@tea-agent/loop-agent 0.16.22 → 0.16.24

package/dist/workflows/dag/init-hybrid.js

@@ -2546,6 +2546,7 @@ function buildAnalyzeInputsNode(sources) {
             "For every endpoint, explicitly set responseBody.kind=array|object|scalar|empty|unknown and ordering=specified|unspecified|not-applicable. Add itemSchemaRef for arrays when documented.",
             "For response fields, use comparison=exact|parseable-only|semantic when the source defines assertion semantics; date-time fields whose precision is unspecified should use parseable-only, not string equality.",
             "Endpoint sourceRefs and field sourceRefs must cite only requirement/reference evidence actually read. Empty sourceRefs are allowed only when normalizing legacy v1 input; newly generated v2 should cite evidence.",
+            "For externalDependencies and risks, emit canonical items with exactly description plus optional name and sourceRef. For a dependency target, put the target value in name. Do not emit type, target, kind, required, severity, mitigation, level, impact, sourceRefs, or custom keys in newly generated v2 output.",
             "Use empty arrays for categories not documented. Never include credentials, tokens, private keys, or secret values.",
             "Required top-level keys: schemaVersion=2, sourceBinding, acceptanceCriteria, endpoints, dataModels, businessRules, stateTransitions, boundaryConstraints, externalDependencies, risks, evidenceGaps.",
             "Read-only: do not modify code, docs, artifacts, or repository files.",
@@ -3312,7 +3313,17 @@ function buildBackendTestHybridDag(sources) {
 // Frontend browser-test RAG DAG template
 // ---------------------------------------------------------------------------
 function buildFrontendTestHybridDag(sources) {
-    const config = sources.taskConfig.frontendTest ?? { maxCasesPerBatch: 20 };
+    const rawFrontendTest = sources.taskConfig.frontendTest;
+    const config = {
+        maxCasesPerBatch: rawFrontendTest?.maxCasesPerBatch ?? 20,
+        maxTokensPerCase: rawFrontendTest?.maxTokensPerCase,
+        maxTotalTokens: rawFrontendTest?.maxTotalTokens,
+        reviewMode: rawFrontendTest?.reviewMode ?? "off",
+        strictOutcomeGate: rawFrontendTest?.strictOutcomeGate === true,
+    };
+    const reviewMode = config.reviewMode;
+    const blockingReview = reviewMode === "blocking";
+    const strictOutcomeGate = config.strictOutcomeGate;
     const hasFrontendTestWriteScope = sources.taskConfig.allowedPaths.some((pattern) => pattern === "testcase/frontend/**" ||
         pattern === "testcase/**" ||
         pattern === "**");
@@ -3323,6 +3334,36 @@ function buildFrontendTestHybridDag(sources) {
     const ragWriteSet = ["testcase/frontend/rag/**"];
     const casesWriteSet = ["testcase/frontend/cases/**"];
     const evidenceRoot = "testcase/frontend/evidence";
+    const checklistValidation = [
+        "node -e",
+        JSON.stringify([
+            "const fs=require('fs'),path=require('path');",
+            "const root='testcase/frontend/cases';",
+            "const draft=path.join(root,'manifest.draft.json');",
+            "const final=path.join(root,'manifest.json');",
+            "const manifestPath=fs.existsSync(draft)?draft:(fs.existsSync(final)?final:null);",
+            "if(!manifestPath)throw new Error('checklist: missing manifest.draft.json or manifest.json');",
+            "const manifest=JSON.parse(fs.readFileSync(manifestPath,'utf8'));",
+            "if(!Array.isArray(manifest.cases)||manifest.cases.length===0)throw new Error('checklist: empty cases');",
+            "const issues=[];",
+            "const openRe=/playwright-cli\\s+open\\s+--browser=chrome\\s+--headed\\s+https?:\\/\\/\\S+/i;",
+            "const prodRe=/(?:^|\\/\\/)(?:www\\.)?[^\\s\\/]*(?:prod|production)/i;",
+            "const codeRe=/\\b(pytest|playwright\\.test|@playwright\\/test)\\b/i;",
+            "for(const c of manifest.cases){",
+            " const id=c&&c.caseId||'?';",
+            " const casePath=typeof c.casePath==='string'?c.casePath:null;",
+            " if(!casePath||!fs.existsSync(casePath)){issues.push({ruleId:'case-file-missing',caseId:id,detail:String(casePath)});continue;}",
+            " const body=fs.readFileSync(casePath,'utf8');",
+            " if(!openRe.test(body))issues.push({ruleId:'open-prefix',caseId:id,detail:'missing playwright-cli open --browser=chrome --headed <absolute-url>'});",
+            " const m=body.match(/playwright-cli\\s+open\\s+--browser=chrome\\s+--headed\\s+(https?:\\/\\/\\S+)/i);",
+            " if(m){const url=m[1].replace(/[)\\]},.\"']+$/,''); if(prodRe.test(url))issues.push({ruleId:'production-url',caseId:id,detail:url});}",
+            " if(codeRe.test(body))issues.push({ruleId:'no-test-source',caseId:id,detail:'pytest/playwright test source forbidden'});",
+            " if(!Array.isArray(c.acIds)||c.acIds.length===0)issues.push({ruleId:'ac-mapping',caseId:id,detail:'acIds required'});",
+            "}",
+            "if(issues.length){console.error('frontend-test checklist blocked: '+JSON.stringify(issues)); process.exit(1);}",
+            "console.log('frontend-test checklist ok cases='+manifest.cases.length+' source='+path.basename(manifestPath));",
+        ].join("")),
+    ].join(" ");
     const manifestValidation = [
         "node -e",
         JSON.stringify([
@@ -3338,7 +3379,6 @@ function buildFrontendTestHybridDag(sources) {
             " if(!Array.isArray(c.acIds)||c.acIds.length===0||c.acIds.some(a=>typeof a!=='string'||!a.trim())) throw new Error('invalid acIds');",
             " for(const k of ['casePath','evidenceDir']){ const v=c[k]; if(typeof v!=='string'||path.isAbsolute(v)||v.includes('..')) throw new Error('unsafe '+k); }",
             " if(c.casePath!=='testcase/frontend/cases/'+c.caseId+'.md') throw new Error('casePath must match caseId');",
-            // Accept evidenceDir as the case root or a nested path under that root.
