@frankzhang2026/opencode-android-orchestrator 0.2.0 → 0.4.0

package/templates/scripts/automation/lib.sh

@@ -47,6 +47,9 @@ AUTOMATION_STATE_DIR="$AUTOMATION_RUNTIME_ROOT/state"
 AUTOMATION_EVIDENCE_DIR="$AUTOMATION_RUNTIME_ROOT/evidence"
 AUTOMATION_LOCKS_DIR="$AUTOMATION_RUNTIME_ROOT/locks"
 AUTOMATION_WORKSPACES_DIR="$AUTOMATION_RUNTIME_ROOT/workspaces"
+AUTOMATION_WORKTREE_ALLOWLIST_RELATIVE_PATH=".automation-worktree-allowlist"
+AUTOMATION_WORKTREE_ALLOWLIST_MAX_BYTES=65536
+AUTOMATION_WORKTREE_ALLOWLIST_MAX_ENTRIES=256
 
 automation_info() {
     printf '[automation] %s\n' "$*"
@@ -69,6 +72,23 @@ automation_require_command() {
     command -v "$1" >/dev/null 2>&1 || automation_die "required command is missing: $1"
 }
 
+automation_resolve_opencode_config() {
+    local output_file="$1"
+    local error_file="$2"
+    local checkpoint_error="Failed to run the query 'PRAGMA wal_checkpoint(PASSIVE)'"
+
+    if opencode debug config > "$output_file" 2> "$error_file"; then
+        return 0
+    fi
+    if ! rg -F "$checkpoint_error" "$error_file" >/dev/null; then
+        return 1
+    fi
+
+    automation_warn "OpenCode database checkpoint failed once; retrying resolved config discovery"
+    sleep 1
+    opencode debug config > "$output_file" 2> "$error_file"
+}
+
 automation_require_layout() {
     [[ -f "$AUTOMATION_CONFIG" ]] || automation_die "missing $AUTOMATION_CONFIG"
     [[ -d "$AUTOMATION_TASKS_DIR" ]] || automation_die "missing $AUTOMATION_TASKS_DIR"
@@ -83,6 +103,14 @@ automation_validate_config() {
             (startswith("/") | not) and
             (test("^[A-Za-z]:[/\\\\]") | not) and
             (test("(^|/)\\.\\.(/|$)") | not);
+        def gradle_task:
+            type == "string" and
+            test("^(?:[A-Za-z][A-Za-z0-9_.-]*|(?::[A-Za-z0-9_.-]+)+)$");
+        def gradle_task_list:
+            type == "array" and
+            length > 0 and
+            length == (unique | length) and
+            all(.[]; gradle_task);
         .schemaVersion == 3 and
         (.enabled | type == "boolean") and
         (.mode == "shadow" or .mode == "orchestrated") and
@@ -101,11 +129,26 @@ automation_validate_config() {
         (.plugins | type == "object" and keys == ["superpowers"]) and
         (.plugins.superpowers | type == "string" and length > 0) and
         (.requiredSkills | type == "array" and length >= 6) and
+        (.gradleVerification as $verification |
+            ($verification | type == "object") and
+            ($verification | keys == [
+                "assembleTasks",
+                "deviceTestTasks",
+                "focusedTestTasks",
+                "fullUnitTestTasks",
+                "lintTasks"
+            ]) and
+            ($verification.fullUnitTestTasks | gradle_task_list) and
+            ($verification.focusedTestTasks | gradle_task_list) and
+            ($verification.assembleTasks | gradle_task_list) and
+            ($verification.lintTasks | gradle_task_list) and
+            ($verification.deviceTestTasks | gradle_task_list)) and
         (.androidProject as $project |
             ($project | type == "object") and
             ($project.name | type == "string" and length > 0) and
             ($project.gradleDsl == "kotlin" or $project.gradleDsl == "groovy" or $project.gradleDsl == "mixed") and
             ($project.settingsFile | repository_path) and
+            ((($project | has("moduleScope")) | not) or $project.moduleScope == "all" or $project.moduleScope == "primary") and
             ($project.primaryModule | type == "string" and test("^:(?:[A-Za-z0-9_.-]+(?::[A-Za-z0-9_.-]+)*)?$")) and
             ($project.modules | type == "array" and length > 0 and all(.[];
                 (.gradlePath | type == "string" and test("^:(?:[A-Za-z0-9_.-]+(?::[A-Za-z0-9_.-]+)*)?$")) and
@@ -201,6 +244,84 @@ automation_config_value() {
     jq -r "$query" "$AUTOMATION_CONFIG"
 }
 
