@tea-agent/loop-agent 0.16.1 → 0.16.3

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # 更新日志
 
+## [Unreleased]
+
+### 改进
+
+- 后端测试 DAG 从 38 个收敛为 24 个真实顶层节点；使用 fail-closed `runIf` 和复合 Shell capability 减少调度，同时保留双合同、Manifest、语义评审、JUnit、Result、分类、修复安全、追踪和最终 outcome 证据。三条可选修订/修复分支仍各最多执行一次。
+- Backend Test Analysis、Case Manifest、Semantic Review 与 Classification 的严格 JSON 契约进一步对齐，生成和修订节点明确字段白名单、`sourceBinding` 与 evidence gap 约束，避免模型自定义字段导致确定性门禁失败。
+
+### 修复
+
+- 后端测试复合 Shell pipeline 现在与普通 Shell 节点共享 Git write guard；即使命令退出成功，只要越过 `read-only`、`allowedPaths` 或 `forbiddenPaths` 边界，节点仍会 fail-closed。
+- Observe 现使用实际的 repair safety 节点，并只在修复节点真正开始执行后计入一次 attempt；条件跳过不再误报已修复，安全门禁失败会显示为 `rejected`。
+- Pi SDK 对缺少响应 ID 的累计 Token 生命周期事件改为取本次执行最大快照，避免同一响应的匿名 usage 被重复累加。
+- Pi SDK 执行长推理或大段结构化输出时不再把高频流式增量事件无界累积到内存；同一响应在多个生命周期事件中重复出现的 Token 用量只统计一次，避免 `Invalid string length` 和成本数据虚高。
+- 后端测试复合执行节点继续保持 clean environment、失败分类和 fail-closed outcome，并为 initial/final Result、repair eligibility、traceability 与 Observe 投影保留结构化运行证据。
+
+## [0.16.3] - 2026-07-19
+
+### 修复
+
+- 前端实现 DAG 在 review 前新增确定性 `frontend-worktree-diff-shell`，写出 run-owned `diff_patch` 与清单，避免 review 因找不到 actual diff 而误拦截。
+
+## [0.16.2] - 2026-07-19
+
+### 修复
+
+- 前端 `frontend-implementation-contract-shell` 物化时用 DAG 权威 `sourceBinding` 覆盖模型输出，避免模型错绑 requirement 路径/哈希或额外引用路径导致实现链在设计门后 fail-closed。
+
 ## [0.16.1] - 2026-07-19
 
 ### 重点更新

package/dist/executors/dag-pi-executor.js

@@ -292,9 +292,11 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep) {
             writeGuardOk = guard.ok;
             writeGuardViolations = guard.violations;
         }
-        catch {
+        catch (error) {
             writeGuardOk = false;
-            writeGuardViolations = ["write guard failed: git status unavailable"];
+            writeGuardViolations = [
+                `git status unavailable: ${error instanceof Error ? error.message : String(error)}`,
+            ];
         }
     }
     if (writeGuardOk) {

