@tea-agent/loop-agent 0.12.0 → 0.13.0-beta.0

package/docs/templates/worker-dogfood-setup.md

@@ -1,68 +1,68 @@
-# Worker Dogfood Setup Template
-
-Use this template to create a disposable target repository for a real `agent-worker` sample. It is deliberately a target-repo recipe, not a substitute for product requirements.
-
-## Preconditions
-
-- Install one published controller version and record it:
-
-  ```bash
-  npm install -g @tea-agent/loop-agent@<version>
-  npm list -g @tea-agent/loop-agent --depth=0
-  loop-agent --version
-  agent-worker --version
-  agent-worker --help
-  ```
-
-- Before any write-capable Worker command, resolve one controller identity for the batch. Record its package version, absolute launch entry, binary SHA-256, and portable package fingerprint. If the run is part of a release or self-hosting train, carry the expected version/fingerprint as explicit CLI gates.
-- Create a clean, disposable target repository. Do not use `npm link`, `npm run dev`, or a workspace controller for a real-evidence run.
-- Put requirement, acceptance, design, test plan, and QA case matrix next to the TaskSpec. `agent-worker` materializes immutable copies into the harness task source before DAG generation.
-
-## Setup checklist
-
-- [ ] Target has a committed baseline and a passing `loop-agent init --profile full --merge` preflight.
-- [ ] Existing test demonstrates the desired behavior is missing or unimplemented.
-- [ ] TaskSpec has narrow `allowed_paths` and explicit `forbidden_paths`.
-- [ ] Task Pool dependencies are either backed by real prior runs or intentionally recorded as pre-existing evidence.
-- [ ] The chosen model/provider and `--pi-model` smoke override, if any, are recorded.
-- [ ] `--loop-agent-bin` resolves to the intended published package, and expected controller version/fingerprint are recorded before target writes.
-- [ ] If this is a self-hosting run, published N remains fixed for the whole batch; candidate N+1 is installed and verified in a separate slot.
-
-## Execute
-
-```bash
-agent-worker batch run-ready \
-  --feature-dir <feature-dir> \
-  --repo <target-repo> \
-  --loop-agent-bin <published-loop-agent-entry> \
-  --expected-controller-version <version> \
-  --expected-controller-fingerprint <sha256:value> \
-  --limit 1 \
-  --check-repo \
-  [--pi-model <model>]
-
-agent-worker observe snapshot --repo <target-repo> > <evidence-dir>/observe-snapshot.json
-agent-worker report morning --repo <target-repo> --output <evidence-dir>/morning-report.md
-```
-
-For a failed task, do not delete state or alter JSONL evidence. Fix the external/root cause, then make the retry explicit:
-
-```bash
-agent-worker task retry <task-id> --repo <target-repo> --reason "<root cause corrected>"
-agent-worker batch run-ready --feature-dir <feature-dir> --repo <target-repo> --limit 1 --check-repo
-```
-
-The retry run must have a distinct `workerRunId` and retain `retryOfWorkerRunId` in its Task Pool evidence.
-
-## Versioned self-hosting takeover
-
-From a source checkout, use the repo-maintainer deterministic canary after building or packing candidate N+1:
-
-```bash
-npm run self-host:canary -- \
-  --deterministic \
-  --tarball <candidate.tgz> \
-  --output <candidate-canary-evidence.json>
-```
-
-The deterministic canary must prove isolated-slot containment, both candidate bin identities, package fingerprint, full init/governance checks, a zero-execution Feature dry-run, static/shell-only observed DAG executors, and no PATH controller fallback. It does not claim to trap every possible Pi SDK/absolute path and does not replace a separately authorized live Pi run or the DAG skill-snapshot tests.
+# Worker Dogfood Setup Template
+
+Use this template to create a disposable target repository for a real `agent-worker` sample. It is deliberately a target-repo recipe, not a substitute for product requirements.
+
+## Preconditions
+
+- Install one published controller version and record it:
+
+  ```bash
+  npm install -g @tea-agent/loop-agent@<version>
+  npm list -g @tea-agent/loop-agent --depth=0
+  loop-agent --version
+  agent-worker --version
+  agent-worker --help
+  ```
+
+- Before any write-capable Worker command, resolve one controller identity for the batch. Record its package version, absolute launch entry, binary SHA-256, and portable package fingerprint. If the run is part of a release or self-hosting train, carry the expected version/fingerprint as explicit CLI gates.