+automation_validate_gradle_task() {
+    local task="${1:-}"
+    local safe_task_pattern='^([A-Za-z][A-Za-z0-9_.-]*|(:[A-Za-z0-9_.-]+)+)$'
+    [[ "$task" =~ $safe_task_pattern ]] || automation_die "unsafe Gradle task: ${task:-<empty>}"
+}
+
+automation_validate_test_filter() {
+    local filter="${1:-}"
+    local safe_filter_pattern='^[A-Za-z0-9_.#$*-]+$'
+    [[ "$filter" =~ $safe_filter_pattern ]] || automation_die "unsafe test filter: ${filter:-<empty>}"
+}
+
+automation_validate_gradle_group() {
+    local group="${1:-}"
+    case "$group" in
+        fullUnitTestTasks|focusedTestTasks|assembleTasks|lintTasks|deviceTestTasks) ;;
+        *)
+            automation_die "unknown Gradle verification group: ${group:-<empty>}"
+            return 1
+            ;;
+    esac
+}
+
+automation_gradle_group_command_json() {
+    local group="$1"
+    automation_validate_gradle_group "$group" || return 1
+    automation_validate_config || return 1
+    jq -ce \
+        --arg group "$group" \
+        '["./gradlew"] + .gradleVerification[$group]' \
+        "$AUTOMATION_CONFIG"
+}
+
+automation_run_gradle_group() {
+    local group="$1"
+    local root="${2:-$AUTOMATION_ROOT}"
+    local task
+    local -a tasks=()
+
+    automation_validate_gradle_group "$group" || return 1
+    automation_validate_config || return 1
+    while IFS= read -r task; do
+        automation_validate_gradle_task "$task" || return 1
+        tasks[${#tasks[@]}]="$task"
+    done < <(jq -er --arg group "$group" '.gradleVerification[$group][]' "$AUTOMATION_CONFIG")
+    [[ "${#tasks[@]}" -gt 0 ]] || {
+        automation_die "Gradle verification group is empty: $group"
+        return 1
+    }
+
+    (
+        cd "$root"
+        ./gradlew "${tasks[@]}"
+    )
+}
+
+automation_run_focused_test() {
+    local task="$1"
+    local filter="$2"
+    local root="${3:-$AUTOMATION_ROOT}"
+
+    automation_validate_config || return 1
+    automation_validate_gradle_task "$task" || return 1
+    automation_validate_test_filter "$filter" || return 1
+    jq -e \
+        --arg task "$task" \
+        '.gradleVerification.focusedTestTasks | index($task) != null' \
+        "$AUTOMATION_CONFIG" >/dev/null || {
+            automation_die "focused Gradle task is not allowed by automation/config.json: $task"
+            return 1
+        }
+
+    (
+        cd "$root"
+        ./gradlew "$task" --tests "$filter"
+    )
+}
+
 automation_require_approval() {
     local kind="$1"
     local supplied="$2"
@@ -265,12 +386,235 @@ automation_array_matches_path() {
     return 1
 }
 
