@pzy560117/codex-harness 0.1.2 → 0.1.4

package/package-source/docs/codex-harness-engineering/templates/runtime/codex-loop.ps1

@@ -15,9 +15,9 @@ $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
 [Console]::OutputEncoding = $utf8NoBom
 $OutputEncoding = $utf8NoBom
 
-if ([string]::IsNullOrWhiteSpace($ProjectRoot)) {
-  $ProjectRoot = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot "..\.."))
-}
+if ([string]::IsNullOrWhiteSpace($ProjectRoot)) {
+  $ProjectRoot = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot "..\.."))
+}
 
 function Write-Step {
   <#
@@ -29,7 +29,7 @@ function Write-Step {
   Write-Host "[$timestamp] $Message"
 }
 
-function Get-TextFileContent {
+function Get-TextFileContent {
   <#
     读取 UTF-8 文本文件，文件不存在时返回空字符串。
   #>
@@ -39,8 +39,116 @@ function Get-TextFileContent {
     return ""
   }
 
-  return Get-Content -LiteralPath $Path -Raw -Encoding UTF8
-}
+  return Get-Content -LiteralPath $Path -Raw -Encoding UTF8
+}
+
+function Get-HarnessStateConfigPath {
+  <#
+    返回 harness 安装状态配置文件路径。
+  #>
+  param([string]$Root)
+
+  return (Join-Path $Root ".codex-harness\state\config.json")
+}
+
+function Get-HarnessPackageRoot {
+  <#
+    读取 thin project 对应的用户级 packageRoot；不存在时返回空字符串。
+  #>
+  param([string]$Root)
+
+  $configPath = Get-HarnessStateConfigPath -Root $Root
+  if (-not (Test-Path -LiteralPath $configPath)) {
+    return ""
+  }
+
+  try {
+    $configDocument = Get-Content -LiteralPath $configPath -Raw | ConvertFrom-Json
+    $packageRoot = [string](Get-ObjectPropertyValue -InputObject $configDocument -Name "packageRoot" -Default "")
+    if ([string]::IsNullOrWhiteSpace($packageRoot)) {
+      return ""
+    }
+
+    return [System.IO.Path]::GetFullPath($packageRoot)
+  }
+  catch {
+    return ""
+  }
+}
+
+function Resolve-HarnessProjectOrPackagePath {
+  <#
+    优先解析项目内路径；若 thin project 未安装该文档，则回退到 packageRoot。
+  #>
+  param(
+    [string]$Root,
+    [string]$RelativePath
+  )
+
+  if ([string]::IsNullOrWhiteSpace($RelativePath)) {
+    return $null
+  }
+
+  if ([System.IO.Path]::IsPathRooted($RelativePath)) {
+    return $RelativePath
+  }
+
+  $normalizedRelativePath = $RelativePath.Replace("/", "\")
+  $projectPath = Join-Path $Root $normalizedRelativePath
+  if (Test-Path -LiteralPath $projectPath) {
+    return $projectPath
+  }
+
+  $packageRoot = Get-HarnessPackageRoot -Root $Root
+  if (-not [string]::IsNullOrWhiteSpace($packageRoot)) {
+    $packagePath = Join-Path $packageRoot $normalizedRelativePath
+    if (Test-Path -LiteralPath $packagePath) {
+      return $packagePath
+    }
+  }
+
+  return $projectPath
+}
+
+function Get-HarnessDisplayReference {
+  <#
+    返回给 prompt / reviewer 显示的引用路径；项目内不存在时显示 package 绝对路径。
+  #>
+  param(
+    [string]$Root,
+    [string]$RelativePath
+  )
+
+  $resolvedPath = Resolve-HarnessProjectOrPackagePath -Root $Root -RelativePath $RelativePath
+  if ([string]::IsNullOrWhiteSpace($resolvedPath)) {
+    return $RelativePath
+  }
+
+  $projectRootFull = ([System.IO.Path]::GetFullPath($Root)).TrimEnd('\', '/') + '\'
+  $resolvedFull = [System.IO.Path]::GetFullPath($resolvedPath)
+  if ($resolvedFull.StartsWith($projectRootFull, [System.StringComparison]::OrdinalIgnoreCase)) {
+    return $RelativePath.Replace("/", "\")
+  }
+
+  return $resolvedFull
+}
+
+function ConvertTo-HarnessDisplayReferences {
+  <#
+    批量解析给 prompt 展示的 truth source / context source 路径。
+  #>
+  param(
+    [string]$Root,
+    [string[]]$RelativePaths
+  )
+
+  $references = @()
+  foreach ($relativePath in @(ConvertTo-StringArray -Value $RelativePaths)) {
+    $references += Get-HarnessDisplayReference -Root $Root -RelativePath $relativePath
+  }
+
+  return @(ConvertTo-UniqueStringArray -Items $references)
+}
 
 function Show-LogTail {
   <#
@@ -127,7 +235,7 @@ function Get-ObjectPropertyValue {
   return $property.Value
 }
 
-function ConvertTo-StringArray {
+function ConvertTo-StringArray {
   <#
     归一化为字符串数组。
   #>
@@ -161,8 +269,46 @@ function ConvertTo-StringArray {
     return $result
   }
 
-  return @([string]$Value)
-}
+  return @([string]$Value)
+}
+
+function Resolve-CodexStartProcessPath {
+  <#
+    在 Windows 下把 codex 命令解析成适合 Start-Process 的可执行文件。
+    避免直接把 npm 生成的 codex.ps1 传给 Start-Process。
+  #>
+  param([string]$Command)
+
+  if ([string]::IsNullOrWhiteSpace($Command)) {
+    throw "CodexCommand 不能为空。"
+  }
+
+  $resolvedCommand = $null
+  try {
+    $resolvedCommand = Get-Command $Command -ErrorAction Stop | Select-Object -First 1
+  }
+  catch {
+    return $Command
+  }
+
+  $resolvedPath = [string]$resolvedCommand.Path
+  if ([string]::IsNullOrWhiteSpace($resolvedPath)) {
+    return $Command
+  }
+
+  if (-not $resolvedPath.EndsWith(".ps1", [System.StringComparison]::OrdinalIgnoreCase)) {
+    return $resolvedPath
+  }
+
+  $basePath = ([System.IO.Path]::ChangeExtension($resolvedPath, $null)).TrimEnd('.')
+  foreach ($candidate in @("$basePath.cmd", "$basePath.exe")) {
+    if (Test-Path -LiteralPath $candidate -PathType Leaf) {
+      return $candidate
+    }
+  }
+
+  return $resolvedPath
+}
 
 function Normalize-GitRelativePath {
   <#
@@ -419,18 +565,18 @@ function Get-TaskDefinitionDefaults {
       $defaultGateProfile = "spec_required"
       $defaultTruthSources = @("product", "testing")
     }
-    "feature_plan" {
-      $defaultGateProfile = "spec_required"
-      $defaultTruthSources = @("product", "design", "testing", "repo_context")
-    }
-    "feature_impl" {
-      $defaultGateProfile = "spec_required"
-      $defaultTruthSources = @("product", "design", "plan", "testing", "repo_context")
-    }
-    "release" {
-      $defaultGateProfile = "release_required"
-      $defaultTruthSources = @("product", "design", "plan", "testing", "repo_context")
-    }
+    "feature_plan" {
+      $defaultGateProfile = "spec_required"
+      $defaultTruthSources = @("product", "design", "testing", "repo_context")
+    }
+    "feature_impl" {
+      $defaultGateProfile = "spec_required"
+      $defaultTruthSources = @("product", "design", "plan", "testing", "repo_context")
+    }
+    "release" {
+      $defaultGateProfile = "release_required"
+      $defaultTruthSources = @("product", "design", "plan", "testing", "repo_context")
+    }
     "archive" {
       $defaultGateProfile = "lightweight"
       $defaultTruthSources = @("knowledge")
@@ -467,7 +613,7 @@ function Get-TaskDefinitionDefaults {
   }
 }
 
-function Get-DefaultRunProfile {
+function Get-DefaultRunProfile {
   <#
     返回默认 task 会话与子代理策略。
   #>
@@ -595,7 +741,7 @@ function Resolve-RunProfilePath {
   return Join-Path $Root $candidate
 }
 
-function Get-TaskExecutionPolicy {
+function Get-TaskExecutionPolicy {
   <#
     组合默认 profile、runtime 默认项和 task 覆盖项。
   #>
@@ -614,21 +760,24 @@ function Get-TaskExecutionPolicy {
   }
 
   $runtime = Get-ObjectPropertyValue -InputObject $TaskDocument -Name "runtime"
-  $runtimeSession = Get-ObjectPropertyValue -InputObject $runtime -Name "session"
-  $runtimeSubagents = Get-ObjectPropertyValue -InputObject $runtime -Name "subagents"
-  $runtimeGit = Get-ObjectPropertyValue -InputObject $runtime -Name "git"
-  $runtimeCodex = Get-ObjectPropertyValue -InputObject $runtime -Name "codex"
+  $runtimeSession = Get-ObjectPropertyValue -InputObject $runtime -Name "session"
+  $runtimeSubagents = Get-ObjectPropertyValue -InputObject $runtime -Name "subagents"
+  $runtimeGit = Get-ObjectPropertyValue -InputObject $runtime -Name "git"
+  $runtimeCodex = Get-ObjectPropertyValue -InputObject $runtime -Name "codex"
+  $runtimeContentGates = Get-ObjectPropertyValue -InputObject $runtime -Name "content_gates"
 
