@tea-agent/loop-agent 0.10.0 → 0.12.0

package/dist/sidecars/cursor-prompt/stream.js

@@ -0,0 +1,121 @@
+import { bestEffortCancelRun, buildCursorPrompt, classifyCursorFailure, mapRunStatusToExecutionStatus, } from "./executor.js";
+async function createCursorStreamAgent(input) {
+    const { Agent } = await import("@cursor/sdk");
+    return Agent.create({
+        apiKey: input.apiKey,
+        name: "pi-cursor-prompt",
+        model: { id: input.model },
+        local: { cwd: input.cwd },
+    });
+}
+/**
+ * One-shot streaming path for cursor-prompt CLI. Loads @cursor/sdk only here.
+ */
+export async function executeCursorPromptStream(input) {
+    const apiKey = input.apiKey ?? process.env.CURSOR_API_KEY;
+    if (!apiKey?.trim()) {
+        return {
+            ok: false,
+            status: "failed",
+            failureCategory: "missing-api-key",
+            model: input.model,
+            durationMs: 0,
+            stdout: "",
+            stderr: "CURSOR_API_KEY environment variable is not set.",
+            details: { startupError: true },
+        };
+    }
+    const prompt = buildCursorPrompt(input.task, { runDir: input.runDir });
+    const startedAt = Date.now();
+    let timeoutHandle;
+    let agent;
+    let run;
+    let timedOut = false;
+    try {
+        agent = await (input.agentFactory ?? createCursorStreamAgent)({
+            apiKey,
+            cwd: input.cwd,
+            model: input.model,
+        });
+        const runPromise = (async () => {
+            run = await agent.send(prompt);
+            for await (const event of run.stream()) {
+                if (event.type === "assistant") {
+                    for (const block of event.message.content) {
+                        if (block.type === "text" && block.text) {
+                            input.callbacks?.onAssistantText?.(block.text);
+                        }
+                    }
+                }
+            }
+            return run.wait();
+        })();
+        const timeoutRace = new Promise((resolve) => {
+            timeoutHandle = setTimeout(() => resolve("timeout"), input.timeoutMs);
+        });
+        const raced = await Promise.race([
+            runPromise.then((value) => ({ kind: "done", value })),
+            timeoutRace.then(() => ({ kind: "timeout" })),
+        ]);
+        if (raced.kind === "timeout") {
+            timedOut = true;
+            await bestEffortCancelRun(run);
+            return {
+                ok: false,
+                status: "timeout",
+                failureCategory: "timeout",
+                model: input.model,
+                durationMs: Date.now() - startedAt,
+                stdout: "",
+                stderr: `Cursor execution timed out after ${input.timeoutMs}ms`,
+                details: { timedOut: true, timeoutKind: "total" },
+            };
+        }
+        const sdkResult = raced.value;
+        const runStatus = String(sdkResult.status ?? "");
+        const status = mapRunStatusToExecutionStatus(runStatus, false);
+        const ok = status === "completed";
+        return {
+            ok,
+            status,
+            failureCategory: ok
+                ? "success"
+                : classifyCursorFailure({ runStatus, stderr: "", stdout: "" }),
+            model: input.model,
+            durationMs: sdkResult.durationMs ?? Date.now() - startedAt,
+            stdout: "",
+            stderr: "",
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            ok: false,
+            status: "failed",
+            failureCategory: classifyCursorFailure({
+                startupError: message,
+                stderr: message,
+            }),
+            model: input.model,
+            durationMs: Date.now() - startedAt,
+            stdout: "",
+            stderr: message,
+            details: { startupError: true },
+        };
+    }
+    finally {
+        if (timeoutHandle)
+            clearTimeout(timeoutHandle);
+        if (!timedOut && run?.status === "running") {
+            await bestEffortCancelRun(run);
+        }
+        if (agent) {
+            try {
+                await agent[Symbol.asyncDispose]();
+            }
+            catch {
+                // The one-shot result remains authoritative; disposal is best effort.
