agentic-dev-loop 1.0.0a31__tar.gz → 1.0.0a34__tar.gz

{agentic_dev_loop-1.0.0a31/src/agentic_dev_loop.egg-info → agentic_dev_loop-1.0.0a34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a31
+Version: 1.0.0a34
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -224,6 +224,8 @@ steps:
     agent: qa
     artifact: qa-report.md
     verdicts: { pass: PASS, fail: FAIL }
+    max_iterations: 100
+    finalize_nudge_turns: 10
     on_pass: commit
     on_fail: { goto: dev, retry: true }
 
@@ -239,6 +241,8 @@ steps:
 | `brief_inputs:` | Optional agent-step input spec: `{ include: [<paths/globs>], env_facts: [<strings>] }`. The engine resolves the include list against the workspace, passes the resolved docs + include contents + env facts as that step's task message, and regenerates the step only when those inputs change. A produces-only agent step such as `brief` is the documented pattern for per-run context digestion. |
 | `stop_when:` | Optional agent-step termination: `{ green_command: <argv regex>, post_green_turns: <int, default 2> }`. When the agent's most recent terminal observation matching `green_command` exits 0 and no workspace writes have happened since, the engine injects one nudge turn, allows `post_green_turns` further turns, then closes the conversation. Absent = run to finish. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
+| `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
+| `custom_prompt:` | Planned (planning-docs/039). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox before the step runs (command or agent steps; network ON; stamp-cached, re-runs when the pipeline's lockfiles change); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |
@@ -338,6 +342,16 @@ steps:
   to exactly the declared hosts for that stage; the default stays network-off
   everywhere. Reserve it for stages that need it (QA, integration). The
   residual risks are documented in [docs/setup.md](docs/setup.md).
+- **Host-service reachability (planned - planning-docs/037, 038).** A host
+  service reached at `host.docker.internal` through the proxy fails today:
+  the policy admits it, but the proxy dials from the host, where that
+  container-only name does not resolve (a 502 for the client). 037 rewrites
+  `host.docker.internal` to host loopback at the proxy dial site, so signed
+  host-service traffic (an S3 SDK against a local MinIO, say) reaches the
+  host through the enforced, logged path. 038 then replaces the
+  host-gateway model with a per-run internal network: sandboxes get no host
+  route, and a containerized proxy on a second host-access network is the
+  only egress path.
 
 ### Sync-back conflicts (host edits during a run)
 
@@ -421,9 +435,10 @@ an agent burned budget learning it mid-run:
   the dev agent's next context; the dev prompt makes every listed issue a
   required fix.
 - **No git mutations, ever.** The `commit` step is the single commit point.
-- **`max_iterations` per role.** qa is bounded probing (60 in both
-  reference repos); dev is open-ended construction and stays uncapped
-  (the engine default).
+- **`max_iterations` per role.** qa is bounded probing (100 in this
+  repo's dogfood loop, with `finalize_nudge_turns: 10` so it never ends
+  silently at the cap - both provisional); dev is open-ended construction
+  and stays uncapped (the engine default).
 
 ### The pipeline file
 
@@ -438,7 +453,7 @@ adapt per repo.
 | editor-tests | command | network + `presets: [package-registries]` | frontend suites that cannot run offline (`npm ci && npm test`). A separate step, never merged into `test`: the step name is the failure diagnosis, its timeout does not contend the backend suite's, and a retry re-runs only its own chain |
 | conformance | command | network + `presets: [package-registries]` | repo-specific fitness checks (the consumer repo: jscpd + DDD rules) |
 | review | agent | ro, offline | static conformance verdict |
-| qa | agent | per repo (see table above) | live-behaviour probes; `max_iterations: 60`; inject secrets only if the probes need them |
+| qa | agent | per repo (see table above) | live-behaviour probes; `max_iterations: 100` + `finalize_nudge_turns: 10` (provisional); inject secrets only if the probes need them |
 | commit | action | host-side | the single commit point |
 
 Adaptation checklist for a new repo:

{agentic_dev_loop-1.0.0a31 → agentic_dev_loop-1.0.0a34}/README.md

@@ -182,6 +182,8 @@ steps:
     agent: qa
     artifact: qa-report.md
     verdicts: { pass: PASS, fail: FAIL }
+    max_iterations: 100
+    finalize_nudge_turns: 10
     on_pass: commit
     on_fail: { goto: dev, retry: true }
 
@@ -197,6 +199,8 @@ steps:
 | `brief_inputs:` | Optional agent-step input spec: `{ include: [<paths/globs>], env_facts: [<strings>] }`. The engine resolves the include list against the workspace, passes the resolved docs + include contents + env facts as that step's task message, and regenerates the step only when those inputs change. A produces-only agent step such as `brief` is the documented pattern for per-run context digestion. |
 | `stop_when:` | Optional agent-step termination: `{ green_command: <argv regex>, post_green_turns: <int, default 2> }`. When the agent's most recent terminal observation matching `green_command` exits 0 and no workspace writes have happened since, the engine injects one nudge turn, allows `post_green_turns` further turns, then closes the conversation. Absent = run to finish. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
+| `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
+| `custom_prompt:` | Planned (planning-docs/039). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox before the step runs (command or agent steps; network ON; stamp-cached, re-runs when the pipeline's lockfiles change); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |
@@ -296,6 +300,16 @@ steps:
   to exactly the declared hosts for that stage; the default stays network-off
   everywhere. Reserve it for stages that need it (QA, integration). The
   residual risks are documented in [docs/setup.md](docs/setup.md).
+- **Host-service reachability (planned - planning-docs/037, 038).** A host
+  service reached at `host.docker.internal` through the proxy fails today:
+  the policy admits it, but the proxy dials from the host, where that
+  container-only name does not resolve (a 502 for the client). 037 rewrites
+  `host.docker.internal` to host loopback at the proxy dial site, so signed
+  host-service traffic (an S3 SDK against a local MinIO, say) reaches the
+  host through the enforced, logged path. 038 then replaces the
+  host-gateway model with a per-run internal network: sandboxes get no host
+  route, and a containerized proxy on a second host-access network is the
+  only egress path.
 
 ### Sync-back conflicts (host edits during a run)
 
@@ -379,9 +393,10 @@ an agent burned budget learning it mid-run:
   the dev agent's next context; the dev prompt makes every listed issue a
   required fix.
 - **No git mutations, ever.** The `commit` step is the single commit point.
-- **`max_iterations` per role.** qa is bounded probing (60 in both
-  reference repos); dev is open-ended construction and stays uncapped
-  (the engine default).
+- **`max_iterations` per role.** qa is bounded probing (100 in this
+  repo's dogfood loop, with `finalize_nudge_turns: 10` so it never ends
+  silently at the cap - both provisional); dev is open-ended construction
+  and stays uncapped (the engine default).
 
 ### The pipeline file
 
@@ -396,7 +411,7 @@ adapt per repo.
 | editor-tests | command | network + `presets: [package-registries]` | frontend suites that cannot run offline (`npm ci && npm test`). A separate step, never merged into `test`: the step name is the failure diagnosis, its timeout does not contend the backend suite's, and a retry re-runs only its own chain |
 | conformance | command | network + `presets: [package-registries]` | repo-specific fitness checks (the consumer repo: jscpd + DDD rules) |
 | review | agent | ro, offline | static conformance verdict |
-| qa | agent | per repo (see table above) | live-behaviour probes; `max_iterations: 60`; inject secrets only if the probes need them |
+| qa | agent | per repo (see table above) | live-behaviour probes; `max_iterations: 100` + `finalize_nudge_turns: 10` (provisional); inject secrets only if the probes need them |
 | commit | action | host-side | the single commit point |
 
 Adaptation checklist for a new repo:

{agentic_dev_loop-1.0.0a31 → agentic_dev_loop-1.0.0a34}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a31"
+version = "1.0.0a34"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-1.0.0a31 → agentic_dev_loop-1.0.0a34}/src/agentic_dev_loop/core/config.py

