@tea-agent/loop-agent 0.16.15-beta.0 → 0.16.16

package/CHANGELOG.md

@@ -4,11 +4,15 @@
 
 ### 改进
 
+- 前端浏览器测试 DAG 的复盘报告现写入 `testcase/frontend/reports/**`，不再要求 `docs/test-reports/**` 权限；任务执行约束可以安全禁止整个 `docs/**`，同时仍保留可审计的测试资产。
+- `frontend-test` 结果链新增 run-owned `frontend-test-result-v1`、单次用例修订与终审门禁；只有所有浏览器用例和 AC 覆盖通过且结果合同明确为 real/pass 时，Worker 才会投影真实集成。
+
 - 后端测试 DAG 从 38 个收敛为 24 个真实顶层节点；使用 fail-closed `runIf` 和复合 Shell capability 减少调度，同时保留双合同、Manifest、语义评审、JUnit、Result、分类、修复安全、追踪和最终 outcome 证据。三条可选修订/修复分支仍各最多执行一次。
 - Backend Test Analysis、Case Manifest、Semantic Review 与 Classification 的严格 JSON 契约进一步对齐，生成和修订节点明确字段白名单、`sourceBinding` 与 evidence gap 约束，避免模型自定义字段导致确定性门禁失败。
 
 ### 修复
 
+- `frontend-test` 的 case review 现在是 fail-closed browser gate：只有 `VERDICT: pass` 才能物化 manifest 并启动动态 browser map；生成的 case 固定使用默认 browser session，要求每个子场景的 fixture/UI reset 和 fresh snapshot，并由确定性节点校验每个 case 的 `execution.md`、`case-result.json`、`caseId`、`status`、`evidencePaths` 及 blocked `blockedReason`。
 - 前端实现计划/修订节点会注入当前包内权威 `frontend-implementation-contract-v1` Schema 与固定 source binding，避免模型猜测字段导致契约门禁失败。
 - 前端 Mock 策略节点的 canonical 输出会把首条 `MOCK_STRATEGY:` 协议行提升为第一行，避免解释性前言触发 `first-non-empty` 门禁误判。
 - 前端规范回退目录统一为本地 `openspec/`，DAG 能力发现、提示词、Skill 与验证证据检查不再查找大小写不一致的旧目录名。
@@ -18,6 +22,60 @@
 - Pi SDK 执行长推理或大段结构化输出时不再把高频流式增量事件无界累积到内存；同一响应在多个生命周期事件中重复出现的 Token 用量只统计一次，避免 `Invalid string length` 和成本数据虚高。
 - 后端测试复合执行节点继续保持 clean environment、失败分类和 fail-closed outcome，并为 initial/final Result、repair eligibility、traceability 与 Observe 投影保留结构化运行证据。
 
+## [0.16.16] - 2026-07-20
+
+### 修复
+
+- 动态 DAG `itemsFrom` / JSON 选择器从 shell 节点 stdout 解析时，可跳过命令回显行并提取末尾 JSON 对象，避免 frontend-test `execute-frontend-cases-map` 在 materialize 门成功后仍因 `$ node -e ...` 前缀失败。
+
+## [0.16.15] - 2026-07-20
+
+### 修复
+
+- frontend-test case manifest 校验接受 `evidenceDir` 为 `testcase/frontend/evidence/<caseId>` 目录根（不必强制尾斜杠/子路径），避免生成节点写出合法目录后被 materialize 门误杀。
+
+## [0.16.14] - 2026-07-20
+
+### 修复
+
+- `frontend-test` materialize / path audit 自动并入 `testcase/frontend/**` 与 `docs/test-reports/**`，与 hybrid frontend-test DAG 生成约束对齐，避免 TaskSpec 仅声明 `tests/e2e/**` 时 `dag run-task` 直接失败。
+
+## [0.16.13] - 2026-07-20
+
+### 修复
+
+- backend-test 的 `finalize-effective-result` 管道在节点完成后绑定 `contracts/backend-test-result.json` 为 structured artifact，使 Outcome 投影出 `backend-test-result`，解除 FE-TEST Ready Planner 对 BE-TEST 产物门的误阻断。
+
+## [0.16.12] - 2026-07-20
+
+### 修复
+
+- `backend-test` materialize / Git checkpoint 自动并入 `testcase/**`（与 `docs/test-reports/**`）运行时写根，避免 TaskSpec 仍写 `tests/api/**` 时绿跑无法 promote、任务卡在 Running。
+
+## [0.16.11] - 2026-07-20
+
+### 修复
+
+- Worker 报告决策不再把条件分支的 `SKIPPED` 节点当成失败；backend-test 等混合 DAG 在 revise/repair 未选中时，只要 ERROR 不存在且 run finished，即可 `report-completed` 并进入 Outcome/promote。
+
+## [0.16.10] - 2026-07-20
+
+### 修复
+
+- 后端测试执行合同物化会清理 `managedCommand` 中的空字符串（如 `stop: ""`），避免 near-schema 侦察输出在 strict parse 下误拦 in-process BE-TEST。
+
+## [0.16.9] - 2026-07-20
+
+### 修复
+
+- Outcome 结构化产物声明不再绑定节点 mint-time sha256；同一路径若被后续 gate（如 backend-test traceability）就地改写，投影时以磁盘重算 hash 为准，消除 BE-TEST 完成态仍被 `artifact sha256 mismatch` 误拦。
+
+## [0.16.8] - 2026-07-20
+
+### 修复
+
+- Outcome 投影对同一 run-owned 结构化产物路径的多次 rewrite（如 backend-test case manifest initial→final）只保留最后一次 hash 声明，避免 `artifact sha256 mismatch` 误拦已完成的 BE-TEST。
+
 ## [0.16.7] - 2026-07-20
 
