loop-engineer 0.9.0__tar.gz → 0.11.0__tar.gz

{loop_engineer-0.9.0 → loop_engineer-0.11.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "loop-engineer",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Design, launch, verify, repair, and improve agent loops. A Claude-Code-native architect+operator for long-running, verifiable, self-improving agentic-coding systems.",
   "author": {
     "name": "Sollan Systems",

loop_engineer-0.11.0/.github/workflows/ci.yml

@@ -0,0 +1,243 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  gates:
+    name: gates (py${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install gate dependencies
+        run: python -m pip install --upgrade pip pyyaml pytest jsonschema hypothesis
+
+      - name: Frontmatter gate
+        run: python -B scripts/validate_frontmatter.py
+
+      - name: Structural self-eval gate
+        run: python -B scripts/self_eval.py
+
+      - name: Test suite
+        run: python -B -m pytest -q -p no:cacheprovider scripts
+
+      - name: Compile portable core
+        run: python -B -m py_compile loop/*.py scripts/*.py
+
+      - name: Manifests and schemas are valid JSON
+        run: |
+          python -B -c "import json, glob; \
+          files = ['.claude-plugin/plugin.json', '.claude-plugin/marketplace.json'] \
+          + glob.glob('schemas/*.json') + glob.glob('evals/**/*.json', recursive=True); \
+          [json.load(open(f)) for f in files]; \
+          print(f'valid JSON: {len(files)} files')"
+
+      - name: Quickstart smoke test
+        run: |
+          python -B -m loop doctor --mode release examples/coverage-repair
+          python -B -m loop inspect examples/coverage-repair
+
+      - name: Plan lint smoke test
+        run: |
+          python -B -m loop plan-lint --mode release examples/plans/coverage-repair.plan.json
+          if python -B -m loop plan-lint --mode release examples/plans/invalid/cyclic-dependency.plan.json; then
+            echo "::error::cyclic-dependency.plan.json unexpectedly passed plan-lint"
+            exit 1
+          fi
+          if python -B -m loop plan-lint --mode release examples/plans/invalid/missing-goal.plan.json; then
+            echo "::error::missing-goal.plan.json unexpectedly passed plan-lint"
+            exit 1
+          fi
+
+  recipe-langgraph:
+    name: recipe (langgraph)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install recipe dependencies
+        run: python -m pip install --upgrade pip pyyaml pytest jsonschema langgraph
+      - name: LangGraph recipe end-to-end
+        run: python -B -m pytest -q -p no:cacheprovider scripts/test_langgraph_recipe.py scripts/test_langgraph_recipe_st3.py
+
+  recipe-temporal:
+    name: recipe (temporal)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install recipe dependencies
+        run: python -m pip install --upgrade pip pyyaml pytest jsonschema temporalio
+      - name: Temporal recipe end-to-end
+        # start_local() downloads the Temporal dev-server binary (~20MB) to
+        # $TMPDIR/temporal-sdk-python-<version> — ephemeral and quick, so (like
+        # recipe-langgraph) this job carries no cache step.
+        run: python -B -m pytest -q -p no:cacheprovider scripts/test_temporal_recipe.py
+
+  anchor-live:
+    name: chain anchor (live end-to-end)
+    runs-on: ubuntu-latest
+    # action-dogfood gates a store-free example, so the anchor surface — the
+    # --expect-chain-head gate and the action's chain-head output — has no live
+    # cover there. This job seeds a chained store and pins both verdicts.
+    env:
+      WRONG_HEAD: "0000000000000000000000000000000000000000000000000000000000000000"
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Install probe dependencies
+        # jsonschema so the probe's own doctor gate is as strict as the action's.
+        run: python -m pip install --upgrade pip pyyaml jsonschema
+
+      - name: Seed a chained workspace
+        id: seed
+        run: |
+          workspace="${RUNNER_TEMP}/anchor-ws"
+          head="$(python -B scripts/ci_anchor_probe.py "$workspace")"
+          echo "head=$head" >> "$GITHUB_OUTPUT"
+          echo "workspace=$workspace" >> "$GITHUB_OUTPUT"
+
+      - name: doctor accepts the seeded anchor
+        env:
+          ANCHOR_WS: ${{ steps.seed.outputs.workspace }}
+          ANCHOR_HEAD: ${{ steps.seed.outputs.head }}
+        run: python -B -m loop doctor --expect-chain-head "$ANCHOR_HEAD" "$ANCHOR_WS"
+
+      - name: doctor rejects a wrong anchor
+        env:
+          ANCHOR_WS: ${{ steps.seed.outputs.workspace }}
+        run: |
+          # Inverted so an unexpected PASS fails the job. 1 is doctor's
