@frankzhang2026/opencode-android-orchestrator 0.2.0 → 0.3.0

package/docs/MIGRATION.md

@@ -1,16 +1,17 @@
 # Migration guide
 
 This guide covers migration to
-`@frankzhang2026/opencode-android-orchestrator@0.2.0` after that exact version
-has been released and accepted. Version `0.2.0` is currently unpublished; do
-not use these commands to switch a live project yet.
+`@frankzhang2026/opencode-android-orchestrator@0.3.0`. Pin the exact version and
+prove the migration in a disposable clone before changing a long-lived
+repository.
 
 ## Choose the migration path
 
 | Current state | Correct command after release | Important distinction |
 | --- | --- | --- |
-| No orchestrator files or manifest | `npx @frankzhang2026/opencode-android-orchestrator@0.2.0 init .` | Normal new installation. |
+| No orchestrator files or manifest | `npx @frankzhang2026/opencode-android-orchestrator@0.3.0 init .` | Normal new installation; all detected Android modules are enabled by default. |
 | Published `0.1.0` scaffold only | Remove any project-local `@0.1.0` plugin reference after review, then run `init`. | `0.1.0` did not create a usable managed installation and cannot be upgraded. |
+| Healthy `0.2.0` manifest-managed installation | Run the fixed `0.3.0` doctor, then `upgrade`. | The missing module-scope field is treated as `primary` unless the upgrade explicitly selects `all`. |
 | Manually copied V3 files, no `.automation-plugin/manifest.json` | Finish active tasks, preserve historical evidence separately, then run `init`. | Exact files can be reused; differing managed files fail as conflicts. |
 | Healthy older manifest-managed installation | Run `doctor`, then the fixed target version's `upgrade`. | `upgrade` requires a valid installed manifest and intact original backups. |
 | Healthy current-version manifest | Run `doctor`; repeated `init` or same-version `upgrade` is verification-only and byte-idempotent. | Do not reinstall or delete the manifest. |
@@ -35,7 +36,7 @@ removes unchanged plugin-created files, and retains drift for manual review.
 5. If a managed manifest already exists, run:
 
    ```sh
-   npx @frankzhang2026/opencode-android-orchestrator@0.2.0 doctor . --json
+   npx @frankzhang2026/opencode-android-orchestrator@0.3.0 doctor . --json
    ```
 
    Do not proceed with `upgrade` unless the installation checks pass.
@@ -51,18 +52,22 @@ scaffold, not as an older managed installation.
 If the project OpenCode configuration contains an exact
 `@frankzhang2026/opencode-android-orchestrator@0.1.0` entry, save the file and
 remove only that obsolete entry in a reviewed Git change before running
-`0.2.0 init`. The merger deliberately rejects a different version of the same
+`0.3.0 init`. The merger deliberately rejects a different version of the same
 managed package; it will not silently replace the reference. A global npm
 installation of `0.1.0` alone does not require project-file cleanup.
 
 After release, initialize with the fixed version:
 
 ```sh
-npx @frankzhang2026/opencode-android-orchestrator@0.2.0 init .
+npx @frankzhang2026/opencode-android-orchestrator@0.3.0 init .
 ```
 
-Use `--primary-module :mobile` when the project has multiple application
-modules and `:mobile` is the intended orchestration target.
+New installations default to all-module scope, so multiple application modules
+do not require a selection. Use
+`--module-scope primary --primary-module :mobile` only when generated task
+contracts must be restricted to `:mobile`. In all-module scope,
+`--primary-module :mobile` merely chooses the focused-test placeholder's
+default module.
 
 ## From a manually copied V3 setup
 
@@ -100,8 +105,8 @@ installer to guess which customization should survive.
 Use the lifecycle command selected by the active manifest:
 
 ```sh
-npx @frankzhang2026/opencode-android-orchestrator@0.2.0 doctor . --json
-npx @frankzhang2026/opencode-android-orchestrator@0.2.0 upgrade . --json
+npx @frankzhang2026/opencode-android-orchestrator@0.3.0 doctor . --json
+npx @frankzhang2026/opencode-android-orchestrator@0.3.0 upgrade . --json
 ```
 
 `upgrade` verifies the installed manifest, every managed file, and every
@@ -110,6 +115,12 @@ OpenCode and AGENTS content from the original pre-install files, carries that
 recovery lineage forward, snapshots the current version, writes the new
 resources, and reruns the 38 automation tests plus the shadow run.
 