 ### 修复

package/dist/executors/pi-executor.js

@@ -186,10 +186,6 @@ function resolvePiCliPath() {
         path.join(nvmBase, nodeVersion, 'lib', 'node_modules'),
     ].flatMap((nodeModulesRoot) => PI_CLI_PACKAGE_NAMES.map((packageName) => piCliPathFromPackageRoot(nodeModulesRoot, packageName)));
     const otherCandidates = [
-        // Prefer the project-local Pi dependency. `npm run` adds node_modules/.bin
-        // to PATH, but direct invocations from the DAG runner may not, so resolve
-        // the package from the current workspace explicitly.
-        ...PI_CLI_PACKAGE_NAMES.map((packageName) => piCliPathFromPackageRoot(path.resolve(process.cwd(), 'node_modules'), packageName)),
         // Global npm installation (non-nvm)
         ...PI_CLI_PACKAGE_NAMES.map((packageName) => piCliPathFromPackageRoot('/usr/local/lib/node_modules', packageName)),
         // Bun installation

package/dist/executors/shell-executor.js

@@ -7,6 +7,7 @@ import { truncateOutput } from "../shared/output-truncation.js";
 import { buildRequirementCoverageGateShellCommand, expandShellPreset, buildVerdictGateShellCommand, } from "./shell-presets.js";
 import { materializeBackendTestAnalysisContract } from "../workflows/dag/backend-test-analysis-contract.js";
 import { materializeFrontendImplementationContract } from "../workflows/dag/frontend-implementation-contract.js";
+import { materializeFrontendTestResult, } from "../workflows/dag/frontend-test-result-contract.js";
 import { formatFrontendVerificationTraceStdout, runFrontendVerificationTraceGate, } from "../workflows/dag/frontend-verification-trace.js";
 import { formatFrontendWorktreeDiffStdout, runFrontendWorktreeDiffGate, } from "../workflows/dag/frontend-worktree-diff.js";
 import { formatFrontendFailureAssessStdout, formatFrontendRepairContractStdout, runFrontendFailureAssessGate, runFrontendRepairContractGate, } from "../workflows/dag/frontend-repair.js";
@@ -544,6 +545,15 @@ export async function executeDagShellNode(input, meta) {
                         sourceBinding: meta.spec.sourceBinding,
                     });
                     break;
+                case "frontend-test-result-v1":
+                    artifact = await materializeFrontendTestResult({
+                        runDir: meta.runDir,
+                        workspaceRoot: input.cwd,
+                        artifactName: gate.artifactName,
+                        outputDir: gate.outputDir,
+                        sourceBinding: meta.spec.sourceBinding,
+                    });
+                    break;
                 default:
                     throw new Error(`unsupported jsonArtifactGate.schemaId: ${String(gate.schemaId)}`);
             }