+            }
+        }
+    }
+}

package/dist/task/config-types.js

@@ -1,5 +1,4 @@
 import { z } from "zod";
-import { taskExecutorSchema } from "../governance/manifest-types.js";
 export const taskFlowSchema = z.enum([
     "auto",
     "micro",
@@ -8,7 +7,12 @@ export const taskFlowSchema = z.enum([
     "loop",
     "feature-study",
 ]);
-export const taskKindSchema = z.enum(["standard", "feature-study"]);
+export const taskKindSchema = z.enum([
+    "standard",
+    "feature-study",
+    "frontend-implementation",
+    "backend-test",
+]);
 export const referenceRepoConfigSchema = z.object({
     name: z.string().min(1),
     path: z.string().min(1),
@@ -40,11 +44,13 @@ export const dagVerifyStrategySchema = z
         .default("adapter"),
 })
     .optional();
-export const loopAutoWritePolicySchema = z.enum([
+export const loopAutoExecutionPolicySchema = z.enum([
     "off",
     "approval-required",
     "enabled",
 ]);
+export const LOOP_AUTO_WRITE_POLICY_REMOVED_ERROR = "task field loopAutoWritePolicy is no longer supported; use loopAutoExecutionPolicy (off | approval-required | enabled)";
+export const CURSOR_TASK_FIELD_REMOVED_ERROR = 'task fields "executor" and "cursorModel" are no longer supported; governed runtime is Pi-only';
 export const convergenceConfigSchema = z.object({
     enabled: z.boolean().optional().default(false),
     maxPasses: z.number().int().positive().optional().default(3),
@@ -52,11 +58,11 @@ export const convergenceConfigSchema = z.object({
     stopOnHardVerifyPass: z.boolean().optional().default(true),
     pauseOnRegression: z.boolean().optional().default(true),
 });
-export const taskConfigSchema = z.object({
+const taskConfigObjectSchema = z.object({
     taskId: z.string(),
     title: z.string(),
     sourceFiles: z.array(z.string()),
-    /** standard: 本仓库需求实现；feature-study: 参考外部代码特性并在目标仓库落地 */
+    /** standard: 本仓库需求实现；feature-study: 参考外部代码特性并在目标仓库落地；frontend-implementation: 使用前端实现 DAG 模板 */
     taskKind: taskKindSchema.optional().default("standard"),
     referenceRepos: z.array(referenceRepoConfigSchema).optional().default([]),
     referenceDocs: z.array(referenceDocConfigSchema).optional().default([]),
@@ -67,7 +73,7 @@ export const taskConfigSchema = z.object({
     hardConstraints: z.array(z.string()).optional().default([]),
     autoCommitAfterVerify: z.boolean().optional().default(true),
     autoCommitMessage: z.string().optional().default(""),
-    /** Explicit reason that a medium/large task could not use DAG before loop cursor-fix. */
+    /** Explicit reason that a medium/large task could not use DAG before loop auto execution. */
     dagFallbackReason: z.string().optional(),
     /** full: attach governance bundle; slim: analyze/plan 只带最少仓库上下文（source + harness 等） */
     contextProfile: contextProfileSchema.optional().default("full"),
@@ -90,8 +96,10 @@ export const taskConfigSchema = z.object({
     maxFixLoops: z.number().int().min(0).optional().default(2),
     /** Supervised DAG convergence is opt-in until runtime smoke evidence is stronger. */
     convergence: convergenceConfigSchema.optional().default({ enabled: false }),
-    /** Outer loop auto mode never writes by default; cursor-fix requires this policy plus bounded path guards. */
-    loopAutoWritePolicy: loopAutoWritePolicySchema.optional().default("off"),
+    /** Outer loop auto mode never writes by default; DAG execute requires this policy plus path/writeSet gates. */
+    loopAutoExecutionPolicy: loopAutoExecutionPolicySchema
+        .optional()
+        .default("off"),
     requireRetrospective: z.boolean().optional().default(false),
     /** inherit: use host shell env; clean: sanitized env for deterministic verify */
     verifyEnv: z.enum(["inherit", "clean"]).optional().default("clean"),