+Upgrade preserves an installed `androidProject.moduleScope`. A legacy
+manifest-managed configuration without that field is treated as `primary`,
+which prevents an upgrade from silently expanding its editable module set. To
+adopt all-module scope during a version upgrade, pass `--module-scope all` and
+review the regenerated task example before approving automation.
+
 The command refuses:
 
 - a downgrade or malformed semantic version;
@@ -127,7 +138,7 @@ the source of drift and use the recorded recovery data.
 Run all checks from the detected Git root:
 
 ```sh
-npx @frankzhang2026/opencode-android-orchestrator@0.2.0 doctor .
+npx @frankzhang2026/opencode-android-orchestrator@0.3.0 doctor .
 opencode debug config
 opencode debug agent scheduled-planner
 opencode debug agent scheduled-coder

package/docs/SECURITY.md

@@ -1,9 +1,9 @@
 # Security model
 
 This document describes the security properties of
-`@frankzhang2026/opencode-android-orchestrator@0.2.0`. Version `0.2.0` is
-currently unpublished and has not completed the real OpenCode `1.14.22` and
-`1.15.13` release matrix.
+`@frankzhang2026/opencode-android-orchestrator@0.3.0`. The lifecycle foundation
+completed the real OpenCode `1.14.22` and `1.15.13` release matrix in `0.2.0`;
+`0.3.0` retains that compatibility boundary.
 
 ## Security goals and non-goals
 
@@ -52,7 +52,7 @@ modify local files; this package does not claim to protect against that actor.
 
 OpenCode permission prompts are also not semantic workflow approval. They can
 be accepted for the remainder of a session and may be auto-approved. For that
-reason `0.2.0` exposes only `android_orchestrator_status` and
+reason `0.3.0` exposes only `android_orchestrator_status` and
 `android_orchestrator_doctor` as custom tools. State-changing wrappers remain a
 NO-GO until a one-use, non-model-forgeable receipt can bind the approval kind,
 task, session/message, sealed SHA or branch, time, and nonce.
@@ -105,6 +105,13 @@ plugin options. It rejects malformed/ambiguous files, duplicate identities,
 different managed-plugin versions, and symlinks. AGENTS merging owns only one
 marked block and rejects partial, duplicate, or modified markers.
 
+New installations generate task examples in `all` module scope: every detected
+Android module's `src/main`, `src/test`, and `src/androidTest` path is eligible,
+while Gradle settings/build files and orchestration resources remain protected.
+`primary` scope narrows the generated paths to one module. Upgrade treats a
+legacy configuration with no scope field as `primary`, preventing an implicit
+permission expansion.
+
 The installed manifest is `0600`. Installer control, backup, recovery, and
 history directories are created with private `0700` defaults; backup files
 preserve the original file mode where recovery requires it. Shell resources

package/docs/TROUBLESHOOTING.md

@@ -1,9 +1,7 @@
 # Troubleshooting
 
 Use this guide for
-`@frankzhang2026/opencode-android-orchestrator@0.2.0`. That version is currently
-unpublished, so lifecycle commands shown here are post-release commands unless
-you are working in an isolated maintainer fixture.
+`@frankzhang2026/opencode-android-orchestrator@0.3.0`.
 
 ## Start with read-only evidence
 
@@ -13,7 +11,7 @@ From the repository root, capture:
 git status --short --branch
 git rev-parse HEAD
 opencode --version
-npx @frankzhang2026/opencode-android-orchestrator@0.2.0 doctor . --json
+npx @frankzhang2026/opencode-android-orchestrator@0.3.0 doctor . --json
 ```
 
