@tea-agent/loop-agent 0.16.26 → 0.17.1

package/docs/templates/backend-test-dag.json

@@ -28,9 +28,10 @@
     "Root artifacts/ is reserved for explicit exclusive write nodes, not read-only scout/reviewer output",
     "exclusive implementer nodes must use narrow, concrete writeSet paths; never keep ** or repo root",
     "Replace REPLACE/WITH/NARROW/IMPLEMENT/PATHS/** with concrete paths before executing the implementation writer",
-    "backend-test-dag uses exactly 16 real top-level tasks and executes pytest exactly once.",
-    "Case and semantic request-revision verdicts fail at deterministic gates; no in-run revision or repair writer is authorized.",
-    "Analysis, execution, manifest, semantic review, single-run result, classification, canonical result, retrospective and outcome evidence remain run-owned and fail-closed.",
+    "backend-test-dag uses exactly 12 real top-level tasks and executes pytest exactly once.",
+    "Case review is advisory evidence consumed by canonical context, retrospective, and L-5; it does not authorize or block the pytest writer.",
+    "Deterministic traceability is the only generated-asset hard gate before pytest.",
+    "Analysis, execution, manifest, case review, traceability, single-run result, classification, canonical context, retrospective and L-5 evidence remain run-owned and fail-closed.",
     "Functional test case IDs must use BE-<MODULE>-<NNN> format.",
     "pytest writers may only create the initially declared testcase assets; production code, config, skip/xfail, swallowed failures and mock substitution are forbidden."
   ],
@@ -68,8 +69,8 @@
   "executorModels": {
     "pi": {
       "LOW": "gpt-5.3-codex-spark",
-      "MED": "grok-4.5",
-      "HIGH": "gpt-5.6-sol"
+      "MED": "glm-5.2",
+      "HIGH": "gpt-5.5"
     }
   },
   "tasks": [
@@ -191,7 +192,8 @@
       "id": "review-backend-cases-pi",
       "depends_on": [
         "backend-test-case-manifest-shell",
-        "validate-backend-test-contracts-shell"
+        "validate-backend-test-contracts-shell",
+        "generate-backend-pytest-pi"
       ],
       "role": "reviewer",
       "executor": "pi",
@@ -206,8 +208,8 @@
         ".harness/dag-runs/**",
         "artifacts/**"
       ],
-      "outputContract": "Plain Markdown whose first non-empty line is VERDICT: pass or VERDICT: request-revision; followed by Findings and Coverage Assessment. No file writes. The deterministic gate accepts pass only; request-revision ends this run.",
-      "subtask_prompt": "Review the generated backend functional test cases under testcase/md/ and the validated Case Manifest v1.\n\n## Mandatory First Line:\n\nFirst non-empty line must be exactly: VERDICT: pass or VERDICT: request-revision\n\n## Review Checklist:\n\n- ID format: every case uses BE-<MODULE>-<NNN> (full ids only in bodies and matrices)\n\n- Positive coverage: each in-scope acceptance criterion (AC-xxx) has happy-path case\n\n- Negative coverage: error scenarios (invalid input, not found, state violations)\n\n- Traceability: each explicit AC maps to a case ID or an evidenceGap in contracts/backend-test-case-manifest.json\n\n- Case structure: ID, Title, Precondition, Steps, Expected Result\n\n- No duplicate IDs across files\n\n- Manifest consistency (Critical): every AC claimed in MD case bodies/matrices must match manifest caseId→acIds; never accept 'all cases cover AC-xxx' unless every case maps that AC\n\n## Conditional Coverage (check ONLY if mentioned in upstream analysis):\n\n- Boundary coverage: check ONLY if analyze-inputs-pi mentions value ranges, length limits, numeric bounds, or format constraints\n\n- State transition coverage: check ONLY if analyze-inputs-pi mentions state machine\n\n- Authentication coverage: check ONLY if analyze-inputs-pi mentions auth mechanism\n\n- Timeout coverage: check ONLY if analyze-inputs-pi mentions timeout handling\n\n- Concurrency coverage: check ONLY if analyze-inputs-pi mentions concurrency/idempotency rules\n\n- If not mentioned, do NOT flag as missing\n\n## Do NOT treat as Critical alone:\n\n- Missing test_*.py / automation still planned (expected before generate-backend-pytest-pi)\n\n- Out-of-scope ACs already listed in manifest evidenceGaps (Flyway, frontend e2e, mvn test)\n\n## Verdict Rules:\n\n- All Critical checks pass + Important findings ≤ 2 → VERDICT: pass\n\n- Any Critical fails OR Important > 2 → VERDICT: request-revision\n\n- Any request-revision verdict ends the current run at the deterministic gate; describe findings clearly for an independent follow-up task.\n\n## Output After Verdict:\n\n1. Coverage Assessment table (AC → full BE-* case IDs) using manifest + MD\n\n2. Findings list (Critical/Important/Informational)\n\n3. Statistics (total cases, positive/negative/boundary breakdown)\n\n4. Required follow-up actions (only when request-revision; no in-run writer)\n\n## Constraints:\n\n- Read-only: do not modify files\n\n- Read validated analysis + case manifest artifacts; do not recompute coverage percentages\n\n- Use testcase/md/ files for case review",
+      "outputContract": "advisory case review evidence whose first non-empty line is VERDICT: pass or VERDICT: request-revision; followed by Findings and Coverage Assessment. No file writes; this review neither authorizes nor blocks pytest generation.",
+      "subtask_prompt": "Review the generated backend functional test cases under testcase/md/ and the validated Case Manifest v1.\n\n## Mandatory First Line:\n\nFirst non-empty line must be exactly: VERDICT: pass or VERDICT: request-revision\n\n## Review Checklist:\n\n- ID format: every case uses BE-<MODULE>-<NNN> (full ids only in bodies and matrices)\n\n- Positive coverage: each in-scope acceptance criterion (AC-xxx) has happy-path case\n\n- Negative coverage: error scenarios (invalid input, not found, state violations)\n\n- Traceability: each explicit AC maps to a case ID or an evidenceGap in contracts/backend-test-case-manifest.json\n\n- Case structure: ID, Title, Precondition, Steps, Expected Result\n\n- No duplicate IDs across files\n\n- Manifest consistency (Critical): every AC claimed in MD case bodies/matrices must match manifest caseId→acIds; never accept 'all cases cover AC-xxx' unless every case maps that AC\n\n## Conditional Coverage (check ONLY if mentioned in upstream analysis):\n\n- Boundary coverage: check ONLY if analyze-inputs-pi mentions value ranges, length limits, numeric bounds, or format constraints\n\n- State transition coverage: check ONLY if analyze-inputs-pi mentions state machine\n\n- Authentication coverage: check ONLY if analyze-inputs-pi mentions auth mechanism\n\n- Timeout coverage: check ONLY if analyze-inputs-pi mentions timeout handling\n\n- Concurrency coverage: check ONLY if analyze-inputs-pi mentions concurrency/idempotency rules\n\n- If not mentioned, do NOT flag as missing\n\n## Do NOT treat as Critical alone:\n\n- Missing test_*.py / automation still planned (expected before generate-backend-pytest-pi)\n\n- Out-of-scope ACs already listed in manifest evidenceGaps (Flyway, frontend e2e, mvn test)\n\n## Verdict Rules:\n\n- All Critical checks pass + Important findings ≤ 2 → VERDICT: pass\n\n- Any Critical fails OR Important > 2 → VERDICT: request-revision\n\n- Any request-revision verdict is advisory evidence for canonical context, retrospective, and L-5; it does not authorize or block the pytest writer.\n\n## Output After Verdict:\n\n1. Coverage Assessment table (AC → full BE-* case IDs) using manifest + MD\n\n2. Findings list (Critical/Important/Informational)\n\n3. Statistics (total cases, positive/negative/boundary breakdown)\n\n4. Required follow-up actions (only when request-revision; no in-run writer)\n\n## Constraints:\n\n- Read-only: do not modify files\n\n- Read validated analysis + case manifest artifacts; do not recompute coverage percentages\n\n- Use testcase/md/ files for case review",
