@frankzhang2026/opencode-android-orchestrator 0.2.0 → 0.4.0

package/templates/scripts/automation/tests/run-tests.sh

@@ -82,6 +82,7 @@ write_workspace() {
 mkdir -p \
     "$fixture/automation/tasks" \
     "$fixture/docs/plans" \
+    "$fixture/local" \
     "$fixture/scripts/automation" \
     "$fixture/mobile-client/src/main/java/dev/example/orchestratorfixture" \
     "$fixture/mobile-client/src/test/java/dev/example/orchestratorfixture"
@@ -89,6 +90,8 @@ mkdir -p \
 cp "$SOURCE_SCRIPT_DIR"/*.sh "$fixture/scripts/automation/"
 chmod +x "$fixture/scripts/automation/"*.sh
 printf '%s\n' '# Approved test plan' > "$fixture/docs/plans/TASK-TEST-001.md"
+printf '%s\n' 'operator baseline' > "$fixture/local/operator-note.txt"
+printf '%s\n' 'rename baseline' > "$fixture/local/rename-source.txt"
 printf '%s\n' 'class ExistingFeature' > "$fixture/mobile-client/src/main/java/dev/example/orchestratorfixture/ExistingFeature.kt"
 
 printf '%s\n' \
@@ -137,10 +140,18 @@ jq -n '{
         "systematic-debugging",
         "verification-before-completion"
     ],
+    gradleVerification: {
+        fullUnitTestTasks: ["testDebugUnitTest"],
+        focusedTestTasks: ["testDebugUnitTest"],
+        assembleTasks: ["assembleDebug"],
+        lintTasks: ["lint"],
+        deviceTestTasks: ["connectedDebugAndroidTest"]
+    },
     androidProject: {
         name: "automation-shell-fixture",
         gradleDsl: "kotlin",
         settingsFile: "settings.gradle.kts",
+        moduleScope: "all",
         primaryModule: ":mobile-client",
         modules: [{
             gradlePath: ":mobile-client",
@@ -158,6 +169,7 @@ jq -n '{
         ]
     },
     protectedPaths: [
+        ".automation-worktree-allowlist",
         ".opencode/",
         ".automation-plugin/",
         "automation/",
@@ -192,6 +204,7 @@ jq -n '{
         "mobile-client/src/test/java/dev/example/orchestratorfixture/**"
     ],
     forbiddenPaths: [
+        ".automation-worktree-allowlist",
         ".opencode/**",
         ".automation-plugin/**",
         "automation/**",
@@ -217,7 +230,10 @@ jq -n '{
     ],
     acceptanceCriteria: ["Greeting returns the approved value"],
     nonGoals: ["No unrelated refactoring"],
-    targetTests: ["dev.example.orchestratorfixture.GreetingTest"],
+    targetTests: [{
+        gradleTask: "testDebugUnitTest",
+        filter: "dev.example.orchestratorfixture.GreetingTest"
+    }],
     deviceTestsRequired: false,
     testPolicy: "required",
     testPolicyReason: "The behavior requires a focused regression test"
@@ -232,6 +248,74 @@ jq -n '{
     git commit -qm 'Create automation fixture'
 )
 