+- Create a clean, disposable target repository. Do not use `npm link`, `npm run dev`, or a workspace controller for a real-evidence run.
+- Put requirement, acceptance, design, test plan, and QA case matrix next to the TaskSpec. `agent-worker` materializes immutable copies into the harness task source before DAG generation.
+
+## Setup checklist
+
+- [ ] Target has a committed baseline and a passing `loop-agent init --profile full --merge` preflight.
+- [ ] Existing test demonstrates the desired behavior is missing or unimplemented.
+- [ ] TaskSpec has narrow `allowed_paths` and explicit `forbidden_paths`.
+- [ ] Task Pool dependencies are either backed by real prior runs or intentionally recorded as pre-existing evidence.
+- [ ] The chosen model/provider and `--pi-model` smoke override, if any, are recorded.
+- [ ] `--loop-agent-bin` resolves to the intended published package, and expected controller version/fingerprint are recorded before target writes.
+- [ ] If this is a self-hosting run, published N remains fixed for the whole batch; candidate N+1 is installed and verified in a separate slot.
+
+## Execute
+
+```bash
+agent-worker batch run-ready \
+  --feature-dir <feature-dir> \
+  --repo <target-repo> \
+  --loop-agent-bin <published-loop-agent-entry> \
+  --expected-controller-version <version> \
+  --expected-controller-fingerprint <sha256:value> \
+  --limit 1 \
+  --check-repo \
+  [--pi-model <model>]
+
+agent-worker observe snapshot --repo <target-repo> > <evidence-dir>/observe-snapshot.json
+agent-worker report morning --repo <target-repo> --output <evidence-dir>/morning-report.md
+```
+
+For a failed task, do not delete state or alter JSONL evidence. Fix the external/root cause, then make the retry explicit:
+
+```bash
+agent-worker task retry <task-id> --repo <target-repo> --reason "<root cause corrected>"
+agent-worker batch run-ready --feature-dir <feature-dir> --repo <target-repo> --limit 1 --check-repo
+```
+
+The retry run must have a distinct `workerRunId` and retain `retryOfWorkerRunId` in its Task Pool evidence.
+
+## Versioned self-hosting takeover
+
+From a source checkout, use the repo-maintainer deterministic canary after building or packing candidate N+1:
+
+```bash
+npm run self-host:canary -- \
+  --deterministic \
+  --tarball <candidate.tgz> \
+  --output <candidate-canary-evidence.json>
+```
+
+The deterministic canary must prove isolated-slot containment, both candidate bin identities, package fingerprint, full init/governance checks, a zero-execution Feature dry-run, static/shell-only observed DAG executors, and no PATH controller fallback. It does not claim to trap every possible Pi SDK/absolute path and does not replace a separately authorized live Pi run or the DAG skill-snapshot tests.

package/docs/verification-matrix.md

@@ -1,66 +1,70 @@
-# 验证矩阵
-
-用能证明声明的最窄命令。
-
-| 变更类型 | 最低验证 | 更强验证 |
-|---|---|---|
-| 仅文档或治理 | `bash scripts/check-repo.sh` | `bash scripts/ci.sh` |
-| TypeScript runtime | `npm run typecheck` | `npm test` |
-| CLI 行为 | `npm run typecheck` + 定向 Vitest | `npm test` + CLI smoke |
-| Feature reducer/review | `npx vitest run test/worker/feature test/worker/agent-worker-cli.test.ts` | `npm test` + `node bin/agent-worker.js feature review --help` |
-| Feature run orchestration | `npx vitest run test/worker/feature test/worker/runner/run-ready.test.ts test/worker/agent-worker-cli.test.ts` | `npm test` + `node bin/agent-worker.js feature run --help` |
