@tea-agent/loop-agent 0.16.0 → 0.16.1-beta.0

package/dist/workflows/dag/types.js

@@ -1,5 +1,4 @@
 import { z } from "zod";
-import { campaignBudgetSchema, } from "../../application/evaluation/budget.js";
 import { assertDagPromptSourceRule } from "./prompt-source.js";
 import { dagRetryPolicySchema } from "./retry-policy.js";
 export const dagComplexitySchema = z.enum(["HIGH", "MED", "LOW"]);
@@ -106,18 +105,12 @@ export const dagWritePolicySchema = z.enum([
     "exclusive",
     "none",
 ]);
-export const contextPolicyIdSchema = z.enum([
-    "baseline-v1",
-    "role-specialized-v1",
-]);
 export const dagDefaultsSchema = z
     .object({
     executor: dagNodeExecutorSchema.optional(),
     model: z.string().optional(),
     piBackend: z.enum(["sdk-first", "cli-only"]).optional(),
     contextProfile: z.string().optional(),
-    /** Eval Lab ContextPolicy seam; default baseline-v1 when omitted. */
-    contextPolicyId: contextPolicyIdSchema.optional(),
     skills: z.array(z.string()).optional(),
     writePolicy: dagWritePolicySchema.optional(),
 })
@@ -274,6 +267,7 @@ export const dagTaskSchema = z.object({
     shell: dagShellConfigSchema.optional(),
     static: dagStaticConfigSchema.optional(),
     outputContract: z.string().optional(),
+    firstProtocolLine: z.string().min(1).optional(),
     allowedPaths: z.array(z.string()).optional().default([]),
     forbiddenPaths: z.array(z.string()).optional().default([]),
     decisionGate: dagDecisionGateSchema.optional(),
@@ -307,8 +301,6 @@ export const dagEvaluationBindingSchema = z
     taskRef: z.string().min(1).optional(),
 })
     .strict();
-/** Eval Lab Campaign Budget (W3.4); enforced by runner ledger when mode=hard. */
-export const dagBudgetSchema = campaignBudgetSchema;
 export const dagSourceBindingSchema = z.object({
     schemaVersion: z.literal(1),
     taskId: z.string().min(1),
@@ -329,8 +321,6 @@ export const dagSpecSchema = z
     title: z.string().min(1),
     runtimeContract: dagRuntimeContractSchema.optional(),
     evaluation: dagEvaluationBindingSchema.optional(),
-    /** Optional hard/record-only budget; requires version 3. */
-    budget: dagBudgetSchema.optional(),
     sourceBinding: dagSourceBindingSchema.optional(),
     outputLanguage: dagOutputLanguageSchema.optional(),
     objective: z.string().optional(),
@@ -351,13 +341,6 @@ export const dagSpecSchema = z
             path: ["evaluation"],
         });
     }
-    if (spec.budget && spec.version !== 3) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "budget requires DagSpec version 3",
-            path: ["budget"],
-        });
-    }
     if (spec.runtimeContract && spec.version !== 3) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,

package/docs/init-surface.manifest.json

@@ -39,7 +39,6 @@
     "docs/templates/product-line/test-plan.md",
     "docs/templates/product-line/task-graph.yaml",
     "docs/templates/product-line/task.yaml",
-    "docs/templates/product-line/feature.yaml",
     "docs/templates/product-line/closeout.yaml",
     "docs/templates/product-line/links.md",
     "scripts/kb-bootstrap-init-skeleton.sh",
@@ -107,7 +106,6 @@
     "docs/templates/product-line/test-plan.md",
     "docs/templates/product-line/task-graph.yaml",
     "docs/templates/product-line/task.yaml",
-    "docs/templates/product-line/feature.yaml",
     "docs/templates/product-line/closeout.yaml",
     "docs/templates/product-line/links.md",
     "scripts/check-skill-entry.sh",
@@ -177,7 +175,6 @@
     "docs/templates/product-line/test-plan.md": "copied",
     "docs/templates/product-line/task-graph.yaml": "copied",
     "docs/templates/product-line/task.yaml": "copied",
-    "docs/templates/product-line/feature.yaml": "copied",
     "docs/templates/product-line/closeout.yaml": "copied",
     "docs/templates/product-line/links.md": "copied",
     "scripts/check-skill-entry.sh": "generated",

package/docs/templates/agent-dag.schema.json

@@ -366,6 +366,11 @@
           "type": "string",
           "minLength": 1
         },
+        "firstProtocolLine": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Optional protocol prefix whose first matching Pi assistant-output line is promoted to the canonical first line. Missing matches are not synthesized."
