@tea-agent/loop-agent 0.10.0 → 0.12.0

package/dist/workflows/dag/init-hybrid.js

@@ -2,12 +2,14 @@ import { access, readdir, readFile, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { assertValidDagSpec } from "./validate.js";
-import { DEFAULT_DAG_OUTPUT_LANGUAGE, DEFAULT_DAG_EXECUTOR_MODELS, parseDagSpec, } from "./types.js";
+import { DAG_AGENT_RUNTIME_PI_ONLY, DAG_REPAIR_WRITER_PROTOCOL_EXPLICIT_NODE_V1, DAG_RUNTIME_CONTRACT_SCHEMA_VERSION, DEFAULT_DAG_OUTPUT_LANGUAGE, DEFAULT_DAG_EXECUTOR_MODELS, parseDagSpec, } from "./types.js";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
 import { BASELINE_FORBIDDEN_PATHS } from "./governance-constants.js";
+import { DEFAULT_READ_ONLY_PI_RETRY_POLICY, isSafeReadOnlyPiRetryCandidate } from "./retry-policy.js";
 import { resolveAdapter } from "../../adapters/index.js";
 import { loadHarnessManifest } from "../../governance/harness.js";
 import { buildAuthoritySurfaceAuditNode, buildAuthoritySurfaceGateNode, resolveAuthoritySurfaceAudit, } from "./authority-surface.js";
+import { applySddEmbeddedEnhancements, probeRepoLocalSddSkills, } from "./sdd-embedded.js";
 import { getTaskPaths, loadTaskConfig } from "../../task/runtime.js";
 import { materializeTaskReferenceDocs } from "../../task/source-references.js";
 import { resolveVerifyPreset } from "../../executors/shell-verification.js";
@@ -58,27 +60,50 @@ const HYBRID_SKILLS_BY_ROLE = {
     verifier: ["verification-before-completion", "systematic-debugging"],
     closeout: ["loop-agent", "verification-before-completion"],
 };
+const FRONTEND_DEFAULTS = {
+    ...HYBRID_DEFAULTS,
+    skills: [],
+};
+const FRONTEND_SKILLS_BY_ROLE = {
+    planner: [],
+    scout: [],
+    implementer: [],
+    reviewer: [],
+    supervisor: [],
+    verifier: [],
+    closeout: [],
+};
+const FRONTEND_IMPLEMENTATION_SKILLS = ["frontend-implementation"];
+const FRONTEND_DESIGN_REVIEW_SKILLS = ["frontend-design-review"];
+const FRONTEND_REVIEW_SKILLS = ["frontend-review"];
+const FRONTEND_VERIFICATION_SKILLS = ["frontend-verification"];
 const IMPLEMENT_WRITESET_PLACEHOLDER = "REPLACE/WITH/NARROW/IMPLEMENT/PATHS/**";
+/**
+ * Runtime contract stamped on every newly generated DAG. Capability fields are
+ * authoritative and are the primary compatibility gate. `minimumControllerVersion`
+ * is intentionally omitted here: it is an optional diagnostic hint, and hardcoding
+ * a future version would make a controller reject the very DAGs it generates.
+ * Operators can still pin a minimum version on hand-authored specs when needed.
+ */
+export const GENERATED_DAG_RUNTIME_CONTRACT = {
+    schemaVersion: DAG_RUNTIME_CONTRACT_SCHEMA_VERSION,
+    agentRuntime: DAG_AGENT_RUNTIME_PI_ONLY,
+    repairWriterProtocol: DAG_REPAIR_WRITER_PROTOCOL_EXPLICIT_NODE_V1,
+};
 function resolveEnabledExecutors(manifestExecutors) {
     return Object.entries(manifestExecutors)
         .filter(([, config]) => config.enabled !== false)
-        .map(([name]) => name);
+        .map(([name]) => name)
+        .filter((name) => name === "pi");
 }
-function resolveImplementationExecutor(sources) {
-    const enabled = sources.enabledExecutors
-        ? new Set(sources.enabledExecutors)
-        : undefined;
-    if (!enabled || enabled.has("pi"))
-        return "pi";
-    if (enabled.has("cursor"))
-        return "cursor";
-    return "pi";
+function implementationNodeId() {
+    return "implement-pi";
 }
-function implementationNodeId(executor) {
-    return executor === "cursor" ? "implement-cursor" : "implement-pi";
+function repairNodeId() {
+    return "repair-pi";
 }
-function repairNodeId(executor) {
-    return executor === "cursor" ? "repair-cursor" : "repair-pi";
+function frontendImplementationNodeId() {
+    return "frontend-implement-pi";
 }
 function probePathsForWriteSetEntry(entry) {
     const normalized = entry.replace(/\\/g, "/").replace(/^\.\//, "");
@@ -275,6 +300,65 @@ function buildVerifyShellCommands(input) {
     const repoRoot = input.repoRoot;
     return input.commands.map((command) => verifyCommandToShell(repoRoot, command));
 }
+function markdownVerifyCommand(repoRoot, command) {
+    const args = command.split(/\s+/).filter(Boolean);
+    if (args.length === 0 ||
+        args.some((arg) => !/^[a-z0-9@._/:=,+-]+$/i.test(arg))) {
+        return null;
+    }
+    return {
+        args,
+        cwd: repoRoot,
+        label: command,
+    };
+}
+function extractFrontendVerifyCommandsFromMarkdown(input) {
+    if (!input.repoRoot)
+        return { staticCommands: [], behaviorCommands: [] };
+    const markdown = [
+        input.requirementMarkdown,
+        input.constraintMarkdown ?? "",
+    ].join("\n");
+    const commands = new Set();
+    for (const line of markdown.split(/\r?\n/)) {
+        const bulletless = line
+            .trim()
+            .replace(/^[-*]\s*(?:\[[ xX]\]\s*)?/, "")
+            .trim();
+        const codeSpanCommands = Array.from(bulletless.matchAll(/`([^`]+)`/g), (match) => match[1].trim());
+        const candidates = codeSpanCommands.length > 0 ? codeSpanCommands : [bulletless];
+        for (const candidate of candidates) {
+            if (/^(npm|pnpm|yarn|bun)\s+(run\s+)?[a-z0-9:_-]+(?:\s.*)?$/i.test(candidate) ||
+                /^(npx|pnpm\s+exec|yarn\s+exec|bunx)\s+(vitest|jest|playwright|cypress|tsc|eslint)(?:\s.*)?$/i.test(candidate)) {
+                commands.add(candidate);
+            }
+        }
+    }
+    const staticCommands = [];
+    const behaviorCommands = [];
+    for (const command of commands) {
+        const verifyCommand = markdownVerifyCommand(input.repoRoot, command);
+        if (!verifyCommand)
+            continue;
+        if (/\b(typecheck|lint|eslint|tsc|build)\b/i.test(command)) {
+            staticCommands.push(verifyCommand);
+            continue;
+        }
+        if (/\b(test|vitest|jest|playwright|cypress|e2e)\b/i.test(command)) {
+            behaviorCommands.push(verifyCommand);
+        }
+    }
+    return { staticCommands, behaviorCommands };
+}
+function chooseFrontendVerifyCommands(input) {
+    if (input.parsedCommands.length > 0) {
+        return { commands: input.parsedCommands, commandSource: "inline" };