package/dist/worker/delivery/git-transaction.js

@@ -6,6 +6,8 @@ import path from "node:path";
 import { z } from "zod";
 import { getTaskPoolRoot } from "../pool/run-store.js";
 import { assertSafeRuntimeId } from "../follow-up/paths.js";
+import { expandAllowedPathsForWorkflow } from "../materialize/harness-task-materializer.js";
+import { resolveWorkflow } from "../task-spec/workflow-routing.js";
 const execFileAsync = promisify(execFile);
 const checkpointSchema = z.object({
     taskId: z.string().min(1),
@@ -275,13 +277,14 @@ function auditChangedPaths(changes, taskSpec) {
         throw new Error(audit.violations[0]);
 }
 function auditChangedPathsReport(changes, taskSpec) {
+    const allowedPaths = expandAllowedPathsForWorkflow(resolveWorkflow(taskSpec).workflow, taskSpec.constraints.allowed_paths);
     const violations = [];
     for (const changed of changes) {
         if (/(^|\/)(\.env(?:\.|$)|[^/]*\.(?:pem|key|p12|pfx))$/i.test(changed))
             violations.push(`changed path may contain sensitive material: ${changed}`);
         else if (taskSpec.constraints.forbidden_paths.some((glob) => matchesGlob(changed, glob)))
             violations.push(`changed path is forbidden for ${taskSpec.id}: ${changed}`);
-        else if (!taskSpec.constraints.allowed_paths.some((glob) => matchesGlob(changed, glob)))
+        else if (!allowedPaths.some((glob) => matchesGlob(changed, glob)))
             violations.push(`changed path is outside allowed_paths for ${taskSpec.id}: ${changed}`);
     }
     return { ok: violations.length === 0, violations };

package/dist/worker/materialize/harness-task-materializer.js

@@ -34,13 +34,17 @@ export async function materializeTaskSpec(options) {
     }
     const paths = getTaskPaths(options.repoRoot, harnessTaskId);
     const baseConfig = await loadTaskConfig(options.repoRoot, harnessTaskId);
+    // backend-test hybrid DAG writes under testcase/** (pytest + md cases + helpers).
+    // TaskSpecs often list legacy tests/api/** surfaces; union runtime write roots so
+    // git checkpoint / path guard can promote green BE-TEST runs.
+    const allowedPaths = expandAllowedPathsForWorkflow(resolvedWorkflow.workflow, options.taskSpec.constraints.allowed_paths);
     const taskConfig = {
         ...baseConfig,
         taskId: harnessTaskId,
         title: options.taskSpec.title,
         taskKind: resolvedWorkflow.taskKind,
         featureId: options.taskSpec.feature_id,
-        allowedPaths: options.taskSpec.constraints.allowed_paths,
+        allowedPaths,
         forbiddenPaths: options.taskSpec.constraints.forbidden_paths,
         hardConstraints: options.taskSpec.constraints.hard_constraints,
         complexity: mapRiskLevelToComplexity(options.taskSpec.risk_level),
@@ -312,6 +316,15 @@ function bulletLines(values) {
         return ["- None"];
     return values.map((value) => `- ${value}`);
 }
+/** Union TaskSpec allowed_paths with workflow-owned write roots. */
+export function expandAllowedPathsForWorkflow(workflow, allowedPaths) {
+    const extras = workflow === "backend-test"
+        ? ["testcase/**", "docs/test-reports/**"]
+        : workflow === "frontend-test"
+            ? ["testcase/frontend/**", "docs/test-reports/**"]
+            : [];
+    return Array.from(new Set([...allowedPaths, ...extras]));
+}
 async function loadExistingTaskConfig(repoRoot, taskId) {
     try {
         return await loadTaskConfig(repoRoot, taskId);

