@tea-agent/loop-agent 0.1.0

package/dist/workflows/dag/init-hybrid.js

@@ -0,0 +1,855 @@
+import { access, readFile, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { assertValidDagSpec } from "./validate.js";
+import { parseDagSpec, } from "./types.js";
+import { pathMatchesPattern } from "../../shared/git-progress.js";
+import { BASELINE_FORBIDDEN_PATHS } from "./governance-constants.js";
+import { resolveAdapter } from "../../adapters/index.js";
+import { loadHarnessManifest } from "../../governance/harness.js";
+import { buildAuthoritySurfaceAuditNode, buildAuthoritySurfaceGateNode, resolveAuthoritySurfaceAudit, } from "./authority-surface.js";
+import { getTaskPaths, loadTaskConfig } from "../../task/runtime.js";
+import { resolveVerifyPreset } from "../../executors/shell-verification.js";
+const REQUIREMENT_FILE = "需求.md";
+const CONSTRAINT_FILE = "执行约束.md";
+const MAX_SOURCE_EXCERPT_CHARS = 2000;
+const HYBRID_DEFAULTS = {
+    executor: "pi",
+    piBackend: "sdk-first",
+    contextProfile: "slim",
+    skills: ["ai-engineering-context"],
+    writePolicy: "read-only",
+};
+const HYBRID_SKILLS_BY_ROLE = {
+    planner: ["loop-agent"],
+    scout: ["ai-engineering-context"],
+    implementer: ["verification-before-completion"],
+    reviewer: ["requesting-code-review"],
+    verifier: ["verification-before-completion", "systematic-debugging"],
+    closeout: ["loop-agent", "verification-before-completion"],
+};
+const IMPLEMENT_WRITESET_PLACEHOLDER = "REPLACE/WITH/NARROW/IMPLEMENT/PATHS/**";
+function resolveEnabledExecutors(manifestExecutors) {
+    return Object.entries(manifestExecutors)
+        .filter(([, config]) => config.enabled !== false)
+        .map(([name]) => name);
+}
+function resolveImplementationExecutor(sources) {
+    const enabled = sources.enabledExecutors
+        ? new Set(sources.enabledExecutors)
+        : undefined;
+    if (!enabled || enabled.has("pi"))
+        return "pi";
+    if (enabled.has("cursor"))
+        return "cursor";
+    return "pi";
+}
+function implementationNodeId(executor) {
+    return executor === "cursor" ? "implement-cursor" : "implement-pi";
+}
+function repairNodeId(executor) {
+    return executor === "cursor" ? "repair-cursor" : "repair-pi";
+}
+function probePathsForWriteSetEntry(entry) {
+    const normalized = entry.replace(/\\/g, "/").replace(/^\.\//, "");
+    if (!normalized.includes("*")) {
+        return [normalized];
+    }
+    const concrete = normalized
+        .replace(/\/\*\*$/, "/_probe_")
+        .replace(/\*\*$/, "_probe_")
+        .replace(/\*/g, "_");
+    return Array.from(new Set([normalized, concrete]));
+}
+function allowedPathHitsBaselineForbidden(allowedPath) {
+    const probes = probePathsForWriteSetEntry(allowedPath);
+    for (const forbidden of BASELINE_FORBIDDEN_PATHS) {
+        if (probes.some((probe) => pathMatchesPattern(probe, forbidden)) ||
+            pathMatchesPattern(allowedPath, forbidden) ||
+            pathMatchesPattern(forbidden, allowedPath)) {
+            return forbidden;
+        }
+    }
+    return undefined;
+}
+export function assertTaskAllowedPathsPreflight(taskConfig) {
+    for (const allowedPath of taskConfig.allowedPaths) {
+        const forbidden = allowedPathHitsBaselineForbidden(allowedPath);
+        if (forbidden) {
+            throw new Error(`task allowedPaths entry "${allowedPath}" overlaps baseline forbidden path "${forbidden}"; task source paths are main-session owned and must not be executor writeSet`);
+        }
+    }
+}
+const STANDARD_GLOBAL_CONSTRAINTS = [
+    "Do not commit runtime traces under .harness/dag-runs/",
+    "Do not enable cross-node Pi runtime reuse by default",
+    "Preserve CODE_AGENT_PI_BACKEND=cli-only rollback for Pi nodes",
+    "Same-rank exclusive writeSet entries must be disjoint",
+    "Every task must explicitly declare executor; defaults.executor is schema-only and not a runtime fallback",
+    "Prefer same-rank parallel read-only scouts over serial chains when outputs are independent",
+    "If the DAG is a single linear chain, challenge whether read-only work can run in parallel ranks",
+    "Read-only DAG nodes must not write repository files, including root artifacts/**; return findings in node output only",
+    "Root artifacts/ is reserved for explicit exclusive write nodes, not read-only scout/reviewer output",
+    "exclusive implementer nodes must use narrow, concrete writeSet paths; never keep ** or repo root",
+    `Replace ${IMPLEMENT_WRITESET_PLACEHOLDER} with concrete paths before executing the implementation writer`,
+];