@@ -387,9 +387,11 @@ class StepConfig(BaseModel):
     timeout: float | None = Field(default=None, gt=0)  # seconds, command steps only
     terminal_timeout: float | None = Field(default=None, gt=0)  # seconds, agent steps only (032)
     stop_when: StopWhenSpec | None = None  # agent steps only (032)
+    finalize_nudge_turns: int | None = Field(default=None, gt=0)  # agent steps only (035)
     brief_inputs: BriefInputsSpec | None = None  # agent steps only (033)
     env: dict[str, str | None] | None = None  # NFR-1: null = inherit host value
     setup: str | None = None  # BR-13: command steps only
+    forbidden_commands: list[str] = []  # banned-command regex deny-list (036 D1)
     network: bool = False  # per-stage egress (command/agent + sandbox actions; host-side actions reject at registry time)
     # unit-5: per-step mount granularity + egress policy. Empty mounts =
     # strict-by-default (BR-1.1); egress None = strict empty allowlist
@@ -419,6 +421,26 @@ class StepConfig(BaseModel):
     def _coerce_produces(cls, v: Any) -> Any:
         return [v] if isinstance(v, str) else v
 
+    @field_validator("forbidden_commands", mode="before")
+    @classmethod
+    def _coerce_forbidden_commands(cls, v: Any) -> Any:
+        return [v] if isinstance(v, str) else v
+
+    @field_validator("forbidden_commands")
+    @classmethod
+    def _valid_forbidden_commands(cls, v: list[str]) -> list[str]:
+        for pattern in v:
+            if not isinstance(pattern, str) or not pattern.strip():
+                raise ValueError(
+                    "forbidden_commands entries must be non-empty strings")
+            try:
+                re.compile(pattern)
+            except re.error as e:
+                raise ValueError(
+                    f"forbidden_commands entry {pattern!r} is not a valid "
+                    f"regex: {e}") from e
+        return v
+
     @model_validator(mode="after")
     def _check_shape(self) -> "StepConfig":
         for key in ("agent", "action", "command"):
@@ -460,6 +482,21 @@ class StepConfig(BaseModel):
             raise ValueError(
                 f"step {self.name!r}: 'stop_when' requires 'agent'"
             )
+        if self.finalize_nudge_turns is not None and self.agent is None:
+            raise ValueError(
+                f"step {self.name!r}: 'finalize_nudge_turns' requires 'agent'"
+            )
+        if self.finalize_nudge_turns is not None and self.max_iterations is None:
+            raise ValueError(
+                f"step {self.name!r}: 'finalize_nudge_turns' requires "
+                "'max_iterations'"
+            )
+        if (self.finalize_nudge_turns is not None
+                and self.finalize_nudge_turns >= self.max_iterations):
+            raise ValueError(
+                f"step {self.name!r}: 'finalize_nudge_turns' must be less "
+                "than 'max_iterations'"
+            )
         if self.brief_inputs is not None and self.agent is None:
             raise ValueError(
                 f"step {self.name!r}: 'brief_inputs' requires 'agent'"

{agentic_dev_loop-1.0.0a31 → agentic_dev_loop-1.0.0a34}/src/agentic_dev_loop/core/paths.py

@@ -67,3 +67,25 @@ def dir_excluded(dir_rel: str, excludes: tuple[str, ...] | list[str]) -> bool:
             if parts[:len(spec_parts)] == spec_parts:
                 return True
     return False
+
+
+def path_allowed(rel: str, allowlist: tuple[str, ...] | list[str]) -> bool:
+    """True when a repo-relative posix path matches an allowed path/glob.
+
+    Mirrors ``path_excluded`` semantics: literal entries match by component
+    prefix (the dir and everything under it); wildcard entries match by
+    ``fnmatch.fnmatchcase`` on the full posix relpath. A ``.`` (or blank)
+    entry allows the whole tree.
+    """
+    parts = relative_parts(rel)
+    for spec in allowlist:
+        if _has_wildcards(spec):
+            if fnmatch.fnmatchcase(rel, spec):
+                return True
+        else:
+            spec_parts = relative_parts(spec)
+            if not spec_parts:
+                return True
+            if parts[:len(spec_parts)] == spec_parts:
+                return True
+    return False

