@tea-agent/loop-agent 0.21.0 → 0.22.0

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 ## [Unreleased]
 
+## [0.22.0] - 2026-07-24
+
+### 重点更新
+
+- 前端规范读取范围扩展，新增 ai_workspace 作为并列来源，并独立展示各类规范证据
+- 前端实现 DAG 引入 lint 债务基线机制，精准区分存量与新增代码问题，减少误阻断
+- 前端预写门禁增强，强制校验真实的规范读取事件，避免遗漏关键上下文
+- 后端测试报告结构优化，新增 Markdown 报告并改进 HTML 报告的分层展示
+
+### 新增
+
+- 前端规范读取将 ai_workspace 目录与 openspec 相关目录作为并列来源，即使缺少 package.json 也能发现本地规范候选
+- Dashboard 规范证据 API 与界面独立展示知识库查询、openspec 检索和成功读取三类证据
+- 后端测试在同目录下新增生成 backend-test.md 报告，便于查阅测试结论与明细
+
+### 改进
+
+- 前端实现 DAG 允许未修改文件中的已知 lint 诊断作为基线债务继续，但对修改文件的新问题严格阻断
+- 后端测试 HTML 报告采用更清晰的分层展示，新增稳定结论图标与可折叠的质量校验明细，移除了原稳定性指标
+- 前端测试用例的内容完整性与证据检查降级为建议性反馈，不再因个别物料缺失阻断最终复盘
+- 设计文档与研发 DAG 拓扑说明同步更新，澄清了 profile/workflow/type 三套正交概念与当前实现状态
+
+### 修复
+
+- 修复前端技能指令可能超出预算限制的问题
+- 修复 DAG 未正确注册 DeepSeek Pi 模型提供者的问题
+- 修复前端目标项目验证路由不够健壮的问题
+- 修复后端测试中无法跨环境便携解析 Python 运行时的问题
+
 ## [0.21.0] - 2026-07-24
 
 ### 重点更新
@@ -18,6 +47,9 @@
 
 - backend-test 第 7 节点现在只执行最终 Markdown `自动化映射` 明确声明且安全校验通过的 pytest 脚本，避免历史或无关 `test_*.py` 混入本轮 JUnit/HTML；空映射、缺失脚本或越界路径会 fail-closed。
 - backend-test HTML 报告升级为更清晰的用例卡片：保留测试结论、质量状态和失败概览，直接展示简洁测试场景、自动化用例名称、结果与耗时，并为通过/失败用例都展示同次执行中脱敏且有界的接口请求参数与响应结果；HTML 不再附带技术证据章节，审计路径与哈希继续保留在 facts/JUnit。
+- frontend-test 第四节点不再扫描或阻断 pytest、原生 Playwright、`npx playwright`、`@playwright/test` 或 Node Playwright API 等可执行工具指令；该节点只保留 manifest、Case/AC/path、非生产 URL 和标准 `playwright-cli open` 前缀等结构与安全门禁，并强烈建议浏览器执行优先使用 `playwright-cli`。
+- frontend-test 用例内容、Case ID、AC 关联与 evidence 完整性检查改为 advisory：缺失或损坏的执行物料不再被自动改写为 blocked，也不阻断最终复盘；finding 汇入结构化结果，并在 Markdown retrospective 后生成中文 HTML 建议报告。路径越界、跨用例 evidence 引用、writeSet、生产环境与凭据安全仍保持硬门禁。
+- frontend-test checklist JavaScript 通过 Base64 参数交给 Node 解码执行，并修正变量声明顺序与重复语句，避免 Git Bash 将 `\s` / `\d`、反引号或引号破坏后再交给 Node。
 - 新初始化项目的 harness 指南同步 adaptive liveness、4h absolute max、stall 状态与 `termination-unconfirmed` 处置；旧项目可由 `init check-update` 识别未修改的受管指南，并通过 `init update --apply-safe` 安全刷新。
 
