@tea-agent/loop-agent 0.1.0

package/dist/workflows/dag/failure-category.js

@@ -0,0 +1,111 @@
+import { z } from "zod";
+export const dagNormalizedFailureCategorySchema = z.enum([
+    "success",
+    "validation",
+    "executor",
+    "write-guard",
+    "timeout",
+    "auth",
+    "human-required",
+    "human-rejected",
+    "shell-command",
+    "static-error",
+    "decision-envelope",
+    "skipped",
+    "unknown",
+]);
+export const DAG_NORMALIZED_FAILURE_CATEGORIES = dagNormalizedFailureCategorySchema.options;
+const RAW_TO_NORMALIZED = {
+    success: "success",
+    "write-guard": "write-guard",
+    timeout: "timeout",
+    "missing-api-key": "auth",
+    auth: "auth",
+    "human-rejected": "human-rejected",
+    "human-required": "human-required",
+    "decision-envelope-invalid": "decision-envelope",
+    "nonzero-exit": "shell-command",
+    "spawn-error": "shell-command",
+    "static-error": "static-error",
+    "invalid-output": "validation",
+    "path-violation": "validation",
+    "empty-output": "validation",
+    "verify-failure": "validation",
+    "test-failure": "validation",
+    network: "executor",
+    quota: "executor",
+    "rate-limit": "executor",
+    unavailable: "executor",
+    unknown: "unknown",
+};
+function isFinishedStatus(status) {
+    return status === "FINISHED" || status === "finished";
+}
+function isInProgressStatus(status) {
+    return (status === "PENDING" ||
+        status === "RUNNING" ||
+        status === "pending" ||
+        status === "running");
+}
+function isFailureStatus(status) {
+    return (status === "ERROR" ||
+        status === "failed" ||
+        status === "partial_failed");
+}
+function mapRawCategory(raw) {
+    const direct = RAW_TO_NORMALIZED[raw];
+    if (direct)
+        return direct;
+    const lower = raw.toLowerCase();
+    if (lower.includes("timeout"))
+        return "timeout";
+    if (lower.includes("validation") || lower.includes("invalid"))
+        return "validation";
+    if (lower.includes("auth") || lower.includes("api-key"))
+        return "auth";
+    if (lower.includes("write-guard") || lower.includes("write_guard"))
+        return "write-guard";
+    if (lower.includes("decision-envelope") || lower.includes("decision_envelope"))
+        return "decision-envelope";
+    if (lower.includes("human-rejected"))
+        return "human-rejected";
+    if (lower.includes("human-required"))
+        return "human-required";
+    if (lower.includes("static-error"))
+        return "static-error";
+    if (lower.includes("nonzero-exit") ||
+        lower.includes("spawn-error") ||
+        lower.includes("shell"))
+        return "shell-command";
+    return undefined;
+}
+export function isDagFailureCategory(value) {
+    return DAG_NORMALIZED_FAILURE_CATEGORIES.includes(value);
+}
+export function normalizeDagFailureCategory(raw, status) {
+    if (status === "SKIPPED") {
+        return "skipped";
+    }
+    if (raw !== undefined) {
+        const mapped = mapRawCategory(raw);
+        if (mapped) {
+            if (mapped === "success") {
+                return isFinishedStatus(status) ? "success" : "unknown";
+            }
+            return mapped;
+        }
+    }
+    if (raw === undefined && isFinishedStatus(status)) {
+        return "success";
+    }
+    if (isInProgressStatus(status)) {
+        return "unknown";
+    }
+    if (isFailureStatus(status)) {
+        return "unknown";
+    }
+    if (raw === "success" && isFinishedStatus(status)) {
+        return "success";
+    }
+    return "unknown";
+}