+    }
+    if (input.adapterCommands && input.adapterCommands.length > 0) {
+        return { commands: input.adapterCommands, commandSource: "adapter" };
+    }
+    return { commandSource: "inline" };
+}
 function resolveDagVerifyStrategy(taskConfig) {
     return {
         intermediateQuota: taskConfig.dagVerifyStrategy?.intermediateQuota ?? taskConfig.verifyQuota,
@@ -311,6 +395,17 @@ function deriveParallelScoutPaths(taskConfig) {
                 : allowed,
     };
 }
+function deriveFrontendBehaviorPaths(taskConfig) {
+    if (taskConfig.allowedPaths.length === 0)
+        return ["**"];
+    const explicitTestPaths = taskConfig.allowedPaths.filter((entry) => entry.includes("/test/") ||
+        entry.includes("/tests/") ||
+        entry.includes("/e2e/") ||
+        entry.includes("/spec/"));
+    if (explicitTestPaths.length > 0)
+        return explicitTestPaths;
+    return taskConfig.allowedPaths;
+}
 function toTaskRelativeSourcePath(sources, absolutePath) {
     return path
         .relative(sources.taskDir, absolutePath)
@@ -454,6 +549,7 @@ export async function loadTaskHybridSources(repoRoot, taskId) {
         enabledExecutors: resolveEnabledExecutors(manifest.executors),
         executorModelMatrix: resolveExecutorModelMatrices(manifest),
         verifyCommands,
+        sddEmbeddedSkills: await probeRepoLocalSddSkills(repoRoot),
     };
 }
 function mergeFinalVerifyCommands(repoRoot, taskConfig, adapterCommands) {
@@ -479,8 +575,7 @@ export function buildStandardHybridDagFromTask(sources) {
     const scoutPaths = deriveParallelScoutPaths(taskConfig);
     const scoutComplexity = mapTaskComplexity(taskConfig.complexity);
     const implementComplexity = resolveWriterComplexity(taskConfig);
-    const writerExecutor = resolveImplementationExecutor(sources);
-    const implementId = implementationNodeId(writerExecutor);
+    const implementId = implementationNodeId();
     const finalVerifyCommands = sources.verifyCommands?.final ?? [];
     const verifyShellCommands = buildVerifyShellCommands({
         repoRoot: sources.repoRoot,
@@ -523,8 +618,9 @@ export function buildStandardHybridDagFromTask(sources) {
         ...STANDARD_GLOBAL_CONSTRAINTS,
     ];
     const spec = {
-        version: 2,
+        version: 3,
         title: `Hybrid DAG: ${taskConfig.title}`,
+        runtimeContract: GENERATED_DAG_RUNTIME_CONTRACT,
         outputLanguage: sources.outputLanguage ?? DEFAULT_DAG_OUTPUT_LANGUAGE,
         objective: extractObjective(sources.requirementMarkdown, taskConfig.title),
         successCriteria: extractSuccessCriteria(sources.requirementMarkdown, sources.taskId),
@@ -604,7 +700,7 @@ export function buildStandardHybridDagFromTask(sources) {
                 id: implementId,
                 depends_on: ["plan-pi"],
                 role: "implementer",
-                executor: writerExecutor,
+                executor: "pi",
                 toolProfile: "write",
                 complexity: implementComplexity,
                 writePolicy: "exclusive",
@@ -656,11 +752,666 @@ export function buildStandardHybridDagFromTask(sources) {
             },
         ],
     };
+    applySddEmbeddedEnhancements(spec, sources.sddEmbeddedSkills ?? new Set());
+    applyDefaultReadOnlyRetryPolicy(spec);
+    parseDagSpec(spec);
+    assertValidDagSpec(spec);
+    return spec;
+}
+function buildFrontendHybridDagFromTask(sources) {
+    const { taskConfig } = sources;
+    const forbiddenPaths = mergeForbiddenPaths(taskConfig);
+    const implementPaths = resolveImplementPaths(taskConfig);
+    const implementId = frontendImplementationNodeId();
+    const sourceContext = buildSourceContextBlock(sources);
+    const strategy = resolveDagVerifyStrategy(taskConfig);
+    const readOnlyPaths = taskConfig.allowedPaths.length > 0 ? taskConfig.allowedPaths : ["**"];
+    const behaviorPaths = deriveFrontendBehaviorPaths(taskConfig);
+    const globalConstraints = [
+        ...taskConfig.hardConstraints,
+        ...(sources.constraintMarkdown
+            ? [`See 执行约束.md in task source (${sources.taskId})`]
+            : []),
+        ...STANDARD_GLOBAL_CONSTRAINTS,
+        "frontend-implementation DAGs must pass the design verdict gate before any write node executes.",
+        "frontend-implementation DAGs must complete deterministic static verification and behavior verification before final review.",
+        "frontend review must block closeout unless review verdict is exactly VERDICT: pass.",
+    ];
+    const staticFallbackCommands = ["npm run typecheck", "npm run build"];
+    const behaviorFallbackCommands = ["npm test"];
+    const parsedFrontendVerifyCommands = extractFrontendVerifyCommandsFromMarkdown({
+        repoRoot: sources.repoRoot,
+        requirementMarkdown: sources.requirementMarkdown,
+        constraintMarkdown: sources.constraintMarkdown,
+    });
+    const staticVerifyCommands = chooseFrontendVerifyCommands({
+        parsedCommands: parsedFrontendVerifyCommands.staticCommands,
+        adapterCommands: sources.verifyCommands?.intermediate,
+    });
+    const behaviorVerifyCommands = chooseFrontendVerifyCommands({
+        parsedCommands: parsedFrontendVerifyCommands.behaviorCommands,
+        adapterCommands: sources.verifyCommands?.final,
+    });
+    const spec = {
+        version: 3,
+        title: `Frontend implementation DAG: ${taskConfig.title}`,
+        runtimeContract: GENERATED_DAG_RUNTIME_CONTRACT,
+        objective: extractObjective(sources.requirementMarkdown, taskConfig.title),
+        successCriteria: extractSuccessCriteria(sources.requirementMarkdown, sources.taskId),
+        globalConstraints,
+        defaults: {
+            ...FRONTEND_DEFAULTS,
+            contextProfile: taskConfig.contextProfile,
+        },
+        skillsByRole: FRONTEND_SKILLS_BY_ROLE,
+        executorModels: sources.executorModelMatrix ?? DEFAULT_DAG_EXECUTOR_MODELS,
+        verifyStrategy: resolveDagVerifyStrategy(taskConfig),
+        tasks: [
+            {
+                id: "frontend-contract-pi",
+                depends_on: [],
+                role: "planner",
+                executor: "pi",
+                complexity: "MED",