+          # report-not-ok code; 2 means the flag itself was refused, which would
+          # prove nothing about the anchor comparison — so pin 1 exactly.
+          set +e
+          out="$(python -B -m loop doctor --expect-chain-head "$WRONG_HEAD" "$ANCHOR_WS" 2>&1)"
+          status=$?
+          set -e
+          if [ "$status" -ne 1 ]; then
+            echo "::error::doctor exited $status on a wrong anchor; expected 1"
+            echo "$out"
+            exit 1
+          fi
+          case "$out" in
+            *chain_anchor_mismatch*) ;;
+            *) echo "::error::doctor did not report chain_anchor_mismatch"; echo "$out"; exit 1 ;;
+          esac
+
+      - name: Action gate with the seeded anchor
+        id: gate
+        uses: ./
+        with:
+          path: ${{ steps.seed.outputs.workspace }}
+          expect-chain-head: ${{ steps.seed.outputs.head }}
+          # 0 keeps inspect warn-only: the scaffold's advisory score must never
+          # be able to flake the anchor verdict this job exists to pin.
+          fail-under-score: "0"
+
+      - name: Action emitted the seeded head
+        env:
+          GATE_HEAD: ${{ steps.gate.outputs.chain-head }}
+          SEED_HEAD: ${{ steps.seed.outputs.head }}
+        run: |
+          if [ "$GATE_HEAD" != "$SEED_HEAD" ]; then
+            echo "::error::action chain-head output '$GATE_HEAD' != seeded head '$SEED_HEAD'"
+            exit 1
+          fi
+
+      - name: Action gate with a wrong anchor
+        id: gate-mismatch
+        continue-on-error: true
+        uses: ./
+        with:
+          path: ${{ steps.seed.outputs.workspace }}
+          expect-chain-head: ${{ env.WRONG_HEAD }}
+          fail-under-score: "0"
+
+      - name: Wrong anchor failed the gate and still recorded the head
+        env:
+          GATE_OUTCOME: ${{ steps.gate-mismatch.outcome }}
+          GATE_HEAD: ${{ steps.gate-mismatch.outputs.chain-head }}
+          SEED_HEAD: ${{ steps.seed.outputs.head }}
+        run: |
+          if [ "$GATE_OUTCOME" != "failure" ]; then
+            echo "::error::a wrong anchor did not fail the action (outcome: $GATE_OUTCOME)"
+            exit 1
+          fi
+          if [ "$GATE_HEAD" != "$SEED_HEAD" ]; then
+            echo "::error::the always-run anchor step recorded '$GATE_HEAD', not the observed head"
+            exit 1
+          fi
+  recipe-openhands:
+    name: recipe (openhands)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
+        with:
+          # openhands-sdk requires >=3.12; the certifier itself is stdlib-only, so
+          # its behavioural e2e already runs on the whole gates matrix.
+          python-version: "3.12"
+      - name: Install recipe dependencies
+        run: python -m pip install --upgrade pip pyyaml pytest jsonschema openhands-sdk==1.37.1 openhands-tools==1.37.1
+      - name: OpenHands schema-drift alarm
+        run: python -B -m pytest -q -p no:cacheprovider scripts/test_openhands_sdk_drift.py scripts/test_openhands_recipe.py
+
+  action-dogfood:
+    name: action (dogfood on flagship example)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      # The repo root's live .loop/ is gitignored, so it does not exist in a fresh
+      # CI checkout — the tracked flagship example is the contract the action gates
+      # (doctor-clean, inspect 90/strong in the action's dependency-free install).
+      - uses: ./
+        with:
+          path: "examples/coverage-repair"
+          fail-under-score: "90"
+
+      - name: pre-commit consumer fixture
+        # bare `python` is on PATH here because the preceding `uses: ./` composite step ran setup-python
+        # (persisted via GITHUB_PATH) — keep the action step before this one.
+        run: |
+          python -m pip install --quiet pre-commit pytest pyyaml
+          python -B -m pytest -q -p no:cacheprovider scripts/test_precommit_hook.py
+
+  recipe-ruflo:
+    name: recipe (ruflo)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - name: Install recipe dependencies
+        # No npm, no Node, no credentials: ruflo has no Python package, and a live
+        # swarm needs the `claude` binary plus model spend. The example replays the
+        # committed examples/ruflo-gate/fixture/ recording instead — the gate,
+        # projection, emit, doctor and metrics path all still execute for real.
+        # The opt-in live schema-drift alarm (LOOP_RUFLO_LIVE=1) stays skipped here.
+        run: python -m pip install --upgrade pip pyyaml pytest jsonschema
+      - name: ruflo recipe end-to-end
+        run: python -B -m pytest -q -p no:cacheprovider scripts/test_ruflo_recipe.py

