@frankzhang2026/opencode-android-orchestrator 1.0.4 → 1.1.0

package/templates/scripts/automation/lib.sh

@@ -109,14 +109,14 @@ automation_validate_config() {
         def gradle_task:
             type == "string" and
             test("^(?:[A-Za-z][A-Za-z0-9_.-]*|(?::[A-Za-z0-9_.-]+)+)$");
-        def gradle_task_list:
+        def optional_gradle_task_list:
             type == "array" and
-            length > 0 and
             length == (unique | length) and
             all(.[]; gradle_task);
+        def gradle_task_list:
+            optional_gradle_task_list and length > 0;
         (.schemaVersion == 5 or .schemaVersion == 6) and
         ((.commitPolicy // "humanApproval") == "humanApproval" or .commitPolicy == "autoCommit") and
-        (.workspaceStrategy != "isolatedWorktree" or (.commitPolicy // "humanApproval") == "humanApproval") and
         (.enabled | type == "boolean") and
         (.mode == "shadow" or .mode == "orchestrated") and
         (.workspaceStrategy == "inPlaceExclusive" or .workspaceStrategy == "isolatedWorktree") and
@@ -149,8 +149,9 @@ automation_validate_config() {
             ($verification.fullUnitTestTasks | gradle_task_list) and
             ($verification.focusedTestTasks | gradle_task_list) and
             ($verification.assembleTasks | gradle_task_list) and
-            ($verification.lintTasks | gradle_task_list) and
-            ($verification.deviceTestTasks | gradle_task_list)) and
+            ($verification.lintTasks | optional_gradle_task_list) and
+            ($verification.deviceTestTasks | optional_gradle_task_list)) and
+        ((.lintEnabled | not) or (.gradleVerification.lintTasks | length > 0)) and
         (.androidProject as $project |
             ($project | type == "object") and
             ($project.name | type == "string" and length > 0) and
@@ -163,16 +164,19 @@ automation_validate_config() {
                 (.directory | repository_path) and
                 (.buildFile | repository_path) and
                 (.dsl == "kotlin" or .dsl == "groovy") and
-                (.type == "application" or .type == "library" or .type == "dynamic-feature" or .type == "test" or .type == "asset-pack") and
+                (.type == "application" or .type == "library" or .type == "dynamic-feature" or .type == "test" or .type == "asset-pack" or ($project.capabilities.version == 1 and .type == "jvm-library")) and
                 (.namespace == null or (.namespace | type == "string" and length > 0)) and
                 (.applicationId == null or (.applicationId | type == "string" and length > 0)))) and
             any($project.modules[]; .gradlePath == $project.primaryModule) and
             ($project.productionPaths | type == "array" and length > 0 and all(.[];
-                repository_path and test("(^|/)src/main/\\*\\*$"))) and
+                repository_path and ($project.capabilities.version == 1 or test("(^|/)src/main/\\*\\*$")))) and
             ($project.testPaths | type == "array" and length > 0 and all(.[];
-                repository_path and test("(^|/)src/(?:test|androidTest)/\\*\\*$")))) and
+                repository_path and ($project.capabilities.version == 1 or test("(^|/)src/(?:test|androidTest)/\\*\\*$"))))) and
         (.protectedPaths | type == "array" and length > 0 and all(.[]; repository_path))
     ' "$AUTOMATION_CONFIG" >/dev/null || automation_die "automation/config.json is invalid"
+    if jq -e '.androidProject | has("capabilities")' "$AUTOMATION_CONFIG" >/dev/null; then
+        node "$AUTOMATION_ROOT/automation/verification/project.cjs" "$AUTOMATION_CONFIG" "$AUTOMATION_ROOT" || automation_die "Android capability snapshot is invalid"
+    fi
 }
 
 automation_require_orchestrated() {
@@ -250,7 +254,7 @@ automation_require_queue_execution() {
         return 1
     }
     if ! worker_pid="$(jq -er --arg key "$queue_key" --arg run "$AUTOMATION_QUEUE_RUN_ID" \
-        'select(.active.key == $key and .active.id == $run) | .active.worker.pid' \
+        'select(.active.key == $key and .active.id == $run and (.active.supervision == null or .active.supervision.state == "RUNNING")) | .active.worker.pid' \
         "$AUTOMATION_RUNTIME_ROOT/inbox/queue.json")"; then
         automation_die "current process does not own this task queue execution"
         return 1
@@ -414,14 +418,26 @@ automation_gradle_group_command_json() {
     automation_validate_config || return 1
     jq -ce \
         --arg group "$group" \
-        '["./gradlew"] + .gradleVerification[$group]' \
+        --arg supervised "${AUTOMATION_WORKER_TOKEN:+yes}" \
+        '["./gradlew"] + .gradleVerification[$group] + (if $supervised == "yes" then ["--no-daemon"] else [] end)'  \
         "$AUTOMATION_CONFIG"
 }
 
