GiviLoop 0.8.0 — Opt-in automatic double check at task completion

GiviLoop 0.8.0 — Automatic double check at task completion

An agent can now request a second opinion when it finishes a code task, without a separate review prompt. givi auto-review enable installs a project AGENTS.md rule and pins the locally configured reviewer. With MCP connected and instructions loaded, the host calls givi_auto_review, verifies concrete findings and exports evidence. Setup and scope.

Behavior

• Opt-in per checkout; setup alone sends nothing automatically. Disable removes the managed rule while preserving other project instructions and saved evidence.
• Selected changed source/test files only, with bounded context and best-effort redaction. Failed checks and selections without eligible code skip transmission. Checks are the host's attestation, not tests executed by GiviLoop.
• Persistent once-per-task and unchanged-snapshot guards shared by CLI/MCP. Review-driven fixes cannot trigger a loop when the task ID is preserved. Concurrent operations do not submit twice.
• Quiet browser delivery, no provider fallback. Login, verification, cancellation, failures and interrupted attempts suspend automatic sends; explicit recovery never silently resubmits uncertain requests.
• Source changes during or after the review are flagged. Successful delivery remains pending independent verification; there is no automatic clean-code verdict or blind application of suggestions.
• Ordinary run cleanup preserves records referenced by automatic-review history. The history has explicit size/count bounds.

Live validation, 2026-09-23

The locally installed tarball passed 214 unit/integration tests and 53 real-browser fixture tests, with zero production dependency vulnerabilities reported by npm audit. The release assets attach the corresponding CI package and test evidence after the release commit passes CI.

A public synthetic discount-allocation change was reviewed through the actual MCP tool and signed-in Claude browser session on macOS arm64. Two happy-path tests passed before submission. The live reviewer found that splitDiscount(100, 3) returned [33, 33, 33], losing one cent despite the explicit sum-preservation contract. An independent local reproduction confirmed the result; the exported report recorded one confirmed finding.

Delivery completed in 18.068 seconds. Calls with the same task and the same snapshot were deduplicated. The focus observer sampled approximately every 20 ms, recorded no foreground transition to the owned Chrome process, and the dedicated profile was released on MCP disconnect. This observation does not guarantee zero flashes on other desktops.

This was a seeded public example, not evidence of general review accuracy or adoption. A test harness explicitly invoked the host lifecycle call: an unattended coding-agent session choosing to invoke the new rule has not been validated. The underlying MCP/CLI and real-browser fixture tests cover successful delivery, attention/resume, deduplication, concurrent calls and failure handling. Local runtime integration tests use a loopback fixture; they do not establish new trained-model results.

Remaining limits

Automatic invocation depends on the host loading and following AGENTS.md; this is not an IDE hook or file watcher. MCP configuration and a new agent session are required. Other clients need their equivalent instruction mechanism. The host remains responsible for selecting task scope, reporting checks honestly and verifying the review.

Source extension/path filtering deliberately omits configuration, docs and generated files. Whitespace edits in code remain eligible; there is no semantic formatting detector. Current changes relative to HEAD are covered, not already committed branch changes. Additional callers/contracts can require an explicit focused review. Browser adapters remain experimental; provider terms, accounts, quotas and verification still apply. Headless ChatGPT is unsupported in practice. Total token savings remain unmeasured. DwarfStar trained-model validation is still pending. No new model-accuracy ranking, external pilot or automatic telemetry was introduced.

The README video remains the clearly labeled 0.5.0 recording. The new automatic flow is documented in text; no replacement video is claimed.

Verified commit: a2158f7. Successful CI run: 214 unit tests, 53 browser tests, zero production dependency vulnerabilities. The tarball below is the exact CI artifact. automatic-live-validation.json records the separate macOS live test. automatic-double-check-report.md contains its independently assessed finding on a public seeded example. Unattended host invocation remains unvalidated.