@frankzhang2026/opencode-android-orchestrator 1.0.5 → 1.1.0

package/templates/scripts/automation/lib.sh

@@ -109,14 +109,14 @@ automation_validate_config() {
         def gradle_task:
             type == "string" and
             test("^(?:[A-Za-z][A-Za-z0-9_.-]*|(?::[A-Za-z0-9_.-]+)+)$");
-        def gradle_task_list:
+        def optional_gradle_task_list:
             type == "array" and
-            length > 0 and
             length == (unique | length) and
             all(.[]; gradle_task);
+        def gradle_task_list:
+            optional_gradle_task_list and length > 0;
         (.schemaVersion == 5 or .schemaVersion == 6) and
         ((.commitPolicy // "humanApproval") == "humanApproval" or .commitPolicy == "autoCommit") and
-        (.workspaceStrategy != "isolatedWorktree" or (.commitPolicy // "humanApproval") == "humanApproval") and
         (.enabled | type == "boolean") and
         (.mode == "shadow" or .mode == "orchestrated") and
         (.workspaceStrategy == "inPlaceExclusive" or .workspaceStrategy == "isolatedWorktree") and
@@ -149,8 +149,9 @@ automation_validate_config() {
             ($verification.fullUnitTestTasks | gradle_task_list) and
             ($verification.focusedTestTasks | gradle_task_list) and
             ($verification.assembleTasks | gradle_task_list) and
-            ($verification.lintTasks | gradle_task_list) and
-            ($verification.deviceTestTasks | gradle_task_list)) and
+            ($verification.lintTasks | optional_gradle_task_list) and
+            ($verification.deviceTestTasks | optional_gradle_task_list)) and
+        ((.lintEnabled | not) or (.gradleVerification.lintTasks | length > 0)) and
         (.androidProject as $project |
             ($project | type == "object") and
             ($project.name | type == "string" and length > 0) and
@@ -163,16 +164,19 @@ automation_validate_config() {
                 (.directory | repository_path) and
                 (.buildFile | repository_path) and
                 (.dsl == "kotlin" or .dsl == "groovy") and
-                (.type == "application" or .type == "library" or .type == "dynamic-feature" or .type == "test" or .type == "asset-pack") and
+                (.type == "application" or .type == "library" or .type == "dynamic-feature" or .type == "test" or .type == "asset-pack" or ($project.capabilities.version == 1 and .type == "jvm-library")) and
                 (.namespace == null or (.namespace | type == "string" and length > 0)) and
                 (.applicationId == null or (.applicationId | type == "string" and length > 0)))) and
             any($project.modules[]; .gradlePath == $project.primaryModule) and
             ($project.productionPaths | type == "array" and length > 0 and all(.[];
-                repository_path and test("(^|/)src/main/\\*\\*$"))) and
+                repository_path and ($project.capabilities.version == 1 or test("(^|/)src/main/\\*\\*$")))) and
             ($project.testPaths | type == "array" and length > 0 and all(.[];
-                repository_path and test("(^|/)src/(?:test|androidTest)/\\*\\*$")))) and
+                repository_path and ($project.capabilities.version == 1 or test("(^|/)src/(?:test|androidTest)/\\*\\*$"))))) and
         (.protectedPaths | type == "array" and length > 0 and all(.[]; repository_path))
     ' "$AUTOMATION_CONFIG" >/dev/null || automation_die "automation/config.json is invalid"
+    if jq -e '.androidProject | has("capabilities")' "$AUTOMATION_CONFIG" >/dev/null; then
+        node "$AUTOMATION_ROOT/automation/verification/project.cjs" "$AUTOMATION_CONFIG" "$AUTOMATION_ROOT" || automation_die "Android capability snapshot is invalid"
+    fi
 }
 
