@tea-agent/loop-agent 0.16.1 → 0.16.3

package/dist/workflows/dag/backend-test-analysis-contract.js

@@ -3,50 +3,84 @@ import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
 import { writeDagRunJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
-export const BACKEND_TEST_ANALYSIS_SCHEMA_ID = "backend-test-analysis-v1";
+export const BACKEND_TEST_ANALYSIS_SCHEMA_ID = "backend-test-analysis-v2";
 const sourceRefSchema = z.string().min(1);
-const fieldSchema = z.object({
+const fieldV1Schema = z.object({
     name: z.string().min(1),
     type: z.string().min(1).optional(),
     required: z.boolean().optional(),
     description: z.string().optional(),
 }).strict();
+const fieldV2Schema = fieldV1Schema.extend({
+    format: z.string().min(1).optional(),
+    comparison: z.enum(["exact", "parseable-only", "semantic"]).optional(),
+    precision: z.string().min(1).optional(),
+    sourceRefs: z.array(sourceRefSchema).default([]),
+}).strict();
 const errorCaseSchema = z.object({
     status: z.number().int().min(400).max(599).optional(),
     code: z.string().min(1).optional(),
     messageField: z.string().min(1).optional(),
     description: z.string().min(1),
 }).strict();
-export const backendTestAnalysisContractSchema = z.object({
-    schemaVersion: z.literal(1),
-    sourceBinding: z.object({
-        taskId: z.string().min(1),
-        requirementPath: z.string().min(1),
-        requirementSha256: z.string().regex(/^[a-f0-9]{64}$/),
-        referencePaths: z.array(z.string().min(1)),
-        requirementIds: z.array(z.string().regex(/^(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*$/)),
-    }).strict(),
+const optionalEvidenceDescriptionSchema = z.object({
+    name: z.string().min(1).optional(),
+    description: z.string().min(1),
+    sourceRef: sourceRefSchema.optional(),
+}).strict();
+const sourceBindingSchema = z.object({
+    taskId: z.string().min(1),
+    requirementPath: z.string().min(1),
+    requirementSha256: z.string().regex(/^[a-f0-9]{64}$/),
+    referencePaths: z.array(z.string().min(1)),
+    requirementIds: z.array(z.string().regex(/^(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*$/)),
+}).strict();
+const commonShape = {
+    sourceBinding: sourceBindingSchema,
     acceptanceCriteria: z.array(z.object({
         id: z.string().regex(/^AC-[A-Z0-9]+(?:-[A-Z0-9]+)*$/),
         text: z.string().min(1),
         sourceRef: sourceRefSchema,
     }).strict()),
-    endpoints: z.array(z.object({
-        id: z.string().min(1),
-        method: z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]),
-        path: z.string().startsWith("/"),
-        requestFields: z.array(fieldSchema),
-        responseFields: z.array(fieldSchema),
-        successStatuses: z.array(z.number().int().min(100).max(399)),
-        errorCases: z.array(errorCaseSchema),
-    }).strict()),
     dataModels: z.array(z.object({ id: z.string().min(1), description: z.string().min(1), sourceRef: sourceRefSchema }).strict()),
     businessRules: z.array(z.object({ id: z.string().min(1), text: z.string().min(1), sourceRef: sourceRefSchema }).strict()),
     stateTransitions: z.array(z.object({ from: z.string().min(1), to: z.string().min(1), trigger: z.string().min(1), sourceRef: sourceRefSchema }).strict()),
     boundaryConstraints: z.array(z.object({ field: z.string().min(1), constraint: z.string().min(1), sourceRef: sourceRefSchema }).strict()),
-    externalDependencies: z.array(z.object({ name: z.string().min(1), description: z.string().min(1), sourceRef: sourceRefSchema.optional() }).strict()),
-    risks: z.array(z.object({ description: z.string().min(1), sourceRef: sourceRefSchema.optional() }).strict()),
+    externalDependencies: z.array(optionalEvidenceDescriptionSchema),
+    risks: z.array(optionalEvidenceDescriptionSchema),
     evidenceGaps: z.array(z.object({ description: z.string().min(1), requirementId: z.string().optional(), sourceRef: sourceRefSchema.optional() }).strict()),
+};
+const endpointBase = {
+    id: z.string().min(1),
+    method: z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]),
+    path: z.string().startsWith("/"),
+    successStatuses: z.array(z.number().int().min(100).max(399)),
+    errorCases: z.array(errorCaseSchema),
+};
+const analysisV1Schema = z.object({
+    schemaVersion: z.literal(1),
+    ...commonShape,
+    endpoints: z.array(z.object({
+        ...endpointBase,