+function mapTaskComplexity(complexity) {
+    if (complexity === "small")
+        return "LOW";
+    if (complexity === "large")
+        return "HIGH";
+    return "MED";
+}
+function excerptMarkdown(content, maxChars = MAX_SOURCE_EXCERPT_CHARS) {
+    const trimmed = content.trim();
+    if (trimmed.length <= maxChars)
+        return trimmed;
+    return `${trimmed.slice(0, maxChars)}\n\n...[truncated for draft prompt]`;
+}
+function extractObjective(requirementMarkdown, title) {
+    const lines = requirementMarkdown.split("\n");
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        return trimmed.slice(0, 500);
+    }
+    return `Implement task: ${title}`;
+}
+function extractSuccessCriteria(requirementMarkdown, taskId) {
+    const criteria = [];
+    const sectionMatch = requirementMarkdown.match(/##\s*验收标准\s*\n([\s\S]*?)(?=\n##\s|\n#\s|$)/);
+    if (sectionMatch) {
+        for (const line of sectionMatch[1].split("\n")) {
+            const trimmed = line.replace(/^[-*]\s*\[[ xX]\]\s*/, "").trim();
+            if (trimmed.startsWith("-") || trimmed.startsWith("*")) {
+                criteria.push(trimmed.replace(/^[-*]\s*/, "").trim());
+            }
+            else if (trimmed.length > 0 && !trimmed.startsWith("#")) {
+                criteria.push(trimmed);
+            }
+        }
+    }
+    if (criteria.length > 0)
+        return criteria.slice(0, 8);
+    return [
+        `contract-pi produces an auditable read-only implementation contract for ${taskId}`,
+        "scout-src and scout-tests complete parallel read-only reconnaissance without file writes",
+        "plan-pi returns a read-only implementation plan aligned with constraints",
+        "the implementation writer changes only paths declared in writeSet",
+        "verify-pi returns read-only verification strategy and residual risks",
+        "closeout-pi returns read-only handoff summary without writing artifacts/docs",
+    ];
+}
+function mergeForbiddenPaths(taskConfig) {
+    const merged = new Set([
+        ".harness/**",
+        ".harness/dag-runs/**",
+        "artifacts/**",
+        ...taskConfig.forbiddenPaths,
+    ]);
+    return [...merged];
+}
+function resolveImplementPaths(taskConfig) {
+    if (taskConfig.allowedPaths.length > 0) {
+        const allowed = [...taskConfig.allowedPaths];
+        return {
+            allowedPaths: allowed,
+            writeSet: [...allowed],
+        };
+    }
+    return {
+        allowedPaths: ["**"],
+        writeSet: [IMPLEMENT_WRITESET_PLACEHOLDER],
+    };
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function verifyCommandToShell(repoRoot, command) {
+    const relativeCwd = path.relative(repoRoot, command.cwd);
+    const cwdPrefix = relativeCwd && !relativeCwd.startsWith("..") && !path.isAbsolute(relativeCwd)
+        ? `cd ${shellQuote(relativeCwd)} && `
+        : command.cwd !== repoRoot
+            ? `cd ${shellQuote(command.cwd)} && `
+            : "";
+    const envPrefix = [
+        ...(command.args.includes("scripts/check-repo.sh")
+            ? ["HARNESS_ALLOW_ACTIVE_DAG_RUNS=1"]
+            : []),
+        ...Object.entries(command.env ?? {}).map(([key, value]) => `${key}=${shellQuote(String(value))}`),
+    ].join(" ");
+    const commandText = command.args.map(shellQuote).join(" ");
+    return `${cwdPrefix}${envPrefix ? `${envPrefix} ` : ""}${commandText}`;
+}
+function buildVerifyShellCommands(input) {
+    if (!input.repoRoot || !input.commands || input.commands.length === 0) {
+        return input.fallbackCommands;
+    }
+    const repoRoot = input.repoRoot;
+    return input.commands.map((command) => verifyCommandToShell(repoRoot, command));
+}
+function resolveDagVerifyStrategy(taskConfig) {
+    return {
+        intermediateQuota: taskConfig.dagVerifyStrategy?.intermediateQuota ?? taskConfig.verifyQuota,
+        finalQuota: "full",
+        focusedCommandSource: taskConfig.dagVerifyStrategy?.focusedCommandSource ?? "adapter",
+    };
+}
+function buildVerifyEvidence(input) {
+    return {
+        phase: input.phase,
+        quota: input.quota,
+        commandSource: input.commandSource,
+        commandCount: input.commands?.length ?? input.fallbackCommands.length,
+        commandLabels: input.commands?.map((command) => command.label) ?? input.fallbackCommands,
+        finalFullRequired: input.finalFullRequired,
+    };
+}
+function deriveParallelScoutPaths(taskConfig) {
+    const allowed = taskConfig.allowedPaths;
+    if (allowed.length === 0) {
+        return { srcPaths: ["**"], testPaths: ["**"] };
+    }
+    const srcPaths = allowed.filter((entry) => !entry.includes("/test/"));