   $taskExecution = Get-ObjectPropertyValue -InputObject $Task -Name "execution"
-  $taskSession = Get-ObjectPropertyValue -InputObject $taskExecution -Name "session"
-  $taskSubagents = Get-ObjectPropertyValue -InputObject $taskExecution -Name "subagents"
-  $taskGit = Get-ObjectPropertyValue -InputObject $taskExecution -Name "git"
-  $taskCodex = Get-ObjectPropertyValue -InputObject $taskExecution -Name "codex"
-
-  $session = Merge-PolicySection -BaseSection $defaultProfile.session -OverrideSection (Get-ObjectPropertyValue -InputObject $profileOverrides -Name "session")
-  $session = Merge-PolicySection -BaseSection $session -OverrideSection $runtimeSession
-  $session = Merge-PolicySection -BaseSection $session -OverrideSection $taskSession
-  $session.context_sources = ConvertTo-StringArray -Value (Get-ObjectPropertyValue -InputObject $session -Name "context_sources")
+  $taskSession = Get-ObjectPropertyValue -InputObject $taskExecution -Name "session"
+  $taskSubagents = Get-ObjectPropertyValue -InputObject $taskExecution -Name "subagents"
+  $taskGit = Get-ObjectPropertyValue -InputObject $taskExecution -Name "git"
+  $taskCodex = Get-ObjectPropertyValue -InputObject $taskExecution -Name "codex"
+  $taskContentGates = Get-ObjectPropertyValue -InputObject $taskExecution -Name "content_gates"
+
+  $session = Merge-PolicySection -BaseSection $defaultProfile.session -OverrideSection (Get-ObjectPropertyValue -InputObject $profileOverrides -Name "session")
+  $session = Merge-PolicySection -BaseSection $session -OverrideSection $runtimeSession
+  $session = Merge-PolicySection -BaseSection $session -OverrideSection $taskSession
+  $session.context_sources = ConvertTo-StringArray -Value (Get-ObjectPropertyValue -InputObject $session -Name "context_sources")
+  $session.context_source_references = ConvertTo-HarnessDisplayReferences -Root $Root -RelativePaths $session.context_sources
 
   $subagents = Merge-PolicySection -BaseSection $defaultProfile.subagents -OverrideSection (Get-ObjectPropertyValue -InputObject $profileOverrides -Name "subagents")
   $subagents = Merge-PolicySection -BaseSection $subagents -OverrideSection $runtimeSubagents
@@ -641,9 +790,36 @@ function Get-TaskExecutionPolicy {
   $gitPolicy = Merge-PolicySection -BaseSection $gitPolicy -OverrideSection $taskGit
   $gitPolicy.non_blocking_dirty_paths = ConvertTo-StringArray -Value (Get-ObjectPropertyValue -InputObject $gitPolicy -Name "non_blocking_dirty_paths")
 
-  $codexPolicy = Merge-PolicySection -BaseSection $defaultProfile.codex -OverrideSection (Get-ObjectPropertyValue -InputObject $profileOverrides -Name "codex")
-  $codexPolicy = Merge-PolicySection -BaseSection $codexPolicy -OverrideSection $runtimeCodex
-  $codexPolicy = Merge-PolicySection -BaseSection $codexPolicy -OverrideSection $taskCodex
+  $codexPolicy = Merge-PolicySection -BaseSection $defaultProfile.codex -OverrideSection (Get-ObjectPropertyValue -InputObject $profileOverrides -Name "codex")
+  $codexPolicy = Merge-PolicySection -BaseSection $codexPolicy -OverrideSection $runtimeCodex
+  $codexPolicy = Merge-PolicySection -BaseSection $codexPolicy -OverrideSection $taskCodex
+
+  $contentGateDefaults = Get-DefaultContentGateSettings
+  $contentGates = Merge-PolicySection -BaseSection $contentGateDefaults -OverrideSection $runtimeContentGates
+  $contentGates = Merge-PolicySection -BaseSection $contentGates -OverrideSection $taskContentGates
+  $runtimeContentGateMode = [string](Get-ObjectPropertyValue -InputObject $runtimeContentGates -Name "mode" -Default "")
+  if ([string]::IsNullOrWhiteSpace($runtimeContentGateMode)) {
+    $runtimeContentGateMode = [string](Get-ObjectPropertyValue -InputObject $runtimeContentGates -Name "default_mode" -Default "")
+  }
+  if (-not [string]::IsNullOrWhiteSpace($runtimeContentGateMode)) {
+    $contentGates.mode = $runtimeContentGateMode
+  }
+  $taskContentGateMode = [string](Get-ObjectPropertyValue -InputObject $Task -Name "content_gate_mode" -Default "")
+  if (-not [string]::IsNullOrWhiteSpace($taskContentGateMode)) {
+    $contentGates.mode = $taskContentGateMode
+  }
+
+  $taskRiskTags = ConvertTo-LowerUniqueStringArray -Value (Get-ObjectPropertyValue -InputObject $Task -Name "risk_tags")
+  $contentGates.mode = Normalize-ContentGateMode -Mode ([string](Get-ObjectPropertyValue -InputObject $contentGates -Name "mode" -Default "core"))
+  $contentGates.risk_tags = ConvertTo-LowerUniqueStringArray -Value @(
+    (Get-ObjectPropertyValue -InputObject $contentGates -Name "risk_tags"),
+    $taskRiskTags
+  )
+
+  $changeKind = [string](Get-ObjectPropertyValue -InputObject $Task -Name "change_kind" -Default "")
+  if ($changeKind.Trim().ToLowerInvariant() -eq "refactor" -and $contentGates.risk_tags -notcontains "refactor") {
+    $contentGates.risk_tags = @($contentGates.risk_tags + @("refactor"))
+  }
 
   $contextFiles = ConvertTo-StringArray -Value (Get-ObjectPropertyValue -InputObject $Task -Name "context_files")
   $taskDefaults = Get-TaskDefinitionDefaults -Task $Task
@@ -651,10 +827,11 @@ function Get-TaskExecutionPolicy {
   return [PSCustomObject]@{
     run_profile_path = $resolvedProfilePath
     session = $session
-    subagents = $subagents
-    git = $gitPolicy
-    codex = $codexPolicy
-    context_files = $contextFiles
+    subagents = $subagents
+    git = $gitPolicy
+    codex = $codexPolicy
+    content_gates = $contentGates
+    context_files = $contextFiles
     task_kind = $taskDefaults.task_kind
     gate_profile = $taskDefaults.gate_profile
     required_truth_sources = $taskDefaults.required_truth_sources
@@ -865,20 +1042,20 @@ function Assert-CleanGitWorkspace {
   }
 }
 
-function Invoke-RuntimeDoctor {
+function Invoke-RuntimeDoctor {
   <#
     在任务执行前检查 runtime 入口、.codex 配置和 harness 深文档是否完整。
   #>
   param([string]$Root)
 
-  $doctorPath = Join-Path $Root "tools\\harness/doctor.ps1"
+  $doctorPath = Join-Path $Root "tools\harness\doctor.ps1"
   if (-not (Test-Path -LiteralPath $doctorPath)) {
     throw "找不到 runtime doctor: $doctorPath"
   }
 
   Push-Location $Root
   try {
-    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\\harness/doctor.ps1 2>&1
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\doctor.ps1 2>&1
     $exitCode = $LASTEXITCODE
     return [PSCustomObject]@{
       ExitCode = $exitCode
@@ -922,7 +1099,7 @@ function New-ImplementationPrompt {
   $steps = ($Task.steps | ForEach-Object { "- $_" }) -join "`n"
   $acceptance = ($Task.acceptance | ForEach-Object { "- $_" }) -join "`n"
   $dependencies = @(ConvertTo-StringArray -Value (Get-ObjectPropertyValue -InputObject $Task -Name "dependencies"))
-  $contextSourcesText = ConvertTo-BulletLines -Items $ExecutionPolicy.session.context_sources
+  $contextSourcesText = ConvertTo-BulletLines -Items $ExecutionPolicy.session.context_source_references
   $contextFilesText = ConvertTo-BulletLines -Items $ExecutionPolicy.context_files -EmptyText "- 无显式任务文件列表；仅按需读取与当前任务直接相关的文件"
   $allowedRoles = @(ConvertTo-StringArray -Value $ExecutionPolicy.subagents.allowed_roles)
   $allowedRolesText = if ($allowedRoles.Count -eq 0) { "none" } else { $allowedRoles -join ", " }
@@ -1005,7 +1182,7 @@ $($Task.test_command)
 "@
 }
 
-function Get-ExistingRelativePaths {
+function Get-ExistingRelativePaths {
   <#
     返回工作区内实际存在的相对路径列表。
   #>
@@ -1020,16 +1197,16 @@ function Get-ExistingRelativePaths {
       continue
     }
 
-    $fullPath = Join-Path $Root $relativePath
-    if (Test-Path -LiteralPath $fullPath) {
-      $existing += $relativePath
-    }
-  }
+    $fullPath = Resolve-HarnessProjectOrPackagePath -Root $Root -RelativePath $relativePath
+    if (Test-Path -LiteralPath $fullPath) {
+      $existing += Get-HarnessDisplayReference -Root $Root -RelativePath $relativePath
+    }
+  }
 
   return $existing
 }
 
-function Get-FirstExistingRelativePath {
+function Get-FirstExistingRelativePath {
   <#
     返回候选路径中第一个实际存在的相对路径。
   #>
@@ -1038,12 +1215,12 @@ function Get-FirstExistingRelativePath {
     [string[]]$Candidates
   )
 
