esengine/DeepSeek-Reasonix
1
0 Fork 0
mirror of https://github.com/esengine/DeepSeek-Reasonix.git synced 2026-11-07 10:45:59 -10:00
Code Issues Packages Projects Releases 1 Wiki Activity

refactor(agent): replace task-mode routing with fact-driven execution / 用事实驱动执行替代任务模式路由 (#8930)

Browse Source 
* refactor(evidence): classify concrete tool effects

Host execution policy must judge the concrete tool call, resolved paths,
and receipts. Unify bash, file, MCP, and proxy effects into EffectProfile
and replace path substring matching with segment-aware classification so
author.go is not treated as an auth path.

Cache-impact: none. EffectHint is host-only and is not serialized into
provider tool schemas.

Verification: go test ./internal/evidence ./internal/shellsafe ./internal/tool

* refactor(contract): make obligations and receipts authoritative

TaskContract no longer classifies the prompt. Rebuild the contract from
approved plans, active goals, todos, project checks, and real receipts.
Obligations can only be added, satisfied, or invalidated by a later
related write. Denied or failed writers create no post-success duties.

Cache-impact: none. Contract state stays host-only and is not injected
into the system prefix or tool schemas.

Verification: go test ./internal/taskcontract ./internal/evidence

* refactor(agent): add monotonic execution guard pipeline

Replace scattered TaskPolicy preflight with a dedicated runtimepolicy
engine. Guards merge Deny > Ask > Allow > Abstain, Plan writes stay
hard-blocked even under YOLO, and the contract lock is never held
across permission, tool execution, or user prompts.

Stop injecting <execution-policy> into new turns. Historical v2 tags
remain readable on disk and are stripped only when building the
provider request.

Cache-impact: intended. Removing the per-turn execution-policy suffix
keeps user history append-only. Executor tool schemas and the system
prefix are unchanged.

Verification: go test ./internal/runtimepolicy ./internal/agent
go test -race ./internal/runtimepolicy ./internal/agent

* refactor(planner): remove automatic task-weight routing

DecidePlannerRoute is now explicit-only: plan-first, plan-for-approval,
plan-only, or Goal start. Ordinary wording, file counts, and risk
keywords stay executor-only. Drop Light/Full planner depth from the
route, the planner-turn block, and leftover complexity tables.

Move ClassifyGoalBudget into control so Goal budget compatibility
survives after deleting taskintent.

Cache-impact: intended planner-prefix change. The planner system prompt
no longer branches on Light/Full depth. Executor schemas and prefix
are unchanged. planner_model remains available for explicit planning.

Verification: go test ./internal/control ./internal/agent

* refactor(agent): decouple delegation and capability routing

Replace InheritedTaskPolicy with InheritedExecutionContext so children
inherit constraints, Plan read-only, Goal scope, and a delegated
contract slice. Read-only children stay read-only from the tool set,
not from prompt classification. Child receipts merge into the parent
ledger; prose claims do not satisfy parent obligations.

The capability router uses TaskPolicy no longer: strong catalog matches
return immediately, and the semantic router runs only when the catalog
is ambiguous.

Cache-impact: none. The provider-visible core tool set is unchanged.

Verification: go test ./internal/agent ./internal/control
go test -race ./internal/agent ./internal/control

* test(agent): lock fact-driven execution contracts

Pin the functional matrix, cache-schema stability, historical
execution-policy restore, and stop rules against the fact contract.
Final readiness now consumes obligations and receipts instead of
prompt-invented missing mutation. Ordinary Recoverable gaps complete
as Partial; Goal and Strict gaps cannot look successful.

Delete the leftover TaskPolicy package now that production callers
are gone.

Cache-impact: none beyond the already-intended execution-policy
strip. Executor schema bytes stay identical across ordinary, Plan,
Goal, and obligation states.

Verification: go test ./internal/agent ./internal/control ./internal/boot
go test -race ./internal/agent ./internal/control

* docs: document fact-driven execution model

Document that ordinary requests always enter the executor, that there
is no automatic simple/light/full task mode, and that Plan, Goal,
permission, and the task contract are independent. Host verification
obligations come from real tool actions. The Harness minimal preset
is not a task-complexity mode, and the tool catalog stays stable to
protect the prompt cache.

Cache-impact: none. Documentation only.

Verification: docs reviewed against DecidePlannerRoute, MapWriter,
and the new GUIDE/SPEC two-model sections.

* fix(contract): bind execution proofs to observed facts

Problem:
Fact-driven obligations could be cleared by targeted verification, unrelated reads, mismatched review reports, or replayed receipts. Sequential single-file writes also bypassed multi-file preconditions, while active Goal and explicit full-verification facts were not consistently enforced.

Root cause:
Receipt folding matched broad evidence kinds without target, scope, verdict, or cumulative-write context. Engine rebuild did not restore its receipt watermark, and live/shadow contract rebuilds omitted policy facts.

Fix:
Require project-wide or repository-declared full verification, bind review evidence to exact targets and review kinds, revoke proofs on later failures, and escalate cumulative production writes. Preserve active Goal, constraint, and receipt-sequence facts across engine and shadow replays, with adversarial regression coverage and updated documentation.

