@tea-agent/loop-agent 0.1.0-fe-test.0

package/dist/workflows/dag/final-verification.js

@@ -0,0 +1,180 @@
+import { writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { DEFAULT_DAG_EXECUTOR_MODELS } from './types.js';
+import { parseDagSpec } from './types.js';
+import { loadHarnessManifest } from '../../governance/harness.js';
+import { loadTaskConfig } from '../../task/runtime.js';
+import { resolveCliPath } from '../../shared/path-refs.js';
+const DEFAULT_OUTPUT_DIR = os.tmpdir();
+export function defaultFinalVerificationDagOutputPath(taskId) {
+    return path.join(DEFAULT_OUTPUT_DIR, `${taskId}-final-verification-dag.json`);
+}
+export async function initFinalVerificationDagFromTask(repoRoot, taskId, options = {}) {
+    const spec = await buildFinalVerificationDagFromTask(repoRoot, taskId, options);
+    const outputPath = resolveCliPath(options.outputPath ?? defaultFinalVerificationDagOutputPath(taskId));
+    await writeFile(outputPath, `${JSON.stringify(spec, null, 2)}\n`, 'utf-8');
+    return {
+        taskId,
+        outputPath,
+        nodeIds: spec.tasks.map((task) => task.id),
+        taskCount: spec.tasks.length,
+    };
+}
+export async function buildFinalVerificationDagFromTask(repoRoot, taskId, options = {}) {
+    const [taskConfig, manifest] = await Promise.all([
+        loadTaskConfig(repoRoot, taskId),
+        loadHarnessManifest(repoRoot),
+    ]);
+    const taskGlob = options.taskGlob ?? taskId;
+    const closeoutPath = options.closeoutPath ?? path.join(os.tmpdir(), `${taskId}-closeout-report.md`);
+    const checkRepo = manifest.scripts.checkRepo ?? 'scripts/check-repo.sh';
+    const finalVerifyCommands = [`HARNESS_ALLOW_ACTIVE_DAG_RUNS=1 bash ${checkRepo}`];
+    const hasChangesetSignal = taskDeclaresReleaseImpact(taskConfig);
+    const tasks = [
+        shellTask({
+            id: 'task-state-reconcile-shell',
+            depends_on: [],
+            outputContract: 'Markdown task state/artifact/DAG/verification drift report.',
+            commands: [
+                `npm run dev -- dag reconcile-tasks --glob ${JSON.stringify(taskGlob)} --markdown`,
+            ],
+        }),
+        shellTask({
+            id: 'requirement-coverage-shell',
+            depends_on: [],
+            outputContract: 'Markdown requirement coverage audit for the closeout task.',
+            commands: [
+                `npm run dev -- handoff coverage ${JSON.stringify(taskId)} --markdown`,
+            ],
+        }),
+        shellTask({
+            id: 'static-invariant-shell',
+            depends_on: [],
+            outputContract: 'Task-scoped static invariant scan derived only from task source/config constraints.',
+            commands: [
+                [
+                    'node',
+                    '-e',
+                    JSON.stringify([
+                        "const fs=require('fs');",
+                        `const task=${JSON.stringify(taskId)};`,
+                        "const cfg=JSON.parse(fs.readFileSync(`.harness/tasks/${task}/task.json`,'utf8'));",
+                        "const forbidden=cfg.forbiddenPaths||[];",
+                        "const hard=cfg.hardConstraints||[];",
+                        "console.log(`# Static invariant scan for ${task}`);",
+                        "console.log(`forbiddenPaths=${forbidden.length}`);",
+                        "console.log(`hardConstraints=${hard.length}`);",
+                        "if (forbidden.some((entry)=>String(entry).includes('harness.json'))) console.log('invariant: harness.json remains forbidden by task source');",
+                        "console.log('No global shellPolicy or host wrapper policy was introduced by this scan.');",
+                    ].join('')),
+                ].join(' '),
+            ],
+        }),
+        shellTask({
+            id: 'changeset-impact-shell',
+            depends_on: [],
+            outputContract: 'Changeset impact audit, or explicit skip reason when the repo/task has no release signal.',
+            commands: [
+                hasChangesetSignal
+                    ? 'test -d .changeset || test -f .changeset/config.json || { echo "changeset impact declared by task but no .changeset metadata found"; exit 1; }; echo "changeset impact metadata present"'
+                    : 'if test -d .changeset || test -f .changeset/config.json; then echo "changeset metadata present; review release notes before final verify"; else echo "SKIP: no changesets directory/config and task declares no release impact"; fi',