+automation_validate_worktree_allowlist_entry_at() {
+    local root="$1"
+    local path="$2"
+    local config_file="$root/automation/config.json"
+    local protected
+
+    if [[ -z "$path" ]]; then
+        automation_die "worktree allowlist entries must not be empty"
+        return 1
+    fi
+    if [[ "$path" == [[:space:]]* || "$path" == *[[:space:]] ]]; then
+        automation_die "worktree allowlist entries must not have leading or trailing whitespace: $path"
+        return 1
+    fi
+    case "$path" in
+        *[[:cntrl:]]*|*'\\'*)
+            automation_die "worktree allowlist entries must use plain repository-relative paths: $path"
+            return 1
+            ;;
+        *'*'*|*'?'*|*'['*|*']'*)
+            automation_die "worktree allowlist entries must be exact file paths, not patterns: $path"
+            return 1
+            ;;
+    esac
+    case "/$path/" in
+        *'//'*|*'/./'*|*'/../'*)
+            automation_die "worktree allowlist entries must be normalized repository-relative paths: $path"
+            return 1
+            ;;
+    esac
+    case "$path" in
+        /*|./*|.|..|.git|.git/*|docs/plans|docs/plans/*|"$AUTOMATION_WORKTREE_ALLOWLIST_RELATIVE_PATH")
+            automation_die "worktree allowlist entry is reserved or unsafe: $path"
+            return 1
+            ;;
+    esac
+    if [[ -d "$root/$path" ]]; then
+        automation_die "worktree allowlist entries must identify files, not directories: $path"
+        return 1
+    fi
+
+    if [[ ! -f "$config_file" ]]; then
+        automation_die "missing automation configuration while validating worktree allowlist: $config_file"
+        return 1
+    fi
+    if ! jq -e '.protectedPaths | type == "array" and all(.[]; type == "string" and length > 0)' \
+        "$config_file" >/dev/null; then
+        automation_die "automation protectedPaths are invalid while validating the worktree allowlist"
+        return 1
+    fi
+    while IFS= read -r protected; do
+        if automation_path_matches "$path" "$protected"; then
+            automation_die "worktree allowlist must not include a protected path: $path"
+            return 1
+        fi
+    done < <(jq -r '.protectedPaths[]' "$config_file")
+    return 0
+}
+
+automation_worktree_allowlist_file_entries_at() {
+    local root="$1"
+    local allowlist_file="$root/$AUTOMATION_WORKTREE_ALLOWLIST_RELATIVE_PATH"
+    local byte_count line existing
+    local entry_count=0
+    local -a entries=()
+
+    if [[ ! -e "$allowlist_file" && ! -L "$allowlist_file" ]]; then
+        return 0
+    fi
+    if [[ -L "$allowlist_file" || ! -f "$allowlist_file" ]]; then
+        automation_die "worktree allowlist must be a regular file, not a symlink: $allowlist_file"
+        return 1
+    fi
+    byte_count="$(wc -c < "$allowlist_file" | tr -d '[:space:]')"
+    if [[ ! "$byte_count" =~ ^[0-9]+$ ]] || \
+       [[ "$byte_count" -gt "$AUTOMATION_WORKTREE_ALLOWLIST_MAX_BYTES" ]]; then
+        automation_die "worktree allowlist exceeds $AUTOMATION_WORKTREE_ALLOWLIST_MAX_BYTES bytes: $allowlist_file"
+        return 1
+    fi
+
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        line="${line%$'\r'}"
+        [[ -n "$line" && "$line" != \#* ]] || continue
+        automation_validate_worktree_allowlist_entry_at "$root" "$line" || return 1
+        if [[ "$entry_count" -gt 0 ]]; then
+            for existing in "${entries[@]}"; do
+                if [[ "$existing" == "$line" ]]; then
+                    automation_die "duplicate worktree allowlist entry: $line"
+                    return 1
+                fi
+            done
+        fi
+        entry_count=$((entry_count + 1))
+        if [[ "$entry_count" -gt "$AUTOMATION_WORKTREE_ALLOWLIST_MAX_ENTRIES" ]]; then
+            automation_die "worktree allowlist exceeds $AUTOMATION_WORKTREE_ALLOWLIST_MAX_ENTRIES entries"
+            return 1
+        fi
+        entries[${#entries[@]}]="$line"
+    done < "$allowlist_file"
+
+    if [[ "$entry_count" -gt 0 ]]; then
+        for line in "${entries[@]}"; do
+            printf '%s\n' "$line"
+        done
+    fi
+    return 0
+}
+
+automation_worktree_allowlist_entries_json() {
+    local entries="$1"
+    if [[ -z "$entries" ]]; then
+        printf '[]\n'
+    else
+        printf '%s\n' "$entries" | jq -Rsc 'split("\n") | map(select(length > 0))'
+    fi
+}
+
+automation_worktree_allowlist_file_json_at() {
+    local root="$1"
+    local entries