 automation_require_orchestrated() {
@@ -250,7 +254,7 @@ automation_require_queue_execution() {
         return 1
     }
     if ! worker_pid="$(jq -er --arg key "$queue_key" --arg run "$AUTOMATION_QUEUE_RUN_ID" \
-        'select(.active.key == $key and .active.id == $run) | .active.worker.pid' \
+        'select(.active.key == $key and .active.id == $run and (.active.supervision == null or .active.supervision.state == "RUNNING")) | .active.worker.pid' \
         "$AUTOMATION_RUNTIME_ROOT/inbox/queue.json")"; then
         automation_die "current process does not own this task queue execution"
         return 1
@@ -414,14 +418,26 @@ automation_gradle_group_command_json() {
     automation_validate_config || return 1
     jq -ce \
         --arg group "$group" \
-        '["./gradlew"] + .gradleVerification[$group]' \
+        --arg supervised "${AUTOMATION_WORKER_TOKEN:+yes}" \
+        '["./gradlew"] + .gradleVerification[$group] + (if $supervised == "yes" then ["--no-daemon"] else [] end)'  \
         "$AUTOMATION_CONFIG"
 }
 
+# Keep Git/scope/evidence operations at the repository root. Only Gradle changes
+# cwd, resolving the persisted relative build selection in the current worktree.
+automation_gradle_build_root() {
+    local root="${1:-$AUTOMATION_ROOT}"
+    if jq -e '.androidProject.capabilities != null' "$AUTOMATION_CONFIG" >/dev/null; then
+        node "$AUTOMATION_ROOT/automation/verification/project.cjs" "$AUTOMATION_CONFIG" "$root" --build-root
+    else
+        printf '%s\n' "$root"
+    fi
+}
+
 automation_run_gradle_group() {
     local group="$1"
     local root="${2:-$AUTOMATION_ROOT}"
-    local task
+    local task build_root
     local -a tasks=()
 
     automation_validate_gradle_group "$group" || return 1
@@ -440,8 +456,10 @@ automation_run_gradle_group() {
         return $?
     fi
     (
-        cd "$root"
-        ./gradlew "${tasks[@]}"
+        local build_root
+        build_root="$(automation_gradle_build_root "$root")" || exit 1
+        cd "$build_root" || exit 1
+        ./gradlew "${tasks[@]}" ${AUTOMATION_WORKER_TOKEN:+--no-daemon}
     )
 }
 
@@ -451,7 +469,7 @@ automation_run_gradle_group() {
 automation_run_fresh_unit_tests() {
     local root="$1"
     shift
-    local init_file log_file result elapsed start
+    local init_file log_file result elapsed start build_root
     mkdir -p "$AUTOMATION_RUNTIME_ROOT/gradle"
     init_file="$(mktemp "$AUTOMATION_RUNTIME_ROOT/gradle/fresh-tests.XXXXXX")"
     log_file="${init_file}.log"
@@ -481,7 +499,7 @@ gradle.taskGraph.afterTask { task, state ->
 GRADLE
     start="$(date +%s)"
     set +e
-    (cd "$root" && ./gradlew "$@" --no-configuration-cache --console=plain --init-script "$init_file") 2>&1 | tee "$log_file"
+    (build_root="$(automation_gradle_build_root "$root")" && cd "$build_root" && ./gradlew "$@" ${AUTOMATION_WORKER_TOKEN:+--no-daemon} --no-configuration-cache --console=plain --init-script "$init_file") 2>&1 | tee "$log_file"
     result=${PIPESTATUS[0]}
     set -e
     elapsed=$(( $(date +%s) - start ))
@@ -522,10 +540,14 @@ automation_run_configured_unit_tests() {
         return 0
     fi
 
+    if [[ "$(jq -r '.schemaVersion' "$contract")" -ge "4" ]]; then
+        automation_run_inventory green "$(jq -er '.id' "$contract")" "$root" || return 1
+    else
     while IFS=$'\t' read -r gradle_task filter; do
         automation_info "running ${context}focused test ($gradle_task): $filter"
         automation_run_focused_test "$gradle_task" "$filter" "$root"
     done < <(jq -r '.targetTests[] | [.gradleTask, .filter] | @tsv' "$contract")
+    fi
 
     automation_info "running ${context}full unit tests"
     automation_run_gradle_group "fullUnitTestTasks" "$root"
@@ -561,8 +583,10 @@ automation_run_focused_test() {
         }
 