+            ],
+        }),
+        shellTask({
+            id: 'closeout-artifact-shell',
+            depends_on: [
+                'task-state-reconcile-shell',
+                'requirement-coverage-shell',
+                'static-invariant-shell',
+                'changeset-impact-shell',
+            ],
+            writePolicy: 'none',
+            outputContract: 'Writes a derived closeout artifact outside completed run facts, before final verification.',
+            commands: [
+                `mkdir -p ${JSON.stringify(path.dirname(closeoutPath))}`,
+                `printf '%s\\n' '# Final Verification Closeout' '' 'task: ${taskId}' 'generated before final verification; do not treat as verify evidence' > ${JSON.stringify(closeoutPath)}`,
+                `test -s ${JSON.stringify(closeoutPath)}`,
+            ],
+        }),
+        shellTask({
+            id: 'final-verify-shell',
+            depends_on: ['closeout-artifact-shell'],
+            outputContract: 'Final verification evidence captured after closeout artifact exists.',
+            commands: finalVerifyCommands,
+        }),
+        {
+            id: 'closeout-summary-pi',
+            depends_on: ['final-verify-shell'],
+            executor: 'pi',
+            role: 'closeout',
+            complexity: 'LOW',
+            writePolicy: 'read-only',
+            allowedPaths: [],
+            forbiddenPaths: ['.harness/**', '.harness/dag-runs/**', 'artifacts/**'],
+            outputContract: 'Plain Markdown summary of reconcile, coverage, invariant, changeset, closeout artifact, and final verification results. No file writes.',
+            subtask_prompt: [
+                `Summarize final verification DAG results for task ${taskId}.`,
+                `The closeout artifact path is ${closeoutPath}.`,
+                'Do not write files. Do not claim final verification passed unless final-verify-shell succeeded.',
+            ].join('\n'),
+        },
+    ];
+    return parseDagSpec({
+        version: 2,
+        title: `Final Verification DAG: ${taskConfig.title || taskId}`,
+        objective: `Run deterministic closeout gates for ${taskId} with final verification after closeout artifact creation.`,
+        successCriteria: [
+            'task-state-reconcile-shell runs before closeout artifact creation',
+            'requirement-coverage-shell audits source requirements',
+            'static-invariant-shell uses task-scoped constraints only',
+            'changeset-impact-shell skips with an explicit reason when no changesets/release impact exists',
+            'closeout-artifact-shell runs before final-verify-shell',
+            'final-verify-shell uses repo manifest verification commands without host-specific wrappers',
+        ],
+        globalConstraints: [
+            'Do not implement Project Policy Gate',
+            'Do not add rtk or host-specific shell wrappers as loop-agent built-ins',
+            'Do not mutate .harness/dag-runs/completed facts',
+            'Final verification must run after closeout artifact creation',
+        ],
+        defaults: {
+            executor: 'shell',
+            contextProfile: 'slim',
+            writePolicy: 'read-only',
+            skills: ['ai-engineering-context'],
+        },
+        executorModels: DEFAULT_DAG_EXECUTOR_MODELS,
+        skillsByRole: {
+            verifier: ['verification-before-completion'],
+            closeout: ['loop-agent', 'verification-before-completion'],
+        },
+        tasks,
+    });
+}
+function shellTask(input) {
+    return {
+        id: input.id,
+        depends_on: input.depends_on,
+        executor: 'shell',
+        role: 'verifier',
+        complexity: 'LOW',
+        writePolicy: input.writePolicy ?? 'read-only',
+        allowedPaths: [],
+        forbiddenPaths: ['.harness/dag-runs/completed/**', 'artifacts/**'],
+        shell: {
+            commands: input.commands,
+            timeoutMs: 600_000,
+        },
+        outputContract: input.outputContract,
+        subtask_prompt: input.outputContract,
+    };
+}
+function taskDeclaresReleaseImpact(taskConfig) {
+    const haystack = [
+        taskConfig.notes ?? '',
+        ...(taskConfig.hardConstraints ?? []),
+        ...(taskConfig.sourceFiles ?? []),
+    ].join('\n');
+    return /changeset|release|publish|version/i.test(haystack);
+}