@tea-agent/loop-agent 0.16.24 → 0.16.26

package/dist/workflows/dag/backend-test-coverage-contract.js

@@ -0,0 +1,202 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+export const CODE_COVERAGE_SCHEMA_ID = "code-coverage-v1";
+const relativePath = z.string().min(1).refine((value) => !path.posix.isAbsolute(value) &&
+    !value.includes("\\") &&
+    !value.split("/").some((part) => part === "" || part === "." || part === ".."), "path must be a relative POSIX path");
+export const coverageMetricSchema = z.object({
+    status: z.enum(["available", "unavailable"]),
+    covered: z.number().int().min(0).nullable(),
+    total: z.number().int().min(0).nullable(),
+    ratio: z.number().min(0).max(1).nullable(),
+    reason: z.string().min(1).nullable(),
+}).strict();
+export const codeCoverageContractSchema = z.object({
+    schemaVersion: z.literal(1),
+    schemaId: z.literal(CODE_COVERAGE_SCHEMA_ID),
+    language: z.enum(["python", "java"]),
+    format: z.enum(["coverage.py-json", "jacoco-xml"]),
+    tool: z.string().min(1),
+    toolVersion: z.string().min(1).nullable(),
+    sourceScope: z.object({
+        requirementIds: z.array(z.string().regex(/^(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*$/)),
+        paths: z.array(relativePath),
+    }).strict(),
+    commitSha: z.string().regex(/^[a-f0-9]{7,64}$/).nullable(),
+    metrics: z.object({
+        line: coverageMetricSchema,
+        branch: coverageMetricSchema,
+        function: coverageMetricSchema,
+    }).strict(),
+    artifact: z.object({
+        path: relativePath,
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+    }).strict(),
+    missingData: z.array(z.string().min(1)),
+}).strict();
+function metric(covered, total, reason) {
+    if (covered === null || total === null || total === 0) {
+        return { status: "unavailable", covered, total, ratio: null, reason: reason ?? (total === 0 ? "denominator-is-zero" : "metric-missing") };
+    }
+    return { status: "available", covered, total, ratio: covered / total, reason: null };
+}
+function numberValue(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : null;
+}
+function safeArtifactPath(value) {
+    const normalized = value.replaceAll(path.sep, "/");
+    if (path.posix.isAbsolute(normalized) || normalized.split("/").some((part) => part === "" || part === "." || part === "..")) {
+        throw new Error("artifact path must be a safe relative POSIX path");
+    }
+    return normalized;
+}
+function scopeMissing(scope) {
+    return scope.requirementIds.length === 0 ? ["source-scope-requirement-id-missing"] : [];
+}
+function baseContract(options, common) {
+    return {
+        schemaVersion: 1,
+        schemaId: CODE_COVERAGE_SCHEMA_ID,
+        ...common,
+        sourceScope: {
+            requirementIds: [...options.sourceScope.requirementIds],
+            paths: [...options.sourceScope.paths],
+        },
+        commitSha: options.commitSha,
+        artifact: { path: safeArtifactPath(options.artifactPath), sha256: options.artifactSha256 },
+    };
+}
+function parsePythonTotals(input, sourceScope) {
+    if (!input || typeof input !== "object")
+        throw new Error("coverage.py JSON must be an object");
+    const root = input;
+    const totals = root.totals;
+    if (!totals || typeof totals !== "object")
+        throw new Error("coverage.py JSON missing totals");
+    const files = root.files;
+    const scopedFiles = sourceScope.paths.length > 0 && files
+        ? Object.entries(files).filter(([file]) => sourceScope.paths.includes(file.replaceAll("\\", "/")))
+        : [];
+    const usesScopedFiles = sourceScope.paths.length > 0;
+    const values = usesScopedFiles ? scopedFiles.map(([, value]) => value) : null;
+    const get = (key) => {
+        if (values) {
+            let sum = 0;
+            for (const file of values) {
+                const data = file && typeof file === "object" ? file : {};
+                const value = numberValue(data[key]);
+                if (value !== null)
+                    sum += value;
+            }
+            return sum;
+        }
+        if (usesScopedFiles)
+            return null;
+        return numberValue(totals[key]);
+    };
+    return {
+        line: metric(get("covered_lines"), get("num_statements"), null),
+        branch: metric(get("covered_branches"), get("num_branches"), "coverage.py branch data missing"),
+        function: { status: "unavailable", covered: null, total: null, ratio: null, reason: "coverage.py JSON has no function coverage" },
+    };
+}
+function parseJacocoCounters(xml) {
+    const report = xml.match(/<report\b[^>]*>([\s\S]*?)<\/report>/i)?.[1];
+    if (report === undefined)
+        throw new Error("JaCoCo XML missing report root");
+    const reportLevel = report.split(/<(?:group|package)\b/i)[0] ?? "";
+    const counters = new Map();
