@tea-agent/loop-agent 0.2.0 → 0.3.0

package/docs/production-readiness.md

@@ -0,0 +1,96 @@
+# Production Readiness v0.1
+
+本文档冻结 2026-07-06 至 2026-07-12 hardening sprint 的单任务 production readiness 标准。
+
+`loop-agent` production readiness v0.1 指：低/中风险的仓库本地 DAG 任务能以稳定、可解释、可验证、可恢复的方式运行。这不是组织级平台 readiness 声明。
+
+## 支持范围
+
+- 单仓库
+- 单任务或小范围有边界任务
+- 低/中风险的代码与文档变更
+- 显式 task source
+- 显式 `allowedPaths`、`forbiddenPaths`、`writeSet`
+- shell 验证命令
+- 通过 `dag report`、`dag doctor`、`promote-run`、`closeout` 交接
+
+## 非目标
+
+- 自动 merge
+- 自动 release
+- 生产 secrets
+- 生产数据库访问
+- 高风险 migration
+- 在线 Worker Pool
+- 多仓库 feature 编排
+- 可写的 Dynamic Workflow sharded migration
+- DAG runtime 之外的第二套 runner
+
+## 必需证据
+
+每个 production-ready v0.1 任务必须保留或产出以下证据：
+
+| 证据 | 要求 |
+|---|---|
+| DAG spec path | 生成的 DAG JSON 路径记录在 CLI 输出、report 或 task artifacts 中 |
+| DAG validation result | `dag validate --strict-models --strict-governance` 有新鲜输出 |
+| Run id | `run-dag` 打印或记录 run id |
+| Shell verification output | 完成声明引用新鲜命令输出，而非 model 自报 |
+| Failure category | 失败 run 在可用时具备 raw、normalized、product-line 与 recommended follow-up 字段 |
+| Closeout 或 failure handoff | 成功 run 可 promote 并 closeout；失败 run 产出 failure handoff 证据而非成功 closeout |
+
+## 必需命令
+
+标准任务路径：
+
+```bash
+loop-agent new-task <task-id> "Task title"
+loop-agent dag run-task <task-id> --profile auto --strict-models --output <temp-dir>/<task-id>-dag.json
+loop-agent dag validate --dag <temp-dir>/<task-id>-dag.json --strict-models --strict-governance
+loop-agent run-dag --dag <temp-dir>/<task-id>-dag.json --cwd .
+loop-agent dag report --run-id <run-id> --markdown
+loop-agent dag doctor --run-id <run-id>
+loop-agent promote-run <task-id> --run-id <run-id>
+loop-agent closeout task <task-id>
+```
+
+`<temp-dir>` 使用平台原生临时目录。
+
+## 必需标准
+
+| ID | 标准 | 验收 |
+|---|---|---|
+| PRD-01 | 新任务仅推荐 DAG 路径 | README、docs、website、skills 不把已移除的 Level 1 顺序命令当作 fallback |
+| PRD-02 | 写任务有显式边界 | strict DAG governance 在需要时拒绝缺失 `allowedPaths`、`forbiddenPaths` 或 `writeSet` |
+| PRD-03 | 每次 DAG run 有可读 report | `loop-agent dag report --latest --markdown` 显示 status、failure summary 与 next step |
+| PRD-04 | 失败 run 可诊断 | `loop-agent dag doctor` 报告 category 与 recommended follow-up |
+| PRD-05 | Shell 验证是完成权威 | closeout 不接受 model 自报替代新鲜命令输出 |
+| PRD-06 | Failure category 覆盖失败 fixture | validation、write guard、shell、timeout、auth、unknown fixture 均有映射 |
+| PRD-07 | 已完成 DAG facts 不可变 | completed facts guard 仍由测试覆盖 |
+| PRD-08 | CLI 主路径输出指引下一步 | `dag run-task`、`dag validate`、`run-dag`、`dag report` 打印 operator next commands |
+| PRD-09 | 文档面一致 | doc 更新后 `bash scripts/check-repo.sh` 与 `npm run docs:build` 通过 |
+| PRD-10 | sprint 完成前完整本地门禁通过 | 最终 hardening closeout 时 `bash scripts/ci.sh` 通过 |
+
+## Failure Routing
+
+Failure category 是路由字段，不是主任务状态。保留 raw DAG facts，仅在 report、doctor 输出、closeout draft、task artifacts 或后续 Task Pool 记录中追加派生字段。
+
+四层结构：
+
+```text
+raw_failure_category
+dag_normalized_failure_category
+product_line_failure_category
+recommended_follow_up
+```
+
+Product-line category 事实源：`docs/design/state-and-failure-taxonomy.md`。
+
+## Sprint Gate
+
+2026-07-06 sprint 仅在 active execution plan 记录以下内容时视为完成：
+
+- M1–M4 最终状态
+- 必需验证门禁的命令输出
+- 成功、write-guard、shell-failure 场景的 dogfood 证据
+- 剩余风险与后续工作