@@ -99,9 +107,18 @@ export const taskConfigSchema = z.object({
     maxGoalContinuationsPerRun: z.number().int().positive().optional().default(5),
     /** Pi subagent assisted mode: 'off' (default), 'analyze-plan', or 'full' */
     piSubagentMode: piSubagentModeSchema.optional().default("off"),
-    /** Leaf executor: default pi; cursor requires delegate + worktree isolation */
-    executor: taskExecutorSchema.optional().default("pi"),
-    /** Cursor model override (e.g. gpt-5.5); falls back to harness executors.cursor.defaultModel */
-    cursorModel: z.string().optional(),
     notes: z.string().optional().default(""),
 });
+export const taskConfigSchema = z.preprocess((raw) => {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        return raw;
+    }
+    const obj = raw;
+    if ("loopAutoWritePolicy" in obj) {
+        throw new Error(LOOP_AUTO_WRITE_POLICY_REMOVED_ERROR);
+    }
+    if ("executor" in obj || "cursorModel" in obj) {
+        throw new Error(CURSOR_TASK_FIELD_REMOVED_ERROR);
+    }
+    return raw;
+}, taskConfigObjectSchema);

package/dist/task/delegate.js

@@ -9,31 +9,24 @@ import { getTaskPaths, loadTaskConfig } from './runtime.js';
 import { copyDir } from '../records/harvest.js';
 import { saveWorkflowState } from './state.js';
 import { workflowStateSchema } from '../shared/types.js';
-import { assertCursorExecutorAvailable, resolveTaskExecutor, validateCursorTaskPreflight } from '../executors/config-core.js';
-import { resolveDelegateExecutionMode } from '../executors/cursor-execution-log.js';
 /**
  * Atomic delegation: validate source → check conflicts → create worktree →
  * sync source → optionally symlink node_modules.
  *
- * Execution runs in-process for Cursor SDK; Pi worktrees are prepared for manual DAG follow-up.
+ * Default is isolation only; callers may run Pi DAG via application use cases.
  */
 export async function delegateTask(repoRoot, manifest, taskId, opts = {}) {
     const symlinkEnabled = opts.symlinkNodeModules !== false;
     await validateSourceMaterials(repoRoot, taskId);
-    const taskConfig = await loadTaskConfig(repoRoot, taskId);
+    await loadTaskConfig(repoRoot, taskId);
     const effectiveManifest = manifest ?? (await loadHarnessManifest(repoRoot));
-    const executor = resolveTaskExecutor(taskConfig, opts.executor);
-    if (executor === 'cursor') {
-        assertCursorExecutorAvailable(effectiveManifest);
-        validateCursorTaskPreflight(taskConfig);
-    }
     await validateNoConflicts(repoRoot, taskId, opts.branch);
     const worktree = await createWorktree(repoRoot, effectiveManifest, {
         taskId,
         branch: opts.branch,
         base: opts.base,
     });
-    await syncSourceToWorktree(repoRoot, taskId, worktree.path, executor);
+    await syncSourceToWorktree(repoRoot, taskId, worktree.path);
     let symlinkedNodeModules = false;
     if (symlinkEnabled) {
         symlinkedNodeModules = await setupNodeModulesSymlink(repoRoot, worktree.path);
@@ -46,13 +39,9 @@ export async function delegateTask(repoRoot, manifest, taskId, opts = {}) {
         branch: worktree.branch,
         baseBranch: worktree.base,
         symlinkedNodeModules,
-        executor,
-        executionMode: resolveDelegateExecutionMode(executor),
+        executionMode: 'pi-worktree',
     };
 }
-// ---------------------------------------------------------------------------
-// Internal helpers
-// ---------------------------------------------------------------------------
 async function validateSourceMaterials(repoRoot, taskId) {
     const { taskConfigPath, sourceDir } = getTaskPaths(repoRoot, taskId);
     try {
@@ -96,7 +85,7 @@ async function validateNoConflicts(repoRoot, taskId, branch) {
         console.error(`[delegate] warning: branch "${targetBranch}" already exists; will reuse it for the worktree.`);
