@tea-agent/loop-agent 0.13.0-beta.0 → 0.13.0

package/dist/commands/init.js

@@ -94,523 +94,523 @@ const COMPAT_PROMPTS = {
     ].join("\n"),
 };
 const GOVERNANCE_ROOT_TOKEN = "__LOOP_AGENT_GOVERNANCE_ROOT__";
-const INIT_CHECK_ENGINEERING_STRUCTURE_SH = `#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-cd "\${ROOT_DIR}"
-
-required_paths=(
-  "README.md"
-  "harness.json"
-  "AGENTS.md"
-  "${GOVERNANCE_ROOT_TOKEN}/README.md"
-  "${GOVERNANCE_ROOT_TOKEN}/development-principles.md"
-  "${GOVERNANCE_ROOT_TOKEN}/feature-workflow.md"
-  "${GOVERNANCE_ROOT_TOKEN}/verification-matrix.md"
-  "${GOVERNANCE_ROOT_TOKEN}/architecture/runtime-boundaries.md"
-  "${GOVERNANCE_ROOT_TOKEN}/templates"
-  ".agents/skills/loop-agent/SKILL.md"
-  ".harness/prompts/analyze.md"
-  ".harness/prompts/plan.md"
-  ".harness/tasks"
-  ".harness/dag-runs/active"
-  ".harness/dag-runs/completed"
-  ".harness/dag-runs/paused"
-  ".harness/runs/active"
-  ".harness/runs/completed"
-  ".harness/runs/failed"
-  "scripts/check-engineering-structure.sh"
-  "scripts/check-doc-index.sh"
-  "scripts/check-doc-links.sh"
-  "scripts/check-active-plan-status.sh"
-  "scripts/check-exec-plan-index-sync.sh"
-  "scripts/check-harness-runtime-clean.sh"
-  "scripts/check-architecture-boundaries.sh"
-  "scripts/check-skill-entry.sh"
-  "scripts/check-repo.sh"
-  "scripts/ci-governance.sh"
-  "scripts/ci-tests.sh"
-  "scripts/ci.sh"
-)
-
-missing=()
-for item in "\${required_paths[@]}"; do
-  if [[ ! -e "\${item}" ]]; then
-    missing+=("\${item}")
-  fi
-done
-
-if (( \${#missing[@]} > 0 )); then
-  echo "loop-agent 初始化检查失败，缺少必要路径："
-  for item in "\${missing[@]}"; do
-    echo "  - \${item}"
-  done
-  exit 1
-fi
-
-echo "loop-agent 工程结构检查通过"
+const INIT_CHECK_ENGINEERING_STRUCTURE_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+cd "\${ROOT_DIR}"
+
+required_paths=(
+  "README.md"
+  "harness.json"
+  "AGENTS.md"
+  "${GOVERNANCE_ROOT_TOKEN}/README.md"
+  "${GOVERNANCE_ROOT_TOKEN}/development-principles.md"
+  "${GOVERNANCE_ROOT_TOKEN}/feature-workflow.md"
+  "${GOVERNANCE_ROOT_TOKEN}/verification-matrix.md"
+  "${GOVERNANCE_ROOT_TOKEN}/architecture/runtime-boundaries.md"
+  "${GOVERNANCE_ROOT_TOKEN}/templates"
+  ".agents/skills/loop-agent/SKILL.md"
+  ".harness/prompts/analyze.md"
+  ".harness/prompts/plan.md"
+  ".harness/tasks"
+  ".harness/dag-runs/active"
+  ".harness/dag-runs/completed"
+  ".harness/dag-runs/paused"
+  ".harness/runs/active"
+  ".harness/runs/completed"
+  ".harness/runs/failed"
+  "scripts/check-engineering-structure.sh"
+  "scripts/check-doc-index.sh"
+  "scripts/check-doc-links.sh"
+  "scripts/check-active-plan-status.sh"
+  "scripts/check-exec-plan-index-sync.sh"
+  "scripts/check-harness-runtime-clean.sh"
+  "scripts/check-architecture-boundaries.sh"
+  "scripts/check-skill-entry.sh"
+  "scripts/check-repo.sh"
+  "scripts/ci-governance.sh"
+  "scripts/ci-tests.sh"
+  "scripts/ci.sh"
+)
+
+missing=()
+for item in "\${required_paths[@]}"; do
+  if [[ ! -e "\${item}" ]]; then
+    missing+=("\${item}")
+  fi
+done
+
+if (( \${#missing[@]} > 0 )); then
+  echo "loop-agent 初始化检查失败，缺少必要路径："
+  for item in "\${missing[@]}"; do
+    echo "  - \${item}"
+  done
+  exit 1
+fi
+
+echo "loop-agent 工程结构检查通过"
 `;
-const INIT_CHECK_DOC_INDEX_SH = `#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-cd "\${ROOT_DIR}"
-
-required_docs=(
-  "${GOVERNANCE_ROOT_TOKEN}/README.md"
-  "${GOVERNANCE_ROOT_TOKEN}/development-principles.md"
-  "${GOVERNANCE_ROOT_TOKEN}/feature-workflow.md"
-  "${GOVERNANCE_ROOT_TOKEN}/verification-matrix.md"
-  "${GOVERNANCE_ROOT_TOKEN}/architecture/runtime-boundaries.md"
-  "${GOVERNANCE_ROOT_TOKEN}/loop-agent-harness.md"
-  "${GOVERNANCE_ROOT_TOKEN}/harness-methodology-tdd.md"
-  "${GOVERNANCE_ROOT_TOKEN}/harness-methodology-verification.md"
-  "${GOVERNANCE_ROOT_TOKEN}/harness-methodology-debugging.md"
-  "${GOVERNANCE_ROOT_TOKEN}/templates"
-  "${GOVERNANCE_ROOT_TOKEN}/exec-plans/active/README.md"
-  "${GOVERNANCE_ROOT_TOKEN}/exec-plans/completed/README.md"
-  "${GOVERNANCE_ROOT_TOKEN}/progress/README.md"
-  "${GOVERNANCE_ROOT_TOKEN}/reports/README.md"
-  "${GOVERNANCE_ROOT_TOKEN}/decisions/README.md"
-)
-
-missing=()
-for item in "\${required_docs[@]}"; do
-  if [[ ! -e "\${item}" ]]; then
-    missing+=("\${item}")
-  fi
-done
-
-if (( \${#missing[@]} > 0 )); then
-  echo "docs 索引检查失败，缺少必要文档或目录：" >&2
-  for item in "\${missing[@]}"; do
-    echo "  - \${item}" >&2
-  done
-  exit 1
-fi
-
-echo "docs 索引检查通过"
+const INIT_CHECK_DOC_INDEX_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+cd "\${ROOT_DIR}"
+
+required_docs=(
+  "${GOVERNANCE_ROOT_TOKEN}/README.md"
+  "${GOVERNANCE_ROOT_TOKEN}/development-principles.md"
+  "${GOVERNANCE_ROOT_TOKEN}/feature-workflow.md"