package/docs/progress/README.md

@@ -1,3 +1,3 @@
-# Progress Logs
+# 进度日志
 
-Use this directory for concise handoff logs that should survive chat context.
+本目录存放应超越聊天上下文的简洁 handoff 日志。

package/docs/reports/README.md

@@ -1,3 +1,5 @@
-# Reports
+# 报告
 
-Use this directory for verification, audit, benchmark, and closeout reports.
+本目录存放验证、审计、benchmark 与 closeout 报告。
+
+- [`2026-07-12-production-readiness-hardening.md`](2026-07-12-production-readiness-hardening.md)

package/docs/skills/README.md

@@ -0,0 +1,6 @@
+# Skill Registry
+
+This directory records repo-local skill wrappers and vetting notes used by Agent DAG role mapping.
+
+- `vetted-skill-registry.md` — supported roles, source inspiration, risk notes, and default/optional usage.
+

package/docs/skills/vetted-skill-registry.md

@@ -0,0 +1,26 @@
+# Vetted Skill Registry
+
+This registry records repo-local skills that may be referenced by default DAG role mapping or task/profile-specific `skills`.
+
+The entries below are local wrappers or existing local skills. They are not wholesale vendored copies of third-party skill repositories.
+
+| Skill | Source / Inspiration | Local Path | Supported Roles | Default Use | Risk Notes |
+|---|---|---|---|---|---|
+| `ai-engineering-context` | local existing | `skills/ai-engineering-context/SKILL.md` | scout, default context | default/scout | Read-only engineering context; not a private platform memory skill. |
+| `loop-agent` | local existing | `skills/loop-agent/SKILL.md` | planner, supervisor, closeout | planner/closeout | Long references may be resolved by strict audit with expanded budget; executor behavior unchanged. |
+| `verification-before-completion` | local wrapper inspired by verification discipline | `skills/verification-before-completion/SKILL.md` | implementer, verifier, closeout | implementer/verifier/closeout | Requires shell evidence before completion claims. |
+| `systematic-debugging` | local wrapper inspired by systematic debugging discipline | `skills/systematic-debugging/SKILL.md` | implementer, verifier | verifier | Advisory prompt guidance only; does not run tools by itself. |
+| `requesting-code-review` | local existing | `skills/requesting-code-review/SKILL.md` | reviewer | reviewer | Review prompt guidance only. |
+| `test-driven-development` | local wrapper inspired by TDD practice | `skills/test-driven-development/SKILL.md` | implementer | implementer | Does not force tests in mechanical-only docs changes; implementer still follows task contract. |
+| `code-review-core` | local wrapper inspired by code review practice | `skills/code-review-core/SKILL.md` | reviewer | reviewer | No external tools or network by default. |
+| `codebase-scout` | local wrapper | `skills/codebase-scout/SKILL.md` | scout | scout | Read-only reconnaissance guidance. |
+| `init-capability-evolution` | local wrapper | `skills/init-capability-evolution/SKILL.md` | supervisor, maintenance | optional | Used only when changes may affect target-project initialization, package surface, or init projection rules. |
+| `webapp-testing` | local wrapper inspired by frontend/browser testing practice | `skills/webapp-testing/SKILL.md` | verifier, reviewer | optional | Only applies when task explicitly involves browser-rendered behavior; no default Playwright/Semgrep execution. |
+
+## Vetting Rules
+
+- Default role mappings may reference only repo-local skills that resolve cleanly under `dag validate --strict-skills`.
+- Optional/security/web skills remain task- or profile-specific until their tool, network, credential, and write behavior is reviewed.
+- This registry records source inspiration, not license clearance for vendored third-party content. Vendoring requires a separate license/security review.
+- `SKILL.md` is the entry point. References must be declared in frontmatter and stay within the skill directory.
+

