simplicio-loop 3.36.0__tar.gz → 3.37.0__tar.gz

{simplicio_loop-3.36.0 → simplicio_loop-3.37.0}/MANIFEST.in

@@ -1,3 +1,4 @@
 include PYPI.md
 include LICENSE
 recursive-include simplicio_loop/_bundle *
+recursive-include contracts/stage-agents/v1 *.json

{simplicio_loop-3.36.0/simplicio_loop.egg-info → simplicio_loop-3.37.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simplicio-loop
-Version: 3.36.0
+Version: 3.37.0
 Summary: The Universal Looping AI Orchestrator — a runtime-agnostic super-plugin (7 skills) that drains any queue of work end-to-end on any LLM/runtime.
 Author-email: Wesley Simplicio <wesleybob4@gmail.com>
 License: MIT

{simplicio_loop-3.36.0 → simplicio_loop-3.37.0}/README.md

@@ -1,7 +1,7 @@
 # 🔁 simplicio-loop — The Universal Looping AI Orchestrator
 
 <p align="center">
-  <img src="assets/simplicio-loop-hero-2026.png" alt="simplicio-loop autonomous parallel evidence-gated orchestration" width="920" />
+  <img src="assets/simplicio-loop-hero-stage-agents-2026.webp" alt="simplicio-loop portable stage agents, evidence gates, durable memory, and connected work-item reporting" width="920" />
 </p>
 
 <p align="center">
@@ -9,7 +9,7 @@
   <a href="https://github.com/wesleysimplicio/simplicio-loop/stargazers"><img src="https://img.shields.io/github/stars/wesleysimplicio/simplicio-loop?style=social" alt="Stars"></a>
   <a href="#-the-7-skills--5-accelerators"><img src="https://img.shields.io/badge/skills-7-7C3AED" alt="7 skills"></a>
   <a href="#-source-adapters"><img src="https://img.shields.io/badge/source%20adapters-5-00E08A" alt="5 source adapters"></a>
-  <a href="#-12-runtimes-one-protocol"><img src="https://img.shields.io/badge/runtimes-12%20(3%20garantidos%2B9%20best--effort)-2563EB" alt="12 runtimes (3 guaranteed + 9 best-effort)"></a>
+  <a href="#-15-runtimes-one-protocol"><img src="https://img.shields.io/badge/runtimes-15%20(3%20garantidos%2B12%20best--effort)-2563EB" alt="15 runtimes (3 guaranteed + 12 best-effort)"></a>
   <a href="#-the-49-extension-points"><img src="https://img.shields.io/badge/extension%20points-49-00E08A" alt="49 extension points"></a>
   <a href="#-token-economy"><img src="https://img.shields.io/badge/savings-unverified-888888" alt="Savings — unverified"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="License"></a>
@@ -20,7 +20,7 @@
   <a href="#-tldr">TL;DR</a> ·
   <a href="#-the-7-skills--5-accelerators">7 Skills</a> ·
   <a href="#-source-adapters">Source Adapters</a> ·
-  <a href="#-12-runtimes-one-protocol">12 Runtimes</a> ·
+  <a href="#-15-runtimes-one-protocol">15 Runtimes</a> ·
   <a href="#-the-loop">The Loop</a> ·
   <a href="#-token-economy">Token Economy</a> ·
   <a href="#-token-economy">Capture Engine</a> ·
@@ -86,6 +86,68 @@ That architecture lets one goal become a governed delivery system: from a single
 </p>
 <!-- visual-story:end -->
 
