@tea-agent/loop-agent 0.15.0 → 0.16.0

package/dist/worker/outcomes/adapters.js

@@ -0,0 +1,144 @@
+import path from "node:path";
+import { splitStructuredArtifactIdentity } from "./evidence-tokens.js";
+/**
+ * Shared artifact extraction. Every successful worker run produces a canonical
+ * `run_record` (the worker-run-record.json) and a `dag` (the generated DAG
+ * JSON). These are the deterministic `kind` tokens the required-output gate
+ * matches literally. Workflow adapters extend this with workflow-specific
+ * artifacts surfaced from the DAG report (e.g. structured JSON artifact gates).
+ *
+ * Adapters never invent tokens outside the canonical facts: if a report node
+ * did not emit a structured artifact, no artifact is added for it.
+ */
+function canonicalArtifacts(input) {
+    const artifacts = [];
+    if (input.runRecordPath) {
+        artifacts.push({
+            path: toRepoRelativePath(input.repoRoot, input.runRecordPath),
+            sha256: "",
+            kind: "run_record",
+        });
+    }
+    if (input.dagPath) {
+        artifacts.push({
+            path: toRepoRelativePath(input.repoRoot, input.dagPath),
+            sha256: "",
+            kind: "dag_json",
+        });
+    }
+    return artifacts;
+}
+function toRepoRelativePath(repoRoot, candidate) {
+    return path.relative(repoRoot, candidate) || candidate;
+}
+/**
+ * Pull structured JSON artifacts emitted by DAG nodes (jsonArtifactGate
+ * outputs). The adapter only carries path+sha256 when both are present in the
+ * report; the projector re-validates the sha256 against the file on disk.
+ */
+function structuredArtifactsFromReport(run) {
+    if (!run?.nodes)
+        return [];
+    const artifacts = [];
+    for (const node of run.nodes) {
+        if (node.structuredArtifactPath &&
+            node.structuredArtifactSha256 &&
+            node.structuredArtifactSchemaId) {
+            const identity = splitStructuredArtifactIdentity(node.structuredArtifactSchemaId);
+            artifacts.push({
+                path: node.structuredArtifactPath,
+                sha256: node.structuredArtifactSha256,
+                kind: identity.kind,
+                schemaId: identity.schemaId,
+            });
+        }
+    }
+    return artifacts;
+}
+/**
+ * `agent-dag` — the default standard agent DAG. No dedicated test/integration
+ * harness; integration status is `mock:false, real:false` (neither a mock nor a
+ * declared real integration). The canonical artifacts are run_record + dag.
+ */
+class AgentDagAdapter {
+    workflow = "agent-dag";
+    project(input) {
+        return {
+            artifacts: [
+                ...canonicalArtifacts(input),
+                ...structuredArtifactsFromReport(input.dagReportRun),
+            ],
+            acceptanceCoverage: [...input.acceptanceRefs],
+            integrationStatus: { mock: false, real: false },
+        };
+    }
+}
+/**
+ * `frontend-implementation` — produces a frontend implementation contract
+ * structured artifact. No automated real integration by default.
+ */
+class FrontendImplementationAdapter {
+    workflow = "frontend-implementation";
+    project(input) {
+        return {
+            artifacts: [
+                ...canonicalArtifacts(input),
+                ...structuredArtifactsFromReport(input.dagReportRun),
+            ],
+            acceptanceCoverage: [...input.acceptanceRefs],
+            integrationStatus: { mock: false, real: false },
+        };
+    }
+}
+/**
+ * `backend-test` — generates + executes backend tests. Integration status is
+ * `real: true` only when the report completed (a real test execution); mock is
+ * always distinct and never merged into the real flag.
+ */
+class BackendTestAdapter {
+    workflow = "backend-test";
+    project(input) {
+        const real = input.reportDecision.succeeded;
+        return {
+            artifacts: [
+                ...canonicalArtifacts(input),
+                ...structuredArtifactsFromReport(input.dagReportRun),
+            ],
+            acceptanceCoverage: [...input.acceptanceRefs],
+            integrationStatus: { mock: false, real },
+        };
+    }
+}
+/**
+ * `frontend-test` — browser/UI tests. Distinct from backend-test: `real` is
+ * true only on a successful report; mock is never merged with real.
+ */
+class FrontendTestAdapter {
+    workflow = "frontend-test";
+    project(input) {
+        const real = input.reportDecision.succeeded;
+        return {
+            artifacts: [
+                ...canonicalArtifacts(input),
+                ...structuredArtifactsFromReport(input.dagReportRun),
+            ],
+            acceptanceCoverage: [...input.acceptanceRefs],
+            integrationStatus: { mock: false, real },
+        };
+    }
+}
+const ADAPTERS = new Map([
+    ["agent-dag", new AgentDagAdapter()],
+    ["frontend-implementation", new FrontendImplementationAdapter()],
+    ["backend-test", new BackendTestAdapter()],
+    ["frontend-test", new FrontendTestAdapter()],
+]);
+export const OUTCOME_ADAPTER_WORKFLOWS = [...ADAPTERS.keys()];
+/**
+ * Resolve the outcome adapter for a workflow. Unknown workflows return
+ * `undefined` so the projector can fail closed deterministically — there is no
+ * silent fallback.
+ */
+export function getOutcomeAdapter(workflow) {
+    return ADAPTERS.get(workflow);
+}