 ## [0.20.1] - 2026-07-24
@@ -63,6 +95,19 @@
 
 ### 新增
 
+- 继续收紧前端实现证据门禁：禁止空 verification contract，校验验证目标与 requirement/UI state/授权路径绑定；新版 review context 缺失 writer baseline 时直接阻断，非 `not-needed` Mock 策略必须提供 endpoint 与 consumer 证据。
+- 前端写入前重新校验 DAG 绑定源文件的 SHA-256；Mock endpoint 现在必须声明 fixture 与 consumer，且验证 trace 必须记录成功的 Mock 命令。
+- 前端验证 bundle 现在冻结实际命令文本，并将实现契约 targets 限制在 writer writeSet 内，避免验证证据与可写范围漂移。
+- 同步前端 prewrite/review context 的 DAG JSON Schema，避免生成 DAG 因 freshness、writeSet 或 baseline 字段漂移而被错误拒绝。
+- 前端 prewrite 现在强制校验需求源新鲜度，验证 Schema 也要求声明实际命令文本，减少旧 DAG 和证据配置的隐式降级。
+- 前端实现 DAG 的验证命令与侦察范围改为从目标项目自身的 package scripts、包管理器和允许路径推导，不再假设目标项目沿用 loop-agent 的目录与命令布局。
+
+### 改进
+
+- 前端实现 DAG 的验证命令与侦察范围改为从目标项目自身的 package scripts、包管理器和允许路径推导，不再假设目标项目沿用 loop-agent 的目录与命令布局。
+- 后端测试用例默认生成中文 README 索引与模块用例卡片，步骤、预期、需求依据和自动化映射更便于测试、研发与评审人员阅读。
+- 后端测试 HTML 主报告现在逐条展示用例编号、中文名称与场景、脚本、测试函数、结果、耗时和失败原因，完整技术详情可折叠查看。
+
 - streamline implementation DAG (#61)
 - improve human-readable artifacts
 
@@ -86,6 +131,7 @@
 ### 改进
 
 - `frontend-implementation` 保留独立 contract/scout，并把 Mock 策略与 implementation contract 合入 plan，把写前授权、验证/失败评估、复验和 review context 分别收敛为组合 shell 节点。standard/high-risk 固定 15 个顶层节点、small-risk 13 个；绿色路径执行 11 个节点、7 次 Pi，同时保留唯一 prewrite 写入授权、同 writeSet repair、真实 diff review 与 fail-closed closeout。
+- 加强前端实现节点的证据链：Trace 只绑定本次实际成功执行的验证命令，契约兼容转换不再补入占位文件或默认验证目标，Prewrite 要求上游节点明确完成，review context 校验 artifact 绑定，并以 writer 前工作区快照隔离既有用户改动。
 - 优化操作与观测统一界面的导航与布局，合并确认与运行为「开始运行」，DAG 详情跳转路径更加准确
 
 ### 修复

package/dist/adapters/loop-agent.js

@@ -63,6 +63,11 @@ function getVerifyCommands(repoRoot, options) {
     if (manifestCommands) {
         return applyQuota(manifestCommands, options);
     }
+    if (options.taskConfig?.taskKind === 'frontend-implementation') {
+        const frontendCommands = getFrontendProjectVerifyCommands(repoRoot, options);
+        if (frontendCommands)
+            return frontendCommands;
+    }
     const quickCommands = [
         {
             args: ['bash', 'scripts/check-repo.sh'],
@@ -91,6 +96,53 @@ function getVerifyCommands(repoRoot, options) {
             : [...quickCommands, ...standardCommands, ...fullCommands];
     return applyQuota(selectedCommands, options);
 }
+function getFrontendProjectVerifyCommands(repoRoot, options) {
+    let scripts;
+    try {
+        const packageJson = JSON.parse(readFileSync(path.join(repoRoot, 'package.json'), 'utf8'));
+        if (!packageJson.scripts || typeof packageJson.scripts !== 'object')
+            return undefined;
+        scripts = packageJson.scripts;
+    }
+    catch {
+        return undefined;
+    }
+    let packageManager = 'npm';
+    for (const [lockfile, manager] of [
+        ['pnpm-lock.yaml', 'pnpm'],
+        ['yarn.lock', 'yarn'],
+        ['bun.lockb', 'bun'],
+        ['bun.lock', 'bun'],
+    ]) {
+        try {
+            readFileSync(path.join(repoRoot, lockfile));
+            packageManager = manager;
+            break;
+        }
+        catch {
+            // Try the next package-manager marker.
+        }
+    }
+    const hasScript = (name) => typeof scripts[name] === 'string' && String(scripts[name]).trim().length > 0;
+    const commandFor = (name) => ({
+        args: name === 'test'
+            ? [packageManager, 'test']
+            : [packageManager, 'run', name],
+        cwd: repoRoot,
+        label: `${packageManager} ${name === 'test' ? 'test' : `run ${name}`}`,
+    });
+    const collect = (names) => names.filter(hasScript).map(commandFor);
+    const staticCommands = collect(['typecheck', 'check-types', 'lint', 'check', 'build']);
+    const behaviorCommands = collect(['test:unit', 'test:frontend', 'test:component', 'test', 'test:e2e', 'e2e']);
+    if (staticCommands.length === 0 && behaviorCommands.length === 0)
+        return undefined;
+    const selected = options.phase === 'final'
+        ? [...staticCommands, ...behaviorCommands]
+        : staticCommands;
+    if (selected.length === 0)
+        return behaviorCommands;
+    return applyQuota(selected, options);
+}
 function applyQuota(commands, options) {
     if (options.phase === 'final' || !options.quota || options.quota === 'full') {
         return commands;

