@tea-agent/loop-agent 0.24.4 → 0.24.5

package/AGENTS.md

@@ -37,7 +37,7 @@
 4. 涉及测试纪律/验证声明/调试时继续读：`docs/governance/harness-methodology-*.md`。
 5. 查看最近提交、相关 plan/progress/report；`git status --short --branch`；跑最小基线验证。
 6. 后端/接口/pytest → `taskKind: "backend-test"`（不是 `--profile`）；知识回写 `knowledge-sync`；图谱开荒 `knowledge-graph-bootstrap`。`--profile` 仅 `auto|minimal|standard|reviewed|supervised`。
-7. 看板/observe → `agent-worker console serve --repo . --port 8790`（`/inspect/` 只读）；`observe serve` 仅为兼容入口。
+7. 看板/observe → `agent-worker console`（默认 repo=当前目录、port=8790；兼容入口 `agent-worker console serve --repo . --port 8790`）（`/inspect/` 只读）；`observe serve` 仅为兼容入口。
 8. 分支合并 → 先读 `docs/operations/branch-merge-guideline.md`。
 
 ## 会话协议

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+## [0.24.5] - 2026-07-28
+
+### 重点更新
+
+- 后端测试 Markdown 模块与 pytest 脚本实现一对一精准映射，提升测试执行的确定性
+- 修复后端测试 HTML 报告中请求参数显示为空的问题，正确展示请求与响应日志
+- 初始化项目支持将「帮我完成/实现/修复」等通用需求表达直接路由进 Agent DAG
+- 新增裸 agent-worker console 入口，简化本地看板启动流程
+
+### 新增
+
+- 初始化后的目标项目支持将「帮我完成/实现/修复/开发」等通用需求表达确定性地路由进 Agent DAG（new-task → dag run-task → dag validate → run-dag），无需追加额外的 cli 关键词
+- 新增裸 agent-worker console 入口，直接启动 Loop Operator Console，repo 默认当前目录、port 默认 8790
+- check-skill-entry.sh 及初始化投影脚本支持解析 YAML 折叠块，对通用需求触发词建立机器门禁以防漂移
+
+### 改进
+
+- 后端测试收敛模块映射，生成与评审 prompt 强制模块文件一对一映射，在映射缺失时支持确定性恢复
+- 后端测试 execute/report 节点文案与 pytest-html 真源对齐，移除残留的 JUnit 表述
+- 后端测试 HTML 报告对齐 R04 模板样式，采用全 inline style 设计（渐变 banner、可折叠用例卡片、状态胶囊及请求/响应分块展示）
+- 本地看板启动更简，端口被占用时不再自动更换，改为明确提示使用 --port 显式指定其它端口
+- 旧项目经 init check-update 与 apply-safe 即可安全补回新的「通用需求实现」路由行，并保留用户自定义前言
+
+### 修复
+
+- 修复后端测试 HTML 报告中请求参数显示为空的问题：渲染器现已兼容 payload= 键或 JSON request_record 格式的请求摘要
+- 修复后端测试报告无法正确获取请求/响应日志的问题：兼容 HTTP_REQUEST 与 HTTP REQUEST 两种日志前缀，并在解析前正确解码 HTML 实体
+- 修复 shell-executor 在 Windows 环境下因反斜杠路径导致 runDir 损坏的问题，确保路径注入稳定
+- 修复前端 lint baseline 在 Windows 下因路径解析逻辑缺陷，拒绝相对路径输出导致评估误报为不可用的问题
+- 修复多个测试固件在 Windows 下因嵌套 Shell 引号剥离导致命令执行输出为空或报错的问题（涉及 composite-shell 与 init-command）
+
 ## [0.24.4] - 2026-07-28
 
 ### 重点更新
@@ -26,6 +57,7 @@
 ### 重点更新
 
 - 发布工作流改为发布已通过完整门禁并经 SHA-256 校验的 npm tarball，避免 `npm publish` 再次触发全量测试、类型检查与构建。
+- 默认 `standard` 实现任务在 React、Next.js 或 Vue 项目中直接选择 `frontend-implementation` DAG，不再依赖需求关键词；明确后端、文档/测试范围或前端否定仍保留对应通用流程。
 
 ## [0.24.2] - 2026-07-28
 

package/README.md

@@ -52,6 +52,8 @@ loop-agent init reconcile --repo-root .
 
 ### 运行第一个任务
 
+初始化后，在已初始化的目标项目中你可以直接对宿主 agent 说「**loop-agent 帮我完成 XXX 需求**」（或「帮我实现 / 帮我修复 / 帮我开发 XXX」「使用 loop-agent 完成 XXX」「按 loop-agent 流程处理 XXX」），初始化写入的 `AGENTS.md` 与 `.agents/skills/loop-agent/` 会把这类通用需求表达确定性地路由进 Agent DAG，**无需**追加额外的 `cli` 关键词。主会话只负责编排与验证，业务实现由受治理 DAG writer 完成。
+
 ```bash
 loop-agent new-task example-task "实现一个有明确验收标准的小功能"
 ```
@@ -90,12 +92,13 @@ loop-agent dag report --run-id <run-id>
 | 入口 | 命令 | 角色 |
 | --- | --- | --- |
 | 受治理 CLI | `loop-agent …` / `agent-worker …` | 权威写入与诊断 |
-| Loop Operator Console | `agent-worker console serve --repo .` | Official 本地控制面（默认 `127.0.0.1:8790`，含 Operate 与 Inspect） |
+| Loop Operator Console | `agent-worker console` | Official 本地控制面（默认 repo=当前目录、`127.0.0.1:8790`，含 Operate 与 Inspect） |
 | Observe | `agent-worker observe serve --repo . --port 8787` | 兼容期独立只读入口；不再作为推荐路径 |
 
 ```bash
 # 终端 A：Console（任务/运行操作面；canonical mutation 只经 sibling loop-agent）
-agent-worker console serve --repo .
+agent-worker console                              # 默认 repo=当前目录、port=8790
+agent-worker console serve --repo .               # 兼容入口，等价于裸入口
 agent-worker console doctor --repo .
 
 ```

package/dist/application/dag/generate-task-dag.js

@@ -239,10 +239,8 @@ export async function generateTaskDagUseCase(input) {
         reasons: ["dag run-task validate did not report governanceProfile"],
     });
     const hasExplicitSpecializedTaskKind = candidateResult.templateSelection.source === "taskKind";
-    const hasSafeAutomaticTaskSourceRoute = candidateResult.templateSelection.source === "task-source" &&
-        profileRouting.selectedByProfile !== "supervised" &&
-        profileRouting.selectedTemplate !== "supervised-implementation";
-    if (hasExplicitSpecializedTaskKind || hasSafeAutomaticTaskSourceRoute) {
+    const hasAutomaticTaskSourceRoute = candidateResult.templateSelection.source === "task-source";
+    if (hasExplicitSpecializedTaskKind || hasAutomaticTaskSourceRoute) {
         profileRouting.selectedTemplate = candidateResult.template;
         profileRouting.source = hasExplicitSpecializedTaskKind
             ? "taskKind"
@@ -256,10 +254,9 @@ export async function generateTaskDagUseCase(input) {
             profileRouting.selectedByProfile = parsed.profile;
         }
     }
-    // Persist only a safe automatic route. Explicit supervised/profile policy
-    // must remain authoritative and must not be weakened by this convenience
-    // marker. Keep taskId stable; frontend-implementation is the taskKind.
-    if (hasSafeAutomaticTaskSourceRoute && candidateResult.template === "frontend-implementation") {
+    // Persist the automatic business workflow route while preserving the
+    // governance profile as a separate routing dimension.
+    if (hasAutomaticTaskSourceRoute && candidateResult.template === "frontend-implementation") {
         const taskConfig = await loadTaskConfig(repoRoot, parsed.taskId);
         if (!taskConfig.taskKind || taskConfig.taskKind === "standard") {
             await writeTaskConfig(repoRoot, parsed.taskId, {

package/dist/commands/init.js

@@ -415,6 +415,18 @@ check_skill "loop-agent" \\
   "references/command-reference.md"
 check_skill "agent-worker" "references/agent-worker-operator.md"
 
+# loop-agent description is a YAML folded block (>-); grep ^description: only
+# captures the indicator line. Validate the general-demand trigger terms
+# against the whole skill file so host auto-discovery phrasing cannot drift.
+loop_agent_skill=".agents/skills/loop-agent/SKILL.md"
+loop_agent_text="$(tr '[:upper:]' '[:lower:]' < "\${loop_agent_skill}")"
+for term in "loop-agent 帮我完成" "帮我实现" "帮我修复" "帮我开发" "agent dag" "new-task" "dag run-task" "dag validate" "run-dag"; do
+  if [[ "\${loop_agent_text}" != *"\${term}"* ]]; then
+    echo "skill entry 检查失败（loop-agent）：description 缺少触发/路由词 \${term}" >&2
+    exit 1
+  fi
+done
+
 description_line="$(grep -E '^description:' .agents/skills/agent-worker/SKILL.md | head -n 1 | tr '[:upper:]' '[:lower:]')"
 for term in "agent-worker" "feature packet" "taskspec" "task pool" "self-host" "candidate" "loop-agent"; do
   if [[ "\${description_line}" != *"\${term}"* ]]; then
@@ -802,6 +814,7 @@ function buildManagedAgentsBlock(input) {
         "| 初始化更新校验 / 检查初始化更新 / loop-agent 初始化更新校验 / loop agent初始化更新校验 | 更新校验 | 只读报告，不写入 |",
         "| 初始化对齐 / 升级后对齐 / reconcile 初始化 / loop-agent 初始化对齐 | 升级对齐 | 自动应用确定性安全动作；活跃 DAG/Worker 或人工决策时零写入 |",
         "| 初始化安全更新 / 应用初始化更新 / loop-agent 初始化安全更新 / loop agent初始化安全更新 | 安全更新 | 先 check-update，再只执行确定性安全动作 |",
+        "| loop-agent 帮我完成 / 帮我实现 / 帮我修复 / 帮我开发 <需求>；使用 loop-agent 完成 <X>；按 loop-agent 流程处理 <X> | 通用需求实现 | 先建任务源与 `task.json.allowedPaths` / `forbiddenPaths`，再 `new-task` → `dag run-task` → `dag validate` → `run-dag`；主会话不得直接修改业务实现 |",
         "",
         "**更新校验（只读）**：只读执行下面命令；**不得自动**执行 `apply-safe` 或模型合并。",
         "",
@@ -861,10 +874,11 @@ function buildManagedAgentsBlock(input) {
         "### 运行看板（只读）",
         "",
         "```bash",
-        "agent-worker console serve --repo . --port 8790",
+        "agent-worker console                       # 默认 repo=当前目录，port=8790",
+        "agent-worker console serve --repo . --port 8790   # 兼容入口，等价于上面裸入口",
         "```",
         "",
-        "浏览器打开 `http://127.0.0.1:8790/`；检视面为 `http://127.0.0.1:8790/inspect/`。默认绑定本机 `127.0.0.1`；不要直接暴露到公开网络。`agent-worker observe serve` 仅为兼容入口。",
+        "浏览器打开 `http://127.0.0.1:8790/`；检视面为 `http://127.0.0.1:8790/inspect/`。默认绑定本机 `127.0.0.1`；不要直接暴露到公开网络。端口被占用时不会自动更换，请用 `--port <port>` 显式指定。`agent-worker observe serve` 仅为兼容入口。",
         "",
         "### DAG 诊断与收口",
         "",
@@ -2049,11 +2063,11 @@ function buildTargetFeatureWorkflow(input) {
         "",
         "## Specialized Task Kinds",
         "",
-        "- standard tasks are classified conservatively by combining the task title, `source/需求.md`, structured `allowedPaths`, strong React/Next/Vue project evidence, and user-visible interaction/state semantics.",
-        "- An implicit frontend demand selects the frontend DAG only when project or frontend-path evidence is paired with product-delivery semantics; framework evidence alone is insufficient. Backend, mixed, negated, documentation/test maintenance, and unknown demands keep the template selected by the normal governance profile.",
+        "- standard tasks first use the structured task type in `source/需求.md`, then combine `allowedPaths` with strong React/Next/Vue project evidence for deterministic routing.",
+        "- A frontend project defaults eligible implementation work to the frontend DAG without requirement keyword matching. Explicit backend, mixed, frontend-negated, and documentation/test-only scopes keep the template selected by the normal governance profile.",
         "- `frontend-mock-assess-pi` reads Mock/API/schema evidence and selects `native|browser-intercept|request-adapter|not-needed|blocked` before frontend planning; its deterministic gate rejects blocked or malformed output, while the existing frontend implementer remains the only writer.",
         "- Mock-backed verification never proves real API integration. When the backend was not exercised, closeout must retain the gap and name `<task-id>-real-api-integration-verify`; that follow-up is explicitly created/run after backend readiness, never automatic.",
-        "- Automatic frontend classification never replaces a supervised template selected by an explicit profile, workflowPolicy, or the supervised quality gate.",
+        "- Automatic frontend classification selects the frontend implementation workflow and persists taskKind; explicit profiles, workflowPolicy, and supervised quality gates record governance strength without switching the business workflow back to a generic DAG.",
         "- A backend implementation does not select the backend test DAG. `backend-test` remains an explicit test-engineering workflow.",
         "- Explicit specialized `taskKind` values remain compatible and take precedence over task-source classification.",
         "",