             " { const prefix='testcase/frontend/evidence/'+c.caseId; if(!(c.evidenceDir===prefix||c.evidenceDir.startsWith(prefix+'/'))) throw new Error('case path escapes frontend test roots'); }",
             " if(!fs.existsSync(c.casePath)) throw new Error('missing case file '+c.casePath);",
             " if(seenCasePath.has(c.casePath)) throw new Error('duplicate casePath'); seenCasePath.add(c.casePath);",
@@ -3360,6 +3400,290 @@ function buildFrontendTestHybridDag(sources) {
         ].join("")),
     ].join(" ");
     const frontendTestOutcomeGate = buildFrontendTestOutcomeGateShellSnippet();
+    const tasks = [
+        {
+            id: "retrieve-frontend-test-context-pi",
+            depends_on: [],
+            role: "planner",
+            executor: "pi",
+            toolProfile: "write",
+            complexity: "MED",
+            writePolicy: "exclusive",
+            writeSet: ragWriteSet,
+            allowedPaths: [...commonReadOnlyPaths(sources), ...ragWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "Write short testcase/frontend/rag/context.md and coverage-map.md with machine-readable baseUrl and capability notes.",
+            subtask_prompt: [
+                "Build the frontend test RAG package (keep it short).",
+                "Read task source, routes/components/API or Mock facts, and execution contract. Write only testcase/frontend/rag/context.md and coverage-map.md.",
+                "Prefer fixed fields: baseUrl, baseUrlSource, AC table, capability matrix (backend real/mock, pagination data, HTTP observation, error injection), risks, forbidden hosts. Do not paste large implementation dumps.",
+                "Base URL resolution (required): (1) Prefer absolute http(s) frontend URL from task source config.md. (2) Else default http://localhost:5173. (3) Never production hosts. (4) Write `baseUrl: <url>` and `baseUrlSource: config.md|<path>|default-localhost-5173`. (5) Include exact start prefix: playwright-cli open --browser=chrome --headed <resolved-base-url>.",
+                buildSourceContextBlock(sources),
+            ].join("\n\n"),
+        },
+        {
+            id: "materialize-frontend-test-execution-shell",
+            depends_on: ["retrieve-frontend-test-context-pi"],
+            role: "verifier",
+            executor: "shell",
+            complexity: "LOW",
+            writePolicy: "read-only",
+            allowedPaths: [...ragWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "Fail-closed preflight: absolute non-production baseUrl required; fixture/reset not hard-gated.",
+            subtask_prompt: "Hard-validate only an absolute non-production baseUrl in RAG context (from config.md or default http://localhost:5173). Fixture/reset and other isolation details are soft guidance for later nodes, not preflight failures.",
+            shell: {
+                commands: [
+                    [
+                        "node -e",
+                        JSON.stringify("const fs=require('fs'); const p='testcase/frontend/rag/context.md'; if(!fs.existsSync(p))throw new Error('missing '+p); const s=fs.readFileSync(p,'utf8'); const patterns=[ /baseUrl\\s*[:=]\\s*(https?:\\/\\/\\S+)/i, /base[- ]url\\s*[:=]\\s*(https?:\\/\\/\\S+)/i, /playwright-cli open --browser=chrome --headed\\s+(https?:\\/\\/\\S+)/i, /(https?:\\/\\/(?:localhost|127\\.0\\.0\\.1)[^\\s)\\]},\"']*)/i ]; let baseUrl=null; for(const re of patterns){const m=s.match(re); if(m){baseUrl=m[1]; break;}} if(!baseUrl)throw new Error('frontend-test preflight missing absolute baseUrl (prefer config.md; default http://localhost:5173)'); baseUrl=baseUrl.replace(/[)\\]},.\"']+$/,''); if(!/^https?:\\/\\//i.test(baseUrl))throw new Error('baseUrl must be absolute http(s): '+baseUrl); if(/(?:^|\\/\\/)(?:www\\.)?[^\\s/]*(?:prod|production)/i.test(baseUrl))throw new Error('production URL forbidden: '+baseUrl); console.log('frontend-test-execution-v1 validated baseUrl='+baseUrl);"),
+                    ].join(" "),
+                ],
+                cwd: ".",
+                timeoutMs: 60000,
+            },
+        },
+        {
+            id: "generate-frontend-functional-cases-pi",
+            depends_on: ["materialize-frontend-test-execution-shell"],
+            role: "implementer",
+            executor: "pi",
+            toolProfile: "write",
+            complexity: "HIGH",
+            writePolicy: "exclusive",
+            writeSet: casesWriteSet,
+            allowedPaths: [...ragWriteSet, ...casesWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "Write executable Markdown frontend cases, index.md, and manifest.draft.json schemaVersion 1; no test source code.",
+            subtask_prompt: [
+                "Use skill playwright-cli-case-generator.",
+                "Read only testcase/frontend/rag/context.md, testcase/frontend/rag/coverage-map.md, and existing testcase/frontend/cases/. Write only testcase/frontend/cases/**.",
+                "Generate Markdown cases, index.md and manifest.draft.json (schemaVersion 1; cases[] with caseId, casePath, dimension, acIds, evidenceDir). IDs use FE-<FEATURE>-<NNN>-<dimension>; dimensions core|boundary|flow|backend.",
+                "Prefer a small smoke suite (default max roughly 4–8 cases unless task frontendTest.maxCasesPerBatch is higher). Never invent unavailable API fields or credentials. Do not create pytest or Playwright source.",
+                "Copy the resolved absolute baseUrl from context.md (baseUrl field; resolved from config.md or default http://localhost:5173). Every browser start command must be: playwright-cli open --browser=chrome --headed <resolved-base-url-from-context.md> with that concrete URL — never leave a <base-url> placeholder. Use default browser session only; never write -s=<case-id>.",
+                "Each case must be independently reproducible with fixture/reset, UI reset, snapshot-before-ref, evidence write point under testcase/frontend/evidence/<case-id>/. If the isolated environment is unavailable, require writing blocked evidence before any browser command.",