package/dist/worker/outcomes/evidence-tokens.js

@@ -0,0 +1,29 @@
+/**
+ * Shared evidence / artifact identity helpers for Outcome gates, Feature review,
+ * and Feature Verification Bundle projection.
+ */
+/** Canonical required-output / required_evidence token for shell exit-zero. */
+export const SHELL_VERIFICATION_TOKEN = "shell_verification";
+/**
+ * Accept the canonical underscore form and the legacy hyphen form used in early
+ * fullstack packets so dual-coverage and bundle evidence stay aligned.
+ */
+export function isShellVerificationToken(token) {
+    return token === SHELL_VERIFICATION_TOKEN || token === "shell-verification";
+}
+/** Match an evidence token against artifact `kind` or `schemaId`. */
+export function artifactMatchesEvidenceToken(artifact, token) {
+    return artifact.kind === token || artifact.schemaId === token;
+}
+/**
+ * Derive stable `kind` + versioned `schemaId` from a DAG structured-artifact
+ * schema id (e.g. `backend-test-result-v1` → kind `backend-test-result`).
+ * Unversioned ids keep kind === schemaId.
+ */
+export function splitStructuredArtifactIdentity(schemaId) {
+    const match = /^(.*)-v\d+$/.exec(schemaId);
+    if (match?.[1]) {
+        return { kind: match[1], schemaId };
+    }
+    return { kind: schemaId, schemaId };
+}

package/dist/worker/outcomes/gate.js

@@ -0,0 +1,40 @@
+import { isShellVerificationToken, } from "./evidence-tokens.js";
+export { artifactMatchesEvidenceToken, isShellVerificationToken, } from "./evidence-tokens.js";
+/**
+ * Deterministic required-output gate.
+ *
+ * The gate runs *after* a successful DAG report. It performs a **literal
+ * string match** of each known `outputs.required` token against produced
+ * artifact kinds (and the shell-verification exit-zero fact).
+ *
+ * Known tokens (`run_record`, `dag_json`, `shell_verification` / legacy
+ * `shell-verification`) fail closed when absent. Unknown legacy tokens are
+ * intentionally ignored for compatibility — they never invent a mapping and
+ * never block promotion. An empty `required` list always passes.
+ *
+ * This gate is the success-criteria guardrail: "DAG report succeeded but a
+ * known required output is missing ⇒ the Task must not be marked Done."
+ */
+export function checkRequiredOutputs(envelope, requiredOutputs) {
+    if (requiredOutputs.length === 0) {
+        return { passed: true, missing: [] };
+    }
+    const producedKinds = new Set(envelope.artifacts
+        .map((artifact) => artifact.kind)
+        .filter((value) => Boolean(value)));
+    const missing = [];
+    for (const token of requiredOutputs) {
+        if (isShellVerificationToken(token)) {
+            if (!envelope.shellVerification?.exitZero)
+                missing.push(token);
+            continue;
+        }
+        if (KNOWN_ARTIFACT_OUTPUTS.has(token) && !producedKinds.has(token)) {
+            missing.push(token);
+        }
+        // Unknown tokens: intentionally ignored (legacy compatibility).
+    }
+    return { passed: missing.length === 0, missing };
+}
+/** M2 deliberately resolves only stable, deterministic legacy tokens. */
+const KNOWN_ARTIFACT_OUTPUTS = new Set(["run_record", "dag_json"]);