+    const explicitTestPaths = allowed.filter((entry) => entry.includes("/test/"));
+    const derivedTestPaths = allowed
+        .filter((entry) => entry.includes("/src/"))
+        .map((entry) => entry.replace("/src/", "/test/"));
+    return {
+        srcPaths: srcPaths.length > 0 ? srcPaths : allowed,
+        testPaths: explicitTestPaths.length > 0
+            ? explicitTestPaths
+            : derivedTestPaths.length > 0
+                ? derivedTestPaths
+                : allowed,
+    };
+}
+function buildSourceContextBlock(sources) {
+    const parts = [
+        "## Task source: 需求.md",
+        excerptMarkdown(sources.requirementMarkdown),
+    ];
+    if (sources.constraintMarkdown) {
+        parts.push("## Task source: 执行约束.md", excerptMarkdown(sources.constraintMarkdown));
+    }
+    parts.push("## Task config summary", `- taskId: ${sources.taskConfig.taskId}`, `- flow: ${sources.taskConfig.flow}`, `- complexity: ${sources.taskConfig.complexity}`, `- contextProfile: ${sources.taskConfig.contextProfile}`, `- allowedPaths: ${sources.taskConfig.allowedPaths.join(", ") || "(none — review before execute)"}`, `- forbiddenPaths: ${sources.taskConfig.forbiddenPaths.join(", ") || "(none)"}`, '- Pi DAG nodes are read-only unless toolProfile="write" is explicitly selected for a bounded writer node.', "- Agent DAG read-only nodes must not write root artifacts/**; root artifacts/ is not a per-node scratchpad.");
+    if (sources.taskConfig.hardConstraints.length > 0) {
+        parts.push("- hardConstraints:", ...sources.taskConfig.hardConstraints.map((c) => `  - ${c}`));
+    }
+    return parts.join("\n\n");
+}
+export async function loadTaskHybridSources(repoRoot, taskId) {
+    const paths = getTaskPaths(repoRoot, taskId);
+    const requirementPath = path.join(paths.sourceDir, REQUIREMENT_FILE);
+    const constraintPath = path.join(paths.sourceDir, CONSTRAINT_FILE);
+    try {
+        await access(paths.taskConfigPath);
+    }
+    catch {
+        throw new Error(`task.json not found for task "${taskId}": expected ${paths.taskConfigPath}`);
+    }
+    let requirementMarkdown;
+    try {
+        requirementMarkdown = await readFile(requirementPath, "utf-8");
+    }
+    catch {
+        throw new Error(`required source file missing for task "${taskId}": ${requirementPath}`);
+    }
+    let constraintMarkdown = null;
+    try {
+        constraintMarkdown = await readFile(constraintPath, "utf-8");
+    }
+    catch {
+        // optional
+    }
+    const taskConfig = await loadTaskConfig(repoRoot, taskId);
+    const manifest = await loadHarnessManifest(repoRoot);
+    const strategy = resolveDagVerifyStrategy(taskConfig);
+    let verifyCommands;
+    try {
+        const adapter = await resolveAdapter(repoRoot);
+        const preset = resolveVerifyPreset(taskConfig.verifyPreset, taskConfig);
+        verifyCommands = {
+            intermediate: adapter.getVerifyCommands(repoRoot, {
+                preset,
+                quota: strategy.intermediateQuota,
+                phase: "intermediate",
+                taskConfig,
+            }),
+            final: adapter.getVerifyCommands(repoRoot, {
+                preset,
+                quota: "full",
+                phase: "final",
+                taskConfig,
+            }),
+        };
+        if (verifyCommands.final.length === 0) {
+            throw new Error("adapter returned no final verification commands");
+        }
+    }
+    catch (error) {
+        throw new Error(`failed to load verification commands for task "${taskId}": ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return {
+        taskId,
+        repoRoot,
+        taskDir: paths.taskDir,
+        requirementPath,
+        constraintPath,
+        requirementMarkdown,
+        constraintMarkdown,
+        taskConfig,
+        enabledExecutors: resolveEnabledExecutors(manifest.executors),
+        verifyCommands,
+    };
+}
+export function buildStandardHybridDagFromTask(sources) {
+    const { taskConfig } = sources;
+    const forbiddenPaths = mergeForbiddenPaths(taskConfig);
+    const implementPaths = resolveImplementPaths(taskConfig);
+    const scoutPaths = deriveParallelScoutPaths(taskConfig);
+    const scoutComplexity = mapTaskComplexity(taskConfig.complexity);
+    const implementComplexity = taskConfig.complexity === "small"
+        ? "MED"
+        : taskConfig.complexity === "large"
+            ? "HIGH"
+            : "MED";
+    const writerExecutor = resolveImplementationExecutor(sources);
+    const implementId = implementationNodeId(writerExecutor);