 If installation never completed, doctor will correctly report a missing or
@@ -41,8 +39,9 @@ remain human-readable on stderr with a stable code such as `[FILE_CONFLICT]`.
 | OpenCode version failure | Installed version is below `1.14.22`, at or above `1.16.0`, or cannot be parsed/executed. | Install a certified version (`1.14.22` or `1.15.13`) for release validation. Do not bypass the version gate. |
 | Git root or Android project not detected | The target is outside a Git repository, settings are missing, or no supported Android module was found. | Run from the intended repository/module and inspect `settings.gradle` or `settings.gradle.kts`. Nested Gradle roots are intentionally unsupported. |
 | Gradle Wrapper failure | `gradlew` or `gradle/wrapper/gradle-wrapper.properties` is missing, or `gradlew` is not executable. | Restore the project's reviewed Wrapper files. Do not let the installer generate or replace build configuration. |
-| `PRIMARY_MODULE_AMBIGUOUS` | Multiple Android application modules exist. | Rerun `init` or `upgrade` with an exact Gradle path such as `--primary-module :mobile`. |
-| `PRIMARY_MODULE_NOT_FOUND` | The selected Gradle path is absent or not an application module. | Use a module path reported by doctor/project detection; do not pass a filesystem directory. |
+| `MODULE_SCOPE_INVALID` or an invalid `--module-scope` argument | The value is not `all` or `primary`. | Use `all` for the default all-module contract or `primary` for an intentional single-module restriction. |
+| `PRIMARY_MODULE_AMBIGUOUS` | Restrictive `primary` scope has multiple possible Android modules. | Supply an exact Gradle path, for example `--module-scope primary --primary-module :mobile`, or use the default `all` scope. |
+| `PRIMARY_MODULE_NOT_FOUND` | The selected Gradle path was not detected. | Use a module path reported by doctor/project detection; do not pass a filesystem directory. |
 | Android SDK failure | No valid explicit SDK, `ANDROID_HOME`, `ANDROID_SDK_ROOT`, or `local.properties` `sdk.dir` was found. | Configure one real SDK root containing `platforms/` and `build-tools/`. Do not publish `local.properties`. |
 | Missing `git`, `jq`, `rg`, `shasum`, or Java | Required deterministic command is unavailable on `PATH`. | Install or restore the missing command, record its version, and rerun the read-only checks. |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frankzhang2026/opencode-android-orchestrator",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Reusable OpenCode orchestration for Android projects",
   "license": "MIT",
   "author": "frankzhang2026",

package/templates/README.md

@@ -25,8 +25,11 @@ Migrated template roots:
 `automation/config.json` is an input to the adaptive renderer, not a directly
 installable configuration. `planAdaptiveProjectTemplates` injects the required
 `androidProject` metadata, repository-relative build files, protected paths,
-all detected production/test source sets, and primary-module task paths. The
-renderer rejects ambiguous primary modules unless the caller selects one.
+all detected production/test source sets, and a module scope. New renders use
+`all` scope and generate task paths for every detected module without requiring
+a primary selection. `primary` scope restricts paths to one module and retains
+the ambiguity guard. The selected/default module still supplies the focused
+test placeholder in both modes.
 
 The legacy Scheduler field has been removed while Superpowers remains pinned.
 The scope gates consume generated source-set arrays, and the Shell test fixture

package/templates/automation/config.json

@@ -29,6 +29,23 @@
     "systematic-debugging",
     "verification-before-completion"
   ],
+  "gradleVerification": {
+    "fullUnitTestTasks": [
+      "testDebugUnitTest"
+    ],
+    "focusedTestTasks": [
+      "testDebugUnitTest"
+    ],
+    "assembleTasks": [
+      "assembleDebug"
+    ],
+    "lintTasks": [
+      "lint"
+    ],
+    "deviceTestTasks": [
+      "connectedDebugAndroidTest"
+    ]
+  },
   "protectedPaths": [
     ".opencode/",
     ".automation-plugin/",

