@bolloon/bolloon-agent 0.4.32 → 0.5.0

package/dist/agents/pi-sdk.js

@@ -29,7 +29,7 @@ import { DeepThinkingEngine, AgentCoordinator } from '@bolloon/constraint-runtim
 import { WorkflowPivotLoop, createDefaultPivotConfig } from './workflow-pivot-loop.js';
 import { initDocumentReceiver } from './p2p-document-tools.js';
 import { startRun, recordStep, finishRun, readRun, budgetVerdict, recordDegradation, recordHarnessEvent, recordRecovery, setRunStatus, prepareResume, markRunRunning, buildResumeInstruction, argsDigestOf, repeatedFailureCount, classifyError as classifyRunError } from './run-store.js';
-import { createGoal, readGoal, attachRun, findActiveGoal, completeGoalIfEligible, setUnresolved, addEvidence, evaluateGoalCompletion } from './goal-store.js';
+import { createGoal, attachRun, findActiveGoal } from './goal-store.js';
 import { PiAgentHarness } from './pi-harness.js';
 import { DiscoveredAgentsManager, createSocialHeartbeat } from '../social/heartbeat.js';
 import { SkillRegistry } from '@bolloon/constraint-runtime';
@@ -757,6 +757,30 @@ export class PiAgentSession {
                     status: 'needs_human',
                     error: 'LLM 不可用: provider 未初始化或无 apiKey (fallback 不是执行结果, 需要配置或人工处理)',
                 });
+                // ★ M0: "工具/权限不可用"也是一条终止路径 → 同样进收尾漏斗 (规则 ④)。
+                const wiring = await import('./goal-flywheel-wiring.js');
+                const closed = await wiring.closeRunOnce({
+                    goalId: boundGoalId,
+                    runId: rec.runId,
+                    caller: 'runner',
+                    now: new Date().toISOString(),
+                    finalReview: `LLM 不可用 → fallback 收尾 (不是执行结果): ${response}`,
+                });
+                if (!wiring.isRefusal(closed) && closed.outcome) {
+                    const { reduceGoalState } = await import('./goal-state-reducer.js');
+                    await reduceGoalState({
+                        goalId: boundGoalId,
+                        intent: 'closure_outcome',
+                        now: new Date().toISOString(),
+                        by: 'runner',
+                        outcome: {
+                            goalStatus: wiring.goalStatusFromDecision(closed.outcome.decision),
+                            continuation: wiring.toGoalStoreContinuation(closed.outcome.continuation),
+                            reason: closed.outcome.decision.reason,
+                        },
+                        runId: rec.runId,
+                    });
+                }
                 console.log(`[PiAgent] LLM 不可用 → 本次仍落 Run ${rec.runId} (needs_human), 不伪装成正常执行`);
             }
             catch (err) {
@@ -2341,30 +2365,61 @@ ${PiAgentSession.TOOL_SELECTION_GUIDE}
                 await recordDegradation({ kind: 'core', op: 'pi-sdk.finishRun', runId: this.currentRunId, message }).catch(() => { });
                 onStream?.({ type: 'error', content: `⚠️ ${message}`, tool: 'harness' });
             }
-            // 2026-09-16 (M4): Goal 侧完成门 —— Run 结束 ≠ Goal 完成; 只有判据全满足 + 有证据 + 无未解决项才算
+            // ★ 2026-09-25 (M0 接线冻结, 规则 ③ + ④): Run 结束**必过收尾漏斗**。
+            //
+            // 旧写法在这里另起了一套 Goal 侧收尾 (读证据 → `evaluateGoalCompletion` →
+            // `completeGoalIfEligible` / `setUnresolved`): 它**不收尾** —— 不写 Memory、不生成 Skill 候选、
+            // 不写权威 continuation、不留决策记录。于是同一条 Run 在 Supervisor 那里还会再收一次 (或反过来
+            // 这条路径根本不收), 全仓就有了两套"这一轮跑完意味着什么"。那一套已删除。
+            //
+            // 现在: `closeRunOnce` (幂等) → 9 步收尾 → 产物落盘; 再由 Goal reducer 把"下一步是什么"
+            // 落进 Goal (没有 Supervisor 宿主时 Runner 也要留下 continuation, 否则下一次还是从零开始)。
             if (this.currentGoalId) {
                 try {
-                    const full = await readRun(this.currentRunId).catch(() => null);
