AgentOps 3.2: the verification keystone

3.2 is a minor on top of 3.1 and 3.0. The north star is unchanged — AgentOps is the in-session operating loop plus the verification membrane that proves work is done. Read 3.0.md for what AgentOps is and 3.1.md for how it became installable and gate-disciplined. This page covers what 3.2 adds: verification becomes the front door, the reviewer becomes standing infrastructure, the membrane remembers, and the CLI sheds the cathedral. When this page and 3.0 disagree on the core thesis, 3.0 wins.

3.1 proved the gate; 3.2 makes the gate the product you can hold. Four moves:

ao verify is the front door. One canonical verb over the cross-family review engine — review a change, get a CONFIRMED/REFUTED verdict bound to the provenance ledger, and prove it later.
The reviewer is standing infrastructure. A warm multi-model service with self-healing routes and honest failure labels, not a hand-rolled per-review invocation.
The membrane remembers. Catches are recorded, recalled by domain, and honestly triaged; the escape→derived-check loop is proven end-to-end on the shipped binary.
The cathedral is shed. The default build is the verification + bookkeeping spine; speculative surfaces moved behind build tags or out of the tree entirely.

The verify story (the front door)

Before 3.2, the cross-family review lived in scripts an operator had to know about. Now it is a product surface:

ao verify reviews a commit through the pawl engine and binds the verdict to docs/provenance/ledger.jsonl — the same ledger the close gate and the receipts read. No verdict = not done, now with a front door.
ao verify init installs the portable pre-push verdict ratchet in any repo — the membrane is no longer something only this repo has. ao verify receipts renders a proof page from the embedded bundle; ao done closes a bead only with a verdict reference.
ao verify stats prices the loop: dispositions, refute rate, rounds, wall-time, degraded share by reviewer family, and a re-review (rebase-waste) gauge — the instrument for the standing north star of driving the cost of verified-done toward the cost of unverified-done.

The waste killer is REBOUND: a byte-identical rebase (same patch-id, lineage intact, gate green) re-authorizes an existing verdict instead of burning a fresh cross-family round. Measured re-reviews of unchanged diffs were pure waste; now they are a ledger disposition with Go-side lineage re-validation in the push gate and CI, plus a keep-ref so CI can re-verify an orphaned reviewed commit.

The standing reviewer (honest degradation everywhere)

The reviewer had a structural single point of failure: cold reviews were codex-only, and a codex outage stalled all validation. 3.2 answers with layers, each honest about what it is:

A standing pawl service (ao pawl up/down/health/route/metrics) keeps warm tri-model panes (Claude + Codex + AGY) with capability-adaptive routing, self-healing respawn/reroute, and p50/p95 + agreement SLOs. The default review routes through it when it is up.
A cold failover chain engages only on outage and labels its verdicts degraded — the fallback never masquerades as the primary.
An opt-in strict two-family cold quorum refuses to degrade at all: until a second strict-eligible reviewer family is graduated, it reports honest-UNAVAILABLE rather than pretending redundancy exists.
An evidence-quality floor requires a finding-or-attestation plus a genuine-run marker before CONFIRMED counts, and a live-smoke mode puts runtime evidence in the packet — the membrane reviews more than the diff.

Reliability fixes landed with the layers: verdicts are what panes actually said (never fabricated from a timeout), all panes are collected (no first-REFUTE guillotine), sends are delivery-based, and cold codex invocations share one hardened stall/echo-defended runner.

The membrane remembers

3.2 closes the loop the product has claimed since the escape thesis was written:

ao membrane catch records a panel catch at the verdict chokepoint with a class key and affected paths; ao membrane recall retrieves catches by domain and can inject them into pre-work prompts; ao membrane triage reports recurrence on two honest axes instead of a vanity counter.
The EM loop is proven on the shipped binary: a false CONFIRMED becomes a domain-tagged escape, the escape compiles into a draft constraint, activation enforces it at the gate, the derived check auto-loads by domain citing the escape — and the learned constraint travels to CI and clean clones.
Real token accounting replaced the hardcoded zeros: per-bead capture, ao yield tokens across Claude and Codex transcripts, and an SPC governor over the error budget.

What 3.2 deliberately does not claim: that the escape corpus compounds (ADR-0011) or that the knowledge corpus is a moat (ADR-0004). Those remain demoted hypotheses — and a new honesty gate mechanically bans unproven-claim language from live docs.

Shedding the cathedral

The consolidation minor inside the minor:

Spine partition. Fifteen skills carry spine: true and a behavioral gate; the default ao build ships the verification + bookkeeping core. Corpus-flywheel and legacy families (harvest, refinery, mind, turn, harness, operator, curate) build only with -tags "flywheel legacy" (ADR-0012). Codex twin regeneration scoped to the spine cut routine regen ~70%.
Removals. The ao rpi command surface is gone (ADR-0009 executed; the operating loop is the navigation path). ao recall and ao memory ingest-claude are gone — recall is consumed from the coexisting open-source memory tools rather than rebuilt in-tree. The bd/Dolt tracker is retired; br + bv over a git-JSONL ledger are canonical.
Skill corpus. The prune folded 39 sources into 21 targets (105→65), then consolidation reached 63 with ao skills retire making retirement deterministic through the dispositions ledger.
ao wiki. The OpenKB port compiles .agents/ into a sanitized gold wiki with verdict-gated, digest-bound publishing — the one knowledge surface that survived the consolidation because it feeds retrieval (ao lookup --gold).

What 3.2 does NOT change

The 3.0 thesis stands. In-session loop, hookless by default, no daemon, no telemetry; state stays in .agents/ and the ledger.
Verification is the proven product; the rest is honestly labeled. Experimental tiers, demoted claims, and honest-UNAVAILABLE labels are load-bearing, not decoration.
Out-of-session orchestration stays a substrate concern (AgentWorker roles over NTM, with Agent Mail for contested writes and managed agents where selected), not an in-repo daemon.

Cutting the release

Mechanics are unchanged from 3.1: ao --version is injected at build time from the git tag via goreleaser ldflags — there is no static version file. The plugin manifests (.claude-plugin, .agy-plugin, .codex-plugin, images/gemini/plugin.json) carry 3.2.0 on main; the curated notes live at docs/releases/2026-07-03-v3.2.0-notes.md and pass the hard notes gate. Cutting the v3.2.0 tag is the single load-bearing release step: it turns the landed content into a shipped 3.2 and drives the goreleaser release assets + Homebrew tap.

Tag-cut status: the 3.2 content is fully landed and locally gated; the v3.2.0 annotated tag + push is the one downstream action the release owner performs to publish.

Canonical references: 3.0.md · 3.1.md · CHANGELOG · operating-loop · docs/releases/2026-07-03-v3.2.0-notes.md

7.7 KiB Raw Blame History