+        requestFields: z.array(fieldV1Schema),
+        responseFields: z.array(fieldV1Schema),
+    }).strict()),
+}).strict();
+export const backendTestAnalysisContractSchema = z.object({
+    schemaVersion: z.literal(2),
+    ...commonShape,
+    endpoints: z.array(z.object({
+        ...endpointBase,
+        requestFields: z.array(fieldV2Schema),
+        responseFields: z.array(fieldV2Schema),
+        responseBody: z.object({
+            kind: z.enum(["array", "object", "scalar", "empty", "unknown"]),
+            itemSchemaRef: z.string().min(1).optional(),
+            ordering: z.enum(["specified", "unspecified", "not-applicable"]),
+            description: z.string().min(1).optional(),
+        }).strict(),
+        sourceRefs: z.array(sourceRefSchema),
+    }).strict()),
 }).strict();
 const SECRET_KEY = /(?:password|passwd|secret|token|api[_-]?key|private[_-]?key|credential|authorization)/i;
 const SECRET_VALUE = /(?:-----BEGIN [A-Z ]*PRIVATE KEY-----|\b(?:sk|ghp|github_pat|xox[baprs]|AKIA)[-_A-Za-z0-9]{12,}\b)/;
@@ -74,13 +108,32 @@ export function extractStrictJsonObject(text) {
     }
     return JSON.parse(blocks[0][1]);
 }
+function normalizeAnalysis(value) {
+    const v2 = backendTestAnalysisContractSchema.safeParse(value);
+    if (v2.success)
+        return v2.data;
+    const v1 = analysisV1Schema.safeParse(value);
+    if (!v1.success) {
+        throw new Error(v2.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; "));
+    }
+    return backendTestAnalysisContractSchema.parse({
+        ...v1.data,
+        schemaVersion: 2,
+        endpoints: v1.data.endpoints.map((endpoint) => ({
+            ...endpoint,
+            requestFields: endpoint.requestFields.map((field) => ({ ...field, sourceRefs: [] })),
+            responseFields: endpoint.responseFields.map((field) => ({ ...field, sourceRefs: [] })),
+            responseBody: { kind: "unknown", ordering: "unspecified" },
+            sourceRefs: [],
+        })),
+    });
+}
 function assertSourceBinding(contract, binding) {
     const requirement = binding.sources.find((source) => source.kind === "requirement");
     const references = binding.sources.filter((source) => source.kind === "reference").map((source) => source.path).sort();
     const actualReferences = [...contract.sourceBinding.referencePaths].sort();
-    if (!requirement || contract.sourceBinding.taskId !== binding.taskId || contract.sourceBinding.requirementPath !== requirement.path || contract.sourceBinding.requirementSha256 !== requirement.sha256) {
+    if (!requirement || contract.sourceBinding.taskId !== binding.taskId || contract.sourceBinding.requirementPath !== requirement.path || contract.sourceBinding.requirementSha256 !== requirement.sha256)
         throw new Error("analysis source binding does not match DAG requirement source");
-    }
     if (JSON.stringify(actualReferences) !== JSON.stringify(references))
         throw new Error("analysis referencePaths do not match DAG source binding");
     if (JSON.stringify(contract.sourceBinding.requirementIds) !== JSON.stringify(binding.requirementIds))
@@ -109,12 +162,16 @@ export async function materializeBackendTestAnalysisContract(input) {
     const secrets = secretIssues(parsed);
     if (secrets.length)
         throw new Error(`invalid-output: ${secrets.join("; ")}`);
-    const result = backendTestAnalysisContractSchema.safeParse(parsed);
-    if (!result.success)
-        throw new Error(`invalid-output: ${result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`);
-    assertSourceBinding(result.data, input.sourceBinding);
+    let result;
+    try {
+        result = normalizeAnalysis(parsed);
+    }
+    catch (error) {
+        throw new Error(`invalid-output: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    assertSourceBinding(result, input.sourceBinding);
     const relativePath = path.posix.join(input.outputDir, input.artifactName);
-    const artifactPath = await writeDagRunJsonArtifact(input.runDir, relativePath, result.data);
-    const normalized = `${JSON.stringify(result.data, null, 2)}\n`;
+    const artifactPath = await writeDagRunJsonArtifact(input.runDir, relativePath, result);
+    const normalized = `${JSON.stringify(result, null, 2)}\n`;
     return { path: artifactPath, sha256: createHash("sha256").update(normalized).digest("hex"), schemaId: BACKEND_TEST_ANALYSIS_SCHEMA_ID };
 }