+    for (const match of reportLevel.matchAll(/<counter\s+[^>]*type="([A-Z]+)"[^>]*missed="(\d+)"[^>]*covered="(\d+)"[^>]*\/>/gi)) {
+        const missed = Number(match[2]);
+        const covered = Number(match[3]);
+        counters.set(match[1].toUpperCase(), { covered, total: covered + missed });
+    }
+    return counters;
+}
+export function parseCoveragePyJson(input, options) {
+    const root = input;
+    const totals = parsePythonTotals(input, options.sourceScope);
+    const missingData = [...scopeMissing(options.sourceScope)];
+    const files = input && typeof input === "object" ? input.files : undefined;
+    if (options.sourceScope.paths.length > 0 && (!files || !options.sourceScope.paths.some((file) => Object.hasOwn(files, file))))
+        missingData.push("source-scope-not-found-in-artifact");
+    if (totals.branch.status === "unavailable")
+        missingData.push("branch-coverage-unavailable");
+    missingData.push("function-coverage-unavailable");
+    return codeCoverageContractSchema.parse({
+        ...baseContract(options, {
+            language: "python",
+            format: "coverage.py-json",
+            tool: "coverage.py",
+            toolVersion: typeof root?.meta?.version === "string" ? root.meta.version : options.toolVersion ?? null,
+        }),
+        metrics: totals,
+        missingData,
+    });
+}
+export function parseJacocoXml(xml, options) {
+    if (!/<report\b/i.test(xml))
+        throw new Error("JaCoCo XML missing report root");
+    const counters = parseJacocoCounters(xml);
+    const line = counters.get("LINE");
+    const branch = counters.get("BRANCH");
+    const method = counters.get("METHOD");
+    const missingData = [...scopeMissing(options.sourceScope)];
+    if (!line)
+        missingData.push("line-coverage-unavailable");
+    if (!branch)
+        missingData.push("branch-coverage-unavailable");
+    if (!method)
+        missingData.push("method-coverage-unavailable");
+    return codeCoverageContractSchema.parse({
+        ...baseContract(options, {
+            language: "java",
+            format: "jacoco-xml",
+            tool: "JaCoCo",
+            toolVersion: options.toolVersion ?? null,
+        }),
+        metrics: {
+            line: line ? metric(line.covered, line.total, null) : metric(null, null, "JaCoCo LINE counter missing"),
+            branch: branch ? metric(branch.covered, branch.total, null) : metric(null, null, "JaCoCo BRANCH counter missing"),
+            function: method ? metric(method.covered, method.total, null) : metric(null, null, "JaCoCo METHOD counter missing"),
+        },
+        missingData,
+    });
+}
+export async function readCoverageArtifact(inputPath, options) {
+    const raw = await readFile(inputPath, "utf8");
+    const artifactSha256 = createHash("sha256").update(raw).digest("hex");
+    const artifactPath = options.artifactPath ?? path.basename(inputPath);
+    const parseOptions = { ...options, artifactPath, artifactSha256 };
+    if (options.sourceScope.paths.some((value) => value.includes("..")))
+        throw new Error("unsafe source scope path");
+    if (inputPath.toLowerCase().endsWith(".xml"))
+        return parseJacocoXml(raw, parseOptions);
+    return parseCoveragePyJson(JSON.parse(raw), parseOptions);
+}
+export function formatCoverageMarkdown(contract) {
+    const row = (name, value) => `| ${name} | ${value.covered ?? "—"} | ${value.total ?? "—"} | ${value.ratio === null ? "unavailable" : `${(value.ratio * 100).toFixed(2)}%`} | ${value.status} | ${value.reason ?? "—"} |`;
+    return [
+        "# Code Coverage Report",
+        "",
+        `- Schema: ${contract.schemaId} v${contract.schemaVersion}`,
+        `- Language: ${contract.language}`,
+        `- Tool: ${contract.tool}${contract.toolVersion ? ` ${contract.toolVersion}` : ""}`,
+        `- Commit: ${contract.commitSha ?? "unavailable"}`,
+        `- Requirement IDs: ${contract.sourceScope.requirementIds.join(", ") || "unavailable"}`,
+        `- Source scope: ${contract.sourceScope.paths.join(", ") || "unavailable"}`,
+        `- Artifact: ${contract.artifact.path}`,
+        `- Artifact SHA-256: ${contract.artifact.sha256}`,
+        "",
+        "| Metric | Covered | Total | Ratio | Status | Reason |",
+        "|---|---:|---:|---:|---|---|",
+        row("Line", contract.metrics.line),
+        row("Branch", contract.metrics.branch),
+        row("Function/Method", contract.metrics.function),
+        "",
+        `Missing data: ${contract.missingData.length ? contract.missingData.join(", ") : "none"}`,
+        "",
+    ].join("\n");
+}

package/dist/workflows/dag/backend-test-execution-contract.js

@@ -334,6 +334,41 @@ function asRecord(value) {
  * Prefer exact schema payloads; otherwise map common discovery shapes onto the
  * pytest-centric runtime contract without inventing secrets or managed commands.