package/dist/task/task-demand-routing.js

@@ -298,6 +298,11 @@ export function classifyTaskDemand(input) {
             message: "allowedPaths include a backend-specific source path",
         });
     }
+    const allowedPathsOnlyCoverNonProductArtifacts = input.allowedPaths.length > 0 &&
+        input.allowedPaths.every((rawPath) => {
+            const allowedPath = normalizedAllowedPath(rawPath);
+            return matchesAny(allowedPath, NON_PRODUCT_ALLOWED_PATH_PATTERNS);
+        });
     const pathSupportedFrontendDelivery = frontendPath &&
         (titleSignals.pathSupportedFrontendDelivery ||
             requirementSignals.pathSupportedFrontendDelivery ||
@@ -328,20 +333,27 @@ export function classifyTaskDemand(input) {
             message: "task text contains user-visible interaction/state delivery and the project has strong frontend framework evidence",
         });
     }
+    const backendDelivery = titleSignals.backendDelivery || requirementSignals.backendDelivery;
+    const frontendProjectDefaultImplementation = hasStrongFrontendProjectEvidence &&
+        !backendDelivery &&
+        !frontendNegated &&
+        !allowedPathsOnlyCoverNonProductArtifacts;
+    if (frontendProjectDefaultImplementation) {
+        addSignal(signals, {
+            id: "frontend-project-default-implementation",
+            source: "project",
+            message: "frontend project evidence selects the frontend implementation workflow by default",
+        });
+    }
     const frontendDelivery = titleSignals.frontendDelivery ||
         requirementSignals.frontendDelivery ||
         pathSupportedFrontendDelivery ||
-        projectSupportedFrontendDelivery;
-    const allowedPathsOnlyCoverNonProductArtifacts = input.allowedPaths.length > 0 &&
-        input.allowedPaths.every((rawPath) => {
-            const allowedPath = normalizedAllowedPath(rawPath);
-            return matchesAny(allowedPath, NON_PRODUCT_ALLOWED_PATH_PATTERNS);
-        });
+        projectSupportedFrontendDelivery ||
+        frontendProjectDefaultImplementation;
     if (allowedPathsOnlyCoverNonProductArtifacts && frontendDelivery) {
         blockers.push("non-product-allowed-paths");
     }
     const eligibleFrontendDelivery = frontendDelivery && !allowedPathsOnlyCoverNonProductArtifacts;
-    const backendDelivery = titleSignals.backendDelivery || requirementSignals.backendDelivery;
     const taskTypeConflict = (hasFrontendTaskType && (backendDelivery || frontendNegated)) ||
         (hasBackendTaskType && eligibleFrontendDelivery);
     if (taskTypeConflict)
@@ -402,13 +414,6 @@ export function resolveTaskDagTemplateSelection(input) {
             reasons: [],
         };
     }
-    if (requestedTemplate !== "standard-dag") {
-        return {
-            template: requestedTemplate,
-            source: "requested-template",
-            reasons: [],
-        };
-    }
     const classification = classifyTaskDemand(input);
     if (classification.kind === "frontend") {
         const frontendSignals = classification.signals
@@ -423,6 +428,14 @@ export function resolveTaskDagTemplateSelection(input) {
             classification,
         };
     }
+    if (requestedTemplate !== "standard-dag") {
+        return {
+            template: requestedTemplate,
+            source: "requested-template",
+            reasons: [],
+            classification,
+        };
+    }
     return {
         template: requestedTemplate,
         source: "requested-template",

package/dist/worker/cli.js

@@ -41,7 +41,8 @@ export function buildAgentWorkerProgram() {
         .description("Local product-line worker utilities for TaskSpec validation")
         .version(readPackageVersion(path.dirname(path.dirname(path.dirname(fileURLToPath(import.meta.url))))) ?? "0.0.0", "-V, --version", "display version")
         .showHelpAfterError()
-        .showSuggestionAfterError();
+        .showSuggestionAfterError()
+        .enablePositionalOptions();
     const task = program.command("task").description("TaskSpec utilities");
     const batch = program
         .command("batch")
@@ -593,18 +594,17 @@ export function buildAgentWorkerProgram() {
         process.stdout.write(`${JSON.stringify(snapshot)}\n`);
     });
     consoleCmd
-        .command("serve")
-        .requiredOption("--repo <repo-root>", "Target repo root")
+        .description("Loop Operator Console (local); bare `agent-worker console` starts it directly (repo defaults to current working directory, port defaults to 8790)")
+        .enablePositionalOptions()
+        .passThroughOptions()
+        .option("--repo <repo-root>", "Target repo root (default: current working directory)", process.cwd())
         .option("--port <port>", "HTTP port", "8790")
         .option("--host <host>", "Bind host (default 127.0.0.1; use 0.0.0.0 for LAN, no network auth)", "127.0.0.1")
         .option("--debug", "Log request source/method/path/status to stderr")
         .option("--app-data <path>", "Override Console application-data root (Draft/Operation/confirmation)")
-        .description("Start Loop Operator Console HTTP server (Operate + Inspect; static SPA + Operator API)")
         .action(async (options) => {
-        const { createConsoleServer } = await import("./console/server.js");
-        const repoRoot = path.resolve(options.repo);
-        const server = await createConsoleServer({
-            repoRoot,
+        await runConsoleServe({
+            repoRoot: path.resolve(options.repo),
             host: options.host,
             port: Number.parseInt(options.port, 10),
             debug: options.debug === true,
@@ -612,13 +612,25 @@ export function buildAgentWorkerProgram() {
                 ? path.resolve(options.appData)
                 : undefined,
         });
-        process.stdout.write(`${server.url}\n`);
-        await new Promise((resolve) => {
-            const shutdown = () => resolve();
-            process.once("SIGINT", shutdown);
-            process.once("SIGTERM", shutdown);
+    });
+    consoleCmd
+        .command("serve")
+        .option("--repo <repo-root>", "Target repo root (default: current working directory)", process.cwd())
+        .option("--port <port>", "HTTP port", "8790")
+        .option("--host <host>", "Bind host (default 127.0.0.1; use 0.0.0.0 for LAN, no network auth)", "127.0.0.1")
+        .option("--debug", "Log request source/method/path/status to stderr")
+        .option("--app-data <path>", "Override Console application-data root (Draft/Operation/confirmation)")
+        .description("Start Loop Operator Console HTTP server (compat entry; equivalent to bare `agent-worker console`)")
+        .action(async (options) => {
+        await runConsoleServe({
+            repoRoot: path.resolve(options.repo),
+            host: options.host,
+            port: Number.parseInt(options.port, 10),
+            debug: options.debug === true,
+            appDataRoot: options.appData
+                ? path.resolve(options.appData)
+                : undefined,
         });
-        await server.close();
     });
     consoleCmd
         .command("doctor")
@@ -693,6 +705,39 @@ export async function main(argv = process.argv) {
 async function readTaskYaml(taskSpecPath) {
     return YAML.parse(await readFile(taskSpecPath, "utf-8"));
 }
+/** Shared console serve entry used by both bare `console` and `console serve`. */
+async function runConsoleServe(options) {
+    const { createConsoleServer } = await import("./console/server.js");
+    try {
+        const server = await createConsoleServer({
+            repoRoot: options.repoRoot,
+            host: options.host,
+            port: options.port,
+            debug: options.debug === true,
+            appDataRoot: options.appDataRoot,
+        });
+        process.stdout.write(`${server.url}\n`);
+        await new Promise((resolve) => {
+            const shutdown = () => resolve();
+            process.once("SIGINT", shutdown);
+            process.once("SIGTERM", shutdown);
+        });
+        await server.close();
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        const code = error?.code;
+        const isPortInUse = code === "EADDRINUSE" ||
+            /listen EADDRINUSE/i.test(detail) ||
+            /address already in use/i.test(detail);
+        if (isPortInUse) {
+            process.stderr.write(`端口 ${options.port} 已被占用，请使用 --port <port> 指定其它端口后重试。\n`);
+            process.exit(1);
+        }
+        process.stderr.write(`${detail}\n`);
+        process.exit(1);
+    }
+}
 function handlePoolRecoveryCliError(error) {
     const detail = error instanceof Error ? error.message : String(error);
     process.stderr.write(`${detail}\n`);