     }
 }
-async function syncSourceToWorktree(repoRoot, taskId, worktreePath, executor) {
+async function syncSourceToWorktree(repoRoot, taskId, worktreePath) {
     const srcPaths = getTaskPaths(repoRoot, taskId);
     const destPaths = getTaskPaths(worktreePath, taskId);
     const destTaskDir = destPaths.taskDir;
@@ -106,16 +95,15 @@ async function syncSourceToWorktree(repoRoot, taskId, worktreePath, executor) {
     await copyDir(srcPaths.sourceDir, destSourceDir);
     const rawJson = await readFile(srcPaths.taskConfigPath, 'utf-8');
     const parsedTaskConfig = JSON.parse(rawJson);
-    parsedTaskConfig.executor = executor;
     await mkdir(path.dirname(destTaskConfigPath), { recursive: true });
     await writeTaskConfig(worktreePath, taskId, parsedTaskConfig);
     await mkdir(destPaths.logsDir, { recursive: true });
     await initializeArtifacts(destTaskDir);
     await initializeTaskLogStubs(worktreePath, taskId);
-    const state = await loadOrCreateWorkflowState(srcPaths.statePath, taskId, executor);
+    const state = await loadOrCreateWorkflowState(srcPaths.statePath, taskId);
     await saveWorkflowState(destPaths.statePath, state);
 }
-async function loadOrCreateWorkflowState(statePath, taskId, executor) {
+async function loadOrCreateWorkflowState(statePath, taskId) {
     try {
         const raw = await readFile(statePath, 'utf-8');
         return workflowStateSchema.parse(JSON.parse(raw));
@@ -129,8 +117,8 @@ async function loadOrCreateWorkflowState(statePath, taskId, executor) {
             completedSteps: [],
             lastUpdated: now,
             executor: {
-                name: executor,
-                mode: executor === 'cursor' ? 'sdk' : 'json',
+                name: 'pi',
+                mode: 'json',
             },
             artifacts: {
                 analysis: false,

package/dist/task/runtime.js

@@ -117,11 +117,10 @@ export async function createTask(repoRoot, taskId, title) {
             stopOnHardVerifyPass: true,
             pauseOnRegression: true,
         },
-        loopAutoWritePolicy: 'off',
+        loopAutoExecutionPolicy: 'off',
         verifyEnv: 'clean',
         maxGoalContinuationsPerRun: 5,
         piSubagentMode: 'off',
-        executor: 'pi',
         notes: '',
     };
     const state = {

package/dist/worker/cli.js

@@ -3,6 +3,7 @@ import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { Command } from "commander";
+import { readPackageVersion } from "../shared/package-metadata.js";
 import YAML from "yaml";
 import { LoopAgentClient } from "./loop-agent/loop-agent-client.js";
 import { resolveLoopAgentProfile } from "./profile-mapping.js";
@@ -31,6 +32,7 @@ export function buildAgentWorkerProgram() {
     program
         .name("agent-worker")
         .description("Local product-line worker utilities for TaskSpec validation")
+        .version(readPackageVersion(path.dirname(path.dirname(path.dirname(fileURLToPath(import.meta.url))))) ?? "0.0.0", "-V, --version", "display version")
         .showHelpAfterError()
         .showSuggestionAfterError();
     const task = program.command("task").description("TaskSpec utilities");
@@ -66,6 +68,8 @@ export function buildAgentWorkerProgram() {
         .option("--check-repo-command <command...>", "Override the check-repo preflight command")
         .option("--quiet", "Suppress human-readable progress on stderr")
         .option("--pi-model <model>", "Smoke override for pi executor nodes")
+        .option("--expected-controller-version <version>", "Exact expected controller version (fail before writes if mismatched)")
+        .option("--expected-controller-fingerprint <value>", "Exact expected controller fingerprint sha256:<hex> (fail before writes if mismatched)")
         .description("Validate and advance one Ready Feature task through the existing Worker pipeline")