+  "${GOVERNANCE_ROOT_TOKEN}/verification-matrix.md"
+  "${GOVERNANCE_ROOT_TOKEN}/architecture/runtime-boundaries.md"
+  "${GOVERNANCE_ROOT_TOKEN}/loop-agent-harness.md"
+  "${GOVERNANCE_ROOT_TOKEN}/harness-methodology-tdd.md"
+  "${GOVERNANCE_ROOT_TOKEN}/harness-methodology-verification.md"
+  "${GOVERNANCE_ROOT_TOKEN}/harness-methodology-debugging.md"
+  "${GOVERNANCE_ROOT_TOKEN}/templates"
+  "${GOVERNANCE_ROOT_TOKEN}/exec-plans/active/README.md"
+  "${GOVERNANCE_ROOT_TOKEN}/exec-plans/completed/README.md"
+  "${GOVERNANCE_ROOT_TOKEN}/progress/README.md"
+  "${GOVERNANCE_ROOT_TOKEN}/reports/README.md"
+  "${GOVERNANCE_ROOT_TOKEN}/decisions/README.md"
+)
+
+missing=()
+for item in "\${required_docs[@]}"; do
+  if [[ ! -e "\${item}" ]]; then
+    missing+=("\${item}")
+  fi
+done
+
+if (( \${#missing[@]} > 0 )); then
+  echo "docs 索引检查失败，缺少必要文档或目录：" >&2
+  for item in "\${missing[@]}"; do
+    echo "  - \${item}" >&2
+  done
+  exit 1
+fi
+
+echo "docs 索引检查通过"
 `;
-const INIT_CHECK_DOC_LINKS_SH = `#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-cd "\${ROOT_DIR}"
-
-if [[ ! -d "${GOVERNANCE_ROOT_TOKEN}" ]]; then
-  echo "docs 链接检查失败：缺少 ${GOVERNANCE_ROOT_TOKEN}/" >&2
-  exit 1
-fi
-
-missing=()
-while IFS= read -r -d '' file; do
-  while IFS= read -r link; do
-    [[ -z "\${link}" ]] && continue
-    [[ "\${link}" == http://* || "\${link}" == https://* || "\${link}" == mailto:* || "\${link}" == "#"* ]] && continue
-    [[ "\${link}" == *"://"* ]] && continue
-    target="\${link%%#*}"
-    [[ -z "\${target}" ]] && continue
-    [[ "\${target}" == /* ]] && continue
-    base="$(dirname "\${file}")"
-    if [[ ! -e "\${base}/\${target}" ]]; then
-      missing+=("\${file}: \${link}")
-    fi
-  done < <(grep -Eo '\\[[^]]+\\]\\([^)]+\\)' "\${file}" | sed -E 's/^.*\\(([^)]+)\\)$/\\1/' || true)
-done < <(find "${GOVERNANCE_ROOT_TOKEN}" -type f -name '*.md' -print0)
-
-if (( \${#missing[@]} > 0 )); then
-  echo "docs 链接检查失败：" >&2
-  for item in "\${missing[@]}"; do
-    echo "  - \${item}" >&2
-  done
-  exit 1
-fi
-
-echo "docs 链接检查通过"
+const INIT_CHECK_DOC_LINKS_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+cd "\${ROOT_DIR}"
+
+if [[ ! -d "${GOVERNANCE_ROOT_TOKEN}" ]]; then
+  echo "docs 链接检查失败：缺少 ${GOVERNANCE_ROOT_TOKEN}/" >&2
+  exit 1
+fi
+
+missing=()
+while IFS= read -r -d '' file; do
+  while IFS= read -r link; do
+    [[ -z "\${link}" ]] && continue
+    [[ "\${link}" == http://* || "\${link}" == https://* || "\${link}" == mailto:* || "\${link}" == "#"* ]] && continue
+    [[ "\${link}" == *"://"* ]] && continue
+    target="\${link%%#*}"
+    [[ -z "\${target}" ]] && continue
+    [[ "\${target}" == /* ]] && continue
+    base="$(dirname "\${file}")"
+    if [[ ! -e "\${base}/\${target}" ]]; then
+      missing+=("\${file}: \${link}")
+    fi
+  done < <(grep -Eo '\\[[^]]+\\]\\([^)]+\\)' "\${file}" | sed -E 's/^.*\\(([^)]+)\\)$/\\1/' || true)
+done < <(find "${GOVERNANCE_ROOT_TOKEN}" -type f -name '*.md' -print0)
+
+if (( \${#missing[@]} > 0 )); then
+  echo "docs 链接检查失败：" >&2
+  for item in "\${missing[@]}"; do
+    echo "  - \${item}" >&2
+  done
+  exit 1
+fi
+
+echo "docs 链接检查通过"
 `;
-const INIT_CHECK_ACTIVE_PLAN_STATUS_SH = `#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-cd "\${ROOT_DIR}"
-
-active_dir="${GOVERNANCE_ROOT_TOKEN}/exec-plans/active"
-[[ -d "\${active_dir}" ]] || { echo "active plan 检查失败：缺少 \${active_dir}" >&2; exit 1; }
-
-bad=()
-while IFS= read -r -d '' file; do
-  name="$(basename "\${file}")"
-  [[ "\${name}" == "README.md" ]] && continue
-  if grep -Eiq 'status:[[:space:]]*(completed|done|closed)|状态[:：][[:space:]]*(已完成|完成|关闭)' "\${file}"; then
-    bad+=("\${file}")
-  fi
-done < <(find "\${active_dir}" -maxdepth 1 -type f -name '*.md' -print0)
-
-if (( \${#bad[@]} > 0 )); then
-  echo "active plan 状态检查失败：已完成计划不应留在 active 目录：" >&2
-  for item in "\${bad[@]}"; do
-    echo "  - \${item}" >&2
-  done
-  exit 1
-fi
-
-echo "active plan 状态检查通过"
+const INIT_CHECK_ACTIVE_PLAN_STATUS_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+cd "\${ROOT_DIR}"
+
+active_dir="${GOVERNANCE_ROOT_TOKEN}/exec-plans/active"
+[[ -d "\${active_dir}" ]] || { echo "active plan 检查失败：缺少 \${active_dir}" >&2; exit 1; }
+
+bad=()
+while IFS= read -r -d '' file; do
+  name="$(basename "\${file}")"
+  [[ "\${name}" == "README.md" ]] && continue
+  if grep -Eiq 'status:[[:space:]]*(completed|done|closed)|状态[:：][[:space:]]*(已完成|完成|关闭)' "\${file}"; then
+    bad+=("\${file}")
+  fi
+done < <(find "\${active_dir}" -maxdepth 1 -type f -name '*.md' -print0)
+
+if (( \${#bad[@]} > 0 )); then
+  echo "active plan 状态检查失败：已完成计划不应留在 active 目录：" >&2
+  for item in "\${bad[@]}"; do
+    echo "  - \${item}" >&2
+  done
+  exit 1
+fi
+
+echo "active plan 状态检查通过"
 `;
