   assert.match(final.stdout, /(?:# pass 1|ℹ pass 1)/);
   assert.equal(await readFile(join(directory, 'src/value.mjs'), 'utf8'), 'export const value = 42;\n');
   const aggregate = await client.session.get({ sessionID: result.sessionID }, request());
+  assert.equal(aggregate.agent, 'ship', 'delivery evaluation must explicitly select Ship');
+  assert.deepEqual(aggregate.metadata['carthagent.options'], { maxTools:60, maxSeconds:180, maxRepairs:20 }, 'caller delivery options must survive evaluation admission');
+  assert.deepEqual(aggregate.metadata['ctg.evaluation.budget'], { maxTurns:30, maxCost:1 }, 'evaluation admission retains its authoritative budget');
   assert.equal(result.cost, aggregate.cost);
   assert.ok(result.tokens > 0);
   const timeline = [];
   const knownCalls = new Map();
+  const workflowTools = new Set();
   for (const request of host.requests) for (const message of request.messages) {
     for (const call of message.tool_calls || []) {
       knownCalls.set(call.id, call.function?.name);
-      timeline.push({ kind:'call', id:call.id, name:call.function?.name });
+      let args = {};
+      try { args = JSON.parse(call.function?.arguments ?? '{}'); } catch {}
+      if (call.function?.name === 'execute') {
+        const code = String(args.code ?? '');
+        for (const name of ['delivery_plan','delivery_check','delivery_progress','delivery_review','delivery_finish']) if (code.includes(name)) workflowTools.add(name);
+      }
+      timeline.push({ kind:'call', id:call.id, name:call.function?.name, arguments:args });
     }
     if (message.role === 'tool' && knownCalls.has(message.tool_call_id)) {
       timeline.push({ kind:'result', id:message.tool_call_id, name:knownCalls.get(message.tool_call_id), output:String(message.content) });
     }
   }
-  const baselineAt = timeline.findIndex(item => item.kind === 'result' && item.name === 'shell'
-    && /(?:exit(?:ed)? with code\s*[:=]?\s*1|exit code\s*[:=]?\s*1|CTG_EXIT_CODE=1)/i.test(item.output) && /(?:not ok 1|ℹ\s*fail\s+1|#\s*fail\s+1)/i.test(item.output));
+  const planAt = timeline.findIndex(item => item.kind === 'result' && item.name === 'execute' && /CTG_SWE_PLAN_ACCEPTED|Contract accepted|plan\.d2/.test(item.output));
+  const baselineAt = timeline.findIndex((item, index) => index > planAt && item.kind === 'result' && item.name === 'shell'
+    && /(?:exit(?:ed)? with code\s*[:=]?\s*1|exit code\s*[:=]?\s*1)/i.test(item.output) && /(?:not ok 1|ℹ\s*fail\s+1|#\s*fail\s+1)/i.test(item.output));
   const editAt = timeline.findIndex((item,index) => index > baselineAt && item.kind === 'result' && item.name === 'edit' && !/\b(?:error|failed)\b/i.test(item.output));
   const greenAt = timeline.findIndex((item,index) => index > editAt && item.kind === 'result' && item.name === 'shell'
-    && /(?:exit(?:ed)? with code\s*[:=]?\s*0|exit code\s*[:=]?\s*0|CTG_EXIT_CODE=0)/i.test(item.output)
-    && /(?:ℹ\s*pass\s+1|#\s*pass\s+1)/i.test(item.output)
+    && !/(?:exit(?:ed)? with code\s*[:=]?\s*1|exit code\s*[:=]?\s*1)/i.test(item.output)
+    && /(?:#\s*pass\s+1|ℹ\s*pass\s+1)/i.test(item.output)
     && /(?:ℹ\s*fail\s+0|#\s*fail\s+0)/i.test(item.output));
   assert.ok(baselineAt >= 0, 'recorded native shell result must prove baseline red');
   assert.ok(editAt > baselineAt, 'completed native edit must follow the baseline failure');
   assert.ok(greenAt > editAt, 'a distinct completed native shell call must prove the post-edit passing test');
+  for (const tool of ['delivery_plan', 'delivery_check', 'delivery_progress', 'delivery_review', 'delivery_finish']) {
+    assert.ok(workflowTools.has(tool), `composed production workflow must execute ${tool}`);
+  }
+  const finishCalls = timeline.filter(item => item.kind === 'call' && item.name === 'execute' && String(item.arguments.code ?? '').includes('delivery_finish'));