+            ].join("\n\n"),
+        },
+    ];
+    if (blockingReview) {
+        tasks.push({
+            id: "review-frontend-cases-pi",
+            depends_on: ["generate-frontend-functional-cases-pi"],
+            role: "reviewer",
+            executor: "pi",
+            complexity: "HIGH",
+            writePolicy: "read-only",
+            allowedPaths: [...ragWriteSet, ...casesWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "First line VERDICT: pass or VERDICT: request-revision, followed by AC-to-case coverage and execution risk findings; no writes. request-revision blocks manifest materialization.",
+            subtask_prompt: "Review only the RAG package, frontend Markdown cases, and manifest.draft.json. Verify traceability, independent execution, safe data/environment handling, manifest correctness, session consistency, fixture/UI reset and fresh snapshot steps, and evidence requirements. Any Important or Critical finding requires VERDICT: request-revision. Browser execution is blocked unless this review passes.",
+        }, {
+            id: "revise-frontend-cases-pi",
+            depends_on: ["review-frontend-cases-pi"],
+            runIf: "$.nodes['review-frontend-cases-pi'].firstVerdictLine == 'VERDICT: request-revision'",
+            role: "implementer",
+            executor: "pi",
+            toolProfile: "write",
+            complexity: "HIGH",
+            writePolicy: "exclusive",
+            writeSet: casesWriteSet,
+            allowedPaths: [...ragWriteSet, ...casesWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "Apply the one permitted frontend case revision under testcase/frontend/cases/** only; no browser execution or evidence writes.",
+            subtask_prompt: "This is the only permitted case revision. Read the first review findings and the RAG package. Revise only testcase/frontend/cases/**, preserve traceable AC mappings, and do not execute a browser or write evidence. HARD: Never delete case files; only edit in place or add missing cases. Preserve the full planned suite, index.md, and manifest.draft.json.",
+        }, {
+            id: "review-frontend-cases-final-pi",
+            depends_on: ["revise-frontend-cases-pi"],
+            runIf: "$.nodes['review-frontend-cases-pi'].firstVerdictLine == 'VERDICT: request-revision'",
+            role: "reviewer",
+            executor: "pi",
+            complexity: "HIGH",
+            writePolicy: "read-only",
+            allowedPaths: [...ragWriteSet, ...casesWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "First line VERDICT: pass or VERDICT: request-revision after the single allowed case revision; no writes.",
+            subtask_prompt: "Perform the final frontend case review after the sole permitted revision. Apply the same traceability, isolation, manifest, reset, session, snapshot, and evidence checks. First verdict line must be exact; any Important or Critical finding requires request-revision. Do not write files.",
+        }, {
+            id: "final-frontend-case-review-gate-shell",
+            depends_on: ["review-frontend-cases-pi", "review-frontend-cases-final-pi"],
+            dependsPolicy: "all-or-condition-skip",
+            role: "verifier",
+            executor: "shell",
+            complexity: "LOW",
+            writePolicy: "read-only",
+            allowedPaths: [...ragWriteSet, ...casesWriteSet],
+            forbiddenPaths: forbidden,
+            outputContract: "Pass-only effective frontend case review gate; final review takes precedence when the revision branch ran.",
+            subtask_prompt: "Authorize checklist/manifest materialization only after the effective frontend case review passes.",
+            shell: {
+                commands: [],
+                verdictGate: {
+                    fromNodeId: "review-frontend-cases-final-pi",
+                    fallbackFromNodeIds: ["review-frontend-cases-pi"],
+                    accept: ["VERDICT: pass"],
+                    label: "effective frontend case review",
+                    lineMode: "first-verdict-line",
+                },
+                cwd: ".",
+                timeoutMs: 60000,
+            },
+        });
+    }
+    const checklistDependsOn = blockingReview
+        ? ["final-frontend-case-review-gate-shell"]
+        : ["generate-frontend-functional-cases-pi"];
+    tasks.push({
+        id: "frontend-case-checklist-shell",
+        depends_on: checklistDependsOn,
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: [...ragWriteSet, ...casesWriteSet],
+        forbiddenPaths: forbidden,
+        outputContract: "Mechanical checklist: open-prefix, non-prod absolute URL, acIds, no pytest/playwright test source; emit structured ruleId issues on failure.",
+        subtask_prompt: "Scan generated cases/manifest against the shared blocking checklist. Do not use free-form LLM verdicts.",
+        shell: { commands: [checklistValidation], cwd: ".", timeoutMs: 120000 },
+    }, {
+        id: "materialize-frontend-case-manifest-shell",
+        depends_on: ["frontend-case-checklist-shell"],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "exclusive",
+        writeSet: casesWriteSet,
+        allowedPaths: casesWriteSet,
+        forbiddenPaths: forbidden,
+        outputContract: "Validated frontend manifest payload { cases: [...] }; atomically materialize testcase/frontend/cases/manifest.json from manifest.draft.json; shell output may echo only the prefix before exactly one final JSON line.",
+        subtask_prompt: "Validate manifest.draft.json and materialize manifest.json after the mechanical checklist (and optional blocking review) passes.",
+        shell: { commands: [manifestValidation], cwd: ".", timeoutMs: 120000 },
+    }, {
+        id: "execute-frontend-cases-map",
+        depends_on: ["materialize-frontend-case-manifest-shell"],
+        role: "verifier",
+        executor: "static",
+        complexity: "LOW",
+        writePolicy: "none",
+        allowedPaths: [],
+        forbiddenPaths: forbidden,