+    const sourceContext = buildSourceContextBlock(sources);
+    const globalConstraints = [
+        ...taskConfig.hardConstraints,
+        ...(sources.constraintMarkdown
+            ? [`See 执行约束.md in task source (${sources.taskId})`]
+            : []),
+        ...STANDARD_GLOBAL_CONSTRAINTS,
+    ];
+    const spec = {
+        version: 2,
+        title: `Hybrid DAG: ${taskConfig.title}`,
+        objective: extractObjective(sources.requirementMarkdown, taskConfig.title),
+        successCriteria: extractSuccessCriteria(sources.requirementMarkdown, sources.taskId),
+        globalConstraints,
+        defaults: {
+            ...HYBRID_DEFAULTS,
+            contextProfile: taskConfig.contextProfile,
+        },
+        skillsByRole: HYBRID_SKILLS_BY_ROLE,
+        executorModels: {
+            cursor: {
+                LOW: "composer-2.5",
+                MED: "composer-2.5",
+                HIGH: "composer-2.5",
+            },
+            pi: {
+                LOW: "gpt-5.3-codex-spark",
+                MED: "glm-5.2",
+                HIGH: "gpt-5.5",
+            },
+        },
+        tasks: [
+            {
+                id: "contract-pi",
+                depends_on: [],
+                role: "planner",
+                executor: "pi",
+                complexity: "MED",
+                writePolicy: "read-only",
+                allowedPaths: taskConfig.allowedPaths.length > 0 ? taskConfig.allowedPaths : ["**"],
+                forbiddenPaths,
+                outputContract: "Plain Markdown implementation contract (10 lines or fewer); no file writes.",
+                subtask_prompt: [
+                    "Read the task source materials and return a concise implementation contract (10 lines or fewer).",
+                    "Cover scope, risks, and verification expectations. Read-only: do not modify code, docs, artifacts, or repository files.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+            {
+                id: "scout-src",
+                depends_on: ["contract-pi"],
+                role: "scout",
+                executor: "pi",
+                complexity: scoutComplexity,
+                writePolicy: "read-only",
+                allowedPaths: scoutPaths.srcPaths,
+                forbiddenPaths,
+                outputContract: "Plain Markdown source reconnaissance summary; no file writes.",
+                subtask_prompt: [
+                    "Perform read-only source reconnaissance for the task scope.",
+                    "List key source files, existing patterns, and integration points. Do not modify files.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+            {
+                id: "scout-tests",
+                depends_on: ["contract-pi"],
+                role: "scout",
+                executor: "pi",
+                complexity: scoutComplexity,
+                writePolicy: "read-only",
+                allowedPaths: scoutPaths.testPaths,
+                forbiddenPaths,
+                outputContract: "Plain Markdown test coverage reconnaissance summary; no file writes.",
+                subtask_prompt: [
+                    "Perform read-only test reconnaissance for the task scope.",
+                    "List relevant tests, coverage gaps, and verification commands. Do not modify files.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+            {
+                id: "plan-pi",
+                depends_on: ["scout-src", "scout-tests"],
+                role: "planner",
+                executor: "pi",
+                complexity: "MED",
+                writePolicy: "read-only",
+                allowedPaths: taskConfig.allowedPaths.length > 0 ? taskConfig.allowedPaths : ["**"],
+                forbiddenPaths,
+                outputContract: "Plain Markdown implementation plan; no file writes.",
+                subtask_prompt: [
+                    "Based on contract-pi, scout-src, and scout-tests upstream output, return a minimal implementation plan.",
+                    "Identify ordered steps, narrow writeSet boundaries, and verification commands. Read-only: do not modify code, docs, artifacts, or repository files.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+            {
+                id: implementId,
+                depends_on: ["plan-pi"],
+                role: "implementer",
+                executor: writerExecutor,
+                toolProfile: "write",
+                complexity: implementComplexity,
+                writePolicy: "exclusive",
+                writeSet: implementPaths.writeSet,