package/dist/workflows/dag/backend-test-case-manifest.js

@@ -108,8 +108,10 @@ export const backendTestCaseManifestSchema = z
         plannedCount: z.number().int().min(0),
         skippedCount: z.number().int().min(0),
         unsupportedCount: z.number().int().min(0),
-        /** Deterministic fraction in [0,1]; model must not invent this. */
         acCoverageRatio: z.number().min(0).max(1),
+        global: z.object({ total: z.number().int().min(0), covered: z.number().int().min(0), gapped: z.number().int().min(0), ratio: z.number().min(0).max(1) }).strict().optional(),
+        inScope: z.object({ total: z.number().int().min(0), covered: z.number().int().min(0), gapped: z.number().int().min(0), ratio: z.number().min(0).max(1) }).strict().optional(),
+        crossDomainGapCount: z.number().int().min(0).optional(),
     })
         .strict()
         .optional(),
@@ -138,10 +140,17 @@ export function extractStrictJsonObject(text) {
         return JSON.parse(trimmed);
     }
     const blocks = [...trimmed.matchAll(/```json\s*\n([\s\S]*?)\n```/gi)];
-    if (blocks.length !== 1 || trimmed.replace(blocks[0][0], "").trim()) {
-        throw new Error("manifest output must be one pure JSON object or one fenced json block with no trailing text");
+    if (blocks.length !== 1) {
+        throw new Error("manifest output must contain exactly one fenced json block");
     }
-    return JSON.parse(blocks[0][1]);
+    // Writer nodes may summarize file changes before the manifest. The single
+    // fenced JSON block is authoritative; trailing text remains forbidden.
+    const last = blocks[0];
+    const trailing = trimmed.slice((last.index ?? 0) + last[0].length).trim();
+    if (trailing) {
+        throw new Error("manifest output must not contain trailing text after the final fenced json block");
+    }
+    return JSON.parse(last[1]);
 }
 function assertSourceBinding(manifest, binding) {
     const requirement = binding.sources.find((source) => source.kind === "requirement");
@@ -195,6 +204,14 @@ export function computeCaseManifestCoverageSummary(manifest) {
     const explicitAcCount = explicitAc.length;
     const coveredAcCount = coveredExplicit.length;
     const acCoverageRatio = explicitAcCount === 0 ? 1 : coveredAcCount / explicitAcCount;
+    const crossDomainAc = new Set(manifest.evidenceGaps
+        .filter((gap) => /(?:frontend|flyway|migration|mvn|browser|e2e|cross[- ]?domain)/i.test(gap.description))
+        .map((gap) => gap.acId)
+        .filter((id) => Boolean(id)));
+    const inScopeIds = explicitAc.filter((id) => !crossDomainAc.has(id));
+    const inScopeCovered = inScopeIds.filter((id) => covered.has(id)).length;
+    const inScopeGapped = inScopeIds.filter((id) => !covered.has(id) && gapped.has(id)).length;
+    const crossDomainGapCount = manifest.evidenceGaps.filter((gap) => /(?:frontend|flyway|migration|mvn|browser|e2e|cross[- ]?domain)/i.test(gap.description)).length;
     return {
         explicitAcCount,
         coveredAcCount,
@@ -202,6 +219,19 @@ export function computeCaseManifestCoverageSummary(manifest) {
         caseCount: manifest.cases.length,
         ...statusCounts,
         acCoverageRatio,
+        global: {
+            total: explicitAcCount,
+            covered: coveredAcCount,
+            gapped: gappedExplicit.length,
+            ratio: acCoverageRatio,
+        },
+        inScope: {
+            total: inScopeIds.length,
+            covered: inScopeCovered,
+            gapped: inScopeGapped,
+            ratio: inScopeIds.length === 0 ? 1 : inScopeCovered / inScopeIds.length,
+        },
+        crossDomainGapCount,
     };
 }
 export function assertBackendTestCaseManifestInvariants(manifest, binding) {
@@ -274,7 +304,10 @@ export function assertBackendTestCaseManifestInvariants(manifest, binding) {
         const expected = computeCaseManifestCoverageSummary(manifest);
         const actual = manifest.coverageSummary;
         for (const key of Object.keys(expected)) {
-            if (actual[key] !== expected[key]) {
+            const same = typeof expected[key] === "object"
+                ? JSON.stringify(actual[key]) === JSON.stringify(expected[key])
+                : actual[key] === expected[key];
+            if (!same) {
                 throw new Error(`coverageSummary.${key} mismatch: expected ${String(expected[key])}, got ${String(actual[key])}`);
             }
         }
@@ -475,10 +508,40 @@ export async function assertBackendTestTraceability(input) {
     }
     return { ok: true, matched };
 }
-export async function runBackendTestTraceabilityGate(input) {
+export async function deriveBackendTestGeneratedManifest(input) {
     const relative = input.manifestRelativePath ?? "contracts/backend-test-case-manifest.json";
     const manifestPath = path.join(input.runDir, relative);
-    const raw = JSON.parse(await readFile(manifestPath, "utf8"));
+    const parsed = backendTestCaseManifestSchema.parse(JSON.parse(await readFile(manifestPath, "utf8")));
+    const hits = await discoverPytestSymbols(input.workspaceRoot, input.testRoot ?? "testcase");
+    const matched = [];
+    const cases = parsed.cases.map((item) => {
+        if (item.automationStatus === "skipped" || item.automationStatus === "unsupported")
+            return item;
+        const hit = hits.find((candidate) => symbolMatchesCase(candidate, item.caseId, item.symbol));
+        if (!hit)
+            return { ...item, automationStatus: "planned", file: undefined, symbol: undefined };
+        matched.push({ caseId: item.caseId, file: hit.file, symbol: hit.symbol });
+        return { ...item, automationStatus: "generated", file: hit.file, symbol: hit.symbol };
+    });
+    const derived = {
+        ...parsed,
+        cases,
+        coverageSummary: undefined,
+    };
+    derived.coverageSummary = computeCaseManifestCoverageSummary(derived);
+    assertBackendTestCaseManifestInvariants(derived);
+    await writeDagRunJsonArtifact(input.runDir, relative, derived);
+    return {
+        path: manifestPath,
+        generatedCount: derived.coverageSummary.generatedCount,
+        plannedCount: derived.coverageSummary.plannedCount,
+        matched,
+    };
+}
+export async function runBackendTestTraceabilityGate(input) {
+    const relative = input.manifestRelativePath ?? "contracts/backend-test-case-manifest.json";
+    const derived = await deriveBackendTestGeneratedManifest(input);
+    const raw = JSON.parse(await readFile(derived.path, "utf8"));
     const parsed = backendTestCaseManifestSchema.safeParse(raw);
     if (!parsed.success) {
         throw new Error(`traceability: invalid manifest: ${parsed.error.issues
@@ -494,7 +557,7 @@ export async function runBackendTestTraceabilityGate(input) {
     return {
         ok: true,
         matchedCount: result.matched.length,
-        manifestPath,
+        manifestPath: derived.path,
     };
 }
 /** Shell-friendly: build a one-liner that invokes node -e would be heavy; export for shell-executor special command. */