package/docs/templates/agent-dag-decision-gate-dogfood-report.md

@@ -8,7 +8,7 @@
 |---|---|
 | Date | YYYY-MM-DD |
 | Topic |  |
-| DAG input | `<temp-dir>/<topic>-decision-gate-dag.json` |
+| DAG input | `<temp-dir>/<topic>-decision-gate-dag.json` |
 | Run ID |  |
 | Run facts | `.harness/dag-runs/completed/<run-id>/` |
 | Gate type | `acceptance-gate` |

package/docs/templates/agent-dag-process-supervisor.prompt.md

@@ -11,7 +11,7 @@ Do **not** create `executor: supervisor`. Supervisor is a **role** on `executor:
 ```json
 {
   "id": "process-supervisor-pi",
-  "depends_on": ["soft-verify-shell", "implement-pi"],
+  "depends_on": ["soft-verify-shell", "implement-pi"],
   "complexity": "HIGH",
   "executor": "pi",
   "role": "supervisor",
@@ -80,7 +80,7 @@ Rules:
 
 - `verdict` must match the first line.
 - `failureClass` must be one of `syntax`, `runtime`, `logic`, `boundary`, `environment`, `governance`, `unknown`.
-- For `request-revision`, `fixScope` must name the smallest repair paths/components and stay inside the downstream `repair-pi` writeSet/allowedPaths.
+- For `request-revision`, `fixScope` must name the smallest repair paths/components and stay inside the downstream `repair-pi` writeSet/allowedPaths.
 - For `pass`, `fixScope` must be an empty array.
 - `invariant` must state the behavior or contract the repair must preserve.
 - `evidenceRefs` must name node ids or relative artifact paths consulted.

package/docs/templates/agent-dag-report.schema.json

@@ -58,6 +58,21 @@
         "commandHint": { "type": "string" }
       }
     },
+    "dagProductLineFailureCategory": {
+      "type": "string",
+      "enum": [
+        "SpecUnclear",
+        "ContractMismatch",
+        "ProductBug",
+        "TestBug",
+        "EnvFailure",
+        "FlakyTest",
+        "RiskyChange",
+        "DependencyFailure",
+        "NeedsHuman",
+        "Unknown"
+      ]
+    },
     "dagReportPrimaryFailure": {
       "type": "object",
       "additionalProperties": false,
@@ -87,7 +102,11 @@
             "skipped",
             "unknown"
           ]
-        }
+        },
+        "productLineFailureCategory": {
+          "$ref": "#/$defs/dagProductLineFailureCategory"
+        },
+        "recommendedFollowUp": { "type": "string" }
       }
     },
     "dagReportPrimaryRecovery": {
@@ -117,7 +136,11 @@
             "skipped",
             "unknown"
           ]
-        }
+        },
+        "productLineFailureCategory": {
+          "$ref": "#/$defs/dagProductLineFailureCategory"
+        },
+        "recommendedFollowUp": { "type": "string" }
       }
     },
     "dagNodeDecisionEnvelope": {
@@ -333,6 +356,10 @@
             "unknown"
           ]
         },
+        "productLineFailureCategory": {
+          "$ref": "#/$defs/dagProductLineFailureCategory"
+        },
+        "recommendedFollowUp": { "type": "string" },
         "recoveryRecommendation": {
           "$ref": "#/$defs/dagRecoveryRecommendation"
         },
@@ -400,6 +427,10 @@
             "unknown"
           ]
         },
+        "productLineFailureCategory": {
+          "$ref": "#/$defs/dagProductLineFailureCategory"
+        },
+        "recommendedFollowUp": { "type": "string" },
         "recoveryRecommendation": {
           "$ref": "#/$defs/dagRecoveryRecommendation"
         },

package/docs/templates/agent-dag-review-verdict.prompt.md

@@ -9,7 +9,7 @@ Use this prompt for a read-only **review verdict** node after hard verification:
 ```json
 {
   "id": "review-pi",
-  "depends_on": ["hard-verify-shell", "repair-pi"],
+  "depends_on": ["hard-verify-shell", "repair-pi"],
   "complexity": "HIGH",
   "executor": "pi",
   "role": "reviewer",