package/dist/worker/outcomes/projector.js

@@ -0,0 +1,185 @@
+import path from "node:path";
+import { readFile, stat } from "node:fs/promises";
+import { sha256File } from "../pool/run-store.js";
+import { taskOutcomeEnvelopeV1Schema } from "./types.js";
+import { getOutcomeAdapter } from "./adapters.js";
+/**
+ * Deterministic path-containment guard. Mirrors run-task's `isPathInside`: a
+ * path must resolve *inside* the repo root and must not escape it. Absolute
+ * paths outside the repo are rejected so an adapter can never point at an
+ * arbitrary filesystem location. Completed DAG run facts live under
+ * `.harness/dag-runs/`; outcome artifacts must not be read from outside the
+ * repo root.
+ */
+export function isRepoRelativePath(repoRoot, candidate) {
+    if (!candidate)
+        return false;
+    const resolved = path.resolve(repoRoot, candidate);
+    const relative = path.relative(path.resolve(repoRoot), resolved);
+    return (relative !== "" &&
+        !relative.startsWith("..") &&
+        !path.isAbsolute(relative));
+}
+function contractError(reason, missingOutputs) {
+    return {
+        ok: false,
+        category: "ContractMismatch",
+        reason,
+        ...(missingOutputs && missingOutputs.length > 0 ? { missingOutputs } : {}),
+    };
+}
+function envFailure(reason) {
+    return { ok: false, category: "EnvFailure", reason };
+}
+/**
+ * Project a completed worker run into a {@link TaskOutcomeEnvelopeV1}.
+ *
+ * The projector is the single deterministic gate between canonical facts and a
+ * successful outcome envelope:
+ * 1. Identity: `taskSpec.feature_id === runRecord.featureId`, `taskId` match,
+ *    and `workerRunId` ownership (the run record must own the worker run id).
+ * 2. Workflow: an adapter must exist for the resolved workflow — no fallback.
+ * 3. Artifacts: every artifact path must be repo-relative; sha256 declared by
+ *    the adapter is re-computed from the file on disk and compared. A missing
+ *    file or hash mismatch is `EnvFailure` / `ContractMismatch` respectively.
+ * 4. Schema: the assembled envelope must parse against the strict schema.
+ *
+ * A projection failure is never turned into a successful Task Pool fact.
+ */
+export async function projectOutcome(input) {
+    // 1. Identity.
+    if (input.taskSpec.feature_id !== input.runRecord.featureId) {
+        return contractError(`feature_id mismatch: taskSpec=${input.taskSpec.feature_id} runRecord=${input.runRecord.featureId}`);
+    }
+    if (input.taskSpec.id !== input.runRecord.taskId) {
+        return contractError(`taskId mismatch: taskSpec=${input.taskSpec.id} runRecord=${input.runRecord.taskId}`);
+    }
+    if (input.workerRunId !== input.runRecord.workerRunId) {
+        return contractError(`workerRunId ownership mismatch: input=${input.workerRunId} runRecord=${input.runRecord.workerRunId}`);
+    }
+    // 2. Workflow adapter (no silent fallback).
+    const workflow = (input.runRecord.workflow ?? resolveLegacyWorkflow(input));
+    if (!workflow) {
+        return contractError(`outcome projection requires a resolved workflow; run record has none`);
+    }
+    const adapter = getOutcomeAdapter(workflow);
+    if (!adapter) {
+        return contractError(`no outcome adapter for workflow "${workflow}"`);
+    }
+    // 3. Adapter projection (pure; no FS).
+    const adapterProjection = adapter.project(input);
+    // 4. Artifact path + hash validation.
+    const validatedArtifacts = [];
+    for (const artifact of adapterProjection.artifacts) {
+        if (!isRepoRelativePath(input.repoRoot, artifact.path)) {
+            return contractError(`artifact path is not repo-relative: ${artifact.path}`);
+        }
+        const resolved = path.resolve(input.repoRoot, artifact.path);
+        let exists;
+        try {
+            await stat(resolved);
+            exists = true;
+        }
+        catch {
+            exists = false;
+        }
+        if (!exists) {