       "retryPolicy": {
         "maxAttempts": 3,
         "backoff": "exponential",
@@ -221,44 +223,10 @@
         ]
       }
     },
-    {
-      "id": "review-backend-cases-gate-shell",
-      "depends_on": [
-        "review-backend-cases-pi"
-      ],
-      "role": "verifier",
-      "executor": "shell",
-      "complexity": "LOW",
-      "writePolicy": "read-only",
-      "allowedPaths": [
-        "testcase/**",
-        "docs/test-reports/**"
-      ],
-      "forbiddenPaths": [
-        ".harness/**",
-        ".harness/dag-runs/**",
-        "artifacts/**"
-      ],
-      "outputContract": "Deterministic backend case review gate: exit 0 only when the first and only review emits VERDICT: pass.",
-      "subtask_prompt": "Block pytest generation when backend case review requests revision; do not authorize an in-run writer.",
-      "shell": {
-        "commands": [],
-        "verdictGate": {
-          "fromNodeId": "review-backend-cases-pi",
-          "accept": [
-            "VERDICT: pass"
-          ],
-          "label": "backend case review",
-          "lineMode": "first-verdict-line"
-        },
-        "cwd": ".",
-        "timeoutMs": 60000
-      }
-    },
     {
       "id": "generate-backend-pytest-pi",
       "depends_on": [
-        "review-backend-cases-gate-shell",
+        "backend-test-case-manifest-shell",
         "validate-backend-test-contracts-shell"
       ],
       "role": "implementer",
@@ -280,48 +248,15 @@
         ".harness/dag-runs/**",
         "artifacts/**"
       ],
-      "subtask_prompt": "Convert the reviewed test cases under testcase/md/ into pytest automation code.\n\n\n\n## Inputs (MUST use validated contracts):\n\n- Reviewed cases under testcase/md/ (after review-backend-cases-gate-shell).\n\n- Validated Backend Test Analysis v1 under the current run contracts/ (analysis gate).\n\n- Validated Backend Test Execution Contract v1 under contracts/backend-test-execution.json (execution gate).\n\nUse only fixture names, env NAMES, testRoot, targetMode, and field/API facts already present in those contracts or reviewed cases. Do not invent production credentials or secret values.\n\nWhen targetMode is in-process (including demoted local npm/node managed servers): bootstrap the service inside function-scoped pytest fixtures under testcase/** — e.g. subprocess node server.js / startWelcomeServer with PORT=0 — and never require host-injected base URL env vars (clean-env shell will not provide WELCOME_BASE_URL / API_BASE_URL).\n\nDo not depend on requiredEnvNames being present at process start for in-process mode; if the contract still lists an env name, the fixture must set it or start the server without that env.\n\n\n\n## Output Steps (do in order):\n\n1. First, output a brief summary: how many files, how many test functions planned\n\n2. Then write each test file under testcase/\n\n\n\n## Format Rules:\n\n- File prefix: test_<module>.py\n\n- Function name: test_BE_<MODULE>_<NNN>_<description>\n\n- Docstring first line: BE-<MODULE>-<NNN>: <Case Title>\n\n- 1:1 mapping: each functional case → one pytest function\n\n\n\n## Implementation Rules:\n\n- Use assert statements, not unittest assertions\n\n- Use @pytest.mark.parametrize for boundary cases when the case defines edge values\n\n- Use markers: @pytest.mark.positive, @pytest.mark.negative, @pytest.mark.boundary\n\n\n\n## Test Data Preparation Rules (MUST follow):\n\n\n\n### When Setup is Needed\n\nSetup phase is REQUIRED only when test cases need pre-existing data:\n\n- Query/Read APIs: need data to exist before querying\n\n- Update/Delete APIs: need data to exist before modifying\n\n- State transition tests: need data in specific state\n\n\n\nSetup phase is NOT needed for:\n\n- Create APIs: testing the creation itself\n\n- Validation tests: testing input validation with invalid data\n\n\n\n### Data Setup Strategy\n\nWhen setup is needed:\n\n1. Prefer function-scoped fixtures for isolation; use module/session scope only when cases explicitly share immutable fixtures\n\n2. Prefer API-based setup from the upstream analyze-inputs-pi API list and reviewed cases\n\n3. If a required helper/factory is missing, create NEW files only under testcase/**/helpers/** or testcase/**/factories/**\n\n\n\n### Data Construction Priority\n\n1. API-first: construct data via documented APIs from analyze-inputs-pi / reviewed cases\n\n2. Reuse existing conftest fixtures when present (read-only)\n\n3. Direct DB writes are LAST RESORT and only if conftest already exposes a safe test DB fixture with rollback/isolation\n\n4. If neither API nor safe DB fixture exists, skip the case with an explicit gap note — do NOT invent production DB credentials or write live data\n\n\n\n### API Data Construction\n\n- Prefer the analyze-inputs-pi API Endpoints section and reviewed cases for method/path/fields\n\n- Chain API calls only when cases document multi-step preconditions\n\n- Store created resource IDs in fixtures for reuse\n\n- Do NOT broadly search host route/controller trees for secrets, .env, private keys, or production configs\n\n- Read host API definitions only when needed to resolve a field name already referenced by reviewed cases; stay out of credential/config paths\n\n\n\n### Database Data Construction (restricted)\n\n- Allowed only via existing conftest test-DB fixtures with transaction rollback or equivalent isolation\n\n- Never hardcode connection strings, passwords, tokens, or cloud credentials\n\n- Never target production/shared non-test databases\n\n- If isolation is unclear, report the gap instead of writing DB rows\n\n\n\n## Assertion Rules (MUST follow):\n\n\n\n### Positive Path\n\nMUST assert ALL of the following:\n\n1. HTTP status code: as defined in API spec (e.g. 200, 201)\n\n2. Response structure: key fields exist in response body\n\n3. Specific values: each field equals expected value from test case\n\n4. Data type: each field is correct type\n\n\n\n### Negative Path\n\nMUST assert ALL of the following:\n\n1. HTTP status code: as defined in API spec (e.g. 400, 404, 500)\n\n2. Error code field: field name from API spec (e.g. code, error_code, errcode, ret)\n\n3. Error message field: field name from API spec (e.g. message, msg, errmsg, error)\n\n\n\n### Field Name Resolution\n\nField names MUST come from the upstream analyze-inputs-pi output (API Endpoints section) or reviewed cases, NOT guessed. For example:\n\n- If API spec defines {\"ret\": 0, \"msg\": \"success\"}, assert response.json()['ret'] and response.json()['msg']\n\n- If API spec defines {\"code\": 4001, \"message\": \"error\"}, assert response.json()['code'] and response.json()['message']\n\n\n\n## Conditional Implementation (include ONLY if test cases exist):\n\n- Authentication tests: implement ONLY if testcase/md/ contains auth-related cases\n\n- Timeout tests: implement ONLY if testcase/md/ contains timeout-related cases\n\n- Boundary tests: implement ONLY when cases define value ranges, length limits, or format constraints\n\n- Use @pytest.mark.auth for auth tests, @pytest.mark.timeout for timeout tests\n\n- If no such cases exist, do NOT add these tests\n\n\n\n## Constraints:\n\n- Only create NEW files under writeSet: testcase/**/test_*.py, testcase/**/helpers/**, testcase/**/factories/**\n\n- Do NOT modify existing framework files (conftest.py, pytest.ini, pyproject.toml, setup.cfg, __init__.py)\n\n- If a test filename exists, add suffix: test_order.py → test_order_01.py\n\n- Do NOT re-read source documents — use reviewed cases under testcase/md/ and upstream analyze-inputs-pi output only\n\n- Read existing conftest.py/pytest.ini to understand conventions, but do NOT modify them\n\n- Do NOT execute pytest/python -m pytest or npm test in this node; the single execution is owned by the dedicated shell node. Local smoke runs create __pycache__/.pytest_cache and are unnecessary here."