+# Keep Git/scope/evidence operations at the repository root. Only Gradle changes
+# cwd, resolving the persisted relative build selection in the current worktree.
+automation_gradle_build_root() {
+    local root="${1:-$AUTOMATION_ROOT}"
+    if jq -e '.androidProject.capabilities != null' "$AUTOMATION_CONFIG" >/dev/null; then
+        node "$AUTOMATION_ROOT/automation/verification/project.cjs" "$AUTOMATION_CONFIG" "$root" --build-root
+    else
+        printf '%s\n' "$root"
+    fi
+}
+
 automation_run_gradle_group() {
     local group="$1"
     local root="${2:-$AUTOMATION_ROOT}"
-    local task
+    local task build_root
     local -a tasks=()
 
     automation_validate_gradle_group "$group" || return 1
@@ -440,8 +456,10 @@ automation_run_gradle_group() {
         return $?
     fi
     (
-        cd "$root"
-        ./gradlew "${tasks[@]}"
+        local build_root
+        build_root="$(automation_gradle_build_root "$root")" || exit 1
+        cd "$build_root" || exit 1
+        ./gradlew "${tasks[@]}" ${AUTOMATION_WORKER_TOKEN:+--no-daemon}
     )
 }
 
@@ -451,7 +469,7 @@ automation_run_gradle_group() {
 automation_run_fresh_unit_tests() {
     local root="$1"
     shift
-    local init_file log_file result elapsed start
+    local init_file log_file result elapsed start build_root
     mkdir -p "$AUTOMATION_RUNTIME_ROOT/gradle"
     init_file="$(mktemp "$AUTOMATION_RUNTIME_ROOT/gradle/fresh-tests.XXXXXX")"
     log_file="${init_file}.log"
@@ -481,7 +499,7 @@ gradle.taskGraph.afterTask { task, state ->
 GRADLE
     start="$(date +%s)"
     set +e
-    (cd "$root" && ./gradlew "$@" --no-configuration-cache --console=plain --init-script "$init_file") 2>&1 | tee "$log_file"
+    (build_root="$(automation_gradle_build_root "$root")" && cd "$build_root" && ./gradlew "$@" ${AUTOMATION_WORKER_TOKEN:+--no-daemon} --no-configuration-cache --console=plain --init-script "$init_file") 2>&1 | tee "$log_file"
     result=${PIPESTATUS[0]}
     set -e
     elapsed=$(( $(date +%s) - start ))
@@ -522,10 +540,14 @@ automation_run_configured_unit_tests() {
         return 0
     fi
 
+    if [[ "$(jq -r '.schemaVersion' "$contract")" -ge "4" ]]; then
+        automation_run_inventory green "$(jq -er '.id' "$contract")" "$root" || return 1
+    else
     while IFS=$'\t' read -r gradle_task filter; do
         automation_info "running ${context}focused test ($gradle_task): $filter"
         automation_run_focused_test "$gradle_task" "$filter" "$root"
     done < <(jq -r '.targetTests[] | [.gradleTask, .filter] | @tsv' "$contract")
+    fi
 
     automation_info "running ${context}full unit tests"
     automation_run_gradle_group "fullUnitTestTasks" "$root"
@@ -561,11 +583,139 @@ automation_run_focused_test() {
         }
 
     (
-        cd "$root"
-        ./gradlew "$task" --tests "$filter"
+        local build_root
+        build_root="$(automation_gradle_build_root "$root")" || exit 1
+        cd "$build_root" || exit 1
+        ./gradlew "$task" --tests "$filter" ${AUTOMATION_WORKER_TOKEN:+--no-daemon}
     )
 }
 