+            return envFailure(`artifact file is missing: ${artifact.path}`);
+        }
+        const recomputed = await safeSha256File(resolved);
+        if (recomputed === undefined) {
+            return envFailure(`artifact file is unreadable: ${artifact.path}`);
+        }
+        if (artifact.sha256 && artifact.sha256 !== recomputed) {
+            return contractError(`artifact sha256 mismatch for ${artifact.path}: declared=${artifact.sha256} actual=${recomputed}`);
+        }
+        validatedArtifacts.push({
+            path: artifact.path,
+            sha256: recomputed,
+            ...(artifact.kind ? { kind: artifact.kind } : {}),
+            ...(artifact.schemaId ? { schemaId: artifact.schemaId } : {}),
+        });
+    }
+    // 5. Shell verification from report decision (exit-zero = report succeeded).
+    const shellVerification = {
+        exitZero: input.reportDecision.succeeded,
+        ...(input.reportDecision.reason
+            ? { evidenceRef: input.reportDecision.reason }
+            : {}),
+    };
+    const controllerIdentity = input.runRecord.controllerIdentity
+        ? {
+            packageName: input.runRecord.controllerIdentity.packageName,
+            packageVersion: input.runRecord.controllerIdentity.packageVersion,
+        }
+        : undefined;
+    const sourceBinding = input.sourceBinding ?? deriveSourceBinding(input);
+    const outcomeStatus = input.reportDecision.succeeded ? "succeeded" : "failed";
+    const outcomeFailure = outcomeStatus === "failed"
+        ? {
+            category: "EnvFailure",
+            reason: input.reportDecision.reason || "DAG report did not succeed",
+        }
+        : undefined;
+    const envelope = {
+        schemaVersion: 1,
+        identity: {
+            featureId: input.runRecord.featureId,
+            taskId: input.runRecord.taskId,
+            workflow,
+            workerRunId: input.runRecord.workerRunId,
+            ...(input.runRecord.harnessTaskId
+                ? { harnessTaskId: input.runRecord.harnessTaskId }
+                : {}),
+        },
+        sourceBinding,
+        acceptanceCoverage: adapterProjection.acceptanceCoverage,
+        artifacts: validatedArtifacts,
+        shellVerification,
+        integrationStatus: adapterProjection.integrationStatus,
+        ...(controllerIdentity ? { controllerIdentity } : {}),
+        createdAt: input.now.toISOString(),
+        outcomeStatus,
+        ...(outcomeFailure ? { outcomeFailure } : {}),
+    };
+    // 6. Strict schema parse.
+    const parsed = taskOutcomeEnvelopeV1Schema.safeParse(envelope);
+    if (!parsed.success) {
+        return contractError(`outcome envelope failed schema validation: ${parsed.error.message}`);
+    }
+    return { ok: true, envelope: parsed.data };
+}
+function deriveSourceBinding(input) {
+    // TaskSpec paths may point into the Feature Packet (and need not be copied
+    // into an isolated test repo); the materializer owns their immutable copy.
+    // Preserve the declared binding here without treating availability as a
+    // successful artifact claim.
+    return { sourceFiles: [input.taskSpecPath] };
+}
+/**
+ * Legacy fallback for run records written before the additive `workflow` field.
+ * Resolves deterministically from the TaskSpec execution.workflow so M2 never
+ * changes Ready Planner routing.
+ */
+function resolveLegacyWorkflow(input) {
+    return input.taskSpec.execution?.workflow;
+}
+async function safeSha256File(filePath) {
+    try {
+        return await sha256File(filePath);
+    }
+    catch {
+        return undefined;
+    }
+}
+// read-side helper kept for symmetry with store.ts callers that need raw bytes.
+export async function readRepoFile(repoRoot, relativePath) {
+    if (!isRepoRelativePath(repoRoot, relativePath))
+        return undefined;
+    try {
+        return await readFile(path.resolve(repoRoot, relativePath), "utf-8");
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/worker/outcomes/registry.js