     (
-        cd "$root"
-        ./gradlew "$task" --tests "$filter"
+        local build_root
+        build_root="$(automation_gradle_build_root "$root")" || exit 1
+        cd "$build_root" || exit 1
+        ./gradlew "$task" --tests "$filter" ${AUTOMATION_WORKER_TOKEN:+--no-daemon}
     )
 }
 
@@ -575,7 +599,7 @@ automation_run_classified_focused_test() {
     local root="$3"
     local result_file="$4"
     local log_file="$5"
-    local init_file status
+    local init_file status build_root
 
     automation_validate_config || return 1
     automation_validate_gradle_task "$task" || return 1
@@ -644,7 +668,7 @@ gradle.allprojects { project ->
 GRADLE
 
     set +e
-    (cd "$root" && ./gradlew "$task" --tests "$filter" \
+    (build_root="$(automation_gradle_build_root "$root")" && cd "$build_root" && ./gradlew "$task" --tests "$filter" ${AUTOMATION_WORKER_TOKEN:+--no-daemon} \
         --no-configuration-cache --console=plain --init-script "$init_file" \
         "-Dorchestrator.caseResultFile=$result_file") 2>&1 | tee "$log_file"
     status=${PIPESTATUS[0]}
@@ -674,6 +698,24 @@ automation_test_diff_sha() {
     } | shasum -a 256 | awk '{print $1}'
 }
 
+automation_run_inventory() {
+    local phase="$1" task_id="$2" root="${3:-$AUTOMATION_ROOT}"
+    node "$AUTOMATION_ROOT/automation/verification/inventory.cjs" "$phase" \
+        "$(automation_contract_path "$task_id")" "$AUTOMATION_CONFIG" "$root" "$(automation_evidence_path "$task_id")"
+}
+
+# Discovery only classifies evidence inputs. Scope gates still enforce the
+# approved paths, forbidden paths, protected files and the file-count limit.
+automation_is_task_test_path() {
+    local task_id="$1" path="$2"
+    if [[ "$(jq -r '.schemaVersion' "$(automation_contract_path "$task_id")")" -ge "4" ]]; then
+        node "$AUTOMATION_ROOT/automation/verification/inventory.cjs" is-test \
+            "$(automation_evidence_path "$task_id")/baseline-inventory.json" "$AUTOMATION_CONFIG" "$AUTOMATION_ROOT" "$path"
+    else
+        automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"
+    fi
+}
+
 automation_require_approval() {
     local kind="$1"
     local supplied="$2"

package/templates/scripts/automation/orchestrate-task.sh

@@ -63,7 +63,13 @@ run_agent() {
     return "$exit_code"
 }
 
-for _step in 1 2 3 4 5 6 7 8; do
+# Each review correction consumes four transitions: resume, code, begin review,
+# and review. Include the initial three transitions, budget-exhaustion
+# transition, and the final state check.
+# The bound must agree with the approved number of review correction cycles.
+max_review_cycles="$(automation_config_value '.maxReviewCycles')"
+max_steps=$((4 * (max_review_cycles + 1) + 1))
+for ((_step = 0; _step < max_steps; _step++)); do
     if [[ -n "${AUTOMATION_QUEUE_RUN_ID:-}" ]] && jq -e --arg id "$task_id" \
         'any(.items[]; .taskId == $id and .request.kind == "abort")' \
         "$AUTOMATION_RUNTIME_ROOT/inbox/queue.json" >/dev/null; then

package/templates/scripts/automation/preflight.sh

@@ -34,9 +34,8 @@ automation_require_command shasum
 if [[ "${AUTOMATION_TEST_MODE:-0}" != "1" ]]; then
     automation_require_command opencode
 fi
-[[ -x "$AUTOMATION_ROOT/gradlew" ]] || automation_die "gradlew is missing or not executable"
-
 automation_validate_config
+[[ -x "$(automation_gradle_build_root)/gradlew" ]] || automation_die "selected Gradle build wrapper is missing or not executable"
 workspace_strategy="$(automation_config_value '.workspaceStrategy')"
 if [[ "$workspace_strategy" == "isolatedWorktree" ]]; then
     automation_worktree_base >/dev/null