+# Run one focused target with fresh Test execution and machine-readable case
+# results. Test assertion failures are collected instead of failing Gradle so
+# the caller can distinguish approved RED from build and fixture failures.
+automation_run_classified_focused_test() {
+    local task="$1"
+    local filter="$2"
+    local root="$3"
+    local result_file="$4"
+    local log_file="$5"
+    local init_file status build_root
+
+    automation_validate_config || return 1
+    automation_validate_gradle_task "$task" || return 1
+    automation_validate_test_filter "$filter" || return 1
+    jq -e --arg task "$task" \
+        '.gradleVerification.focusedTestTasks | index($task) != null' \
+        "$AUTOMATION_CONFIG" >/dev/null || {
+        automation_die "focused Gradle task is not allowed by automation/config.json: $task"
+        return 1
+    }
+
+    mkdir -p "$AUTOMATION_RUNTIME_ROOT/gradle" "$(dirname "$result_file")" "$(dirname "$log_file")"
+    init_file="$(mktemp "$AUTOMATION_RUNTIME_ROOT/gradle/classified-tests.XXXXXX")"
+    : > "$result_file"
+    cat > "$init_file" <<'GRADLE'
+import groovy.json.JsonOutput
+import org.gradle.api.tasks.testing.Test
+import org.gradle.api.tasks.testing.TestDescriptor
+import org.gradle.api.tasks.testing.TestListener
+import org.gradle.api.tasks.testing.TestResult
+
+def outputPath = System.getProperty('orchestrator.caseResultFile')
+if (outputPath == null || outputPath.isEmpty()) {
+    throw new GradleException('orchestrator.caseResultFile is required')
+}
+def outputFile = new File(outputPath)
+def appendResult = { Map value ->
+    synchronized (gradle) {
+        outputFile << JsonOutput.toJson(value) << System.lineSeparator()
+    }
+}
+
+gradle.allprojects { project ->
+    project.tasks.withType(Test).configureEach { testTask ->
+        outputs.upToDateWhen { false }
+        outputs.doNotCacheIf('Orchestrator requires fresh classified test execution') { true }
+        ignoreFailures = true
+        failFast = false
+        if (testTask.hasProperty('dryRun')) testTask.dryRun = false
+        addTestListener(new TestListener() {
+            void beforeSuite(TestDescriptor descriptor) {}
+            void beforeTest(TestDescriptor descriptor) {}
+            void afterTest(TestDescriptor descriptor, TestResult result) {
+                def failure = result.exceptions == null || result.exceptions.isEmpty() ? null : result.exceptions[0]
+                appendResult([
+                    kind: 'case', taskPath: testTask.path,
+                    className: descriptor.className ?: '', name: descriptor.name ?: '',
+                    result: result.resultType.toString(),
+                    exceptionType: failure == null ? null : failure.class.name,
+                    exceptionMessage: failure == null ? null : (failure.message ?: '')
+                ])
+            }
+            void afterSuite(TestDescriptor descriptor, TestResult result) {
+                if (descriptor.parent == null) {
+                    appendResult([
+                        kind: 'suite', taskPath: testTask.path,
+                        tests: result.testCount, failures: result.failedTestCount,
+                        skipped: result.skippedTestCount,
+                        result: result.resultType.toString()
+                    ])
+                }
+            }
+        })
+    }
+}
+GRADLE
+
+    set +e
+    (build_root="$(automation_gradle_build_root "$root")" && cd "$build_root" && ./gradlew "$task" --tests "$filter" ${AUTOMATION_WORKER_TOKEN:+--no-daemon} \
+        --no-configuration-cache --console=plain --init-script "$init_file" \
+        "-Dorchestrator.caseResultFile=$result_file") 2>&1 | tee "$log_file"
+    status=${PIPESTATUS[0]}
+    set -e
+    rm -f "$init_file"
+    return "$status"
+}
+
+automation_test_diff_sha() {
+    local task_id="$1"
+    local root="${2:-$AUTOMATION_ROOT}"
+    local path tracked=0
+    {
+        while IFS= read -r path; do
+            [[ -n "$path" ]] || continue
+            if automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"; then
+                tracked=1
+                if git -C "$root" ls-files --error-unmatch -- "$path" >/dev/null 2>&1; then
+                    git -C "$root" diff --binary --no-renames HEAD -- "$path"
+                else
+                    printf 'UNTRACKED %s\0' "$path"
+                    git -C "$root" hash-object -- "$path"
+                fi
+            fi
+        done < <(automation_product_changed_paths_at "$task_id" "$root")
+        [[ "$tracked" == "1" ]] || printf 'NO-TEST-CHANGES'
+    } | shasum -a 256 | awk '{print $1}'
+}
+
+automation_run_inventory() {
+    local phase="$1" task_id="$2" root="${3:-$AUTOMATION_ROOT}"
+    node "$AUTOMATION_ROOT/automation/verification/inventory.cjs" "$phase" \
+        "$(automation_contract_path "$task_id")" "$AUTOMATION_CONFIG" "$root" "$(automation_evidence_path "$task_id")"
+}
+
+# Discovery only classifies evidence inputs. Scope gates still enforce the
+# approved paths, forbidden paths, protected files and the file-count limit.
+automation_is_task_test_path() {
+    local task_id="$1" path="$2"
+    if [[ "$(jq -r '.schemaVersion' "$(automation_contract_path "$task_id")")" -ge "4" ]]; then
+        node "$AUTOMATION_ROOT/automation/verification/inventory.cjs" is-test \
+            "$(automation_evidence_path "$task_id")/baseline-inventory.json" "$AUTOMATION_CONFIG" "$AUTOMATION_ROOT" "$path"
+    else
+        automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"
+    fi
+}
+
 automation_require_approval() {
     local kind="$1"
     local supplied="$2"