package/dist/worker/outcomes/adapters.js

@@ -39,21 +39,29 @@ function toRepoRelativePath(repoRoot, candidate) {
 function structuredArtifactsFromReport(run) {
     if (!run?.nodes)
         return [];
-    const artifacts = [];
+    // Multiple gates may rewrite the same run-owned path (e.g. backend-test
+    // case manifest initial → final). Keep the last claim in report node order
+    // so projector validates against the file on disk after all rewrites.
+    const byPath = new Map();
     for (const node of run.nodes) {
-        if (node.structuredArtifactPath &&
-            node.structuredArtifactSha256 &&
-            node.structuredArtifactSchemaId) {
-            const identity = splitStructuredArtifactIdentity(node.structuredArtifactSchemaId);
-            artifacts.push({
-                path: node.structuredArtifactPath,
-                sha256: node.structuredArtifactSha256,
-                kind: identity.kind,
-                schemaId: identity.schemaId,
-            });
+        if (!node.structuredArtifactPath ||
+            !node.structuredArtifactSha256 ||
+            !node.structuredArtifactSchemaId) {
+            continue;
         }
+        const identity = splitStructuredArtifactIdentity(node.structuredArtifactSchemaId);
+        const pathKey = node.structuredArtifactPath.replace(/\\/g, "/");
+        // Leave sha256 empty: later DAG nodes (e.g. backend-test traceability)
+        // may rewrite the same run-owned path in place, invalidating the mint-time
+        // structuredArtifactSha256. Projector re-hashes the file on disk.
+        byPath.set(pathKey, {
+            path: pathKey,
+            sha256: "",
+            kind: identity.kind,
+            schemaId: identity.schemaId,
+        });
     }
-    return artifacts;
+    return Array.from(byPath.values());
 }
 /**
  * `agent-dag` — the default standard agent DAG. No dedicated test/integration
@@ -116,12 +124,13 @@ class BackendTestAdapter {
 class FrontendTestAdapter {
     workflow = "frontend-test";
     project(input) {
-        const real = input.reportDecision.succeeded;
+        const structured = structuredArtifactsFromReport(input.dagReportRun);
+        const result = structured.find((artifact) => artifact.kind === "frontend-test-result" && artifact.schemaId === "frontend-test-result-v1");
+        // The projector validates the bound hash on disk. Missing result evidence is
+        // intentionally not upgraded from DAG completion to real integration.
+        const real = input.reportDecision.succeeded && Boolean(result);
         return {
-            artifacts: [
-                ...canonicalArtifacts(input),
-                ...structuredArtifactsFromReport(input.dagReportRun),
-            ],
+            artifacts: [...canonicalArtifacts(input), ...structured],
             acceptanceCoverage: [...input.acceptanceRefs],
             integrationStatus: { mock: false, real },
         };

package/dist/worker/outcomes/projector.js

@@ -2,6 +2,7 @@ import path from "node:path";
 import { readFile, stat } from "node:fs/promises";
 import { sha256File } from "../pool/run-store.js";
 import { taskOutcomeEnvelopeV1Schema } from "./types.js";
+import { frontendTestResultContractSchema } from "../../workflows/dag/frontend-test-result-contract.js";
 import { getOutcomeAdapter } from "./adapters.js";
 import { isPathAllowedForTask, mergeOutcomeArtifacts, projectDeclaredPathArtifacts, } from "./declared-artifacts.js";
 /**
@@ -117,6 +118,26 @@ export async function projectOutcome(input) {
             ...(artifact.schemaId ? { schemaId: artifact.schemaId } : {}),
         });
     }
+    // A frontend-test success is meaningful only when its finalizer produced a
+    // hash-verified real/pass result. This check deliberately happens after the
+    // generic rehash so report metadata cannot forge integration evidence.
+    if (workflow === "frontend-test") {
+        const results = validatedArtifacts.filter((artifact) => artifact.kind === "frontend-test-result" &&
+            artifact.schemaId === "frontend-test-result-v1");
+        if (results.length !== 1) {
+            return contractError("frontend-test requires exactly one hash-bound frontend-test-result-v1 artifact", ["frontend-test-result-v1"]);
+        }
+        try {
+            const resultArtifact = results[0];
+            const result = frontendTestResultContractSchema.parse(JSON.parse(await readFile(path.resolve(input.repoRoot, resultArtifact.path), "utf-8")));
+            if (result.outcome !== "passed" || result.integrationMode !== "real") {
+                return contractError(`frontend-test result is not a real pass: outcome=${result.outcome} integrationMode=${result.integrationMode}`);
+            }
+        }
+        catch (error) {
+            return contractError(`invalid frontend-test-result-v1 artifact: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     // 5. Shell verification from report decision (exit-zero = report succeeded).
     const shellVerification = {
         exitZero: input.reportDecision.succeeded,