@@ -0,0 +1 @@
+export {};

package/dist/worker/outcomes/store.js

@@ -0,0 +1,131 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { assertSafeTaskPoolId, getTaskPoolRoot, sha256Text, } from "../pool/run-store.js";
+import { TASK_POOL_STATE_ERROR_CODES, TaskPoolStateError, } from "../pool/types.js";
+import { taskOutcomeEnvelopeV1Schema } from "./types.js";
+/** Canonical M2 projection root, shared with other Task Pool artifacts. */
+export const OUTCOMES_RELATIVE_ROOT = "artifacts";
+export function getOutcomesRoot(repoRoot) {
+    return path.join(getTaskPoolRoot(repoRoot), OUTCOMES_RELATIVE_ROOT);
+}
+export function getOutcomePath(repoRoot, workerRunId) {
+    assertSafeTaskPoolId(workerRunId, "outcome workerRunId");
+    const outcomePath = path.join(getOutcomesRoot(repoRoot), workerRunId, "task-outcome.json");
+    assertWithinOutcomesRoot(repoRoot, outcomePath);
+    return outcomePath;
+}
+/**
+ * Path-containment guard mirroring run-store's `assertWithinStatesRoot`. An
+ * outcome path must resolve strictly under `.harness/task-pool/outcomes/` so a
+ * crafted workerRunId can never escape to arbitrary repo paths or, crucially,
+ * into `.harness/dag-runs/**` completed facts.
+ */
+export function assertWithinOutcomesRoot(repoRoot, candidatePath) {
+    const outcomesRoot = path.resolve(getOutcomesRoot(repoRoot));
+    const resolved = path.resolve(candidatePath);
+    const relative = path.relative(outcomesRoot, resolved);
+    if (relative.startsWith("..") || path.isAbsolute(relative)) {
+        throw new TaskPoolStateError(TASK_POOL_STATE_ERROR_CODES.PATH_MISMATCH, `Task Pool outcome path escapes outcomes root: ${candidatePath}`);
+    }
+}
+/**
+ * Persist a {@link TaskOutcomeEnvelopeV1} atomically under the worker-run
+ * isolated outcomes dir. Returns the absolute path and the sha256 of the
+ * written bytes.
+ *
+ * - Re-validates the envelope against the strict schema before writing (a
+ *   projection failure must never become a stored successful fact).
+ * - Atomic write via mkdtemp-style temp + rename + unlink-tmp, mirroring
+ *   `writeTaskPoolState`.
+ * - Never writes under `.harness/dag-runs/**`; the containment guard rejects
+ *   any escape from the outcomes root.
+ */
+export async function writeOutcome(repoRoot, envelope) {
+    const parsed = taskOutcomeEnvelopeV1Schema.safeParse(envelope);
+    if (!parsed.success) {
+        throw new TaskPoolStateError(TASK_POOL_STATE_ERROR_CODES.PATH_MISMATCH, `refusing to write invalid outcome envelope: ${parsed.error.message}`);
+    }
+    const safe = parsed.data;
+    assertSafeTaskPoolId(safe.identity.workerRunId, "outcome workerRunId");
+    const outcomePath = getOutcomePath(repoRoot, safe.identity.workerRunId);
+    await mkdir(path.dirname(outcomePath), { recursive: true });
+    const payload = `${JSON.stringify(safe, null, 2)}\n`;