-                    const ev = (full?.evidence || []).slice(-10);
-                    if (ev.length)
-                        await addEvidence(this.currentGoalId, ev);
-                    const goal = await readGoal(this.currentGoalId);
-                    if (goal) {
-                        const verdict = evaluateGoalCompletion(goal);
-                        if (verdict.complete) {
-                            const done = await completeGoalIfEligible(this.currentGoalId);
-                            onStream?.({ type: 'status', content: `🎯 目标已达成: ${done.reason} (goal=${this.currentGoalId})`, tool: 'harness' });
-                        }
-                        else {
-                            // 不静默: 未达成的目标留在 active, 未解决项写清楚 (下次 prompt 会继续这个 Goal)
-                            const items = verdict.missing.length ? verdict.missing : [`run=${this.currentRunId} 结束但目标未达成: ${verdict.reason}`];
-                            await setUnresolved(this.currentGoalId, items);
-                            onStream?.({ type: 'status', content: `🎯 目标仍在进行 (未判完成): ${verdict.reason}`, tool: 'harness' });
-                        }
+                    const wiring = await import('./goal-flywheel-wiring.js');
+                    const { reduceGoalState } = await import('./goal-state-reducer.js');
+                    const nowIso = new Date().toISOString();
+                    const closed = await wiring.closeRunOnce({
+                        goalId: this.currentGoalId,
+                        runId: this.currentRunId,
+                        caller: 'runner',
+                        now: nowIso,
+                        finalReview: finalResponse ? String(finalResponse).slice(0, 2000) : '',
+                    });
+                    if (wiring.isRefusal(closed)) {
+                        onStream?.({ type: 'status', content: `⚠️ 收尾被拒 (不当作收过): ${closed.reason}`, tool: 'harness' });
+                    }
+                    else if (closed.outcome) {
+                        const view = closed.outcome;
+                        const applied = await reduceGoalState({
+                            goalId: this.currentGoalId,
+                            intent: 'closure_outcome',
+                            now: nowIso,
+                            by: 'runner',
+                            outcome: {
+                                goalStatus: wiring.goalStatusFromDecision(view.decision),
+                                continuation: wiring.toGoalStoreContinuation(view.continuation),
+                                reason: view.decision.reason,
+                            },
+                            runId: view.runId,
+                        });
+                        const line = view.decision.decision === 'complete'
+                            ? `🎯 目标已达成 (仍要过完成门): ${view.decision.reason}`
+                            : `🎯 目标仍在进行 (未判完成): ${view.decision.reason}`;
+                        onStream?.({
+                            type: 'status',
+                            content: `${line}${applied.gateRejected ? ` [完成门拒绝: ${applied.gateRejected}]` : ''} `
+                                + `(收尾 ${view.steps} 步 · memory ${view.memories} · skill 候选 ${view.candidates} · goal=${this.currentGoalId})`,
+                            tool: 'harness',
+                        });
+                    }
+                    else {
+                        // 幂等: 别处 (或上一次) 已经收过尾 —— 事实读不回来就如实说, 不重收也不假装
+                        onStream?.({ type: 'status', content: `🎯 ${closed.reason}`, tool: 'harness' });
                     }
                 }
                 catch (err) {