package/dist/worker/run-task/run-task.js

@@ -455,7 +455,8 @@ function isPathInside(root, target) {
     const relative = path.relative(root, target);
     return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
 }
-function decideFromReport(workerRunId, result) {
+/** Exported for unit tests: map DAG report JSON into Worker report decision. */
+export function decideFromReport(workerRunId, result) {
     if (!result.ok || !result.json) {
         return {
             succeeded: false,
@@ -473,11 +474,16 @@ function decideFromReport(workerRunId, result) {
     }
     const runStatus = readString(run, "status");
     const nodes = readObjectArray(run, "nodes");
+    // Condition-branch SKIPPED nodes are expected on green backend-test / hybrid
+    // paths (e.g. revise/repair not selected). Do not treat SKIPPED as failure.
+    // ERROR and non-success failureCategory on executed nodes still fail closed.
     const failedNode = nodes.find((node) => {
         const status = readString(node, "status");
         const failureCategory = readString(node, "failureCategory");
+        if (status === "SKIPPED") {
+            return false;
+        }
         return (status === "ERROR" ||
-            status === "SKIPPED" ||
             (Boolean(failureCategory) && failureCategory !== "success"));
     });
     if (runStatus !== "completed" && runStatus !== "finished") {

package/dist/workflows/dag/backend-test-execution-contract.js

@@ -334,22 +334,50 @@ function asRecord(value) {
  * Prefer exact schema payloads; otherwise map common discovery shapes onto the
  * pytest-centric runtime contract without inventing secrets or managed commands.
  */
+/** Drop empty managedCommand strings; omit block when not managed-command. */
+export function sanitizeBackendTestExecutionInput(value) {
+    const record = asRecord(value);
+    if (!record)
+        return value;
+    const next = { ...record };
+    const managed = asRecord(record.managedCommand);
+    if (!managed)
+        return next;
+    const cleaned = {};
+    for (const key of ["start", "stop", "sourceRef"]) {
+        const raw = managed[key];
+        if (typeof raw === "string" && raw.trim())
+            cleaned[key] = raw.trim();
+    }
+    if (next.targetMode === "managed-command") {
+        next.managedCommand = cleaned;
+    }
+    else if (Object.keys(cleaned).length === 0) {
+        delete next.managedCommand;
+    }
+    else {
+        // in-process / external: optional managedCommand must not carry empty strings
+        next.managedCommand = cleaned;
+    }
+    return next;
+}
 export function coerceBackendTestExecutionInput(value) {
-    const direct = backendTestExecutionContractSchema.safeParse(value);
+    const sanitized = sanitizeBackendTestExecutionInput(value);
+    const direct = backendTestExecutionContractSchema.safeParse(sanitized);
     if (direct.success)
         return direct.data;
-    const record = asRecord(value);
+    const record = asRecord(sanitized);
     if (!record)
-        return value;
+        return sanitized;
     // Near-schema payloads (string framework + runner + testRoot) must stay fail-closed.
     // Only free-form discovery envelopes are rewritten onto the pytest contract.
     const looksSchemaShaped = typeof record.framework === "string" &&
         asRecord(record.runner) !== null &&
         typeof record.testRoot === "string";
     if (looksSchemaShaped)
-        return value;
+        return sanitized;
     if (typeof record.framework === "string" && record.framework !== "pytest") {
-        return value;
+        return sanitized;
     }
     const frameworkObj = asRecord(record.framework);
     const discovered = asRecord(record.discoveredFixtures);
@@ -504,7 +532,10 @@ export async function materializeBackendTestExecutionContract(input) {
     catch (error) {
         throw new Error(`invalid-output: ${error instanceof Error ? error.message : String(error)}`);
     }
-    const candidates = [parsed, coerceBackendTestExecutionInput(parsed)];
+    const candidates = [
+        sanitizeBackendTestExecutionInput(parsed),
+        coerceBackendTestExecutionInput(parsed),
+    ];
     let accepted = null;
     let lastSchemaError = "invalid execution contract";
     let lastSecretError = "";