package/templates/scripts/automation/orchestrate-task.sh

@@ -63,7 +63,13 @@ run_agent() {
     return "$exit_code"
 }
 
-for _step in 1 2 3 4 5 6 7 8; do
+# Each review correction consumes four transitions: resume, code, begin review,
+# and review. Include the initial three transitions, budget-exhaustion
+# transition, and the final state check.
+# The bound must agree with the approved number of review correction cycles.
+max_review_cycles="$(automation_config_value '.maxReviewCycles')"
+max_steps=$((4 * (max_review_cycles + 1) + 1))
+for ((_step = 0; _step < max_steps; _step++)); do
     if [[ -n "${AUTOMATION_QUEUE_RUN_ID:-}" ]] && jq -e --arg id "$task_id" \
         'any(.items[]; .taskId == $id and .request.kind == "abort")' \
         "$AUTOMATION_RUNTIME_ROOT/inbox/queue.json" >/dev/null; then

package/templates/scripts/automation/preflight.sh

@@ -34,9 +34,8 @@ automation_require_command shasum
 if [[ "${AUTOMATION_TEST_MODE:-0}" != "1" ]]; then
     automation_require_command opencode
 fi
-[[ -x "$AUTOMATION_ROOT/gradlew" ]] || automation_die "gradlew is missing or not executable"
-
 automation_validate_config
+[[ -x "$(automation_gradle_build_root)/gradlew" ]] || automation_die "selected Gradle build wrapper is missing or not executable"
 workspace_strategy="$(automation_config_value '.workspaceStrategy')"
 if [[ "$workspace_strategy" == "isolatedWorktree" ]]; then
     automation_worktree_base >/dev/null

package/templates/scripts/automation/quality-gate.sh

@@ -33,10 +33,19 @@ max_attempts=$((max_fix_loops + 1))
 attempt_log="$evidence_dir/gate-cycle-$coding_cycle-attempt-$attempt.log"
 started_at="$(automation_now)"
 set +e
-"$SCRIPT_DIR/verify-task.sh" "$task_id" 2>&1 | tee "$attempt_log"
+if [[ "$(jq -r '.schemaVersion' "$contract")" -ge "7" ]]; then
+    node "$AUTOMATION_ROOT/automation/verification/recovery.cjs" --stage green "$contract" "$AUTOMATION_CONFIG" "$AUTOMATION_ROOT" "$evidence_dir" 2>&1 | tee "$attempt_log"
+else
+    "$SCRIPT_DIR/verify-task.sh" "$task_id" 2>&1 | tee "$attempt_log"
+fi
 gate_status=${PIPESTATUS[0]}
 set -e
 
+if [[ "$(jq -r '.schemaVersion' "$contract")" -ge "7" && ( "$gate_status" -eq 75 || "$gate_status" -eq 76 ) ]]; then
+    automation_transition_state "$task_id" "CODING" "BLOCKED" "quality-gate" "verification stopped; inspect stage-recovery/green.json; implementation budget retained"
+    exit "$gate_status"
+fi
+
 jq -n \
     --arg taskId "$task_id" \
     --argjson attempts "$attempt" \

package/templates/scripts/automation/record-red.sh

@@ -6,51 +6,201 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$SCRIPT_DIR/lib.sh"
 
 task_id="${1:-}"
-expected="${2:-}"
-separator="${3:-}"
-filter="${4:-}"
-
-if [[ -z "$task_id" || -z "$expected" || "$separator" != "--" || -z "$filter" || "$#" -ne 4 ]]; then
-    printf 'Usage: %s TASK-ID EXPECTED-FAILURE-TEXT -- TEST-FILTER\n' "$0" >&2
-    exit 2
-fi
-
+[[ -n "$task_id" ]] || { printf 'Usage: %s TASK-ID [LEGACY-EXPECTED -- LEGACY-FILTER]\n' "$0" >&2; exit 2; }
 automation_validate_task_id "$task_id"
 automation_require_queue_execution "$task_id"
-automation_validate_test_filter "$filter"
-[[ ${#expected} -ge 3 ]] || automation_die "expected failure text is too short"
 [[ "$(automation_read_state "$task_id")" == "CODING" ]] || automation_die "$task_id is not CODING"
 "$SCRIPT_DIR/validate-contract.sh" "$task_id"
 
