taskforce-loop-engineering 0.15.8 → 0.15.9

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+## 0.15.9 - 2026-08-25
+
+- Clarify that the disposable OpenClaw smoke may write required checkpoint and verification artifacts only inside its temporary Loop runtime queue while user/project files, configuration, credentials, and external state remain read-only.
+- Add regression coverage that rejects contradictory smoke permission wording or a missing checkpoint requirement.
+
 ## 0.15.8 - 2026-08-25
 
 - Preserve every non-blocking risk from the effective terminal checkpoint in `final_judgement.residual_risks`, including accepted project completions without a continuation action.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskforce-loop-engineering",
-  "version": "0.15.8",
+  "version": "0.15.9",
   "private": false,
   "description": "OpenClaw-native loop engineering CLI, templates, and skill for verifiable agent work loops.",
   "type": "module",

package/scripts/openclaw-install-self-test.mjs

@@ -128,6 +128,13 @@ if (doctorResult.code !== 0) throw new Error(`doctor failed: ${doctorResult.stde
 const doctorReport = JSON.parse(doctorResult.stdout);
 if (doctorReport.status !== 'ok' || doctorReport.externalWrite !== false || !doctorReport.checks.some((check) => check.id === 'notification_dry_run' && check.ok)) throw new Error('doctor did not complete a safe notification dry-run');
 const smoke = new URL('./openclaw-smoke.mjs', import.meta.url).pathname;
+const smokeSource = await readFile(smoke, 'utf8');
+if (!smokeSource.includes('Do not change user or project files, configuration, credentials, or external state.')
+  || !smokeSource.includes('Writing the required Loop checkpoint and verification evidence under')
+  || !smokeSource.includes('is allowed and required; do not write anywhere else.')
+  || !smokeSource.includes('path.relative(args.root, smokeRuntime)')) {
+  throw new Error('OpenClaw smoke permission boundary or checkpoint requirement is missing');
+}
 const loopBin = new URL('../bin/loop-engineering.mjs', import.meta.url).pathname;
 const smokeResult = await new Promise((resolve) => {
   const child = spawn(process.execPath, [smoke, '--root', root, '--queue', 'test-tasks', '--worker-agent', 'builder', '--openclaw-bin', mockOpenClaw, '--loop-bin', loopBin, '--json'], { stdio: ['ignore', 'pipe', 'pipe'] });

package/scripts/openclaw-smoke.mjs

@@ -59,7 +59,8 @@ async function main() {
     config.retry = { ...(config.retry || {}), maxAttempts: 1 };
     await mkdir(path.dirname(smokeConfig), { recursive: true });
     await writeFile(smokeConfig, `${JSON.stringify(config, null, 2)}\n`);
-    const message = '走 loop：Perform a read-only integration smoke. Do not change files or external state. Report SMOKE_OK with verification evidence.';
+    const smokeRuntimeRel = path.relative(args.root, smokeRuntime);
+    const message = `走 loop：Perform a read-only integration smoke. Do not change user or project files, configuration, credentials, or external state. Writing the required Loop checkpoint and verification evidence under ${smokeRuntimeRel}/ is allowed and required; do not write anywhere else. Report SMOKE_OK with verification evidence.`;
     const route = await run(args.loopBin, ['route-message', '--root', args.root, '--queue', smokeQueue, '--message', message, '--route', '--confirm-execute', '--source-channel', 'feishu', '--source-target', 'user:loop-smoke-dry-run', '--source-account', 'doctor', '--source-message-id', `smoke-${runToken}`, '--source-reply-to', `smoke-${runToken}`, '--json'], { cwd: args.root });
     steps.push({ id: 'route', ok: route.code === 0 });
     if (route.code !== 0) throw new Error(`route failed: ${route.stderr || route.stdout}`);