package/dist/commands/init.js

@@ -522,10 +522,107 @@ has_npm_script() {
   node -e "const fs=require('fs'); const p=JSON.parse(fs.readFileSync('package.json','utf8')); process.exit(p.scripts && p.scripts[process.argv[1]] ? 0 : 1)" "\${script}" >/dev/null 2>&1
 }
 
+dag_lint_assessment_allows_skip() {
+  [[ -n "\${HARNESS_DAG_RUN_DIR:-}" ]] || return 1
+  command -v node >/dev/null 2>&1 || return 1
+  node - "\${HARNESS_DAG_RUN_DIR}" <<'NODE'
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+const runDir = path.resolve(process.argv[2]);
+const assessmentPath = path.join(runDir, "contracts", "frontend-lint-assessment.json");
+const fail = () => process.exit(1);
+const sha256 = (value) => crypto.createHash("sha256").update(value).digest("hex");
+const readContained = (relative) => {
+  if (typeof relative !== "string" || path.isAbsolute(relative)) fail();
+  const absolute = path.resolve(runDir, relative);
+  if (absolute !== runDir && !absolute.startsWith(runDir + path.sep)) fail();
+  return fs.readFileSync(absolute);
+};
+let assessment;
+try {
+  assessment = JSON.parse(fs.readFileSync(assessmentPath, "utf8"));
+} catch {
+  fail();
+}
+if (
+  assessment.schemaVersion !== 1 ||
+  assessment.schemaId !== "frontend-lint-assessment-v1" ||
+  !["passed", "baseline-debt"].includes(assessment.status) ||
+  !assessment.commandIdentity ||
+  !Array.isArray(assessment.commandIdentity.commands) ||
+  assessment.commandIdentity.commands.length === 0 ||
+  !Array.isArray(assessment.writerChangedFiles) ||
+  !Array.isArray(assessment.blockingDiagnostics) ||
+  assessment.blockingDiagnostics.length !== 0 ||
+  !Array.isArray(assessment.blockingReasons) ||
+  assessment.blockingReasons.length !== 0
+) fail();
+const commandHash = sha256(JSON.stringify(assessment.commandIdentity.commands));
+if (commandHash !== assessment.commandIdentity.sha256) fail();
+if (!assessment.commandIdentity.commands.every((command) =>
+  /(?:^|[\\s'"])npm(?:['"])?\\s+(?:['"])?run(?:['"])?\\s+(?:['"])?lint(?:['"])?(?:\\s|$)/.test(command)
+)) fail();
+if (
+  (assessment.status === "passed" && assessment.currentExitCode !== 0) ||
+  (assessment.status === "baseline-debt" && assessment.currentExitCode === 0)
+) fail();
+if (!assessment.baselineRef || assessment.baselineRef.nodeId !== "frontend-lint-baseline-shell") fail();
+const baselineRaw = readContained(assessment.baselineRef.path);
+if (sha256(baselineRaw) !== assessment.baselineRef.sha256) fail();
+let baseline;
+try {
+  baseline = JSON.parse(baselineRaw);
+} catch {
+  fail();
+}
+if (
+  baseline.schemaVersion !== 1 ||
+  baseline.schemaId !== "frontend-lint-baseline-v1" ||
+  baseline.status !== "available" ||
+  baseline.commandIdentity?.sha256 !== assessment.commandIdentity.sha256
+) fail();
+if (assessment.status === "baseline-debt") {
+  if (
+    !Array.isArray(assessment.currentDiagnostics) ||
+    assessment.currentDiagnostics.length === 0 ||
+    assessment.currentDiagnostics.length !== assessment.toleratedDiagnosticCount ||
+    !Array.isArray(baseline.diagnostics)
+  ) fail();
+  const key = (item) => JSON.stringify([
+    item.file, item.line, item.column, item.severity, item.message, item.ruleId ?? null,
+  ]);
+  const baselineCounts = new Map();
+  for (const item of baseline.diagnostics) {
+    const value = key(item);
+    baselineCounts.set(value, (baselineCounts.get(value) || 0) + 1);
+  }
+  const changed = new Set(assessment.writerChangedFiles);
+  for (const item of assessment.currentDiagnostics) {
+    if (changed.has(item.file)) fail();
+    const value = key(item);
+    const count = baselineCounts.get(value) || 0;
+    if (count === 0) fail();
+    baselineCounts.set(value, count - 1);
+  }
+}
+if (!Array.isArray(assessment.rawEvidenceRefs) || assessment.rawEvidenceRefs.length === 0) fail();
+for (const ref of assessment.rawEvidenceRefs) {
+  if (sha256(readContained(ref.path)) !== ref.sha256) fail();
+}
+process.exit(0);
+NODE
+}
+
 if [[ -f package.json ]]; then
   if command -v npm >/dev/null 2>&1; then
     for script in lint typecheck test build; do
       if has_npm_script "\${script}"; then
+        if [[ "\${script}" == "lint" ]] && dag_lint_assessment_allows_skip; then
+          echo "==> lint handled by frontend DAG assessment (status: passed or baseline-debt)"
+          ran=1
+          continue
+        fi
         run_cmd npm run "\${script}"
       fi
     done