Verification:
- go test ./...
- cd desktop && go test ./...
- go test -race ./internal/evidence ./internal/taskcontract ./internal/runtimepolicy ./internal/agent ./internal/control
- go vet ./...
- go run ./tools/repolint
- git diff --check
This commit is contained in:
SivanCola authored and GitHub committed 2026-08-16 08:17:07 +08:00
1 parent 352d171b32
commit 314beed8f5
122 files changed
+4872 -3654
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CHANGELOG.md
+9 -15
View File
@@ -8,21 +8,15 @@ branch.
### Changed
- **Single adaptive standard execution:** Reasonix no longer exposes Light /
Balanced / Delivery (or TokenMode) as a selectable execution mode. Planning,
verification, and independent review now follow per-turn task risk via
`TaskPolicy` v2. Low-risk conversation stays direct with no auxiliary model
calls; high-risk, security, persistence, and active-Goal work keep the former
Delivery closed-loop contract. Old `--preset`/`--profile`, `/preset`, ACP
`agent_preset`/`work_mode`, and Desktop `SetAgentPreset*`/`SetTokenMode*`
calls stay accepted for one compatibility version as no-ops. New persisted
compat fields pin `agentPreset=balanced` and `tokenMode=full`. Isolated
worktrees keep their on-disk directory; the UI no longer forces a Delivery
mode. Ordinary targeted tasks now surface missing verification or review as
a host-authored non-complete/unverified summary instead of stopping on
a recovery card; high-risk, persistent, security, explicit full-verification,
and Goal work retain hard evidence closure. Deprecated fields will be removed
after that compatibility window.
- **Fact-driven execution:** Ordinary requests always enter the executor.
There is no automatic simple / light / full task mode and no per-turn
`TaskPolicy` classification. The planner runs only for an explicit Plan,
an approval boundary, or Goal start. The host builds verification
obligations from concrete tool effects and receipts. Plan, Goal,
permission, and sandbox stay independent. Tool schemas and the executor
system prefix stay byte-stable. Historical `<execution-policy>` tags remain
readable on old sessions and are stripped from new provider context.
Old `--preset`/`--profile` compatibility no-ops are unchanged.
### Fixed
docs/ACP.md
+2 -2
View File
@@ -30,8 +30,8 @@ reasonix acp
```
`--model` selects the startup model when the client does not override it.
Reasonix runs one adaptive standard execution whose planning, verification,
and review strength follows task risk automatically.
Ordinary requests always enter the executor. There is no automatic simple /
light / full task mode. Verification obligations come from real tool actions.
Standard output is reserved for ACP messages. Reasonix sends diagnostics to
standard error, so hosts must not merge the two streams. Run `reasonix setup`
docs/ACP.zh-CN.md
+2 -2
View File
@@ -26,8 +26,8 @@ reasonix acp
reasonix acp --model deepseek-pro
```
客户端未覆盖模型时，`--model` 用于选择启动模型。Reasonix 使用同一套自适应标准执行，
规划、验证与复查强度随任务风险自动调整。
客户端未覆盖模型时，`--model` 用于选择启动模型。普通请求一律进入 executor，
没有自动简单 / 轻量 / 完整任务模式；验证义务由宿主根据真实工具动作建立。
标准输出专用于 ACP 消息，Reasonix 会把诊断写入标准错误，因此 host 不应合并这两个
流。尚未配置 provider 时先运行 `reasonix setup`；initialize 响应也会声明一个启动
docs/CLI.md
+3 -3
View File
@@ -19,9 +19,9 @@ reasonix --effort high
reasonix --dir /path/to/project
```
Reasonix runs a single adaptive standard execution: planning depth,
verification breadth, and independent review follow the task's risk
automatically — there is no execution mode to pick.
Ordinary requests always enter the executor. There is no automatic simple /
light / full task mode to pick. The dedicated planner runs only for an
explicit Plan, an approval boundary, or Goal start.
Running `reasonix` without a subcommand starts the interactive terminal UI. Use
`reasonix setup` first when no provider is configured.
docs/CLI.zh-CN.md
+2 -2
View File
@@ -401,8 +401,8 @@ SSH 下远端进程无法读取本机剪贴板，请使用终端粘贴快捷键
切换模型或 effort 会重建运行时，同时保留当前对话、会话级权限覆盖、附加目录
访问权限和 session ownership。`/reload` 使用同一套失败原子重建语义。
Reasonix 只有一种自适应标准执行：规划、验证与复查强度随任务风险自动调整，
不再存在执行模式。
普通请求一律进入 executor，没有自动简单 / 轻量 / 完整任务模式。
独立 Planner 只响应显式 Plan、批准边界和 Goal 启动。
用量统计使用独立的可丢弃 rollup 投影：
reasonix catalogs reindex usage [--json]
docs/COLLABORATION_MODES.md
+35
View File
@@ -0,0 +1,35 @@
# Collaboration modes and fact-driven execution
The desktop composer menu has two independent collaboration axes:
- **Plan mode**: draft a plan, then implement after approval.
- **Goal mode**: pursue one objective until it is complete, blocked, or stopped.
There is no automatic simple / light / full task mode. Ordinary requests always
enter the executor. The dedicated planner runs only for an explicit Plan, an
approval boundary, or Goal start. Todos and sub-agents are model-chosen. The
host builds verification obligations from real tool actions.
The host evaluates cumulative effects, not just one tool call at a time. A
second production target upgrades sequential edits to multi-file preconditions.
Full verification requires every repository-declared check, or an unmistakably
project-wide verifier when no checks are declared. Reviews are accepted only
when their type, target coverage, and non-blocking verdict match the outstanding
obligation.
Plan, Goal, permission, sandbox, and the task contract are independent states.
Ask / Auto / Yolo keep their public meanings. The tool catalog stays stable so
the prompt cache stays warm. The Harness minimal preset is not a task
complexity mode.
## Plan mode
Plan mode is a workflow instruction, not a permission boundary. Writes stay
hard-blocked until the plan is approved, even under YOLO. `complete_step` waits
for approval.
## Goal mode
Goal mode keeps working inside the stated objective. Blocked Goals write into
the existing Goal state. Ordinary tasks that cannot satisfy a strict obligation
return a blocked explanation and must not look successful.
docs/COLLABORATION_MODES.zh-CN.md
+18 -32
View File
@@ -1,13 +1,13 @@
# 协作方式与自适应执行
# 协作方式与事实驱动执行
Reasonix 桌面端输入框左下角的菜单包含两条互相独立的协作轴：
- **计划模式**：要求模型先产出计划，确认后再切换到实施。
- **目标模式**：给 Reasonix 一个目标，让它持续推进直到完成、阻塞或停止。
计划模式和目标模式属于“协作方式”轴，通常二选一。执行强度不是可选项：Reasonix
对每个任务使用同一套自适应标准执行，规划、验证与独立复查的强度随任务风险自动调整
（低风险任务零辅助模型调用，中高风险任务自动获得完整验证与复查闭环）。
计划模式和目标模式属于“协作方式”轴，通常二选一。没有自动简单/轻量/完整任务模式。
普通请求一律进入 executor；Planner 只响应显式 Plan、批准边界和 Goal 启动。
验证义务由宿主根据真实工具动作建立。
## 计划模式
@@ -31,7 +31,7 @@ Reasonix 桌面端输入框左下角的菜单包含两条互相独立的协作
- 计划模式不是“自动完成任务”。它会先暂停在计划阶段，等待你确认。
- 计划模式通过模型指令和确认步骤减少误改风险，但不替代 Ask、`deny` 规则或 Sandbox。
- 如果你已经明确要直接改一个小问题，普通模式通常更快。
- 计划模式只控制“先规划再执行”的流程；验证与复查强度由任务风险自动决定。
- 计划模式只控制“先规划再执行”的流程；验证义务来自实际写入和批准后的合同。
- Ask 不是只读模式：需审批的 writer 在批准后仍可执行。需要技术上严格只读时，应使用显式只读 subagent/权限配置，而不是依赖 Plan 或 Ask。
## 目标模式
@@ -71,31 +71,17 @@ Goal 模式会把这些部分当作任务边界；除非下一步涉及不可逆
- 旧 `.reasonix/autoresearch/...` 目录不会被新版本创建或改写；显式引用旧任务路径时只会读取并恢复成普通 Goal。
- 目标模式和计划模式是同一协作轴。切到计划模式时，会退出目标草稿/目标显示状态。
## 自适应标准执行
## 事实驱动执行
Reasonix 只有一种执行体验：系统根据任务风险自动选择规划、验证和复查强度，用户无需
（也无法）选择执行模式。所有任务共享同一套 provider 可见核心工具面（直接编码工具 +
后台 shell 生命周期 + 稳定的 `use_capability` 代理）；可选能力一律经 `use_capability`
调度，不扩展 top-level schema。
Reasonix 没有自动简单/轻量/完整模式。普通请求进入 executor；显式 Plan、批准边界和
Goal 启动才会调用独立 Planner。todo 与 subagent 由模型按需使用。宿主依据真实动作
建立验证义务：只读无义务，文档修改为 Advisory，单文件生产修改为 Recoverable，
Schema/认证/破坏性操作为 Strict。Plan、Goal、permission、sandbox 互相独立。
工具目录保持稳定以保护 prompt cache。Harness minimal preset 不是任务复杂度模式。
风险分级策略：
- **对话与咨询**：直接执行，零辅助模型调用。
- **普通只读查询**：定向证据，结论必须引用实际读取结果。
- **结构化多步只读分析**：轻量规划 + 证据核对 + 条件复审。
- **单文件、目标明确、低风险修改**：直接执行 + 零额外模型调用的 Atomic TaskContract +
定向检查。
- **同一功能面内的多文件修改**：轻量规划 + 针对性或项目级检查 + 条件复审；缺少质量
证据时以“未完整验证”的质量摘要明确展示，不中断普通任务要求手动“继续检查”。
- **跨模块、公共接口、持久化、活跃 Goal**：完整规划 + 完整检查 + 强制独立复审 + 证据
闭环。
- **安全、权限、迁移、发布、破坏性操作**：完整规划 + 完整检查 + 强制安全复查；缺证据
不得 Complete。
闭环执行包含稳定证据合约：变更前建立 `todo_write` 验收清单；条件允许时先复现；修复
根因；运行聚焦验证；复审 diff 与相邻行为；变更后以 `complete_step` 正式签收；证据不足时
只能返回 Partial、Unverified 或 Blocked，绝不“表面成功”。风险在任务内只升不降：回执
发现改动触及高风险面或超出初始判断时，策略实时上调并补齐验证与复查。
宿主按累计效果判断，而不是只看单次工具调用：顺序写到第二个生产目标会升级为多文件
前置条件。完整验证要求仓库声明的检查全部通过；仓库未声明检查时，只接受明确覆盖整个
项目的验证命令。复查回执只有在类型、目标覆盖范围和非阻断结论都匹配待办义务时才有效。
## 协作方式如何组合
@@ -103,7 +89,7 @@ Reasonix 只有一种执行体验：系统根据任务风险自动选择规划
| --- | --- | --- |
| 普通 | 支持 | 日常聊天与问答；低风险任务零辅助模型调用。 |
| 计划 | 支持 | 先用完整工具面研究并确认方案，再执行。 |
| 目标 | 支持 | 持续推进明确目标，自动获得完整规划与证据闭环。 |
| 目标 | 支持 | 持续推进明确目标；Goal 启动可调用一次独立 Planner，之后按真实回执形成证据闭环。 |
| 计划 + 目标 | 不建议同时使用 | 两者都是协作方式轴，切换计划会退出目标草稿/目标显示状态。 |
| 工具权限（询问/自动/Yolo）+ 任一组合 | 支持 | 工具权限控制工具审批；Sandbox 继续控制文件、进程与网络边界。 |
@@ -111,8 +97,8 @@ Reasonix 只有一种执行体验：系统根据任务风险自动选择规划
## 推荐选择
- **不确定怎么选**：保持普通模式；执行强度会随任务风险自动调整。
- **成本敏感或简单问答**：直接提问即可——低风险任务不会产生规划或复查模型调用。
- **不确定怎么选**：保持普通模式；普通请求进入 executor，验证义务来自真实写入。
- **成本敏感或简单问答**：直接提问即可——普通请求不会自动调用 Planner。
- **担心 Reasonix 改错**：开启计划模式先确认方案，并保持 Ask 与合适的 Sandbox 边界。
- **想让 Reasonix 持续推进一个明确目标**：开启目标模式，目标写清楚成功标准。
- **看重最终质量**：无需选择——中高风险任务自动获得完整验证、独立复查与证据闭环。
- **看重最终质量**：无需另选模式——宿主按实际写入建立验证义务；Schema、认证或破坏性操作为 Strict。
docs/GUIDE.md
+42 -48
View File
@@ -1225,36 +1225,33 @@ The planner sees loaded `REASONIX.md` / `AGENTS.md` memory and a small read-only
research tool set, so it can inspect relevant files before handing a plan to the
executor. Writer and workflow tools remain executor-only.
Reasonix routes each turn deterministically without another classifier model:
questions, short follow-ups, clear atomic edits, and bounded read-only actions
go straight to the executor; bounded implementation work may receive a short
light plan. Ambiguous, cross-surface, structured, high-risk, active-Goal, or
closed-loop work receives a full plan unless the request is clearly atomic or
read-only. Explicit Plan Mode
remains a separate host workflow and is never planned twice. An explicit
`plan first` / `先规划` request forces planning, while `just do it` / `直接改`
goes directly to the executor. Execution boundaries are recognized across the
request, not only at its beginning, while quoted examples are ignored. Bare
plan-first requests continue from the planner to the executor automatically.
Requests that explicitly say to wait for confirmation pause at the host
approval boundary and continue to the executor after approval. Only an
explicit `plan only` / `不要执行` request ends the
Reasonix routes each turn deterministically without another classifier model.
Ordinary requests always stay with the executor. The dedicated planner runs
only for an explicit `plan first` / `先规划` request, an explicit wait-for-
approval boundary, an explicit `plan only` / `不要执行` request, or Goal
start. Wording such as "complex refactor" or "fix login" does not start the
planner. There is no automatic light / full planning depth. Explicit Plan Mode
remains a separate host workflow on the executor and is never planned twice.
`just do it` / `直接改` also stays with the executor. Execution boundaries are
recognized across the request, not only at its beginning, while quoted
examples are ignored. Bare plan-first requests continue from the planner to
the executor automatically. Requests that explicitly say to wait for
confirmation pause at the host approval boundary and continue to the executor
after approval. Only an explicit `plan only` / `不要执行` request ends the
current turn with the plan persisted and no execution; a later user instruction
can continue in the same session. The phase detail records a privacy-safe route,
depth, and reason code for diagnosis without logging the user prompt.
can continue in the same session. The phase detail records a privacy-safe route
and reason code for diagnosis without logging the user prompt.
Light plans contain a compact objective, at most four ordered steps, likely
touchpoints, and the main verification. Full plans distinguish verified from
candidate touchpoints and add relevant non-goals, risks, acceptance criteria,
command-level verification, and rollback guidance when the operation is hard to
reverse. These contracts are part of one stable planner system prompt; only the
small per-turn depth instruction is appended to the user turn, preserving the
planner's prefix cache after the one-time prompt upgrade. The host also gives
light and full research different per-turn round budgets. If a planner still
does not finalize after its bounded research and finalization round, ordinary
plan-and-execute work continues with the executor using the original task.
Plan-only and approval-gated requests remain fail-closed, and the incomplete
planner turn is rolled back instead of leaving an unusable continuation tail.
The planner uses one stable system prompt. A small host-authored
`<planner-turn>` block names the explicit route and preserves the planner
prefix cache after the one-time prompt upgrade. The plan should separate
verified from candidate touchpoints and include non-goals, risks, acceptance
criteria, and command-level verification when evidence supports them. If a
planner still does not finalize after its bounded research and finalization
round, ordinary plan-and-execute work continues with the executor using the
original task. Plan-only and approval-gated requests remain fail-closed, and
the incomplete planner turn is rolled back instead of leaving an unusable
continuation tail.
Reasonix manages normal execution automatically: if an active todo produces no
new completion, unique read, command, or mutation for 8 tool-call rounds, the
@@ -1394,34 +1391,31 @@ is narrower than the dedicated Planner: the Planner accepts authorized opaque
non-destructive MCP, while a strict child requires an explicit reader hint and
never exposes writers at all.
Reasonix runs a single adaptive **standard execution**: planning depth,
verification breadth, and independent review follow the task's risk
automatically, per turn.
Reasonix uses **fact-driven execution**. Ordinary requests always enter the
executor. There is no automatic simple / light / full task mode. Planner,
Goal, permission, sandbox, and the task contract are independent states.
Every task shares the same provider-visible core tool surface: direct
read/bash/edit/write, background-shell lifecycle tools, `ask`/`compress` when
registered, and the stable `use_capability` proxy for optional tools (search,
MCP, skills, subagents, docs, web_fetch, and so on). Calling `use_capability`
never expands the top-level provider schema, so the prompt-cache tool prefix
stays stable across every task.
stays stable across every task. The Harness minimal preset is not a task
complexity mode.
What adapts is host policy, not the tool list:
The model decides whether to investigate, write todos, or spawn a sub-agent.
The host then builds verification obligations from the actual tool call, the
real target path, and the execution receipt:
- Conversation and advisory turns run direct with no auxiliary model calls.
- Plain read-only queries cite their actual reads (targeted evidence).
- Single-file, anchored, low-risk modifications run direct with a
zero-extra-model-call Atomic TaskContract and targeted checks.
- Multi-file same-surface work gets a light plan, project-level checks, and a
conditional independent review that escalates to forced when coverage is weak.
- Cross-module, public-interface, persistence, security/permission/migration/
release, and active-Goal work get a full plan, full checks, forced independent
review (plus security review for safety classes), and the full evidence
closed loop: acceptance criteria before state changes, verification after the
latest mutation, review, and sign-off with `complete_step`. Missing evidence
ends the turn Partial, Unverified, or Blocked — never Complete.
- Risk only ratchets upward within a turn: when receipts show the change set
touched high-risk surfaces or outgrew the initial judgment, the policy
escalates and the missing verification/review is still demanded.
- A read-only call creates no obligation.
- A local docs, i18n, fixture, or style edit is advisory targeted verification.
- A single production-file edit is recoverable targeted verification plus
diff review.
- Multi-file or unclear local writes require a todo and criteria first.
- Schema, migration, public-interface, auth, or destructive work becomes
strict verification, review, and sign-off after the write is observed.
- Goal items and approved Plan criteria are always strict.
- Prompt words such as OAuth or token never create action risk by themselves.
Meta tools such as `task`, `run_skill`, and `review` are not counted as mutations
by themselves — only real child writes are. Read-only analysis remains available
docs/GUIDE.zh-CN.md
+32 -36
View File
@@ -951,25 +951,23 @@ planner_model = "deepseek-pro" # 作为低频规划器
Planner 会看到已加载的 `REASONIX.md` / `AGENTS.md` 记忆，并拿到一小组只读研究工具，
因此可以先检查相关文件再把计划交给执行器。写入类和流程类工具仍只给执行器使用。
Reasonix 会用确定性规则路由每一轮，不再调用额外的 classifier 模型：问答、短回复、
明确的单点小改和边界清楚的纯只读动作直达 Executor；边界清楚的实现任务可生成简短的
Light 计划；模糊、跨面、结构化、高风险、活跃 Goal 或 Delivery 的任务生成 Full 计划，
明确的原子小改或纯只读动作除外。
显式 Plan Mode 仍是独立的宿主流程，不会发生双重规划。
明确的 `先规划` / `plan first` 会强制规划，`直接改` / `just do it` 则直达 Executor；
执行边界可出现在请求中的任意子句，不要求位于句首，同时会忽略引号内的示例；
普通的“先规划”会在规划完成后自动交接 Executor；明确要求“等我确认”的请求停在宿主
审批边界，批准后继续交接 Executor。只有明确的 `只规划` / `不要执行` 才以计划结束当前
回合而不执行，计划会写入同一会话，用户之后仍可继续要求 Executor 落地。阶段详情会记录
不含用户原文的 route、depth 与 reason code，便于诊断。
Reasonix 会用确定性规则路由每一轮，不再调用额外的 classifier 模型。普通请求一律
直达 Executor。独立 Planner 只响应显式 `先规划` / `plan first`、显式等待批准、
显式 `只规划` / `不要执行`，或 Goal 启动。“复杂重构”“修复登录”这类措辞不会自动
启动 Planner，也没有 Light/Full 规划深度。显式 Plan Mode 仍是 executor 上的独立
宿主流程，不会发生双重规划。`直接改` / `just do it` 同样直达 Executor。执行边界
可出现在请求中的任意子句，不要求位于句首，同时会忽略引号内的示例。普通的“先规划”
会在规划完成后自动交接 Executor；明确要求“等我确认”的请求停在宿主审批边界，批准后
继续交接 Executor。只有明确的 `只规划` / `不要执行` 才以计划结束当前回合而不执行，
计划会写入同一会话，用户之后仍可继续要求 Executor 落地。阶段详情会记录不含用户原文
的 route 与 reason code，便于诊断。
Light 计划包含紧凑目标、最多四个有序步骤、可能触点和主要验证；Full 计划会区分已验证
与候选触点，并按需补充非目标、风险、验收标准、命令级验证，以及难回滚操作的回滚方案。
这些合约位于同一个稳定的 Planner system prompt，单轮只在 user turn 追加很小的深度指令，
因此除本次 prompt 升级的一次缓存未命中外，不会持续破坏 Planner prefix cache。宿主也会
为 Light 与 Full 调研设置不同的单轮轮次预算。若 Planner 在有界调研和最终总结轮后仍未
给出最终计划，普通 plan-and-execute 会用原始任务直接交给 Executor 继续；plan-only 与
等待批准请求仍保持 fail-closed，并回滚不完整的 Planner 回合，避免留下无法继续的会话尾部。
Planner 使用同一个稳定的 system prompt，单轮只追加很小的 `<planner-turn>` 标明
显式路由，因此除本次 prompt 升级的一次缓存未命中外，不会持续破坏 Planner prefix
cache。计划应区分已验证与候选触点，并在证据支持时补充非目标、风险、验收标准和
命令级验证。若 Planner 在有界调研和最终总结轮后仍未给出最终计划，普通
plan-and-execute 会用原始任务直接交给 Executor 继续；plan-only 与等待批准请求仍
保持 fail-closed，并回滚不完整的 Planner 回合，避免留下无法继续的会话尾部。
Reasonix 会自动管理正常执行：活跃 Todo 连续 8 个工具调用轮次没有新的完成项、唯一读取、
命令或修改时，宿主会要求执行器重新评估；Goal 到达后续阈值时会强制重新规划并继续，而不会因
@@ -1067,28 +1065,26 @@ enable、授权与完整连接身份，因此共享 Host 中另一个项目/tab
server 无法在这里提升权限。严格只读边界比独立 Planner 更窄：Planner 接受已授权的 opaque
非 destructive MCP，而严格只读子会话必须有明确 reader hint，且根本不暴露 writer。
Reasonix 只有一种自适应**标准执行**：规划深度、验证广度与独立复查随任务风险逐 turn
自动调整。
Reasonix 使用**事实驱动执行**。普通请求一律进入 executor，没有自动的简单 /
轻量 / 完整任务模式。Plan、Goal、permission、sandbox 与任务合同是互相独立的状态。
所有任务共享同一套 provider 可见核心工具面（直接读/bash/编辑/写入、后台 shell
生命周期工具，以及稳定的 `use_capability` 代理）。可选工具（搜索、MCP、skills、
subagents、docs、web_fetch 等）通过 `use_capability` 调度，不会扩展 top-level
provider schema，因此任何任务都不会制造新的工具 schema 缓存前缀。
provider schema，因此任何任务都不会制造新的工具 schema 缓存前缀。Harness 的
minimal preset 不是任务复杂度模式。
随风险自适应的是宿主策略，不是工具列表：
模型按需决定是否调查、写 todo、调用子 Agent。宿主再根据具体 Tool Call、真实
目标路径和执行回执建立验证义务：
- 对话与咨询类 turn 直接执行，不产生任何辅助模型调用。
- 普通只读查询要求引用实际读取结果（定向证据）。
- 单文件、目标明确、低风险的修改直接执行，使用零额外模型调用的 Atomic
TaskContract 与定向检查。
- 同一功能面内的多文件修改获得轻量规划、项目级检查；条件独立复审在证据覆盖
不足时升级为强制。
- 跨模块、公共接口、持久化、安全/权限/迁移/发布与活跃 Goal 任务获得完整规划、
完整检查、强制独立复审（安全类附加 security review）与完整证据闭环：变更前
建立验收标准，变更后验证、复查并以 `complete_step` 签收；证据不足时只能以
Partial、Unverified 或 Blocked 结束，绝不产生 Complete。
- 风险在 turn 内只升不降：回执发现改动触及高风险面或超出初始判断时，策略实时
上调并补齐缺失的验证与复查。
- 纯只读调用不产生义务。
- 文档、i18n、fixture、样式的局部修改只需 Advisory 定向验证。
- 单个生产文件修改是 Recoverable 定向验证加 diff review。
- 多文件或范围不清的本地写入，先要求 todo 和验收标准。
- Schema、迁移、公共接口、认证路径或破坏性操作，在实际写入后形成 Strict
验证、复查和签收。
- Goal 项和已批准 Plan 的验收项全部为 Strict。
- 用户话里出现 OAuth、token 等词本身不会产生动作风险。
交互式前端中的计划模式始终由用户显式选择：桌面端在“协作方式”中选择计划模式，CLI 用
`Shift+Tab` 切换到 Plan。Reasonix 先生成计划，待用户批准后工作流才切换到实施；规划期间的
@@ -1099,8 +1095,8 @@ provider schema，因此任何任务都不会制造新的工具 schema 缓存前
reasoning-language 写项目级覆盖时，才给 shell 命令加 `--local`。
桌面端“协作方式”菜单里的计划模式与目标模式的使用方法与注意事项，
见 [`COLLABORATION_MODES.zh-CN.md`](./COLLABORATION_MODES.zh-CN.md)。执行模式已移除：
规划、验证与复查强度随任务风险自动调整。
见 [`COLLABORATION_MODES.zh-CN.md`](./COLLABORATION_MODES.zh-CN.md)。没有自动
简单 / 轻量 / 完整任务模式；验证义务由宿主根据真实工具动作建立。
桌面端“工具权限”里的询问、自动和 Yolo 模式的区别与使用场景，
见 [`TOOL_APPROVAL_MODES.zh-CN.md`](./TOOL_APPROVAL_MODES.zh-CN.md)。
docs/SPEC.md
+14 -16
View File
@@ -213,22 +213,20 @@ prefix cache-stable:
- The **planner** (low-frequency) runs in its own session with the same standing
memory context plus a filtered read-only research tool set, then produces a
concise plan. A deterministic host policy chooses executor-only, light
planning, full planning, plan-for-approval, or explicit plan-only from
pristine user text plus trusted turn metadata. It does not call a classifier
model and does not infer host state from controller-authored prompt blocks.
Explicit Plan Mode, synthetic turns, short contextual replies, atomic edits,
and bounded read-only actions avoid a second planner; cross-surface,
structured, ambiguous, and high-risk work uses the full contract. Active Goal
and Delivery turns upgrade non-atomic mutation work, while bounded read-only
actions remain executor-only. The privacy-safe
route/depth/reason decision is emitted in phase detail.
- Light plans use a small per-turn research-round budget and return a compact
objective, 1-4 ordered steps, likely touchpoints, and primary verification.
Full plans use a larger bounded budget and distinguish verified from candidate
touchpoints, with risks, acceptance criteria, command-level verification, and
rollback when relevant. The depth contract stays in one stable system prompt;
only a small host-authored `<planner-turn>` block changes per user turn. If
concise plan. A deterministic host policy defaults to executor-only. It
invokes the dedicated planner only for an explicit plan-first /
plan-then-execute request, an explicit wait-for-approval boundary, an
explicit plan-only request, or an explicit Goal start. It does not call a
classifier model, does not infer complexity from wording, file count, or
keywords, and does not infer host state from controller-authored prompt
blocks. Explicit Plan Mode is an executor-driven workflow and never starts a
second planner. Synthetic turns, short contextual replies, and ordinary
requests stay executor-only. There is no Light/Full planning depth. The
privacy-safe route/reason decision is emitted in phase detail.
- The planner uses one stable system prompt. Only a small host-authored
`<planner-turn>` block names the explicit route. The plan distinguishes
verified from candidate touchpoints and records non-goals, risks, acceptance
criteria, and command-level verification when the evidence supports them. If
the planner still does not finalize after the bounded research and grace
round, plan-and-execute falls back to the executor with the pristine task;
plan-only and plan-for-approval remain fail-closed. The incomplete planner
docs/SPEC.zh-CN.md
+12 -12
View File
@@ -121,18 +121,18 @@ type Tool interface {
当 `agent.planner_model` 与 executor 不同时，planner 与 executor 使用独立 session：
- 宿主使用原始用户文本和可信回合元数据做确定性路由，不调用 classifier 模型，也不从
controller 注入的 prompt block 猜测宿主状态；路由结果为 executor-only、Light、Full、
plan-for-approval 或显式 plan-only，并用不含用户原文的 route/depth/reason 写入阶段详情；
- 显式 Plan Mode、synthetic turn、上下文短回复、明确单点小改和边界清楚的纯只读动作
不再调用第二个 Planner；跨面、结构化、模糊或高风险工作使用 Full；活跃 Goal 与
Delivery 中的非原子修改工作同样升级为 Full，纯只读动作仍直达 Executor；
- Light 使用较小的单轮调研预算，输出紧凑目标、1–4 个有序步骤、候选触点和主要验证；
Full 使用较大的有界预算，区分已验证与候选触点，并补充风险、验收标准、命令级验证及
必要回滚；深度合约保持在同一个稳定 system prompt 中，单轮只追加很小的
`<planner-turn>`；若 Planner 在有界调研和最终总结轮后仍未收敛，普通
plan-and-execute 用原始任务降级到 Executor，plan-only 与 plan-for-approval 仍保持
fail-closed；不完整的 Planner 回合会被回滚，不暴露成无法继续的手动续跑；
- 宿主使用原始用户文本和可信回合元数据做确定性路由，默认 executor-only；不调用
classifier 模型，不从措辞、文件数量或关键词推断复杂度，也不从 controller 注入的
prompt block 猜测宿主状态。独立 Planner 只响应显式先规划 / 规划再执行、显式等待批准、
显式只规划，或显式 Goal 启动；没有 Light/Full 规划深度。阶段详情只记录不含用户原文
的 route/reason；
- 显式 Plan Mode 由 executor 驱动，不会再启动第二个 Planner；synthetic turn、上下文
短回复和普通请求一律直达 Executor；
- Planner 使用同一个稳定 system prompt，单轮只追加很小的 `<planner-turn>` 标明显式
路由。计划应区分已验证与候选触点，并在证据支持时补充非目标、风险、验收标准和
命令级验证；若 Planner 在有界调研和最终总结轮后仍未收敛，普通 plan-and-execute
用原始任务降级到 Executor，plan-only 与 plan-for-approval 仍保持 fail-closed；
不完整的 Planner 回合会被回滚，不暴露成无法继续的手动续跑；
- 普通“先规划”在计划完成后直接交接 Executor；plan-for-approval 只用于明确要求等待
确认的请求，由宿主强制审批边界，批准后交接 Executor；headless 场景会保存计划供后续
回合继续；明确 plan-only 会保存计划并结束当前回合；上述两种执行边界下 Planner 失败
docs/TASK_CONTRACT.md
+12
View File
@@ -59,6 +59,18 @@ after the task is complete.
The Goal-mode task contract rides the provider-visible user turn. It does not
rewrite the cache-stable system prompt, memory prefix, or tool schemas.
Host verification obligations are fact-driven. They come from approved plans,
active goals, the latest todo, project checks, and actual receipts — never from
classifying the prompt as simple, light, or complex. Subsequent related writes
invalidate earlier targeted verification, review, and sign-off; every later
workspace write invalidates project-wide verification. A targeted command does
not satisfy a full-verification obligation unless it is one of the repository's
declared checks and all declared checks have passed. Review evidence must cover
the changed target, match the required review kind, and have a non-blocking
verdict. Sequential writes to a second production target establish the same
todo and acceptance-criteria preconditions as a multi-file write observed in a
single tool call.
## Example
```text
docs/TASK_CONTRACT.zh-CN.md
+2
View File
@@ -45,6 +45,8 @@ Pause policy:
Goal 模式里的任务合约会随 user turn 注入 provider 可见上下文，不会改写 cache-stable system prompt、memory prefix 或 tool schema。
宿主验证义务由事实驱动：来源是批准的 Plan、活跃 Goal、最新 todo、项目检查和真实回执，而不是把提示词分类成简单、轻量或复杂。后续相关写入会使旧的定向验证、复查和签收重新变为未满足；任何后续工作区写入都会使项目级完整验证失效。定向命令不能冒充完整验证，除非它属于仓库声明的检查且所有声明检查均已通过。复查回执必须覆盖实际修改目标、匹配所需复查类型，并且结论不含阻断项。顺序写入第二个生产目标时，会建立与单次多文件写入相同的 todo 和验收标准前置条件。
## 示例
```text
docs/TOOL_APPROVAL_MODES.md
+1 -1
View File
@@ -4,7 +4,7 @@ The Ask / Auto / Yolo control under the desktop composer sets how Reasonix handl
Tool permission is independent of collaboration mode:
- **Collaboration mode** (Normal / Plan / Goal) decides how Reasonix advances the task. Planning, verification, and review strength follow task risk automatically; there is no selectable execution mode.
- **Collaboration mode** (Normal / Plan / Goal) decides how Reasonix advances the task. There is no automatic simple / light / full task mode. Verification obligations come from real tool actions.
- **Tool permission** decides whether controlled tools wait for approval before running.
## Quick comparison
docs/TOOL_APPROVAL_MODES.zh-CN.md
+1 -1
View File
@@ -4,7 +4,7 @@ Reasonix 桌面端输入框下方的“询问 / 自动 / Yolo”控制的是工
工具权限和“协作方式”是两条独立轴：
- **协作方式**（普通 / 计划 / 目标）决定 Reasonix 怎么推进任务。规划、验证与复查强度随任务风险自动调整，没有可切换的执行模式。
- **协作方式**（普通 / 计划 / 目标）决定 Reasonix 怎么推进任务。没有自动简单 / 轻量 / 完整任务模式；验证义务由宿主根据真实工具动作建立。
- **工具权限**决定 Reasonix 调用受控工具时，是否需要你审批。
## 快速对比
docs/TOOL_CONTRACT.md
+2 -2
View File
@@ -113,8 +113,8 @@ without injecting every report into the parent context at once. References are
restricted to the current conversation lineage and workspace.
`use_capability` (`action` = `list` | `inspect` | `call` | `decline`) is on the
provider-visible surface for every task. The adaptive standard execution derives
policy from task risk. Optional tools stay registered for host dispatch but are not
provider-visible surface for every task. Host verification obligations come
from real tool actions, not from preclassifying the prompt. Optional tools stay registered for host dispatch but are not
expanded into the top-level provider schema; the model reaches them through
`use_capability` without cache-breaking schema churn.
docs/TOOL_CONTRACT.zh-CN.md
+8 -8
View File
@@ -43,11 +43,11 @@ go test ./internal/tool -run TestBuiltinToolContractDocumentation
每个会话都使用这套 Executor 工具面，并额外提供稳定代理 `use_capability`
（list/inspect/call/decline），用于在不改变 provider 可见 Schema 的前提下发现和调用按需
MCP（含 `auto_start=false`）。宿主还会按任务风险强制执行合约：闭环任务的变更和
验证命令必须先建立验收标准；变更后的工作必须完成复查、验证并通过带证据的 `complete_step` 签收；
Skill/MCP 的 require/prefer 路由受门禁约束（只读回答同样不能跳过 require 能力）；中/高风险改动
强制结构化 review/security_review，且 `review_report` 的 `reviewed_paths` 必须有宿主观测到的
read/diff 证据。
MCP（含 `auto_start=false`）。宿主根据真实工具动作建立验证义务：后续相关写入会使旧的
验证、复查和签收重新变为未满足；Goal 项和已批准 Plan 的验收项为 Strict；`complete_step`
必须引用最后一次相关写入之后的证据。Skill/MCP 的 require/prefer 路由受门禁约束（只读回答
同样不能跳过 require 能力）；触及认证、Schema 或破坏性路径后，结构化 review 的
`reviewed_paths` 必须有宿主观测到的 read/diff 证据。
## 统一 Boot 工具面
@@ -89,7 +89,7 @@ read/diff 证据。
注入父会话也不会丢失。引用只允许在当前会话 lineage 和工作区内读取。
`use_capability`（`action` = `list` | `inspect` | `call` | `decline`）在 provider
可见工具面上始终存在（自适应标准执行没有可选档位）。可选工具仍在 host
可见工具面上始终存在（没有按任务复杂度切换的工具档位）。可选工具仍在 host
registry 中供调度，但不会展开到 top-level provider schema；模型通过 `use_capability`
调用，避免缓存前缀因 schema 变化而失效。
@@ -105,5 +105,5 @@ registry 中供调度，但不会展开到 top-level provider schema；模型通
可选工具（`glob`、`grep`、`ls`、`web_fetch`、MCP、skills、subagents、docs、会话历史、
记忆写入、workflow 等）仍在 host registry 中可调度；模型通过 `use_capability` 列举、
检查、调用或拒绝它们，且不会改变 provider 工具列表。任务风险改变的是规划 / 验证 /
独立复审策略，而不是 provider 可见工具集合。已退役的 `connect_tool_source` 不再注册。
检查、调用或拒绝它们，且不会改变 provider 工具列表。改变的是宿主根据真实动作建立的
验证义务，而不是 provider 可见工具集合。已退役的 `connect_tool_source` 不再注册。
internal/agent/agent.go
+31 -32
View File
@@ -28,9 +28,10 @@ import (
"reasonix/internal/plancontract"
"reasonix/internal/planmode"
"reasonix/internal/provider"
"reasonix/internal/runtimepolicy"
"reasonix/internal/sandbox"
"reasonix/internal/shellparse"
"reasonix/internal/taskpolicy"
"reasonix/internal/taskcontract"
"reasonix/internal/tool"
"reasonix/internal/workspacelease"
)
@@ -355,15 +356,11 @@ type Agent struct {
// verify against same-turn bash receipts after a write-backed completion.
projectChecks []instruction.VerifyCheck
// closedLoop gates come from the frozen per-turn TaskPolicy (see turn.policy
// and closedLoopActive). Host state only; never enters the provider-cached
// prefix. The scope ID and checkpoint it works against live in task; the
// per-turn expectations live in turn.
// closedLoop gates come from Goal/Plan scope and strict contract
// obligations. Host state only; never enters the provider-cached prefix.
// inheritedPolicy is the writer parent's frozen TaskPolicy. Writer
// sub-agents merge its risk and closure floors into their own policy;
// read-only sub-agents leave it nil.
inheritedPolicy *taskpolicy.TaskPolicy
// inheritedExec is the writer parent's host execution context.
inheritedExec *runtimepolicy.InheritedExecutionContext
// turn is the state of the Run currently executing; beginRunTurn replaces
// it wholesale. See turnruntime.go.
@@ -536,8 +533,6 @@ func (a *Agent) withTurnPreferences(input string) string {
}
}
input = WithReasoningLanguage(input, lang)
// Role settings no longer inject a stable delivery-runtime system-like
// marker. Per-turn <execution-policy> carries the frozen role setting.
return input
}
@@ -949,9 +944,8 @@ type Options struct {
// ProjectChecks are host-observable structured checks extracted during boot.
ProjectChecks []instruction.VerifyCheck
// InheritedTaskPolicy is the writer parent's frozen TaskPolicy. Writer
// sub-agents merge its risk/closure floors; read-only sub-agents ignore it.
InheritedTaskPolicy *taskpolicy.TaskPolicy
// InheritedExecution is the writer parent's host execution context.
InheritedExecution *runtimepolicy.InheritedExecutionContext
// Ablation switches subsystems off for a benchmark arm. The zero value runs
// everything, so ordinary callers leave it unset.
@@ -1101,7 +1095,7 @@ func New(prov provider.Provider, tools *tool.Registry, session *Session, opts Op
readOnlyExecution: opts.ReadOnlyExecution,
plannerMCPExecution: opts.PlannerMCPExecution,
projectChecks: append([]instruction.VerifyCheck(nil), opts.ProjectChecks...),
inheritedPolicy: opts.InheritedTaskPolicy,
inheritedExec: opts.InheritedExecution,
ablation: opts.Ablation,
capabilityLedger: opts.CapabilityLedger,
capabilityAudit: opts.CapabilityAudit,
@@ -1128,15 +1122,21 @@ func (a *Agent) closedLoopActive() bool {
if a == nil {
return false
}
return a.turn.policySet && a.turn.policy.ClosedLoop()
}
// TurnPolicy returns the frozen TaskPolicy for the active turn, if any.
func (a *Agent) TurnPolicy() (taskpolicy.TaskPolicy, bool) {
if a == nil || !a.turn.policySet {
return taskpolicy.TaskPolicy{}, false
if a.turn.deliveryScopeActive {
return true
}
return a.turn.policy, true
if a.planContractSnapshot() != nil {
return true
}
if a.turn.engine == nil {
return false
}
for _, o := range a.turn.engine.Snapshot().Obligations {
if o.Enforcement == taskcontract.EnforcementStrict {
return true
}
}
return false
}
func usageSourceOrDefault(source, fallback string) string {
@@ -1239,11 +1239,12 @@ func (a *Agent) Run(ctx context.Context, input string) (runErr error) {
state.runMaxSteps = runMaxSteps
state.runMaxStepsKey = runMaxStepsKey
state.workDurationMs = workDurationMs
// Publish the frozen policy so writer sub-agents spawned this turn inherit
// its risk and closure floors instead of re-deriving a weaker contract.
if a.turn.policySet {
ctx = taskpolicy.WithContext(ctx, a.turn.policy)
}
ctx = runtimepolicy.WithContext(ctx, a.turn.constraints)
ctx = runtimepolicy.WithInherited(ctx, runtimepolicy.InheritedExecutionContext{
Constraints: a.turn.constraints,
PlanReadOnly: a.planMode.Load() || a.readOnlyExecution,
GoalScopeID: a.task.scopeID,
})
return a.runToolLoop(ctx, state)
}
@@ -1313,13 +1314,11 @@ func (a *Agent) updateDeliveryCheckpoint(runErr error) {
}
cp.CriteriaEstablished = cp.CriteriaEstablished || a.turn.deliveryCriteriaEstablished || a.task.ledger.HasSuccessfulTodoWrite()
cp.WorkObserved = cp.WorkObserved || a.task.ledger.HasSuccessfulWorkReceipt()
persistentOnlyReady := a.turn.deliveryPersistentExpected && !a.turn.deliveryMutationExpected &&
a.task.ledger.HasSuccessfulToolReceipt("remember") && !a.task.ledger.HasSuccessfulMutationOtherThan("remember")
if _, ok := a.task.ledger.LatestSuccessfulMutationIndex(); ok && !persistentOnlyReady {
if _, ok := a.task.ledger.LatestSuccessfulMutationIndex(); ok {
cp.MutationObserved = true
cp.PendingMutation = true
}
if persistentOnlyReady {
if a.task.ledger.HasSuccessfulToolReceipt("remember") && !a.task.ledger.HasSuccessfulMutationOtherThan("remember") {
cp.MutationObserved = true
}
if runErr == nil && cp.PendingMutation && a.deliveryMutationCheckpointReady() {
internal/agent/canonical_todo_test.go
+1 -1
View File
@@ -10,7 +10,7 @@ import (
)
func TestFinalReadinessFallsBackToCanonicalTodos(t *testing.T) {
ran := evidence.Receipt{ToolName: "bash", Success: true, Command: "git push"}
ran := evidence.Receipt{ToolName: "bash", Success: true, Write: true, Mutation: true, Command: "git push"}
open := []evidence.TodoItem{{Content: "push", Status: "completed"}, {Content: "rebase", Status: "pending"}}
// Turn did work (a successful bash) but issued no todo_write this turn, so the
internal/agent/capability_gate.go
+8 -17
View File
@@ -10,7 +10,6 @@ import (
"reasonix/internal/event"
"reasonix/internal/evidence"
"reasonix/internal/skill"
"reasonix/internal/taskpolicy"
"reasonix/internal/tool"
)
@@ -198,14 +197,13 @@ func (a *Agent) capabilityGateFailure() string {
}
// deliveryReviewGateFailure enforces risk-adaptive structured review after the
// latest mutation. The frozen TaskPolicy's Review level and closed-loop flag
// are authoritative.
// latest mutation. Contract review obligations are authoritative.
func (a *Agent) deliveryReviewGateFailure() string {
if a == nil || a.task.ledger == nil {
return ""
}
// Without closed-loop elevation or a forced TaskPolicy review, skip.
if !a.closedLoopActive() && !(a.turn.policySet && a.turn.policy.RequiresIndependentReview()) {
// Without Goal/Plan closed-loop or a contract review obligation, skip.
if !a.closedLoopActive() && !a.requiresIndependentReview() {
return ""
}
if a.subagentDepth > 0 {
@@ -224,18 +222,11 @@ func (a *Agent) deliveryReviewGateFailure() string {
}
a.emitTurnPhase(event.TurnPhaseReviewing)
risk := a.task.ledger.MutationRiskWithin(a.writeWorkspaceRoot)
// TaskPolicy may force higher review than mutation-risk alone.
if a.turn.policySet {
switch a.turn.policy.Review {
case taskpolicy.ReviewForcedSecurity:
risk = evidence.RiskHigh
case taskpolicy.ReviewForced:
if risk < evidence.RiskMedium {
risk = evidence.RiskMedium
}
case taskpolicy.ReviewNone:
return ""
}
// Contract review obligations may raise the review floor.
if a.requiresSecurityReview() {
risk = evidence.RiskHigh
} else if a.requiresIndependentReview() && risk < evidence.RiskMedium {
risk = evidence.RiskMedium
}
paths := productionPaths(a.task.ledger.PathsSince(-1))
hasReviewTool := a.svc.tools != nil && (toolPresent(a.svc.tools, "review") || toolPresent(a.svc.tools, "run_skill") || toolPresent(a.svc.tools, "use_capability"))
internal/agent/capability_gate_test.go
+7 -26
View File
@@ -7,40 +7,21 @@ import (
"testing"
"reasonix/internal/evidence"
"reasonix/internal/taskpolicy"
"reasonix/internal/tool"
)
func closedLoopTurnPolicy(review taskpolicy.Review) taskpolicy.TaskPolicy {
return taskpolicy.TaskPolicy{
Evidence: taskpolicy.EvidenceClosedLoop,
Review: review,
}
}
func withClosedLoopContext(ctx context.Context) context.Context {
if ctx == nil {
ctx = context.Background()
}
return taskpolicy.WithContext(ctx, closedLoopTurnPolicy(taskpolicy.ReviewForced))
}
func noClosedLoopPolicy() taskpolicy.TaskPolicy {
return taskpolicy.TaskPolicy{
// Pin risk at the ceiling so escalatePolicyFromEvidence cannot
// RaiseRisk and reevaluate floors into a closed loop.
Risk: taskpolicy.RiskHigh,
Evidence: taskpolicy.EvidenceNone,
Review: taskpolicy.ReviewNone,
Verification: taskpolicy.VerifyNone,
}
return WithDeliveryExecutionScope(ctx, DeliveryExecutionScope{ID: "test-closed-loop", TaskText: "closed-loop test"})
}
func withNoClosedLoop(ctx context.Context) context.Context {
if ctx == nil {
ctx = context.Background()
return context.Background()
}
return taskpolicy.WithContext(ctx, noClosedLoopPolicy())
return ctx
}
func TestClosedLoopReviewGateExplainsOpaqueMutationRecovery(t *testing.T) {
@@ -58,7 +39,7 @@ func TestClosedLoopReviewGateExplainsOpaqueMutationRecovery(t *testing.T) {
a := &Agent{
task: taskRuntime{ledger: ledger},
svc: agentServices{tools: reg},
turn: turnRuntime{policySet: true, policy: closedLoopTurnPolicy(taskpolicy.ReviewForcedSecurity)},
turn: turnRuntime{deliveryScopeActive: true},
}
got := a.deliveryReviewGateFailure()
@@ -117,7 +98,7 @@ func TestClosedLoopReviewGateHighRiskStillRequiresSecurityReview(t *testing.T) {
a := &Agent{
task: taskRuntime{ledger: ledger},
svc: agentServices{tools: reg},
turn: turnRuntime{policySet: true, policy: closedLoopTurnPolicy(taskpolicy.ReviewForcedSecurity)},
turn: turnRuntime{deliveryScopeActive: true},
}
if got := a.deliveryReviewGateFailure(); !strings.Contains(got, "high-risk") {
@@ -160,7 +141,7 @@ func TestClosedLoopReviewGateMediumAcceptsHostProvenVerificationAndCoverage(t *t
a := &Agent{
task: taskRuntime{ledger: ledger},
svc: agentServices{tools: reg},
turn: turnRuntime{policySet: true, policy: closedLoopTurnPolicy(taskpolicy.ReviewForced)},
turn: turnRuntime{deliveryScopeActive: true},
}
if got := a.deliveryReviewGateFailure(); got != "" {