package/dist/executors/pi-sdk-executor.js

@@ -1,6 +1,6 @@
 import { appendFile, mkdir } from 'node:fs/promises';
 import path from 'node:path';
-import { classifyPiFailure, DEFAULT_TIMEOUT_MS, extractAssistantTextFromPiJson, extractTokenUsageFromPiJson, } from './pi-executor.js';
+import { classifyPiFailure, DEFAULT_TIMEOUT_MS, extractAssistantTextFromPiJson, } from './pi-executor.js';
 import { serializeSessionEvent } from './pi-event-serializer.js';
 let sdkSessionFactoryOverride;
 let sdkImportOverrideForTests;
@@ -202,6 +202,63 @@ async function resolveSdkSessionFactory(reuseScope) {
         return createSdkSession(sdk, input, shared);
     };
 }
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function readUsageNumber(record, keys) {
+    for (const key of keys) {
+        const value = record[key];
+        if (typeof value === 'number' && Number.isFinite(value) && value >= 0) {
+            return Math.trunc(value);
+        }
+    }
+    return undefined;
+}
+function extractSdkUsageSample(event) {
+    const message = isRecord(event.message) ? event.message : undefined;
+    const usageCandidates = [event.usage, message?.usage, event.tokenUsage];
+    let tokens;
+    for (const candidate of usageCandidates) {
+        if (!isRecord(candidate))
+            continue;
+        const input = readUsageNumber(candidate, ['input_tokens', 'inputTokens', 'prompt_tokens', 'promptTokens']);
+        const output = readUsageNumber(candidate, ['output_tokens', 'outputTokens', 'completion_tokens', 'completionTokens']);
+        const total = readUsageNumber(candidate, ['total_tokens', 'totalTokens']);
+        if (input !== undefined && output !== undefined) {
+            tokens = input + output;
+            break;
+        }
+        if (total !== undefined) {
+            tokens = total;
+            break;
+        }
+    }
+    if (tokens === undefined)
+        return undefined;
+    const responseKeyCandidates = [
+        event.responseId,
+        event.messageId,
+        message?.responseId,
+        message?.id,
+    ];
+    const responseKey = responseKeyCandidates.find((value) => typeof value === 'string' && value.length > 0);
+    return responseKey ? { responseKey, tokens } : { tokens };
+}
+function aggregateSdkTokenUsage(samples) {
+    const identified = new Map();
+    let anonymousMaximum = 0;
+    for (const sample of samples) {
+        if (sample.responseKey) {
+            identified.set(sample.responseKey, Math.max(identified.get(sample.responseKey) ?? 0, sample.tokens));
+        }
+        else {
+            // SDK lifecycle events may repeat cumulative usage without a response id.
+            // Treat anonymous samples as snapshots for this attempt rather than increments.
+            anonymousMaximum = Math.max(anonymousMaximum, sample.tokens);
+        }
+    }
+    return anonymousMaximum + Array.from(identified.values()).reduce((sum, tokens) => sum + tokens, 0);
+}
 /**
  * Execute a single Pi step via the SDK.
  * When reuseScope is active, only shared auth/model resources are reused; each attempt still
@@ -227,6 +284,7 @@ export async function executeSingleSdkAttempt(options) {
     let timedOut = false;
     let stderr = '';
     const stdoutLines = [];
+    const usageSamples = [];
     let session;
     let timeoutHandle;
     const sessionEventAppender = options.sessionEventsPath
@@ -243,9 +301,14 @@ export async function executeSingleSdkAttempt(options) {
             thinking: modelConfig.thinking,
         });
         const unsubscribe = session.subscribe((event) => {
+            const usageSample = extractSdkUsageSample(event);
+            if (usageSample)
+                usageSamples.push(usageSample);
+            if (!shouldPersistSessionEvent(event))
+                return;
             const line = serializeSessionEvent(event);
             stdoutLines.push(line);
-            if (sessionEventAppender && shouldPersistSessionEvent(event)) {
+            if (sessionEventAppender) {
                 sessionEventAppender.append(line, event);
             }
         });
@@ -305,7 +368,7 @@ export async function executeSingleSdkAttempt(options) {
     const stdout = stdoutLines.join('\n');
     const durationMs = Date.now() - startedAt;
     const { assistantText, parsedEvents } = extractAssistantTextFromPiJson(stdout);
-    const tokensUsed = extractTokenUsageFromPiJson(stdout);
+    const tokensUsed = aggregateSdkTokenUsage(usageSamples);
     const failureCategory = classifyPiFailure({
         assistantText,
         exitCode: timedOut ? 1 : stderr ? 1 : 0,