 contract="$(automation_contract_path "$task_id")"
-target_count="$(jq -er --arg filter "$filter" '[.targetTests[] | select(.filter == $filter)] | length' "$contract")"
-[[ "$target_count" -eq 1 ]] || automation_die "test filter must identify exactly one declared contract target: $filter"
-gradle_task="$(jq -er --arg filter "$filter" '.targetTests[] | select(.filter == $filter) | .gradleTask' "$contract")"
-
+schema_version="$(jq -er '.schemaVersion' "$contract")"
 evidence_dir="$(automation_evidence_path "$task_id")"
 mkdir -p "$evidence_dir"
-red_log="$evidence_dir/red.log"
 red_meta="$evidence_dir/red.json"
 [[ ! -e "$red_meta" ]] || automation_die "RED evidence already exists for $task_id"
-started_at="$(automation_now)"
 
-set +e
-automation_run_focused_test "$gradle_task" "$filter" "$AUTOMATION_ROOT" 2>&1 | tee "$red_log"
-red_status=${PIPESTATUS[0]}
-set -e
+if [[ "$schema_version" -ge "4" ]]; then
+    [[ "$#" -eq 1 ]] || automation_die "Schema V4/V5 usage: record-red.sh TASK-ID"
+    "$SCRIPT_DIR/scope-gate.sh" "$task_id" >/dev/null
+    if [[ "$schema_version" -ge "7" ]]; then
+        node "$AUTOMATION_ROOT/automation/verification/recovery.cjs" --stage red "$contract" "$AUTOMATION_CONFIG" "$AUTOMATION_ROOT" "$evidence_dir"
+        exit $?
+    fi
+    automation_run_inventory red "$task_id"
+    exit 0
+fi
+
+# Preserve the exact V1/V2 behavior for already approved contracts.
+if [[ "$schema_version" != "3" ]]; then
+    expected="${2:-}"
+    separator="${3:-}"
+    filter="${4:-}"
+    if [[ -z "$expected" || "$separator" != "--" || -z "$filter" || "$#" -ne 4 ]]; then
+        printf 'Usage: %s TASK-ID EXPECTED-FAILURE-TEXT -- TEST-FILTER\n' "$0" >&2
+        exit 2
+    fi
+    automation_validate_test_filter "$filter"
+    [[ ${#expected} -ge 3 ]] || automation_die "expected failure text is too short"
+    target_count="$(jq -er --arg filter "$filter" '[.targetTests[] | select(.filter == $filter)] | length' "$contract")"
+    [[ "$target_count" -eq 1 ]] || automation_die "test filter must identify exactly one declared contract target: $filter"
+    gradle_task="$(jq -er --arg filter "$filter" '.targetTests[] | select(.filter == $filter) | .gradleTask' "$contract")"
+    red_log="$evidence_dir/red.log"
+    started_at="$(automation_now)"
+    set +e
+    automation_run_focused_test "$gradle_task" "$filter" "$AUTOMATION_ROOT" 2>&1 | tee "$red_log"
+    red_status=${PIPESTATUS[0]}
+    set -e
+    [[ "$red_status" -ne 0 ]] || automation_die "RED capture failed: focused test passed before implementation"
+    rg -F "$expected" "$red_log" >/dev/null || automation_die "RED output does not contain the expected failure text"
+    jq -n --arg taskId "$task_id" --arg startedAt "$started_at" --arg finishedAt "$(automation_now)" \
+        --arg expectedFailure "$expected" --arg gradleTask "$gradle_task" --arg testFilter "$filter" \
+        --arg cwd "$(automation_gradle_build_root)" \
+        --argjson exitCode "$red_status" \
+        '{taskId: $taskId, startedAt: $startedAt, finishedAt: $finishedAt,
+          command: ["./gradlew", $gradleTask, "--tests", $testFilter], cwd: $cwd,
+          expectedFailure: $expectedFailure, exitCode: $exitCode}' | automation_record_json "$red_meta"
+    automation_info "$task_id legacy RED evidence recorded"
+    exit 0
+fi
 
