oacp-cli 0.3.3__tar.gz → 0.3.4__tar.gz

{oacp_cli-0.3.3 → oacp_cli-0.3.4}/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.4] - 2026-06-11
+
+### Fixed
+
+- Receiver autonomy Gate 1 now performs real message schema validation, expiry
+  comparison, SHA-256 hash recording, and same-receiver replay detection before
+  auto-accepting work.
+- Receiver autonomy Gate 3 now pauses on credentials, pricing, commercial
+  content, and anchored config-sensitive scope, and evaluates external
+  side-effect hard stops before sensitive-scope hard stops to match the
+  protocol.
+
 ## [0.3.3] - 2026-06-11
 
 ### Added
@@ -180,6 +192,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Checkout step in github-release workflow job (#19)
 - Pre-release audit fixes: SHA-pinned actions, dangling doc refs (#15, #16)
 
+[0.3.4]: https://github.com/kiloloop/oacp/compare/v0.3.3...v0.3.4
 [0.3.3]: https://github.com/kiloloop/oacp/compare/v0.3.2...v0.3.3
 [0.3.2]: https://github.com/kiloloop/oacp/compare/v0.3.1...v0.3.2
 [0.3.1]: https://github.com/kiloloop/oacp/compare/v0.3.0...v0.3.1

{oacp_cli-0.3.3 → oacp_cli-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oacp-cli
-Version: 0.3.3
+Version: 0.3.4
 Summary: Open Agent Coordination Protocol CLI for file-based multi-agent workflows
 Project-URL: Homepage, https://github.com/kiloloop/oacp
 Project-URL: Repository, https://github.com/kiloloop/oacp

{oacp_cli-0.3.3 → oacp_cli-0.3.4}/docs/protocol/agent_safety_defaults.md

@@ -40,7 +40,7 @@ Regardless of autonomy mode, receivers must pause on actual requests for:
 
 - Destructive command tokens: `rm -rf`, `--force`, `--no-verify`, `--dangerously-skip-permissions`
 - External side effects: push, deploy, merge, publish, credential rotation, dependency install
-- Sensitive scope: auth, config, secrets, dependencies, public repos, pricing/commercial content, memory SSOT
+- Sensitive scope: auth, config, secrets, credentials, dependencies, public repos, pricing/commercial content, memory SSOT
 
 Profileless message types that are explicitly allowed for auto-review may log
 incidental side-effect verb mentions as notes instead of hard stops, but

{oacp_cli-0.3.3 → oacp_cli-0.3.4}/docs/protocol/autonomy.md

@@ -97,8 +97,8 @@ If any required gate is missing or uncertain, the receiver pauses.
      as deploy/publish/merge are logged as notes instead of hard stops.
      Destructive tokens still pause.
    - Path-like tokens such as `packets/deploy/` are not deploy verbs.
-   - Pause when the body touches auth, config, secrets, dependencies, public
-     repos, pricing/commercial content, or memory SSOT.
+   - Pause when the body touches auth, config, secrets, credentials,
+     dependencies, public repos, pricing/commercial content, or memory SSOT.
    - Pause when file scope is ambiguous or broader than the declared profile.
 4. **Runtime/workspace**
    - Worktree is clean or the task can be isolated to a fresh branch.
@@ -114,11 +114,12 @@ Regardless of autonomy mode, receivers must pause on any of: destructive command
 tokens (`rm -rf`, `--force`, `--no-verify`,
 `--dangerously-skip-permissions`), external side effects
 (push/deploy/merge/publish/rotate/install), or modifications to auth, config,
-secrets, dependencies, public repos, pricing/commercial content, or memory SSOT,
-unless explicitly authorized by a separate safety-default exception.
+secrets, credentials, dependencies, public repos, pricing/commercial content, or
+memory SSOT, unless explicitly authorized by a separate safety-default
+exception.
 
-Continuation grants do not override destructive tokens, auth/secrets,
-dependency, public-scope, pricing/commercial, or memory-SSOT hard stops.