package/dist/executors/shell-executor.js

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { appendFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { writeDagNodeTextArtifact } from "../infrastructure/harness/artifact-store.js";
 import { truncateOutput } from "../shared/output-truncation.js";
@@ -7,11 +8,14 @@ import { buildRequirementCoverageGateShellCommand, expandShellPreset, buildVerdi
 import { materializeBackendTestAnalysisContract } from "../workflows/dag/backend-test-analysis-contract.js";
 import { materializeFrontendImplementationContract } from "../workflows/dag/frontend-implementation-contract.js";
 import { formatFrontendVerificationTraceStdout, runFrontendVerificationTraceGate, } from "../workflows/dag/frontend-verification-trace.js";
+import { formatFrontendWorktreeDiffStdout, runFrontendWorktreeDiffGate, } from "../workflows/dag/frontend-worktree-diff.js";
 import { formatFrontendFailureAssessStdout, formatFrontendRepairContractStdout, runFrontendFailureAssessGate, runFrontendRepairContractGate, } from "../workflows/dag/frontend-repair.js";
 import { formatTraceabilityGateStdout, materializeBackendTestCaseManifest, runBackendTestTraceabilityGate, } from "../workflows/dag/backend-test-case-manifest.js";
 import { materializeBackendTestExecutionContract } from "../workflows/dag/backend-test-execution-contract.js";
 import { materializeBackendTestResultFromRunDir } from "../workflows/dag/backend-test-result-contract.js";
-import { pathsChangedDuringRun, snapshotGitStatusPorcelain, validateShellWriteGuard, } from "./shell-write-guard.js";
+import { buildBackendTestEffectiveResultSelectorShellSnippet, buildBackendTestRepairEligibilityShellSnippet, buildBackendTestRepairSafetyShellSnippet, materializeBackendTestClassification, } from "../workflows/dag/backend-test-repair-contract.js";
+import { materializeBackendTestSemanticReview } from "../workflows/dag/backend-test-semantic-review-contract.js";
+import { pathsChangedDuringRun, readGitStatusPorcelain, snapshotGitStatusPorcelain, validateShellWriteGuard, } from "./shell-write-guard.js";
 import { buildShellProcessEnv } from "./shell-verification.js";
 const DEFAULT_SHELL_TIMEOUT_MS = 300_000;
 const SUMMARY_STDOUT_MAX = 4_000;
@@ -63,32 +67,6 @@ export function resolveShellCommands(shell) {
         ...fromRequirementCoverageGate,
     ];
 }
-async function readGitStatusPorcelain(cwd) {
-    return new Promise((resolve, reject) => {
-        const child = spawn("git", ["status", "--porcelain=v1", "--untracked-files=all"], {
-            cwd,
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.setEncoding("utf-8");
-        child.stderr.setEncoding("utf-8");
-        child.stdout.on("data", (chunk) => {
-            stdout += chunk;
-        });
-        child.stderr.on("data", (chunk) => {
-            stderr += chunk;
-        });
-        child.on("error", reject);
-        child.on("close", (code) => {
-            if (code === 0) {
-                resolve(stdout);
-                return;
-            }
-            reject(new Error(`git status failed: ${stderr.trim() || stdout.trim()}`));
-        });
-    });
-}
 export async function executeShellCommand(input) {
     return new Promise((resolve) => {
         const startedAt = Date.now();
@@ -297,8 +275,194 @@ async function runShellWriteGuard(input) {
         forbiddenPaths: input.task.forbiddenPaths,
     });
 }
+async function executeBackendTestPipeline(input, meta) {
+    const pipeline = input.task.shell?.backendTestPipeline;
+    const started = Date.now();
+    try {
+        if (!pipeline)
+            throw new Error("missing backend-test pipeline id");
+        const outputs = [];
+        if (pipeline === "contracts") {
+            const wrapperPath = path.join(meta.runDir, "analyze-and-discover-backend-test-pi.json");
+            const wrapper = JSON.parse(await readFile(wrapperPath, "utf8"));
+            const raw = wrapper.assistantText?.trim() || wrapper.stdout?.trim() || "";
+            const fenced = raw.match(/^```json\s*([\s\S]*?)\s*```$/i);
+            const envelope = JSON.parse(fenced ? fenced[1] : raw);
+            if (!envelope.analysis || !envelope.execution)
+                throw new Error("backend-test contract envelope requires analysis and execution");
