feat(agents): read-only reviewed task catalog

.gitleaks.toml

@@ -29,3 +29,10 @@ condition = "AND"
 paths = ['''^tests/mcp-inspect-tools\.test\.ts$''']
 regexTarget = "line"
 regexes = ['''(?m)^\s*const SECRET_CANARY = "zqx-secret-canary-7731";\s*$''']
+
+[[rules.allowlists]]
+description = "Task catalog tests use a fixed synthetic canary to prove smuggled env values are never echoed"
+condition = "AND"
+paths = ['''^tests/project-task-catalog\.test\.ts$''']
+regexTarget = "line"
+regexes = ['''(?m)^\s*const SECRET_CANARY = "secret-canary-91c4d0";\s*$''']

.hack/tasks.json

@@ -0,0 +1,172 @@
+{
+  "schema": "hack.tasks.v0",
+  "tasks": [
+    {
+      "id": "models",
+      "summary": "Check the repository's TLA+ models with TLC in the toolchain service.",
+      "runner": {
+        "kind": "compose_service",
+        "service": "toolchain",
+        "definition_sha256": "5eb5bd4b52eaa878821fd2929292a5c7a5df0bb6524843e0843addd7404fd767"
+      },
+      "argv": ["models"],
+      "workdir": null,
+      "env": { "overlay": null, "keys": [] },
+      "requires": ["checkout_read", "network_egress"],
+      "effects": [
+        "reads_checkout",
+        "network_egress",
+        "creates_ephemeral_container"
+      ],
+      "prerequisites": [
+        "A container engine that Hack can reach.",
+        "The toolchain image builds from .hack/toolchain/Dockerfile; the first build downloads pinned tools."
+      ],
+      "checks": [
+        "Exit status 0 means every model in scripts/check-tla-models.ts passed TLC."
+      ],
+      "cleanup": [
+        "The one-shot container exits; TLC state lives in the container's temporary directory.",
+        "Named toolchain volumes are kept for reuse."
+      ],
+      "provenance": {
+        "source": "repository_script",
+        "inputs": [
+          {
+            "path": ".hack/toolchain/run.sh",
+            "sha256": "0690919e0937c49638ea1c8318d731df3c45df26c3865c6a37ae263e8854e6a5"
+          },
+          {
+            "path": ".hack/toolchain/Dockerfile",
+            "sha256": "26743556cde8930e2105e860a9b6bd3f5d6d4e2a4f5b567df01d4dd3e8e0c745"
+          },
+          {
+            "path": "mise.toml",
+            "sha256": "e43a4542f0c4a466219402a1f5b9ad993bf4a6b109cadfba9281149de9a2f205"
+          },
+          {
+            "path": "package.json",
+            "pointer": "/scripts/test:models",
+            "sha256": "69aff6d9215e0567db0cb729b6f6f227f0482092d3561e813d621cb4d49a0b54"
+          },
+          {
+            "path": "scripts/check-tla-models.ts",
+            "sha256": "e162839a788a69c6c42adcfb28f12aa91943a5f43b2de43c445ea96e88b5cc81"
+          }
+        ],
+        "review": "HACK-1157"
+      }
+    },
+    {
+      "id": "check",
+      "summary": "Install locked dependencies, then run typecheck and lint/format checks in the toolchain service.",
+      "runner": {
+        "kind": "compose_service",
+        "service": "toolchain",
+        "definition_sha256": "5eb5bd4b52eaa878821fd2929292a5c7a5df0bb6524843e0843addd7404fd767"
+      },
+      "argv": ["check"],
+      "workdir": null,
+      "env": { "overlay": null, "keys": [] },
+      "requires": [
+        "checkout_read",
+        "checkout_write",
+        "named_volumes",
+        "network_egress"
+      ],
+      "effects": [
+        "reads_checkout",
+        "writes_checkout",
+        "writes_named_volumes",
+        "network_egress",
+        "creates_ephemeral_container"
+      ],
+      "prerequisites": [
+        "A container engine that Hack can reach.",
+        "The toolchain image builds from .hack/toolchain/Dockerfile; the first build downloads pinned tools."
+      ],
+      "checks": [
+        "Exit status 0 means typecheck and the repository check script passed."
+      ],
+      "cleanup": [
+        "The one-shot container exits; installed dependencies stay in the toolchain_dependencies volume.",
+        "Build tool caches written under the checkout are ignored by Git."
+      ],
+      "provenance": {
+        "source": "repository_script",
+        "inputs": [
+          {
+            "path": ".hack/toolchain/run.sh",
+            "sha256": "0690919e0937c49638ea1c8318d731df3c45df26c3865c6a37ae263e8854e6a5"
+          },
+          {
+            "path": ".hack/toolchain/Dockerfile",
+            "sha256": "26743556cde8930e2105e860a9b6bd3f5d6d4e2a4f5b567df01d4dd3e8e0c745"
+          },
+          {
+            "path": "mise.toml",
+            "sha256": "e43a4542f0c4a466219402a1f5b9ad993bf4a6b109cadfba9281149de9a2f205"
+          },
+          {
+            "path": "package.json",
+            "pointer": "/scripts/check",
+            "sha256": "ae7e24ee743b2aa230c6a492da63a0e7b6a0db925e691a24a7a8f1c97d3ee7fb"
+          },
+          {
+            "path": "package.json",
+            "pointer": "/scripts/typecheck",
+            "sha256": "4209d96797d84dcd31f559acfde1395b9969d025ef6fc11f4684567a3009ef6f"
+          }
+        ],
+        "review": "HACK-1157"
+      }
+    },
+    {
+      "id": "rust-check",
+      "summary": "Check formatting and run Clippy for the runtime-core crate in the toolchain service.",
+      "runner": {
+        "kind": "compose_service",
+        "service": "toolchain",
+        "definition_sha256": "5eb5bd4b52eaa878821fd2929292a5c7a5df0bb6524843e0843addd7404fd767"
+      },
+      "argv": ["rust-check"],
+      "workdir": null,
+      "env": { "overlay": null, "keys": [] },
+      "requires": ["checkout_read", "named_volumes", "network_egress"],
+      "effects": [
+        "reads_checkout",
+        "writes_named_volumes",
+        "network_egress",
+        "creates_ephemeral_container"
+      ],
+      "prerequisites": [
+        "A container engine that Hack can reach.",
+        "The toolchain image builds from .hack/toolchain/Dockerfile; the first build downloads pinned tools."
+      ],
+      "checks": [
+        "Exit status 0 means cargo fmt --check and Clippy with -D warnings passed."
+      ],
+      "cleanup": [
+        "The one-shot container exits; the Cargo registry and build outputs stay in named toolchain volumes."
+      ],
+      "provenance": {
+        "source": "repository_script",
+        "inputs": [
+          {
+            "path": ".hack/toolchain/run.sh",
+            "sha256": "0690919e0937c49638ea1c8318d731df3c45df26c3865c6a37ae263e8854e6a5"
+          },
+          {
+            "path": ".hack/toolchain/Dockerfile",
+            "sha256": "26743556cde8930e2105e860a9b6bd3f5d6d4e2a4f5b567df01d4dd3e8e0c745"
+          },
+          {
+            "path": "mise.toml",
+            "sha256": "e43a4542f0c4a466219402a1f5b9ad993bf4a6b109cadfba9281149de9a2f205"
+          }
+        ],
+        "review": "HACK-1157"
+      }
+    }
+  ]
+}

