@tea-agent/loop-agent 0.24.11-beta.0 → 0.25.0

package/dist/worker/delivery/git-transaction.js

@@ -101,11 +101,12 @@ export async function finalizeGitTask(transaction, outcome) {
     await assertTransactionPosition(transaction.repoRoot, current);
     const currentIgnored = await readIgnoredBaseline(transaction.repoRoot);
     const ignoredBaselineByPath = new Map(current.ignoredBaseline.map((entry) => [entry.path, entry.sha256]));
-    const changedBaselineIgnored = currentIgnored.filter((entry) => ignoredBaselineByPath.has(entry.path) && ignoredBaselineByPath.get(entry.path) !== entry.sha256).map((entry) => entry.path);
-    const missingBaselineIgnored = current.ignoredBaseline.filter((entry) => !currentIgnored.some((candidate) => candidate.path === entry.path)).map((entry) => entry.path);
-    if (changedBaselineIgnored.length > 0 || missingBaselineIgnored.length > 0) {
-        throw new Error(`pre-existing ignored file changed during Git transaction: ${[...changedBaselineIgnored, ...missingBaselineIgnored].join(", ")}`);
-    }
+    const changedBaselineIgnored = currentIgnored
+        .filter((entry) => ignoredBaselineByPath.has(entry.path) && ignoredBaselineByPath.get(entry.path) !== entry.sha256)
+        .map((entry) => entry.path);
+    const missingBaselineIgnored = current.ignoredBaseline
+        .filter((entry) => !currentIgnored.some((candidate) => candidate.path === entry.path))
+        .map((entry) => entry.path);
     const existing = current.checkpoints.find((entry) => entry.workerRunId === outcome.workerRunId);
     if (outcome.status === "reused" || existing) {
         if (!existing)
@@ -123,12 +124,28 @@ export async function finalizeGitTask(transaction, outcome) {
     const newIgnored = currentIgnored.map((entry) => entry.path).filter((entry) => !ignoredBaselineByPath.has(entry));
     if (outcome.status === "succeeded") {
         const allowedPaths = expandAllowedPathsForWorkflow(resolveWorkflow(outcome.taskSpec).workflow, outcome.taskSpec.constraints.allowed_paths);
+        const isAllowedEvidencePath = (entry) => !isSensitivePath(entry) &&
+            !isEphemeralToolCachePath(entry) &&
+            allowedPaths.some((glob) => matchesGlob(entry, glob));
+        // Pre-existing ignored evidence under allowed_paths may be rewritten by
+        // FINAL-VERIFY smoke / verify-final and must force-add into the checkpoint.
+        // Other baseline ignored mutations remain fail-closed (e.g. dist/, secrets).
+        const blockedBaselineChanged = changedBaselineIgnored.filter((entry) => !isAllowedEvidencePath(entry));
+        const blockedBaselineMissing = missingBaselineIgnored.filter((entry) => !isEphemeralToolCachePath(entry) && !isAllowedEvidencePath(entry));
+        if (blockedBaselineChanged.length > 0 || blockedBaselineMissing.length > 0) {
+            throw new Error(`pre-existing ignored file changed during Git transaction: ${[...blockedBaselineChanged, ...blockedBaselineMissing].join(", ")}`);
+        }
         // Evidence under allowed_paths may be gitignored for local convenience (e.g.
         // reports/welcome/** smoke JSON) but must still checkpoint for Task Pool Done.
         // Sensitive / out-of-scope ignored files remain fail-closed; ephemeral tool
         // caches neither block nor force-add.
         const forceAddIgnored = [];
         const blockedIgnored = [];
+        const rewrittenBaselineEvidence = changedBaselineIgnored.filter((entry) => isAllowedEvidencePath(entry));
+        for (const entry of rewrittenBaselineEvidence) {
+            if (!forceAddIgnored.includes(entry))
+                forceAddIgnored.push(entry);
+        }
         for (const entry of newIgnored) {
             if (isEphemeralToolCachePath(entry))
                 continue;
@@ -137,7 +154,8 @@ export async function finalizeGitTask(transaction, outcome) {
                 continue;
             }
             if (allowedPaths.some((glob) => matchesGlob(entry, glob))) {
-                forceAddIgnored.push(entry);
+                if (!forceAddIgnored.includes(entry))
+                    forceAddIgnored.push(entry);
             }
             else {
                 blockedIgnored.push(entry);
@@ -166,7 +184,10 @@ export async function finalizeGitTask(transaction, outcome) {
             await assertTransactionPosition(transaction.repoRoot, { ...current, lastCheckpoint: commit });
             await assertCheckpointMetadata(transaction.repoRoot, commit, outcome.taskSpec, outcome.workerRunId);
             const afterCommitIgnored = await readIgnoredBaseline(transaction.repoRoot);
-            assertIgnoredBaselineUnchanged(current.ignoredBaseline.filter((entry) => !isEphemeralToolCachePath(entry.path)), afterCommitIgnored.filter((entry) => !isEphemeralToolCachePath(entry.path)));
+            // force-add may promote allowed evidence from ignored → tracked; drop those
+            // paths from the post-commit baseline equality check.
