@tea-agent/loop-agent 0.13.0-alpha.0 → 0.13.0

package/skills/browser-tools/package.json

@@ -0,0 +1,19 @@
+{
+	"name": "browser-tools",
+	"version": "1.0.0",
+	"type": "module",
+	"description": "Minimal CDP tools for collaborative site exploration",
+	"author": "Mario Zechner",
+	"license": "MIT",
+	"dependencies": {
+		"@mozilla/readability": "^0.6.0",
+		"cheerio": "^1.1.2",
+		"jsdom": "^27.0.1",
+		"puppeteer": "^24.31.0",
+		"puppeteer-core": "^23.11.1",
+		"puppeteer-extra": "^3.3.6",
+		"puppeteer-extra-plugin-stealth": "^2.11.2",
+		"turndown": "^7.2.2",
+		"turndown-plugin-gfm": "^1.0.2"
+	}
+}

package/skills/frontend-design-review/SKILL.md

@@ -4,12 +4,13 @@ description: Use for the frontend plan design gate before any writer runs.
 references:
   - path: references/review-checklist.md
     required: true
+    maxChars: 3600
 ---
 
 # Frontend Design Review
 
 For first/final design review nodes. Read the checklist, then audit contract, scout,
-plan/revision, task constraints/bounds, and traceable design evidence. The knowledge-
+mock strategy, plan/revision, task constraints/bounds, and traceable design evidence. The knowledge-
 base connector is TODO: never invent results. If absent/failed/unmatched, require
 `<repoRoot>/openSpec/**` search/read evidence before repo conventions.
 
@@ -29,6 +30,10 @@ remaining, incomplete, or newly introduced gaps.
   lack knowledge-base or required `openSpec/` evidence; paths cross write bounds;
   commands are missing/non-deterministic; or interaction, responsive, accessibility,
   data, or failure behavior requires guessing.
+- `MOCK_STRATEGY: blocked`; missing permitted target paths, endpoint/schema-to-fixture
+  mapping, fixed verification, or dev/test-only activation; a second Mock framework;
+  inline fake data; commented real requests; Mock-on production defaults; test-only
+  production imports; or Mock evidence reported as real integration.
 
 Knowledge-base absence is advisory if relevant `openSpec/` rules were searched/read
 and applied. Block skipped fallback, unresolved conflict, or unresolved UI decisions.

package/skills/frontend-design-review/references/review-checklist.md

@@ -5,15 +5,17 @@
 - Target route/page/component and non-goals are clear.
 - Every acceptance criterion maps to steps, files, UI behavior, and verification.
 - Assumptions and unresolved ambiguity are explicit.
-- Success, error/validation, loading, empty, disabled, permission, retry, repeated-action, stale-response, and boundary states are handled or marked not applicable.
+- Applicable success, error, loading, empty, disabled, permission, retry, stale-response, and boundary states are handled or marked N/A.
 
 ## Project And Knowledge Fit
 
 - Existing components, hooks, API helpers, mocks, schemas, router patterns, templates, tokens, and theme rules were considered.
-- Component/design choices cite a knowledge-base result or relevant `openSpec/` rule.
-- If knowledge-base setup/query failed or returned no match, `<repoRoot>/openSpec/**` was recursively searched before other repo evidence.
-- Source is `knowledge-base`, `openSpec fallback`, `repository fallback`, or `unavailable`; evidence includes query/search terms, matched paths/headings, and conflicts.
+- Component/design choices cite knowledge-base or `openSpec/`; failed/empty knowledge-base queries recurse through `<repoRoot>/openSpec/**` first.
+- Evidence records source status, query terms, paths/headings, and conflicts.
 - Dependencies are authorized; paths fit allowed/write scope and avoid forbidden/generated files.
+- A required Mock-backed strategy reuses native support when proven, otherwise an
+  existing browser-intercept/request-adapter seam; it maps endpoint/states to fixtures,
+  stays in writer scope, and is off in production. `not-needed` adds none.
 