  */
+/** True when managed start is a local node/npm process the adapter cannot host. */
+export function isLocalManagedServerStart(start) {
+    if (!start)
+        return false;
+    const normalized = start.trim().toLowerCase();
+    if (!normalized)
+        return false;
+    return (/\bnpm(\s+run)?\s+start\b/.test(normalized) ||
+        /\bnode\s+server(\.js)?\b/.test(normalized) ||
+        /\bnode\s+\.\/?server(\.js)?\b/.test(normalized) ||
+        /\bbash\s+scripts\/fe-test-server\.sh\b/.test(normalized) ||
+        normalized === "node server.js" ||
+        normalized.includes("server.js"));
+}
+function seedLocalServerFixture(fixtures, managedStart) {
+    if (Array.isArray(fixtures) && fixtures.length > 0) {
+        return fixtures.filter((item) => Boolean(item && typeof item === "object" && !Array.isArray(item)));
+    }
+    if (managedStart.includes("server") || managedStart.includes("npm")) {
+        return [
+            {
+                name: "server-bootstrap",
+                sourcePath: "server.js",
+                kind: "server-bootstrap",
+            },
+        ];
+    }
+    return [
+        {
+            name: "pytest-test-root",
+            sourcePath: BACKEND_TEST_EXECUTION_DEFAULT_TEST_ROOT,
+            kind: "test-root",
+        },
+    ];
+}
 /** Drop empty managedCommand strings; omit block when not managed-command. */
 export function sanitizeBackendTestExecutionInput(value) {
     const record = asRecord(value);
@@ -359,6 +394,51 @@ export function sanitizeBackendTestExecutionInput(value) {
             next.managedCommand = cleaned;
         }
     }
+    // Adapter always executes `python -m pytest testcase/`. Scout-chosen relative roots such as
+    // tests/api/** are product sample trees, not the frozen automation root. Absolute / ..
+    // paths stay untouched so schema materialize remains fail-closed.
+    if (typeof next.testRoot === "string" && next.testRoot.trim()) {
+        const rawRoot = next.testRoot.trim();
+        const normalizedRoot = rawRoot.replace(/\/+$/, "");
+        const looksUnsafe = normalizedRoot.startsWith("/") ||
+            normalizedRoot.includes("..") ||
+            normalizedRoot.includes("\\") ||
+            /^[A-Za-z]:/.test(normalizedRoot);
+        if (!looksUnsafe &&
+            normalizedRoot !== BACKEND_TEST_EXECUTION_DEFAULT_TEST_ROOT) {
+            const gaps = Array.isArray(next.evidenceGaps)
+                ? [...next.evidenceGaps]
+                : [];
+            gaps.push({
+                description: `scout testRoot=${normalizedRoot} remapped to frozen adapter root ${BACKEND_TEST_EXECUTION_DEFAULT_TEST_ROOT}`,
+                sourceRef: "adapter:backend-test-execution",
+            });
+            next.evidenceGaps = gaps;
+            next.testRoot = BACKEND_TEST_EXECUTION_DEFAULT_TEST_ROOT;
+        }
+    }
+    // Local node/npm managed-command is not hosted by the clean-env pytest shell.
+    // Demote to in-process so generate-pytest must bootstrap the server inside fixtures
+    // instead of requiring host-injected base URL env vars that clean env cannot provide.
