devcouncil 0.1.1 → 0.3.0

package/src/devcouncil/executors/mini_swe.py

@@ -1,3 +1,4 @@
+import logging
 import subprocess
 import sys
 from pathlib import Path
@@ -8,6 +9,7 @@ from devcouncil.execution.executor import Executor, ExecutionResult
 from devcouncil.execution.prompt_builder import PromptBuilder
 
 console = Console()
+logger = logging.getLogger(__name__)
 
 class MiniSWEExecutor(Executor):
     def __init__(self, project_root: Path):
@@ -22,6 +24,7 @@ class MiniSWEExecutor(Executor):
         instruction_file.parent.mkdir(parents=True, exist_ok=True)
         instruction_file.write_text(task_prompt, encoding="utf-8")
         
+        logger.info("mini-SWE-agent starting for %s", task.id)
         console.print(f"Starting [bold]mini-SWE-agent[/bold] for task {task.id}...")
         
         # In a real implementation, we'd invoke the agent CLI
@@ -50,10 +53,13 @@ class MiniSWEExecutor(Executor):
             )
             self._write_log(task.id, result)
             if result.returncode != 0:
+                logger.error("mini-SWE-agent exited %s for %s", result.returncode, task.id)
                 console.print(f"[red]mini-SWE-agent exited with {result.returncode}.[/red]")
                 return ExecutionResult(success=False, message='Execution failed')
+            logger.info("mini-SWE-agent finished for %s", task.id)
             return ExecutionResult(success=True, message='Execution successful')
         except Exception as e:
+            logger.exception("mini-SWE-agent error for %s: %s", task.id, e)
             console.print(f"[red]Error running mini-SWE-agent: {e}[/red]")
             return ExecutionResult(success=False, message='Execution failed')
 

package/src/devcouncil/executors/native/agent.py

@@ -1,15 +1,25 @@
 from typing import List, Dict, Any
+import asyncio
+import logging
 from rich.console import Console
 from pydantic import BaseModel
 from devcouncil.domain.task import Task
 from devcouncil.domain.requirement import Requirement
 from devcouncil.execution.executor import Executor, ExecutionResult
-from devcouncil.llm.router import ModelRouter
+from devcouncil.llm.router import ModelRouter, StructuredOutputError
 from devcouncil.execution.task_runner import TaskRunner
 from devcouncil.execution.context_builder import ContextBuilder
+from devcouncil.execution.prompt_builder import PromptBuilder
 from devcouncil.execution.paths import resolve_project_path
+from devcouncil.app.errors import ExecutionError
 
 console = Console()
+logger = logging.getLogger(__name__)
+
+# Resilience bounds for the preview native loop.
+MAX_AGENT_STEPS = 10
+MAX_STRUCTURED_FAILURES = 2          # model can't produce a valid action -> give up cleanly
+MAX_CONSECUTIVE_PATCH_FAILURES = 3   # stop spinning on a patch the model can't fix
 
 class ToolCall(BaseModel):
     tool: str
@@ -24,23 +34,41 @@ class NativeAgent(Executor):
     def __init__(self, router: ModelRouter, task_runner: TaskRunner):
         self.router = router
         self.task_runner = task_runner
+        # ContextBuilder is retained only for the cheap list_files file listing; the
+        # implementation context itself uses the budgeted PromptBuilder so the native
+        # executor gets the same repo-map orientation, symbol outlines, dependents and
+        # context-window budgeting as the CLI executors (rather than a flat JSON dump).
         self.context_builder = ContextBuilder(task_runner.project_root)
+        self.prompt_builder = PromptBuilder(task_runner.project_root)
+
+    def run_task(self, task: Task, requirements: List[Requirement]) -> ExecutionResult:
+        """Run the preview native executor behind the normal synchronous executor contract."""
+        return asyncio.run(self._run_task_async(task, requirements))
 