+      "subtask_prompt": "Convert the validated test cases under testcase/md/ into pytest automation code.\n\n\n\n## Inputs (MUST use validated contracts):\n\n- Validated cases under testcase/md/ and contracts/backend-test-case-manifest.json (case review runs independently as advisory evidence).\n\n- Validated Backend Test Analysis v2 under contracts/backend-test-analysis.json.\n\n\n\n- Validated Backend Test Execution Contract v1 under contracts/backend-test-execution.json (execution gate).\n\nUse only fixture names, env NAMES, testRoot, targetMode, and field/API facts already present in those contracts or reviewed cases. Do not invent production credentials or secret values.\n\nWhen targetMode is in-process (including demoted local npm/node managed servers): bootstrap the service inside function-scoped pytest fixtures under testcase/** — e.g. subprocess node server.js / startWelcomeServer with PORT=0 — and never require host-injected base URL env vars (clean-env shell will not provide WELCOME_BASE_URL / API_BASE_URL).\n\nDo not depend on requiredEnvNames being present at process start for in-process mode; if the contract still lists an env name, the fixture must set it or start the server without that env.\n\n\n\n## Output Steps (do in order):\n\n1. First, output a brief summary: how many files, how many test functions planned\n\n2. Then write each test file under testcase/\n\n\n\n## Format Rules:\n\n- File prefix: test_<module>.py\n\n- Function name: test_BE_<MODULE>_<NNN>_<description>\n\n- Docstring first line: BE-<MODULE>-<NNN>: <Case Title>\n\n- 1:1 mapping: each functional case → one pytest function\n\n\n\n## Implementation Rules:\n\n- Use assert statements, not unittest assertions\n\n- Use @pytest.mark.parametrize for boundary cases when the case defines edge values\n\n- Use markers: @pytest.mark.positive, @pytest.mark.negative, @pytest.mark.boundary\n\n\n\n## Test Data Preparation Rules (MUST follow):\n\n\n\n### When Setup is Needed\n\nSetup phase is REQUIRED only when test cases need pre-existing data:\n\n- Query/Read APIs: need data to exist before querying\n\n- Update/Delete APIs: need data to exist before modifying\n\n- State transition tests: need data in specific state\n\n\n\nSetup phase is NOT needed for:\n\n- Create APIs: testing the creation itself\n\n- Validation tests: testing input validation with invalid data\n\n\n\n### Data Setup Strategy\n\nWhen setup is needed:\n\n1. Prefer function-scoped fixtures for isolation; use module/session scope only when cases explicitly share immutable fixtures\n\n2. Prefer API-based setup from the upstream analyze-inputs-pi API list and reviewed cases\n\n3. If a required helper/factory is missing, create NEW files only under testcase/**/helpers/** or testcase/**/factories/**\n\n\n\n### Data Construction Priority\n\n1. API-first: construct data via documented APIs from analyze-inputs-pi / reviewed cases\n\n2. Reuse existing conftest fixtures when present (read-only)\n\n3. Direct DB writes are LAST RESORT and only if conftest already exposes a safe test DB fixture with rollback/isolation\n\n4. If neither API nor safe DB fixture exists, skip the case with an explicit gap note — do NOT invent production DB credentials or write live data\n\n\n\n### API Data Construction\n\n- Prefer the analyze-inputs-pi API Endpoints section and reviewed cases for method/path/fields\n\n- Chain API calls only when cases document multi-step preconditions\n\n- Store created resource IDs in fixtures for reuse\n\n- Do NOT broadly search host route/controller trees for secrets, .env, private keys, or production configs\n\n- Read host API definitions only when needed to resolve a field name already referenced by reviewed cases; stay out of credential/config paths\n\n\n\n### Database Data Construction (restricted)\n\n- Allowed only via existing conftest test-DB fixtures with transaction rollback or equivalent isolation\n\n- Never hardcode connection strings, passwords, tokens, or cloud credentials\n\n- Never target production/shared non-test databases\n\n- If isolation is unclear, report the gap instead of writing DB rows\n\n\n\n## Assertion Rules (MUST follow):\n\n\n\n### Positive Path\n\nMUST assert ALL of the following:\n\n1. HTTP status code: as defined in API spec (e.g. 200, 201)\n\n2. Response structure: key fields exist in response body\n\n3. Specific values: each field equals expected value from test case\n\n4. Data type: each field is correct type\n\n\n\n### Negative Path\n\nMUST assert ALL of the following:\n\n1. HTTP status code: as defined in API spec (e.g. 400, 404, 500)\n\n2. Error code field: field name from API spec (e.g. code, error_code, errcode, ret)\n\n3. Error message field: field name from API spec (e.g. message, msg, errmsg, error)\n\n\n\n### Field Name Resolution\n\nField names MUST come from the upstream analyze-inputs-pi output (API Endpoints section) or reviewed cases, NOT guessed. For example:\n\n- If API spec defines {\"ret\": 0, \"msg\": \"success\"}, assert response.json()['ret'] and response.json()['msg']\n\n- If API spec defines {\"code\": 4001, \"message\": \"error\"}, assert response.json()['code'] and response.json()['message']\n\n\n\n## Conditional Implementation (include ONLY if test cases exist):\n\n- Authentication tests: implement ONLY if testcase/md/ contains auth-related cases\n\n- Timeout tests: implement ONLY if testcase/md/ contains timeout-related cases\n\n- Boundary tests: implement ONLY when cases define value ranges, length limits, or format constraints\n\n- Use @pytest.mark.auth for auth tests, @pytest.mark.timeout for timeout tests\n\n- If no such cases exist, do NOT add these tests\n\n\n\n## Constraints:\n\n- Only create NEW files under writeSet: testcase/**/test_*.py, testcase/**/helpers/**, testcase/**/factories/**\n\n- Do NOT modify existing framework files (conftest.py, pytest.ini, pyproject.toml, setup.cfg, __init__.py)\n\n- If a test filename exists, add suffix: test_order.py → test_order_01.py\n\n- Do NOT re-read source documents — use reviewed cases under testcase/md/ and upstream analyze-inputs-pi output only\n\n- Read existing conftest.py/pytest.ini to understand conventions, but do NOT modify them\n\n- Do NOT execute pytest/python -m pytest or npm test in this node; the single execution is owned by the dedicated shell node. Local smoke runs create __pycache__/.pytest_cache and are unnecessary here."
     },
     {
-      "id": "review-generated-backend-pytest-pi",
+      "id": "backend-test-traceability-gate-shell",
       "depends_on": [