{loop_engineer-0.9.0 → loop_engineer-0.11.0}/.github/workflows/publish.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 

{loop_engineer-0.9.0 → loop_engineer-0.11.0}/CHANGELOG.md

@@ -14,6 +14,137 @@ All notable changes to `loop-engineer` are documented here.
   `WORKFLOW.md` and `README.md` are reworded to describe the mechanism; the 0.3.4
   history is left intact.
 
+## 0.11.0 — 2026-07-26
+
+**Verifier identity, and evidence that is load-bearing.** Two slices of the
+tamper-evident-provenance program ship together, because neither was cut on its own.
+
+*Verifier identity and independence (PR #94).* evidence@1 records now carry
+`verified_by.code_digest` and `verified_by.policy_digest` — the runner hashes the
+verifier it actually executed and the goalpost it was held to. `loop doctor`
+reports `self_verified_evidence` when a record declares that its producer also
+verified it, making the independence rule of `reference/safety-and-approvals.md` §5
+a machine check rather than prose. Verify bundles record the visible/held-out
+criterion partition.
+
+*Evidence wiring (PR #102).* A verified dispatch binds its evidence digests into
+the hash chain at append time, using the existing `artifact_hashes` envelope field
+— no new event type and still one append per dispatch. The bundle is also written
+to a content-addressed object store whose location is derived from the digest, so
+a third-party reader finds the original bytes from `record["sha256"]` alone and a
+swapped bundle no longer destroys the evidence. `loop doctor` hash-verifies every
+discovered record, re-hashes what the chain bound, and compares a record's
+`policy_digest` against the live `TASKS.json` goalpost. Five new issue codes:
+`evidence_chain_mismatch`, `missing_bound_evidence`, `policy_digest_mismatch`,
+`unverified_evidence_terminal`, `bound_evidence_escape`.
+
+**Behavioural flag — `Succeeded` can now mean more.** The opt-in
+`completion_policy.mode: all_required_verified_evidence` requires every cited
+evidence entry to be a workspace-relative record that hash-verifies, **attests a
+pass**, is chain-bound wherever a store exists, and agrees with the live goalpost.
+The default `all_required` is unchanged and every record written before this
+release still validates. The canonical green-marker rule now lives in
+`loop.evidence.verify_bundle_is_green` and is shared object-for-object with
+`scripts/metrics.py`, so a bundle cannot read RED to the FCR gate and GREEN to the
+completion gate.
+
+**Known limitations, stated rather than discovered.** Binding makes tampering
+detectable against an anchor, not impossible: without `--expect-chain-head` a
+worker who can rewrite `.loop/` can rewrite the chain too, and a contract with no
+event store cannot chain-bind at all. Deleting `.loop/events.db` after a run leaves
+plain `loop doctor` quiet — the `missing_event_store` tripwire only fires on
+leftover `-wal`/`-shm` residue — so the external anchor is the control that holds.
+Four upgrade notes in `reference/repo-os-contract.md` §17 name the behaviour that
+can turn a previously-clean contract red: `policy_digest_mismatch` is not opt-in
+and has no first-class re-baseline affordance; the `completion_policy` enum
+widening is forward-incompatible as a hard error against an older kernel; `os.link`
+now runs once per dispatch; and a bound artifact above the 64 MiB read cap fails
+doctor with no configuration knob.
+
+## 0.10.0 — 2026-07-25
+
+**The hash-linked event chain.** Every `loop-engineer/event@1` row now carries
+`prev_event_hash` and `event_hash` — a sha256 over a canonical JSON preimage of
+the event's hashed fields, `prev_event_hash` among them. Canonical form is
+`json.dumps(sort_keys=True, separators=(",", ":"), ensure_ascii=False,
+allow_nan=False)` encoded UTF-8, pinned normatively with conformance vectors in
+`reference/repo-os-contract.md` §16. The digest is computed **inside the store on
+append**, never supplied by a caller, and the deterministic reducer re-verifies
+each link as it folds: a spliced, reordered, or edited row raises
+`ChainBreakError` and stops the fold instead of projecting a plausible state.
+`loop.chain` is stdlib-only and imports no other module of this package, so
+`verify_chain()` re-verifies an exported event stream without the store code
+(#82).
+
+**Store generations and `loop migrate`.** A fresh store stamps `PRAGMA
+user_version = 2` and widens the `events` DDL with `event_hash TEXT NOT NULL`.