-  foreach ($candidate in @(ConvertTo-StringArray -Value $Candidates)) {
-    $fullPath = Join-Path $Root $candidate
-    if (Test-Path -LiteralPath $fullPath) {
-      return $candidate
-    }
-  }
+  foreach ($candidate in @(ConvertTo-StringArray -Value $Candidates)) {
+    $fullPath = Resolve-HarnessProjectOrPackagePath -Root $Root -RelativePath $candidate
+    if (Test-Path -LiteralPath $fullPath) {
+      return (Get-HarnessDisplayReference -Root $Root -RelativePath $candidate)
+    }
+  }
 
   return $null
 }
@@ -1545,7 +1722,7 @@ $($TestResult.Output)
 "@
 }
 
-function Invoke-CodexTask {
+function Invoke-CodexTask {
   <#
     调用 codex exec 运行单任务。
     原始输出写入日志文件，终端只显示 driver 摘要。
@@ -1593,15 +1770,17 @@ function Invoke-CodexTask {
     $Root,
     "-"
   )
-  if ($CaptureJsonEvents) {
-    $arguments += "--json"
-  }
-
-  $process = Start-Process `
-    -FilePath $Command `
-    -ArgumentList $arguments `
-    -WorkingDirectory $Root `
-    -RedirectStandardInput $promptPath `
+  if ($CaptureJsonEvents) {
+    $arguments += "--json"
+  }
+
+  $resolvedCommand = Resolve-CodexStartProcessPath -Command $Command
+
+  $process = Start-Process `
+    -FilePath $resolvedCommand `
+    -ArgumentList $arguments `
+    -WorkingDirectory $Root `
+    -RedirectStandardInput $promptPath `
     -RedirectStandardOutput $stdoutPath `
     -RedirectStandardError $stderrPath `
     -NoNewWindow `
@@ -1724,7 +1903,7 @@ function Add-TraceDurableFields {
   return $Trace
 }
 