+Continuation grants do not override destructive tokens, auth/secrets/credentials,
+dependency, public-scope, pricing/commercial, config, or memory-SSOT hard stops.
 When explicitly enabled, a valid continuation grant may cover declared external
 side effects only for the scoped PR, GitHub comment, or commit continuation
 fields that the grant marks true.
@@ -131,7 +132,7 @@ Every autonomy decision writes one YAML file:
 
 ```yaml
 schema_version: 1
-spec_version: "0.3.0"
+spec_version: "0.3.1"
 created_at_utc: "2026-05-12T13:23:25Z"
 receiver: codex
 sender: iris
@@ -176,6 +177,9 @@ result:
 
 `policy_path` and `policy_sha256` may be null when the pause is caused by
 missing or malformed config. `sender` is logged only for traceability.
+`spec_version: "0.3.1"` pins Gate 1 integrity enforcement: schema validation,
+expiry rejection, raw YAML SHA-256 recording, and same-receiver replay
+detection.
 
 ## State Transition Metadata
 

{oacp_cli-0.3.3 → oacp_cli-0.3.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "oacp-cli"
-version = "0.3.3"
+version = "0.3.4"
 description = "Open Agent Coordination Protocol CLI for file-based multi-agent workflows"
 readme = "README.md"
 license = "Apache-2.0"

{oacp_cli-0.3.3 → oacp_cli-0.3.4}/scripts/autonomy_gate.py

@@ -11,6 +11,8 @@ scope-envelope contract. The module is intentionally separate from
 from __future__ import annotations
 
 import argparse
+import datetime as dt
+import hashlib
 import json
 import re
 import sys
@@ -19,6 +21,8 @@ from typing import Any, Dict, List, Optional, Sequence, Tuple
 
 import yaml
 
+from validate_message import validate_message_dict
+
 
 VALID_MODES = {"always_pause", "auto_review"}
 POLICY_ACTIONS = {"pause"}
@@ -87,6 +91,18 @@ NON_DEMOTABLE_SIDE_EFFECT_PATTERNS = (
 SENSITIVE_SCOPE_PATTERNS = (
     ("auth", re.compile(r"(?<![\w/-])auth(?![\w/-])", re.IGNORECASE)),
     ("secrets", re.compile(r"(?<![\w/-])secrets?(?![\w/-])", re.IGNORECASE)),
+    ("credentials", re.compile(r"(?<![\w/-])credentials?(?![\w/-])", re.IGNORECASE)),
+    ("pricing", re.compile(r"(?<![\w/-])pricing(?![\w/-])", re.IGNORECASE)),
+    ("commercial", re.compile(r"(?<![\w/-])commercial(?![\w/-])", re.IGNORECASE)),
+    (
+        "config",
+        re.compile(
+            r"\bconfig(?:uration)?\s+(?:file|files|setting|settings|template|templates|yaml|yml)\b"
+            r"|\b(?:project|workspace|runtime|agent)\s+config(?:uration)?\b"
+            r"|\bconfig\.ya?ml\b",
+            re.IGNORECASE,
+        ),
+    ),
     (
         "public repo",
         re.compile(r"\bpublic\s+repositor(?:y|ies)|\bpublic\s+repo\b", re.IGNORECASE),
@@ -248,6 +264,57 @@ def first_match(
     return None
 
 
+def message_sha256(
+    message: Dict[str, Any],
+    message_path: Optional[Path] = None,
+) -> str:
+    """Return the raw YAML hash when a path is available, otherwise a stable fallback."""
+    if message_path is not None:
+        return hashlib.sha256(message_path.read_bytes()).hexdigest()
+    serialized = yaml.safe_dump(message, sort_keys=True, allow_unicode=False).encode("utf-8")
+    return hashlib.sha256(serialized).hexdigest()
+
+
+def message_expired(
+    message: Dict[str, Any],
+    now_utc: Optional[dt.datetime] = None,
+) -> bool:
+    expires_at = str(message.get("expires_at") or "").strip()
+    if not expires_at:
+        return False
+    now = now_utc or dt.datetime.now(dt.timezone.utc)
+    if now.tzinfo is None:
+        now = now.replace(tzinfo=dt.timezone.utc)
+    # validate_message_dict enforces Z-only format; ValueError here is defensive.