package/docs/templates/agent-dag.base.json

@@ -1,195 +1,195 @@
-{
-  "$schema": "./agent-dag.schema.json",
-  "version": 2,
-  "title": "Agent DAG base template",
-  "objective": "Replace with the concrete objective for this DAG run.",
-  "successCriteria": [
-    "Each node returns output matching its outputContract.",
-    "Same-rank read-only scouts run in parallel when their outputs are independent.",
-    "Only Pi nodes with toolProfile=write or explicitly enabled Cursor implementer nodes may write files, and only inside declared writeSet.",
-    "Pi nodes remain read-only unless toolProfile=write is explicitly selected for a bounded writer node.",
-    "Read-only nodes must not write root artifacts/**; root artifacts/ is not a per-node scratchpad."
-  ],
-  "globalConstraints": [
-    "Replace every REPLACE/WITH/... placeholder with concrete repo paths before execution; do not leave template placeholders in production DAG JSON.",
-    "Do not commit runtime traces under .harness/dag-runs/.",
-    "Do not write generated DAG input specs into .harness/dag-runs/active/.",
-    "Use a platform-native temp path such as <temp-dir>/<topic>-dag.json for one-off DAG specs; commit reusable templates under examples/ or docs/templates/.",
-    "Actual file operation paths must be macOS/Windows compatible; use / only for stable repo refs, JSON/Markdown evidence refs, and glob conventions.",
-    "Every task must explicitly declare executor; defaults.executor is schema-only and not a runtime fallback.",
-    "Prefer same-rank parallel read-only scouts over serial chains when outputs are independent.",
-    "Add depends_on only when a child truly needs upstream output; challenge single-chain topologies during review.",
-    "Same-rank exclusive writeSet entries must be disjoint.",
-    "Do not add provider fields to DAG JSON; provider routing is executor-owned.",
-    "Use executorModels for model routing; do not add defaults.model or legacy top-level models.",
-    "Every task must declare outputContract describing the expected Markdown/output shape.",
-    "exclusive implementer nodes must use narrow, concrete writeSet and allowedPaths; never keep broad write permissions such as ** or repo root.",
-    "Cursor is optional; no-Cursor environments should use Pi read-only scouts and Pi writer nodes with toolProfile=write."
-  ],
-  "defaults": {
-    "executor": "pi",
-    "contextProfile": "slim",
-    "skills": [
-      "ai-engineering-context"
-    ],
-    "writePolicy": "read-only"
-  },
-  "skillsByRole": {
-    "planner": [
-      "loop-agent"
-    ],
-    "scout": [
-      "ai-engineering-context"
-    ],
-    "implementer": [
-      "verification-before-completion"
-    ],
-    "reviewer": [
-      "requesting-code-review"
-    ],
-    "verifier": [
-      "verification-before-completion",
-      "systematic-debugging"
-    ],
-    "closeout": [
-      "loop-agent",
-      "verification-before-completion"
-    ]
-  },
-  "executorModels": {
-    "cursor": {
-      "LOW": "composer-2.5",
-      "MED": "composer-2.5",
-      "HIGH": "composer-2.5"
-    },
-    "pi": {
-      "LOW": "gpt-5.3-codex-spark",
-      "MED": "glm-5.2",
-      "HIGH": "gpt-5.5"
-    }
-  },
-  "tasks": [
-    {
-      "id": "contract-pi",
-      "depends_on": [],
-      "complexity": "MED",
-      "executor": "pi",
-      "role": "planner",
-      "writePolicy": "read-only",
-      "allowedPaths": [
-        "**"
-      ],
-      "forbiddenPaths": [
-        ".harness/**",
-        "artifacts/**"