-| Follow-up 分类与事务 | `npx vitest run test/worker/follow-up test/worker/feature test/worker/pool test/worker/report test/worker/agent-worker-cli.test.ts` | `npm test` + `node bin/agent-worker.js task draft-followup --help` + `node bin/agent-worker.js feature approve-followup --help` |
-| Feature Git transaction | `npx vitest run test/worker/delivery test/worker/feature test/worker/runner test/worker/agent-worker-cli.test.ts` | `npm test` + `node bin/agent-worker.js feature run --help` + temporary Git repo smoke |
-| Final verification / Delivery / Closeout | `npx vitest run test/worker/delivery test/worker/closeout test/worker/feature test/worker/agent-worker-cli.test.ts` | `npm test` + verify-final/Delivery/Closeout CLI help + temporary Git repo evidence/hash/tamper/apply rollback smoke |
-| Controller identity / pinning | `npx vitest run test/worker/package-metadata.test.ts test/worker/repo-preflight.test.ts test/worker/loop-agent-client.test.ts test/worker/run-task/run-task.test.ts test/worker/runner/run-ready.test.ts test/worker/feature/run.test.ts test/worker/delivery/final-verification.test.ts test/worker/delivery/package.test.ts test/worker/agent-worker-cli.test.ts` + `npm run typecheck` | `npm test` + build + 两个 CLI `--version` + 写入型命令 help |
-| DAG resolved skill snapshot / resume | `npx vitest run test/dag-skill-snapshot.test.ts test/dag-approve-resume.test.ts` + `npm run typecheck` | `npm test` + snapshot tamper/pause-resume/dynamic profile smoke |
-| Versioned self-hosting candidate canary | `npx vitest run test/self-host-canary.test.ts test/package-surface.test.ts` + `npm run build` | `npm run self-host:canary -- --deterministic --output <evidence.json>` + `npm pack --dry-run` |
-| Public skill / init mirror surface | `bash scripts/check-skill-entry.sh` + `npx vitest run test/init-command.test.ts test/package-surface.test.ts` | 临时目标项目 full init + skill/mirror hash 对照 + `bash scripts/check-repo.sh` |
-| DAG 工作流 | 定向 DAG 测试 | `npm test` |
-| 前端 DAG 模板 / 前端节点生成 | `npm run typecheck` + 定向 DAG 测试 | `npm test` + `bash scripts/check-repo.sh` |
-| Production readiness hardening | `bash scripts/check-repo.sh` + 定向 DAG/CLI 测试 | `bash scripts/ci.sh` + docs build + package smoke |
-| 脚本或 CI | 运行变更的脚本 | `bash scripts/ci.sh` |
-| Package / publish 入口 | `npm run build` + `node bin/loop-agent.js --help` | `npm pack --dry-run` |
-| 完整交付 | `bash scripts/ci.sh` | CLI smoke + 相关手工检查 |
-
-常用命令：
-
-```bash
-npm run typecheck
-npm test
-npm run build
-bash scripts/check-repo.sh
-bash scripts/ci.sh
-node bin/loop-agent.js --help
-node bin/loop-agent.js --version
-node bin/agent-worker.js --version
-npm run dev -- --help
-npm pack --dry-run
-npm run self-host:canary -- --deterministic --output <evidence.json>
-```
-
-deterministic self-host canary 必须只执行 static/shell DAG，并在 evidence 中证明 `piExecutorObserved=false`、`modelExecutorObserved=false`、`featureExecutedTasks=[]`、PATH controller trap 未触发且候选入口位于隔离 slot。它不证明 candidate Pi/model/provider 路径，也不替代 `test/dag-skill-snapshot.test.ts` 对候选 skill resolution、snapshot hash 和 resume 的验证。
-
-测试资源策略：`npm test` 会先运行可并行的纯测试，再串行运行会启动 CLI、`tsx` 或 Git 子进程的集成测试。纯测试根据 `os.availableParallelism()` 自适应使用 1 至 4 个 Worker；可用 `LOOP_AGENT_FAST_TEST_WORKERS` 在 CI 或受限机器上显式覆盖。传入测试文件时，例如 `npm test -- test/worker/observe/server.test.ts`，仍按常规 Vitest 方式只运行该范围，不会启动两阶段完整测试。
-
-产品线 Feature/Task/QA 文档或 TaskSpec 约束变更还应运行：