+    expires = dt.datetime.strptime(expires_at, "%Y-%m-%dT%H:%M:%SZ").replace(
+        tzinfo=dt.timezone.utc
+    )
+    return now >= expires
+
+
+def prior_auto_accept_exists(
+    message_id: str,
+    receiver: str,
+    audit_dir: Optional[Path],
+) -> bool:
+    if not message_id or audit_dir is None or not audit_dir.is_dir():
+        return False
+    for audit_path in audit_dir.glob("*.yaml"):
+        try:
+            audit = yaml.safe_load(audit_path.read_text(encoding="utf-8"))
+        except (OSError, yaml.YAMLError):
+            continue
+        if not isinstance(audit, dict):
+            continue
+        if audit.get("message_id") != message_id:
+            continue
+        if audit.get("receiver") != receiver:
+            continue
+        if audit.get("decision") == "auto_accepted":
+            return True
+    return False
+
+
 def side_effect_notes_for_allowed_type(body: str) -> List[Dict[str, str]]:
     notes: List[Dict[str, str]] = []
     for label, pattern in SIDE_EFFECT_VERB_PATTERNS:
@@ -449,8 +516,13 @@ def evaluate_autonomy(
     message: Dict[str, Any],
     config: Dict[str, Any],
     actuals: Optional[Dict[str, Any]] = None,
+    message_path: Optional[Path] = None,
+    audit_dir: Optional[Path] = None,
+    receiver: str = "codex",
+    now_utc: Optional[dt.datetime] = None,
 ) -> Dict[str, Any]:
     """Evaluate a message/config pair and return a canonical decision dict."""
+    msg_hash = message_sha256(message, message_path)
     try:
         mode, policy = receiver_policy(config)
     except AutonomyConfigError:
@@ -459,6 +531,7 @@ def evaluate_autonomy(
             "decision": "paused",
             "mode": "always_pause",
             "reason_codes": ["config_malformed"],
+            "message_sha256": msg_hash,
             "scope_envelope": None,
             "logged_notes": [],
             "continuation_grant": {"present": False, "enabled": False},
@@ -471,21 +544,67 @@ def evaluate_autonomy(
             "decision": "paused",
             "mode": mode,
             "reason_codes": ["mode_always_pause"],
+            "message_sha256": msg_hash,
             "scope_envelope": None,
             "logged_notes": [],
             "continuation_grant": {"present": False, "enabled": False},
             "result": _base_result("paused", "always_pause", checkpoint),
         }
 
+    message_errors = validate_message_dict(message)
+    if message_errors:
+        checkpoint = evaluate_threshold_checkpoint(None, {}, actuals)
+        return {
+            "decision": "paused",
+            "mode": mode,
+            "reason_codes": ["message_invalid"],
+            "message_sha256": msg_hash,
+            "message_validation_errors": message_errors,
+            "scope_envelope": None,
+            "logged_notes": [],
+            "continuation_grant": {"present": False, "enabled": False},
+            "result": _base_result("paused", "message_invalid", checkpoint),
+        }
+
+    if message_expired(message, now_utc):
+        checkpoint = evaluate_threshold_checkpoint(None, {}, actuals)
+        return {
+            "decision": "paused",
+            "mode": mode,
+            "reason_codes": ["message_expired"],
+            "message_sha256": msg_hash,
+            "scope_envelope": None,
+            "logged_notes": [],
+            "continuation_grant": {"present": False, "enabled": False},
+            "result": _base_result("paused", "message_expired", checkpoint),
+        }
+
+    if prior_auto_accept_exists(str(message.get("id") or ""), receiver, audit_dir):
+        checkpoint = evaluate_threshold_checkpoint(None, {}, actuals)
+        return {
+            "decision": "paused",
+            "mode": mode,
+            "reason_codes": ["message_replayed"],
+            "message_sha256": msg_hash,