package/dist/executors/dag-pi-executor.js

@@ -19,6 +19,8 @@ export const DAG_PI_MODEL_PROVIDERS = {
     "gpt-5.3-codex-spark": "wizard-local",
     "gpt-5.5": "wizard-local",
     "glm-5.2": "wizard-local",
+    "deepseek-v4-flash": "deepseek",
+    "deepseek-v4-pro": "deepseek",
 };
 const SAFE_PI_STEPS = new Set([
     "analyze",

package/dist/executors/shell-executor.js

@@ -14,6 +14,7 @@ import { formatFrontendWorktreeDiffStdout, runFrontendWorktreeDiffGate, } from "
 import { formatFrontendFailureAssessStdout, formatFrontendRepairContractStdout, runFrontendFailureAssessGate, runFrontendRepairContractGate, } from "../workflows/dag/frontend-repair.js";
 import { formatFrontendPrewriteGateStdout, runFrontendPrewriteGate, } from "../workflows/dag/frontend-prewrite-gate.js";
 import { formatFrontendReviewContextStdout, runFrontendReviewContextGate, } from "../workflows/dag/frontend-review-context.js";
+import { materializeFrontendLintAssessment, materializeFrontendLintBaseline, } from "../workflows/dag/frontend-lint-baseline.js";
 import { formatTraceabilityGateStdout, materializeBackendTestCaseManifest, runBackendTestTraceabilityGate, } from "../workflows/dag/backend-test-case-manifest.js";
 import { materializeBackendTestExecutionContract } from "../workflows/dag/backend-test-execution-contract.js";
 import { materializeBackendTestResultFromRunDir, parseJunitXml } from "../workflows/dag/backend-test-result-contract.js";
@@ -381,7 +382,9 @@ async function executeBackendTestPipeline(input, meta) {
             const pytestTargets = mappedScripts.map(shellQuote).join(" ");
             const pytestCommand = [
                 'mkdir -p "${HARNESS_DAG_RUN_DIR}/reports"',
-                `PYTHONUTF8=1 PYTHONIOENCODING=utf-8 PYTHONDONTWRITEBYTECODE=1 python -m pytest ${pytestTargets} -v -p no:cacheprovider -o junit_logging=all -o junit_log_passing_tests=true --junitxml="\${HARNESS_DAG_RUN_DIR}/reports/backend-test.junit.xml"`,
+                'PYTHON_BIN="$(command -v python || command -v python3 || true)"',
+                'if [ -z "${PYTHON_BIN}" ]; then echo "python/python3 is required for backend-test execution" >&2; exit 127; fi',
+                `PYTHONUTF8=1 PYTHONIOENCODING=utf-8 PYTHONDONTWRITEBYTECODE=1 "\${PYTHON_BIN}" -m pytest ${pytestTargets} -v -p no:cacheprovider -o junit_logging=all -o junit_log_passing_tests=true --junitxml="\${HARNESS_DAG_RUN_DIR}/reports/backend-test.junit.xml"`,
                 "STATUS=$?",
                 'printf "%s" "${STATUS}" > "${HARNESS_DAG_RUN_DIR}/reports/backend-test-pytest-exit.txt"',
                 'if { [ "${STATUS}" -eq 0 ] || [ "${STATUS}" -eq 1 ]; } && [ -s "${HARNESS_DAG_RUN_DIR}/reports/backend-test.junit.xml" ]; then exit 0; fi',
@@ -411,9 +414,10 @@ async function executeBackendTestPipeline(input, meta) {
             });
             const htmlPath = await writeRunReport(meta.runDir, "backend-test.html", htmlContent);
             const facts = renderBackendTestFacts({ parsed, cases, pytestExitCode, junitRelativePath: "reports/backend-test.junit.xml", htmlRelativePath: "reports/backend-test.html", junitContent, htmlContent, caseValidationSummary, traceabilitySummary });
+            const markdownPath = await writeRunReport(meta.runDir, "backend-test.md", facts);
             const factsPath = await writeRunReport(meta.runDir, "backend-test-facts.md", facts);
             const sanitizedOutputs = results.map((result) => redactBackendTestOutput(result.stdout));
-            outputs.push(...sanitizedOutputs, `html=${htmlPath}`, `facts=${factsPath}`, facts);
+            outputs.push(...sanitizedOutputs, `html=${htmlPath}`, `markdown=${markdownPath}`, `facts=${factsPath}`, facts);
         }
         else if (pipeline === "contracts") {
             const wrapperPath = path.join(meta.runDir, "analyze-and-discover-backend-test-pi.json");