package/templates/automation/config.schema.json

@@ -13,6 +13,17 @@
     "nullableIdentifier": {
       "type": ["string", "null"],
       "minLength": 1
+    },
+    "gradleTask": {
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^(?:[A-Za-z][A-Za-z0-9_.-]*|(?::[A-Za-z0-9_.-]+)+)$"
+    },
+    "gradleTaskList": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/gradleTask" }
     }
   },
   "required": [
@@ -30,6 +41,7 @@
     "approvalPhrases",
     "plugins",
     "requiredSkills",
+    "gradleVerification",
     "androidProject",
     "protectedPaths"
   ],
@@ -72,6 +84,24 @@
       "uniqueItems": true,
       "items": { "type": "string", "minLength": 1 }
     },
+    "gradleVerification": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "fullUnitTestTasks",
+        "focusedTestTasks",
+        "assembleTasks",
+        "lintTasks",
+        "deviceTestTasks"
+      ],
+      "properties": {
+        "fullUnitTestTasks": { "$ref": "#/$defs/gradleTaskList" },
+        "focusedTestTasks": { "$ref": "#/$defs/gradleTaskList" },
+        "assembleTasks": { "$ref": "#/$defs/gradleTaskList" },
+        "lintTasks": { "$ref": "#/$defs/gradleTaskList" },
+        "deviceTestTasks": { "$ref": "#/$defs/gradleTaskList" }
+      }
+    },
     "androidProject": {
       "type": "object",
       "additionalProperties": false,
@@ -88,6 +118,7 @@
         "name": { "type": "string", "minLength": 1 },
         "gradleDsl": { "enum": ["kotlin", "groovy", "mixed"] },
         "settingsFile": { "$ref": "#/$defs/repositoryPath" },
+        "moduleScope": { "enum": ["all", "primary"] },
         "primaryModule": {
           "type": "string",
           "pattern": "^:(?:[A-Za-z0-9_.-]+(?::[A-Za-z0-9_.-]+)*)?$"

package/templates/automation/task-contract.schema.json

@@ -4,6 +4,18 @@
   "title": "Scheduled coding task contract",
   "type": "object",
   "additionalProperties": false,
+  "$defs": {
+    "gradleTask": {
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^(?:[A-Za-z][A-Za-z0-9_.-]*|(?::[A-Za-z0-9_.-]+)+)$"
+    },
+    "testFilter": {
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9_.#$*-]+$"
+    }
+  },
   "required": [
     "schemaVersion",
     "id",
@@ -62,7 +74,16 @@
     "targetTests": {
       "type": "array",
       "minItems": 1,
-      "items": { "type": "string", "minLength": 1 }
+      "uniqueItems": true,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["gradleTask", "filter"],
+        "properties": {
+          "gradleTask": { "$ref": "#/$defs/gradleTask" },
+          "filter": { "$ref": "#/$defs/testFilter" }
+        }
+      }
     },
     "deviceTestsRequired": { "type": "boolean" },
     "testPolicy": { "enum": ["required", "not-required"] },

package/templates/automation/tasks/TASK-TEMPLATE.json.example

@@ -45,7 +45,10 @@
     "Do not upgrade dependencies or Gradle configuration"
   ],
   "targetTests": [
-    "*ReplaceWithFocusedTest"
+    {
+      "gradleTask": "testDebugUnitTest",
+      "filter": "*ReplaceWithFocusedTest"
+    }
   ],
   "deviceTestsRequired": false,
   "testPolicy": "required",

package/templates/scripts/automation/claim-task.sh

@@ -30,12 +30,10 @@ baseline_meta="$evidence_dir/baseline.json"
 protected_hashes="$evidence_dir/protected.sha256"
 started_at="$(automation_now)"
 head_commit="$(git -C "$AUTOMATION_ROOT" rev-parse HEAD)"
+baseline_command="$(automation_gradle_group_command_json "fullUnitTestTasks")"
 
 set +e
-(
-    cd "$AUTOMATION_ROOT"
-    ./gradlew testDebugUnitTest
-) 2>&1 | tee "$baseline_log"
+automation_run_gradle_group "fullUnitTestTasks" "$AUTOMATION_ROOT" 2>&1 | tee "$baseline_log"
 baseline_status=${PIPESTATUS[0]}
 set -e
 