 ## Interaction And Quality
 
@@ -27,11 +29,30 @@
 - Tests prove changed state logic and flows at repository-supported levels.
 - Browser/visual checks are required only by task intent or existing gates.
 - Every missing verification path is a blocker or disclosed risk.
+- Verification entrypoints are frozen; any Mock-specific command is generated only
+  from trusted sources, and behavior separately proves page consumption.
+
+## Mock Strategy Safety
+
+- The strategy protocol is valid and not `MOCK_STRATEGY: blocked`.
+- For Mock strategies, API fields and fixture states trace to contract evidence; gaps are explicit.
+- Selection follows repository capability: native mock first, browser interception
+  for existing e2e, request adapter/injection for local preview.
+- The real request remains enabled by default; activation is explicit, reversible,
+  local/test-only, and excluded from production behavior.
+- Verification uses only shell entrypoints fixed when the DAG was generated; the
+  plan does not invent commands that shell nodes cannot execute.
+- Mock strategies include a production/default-real-path build with Mock off and
+  Mock-backed behavior evidence. `not-needed` instead needs applicable real or
+  no-remote behavior evidence.
+- Mock-backed checks prove frontend states only. Real integration remains pending
+  until the actual backend path has fresh evidence.
 
 ## Verdict Matrix
 
 - Coverage gap, unsafe scope, unauthorized dependency, unresolved required interaction, or missing required verification: request revision.
 - Missing knowledge-base evidence and skipped `openSpec/` fallback: request revision.
 - No relevant knowledge-base or `openSpec/` rule for a required decision: request revision.
+- Unsafe/missing mock strategy or mock evidence presented as real integration: request revision.
 - Knowledge-base unavailable but relevant `openSpec/` rules were applied: advisory connection gap, not a specification gap.
 - Optional cleanup that cannot affect acceptance: advisory.

package/skills/frontend-implementation/SKILL.md

@@ -1,11 +1,13 @@
 ---
 name: frontend-implementation
 description: >-
-  Use for frontend contract, scout, plan, and implementation DAG nodes.
+  Use for frontend contract, scout, mock strategy, plan, and implementation DAG nodes.
 references:
-  - path: references/node-contracts.md
-    required: true
-    maxChars: 3200
+  - path: references/node-contracts.md
+    required: true
+    # Compact contract index must stay under skill total budget (~10k with body + other refs).
+    # Headroom above current ~4k file; do not raise alone without checking totalMaxChars.
+    maxChars: 6000
   - path: references/design-spec.md
     required: true
     maxChars: 3000
@@ -16,39 +18,32 @@ references:
 
 # Frontend Implementation
 
-For `frontend-contract-pi`, `frontend-scout-pi`, `frontend-plan-pi`, and
-`frontend-implement-pi`. Read all required references first.
+Read all required references before running any listed frontend node.
 
 ## Source And Evidence Rules
 
-Use task sources/references, constraints, then `task.json`. Resolve design rules in
-`design-spec.md` order: query the knowledge base; if unavailable, failed, or empty,
-search `<repoRoot>/openSpec/**`; only then use other repository evidence.
-
-- Cite paths/symbols or tight lines; label assumptions, questions, and missing evidence.
-- Never invent conventions, APIs, tokens, commands, or knowledge-base results.
-- Record `knowledge-base`, `openSpec fallback`, `repository fallback`, or `unavailable`, plus evidence/conflicts.
-
-### Observable Spec Retrieval
-
-Scout/planner nodes must `grep`/`find` relevant `openSpec/**` and skill references,
-then explicitly `read` every consulted spec (`SKILL.md`, `design-spec.md`,
-`code-standards.md`, etc.). Observe derives evidence from session tool events: only
-successful paired `read` calls count as “已读取规范文件”; summaries do not. If the
-knowledge base is unavailable, record `openSpec/**` search hits before repo fallback.
+Use task sources/references, constraints, then `task.json`. Follow `design-spec.md`:
+knowledge base; `<repoRoot>/openSpec/**` after unavailable/failed/empty; then repo
+evidence. Cite tight paths/symbols, label gaps/conflicts, and never invent APIs,
+rules, commands, or retrievals. Scout/planners locate and explicitly read applicable
+specs; only successful paired reads count. Lockfile-only, fixture-only, or unread
+search hits do not prove a reusable Mock service.
 
 ## Implementation Discipline
 
-- Project specs and repo-local skills are authoritative within scope.
-- Reuse confirmed components, tokens, helpers, APIs, mocks, schemas, and tests.
-- Add dependencies only when task and approved plan allow them.
-- Cover success/error/loading/empty/disabled/permission/boundary states; justify N/A.
-- Keep state/validation testable. Writers stay in `writeSet`, preserve unrelated behavior, and update tests.
+- Reuse confirmed specs, components, tokens, helpers, APIs, mocks, schemas, and tests.
+- Keep real requests enabled by default; never comment them out for a mock.
+- Prefer native Mock support; otherwise use existing browser interception for e2e or
+  a reversible request adapter/DI seam for local preview.
+- Trace fixtures to API/schema evidence. Activation is explicit, dev/test-only,
+  production-off; Mock evidence never proves real API integration.
+- Add dependencies only when approved. Cover applicable success/loading/empty/error/
+  permission/boundary states and justify N/A.
+- Keep state testable. Stay in `writeSet`, preserve behavior, and update tests.
 - Never relax lint/type/test/build config or write unauthorized generated output.
 