+    entries="$(automation_worktree_allowlist_file_entries_at "$root")" || return 1
+    automation_worktree_allowlist_entries_json "$entries"
+}
+
+automation_effective_worktree_allowlist_entries_at() {
+    local root="$1"
+    local resolved_root
+    local lease_file="$AUTOMATION_LOCKS_DIR/repository.workspace.lease/lease.json"
+    local task_id workspace_file source_root task_root resolved_source resolved_task entry
+
+    resolved_root="$(cd "$root" && pwd -P)" || {
+        automation_die "unable to resolve worktree root for allowlist: $root"
+        return 1
+    }
+    if [[ -f "$lease_file" ]]; then
+        task_id="$(jq -er '.taskId' "$lease_file")" || {
+            automation_die "repository lease is invalid while resolving the worktree allowlist"
+            return 1
+        }
+        workspace_file="$(automation_workspace_path "$task_id")"
+        if [[ -f "$workspace_file" ]] && jq -e 'has("worktreeAllowlist")' "$workspace_file" >/dev/null; then
+            jq -e \
+                --argjson max "$AUTOMATION_WORKTREE_ALLOWLIST_MAX_ENTRIES" \
+                '.worktreeAllowlist as $entries |
+                 ($entries | type == "array") and
+                 ($entries | length <= $max) and
+                 ($entries | length == (unique | length)) and
+                 all($entries[]; type == "string" and length > 0)' \
+                "$workspace_file" >/dev/null || {
+                    automation_die "workspace worktreeAllowlist snapshot is invalid: $workspace_file"
+                    return 1
+                }
+            source_root="$(jq -er '.sourceRoot' "$workspace_file")" || return 1
+            task_root="$(automation_workspace_task_root "$workspace_file")" || return 1
+            resolved_source="$(cd "$source_root" 2>/dev/null && pwd -P || true)"
+            resolved_task="$(cd "$task_root" 2>/dev/null && pwd -P || true)"
+            if [[ "$resolved_root" == "$resolved_source" ]]; then
+                while IFS= read -r entry; do
+                    [[ -n "$entry" ]] || continue
+                    automation_validate_worktree_allowlist_entry_at "$root" "$entry" || return 1
+                    printf '%s\n' "$entry"
+                done < <(jq -r '.worktreeAllowlist[]' "$workspace_file")
+                return 0
+            fi
+            if [[ "$resolved_root" == "$resolved_task" ]]; then
+                return 0
+            fi
+        fi
+    fi
+
+    automation_worktree_allowlist_file_entries_at "$root"
+}
+
+automation_effective_worktree_allowlist_json_at() {
+    local root="$1"
+    local entries
+    entries="$(automation_effective_worktree_allowlist_entries_at "$root")" || return 1
+    automation_worktree_allowlist_entries_json "$entries"
+}
+
+automation_worktree_path_is_allowlisted() {
+    local path="$1"
+    local entries="$2"
+    local entry
+
+    [[ "$path" == "$AUTOMATION_WORKTREE_ALLOWLIST_RELATIVE_PATH" ]] && return 0
+    while IFS= read -r entry; do
+        [[ -n "$entry" ]] || continue
+        [[ "$path" == "$entry" ]] && return 0
+    done <<< "$entries"
+    return 1
+}
+
+automation_filter_worktree_paths_at() {
+    local root="$1"
+    local paths="$2"
+    local allowlist path
+
+    allowlist="$(automation_effective_worktree_allowlist_entries_at "$root")" || return 1
+    while IFS= read -r path; do
+        [[ -n "$path" ]] || continue
+        if ! automation_worktree_path_is_allowlisted "$path" "$allowlist"; then
+            printf '%s\n' "$path"
+        fi
+    done <<< "$paths"
+    return 0
+}
+
+automation_tracked_changed_paths_at() {
+    local root="$1"
+    local paths
+    paths="$(git -C "$root" diff --no-renames --name-only HEAD -- | LC_ALL=C sort -u)" || return 1
+    automation_filter_worktree_paths_at "$root" "$paths"
+}
+
+automation_untracked_paths_at() {
+    local root="$1"
+    local paths
+    paths="$(git -C "$root" ls-files --others --exclude-standard | LC_ALL=C sort -u)" || return 1
+    automation_filter_worktree_paths_at "$root" "$paths"
+}
+
 automation_changed_paths_at() {
     local root="$1"
-    {
-        git -C "$root" diff --name-only HEAD --
-        git -C "$root" ls-files --others --exclude-standard
-    } | LC_ALL=C sort -u
+    local tracked untracked
+
+    tracked="$(automation_tracked_changed_paths_at "$root")" || return 1
+    untracked="$(automation_untracked_paths_at "$root")" || return 1
+    printf '%s\n%s\n' "$tracked" "$untracked" | awk 'NF' | LC_ALL=C sort -u
 }
 