-const INIT_CHECK_EXEC_PLAN_INDEX_SYNC_SH = `#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-cd "\${ROOT_DIR}"
-
-required=(
-  "${GOVERNANCE_ROOT_TOKEN}/exec-plans/README.md"
-  "${GOVERNANCE_ROOT_TOKEN}/exec-plans/active/README.md"
-  "${GOVERNANCE_ROOT_TOKEN}/exec-plans/completed/README.md"
-)
-
-for item in "\${required[@]}"; do
-  if [[ ! -f "\${item}" ]]; then
-    echo "exec-plan 索引同步检查失败：缺少 \${item}" >&2
-    exit 1
-  fi
-done
-
-echo "exec-plan 索引同步检查通过"
+const INIT_CHECK_EXEC_PLAN_INDEX_SYNC_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+cd "\${ROOT_DIR}"
+
+required=(
+  "${GOVERNANCE_ROOT_TOKEN}/exec-plans/README.md"
+  "${GOVERNANCE_ROOT_TOKEN}/exec-plans/active/README.md"
+  "${GOVERNANCE_ROOT_TOKEN}/exec-plans/completed/README.md"
+)
+
+for item in "\${required[@]}"; do
+  if [[ ! -f "\${item}" ]]; then
+    echo "exec-plan 索引同步检查失败：缺少 \${item}" >&2
+    exit 1
+  fi
+done
+
+echo "exec-plan 索引同步检查通过"
 `;
-const INIT_CHECK_HARNESS_RUNTIME_CLEAN_SH = `#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-cd "\${ROOT_DIR}"
-
-failures=()
-
-count_entries() {
-  local dir="$1"
-  if [[ ! -d "\${dir}" ]]; then
-    echo 0
-    return
-  fi
-  find "\${dir}" -mindepth 1 -maxdepth 1 ! -name .gitkeep | wc -l | tr -d ' '
-}
-
-if [[ "\${HARNESS_ALLOW_ACTIVE_DAG_RUNS:-}" != "1" ]]; then
-  active_dag_count="$(count_entries ".harness/dag-runs/active")"
-  [[ "\${active_dag_count}" == "0" ]] || failures+=(".harness/dag-runs/active contains \${active_dag_count} entries")
-fi
-
-if [[ "\${HARNESS_ALLOW_ACTIVE_TOOL_RUNS:-\${HARNESS_ALLOW_ACTIVE_ONE_SHOT_RUNS:-}}" != "1" ]]; then
-  active_run_count="$(count_entries ".harness/runs/active")"
-  [[ "\${active_run_count}" == "0" ]] || failures+=(".harness/runs/active contains \${active_run_count} entries")
-fi
-
-if [[ -d artifacts ]]; then
-  artifact_count="$(find artifacts -mindepth 1 -maxdepth 1 ! -name .gitkeep | wc -l | tr -d ' ')"
-  [[ "\${artifact_count}" == "0" ]] || failures+=("root artifacts/ contains \${artifact_count} entries; use ${GOVERNANCE_ROOT_TOKEN}/reports or .harness run artifacts")
-fi
-
-if (( \${#failures[@]} > 0 )); then
-  echo "[HARNESS RUNTIME DIRTY]" >&2
-  for item in "\${failures[@]}"; do
-    echo "  - \${item}" >&2
-  done
-  exit 1
-fi
-
-echo "harness runtime clean check passed"
+const INIT_CHECK_HARNESS_RUNTIME_CLEAN_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+cd "\${ROOT_DIR}"
+
+failures=()
+
+count_entries() {
+  local dir="$1"
+  if [[ ! -d "\${dir}" ]]; then
+    echo 0
+    return
+  fi
+  find "\${dir}" -mindepth 1 -maxdepth 1 ! -name .gitkeep | wc -l | tr -d ' '
+}
+
+if [[ "\${HARNESS_ALLOW_ACTIVE_DAG_RUNS:-}" != "1" ]]; then
+  active_dag_count="$(count_entries ".harness/dag-runs/active")"
+  [[ "\${active_dag_count}" == "0" ]] || failures+=(".harness/dag-runs/active contains \${active_dag_count} entries")
+fi
+
+if [[ "\${HARNESS_ALLOW_ACTIVE_TOOL_RUNS:-\${HARNESS_ALLOW_ACTIVE_ONE_SHOT_RUNS:-}}" != "1" ]]; then
+  active_run_count="$(count_entries ".harness/runs/active")"
+  [[ "\${active_run_count}" == "0" ]] || failures+=(".harness/runs/active contains \${active_run_count} entries")
+fi
+
+if [[ -d artifacts ]]; then
+  artifact_count="$(find artifacts -mindepth 1 -maxdepth 1 ! -name .gitkeep | wc -l | tr -d ' ')"
+  [[ "\${artifact_count}" == "0" ]] || failures+=("root artifacts/ contains \${artifact_count} entries; use ${GOVERNANCE_ROOT_TOKEN}/reports or .harness run artifacts")
+fi
+
+if (( \${#failures[@]} > 0 )); then
+  echo "[HARNESS RUNTIME DIRTY]" >&2
+  for item in "\${failures[@]}"; do
+    echo "  - \${item}" >&2
+  done
+  exit 1
+fi
+
+echo "harness runtime clean check passed"
 `;
-const INIT_CHECK_ARCHITECTURE_BOUNDARIES_SH = `#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-cd "\${ROOT_DIR}"
-
-boundary_doc="${GOVERNANCE_ROOT_TOKEN}/architecture/runtime-boundaries.md"
-if [[ ! -f "\${boundary_doc}" ]]; then
-  echo "architecture boundary 检查失败：缺少 \${boundary_doc}" >&2
-  exit 1
-fi
-
-violations=()
-
-check_ts_import_boundary() {
-  local from_dir="$1"
-  local forbidden_dir="$2"
-  local label="$3"
-  [[ -d "\${from_dir}" && -d "\${forbidden_dir}" ]] || return 0
-  while IFS= read -r -d '' file; do
-    if grep -Eq "from ['\\\"][^'\\\"]*\${forbidden_dir}/|import\\(['\\\"][^'\\\"]*\${forbidden_dir}/|require\\(['\\\"][^'\\\"]*\${forbidden_dir}/" "\${file}"; then
-      violations+=("\${label}: \${file} imports \${forbidden_dir}")
-    fi
-  done < <(find "\${from_dir}" -type f \\( -name '*.ts' -o -name '*.tsx' -o -name '*.js' -o -name '*.jsx' -o -name '*.mjs' -o -name '*.cjs' \\) -print0)
-}
-
-# These checks are intentionally optional and stack-agnostic. They activate only
-# when a target repository has recognizable source directories.