package/templates/scripts/automation/quality-gate.sh

@@ -33,10 +33,19 @@ max_attempts=$((max_fix_loops + 1))
 attempt_log="$evidence_dir/gate-cycle-$coding_cycle-attempt-$attempt.log"
 started_at="$(automation_now)"
 set +e
-"$SCRIPT_DIR/verify-task.sh" "$task_id" 2>&1 | tee "$attempt_log"
+if [[ "$(jq -r '.schemaVersion' "$contract")" -ge "7" ]]; then
+    node "$AUTOMATION_ROOT/automation/verification/recovery.cjs" --stage green "$contract" "$AUTOMATION_CONFIG" "$AUTOMATION_ROOT" "$evidence_dir" 2>&1 | tee "$attempt_log"
+else
+    "$SCRIPT_DIR/verify-task.sh" "$task_id" 2>&1 | tee "$attempt_log"
+fi
 gate_status=${PIPESTATUS[0]}
 set -e
 
+if [[ "$(jq -r '.schemaVersion' "$contract")" -ge "7" && ( "$gate_status" -eq 75 || "$gate_status" -eq 76 ) ]]; then
+    automation_transition_state "$task_id" "CODING" "BLOCKED" "quality-gate" "verification stopped; inspect stage-recovery/green.json; implementation budget retained"
+    exit "$gate_status"
+fi
+
 jq -n \
     --arg taskId "$task_id" \
     --argjson attempts "$attempt" \

package/templates/scripts/automation/record-red.sh

@@ -19,6 +19,17 @@ mkdir -p "$evidence_dir"
 red_meta="$evidence_dir/red.json"
 [[ ! -e "$red_meta" ]] || automation_die "RED evidence already exists for $task_id"
 
+if [[ "$schema_version" -ge "4" ]]; then
+    [[ "$#" -eq 1 ]] || automation_die "Schema V4/V5 usage: record-red.sh TASK-ID"
+    "$SCRIPT_DIR/scope-gate.sh" "$task_id" >/dev/null
+    if [[ "$schema_version" -ge "7" ]]; then
+        node "$AUTOMATION_ROOT/automation/verification/recovery.cjs" --stage red "$contract" "$AUTOMATION_CONFIG" "$AUTOMATION_ROOT" "$evidence_dir"
+        exit $?
+    fi
+    automation_run_inventory red "$task_id"
+    exit 0
+fi
+
 # Preserve the exact V1/V2 behavior for already approved contracts.
 if [[ "$schema_version" != "3" ]]; then
     expected="${2:-}"
@@ -43,9 +54,10 @@ if [[ "$schema_version" != "3" ]]; then
     rg -F "$expected" "$red_log" >/dev/null || automation_die "RED output does not contain the expected failure text"
     jq -n --arg taskId "$task_id" --arg startedAt "$started_at" --arg finishedAt "$(automation_now)" \
         --arg expectedFailure "$expected" --arg gradleTask "$gradle_task" --arg testFilter "$filter" \
+        --arg cwd "$(automation_gradle_build_root)" \
         --argjson exitCode "$red_status" \
         '{taskId: $taskId, startedAt: $startedAt, finishedAt: $finishedAt,
-          command: ["./gradlew", $gradleTask, "--tests", $testFilter],
+          command: ["./gradlew", $gradleTask, "--tests", $testFilter], cwd: $cwd,
           expectedFailure: $expectedFailure, exitCode: $exitCode}' | automation_record_json "$red_meta"
     automation_info "$task_id legacy RED evidence recorded"
     exit 0

package/templates/scripts/automation/resume-task.sh

@@ -55,6 +55,9 @@ source_root="$(cd "$source_root" && pwd -P)"
 git -C "$source_root" show-ref --verify --quiet "refs/heads/$original_branch" || automation_die "recorded original branch no longer exists"
 [[ "$(git -C "$source_root" rev-parse "refs/heads/$original_branch")" == "$baseline_head" ]] || automation_die "original branch drifted after task preparation"
 