+            const forceAdded = new Set(forceAddIgnored);
+            assertIgnoredBaselineUnchanged(current.ignoredBaseline.filter((entry) => !isEphemeralToolCachePath(entry.path) && !forceAdded.has(entry.path)), afterCommitIgnored.filter((entry) => !isEphemeralToolCachePath(entry.path) && !forceAdded.has(entry.path)));
         }
         catch (error) {
             const branch = await git(transaction.repoRoot, ["branch", "--show-current"]).catch(() => "");
@@ -199,6 +220,10 @@ export async function finalizeGitTask(transaction, outcome) {
             changedFiles: checkpointFiles,
         };
     }
+    // Failed / keep-diff paths still fail closed on unexpected baseline ignored mutations.
+    if (changedBaselineIgnored.length > 0 || missingBaselineIgnored.length > 0) {
+        throw new Error(`pre-existing ignored file changed during Git transaction: ${[...changedBaselineIgnored, ...missingBaselineIgnored].join(", ")}`);
+    }
     const artifactDir = path.join(path.dirname(transaction.recordPath), "failures", outcome.workerRunId);
     await captureFailureArtifacts(transaction.repoRoot, artifactDir, changes, newIgnored, outcome);
     if (outcome.keepFailedDiff) {

package/dist/worker/delivery/package.js

@@ -284,11 +284,15 @@ export async function validateDeliveryPackage(input) {
             blockers.push(`Acceptance coverage status is not derivable: ${ac.id}`);
         if (JSON.stringify([...item.blockedBy].sort()) !== JSON.stringify([...blockedBy].sort()))
             blockers.push(`Acceptance blockers changed: ${ac.id}`);
-        for (const ref of expectedRefs)
-            if (!item.evidence.some((candidate) => candidate.path === ref.path && candidate.sha256 === ref.sha256))
-                blockers.push(`Acceptance run evidence is missing: ${ac.id}`);
-        if (qa?.data.acIds.includes(ac.id) && !item.evidence.some((candidate) => candidate.path === qa.ref.path && candidate.sha256 === qa.ref.sha256))
-            blockers.push(`Acceptance QA evidence is missing: ${ac.id}`);
+        // partial / missing / blocked should-ACs intentionally omit full evidence lists
+        // (only must ACs covered by QA require run+QA hash binding).
+        if (expectedStatus === "covered") {
+            for (const ref of expectedRefs)
+                if (!item.evidence.some((candidate) => candidate.path === ref.path && candidate.sha256 === ref.sha256))
+                    blockers.push(`Acceptance run evidence is missing: ${ac.id}`);
+            if (qa?.data.acIds.includes(ac.id) && !item.evidence.some((candidate) => candidate.path === qa.ref.path && candidate.sha256 === qa.ref.sha256))
+                blockers.push(`Acceptance QA evidence is missing: ${ac.id}`);
+        }
         for (const ref of item.evidence)
             if (!await hashedRefValid(repoRoot, ref))
                 blockers.push(`Acceptance evidence changed: ${item.acId}`);

package/dist/worker/delivery/verification-bundle.js

@@ -404,7 +404,23 @@ export async function verifyBundleOutcomes(repoRoot, bundle) {
             return false;
         if (JSON.stringify(verified.artifacts) !== JSON.stringify(outcome.artifacts))
             return false;
-        if (!await verifyArtifactRefs(repoRoot, outcome.artifacts))
+        // Rehash only durable typed evidence. run_record/dag_json may be rewritten
+        // after outcome projection (worker-run-record appends report commands).