         "generate-backend-pytest-pi",
-        "validate-backend-test-contracts-shell",
-        "backend-test-case-manifest-shell"
-      ],
-      "role": "reviewer",
-      "executor": "pi",
-      "complexity": "MED",
-      "writePolicy": "read-only",
-      "allowedPaths": [
-        "testcase/**"
-      ],
-      "forbiddenPaths": [
-        ".harness/**",
-        ".harness/dag-runs/**",
-        "artifacts/**"
-      ],
-      "outputContract": "Pure Backend Test Semantic Review v1 JSON: verdict, findings[], summary. No file writes.",
-      "subtask_prompt": "Review generated pytest semantics before the single execution.\n\nUse only compact authoritative inputs: contracts/backend-test-analysis.json, contracts/backend-test-case-manifest.json, testcase/md/**, and generated testcase/**/test_*.py/helpers/factories.\n\nReturn exactly one pure JSON object with only verdict, findings, summary; no Markdown fence or surrounding prose.\n\nverdict must be pass or request-revision. Each findings[] item must contain exactly severity, caseId, testFile, testSymbol, contractRefs, issue, requiredChange.\n\nseverity must be exactly Critical, Important, or Informational; contractRefs must be a non-empty string array. A request-revision verdict requires at least one finding; pass must not contain Critical findings.\n\nMinimal shape: {\"verdict\":\"pass\",\"findings\":[],\"summary\":\"No contract-backed semantic contradiction found.\"}\n\nCheck responseBody.kind (array vs object/items), ordering, field comparison (especially parseable-only date-time precision), documented status/error fields, and each caseId→symbol assertion meaning.\n\nDo not use aliases such as file, symbol, refs, finding, or requiredFix; the strict contract requires testFile, testSymbol, contractRefs, issue, requiredChange.\n\nrequest-revision only for concrete semantic contradiction with reviewed cases/formal analysis evidence. No style findings.\n\nRead-only; do not edit tests or production code.",
-      "retryPolicy": {
-        "maxAttempts": 3,
-        "backoff": "exponential",
-        "initialDelayMs": 2000,
-        "maxDelayMs": 30000,
-        "retryCategories": [
-          "timeout",
-          "network",
-          "rate-limit",
-          "unavailable"
-        ]
-      }
-    },
-    {
-      "id": "validate-semantic-review-and-traceability-shell",
-      "depends_on": [
-        "review-generated-backend-pytest-pi",
         "backend-test-case-manifest-shell"
       ],
+      "dependsPolicy": "all-or-condition-skip",
       "role": "verifier",
       "executor": "shell",
       "complexity": "LOW",
@@ -335,39 +270,12 @@
         ".harness/dag-runs/**",
         "artifacts/**"
       ],
-      "outputContract": "Materialize the only semantic review and validate pytest traceability.",
-      "subtask_prompt": "Materialize semantic facts and traceability; verdict authorization is handled by the next deterministic gate.",
+      "outputContract": "Deterministic traceability: generated cases have real file/symbol; skipped/unsupported have gapReason; convention symbols scanned under testcase/**/test_*.py.",
+      "subtask_prompt": "Fail closed when generated automation claims do not resolve to workspace pytest symbols, or skip/unsupported lacks gapReason.",
       "shell": {
-        "commands": [],
-        "backendTestPipeline": "semantic-initial",
-        "cwd": ".",
-        "timeoutMs": 60000
-      }
-    },
-    {
-      "id": "backend-test-semantic-gate-shell",
-      "depends_on": [
-        "validate-semantic-review-and-traceability-shell",
-        "review-generated-backend-pytest-pi"
-      ],
-      "role": "verifier",
-      "executor": "shell",
-      "complexity": "LOW",
-      "writePolicy": "read-only",
-      "allowedPaths": [
-        "testcase/**",
-        "docs/test-reports/**"
-      ],
-      "forbiddenPaths": [
-        ".harness/**",
-        ".harness/dag-runs/**",
-        "artifacts/**"
-      ],
-      "outputContract": "Pass-only authorization by reading contracts/backend-test-semantic-review.json; only verdict=pass proceeds to the single pytest execution.",
-      "subtask_prompt": "Read the canonical semantic review artifact written by validate-semantic-review-and-traceability-shell. Authorize only when verdict is pass. Do not materialize, do not parse raw Pi Markdown or VERDICT lines, and do not authorize an in-run pytest writer.",
-      "shell": {
-        "commands": [],
-        "backendTestPipeline": "semantic-initial",
+        "commands": [
+          "backend-test-traceability-gate"
+        ],
         "cwd": ".",
         "timeoutMs": 60000
       }
@@ -375,7 +283,7 @@
     {
       "id": "execute-and-parse-backend-pytest-shell",
       "depends_on": [
-        "backend-test-semantic-gate-shell",
+        "backend-test-traceability-gate-shell",
         "validate-backend-test-contracts-shell"
       ],
       "role": "verifier",
@@ -450,7 +358,9 @@
       "id": "materialize-classification-and-result-context-shell",
       "depends_on": [
         "classify-backend-test-result-pi",
-        "backend-test-case-manifest-shell"
+        "backend-test-case-manifest-shell",
+        "review-backend-cases-pi",
+        "backend-test-traceability-gate-shell"
       ],
       "role": "verifier",
       "executor": "shell",
@@ -465,8 +375,8 @@
         ".harness/dag-runs/**",
         "artifacts/**"
       ],
-      "outputContract": "Materialize Classification v1, copy the unique initial Result to canonical contracts/backend-test-result.json, and emit Result + Manifest + Classification context.",
-      "subtask_prompt": "Validate classification and materialize canonical single-run result context without repair eligibility or rerun.",
+      "outputContract": "Materialize Classification v1, copy the unique initial Result to canonical contracts/backend-test-result.json, and emit Result + Manifest + Classification + advisory case review + traceability context.",
+      "subtask_prompt": "Validate classification and materialize canonical single-run result context with auditable case review and traceability evidence, without repair eligibility or rerun.",
       "shell": {
         "commands": [],
         "backendTestPipeline": "classification-result-context",
@@ -496,7 +406,7 @@
         "artifacts/**"
       ],
       "outputContract": "Maturity rating in assistant output plus a report written under docs/test-reports/**.",