package/dist/workflows/dag/dynamic-runtime/map.js

@@ -1,4 +1,4 @@
-import { mkdir } from "node:fs/promises";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { writeDagRunJsonArtifact } from "../../../infrastructure/harness/artifact-store.js";
 import { executeDagNode, } from "../node-execution.js";
@@ -81,6 +81,28 @@ export function resolveRunLocalPath(runDir, ref, label) {
     }
     return resolved;
 }
+async function materializeTokenBudgetBlockedEvidence(input) {
+    if (!input.workspaceRef)
+        return;
+    const workspace = resolveRunLocalPath(input.cwd, input.workspaceRef, "workspaceRef");
+    await mkdir(workspace, { recursive: true });
+    const resultPath = path.join(workspace, "case-result.json");
+    const caseId = typeof input.item === "object" && input.item !== null &&
+        typeof input.item.caseId === "string"
+        ? input.item.caseId
+        : String(input.item);
+    try {
+        const existing = JSON.parse(await readFile(resultPath, "utf-8"));
+        if (existing.caseId === caseId &&
+            (existing.status === "passed" || existing.status === "failed" || existing.status === "blocked"))
+            return;
+    }
+    catch {
+        // Missing or malformed evidence is replaced only for a child that never started.
+    }
+    await writeFile(path.join(workspace, "execution.md"), `# ${caseId}\n\nStatus: blocked\n\nReason: token-budget-exhausted\n`, "utf-8");
+    await writeFile(resultPath, `${JSON.stringify({ caseId, status: "blocked", blockedReason: "token-budget-exhausted", evidencePaths: ["execution.md"] }, null, 2)}\n`, "utf-8");
+}
 export async function executeDynamicMapExpansion(input) {
     const started = Date.now();
     const items = resolveItemsFromSelector(input.expansion.itemsFrom, input.state);
@@ -195,6 +217,16 @@ export async function executeDynamicMapExpansion(input) {
                     }
                     continue;
                 }
+                try {
+                    await materializeTokenBudgetBlockedEvidence({
+                        cwd: input.cwd,
+                        workspaceRef: workspaceRefs[children.indexOf(remaining)],
+                        item: items[children.indexOf(remaining)],
+                    });
+                }
+                catch (error) {
+                    throw new Error(`failed to materialize token-budget blocked evidence for ${remaining.id}: ${error instanceof Error ? error.message : String(error)}`);
+                }
                 record.status = "SKIPPED";
                 record.stderr = "blocked: token-budget-exhausted";
                 if (!blockedChildren.some((entry) => entry.nodeId === remaining.id)) {

package/dist/workflows/dag/dynamic-runtime/shared.js

@@ -21,12 +21,10 @@ export function getNodeOutputAsJson(state, nodeId) {
     if (!raw) {
         throw new Error(`itemsFrom upstream node "${nodeId}" has no JSON output`);
     }
-    try {
-        return JSON.parse(raw);
-    }
-    catch (error) {
-        throw new Error(`itemsFrom upstream node "${nodeId}" output is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
-    }
+    const parsed = parseJsonFromText(raw);
+    if (parsed !== undefined)
+        return parsed;
+    throw new Error(`itemsFrom upstream node "${nodeId}" output is not valid JSON: ${raw.slice(0, 120)}`);
 }
 /** Normalize a line the same way verdict gates do (strip whole-line Markdown emphasis). */
 export function normalizeVerdictCandidateLine(value) {
@@ -147,10 +145,29 @@ export function parseConditionLiteral(raw) {
     return Number.isFinite(numeric) ? numeric : trimmed;
 }
 export function parseJsonFromText(value) {
-    if (!value?.trim())
+    const raw = value?.trim();
+    if (!raw)
         return undefined;
+    // Pure JSON first.
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        // continue
+    }
+    // Shell executor stdout prefixes each command with `$ <command>`. Dynamic
+    // selectors must consume exactly one trailing JSON payload after those echoes.
+    // Reject multi-payload or mixed prose to keep map expansion fail-closed.
+    const lines = raw.split(/\r?\n/).filter((line) => line.trim().length > 0);
+    if (lines.length < 2)
+        return undefined;
+    const payload = lines.at(-1)?.trim();
+    const prefix = lines.slice(0, -1);
+    if (!payload || prefix.some((line) => !line.startsWith("$ "))) {
+        return undefined;
+    }
     try {
-        return JSON.parse(value);
+        return JSON.parse(payload);
     }
     catch {
         return undefined;