+                allowedPaths: implementPaths.allowedPaths,
+                forbiddenPaths,
+                subtask_prompt: [
+                    "Implement the approved plan with minimal focused changes.",
+                    "Stay within writeSet. Do not write root artifacts/** unless artifacts paths are explicitly declared in writeSet.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+            {
+                id: "verify-pi",
+                depends_on: [implementId],
+                role: "verifier",
+                executor: "pi",
+                complexity: "MED",
+                writePolicy: "read-only",
+                allowedPaths: taskConfig.allowedPaths.length > 0 ? taskConfig.allowedPaths : ["**"],
+                forbiddenPaths,
+                outputContract: "Plain Markdown verification matrix and residual risks; no file writes.",
+                subtask_prompt: [
+                    "Review upstream implementation and return the verification matrix.",
+                    `Task verifyMode=${taskConfig.verifyMode}, verifyPreset=${taskConfig.verifyPreset}.`,
+                    "List commands to run, expected pass/fail evidence, and residual risks. Read-only: do not modify code, docs, artifacts, or repository files.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+            {
+                id: "closeout-pi",
+                depends_on: ["verify-pi"],
+                role: "closeout",
+                executor: "pi",
+                complexity: "MED",
+                writePolicy: "read-only",
+                allowedPaths: taskConfig.allowedPaths.length > 0
+                    ? [...taskConfig.allowedPaths, "docs/**"]
+                    : ["**", "docs/**"],
+                forbiddenPaths,
+                outputContract: "Plain Markdown closeout summary; no file writes.",
+                subtask_prompt: [
+                    "Return closeout summary: what changed, verification status, risks, and handoff notes.",
+                    "Read-only: do not modify code, docs, artifacts, or .harness/dag-runs/.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+        ],
+    };
+    parseDagSpec(spec);
+    assertValidDagSpec(spec);
+    return spec;
+}
+export function buildHybridDagFromTask(sources, options = {}) {
+    const standard = buildStandardHybridDagFromTask(sources);
+    const template = options.template ?? "standard-dag";
+    if (template === "standard-dag")
+        return standard;
+    if (template === "review-gated-dag")
+        return buildReviewGatedHybridDag(standard, sources);
+    return buildSupervisedHybridDag(standard, sources);
+}
+function cloneTask(task, patch = {}) {
+    return { ...task, ...patch };
+}
+function getTaskOrThrow(spec, id) {
+    const task = spec.tasks.find((item) => item.id === id);
+    if (!task)
+        throw new Error(`generated DAG missing expected node: ${id}`);
+    return task;
+}
+function replaceTask(spec, task) {
+    const index = spec.tasks.findIndex((item) => item.id === task.id);
+    if (index < 0)
+        throw new Error(`generated DAG missing expected node: ${task.id}`);
+    spec.tasks[index] = task;
+}
+function commonReadOnlyPaths(sources) {
+    return sources.taskConfig.allowedPaths.length > 0
+        ? sources.taskConfig.allowedPaths
+        : ["**"];
+}
+function commonForbiddenPaths(sources) {
+    return mergeForbiddenPaths(sources.taskConfig);
+}
+function buildReviewNode(sources) {
+    return {
+        id: "review-pi",
+        depends_on: ["verify-pi"],
+        role: "reviewer",
+        executor: "pi",
+        complexity: "HIGH",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Plain Markdown whose first non-empty line is VERDICT: pass or VERDICT: request-revision; Critical/Important findings force request-revision. No file writes.",
+        subtask_prompt: [
+            "Review upstream implementation and verification evidence.",
+            "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.",
+            "List Critical/Important findings when present; any Critical/Important finding must force request-revision. Read-only: do not modify files.",
+            buildSourceContextBlock(sources),
+        ].join("\n\n"),
+    };
+}
+function buildReviewGateNode(sources) {
+    return {
+        id: "review-gate-shell",
+        depends_on: ["review-pi"],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Deterministic review verdict gate: exit 0 only when review-pi first non-empty assistant output line is pass.",
+        subtask_prompt: "Deterministic gate: block downstream closeout unless review-pi emitted VERDICT: pass.",