@@ -661,13 +665,46 @@ async function executeFrontendVerificationBundle(input, meta) {
     catch {
         beforeStatus = undefined;
     }
+    const lintResults = [];
+    for (const command of bundle.lintCommands ?? []) {
+        const commandNumber = results.length + 1;
+        const result = await executeShellCommand({
+            command,
+            cwd,
+            timeoutMs: shell.timeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS,
+            envAllowlist: shell.envAllowlist,
+            dagRunMeta: { runDir: meta.runDir, runId: meta.runId },
+            outputArtifacts: {
+                stdoutPath: path.join(meta.runDir, input.task.id, "commands", `${commandNumber}.stdout.txt`),
+                stderrPath: path.join(meta.runDir, input.task.id, "commands", `${commandNumber}.stderr.txt`),
+            },
+        });
+        lintResults.push(result);
+        results.push(result);
+    }
+    let lintAssessment;
+    if ((bundle.lintCommands?.length ?? 0) > 0 &&
+        bundle.lintBaselineNodeId &&
+        (bundle.writerNodeIds?.length ?? 0) > 0) {
+        lintAssessment = await materializeFrontendLintAssessment({
+            runDir: meta.runDir,
+            workspaceRoot: input.cwd,
+            commands: bundle.lintCommands,
+            results: lintResults,
+            baselineNodeId: bundle.lintBaselineNodeId,
+            writerNodeIds: bundle.writerNodeIds,
+        });
+    }
+    const lintBlocked = lintAssessment?.status === "failed" ||
+        lintAssessment?.status === "unavailable";
     const groups = [
-        { name: "mock", commands: bundle.mockCommands },
-        { name: "static", commands: bundle.staticCommands },
-        { name: "behavior", commands: bundle.behaviorCommands },
+        { name: "mock", commands: bundle.mockCommands, labels: bundle.mockEvidence?.commandLabels ?? [] },
+        { name: "static", commands: bundle.staticCommands, labels: bundle.staticEvidence.commandLabels },
+        { name: "behavior", commands: bundle.behaviorCommands, labels: bundle.behaviorEvidence.commandLabels },
     ];
-    for (const group of groups) {
-        for (const command of group.commands) {
+    const successfulLabels = new Map();
+    for (const group of lintBlocked ? [] : groups) {
+        for (const [index, command] of group.commands.entries()) {
             const commandNumber = results.length + 1;
             const result = await executeShellCommand({
                 command,
@@ -681,6 +718,11 @@ async function executeFrontendVerificationBundle(input, meta) {
                 },
             });
             results.push(result);
+            if (result.ok && group.labels[index]) {
+                const labels = successfulLabels.get(group.name) ?? [];
+                labels.push(group.labels[index]);
+                successfulLabels.set(group.name, labels);
+            }
             if (!result.ok)
                 break;
         }
@@ -713,20 +755,36 @@ async function executeFrontendVerificationBundle(input, meta) {
         failureCategory: result.failureCategory,
         command: result.command,
     }));
-    const firstFailure = results.find((result) => !result.ok);
+    const firstFailure = lintBlocked
+        ? lintResults.find((result) => !result.ok)
+        : results
+            .filter((result) => !lintResults.includes(result))
+            .find((result) => !result.ok);
+    const lintSyntheticFailure = lintBlocked && !firstFailure
+        ? {
+            failureCategory: "invalid-output",
+            stderr: lintAssessment?.blockingReasons.join("; ") ??
+                "frontend lint assessment failed",
+        }
+        : undefined;
     let traceError;
     try {
         await runFrontendVerificationTraceGate({
             runDir: meta.runDir,