+printf '%s\n' \
+    '# Exact repository-relative paths intentionally kept local' \
+    'local/operator-note.txt' \
+    'local/generated-note.txt' \
+    > "$fixture/.automation-worktree-allowlist"
+printf '%s\n' 'operator local edit' > "$fixture/local/operator-note.txt"
+printf '%s\n' 'generated local state' > "$fixture/local/generated-note.txt"
+run_fixture ./scripts/automation/preflight.sh --source >/dev/null
+allowlisted_changes="$(run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths')"
+[[ -z "$allowlisted_changes" ]] || fail "allowlisted paths remained visible: $allowlisted_changes"
+
+printf '%s\n' \
+    'local/operator-note.txt' \
+    'local/generated-note.txt' \
+    'local/rename-target.txt' \
+    > "$fixture/.automation-worktree-allowlist"
+git -C "$fixture" mv local/rename-source.txt local/rename-target.txt
+rename_changes="$(run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths')"
+[[ "$rename_changes" == "local/rename-source.txt" ]] || \
+    fail "an allowlisted rename target hid its non-allowlisted source: $rename_changes"
+git -C "$fixture" mv local/rename-target.txt local/rename-source.txt
+printf '%s\n' \
+    '# Exact repository-relative paths intentionally kept local' \
+    'local/operator-note.txt' \
+    'local/generated-note.txt' \
+    > "$fixture/.automation-worktree-allowlist"
+pass 'exact tracked and untracked entries are ignored without hiding rename sources'
+
+printf '%s\n' 'must still block' > "$fixture/unapproved-change.txt"
+if run_fixture ./scripts/automation/preflight.sh --source >/dev/null 2>&1; then
+    fail 'preflight ignored a path that was not allowlisted'
+fi
+rm "$fixture/unapproved-change.txt"
+pass 'a non-allowlisted worktree change still blocks orchestration startup'
+
+printf '%s\n' 'automation/config.json' > "$fixture/.automation-worktree-allowlist"
+if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths >/dev/null' 2>/dev/null; then
+    fail 'worktree allowlist accepted a protected automation path'
+fi
+printf '%s\n' 'local/*.json' > "$fixture/.automation-worktree-allowlist"
+if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths >/dev/null' 2>/dev/null; then
+    fail 'worktree allowlist accepted a glob pattern'
+fi
+printf '%s\n' 'local' > "$fixture/.automation-worktree-allowlist"
+if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths >/dev/null' 2>/dev/null; then
+    fail 'worktree allowlist accepted a directory path'
+fi
+printf '%s\n' 'local/operator-note.txt' 'local/operator-note.txt' > "$fixture/.automation-worktree-allowlist"
+if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths >/dev/null' 2>/dev/null; then
+    fail 'worktree allowlist accepted duplicate entries'
+fi
+printf '%s\n' '../outside.txt' > "$fixture/.automation-worktree-allowlist"
+if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths >/dev/null' 2>/dev/null; then
+    fail 'worktree allowlist accepted a path outside the repository'
+fi
+rm "$fixture/.automation-worktree-allowlist"
+ln -s local/operator-note.txt "$fixture/.automation-worktree-allowlist"
+if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths >/dev/null' 2>/dev/null; then
+    fail 'worktree allowlist accepted a symbolic-link control file'
+fi
+rm "$fixture/.automation-worktree-allowlist"
+printf '%s\n' \
+    '# Exact repository-relative paths intentionally kept local' \
+    'local/operator-note.txt' \
+    'local/generated-note.txt' \
+    > "$fixture/.automation-worktree-allowlist"
+pass 'invalid, duplicate, symbolic-link, patterned, and protected allowlist input fails closed'
+
 run_fixture ./scripts/automation/validate-contract.sh TASK-TEST-001 >/dev/null
 pass 'valid version-3 configuration and task contract are accepted'
 
@@ -273,11 +357,17 @@ pass 'illegal state transition is rejected'
 run_fixture ./scripts/automation/claim-task.sh TASK-TEST-001 >/dev/null
 [[ "$(jq -r '.state' "$runtime_root/state/TASK-TEST-001.json")" == "CODING" ]] || fail 'claim did not create CODING state'
 [[ -f "$runtime_root/evidence/TASK-TEST-001/baseline.json" ]] || fail 'baseline metadata missing'
+jq -e \
+    '.command == ["./gradlew", "testDebugUnitTest"]' \
+    "$runtime_root/evidence/TASK-TEST-001/baseline.json" >/dev/null || fail 'baseline command does not match the configured task matrix'
 pass 'claim verifies workspace identity and records a green baseline'
 
 printf '%s\n' 'class GreetingTest { fun expectedBehavior() = Unit }' > "$fixture/mobile-client/src/test/java/dev/example/orchestratorfixture/GreetingTest.kt"
 run_fixture ./scripts/automation/record-red.sh TASK-TEST-001 'expected missing behavior' -- dev.example.orchestratorfixture.GreetingTest >/dev/null
 [[ "$(jq -r '.exitCode' "$runtime_root/evidence/TASK-TEST-001/red.json")" -ne 0 ]] || fail 'RED evidence exit code was not captured'
+jq -e \
+    '.command == ["./gradlew", "testDebugUnitTest", "--tests", "dev.example.orchestratorfixture.GreetingTest"]' \
+    "$runtime_root/evidence/TASK-TEST-001/red.json" >/dev/null || fail 'RED command does not bind the configured task and filter'
 pass 'focused failing test records genuine RED evidence'
 