package/dist/workflows/dag/backend-test-markdown-workflow.js

@@ -413,6 +413,18 @@ export async function validateBackendMarkdownCases(input) {
             if (!hasAssertableExpectedResult(expected)) {
                 findings.push(`${testCase.id} has no structured expected result`);
             }
+            const expectedScript = expectedBackendTestPytestScriptForMarkdownModule(relativeFile);
+            const mappedScripts = extractMappedPytestScripts(testCase.body);
+            if (mappedScripts.length === 0) {
+                findings.push(`${testCase.id} has no mapped pytest script in Automation Notes/自动化映射 (expected ${expectedScript} from module ${path.basename(relativeFile)})`);
+            }
+            else {
+                for (const script of mappedScripts) {
+                    if (script !== expectedScript) {
+                        findings.push(`${testCase.id} automation mapping ${script} must equal module one-to-one path ${expectedScript} (from ${path.basename(relativeFile)})`);
+                    }
+                }
+            }
         }
     }
     const missing = input.requiredRequirementIds.filter((id) => !coveredAc.has(id));
@@ -454,6 +466,27 @@ export async function validateBackendMarkdownCases(input) {
 function collectMarkdownCaseIds(markdown) {
     return splitCases(markdown).map((testCase) => testCase.id);
 }
+/**
+ * Derive the stable module stem used for Markdown ↔ pytest one-to-one mapping.
+ * `testcase/md/<module>.md` → stem → `testcase/test_<stem>.py`.
+ * Example: `BE-HEALTH.md` / `be-health.md` / `order-api.md` → `be_health` / `order_api`.
+ */
+export function normalizeBackendTestModuleStem(moduleFileName) {
+    const base = path.basename(moduleFileName).replace(/\.md$/i, "");
+    const stem = base
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_")
+        .replace(/^_+|_+$/g, "")
+        .replace(/_+/g, "_");
+    if (!stem) {
+        throw new Error(`cannot derive backend-test module stem from: ${moduleFileName}`);
+    }
+    return stem;
+}
+/** Expected pytest script path for a Markdown module file (basename or relative path). */
+export function expectedBackendTestPytestScriptForMarkdownModule(moduleFileName) {
+    return `testcase/test_${normalizeBackendTestModuleStem(moduleFileName)}.py`;
+}
 function extractMappedPytestScripts(testCaseBody) {
     const automation = sectionBody(testCaseBody, CASE_SECTION_ALIASES.automationNotes);
     if (!automation.trim())
@@ -462,6 +495,15 @@ function extractMappedPytestScripts(testCaseBody) {
         .map((match) => match[1].replaceAll("\\", "/"))
         .filter((value) => !value.includes("..")));
 }
+function isSafeBackendPytestScript(script, workspaceRoot) {
+    const absolute = path.resolve(workspaceRoot, script);
+    const relative = path.relative(workspaceRoot, absolute).replaceAll(path.sep, "/");
+    return (!relative.startsWith("..") &&
+        !path.isAbsolute(relative) &&
+        script.startsWith("testcase/") &&
+        !script.includes("..") &&
+        /^test_.*\.py$/i.test(path.basename(script)));
+}
 function testFunctionRegion(input) {
     const functionLineStart = input.source.lastIndexOf("\n", input.functionIndex - 1) + 1;
     const functionLine = input.source.slice(functionLineStart, input.functionHeaderEnd);
@@ -610,26 +652,50 @@ export async function collectBackendTestMappedPytestScripts(workspaceRoot) {
     for (const file of files) {
         if (path.basename(file).toLowerCase() === "readme.md")
             continue;
+        const relativeFile = path.relative(workspaceRoot, file).replaceAll(path.sep, "/");
+        const expectedScript = expectedBackendTestPytestScriptForMarkdownModule(relativeFile);
         const markdown = await readFile(file, "utf8");
+        const mappedFromModule = new Set();
         for (const testCase of splitCases(markdown)) {
-            for (const script of extractMappedPytestScripts(testCase.body))
+            for (const script of extractMappedPytestScripts(testCase.body)) {
+                mappedFromModule.add(script);
+            }
+        }
+        // Prefer explicit mappings, but recover to the deterministic module stem path
+        // when the model wrote the correct one-to-one file while Markdown still names
+        // a drifted script (common: health.md maps test_health.py but writer emitted
+        // test_be_health.py for BE-HEALTH.md, or the reverse).
+        if (mappedFromModule.size === 0) {
+            if (await exists(path.resolve(workspaceRoot, expectedScript))) {
+                scripts.add(expectedScript);
+            }
+            continue;
+        }
+        for (const script of mappedFromModule) {
+            if (!isSafeBackendPytestScript(script, workspaceRoot)) {
+                throw new Error(`unsafe mapped pytest script: ${script}`);
+            }
+            if (await exists(path.resolve(workspaceRoot, script))) {
                 scripts.add(script);
+                continue;
+            }
+            if (isSafeBackendPytestScript(expectedScript, workspaceRoot) &&
+                (await exists(path.resolve(workspaceRoot, expectedScript)))) {
+                scripts.add(expectedScript);
+                continue;
+            }
+            throw new Error(`mapped pytest script is missing: ${script} (module one-to-one path ${expectedScript} also missing)`);
         }
     }
     if (scripts.size === 0) {
         throw new Error("no pytest scripts are mapped by final Markdown cases");
     }
     const safeScripts = [];
-    for (const script of unique(scripts)) {
-        const absolute = path.resolve(workspaceRoot, script);
-        const relative = path.relative(workspaceRoot, absolute);
-        if (relative.startsWith("..") ||
-            path.isAbsolute(relative) ||
-            !script.startsWith("testcase/") ||
-            !/^test_.*\.py$/i.test(path.basename(script))) {
+    for (const script of unique([...scripts]).sort()) {
+        if (!isSafeBackendPytestScript(script, workspaceRoot)) {
             throw new Error(`unsafe mapped pytest script: ${script}`);
         }
-        if (!(await exists(absolute))) {
+        if (!(await exists(path.resolve(workspaceRoot, script)))) {
             throw new Error(`mapped pytest script is missing: ${script}`);
         }
         safeScripts.push(script);