-    async def run_task(self, task: Task, requirements: List[Requirement]) -> ExecutionResult:
+    async def _run_task_async(self, task: Task, requirements: List[Requirement]) -> ExecutionResult:
+        logger.info("Native agent starting for %s (max_steps=%d)", task.id, MAX_AGENT_STEPS)
         console.print(f"Starting [bold]Native Executor[/bold] for task {task.id}...")
+        console.print("[yellow]Native executor is preview quality; DevCouncil verification remains the completion gate.[/yellow]")
         
-        # 1. Gather rich context
-        context_json = self.context_builder.build_task_context(task, requirements)
-        
+        # 1. Gather rich context (budgeted; includes repo-map orientation + symbol outlines)
+        context_block = self.prompt_builder.build_task_prompt(task, requirements)
+        from devcouncil.planning.correction_manifest import load_latest_correction_manifest
+
+        correction = load_latest_correction_manifest(self.task_runner.project_root, task.id)
+        correction_block = ""
+        if correction is not None:
+            correction_block = f"\nCorrection Manifest:\n{correction.model_dump_json(indent=2)}\n"
+
         system_prompt = f"""
 You are the DevCouncil Native Agent. Your goal is to implement the provided task.
 Current Project Context:
-{context_json}
+{context_block}
+{correction_block}
 
 You have access to the following tools:
 - read_file(path: str)
 - list_files()
-- apply_patch(patch: str)
+- apply_patch(patch: str)  OR  apply_patch(path: str, content: str) as a fallback when a valid unified diff cannot be produced
 - run_command(command: str)
 
 Rules:
@@ -54,22 +82,71 @@ Rules:
         # Initial task prompt
         messages.append({"role": "user", "content": f"Begin implementing task {task.id} based on the context provided."})
 
-        # Basic tool loop (Max 10 steps for safety in MVP)
-        for step in range(10):
-            action = await self.router.complete_structured(
-                role="native_agent", 
-                messages=messages,
-                schema=AgentAction
+        # Bounded tool loop. Counters let us fail a single task cleanly instead of
+        # crashing the whole run (structured-output faults) or spinning on an
+        # unfixable patch.
+        structured_failures = 0
+        consecutive_patch_failures = 0
+        for step in range(MAX_AGENT_STEPS):
+            try:
+                action = await self.router.complete_structured(
+                    role="native_agent",
+                    messages=messages,
+                    schema=AgentAction,
+                )
+            except StructuredOutputError as exc:
+                # The model could not produce a valid action even after healing/retry.
+                # native_agent has no fallback by design, so handle it here rather than
+                # letting it propagate and abort the entire `dev go` run.
+                structured_failures += 1
+                logger.warning("Native agent step %d: unparseable action (%d/%d): %s", step + 1, structured_failures, MAX_STRUCTURED_FAILURES, exc)
+                console.print(f"[red]Native agent could not parse a valid action: {exc}[/red]")
+                if structured_failures >= MAX_STRUCTURED_FAILURES:
+                    logger.error("Native agent giving up on %s after %d unparseable responses", task.id, structured_failures)
+                    return ExecutionResult(
+                        success=False,
+                        message=f"Native agent gave up after {structured_failures} unparseable responses.",
+                    )
+                messages.append({
+                    "role": "user",
+                    "content": (
+                        "[System] Your previous response was not valid JSON for the "
+                        "AgentAction schema. Reply with a single valid JSON object only "
+                        "(fields: thought, tool_calls, finish) — no prose, no fences."
+                    ),
+                })
+                continue
+            structured_failures = 0
+
+            logger.info(
+                "Native agent %s step %d/%d: %d tool call(s)%s",
+                task.id, step + 1, MAX_AGENT_STEPS, len(action.tool_calls),
+                " finish=True" if action.finish else "",
             )
-            
             console.print(f"\n[bold]Step {step+1}:[/bold] {action.thought}")
-            
+
+            # Record the agent's own turn so subsequent steps see what it already did.
+            # Without this the model only sees tool RESULTS, not its prior actions, and
+            # tends to repeat itself and never converge within the step budget.
+            messages.append({"role": "assistant", "content": action.model_dump_json()})
+
             if action.finish:
+                logger.info("Native agent signaled completion for %s at step %d", task.id, step + 1)
                 console.print("[green]Native agent signaled completion.[/green]")
-                return ExecutionResult(success=True, message="Agent signaled completion")
+                return ExecutionResult(success=True, message="Agent signaled completion; pending DevCouncil verification")
+
+            if not action.tool_calls:
+                # No action and not finished — nudge instead of silently burning a step.
+                messages.append({"role": "user", "content": (
+                    "[System] You produced no tool_calls and did not finish. Call a tool "
+                    "(read_file/list_files/apply_patch/run_command) to make progress, or set "
+                    "finish=true if the task is complete."
+                )})
+                continue
 
