@tea-agent/loop-agent 0.15.0 → 0.16.0

package/dist/infrastructure/evaluation/ignition-store.js

@@ -0,0 +1,82 @@
+import { access, mkdir, mkdtemp, readdir, readFile, rename, rm } from "node:fs/promises";
+import path from "node:path";
+import { ignitionIdSchema, ignitionReportSchema, } from "../../application/evaluation/types.js";
+import { sha256Hex } from "../../application/evaluation/candidate-hash.js";
+import { writeJsonAtomic, writeTextAtomic } from "../harness/atomic-write.js";
+import { EVALUATION_ROOT } from "./store.js";
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const MANIFEST_INTEGRITY_FILE = "manifest.sha256";
+export function assertIgnitionId(value) {
+    ignitionIdSchema.parse(value);
+}
+export function ignitionDir(repoRoot, ignitionId) {
+    assertIgnitionId(ignitionId);
+    return path.join(repoRoot, EVALUATION_ROOT, "ignition", ignitionId);
+}
+export function ignitionReportPath(repoRoot, ignitionId) {
+    return path.join(ignitionDir(repoRoot, ignitionId), "report.json");
+}
+async function pathExists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function serialize(report) {
+    return `${JSON.stringify(report, null, 2)}\n`;
+}
+export async function readIgnitionReport(repoRoot, ignitionId) {
+    assertIgnitionId(ignitionId);
+    const reportPath = ignitionReportPath(repoRoot, ignitionId);
+    if (!(await pathExists(reportPath)))
+        return undefined;
+    const rawText = await readFile(reportPath, "utf-8");
+    const expected = (await readFile(path.join(ignitionDir(repoRoot, ignitionId), MANIFEST_INTEGRITY_FILE), "utf-8")).trim();
+    if (sha256Hex(rawText) !== expected) {
+        throw new Error(`ignition report integrity mismatch for ${ignitionId}`);
+    }
+    return ignitionReportSchema.parse(JSON.parse(rawText));
+}
+export async function writeIgnitionReport(input) {
+    const parsed = ignitionReportSchema.parse(input.report);
+    const reportPath = ignitionReportPath(input.repoRoot, parsed.ignitionId);
+    const root = path.dirname(ignitionDir(input.repoRoot, parsed.ignitionId));
+    await mkdir(root, { recursive: true });
+    if (await pathExists(reportPath)) {
+        await writeJsonAtomic(reportPath, parsed, { repoRoot: input.repoRoot });
+        await writeTextAtomic(path.join(ignitionDir(input.repoRoot, parsed.ignitionId), MANIFEST_INTEGRITY_FILE), `${sha256Hex(serialize(parsed))}\n`, { repoRoot: input.repoRoot });
+        return reportPath;
+    }
+    const stagingDir = await mkdtemp(path.join(root, `.${parsed.ignitionId}.register-`));
+    try {
+        await writeJsonAtomic(path.join(stagingDir, "report.json"), parsed, {
+            repoRoot: input.repoRoot,
+        });
+        await writeTextAtomic(path.join(stagingDir, MANIFEST_INTEGRITY_FILE), `${sha256Hex(serialize(parsed))}\n`, { repoRoot: input.repoRoot });
+        await rename(stagingDir, ignitionDir(input.repoRoot, parsed.ignitionId));
+    }
+    catch (error) {
+        await rm(stagingDir, { recursive: true, force: true });
+        throw error;
+    }
+    return reportPath;
+}
+export async function listIgnitionIds(repoRoot) {
+    const root = path.join(repoRoot, EVALUATION_ROOT, "ignition");
+    try {
+        const entries = await readdir(root, { withFileTypes: true });
+        return entries
+            .filter((entry) => entry.isDirectory() && SAFE_ID.test(entry.name))
+            .map((entry) => entry.name)
+            .sort();
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT")
+            return [];
+        throw error;
+    }
+}

package/dist/infrastructure/evaluation/private-verifier-store.js

@@ -0,0 +1,145 @@
+import { access, mkdir, mkdtemp, readdir, readFile, rename, rm } from "node:fs/promises";
+import path from "node:path";
+import { assertPrivateVerifierHash, computePrivateVerifierManifestHash, } from "../../application/evaluation/campaign-hash.js";
+import { formatContentSha, normalizeContentSha, sha256Hex, } from "../../application/evaluation/candidate-hash.js";