-function Invoke-TestCommand {
+function Invoke-TestCommand {
   <#
     执行任务指定的验证命令，并在需要时持久化测试输出。
   #>
@@ -1764,117 +1943,773 @@ function Invoke-TestCommand {
   finally {
     Pop-Location
   }
-}
-
-function Invoke-FailureTriage {
-  <#
-    在测试失败后运行只读失败归因链路，输出结构化 triage 结果。
-  #>
-  param(
-    [object]$Task,
-    [string]$Root,
-    [object]$ExecutionPolicy,
-    [object]$ReviewContext,
-    [object]$CodexResult,
-    [object]$Stage1Result,
-    [object]$TestResult,
-    [string]$CodexCommand,
-    [string]$LogDirectory,
-    [switch]$CaptureJsonEvents
-  )
-
-  $template = Get-PromptTemplate -Root $Root -TemplateName "failure-triage.md"
-  $requirementIdsText = ConvertTo-BulletLines -Items (ConvertTo-StringArray -Value (Get-ObjectPropertyValue -InputObject $Task -Name "requirement_ids")) -EmptyText "- 未显式声明 Requirement IDs"
-  $acceptanceText = ConvertTo-BulletLines -Items (ConvertTo-StringArray -Value $Task.acceptance)
-  $contextFilesText = ConvertTo-BulletLines -Items $ReviewContext.task_context
-  $testingText = ConvertTo-BulletLines -Items $ReviewContext.testing
-  $truthSourceStateText = Convert-TruthSourceStateToBulletLines -States $ReviewContext.truth_source_state
-  $triageOutputPath = Join-Path $LogDirectory "$($Task.id)-failure-triage.json"
-  $testOutputPathText = if ([string]::IsNullOrWhiteSpace($TestResult.OutputLog)) { "- 无测试日志文件" } else { "- $($TestResult.OutputLog)" }
-
-  $prompt = @"
-$template
-
-## Driver Context
-
-- Task ID: $($Task.id)
-- 描述: $($Task.description)
-- Requirement IDs:
-$requirementIdsText
-- 验收标准:
-$acceptanceText
-- 失败来源: test
-- 测试命令: $($Task.test_command)
-- 测试退出码: $($TestResult.ExitCode)
-
-### Task Context Files
-$contextFilesText
-
-### Testing Truth Sources
-$testingText
-
-### Truth Source Completeness
-$truthSourceStateText
-
-### Evidence Files
-- 实现 stdout: $($CodexResult.StdoutLog)
-- 实现 stderr: $($CodexResult.StderrLog)
-- Stage 1 stdout: $($Stage1Result.StdoutLog)
-- Stage 1 stderr: $($Stage1Result.StderrLog)
-$testOutputPathText
-
-### Raw Test Output
-```text
-$($TestResult.Output)
-```
-
-输出要求:
-- 只输出一个合法 JSON 对象。
-- 必须包含 findings 数组；没有 finding 也要输出空数组。
-- 优先把失败归类为 `TEST_CODE_ISSUE`、`PRODUCT_BUG`、`REQUIREMENT_CHANGE`、`ENV_OR_DATA_ISSUE` 或 `FLAKY`。
-"@
-
-  $triageResult = Invoke-CodexTask `
-    -Prompt $prompt `
-    -Root $Root `
-    -Command $CodexCommand `
-    -LogDirectory $LogDirectory `
-    -TaskId "$($Task.id)-failure-triage" `
-    -Sandbox $ExecutionPolicy.codex.review_sandbox `
-    -ActivityLabel "Failure Triage" `
-    -DisableHooks $ExecutionPolicy.codex.disable_hooks `
-    -CaptureJsonEvents:$CaptureJsonEvents
-
-  $triageJson = $triageResult.Output
-  if ([string]::IsNullOrWhiteSpace($triageJson)) {
-    $triageJson = $triageResult.LastMessage
-  }
-
-  $reportPath = $null
-  $parseError = $null
-  if (-not [string]::IsNullOrWhiteSpace($triageJson)) {
-    try {
-      $triageObject = $triageJson | ConvertFrom-Json -ErrorAction Stop
-      $triageObject | ConvertTo-Json -Depth 12 | Set-Content -LiteralPath $triageOutputPath -Encoding UTF8
-      $reportPath = $triageOutputPath
-    }
-    catch {
-      $parseError = $_.Exception.Message
-    }
-  }
-
-  return [PSCustomObject]@{
-    ExitCode = $triageResult.ExitCode
-    Output = $triageResult.Output
-    LastMessage = $triageResult.LastMessage
-    StdoutLog = $triageResult.StdoutLog
-    StderrLog = $triageResult.StderrLog
-    PromptLog = $triageResult.PromptLog
-    LastMessageLog = $triageResult.LastMessageLog
-    ReportPath = $reportPath
-    ParseError = $parseError
-  }
-}
+}
+
+function Invoke-SpecLintPrecheck {
+  <#
+    对需要 spec 真相源的任务执行内容级门禁，避免 TBD 规格直接进入实现闭环。
+  #>
+  param([string]$Root)
+
+  $specLintPath = Join-Path $Root "tools\harness\spec-lint.ps1"
+  if (-not (Test-Path -LiteralPath $specLintPath)) {
+    throw "找不到 spec lint: $specLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\spec-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Test-ContentGateModeEnabled {
+  <#
+    core < recommended < full
+  #>
+  param(
+    [object]$ExecutionPolicy,
+    [string]$MinimumMode
+  )
+
+  $order = @{
+    core = 1
+    recommended = 2
+    full = 3
+  }
+
+  $currentMode = Normalize-ContentGateMode -Mode ([string](Get-ObjectPropertyValue -InputObject $ExecutionPolicy.content_gates -Name "mode" -Default "core"))
+  $requiredMode = Normalize-ContentGateMode -Mode $MinimumMode
+  return $order[$currentMode] -ge $order[$requiredMode]
+}
+
+function Test-TaskHasRiskTag {
+  param(
+    [object]$ExecutionPolicy,
+    [string[]]$Tags
+  )
+
+  $riskTags = ConvertTo-LowerUniqueStringArray -Value (Get-ObjectPropertyValue -InputObject $ExecutionPolicy.content_gates -Name "risk_tags")
+  foreach ($tag in @(ConvertTo-LowerUniqueStringArray -Value $Tags)) {
+    if ($riskTags -contains $tag) {
+      return $true
+    }
+  }
+
+  return $false
+}
+
+function Get-DefaultContentGateSettings {
+  <#
+    默认只启用 core 档位，避免新项目冷启动时被大量非关键门禁阻塞。
+  #>
+  return [PSCustomObject]@{
+    mode = "core"
+    risk_tags = @()
+  }
+}
+
+function Normalize-ContentGateMode {
+  param([string]$Mode)
+
+  $value = if ([string]::IsNullOrWhiteSpace($Mode)) { "core" } else { $Mode.Trim().ToLowerInvariant() }
+  if (@("core", "recommended", "full") -notcontains $value) {
+    return "core"
+  }
+
+  return $value
+}
+
+function ConvertTo-LowerUniqueStringArray {
+  param([object]$Value)
+
+  $result = @()
+  foreach ($item in @(ConvertTo-StringArray -Value $Value)) {
+    $normalized = $item.Trim().ToLowerInvariant()
+    if (-not [string]::IsNullOrWhiteSpace($normalized) -and $result -notcontains $normalized) {
+      $result += $normalized
+    }
+  }
+
+  return $result
+}
+
+function Invoke-ContextLintPrecheck {
+  <#
+    对需要上下文导航的任务执行内容级门禁，避免在缺少项目导航索引时直接实现。
+  #>
+  param([string]$Root)
+
+  $contextLintPath = Join-Path $Root "tools\harness\context-lint.ps1"
+  if (-not (Test-Path -LiteralPath $contextLintPath)) {
+    throw "找不到 context lint: $contextLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\context-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-ArchitectureLintPrecheck {
+  <#
+    对需要架构门禁的任务执行轻量架构模板检查，避免缺少分层/复用/边界约束就进入实现。
+  #>
+  param([string]$Root)
+
+  $architectureLintPath = Join-Path $Root "tools\harness\architecture-lint.ps1"
+  if (-not (Test-Path -LiteralPath $architectureLintPath)) {
+    throw "找不到 architecture lint: $architectureLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\architecture-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-DirectoryLintPrecheck {
+  <#
+    对需要目录结构规则的任务执行轻量目录模板检查，避免在缺少目录规范时直接实现。
+  #>
+  param([string]$Root)
+
+  $directoryLintPath = Join-Path $Root "tools\harness\directory-lint.ps1"
+  if (-not (Test-Path -LiteralPath $directoryLintPath)) {
+    throw "找不到 directory lint: $directoryLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\directory-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-StyleLintPrecheck {
+  <#
+    对需要代码风格与命名规则的任务执行轻量模板检查，避免缺少业务词典和命名边界时直接实现。
+  #>
+  param([string]$Root)
+
+  $styleLintPath = Join-Path $Root "tools\harness\style-lint.ps1"
+  if (-not (Test-Path -LiteralPath $styleLintPath)) {
+    throw "找不到 style lint: $styleLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\style-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-ComponentLintPrecheck {
+  <#
+    对需要公共组件复用规则的任务执行轻量模板检查，避免没盘点组件和兼容影响就直接实现。
+  #>
+  param([string]$Root)
+
+  $componentLintPath = Join-Path $Root "tools\harness\component-lint.ps1"
+  if (-not (Test-Path -LiteralPath $componentLintPath)) {
+    throw "找不到 component lint: $componentLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\component-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-BusinessLintPrecheck {
+  <#
+    对需要业务规则一致性的任务执行轻量模板检查，避免缺少业务规则、边界状态和异常路径约束就直接实现。
+  #>
+  param([string]$Root)
+
+  $businessLintPath = Join-Path $Root "tools\harness\business-lint.ps1"
+  if (-not (Test-Path -LiteralPath $businessLintPath)) {
+    throw "找不到 business lint: $businessLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\business-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-ContractLintPrecheck {
+  <#
+    对需要接口与数据结构约束的任务执行轻量模板检查，避免缺少请求入口、响应包装和契约追溯时直接实现。
+  #>
+  param([string]$Root)
+
+  $contractLintPath = Join-Path $Root "tools\harness\contract-lint.ps1"
+  if (-not (Test-Path -LiteralPath $contractLintPath)) {
+    throw "找不到 contract lint: $contractLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\contract-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-StateLintPrecheck {
+  <#
+    对需要状态管理一致性的任务执行轻量模板检查，避免缺少状态分层、唯一来源和缓存失效规则时直接实现。
+  #>
+  param([string]$Root)
+
+  $stateLintPath = Join-Path $Root "tools\harness\state-lint.ps1"
+  if (-not (Test-Path -LiteralPath $stateLintPath)) {
+    throw "找不到 state lint: $stateLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\state-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-UiLintPrecheck {
+  <#
+    对需要前端 UI 与交互质量约束的任务执行轻量模板检查，避免缺少设计系统、移动端和表单体验规则时直接实现。
+  #>
+  param([string]$Root)
+
+  $uiLintPath = Join-Path $Root "tools\harness\ui-lint.ps1"
+  if (-not (Test-Path -LiteralPath $uiLintPath)) {
+    throw "找不到 ui lint: $uiLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\ui-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-BackendLintPrecheck {
+  <#
+    对需要后端服务分层质量约束的任务执行轻量模板检查，避免缺少 Controller/Service/Repository、事务和异常策略时直接实现。
+  #>
+  param([string]$Root)
+
+  $backendLintPath = Join-Path $Root "tools\harness\backend-lint.ps1"
+  if (-not (Test-Path -LiteralPath $backendLintPath)) {
