taskforce-loop-engineering 0.15.7 → 0.15.9

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+## 0.15.9 - 2026-08-25
+
+- Clarify that the disposable OpenClaw smoke may write required checkpoint and verification artifacts only inside its temporary Loop runtime queue while user/project files, configuration, credentials, and external state remain read-only.
+- Add regression coverage that rejects contradictory smoke permission wording or a missing checkpoint requirement.
+
+## 0.15.8 - 2026-08-25
+
+- Preserve every non-blocking risk from the effective terminal checkpoint in `final_judgement.residual_risks`, including accepted project completions without a continuation action.
+- Deduplicate repeated terminal risks while retaining the accepted completion outcome.
+- Add regression coverage proving accepted terminal checkpoints keep their operational risks visible.
+
 ## 0.15.7 - 2026-08-24
 
 - Prevent accepted phase checkpoints from producing `ready_to_apply` when they explicitly mark project completion as `in_progress`, including both string and object completion forms.

package/lib/core.mjs

@@ -3852,6 +3852,7 @@ export function buildFinalJudgement(contract, acceptancePlan, devPlan, checkpoin
   const explicitContinuationReviews = effectiveReviews.filter((review) =>
     (review.checkpointRisks?.length ?? 0) > 0 && continuationNextAction(review.checkpointNextAction)
   );
+  const effectiveResidualRisks = [...new Set(effectiveReviews.flatMap((review) => review.checkpointRisks ?? []))];
   const deferredGateCount = effectiveReviews.reduce((count, review) => count + (review.deferredGates?.length ?? 0), 0);
   let outcome = 'needs_revision';
 
@@ -3954,7 +3955,7 @@ export function buildFinalJudgement(contract, acceptancePlan, devPlan, checkpoin
     residual_risks: [
       ...(contract.requires_human_gate ? ['Human gate still required before external or high-risk action.'] : []),
       ...(context.verificationFailed ? ['Configured verification has failing commands.'] : []),
-      ...explicitContinuationReviews.flatMap((review) => review.checkpointRisks ?? [])
+      ...effectiveResidualRisks
     ],
     created_at: new Date().toISOString()
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskforce-loop-engineering",
-  "version": "0.15.7",
+  "version": "0.15.9",
   "private": false,
   "description": "OpenClaw-native loop engineering CLI, templates, and skill for verifiable agent work loops.",
   "type": "module",

package/scripts/final-judgement-self-test.mjs

@@ -175,7 +175,13 @@ assert.equal(inferTaskScope({ body: 'Continue the overall project with a product
 
 {
   const devPlan = { checkpoints: [{ id: 'cp1' }] };
-  const reviews = { reviews: [{ checkpointId: 'cp6', sequence: 6, status: 'accepted', projectCompletion: { status: 'accepted' } }] };
+  const reviews = { reviews: [{
+    checkpointId: 'cp6', sequence: 6, status: 'accepted', projectCompletion: { status: 'accepted' },
+    checkpointRisks: [
+      'A non-blocking operational risk remains after acceptance.',
+      'A non-blocking operational risk remains after acceptance.'
+    ]
+  }] };
   const judgement = buildFinalJudgement(
     { ...baseContract, task_scope: 'project' },
     basePlan,
@@ -185,6 +191,7 @@ assert.equal(inferTaskScope({ body: 'Continue the overall project with a product
     { dispatchStatus: 'completed' }
   );
   assert.equal(judgement.outcome, 'ready_to_apply');
+  assert.deepEqual(judgement.residual_risks, ['A non-blocking operational risk remains after acceptance.']);
 }
 
 console.log('final judgement self-test passed');

package/scripts/openclaw-install-self-test.mjs

@@ -128,6 +128,13 @@ if (doctorResult.code !== 0) throw new Error(`doctor failed: ${doctorResult.stde
 const doctorReport = JSON.parse(doctorResult.stdout);
 if (doctorReport.status !== 'ok' || doctorReport.externalWrite !== false || !doctorReport.checks.some((check) => check.id === 'notification_dry_run' && check.ok)) throw new Error('doctor did not complete a safe notification dry-run');
 const smoke = new URL('./openclaw-smoke.mjs', import.meta.url).pathname;
+const smokeSource = await readFile(smoke, 'utf8');
+if (!smokeSource.includes('Do not change user or project files, configuration, credentials, or external state.')
+  || !smokeSource.includes('Writing the required Loop checkpoint and verification evidence under')
+  || !smokeSource.includes('is allowed and required; do not write anywhere else.')
+  || !smokeSource.includes('path.relative(args.root, smokeRuntime)')) {
+  throw new Error('OpenClaw smoke permission boundary or checkpoint requirement is missing');
+}
 const loopBin = new URL('../bin/loop-engineering.mjs', import.meta.url).pathname;
 const smokeResult = await new Promise((resolve) => {
   const child = spawn(process.execPath, [smoke, '--root', root, '--queue', 'test-tasks', '--worker-agent', 'builder', '--openclaw-bin', mockOpenClaw, '--loop-bin', loopBin, '--json'], { stdio: ['ignore', 'pipe', 'pipe'] });

package/scripts/openclaw-smoke.mjs

@@ -59,7 +59,8 @@ async function main() {
     config.retry = { ...(config.retry || {}), maxAttempts: 1 };
     await mkdir(path.dirname(smokeConfig), { recursive: true });
     await writeFile(smokeConfig, `${JSON.stringify(config, null, 2)}\n`);
-    const message = '走 loop：Perform a read-only integration smoke. Do not change files or external state. Report SMOKE_OK with verification evidence.';
+    const smokeRuntimeRel = path.relative(args.root, smokeRuntime);
+    const message = `走 loop：Perform a read-only integration smoke. Do not change user or project files, configuration, credentials, or external state. Writing the required Loop checkpoint and verification evidence under ${smokeRuntimeRel}/ is allowed and required; do not write anywhere else. Report SMOKE_OK with verification evidence.`;
     const route = await run(args.loopBin, ['route-message', '--root', args.root, '--queue', smokeQueue, '--message', message, '--route', '--confirm-execute', '--source-channel', 'feishu', '--source-target', 'user:loop-smoke-dry-run', '--source-account', 'doctor', '--source-message-id', `smoke-${runToken}`, '--source-reply-to', `smoke-${runToken}`, '--json'], { cwd: args.root });
     steps.push({ id: 'route', ok: route.code === 0 });
     if (route.code !== 0) throw new Error(`route failed: ${route.stderr || route.stdout}`);