{agentic_dev_loop-1.0.0a31 → agentic_dev_loop-1.0.0a34}/src/agentic_dev_loop/engine/agents.py

@@ -15,6 +15,7 @@ from openhands.tools.file_editor import FileEditorTool  # noqa: F401 - registers
 from openhands.tools.task_tracker import TaskTrackerTool  # noqa: F401 - registers "task_tracker"
 from openhands.tools.terminal import TerminalTool  # noqa: F401 - registers "terminal"
 
+from .forbidden import ForbiddenRule, match_forbidden_command
 from .isolation import (SandboxError, SandboxExecutionRequest, command_argv,
                         resolve_sandbox_env)
 
@@ -68,7 +69,9 @@ class SandboxTerminalExecutor(ToolExecutor):
                  pipeline: str | None = None, step: str | None = None,
                  network: bool = False, mount_set=None, egress_policy=None,
                  terminal_timeout: float | None = None,
-                 on_terminal_result=None):
+                 on_terminal_result=None,
+                 forbidden_commands: tuple[ForbiddenRule, ...] | None = None,
+                 allowlist: tuple[str, ...] | None = None):
         self._sandbox = sandbox
         self._workspace = workspace
         self._env = env or {}
@@ -79,6 +82,8 @@ class SandboxTerminalExecutor(ToolExecutor):
         self._egress_policy = egress_policy
         self._terminal_timeout = terminal_timeout
         self._on_terminal_result = on_terminal_result
+        self._forbidden_commands = forbidden_commands
+        self._allowlist = allowlist
 
     def __call__(self, action, conversation=None):
         from openhands.tools.terminal import TerminalObservation
@@ -99,11 +104,19 @@ class SandboxTerminalExecutor(ToolExecutor):
         timeout = action.timeout
         if timeout is None and self._terminal_timeout is not None:
             timeout = self._terminal_timeout
+        argv = command_argv(action.command)
+        forbidden = match_forbidden_command(argv, self._forbidden_commands)
+        if forbidden is not None:
+            return TerminalObservation.from_text(
+                f"[forbidden: {forbidden}]", is_error=True,
+                command=action.command, exit_code=None, timeout=False,
+                metadata=CmdOutputMetadata(exit_code=-1))
         request = SandboxExecutionRequest(
-            argv=command_argv(action.command), cwd=self._workspace,
+            argv=argv, cwd=self._workspace,
             env=self._env, timeout=timeout,
             pipeline=self._pipeline, step=self._step, network=self._network,
-            mount_set=self._mount_set, egress_policy=self._egress_policy)
+            mount_set=self._mount_set, egress_policy=self._egress_policy,
+            allowlist=self._allowlist)
         try:
             result = self._sandbox.run(request)
         except SandboxError as exc:
@@ -142,7 +155,9 @@ def register_sandbox_terminal(sandbox: "Sandbox", *, env: dict[str, str | None]
                               mount_set=None, egress_policy=None,
                               terminal_timeout: float | None = None,
                               on_terminal_result=None,
-                              secrets: dict[str, str] | None = None) -> None:
+                              secrets: dict[str, str] | None = None,
+                              forbidden_commands: tuple[ForbiddenRule, ...] | None = None,
+                              allowlist: tuple[str, ...] | None = None) -> None:
     """Per-run re-registration of the `terminal` name (KD-4): a callable
     factory that builds the SDK terminal with a `SandboxTerminalExecutor`.
     Pipelines are sequential, so re-registering per agent step is safe.
@@ -161,6 +176,8 @@ def register_sandbox_terminal(sandbox: "Sandbox", *, env: dict[str, str | None]
                 pipeline=pipeline, step=step, network=network,
                 mount_set=mount_set, egress_policy=egress_policy,
                 terminal_timeout=terminal_timeout,
-                on_terminal_result=on_terminal_result))
+                on_terminal_result=on_terminal_result,
+                forbidden_commands=forbidden_commands,
+                allowlist=allowlist))
 