             workspaceRoot: input.cwd,
             evidence: {
+                mock: {
+                    nodeId: input.task.id,
+                    commandLabels: successfulLabels.get("mock") ?? [],
+                    commandTexts: bundle.mockCommands.slice(0, successfulLabels.get("mock")?.length ?? 0),
+                },
                 static: {
                     nodeId: input.task.id,
-                    commandLabels: bundle.staticEvidence.commandLabels,
+                    commandLabels: successfulLabels.get("static") ?? [],
                 },
                 behavior: {
                     nodeId: input.task.id,
-                    commandLabels: bundle.behaviorEvidence.commandLabels,
+                    commandLabels: successfulLabels.get("behavior") ?? [],
                 },
             },
         });
@@ -735,19 +793,26 @@ async function executeFrontendVerificationBundle(input, meta) {
         traceError = error instanceof Error ? error : new Error(String(error));
     }
     if (bundle.mode === "repair") {
-        if (firstFailure || traceError) {
+        if (firstFailure || lintSyntheticFailure || traceError) {
             return {
                 ok: false,
                 stdout: summarizeCommandResults(results).stdout,
-                stderr: firstFailure?.stderr || traceError?.message || "frontend reverify failed",
-                failureCategory: firstFailure?.failureCategory ?? "invalid-output",
+                stderr: firstFailure?.stderr ||
+                    lintSyntheticFailure?.stderr ||
+                    traceError?.message ||
+                    "frontend reverify failed",
+                failureCategory: firstFailure?.failureCategory ??
+                    lintSyntheticFailure?.failureCategory ??
+                    "invalid-output",
                 durationMs: Date.now() - started,
                 ...{ commandResults },
             };
         }
         return {
             ok: true,
-            stdout: "Frontend reverify bundle: pass",
+            stdout: lintAssessment?.status === "baseline-debt"
+                ? "Frontend reverify bundle: pass with lint baseline-debt"
+                : "Frontend reverify bundle: pass",
             stderr: "",
             failureCategory: "success",
             durationMs: Date.now() - started,
@@ -755,14 +820,22 @@ async function executeFrontendVerificationBundle(input, meta) {
         };
     }
     const failureFacts = [];
-    if (firstFailure) {
+    if (firstFailure || lintSyntheticFailure) {
+        const failureStdout = firstFailure
+            ? [firstFailure.command, firstFailure.stdout]
+                .filter(Boolean)
+                .join("\n")
+            : "";
         failureFacts.push({
             nodeId: input.task.id,
             record: {
                 status: "FINISHED",
-                failureCategory: firstFailure.failureCategory,
-                stdout: summarizeCommandResults(results).stdout,
-                stderr: firstFailure.stderr,
+                failureCategory: firstFailure?.failureCategory ??
+                    lintSyntheticFailure?.failureCategory,
+                // Keep classification scoped to the failed command. Aggregate
+                // successful output may contain unrelated writeSet-like JSON.
+                stdout: failureStdout,
+                stderr: firstFailure?.stderr ?? lintSyntheticFailure?.stderr,
                 commandResults,
             },
         });
@@ -803,6 +876,68 @@ async function executeFrontendVerificationBundle(input, meta) {
         };
     }
 }
+async function executeFrontendLintBaseline(input, meta) {
+    const started = Date.now();
+    const shell = input.task.shell;
+    const baseline = shell.frontendLintBaseline;
+    const cwd = resolveShellCwd(input.cwd, shell.cwd);