+if [[ "$(jq -r '.schemaVersion' "$(automation_contract_path "$task_id")")" == "4" && -e "$evidence_dir/baseline.json" ]]; then
+    automation_die "V4 baseline.json already exists; /resume-task cannot retry inventory capture. Inspect the retained attempt, request approved abort/archive, then approve a new task; do not delete or overwrite baseline evidence."
+fi
 for sealed_evidence in baseline.json red.json ready.json review.json reviews.jsonl; do
     [[ ! -e "$evidence_dir/$sealed_evidence" ]] || \
         automation_die "$sealed_evidence already exists; baseline-only recovery is forbidden"

package/templates/scripts/automation/scope-gate.sh

@@ -66,7 +66,7 @@ while IFS= read -r path; do
     if automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.productionPaths' "$path"; then
         production_changed=1
     fi
-    if automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"; then
+    if automation_is_task_test_path "$task_id" "$path"; then
         test_changed=1
     fi
 done <<< "$changed_file_list"
@@ -75,7 +75,7 @@ deleted_tests="$(
     while IFS= read -r path; do
         [[ -n "$path" ]] || continue
         if [[ -n "$(git -C "$AUTOMATION_ROOT" diff --no-renames --name-only --diff-filter=D HEAD -- "$path")" ]] && \
-           automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"; then
+           automation_is_task_test_path "$task_id" "$path"; then
             printf '%s\n' "$path"
         fi
     done <<< "$changed_file_list"
@@ -91,7 +91,7 @@ fi
 added_test_lines="$(
     while IFS= read -r path; do
         [[ -n "$path" ]] || continue
-        if automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"; then
+        if automation_is_task_test_path "$task_id" "$path"; then
             git -C "$AUTOMATION_ROOT" diff --no-renames --unified=0 HEAD -- "$path"
         fi
     done <<< "$changed_file_list" \
@@ -106,7 +106,7 @@ fi
 while IFS= read -r untracked_test; do
     [[ -n "$untracked_test" ]] || continue
     if ! git -C "$AUTOMATION_ROOT" ls-files --error-unmatch -- "$untracked_test" >/dev/null 2>&1 && \
-       automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$untracked_test" && \
+       automation_is_task_test_path "$task_id" "$untracked_test" && \
         rg -n "$weakening_pattern" "$AUTOMATION_ROOT/$untracked_test" >/dev/null; then
         automation_die "potential test weakening detected in new test: $untracked_test"
         exit 40

package/templates/scripts/automation/show-acceptance-review.sh

@@ -95,6 +95,7 @@ printf -- '- Reviewer：`%s`，独立复验退出码 `%s`\n' \
     "$(jq -r '.evidence.reviewerVerificationExitCode' "$report_file")"
 printf -- '- Reviewer 摘要：%s\n' "$(jq -r '.reviewSummary' "$report_file")"
 printf -- '- 聚焦测试：\n'
+printf -- '  - Gradle 工作目录：`%s`\n' "$(automation_gradle_build_root)"
 jq -r '.targetTests[] | "  - `./gradlew \(.gradleTask) --tests \(.filter)`"' "$report_file"
 
 printf '\n### P1 · 绑定与剩余风险\n\n'