-      "subtask_prompt": "Read the complete JSON from direct upstream materialize-classification-and-result-context-shell and generate a test retrospective report.\n\nThat JSON contains result, manifest (including coverageSummary), and classification. Treat those fields as authoritative; do not rely on pointer/hash summaries.\n\n\n\n## Output Steps (do in order):\n\n1. First, output the maturity rating on the first line: Rating: A/B/C/D\n\n2. Then write the full report under docs/test-reports/\n\n\n\n## Stats authority (deterministic only):\n\n- Pass rate, failed/error/skipped counts, and failure list MUST come from contracts/backend-test-result.json only.\n\n- AC coverage ratio / case counts MUST come from contracts/backend-test-case-manifest.json coverageSummary (or gate-derived fields). Do NOT invent coverage %.\n\n- Automation coverage MUST use coverageSummary.generatedCount / coverageSummary.caseCount. If either field is missing, write unavailable; do not estimate.\n\n- Code coverage MUST come only from the validated contracts/code-coverage-v1.json artifact generated by coverage.py/pytest-cov or JaCoCo. Show line, branch, function/method, covered, total, ratio, threshold, status, source scope, requirement IDs, tool, commit, and artifact hash.\n\n- Stability MUST come from independent Stability Evidence: use successfulRuns / recordedRuns, same suite/version, and require n≥5; a single run is unavailable.\n\n- Use classify-backend-test-result-pi JSON as interpretive evidence only.\n\n- NEVER rewrite a failed result as passed. Outcome gate (not this report) is authoritative for task success.\n\n\n\n## Report Structure:\n\n1. Maturity Rating with rationale\n\n2. Test Coverage Summary (Result v1 pass rate, AC coverage, automation coverage, code coverage, and stability evidence)\n\n3. Failed Test Analysis (failure/error details, category, confidence, evidence, and owner direction)\n\n4. Defects (local Bug ledger in the same report directory; unavailable when absent)\n\n5. Risks (Critical/High/Medium/Low, impact, controls, residual risk, treatment; Critical risks block L-5, High risks do not automatically block)\n\n6. Regression Recommendations (immediate, related, periodic, deferred; every item links to failure/risk/AC/case IDs)\n\n7. L-5 conclusion with blocking items\n\n\n\n## Rating Criteria:\n\n- L-5 ready requires pass rate=100%, AC coverage=100%, automation coverage≥90%, stability≥95% with n≥5, line coverage≥80%, branch coverage≥70%, skipped=0, and no blocking Critical risk.\n\n- Any required metric fail or unavailable means L-5 not-ready. Function/method coverage is displayed but not a gate. Preserve the existing A/B/C/D single-run rating separately.\n\n\n\n## Constraints:\n\n- Stay within writeSet: docs/test-reports/**\n\n- Do NOT re-read source documents — use upstream outputs only\n\n- Do not write root artifacts/**"
+      "subtask_prompt": "Read the complete JSON from direct upstream materialize-classification-and-result-context-shell and generate a test retrospective report.\n\nThat JSON contains result, manifest (including coverageSummary), and classification. Treat those fields as authoritative; do not rely on pointer/hash summaries.\n\n\n\n## Output Steps (do in order):\n\n1. First, output the maturity rating on the first line: Rating: A/B/C/D\n\n2. Then write the full report under docs/test-reports/\n\n\n\n## Stats authority (deterministic only):\n\n- Pass rate, failed/error/skipped counts, and failure list MUST come from contracts/backend-test-result.json only.\n\n- AC coverage ratio / case counts MUST come from contracts/backend-test-case-manifest.json coverageSummary (or gate-derived fields). Do NOT invent coverage %.\n\n- Automation coverage MUST use coverageSummary.generatedCount / coverageSummary.caseCount. If either field is missing, write unavailable; do not estimate.\n\n- Code coverage MUST come only from the validated contracts/code-coverage-v1.json artifact generated by coverage.py/pytest-cov or JaCoCo. Show line, branch, function/method, covered, total, ratio, threshold, status, source scope, requirement IDs, tool, commit, and artifact hash.\n\n- Stability MUST come from independent Stability Evidence: use successfulRuns / recordedRuns, same suite/version, and require n≥5; a single run is unavailable.\n\n- Use classify-backend-test-result-pi JSON as interpretive evidence only.\n\n- NEVER rewrite a failed result as passed. Result v1 is authoritative for testOutcome; pipeline completion and L-5 readiness are separate conclusions.\n\n\n\n\n\n## Report Structure:\n\n1. Maturity Rating with rationale\n\n2. Test Coverage Summary (Result v1 pass rate, AC coverage, automation coverage, code coverage, and stability evidence)\n\n3. Failed Test Analysis (failure/error details, category, confidence, evidence, and owner direction)\n\n4. Defects (local Bug ledger in the same report directory; unavailable when absent)\n\n5. Risks (Critical/High/Medium/Low, impact, controls, residual risk, treatment; Critical risks block L-5, High risks do not automatically block)\n\n6. Regression Recommendations (immediate, related, periodic, deferred; every item links to failure/risk/AC/case IDs)\n\n7. L-5 conclusion with blocking items\n\n\n\n## Rating Criteria:\n\n- L-5 ready requires pass rate=100%, AC coverage=100%, automation coverage≥90%, stability≥95% with n≥5, line coverage≥80%, branch coverage≥70%, skipped=0, and no blocking Critical risk.\n\n- Any required metric fail or unavailable means L-5 not-ready. Function/method coverage is displayed but not a gate. Preserve the existing A/B/C/D single-run rating separately.\n\n\n\n## Constraints:\n\n- Stay within writeSet: docs/test-reports/**\n\n- Do NOT re-read source documents — use upstream outputs only\n\n- Do not write root artifacts/**"
     },
     {
       "id": "l5-metrics-pi",
@@ -530,44 +440,6 @@
           "unavailable"
         ]
       }
-    },
-    {
-      "id": "backend-test-outcome-gate-shell",
-      "depends_on": [
-        "l5-metrics-pi"
-      ],
-      "role": "verifier",
-      "executor": "shell",
-      "complexity": "LOW",
-      "writePolicy": "read-only",
-      "allowedPaths": [
-        "testcase/**",
-        "docs/test-reports/**"
-      ],
-      "forbiddenPaths": [
-        ".harness/**",
-        ".harness/dag-runs/**",
-        "artifacts/**"
-      ],
-      "outputContract": "Shell exit 0 only when Result v1 outcome=passed with failed=0 and error=0; non-zero otherwise. Ignores retrospective Markdown.",
-      "subtask_prompt": "Gate the backend-test DAG on run-owned Result v1 shell facts only (not retrospective prose).",
-      "shell": {
-        "commands": [
-          "test -n \"${HARNESS_DAG_RUN_DIR:-}\" || { echo \"missing HARNESS_DAG_RUN_DIR for backend-test outcome gate\" >&2; exit 2; }; RESULT=\"${HARNESS_DAG_RUN_DIR}/contracts/backend-test-result.json\"; test -f \"${RESULT}\" || { echo \"missing backend-test result: ${RESULT}\" >&2; exit 2; }; node -e 'const fs=require(\"fs\");const r=JSON.parse(fs.readFileSync(process.argv[1],\"utf8\"));const outcome=String(r.outcome||\"\");const ok=outcome===\"passed\"&&Number(r.failed||0)===0&&Number(r.error||0)===0;console.log(\"backend-test outcome=\"+outcome+\" passed=\"+r.passed+\" failed=\"+r.failed+\" error=\"+r.error+\" executionStatus=\"+r.executionStatus);if(!ok){process.exit(1);}' \"${RESULT}\""
-        ],
-        "verifyEvidence": {
-          "phase": "final",
-          "quota": "full",
-          "commandSource": "inline",
-          "commandCount": 1,
-          "commandLabels": [
-            "test -n \"${HARNESS_DAG_RUN_DIR:-}\" || { echo \"missing HARNESS_DAG_RUN_DIR for backend-test outcome gate\" >&2; exit 2; }; RESULT=\"${HARNESS_DAG_RUN_DIR}/contracts/backend-test-result.json\"; test -f \"${RESULT}\" || { echo \"missing backend-test result: ${RESULT}\" >&2; exit 2; }; node -e 'const fs=require(\"fs\");const r=JSON.parse(fs.readFileSync(process.argv[1],\"utf8\"));const outcome=String(r.outcome||\"\");const ok=outcome===\"passed\"&&Number(r.failed||0)===0&&Number(r.error||0)===0;console.log(\"backend-test outcome=\"+outcome+\" passed=\"+r.passed+\" failed=\"+r.failed+\" error=\"+r.error+\" executionStatus=\"+r.executionStatus);if(!ok){process.exit(1);}' \"${RESULT}\""
-          ],
-          "finalFullRequired": true
-        },
-        "cwd": ".",
-        "timeoutMs": 60000
-      }
     }
   ],
   "sourceBinding": {