+<!-- stage-agents-roadmap:start -->
+## 🤖 Roadmap — a concrete agent behind every stage
+
+> **Implementation status:** this is the tracked target architecture in [#422](https://github.com/wesleysimplicio/simplicio-loop/issues/422)–[#436](https://github.com/wesleysimplicio/simplicio-loop/issues/436), not a claim that every stage agent and tracker adapter already ships. The canonical GitHub lifecycle comment exists today; the full mandatory stage-reporting gate is tracked in [#433](https://github.com/wesleysimplicio/simplicio-loop/issues/433).
+
+The portable driver will assign one accountable agent to intake/planning, implementation, safety,
+delivery, feedback/recovery, and final completion audit. Review fans out to four independent agents
+— security/correctness, code quality, runtime reproduction, and blast radius — before it can
+reconverge. Every transition emits an event and receipt; the completion auditor accepts evidence,
+never self-reported confidence.
+
+<p align="center">
+  <img src="assets/simplicio-loop-stage-agents-reporting-2026.webp" alt="simplicio-loop stage agents with four-way review, evidence ledger, recovery, completion audit, and work-item comments" width="920" />
+</p>
+
+### Work-item comment policy
+
+| Work tracker | Reporting policy | Completion meaning |
+|---|---|---|
+| **GitHub Issues / PRs** | **Required** for GitHub-bound runs | `COMPLETE` waits for a remotely observed comment receipt |
+| **Azure DevOps** | Only when its connector is detected, authenticated, authorized, and target-resolved | Connected providers report; `NOT_CONNECTED` is an explicit, non-blocking skip |
+| **Jira** | Only when connected | Same canonical timeline, provider-specific confirmation |
+| **Asana** | Only when connected | Same canonical timeline, provider-specific confirmation |
+| **Trello** | Only when connected | Same canonical timeline, provider-specific confirmation |
+
+```mermaid
+flowchart LR
+  SOURCE["Issue · task · queue"] --> COORD["Portable coordinator"]
+  COORD --> PLAN["Intake + Planner agent"]
+  PLAN --> BUILD["Implementation agent"]
+  BUILD --> SAFE["Safety agent"]
+  SAFE --> R1["Review agent · security"]
+  SAFE --> R2["Review agent · quality"]
+  SAFE --> R3["Review agent · runtime/E2E"]
+  SAFE --> R4["Review agent · blast radius"]
+  R1 --> DELIVER["Delivery agent"]
+  R2 --> DELIVER
+  R3 --> DELIVER
+  R4 --> DELIVER
+  DELIVER --> RECOVER["Feedback + Recovery agent"]
+  RECOVER --> BUILD
+  DELIVER --> AUDIT["Completion auditor"]
+  AUDIT --> VERDICT{"COMPLETE · PARTIAL · BLOCKED · REGRESSED"}
+  PLAN -. "events + receipts" .-> LEDGER["Append-only stage ledger"]
+  BUILD -.-> LEDGER
+  SAFE -.-> LEDGER
+  DELIVER -.-> LEDGER
+  AUDIT -.-> LEDGER
+  LEDGER --> GH["GitHub comments · REQUIRED"]
+  LEDGER -. "only if connected" .-> AZ["Azure DevOps comments"]
+  LEDGER -. "only if connected" .-> JIRA["Jira comments"]
+  LEDGER -. "only if connected" .-> ASANA["Asana comments"]
+  LEDGER -. "only if connected" .-> TRELLO["Trello comments"]
+  GH --> AUDIT
+```
+
+The provider-neutral contract, capability probes, idempotent markers, durable outboxes, recovery
+rules, sandbox E2E matrix, and acceptance criteria are specified in
+[#436](https://github.com/wesleysimplicio/simplicio-loop/issues/436). An optional provider is never
+treated as connected merely because a CLI exists, and no remote acknowledgment is ever invented.
+<!-- stage-agents-roadmap:end -->
+
 ## 🆕 What's new in v3.35.0
 