+    const managedStart = asRecord(next.managedCommand) &&
+        typeof asRecord(next.managedCommand).start === "string"
+        ? String(asRecord(next.managedCommand).start)
+        : "";
+    if (next.targetMode === "managed-command" &&
+        isLocalManagedServerStart(managedStart)) {
+        next.targetMode = "in-process";
+        next.requiredEnvNames = [];
+        next.existingFixtures = seedLocalServerFixture(Array.isArray(next.existingFixtures) ? next.existingFixtures : null, managedStart);
+        const gaps = Array.isArray(next.evidenceGaps)
+            ? [...next.evidenceGaps]
+            : [];
+        gaps.push({
+            description: "local managed-command demoted to in-process: clean-env pytest shell does not start npm/node servers or inject base URL env; tests must bootstrap via fixtures",
+            sourceRef: asRecord(next.managedCommand)?.sourceRef ||
+                "adapter:backend-test-execution",
+        });
+        next.evidenceGaps = gaps;
+    }
     // Near-schema scouts sometimes emit in-process with existingFixtures: [].
     // Only rewrite near-schema payloads here; free-form envelopes keep empty/missing
     // fixtures so coerceBackendTestExecutionInput can map discoveredFixtures first.
@@ -369,23 +449,7 @@ export function sanitizeBackendTestExecutionInput(value) {
     if (nearSchema &&
         (next.targetMode === "in-process" || next.targetMode === undefined) &&
         (!fixtures || fixtures.length === 0)) {
-        const managedStart = asRecord(next.managedCommand) &&
-            typeof asRecord(next.managedCommand).start === "string"
-            ? String(asRecord(next.managedCommand).start)
-            : "";
-        next.existingFixtures = [
-            managedStart.includes("server")
-                ? {
-                    name: "server-bootstrap",
-                    sourcePath: "server.js",
-                    kind: "server-bootstrap",
-                }
-                : {
-                    name: "pytest-test-root",
-                    sourcePath: BACKEND_TEST_EXECUTION_DEFAULT_TEST_ROOT,
-                    kind: "test-root",
-                },
-        ];
+        next.existingFixtures = seedLocalServerFixture(fixtures, managedStart);
         if (next.targetMode === undefined)
             next.targetMode = "in-process";
     }
@@ -631,10 +695,12 @@ export function buildBackendTestExecutionPreflightShellSnippet(options) {
         `console.log("backend-test preflight ok: framework=pytest testRoot="+testRoot+" targetMode="+contract.targetMode);'`,
         ' "${CONTRACT}"',
     ].join("");
+    // Fail-closed: join with && so a preflight exit 2 never continues into pytest.
+    // Historical ";" chains recorded I27-style false progresses (env missing + pytest ran).
     return [
         'test -n "${HARNESS_DAG_RUN_DIR:-}" || { echo "missing HARNESS_DAG_RUN_DIR for backend pytest preflight" >&2; exit 2; }',
         `CONTRACT="\${HARNESS_DAG_RUN_DIR}/${contractRelativePath}"`,
         'test -f "${CONTRACT}" || { echo "missing backend-test execution contract: ${CONTRACT}" >&2; exit 2; }',
         nodePreflight,
-    ].join("; ");
+    ].join(" && ");
 }

package/dist/workflows/dag/backend-test-stability-contract.js

@@ -0,0 +1,57 @@
+import { z } from "zod";
+export const STABILITY_EVIDENCE_SCHEMA_ID = "stability-evidence-v1";
+const runRefSchema = z.object({
+    runId: z.string().min(1),
+    suiteId: z.string().min(1),
+    version: z.string().min(1),
+    commitSha: z.string().regex(/^[a-f0-9]{7,64}$/),
+    success: z.boolean(),
+    resultRef: z.string().min(1),
+}).strict();
+export const stabilityEvidenceSchema = z.object({
+    schemaVersion: z.literal(1),
+    schemaId: z.literal(STABILITY_EVIDENCE_SCHEMA_ID),
+    suiteId: z.string().min(1),
+    version: z.string().min(1),
+    commitSha: z.string().regex(/^[a-f0-9]{7,64}$/),
+    runs: z.array(runRefSchema),
+    recordedRuns: z.number().int().min(0),
+    successfulRuns: z.number().int().min(0),
+    failedRuns: z.number().int().min(0),
+    ratio: z.number().min(0).max(1).nullable(),
+    minimumRuns: z.literal(5),
+    status: z.enum(["available", "unavailable"]),
+    reason: z.string().min(1).nullable(),
+}).strict().superRefine((value, ctx) => {
+    if (value.recordedRuns !== value.runs.length)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "recordedRuns must equal runs.length", path: ["recordedRuns"] });