package/docs/templates/backend-test-dag.retrospect.prompt.md

@@ -31,7 +31,7 @@ You are the Backend Test DAG **test retrospective** agent.
 
 Your job is to read upstream Result v1 + classification (+ review report) and generate a retrospective report with a maturity rating. Write the report under `docs/test-reports/` only. Stay within `writeSet`. Do not write root `artifacts/**`.
 
-This node runs on **both pass and assertion-fail** paths (after parse + classify). Final task success is decided later by `backend-test-outcome-gate-shell` using Result v1 shell facts only — **never** rewrite a failed result as passed in this report.
+This node runs on **both pass and assertion-fail** paths after canonical context. Treat Result v1 as the sole testOutcome authority; pipeline completion and L-5 readiness are separate conclusions. **Never** rewrite a failed result as passed in this report. The context also carries advisory case review and deterministic traceability evidence, which must be reflected in the retrospective.
 
 ### Output Steps (do in order)
 

package/docs/templates/backend-test-dag.review-cases.prompt.md

@@ -2,7 +2,7 @@
 
 ## Purpose
 
-Use this prompt for the single read-only **backend test case review** node: `executor: "pi"`, `role: "reviewer"`, `writePolicy: "read-only"`. The reviewer audits generated backend functional test cases for completeness, format compliance, and traceability to source requirements. `VERDICT: request-revision` causes the deterministic `review-backend-cases-gate-shell` to fail; it does not authorize another writer in the same run.
+Use this prompt for the single read-only **backend test case review** node: `executor: "pi"`, `role: "reviewer"`, `writePolicy: "read-only"`. The reviewer audits generated backend functional test cases for completeness, format compliance, and traceability to source requirements. The verdict is advisory evidence consumed by canonical context, retrospective, and L-5; it neither authorizes nor blocks the pytest writer.
 
 Do **not** create `executor: reviewer`. Reviewer is a **role** on `executor: pi`.
 
@@ -86,4 +86,4 @@ Do NOT re-read source documents. Use the validated analysis artifact, case manif
 
 ### Fail-fast note
 
-There is no final review or in-run revision writer. Any `request-revision` verdict ends the current backend-test run at the deterministic case gate.
+There is no final review or in-run revision writer. Any `request-revision` verdict remains auditable advisory evidence and must be reported downstream; it does not stop pytest generation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tea-agent/loop-agent",
-  "version": "0.16.26",
+  "version": "0.17.1",
   "type": "module",
   "bin": {
     "loop-agent": "bin/loop-agent.js",
@@ -44,7 +44,8 @@
     "cursor": "node --import tsx/esm src/cli.ts cursor-prompt",
     "pi-prompt": "node --import tsx/esm src/cli.ts pi-prompt",
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc -p tsconfig.build.json && node -e \"const fs=require('node:fs');const p='dist/worker/observe/static';fs.mkdirSync(p,{recursive:true});fs.cpSync('src/worker/observe/static',p,{recursive:true});\"",
+    "build": "npm run clean && tsc -p tsconfig.build.json && node -e \"const fs=require('node:fs');const p='dist/worker/observe/static';fs.mkdirSync(p,{recursive:true});fs.cpSync('src/worker/observe/static',p,{recursive:true});\" && npm run console:build",
+    "console:build": "vite build --config src/worker/console/vite.config.ts",
     "prepack": "npm run build",
     "prepublishOnly": "node scripts/check-npm-publish-policy.mjs && npm run typecheck && npm test && npm run build",
     "lint": "tsc --noEmit",
@@ -71,9 +72,14 @@
   },
   "devDependencies": {
     "@types/node": "^24.6.0",
+    "@types/react": "^19.1.8",
+    "@types/react-dom": "^19.1.6",
     "@types/semver": "^7.7.1",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0",
     "tsx": "^4.20.6",
     "typescript": "^5.9.3",
+    "vite": "^7.0.0",
     "vitest": "^3.2.4"
   }
 }

package/skills/agent-worker/SKILL.md

@@ -16,6 +16,7 @@ references:
 - **允许**：`agent-worker` / `loop-agent` CLI；只读 `pool doctor`、`observe`、status/report；冻结 controller identity；选择 Ready 工作与 recovery 命令。
 - **禁止**：绕过 CLI 直接 Edit 业务实现；Worker/DAG 失败后主会话「救火改文件」。
 - **失败时只允许**：保留 evidence → `task retry` / `task reconcile` / `pool mark-failed` / human gate → 再经 CLI 重跑；实现写入仍只经 published `loop-agent` DAG。
+- **Official vs Compatibility**：`agent-worker console serve` 是 Official 本地控制面；openCode 等主会话仍是 Compatibility Assist，二者**不是**同等保证。Console 与 Observe 分进程；深链依赖 Observe health match，Console 不 proxy Observe。
 
