agentic-dev-loop 1.0.0a14__tar.gz → 1.0.0a16__tar.gz

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a14
+Version: 1.0.0a16
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -213,7 +213,7 @@ steps:
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox (command steps, network ON, stamp-cached); `network: true` grants egress to a command or agent step (default off) - see [Per-stage networking](#per-stage-networking). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only - never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
-| `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`. It can never disable it. |
+| `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`, `seccomp_profile`. It can never disable it. See [browser sandbox](docs/browser-sandbox.md). |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` - artifacts and checkpoints live outside the sandbox mount. |
 | `extensions_dir` | Where consumer `extensions:` modules resolve - defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
 | `deps_policy` | `locked` (default) or `open`. `locked` = the human-owned lockfile is the source of truth and the agent may not add dependencies; `open` = the bootstrap protocol (the agent may add exact-pinned manifest entries). See [Dependency policy](#dependency-policy-locked-by-default). |

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/README.md

@@ -171,7 +171,7 @@ steps:
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox (command steps, network ON, stamp-cached); `network: true` grants egress to a command or agent step (default off) - see [Per-stage networking](#per-stage-networking). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only - never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
-| `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`. It can never disable it. |
+| `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`, `seccomp_profile`. It can never disable it. See [browser sandbox](docs/browser-sandbox.md). |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` - artifacts and checkpoints live outside the sandbox mount. |
 | `extensions_dir` | Where consumer `extensions:` modules resolve - defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
 | `deps_policy` | `locked` (default) or `open`. `locked` = the human-owned lockfile is the source of truth and the agent may not add dependencies; `open` = the bootstrap protocol (the agent may add exact-pinned manifest entries). See [Dependency policy](#dependency-policy-locked-by-default). |

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a14"
+version = "1.0.0a16"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/src/agentic_dev_loop/core/config.py

@@ -19,6 +19,7 @@ class VerdictSpec(BaseModel):
 
     pass_: str = Field(alias="pass")
     fail: str = Field(alias="fail")
+    unverifiable: str | None = None
 
 
 class Route(BaseModel):
@@ -86,11 +87,15 @@ class IsolationConfig(BaseModel):
     # the workspace - validated at startup, not load (the workspace is unknown
     # here).
     sandbox_venv_dir: str | None = None
-    # 023: optional host path to a Docker seccomp profile JSON. When set, the
-    # exec container runs with ``--security-opt seccomp=<path>`` in place of
-    # Docker's default profile. Used to allow Chromium's namespace sandbox
-    # (userns syscalls) under --cap-drop ALL. The path is validated by Docker
-    # at container-create time, not at load.
+    # 023/025: optional host path to a Docker seccomp profile JSON, or a
+    # ``bundled:<name>`` sentinel resolved at load to a packaged profile
+    # (e.g. ``bundled:chromium-userns``). When set, the exec container runs
+    # with ``--security-opt seccomp=<path>`` in place of Docker's default
+    # profile, plus ``--cap-add SYS_CHROOT`` (the profile gates chroot(2) on
+    # exactly that capability). Used to allow Chromium's namespace sandbox
+    # (userns syscalls) under --cap-drop ALL. An unknown sentinel name fails
+    # at load naming the known bundled profiles; a raw path is validated by
+    # Docker at container-create time, not at load.
     seccomp_profile: str | None = None
 
     @field_validator("memory")
@@ -131,6 +136,7 @@ class StepConfig(BaseModel):
     secrets: list[str] = []  # declared ref names; action steps reject
     on_pass: RouteTarget | None = None
     on_fail: RouteTarget | None = None
+    on_unverifiable: RouteTarget | None = None
 
     @property
     def kind(self) -> str:
@@ -286,7 +292,7 @@ class PipelineConfig(BaseModel):
                 raise ValueError(f"step name {n!r} collides with a reserved terminal")
         valid = set(names) | TERMINALS
         for step in self.steps:
-            for route in (step.on_pass, step.on_fail):
+            for route in (step.on_pass, step.on_fail, step.on_unverifiable):
                 target = route_target(route)
                 if target is not None and target not in valid:
                     raise ValueError(

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/src/agentic_dev_loop/engine/dryrun.py

@@ -16,7 +16,7 @@ from agentic_dev_loop.core.config import PipelineConfig, StepConfig, load_config
 from .hostboundary import check_orchestrator_install, check_tooling_integrity
 from .loaders import resolve_docs
 from .isolation import (isolation_state_dir, resolve_effective_profile,
-                        resolve_image_ref)
+                        resolve_image_ref, resolved_seccomp_profile)
 from .registry import (Registry, default_registry, load_extensions,
                        validate_action_network)
 from .secrets import scan_env_files
@@ -134,6 +134,7 @@ def dry_run(cfg_path, args, registry: Registry | None = None) -> int:
 