-                    await recordDegradation({ kind: 'observational', op: 'pi-sdk.goalCompletion', runId: this.currentRunId, message: String(err?.message || err).slice(0, 160) }).catch(() => { });
+                    await recordDegradation({ kind: 'observational', op: 'pi-sdk.runClosure', runId: this.currentRunId, message: String(err?.message || err).slice(0, 160) }).catch(() => { });
                 }
             }
             this.currentRunId = '';

package/dist/agents/run-store.js

@@ -24,14 +24,14 @@ export const RUN_TRANSITIONS = {
     queued: ['running', 'aborted', 'interrupted'],
     running: ['recovering', 'paused', 'awaiting_external', 'done', 'failed', 'aborted', 'interrupted', 'stalled', 'needs_human'],
     recovering: ['running', 'failed', 'aborted', 'needs_human', 'interrupted', 'stalled'],
-    paused: ['running', 'aborted', 'interrupted'],
-    awaiting_external: ['running', 'failed', 'aborted', 'interrupted', 'stalled'],
+    paused: ['running', 'aborted', 'interrupted', 'recovering'],
+    awaiting_external: ['running', 'failed', 'aborted', 'interrupted', 'stalled', 'recovering'],
     done: [],
     failed: [],
     aborted: [],
     interrupted: ['recovering', 'aborted'], // 允许"从 checkpoint 恢复"
     stalled: ['recovering', 'aborted', 'needs_human'],
-    needs_human: ['running', 'aborted'],
+    needs_human: ['running', 'aborted', 'recovering'],
 };
 export function canTransition(from, to) {
     if (from === to)
@@ -572,6 +572,13 @@ function pidAlive(pid) {
         return e?.code === 'EPERM';
     }
 }
+let onRunTerminal = null;
+export function setOnRunTerminal(hook) {
+    onRunTerminal = hook;
+}
+export function getOnRunTerminal() {
+    return onRunTerminal;
+}
 /**
  * 孤儿对账: 启动时把 pid 已死的 running 记录改判 interrupted。
  * 不做这一层的话, 重载后 UI/CLI 会显示"还在跑"的幽灵运行 —— 那是最典型的假状态。
@@ -588,11 +595,14 @@ export async function reconcileOrphans() {
             continue;
         }
         try {
-            await finishRun(r.runId, {
+            const closed = await finishRun(r.runId, {
                 status: 'interrupted',
                 error: `进程 ${r.pid} 已不在 (刷新/重载/崩溃); 运行到此中断`,
             });
             interrupted.push(r.runId);
+            // 终止路径进唯一责任链 (拿不到 Goal 就不收, 不假装收过)
+            if (onRunTerminal)
+                await Promise.resolve(onRunTerminal(closed || r)).catch(() => null);
         }
         catch (err) {
             failed.push(r.runId);
@@ -615,11 +625,14 @@ export async function superviseRuns(now = Date.now()) {
             continue; // 交给 reconcileOrphans
         if (now - Date.parse(r.updatedAt) > cfg.staleMs) {
             try {
-                await finishRun(r.runId, {
+                const closed = await finishRun(r.runId, {
                     status: 'stalled',
                     error: `超过 ${Math.round(cfg.staleMs / 1000)}s 没有新进展 (可能是工具卡住或模型长时间无响应)`,
                 });
                 stalled.push(r.runId);
+                // 同上: 失速也是一条终止路径
+                if (onRunTerminal)
+                    await Promise.resolve(onRunTerminal(closed || r)).catch(() => null);
             }
             catch (err) {
                 failed.push(r.runId);

package/dist/agents/skill-readiness.js

@@ -12,7 +12,9 @@
  */
 import * as os from 'os';
 import { SkillsManager } from './skills-manager.js';
-import { readGoal, setContinuation, updateGoal, addEvidence, } from './goal-store.js';
+import { readGoal, updateGoal, addEvidence, } from './goal-store.js';
+// 2026-09-25 (M0 接线冻结, 规则 ②): Goal 状态与 continuation 变更只有一个漏斗
+import { reduceGoalState } from './goal-state-reducer.js';
 import { recordDegradation } from './run-store.js';
 export function parseSkillSpecs(list = []) {
     const required = [];
@@ -109,15 +111,45 @@ export async function ensureGoalSkillsReady(goal, opts = {}) {