t.Fatalf("medium-risk host proof was rejected: %q", got)
@@ -186,7 +167,7 @@ func TestClosedLoopReviewGateDefersToParentInSubagents(t *testing.T) {
agentConfig: agentConfig{subagentDepth: 1},
task: taskRuntime{ledger: ledger},
svc: agentServices{tools: reg},
turn: turnRuntime{policySet: true, policy: closedLoopTurnPolicy(taskpolicy.ReviewForcedSecurity)},
turn: turnRuntime{deliveryScopeActive: true},
}
// Inside a sub-agent the structured-review contract belongs to the parent,
internal/agent/contract_shadow.go
+52 -95
View File
@@ -1,8 +1,6 @@
package agent
import (
"encoding/json"
"fmt"
"strings"
"reasonix/internal/completion"
@@ -11,7 +9,6 @@ import (
"reasonix/internal/instruction"
"reasonix/internal/plancontract"
"reasonix/internal/taskcontract"
"reasonix/internal/taskintent"
)
// buildShadowContract replays a finished turn's receipts into a task
@@ -20,91 +17,48 @@ import (
// are what the work agreed to, and todo titles are only a restatement of the
// steps. Without a plan the todo list stands in, as it always did.
func buildShadowContract(input string, receipts []evidence.Receipt, plan *plancontract.Plan, projectChecks ...instruction.VerifyCheck) *taskcontract.Contract {
var c *taskcontract.Contract
switch {
case plan != nil:
c = taskcontract.FromPlan(input, planFacts(*plan))
case taskintent.Classify(input) == taskintent.Mutation,
taskintent.Classify(input) == taskintent.PersistentAction:
c = taskcontract.Atomic(input)
default:
c = taskcontract.New(input)
}
return buildShadowContractWithPolicy(input, receipts, plan, false, false, false, "", projectChecks...)
}
func buildShadowContractWithPolicy(
input string,
receipts []evidence.Receipt,
plan *plancontract.Plan,
goalActive bool,
testsForbidden bool,
requireFullVerification bool,
workspaceRoot string,
projectChecks ...instruction.VerifyCheck,
) *taskcontract.Contract {
_ = input
var todos []evidence.TodoItem
for _, r := range receipts {
if len(r.Todos) > 0 {
todos = r.Todos
}
}
// Todo titles restate the plan's steps, so they only become requirements
// when no plan supplied the real acceptance criteria.
if plan == nil {
for i, todo := range todos {
c.AddRequirement(fmt.Sprintf("t%d", i+1), todo.Content, true)
}
}
var checks []string
for _, check := range projectChecks {
if command := strings.TrimSpace(check.Command); command != "" {
c.AddCheck(command)
checks = append(checks, command)
}
}
for _, r := range receipts {
c.Observe(r)
resolveCitedCriteria(c, r)
}
for i, todo := range todos {
if todo.Status == "completed" {
c.Resolve(fmt.Sprintf("t%d", i+1), taskcontract.Satisfied)
}
}
return c
}
// resolveCitedCriteria satisfies the criteria a successful complete_step named.
// The tool verified each proof against the ledger before succeeding, so what the
// citation adds is the binding: "the command ran" and "the criterion holds" are
// different claims, and only the model knows which proof was for which.
func resolveCitedCriteria(c *taskcontract.Contract, r evidence.Receipt) {
if r.ToolName != "complete_step" || !r.Success || len(r.Args) == 0 {
return
}
var payload struct {
Evidence []struct {
Kind string `json:"kind"`
CriterionID string `json:"criterion_id"`
} `json:"evidence"`
}
if json.Unmarshal(r.Args, &payload) != nil {
return
}
for _, e := range payload.Evidence {
id := strings.TrimSpace(e.CriterionID)
if id == "" {
continue
}
c.Resolve(id, taskcontract.Satisfied, taskcontract.EvidenceRef{
Kind: criterionEvidenceKind(e.Kind),
MutationEpoch: c.Epoch(),
Source: "complete_step",
Success: true,
})
}
}
// criterionEvidenceKind mirrors the ledger's own classification so staleness
// behaves identically: a mutation proves it happened and never stales, while a
// verification, review, or manual check must be re-proven after later changes.
func criterionEvidenceKind(kind string) taskcontract.EvidenceKind {
switch kind {
case "verification":
return taskcontract.EvidenceVerification
case "review":
return taskcontract.EvidenceReview
case "diff", "files":
return taskcontract.EvidenceMutation
default:
return taskcontract.EvidenceRead
var planPtr *taskcontract.PlanFacts
if plan != nil {
facts := planFacts(*plan)
planPtr = &facts
}
return taskcontract.Rebuild(taskcontract.RebuildFacts{
Plan: planPtr,
Todos: todos,
ProjectChecks: checks,
Receipts: receipts,
TestsForbidden: testsForbidden,
RequireFullVerification: requireFullVerification,
WorkspaceRoot: workspaceRoot,
HasApprovedPlan: plan != nil,
HasActiveGoal: goalActive,
})
}
func contractShadowAudit(c *taskcontract.Contract) event.ContractShadowAudit {
@@ -121,7 +75,7 @@ func contractShadowAudit(c *taskcontract.Contract) event.ContractShadowAudit {
}
}
return event.ContractShadowAudit{
Intent: intentName(c.Intent),
Intent: "",
Requirements: len(c.Requirements),
RequirementsSatisfied: reqDone,
Checks: len(c.Checks),
@@ -133,21 +87,6 @@ func contractShadowAudit(c *taskcontract.Contract) event.ContractShadowAudit {
}
}
func intentName(i taskintent.Intent) string {
switch i {
case taskintent.Advisory:
return "advisory"
case taskintent.ObservableRead:
return "observable_read"
case taskintent.Mutation:
return "mutation"
case taskintent.PersistentAction:
return "persistent_action"
default:
return "conversation"
}
}
// LiveContract is the contract as it stands right now: the same pure replay the
// turn ends with, run against the receipts recorded so far. Rebuilding beats
// keeping incremental state because one code path serves the per-round view and
@@ -156,7 +95,16 @@ func (a *Agent) LiveContract() *taskcontract.Contract {
if a == nil || a.task.ledger == nil {
return nil
}
return buildShadowContract(a.turn.turnInput, a.task.ledger.Receipts(), a.planContractSnapshot(), a.projectChecks...)
return buildShadowContractWithPolicy(
a.turn.turnInput,
a.task.ledger.Receipts(),
a.planContractSnapshot(),
a.turn.deliveryScopeActive,
a.turn.constraints.ForbidTests,
a.turn.constraints.RequireFullVerification,
a.writeWorkspaceRoot,
a.projectChecks...,
)
}
// observeContractRound records the contract after one tool round, so a
@@ -177,7 +125,16 @@ func (a *Agent) emitTurnShadows(input string) {
if a.task.ledger == nil {
return
}
c := buildShadowContract(input, a.task.ledger.Receipts(), a.planContractSnapshot(), a.projectChecks...)
c := buildShadowContractWithPolicy(
input,
a.task.ledger.Receipts(),
a.planContractSnapshot(),
a.turn.deliveryScopeActive,
a.turn.constraints.ForbidTests,
a.turn.constraints.RequireFullVerification,
a.writeWorkspaceRoot,
a.projectChecks...,
)
// Prefer the live contract when present so Suppressed/Partial state is not
// lost in the pure replay path.
if live := a.LiveContract(); live != nil && (live.HasSuppressed() || len(live.Requirements) > 0 || len(live.Checks) > 0) {
internal/agent/contract_shadow_test.go
+4 -8
View File
@@ -25,12 +25,8 @@ func TestBuildShadowContractReplaysTheTurn(t *testing.T) {
c := buildShadowContract("fix the add bug in calc.py", receipts, nil)
audit := contractShadowAudit(c)
if audit.Intent != "mutation" {
t.Fatalf("intent = %q", audit.Intent)
}
// Atomic r1 + two todo requirements.
if audit.Requirements != 3 || audit.RequirementsSatisfied != 3 {
t.Fatalf("requirements = %d/%d, want 3/3", audit.RequirementsSatisfied, audit.Requirements)
if audit.Requirements != 2 || audit.RequirementsSatisfied != 2 {
t.Fatalf("requirements = %d/%d, want 2/2 from todos", audit.RequirementsSatisfied, audit.Requirements)
}
if audit.Epoch != 1 {
t.Fatalf("epoch = %d, want 1 (one mutation)", audit.Epoch)
@@ -61,7 +57,7 @@ func TestBuildShadowContractIncludesProjectChecksInCompletionEvidence(t *testing
missing := buildShadowContract("fix the parser", []evidence.Receipt{
{ToolName: "edit_file", Mutation: true, Write: true, Success: true, Paths: []string{"parser.go"}},
}, nil, check)
if len(missing.Checks) != 2 || missing.Checks[1].Status != taskcontract.Pending {
if len(missing.Checks) == 0 || missing.Checks[len(missing.Checks)-1].Status != taskcontract.Pending {
t.Fatalf("missing project-check contract = %+v, want pending project check", missing.Checks)
}
@@ -69,7 +65,7 @@ func TestBuildShadowContractIncludesProjectChecksInCompletionEvidence(t *testing
{ToolName: "edit_file", Mutation: true, Write: true, Success: true, Paths: []string{"parser.go"}},
{ToolName: "bash", Command: "go test ./...", Success: true},
}, nil, check)
if passed.Checks[1].Status != taskcontract.Satisfied {
if passed.Checks[len(passed.Checks)-1].Status != taskcontract.Satisfied {
t.Fatalf("passed project-check contract = %+v, want satisfied project check", passed.Checks)
}
}
internal/agent/coordinator.go
+9 -15
View File
@@ -46,12 +46,11 @@ implies. Record read paths as verified_files and inferred ones as
candidate_files; never present an unread path as verified. Set requires_approval
when execution should stop for the user; the host owns the final decision.
A host-authored <planner-turn> block at the end of the user turn selects the
planning depth. For depth=light, submit a compact objective with 1-4 steps,
likely touchpoints, and the main verification. For depth=full, inspect enough
evidence to separate verified touchpoints from candidates, then also fill
non-goals, per-step risks, acceptance criteria, and command-level verification.
Label anything unproven in assumptions rather than stating it as fact.
A host-authored <planner-turn> block at the end of the user turn names the
explicit planner route. Inspect enough evidence to separate verified
touchpoints from candidates, then fill non-goals, per-step risks, acceptance
criteria, and command-level verification. Label anything unproven in
assumptions rather than stating it as fact.
If execution needs a user-owned decision or a missing user-provided value
before it can be safe, call ask and let the answer shape the plan; never ask in
@@ -137,7 +136,7 @@ func NewCoordinator(planner provider.Provider, plannerSession *Session, plannerP
if !shouldPlan(ctx, input) {
return PlannerDecision{Route: PlannerRouteExecutorOnly, Reason: "legacy_skip"}
}
return PlannerDecision{Route: PlannerRoutePlanAndExecute, Depth: PlannerDepthFull, Reason: "legacy_plan"}
return PlannerDecision{Route: PlannerRoutePlanAndExecute, Reason: "legacy_plan"}
}
}
return newCoordinator(planner, plannerSession, plannerPricing, plannerTools, plannerOptions, executor, temperature, sink, policy)
@@ -327,13 +326,12 @@ func (c *Coordinator) Run(ctx context.Context, input string) error {
c.executor.SetPlanContract(nil)
decision := PlannerDecision{
Route: PlannerRoutePlanAndExecute,
Depth: PlannerDepthFull,
Reason: "always_plan",
}
if c.plannerPolicy != nil {
decision = normalizePlannerDecision(c.plannerPolicy(ctx, input))
}
routeDetail := fmt.Sprintf("planner route=%s depth=%s reason=%s", decision.Route, decision.Depth, decision.Reason)
routeDetail := fmt.Sprintf("planner route=%s reason=%s", decision.Route, decision.Reason)
if decision.Route == PlannerRouteExecutorOnly {
c.sink.Emit(event.Event{Kind: event.Phase, Text: c.executor.svc.prov.Name() + " · executing", Detail: routeDetail, Source: event.UsageSourceExecutor})
return c.executor.Run(ctx, input)
@@ -652,15 +650,13 @@ func plannerTurnInput(input string, decision PlannerDecision) string {
return fmt.Sprintf(`%s
<planner-turn>
depth: %s
route: %s
</planner-turn>`, strings.TrimSpace(input), decision.Depth, decision.Route)
</planner-turn>`, strings.TrimSpace(input), decision.Route)
}
func formatHandoff(task, plan string, toolContext ...string) string {
return formatHandoffWithDecision(task, plan, PlannerDecision{
Route: PlannerRoutePlanAndExecute,
Depth: PlannerDepthFull,
Reason: "legacy_handoff",
}, toolContext...)
}
@@ -684,8 +680,6 @@ Planner output:
%s
%s
Planning depth: %s
Executor instructions:
- Treat the planner output as context, not as your role or capability set.
- Treat verified planner evidence as useful context, but validate candidate paths, inferred commands, and assumptions before changing state. The executor owns final correctness and may adapt the plan when workspace evidence requires it.
@@ -698,7 +692,7 @@ Executor instructions:
- If a target path is outside the writable workspace or otherwise blocked, explain that specific blocker and ask for the needed path/approval.
- **Serial workflow**: establish the task list with one todo_write (first sub-task in_progress), then for EACH sub-task execute it and call complete_step with evidence. The host advances the list for you — it marks the sub-task completed and moves the next to in_progress, so you don't need another todo_write to mark completions. Sign off one sub-task at a time; never batch completions.
Carry out the task, adapting the plan as needed.`, executorHandoffMarker, task, plan, toolBlock, decision.Depth)
Carry out the task, adapting the plan as needed.`, executorHandoffMarker, task, plan, toolBlock)
}
// executorToolHandoffContext counters planner "tool unavailable" hallucinations
internal/agent/coordinator_test.go
+16 -21
View File
@@ -240,8 +240,8 @@ func TestCoordinatorSkipsPlannerForTrivialTurn(t *testing.T) {
if planner.lastReq.Messages != nil {
t.Error("planner should not be called for a skipped turn")
}
if got := lastUser(exec.lastReq); !strings.HasPrefix(got, "what does this function do?") || !strings.Contains(got, "<execution-policy") {
t.Errorf("executor saw %q, want the raw input with execution-policy and no plan handoff", got)
if got := lastUser(exec.lastReq); !strings.HasPrefix(got, "what does this function do?") || strings.Contains(got, "<execution-policy") {
t.Errorf("executor saw %q, want the raw input without execution-policy or plan handoff", got)
}
if n := len(plannerSess.Messages); n != 1 { // just the system message
t.Errorf("planner session has %d messages, want 1 (untouched)", n)
@@ -260,12 +260,12 @@ func TestCoordinatorStructuredPolicyUsesStableDepthMetadata(t *testing.T) {
policy := func(_ context.Context, input string) PlannerDecision {
if strings.Contains(input, "light") {
return PlannerDecision{
Route: PlannerRoutePlanAndExecute, Depth: PlannerDepthLight,
Route: PlannerRoutePlanAndExecute,
Reason: "test_light",
}
}
return PlannerDecision{
Route: PlannerRoutePlanAndExecute, Depth: PlannerDepthFull,
Route: PlannerRoutePlanAndExecute,
Reason: "test_full",
}
}
@@ -282,10 +282,10 @@ func TestCoordinatorStructuredPolicyUsesStableDepthMetadata(t *testing.T) {
t.Fatalf("full Run: %v", err)
}
if got := lastUser(planner.requests[0]); !strings.Contains(got, "depth: light") || !strings.Contains(got, "route: plan_and_execute") {
if got := lastUser(planner.requests[0]); !strings.Contains(got, "route: plan_and_execute") {
t.Fatalf("light planner input missing route metadata: %q", got)
}
if got := lastUser(planner.requests[1]); !strings.Contains(got, "depth: full") || !strings.Contains(got, "route: plan_and_execute") {
if got := lastUser(planner.requests[1]); !strings.Contains(got, "route: plan_and_execute") {
t.Fatalf("full planner input missing route metadata: %q", got)
}
for i, req := range planner.requests {
@@ -302,11 +302,8 @@ func TestCoordinatorStructuredPolicyUsesStableDepthMetadata(t *testing.T) {
if len(handoffs) != 2 {
t.Fatalf("executor handoffs = %d, want one light and one full handoff", len(handoffs))
}
if !strings.Contains(handoffs[0], "Planning depth: light") {
t.Fatalf("light handoff missing depth: %q", handoffs[0])
}
if !strings.Contains(handoffs[1], "Planning depth: full") {
t.Fatalf("full handoff missing depth: %q", handoffs[1])
if strings.Contains(handoffs[0], "Planning depth:") || strings.Contains(handoffs[1], "Planning depth:") {
t.Fatalf("handoff still mentions planning depth: %q %q", handoffs[0], handoffs[1])
}
}
@@ -321,7 +318,7 @@ func TestCoordinatorPlanForApprovalDoesNotDependOnPlannerMarker(t *testing.T) {
}}
policy := func(context.Context, string) PlannerDecision {
return PlannerDecision{
Route: PlannerRoutePlanForApproval, Depth: PlannerDepthFull,
Route: PlannerRoutePlanForApproval,
Reason: "user_plan_for_approval",
}
}
@@ -354,7 +351,7 @@ func TestCoordinatorPlanForApprovalHandsOffAfterApproval(t *testing.T) {
{Type: provider.ChunkDone},
}}
policy := func(context.Context, string) PlannerDecision {
return PlannerDecision{Route: PlannerRoutePlanForApproval, Depth: PlannerDepthFull, Reason: "user_plan_for_approval"}
return PlannerDecision{Route: PlannerRoutePlanForApproval, Reason: "user_plan_for_approval"}
}
executor := New(exec, tool.NewRegistry(), NewSession("exec-sys"), Options{}, event.Discard)
coord := NewCoordinatorWithPlannerPolicy(
@@ -390,7 +387,7 @@ func TestCoordinatorHeadlessPlanForApprovalPersistsForContinuation(t *testing.T)
{Type: provider.ChunkDone},
}}
policy := func(context.Context, string) PlannerDecision {
return PlannerDecision{Route: PlannerRoutePlanForApproval, Depth: PlannerDepthFull, Reason: "user_plan_for_approval"}
return PlannerDecision{Route: PlannerRoutePlanForApproval, Reason: "user_plan_for_approval"}
}
sink := &recordSink{}
executor := New(exec, tool.NewRegistry(), NewSession("exec-sys"), Options{}, sink)
@@ -421,7 +418,7 @@ func TestCoordinatorPlanOnlyDoesNotRunExecutor(t *testing.T) {
{Type: provider.ChunkDone},
}}
policy := func(context.Context, string) PlannerDecision {
return PlannerDecision{Route: PlannerRoutePlanOnly, Depth: PlannerDepthFull, Reason: "user_plan_only"}
return PlannerDecision{Route: PlannerRoutePlanOnly, Reason: "user_plan_only"}
}
sink := &recordSink{}
executor := New(exec, tool.NewRegistry(), NewSession("exec-sys"), Options{}, sink)
@@ -458,9 +455,9 @@ func TestCoordinatorPlanOnlyContinuesWithExecutorOnNextTurn(t *testing.T) {
}}
policy := func(_ context.Context, input string) PlannerDecision {
if strings.Contains(input, "只规划") {
return PlannerDecision{Route: PlannerRoutePlanOnly, Depth: PlannerDepthFull, Reason: "user_plan_only"}
return PlannerDecision{Route: PlannerRoutePlanOnly, Reason: "user_plan_only"}
}
return PlannerDecision{Route: PlannerRouteExecutorOnly, Depth: PlannerDepthNone, Reason: "short_reply"}
return PlannerDecision{Route: PlannerRouteExecutorOnly, Reason: "short_reply"}
}
executor := New(exec, tool.NewRegistry(), NewSession("exec-sys"), Options{}, event.Discard)
coord := NewCoordinatorWithPlannerPolicy(
@@ -532,7 +529,7 @@ func TestCoordinatorPlannerFailurePreservesExecutionBoundary(t *testing.T) {
{Type: provider.ChunkDone},
}}
policy := func(context.Context, string) PlannerDecision {
return PlannerDecision{Route: tc.route, Depth: PlannerDepthFull, Reason: tc.reason}
return PlannerDecision{Route: tc.route, Reason: tc.reason}
}
executor := New(exec, tool.NewRegistry(), NewSession("exec-sys"), Options{}, event.Discard)
coord := NewCoordinatorWithPlannerPolicy(
@@ -1205,8 +1202,6 @@ func TestDefaultPlannerPromptRequestsNoChangesMarker(t *testing.T) {
func TestDefaultPlannerPromptDefinesLightAndFullEvidenceContracts(t *testing.T) {
for _, want := range []string{
"depth=light",
"depth=full",
"submit_plan",
"command-level verification",
"assumptions",
@@ -1410,7 +1405,7 @@ func TestCoordinatorPlannerSafetyBoundaryPreservesExecutionBoundaries(t *testing
plannerReg := tool.NewRegistry()
plannerReg.Add(coordinatorTestTool{name: "read_file", readOnly: true, output: "package main"})
policy := func(context.Context, string) PlannerDecision {
return PlannerDecision{Route: route, Depth: PlannerDepthFull, Reason: "explicit_boundary"}
return PlannerDecision{Route: route, Reason: "explicit_boundary"}
}
executor := New(exec, tool.NewRegistry(), NewSession("exec-sys"), Options{}, event.Discard)
internal/agent/delegation_admission.go
+4 -24
View File
@@ -1,11 +1,8 @@
package agent
import (
"strings"
"reasonix/internal/event"
"reasonix/internal/provider"
"reasonix/internal/taskintent"
)
// admissionGatedDelegations are the delegation tools expensive enough to need
@@ -20,29 +17,12 @@ var admissionGatedDelegations = map[string]bool{
"fleet": true,
}
// researchRequestMarkers is the V1 shadow heuristic for "the user explicitly
// asked for external research"; deliberately narrow — a miss records a deny
// verdict, it never blocks the call.
var researchRequestMarkers = []string{"research", "调研", "查资料", "查文档", "search the web", "look up online"}
// delegationAdmission is the shadow verdict for one gated delegation call:
// local mutation-shaped turns get no expensive external research unless the
// user asked for it or the call cites an external source. Pure function.
func delegationAdmission(input, args string) (verdict, reason string, intent taskintent.Intent) {
intent = taskintent.Classify(input)
if intent != taskintent.Mutation && intent != taskintent.PersistentAction {
return "allow", "non_local_intent", intent
}
lower := strings.ToLower(input)
for _, marker := range researchRequestMarkers {
if strings.Contains(lower, marker) {
return "allow", "user_requested", intent
}
}
if strings.Contains(args, "http://") || strings.Contains(args, "https://") {
return "allow", "external_source_cited", intent
}
return "deny", "local_fix_no_external_need", intent
func delegationAdmission(input, args string) (verdict, reason, intent string) {
_, _ = input, args
return "allow", "model_decides", ""
}
// observeDelegationAdmission records a shadow admission verdict for every
@@ -56,7 +36,7 @@ func (a *Agent) observeDelegationAdmission(calls []provider.ToolCall) {
}
verdict, reason, intent := delegationAdmission(a.turn.recoveryTaskSummary, call.Arguments)
event.RecordDelegationAdmission(a.svc.sink, event.DelegationAdmissionAudit{
Tool: call.Name, Verdict: verdict, Reason: reason, Intent: intentName(intent),
Tool: call.Name, Verdict: verdict, Reason: reason, Intent: intent,
})
}
}
internal/agent/delegation_admission_test.go
+6 -6
View File
@@ -12,13 +12,13 @@ func TestDelegationAdmissionVerdicts(t *testing.T) {
name, input, args, verdict, reason string
}{
{"local fix, plain query", "fix the config serializer bug in parser.go",
`{"prompt":"how does the serializer format keys"}`, "deny", "local_fix_no_external_need"},
`{"prompt":"how does the serializer format keys"}`, "allow", "model_decides"},
{"user asked for research", "research the best TOML library and fix the loader",
`{"prompt":"compare toml libraries"}`, "allow", "user_requested"},
`{"prompt":"compare toml libraries"}`, "allow", "model_decides"},
{"external source cited", "fix the retry logic to match the upstream spec",
`{"prompt":"read https://example.com/spec and summarize backoff rules"}`, "allow", "external_source_cited"},
`{"prompt":"read https://example.com/spec and summarize backoff rules"}`, "allow", "model_decides"},
{"advisory turn", "how does our retry budget compare to industry practice?",
`{"prompt":"survey retry budget conventions"}`, "allow", "non_local_intent"},
`{"prompt":"survey retry budget conventions"}`, "allow", "model_decides"},
}
for _, c := range cases {
verdict, reason, _ := delegationAdmission(c.input, c.args)
@@ -56,8 +56,8 @@ func TestObserveDelegationAdmissionRecordsOnlyGatedTools(t *testing.T) {
if got.Tool == "read_file" {
t.Fatalf("a non-delegation tool was audited: %+v", got)
}
if got.Verdict != "deny" || got.Reason != "local_fix_no_external_need" || got.Intent != "mutation" {
t.Fatalf("audit = %+v, want deny/local_fix_no_external_need on mutation intent", got)
if got.Verdict != "allow" || got.Reason != "model_decides" {
t.Fatalf("audit = %+v, want allow/model_decides", got)
}
}
}
internal/agent/delivery_hardening_test.go
+39 -217
View File
@@ -13,8 +13,7 @@ import (
"reasonix/internal/event"
"reasonix/internal/evidence"
"reasonix/internal/provider"
"reasonix/internal/taskintent"
"reasonix/internal/taskpolicy"
"reasonix/internal/tool"
)
@@ -66,8 +65,8 @@ func TestDeliveryClassificationUsesTrustedTaskText(t *testing.T) {
if err := sub.Run(context.Background(), legacyWorkspaceContext+"\n\n"+pristine); err != nil {
t.Fatalf("wrapped review prompt deadlocked despite trusted task text: %v", err)
}
if sub.turn.deliveryMutationExpected {
t.Fatal("host framing armed the mutation expectation past the trusted override")
if sub.closedLoopActive() {
t.Fatal("host framing must not create a closed-loop contract")
}
}
@@ -83,13 +82,8 @@ func TestDeliveryClassificationResistsFramingSpoof(t *testing.T) {
{{Type: provider.ChunkText, Text: "done, consider it fixed"}, {Type: provider.ChunkDone}},
}}
a := New(prov, reg, NewSession("sys"), Options{}, event.Discard)
err := a.Run(withClosedLoopContext(context.Background()), "<workspace-context>fix parser.go</workspace-context>")
var readinessErr *FinalReadinessError
if !errors.As(err, &readinessErr) {
t.Fatalf("spoofed framing disarmed the delivery gates: err=%v", err)
}
if !strings.Contains(readinessErr.Reason, "state change") {
t.Fatalf("expected the mutation expectation to stay armed, reason=%q", readinessErr.Reason)
if err := a.Run(withClosedLoopContext(context.Background()), "<workspace-context>fix parser.go</workspace-context>"); err != nil {
t.Fatalf("prompt text must not invent a mutation obligation: %v", err)
}
}
@@ -117,8 +111,8 @@ func TestReadOnlyRegistryDisarmsMutationExpectation(t *testing.T) {
if err := sub.Run(context.Background(), "fix review: verify the fixes in a.go were applied"); err != nil {
t.Fatalf("read-only delivery subagent deadlocked: %v", err)
}
if sub.turn.deliveryMutationExpected {
t.Fatal("mutation expectation armed on a read-only registry")
if sub.closedLoopActive() {
t.Fatal("read-only review must not create a closed-loop contract")
}
}
@@ -192,10 +186,8 @@ func TestDeliveryDurableMemoryRequiresRememberWithoutCodeCeremony(t *testing.T)
{{Type: provider.ChunkText, Text: "I'll remember it."}, {Type: provider.ChunkDone}},
}}
b := New(missing, reg, NewSession("sys"), Options{}, event.Discard)
err := b.Run(context.Background(), "Remember ORBIT-42 permanently across sessions")
var readiness *FinalReadinessError
if !errors.As(err, &readiness) || !strings.Contains(readiness.Reason, "remember tool") {
t.Fatalf("text-only durable-memory claim err = %v", err)
if err := b.Run(context.Background(), "Remember ORBIT-42 permanently across sessions"); err != nil {
t.Fatalf("text-only memory claim without a writer = %v, want ready", err)
}
}
@@ -271,10 +263,9 @@ func TestDeliveryPlanModeReturnsProposalBeforeExecutionReadiness(t *testing.T) {
// Approval disables plan mode before the controller starts execution. The
// same delivery expectations must become enforceable again at that boundary.
a.SetPlanMode(false)
a.turn.policy = closedLoopTurnPolicy(taskpolicy.ReviewForced)
a.turn.policySet = true
if got := a.ReadinessResult(); !strings.Contains(got.Reason, "state change") {
t.Fatalf("execution readiness did not resume after plan mode: %q", got.Reason)
a.turn.deliveryScopeActive = true
if got := a.ReadinessResult(); got.Ready && got.Reason != "" {
t.Fatalf("execution readiness after plan mode: %+v", got)
}
}
@@ -285,8 +276,7 @@ func TestPlanModeDefersCapabilityRequirementsUntilExecution(t *testing.T) {
reg := tool.NewRegistry()
a := New(&scriptedProvider{name: "p"}, reg, NewSession("sys"),
Options{CapabilityLedger: capability.NewLedger()}, event.Discard)
a.turn.policySet = true
a.turn.policy = closedLoopTurnPolicy(taskpolicy.ReviewForced)
a.turn.deliveryScopeActive = true
a.SetPlanMode(true)
a.SeedCapabilityRoute(capability.RouteDecision{Candidates: []capability.RouteCandidate{
{Entry: capability.Entry{ID: "skill:deploy"}, Policy: capability.AutoUseRequire},
@@ -390,9 +380,8 @@ func TestRunSubAgentSalvagesReadinessExhaustedWork(t *testing.T) {
}
func TestRunSubAgentReadinessFailureWithoutMutationStillFails(t *testing.T) {
// An unbacked "done" claim keeps failing: with a mutation expected and no
// successful mutation receipt, salvage must not launder the claim into an
// unverified answer.
// Prompt text does not invent a mutation. A text-only answer with no
// writer receipt is Ready; salvage must not invent unverified work.
reg := tool.NewRegistry()
reg.Add(fakeReadFileTool{})
reg.Add(fakeWriterTool{})
@@ -401,12 +390,11 @@ func TestRunSubAgentReadinessFailureWithoutMutationStillFails(t *testing.T) {
sess := NewSession("sys")
answer, err := RunSubAgentWithSession(withClosedLoopContext(context.Background()), prov, reg, sess,
"fix the crash in a.go", Options{SubagentDepth: 1}, event.Discard)
var readinessErr *FinalReadinessError
if !errors.As(err, &readinessErr) {
t.Fatalf("expected wrapped FinalReadinessError, got %v", err)
if err != nil {
t.Fatalf("text-only answer without a writer must succeed, got %v", err)
}
if answer != "" {
t.Fatalf("mutation-less readiness failure must not salvage, got %q", answer)
if strings.Contains(answer, "[unverified]") {
t.Fatalf("mutation-less run must not salvage, got %q", answer)
}
}
@@ -426,7 +414,10 @@ func TestFinalReadinessFailsImmediatelyWithoutRetries(t *testing.T) {
return []provider.Chunk{toolCallChunk(id, "read_file", `{"path":"a.go"}`), {Type: provider.ChunkDone}}
}
stalled := &scriptedProvider{name: "p", turns: [][]provider.Chunk{finalText}}
stalled := &scriptedProvider{name: "p", turns: [][]provider.Chunk{
{toolCallChunk("w", "fake_write", `{"path":"a.go","content":"package a"}`), {Type: provider.ChunkDone}},
finalText,
}}
a := New(stalled, newReg(), NewSession("sys"), Options{}, event.Discard)
err := a.Run(withClosedLoopContext(context.Background()), "fix the crash in a.go")
var readinessErr *FinalReadinessError
@@ -436,8 +427,8 @@ func TestFinalReadinessFailsImmediatelyWithoutRetries(t *testing.T) {
if readinessErr.Attempts != 1 {
t.Fatalf("attempts = %d, want 1 (no readiness retries)", readinessErr.Attempts)
}
if stalled.call != 1 {
t.Fatalf("provider calls = %d, want 1 (no hidden retry messages)", stalled.call)
if stalled.call != 2 {
t.Fatalf("provider calls = %d, want write + one final (no hidden retry messages)", stalled.call)
}
if !a.pending.finalReadinessRecovery {
t.Fatal("delivery recovery must be pending for an explicit continuation")
@@ -445,6 +436,7 @@ func TestFinalReadinessFailsImmediatelyWithoutRetries(t *testing.T) {
// A read that changed nothing still ends the run at the first final answer.
converging := &scriptedProvider{name: "p", turns: [][]provider.Chunk{
{toolCallChunk("w", "fake_write", `{"path":"a.go","content":"package a"}`), {Type: provider.ChunkDone}},
readCall("1"), finalText,
readCall("2"), finalText,
}}
@@ -454,8 +446,8 @@ func TestFinalReadinessFailsImmediatelyWithoutRetries(t *testing.T) {
if !errors.As(err2, &readinessErr2) {
t.Fatalf("expected FinalReadinessError, got %v", err2)
}
if converging.call != 2 {
t.Fatalf("provider calls = %d, want 2 (work turn + one final answer)", converging.call)
if converging.call != 3 {
t.Fatalf("provider calls = %d, want write + read + one final answer", converging.call)
}
}
@@ -511,9 +503,8 @@ func TestOrdinaryFollowUpDoesNotPreserveFailedDeliveryEvidence(t *testing.T) {
t.Fatal("first failed delivery should retain its mutation until the next turn is classified")
}
var followUpErr *FinalReadinessError
if err := a.Run(withClosedLoopContext(context.Background()), "fix the unrelated crash in other.go"); !errors.As(err, &followUpErr) {
t.Fatalf("ordinary follow-up error = %v, want FinalReadinessError", err)
if err := a.Run(withClosedLoopContext(context.Background()), "fix the unrelated crash in other.go"); err != nil {
t.Fatalf("ordinary follow-up without a writer = %v, want ready", err)
}
if _, ok := a.task.ledger.LatestSuccessfulMutationIndex(); ok {
t.Fatal("ordinary follow-up inherited stale mutation evidence without explicit recovery")
@@ -548,146 +539,13 @@ func TestPreviewStripsDeliveryMarkerAndSyntheticTurns(t *testing.T) {
}
}
func TestDeliveryTaskNeedsEvidenceSkipsDiagnosticConversations(t *testing.T) {
// Diagnostic/troubleshooting conversations ask "what's wrong" or "why"
// without requesting code changes. They must not demand host-observable
// work — the agent can only give advice, not mutate files.
diagnostic := []string{
"what's wrong with my wifi",
"I don't want to install dependencies",
"please don't install any dependencies",
"why can't I install the plugin?",
"why can't I run WPS?",
"why can't I check my email in Outlook?",
"can you analyze why WPS won't open?",
"why did the plugin update fail?",
"can you explain why install keeps failing?",
"why does this make a difference?",
"why does the node selection matter?",
"why is `Python` popular?",
"what does `context.Context` mean?",
"why can't I open github.com/?",
"为什么wps导入zetero参考文献报错",
"为什么无法安装插件",
"为什么不能安装插件",
"为什么 WPS 不能运行",
"为什么无法检查 Outlook 邮件",
"分析一下为什么 WPS 不能运行",
"为什么安装插件失败",
"为什么更新配置后报错",
"帮我看看这是什么问题",
"为什么zotero连接不上，我不敢重新安装",
"诊断数据库连接失败的原因",
"这软件打不开了，怎么回事",
}
for _, input := range diagnostic {
if taskintent.NeedsEvidence(input) {
t.Errorf("diagnostic input %q incorrectly classified as needing evidence", input)
}
}
// Mutation-worded tasks still require evidence.
taskInputs := []string{
func TestPromptTextDoesNotInventMutationObligations(t *testing.T) {
inputs := []string{
"解释 OAuth token",
"fix the crash in a.go",
"帮我修复wps的崩溃问题",
"create a new login endpoint",
"添加一个单元测试",
"modify the existing config",
"patch the parser",
"replace the old endpoint",
"make the requested changes",
"调整现有配置",
"替换旧接口",
"thanks for fixing that, now update the tests",
"谢谢你，请继续修改配置",
}
for _, input := range taskInputs {
if !taskintent.NeedsEvidence(input) {
t.Errorf("mutation task %q incorrectly classified as NOT needing evidence", input)
}
}
}
func TestDeliveryTaskNeedsEvidenceKeepsReadOnlyTechnicalWork(t *testing.T) {
inputs := []string{
"修复登录超时",
"I can't install dependencies and please update the config",
"review this pull request and report whether it is correct",
"run go test ./... and tell me why it fails",
"why does go test fail?",
"why does go build ./... fail?",
"why does npm run build fail?",
"why does git status fail?",
"why does `custom-lint --strict` fail?",
"why does ./scripts/verify.sh fail?",
"为什么 go build ./... 会失败",
"why can't I run main.go?",
"why does README.md render incorrectly?",
"reproduce the crash and identify the root cause",
"inspect main.go for security vulnerabilities",
"诊断当前项目的数据库连接失败原因",
}
for _, input := range inputs {
if !taskintent.NeedsEvidence(input) {
t.Errorf("read-only technical task %q did not require host-observable evidence", input)
}
if taskintent.NeedsMutation(input) {
t.Errorf("read-only technical task %q incorrectly required a mutation", input)
}
}
}
func TestDeliveryTaskNeedsMutationHandlesMixedIntent(t *testing.T) {
mutationInputs := []string{
"modify the existing config",
"patch the parser",
"make the requested changes",
"I don't want to install dependencies, but update the existing config",
"I can't install dependencies; please edit the existing config instead",
"I can't install dependencies and please update the config",
"do not install dependencies and please update the config",
"I can't install dependencies so update the config",
"I can't install dependencies please update the existing config",
"can you explain why it fails and fix it",
"我不想安装新依赖，请修改现有配置修复这个问题",
"我无法安装新依赖，但请修改现有配置",
"无法安装新依赖请修改配置",
"不要安装依赖请更新配置",
"无法安装新依赖所以修改配置",
"为什么这个方案失败，请修复它",
"调整现有配置",
"替换旧接口",
}
for _, input := range mutationInputs {
if !taskintent.NeedsMutation(input) {
t.Errorf("mixed-intent input %q did not require a mutation", input)
}
}
readOnlyInputs := []string{
"review only; do not fix anything",
"I don't want to install dependencies",
"please don't install any dependencies",
"why can't I install the plugin?",
"do not install and update dependencies",
"don't fix or update anything",
"只分析，不要修改代码",
"请不要安装或更新依赖",
"不想请团队修改代码",
"禁止申请修改配置",
"为什么无法安装插件",
"为什么不能安装插件",
"为什么zotero连接不上，我不敢重新安装",
}
for _, input := range readOnlyInputs {
if taskintent.NeedsMutation(input) {
t.Errorf("read-only input %q incorrectly required a mutation", input)
}
}
}
func TestDeliveryMixedIntentRequiresMutationEvidence(t *testing.T) {
inputs := []string{
"I can't install dependencies and please update the config",
"无法安装新依赖请修改配置",
}
for _, input := range inputs {
t.Run(input, func(t *testing.T) {
@@ -695,49 +553,13 @@ func TestDeliveryMixedIntentRequiresMutationEvidence(t *testing.T) {
reg.Add(fakeReadFileTool{})
reg.Add(fakeWriterTool{})
answer := []provider.Chunk{
{Type: provider.ChunkText, Text: "Done; the config is updated."},
{Type: provider.ChunkText, Text: "Here is the explanation."},
{Type: provider.ChunkDone},
}
prov := &scriptedProvider{name: "p", turns: [][]provider.Chunk{answer, answer, answer}}
prov := &scriptedProvider{name: "p", turns: [][]provider.Chunk{answer}}
a := New(prov, reg, NewSession("sys"), Options{}, event.Discard)
err := a.Run(withClosedLoopContext(context.Background()), input)
var readinessErr *FinalReadinessError
if !errors.As(err, &readinessErr) {
t.Fatalf("text-only completion escaped the mutation gate: %v", err)
}
if !strings.Contains(readinessErr.Reason, "state change") {
t.Fatalf("readiness reason = %q, want missing state change", readinessErr.Reason)
}
})
}
}
func TestDeliveryReadOnlyTechnicalTaskRequiresEvidence(t *testing.T) {
inputs := []string{
"review this pull request and report whether it is correct",
"why does go build ./... fail?",
}
for _, input := range inputs {
t.Run(input, func(t *testing.T) {
reg := tool.NewRegistry()
reg.Add(fakeReadFileTool{})
reg.Add(fakeWriterTool{})
answer := []provider.Chunk{
{Type: provider.ChunkText, Text: "Reviewed; everything is correct."},
{Type: provider.ChunkDone},
}
prov := &scriptedProvider{name: "p", turns: [][]provider.Chunk{answer, answer, answer}}
a := New(prov, reg, NewSession("sys"), Options{}, event.Discard)
err := a.Run(withClosedLoopContext(context.Background()), input)
var readinessErr *FinalReadinessError
if !errors.As(err, &readinessErr) {
t.Fatalf("text-only technical work escaped the evidence gate: %v", err)
}
if !strings.Contains(readinessErr.Reason, "host-observable work") {
t.Fatalf("readiness reason = %q, want missing host-observable work", readinessErr.Reason)
}
if strings.Contains(readinessErr.Reason, "state change") {
t.Fatalf("read-only work incorrectly required a mutation: %q", readinessErr.Reason)
if err := a.Run(context.Background(), input); err != nil {
t.Fatalf("prompt-only turn must not invent a mutation gap: %v", err)
}
})
}
internal/agent/delivery_scope_test.go
+4 -7
View File
@@ -56,13 +56,10 @@ func TestDeliveryGoalFinalAnswerAlwaysGatesMutationExpectation(t *testing.T) {
}}
a := New(prov, reg, NewSession(""), Options{}, event.Discard)
ctx := withClosedLoopContext(deliveryGoalContext("goal-1", "fix the crash in main.go"))
// A read-only final answer is gated on the mutation expectation immediately:
// the host no longer defers readiness for marker-carrying turns, the Goal
// FSM absorbs the failure and continues with the missing requirements.
err := a.Run(ctx, "investigate the crash")
var readiness *FinalReadinessError
if !errors.As(err, &readiness) || !strings.Contains(readiness.Reason, "state change") {
t.Fatalf("read-only final answer err = %v, want mutation readiness failure", err)
// Prompt text does not invent a mutation. A Goal investigation that only
// reads may finish without a state-change obligation.
if err := a.Run(ctx, "investigate the crash"); err != nil {
t.Fatalf("read-only Goal investigation = %v, want ready", err)
}
}
internal/agent/evidence_flow_fact_test.go
+31
View File
@@ -0,0 +1,31 @@
package agent
import (
"context"
"testing"
"reasonix/internal/event"
"reasonix/internal/provider"
)
func TestClosedLoopRejectsTextOnlyImplementationClaim(t *testing.T) {
reg := evidenceRegistry()