package/templates/scripts/automation/status.sh

@@ -23,6 +23,26 @@ baseline_json="$(if [[ -f "$evidence_dir/baseline.json" ]]; then jq -c . "$evide
 red_json="$(if [[ -f "$evidence_dir/red.json" ]]; then jq -c . "$evidence_dir/red.json"; else printf 'null'; fi)"
 preflight_json="$(if [[ -f "$evidence_dir/test-preflight.json" ]]; then jq -c . "$evidence_dir/test-preflight.json"; else printf 'null'; fi)"
 manifest_json="$(if [[ -f "$evidence_dir/test-manifest.json" ]]; then jq -c . "$evidence_dir/test-manifest.json"; else printf 'null'; fi)"
+inventory_baseline_json="$(if [[ -f "$evidence_dir/baseline-inventory.json" ]]; then jq -c . "$evidence_dir/baseline-inventory.json"; else printf 'null'; fi)"
+inventory_green_json="$(if [[ -f "$evidence_dir/green-inventory.json" ]]; then jq -c . "$evidence_dir/green-inventory.json"; else printf 'null'; fi)"
+inventory_status_json="$(if [[ -f "$evidence_dir/inventory-status.json" ]]; then jq -c . "$evidence_dir/inventory-status.json"; else printf 'null'; fi)"
+baseline_recovery_json="$(if [[ -f "$evidence_dir/baseline-recovery.json" ]]; then jq -c . "$evidence_dir/baseline-recovery.json"; else printf 'null'; fi)"
+stage_recovery_json='{}'
+for phase in red green review; do
+    if [[ -f "$evidence_dir/stage-recovery/$phase.json" ]]; then
+        stage_recovery_json="$(jq -nc --argjson current "$stage_recovery_json" --arg phase "$phase" \
+            --slurpfile record "$evidence_dir/stage-recovery/$phase.json" '$current + {($phase): $record[0]}')"
+    fi
+done
+supervision_json=null
+if [[ -f "$AUTOMATION_RUNTIME_ROOT/inbox/queue.json" ]]; then
+    supervision_json="$(jq -c --arg task "$task_id" '
+        ([.items[]? | select(.taskId == $task)] | last | .key) as $key |
+        ([.runs[]?, .active] | map(select(.key == $key)) | last | .supervision) |
+        if . == null then null else {state, stage, deadline, stageDeadline, stopReason, termAt, killAt} end
+    ' "$AUTOMATION_RUNTIME_ROOT/inbox/queue.json")"
+    supervision_json="${supervision_json:-null}"
+fi
 ready_json="$(if [[ -f "$evidence_dir/ready.json" ]]; then jq -c . "$evidence_dir/ready.json"; else printf 'null'; fi)"
 review_json="$(if [[ -f "$evidence_dir/review.json" ]]; then jq -c . "$evidence_dir/review.json"; else printf 'null'; fi)"
 gate_json=null
@@ -97,6 +117,12 @@ jq -n \
     --argjson red "$red_json" \
     --argjson testPreflight "$preflight_json" \
     --argjson testManifest "$manifest_json" \
+    --argjson baselineInventory "$inventory_baseline_json" \
+    --argjson greenInventory "$inventory_green_json" \
+    --argjson inventoryStatus "$inventory_status_json" \
+    --argjson baselineRecovery "$baseline_recovery_json" \
+    --argjson stageRecovery "$stage_recovery_json" \
+    --argjson workerSupervision "$supervision_json" \
     --argjson ready "$ready_json" \
     --argjson gate "$gate_json" \
     --argjson review "$review_json" \
@@ -124,6 +150,12 @@ jq -n \
         red: $red,
         testPreflight: $testPreflight,
         testManifest: $testManifest,
+        baselineInventory: $baselineInventory,
+        greenInventory: $greenInventory,
+        inventoryStatus: $inventoryStatus,
+        baselineRecovery: $baselineRecovery,
+        stageRecovery: $stageRecovery,
+        workerSupervision: $workerSupervision,
         ready: $ready,
         latestGate: $gate,
         review: $review,

package/templates/scripts/automation/submit-review.sh

@@ -36,9 +36,18 @@ review_log="$evidence_dir/review-verification.log"
 verification_status=0
 if [[ "$decision" == "APPROVED" ]]; then
     set +e
-    "$SCRIPT_DIR/verify-task.sh" "$task_id" 2>&1 | tee "$review_log"
+    contract="$(automation_contract_path "$task_id")"
+    if [[ "$(jq -r '.schemaVersion' "$contract")" -ge "7" ]]; then
+        node "$AUTOMATION_ROOT/automation/verification/recovery.cjs" --stage review "$contract" "$AUTOMATION_CONFIG" "$AUTOMATION_ROOT" "$evidence_dir" 2>&1 | tee "$review_log"
+    else
+        "$SCRIPT_DIR/verify-task.sh" "$task_id" 2>&1 | tee "$review_log"
+    fi
     verification_status=${PIPESTATUS[0]}
     set -e
+    if [[ "$(jq -r '.schemaVersion' "$contract")" -ge "7" && ( "$verification_status" -eq 75 || "$verification_status" -eq 76 ) ]]; then
+        automation_transition_state "$task_id" "REVIEWING" "BLOCKED" "reviewer" "independent verification stopped; inspect stage-recovery/review.json; no implementation change requested"
+        exit "$verification_status"
+    fi
     if [[ "$verification_status" -ne 0 ]]; then
         decision="CHANGES_REQUESTED"
         summary="Independent verification failed with exit $verification_status. $summary"