+import { privateVerifierIdSchema, privateVerifierManifestInputSchema, privateVerifierManifestSchema, } from "../../application/evaluation/types.js";
+import { writeJsonAtomic, writeTextAtomic } from "../harness/atomic-write.js";
+import { EVALUATION_ROOT } from "./store.js";
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const MANIFEST_INTEGRITY_FILE = "manifest.sha256";
+export function assertPrivateVerifierId(value) {
+    privateVerifierIdSchema.parse(value);
+}
+export function privateVerifierDir(repoRoot, privateVerifierId) {
+    assertPrivateVerifierId(privateVerifierId);
+    return path.join(repoRoot, EVALUATION_ROOT, "private-verifiers", privateVerifierId);
+}
+export function privateVerifierManifestPath(repoRoot, privateVerifierId) {
+    return path.join(privateVerifierDir(repoRoot, privateVerifierId), "manifest.json");
+}
+async function pathExists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function serializeManifest(manifest) {
+    return `${JSON.stringify(manifest, null, 2)}\n`;
+}
+export async function materializePrivateVerifierManifest(raw) {
+    const input = privateVerifierManifestInputSchema.parse(raw);
+    const withoutHash = {
+        schemaVersion: 1,
+        privateVerifierId: input.privateVerifierId,
+        createdAt: input.createdAt,
+        ...(input.description !== undefined
+            ? { description: input.description }
+            : {}),
+        checks: input.checks,
+    };
+    const manifestHash = computePrivateVerifierManifestHash(withoutHash);
+    if (input.manifestHash) {
+        const provided = formatContentSha(normalizeContentSha(input.manifestHash));
+        if (provided !== manifestHash) {
+            throw new Error(`privateVerifier manifestHash mismatch: expected ${manifestHash}, got ${provided}`);
+        }
+    }
+    return privateVerifierManifestSchema.parse({
+        ...withoutHash,
+        manifestHash,
+    });
+}
+export async function loadPrivateVerifierManifestFromPath(repoRoot, manifestPath) {
+    const resolved = path.isAbsolute(manifestPath)
+        ? manifestPath
+        : path.resolve(repoRoot, manifestPath);
+    const raw = JSON.parse(await readFile(resolved, "utf-8"));
+    return privateVerifierManifestInputSchema.parse(raw);
+}
+export async function readPrivateVerifierManifest(repoRoot, privateVerifierId) {
+    assertPrivateVerifierId(privateVerifierId);
+    const manifestPath = privateVerifierManifestPath(repoRoot, privateVerifierId);
+    const rawText = await readFile(manifestPath, "utf-8");
+    const integrityPath = path.join(privateVerifierDir(repoRoot, privateVerifierId), MANIFEST_INTEGRITY_FILE);
+    const expected = (await readFile(integrityPath, "utf-8")).trim();
+    const actual = sha256Hex(rawText);
+    if (expected !== actual) {
+        throw new Error(`privateVerifier manifest integrity mismatch for ${privateVerifierId}`);
+    }
+    const stored = privateVerifierManifestSchema.parse(JSON.parse(rawText));
+    if (stored.privateVerifierId !== privateVerifierId) {
+        throw new Error(`privateVerifier identity mismatch: directory=${privateVerifierId}, manifest=${stored.privateVerifierId}`);
+    }
+    assertPrivateVerifierHash(stored);
+    return stored;
+}
+export async function listPrivateVerifierIds(repoRoot) {
+    const root = path.join(repoRoot, EVALUATION_ROOT, "private-verifiers");
+    try {
+        const entries = await readdir(root, { withFileTypes: true });
+        return entries
+            .filter((entry) => entry.isDirectory() && SAFE_ID.test(entry.name))
+            .map((entry) => entry.name)
+            .sort();
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+function manifestsEqual(a, b) {
+    return (a.privateVerifierId === b.privateVerifierId &&
+        a.manifestHash === b.manifestHash &&
+        a.createdAt === b.createdAt &&
+        (a.description ?? "") === (b.description ?? "") &&
+        JSON.stringify(a.checks) === JSON.stringify(b.checks));
+}