@@ -45,8 +43,9 @@ if [[ "$baseline_status" -ne 0 ]]; then
         --arg startedAt "$started_at" \
         --arg finishedAt "$(automation_now)" \
         --arg head "$head_commit" \
+        --argjson command "$baseline_command" \
         --argjson exitCode "$baseline_status" \
-        '{taskId: $taskId, startedAt: $startedAt, finishedAt: $finishedAt, head: $head, command: "./gradlew testDebugUnitTest", exitCode: $exitCode}' \
+        '{taskId: $taskId, startedAt: $startedAt, finishedAt: $finishedAt, head: $head, command: $command, exitCode: $exitCode}' \
         | automation_record_json "$baseline_meta"
     automation_transition_state "$task_id" "CODING" "BLOCKED" "preflight" "baseline unit tests failed"
     automation_die "baseline unit tests failed"
@@ -68,7 +67,8 @@ jq -n \
     --arg finishedAt "$(automation_now)" \
     --arg head "$head_commit" \
     --arg worktree "$AUTOMATION_ROOT" \
-    '{taskId: $taskId, startedAt: $startedAt, finishedAt: $finishedAt, head: $head, worktree: $worktree, command: "./gradlew testDebugUnitTest", exitCode: 0}' \
+    --argjson command "$baseline_command" \
+    '{taskId: $taskId, startedAt: $startedAt, finishedAt: $finishedAt, head: $head, worktree: $worktree, command: $command, exitCode: 0}' \
     | automation_record_json "$baseline_meta"
 
 automation_info "$task_id claimed; baseline is green"

package/templates/scripts/automation/lib.sh

@@ -69,6 +69,23 @@ automation_require_command() {
     command -v "$1" >/dev/null 2>&1 || automation_die "required command is missing: $1"
 }
 
+automation_resolve_opencode_config() {
+    local output_file="$1"
+    local error_file="$2"
+    local checkpoint_error="Failed to run the query 'PRAGMA wal_checkpoint(PASSIVE)'"
+
+    if opencode debug config > "$output_file" 2> "$error_file"; then
+        return 0
+    fi
+    if ! rg -F "$checkpoint_error" "$error_file" >/dev/null; then
+        return 1
+    fi
+
+    automation_warn "OpenCode database checkpoint failed once; retrying resolved config discovery"
+    sleep 1
+    opencode debug config > "$output_file" 2> "$error_file"
+}
+
 automation_require_layout() {
     [[ -f "$AUTOMATION_CONFIG" ]] || automation_die "missing $AUTOMATION_CONFIG"
     [[ -d "$AUTOMATION_TASKS_DIR" ]] || automation_die "missing $AUTOMATION_TASKS_DIR"
@@ -83,6 +100,14 @@ automation_validate_config() {
             (startswith("/") | not) and
             (test("^[A-Za-z]:[/\\\\]") | not) and
             (test("(^|/)\\.\\.(/|$)") | not);
+        def gradle_task:
+            type == "string" and
+            test("^(?:[A-Za-z][A-Za-z0-9_.-]*|(?::[A-Za-z0-9_.-]+)+)$");
+        def gradle_task_list:
+            type == "array" and
+            length > 0 and
+            length == (unique | length) and
+            all(.[]; gradle_task);
         .schemaVersion == 3 and
         (.enabled | type == "boolean") and
         (.mode == "shadow" or .mode == "orchestrated") and
@@ -101,11 +126,26 @@ automation_validate_config() {
         (.plugins | type == "object" and keys == ["superpowers"]) and
         (.plugins.superpowers | type == "string" and length > 0) and
         (.requiredSkills | type == "array" and length >= 6) and
+        (.gradleVerification as $verification |
+            ($verification | type == "object") and
+            ($verification | keys == [
+                "assembleTasks",
+                "deviceTestTasks",
+                "focusedTestTasks",
+                "fullUnitTestTasks",
+                "lintTasks"
+            ]) and
+            ($verification.fullUnitTestTasks | gradle_task_list) and
+            ($verification.focusedTestTasks | gradle_task_list) and
+            ($verification.assembleTasks | gradle_task_list) and
+            ($verification.lintTasks | gradle_task_list) and
+            ($verification.deviceTestTasks | gradle_task_list)) and
         (.androidProject as $project |
             ($project | type == "object") and
             ($project.name | type == "string" and length > 0) and
             ($project.gradleDsl == "kotlin" or $project.gradleDsl == "groovy" or $project.gradleDsl == "mixed") and
             ($project.settingsFile | repository_path) and
+            ((($project | has("moduleScope")) | not) or $project.moduleScope == "all" or $project.moduleScope == "primary") and
             ($project.primaryModule | type == "string" and test("^:(?:[A-Za-z0-9_.-]+(?::[A-Za-z0-9_.-]+)*)?$")) and
             ($project.modules | type == "array" and length > 0 and all(.[];
                 (.gradlePath | type == "string" and test("^:(?:[A-Za-z0-9_.-]+(?::[A-Za-z0-9_.-]+)*)?$")) and
@@ -201,6 +241,84 @@ automation_config_value() {
     jq -r "$query" "$AUTOMATION_CONFIG"
 }
 