package/dist/workflows/dag/final-verification.js

@@ -0,0 +1,180 @@
+import { writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { DEFAULT_DAG_EXECUTOR_MODELS } from './types.js';
+import { parseDagSpec } from './types.js';
+import { loadHarnessManifest } from '../../governance/harness.js';
+import { loadTaskConfig } from '../../task/runtime.js';
+import { resolveCliPath } from '../../shared/path-refs.js';
+const DEFAULT_OUTPUT_DIR = os.tmpdir();
+export function defaultFinalVerificationDagOutputPath(taskId) {
+    return path.join(DEFAULT_OUTPUT_DIR, `${taskId}-final-verification-dag.json`);
+}
+export async function initFinalVerificationDagFromTask(repoRoot, taskId, options = {}) {
+    const spec = await buildFinalVerificationDagFromTask(repoRoot, taskId, options);
+    const outputPath = resolveCliPath(options.outputPath ?? defaultFinalVerificationDagOutputPath(taskId));
+    await writeFile(outputPath, `${JSON.stringify(spec, null, 2)}\n`, 'utf-8');
+    return {
+        taskId,
+        outputPath,
+        nodeIds: spec.tasks.map((task) => task.id),
+        taskCount: spec.tasks.length,
+    };
+}
+export async function buildFinalVerificationDagFromTask(repoRoot, taskId, options = {}) {
+    const [taskConfig, manifest] = await Promise.all([
+        loadTaskConfig(repoRoot, taskId),
+        loadHarnessManifest(repoRoot),
+    ]);
+    const taskGlob = options.taskGlob ?? taskId;
+    const closeoutPath = options.closeoutPath ?? path.join(os.tmpdir(), `${taskId}-closeout-report.md`);
+    const checkRepo = manifest.scripts.checkRepo ?? 'scripts/check-repo.sh';
+    const finalVerifyCommands = [`HARNESS_ALLOW_ACTIVE_DAG_RUNS=1 bash ${checkRepo}`];
+    const hasChangesetSignal = taskDeclaresReleaseImpact(taskConfig);
+    const tasks = [
+        shellTask({
+            id: 'task-state-reconcile-shell',
+            depends_on: [],
+            outputContract: 'Markdown task state/artifact/DAG/verification drift report.',
+            commands: [
+                `npm run dev -- dag reconcile-tasks --glob ${JSON.stringify(taskGlob)} --markdown`,
+            ],
+        }),
+        shellTask({
+            id: 'requirement-coverage-shell',
+            depends_on: [],
+            outputContract: 'Markdown requirement coverage audit for the closeout task.',
+            commands: [
+                `npm run dev -- handoff coverage ${JSON.stringify(taskId)} --markdown`,
+            ],
+        }),
+        shellTask({
+            id: 'static-invariant-shell',
+            depends_on: [],
+            outputContract: 'Task-scoped static invariant scan derived only from task source/config constraints.',
+            commands: [
+                [
+                    'node',
+                    '-e',
+                    JSON.stringify([
+                        "const fs=require('fs');",
+                        `const task=${JSON.stringify(taskId)};`,
+                        "const cfg=JSON.parse(fs.readFileSync(`.harness/tasks/${task}/task.json`,'utf8'));",
+                        "const forbidden=cfg.forbiddenPaths||[];",
+                        "const hard=cfg.hardConstraints||[];",
+                        "console.log(`# Static invariant scan for ${task}`);",
+                        "console.log(`forbiddenPaths=${forbidden.length}`);",
+                        "console.log(`hardConstraints=${hard.length}`);",
+                        "if (forbidden.some((entry)=>String(entry).includes('harness.json'))) console.log('invariant: harness.json remains forbidden by task source');",
+                        "console.log('No global shellPolicy or host wrapper policy was introduced by this scan.');",
+                    ].join('')),
+                ].join(' '),
+            ],
+        }),
+        shellTask({
+            id: 'changeset-impact-shell',
+            depends_on: [],
+            outputContract: 'Changeset impact audit, or explicit skip reason when the repo/task has no release signal.',
+            commands: [
+                hasChangesetSignal
+                    ? 'test -d .changeset || test -f .changeset/config.json || { echo "changeset impact declared by task but no .changeset metadata found"; exit 1; }; echo "changeset impact metadata present"'
+                    : 'if test -d .changeset || test -f .changeset/config.json; then echo "changeset metadata present; review release notes before final verify"; else echo "SKIP: no changesets directory/config and task declares no release impact"; fi',
+            ],
+        }),