 - **Real multi-device execution** — atomic claim/discovery over a live remote queue, worker heartbeat + cancellation, receipt verification on *both* the client and the server, and an installable worker/supervisor/queue-server console-script surface, plus a `doctor.py` `LOCAL_ONLY` / `REMOTE_READY` / `REMOTE_MEASURED` tri-state so "remote" is never claimed without a passing cross-process proof.
@@ -126,14 +188,14 @@ and keeps watching **24/7** for new work — all behind safety gates and evidenc
 ```
 
 Three things make it different: it is a **super-plugin of focused skills**, it runs the **same
-protocol on 12 runtimes**, and it does all of this with **aggressive, honest token economy**.
+protocol on 15 runtimes**, and it does all of this with **aggressive, honest token economy**.
 
 The skill installs **standalone** too: you do **not** need `simplicio-runtime` or any mandatory
 runtime-native component just to use `simplicio-loop`. Native binds, operators, capture services,
 and the wider Simplicio runtime stack are optional accelerators on top of the core skill bundle.
 
 <p align="center">
-  <img src="assets/simplicio-loop-infographic.png" alt="simplicio-loop detailed infographic: standalone install, optional native binds, 7 skills, 5 accelerators, 12 runtimes, 5 source adapters, and proof gates" width="920" />
+  <img src="assets/simplicio-loop-infographic.png" alt="simplicio-loop detailed infographic: standalone install, required native binds, 7 skills, 5 accelerators, 15 runtimes, 5 source adapters, and proof gates" width="920" />
 </p>
 
 Within the Simplicio product line, this repo is also the **current reference task flow** for
@@ -230,9 +292,12 @@ The orchestrator discovers work from any source via pluggable adapters. Each exp
 
 | Source | Adapter | Purpose |
 |---|---|---|
-| GitHub Issues/PRs | `gh` CLI (native) | Primary work-item source |
-| Jira / Asana / ClickUp / Linear / Notion | host connector | Board/project management |
-| Trello / Azure DevOps | `az boards` adapter | Azure work tracking |
+| GitHub Issues/PRs | `gh` CLI (native) | Primary work-item source; canonical lifecycle comments ship today |
+| Azure DevOps | `az boards` / host connector | Azure Boards discovery; stage comments only after a real connected-capability probe |
+| Jira | host connector | Jira discovery; stage comments only when connected |
+| Asana | host connector | Asana discovery; stage comments only when connected |
+| Trello | host connector | Trello discovery; stage comments only when connected |
+| ClickUp / Linear / Notion | host connector | Board/project discovery; no stage-comment claim without a certified adapter |
 | **agentsview sessions** | `scripts/agentsview_adapter.py` | Stalled session recovery + cost observability |
 | Local files / CI queue | filesystem / CI API | Internal work tracking |
 
@@ -240,33 +305,38 @@ See each adapter's reference doc under `.claude/skills/simplicio-loop/references
 
 ---
 
-## 🌐 12 runtimes, one protocol — 3 guaranteed + 9 best-effort
+## 🌐 15 runtimes, one protocol — 3 guaranteed + 12 best-effort
 
 One universal skill core + one set of hooks drives every runtime. An adapter is thin: it tells a
 runtime *where to load the skills*, *how to arm the loop*, and *how to bind native speed*. **The
-skill names no runtime; the runtime detects the skill.**
+skill names no runtime; the runtime detects the skill.** The native `simplicio-runtime` MCP bind
+is **REQUIRED** on every runtime (loop BLOCKS if it's missing/unreachable) — see
+[`docs/MCP_SETUP.md`](docs/MCP_SETUP.md) for the per-host config table.
 