 /** 门禁不过 → 写清事实并把 Goal 交给人 (不启动 Run, 不伪造失败) */
 export async function blockGoalOnSkills(goalId, res) {
     const reason = res.reason || '技能未就绪';
-    await setContinuation(goalId, {
-        wakeReason: 'needs_human', autoContinue: false, needsExternal: undefined,
-        skillReadiness: { ok: false, at: new Date().toISOString(), reason, missing: res.missing, drift: res.drift, degradations: res.degradations },
-    });
-    await updateGoal(goalId, { status: 'needs_human' }).catch(() => { });
-    await addEvidence(goalId, [`技能门禁拦截: ${reason}`]).catch(() => { });
+    // 规则 ②: 状态与 continuation 都经 Goal reducer 写 (单一漏斗)
+    await reduceGoalState({
+        goalId,
+        intent: 'skill_gate_block',
+        now: new Date().toISOString(),
+        by: 'skill-readiness',
+        reason,
+        skillReadiness: {
+            ok: false, at: new Date().toISOString(), reason,
+            missing: res.missing, drift: res.drift, degradations: res.degradations,
+        },
+    }).catch(() => null);
     for (const d of res.degradations)
         await recordDegradation({ kind: 'observational', op: 'skill-readiness', message: d }).catch(() => { });
 }
+/**
+ * 只**记事实**、不改状态: 把本地技能就绪检查的结论写进 `continuation.skillReadiness`。
+ *
+ * ★ 2026-09-25 (P5 验收修复): 飞轮裁决 = `delegate` 时本地技能门禁**不适用** (能力由子 Agent 凭合同
+ *   交付), 所以不能调 `blockGoalOnSkills` (那会把 Goal 打成 needs_human)。但"本地缺什么"必须仍然
+ *   可查 —— 原来只有 `blockGoalOnSkills` 写这个字段, 门禁一放行就没有任何记录了。
+ */
+export async function recordSkillReadiness(goalId, res) {
+    // 规则 ②: continuation 也经 Goal reducer 写 (只记事实, 不改状态)
+    await reduceGoalState({
+        goalId,
+        intent: 'skill_gate_record',
+        now: new Date().toISOString(),
+        by: 'skill-readiness',
+        skillReadiness: {
+            ok: res.ok,
+            at: new Date().toISOString(),
+            reason: res.reason,
+            missing: res.missing,
+            drift: res.drift,
+            degradations: res.degradations,
+        },
+    }).catch(() => null);
+}
 /** 人工批准技能升级: 重新冻结快照 (显式动作, 不隐式切换) */
 export async function approveSkillUpgrade(goalId, opts = {}) {
     const goal = await readGoal(goalId);
@@ -126,8 +158,18 @@ export async function approveSkillUpgrade(goalId, opts = {}) {
     const frozen = await freezeGoalSkills(goal, { ...opts, force: true });
     if (!frozen.ok)
         return { ok: false, reason: frozen.reason };
-    await setContinuation(goalId, { skillReadiness: { ok: true, at: new Date().toISOString(), reason: '人工批准技能升级' }, wakeReason: 'active', autoContinue: true });
-    await updateGoal(goalId, { status: 'active' }).catch(() => { });
-    await addEvidence(goalId, [`技能升级已被人工批准: ${(frozen.snapshot || []).map((s) => `${s.name}@${s.version}`).join(', ')}`]).catch(() => { });
+    // ★ 规则 ⑥ (Skill 不许绕过 验证+快照+可回退 通道): 批准是**人**的动作, 但必须留下通道证据 ——
+    //   快照 (skillSnapshot, 上面 freezeGoalSkills 已写) + 版本 + 变更原因 + 可回退 (fromVersion 仍在
+    //   Goal 上)。这里把"谁批的、为什么"连同新版本一起记进 Goal (走唯一漏斗, 规则 ②)。
+    const versions = (frozen.snapshot || []).map((s) => `${s.name}@${s.version}`);
+    const fromVersions = (goal.skillSnapshot || []).map((s) => `${s.name}@${s.version}`);
+    await reduceGoalState({
+        goalId,
+        intent: 'skill_upgrade_approved',
+        now: new Date().toISOString(),
+        by: 'human',
+        skillReadiness: { ok: true, at: new Date().toISOString(), reason: '人工批准技能升级' },
+        reason: `技能升级已被人工批准 (by=human; from=[${fromVersions.join(', ')}] → to=[${versions.join(', ')}]; 可回退: Goal.skillSnapshot 保留新版本快照, 内容哈希在 skills-manager 侧可核验)`,
+    }).catch(() => null);
     return { ok: true, snapshot: frozen.snapshot };
 }

package/dist/agents/subagent-manager.js

@@ -1,5 +1,7 @@
 import * as fs from 'fs/promises';
 import * as path from 'path';