+            await writeFile(path.join(meta.runDir, "backend-test-analysis-envelope.json"), JSON.stringify({ assistantText: JSON.stringify(envelope.analysis) }));
+            await writeFile(path.join(meta.runDir, "backend-test-execution-envelope.json"), JSON.stringify({ assistantText: JSON.stringify(envelope.execution) }));
+            const analysis = await materializeBackendTestAnalysisContract({
+                runDir: meta.runDir,
+                fromNodeId: "backend-test-analysis-envelope",
+                artifactName: "backend-test-analysis.json",
+                outputDir: "contracts",
+                sourceBinding: meta.spec.sourceBinding,
+            });
+            const execution = await materializeBackendTestExecutionContract({
+                runDir: meta.runDir,
+                fromNodeId: "backend-test-execution-envelope",
+                artifactName: "backend-test-execution.json",
+                outputDir: "contracts",
+            });
+            outputs.push(`analysis=${analysis.path}`, `execution=${execution.path}`);
+        }
+        else if (pipeline === "semantic-initial" || pipeline === "semantic-final") {
+            const fromNodeId = pipeline === "semantic-final"
+                ? "review-generated-backend-pytest-final-pi"
+                : "review-generated-backend-pytest-pi";
+            const artifactName = pipeline === "semantic-final"
+                ? "backend-test-semantic-review-final.json"
+                : "backend-test-semantic-review.json";
+            const review = await materializeBackendTestSemanticReview({
+                runDir: meta.runDir,
+                fromNodeId,
+                artifactName,
+                outputDir: "contracts",
+            });
+            const trace = await runBackendTestTraceabilityGate({
+                runDir: meta.runDir,
+                workspaceRoot: input.cwd,
+            });
+            outputs.push(`semantic=${review.path}`, formatTraceabilityGateStdout(trace));
+            const parsed = JSON.parse(await readFile(review.path, "utf8"));
+            if (pipeline === "semantic-initial") {
+                return { ok: true, stdout: JSON.stringify(parsed), stderr: "", failureCategory: "success", durationMs: Date.now() - started };
+            }
+            if (pipeline === "semantic-final") {
+                if (parsed.verdict !== "pass")
+                    throw new Error("backend pytest semantic review did not pass");
+            }
+        }
+        else if (pipeline === "execute-parse-initial") {
+            const results = await executePipelineCommands(input, meta);
+            if (!results.every((result) => result.ok)) {
+                const failure = results.find((result) => !result.ok);
+                return { ok: false, stdout: results.map((result) => result.stdout).join("\n"), stderr: failure.stderr, failureCategory: failure.failureCategory, durationMs: Date.now() - started };
+            }
+            const artifact = await materializeBackendTestResultFromRunDir({
+                runDir: meta.runDir,
+                fromNodeId: input.task.id,
+                artifactName: "backend-test-result-initial.json",
+                outputDir: "contracts",
+                junitRelativePath: "reports/backend-test-initial-junit.xml",
+            });
+            outputs.push(...results.map((result) => result.stdout), `result=${artifact.path}`);
+        }
+        else if (pipeline === "classification-eligibility") {
+            const classification = await materializeBackendTestClassification({
+                runDir: meta.runDir,
+                fromNodeId: "classify-backend-test-result-pi",
+                artifactName: "backend-test-classification.json",
+                outputDir: "contracts",
+            });
+            const results = await executePipelineCommands(input, meta, [buildBackendTestRepairEligibilityShellSnippet()]);
+            if (!results.every((result) => result.ok))
+                throw new Error(results.find((result) => !result.ok)?.stderr || "repair eligibility failed");
+            const eligibility = JSON.parse(await readFile(path.join(meta.runDir, "contracts", "backend-test-repair-eligibility.json"), "utf8"));
+            return { ok: true, stdout: JSON.stringify(eligibility), stderr: "", failureCategory: "success", durationMs: Date.now() - started };