+export async function registerPrivateVerifierManifest(input) {
+    const { repoRoot, manifest } = input;
+    assertPrivateVerifierId(manifest.privateVerifierId);
+    const manifestPath = privateVerifierManifestPath(repoRoot, manifest.privateVerifierId);
+    if (await pathExists(manifestPath)) {
+        const existing = await readPrivateVerifierManifest(repoRoot, manifest.privateVerifierId);
+        if (!manifestsEqual(existing, manifest)) {
+            throw new Error(`privateVerifier already exists with different content: ${manifest.privateVerifierId}`);
+        }
+        return { manifest: existing, idempotent: true, manifestPath };
+    }
+    const root = path.dirname(privateVerifierDir(repoRoot, manifest.privateVerifierId));
+    await mkdir(root, { recursive: true });
+    const stagingDir = await mkdtemp(path.join(root, `.${manifest.privateVerifierId}.register-`));
+    try {
+        await writeJsonAtomic(path.join(stagingDir, "manifest.json"), manifest, {
+            repoRoot,
+        });
+        await writeTextAtomic(path.join(stagingDir, MANIFEST_INTEGRITY_FILE), `${sha256Hex(serializeManifest(manifest))}\n`, { repoRoot });
+        try {
+            await rename(stagingDir, privateVerifierDir(repoRoot, manifest.privateVerifierId));
+        }
+        catch (error) {
+            const code = error.code;
+            const isCreateRace = code === "EEXIST" ||
+                code === "ENOTEMPTY" ||
+                (code === "EPERM" &&
+                    (await pathExists(privateVerifierDir(repoRoot, manifest.privateVerifierId))));
+            if (!isCreateRace)
+                throw error;
+            await rm(stagingDir, { recursive: true, force: true });
+            const existing = await readPrivateVerifierManifest(repoRoot, manifest.privateVerifierId);
+            if (!manifestsEqual(existing, manifest)) {
+                throw new Error(`privateVerifier already exists with different content: ${manifest.privateVerifierId}`);
+            }
+            return { manifest: existing, idempotent: true, manifestPath };
+        }
+    }
+    catch (error) {
+        await rm(stagingDir, { recursive: true, force: true });
+        throw error;
+    }
+    return { manifest, idempotent: false, manifestPath };
+}

package/dist/infrastructure/evaluation/proposer-store.js

@@ -0,0 +1,78 @@
+import { access, mkdir, mkdtemp, readdir, readFile, rename, rm } from "node:fs/promises";
+import path from "node:path";
+import { proposerRunIdSchema, proposerRunSchema, } from "../../application/evaluation/types.js";
+import { sha256Hex } from "../../application/evaluation/candidate-hash.js";
+import { writeJsonAtomic, writeTextAtomic } from "../harness/atomic-write.js";
+import { EVALUATION_ROOT } from "./store.js";
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const MANIFEST_INTEGRITY_FILE = "manifest.sha256";
+export function assertProposerRunId(value) {
+    proposerRunIdSchema.parse(value);
+}
+export function proposerRunDir(repoRoot, proposerRunId) {
+    assertProposerRunId(proposerRunId);
+    return path.join(repoRoot, EVALUATION_ROOT, "proposer-runs", proposerRunId);
+}
+export function proposerRunManifestPath(repoRoot, proposerRunId) {
+    return path.join(proposerRunDir(repoRoot, proposerRunId), "manifest.json");
+}
+async function pathExists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function serialize(record) {
+    return `${JSON.stringify(record, null, 2)}\n`;
+}
+export async function writeProposerRun(input) {
+    const parsed = proposerRunSchema.parse(input.run);
+    const root = path.dirname(proposerRunDir(input.repoRoot, parsed.proposerRunId));
+    await mkdir(root, { recursive: true });
+    const stagingDir = await mkdtemp(path.join(root, `.${parsed.proposerRunId}.register-`));
+    const manifestPath = proposerRunManifestPath(input.repoRoot, parsed.proposerRunId);
+    try {
+        if (await pathExists(manifestPath)) {
+            throw new Error(`proposer run already exists: ${parsed.proposerRunId}`);