package/dist/workflows/dag/init-hybrid.js

@@ -3302,8 +3302,9 @@ async function buildBackendTestHybridDag(sources) {
             "Write human-readable content in Simplified Chinese by default. Keep English only for machine-readable IDs and technical literals such as Case/AC/REQ/BR IDs, HTTP methods, paths, field names, enum values, commands, filenames, code symbols and exact source citations.",
             "Create testcase/md/README.md as the concise entry page: test objective, target/environment, isolation/cleanup, module summary and a linked case index table with Case ID, Chinese case name, scenario type, endpoint and expected status/result. Avoid repeating every case body in README.",
             "Write each module as readable case cards. Every case starts with `## BE-<MODULE>-<NNN>｜<中文用例名称>`. The only sections required by the deterministic validator are `### 前置条件`, `### 操作步骤`, and `### 预期结果` (legacy English aliases remain accepted). Add `测试目的`, `验收标准`, `需求依据`, `测试数据`, and `自动化映射` when useful for human readability; every automatable case should explicitly name its target pytest script under `自动化映射` so traceability can scan only that script.",
+            "Name each module file with a stable lowercase business stem such as `testcase/md/health.md` or `testcase/md/resource_notes.md`. Do not use Case-ID-like module filenames such as `BE-HEALTH.md` or `BE-NOTES.md`. For every automatable case, `自动化映射` must name exactly `testcase/test_<module>.py`, where <module> is that Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `testcase/md/health.md` → `testcase/test_health.py`; `testcase/md/resource_notes.md` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.",
             "Place steps and their expected results in a compact readable table when that improves clarity; otherwise keep numbered executable steps and numbered/bulleted independently assertable results. Every result must name the observable HTTP status, response field/value, state transition or membership condition, never vague wording such as ‘符合预期’.",
-            "In `自动化映射`, record the planned script path and pytest function name when known. Put implementation-only restrictions in a concise `<details>` block rather than dominating the main case flow. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.",
+            "In `自动化映射`, record the planned script path and pytest function name when known, and keep the script path identical to the module one-to-one path above. Put implementation-only restrictions in a concise `<details>` block rather than dominating the main case flow. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.",
             intake.boundedSourceContext, "## Authoritative reference index", JSON.stringify(intake.referenceIndex, null, 2),
             "For each index entry, use `readPath` for Pi read-tool calls and copy `path` exactly into Markdown Source References. Bound files under .harness/tasks/<taskId>/source/** are read-only inputs: reading them is allowed even though writing .harness/** is forbidden. Never resolve `path` relative to the repository root, search for substitutes, or fall back to docs/** when a bound read fails.",
             "Read only precise indexed references needed for AC/API/field/rule evidence; references remain authoritative over derived text.",
@@ -3316,8 +3317,8 @@ async function buildBackendTestHybridDag(sources) {
         outputContract: "Review source fidelity and directly revise only testcase/md/**; return concise Markdown, never JSON.",
         subtask_prompt: [
             "Independently review generated Markdown cases against the task requirements and environment evidence. Treat the files as human-facing test documentation: require clear preconditions, executable steps and assertable expected results; improve names, purpose, metadata and automation mapping where useful while preserving exact machine IDs and technical literals.",
-            "Check AC completeness/meaning, endpoint, fields/shape, status/error codes, rules, states, documented boundaries/auth, positive/negative coverage, executable steps and assertable results. Reject avoidable English prose, duplicated bilingual wording, repeated boilerplate, oversized unstructured sections, vague results such as ‘符合预期’, and missing script/function mapping where it can be derived.",
-            "Correct testcase/md/** directly: add documented omissions, remove unsupported cases, fix mappings/expectations, merge duplicates, improve navigation/tables/Chinese wording, or record gaps in Chinese. Keep Case IDs, AC/REQ/BR IDs, HTTP methods, paths, fields, enum values, filenames, code symbols and source citations exact. The validator accepts Chinese and legacy English section aliases; retain or converge to the Chinese human-readable headings without losing structure.",
+            "Check AC completeness/meaning, endpoint, fields/shape, status/error codes, rules, states, documented boundaries/auth, positive/negative coverage, executable steps and assertable results. Reject avoidable English prose, duplicated bilingual wording, repeated boilerplate, oversized unstructured sections, vague results such as ‘符合预期’, Case-ID-like module filenames (for example `BE-HEALTH.md`), and missing or drifted script/function mapping where it can be derived.",
+            "Correct testcase/md/** directly: add documented omissions, remove unsupported cases, rename module files to stable lowercase stems when needed, fix automation mappings so each case points at `testcase/test_<module>.py` derived from that module filename, merge duplicates, improve navigation/tables/Chinese wording, or record gaps in Chinese. Keep Case IDs, AC/REQ/BR IDs, HTTP methods, paths, fields, enum values, filenames, code symbols and source citations exact. The validator accepts Chinese and legacy English section aliases; retain or converge to the Chinese human-readable headings without losing structure.",
             "Read only precise referenced source paths plus requirement sections needed for uncovered ACs. Do not scan the repository, modify source/**, generate pytest, execute tests, or emit JSON.",
             intake.boundedSourceContext, "## Authoritative reference index", JSON.stringify(intake.referenceIndex, null, 2),
             "For each index entry, use `readPath` for Pi read-tool calls and keep `path` as the exact Markdown Source References citation. Bound files under .harness/tasks/<taskId>/source/** are read-only inputs: reading them is allowed even though writing .harness/** is forbidden. Never resolve `path` relative to the repository root, search for substitutes, or fall back to docs/** when a bound read fails.",
@@ -3333,7 +3334,7 @@ async function buildBackendTestHybridDag(sources) {
         subtask_prompt: [
             "Convert testcase/md/** to pytest using upstream environment and advisory validation evidence plus only bounded pytest config/conftest. A FAIL advisory report does not authorize inventing missing behavior; use the final Markdown facts that are present.",
             "Ensure every final Markdown Case ID appears in at least one real pytest test function or pytest test class method region, preferably as `test_BE_<MODULE>_<NNN>_<description>` and in that function/method docstring. Module-level functions and class-based pytest methods are both supported. Multiple test functions may cover one Case ID; assertions come only from 预期结果/Expected Results and setup comes only from 前置条件 plus any optional 测试数据/自动化映射 or their legacy English aliases.",
-            "Name each generated pytest file so it corresponds one-to-one with its source Markdown module file: for each `testcase/md/<module>.md` (excluding README.md), emit exactly one `testcase/test_<module>.py`. The <module> stem is the Markdown filename without the `.md` extension, lowercased and with non-alphanumeric characters replaced by underscores. For example, `testcase/md/resource_notes.md` maps to `testcase/test_resource_notes.py`, and `testcase/md/order-api.md` maps to `testcase/test_order_api.py`. Never merge multiple Markdown modules into one pytest file, never split one module across several files, and never invent pytest filenames unrelated to the Markdown modules.",
+            "Name each generated pytest file so it corresponds one-to-one with its source Markdown module file: for each `testcase/md/<module>.md` (excluding README.md), emit exactly one `testcase/test_<module>.py`. The <module> stem is the Markdown filename without the `.md` extension, lowercased and with non-alphanumeric characters replaced by underscores. For example, `testcase/md/resource_notes.md` maps to `testcase/test_resource_notes.py`, `testcase/md/health.md` maps to `testcase/test_health.py`, `testcase/md/BE-HEALTH.md` maps to `testcase/test_be_health.py`, and `testcase/md/order-api.md` maps to `testcase/test_order_api.py`. If Markdown automation mapping names a different path than this module stem path, still write the module stem path and do not invent prefixes such as `test_be_*` unless the module filename itself normalizes to that stem. Never merge multiple Markdown modules into one pytest file, never split one module across several files, and never invent pytest filenames unrelated to the Markdown modules.",
             "Generate a reusable HTTP logging helper (or equivalent client wrapper) and call it for every interface request. The request log must include method, URL/path, and request parameters (query plus JSON/body/payload summary). The response log must include status code and response result (JSON/text/body summary), and both records must be visible in pytest stdout/stderr without changing assertions.",
             "Compare timestamps and other semantically equivalent protocol values by parsed meaning, not byte-for-byte serialization. In particular, normalize valid ISO-8601 instants before equality/order assertions so differences such as omitted trailing fractional seconds do not create TestBug failures; preserve exact-string assertions only when the Markdown explicitly requires representation equality.",
             "Before logging, recursively redact sensitive keys and header values including authorization, proxy-authorization, cookie, set-cookie, token, password, secret, api key and credentials. Never print full Authorization/Cookie values. Apply bounded truncation to serialized request and response bodies (with an explicit truncation marker) so large payloads cannot flood pytest or report artifacts.",
@@ -3345,7 +3346,7 @@ async function buildBackendTestHybridDag(sources) {
         'mkdir -p "${HARNESS_DAG_RUN_DIR}/reports"',
         'echo "pytest targets are resolved at runtime from final Markdown 自动化映射"',
     ].join("; ");
-    const execute = shellNode("execute-backend-pytest-and-html-report-shell", [traceability.id], "markdown-execute-html", "Resolve the final Markdown Automation Notes/自动化映射 to a unique, safe set of testcase/**/test_*.py targets and execute only those scripts exactly once. Validate JUnit, then render the primary self-contained Chinese HTML report from the same JUnit plus final Markdown case metadata without rerun. Keep 测试结论, quality status, failure overview, and a polished per-case result card with concise scenario, automation test name, result, duration, and redacted bounded HTTP request parameters/response results for both passed and failed cases. Do not render a technical/execution evidence section in HTML; retain auditable paths and hashes in facts.", "One scoped pytest execution over Markdown-mapped scripts producing valid JUnit with per-case captured output, self-contained reports/backend-test.html and reports/backend-test.md, plus internal reports/backend-test-facts.md evidence; exit 0/1 with valid evidence continues.", [pytestCommand], 300000);
+    const execute = shellNode("execute-backend-pytest-and-html-report-shell", [traceability.id], "markdown-execute-html", "Resolve the final Markdown Automation Notes/自动化映射 to a unique, safe set of testcase/**/test_*.py targets and execute only those scripts exactly once. Prefer the deterministic module one-to-one path when a mapped script is missing but the module stem file exists. Generate a native pytest-html self-contained report, then render the primary self-contained Chinese HTML report from the same pytest-html plus final Markdown case metadata without rerun. Keep 测试结论, quality status, failure overview, and a polished per-case result card with concise scenario, automation test name, result, duration, and redacted bounded HTTP request parameters/response results for both passed and failed cases. Do not render a technical/execution evidence section in HTML; retain auditable paths and hashes in facts.", "One scoped pytest execution over Markdown-mapped scripts producing a valid pytest-html report with per-case captured output, self-contained reports/backend-test.html and reports/backend-test.md, plus internal reports/backend-test-facts.md evidence; exit 0/1 with valid evidence continues.", [pytestCommand], 300000);
     if (execute.shell) {
         execute.shell.envAllowlist = collectBackendTestShellEnvAllowlist(sources);
     }
@@ -3358,11 +3359,11 @@ async function buildBackendTestHybridDag(sources) {
         forbiddenPaths: forbidden,
         outputContract: canWriteReport ? "Final Markdown report and L-5 conclusion under docs/test-reports/**; no JSON." : "Final Markdown report and L-5 conclusion in assistant output; no JSON or writes.",
         subtask_prompt: [
-            "Generate the final Markdown report from upstream facts and run-owned environment, advisory case-validation, advisory traceability, JUnit and HTML evidence. Do not emit JSON.",
+            "Generate the final Markdown report from upstream facts and run-owned environment, advisory case-validation, advisory traceability, pytest-html and HTML evidence. Do not emit JSON.",
             "Use this exact human-facing section order: 测试结论 → 执行概览 → 质量校验 → 失败分析 → 风险与建议 → 证据与 L-5. Put the decision and key numbers first, use compact tables/bullets, and keep headings concise. Do not paste entire upstream reports, duplicate per-case tables already present in facts, or repeat the same evidence in multiple sections; link to paths/hashes and quote only the findings needed for the conclusion.",
             "Always state the exact PASS/FAIL status and findings from nodes 4 and 6. Their FAIL status does not block pytest, but it must remain visible as a quality/traceability risk and must never be rewritten as PASS.",
             "Include environment, case quality/review, automation mapping, exact pytest facts, failure classification/analysis, risks, regression recommendations, evidence paths/hashes, coverage availability, and L-5 READY/NOT READY.",
-            "Never override Shell/JUnit facts. L-5 requires pass=100%, AC=100%, automation>=90%, line>=80%, branch>=70%, skipped=0 and no blocking Critical risk.",
+            "Never override Shell/pytest-html facts. L-5 requires pass=100%, AC=100%, automation>=90%, line>=80%, branch>=70%, skipped=0 and no blocking Critical risk.",
             canWriteReport ? "Write only under docs/test-reports/**." : "Keep the full report in assistant output.",
         ].join("\n\n"),
     };
@@ -3376,7 +3377,7 @@ async function buildBackendTestHybridDag(sources) {
             ...taskConfig.hardConstraints, ...STANDARD_GLOBAL_CONSTRAINTS,
             "backend-test-dag uses exactly 8 real top-level tasks and executes pytest exactly once over only the safe scripts explicitly mapped by final Markdown cases.",
             "Model nodes produce Markdown and pytest assets, never backend-test business JSON envelopes.",
-            "Environment, advisory Markdown validation, advisory traceability, JUnit, HTML and execution facts are deterministic evidence. Nodes 4 and 6 record findings without blocking nodes 5, 7 or 8.",
+            "Environment, advisory Markdown validation, advisory traceability, pytest-html, HTML and execution facts are deterministic evidence. Nodes 4 and 6 record findings without blocking nodes 5, 7 or 8.",
             "Only Markdown case generation/review may read source facts; pytest generation must not read source/**.",
             "Functional case IDs use BE-<MODULE>-<NNN>; production code/config, skip/xfail, repair and rerun are forbidden.",
         ],

package/docs/templates/backend-test-dag.generate-pytest.prompt.md

@@ -22,11 +22,12 @@ class TestOrderApi:
 - 断言只来自 `### 预期结果` / `### Expected Results`；setup 只来自必选 `### 前置条件`，以及存在时的 `### 测试数据`、`### 自动化映射` 或对应历史英文分节。
 - 每条可自动化 Case 应在 `自动化映射` / `Automation Notes` 明确写出目标 pytest 脚本；第 6 节点只扫描这些脚本，不递归扫描无关历史 `test_*.py`。
 - 每次接口请求必须通过统一日志 helper 或等价 client wrapper 打印请求与响应诊断信息：请求日志至少包含 HTTP method、URL/path、query 与 JSON/body/payload 参数摘要；响应日志至少包含 status code 与 JSON/text/body 结果摘要。日志必须能出现在 pytest stdout/stderr，不能改变断言或把失败伪装成通过。
-- 日志输出前必须递归脱敏 `authorization`、`proxy-authorization`、`cookie`、`set-cookie`、`token`、`password`、`secret`、`api key`、`credential` 等 key/header；禁止打印完整 Authorization/Cookie。序列化后的 request/response body 必须有明确长度上限和截断标识，避免大对象淹没 pytest/JUnit/报告证据。
+- 日志输出前必须递归脱敏 `authorization`、`proxy-authorization`、`cookie`、`set-cookie`、`token`、`password`、`secret`、`api key`、`credential` 等 key/header；禁止打印完整 Authorization/Cookie。序列化后的 request/response body 必须有明确长度上限和截断标识，避免大对象淹没 pytest/pytest-html/报告证据。
 - 禁止 `skip` / `xfail`、吞断言、宽异常静默通过、mock 替代真实目标、删除用例或弱化断言。
 - best-effort 清理只能捕获所选 HTTP client 实际抛出的窄 transport exception，例如 `requests.RequestException` 或 `urllib.error.URLError`；禁止 `except:`、`except Exception`、`except BaseException` 后 `pass`。
 - 同一 Case ID 可以由多个 pytest 函数覆盖；额外映射会进入 traceability 报告，但不能伪造未在 Markdown 中定义的业务场景。
-- 测试失败必须诚实保留，后续节点只执行一次 pytest，并从同一 JUnit 生成 HTML/facts。
+- 生成 pytest 文件名必须与 Markdown 模块一一对应：`testcase/md/<module>.md` → `testcase/test_<module>.py`（`<module>` 为文件名去 `.md` 后小写、非字母数字转 `_`）。即使 Markdown `自动化映射` 写了别的路径，也必须写模块 stem 路径，不得额外发明 `test_be_*` 前缀。
+- 测试失败必须诚实保留，后续节点只执行一次 pytest，并从同一 pytest-html 报告生成 HTML/facts。
 