-[[ "$red_status" -ne 0 ]] || automation_die "RED capture failed: focused test passed before implementation"
-rg -F "$expected" "$red_log" >/dev/null || automation_die "RED output does not contain the expected failure text"
+[[ "$#" -eq 1 ]] || { printf 'Schema V3 usage: %s TASK-ID\n' "$0" >&2; exit 2; }
+"$SCRIPT_DIR/scope-gate.sh" "$task_id" >/dev/null
+
+# RED must be captured before any production change. Planning artifacts are
+# excluded; test sources and fixtures are the only permitted product changes.
+while IFS= read -r changed_path; do
+    [[ -n "$changed_path" ]] || continue
+    if ! automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$changed_path"; then
+        automation_die "RED preflight requires unchanged production code; non-test path changed: $changed_path"
+    fi
+done < <(automation_product_changed_paths_at "$task_id" "$AUTOMATION_ROOT")
+
+previous_attempt=0
+preflight_meta="$evidence_dir/test-preflight.json"
+if [[ -f "$preflight_meta" ]]; then
+    previous_attempt="$(jq -er '.attempt' "$preflight_meta")"
+fi
+attempt=$((previous_attempt + 1))
+max_fixes="$(jq -er '.verification.maxPreparationFixes' "$contract")"
+if [[ "$attempt" -gt $((max_fixes + 1)) ]]; then
+    automation_die "test preparation retry budget exhausted; revise the contract or abort the task"
+fi
+
+attempt_id="$(printf '%03d' "$attempt")"
+attempt_dir="$evidence_dir/attempts/red-preflight-$attempt_id"
+mkdir -p "$attempt_dir"
+observed_file="$attempt_dir/observed.jsonl"
+: > "$observed_file"
+execution_failures='[]'
+started_at="$(automation_now)"
+target_index=0
+while IFS=$'\t' read -r gradle_task filter; do
+    result_file="$attempt_dir/target-$target_index.jsonl"
+    log_file="$attempt_dir/target-$target_index.log"
+    set +e
+    automation_run_classified_focused_test "$gradle_task" "$filter" "$AUTOMATION_ROOT" "$result_file" "$log_file"
+    gradle_status=$?
+    set -e
+    if [[ "$gradle_status" -ne 0 ]]; then
+        execution_failures="$(jq -nc --argjson current "$execution_failures" --argjson target "$target_index" \
+            --arg task "$gradle_task" --arg filter "$filter" --argjson exitCode "$gradle_status" \
+            '$current + [{target: $target, gradleTask: $task, filter: $filter, exitCode: $exitCode}]')"
+    fi
+    if [[ -s "$result_file" ]]; then
+        while IFS= read -r result_line; do
+            if ! jq -e . >/dev/null 2>&1 <<< "$result_line"; then
+                execution_failures="$(jq -nc --argjson current "$execution_failures" --argjson target "$target_index" \
+                    '$current + [{target: $target, reason: "invalid structured test output"}]')"
+                continue
+            fi
+            jq -c --argjson target "$target_index" '. + {target: $target}' <<< "$result_line" >> "$observed_file"
+        done < "$result_file"
+    else
+        execution_failures="$(jq -nc --argjson current "$execution_failures" --argjson target "$target_index" \
+            '$current + [{target: $target, reason: "no structured test results"}]')"
+    fi
+    target_index=$((target_index + 1))
+done < <(jq -r '.targetTests[] | [.gradleTask, .filter] | @tsv' "$contract")
+
+contract_sha="$(automation_file_sha256 "$contract")"
+baseline_head="$(jq -er '.head' "$evidence_dir/baseline.json")"
+test_diff_sha="$(automation_test_diff_sha "$task_id" "$AUTOMATION_ROOT")"
+finished_at="$(automation_now)"
 