+        shell: {
+            commands: [],
+            verdictGate: {
+                fromNodeId: "review-pi",
+                accept: ["VERDICT: pass"],
+                label: "review",
+                lineMode: "first-verdict-line",
+            },
+            cwd: ".",
+            timeoutMs: 60000,
+        },
+    };
+}
+function buildReviewGatedHybridDag(standard, sources) {
+    const spec = {
+        ...standard,
+        title: `Review-gated ${standard.title}`,
+        objective: `${standard.objective ?? ""}\n\nRoute: review-gated DAG selected by workflowPolicy/governanceProfile.`.trim(),
+        globalConstraints: [
+            ...(standard.globalConstraints ?? []),
+            "Review-gated DAGs must block closeout unless review-pi emits first-line VERDICT: pass.",
+        ],
+        tasks: standard.tasks.map((task) => ({ ...task })),
+    };
+    const closeout = getTaskOrThrow(spec, "closeout-pi");
+    replaceTask(spec, cloneTask(closeout, { depends_on: ["review-gate-shell"] }));
+    spec.tasks.splice(spec.tasks.length - 1, 0, buildReviewNode(sources), buildReviewGateNode(sources));
+    parseDagSpec(spec);
+    assertValidDagSpec(spec);
+    return spec;
+}
+function buildWriteSetAuditNode(sources) {
+    return {
+        id: "write-set-audit-pi",
+        depends_on: ["plan-pi"],
+        role: "reviewer",
+        executor: "pi",
+        complexity: "MED",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Plain Markdown whose first non-empty line is VERDICT: pass or VERDICT: request-revision; includes writeSet coverage findings. No file writes.",
+        subtask_prompt: [
+            "Audit plan-pi writeSet coverage against task constraints.",
+            "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.",
+            "Request revision if required files lack a single exclusive owner, writeSet is broad/placeholder, or forbidden paths overlap. Do not edit files.",
+            buildSourceContextBlock(sources),
+        ].join("\n\n"),
+    };
+}
+function buildWriteSetGateNode(sources) {
+    return {
+        id: "write-set-gate-shell",
+        depends_on: ["write-set-audit-pi"],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Deterministic write-set audit verdict gate: exit 0 only when write-set-audit-pi first non-empty assistant output line is pass.",
+        subtask_prompt: "Deterministic gate: block the implementation writer unless write-set-audit-pi emitted VERDICT: pass.",
+        shell: {
+            commands: [],
+            verdictGate: {
+                fromNodeId: "write-set-audit-pi",
+                accept: ["VERDICT: pass"],
+                label: "write-set audit",
+                lineMode: "first-verdict-line",
+            },
+            cwd: ".",
+            timeoutMs: 60000,
+        },
+    };
+}
+function buildSoftVerifyNode(sources) {
+    const implementId = implementationNodeId(resolveImplementationExecutor(sources));
+    const strategy = resolveDagVerifyStrategy(sources.taskConfig);
+    const fallbackCommands = ["npm run typecheck"];
+    const commands = buildVerifyShellCommands({
+        repoRoot: sources.repoRoot,
+        commands: sources.verifyCommands?.intermediate,
+        fallbackCommands,
+    });
+    return {
+        id: "soft-verify-shell",
+        depends_on: [implementId],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Archived shell stdout/stderr with exit codes for focused verification; no worktree writes.",
+        subtask_prompt: "Run focused soft verification before process supervision.",
+        shell: {
+            commands,
+            verifyEvidence: buildVerifyEvidence({
+                phase: "intermediate",
+                quota: strategy.intermediateQuota ?? "full",
+                commandSource: sources.verifyCommands ? "adapter" : "inline",
+                commands: sources.verifyCommands?.intermediate,
+                fallbackCommands,
+            }),
+            cwd: ".",
+            timeoutMs: 300000,
+        },
+    };
+}
+function buildProcessSupervisorNode(sources) {
+    const implementId = implementationNodeId(resolveImplementationExecutor(sources));
+    const repairId = repairNodeId(resolveImplementationExecutor(sources));
+    return {
+        id: "process-supervisor-pi",
+        depends_on: ["soft-verify-shell", implementId],
+        role: "supervisor",
+        executor: "pi",
+        complexity: "HIGH",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Plain Markdown whose first non-empty line is VERDICT: pass or VERDICT: request-revision, followed by a REPAIR_ARTIFACT_JSON fenced block. Audit writeSet coverage, boundary drift, verification gaps, repair scope. No file writes.",