 ## 推荐输出
 

package/docs/templates/backend-test-dag.json

@@ -30,7 +30,7 @@
     "Replace REPLACE/WITH/NARROW/IMPLEMENT/PATHS/** with concrete paths before executing the implementation writer",
     "backend-test-dag uses exactly 8 real top-level tasks and executes pytest exactly once over only the safe scripts explicitly mapped by final Markdown cases.",
     "Model nodes produce Markdown and pytest assets, never backend-test business JSON envelopes.",
-    "Environment, advisory Markdown validation, advisory traceability, JUnit, HTML and execution facts are deterministic evidence. Nodes 4 and 6 record findings without blocking nodes 5, 7 or 8.",
+    "Environment, advisory Markdown validation, advisory traceability, pytest-html, HTML and execution facts are deterministic evidence. Nodes 4 and 6 record findings without blocking nodes 5, 7 or 8.",
     "Only Markdown case generation/review may read source facts; pytest generation must not read source/**.",
     "Functional case IDs use BE-<MODULE>-<NNN>; production code/config, skip/xfail, repair and rerun are forbidden."
   ],
@@ -125,7 +125,7 @@
         "artifacts/**"
       ],
       "outputContract": "Write a Chinese, human-readable testcase/md/README.md plus module Markdown case cards using BE-<MODULE>-<NNN>; keep machine IDs/literals exact and do not execute pytest or modify production code/config.",
-      "subtask_prompt": "Read the upstream environment report. Generate a Markdown-first backend test strategy and cases under testcase/md/**.\n\nWrite human-readable content in Simplified Chinese by default. Keep English only for machine-readable IDs and technical literals such as Case/AC/REQ/BR IDs, HTTP methods, paths, field names, enum values, commands, filenames, code symbols and exact source citations.\n\nCreate testcase/md/README.md as the concise entry page: test objective, target/environment, isolation/cleanup, module summary and a linked case index table with Case ID, Chinese case name, scenario type, endpoint and expected status/result. Avoid repeating every case body in README.\n\nWrite each module as readable case cards. Every case starts with `## BE-<MODULE>-<NNN>｜<中文用例名称>`. The only sections required by the deterministic validator are `### 前置条件`, `### 操作步骤`, and `### 预期结果` (legacy English aliases remain accepted). Add `测试目的`, `验收标准`, `需求依据`, `测试数据`, and `自动化映射` when useful for human readability; every automatable case should explicitly name its target pytest script under `自动化映射` so traceability can scan only that script.\n\nPlace steps and their expected results in a compact readable table when that improves clarity; otherwise keep numbered executable steps and numbered/bulleted independently assertable results. Every result must name the observable HTTP status, response field/value, state transition or membership condition, never vague wording such as ‘符合预期’.\n\nIn `自动化映射`, record the planned script path and pytest function name when known. Put implementation-only restrictions in a concise `<details>` block rather than dominating the main case flow. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.\n\n## Derived task contract: 需求.md\n\n# Backend test\n- AC-001 proof\n\n## Authoritative reference index\n\n[]\n\nFor each index entry, use `readPath` for Pi read-tool calls and copy `path` exactly into Markdown Source References. Bound files under .harness/tasks/<taskId>/source/** are read-only inputs: reading them is allowed even though writing .harness/** is forbidden. Never resolve `path` relative to the repository root, search for substitutes, or fall back to docs/** when a bound read fails.\n\nRead only precise indexed references needed for AC/API/field/rule evidence; references remain authoritative over derived text."
+      "subtask_prompt": "Read the upstream environment report. Generate a Markdown-first backend test strategy and cases under testcase/md/**.\n\nWrite human-readable content in Simplified Chinese by default. Keep English only for machine-readable IDs and technical literals such as Case/AC/REQ/BR IDs, HTTP methods, paths, field names, enum values, commands, filenames, code symbols and exact source citations.\n\nCreate testcase/md/README.md as the concise entry page: test objective, target/environment, isolation/cleanup, module summary and a linked case index table with Case ID, Chinese case name, scenario type, endpoint and expected status/result. Avoid repeating every case body in README.\n\nWrite each module as readable case cards. Every case starts with `## BE-<MODULE>-<NNN>｜<中文用例名称>`. The only sections required by the deterministic validator are `### 前置条件`, `### 操作步骤`, and `### 预期结果` (legacy English aliases remain accepted). Add `测试目的`, `验收标准`, `需求依据`, `测试数据`, and `自动化映射` when useful for human readability; every automatable case should explicitly name its target pytest script under `自动化映射` so traceability can scan only that script.\n\nName each module file with a stable lowercase business stem such as `testcase/md/health.md` or `testcase/md/resource_notes.md`. Do not use Case-ID-like module filenames such as `BE-HEALTH.md` or `BE-NOTES.md`. For every automatable case, `自动化映射` must name exactly `testcase/test_<module>.py`, where <module> is that Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `testcase/md/health.md` → `testcase/test_health.py`; `testcase/md/resource_notes.md` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.\n\nPlace steps and their expected results in a compact readable table when that improves clarity; otherwise keep numbered executable steps and numbered/bulleted independently assertable results. Every result must name the observable HTTP status, response field/value, state transition or membership condition, never vague wording such as ‘符合预期’.\n\nIn `自动化映射`, record the planned script path and pytest function name when known, and keep the script path identical to the module one-to-one path above. Put implementation-only restrictions in a concise `<details>` block rather than dominating the main case flow. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.\n\n## Derived task contract: 需求.md\n\n# Backend test\n- AC-001 proof\n\n## Authoritative reference index\n\n[]\n\nFor each index entry, use `readPath` for Pi read-tool calls and copy `path` exactly into Markdown Source References. Bound files under .harness/tasks/<taskId>/source/** are read-only inputs: reading them is allowed even though writing .harness/** is forbidden. Never resolve `path` relative to the repository root, search for substitutes, or fall back to docs/** when a bound read fails.\n\nRead only precise indexed references needed for AC/API/field/rule evidence; references remain authoritative over derived text."
     },
     {
       "id": "review-and-revise-backend-md-cases-pi",
@@ -149,7 +149,7 @@
         "artifacts/**"
       ],
       "outputContract": "Review source fidelity and directly revise only testcase/md/**; return concise Markdown, never JSON.",
-      "subtask_prompt": "Independently review generated Markdown cases against the task requirements and environment evidence. Treat the files as human-facing test documentation: require clear preconditions, executable steps and assertable expected results; improve names, purpose, metadata and automation mapping where useful while preserving exact machine IDs and technical literals.\n\nCheck AC completeness/meaning, endpoint, fields/shape, status/error codes, rules, states, documented boundaries/auth, positive/negative coverage, executable steps and assertable results. Reject avoidable English prose, duplicated bilingual wording, repeated boilerplate, oversized unstructured sections, vague results such as ‘符合预期’, and missing script/function mapping where it can be derived.\n\nCorrect testcase/md/** directly: add documented omissions, remove unsupported cases, fix mappings/expectations, merge duplicates, improve navigation/tables/Chinese wording, or record gaps in Chinese. Keep Case IDs, AC/REQ/BR IDs, HTTP methods, paths, fields, enum values, filenames, code symbols and source citations exact. The validator accepts Chinese and legacy English section aliases; retain or converge to the Chinese human-readable headings without losing structure.\n\nRead only precise referenced source paths plus requirement sections needed for uncovered ACs. Do not scan the repository, modify source/**, generate pytest, execute tests, or emit JSON.\n\n## Derived task contract: 需求.md\n\n# Backend test\n- AC-001 proof\n\n## Authoritative reference index\n\n[]\n\nFor each index entry, use `readPath` for Pi read-tool calls and keep `path` as the exact Markdown Source References citation. Bound files under .harness/tasks/<taskId>/source/** are read-only inputs: reading them is allowed even though writing .harness/** is forbidden. Never resolve `path` relative to the repository root, search for substitutes, or fall back to docs/** when a bound read fails."
+      "subtask_prompt": "Independently review generated Markdown cases against the task requirements and environment evidence. Treat the files as human-facing test documentation: require clear preconditions, executable steps and assertable expected results; improve names, purpose, metadata and automation mapping where useful while preserving exact machine IDs and technical literals.\n\nCheck AC completeness/meaning, endpoint, fields/shape, status/error codes, rules, states, documented boundaries/auth, positive/negative coverage, executable steps and assertable results. Reject avoidable English prose, duplicated bilingual wording, repeated boilerplate, oversized unstructured sections, vague results such as ‘符合预期’, Case-ID-like module filenames (for example `BE-HEALTH.md`), and missing or drifted script/function mapping where it can be derived.\n\nCorrect testcase/md/** directly: add documented omissions, remove unsupported cases, rename module files to stable lowercase stems when needed, fix automation mappings so each case points at `testcase/test_<module>.py` derived from that module filename, merge duplicates, improve navigation/tables/Chinese wording, or record gaps in Chinese. Keep Case IDs, AC/REQ/BR IDs, HTTP methods, paths, fields, enum values, filenames, code symbols and source citations exact. The validator accepts Chinese and legacy English section aliases; retain or converge to the Chinese human-readable headings without losing structure.\n\nRead only precise referenced source paths plus requirement sections needed for uncovered ACs. Do not scan the repository, modify source/**, generate pytest, execute tests, or emit JSON.\n\n## Derived task contract: 需求.md\n\n# Backend test\n- AC-001 proof\n\n## Authoritative reference index\n\n[]\n\nFor each index entry, use `readPath` for Pi read-tool calls and keep `path` as the exact Markdown Source References citation. Bound files under .harness/tasks/<taskId>/source/** are read-only inputs: reading them is allowed even though writing .harness/** is forbidden. Never resolve `path` relative to the repository root, search for substitutes, or fall back to docs/** when a bound read fails."
     },
     {
       "id": "validate-backend-md-cases-shell",
@@ -203,7 +203,7 @@
         "artifacts/**"
       ],
       "outputContract": "Convert every final automatable Markdown case into pytest assets whose actual test function region contains the exact Case ID, preferably in the function name or docstring. Each testcase/md/<module>.md (excluding README.md) maps one-to-one to testcase/test_<module>.py; never merge or split modules. No JSON and no pytest execution.",