 ## Output And Failure Rules
 
-- Follow `node-contracts.md` headings exactly. Read-only nodes return Markdown and never edit files.
-- Missing input blocks work when proceeding would guess behavior, compliance, write bounds, or verification.
-- Preserve protocol tokens, commands, paths, identifiers, and output language.
-- Attempted checks may be reported; completion needs fresh downstream shell evidence.
+- Follow `node-contracts.md`; read-only nodes never edit. Missing input blocks work
+  when proceeding would guess behavior, bounds, or verification.
+- Preserve tokens, commands, paths, IDs, and language. Completion needs fresh shell evidence.

package/skills/frontend-implementation/references/code-standards.md

@@ -1,34 +1,32 @@
 # Frontend Code Standards
 
-Discover project rules from task constraints, the component/design source sequence
-in `design-spec.md`, configuration, source, tests, manifests, and generated types.
-When knowledge-base access is unavailable, relevant `<repoRoot>/openSpec/**` rules
-are normative for the current project. Generic style preferences are not rules, and
-documentation never overrides an installed API without an explicit compatibility decision.
+Discover rules from task constraints, `design-spec.md` source order, config, code,
+tests, manifests, and generated types. After knowledge-base failure, applicable
+`<repoRoot>/openSpec/**` rules are normative. Preferences are not rules, and docs do
+not override installed APIs without an explicit compatibility decision.
 
 ## Discover And Cite
 
-- Routing, server/client boundaries, state, forms, data fetching, cache/invalidation, and error boundaries.
-- API, mock, page, component, hook, utility, schema, template, and test directories.
-- Component, hook, route, mock, utility, and test naming.
-- Unit, component, integration, browser/e2e, fixture, and mock expectations.
-- Approved/forbidden dependencies and human-approval rules.
+- Find routing and server/client boundaries; state, forms, data/cache, and errors;
+  API/mock/UI/schema/test locations and naming; supported tests; dependency rules.
 
-Cite a representative file or configuration for every convention. When neighboring
-code conflicts, describe the alternatives rather than silently choosing one.
+Cite representative files/config for each convention. Describe conflicts instead of
+silently selecting one.
 
 ## Plan And Implement
 
-- Map each acceptance criterion to code and verification.
-- Determine component placement, state ownership, request lifecycle, validation, error handling, API/schema compatibility, mocks, and fixtures.
-- Prefer existing helpers and public APIs; preserve behavior outside the contract.
-- Keep rendering, transitions, validation, and side effects separable where the project pattern supports it.
-- Handle cancellation, stale responses, repeated actions, and boundary inputs when applicable.
-- Update tests at repository-supported levels; update relevant existing tests before adding duplicates.
-- Keep writes inside `writeSet`; generated output requires explicit authorization.
+- Map criteria to code and checks. Define placement, state ownership, request
+  lifecycle, validation/failures, API compatibility, mocks, and fixtures.
+- Trace fixtures to API evidence; label gaps. Prefer native mocks, then browser
+  interception for existing e2e, then a reversible request adapter/DI preview seam.
+- Real API stays default; mock activation is explicit, local/test-only,
+  non-production, and removable.
+- Reuse helpers/public APIs and preserve out-of-contract behavior. Keep rendering,
+  transitions, validation, and side effects testable; cover lifecycle races/bounds
+  when relevant. Update supported tests; stay in `writeSet`.
 
 ## Prohibited
 
-- Do not relax lint/type/test configuration.
-- Do not add dependencies, a parallel component library, styling system, or state framework without permission.
-- Do not describe an unexecuted command or unavailable browser/knowledge-base flow as verified.
+- Do not relax checks, add unapproved dependencies, comment real requests, hardcode
+  fixtures in production UI, import test mocks into production, store fixture
+  secrets, equate mock evidence with real integration, or report unrun checks as verified.

package/skills/frontend-implementation/references/node-contracts.md

@@ -1,63 +1,27 @@
 # Frontend Node Contracts
 
-Pre-implementation nodes are read-only. Preserve IDs, protocol tokens, source
-labels, language, and named output headings.
+Pre-write nodes are read-only. Preserve IDs, labels, commands, language, required headings.
 