-check_ts_import_boundary "src/workflows" "src/commands" "workflow-runtime"
-check_ts_import_boundary "src/executors" "src/commands" "executors"
-check_ts_import_boundary "src/domain" "src/infrastructure" "domain"
-
-if (( \${#violations[@]} > 0 )); then
-  echo "architecture boundary 检查失败：" >&2
-  for item in "\${violations[@]}"; do
-    echo "  - \${item}" >&2
-  done
-  echo "请更新 \${boundary_doc} 中的层边界，或修正反向依赖。" >&2
-  exit 1
-fi
-
-echo "architecture boundary 检查通过"
+const INIT_CHECK_ARCHITECTURE_BOUNDARIES_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+cd "\${ROOT_DIR}"
+
+boundary_doc="${GOVERNANCE_ROOT_TOKEN}/architecture/runtime-boundaries.md"
+if [[ ! -f "\${boundary_doc}" ]]; then
+  echo "architecture boundary 检查失败：缺少 \${boundary_doc}" >&2
+  exit 1
+fi
+
+violations=()
+
+check_ts_import_boundary() {
+  local from_dir="$1"
+  local forbidden_dir="$2"
+  local label="$3"
+  [[ -d "\${from_dir}" && -d "\${forbidden_dir}" ]] || return 0
+  while IFS= read -r -d '' file; do
+    if grep -Eq "from ['\\\"][^'\\\"]*\${forbidden_dir}/|import\\(['\\\"][^'\\\"]*\${forbidden_dir}/|require\\(['\\\"][^'\\\"]*\${forbidden_dir}/" "\${file}"; then
+      violations+=("\${label}: \${file} imports \${forbidden_dir}")
+    fi
+  done < <(find "\${from_dir}" -type f \\( -name '*.ts' -o -name '*.tsx' -o -name '*.js' -o -name '*.jsx' -o -name '*.mjs' -o -name '*.cjs' \\) -print0)
+}
+
+# These checks are intentionally optional and stack-agnostic. They activate only
+# when a target repository has recognizable source directories.
+check_ts_import_boundary "src/workflows" "src/commands" "workflow-runtime"
+check_ts_import_boundary "src/executors" "src/commands" "executors"
+check_ts_import_boundary "src/domain" "src/infrastructure" "domain"
+
+if (( \${#violations[@]} > 0 )); then
+  echo "architecture boundary 检查失败：" >&2
+  for item in "\${violations[@]}"; do
+    echo "  - \${item}" >&2
+  done
+  echo "请更新 \${boundary_doc} 中的层边界，或修正反向依赖。" >&2
+  exit 1
+fi
+
+echo "architecture boundary 检查通过"
 `;
-const INIT_CHECK_SKILL_ENTRY_SH = `#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-cd "\${ROOT_DIR}"
-
-check_skill() {
-  local skill_name="$1"
-  shift
-  local skill_dir=".agents/skills/\${skill_name}"
-  local skill_md="\${skill_dir}/SKILL.md"
-  local missing=()
-
-  if [[ ! -f "\${skill_md}" ]]; then
-    echo "skill entry 检查失败：缺少 \${skill_md}" >&2
-    exit 1
-  fi
-  grep -Eq "^name:[[:space:]]*\${skill_name}[[:space:]]*$" "\${skill_md}" || missing+=("frontmatter name")
-  grep -Eq '^description:[[:space:]]*[^[:space:]]' "\${skill_md}" || missing+=("frontmatter description")
-
-  local ref
-  for ref in "$@"; do
-    [[ -f "\${skill_dir}/\${ref}" ]] || missing+=("\${ref}")
-    grep -Fq "\${ref}" "\${skill_md}" || missing+=("SKILL.md -> \${ref}")
-  done
-  if (( \${#missing[@]} > 0 )); then
-    echo "skill entry 检查失败（\${skill_name}）：" >&2
-    printf '  - %s\\n' "\${missing[@]}" >&2
-    exit 1
-  fi
-
-  local line_count
-  line_count="$(wc -l < "\${skill_md}" | tr -d ' ')"
-  if [[ "\${line_count}" =~ ^[0-9]+$ && "\${line_count}" -gt 180 ]]; then
-    echo "skill entry 检查失败：\${skill_md} 行数为 \${line_count}，入口应保持精简" >&2
-    exit 1
-  fi
-  echo "skill entry 检查通过：\${skill_name} references ok, lines=\${line_count}"
-}
-
-check_skill "loop-agent" \\
-  "references/harness-policy.md" \\
-  "references/hybrid-dag.md" \\
-  "references/verification-and-failure-handling.md" \\
-  "references/command-reference.md"
-check_skill "agent-worker" "references/agent-worker-operator.md"
-
-description_line="$(grep -E '^description:' .agents/skills/agent-worker/SKILL.md | head -n 1 | tr '[:upper:]' '[:lower:]')"
-for term in "agent-worker" "feature packet" "taskspec" "task pool" "self-host" "candidate" "loop-agent"; do
-  if [[ "\${description_line}" != *"\${term}"* ]]; then
-    echo "skill entry 检查失败（agent-worker）：description 缺少触发/路由词 \${term}" >&2
-    exit 1
-  fi
-done
+const INIT_CHECK_SKILL_ENTRY_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+cd "\${ROOT_DIR}"
+
+check_skill() {
+  local skill_name="$1"
+  shift
+  local skill_dir=".agents/skills/\${skill_name}"
+  local skill_md="\${skill_dir}/SKILL.md"
+  local missing=()
+
+  if [[ ! -f "\${skill_md}" ]]; then
+    echo "skill entry 检查失败：缺少 \${skill_md}" >&2
+    exit 1
+  fi
+  grep -Eq "^name:[[:space:]]*\${skill_name}[[:space:]]*$" "\${skill_md}" || missing+=("frontmatter name")
+  grep -Eq '^description:[[:space:]]*[^[:space:]]' "\${skill_md}" || missing+=("frontmatter description")
+
+  local ref
+  for ref in "$@"; do
+    [[ -f "\${skill_dir}/\${ref}" ]] || missing+=("\${ref}")
+    grep -Fq "\${ref}" "\${skill_md}" || missing+=("SKILL.md -> \${ref}")
+  done
+  if (( \${#missing[@]} > 0 )); then
+    echo "skill entry 检查失败（\${skill_name}）：" >&2
+    printf '  - %s\\n' "\${missing[@]}" >&2
+    exit 1
+  fi
+
+  local line_count
+  line_count="$(wc -l < "\${skill_md}" | tr -d ' ')"
+  if [[ "\${line_count}" =~ ^[0-9]+$ && "\${line_count}" -gt 180 ]]; then
+    echo "skill entry 检查失败：\${skill_md} 行数为 \${line_count}，入口应保持精简" >&2
+    exit 1
+  fi
+  echo "skill entry 检查通过：\${skill_name} references ok, lines=\${line_count}"
+}
+
+check_skill "loop-agent" \\
+  "references/harness-policy.md" \\
+  "references/hybrid-dag.md" \\
+  "references/verification-and-failure-handling.md" \\
+  "references/command-reference.md"