 printf '%s\n' 'unsafe' > "$fixture/automation/forbidden-change.txt"
@@ -338,7 +428,7 @@ jq \
     '.id = "TASK-TEST-002" |
      .title = "Exercise the bounded verification failure loop" |
      .planPath = "docs/plans/TASK-TEST-002.md" |
-     .targetTests = ["dev.example.orchestratorfixture.FailureLoopTest"]' \
+     .targetTests = [{gradleTask: "testDebugUnitTest", filter: "dev.example.orchestratorfixture.FailureLoopTest"}]' \
     "$fixture/automation/tasks/TASK-TEST-001.json" \
     > "$fixture/automation/tasks/TASK-TEST-002.json"
 (
@@ -375,7 +465,7 @@ jq \
     '.id = "TASK-TEST-003" |
      .title = "Verify dirty worktree preflight blocking" |
      .planPath = "docs/plans/TASK-TEST-003.md" |
-     .targetTests = ["dev.example.orchestratorfixture.PreflightBlockTest"]' \
+     .targetTests = [{gradleTask: "testDebugUnitTest", filter: "dev.example.orchestratorfixture.PreflightBlockTest"}]' \
     "$fixture/automation/tasks/TASK-TEST-001.json" \
     > "$fixture/automation/tasks/TASK-TEST-003.json"
 (
@@ -402,7 +492,7 @@ jq \
     '.id = "TASK-TEST-005" |
      .title = "Exercise the bounded reviewer repair cycle" |
      .planPath = "docs/plans/TASK-TEST-005.md" |
-     .targetTests = ["dev.example.orchestratorfixture.ReviewerFixTest"]' \
+     .targetTests = [{gradleTask: "testDebugUnitTest", filter: "dev.example.orchestratorfixture.ReviewerFixTest"}]' \
     "$fixture/automation/tasks/TASK-TEST-001.json" \
     > "$fixture/automation/tasks/TASK-TEST-005.json"
 (
@@ -452,7 +542,7 @@ jq \
     '.id = "TASK-TEST-004" |
      .title = "Exercise in-place transactional integration" |
      .planPath = "docs/plans/TASK-TEST-004.md" |
-     .targetTests = ["dev.example.orchestratorfixture.OrchestratedFlowTest"]' \
+     .targetTests = [{gradleTask: "testDebugUnitTest", filter: "dev.example.orchestratorfixture.OrchestratedFlowTest"}]' \
     "$fixture/automation/tasks/TASK-TEST-001.json" \
     > "$fixture/automation/tasks/TASK-TEST-004.json"
 
@@ -483,6 +573,8 @@ approved_baseline="$(jq -er '.baselineHead' "$runtime_root/workspaces/TASK-TEST-
 leased_status="$(run_fixture ./scripts/automation/status.sh TASK-TEST-004)"
 [[ "$(jq -r '.runtime.repositoryLeaseMatches' <<< "$leased_status")" == "true" ]] || fail 'status did not verify the repository lease'
 [[ "$(jq -r '.runtime.originalBranchDrifted' <<< "$leased_status")" == "false" ]] || fail 'status reported false branch drift'
+[[ "$(jq -c '.runtime.effectiveWorktreeAllowlist' <<< "$leased_status")" == '["local/operator-note.txt","local/generated-note.txt"]' ]] || \
+    fail 'status did not expose the approved in-place allowlist snapshot'
 if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_acquire_repository_lease TASK-TEST-999 "$PWD" inPlaceExclusive' >/dev/null 2>&1; then
     fail 'a second task acquired the persistent repository lease'
 fi
@@ -491,6 +583,10 @@ pass 'persistent repository lease rejects a concurrent automation task'
 [[ "$(jq -r '.state' "$runtime_root/state/TASK-TEST-004.json")" == "PENDING" ]] || fail 'prepared task did not become PENDING'
 pass 'contract approval switches to a leased task branch while deferring the sealed plan and contract to the product commit'
 