+            "scope_envelope": None,
+            "logged_notes": [],
+            "continuation_grant": {"present": False, "enabled": False},
+            "result": _base_result("paused", "message_replayed", checkpoint),
+        }
+
     body = str(message.get("body") or "")
     msg_type = str(message.get("type") or "")
     allow_without_profile = msg_type in policy["allow_without_task_profile"]
     logged_notes: List[Dict[str, str]] = []
 
+    def with_message_hash(decision: Dict[str, Any]) -> Dict[str, Any]:
+        decision["message_sha256"] = msg_hash
+        return decision
+
     profile, profile_error = extract_task_profile(body)
     if profile_error:
         checkpoint = evaluate_threshold_checkpoint(None, {}, actuals)
-        return {
+        return with_message_hash({
             "decision": "paused",
             "mode": mode,
             "reason_codes": [profile_error],
@@ -493,12 +612,12 @@ def evaluate_autonomy(
             "logged_notes": logged_notes,
             "continuation_grant": {"present": False, "enabled": False},
             "result": _base_result("paused", profile_error, checkpoint),
-        }
+        })
 
     if profile is None and not allow_without_profile:
         reason = "risk_obvious_no_profile" if obvious_no_profile_risk(body) else "task_profile_missing"
         checkpoint = evaluate_threshold_checkpoint(None, {}, actuals)
-        return {
+        return with_message_hash({
             "decision": "paused",
             "mode": mode,
             "reason_codes": [reason],
@@ -506,7 +625,7 @@ def evaluate_autonomy(
             "logged_notes": logged_notes,
             "continuation_grant": {"present": False, "enabled": False},
             "result": _base_result("paused", reason, checkpoint),
-        }
+        })
 
     envelope: Optional[Dict[str, Any]] = None
     profile_required_reason = "task_profile_present"
@@ -518,7 +637,7 @@ def evaluate_autonomy(
             envelope = normalize_scope_envelope(profile)
         except TaskProfileError:
             checkpoint = evaluate_threshold_checkpoint(None, {}, actuals)
-            return {
+            return with_message_hash({
                 "decision": "paused",
                 "mode": mode,
                 "reason_codes": ["task_profile_unparsable"],
@@ -526,12 +645,12 @@ def evaluate_autonomy(
                 "logged_notes": logged_notes,
                 "continuation_grant": {"present": False, "enabled": False},
                 "result": _base_result("paused", "task_profile_unparsable", checkpoint),
-            }
+            })
 
     matched = first_match(DESTRUCTIVE_PATTERNS, body)
     if matched:
         checkpoint = evaluate_threshold_checkpoint(envelope, {}, actuals)
-        return {
+        return with_message_hash({
             "decision": "paused",
             "mode": mode,
             "reason_codes": ["hard_stop_destructive_command"],
@@ -540,52 +659,52 @@ def evaluate_autonomy(
             "logged_notes": logged_notes,
             "continuation_grant": {"present": False, "enabled": False},
             "result": _base_result("paused", "hard_stop", checkpoint),
-        }
+        })
 
-    matched = first_match(SENSITIVE_SCOPE_PATTERNS, body)
+    side_effect_patterns = NON_DEMOTABLE_SIDE_EFFECT_PATTERNS
+    if not allow_without_profile or profile is not None:
+        side_effect_patterns = SIDE_EFFECT_VERB_PATTERNS + side_effect_patterns
+    matched = first_match(side_effect_patterns, body)
     if matched:
         checkpoint = evaluate_threshold_checkpoint(envelope, {}, actuals)
-        return {
+        return with_message_hash({
             "decision": "paused",
             "mode": mode,
-            "reason_codes": ["hard_stop_sensitive_scope"],