         .action(async (options) => {
         if (options.gitMode !== "none" && options.gitMode !== "checkpoint")
@@ -74,9 +78,11 @@ export function buildAgentWorkerProgram() {
             throw new Error("--keep-failed-diff requires --git-mode checkpoint");
         const repoRoot = path.resolve(options.repo);
         const batchRunId = options.batchRunId ?? buildBatchRunId(new Date());
+        const expectedIdentity = buildIdentityExpectation(options);
         const client = new LoopAgentClient({
             loopAgentBin: options.loopAgentBin,
             artifactRoot: path.join(getTaskPoolRoot(repoRoot), "artifacts", batchRunId),
+            resolveIdentity: true,
         });
         let progress;
         try {
@@ -102,6 +108,8 @@ export function buildAgentWorkerProgram() {
             ...(options.piModel ? { piModel: options.piModel } : {}),
             gitMode: options.gitMode === "checkpoint" ? "checkpoint" : "none",
             keepFailedDiff: options.keepFailedDiff ?? false,
+            controllerIdentity: client.getIdentity(),
+            controllerExpectation: expectedIdentity,
         });
         process.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : renderFeatureRun(result));
         if (result.status === "failed" || result.status === "needs-action")
@@ -114,11 +122,13 @@ export function buildAgentWorkerProgram() {
         .requiredOption("--task-id <id>", "Completed qa-execute TaskSpec to rerun as dedicated final verification")
         .option("--loop-agent-bin <bin>", "loop-agent binary", "loop-agent")
         .option("--json", "Emit stable JSON")
+        .option("--expected-controller-version <version>", "Exact expected controller version (fail before writes if mismatched)")
+        .option("--expected-controller-fingerprint <value>", "Exact expected controller fingerprint sha256:<hex> (fail before writes if mismatched)")
         .description("Run an independent HEAD-bound final QA verification and project Delivery evidence")
         .action(async (options) => {
         const repoRoot = path.resolve(options.repo);
-        const client = new LoopAgentClient({ loopAgentBin: options.loopAgentBin, artifactRoot: path.join(getTaskPoolRoot(repoRoot), "artifacts", `final-verification-${Date.now()}`) });
-        const result = await runFeatureFinalVerification({ featureDir: path.resolve(options.featureDir), repoRoot, taskId: options.taskId, client });
+        const client = new LoopAgentClient({ loopAgentBin: options.loopAgentBin, artifactRoot: path.join(getTaskPoolRoot(repoRoot), "artifacts", `final-verification-${Date.now()}`), resolveIdentity: true });
+        const result = await runFeatureFinalVerification({ featureDir: path.resolve(options.featureDir), repoRoot, taskId: options.taskId, client, controllerIdentity: client.getIdentity(), controllerExpectation: buildIdentityExpectation(options) });
         process.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : `Feature: ${result.featureId}\nFinal verification: ${result.workerRunId}\nQA evidence: ${result.qaEvidencePath}\nFinal evidence: ${result.finalVerificationPath}\n`);
     });
     feature
@@ -269,13 +279,17 @@ export function buildAgentWorkerProgram() {
         .option("--check-repo-command <command...>", "Override the check-repo preflight command")
         .option("--quiet", "Suppress human-readable progress on stderr (JSON still goes to stdout)")
         .option("--pi-model <model>", "Smoke override: force every pi executor node to this model (drops --strict-models)")
+        .option("--expected-controller-version <version>", "Exact expected controller version (fail before writes if mismatched)")
+        .option("--expected-controller-fingerprint <value>", "Exact expected controller fingerprint sha256:<hex> (fail before writes if mismatched)")
