Harden ReviewOps retriever lifecycle watchdog

[YCM-Vibe]

Summary

• Add ReviewOps retriever lifecycle helpers for status-file/out-file completion checks.
• Add a lifecycle-only invocation wrapper that can stop waiting once a retriever has produced a guarded terminal result.
• Require strict wrapper completion to prove all three conditions: terminal downloaded/captured status, non-empty output file, and export_identity_guard_enabled=true with export_identity_guard_last_result.accepted=true.
• Keep wrapper and child retriever locks separate by default with .retriever-wrapper.lock, and avoid persisting raw argv in lock payloads.
• Add unit coverage for terminal status/output checks, identity-guard fail-closed behavior, duplicate/stale locks, wrapper strict-mode completion, child success without guard, and wrapper-vs-child lock separation.

Why

A ReviewOps/Deep Research retriever can reach status=downloaded with a non-empty output file but keep polling forever. When that happens, outer notify_on_complete flows never fire even though the artifact is already available. This change makes completion observable without adding browser-side actions or bypassing identity/stale-export safeguards.

Safety boundaries

• Lifecycle-only: no UI clicking, no prompt send/resend, no export trigger, no browser profile or credential inspection.
• Fail-closed strict wrapper mode: status and output are insufficient unless the current-response identity guard is enabled and accepted.
• Single-retriever guard retained; wrapper lock defaults to a separate file to avoid child-lock self-conflict.
• Lock payload stores argv_redacted: true rather than raw command arguments.

Test plan

• python3 -m py_compile agent-workspace/agent_helpers.py agent-workspace/reviewops_retriever_invocation_template.py tests/unit/test_agent_helpers.py
• PYTHONDONTWRITEBYTECODE=1 PYTHONPATH="/Users/yangchongmeng/AI-Workspace/tools/browser-harness/src:/Users/yangchongmeng/AI-Workspace/tools/browser-harness/.venv/lib/python3.11/site-packages" /Users/yangchongmeng/Documents/Codex/2026-04-24/https-github-com-nousresearch-hermes-agent/venv/bin/python3 -m pytest -p no:cacheprovider -q tests/unit/test_agent_helpers.py -> 12 passed
• PYTHONDONTWRITEBYTECODE=1 PYTHONPATH="/Users/yangchongmeng/AI-Workspace/tools/browser-harness/src:/Users/yangchongmeng/AI-Workspace/tools/browser-harness/.venv/lib/python3.11/site-packages" /Users/yangchongmeng/Documents/Codex/2026-04-24/https-github-com-nousresearch-hermes-agent/venv/bin/python3 -m pytest -p no:cacheprovider -q -> 119 passed
• git diff --check
• Added-lines security scan: no findings
• Independent Codex read-only review: approved; no blockers

Branch

• Base: browser-use/browser-harness@main
• Head: YCM-Vibe:reviewops/retriever-watchdog
• Local commits: 1e780cf, 6ac1dd3, 5f61b34

---

Summary by cubic

Adds a lifecycle watchdog and strict wrapper for ReviewOps retrievers to detect completion via status file + non-empty out file + accepted identity guard. Prevents stuck runs from blocking notify_on_complete while staying fail-closed.

• New Features

  • Helpers: transient-safe status read, reviewops_download_is_complete, wait_for_reviewops_download, exit_if_reviewops_downloaded.
  • Wrapper agent-workspace/reviewops_retriever_invocation_template.py: lifecycle-only; exits when terminal status + out-file + identity guard accepted; separate .retriever-wrapper.lock with stale-lock breaking; lock payload redacts argv.

• Bug Fixes

  • Makes completion observable when a retriever reaches status=downloaded with a valid output file, avoiding indefinite polling.

^{Written for commit 5f61b34. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}