+            "reason_codes": ["hard_stop_external_side_effect"],
             "matched_pattern": matched,
             "scope_envelope": envelope,
             "logged_notes": logged_notes,
             "continuation_grant": {"present": False, "enabled": False},
             "result": _base_result("paused", "hard_stop", checkpoint),
-        }
+        })
 
-    matched = first_match(AMBIGUOUS_SCOPE_PATTERNS, body)
+    matched = first_match(SENSITIVE_SCOPE_PATTERNS, body)
     if matched:
         checkpoint = evaluate_threshold_checkpoint(envelope, {}, actuals)
-        return {
+        return with_message_hash({
             "decision": "paused",
             "mode": mode,
-            "reason_codes": ["file_scope_ambiguous"],
+            "reason_codes": ["hard_stop_sensitive_scope"],
             "matched_pattern": matched,
             "scope_envelope": envelope,
             "logged_notes": logged_notes,
             "continuation_grant": {"present": False, "enabled": False},
-            "result": _base_result("paused", "ambiguous_scope", checkpoint),
-        }
+            "result": _base_result("paused", "hard_stop", checkpoint),
+        })
 
-    side_effect_patterns = NON_DEMOTABLE_SIDE_EFFECT_PATTERNS
-    if not allow_without_profile or profile is not None:
-        side_effect_patterns = SIDE_EFFECT_VERB_PATTERNS + side_effect_patterns
-    matched = first_match(side_effect_patterns, body)
+    matched = first_match(AMBIGUOUS_SCOPE_PATTERNS, body)
     if matched:
         checkpoint = evaluate_threshold_checkpoint(envelope, {}, actuals)
-        return {
+        return with_message_hash({
             "decision": "paused",
             "mode": mode,
-            "reason_codes": ["hard_stop_external_side_effect"],
+            "reason_codes": ["file_scope_ambiguous"],
             "matched_pattern": matched,
             "scope_envelope": envelope,
             "logged_notes": logged_notes,
             "continuation_grant": {"present": False, "enabled": False},
-            "result": _base_result("paused", "hard_stop", checkpoint),
-        }
+            "result": _base_result("paused", "ambiguous_scope", checkpoint),
+        })
 
     grant_result: Dict[str, Any] = {"present": False, "enabled": False}
     if envelope is not None:
@@ -605,7 +724,7 @@ def evaluate_autonomy(
             hard_profile_reasons.append("public_visibility_pause")
         if hard_profile_reasons:
             checkpoint = evaluate_threshold_checkpoint(envelope, grant_result, actuals)
-            return {
+            return with_message_hash({
                 "decision": "paused",
                 "mode": mode,
                 "reason_codes": hard_profile_reasons,
@@ -613,7 +732,7 @@ def evaluate_autonomy(
                 "logged_notes": logged_notes,
                 "continuation_grant": grant_result,
                 "result": _base_result("paused", "hard_stop", checkpoint),
-            }
+            })
 
         reasons = _threshold_reasons(envelope, policy["thresholds"])
         side_effect_reasons = _side_effect_reasons(envelope, grant_result)
@@ -622,7 +741,7 @@ def evaluate_autonomy(
         reasons.extend(side_effect_reasons)
         if reasons:
             checkpoint = evaluate_threshold_checkpoint(envelope, grant_result, actuals)
-            return {
+            return with_message_hash({
                 "decision": "paused",
                 "mode": mode,
                 "reason_codes": reasons,
@@ -630,11 +749,11 @@ def evaluate_autonomy(
                 "logged_notes": logged_notes,
                 "continuation_grant": grant_result,
                 "result": _base_result("paused", "auto_review_paused", checkpoint),
-            }
+            })
 
     checkpoint = evaluate_threshold_checkpoint(envelope, grant_result, actuals)