             for tool_call in action.tool_calls:
                 result_summary = ""
+                logger.debug("Native agent tool call: %s args=%s", tool_call.tool, list(tool_call.args))
                 try:
                     if tool_call.tool == "read_file":
                         path = tool_call.args["path"]
@@ -90,8 +167,26 @@ Rules:
                     elif tool_call.tool == "write_file":
                         raise PermissionError("write_file is disabled for the native executor; use apply_patch.")
                     elif tool_call.tool == "apply_patch":
-                        self.task_runner.apply_patch(tool_call.args["patch"], task)
-                        result_summary = "Successfully applied patch."
+                        if "path" in tool_call.args and "content" in tool_call.args:
+                            # Fallback for when the model can't produce a valid unified
+                            # diff. Routes through write_file, which enforces the same
+                            # planned-files permission check — no widening of scope.
+                            self.task_runner.write_file(
+                                tool_call.args["path"], tool_call.args["content"], task
+                            )
+                            consecutive_patch_failures = 0
+                            result_summary = f"Wrote {tool_call.args['path']} via path+content fallback."
+                        else:
+                            patch = tool_call.args.get("patch", "")
+                            if not patch or not patch.strip():
+                                raise ExecutionError(
+                                    "Empty patch. Provide a unified git diff beginning with "
+                                    "'diff --git a/<path> b/<path>', then '--- a/<path>' (or "
+                                    "'--- /dev/null' for a new file), '+++ b/<path>', and '@@' hunks."
+                                )
+                            self.task_runner.apply_patch(patch, task)
+                            consecutive_patch_failures = 0
+                            result_summary = "Successfully applied patch."
                     elif tool_call.tool == "run_command":
                         cmd_result = self.task_runner.run_command(tool_call.args["command"], task)
                         result_summary = f"Command finished with exit code {cmd_result.exit_code}."
@@ -100,8 +195,29 @@ Rules:
                     
                     messages.append({"role": "user", "content": f"[Tool Result] '{tool_call.tool}': {result_summary}"})
                 except Exception as e:
+                    logger.warning("Native agent tool %s failed for %s: %s", tool_call.tool, task.id, e)
                     console.print(f"[red]Error executing tool {tool_call.tool}: {e}[/red]")
-                    messages.append({"role": "user", "content": f"[Tool Error] '{tool_call.tool}' failed: {e}"})
+                    if tool_call.tool == "apply_patch":
+                        consecutive_patch_failures += 1
+                        if consecutive_patch_failures >= MAX_CONSECUTIVE_PATCH_FAILURES:
+                            logger.error("Native agent giving up on %s after %d consecutive patch failures", task.id, consecutive_patch_failures)
+                            return ExecutionResult(
+                                success=False,
+                                message=(
+                                    f"Native agent failed to apply a patch "
+                                    f"{consecutive_patch_failures} times in a row."
+                                ),
+                            )
+                        messages.append({"role": "user", "content": (
+                            f"[Tool Error] 'apply_patch' failed: {e}\n"
+                            "Re-read the target file, match the existing context lines EXACTLY, "
+                            "and do NOT resubmit the same patch. If you cannot produce a valid "
+                            "unified diff, call apply_patch with 'path' and 'content' instead to "
+                            "write the whole file."
+                        )})
+                    else:
+                        messages.append({"role": "user", "content": f"[Tool Error] '{tool_call.tool}' failed: {e}"})
 