+        },
         "allowedPaths": {
           "type": "array",
           "items": { "type": "string", "minLength": 1 },

package/docs/templates/product-line/AGENTS.md

@@ -4,6 +4,5 @@
 - Treat `constraints.allowed_paths` and `constraints.forbidden_paths` as machine-enforced write boundaries; review DAG writer `writeSet` before execution.
 - Advance only tasks whose dependencies are complete. Preserve failed run records; retries receive new worker run IDs.
 - A Ready task must have acceptance references, non-empty allowed/forbidden paths, and deterministic verification commands.
-- For `fullstack-v1` packets (`feature.yaml`), every TaskSpec should declare `execution.workflow`; required ACs need implementation/verification refs, `required_evidence`, and integration policy. Parallel writers must not share overlapping `allowed_paths`.
 - QA records an independent verdict and evidence. Do not write `status: success` closeout until `qa_verdict: pass` and non-empty `qa_evidence` exist.
 - Human gates remain human decisions. Record owner, time, reason, evidence, and follow-up without rewriting failed history.

package/docs/templates/product-line/README.md

@@ -7,20 +7,3 @@ agent-worker task validate-feature <feature-dir>
 ```
 
 The validator checks acceptance ID uniqueness, task references and dependencies, cycles, TaskSpec/path/verification completeness, and QA evidence before a successful closeout.
-
-## Profiles
-
-| Profile | How to declare | Behavior |
-|---|---|---|
-| `generic`（默认） | 省略 `feature.yaml`，或 `profile: generic` | 保持 legacy 校验；不强制 `execution.workflow` / 双覆盖 AC |
-| `fullstack-v1` | `feature.yaml` 中 `profile: fullstack-v1` 并声明 `scope` | 强制显式 workflow、required AC 双覆盖、frontend-test 依赖、writer writeSet 串行等结构门禁 |
-
-端到端全栈 dogfood 样板见仓库 `features/F-2026-005/`（欢迎语链路：契约 → BE/FE 实现 → backend-test / frontend-test → Final Verification）。
-
-## Minimal files
-
-- `feature.yaml`（可选；fullstack 必填）
-- `requirement.md` / `design.md` / `test-plan.md`
-- `acceptance.yaml`
-- `tasks/task-graph.yaml` + `tasks/*.yaml`
-- `links.md` / `closeout.yaml`（按交付阶段）

package/docs/templates/product-line/acceptance.yaml

@@ -12,12 +12,3 @@ acceptance:
       expected_task_refs:
         - BE-001
         - QA-001
-      # fullstack-v1 required AC fields (optional for generic packets):
-      # implementation_task_refs:
-      #   - BE-001
-      # verification_task_refs:
-      #   - BE-TEST-001
-      # required_evidence:
-      #   - backend-test-result-v1
-      #   - shell_verification
-      # integration: real-required

package/docs/templates/product-line/task-graph.yaml

@@ -5,19 +5,11 @@ nodes:
     task: BE-001.yaml
     type: backend-feature
     depends_on: []
-    # Optional artifact-aware edges (Ready Planner envelope-level gate):
-    # produces:
-    #   - kind: backend-impl
-    #     schemaId: backend-impl-v1
   - id: QA-001
     task: QA-001.yaml
     type: qa-execute
     depends_on:
       - BE-001
-    # consumes:
-    #   - kind: backend-impl
-    #     schemaId: backend-impl-v1
-    #     producerTaskId: BE-001
 parallel_policy:
   max_parallel_tasks: 2
   disallow_same_file_parallel_writes: true

package/docs/templates/product-line/task.yaml

@@ -30,10 +30,6 @@ constraints:
     - <protected/path/**>
   hard_constraints:
     - Do not access production secrets
-# Explicit runtime workflow → taskKind. For fullstack-v1 packets this should be set
-# on every TaskSpec. Allowed: agent-dag | frontend-implementation | backend-test | frontend-test
-execution:
-  workflow: agent-dag
 verify:
   preset: standard
   mode: serial

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tea-agent/loop-agent",
-  "version": "0.16.0",
+  "version": "0.16.1-beta.0",
   "type": "module",
   "bin": {
     "loop-agent": "bin/loop-agent.js",

package/skills/frontend-implementation/references/node-contracts.md

@@ -6,9 +6,9 @@ Pre-write nodes are read-only. Preserve IDs, labels, commands, language, require
 
 - **`frontend-contract-pi`**: `Scope`, `Non-goals`, `Acceptance Criteria`, `UI States`, `Target Runtime Environment`, `Risks`, `Verification Expectations`. No guessed requirements.