+                writePolicy: "read-only",
+                allowedPaths: readOnlyPaths,
+                forbiddenPaths,
+                skills: FRONTEND_IMPLEMENTATION_SKILLS,
+                outputContract: "Markdown contract with Scope, Non-goals, Acceptance Criteria, UI States, Target Runtime Environment, Risks, and Verification Expectations. No file writes.",
+                subtask_prompt: [
+                    "Read task source and produce a concise frontend implementation contract.",
+                    "Cover scope, non-goals, acceptance criteria, UI states, target runtime environment, risks, and verification expectations.",
+                    "Read-only: do not modify code, docs, artifacts, or repository files.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+            {
+                id: "frontend-scout-pi",
+                depends_on: ["frontend-contract-pi"],
+                role: "scout",
+                executor: "pi",
+                complexity: mapTaskComplexity(taskConfig.complexity),
+                writePolicy: "read-only",
+                allowedPaths: readOnlyPaths,
+                forbiddenPaths,
+                skills: FRONTEND_IMPLEMENTATION_SKILLS,
+                outputContract: "Markdown scout report covering frontend stack, routes, components, styling system, existing design conventions, state/data flow, test entry points, reuse opportunities, and risks. No file writes.",
+                subtask_prompt: [
+                    "Inspect frontend code, routing, components, styles, package scripts, and tests.",
+                    "Return code and design observations, existing reuse opportunities, and verification entry points.",
+                    "Read-only: do not modify repository files.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+            {
+                id: "frontend-plan-pi",
+                depends_on: ["frontend-scout-pi"],
+                role: "planner",
+                executor: "pi",
+                complexity: "MED",
+                writePolicy: "read-only",
+                allowedPaths: readOnlyPaths,
+                forbiddenPaths,
+                skills: FRONTEND_IMPLEMENTATION_SKILLS,
+                outputContract: "Markdown implementation plan with Implementation Steps, Target Files, UI State Handling, Styling / Component Strategy, Interaction Notes, Dependency Policy, Verification Plan, and Residual Risks. No file writes.",
+                subtask_prompt: [
+                    "Based on frontend-contract-pi and frontend-scout-pi, return a minimal frontend implementation plan.",
+                    "Include ordered steps, target files, UI state handling, styling/component strategy, interaction notes, dependency policy, and deterministic verification commands.",
+                    "Read-only: do not modify code, docs, artifacts, or repository files.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+            {
+                id: "frontend-design-gate-pi",
+                depends_on: ["frontend-plan-pi"],
+                role: "reviewer",
+                executor: "pi",
+                complexity: "MED",
+                writePolicy: "read-only",
+                allowedPaths: readOnlyPaths,
+                forbiddenPaths,
+                skills: FRONTEND_DESIGN_REVIEW_SKILLS,
+                outputContract: "Plain Markdown whose first non-empty line is VERDICT: pass or VERDICT: request-revision, followed by Findings, Required Plan Corrections, and Checked Items. No file writes.",
+                subtask_prompt: [
+                    "Audit the frontend plan before implementation.",
+                    "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.",
+                    "Request revision for missing applicable UI states, unsupported dependency additions, design-system drift without reason, weak interaction coverage, broad scope, or missing deterministic verification commands.",
+                    "Read-only: do not modify repository files.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+            {
+                id: "frontend-design-gate-shell",
+                depends_on: ["frontend-design-gate-pi"],
+                role: "verifier",
+                executor: "shell",
+                complexity: "LOW",
+                writePolicy: "read-only",
+                allowedPaths: readOnlyPaths,
+                forbiddenPaths,
+                outputContract: "Deterministic frontend design verdict gate: exit 0 only when frontend-design-gate-pi emits VERDICT: pass.",
+                subtask_prompt: "Deterministic gate: block frontend implementation unless frontend-design-gate-pi emitted VERDICT: pass.",
+                shell: {
+                    commands: [],
+                    verdictGate: {
+                        fromNodeId: "frontend-design-gate-pi",
+                        accept: ["VERDICT: pass"],
+                        label: "frontend design gate",
+                        lineMode: "first-verdict-line",
+                    },
+                    cwd: ".",
+                    timeoutMs: 60000,
+                },
+            },
+            {
+                id: implementId,
+                depends_on: ["frontend-design-gate-shell"],
+                role: "implementer",
+                executor: "pi",
+                toolProfile: "write",
+                complexity: taskConfig.complexity === "large"
+                    ? "HIGH"
+                    : "MED",
+                writePolicy: "exclusive",
+                writeSet: implementPaths.writeSet,
+                allowedPaths: implementPaths.allowedPaths,
+                forbiddenPaths,
+                skills: FRONTEND_IMPLEMENTATION_SKILLS,
+                outputContract: "Markdown summary with Changed Files, Implemented Behavior, UI States Covered, Styling / Component Notes, Verification Attempted, and Residual Risks.",
+                subtask_prompt: [
+                    "Implement the approved frontend plan with minimal focused changes.",