+// 2026-09-25 (M3 接缝): 换人必须重签合同的判据只有一份 (纯函数, 零 I/O)
+import { childMatchesContract } from './goal-flywheel/wiring/contract.js';
 const DEFAULT_STORAGE_PATH = path.join(process.env.HOME || '/tmp', '.bolloon', 'agents');
 const DEFAULT_TASK_TIMEOUT_MS = 5 * 60 * 1000;
 const DEFAULT_MAX_CONCURRENT_TASKS = 10;
@@ -160,10 +162,36 @@ export class SubAgentManager {
     async assignTask(taskId, toAgentId) {
         const task = this.tasks.get(taskId);
         if (task) {
+            // 2026-09-25 (M3): 挂着工作合同的任务 **不许换人而不换合同**。
+            //   合同把 `childAgentId` 钉死了 (回报核验要求 report.childAgentId === contract.childAgentId),
+            //   把同一份合同指给另一个子 Agent ⇒ 新子的回报必然对不上合同, 合规判定整个失效。
+            //   换人的正确做法是**重新派遣** (父侧 signed 新合同) —— 本方法只维护指派关系, 无权签合同,
+            //   所以这里如实拒绝并留痕, 而不是"改了字段就当换成了"。
+            if (task.goalId && task.workId) {
+                const contract = (task.metadata?.workContract ?? null);
+                if (!contract) {
+                    task.reassignRefused = {
+                        code: 'contract_unreadable',
+                        reason: `任务 ${taskId} 挂着 workId=${task.workId} 却读不到合同 → 无法判断新执行者是否与原合同一致, 拒绝换人 (先重签合同)`,
+                    };
+                    await this.saveTasks();
+                    this.notifyTaskListeners(task);
+                    return;
+                }
+                const same = childMatchesContract(contract, toAgentId);
+                if (!same.ok) {
+                    task.reassignRefused = { code: 'requires_new_contract', reason: same.reason };
+                    await this.saveTasks();
+                    this.notifyTaskListeners(task);
+                    return;
+                }
+                task.reassignRefused = null;
+            }
             task.assignedAgentId = toAgentId;
             task.toAgentId = toAgentId;
             task.status = 'assigned';
             task.assignedAt = new Date().toISOString();
+            await this.heartbeatContractedTask(task, task.assignedAt);
             await this.saveTasks();
             this.notifyTaskListeners(task);
         }
@@ -171,6 +199,37 @@ export class SubAgentManager {
     async updateTaskStatus(taskId, status, result, error) {
         const task = this.tasks.get(taskId);
         if (task) {
+            // 2026-09-25 (M3 接缝): 挂了合同的子任务, 任何状态更新都是"子还活着"的证据 → 记一次心跳。
+            //   这是"执行中统一监控"的输入面: 没有心跳, 阻塞巡检只能看见"卡住", 看不见"在动"。
+            await this.heartbeatContractedTask(task);
+            // 2026-09-25 (飞轮接线 P2): 挂着工作合同的任务, "完成" 必须过回报核验 ——
+            //   回一段漂亮话 (没有逐条判据证据) **不算完成**: 任务留在 in_progress, 原因写清楚,
+            //   而 Goal 那边的 pendingReports 保持 (父仍然在等这份回报)。
+            //
+            // 2026-09-25 (M3): 判据从 `task.workId && task.goalId` 收紧成 `task.goalId` ——
+            //   "派前必须有合同"的**反面**: 目标语境下的任务若**没有**合同 (签发失败 / 旧数据),
+            //   它同样不许自称完成 —— 没有合同的回报不核验也不接受 (handleChildReport 的 no_contract)。
+            if (status === 'completed' && task.goalId) {
+                if (!task.workId) {
+                    task.status = 'in_progress';
+                    task.error = '回报不接受为完成: 这条任务在目标语境下**没有工作合同** '
+                        + '(签合同失败或任务早于合同接线) —— 没有合同就没有判据, 无法核验, 不许当完成记账';
+                    await this.saveTasks();
+                    this.notifyTaskListeners(task);
+                    return;
+                }
+                const verdict = await this.validateTaskReport(task, result ?? '');
+                if (!verdict.accepted) {
+                    task.status = 'in_progress';
+                    if (result)
+                        task.result = result;
+                    task.error = `回报核验不过, 不接受为完成: ${verdict.reason}`
+                        + (verdict.missingEvidence.length ? ` [缺证据: ${verdict.missingEvidence.join('; ')}]` : '');