 ## Route the Work
 

package/skills/agent-worker/references/agent-worker-operator.md

@@ -7,7 +7,7 @@
 主会话使用本 reference 时是 **operator**，不是 implementer：
 
 | 允许 | 禁止 |
-|---|---|
+| --- | --- |
 | `agent-worker` / `loop-agent` CLI | 宿主 Edit/Write 直接改业务实现 |
 | 只读 doctor / observe / report / status | Worker 或 DAG 失败后「救火改文件」 |
 | 冻结 controller identity、选 Ready、retry/reconcile | 跳过 published controller 手写实现收尾 |
@@ -52,7 +52,8 @@ Leaf DAG nodes 不得递归启动 `agent-worker`。Worker 负责 DAG 之外的 s
    ```
 
    doctor 只读；migrate 默认零写入，apply 失败全回滚且不改 JSONL。
-8. Observe（`observe serve|snapshot`）只读；canonical Task 路由为 `/api/features/:featureId/tasks/:taskId` 与 `#/feature/:featureId/task/:taskId`。
+8. Observe（`observe serve|snapshot`）只读；canonical Task 路由为 `/api/features/:featureId/tasks/:taskId` 与 `#/feature/:featureId/task/:taskId`。`GET /api/health` 为 versioned DTO（fingerprint + routeCapabilities）。Console `observeLink` 仅 match 后深链；offline 展示 `agent-worker observe serve --repo . --port 8787`。
+9. Official Console：`agent-worker console serve|doctor`（loopback）。Recovery CTA 为 report/doctor/decision/resume/reconcile/regenerate；无 Cancel、无主 CTA「直接改代码」。主会话 Compatibility Assist 不得替代 Console/CLI 执法。
 
 ## Versioned Self-Hosting
 

package/skills/frontend-design-review/SKILL.md

@@ -9,19 +9,29 @@ references:
 
 # Frontend Design Review
 
-For first/final design review nodes. Read the checklist, then audit contract, scout,
-mock strategy, plan/revision, task constraints/bounds, and traceable design evidence. The knowledge-
-base connector is TODO: never invent results. If absent/failed/unmatched, require
-`<repoRoot>/openspec/**` search/read evidence before repo conventions.
+For frontend design review nodes. Read the checklist; audit contract, scout, Mock
+strategy, effective plan, task bounds, and traceable design evidence. The knowledge-
+base connector is TODO: never invent results. If unavailable or unmatched, require
+`<repoRoot>/openspec/**` search/read evidence before repository conventions.
 
 ## Verdict Contract
 
 First non-empty line: exactly `VERDICT: pass` or `VERDICT: request-revision`.
-Any blocker requires request-revision; the shell gate reads this line exactly.
+Any blocker requires request-revision. An initial pass is the effective verdict;
+there is no intermediate first-design shell gate.
 
-For `frontend-final-design-review-pi`: recheck the original plan when output is
-`PASS_NO_REVISION_NEEDED`; otherwise verify every Required Plan Correction. Reject
-remaining, incomplete, or newly introduced gaps.
+In standard/full topology, revision and final review run only after initial
+`VERDICT: request-revision`. Verify every Required Plan Correction against the
+complete revision; reject remaining, incomplete, or new gaps. An initial pass uses
+the original plan and skips both conditional nodes.
+
+Small-risk topology instead removes initial review and revision, then runs
+`frontend-final-design-review-pi` as the sole review of the original plan. Do not
+expect initial findings or a revision there.
+
+The deterministic gate prefers final-review output and falls back to initial review
+only when no current-run final output exists. Existing malformed/non-pass primary
+output fails closed.
 
 ## Blocking Conditions
 
@@ -35,20 +45,19 @@ remaining, incomplete, or newly introduced gaps.
   inline fake data; commented real requests; Mock-on production defaults; test-only
   production imports; or Mock evidence reported as real integration.
 
-Knowledge-base absence is advisory if relevant `openspec/` rules were searched/read
-and applied. Block skipped fallback, unresolved conflict, or unresolved UI decisions.
+Knowledge-base absence is advisory if relevant `openspec/` rules were read and
+applied. Block skipped fallback, unresolved conflict, or unresolved UI decisions.
 
 ## Method And Output
 
-Map criteria to steps/files/states/checks, audit paths/evidence, classify Blocking or
-Advisory, and never edit files.
+Map criteria to steps/files/states/checks, audit paths/evidence, classify Blocking
+or Advisory, and never edit files.
 