package/dist/workflows/dag/frontend-test-result-contract.js

@@ -0,0 +1,165 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { writeDagRunJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
+export const FRONTEND_TEST_RESULT_SCHEMA_ID = "frontend-test-result-v1";
+const safeRelativePathSchema = z.string().min(1).refine((value) => !path.posix.isAbsolute(value) &&
+    !path.win32.isAbsolute(value) &&
+    !value.includes("\\") &&
+    value.split("/").every((part) => part.length > 0 && part !== "." && part !== ".."), "must be a safe repo-relative POSIX path");
+const sha256Schema = z.string().regex(/^[a-f0-9]{64}$/);
+const caseStatusSchema = z.enum(["passed", "failed", "blocked"]);
+export const frontendTestResultContractSchema = z.object({
+    schemaVersion: z.literal(1),
+    sourceBinding: z.object({
+        taskId: z.string().min(1),
+        sources: z.array(z.object({
+            kind: z.enum(["requirement", "constraint", "reference"]),
+            path: safeRelativePathSchema,
+            sha256: sha256Schema,
+        }).strict()).min(1),
+        requirementIds: z.array(z.string().min(1)),
+    }).strict(),
+    manifest: z.object({
+        path: safeRelativePathSchema,
+        sha256: sha256Schema,
+    }).strict(),
+    cases: z.array(z.object({
+        caseId: z.string().min(1),
+        acIds: z.array(z.string().min(1)).min(1),
+        status: caseStatusSchema,
+        evidence: z.array(z.object({ path: safeRelativePathSchema, sha256: sha256Schema }).strict()),
+        blockedReason: z.string().min(1).optional(),
+    }).strict()).min(1),
+    totals: z.object({
+        cases: z.number().int().positive(),
+        passed: z.number().int().min(0),
+        failed: z.number().int().min(0),
+        blocked: z.number().int().min(0),
+    }).strict(),
+    acceptanceCoverage: z.object({
+        covered: z.array(z.string().min(1)),
+        missing: z.array(z.string().min(1)),
+    }).strict(),
+    integrationMode: z.enum(["real", "none"]),
+    outcome: z.enum(["passed", "failed", "incomplete"]),
+}).strict().superRefine((value, ctx) => {
+    if (value.totals.cases !== value.cases.length) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["totals", "cases"], message: "totals.cases must equal cases length" });
+    }
+    for (const status of ["passed", "failed", "blocked"]) {
+        const actual = value.cases.filter((item) => item.status === status).length;
+        if (value.totals[status] !== actual) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["totals", status], message: `totals.${status} must equal case status count` });
+        }
+    }
+    if (value.outcome === "passed" && (value.totals.failed > 0 || value.totals.blocked > 0 || value.acceptanceCoverage.missing.length > 0 || value.integrationMode !== "real")) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["outcome"], message: "passed requires all cases passed, complete AC coverage, and real integration" });
+    }
+    if (value.integrationMode === "real" && value.outcome !== "passed") {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["integrationMode"], message: "real integration requires passed outcome" });
+    }
+});
+function sha256(content) {
+    return createHash("sha256").update(content).digest("hex");
+}
+function assertInside(root, candidate, label) {
+    const relative = path.relative(root, candidate);
+    if (relative.startsWith("..") || path.isAbsolute(relative)) {
+        throw new Error(`${label} escapes its allowed root`);
+    }
+}
+async function readEvidenceFile(repoRoot, evidenceRoot, relative) {
+    if (!safeRelativePathSchema.safeParse(relative).success) {
+        throw new Error(`unsafe evidence path: ${relative}`);
+    }
+    const absolute = path.resolve(evidenceRoot, relative);
+    assertInside(evidenceRoot, absolute, "evidence path");
+    const resolved = await realpath(absolute);
+    assertInside(repoRoot, resolved, "evidence realpath");
+    const info = await lstat(resolved);
+    if (!info.isFile())
+        throw new Error(`evidence is not a file: ${relative}`);
+    return { path: relative, sha256: sha256(await readFile(resolved)) };
+}
+export async function materializeFrontendTestResult(input) {
+    if (!/^[a-z0-9][a-z0-9._-]*\.json$/.test(input.artifactName) || !/^[a-z0-9][a-z0-9._-]*$/.test(input.outputDir)) {
+        throw new Error("unsafe structured artifact path");
+    }
+    const sourceBinding = input.sourceBinding;
+    if (!sourceBinding?.taskId || !sourceBinding.sources?.length) {
+        throw new Error("frontend-test result requires frozen sourceBinding");
+    }
+    const manifestPath = "testcase/frontend/cases/manifest.json";