 - **`frontend-scout-pi`**: routes, components, tokens, data/API/Mock, scripts, tests, assets. Fact vs inference vs gap. Knowledge base first; else search+read `<repoRoot>/openSpec/**` before repo fallback. Output stack, routes, components, styling, conventions, state/data, test entry points, reuse, risks.
-- **`frontend-mock-assess-pi` + gate**: first non-empty line
+- **`frontend-mock-assess-pi` + gate**: declares `firstProtocolLine: "MOCK_STRATEGY:"`; canonical output first line
   `MOCK_STRATEGY: native|browser-intercept|request-adapter|not-needed|blocked`
-  Prefer native Mock; browser intercept only with existing e2e; request-adapter only for reversible local preview. Default `auto` may select `not-needed` when contract/scout evidence confirms no project Mock capability, without adding Mock files/deps, while keeping real requests default and recording the Real Integration Gap. Other `not-needed` cases need positive no-remote/stable-backend evidence; invalid when `frontendMock.policy=required`. `blocked` for missing/conflicting contracts, unsafe paths/deps, unread specs, production-default-on, unverifiable entrypoints. Output Mock Decision, API/spec/service evidence, backend readiness, selection evidence, endpoint/fixture matrix, activation, targets, production safety, verification plan, real-integration gap, blocking issues. Never invent fields, store secrets, comment real requests, import test mocks into production, or treat Mock as real integration. Gate uses `first-non-empty` only; never authorizes writes. Unsafe required contracts → no writer.
+  Pi output mapping promotes the first matching protocol line ahead of any preamble without inventing or replacing its value; missing, malformed, or blocked strategies still fail closed. Prefer native Mock; browser intercept only with existing e2e; request-adapter only for reversible local preview. Default `auto` may select `not-needed` when contract/scout evidence confirms no project Mock capability, without adding Mock files/deps, while keeping real requests default and recording the Real Integration Gap. Other `not-needed` cases need positive no-remote/stable-backend evidence; invalid when `frontendMock.policy=required`. `blocked` for missing/conflicting contracts, unsafe paths/deps, unread specs, production-default-on, unverifiable entrypoints. Output Mock Decision, API/spec/service evidence, backend readiness, selection evidence, endpoint/fixture matrix, activation, targets, production safety, verification plan, real-integration gap, blocking issues. Never invent fields, store secrets, comment real requests, import test mocks into production, or treat Mock as real integration. Gate uses `first-non-empty` only; never authorizes writes. Unsafe required contracts → no writer.
 - **`frontend-plan-pi` + design loop**: AC → steps, in-bound files, UI states, reuse, deps, activation/rollback, frozen verify entrypoints, real-integration gap. First gate: `VERDICT: pass|request-revision`. Pass may emit `PASS_NO_REVISION_NEEDED`; else full corrected plan without invented evidence. Final review rechecks plan/findings/revision/assessment/Mock safety. Only final `VERDICT: pass` authorizes writes; failure → replan/rerun (not dev-fix).
 - **`frontend-implement-pi`**: sole exclusive writer. Stay in `writeSet`; real requests default-on; Mock reversible, dev/test-only, production-off. Atomic handler/intercept/adapter with consumer+tests. Stop on forbidden paths or guesses. Output changed files, behavior, UI states, styling notes, verification attempted, residual risks. Optional mock-verify when frozen; static+behavior always; behavior must prove page consumption. Skipped-Mock `not-needed` keeps real integration pending unless the real backend path has fresh evidence.