+    let beforeStatus;
+    try {
+        beforeStatus = await readGitStatusPorcelain(input.cwd);
+    }
+    catch {
+        beforeStatus = undefined;
+    }
+    const results = [];
+    for (const command of baseline.lintCommands) {
+        const commandNumber = results.length + 1;
+        results.push(await executeShellCommand({
+            command,
+            cwd,
+            timeoutMs: shell.timeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS,
+            envAllowlist: shell.envAllowlist,
+            dagRunMeta: { runDir: meta.runDir, runId: meta.runId },
+            outputArtifacts: {
+                stdoutPath: path.join(meta.runDir, input.task.id, "commands", `${commandNumber}.stdout.txt`),
+                stderrPath: path.join(meta.runDir, input.task.id, "commands", `${commandNumber}.stderr.txt`),
+            },
+        }));
+    }
+    let afterStatus;
+    try {
+        afterStatus = await readGitStatusPorcelain(input.cwd);
+    }
+    catch {
+        afterStatus = undefined;
+    }
+    try {
+        const materialized = await materializeFrontendLintBaseline({
+            runDir: meta.runDir,
+            workspaceRoot: input.cwd,
+            commands: baseline.lintCommands,
+            results,
+            worktreeChanged: beforeStatus === undefined ||
+                afterStatus === undefined ||
+                beforeStatus !== afterStatus,
+        });
+        return {
+            ok: true,
+            stdout: `Frontend lint baseline: ${materialized.artifact.status}\nArtifact: ${materialized.ref.path}\nDiagnostics: ${materialized.artifact.diagnostics.length}`,
+            stderr: materialized.artifact.reason ?? "",
+            failureCategory: "success",
+            durationMs: Date.now() - started,
+        };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            stdout: "",
+            stderr: error instanceof Error ? error.message : String(error),
+            failureCategory: "invalid-output",
+            durationMs: Date.now() - started,
+        };
+    }
+}
 export async function executeDagShellNode(input, meta) {
     const shell = input.task.shell;
     if (shell?.frontendPrewriteGate) {
@@ -812,6 +947,7 @@ export async function executeDagShellNode(input, meta) {
                 runDir: meta.runDir,
                 config: shell.frontendPrewriteGate,
                 sourceBinding: meta.spec.sourceBinding,
+                workspaceRoot: input.cwd,
                 repoRoot: input.cwd,
             });
             return { ok: true, stdout: formatFrontendPrewriteGateStdout(result), stderr: "", failureCategory: "success", durationMs: Date.now() - started };
@@ -820,13 +956,20 @@ export async function executeDagShellNode(input, meta) {
             return { ok: false, stdout: "", stderr: error instanceof Error ? error.message : String(error), failureCategory: "invalid-output", durationMs: Date.now() - started };
         }
     }
+    if (shell?.frontendLintBaseline) {
+        return executeFrontendLintBaseline(input, meta);
+    }
     if (shell?.frontendVerificationBundle) {
         return executeFrontendVerificationBundle(input, meta);
     }
     if (shell?.frontendReviewContext) {
         const started = Date.now();
         try {
-            const result = await runFrontendReviewContextGate({ runDir: meta.runDir, workspaceRoot: input.cwd });
+            const result = await runFrontendReviewContextGate({
+                runDir: meta.runDir,
+                workspaceRoot: input.cwd,
+                requireBaseline: shell.frontendReviewContext.requireBaseline,
+            });
             return { ok: true, stdout: formatFrontendReviewContextStdout(result), stderr: "", failureCategory: "success", durationMs: Date.now() - started };
         }
         catch (error) {