+        }
+        else if (pipeline === "repair-safety-traceability") {
+            const results = await executePipelineCommands(input, meta, [buildBackendTestRepairSafetyShellSnippet()]);
+            if (!results.every((result) => result.ok))
+                throw new Error(results.find((result) => !result.ok)?.stderr || "repair safety failed");
+            const trace = await runBackendTestTraceabilityGate({ runDir: meta.runDir, workspaceRoot: input.cwd });
+            outputs.push(...results.map((result) => result.stdout), formatTraceabilityGateStdout(trace));
+        }
+        else if (pipeline === "finalize-effective-result") {
+            const eligibilityPath = path.join(meta.runDir, "contracts", "backend-test-repair-eligibility.json");
+            const eligibility = existsSync(eligibilityPath)
+                ? JSON.parse(await readFile(eligibilityPath, "utf8"))
+                : { eligible: false };
+            const finalNeeded = eligibility.eligible === true;
+            if (finalNeeded) {
+                const results = await executePipelineCommands(input, meta);
+                if (!results.every((result) => result.ok))
+                    return { ok: false, stdout: results.map((result) => result.stdout).join("\n"), stderr: results.find((result) => !result.ok)?.stderr ?? "final pytest failed", failureCategory: results.find((result) => !result.ok)?.failureCategory ?? "nonzero-exit", durationMs: Date.now() - started };
+                const artifact = await materializeBackendTestResultFromRunDir({ runDir: meta.runDir, fromNodeId: input.task.id, artifactName: "backend-test-result-final.json", outputDir: "contracts", junitRelativePath: "reports/backend-test-final-junit.xml" });
+                outputs.push(...results.map((result) => result.stdout), `final=${artifact.path}`);
+            }
+            const selected = await executePipelineCommands(input, meta, [buildBackendTestEffectiveResultSelectorShellSnippet()]);
+            if (!selected.every((result) => result.ok))
+                throw new Error(selected.find((result) => !result.ok)?.stderr || "effective result selection failed");
+            outputs.push(...selected.map((result) => result.stdout));
+        }
+        else {
+            throw new Error(`unsupported backend-test pipeline: ${pipeline}`);
+        }
+        return { ok: true, stdout: outputs.filter(Boolean).join("\n"), stderr: "", failureCategory: "success", durationMs: Date.now() - started };
+    }
+    catch (error) {
+        return { ok: false, stdout: "", stderr: error instanceof Error ? error.message : String(error), failureCategory: "invalid-output", durationMs: Date.now() - started };
+    }
+}
+async function executeBackendTestPipelineWithWriteGuard(input, meta) {
+    let beforeStatus;
+    try {
+        beforeStatus = await readGitStatusPorcelain(input.cwd);
+    }
+    catch {
+        // Non-git cwd: keep the same documented limitation as normal shell nodes.
+        beforeStatus = undefined;
+    }
+    const result = await executeBackendTestPipeline(input, meta);
+    if (beforeStatus === undefined)
+        return result;
+    try {
+        const guard = await runShellWriteGuard({
+            rootCwd: input.cwd,
+            task: input.task,
+            beforeStatus,
+        });
+        if (guard.ok)
+            return result;
+        const detail = `write guard failed: ${guard.violations.join(", ")}`;
+        return {
+            ...result,
+            ok: false,
+            stderr: [result.stderr, detail].filter(Boolean).join("\n\n"),
+            failureCategory: "write-guard",
+        };
+    }
+    catch (error) {
+        const detail = `write guard failed: git status unavailable: ${error instanceof Error ? error.message : String(error)}`;
+        return {
+            ...result,
+            ok: false,
+            stderr: [result.stderr, detail].filter(Boolean).join("\n\n"),
+            failureCategory: "write-guard",
+        };
+    }
+}
+async function executePipelineCommands(input, meta, overrideCommands) {
+    const shell = input.task.shell;
+    const cwd = resolveShellCwd(input.cwd, shell.cwd);
+    const commands = overrideCommands ?? shell.commands;
+    const results = [];
+    for (const command of commands) {
+        const commandNumber = results.length + 1;