+                    await this.saveTasks();
+                    this.notifyTaskListeners(task);
+                    return;
+                }
+            }
             task.status = status;
             if (result)
                 task.result = result;
@@ -183,6 +242,31 @@ export class SubAgentManager {
             this.notifyTaskListeners(task);
         }
     }
+    /**
+     * 给挂着合同的任务记一次心跳 (P3 的输入面; 只有真写成盘才算数)。
+     *
+     * 为什么放在**真实派遣过程**里而不是让子 Agent 自己记得报: 心跳是"任务还活着"的事实,
+     * 而子 Agent 是最没有动力报心跳的一方 (它卡住了就不会报)。所以由派遣侧在每一次
+     * 真实状态变化 (派出去 / 换人 / 子更新状态) 时落一次 —— 没有这些落点, 阻塞巡检
+     * 只能看到"从来没心跳过", 分不清"卡住"与"刚派出"。
+     *
+     * 失败**不覆盖** `task.error` (那是子 Agent 的事实), 而是记进 `heartbeatError`:
+     * 心跳写不进去 = 监控会看到"无进展", 这件事必须留在任务上, 不许静默。
+     */
+    async heartbeatContractedTask(task, at) {
+        if (!task.goalId || !task.workId)
+            return;
+        const now = at ?? new Date().toISOString();
+        try {
+            const { recordWorkHeartbeat } = await import('./goal-flywheel-wiring.js');
+            await recordWorkHeartbeat(task.goalId, task.workId, now);
+            task.lastHeartbeatAt = now;
+            task.heartbeatError = null;
+        }
+        catch (e) {
+            task.heartbeatError = `心跳写入失败 (监控会看到"无进展"): ${String(e?.message || e).slice(0, 160)}`;
+        }
+    }
     async getTask(taskId) {
         return this.tasks.get(taskId);
     }
@@ -300,14 +384,136 @@ export class SubAgentManager {
             }
         }
     }
-    async delegateTask(fromAgentId, taskDescription, requiredCapabilities, priority = 'normal', input) {
+    async delegateTask(fromAgentId, taskDescription, requiredCapabilities, priority = 'normal', input, contractOptions) {
         const agent = await this.findBestAgentForTask(requiredCapabilities, fromAgentId);
         if (!agent) {
             const task = await this.createTask('delegate', taskDescription.substring(0, 50), taskDescription, fromAgentId, undefined, priority, input);
-            return { task, agent: undefined };
+            const workContract = await this.issueWorkContractFor(fromAgentId, task, requiredCapabilities, contractOptions);
+            // 派前必须有工作合同 (M3): 目标语境下签不出合同 → **(没有收件人时本来也派不出去)**, 但要如实标注
+            if (!workContract && contractOptions?.goalId) {
+                this.refuseDispatchWithoutContract(task, contractOptions?.goalId);
+                await this.saveTasks();
+                return { task, agent: undefined, workContract: undefined };
+            }
+            if (workContract)
+                await this.heartbeatContractedTask(task);
+            await this.saveTasks();
+            return { task, agent: undefined, workContract };
         }
         const task = await this.createTask('delegate', taskDescription.substring(0, 50), taskDescription, fromAgentId, agent.id, priority, input);
-        return { task, agent };
+        // 2026-09-25 (P2): 派遣这件事**本身**就包含签合同 (不是事后再补一份文档);
+        //   有没有空闲子 Agent 不影响合同签发 (合同锁的是能力与判据, 不是某个人)。
+        //
+        // 2026-09-25 (M3): 签不出合同 ⇒ **不派出**。旧形状是"记个 error 照样把任务交出去",
+        //   那等于"派前必须有的合同"在失败路径上直接不存在 (子拿到一段任务描述就开始干,
+        //   回来只有一段文本, 父连判据都没有)。现在: 任务退回 `pending`、不绑执行者、
+        //   返回 `agent: undefined`, 让调用方**没有**可派遣的对象。
+        const workContract = await this.issueWorkContractFor(fromAgentId, task, requiredCapabilities, contractOptions);
+        if (!workContract && contractOptions?.goalId) {
+            this.refuseDispatchWithoutContract(task, contractOptions.goalId);
+            await this.saveTasks();
+            return { task, agent: undefined, workContract: undefined };
+        }
+        if (workContract)
+            await this.heartbeatContractedTask(task);