+        const evidenceArtifacts = outcome.artifacts.filter((artifact) => {
+            const kind = artifact.kind ?? "";
+            if (kind === "run_record" || kind === "dag_json")
+                return false;
+            if (kind === "backend-test-result" ||
+                kind === "frontend-test-result" ||
+                kind.includes("backend-test-result") ||
+                kind.includes("frontend-test-result")) {
+                return true;
+            }
+            // Unknown kinds: still rehash unless clearly infrastructure paths.
+            return (!artifact.path.includes("worker-run-record") &&
+                !artifact.path.includes("-dag.json"));
+        });
+        if (!await verifyArtifactRefs(repoRoot, evidenceArtifacts))
             return false;
     }
     return true;
@@ -417,9 +433,12 @@ export function verifyBundleTaskSpecBindings(bundle, specs) {
             return false;
         taskIds.add(outcome.taskId);
         const spec = specs.get(outcome.taskId);
+        // Typed verification tasks may be qa-execute (frontend-test) or qa-testcode
+        // (backend-test Markdown-first). Delivery binds on feature_id + workflow.
+        const typedVerificationTypes = new Set(["qa-execute", "qa-testcode"]);
         if (!spec ||
             spec.feature_id !== bundle.featureId ||
-            spec.type !== "qa-execute" ||
+            !typedVerificationTypes.has(spec.type) ||
             spec.execution?.workflow !== outcome.workflow)
             return false;
     }
@@ -460,9 +479,11 @@ async function verifyArtifactRefs(repoRoot, artifacts) {
         return false;
     }
     for (const artifact of artifacts) {
-        if (path.isAbsolute(artifact.path))
-            return false;
-        const lexical = path.resolve(canonicalRepoRoot, artifact.path);
+        // Accept absolute paths only when they resolve inside the repo (legacy
+        // envelopes may store abs paths). Prefer relative for new projections.
+        const lexical = path.isAbsolute(artifact.path)
+            ? path.resolve(artifact.path)
+            : path.resolve(canonicalRepoRoot, artifact.path);
         let resolved;
         let content;
         try {

package/dist/worker/feature/advance.js

@@ -0,0 +1,301 @@
+import path from "node:path";
+import { defaultFeatureEvidencePaths, runFeatureFinalVerification, } from "../delivery/final-verification.js";
+import { prepareFeatureDelivery, } from "../delivery/package.js";
+import { applyFeatureCloseout, } from "../closeout/apply.js";
+import { previewFeatureCloseout, } from "../closeout/preview.js";
+import { validateFeatureTaskGraph } from "../task-graph/validate.js";
+import { reviewFeature } from "./review.js";
+const defaultDeps = {
+    validateFeature: validateFeatureTaskGraph,
+    review: reviewFeature,
+    verifyFinal: runFeatureFinalVerification,
+    delivery: prepareFeatureDelivery,
+    previewCloseout: previewFeatureCloseout,
+    applyCloseout: applyFeatureCloseout,
+};
+/**
+ * ADR 0007 orchestration: verify-final → delivery → closeout preview[/apply].
+ * Does not run implementation tasks (use `feature run` for Ready writers).
+ */
+export async function advanceFeature(input, deps = defaultDeps) {
+    const featureDir = path.resolve(input.featureDir);
+    const repoRoot = path.resolve(input.repoRoot);
+    const dryRun = input.dryRun ?? false;
+    const apply = Boolean(input.apply) && !dryRun;
+    const steps = [];
+    const blockers = [];
+    const started = Date.now();
+    const push = (id, status, message, from = started) => {
+        steps.push({
+            id,
+            status,
+            ...(message ? { message } : {}),
+            durationMs: Math.max(0, Date.now() - from),
+        });
+    };
+    const validateStarted = Date.now();
+    const validation = await deps.validateFeature(featureDir);
+    if (!validation.ok) {
+        push("validate", "failed", validation.errors.map((e) => e.code).join(", "), validateStarted);
+        return {
+            schemaVersion: 1,
+            featureId: validation.featureId || "unknown",
+            mode: dryRun ? "dry-run" : "executed",
+            status: "failed",
+            finalTaskId: null,
+            steps,
+            blockers: validation.errors.map((e) => e.message),
+            nextCommand: `agent-worker task validate-feature ${JSON.stringify(featureDir)}`,
+        };
+    }
+    push("validate", "completed", `featureId=${validation.featureId}`, validateStarted);
+    const featureId = validation.featureId;
+    const resolveStarted = Date.now();
+    let finalTaskId = input.taskId?.trim() || "";