+        logger.warning("Native agent reached max step limit (%d) for %s", MAX_AGENT_STEPS, task.id)
         console.print("[red]Native agent reached maximum step limit.[/red]")
         return ExecutionResult(success=False, message="Reached maximum step limit")

package/src/devcouncil/executors/openhands.py

@@ -1,3 +1,4 @@
+import logging
 import subprocess
 from pathlib import Path
 from rich.console import Console
@@ -7,6 +8,7 @@ from devcouncil.execution.executor import Executor, ExecutionResult
 from devcouncil.execution.prompt_builder import PromptBuilder
 
 console = Console()
+logger = logging.getLogger(__name__)
 
 class OpenHandsExecutor(Executor):
     def __init__(self, project_root: Path):
@@ -16,6 +18,7 @@ class OpenHandsExecutor(Executor):
         builder = PromptBuilder(self.project_root)
         task_prompt = builder.build_task_prompt(task, requirements)
         
+        logger.info("OpenHands starting for %s", task.id)
         console.print(f"Starting [bold]OpenHands[/bold] for task {task.id}...")
         
         # OpenHands often expects a workspace mount and an instruction.
@@ -48,10 +51,13 @@ class OpenHandsExecutor(Executor):
             )
             self._write_log(task.id, result)
             if result.returncode != 0:
+                logger.error("OpenHands exited %s for %s", result.returncode, task.id)
                 console.print(f"[red]OpenHands exited with {result.returncode}.[/red]")
                 return ExecutionResult(success=False, message=f"Exited with code {result.returncode}")
+            logger.info("OpenHands finished for %s", task.id)
             return ExecutionResult(success=True, message="Completed successfully")
         except Exception as e:
+            logger.exception("OpenHands error for %s: %s", task.id, e)
             console.print(f"[red]Error running OpenHands: {e}[/red]")
             return ExecutionResult(success=False, message=str(e))
 

package/src/devcouncil/gating/checks/clean_git.py

@@ -9,7 +9,9 @@ class CleanGitCheck:
 
     def _is_runtime_state(self, line: str) -> bool:
         path = line[3:].strip().replace("\\", "/")
-        return path.startswith(".devcouncil/")
+        # DevCouncil manages the root .gitignore itself (ensure_gitignore runs on
+        # init and before every task), so it must not block execution.
+        return path.startswith(".devcouncil/") or path == ".gitignore"
     
     def check(self, project_root, task_id: str) -> list[Gap]:
         try:

package/src/devcouncil/gating/checks/secret_scan_check.py

@@ -1,34 +1,60 @@
+import logging
+import re
 from typing import List
 from devcouncil.domain.gap import Gap
 from devcouncil.utils.redaction import SECRET_PATTERNS, redact_string
 