+        await this.saveTasks();
+        return { task, agent, workContract };
+    }
+    /**
+     * 目标语境下没有合同 ⇒ **不派出** (M3 的"派前必须有合同")。
+     *
+     * 落成事实: 任务退回 `pending` 且**不绑执行者** (没有 `assignedAt`),
+     * `contractRefused` 记下原因。于是:
+     *   · 调用方拿到的 `agent` 是 `undefined` → 没有派遣对象;
+     *   · 任务不会出现在 `getActiveTasks()` 里 (它没被派出去);
+     *   · 原因留在任务上, 父能据此重签合同或交人 (不许静默当"没派过")。
+     */
+    refuseDispatchWithoutContract(task, goalId) {
+        const reason = task.error
+            ? `派前必须有工作合同: 合同没签成 → 不派出 (${task.error})`
+            : '派前必须有工作合同: 合同没签成 → 不派出';
+        task.status = 'pending';
+        task.assignedAgentId = undefined;
+        task.toAgentId = undefined;
+        task.assignedAt = undefined;
+        // Goal 上下文要留在任务上: ① 它说明这次派遣是**为哪个目标**尝试的;
+        //   ② 于是完成门 (`updateTaskStatus` 的 `task.goalId` 判据) 也管得到这条没有合同的任务
+        //      —— 没有合同就不许自称完成, 不留 goalId 的话它就绕过了那道门。
+        if (goalId)
+            task.goalId = goalId;
+        task.contractRefused = { code: 'contract_not_issued', reason };
+    }
+    /**
+     * 给这次派遣签工作合同 (P2)。只有调用方给了 `goalId` 才签 —— 没有长期目标就没有合同上下文,
+     * 这时行为与接线前完全一致 (只记任务)。
+     */
+    async issueWorkContractFor(fromAgentId, task, requiredCapabilities, opts) {
+        if (!opts?.goalId)
+            return undefined;
+        try {
+            const { dispatchChildWork } = await import('./goal-flywheel-wiring.js');
+            const capability = (requiredCapabilities[0] || 'general').trim();
+            const issued = await dispatchChildWork({
+                goalId: opts.goalId,
+                parentRunId: opts.parentRunId ?? `subagent-task:${task.id}`,
+                childAgentId: task.assignedAgentId || task.toAgentId || `(unassigned:${fromAgentId})`,
+                capability,
+                objective: task.description,
+                inputs: { taskId: task.id, input: task.input ?? null },
+                allowedTools: opts.allowedTools ?? [],
+                budget: opts.budget ?? { maxSteps: null, maxDurationMs: this.config.taskTimeoutMs, maxAmount: null, currency: null },
+                deadline: opts.deadline ?? null,
+                successCriteria: (opts.successCriteria?.length ? opts.successCriteria : [task.description]).slice(0, 20),
+                issuedBy: `subagent-manager:${fromAgentId}`,
+            });
+            task.goalId = opts.goalId;
+            task.workId = issued.workId;
+            task.metadata = { ...(task.metadata ?? {}), workContract: issued };
+            await this.saveTasks();
+            return issued;
+        }
+        catch (err) {
+            // 签合同失败 → 如实记在任务上 (不许悄悄降级成"没合同也能派")
+            task.error = `工作合同签发失败: ${String(err?.message || err).slice(0, 200)}`;
+            await this.saveTasks();
+            return undefined;
+        }
+    }
+    /**
+     * 核验挂着合同的子任务回报 (P2)。
+     * 报告可以是**结构化 JSON 文本** (推荐: 子按 `bolloon-work-report/1` 回), 也可以是纯文本 ——
+     * 纯文本没有逐条证据 → **不接受为完成** (这正是要堵的"回一段漂亮话就算完成")。
+     */
+    async validateTaskReport(task, result) {
+        const { handleChildReport } = await import('./goal-flywheel-wiring.js');
+        const contract = (task.metadata?.workContract ?? null);
+        const raw = String(result ?? '');
+        let report = null;
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed === 'object' && typeof parsed.status === 'string') {
+                report = parsed;
+            }
+        }
+        catch { /* 不是 JSON → 当纯文本处理 */ }
+        if (!report) {
+            report = {
+                workId: task.workId,
+                childAgentId: contract?.childAgentId ?? task.assignedAgentId ?? task.toAgentId ?? '(unknown)',
+                status: 'completed',
+                summary: raw.slice(0, 400),