+check_skill "agent-worker" "references/agent-worker-operator.md"
+
+description_line="$(grep -E '^description:' .agents/skills/agent-worker/SKILL.md | head -n 1 | tr '[:upper:]' '[:lower:]')"
+for term in "agent-worker" "feature packet" "taskspec" "task pool" "self-host" "candidate" "loop-agent"; do
+  if [[ "\${description_line}" != *"\${term}"* ]]; then
+    echo "skill entry 检查失败（agent-worker）：description 缺少触发/路由词 \${term}" >&2
+    exit 1
+  fi
+done
 `;
-const INIT_CHECK_REPO_SH = `#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-cd "\${ROOT_DIR}"
-
-checks=(
-  "scripts/check-engineering-structure.sh"
-  "scripts/check-doc-index.sh"
-  "scripts/check-doc-links.sh"
-  "scripts/check-active-plan-status.sh"
-  "scripts/check-exec-plan-index-sync.sh"
-  "scripts/check-harness-runtime-clean.sh"
-  "scripts/check-architecture-boundaries.sh"
-  "scripts/check-skill-entry.sh"
-  "scripts/check-product-line-docs.sh"
-)
-
-for check in "\${checks[@]}"; do
-  echo "==> bash \${check}"
-  bash "\${check}"
-  echo
-done
-
-echo "仓库治理检查全部通过"
+const INIT_CHECK_REPO_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+cd "\${ROOT_DIR}"
+
+checks=(
+  "scripts/check-engineering-structure.sh"
+  "scripts/check-doc-index.sh"
+  "scripts/check-doc-links.sh"
+  "scripts/check-active-plan-status.sh"
+  "scripts/check-exec-plan-index-sync.sh"
+  "scripts/check-harness-runtime-clean.sh"
+  "scripts/check-architecture-boundaries.sh"
+  "scripts/check-skill-entry.sh"
+  "scripts/check-product-line-docs.sh"
+)
+
+for check in "\${checks[@]}"; do
+  echo "==> bash \${check}"
+  bash "\${check}"
+  echo
+done
+
+echo "仓库治理检查全部通过"
 `;
-const INIT_CHECK_PRODUCT_LINE_DOCS_SH = `#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-cd "\${ROOT_DIR}"
-
-if ! command -v agent-worker >/dev/null 2>&1; then
-  echo "product-line docs check skipped: agent-worker is not installed"
-  exit 0
-fi
-
-feature_dirs=()
-for root in features product/features dogfood/features; do
-  [[ -d "\${root}" ]] || continue
-  while IFS= read -r feature_dir; do
-    if [[ ! -f "\${feature_dir}/acceptance.yaml" ]]; then
-      echo "product-line docs check failed: incomplete feature packet missing acceptance.yaml: \${feature_dir}" >&2
-      exit 1
-    fi
-    feature_dirs+=("\${feature_dir}")
-  done < <(find "\${root}" -mindepth 1 -maxdepth 1 -type d | sort)
-done
-
-if [[ \${#feature_dirs[@]} -eq 0 ]]; then
-  echo "product-line docs check skipped: no feature packets found"
-  exit 0
-fi
-
-for feature_dir in "\${feature_dirs[@]}"; do
-  echo "==> validate product-line feature: \${feature_dir}"
-  agent-worker task validate-feature "\${feature_dir}"
-done
-
-echo "product-line docs checks passed: \${#feature_dirs[@]} feature packet(s)"
+const INIT_CHECK_PRODUCT_LINE_DOCS_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+cd "\${ROOT_DIR}"
+
+if ! command -v agent-worker >/dev/null 2>&1; then
+  echo "product-line docs check skipped: agent-worker is not installed"
+  exit 0
+fi
+
+feature_dirs=()
+for root in features product/features dogfood/features; do
+  [[ -d "\${root}" ]] || continue
+  while IFS= read -r feature_dir; do
+    if [[ ! -f "\${feature_dir}/acceptance.yaml" ]]; then
+      echo "product-line docs check failed: incomplete feature packet missing acceptance.yaml: \${feature_dir}" >&2
+      exit 1
+    fi
+    feature_dirs+=("\${feature_dir}")
+  done < <(find "\${root}" -mindepth 1 -maxdepth 1 -type d | sort)
+done
+
+if [[ \${#feature_dirs[@]} -eq 0 ]]; then
+  echo "product-line docs check skipped: no feature packets found"
+  exit 0
+fi
+
+for feature_dir in "\${feature_dirs[@]}"; do
+  echo "==> validate product-line feature: \${feature_dir}"
+  agent-worker task validate-feature "\${feature_dir}"
+done
+
+echo "product-line docs checks passed: \${#feature_dirs[@]} feature packet(s)"
 `;
-const INIT_CI_GOVERNANCE_SH = `#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-cd "\${ROOT_DIR}"
-
-bash scripts/check-repo.sh
+const INIT_CI_GOVERNANCE_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+cd "\${ROOT_DIR}"
+
+bash scripts/check-repo.sh
 `;
-const INIT_CI_TESTS_SH = `#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-cd "\${ROOT_DIR}"
-
-ran=0
-notes=()
-
-run_cmd() {
-  echo "==> $*"
-  "$@"
-  ran=1
-}
-
-run_bash() {
-  echo "==> $*"
-  bash -lc "$*"
-  ran=1
-}
-
-has_make_target() {
-  local target="$1"
-  [[ -f Makefile || -f makefile ]] || return 1
-  grep -Eq "^[[:alnum:]_.-]*\${target}[[:alnum:]_.-]*:" Makefile makefile 2>/dev/null
-}
-
-has_npm_script() {
-  local script="$1"
-  [[ -f package.json ]] || return 1
-  command -v node >/dev/null 2>&1 || return 1
-  node -e "const fs=require('fs'); const p=JSON.parse(fs.readFileSync('package.json','utf8')); process.exit(p.scripts && p.scripts[process.argv[1]] ? 0 : 1)" "\${script}" >/dev/null 2>&1
-}
-
-if [[ -f package.json ]]; then
-  if command -v npm >/dev/null 2>&1; then
-    for script in lint typecheck test build; do
-      if has_npm_script "\${script}"; then
-        run_cmd npm run "\${script}"
-      fi
-    done
-  else
-    notes+=("package.json exists but npm is not available")
-  fi
-fi
-
-if has_make_target verify; then
-  run_cmd make verify
-elif has_make_target test; then
-  run_cmd make test
-fi
-
-if [[ -f go.mod ]]; then
-  if command -v go >/dev/null 2>&1; then
-    run_cmd go test ./...