-      ],
-      "outputContract": "Plain Markdown implementation contract; no file writes.",
-      "subtask_prompt": "Read the task inputs and return a concise implementation contract: scope, risks, narrow write boundaries, parallel scout opportunities, and verification expectations. Do not edit files."
-    },
-    {
-      "id": "scout-src",
-      "depends_on": [
-        "contract-pi"
-      ],
-      "complexity": "LOW",
-      "executor": "pi",
-      "role": "scout",
-      "writePolicy": "read-only",
-      "allowedPaths": [
-        "REPLACE/WITH/SOURCE/PATH/**"
-      ],
-      "forbiddenPaths": [
-        ".harness/**",
-        "artifacts/**"
-      ],
-      "outputContract": "Plain Markdown source reconnaissance summary; no file writes.",
-      "subtask_prompt": "Perform read-only source reconnaissance. List relevant source files, existing patterns, and risks. Do not edit files."
-    },
-    {
-      "id": "scout-tests",
-      "depends_on": [
-        "contract-pi"
-      ],
-      "complexity": "LOW",
-      "executor": "pi",
-      "role": "scout",
-      "writePolicy": "read-only",
-      "allowedPaths": [
-        "REPLACE/WITH/TEST/PATH/**"
-      ],
-      "forbiddenPaths": [
-        ".harness/**",
-        "artifacts/**"
-      ],
-      "outputContract": "Plain Markdown test coverage reconnaissance summary; no file writes.",
-      "subtask_prompt": "Perform read-only test reconnaissance. List relevant tests, coverage gaps, and verification commands. Do not edit files."
-    },
-    {
-      "id": "implement-pi",
-      "depends_on": [
-        "scout-src",
-        "scout-tests"
-      ],
-      "complexity": "HIGH",
-      "executor": "pi",
-      "role": "implementer",
-      "writePolicy": "exclusive",
-      "writeSet": [
-        "REPLACE/WITH/ALLOWED/PATH/**"
-      ],
-      "allowedPaths": [
-        "REPLACE/WITH/ALLOWED/PATH/**"
-      ],
-      "forbiddenPaths": [
-        ".harness/**",
-        "artifacts/**"
-      ],
-      "outputContract": "Implementation summary with changed files, tests run, and risks.",
-      "subtask_prompt": "Implement the approved change within writeSet only. Keep the change minimal and update relevant tests/docs inside allowedPaths.",
-      "toolProfile": "write"
-    },
-    {
-      "id": "review-pi",
-      "depends_on": [
-        "implement-pi"
-      ],
-      "complexity": "MED",
-      "executor": "pi",
-      "role": "reviewer",
-      "writePolicy": "read-only",
-      "allowedPaths": [
-        "**"
-      ],
-      "forbiddenPaths": [
-        ".harness/**",
-        "artifacts/**"
-      ],
-      "outputContract": "Plain Markdown review summary; no file writes.",
-      "subtask_prompt": "Review upstream implementation output against the contract. Identify drift, missing tests, and residual risks. Do not edit files."
-    },
-    {
-      "id": "verify-shell",
-      "depends_on": [
-        "implement-pi"
-      ],
-      "complexity": "LOW",
-      "executor": "shell",
-      "role": "verifier",
-      "writePolicy": "read-only",
-      "allowedPaths": [
-        "./**"
-      ],
-      "forbiddenPaths": [
-        ".harness/**",
-        "artifacts/**"
-      ],
-      "outputContract": "Archived shell command stdout/stderr with exit codes; no worktree writes.",
-      "subtask_prompt": "Run deterministic loop-agent verification commands and archive outputs.",
-      "shell": {
-        "preset": "loop-agent-standard-verify",
-        "cwd": ".",
-        "timeoutMs": 300000