-## `frontend-contract-pi`
+## Core nodes
 
-Read task sources, constraints, config, and references. Define scope, non-goals,
-routes/components, runtime, flows, criteria, states, risks, and verification. Never
-turn a guess into a requirement. Output: `Scope`,
-`Non-goals`, `Acceptance Criteria`, `UI States`, `Target Runtime Environment`,
-`Risks`, `Verification Expectations`.
+- **`frontend-contract-pi`**: `Scope`, `Non-goals`, `Acceptance Criteria`, `UI States`, `Target Runtime Environment`, `Risks`, `Verification Expectations`. No guessed requirements.
+- **`frontend-scout-pi`**: routes, components, tokens, data/API/Mock, scripts, tests, assets. Fact vs inference vs gap. Knowledge base first; else search+read `<repoRoot>/openSpec/**` before repo fallback. Output stack, routes, components, styling, conventions, state/data, test entry points, reuse, risks.
+- **`frontend-mock-assess-pi` + gate**: first non-empty line  
+  `MOCK_STRATEGY: native|browser-intercept|request-adapter|not-needed|blocked`  
+  Prefer native Mock; browser intercept only with existing e2e; request-adapter only for reversible local preview. `not-needed` needs positive no-remote/stable-backend evidence; invalid when `frontendMock.policy=required`. `blocked` for missing/conflicting contracts, unsafe paths/deps, unread specs, production-default-on, unverifiable entrypoints. Output Mock Decision, API/spec/service evidence, backend readiness, selection evidence, endpoint/fixture matrix, activation, targets, production safety, verification plan, real-integration gap, blocking issues. Never invent fields, store secrets, comment real requests, import test mocks into production, or treat Mock as real integration. Gate uses `first-non-empty` only; never authorizes writes. Unsafe required contracts → no writer.
+- **`frontend-plan-pi` + design loop**: AC → steps, in-bound files, UI states, reuse, deps, activation/rollback, frozen verify entrypoints, real-integration gap. First gate: `VERDICT: pass|request-revision`. Pass may emit `PASS_NO_REVISION_NEEDED`; else full corrected plan without invented evidence. Final review rechecks plan/findings/revision/assessment/Mock safety. Only final `VERDICT: pass` authorizes writes; failure → replan/rerun (not dev-fix).
+- **`frontend-implement-pi`**: sole exclusive writer. Stay in `writeSet`; real requests default-on; Mock reversible, dev/test-only, production-off. Atomic handler/intercept/adapter with consumer+tests. Stop on forbidden paths or guesses. Output changed files, behavior, UI states, styling notes, verification attempted, residual risks. Optional mock-verify when frozen; static+behavior always; behavior must prove page consumption.
 
-## `frontend-scout-pi`
+## Contract / trace / stages (M1–M2)
 
-Inspect routes, components, styles/tokens, state/data, APIs/mocks, scripts, tests,
-and assets. Separate facts, inferences, and gaps. Query knowledge-base;
-if absent/failed/unmatched, search and read `<repoRoot>/openSpec/**` before repo
-conventions. Record source, query/terms, and paths. Output: `Frontend Stack`,
-`Routes`, `Components`, `Styling System`, `Existing Design Conventions`,
-`State / Data Flow`, `Test Entry Points`, `Reuse Opportunities`, `Risks`.
+- Contract shell: `jsonArtifactGate` → `contracts/frontend-implementation-contract.json` from revision (one fenced JSON or pure JSON); schemaId `frontend-implementation-contract-v1`. Final design + implement depend on it; `MOCK_STRATEGY: blocked` not implementable.
+- Trace shell: `frontend-verification-trace-gate` binds contract `verificationTargets` to static/behavior records (`commandLabels`, file exists, optional symbol). Assess `MOCK_STRATEGY:` must match `mockApi.strategy` when present. Writes `contracts/frontend-verification-trace.json`. Browser/visual always `not-run`.
+- Implement stages: (1) contract confirm (2) tests sync (3) component/UI (4) API/Mock (5) frozen checks (6) diff cleanup. Summary: Contract Ref, Changed Files, Requirements, UI States, Tests, Verification Attempts, Deviations, Residual Risks.
 