     _validate_agents(cfg, base / cfg.agents_dir)
     _validate_actions(cfg, registry)
+    resolved_seccomp_profile(cfg)  # fails loud on an unknown bundled:<name>
 
     loader, docs, subject = resolve_docs(cfg, base, registry, args)
     image, memory, cpus = _resolved_image(cfg)

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/src/agentic_dev_loop/engine/isolation.py

@@ -37,6 +37,7 @@ from typing import Protocol
 
 from agentic_dev_loop.core.config import IsolationConfig, PipelineConfig
 from .proc import needs_shell, split_command
+from .seccomp import resolve_seccomp_profile
 
 # ---------------------------------------------------------------------------
 # Constants (KD-2 / ID-4)
@@ -480,7 +481,9 @@ def docker_create_payload(*, run_id: str, image: str, profile: EffectiveProfile,
     CAP_SYS_CHROOT; the profile gates chroot(2) on exactly that capability,
     so the payload adds it back (the bounding set is otherwise empty under
     --cap-drop ALL). Without the cap the zygote dies even with the profile
-    (023 host-side gate 2)."""
+    (023 host-side gate 2). The ``--cap-add SYS_CHROOT`` applies to any
+    seccomp profile by design: the bundled profile requires it, and custom
+    profiles are expected to follow the same cap-gated pattern."""
     payload = [
         "docker", "run", "--detach", "--rm", "--name",
         exec_container_name(run_id, network),
@@ -956,6 +959,14 @@ def isolation_state_dir(cfg: PipelineConfig) -> Path:
     return Path(iso.state_dir).expanduser()
 
 
+def resolved_seccomp_profile(cfg: PipelineConfig) -> str | None:
+    """The pipeline's seccomp profile with any ``bundled:<name>`` sentinel
+    expanded to a real host path (025). A raw path passes through unchanged
+    and is still validated by Docker at container-create time."""
+    return resolve_seccomp_profile(
+        cfg.isolation.seccomp_profile if cfg.isolation else None)
+
+
 def resolve_image_ref(image: str, environ: Mapping[str, str] | None = None) -> str:
     """AGENTIC_DEV_LOOP_DEV_IMAGE override (tag OR digest) → else the profile
     image (digest-pinned) → if empty, fail fast AE-SBX-005."""
@@ -976,6 +987,7 @@ def startup_sandbox(cfg: PipelineConfig, *, workspace: Path,
                     refresh: bool | None = None) -> Sandbox:
     """Eager startup sequence (Q2): probe → image → backend → ensure_image →
     create+start → pre-provision every declared setup (stamp-cached)."""
+    seccomp_profile = resolved_seccomp_profile(cfg)
     probe_docker(runner)
     profile = resolve_effective_profile(cfg.isolation)
     image = resolve_image_ref(profile.image)
@@ -983,7 +995,6 @@ def startup_sandbox(cfg: PipelineConfig, *, workspace: Path,
     needs_network = any(step.network for step in cfg.steps)
     sandbox_venv_dir = resolve_sandbox_venv_dir(
         cfg.isolation.sandbox_venv_dir if cfg.isolation else None, workspace)
-    seccomp_profile = cfg.isolation.seccomp_profile if cfg.isolation else None
     backend = DockerBackend(
         image=image, workspace=str(workspace), iso_state_dir=str(iso_state_dir),
         profile=profile, runner=runner, network=needs_network,