+    if (value.successfulRuns !== value.runs.filter((run) => run.success).length)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "successfulRuns must match run facts", path: ["successfulRuns"] });
+    if (value.failedRuns !== value.runs.filter((run) => !run.success).length)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "failedRuns must match run facts", path: ["failedRuns"] });
+    for (const [index, run] of value.runs.entries()) {
+        if (run.suiteId !== value.suiteId || run.version !== value.version || run.commitSha !== value.commitSha) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, message: "all runs must bind to the same suite/version/commit", path: ["runs", index] });
+        }
+    }
+    if (value.recordedRuns >= value.minimumRuns && value.ratio === null)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "ratio required when minimum sample is met", path: ["ratio"] });
+});
+export function buildStabilityEvidence(input) {
+    const recordedRuns = input.runs.length;
+    const successfulRuns = input.runs.filter((run) => run.success).length;
+    const failedRuns = recordedRuns - successfulRuns;
+    const status = recordedRuns >= 5 ? "available" : "unavailable";
+    return stabilityEvidenceSchema.parse({
+        schemaVersion: 1,
+        schemaId: STABILITY_EVIDENCE_SCHEMA_ID,
+        ...input,
+        recordedRuns,
+        successfulRuns,
+        failedRuns,
+        ratio: recordedRuns >= 5 ? successfulRuns / recordedRuns : null,
+        minimumRuns: 5,
+        status,
+        reason: recordedRuns >= 5 ? null : "minimum-sample-size-not-met",
+    });
+}

package/dist/workflows/dag/init-hybrid.js

@@ -12,6 +12,7 @@ import { resolveAdapter } from "../../adapters/index.js";
 import { loadHarnessManifest } from "../../governance/harness.js";
 import { buildAuthoritySurfaceAuditNode, buildAuthoritySurfaceGateNode, resolveAuthoritySurfaceAudit, } from "./authority-surface.js";
 import { applySddEmbeddedEnhancements, probeRepoLocalSddSkills, } from "./sdd-embedded.js";
+import { discoverProjectGovernancePresence } from "./project-governance-context.js";
 import { getTaskPaths, loadTaskConfig } from "../../task/runtime.js";
 import { materializeTaskReferenceDocs } from "../../task/source-references.js";
 import { resolveVerifyPreset } from "../../executors/shell-verification.js";
@@ -1105,6 +1106,7 @@ export async function loadTaskHybridSources(repoRoot, taskId) {
         executorModelMatrix: resolveExecutorModelMatrices(manifest),
         verifyCommands,
         sddEmbeddedSkills: await probeRepoLocalSddSkills(repoRoot),
+        projectGovernancePresent: await discoverProjectGovernancePresence(repoRoot),
     };
     return sources;
 }
@@ -2912,6 +2914,8 @@ function buildGenerateBackendPytestNode(sources) {
             "- Validated Backend Test Analysis v1 under the current run contracts/ (analysis gate).",
             "- Validated Backend Test Execution Contract v1 under contracts/backend-test-execution.json (execution gate).",
             "Use only fixture names, env NAMES, testRoot, targetMode, and field/API facts already present in those contracts or reviewed cases. Do not invent production credentials or secret values.",
+            "When targetMode is in-process (including demoted local npm/node managed servers): bootstrap the service inside function-scoped pytest fixtures under testcase/** — e.g. subprocess node server.js / startWelcomeServer with PORT=0 — and never require host-injected base URL env vars (clean-env shell will not provide WELCOME_BASE_URL / API_BASE_URL).",
+            "Do not depend on requiredEnvNames being present at process start for in-process mode; if the contract still lists an env name, the fixture must set it or start the server without that env.",
             "",
             "## Output Steps (do in order):",
             "1. First, output a brief summary: how many files, how many test functions planned",
@@ -3062,8 +3066,9 @@ function buildExecuteBackendPytestNode(sources, options = {}) {
     const reportStem = options.reportStem ?? "backend-test";
     const reportName = `${reportStem}-junit.xml`;
     const exitName = `${reportStem}-pytest-exit.txt`;
-    const pytestCommand = [
-        preflightCommand,
+    // Preflight snippet is already fail-closed (&&). Only the pytest body may use
+    // ";" so STATUS capture still runs after non-zero pytest exits.