package/dist/workflows/dag/backend-test-execution-contract.js

@@ -31,9 +31,62 @@ const fixtureSchema = z
     kind: z.string().min(1),
 })
     .strict();
+/**
+ * HTTP URL path for service readiness probes (e.g. `/api/health`).
+ * Not a repository file path — do not reuse relativePosixPathSchema.
+ */
+export function normalizeHttpReadinessPath(value) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        throw new Error("readiness.path must be non-empty");
+    if (trimmed.includes("\\")) {
+        throw new Error("readiness.path must use posix separators");
+    }
+    // Windows treats paths starting with "/" as absolute; only reject drive-letter / UNC filesystem forms here.
+    if (/^[a-zA-Z]:/.test(trimmed) || /^[a-zA-Z]:[\\/]/.test(trimmed)) {
+        throw new Error("readiness.path must not be a filesystem absolute path");
+    }
+    if (trimmed.includes("://") || trimmed.startsWith("//")) {
+        throw new Error("readiness.path must be a URL path, not a full URL");
+    }
+    if (!trimmed.startsWith("/")) {
+        throw new Error("readiness.path must start with / (HTTP URL path)");
+    }
+    if (trimmed.includes("?") || trimmed.includes("#")) {
+        throw new Error("readiness.path must not include query or fragment");
+    }
+    const segments = trimmed.split("/");
+    // first segment is empty because path starts with /
+    for (const segment of segments.slice(1)) {
+        if (segment === "..")
+            throw new Error("readiness.path traversal is forbidden");
+        if (segment === ".")
+            throw new Error("readiness.path must not contain '.' segments");
+    }
+    // collapse duplicate slashes except keep single leading /
+    const body = segments
+        .slice(1)
+        .filter((part) => part !== "")
+        .join("/");
+    return body ? `/${body}` : "/";
+}
+const httpReadinessPathSchema = z
+    .string()
+    .min(1)
+    .refine((value) => {
+    try {
+        normalizeHttpReadinessPath(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}, {
+    message: "readiness.path must be an HTTP URL path (e.g. /api/health), not a repo-relative file path",
+});
 const readinessSchema = z
     .object({
-    path: relativePosixPathSchema,
+    path: httpReadinessPathSchema,
     description: z.string().min(1),
 })
     .strict();
@@ -194,7 +247,7 @@ function normalizeContractPaths(contract) {
         })),
         readiness: readiness.map((item) => ({
             ...item,
-            path: normalizeRelativePosixPath(item.path),
+            path: normalizeHttpReadinessPath(item.path),
         })),
         requiredEnvNames,
         evidenceGaps,
@@ -258,12 +311,11 @@ export function assertBackendTestExecutionPreflight(input) {
             errors.push("managed-command is fail-closed without managedCommand.sourceRef task-source evidence");
         }
     }
-    if ((contract.evidenceGaps?.length ?? 0) > 0) {
-        errors.push(`execution contract has ${contract.evidenceGaps.length} evidenceGaps; fail-closed before writer/execute`);
-    }
+    // evidenceGaps are informational for greenfield backend-test (generate may fill
+    // missing test_*.py later). Hard env/targetMode/fixture checks remain below.
     if (contract.targetMode === "in-process" &&
         (contract.existingFixtures?.length ?? 0) === 0) {
-        errors.push("in-process targetMode requires at least one existingFixtures entry (or record evidenceGaps)");
+        errors.push("in-process targetMode requires at least one existingFixtures entry");
     }
     return {
         ok: errors.length === 0,
@@ -298,10 +350,11 @@ export async function materializeBackendTestExecutionContract(input) {
             .join("; ")}`);
     }
     const normalized = normalizeContractPaths(result.data);
-    // Incomplete discovery must not become a green gate that unblocks pytest writers.
-    if ((normalized.evidenceGaps?.length ?? 0) > 0) {
-        throw new Error(`invalid-output: evidenceGaps present (${normalized.evidenceGaps.length}); fail-closed until scout resolves gaps or records an explicit alternate contract`);
-    }
+    // evidenceGaps may record greenfield/incomplete discovery (no test_*.py yet,
+    // missing pytest.ini, projected schema path, etc.). Do not block materialize:
+    // generate-functional-cases / generate-pytest are expected to fill automation.
+    // Hard fail-closed remains: schema/secrets, in-process fixtures, managed sourceRef
+    // (schema superRefine), and execute preflight env/targetMode checks.
     if (normalized.targetMode === "in-process" &&
         (normalized.existingFixtures?.length ?? 0) === 0) {
         throw new Error("invalid-output: in-process targetMode requires existingFixtures evidence");
@@ -335,7 +388,6 @@ export function buildBackendTestExecutionPreflightShellSnippet(options) {
         `if(testRoot.replace(/\\/+$/,"")!==expected.replace(/\\/+$/,"")) errors.push("testRoot mismatch vs frozen command: "+testRoot+" !== "+expected);`,
         `const rootAbs=path.resolve(process.cwd(),testRoot);`,
         `if(!fs.existsSync(rootAbs)) errors.push("testRoot does not exist: "+testRoot);`,
-        `if(Array.isArray(contract.evidenceGaps)&&contract.evidenceGaps.length) errors.push("evidenceGaps present: "+contract.evidenceGaps.length);`,
         `if(contract.targetMode==="in-process"&&!(Array.isArray(contract.existingFixtures)&&contract.existingFixtures.length)) errors.push("in-process requires existingFixtures");`,
         `for (const name of (contract.requiredEnvNames||[])) { if(!process.env[name]) errors.push("required env missing: "+name); }`,
         `if(contract.targetMode==="external-running-service"){ const n=contract.baseUrlEnvName; if(!n||!process.env[n]) errors.push("external base URL env missing: "+String(n||"<empty>")); }`,