-
-```bash
-bash scripts/check-product-line-docs.sh
-```
-
-该检查对仓库中的 feature packet 执行 `agent-worker task validate-feature`，覆盖 AC 唯一性、依赖/环、TaskSpec 路径与验证命令、QA verdict 与 success closeout 顺序。
-
-Windows 上通过 Git Bash 或已配置的兼容 Bash 运行 `scripts/*.sh`。跨平台 CLI 代码对真实文件操作用原生路径；`/` 仅用于稳定 repo 引用、JSON/Markdown 证据引用和 glob 约定。
-
-没有相关门禁的新鲜命令输出，不得声明完成。
-
-Production Readiness v0.1 工作以 `docs/production-readiness.md` 与 `docs/templates/production-readiness-checklist.md` 为验收契约。最终 hardening closeout 需要：
-
-```bash
-bash scripts/ci.sh
-npm run docs:build
-npm run build
-node bin/loop-agent.js --help
-npm pack --dry-run
-```
+# 验证矩阵
+
+用能证明声明的最窄命令。
+
+| 变更类型 | 最低验证 | 更强验证 |
+|---|---|---|
+| 仅文档或治理 | `bash scripts/check-repo.sh` | `bash scripts/ci.sh` |
+| TypeScript runtime | `npm run typecheck` | `npm test` |
+| CLI 行为 | `npm run typecheck` + 定向 Vitest | `npm test` + CLI smoke |
+| Feature reducer/review | `npx vitest run test/worker/feature test/worker/agent-worker-cli.test.ts` | `npm test` + `node bin/agent-worker.js feature review --help` |
+| Feature run orchestration | `npx vitest run test/worker/feature test/worker/runner/run-ready.test.ts test/worker/agent-worker-cli.test.ts` | `npm test` + `node bin/agent-worker.js feature run --help` |
+| Follow-up 分类与事务 | `npx vitest run test/worker/follow-up test/worker/feature test/worker/pool test/worker/report test/worker/agent-worker-cli.test.ts` | `npm test` + `node bin/agent-worker.js task draft-followup --help` + `node bin/agent-worker.js feature approve-followup --help` |
+| Feature Git transaction | `npx vitest run test/worker/delivery test/worker/feature test/worker/runner test/worker/agent-worker-cli.test.ts` | `npm test` + `node bin/agent-worker.js feature run --help` + temporary Git repo smoke |
+| Final verification / Delivery / Closeout | `npx vitest run test/worker/delivery test/worker/feature test/worker/agent-worker-cli.test.ts` | `npm test` + verify-final/Delivery/Closeout CLI help + temporary Git repo evidence/hash/tamper/apply rollback smoke。Closeout 覆盖在 `test/worker/delivery/**` 与 CLI，不存在独立 `test/worker/closeout/` 目录 |
+| Task Pool feature-scoped identity / migration | `npx vitest run test/worker/pool test/worker/runner/run-ready.test.ts test/worker/feature test/worker/follow-up test/worker/delivery test/worker/report test/worker/observability test/worker/observe test/worker/agent-worker-cli.test.ts` + `npm run typecheck` | 平台临时目录 dual-Feature smoke（同名 `QA-EXEC-001` 不串线）+ `pool doctor` / `pool migrate-state` dry-run + Observe canonical/legacy 409 |
+| Controller identity / pinning | `npx vitest run test/worker/package-metadata.test.ts test/worker/repo-preflight.test.ts test/worker/loop-agent-client.test.ts test/worker/run-task/run-task.test.ts test/worker/runner/run-ready.test.ts test/worker/feature/run.test.ts test/worker/delivery/final-verification.test.ts test/worker/delivery/package.test.ts test/worker/agent-worker-cli.test.ts` + `npm run typecheck` | `npm test` + build + 两个 CLI `--version` + 写入型命令 help |
+| DAG resolved skill snapshot / resume | `npx vitest run test/dag-skill-snapshot.test.ts test/dag-approve-resume.test.ts` + `npm run typecheck` | `npm test` + snapshot tamper/pause-resume/dynamic profile smoke |
+| Versioned self-hosting candidate canary | `npx vitest run test/self-host-canary.test.ts test/package-surface.test.ts` + `npm run build` | `npm run self-host:canary -- --deterministic --output <evidence.json>` + `npm pack --dry-run` |