+`loop migrate` is the only store-upgrade path — explicit, idempotent, and
+non-rewriting: it adds the two columns and stamps `user_version = 2`, but never
+backfills hashes onto existing rows, because the append-only `BEFORE UPDATE`
+trigger forbids it. Pre-migration rows therefore stay an **unchained prefix**
+that doctor reports rather than elides, and the first post-migration append is a
+chain genesis.
+
+**Anchored doctor gate.** `loop doctor` gains an `event_store.chain` block
+(`head`, `unchained_prefix`) and a `--expect-chain-head SHA256` flag — also
+accepted by `validate` and `verify` — that fails the gate unless the store's head
+equals an externally remembered anchor. Four new issue codes: `event_chain_broken`
+(a link does not verify), `chain_anchor_mismatch` (the head differs from the
+supplied anchor, or an anchor was supplied with no readable store),
+`missing_event_store` (`events.db` is absent while SQLite sidecars remain — the
+store was deleted), and `chain_columns_missing` (the store still declares
+generation 2 with its chain columns gone — the lazy downgrade). The composite
+action publishes the observed head as a `chain-head` output on every run and
+optionally enforces one through an `expect-chain-head` input.
+
+**Integrity boundary.** The chain is **tamper-evident relative to an anchored
+head** — a detection property, not a prevention one, and scoped to the anchor.
+It detects splicing, reordering, an edit that does not recompute every downstream
+digest, and byte corruption of any hashed field; given an anchor it detects *any*
+divergence from the head that anchor names, including tail truncation, which is
+otherwise invisible because deleting trailing events leaves a shorter but
+internally valid chain. It does **not** detect a full in-workspace recompute, a
+chain-column downgrade that also resets `user_version`, deletion of the store when
+no sidecars remain and no anchor is supplied, well-formed lies (nothing in the
+chain judges whether a payload is true), or anything in a never-migrated prefix.
+And the window stays open at the head: "An anchor certifies the log only up to the
+anchored head. Everything appended after the last externally-read anchor —
+including a rewrite of the suffix — is unverified until the next anchor is read
+and remembered outside the workspace. The chain narrows the tampering window; it
+does not close it." `scripts/test_adversarial_chain.py` pins both sides — the
+attacks that are caught and four `PINNED LIMITATION` cases that are not. The full
+boundary, with the anchor's trust assumptions, is normative in
+`reference/repo-os-contract.md` §16.
+
+**Stricter reads.** `status`, `replay`, and `doctor` now **reject** a store
+containing any schema-invalid event, raising `invalid_event` instead of silently
+folding past it as they did in 0.9.0. Validation runs before the fold, so a tamper
+that also violates `event@1` surfaces as `invalid_event` rather than
+`event_chain_broken`.
+
+**Sidecars resolved.** Read verbs no longer leave `-wal`/`-shm` files beside a
+clean `.loop/events.db` — the 0.9.0 known limitation recorded below. #80 landed
+the first half, opening read-only connections with `immutable=1` when no WAL
+sidecar exists; this release completes it with a two-stage retry so that a lost
+`immutable=1` race against a live writer retries plainly as `mode=ro` before
+anything may be called corruption, the same read path in the runner, and a
+zero-carve-out tripwire proving every read verb leaves a clean store
+byte-identical on both store generations.
+
+**Compatibility, both directions.** Pre-0.10.0 *readers* can read a v2 store:
+their explicit ten-column `SELECT` is unaffected by the two added columns.
+Pre-0.10.0 *writers* must not append to a chained store. A fresh v0.10.0 store
+refuses such an append at the database, because `event_hash` is `NOT NULL`; a
+*migrated* store keeps its columns nullable, so the append succeeds and produces a
+permanent, unrepairable `event_chain_broken` — the row cannot be re-linked
+afterwards, since `UPDATE` is trigger-blocked. Pin your `loop-engineer` and action
+version per store.
+
+Test baseline: 1021 passed / 16 skipped with the `yaml`+`schemas` extras;
+951 / 86 in structural-fallback mode (PyYAML only). Both measured in a fresh
+worktree; a live checkout reads +2 passed / −2 skipped through two
+checked-when-present tests.
+
 ## 0.9.0 — 2026-07-17
 