+    if (!finalTaskId) {
+        const model = await deps.review({ featureDir, repoRoot });
+        finalTaskId = resolveFinalVerifyTaskId(model) ?? "";
+    }
+    if (!finalTaskId) {
+        push("resolve-final-task", "failed", "could not resolve FINAL-VERIFY task id", resolveStarted);
+        return {
+            schemaVersion: 1,
+            featureId,
+            mode: dryRun ? "dry-run" : "executed",
+            status: "failed",
+            finalTaskId: null,
+            steps,
+            blockers: [
+                "missing --task-id and no FINAL-VERIFY* task found in Feature review",
+            ],
+            nextCommand: `agent-worker feature review --feature-dir ${JSON.stringify(featureDir)} --repo ${JSON.stringify(repoRoot)}`,
+        };
+    }
+    push("resolve-final-task", "completed", finalTaskId, resolveStarted);
+    if (!input.client) {
+        push("verify-final", "failed", "loop-agent client required for verify-final");
+        return {
+            schemaVersion: 1,
+            featureId,
+            mode: dryRun ? "dry-run" : "executed",
+            status: "failed",
+            finalTaskId,
+            steps,
+            blockers: [
+                "feature advance requires --loop-agent-bin / client for verify-final",
+            ],
+        };
+    }
+    const verifyStarted = Date.now();
+    let verifyFinal;
+    try {
+        verifyFinal = await deps.verifyFinal({
+            featureDir,
+            repoRoot,
+            taskId: finalTaskId,
+            client: input.client,
+            controllerIdentity: input.controllerIdentity ?? input.client.getIdentity?.(),
+            ...(input.controllerExpectation
+                ? { controllerExpectation: input.controllerExpectation }
+                : {}),
+            evidenceMode: input.evidenceMode ?? "auto",
+            ...(input.now ? { now: input.now } : {}),
+        });
+        push("verify-final", "completed", `mode=${verifyFinal.evidenceMode ?? "qa-execute"}`, verifyStarted);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        push("verify-final", "failed", message, verifyStarted);
+        return {
+            schemaVersion: 1,
+            featureId,
+            mode: dryRun ? "dry-run" : "executed",
+            status: "failed",
+            finalTaskId,
+            steps,
+            blockers: [message],
+            nextCommand: `agent-worker feature verify-final --feature-dir ${JSON.stringify(featureDir)} --repo ${JSON.stringify(repoRoot)} --task-id ${JSON.stringify(finalTaskId)} --json`,
+        };
+    }
+    const defaults = defaultFeatureEvidencePaths(featureId);
+    const qaEvidencePath = input.qaEvidencePath ??
+        verifyFinal.qaEvidencePath ??
+        defaults.qaEvidencePath;
+    const finalVerificationPath = input.finalVerificationPath ??
+        verifyFinal.finalVerificationPath ??
+        defaults.finalVerificationPath;
+    const deliveryStarted = Date.now();
+    const delivery = await deps.delivery({
+        featureDir,
+        repoRoot,
+        qaEvidencePath,
+        finalVerificationPath,
+        ...(input.waiverPath ? { waiverPath: input.waiverPath } : {}),
+        dryRun,
+        ...(input.now ? { now: input.now } : {}),
+    });
+    if (delivery.status === "blocked") {
+        push("delivery", "failed", delivery.blockers.join("; ") || "blocked", deliveryStarted);
+        return {
+            schemaVersion: 1,
+            featureId,
+            mode: dryRun ? "dry-run" : "executed",
+            status: "blocked",
+            finalTaskId,
+            steps,
+            verifyFinal,
+            delivery,
+            blockers: delivery.blockers,
+            nextCommand: `agent-worker feature delivery --feature-dir ${JSON.stringify(featureDir)} --repo ${JSON.stringify(repoRoot)} --json`,
+        };
+    }
+    push("delivery", "completed", delivery.status, deliveryStarted);
+    const previewStarted = Date.now();
+    const closeoutPreview = await deps.previewCloseout({
+        featureDir,
+        repoRoot,
+        ...(input.now ? { now: input.now } : {}),
+    });
+    if (closeoutPreview.status !== "ready") {
+        const failedGates = closeoutPreview.gates
+            .filter((g) => !g.passed)
+            .map((g) => `${g.id}: ${g.message}`);
+        push("closeout-preview", "failed", failedGates.join("; ") || "blocked", previewStarted);
+        blockers.push(...failedGates);
+        return {
+            schemaVersion: 1,
+            featureId,
+            mode: dryRun ? "dry-run" : "executed",
+            status: "blocked",