+logger = logging.getLogger(__name__)
+
+# Captures the new-file starting line from a unified-diff hunk header (@@ -a,b +c,d @@).
+_HUNK_RE = re.compile(r"^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@")
+
+
 class SecretScanner:
     """Scans code diffs for potential secrets (API keys, tokens, etc.)."""
-    
+
     def scan_diff(self, diff_content: str, task_id: str) -> List[Gap]:
-        gaps = []
-        lines = diff_content.splitlines()
+        gaps: List[Gap] = []
         current_file = "unknown_file"
-        
-        for i, line in enumerate(lines):
+        new_line_no = 0  # line number in the new file, tracked across hunks
+        counter = 0      # ensures unique gap ids
+
+        for line in diff_content.splitlines():
             if line.startswith("+++ b/"):
                 current_file = line[6:]
                 continue
-                
-            # Only scan added lines in diff
-            if not line.startswith("+") or line.startswith("+++"):
+            if line.startswith("+++") or line.startswith("---") or line.startswith("diff "):
+                continue
+            hunk = _HUNK_RE.match(line)
+            if hunk:
+                new_line_no = int(hunk.group(1))
+                continue
+            if line.startswith("-"):
+                continue  # removed line — does not advance the new-file counter
+            if line.startswith("+"):
+                for key_type, pattern in SECRET_PATTERNS.items():
+                    if pattern.search(line):
+                        counter += 1
+                        logger.warning(
+                            "Potential %s secret detected in %s:%d (task %s)",
+                            key_type, current_file, new_line_no, task_id,
+                        )
+                        gaps.append(Gap(
+                            id=f"GAP-{task_id}-SECRET-{key_type.upper()}-{new_line_no}-{counter}",
+                            severity="critical",
+                            gap_type="security_risk",
+                            task_id=task_id,
+                            description=f"Potential {key_type} found in {current_file}:{new_line_no}.",
+                            evidence=[redact_string(line.strip())],
+                            recommended_fix="Remove the secret and use environment variables or a secret manager.",
+                            blocking=True,
+                            # Populate the routing fields so the security NextAction points
+                            # the agent straight at the file:line instead of forcing a re-grep.
+                            file=current_file,
+                            line=new_line_no,
+                        ))
+                new_line_no += 1
                 continue
-                
-            for key_type, pattern in SECRET_PATTERNS.items():
-                if pattern.search(line):
-                    gaps.append(Gap(
-                        id=f"GAP-{task_id}-SECRET-{key_type.upper()}-{i}",
-                        severity="critical",
-                        gap_type="security_risk",
-                        task_id=task_id,
-                        description=f"Potential {key_type} found in {current_file} (diff line {i+1}).",
-                        evidence=[redact_string(line.strip())],
-                        recommended_fix="Remove the secret and use environment variables or a secret manager.",
-                        blocking=True
-                    ))
+            # Context or blank line — advances the new-file counter.
+            new_line_no += 1
         return gaps

package/src/devcouncil/gating/policy.py

@@ -1,3 +1,5 @@
+import logging
+from collections import deque
 from pydantic import BaseModel
 from typing import Any, List, Optional
 from pathlib import Path
@@ -11,10 +13,94 @@ from devcouncil.gating.checks.requirement_coverage import RequirementCoverageChe
 from devcouncil.gating.checks.planned_files_check import PlannedFilesCheck
 from devcouncil.gating.checks.clean_git import CleanGitCheck
 
+logger = logging.getLogger(__name__)
+
+
+def _log_gate(name: str, gaps: List[Gap], *, routine: bool = False, **context: Any) -> bool:
+    """Log a gate decision and return whether it passed (no blocking gaps).
+
+    A passing gate is logged at INFO for once-per-plan checks (a real milestone) but at
+    DEBUG for ``routine`` per-task checks (e.g. task_ready, which fires for every task and
+    every repair attempt) so the ``-v`` stream stays milestone-level. A FAILED gate is
+    always WARNING — that's the signal you actually chase.
+    """
+    blocking = [g for g in gaps if g.blocking]
+    passed = not blocking
+    suffix = "".join(f" {k}={v}" for k, v in context.items())
+    if passed:
+        log = logger.debug if routine else logger.info
+        log("Gate %s PASSED (%d advisory gap(s))%s", name, len(gaps), suffix)
+    else:
+        logger.warning(
+            "Gate %s FAILED%s: %s",
+            name, suffix,
+            "; ".join(f"{g.gap_type}: {g.description}" for g in blocking),
+        )
+    return passed
+
+
 class GateResult(BaseModel):
     passed: bool
     gaps: List[Gap]
 
