name: bug-verify-sonnet
version: 1
description: Read-only verification of an ai-resolve-tagged bug using Sonnet planning
runtime: planning-sonnet-repo
input:
  state: verify-pending
  tags_required: [ai-resolve]
  tags_forbidden: []
  required_artifacts: []
output:
  state: 'verified|rejected'
scope_budget:
  files_modified_max: 1
  lines_diff_max: 400
  wall_clock_seconds_max: 1800
nodes:
  - id: agent
    kind: agent
    template: planning-sonnet-repo
    model: sonnet
    runtime_env:
      AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
      AGENT_BRANCH: "bug-verify/${item.uuid}"
    prompt: |
      The agent-runtimes project repo is cloned at /workspace/project.
      Change to that directory before doing any work.

      Verify the following bug report. This is a READ-ONLY investigation —
      do NOT modify any source code. Your only file changes are the
      verification artifact described below.

      **Title**: ${item.title}

      **Bug report**:
      ${item.body}

      Steps:
      1. cd /workspace/project
      2. Investigate the codebase to determine whether the reported bug is
         real, reproducible, and correctly diagnosed. Do not make code
         changes — this is verification, not a fix.
      3. Write your findings to
         spec/bugs/<slug>-verification.md (derive <slug> from this item's
         own slug) with exactly these sections, in order:
         - `## Reproduction` — concrete steps or evidence confirming (or
           failing to confirm) the reported symptom
         - `## Root-Cause Hypothesis` — the mechanism you believe causes it,
           with file/line references
         - `## Verdict` — exactly one of `verified` or `rejected`
         - `## Rationale` — why you reached that verdict
      4. Commit and push the verification artifact on this branch.
      5. Write the bare verdict token — exactly `verified` or exactly
         `rejected`, nothing else, no trailing whitespace or punctuation —
         to /workspace/verdict. This file is NOT committed to the repo.
         (NOTE 2026-09-06: this SHOULD move to scratchpad/verdict,
         committed+pushed, once verdict-tx can clone the branch to read it
         back — see the runtime_env note on the verdict-tx node below.
         Left as the working /workspace/verdict contract for now.)
      6. Call task_complete.
  - id: verdict-tx
    kind: script
    cmd: scripts/workflow/state-tx-verdict
    depends_on: [agent]
    runtime_env:
      STATE_TX_ALLOWED_STATES: "verified,rejected"
      # NOTE (2026-09-06): scratchpad/verdict cross-node wiring is NOT yet
      # live — script tasks (dispatcher/task_manager.py::_run_script_task)
      # have no credentialed way to clone the agent's branch (the per-task
      # SSH key is provisioned through the full ESO/account harness
      # resolution pipeline, which script tasks deliberately bypass). Left
      # at the /workspace/verdict default pending that follow-up; see
      # spec/bugs or the M-something item tracking it.