-      "subtask_prompt": "Convert testcase/md/** to pytest using upstream environment and advisory validation evidence plus only bounded pytest config/conftest. A FAIL advisory report does not authorize inventing missing behavior; use the final Markdown facts that are present.\n\nEnsure every final Markdown Case ID appears in at least one real pytest test function or pytest test class method region, preferably as `test_BE_<MODULE>_<NNN>_<description>` and in that function/method docstring. Module-level functions and class-based pytest methods are both supported. Multiple test functions may cover one Case ID; assertions come only from 预期结果/Expected Results and setup comes only from 前置条件 plus any optional 测试数据/自动化映射 or their legacy English aliases.\n\nName each generated pytest file so it corresponds one-to-one with its source Markdown module file: for each `testcase/md/<module>.md` (excluding README.md), emit exactly one `testcase/test_<module>.py`. The <module> stem is the Markdown filename without the `.md` extension, lowercased and with non-alphanumeric characters replaced by underscores. For example, `testcase/md/resource_notes.md` maps to `testcase/test_resource_notes.py`, and `testcase/md/order-api.md` maps to `testcase/test_order_api.py`. Never merge multiple Markdown modules into one pytest file, never split one module across several files, and never invent pytest filenames unrelated to the Markdown modules.\n\nGenerate a reusable HTTP logging helper (or equivalent client wrapper) and call it for every interface request. The request log must include method, URL/path, and request parameters (query plus JSON/body/payload summary). The response log must include status code and response result (JSON/text/body summary), and both records must be visible in pytest stdout/stderr without changing assertions.\n\nCompare timestamps and other semantically equivalent protocol values by parsed meaning, not byte-for-byte serialization. In particular, normalize valid ISO-8601 instants before equality/order assertions so differences such as omitted trailing fractional seconds do not create TestBug failures; preserve exact-string assertions only when the Markdown explicitly requires representation equality.\n\nBefore logging, recursively redact sensitive keys and header values including authorization, proxy-authorization, cookie, set-cookie, token, password, secret, api key and credentials. Never print full Authorization/Cookie values. Apply bounded truncation to serialized request and response bodies (with an explicit truncation marker) so large payloads cannot flood pytest or report artifacts.\n\nDo not read source/**, add cases, reassign ACs, modify conftest/config/production code, use skip/xfail, swallow assertions, execute pytest, or emit JSON. For best-effort cleanup, catch only the narrow transport exception actually raised by the selected HTTP client (for example `requests.RequestException` or `urllib.error.URLError`); never use bare `except`, `Exception`, or `BaseException` with `pass`."
+      "subtask_prompt": "Convert testcase/md/** to pytest using upstream environment and advisory validation evidence plus only bounded pytest config/conftest. A FAIL advisory report does not authorize inventing missing behavior; use the final Markdown facts that are present.\n\nEnsure every final Markdown Case ID appears in at least one real pytest test function or pytest test class method region, preferably as `test_BE_<MODULE>_<NNN>_<description>` and in that function/method docstring. Module-level functions and class-based pytest methods are both supported. Multiple test functions may cover one Case ID; assertions come only from 预期结果/Expected Results and setup comes only from 前置条件 plus any optional 测试数据/自动化映射 or their legacy English aliases.\n\nName each generated pytest file so it corresponds one-to-one with its source Markdown module file: for each `testcase/md/<module>.md` (excluding README.md), emit exactly one `testcase/test_<module>.py`. The <module> stem is the Markdown filename without the `.md` extension, lowercased and with non-alphanumeric characters replaced by underscores. For example, `testcase/md/resource_notes.md` maps to `testcase/test_resource_notes.py`, `testcase/md/health.md` maps to `testcase/test_health.py`, `testcase/md/BE-HEALTH.md` maps to `testcase/test_be_health.py`, and `testcase/md/order-api.md` maps to `testcase/test_order_api.py`. If Markdown automation mapping names a different path than this module stem path, still write the module stem path and do not invent prefixes such as `test_be_*` unless the module filename itself normalizes to that stem. Never merge multiple Markdown modules into one pytest file, never split one module across several files, and never invent pytest filenames unrelated to the Markdown modules.\n\nGenerate a reusable HTTP logging helper (or equivalent client wrapper) and call it for every interface request. The request log must include method, URL/path, and request parameters (query plus JSON/body/payload summary). The response log must include status code and response result (JSON/text/body summary), and both records must be visible in pytest stdout/stderr without changing assertions.\n\nCompare timestamps and other semantically equivalent protocol values by parsed meaning, not byte-for-byte serialization. In particular, normalize valid ISO-8601 instants before equality/order assertions so differences such as omitted trailing fractional seconds do not create TestBug failures; preserve exact-string assertions only when the Markdown explicitly requires representation equality.\n\nBefore logging, recursively redact sensitive keys and header values including authorization, proxy-authorization, cookie, set-cookie, token, password, secret, api key and credentials. Never print full Authorization/Cookie values. Apply bounded truncation to serialized request and response bodies (with an explicit truncation marker) so large payloads cannot flood pytest or report artifacts.\n\nDo not read source/**, add cases, reassign ACs, modify conftest/config/production code, use skip/xfail, swallow assertions, execute pytest, or emit JSON. For best-effort cleanup, catch only the narrow transport exception actually raised by the selected HTTP client (for example `requests.RequestException` or `urllib.error.URLError`); never use bare `except`, `Exception`, or `BaseException` with `pass`."
     },
     {
       "id": "backend-test-traceability-gate-shell",
@@ -250,8 +250,8 @@
         ".harness/dag-runs/**",
         "artifacts/**"
       ],
-      "outputContract": "One scoped pytest execution over Markdown-mapped scripts producing valid JUnit with per-case captured output, self-contained reports/backend-test.html and reports/backend-test.md, plus internal reports/backend-test-facts.md evidence; exit 0/1 with valid evidence continues.",
-      "subtask_prompt": "Resolve the final Markdown Automation Notes/自动化映射 to a unique, safe set of testcase/**/test_*.py targets and execute only those scripts exactly once. Validate JUnit, then render the primary self-contained Chinese HTML report from the same JUnit plus final Markdown case metadata without rerun. Keep 测试结论, quality status, failure overview, and a polished per-case result card with concise scenario, automation test name, result, duration, and redacted bounded HTTP request parameters/response results for both passed and failed cases. Do not render a technical/execution evidence section in HTML; retain auditable paths and hashes in facts.",
+      "outputContract": "One scoped pytest execution over Markdown-mapped scripts producing a valid pytest-html report with per-case captured output, self-contained reports/backend-test.html and reports/backend-test.md, plus internal reports/backend-test-facts.md evidence; exit 0/1 with valid evidence continues.",
+      "subtask_prompt": "Resolve the final Markdown Automation Notes/自动化映射 to a unique, safe set of testcase/**/test_*.py targets and execute only those scripts exactly once. Prefer the deterministic module one-to-one path when a mapped script is missing but the module stem file exists. Generate a native pytest-html self-contained report, then render the primary self-contained Chinese HTML report from the same pytest-html plus final Markdown case metadata without rerun. Keep 测试结论, quality status, failure overview, and a polished per-case result card with concise scenario, automation test name, result, duration, and redacted bounded HTTP request parameters/response results for both passed and failed cases. Do not render a technical/execution evidence section in HTML; retain auditable paths and hashes in facts.",
       "shell": {
         "commands": [
           "mkdir -p \"${HARNESS_DAG_RUN_DIR}/reports\"; echo \"pytest targets are resolved at runtime from final Markdown 自动化映射\""
@@ -284,7 +284,7 @@
         "artifacts/**"
       ],
       "outputContract": "Final Markdown report and L-5 conclusion under docs/test-reports/**; no JSON.",
-      "subtask_prompt": "Generate the final Markdown report from upstream facts and run-owned environment, advisory case-validation, advisory traceability, JUnit and HTML evidence. Do not emit JSON.\n\nUse this exact human-facing section order: 测试结论 → 执行概览 → 质量校验 → 失败分析 → 风险与建议 → 证据与 L-5. Put the decision and key numbers first, use compact tables/bullets, and keep headings concise. Do not paste entire upstream reports, duplicate per-case tables already present in facts, or repeat the same evidence in multiple sections; link to paths/hashes and quote only the findings needed for the conclusion.\n\nAlways state the exact PASS/FAIL status and findings from nodes 4 and 6. Their FAIL status does not block pytest, but it must remain visible as a quality/traceability risk and must never be rewritten as PASS.\n\nInclude environment, case quality/review, automation mapping, exact pytest facts, failure classification/analysis, risks, regression recommendations, evidence paths/hashes, coverage availability, and L-5 READY/NOT READY.\n\nNever override Shell/JUnit facts. L-5 requires pass=100%, AC=100%, automation>=90%, line>=80%, branch>=70%, skipped=0 and no blocking Critical risk.\n\nWrite only under docs/test-reports/**."
+      "subtask_prompt": "Generate the final Markdown report from upstream facts and run-owned environment, advisory case-validation, advisory traceability, pytest-html and HTML evidence. Do not emit JSON.\n\nUse this exact human-facing section order: 测试结论 → 执行概览 → 质量校验 → 失败分析 → 风险与建议 → 证据与 L-5. Put the decision and key numbers first, use compact tables/bullets, and keep headings concise. Do not paste entire upstream reports, duplicate per-case tables already present in facts, or repeat the same evidence in multiple sections; link to paths/hashes and quote only the findings needed for the conclusion.\n\nAlways state the exact PASS/FAIL status and findings from nodes 4 and 6. Their FAIL status does not block pytest, but it must remain visible as a quality/traceability risk and must never be rewritten as PASS.\n\nInclude environment, case quality/review, automation mapping, exact pytest facts, failure classification/analysis, risks, regression recommendations, evidence paths/hashes, coverage availability, and L-5 READY/NOT READY.\n\nNever override Shell/pytest-html facts. L-5 requires pass=100%, AC=100%, automation>=90%, line>=80%, branch>=70%, skipped=0 and no blocking Critical risk.\n\nWrite only under docs/test-reports/**."
     }
   ],
   "sourceBinding": {