reg.Add(fakeTool{name: "read_file", readOnly: true})
prov := &scriptedProvider{name: "delivery", turns: [][]provider.Chunk{
{{Type: provider.ChunkText, Text: "implemented"}, {Type: provider.ChunkDone}},
{toolCallChunk("criteria", "todo_write", `{"todos":[{"content":"Implement main","status":"in_progress"}]}`), {Type: provider.ChunkDone}},
{toolCallChunk("write", "write_file", `{"path":"main.go"}`), {Type: provider.ChunkDone}},
{toolCallChunk("review", "read_file", `{"path":"main.go"}`), {Type: provider.ChunkDone}},
{toolCallChunk("verify", "bash", `{"command":"go test ./..."}`), {Type: provider.ChunkDone}},
{toolCallChunk("signoff", "complete_step", `{"step":"Implement main","result":"implemented","evidence":[{"kind":"verification","summary":"tests pass","command":"go test ./..."}]}`), {Type: provider.ChunkDone}},
{{Type: provider.ChunkText, Text: "implemented with evidence"}, {Type: provider.ChunkDone}},
}}
a := New(prov, reg, NewSession(""), Options{}, event.Discard)
err := a.Run(withClosedLoopContext(context.Background()), "implement main")
if err != nil {
t.Fatalf("text-only claim without a writer = %v, want ready", err)
}
if prov.call != 1 {
t.Fatalf("provider calls = %d, want 1 (text-only claim ends immediately)", prov.call)
}
}
internal/agent/evidence_flow_test.go
+18 -32
View File
@@ -2,7 +2,6 @@ package agent
import (
"context"
"errors"
"reflect"
"strings"
"testing"
@@ -172,11 +171,11 @@ func TestClosedLoopEnforcesAcceptanceReviewVerificationAndSignoff(t *testing.T)
if err := a.Run(withClosedLoopContext(context.Background()), "implement main"); err != nil {
t.Fatalf("Run: %v", err)
}
if got := toolResult(a.sess.conversation, "write_file"); !strings.Contains(got, "closed-loop execution requires acceptance criteria") {
t.Fatalf("first write result = %q, want delivery acceptance gate", got)
if got := toolResultByID(a.sess.conversation, "blocked-write"); strings.Contains(got, "acceptance criteria") {
t.Fatalf("single-file write must not require a todo precondition: %q", got)
}
if !sessionHasUserMessageContaining(a.sess.conversation, "<execution-policy") {
t.Fatal("execution-policy marker was not injected into the turn tail")
if sessionHasUserMessageContaining(a.sess.conversation, "<execution-policy") {
t.Fatal("new turns must not inject execution-policy")
}
if got := lastToolResult(a.sess.conversation, "complete_step"); !strings.Contains(got, "signed off") {
t.Fatalf("complete_step result = %q, want successful sign-off", got)
@@ -234,29 +233,6 @@ func TestClosedLoopRequiresReviewBeforeFinalAnswer(t *testing.T) {
}
}
func TestClosedLoopRejectsTextOnlyImplementationClaim(t *testing.T) {
reg := evidenceRegistry()
reg.Add(fakeTool{name: "read_file", readOnly: true})
prov := &scriptedProvider{name: "delivery", turns: [][]provider.Chunk{
{{Type: provider.ChunkText, Text: "implemented"}, {Type: provider.ChunkDone}},
{toolCallChunk("criteria", "todo_write", `{"todos":[{"content":"Implement main","status":"in_progress"}]}`), {Type: provider.ChunkDone}},
{toolCallChunk("write", "write_file", `{"path":"main.go"}`), {Type: provider.ChunkDone}},
{toolCallChunk("review", "read_file", `{"path":"main.go"}`), {Type: provider.ChunkDone}},
{toolCallChunk("verify", "bash", `{"command":"go test ./..."}`), {Type: provider.ChunkDone}},
{toolCallChunk("signoff", "complete_step", `{"step":"Implement main","result":"implemented","evidence":[{"kind":"verification","summary":"tests pass","command":"go test ./..."}]}`), {Type: provider.ChunkDone}},
{{Type: provider.ChunkText, Text: "implemented with evidence"}, {Type: provider.ChunkDone}},
}}
a := New(prov, reg, NewSession(""), Options{}, event.Discard)
err := a.Run(withClosedLoopContext(context.Background()), "implement main")
var readiness *FinalReadinessError
if !errors.As(err, &readiness) || !strings.Contains(readiness.Reason, "no successful mutation was observed") {
t.Fatalf("text-only implementation claim err = %v, want mutation readiness failure", err)
}
if prov.call != 1 {
t.Fatalf("provider calls = %d, want 1 (text-only claim rejected immediately, no retries)", prov.call)
}
}
func TestClosedLoopCommandOnlyActionRequiresCriteriaAndSignoff(t *testing.T) {
reg := evidenceRegistry()
prov := &scriptedProvider{name: "delivery", turns: [][]provider.Chunk{
@@ -270,8 +246,8 @@ func TestClosedLoopCommandOnlyActionRequiresCriteriaAndSignoff(t *testing.T) {
if err := a.Run(withClosedLoopContext(context.Background()), "run tests"); err != nil {
t.Fatalf("Run: %v", err)
}
if got := toolResult(a.sess.conversation, "bash"); !strings.Contains(got, "closed-loop execution requires acceptance criteria") {
t.Fatalf("first bash result = %q, want acceptance gate", got)
if got := toolResultByID(a.sess.conversation, "blocked-test"); strings.Contains(got, "acceptance criteria") {
t.Fatalf("verification command must not require a todo precondition: %q", got)
}
if got := lastToolResult(a.sess.conversation, "complete_step"); !strings.Contains(got, "signed off") {
t.Fatalf("complete_step result = %q, want successful command-only sign-off", got)
@@ -362,8 +338,8 @@ func TestClosedLoopRequiresActiveTodoForLateMutation(t *testing.T) {
if err := a.Run(withClosedLoopContext(context.Background()), "implement main and incorporate review fixes"); err != nil {
t.Fatalf("Run: %v", err)
}
if got := toolResultByID(a.sess.conversation, "late-write"); !strings.Contains(got, "current in_progress todo") {
t.Fatalf("late mutation result = %q, want active-todo gate", got)
if got := toolResultByID(a.sess.conversation, "late-write"); strings.HasPrefix(got, "blocked:") {
t.Fatalf("single-file follow-up write must not require a new todo: %q", got)
}
if got := toolResultByID(a.sess.conversation, "retry-write"); strings.HasPrefix(got, "blocked:") || strings.HasPrefix(got, "error:") {
t.Fatalf("mutation after appended active todo should run, got %q", got)
@@ -508,10 +484,12 @@ func TestFinalReadinessBlocksUntilProjectCheckRunsAfterWriter(t *testing.T) {
{{Type: provider.ChunkText, Text: "premature"}, {Type: provider.ChunkDone}},
{
toolCallChunk("c2", "bash", `{"command":"go test ./..."}`),
toolCallChunk("c2r", "read_file", `{"path":"changed.go"}`),
{Type: provider.ChunkDone},
},
{{Type: provider.ChunkText, Text: "verified done"}, {Type: provider.ChunkDone}},
}}
reg.Add(fakeTool{name: "read_file", readOnly: true})
a := New(prov, reg, NewSession(""), Options{
ProjectChecks: []instruction.VerifyCheck{{Command: "go test ./...", SourcePath: "AGENTS.md", Line: 3}},
}, event.Discard)
@@ -537,6 +515,7 @@ func TestFinalReadinessAuditRecordsBlockAndRecovery(t *testing.T) {
reg := tool.NewRegistry()
reg.Add(fakeTool{name: "write_file", readOnly: false})
reg.Add(fakeTool{name: "bash", readOnly: false})
reg.Add(fakeTool{name: "read_file", readOnly: true})
prov := &scriptedProvider{name: "p", turns: [][]provider.Chunk{
{
toolCallChunk("c1", "write_file", `{"path":"changed.go","content":"package main"}`),
@@ -545,6 +524,7 @@ func TestFinalReadinessAuditRecordsBlockAndRecovery(t *testing.T) {
{{Type: provider.ChunkText, Text: "premature"}, {Type: provider.ChunkDone}},
{
toolCallChunk("c2", "bash", `{"command":"go test ./..."}`),
toolCallChunk("c2r", "read_file", `{"path":"changed.go"}`),
{Type: provider.ChunkDone},
},
{{Type: provider.ChunkText, Text: "verified done"}, {Type: provider.ChunkDone}},
@@ -578,6 +558,7 @@ func TestFinalReadinessRejectsProjectCheckBeforeWriter(t *testing.T) {
reg := tool.NewRegistry()
reg.Add(fakeTool{name: "bash", readOnly: false})
reg.Add(fakeTool{name: "write_file", readOnly: false})
reg.Add(fakeTool{name: "read_file", readOnly: true})
prov := &scriptedProvider{name: "p", turns: [][]provider.Chunk{
{
toolCallChunk("c1", "bash", `{"command":"go test ./..."}`),
@@ -587,6 +568,7 @@ func TestFinalReadinessRejectsProjectCheckBeforeWriter(t *testing.T) {
{{Type: provider.ChunkText, Text: "premature"}, {Type: provider.ChunkDone}},
{
toolCallChunk("c3", "bash", `{"command":"go test ./..."}`),
toolCallChunk("c3r", "read_file", `{"path":"changed.go"}`),
{Type: provider.ChunkDone},
},
{{Type: provider.ChunkText, Text: "verified done"}, {Type: provider.ChunkDone}},
@@ -620,6 +602,8 @@ func TestFinalReadinessRequiresCompleteStepAfterWriterWhenTodoSeen(t *testing.T)
}
reg := tool.NewRegistry()
reg.Add(fakeTool{name: "write_file", readOnly: false})
reg.Add(fakeTool{name: "read_file", readOnly: true})
reg.Add(fakeTool{name: "bash", readOnly: false})
reg.Add(todoWrite)
reg.Add(completeStep)
prov := &scriptedProvider{name: "p", turns: [][]provider.Chunk{
@@ -630,6 +614,8 @@ func TestFinalReadinessRequiresCompleteStepAfterWriterWhenTodoSeen(t *testing.T)
},
{{Type: provider.ChunkText, Text: "premature"}, {Type: provider.ChunkDone}},
{
toolCallChunk("review", "read_file", `{"path":"changed.go"}`),
toolCallChunk("verify", "bash", `{"command":"go test ./..."}`),
toolCallChunk("c3", "complete_step", `{
"step":"Edit code",
"result":"changed.go updated",
internal/agent/execute_one.go
+1 -16
View File
@@ -140,7 +140,7 @@ func (a *Agent) resolveToolPolicy(ctx context.Context, turn *turnRuntime, plan *
if blocked, early := a.applyContextualToolGate(ctx, plan); early {
return blocked, true
}
if blocked, early := a.applyTaskPolicyPreflight(turn, plan); early {
if blocked, early := a.applyExecutionPreflight(turn, plan); early {
return blocked, true
}
if blocked, early := a.applyDeliveryPolicyGates(turn, plan); early {
@@ -419,21 +419,6 @@ func (a *Agent) applyDeliveryPolicyGates(turn *turnRuntime, plan *toolCallPlan)
}, true
}
persistentWorkflowCall := turn.deliveryPersistentExpected && !turn.deliveryMutationExpected && plan.evidenceName == "remember"
if closedLoop && !persistentWorkflowCall && evidence.ToolCallRequiresAcceptanceCriteria(plan.evidenceName, plan.evidenceArgs, plan.readOnly) && !turn.deliveryCriteriaEstablished {
return toolOutcome{
output: "blocked: closed-loop execution requires acceptance criteria before state-changing work. Call todo_write with a concrete, verifiable task list, then retry this tool call.",
blocked: true,
errMsg: "blocked: closed-loop acceptance criteria required",
}, true
}
if closedLoop && !persistentWorkflowCall && plan.effects.ContentMutation && !a.hasActiveCanonicalTodo() {
return toolOutcome{
output: "blocked: closed-loop execution requires every state change to belong to the current in_progress todo. Preserve the completed todo prefix, append a concrete new item if more work was discovered, mark that item in_progress with todo_write, then retry this mutation.",
blocked: true,
errMsg: "blocked: active in-progress todo required",
}, true
}
return toolOutcome{}, false
}
internal/agent/execution_engine.go
+166
View File
@@ -0,0 +1,166 @@
package agent
import (
"encoding/json"
"strings"
"reasonix/internal/evidence"
"reasonix/internal/runtimepolicy"
"reasonix/internal/taskcontract"
"reasonix/internal/tool"
)
func mergeInheritedConstraints(child, parent runtimepolicy.Constraints) runtimepolicy.Constraints {
if parent.ForbidMutation {
child.ForbidMutation = true
}
if parent.ForbidTests {
child.ForbidTests = true
}
if parent.ForbidExternal {
child.ForbidExternal = true
}
if parent.PlanModeReadOnly {
child.PlanModeReadOnly = true
child.ForbidMutation = true
}
if parent.RequireFullVerification {
child.RequireFullVerification = true
}
if len(parent.AllowedChecks) > 0 && len(child.AllowedChecks) == 0 {
child.AllowedChecks = append([]string(nil), parent.AllowedChecks...)
}
return child
}
func (a *Agent) rebuildTurnContract() {
if a == nil || a.turn.engine == nil {
return
}
var plan *taskcontract.PlanFacts
if snapshot := a.planContractSnapshot(); snapshot != nil {
facts := planFacts(*snapshot)
plan = &facts
}
var todos []evidence.TodoItem
if a.task.ledger != nil {
if items, ok := a.task.ledger.LatestTodos(); ok {
todos = items
}
}
var checks []string
for _, check := range a.projectChecks {
if command := strings.TrimSpace(check.Command); command != "" {
checks = append(checks, command)
}
}
var receipts []evidence.Receipt
if a.task.ledger != nil {
receipts = a.task.ledger.Receipts()
}
a.turn.engine.Rebuild(taskcontract.RebuildFacts{
Plan: plan,
Todos: todos,
ProjectChecks: checks,
Receipts: receipts,
TestsForbidden: a.turn.constraints.ForbidTests,
RequireFullVerification: a.turn.constraints.RequireFullVerification,
WorkspaceRoot: a.writeWorkspaceRoot,
HasApprovedPlan: plan != nil,
HasActiveGoal: a.turn.deliveryScopeActive,
})
}
func (a *Agent) pipelineDecision(plan *toolCallPlan) runtimepolicy.GuardDecision {
if a == nil || plan == nil || a.turn.engine == nil {
return runtimepolicy.GuardDecision{}
}
profile := evidence.ClassifyEffect(evidence.EffectInput{
ToolName: plan.evidenceName,
Args: plan.evidenceArgs,
StaticReadOnly: plan.readOnly,
Hint: effectHintOf(plan.execTool, plan.execArgs),
ActualPaths: evidence.ToolCallPaths(plan.evidenceArgs),
})
plan.profile = profile
plan.effects = profile.ToolEffects()
return a.turn.engine.BeforeTool(runtimepolicy.CallContext{
ToolName: plan.evidenceName,
Args: plan.evidenceArgs,
Profile: profile,
PlanReadOnly: a.planMode.Load() || a.turn.constraints.PlanModeReadOnly,
Interactive: a.hasInteractiveAsk(),
HasTodo: a.hasActiveCanonicalTodo() || a.turn.deliveryCriteriaEstablished,
HasCriteria: a.turn.deliveryCriteriaEstablished,
Verification: plan.evidenceName == "bash" && evidence.IsVerificationCommand(bashCommandFromArgs(plan.evidenceArgs)),
TestsForbidden: a.turn.constraints.ForbidTests,
WorkspaceRoot: a.writeWorkspaceRoot,
})
}
func (a *Agent) commitToolReceipt(rec evidence.Receipt) {
if a == nil || a.turn.engine == nil {
return
}
a.turn.engine.CommitReceipt(runtimepolicy.ResultContext{
Receipt: rec,
Profile: evidence.ClassifyEffect(evidence.EffectInput{ToolName: rec.ToolName, Args: rec.Args, ActualPaths: rec.Paths, StaticReadOnly: rec.Read && !rec.Write}),
WorkspaceRoot: a.writeWorkspaceRoot,
TestsForbidden: a.turn.constraints.ForbidTests,
})
}
func effectHintOf(t tool.Tool, args json.RawMessage) evidence.CallHint {
if t == nil {
return evidence.CallHint{}
}
hint := evidence.CallHint{Present: true, ReadOnly: t.ReadOnly()}
if d, ok := t.(interface{ MCPDestructiveHint() bool }); ok {
hint.Destructive = d.MCPDestructiveHint()
}
if p, ok := t.(tool.EffectHintProvider); ok {
h := p.EffectHint(args)
hint.Known = h.Known
hint.ReadOnly = hint.ReadOnly || h.ReadOnly
hint.Destructive = hint.Destructive || h.Destructive
hint.Privileged = h.Privileged
hint.UsesNetwork = h.UsesNetwork
hint.ExecutesCode = h.ExecutesCode
hint.Targets = append([]string(nil), h.Targets...)
}
return hint
}
func (a *Agent) requiresIndependentReview() bool {
if a == nil || a.turn.engine == nil {
return false
}
for _, o := range a.turn.engine.Snapshot().Unsatisfied() {
if o.Kind == taskcontract.ObligationIndependentReview || o.Kind == taskcontract.ObligationSecurityReview {
return true
}
}
return false
}
func (a *Agent) requiresSecurityReview() bool {
if a == nil || a.turn.engine == nil {
return false
}
for _, o := range a.turn.engine.Snapshot().Unsatisfied() {
if o.Kind == taskcontract.ObligationSecurityReview {
return true
}
}
return false
}
func (a *Agent) hasInteractiveAsk() bool {
if a == nil || a.svc.gate == nil {
return false
}
_, ok := a.svc.gate.(interface {
Ask(any) (bool, error)
})
return ok
}
internal/agent/fact_driven_cache_test.go
+65
View File
@@ -0,0 +1,65 @@
package agent
import (
"context"
"encoding/json"
"errors"
"testing"
"reasonix/internal/event"
"reasonix/internal/evidence"
"reasonix/internal/provider"
"reasonix/internal/tool"
)
func TestFactDrivenModesShareExecutorSchemaBytes(t *testing.T) {
prov := &mockProvider{name: "p", chunks: []provider.Chunk{
{Type: provider.ChunkText, Text: "ok"},
{Type: provider.ChunkDone},
}}
reg := tool.NewRegistry()
reg.Add(fakeReadFileTool{})
reg.Add(fakeWriterTool{})
a := New(prov, reg, NewSession("STABLE-SYS"), Options{}, event.Discard)
capture := func(ctx context.Context, input string) (system, schemas string) {
t.Helper()
prov.chunks = []provider.Chunk{{Type: provider.ChunkText, Text: "ok"}, {Type: provider.ChunkDone}}
err := a.Run(ctx, input)
if err != nil {
var readiness *FinalReadinessError
if !errors.As(err, &readiness) {
t.Fatalf("Run(%q): %v", input, err)
}
}
if len(prov.lastReq.Messages) == 0 || prov.lastReq.Messages[0].Role != provider.RoleSystem {
t.Fatalf("missing system prefix for %q", input)
}
return prov.lastReq.Messages[0].Content, serializeToolSchemas(t, prov.lastReq.Tools)
}
ordinarySys, ordinaryTools := capture(context.Background(), "解释 OAuth token")
a.SetPlanMode(true)
planSys, planTools := capture(context.Background(), "先规划这个认证迁移，不要执行")
a.SetPlanMode(false)
goalCtx := WithDeliveryExecutionScope(context.Background(), DeliveryExecutionScope{
ID: "goal-cache", TaskText: "ship the parser",
})
goalSys, goalTools := capture(goalCtx, "ship the parser")
a.task.ledger.Record(evidence.Receipt{
ToolName: "edit_file", Success: true, Write: true, Mutation: true,
Args: json.RawMessage(`{"path":"internal/agent/agent.go"}`), Paths: []string{"internal/agent/agent.go"},
})
afterSys, afterTools := capture(goalCtx, "continue")
if ordinarySys != planSys || ordinarySys != goalSys || ordinarySys != afterSys {
t.Fatalf("executor system prefix drifted:\nordinary=%q\nplan=%q\ngoal=%q\nafter=%q",
ordinarySys, planSys, goalSys, afterSys)
}
if ordinaryTools != planTools || ordinaryTools != goalTools || ordinaryTools != afterTools {
t.Fatalf("tool schemas drifted across ordinary/plan/goal/obligation")
}
}
internal/agent/final_readiness.go
+108 -177
View File
@@ -5,13 +5,13 @@ import (
"strings"
"reasonix/internal/ablation"
"reasonix/internal/event"
"reasonix/internal/evidence"
"reasonix/internal/instruction"
"reasonix/internal/taskpolicy"
"reasonix/internal/runtimepolicy"
"reasonix/internal/taskcontract"
)
// Final readiness: whether the frozen TaskPolicy and ledger allow the turn to stop.
// Final readiness: whether the fact contract and ledger allow the turn to stop.
type finalReadinessCheck struct {
applies bool
@@ -83,121 +83,36 @@ func (a *Agent) finalReadinessCheckFor() finalReadinessCheck {
if a.task.ledger == nil || a.ablation.Off(ablation.Evidence) {
return finalReadinessCheck{}
}
// Absorb wait/child receipts that arrived after the last commit. Do not
// rebuild the whole contract here — that would re-impose an unused plan.
if a.turn.engine != nil && a.task.ledger != nil {
a.turn.engine.SyncReceipts(a.task.ledger.Receipts(), a.writeWorkspaceRoot, a.turn.constraints.ForbidTests)
}
var missing []string
out := finalReadinessCheck{}
// Planning returns a proposal; the controller owns approval and starts a
// fresh execution turn, which is where delivery requirements belong. A
// workflow boundary only — tool calls still take the usual permission path.
if a.planMode.Load() {
return out
}
a.escalatePolicyFromEvidence()
closedLoop, qualityGated := a.finalReadinessPolicyState()
// An unfinished todo is a direct contradiction of a final answer, not a
// quality-evidence gap. Keep blocking it even on ordinary targeted turns.
incomplete, hasTodos := a.task.ledger.IncompleteLatestTodos()
if !hasTodos && a.task.ledger.HasAnySuccessfulReceipt() {
incomplete, hasTodos = a.incompleteCanonicalTodos()
}
if hasTodos && len(incomplete) > 0 && a.task.ledger.HasSuccessfulTodoProgressReceipt() {
if msg := a.capabilityGateFailure(); msg != "" {
out.applies = true
out.missingCapabilities++
missing = append(missing, msg)
}
writer, hasWriter := a.task.ledger.LatestSuccessfulWriterIndex()
if mutation, ok := a.task.ledger.LatestSuccessfulMutationIndex(); ok {
writer, hasWriter = mutation, true
}
if hasWriter && hasTodos && len(incomplete) > 0 {
out.applies = true
out.incompleteTodos = len(incomplete)
missing = append(missing, finalReadinessIncompleteTodos(incomplete))
}
writer, hasWriter := a.task.ledger.LatestSuccessfulWriterIndex()
atomicMutationMissing := false
if a.turn.policySet && a.turn.policy.RequireAtomicContract {
if _, ok := a.task.ledger.LatestSuccessfulMutationIndex(); !ok {
atomicMutationMissing = true
out.applies = true
out.missingMutation++
missing = append(missing, "the atomic modification contract requires a successful mutation before answering")
}
}
deliveryMutation := false
deliveryVerificationOnly := false
checkpoint := a.task.checkpoint
checkpointApplies := a.turn.deliveryScopeActive && checkpoint.ScopeID == a.task.scopeID
if closedLoop {
if mutation, ok := a.task.ledger.LatestSuccessfulMutationIndex(); ok {
writer, hasWriter = mutation, true
deliveryMutation = true
} else if checkpointApplies && checkpoint.PendingMutation {
// The mutation happened before a controller rebuild/restart. Treat it as
// the baseline so this run can satisfy verification/review/sign-off
// without manufacturing another write.
writer, hasWriter = -1, true
deliveryMutation = true
} else if checkpointApplies && checkpoint.MutationObserved {
deliveryMutation = true
}
workObserved := a.task.ledger.HasSuccessfulWorkReceipt() || (checkpointApplies && checkpoint.WorkObserved)
if a.turn.deliveryTaskExpected && !a.turn.deliveryPersistentExpected && !workObserved {
out.missingActionEvidence++
missing = append(missing, "perform host-observable work for this technical task before answering")
}
if a.turn.deliveryPersistentExpected && !a.task.ledger.HasSuccessfulToolReceipt("remember") {
out.missingMutation++
missing = append(missing, "save the requested durable memory with the remember tool before answering")
}
if a.turn.deliveryMutationExpected && !deliveryMutation {
out.missingMutation++
missing = append(missing, "the request requires a state change, but no successful mutation was observed")
}
if !hasWriter && a.task.ledger.HasSuccessfulVerificationCommand() {
writer, hasWriter = -1, true
deliveryVerificationOnly = true
}
// Required/preferred capability gates apply before the no-writer fast
// path below: a user-required Skill/MCP must not be skippable by
// answering from ordinary reads alone.
if msg := a.capabilityGateFailure(); msg != "" {
out.applies = true
out.missingCapabilities++
missing = append(missing, msg)
}
if a.turn.deliveryPersistentExpected && !a.turn.deliveryMutationExpected && !a.task.ledger.HasSuccessfulMutationOtherThan("remember") {
// A durable-memory-only request has its own concrete receipt contract.
// It must not inherit code-delivery todo/test/diff/review ceremonies;
// any unrelated mutation falls through to the full contract below.
out.applies = true
if len(missing) > 0 {
out.reason = strings.Join(missing, "; ")
}
return out
}
}
if !hasWriter {
if len(missing) > 0 {
if a.loopGuardAllowsFinal() && !atomicMutationMissing {
return out
}
out.reason = strings.Join(missing, "; ")
}
return out
}
// Targeted standard turns report missing checks without opening a recovery
// card. Hard readiness remains for high-assurance and Goal execution.
if !qualityGated {
if len(missing) > 0 {
if a.loopGuardAllowsFinal() && !atomicMutationMissing {
return finalReadinessCheck{}
}
out.reason = strings.Join(missing, "; ")
}
return out
}
hasProjectChecks := len(a.projectChecks) > 0
hasTodoReceipt := a.task.ledger.HasSuccessfulTodoWrite()
if !closedLoop && !hasProjectChecks && !hasTodoReceipt && len(missing) == 0 {
return finalReadinessCheck{}
}
out.applies = true
if closedLoop {
missing = a.appendClosedLoopReadiness(&out, missing, writer, deliveryMutation, checkpointApplies, checkpoint)
}
for _, check := range a.projectChecks {
if deliveryVerificationOnly {
if !hasWriter {
break
}
command := strings.TrimSpace(check.Command)
@@ -209,13 +124,76 @@ func (a *Agent) finalReadinessCheckFor() finalReadinessCheck {
missing = append(missing, fmt.Sprintf("run %q from %s after the latest write", command, finalReadinessCheckSource(check)))
}
}
if hasWriter {
outstanding := a.outstandingPlanCriteria()
out.missingAcceptanceCriteria += len(outstanding)
missing = append(missing, outstanding...)
}
// Before the loop-guard escape on purpose: a criterion the model cannot
// prove must still be able to stop asking.
outstanding := a.outstandingPlanCriteria()
out.missingAcceptanceCriteria += len(outstanding)
missing = append(missing, outstanding...)
if len(missing) == 0 {
stop := runtimepolicy.StopDecision{Disposition: taskcontract.StopReady}
if a.turn.engine != nil {
stop = a.turn.engine.BeforeStop(runtimepolicy.StopContext{
GoalActive: a.turn.deliveryScopeActive,
ApprovedPlan: a.planContractSnapshot() != nil,
IncompleteTodo: hasTodos && len(incomplete) > 0,
Opts: taskcontract.StopOptions{
LoopGuard: a.loopGuardAllowsFinal(),
EnvUnavailable: a.turn.constraints.ForbidTests,
PermissionDenied: false,
},
})
for _, o := range a.turn.engine.Snapshot().Unsatisfied() {
missing = append(missing, obligationGap(o))
switch o.Kind {
case taskcontract.ObligationTargetedVerify, taskcontract.ObligationFullVerify:
out.missingVerification++
case taskcontract.ObligationDiffReview, taskcontract.ObligationIndependentReview, taskcontract.ObligationSecurityReview:
out.missingReview++
case taskcontract.ObligationSignoff:
out.missingSignoff++
case taskcontract.ObligationActionReceipt:
out.missingActionEvidence++
case taskcontract.ObligationCriteria:
out.missingAcceptanceCriteria++
}
}
}
if a.loopGuardAllowsFinal() {
return finalReadinessCheck{applies: true}
}
if out.incompleteTodos > 0 && stop.Disposition == taskcontract.StopReady {
// Incomplete todos are a fact contradiction, not an advisory gap.
stop.Disposition = taskcontract.StopContinue
}
if len(missing) == 0 && stop.Disposition == taskcontract.StopReady {
return out
}
out.applies = true
switch stop.Disposition {
case taskcontract.StopReady:
if a.loopGuardAllowsFinal() {
return out
}
if out.incompleteTodos == 0 && a.turn.engine != nil && len(a.turn.engine.Snapshot().AdvisoryGaps()) > 0 {
return out
}
case taskcontract.StopPartial:
out.reason = strings.Join(missing, "; ")
return a.applyPartialCheckWaiver(out)
case taskcontract.StopBlocked:
out.reason = strings.Join(missing, "; ")
return out
case taskcontract.StopContinue:
if a.loopGuardAllowsFinal() {
return out
}
if a.turn.engine != nil {
a.turn.engine.NoteRecoveryAttempt()
}
out.reason = strings.Join(missing, "; ")
if !a.closedLoopActive() {
return a.applyPartialCheckWaiver(out)
}
return out
}
if a.loopGuardAllowsFinal() {
@@ -225,38 +203,27 @@ func (a *Agent) finalReadinessCheckFor() finalReadinessCheck {
return a.applyPartialCheckWaiver(out)
}
// finalReadinessPolicyState keeps Goal mutation closure runtime-only, preserving
// provider-visible prompt bytes and the explicit EvidenceNone test escape hatch.
func (a *Agent) finalReadinessPolicyState() (closedLoop, qualityGated bool) {
_, goalMutationObserved := a.task.ledger.LatestSuccessfulMutationIndex()
closedLoop = a.closedLoopActive() ||
(a.turn.deliveryScopeActive && goalMutationObserved && a.turn.policy.Evidence != taskpolicy.EvidenceNone)
return closedLoop, closedLoop || a.turn.deliveryScopeActive || !a.turn.policySet
}
func (a *Agent) appendClosedLoopReadiness(out *finalReadinessCheck, missing []string, writer int, deliveryMutation, checkpointApplies bool, checkpoint evidence.DeliveryCheckpoint) []string {
a.emitTurnPhase(event.TurnPhaseVerifying)
if !(a.turn.deliveryCriteriaEstablished || (checkpointApplies && checkpoint.CriteriaEstablished)) {
out.missingAcceptanceCriteria++
missing = append(missing, "establish concrete acceptance criteria with todo_write before changing state")
func obligationGap(o taskcontract.Obligation) string {
switch o.Kind {
case taskcontract.ObligationTargetedVerify, taskcontract.ObligationFullVerify:
return "run relevant verification after the latest mutation"
case taskcontract.ObligationDiffReview:
return "inspect the changed result after the latest mutation (read the touched file or run git diff/status)"
case taskcontract.ObligationIndependentReview:
return "run an independent review after the latest mutation"
case taskcontract.ObligationSecurityReview:
return "run a security review after the latest mutation"
case taskcontract.ObligationSignoff:
return "call complete_step after the latest mutation"
case taskcontract.ObligationActionReceipt:
return "record a successful action receipt for this operation"
case taskcontract.ObligationCriteria:
return "establish concrete acceptance criteria before changing state"
case taskcontract.ObligationTodo:
return "keep an in-progress todo for this write"
default:
return string(o.Kind)
}
if !a.task.ledger.HasSuccessfulCompleteStepAfter(writer) {
out.missingSignoff++
missing = append(missing, "call complete_step after the latest mutation")
}
if !a.task.ledger.HasSuccessfulDeliverySignoffAfter(writer) {
out.missingVerification++
missing = append(missing, "run relevant verification after the latest mutation and cite that successful command in complete_step")
}
if deliveryMutation && !a.task.ledger.HasSuccessfulReviewAfter(writer) {
out.missingReview++
missing = append(missing, "inspect the changed result after the latest mutation (read the touched file or run git diff/status)")
}
if msg := a.deliveryReviewGateFailure(); msg != "" {
out.missingReview++
missing = append(missing, msg)
}
return missing
}
func finalReadinessCheckSource(check instruction.VerifyCheck) string {
@@ -281,39 +248,3 @@ func finalReadinessIncompleteTodos(items []evidence.TodoStepMatch) string {
}
return "latest successful todo_write still has incomplete items: " + strings.Join(parts, ", ")
}
// escalatePolicyFromEvidence ratchets risk/review upward from ledger receipts.
// High-risk or oversized mutations raise floors; weak coverage forces review.
func (a *Agent) escalatePolicyFromEvidence() {
if !a.turn.policySet || a.task.ledger == nil || !a.turn.policy.AllowsMutation() {
return
}
p := &a.turn.policy
if _, ok := a.task.ledger.LatestSuccessfulMutationIndex(); ok {
switch a.task.ledger.MutationRiskWithin(a.writeWorkspaceRoot) {
case evidence.RiskHigh:
p.RaiseRisk(taskpolicy.RiskHigh)
case evidence.RiskMedium:
p.RaiseRisk(taskpolicy.RiskMedium)
}
}
// Scope overrun: the change set grew well past a single-surface judgment.
if paths := a.task.ledger.PathsSince(-1); len(paths) > 8 && p.Risk < taskpolicy.RiskMedium {
p.RaiseRisk(taskpolicy.RiskMedium)
}
// Conditional review escalates to forced when acceptance coverage is weak,
// ambiguous, or uncovered, or when required verification failed or never ran.
if p.Review == taskpolicy.ReviewConditional {
incomplete, hasTodos := a.task.ledger.IncompleteLatestTodos()
weakCoverage := hasTodos && len(incomplete) > 0
if !weakCoverage && p.Evidence >= taskpolicy.EvidenceClosedLoop {
if mutation, ok := a.task.ledger.LatestSuccessfulMutationIndex(); ok {
weakCoverage = !a.task.ledger.HasSuccessfulVerificationCommandAfter(mutation) &&
!a.task.ledger.HasSuccessfulReviewAfter(mutation)
}
}
if weakCoverage {
p.EscalateConditionalReview("weak_evidence_coverage")
}
}
}
internal/agent/final_readiness_recovery_test.go
+4 -4
View File
@@ -24,8 +24,8 @@ func TestTargetedVerificationGapDoesNotArmRecovery(t *testing.T) {
if err := a.Run(context.Background(), "write docs/verify_v070.md and run the validation script"); err != nil {
t.Fatalf("targeted Run returned a readiness failure: %v", err)
}
if policy, ok := a.TurnPolicy(); !ok || policy.ClosedLoop() {
t.Fatalf("targeted standard turn unexpectedly elevated to closed loop: %+v", policy)
if a.closedLoopActive() {
t.Fatal("ordinary targeted turn unexpectedly elevated to closed loop")
}
if a.PrepareDeliveryRecovery() {
t.Fatal("a soft targeted-verification gap must not create a recovery card")
@@ -47,7 +47,7 @@ func TestTargetedVerificationRecoverySurvivesAgentRebuild(t *testing.T) {
a := New(first, reg, session, Options{}, event.Discard)
var readinessErr *FinalReadinessError
if err := a.Run(withClosedLoopContext(context.Background()), "write docs/verify_v070.md and run the validation script"); !errors.As(err, &readinessErr) {
if err := a.Run(context.Background(), "write docs/verify_v070.md and run the validation script"); !errors.As(err, &readinessErr) {
t.Fatalf("first Run error = %v, want final readiness failure", err)
}
var marker *provider.FinalReadinessRecovery
@@ -95,7 +95,7 @@ func TestTargetedVerificationRecoverySurvivesAgentRebuild(t *testing.T) {
func TestFinalReadinessRecoveryRejectsStaleMarkerAfterUserTurn(t *testing.T) {
reg := evidenceRegistry()
prov := &scriptedProvider{name: "standard", turns: [][]provider.Chunk{
{toolCallChunk("write", "write_file", `{"path":"README.md"}`), {Type: provider.ChunkDone}},
{toolCallChunk("write", "write_file", `{"path":"main.go"}`), {Type: provider.ChunkDone}},
{{Type: provider.ChunkText, Text: "done"}, {Type: provider.ChunkDone}},
}}
session := NewSession("sys")
internal/agent/fork_test.go
+4 -2
View File
@@ -17,8 +17,10 @@ import (
func forkScriptTurns() [][]provider.Chunk {
return [][]provider.Chunk{
{toolCallChunk("c1", "write_file", `{"path":"a.py","content":"x"}`)},
{toolCallChunk("c2", "write_file", `{"path":"b.py","content":"x"}`)},
{toolCallChunk("c3", "write_file", `{"path":"c.py","content":"x"}`)},
// Keep this fixture single-target: it measures the evidence-blindness
// fork, not the cumulative multi-file precondition guard.
{toolCallChunk("c2", "write_file", `{"path":"a.py","content":"y"}`)},
{toolCallChunk("c3", "write_file", `{"path":"a.py","content":"z"}`)},
{{Type: provider.ChunkText, Text: "done"}},
}
}
internal/agent/legacy_execution_policy_test.go
+38
View File
@@ -0,0 +1,38 @@
package agent
import (
"context"
"strings"
"testing"
"reasonix/internal/event"
"reasonix/internal/provider"
"reasonix/internal/tool"
)
func TestLegacyExecutionPolicyIsStrippedFromProviderRequest(t *testing.T) {
sess := NewSession("system")
sess.Add(provider.Message{
Role: provider.RoleUser,
Content: "fix parser.go\n\n<execution-policy version=\"2\">\nroute=full-plan risk=high\n</execution-policy>",
RawContent: "fix parser.go",
})
sess.Add(provider.Message{Role: provider.RoleAssistant, Content: "looking"})
prov := &userInputCaptureProvider{}
a := New(prov, tool.NewRegistry(), sess, Options{}, event.Discard)
if err := a.Run(WithRawUserInput(context.Background(), "continue"), "continue"); err != nil {
t.Fatalf("Run: %v", err)
}
for _, m := range prov.request.Messages {
if m.Role == provider.RoleUser && strings.Contains(m.Content, "<execution-policy") {
t.Fatalf("historical execution-policy leaked into provider request: %q", m.Content)
}
}
stored := sess.Snapshot()
if !strings.Contains(stored[1].Content, "<execution-policy version=\"2\">") {
t.Fatal("stored historical execution-policy must remain readable")
}
if stored[1].RawContent != "fix parser.go" {
t.Fatalf("raw content rewritten: %q", stored[1].RawContent)
}
}
internal/agent/parallel_tasks_test.go
+13 -13
View File
@@ -13,7 +13,7 @@ import (
"reasonix/internal/event"
"reasonix/internal/provider"
"reasonix/internal/taskpolicy"
"reasonix/internal/runtimepolicy"
"reasonix/internal/tool"
"reasonix/internal/workspacelease"
)
@@ -490,22 +490,22 @@ func TestChildMaxStepsSharedDefault(t *testing.T) {
}
}
func TestTaskToolPropagatesInheritedTaskPolicyToSubagents(t *testing.T) {
parent := taskpolicy.TaskPolicy{
Evidence: taskpolicy.EvidenceClosedLoop,
Review: taskpolicy.ReviewForced,
Risk: taskpolicy.RiskHigh,
func TestTaskToolPropagatesInheritedExecutionToSubagents(t *testing.T) {
parent := runtimepolicy.InheritedExecutionContext{
Constraints: runtimepolicy.Constraints{ForbidMutation: true},
PlanReadOnly: true,
GoalScopeID: "goal-1",
}
task := &TaskTool{}
opts := task.subagentOptions(taskpolicy.WithContext(context.Background(), parent), 0, nil, 0, 1, "", nil)
if opts.InheritedTaskPolicy == nil {
t.Fatal("sub-agent options did not inherit parent TaskPolicy")
opts := task.subagentOptions(runtimepolicy.WithInherited(context.Background(), parent), 0, nil, 0, 1, "", nil)
if opts.InheritedExecution == nil {
t.Fatal("sub-agent options did not inherit parent execution context")
}
if !opts.InheritedTaskPolicy.ClosedLoop() {
t.Fatal("inherited TaskPolicy lost closed-loop evidence")
if !opts.InheritedExecution.PlanReadOnly || !opts.InheritedExecution.Constraints.ForbidMutation {
t.Fatalf("inherited execution = %+v", opts.InheritedExecution)
}
if opts.InheritedTaskPolicy.Review != taskpolicy.ReviewForced {
t.Fatalf("inherited review = %v, want forced", opts.InheritedTaskPolicy.Review)
if opts.InheritedExecution.GoalScopeID != "goal-1" {
t.Fatalf("inherited goal scope = %q", opts.InheritedExecution.GoalScopeID)
}
}
internal/agent/planned_mutation_policy.go
+30 -24
View File
@@ -1,36 +1,42 @@
package agent
import (
"reasonix/internal/evidence"
"reasonix/internal/taskpolicy"
"strings"
"reasonix/internal/runtimepolicy"
)
// applyTaskPolicyPreflight classifies the resolved call and applies host-only
// policy before closed-loop recovery, Auto Guard, and ordinary permission. A
// call the frozen user constraints already forbid therefore cannot create an
// avoidable approval prompt.
func (a *Agent) applyTaskPolicyPreflight(turn *turnRuntime, plan *toolCallPlan) (toolOutcome, bool) {
// applyExecutionPreflight classifies the resolved call and applies the
// monotonic guard pipeline before recovery, Auto Guard, and permission.
func (a *Agent) applyExecutionPreflight(_ *turnRuntime, plan *toolCallPlan) (toolOutcome, bool) {
plan.classifyEffects()
a.escalatePolicyForPlannedMutation(turn, plan)
policyArgs := plan.permArgs
if len(plan.resolved.Args) > 0 {
policyArgs = plan.resolved.Args
decision := a.pipelineDecision(plan)
switch decision.Action {
case runtimepolicy.GuardDeny:
return policyBlock(decision.Message, firstLine(decision.Message))
case runtimepolicy.GuardAsk:
if !a.hasInteractiveAsk() {
return policyBlock(decision.Message, firstLine(decision.Message))
}
// Permission/Ask still owns the interactive prompt; do not wait here.
}
return a.taskPolicyToolGate(plan, policyArgs)
return toolOutcome{}, false
}
// escalatePolicyForPlannedMutation closes the gap between intent-level routing
// and the concrete target selected by the model. The ratchet is deterministic:
// ordinary calls keep the same provider request count and cache prefix, while
// sensitive or opaque writers enter the stronger policy before mutation.
func (a *Agent) escalatePolicyForPlannedMutation(turn *turnRuntime, plan *toolCallPlan) {
if a == nil || turn == nil || plan == nil || plan.readOnly || !turn.policySet || !turn.policy.AllowsMutation() || !plan.effects.ContentMutation {
return
func policyBlock(output, reason string) (toolOutcome, bool) {
output = strings.TrimSpace(output)
reason = strings.TrimSpace(reason)
if output == "" {
output = reason
}
switch evidence.ClassifyToolCallMutationRiskWithin(a.writeWorkspaceRoot, plan.evidenceName, plan.evidenceArgs, plan.readOnly) {
case evidence.RiskHigh:
turn.policy.RaiseRisk(taskpolicy.RiskHigh)
case evidence.RiskMedium:
turn.policy.RaiseRisk(taskpolicy.RiskMedium)
if !strings.HasPrefix(output, "blocked:") {
output = "blocked: " + output
}
if reason == "" {
reason = output
}
if !strings.HasPrefix(reason, "blocked:") {
reason = "blocked: " + reason
}
return toolOutcome{output: output, blocked: true, errMsg: firstLine(reason)}, true
}
internal/agent/planner_adaptive_research_test.go
+3 -3
View File
@@ -21,7 +21,7 @@ func TestCoordinatorPlannerDepthDoesNotCapResearchRounds(t *testing.T) {
reg := tool.NewRegistry()
reg.Add(coordinatorTestTool{name: "read_file", readOnly: true, output: "ok"})
policy := func(context.Context, string) PlannerDecision {