+        outputContract: "Serial aggregate of case execution summaries, evidence paths, tokens, and token-budget or executor blocked/failed cases.",
+        subtask_prompt: "Expand and execute the validated frontend case manifest serially. Child executor failures become case-level failed/blocked evidence so closeout can still run.",
+        static: { resultMarkdown: "Frontend case map expansion barrier." },
+        dynamicExpansion: {
+            type: "map_agent",
+            workflowNodeId: "execute-frontend-cases-map",
+            itemsFrom: "$.nodes['materialize-frontend-case-manifest-shell'].output.cases",
+            itemName: "case",
+            maxItems: config.maxCasesPerBatch,
+            maxExpandedNodes: config.maxCasesPerBatch,
+            childIdPrefix: "execute-frontend-case",
+            workspaceTemplate: "{{case.evidenceDir}}",
+            tolerateChildFailures: true,
+            tokenBudget: {
+                maxTokensPerCase: config.maxTokensPerCase,
+                maxTotalTokens: config.maxTotalTokens,
+            },
+            childTask: {
+                executor: "pi",
+                role: "implementer",
+                skills: ["playwright-cli"],
+                toolProfile: "write",
+                complexity: "MED",
+                writePolicy: "exclusive",
+                allowedPaths: [
+                    "testcase/frontend/cases/{{case.caseId}}.md",
+                    "testcase/frontend/rag/context.md",
+                    "testcase/frontend/rag/coverage-map.md",
+                    `${evidenceRoot}/{{case.caseId}}/**`,
+                ],
+                forbiddenPaths: forbidden,
+                writeSet: [`${evidenceRoot}/{{case.caseId}}/**`],
+                outputContract: "Compact JSON <=1200 characters with case status, evidence paths, error summary, and tokens.",
+                subtaskPromptTemplate: [
+                    "Primary job: EXECUTE case {{case.caseId}} from {{case.casePath}} with skill playwright-cli (fresh Pi session; do not use /new). Prefer playwright-cli over prose review.",
+                    "1) Read baseUrl from testcase/frontend/rag/context.md (config.md preferred, else http://localhost:5173). 2) Start browser: playwright-cli open --browser=chrome --headed <resolved-base-url> (default session only; no -s=). 3) Follow the case steps with snapshot before element refs. 4) If env/CLI/baseUrl is unavailable, write blocked evidence and do not open a browser.",
+                    "Always write {{case.evidenceDir}}execution.md and {{case.evidenceDir}}case-result.json (caseId, status passed|failed|blocked, evidencePaths; blocked needs blockedReason). Then validate: node -e \"const fs=require('fs');const p='{{case.evidenceDir}}';const r=JSON.parse(fs.readFileSync(p+'case-result.json','utf8'));if(!fs.existsSync(p+'execution.md')||r.caseId!=='{{case.caseId}}'||!['passed','failed','blocked'].includes(r.status)||!Array.isArray(r.evidencePaths)||(r.status==='blocked'&&!(typeof r.blockedReason==='string'&&r.blockedReason.trim())))process.exit(1)\".",
+                    "Business failed/blocked is a recorded result, not a node failure. Close browser. Return compact JSON (<=1200 chars): {caseId,status,evidencePaths,errorSummary,tokens}.",
+                ].join("\n\n"),
+            },
+        },
+    }, {
+        id: "validate-frontend-case-evidence-shell",
+        depends_on: ["execute-frontend-cases-map"],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: ["testcase/frontend/cases/**", `${evidenceRoot}/**`],
+        forbiddenPaths: forbidden,
+        outputContract: "Deterministic validation that every manifest case has execution.md and valid matching case-result.json; blocked results require blockedReason.",
+        subtask_prompt: "Validate all frontend case evidence before result materialization; fail closed on missing or malformed records.",
+        shell: { commands: [evidenceValidation], cwd: ".", timeoutMs: 120000 },
+    }, {
+        id: "materialize-frontend-test-result-shell",
+        depends_on: ["validate-frontend-case-evidence-shell"],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: ["testcase/frontend/cases/**", `${evidenceRoot}/**`],
+        forbiddenPaths: forbidden,
+        outputContract: "Run-owned hash-bound frontend-test-result-v1 derived only from the manifest and validated case evidence.",
+        subtask_prompt: "Materialize the authoritative frontend-test-result-v1. Do not use Pi prose or retrospective output as input.",
+        shell: {
+            commands: [],
+            jsonArtifactGate: {
+                fromNodeId: "validate-frontend-case-evidence-shell",
+                schemaId: "frontend-test-result-v1",
+                artifactName: "frontend-test-result.json",
+                outputDir: "contracts",
+            },
+            cwd: ".",
+            timeoutMs: 120000,
+        },
+    });
+    if (strictOutcomeGate) {
+        tasks.push({
+            id: "frontend-test-result-outcome-gate-shell",
+            depends_on: ["materialize-frontend-test-result-shell"],
+            role: "verifier",
+            executor: "shell",
+            complexity: "LOW",
+            writePolicy: "read-only",
+            allowedPaths: [],
+            forbiddenPaths: forbidden,
+            outputContract: "Optional quality gate: pass only when frontend-test-result-v1 is outcome=passed and integrationMode=real with 0 failed/blocked and no missing AC. Does not gate retrospective closeout.",
+            subtask_prompt: "Opt-in Delivery/Worker quality gate (frontendTest.strictOutcomeGate=true). Retrospective does not depend on this node.",
+            shell: { commands: [frontendTestOutcomeGate], cwd: ".", timeoutMs: 60000 },
+        });
+    }
+    tasks.push({
+        id: "frontend-test-retrospect-pi",
+        depends_on: ["materialize-frontend-test-result-shell"],
+        role: "closeout",
+        executor: "pi",
+        toolProfile: "write",
+        complexity: "MED",
+        writePolicy: "exclusive",
+        writeSet: ["testcase/frontend/reports/**"],