+    throw "找不到 backend lint: $backendLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\backend-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-SecurityLintPrecheck {
+  <#
+    对需要安全设计约束的任务执行轻量模板检查，避免缺少权限、输入校验、脱敏和风控策略时直接实现。
+  #>
+  param([string]$Root)
+
+  $securityLintPath = Join-Path $Root "tools\harness\security-lint.ps1"
+  if (-not (Test-Path -LiteralPath $securityLintPath)) {
+    throw "找不到 security lint: $securityLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\security-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-TestingLintPrecheck {
+  <#
+    对需要测试左移和验证完整性的任务执行轻量模板检查，避免缺少测试真相源时直接实现。
+  #>
+  param([string]$Root)
+
+  $testingLintPath = Join-Path $Root "tools\harness\testing-lint.ps1"
+  if (-not (Test-Path -LiteralPath $testingLintPath)) {
+    throw "找不到 testing lint: $testingLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\testing-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-ImpactLintPrecheck {
+  <#
+    对需要影响面分析的任务执行轻量模板检查，避免缺少调用链、受影响对象和回归范围时直接实现。
+  #>
+  param([string]$Root)
+
+  $impactLintPath = Join-Path $Root "tools\harness\impact-lint.ps1"
+  if (-not (Test-Path -LiteralPath $impactLintPath)) {
+    throw "找不到 impact lint: $impactLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\impact-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-PerformanceLintPrecheck {
+  <#
+    对需要性能预算与性能风险约束的任务执行轻量模板检查，避免缺少性能预算时直接实现。
+  #>
+  param([string]$Root)
+
+  $performanceLintPath = Join-Path $Root "tools\harness\performance-lint.ps1"
+  if (-not (Test-Path -LiteralPath $performanceLintPath)) {
+    throw "找不到 performance lint: $performanceLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\performance-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-ConfigLintPrecheck {
+  <#
+    对需要配置与环境约束的任务执行轻量模板检查，避免缺少环境变量、构建和部署说明时直接实现。
+  #>
+  param([string]$Root)
+
+  $configLintPath = Join-Path $Root "tools\harness\config-lint.ps1"
+  if (-not (Test-Path -LiteralPath $configLintPath)) {
+    throw "找不到 config lint: $configLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\config-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-ObservabilityLintPrecheck {
+  <#
+    对需要日志与可观测性约束的任务执行轻量模板检查，避免缺少日志字段、审计和告警说明时直接实现。
+  #>
+  param([string]$Root)
+
+  $observabilityLintPath = Join-Path $Root "tools\harness\observability-lint.ps1"
+  if (-not (Test-Path -LiteralPath $observabilityLintPath)) {
+    throw "找不到 observability lint: $observabilityLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\observability-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-RefactorLintPrecheck {
+  <#
+    对需要重构与维护约束的任务执行轻量模板检查，避免缺少任务类型、行为不变约束和死代码清理范围时直接实现。
+  #>
+  param([string]$Root)
+
+  $refactorLintPath = Join-Path $Root "tools\harness\refactor-lint.ps1"
+  if (-not (Test-Path -LiteralPath $refactorLintPath)) {
+    throw "找不到 refactor lint: $refactorLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\refactor-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-SessionLintPrecheck {
+  <#
+    对需要多轮协作与交接约束的任务执行轻量模板检查，避免缺少会话交接字段和同文件隔离规则时直接实现。
+  #>
+  param([string]$Root)
+
+  $sessionLintPath = Join-Path $Root "tools\harness\session-lint.ps1"
+  if (-not (Test-Path -LiteralPath $sessionLintPath)) {
+    throw "找不到 session lint: $sessionLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\session-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{
+      ExitCode = $exitCode
+      Output = ($output -join "`n")
+    }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-DocsLintPrecheck {
+  <#
+    对需要文档与规范约束的任务执行轻量模板检查，避免核心文档集和文档更新字段缺失时直接实现。
+  #>
+  param([string]$Root)
+
+  $docsLintPath = Join-Path $Root "tools\harness\docs-lint.ps1"
+  if (-not (Test-Path -LiteralPath $docsLintPath)) {
+    throw "找不到 docs lint: $docsLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\docs-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{ ExitCode = $exitCode; Output = ($output -join "`n") }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-DataLintPrecheck {
+  <#
+    对需要数据库与迁移约束的任务执行轻量模板检查，避免缺少 migration、历史数据和回滚口径时直接实现。
+  #>
+  param([string]$Root)
+
+  $dataLintPath = Join-Path $Root "tools\harness\data-lint.ps1"
+  if (-not (Test-Path -LiteralPath $dataLintPath)) {
+    throw "找不到 data lint: $dataLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\data-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{ ExitCode = $exitCode; Output = ($output -join "`n") }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-IntegrationLintPrecheck {
+  <#
+    对需要第三方服务集成约束的任务执行轻量模板检查，避免缺少回调、凭据和失败策略时直接实现。
+  #>
+  param([string]$Root)
+
+  $integrationLintPath = Join-Path $Root "tools\harness\integration-lint.ps1"
+  if (-not (Test-Path -LiteralPath $integrationLintPath)) {
+    throw "找不到 integration lint: $integrationLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\integration-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{ ExitCode = $exitCode; Output = ($output -join "`n") }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-MobileLintPrecheck {
+  <#
+    对需要移动端专项约束的任务执行轻量模板检查，避免缺少平台差异、权限和生命周期口径时直接实现。
+  #>
+  param([string]$Root)
+
+  $mobileLintPath = Join-Path $Root "tools\harness\mobile-lint.ps1"
+  if (-not (Test-Path -LiteralPath $mobileLintPath)) {
+    throw "找不到 mobile lint: $mobileLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\mobile-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{ ExitCode = $exitCode; Output = ($output -join "`n") }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-AcceptanceLintPrecheck {
+  <#
+    对需要交付验收报告约束的任务执行轻量模板检查，避免缺少需求对照和回滚信息时直接实现。
+  #>
+  param([string]$Root)
+
+  $acceptanceLintPath = Join-Path $Root "tools\harness\acceptance-lint.ps1"
+  if (-not (Test-Path -LiteralPath $acceptanceLintPath)) {
+    throw "找不到 acceptance lint: $acceptanceLintPath"
+  }
+
+  Push-Location $Root
+  try {
+    $output = powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\harness\acceptance-lint.ps1 -ProjectRoot . 2>&1
+    $exitCode = $LASTEXITCODE
+    return [PSCustomObject]@{ ExitCode = $exitCode; Output = ($output -join "`n") }
+  }
+  finally {
+    Pop-Location
+  }
+}
+
+function Invoke-FailureTriage {
+  <#
+    在测试失败后运行只读失败归因链路，输出结构化 triage 结果。
+  #>
+  param(
+    [object]$Task,
+    [string]$Root,
+    [object]$ExecutionPolicy,
+    [object]$ReviewContext,
+    [object]$CodexResult,
+    [object]$Stage1Result,
+    [object]$TestResult,
+    [string]$CodexCommand,
+    [string]$LogDirectory,
+    [switch]$CaptureJsonEvents
+  )
+
+  $template = Get-PromptTemplate -Root $Root -TemplateName "failure-triage.md"
+  $requirementIdsText = ConvertTo-BulletLines -Items (ConvertTo-StringArray -Value (Get-ObjectPropertyValue -InputObject $Task -Name "requirement_ids")) -EmptyText "- 未显式声明 Requirement IDs"
+  $acceptanceText = ConvertTo-BulletLines -Items (ConvertTo-StringArray -Value $Task.acceptance)
+  $contextFilesText = ConvertTo-BulletLines -Items $ReviewContext.task_context
+  $testingText = ConvertTo-BulletLines -Items $ReviewContext.testing
+  $truthSourceStateText = Convert-TruthSourceStateToBulletLines -States $ReviewContext.truth_source_state
+  $triageOutputPath = Join-Path $LogDirectory "$($Task.id)-failure-triage.json"
+  $testOutputPathText = if ([string]::IsNullOrWhiteSpace($TestResult.OutputLog)) { "- 无测试日志文件" } else { "- $($TestResult.OutputLog)" }
+
+  $prompt = @"
+$template
+
+## Driver Context
+
+- Task ID: $($Task.id)
+- 描述: $($Task.description)
+- Requirement IDs:
+$requirementIdsText
+- 验收标准:
+$acceptanceText
+- 失败来源: test
+- 测试命令: $($Task.test_command)
+- 测试退出码: $($TestResult.ExitCode)
+
+### Task Context Files
+$contextFilesText
+
+### Testing Truth Sources
+$testingText
+
+### Truth Source Completeness
+$truthSourceStateText
+
+### Evidence Files
+- 实现 stdout: $($CodexResult.StdoutLog)
+- 实现 stderr: $($CodexResult.StderrLog)
+- Stage 1 stdout: $($Stage1Result.StdoutLog)
+- Stage 1 stderr: $($Stage1Result.StderrLog)
+$testOutputPathText
+
+### Raw Test Output
+```text
+$($TestResult.Output)
+```
+
+输出要求:
+- 只输出一个合法 JSON 对象。
+- 必须包含 findings 数组；没有 finding 也要输出空数组。
+- 优先把失败归类为 `TEST_CODE_ISSUE`、`PRODUCT_BUG`、`REQUIREMENT_CHANGE`、`ENV_OR_DATA_ISSUE` 或 `FLAKY`。
+"@
+
+  $triageResult = Invoke-CodexTask `
+    -Prompt $prompt `
+    -Root $Root `
+    -Command $CodexCommand `
+    -LogDirectory $LogDirectory `
+    -TaskId "$($Task.id)-failure-triage" `
+    -Sandbox $ExecutionPolicy.codex.review_sandbox `
+    -ActivityLabel "Failure Triage" `
+    -DisableHooks $ExecutionPolicy.codex.disable_hooks `
+    -CaptureJsonEvents:$CaptureJsonEvents
+
+  $triageJson = $triageResult.Output
+  if ([string]::IsNullOrWhiteSpace($triageJson)) {
+    $triageJson = $triageResult.LastMessage
+  }
+
+  $reportPath = $null
+  $parseError = $null
+  if (-not [string]::IsNullOrWhiteSpace($triageJson)) {
+    try {
+      $triageObject = $triageJson | ConvertFrom-Json -ErrorAction Stop
+      $triageObject | ConvertTo-Json -Depth 12 | Set-Content -LiteralPath $triageOutputPath -Encoding UTF8
+      $reportPath = $triageOutputPath
+    }
+    catch {
+      $parseError = $_.Exception.Message
+    }
+  }
+
+  return [PSCustomObject]@{
+    ExitCode = $triageResult.ExitCode
+    Output = $triageResult.Output
+    LastMessage = $triageResult.LastMessage
+    StdoutLog = $triageResult.StdoutLog
+    StderrLog = $triageResult.StderrLog
+    PromptLog = $triageResult.PromptLog
+    LastMessageLog = $triageResult.LastMessageLog
+    ReportPath = $reportPath
+    ParseError = $parseError
+  }
+}
 