     register_tool("terminal", factory)

agentic_dev_loop-1.0.0a34/src/agentic_dev_loop/engine/allowlist.py

@@ -0,0 +1,66 @@
+"""Engine-lane allowlist (036 D2 v1).
+
+The active AI-DLC unit directory may carry ``engine-allowlist.yaml`` - a YAML
+list of repo-relative allowed paths/globs. Absent = unrestricted (backward
+compatible). Present = sync-back asserts every merged/synced path matches an
+entry and fails the step otherwise. v2 (read-only export root with rw
+bind-mounts for the allowlisted paths) is deferred.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+
+from agentic_dev_loop.core.config import _validate_declared_path
+from .loaders import select_loader
+
+ALLOWLIST_FILENAME = "engine-allowlist.yaml"
+
+
+def load_engine_allowlist(path: str | Path) -> list[str]:
+    """Parse and validate an ``engine-allowlist.yaml`` file.
+
+    The file is a plain YAML list of repo-relative path/glob strings (the
+    same declared-path vocabulary as ``sync_excludes:``). An empty file is a
+    valid, deliberately empty allowlist (nothing matches, so every synced
+    path violates the lane). Missing files are handled by the caller as the
+    unrestricted case, not here.
+    """
+    path = Path(path)
+    if not path.is_file():
+        raise FileNotFoundError(f"engine allowlist file not found: {path}")
+    data = yaml.safe_load(path.read_text(encoding="utf-8"))
+    if data is None:
+        return []
+    if not isinstance(data, list):
+        raise ValueError(
+            f"{ALLOWLIST_FILENAME} must be a YAML list of paths/globs, "
+            f"got {type(data).__name__}")
+    return [_validate_declared_path(entry, allow_wildcards=True)
+            for entry in data]
+
+
+def resolve_engine_allowlist(registry, args) -> list[str] | None:
+    """Resolve the active unit's allowlist, or None when unrestricted.
+
+    Only AI-DLC unit loaders expose a unit directory; other loaders (plan,
+    none) have no lane boundary. The file lives at
+    ``<unit_dir>/engine-allowlist.yaml``.
+    """
+    loader = select_loader(registry, args)
+    if loader is None:
+        return None
+    unit_dir = getattr(loader, "unit_dir", None)
+    if not callable(unit_dir):
+        return None
+    try:
+        path = Path(unit_dir(args)) / ALLOWLIST_FILENAME
+    except (FileNotFoundError, RuntimeError):
+        # No active AI-DLC unit can be determined (e.g. a resumed run with no
+        # aidlc-state file) -> no lane boundary, exactly like an absent file.
+        return None
+    if not path.is_file():
+        return None
+    return load_engine_allowlist(path)

{agentic_dev_loop-1.0.0a31 → agentic_dev_loop-1.0.0a34}/src/agentic_dev_loop/engine/extensions/aidlc.py

@@ -138,6 +138,12 @@ class AidlcDocumentLoader:
         _, sources = resolve_unit_docs_with_sources(self.docs_dir, unit)
         return sources
 
+    def unit_dir(self, args: argparse.Namespace) -> Path:
+        """The active unit directory (036): where the engine lane boundary
+        looks for ``engine-allowlist.yaml``."""
+        unit = getattr(args, "aidlc_unit", None) or get_current_unit(self.docs_dir)
+        return Path(self.docs_dir) / "construction" / unit
+
 
 class AidlcExtension:
     name = "ai-dlc"