+        allowedPaths: ["testcase/frontend/**"],
+        forbiddenPaths: forbidden,
+        outputContract: "Write frontend-test retrospective under testcase/frontend/reports/frontend-test-retrospect-<date>.md with coverage, pass/fail/blocked, execution evidence review, risks, findings, and A/B/C/D rating — even when outcome is failed/incomplete. Pipeline acceptance = this report exists (not case 100% pass).",
+        subtask_prompt: "Write the frontend test retrospective under testcase/frontend/reports/ after result materialization (do not wait for outcome=pass). Combine AC→case→browser-evidence review with the closeout report: coverage, passed/failed/blocked (including token-budget-exhausted / executor-auth-unavailable), evidence gaps, browser anomalies, residual risks, and A/B/C/D rating. Passed cases need assertion plus screenshot or equivalent evidence when available; failed/blocked need explicit reasons. Blocked cases never count as passed. Do not replace browser evidence with model conclusions. Do not write docs/**. Pipeline success is report production, not case full green.",
+    });
+    const globalConstraints = [
+        ...sources.taskConfig.hardConstraints,
+        ...STANDARD_GLOBAL_CONSTRAINTS,
+        "frontend-test-dag generates Markdown cases and browser evidence only; it must not generate pytest or Playwright test source code.",
+        "Each browser case runs serially in a fresh Pi execution boundary. Persist its evidence before starting the next case.",
+        "Use only the declared isolated test environment. Production URLs, real credentials, and unauthorized data are blocked.",
+        "Browser startup for generated cases must be playwright-cli open --browser=chrome --headed <resolved-base-url>; resolve baseUrl from task source config.md when present, otherwise default http://localhost:5173; generated operations stay in the default browser session and must not use unverified named-session flags.",
+        "Token settings are post-case stop thresholds, never a hard provider token cap. Unstarted cases after a threshold are blocked: token-budget-exhausted.",
+        "Pipeline acceptance for frontend-test is the final retrospect report under testcase/frontend/reports/; case pass rate and outcome=passed are quality signals, not the default pipeline success condition.",
+        blockingReview
+            ? "frontendTest.reviewMode=blocking: a frontend case review must emit VERDICT: pass before checklist/manifest materialization; request-revision blocks browser execution."
+            : "frontendTest.reviewMode is off|advisory by default: mechanical checklist-shell gates materialize/execute; LLM review is not a hard browser gate.",
+    ];
     const spec = {
         version: 3,
         title: `Frontend test DAG: ${sources.taskConfig.title}`,
@@ -3367,16 +3691,7 @@ function buildFrontendTestHybridDag(sources) {
         outputLanguage: sources.outputLanguage ?? DEFAULT_DAG_OUTPUT_LANGUAGE,
         objective: extractObjective(sources.requirementMarkdown, sources.taskConfig.title),
         successCriteria: extractSuccessCriteria(sources.requirementMarkdown, sources.taskId),
-        globalConstraints: [
-            ...sources.taskConfig.hardConstraints,
-            ...STANDARD_GLOBAL_CONSTRAINTS,
-            "frontend-test-dag generates Markdown cases and browser evidence only; it must not generate pytest or Playwright test source code.",
-            "Each browser case runs serially in a fresh Pi execution boundary. Persist its evidence before starting the next case.",
-            "Use only the declared isolated test environment. Production URLs, real credentials, and unauthorized data are blocked.",
-            "Browser startup for generated cases must be playwright-cli open --browser=chrome --headed <resolved-base-url>; resolve baseUrl from task source config.md when present, otherwise default http://localhost:5173; generated operations stay in the default browser session and must not use unverified named-session flags.",
-            "A frontend case review must emit VERDICT: pass before manifest materialization; request-revision blocks browser execution.",
-            "Token settings are post-case stop thresholds, never a hard provider token cap. Unstarted cases after a threshold are blocked: token-budget-exhausted.",
-        ],
+        globalConstraints,
         defaults: {
             ...HYBRID_DEFAULTS,
             skills: [],
@@ -3393,253 +3708,7 @@ function buildFrontendTestHybridDag(sources) {
             closeout: ["verification-before-completion"],
         },
         executorModels: sources.executorModelMatrix ?? DEFAULT_DAG_EXECUTOR_MODELS,
-        tasks: [
-            {
-                id: "retrieve-frontend-test-context-pi",
-                depends_on: [],
-                role: "planner",
-                executor: "pi",
-                toolProfile: "write",
-                complexity: "HIGH",
-                writePolicy: "exclusive",
-                writeSet: ragWriteSet,
-                allowedPaths: [...commonReadOnlyPaths(sources), ...ragWriteSet],
-                forbiddenPaths: forbidden,
-                outputContract: "Write testcase/frontend/rag/context.md and coverage-map.md with traceable UI/API/test-environment facts.",
-                subtask_prompt: [
-                    "Build the frontend test RAG package.",
-                    "Read task source, relevant routes/components/API or Mock facts, existing tests, and execution contract. Write only testcase/frontend/rag/context.md and coverage-map.md.",
-                    "Record AC IDs, source paths, routes, states, roles, fixture/data prerequisites, API mapping status, risks, and isolated execution contract. Do not guess unavailable facts.",