package/dist/workflows/dag/backend-test-repair-contract.js

@@ -0,0 +1,94 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { writeDagRunJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
+import { BACKEND_TEST_CLASSIFICATION_CATEGORIES, backendTestResultContractSchema, } from "./backend-test-result-contract.js";
+export const BACKEND_TEST_CLASSIFICATION_SCHEMA_ID = "backend-test-classification-v1";
+export const backendTestClassificationContractSchema = z
+    .object({
+    category: z.enum(BACKEND_TEST_CLASSIFICATION_CATEGORIES),
+    evidence: z.array(z.string().min(1)).min(1),
+    confidence: z.number().min(0).max(1),
+    notes: z.string().min(1),
+})
+    .strict();
+function extractJsonObject(text) {
+    const trimmed = text.trim();
+    const fenced = trimmed.match(/^```json\s*([\s\S]*?)\s*```$/i);
+    return JSON.parse(fenced ? fenced[1] : trimmed);
+}
+export async function materializeBackendTestClassification(input) {
+    const wrapperPath = path.join(input.runDir, `${input.fromNodeId}.json`);
+    const wrapper = JSON.parse(await readFile(wrapperPath, "utf8"));
+    const raw = wrapper.assistantText?.trim() || wrapper.stdout?.trim() || "";
+    if (!raw)
+        throw new Error("backend-test classification output is empty");
+    const classification = backendTestClassificationContractSchema.parse(extractJsonObject(raw));
+    const relativePath = path.posix.join(input.outputDir, input.artifactName);
+    const artifactPath = await writeDagRunJsonArtifact(input.runDir, relativePath, classification);
+    const serialized = `${JSON.stringify(classification, null, 2)}\n`;
+    return {
+        path: artifactPath,
+        sha256: createHash("sha256").update(serialized).digest("hex"),
+        schemaId: BACKEND_TEST_CLASSIFICATION_SCHEMA_ID,
+    };
+}
+export function assessBackendTestRepairEligibility(input) {
+    const result = backendTestResultContractSchema.parse(input.result);
+    const classification = backendTestClassificationContractSchema.parse(input.classification);
+    const attempt = input.revisionAttempt ?? 0;
+    let reason = "eligible TestBug assertion failure";
+    let eligible = true;
+    if (attempt !== 0) {
+        eligible = false;
+        reason = "repair attempt already consumed";
+    }
+    else if (classification.category !== "TestBug") {
+        eligible = false;
+        reason = `classification ${classification.category} is not TestBug`;
+    }
+    else if (classification.confidence < 0.7) {
+        eligible = false;
+        reason = "TestBug confidence is below 0.7";
+    }
+    else if (result.executionStatus !== "completed" ||
+        result.outcome !== "completed-with-failures") {
+        eligible = false;
+        reason = "initial pytest did not complete with assertion failures";
+    }
+    else if (result.failed <= 0 || result.error !== 0) {
+        eligible = false;
+        reason = "repair requires failed>0 and error=0";
+    }
+    else if (result.failures.length === 0) {
+        eligible = false;
+        reason = "repair requires concrete failure summaries";
+    }
+    return {
+        schemaVersion: 1,
+        eligible,
+        reason,
+        revisionAttempt: attempt === 0 ? 0 : 1,
+        category: classification.category,
+        confidence: classification.confidence,
+    };
+}
+export function buildBackendTestRepairEligibilityShellSnippet() {
+    return [