 

package/skills/loop-agent/references/hybrid-dag.md

@@ -117,7 +117,7 @@ contract-pi → scout-src ∥ scout-tests → plan-pi → write-set-audit-pi
 | `authority-surface-audit-pi` + `authority-surface-gate-shell` | 可选 permission/state/tool-exposure audit；仅 authority signal 或显式 `authority-surface-audit` marker 时插入；gate 仅接受 `VERDICT: pass` |
 | `review-pi` + `review-gate-shell` | Critical/Important → `request-revision`；node JSON 上 `shell.verdictGate` block，除非 extracted verdict 行为 `VERDICT: pass` |
 
-**Verdict gate contract（`shell.verdictGate`）**：声明 `fromNodeId`、`accept[]`、可选 `label`、可选 `lineMode`。runner 展开为一条 shell command，从 injected current run directory 读 `$HARNESS_DAG_RUN_DIR/<fromNodeId>.json`，对 extracted `assistantText ?? stdout` verdict line 与 `accept[]` exact-match。默认 `lineMode` 为 `first-non-empty` 以兼容；supervised gate 用 `first-verdict-line` 选 Pi 在 preamble 或常见整行 Markdown emphasis（如 `**VERDICT: pass**`）后第一条 normalized `VERDICT:` line。勿用 `result.summary.md`、grep VERDICT、latest-active-run discovery 或 multi-command stateful gate。`--strict-governance` 对 anti-pattern fail。supervisor 仍为 `executor: pi` 上的 `role: supervisor`。
+**Verdict gate contract（`shell.verdictGate`）**：声明 `fromNodeId`、`accept[]`、可选 `label`、可选 `lineMode`。runner 展开为一条 shell command，从 injected current run directory 读 `$HARNESS_DAG_RUN_DIR/<fromNodeId>.json`，对 extracted `assistantText ?? stdout` verdict line 与 `accept[]` exact-match。默认 `lineMode` 为 `first-non-empty` 以兼容；需要固定非 `VERDICT:` 协议首行的 Pi 节点可显式声明 `firstProtocolLine`，executor 会把第一条匹配前缀的行提升为 canonical 首行，不匹配时不伪造。`frontend-mock-assess-pi` 用它固定 `MOCK_STRATEGY:`，gate 仍保持 `first-non-empty` exact-match。supervised gate 用 `first-verdict-line` 选 Pi 在 preamble 或常见整行 Markdown emphasis（如 `**VERDICT: pass**`）后第一条 normalized `VERDICT:` line。勿用 `result.summary.md`、grep VERDICT、latest-active-run discovery 或 multi-command stateful gate。`--strict-governance` 对 anti-pattern fail。supervisor 仍为 `executor: pi` 上的 `role: supervisor`。
 
 **Repair artifact gate contract（`shell.repairArtifactGate`）**：声明 `fromNodeId`（supervisor artifact 节点）与 `repairNodeId`（承接修订的 Pi 修复节点）。runner **不再**按节点名（历史 `repair-cursor` / `repair-pi`）猜测 repair 节点：显式 `repairNodeId` 必须存在、直接 `depends_on` gate、且是受治理 Pi writer（`executor: pi`、`toolProfile: write`、`writePolicy: exclusive`、`allowedPaths`+`writeSet` 非空且 `writeSet` 不与 `forbiddenPaths` 冲突）。新生成的 supervised DAG 总是写入 `repairNodeId`；旧 DAG 缺失时只在能唯一、安全地推导出下游 Pi writer 时兼容，零个或多个候选、或候选不满足契约都在执行前 fail closed。validation 覆盖存在性、直接下游、writer 属性与路径边界。
 

package/dist/application/evaluation/alias.js

@@ -1,184 +0,0 @@
-import { readFile } from "node:fs/promises";
-import { aliasHistoryPath, commitAliasMove, listAliasNames, listIncumbentCandidateIds, makeDecisionId, readIncumbentAlias, readPromotionDecision, } from "../../infrastructure/evaluation/alias-store.js";
-import { readCandidateRecord } from "../../infrastructure/evaluation/candidate-store.js";
-async function requireAcceptedCandidate(input) {
-    const record = await readCandidateRecord(input.repoRoot, input.candidateId);
-    if (record.status !== "accepted") {
-        throw new Error(`alias move requires candidate lifecycle accepted; ${input.candidateId} is ${record.status}`);
-    }
-    return {
-        candidateId: record.manifest.candidateId,
-        bundleHash: record.manifest.bundleHash,
-    };
-}
-function buildDecision(input) {
-    const decisionId = makeDecisionId({
-        alias: input.alias,
-        action: input.action,
-        toCandidateId: input.toCandidateId,
-        createdAt: input.createdAt,
-    });
-    return {
-        schemaVersion: 1,
-        decisionId,
-        alias: input.alias,
-        action: input.action,
-        fromCandidateId: input.fromCandidateId,
-        toCandidateId: input.toCandidateId,
-        toBundleHash: input.toBundleHash,
-        reason: input.reason,
-        actor: "human",
-        humanRequired: true,
-        applied: input.applied,
-        createdAt: input.createdAt,
-        campaignId: input.campaignId ?? null,
-    };
-}
-async function planAliasMove(input) {
-    const reason = input.reason.trim();
-    if (!reason) {
-        throw new Error("alias move requires non-empty --reason");
-    }
-    const createdAt = input.now ?? new Date().toISOString();