package/docs/templates/backend-test-dag.review-cases.prompt.md

@@ -22,7 +22,7 @@
 - 对照每条 `需求依据` 和环境报告检查 AC、接口、字段/响应形状、状态码、错误语义、状态转换、正向/异常/边界场景。
 - 删除无依据场景、合并重复用例、补齐有依据的遗漏；无法确认的内容写入中文证据缺口，不猜测行为或凭据。
 - 拒绝“符合预期”“正常工作”等模糊结果，以及无意义的中英双写和大段重复 boilerplate。
-- 若能确定脚本与函数命名，在 `自动化映射` 中写明计划脚本路径与 pytest 函数/方法名。
+- 若能确定脚本与函数命名，在 `自动化映射` 中写明计划脚本路径与 pytest 函数/方法名；脚本路径必须等于模块 one-to-one 路径 `testcase/test_<module>.py`，`<module>` 来自当前 Markdown 文件名 stem，不得使用 Case-ID 式模块名（如 `BE-HEALTH.md`）或与模块 stem 不一致的映射。
 
 ## 推荐输出
 

package/docs/templates/evaluation/agents-map-slim-v1.md

@@ -37,7 +37,7 @@
 4. 涉及测试纪律/验证声明/调试时继续读：`docs/harness-methodology-*.md`。
 5. 查看最近提交、相关 plan/progress/report；`git status --short --branch`；跑最小基线验证。
 6. 后端/接口/pytest → `taskKind: "backend-test"`（不是 `--profile`）；知识回写 `knowledge-sync`；图谱开荒 `knowledge-graph-bootstrap`。`--profile` 仅 `auto|minimal|standard|reviewed|supervised`。
-7. 看板/observe → `agent-worker console serve --repo . --port 8790`（`/inspect/` 只读）；`observe serve` 仅为兼容入口。
+7. 看板/observe → `agent-worker console`（默认 repo=当前目录、port=8790；兼容 `agent-worker console serve --repo . --port 8790`）（`/inspect/` 只读）；`observe serve` 仅为兼容入口。
 8. 分支合并 → 先读 `docs/operations/branch-merge-guideline.md`。
 
 ## 会话协议

package/docs/templates/evaluation/agents-map-verbose-v0.md

@@ -54,7 +54,7 @@
 10. 检查 `git status --short --branch`。
 11. 运行本次任务相关的最小基线验证。
 12. 如果用户提到"后端测试"、"接口测试"、"pytest"、"自动化测试"，在任务 `task.json` 中设置 `taskKind: "backend-test"` 再 `dag run-task`；不要用 `--profile backend-test`（CLI 不接受该值，专用模板只走 taskKind）。知识回写用 `taskKind: "knowledge-sync"`（须 `featureId`），图谱开荒用 `taskKind: "knowledge-graph-bootstrap"`。`--profile` 仅表示治理强度：`auto|minimal|standard|reviewed|supervised`。
-13. 如果用户提到"看板"、"observe"、"监控面板"、"启动看板"，使用 `agent-worker console serve --repo . --port 8790` 启动统一 Operator Console；`/inspect/` 提供只读检视。`agent-worker observe serve --repo . --port 8787` 仅为兼容入口。
+13. 如果用户提到"看板"、"observe"、"监控面板"、"启动看板"，使用 `agent-worker console` 启动统一 Operator Console（默认 repo=当前目录、port=8790；兼容入口 `agent-worker console serve --repo . --port 8790`）；`/inspect/` 提供只读检视。`agent-worker observe serve --repo . --port 8787` 仅为兼容入口。
 14. 如果用户要求“合并 `<source>` 到 `<target>`”或“合并 origin/main 到当前分支”，先阅读 `docs/operations/branch-merge-guideline.md`，按影响自动选择快速、标准或深度模式；始终冻结 source SHA、审查双方功能、运行 merge-tree、生成 source-SHA 合并报告，并在提交前再次 fetch 防止主干前进。
 
 ## 会话协议
@@ -89,7 +89,7 @@
 - 长期决策写入 `docs/`，不要只留在聊天里。
 - 分支合并遵循 `docs/operations/branch-merge-guideline.md`；快速模式只用于可证明的低风险/no-op 合并，涉及冲突、init/package/runtime/release/public API 时必须升级为标准或深度模式。
 - 后端测试、接口/API 测试、pytest 或明确的后端自动化测试，必须把 `.harness/tasks/<task-id>/task.json` 的 `taskKind` 设置为 `"backend-test"`，不得保留默认 `standard`。`backend-test` 是 `taskKind`，不是 `--profile` 的可选值；`dag run-task` 继续使用 `--profile auto` 选择治理等级。仅说“自动化测试”且前后端不明时，先根据任务源和项目技术栈判断，禁止无条件路由。
-- 本地 Operator Console：`agent-worker console serve --repo . --port 8790`，访问 `http://127.0.0.1:8790/`；其中 `/inspect/` 为只读运行检视。默认绑定本机 `127.0.0.1`；可用 `--host 0.0.0.0` / `--debug`，不要直接暴露到公开网络。
+- 本地 Operator Console：`agent-worker console`（默认 repo=当前目录、port=8790；兼容 `agent-worker console serve --repo . --port 8790`），访问 `http://127.0.0.1:8790/`；其中 `/inspect/` 为只读运行检视。默认绑定本机 `127.0.0.1`；可用 `--host 0.0.0.0` / `--debug`，不要直接暴露到公开网络。端口被占用时不会自动更换，请用 `--port <port>` 显式指定。
 - 面向使用者的新增、修改、删除或修复，应同步更新根目录 `CHANGELOG.md`；保持版本级摘要即可，不写过细技术细节。
 - 面向用户的中文更新日志、README 和说明文档应使用自然、结果导向的表达：先说明用户能获得什么或问题如何改善，保留必要的命令和产品术语，避免逐字翻译、内部实现细节和无意义的中英混杂。
 - 涉及 `loop-agent init` 或目标项目投影的改动，必须同步考虑目标项目生成物：`AGENTS.md`、`README.md`、`harness.json`、`ai_workspace/loop-agent/`、`scripts/`、`.agents/skills/`、`.harness/prompts`、`.gitignore`（loop-agent runtime managed block）和 npm 包内置 assets；目标项目根 `docs/` 和根 `skills/` 的旧投影需要由 `init update --apply-safe` 安全迁移或退役。

package/harness.json

@@ -58,7 +58,7 @@
   "executors": {
     "pi": {
       "description": "Pi planning, review, diagnosis, and bounded writing when DAG toolProfile=write",
-      "LOW": "gpt-5.3-codex-spark",
+      "LOW": "grok-4.5",
       "MED": "grok-4.5",
       "HIGH": "gpt-5.6-sol"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tea-agent/loop-agent",
-  "version": "0.24.4",
+  "version": "0.24.5",
   "type": "module",
   "bin": {
     "loop-agent": "bin/loop-agent.js",

package/skills/agent-worker/SKILL.md

@@ -16,7 +16,7 @@ references:
 - **允许**：`agent-worker` / `loop-agent` CLI；只读 `pool doctor`、`observe`、status/report；冻结 controller identity；选择 Ready 工作与 recovery 命令。
 - **禁止**：绕过 CLI 直接 Edit 业务实现；Worker/DAG 失败后主会话「救火改文件」。
 - **失败时只允许**：保留 evidence → `task retry` / `task reconcile` / `pool mark-failed` / human gate → 再经 CLI 重跑；实现写入仍只经 published `loop-agent` DAG。
-- **Official vs Compatibility**：`agent-worker console serve` 是 Official 本地控制面（同进程提供 Operate + Inspect，Inspect 路径 `/inspect/#/...`）；openCode 等主会话仍是 Compatibility Assist，二者**不是**同等保证。原 `observe serve` 为兼容期只读入口（启动时输出 `OBSERVE_SERVE_DEPRECATED`，stdout 仍只输出 URL），功能等价于 Console 的 Inspect 面。
+- **Official vs Compatibility**：`agent-worker console` 是 Official 本地控制面（裸入口直接启动；默认 repo=当前目录、port=8790；兼容入口 `agent-worker console serve --repo . --port 8790` 等价）。同进程提供 Operate + Inspect，Inspect 路径 `/inspect/#/...`；openCode 等主会话仍是 Compatibility Assist，二者**不是**同等保证。原 `observe serve` 为兼容期只读入口（启动时输出 `OBSERVE_SERVE_DEPRECATED`，stdout 仍只输出 URL），功能等价于 Console 的 Inspect 面。
 
 ## Route the Work
 

package/skills/loop-agent/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: loop-agent
 description: >-
-  Use when implementing features, processing PRDs or requirements, running structured loop-agent workflows, creating harness tasks, using Agent DAG, run-dag, pi-prompt planning/review, cursor-prompt one-shot sidecar intervention, initializing a target project with loop-agent, checking init update status, applying a safe init update, or converging website/governance docs after user-visible changes in loop-agent. Triggers: loop-agent, workflow, structured development, harness task, Agent DAG, docs converge, Converge Docs, 文档收敛, 结构化开发, 工作流, 需求实现, PRD 实现, 初始化 loop-agent, loop agent 初始化, loop agent初始化, loop-agent 初始化, 初始化更新校验, loop agent初始化更新校验, 检查初始化更新, 初始化安全更新, loop agent初始化安全更新, 应用初始化更新.
+  Use when implementing features, processing PRDs or requirements, running structured loop-agent workflows, creating harness tasks, using Agent DAG, run-dag, pi-prompt planning/review, cursor-prompt one-shot sidecar intervention, initializing a target project with loop-agent, checking init update status, applying a safe init update, or converging website/governance docs after user-visible changes in loop-agent. Triggers: loop-agent, workflow, structured development, harness task, Agent DAG, docs converge, Converge Docs, 文档收敛, 结构化开发, 工作流, 需求实现, PRD 实现, 初始化 loop-agent, loop agent 初始化, loop agent初始化, loop-agent 初始化, 初始化更新校验, loop agent初始化更新校验, 检查初始化更新, 初始化安全更新, loop agent初始化安全更新, 应用初始化更新. 强路由：loop-agent 帮我完成需求, 帮我实现, 帮我修复, 帮我开发, 使用 loop-agent 完成, 按 loop-agent 流程处理, 通用需求实现；这些表达确定性地进入 Agent DAG/CLI（new-task, dag run-task, dag validate, run-dag），主会话编排而不直接写业务实现.
 references:
   - path: references/harness-policy.md
     required: true