-## `frontend-plan-pi`
+## Repair (M3)
 
-Map each criterion to implementation and verification. Name in-bound files; define
-states, reuse, interactions, dependencies, and commands. Apply `openSpec/` rules
-when knowledge-base fails; ask only for material conflicts. Output: `Implementation Steps`, `Target
-Files`, `UI State Handling`, `Styling / Component Strategy`, `Interaction Notes`,
-`Dependency Policy`, `Verification Plan`, `Residual Risks`.
+static/behavior/trace may `nonZeroExitPolicy: record`. Assess → `contracts/frontend-repair-assessment.json`. Repair-contract fail-closed on non-repairable (contract/path/dependency/credential/deploy/spec-unclear) or writeSet expansion. `frontend-repair-pi`: same writeSet as implement; no re-spec; max 1 attempt. Reverify/retrace fail policy; review/closeout use post-repair evidence.
 
-## First design protocol gate
+## Risk & capability (M4–M6)
 
-`frontend-first-design-gate-shell` reads `frontend-design-gate-pi`'s first
-non-empty line. It accepts only `VERDICT: pass` or `VERDICT: request-revision` and
-blocks malformed output. It never authorizes writes; request-revision enters plan
-revision. Line mode: `first-verdict-line`.
-
-## `frontend-plan-revision-pi`
-
-Consume the original plan and first review findings. On first-gate pass, output
-`PASS_NO_REVISION_NEEDED`; on request-revision, address every Required Plan
-Correction in a complete plan with the plan headings above. Always `read-only`;
-never edit code, docs, or artifacts.
-
-## Final design review and gate
-
-`frontend-final-design-review-pi` rechecks the original plan for
-`PASS_NO_REVISION_NEEDED`, otherwise verifies every correction and rejects any
-remaining/new gap. Its first non-empty line is exactly `VERDICT: pass` or
-`VERDICT: request-revision`.
-
-`frontend-final-design-gate-shell` reads that verdict and accepts only
-`VERDICT: pass`. It is the sole write authorization. Failure routes to
-`ContractMismatch` / `frontend-plan-revision-and-rerun`, never `ProductBug` /
-`dev-fix`. Line mode: `first-verdict-line`.
-
-## `frontend-implement-pi`
-
-Depends directly on final gate, revision plan, and final review. After pass, re-read
-current files and implement only the approved plan inside `writeSet`; stop on
-forbidden paths or blocking guesses. Reuse primitives and update tests. Output:
-`Changed Files`, `Implemented Behavior`, `UI States Covered`, `Styling / Component
-Notes`, `Verification Attempted`, `Residual Risks`.
+Deterministic risk (no model); high-risk beats small; supervised never small. Small may drop first design gate + plan-revision; contract shell retargets to `frontend-plan-pi`. Capability seed injects adapters; openSpec/task sources outrank. A11y: static/component tools only when present; Browser a11y always not-run.

package/skills/frontend-review/SKILL.md

@@ -4,14 +4,16 @@ description: Use to review completed frontend code and verification before close
 references:
   - path: references/review-findings.md
     required: true
+    maxChars: 2800
 ---
 
 # Frontend Review
 
 Use for `frontend-review-pi`; read the findings guide first. Required inputs are
-original task/reference material, derived contract/constraints, approved plan and
-design verdict, implementation summary, actual diff, and shell evidence. Missing
-actual diff or required evidence forces revision; never infer it from a summary.
+original task/reference material, contract/constraints, Mock assessment, original and
+revised/confirmed plan, final design verdict, implementation summary, actual diff,
+and static/behavior/optional Mock shell evidence. Missing actual diff or required
+evidence forces revision; never infer it from a summary.
 
 ## Verdict Contract
 
@@ -21,10 +23,14 @@ required check, forbidden write, or unmet acceptance criterion forces revision.
 
 ## Review Scope
 
-- Compare original intent, derived artifacts, approved plan, actual diff, and evidence; report lost or altered requirements.
+- Compare intent, contract, plan, diff, and evidence; report altered requirements.
 - Inspect every changed file against allowed, forbidden, and approved write scope.
 - Map criteria to behavior, applicable UI states, tests, and shell evidence.
 - Review state/data flow, validation, async/error behavior, components/design, responsive behavior, accessibility, dependencies, maintenance, and regression risk when applicable.
+- Inspect static, behavior, and available Mock-specific artifacts directly. For Mock
+  strategies, compare the endpoint matrix, handler/fixture/adapter and consumer diff;
+  require the real request as default, contract-aligned fixtures, production isolation,
+  and no false real-integration claim. `not-needed` needs applicable real/no-remote evidence.
 - Component/design claims require traceable knowledge-base evidence or, after connection/query failure or no match, relevant `<repoRoot>/openSpec/**` evidence. The connector format is TODO; never claim a query or fallback search without evidence. Execute explicit `grep`/`find` to locate spec files and `read` to load them before referencing their rules. Only successful `read` tool calls are observable as "已读取规范文件" in the spec-evidence inspector.
 - Treat shell exit status as authoritative. Do not edit files.
 