agentic_dev_loop-1.0.0a16/src/agentic_dev_loop/engine/seccomp/__init__.py

@@ -0,0 +1,72 @@
+"""Bundled Docker seccomp profiles (023).
+
+Docker's default seccomp profile blocks the user-namespace syscalls Chromium's
+namespace sandbox needs, which makes ``chromium.launch(chromiumSandbox=True)``
+die at the zygote under ``--cap-drop ALL``. These profiles are Docker's default
+profile with an allowlist for those userns syscalls; pass one as
+``isolation.seccomp_profile`` to swap it in. The ``bundled:<name>`` sentinel
+(025) resolves a profile by name so consumers declare intent instead of
+rediscovering the packaged path.
+"""
+
+from __future__ import annotations
+
+from importlib.resources import as_file, files
+
+CHROMIUM_USERNS_NAME = "chromium-userns"
+CHROMIUM_USERNS_PROFILE = "chromium-userns.json"
+
+# ``bundled:<name>`` sentinel suffix -> packaged JSON filename. This is the
+# single registry new bundled profiles slot into (025).
+BUNDLED_PROFILES = {
+    CHROMIUM_USERNS_NAME: CHROMIUM_USERNS_PROFILE,
+}
+
+
+def _profile_path(filename: str) -> str:
+    """Host filesystem path to a packaged seccomp profile JSON."""
+    traversable = files("agentic_dev_loop.engine.seccomp").joinpath(filename)
+    with as_file(traversable) as path:
+        return str(path)
+
+
+def bundled_profile_path(name: str) -> str:
+    """Host filesystem path to the named bundled seccomp profile.
+
+    Raises ``ValueError`` listing every known ``bundled:<name>`` when ``name``
+    is unknown, so a bad sentinel fails loud at load instead of at
+    container-create time.
+    """
+    filename = BUNDLED_PROFILES.get(name)
+    if filename is None:
+        known = ", ".join(f"bundled:{n}" for n in sorted(BUNDLED_PROFILES))
+        raise ValueError(
+            f"unknown bundled seccomp profile {name!r} (known: {known})")
+    return _profile_path(filename)
+
+
+def chromium_userns_profile_path() -> str:
+    """Host filesystem path to the bundled Chromium userns seccomp profile.
+
+    Docker's ``--security-opt seccomp=<path>`` takes a host path, so the JSON
+    must resolve to a real file. Wheels unpack to disk, so ``as_file`` returns
+    the installed path without copying.
+    """
+    return bundled_profile_path(CHROMIUM_USERNS_NAME)
+
+
+def resolve_seccomp_profile(value: str | None) -> str | None:
+    """Expand a ``bundled:<name>`` sentinel to its real profile path (025).
+
+    A raw host path passes through unchanged (Docker still validates it at
+    container-create time, unchanged from 023). An unknown or empty bundled
+    name fails loud with every known ``bundled:<name>``.
+    """
+    if value is None or not value.startswith("bundled:"):
+        return value
+    name = value[len("bundled:"):]
+    if not name:
+        known = ", ".join(f"bundled:{n}" for n in sorted(BUNDLED_PROFILES))
+        raise ValueError(
+            f"seccomp_profile 'bundled:' is missing a name (known: {known})")
+    return bundled_profile_path(name)

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/src/agentic_dev_loop/engine/stages.py

@@ -254,8 +254,13 @@ def _unclear_note(runtime: Runtime, step: StepConfig, attempt: int,
     captured response when it exists, so real findings are never swallowed."""
     expected = ""
     if step.verdicts is not None:
-        expected = (f" (expected `VERDICT: {step.verdicts.pass_}` or "
-                    f"`VERDICT: {step.verdicts.fail}` on its own line)")
+        if step.verdicts.unverifiable is not None:
+            expected = (f" (expected `VERDICT: {step.verdicts.pass_}`, "
+                        f"`VERDICT: {step.verdicts.fail}`, or "
+                        f"`VERDICT: {step.verdicts.unverifiable}` on its own line)")
+        else:
+            expected = (f" (expected `VERDICT: {step.verdicts.pass_}` or "
+                        f"`VERDICT: {step.verdicts.fail}` on its own line)")
     if truncated:
         lead = (f"{step.name} agent was cut short on attempt {attempt} "
                 f"(hit the {max_iterations}-turn limit or was stopped "
@@ -282,6 +287,8 @@ def make_agent_node(runtime: Runtime, step: StepConfig):
     verdicts_map = None
     if step.verdicts is not None:
         verdicts_map = {step.verdicts.pass_: "pass", step.verdicts.fail: "fail"}
+        if step.verdicts.unverifiable is not None:
+            verdicts_map[step.verdicts.unverifiable] = "unverifiable"
     captures = step.artifact is not None or bool(step.produces)
 
     def node(state: dict) -> dict:
@@ -334,6 +341,10 @@ def make_agent_node(runtime: Runtime, step: StepConfig):
                 print(f"[{subject}] {step.name} VERDICT: PASS on attempt {attempt}.",
                       flush=True)
                 return {"step_verdicts": merged, "failed": False}
+            if verdict == "unverifiable":
+                print(f"[{subject}] {step.name} qa verdict: UNVERIFIABLE "
+                      f"(moves on).", flush=True)
+                return {"step_verdicts": merged, "failed": False}
             print(f"[{subject}] {step.name} verdict: fail on attempt {attempt}.",
                   flush=True)
             update = {"step_verdicts": merged,
@@ -519,6 +530,10 @@ def make_router(runtime: Runtime, step: StepConfig):
         verdict = state["step_verdicts"].get(step.name)
         if verdict == "pass":
             return resolve(step.on_pass)
+        if verdict == "unverifiable":
+            if step.on_unverifiable is not None:
+                return resolve(step.on_unverifiable)
+            return resolve(step.on_pass)
         if verdict == "fail":
             if step.on_fail is None:
                 return END

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/src/agentic_dev_loop/viz/server.py