+| Public skill / init mirror surface | `bash scripts/check-skill-entry.sh` + `npx vitest run test/init-command.test.ts test/package-surface.test.ts` | 临时目标项目 full init + skill/mirror hash 对照 + `bash scripts/check-repo.sh` |
+| DAG 工作流 | 定向 DAG 测试 | `npm test` |
+| Eval Replay MVP | `npx vitest run test/eval-replay.test.ts test/eval-cli.test.ts test/cli-contract.test.ts` + `npm run typecheck` | `bash scripts/check-command-registry-drift.sh` + `bash scripts/check-architecture-boundaries.sh` + `node bin/loop-agent.js eval --help` + `bash scripts/check-repo.sh` |
+| Eval Candidate Registry MVP | `npx vitest run test/eval-candidate-registry.test.ts test/eval-cli.test.ts test/cli-contract.test.ts` + `npm run typecheck` | `npm run build` + `bash scripts/check-command-registry-drift.sh` + `bash scripts/check-architecture-boundaries.sh` + `node bin/loop-agent.js eval --help` + `HARNESS_ALLOW_ACTIVE_DAG_RUNS=1 bash scripts/check-repo.sh` |
+| Eval run association W2.3 | `npx vitest run test/eval-run-association.test.ts test/eval-replay.test.ts test/dag-report.test.ts test/run-dag.test.ts` + `npm run typecheck` | `npm run build` + `bash scripts/check-architecture-boundaries.sh` + `bash scripts/check-command-registry-drift.sh` + `HARNESS_ALLOW_ACTIVE_DAG_RUNS=1 bash scripts/check-repo.sh` + `npm run docs:build` + `git diff --check` |
+| 前端 DAG 模板 / 前端节点生成 | `npm run typecheck` + 定向 DAG 测试 | `npm test` + `bash scripts/check-repo.sh` |
+| Production readiness hardening | `bash scripts/check-repo.sh` + 定向 DAG/CLI 测试 | `bash scripts/ci.sh` + docs build + package smoke |
+| 脚本或 CI | 运行变更的脚本 | `bash scripts/ci.sh` |
+| Package / publish 入口 | `npm run build` + `node bin/loop-agent.js --help` | `npm pack --dry-run` |
+| 完整交付 | `bash scripts/ci.sh` | CLI smoke + 相关手工检查 |
+
+常用命令：
+
+```bash
+npm run typecheck
+npm test
+npm run build
+bash scripts/check-repo.sh
+bash scripts/ci.sh
+node bin/loop-agent.js --help
+node bin/loop-agent.js --version
+node bin/agent-worker.js --version
+npm run dev -- --help
+npm pack --dry-run
+npm run self-host:canary -- --deterministic --output <evidence.json>
+```
+
+deterministic self-host canary 必须只执行 static/shell DAG，并在 evidence 中证明 `piExecutorObserved=false`、`modelExecutorObserved=false`、`featureExecutedTasks=[]`、PATH controller trap 未触发且候选入口位于隔离 slot。它不证明 candidate Pi/model/provider 路径，也不替代 `test/dag-skill-snapshot.test.ts` 对候选 skill resolution、snapshot hash 和 resume 的验证。
+
+测试资源策略：`npm test` 会先运行可并行的纯测试，再串行运行会启动 CLI、`tsx` 或 Git 子进程的集成测试。纯测试根据 `os.availableParallelism()` 自适应使用 1 至 4 个 Worker；可用 `LOOP_AGENT_FAST_TEST_WORKERS` 在 CI 或受限机器上显式覆盖。传入测试文件时，例如 `npm test -- test/worker/observe/server.test.ts`，仍按常规 Vitest 方式只运行该范围，不会启动两阶段完整测试。
+
+产品线 Feature/Task/QA 文档或 TaskSpec 约束变更还应运行：
+
+```bash
+bash scripts/check-product-line-docs.sh
+```
+
+该检查对仓库中的 feature packet 执行 `agent-worker task validate-feature`，覆盖 AC 唯一性、依赖/环、TaskSpec 路径与验证命令、QA verdict 与 success closeout 顺序。
+
+Windows 上通过 Git Bash 或已配置的兼容 Bash 运行 `scripts/*.sh`。跨平台 CLI 代码对真实文件操作用原生路径；`/` 仅用于稳定 repo 引用、JSON/Markdown 证据引用和 glob 约定。
+
+没有相关门禁的新鲜命令输出，不得声明完成。
+
+Production Readiness v0.1 工作以 `docs/production-readiness.md` 与 `docs/templates/production-readiness-checklist.md` 为验收契约。最终 hardening closeout 需要：
+
+```bash
+bash scripts/ci.sh
+npm run docs:build
+npm run build
+node bin/loop-agent.js --help
+npm pack --dry-run
+```