+  assert.ok(finishCalls.length >= 3, 'fixture must issue no-plan, pre-progress, and final finish attempts');
+  const noPlanFinish = timeline.find(item => item.kind === 'result' && item.id === finishCalls[0].id);
+  assert.match(noPlanFinish?.output ?? '', /Call delivery_plan first/);
+  const beforeProgress = finishCalls.find(call => /premature attempt before progress/.test(String(call.arguments.code ?? '')));
+  assert.ok(beforeProgress);
+  const beforeProgressResult = timeline.find(item => item.kind === 'result' && item.id === beforeProgress.id)?.output ?? '';
+  assert.match(beforeProgressResult, /incompleteSteps/);
+  assert.match(beforeProgressResult, /repair-value/);
+  const finishCall = finishCalls.at(-1);
+  assert.ok(finishCall, 'native workflow must issue delivery_finish');
+  const finishResult = timeline.find(item => item.kind === 'result' && item.id === finishCall.id);
+  assert.match(finishResult?.output ?? '', /\\"status\\"\s*:\s*\\"verified\\"/, 'production delivery gate must accept the completed declared check and review receipt');
+  assert.ok(timeline.some(item => item.kind === 'call' && item.name === 'execute' && /not independent review|independent review was not configured/i.test(String(item.arguments.code ?? ''))), 'fixture must accurately disclose model-authored review limitation');
+  const workspaceRpc = (method, input) => client.rpc.call({ rpcID: 'carthagent.workspace', method, input, location }, request());
+  let independentResponse;
+  const reviewTarget = await client.session.get({ sessionID: result.sessionID }, request());
+  try { independentResponse = await workspaceRpc('startReview', { sessionID: reviewTarget.id }); }
+  catch (error) { console.error(JSON.stringify({ error, providerErrors:host.providerErrors.map(item=>item.message), host:host.output }, null, 2)); throw error; }
+  const independent = independentResponse.output;
+  assert.equal(independent.status, 'approved', JSON.stringify(independent));
+  assert.ok(independent.sessionID && independent.sessionID !== result.sessionID, 'reviewer must be a distinct session');
+  const reviewer = await client.session.get({ sessionID: independent.sessionID }, request());
+  assert.equal(reviewer.parentID, undefined, 'reviewer must be a fresh root session');
+  assert.equal(reviewer.location.directory, directory, 'reviewer must inspect this exact delivery worktree');
+  assert.equal(reviewRequests, 1, 'independent reviewer must actually be invoked');
+  assert.match(reviewerSource, /export const value = 42/, 'reviewer source snapshot must contain the actual delivered edit');
+  assert.ok(Array.isArray(reviewer.permissions), 'reviewer session must persist its explicit read-only permission policy');
+  assert.ok(reviewer.permissions.some(rule => rule.action === '*' && rule.effect === 'deny'));
+  assert.ok(reviewer.permissions.some(rule => rule.action === 'read' && rule.effect === 'allow'));
+  for (const action of ['shell', 'edit', 'write', 'execute', 'subagent']) {
+    assert.ok(reviewer.permissions.some(rule => rule.action === action && rule.effect === 'deny'), `reviewer permission policy must deny ${action}`);
+  }
+  const reviewMessages = await client.session.context({sessionID:independent.sessionID},request());
+  assert.ok(reviewMessages.some(message => message.type === 'assistant' && message.content?.some(part => part.type === 'text' && /REVIEW_JSON:/.test(part.text))), 'fresh reviewer session must complete a structured review response');
+  assert.equal((await workspaceRpc('review', { sessionID: reviewTarget.id })).output.status, 'approved');
+  await writeFile(join(directory, 'src/value.mjs'), 'export const value = 43;\n');
+  assert.equal((await workspaceRpc('review', { sessionID: reviewTarget.id })).output.status, 'stale', 'source edits must invalidate the exact-worktree review receipt');