package/dist/shared/openspec-spec.js

@@ -0,0 +1,49 @@
+/**
+ * Shared openspec specification path predicates.
+ *
+ * Canonical frontend specification directories (case-sensitive) and extension
+ * allowlist.
+ * All consumers in candidate discovery, DAG schema, prewrite gate, and observe
+ * must use these predicates to ensure a single consistent scope definition.
+ */
+/** Canonical spec directories (case-sensitive, POSIX form). */
+export const OPENSPEC_SPEC_DIRS = [
+    "openspec/schemas",
+    "openspec/project-specs",
+    "ai_workspace",
+];
+/** Allowed spec file extensions (case-insensitive). */
+export const OPENSPEC_SPEC_EXT_RE = /\.(md|mdx|json|yaml|yml)$/i;
+/**
+ * Returns `true` when `filePath` is inside one of the canonical frontend spec
+ * directories.  `filePath` must be a repo-relative POSIX path (backslashes are
+ * normalised internally).  Directory names are case-sensitive.
+ */
+export function isOpenspecSpecPath(filePath) {
+    const normalized = filePath.replaceAll("\\", "/");
+    for (const dir of OPENSPEC_SPEC_DIRS) {
+        if (normalized === dir || normalized.startsWith(dir + "/"))
+            return true;
+    }
+    return false;
+}
+/**
+ * Returns `true` when `filename` (the basename only, not a full path) has an
+ * allowed frontend specification extension.
+ */
+export function isValidOpenspecExtension(filename) {
+    return OPENSPEC_SPEC_EXT_RE.test(filename);
+}
+/** Returns `true` for a supported file inside a canonical openspec spec dir. */
+export function isOpenspecSpecFilePath(filePath) {
+    return (isOpenspecSpecPath(filePath) &&
+        isValidOpenspecExtension(filePath.replaceAll("\\", "/")));
+}
+/**
+ * Returns `true` when free-form search input references a canonical frontend
+ * specification directory with exact lowercase directory names.
+ */
+export function isOpenspecSpecSearchTarget(value) {
+    const normalized = value.replaceAll("\\", "/");
+    return /(?:^|[^A-Za-z0-9_.-])(?:openspec\/(?:schemas|project-specs)|ai_workspace)(?:\/|$)/.test(normalized);
+}

package/dist/worker/observability/read-model.js

@@ -8,6 +8,7 @@ import { getTaskPoolRoot, listLegacyStateFiles, listTaskPoolStates, } from "../p
 import { assessDagRunLiveness, assessDagRunRecoveryEligibility, deriveDagRunEffectiveStatus, } from "../../workflows/dag/lifecycle.js";
 import { parseDagSpec, resolveModelForTask, } from "../../workflows/dag/types.js";
 import { loadFeatureDecisionModels } from "../feature/decision-loader.js";
+import { frontendLintAssessmentArtifactSchema } from "../../workflows/dag/frontend-lint-baseline.js";
 /** Internal map key: featureId + NUL + taskId (stable, non-printable delimiter). */
 export function taskIdentityKey(featureId, taskId) {
     return `${featureId}\0${taskId}`;
@@ -1525,6 +1526,21 @@ async function loadBackendTestProjection(runDir, nodes) {
         ...(manifest && manifest.coverageSummary ? { coverage: manifest.coverageSummary } : {}),
     };
 }
+async function loadFrontendLintProjection(runDir) {
+    const decoded = await safeReadJson(path.join(runDir, "contracts", "frontend-lint-assessment.json"));
+    if (!decoded)
+        return undefined;
+    const parsed = frontendLintAssessmentArtifactSchema.safeParse(decoded);
+    if (!parsed.success)
+        return undefined;
+    return {
+        status: parsed.data.status,
+        writerChangedFiles: parsed.data.writerChangedFiles,
+        toleratedDiagnosticCount: parsed.data.toleratedDiagnosticCount,
+        blockingDiagnosticCount: parsed.data.blockingDiagnostics.length,
+        blockingReasons: parsed.data.blockingReasons,
+    };
+}
 async function parseDagStateFile(statePath, now) {
     try {
         if (!existsSync(statePath))
@@ -1579,7 +1595,10 @@ async function parseDagStateFile(statePath, now) {
                 liveness: liveness.status,
             })
             : undefined;
-        const backendTest = await loadBackendTestProjection(runDir, nodes);
+        const [backendTest, frontendLint] = await Promise.all([
+            loadBackendTestProjection(runDir, nodes),
+            loadFrontendLintProjection(runDir),
+        ]);
         const continuationRecord = state.continuation &&
             typeof state.continuation.parentRunId === "string" &&
             typeof state.continuation.effectiveFromNodeId === "string" &&
@@ -1631,6 +1650,7 @@ async function parseDagStateFile(statePath, now) {
             dagPath: runDir,
             ...(continuation ? { continuation } : {}),
             ...(backendTest ? { backendTest } : {}),
+            ...(frontendLint ? { frontendLint } : {}),
         };
     }
     catch {