+                    "Stay within writeSet and preserve unrelated files. Do not write root artifacts/** unless explicitly included in writeSet.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+            {
+                id: "frontend-static-verify-shell",
+                depends_on: [implementId],
+                role: "verifier",
+                executor: "shell",
+                complexity: "LOW",
+                writePolicy: "read-only",
+                allowedPaths: readOnlyPaths,
+                forbiddenPaths,
+                outputContract: "Archived shell stdout/stderr with exit codes for deterministic static verification; no worktree writes.",
+                subtask_prompt: "Run deterministic static verification for the frontend implementation.",
+                shell: {
+                    commands: buildVerifyShellCommands({
+                        repoRoot: sources.repoRoot,
+                        commands: staticVerifyCommands.commands,
+                        fallbackCommands: staticFallbackCommands,
+                    }),
+                    verifyEvidence: buildVerifyEvidence({
+                        phase: "intermediate",
+                        quota: strategy.intermediateQuota ?? "full",
+                        commandSource: staticVerifyCommands.commandSource,
+                        commands: staticVerifyCommands.commands,
+                        fallbackCommands: staticFallbackCommands,
+                    }),
+                    cwd: ".",
+                    timeoutMs: 300000,
+                },
+            },
+            {
+                id: "frontend-behavior-verify-shell",
+                depends_on: ["frontend-static-verify-shell"],
+                role: "verifier",
+                executor: "shell",
+                complexity: "LOW",
+                writePolicy: "read-only",
+                allowedPaths: behaviorPaths,
+                forbiddenPaths,
+                outputContract: "Archived shell stdout/stderr with exit codes for deterministic behavior verification; no worktree writes.",
+                subtask_prompt: "Run deterministic behavior verification for frontend flows, states, and integration points.",
+                shell: {
+                    commands: buildVerifyShellCommands({
+                        repoRoot: sources.repoRoot,
+                        commands: behaviorVerifyCommands.commands,
+                        fallbackCommands: behaviorFallbackCommands,
+                    }),
+                    verifyEvidence: buildVerifyEvidence({
+                        phase: "final",
+                        quota: "full",
+                        commandSource: behaviorVerifyCommands.commandSource,
+                        commands: behaviorVerifyCommands.commands,
+                        fallbackCommands: behaviorFallbackCommands,
+                        finalFullRequired: true,
+                    }),
+                    cwd: ".",
+                    timeoutMs: 300000,
+                },
+            },
+            {
+                id: "frontend-review-pi",
+                depends_on: ["frontend-behavior-verify-shell"],
+                role: "reviewer",
+                executor: "pi",
+                complexity: "HIGH",
+                writePolicy: "read-only",
+                allowedPaths: readOnlyPaths,
+                forbiddenPaths,
+                skills: FRONTEND_REVIEW_SKILLS,
+                outputContract: "Plain Markdown whose first non-empty line is VERDICT: pass or VERDICT: request-revision, followed by Findings, Verification Assessment, UX Assessment, and Residual Risks. No file writes.",
+                subtask_prompt: [
+                    "Review the frontend implementation and verification evidence.",
+                    "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.",
+                    "Any Critical or Important finding must force VERDICT: request-revision.",
+                    "Review implementation quality, behavior/state coverage, verification evidence, and maintainability. Read-only: do not modify files.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+            {
+                id: "frontend-review-gate-shell",
+                depends_on: ["frontend-review-pi"],
+                role: "verifier",
+                executor: "shell",
+                complexity: "LOW",
+                writePolicy: "read-only",
+                allowedPaths: readOnlyPaths,
+                forbiddenPaths,
+                outputContract: "Deterministic frontend review verdict gate: exit 0 only when frontend-review-pi emits VERDICT: pass.",
+                subtask_prompt: "Deterministic gate: block downstream closeout unless frontend-review-pi emitted VERDICT: pass.",
+                shell: {
+                    commands: [],
+                    verdictGate: {
+                        fromNodeId: "frontend-review-pi",
+                        accept: ["VERDICT: pass"],
+                        label: "frontend review",
+                        lineMode: "first-verdict-line",
+                    },
+                    cwd: ".",
+                    timeoutMs: 60000,
+                },
+            },
+            {
+                id: "frontend-closeout-pi",
+                depends_on: ["frontend-review-gate-shell"],
+                role: "closeout",
+                executor: "pi",
+                complexity: "MED",
+                writePolicy: "read-only",
+                allowedPaths: taskConfig.allowedPaths.length > 0
+                    ? [...taskConfig.allowedPaths, "docs/**"]
+                    : ["**", "docs/**"],
+                forbiddenPaths,
+                skills: FRONTEND_VERIFICATION_SKILLS,
+                outputContract: "Markdown closeout summary with Changes, Verification Evidence, Review Result, Known Risks, and Follow-up. No file writes.",
+                subtask_prompt: [
+                    "Return a frontend closeout summary covering changes, verification evidence, review result, known risks, and follow-up.",
+                    "Read-only: do not modify code, docs, artifacts, or .harness/dag-runs/.",
+                    sourceContext,
+                ].join("\n\n"),
+            },
+        ],