+        const result = await executeShellCommand({
+            command,
+            cwd,
+            timeoutMs: shell.timeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS,
+            envAllowlist: shell.envAllowlist,
+            dagRunMeta: { runDir: meta.runDir, runId: meta.runId },
+            outputArtifacts: {
+                stdoutPath: path.join(meta.runDir, input.task.id, "commands", `${commandNumber}.stdout.txt`),
+                stderrPath: path.join(meta.runDir, input.task.id, "commands", `${commandNumber}.stderr.txt`),
+            },
+        });
+        results.push(result);
+        if (!result.ok)
+            break;
+    }
+    return results;
+}
 export async function executeDagShellNode(input, meta) {
     const shell = input.task.shell;
+    if (shell?.backendTestPipeline) {
+        return executeBackendTestPipelineWithWriteGuard(input, meta);
+    }
     if (shell?.jsonArtifactGate) {
         const started = Date.now();
         try {
@@ -306,6 +470,7 @@ export async function executeDagShellNode(input, meta) {
             let artifact;
             switch (gate.schemaId) {
                 case "backend-test-analysis-v1":
+                case "backend-test-analysis-v2":
                     artifact = await materializeBackendTestAnalysisContract({
                         runDir: meta.runDir,
                         fromNodeId: gate.fromNodeId,
@@ -328,6 +493,23 @@ export async function executeDagShellNode(input, meta) {
                         fromNodeId: gate.fromNodeId,
                         artifactName: gate.artifactName,
                         outputDir: gate.outputDir,
+                        junitRelativePath: gate.junitRelativePath,
+                    });
+                    break;
+                case "backend-test-classification-v1":
+                    artifact = await materializeBackendTestClassification({
+                        runDir: meta.runDir,
+                        fromNodeId: gate.fromNodeId,
+                        artifactName: gate.artifactName,
+                        outputDir: gate.outputDir,
+                    });
+                    break;
+                case "backend-test-semantic-review-v1":
+                    artifact = await materializeBackendTestSemanticReview({
+                        runDir: meta.runDir,
+                        fromNodeId: gate.fromNodeId,
+                        artifactName: gate.artifactName,
+                        outputDir: gate.outputDir,
                     });
                     break;
                 case "backend-test-case-manifest-v1":
@@ -425,6 +607,32 @@ export async function executeDagShellNode(input, meta) {
             };
         }
     }
+    if (shell?.commands?.length === 1 &&
+        shell.commands[0] === "frontend-worktree-diff-gate") {
+        const started = Date.now();
+        try {
+            const result = await runFrontendWorktreeDiffGate({
+                runDir: meta.runDir,
+                workspaceRoot: input.cwd,
+            });
+            return {
+                ok: true,
+                stdout: formatFrontendWorktreeDiffStdout(result),
+                stderr: "",
+                failureCategory: "success",
+                durationMs: Date.now() - started,
+            };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                stdout: "",
+                stderr: error instanceof Error ? error.message : String(error),
+                failureCategory: "invalid-output",
+                durationMs: Date.now() - started,
+            };
+        }
+    }
     if (shell?.commands?.length === 1 &&
         shell.commands[0] === "frontend-failure-assess-gate") {
         const started = Date.now();
@@ -520,9 +728,11 @@ export async function executeDagShellNode(input, meta) {
             writeGuardOk = guard.ok;
             writeGuardViolations = guard.violations;
         }
-        catch {
+        catch (error) {
             writeGuardOk = false;
-            writeGuardViolations = ["write guard failed: git status unavailable"];
+            writeGuardViolations = [
+                `git status unavailable: ${error instanceof Error ? error.message : String(error)}`,
+            ];
         }
     }
     const commandsOk = results.every((result) => result.ok);