 automation_changed_paths() {
@@ -343,20 +687,71 @@ automation_changed_paths_between() {
 
 automation_worktree_diff_sha() {
     local root="${1:-$AUTOMATION_ROOT}"
-    local path
+    local tracked_paths untracked_paths path
+    tracked_paths="$(automation_tracked_changed_paths_at "$root")" || return 1
+    untracked_paths="$(automation_untracked_paths_at "$root")" || return 1
     {
-        git -C "$root" diff --binary HEAD --
+        while IFS= read -r path; do
+            [[ -n "$path" ]] || continue
+            git -C "$root" diff --binary --no-renames HEAD -- "$path"
+        done <<< "$tracked_paths"
         while IFS= read -r path; do
             [[ -n "$path" ]] || continue
             printf 'UNTRACKED %s\0' "$path"
             git -C "$root" hash-object -- "$path"
-        done < <(git -C "$root" ls-files --others --exclude-standard | LC_ALL=C sort)
+        done <<< "$untracked_paths"
     } | shasum -a 256 | awk '{print $1}'
 }
 
+automation_worktree_diff_stat_at() {
+    local root="${1:-$AUTOMATION_ROOT}"
+    local tracked_paths path
+    local -a paths=()
+
+    tracked_paths="$(automation_tracked_changed_paths_at "$root")" || return 1
+    while IFS= read -r path; do
+        [[ -n "$path" ]] && paths[${#paths[@]}]="$path"
+    done <<< "$tracked_paths"
+    if [[ "${#paths[@]}" -gt 0 ]]; then
+        git -C "$root" diff --stat --no-renames HEAD -- "${paths[@]}"
+    fi
+    return 0
+}
+
+automation_worktree_patch_at() {
+    local root="${1:-$AUTOMATION_ROOT}"
+    local tracked_paths untracked_paths path
+
+    tracked_paths="$(automation_tracked_changed_paths_at "$root")" || return 1
+    untracked_paths="$(automation_untracked_paths_at "$root")" || return 1
+    while IFS= read -r path; do
+        [[ -n "$path" ]] || continue
+        git -C "$root" diff --binary --no-renames HEAD -- "$path"
+    done <<< "$tracked_paths"
+    while IFS= read -r path; do
+        [[ -n "$path" ]] || continue
+        git -C "$root" diff --binary --no-index -- /dev/null "$root/$path" || [[ "$?" -eq 1 ]]
+    done <<< "$untracked_paths"
+    return 0
+}
+
+automation_worktree_status_at() {
+    local root="${1:-$AUTOMATION_ROOT}"
+    local changed_paths path
+
+    changed_paths="$(automation_changed_paths_at "$root")" || return 1
+    printf 'branch %s\n' "$(automation_current_branch "$root")"
+    while IFS= read -r path; do
+        [[ -n "$path" ]] && printf 'changed %s\n' "$path"
+    done <<< "$changed_paths"
+    return 0
+}
+
 automation_worktree_is_clean() {
     local root="${1:-$AUTOMATION_ROOT}"
-    [[ -z "$(git -C "$root" status --porcelain --untracked-files=all)" ]]
+    local changed_paths
+    changed_paths="$(automation_changed_paths_at "$root")" || return 1
+    [[ -z "$changed_paths" ]]
 }
 