+    };
+    applyDefaultReadOnlyRetryPolicy(spec);
+    parseDagSpec(spec);
+    assertValidDagSpec(spec);
+    return spec;
+}
+// ---------------------------------------------------------------------------
+// Backend test DAG template
+// ---------------------------------------------------------------------------
+function buildAnalyzeInputsNode(sources) {
+    return {
+        id: "analyze-inputs-pi",
+        depends_on: [],
+        role: "planner",
+        executor: "pi",
+        complexity: "MED",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Structured Markdown extracting core content from source documents. No file writes.",
+        subtask_prompt: [
+            "Read the task source materials and extract the following structured content for downstream test generation.",
+            "",
+            "## Required Output Sections:",
+            "",
+            "### 1. API Endpoints",
+            "List all API endpoints: Method, Path, Description, Request params, Response format.",
+            "",
+            "### 2. Data Model",
+            "For each table/collection: fields, types, constraints, descriptions.",
+            "",
+            "### 3. Business Logic",
+            "Core business rules, validation rules, calculation formulas.",
+            "",
+            "### 4. State Transitions",
+            "State machines (e.g. order status: pending → paid → shipped → completed).",
+            "",
+            "### 5. Error Scenarios & Error Codes",
+            "All error codes, error messages, and when they occur.",
+            "",
+            "### 6. External Dependencies",
+            "Third-party services, databases, message queues. Include timeout settings if documented.",
+            "",
+            "### 7. Acceptance Criteria",
+            "Extract ALL acceptance criteria from 需求.md. Number them AC-001, AC-002, etc. If not explicitly listed, derive from functional requirements.",
+            "",
+            "### 8. Risk Areas",
+            "High-risk areas requiring extra test coverage.",
+            "",
+            "## Conditional Sections (include ONLY if mentioned in requirements):",
+            "- Authentication & Authorization: include ONLY if requirements mention auth mechanism (JWT, OAuth2, API Key, etc.)",
+            "- Timeout Handling: include ONLY if requirements mention timeout configuration or degradation strategy",
+            "- Concurrency & Idempotency: include ONLY if requirements mention concurrency, idempotency rules, or locking mechanisms",
+            "- State Transitions: include ONLY if requirements mention business state machines",
+            "- If not mentioned in requirements, do NOT include these sections",
+            "",
+            "This output will be used directly by downstream nodes. Be thorough and structured.",
+            "Read-only: do not modify code, docs, artifacts, or repository files.",
+            buildSourceContextBlock(sources),
+        ].join("\n\n"),
+    };
+}
+function buildGenerateBackendFunctionalCasesNode(sources) {
+    return {
+        id: "generate-backend-functional-cases-pi",
+        depends_on: ["analyze-inputs-pi"],
+        role: "implementer",
+        executor: "pi",
+        toolProfile: "write",
+        complexity: "MED",
+        writePolicy: "exclusive",
+        writeSet: ["testcase/md/**"],
+        allowedPaths: ["testcase/md/**"],
+        forbiddenPaths: commonForbiddenPaths(sources),
+        // 注意：Pi 节点超时由 executor 层控制（默认 30 分钟）
+        // 如需调整，在 harness.json 的 executors.pi 中配置 modelConfig.timeoutMs
+        subtask_prompt: [
+            "Based on the upstream analyze-inputs-pi output, generate structured backend functional test cases.",
+            "",
+            "## Output Steps (do in order):",
+            "1. First, output a brief summary: how many modules, how many cases planned per module",
+            "2. Then write each test case file under testcase/md/",
+            "",
+            "## Format Rules:",
+            "- Each test case ID: BE-<MODULE>-<NNN> (e.g. BE-ORDER-001)",
+            "- Each file covers one module",
+            "- Case structure: ID, Title, Precondition, Steps, Expected Result",
+            "- Map each case to acceptance criteria (AC-xxx)",
+            "",
+            "## Coverage Requirements:",
+            "- Positive paths: happy path for each acceptance criterion",
+            "- Negative paths: error scenarios (invalid input, not found, state violations)",
+            "- Boundary conditions: empty input, max length, edge values",
+            "",
+            "## Conditional Coverage (include ONLY if mentioned in upstream analysis):",
+            "- State transitions: include ONLY if upstream analyze-inputs-pi mentions state machine",
+            "- Authentication scenarios: include ONLY if upstream analyze-inputs-pi mentions auth mechanism",
+            "- Timeout scenarios: include ONLY if upstream analyze-inputs-pi mentions timeout handling",
+            "- Concurrency scenarios: include ONLY if upstream analyze-inputs-pi mentions concurrency/idempotency rules",
+            "- If not mentioned, do NOT generate these test cases",
+            "",
+            "## Constraints:",
+            "- Stay within writeSet: testcase/md/**",
+            "- Do NOT re-read source documents — use the upstream analyze-inputs-pi output only",
+            "- Do not write root artifacts/**",
+        ].join("\n\n"),
+    };
+}
+function buildReviewBackendCasesNode(sources) {
+    return {
+        id: "review-backend-cases-pi",
+        depends_on: ["generate-backend-functional-cases-pi"],
+        role: "reviewer",
+        executor: "pi",
+        complexity: "HIGH",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Plain Markdown whose first non-empty line is VERDICT: pass or VERDICT: request-revision; followed by Findings and Coverage Assessment. No file writes.",
+        subtask_prompt: [
+            "Review the generated backend functional test cases under testcase/md/.",
+            "",
+            "## Mandatory First Line:",
+            "First non-empty line must be exactly: VERDICT: pass or VERDICT: request-revision",