 jq -n \
+    --slurpfile contract "$contract" \
+    --slurpfile observed "$observed_file" \
     --arg taskId "$task_id" \
     --arg startedAt "$started_at" \
-    --arg finishedAt "$(automation_now)" \
-    --arg expectedFailure "$expected" \
-    --arg gradleTask "$gradle_task" \
-    --arg testFilter "$filter" \
-    --argjson exitCode "$red_status" \
-    '{taskId: $taskId, startedAt: $startedAt, finishedAt: $finishedAt, command: ["./gradlew", $gradleTask, "--tests", $testFilter], expectedFailure: $expectedFailure, exitCode: $exitCode}' \
-    | automation_record_json "$red_meta"
-
-automation_info "$task_id RED evidence recorded"
+    --arg finishedAt "$finished_at" \
+    --arg contractSha256 "$contract_sha" \
+    --arg baselineHead "$baseline_head" \
+    --arg testDiffSha256 "$test_diff_sha" \
+    --argjson attempt "$attempt" \
+    --argjson executionFailures "$execution_failures" '
+      def failure_matches($decl; $actual):
+        ($actual.result == "FAILURE") and
+        ($actual.exceptionType == $decl.expectedFailure.type) and
+        (($decl.expectedFailure.messageIncludes // "") as $fragment |
+          ($fragment == "" or (($actual.exceptionMessage // "") | contains($fragment))));
+      ($contract[0].verification.cases | map(
+        . as $decl |
+        [$observed[] | select(.kind == "case" and .target == $decl.test.target and
+          .className == $decl.test.className and .name == $decl.test.name)] as $matches |
+        (if ($matches | length) == 1 then $matches[0] else null end) as $actual |
+        (if ($matches | length) != 1 then false
+         elif $decl.before == "pass" then $actual.result == "SUCCESS"
+         elif $decl.before == "fail" then failure_matches($decl; $actual)
+         elif $actual.result == "SUCCESS" then true
+         elif ($decl | has("expectedFailure")) then failure_matches($decl; $actual)
+         else false end) as $valid |
+        {id: $decl.id, criterion: $decl.criterion, intent: $decl.intent,
+         expectedBefore: $decl.before, test: $decl.test, expectedFailure: ($decl.expectedFailure // null),
+         matches: ($matches | length), actual: $actual, valid: $valid}
+      )) as $cases |
+      [$observed[] | select(.kind == "case") as $actual |
+        select(any($contract[0].verification.cases[];
+          .test.target == $actual.target and .test.className == $actual.className and .test.name == $actual.name) | not)] as $undeclared |
+      [$observed[] | select(.kind == "suite")] as $suites |
+      ($executionFailures | length == 0 and
+       ($suites | length) >= ($contract[0].targetTests | length) and
+       ($cases | all(.valid)) and ($undeclared | length == 0) and
+       ($cases | any(.intent == "change" and .actual.result == "FAILURE"))) as $valid |
+      {taskId: $taskId, attempt: $attempt, startedAt: $startedAt, finishedAt: $finishedAt,
+       contractSha256: $contractSha256, baselineHead: $baselineHead,
+       testDiffSha256: $testDiffSha256, valid: $valid,
+       reasonCode: (if $valid then "VALID_RED"
+                    elif ($executionFailures | length) > 0 then "EXECUTION_FAILURE"
+                    elif ($undeclared | length) > 0 then "UNDECLARED_TEST_RESULT"
+                    else "CASE_EXPECTATION_MISMATCH" end),
+       summary: {declared: ($cases | length), valid: ([$cases[] | select(.valid)] | length),
+                 invalid: ([$cases[] | select(.valid | not)] | length),
+                 expectedRed: ([$cases[] | select(.intent == "change" and .actual.result == "FAILURE")] | length),
+                 undeclared: ($undeclared | length)},
+       cases: $cases, undeclaredCases: $undeclared, suites: $suites,
+       executionFailures: $executionFailures}' | automation_record_json "$preflight_meta"
+
+cp "$preflight_meta" "$attempt_dir/evaluation.json"
+if [[ "$(jq -r '.valid' "$preflight_meta")" != "true" ]]; then
+    reason="$(jq -r '.reasonCode' "$preflight_meta")"
+    invalid="$(jq -r '[.cases[] | select(.valid | not) | .id] | join(", ")' "$preflight_meta")"
+    automation_die "RED preflight rejected ($reason); invalid cases: ${invalid:-none}; evidence: $preflight_meta"
+fi
+
+jq '{taskId, contractSha256, baselineHead, testDiffSha256,
+     cases: [.cases[] | {id, criterion, intent, test, actual}]}' "$preflight_meta" \
+    | automation_record_json "$evidence_dir/test-manifest.json"
+preflight_sha="$(automation_file_sha256 "$preflight_meta")"
+manifest_sha="$(automation_file_sha256 "$evidence_dir/test-manifest.json")"
+jq -n --arg taskId "$task_id" --arg startedAt "$started_at" --arg finishedAt "$finished_at" \
+    --arg contractSha256 "$contract_sha" --arg baselineHead "$baseline_head" \
+    --arg testDiffSha256 "$test_diff_sha" --arg preflightSha256 "$preflight_sha" \
+    --arg manifestSha256 "$manifest_sha" --arg attemptPath "attempts/red-preflight-$attempt_id" \
+    --argjson attempt "$attempt" \
+    '{taskId: $taskId, schemaVersion: 3, startedAt: $startedAt, finishedAt: $finishedAt,
+      contractSha256: $contractSha256, baselineHead: $baselineHead,
+      testDiffSha256: $testDiffSha256, preflightSha256: $preflightSha256,
+      manifestSha256: $manifestSha256, attempt: $attempt, attemptPath: $attemptPath,
+      structuredCasesVerified: true, exitCode: 1}' | automation_record_json "$red_meta"
+
+automation_info "$task_id structured RED evidence recorded"

package/templates/scripts/automation/resume-task.sh

@@ -55,6 +55,9 @@ source_root="$(cd "$source_root" && pwd -P)"
 git -C "$source_root" show-ref --verify --quiet "refs/heads/$original_branch" || automation_die "recorded original branch no longer exists"
 [[ "$(git -C "$source_root" rev-parse "refs/heads/$original_branch")" == "$baseline_head" ]] || automation_die "original branch drifted after task preparation"
 