@@ -472,6 +472,7 @@ PAGE = """<!doctype html>
            background: #f0f0f0; color: #333; }
   .badge-pass { background: #e8f5e9; color: #2e7d32; }
   .badge-fail { background: #ffebee; color: #c62828; }
+  .badge-unverifiable { background: #ede7f6; color: #4527a0; }
   .badge-unclear { background: #fff8e1; color: #f57f17; }
   #stages { flex: 1 1 auto; min-height: 0; overflow-y: auto; display: flex;
             flex-direction: column; gap: 8px; }
@@ -487,6 +488,7 @@ PAGE = """<!doctype html>
   .status-pass { color: #2e7d32; }
   .status-fail { color: #b26a00; }
   .status-fatal { color: #c62828; }
+  .status-unverifiable { color: #7e57c2; }
   .console-wrap { max-height: 240px; overflow-y: auto; background: #1e1e1e; }
   .stage-console { margin: 0; padding: 8px 10px; background: #1e1e1e;
                    color: #e0e0e0; font: 12px/1.5 ui-monospace, SFMono-Regular,
@@ -543,6 +545,7 @@ PAGE = """<!doctype html>
   var currentVerdicts = {};
   var verdictFail = new Set();
   var verdictPass = new Set();
+  var verdictUnverifiable = new Set();
   var fatalNodes = new Set();
   var maxAttempts = null;
   var attempt = null;
@@ -610,6 +613,7 @@ PAGE = """<!doctype html>
     if (nodeStatus[n] === "fatal") { return "fatal"; }
     if (verdictFail.has(n)) { return "fail"; }
     if (verdictPass.has(n)) { return "pass"; }
+    if (verdictUnverifiable.has(n)) { return "unverifiable"; }
     return nodeStatus[n] || "pending";
   }
 
@@ -622,6 +626,7 @@ PAGE = """<!doctype html>
       b.className = "badge";
       if (v === "pass") { b.className += " badge-pass"; }
       else if (v === "fail") { b.className += " badge-fail"; }
+      else if (v === "unverifiable") { b.className += " badge-unverifiable"; }
       else { b.className += " badge-unclear"; }
       b.textContent = step + ": " + (v === null || v === undefined ? "no verdict" : v);
       box.appendChild(b);
@@ -632,6 +637,7 @@ PAGE = """<!doctype html>
     verdictSteps.clear();
     verdictPass.clear();
     verdictFail.clear();
+    verdictUnverifiable.clear();
     currentVerdicts = {};
     nodeStatus = {};
     stageWord = {};
@@ -653,6 +659,7 @@ PAGE = """<!doctype html>
       "classDef pass fill:#2e7d32,stroke:#2e7d32,color:#fff",
       "classDef fail fill:#ffb300,stroke:#ffb300,color:#fff",
       "classDef fatal fill:#c62828,stroke:#c62828,color:#fff",
+      "classDef unverifiable fill:#7e57c2,stroke:#7e57c2,color:#fff",
       "classDef pending fill:#f2f0ff,stroke:#555,color:#000"
     ];
     var classLines = Object.keys(nodeStatus).filter(function (n) {
@@ -748,6 +755,7 @@ PAGE = """<!doctype html>
       var v = currentVerdicts[node];
       if (v === "pass") { suffix = " (verdict: PASS)"; }
       else if (v === "fail") { suffix = " (verdict: FAIL)"; }
+      else if (v === "unverifiable") { suffix = " (verdict: UNVERIFIABLE)"; }
     }
     status.textContent = (word ? " " + word : "") + suffix;
     header.className = "stage-header status-" + statusOf(node);
@@ -1064,9 +1072,10 @@ PAGE = """<!doctype html>
           Object.keys(ev.step_verdicts).forEach(function (k) {
             verdictSteps.add(k);
             var v = ev.step_verdicts[k];
-            if (v === "pass") { verdictPass.add(k); verdictFail.delete(k); }
-            else if (v === "fail") { verdictFail.add(k); verdictPass.delete(k); }
-            else { verdictPass.delete(k); verdictFail.delete(k); }
+            if (v === "pass") { verdictPass.add(k); verdictFail.delete(k); verdictUnverifiable.delete(k); }
+            else if (v === "fail") { verdictFail.add(k); verdictPass.delete(k); verdictUnverifiable.delete(k); }
+            else if (v === "unverifiable") { verdictUnverifiable.add(k); verdictPass.delete(k); verdictFail.delete(k); }
+            else { verdictPass.delete(k); verdictFail.delete(k); verdictUnverifiable.delete(k); }
             currentVerdicts[k] = v;
           });
           updateBadges();