 function Write-ProgressEntry {
   <#
@@ -2027,7 +2862,7 @@ function Invoke-OneTask {
   }
 
   $initialReviewContext = Get-ReviewContextPaths -Root $ProjectRoot -ExecutionPolicy $executionPolicy
-  if ($executionPolicy.gate_profile -ne "lightweight" -and $initialReviewContext.missing_truth_sources.Count -gt 0) {
+  if ($executionPolicy.gate_profile -ne "lightweight" -and $initialReviewContext.missing_truth_sources.Count -gt 0) {
     $truthSourceSummary = Convert-TruthSourceStateToBulletLines -States $initialReviewContext.truth_source_state
     $blockedReason = "缺少前置 truth sources: $($initialReviewContext.missing_truth_sources -join ', ')"
     Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，前置 truth source 检查未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$truthSourceSummary" -Stage1Summary "NOT_RUN - truth source precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
@@ -2072,10 +2907,1073 @@ function Invoke-OneTask {
       Status = "blocked"
       TaskId = $task.id
       ExitCode = 2
-    }
-  }
-
-  Write-Step "选择任务: $($task.id) $($task.description)"
+    }
+  }
+
+  $needsSpecLint = @("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile
+  if ($needsSpecLint) {
+    $specLintResult = Invoke-SpecLintPrecheck -Root $ProjectRoot
+    if ($specLintResult.ExitCode -ne 0) {
+      $blockedReason = "spec 内容级门禁未通过，请先补齐需求范围、验收标准、边界与追溯。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，spec 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($specLintResult.Output)" -Stage1Summary "NOT_RUN - spec lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "spec_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "spec lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "spec_lint_precheck"; exit_code = $specLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          spec_lint = $specLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: spec 内容级门禁未通过。"
+      Write-Output $specLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsContextLint = @("research_required", "spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile
+  if ($needsContextLint) {
+    $contextLintResult = Invoke-ContextLintPrecheck -Root $ProjectRoot
+    if ($contextLintResult.ExitCode -eq 1) {
+      $blockedReason = "context 内容级门禁未通过，请先补齐 docs/ai 导航索引与当前任务上下文。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，context 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($contextLintResult.Output)" -Stage1Summary "NOT_RUN - context lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "context_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "context lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "context_lint_precheck"; exit_code = $contextLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          context_lint = $contextLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: context 内容级门禁未通过。"
+      Write-Output $contextLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsSessionLint = @("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile
+  if ($needsSessionLint) {
+    $sessionLintResult = Invoke-SessionLintPrecheck -Root $ProjectRoot
+    if ($sessionLintResult.ExitCode -eq 1) {
+      $blockedReason = "session 内容级门禁未通过，请先补齐 CURRENT_TASK 交接字段和多 Agent 同文件隔离规则。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，session 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($sessionLintResult.Output)" -Stage1Summary "NOT_RUN - session lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "session_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "session lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "session_lint_precheck"; exit_code = $sessionLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          session_lint = $sessionLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: session 内容级门禁未通过。"
+      Write-Output $sessionLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsDocsLint = (Test-ContentGateModeEnabled -ExecutionPolicy $executionPolicy -MinimumMode "recommended") -and (@("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile)
+  if ($needsDocsLint) {
+    $docsLintResult = Invoke-DocsLintPrecheck -Root $ProjectRoot
+    if ($docsLintResult.ExitCode -eq 1) {
+      $blockedReason = "docs 内容级门禁未通过，请先补齐核心文档集、文档分层入口和文档更新字段。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，docs 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($docsLintResult.Output)" -Stage1Summary "NOT_RUN - docs lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{ task_id = $task.id; task_session_id = $taskSessionId; task_kind = $executionPolicy.task_kind; gate_profile = $executionPolicy.gate_profile; required_truth_sources = $executionPolicy.required_truth_sources; agent = "codex"; started_at = $startedAt.ToString("o"); ended_at = (Get-Date).ToString("o"); status = "blocked"; test_command = $task.test_command; failed_stage = "docs_lint_precheck"; stage1_review = [PSCustomObject]@{ verdict = "NOT_RUN"; exit_code = $null; summary = "docs lint precheck 未通过。" }; stage2_review = [PSCustomObject]@{ verdict = "NOT_RUN"; exit_code = $null; summary = "未进入 Stage 2 审查。" }; session_policy = $executionPolicy.session; subagent_policy = $executionPolicy.subagents; context_files = $executionPolicy.context_files; run_profile_path = $executionPolicy.run_profile_path; review_context = $initialReviewContext; commands = @(@{ cmd = "docs_lint_precheck"; exit_code = $docsLintResult.ExitCode }); blocked_reason = $blockedReason; final_message = $blockedReason; logs = @{ docs_lint = $docsLintResult.Output } }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: docs 内容级门禁未通过。"
+      Write-Output $docsLintResult.Output
+      return [PSCustomObject]@{ Status = "blocked"; TaskId = $task.id; ExitCode = 2 }
+    }
+  }
+
+  $needsDataLint = Test-TaskHasRiskTag -ExecutionPolicy $executionPolicy -Tags @("data", "database", "migration")
+  if ($needsDataLint) {
+    $dataLintResult = Invoke-DataLintPrecheck -Root $ProjectRoot
+    if ($dataLintResult.ExitCode -eq 1) {
+      $blockedReason = "data 内容级门禁未通过，请先补齐 migration、历史数据兼容和回滚策略。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，data 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($dataLintResult.Output)" -Stage1Summary "NOT_RUN - data lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{ task_id = $task.id; task_session_id = $taskSessionId; task_kind = $executionPolicy.task_kind; gate_profile = $executionPolicy.gate_profile; required_truth_sources = $executionPolicy.required_truth_sources; agent = "codex"; started_at = $startedAt.ToString("o"); ended_at = (Get-Date).ToString("o"); status = "blocked"; test_command = $task.test_command; failed_stage = "data_lint_precheck"; stage1_review = [PSCustomObject]@{ verdict = "NOT_RUN"; exit_code = $null; summary = "data lint precheck 未通过。" }; stage2_review = [PSCustomObject]@{ verdict = "NOT_RUN"; exit_code = $null; summary = "未进入 Stage 2 审查。" }; session_policy = $executionPolicy.session; subagent_policy = $executionPolicy.subagents; context_files = $executionPolicy.context_files; run_profile_path = $executionPolicy.run_profile_path; review_context = $initialReviewContext; commands = @(@{ cmd = "data_lint_precheck"; exit_code = $dataLintResult.ExitCode }); blocked_reason = $blockedReason; final_message = $blockedReason; logs = @{ data_lint = $dataLintResult.Output } }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: data 内容级门禁未通过。"
+      Write-Output $dataLintResult.Output
+      return [PSCustomObject]@{ Status = "blocked"; TaskId = $task.id; ExitCode = 2 }
+    }
+  }
+
+  $needsIntegrationLint = Test-TaskHasRiskTag -ExecutionPolicy $executionPolicy -Tags @("integration", "third_party", "third-party", "external")
+  if ($needsIntegrationLint) {
+    $integrationLintResult = Invoke-IntegrationLintPrecheck -Root $ProjectRoot
+    if ($integrationLintResult.ExitCode -eq 1) {
+      $blockedReason = "integration 内容级门禁未通过，请先补齐第三方回调、凭据、重试和上传边界。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，integration 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($integrationLintResult.Output)" -Stage1Summary "NOT_RUN - integration lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{ task_id = $task.id; task_session_id = $taskSessionId; task_kind = $executionPolicy.task_kind; gate_profile = $executionPolicy.gate_profile; required_truth_sources = $executionPolicy.required_truth_sources; agent = "codex"; started_at = $startedAt.ToString("o"); ended_at = (Get-Date).ToString("o"); status = "blocked"; test_command = $task.test_command; failed_stage = "integration_lint_precheck"; stage1_review = [PSCustomObject]@{ verdict = "NOT_RUN"; exit_code = $null; summary = "integration lint precheck 未通过。" }; stage2_review = [PSCustomObject]@{ verdict = "NOT_RUN"; exit_code = $null; summary = "未进入 Stage 2 审查。" }; session_policy = $executionPolicy.session; subagent_policy = $executionPolicy.subagents; context_files = $executionPolicy.context_files; run_profile_path = $executionPolicy.run_profile_path; review_context = $initialReviewContext; commands = @(@{ cmd = "integration_lint_precheck"; exit_code = $integrationLintResult.ExitCode }); blocked_reason = $blockedReason; final_message = $blockedReason; logs = @{ integration_lint = $integrationLintResult.Output } }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: integration 内容级门禁未通过。"
+      Write-Output $integrationLintResult.Output
+      return [PSCustomObject]@{ Status = "blocked"; TaskId = $task.id; ExitCode = 2 }
+    }
+  }
+
+  $needsMobileLint = Test-TaskHasRiskTag -ExecutionPolicy $executionPolicy -Tags @("mobile", "app", "ios", "android", "h5", "miniapp")
+  if ($needsMobileLint) {
+    $mobileLintResult = Invoke-MobileLintPrecheck -Root $ProjectRoot
+    if ($mobileLintResult.ExitCode -eq 1) {
+      $blockedReason = "mobile 内容级门禁未通过，请先补齐平台差异、权限弹窗、生命周期和真机矩阵。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，mobile 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($mobileLintResult.Output)" -Stage1Summary "NOT_RUN - mobile lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{ task_id = $task.id; task_session_id = $taskSessionId; task_kind = $executionPolicy.task_kind; gate_profile = $executionPolicy.gate_profile; required_truth_sources = $executionPolicy.required_truth_sources; agent = "codex"; started_at = $startedAt.ToString("o"); ended_at = (Get-Date).ToString("o"); status = "blocked"; test_command = $task.test_command; failed_stage = "mobile_lint_precheck"; stage1_review = [PSCustomObject]@{ verdict = "NOT_RUN"; exit_code = $null; summary = "mobile lint precheck 未通过。" }; stage2_review = [PSCustomObject]@{ verdict = "NOT_RUN"; exit_code = $null; summary = "未进入 Stage 2 审查。" }; session_policy = $executionPolicy.session; subagent_policy = $executionPolicy.subagents; context_files = $executionPolicy.context_files; run_profile_path = $executionPolicy.run_profile_path; review_context = $initialReviewContext; commands = @(@{ cmd = "mobile_lint_precheck"; exit_code = $mobileLintResult.ExitCode }); blocked_reason = $blockedReason; final_message = $blockedReason; logs = @{ mobile_lint = $mobileLintResult.Output } }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: mobile 内容级门禁未通过。"
+      Write-Output $mobileLintResult.Output
+      return [PSCustomObject]@{ Status = "blocked"; TaskId = $task.id; ExitCode = 2 }
+    }
+  }
+
+  $needsAcceptanceLint = (Test-ContentGateModeEnabled -ExecutionPolicy $executionPolicy -MinimumMode "recommended") -and (@("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile)
+  if ($needsAcceptanceLint) {
+    $acceptanceLintResult = Invoke-AcceptanceLintPrecheck -Root $ProjectRoot
+    if ($acceptanceLintResult.ExitCode -eq 1) {
+      $blockedReason = "acceptance 内容级门禁未通过，请先补齐验收报告、需求对照和回滚说明。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，acceptance 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($acceptanceLintResult.Output)" -Stage1Summary "NOT_RUN - acceptance lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{ task_id = $task.id; task_session_id = $taskSessionId; task_kind = $executionPolicy.task_kind; gate_profile = $executionPolicy.gate_profile; required_truth_sources = $executionPolicy.required_truth_sources; agent = "codex"; started_at = $startedAt.ToString("o"); ended_at = (Get-Date).ToString("o"); status = "blocked"; test_command = $task.test_command; failed_stage = "acceptance_lint_precheck"; stage1_review = [PSCustomObject]@{ verdict = "NOT_RUN"; exit_code = $null; summary = "acceptance lint precheck 未通过。" }; stage2_review = [PSCustomObject]@{ verdict = "NOT_RUN"; exit_code = $null; summary = "未进入 Stage 2 审查。" }; session_policy = $executionPolicy.session; subagent_policy = $executionPolicy.subagents; context_files = $executionPolicy.context_files; run_profile_path = $executionPolicy.run_profile_path; review_context = $initialReviewContext; commands = @(@{ cmd = "acceptance_lint_precheck"; exit_code = $acceptanceLintResult.ExitCode }); blocked_reason = $blockedReason; final_message = $blockedReason; logs = @{ acceptance_lint = $acceptanceLintResult.Output } }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: acceptance 内容级门禁未通过。"
+      Write-Output $acceptanceLintResult.Output
+      return [PSCustomObject]@{ Status = "blocked"; TaskId = $task.id; ExitCode = 2 }
+    }
+  }
+
+  $needsArchitectureLint = @("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile
+  if ($needsArchitectureLint) {
+    $architectureLintResult = Invoke-ArchitectureLintPrecheck -Root $ProjectRoot
+    if ($architectureLintResult.ExitCode -eq 1) {
+      $blockedReason = "architecture 内容级门禁未通过，请先补齐分层规则、复用检查和复杂功能技术方案字段。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，architecture 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($architectureLintResult.Output)" -Stage1Summary "NOT_RUN - architecture lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "architecture_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "architecture lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "architecture_lint_precheck"; exit_code = $architectureLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          architecture_lint = $architectureLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: architecture 内容级门禁未通过。"
+      Write-Output $architectureLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsDirectoryLint = (Test-ContentGateModeEnabled -ExecutionPolicy $executionPolicy -MinimumMode "recommended") -and (@("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile)
+  if ($needsDirectoryLint) {
+    $directoryLintResult = Invoke-DirectoryLintPrecheck -Root $ProjectRoot
+    if ($directoryLintResult.ExitCode -eq 1) {
+      $blockedReason = "directory 内容级门禁未通过，请先补齐目录规范、目录新增规则和本地规则索引。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，directory 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($directoryLintResult.Output)" -Stage1Summary "NOT_RUN - directory lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "directory_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "directory lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "directory_lint_precheck"; exit_code = $directoryLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          directory_lint = $directoryLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: directory 内容级门禁未通过。"
+      Write-Output $directoryLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsStyleLint = (Test-ContentGateModeEnabled -ExecutionPolicy $executionPolicy -MinimumMode "recommended") -and (@("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile)