 ### Tier 1 — Guaranteed (gated on every commit)
 
-| Runtime | Skill load | Loop drive | Native bind |
+| Runtime | Skill load | Loop drive | Native bind (MCP) |
 |---|---|---|---|
-| **Claude Code** | `.claude/skills/` + plugin | `Stop` hook | MCP |
-| **Codex** | `AGENTS.md` | self-paced | MCP / adapter |
-| **Cursor** | `.cursor-plugin/` | `stop`+`afterAgentResponse` | MCP / rules |
+| **Claude Code** | `.claude/skills/` + plugin | `Stop` hook | REQUIRED — `~/.claude.json` |
+| **Codex** | `AGENTS.md` | self-paced | REQUIRED — `~/.codex/config.toml` |
+| **Cursor** | `.cursor-plugin/` | `stop`+`afterAgentResponse` | REQUIRED — `.cursor/mcp.json` |
 
 ### Tier 2 — Best-effort (contributions welcome, no gate)
 
-| Runtime | Skill load | Loop drive | Native bind |
+| Runtime | Skill load | Loop drive | Native bind (MCP) |
 |---|---|---|---|
-| **VS Code (Copilot)** | `copilot-instructions.md` | tasks | MCP |
-| **Antigravity** | rules / `AGENTS.md` | self-paced | MCP |
-| **Kiro** | `.kiro/steering/` | specs | MCP |
-| **OpenCode** | `AGENTS.md` | self-paced | MCP |
-| **Gemini** | `GEMINI.md` | self-paced | MCP / adapter |
-| **Aider** | `CONVENTIONS.md` | self-paced | — (LLM fallback) |
-| **Simplicio Agent** *(formerly Hermes)* | native recall | native loop | **native** |
-| **OpenClaw** | plugin SDK | native scheduler | **native** |
-| **Orca** | via inner agent + skills registry | inner hook / scheduled automations | MCP |
+| **VS Code (Copilot)** | `copilot-instructions.md` | tasks | REQUIRED — `.vscode/mcp.json` |
+| **Antigravity** | rules / `AGENTS.md` | self-paced | REQUIRED — best-effort path |
+| **Kiro** | `.kiro/steering/` | specs | REQUIRED — `.kiro/settings/mcp.json` |
+| **OpenCode** | `AGENTS.md` | self-paced | REQUIRED — `opencode.json` |
+| **Gemini** (CLI/Code Assist) | `GEMINI.md` | self-paced | REQUIRED — `.gemini/settings.json` (CLI) |
+| **Kimi** | inlined conventions | self-paced | REQUIRED — best-effort, no verified client |
+| **Qwen** (Code/CLI) | `AGENTS.md`-equivalent | self-paced | REQUIRED — `.qwen/settings.json` (best-effort) |
+| **DeepSeek** | inlined conventions | self-paced | REQUIRED — no first-party client, best-effort |
+| **Aider** | `CONVENTIONS.md` | self-paced | REQUIRED — no MCP client (LLM fallback for exec) |
+| **Simplicio Agent** *(formerly Hermes)* | native recall | native loop | REQUIRED — **native** |
+| **OpenClaw** | plugin SDK | native scheduler | REQUIRED — **native** |
+| **Orca** | via inner agent + skills registry | inner hook / scheduled automations | REQUIRED — registry/inner-agent config |
 
 The promise: **same protocol, same gates, same safety on all 12 — Tier 1 verified mechanically,
 Tier 2 best-effort.** `orient_clamp.py` (token economy) works on every runtime with zero wiring. See
@@ -680,7 +750,7 @@ opt-in capabilities you reach for when the task calls for them.
 MIT
 
 <!-- simplicio-loop:github-comment-coordination:v1 -->
-## 🌐 GitHub comment coordination across runtimes
+## 🌐 Work-item comment coordination across runtimes
 
 `simplicio-loop` can run at the same time in Claude Code, Codex, Cursor, Gemini, and Hermes. When a run is bound to a GitHub issue, it publishes idempotent lifecycle updates to that issue's canonical comment: claim, plan, progress, evidence, PR, and close. Agents on different machines can coordinate through the same GitHub thread without a shared local filesystem.
 
@@ -692,7 +762,7 @@ pwsh scripts/install.ps1 gemini -Global
 pwsh scripts/install.ps1 hermes -Global   # legacy alias for simplicio_agent
 ```
 