+git -C "$fixture" add -- \
+    .automation-worktree-allowlist \
+    local/operator-note.txt \
+    local/generated-note.txt
 run_task "$task_root" ./scripts/automation/claim-task.sh TASK-TEST-004 >/dev/null
 printf '%s\n' 'class OrchestratedFlowTest { fun expectedBehavior() = Unit }' > "$task_root/mobile-client/src/test/java/dev/example/orchestratorfixture/OrchestratedFlowTest.kt"
 run_task "$task_root" ./scripts/automation/record-red.sh TASK-TEST-004 'expected missing behavior' -- dev.example.orchestratorfixture.OrchestratedFlowTest >/dev/null
@@ -500,6 +596,15 @@ run_task "$task_root" ./scripts/automation/begin-review.sh TASK-TEST-004 >/dev/n
 run_task "$task_root" env AUTOMATION_FAKE_GREEN=1 ./scripts/automation/submit-review.sh TASK-TEST-004 APPROVED 'Fresh review confirms the sealed behavior and scope.' >/dev/null
 run_task "$task_root" ./scripts/automation/acceptance-report.sh TASK-TEST-004 >/dev/null
 [[ "$(jq -r '.changedPaths | length' "$runtime_root/evidence/TASK-TEST-004/acceptance-report.json")" -eq 2 ]] || fail 'acceptance package omitted product paths'
+if jq -e '.changedPaths | any(. == "local/operator-note.txt" or . == "local/generated-note.txt")' \
+    "$runtime_root/evidence/TASK-TEST-004/acceptance-report.json" >/dev/null; then
+    fail 'acceptance package included an allowlisted local path'
+fi
+if rg -F 'diff --git a/local/operator-note.txt b/local/operator-note.txt' "$runtime_root/evidence/TASK-TEST-004/sealed.diff" >/dev/null || \
+   rg -F 'diff --git a/local/generated-note.txt b/local/generated-note.txt' "$runtime_root/evidence/TASK-TEST-004/sealed.diff" >/dev/null || \
+   rg -F 'diff --git a/.automation-worktree-allowlist b/.automation-worktree-allowlist' "$runtime_root/evidence/TASK-TEST-004/sealed.diff" >/dev/null; then
+    fail 'sealed diff included allowlisted local content'
+fi
 [[ "$(jq -r '.evidence.qualityGate' "$runtime_root/evidence/TASK-TEST-004/acceptance-report.json")" == "PASSED" ]] || fail 'acceptance package omitted quality-gate status'
 acceptance_card="$(run_fixture ./scripts/automation/show-acceptance-review.sh TASK-TEST-004)"
 [[ "$acceptance_card" == *"人工验收提醒"* ]] || fail 'acceptance review did not actively identify the human gate'
@@ -538,6 +643,27 @@ for combined_path in \
         awk -v expected="$combined_path" '$0 == expected { found = 1 } END { exit !found }' || \
         fail "combined task commit omitted $combined_path"
 done
+if git -C "$fixture" diff-tree --no-commit-id --name-only -r "$combined_commit" | \
+    rg -x 'local/(operator-note|generated-note)\.txt|\.automation-worktree-allowlist' >/dev/null; then
+    fail 'combined task commit included an allowlisted local path or its control file'
+fi
+[[ "$(cat "$fixture/local/operator-note.txt")" == "operator local edit" ]] || fail 'tracked allowlisted content changed during integration'
+[[ "$(cat "$fixture/local/generated-note.txt")" == "generated local state" ]] || fail 'untracked allowlisted content changed during integration'
+staged_allowlist_paths="$(git -C "$fixture" diff --cached --name-only HEAD -- | LC_ALL=C sort)"
+for staged_allowlist_path in \
+    .automation-worktree-allowlist \
+    local/generated-note.txt \
+    local/operator-note.txt; do
+    printf '%s\n' "$staged_allowlist_paths" | \
+        awk -v expected="$staged_allowlist_path" '$0 == expected { found = 1 } END { exit !found }' || \
+        fail "integration consumed a staged allowlisted path: $staged_allowlist_path"
+done
+run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_worktree_is_clean' || fail 'allowlisted local state made the integrated source root dirty'
+pass 'in-place integration preserves allowlisted local state without evidence or commit leakage'
+git -C "$fixture" restore --staged -- \