+  const altered = spawnSync(process.execPath, ['--test', '--test-reporter=tap', join(directory, 'src/value.test.mjs')], { cwd: directory, encoding: 'utf8' });
+  assert.notEqual(altered.status, 0, 'post-review source mutation must break the declared acceptance test');
+  assert.equal((await workspaceRpc('startReview', { sessionID: reviewTarget.id })).output.status, 'approved');
+  await writeFile(join(directory, 'src/value.mjs'), 'export const value = 44;\n');
+  assert.equal((await workspaceRpc('startReview', { sessionID: reviewTarget.id })).output.status, 'approved');
+  await writeFile(join(directory, 'src/value.mjs'), 'export const value = 45;\n');
+  const beforeAlteredFinish = reviewRequests;
+  await assert.rejects(workspaceRpc('startReview', { sessionID: reviewTarget.id }));
+  assert.equal(reviewRequests, beforeAlteredFinish, 'review admission must stop after its configured round cap');
+  await client.session.prompt({sessionID:result.sessionID,text:'STALE_FINISH_ATTEMPT: try to finish verified using now stale evidence.'},request());
+  await client.session.wait({sessionID:result.sessionID},{signal:AbortSignal.timeout(45_000)});
+  const staleFinishPrompt = [...host.requests].reverse().find(request => request.messages?.some(message => message.role === 'user' && String(message.content).includes('STALE_FINISH_ATTEMPT')))
+    ?? host.requests.at(-1);
+  assert.ok(staleFinishPrompt, 'stale-finish probe must have its own model request');
+  const staleFinishCall = [...staleFinishPrompt.messages.flatMap(message => message.tool_calls ?? [])].reverse().find(call => {
+    if (call.function?.name !== 'execute') return false;
+    try { return JSON.parse(call.function.arguments ?? '{}').code?.includes('independent receipt is stale after source mutation'); }
+    catch { return false; }
+  });
+  assert.ok(staleFinishCall, 'stale-finish turn must issue its own verified-finish call');
+  const staleFinishResult = staleFinishPrompt.messages.find(message => message.role === 'tool' && message.tool_call_id === staleFinishCall.id);
+  assert.ok(staleFinishResult, `stale-finish tool call ${staleFinishCall.id} must have a correlated result`);
+  assert.match(String(staleFinishResult.content), /Cannot verify:/, 'the source-mutated finish call itself must be rejected');
+  assert.match(String(staleFinishResult.content), /pendingChecks/, 'source mutation must invalidate declared check evidence');
+  assert.doesNotMatch(String(staleFinishResult.content), /"status"\s*:\s*"verified"/);
   console.log(JSON.stringify({
-    host: '2.0.32', outcome: result.outcome, productiveTurns: result.productiveTurns,
+    host: { compatibilityVersion: result.compatibilityVersion, runtimeVersion: result.runtimeVersion }, outcome: result.outcome, productiveTurns: result.productiveTurns,
     tools: result.tools, cost: result.cost, baseline: 'native shell failed', nativePostEditCheck: 'native shell passed', finalTest: 'passed',
-    realOpenCodeHost: true, loopbackProvider: true,
+    realOpenCodeHost: true, loopbackProvider: true, composedProductionDelivery: true,
+    policyEvidence: {
+      unplannedShell: 'withheld before plan; no policy-hook rejection claim',
+      plannedNativeShellPositiveControl: 'passed',
+      verifiedFinishWithoutPlan: 'rejected',
+      verifiedFinishBeforeProgress: 'rejected',
+      verifiedFinishAfterSourceMutation: 'rejected because declared evidence is stale',
+    },
+    review: 'same-worktree root reviewer configured with persisted read-only permissions; source-bound receipt invalidated by later edit; deterministic verdict proves receipt plumbing only, not review quality',
+    finalTestPassedBeforeMutation: true, alteredSourceTestFailedIntentionally: true,
   }));
 } finally {
   if (runResult?.exitCode) {