package/skills/frontend-review/references/review-findings.md

@@ -3,7 +3,7 @@
 ## Severity
 
 - **Critical**: blocks primary flow, corrupts data, violates security/privacy, writes forbidden paths, or bypasses required verification.
-- **Important**: acceptance/state/validation gap, material convention drift, missing behavior tests, unauthorized dependency, or failed/missing required verification.
+- **Important**: acceptance/state/validation gap, material convention drift, missing behavior tests, unauthorized dependency, unsafe mock activation/import, mock-contract drift, misleading real-integration claim, or failed/missing required verification.
 - **Minor**: non-blocking maintainability, copy, layout, or cleanup issue.
 
 ## Evidence
@@ -19,8 +19,11 @@
 2. Compare original requirement with derived contract/constraints.
 3. Map each criterion to code, states, tests, and evidence.
 4. Inspect interactions, state/data/API behavior, failure paths, and regression risk.
-5. Check component/design evidence, responsive/accessibility behavior, dependencies, and maintenance fit when applicable.
-6. Classify findings and derive the verdict mechanically.
+5. Check mock selection, contract-to-fixture mapping, activation/default path,
+   handler/fixture/adapter and consumer diff, optional Mock-specific verification,
+   production imports, evidence scope, and the documented real-integration gap.
+6. Check component/design evidence, responsive/accessibility behavior, dependencies, and maintenance fit when applicable.
+7. Classify findings and derive the verdict mechanically.
 
 Skipping the required `openSpec/` search after knowledge-base failure is Important
 when component/design compliance affects acceptance or implementation choices.
@@ -39,4 +42,6 @@ Avoid vague advice. When no source location exists, cite the command or artifact
 - Required static and behavior nodes ran and passed.
 - Changed files are authorized.
 - Criteria and applicable states have implementation and evidence.
+- Required Mock-backed behavior passed; any generated Mock-specific verification also
+  passed; Mock is not enabled by default in production.
 - Optional unavailable knowledge-base, browser, visual, or manual checks remain explicit risks.

package/skills/frontend-verification/SKILL.md

@@ -4,6 +4,7 @@ description: Use to assess frontend evidence and produce closeout.
 references:
   - path: references/verification-checklist.md
     required: true
+    maxChars: 3000
 ---
 
 # Frontend Verification
@@ -11,30 +12,42 @@ references:
 Use for `frontend-closeout-pi`. Shell nodes execute commands; this read-only skill
 assesses their evidence. Read the checklist first.
 
-Required inputs: criteria, implementation summary/change inventory, static and
-behavior shell commands/source/status/artifacts, review verdict/findings, and any
-required browser, visual, manual, or knowledge-base validation.
+Inputs: criteria, change inventory, shell commands/status/artifacts, review
+verdict/findings, and required browser, visual, manual, or knowledge evidence.
 
 ## Evidence Rules
 
-- Static evidence covers type/lint/build/schema checks; behavior evidence covers tests or interaction checks that actually exercise the flow.
-- Shell exit status is authoritative. Classify checks as `passed`, `failed`, `not-run`, `blocked`, or `unavailable`; only passed satisfies a required check.
+- Static evidence covers type/lint/build/schema; behavior evidence must exercise the flow.
+- Shell exit status is authoritative. Classify as `passed`, `failed`, `not-run`,
+  `blocked`, or `unavailable`; only passed satisfies a required check.
 - Never use static success as behavior proof, or tests as visual/browser proof they did not exercise.
-- Unavailable commands remain gaps, not weaker success claims.
-- Resolve component/design evidence as knowledge base first, then `<repoRoot>/openSpec/**` when setup/query fails or has no match. Mark `openSpec fallback` as the active project specification source; do not report it as missing merely because the connector format is TODO.
+- Mock-backed behavior proves frontend rendering and state transitions only. It never
+  proves backend readiness, transport compatibility, or real API integration.
+- Unavailable commands remain gaps.
+- Resolve design evidence via knowledge base, then `<repoRoot>/openSpec/**` after
+  failure/no match. Its connector format remains TODO; never invent it. An applied
+  `openSpec fallback` is available project evidence.
+- Separate Mock service/handler checks from page consumption and record the
+  dev/test-only boundary; handler tests alone do not prove page use.
 