         .description("Run ready TaskSpec tasks serially")
         .action(async (options) => {
         const repoRoot = path.resolve(options.repo);
         const batchRunId = options.batchRunId ?? buildBatchRunId(new Date());
+        const expectedIdentity = buildIdentityExpectation(options);
         const client = new LoopAgentClient({
             loopAgentBin: options.loopAgentBin,
             artifactRoot: path.join(getTaskPoolRoot(repoRoot), "artifacts", batchRunId),
+            resolveIdentity: true,
         });
         let progress;
         try {
@@ -301,6 +315,8 @@ export function buildAgentWorkerProgram() {
                 : {}),
             progress,
             ...(options.piModel ? { piModel: options.piModel } : {}),
+            controllerIdentity: client.getIdentity(),
+            controllerExpectation: expectedIdentity,
         });
         process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
         if (result.status !== "completed")
@@ -310,7 +326,8 @@ export function buildAgentWorkerProgram() {
         .command("serve")
         .requiredOption("--repo <repo-root>", "Target repo root")
         .option("--port <port>", "HTTP port", "8787")
-        .option("--host <host>", "Bind host", "127.0.0.1")
+        .option("--host <host>", "Bind host (default 127.0.0.1; use 0.0.0.0 for LAN, no auth)", "127.0.0.1")
+        .option("--debug", "Log request source/method/path/status to stderr")
         .description("Start read-only observe HTTP server")
         .action(async (options) => {
         const repoRoot = path.resolve(options.repo);
@@ -318,6 +335,7 @@ export function buildAgentWorkerProgram() {
             repoRoot,
             host: options.host,
             port: Number.parseInt(options.port, 10),
+            debug: options.debug === true,
         });
         process.stdout.write(`${server.url}\n`);
         await new Promise((resolve) => {
@@ -365,6 +383,17 @@ export function buildAgentWorkerProgram() {
     });
     return program;
 }
+export function buildIdentityExpectation(options) {
+    if (options.expectedControllerVersion || options.expectedControllerFingerprint) {
+        const expectation = {};
+        if (options.expectedControllerVersion)
+            expectation.expectedVersion = options.expectedControllerVersion;
+        if (options.expectedControllerFingerprint)
+            expectation.expectedFingerprint = options.expectedControllerFingerprint;
+        return expectation;
+    }
+    return undefined;
+}
 export async function main(argv = process.argv) {
     await buildAgentWorkerProgram().parseAsync(argv);
 }

package/dist/worker/delivery/final-verification.js

@@ -4,15 +4,29 @@ import { mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promis
 import path from "node:path";
 import { promisify } from "node:util";
 import YAML from "yaml";
+import { controllerIdentitiesMatch, controllerIdentityExpectationFailure, resolveControllerIdentity, } from "../loop-agent/loop-agent-client.js";
 import { acceptanceSpecSchema } from "../task-graph/acceptance-schema.js";
 import { taskGraphSpecSchema } from "../task-graph/task-graph-schema.js";
 import { validateFeatureTaskGraph } from "../task-graph/validate.js";
 import { getRunsJsonlPath, getTaskPoolRoot, readJsonlFile, recordTaskPoolRun } from "../pool/run-store.js";
 import { buildWorkerRunId, runTaskSpec } from "../run-task/run-task.js";
 import { taskSpecSchema } from "../task-spec/schema.js";
+import { preflightTargetRepo } from "../preflight.js";
 import { gitTransactionRecordSchema, transactionRecordPath } from "./git-transaction.js";
 const execFileAsync = promisify(execFile);
 export async function runFeatureFinalVerification(input) {
+    const dependencies = {