+            "",
+            "## Review Checklist:",
+            "- ID format: every case uses BE-<MODULE>-<NNN>",
+            "- Positive coverage: each acceptance criterion (AC-xxx) has happy-path case",
+            "- Negative coverage: error scenarios (invalid input, not found, state violations)",
+            "- Boundary coverage: edge cases (empty, max length, edge values)",
+            "- Traceability: each AC maps to at least one case ID",
+            "- Case structure: ID, Title, Precondition, Steps, Expected Result",
+            "- No duplicate IDs across files",
+            "",
+            "## Conditional Coverage (check ONLY if mentioned in upstream analysis):",
+            "- State transition coverage: check ONLY if analyze-inputs-pi mentions state machine",
+            "- Authentication coverage: check ONLY if analyze-inputs-pi mentions auth mechanism",
+            "- Timeout coverage: check ONLY if analyze-inputs-pi mentions timeout handling",
+            "- Concurrency coverage: check ONLY if analyze-inputs-pi mentions concurrency/idempotency rules",
+            "- If not mentioned, do NOT flag as missing",
+            "",
+            "## Verdict Rules:",
+            "- All Critical checks pass + Important findings ≤ 2 → VERDICT: pass",
+            "- Any Critical fails OR Important > 2 → VERDICT: request-revision",
+            "",
+            "## Output After Verdict:",
+            "1. Coverage Assessment table (AC → case IDs)",
+            "2. Findings list (Critical/Important/Informational)",
+            "3. Statistics (total cases, positive/negative/boundary breakdown)",
+            "",
+            "## Constraints:",
+            "- Read-only: do not modify files",
+            "- Do NOT re-read source documents — use upstream analyze-inputs-pi output for acceptance criteria",
+            "- Use testcase/md/ files for case review",
+        ].join("\n\n"),
+    };
+}
+function buildReviewBackendCasesGateNode(sources) {
+    return {
+        id: "review-backend-cases-gate-shell",
+        depends_on: ["review-backend-cases-pi"],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Deterministic backend case review gate: exit 0 only when review-backend-cases-pi emits VERDICT: pass.",
+        subtask_prompt: "Deterministic gate: block pytest generation unless backend case review emitted VERDICT: pass.",
+        shell: {
+            commands: [],
+            verdictGate: {
+                fromNodeId: "review-backend-cases-pi",
+                accept: ["VERDICT: pass"],
+                label: "backend case review",
+                lineMode: "first-verdict-line",
+            },
+            cwd: ".",
+            timeoutMs: 60000,
+        },
+    };
+}
+function buildGenerateBackendPytestNode(sources) {
+    return {
+        id: "generate-backend-pytest-pi",
+        depends_on: ["review-backend-cases-gate-shell"],
+        role: "implementer",
+        executor: "pi",
+        toolProfile: "write",
+        complexity: "HIGH",
+        writePolicy: "exclusive",
+        writeSet: ["testcase/**/test_*.py"],
+        allowedPaths: ["testcase/**/test_*.py"],
+        forbiddenPaths: commonForbiddenPaths(sources),
+        // 注意：Pi 节点超时由 executor 层控制（默认 30 分钟）
+        // 如需调整，在 harness.json 的 executors.pi 中配置 modelConfig.timeoutMs
+        subtask_prompt: [
+            "Convert the reviewed test cases under testcase/md/ into pytest automation code.",
+            "",
+            "## Output Steps (do in order):",
+            "1. First, output a brief summary: how many files, how many test functions planned",
+            "2. Then write each test file under testcase/",
+            "",
+            "## Format Rules:",
+            "- File prefix: test_<module>.py",
+            "- Function name: test_BE_<MODULE>_<NNN>_<description>",
+            "- Docstring first line: BE-<MODULE>-<NNN>: <Case Title>",
+            "- 1:1 mapping: each functional case → one pytest function",
+            "",
+            "## Implementation Rules:",
+            "- Use assert statements, not unittest assertions",
+            "- Assert specific values, not just 'no exception'",
+            "- Use @pytest.mark.parametrize for boundary cases",
+            "- Use markers: @pytest.mark.positive, @pytest.mark.negative, @pytest.mark.boundary",
+            "",
+            "## Conditional Implementation (include ONLY if test cases exist):",
+            "- Authentication tests: implement ONLY if testcase/md/ contains auth-related cases",
+            "- Timeout tests: implement ONLY if testcase/md/ contains timeout-related cases",
+            "- Use @pytest.mark.auth for auth tests, @pytest.mark.timeout for timeout tests",
+            "- If no such cases exist, do NOT add these tests",
+            "",
+            "## Constraints:",
+            "- Only create NEW files, do NOT modify existing framework files (conftest.py, pytest.ini, pyproject.toml)",
+            "- If filename exists, add suffix: test_order.py → test_order_01.py",
+            "- Stay within writeSet: testcase/**/test_*.py",
+            "- Do NOT re-read source documents — use the reviewed cases under testcase/md/ only",
+            "- Read existing conftest.py/pytest.ini to understand conventions, but do NOT modify them",
+        ].join("\n\n"),
+    };
+}
+function buildExecuteBackendPytestNode(sources) {
+    return {
+        id: "execute-backend-pytest-shell",
+        depends_on: ["generate-backend-pytest-pi"],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Archived pytest stdout/stderr with exit codes and HTML report path; no source or test file modifications.",
+        subtask_prompt: "Run pytest for the backend test suite and capture results.",
+        shell: {
+            commands: [
+                "python -m pytest testcase/ --html=reports/backend-test-report.html -v",
+            ],
+            verifyEvidence: buildVerifyEvidence({
+                phase: "final",
+                quota: "full",
+                commandSource: "inline",
+                fallbackCommands: [
+                    "python -m pytest testcase/ --html=reports/backend-test-report.html -v",