-                    "Base URL resolution (required): (1) Prefer an absolute http(s) frontend URL from task source config.md (source/references/**/config.md or any attached config.md), including keys baseUrl/base_url/frontendBaseUrl/FRONTEND_BASE_URL/url or labeled frontend base URL text. (2) If config.md has no usable absolute URL, default to http://localhost:5173. (3) Never use production hosts. (4) Write both a human-readable base URL line and machine-readable lines `baseUrl: <url>` and `baseUrlSource: config.md|<path>` or `baseUrlSource: default-localhost-5173`. (5) Include the exact browser start prefix with the resolved URL: playwright-cli open --browser=chrome --headed <resolved-base-url>.",
-                    buildSourceContextBlock(sources),
-                ].join("\n\n"),
-            },
-            {
-                id: "materialize-frontend-test-execution-shell",
-                depends_on: ["retrieve-frontend-test-context-pi"],
-                role: "verifier",
-                executor: "shell",
-                complexity: "LOW",
-                writePolicy: "read-only",
-                allowedPaths: [...ragWriteSet],
-                forbiddenPaths: forbidden,
-                outputContract: "Fail-closed preflight: absolute non-production baseUrl required; fixture/reset not hard-gated.",
-                subtask_prompt: "Hard-validate only an absolute non-production baseUrl in RAG context (from config.md or default http://localhost:5173). Fixture/reset and other isolation details are soft guidance for later nodes, not preflight failures.",
-                shell: { commands: [["node -e", JSON.stringify("const fs=require('fs'); const p='testcase/frontend/rag/context.md'; if(!fs.existsSync(p))throw new Error('missing '+p); const s=fs.readFileSync(p,'utf8'); const patterns=[ /baseUrl\\s*[:=]\\s*(https?:\\/\\/\\S+)/i, /base[- ]url\\s*[:=]\\s*(https?:\\/\\/\\S+)/i, /playwright-cli open --browser=chrome --headed\\s+(https?:\\/\\/\\S+)/i, /(https?:\\/\\/(?:localhost|127\\.0\\.0\\.1)[^\\s)\\]},\"']*)/i ]; let baseUrl=null; for(const re of patterns){const m=s.match(re); if(m){baseUrl=m[1]; break;}} if(!baseUrl)throw new Error('frontend-test preflight missing absolute baseUrl (prefer config.md; default http://localhost:5173)'); baseUrl=baseUrl.replace(/[)\\]},.\"']+$/,''); if(!/^https?:\\/\\//i.test(baseUrl))throw new Error('baseUrl must be absolute http(s): '+baseUrl); if(/(?:^|\\/\\/)(?:www\\.)?[^\\s/]*(?:prod|production)/i.test(baseUrl))throw new Error('production URL forbidden: '+baseUrl); console.log('frontend-test-execution-v1 validated baseUrl='+baseUrl);")].join(" ")], cwd: ".", timeoutMs: 60000 },
-            },
-            {
-                id: "generate-frontend-functional-cases-pi",
-                depends_on: ["materialize-frontend-test-execution-shell"],
-                role: "implementer",
-                executor: "pi",
-                toolProfile: "write",
-                complexity: "HIGH",
-                writePolicy: "exclusive",
-                writeSet: casesWriteSet,
-                allowedPaths: [...ragWriteSet, ...casesWriteSet],
-                forbiddenPaths: forbidden,
-                outputContract: "Write executable Markdown frontend cases, index.md, and manifest.draft.json schemaVersion 1; no test source code.",
-                subtask_prompt: [
-                    "Use skill playwright-cli-case-generator.",
-                    "Read only testcase/frontend/rag/context.md, testcase/frontend/rag/coverage-map.md, and existing testcase/frontend/cases/. Write only testcase/frontend/cases/**.",
-                    "Generate Markdown cases, index.md and manifest.draft.json (schemaVersion 1; cases[] with caseId, casePath, dimension, acIds, evidenceDir). IDs use FE-<FEATURE>-<NNN>-<dimension>; dimensions core|boundary|flow|backend.",
-                    "Never infer API fields, constraints, SLA, credentials, or unrecorded test data. Do not create pytest or Playwright source. Copy the resolved absolute baseUrl from context.md (baseUrl field; resolved from config.md or default http://localhost:5173). Every browser start command must be: playwright-cli open --browser=chrome --headed <resolved-base-url-from-context.md> with that concrete URL — never leave a <base-url> placeholder. Use the same default browser session for every subsequent command; never write -s=<case-id> or assume named-session binding.",
-                    "Each case must be independently reproducible: for every executable sub-scenario state fixture/reset, UI reset, a fresh snapshot before references are used, exact evidence write point, preconditions/data cleanup, UI assertions, and evidence paths under testcase/frontend/evidence/<case-id>/. If the isolated environment is unavailable, require writing blocked evidence before any browser command.",
-                ].join("\n\n"),
-            },
-            {
-                id: "review-frontend-cases-pi",
-                depends_on: ["generate-frontend-functional-cases-pi"],
-                role: "reviewer",
-                executor: "pi",
-                complexity: "HIGH",
-                writePolicy: "read-only",
-                allowedPaths: [...ragWriteSet, ...casesWriteSet],
-                forbiddenPaths: forbidden,
-                outputContract: "First line VERDICT: pass or VERDICT: request-revision, followed by AC-to-case coverage and execution risk findings; no writes. request-revision blocks manifest materialization.",
-                subtask_prompt: "Review only the RAG package, frontend Markdown cases, and manifest.draft.json. Verify traceability, independent execution, safe data/environment handling, manifest correctness, session consistency, fixture/UI reset and fresh snapshot steps, and evidence requirements. Any Important or Critical finding requires VERDICT: request-revision. Browser execution is blocked unless this review passes.",
-            },
-            {
-                id: "revise-frontend-cases-pi",
-                depends_on: ["review-frontend-cases-pi"],
-                runIf: "$.nodes['review-frontend-cases-pi'].firstVerdictLine == 'VERDICT: request-revision'",
-                role: "implementer",
-                executor: "pi",
-                toolProfile: "write",
-                complexity: "HIGH",
-                writePolicy: "exclusive",
-                writeSet: casesWriteSet,