package/skills/loop-agent/references/command-reference.md

@@ -117,6 +117,7 @@ SDK 回归或 SDK 可选依赖不可用时用 `cli-only` 诊断。CLI fallback
 | 初始化更新校验 / loop agent初始化更新校验 / 检查初始化更新 | `loop-agent init check-update --repo-root . --markdown`（只读，不得隐含 `apply-safe`） |
 | 初始化安全更新 / loop agent初始化安全更新 / 应用初始化更新 | 先 `loop-agent init check-update --repo-root . --markdown`，再 `loop-agent init update --repo-root . --apply-safe`（surface 缺失时先 `--bootstrap-surface`；human decisions 存在时停下等用户） |
 | 初始化对齐 / 升级后对齐 / init reconcile / 控制器升级后对齐目标项目 | `loop-agent init reconcile --repo-root .`（统一入口：surface 缺失返回 `needs-baseline` 零写入；human decisions 返回 `needs-human-decision` 零写入；活跃 DAG/Worker 或 Worker 状态无法确认时返回 `blocked-active-runtime` 零写入；其余执行 safe actions 后复查） |
+| loop-agent 帮我完成 / 帮我实现 / 帮我修复 / 帮我开发 <需求>；使用 loop-agent 完成 <X>；按 loop-agent 流程处理 <X> | 先 `loop-agent new-task <task-id> "任务标题"`，写 `source/需求.md` 与 `source/执行约束.md`，同步 `task.json.allowedPaths` / `forbiddenPaths`，再 `loop-agent dag run-task <task-id> --profile auto --strict-models`、`dag validate`、`run-dag`；主会话编排而不直接写业务实现 |
 
 ```bash
 loop-agent init instructions --repo-root <target-repo>
@@ -336,8 +337,8 @@ loop-agent dag resume --run-id <run-id>                  # approve 后继续
 - 从 run facts dry-run envelope 解析用 `dag decision inspect|validate`；`validate` 在无效 envelope 时 exit 1；永不自动 resume/retry。
 - Decision Gate prompt 可用 `buildDagDecisionGateEvidence()`（`src/workflows/dag/decision-evidence.ts`）做与 `dag report --json`、`ai_workspace/loop-agent/templates/agent-dag-report.schema.json` 对齐的只读摘要；不 mutate run state，不执行 retry/resume。
 - 仅当有意在 `.harness/dag-runs/active/` 下要 active run snapshot 时用 `run-dag --dry-run`。
-- task source 应从 `harness.json.workflowPolicy.dag.profileRouting` 与确定性 candidate `governanceProfile` 选择通用候选模板时用 `dag run-task --profile auto`。无 `--profile` 仅用于旧 standard-compatible 输出；`--profile minimal|standard|reviewed|supervised` 选择治理路由，其中 supervised 模板不会被自动前端分类替换。
-- 默认 `standard` 任务会根据标题、`source/需求.md` 和结构化 `allowedPaths` 做保守、确定性的需求分类。只有高置信的前端实现需求自动选择 `frontend-implementation`；后端、前后端混合、明确排除前端或无法可靠判断的需求保留 governance profile 选出的模板，绝不自动进入 `backend-test`。显式 profile、`workflowPolicy` 或 supervised quality gate 已选中 supervised 时，自动分类不得降低治理等级。
+- task source 应从 `harness.json.workflowPolicy.dag.profileRouting` 与确定性 candidate `governanceProfile` 选择治理强度时用 `dag run-task --profile auto`。无 `--profile` 仅用于旧 standard-compatible 输出；`--profile minimal|standard|reviewed|supervised` 记录治理强度，不替换已识别的专用业务 workflow。
+- 默认 `standard` 任务先读取 `source/需求.md` 中的结构化任务类型，再结合 `allowedPaths` 与 React/Next/Vue 项目能力做确定性分类。确认是前端项目且任务不是明确后端、混合、排除前端或仅文档/测试范围时，自动选择 `frontend-implementation`，不依赖需求关键词；普通后端实现绝不自动进入 `backend-test`。
 - 新生成 DAG 会冻结任务源路径、SHA-256 和显式 `REQ/BR/AC` 到 `sourceBinding`。前端计划漏号时 `frontend-requirement-coverage-shell` 在 writer 前阻断。中断恢复应修复 task source 后重新运行 `dag run-task`，不要生成只携带上游摘要的 impl-only DAG；strict governance 会拒绝无来源绑定且无只读 planner 上游的 v3 孤立 writer。
 - 显式专用 `taskKind` 保持兼容并优先于任务源分类，也不扩充 governance profile：`frontend-implementation` 可有意覆盖为带 Mock 规范评估、contract gate、design gate 和验证链的前端模板；可选 `frontendMock` 配置 auto/required/disabled、既有服务目录和专项验证命令，required 合同不完整时不会生成 writer。`backend-test` 显式选择需求分析 → 功能用例 → 评审 → pytest 生成/执行 → 复盘的后端测试工程模板。
 

package/skills/loop-agent/references/hybrid-dag.md

@@ -14,7 +14,7 @@
 
 此 policy 驱动 `dag run-task --profile auto`：CLI 仍要求显式 `dag run-task`、`dag validate`、`run-dag`，但 `--profile auto` 在确定性 candidate `governanceProfile` 推断后应用 `workflowPolicy.dag.profileRouting`。生成器还会把 `outputLanguage` 写入 DagSpec，runner 在每个 Pi/Cursor 节点 prompt 中注入语言规则；代码、命令、路径、JSON 字段与 gate token 保持原样。`humanGatePolicy` 是默认人机边界声明；真实暂停仍由 DAG 节点的 `decisionGate.mode: "pause-on-human"` 与 decision envelope 触发。无 profile 的 `dag run-task <task-id>` 仍为 standard-compatible，供 legacy/review workflow。
 
-对于默认 `standard` 任务，生成器组合标题、`source/需求.md`、结构化 `allowedPaths`、React/Next/Vue 强工程证据与用户可见交互/状态语义，做保守、确定性的需求分类。即使需求没有显式写出“前端/UI/页面”，工程证据与产品交付语义共同成立时也会自动选择 `frontend-implementation` DAG；框架证据单独不足以触发。后端、前后端混合、明确排除前端、文档/测试维护或证据不足的需求继续使用 governance profile 选出的模板。分类不会把普通后端实现路由到 `backend-test`，也不会替换由显式 profile、`workflowPolicy` 或 supervised quality gate 选中的 supervised 模板。
+对于默认 `standard` 任务，生成器先读取 `source/需求.md` 中的结构化任务类型，再结合 `allowedPaths` 与 React/Next/Vue 强工程证据做确定性分类。确认是前端项目且任务不是明确后端、前后端混合、排除前端或仅文档/测试范围时，默认选择 `frontend-implementation` DAG，不依赖需求关键词。分类不会把普通后端实现路由到 `backend-test`；显式 profile、`workflowPolicy` 或 supervised quality gate 只记录治理强度，不把已识别的前端业务 workflow 换回通用模板。
 
 前端专用链保留独立 contract/scout；plan 同时选择 Mock/API 策略并输出结构化 implementation contract。design initial pass 直接使用原计划，只有 request-revision 才运行 revision/final review；small-risk 只执行一次 design review。`frontend-prewrite-gate-shell` 合并生效 verdict、REQ/BR/AC 覆盖、Mock policy 和 contract 物化，是唯一写入授权。实现后 `frontend-verify-assess-shell` 合并 Mock/static/behavior/trace/assessment；只有 `eligible=true` 才运行同 writeSet 的 repair 和 `frontend-reverify-shell`。`frontend-review-context-shell` 绑定真实 diff 与有效验证证据后再 review/closeout。standard/high-risk 为 15 个顶层节点，small-risk 为 13；绿色路径执行 11 个节点、7 次 Pi。生成期 blocked Mock 只生成一个确定性阻塞节点且没有 writer。
 
@@ -67,7 +67,7 @@ loop-agent run-dag --dag <temp-dir>/hybrid-dag.json --init-only --canvas-path <t
 **运维 warning**：
 
 - **常规 validation**：`dag validate --dag <path>` 做 schema/topology/ranks。JSON 输出含 `governanceProfile`（确定性 `minimal|standard|reviewed|supervised` 推断，含 `process` / `delivery` / `codeChange` signal 与 `reasons`），及 model-matrix drift、governance lint（如 read-only artifact-boundary drift 或 DAG 内 `check-repo.sh` shell env drift）的 warnings。手写临时 DAG spec 执行前用 `dag validate --dag <path> --strict-models`；governance warning 应 fail fast 时加 `--strict-governance`。含 `executor: "cursor"` 的旧 DAG 会在 schema 校验失败；默认生成 DAG 使用 `pi` read-only / Pi write profile / shell。仅当有意在 `.harness/dag-runs/active/` 要 active run snapshot 时用 `run-dag --dry-run`。
-- **Governance profile 推断与 routing（code vs skill 分工）**：`./src/workflows/dag/governance-profile.ts` 从 DAG 结构与 write scope 做 **硬确定性推断**。JSON 输出 **报告** `process` / `delivery` / `codeChange` signal 与人类可读 `reasons`；`profile` tier（`minimal|standard|reviewed|supervised`）仅由该模块 code rule 选择（如多个 exclusive writer、repair node、review-gate topology、`loop-agent-runtime-paths`、`scripts-ci-harness-paths`、weak post-implementation shell verification、supervised topology）。baseline `forbiddenPaths`（`.harness/**`、`.harness/dag-runs/**`、`artifacts/**`）是默认 governance，**本身不是** process-risk signal。skill prompt 与本 reference **解释** tier 并摘要 profile 选择原因；不替代 code 推断。`dag run-task` 转发 embedded validate step 的同一 candidate `governanceProfile`。`dag run-task --profile auto` 先将 candidate profile 经 `harness.json.workflowPolicy.dag.profileRouting` 映射，再在 candidate delivery signal 含 `loop-agent-runtime-paths`、`scripts-ci-harness-paths` 或 `public-contract-paths` 时应用 M4 `supervised-quality-gate` promotion；`profileRouting.routingReasons` 记录确定性 reason。无 profile `dag run-task <task-id>` 仍为 standard-compatible；显式 `--profile minimal|standard|reviewed|supervised` 选择治理路由的通用候选模板，默认 `standard` 前端任务可在非 supervised 候选上选择前端专用模板，但自动分类不得替换 supervised 候选。高风险 task 应用 `--profile auto` 或显式 `--profile supervised`，而非显式 `--profile reviewed`。
+- **Governance profile 推断与 routing（code vs skill 分工）**：`./src/workflows/dag/governance-profile.ts` 从 DAG 结构与 write scope 做 **硬确定性推断**。JSON 输出 **报告** `process` / `delivery` / `codeChange` signal 与人类可读 `reasons`；`profile` tier（`minimal|standard|reviewed|supervised`）仅由该模块 code rule 选择（如多个 exclusive writer、repair node、review-gate topology、`loop-agent-runtime-paths`、`scripts-ci-harness-paths`、weak post-implementation shell verification、supervised topology）。baseline `forbiddenPaths`（`.harness/**`、`.harness/dag-runs/**`、`artifacts/**`）是默认 governance，**本身不是** process-risk signal。skill prompt 与本 reference **解释** tier 并摘要 profile 选择原因；不替代 code 推断。`dag run-task` 转发 embedded validate step 的同一 candidate `governanceProfile`。`dag run-task --profile auto` 先将 candidate profile 经 `harness.json.workflowPolicy.dag.profileRouting` 映射，再在 candidate delivery signal 含 `loop-agent-runtime-paths`、`scripts-ci-harness-paths` 或 `public-contract-paths` 时应用 M4 `supervised-quality-gate` promotion；`profileRouting.routingReasons` 记录确定性 reason。无 profile `dag run-task <task-id>` 仍为 standard-compatible；显式 `--profile minimal|standard|reviewed|supervised` 与自动 promotion 记录治理强度，已识别的前端业务 workflow 仍使用前端专用模板。高风险 task 应用 `--profile auto` 或显式 `--profile supervised`，而非显式 `--profile reviewed`。
 - **Executor model routing**：DAG spec 选 `executor` 与 `complexity`，可通过 `executorModels.pi` 覆盖 model 名；不选 provider。默认 routing：Pi LOW=`gpt-5.3-codex-spark`、MED=`glm-5.2`、HIGH=`gpt-5.5`。`shell` 不用 model，忽略 `executorModels`。
 - **Active visibility**：真实 `run-dag` execution 在 run/node 转换时写 active `state.json`，归档前 core runner 暴露 isolated `DagRunObserver` hook 供 derived view。`.harness/dag-runs/completed/<run-id>/` / `paused/<run-id>/` 仍是 source of truth；observer 输出非 canonical。
 - **可选 Canvas**：传 `--canvas-path <abs-path>` 或 `--canvas <name>` 输出 derived `.canvas.tsx` live view。省略 flag 行为不变。`--init-only` + Canvas 无需 `CURSOR_API_KEY`。