+                evidence: [],
+                artifacts: [],
+                checks: [],
+                unresolvedItems: [],
+                blockReason: null,
+                nextRecommendation: '(未提供)',
+                durationMs: 0,
+                reportedAt: new Date().toISOString(),
+            };
+        }
+        const out = await handleChildReport({ goalId: task.goalId, workId: task.workId, report });
+        return { accepted: out.accepted, reason: out.reason, missingEvidence: out.missingEvidence };
     }
     async consultAgent(fromAgentId, toAgentId, query, taskId) {
         return this.sendMessage(fromAgentId, toAgentId, query, 'query', taskId);

package/dist/agents/task/task-onchain-runner.js

@@ -24,7 +24,7 @@ import { resolveTaskBudget } from './task-budget.js';
 import { adviseResource } from './resource-advisor.js';
 import { defaultRequestId, installBundle, deriveSkillInput, extractSources, extractConclusion } from './task-runner.js';
 import { buildReportCard, renderReportCard } from './report-card.js';
-import { loadResourceContract, executeContractSkill, validateResourceOutput, verifyInstallFidelity, } from '../x402/resource-contract.js';
+import { loadResourceContract, executeContractSkill, validateResourceOutput, validateResourceInput, verifyInstallFidelity, } from '../x402/resource-contract.js';
 import { beginTransaction, readTransaction, updateTransaction } from '../x402/transaction-store.js';
 import { writeDeliveryContent } from '../x402/settlement-state.js';
 import { computeContentHash } from '../x402/paid-info-protocol.js';
@@ -88,6 +88,23 @@ export async function runTaskOnchain(opts) {
         };
     }
     mark('acquire', `选中 ${chosen.name} (${(chosen.why || []).slice(0, 2).join(' / ') || '名字匹配'})`);
+    // ②.5 输入预检 (不花钱的前置门): 输入建不出来/不合 inputSchema → **绝不先注资**
+    // 教训: 先注资再执行, 执行不达标 → 钱卡在托管里 (只能 dispute+refund 才拿得回)。
+    // 契约的 inputSchema 在这里就能判, 所以把这道门放在任何链上写操作之前。
+    const preContract = chosen.contract || (await loadResourceContract(chosen.dir)).contract;
+    const preInput = opts.input ?? deriveSkillInput(preContract, opts.task);
+    const preChk = preContract ? validateResourceInput(preContract, preInput) : { ok: true, issues: [] };
+    if (!preChk.ok) {
+        const blocker = `输入不符合 inputSchema (${preChk.issues[0] || '未知'}) → 未开托管, 没花钱`;
+        const card = buildReportCard({ task: opts.task, executed: false, paid: false, evidenceRef: {}, blocker });
+        mark('report', '输入不完整 → 不开托管, 不花钱 (给 --input 或把数字写进任务文本)');
+        return {
+            ok: false, taskKey, requestId, transactionId: '', card, text: renderReportCard(card), budget,
+            skill: { name: chosen.name, version: chosen.version, dir: chosen.dir },
+            chain: { verified: false, reason: blocker, statuses: [] }, outputIssues: [...preChk.issues, blocker],
+            recovery: recoverOnchainTrade({ home: opts.home, taskKey }), stages,
+        };
+    }
     // ③ 金额 = 单次购买上限 (与 M1 硬约束一致); 转原子单位
     const amountAtomic = BigInt(Math.round(budget.perPurchase * 10 ** decimals));
     const amountChk = checkOnchainAmount({ amountAtomic, decimals, budget: { taskBudget: budget.taskBudget, perPurchase: budget.perPurchase } });
@@ -124,6 +141,7 @@ export async function runTaskOnchain(opts) {
         network: opts.network || 'unknown', tokenDecimals: decimals,
         buyerSigner: opts.buyerSigner, sellerSigner: opts.sellerSigner,
         env: opts.env, persistState: opts.persistState, verifyOnChain: opts.verifyOnChain,
+        settleRetryAttempts: opts.settleRetryAttempts, settleRetryDelayMs: opts.settleRetryDelayMs,
     };
     // ⑤ 幂等/恢复: 已经链上走过的任务**不新开托管** (先读盘重建)
     const before = recoverOnchainTrade({ home: opts.home, taskKey });