+        }
+        await writeJsonAtomic(path.join(stagingDir, "manifest.json"), parsed, {
+            repoRoot: input.repoRoot,
+        });
+        await writeTextAtomic(path.join(stagingDir, MANIFEST_INTEGRITY_FILE), `${sha256Hex(serialize(parsed))}\n`, { repoRoot: input.repoRoot });
+        await rename(stagingDir, proposerRunDir(input.repoRoot, parsed.proposerRunId));
+    }
+    catch (error) {
+        await rm(stagingDir, { recursive: true, force: true });
+        throw error;
+    }
+    return manifestPath;
+}
+export async function readProposerRun(repoRoot, proposerRunId) {
+    assertProposerRunId(proposerRunId);
+    const manifestPath = proposerRunManifestPath(repoRoot, proposerRunId);
+    const rawText = await readFile(manifestPath, "utf-8");
+    const expected = (await readFile(path.join(proposerRunDir(repoRoot, proposerRunId), MANIFEST_INTEGRITY_FILE), "utf-8")).trim();
+    if (sha256Hex(rawText) !== expected) {
+        throw new Error(`proposer run integrity mismatch for ${proposerRunId}`);
+    }
+    return proposerRunSchema.parse(JSON.parse(rawText));
+}
+export async function listProposerRunIds(repoRoot) {
+    const root = path.join(repoRoot, EVALUATION_ROOT, "proposer-runs");
+    try {
+        const entries = await readdir(root, { withFileTypes: true });
+        return entries
+            .filter((entry) => entry.isDirectory() && SAFE_ID.test(entry.name))
+            .map((entry) => entry.name)
+            .sort();
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT")
+            return [];
+        throw error;
+    }
+}

package/dist/worker/cli.js

@@ -176,17 +176,20 @@ export function buildAgentWorkerProgram() {
         .command("verify-final")
         .requiredOption("--feature-dir <dir>", "Feature directory containing acceptance.yaml and tasks/")
         .requiredOption("--repo <repo-root>", "Target repo root")
-        .requiredOption("--task-id <id>", "Completed qa-execute TaskSpec to rerun as dedicated final verification")
+        .requiredOption("--task-id <id>", "Completed final verification TaskSpec; typed backend/frontend outcomes are aggregated when present")
         .option("--loop-agent-bin <bin>", "loop-agent binary", "loop-agent")
         .option("--json", "Emit stable JSON")
+        .option("--evidence-mode <mode>", "Evidence aggregate: auto, qa-execute, or typed", "auto")
         .option("--expected-controller-version <version>", "Exact expected controller version (fail before writes if mismatched)")
         .option("--expected-controller-fingerprint <value>", "Exact expected controller fingerprint sha256:<hex> (fail before writes if mismatched)")
         .description("Run an independent HEAD-bound final QA verification and project Delivery evidence")
         .action(async (options) => {
+        if (options.evidenceMode !== "auto" && options.evidenceMode !== "qa-execute" && options.evidenceMode !== "typed")
+            throw new Error("feature verify-final --evidence-mode must be auto, qa-execute, or typed");
         const repoRoot = path.resolve(options.repo);
         const client = new LoopAgentClient({ loopAgentBin: options.loopAgentBin, artifactRoot: path.join(getTaskPoolRoot(repoRoot), "artifacts", `final-verification-${Date.now()}`), resolveIdentity: true });
-        const result = await runFeatureFinalVerification({ featureDir: path.resolve(options.featureDir), repoRoot, taskId: options.taskId, client, controllerIdentity: client.getIdentity(), controllerExpectation: buildIdentityExpectation(options) });
-        process.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : `Feature: ${result.featureId}\nFinal verification: ${result.workerRunId}\nQA evidence: ${result.qaEvidencePath}\nFinal evidence: ${result.finalVerificationPath}\n`);
+        const result = await runFeatureFinalVerification({ featureDir: path.resolve(options.featureDir), repoRoot, taskId: options.taskId, client, controllerIdentity: client.getIdentity(), controllerExpectation: buildIdentityExpectation(options), evidenceMode: options.evidenceMode });