-  else
-    notes+=("go.mod exists but go is not available")
-  fi
-fi
-
-if [[ -f Cargo.toml ]]; then
-  if command -v cargo >/dev/null 2>&1; then
-    run_cmd cargo test
-  else
-    notes+=("Cargo.toml exists but cargo is not available")
-  fi
-fi
-
-if [[ -f pyproject.toml || -f pytest.ini || -f tox.ini ]]; then
-  if command -v pytest >/dev/null 2>&1; then
-    run_cmd pytest
-  elif command -v tox >/dev/null 2>&1 && [[ -f tox.ini ]]; then
-    run_cmd tox
-  else
-    notes+=("Python project metadata found but pytest/tox is not available")
-  fi
-fi
-
-if [[ -f pom.xml ]]; then
-  if command -v mvn >/dev/null 2>&1; then
-    run_cmd mvn test
-  else
-    notes+=("pom.xml exists but mvn is not available")
-  fi
-fi
-
-if [[ -f build.gradle || -f build.gradle.kts || -f settings.gradle || -f settings.gradle.kts ]]; then
-  if [[ -x ./gradlew ]]; then
-    run_cmd ./gradlew test
-  elif command -v gradle >/dev/null 2>&1; then
-    run_cmd gradle test
-  else
-    notes+=("Gradle project metadata found but gradle/gradlew is not available")
-  fi
-fi
-
-if compgen -G "*.sln" >/dev/null || compgen -G "*.csproj" >/dev/null; then
-  if command -v dotnet >/dev/null 2>&1; then
-    run_cmd dotnet test
-  else
-    notes+=(".NET project metadata found but dotnet is not available")
-  fi
-fi
-
-if (( ran == 0 )); then
-  echo "未检测到可安全自动运行的项目测试入口。"
-  echo "loop-agent 治理检查仍可运行；请让初始化模型根据目标项目技术栈补充 scripts/ci-tests.sh 与 ${GOVERNANCE_ROOT_TOKEN}/verification-matrix.md。"
-fi
-
-if (( \${#notes[@]} > 0 )); then
-  echo "项目验证探测备注："
-  for note in "\${notes[@]}"; do
-    echo "  - \${note}"
-  done
-fi
+const INIT_CI_TESTS_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+cd "\${ROOT_DIR}"
+
+ran=0
+notes=()
+
+run_cmd() {
+  echo "==> $*"
+  "$@"
+  ran=1
+}
+
+run_bash() {
+  echo "==> $*"
+  bash -lc "$*"
+  ran=1
+}
+
+has_make_target() {
+  local target="$1"
+  [[ -f Makefile || -f makefile ]] || return 1
+  grep -Eq "^[[:alnum:]_.-]*\${target}[[:alnum:]_.-]*:" Makefile makefile 2>/dev/null
+}
+
+has_npm_script() {
+  local script="$1"
+  [[ -f package.json ]] || return 1
+  command -v node >/dev/null 2>&1 || return 1
+  node -e "const fs=require('fs'); const p=JSON.parse(fs.readFileSync('package.json','utf8')); process.exit(p.scripts && p.scripts[process.argv[1]] ? 0 : 1)" "\${script}" >/dev/null 2>&1
+}
+
+if [[ -f package.json ]]; then
+  if command -v npm >/dev/null 2>&1; then
+    for script in lint typecheck test build; do
+      if has_npm_script "\${script}"; then
+        run_cmd npm run "\${script}"
+      fi
+    done
+  else
+    notes+=("package.json exists but npm is not available")
+  fi
+fi
+
+if has_make_target verify; then
+  run_cmd make verify
+elif has_make_target test; then
+  run_cmd make test
+fi
+
+if [[ -f go.mod ]]; then
+  if command -v go >/dev/null 2>&1; then
+    run_cmd go test ./...
+  else
+    notes+=("go.mod exists but go is not available")
+  fi
+fi
+
+if [[ -f Cargo.toml ]]; then
+  if command -v cargo >/dev/null 2>&1; then
+    run_cmd cargo test
+  else
+    notes+=("Cargo.toml exists but cargo is not available")
+  fi
+fi
+
+if [[ -f pyproject.toml || -f pytest.ini || -f tox.ini ]]; then
+  if command -v pytest >/dev/null 2>&1; then
+    run_cmd pytest
+  elif command -v tox >/dev/null 2>&1 && [[ -f tox.ini ]]; then
+    run_cmd tox
+  else
+    notes+=("Python project metadata found but pytest/tox is not available")
+  fi
+fi
+
+if [[ -f pom.xml ]]; then
+  if command -v mvn >/dev/null 2>&1; then
+    run_cmd mvn test
+  else
+    notes+=("pom.xml exists but mvn is not available")
+  fi
+fi
+
+if [[ -f build.gradle || -f build.gradle.kts || -f settings.gradle || -f settings.gradle.kts ]]; then
+  if [[ -x ./gradlew ]]; then
+    run_cmd ./gradlew test
+  elif command -v gradle >/dev/null 2>&1; then
+    run_cmd gradle test
+  else
+    notes+=("Gradle project metadata found but gradle/gradlew is not available")
+  fi
+fi
+
+if compgen -G "*.sln" >/dev/null || compgen -G "*.csproj" >/dev/null; then
+  if command -v dotnet >/dev/null 2>&1; then
+    run_cmd dotnet test
+  else
+    notes+=(".NET project metadata found but dotnet is not available")
+  fi
+fi
+
+if (( ran == 0 )); then
+  echo "未检测到可安全自动运行的项目测试入口。"
+  echo "loop-agent 治理检查仍可运行；请让初始化模型根据目标项目技术栈补充 scripts/ci-tests.sh 与 ${GOVERNANCE_ROOT_TOKEN}/verification-matrix.md。"
+fi
+
+if (( \${#notes[@]} > 0 )); then
+  echo "项目验证探测备注："
+  for note in "\${notes[@]}"; do
+    echo "  - \${note}"
+  done
+fi
 `;
-const INIT_CI_SH = `#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
-cd "\${ROOT_DIR}"
-
-bash scripts/ci-governance.sh
-bash scripts/ci-tests.sh
+const INIT_CI_SH = `#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")/.." && pwd)"
+cd "\${ROOT_DIR}"
+
+bash scripts/ci-governance.sh
+bash scripts/ci-tests.sh
 `;
 const INIT_SCRIPT_FILES = {
     "scripts/check-engineering-structure.sh": INIT_CHECK_ENGINEERING_STRUCTURE_SH,
@@ -679,9 +679,34 @@ function buildManagedAgentsBlock(input) {
         "- 保留无关的用户改动，不要回退自己没有做的修改。",
         "- 委托模型写入前，必须把写入边界写成结构化 `task.json.allowedPaths` / `task.json.forbiddenPaths`，再审查生成 DAG 的 writer `writeSet`；不要只依赖 `source/执行约束.md` 的自然语言约束。",
         "",
+        "### 自然语言入口路由",
+        "",
+        "用户用中文表达意图时，按以下三类入口路由；只读与写入必须严格区分。",
+        "",
+        "| 用户表达 | 入口 | 执行动作 |",
+        "|---|---|---|",
+        "| loop-agent 初始化 / loop agent 初始化 / loop agent初始化 / 初始化 loop-agent | 初始化 | 完成确定性初始化闭环 |",
+        "| 初始化更新校验 / 检查初始化更新 / loop-agent 初始化更新校验 / loop agent初始化更新校验 | 更新校验 | 只读报告，不写入 |",
+        "| 初始化安全更新 / 应用初始化更新 / loop-agent 初始化安全更新 / loop agent初始化安全更新 | 安全更新 | check-update 后只执行确定性安全动作 |",
+        "",