+    .automation-worktree-allowlist \
+    local/operator-note.txt \
+    local/generated-note.txt
 [[ "$(jq -r '.contractCommit' "$runtime_root/evidence/TASK-TEST-004/origin.json")" == "$combined_commit" ]] || fail 'origin evidence did not bind the contract to the combined task commit'
 [[ "$(jq -r '.pushed' "$runtime_root/evidence/TASK-TEST-004/integration.json")" == "false" ]] || fail 'integration evidence did not forbid push'
 [[ "$(jq -r '.method' "$runtime_root/evidence/TASK-TEST-004/integration.json")" == "inPlaceExclusive-fast-forward" ]] || fail 'integration did not use the in-place fast-forward path'
@@ -557,11 +683,15 @@ jq \
     '.id = "TASK-TEST-008" |
      .title = "Archive an interrupted in-place task" |
      .planPath = "docs/plans/TASK-TEST-008.md" |
-     .targetTests = ["dev.example.orchestratorfixture.AbortArchiveTest"]' \
+     .targetTests = [{gradleTask: "testDebugUnitTest", filter: "dev.example.orchestratorfixture.AbortArchiveTest"}]' \
     "$fixture/automation/tasks/TASK-TEST-001.json" \
     > "$fixture/automation/tasks/TASK-TEST-008.json"
 run_fixture ./scripts/automation/prepare-contract-review.sh TASK-TEST-008 '批准方案，生成计划和任务合同。' >/dev/null
 run_fixture env AUTOMATION_SKIP_AGENT_RUN=1 ./scripts/automation/approve-and-run.sh TASK-TEST-008 '合同已复核，批准自动执行到人工验收阶段。' >/dev/null
+git -C "$fixture" add -- \
+    .automation-worktree-allowlist \
+    local/operator-note.txt \
+    local/generated-note.txt
 printf '%s\n' 'class AbortArchive { fun value() = "preserved" }' > "$fixture/mobile-client/src/main/java/dev/example/orchestratorfixture/AbortArchive.kt"
 printf '%s\n' 'must not be archived automatically' > "$fixture/out-of-contract.txt"
 if run_fixture ./scripts/automation/abort-task.sh TASK-TEST-008 '中止任务，封存修改并恢复原分支。' >/dev/null 2>&1; then
@@ -575,10 +705,27 @@ abort_recovery_commit="$(jq -er '.recoveryCommit' "$runtime_root/evidence/TASK-T
 git -C "$fixture" cat-file -e "$abort_recovery_commit:mobile-client/src/main/java/dev/example/orchestratorfixture/AbortArchive.kt" || fail 'abort recovery commit omitted the allowed change'
 git -C "$fixture" cat-file -e "$abort_recovery_commit:docs/plans/TASK-TEST-008.md" || fail 'abort recovery commit omitted the sealed plan'
 git -C "$fixture" cat-file -e "$abort_recovery_commit:automation/tasks/TASK-TEST-008.json" || fail 'abort recovery commit omitted the sealed contract'
+if git -C "$fixture" diff-tree --no-commit-id --name-only -r "$abort_recovery_commit" | \
+    rg -x 'local/(operator-note|generated-note)\.txt|\.automation-worktree-allowlist' >/dev/null; then
+    fail 'abort recovery commit included an allowlisted local path or its control file'
+fi
+staged_abort_allowlist_paths="$(git -C "$fixture" diff --cached --name-only HEAD -- | LC_ALL=C sort)"
+for staged_allowlist_path in \
+    .automation-worktree-allowlist \
+    local/generated-note.txt \
+    local/operator-note.txt; do
+    printf '%s\n' "$staged_abort_allowlist_paths" | \
+        awk -v expected="$staged_allowlist_path" '$0 == expected { found = 1 } END { exit !found }' || \
+        fail "abort consumed a staged allowlisted path: $staged_allowlist_path"
+done
 [[ ! -f "$fixture/mobile-client/src/main/java/dev/example/orchestratorfixture/AbortArchive.kt" ]] || fail 'abort left archived code on the original branch'
 [[ "$(jq -r '.state' "$runtime_root/state/TASK-TEST-008.json")" == "ABORTED" ]] || fail 'allowed abort did not reach ABORTED'
 [[ ! -d "$runtime_root/locks/repository.workspace.lease" ]] || fail 'allowed abort did not release the repository lease'
 pass 'abort refuses unrelated files and archives allowed uncommitted changes in a recovery commit'
+git -C "$fixture" restore --staged -- \
+    .automation-worktree-allowlist \
+    local/operator-note.txt \
+    local/generated-note.txt
 