 automation_create_lock_dir() {

package/templates/scripts/automation/orchestrate-task.sh

@@ -86,7 +86,7 @@ for _step in 1 2 3 4 5 6 7 8; do
             if [[ -f "$agent_runs" ]]; then
                 review_attempt="$(jq -s --argjson cycle "$review_cycle" '[.[] | select(.role == "scheduled-reviewer" and .cycle == $cycle)] | length' "$agent_runs")"
             fi
-            reviewer_prompt="Use \$scheduled-quality-reviewer with $task_id. This is fresh, non-interactive, read-only review attempt $review_attempt for sealed review cycle $review_cycle. Work within the step budget. Run exactly ./scripts/automation/status.sh $task_id once; its JSON already includes baseline, RED, ready, latest gate, current diff SHA, and the sealed-SHA comparison, so do not browse the external evidence directory. Then inspect the approved contract and run exactly git diff. Submit exactly one decision. Do not browse generated build reports, list the whole repository, retry denied command variants, or run Gradle commands separately before deciding: submit-review.sh performs and records the focused tests, full unit suite, assembleDebug, and lint for APPROVED. Reserve a tool call for submit-review.sh. Never edit, commit, merge, or push."
+            reviewer_prompt="Use \$scheduled-quality-reviewer with $task_id. This is fresh, non-interactive, read-only review attempt $review_attempt for sealed review cycle $review_cycle. Work within the step budget. Run exactly ./scripts/automation/status.sh $task_id once; its JSON already includes baseline, RED, ready, latest gate, current diff SHA, the sealed-SHA comparison, and runtime.effectiveWorktreeAllowlist, so do not browse the external evidence directory. Then inspect the approved contract and run exactly git diff, excluding the control file and every exact path in that effective list from review findings. Submit exactly one decision. Do not browse generated build reports, list the whole repository, retry denied command variants, or run Gradle commands separately before deciding: submit-review.sh performs and records the focused tests, full unit suite, assembleDebug, and lint for APPROVED. Reserve a tool call for submit-review.sh. Never edit, commit, merge, or push."
             run_agent scheduled-reviewer "$reviewer_prompt" "$review_cycle" "$review_attempt" || true
             if [[ "$(automation_read_state "$task_id")" == "REVIEWING" ]]; then
                 automation_transition_state "$task_id" "REVIEWING" "BLOCKED" "orchestrator" "reviewer exited without submitting a decision; sealed diff preserved for reviewer-only recovery"

package/templates/scripts/automation/preflight.sh

@@ -124,7 +124,7 @@ else
     discovery_dir="$(mktemp -d "${TMPDIR:-/tmp}/opencode-android-orchestrator-preflight.XXXXXX")"
     trap 'rm -rf "$discovery_dir"' EXIT
 