+  if ($needsStyleLint) {
+    $styleLintResult = Invoke-StyleLintPrecheck -Root $ProjectRoot
+    if ($styleLintResult.ExitCode -eq 1) {
+      $blockedReason = "style 内容级门禁未通过，请先补齐业务词典、命名规则和类型边界。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，style 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($styleLintResult.Output)" -Stage1Summary "NOT_RUN - style lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "style_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "style lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "style_lint_precheck"; exit_code = $styleLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          style_lint = $styleLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: style 内容级门禁未通过。"
+      Write-Output $styleLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsComponentLint = (Test-ContentGateModeEnabled -ExecutionPolicy $executionPolicy -MinimumMode "recommended") -and (@("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile)
+  if ($needsComponentLint) {
+    $componentLintResult = Invoke-ComponentLintPrecheck -Root $ProjectRoot
+    if ($componentLintResult.ExitCode -eq 1) {
+      $blockedReason = "component 内容级门禁未通过，请先补齐组件清单、复用决策和公共组件兼容影响面。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，component 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($componentLintResult.Output)" -Stage1Summary "NOT_RUN - component lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "component_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "component lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "component_lint_precheck"; exit_code = $componentLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          component_lint = $componentLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: component 内容级门禁未通过。"
+      Write-Output $componentLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsBusinessLint = (Test-ContentGateModeEnabled -ExecutionPolicy $executionPolicy -MinimumMode "recommended") -and (@("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile)
+  if ($needsBusinessLint) {
+    $businessLintResult = Invoke-BusinessLintPrecheck -Root $ProjectRoot
+    if ($businessLintResult.ExitCode -eq 1) {
+      $blockedReason = "business 内容级门禁未通过，请先补齐业务规则、边界状态和异常路径测试约束。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，business 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($businessLintResult.Output)" -Stage1Summary "NOT_RUN - business lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "business_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "business lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "business_lint_precheck"; exit_code = $businessLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          business_lint = $businessLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: business 内容级门禁未通过。"
+      Write-Output $businessLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsContractLint = @("contract_required", "release_required") -contains $executionPolicy.gate_profile
+  if ($needsContractLint) {
+    $contractLintResult = Invoke-ContractLintPrecheck -Root $ProjectRoot
+    if ($contractLintResult.ExitCode -eq 1) {
+      $blockedReason = "contract 内容级门禁未通过，请先补齐统一请求入口、响应包装、错误模型和契约追溯。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，contract 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($contractLintResult.Output)" -Stage1Summary "NOT_RUN - contract lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "contract_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "contract lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "contract_lint_precheck"; exit_code = $contractLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          contract_lint = $contractLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: contract 内容级门禁未通过。"
+      Write-Output $contractLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsStateLint = (Test-ContentGateModeEnabled -ExecutionPolicy $executionPolicy -MinimumMode "recommended") -and (@("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile)
+  if ($needsStateLint) {
+    $stateLintResult = Invoke-StateLintPrecheck -Root $ProjectRoot
+    if ($stateLintResult.ExitCode -eq 1) {
+      $blockedReason = "state 内容级门禁未通过，请先补齐状态分层、唯一状态来源和缓存失效策略。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，state 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($stateLintResult.Output)" -Stage1Summary "NOT_RUN - state lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "state_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "state lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "state_lint_precheck"; exit_code = $stateLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          state_lint = $stateLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: state 内容级门禁未通过。"
+      Write-Output $stateLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsUiLint = (Test-ContentGateModeEnabled -ExecutionPolicy $executionPolicy -MinimumMode "recommended") -and (@("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile)
+  if ($needsUiLint) {
+    $uiLintResult = Invoke-UiLintPrecheck -Root $ProjectRoot
+    if ($uiLintResult.ExitCode -eq 1) {
+      $blockedReason = "ui 内容级门禁未通过，请先补齐设计系统、移动端安全区、交互状态和表单体验规则。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，ui 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($uiLintResult.Output)" -Stage1Summary "NOT_RUN - ui lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "ui_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "ui lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "ui_lint_precheck"; exit_code = $uiLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          ui_lint = $uiLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: ui 内容级门禁未通过。"
+      Write-Output $uiLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsBackendLint = Test-TaskHasRiskTag -ExecutionPolicy $executionPolicy -Tags @("backend", "api", "worker", "service")
+  if ($needsBackendLint) {
+    $backendLintResult = Invoke-BackendLintPrecheck -Root $ProjectRoot
+    if ($backendLintResult.ExitCode -eq 1) {
+      $blockedReason = "backend 内容级门禁未通过，请先补齐 Controller/Service/Repository 边界、事务/幂等和异常处理策略。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，backend 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($backendLintResult.Output)" -Stage1Summary "NOT_RUN - backend lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "backend_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "backend lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "backend_lint_precheck"; exit_code = $backendLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          backend_lint = $backendLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: backend 内容级门禁未通过。"
+      Write-Output $backendLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsSecurityLint = Test-TaskHasRiskTag -ExecutionPolicy $executionPolicy -Tags @("security", "auth", "permission", "payment", "privacy")
+  if ($needsSecurityLint) {
+    $securityLintResult = Invoke-SecurityLintPrecheck -Root $ProjectRoot
+    if ($securityLintResult.ExitCode -eq 1) {
+      $blockedReason = "security 内容级门禁未通过，请先补齐权限校验、输入校验、脱敏和风控策略。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，security 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($securityLintResult.Output)" -Stage1Summary "NOT_RUN - security lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "security_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "security lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "security_lint_precheck"; exit_code = $securityLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          security_lint = $securityLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: security 内容级门禁未通过。"
+      Write-Output $securityLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsTestingLint = @("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile
+  if ($needsTestingLint) {
+    $testingLintResult = Invoke-TestingLintPrecheck -Root $ProjectRoot
+    if ($testingLintResult.ExitCode -eq 1) {
+      $blockedReason = "testing 内容级门禁未通过，请先补齐验收、追溯、测试策略、验证矩阵和假测试约束。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，testing 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($testingLintResult.Output)" -Stage1Summary "NOT_RUN - testing lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "testing_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "testing lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "testing_lint_precheck"; exit_code = $testingLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          testing_lint = $testingLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: testing 内容级门禁未通过。"
+      Write-Output $testingLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsImpactLint = @("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile
+  if ($needsImpactLint) {
+    $impactLintResult = Invoke-ImpactLintPrecheck -Root $ProjectRoot
+    if ($impactLintResult.ExitCode -eq 1) {
+      $blockedReason = "impact 内容级门禁未通过，请先补齐调用链、直接/间接影响和回归范围。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，impact 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($impactLintResult.Output)" -Stage1Summary "NOT_RUN - impact lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "impact_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "impact lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "impact_lint_precheck"; exit_code = $impactLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          impact_lint = $impactLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: impact 内容级门禁未通过。"
+      Write-Output $impactLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsPerformanceLint = (Test-ContentGateModeEnabled -ExecutionPolicy $executionPolicy -MinimumMode "recommended") -and (@("spec_required", "contract_required", "release_required") -contains $executionPolicy.gate_profile)
+  if ($needsPerformanceLint) {
+    $performanceLintResult = Invoke-PerformanceLintPrecheck -Root $ProjectRoot
+    if ($performanceLintResult.ExitCode -eq 1) {
+      $blockedReason = "performance 内容级门禁未通过，请先补齐性能预算、复杂列表策略和后端性能约束。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，performance 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($performanceLintResult.Output)" -Stage1Summary "NOT_RUN - performance lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "performance_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "performance lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "performance_lint_precheck"; exit_code = $performanceLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          performance_lint = $performanceLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: performance 内容级门禁未通过。"
+      Write-Output $performanceLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsConfigLint = Test-TaskHasRiskTag -ExecutionPolicy $executionPolicy -Tags @("config", "deploy", "env", "infra", "ci", "ops")
+  if ($needsConfigLint) {
+    $configLintResult = Invoke-ConfigLintPrecheck -Root $ProjectRoot
+    if ($configLintResult.ExitCode -eq 1) {
+      $blockedReason = "config 内容级门禁未通过，请先补齐环境变量、构建命令和部署影响说明。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，config 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($configLintResult.Output)" -Stage1Summary "NOT_RUN - config lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "config_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "config lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "config_lint_precheck"; exit_code = $configLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          config_lint = $configLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: config 内容级门禁未通过。"
+      Write-Output $configLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsObservabilityLint = Test-TaskHasRiskTag -ExecutionPolicy $executionPolicy -Tags @("observability", "logging", "metrics", "trace", "alerting")
+  if ($needsObservabilityLint) {
+    $observabilityLintResult = Invoke-ObservabilityLintPrecheck -Root $ProjectRoot
+    if ($observabilityLintResult.ExitCode -eq 1) {
+      $blockedReason = "observability 内容级门禁未通过，请先补齐日志字段、trace 证据和告警策略。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，observability 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($observabilityLintResult.Output)" -Stage1Summary "NOT_RUN - observability lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "observability_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "observability lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "observability_lint_precheck"; exit_code = $observabilityLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          observability_lint = $observabilityLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: observability 内容级门禁未通过。"
+      Write-Output $observabilityLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  $needsRefactorLint = Test-TaskHasRiskTag -ExecutionPolicy $executionPolicy -Tags @("refactor")
+  if ($needsRefactorLint) {
+    $refactorLintResult = Invoke-RefactorLintPrecheck -Root $ProjectRoot
+    if ($refactorLintResult.ExitCode -eq 1) {
+      $blockedReason = "refactor 内容级门禁未通过，请先补齐任务类型、行为不变约束和死代码清理范围。"
+      Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "未进入实现阶段，refactor 内容级门禁未通过。" -TestSummary "未运行测试。" -Notes "$blockedReason`n$($refactorLintResult.Output)" -Stage1Summary "NOT_RUN - refactor lint precheck 未通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+      $tracePayload = [PSCustomObject]@{
+        task_id = $task.id
+        task_session_id = $taskSessionId
+        task_kind = $executionPolicy.task_kind
+        gate_profile = $executionPolicy.gate_profile
+        required_truth_sources = $executionPolicy.required_truth_sources
+        agent = "codex"
+        started_at = $startedAt.ToString("o")
+        ended_at = (Get-Date).ToString("o")
+        status = "blocked"
+        test_command = $task.test_command
+        failed_stage = "refactor_lint_precheck"
+        stage1_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "refactor lint precheck 未通过。"
+        }
+        stage2_review = [PSCustomObject]@{
+          verdict = "NOT_RUN"
+          exit_code = $null
+          summary = "未进入 Stage 2 审查。"
+        }
+        session_policy = $executionPolicy.session
+        subagent_policy = $executionPolicy.subagents
+        context_files = $executionPolicy.context_files
+        run_profile_path = $executionPolicy.run_profile_path
+        review_context = $initialReviewContext
+        commands = @(@{ cmd = "refactor_lint_precheck"; exit_code = $refactorLintResult.ExitCode })
+        blocked_reason = $blockedReason
+        final_message = $blockedReason
+        logs = @{
+          refactor_lint = $refactorLintResult.Output
+        }
+      }
+      Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $null -LogFiles @() | Out-Null
+      Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+      Write-Step "BLOCKED: refactor 内容级门禁未通过。"
+      Write-Output $refactorLintResult.Output
+      return [PSCustomObject]@{
+        Status = "blocked"
+        TaskId = $task.id
+        ExitCode = 2
+      }
+    }
+  }
+
+  Write-Step "选择任务: $($task.id) $($task.description)"
   Write-Step "启动新 task 会话: $taskSessionId ($($executionPolicy.session.mode))"
 