+
+def _find_dependency_cycle(tasks: List[Task]) -> Optional[List[str]]:
+    """Return one dependency cycle as an id path (e.g. [A, B, A]), or None. Only edges
+    to known task ids are followed; unknown deps are reported separately."""
+    ids = {t.id for t in tasks}
+    graph = {t.id: [d for d in t.depends_on if d in ids] for t in tasks}
+    WHITE, GREY, BLACK = 0, 1, 2
+    color = {tid: WHITE for tid in graph}
+    stack: List[str] = []
+
+    def visit(node: str) -> Optional[List[str]]:
+        color[node] = GREY
+        stack.append(node)
+        for nxt in graph.get(node, []):
+            if color[nxt] == GREY:
+                return stack[stack.index(nxt):] + [nxt]
+            if color[nxt] == WHITE:
+                found = visit(nxt)
+                if found:
+                    return found
+        stack.pop()
+        color[node] = BLACK
+        return None
+
+    for tid in graph:
+        if color[tid] == WHITE:
+            found = visit(tid)
+            if found:
+                return found
+    return None
+
+
+def topological_order(tasks: List[Task]) -> List[Task]:
+    """Order tasks so every task follows the ones it depends on. Stable: preserves the
+    given order among independent tasks. Falls back to the original order if a cycle
+    makes a full ordering impossible (the plan gate blocks cycles separately)."""
+    by_id = {t.id: t for t in tasks}
+    indegree = {t.id: 0 for t in tasks}
+    dependents: dict[str, List[str]] = {t.id: [] for t in tasks}
+    for task in tasks:
+        for dep in task.depends_on:
+            if dep in by_id:
+                indegree[task.id] += 1
+                dependents[dep].append(task.id)
+    # Kahn's algorithm, seeded in original order for stability.
+    ready = deque(t.id for t in tasks if indegree[t.id] == 0)
+    ordered: List[str] = []
+    while ready:
+        current = ready.popleft()
+        ordered.append(current)
+        for child in dependents[current]:
+            indegree[child] -= 1
+            if indegree[child] == 0:
+                ready.append(child)
+    if len(ordered) != len(tasks):  # cycle — fall back to original order
+        return list(tasks)
+    return [by_id[tid] for tid in ordered]
+
 class GatePolicy:
     """Central engine for executing project and task level quality gates."""
     
@@ -104,6 +190,68 @@ class GatePolicy:
                     blocking=True,
                 ))
 
+        # Surface read-only-only tasks at PLANNING time (advisory): a task that declares
+        # planned files but none writable can implement nothing, and was previously only
+        # caught at execution by the task-readiness gate.
+        for task in tasks:
+            if task.planned_files and not any(
+                pf.allowed_change in ("create", "modify", "delete") for pf in task.planned_files
+            ):
+                gaps.append(Gap(
+                    id=f"GAP-PLAN-{task.id}-READ-ONLY",
+                    severity="medium",
+                    gap_type="task_not_implemented",
+                    task_id=task.id,
+                    description=(
+                        f"Task {task.id} declares planned files but none are writable "
+                        "(all read_only); it cannot implement any change. Expected only if "
+                        "this is an analysis-only task."
+                    ),
+                    recommended_fix=(
+                        "Grant 'create', 'modify', or 'delete' to at least one planned file, "
+                        "or confirm the task is intentionally analysis-only."
+                    ),
+                    blocking=False,
+                ))
+
+        # Surface overlapping ownership (advisory): when 2+ tasks each declare a
+        # writable (create/modify/delete) change to the SAME file, the plan is
+        # over-decomposed — the later task tends to duplicate or conflict with the
+        # earlier one (e.g. both add the same function), which then fails per-task
+        # verification. Consolidating a file's work into one task avoids this.
+        writers_by_file: dict[str, list[str]] = {}
+        writer_sets: dict[str, set[str]] = {}
+        for task in tasks:
+            for pf in task.planned_files:
+                if pf.allowed_change in ("create", "modify", "delete"):
+                    path = pf.path.replace("\\", "/")
+                    owners = writers_by_file.setdefault(path, [])
+                    seen = writer_sets.setdefault(path, set())
+                    if task.id not in seen:
+                        seen.add(task.id)
+                        owners.append(task.id)
+        for path, owners in writers_by_file.items():
+            if len(owners) > 1:
+                gaps.append(Gap(
+                    id=f"GAP-PLAN-OVERLAP-{owners[0]}-{path.replace('/', '_')}",
+                    severity="medium",
+                    gap_type="task_not_implemented",
+                    description=(
+                        f"{len(owners)} tasks ({', '.join(owners)}) each declare writable "
+                        f"changes to {path}; overlapping ownership over-decomposes the plan "
+                        "and tends to cause duplicate/conflicting edits at execution."
+                    ),
+                    recommended_fix=(
+                        f"Consolidate the work on {path} into a single task, or scope the "
+                        "others to read_only."
+                    ),
+                    blocking=False,
+                ))
+
+        # Validate the task dependency DAG: unknown depends_on ids and cycles would make
+        # execution ordering impossible / stall the run, so block the plan on them.
+        gaps.extend(self._validate_task_dependencies(tasks))
+
         for assumption in assumptions or []:
             if (
                 assumption.impact == "high"
@@ -145,7 +293,7 @@ class GatePolicy:
             ))
 