+    const tempPath = path.join(path.dirname(outcomePath), `.${path.basename(outcomePath)}.${randomUUID()}.tmp`);
+    try {
+        await writeFile(tempPath, payload, "utf-8");
+        await rename(tempPath, outcomePath);
+    }
+    finally {
+        await unlink(tempPath).catch(() => { });
+    }
+    const outcomeSha256 = await sha256Text(payload);
+    return { outcomePath, outcomeSha256 };
+}
+/**
+ * Read an outcome envelope by workerRunId. Returns `undefined` when absent or
+ * semantically invalid (read-models degrade gracefully rather than throwing).
+ */
+export async function readOutcome(repoRoot, workerRunId) {
+    const outcomePath = getOutcomePath(repoRoot, workerRunId);
+    let raw;
+    try {
+        raw = await readFile(outcomePath, "utf-8");
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return undefined;
+        throw error;
+    }
+    const parsed = taskOutcomeEnvelopeV1Schema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : undefined;
+}
+/**
+ * Read an outcome only when the Task Pool run's path and byte hash still bind
+ * it to the expected worker run. Callers receive `undefined` on any mismatch
+ * and therefore naturally fail the M3 artifact gate closed.
+ */
+export async function readVerifiedOutcome(input) {
+    if (!input.outcomePath || !input.outcomeSha256)
+        return undefined;
+    const outcomePath = input.outcomePath;
+    const expectedPath = getOutcomePath(input.repoRoot, input.workerRunId);
+    // Compare canonical (realpath-resolved) locations so a repo root reached
+    // via a symlink alias (e.g. macOS /var -> /private/var) cannot break the
+    // hash-bound outcome binding. Both paths must still resolve to the same
+    // canonical file inside the outcomes root.
+    let canonicalExpected = expectedPath;
+    let canonicalInput = outcomePath;
+    try {
+        const [resolvedExpected, resolvedInput] = await Promise.all([
+            realpath(expectedPath).catch(() => expectedPath),
+            realpath(outcomePath).catch(() => outcomePath),
+        ]);
+        canonicalExpected = resolvedExpected;
+        canonicalInput = resolvedInput;
+    }
+    catch {
+        // Fall back to lexical comparison when realpath is unavailable.
+    }
+    if (path.resolve(canonicalInput) !== path.resolve(canonicalExpected))
+        return undefined;
+    let raw;
+    try {
+        raw = await readFile(expectedPath, "utf-8");
+    }
+    catch {
+        return undefined;
+    }
+    if (await sha256Text(raw) !== input.outcomeSha256)
+        return undefined;
+    const parsed = taskOutcomeEnvelopeV1Schema.safeParse(JSON.parse(raw));
+    if (!parsed.success || parsed.data.identity.workerRunId !== input.workerRunId)
+        return undefined;
+    return parsed.data;
+}
+function isNotFound(error) {
+    return Boolean(error &&
+        typeof error === "object" &&
+        "code" in error &&
+        error.code === "ENOENT");
+}