return PlannerDecision{Route: PlannerRoutePlanAndExecute, Depth: PlannerDepthLight, Reason: "adaptive_work"}
return PlannerDecision{Route: PlannerRoutePlanAndExecute, Reason: "adaptive_work"}
}
executor := New(exec, tool.NewRegistry(), NewSession("exec-sys"), Options{}, event.Discard)
coord := NewCoordinatorWithPlannerPolicy(planner, NewSession("planner-sys"), nil,
@@ -63,7 +63,7 @@ func TestCoordinatorEmergencyBoundedPlannerCanSubmitPlanInFinalizationRound(t *t
coord := NewCoordinatorWithPlannerPolicy(planner, plannerSess, nil, PlannerToolRegistry(reg),
Options{MaxSteps: 2, MaxStepsKey: "planner emergency rounds"}, executor, 0, sink,
func(context.Context, string) PlannerDecision {
return PlannerDecision{Route: PlannerRoutePlanAndExecute, Depth: PlannerDepthLight, Reason: "emergency_bounded_work"}
return PlannerDecision{Route: PlannerRoutePlanAndExecute, Reason: "emergency_bounded_work"}
})
if err := coord.Run(withNoClosedLoop(context.Background()), "fix the planner bug"); err != nil {
@@ -115,7 +115,7 @@ func TestCoordinatorTaskBudgetLetsPlannerSubmitTerminalPlan(t *testing.T) {
executor := New(exec, tool.NewRegistry(), NewSession("exec-sys"), Options{}, event.Discard)
coord := NewCoordinatorWithPlannerPolicy(planner, NewSession("planner-sys"), nil, PlannerToolRegistry(reg),
Options{}, executor, 0, sink, func(context.Context, string) PlannerDecision {
return PlannerDecision{Route: PlannerRoutePlanAndExecute, Depth: PlannerDepthFull, Reason: "budgeted_work"}
return PlannerDecision{Route: PlannerRoutePlanAndExecute, Reason: "budgeted_work"}
})
ctx := withNoClosedLoop(WithTaskBudget(context.Background(), TaskBudget{Tokens: 1}))
internal/agent/planner_route.go
+5 -20
View File
@@ -17,24 +17,15 @@ const (
PlannerRoutePlanOnly PlannerRoute = "plan_only"
)
// PlannerDepth controls how much evidence and detail the planning contract asks
// for. It deliberately does not impose a model-round budget: planning lands on
// submit_plan and the shared adaptive progress, task-budget, and context guards
// own runaway protection. None is only valid for ExecutorOnly.
type PlannerDepth string
const (
PlannerDepthNone PlannerDepth = "none"
PlannerDepthLight PlannerDepth = "light"
PlannerDepthFull PlannerDepth = "full"
)
// PlannerIntent is the explicit planner request for one turn. Ordinary work is
// always executor-only; the planner never infers complexity from wording.
type PlannerIntent = PlannerRoute
// PlannerDecision is the deterministic, host-owned routing result for one turn.
// Reason is an opaque privacy-safe code for diagnostics; user text never belongs
// in it.
type PlannerDecision struct {
Route PlannerRoute
Depth PlannerDepth
Reason string
}
@@ -44,15 +35,9 @@ type PlannerPolicy func(context.Context, string) PlannerDecision
func normalizePlannerDecision(d PlannerDecision) PlannerDecision {
switch d.Route {
case PlannerRouteExecutorOnly:
d.Depth = PlannerDepthNone
case PlannerRoutePlanAndExecute, PlannerRoutePlanForApproval, PlannerRoutePlanOnly:
if d.Depth != PlannerDepthLight && d.Depth != PlannerDepthFull {
d.Depth = PlannerDepthFull
}
case PlannerRouteExecutorOnly, PlannerRoutePlanAndExecute, PlannerRoutePlanForApproval, PlannerRoutePlanOnly:
default:
d.Route = PlannerRoutePlanAndExecute
d.Depth = PlannerDepthFull
d.Route = PlannerRouteExecutorOnly
}
d.Reason = strings.TrimSpace(d.Reason)
if d.Reason == "" {
internal/agent/readiness_partial.go
+21 -8
View File
@@ -2,6 +2,7 @@ package agent
import (
"reasonix/internal/completion"
"reasonix/internal/taskcontract"
)
// applyPartialCheckWaiver stands down project-check and post-write verification
@@ -13,33 +14,45 @@ func (a *Agent) applyPartialCheckWaiver(out finalReadinessCheck) finalReadinessC
return out
}
if out.incompleteTodos > 0 || out.missingMutation > 0 || out.missingActionEvidence > 0 ||
out.missingCapabilities > 0 || out.missingAcceptanceCriteria > 0 ||
out.missingReview > 0 || out.missingSignoff > 0 {
out.missingCapabilities > 0 {
return out
}
if out.missingProjectChecks == 0 && out.missingVerification == 0 {
if a.closedLoopActive() && (out.missingAcceptanceCriteria > 0 || out.missingReview > 0 || out.missingSignoff > 0) {
return out
}
if out.missingProjectChecks > 0 && !a.turn.constraints.ForbidTests {
claim, ok := completion.LatestCompleteClaim(a.task.ledger)
if a.closedLoopActive() || !ok || len(claim.Unverified) == 0 {
return out
}
}
out.reason = ""
out.missingProjectChecks = 0
out.missingVerification = 0
if !a.closedLoopActive() {
out.missingReview = 0
out.applies = false
}
return out
}
// allowsPartialWithoutChecks reports whether the frozen TaskPolicy permits a
// allowsPartialWithoutChecks reports whether the current contract permits a
// Partial/Unverified ending without checks. Closed-loop turns never waive
// checks silently; only a user's explicit no-tests constraint may end Partial,
// and the summary must still mark the unverified parts.
func (a *Agent) allowsPartialWithoutChecks() bool {
if a.turn.policySet {
return a.turn.policy.AllowsPartialWithoutChecks()
if a.turn.engine != nil {
for _, o := range a.turn.engine.Snapshot().Unsatisfied() {
if o.Enforcement == taskcontract.EnforcementStrict {
return false
}
}
}
// Direct construction without a frozen policy keeps the historical default.
return true
}
func (a *Agent) mayWaiveUnavailableChecks() bool {
if a.turn.policySet && a.turn.policy.Constraints.ForbidTests {
if a.turn.constraints.ForbidTests || !a.closedLoopActive() {
return true
}
claim, ok := completion.LatestCompleteClaim(a.task.ledger)
internal/agent/readiness_partial_test.go
+7 -19
View File
@@ -6,7 +6,7 @@ import (
"reasonix/internal/evidence"
"reasonix/internal/instruction"
"reasonix/internal/taskpolicy"
"reasonix/internal/runtimepolicy"
"reasonix/internal/tool"
)
@@ -20,10 +20,7 @@ func TestPartialWaiverStandsDownUnavailableChecksOnBalanced(t *testing.T) {
)},
projectChecks: []instruction.VerifyCheck{check},
svc: agentServices{tools: tool.NewRegistry()},
turn: turnRuntime{
policy: taskpolicy.TaskPolicy{Evidence: taskpolicy.EvidenceTargeted, Verification: taskpolicy.VerifyTargeted},
policySet: true,
},
turn: turnRuntime{engine: runtimepolicy.NewEngine(runtimepolicy.Constraints{})},
}
got := a.ReadinessResult()
if !got.Ready {
@@ -38,10 +35,7 @@ func TestPartialWaiverDoesNotClearIncompleteTodos(t *testing.T) {
task: taskRuntime{ledger: readinessLedger(writer, todo,
evidence.Receipt{ToolName: "update_goal", Success: true, Args: []byte(`{"status":"complete","completion":{"unverified":["e2e"]}}`)},
)},
turn: turnRuntime{
policy: taskpolicy.TaskPolicy{Evidence: taskpolicy.EvidenceTargeted, Verification: taskpolicy.VerifyTargeted},
policySet: true,
},
turn: turnRuntime{engine: runtimepolicy.NewEngine(runtimepolicy.Constraints{})},
}
got := a.ReadinessResult()
if got.Ready || !strings.Contains(got.Reason, "incomplete") {
@@ -60,10 +54,7 @@ func TestPartialWaiverStaysClosedOnDelivery(t *testing.T) {
)},
projectChecks: []instruction.VerifyCheck{check},
svc: agentServices{tools: reg},
turn: turnRuntime{
policy: taskpolicy.TaskPolicy{Evidence: taskpolicy.EvidenceClosedLoop, Verification: taskpolicy.VerifyFull},
policySet: true,
},
turn: turnRuntime{deliveryScopeActive: true, engine: runtimepolicy.NewEngine(runtimepolicy.Constraints{})},
}
got := a.ReadinessResult()
if got.Ready {
@@ -87,13 +78,10 @@ func TestForbidTestsWaivesProjectChecksEvenOnDelivery(t *testing.T) {
projectChecks: []instruction.VerifyCheck{check},
svc: agentServices{tools: reg},
turn: turnRuntime{
policy: taskpolicy.TaskPolicy{
Evidence: taskpolicy.EvidenceClosedLoop,
Verification: taskpolicy.VerifyFull,
Constraints: taskpolicy.Constraints{ForbidTests: true},
},
policySet: true,
constraints: runtimepolicy.Constraints{ForbidTests: true},
engine: runtimepolicy.NewEngine(runtimepolicy.Constraints{ForbidTests: true}),
deliveryCriteriaEstablished: true,
deliveryScopeActive: true,
},
}
got := a.ReadinessResult()
internal/agent/run_loop.go
+34 -34
View File
@@ -11,8 +11,7 @@ import (
"reasonix/internal/event"
"reasonix/internal/evidence"
"reasonix/internal/provider"
"reasonix/internal/taskintent"
"reasonix/internal/taskpolicy"
"reasonix/internal/runtimepolicy"
"reasonix/internal/tool"
)
@@ -171,40 +170,40 @@ func (a *Agent) beginRunTurn(ctx context.Context, input string) (rawInput string
} else if strings.TrimSpace(a.turn.turnInput) == "" {
a.turn.turnInput = rawInput
}
intent := taskintent.Classify(a.turn.turnInput)
a.turn.deliveryTaskExpected = intent.NeedsEvidence()
a.turn.deliveryMutationExpected = intent == taskintent.Mutation && registryHasWriterTools(a.svc.tools)
a.turn.deliveryPersistentExpected = taskintent.NeedsPersistentAction(a.turn.turnInput)
a.turn.recoveryTaskSummary = boundedRecoveryTaskSummary(a.turn.turnInput)
// Planner-gate policy wins; otherwise derive. Writer children inherit floors.
if policy, ok := taskpolicy.FromContext(ctx); ok {
a.turn.policy = policy
if constraints, ok := runtimepolicy.FromContext(ctx); ok {
a.turn.constraints = constraints
} else {
a.turn.policy = taskpolicy.Derive(taskpolicy.Input{
Raw: a.turn.turnInput,
Instruction: taskpolicy.StripQuotedConstraints(a.turn.turnInput),
PlanMode: a.planMode.Load(),
})
a.turn.constraints = runtimepolicy.ParseConstraints(runtimepolicy.StripQuotedConstraints(a.turn.turnInput))
if a.planMode.Load() {
a.turn.constraints.PlanModeReadOnly = true
a.turn.constraints.ForbidMutation = true
}
}
if a.inheritedPolicy != nil && !a.readOnlyExecution {
a.turn.policy.InheritFrom(*a.inheritedPolicy)
if inherited, ok := runtimepolicy.InheritedFromContext(ctx); ok && !a.readOnlyExecution {
a.turn.constraints = mergeInheritedConstraints(a.turn.constraints, inherited.Constraints)
if inherited.PlanReadOnly {
a.turn.constraints.PlanModeReadOnly = true
a.turn.constraints.ForbidMutation = true
}
} else if a.inheritedExec != nil && !a.readOnlyExecution {
a.turn.constraints = mergeInheritedConstraints(a.turn.constraints, a.inheritedExec.Constraints)
if a.inheritedExec.PlanReadOnly {
a.turn.constraints.PlanModeReadOnly = true
a.turn.constraints.ForbidMutation = true
}
}
a.turn.policySet = true
a.turn.engine = runtimepolicy.NewEngine(a.turn.constraints)
a.rebuildTurnContract()
// A cancelled/error turn leaves a provider-excluded recovery record at the
// transcript tail. Fold its bounded facts into this new user turn exactly
// once; the user's raw text remains the classifier source above.
// once; the user's raw text remains the source above.
a.ensureUnreplayableHistoryRecovery()
providerInput = withInterruptedRecovery(providerInput, a.pendingInterruptedRecovery())
a.task.prepareScope(scoped, scope.ID)
a.svc.sink.Emit(event.Event{Kind: event.TurnStarted})
a.emitTurnPhase(event.TurnPhaseWorking)
input = a.withTurnPreferences(providerInput)
// Persist the short execution-policy block in provider Content; keep the
// original user text in RawContent for history/title/rewind stripping.
policyBlock := taskpolicy.ExecutionPolicyBlock(a.turn.policy)
if !strings.Contains(input, "<execution-policy") {
input = strings.TrimSpace(input) + "\n\n" + policyBlock
}
userCreatedAt := time.Now().UnixMilli()
a.activeTurnCreatedAt.Store(userCreatedAt)
rawContent := rawInput
@@ -520,15 +519,16 @@ func (a *Agent) handleFinalResponse(ctx context.Context, state *turnRuntime, tex
return false, a.gracePause(state)
}
if readiness.reason != "" {
// Delivery no longer retries readiness with hidden model messages: the
// run ends immediately with the missing requirements, and the host owns
// what happens next. In Goal mode the FSM auto-continues under budget
// with the missing list as the next turn; plain Delivery turns surface
// the recovery card for an explicit user continuation.
event.RecordReadinessAudit(a.svc.sink, readiness.audit(evidence.ReadinessErrored, false))
a.pending.finalReadinessRecovery = true
a.persistFinalReadinessRecovery(readiness.missingIDs())
return false, &FinalReadinessError{Attempts: 1, Reason: readiness.reason, Missing: readiness.missingIDs()}
// Goal/Plan and fact contradictions (open todos, sign-off, action
// receipts) fail the run. Ordinary Recoverable/project/review gaps
// become an honest Partial completion instead of a recovery error.
if a.closedLoopActive() || readiness.incompleteTodos > 0 || readiness.missingSignoff > 0 || readiness.missingActionEvidence > 0 {
event.RecordReadinessAudit(a.svc.sink, readiness.audit(evidence.ReadinessErrored, false))
a.pending.finalReadinessRecovery = true
a.persistFinalReadinessRecovery(readiness.missingIDs())
return false, &FinalReadinessError{Attempts: 1, Reason: readiness.reason, Missing: readiness.missingIDs()}
}
event.RecordReadinessAudit(a.svc.sink, readiness.audit(evidence.ReadinessAllowed, a.turn.readinessRecovered))
}
if !hasVisibleFinalAnswer(text) {
// DeepSeek thinking mode can stream a long reasoning_content and
@@ -557,7 +557,7 @@ func (a *Agent) handleFinalResponse(ctx context.Context, state *turnRuntime, tex
a.contextManager().ObserveUsage(usage)
return true, nil
}
if readiness.applies {
if readiness.applies || a.turn.readinessRecovered {
event.RecordReadinessAudit(a.svc.sink, readiness.audit(evidence.ReadinessAllowed, a.turn.readinessRecovered))
}
a.emitTurnShadows(a.turn.turnInput)
internal/agent/sampling_request.go
+3
View File
@@ -92,6 +92,9 @@ func (a *Agent) buildSamplingRequest(ctx context.Context, trigger string) (sampl
requestMessages = a.providerProjectionMessages(requestMessages)
for i := range requestMessages {
requestMessages[i].CreatedAt = 0
if requestMessages[i].Role == provider.RoleUser {
requestMessages[i].Content = reTrailingExecutionPolicy.ReplaceAllString(requestMessages[i].Content, "")
}
}
// context.prepare: extensions may rewrite the message copy feeding THIS
// request. The session log is never touched — the replacement is
internal/agent/task.go
+6 -4
View File
@@ -23,9 +23,9 @@ import (
"reasonix/internal/permission"
"reasonix/internal/planmode"
"reasonix/internal/provider"
"reasonix/internal/runtimepolicy"
"reasonix/internal/sandbox"
"reasonix/internal/sessiontemp"
"reasonix/internal/taskpolicy"
"reasonix/internal/tool"
"reasonix/internal/workspacelease"
)
@@ -1620,9 +1620,11 @@ func (t *TaskTool) subagentOptions(ctx context.Context, maxSteps int, pricing *p
// Writer children inherit the parent turn's frozen risk and closure floors.
// The parent publishes its policy into the run context; a child that never
// received it (direct unit construction) keeps its own derived policy.
if parent, ok := taskpolicy.FromContext(ctx); ok {
p := parent
opts.InheritedTaskPolicy = &p
if inherited, ok := runtimepolicy.InheritedFromContext(ctx); ok {
copy := inherited
opts.InheritedExecution = &copy
} else if constraints, ok := runtimepolicy.FromContext(ctx); ok {
opts.InheritedExecution = &runtimepolicy.InheritedExecutionContext{Constraints: constraints}
}
return opts
}
internal/agent/task_test.go
+3 -3
View File
@@ -968,7 +968,7 @@ func TestBackgroundEvidenceNotCommittedWhenTurnFails(t *testing.T) {
// so the next turn can review it instead of shipping it unreviewed.
jm := jobs.NewManager(event.Discard)
defer jm.Close()
jobID := startTerminalBackgroundMutation(t, jm, "parent-session", "qa/bank.md")
jobID := startTerminalBackgroundMutation(t, jm, "parent-session", "internal/auth/session.go")
reg := evidenceRegistry()
waitBuiltin(t, reg)
@@ -1032,7 +1032,7 @@ func TestBackgroundEvidenceCommittedWhenTurnDelivers(t *testing.T) {
func TestFailedTurnBackgroundMutationForcesReadinessOnNextRunWithoutWait(t *testing.T) {
jm := jobs.NewManager(event.Discard)
defer jm.Close()
jobID := startTerminalBackgroundMutation(t, jm, "parent-session", "qa/bank.md")
jobID := startTerminalBackgroundMutation(t, jm, "parent-session", "internal/auth/session.go")
reg := evidenceRegistry()
waitBuiltin(t, reg)
@@ -1079,7 +1079,7 @@ func TestRestartRecoversPendingBackgroundMutationForcesReadinessWithoutWait(t *t
first.SetActiveSessionPath("parent-session", sessionPath)
j := first.StartForSession("parent-session", "task", "bg writer", func(ctx context.Context, _ io.Writer) (string, error) {
jobs.PublishEvidence(ctx, evidence.ChildEvidenceSummary{Receipts: []evidence.Receipt{{
ToolName: "write_file", Success: true, Write: true, Mutation: true, Paths: []string{"qa/bank.md"},
ToolName: "write_file", Success: true, Write: true, Mutation: true, Paths: []string{"internal/auth/session.go"},
}}})
return "background answer", nil
})
internal/agent/taskpolicy_execution_test.go
+45 -102
View File
@@ -12,17 +12,41 @@ import (
"reasonix/internal/event"
"reasonix/internal/evidence"
"reasonix/internal/provider"
"reasonix/internal/taskpolicy"
"reasonix/internal/runtimepolicy"
"reasonix/internal/taskcontract"
"reasonix/internal/tool"
)
func setTurnConstraints(a *Agent, raw string) {
c := runtimepolicy.ParseConstraints(runtimepolicy.StripQuotedConstraints(raw))
a.turn.constraints = c
a.turn.engine = runtimepolicy.NewEngine(c)
}
func TestRebuildTurnContractEnforcesExplicitFullVerification(t *testing.T) {
a := New(nil, tool.NewRegistry(), NewSession(""), Options{}, event.Discard)
a.resetTurnEvidence()
setTurnConstraints(a, "请闭环交付")
a.task.ledger.Record(evidence.Receipt{
ToolName: "edit_file", Success: true, Write: true, Mutation: true,
Args: json.RawMessage(`{"path":"README.md"}`), Paths: []string{"README.md"},
})
a.rebuildTurnContract()
for _, obligation := range a.turn.engine.Snapshot().Unsatisfied() {
if obligation.Kind == taskcontract.ObligationFullVerify && obligation.Enforcement == taskcontract.EnforcementStrict {
return
}
}
t.Fatalf("Agent rebuild dropped explicit full verification: %+v", a.turn.engine.Snapshot().Obligations)
}
func TestTaskPolicyUsesStructuredCommandEffects(t *testing.T) {
var calls int32
reg := tool.NewRegistry()
reg.Add(fakeTool{name: "bash", readOnly: false, calls: &calls})
a := New(&scriptedProvider{name: "p"}, reg, NewSession("sys"), Options{}, event.Discard)
a.turn.policy = taskpolicy.TaskPolicy{Constraints: taskpolicy.Constraints{ForbidMutation: true}}
a.turn.policySet = true
a.turn.constraints = runtimepolicy.Constraints{ForbidMutation: true}
a.turn.engine = runtimepolicy.NewEngine(a.turn.constraints)
listing := a.executeOne(context.Background(), &a.turn, provider.ToolCall{Name: "bash", Arguments: `{"command":"git branch -a"}`})
if listing.blocked || listing.errMsg != "" {
@@ -50,8 +74,8 @@ func TestTaskPolicyUsesStructuredCommandEffects(t *testing.T) {
t.Fatal(err)
}
got := a.executeOne(context.Background(), &a.turn, provider.ToolCall{Name: "bash", Arguments: string(args)})
if !got.blocked || !strings.Contains(got.errMsg, tt.wantDomain) {
t.Fatalf("command %q outcome = %+v, want %q mutation block", tt.command, got, tt.wantDomain)
if !got.blocked || !strings.Contains(got.output, "forbid") {
t.Fatalf("command %q outcome = %+v, want mutation block", tt.command, got)
}
if strings.Contains(got.errMsg, tt.secret) && tt.secret != "--edit" {
t.Fatalf("policy error leaked command operand %q: %q", tt.secret, got.errMsg)
@@ -68,8 +92,7 @@ func TestTaskPolicyEnforcesVerificationAllowlist(t *testing.T) {
reg := tool.NewRegistry()
reg.Add(fakeTool{name: "bash", readOnly: true, calls: &calls})
a := New(&scriptedProvider{name: "p"}, reg, NewSession("sys"), Options{}, event.Discard)
a.turn.policy = taskpolicy.Derive(taskpolicy.Input{Raw: "fix it; only run go test ./internal/parser"})
a.turn.policySet = true
setTurnConstraints(a, "fix it; only run go test ./internal/parser")
a.turn.deliveryCriteriaEstablished = true
for _, command := range []string{"npm test", "go vet ./...", "golangci-lint run", "npm run typecheck"} {
@@ -97,15 +120,14 @@ func TestTaskPolicyForbidTestsBlocksEveryVerifier(t *testing.T) {
reg := tool.NewRegistry()
reg.Add(fakeTool{name: "bash", readOnly: true, calls: &calls})
a := New(&scriptedProvider{name: "p"}, reg, NewSession("sys"), Options{}, event.Discard)
a.turn.policy = taskpolicy.Derive(taskpolicy.Input{Raw: "fix it; don't run tests"})
a.turn.policySet = true
setTurnConstraints(a, "fix it; don't run tests")
a.turn.deliveryCriteriaEstablished = true
for _, command := range []string{"go test ./...", "go vet ./...", "golangci-lint run", "npm run typecheck"} {
got := a.executeOne(context.Background(), &a.turn, provider.ToolCall{
Name: "bash", Arguments: `{"command":` + strconv.Quote(command) + `}`,
})
if !got.blocked || !strings.Contains(got.errMsg, "forbids verification commands") {
if !got.blocked || !strings.Contains(got.output, "forbid") {
t.Fatalf("%s outcome = %+v, want user-constraint block", command, got)
}
}
@@ -114,25 +136,11 @@ func TestTaskPolicyForbidTestsBlocksEveryVerifier(t *testing.T) {
}
}
func TestTaskPolicyBlocksDisallowedExploreSubagent(t *testing.T) {
reg := tool.NewRegistry()
reg.Add(fakeTool{name: "explore", readOnly: true})
a := New(&scriptedProvider{name: "p"}, reg, NewSession("sys"), Options{}, event.Discard)
a.turn.policy = taskpolicy.TaskPolicy{AllowExploreSubagent: false}
a.turn.policySet = true
got := a.executeOne(context.Background(), &a.turn, provider.ToolCall{Name: "explore", Arguments: `{}`})
if !got.blocked || !strings.Contains(got.errMsg, "exploration sub-agent") {
t.Fatalf("explore outcome = %+v, want task-policy block", got)
}
}
func TestTaskPolicyBlocksExternalActionCommandVariants(t *testing.T) {
reg := tool.NewRegistry()
reg.Add(fakeTool{name: "bash", readOnly: false})
a := New(&scriptedProvider{name: "p"}, reg, NewSession("sys"), Options{}, event.Discard)
a.turn.policy = taskpolicy.Derive(taskpolicy.Input{Raw: "fix it, but don't push"})
a.turn.policySet = true
setTurnConstraints(a, "fix it, but don't push")
a.turn.deliveryCriteriaEstablished = true
a.setTodoState([]evidence.TodoItem{{Content: "fix it", Status: "in_progress"}})
@@ -146,7 +154,7 @@ func TestTaskPolicyBlocksExternalActionCommandVariants(t *testing.T) {
t.Fatal(err)
}
got := a.executeOne(context.Background(), &a.turn, provider.ToolCall{Name: "bash", Arguments: string(args)})
if !got.blocked || !strings.Contains(got.errMsg, "external action") {
if !got.blocked || !(strings.Contains(got.output, "external") || strings.Contains(got.output, "push") || strings.Contains(got.output, "publish") || strings.Contains(got.output, "deploy")) {
t.Fatalf("command %q outcome = %+v, want task-policy block", command, got)
}
}
@@ -161,14 +169,13 @@ func TestTaskPolicyBlocksResolvedExternalCapability(t *testing.T) {
reg := tool.NewRegistry()
reg.Add(proxy)
a := New(nil, reg, NewSession("sys"), Options{}, event.Discard)
a.turn.policy = taskpolicy.Derive(taskpolicy.Input{Raw: "prepare the release, but don't deploy"})
a.turn.policySet = true
setTurnConstraints(a, "prepare the release, but don't deploy")
got := a.executeOne(context.Background(), &a.turn, provider.ToolCall{
ID: "deploy-1", Name: "use_capability", Arguments: `{"action":"call","capability_id":"mcp-tool:vercel/deploy_project"}`,
})
if !got.blocked || !strings.Contains(got.errMsg, "external action") {
t.Fatalf("resolved deploy outcome = %+v, want task-policy block", got)
if !got.blocked || !strings.Contains(got.output, "deploy") {
t.Fatalf("resolved deploy outcome = %+v, want deploy block", got)
}
if calls != 0 {
t.Fatalf("resolved deploy Execute calls = %d, want 0", calls)
@@ -183,10 +190,7 @@ func TestTaskPolicyReportsPostMutationVerificationGapWithoutBlockingTargetedTurn
a := &Agent{
task: taskRuntime{ledger: readinessLedger(check, writer)},
svc: agentServices{tools: reg},
turn: turnRuntime{
policy: taskpolicy.TaskPolicy{Verification: taskpolicy.VerifyTargeted},
policySet: true,
},
turn: turnRuntime{engine: runtimepolicy.NewEngine(runtimepolicy.Constraints{})},
}
if got := a.finalReadinessCheckFor(); got.reason != "" {
t.Fatalf("targeted readiness = %+v, want quality gap to remain non-blocking", got)
@@ -197,59 +201,13 @@ func TestTaskPolicyReportsPostMutationVerificationGapWithoutBlockingTargetedTurn
}
}
func TestTaskPolicyAtomicContractRejectsFinalWithoutMutation(t *testing.T) {
policy := taskpolicy.Derive(taskpolicy.Input{Raw: "fix the typo in README.md", Anchored: true})
if !policy.RequireAtomicContract {
t.Fatal("test setup: expected atomic policy")
}
ledger := readinessLedger(evidence.Receipt{ToolName: "read_file", Success: true, Read: true, Paths: []string{"README.md"}})
a := &Agent{
task: taskRuntime{ledger: ledger},
turn: turnRuntime{policy: policy, policySet: true},
}
got := a.finalReadinessCheckFor()
if !strings.Contains(got.reason, "atomic modification contract") || got.missingMutation != 1 {
t.Fatalf("readiness = %+v, want missing atomic mutation", got)
}
a.armLoopGuardPass(ledger.Len())
if got := a.finalReadinessCheckFor(); got.reason == "" {
t.Fatal("loop guard must not convert a missing atomic mutation into completion")
}
ledger.Record(evidence.Receipt{ToolName: "edit_file", Success: true, Write: true, Mutation: true, Paths: []string{"README.md"}})
if got := a.finalReadinessCheckFor(); got.reason != "" {
t.Fatalf("readiness after mutation = %+v, want ready", got)
}
}
func TestPolicyEscalationIncludesEveryTurnMutation(t *testing.T) {
ledger := readinessLedger(
evidence.Receipt{ToolName: "edit_file", Success: true, Write: true, Mutation: true, Paths: []string{"internal/auth/session.go"}},
evidence.Receipt{ToolName: "edit_file", Success: true, Write: true, Mutation: true, Paths: []string{"docs/GUIDE.md"}},
)
a := &Agent{
task: taskRuntime{ledger: ledger},
turn: turnRuntime{
policy: taskpolicy.Derive(taskpolicy.Input{Raw: "fix the typo in README.md", Anchored: true}),
policySet: true,
},
}
a.escalatePolicyFromEvidence()
if a.turn.policy.Risk != taskpolicy.RiskHigh || a.turn.policy.Review != taskpolicy.ReviewForced {
t.Fatalf("policy after evidence = %+v, want high-risk forced review", a.turn.policy)
}
}
func TestPolicyEscalatesBeforeFirstSensitiveMutation(t *testing.T) {
var calls int32
reg := tool.NewRegistry()
reg.Add(fakeTool{name: "edit_file", readOnly: false, calls: &calls})
permission := &stubGate{deny: map[string]bool{}}
a := New(nil, reg, NewSession("sys"), Options{Gate: permission}, event.Discard)
a.turn.policy = taskpolicy.Derive(taskpolicy.Input{Raw: "fix the typo in README.md", Anchored: true})
a.turn.policySet = true
setTurnConstraints(a, "fix the typo in README.md")
got := a.executeOne(context.Background(), &a.turn, provider.ToolCall{
Name: "edit_file",
@@ -264,10 +222,6 @@ func TestPolicyEscalatesBeforeFirstSensitiveMutation(t *testing.T) {
if len(permission.checked) != 0 {
t.Fatalf("permission was requested for a deterministically blocked call: %v", permission.checked)
}
if a.turn.policy.Risk != taskpolicy.RiskHigh || !a.turn.policy.ClosedLoop() || a.turn.policy.Review != taskpolicy.ReviewForced {
t.Fatalf("policy after planned sensitive mutation = %+v, want high-risk closed loop", a.turn.policy)
}
a.turn.deliveryCriteriaEstablished = true
a.setTodoState([]evidence.TodoItem{{Content: "update session handling", Status: "in_progress"}})
got = a.executeOne(context.Background(), &a.turn, provider.ToolCall{
@@ -292,8 +246,7 @@ func TestPolicyEscalatesDeepAbsoluteSensitiveMutationBeforeExecution(t *testing.
reg.Add(fakeTool{name: "edit_file", readOnly: false, calls: &calls})
permission := &stubGate{deny: map[string]bool{}}
a := New(nil, reg, NewSession("sys"), Options{Gate: permission, WriteWorkspaceRoot: root}, event.Discard)
a.turn.policy = taskpolicy.Derive(taskpolicy.Input{Raw: "fix this file", Anchored: true})
a.turn.policySet = true
setTurnConstraints(a, "fix this file")
args, err := json.Marshal(map[string]string{
"path": filepath.Join(root, "internal", "provider", "openai", "responses", "client.go"),
"old_string": "old",
@@ -304,17 +257,8 @@ func TestPolicyEscalatesDeepAbsoluteSensitiveMutationBeforeExecution(t *testing.
}
got := a.executeOne(context.Background(), &a.turn, provider.ToolCall{Name: "edit_file", Arguments: string(args)})
if !got.blocked || !strings.Contains(got.errMsg, "acceptance criteria") {
t.Fatalf("deep sensitive first mutation outcome = %+v, want pre-execution criteria block", got)
}
if got := atomic.LoadInt32(&calls); got != 0 {
t.Fatalf("deep sensitive writer executed %d times before escalation, want 0", got)
}
if len(permission.checked) != 0 {
t.Fatalf("permission was requested for a deterministically blocked call: %v", permission.checked)
}
if a.turn.policy.Risk != taskpolicy.RiskHigh || a.turn.policy.Review != taskpolicy.ReviewForced || a.turn.policy.Verification != taskpolicy.VerifyFull {
t.Fatalf("policy after deep sensitive mutation = %+v, want high-risk full verification and forced review", a.turn.policy)
if got.blocked {
t.Fatalf("ordinary production file must not be pre-classified as schema/auth: %+v", got)
}
}
@@ -324,8 +268,7 @@ func TestPlannedLowRiskMutationKeepsOrdinaryPath(t *testing.T) {
reg.Add(fakeTool{name: "edit_file", readOnly: false, calls: &calls})
permission := &stubGate{deny: map[string]bool{}}
a := New(nil, reg, NewSession("sys"), Options{Gate: permission}, event.Discard)
a.turn.policy = taskpolicy.Derive(taskpolicy.Input{Raw: "fix the typo in README.md", Anchored: true})
a.turn.policySet = true
setTurnConstraints(a, "fix the typo in README.md")
got := a.executeOne(context.Background(), &a.turn, provider.ToolCall{
Name: "edit_file",
@@ -340,7 +283,7 @@ func TestPlannedLowRiskMutationKeepsOrdinaryPath(t *testing.T) {
if len(permission.checked) != 1 {
t.Fatalf("permission checks = %v, want one ordinary check", permission.checked)
}
if a.turn.policy.Risk != taskpolicy.RiskLow || a.turn.policy.ClosedLoop() {
t.Fatalf("ordinary low-risk policy changed: %+v", a.turn.policy)
if a.closedLoopActive() {
t.Fatal("README typo must not create a closed-loop contract")
}
}
internal/agent/taskpolicy_gate.go
-77
View File
@@ -1,77 +0,0 @@
package agent
import (
"encoding/json"
"strings"
"reasonix/internal/evidence"
)
// taskPolicyToolGate binds natural-language constraints to both direct tools
// and use_capability-resolved targets before any workspace mutation.
func (a *Agent) taskPolicyToolGate(plan *toolCallPlan, args json.RawMessage) (toolOutcome, bool) {
if !a.turn.policySet {
return toolOutcome{}, false
}
if plan.effects.StateMutation && !a.turn.policy.AllowsMutation() {
reason := strings.TrimSpace(plan.effects.Reason)
if reason == "" {
reason = "state mutation whose effects cannot be proven read-only"
}
return policyBlock(
"the current task policy forbids "+reason+" (user constraint or plan mode)",
"task policy forbids "+reason,
)
}
if !a.turn.policy.AllowsExternal() && isExternalActionTool(plan.evidenceName, plan.permName, args) {
return policyBlock("the current task policy forbids push/publish/deploy-style external actions", "task policy forbids external action")
}
if isVerificationCommandTool(plan.evidenceName, plan.permName, args) {
if !a.turn.policy.AllowsTests() {
return policyBlock("the current task policy forbids running verification commands (user constraint)", "task policy forbids verification commands")
}
if !a.turn.policy.AllowsCommand(bashCommandFromArgs(args)) {
return policyBlock("the current task policy allows only the verification commands named by the user", "verification command is outside the user allowlist")
}
}
if !a.turn.policy.AllowExploreSubagent && isExplorationSubagentTool(plan.evidenceName, plan.permName, args) {
return policyBlock("the current task policy does not allow proactive explore/research sub-agents for this turn", "exploration sub-agent is outside the turn policy")
}
return toolOutcome{}, false
}
func policyBlock(output, reason string) (toolOutcome, bool) {
return toolOutcome{output: "blocked: " + output, blocked: true, errMsg: "blocked: " + reason}, true
}
func isVerificationCommandTool(evidenceName, permName string, args json.RawMessage) bool {
name := strings.ToLower(strings.TrimSpace(evidenceName))
if name == "" {
name = strings.ToLower(strings.TrimSpace(permName))
}
if name != "bash" && name != "shell" {
return false
}
return evidence.IsVerificationCommand(bashCommandFromArgs(args))
}
func isExplorationSubagentTool(evidenceName, permName string, args json.RawMessage) bool {
name := strings.ToLower(strings.TrimSpace(evidenceName))
if name == "" || name == "use_capability" {
name = strings.ToLower(strings.TrimSpace(permName))
}
if name == "explore" || name == "research" {
return true
}
if name != "run_skill" && name != "read_only_skill" {
return false
}
var payload struct {
Name string `json:"name"`
}
if json.Unmarshal(args, &payload) != nil {
return false
}
skillName := strings.ToLower(strings.TrimSpace(payload.Name))
return skillName == "explore" || skillName == "research"
}
internal/agent/tool_call_plan.go
+1
View File
@@ -24,6 +24,7 @@ type toolCallPlan struct {
resolved tool.ResolvedCall
resolvedMeta *tool.ResolvedCall
effects evidence.ToolEffects
profile evidence.EffectProfile
verification, planTransition bool
planBefore, planAfter, planDiff string
planReplacementAuthorized bool
internal/agent/tool_receipts.go
+5 -1
View File
@@ -42,20 +42,24 @@ func (a *Agent) recordToolReceipts(plan *toolCallPlan, result string, execution
case call.Name == "complete_step":
rec := evidence.ReceiptFromToolCall(call.Name, args, err == nil, plan.readOnly)
a.task.ledger.Record(rec)
a.commitToolReceipt(rec)
if err == nil {
a.advanceCanonicalTodo(rec.Step)
}
case plan.evidenceName != call.Name:
a.task.ledger.Record(evidence.ReceiptFromToolCall(call.Name, args, err == nil, true))
proxy := evidence.ReceiptFromToolCall(call.Name, args, err == nil, true)
a.task.ledger.Record(proxy)
rec := evidence.ReceiptFromToolCall(plan.evidenceName, plan.evidenceArgs, err == nil, plan.readOnly)
rec.Mutation = plan.effects.ContentMutation
decorateExecutionReceipt(&rec, result, execution)
a.task.ledger.Record(rec)
a.commitToolReceipt(rec)
default:
rec := evidence.ReceiptFromToolCall(call.Name, args, err == nil, plan.tool.ReadOnly())
rec.Mutation = plan.effects.ContentMutation
decorateExecutionReceipt(&rec, result, execution)
a.task.ledger.Record(rec)
a.commitToolReceipt(rec)
if err == nil && call.Name == "todo_write" {
a.setTodoState(rec.Todos)
if len(rec.Todos) > 0 {
internal/agent/turn_phase.go
+7 -15
View File
@@ -7,7 +7,6 @@ import (
"reasonix/internal/completion"
"reasonix/internal/event"
"reasonix/internal/taskcontract"
"reasonix/internal/taskpolicy"
)
// emitTurnPhase publishes a content-free host phase for the active turn.
@@ -52,19 +51,12 @@ func (a *Agent) emitCompletionSummary(c *taskcontract.Contract, report completio
}
}
review := "none"
if a.turn.policySet {
switch a.turn.policy.Review {
case taskpolicy.ReviewNone:
review = "none"
default:
if a.task.ledger != nil {
if mut, ok := a.task.ledger.LatestSuccessfulMutationIndex(); ok {
if a.task.ledger.HasSuccessfulReviewAfter(mut) {
review = "passed"
} else if a.turn.policy.RequiresIndependentReview() {
review = "unavailable"
}
}
if a.task.ledger != nil {
if mut, ok := a.task.ledger.LatestSuccessfulMutationIndex(); ok {
if a.task.ledger.HasSuccessfulReviewAfter(mut) {
review = "passed"
} else if a.requiresIndependentReview() {
review = "unavailable"
}
}
}
@@ -85,7 +77,7 @@ func (a *Agent) emitCompletionSummary(c *taskcontract.Contract, report completio
}
}
gaps = completionGapKinds(gaps, report)
constraintDegraded := a.turn.policySet && (a.turn.policy.Constraints.ForbidTests || len(a.turn.policy.Constraints.AllowedChecks) > 0)
constraintDegraded := a.turn.constraints.ForbidTests || len(a.turn.constraints.AllowedChecks) > 0
summaryVerdict := verdict.String()
switch verdict {
case taskcontract.VerdictComplete:
internal/agent/turn_phase_test.go
+2 -6
View File
@@ -76,20 +76,16 @@ func containsString(values []string, want string) bool {
return slices.Contains(values, want)
}
func TestExecutionPolicyPresentOnMutationTurn(t *testing.T) {
func TestExecutionPolicyAbsentOnNewTurn(t *testing.T) {
prov := &mockProvider{name: "p", chunks: []provider.Chunk{
{Type: provider.ChunkText, Text: "ok"},
{Type: provider.ChunkDone},
}}
a := New(prov, tool.NewRegistry(), NewSession("sys"), Options{}, event.Discard)
_ = a.Run(context.Background(), "explain mutexes")
found := false
for _, m := range a.sess.conversation.Messages {
if m.Role == provider.RoleUser && strings.Contains(m.Content, "<execution-policy") {
found = true
t.Fatal("new turns must not inject execution-policy")
}
}
if !found {
t.Fatal("execution-policy block missing")
}
}
internal/agent/turnruntime.go
+4 -9
View File
@@ -2,7 +2,7 @@ package agent
import (
"reasonix/internal/completion"
"reasonix/internal/taskpolicy"
"reasonix/internal/runtimepolicy"
)
// turnRuntime is the host state for exactly one Agent.Run. beginRunTurn builds
@@ -42,13 +42,9 @@ type turnRuntime struct {
// completion is the report built as the turn ends; the host reads it while
// emitting TurnDone, before the next turn resets this state.
completion *completion.Report
// Delivery expectations classified from the task text (see taskintent).
// deliveryCriteriaEstablished may inherit an unfinished canonical task
// list on continuation, but the flag itself is recomputed every turn.
deliveryCriteriaEstablished bool
deliveryTaskExpected bool
deliveryMutationExpected bool
deliveryPersistentExpected bool
deliveryScopeActive bool
// readinessRecovered marks a run that started with evidence preserved from
// (or a pending recovery of) a prior readiness failure, so the final
@@ -75,10 +71,9 @@ type turnRuntime struct {
// succeeding over and over leaves no error for a failure-only breaker.
repeatSuccessCounts map[string]int
// policy is frozen at the start of the Run and never observes a mid-turn
// SetAgentPreset change. policySet marks that beginRunTurn derived it.
policy taskpolicy.TaskPolicy
policySet bool
// constraints and engine are frozen at the start of the Run.
constraints runtimepolicy.Constraints
engine *runtimepolicy.Engine
// reviewWarnings are warn-level findings to surface in the final summary.
reviewWarnings []string
internal/agent/usecapability_test.go
+3 -3
View File
@@ -24,7 +24,7 @@ import (
"reasonix/internal/plugin"
"reasonix/internal/provider"
"reasonix/internal/skill"
"reasonix/internal/taskpolicy"
"reasonix/internal/tool"
)
@@ -930,7 +930,7 @@ func TestCapabilityGateRecoveryIsAudited(t *testing.T) {
audit := &capability.Audit{}
a := New(&scriptedProvider{name: "p"}, reg, NewSession("sys"),
Options{CapabilityLedger: capability.NewLedger(), CapabilityAudit: audit}, event.Discard)
a.turn = turnRuntime{policySet: true, policy: closedLoopTurnPolicy(taskpolicy.ReviewForced)}
a.turn = turnRuntime{deliveryScopeActive: true}
a.SeedCapabilityRoute(capability.RouteDecision{Candidates: []capability.RouteCandidate{
{Entry: capability.Entry{ID: "skill:review"}, Policy: capability.AutoUseRequire},
}})
@@ -1091,7 +1091,7 @@ func TestCapabilityGateAppliesToReadOnlyTasks(t *testing.T) {
reg := tool.NewRegistry()
a := New(&scriptedProvider{name: "p"}, reg, NewSession("sys"),
Options{CapabilityLedger: capability.NewLedger()}, event.Discard)
a.turn = turnRuntime{policySet: true, policy: closedLoopTurnPolicy(taskpolicy.ReviewForced)}
a.turn = turnRuntime{deliveryScopeActive: true}
a.SeedCapabilityRoute(capability.RouteDecision{Candidates: []capability.RouteCandidate{
{Entry: capability.Entry{ID: "skill:review"}, Policy: capability.AutoUseRequire},
}})
internal/agent/user_input_test.go
+13 -28
View File
@@ -41,8 +41,8 @@ func TestRunPersistsRawUserInputSeparatelyFromProviderContext(t *testing.T) {
if len(stored) < 2 {
t.Fatalf("stored messages = %d, want system and user", len(stored))
}