+        process.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : `Feature: ${result.featureId}\nFinal verification: ${result.workerRunId}\nEvidence mode: ${result.evidenceMode ?? "qa-execute"}\nQA evidence: ${result.qaEvidencePath}\nFinal evidence: ${result.finalVerificationPath}${result.bundleEvidencePath ? `\nVerification bundle: ${result.bundleEvidencePath}` : ""}\n`);
     });
     feature
         .command("delivery")

package/dist/worker/delivery/final-verification.js

@@ -8,11 +8,13 @@ import { controllerIdentitiesMatch, controllerIdentityExpectationFailure, resolv
 import { acceptanceSpecSchema } from "../task-graph/acceptance-schema.js";
 import { taskGraphSpecSchema } from "../task-graph/task-graph-schema.js";
 import { validateFeatureTaskGraph } from "../task-graph/validate.js";
-import { getRunsJsonlPath, getTaskPoolRoot, readJsonlFile, recordTaskPoolRun } from "../pool/run-store.js";
+import { getRunsJsonlPath, getTaskPoolRoot, readFeatureTaskPoolStates, readJsonlFile, recordTaskPoolRun } from "../pool/run-store.js";
+import { readVerifiedOutcome } from "../outcomes/store.js";
 import { buildWorkerRunId, runTaskSpec } from "../run-task/run-task.js";
 import { taskSpecSchema } from "../task-spec/schema.js";
 import { preflightTargetRepo } from "../preflight.js";
 import { gitTransactionRecordSchema, transactionRecordPath } from "./git-transaction.js";
+import { buildFeatureVerificationBundle, writeFeatureVerificationBundle, } from "./verification-bundle.js";
 const execFileAsync = promisify(execFile);
 export async function runFeatureFinalVerification(input) {
     const dependencies = {
@@ -103,11 +105,60 @@ export async function runFeatureFinalVerification(input) {
         allSpecs.set(graphNode.id, taskSpecSchema.parse(YAML.parse(await readFile(path.join(featureDir, "tasks", graphNode.task), "utf-8"))));
     }
     const acceptance = acceptanceSpecSchema.parse(YAML.parse(await readFile(path.join(featureDir, "acceptance.yaml"), "utf-8")));
-    const qaRuns = latestSuccessfulQaRuns(runs, allSpecs, taskSpec.id, featureId);
-    if (qaRuns.length === 0)
-        throw new Error("no prior successful qa-execute runs are available for the QA aggregate");
-    const coveredAcIds = [...new Set(qaRuns.flatMap((run) => allSpecs.get(run.taskId)?.acceptance_refs ?? []))];
     const requiredAcIds = acceptance.acceptance.filter((item) => item.priority === "must").map((item) => item.id);
+    const states = await readFeatureTaskPoolStates(repoRoot, featureId);
+    for (const [taskId, spec] of allSpecs) {
+        if ((spec.execution?.workflow === "backend-test" || spec.execution?.workflow === "frontend-test") && ["Failed", "Blocked"].includes(states[taskId]?.status ?? "")) {
+            throw new Error(`final verification has an unresolved typed test task: ${taskId}`);
+        }
+    }
+    const evidenceMode = input.evidenceMode ?? "auto";
+    let bundleRef;
+    let bundlePayload;
+    let qaRuns = latestSuccessfulQaRuns(runs, allSpecs, taskSpec.id, featureId);
+    let coveredAcIds = [...new Set(qaRuns.flatMap((run) => allSpecs.get(run.taskId)?.acceptance_refs ?? []))];
+    const typedCapable = requiredAcIds.length > 0 && requiredAcIds.every((acId) => {
+        const item = acceptance.acceptance.find((candidate) => candidate.id === acId);
+        const refs = item?.verification.verification_task_refs ?? [];
+        return refs.length > 0 && refs.every((taskId) => {
+            const workflow = allSpecs.get(taskId)?.execution?.workflow;
+            return workflow === "backend-test" || workflow === "frontend-test";
+        });
+    });
+    if (evidenceMode === "qa-execute" && !qaRuns.length) {
+        throw new Error("evidence-mode qa-execute requires at least one successful qa-execute run");
+    }
+    if ((evidenceMode === "auto" && typedCapable) || evidenceMode === "typed") {
+        const typedRuns = selectCurrentTypedVerificationRuns({