 **The event-sourced kernel.** The contract gains a durable runtime substrate:
@@ -71,7 +202,7 @@ least-privilege workflow permissions (#46, #47).
 `-wal`/`-shm` sidecars next to `.loop/events.db` (read-only connections
 recreate them and cannot checkpoint on close). Store content is never
 mutated, but tree-byte-identity checks over a store-backed workspace will
-notice them.
+notice them. *(Resolved in 0.10.0 — see "Sidecars resolved" above.)*
 
 Test baseline: 933 passed / 16 skipped with the `yaml`+`schemas` extras;
 864 / 85 in structural-fallback mode (PyYAML only).

{loop_engineer-0.9.0 → loop_engineer-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: loop-engineer
-Version: 0.9.0
+Version: 0.11.0
 Summary: Portable Loop Contract Core: validate and inspect repo-native operating contracts for agent loops.
 Project-URL: Homepage, https://github.com/SollanSystems/loop-engineer
 Project-URL: Repository, https://github.com/SollanSystems/loop-engineer
@@ -44,7 +44,7 @@ Description-Content-Type: text/markdown
 [![CI](https://github.com/SollanSystems/loop-engineer/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/SollanSystems/loop-engineer/actions/workflows/ci.yml)
 [![Python 3.10–3.12](https://img.shields.io/badge/python-3.10%E2%80%933.12-blue)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)
-[![Release](https://img.shields.io/badge/release-0.9.0-blue)](https://github.com/SollanSystems/loop-engineer/tags)
+[![Release](https://img.shields.io/badge/release-0.11.0-blue)](https://github.com/SollanSystems/loop-engineer/tags)
 
 Long-running agents commit **false completion**. After context compaction they
 forget what "done" meant, optimize to the visible test, patch in circles, and
@@ -63,7 +63,19 @@ ships, on disk and runnable today:
 - an **event-sourced runtime** — `run`, `status`, `replay`, `simulate`, and
   approve/pause/resume/cancel over an append-only SQLite event log
   (`.loop/events.db`), folded by a deterministic reducer that enforces the same
-  completion gate as the writers, with crash-safe single-step resume.
+  completion gate as the writers, with crash-safe single-step resume. Events are
+  hash-chained; `loop doctor --expect-chain-head` verifies the log against an
+  externally anchored head. The chain is tamper-evident **relative to an
+  anchor** — an adversary with workspace write access can rewrite an unanchored
+  log. Verify runs record which verifier actually ran — command, code digest
+  (recorded only when the verifier is a workspace file, an honest null with a
+  named reason otherwise — e.g. `python3 -m pytest`), policy digest — and
+  `loop doctor` fails when a record declares that its own
+  producer verified it; identity is recorded, not proven: a worker can write a
+  false verifier name. A verified dispatch **binds its evidence digests into the
+  hash chain**, and `loop doctor` re-hashes them — binding makes tampering
+  detectable against an anchor, not impossible: without `--expect-chain-head` a
+  worker who can rewrite `.loop/` can rewrite the chain too.
 
 ![The inspector scores a self-asserted DIY loop 0/weak, then the gate-backed example 90/strong — both runs live](docs/demo.gif)
 
@@ -367,7 +379,7 @@ present. Recipe:
 **CI** — one workflow step validates the contract and publishes a scorecard:
 
 ```yaml
-- uses: SollanSystems/loop-engineer@v0.9.0
+- uses: SollanSystems/loop-engineer@v0.11.0
   with:
     path: "."
 ```
@@ -460,8 +472,8 @@ doctor` and the contract's own `verify-*` scripts).
 