+        subtask_prompt: [
+            "Supervise the implementation process after soft verification.",
+            "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.",
+            "Immediately after the verdict, include one fenced block labelled REPAIR_ARTIFACT_JSON with this JSON shape:",
+            '{"schemaVersion":1,"verdict":"pass|request-revision","failureClass":"syntax|runtime|logic|boundary|environment|governance|unknown","rootCause":"one concise reason","fixScope":["path/or/component"],"invariant":"behavior or contract to preserve","evidenceRefs":["relative/path/or/node"],"rawLogFallbackAllowed":false}',
+            `For request-revision, fixScope must be inside ${repairId} allowedPaths/writeSet. For pass, use an empty fixScope array.`,
+            `Audit boundary drift, verification gaps, and whether ${repairId} should perform bounded fixes. Read-only: do not modify files.`,
+            buildSourceContextBlock(sources),
+        ].join("\n\n"),
+    };
+}
+function buildProcessGateNode(sources) {
+    return {
+        id: "process-gate-shell",
+        depends_on: ["process-supervisor-pi"],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Deterministic process supervisor verdict gate: exit 0 when first non-empty assistant output line is pass or request-revision; exit non-zero otherwise.",
+        subtask_prompt: "Deterministic gate: validate process-supervisor-pi first-line VERDICT before repair/hard-verify.",
+        shell: {
+            commands: [],
+            verdictGate: {
+                fromNodeId: "process-supervisor-pi",
+                accept: ["VERDICT: pass", "VERDICT: request-revision"],
+                label: "process",
+                lineMode: "first-verdict-line",
+            },
+            repairArtifactGate: {
+                fromNodeId: "process-supervisor-pi",
+            },
+            cwd: ".",
+            timeoutMs: 60000,
+        },
+    };
+}
+function buildRepairNode(sources) {
+    const writerExecutor = resolveImplementationExecutor(sources);
+    const implement = resolveImplementPaths(sources.taskConfig);
+    return {
+        id: repairNodeId(writerExecutor),
+        depends_on: ["process-gate-shell", "process-supervisor-pi"],
+        role: "implementer",
+        executor: writerExecutor,
+        toolProfile: "write",
+        complexity: sources.taskConfig.complexity === "small" ? "MED" : "HIGH",
+        writePolicy: "exclusive",
+        writeSet: implement.writeSet,
+        allowedPaths: implement.allowedPaths,
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Repair summary or explicit no-op when process supervisor passed; changed files and tests when revised. Must not ask main session to write artifacts.",
+        subtask_prompt: [
+            "If process-supervisor-pi returned VERDICT: request-revision, apply bounded fixes within writeSet addressing its REPAIR_ARTIFACT_JSON.fixScope and preserving REPAIR_ARTIFACT_JSON.invariant.",
+            "Use REPAIR_ARTIFACT_JSON.failureClass and rootCause to choose the smallest repair strategy. Raw log is fallback evidence only when rawLogFallbackAllowed is true.",
+            "If VERDICT: pass, return no-op with evidence. Re-run focused tests when you change code.",
+            buildSourceContextBlock(sources),
+        ].join("\n\n"),
+    };
+}
+function buildHardVerifyNode(sources) {
+    const repairId = repairNodeId(resolveImplementationExecutor(sources));
+    const fallbackCommands = [
+        "HARNESS_ALLOW_ACTIVE_DAG_RUNS=1 bash scripts/check-repo.sh",
+    ];
+    const commands = buildVerifyShellCommands({
+        repoRoot: sources.repoRoot,
+        commands: sources.verifyCommands?.final,
+        fallbackCommands,
+    });
+    return {
+        id: "hard-verify-shell",
+        depends_on: [repairId],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: ["./**", "docs/**", "scripts/**"],
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Archived hard verification stdout/stderr with exit codes; no worktree writes.",
+        subtask_prompt: "Run hard verification after repair round.",
+        shell: {
+            commands,
+            verifyEvidence: buildVerifyEvidence({
+                phase: "final",
+                quota: "full",
+                commandSource: sources.verifyCommands ? "adapter" : "inline",
+                commands: sources.verifyCommands?.final,
+                fallbackCommands,
+                finalFullRequired: true,
+            }),