+        'test -n "${HARNESS_DAG_RUN_DIR:-}" || { echo "missing HARNESS_DAG_RUN_DIR for backend-test repair eligibility" >&2; exit 2; }',
+        `node -e 'const fs=require("fs"),path=require("path");const root=process.env.HARNESS_DAG_RUN_DIR;const r=JSON.parse(fs.readFileSync(path.join(root,"contracts","backend-test-result-initial.json"),"utf8"));const c=JSON.parse(fs.readFileSync(path.join(root,"contracts","backend-test-classification.json"),"utf8"));let eligible=true,reason="eligible TestBug assertion failure";if(c.category!=="TestBug"){eligible=false;reason="classification "+c.category+" is not TestBug";}else if(Number(c.confidence)<0.7){eligible=false;reason="TestBug confidence is below 0.7";}else if(r.executionStatus!=="completed"||r.outcome!=="completed-with-failures"){eligible=false;reason="initial pytest did not complete with assertion failures";}else if(Number(r.failed)<=0||Number(r.error)!==0){eligible=false;reason="repair requires failed>0 and error=0";}else if(!Array.isArray(r.failures)||r.failures.length===0){eligible=false;reason="repair requires concrete failure summaries";}const out={schemaVersion:1,eligible,reason,revisionAttempt:0,category:c.category,confidence:c.confidence};fs.writeFileSync(path.join(root,"contracts","backend-test-repair-eligibility.json"),JSON.stringify(out,null,2)+"\\n");process.stdout.write(JSON.stringify(out));'`,
+    ].join("; ");
+}
+export function buildBackendTestEffectiveResultSelectorShellSnippet() {
+    return [
+        'test -n "${HARNESS_DAG_RUN_DIR:-}" || { echo "missing HARNESS_DAG_RUN_DIR for backend-test effective result" >&2; exit 2; }',
+        `node -e 'const fs=require("fs"),path=require("path"),crypto=require("crypto");const root=process.env.HARNESS_DAG_RUN_DIR;const contracts=path.join(root,"contracts");const finalPath=path.join(contracts,"backend-test-result-final.json");const initialPath=path.join(contracts,"backend-test-result-initial.json");const source=fs.existsSync(finalPath)?finalPath:initialPath;if(!fs.existsSync(source))throw new Error("missing initial/final backend-test result");const result=JSON.parse(fs.readFileSync(source,"utf8"));const target=path.join(contracts,"backend-test-result.json");const body=JSON.stringify(result,null,2)+"\\n";fs.writeFileSync(target,body);process.stdout.write(JSON.stringify({effectiveResult:path.basename(source),revisionAttempt:fs.existsSync(finalPath)?1:0,outcome:result.outcome,sha256:crypto.createHash("sha256").update(body).digest("hex")}));'`,
+    ].join("; ");
+}
+export function buildBackendTestRepairSafetyShellSnippet() {
+    return [
+        'test -d testcase || { echo "missing testcase directory after TestBug repair" >&2; exit 1; }',
+        `node -e 'const fs=require("fs"),path=require("path");const root="testcase";const bad=[];function walk(p){for(const e of fs.readdirSync(p,{withFileTypes:true})){const f=path.join(p,e.name);if(e.isDirectory())walk(f);else if(/\\.py$/.test(e.name)){const s=fs.readFileSync(f,"utf8");if(/@pytest\\.mark\\.(?:skip|skipif|xfail)\\b|pytest\\.(?:skip|xfail)\\s*\\(/.test(s))bad.push(f+": skip/xfail is forbidden in automatic repair");if(/except\\s+(?:AssertionError|Exception|BaseException)\\s*:\\s*(?:pass|return)\\b/.test(s))bad.push(f+": broad failure swallowing is forbidden");}}}walk(root);if(bad.length){console.error(bad.join("\\n"));process.exit(1);}console.log("backend-test repair safety gate: pass");'`,
+    ].join("; ");
+}