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/src/agentic_dev_loop.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a14
+Version: 1.0.0a16
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -213,7 +213,7 @@ steps:
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox (command steps, network ON, stamp-cached); `network: true` grants egress to a command or agent step (default off) - see [Per-stage networking](#per-stage-networking). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only - never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
-| `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`. It can never disable it. |
+| `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`, `seccomp_profile`. It can never disable it. See [browser sandbox](docs/browser-sandbox.md). |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` - artifacts and checkpoints live outside the sandbox mount. |
 | `extensions_dir` | Where consumer `extensions:` modules resolve - defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
 | `deps_policy` | `locked` (default) or `open`. `locked` = the human-owned lockfile is the source of truth and the agent may not add dependencies; `open` = the bootstrap protocol (the agent may add exact-pinned manifest entries). See [Dependency policy](#dependency-policy-locked-by-default). |

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/src/agentic_dev_loop.egg-info/SOURCES.txt

@@ -57,6 +57,7 @@ tests/test_outputs.py
 tests/test_outputs_pbt.py
 tests/test_proc.py
 tests/test_publish.py
+tests/test_qa_prompt.py
 tests/test_registry.py
 tests/test_repo_ascii.py
 tests/test_results.py

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/tests/test_config.py

@@ -195,6 +195,28 @@ def test_unknown_verdicts_key_rejected(tmp_path):
         _load(tmp_path, data)
 
 
+def test_three_keyword_verdict_and_on_unverifiable_load(tmp_path):
+    data = _base()
+    data["steps"][0] = {
+        "name": "qa", "agent": "qa", "artifact": "qa-report.md",
+        "verdicts": {"pass": "PASS", "fail": "FAIL",
+                     "unverifiable": "UNVERIFIABLE"},
+        "on_pass": "success", "on_unverifiable": "success",
+    }
+    step = _load(tmp_path, data).steps[0]
+    assert step.verdicts.pass_ == "PASS"
+    assert step.verdicts.fail == "FAIL"
+    assert step.verdicts.unverifiable == "UNVERIFIABLE"
+    assert step.on_unverifiable == "success"
+
+
+def test_dangling_on_unverifiable_rejected(tmp_path):
+    data = _base()
+    data["steps"][0]["on_unverifiable"] = "nope"
+    with pytest.raises(ValidationError, match="unknown route target 'nope'"):
+        _load(tmp_path, data)
+
+
 def test_dangling_on_pass_rejected(tmp_path):
     data = _base()
     data["steps"][0]["on_pass"] = "nope"

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/tests/test_isolation.py

@@ -1097,6 +1097,54 @@ class TestStartupSandbox:
         finally:
             sandbox.close()
 
+    def test_bundled_seccomp_sentinel_resolved_and_plumbed(self, tmp_path, monkeypatch):
+        """025: a ``bundled:chromium-userns`` sentinel is expanded to the real
+        packaged path before the exec payload is built, so the payload sees a
+        plain path and emits the profile plus the cap-gated SYS_CHROOT add."""
+        from agentic_dev_loop.engine.isolation import startup_sandbox
+        from agentic_dev_loop.engine.seccomp import chromium_userns_profile_path
+
+        ws = tmp_path / "ws"
+        ws.mkdir()
+        cfg = self._cfg(tmp_path, with_setup=False)
+        cfg.isolation.seccomp_profile = "bundled:chromium-userns"
+        monkeypatch.setattr("agentic_dev_loop.engine.isolation.shutil.which",
+                            lambda *a: "/usr/bin/docker")
+        monkeypatch.setenv("AGENTIC_DEV_LOOP_DEV_IMAGE", "img:tag")
+        runner = FakeRunner(
+            ok("1.54"),   # probe version
+            ok("linux"),  # probe ostype
+            ok(""),       # image inspect
+            ok(""),       # docker run -d --rm (exec container)
+        )
+        sandbox = startup_sandbox(cfg, workspace=ws, runner=runner)
+        try:
+            run_argv = [c for c in runner.calls if c[:2] == ["docker", "run"]][0]
+            resolved = chromium_userns_profile_path()
+            assert "--security-opt" in run_argv
+            assert run_argv[run_argv.index("--security-opt") + 1] == f"seccomp={resolved}"
+            assert "--cap-add" in run_argv
+            assert run_argv[run_argv.index("--cap-add") + 1] == "SYS_CHROOT"
+        finally:
+            sandbox.close()
+
+    def test_unknown_bundled_seccomp_name_fails_before_docker_probe(self, tmp_path, monkeypatch):
+        """025: an unknown bundled:<name> fails loud at startup, before any
+        Docker probe runs."""
+        from agentic_dev_loop.engine.isolation import startup_sandbox
+
+        ws = tmp_path / "ws"
+        ws.mkdir()
+        cfg = self._cfg(tmp_path, with_setup=False)
+        cfg.isolation.seccomp_profile = "bundled:unknown-name"
+        monkeypatch.setattr("agentic_dev_loop.engine.isolation.shutil.which",
+                            lambda *a: "/usr/bin/docker")
+        monkeypatch.setenv("AGENTIC_DEV_LOOP_DEV_IMAGE", "img:tag")
+        runner = FakeRunner()
+        with pytest.raises(ValueError, match="bundled:chromium-userns"):
+            startup_sandbox(cfg, workspace=ws, runner=runner)
+        assert runner.calls == []
+
     def test_in_workspace_sandbox_venv_dir_fails_loud(self, tmp_path, monkeypatch):
         from agentic_dev_loop.engine.isolation import startup_sandbox
 