 planning_only_baseline="$(git -C "$fixture" rev-parse HEAD)"
 printf '%s\n' '# Planning-only abort plan' > "$fixture/docs/plans/TASK-TEST-009.md"
@@ -586,7 +733,7 @@ jq \
     '.id = "TASK-TEST-009" |
      .title = "Abort before product editing" |
      .planPath = "docs/plans/TASK-TEST-009.md" |
-     .targetTests = ["dev.example.orchestratorfixture.PlanningOnlyAbortTest"]' \
+     .targetTests = [{gradleTask: "testDebugUnitTest", filter: "dev.example.orchestratorfixture.PlanningOnlyAbortTest"}]' \
     "$fixture/automation/tasks/TASK-TEST-001.json" \
     > "$fixture/automation/tasks/TASK-TEST-009.json"
 run_fixture ./scripts/automation/prepare-contract-review.sh TASK-TEST-009 '批准方案，生成计划和任务合同。' >/dev/null
@@ -611,16 +758,24 @@ jq \
     '.id = "TASK-TEST-007" |
      .title = "Keep optional isolated workspace support" |
      .planPath = "docs/plans/TASK-TEST-007.md" |
-     .targetTests = ["dev.example.orchestratorfixture.IsolatedFlowTest"]' \
+     .targetTests = [{gradleTask: "testDebugUnitTest", filter: "dev.example.orchestratorfixture.IsolatedFlowTest"}]' \
     "$fixture/automation/tasks/TASK-TEST-001.json" \
     > "$fixture/automation/tasks/TASK-TEST-007.json"
 run_fixture ./scripts/automation/prepare-contract-review.sh TASK-TEST-007 '批准方案，生成计划和任务合同。' >/dev/null
 run_fixture env AUTOMATION_SKIP_AGENT_RUN=1 ./scripts/automation/approve-and-run.sh TASK-TEST-007 '合同已复核，批准自动执行到人工验收阶段。' >/dev/null
 isolated_task_root="$(jq -er '.taskRoot' "$runtime_root/workspaces/TASK-TEST-007.json")"
 [[ "$isolated_task_root" != "$fixture" && -d "$isolated_task_root" ]] || fail 'optional isolated strategy did not create a separate task root'
+[[ "$(jq -r '.worktreeAllowlist | length' "$runtime_root/workspaces/TASK-TEST-007.json")" -eq 2 ]] || fail 'isolated workspace did not retain the approved allowlist snapshot'
 [[ -f "$isolated_task_root/docs/plans/TASK-TEST-007.md" && -f "$isolated_task_root/automation/tasks/TASK-TEST-007.json" ]] || fail 'isolated task root did not receive the sealed planning artifacts'
 [[ ! -e "$fixture/docs/plans/TASK-TEST-007.md" && ! -e "$fixture/automation/tasks/TASK-TEST-007.json" ]] || fail 'isolated preparation left duplicate planning artifacts in the source root'
 [[ "$(git -C "$fixture" worktree list --porcelain | awk '/^worktree / { count++ } END { print count + 0 }')" -eq 2 ]] || fail 'isolated strategy created more than one additional worktree'
+isolated_status="$(run_task "$isolated_task_root" ./scripts/automation/status.sh TASK-TEST-007)"
+[[ "$(jq -c '.runtime.effectiveWorktreeAllowlist' <<< "$isolated_status")" == '[]' ]] || \
+    fail 'status applied the source allowlist inside an isolated task root'
+printf '%s\n' 'task-local edit must stay visible' > "$isolated_task_root/local/operator-note.txt"
+isolated_visible_paths="$(run_task "$isolated_task_root" bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths')"
+printf '%s\n' "$isolated_visible_paths" | rg -x 'local/operator-note.txt' >/dev/null || fail 'source allowlist hid a task-local isolated-worktree edit'
+git -C "$isolated_task_root" restore -- local/operator-note.txt
 run_task "$isolated_task_root" ./scripts/automation/claim-task.sh TASK-TEST-007 >/dev/null
 printf '%s\n' 'class IsolatedFlowTest { fun expectedBehavior() = Unit }' > "$isolated_task_root/mobile-client/src/test/java/dev/example/orchestratorfixture/IsolatedFlowTest.kt"
 run_task "$isolated_task_root" ./scripts/automation/record-red.sh TASK-TEST-007 'expected missing behavior' -- dev.example.orchestratorfixture.IsolatedFlowTest >/dev/null
@@ -654,7 +809,7 @@ jq \
     '.id = "TASK-TEST-006" |
      .title = "Block an advanced original branch" |
      .planPath = "docs/plans/TASK-TEST-006.md" |
-     .targetTests = ["dev.example.orchestratorfixture.AdvancedOriginalTest"]' \
+     .targetTests = [{gradleTask: "testDebugUnitTest", filter: "dev.example.orchestratorfixture.AdvancedOriginalTest"}]' \
     "$fixture/automation/tasks/TASK-TEST-001.json" \
     > "$fixture/automation/tasks/TASK-TEST-006.json"
 run_fixture ./scripts/automation/prepare-contract-review.sh TASK-TEST-006 '批准方案，生成计划和任务合同。' >/dev/null