+                ],
+                finalFullRequired: true,
+            }),
+            cwd: ".",
+            timeoutMs: 300000,
+        },
+    };
+}
+function buildTestRetrospectNode(sources) {
+    return {
+        id: "test-retrospect-pi",
+        depends_on: ["execute-backend-pytest-shell"],
+        role: "closeout",
+        executor: "pi",
+        toolProfile: "write",
+        complexity: "MED",
+        writePolicy: "exclusive",
+        writeSet: ["docs/test-reports/**"],
+        allowedPaths: ["docs/test-reports/**"],
+        forbiddenPaths: commonForbiddenPaths(sources),
+        subtask_prompt: [
+            "Read upstream outputs (review report + pytest results) and generate a test retrospective report.",
+            "",
+            "## Output Steps (do in order):",
+            "1. First, output the maturity rating on the first line: Rating: A/B/C/D",
+            "2. Then write the full report under docs/test-reports/",
+            "",
+            "## Report Structure:",
+            "1. Maturity Rating with rationale",
+            "2. Test Coverage Summary (total cases, pass rate, failed case analysis)",
+            "3. Review Findings and resolution status",
+            "4. Failed Test Analysis (if any)",
+            "5. Recommendations for improvement",
+            "",
+            "## Rating Criteria:",
+            "- A: 100% acceptance criteria covered + 100% pytest pass + no Critical findings",
+            "- B: ≥80% coverage + ≥90% pass + Low findings only",
+            "- C: ≥60% coverage + ≥70% pass + no Critical findings",
+            "- D: below C thresholds",
+            "",
+            "## Constraints:",
+            "- Stay within writeSet: docs/test-reports/**",
+            "- Do NOT re-read source documents — use upstream outputs only",
+            "- Do not write root artifacts/**",
+        ].join("\n\n"),
+    };
+}
+const BACKEND_TEST_DEFAULTS = {
+    ...HYBRID_DEFAULTS,
+    writePolicy: "read-only",
+};
+const BACKEND_TEST_SKILLS_BY_ROLE = {
+    planner: ["loop-agent"],
+    scout: [],
+    implementer: ["test-driven-development", "verification-before-completion"],
+    reviewer: ["requesting-code-review", "code-review-core"],
+    verifier: ["verification-before-completion", "systematic-debugging"],
+    closeout: ["loop-agent", "verification-before-completion"],
+};
+function buildBackendTestHybridDag(sources) {
+    const { taskConfig } = sources;
+    const sourceContext = buildSourceContextBlock(sources);
+    const readOnlyPaths = commonReadOnlyPaths(sources);
+    const forbiddenPaths = commonForbiddenPaths(sources);
+    const globalConstraints = [
+        ...taskConfig.hardConstraints,
+        ...(sources.constraintMarkdown
+            ? [`See 执行约束.md in task source (${sources.taskId})`]
+            : []),
+        ...STANDARD_GLOBAL_CONSTRAINTS,
+        "backend-test-dag nodes must maintain traceability from requirements to functional cases to pytest automation.",
+        "Functional test case IDs must use BE-<MODULE>-<NNN> format.",
+        "pytest execution must produce HTML reports under reports/.",
+        "pytest automation scripts must use test_ filename prefix for pytest discovery.",
+        "generate-backend-pytest-pi must only create new test files under testcase/; modifying existing framework files (conftest.py, pytest.ini, pyproject.toml) is forbidden.",
+        "review-backend-cases-gate-shell must block pytest generation unless the review verdict is exactly VERDICT: pass.",
+        "If a target test filename already exists under testcase/, add a numeric suffix (_01, _02, ...); never overwrite or append to existing files.",
+        "execute-backend-pytest-shell must not modify test assertions or production code to make tests pass; test failures indicate potential implementation issues and must be reported honestly.",
+    ];
+    const spec = {
+        version: 3,
+        title: `Backend test DAG: ${taskConfig.title}`,
+        runtimeContract: GENERATED_DAG_RUNTIME_CONTRACT,
+        outputLanguage: sources.outputLanguage ?? DEFAULT_DAG_OUTPUT_LANGUAGE,
+        objective: extractObjective(sources.requirementMarkdown, taskConfig.title),
+        successCriteria: extractSuccessCriteria(sources.requirementMarkdown, sources.taskId),
+        globalConstraints,
+        defaults: {
+            ...BACKEND_TEST_DEFAULTS,
+            contextProfile: taskConfig.contextProfile,
+        },
+        skillsByRole: BACKEND_TEST_SKILLS_BY_ROLE,
+        executorModels: sources.executorModelMatrix ?? DEFAULT_DAG_EXECUTOR_MODELS,
+        tasks: [
+            buildAnalyzeInputsNode(sources),
+            buildGenerateBackendFunctionalCasesNode(sources),
+            buildReviewBackendCasesNode(sources),
+            buildReviewBackendCasesGateNode(sources),
+            buildGenerateBackendPytestNode(sources),
+            buildExecuteBackendPytestNode(sources),
+            buildTestRetrospectNode(sources),
+        ],
+    };
+    applyDefaultReadOnlyRetryPolicy(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
 }
 export function buildHybridDagFromTask(sources, options = {}) {
+    if (sources.taskConfig.taskKind === "frontend-implementation" ||
+        options.template === "frontend-implementation") {
+        return buildFrontendHybridDagFromTask(sources);
+    }
+    if (sources.taskConfig.taskKind === "backend-test" ||
+        options.template === "backend-test-dag") {
+        return buildBackendTestHybridDag(sources);
+    }
     const standard = buildStandardHybridDagFromTask(sources);
     const template = options.template ?? "standard-dag";
     if (template === "standard-dag")
@@ -672,6 +1423,21 @@ export function buildHybridDagFromTask(sources, options = {}) {
 function cloneTask(task, patch = {}) {
     return { ...task, ...patch };
 }
+/**
+ * Apply the default read-only Pi retry policy to safe planner/scout/reviewer/
+ * verifier/closeout Pi nodes in the generated DAG. Writers, supervisors,
+ * dynamic, shell, static, and decision-gate nodes are skipped. Idempotent:
+ * never overwrites an explicit retryPolicy a task already declares.