+automation_validate_gradle_task() {
+    local task="${1:-}"
+    local safe_task_pattern='^([A-Za-z][A-Za-z0-9_.-]*|(:[A-Za-z0-9_.-]+)+)$'
+    [[ "$task" =~ $safe_task_pattern ]] || automation_die "unsafe Gradle task: ${task:-<empty>}"
+}
+
+automation_validate_test_filter() {
+    local filter="${1:-}"
+    local safe_filter_pattern='^[A-Za-z0-9_.#$*-]+$'
+    [[ "$filter" =~ $safe_filter_pattern ]] || automation_die "unsafe test filter: ${filter:-<empty>}"
+}
+
+automation_validate_gradle_group() {
+    local group="${1:-}"
+    case "$group" in
+        fullUnitTestTasks|focusedTestTasks|assembleTasks|lintTasks|deviceTestTasks) ;;
+        *)
+            automation_die "unknown Gradle verification group: ${group:-<empty>}"
+            return 1
+            ;;
+    esac
+}
+
+automation_gradle_group_command_json() {
+    local group="$1"
+    automation_validate_gradle_group "$group" || return 1
+    automation_validate_config || return 1
+    jq -ce \
+        --arg group "$group" \
+        '["./gradlew"] + .gradleVerification[$group]' \
+        "$AUTOMATION_CONFIG"
+}
+
+automation_run_gradle_group() {
+    local group="$1"
+    local root="${2:-$AUTOMATION_ROOT}"
+    local task
+    local -a tasks=()
+
+    automation_validate_gradle_group "$group" || return 1
+    automation_validate_config || return 1
+    while IFS= read -r task; do
+        automation_validate_gradle_task "$task" || return 1
+        tasks[${#tasks[@]}]="$task"
+    done < <(jq -er --arg group "$group" '.gradleVerification[$group][]' "$AUTOMATION_CONFIG")
+    [[ "${#tasks[@]}" -gt 0 ]] || {
+        automation_die "Gradle verification group is empty: $group"
+        return 1
+    }
+
+    (
+        cd "$root"
+        ./gradlew "${tasks[@]}"
+    )
+}
+
+automation_run_focused_test() {
+    local task="$1"
+    local filter="$2"
+    local root="${3:-$AUTOMATION_ROOT}"
+
+    automation_validate_config || return 1
+    automation_validate_gradle_task "$task" || return 1
+    automation_validate_test_filter "$filter" || return 1
+    jq -e \
+        --arg task "$task" \
+        '.gradleVerification.focusedTestTasks | index($task) != null' \
+        "$AUTOMATION_CONFIG" >/dev/null || {
+            automation_die "focused Gradle task is not allowed by automation/config.json: $task"
+            return 1
+        }
+
+    (
+        cd "$root"
+        ./gradlew "$task" --tests "$filter"
+    )
+}
+
 automation_require_approval() {
     local kind="$1"
     local supplied="$2"

package/templates/scripts/automation/preflight.sh

@@ -124,7 +124,7 @@ else
     discovery_dir="$(mktemp -d "${TMPDIR:-/tmp}/opencode-android-orchestrator-preflight.XXXXXX")"
     trap 'rm -rf "$discovery_dir"' EXIT
 