+        "**更新校验（只读）**：用户说“初始化更新校验”“检查初始化更新”时，只读执行下面命令，汇报 deterministic actions、model merge、human decisions 和 next steps。**这一步不得自动执行 `apply-safe` 或模型合并。**",
+        "",
+        "```bash",
+        "loop-agent init check-update --repo-root . --markdown",
+        "```",
+        "",
+        "**安全更新（写入型）**：用户明确说“初始化安全更新”“应用初始化更新”时，先 check-update，再执行确定性安全动作；surface 缺失时先 bootstrap，存在 human decisions 时停下等用户决策。model merge 任务必须带 allowed/forbidden paths，且不得自动决策。安全更新完成后必须复查 `loop-agent init doctor --repo-root .`、`loop-agent inspect --repo-root .`、`loop-agent docs audit --repo-root .` 与目标项目治理检查（如 `bash scripts/check-repo.sh`）。",
+        "",
+        "```bash",
+        "loop-agent init check-update --repo-root . --markdown",
+        "loop-agent init update --repo-root . --apply-safe",
+        "```",
+        "",
+        "仅当 check-update 报告 surface 缺失时才执行 `loop-agent init update --repo-root . --bootstrap-surface`。",
+        "",
         "### 初始化闭环",
         "",
-        `当用户要求在本仓库初始化 loop-agent，或发现 \`README.md\` / \`${input.governanceRoot}/verification-matrix.md\` 仍停留在通用初始化状态时，模型应在同一轮工作中完成初始化闭环，不要把补全文档和验证矩阵留给用户交互。`,
+        `当用户要求初始化 loop-agent（“初始化 loop-agent”“loop agent 初始化”“loop agent初始化”“loop-agent 初始化”），或发现 \`README.md\` / \`${input.governanceRoot}/verification-matrix.md\` 仍停留在通用初始化状态时，模型应在同一轮工作中完成初始化闭环，不要把补全文档和验证矩阵留给用户交互。`,
         "",
         "标准流程：",
         "",
@@ -731,6 +756,22 @@ function buildManagedAgentsBlock(input) {
         "",
         "执行 DAG 前必须审查 profile routing、governance profile、writer 的 `writeSet`、`allowedPaths`、`forbiddenPaths`、shell verification 和 decision gate mode。不要执行占位或过宽的写入范围。",
         "",
+        "### 任务类型路由（taskKind）",
+        "",
+        "- 用户明确提出后端测试、接口/API 测试、pytest，或语境明确为后端的自动化测试时，必须把 `.harness/tasks/<task-id>/task.json` 的 `taskKind` 设置为 `\"backend-test\"`，不得保留默认 `standard`。",
+        "- `backend-test` 是 `taskKind`，不是 `--profile` 的可选值；运行 `dag run-task` 时继续使用 `--profile auto`，也可按需显式选择 `minimal` / `standard` / `reviewed` / `supervised`，不要把业务模板名当作 profile。",
+        "- 仅出现“自动化测试”且无法判断前后端时，先阅读任务源与目标项目技术栈再决定，禁止无条件路由到 `backend-test`。",
+        "",
+        "### 运行看板（只读）",
+        "",
+        "启动本地只读运行看板：",
+        "",
+        "```bash",
+        "agent-worker observe serve --repo . --port 8787",
+        "```",
+        "",
+        "浏览器打开 `http://127.0.0.1:8787/`。看板只读，默认只绑定本机 `127.0.0.1`；不要直接暴露到公开网络。",
+        "",
         "### DAG 诊断与收口",
         "",
         "执行后优先使用 `loop-agent dag report --run-id <run-id> --markdown` 读取 run facts；失败或 paused run 使用 `loop-agent dag doctor --run-id <run-id> --markdown` 诊断。失败 DAG run 不应写成成功 closeout，应使用 `loop-agent dag closeout-draft --run-id <run-id>` 生成 failure handoff，保留 what failed、evidence、classification、recommended follow-up、safe retry conditions 和 human decision needed。",
@@ -822,6 +863,9 @@ export function buildManagedGitignoreBlock() {
         ".harness/task-pool/*",
         ".task-pool/",
         "",
+        "# repo-local skill dependencies installed inside projected skills",
+        ".agents/skills/*/node_modules/",
+        "",
         "# multi-worktree parallel mode",
         ".worktrees/",
         GITIGNORE_BLOCK_END,
@@ -1242,7 +1286,7 @@ async function buildCurrentSurfaceState(input) {
             repoRoot: input.repoRoot,
             projectName: input.projectName,
             governanceRoot: input.governanceRoot,
-            entry,
+            entry: manifestEntry,
         });
         const sourceSha256 = desired.content === undefined ? undefined : sha256Text(desired.content);
         const base = {
@@ -1318,6 +1362,19 @@ async function buildCurrentSurfaceState(input) {
 }
 async function writeInitSurfaceState(input) {
     const state = await buildCurrentSurfaceState(input);
+    if (input.stateKind === "recorded" && input.preserveOwnershipFrom) {
+        for (const [pathName, file] of Object.entries(state.files)) {
+            if (file.relationship !== "local-existing-unknown")
+                continue;
+            const priorHash = input.preserveOwnershipFrom.files[pathName]?.currentSha256;
+            if (priorHash !== undefined) {
+                file.currentSha256 = priorHash;
+            }
+            else {
+                delete file.currentSha256;
+            }
+        }
+    }
     const target = path.join(input.repoRoot, INIT_SURFACE_STATE_PATH);
     await mkdir(path.dirname(target), { recursive: true });
     await writeFile(target, `${JSON.stringify(state, null, 2)}\n`, "utf-8");
@@ -1867,9 +1924,28 @@ function buildTargetFeatureWorkflow(input) {
         "",
         "- `taskKind: \"frontend-implementation\"` explicitly selects the frontend DAG for compatibility or intentional override. Optional `frontendMock` config sets `policy: auto|required|disabled`, an existing `serviceRoot`, and generation-time-frozen `verifyCommands`; an unsafe or incomplete explicit required contract produces an assessment-only DAG with no writer, while a complete required contract adds Mock-specific verification only when trusted commands exist. Auto API tasks without a native service may use an existing browser interception harness or reversible request adapter, then continue through static and behavior verification.",
         "- `taskKind: \"backend-test\"` selects the dedicated backend test DAG. Its Pi nodes analyze requirements, generate and review backend cases, generate pytest, and retrospect on results; shell gate/execution nodes enforce the review verdict and run the target project's pytest. The backend test templates (`backend-test-dag.json` and the `backend-test-dag.*.prompt.md` files) ship inside the loop-agent package as static references and are projected to target projects under the governance `templates/` directory.",