package/templates/scripts/automation/validate-contract.sh

@@ -13,6 +13,7 @@ input="${1:-}"
 [[ -n "$input" ]] || { usage; exit 2; }
 automation_require_command jq
 automation_require_layout
+automation_validate_config
 
 if [[ "$input" == */* || "$input" == *.json || "$input" == *.example ]]; then
     contract="$input"
@@ -39,7 +40,12 @@ jq -e '
     (.allowedSuperpowers == ["test-driven-development", "systematic-debugging", "verification-before-completion"]) and
     (.acceptanceCriteria | type == "array" and length > 0) and
     (.nonGoals | type == "array" and length > 0) and
-    (.targetTests | type == "array" and length > 0) and
+    (.targetTests | type == "array" and length > 0 and all(.[];
+        type == "object" and
+        keys == ["filter", "gradleTask"] and
+        (.gradleTask | type == "string" and test("^(?:[A-Za-z][A-Za-z0-9_.-]*|(?::[A-Za-z0-9_.-]+)+)$")) and
+        (.filter | type == "string" and test("^[A-Za-z0-9_.#$*-]+$")))) and
+    ([.targetTests[].filter] | length == (unique | length)) and
     (.deviceTestsRequired | type == "boolean") and
     (.testPolicy == "required" or .testPolicy == "not-required") and
     (if .testPolicy == "not-required" then (.testPolicyReason | type == "string" and length >= 20) else true end)
@@ -68,10 +74,15 @@ while IFS= read -r protected; do
     fi
 done < <(jq -r '.protectedPaths[]' "$AUTOMATION_CONFIG")
 
-safe_filter_pattern='^[A-Za-z0-9_.#$*-]+$'
-while IFS= read -r filter; do
-    [[ "$filter" =~ $safe_filter_pattern ]] || automation_die "unsafe target test filter: $filter"
-done < <(jq -r '.targetTests[]' "$contract")
+while IFS=$'\t' read -r gradle_task filter; do
+    automation_validate_gradle_task "$gradle_task"
+    automation_validate_test_filter "$filter"
+    jq -e \
+        --arg task "$gradle_task" \
+        '.gradleVerification.focusedTestTasks | index($task) != null' \
+        "$AUTOMATION_CONFIG" >/dev/null || \
+        automation_die "target test Gradle task is not allowed by automation/config.json: $gradle_task"
+done < <(jq -r '.targetTests[] | [.gradleTask, .filter] | @tsv' "$contract")
 
 if rg -n -i 'replace with|TASK-EXAMPLE|todo|tbd|placeholder' "$contract" >/dev/null; then
     automation_die "contract still contains template placeholders"

package/templates/scripts/automation/verify-integration.sh

@@ -12,26 +12,27 @@ head="${3:-}"
 automation_validate_task_id "$task_id"
 [[ "$(automation_read_state "$task_id")" == "INTEGRATING" ]] || automation_die "$task_id is not INTEGRATING"
 contract="$(automation_contract_path "$task_id")"
+"$SCRIPT_DIR/validate-contract.sh" "$task_id" >/dev/null
 