package/templates/scripts/automation/validate-contract.sh

@@ -26,6 +26,10 @@ fi
 [[ -f "$contract" ]] || automation_die "contract not found: $contract"
 jq -e . "$contract" >/dev/null || automation_die "contract is not valid JSON: $contract"
 
+if [[ "$(jq -r '.schemaVersion' "$contract")" -ge "4" ]]; then
+    node "$AUTOMATION_ROOT/automation/verification/contract.cjs" "$contract" "$AUTOMATION_CONFIG" || \
+        automation_die "V4/V5 contract validation failed"
+else
 jq -e '
     (.schemaVersion == 1 or .schemaVersion == 2 or .schemaVersion == 3) and
     (.id | type == "string" and test("^TASK-[A-Z0-9-]+$")) and
@@ -99,9 +103,14 @@ jq -e '
              else false end)))
      else true end)
 ' "$contract" >/dev/null || automation_die "contract is missing required fields or violates limits"
+fi
 
 task_id="$(jq -r '.id' "$contract")"
 automation_validate_task_id "$task_id"
+if [[ "$(jq -r '.deviceTestsRequired' "$contract")" == "true" ]]; then
+    jq -e '.gradleVerification.deviceTestTasks | length > 0' "$AUTOMATION_CONFIG" >/dev/null || \
+        automation_die "Device tests are required by this contract but no device test tasks are available"
+fi
 
 if [[ "$contract" == "$AUTOMATION_TASKS_DIR/"* ]]; then
     expected_contract="$(automation_contract_path "$task_id")"
@@ -133,7 +142,7 @@ while IFS=$'\t' read -r gradle_task filter; do
         automation_die "target test Gradle task is not allowed by automation/config.json: $gradle_task"
 done < <(jq -r '.targetTests[] | [.gradleTask, .filter] | @tsv' "$contract")
 
-if rg -n -i 'replace with|TASK-EXAMPLE|todo|tbd|placeholder' "$contract" >/dev/null; then
+if [[ "$(jq -r '.schemaVersion' "$contract")" -lt "4" ]] && rg -n -i 'replace with|TASK-EXAMPLE|todo|tbd|placeholder' "$contract" >/dev/null; then
     automation_die "contract still contains template placeholders"
 fi
 

package/templates/scripts/automation/verify-integration.sh

@@ -28,4 +28,7 @@ if [[ "$(jq -r '.deviceTestsRequired' "$contract")" == "true" ]]; then
     automation_run_gradle_group "deviceTestTasks" "$AUTOMATION_ROOT"
 fi
 
+if [[ "$(jq -r '.schemaVersion' "$contract")" -ge "4" ]]; then
+    automation_run_inventory check "$task_id"
+fi
 automation_info "integration candidate passed all deterministic verification"

package/templates/scripts/automation/verify-task.sh

@@ -44,6 +44,9 @@ if [[ "$(jq -r '.deviceTestsRequired' "$contract")" == "true" ]]; then
 fi
 
 automation_info "all deterministic verification commands passed"
+if [[ "$contract_schema" -ge "4" ]]; then
+    automation_run_inventory check "$task_id"
+fi
 if [[ -n "${AUTOMATION_QUEUE_RUN_ID:-}" ]]; then
     [[ -n "${AUTOMATION_FULL_TEST_LOG:-}" ]] || automation_die "fresh full unit-test evidence is missing"
     jq -n \