-    const previous = await readIncumbentAlias(input.repoRoot, input.alias);
-    if (input.action === "rollback" && !previous) {
-        throw new Error(`cannot rollback alias ${input.alias}: alias does not exist yet`);
-    }
-    const target = await requireAcceptedCandidate({
-        repoRoot: input.repoRoot,
-        candidateId: input.toCandidateId,
-    });
-    if (previous && previous.candidateId === target.candidateId) {
-        throw new Error(`alias ${input.alias} already points at candidate ${target.candidateId}`);
-    }
-    const decision = buildDecision({
-        alias: input.alias,
-        action: input.action,
-        fromCandidateId: previous?.candidateId ?? null,
-        toCandidateId: target.candidateId,
-        toBundleHash: target.bundleHash,
-        reason,
-        applied: !input.dryRun,
-        createdAt,
-        campaignId: input.campaignId,
-    });
-    const nextAlias = {
-        schemaVersion: 1,
-        alias: input.alias,
-        candidateId: target.candidateId,
-        bundleHash: target.bundleHash,
-        updatedAt: createdAt,
-        updatedByDecisionId: decision.decisionId,
-        previousCandidateId: previous?.candidateId ?? null,
-    };
-    if (input.dryRun) {
-        return {
-            dryRun: true,
-            decision: { ...decision, applied: false },
-            alias: nextAlias,
-            previous,
-        };
-    }
-    const historySeq = previous ? await nextHistorySeq(input.repoRoot, input.alias) : 1;
-    const historyEvent = {
-        schemaVersion: 1,
-        seq: historySeq,
-        decisionId: decision.decisionId,
-        action: input.action,
-        fromCandidateId: previous?.candidateId ?? null,
-        toCandidateId: target.candidateId,
-        toBundleHash: target.bundleHash,
-        at: createdAt,
-    };
-    await commitAliasMove({
-        repoRoot: input.repoRoot,
-        decision,
-        nextAlias,
-        historyEvent,
-    });
-    // W2.4 does not auto-retire the previous incumbent: lifecycle `accepted` ≠
-    // alias pointer, and rollback drills must be able to point back without
-    // inventing a new candidate id. Operators may `eval candidate transition
-    // --to retired` separately.
-    return {
-        dryRun: false,
-        decision,
-        alias: (await readIncumbentAlias(input.repoRoot, input.alias)),
-        previous,
-    };
-}
-async function nextHistorySeq(repoRoot, alias) {
-    const text = await readFile(aliasHistoryPath(repoRoot, alias), "utf-8").catch(() => "");
-    const lines = text
-        .split("\n")
-        .map((line) => line.trim())
-        .filter(Boolean);
-    return lines.length + 1;
-}
-export async function promoteAlias(input) {
-    return planAliasMove({
-        ...input,
-        action: "promote",
-        dryRun: input.dryRun !== false,
-    });
-}
-export async function rollbackAlias(input) {
-    return planAliasMove({
-        ...input,
-        action: "rollback",
-        dryRun: input.dryRun !== false,
-    });
-}
-export async function showAlias(input) {
-    const current = await readIncumbentAlias(input.repoRoot, input.alias);
-    if (!current) {
-        throw new Error(`alias not found: ${input.alias}`);
-    }
-    return current;
-}
-export async function listAliases(input) {
-    const names = await listAliasNames(input.repoRoot);
-    const rows = [];
-    for (const name of names) {
-        const current = await readIncumbentAlias(input.repoRoot, name);
-        if (current)
-            rows.push(current);
-    }
-    return rows;
-}
-export async function isCandidatePromotionApplied(input) {
-    const incumbents = await listIncumbentCandidateIds(input.repoRoot);
-    return incumbents.has(input.candidateId);
-}
-export function formatAliasMarkdown(alias) {
-    return [
-        `# Alias: ${alias.alias}`,
-        "",
-        `- candidateId: \`${alias.candidateId}\``,
-        `- bundleHash: \`${alias.bundleHash}\``,
-        `- previousCandidateId: \`${alias.previousCandidateId ?? "null"}\``,
-        `- updatedByDecisionId: \`${alias.updatedByDecisionId}\``,
-        `- updatedAt: \`${alias.updatedAt}\``,
-        "",
-    ].join("\n");
-}
-export function formatAliasMoveMarkdown(result) {
-    const mode = result.dryRun ? "dry-run" : "applied";
-    return [