         return GateResult(
-            passed=len([g for g in gaps if g.blocking]) == 0, 
+            passed=_log_gate("plan_approval", gaps),
             gaps=gaps
         )
 
@@ -159,32 +307,63 @@ class GatePolicy:
         # 2. Check planned files
         gaps.extend(self.planned_files.check(task))
 
-        # 3. Check execution/verification evidence contract
-        if not task.allowed_commands:
+        # 3. Surface a missing execution/verification contract — but do NOT block
+        # execution on it. The executor still needs to run to implement the code,
+        # and the evidence requirement is genuinely enforced at verify time
+        # (acceptance_criteria_unproven / NOAC gaps). Blocking here only prevents
+        # implementation and stalls multi-task plans when the planner under-specs a
+        # task; these stay advisory so the work can proceed and be judged on output.
+        if not task.allowed_commands and not task.expected_tests:
             gaps.append(Gap(
                 id=f"GAP-{task.id}-NO-COMMANDS",
-                severity="high",
+                severity="medium",
                 gap_type="missing_test",
                 task_id=task.id,
                 description=f"Task {task.id} has no allowed commands for execution or verification.",
-                recommended_fix="Add explicit allowed_commands for the task before execution.",
-                blocking=True,
+                recommended_fix="Add explicit allowed_commands or expected_tests so verification can prove the acceptance criteria.",
+                blocking=False,
             ))
 
         if not task.expected_tests:
             gaps.append(Gap(
                 id=f"GAP-{task.id}-NO-EXPECTED-EVIDENCE",
-                severity="high",
+                severity="medium",
                 gap_type="missing_test",
                 task_id=task.id,
                 description=f"Task {task.id} has no expected verification evidence.",
                 recommended_fix="Add expected_tests or targeted static/manual review commands that prove the acceptance criteria.",
-                blocking=True,
+                blocking=False,
             ))
 
-        # 4. Check for task dependencies (if implemented)
-        
         return GateResult(
-            passed=len([g for g in gaps if g.blocking]) == 0, 
+            passed=_log_gate("task_ready", gaps, routine=True, task_id=task.id),
             gaps=gaps
         )
+
+    def _validate_task_dependencies(self, tasks: List[Task]) -> List[Gap]:
+        """Block on a malformed dependency DAG: unknown depends_on ids and cycles."""
+        gaps: List[Gap] = []
+        ids = {t.id for t in tasks}
+        for task in tasks:
+            unknown = [dep for dep in task.depends_on if dep not in ids]
+            if unknown:
+                gaps.append(Gap(
+                    id=f"GAP-PLAN-{task.id}-UNKNOWN-DEP",
+                    severity="high",
+                    gap_type="task_not_implemented",
+                    task_id=task.id,
+                    description=f"Task {task.id} depends on unknown task(s): {', '.join(unknown)}.",
+                    recommended_fix="Reference only task IDs that exist in this plan, or remove the dependency.",
+                    blocking=True,
+                ))
+        cycle = _find_dependency_cycle(tasks)
+        if cycle:
+            gaps.append(Gap(
+                id="GAP-PLAN-DEP-CYCLE",
+                severity="high",
+                gap_type="task_not_implemented",
+                description=f"Task dependency cycle detected: {' -> '.join(cycle)}.",
+                recommended_fix="Break the cycle so the tasks can be ordered and executed.",
+                blocking=True,
+            ))
+        return gaps