package/dist/workflows/dag/backend-test-result-contract.js

@@ -479,8 +479,8 @@ export function classifyCategoryHints(result) {
         confidenceCap: 0.75,
     };
 }
-async function readPytestExitCode(runDir, fromNodeId) {
-    const exitPath = path.join(runDir, "reports", "backend-test-pytest-exit.txt");
+async function readPytestExitCode(runDir, fromNodeId, exitRelativePath = "reports/backend-test-pytest-exit.txt") {
+    const exitPath = path.join(runDir, ...exitRelativePath.split("/"));
     try {
         const raw = (await readFile(exitPath, "utf8")).trim();
         const code = Number(raw);
@@ -531,8 +531,10 @@ export async function materializeBackendTestResultFromRunDir(input) {
     if (!junitXml.trim()) {
         throw new Error("invalid junit xml: empty report");
     }
-    const pytestExitCode = await readPytestExitCode(input.runDir, input.fromNodeId);
-    const commandSummary = "PYTHONDONTWRITEBYTECODE=1 python -m pytest testcase/ -v -p no:cacheprovider --junitxml=reports/backend-test-junit.xml";
+    const pytestExitCode = await readPytestExitCode(input.runDir, input.fromNodeId, input.junitRelativePath?.endsWith("-junit.xml")
+        ? input.junitRelativePath.replace(/-junit\.xml$/, "-pytest-exit.txt")
+        : "reports/backend-test-pytest-exit.txt");
+    const commandSummary = `PYTHONUTF8=1 PYTHONIOENCODING=utf-8 PYTHONDONTWRITEBYTECODE=1 python -m pytest testcase/ -v -p no:cacheprovider --junitxml=${junitRelativePath}`;
     let result;
     try {
         result = deriveBackendTestResult({

package/dist/workflows/dag/backend-test-semantic-review-contract.js

@@ -0,0 +1,36 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { writeDagRunJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
+export const BACKEND_TEST_SEMANTIC_REVIEW_SCHEMA_ID = "backend-test-semantic-review-v1";
+export const backendTestSemanticReviewSchema = z.object({
+    verdict: z.enum(["pass", "request-revision"]),
+    findings: z.array(z.object({
+        severity: z.enum(["Critical", "Important", "Informational"]),
+        caseId: z.string().regex(/^BE-[A-Z0-9]+(?:-[A-Z0-9]+)*-\d{3}$/),
+        testFile: z.string().min(1),
+        testSymbol: z.string().min(1),
+        contractRefs: z.array(z.string().min(1)).min(1),
+        issue: z.string().min(1),
+        requiredChange: z.string().min(1),
+    })).default([]),
+    summary: z.string().min(1),
+}).strict().superRefine((value, ctx) => {
+    if (value.verdict === "pass" && value.findings.some((item) => item.severity === "Critical")) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "pass verdict cannot contain Critical findings", path: ["verdict"] });
+    }
+    if (value.verdict === "request-revision" && value.findings.length === 0) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "request-revision requires findings", path: ["findings"] });
+    }
+});
+export async function materializeBackendTestSemanticReview(input) {
+    const wrapper = JSON.parse(await readFile(path.join(input.runDir, `${input.fromNodeId}.json`), "utf8"));
+    const raw = wrapper.assistantText?.trim() || wrapper.stdout?.trim() || "";
+    const fenced = raw.match(/^```json\s*([\s\S]*?)\s*```$/i);
+    const parsed = backendTestSemanticReviewSchema.parse(JSON.parse(fenced ? fenced[1] : raw));
+    const relativePath = path.posix.join(input.outputDir, input.artifactName);
+    const artifactPath = await writeDagRunJsonArtifact(input.runDir, relativePath, parsed);
+    const normalized = `${JSON.stringify(parsed, null, 2)}\n`;
+    return { path: artifactPath, sha256: createHash("sha256").update(normalized).digest("hex"), schemaId: BACKEND_TEST_SEMANTIC_REVIEW_SCHEMA_ID };
+}