-        `# Alias ${result.decision.action} (${mode})`,
-        "",
-        `- alias: \`${result.decision.alias}\``,
-        `- from: \`${result.decision.fromCandidateId ?? "null"}\``,
-        `- to: \`${result.decision.toCandidateId}\``,
-        `- bundleHash: \`${result.decision.toBundleHash}\``,
-        `- decisionId: \`${result.decision.decisionId}\``,
-        `- applied: \`${result.decision.applied}\``,
-        `- reason: ${result.decision.reason}`,
-        "",
-        result.dryRun
-            ? "_No alias files were written (dry-run). Pass `--apply` to commit._"
-            : "_Alias pointer updated; candidate bundles and completed DAG facts were not rewritten._",
-        "",
-    ].join("\n");
-}
-export { readPromotionDecision };

package/dist/application/evaluation/budget.js

@@ -1,192 +0,0 @@
-import { z } from "zod";
-/**
- * Campaign / DAG hard-budget contract (Eval Lab W3.4–W3.5 / M3).
- *
- * Token incompleteness: missing `tokensUsed` must never be treated as 0.
- * When `maxTokens` is set, only known token samples accumulate; breach fires
- * only when the known sum exceeds the limit. Calls + wall time + repair passes
- * are the primary hard dimensions for v1.
- */
-export const campaignBudgetModeSchema = z.enum(["hard", "record-only"]);
-export const campaignBudgetLimitsSchema = z
-    .object({
-    maxTokens: z.number().int().positive().optional(),
-    maxWallTimeMs: z.number().int().positive().optional(),
-    maxExecutorCalls: z.number().int().positive().optional(),
-    maxRepairPasses: z.number().int().nonnegative().optional(),
-    maxConcurrency: z.number().int().positive().optional(),
-    maxContextChars: z.number().int().positive().optional(),
-})
-    .strict()
-    .superRefine((limits, ctx) => {
-    const hasHardDim = limits.maxTokens !== undefined ||
-        limits.maxWallTimeMs !== undefined ||
-        limits.maxExecutorCalls !== undefined ||
-        limits.maxRepairPasses !== undefined ||
-        limits.maxContextChars !== undefined;
-    if (!hasHardDim) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "budget.limits requires at least one of maxTokens, maxWallTimeMs, maxExecutorCalls, maxRepairPasses, maxContextChars",
-        });
-    }
-});
-export const campaignBudgetSchema = z
-    .object({
-    schemaVersion: z.literal(1),
-    mode: campaignBudgetModeSchema.default("hard"),
-    limits: campaignBudgetLimitsSchema,
-})
-    .strict();
-export function createBudgetLedger(budget) {
-    return {
-        schemaVersion: 1,
-        mode: budget.mode,
-        limits: { ...budget.limits },
-        consumed: {
-            tokens: null,
-            wallTimeMs: 0,
-            executorCalls: 0,
-            repairPasses: 0,
-            peakContextChars: 0,
-            missingTokenNodeIds: [],
-        },
-        breaches: [],
-        status: budget.mode === "record-only" ? "record-only" : "ok",
-    };
-}
-export function resolveEffectiveMaxConcurrent(requested, budget) {
-    const limit = budget?.limits.maxConcurrency;
-    if (limit === undefined) {
-        return { maxConcurrent: Math.max(1, requested), clamped: false };
-    }
-    const maxConcurrent = Math.max(1, Math.min(requested, limit));
-    return { maxConcurrent, clamped: maxConcurrent < requested };
-}
-function pushBreach(ledger, breach) {
-    const full = {
-        ...breach,
-        at: breach.at ?? new Date().toISOString(),
-    };
-    const duplicate = ledger.breaches.some((existing) => existing.dimension === full.dimension &&
-        existing.nodeId === full.nodeId &&
-        existing.limit === full.limit);
-    if (!duplicate) {
-        ledger.breaches.push(full);
-    }
-    if (ledger.mode === "hard") {
-        ledger.status = "breached";
-    }
-}
-function checkLimit(ledger, dimension, consumed, limit, opts) {
-    if (limit === undefined)
-        return undefined;
-    const exceeded = opts?.inclusive ? consumed >= limit : consumed > limit;
-    if (!exceeded)
-        return undefined;
-    const breach = {
-        dimension,
-        limit,
-        consumed,
-        at: new Date().toISOString(),
-        ...(opts?.nodeId ? { nodeId: opts.nodeId } : {}),
-    };
-    pushBreach(ledger, breach);
-    return breach;
-}
-/**
- * Pre-node check (no call increment yet).