+    const pytestBody = [
         `REPORT="\${HARNESS_DAG_RUN_DIR}/reports/${reportName}"`,
         `EXIT_FILE="\${HARNESS_DAG_RUN_DIR}/reports/${exitName}"`,
         'mkdir -p "$(dirname "${REPORT}")"',
@@ -3075,6 +3080,7 @@ function buildExecuteBackendPytestNode(sources, options = {}) {
         'if { [ "${STATUS}" -eq 0 ] || [ "${STATUS}" -eq 1 ]; } && [ -s "${REPORT}" ]; then exit 0; fi',
         'exit "${STATUS}"',
     ].join("; ");
+    const pytestCommand = `${preflightCommand} && { ${pytestBody}; }`;
     return {
         id: nodeId,
         depends_on: options.dependsOn ?? [
@@ -3168,21 +3174,24 @@ function buildTestRetrospectNode(sources) {
             "## Stats authority (deterministic only):",
             "- Pass rate, failed/error/skipped counts, and failure list MUST come from contracts/backend-test-result.json only.",
             "- AC coverage ratio / case counts MUST come from contracts/backend-test-case-manifest.json coverageSummary (or gate-derived fields). Do NOT invent coverage %.",
+            "- Automation coverage MUST use coverageSummary.generatedCount / coverageSummary.caseCount. If either field is missing, write unavailable; do not estimate.",
+            "- Code coverage MUST come only from the validated contracts/code-coverage-v1.json artifact generated by coverage.py/pytest-cov or JaCoCo. Show line, branch, function/method, covered, total, ratio, threshold, status, source scope, requirement IDs, tool, commit, and artifact hash.",
+            "- Stability MUST come from independent Stability Evidence: use successfulRuns / recordedRuns, same suite/version, and require n≥5; a single run is unavailable.",
             "- Use classify-backend-test-result-pi JSON as interpretive evidence only.",
             "- NEVER rewrite a failed result as passed. Outcome gate (not this report) is authoritative for task success.",
             "",
             "## Report Structure:",
             "1. Maturity Rating with rationale",
-            "2. Test Coverage Summary (manifest coverageSummary + Result v1 pass rate)",
-            "3. Review Findings and resolution status",
-            "4. Failed Test Analysis (if any) + classification category",
-            "5. Recommendations for improvement",
+            "2. Test Coverage Summary (Result v1 pass rate, AC coverage, automation coverage, code coverage, and stability evidence)",
+            "3. Failed Test Analysis (failure/error details, category, confidence, evidence, and owner direction)",
+            "4. Defects (local Bug ledger in the same report directory; unavailable when absent)",
+            "5. Risks (Critical/High/Medium/Low, impact, controls, residual risk, treatment; Critical risks block L-5, High risks do not automatically block)",
+            "6. Regression Recommendations (immediate, related, periodic, deferred; every item links to failure/risk/AC/case IDs)",
+            "7. L-5 conclusion with blocking items",
             "",
             "## Rating Criteria:",
-            "- A: coverageSummary.acCoverageRatio=1 + 100% pytest pass + no Critical findings",
-            "- B: acCoverageRatio≥0.8 + ≥90% pass + Low findings only",
-            "- C: acCoverageRatio≥0.6 + ≥70% pass + no Critical findings",
-            "- D: below C thresholds",
+            "- L-5 ready requires pass rate=100%, AC coverage=100%, automation coverage≥90%, stability≥95% with n≥5, line coverage≥80%, branch coverage≥70%, skipped=0, and no blocking Critical risk.",
+            "- Any required metric fail or unavailable means L-5 not-ready. Function/method coverage is displayed but not a gate. Preserve the existing A/B/C/D single-run rating separately.",
             "",
             "## Constraints:",
             canWriteReport
@@ -3197,7 +3206,7 @@ function buildBackendTestOutcomeGateNode(sources) {
     const gateCommand = buildBackendTestOutcomeGateShellSnippet();
     return {
         id: "backend-test-outcome-gate-shell",
-        depends_on: ["test-retrospect-pi"],
+        depends_on: ["l5-metrics-pi"],
         role: "verifier",
         executor: "shell",
         complexity: "LOW",
@@ -3220,6 +3229,30 @@ function buildBackendTestOutcomeGateNode(sources) {
         },
     };
 }
+function buildL5MetricsNode(sources) {
+    return {
+        id: "l5-metrics-pi",
+        depends_on: ["test-retrospect-pi"],
+        role: "reviewer",
+        executor: "pi",
+        complexity: "MED",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Exactly one JSON object with status=ready|not-ready, metrics, and blockingItems; no file writes.",
+        subtask_prompt: [
+            "You are the independent L-5 metrics node at the end of the existing backend-test DAG.",