+        "- `taskKind: \"knowledge-sync\"` selects the Feature-scoped test-knowledge write-back DAG (collect → draft → validate → apply → pointer). Bind `featureId` in `task.json` (or hardConstraints / requirement text). It writes only under `features/<featureId>/…` after final verification evidence exists.",
+        "- `taskKind: \"knowledge-graph-bootstrap\"` selects the business knowledge-graph bootstrap DAG (preflight → inventory → propose → validate → review → gate → promote → materialize). AI writes only `knowledge/bootstrap/staging/**`; promote is merge-new-only.",
         "- `taskKind: \"frontend-test\"` selects the FE-test RAG DAG. It writes a traceable frontend RAG package and Markdown case manifest, then executes manifest cases serially with `playwright-cli` in isolated test environments and retains per-case evidence. It never generates pytest or Playwright source code. `frontendTest.maxCasesPerBatch` defaults to 20 (maximum 50); optional `maxTokensPerCase` and `maxTotalTokens` stop only later cases after a completed case's token usage is recorded, marking them `blocked: token-budget-exhausted`. Generated browser startup uses `playwright-cli open --browser=chrome --headed <base-url>`; the generic playwright-cli skill is unchanged.",
         "- Only eligible read-only Pi nodes (planner, scout, reviewer, verifier, closeout with no write-capable tool profile) receive the conservative automatic retry policy. Supervisor, implementer, writer, docs-only, dynamic, shell, static, and decision-gate nodes are not retried automatically. Eligible nodes cannot write repository files; the controller only records immutable attempt evidence under `.harness/dag-runs/<state>/<run-id>/<node-id>/attempt-<n>.json`.",
         "",
+        "Use the package-backed public knowledge CLI for graph operations. Do not require target projects to run package-only kb runtime scripts:",
+        "",
+        "```bash",
+        "loop-agent knowledge graph-init --product-name <name>",
+        "# edit knowledge/bootstrap/scope.yaml, then:",
+        "loop-agent dag run-task <task-id>   # taskKind: knowledge-graph-bootstrap",
+        "loop-agent knowledge query --mode by_feature --feature F-2026-004 --json",
+        "loop-agent knowledge query --mode by_id --id SVC-order --json",
+        "loop-agent knowledge query --mode search --text \"keyword\" --json",
+        "loop-agent knowledge graph-incremental-prepare --feature F-2026-004 --service <service>",
+        "# review the prepared scope/staging; for a manual reviewed promotion:",
+        "loop-agent knowledge graph-promote",
+        "loop-agent knowledge graph-materialize",
+        "```",
+        "",
+        "Daily Feature test-knowledge write-back still uses `taskKind: \"knowledge-sync\"` with a bound `featureId`, separate from graph bootstrap/incremental entry points.",
+        "",
         "## Verification",
         "",
         `Use \`${input.governanceRoot}/verification-matrix.md\` to choose the narrowest command that proves the claim.`,
@@ -2563,38 +2639,31 @@ export async function applyInitUpdate(input) {
         });
     }
     if (input.applySafe) {
+        const existingSurface = await readExistingSurfaceState(repoRoot);
+        // Preserve source strength: recorded stays recorded so unchanged owned files
+        // remain deterministic refresh candidates; bootstrap/inferred stays inferred.
+        const preservedStateKind = existingSurface?.stateKind === "recorded" ? "recorded" : "inferred-baseline";
         const report = await checkInitUpdate({ repoRoot, projectName, governanceRoot });
         for (const action of report.deterministicActions) {
             if (action.type === "bootstrap-surface") {
                 skipped.push(action);
                 continue;
             }
-            if (action.type !== "strip-pi-requires-api-key" &&
-                action.type !== "add-harness-schema-ref" &&
-                action.type !== "refresh-owned-file" &&
-                action.type !== "migrate-harness-governance-root" &&
-                action.type !== "migrate-harness-model-fields" &&
-                action.type !== "migrate-owned-file" &&
-                action.type !== "remove-owned-file" &&
-                action.type !== "remove-empty-directory") {
-                const currentState = await buildCurrentSurfaceState({
-                    repoRoot,
-                    projectName,
-                    governanceRoot,
-                    stateKind: "inferred-baseline",
-                });
-                const relationship = currentState.files[action.path]?.relationship;
-                if (relationship === "local-existing-unknown") {
-                    skipped.push(action);
-                    continue;
-                }
-            }
+            // The report was produced immediately before this batch. Each action also
+            // performs its own target check; missing-file writes refuse existing paths,
+            // while managed blocks merge into the latest user-authored content.
             if (await applySafeAction({ repoRoot, projectName, governanceRoot, action }))
                 applied.push(action);
             else
                 skipped.push(action);
         }
-        await writeInitSurfaceState({ repoRoot, projectName, governanceRoot, stateKind: "inferred-baseline" });
+        await writeInitSurfaceState({
+            repoRoot,
+            projectName,
+            governanceRoot,
+            stateKind: preservedStateKind,
+            preserveOwnershipFrom: existingSurface,
+        });
     }
     return {
         applied,