- * Discrete call budget uses inclusive compare so maxExecutorCalls=1 allows the
- * first node then blocks starting a second.
- */
-export function checkBudgetPreNode(ledger, sample) {
-    ledger.consumed.wallTimeMs = sample.wallTimeMs;
-    ledger.consumed.repairPasses = sample.repairPasses;
-    return (checkLimit(ledger, "executorCalls", ledger.consumed.executorCalls, ledger.limits.maxExecutorCalls, { inclusive: true }) ??
-        checkLimit(ledger, "wallTimeMs", sample.wallTimeMs, ledger.limits.maxWallTimeMs) ??
-        checkLimit(ledger, "repairPasses", sample.repairPasses, ledger.limits.maxRepairPasses));
-}
-/**
- * Record one finished node execution attempt and evaluate hard limits.
- * Increments executorCalls by 1. Does not invent tokens when missing.
- */
-export function recordNodeBudgetSample(ledger, sample) {
-    ledger.consumed.executorCalls += 1;
-    ledger.consumed.wallTimeMs = sample.wallTimeMs;
-    ledger.consumed.repairPasses = sample.repairPasses;
-    if (sample.tokensUsed === undefined) {
-        if (!ledger.consumed.missingTokenNodeIds.includes(sample.nodeId)) {
-            ledger.consumed.missingTokenNodeIds.push(sample.nodeId);
-        }
-    }
-    else {
-        ledger.consumed.tokens = (ledger.consumed.tokens ?? 0) + sample.tokensUsed;
-    }
-    if (sample.contextChars !== undefined) {
-        ledger.consumed.peakContextChars = Math.max(ledger.consumed.peakContextChars, sample.contextChars);
-    }
-    return (checkLimit(ledger, "executorCalls", ledger.consumed.executorCalls, ledger.limits.maxExecutorCalls, { nodeId: sample.nodeId, inclusive: true }) ??
-        checkLimit(ledger, "wallTimeMs", ledger.consumed.wallTimeMs, ledger.limits.maxWallTimeMs, { nodeId: sample.nodeId }) ??
-        checkLimit(ledger, "repairPasses", ledger.consumed.repairPasses, ledger.limits.maxRepairPasses, { nodeId: sample.nodeId }) ??
-        (ledger.consumed.tokens !== null
-            ? checkLimit(ledger, "tokens", ledger.consumed.tokens, ledger.limits.maxTokens, { nodeId: sample.nodeId })
-            : undefined) ??