-    if ! opencode debug config > "$discovery_dir/config.json" 2> "$discovery_dir/config.err"; then
+    if ! automation_resolve_opencode_config "$discovery_dir/config.json" "$discovery_dir/config.err"; then
         automation_die "OpenCode resolved config failed; see $discovery_dir/config.err"
     fi
     superpowers_pin="$(jq -r '.plugins.superpowers' "$AUTOMATION_CONFIG")"

package/templates/scripts/automation/record-red.sh

@@ -16,15 +16,15 @@ if [[ -z "$task_id" || -z "$expected" || "$separator" != "--" || -z "$filter" ||
 fi
 
 automation_validate_task_id "$task_id"
-safe_filter_pattern='^[A-Za-z0-9_.#$*-]+$'
-[[ "$filter" =~ $safe_filter_pattern ]] || automation_die "unsafe test filter: $filter"
+automation_validate_test_filter "$filter"
 [[ ${#expected} -ge 3 ]] || automation_die "expected failure text is too short"
 [[ "$(automation_read_state "$task_id")" == "CODING" ]] || automation_die "$task_id is not CODING"
 "$SCRIPT_DIR/validate-contract.sh" "$task_id"
 
 contract="$(automation_contract_path "$task_id")"
-jq -e --arg filter "$filter" '.targetTests | index($filter) != null' "$contract" >/dev/null || \
-    automation_die "test filter is not declared in the contract: $filter"
+target_count="$(jq -er --arg filter "$filter" '[.targetTests[] | select(.filter == $filter)] | length' "$contract")"
+[[ "$target_count" -eq 1 ]] || automation_die "test filter must identify exactly one declared contract target: $filter"
+gradle_task="$(jq -er --arg filter "$filter" '.targetTests[] | select(.filter == $filter) | .gradleTask' "$contract")"
 
 evidence_dir="$(automation_evidence_path "$task_id")"
 mkdir -p "$evidence_dir"
@@ -34,10 +34,7 @@ red_meta="$evidence_dir/red.json"
 started_at="$(automation_now)"
 
 set +e
-(
-    cd "$AUTOMATION_ROOT"
-    ./gradlew testDebugUnitTest --tests "$filter"
-) 2>&1 | tee "$red_log"
+automation_run_focused_test "$gradle_task" "$filter" "$AUTOMATION_ROOT" 2>&1 | tee "$red_log"
 red_status=${PIPESTATUS[0]}
 set -e
 
@@ -49,9 +46,10 @@ jq -n \
     --arg startedAt "$started_at" \
     --arg finishedAt "$(automation_now)" \
     --arg expectedFailure "$expected" \
+    --arg gradleTask "$gradle_task" \
     --arg testFilter "$filter" \
     --argjson exitCode "$red_status" \
-    '{taskId: $taskId, startedAt: $startedAt, finishedAt: $finishedAt, command: ["./gradlew", "testDebugUnitTest", "--tests", $testFilter], expectedFailure: $expectedFailure, exitCode: $exitCode}' \
+    '{taskId: $taskId, startedAt: $startedAt, finishedAt: $finishedAt, command: ["./gradlew", $gradleTask, "--tests", $testFilter], expectedFailure: $expectedFailure, exitCode: $exitCode}' \
     | automation_record_json "$red_meta"
 
 automation_info "$task_id RED evidence recorded"

package/templates/scripts/automation/scope-gate.sh

@@ -64,12 +64,13 @@ while IFS= read -r path; do
 done <<< "$changed_file_list"
 
 deleted_tests="$(
-    git -C "$AUTOMATION_ROOT" diff --name-only --diff-filter=D HEAD -- \
-        | while IFS= read -r path; do
-            if automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"; then
-                printf '%s\n' "$path"
-            fi
-        done
+    while IFS= read -r path; do
+        [[ -n "$path" ]] || continue
+        if [[ -n "$(git -C "$AUTOMATION_ROOT" diff --no-renames --name-only --diff-filter=D HEAD -- "$path")" ]] && \
+           automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"; then
+            printf '%s\n' "$path"
+        fi
+    done <<< "$changed_file_list"
 )"
 [[ -z "$deleted_tests" ]] || { automation_die "test deletion is forbidden: $deleted_tests"; exit 40; }
 