-      }
-    }
-  ]
-}
+{
+  "$schema": "./agent-dag.schema.json",
+  "version": 2,
+  "title": "Agent DAG base template",
+  "objective": "Replace with the concrete objective for this DAG run.",
+  "successCriteria": [
+    "Each node returns output matching its outputContract.",
+    "Same-rank read-only scouts run in parallel when their outputs are independent.",
+    "Only Pi nodes with toolProfile=write or explicitly enabled Cursor implementer nodes may write files, and only inside declared writeSet.",
+    "Pi nodes remain read-only unless toolProfile=write is explicitly selected for a bounded writer node.",
+    "Read-only nodes must not write root artifacts/**; root artifacts/ is not a per-node scratchpad."
+  ],
+  "globalConstraints": [
+    "Replace every REPLACE/WITH/... placeholder with concrete repo paths before execution; do not leave template placeholders in production DAG JSON.",
+    "Do not commit runtime traces under .harness/dag-runs/.",
+    "Do not write generated DAG input specs into .harness/dag-runs/active/.",
+    "Use a platform-native temp path such as <temp-dir>/<topic>-dag.json for one-off DAG specs; commit reusable templates under examples/ or docs/templates/.",
+    "Actual file operation paths must be macOS/Windows compatible; use / only for stable repo refs, JSON/Markdown evidence refs, and glob conventions.",
+    "Every task must explicitly declare executor; defaults.executor is schema-only and not a runtime fallback.",
+    "Prefer same-rank parallel read-only scouts over serial chains when outputs are independent.",
+    "Add depends_on only when a child truly needs upstream output; challenge single-chain topologies during review.",
+    "Same-rank exclusive writeSet entries must be disjoint.",
+    "Do not add provider fields to DAG JSON; provider routing is executor-owned.",
+    "Use executorModels for model routing; do not add defaults.model or legacy top-level models.",
+    "Every task must declare outputContract describing the expected Markdown/output shape.",
+    "exclusive implementer nodes must use narrow, concrete writeSet and allowedPaths; never keep broad write permissions such as ** or repo root.",
+    "Cursor is optional; no-Cursor environments should use Pi read-only scouts and Pi writer nodes with toolProfile=write."
+  ],
+  "defaults": {
+    "executor": "pi",
+    "contextProfile": "slim",
+    "skills": [
+      "ai-engineering-context"
+    ],
+    "writePolicy": "read-only"
+  },
+  "skillsByRole": {
+    "planner": [
+      "loop-agent"
+    ],
+    "scout": [
+      "ai-engineering-context"
+    ],
+    "implementer": [
+      "verification-before-completion"
+    ],
+    "reviewer": [
+      "requesting-code-review"
+    ],
+    "verifier": [
+      "verification-before-completion",
+      "systematic-debugging"
+    ],
+    "closeout": [
+      "loop-agent",
+      "verification-before-completion"
+    ]
+  },
+  "executorModels": {
+    "cursor": {
+      "LOW": "composer-2.5",
+      "MED": "composer-2.5",
+      "HIGH": "composer-2.5"
+    },
+    "pi": {
+      "LOW": "gpt-5.3-codex-spark",
+      "MED": "glm-5.2",
+      "HIGH": "gpt-5.5"
+    }
+  },
+  "tasks": [
+    {
+      "id": "contract-pi",
+      "depends_on": [],
+      "complexity": "MED",
+      "executor": "pi",
+      "role": "planner",
+      "writePolicy": "read-only",
+      "allowedPaths": [
+        "**"
+      ],
+      "forbiddenPaths": [
+        ".harness/**",
+        "artifacts/**"
+      ],