+ */
+function applyDefaultReadOnlyRetryPolicy(spec) {
+    for (const task of spec.tasks) {
+        if (task.retryPolicy !== undefined)
+            continue;
+        if (isSafeReadOnlyPiRetryCandidate(task)) {
+            task.retryPolicy = DEFAULT_READ_ONLY_PI_RETRY_POLICY;
+        }
+    }
+}
 function getTaskOrThrow(spec, id) {
     const task = spec.tasks.find((item) => item.id === id);
     if (!task)
@@ -758,6 +1524,8 @@ function buildReviewGatedHybridDag(standard, sources) {
     const closeout = getTaskOrThrow(spec, "closeout-pi");
     replaceTask(spec, cloneTask(closeout, { depends_on: ["review-gate-shell"] }));
     spec.tasks.splice(spec.tasks.length - 1, 0, buildReviewNode(sources), buildReviewGateNode(sources));
+    applySddEmbeddedEnhancements(spec, sources.sddEmbeddedSkills ?? new Set());
+    applyDefaultReadOnlyRetryPolicy(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
@@ -807,7 +1575,7 @@ function buildWriteSetGateNode(sources) {
     };
 }
 function buildSoftVerifyNode(sources) {
-    const implementId = implementationNodeId(resolveImplementationExecutor(sources));
+    const implementId = implementationNodeId();
     const strategy = resolveDagVerifyStrategy(sources.taskConfig);
     const fallbackCommands = ["npm run typecheck"];
     const commands = buildVerifyShellCommands({
@@ -841,8 +1609,8 @@ function buildSoftVerifyNode(sources) {
     };
 }
 function buildProcessSupervisorNode(sources) {
-    const implementId = implementationNodeId(resolveImplementationExecutor(sources));
-    const repairId = repairNodeId(resolveImplementationExecutor(sources));
+    const implementId = implementationNodeId();
+    const repairId = repairNodeId();
     return {
         id: "process-supervisor-pi",
         depends_on: ["soft-verify-shell", implementId],
@@ -886,6 +1654,7 @@ function buildProcessGateNode(sources) {
             },
             repairArtifactGate: {
                 fromNodeId: "process-supervisor-pi",
+                repairNodeId: repairNodeId(),
             },
             cwd: ".",
             timeoutMs: 60000,
@@ -893,13 +1662,12 @@ function buildProcessGateNode(sources) {
     };
 }
 function buildRepairNode(sources) {
-    const writerExecutor = resolveImplementationExecutor(sources);
     const implement = resolveImplementPaths(sources.taskConfig);
     return {
-        id: repairNodeId(writerExecutor),
+        id: repairNodeId(),
         depends_on: ["process-gate-shell", "process-supervisor-pi"],
         role: "implementer",
-        executor: writerExecutor,
+        executor: "pi",
         toolProfile: "write",
         complexity: isInteractiveUiTask(sources.taskConfig)
             ? "HIGH"
@@ -921,7 +1689,7 @@ function buildRepairNode(sources) {
     };
 }
 function buildHardVerifyNode(sources) {
-    const repairId = repairNodeId(resolveImplementationExecutor(sources));
+    const repairId = repairNodeId();
     const fallbackCommands = [
         "HARNESS_ALLOW_ACTIVE_DAG_RUNS=1 bash scripts/check-repo.sh",
     ];
@@ -980,7 +1748,7 @@ function buildSupervisedHybridDag(standard, sources) {
     const scoutSrc = getTaskOrThrow(standard, "scout-src");
     const scoutTests = getTaskOrThrow(standard, "scout-tests");
     const plan = getTaskOrThrow(standard, "plan-pi");
-    const implement = getTaskOrThrow(standard, implementationNodeId(resolveImplementationExecutor(sources)));
+    const implement = getTaskOrThrow(standard, implementationNodeId());
     const closeout = getTaskOrThrow(standard, "closeout-pi");
     const authorityDecision = resolveAuthoritySurfaceAudit(sources);
     const reviewDependsOn = authorityDecision.enabled
@@ -1028,6 +1796,8 @@ function buildSupervisedHybridDag(standard, sources) {
             cloneTask(closeout, { depends_on: ["decision-pi"] }),
         ],
     };
+    applySddEmbeddedEnhancements(spec, sources.sddEmbeddedSkills ?? new Set());
+    applyDefaultReadOnlyRetryPolicy(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;