agentic_dev_loop-1.0.0a34/src/agentic_dev_loop/engine/forbidden.py

@@ -0,0 +1,91 @@
+"""Banned-command deny-list (036 D1).
+
+The sandbox terminal enforces a deny-list before any shell spawn: a command
+whose argv matches a step's ``forbidden_commands:`` regex (merged with the
+engine defaults) returns a structured observation instead of reaching the
+sandbox. Command steps are unaffected - they are declared infrastructure and
+already fail fast on their exit code.
+
+The default list carries human-readable labels; custom entries use their
+regex text as the label. ``dotnet restore`` and ``dotnet add`` are network
+gated: denied only while the step's ``network:`` flag is off.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class ForbiddenRule:
+    label: str
+    regex: re.Pattern[str]
+
+
+_DEFAULT_PATTERNS: tuple[tuple[str, str], ...] = (
+    ("git commit", r"\bgit\s+commit\b"),
+    ("git push", r"\bgit\s+push\b"),
+    ("git rebase", r"\bgit\s+rebase\b"),
+    ("git checkout", r"\bgit\s+checkout\b"),
+    ("git reset", r"\bgit\s+reset\b"),
+    ("git tag", r"\bgit\s+tag\b"),
+    ("npm install", r"\bnpm\s+install\b"),
+    ("npm ci", r"\bnpm\s+ci\b"),
+    ("pip install", r"\bpip\s+install\b"),
+    ("uv add", r"\buv\s+add\b"),
+    ("pip-compile", r"\bpip-compile\b"),
+    ("dotnet add package", r"\bdotnet\s+add\s+package\b"),
+    ("npx playwright", r"\bnpx\s+playwright\b"),
+    ("playwright", r"\bplaywright\b"),
+    ("docker", r"\bdocker\b"),
+)
+
+_NETWORK_GATED_PATTERNS: tuple[tuple[str, str], ...] = (
+    ("dotnet restore", r"\bdotnet\s+restore\b"),
+    ("dotnet add", r"\bdotnet\s+add\b"),
+)
+
+
+def _compile(label: str, pattern: str) -> ForbiddenRule:
+    return ForbiddenRule(label=label, regex=re.compile(pattern, re.IGNORECASE))
+
+
+DEFAULT_FORBIDDEN_RULES: tuple[ForbiddenRule, ...] = tuple(
+    _compile(label, pattern) for label, pattern in _DEFAULT_PATTERNS)
+
+NETWORK_GATED_FORBIDDEN_RULES: tuple[ForbiddenRule, ...] = tuple(
+    _compile(label, pattern) for label, pattern in _NETWORK_GATED_PATTERNS)
+
+
+def resolve_forbidden_rules(custom_patterns: list[str] | tuple[str, ...] | None,
+                            network: bool) -> tuple[ForbiddenRule, ...]:
+    """Merge the engine defaults with a step's custom regex list.
+
+    Custom entries are appended after the defaults, so the first match wins
+    on overlap. Network-gated defaults are included only while ``network`` is
+    off; there is no disable escape hatch for the engine defaults.
+    """
+    rules = list(DEFAULT_FORBIDDEN_RULES)
+    if not network:
+        rules.extend(NETWORK_GATED_FORBIDDEN_RULES)
+    for pattern in custom_patterns or ():
+        rules.append(_compile(pattern, pattern))
+    return tuple(rules)
+
+
+def match_forbidden_command(argv: list[str],
+                            rules: tuple[ForbiddenRule, ...] | None) -> str | None:
+    """Return the label of the first matching rule for ``argv``, else None.
+
+    Match is a regex search over the space-joined argv, so shell-wrapped
+    commands (``/bin/sh -c "git commit ..."``) still match. Empty argv never
+    matches.
+    """
+    if not argv:
+        return None
+    text = " ".join(argv)
+    for rule in rules or ():
+        if rule.regex.search(text):
+            return rule.label
+    return None

{agentic_dev_loop-1.0.0a31 → agentic_dev_loop-1.0.0a34}/src/agentic_dev_loop/engine/graph.py

