Repository navigation
v3.3.0
What's new
Features
Receipt-backed workflow completion guard (#697) — Workflow transitions (implementation, verification, commit, push, PR creation, check/review readback) are now grounded in host-observed evidence rather than self-reported state. A session-scoped, privacy-safe receipt ledger paired with an AST-bounded Bash classifier records real operations as they happen, and guarded transitions require runtime-trusted receipt minima before they're allowed to complete. The guard fails closed on no-ops, replay, ambiguous shell shapes, and incompatible or stale receipt metadata — qualifying receipts are consumed exactly once.
Key pieces of the system:
- OpenCode adapter wiring: a trust-bounded guard configuration supports observe/protected modes with project-scope protection, per-session/per-registration activation, and bounded workflow-control tools. Tool lifecycle hooks can surface blocks before execution while post-execution finalization never throws.
- Operation evidence verification: current-state-bound before/after evidence, class-specific no-op and resource validation, and operation-aware staleness tracking ensure receipts reflect the true state of the workspace, repository, or resource in question.
- Restart and recovery: receipts persist deterministically across restarts, with replay-safe readback, stale-evidence repair, and session-scoped projections. Foreground task child receipts roll up into fresh, parent-scoped, once-only evidence, failing closed on fork copies or mismatched lineage.
- Local and remote operation observation: production write/edit/apply-patch and Bash verification/commit operations now mint real receipts using a stable-target/mutable-revision identity model and symlink-safe worktree hashing. Push, PR creation, and check/review readback observation use narrow, read-only git/gh JSON readbacks, storing digest-only resource identity and failing closed on unavailable or oversized readbacks.
- Question attestation: a host-neutral, one-time attestation state machine (challenge → bind-asked → observe-reply → consume) gates certain transitions behind an exact-token yes/confirm reply, with replay and substitution protection and no retained user prose.
- Skill-to-operation mapping: guarded skills are mapped to their required shipping operations on activation, with PR-check/review resource scopes deferred until the PR materializes and push upstream refs bound at start.
The guard also picks up several correctness fixes along the way: worktree digests now reflect working-tree content (not just the git index) so staleness checks stay accurate after staged edits; push classification recognizes more common git push command forms while still rejecting destructive refspecs (force/delete/mirror-like); and workflow observer subprocess calls now have bounded timeouts with fail-closed behavior. Configuration and generated documentation were updated to document the observe/protected/disabled modes, and CodeQL findings around predictable temp-file paths and a TOCTOU read window in test helpers were resolved using secure temp directories and readlink-first reads.