 ### Spec Evidence Rules
 
-Run `grep`/`find`, then explicit `read` calls for applicable specs and checklist.
-Only successful paired reads count as “已读取规范文件”; summaries do not. List each
-read path/section in `Checked Items`. If the connector is unavailable, search/read
-`openspec/` before accepting repository conventions.
+Run `grep`/`find`, then explicit `read` calls for applicable specs/checklist. Only
+successful paired reads count as “已读取规范文件”; summaries do not. List each path/
+section in `Checked Items`; search/read `openspec/` before accepting conventions.
 
 ```markdown
 VERDICT: pass

package/skills/frontend-implementation/references/node-contracts.md

@@ -8,20 +8,20 @@ Pre-write nodes are read-only. Preserve IDs, labels, commands, language, require
 - **`frontend-scout-pi`**: routes, components, tokens, data/API/Mock, scripts, tests, assets. Fact vs inference vs gap. Knowledge base first; else search+read `<repoRoot>/openspec/**` before repo fallback. Output stack, routes, components, styling, conventions, state/data, test entry points, reuse, risks.
 - **`frontend-mock-assess-pi` + gate**: declares `firstProtocolLine: "MOCK_STRATEGY:"`; canonical output first line
   `MOCK_STRATEGY: native|browser-intercept|request-adapter|not-needed|blocked`
-  Pi output mapping promotes the first matching protocol line ahead of any preamble without inventing or replacing its value; missing, malformed, or blocked strategies still fail closed. Prefer native Mock; browser intercept only with existing e2e; request-adapter only for reversible local preview. Default `auto` may select `not-needed` when contract/scout evidence confirms no project Mock capability, without adding Mock files/deps, while keeping real requests default and recording the Real Integration Gap. Other `not-needed` cases need positive no-remote/stable-backend evidence; invalid when `frontendMock.policy=required`. `blocked` for missing/conflicting contracts, unsafe paths/deps, unread specs, production-default-on, unverifiable entrypoints. Output Mock Decision, API/spec/service evidence, backend readiness, selection evidence, endpoint/fixture matrix, activation, targets, production safety, verification plan, real-integration gap, blocking issues. Never invent fields, store secrets, comment real requests, import test mocks into production, or treat Mock as real integration. Gate uses `first-non-empty` only; never authorizes writes. Unsafe required contracts → no writer.
-- **`frontend-plan-pi` + design loop**: AC → steps, in-bound files, UI states, reuse, deps, activation/rollback, frozen verify entrypoints, real-integration gap. First gate: `VERDICT: pass|request-revision`. Pass may emit `PASS_NO_REVISION_NEEDED`; else full corrected plan without invented evidence. Final review rechecks plan/findings/revision/assessment/Mock safety. Only final `VERDICT: pass` authorizes writes; failure → replan/rerun (not dev-fix). The plan-pi prompt now includes the complete `frontend-implementation-contract-v1` JSON Schema loaded from the loop-agent package `docs/templates/` path, plus deterministic source binding, risk level, and allowed implementation targets. The model does not need to search or guess contract fields; `schemaId`, `targetFiles`, `requirementCoverage` are explicitly forbidden.
+  Pi output mapping promotes the first explicitly labeled Mock strategy line ahead of any preamble, including common bullet, quote, inline-code, fullwidth-colon, `Mock strategy`, and split label/value drift, without inventing or replacing its value; missing, unlabeled, malformed, or blocked strategies still fail closed. Prefer native Mock; browser intercept only with existing e2e; request-adapter only for reversible local preview. Default `auto` may select `not-needed` when contract/scout evidence confirms no project Mock capability, without adding Mock files/deps, while keeping real requests default and recording the Real Integration Gap. Other `not-needed` cases need positive no-remote/stable-backend evidence; invalid when `frontendMock.policy=required`. `blocked` for missing/conflicting contracts, unsafe paths/deps, unread specs, production-default-on, unverifiable entrypoints. Output Mock Decision, API/spec/service evidence, backend readiness, selection evidence, endpoint/fixture matrix, activation, targets, production safety, verification plan, real-integration gap, blocking issues. Never invent fields, store secrets, comment real requests, import test mocks into production, or treat Mock as real integration. Gate uses `first-non-empty` only; never authorizes writes. Unsafe required contracts → no writer.
+- **`frontend-plan-pi` + conditional design loop**: AC → steps, in-bound files, UI states, reuse, deps, activation/rollback, frozen verify entrypoints, real-integration gap. Initial `VERDICT: pass` uses the original plan directly. Only exact `VERDICT: request-revision` runs read-only plan revision plus final review; there is no `frontend-first-design-gate-shell` or pass-path `PASS_NO_REVISION_NEEDED` node. The effective final gate prefers final review when present, otherwise initial review, and only exact pass authorizes writes; malformed/missing/request-revision fails closed → replan/rerun (not dev-fix). The plan-pi prompt includes the complete `frontend-implementation-contract-v1` JSON Schema loaded from the loop-agent package `docs/templates/` path, plus deterministic source binding, risk level, and allowed implementation targets. The model does not need to search or guess contract fields; `schemaId`, `targetFiles`, `requirementCoverage` are explicitly forbidden.
 - **`frontend-implement-pi`**: sole exclusive writer. Stay in `writeSet`; real requests default-on; Mock reversible, dev/test-only, production-off. Atomic handler/intercept/adapter with consumer+tests. Stop on forbidden paths or guesses. Output changed files, behavior, UI states, styling notes, verification attempted, residual risks. Optional mock-verify when frozen; static+behavior always; behavior must prove page consumption. Skipped-Mock `not-needed` keeps real integration pending unless the real backend path has fresh evidence.
 
 ## Contract / trace / stages (M1–M2)
 
-- Contract shell: `jsonArtifactGate` → `contracts/frontend-implementation-contract.json` from revision (one fenced JSON or pure JSON); schemaId `frontend-implementation-contract-v1`. Final design + implement depend on it; `MOCK_STRATEGY: blocked` not implementable.
+- Contract shell: `jsonArtifactGate` → `contracts/frontend-implementation-contract.json` from the effective plan (one fenced JSON or pure JSON); schemaId `frontend-implementation-contract-v1`. Revision is primary and original plan is fallback only when the conditional revision output is absent. Requirement coverage uses the same primary/fallback rule. An existing malformed/schema-invalid/incomplete primary fails closed; fallback never masks it. Final design + implement depend on the artifact; `MOCK_STRATEGY: blocked` not implementable.
 - Trace shell: `frontend-verification-trace-gate` binds contract `verificationTargets` to static/behavior records (`commandLabels`, file exists, optional symbol). Assess `MOCK_STRATEGY:` must match `mockApi.strategy` when present. Writes `contracts/frontend-verification-trace.json`. Browser/visual always `not-run`.
 - Implement stages: (1) contract confirm (2) tests sync (3) component/UI (4) API/Mock (5) frozen checks (6) diff cleanup. Summary: Contract Ref, Changed Files, Requirements, UI States, Tests, Verification Attempts, Deviations, Residual Risks.
 
 ## Repair (M3)
 
-static/behavior/trace may `nonZeroExitPolicy: record`. Assess → `contracts/frontend-repair-assessment.json`. Repair-contract fail-closed on non-repairable (contract/path/dependency/credential/deploy/spec-unclear) or writeSet expansion. `frontend-repair-pi`: same writeSet as implement; no re-spec; max 1 attempt. Reverify/retrace fail policy; review/closeout use post-repair evidence.
+static/behavior/trace may `nonZeroExitPolicy: record`. Assess emits pure JSON and writes `contracts/frontend-repair-assessment.json`. Only `eligible=true` runs `frontend-repair-pi` (same writeSet as implement; no re-spec; max 1 attempt), reverify, and retrace. No-failure condition-skips that branch, while diff/review/read-only `frontend-closeout-pi` continue on initial evidence. Repair-contract fails closed on non-repairable (contract/path/dependency/credential/deploy/spec-unclear), writeSet expansion, ERROR, or hard skip; `all-or-condition-skip` never softens those failures.
 
 ## Risk & capability (M4–M6)
 
-Deterministic risk (no model); high-risk beats small; supervised never small. Small may drop first design gate + plan-revision; contract shell retargets to `frontend-plan-pi`. Capability seed injects adapters; openspec/task sources outrank. A11y: static/component tools only when present; Browser a11y always not-run.
+Deterministic risk (no model); high-risk beats small; supervised never small. Small may drop the initial design review + conditional revision branch; its retained final review audits `frontend-plan-pi`, and contract shell retargets to that plan without fallback. Capability seed injects adapters; openspec/task sources outrank. A11y: static/component tools only when present; Browser a11y always not-run.