docs/env.md

@@ -263,6 +263,8 @@ into a host command, and `--target` on env and host commands chooses the `host`
 | `hack config validate` | `--env` | Per invocation; resolves the native selection without reading managed env documents. | Not needed. | Authored native projects only; cannot be combined with `--file`. |
 | `hack config plan` | `--env` | Per invocation; metadata only (names, scopes, secret flags), never decrypted. | Not needed. | Authored native projects only. |
 | `hack project target` | `--env`, `--service` | Per invocation, read-only; reports the overlay selection (explicit, project default or base) without reading env files or values. | Not needed. | Selection only: overlay existence is not checked; no runtime required. |
+| `hack project task list` | `--env` | Per invocation, read-only; selects the overlay that each recipe's reviewed env scope is compared with, without reading env files or values. | Not needed. | Selection only; lists recipes and runs nothing, so no runtime is required. |
+| `hack project task inspect` | `--env` | Per invocation, read-only; as for `hack project task list`, for one recipe. | Not needed. | Selection only; runs nothing, so no runtime is required. |
 | `hack session start` | `--env`, `--service` | When the workspace is created; the name gains `.env-<name>` (`.env-base` for base spellings), and `--up` runs `hack up -d` with the same selection. | Start a new workspace or pass `--env` to `hack session exec`. | Injects into the workspace shell, not into containers. |
 | `hack session exec` | `--env`, `--service` | Per command; omitted reuses the selection encoded in the workspace name. | Each command resolves again. | Injects into the workspace command, not into containers. |
 

docs/reference.md

@@ -31,3 +31,4 @@
 - [MCP tool contract](./reference/mcp-tools.md) — every MCP tool: annotations, inputs, argv, results, and the value-free env tools
 - [MCP logs contract](./reference/mcp-logs.md) — cutoff versus backend failure for the MCP log tools, and the cursor/handle decision
 - [AX target and result contract](./reference/ax-target-result-contract.md) — provisional target schema, closed refusals and the read-only `hack project target` inspector
+- [AX task catalog contract](./reference/ax-task-catalog.md) — provisional reviewed-recipe catalog, closed refusals and the read-only `hack project task list|inspect` commands