@@ -1155,3 +1203,60 @@ class TestBundledSeccompProfile:
         path = Path(chromium_userns_profile_path())
         assert path.is_file()
         assert json.loads(path.read_text(encoding="utf-8"))["defaultAction"]             == "SCMP_ACT_ERRNO"
+
+
+class TestResolveSeccompProfile:
+    """025: the ``bundled:<name>`` sentinel resolves to a packaged profile
+    path; raw host paths pass through unchanged; unknown names fail loud with
+    every known bundled name."""
+
+    def test_bundled_sentinel_resolves_to_real_path(self):
+        from agentic_dev_loop.engine.seccomp import (chromium_userns_profile_path,
+                                                     resolve_seccomp_profile)
+
+        resolved = resolve_seccomp_profile("bundled:chromium-userns")
+        assert resolved == chromium_userns_profile_path()
+        assert Path(resolved).is_file()
+
+    def test_unknown_bundled_name_lists_known(self):
+        from agentic_dev_loop.engine.seccomp import resolve_seccomp_profile
+
+        with pytest.raises(ValueError, match="bundled:chromium-userns"):
+            resolve_seccomp_profile("bundled:unknown-name")
+
+    def test_empty_bundled_name_lists_known(self):
+        from agentic_dev_loop.engine.seccomp import resolve_seccomp_profile
+
+        with pytest.raises(ValueError, match="bundled:chromium-userns"):
+            resolve_seccomp_profile("bundled:")
+
+    def test_none_passes_through(self):
+        from agentic_dev_loop.engine.seccomp import resolve_seccomp_profile
+
+        assert resolve_seccomp_profile(None) is None
+
+    def test_raw_path_passes_through(self):
+        from agentic_dev_loop.engine.seccomp import resolve_seccomp_profile
+
+        assert resolve_seccomp_profile(
+            "/host/chromium-userns.json") == "/host/chromium-userns.json"
+
+    def test_bundled_profile_path_unknown_name(self):
+        from agentic_dev_loop.engine.seccomp import bundled_profile_path
+
+        with pytest.raises(ValueError, match="bundled:chromium-userns"):
+            bundled_profile_path("nope")
+
+    def test_sentinel_resolves_into_payload(self):
+        """025: the resolved sentinel path reaches ``docker_create_payload``
+        unchanged, producing the profile security-opt and the cap-add."""
+        from agentic_dev_loop.engine.seccomp import resolve_seccomp_profile
+
+        resolved = resolve_seccomp_profile("bundled:chromium-userns")
+        payload = docker_create_payload(
+            run_id="r1", image="img",
+            profile=EffectiveProfile(True, True, True, True, True,
+                                     "img", "4g", 2.0),
+            workspace="/ws", seccomp_profile=resolved)
+        assert payload[payload.index("--security-opt") + 1] == f"seccomp={resolved}"
+        assert payload[payload.index("--cap-add") + 1] == "SYS_CHROOT"

agentic_dev_loop-1.0.0a16/tests/test_qa_prompt.py

@@ -0,0 +1,29 @@
+"""QA prompt contract (024): the no-substitution rule and the three-way
+verdict rules live in the dogfood copy of sdk_agents/qa.agent.md."""
+
+from pathlib import Path
+
+QA_PROMPT = Path(__file__).parent.parent / "agentic-dev-loop" / "sdk_agents" / "qa.agent.md"
+
+
+def _text() -> str:
+    return QA_PROMPT.read_text(encoding="utf-8")
+
+
+def test_no_substitution_rule_present():
+    text = _text()
+    assert "Never substitute unrelated generic probes" in text
+    assert "UNVERIFIABLE" in text
+    assert "blocking reason" in text
+
+
+def test_unverifiable_verdict_rules_present():
+    text = _text()
+    assert "VERDICT: PASS" in text
+    assert "VERDICT: UNVERIFIABLE" in text
+    assert "VERDICT: FAIL" in text
+    assert "## UNVERIFIABLE" in text
+
+
+def test_inconclusive_budget_rule_retained():
+    assert "INCONCLUSIVE" in _text()

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/tests/test_stages.py

@@ -251,6 +251,36 @@ class TestAgentNode:
         make_agent_node(runtime, step)(make_state())
         assert fake_agents.calls[0]["max_iterations"] == 200
 