-                allowedPaths: [...ragWriteSet, ...casesWriteSet],
-                forbiddenPaths: forbidden,
-                outputContract: "Apply the one permitted frontend case revision under testcase/frontend/cases/** only; no browser execution or evidence writes.",
-                subtask_prompt: "This is the only permitted case revision. Read the first review findings and the RAG package. Revise only testcase/frontend/cases/**, preserve traceable AC mappings, and do not execute a browser or write evidence. HARD: Never delete case files; only edit in place or add missing cases. Preserve the full planned suite, index.md, and manifest.draft.json.",
-            },
-            {
-                id: "review-frontend-cases-final-pi",
-                depends_on: ["revise-frontend-cases-pi"],
-                runIf: "$.nodes['review-frontend-cases-pi'].firstVerdictLine == 'VERDICT: request-revision'",
-                role: "reviewer",
-                executor: "pi",
-                complexity: "HIGH",
-                writePolicy: "read-only",
-                allowedPaths: [...ragWriteSet, ...casesWriteSet],
-                forbiddenPaths: forbidden,
-                outputContract: "First line VERDICT: pass or VERDICT: request-revision after the single allowed case revision; no writes.",
-                subtask_prompt: "Perform the final frontend case review after the sole permitted revision. Apply the same traceability, isolation, manifest, reset, session, snapshot, and evidence checks. First verdict line must be exact; any Important or Critical finding requires request-revision. Do not write files.",
-            },
-            {
-                id: "final-frontend-case-review-gate-shell",
-                depends_on: ["review-frontend-cases-pi", "review-frontend-cases-final-pi"],
-                dependsPolicy: "all-or-condition-skip",
-                role: "verifier",
-                executor: "shell",
-                complexity: "LOW",
-                writePolicy: "read-only",
-                allowedPaths: [...ragWriteSet, ...casesWriteSet],
-                forbiddenPaths: forbidden,
-                outputContract: "Pass-only effective frontend case review gate; final review takes precedence when the revision branch ran.",
-                subtask_prompt: "Authorize manifest materialization only after the effective frontend case review passes.",
-                shell: {
-                    commands: [],
-                    verdictGate: {
-                        fromNodeId: "review-frontend-cases-final-pi",
-                        fallbackFromNodeIds: ["review-frontend-cases-pi"],
-                        accept: ["VERDICT: pass"],
-                        label: "effective frontend case review",
-                        lineMode: "first-verdict-line",
-                    },
-                    cwd: ".",
-                    timeoutMs: 60000,
-                },
-            },
-            {
-                id: "materialize-frontend-case-manifest-shell",
-                depends_on: ["final-frontend-case-review-gate-shell"],
-                role: "verifier",
-                executor: "shell",
-                complexity: "LOW",
-                writePolicy: "exclusive",
-                writeSet: casesWriteSet,
-                allowedPaths: casesWriteSet,
-                forbiddenPaths: forbidden,
-                outputContract: "Validated frontend manifest payload { cases: [...] }; after the review gate, atomically materialize testcase/frontend/cases/manifest.json from manifest.draft.json; shell output may echo only the prefix before exactly one final JSON line.",
-                subtask_prompt: "Validate manifest.draft.json and materialize manifest.json only after the effective frontend case review has passed.",
-                shell: { commands: [manifestValidation], cwd: ".", timeoutMs: 120000 },
-            },
-            {
-                id: "execute-frontend-cases-map",
-                depends_on: ["materialize-frontend-case-manifest-shell"],
-                role: "verifier",
-                executor: "static",
-                complexity: "LOW",
-                writePolicy: "none",
-                allowedPaths: [],
-                forbiddenPaths: forbidden,
-                outputContract: "Serial aggregate of case execution summaries, evidence paths, tokens, and token-budget blocked cases.",
-                subtask_prompt: "Expand and execute the validated frontend case manifest serially.",
-                static: { resultMarkdown: "Frontend case map expansion barrier." },
-                dynamicExpansion: {
-                    type: "map_agent",
-                    workflowNodeId: "execute-frontend-cases-map",
-                    itemsFrom: "$.nodes['materialize-frontend-case-manifest-shell'].output.cases",
-                    itemName: "case",
-                    maxItems: config.maxCasesPerBatch,
-                    maxExpandedNodes: config.maxCasesPerBatch,
-                    childIdPrefix: "execute-frontend-case",
-                    workspaceTemplate: "{{case.evidenceDir}}",
-                    tokenBudget: {
-                        maxTokensPerCase: config.maxTokensPerCase,
-                        maxTotalTokens: config.maxTotalTokens,
-                    },
-                    childTask: {
-                        executor: "pi",
-                        role: "implementer",
-                        skills: ["playwright-cli"],
-                        toolProfile: "write",
-                        complexity: "MED",
-                        writePolicy: "exclusive",
-                        allowedPaths: [
-                            "testcase/frontend/cases/{{case.caseId}}.md",
-                            "testcase/frontend/rag/context.md",
-                            "testcase/frontend/rag/coverage-map.md",
-                            `${evidenceRoot}/{{case.caseId}}/**`,
-                        ],
-                        forbiddenPaths: forbidden,
-                        writeSet: [`${evidenceRoot}/{{case.caseId}}/**`],