+        preflight: preflightTargetRepo,
+        runTask: runTaskSpec,
+        git,
+        gitRaw,
+        ...input.dependencies,
+    };
+    let controllerIdentity = resolveControllerIdentity(input.client, input.controllerIdentity);
+    const identityFailure = controllerIdentityExpectationFailure(controllerIdentity, input.controllerExpectation);
+    if (identityFailure) {
+        throw new Error(`${identityFailure.code}: ${identityFailure.message}`);
+    }
     const repoRoot = await realpath(path.resolve(input.repoRoot));
     const featureDir = await realpath(path.resolve(input.featureDir));
     const relativeFeature = path.relative(repoRoot, featureDir);
@@ -22,10 +36,19 @@ export async function runFeatureFinalVerification(input) {
     if (!validation.ok)
         throw new Error(`Feature Packet is invalid: ${validation.errors.map((error) => error.code).join(", ")}`);
     const featureId = validation.featureId;
+    const preflight = await dependencies.preflight({
+        repoRoot,
+        client: input.client,
+        ...(input.controllerExpectation ? { expectation: input.controllerExpectation } : {}),
+    });
+    if (!preflight.ok) {
+        throw new Error(`target repo preflight failed: ${preflight.code}: ${preflight.message}`);
+    }
+    controllerIdentity = preflight.controllerIdentity ?? controllerIdentity;
     const record = gitTransactionRecordSchema.parse(JSON.parse(await readFile(transactionRecordPath(repoRoot, featureId), "utf-8")));
-    const branch = await git(repoRoot, ["branch", "--show-current"]);
-    const headSha = await git(repoRoot, ["rev-parse", "HEAD"]);
-    const status = await gitRaw(repoRoot, ["status", "--porcelain=v1", "--untracked-files=all"]);
+    const branch = await dependencies.git(repoRoot, ["branch", "--show-current"]);
+    const headSha = await dependencies.git(repoRoot, ["rev-parse", "HEAD"]);
+    const status = await dependencies.gitRaw(repoRoot, ["status", "--porcelain=v1", "--untracked-files=all"]);
     if (branch !== record.branch || headSha !== record.lastCheckpoint)
         throw new Error("final verification requires the recorded Feature branch at lastCheckpoint");
     if (status.trim())
@@ -50,17 +73,28 @@ export async function runFeatureFinalVerification(input) {
     };
     const now = input.now ?? new Date();
     let runs = await readJsonlFile(getRunsJsonlPath(repoRoot));
-    let finalRun = await reusableFinalRun(repoRoot, runs, taskSpec.id, featureId, record, now);
+    let finalRun = await reusableFinalRun(repoRoot, runs, taskSpec.id, featureId, record, now, controllerIdentity);
     if (!finalRun) {
         const workerRunId = buildWorkerRunId(`${input.taskId}-final`, now);
-        const result = await runTaskSpec({ repoRoot, taskSpec: verificationTaskSpec, taskSpecPath, client: input.client, now, workerRunId, skipSuccessFinalization: true });
+        const result = await dependencies.runTask({
+            repoRoot,
+            taskSpec: verificationTaskSpec,
+            taskSpecPath,
+            client: input.client,
+            now,
+            workerRunId,
+            skipSuccessFinalization: true,
+            preflight: false,
+            ...(controllerIdentity ? { controllerIdentity } : {}),
+            ...(input.controllerExpectation ? { controllerExpectation: input.controllerExpectation } : {}),
+        });
         if (result.status !== "succeeded")
             throw new Error(`dedicated final verification failed: ${workerRunId}`);
-        const afterHead = await git(repoRoot, ["rev-parse", "HEAD"]);
-        const afterStatus = await gitRaw(repoRoot, ["status", "--porcelain=v1", "--untracked-files=all"]);
+        const afterHead = await dependencies.git(repoRoot, ["rev-parse", "HEAD"]);