package/dist/executors/shell-presets.js

@@ -31,10 +31,20 @@ function verdictGateNodeParser(lineMode) {
  */
 export function buildVerdictGateShellCommand(gate) {
     const gateLabel = gate.label ?? `${gate.fromNodeId} verdict`;
-    const jsonFile = `${gate.fromNodeId}.json`;
     const lineMode = gate.lineMode ?? "first-non-empty";
     const parser = verdictGateNodeParser(lineMode);
-    const preamble = `test -n "\${HARNESS_DAG_RUN_DIR:-}" || { echo "missing HARNESS_DAG_RUN_DIR for ${gateLabel} gate" >&2; exit 1; }; FILE="\${HARNESS_DAG_RUN_DIR}/${jsonFile}"; test -f "\${FILE}" || { echo "missing ${gateLabel} JSON output: \${FILE}" >&2; exit 1; }; FIRST=$(${parser})`;
+    const candidateNodeIds = [
+        gate.fromNodeId,
+        ...(gate.fallbackFromNodeIds ?? []).filter((id) => id !== gate.fromNodeId),
+    ];
+    const resolveFile = candidateNodeIds.length === 1
+        ? `FILE="\${HARNESS_DAG_RUN_DIR}/${candidateNodeIds[0]}.json"; test -f "\${FILE}" || { echo "missing ${gateLabel} JSON output: \${FILE}" >&2; exit 1; }`
+        : [
+            "FILE=\"\"",
+            ...candidateNodeIds.map((id) => `if test -z "\${FILE}" && test -f "\${HARNESS_DAG_RUN_DIR}/${id}.json"; then FILE="\${HARNESS_DAG_RUN_DIR}/${id}.json"; fi`),
+            `test -n "\${FILE}" || { echo "missing ${gateLabel} JSON output (tried: ${candidateNodeIds.join(", ")})" >&2; exit 1; }`,
+        ].join("; ");
+    const preamble = `test -n "\${HARNESS_DAG_RUN_DIR:-}" || { echo "missing HARNESS_DAG_RUN_DIR for ${gateLabel} gate" >&2; exit 1; }; ${resolveFile}; FIRST=$(${parser})`;
     const blockedMessage = `${gateLabel} gate blocked: \${FIRST:-missing VERDICT line}`;
     if (gate.accept.length === 1) {
         const expected = escapeShellSingleQuoted(gate.accept[0]);

package/dist/executors/shell-write-guard.js

@@ -67,7 +67,26 @@ export function validateShellWriteGuard(input) {
     }
     return { ok: violations.length === 0, violations };
 }
-export async function readGitStatusPorcelain(cwd) {
+export async function readGitStatusPorcelain(cwd, options = {}) {
+    const attempts = Math.max(1, options.attempts ?? 3);
+    const retryDelayMs = Math.max(0, options.retryDelayMs ?? 100);
+    let lastError;
+    for (let attempt = 1; attempt <= attempts; attempt += 1) {
+        try {
+            return await readGitStatusPorcelainOnce(cwd);
+        }
+        catch (error) {
+            lastError = error;
+            if (attempt < attempts && retryDelayMs > 0) {
+                await new Promise((resolve) => setTimeout(resolve, retryDelayMs * attempt));
+            }
+        }
+    }
+    throw lastError instanceof Error
+        ? lastError
+        : new Error(`git status failed after ${attempts} attempts`);
+}
+function readGitStatusPorcelainOnce(cwd) {
     return new Promise((resolve, reject) => {
         const child = spawn("git", ["status", "--porcelain=v1", "--untracked-files=all"], {
             cwd,

package/dist/shared/git-progress.js

@@ -114,8 +114,15 @@ function globToRegExp(pattern) {
         const char = normalized[i];
         const next = normalized[i + 1];
         if (char === '*' && next === '*') {
-            regex += '.*';
-            i += 1;
+            const afterGlobstar = normalized[i + 2];
+            if (afterGlobstar === '/') {
+                regex += '(?:.*/)?';
+                i += 2;
+            }
+            else {
+                regex += '.*';
+                i += 1;
+            }
             continue;
         }
         if (char === '*') {