+            cwd: ".",
+            timeoutMs: 300000,
+        },
+    };
+}
+function buildDecisionNode(sources) {
+    return {
+        id: "decision-pi",
+        depends_on: ["review-gate-shell", "hard-verify-shell"],
+        role: "reviewer",
+        executor: "pi",
+        complexity: "HIGH",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Markdown with exactly one DECISION_ENVELOPE_JSON fenced block plus evidence summary. No file writes.",
+        subtask_prompt: [
+            "Return an advisory Decision Gate envelope for the supervised DAG outcome.",
+            "Include exactly one DECISION_ENVELOPE_JSON fenced block and concise evidence. Read-only: do not modify files.",
+            buildSourceContextBlock(sources),
+        ].join("\n\n"),
+        decisionGate: { enabled: true, schemaVersion: 1, mode: "record-only" },
+    };
+}
+function buildSupervisedHybridDag(standard, sources) {
+    const contract = getTaskOrThrow(standard, "contract-pi");
+    const scoutSrc = getTaskOrThrow(standard, "scout-src");
+    const scoutTests = getTaskOrThrow(standard, "scout-tests");
+    const plan = getTaskOrThrow(standard, "plan-pi");
+    const implement = getTaskOrThrow(standard, implementationNodeId(resolveImplementationExecutor(sources)));
+    const closeout = getTaskOrThrow(standard, "closeout-pi");
+    const authorityDecision = resolveAuthoritySurfaceAudit(sources);
+    const reviewDependsOn = authorityDecision.enabled
+        ? ["authority-surface-gate-shell"]
+        : ["hard-verify-shell"];
+    const supervisedConstraints = [
+        ...(standard.globalConstraints ?? []),
+        "Supervised DAGs must use write-set, process, hard-verification, review, and decision gates before closeout.",
+        "Shell governance inside active DAG must use HARNESS_ALLOW_ACTIVE_DAG_RUNS=1 bash scripts/check-repo.sh.",
+    ];
+    if (authorityDecision.enabled) {
+        supervisedConstraints.push("Authority surface audit gate must fail closed without explicit VERDICT: pass from authority-surface-audit-pi.");
+    }
+    const spec = {
+        ...standard,
+        title: `Supervised ${standard.title}`,
+        objective: `${standard.objective ?? ""}\n\nRoute: supervised implementation DAG selected by workflowPolicy/governanceProfile or explicit CLI profile.`.trim(),
+        globalConstraints: supervisedConstraints,
+        convergence: sources.taskConfig.convergence,
+        verifyStrategy: resolveDagVerifyStrategy(sources.taskConfig),
+        tasks: [
+            cloneTask(contract),
+            cloneTask(scoutSrc),
+            cloneTask(scoutTests),
+            cloneTask(plan),
+            buildWriteSetAuditNode(sources),
+            buildWriteSetGateNode(sources),
+            cloneTask(implement, { depends_on: ["write-set-gate-shell"] }),
+            buildSoftVerifyNode(sources),
+            buildProcessSupervisorNode(sources),
+            buildProcessGateNode(sources),
+            buildRepairNode(sources),
+            buildHardVerifyNode(sources),
+            ...(authorityDecision.enabled
+                ? [
+                    buildAuthoritySurfaceAuditNode(sources),
+                    buildAuthoritySurfaceGateNode(sources),
+                ]
+                : []),
+            cloneTask(buildReviewNode(sources), {
+                depends_on: reviewDependsOn,
+            }),
+            buildReviewGateNode(sources),
+            buildDecisionNode(sources),
+            cloneTask(closeout, { depends_on: ["decision-pi"] }),
+        ],
+    };
+    parseDagSpec(spec);
+    assertValidDagSpec(spec);
+    return spec;
+}
+export function defaultHybridDagOutputPath(taskId) {
+    return path.join(os.tmpdir(), `${taskId}-hybrid-dag.json`);
+}
+export async function writeHybridDagDraft(sources, outputPath, options = {}) {
+    const template = options.template ?? "standard-dag";
+    const spec = buildHybridDagFromTask(sources, { template });
+    await writeFile(outputPath, `${JSON.stringify(spec, null, 2)}\n`, "utf-8");
+    return {
+        taskId: sources.taskId,
+        outputPath,
+        taskCount: spec.tasks.length,
+        nodeIds: spec.tasks.map((task) => task.id),
+        template,
+    };
+}
+export async function initHybridDagFromTask(repoRoot, taskId, options = {}) {
+    const sources = await loadTaskHybridSources(repoRoot, taskId);
+    assertTaskAllowedPathsPreflight(sources.taskConfig);
+    const outputPath = options.outputPath ?? defaultHybridDagOutputPath(taskId);
+    return writeHybridDagDraft(sources, outputPath, {
+        template: options.template,
+    });
+}