+            "The direct upstream test-retrospect-pi output is the primary report to assess. Read it together with the run-owned Result v1, Case Manifest v1, Code Coverage v1, and Stability Evidence artifacts when present.",
+            "Do not create a new DAG, rewrite the retrospective report, change test outcome, or modify any repository file.",
+            "Return exactly one JSON object and no surrounding prose.",
+            "Required shape: {\"status\":\"ready\"|\"not-ready\",\"metrics\":{\"passRate\":metric,\"acCoverage\":metric,\"automationCoverage\":metric,\"stability\":metric,\"lineCoverage\":metric,\"branchCoverage\":metric,\"skipped\":metric,\"criticalRisks\":metric},\"blockingItems\":[string]}.",
+            "Each metric must contain numerator, denominator, ratio, threshold, status=pass|fail|unavailable, and reason (null only when passed).",
+            "Use only explicit evidence. Missing or invalid required evidence is unavailable, never zero or an estimate.",
+            "L-5 ready requires pass rate=100%, AC coverage=100%, automation coverage>=90%, stability>=95% with n>=5, line coverage>=80%, branch coverage>=70%, skipped=0, and zero blocking Critical risks.",
+            "Function/method coverage is display-only and does not gate L-5. Preserve the distinction between L-5 maturity and the Result v1 outcome gate.",
+        ].join("\n\n"),
+    };
+}
 const BACKEND_TEST_DEFAULTS = {
     ...HYBRID_DEFAULTS,
     writePolicy: "read-only",
@@ -3237,7 +3270,7 @@ function buildBackendTestHybridDag(sources) {
     const globalConstraints = [
         ...taskConfig.hardConstraints,
         ...STANDARD_GLOBAL_CONSTRAINTS,
-        "backend-test-dag uses exactly 15 real top-level tasks and executes pytest exactly once.",
+        "backend-test-dag uses exactly 16 real top-level tasks and executes pytest exactly once.",
         "Case and semantic request-revision verdicts fail at deterministic gates; no in-run revision or repair writer is authorized.",
         "Analysis, execution, manifest, semantic review, single-run result, classification, canonical result, retrospective and outcome evidence remain run-owned and fail-closed.",
         "Functional test case IDs must use BE-<MODULE>-<NNN> format.",
@@ -3301,8 +3334,10 @@ function buildBackendTestHybridDag(sources) {
     const retrospect = buildTestRetrospectNode(sources);
     retrospect.depends_on = [context.id];
     retrospect.subtask_prompt = retrospect.subtask_prompt.replaceAll("select-effective-backend-test-result-shell", context.id);
+    const l5Metrics = buildL5MetricsNode(sources);
+    l5Metrics.depends_on = [retrospect.id];
     const outcome = buildBackendTestOutcomeGateNode(sources);
-    const tasks = [analyze, contracts, generateCases, manifest, reviewCases, caseGate, generatePytest, semanticReview, semanticMaterialize, semanticGate, execute, classify, context, retrospect, outcome];
+    const tasks = [analyze, contracts, generateCases, manifest, reviewCases, caseGate, generatePytest, semanticReview, semanticMaterialize, semanticGate, execute, classify, context, retrospect, l5Metrics, outcome];
     const spec = { version: 3, title: `Backend test DAG: ${taskConfig.title}`, runtimeContract: GENERATED_DAG_RUNTIME_CONTRACT, outputLanguage: sources.outputLanguage ?? DEFAULT_DAG_OUTPUT_LANGUAGE, objective: extractObjective(sources.requirementMarkdown, taskConfig.title), successCriteria: extractSuccessCriteria(sources.requirementMarkdown, sources.taskId), globalConstraints, defaults: { ...BACKEND_TEST_DEFAULTS, contextProfile: taskConfig.contextProfile }, skillsByRole: BACKEND_TEST_SKILLS_BY_ROLE, executorModels: sources.executorModelMatrix ?? DEFAULT_DAG_EXECUTOR_MODELS, tasks };
     applyDefaultReadOnlyRetryPolicy(spec);
     parseDagSpec(spec);
@@ -4630,11 +4665,35 @@ function buildHybridDagForTemplate(sources, template) {
         else
             spec = buildSupervisedHybridDag(standard, sources);
     }
+    applyProjectGovernanceReview(spec, template, sources);
     spec.sourceBinding = buildDagSourceBinding(sources);
+    assertNoGovernanceFlagOnDisallowedTemplate(spec, template);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
 }
+const GOVERNANCE_DISALLOWED_TEMPLATES = new Set([
+    "frontend-implementation",
+    "frontend-test-dag",
+    "backend-test-dag",
+    "knowledge-sync-dag",
+    "knowledge-graph-bootstrap-dag",
+]);
+/**
+ * Generate-time guard (constraint 2 / AC-007): the governance standard review
+ * flag must never appear on knowledge-sync, knowledge-graph-bootstrap,
+ * backend-test, or frontend tasks. Only standard verify-pi and the shared
+ * review-pi (reviewed/supervised) opt in explicitly.