+        shellTask({
+            id: 'closeout-artifact-shell',
+            depends_on: [
+                'task-state-reconcile-shell',
+                'requirement-coverage-shell',
+                'static-invariant-shell',
+                'changeset-impact-shell',
+            ],
+            writePolicy: 'none',
+            outputContract: 'Writes a derived closeout artifact outside completed run facts, before final verification.',
+            commands: [
+                `mkdir -p ${JSON.stringify(path.dirname(closeoutPath))}`,
+                `printf '%s\\n' '# Final Verification Closeout' '' 'task: ${taskId}' 'generated before final verification; do not treat as verify evidence' > ${JSON.stringify(closeoutPath)}`,
+                `test -s ${JSON.stringify(closeoutPath)}`,
+            ],
+        }),
+        shellTask({
+            id: 'final-verify-shell',
+            depends_on: ['closeout-artifact-shell'],
+            outputContract: 'Final verification evidence captured after closeout artifact exists.',
+            commands: finalVerifyCommands,
+        }),
+        {
+            id: 'closeout-summary-pi',
+            depends_on: ['final-verify-shell'],
+            executor: 'pi',
+            role: 'closeout',
+            complexity: 'LOW',
+            writePolicy: 'read-only',
+            allowedPaths: [],
+            forbiddenPaths: ['.harness/**', '.harness/dag-runs/**', 'artifacts/**'],
+            outputContract: 'Plain Markdown summary of reconcile, coverage, invariant, changeset, closeout artifact, and final verification results. No file writes.',
+            subtask_prompt: [
+                `Summarize final verification DAG results for task ${taskId}.`,
+                `The closeout artifact path is ${closeoutPath}.`,
+                'Do not write files. Do not claim final verification passed unless final-verify-shell succeeded.',
+            ].join('\n'),
+        },
+    ];
+    return parseDagSpec({
+        version: 2,
+        title: `Final Verification DAG: ${taskConfig.title || taskId}`,
+        objective: `Run deterministic closeout gates for ${taskId} with final verification after closeout artifact creation.`,
+        successCriteria: [
+            'task-state-reconcile-shell runs before closeout artifact creation',
+            'requirement-coverage-shell audits source requirements',
+            'static-invariant-shell uses task-scoped constraints only',
+            'changeset-impact-shell skips with an explicit reason when no changesets/release impact exists',
+            'closeout-artifact-shell runs before final-verify-shell',
+            'final-verify-shell uses repo manifest verification commands without host-specific wrappers',
+        ],
+        globalConstraints: [
+            'Do not implement Project Policy Gate',
+            'Do not add rtk or host-specific shell wrappers as loop-agent built-ins',
+            'Do not mutate .harness/dag-runs/completed facts',
+            'Final verification must run after closeout artifact creation',
+        ],
+        defaults: {
+            executor: 'shell',
+            contextProfile: 'slim',
+            writePolicy: 'read-only',
+            skills: ['ai-engineering-context'],
+        },
+        executorModels: DEFAULT_DAG_EXECUTOR_MODELS,
+        skillsByRole: {
+            verifier: ['verification-before-completion'],
+            closeout: ['loop-agent', 'verification-before-completion'],
+        },
+        tasks,
+    });
+}
+function shellTask(input) {
+    return {
+        id: input.id,
+        depends_on: input.depends_on,
+        executor: 'shell',
+        role: 'verifier',
+        complexity: 'LOW',
+        writePolicy: input.writePolicy ?? 'read-only',
+        allowedPaths: [],
+        forbiddenPaths: ['.harness/dag-runs/completed/**', 'artifacts/**'],
+        shell: {
+            commands: input.commands,
+            timeoutMs: 600_000,
+        },
+        outputContract: input.outputContract,
+        subtask_prompt: input.outputContract,
+    };
+}
+function taskDeclaresReleaseImpact(taskConfig) {
+    const haystack = [
+        taskConfig.notes ?? '',
+        ...(taskConfig.hardConstraints ?? []),
+        ...(taskConfig.sourceFiles ?? []),
+    ].join('\n');
+    return /changeset|release|publish|version/i.test(haystack);
+}

package/dist/workflows/dag/governance-constants.js

@@ -0,0 +1,5 @@
+export const BASELINE_FORBIDDEN_PATHS = [
+    ".harness/**",
+    ".harness/dag-runs/**",
+    "artifacts/**",
+];