     if checkpoint["evaluated"] and checkpoint["breached"]:
-        return {
+        return with_message_hash({
             "decision": "paused",
             "mode": mode,
             "reason_codes": ["threshold_checkpoint_breached"],
@@ -642,7 +761,7 @@ def evaluate_autonomy(
             "logged_notes": logged_notes,
             "continuation_grant": grant_result,
             "result": _base_result("paused", "threshold_checkpoint_breached", checkpoint),
-        }
+        })
 
     reason_codes = [
         "message_valid",
@@ -658,7 +777,7 @@ def evaluate_autonomy(
     if grant_result.get("decision") == "accepted":
         reason_codes.append("continuation_grant_accepted")
 
-    return {
+    return with_message_hash({
         "decision": "auto_accepted",
         "mode": mode,
         "reason_codes": reason_codes,
@@ -666,7 +785,7 @@ def evaluate_autonomy(
         "logged_notes": logged_notes,
         "continuation_grant": grant_result,
         "result": _base_result("done", "auto_accepted", checkpoint),
-    }
+    })
 
 
 def main(argv: Optional[Sequence[str]] = None) -> int:
@@ -674,13 +793,25 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
     parser.add_argument("--config", required=True, type=Path)
     parser.add_argument("--message", required=True, type=Path)
     parser.add_argument("--actuals", type=Path)
+    parser.add_argument("--audit-dir", type=Path)
+    parser.add_argument("--receiver", default="codex")
     args = parser.parse_args(argv)
 
     try:
         config = load_yaml_file(args.config)
         message = load_yaml_file(args.message)
         actuals = load_yaml_file(args.actuals) if args.actuals else None
-        print(json.dumps(evaluate_autonomy(message, config, actuals), indent=2))
+        print(json.dumps(
+            evaluate_autonomy(
+                message,
+                config,
+                actuals,
+                message_path=args.message,
+                audit_dir=args.audit_dir,
+                receiver=args.receiver,
+            ),
+            indent=2,
+        ))
         return 0
     except Exception as exc:
         print(f"ERROR: {exc}", file=sys.stderr)

oacp_cli-0.3.4/tests/conformance/autonomy/expected/expired_message_pauses.yaml

@@ -0,0 +1,8 @@
+case: expired_message_pauses
+config: configs/auto_review_standard.yaml
+message: messages/expired_message.yaml
+expected:
+  decision: paused
+  mode: auto_review
+  reason_codes:
+    - message_expired

oacp_cli-0.3.4/tests/conformance/autonomy/expected/hard_stop_sensitive_commercial_pauses.yaml

@@ -0,0 +1,9 @@
+case: hard_stop_sensitive_commercial_pauses
+config: configs/auto_review_standard.yaml
+message: messages/sensitive_commercial.yaml
+expected:
+  decision: paused
+  mode: auto_review
+  reason_codes:
+    - hard_stop_sensitive_scope
+  matched_pattern: "commercial"

oacp_cli-0.3.4/tests/conformance/autonomy/expected/hard_stop_sensitive_config_pauses.yaml

@@ -0,0 +1,9 @@
+case: hard_stop_sensitive_config_pauses
+config: configs/auto_review_standard.yaml
+message: messages/sensitive_config.yaml
+expected:
+  decision: paused
+  mode: auto_review
+  reason_codes:
+    - hard_stop_sensitive_scope
+  matched_pattern: "config"

oacp_cli-0.3.4/tests/conformance/autonomy/expected/hard_stop_sensitive_credentials_pauses.yaml

@@ -0,0 +1,9 @@
+case: hard_stop_sensitive_credentials_pauses
+config: configs/auto_review_standard.yaml
+message: messages/sensitive_credentials.yaml
+expected:
+  decision: paused
+  mode: auto_review
+  reason_codes:
+    - hard_stop_sensitive_scope
+  matched_pattern: "credentials"

oacp_cli-0.3.4/tests/conformance/autonomy/expected/hard_stop_sensitive_memory_ssot_pauses.yaml

@@ -0,0 +1,9 @@
+case: hard_stop_sensitive_memory_ssot_pauses
+config: configs/auto_review_standard.yaml