 "$SCRIPT_DIR/integration-scope-gate.sh" "$task_id" "$base" "$head"
 
-while IFS= read -r filter; do
-    automation_info "running integration focused test: $filter"
-    ./gradlew testDebugUnitTest --tests "$filter"
-done < <(jq -r '.targetTests[]' "$contract")
+while IFS=$'\t' read -r gradle_task filter; do
+    automation_info "running integration focused test ($gradle_task): $filter"
+    automation_run_focused_test "$gradle_task" "$filter" "$AUTOMATION_ROOT"
+done < <(jq -r '.targetTests[] | [.gradleTask, .filter] | @tsv' "$contract")
 
 automation_info "running integration full unit tests"
-./gradlew testDebugUnitTest
+automation_run_gradle_group "fullUnitTestTasks" "$AUTOMATION_ROOT"
 
-automation_info "building integration debug APK"
-./gradlew assembleDebug
+automation_info "running configured integration assemble tasks"
+automation_run_gradle_group "assembleTasks" "$AUTOMATION_ROOT"
 
-automation_info "running integration Android lint"
-./gradlew lint
+automation_info "running configured integration Android lint tasks"
+automation_run_gradle_group "lintTasks" "$AUTOMATION_ROOT"
 
 if [[ "$(jq -r '.deviceTestsRequired' "$contract")" == "true" ]]; then
-    automation_info "running integration connected device tests"
-    ./gradlew connectedDebugAndroidTest
+    automation_info "running configured integration device tests"
+    automation_run_gradle_group "deviceTestTasks" "$AUTOMATION_ROOT"
 fi
 
 automation_info "integration candidate passed all deterministic verification"

package/templates/scripts/automation/verify-task.sh

@@ -17,38 +17,23 @@ evidence_dir="$(automation_evidence_path "$task_id")"
 
 "$SCRIPT_DIR/scope-gate.sh" "$task_id"
 
-while IFS= read -r filter; do
-    automation_info "running focused test: $filter"
-    (
-        cd "$AUTOMATION_ROOT"
-        ./gradlew testDebugUnitTest --tests "$filter"
-    )
-done < <(jq -r '.targetTests[]' "$contract")
+while IFS=$'\t' read -r gradle_task filter; do
+    automation_info "running focused test ($gradle_task): $filter"
+    automation_run_focused_test "$gradle_task" "$filter" "$AUTOMATION_ROOT"
+done < <(jq -r '.targetTests[] | [.gradleTask, .filter] | @tsv' "$contract")
 
 automation_info "running full unit tests"
-(
-    cd "$AUTOMATION_ROOT"
-    ./gradlew testDebugUnitTest
-)
-
-automation_info "building debug APK"
-(
-    cd "$AUTOMATION_ROOT"
-    ./gradlew assembleDebug
-)
-
-automation_info "running Android lint"
-(
-    cd "$AUTOMATION_ROOT"
-    ./gradlew lint
-)
+automation_run_gradle_group "fullUnitTestTasks" "$AUTOMATION_ROOT"
+
+automation_info "running configured assemble tasks"
+automation_run_gradle_group "assembleTasks" "$AUTOMATION_ROOT"
+
+automation_info "running configured Android lint tasks"
+automation_run_gradle_group "lintTasks" "$AUTOMATION_ROOT"
 
 if [[ "$(jq -r '.deviceTestsRequired' "$contract")" == "true" ]]; then
-    automation_info "running connected device tests"
-    (
-        cd "$AUTOMATION_ROOT"
-        ./gradlew connectedDebugAndroidTest
-    )
+    automation_info "running configured device tests"
+    automation_run_gradle_group "deviceTestTasks" "$AUTOMATION_ROOT"
 fi
 
 automation_info "all deterministic verification commands passed"