+            featureId,
+            acceptance: acceptance.acceptance,
+            specs: allSpecs,
+            states,
+            runs,
+        });
+        const outcomes = new Map();
+        for (const run of typedRuns) {
+            const outcome = await readVerifiedOutcome({ repoRoot, workerRunId: run.workerRunId, outcomePath: run.outcomePath, outcomeSha256: run.outcomeSha256 });
+            if (outcome)
+                outcomes.set(run.workerRunId, outcome);
+        }
+        const bundle = buildFeatureVerificationBundle({
+            featureId,
+            headSha,
+            runs: typedRuns,
+            specs: allSpecs,
+            outcomes,
+            acceptance: acceptance.acceptance,
+            implementationTaskIds: new Set(acceptance.acceptance.flatMap((item) => item.verification.implementation_task_refs ?? []).filter((taskId) => states[taskId]?.status === "Done")),
+            controllerIdentity,
+        });
+        bundleRef = await writeFeatureVerificationBundle(repoRoot, bundle);
+        bundlePayload = bundle;
+        qaRuns = typedRuns;
+        coveredAcIds = bundle.acceptance.filter((item) => item.status === "covered").map((item) => item.acId);
+    }
+    if (qaRuns.length === 0)
+        throw new Error("no prior successful typed test or qa-execute runs are available for the QA aggregate");
     for (const acId of requiredAcIds)
         if (!coveredAcIds.includes(acId))
             throw new Error(`QA aggregate does not cover required acceptance: ${acId}`);
@@ -118,10 +169,11 @@ export async function runFeatureFinalVerification(input) {
     const qaEvidencePath = path.join(evidenceDir, "qa-pass.json");
     const finalVerificationPath = path.join(evidenceDir, "final-verification.json");
     await writeEvidencePairAtomic(evidenceDir, {
-        qa: { schemaVersion: 1, featureId, verdict: "passed", acIds: requiredAcIds, runs: qaRuns.map(runRef) },
-        final: { schemaVersion: 1, featureId, kind: "final-verification", status: "passed", headSha, run: runRef(finalRun), shellSummary: { path: summaryRelative, sha256: createHash("sha256").update(summary).digest("hex") } },
+        qa: { schemaVersion: 1, featureId, verdict: "passed", acIds: requiredAcIds, runs: qaRuns.map(runRef), ...(bundleRef ? { bundle: bundleRef } : {}) },
+        final: { schemaVersion: 1, featureId, kind: "final-verification", status: "passed", headSha, run: runRef(finalRun), shellSummary: { path: summaryRelative, sha256: createHash("sha256").update(summary).digest("hex") }, ...(bundleRef ? { bundle: bundleRef } : {}) },
+        ...(bundlePayload ? { bundle: bundlePayload } : {}),
     });
-    return { schemaVersion: 1, featureId, taskId: taskSpec.id, workerRunId: finalRun.workerRunId, headSha, qaEvidencePath: repoRef(repoRoot, qaEvidencePath), finalVerificationPath: repoRef(repoRoot, finalVerificationPath), qaRunCount: qaRuns.length, ...(controllerIdentity ? { controllerIdentity } : {}) };
+    return { schemaVersion: 1, featureId, taskId: taskSpec.id, workerRunId: finalRun.workerRunId, headSha, qaEvidencePath: repoRef(repoRoot, qaEvidencePath), finalVerificationPath: repoRef(repoRoot, finalVerificationPath), qaRunCount: qaRuns.length, ...(bundleRef ? { bundleEvidencePath: bundleRef.path, bundleSha256: bundleRef.sha256, evidenceMode: "typed" } : { evidenceMode: "qa-execute" }), ...(controllerIdentity ? { controllerIdentity } : {}) };
 }
 export function latestSuccessfulQaRuns(runs, specs, excludedTaskId, featureId) {
     const byTask = new Map();
@@ -130,6 +182,40 @@ export function latestSuccessfulQaRuns(runs, specs, excludedTaskId, featureId) {
             byTask.set(run.taskId, run);
     return [...byTask.values()].sort((a, b) => a.taskId.localeCompare(b.taskId));
 }
+/**
+ * Typed verification is bound to the canonical Feature-scoped Task Pool state,
+ * never to an arbitrary historical success in runs.jsonl. Each required AC
+ * verification task must be Done and identify exactly one succeeded run.