 ## Method And Output
 
-Inventory required checks, map each to fresh evidence, classify gaps, confirm review
-pass, and state only proven user-visible changes.
+Map required checks to fresh evidence, classify gaps, confirm review pass, and state
+only proven changes.
 
 Return Markdown headings:
 
 - `Changes`: changed behavior and areas.
+- `Mock Decision`, `Mock Files`, `Mock Verification`, `Production Boundary`: status is `passed`, `failed`, `not-required`, `blocked`, or `unavailable`.
 - `Verification Evidence`: table of check, command/source, status, and artifact/result.
 - `Review Result`: exact review verdict and findings.
 - `Known Risks`: missing optional checks and environment caveats.
 - `Follow-up`: concrete work or `None`.
 
+When the backend remains unavailable but required mock-backed checks pass, state
+`Frontend status: mock-validated` and `Real integration: pending`. Use a completed
+`<task-id>-real-api-integration-verify` task before changing the latter to complete;
+the follow-up is explicit, not auto-created or auto-executed.
+
 Do not edit files. Do not claim complete when review is not pass or a required check
 is failed, not-run, blocked, unavailable, stale, or contradicted.

package/skills/frontend-verification/references/verification-checklist.md

@@ -4,15 +4,22 @@
 
 - Type/compile, lint/format, build, and schema/client checks ran when required.
 - Generated output was authorized.
-- Unit/component/integration tests cover changed logic and flows; regressions pass.
+- Tests cover changed logic/flows and regressions.
 - Browser/e2e/manual evidence exists when explicitly required.
-- API/mock behavior and applicable loading, empty, error, success, disabled, permission, retry, and boundary states have evidence.
+- Selected-strategy behavior and applicable loading, empty, error, success, disabled,
+  permission, retry, and boundary states have evidence from fixed DAG entrypoints.
+- When generated, Mock-specific verification checks service/handler/schema/fixtures;
+  behavior evidence separately proves page consumption.
+- For Mock strategies, activation is explicit/non-production and a production/default-
+  real-path build with Mock off confirms the real request remains default.
+- `not-needed` has positive readiness/no-remote evidence plus applicable real or
+  no-remote behavior evidence. Mock-backed evidence remains frontend-only and never
+  satisfies real API integration.
 
 ## Design And Component Evidence
 
-- Claims cite traceable knowledge-base retrieval or relevant `<repoRoot>/openSpec/**` fallback evidence.
-- Retrieval includes connector/query, collection/document ID, version when available, and time.
-- When connector setup/query fails or has no match, evidence shows recursive `openSpec/` search terms, inspected paths, matched headings/lines, and applied rules.
+- Claims cite knowledge-base retrieval or `<repoRoot>/openSpec/**` fallback.
+- Evidence records query/source/version/time or fallback search terms, paths, headings, and applied rules.
 - Relevant `openSpec/` matches become the current-project specification and satisfy source availability; only the knowledge-base connection remains unavailable.
 - Missing both sources blocks explicit compliance or an unresolved required design decision.
 
@@ -32,6 +39,8 @@ Only passed satisfies a required check. Other optional statuses remain disclosed
 - Map every criterion to evidence or a named gap.
 - Record review verdict before completion.
 - Do not conflate static, behavior, browser/visual/manual, or knowledge-base proof.
+- If only mock evidence exists, report `Frontend status: mock-validated` and
+  `Real integration: pending`, with the actual API verification as follow-up.
 
 ```markdown
 ## Changes
@@ -42,6 +51,9 @@ Only passed satisfies a required check. Other optional statuses remain disclosed
 |---|---|---|---|
 | ... | ... | passed | ... |
 
+## Mock Decision / Mock Files / Mock Verification / Production Boundary
+- Status: `passed | failed | not-required | blocked | unavailable`
+
 ## Review Result
 - Verdict: `VERDICT: pass`
 

package/skills/grill-with-docs/SKILL.md

@@ -26,7 +26,7 @@ Most repos have a single context:
 ```
 /
 ├── CONTEXT.md
-├── docs/
+├── ai_workspace/loop-agent/
 │   └── adr/
 │       ├── 0001-event-sourced-orders.md
 │       └── 0002-postgres-for-write-model.md
@@ -38,18 +38,18 @@ If a `CONTEXT-MAP.md` exists at the root, the repo has multiple contexts. The ma
 ```
 /
 ├── CONTEXT-MAP.md
-├── docs/
+├── ai_workspace/loop-agent/
 │   └── adr/                          ← system-wide decisions
 ├── src/
 │   ├── ordering/
 │   │   ├── CONTEXT.md
-│   │   └── docs/adr/                 ← context-specific decisions
+│   │   └── ai_workspace/loop-agent/adr/                 ← context-specific decisions
 │   └── billing/
 │       ├── CONTEXT.md
-│       └── docs/adr/
+│       └── ai_workspace/loop-agent/adr/
 ```
 