+message: messages/sensitive_memory_ssot.yaml
+expected:
+  decision: paused
+  mode: auto_review
+  reason_codes:
+    - hard_stop_sensitive_scope
+  matched_pattern: "memory SSOT"

oacp_cli-0.3.4/tests/conformance/autonomy/expected/hard_stop_sensitive_pricing_pauses.yaml

@@ -0,0 +1,9 @@
+case: hard_stop_sensitive_pricing_pauses
+config: configs/auto_review_standard.yaml
+message: messages/sensitive_pricing.yaml
+expected:
+  decision: paused
+  mode: auto_review
+  reason_codes:
+    - hard_stop_sensitive_scope
+  matched_pattern: "pricing"

oacp_cli-0.3.4/tests/conformance/autonomy/expected/hard_stop_sensitive_public_repo_pauses.yaml

@@ -0,0 +1,9 @@
+case: hard_stop_sensitive_public_repo_pauses
+config: configs/auto_review_standard.yaml
+message: messages/sensitive_public_repo.yaml
+expected:
+  decision: paused
+  mode: auto_review
+  reason_codes:
+    - hard_stop_sensitive_scope
+  matched_pattern: "public repo"

oacp_cli-0.3.4/tests/conformance/autonomy/expected/hard_stop_sensitive_secret_pauses.yaml

@@ -0,0 +1,9 @@
+case: hard_stop_sensitive_secret_pauses
+config: configs/auto_review_standard.yaml
+message: messages/sensitive_secret.yaml
+expected:
+  decision: paused
+  mode: auto_review
+  reason_codes:
+    - hard_stop_sensitive_scope
+  matched_pattern: "secrets"

oacp_cli-0.3.4/tests/conformance/autonomy/expected/hard_stop_side_effect_before_sensitive_pauses.yaml

@@ -0,0 +1,9 @@
+case: hard_stop_side_effect_before_sensitive_pauses
+config: configs/auto_review_standard.yaml
+message: messages/side_effect_before_sensitive.yaml
+expected:
+  decision: paused
+  mode: auto_review
+  reason_codes:
+    - hard_stop_external_side_effect
+  matched_pattern: "merge"

oacp_cli-0.3.4/tests/conformance/autonomy/expected/invalid_message_pauses.yaml

@@ -0,0 +1,8 @@
+case: invalid_message_pauses
+config: configs/auto_review_standard.yaml
+message: messages/invalid_message.yaml
+expected:
+  decision: paused
+  mode: auto_review
+  reason_codes:
+    - message_invalid

oacp_cli-0.3.4/tests/conformance/autonomy/messages/expired_message.yaml

@@ -0,0 +1,21 @@
+id: msg-20260512121200-iris-expired
+from: iris
+to: codex
+type: task_request
+priority: P2
+created_at_utc: "2026-05-12T12:12:00Z"
+expires_at: "2020-01-01T00:00:00Z"
+subject: "Expired task"
+body: |
+  ## Task
+  Update one documentation paragraph for clarity.
+
+  task_profile:
+    estimated_minutes: 20
+    risk_tier: P3
+    expected_files_touched: 1
+    destructive_ops: false
+    external_side_effects: false
+    touches_auth_config_or_secrets: false
+    touches_dependencies: false
+    public_visibility: false

oacp_cli-0.3.4/tests/conformance/autonomy/messages/invalid_message.yaml

@@ -0,0 +1,19 @@
+id: msg-20260512121300-iris-invalid
+from: iris
+type: task_request
+priority: P2
+created_at_utc: "2026-05-12T12:13:00Z"
+subject: "Invalid task"
+body: |
+  ## Task
+  Update one documentation paragraph for clarity.
+
+  task_profile:
+    estimated_minutes: 20
+    risk_tier: P3
+    expected_files_touched: 1
+    destructive_ops: false
+    external_side_effects: false
+    touches_auth_config_or_secrets: false
+    touches_dependencies: false
+    public_visibility: false

oacp_cli-0.3.4/tests/conformance/autonomy/messages/sensitive_commercial.yaml

@@ -0,0 +1,20 @@
+id: msg-20260512121400-iris-commercial
+from: iris
+to: codex
+type: task_request
+priority: P2
+created_at_utc: "2026-05-12T12:14:00Z"
+subject: "Commercial terms update"
+body: |
+  ## Task
+  Update the commercial terms summary for the product page.
+
+  task_profile:
+    estimated_minutes: 10
+    risk_tier: P3
+    expected_files_touched: 1
+    destructive_ops: false
+    external_side_effects: false
+    touches_auth_config_or_secrets: false
+    touches_dependencies: false
+    public_visibility: false