-Local queues, leases, worktrees, heartbeats, and evidence remain active on every machine; GitHub comments are the shared coordination projection. This flow is GitHub-only: Jira, Azure DevOps, and other trackers do not receive these comments. If GitHub is unavailable or unauthenticated, the loop remains usable locally and records the sync failure without inventing a remote acknowledgment. Give every runtime GitHub access and bind runs to the same `source_issue`.
+Local queues, leases, worktrees, heartbeats, and evidence remain active on every machine; GitHub comments are the shipped shared coordination projection. Today, an unavailable or unauthenticated GitHub records a sync failure without inventing a remote acknowledgment. The stage-agent roadmap tightens this for GitHub-bound runs: [#433](https://github.com/wesleysimplicio/simplicio-loop/issues/433) makes the comment confirmation mandatory before `COMPLETE`. [#436](https://github.com/wesleysimplicio/simplicio-loop/issues/436) adds the same projection to Azure DevOps, Jira, Asana, and Trello only when each connector is proven connected; disconnected optional trackers are explicitly skipped.
 
 The repository workflow `.github/workflows/simplicio-status-sync.yml` turns the canonical lifecycle
 state into a managed `simplicio:status:<state>` label and, when configured, moves the issue in a

simplicio_loop-3.37.0/contracts/stage-agents/v1/action-intent.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "simplicio.action-intent/v1",
+  "title": "Stage Agent Action Intent",
+  "description": "Typed intent emitted before any mutation-boundary action. Classifies the action surface so the safety gate can apply the right policy. Fail-closed: unknown action classes are rejected by the reducer.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "intent_id", "action_class", "command", "actor", "scope"],
+  "properties": {
+    "schema": { "const": "simplicio.action-intent/v1" },
+    "intent_id": { "type": "string", "minLength": 1 },
+    "action_class": {
+      "type": "string",
+      "enum": [
+        "write_edit",
+        "compound_shell",
+        "dependency_install",
+        "commit",
+        "push",
+        "pull_request",
+        "issue_board_op",
+        "migration_data",
+        "deploy_release",
+        "cancel_cleanup",
+        "secret_network_access",
+        "artifact_fetch_execute"
+      ]
+    },
+    "command": { "type": "string", "minLength": 1 },
+    "actor": { "type": "string", "minLength": 1 },
+    "scope": { "type": "string", "minLength": 1 },
+    "idempotency_key": { "type": "string" },
+    "policy_hash": { "type": "string" },
+    "segments": { "type": "array", "items": { "type": "string" } },
+    "created_at": { "type": "string", "format": "date-time" }
+  }
+}