package/dist/worker/observability/read-model.js

@@ -1283,6 +1283,9 @@ function mergeDagRun(existing, incoming) {
         ...((incoming.dagPath ?? existing.dagPath)
             ? { dagPath: incoming.dagPath ?? existing.dagPath }
             : {}),
+        ...((incoming.backendTest ?? existing.backendTest)
+            ? { backendTest: incoming.backendTest ?? existing.backendTest }
+            : {}),
     };
 }
 function mergeDagNodes(existing, incoming) {
@@ -1462,6 +1465,57 @@ async function walkForStateJson(dir, results) {
         // skip
     }
 }
+async function loadBackendTestProjection(runDir, nodes) {
+    const contracts = path.join(runDir, "contracts");
+    const readContract = async (name) => {
+        const value = await safeReadJson(path.join(contracts, name));
+        return value ?? undefined;
+    };
+    const [initial, classification, eligibility, final, effective, manifest] = await Promise.all([
+        readContract("backend-test-result-initial.json"),
+        readContract("backend-test-classification.json"),
+        readContract("backend-test-repair-eligibility.json"),
+        readContract("backend-test-result-final.json"),
+        readContract("backend-test-result.json"),
+        readContract("backend-test-case-manifest.json"),
+    ]);
+    if (!initial && !classification && !eligibility && !final && !effective && !manifest)
+        return undefined;
+    const result = (value) => value ? {
+        outcome: readString(value, "outcome"),
+        passed: readNumber(value, "passed"),
+        failed: readNumber(value, "failed"),
+        error: readNumber(value, "error"),
+    } : undefined;
+    const repairNode = nodes.find((node) => node.nodeId === "repair-backend-pytest-pi");
+    const safetyNode = nodes.find((node) => node.nodeId === "validate-repair-safety-and-traceability-shell");
+    const eligible = eligibility ? eligibility.eligible === true : undefined;
+    const repairNodeStatus = repairNode?.status?.toLowerCase();
+    const repairAttempted = repairNodeStatus === "running" || repairNodeStatus === "finished" || repairNodeStatus === "error";
+    let repairStatus = "not-needed";
+    if (repairNodeStatus === "running")
+        repairStatus = "repairing";
+    else if (safetyNode && isFailedNodeStatus(safetyNode.status))
+        repairStatus = "rejected";
+    else if (final)
+        repairStatus = "completed";
+    else if (eligible)
+        repairStatus = "eligible";
+    const effectiveSource = final ? "final" : "initial";
+    return {
+        ...(initial ? { initial: result(initial) } : {}),
+        ...(classification ? { classification: { category: readString(classification, "category"), confidence: readNumber(classification, "confidence") } } : {}),
+        repair: {
+            eligible,
+            reason: eligibility ? readString(eligibility, "reason") : undefined,
+            attempt: final || repairAttempted ? 1 : 0,
+            status: repairStatus,
+        },
+        ...(final ? { final: result(final) } : {}),
+        ...(effective ? { effective: { source: effectiveSource, outcome: readString(effective, "outcome") } } : {}),
+        ...(manifest && manifest.coverageSummary ? { coverage: manifest.coverageSummary } : {}),
+    };
+}
 async function parseDagStateFile(statePath, now) {
     try {
         if (!existsSync(statePath))
@@ -1516,6 +1570,7 @@ async function parseDagStateFile(statePath, now) {
                 liveness: liveness.status,
             })
             : undefined;
+        const backendTest = await loadBackendTestProjection(runDir, nodes);
         return {
             dagRunId,
             status,
@@ -1532,6 +1587,7 @@ async function parseDagStateFile(statePath, now) {
             nodes,
             edges,
             dagPath: runDir,
+            ...(backendTest ? { backendTest } : {}),
         };
     }
     catch {

package/dist/worker/observe/server.js

@@ -24,9 +24,6 @@ export function createObserveServer(options) {
     return new Promise((resolve, reject) => {
         const server = createServer((req, res) => {
             const startedAt = Date.now();
-            req.socket?.on("error", () => {
-                // Ignore client resets; avoid unhandled socket error noise.
-            });
             if (debug) {
                 let logged = false;
                 const onceLog = (note) => {
@@ -59,6 +56,12 @@ export function createObserveServer(options) {
         server.headersTimeout = keepAliveTimeoutMs + 5_000;
         // Allow long-lived SSE; per-request work still finishes promptly.
         server.requestTimeout = 0;
+        server.on("connection", (socket) => {
+            socket.on("error", () => {
+                // Ignore client resets; install once per connection so keep-alive
+                // requests cannot accumulate listeners on the same socket.
+            });
+        });
         server.on("clientError", (err, socket) => {
             if (debug) {
                 process.stderr.write(`[observe] ${new Date().toISOString()} clientError ${err.message}\n`);