-        checkLimit(ledger, "contextChars", ledger.consumed.peakContextChars, ledger.limits.maxContextChars, { nodeId: sample.nodeId }));
-}
-export function isHardBudgetBreached(ledger) {
-    return Boolean(ledger && ledger.mode === "hard" && ledger.status === "breached");
-}
-/** Mark all PENDING nodes as SKIPPED due to budget breach (fail closed). */
-export function skipPendingNodesForBudgetBreach(nodes, breach) {
-    const skipped = [];
-    const reason = `budget_breach:${breach.dimension}`;
-    for (const [id, node] of Object.entries(nodes)) {
-        if (node.status !== "PENDING")
-            continue;
-        node.status = "SKIPPED";
-        node.skippedReason = reason;
-        skipped.push(id);
-    }
-    return skipped;
-}
-export function formatBudgetReportMarkdown(ledger) {
-    const limits = ledger.limits;
-    const c = ledger.consumed;
-    const lines = [
-        `# Budget Ledger`,
-        ``,
-        `- **mode**: ${ledger.mode}`,
-        `- **status**: ${ledger.status}`,
-        ``,
-        `## Limits`,
-        ``,
-        `| dimension | limit |`,
-        `|---|---|`,
-        `| maxTokens | ${limits.maxTokens ?? "n/a"} |`,
-        `| maxWallTimeMs | ${limits.maxWallTimeMs ?? "n/a"} |`,
-        `| maxExecutorCalls | ${limits.maxExecutorCalls ?? "n/a"} |`,
-        `| maxRepairPasses | ${limits.maxRepairPasses ?? "n/a"} |`,
-        `| maxConcurrency | ${limits.maxConcurrency ?? "n/a"} |`,
-        `| maxContextChars | ${limits.maxContextChars ?? "n/a"} |`,
-        ``,
-        `## Consumed`,
-        ``,
-        `| dimension | value |`,
-        `|---|---|`,
-        `| tokens | ${c.tokens ?? "n/a (missing)"} |`,
-        `| wallTimeMs | ${c.wallTimeMs} |`,
-        `| executorCalls | ${c.executorCalls} |`,
-        `| repairPasses | ${c.repairPasses} |`,
-        `| peakContextChars | ${c.peakContextChars} |`,
-        `| missingTokenNodes | ${c.missingTokenNodeIds.join(", ") || "none"} |`,
-    ];
-    if (ledger.breaches.length > 0) {
-        lines.push(``, `## Breaches`, ``);
-        for (const breach of ledger.breaches) {
-            lines.push(`- **${breach.dimension}**: consumed ${breach.consumed} > limit ${breach.limit}` +
-                (breach.nodeId ? ` (node ${breach.nodeId})` : "") +
-                ` at ${breach.at}`);
-        }
-    }
-    return `${lines.join("\n")}\n`;
-}

package/dist/application/evaluation/campaign-hash.js

@@ -1,47 +0,0 @@
-import { formatContentSha, sha256Hex, } from "./candidate-hash.js";
-/** Frozen placeholder for M4; M5 may replace with real scoring rules bytes. */
-export const SCORING_RULES_V1 = "promotion-policy-v1";
-export function computeScoringRulesHash(policyVersion = SCORING_RULES_V1) {
-    return formatContentSha(sha256Hex(policyVersion));
-}
-export function computeBudgetHash(budget) {
-    const canonical = {
-        schemaVersion: budget.schemaVersion,
-        mode: budget.mode,
-        limits: Object.fromEntries(Object.entries(budget.limits).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)),
-    };
-    return formatContentSha(sha256Hex(JSON.stringify(canonical)));
-}
-export function computePrivateVerifierManifestHash(manifest) {
-    const checks = [...manifest.checks]
-        .map((check) => ({
-        checkId: check.checkId,
-        kind: check.kind,
-        command: [...check.command],
-        cwd: check.cwd ?? ".",
-        timeoutMs: check.timeoutMs ?? 60_000,
-        expectedExitCode: check.expectedExitCode ?? 0,
-    }))
-        .sort((a, b) => a.checkId < b.checkId ? -1 : a.checkId > b.checkId ? 1 : 0);
-    const canonical = {
-        schemaVersion: 1,
-        privateVerifierId: manifest.privateVerifierId,
-        checks,
-    };
-    return formatContentSha(sha256Hex(JSON.stringify(canonical)));
-}
-export function computeCampaignPlanHash(campaignId, cells) {
-    const sorted = [...cells].sort((a, b) => a.cellId < b.cellId ? -1 : a.cellId > b.cellId ? 1 : 0);
-    const canonical = {
-        schemaVersion: 1,
-        campaignId,
-        cells: sorted,
-    };
-    return formatContentSha(sha256Hex(JSON.stringify(canonical)));
-}
-export function assertPrivateVerifierHash(manifest) {
-    const recomputed = computePrivateVerifierManifestHash(manifest);
-    if (recomputed !== manifest.manifestHash) {
-        throw new Error(`privateVerifier manifestHash mismatch for ${manifest.privateVerifierId}: expected ${recomputed}, got ${manifest.manifestHash}`);
-    }
-}