+    def test_unverifiable_verdict_records_and_moves_on(self, runtime,
+                                                       fake_agents, capsys):
+        step = make_cfg([
+            {"name": "dev", "agent": "dev", "on_pass": "qa"},
+            {"name": "qa", "agent": "qa", "artifact": "qa-report.md",
+             "verdicts": {"pass": "PASS", "fail": "FAIL",
+                          "unverifiable": "UNVERIFIABLE"},
+             "on_pass": "commit", "on_fail": {"goto": "dev", "retry": True},
+             "on_unverifiable": "commit"},
+            {"name": "commit", "action": "commit", "on_pass": "success"}]).steps[1]
+        fake_agents.set("qa", [("write", "qa-report.md", "VERDICT: UNVERIFIABLE")])
+        update = make_agent_node(runtime, step)(make_state())
+        assert update["step_verdicts"] == {"qa": "unverifiable"}
+        assert update["failed"] is False
+        assert "notes" not in update
+        assert "UNVERIFIABLE (moves on)" in capsys.readouterr().out
+
+    def test_unclear_note_mentions_third_keyword(self, runtime, fake_agents):
+        step = make_cfg([
+            {"name": "qa", "agent": "qa", "artifact": "qa-report.md",
+             "verdicts": {"pass": "PASS", "fail": "FAIL",
+                          "unverifiable": "UNVERIFIABLE"},
+             "on_pass": "success"}]).steps[0]
+        fake_agents.set("qa", [("write", "qa-report.md", "undecided")])
+        update = make_agent_node(runtime, step)(make_state())
+        (note,) = update["notes"]
+        assert "VERDICT: PASS" in note
+        assert "VERDICT: FAIL" in note
+        assert "VERDICT: UNVERIFIABLE" in note
+
 
 class TestCommandNode:
     def _node(self, runtime, steps, idx=0):
@@ -464,6 +494,35 @@ class TestRouter:
         router = make_router(runtime, cfg.steps[1])
         assert router(make_state(step_verdicts={"c": "fail"})) == "a"
 
+    def test_unverifiable_routes_on_unverifiable(self, runtime):
+        cfg = make_cfg([
+            {"name": "dev", "agent": "dev", "on_pass": "qa"},
+            {"name": "qa", "agent": "qa", "artifact": "qa-report.md",
+             "verdicts": {"pass": "PASS", "fail": "FAIL",
+                          "unverifiable": "UNVERIFIABLE"},
+             "on_pass": "commit", "on_fail": {"goto": "dev", "retry": True},
+             "on_unverifiable": "commit"},
+            {"name": "commit", "action": "commit", "on_pass": "success"},
+        ])
+        runtime = dataclasses.replace(runtime, cfg=cfg)
+        router = make_router(runtime, cfg.steps[1])
+        assert router(make_state(step_verdicts={"qa": "unverifiable"})) == "commit"
+
+    def test_unverifiable_falls_back_to_on_pass_and_never_retries(self, runtime):
+        cfg = make_cfg([
+            {"name": "dev", "agent": "dev", "on_pass": "qa"},
+            {"name": "qa", "agent": "qa", "artifact": "qa-report.md",
+             "verdicts": {"pass": "PASS", "fail": "FAIL",
+                          "unverifiable": "UNVERIFIABLE"},
+             "on_pass": "commit", "on_fail": {"goto": "dev", "retry": True}},
+            {"name": "commit", "action": "commit", "on_pass": "success"},
+        ])
+        runtime = dataclasses.replace(runtime, cfg=cfg)
+        router = make_router(runtime, cfg.steps[1])
+        # unset on_unverifiable -> on_pass; never on_fail's bump retry
+        assert router(make_state(attempt=1,
+                                 step_verdicts={"qa": "unverifiable"})) == "commit"
+
 
 class TestBumpNode:
     def test_consumes_attempt_resets_verdicts_rebuilds_cleans(self, runtime):

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/tests/test_verdict.py

@@ -3,10 +3,11 @@ Result API (BR-2): decisions route as `Result.ok(Verdict)`; verdict lines
 without a decision, or conflicting decisions, are typed errors that feed
 the attempt-bounded retry path - never exceptions, never silent routing."""
 