+      "outputContract": "Plain Markdown implementation contract; no file writes.",
+      "subtask_prompt": "Read the task inputs and return a concise implementation contract: scope, risks, narrow write boundaries, parallel scout opportunities, and verification expectations. Do not edit files."
+    },
+    {
+      "id": "scout-src",
+      "depends_on": [
+        "contract-pi"
+      ],
+      "complexity": "LOW",
+      "executor": "pi",
+      "role": "scout",
+      "writePolicy": "read-only",
+      "allowedPaths": [
+        "REPLACE/WITH/SOURCE/PATH/**"
+      ],
+      "forbiddenPaths": [
+        ".harness/**",
+        "artifacts/**"
+      ],
+      "outputContract": "Plain Markdown source reconnaissance summary; no file writes.",
+      "subtask_prompt": "Perform read-only source reconnaissance. List relevant source files, existing patterns, and risks. Do not edit files."
+    },
+    {
+      "id": "scout-tests",
+      "depends_on": [
+        "contract-pi"
+      ],
+      "complexity": "LOW",
+      "executor": "pi",
+      "role": "scout",
+      "writePolicy": "read-only",
+      "allowedPaths": [
+        "REPLACE/WITH/TEST/PATH/**"
+      ],
+      "forbiddenPaths": [
+        ".harness/**",
+        "artifacts/**"
+      ],
+      "outputContract": "Plain Markdown test coverage reconnaissance summary; no file writes.",
+      "subtask_prompt": "Perform read-only test reconnaissance. List relevant tests, coverage gaps, and verification commands. Do not edit files."
+    },
+    {
+      "id": "implement-pi",
+      "depends_on": [
+        "scout-src",
+        "scout-tests"
+      ],
+      "complexity": "HIGH",
+      "executor": "pi",
+      "role": "implementer",
+      "writePolicy": "exclusive",
+      "writeSet": [
+        "REPLACE/WITH/ALLOWED/PATH/**"
+      ],
+      "allowedPaths": [
+        "REPLACE/WITH/ALLOWED/PATH/**"
+      ],
+      "forbiddenPaths": [
+        ".harness/**",
+        "artifacts/**"
+      ],
+      "outputContract": "Implementation summary with changed files, tests run, and risks.",
+      "subtask_prompt": "Implement the approved change within writeSet only. Keep the change minimal and update relevant tests/docs inside allowedPaths.",
+      "toolProfile": "write"
+    },
+    {
+      "id": "review-pi",
+      "depends_on": [
+        "implement-pi"
+      ],
+      "complexity": "MED",
+      "executor": "pi",
+      "role": "reviewer",
+      "writePolicy": "read-only",
+      "allowedPaths": [
+        "**"
+      ],
+      "forbiddenPaths": [
+        ".harness/**",
+        "artifacts/**"
+      ],
+      "outputContract": "Plain Markdown review summary; no file writes.",
+      "subtask_prompt": "Review upstream implementation output against the contract. Identify drift, missing tests, and residual risks. Do not edit files."
+    },
+    {
+      "id": "verify-shell",
+      "depends_on": [
+        "implement-pi"
+      ],
+      "complexity": "LOW",
+      "executor": "shell",
+      "role": "verifier",
+      "writePolicy": "read-only",
+      "allowedPaths": [
+        "./**"
+      ],
+      "forbiddenPaths": [
+        ".harness/**",
+        "artifacts/**"
+      ],
+      "outputContract": "Archived shell command stdout/stderr with exit codes; no worktree writes.",
+      "subtask_prompt": "Run deterministic loop-agent verification commands and archive outputs.",
+      "shell": {
+        "preset": "loop-agent-standard-verify",
+        "cwd": ".",
+        "timeoutMs": 300000
+      }
+    }
+  ]
+}