-    if ! opencode debug config > "$discovery_dir/config.json" 2> "$discovery_dir/config.err"; then
+    if ! automation_resolve_opencode_config "$discovery_dir/config.json" "$discovery_dir/config.err"; then
         automation_die "OpenCode resolved config failed; see $discovery_dir/config.err"
     fi
     superpowers_pin="$(jq -r '.plugins.superpowers' "$AUTOMATION_CONFIG")"

package/templates/scripts/automation/record-red.sh

@@ -16,15 +16,15 @@ if [[ -z "$task_id" || -z "$expected" || "$separator" != "--" || -z "$filter" ||
 fi
 
 automation_validate_task_id "$task_id"
-safe_filter_pattern='^[A-Za-z0-9_.#$*-]+$'
-[[ "$filter" =~ $safe_filter_pattern ]] || automation_die "unsafe test filter: $filter"
+automation_validate_test_filter "$filter"
 [[ ${#expected} -ge 3 ]] || automation_die "expected failure text is too short"
 [[ "$(automation_read_state "$task_id")" == "CODING" ]] || automation_die "$task_id is not CODING"
 "$SCRIPT_DIR/validate-contract.sh" "$task_id"
 
 contract="$(automation_contract_path "$task_id")"
-jq -e --arg filter "$filter" '.targetTests | index($filter) != null' "$contract" >/dev/null || \
-    automation_die "test filter is not declared in the contract: $filter"
+target_count="$(jq -er --arg filter "$filter" '[.targetTests[] | select(.filter == $filter)] | length' "$contract")"
+[[ "$target_count" -eq 1 ]] || automation_die "test filter must identify exactly one declared contract target: $filter"
+gradle_task="$(jq -er --arg filter "$filter" '.targetTests[] | select(.filter == $filter) | .gradleTask' "$contract")"
 
 evidence_dir="$(automation_evidence_path "$task_id")"
 mkdir -p "$evidence_dir"
@@ -34,10 +34,7 @@ red_meta="$evidence_dir/red.json"
 started_at="$(automation_now)"
 
 set +e
-(
-    cd "$AUTOMATION_ROOT"
-    ./gradlew testDebugUnitTest --tests "$filter"
-) 2>&1 | tee "$red_log"
+automation_run_focused_test "$gradle_task" "$filter" "$AUTOMATION_ROOT" 2>&1 | tee "$red_log"
 red_status=${PIPESTATUS[0]}
 set -e
 
@@ -49,9 +46,10 @@ jq -n \
     --arg startedAt "$started_at" \
     --arg finishedAt "$(automation_now)" \
     --arg expectedFailure "$expected" \
+    --arg gradleTask "$gradle_task" \
     --arg testFilter "$filter" \
     --argjson exitCode "$red_status" \
-    '{taskId: $taskId, startedAt: $startedAt, finishedAt: $finishedAt, command: ["./gradlew", "testDebugUnitTest", "--tests", $testFilter], expectedFailure: $expectedFailure, exitCode: $exitCode}' \
+    '{taskId: $taskId, startedAt: $startedAt, finishedAt: $finishedAt, command: ["./gradlew", $gradleTask, "--tests", $testFilter], expectedFailure: $expectedFailure, exitCode: $exitCode}' \
     | automation_record_json "$red_meta"
 
 automation_info "$task_id RED evidence recorded"

package/templates/scripts/automation/show-acceptance-review.sh

@@ -85,7 +85,7 @@ printf -- '- Reviewer：`%s`，独立复验退出码 `%s`\n' \
     "$(jq -r '.evidence.reviewerVerificationExitCode' "$report_file")"
 printf -- '- Reviewer 摘要：%s\n' "$(jq -r '.reviewSummary' "$report_file")"
 printf -- '- 聚焦测试：\n'
-jq -r '.targetTests[] | "  - `\(.)`"' "$report_file"
+jq -r '.targetTests[] | "  - `./gradlew \(.gradleTask) --tests \(.filter)`"' "$report_file"
 
 printf '\n### P1 · 绑定与剩余风险\n\n'
 printf -- '- 当前 diff 与质量门、独立 Review、验收包的 SHA 三方一致。\n'