if got := stored[1].Content; !strings.HasPrefix(got, composed) || !strings.Contains(got, "<execution-policy") {
t.Fatalf("stored provider content = %q, want composed %q plus execution-policy", got, composed)
if got := stored[1].Content; !strings.HasPrefix(got, composed) || strings.Contains(got, "<execution-policy") {
t.Fatalf("stored provider content = %q, want composed %q without execution-policy", got, composed)
}
if got := stored[1].RawContent; got != raw {
t.Fatalf("stored raw content = %q, want raw %q", got, raw)
@@ -67,22 +67,14 @@ func TestRunPersistsRawUserInputSeparatelyFromProviderContext(t *testing.T) {
if err := json.Unmarshal(encoded, &legacy); err != nil {
t.Fatalf("decode with previous-release shape: %v", err)
}
if !strings.HasPrefix(legacy.Content, composed) || !strings.Contains(legacy.Content, "<execution-policy") {
t.Fatalf("previous-release reader sees %q, want provider-visible composed prefix plus execution-policy", legacy.Content)
if !strings.HasPrefix(legacy.Content, composed) || strings.Contains(legacy.Content, "<execution-policy") {
t.Fatalf("stored content = %q, want composed prefix without execution-policy", legacy.Content)
}
receipt := a.CompletionReceipt()
if receipt == nil {
t.Fatal("completion receipt is nil")
}
if len(receipt.Gaps) != 2 {
t.Fatalf("completion gaps = %+v, want the atomic requirement and mutation check", receipt.Gaps)
}
if got := receipt.Gaps[0].Detail; got != "r1: "+raw {
t.Fatalf("atomic criterion = %q, want raw user input %q", got, raw)
}
if strings.Contains(receipt.Gaps[0].Detail, "capability-route") {
t.Fatalf("completion receipt leaked transient provider context: %+v", receipt.Gaps)
if receipt := a.CompletionReceipt(); receipt != nil && len(receipt.Gaps) > 0 {
if strings.Contains(receipt.Gaps[0].Detail, "capability-route") {
t.Fatalf("completion receipt leaked transient provider context: %+v", receipt.Gaps)
}
}
}
@@ -128,7 +120,9 @@ func TestCompletionContractUsesGoalScopeTaskText(t *testing.T) {
if err := a.Run(ctx, "<goal-context>continue</goal-context>"); err != nil {
t.Fatalf("Run: %v", err)
}
assertAtomicCriterion(t, a, "fix the parser")
if got := a.turn.turnInput; got != "fix the parser" {
t.Fatalf("goal scope task text = %q", got)
}
}
func TestCompletionContractUsesPristineSubagentTaskText(t *testing.T) {
@@ -141,17 +135,8 @@ func TestCompletionContractUsesPristineSubagentTaskText(t *testing.T) {
if err := a.Run(withNoClosedLoop(context.Background()), wrapped); err != nil {
t.Fatalf("Run: %v", err)
}
assertAtomicCriterion(t, a, "fix the parser")
}
func assertAtomicCriterion(t *testing.T, a *Agent, want string) {
t.Helper()
receipt := a.CompletionReceipt()
if receipt == nil || len(receipt.Gaps) == 0 {
t.Fatalf("completion receipt = %+v, want atomic criterion %q", receipt, want)
}
if got := receipt.Gaps[0].Detail; got != "r1: "+want {
t.Fatalf("atomic criterion = %q, want %q", got, want)
if got := a.turn.turnInput; got != "fix the parser" {
t.Fatalf("classifier task text = %q", got)
}
}
internal/agentpreset/preset.go
+1 -1
View File
@@ -1,6 +1,6 @@
// Package agentpreset holds the deprecated execution-mode vocabulary kept for
// one compatibility version. Reasonix now runs a single adaptive standard
// execution policy (see internal/taskpolicy); these helpers exist only so old
// host execution (see internal/runtimepolicy); these helpers exist only so old
// CLI flags, ACP options, persisted sessions, and Desktop tabs can be parsed,
// answered with a deprecation notice, and dual-written with safe values for
// older clients. Nothing here may influence runtime behavior.
internal/boot/agent_preset.go
+1 -1
View File
@@ -5,7 +5,7 @@ import (
)
// Deprecated execution-mode vocabulary re-exported for old frontends.
// Runtime policy lives in internal/taskpolicy; these names only parse compat inputs.
// Runtime constraints live in internal/runtimepolicy; these names only parse compat inputs.
// Deprecated AgentPreset label constants — one compatibility version.
const (
internal/boot/boot.go
+6 -8
View File
@@ -134,9 +134,8 @@ type Options struct {
// controller but are not persisted to reasonix.toml.
ExtraPlugins []plugin.Spec
// AgentPreset and TokenMode are deprecated no-op compatibility inputs.
// Reasonix derives one adaptive standard execution policy per turn from
// task risk (internal/taskpolicy); these fields are accepted so old
// frontends keep compiling, and ignored.
// Host obligations are fact-driven from real tool actions; these fields are
// accepted so old frontends keep compiling, and ignored.
AgentPreset string
TokenMode string
// SessionDir overrides where persisted chat transcripts are written. When
@@ -593,9 +592,8 @@ func build(ctx context.Context, opts Options) (*BuildResult, error) {
if workspaceLine := currentWorkspacePromptLine(root); workspaceLine != "" {
sysPrompt += "\n\n" + workspaceLine
}
// Execution modes no longer exist. Planning, verification, review, and
// evidence-closure intensity travel in the per-turn transient
// <execution-policy> user block so the cache-stable prefix stays shared.
// Execution modes no longer exist. Host obligations are fact-driven and
// never rewrite the cache-stable system prefix or tool schemas.
if cfg.EnvironmentEnabled() {
shellLabel := shell.Kind.String()
if strings.TrimSpace(cfg.Tools.Shell.Path) != "" {
@@ -1892,7 +1890,7 @@ func build(ctx context.Context, opts Options) (*BuildResult, error) {
taskTool.WithCapabilityRuntime(capRuntime)
}
// Build one role-neutral semantic router so an in-place switch never needs a
// controller rebuild. The frozen TaskPolicy decides whether a turn may call
// controller rebuild. Host constraints and live capability routing decide whether a turn may call
// it; construction alone does not add a provider request.
var router *capability.SemanticRouter
if modelRef := strings.TrimSpace(cfg.Agent.SubagentModels["capability-router"]); modelRef != "" {
@@ -2029,7 +2027,7 @@ func applyUnifiedProviderToolSurface(reg *tool.Registry) {
// effectivePlannerModel centralizes planner precedence. Every role setting
// builds the configured planner so later in-place switches retain the same
// runtime; the per-turn TaskPolicy decides whether it is invoked.
// runtime; explicit Plan, approval, or Goal start decides whether it is invoked.
func effectivePlannerModel(cfg *config.Config, opts Options) string {
if cfg == nil || opts.Ablation.Off(ablation.Planner) {
return ""
internal/boot/boot_policy_helpers_test.go
-14
View File
@@ -11,20 +11,6 @@ import (
"reasonix/internal/provider"
)
func userExecutionPolicy(messages []provider.Message) string {
for _, message := range messages {
if message.Role != provider.RoleUser {
continue
}
start := strings.Index(message.Content, "<execution-policy")
end := strings.Index(message.Content, "</execution-policy>")
if start >= 0 && end > start {
return message.Content[start : end+len("</execution-policy>")]
}
}
return ""
}
func bootLastUser(req provider.Request) string {
for _, v := range slices.Backward(req.Messages) {
if v.Role == provider.RoleUser {
internal/boot/boot_test.go
+4 -14
View File
@@ -2056,22 +2056,12 @@ model = "x"
if requestHasTool(deliveryReq, "connect_tool_source") {
t.Fatal("legacy token-mode inputs must not expose a connector")
}
// Per-turn execution-policy block is version 2: no preset. Legacy TokenMode
// inputs are ignored, so both requests share the same derived policy.
if !requestMessageContains(fullReq.Messages, provider.RoleUser, `<execution-policy version="2">`) {
t.Fatal("standard turn must include execution-policy version 2")
}
if requestMessageContains(fullReq.Messages, provider.RoleUser, "preset=") ||
requestMessageContains(deliveryReq.Messages, provider.RoleUser, "preset=") {
t.Fatal("execution-policy must not include a preset attribute")
if requestMessageContains(fullReq.Messages, provider.RoleUser, "<execution-policy") ||
requestMessageContains(deliveryReq.Messages, provider.RoleUser, "<execution-policy") {
t.Fatal("new turns must not inject execution-policy")
}
if requestMessageContains(deliveryReq.Messages, provider.RoleUser, "<delivery-runtime>") {
t.Fatal("delivery-runtime marker is retired; use execution-policy")
}
fullPolicy := userExecutionPolicy(fullReq.Messages)
deliveryPolicy := userExecutionPolicy(deliveryReq.Messages)
if fullPolicy == "" || fullPolicy != deliveryPolicy {
t.Fatalf("legacy TokenMode must not change the derived policy\nfull=%q\ndelivery=%q", fullPolicy, deliveryPolicy)
t.Fatal("delivery-runtime marker is retired")
}
}
internal/control/approval_e2e_test.go
+4 -4
View File
@@ -105,7 +105,7 @@ func TestApprovalToolWideEndToEnd(t *testing.T) {
}
// TestPlanModeApprovalPostureMatrix proves Plan freezes ForbidMutation on the
// turn TaskPolicy so ordinary writers are host-blocked even when YOLO would
// turn constraints so ordinary writers are host-blocked even when YOLO would
// otherwise auto-allow them. Permission may still prompt first in Ask mode;
// the host floor is enforced after the gate.
func TestPlanModeApprovalPostureMatrix(t *testing.T) {
@@ -117,9 +117,9 @@ func TestPlanModeApprovalPostureMatrix(t *testing.T) {
wantWrites int
}{
// YOLO/Auto avoid hanging on interactive approval while still proving
// TaskPolicy ForbidMutation blocks the write.
{name: "Auto blocks writer under plan TaskPolicy", mode: ToolApprovalAuto, wantWrites: 0},
{name: "YOLO blocks writer under plan TaskPolicy", mode: ToolApprovalYolo, askRules: []string{"write_file"}, wantWrites: 0},
// Plan ForbidMutation blocks the write.
{name: "Auto blocks writer under plan constraints", mode: ToolApprovalAuto, wantWrites: 0},
{name: "YOLO blocks writer under plan constraints", mode: ToolApprovalYolo, askRules: []string{"write_file"}, wantWrites: 0},
{name: "deny still blocks in YOLO plan", mode: ToolApprovalYolo, denyRules: []string{"write_file"}, wantWrites: 0},
}
for _, tc := range tests {
internal/control/capability.go
+18 -36
View File
@@ -8,7 +8,6 @@ import (
"reasonix/internal/capability"
"reasonix/internal/config"
"reasonix/internal/plugin"
"reasonix/internal/taskpolicy"
)
func (c *Controller) withCapabilityRoute(ctx context.Context, composed, routeInput string) string {
@@ -48,14 +47,8 @@ func (c *Controller) routeCapabilities(ctx context.Context, routeInput string) c
ctx = context.Background()
}
tools := c.ToolContractEntries()
// One shared capability directory: task risk picks the route strength
// (closed-loop promotion), never the visible tool set.
closedLoop := false
semanticAllowed := false
if policy, ok := taskpolicy.FromContext(ctx); ok {
closedLoop = policy.ClosedLoop()
semanticAllowed = policy.SemanticRouterAllowed
}
// Deterministic routing is first. The semantic router runs only when that
// catalog match is itself ambiguous — never as a per-turn classification.
var proxyTools map[string][]plugin.CachedTool
if c.proxyToolsFn != nil {
proxyTools = c.proxyToolsFn()
@@ -97,38 +90,27 @@ func (c *Controller) routeCapabilities(ctx context.Context, routeInput string) c
}
}
catalog := capability.BuildCatalog(opts)
var decision capability.RouteDecision
if closedLoop {
decision = capability.RouteClosedLoop(routeInput, catalog.Entries)
} else {
decision = capability.Route(routeInput, catalog.Entries)
}
decision := capability.Route(routeInput, catalog.Entries)
if c.capabilityProxy {
decision.CapabilityProxy = true
}
// The frozen TaskPolicy decides whether ambiguity warrants the semantic
// router; deterministic routing remains first for every task.
if semanticAllowed && c.semanticRouter != nil {
before := len(decision.Candidates)
strong := false
for _, cand := range decision.Candidates {
if cand.Policy == capability.AutoUseRequire || cand.Policy == capability.AutoUsePrefer {
strong = true
break
}
strong := false
for _, cand := range decision.Candidates {
if cand.Policy == capability.AutoUseRequire || cand.Policy == capability.AutoUsePrefer {
strong = true
break
}
if !strong {
decision = c.semanticRouter.RouteSemantic(ctx, routeInput, catalog, decision)
if c.capabilityProxy {
decision.CapabilityProxy = true
}
if c.capabilityAudit != nil {
fallback := len(decision.Candidates) == before
c.capabilityAudit.RecordRoute(true, fallback)
}
} else if c.capabilityAudit != nil {
c.capabilityAudit.RecordRoute(false, false)
}
ambiguous := !strong && len(decision.Candidates) > 1
if ambiguous && c.semanticRouter != nil {
before := len(decision.Candidates)
decision = c.semanticRouter.RouteSemantic(ctx, routeInput, catalog, decision)
if c.capabilityProxy {
decision.CapabilityProxy = true
}
if c.capabilityAudit != nil {
c.capabilityAudit.RecordRoute(true, len(decision.Candidates) == before)
}
} else if c.capabilityAudit != nil {
c.capabilityAudit.RecordRoute(false, false)
internal/control/chat_run_budget_test.go
+3 -2
View File
@@ -92,8 +92,9 @@ func TestOrdinaryChatTurnStopsOnItsTimeBudget(t *testing.T) {
c.Submit("collect the real state, then rewrite HANDOVER.md")
waitForDone(t, done)
// An unbounded provider: without the spend gate this never returns.
if got := prov.calls.Load(); got > 20 {
// Instant mock rounds can fit more than a handful into 1ms; the gate must
// still stop a runaway well short of an unbounded loop.
if got := prov.calls.Load(); got > 50 {
t.Fatalf("provider rounds = %d, want the wall-clock budget to land it promptly", got)
}
}
internal/control/controller_test.go
+1 -1
View File
@@ -2762,7 +2762,7 @@ func TestTwoModelShortChoiceReplySkipsPlanner(t *testing.T) {
t.Fatalf("short choice reply should not be wrapped as a planner handoff:\n%s", reqText)
}
if got := agent.StripTransientUserBlocks(lastUserMessage(execProv.requests[0].Messages)); got != "1" {
t.Fatalf("executor last user = %q, want raw choice reply (execution-policy may append)", lastUserMessage(execProv.requests[0].Messages))
t.Fatalf("executor last user = %q, want raw choice reply", lastUserMessage(execProv.requests[0].Messages))
}
}
internal/control/fact_driven_route_test.go
+20
View File
@@ -0,0 +1,20 @@
package control
import "testing"
func TestFactDrivenPlannerIsExplicitOnly(t *testing.T) {
if TaskWarrantsPlanner("解释 OAuth token") || TaskWarrantsPlanner("复杂重构认证迁移") {
t.Fatal("ordinary wording must stay executor-only")
}
if !TaskWarrantsPlanner("先规划再执行认证迁移") {
t.Fatal("explicit plan-then-execute must call planner")
}
}
func TestFactDrivenConstraintsIgnoreComplexityWords(t *testing.T) {
// ParseConstraints lives in runtimepolicy; this covers the controller path
// that must not auto-plan on complexity words.
if TaskWarrantsPlanner("复杂重构认证迁移 OAuth token database") {
t.Fatal("complexity words must not invoke the planner")
}
}
internal/control/goal.go
+21 -8
View File
@@ -15,7 +15,7 @@ import (
fileencoding "reasonix/internal/fileutil/encoding"
"reasonix/internal/goaleval"
"reasonix/internal/store"
"reasonix/internal/taskintent"
"reasonix/internal/tool"
)
@@ -32,9 +32,9 @@ const (
// Budget class aliases remain as sidecar/CLI compatibility metadata only.
const (
budgetClassSimple = taskintent.BudgetClassSimple
budgetClassWrite = taskintent.BudgetClassWrite
budgetClassResearch = taskintent.BudgetClassResearch
budgetClassSimple = BudgetClassSimple
budgetClassWrite = BudgetClassWrite
budgetClassResearch = BudgetClassResearch
)
// Stop causes distinguish a safe pause from a genuine block. Removed numeric
@@ -58,12 +58,12 @@ func budgetClassForLegacyMode(goal string, researchMode GoalResearchMode) string
case GoalResearchOn:
return budgetClassResearch
case GoalResearchOff:
if taskintent.GoalNeedsWriteBudget(goal) {
if GoalNeedsWriteBudget(goal) {
return budgetClassWrite
}
return budgetClassSimple
default:
return taskintent.ClassifyGoalBudget(goal)
return ClassifyGoalBudget(goal)
}
}
@@ -97,6 +97,7 @@ type goalMachine struct {
noProgressTurns int
noProgressLimit int
lastContinuationReason string
launch goalLaunchState
lastEvaluatorReason string
stopCause string
budgetExtensions int // deprecated historical sidecar field
@@ -282,7 +283,7 @@ func (g *goalMachine) statusForDisplay() string {
func (g *goalMachine) set(goal, preferredBudgetClass string, todos []evidence.TodoItem) (string, []byte, bool) {
goal = strings.TrimSpace(goal)
if goal != "" && preferredBudgetClass == "" {
preferredBudgetClass = taskintent.ClassifyGoalBudget(goal)
preferredBudgetClass = ClassifyGoalBudget(goal)
}
g.mu.Lock()
defer g.mu.Unlock()
@@ -304,7 +305,7 @@ func (g *goalMachine) setLegacyArchiveBlockedWithTaskID(goal, preferredBudgetCla
goal = strings.TrimSpace(goal)
taskID = strings.TrimSpace(taskID)
if goal != "" && preferredBudgetClass == "" {
preferredBudgetClass = taskintent.ClassifyGoalBudget(goal)
preferredBudgetClass = ClassifyGoalBudget(goal)
}
g.mu.Lock()
defer g.mu.Unlock()
@@ -561,6 +562,18 @@ func (g *goalMachine) advance(in goalAdvanceInput) goalAdvanceResult {
g.stopCause = in.pauseCause
g.block = clipGoalReason(reason)
notice = "goal paused: " + reason
case len(in.readiness.Missing) > 0 && g.noProgressTurns >= 2 && len(g.progressEvidence) > 0 &&
g.lastContinuationReason == clipGoalReason("readiness missing: "+in.readiness.Reason) &&
repeatedCompleteMayFinish(in.readiness.Missing, in.todos):
// After real Goal work, a repeated verification/review-only gap is
// Partial. Do not replay the same intercept forever.
g.goal = ""
g.status = GoalStatusComplete
g.block = ""
g.stopCause = ""
g.progressEvidence = nil
g.lastContinuationReason, g.lastEvaluatorReason = "", ""
notice = goalCompleteNotice
default:
intercept, interceptNotice = g.applyContinue(in, reportComplete, evaluatorComplete, complete)
}
internal/taskintent/goal_budget.go → internal/control/goal_budget.go
+1 -1
View File
@@ -1,4 +1,4 @@
package taskintent
package control
import (
"strings"
internal/taskintent/heuristic.go → internal/control/goal_budget_heuristic.go
+5 -7
View File
@@ -1,4 +1,4 @@
package taskintent
package control
import (
"slices"
@@ -57,10 +57,8 @@ func heuristicInputIsTask(input string) bool {
}
return false
}
// Ambiguous prose stays conversational. Delivery evidence gates require a
// concrete host-observable signal rather than using message length as a
// proxy; explicit mutations, files, commands, failures, and audit verbs are
// still classified below.
// Ambiguous prose stays conversational. Length is not a task signal;
// mutations, files, commands, failures, and audit verbs are classified below.
return heuristicInputHasStrongTaskSignal(normalized)
}
@@ -151,7 +149,7 @@ func containsTaskNeedle(input, needle string) bool {
if needle == "" {
return false
}
if containsNonASCII(needle) || strings.Contains(needle, " ") {
if goalBudgetContainsNonASCII(needle) || strings.Contains(needle, " ") {
return strings.Contains(input, needle)
}
return slices.Contains(strings.FieldsFunc(input, func(r rune) bool {
@@ -159,7 +157,7 @@ func containsTaskNeedle(input, needle string) bool {
}), needle)
}
func containsNonASCII(s string) bool {
func goalBudgetContainsNonASCII(s string) bool {
for _, r := range s {
if r > 127 {
return true
internal/taskintent/intent.go → internal/control/goal_budget_intent.go
+4 -4
View File
@@ -1,8 +1,8 @@
// Package taskintent classifies natural-language task text (English and
// Goal budget helpers classify natural-language task text (English and
// Chinese) into delivery-intent categories. The delivery evidence gates and
// Goal budget selection consume it as a heuristic; it never gates permissions
// or whether writes are allowed.
package taskintent
package control
import (
"strings"
@@ -418,7 +418,7 @@ func deliveryTaskStartsWithMutation(input string) bool {
}
for _, needle := range deliveryMutationNeedles {
if containsTaskNeedle(input, needle) {
if containsNonASCII(needle) {
if goalBudgetContainsNonASCII(needle) {
return strings.HasPrefix(input, needle)
}
tokens := strings.FieldsFunc(input, func(r rune) bool {
@@ -484,7 +484,7 @@ func deliveryMutationClauseNegated(clause string) bool {
}
func deliveryTaskNeedleIntent(clause, needle string) (affirmative, negated bool) {
if containsNonASCII(needle) {
if goalBudgetContainsNonASCII(needle) {
for offset := 0; offset < len(clause); {
relative := strings.Index(clause[offset:], needle)
if relative < 0 {
internal/control/goal_command.go
+1
View File
@@ -11,6 +11,7 @@ func (c *Controller) startGoalCommandTurn(cmd GoalCommand, display string) {
if !c.goals.active() {
return
}
c.goals.markExplicitStart()
c.notice(fmt.Sprintf(i18n.M.GoalSetFmt, ShortGoalForNotice(c.Goal())))
if c.runner != nil {
c.runGuarded(func(ctx context.Context) error {
internal/taskintent/goal_research_budget.go → internal/control/goal_research_budget.go
+1 -1
View File
@@ -1,4 +1,4 @@
package taskintent
package control
import "strings"
internal/control/goal_runtime_test.go
+1 -1
View File
@@ -658,7 +658,7 @@ func TestGoalDeliveryWorkflowCompletesAfterVerifiedSignoff(t *testing.T) {
textTurn("Ship main delivered."),
},
)}
// An active Goal derives a closed-loop TaskPolicy; no profile option needed.
// An active Goal is a closed-loop delivery scope; no profile option needed.
ag := agent.New(prov, reg, agent.NewSession(""), agent.Options{}, event.Discard)
done := make(chan event.Event, 1)
var doneReadiness *event.FinalReadiness
internal/control/goal_start.go
+28
View File
@@ -0,0 +1,28 @@
package control
// goalLaunchState is the one-shot "user just started this Goal" flag.
// It is host-only and never persisted.
type goalLaunchState struct {
explicit bool
}
func (g *goalMachine) markExplicitStart() {
g.mu.Lock()
g.launch.explicit = true
g.mu.Unlock()
}
func (g *goalMachine) consumeExplicitStart() bool {
g.mu.Lock()
defer g.mu.Unlock()
ok := g.launch.explicit
g.launch.explicit = false
return ok
}
func (c *Controller) consumeExplicitGoalStart() bool {
if c == nil {
return false
}
return c.goals.consumeExplicitStart()
}
internal/control/planner_gate.go
+19 -239
View File
@@ -9,7 +9,7 @@ import (
"unicode/utf8"
"reasonix/internal/agent"
"reasonix/internal/taskpolicy"
"reasonix/internal/runtimepolicy"
)
const (
@@ -23,26 +23,13 @@ const (
plannerReasonUserPlanApproval = "user_plan_for_approval"
plannerReasonUserPlanAndExecute = "user_plan_and_execute"
plannerReasonContextContinuation = "context_continuation"
plannerReasonLowRiskQuestion = "low_risk_question"
plannerReasonHighRisk = "high_risk"
plannerReasonCrossSurface = "cross_surface"
plannerReasonStructuredRequest = "structured_request"
plannerReasonComplexIntent = "complex_intent"
plannerReasonAtomicEdit = "atomic_edit"
plannerReasonReadOnlyAction = "read_only_action"
plannerReasonGuidance = "complex_guidance"
plannerReasonGoalActive = "goal_active"
plannerReasonAnchoredWork = "anchored_work"
plannerReasonAmbiguousWork = "ambiguous_work"
plannerReasonWorkRequest = "work_request"
plannerReasonTaskPolicy = "task_policy"
plannerReasonGoalStart = "explicit_goal_start"
plannerReasonDefault = "default_executor"
)
var (
directOptionReplyRE = regexp.MustCompile(`(?i)^\s*(?:\d+|[a-z])\s*[.)、。]?\s*$`)
prefixedOptionReplyRE = regexp.MustCompile(`(?i)^\s*(?:选|选择|就|用|按|走|执行|choose|pick|use|option|choice|方案)\s*(?:第\s*)?(?:方案|选项|option|choice)?\s*(?:\d+|[一二三四五六七八九十]|[a-z])\s*(?:个|号|项|种|条|方案|option|choice)?\s*[.)、。!！?？]?\s*$`)
plannerListRE = regexp.MustCompile(`(?m)^\s*(?:[-*]|\d+[.)、])\s+\S`)
plannerFileRefRE = regexp.MustCompile(`(?i)(?:^|[\s@` + "`" + `"'(])(?:[\w.-]+[/\\])*[\w.-]+\.(?:go|ts|tsx|js|jsx|py|rs|java|kt|md|json|ya?ml|toml|sql|sh|css|html)(?:$|[\s,;:!?，；：！？)` + "`" + `"'])`)
)
@@ -50,11 +37,8 @@ type plannerTurnMetadata struct {
UserText string
Synthetic bool
ExplicitPlanMode bool
GoalActive bool
ClosedLoop bool // legacy tests/callers without a frozen TaskPolicy
ExplicitGoalStart bool
HasConversationContext bool
Policy taskpolicy.TaskPolicy
PolicySet bool
}
type plannerTurnMetadataKey struct{}
@@ -73,30 +57,18 @@ func plannerTurnMetadataFromContext(ctx context.Context) (plannerTurnMetadata, b
func (c *Controller) withPlannerTurnMetadata(ctx context.Context, userText string, synthetic bool, priorMessages int) context.Context {
text := strings.TrimSpace(agent.StripTransientUserBlocks(userText))
features := plannerFeaturesFor(text, normalizePlannerText(text))
goalActive := c.goals.active()
policy := taskpolicy.Derive(taskpolicy.Input{
Raw: text,
Instruction: taskpolicy.StripQuotedConstraints(text),
PlanMode: c.PlanMode(),
GoalActive: goalActive,
HighRiskHints: features.highRisk,
MediumRiskHints: features.complex,
MultiFile: features.multiFile,
CrossSurface: features.crossSurface,
Anchored: features.anchored,
Structured: features.structured,
})
ctx = taskpolicy.WithContext(ctx, policy)
constraints := runtimepolicy.ParseConstraints(runtimepolicy.StripQuotedConstraints(text))
if c.PlanMode() {
constraints.PlanModeReadOnly = true
constraints.ForbidMutation = true
}
ctx = runtimepolicy.WithContext(ctx, constraints)
return withPlannerTurnMetadata(ctx, plannerTurnMetadata{
UserText: userText,
Synthetic: synthetic,
ExplicitPlanMode: c.PlanMode(),
GoalActive: goalActive,
ClosedLoop: policy.ClosedLoop(),
ExplicitGoalStart: c.consumeExplicitGoalStart(),
HasConversationContext: priorMessages > 1,
Policy: policy,
PolicySet: true,
})
}
@@ -132,137 +104,40 @@ func DecidePlannerRoute(ctx context.Context, input string) agent.PlannerDecision
lower := normalizePlannerText(text)
if requestsPlanApproval(lower) {
return plannerPlanDecision(agent.PlannerRoutePlanForApproval, agent.PlannerDepthFull, plannerReasonUserPlanApproval)
return plannerPlanDecision(agent.PlannerRoutePlanForApproval, plannerReasonUserPlanApproval)
}
if requestsPlanOnly(lower) {
return plannerPlanDecision(agent.PlannerRoutePlanOnly, agent.PlannerDepthFull, plannerReasonUserPlanOnly)
return plannerPlanDecision(agent.PlannerRoutePlanOnly, plannerReasonUserPlanOnly)
}
if hasLeadingDirective(lower, planAndExecuteDirectives) || hasLeadingDirective(lower, planFirstDirectives) {
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthFull, plannerReasonUserPlanAndExecute)
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, plannerReasonUserPlanAndExecute)
}
if requestsDirectExecution(lower) && (!meta.PolicySet || meta.Policy.Route == taskpolicy.RouteDirect) {
if requestsDirectExecution(lower) {
return plannerExecutorDecision(plannerReasonUserDirect)
}
if meta.ExplicitGoalStart {
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, plannerReasonGoalStart)
}
if meta.HasConversationContext && isContextDependentAction(text) {
return plannerExecutorDecision(plannerReasonContextContinuation)
}
if isLowRiskQuestion(lower) {
return plannerExecutorDecision(plannerReasonLowRiskQuestion)
}
features := plannerFeaturesFor(text, lower)
if meta.PolicySet {
if meta.GoalActive && features.work && !features.atomic {
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthFull, plannerReasonGoalActive)
}
switch meta.Policy.Route {
case taskpolicy.RouteFullPlan:
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthFull, plannerReasonTaskPolicy)
case taskpolicy.RouteLightPlan:
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthLight, plannerReasonTaskPolicy)
default:
return plannerExecutorDecision(plannerReasonTaskPolicy)
}
}
if features.work && features.highRisk {
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthFull, plannerReasonHighRisk)
}
if features.multiFile || features.crossSurface {
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthFull, plannerReasonCrossSurface)
}
if features.structured {
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthFull, plannerReasonStructuredRequest)
}
if features.complex {
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthFull, plannerReasonComplexIntent)
}
if features.atomic {
return plannerExecutorDecision(plannerReasonAtomicEdit)
}
if features.guidance {
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthLight, plannerReasonGuidance)
}
if features.readOnly && !features.ambiguous {
return plannerExecutorDecision(plannerReasonReadOnlyAction)
}
if meta.GoalActive && features.work {
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthFull, plannerReasonGoalActive)
}
if meta.ClosedLoop && features.work {
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthFull, plannerReasonWorkRequest)
}
if features.work && features.ambiguous {
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthFull, plannerReasonAmbiguousWork)
}
if features.work && features.anchored {
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthLight, plannerReasonAnchoredWork)
}
if features.work {
return plannerPlanDecision(agent.PlannerRoutePlanAndExecute, agent.PlannerDepthLight, plannerReasonWorkRequest)
}
return plannerExecutorDecision(plannerReasonDefault)
}
func plannerExecutorDecision(reason string) agent.PlannerDecision {
return agent.PlannerDecision{
Route: agent.PlannerRouteExecutorOnly,
Depth: agent.PlannerDepthNone,
Reason: reason,
}
}
func plannerPlanDecision(route agent.PlannerRoute, depth agent.PlannerDepth, reason string) agent.PlannerDecision {
func plannerPlanDecision(route agent.PlannerRoute, reason string) agent.PlannerDecision {
return agent.PlannerDecision{
Route: route,
Depth: depth,
Reason: reason,
}
}
type plannerFeatures struct {
work bool
highRisk bool
multiFile bool
crossSurface bool
structured bool
complex bool
atomic bool
readOnly bool
guidance bool
anchored bool
ambiguous bool
}
func plannerFeaturesFor(text, lower string) plannerFeatures {
fileRefs := plannerFileRefRE.FindAllString(text, -1)
anchored := len(fileRefs) > 0 || strings.Contains(text, "@") || containsAnyLexical(lower, plannerNamedTargets)
work := containsAnyLexical(lower, plannerWorkTerms)
highRisk := containsAnyLexical(lower, plannerHighRiskTerms)
multiFile := len(fileRefs) >= 2 || strings.Count(text, "@") >= 2
crossSurface := containsAnyLexical(lower, plannerCrossSurfaceTerms)
structured := utf8.RuneCountInString(text) >= 240 || plannerListRE.MatchString(text) || strings.Count(text, "\n") >= 2
complex := containsAnyLexical(lower, complexIntentTerms)
guidance := isComplexGuidanceQuestion(lower)
ambiguous := work && containsAnyLexical(lower, plannerAmbiguousScopeTerms)
readOnly := work && containsAnyLexical(lower, plannerReadOnlyWorkTerms) &&
!containsAnyLexical(lower, plannerMutationWorkTerms)
atomic := work && anchored && !highRisk && !multiFile && !crossSurface && !structured && !complex &&
utf8.RuneCountInString(text) <= 140 && containsAnyLexical(lower, plannerAtomicTerms)
return plannerFeatures{
work: work,
highRisk: highRisk,
multiFile: multiFile,
crossSurface: crossSurface,
structured: structured,
complex: complex,
atomic: atomic,
readOnly: readOnly,
guidance: guidance,
anchored: anchored,
ambiguous: ambiguous,
}
}
func normalizePlannerText(text string) string {
text = strings.ToLower(strings.TrimSpace(text))
text = strings.ReplaceAll(text, "’", "'")
@@ -546,50 +421,6 @@ var shortContextReplyPrefixes = []string{
"继续", "执行", "开始", "下一步", "go ahead", "proceed", "continue",
}
func isLowRiskQuestion(lower string) bool {
lower = strings.TrimSpace(lower)
normalized := strings.ReplaceAll(lower, "'", "")
if strings.HasPrefix(lower, "what ") || strings.HasPrefix(normalized, "whats ") ||
strings.HasPrefix(lower, "why ") || strings.HasPrefix(lower, "how ") ||
strings.HasPrefix(lower, "who ") || strings.HasPrefix(lower, "where ") ||
strings.HasPrefix(lower, "when ") || strings.HasPrefix(lower, "which ") ||
strings.HasPrefix(lower, "whose ") || strings.HasPrefix(lower, "whom ") ||
strings.HasPrefix(lower, "explain ") || strings.HasPrefix(lower, "describe ") ||
strings.HasPrefix(lower, "tell ") || strings.HasPrefix(lower, "show ") ||
strings.HasPrefix(lower, "list ") || strings.HasPrefix(lower, "summarize ") ||
strings.HasPrefix(lower, "summarise ") || strings.HasPrefix(lower, "compare ") ||
strings.HasPrefix(lower, "difference ") || strings.HasPrefix(lower, "is ") ||
strings.HasPrefix(lower, "are ") || strings.HasPrefix(lower, "can ") ||
strings.HasPrefix(lower, "could ") || strings.HasPrefix(lower, "do ") ||
strings.HasPrefix(lower, "does ") || strings.HasPrefix(lower, "did ") ||
strings.HasPrefix(lower, "should ") || strings.HasPrefix(lower, "would ") ||
strings.HasPrefix(lower, "will ") ||
strings.HasPrefix(lower, "what's") || strings.HasPrefix(normalized, "whats") ||
strings.HasPrefix(lower, "解释") || strings.HasPrefix(lower, "说明") ||
strings.HasPrefix(lower, "怎么看") || strings.HasPrefix(lower, "查一下") ||
strings.HasPrefix(lower, "介绍一下") ||
strings.HasPrefix(lower, "说一下") || strings.HasPrefix(lower, "帮我看") ||
strings.HasPrefix(lower, "帮我查") || strings.HasPrefix(lower, "是什么") ||
strings.HasPrefix(lower, "有没有") || strings.HasPrefix(lower, "能不能") ||
strings.HasPrefix(lower, "可以吗") || strings.HasPrefix(lower, "对吗") ||
strings.HasPrefix(lower, "是不是") || strings.HasPrefix(lower, "请问") {
return !containsAnyLexical(lower, plannerQuestionWorkTerms)
}
return false
}
func isComplexGuidanceQuestion(lower string) bool {
for _, prefix := range []string{
"how do i ", "how should i ", "how would you ", "what's the best way ",
"what is the best way ", "explain how to ", "怎么实现", "如何实现", "怎么迁移", "如何迁移",
} {
if strings.HasPrefix(lower, prefix) {
return true
}
}
return false
}
func containsAnyLexical(s string, terms []string) bool {
for _, term := range terms {
if containsLexicalTerm(s, term) {
@@ -637,59 +468,8 @@ var plannerWorkTerms = []string{
"改造", "评审", "审查", "排查", "调试", "测试", "加个", "加一", "补一个", "补个",
}
var plannerMutationWorkTerms = []string{
"fix", "fixing", "update", "updating", "remove", "removing", "delete", "deleting",
"edit", "editing", "write", "writing", "create", "creating", "add", "adding", "repair",
"patch", "build", "building", "implement", "implementing", "refactor", "refactoring",
"migrate", "migrating", "redesign", "修改", "修复", "更新", "删除", "移除", "编辑",
"写入", "创建", "新增", "添加", "构建", "实现", "重构", "迁移", "改造", "加个",
"加一", "补一个", "补个",
}
var plannerReadOnlyWorkTerms = []string{
"run", "running", "review", "reviewing", "audit", "inspect", "debug",
"test", "tests", "testing", "运行", "评审", "审查", "排查", "调试", "测试",
}
var plannerQuestionWorkTerms = []string{
"fix", "fixing", "update", "updating", "remove", "removing", "delete", "deleting",
"edit", "editing", "write", "writing", "create", "creating", "add", "adding", "repair",
"patch", "implement", "implementing", "refactor", "refactoring", "migrate", "migrating",
"redesign", "修改", "修复", "更新", "删除", "移除", "编辑", "写入", "创建", "新增",
"添加", "实现", "重构", "迁移", "改造", "加个", "加一", "补一个", "补个",
}
var plannerHighRiskTerms = []string{
"auth", "authentication", "authorization", "permission", "token", "secret",
"credential", "payment", "billing", "race", "concurrency", "deadlock", "transaction",
"encryption", "signature", "sandbox", "privilege", "权限", "鉴权", "认证", "令牌",
"密钥", "支付", "账单", "并发", "竞态", "竟态", "死锁", "事务", "加密", "签名",
"沙箱", "提权",
}
var plannerCrossSurfaceTerms = []string{
"multiple files", "several files", "across", "frontend and backend", "backend and frontend",
"api and ui", "ui and api", "database and api", "多个文件", "多处", "前后端",
"整个模块", "整个项目", "全链路", "跨模块",
}
var plannerAtomicTerms = []string{
"typo", "wording", "copy", "readme", "changelog", "nil check", "null check",
"log line", "one line", "rename", "文案", "错别字", "拼写", "空指针检查",
"nil 检查", "一行日志", "改名", "重命名",
}
var plannerNamedTargets = []string{
"readme", "changelog", "makefile", "dockerfile",
}
var plannerAmbiguousScopeTerms = []string{
"the bug", "the issue", "the problem", "performance", "everything", "whole module",
"这个 bug", "这个bug", "这个问题", "性能", "整个模块", "全部问题",
}
// TaskWarrantsPlanner is retained as a small compatibility predicate for
// callers and tests that do not need depth or approval semantics.
// callers and tests that only need "planner vs executor".
func TaskWarrantsPlanner(input string) bool {
return DecidePlannerRoute(context.Background(), input).Route != agent.PlannerRouteExecutorOnly
}
internal/control/planner_gate_test.go
+38 -374
View File
@@ -5,7 +5,6 @@ import (
"testing"
"reasonix/internal/agent"
"reasonix/internal/taskpolicy"
)
func TestTaskWarrantsPlanner(t *testing.T) {
@@ -17,64 +16,16 @@ func TestTaskWarrantsPlanner(t *testing.T) {
{" ", false},
{"/init", false},
{"1", false},
{"2.", false},
{"A", false},
{"好的", false},
{"继续", false},
{"选 1", false},
{"what does this function do?", false}, // low-risk question → executor only
{"why did the test fail", false},
{"what does this function do?", false},
{"解释一下这段代码", false},
{reasoningLanguageBlock("zh") + "\n\nwhat does this function do?", false},
{reasoningLanguageBlock("en") + "\n\n" + PlanModeMarker + "\n\nfix the bug", false},
{reasoningLanguageBlock("en") + "\n\nfix the bug", true},
{"fix the bug", true}, // terse, but a work request → still planned
{"add a login button", true}, // ditto
{"run the tests", false},
{"review this PR", false},
{"inspect internal/foo.go", false},
{"执行修复", true},
{"开始迁移", true},
{"继续重构", true},
{"continue fixing tests", true},
{"implement the new caching layer across the backend", true},
{"who wrote this file?", false},
{"where is the config file?", false},
{"when does this run?", false},
{"which file has the error?", false},
{"explain this code", false},
{"describe the architecture", false},
{"tell me about this function", false},
{"is this safe?", false},
{"are we done?", false},
{"can you help?", false},
{"can you fix the failing tests across the backend", true},
{"could you update the README", false}, // explicit single-target edit → executor only
{"should we remove the stale config option", true},
{"would you add a regression test", true},
{"do you fix flaky tests here", true},
{"does it work?", false},
{"did the test pass?", false},
{"should I use mutex here?", false},
{"would this approach work?", false},
{"list all the endpoints", false},
{"summarize the changes", false},
{"compare these two approaches", false},
{"what's the status?", false},
{"介绍一下这个项目", false},
{"说一下这个函数的作用", false},
{"帮我看一下这个报错", false},
{"是什么意思", false},
{"有没有现成的方案", false},
{"能不能这样做", false},
{"请问这个怎么用", false},
{"how do I implement a new caching layer", true},
{"what's the best way to refactor this module", true},
{"explain how to migrate from v1 to v2", true},
{goalContinueTurn, false},
{"Goal signaled complete but issues remain:\n- the following tasks are still incomplete:\n - Fix login (in_progress)\nFix remaining work, or if a check cannot be run declare it in update_goal completion.unverified and report complete.", false},
{activeGoalBlock("execute plan: fix the parser") + "\n\n" + goalContinueTurn, false},
{activeGoalBlock("implement the new caching layer") + "\n\nimplement the new caching layer across the backend", true},
{"fix the bug", false},
{"复杂重构认证迁移", false},
{"直接修改 parser.go", false},
{"先规划这个认证迁移，不要执行", true},
{"plan first then implement the cache", true},
{"give me a plan only", true},
{"fix auth and wait for my approval", true},
}
for _, c := range cases {
if got := TaskWarrantsPlanner(c.input); got != c.want {
@@ -83,48 +34,28 @@ func TestTaskWarrantsPlanner(t *testing.T) {
}
}
func TestTaskPolicyOwnsAutomaticPlannerRoute(t *testing.T) {
cases := []struct {
name string
policy taskpolicy.TaskPolicy
input string
depth agent.PlannerDepth
}{
{"direct", taskpolicy.TaskPolicy{Route: taskpolicy.RouteDirect}, "fix the parser", agent.PlannerDepthNone},
{"light", taskpolicy.TaskPolicy{Route: taskpolicy.RouteLightPlan}, "fix parser.go and parser_test.go", agent.PlannerDepthLight},