+ */
+function assertNoGovernanceFlagOnDisallowedTemplate(spec, template) {
+    if (!GOVERNANCE_DISALLOWED_TEMPLATES.has(template))
+        return;
+    for (const task of spec.tasks) {
+        if (task.governanceStandardReview) {
+            throw new Error(`governanceStandardReview must not be set on ${template} task ${task.id}`);
+        }
+    }
+}
 export function buildHybridDagFromTask(sources, options = {}) {
     const selection = resolveTaskDagTemplateSelection({
         taskKind: sources.taskConfig.taskKind,
@@ -4758,6 +4817,84 @@ function buildReviewGateNode(sources) {
         },
     };
 }
+function enableProjectGovernanceOnNode(task) {
+    task.governanceStandardReview = true;
+}
+/**
+ * Apply governance only to general implementation DAGs, and only when the
+ * target repository actually contains AGENTS.md. Standard reuses verify-pi;
+ * reviewed/supervised reuse review-pi and their existing review verdict gate.
+ */
+function applyProjectGovernanceReview(spec, template, sources) {
+    if (!sources.projectGovernancePresent)
+        return;
+    if (template === "standard-dag") {
+        const verify = spec.tasks.find((task) => task.id === "verify-pi");
+        if (!verify)
+            return;
+        enableProjectGovernanceOnNode(verify);
+        insertGovernanceStandardGate(spec, sources);
+        return;
+    }
+    if (template === "review-gated-dag" || template === "supervised-implementation") {
+        const review = spec.tasks.find((task) => task.id === "review-pi");
+        if (review)
+            enableProjectGovernanceOnNode(review);
+    }
+}
+/**
+ * Deterministic governance standard gate for standard-dag closeout. It reuses
+ * the standard `verdictGate` preset (fromNodeId=verify-pi, accept
+ * ["VERDICT: pass"], first-verdict-line). When no applicable AGENTS.md/standard
+ * exists, projectGovernanceGate returns success without parsing a verdict.
+ * When an applicable mandatory standard is violated, verify-pi must emit
+ * VERDICT: request-revision and the gate blocks closeout. No new model node.
+ */
+function buildGovernanceStandardGateNode(sources) {
+    return {
+        id: "governance-standard-gate-shell",
+        depends_on: ["verify-pi"],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Deterministic governance verdict gate: exit 0 only when verify-pi first VERDICT line is pass (covers applicable mandatory standard compliance). No file writes.",
+        subtask_prompt: "Deterministic gate: block closeout unless verify-pi emitted VERDICT: pass, which requires no unresolved applicable mandatory governance-standard violation. Read-only: do not modify files.",
+        shell: {
+            commands: [],
+            projectGovernanceGate: {
+                contextPath: ".runtime/project-governance-context.json",
+            },
+            verdictGate: {
+                fromNodeId: "verify-pi",
+                accept: ["VERDICT: pass"],
+                label: "governance-standard",
+                lineMode: "first-verdict-line",
+            },
+            cwd: ".",
+            timeoutMs: 60000,
+        },
+    };
+}
+/**
+ * Insert the governance-standard gate between verify-pi and closeout-pi in a
+ * standard DAG. Idempotent and no-op if verify-pi/closeout-pi are absent.
+ */
+function insertGovernanceStandardGate(spec, sources) {
+    const closeout = spec.tasks.find((task) => task.id === "closeout-pi");
+    const verify = spec.tasks.find((task) => task.id === "verify-pi");
+    if (!closeout || !verify)
+        return;
+    if (spec.tasks.some((task) => task.id === "governance-standard-gate-shell")) {
+        return;
+    }
+    const gate = buildGovernanceStandardGateNode(sources);
+    const closeoutIndex = spec.tasks.findIndex((task) => task.id === "closeout-pi");
+    spec.tasks.splice(closeoutIndex, 0, gate);
+    closeout.depends_on = ["governance-standard-gate-shell"];
+}
 function buildReviewGatedHybridDag(standard, sources) {
     const spec = {
         ...standard,