+ */
+function selectCurrentTypedVerificationRuns(input) {
+    const requiredTaskIds = [
+        ...new Set(input.acceptance.flatMap((item) => item.verification.verification_task_refs ?? [])),
+    ];
+    const selected = [];
+    for (const taskId of requiredTaskIds) {
+        const spec = input.specs.get(taskId);
+        const workflow = spec?.execution?.workflow;
+        if (workflow !== "backend-test" && workflow !== "frontend-test") {
+            throw new Error(`typed verification TaskSpec is not a typed test: ${taskId}`);
+        }
+        const state = input.states[taskId];
+        if (state?.status !== "Done" || !state.workerRunId) {
+            throw new Error(`required typed verification task is not Done: ${taskId}`);
+        }
+        const matches = input.runs.filter((run) => run.featureId === input.featureId &&
+            run.taskId === taskId &&
+            run.workerRunId === state.workerRunId);
+        if (matches.length !== 1) {
+            throw new Error(`current Task Pool run is missing or ambiguous: ${taskId}`);
+        }
+        const run = matches[0];
+        if (run.status !== "succeeded" || run.workflow !== workflow) {
+            throw new Error(`current Task Pool run is not a succeeded typed test: ${taskId}`);
+        }
+        selected.push(run);
+    }
+    return selected;
+}
 async function reusableFinalRun(repoRoot, runs, taskId, featureId, record, now, controllerIdentity) {
     const latestCheckpointAt = Math.max(...record.checkpoints.map((entry) => new Date(entry.createdAt).getTime()));
     for (const run of [...runs].reverse()) {
@@ -162,6 +248,8 @@ export async function writeEvidencePairAtomic(evidenceDir, value, fs = { rm }) {
     await mkdir(staging, { recursive: true });
     await writeFile(path.join(staging, "qa-pass.json"), `${JSON.stringify(value.qa, null, 2)}\n`);
     await writeFile(path.join(staging, "final-verification.json"), `${JSON.stringify(value.final, null, 2)}\n`);
+    if (value.bundle)
+        await writeFile(path.join(staging, "feature-verification-bundle.json"), `${JSON.stringify(value.bundle, null, 2)}\n`);
     let backedUp = false;
     try {
         await rename(evidenceDir, backup);

package/dist/worker/delivery/package.js

@@ -12,6 +12,7 @@ import { taskGraphSpecSchema } from "../task-graph/task-graph-schema.js";
 import { validateFeatureTaskGraph } from "../task-graph/validate.js";
 import { taskSpecSchema } from "../task-spec/schema.js";
 import { gitTransactionRecordSchema, transactionRecordPath } from "./git-transaction.js";
+import { readVerifiedBundle, verifyBundleCurrentStateBindings, verifyBundleOutcomes, verifyBundleTaskSpecBindings } from "./verification-bundle.js";
 const execFileAsync = promisify(execFile);
 const hashedRefSchema = z.object({ path: z.string().min(1), sha256: z.string().regex(/^[a-f0-9]{64}$/) }).strict();
 export const acceptanceCoverageArtifactSchema = z.object({
@@ -76,8 +77,8 @@ const evidenceRunSchema = z.object({
     recordedAt: z.string().datetime(),
     controllerIdentity: controllerIdentityEvidenceSchema.optional(),
 }).strict();
-const qaEvidenceSchema = z.object({ schemaVersion: z.literal(1), featureId: z.string(), verdict: z.literal("passed"), acIds: z.array(z.string()).min(1), runs: z.array(evidenceRunSchema).min(1) }).strict();
-const finalVerificationSchema = z.object({ schemaVersion: z.literal(1), featureId: z.string(), kind: z.literal("final-verification"), status: z.literal("passed"), headSha: z.string().regex(/^[a-f0-9]{40}$/), run: evidenceRunSchema, shellSummary: hashedRefSchema }).strict();
+const qaEvidenceSchema = z.object({ schemaVersion: z.literal(1), featureId: z.string(), verdict: z.literal("passed"), acIds: z.array(z.string()).min(1), runs: z.array(evidenceRunSchema).min(1), bundle: hashedRefSchema.optional() }).strict();
+const finalVerificationSchema = z.object({ schemaVersion: z.literal(1), featureId: z.string(), kind: z.literal("final-verification"), status: z.literal("passed"), headSha: z.string().regex(/^[a-f0-9]{40}$/), run: evidenceRunSchema, shellSummary: hashedRefSchema, bundle: hashedRefSchema.optional() }).strict();
 const workerRunEvidenceSchema = z.object({ schemaVersion: z.literal(1), status: z.literal("succeeded"), workerRunId: z.string(), businessId: z.string(), featureId: z.string(), reportDecision: z.object({ succeeded: z.literal(true) }).passthrough(), commands: z.array(z.object({ name: z.string(), result: z.object({ ok: z.literal(true) }).passthrough() }).passthrough()).min(1), controllerIdentity: controllerIdentityEvidenceSchema.optional() }).passthrough();