{"full overrides direct request", taskpolicy.TaskPolicy{Route: taskpolicy.RouteFullPlan}, "do it directly: migrate authentication", agent.PlannerDepthFull},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
ctx := withPlannerTurnMetadata(context.Background(), plannerTurnMetadata{Policy: tc.policy, PolicySet: true})
got := DecidePlannerRoute(ctx, tc.input)
if got.Depth != tc.depth || got.Reason != plannerReasonTaskPolicy {
t.Fatalf("decision = %+v, want task-policy depth %s", got, tc.depth)
}
})
}
}
func TestNewPlannerGateUsesDeterministicTaskPolicy(t *testing.T) {
func TestNewPlannerGateIsExplicitOnly(t *testing.T) {
gate := NewPlannerGate()
if gate == nil {
t.Fatal("NewPlannerGate returned nil")
}
if got := gate(context.Background(), "what is this?"); got {
t.Error("planner gate should skip low-risk questions")
t.Error("planner gate should skip questions")
}
if got := gate(context.Background(), "fix the bug"); !got {
t.Error("planner gate should plan work requests")
if got := gate(context.Background(), "fix the bug"); got {
t.Error("ordinary work must stay executor-only")
}
if got := gate(context.Background(), "先规划再执行认证迁移"); !got {
t.Error("explicit plan-then-execute must call planner")
}
}
func TestDecidePlannerRouteMatrix(t *testing.T) {
func TestDecidePlannerRouteExplicitOnly(t *testing.T) {
cases := []struct {
name string
input string
meta plannerTurnMetadata
route agent.PlannerRoute
depth agent.PlannerDepth
reason string
}{
{
@@ -132,7 +63,6 @@ func TestDecidePlannerRouteMatrix(t *testing.T) {
input: "fix the bug",
meta: plannerTurnMetadata{ExplicitPlanMode: true},
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonExplicitPlanMode,
},
{
@@ -140,331 +70,65 @@ func TestDecidePlannerRouteMatrix(t *testing.T) {
input: "perform a brand new implementation",
meta: plannerTurnMetadata{Synthetic: true},
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonSynthetic,
},
{
name: "user asks for plan only",
input: "先规划这个认证迁移，不要执行",
route: agent.PlannerRoutePlanOnly,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanOnly,
},
{
name: "bare english plan only",
input: "Give me a plan only for the auth migration.",
route: agent.PlannerRoutePlanOnly,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanOnly,
},
{
name: "bare chinese plan only with embedded target",
input: "只给认证迁移方案",
route: agent.PlannerRoutePlanOnly,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanOnly,
},
{
name: "task first english plan only boundary",
input: "Review the auth migration and give me a plan only; do not execute.",
route: agent.PlannerRoutePlanOnly,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanOnly,
},
{
name: "task first english plan only without redundant no execution",
input: "Review the auth migration and give me a plan only.",
route: agent.PlannerRoutePlanOnly,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanOnly,
},
{
name: "work request with no execution boundary",
input: "Implement the auth migration, but do not execute.",
route: agent.PlannerRoutePlanOnly,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanOnly,
},
{
name: "task first chinese plan only boundary",
input: "评审认证迁移，给我方案即可，不要修改代码",
route: agent.PlannerRoutePlanOnly,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanOnly,
},
{
name: "bare plan first continues to executor",
input: "先规划这个认证迁移",
name: "user asks for plan then execute",
input: "先规划再执行这个缓存改造",
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanAndExecute,
},
{
name: "english plan first continues to executor",
input: "plan first, then handle the authentication migration",
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanAndExecute,
},
{
name: "user asks to approve plan before execution",
input: "先规划这个认证迁移，等我确认后再执行",
name: "user asks for approval",
input: "plan the migration and wait for my approval",
route: agent.PlannerRoutePlanForApproval,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanApproval,
},
{
name: "task first english approval boundary",
input: "Implement the auth migration, but show me the plan and wait for my approval.",
route: agent.PlannerRoutePlanForApproval,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanApproval,
},
{
name: "work request with approval boundary",
input: "Implement the auth migration and wait for my approval.",
route: agent.PlannerRoutePlanForApproval,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanApproval,
},
{
name: "task first chinese approval boundary",
input: "实现认证迁移，但先给我方案并等我确认",
route: agent.PlannerRoutePlanForApproval,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanApproval,
},
{
name: "conditional no execution remains approval boundary",
input: "Plan the auth migration and do not execute until I approve.",
route: agent.PlannerRoutePlanForApproval,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanApproval,
},
{
name: "user asks to plan then execute",
input: "先规划再执行这个认证迁移",
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanAndExecute,
},
{
name: "user explicitly skips planner",
input: "直接改 auth.go，别规划",
name: "direct request stays executor only",
input: "直接修改 parser.go",
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonUserDirect,
},
{
name: "task first english direct execution boundary",
input: "Implement the auth migration, but do not plan.",
name: "ordinary long multi-file request stays executor only",
input: "refactor the parser across reader.py and writer.py and add tests",
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonUserDirect,
reason: plannerReasonDefault,
},
{
name: "do not plan to is a scope constraint not a routing directive",
input: "Plan the auth migration, but do not plan to change the database schema.",
name: "auth wording does not auto plan",
input: "修复登录超时",
route: agent.PlannerRouteExecutorOnly,
reason: plannerReasonDefault,
},
{
name: "explicit goal start plans once",
input: "fix the crash",
meta: plannerTurnMetadata{ExplicitGoalStart: true},
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthFull,
reason: plannerReasonComplexIntent,
},
{
name: "task first chinese direct execution boundary",
input: "实现认证迁移，别规划，直接改",
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonUserDirect,
},
{
name: "quoted directive is not an override",
input: "解释“直接改”是什么意思",
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonLowRiskQuestion,
},
{
name: "quoted no execution phrase is not a boundary",
input: "解释“不要执行”是什么意思",
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonLowRiskQuestion,
},
{
name: "quoted english approval phrase is not a boundary",
input: "Explain what \"wait for my approval\" means.",
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonLowRiskQuestion,
},
{
name: "single quoted english boundary is not an override",
input: "Review the README wording 'wait for my approval'.",
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonAtomicEdit,
},
{
name: "apostrophe in contraction remains a boundary",
input: "Review the README but don't execute.",
route: agent.PlannerRoutePlanOnly,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanOnly,
},
{
name: "expanded approval negation is not an approval boundary",
input: "Plan the migration; you do not need to wait for my approval.",
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthFull,
reason: plannerReasonComplexIntent,
},
{
name: "negated approval does not override plan only",
input: "只给认证迁移方案，不要执行，也不用等我确认",
route: agent.PlannerRoutePlanOnly,
depth: agent.PlannerDepthFull,
reason: plannerReasonUserPlanOnly,
reason: plannerReasonGoalStart,
},
{
name: "context dependent fix stays with executor",
input: "fix it",
meta: plannerTurnMetadata{HasConversationContext: true},
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonContextContinuation,
},
{
name: "standalone context dependent fix remains ambiguous",
input: "fix it",
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthLight,
reason: plannerReasonWorkRequest,
},
{
name: "atomic readme edit skips planner",
input: "fix typo in README",
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonAtomicEdit,
},
{
name: "atomic nil check skips planner",
input: "add a nil check in internal/foo.go",
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonAtomicEdit,
},
{
name: "bounded anchored work gets light plan",
input: "add regression coverage in internal/foo_test.go",
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthLight,
reason: plannerReasonAnchoredWork,
},
{
name: "single step read only command skips planner",
input: "run the tests",
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonReadOnlyAction,
},
{
name: "single file inspection skips planner",
input: "inspect internal/foo.go",
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonReadOnlyAction,
},
{
name: "closed-loop keeps pure read only command direct",
input: "review this PR",
meta: plannerTurnMetadata{ClosedLoop: true},
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonReadOnlyAction,
},
{
name: "high risk read only audit still gets full plan",
input: "audit the authentication authorization flow",
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthFull,
reason: plannerReasonHighRisk,
},
{
name: "ambiguous bug gets full plan",
input: "fix the bug",
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthFull,
reason: plannerReasonAmbiguousWork,
},
{
name: "anchored ambiguous bug still gets full plan",
input: "fix the bug in internal/foo.go",
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthFull,
reason: plannerReasonAmbiguousWork,
},
{
name: "high risk overrides single target",
input: "fix the token authorization race in auth.go",
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthFull,
reason: plannerReasonHighRisk,
},
{
name: "cross surface gets full plan",
input: "update frontend and backend for the new profile field",
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthFull,
reason: plannerReasonCrossSurface,
},
{
name: "complex guidance gets light plan",
input: "how do I implement a local cache?",
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthLight,
reason: plannerReasonGuidance,
},
{
name: "closed-loop upgrades non atomic work",
input: "add a login button",
meta: plannerTurnMetadata{ClosedLoop: true},
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthFull,
reason: plannerReasonWorkRequest,
},
{
name: "closed-loop keeps atomic edit direct",
input: "fix typo in README",
meta: plannerTurnMetadata{ClosedLoop: true},
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonAtomicEdit,
},
{
name: "active goal upgrades non atomic work",
input: "add a login button",
meta: plannerTurnMetadata{GoalActive: true},
route: agent.PlannerRoutePlanAndExecute,
depth: agent.PlannerDepthFull,
reason: plannerReasonGoalActive,
},
{
name: "active goal alone does not force an atomic edit through planner",
input: "fix typo in README",
meta: plannerTurnMetadata{GoalActive: true},
route: agent.PlannerRouteExecutorOnly,
depth: agent.PlannerDepthNone,
reason: plannerReasonAtomicEdit,
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
ctx := withPlannerTurnMetadata(context.Background(), tc.meta)
got := DecidePlannerRoute(ctx, tc.input)
if got.Route != tc.route || got.Depth != tc.depth || got.Reason != tc.reason {
t.Fatalf("decision = %+v, want route=%s depth=%s reason=%s", got, tc.route, tc.depth, tc.reason)
if got.Route != tc.route || got.Reason != tc.reason {
t.Fatalf("decision = %+v, want route=%s reason=%s", got, tc.route, tc.reason)
}
})
}
@@ -477,7 +141,7 @@ func TestPlannerPolicyUsesPristineMetadataInsteadOfInjectedContext(t *testing.T)
input := activeGoalBlock("migrate authentication across the backend") +
"\n\n<capability-route>\nhigh risk migration\n</capability-route>\n\nfix typo in README"
got := DecidePlannerRoute(ctx, input)
if got.Route != agent.PlannerRouteExecutorOnly || got.Reason != plannerReasonAtomicEdit {
if got.Route != agent.PlannerRouteExecutorOnly {
t.Fatalf("decision used injected context instead of pristine user text: %+v", got)
}
}
internal/control/taskpolicy_route_test.go
+2 -5
View File
@@ -28,10 +28,7 @@ func TestTurnOrchestratorRoutesCapabilitiesWithFrozenTaskPolicy(t *testing.T) {
if err := newTurnOrchestrator(c).runTurnWithRawDisplay(context.Background(), raw, raw, ""); err != nil {
t.Fatal(err)
}
if !runner.meta.PolicySet || !runner.meta.Policy.ClosedLoop() {
t.Fatalf("runner policy = %+v, want frozen closed-loop policy", runner.meta)
}
if !strings.Contains(runner.input, "skill:security-review prefer") {
t.Fatalf("interactive capability route did not consume the frozen policy:\n%s", runner.input)
if !strings.Contains(runner.input, "skill:security-review prefer") && !strings.Contains(runner.input, "security-review") {
t.Fatalf("capability route missing security-review:\n%s", runner.input)
}
}
internal/control/turn_orchestrator_test.go
+2 -2
View File
@@ -70,8 +70,8 @@ func TestTurnOrchestratorAttachesTrustedPlannerMetadata(t *testing.T) {
if runner.meta.UserText != raw {
t.Fatalf("planner metadata user text = %q, want pristine %q", runner.meta.UserText, raw)
}
if runner.meta.ExplicitPlanMode || !runner.meta.GoalActive || !runner.meta.ClosedLoop || !runner.meta.PolicySet || !runner.meta.Policy.ClosedLoop() {
t.Fatalf("planner metadata missing trusted host state: %+v", runner.meta)
if runner.meta.ExplicitPlanMode {
t.Fatalf("planner metadata should not force plan mode: %+v", runner.meta)
}
if !runner.meta.HasConversationContext {
t.Fatalf("planner metadata lost executor conversation ownership: %+v", runner.meta)
internal/event/event.go
+1 -1
View File
@@ -773,7 +773,7 @@ type DelegationAdmissionAudit struct {
Tool string
Verdict string // "allow" | "deny"
Reason string // e.g. "local_fix_no_external_need"
Intent string // taskintent class of the turn
Intent string // compatibility field; no longer classified from prompt text
}
// DelegationAdmissionSink is an optional sink capability; implementations
internal/evidence/child_test.go
+46 -7
View File
@@ -3,6 +3,7 @@ package evidence
import (
"encoding/json"
"path/filepath"
"sync"
"testing"
)
@@ -43,6 +44,36 @@ func TestMergeChildPropagatesRealWrites(t *testing.T) {
}
}
func TestConcurrentChildMergesKeepDistinctWrites(t *testing.T) {
parent := NewLedger()
start := make(chan struct{})
var wg sync.WaitGroup
wg.Add(2)
go func() {
defer wg.Done()
<-start
child := NewLedger()
child.Record(ReceiptFromToolCall("edit_file", json.RawMessage(`{"path":"internal/a.go"}`), true, false))
parent.MergeChild(child.Summary())
}()
go func() {
defer wg.Done()
<-start
child := NewLedger()
child.Record(ReceiptFromToolCall("edit_file", json.RawMessage(`{"path":"internal/b.go"}`), true, false))
parent.MergeChild(child.Summary())
}()
close(start)
wg.Wait()
if parent.Len() != 2 {
t.Fatalf("merged receipts = %d, want 2", parent.Len())
}
paths := parent.Summary().MutationPaths()
if len(paths) != 2 {
t.Fatalf("mutation paths = %v, want both child writes", paths)
}
}
func TestClassifyMutationRisk(t *testing.T) {
low := []Receipt{
ReceiptFromToolCall("edit_file", json.RawMessage(`{"path":"docs/GUIDE.md"}`), true, false),
@@ -126,12 +157,20 @@ func TestAbsoluteMutationRiskIgnoresWorkspaceAndTestHarnessAncestors(t *testing.
}
deep := ClassifyToolCallMutationRisk(
"edit_file",
json.RawMessage(`{"path":"/tmp/TestBuildToolSchemas123/001/internal/provider/openai/responses/client.go"}`),
json.RawMessage(`{"path":"/tmp/TestBuildToolSchemas123/001/internal/auth/oauth/client.go"}`),
false,
)
if deep != RiskHigh {
t.Fatalf("deep absolute sensitive suffix risk = %s, want high", deep)
}
ordinary := ClassifyToolCallMutationRisk(
"edit_file",
json.RawMessage(`{"path":"/tmp/TestBuildToolSchemas123/001/internal/provider/openai/responses/client.go"}`),
false,
)
if ordinary != RiskMedium {
t.Fatalf("provider path is ordinary production code = %s, want medium", ordinary)
}
}
func TestWorkspaceRelativeMutationRiskPreservesDeepOwnerAndIgnoresCheckoutName(t *testing.T) {
@@ -148,20 +187,20 @@ func TestWorkspaceRelativeMutationRiskPreservesDeepOwnerAndIgnoresCheckoutName(t
deep := ClassifyToolCallMutationRiskWithin(
root,
"edit_file",
json.RawMessage(`{"path":"/workspace/toolbox/internal/provider/openai/responses/client.go"}`),
json.RawMessage(`{"path":"/workspace/toolbox/internal/auth/session.go"}`),
false,
)
if deep != RiskHigh {
t.Fatalf("deep provider path = %s, want high", deep)
t.Fatalf("deep auth path = %s, want high", deep)
}
windows := ClassifyToolCallMutationRiskWithin(
`C:\workspace\toolbox`,
"edit_file",
json.RawMessage(`{"path":"c:\\workspace\\toolbox\\internal\\sandbox\\linux\\seccomp\\policy.go"}`),
json.RawMessage(`{"path":"c:\\workspace\\toolbox\\internal\\auth\\session.go"}`),
false,
)
if windows != RiskHigh {
t.Fatalf("Windows deep sandbox path = %s, want high", windows)
t.Fatalf("Windows deep auth path = %s, want high", windows)
}
}
@@ -223,7 +262,7 @@ func TestAbsoluteMutationRiskPreservesSensitiveOwnerBeforeTempShape(t *testing.T
Success: true,
Write: true,
Mutation: true,
Paths: []string{"/workspace/provider/TestWorker123/001/internal/client.go"},
Paths: []string{"/workspace/auth/TestWorker123/001/internal/client.go"},
}}
if got := ClassifyMutationRisk(receipts, 0); got != RiskHigh {
t.Fatalf("risk = %q, want %q", got, RiskHigh)
@@ -252,7 +291,7 @@ func TestLedgerMutationRiskWithinPreservesDeepSensitiveOwner(t *testing.T) {
ledger := NewLedger()
ledger.Record(ReceiptFromToolCall(
"edit_file",
json.RawMessage(`{"path":"/workspace/toolbox/internal/provider/openai/responses/client.go"}`),
json.RawMessage(`{"path":"/workspace/toolbox/internal/auth/session.go"}`),
true,
false,
))
internal/evidence/classify_profile.go
+252
View File
@@ -0,0 +1,252 @@
package evidence
import (
"encoding/json"
"strings"
"reasonix/internal/shellsafe"
)
// ClassifyEffect returns the concrete effect profile for one invocation.
func ClassifyEffect(in EffectInput) EffectProfile {
name := strings.ToLower(strings.TrimSpace(in.ToolName))
args := json.RawMessage(in.Args)
if name == "bash" || name == "shell" {
return classifyBashEffect(args, in)
}
if in.Hint.Present && in.Hint.ReadOnly {
return readOnlyProfile(targetsFrom(in, nil), ReasonHintReadOnly)
}
if in.StaticReadOnly || IsNonMutationMetaTool(in.ToolName) {
return readOnlyProfile(targetsFrom(in, nil), ReasonReadOnly)
}
switch name {
case "ask", "todo_write", "complete_step", "bash_output", "wait":
return readOnlyProfile(nil, ReasonReadOnly)
case "remember", "forget", "set_session_title":
return EffectProfile{Known: true, HostState: true, Reason: ReasonHostState}
}
profile := writerProfile(in)
if in.Hint.Present {
applyCallHint(&profile, in.Hint)
}
return profile
}
func classifyBashEffect(args json.RawMessage, in EffectInput) EffectProfile {
var fields map[string]json.RawMessage
if err := json.Unmarshal(args, &fields); err != nil {
return opaqueProfile(in, ReasonUnknown)
}
command := stringField(fields, "command")
effect := shellsafe.ClassifyBash(command)
if effect.Certainty != shellsafe.EffectKnown {
if bashCommandIsVerification(command) {
return readOnlyProfile(nil, ReasonReadOnly)
}
// Unproven bash is a pathless workspace write. It is not an MCP opaque
// writer: permission and the shell contract still own the invocation.
return EffectProfile{
WorkspaceWrite: true,
ExecutesCode: effect.ExecutesCode,
UsesNetwork: effect.UsesNetwork,
Reason: EffectReason(effect.Reason),
}
}
profile := EffectProfile{
Known: true,
ReadOnly: effect.Writes == 0,
WorkspaceWrite: effect.Writes&shellsafe.WriteWorkspaceContent != 0,
RepoMetadata: effect.Writes&shellsafe.WriteRepositoryMetadata != 0,
HostState: effect.Writes&shellsafe.WriteHostState != 0,
ExternalState: effect.Writes&shellsafe.WriteExternalState != 0,
ExecutesCode: effect.ExecutesCode,
UsesNetwork: effect.UsesNetwork,
Reason: EffectReason(commandEffectReason(effect)),
}
if profile.ReadOnly {
profile.Reason = ReasonReadOnly
} else if profile.ExternalState {
profile.Reason = ReasonExternalState
} else if profile.HostState {
profile.Reason = ReasonHostState
} else if profile.WorkspaceWrite {
profile.Reason = ReasonWorkspaceWrite
} else if profile.RepoMetadata {
profile.Reason = ReasonRepoMetadata
}
applyBashShape(&profile, effect.CommandFamily, command)
profile.Targets = bashTargets(profile)
return profile
}
func applyBashShape(profile *EffectProfile, family, command string) {
family = strings.ToLower(strings.TrimSpace(family))
lower := strings.ToLower(command)
switch {
case family == "git push" || strings.HasPrefix(family, "git push"):
profile.ExternalState = true
profile.UsesNetwork = true
if containsForceFlag(lower) {
profile.Destructive = true
profile.Irreversible = true
}
case family == "git clean" && profile.WorkspaceWrite:
profile.Destructive = true
case strings.Contains(family, "publish") || strings.Contains(family, "deploy"):
profile.ExternalState = true
profile.UsesNetwork = true
}
if strings.Contains(lower, "rm -rf") || strings.Contains(lower, "rm -fr") {
profile.Destructive = true
profile.Irreversible = true
}
}
func containsForceFlag(command string) bool {
for field := range strings.FieldsSeq(command) {
switch field {
case "-f", "--force", "--force-with-lease":
return true
}
}
return false
}
func bashTargets(p EffectProfile) []Target {
switch {
case p.ExternalState:
return []Target{{Kind: TargetExternal}}
case p.HostState:
return []Target{{Kind: TargetHost}}
case p.RepoMetadata && !p.WorkspaceWrite:
return []Target{{Kind: TargetRepo}}
default:
return nil
}
}
func writerProfile(in EffectInput) EffectProfile {
paths := declaredPaths(in)
if !in.Hint.Present && !in.Hint.Known && len(paths) == 0 && looksOpaqueName(in.ToolName) {
return opaqueProfile(in, ReasonOpaqueWriter)
}
profile := EffectProfile{
Known: true,
WorkspaceWrite: true,
Reason: ReasonWorkspaceWrite,
Targets: fileTargets(paths),
}
if in.Hint.Destructive || isDestructiveTool(in.ToolName) {
profile.Destructive = true
profile.Reason = ReasonDestructive
}
return profile
}
func applyCallHint(profile *EffectProfile, hint CallHint) {
profile.Destructive = profile.Destructive || hint.Destructive
profile.Privileged = profile.Privileged || hint.Privileged
profile.UsesNetwork = profile.UsesNetwork || hint.UsesNetwork
profile.ExecutesCode = profile.ExecutesCode || hint.ExecutesCode
if hint.Destructive {
profile.Reason = ReasonHintDestructive
}
if len(hint.Targets) > 0 && len(profile.Targets) == 0 {
profile.Targets = fileTargets(hint.Targets)
}
}
func readOnlyProfile(targets []Target, reason EffectReason) EffectProfile {
return EffectProfile{Known: true, ReadOnly: true, Reason: reason, Targets: append([]Target(nil), targets...)}
}
func opaqueProfile(in EffectInput, reason EffectReason) EffectProfile {
if reason == "" {
reason = ReasonOpaqueWriter
}
return EffectProfile{
WorkspaceWrite: true,
Destructive: in.Hint.Destructive,
Privileged: in.Hint.Privileged || looksPrivilegedName(in.ToolName),
UsesNetwork: in.Hint.UsesNetwork,
ExecutesCode: in.Hint.ExecutesCode,
Targets: fileTargets(declaredPaths(in)),
Reason: reason,
}
}
func declaredPaths(in EffectInput) []string {
var paths []string
if len(in.ActualPaths) > 0 {
paths = append(paths, in.ActualPaths...)
} else {
paths = append(paths, ToolCallPaths(in.Args)...)
}
if in.Hint.Present {
paths = append(paths, in.Hint.Targets...)
}
return uniquePaths(paths)
}
func targetsFrom(in EffectInput, extra []string) []Target {
paths := append(declaredPaths(in), extra...)
return fileTargets(uniquePaths(paths))
}
func fileTargets(paths []string) []Target {
if len(paths) == 0 {
return nil
}
out := make([]Target, 0, len(paths))
for _, p := range paths {
p = strings.TrimSpace(p)
if p == "" {
continue
}
kind := TargetFile
if strings.HasSuffix(p, "/") {
kind = TargetDirectory
}
out = append(out, Target{Path: p, Kind: kind})
}
return out
}
func uniquePaths(paths []string) []string {
seen := make(map[string]bool, len(paths))
var out []string
for _, p := range paths {
p = strings.TrimSpace(p)
if p == "" || seen[p] {
continue
}
seen[p] = true
out = append(out, p)
}
return out
}
func looksOpaqueName(name string) bool {
lower := strings.ToLower(strings.TrimSpace(name))
return strings.HasPrefix(lower, "mcp__") || strings.HasPrefix(lower, "mcp-tool:")
}
func looksPrivilegedName(name string) bool {
lower := strings.ToLower(strings.TrimSpace(name))
for _, hint := range highRiskToolHints {
if strings.Contains(lower, hint) {
return true
}
}
return false
}
func isDestructiveTool(name string) bool {
switch strings.ToLower(strings.TrimSpace(name)) {
case "delete_file", "delete_symbol", "remove_file":
return true
default:
return false
}
}
internal/evidence/effects.go
+9 -40
View File
@@ -2,7 +2,6 @@ package evidence
import (
"encoding/json"
"strings"
"reasonix/internal/shellsafe"
)
@@ -16,45 +15,22 @@ type ToolEffects struct {
// ClassifyToolCall returns durable effects for one concrete invocation.
func ClassifyToolCall(toolName string, args json.RawMessage, readOnly bool) ToolEffects {
name := strings.ToLower(strings.TrimSpace(toolName))
if name == "bash" || name == "shell" {
effects, _ := ClassifyBashToolCall(args)
return effects
}
if readOnly || IsNonMutationMetaTool(toolName) {
return ToolEffects{Known: true}
}
switch name {
case "ask", "todo_write", "complete_step", "bash_output", "wait":
return ToolEffects{Known: true}
case "set_session_title":
return ToolEffects{StateMutation: true, Known: true, Reason: "host session metadata write"}
default:
return ToolEffects{StateMutation: true, WorkspaceMutation: true, ContentMutation: true, Known: true, Reason: "workspace content write by a writer-capable tool"}
}
return ClassifyEffect(EffectInput{
ToolName: toolName,
Args: args,
StaticReadOnly: readOnly,
}).ToolEffects()
}
// ClassifyBashToolCall parses once and returns effects plus permission trust.
func ClassifyBashToolCall(args json.RawMessage) (ToolEffects, bool) {
profile := ClassifyEffect(EffectInput{ToolName: "bash", Args: args})
var fields map[string]json.RawMessage
if err := json.Unmarshal(args, &fields); err != nil {
return unknownToolEffects("invalid shell arguments"), false
return profile.ToolEffects(), false
}
command := stringField(fields, "command")
effect := shellsafe.ClassifyBash(command)
if effect.Certainty == shellsafe.EffectKnown {
return ToolEffects{
StateMutation: effect.AnyMutation(), WorkspaceMutation: effect.WorkspaceMutation(),
ContentMutation: effect.ContentMutation(), RepositoryMutation: effect.RepositoryMutation(),
Known: true, Reason: commandEffectReason(effect),
}, effect.IsPermissionReader()
}
// Unknown syntax stays fail-closed unless the host recognized a verifier
// such as `go test` that ClassifyBash does not model as a known reader.
if bashCommandIsVerification(command) {
return ToolEffects{Known: true}, false
}
return unknownToolEffects(effect.Reason), false
effect := shellsafe.ClassifyBash(stringField(fields, "command"))
return profile.ToolEffects(), effect.IsPermissionReader()
}
func commandEffectReason(effect shellsafe.CommandEffect) string {
@@ -78,13 +54,6 @@ func commandEffectReason(effect shellsafe.CommandEffect) string {
return domain + " by " + effect.CommandFamily
}
func unknownToolEffects(reason string) ToolEffects {
if strings.TrimSpace(reason) == "" {
reason = "tool effects are not statically known"
}
return ToolEffects{StateMutation: true, WorkspaceMutation: true, ContentMutation: true, Reason: reason}
}
// ToolCallMutates is the compatibility projection for durable state changes.
func ToolCallMutates(toolName string, args json.RawMessage, readOnly bool) bool {
return ClassifyToolCall(toolName, args, readOnly).StateMutation
internal/evidence/full_verification.go
+173
View File
@@ -0,0 +1,173 @@
package evidence
import (
"path/filepath"
"strings"
"reasonix/internal/shellparse"
"reasonix/internal/shellsafe"
)
// IsFullVerificationCommand reports whether a recognized verifier clearly
// covers the current project rather than one named package, file, or test.
// Project-declared checks remain authoritative at the task-contract layer;
// this conservative fallback is for repositories without declared checks.
func IsFullVerificationCommand(command string) bool {
if !bashCommandIsVerification(command) {
return false
}
if masks, ok := shellparse.CanMaskEarlierFailure(command); !ok || masks {
return false
}
segments, _, ok := shellparse.SplitTopLevel(command)
if !ok {
return false
}
for _, segment := range segments {
normalized, safe := shellsafe.NormalizeBashSafeRedirectsForMatch(segment)
if !safe {
continue
}
fields, ok := bashStaticArgv(normalized)
if ok && fullVerificationArgv(fields) {
return true
}
}
return false
}
func fullVerificationArgv(fields []string) bool {
if !bashSegmentIsVerification(fields) || len(fields) == 0 {
return false
}
base := strings.ToLower(filepath.Base(fields[0]))
args := fields[1:]
switch base {
case "go":
return fullGoVerification(args)
case "pytest", "py.test":
return onlyBroadVerificationTargets(args, ".", "./", "test", "test/", "tests", "tests/")
case "gotestsum", "staticcheck":
return len(args) == 0 || slicesContainFold(args, "./...")
case "golangci-lint":
return onlyBroadVerificationTargets(args)
case "tsc":
return onlyBroadVerificationTargets(args)
case "mypy":
return onlyBroadVerificationTargets(args, ".", "./", "src", "src/")
case "npm", "pnpm", "yarn", "bun":
return fullScriptVerification(args)
case "cargo":
return len(args) > 0 && onlyBroadVerificationTargets(args[1:])
case "npx":
return fullNpxVerification(args)
case "node":
return len(args) > 0 && args[0] == "--test" && onlyBroadVerificationTargets(args[1:])
case "make", "just":
return len(args) == 1
case "python", "python3":
return len(args) > 1 && args[0] == "-m" && onlyBroadVerificationTargets(args[2:])
case "dotnet":
return len(args) > 0 && args[0] == "test" && onlyBroadVerificationTargets(args[1:])
case "swift":
return len(args) > 0 && args[0] == "test" && onlyBroadVerificationTargets(args[1:])
case "mvn", "mvnw", "gradle", "gradlew":
return buildToolVerificationIsFull(args)
default:
return false
}
}
func fullGoVerification(args []string) bool {
if len(args) < 2 || (args[0] != "test" && args[0] != "vet") || !slicesContainFold(args[1:], "./...") {
return false
}
if args[0] == "vet" {
return true
}
for _, arg := range args[1:] {
name := strings.TrimPrefix(strings.ToLower(arg), "-test.")
name = strings.TrimLeft(name, "-")
if before, _, ok := strings.Cut(name, "="); ok {
name = before
}
switch name {
case "run", "bench", "list", "skip":
return false
case "count":
if strings.HasSuffix(strings.ToLower(arg), "=0") {
return false
}
}
}
return true
}
func fullScriptVerification(args []string) bool {
if len(args) == 0 {
return false
}
start := 1
if args[0] == "run" {
if len(args) < 2 {
return false
}
start = 2
}
return onlyBroadVerificationTargets(args[start:])
}
func fullNpxVerification(args []string) bool {
if len(args) == 0 {
return false
}
runner, ok := npxRunnerName(args[0])
if !ok {
return false
}
switch runner {
case "tsc":
return tscSegmentIsVerification(args[1:]) && onlyBroadVerificationTargets(args[1:])
case "vitest", "jest", "mocha", "ava", "eslint", "prettier":
return onlyBroadVerificationTargets(args[1:], ".", "./")
default:
return false
}
}
func buildToolVerificationIsFull(args []string) bool {
seenTask := false
for _, arg := range args {
if strings.HasPrefix(arg, "-") {
continue
}
switch strings.ToLower(arg) {
case "test", "check", "verify":
seenTask = true
default:
return false
}
}
return seenTask
}
func onlyBroadVerificationTargets(args []string, broad ...string) bool {
for _, arg := range args {
if strings.HasPrefix(arg, "-") {
continue
}
if !slicesContainFold(broad, arg) {
return false
}
}
return true
}
func slicesContainFold(items []string, want string) bool {
for _, item := range items {
if strings.EqualFold(item, want) {
return true
}
}
return false
}
internal/evidence/full_verification_test.go
+30
View File
@@ -0,0 +1,30 @@
package evidence
import "testing"
func TestFullVerificationCommandRejectsTargetedChecks(t *testing.T) {
cases := map[string]bool{
"go test ./...": true,
"go vet ./...": true,
"go test ./internal/auth": false,
"go test ./... -run TestLogin": false,
"git diff --check": false,
"pytest tests/": true,
"pytest tests/test_login.py": false,
"npm test": true,
"npm test -- auth": false,
"cargo test --all-features": true,
"cargo test --package auth": false,
"GOROOT=/x go test ./...": true,
"cd desktop && go test ./...": true,
"go test ./... 2>&1 | tail -3": false,
"go test ./... || true": false,
"go test ./...; true": false,
"go test ./internal/auth && true": false,
}
for command, want := range cases {
if got := IsFullVerificationCommand(command); got != want {
t.Errorf("IsFullVerificationCommand(%q) = %v, want %v", command, got, want)
}
}
}
internal/evidence/pathclass.go
+194
View File
@@ -0,0 +1,194 @@
package evidence
import (
"path"
"slices"
"strings"
"unicode"
)
// PathClass is a structured category for one filesystem target.
type PathClass uint8
const (
PathOrdinary PathClass = iota
PathDocs
PathI18n
PathTest
PathStyle
PathSchema
PathMigration
PathAuth
PathSecret
PathPublicAPI
)
// ClassifyPath reports the strongest structured class for a workspace path.
// Matching uses directory segments, filename tokens, and extensions — never a
// raw substring of the whole path, so author.go cannot match auth.
func ClassifyPath(p, workspaceRoot string) PathClass {
relevant := riskRelevantPath(p, workspaceRoot)
if relevant == "" || relevant == "." {
return PathOrdinary
}
lower := strings.ToLower(strings.ReplaceAll(relevant, `\`, "/"))
segments := pathSegments(lower)
base := ""
if len(segments) > 0 {
base = segments[len(segments)-1]
}
ext := strings.ToLower(path.Ext(base))
stem := strings.TrimSuffix(base, ext)
tokens := filenameTokens(stem)
switch {
case classMatches(segments, tokens, ext, authPathMatch):
return PathAuth
case classMatches(segments, tokens, ext, secretPathMatch):
return PathSecret
case classMatches(segments, tokens, ext, migrationPathMatch):
return PathMigration
case classMatches(segments, tokens, ext, schemaPathMatch):
return PathSchema
case classMatches(segments, tokens, ext, publicAPIPathMatch):
return PathPublicAPI
case pathLooksLowRisk(p, workspaceRoot) && classMatches(segments, tokens, ext, stylePathMatch):
return PathStyle
case pathLooksLowRisk(p, workspaceRoot) && classMatches(segments, tokens, ext, i18nPathMatch):
return PathI18n
case pathLooksLowRisk(p, workspaceRoot) && classMatches(segments, tokens, ext, testPathMatch):
return PathTest
case pathLooksLowRisk(p, workspaceRoot) && classMatches(segments, tokens, ext, docsPathMatch):
return PathDocs
case pathLooksLowRisk(p, workspaceRoot):
return PathDocs
default:
return PathOrdinary
}
}
type pathMatch struct {
segments []string
tokens []string
exts []string
testSuffix bool
}
var (
authPathMatch = pathMatch{
segments: []string{"auth", "authentication", "authorization", "permission", "permissions", "oauth", "oidc", "sso", "iam", "acl", "rbac"},
tokens: []string{"auth", "authentication", "authorization", "permission", "permissions", "oauth", "oidc", "sso", "session", "login", "passwd"},
}
secretPathMatch = pathMatch{
segments: []string{"secret", "secrets", "credential", "credentials", "keystore", "keyring", "certs", "tls", "ssl"},
tokens: []string{"secret", "secrets", "credential", "credentials", "password", "passwd", "token", "keystore", "keyring"},
}
migrationPathMatch = pathMatch{
segments: []string{"migration", "migrations", "migrate"},
tokens: []string{"migration", "migrate"},
}
schemaPathMatch = pathMatch{
segments: []string{"schema", "schemas", "protobuf", "proto", "openapi", "graphql"},
tokens: []string{"schema", "migration"},
exts: []string{".proto", ".graphql"},
}
publicAPIPathMatch = pathMatch{
segments: []string{"api", "apis", "openapi", "swagger"},
tokens: []string{"openapi", "swagger"},
exts: []string{".proto"},
}
docsPathMatch = pathMatch{
segments: []string{"docs", "doc", "documentation"},
exts: []string{".md", ".mdx", ".txt", ".rst"},
}
i18nPathMatch = pathMatch{
segments: []string{"i18n", "locales", "locale", "l10n"},
}
testPathMatch = pathMatch{
segments: []string{"testdata", "__tests__", "fixtures", "fixture"},
testSuffix: true,
}
stylePathMatch = pathMatch{
exts: []string{".css", ".scss", ".sass", ".less"},
}
)
func classMatches(segments, tokens []string, ext string, m pathMatch) bool {
for _, seg := range segments {
if containsWord(m.segments, seg) {
return true
}
}
for _, tok := range tokens {
if containsWord(m.tokens, tok) {
return true
}
}
if containsWord(m.exts, ext) {
return true
}
if m.testSuffix && isTestFilename(segments) {
return true
}
return false
}
func containsWord(words []string, got string) bool {
return slices.Contains(words, got)
}
func pathSegments(p string) []string {
p = strings.Trim(p, "/")
if p == "" || p == "." {
return nil
}
return strings.Split(p, "/")
}
func filenameTokens(stem string) []string {
if stem == "" {
return nil
}
var out []string
var b strings.Builder
flush := func() {
if b.Len() == 0 {
return
}
out = append(out, strings.ToLower(b.String()))
b.Reset()
}
for _, r := range stem {
if unicode.IsLetter(r) || unicode.IsDigit(r) {
b.WriteRune(r)
continue
}
flush()
}
flush()
return out
}
func isTestFilename(segments []string) bool {
if len(segments) == 0 {
return false
}
base := segments[len(segments)-1]
return strings.HasSuffix(base, "_test.go") ||
strings.HasSuffix(base, "_test.ts") ||
strings.HasSuffix(base, ".test.ts") ||
strings.HasSuffix(base, ".test.tsx") ||
strings.HasSuffix(base, "_spec.ts") ||
strings.HasSuffix(base, ".spec.ts")
}
// pathLooksSensitive reports whether a path is an auth, secret, schema, or
// migration surface. User prompt text is never consulted.
func pathLooksSensitive(p, workspaceRoot string) bool {
switch ClassifyPath(p, workspaceRoot) {
case PathAuth, PathSecret, PathSchema, PathMigration, PathPublicAPI:
return true
default:
return false
}
}
internal/evidence/pathclass_test.go
+55
View File
@@ -0,0 +1,55 @@
package evidence
import "testing"
func TestClassifyPathRejectsSubstringFalsePositives(t *testing.T) {
tests := []struct {
path string
want PathClass
}{
{"author.go", PathOrdinary},
{"authority.md", PathDocs},
{"docs/authority.md", PathDocs},
{"internal/author/author.go", PathOrdinary},
{"auth/session.go", PathAuth},
{"internal/auth/session.go", PathAuth},
{"internal/permission/gate.go", PathAuth},
{"internal/oauth/client.go", PathAuth},
{"secrets/token.go", PathSecret},
{"internal/db/migrations/001_init.sql", PathMigration},
{"schema/user.proto", PathSchema},
{"api/openapi.yaml", PathPublicAPI},
{"docs/GUIDE.md", PathDocs},
{"locales/en.json", PathI18n},
{"internal/agent/agent_test.go", PathTest},
{"testdata/fixture.json", PathTest},
{"web/app.css", PathStyle},
{"internal/agent/agent.go", PathOrdinary},
}
for _, tt := range tests {
if got := ClassifyPath(tt.path, ""); got != tt.want {
t.Fatalf("ClassifyPath(%q) = %v, want %v", tt.path, got, tt.want)
}
}
}
func TestClassifyPathIgnoresPromptWords(t *testing.T) {
if got := ClassifyPath("README.md", ""); got != PathDocs {
t.Fatalf("readme = %v, want docs", got)
}
if ClassifyPath("internal/parser/parser.go", "") != PathOrdinary {
t.Fatal("ordinary production path must not inherit prompt keywords")
}
}
func TestPathLooksSensitiveUsesSegments(t *testing.T) {
if pathLooksSensitive("author.go", "") {
t.Fatal("author.go must not be sensitive")
}
if pathLooksSensitive("authority.md", "") {
t.Fatal("authority.md must not be sensitive")
}
if !pathLooksSensitive("internal/auth/session.go", "") {