simplicio_loop-3.37.0/contracts/stage-agents/v1/agent-instance.schema.json

@@ -0,0 +1,89 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://simplicio.dev/contracts/stage-agents/v1/agent-instance.schema.json",
+  "title": "simplicio.agent-instance/v1",
+  "type": "object",
+  "required": [
+    "schema",
+    "agent_instance_id",
+    "role_id",
+    "role_version",
+    "stage_id",
+    "stage_version",
+    "run_id",
+    "task_id",
+    "work_item_id",
+    "attempt_id",
+    "attempt_ordinal",
+    "fence",
+    "plan_revision",
+    "runtime",
+    "provider",
+    "model",
+    "driver",
+    "parent_agent_id",
+    "coordinator_agent_id",
+    "parent_instance_id",
+    "idempotency_key",
+    "isolation_level",
+    "negotiated_capabilities",
+    "context_hash",
+    "manifest_hash",
+    "created_at",
+    "ready_at",
+    "terminal_status",
+    "reason_code"
+  ],
+  "properties": {
+    "schema": { "const": "simplicio.agent-instance/v1" },
+    "agent_instance_id": { "type": "string", "minLength": 1 },
+    "role_id": { "type": "string", "pattern": "^[a-z][a-z0-9_-]*$" },
+    "role_version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+    "stage_id": { "type": "string", "pattern": "^[a-z][a-z0-9_-]*$" },
+    "stage_version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+    "run_id": { "type": "string", "minLength": 1 },
+    "task_id": { "type": "string", "minLength": 1 },
+    "work_item_id": { "type": "string", "minLength": 1 },
+    "attempt_id": { "type": "string", "minLength": 1 },
+    "attempt_ordinal": { "type": "integer", "minimum": 1 },
+    "fence": { "type": "string", "minLength": 1 },
+    "plan_revision": { "type": "integer", "minimum": 0 },
+    "runtime": { "type": "string", "minLength": 1 },
+    "provider": { "type": "string", "minLength": 1 },
+    "model": { "type": "string", "minLength": 1 },
+    "driver": { "type": "string", "minLength": 1 },
+    "parent_agent_id": { "type": "string", "minLength": 1 },
+    "coordinator_agent_id": { "type": "string", "minLength": 1 },
+    "parent_instance_id": { "type": "string", "minLength": 1 },
+    "idempotency_key": { "type": "string", "minLength": 1 },
+    "isolation_level": { "enum": ["process", "session", "worker", "command", "human"] },
+    "negotiated_capabilities": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 },
+      "uniqueItems": true
+    },
+    "context_hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "manifest_hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "created_at": { "type": "string", "format": "date-time" },
+    "ready_at": { "type": "string", "format": "date-time" },
+    "started_at": { "type": "string", "format": "date-time" },
+    "ended_at": { "type": "string", "format": "date-time" },
+    "terminal_status": { "enum": ["ready", "running", "completed", "failed", "blocked", "cancelled", "timed_out"] },
+    "reason_code": { "type": "string", "minLength": 1 }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "terminal_status": { "const": "ready" } } },
+      "then": { "not": { "anyOf": [{ "required": ["started_at"] }, { "required": ["ended_at"] }] } }
+    },
+    {
+      "if": { "properties": { "terminal_status": { "const": "running" } } },
+      "then": { "required": ["started_at"], "not": { "required": ["ended_at"] } }
+    },
+    {
+      "if": { "properties": { "terminal_status": { "enum": ["completed", "failed", "blocked", "cancelled", "timed_out"] } } },
+      "then": { "required": ["started_at", "ended_at"] }
+    }
+  ],
+  "additionalProperties": false
+}

simplicio_loop-3.37.0/contracts/stage-agents/v1/agent-role.schema.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://simplicio.dev/contracts/stage-agents/v1/agent-role.schema.json",
+  "title": "simplicio.agent-role/v1",
+  "type": "object",
+  "required": [
+    "schema",
+    "role_id",
+    "version",
+    "title",
+    "description",
+    "required_capabilities",
+    "forbidden_to_self_sign",
+    "independent_of_roles"
+  ],
+  "properties": {
+    "schema": { "const": "simplicio.agent-role/v1" },
+    "role_id": { "type": "string", "pattern": "^[a-z][a-z0-9_-]*$", "minLength": 1 },
+    "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+    "title": { "type": "string", "minLength": 1 },
+    "description": { "type": "string", "minLength": 1 },
+    "required_capabilities": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 },
+      "uniqueItems": true
+    },
+    "forbidden_to_self_sign": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 },
+      "description": "Receipt types this role may NEVER sign for itself (e.g. reviewer cannot sign its own review).",
+      "uniqueItems": true
+    },
+    "independent_of_roles": {
+      "type": "array",
+      "items": { "type": "string", "pattern": "^[a-z][a-z0-9_-]*$" },
+      "description": "Roles that must be a DIFFERENT instance/context from this one (no fake independence).",
+      "uniqueItems": true
+    }
+  },
+  "additionalProperties": false
+}