+            finalTaskId,
+            steps,
+            verifyFinal,
+            delivery,
+            closeoutPreview,
+            blockers,
+            nextCommand: `agent-worker feature closeout --feature-dir ${JSON.stringify(featureDir)} --repo ${JSON.stringify(repoRoot)} --json`,
+        };
+    }
+    push("closeout-preview", "completed", "ready", previewStarted);
+    if (!apply) {
+        push("closeout-apply", "skipped", dryRun
+            ? "dry-run: closeout apply skipped"
+            : "pass --apply --owner to apply closeout");
+        const reviewAfter = await deps.review({ featureDir, repoRoot });
+        return {
+            schemaVersion: 1,
+            featureId,
+            mode: dryRun ? "dry-run" : "executed",
+            status: "ready",
+            finalTaskId,
+            steps,
+            verifyFinal,
+            delivery,
+            closeoutPreview,
+            reviewAfter: {
+                status: reviewAfter.status,
+                statusLabel: reviewAfter.statusLabel,
+                nextAction: reviewAfter.nextAction,
+            },
+            blockers: [],
+            nextCommand: `agent-worker feature advance --feature-dir ${JSON.stringify(featureDir)} --repo ${JSON.stringify(repoRoot)} --task-id ${JSON.stringify(finalTaskId)} --apply --owner <owner>`,
+        };
+    }
+    if (!input.owner?.trim()) {
+        push("closeout-apply", "failed", "owner required for --apply");
+        return {
+            schemaVersion: 1,
+            featureId,
+            mode: "executed",
+            status: "failed",
+            finalTaskId,
+            steps,
+            verifyFinal,
+            delivery,
+            closeoutPreview,
+            blockers: ["feature advance --apply requires non-empty --owner"],
+        };
+    }
+    const applyStarted = Date.now();
+    try {
+        const closeoutApply = await deps.applyCloseout({
+            featureDir,
+            repoRoot,
+            owner: input.owner.trim(),
+            ...(input.now ? { now: input.now } : {}),
+        });
+        push("closeout-apply", "completed", closeoutApply.status, applyStarted);
+        const reviewAfter = await deps.review({ featureDir, repoRoot });
+        return {
+            schemaVersion: 1,
+            featureId,
+            mode: "executed",
+            status: "applied",
+            finalTaskId,
+            steps,
+            verifyFinal,
+            delivery,
+            closeoutPreview,
+            closeoutApply,
+            reviewAfter: {
+                status: reviewAfter.status,
+                statusLabel: reviewAfter.statusLabel,
+                nextAction: reviewAfter.nextAction,
+            },
+            blockers: [],
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        push("closeout-apply", "failed", message, applyStarted);
+        return {
+            schemaVersion: 1,
+            featureId,
+            mode: "executed",
+            status: "failed",
+            finalTaskId,
+            steps,
+            verifyFinal,
+            delivery,
+            closeoutPreview,
+            blockers: [message],
+            nextCommand: `agent-worker feature closeout --feature-dir ${JSON.stringify(featureDir)} --repo ${JSON.stringify(repoRoot)} --apply --owner ${JSON.stringify(input.owner)} --json`,
+        };
+    }
+}
+export function resolveFinalVerifyTaskId(model) {
+    const hint = /(final[-_]?(verify|verification))|closeout/i;
+    const byId = model.tasks.find((t) => hint.test(t.taskId));
+    if (byId)
+        return byId.taskId;
+    // Fallback: last Done-or-any task that depends on both test-ish types is not available here;
+    // review model lacks depends_on depth — require explicit task when id heuristic fails.
+    return null;
+}
+export function renderFeatureAdvance(result) {
+    const lines = [
+        `Feature: ${result.featureId}`,
+        `Advance: ${result.status} (${result.mode})`,
+        `Final task: ${result.finalTaskId ?? "none"}`,
+        ...result.steps.map((s) => `${statusMark(s.status)} ${s.id}${s.message ? `: ${s.message}` : ""}`),
+    ];
+    if (result.blockers.length) {
+        lines.push(`Blockers: ${result.blockers.join("; ")}`);
+    }
+    if (result.nextCommand) {
+        lines.push(`Next: ${result.nextCommand}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+function statusMark(status) {
+    switch (status) {
+        case "completed":
+            return "✓";
+        case "failed":
+            return "✗";
+        case "skipped":
+            return "·";
+        default:
+            return "○";
+    }
+}