-Create files lazily — only when you have something to write. If no `CONTEXT.md` exists, create one when the first term is resolved. If no `docs/adr/` exists, create it when the first ADR is needed.
+Create files lazily — only when you have something to write. If no `CONTEXT.md` exists, create one when the first term is resolved. If no `ai_workspace/loop-agent/adr/` exists, create it when the first ADR is needed.
 
 ## During the session
 

package/skills/grill-with-docs/adr-format.md

@@ -1,8 +1,8 @@
 # ADR Format
 
-ADRs live in `docs/adr/` and use sequential numbering: `0001-slug.md`, `0002-slug.md`, etc.
+ADRs live in `ai_workspace/loop-agent/adr/` and use sequential numbering: `0001-slug.md`, `0002-slug.md`, etc.
 
-Create the `docs/adr/` directory lazily — only when the first ADR is needed.
+Create the `ai_workspace/loop-agent/adr/` directory lazily — only when the first ADR is needed.
 
 ## Template
 
@@ -24,7 +24,7 @@ Only include these when they add genuine value. Most ADRs won't need them.
 
 ## Numbering
 
-Scan `docs/adr/` for the highest existing number and increment by one.
+Scan `ai_workspace/loop-agent/adr/` for the highest existing number and increment by one.
 
 ## When to offer an ADR
 

package/skills/init-capability-evolution/SKILL.md

@@ -14,12 +14,12 @@ description: 用于 loop-agent 本仓库的初始化能力演化审查，判断
 - 新能力是否应该进入目标项目。
 - 新增/修改的 skill 是否应随 npm 包和 `init --profile full` 投影。
 - 目标项目的 `AGENTS.md`、README managed block、治理 docs、scripts 或 templates 是否需要更新。
-- `package.json files` 与 `docs/init-surface.manifest.json` 是否仍覆盖真实发布范围。
+- `package.json files` 与 `ai_workspace/loop-agent/init-surface.manifest.json` 是否仍覆盖真实发布范围。
 - 是否需要目标项目 smoke、init doctor、docs audit 或 package dry-run 证据。
 
 ## Trigger Tiers
 
-按 `docs/init-surface.manifest.json` 的 `evolutionReview.tiers` 判断成本：
+按 `ai_workspace/loop-agent/init-surface.manifest.json` 的 `evolutionReview.tiers` 判断成本：
 
 - `advisory`：只记录提示，不阻塞。
 - `surface-check`：运行 `bash scripts/check-init-surface.sh`；通过即可。
@@ -32,11 +32,11 @@ description: 用于 loop-agent 本仓库的初始化能力演化审查，判断
 审查时逐条回答：
 
 1. 本次变更会改变目标项目执行 `loop-agent init --profile full --merge` 后得到的文件、规则或能力吗？
-2. 是否新增、删除或重命名了 `skills/**`，并且目标项目需要 repo-local 可审计副本？
+2. 是否新增、删除或重命名了 `.agents/skills/**`，并且目标项目需要 repo-local 可审计副本？
 3. 是否改变了默认 DAG role skills、skill resolution、strict skill audit 或 task prompt 注入？
 4. 是否新增通用治理模板、script matrix、production readiness 或 operator recovery 文档，需要目标项目初始化后可见？
 5. `package.json files` 是否包含所有 npm 运行和初始化所需静态资料？
-6. `docs/init-surface.manifest.json` 是否更新了 package / init / exclude / trigger contract？
+6. `ai_workspace/loop-agent/init-surface.manifest.json` 是否更新了 package / init / exclude / trigger contract？
 7. 旧目标项目是否只需 advisory、需要手工复制新增文件，还是需要未来 `init audit/update` 迁移能力？
 
 ## Output
@@ -44,7 +44,7 @@ description: 用于 loop-agent 本仓库的初始化能力演化审查，判断
 轻量审查可以只在 handoff 中说明。高影响审查应写入：
 
 ```text
-docs/reports/YYYY-MM-DD-init-evolution-review.md
+ai_workspace/loop-agent/reports/YYYY-MM-DD-init-evolution-review.md
 ```
 
 报告保持短小，包含：