-from agentic_dev_loop.core.verdict import Verdict, VerdictError
+from agentic_dev_loop.core.verdict import Verdict, VerdictError, parse_verdict
 
 REVIEW_VERDICTS = {"APPROVED": "approved", "NEEDS CHANGES": "needs_changes"}
 TEST_VERDICTS = {"PASS": "pass", "FAIL": "fail"}
+QA_VERDICTS = {"PASS": "pass", "FAIL": "fail", "UNVERIFIABLE": "unverifiable"}
 
 
 def _parse(text, verdicts):
@@ -169,6 +170,24 @@ class TestVerdictParsing:
     def test_not_unknown_keyword_rejected(self):
         _err("VERDICT: NOT MAYBE", REVIEW_VERDICTS, VerdictError.AMBIGUOUS)
 
+    def test_parse_unverifiable(self):
+        _ok("VERDICT: UNVERIFIABLE", QA_VERDICTS, "unverifiable")
+        _ok("VERDICT: UNVERIFIABLE - no docker in the sandbox",
+            QA_VERDICTS, "unverifiable")
+        _ok("verdict: unverifiable", QA_VERDICTS, "unverifiable")
+
+    def test_parse_verdict_unverifiable_returns_canonical_value(self):
+        assert parse_verdict("VERDICT: UNVERIFIABLE", QA_VERDICTS) == "unverifiable"
+
+    def test_negated_unverifiable_stays_ambiguous_on_three_key_sets(self):
+        _err("VERDICT: NOT UNVERIFIABLE", QA_VERDICTS, VerdictError.AMBIGUOUS)
+
+    def test_conflicting_pass_and_unverifiable_is_ambiguous(self):
+        _err("VERDICT: PASS\nVERDICT: UNVERIFIABLE", QA_VERDICTS,
+             VerdictError.AMBIGUOUS)
+        assert parse_verdict("VERDICT: PASS\nVERDICT: UNVERIFIABLE",
+                             QA_VERDICTS) == "retry"
+
 
 class TestConflictingDecisions:
     """BR-2.4: conflicting *decisions* are never silently resolved."""

{agentic_dev_loop-1.0.0a14 → agentic_dev_loop-1.0.0a16}/tests/test_viz.py

@@ -734,6 +734,15 @@ class TestServer:
         assert "verdictFail" in PAGE
         assert "verdictPass" in PAGE
 
+    def test_page_constant_has_unverifiable_verdict_support(self):
+        assert "classDef unverifiable" in PAGE
+        assert ".badge-unverifiable" in PAGE
+        assert ".status-unverifiable" in PAGE
+        assert "verdictUnverifiable" in PAGE
+        # the new value maps to badge-unverifiable, not the unclear fallthrough
+        assert 'else if (v === "unverifiable")' in PAGE
+        assert " (verdict: UNVERIFIABLE)" in PAGE
+
     def test_page_constant_color_palette(self):
         assert 'classDef running fill:#1976d2' in PAGE
         assert 'classDef fail fill:#ffb300' in PAGE
@@ -1097,6 +1106,19 @@ main();
         assert snaps[1]["classes"]["test"] == "pass"
         assert snaps[1]["classes"]["review"] == "fail"
 
+    def test_unverifiable_verdict_badge_and_class(self, node, tmp_path):
+        events = [
+            {"type": "run_started", "subject": "s", "max_attempts": 5,
+             "attempt": 1, "thread_id": "t"},
+            {"type": "node_finished", "node": "review", "ok": True},
+            {"type": "state", "attempt": 1,
+             "step_verdicts": {"review": "unverifiable"}, "failed": False},
+        ]
+        snaps = self._run_page(node, events, tmp_path)
+
+        assert snaps[0]["badges"] == ["review: unverifiable"]
+        assert snaps[0]["classes"]["review"] == "unverifiable"
+
     def test_copy_button_copies_console_text(self, node, tmp_path):
         events = [
             {"type": "run_started", "subject": "s", "max_attempts": 5,

agentic_dev_loop-1.0.0a14/src/agentic_dev_loop/engine/seccomp/__init__.py

@@ -1,27 +0,0 @@
-"""Bundled Docker seccomp profiles (023).
-
-Docker's default seccomp profile blocks the user-namespace syscalls Chromium's
-namespace sandbox needs, which makes ``chromium.launch(chromiumSandbox=True)``
-die at the zygote under ``--cap-drop ALL``. These profiles are Docker's default
-profile with an allowlist for those userns syscalls; pass one as
-``isolation.seccomp_profile`` to swap it in.
-"""
-
-from __future__ import annotations
-
-from importlib.resources import as_file, files
-
-CHROMIUM_USERNS_PROFILE = "chromium-userns.json"
-
-
-def chromium_userns_profile_path() -> str:
-    """Host filesystem path to the bundled Chromium userns seccomp profile.
-
-    Docker's ``--security-opt seccomp=<path>`` takes a host path, so the JSON
-    must resolve to a real file. Wheels unpack to disk, so ``as_file`` returns
-    the installed path without copying.
-    """
-    traversable = files("agentic_dev_loop.engine.seccomp").joinpath(
-        CHROMIUM_USERNS_PROFILE)
-    with as_file(traversable) as path:
-        return str(path)