@@ -18,6 +18,7 @@ from langgraph.graph import END, START, StateGraph
 
 from agentic_dev_loop import viz
 from .actions import git_worktree_clean, kill_listeners_on_port
+from .allowlist import resolve_engine_allowlist
 from agentic_dev_loop.core.config import load_config
 from .hostboundary import (check_orchestrator_install,
                            check_tooling_integrity, tooling_rel_paths)
@@ -170,11 +171,13 @@ def run_pipeline(cfg_path, args, *, viz_bus=None,
 def _run_pipeline(cfg, base, registry, state_dir, max_attempts, args, viz_bus,
                   sandbox, resolved_secrets, tooling_paths) -> tuple[bool, int]:
     export_root = getattr(sandbox, "export_root", None)
+    engine_allowlist = resolve_engine_allowlist(registry, args)
     runtime = Runtime(cfg=cfg, registry=registry, llm=build_llm(cfg.llm),
                       agents_dir=base / cfg.agents_dir, state_dir=state_dir,
                       workspace=Path.cwd(), sandbox=sandbox,
                       sandbox_cwd=Path(export_root) if export_root else None,
-                      secrets=resolved_secrets)
+                      secrets=resolved_secrets,
+                      engine_allowlist=engine_allowlist)
     state_dir.mkdir(parents=True, exist_ok=True)
 
     resume = getattr(args, "resume", None)

{agentic_dev_loop-1.0.0a31 → agentic_dev_loop-1.0.0a34}/src/agentic_dev_loop/engine/isolation.py

@@ -121,6 +121,10 @@ class SandboxExecutionRequest:
     # Host-side audit metadata (BR-11) - never sent into the container.
     pipeline: str | None = None
     step: str | None = None
+    # 036 lane boundary (v1): the unit allowlist every synced path must match.
+    # None = unrestricted (no engine-allowlist.yaml); an empty tuple = present
+    # but empty file (deny all synced paths).
+    allowlist: tuple[str, ...] | None = None
 
     def __post_init__(self) -> None:
         if not self.argv:
@@ -1071,7 +1075,7 @@ class DockerBackend(Sandbox):
         result = self._exec(request, prof.name)
         report: SyncBackReport | None = None
         if mount_set.rw_paths() and self._export_root is not None:
-            report = self._sync_back(mount_set)
+            report = self._sync_back(mount_set, request.allowlist)
         if report is not None and (report.synced_paths or report.merged_paths):
             result = SandboxExecutionResult(
                 exit_code=result.exit_code, stdout=result.stdout,
@@ -1169,7 +1173,8 @@ class DockerBackend(Sandbox):
         export_path.parent.mkdir(parents=True, exist_ok=True)
         shutil.copy2(host_path, export_path, follow_symlinks=False)
 
-    def _sync_back(self, mount_set: MountSet) -> SyncBackReport | None:
+    def _sync_back(self, mount_set: MountSet,
+                   allowlist: tuple[str, ...] | None = None) -> SyncBackReport | None:
         """Sync declared-rw export changes back to the real repo (BR-4/F1),
         git-aware, host-side, with the sandbox step already complete.
 
@@ -1184,7 +1189,18 @@ class DockerBackend(Sandbox):
             self._export_root, self._workspace, list(mount_set.rw_paths()),
             baseline=self._baseline, step_id=None,
             cache_paths=self._cache_paths, excludes=self._sync_excludes,
-            merge_on_conflict=self._merge_on_conflict)
+            merge_on_conflict=self._merge_on_conflict, allowlist=allowlist)
+
+        # 036 lane boundary (v1): fail the step before any copy/delete/merge
+        # so an out-of-lane write is never promoted into the real repo.
+        if report.lane_violations:
+            _announce(
+                "lane violation: "
+                + ", ".join(report.lane_violations)
+                + " outside engine-allowlist.yaml")
+            raise SandboxError(
+                "engine lane violation: synced/merged paths outside the unit "
+                "engine-allowlist.yaml: " + ", ".join(report.lane_violations))
 
         # 029 step 2: union-merge declared merge paths first, so a mixed
         # merge+hard conflict still converges the append-style logs before