simplicio_loop-3.37.0/contracts/stage-agents/v1/review-finding.schema.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://simplicio.dev/contracts/stage-agents/v1/review-finding.schema.json",
+  "title": "simplicio.review-finding/v1",
+  "type": "object",
+  "required": [
+    "schema",
+    "role_id",
+    "file",
+    "line",
+    "claim",
+    "normalized_claim",
+    "class",
+    "confidence",
+    "evidence_refs"
+  ],
+  "properties": {
+    "schema": { "const": "simplicio.review-finding/v1" },
+    "role_id": {
+      "enum": [
+        "security_correctness_reviewer",
+        "maintainability_reviewer",
+        "runtime_reproduction_verifier",
+        "blast_radius_reviewer"
+      ]
+    },
+    "file": { "type": "string", "minLength": 1 },
+    "line": { "type": "integer", "minimum": 0 },
+    "claim": { "type": "string", "minLength": 1 },
+    "normalized_claim": { "type": "string", "minLength": 1 },
+    "class": {
+      "enum": ["security", "correctness", "maintainability", "runtime", "blast_radius"]
+    },
+    "confidence": { "enum": ["low", "medium", "high"] },
+    "evidence_refs": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 }
+    }
+  },
+  "additionalProperties": false
+}

simplicio_loop-3.37.0/contracts/stage-agents/v1/review-receipt.schema.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://simplicio.dev/contracts/stage-agents/v1/review-receipt.schema.json",
+  "title": "simplicio.review-receipt/v1",
+  "description": "Per-reviewer receipt from the four-reviewer independent review panel (issue #427). Extends simplicio.stage-receipt/v1 with a hash-pinned rubric and a panel_signature that invalidates the receipt whenever the diff/head/plan_revision changes.",
+  "type": "object",
+  "required": [
+    "schema",
+    "receipt_id",
+    "agent_instance_id",
+    "role_id",
+    "run_id",
+    "task_id",
+    "attempt_id",
+    "fence",
+    "plan_revision",
+    "context_hash",
+    "rubric_hash",
+    "panel_signature",
+    "verdict",
+    "findings",
+    "evidence_refs",
+    "accepted",
+    "created_at"
+  ],
+  "properties": {
+    "schema": { "const": "simplicio.review-receipt/v1" },
+    "receipt_id": { "type": "string", "minLength": 1 },
+    "agent_instance_id": { "type": "string", "minLength": 1 },
+    "role_id": {
+      "enum": [
+        "security_correctness_reviewer",
+        "maintainability_reviewer",
+        "runtime_reproduction_verifier",
+        "blast_radius_reviewer"
+      ]
+    },
+    "run_id": { "type": "string", "minLength": 1 },
+    "task_id": { "type": "string", "minLength": 1 },
+    "attempt_id": { "type": "string", "minLength": 1 },
+    "fence": { "type": "string", "minLength": 1 },
+    "plan_revision": { "type": "integer", "minimum": 0 },
+    "context_hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "rubric_hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "panel_signature": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "verdict": { "enum": ["pass", "fail", "blocked", "skip"] },
+    "findings": {
+      "type": "array",
+      "items": { "$ref": "https://simplicio.dev/contracts/stage-agents/v1/review-finding.schema.json" }
+    },
+    "evidence_refs": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "accepted": { "type": "boolean" },
+    "created_at": { "type": "string", "format": "date-time" },
+    "rejection_reason": { "type": "string", "minLength": 1 }
+  },
+  "additionalProperties": false
+}

simplicio_loop-3.37.0/contracts/stage-agents/v1/run-stage-graph.schema.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://simplicio.dev/contracts/stage-agents/v1/run-stage-graph.schema.json",
+  "title": "simplicio.run-stage-graph/v1",
+  "type": "object",
+  "required": [
+    "schema",
+    "graph_id",
+    "version",
+    "manifest_hash",
+    "schema_pins",
+    "stages",
+    "roles"
+  ],
+  "properties": {
+    "schema": { "const": "simplicio.run-stage-graph/v1" },
+    "graph_id": { "type": "string", "minLength": 1 },
+    "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+    "manifest_hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "schema_pins": {
+      "type": "object",
+      "additionalProperties": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
+    },
+    "stages": {
+      "type": "array",
+      "items": { "$ref": "stage-definition.schema.json" },
+      "minItems": 1
+    },
+    "roles": {
+      "type": "array",
+      "items": { "$ref": "agent-role.schema.json" },
+      "minItems": 1
+    }
+  },
+  "additionalProperties": false
+}