package/dist/workflows/dag/dynamic-runtime/condition.js

@@ -1,5 +1,5 @@
 import { parseConditionLiteral, resolveOutputSelector } from "./shared.js";
-function evaluateConditionExpression(expression, state) {
+export function evaluateConditionExpression(expression, state) {
     const equality = expression.match(/^\s*(\$\..+?)\s*==\s*(.+?)\s*$/);
     if (!equality?.[1]) {
         throw new Error(`unsupported condition expression: ${expression}`);

package/dist/workflows/dag/dynamic-runtime/shared.js

@@ -28,7 +28,49 @@ export function getNodeOutputAsJson(state, nodeId) {
         throw new Error(`itemsFrom upstream node "${nodeId}" output is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
+/** Normalize a line the same way verdict gates do (strip whole-line Markdown emphasis). */
+export function normalizeVerdictCandidateLine(value) {
+    const trimmed = String(value).trim();
+    const emphasized = trimmed.match(/^\*{1,3}\s*(VERDICT:[^*]+?)\s*\*{1,3}$/);
+    return (emphasized ? emphasized[1] : trimmed).trim();
+}
+/** First line matching /^VERDICT:/ from node assistantText/stdout (markdown emphasis OK). */
+export function extractFirstVerdictLineFromNodeText(text) {
+    for (const line of String(text).split(/\r?\n/)) {
+        const normalized = normalizeVerdictCandidateLine(line);
+        if (/^VERDICT:/.test(normalized))
+            return normalized;
+    }
+    return "";
+}
+function getNodeRawText(state, nodeId) {
+    const record = state.nodes[nodeId];
+    if (!record || record.status !== "FINISHED") {
+        throw new Error(`selector upstream node "${nodeId}" is not finished`);
+    }
+    return record.assistantText?.trim() || record.stdout?.trim() || "";
+}
 export function resolveOutputSelector(selector, state) {
+    const firstVerdictMatch = selector.match(/^\$\.nodes\[['"]([^'"]+)['"]\]\.firstVerdictLine\s*$/);
+    if (firstVerdictMatch?.[1]) {
+        const nodeId = firstVerdictMatch[1];
+        return extractFirstVerdictLineFromNodeText(getNodeRawText(state, nodeId));
+    }
+    const jsonFieldMatch = selector.match(/^\$\.nodes\[['"]([^'"]+)['"]\]\.json\.([A-Za-z0-9_.-]+)\s*$/);
+    if (jsonFieldMatch?.[1] && jsonFieldMatch[2]) {
+        let current = parseJsonFromText(getNodeRawText(state, jsonFieldMatch[1]));
+        if (current === undefined) {
+            throw new Error(`selector upstream node "${jsonFieldMatch[1]}" output is not valid JSON`);
+        }
+        for (const segment of jsonFieldMatch[2].split(".")) {
+            if (current && typeof current === "object" && segment in current) {
+                current = current[segment];
+                continue;
+            }
+            throw new Error(`output selector path not found: ${selector} (missing "${segment}")`);
+        }
+        return current;
+    }
     const match = selector.match(/^\$\.nodes\[['"]([^'"]+)['"]\]\.output(?:\.(.+))?$/);
     if (!match?.[1]) {
         throw new Error(`unsupported itemsFrom selector: ${selector}`);

package/dist/workflows/dag/failure-routing.js

@@ -86,7 +86,7 @@ function routeToProductLine(input) {
     }
 }
 export function routeDagFailure(input) {
-    const productLineFailureCategory = routeToProductLine(input);
+    const productLineFailureCategory = input.productLineFailureCategory ?? routeToProductLine(input);
     if (!productLineFailureCategory)
         return {};
     const recommendedFollowUp = productLineFailureCategory === "ContractMismatch" &&