@@ -83,7 +84,7 @@ added_test_lines="$(
     while IFS= read -r path; do
         [[ -n "$path" ]] || continue
         if automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"; then
-            git -C "$AUTOMATION_ROOT" diff --unified=0 HEAD -- "$path"
+            git -C "$AUTOMATION_ROOT" diff --no-renames --unified=0 HEAD -- "$path"
         fi
     done <<< "$changed_file_list" \
         | awk '/^\+\+\+/ { next } /^\+/ { sub(/^\+/, ""); print }'
@@ -95,12 +96,14 @@ if printf '%s\n' "$added_test_lines" | rg -n "$weakening_pattern" >/dev/null; th
 fi
 
 while IFS= read -r untracked_test; do
-    if automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$untracked_test" && \
+    [[ -n "$untracked_test" ]] || continue
+    if ! git -C "$AUTOMATION_ROOT" ls-files --error-unmatch -- "$untracked_test" >/dev/null 2>&1 && \
+       automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$untracked_test" && \
         rg -n "$weakening_pattern" "$AUTOMATION_ROOT/$untracked_test" >/dev/null; then
         automation_die "potential test weakening detected in new test: $untracked_test"
         exit 40
     fi
-done < <(git -C "$AUTOMATION_ROOT" ls-files --others --exclude-standard)
+done <<< "$changed_file_list"
 
 if [[ "$planning_commit_policy" == "withProductChanges" ]]; then
     automation_info "scope gate passed ($changed_count product files; sealed planning artifacts excluded from the contract limit)"

package/templates/scripts/automation/show-acceptance-review.sh

@@ -85,7 +85,7 @@ printf -- '- Reviewer：`%s`，独立复验退出码 `%s`\n' \
     "$(jq -r '.evidence.reviewerVerificationExitCode' "$report_file")"
 printf -- '- Reviewer 摘要：%s\n' "$(jq -r '.reviewSummary' "$report_file")"
 printf -- '- 聚焦测试：\n'
-jq -r '.targetTests[] | "  - `\(.)`"' "$report_file"
+jq -r '.targetTests[] | "  - `./gradlew \(.gradleTask) --tests \(.filter)`"' "$report_file"
 
 printf '\n### P1 · 绑定与剩余风险\n\n'
 printf -- '- 当前 diff 与质量门、独立 Review、验收包的 SHA 三方一致。\n'

package/templates/scripts/automation/status.sh

@@ -33,6 +33,7 @@ if [[ "$ready_json" != "null" ]]; then
 fi
 
 current_diff_sha=""
+effective_worktree_allowlist_json='[]'
 lease_json=null
 lease_matches=null
 original_head_current=""
@@ -41,6 +42,7 @@ task_branch_exists=null
 if [[ "$workspace_json" != "null" ]]; then
     task_root="$(jq -r '.taskRoot // .taskWorktree // empty' <<< "$workspace_json")"
     if [[ -n "$task_root" && -d "$task_root" ]]; then
+        effective_worktree_allowlist_json="$(automation_effective_worktree_allowlist_json_at "$task_root")"
         current_diff_sha="$(automation_worktree_diff_sha "$task_root")"
     fi
     source_root="$(jq -r '.sourceRoot // empty' <<< "$workspace_json")"
@@ -97,6 +99,7 @@ jq -n \
     --argjson repositoryLease "$lease_json" \
     --argjson repositoryLeaseMatches "$lease_matches" \
     --argjson taskBranchExists "$task_branch_exists" \
+    --argjson effectiveWorktreeAllowlist "$effective_worktree_allowlist_json" \
     --arg originalHeadCurrent "$original_head_current" \
     --argjson originalBranchDrifted "$original_branch_drifted" \
     --arg evidence "$evidence_dir" \
@@ -106,6 +109,7 @@ jq -n \
         repositoryLease: $repositoryLease,
         repositoryLeaseMatches: $repositoryLeaseMatches,
         taskBranchExists: $taskBranchExists,
+        effectiveWorktreeAllowlist: $effectiveWorktreeAllowlist,
         originalHeadCurrent: ($originalHeadCurrent | if length == 0 then null else . end),
         originalBranchDrifted: $originalBranchDrifted
       },