package/dist/worker/outcomes/types.js

@@ -0,0 +1,79 @@
+import { z } from "zod";
+import { workflowSchema } from "../task-spec/workflow-routing.js";
+/** Worker-owned, serialized source binding; never imports the DAG runtime. */
+export const outcomeSourceBindingSchema = z.object({
+    sourceFiles: z.array(z.string().min(1)).optional(),
+    sha256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+}).passthrough();
+/**
+ * Task Outcome Envelope v1 — derived projection of a completed DAG run.
+ *
+ * M2 adds this envelope as a *read-only* view over canonical completed DAG
+ * facts + TaskSpec + worker run record. It never mutates completed DAG facts,
+ * the DAG runtime, executors, Delivery, Follow-up, Final Verification, or
+ * Ready Planner dependency behavior. Projection failures fail closed and are
+ * classified into existing {@link OutcomeFailureCategory} values only.
+ */
+export const OUTCOME_SCHEMA_VERSION = 1;
+/** Failure categories reuse the existing ProductLineFailureCategory taxonomy. */
+export const outcomeFailureCategorySchema = z.enum([
+    "ContractMismatch",
+    "EnvFailure",
+]);
+/** Workflow-bound outcome adapter identity. */
+export const OUTCOME_WORKFLOWS = [
+    "agent-dag",
+    "frontend-implementation",
+    "backend-test",
+    "frontend-test",
+];
+export const outcomeArtifactSchema = z.object({
+    path: z.string().min(1),
+    sha256: z.string().regex(/^[a-f0-9]{64}$/, "sha256 must be lowercase hex"),
+    /** Stable artifact family (e.g. `backend-test-result`). */
+    kind: z.string().min(1).optional(),
+    /** Versioned schema id (e.g. `backend-test-result-v1`); orthogonal to kind. */
+    schemaId: z.string().min(1).optional(),
+});
+export const shellVerificationSchema = z.object({
+    exitZero: z.boolean(),
+    command: z.string().optional(),
+    evidenceRef: z.string().optional(),
+});
+/**
+ * Integration status is strictly split: `mock` and `real` are independent so a
+ * mock adapter can never be mistaken for a real integration and vice versa.
+ */
+export const integrationStatusSchema = z.object({
+    mock: z.boolean(),
+    real: z.boolean(),
+});
+export const outcomeFailureSchema = z.object({
+    category: outcomeFailureCategorySchema,
+    reason: z.string().min(1),
+    missingOutputs: z.array(z.string().min(1)).optional(),
+});
+export const taskOutcomeEnvelopeV1Schema = z.object({
+    schemaVersion: z.literal(OUTCOME_SCHEMA_VERSION),
+    identity: z.object({
+        featureId: z.string().min(1),
+        taskId: z.string().min(1),
+        workflow: workflowSchema,
+        workerRunId: z.string().min(1),
+        harnessTaskId: z.string().min(1).optional(),
+    }),
+    sourceBinding: outcomeSourceBindingSchema.optional(),
+    acceptanceCoverage: z.array(z.string().min(1)).default([]),
+    artifacts: z.array(outcomeArtifactSchema).default([]),
+    shellVerification: shellVerificationSchema.optional(),
+    integrationStatus: integrationStatusSchema,
+    controllerIdentity: z
+        .object({
+        packageName: z.string().min(1),
+        packageVersion: z.string().min(1),
+    })
+        .optional(),
+    createdAt: z.string().datetime(),
+    outcomeStatus: z.enum(["succeeded", "failed"]),
+    outcomeFailure: outcomeFailureSchema.optional(),
+});

package/dist/worker/report/morning-report.js

@@ -44,13 +44,13 @@ export async function renderMorningReport(options) {
         "",
         "## Results",
         "",
-        "| Task | Status | Run | Failure | Next | Artifacts |",
-        "|---|---|---|---|---|---|",
+        "| Task | Workflow | Status | Run | Failure | Next | Artifacts |",
+        "|---|---|---|---|---|---|---|",
     ];
     for (const run of runs) {
         const followUp = await followUpSummary(run, options.repoRoot);
         const identity = `${run.featureId}/${run.taskId}`;
-        lines.push(`| ${identity} | ${run.status} | ${run.workerRunId} | ${run.failure?.category ?? "-"} | ${followUp ?? run.failure?.derivedFollowUpTaskId ?? "-"} | ${await artifactSummary(run)} |`);
+        lines.push(`| ${identity} | ${run.workflow ?? "-"} | ${run.status} | ${run.workerRunId} | ${run.failure?.category ?? "-"} | ${followUp ?? run.failure?.derivedFollowUpTaskId ?? "-"} | ${await artifactSummary(run)} |`);
     }
     if (followUps > 0) {
         lines.push("", "## Human Actions", "");
@@ -94,6 +94,7 @@ async function artifactSummary(run) {
         ["report", run.failureArtifacts?.reportMarkdownArtifactPath],
         ["doctor", run.failureArtifacts?.doctorMarkdownArtifactPath],
         ["closeout", run.failureArtifacts?.closeoutDraftPath],
+        ["outcome", run.outcomePath],
     ].filter((entry) => Boolean(entry[1]));
     if (artifacts.length === 0)
         return "-";