t.Fatal("auth/session.go must be sensitive")
}
}
internal/evidence/profile.go
+170
View File
@@ -0,0 +1,170 @@
package evidence
import "strings"
// EffectReason is a privacy-safe, argument-free classification note.
type EffectReason string
const (
ReasonReadOnly EffectReason = "read_only"
ReasonWorkspaceWrite EffectReason = "workspace_write"
ReasonRepoMetadata EffectReason = "repository_metadata"
ReasonHostState EffectReason = "host_state"
ReasonExternalState EffectReason = "external_state"
ReasonOpaqueWriter EffectReason = "opaque_writer"
ReasonDestructive EffectReason = "destructive"
ReasonUnknown EffectReason = "unknown"
ReasonHintReadOnly EffectReason = "annotation_read_only"
ReasonHintDestructive EffectReason = "annotation_destructive"
)
// TargetKind classifies one concrete action target.
type TargetKind uint8
const (
TargetUnspecified TargetKind = iota
TargetFile
TargetDirectory
TargetRepo
TargetHost
TargetExternal
)
// Target is one resolved path or state domain the call touches.
type Target struct {
Path string
Kind TargetKind
}
// TargetKey is a comparable identity for an action target.
type TargetKey string
// Key returns a stable identity. Empty paths collapse by kind only.
func (t Target) Key() TargetKey {
path := strings.TrimSpace(t.Path)
if path == "" {
return TargetKey(targetKindName(t.Kind))
}
return TargetKey(targetKindName(t.Kind) + ":" + normalizeRiskPath(path))
}
func targetKindName(k TargetKind) string {
switch k {
case TargetFile:
return "file"
case TargetDirectory:
return "dir"
case TargetRepo:
return "repo"
case TargetHost:
return "host"
case TargetExternal:
return "external"
default:
return "target"
}
}
// EffectProfile is the host's concrete classification of one tool invocation.
type EffectProfile struct {
Known bool
ReadOnly bool
WorkspaceWrite bool
RepoMetadata bool
HostState bool
ExternalState bool
Destructive bool
Irreversible bool
Privileged bool
ExecutesCode bool
UsesNetwork bool
Targets []Target
Reason EffectReason
}
// Clone copies Targets so callers cannot share a mutable slice.
func (p EffectProfile) Clone() EffectProfile {
if len(p.Targets) > 0 {
p.Targets = append([]Target(nil), p.Targets...)
}
return p
}
// MutatesState reports whether the call can change durable state.
func (p EffectProfile) MutatesState() bool {
if !p.Known {
return true
}
return p.WorkspaceWrite || p.RepoMetadata || p.HostState || p.ExternalState
}
// OpaqueWriter reports a write-capable call whose effects are not proven.
func (p EffectProfile) OpaqueWriter() bool {
return !p.Known && !p.ReadOnly
}
// TargetKeys copies comparable identities for the classified targets.
func (p EffectProfile) TargetKeys() []TargetKey {
if len(p.Targets) == 0 {
return nil
}
out := make([]TargetKey, len(p.Targets))
for i, t := range p.Targets {
out[i] = t.Key()
}
return out
}
// ToolEffects projects the profile onto the existing policy/evidence boundary.
func (p EffectProfile) ToolEffects() ToolEffects {
return ToolEffects{
StateMutation: p.MutatesState(),
WorkspaceMutation: !p.Known || p.WorkspaceWrite || p.RepoMetadata,
ContentMutation: !p.Known || p.WorkspaceWrite,
RepositoryMutation: p.RepoMetadata,
Known: p.Known,
Reason: p.displayReason(),
}
}
func (p EffectProfile) displayReason() string {
switch p.Reason {
case ReasonRepoMetadata:
return "repository metadata write"
case ReasonWorkspaceWrite:
return "workspace content write"
case ReasonHostState:
return "host state write"
case ReasonExternalState:
return "external state write"
case ReasonOpaqueWriter:
return "opaque writer"
case ReasonDestructive:
return "destructive write"
case ReasonUnknown:
return "unknown command"
default:
return string(p.Reason)
}
}
// CallHint is the optional host-only preview collected before classification.
type CallHint struct {
Present bool
Known bool
ReadOnly bool
Destructive bool
Privileged bool
UsesNetwork bool
ExecutesCode bool
Targets []string
}
// EffectInput is one concrete invocation to classify.
type EffectInput struct {
ToolName string
Args []byte
StaticReadOnly bool
Hint CallHint
ActualPaths []string
}
internal/evidence/profile_test.go
+83
View File
@@ -0,0 +1,83 @@
package evidence
import (
"encoding/json"
"testing"
)
func TestClassifyEffectBashReadersAndWriters(t *testing.T) {
tests := []struct {
name string
command string
want EffectProfile
}{
{name: "status", command: "git status", want: EffectProfile{Known: true, ReadOnly: true, Reason: ReasonReadOnly}},
{name: "diff", command: "git diff", want: EffectProfile{Known: true, ReadOnly: true, Reason: ReasonReadOnly}},
{name: "push", command: "git push origin main", want: EffectProfile{Known: true, ExternalState: true, UsesNetwork: true, Reason: ReasonExternalState, Targets: []Target{{Kind: TargetExternal}}}},
{name: "force push", command: "git push --force origin main", want: EffectProfile{Known: true, ExternalState: true, UsesNetwork: true, Destructive: true, Irreversible: true, Reason: ReasonExternalState, Targets: []Target{{Kind: TargetExternal}}}},
{name: "unknown", command: "custom-tool --run", want: EffectProfile{WorkspaceWrite: true, Reason: "command effects are not statically known"}},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
args, _ := json.Marshal(map[string]string{"command": tt.command})
got := ClassifyEffect(EffectInput{ToolName: "bash", Args: args})
if got.Known != tt.want.Known || got.ReadOnly != tt.want.ReadOnly || got.WorkspaceWrite != tt.want.WorkspaceWrite ||
got.ExternalState != tt.want.ExternalState || got.Destructive != tt.want.Destructive ||
got.Irreversible != tt.want.Irreversible || got.UsesNetwork != tt.want.UsesNetwork {
t.Fatalf("profile = %+v, want %+v", got, tt.want)
}
})
}
}
func TestClassifyEffectFileAndMCP(t *testing.T) {
edit := ClassifyEffect(EffectInput{
ToolName: "edit_file",
Args: json.RawMessage(`{"path":"internal/agent/agent.go"}`),
})
if !edit.Known || !edit.WorkspaceWrite || len(edit.Targets) != 1 || edit.Targets[0].Path != "internal/agent/agent.go" {
t.Fatalf("edit profile = %+v", edit)
}
read := ClassifyEffect(EffectInput{
ToolName: "read_file",
Args: json.RawMessage(`{"path":"auth/session.go"}`),
StaticReadOnly: true,
})
if !read.ReadOnly || read.MutatesState() {
t.Fatalf("read-only file must not mutate: %+v", read)
}
mcpRead := ClassifyEffect(EffectInput{
ToolName: "mcp__srv__get",
Hint: CallHint{Present: true, ReadOnly: true},
})
if !mcpRead.ReadOnly || mcpRead.MutatesState() {
t.Fatalf("MCP read-only annotation = %+v", mcpRead)
}
opaque := ClassifyEffect(EffectInput{ToolName: "mcp__srv__write", Args: json.RawMessage(`{}`)})
if opaque.Known || !opaque.OpaqueWriter() {
t.Fatalf("unknown MCP writer must fail closed: %+v", opaque)
}
}
func TestClassifyEffectPrefersReceiptPaths(t *testing.T) {
got := ClassifyEffect(EffectInput{
ToolName: "edit_file",
Args: json.RawMessage(`{"path":"expected.go"}`),
ActualPaths: []string{"actual.go"},
})
if len(got.Targets) != 1 || got.Targets[0].Path != "actual.go" {
t.Fatalf("receipt paths must win: %+v", got)
}
}
func TestEffectProfileCloneCopiesTargets(t *testing.T) {
orig := EffectProfile{Targets: []Target{{Path: "a.go", Kind: TargetFile}}}
clone := orig.Clone()
clone.Targets[0].Path = "b.go"
if orig.Targets[0].Path != "a.go" {
t.Fatal("clone must not share the target slice")
}
}
internal/evidence/review_evidence.go
+28
View File
@@ -0,0 +1,28 @@
package evidence
import (
"path/filepath"
"strings"
)
// ReceiptShowsWholeGitDiff reports whether a successful shell receipt exposed
// the current repository diff content. Status summaries and diff --check do
// not count as content review.
func ReceiptShowsWholeGitDiff(rec Receipt) bool {
toolName := strings.ToLower(strings.TrimSpace(rec.ToolName))
return receiptCommandSucceeded(rec) && (toolName == "bash" || toolName == "shell") && rec.OutputBytes > 0 && commandShowsWholeGitDiff(rec.Command)
}
// ReceiptShowsContentForPath reports whether a successful shell receipt
// exposed the named file's content rather than merely mentioning the path.
func ReceiptShowsContentForPath(rec Receipt, path string) bool {
toolName := strings.ToLower(strings.TrimSpace(rec.ToolName))
path = strings.ToLower(filepath.ToSlash(normalizePath(path)))
return path != "" && receiptCommandSucceeded(rec) &&
(toolName == "bash" || toolName == "shell") && rec.OutputBytes > 0 &&
commandShowsContentForPath(rec.Command, path)
}
func receiptCommandSucceeded(rec Receipt) bool {
return rec.Success && (rec.ExitCode == nil || *rec.ExitCode == 0) && rec.Verification != VerificationFailed
}
internal/evidence/review_report.go
+16 -20
View File
@@ -80,6 +80,8 @@ func ParseReviewReport(raw json.RawMessage) (ReviewReport, error) {
}
// CoversPaths reports whether every required production path was reviewed.
// A fuller absolute path may cover the same relative path, but a bare
// basename never covers a directory-qualified target.
func (r ReviewReport) CoversPaths(required []string) bool {
if len(required) == 0 {
return len(r.ReviewedPaths) > 0
@@ -89,20 +91,22 @@ func (r ReviewReport) CoversPaths(required []string) bool {
if p == "" {
continue
}
if !have[p] {
// Also accept basename coverage for short relative refs.
found := false
base := filepathBase(p)
for h := range have {
if h == p || filepathBase(h) == base {
found = true
break
}
}
if !found {
return false
if have[p] {
continue
}
found := false
for h := range have {
hSlash := strings.ToLower(filepath.ToSlash(h))
pSlash := strings.ToLower(filepath.ToSlash(p))
if strings.HasSuffix(hSlash, "/"+pSlash) ||
(strings.Contains(hSlash, "/") && strings.HasSuffix(pSlash, "/"+hSlash)) {
found = true
break
}
}
if !found {
return false
}
}
return true
}
@@ -140,14 +144,6 @@ func (r ReviewReport) WarningSummaries() []string {
return out
}
func filepathBase(p string) string {
p = strings.ReplaceAll(p, `\`, `/`)
if i := strings.LastIndex(p, "/"); i >= 0 {
return p[i+1:]
}
return p
}
// ReviewReportReceipt is stored on the ledger when a review_report succeeds.
type ReviewReportReceipt struct {
Report ReviewReport
internal/evidence/review_report_test.go
+18
View File
@@ -0,0 +1,18 @@
package evidence
import "testing"
func TestReviewReportCoverageRejectsSameBasenameInAnotherDirectory(t *testing.T) {
report := ReviewReport{ReviewedPaths: []string{"other/agent.go"}}
if report.CoversPaths([]string{"internal/agent/agent.go"}) {
t.Fatal("same basename in another directory must not cover the required path")
}
report.ReviewedPaths = []string{"/workspace/internal/agent/agent.go"}
if !report.CoversPaths([]string{"internal/agent/agent.go"}) {
t.Fatal("a fuller absolute path must cover the same relative target")
}
report.ReviewedPaths = []string{"agent.go"}
if report.CoversPaths([]string{"internal/agent/agent.go"}) {
t.Fatal("a bare basename must not cover a directory-qualified target")
}
}
internal/evidence/risk.go
+2 -28
View File
@@ -16,18 +16,6 @@ const (
RiskHigh RiskLevel = "high"
)
// highRiskPathHints elevate ordinary production edits to High when the path
// touches auth, crypto, networking, providers, plugins, sandbox, config,
// migrations, persistence, or concurrency.
var highRiskPathHints = []string{
"auth", "permission", "secret", "credential", "token", "password", "oauth",
"crypto", "encrypt", "decrypt", "tls", "ssl", "keyring",
"network", "proxy", "http", "websocket", "provider",
"plugin", "mcp", "tool", "schema", "sandbox",
"config", "migrate", "migration", "persist", "store", "database", "db",
"concurrent", "mutex", "race", "lock", "atomic",
}
// highRiskToolHints elevate opaque or privileged mutation surfaces.
var highRiskToolHints = []string{
"mcp__", "install_source", "install_skill", "plugin",
@@ -193,15 +181,7 @@ func (l *Ledger) PathsSince(after int) []string {
}
func pathLooksHighRisk(path, workspaceRoot string) bool {
relevant := riskRelevantPath(path, workspaceRoot)
lower := strings.ToLower(relevant)
base := strings.ToLower(pathpkg.Base(relevant))
for _, hint := range highRiskPathHints {
if strings.Contains(lower, hint) || strings.Contains(base, hint) {
return true
}
}
return false
return pathLooksSensitive(path, workspaceRoot)
}
// riskRelevantPath keeps relative paths intact and makes workspace-owned
@@ -277,13 +257,7 @@ func riskPathWithin(workspaceRoot, value string) (string, bool) {
}
func pathPartsLookHighRisk(parts []string) bool {
lower := strings.ToLower(strings.Join(parts, "/"))
for _, hint := range highRiskPathHints {
if strings.Contains(lower, hint) {
return true
}
}
return false
return pathLooksSensitive(strings.Join(parts, "/"), "")
}
func goTestTempComponent(value string) bool {
internal/jobs/workspace_risk_test.go
+1 -1
View File
@@ -22,7 +22,7 @@ func TestTaskMutationEvidenceUsesWorkspaceRelativeRisk(t *testing.T) {
t.Fatalf("ordinary workspace mutation evidence = %+v, want medium risk", meta)
}
summary.Receipts[0].Paths = []string{"/workspace/toolbox/internal/provider/openai/responses/client.go"}
summary.Receipts[0].Paths = []string{"/workspace/toolbox/internal/auth/session.go"}
meta = mutationEvidenceForArtifact(summary)
if meta == nil || meta.Risk != string(evidence.RiskHigh) {
t.Fatalf("sensitive workspace mutation evidence = %+v, want high risk", meta)
internal/runtimepolicy/constraints.go
+204
View File
@@ -0,0 +1,204 @@
package runtimepolicy
import (
"regexp"
"strings"
"reasonix/internal/shellparse"
)
// Constraints are explicit user or host limits. They never encode task
// complexity, security keywords, or file counts.
type Constraints struct {
ForbidMutation bool
ForbidTests bool
AllowedChecks []string
ForbidExternal bool
RequireFullVerification bool
PlanModeReadOnly bool
Notes []string
}
// ParseConstraints accepts only explicit forbid/limit phrasing.
func ParseConstraints(instruction string) Constraints {
var c Constraints
lower := strings.ToLower(instruction)
if matchesAny(lower, []string{
"只分析", "只读", "不要修改", "别改", "不要改", "仅分析", "只看不改",
"analyze only", "analysis only", "don't modify", "do not modify",
"don't change", "do not change", "no changes", "read only", "read-only",
"without modifying", "without changes", "don't edit", "do not edit",
"复现但不修复", "只复现", "不要修复", "reproduce but don't fix",
"reproduce only", "don't fix", "do not fix", "no fix",
}) {
c.ForbidMutation = true
c.Notes = append(c.Notes, "user_forbid_mutation")
}
if matchesAny(lower, []string{
"不要测试", "别跑测试", "不用测试", "跳过测试", "不要跑测试",
"don't run tests", "do not run tests", "no tests", "skip tests",
"without tests", "don't test", "do not test",
}) {
c.ForbidTests = true
c.Notes = append(c.Notes, "user_forbid_tests")
}
if matchesAny(lower, []string{
"完整验证", "全面验证", "闭环交付", "完整交付", "交付前检查", "验收闭环",
"full verification", "complete verification", "verify everything",
"closed-loop delivery", "deliver with verification",
}) {
c.RequireFullVerification = true
c.Notes = append(c.Notes, "user_require_full_verification")
}
if cmds := parseAllowedChecks(instruction); len(cmds) > 0 {
c.AllowedChecks = cmds
c.Notes = append(c.Notes, "user_allowed_checks")
}
if matchesAny(lower, []string{
"不要 push", "不要push", "别 push", "别push", "不要推送", "不要发布",
"don't push", "do not push", "no push", "don't publish", "do not publish",
"no publish", "don't deploy", "do not deploy",
}) {
c.ForbidExternal = true
c.Notes = append(c.Notes, "user_forbid_external")
}
return c
}
// StripQuotedConstraints removes fenced and quoted spans so cited phrases
// cannot bind the host.
func StripQuotedConstraints(raw string) string {
s := stripFences(raw)
s = stripInlineCode(s)
s = stripQuoted(s, '"', '"')
s = stripQuoted(s, '“', '”')
s = stripQuoted(s, '「', '」')
return strings.TrimSpace(s)
}
func (c Constraints) AllowsMutation() bool {
return !c.ForbidMutation && !c.PlanModeReadOnly
}
func (c Constraints) AllowsTests() bool { return !c.ForbidTests }
func (c Constraints) AllowsExternal() bool { return !c.ForbidExternal }
func (c Constraints) AllowsCommand(command string) bool {
if !c.AllowsTests() {
return false
}
command = strings.TrimSpace(command)
if command == "" || len(c.AllowedChecks) == 0 {
return true
}
for _, allowed := range c.AllowedChecks {
if strings.EqualFold(strings.TrimSpace(allowed), command) {
return true
}
}
commandFields, malformed := shellparse.StaticFields(command)
if malformed != "" || len(commandFields) == 0 {
return false
}
for _, allowed := range c.AllowedChecks {
allowedFields, malformed := shellparse.StaticFields(strings.TrimSpace(allowed))
if malformed == "" && len(allowedFields) > 0 && hasFieldPrefix(commandFields, allowedFields) {
return true
}
}
return false
}
func parseAllowedChecks(instruction string) []string {
patterns := []*regexp.Regexp{
regexp.MustCompile(`(?i)只跑\s+([^\n,，;；]+)`),
regexp.MustCompile(`(?i)只运行\s+([^\n,，;；]+)`),
regexp.MustCompile(`(?i)only\s+run\s+([^\n,;]+)`),
regexp.MustCompile(`(?i)just\s+run\s+([^\n,;]+)`),
}
var out []string
for _, re := range patterns {
m := re.FindStringSubmatch(instruction)
if len(m) < 2 {
continue
}
cmd := strings.Trim(strings.TrimSpace(m[1]), "\"'`。.")
if cmd != "" {
out = append(out, cmd)
}
}
return out
}
func matchesAny(lower string, needles []string) bool {
for _, n := range needles {
if n != "" && strings.Contains(lower, strings.ToLower(n)) {
return true
}
}
return false
}
func hasFieldPrefix(fields, prefix []string) bool {
if len(prefix) > len(fields) {
return false
}
for i := range prefix {
if !strings.EqualFold(fields[i], prefix[i]) {
return false
}
}
return true
}
func stripFences(s string) string {
var b strings.Builder
inFence := false
for line := range strings.SplitSeq(s, "\n") {
trim := strings.TrimSpace(line)
if strings.HasPrefix(trim, "```") {
inFence = !inFence
continue
}
if !inFence {
b.WriteString(line)
b.WriteByte('\n')
}
}
return b.String()
}
func stripInlineCode(s string) string {
var b strings.Builder
in := false
for _, r := range s {
if r == '`' {
in = !in
continue
}
if !in {
b.WriteRune(r)
}
}
return b.String()
}
func stripQuoted(s string, open, close rune) string {
var b strings.Builder
in := false
for _, r := range s {
if !in && r == open {
in = true
continue
}
if in && r == close {
in = false
continue
}
if !in {
b.WriteRune(r)
}
}
return b.String()
}
internal/runtimepolicy/context.go
+54
View File
@@ -0,0 +1,54 @@
package runtimepolicy
import (
"context"
"reasonix/internal/taskcontract"
)
type contextKey struct{}
// InheritedExecutionContext is what a child agent may inherit from its parent.
// It is host-only and never enters a provider schema.
type InheritedExecutionContext struct {
Constraints Constraints
PlanReadOnly bool
GoalScopeID string
PlanContract *taskcontract.DelegatedContract
}
// WithContext stores host execution constraints for the turn.
func WithContext(ctx context.Context, constraints Constraints) context.Context {
if ctx == nil {
ctx = context.Background()
}
return context.WithValue(ctx, contextKey{}, constraints)
}
// FromContext returns host constraints when the controller published them.
func FromContext(ctx context.Context) (Constraints, bool) {
if ctx == nil {
return Constraints{}, false
}
c, ok := ctx.Value(contextKey{}).(Constraints)
return c, ok
}
type inheritKey struct{}
// WithInherited stores the parent execution context for a writer child.
func WithInherited(ctx context.Context, in InheritedExecutionContext) context.Context {
if ctx == nil {
ctx = context.Background()
}
return context.WithValue(ctx, inheritKey{}, in)
}
// InheritedFromContext returns the parent execution context, if any.
func InheritedFromContext(ctx context.Context) (InheritedExecutionContext, bool) {
if ctx == nil {
return InheritedExecutionContext{}, false
}
in, ok := ctx.Value(inheritKey{}).(InheritedExecutionContext)
return in, ok
}
internal/runtimepolicy/doc.go
+5
View File
@@ -0,0 +1,5 @@
// Package runtimepolicy is the monotonic pre/post execution guard engine.
// Guards may only add Deny, Ask, Allow, or obligations; they never revoke a
// stronger decision, rewrite a resolved tool identity, or wait on I/O while
// the contract lock is held.
package runtimepolicy
internal/runtimepolicy/engine.go
+264
View File
@@ -0,0 +1,264 @@
package runtimepolicy
import (
"strings"
"sync"
"reasonix/internal/evidence"
"reasonix/internal/taskcontract"
)
// Engine owns the fact contract behind a dedicated mutex. Permission, tool
// execution, and user prompts must happen outside that lock.
type Engine struct {
mu sync.Mutex
contract *taskcontract.Contract
guards []Guard
constraints Constraints
seq int
}
// NewEngine starts an empty contract with the fixed monotonic guard set.
func NewEngine(constraints Constraints, extra ...Guard) *Engine {
guards := []Guard{
PlanGuard{},
ConstraintGuard{Constraints: constraints},
MutationDependencyGuard{},
ContractPreconditionGuard{},
OpaqueWriterGuard{},
}
guards = append(guards, extra...)
return &Engine{contract: taskcontract.New(""), guards: guards, constraints: constraints}
}
// Constraints returns a copy of the frozen user/host limits.
func (e *Engine) Constraints() Constraints {
if e == nil {
return Constraints{}
}
return e.constraints
}
// Rebuild replaces the contract from a pure fact replay.
func (e *Engine) Rebuild(facts taskcontract.RebuildFacts) {
if e == nil {
return
}
e.mu.Lock()
defer e.mu.Unlock()
e.contract = taskcontract.Rebuild(facts)
e.seq = len(facts.Receipts)
}
// Snapshot copies the contract for lock-free inspection.
func (e *Engine) Snapshot() *taskcontract.Contract {
if e == nil {
return taskcontract.New("")
}
e.mu.Lock()
defer e.mu.Unlock()
return cloneContract(e.contract)
}
// BeforeTool merges guard decisions under the contract lock and returns an
// immutable snapshot. Callers must release before asking the user or running
// a tool.
func (e *Engine) BeforeTool(ctx CallContext) GuardDecision {
if e == nil {
return GuardDecision{Action: GuardAbstain}
}
e.mu.Lock()
defer e.mu.Unlock()
if e.contract != nil {
ctx.HasTodo = ctx.HasTodo || hasTodo(e.contract)
ctx.HasCriteria = ctx.HasCriteria || hasCriteria(e.contract)
ctx.TestsForbidden = ctx.TestsForbidden || e.constraints.ForbidTests
ctx.PriorWriteTargets, ctx.PriorProductionWrite = observedWorkspaceWrites(e.contract)
}
var decisions []GuardDecision
for _, g := range e.guards {
decisions = append(decisions, g.BeforeTool(ctx))
}
merged := MergeDecisions(decisions...)
if merged.Action == GuardAbstain {
// Abstain is not authorization; availability stays with the owner.
return merged
}
return merged
}
// CommitReceipt absorbs a frozen receipt under the contract lock.
func (e *Engine) CommitReceipt(ctx ResultContext) {
if e == nil {
return
}
e.mu.Lock()
defer e.mu.Unlock()
if ctx.Seq == 0 {
e.seq++
ctx.Seq = e.seq
} else if ctx.Seq > e.seq {
e.seq = ctx.Seq
}
if e.contract == nil {
e.contract = taskcontract.New("")
}
e.contract.AbsorbReceipt(
ctx.Seq,
ctx.Receipt,
ctx.WorkspaceRoot,
ctx.TestsForbidden || e.constraints.ForbidTests,
e.constraints.RequireFullVerification,
)
for _, g := range e.guards {
_ = g.AfterTool(ctx)
}
}
// SyncReceipts absorbs ledger receipts that the engine has not yet seen.
func (e *Engine) SyncReceipts(receipts []evidence.Receipt, workspaceRoot string, testsForbidden bool) {
if e == nil {
return
}
e.mu.Lock()
defer e.mu.Unlock()
if e.contract == nil {
e.contract = taskcontract.New("")
}
if testsForbidden || e.constraints.ForbidTests {
testsForbidden = true
}
for i, rec := range receipts {
seq := i + 1
if seq <= e.seq {
continue
}
e.seq = seq
e.contract.AbsorbReceipt(seq, rec, workspaceRoot, testsForbidden, e.constraints.RequireFullVerification)
}
}
// BeforeStop evaluates the contract and guards without waiting on I/O.
func (e *Engine) BeforeStop(ctx StopContext) StopDecision {
if e == nil {
return StopDecision{Disposition: taskcontract.StopReady}
}
e.mu.Lock()
defer e.mu.Unlock()
dec := StopDecision{Disposition: taskcontract.StopReady}
if e.contract != nil {
dec.Disposition = e.contract.Stop(ctx.Opts)
dec.Advisory = e.contract.AdvisoryGaps()
}
for _, g := range e.guards {
got := g.BeforeStop(ctx)
if got.Disposition > dec.Disposition {
dec.Disposition = got.Disposition
dec.Message = got.Message
}
}
return dec
}
// NoteRecoveryAttempt records that a recoverable/strict gap was retried.
func (e *Engine) NoteRecoveryAttempt() {
if e == nil {
return
}
e.mu.Lock()
defer e.mu.Unlock()
if e.contract != nil {
e.contract.NoteRecoveryAttempt()
}
}
func hasTodo(c *taskcontract.Contract) bool {
if c == nil {
return false
}
for _, o := range c.Obligations {
if o.Kind == taskcontract.ObligationTodo && len(o.SatisfiedBy) > 0 {
return true
}
}
for _, req := range c.Requirements {
if req.ID != "" {
return true
}
}
return false
}
func hasCriteria(c *taskcontract.Contract) bool {
if c == nil {
return false
}
for _, req := range c.Requirements {
if req.Required {
return true
}
}
return false
}
func observedWorkspaceWrites(c *taskcontract.Contract) ([]evidence.TargetKey, bool) {
if c == nil {
return nil, false
}
seen := make(map[evidence.TargetKey]bool)
var targets []evidence.TargetKey
production := false
for _, obligation := range c.Obligations {
local, prod := localWriteOrigin(obligation.Origin)
if !local {
continue
}
for _, target := range obligation.Targets {
key := string(target)
if (!strings.HasPrefix(key, "file:") && !strings.HasPrefix(key, "dir:")) || seen[target] {
continue
}
seen[target] = true
targets = append(targets, target)
}
production = production || prod
}
return targets, production
}
func localWriteOrigin(origin taskcontract.ReasonCode) (local, production bool) {
switch origin {
case taskcontract.ReasonDocsEdit:
return true, false
case taskcontract.ReasonProductionEdit, taskcontract.ReasonMultiFile,
taskcontract.ReasonSchemaPath, taskcontract.ReasonAuthPath,
taskcontract.ReasonDestructive, taskcontract.ReasonOpaqueWriter:
return true, true
default:
return false, false
}
}
func cloneContract(c *taskcontract.Contract) *taskcontract.Contract {
if c == nil {
return taskcontract.New("")
}
out := *c
out.Requirements = append([]taskcontract.Requirement(nil), c.Requirements...)
out.Checks = append([]taskcontract.Check(nil), c.Checks...)
out.Obligations = append([]taskcontract.Obligation(nil), c.Obligations...)
for i := range out.Obligations {
out.Obligations[i] = cloneStored(out.Obligations[i])
}
return &out
}
func cloneStored(o taskcontract.Obligation) taskcontract.Obligation {
if len(o.Targets) > 0 {
o.Targets = append(o.Targets[:0:0], o.Targets...)
}
if len(o.SatisfiedBy) > 0 {
o.SatisfiedBy = append(o.SatisfiedBy[:0:0], o.SatisfiedBy...)
}
return o
}
internal/runtimepolicy/engine_test.go
+359
View File
@@ -0,0 +1,359 @@
package runtimepolicy
import (
"encoding/json"
"sync"
"testing"
"reasonix/internal/evidence"
"reasonix/internal/taskcontract"
)
func TestMergeDecisionsIsMonotonic(t *testing.T) {
allow := GuardDecision{Action: GuardAllow}
ask := GuardDecision{Action: GuardAsk, Message: "ask"}
deny := GuardDecision{Action: GuardDeny, Message: "deny"}
got := MergeDecisions(allow, deny, ask)
if got.Action != GuardDeny || got.Message != "deny" {
t.Fatalf("merge = %+v", got)
}
got = MergeDecisions(ask, allow)
if got.Action != GuardAsk {
t.Fatalf("ask must outrank allow: %+v", got)
}
}
func TestPlanGuardBeatsYOLO(t *testing.T) {
ctx := CallContext{
PlanReadOnly: true,
Profile: evidence.EffectProfile{Known: true, WorkspaceWrite: true},
}
if (PlanGuard{}).BeforeTool(ctx).Action != GuardDeny {
t.Fatal("plan writes must deny even when permission would allow")
}
}
func TestOpaqueWriterAskOrDeny(t *testing.T) {
ctx := CallContext{Profile: evidence.EffectProfile{WorkspaceWrite: true, Reason: evidence.ReasonOpaqueWriter}}
if (OpaqueWriterGuard{}).BeforeTool(ctx).Action != GuardDeny {
t.Fatal("headless unknown writer must deny")
}
ctx.Interactive = true
if (OpaqueWriterGuard{}).BeforeTool(ctx).Action != GuardAsk {
t.Fatal("interactive unknown writer must ask")
}
}
func TestConstraintNoWrite(t *testing.T) {
g := ConstraintGuard{Constraints: Constraints{ForbidMutation: true}}
ctx := CallContext{Profile: evidence.EffectProfile{Known: true, WorkspaceWrite: true}}
if g.BeforeTool(ctx).Action != GuardDeny {
t.Fatal("explicit no-write must deny")
}
}
func TestEngineCommitInvalidatesWithoutRace(t *testing.T) {
e := NewEngine(Constraints{})
write := ResultContext{
Receipt: evidence.Receipt{
ToolName: "edit_file", Success: true, Write: true, Mutation: true,
Args: json.RawMessage(`{"path":"internal/agent/agent.go"}`), Paths: []string{"internal/agent/agent.go"},
},
Profile: evidence.ClassifyEffect(evidence.EffectInput{
ToolName: "edit_file", Args: json.RawMessage(`{"path":"internal/agent/agent.go"}`),
ActualPaths: []string{"internal/agent/agent.go"},
}),
}
start := make(chan struct{})
var wg sync.WaitGroup
wg.Add(2)
go func() {
defer wg.Done()
<-start
e.CommitReceipt(write)
}()
go func() {
defer wg.Done()
<-start
_ = e.BeforeStop(StopContext{})
}()
close(start)
wg.Wait()
snap := e.Snapshot()
if len(snap.Obligations) == 0 {
t.Fatal("successful writer must create obligations")
}
}
func TestConcurrentReadOnlyBeforeTool(t *testing.T) {
e := NewEngine(Constraints{})
ctx := CallContext{Profile: evidence.EffectProfile{Known: true, ReadOnly: true}}
start := make(chan struct{})
var wg sync.WaitGroup
wg.Add(2)
for range 2 {
go func() {
defer wg.Done()
<-start
if e.BeforeTool(ctx).Action == GuardDeny {
t.Error("read-only overlap must not deny")
}
}()
}
close(start)
wg.Wait()
}
func TestFailedWriterBarrier(t *testing.T) {
g := MutationDependencyGuard{Blocked: true}
ctx := CallContext{Profile: evidence.EffectProfile{Known: true, WorkspaceWrite: true}}
if g.BeforeTool(ctx).Action != GuardDeny {
t.Fatal("failed writer must block later mutations")
}
read := CallContext{Profile: evidence.EffectProfile{Known: true, ReadOnly: true}}
if g.BeforeTool(read).Action != GuardAbstain {
t.Fatal("read-only diagnosis may still run after a failed writer")
}
}
func TestWriterPreflightInterleavesWithTodoRebuild(t *testing.T) {
e := NewEngine(Constraints{})
auth := authWriteCall()
if e.BeforeTool(auth).Action != GuardDeny {
t.Fatal("auth write without todo must deny")
}
start := make(chan struct{})
var wg sync.WaitGroup
var decision GuardDecision
wg.Add(2)
go func() {
defer wg.Done()
<-start
decision = e.BeforeTool(auth)
}()
go func() {
defer wg.Done()
<-start
e.Rebuild(taskcontract.RebuildFacts{
Todos: []evidence.TodoItem{{Content: "fix login timeout", Status: "in_progress"}},
})
}()
close(start)
wg.Wait()
if decision.Action != GuardDeny && decision.Action != GuardAllow {
t.Fatalf("interleaved preflight = %+v", decision)
}
if len(e.Snapshot().Requirements) == 0 {
t.Fatal("todo rebuild must remain after interleaved preflight")
}
if e.BeforeTool(auth).Action == GuardDeny {
t.Fatal("auth write after todo rebuild must not deny for missing preconditions")
}
}
func TestFailedWriterCommitInterleavesWithoutSuccessObligations(t *testing.T) {
e := NewEngine(Constraints{})
failed := ResultContext{
Receipt: evidence.Receipt{
ToolName: "edit_file", Success: false, Write: true, Mutation: true,
Args: json.RawMessage(`{"path":"internal/agent/agent.go"}`), Paths: []string{"internal/agent/agent.go"},
},
Profile: evidence.ClassifyEffect(evidence.EffectInput{
ToolName: "edit_file", Args: json.RawMessage(`{"path":"internal/agent/agent.go"}`),
}),
}
later := CallContext{
Profile: evidence.EffectProfile{Known: true, WorkspaceWrite: true},
}
start := make(chan struct{})
var wg sync.WaitGroup
wg.Add(3)
go func() {
defer wg.Done()
<-start
e.CommitReceipt(failed)
}()
go func() {
defer wg.Done()
<-start
_ = e.BeforeTool(later)
}()
go func() {
defer wg.Done()
<-start
_ = e.BeforeStop(StopContext{})
}()
close(start)
wg.Wait()
for _, o := range e.Snapshot().Obligations {
if o.Kind == taskcontract.ObligationTargetedVerify || o.Kind == taskcontract.ObligationDiffReview {
t.Fatalf("failed writer created success obligation: %+v", o)
}
}
}
func TestRebuildInterleavesWithSnapshotAndStop(t *testing.T) {
facts := taskcontract.RebuildFacts{Receipts: []evidence.Receipt{{
ToolName: "edit_file", Success: true, Write: true, Mutation: true,
Args: json.RawMessage(`{"path":"internal/agent/agent.go"}`), Paths: []string{"internal/agent/agent.go"},
}}}
e := NewEngine(Constraints{})
start := make(chan struct{})
var wg sync.WaitGroup
wg.Add(3)
go func() {
defer wg.Done()
<-start
e.Rebuild(facts)
}()
go func() {
defer wg.Done()
<-start
_ = e.Snapshot()
}()
go func() {
defer wg.Done()
<-start
_ = e.BeforeStop(StopContext{})
}()
close(start)
wg.Wait()
want := taskcontract.Rebuild(facts)
got := e.Snapshot()
if len(got.Obligations) != len(want.Obligations) {
t.Fatalf("replay drifted under interleaving: %+v vs %+v", got.Obligations, want.Obligations)
}
}
func TestChildMergeInterleavesWithParentStop(t *testing.T) {
parent := evidence.NewLedger()
child := evidence.NewLedger()
child.Record(evidence.Receipt{
ToolName: "edit_file", Success: true, Write: true, Mutation: true,
Args: json.RawMessage(`{"path":"internal/agent/agent.go"}`), Paths: []string{"internal/agent/agent.go"},
})
e := NewEngine(Constraints{})
start := make(chan struct{})
var wg sync.WaitGroup
wg.Add(2)
go func() {
defer wg.Done()
<-start
parent.MergeChild(child.Summary())
}()
go func() {
defer wg.Done()
<-start
_ = e.BeforeStop(StopContext{})
}()
close(start)
wg.Wait()
e.Rebuild(taskcontract.RebuildFacts{Receipts: parent.Receipts()})
if len(e.Snapshot().Unsatisfied()) == 0 {
t.Fatal("merged child write must replay into the parent contract")
}
}
func TestSequentialProductionWritesEscalatePreconditions(t *testing.T) {
e := NewEngine(Constraints{})
e.CommitReceipt(writeResult("internal/agent/agent.go"))
if got := e.BeforeTool(writeCall("internal/agent/run_loop.go")); got.Action != GuardDeny {
t.Fatalf("second production target without todo and criteria = %+v, want deny", got)
}
if got := e.BeforeTool(writeCall("internal/agent/agent.go")); got.Action == GuardDeny {
t.Fatalf("repeat write to the same target must not become multi-file: %+v", got)
}
docs := NewEngine(Constraints{})
docs.CommitReceipt(writeResult("README.md"))
if got := docs.BeforeTool(writeCall("docs/usage.md")); got.Action == GuardDeny {
t.Fatalf("two docs targets must remain lightweight: %+v", got)
}
pathless := CallContext{Profile: evidence.EffectProfile{Known: true, WorkspaceWrite: true}}
if got := e.BeforeTool(pathless); got.Action != GuardDeny {
t.Fatalf("pathless writer after a production write must establish preconditions: %+v", got)
}
}
func TestRequireFullVerificationSurvivesParseRebuildAndReplay(t *testing.T) {
constraints := ParseConstraints("请闭环交付")
if !constraints.RequireFullVerification {
t.Fatal("explicit closed-loop request must require full verification")
}
e := NewEngine(constraints)
e.CommitReceipt(writeResult("README.md"))
if !hasUnsatisfiedKind(e.Snapshot(), taskcontract.ObligationFullVerify, taskcontract.EnforcementStrict) {
t.Fatalf("explicit full verification constraint missing after write: %+v", e.Snapshot().Obligations)
}
e.CommitReceipt(ResultContext{Receipt: evidence.Receipt{
ToolName: "bash", Success: true, Command: "go test ./internal/taskcontract",
Verification: evidence.VerificationPassed,
}})
if !hasUnsatisfiedKind(e.Snapshot(), taskcontract.ObligationFullVerify, taskcontract.EnforcementStrict) {
t.Fatal("targeted verification must not clear explicit full verification")
}
e.CommitReceipt(ResultContext{Receipt: evidence.Receipt{
ToolName: "bash", Success: true, Command: "go test ./...",
Verification: evidence.VerificationPassed,
}})
if hasUnsatisfiedKind(e.Snapshot(), taskcontract.ObligationFullVerify, taskcontract.EnforcementStrict) {
t.Fatal("full-project verification must clear explicit full verification")
}
}
func TestRebuildThenSyncDoesNotReplayReceipts(t *testing.T) {
receipts := []evidence.Receipt{writeResult("internal/agent/agent.go").Receipt}
e := NewEngine(Constraints{})
e.Rebuild(taskcontract.RebuildFacts{Receipts: receipts})
if got := e.Snapshot().Epoch(); got != 1 {
t.Fatalf("epoch after rebuild = %d, want 1", got)
}
e.SyncReceipts(receipts, "", false)
if got := e.Snapshot().Epoch(); got != 1 {
t.Fatalf("epoch after syncing rebuilt receipts = %d, want 1", got)
}
}
func writeCall(path string) CallContext {
args := json.RawMessage(`{"path":"` + path + `"}`)
return CallContext{
ToolName: "edit_file",
Args: args,
Profile: evidence.ClassifyEffect(evidence.EffectInput{
ToolName: "edit_file", Args: args, ActualPaths: []string{path},
}),
}
}
func writeResult(path string) ResultContext {
call := writeCall(path)
return ResultContext{
Receipt: evidence.Receipt{
ToolName: "edit_file", Success: true, Write: true, Mutation: true,
Args: call.Args, Paths: []string{path},
},
Profile: call.Profile,
}
}
func hasUnsatisfiedKind(c *taskcontract.Contract, kind taskcontract.ObligationKind, enforcement taskcontract.Enforcement) bool {
for _, obligation := range c.Unsatisfied() {
if obligation.Kind == kind && obligation.Enforcement == enforcement {
return true
}
}
return false
}
func authWriteCall() CallContext {
return CallContext{
ToolName: "edit_file",
Args: json.RawMessage(`{"path":"internal/auth/session.go"}`),
Profile: evidence.ClassifyEffect(evidence.EffectInput{
ToolName: "edit_file", Args: json.RawMessage(`{"path":"internal/auth/session.go"}`),
}),
}
}
internal/runtimepolicy/guard.go
+92
View File
@@ -0,0 +1,92 @@
package runtimepolicy
import (
"encoding/json"
"reasonix/internal/evidence"
"reasonix/internal/taskcontract"
)
// GuardAction is one monotonic preflight verdict.
type GuardAction uint8
const (
GuardAbstain GuardAction = iota
GuardAllow
GuardAsk
GuardDeny
)
// GuardDecision is one guard's immutable snapshot.
type GuardDecision struct {
Action GuardAction
Preconditions []taskcontract.Obligation
Reasons []taskcontract.ReasonCode
Message string
}
// CallContext is the resolved, already-identified tool call.
type CallContext struct {
ToolName string
Args json.RawMessage
Profile evidence.EffectProfile
PlanReadOnly bool
Interactive bool
HasTodo bool
HasCriteria bool
Verification bool
TestsForbidden bool
WorkspaceRoot string
PriorWriteTargets []evidence.TargetKey
PriorProductionWrite bool
}
// ResultContext is the frozen post-execute receipt.
type ResultContext struct {
Seq int
Receipt evidence.Receipt
Profile evidence.EffectProfile
WorkspaceRoot string
TestsForbidden bool
}
// StopContext is the host-visible state at a proposed stop.
type StopContext struct {
GoalActive bool
ApprovedPlan bool
Opts taskcontract.StopOptions
IncompleteTodo bool
}
// StopDecision is the composed stop stance plus any user-visible note.
type StopDecision struct {
Disposition taskcontract.StopDisposition
Message string
Advisory []taskcontract.Obligation
}
// Guard is one monotonic pipeline stage.
type Guard interface {
BeforeTool(CallContext) GuardDecision
AfterTool(ResultContext) []evidence.Receipt
BeforeStop(StopContext) StopDecision
}
// MergeDecisions applies Deny > Ask > Allow > Abstain and concatenates
// obligations. Later guards cannot revoke a stronger action.
func MergeDecisions(decisions ...GuardDecision) GuardDecision {
out := GuardDecision{Action: GuardAbstain}
for _, d := range decisions {
if d.Action > out.Action {
out.Action = d.Action
if d.Message != "" {
out.Message = d.Message
}
} else if out.Message == "" && d.Message != "" && d.Action == out.Action {
out.Message = d.Message
}
out.Preconditions = append(out.Preconditions, d.Preconditions...)
out.Reasons = append(out.Reasons, d.Reasons...)
}
return out
}
Loaded 100 of 122 files, more files were not shown because too many files have changed in this diff. Show more