+    const manifestAbsolute = path.resolve(input.workspaceRoot, manifestPath);
+    const manifest = JSON.parse(await readFile(manifestAbsolute, "utf-8"));
+    if (manifest.schemaVersion !== 1 || !Array.isArray(manifest.cases) || manifest.cases.length === 0) {
+        throw new Error("invalid or empty frontend case manifest");
+    }
+    const requiredIds = new Set(sourceBinding.requirementIds ?? []);
+    const covered = new Set();
+    const cases = [];
+    for (const raw of manifest.cases) {
+        const item = raw;
+        if (!item || typeof item.caseId !== "string" || !Array.isArray(item.acIds) || typeof item.evidenceDir !== "string") {
+            throw new Error("invalid frontend manifest case");
+        }
+        if (!item.evidenceDir.startsWith(`testcase/frontend/evidence/${item.caseId}/`)) {
+            throw new Error(`unsafe evidenceDir for ${item.caseId}`);
+        }
+        for (const acId of item.acIds) {
+            if (requiredIds.size > 0 && !requiredIds.has(acId))
+                throw new Error(`unknown AC in manifest: ${acId}`);
+            covered.add(acId);
+        }
+        const evidenceRoot = path.resolve(input.workspaceRoot, item.evidenceDir);
+        assertInside(input.workspaceRoot, evidenceRoot, "evidenceDir");
+        const resultRaw = JSON.parse(await readFile(path.join(evidenceRoot, "case-result.json"), "utf-8"));
+        const status = caseStatusSchema.parse(resultRaw.status);
+        if (resultRaw.caseId !== item.caseId || !Array.isArray(resultRaw.evidencePaths))
+            throw new Error(`invalid result identity for ${item.caseId}`);
+        if (status === "blocked" && (typeof resultRaw.blockedReason !== "string" || !resultRaw.blockedReason.trim()))
+            throw new Error(`blocked result requires reason for ${item.caseId}`);
+        const evidence = [await readEvidenceFile(input.workspaceRoot, evidenceRoot, "execution.md")];
+        for (const evidencePath of resultRaw.evidencePaths) {
+            if (typeof evidencePath !== "string" || evidencePath === "execution.md")
+                continue;
+            evidence.push(await readEvidenceFile(input.workspaceRoot, evidenceRoot, evidencePath));
+        }
+        if (status === "passed" && !evidence.some((entry) => /\.(png|jpg|jpeg|webp|zip|har|webm|mp4|ya?ml)$/i.test(entry.path))) {
+            throw new Error(`passed case requires browser evidence: ${item.caseId}`);
+        }
+        cases.push({ caseId: item.caseId, acIds: item.acIds, status, evidence, ...(status === "blocked" ? { blockedReason: resultRaw.blockedReason } : {}) });
+    }
+    const missing = [...requiredIds].filter((id) => !covered.has(id));
+    const totals = {
+        cases: cases.length,
+        passed: cases.filter((item) => item.status === "passed").length,
+        failed: cases.filter((item) => item.status === "failed").length,
+        blocked: cases.filter((item) => item.status === "blocked").length,
+    };
+    const outcome = totals.failed > 0 ? "failed" : totals.blocked > 0 || missing.length > 0 ? "incomplete" : "passed";
+    const result = frontendTestResultContractSchema.parse({
+        schemaVersion: 1,
+        sourceBinding,
+        manifest: { path: manifestPath, sha256: sha256(await readFile(manifestAbsolute)) },
+        cases,
+        totals,
+        acceptanceCoverage: { covered: [...covered].sort(), missing: missing.sort() },
+        integrationMode: outcome === "passed" ? "real" : "none",
+        outcome,
+    });
+    const relativePath = path.posix.join(input.outputDir, input.artifactName);
+    const artifactPath = await writeDagRunJsonArtifact(input.runDir, relativePath, result);
+    return { path: artifactPath, sha256: sha256(`${JSON.stringify(result, null, 2)}\n`), schemaId: FRONTEND_TEST_RESULT_SCHEMA_ID };
+}
+export function buildFrontendTestOutcomeGateShellSnippet(options) {
+    const resultRelativePath = options?.resultRelativePath ?? "contracts/frontend-test-result.json";
+    return [
+        'test -n "${HARNESS_DAG_RUN_DIR:-}" || { echo "missing HARNESS_DAG_RUN_DIR for frontend-test outcome gate" >&2; exit 2; }',
+        `RESULT="\${HARNESS_DAG_RUN_DIR}/${resultRelativePath}"`,
+        'test -f "${RESULT}" || { echo "missing frontend-test result: ${RESULT}" >&2; exit 2; }',
+        `node -e 'const fs=require("fs");const r=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));const ok=r.outcome==="passed"&&r.integrationMode==="real"&&Number(r.totals?.failed||0)===0&&Number(r.totals?.blocked||0)===0&&Array.isArray(r.acceptanceCoverage?.missing)&&r.acceptanceCoverage.missing.length===0;console.log("frontend-test outcome="+r.outcome+" integrationMode="+r.integrationMode);if(!ok)process.exit(1);' "\${RESULT}"`,
+    ].join("; ");
+}