 ## Status
 
-- Version: `0.9.0`
-- Release tag: `v0.9.0` (PyPI publish trigger; plugin tags through 0.6.0 used `loop-engineer--v<version>`)
+- Version: `0.11.0`
+- Release tag: `v0.11.0` (PyPI publish trigger; plugin tags through 0.6.0 used `loop-engineer--v<version>`)
 - License: MIT
 - Primary interface: Claude Code plugin
 - Portable core: Python CLI + JSON schemas

{loop_engineer-0.9.0 → loop_engineer-0.11.0}/README.md

@@ -5,7 +5,7 @@
 [![CI](https://github.com/SollanSystems/loop-engineer/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/SollanSystems/loop-engineer/actions/workflows/ci.yml)
 [![Python 3.10–3.12](https://img.shields.io/badge/python-3.10%E2%80%933.12-blue)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)
-[![Release](https://img.shields.io/badge/release-0.9.0-blue)](https://github.com/SollanSystems/loop-engineer/tags)
+[![Release](https://img.shields.io/badge/release-0.11.0-blue)](https://github.com/SollanSystems/loop-engineer/tags)
 
 Long-running agents commit **false completion**. After context compaction they
 forget what "done" meant, optimize to the visible test, patch in circles, and
@@ -24,7 +24,19 @@ ships, on disk and runnable today:
 - an **event-sourced runtime** — `run`, `status`, `replay`, `simulate`, and
   approve/pause/resume/cancel over an append-only SQLite event log
   (`.loop/events.db`), folded by a deterministic reducer that enforces the same
-  completion gate as the writers, with crash-safe single-step resume.
+  completion gate as the writers, with crash-safe single-step resume. Events are
+  hash-chained; `loop doctor --expect-chain-head` verifies the log against an
+  externally anchored head. The chain is tamper-evident **relative to an
+  anchor** — an adversary with workspace write access can rewrite an unanchored
+  log. Verify runs record which verifier actually ran — command, code digest
+  (recorded only when the verifier is a workspace file, an honest null with a
+  named reason otherwise — e.g. `python3 -m pytest`), policy digest — and
+  `loop doctor` fails when a record declares that its own
+  producer verified it; identity is recorded, not proven: a worker can write a
+  false verifier name. A verified dispatch **binds its evidence digests into the
+  hash chain**, and `loop doctor` re-hashes them — binding makes tampering
+  detectable against an anchor, not impossible: without `--expect-chain-head` a
+  worker who can rewrite `.loop/` can rewrite the chain too.
 
 ![The inspector scores a self-asserted DIY loop 0/weak, then the gate-backed example 90/strong — both runs live](docs/demo.gif)
 
@@ -328,7 +340,7 @@ present. Recipe:
 **CI** — one workflow step validates the contract and publishes a scorecard:
 
 ```yaml
-- uses: SollanSystems/loop-engineer@v0.9.0
+- uses: SollanSystems/loop-engineer@v0.11.0
   with:
     path: "."
 ```
@@ -421,8 +433,8 @@ doctor` and the contract's own `verify-*` scripts).
 
 ## Status
 
-- Version: `0.9.0`
-- Release tag: `v0.9.0` (PyPI publish trigger; plugin tags through 0.6.0 used `loop-engineer--v<version>`)
+- Version: `0.11.0`
+- Release tag: `v0.11.0` (PyPI publish trigger; plugin tags through 0.6.0 used `loop-engineer--v<version>`)
 - License: MIT
 - Primary interface: Claude Code plugin
 - Portable core: Python CLI + JSON schemas

{loop_engineer-0.9.0 → loop_engineer-0.11.0}/action.yml

@@ -25,11 +25,23 @@ inputs:
     description: "Token for the optional PR scorecard comment. Empty skips the comment."
     required: false
     default: ""
+  expect-chain-head:
+    description: >-
+      Fail the gate unless the store's chain head equals this 64-hex value (an
+      externally remembered anchor). Empty performs NO cross-run tamper
+      detection — the gate then only records the head for a later comparison.
+    required: false
+    default: ""
+
+outputs:
+  chain-head:
+    description: "Chain head event_hash observed by this gate run ('' when the store has no chained events)."
+    value: ${{ steps.chain-head.outputs.chain-head }}
 
 runs:
   using: "composite"
   steps:
-    - uses: actions/setup-python@v6
+    - uses: actions/setup-python@v7
       with:
         python-version: ${{ inputs.python-version }}
 