   $prompt = New-ImplementationPrompt -Task $task -ExecutionPolicy $executionPolicy -TaskSessionId $taskSessionId
@@ -2209,16 +4107,16 @@ function Invoke-OneTask {
     }
   }
 
-  Write-Step "Stage 1 审查通过，开始运行测试。"
-  $testResult = Invoke-TestCommand -Command $task.test_command -Root $ProjectRoot -LogDirectory $taskLogDirectory -TaskId $task.id
-
-  if ($testResult.ExitCode -ne 0) {
-    Write-Step "测试失败，开始自动失败归因。"
-    $triageResult = Invoke-FailureTriage -Task $task -Root $ProjectRoot -ExecutionPolicy $executionPolicy -ReviewContext $reviewContext -CodexResult $codexResult -Stage1Result $stage1Result -TestResult $testResult -CodexCommand $CodexCommand -LogDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents
-    $triageNote = if ($null -ne $triageResult.ReportPath) { "failure triage: $($triageResult.ReportPath)" } elseif (-not [string]::IsNullOrWhiteSpace($triageResult.ParseError)) { "failure triage parse failed: $($triageResult.ParseError)" } else { "failure triage did not produce a structured report" }
-    Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "Codex 已产生改动。" -TestSummary "测试失败，退出码 $($testResult.ExitCode)。" -Notes "禁止标记 passes=true，请人工查看 trace；$triageNote" -Stage1Summary "PASS - 审查通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
-    $tracePayload = [PSCustomObject]@{
-      task_id = $task.id
+  Write-Step "Stage 1 审查通过，开始运行测试。"
+  $testResult = Invoke-TestCommand -Command $task.test_command -Root $ProjectRoot -LogDirectory $taskLogDirectory -TaskId $task.id
+
+  if ($testResult.ExitCode -ne 0) {
+    Write-Step "测试失败，开始自动失败归因。"
+    $triageResult = Invoke-FailureTriage -Task $task -Root $ProjectRoot -ExecutionPolicy $executionPolicy -ReviewContext $reviewContext -CodexResult $codexResult -Stage1Result $stage1Result -TestResult $testResult -CodexCommand $CodexCommand -LogDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents
+    $triageNote = if ($null -ne $triageResult.ReportPath) { "failure triage: $($triageResult.ReportPath)" } elseif (-not [string]::IsNullOrWhiteSpace($triageResult.ParseError)) { "failure triage parse failed: $($triageResult.ParseError)" } else { "failure triage did not produce a structured report" }
+    Write-ProgressEntry -Path $ProgressPath -Task $task -WorkSummary "Codex 已产生改动。" -TestSummary "测试失败，退出码 $($testResult.ExitCode)。" -Notes "禁止标记 passes=true，请人工查看 trace；$triageNote" -Stage1Summary "PASS - 审查通过。" -Stage2Summary "NOT_RUN - 未进入 Stage 2 审查。"
+    $tracePayload = [PSCustomObject]@{
+      task_id = $task.id
       task_session_id = $taskSessionId
       task_kind = $executionPolicy.task_kind
       gate_profile = $executionPolicy.gate_profile
@@ -2244,45 +4142,45 @@ function Invoke-OneTask {
       subagent_policy = $executionPolicy.subagents
       context_files = $executionPolicy.context_files
       run_profile_path = $executionPolicy.run_profile_path
-      review_context = $reviewContext
-      commands = @(
-        @{ cmd = "codex exec"; exit_code = $codexResult.ExitCode },
-        @{ cmd = "stage1 review"; exit_code = $stage1Result.ExitCode; verdict = $stage1Verdict },
-        @{ cmd = $task.test_command; exit_code = $testResult.ExitCode },
-        @{ cmd = "failure triage"; exit_code = $triageResult.ExitCode; report = $triageResult.ReportPath }
-      )
-      final_message = $codexResult.Output
-      logs = @{
-        implementation_stdout = $codexResult.StdoutLog
+      review_context = $reviewContext
+      commands = @(
+        @{ cmd = "codex exec"; exit_code = $codexResult.ExitCode },
+        @{ cmd = "stage1 review"; exit_code = $stage1Result.ExitCode; verdict = $stage1Verdict },
+        @{ cmd = $task.test_command; exit_code = $testResult.ExitCode },
+        @{ cmd = "failure triage"; exit_code = $triageResult.ExitCode; report = $triageResult.ReportPath }
+      )
+      final_message = $codexResult.Output
+      logs = @{
+        implementation_stdout = $codexResult.StdoutLog
         implementation_stderr = $codexResult.StderrLog
         implementation_prompt = $codexResult.PromptLog
         implementation_last_message = $codexResult.LastMessageLog
         stage1_stdout = $stage1Result.StdoutLog
         stage1_stderr = $stage1Result.StderrLog
-        stage1_prompt = $stage1Result.PromptLog
-        stage1_last_message = $stage1Result.LastMessageLog
-        test_output = $testResult.OutputLog
-        failure_triage_stdout = $triageResult.StdoutLog
-        failure_triage_stderr = $triageResult.StderrLog
-        failure_triage_prompt = $triageResult.PromptLog
-        failure_triage_last_message = $triageResult.LastMessageLog
-      }
-      failure_triage_report = $triageResult.ReportPath
-      failure_triage_parse_error = $triageResult.ParseError
-    }
-    Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $codexResult -LogFiles (@(Get-TraceLogFiles -CodexResults @($codexResult, $stage1Result, $triageResult)) + @(ConvertTo-StringArray -Value $testResult.OutputLog) + @(ConvertTo-StringArray -Value $triageResult.ReportPath)) | Out-Null
-    Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
-    Write-Step "FAILED: 测试失败，退出码 $($testResult.ExitCode)。"
-    Write-Output ""
-    Write-Output "测试输出:"
-    Write-Output $testResult.Output
-    Write-Output ""
-    Write-Output "Failure triage:"
-    Write-Output $triageNote
-    Write-Output ""
-    Write-Output "Codex 完整日志: $($codexResult.StdoutLog)"
-    return [PSCustomObject]@{
-      Status = "failed"
+        stage1_prompt = $stage1Result.PromptLog
+        stage1_last_message = $stage1Result.LastMessageLog
+        test_output = $testResult.OutputLog
+        failure_triage_stdout = $triageResult.StdoutLog
+        failure_triage_stderr = $triageResult.StderrLog
+        failure_triage_prompt = $triageResult.PromptLog
+        failure_triage_last_message = $triageResult.LastMessageLog
+      }
+      failure_triage_report = $triageResult.ReportPath
+      failure_triage_parse_error = $triageResult.ParseError
+    }
+    Add-TraceDurableFields -Trace $tracePayload -SessionDirectory $taskLogDirectory -CaptureJsonEvents:$CaptureJsonEvents -EventsSource $codexResult -LogFiles (@(Get-TraceLogFiles -CodexResults @($codexResult, $stage1Result, $triageResult)) + @(ConvertTo-StringArray -Value $testResult.OutputLog) + @(ConvertTo-StringArray -Value $triageResult.ReportPath)) | Out-Null
+    Save-Trace -Directory $TracePath -Trace $tracePayload | Out-Null
+    Write-Step "FAILED: 测试失败，退出码 $($testResult.ExitCode)。"
+    Write-Output ""
+    Write-Output "测试输出:"
+    Write-Output $testResult.Output
+    Write-Output ""
+    Write-Output "Failure triage:"
+    Write-Output $triageNote
+    Write-Output ""
+    Write-Output "Codex 完整日志: $($codexResult.StdoutLog)"
+    return [PSCustomObject]@{
+      Status = "failed"
       TaskId = $task.id
       ExitCode = 1
     }