-                        outputContract: "Compact JSON <=1200 characters with case status, evidence paths, error summary, and tokens.",
-                        subtaskPromptTemplate: [
-                            "Primary job: EXECUTE case {{case.caseId}} from {{case.casePath}} with skill playwright-cli (fresh Pi session; do not use /new). Prefer playwright-cli over prose review.",
-                            "1) Read baseUrl from testcase/frontend/rag/context.md (config.md preferred, else http://localhost:5173). 2) Start browser: playwright-cli open --browser=chrome --headed <resolved-base-url> (default session only; no -s=). 3) Follow the case steps with snapshot before element refs. 4) If env/CLI/baseUrl is unavailable, write blocked evidence and do not open a browser.",
-                            "Always write {{case.evidenceDir}}execution.md and {{case.evidenceDir}}case-result.json (caseId, status passed|failed|blocked, evidencePaths; blocked needs blockedReason). Then validate: node -e \"const fs=require('fs');const p='{{case.evidenceDir}}';const r=JSON.parse(fs.readFileSync(p+'case-result.json','utf8'));if(!fs.existsSync(p+'execution.md')||r.caseId!=='{{case.caseId}}'||!['passed','failed','blocked'].includes(r.status)||!Array.isArray(r.evidencePaths)||(r.status==='blocked'&&!(typeof r.blockedReason==='string'&&r.blockedReason.trim())))process.exit(1)\".",
-                            "Business failed/blocked is a recorded result, not a node failure. Close browser. Return compact JSON (<=1200 chars): {caseId,status,evidencePaths,errorSummary,tokens}.",
-                        ].join("\n\n"),
-                    },
-                },
-            },
-            {
-                id: "validate-frontend-case-evidence-shell",
-                depends_on: ["execute-frontend-cases-map"],
-                role: "verifier",
-                executor: "shell",
-                complexity: "LOW",
-                writePolicy: "read-only",
-                allowedPaths: ["testcase/frontend/cases/**", `${evidenceRoot}/**`],
-                forbiddenPaths: forbidden,
-                outputContract: "Deterministic validation that every manifest case has execution.md and valid matching case-result.json; blocked results require blockedReason.",
-                subtask_prompt: "Validate all frontend case evidence before evidence review; fail closed on missing or malformed records.",
-                shell: { commands: [evidenceValidation], cwd: ".", timeoutMs: 120000 },
-            },
-            {
-                id: "materialize-frontend-test-result-shell",
-                depends_on: ["validate-frontend-case-evidence-shell"],
-                role: "verifier",
-                executor: "shell",
-                complexity: "LOW",
-                writePolicy: "read-only",
-                allowedPaths: ["testcase/frontend/cases/**", `${evidenceRoot}/**`],
-                forbiddenPaths: forbidden,
-                outputContract: "Run-owned hash-bound frontend-test-result-v1 derived only from the manifest and validated case evidence.",
-                subtask_prompt: "Materialize the authoritative frontend-test-result-v1. Do not use Pi prose or retrospective output as input.",
-                shell: {
-                    commands: [],
-                    jsonArtifactGate: {
-                        fromNodeId: "validate-frontend-case-evidence-shell",
-                        schemaId: "frontend-test-result-v1",
-                        artifactName: "frontend-test-result.json",
-                        outputDir: "contracts",
-                    },
-                    cwd: ".",
-                    timeoutMs: 120000,
-                },
-            },
-            {
-                id: "frontend-test-result-outcome-gate-shell",
-                depends_on: ["materialize-frontend-test-result-shell"],
-                role: "verifier",
-                executor: "shell",
-                complexity: "LOW",
-                writePolicy: "read-only",
-                allowedPaths: [],
-                forbiddenPaths: forbidden,
-                outputContract: "Pass only when the run-owned frontend-test-result-v1 records outcome=passed and integrationMode=real. Does not gate retrospective closeout.",
-                subtask_prompt: "Delivery/Worker gate for authoritative frontend-test result. Retrospective does not depend on this node so failed runs can still write reports.",
-                shell: { commands: [frontendTestOutcomeGate], cwd: ".", timeoutMs: 60000 },
-            },
-            {
-                id: "frontend-test-retrospect-pi",
-                depends_on: ["materialize-frontend-test-result-shell"],
-                role: "closeout",
-                executor: "pi",
-                toolProfile: "write",
-                complexity: "MED",
-                writePolicy: "exclusive",
-                writeSet: ["testcase/frontend/reports/**"],
-                allowedPaths: ["testcase/frontend/**"],
-                forbiddenPaths: forbidden,
-                outputContract: "Write frontend-test retrospective under testcase/frontend/reports/frontend-test-retrospect-<date>.md with coverage, pass/fail/blocked, execution evidence review, risks, findings, and A/B/C/D rating — even when outcome is failed/incomplete.",
-                subtask_prompt: "Write the frontend test retrospective under testcase/frontend/reports/ after result materialization (do not wait for outcome=pass). Combine AC→case→browser-evidence review with the closeout report: coverage, passed/failed/blocked (including token-budget-exhausted), evidence gaps, browser anomalies, residual risks, and A/B/C/D rating. Passed cases need assertion plus screenshot or equivalent evidence when available; failed/blocked need explicit reasons. Blocked cases never count as passed. Do not replace browser evidence with model conclusions. Do not write docs/**.",
-            },
-        ],
+        tasks,
     };
     applyDefaultReadOnlyRetryPolicy(spec);
     parseDagSpec(spec);