 export async function prepareFeatureDelivery(input) {
     const repoRoot = path.resolve(input.repoRoot);
@@ -111,6 +112,10 @@ export async function prepareFeatureDelivery(input) {
         taskSpecs.set(node.id, taskSpecSchema.parse(YAML.parse(await readFile(path.join(featureDir, "tasks", node.task), "utf-8"))));
     const qaFact = await canonicalQaEvidence(repoRoot, input.qaEvidencePath, featureId, runs, taskSpecs, now, blockers);
     const finalFact = record ? await canonicalFinalEvidence(repoRoot, input.finalVerificationPath, featureId, runs, taskSpecs, record, now, blockers) : undefined;
+    if (qaFact?.data.bundle || finalFact?.data.bundle) {
+        if (!qaFact?.data.bundle || !finalFact?.data.bundle || qaFact.data.bundle.path !== finalFact.data.bundle.path || qaFact.data.bundle.sha256 !== finalFact.data.bundle.sha256)
+            blockers.push("QA and final verification do not bind the same Feature Verification Bundle");
+    }
     if (qaFact && finalFact && qaFact.data.runs.some((entry) => entry.workerRunId === finalFact.data.run.workerRunId))
         blockers.push("final verification must use a dedicated run not included in the QA aggregate");
     const qaEvidence = qaFact?.ref;
@@ -340,11 +345,20 @@ async function canonicalQaEvidence(repoRoot, ref, featureId, runs, specs, now, b
         const data = qaEvidenceSchema.parse(JSON.parse(await readFile(await safeRepoPath(repoRoot, ref), "utf-8")));
         if (data.featureId !== featureId)
             throw new Error("Feature ownership mismatch");
+        const bundle = data.bundle ? await readVerifiedBundle({ repoRoot, ref: data.bundle }) : undefined;
+        if (data.bundle && (!bundle || bundle.featureId !== featureId || !await verifyBundleOutcomes(repoRoot, bundle) || !verifyBundleTaskSpecBindings(bundle, specs) || !await verifyBundleCurrentStateBindings(repoRoot, bundle)))
+            throw new Error("Feature Verification Bundle is missing, changed, has invalid typed outcomes, no longer matches TaskSpecs, or no longer matches current Task Pool state");
+        const typedByRun = new Map((bundle ? [...bundle.backendTests, ...bundle.frontendTests] : []).map((entry) => [entry.workerRunId, entry]));
         for (const entry of data.runs) {
-            const run = assertEvidenceRun(entry, featureId, runs, specs, now, true);
+            const run = assertEvidenceRun(entry, featureId, runs, specs, now, !bundle);
+            if (bundle) {
+                const typed = typedByRun.get(entry.workerRunId);
+                if (!typed || typed.taskId !== entry.taskId || run.workflow !== typed.workflow)
+                    throw new Error(`QA bundle run is not a declared typed outcome: ${entry.workerRunId}`);
+            }
             await readCanonicalWorkerRun(repoRoot, run);
         }
-        const allowedAcIds = new Set(data.runs.flatMap((entry) => specs.get(entry.taskId)?.acceptance_refs ?? []));
+        const allowedAcIds = bundle ? new Set(bundle.acceptance.filter((item) => item.status === "covered").map((item) => item.acId)) : new Set(data.runs.flatMap((entry) => specs.get(entry.taskId)?.acceptance_refs ?? []));
         for (const acId of data.acIds)
             if (!allowedAcIds.has(acId))
                 throw new Error(`QA run scope does not cover ${acId}`);
@@ -363,6 +377,11 @@ async function canonicalFinalEvidence(repoRoot, ref, featureId, runs, specs, rec
         const data = finalVerificationSchema.parse(JSON.parse(await readFile(await safeRepoPath(repoRoot, ref), "utf-8")));
         if (data.featureId !== featureId)
             throw new Error("Feature ownership mismatch");
+        if (data.bundle) {
+            const bundle = await readVerifiedBundle({ repoRoot, ref: data.bundle });
+            if (!bundle || bundle.featureId !== featureId || bundle.headSha !== record.lastCheckpoint || !await verifyBundleOutcomes(repoRoot, bundle) || !verifyBundleTaskSpecBindings(bundle, specs) || !await verifyBundleCurrentStateBindings(repoRoot, bundle))
+                throw new Error("Feature Verification Bundle is missing, changed, does not bind the Delivery HEAD, no longer matches TaskSpecs, or no longer matches current Task Pool state");
+        }
         const taskPoolRun = assertEvidenceRun(data.run, featureId, runs, specs, now, true);
         if (data.headSha !== record.lastCheckpoint)
             throw new Error("final verification is not bound to Delivery HEAD");