@@ -50,12 +62,17 @@ runs:
       shell: bash
       env:
         LOOP_PATH: "${{ inputs.path }}"
+        LOOP_EXPECT_HEAD: "${{ inputs.expect-chain-head }}"
       run: |
         # -eo pipefail (GitHub's bash default) makes a doctor failure fail the step
         # despite the tee. Then assert the strict validation path actually ran, so a
         # future packaging regression that drops the extras fails loudly here. The
         # check reads one fixed field from doctor's own JSON — no fragile parsing.
-        loop doctor "$LOOP_PATH" | tee "${RUNNER_TEMP}/doctor.json"
+        if [ -n "$LOOP_EXPECT_HEAD" ]; then
+          loop doctor --expect-chain-head "$LOOP_EXPECT_HEAD" "$LOOP_PATH" | tee "${RUNNER_TEMP}/doctor.json"
+        else
+          loop doctor "$LOOP_PATH" | tee "${RUNNER_TEMP}/doctor.json"
+        fi
         python - "${RUNNER_TEMP}/doctor.json" <<'PY'
         import json, sys
         mode = json.load(open(sys.argv[1])).get("validation_mode")
@@ -65,6 +82,30 @@ runs:
             raise SystemExit(1)
         PY
 
+    - name: chain head (anchor surface)
+      id: chain-head
+      if: always()
+      shell: bash
+      run: |
+        # Runs even when doctor failed: an anchor MISMATCH is exactly the run whose
+        # observed head an operator needs recorded. Absent/empty doctor.json (doctor
+        # never got to write one) is a silent no-op, not an error.
+        [ -s "${RUNNER_TEMP}/doctor.json" ] || exit 0
+        python - "${RUNNER_TEMP}/doctor.json" "$GITHUB_STEP_SUMMARY" "$GITHUB_OUTPUT" <<'PY'
+        import json, sys
+        try:
+            doctor = json.load(open(sys.argv[1]))
+        except (OSError, json.JSONDecodeError):
+            doctor = {}
+        chain = (doctor.get("event_store") or {}).get("chain") or {}
+        head = chain.get("head") or {}
+        value = head.get("event_hash") or ""
+        line = (f"**loop-engineer chain head:** `{value}` (sequence {head.get('sequence')})"
+                if value else "**loop-engineer chain head:** none (no chained events)")
+        open(sys.argv[2], "a").write(line + "\n")
+        open(sys.argv[3], "a").write(f"chain-head={value}\n")
+        PY
+
     - name: loop inspect (scorecard)
       shell: bash
       env:

{loop_engineer-0.9.0 → loop_engineer-0.11.0}/docs/gap-reports/scoreboard.md

@@ -57,7 +57,16 @@ for exactly the machinery our signals miss.
 Harnesses whose run state lives fundamentally off-repo (OpenHands and
 SWE-agent trajectories, platform-hosted runs) are out of scope: there is no
 on-disk run record for a repo-native inspector to read — which is its own
-answer to the question this scoreboard asks.
+answer to the question this scoreboard asks.†
+
+> † **Correction (2026-07-25).** For OpenHands this is now only half true. The
+> V1 SDK (`openhands-sdk` 1.37.1) persists `base_state.json` + an `events/`
+> trajectory whenever `persistence_dir=` is set — enough for an external
+> certifier to read a run's terminal signal, its iteration cap, and its full
+> event log. It is still not a *repo-native* contract (the record lives outside
+> the repo by default and carries no spec, plan, or ledger), so the row stays
+> out of the scoreboard; but the gap is addressable from outside, which is what
+> [`examples/openhands-certify/`](../../examples/openhands-certify/) does.
 
 ## The scoreboard
 
@@ -283,8 +292,10 @@ FCR/RP — is a missing **layer**, one every harness on this board could emit
 at its finish line. The port is small: four `loop.emit` calls
 (`open_contract`, `append_iteration`, `append_receipt`, `terminate`), worked
 end-to-end for a real engine in
-[`docs/integrations/langgraph.md`](../integrations/langgraph.md) and
-[`docs/integrations/temporal.md`](../integrations/temporal.md).
+[`docs/integrations/langgraph.md`](../integrations/langgraph.md),
+[`docs/integrations/temporal.md`](../integrations/temporal.md), and — for a
+harness with no seam to hook at all —
+[`docs/integrations/openhands.md`](../integrations/openhands.md).
 
 ## Contribute a row