+if [[ "$(jq -r '.schemaVersion' "$(automation_contract_path "$task_id")")" == "4" && -e "$evidence_dir/baseline.json" ]]; then
+    automation_die "V4 baseline.json already exists; /resume-task cannot retry inventory capture. Inspect the retained attempt, request approved abort/archive, then approve a new task; do not delete or overwrite baseline evidence."
+fi
 for sealed_evidence in baseline.json red.json ready.json review.json reviews.jsonl; do
     [[ ! -e "$evidence_dir/$sealed_evidence" ]] || \
         automation_die "$sealed_evidence already exists; baseline-only recovery is forbidden"

package/templates/scripts/automation/scope-gate.sh

@@ -66,7 +66,7 @@ while IFS= read -r path; do
     if automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.productionPaths' "$path"; then
         production_changed=1
     fi
-    if automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"; then
+    if automation_is_task_test_path "$task_id" "$path"; then
         test_changed=1
     fi
 done <<< "$changed_file_list"
@@ -75,7 +75,7 @@ deleted_tests="$(
     while IFS= read -r path; do
         [[ -n "$path" ]] || continue
         if [[ -n "$(git -C "$AUTOMATION_ROOT" diff --no-renames --name-only --diff-filter=D HEAD -- "$path")" ]] && \
-           automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"; then
+           automation_is_task_test_path "$task_id" "$path"; then
             printf '%s\n' "$path"
         fi
     done <<< "$changed_file_list"
@@ -91,7 +91,7 @@ fi
 added_test_lines="$(
     while IFS= read -r path; do
         [[ -n "$path" ]] || continue
-        if automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"; then
+        if automation_is_task_test_path "$task_id" "$path"; then
             git -C "$AUTOMATION_ROOT" diff --no-renames --unified=0 HEAD -- "$path"
         fi
     done <<< "$changed_file_list" \
@@ -106,7 +106,7 @@ fi
 while IFS= read -r untracked_test; do
     [[ -n "$untracked_test" ]] || continue
     if ! git -C "$AUTOMATION_ROOT" ls-files --error-unmatch -- "$untracked_test" >/dev/null 2>&1 && \
-       automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$untracked_test" && \
+       automation_is_task_test_path "$task_id" "$untracked_test" && \
         rg -n "$weakening_pattern" "$AUTOMATION_ROOT/$untracked_test" >/dev/null; then
         automation_die "potential test weakening detected in new test: $untracked_test"
         exit 40

package/templates/scripts/automation/show-acceptance-review.sh

@@ -79,6 +79,13 @@ jq -r '.nonGoals[] | "- \(.)"' "$report_file"
 
 printf '\n### P1 · 自动证据是否可信\n\n'
 printf -- '- RED 退出码：`%s`（应为非 0，证明测试先真实失败）\n' "$(jq -r '.evidence.redExitCode' "$report_file")"
+if [[ "$(jq -r '.evidence.structuredRed != null' "$report_file")" == "true" ]]; then
+    printf -- '- 结构化 RED：声明 `%s` 个，用例匹配 `%s` 个，额外用例 `%s` 个\n' \
+        "$(jq -r '.evidence.structuredRed.summary.declared' "$report_file")" \
+        "$(jq -r '.evidence.structuredRed.summary.valid' "$report_file")" \
+        "$(jq -r '.evidence.structuredRed.summary.undeclared' "$report_file")"
+    jq -r '.evidence.structuredRed.cases[] | "  - `\(.id)` · \(.intent) · 修改前应 \(.expectedBefore) · 已核验 \(.valid)"' "$report_file"
+fi
 printf -- '- 质量门：`%s`，第 %s 个编码周期内共运行 %s 次\n' \
     "$(jq -r '.evidence.qualityGate' "$report_file")" \
     "$(jq -r '.evidence.codingCycle' "$report_file")" \
@@ -88,6 +95,7 @@ printf -- '- Reviewer：`%s`，独立复验退出码 `%s`\n' \
     "$(jq -r '.evidence.reviewerVerificationExitCode' "$report_file")"
 printf -- '- Reviewer 摘要：%s\n' "$(jq -r '.reviewSummary' "$report_file")"
 printf -- '- 聚焦测试：\n'
+printf -- '  - Gradle 工作目录：`%s`\n' "$(automation_gradle_build_root)"
 jq -r '.targetTests[] | "  - `./gradlew \(.gradleTask) --tests \(.filter)`"' "$report_file"
 
 printf '\n### P1 · 绑定与剩余风险\n\n'