+        const afterStatus = await dependencies.gitRaw(repoRoot, ["status", "--porcelain=v1", "--untracked-files=all"]);
         if (afterHead !== headSha || afterStatus.trim())
             throw new Error("dedicated final verification changed the Delivery HEAD or worktree");
-        finalRun = { schemaVersion: 1, batchRunId: `final-verification-${workerRunId}`, workerRunId, taskId: taskSpec.id, featureId, status: "succeeded", harnessTaskId: result.harnessTaskId, runRecordPath: result.runRecordPath, dagPath: result.dagPath, recordedAt: new Date().toISOString() };
+        finalRun = { schemaVersion: 1, batchRunId: `final-verification-${workerRunId}`, workerRunId, taskId: taskSpec.id, featureId, status: "succeeded", harnessTaskId: result.harnessTaskId, runRecordPath: result.runRecordPath, dagPath: result.dagPath, recordedAt: now.toISOString(), ...(controllerIdentity ? { controllerIdentity } : {}) };
         await recordTaskPoolRun({ repoRoot, run: finalRun });
         runs = [...runs, finalRun];
     }
@@ -87,7 +121,7 @@ export async function runFeatureFinalVerification(input) {
         qa: { schemaVersion: 1, featureId, verdict: "passed", acIds: requiredAcIds, runs: qaRuns.map(runRef) },
         final: { schemaVersion: 1, featureId, kind: "final-verification", status: "passed", headSha, run: runRef(finalRun), shellSummary: { path: summaryRelative, sha256: createHash("sha256").update(summary).digest("hex") } },
     });
-    return { schemaVersion: 1, featureId, taskId: taskSpec.id, workerRunId: finalRun.workerRunId, headSha, qaEvidencePath: repoRef(repoRoot, qaEvidencePath), finalVerificationPath: repoRef(repoRoot, finalVerificationPath), qaRunCount: qaRuns.length };
+    return { schemaVersion: 1, featureId, taskId: taskSpec.id, workerRunId: finalRun.workerRunId, headSha, qaEvidencePath: repoRef(repoRoot, qaEvidencePath), finalVerificationPath: repoRef(repoRoot, finalVerificationPath), qaRunCount: qaRuns.length, ...(controllerIdentity ? { controllerIdentity } : {}) };
 }
 export function latestSuccessfulQaRuns(runs, specs, excludedTaskId, featureId) {
     const byTask = new Map();
@@ -96,11 +130,13 @@ export function latestSuccessfulQaRuns(runs, specs, excludedTaskId, featureId) {
             byTask.set(run.taskId, run);
     return [...byTask.values()].sort((a, b) => a.taskId.localeCompare(b.taskId));
 }
-async function reusableFinalRun(repoRoot, runs, taskId, featureId, record, now) {
+async function reusableFinalRun(repoRoot, runs, taskId, featureId, record, now, controllerIdentity) {
     const latestCheckpointAt = Math.max(...record.checkpoints.map((entry) => new Date(entry.createdAt).getTime()));
     for (const run of [...runs].reverse()) {
         if (run.taskId !== taskId || run.featureId !== featureId || run.status !== "succeeded" || !run.workerRunId.includes("-final-") || !run.runRecordPath)
             continue;
+        if (controllerIdentity && !controllerIdentitiesMatch(run.controllerIdentity, controllerIdentity))
+            continue;
         const recordedAt = new Date(run.recordedAt).getTime();
         if (recordedAt < latestCheckpointAt || now.getTime() - recordedAt > 24 * 60 * 60 * 1000)
             continue;
@@ -117,7 +153,7 @@ async function reusableFinalRun(repoRoot, runs, taskId, featureId, record, now)
     }
     return undefined;
 }
-function runRef(run) { return { taskId: run.taskId, workerRunId: run.workerRunId, recordedAt: run.recordedAt }; }
+function runRef(run) { return { taskId: run.taskId, workerRunId: run.workerRunId, recordedAt: run.recordedAt, ...(run.controllerIdentity ? { controllerIdentity: run.controllerIdentity } : {}) }; }
 function repoRef(repoRoot, absolute) { return path.relative(repoRoot, absolute).replace(/\\/g, "/"); }
 export async function writeEvidencePairAtomic(evidenceDir, value, fs = { rm }) {
     const parent = path.dirname(evidenceDir);