@tea-agent/loop-agent 0.24.9 → 0.24.11-beta.0

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+### 改进
+
+- Feature Delivery 在省略 `--qa-evidence` / `--final-verification` 时默认使用 `feature verify-final` 写入的 evidence 路径（ADR 0007）
+
+### 文档
+
+- ADR 0007：Final Verification 唯一权威为 `agent-worker feature verify-final`；packet FINAL-VERIFY 仅 local smoke
+- F-2026-005 design / FINAL-VERIFY TaskSpec 与发布列车状态对齐 I39 Delivery + 收口下一步 I40
+
+
+## [0.24.10] - 2026-07-29
+
+### 修复
+
+- Closeout 重验不再要求 `should`/partial AC 绑定完整 run evidence（仅 `covered` must AC 强制 hash 绑定）
+
 ## [0.24.9] - 2026-07-29
 
 ### 重点更新
@@ -22,6 +38,12 @@
 
 - 修复前端证据校验在 Windows 下通过长 node -e 命令执行时的终端转义崩溃：改为由 runtime 内部直接校验，兼容 CMD、Git Bash、PowerShell 与 Unix shell
 
+## [0.24.9] - 2026-07-29
+
+### 修复
+
+- Closeout 重验不再要求 `should`/partial AC 绑定完整 run evidence（仅 `covered` must AC 强制 hash 绑定）
+
 ## [0.24.8] - 2026-07-29
 
 ### 重点更新
@@ -41,6 +63,8 @@
 
 ### 修复
 
+- 修复前端证据校验在 Windows 下通过长 `node -e` 命令执行时的终端转义崩溃：改为由 runtime 内部直接校验，兼容 CMD、Git Bash、PowerShell 与 Unix shell
+- 修复 `frontend-implement-pi` 因复用需求发现 skill 而长时间侦查后空实现：contract 现在强制 requirement outcome 与 interaction 行为语义，implement/repair 改用不含递归 OpenSpec/AI workspace 搜索的 bounded skill，并由 `implementation-outcome-v1` 机器校验声明结果与实际 diff；只有显式 already-satisfied 才允许空 diff
 - Outcome 投影强制写出 repo-relative artifact 路径
 - Delivery `verifyArtifactRefs` 接受位于仓库内的绝对路径（兼容旧 envelope）
 - `verifyBundleTaskSpecBindings` 接受 `qa-testcode`（backend-test）与 `qa-execute`（frontend-test）

package/dist/commands/init.js

@@ -415,18 +415,6 @@ check_skill "loop-agent" \\
   "references/command-reference.md"
 check_skill "agent-worker" "references/agent-worker-operator.md"
 
-# loop-agent description is a YAML folded block (>-); grep ^description: only
-# captures the indicator line. Validate the general-demand trigger terms
-# against the whole skill file so host auto-discovery phrasing cannot drift.
-loop_agent_skill=".agents/skills/loop-agent/SKILL.md"
-loop_agent_text="$(tr '[:upper:]' '[:lower:]' < "\${loop_agent_skill}")"
-for term in "loop-agent 帮我完成" "帮我实现" "帮我修复" "帮我开发" "agent dag" "new-task" "dag run-task" "dag validate" "run-dag"; do
-  if [[ "\${loop_agent_text}" != *"\${term}"* ]]; then
-    echo "skill entry 检查失败（loop-agent）：description 缺少触发/路由词 \${term}" >&2
-    exit 1
-  fi
-done
-
 description_line="$(grep -E '^description:' .agents/skills/agent-worker/SKILL.md | head -n 1 | tr '[:upper:]' '[:lower:]')"
 for term in "agent-worker" "feature packet" "taskspec" "task pool" "self-host" "candidate" "loop-agent"; do
   if [[ "\${description_line}" != *"\${term}"* ]]; then
@@ -814,7 +802,6 @@ function buildManagedAgentsBlock(input) {
         "| 初始化更新校验 / 检查初始化更新 / loop-agent 初始化更新校验 / loop agent初始化更新校验 | 更新校验 | 只读报告，不写入 |",
         "| 初始化对齐 / 升级后对齐 / reconcile 初始化 / loop-agent 初始化对齐 | 升级对齐 | 自动应用确定性安全动作；活跃 DAG/Worker 或人工决策时零写入 |",
         "| 初始化安全更新 / 应用初始化更新 / loop-agent 初始化安全更新 / loop agent初始化安全更新 | 安全更新 | 先 check-update，再只执行确定性安全动作 |",
-        "| loop-agent 帮我完成 / 帮我实现 / 帮我修复 / 帮我开发 <需求>；使用 loop-agent 完成 <X>；按 loop-agent 流程处理 <X> | 通用需求实现 | 先建任务源与 `task.json.allowedPaths` / `forbiddenPaths`，再 `new-task` → `dag run-task` → `dag validate` → `run-dag`；主会话不得直接修改业务实现 |",
         "",
         "**更新校验（只读）**：只读执行下面命令；**不得自动**执行 `apply-safe` 或模型合并。",
         "",
@@ -874,11 +861,10 @@ function buildManagedAgentsBlock(input) {
         "### 运行看板（只读）",
         "",
         "```bash",
-        "agent-worker console                       # 默认 repo=当前目录，port=8790",
-        "agent-worker console serve --repo . --port 8790   # 兼容入口，等价于上面裸入口",
+        "agent-worker console serve --repo . --port 8790",
         "```",
         "",
-        "浏览器打开 `http://127.0.0.1:8790/`；检视面为 `http://127.0.0.1:8790/inspect/`。默认绑定本机 `127.0.0.1`；不要直接暴露到公开网络。端口被占用时不会自动更换，请用 `--port <port>` 显式指定。`agent-worker observe serve` 仅为兼容入口。",
+        "浏览器打开 `http://127.0.0.1:8790/`；检视面为 `http://127.0.0.1:8790/inspect/`。默认绑定本机 `127.0.0.1`；不要直接暴露到公开网络。`agent-worker observe serve` 仅为兼容入口。",
         "",
         "### DAG 诊断与收口",
         "",

package/dist/executors/shell-executor.js

@@ -8,7 +8,7 @@ import { buildRequirementCoverageGateShellCommand, expandShellPreset, buildVerdi
 import { materializeBackendTestAnalysisContract } from "../workflows/dag/backend-test-analysis-contract.js";
 import { extractBackendTestContractEnvelope } from "../workflows/dag/backend-test-contract-envelope.js";
 import { materializeFrontendImplementationContract } from "../workflows/dag/frontend-implementation-contract.js";
-import { materializeFrontendTestResult, validateFrontendCaseEvidence, } from "../workflows/dag/frontend-test-result-contract.js";
+import { materializeFrontendTestResult, } from "../workflows/dag/frontend-test-result-contract.js";
 import { formatFrontendVerificationTraceStdout, runFrontendVerificationTraceGate, } from "../workflows/dag/frontend-verification-trace.js";
 import { formatFrontendWorktreeDiffStdout, runFrontendWorktreeDiffGate, } from "../workflows/dag/frontend-worktree-diff.js";
 import { formatFrontendFailureAssessStdout, formatFrontendRepairContractStdout, runFrontendFailureAssessGate, runFrontendRepairContractGate, } from "../workflows/dag/frontend-repair.js";
@@ -17,7 +17,7 @@ import { formatFrontendReviewContextStdout, runFrontendReviewContextGate, } from
 import { materializeFrontendLintAssessment, materializeFrontendLintBaseline, } from "../workflows/dag/frontend-lint-baseline.js";
 import { formatTraceabilityGateStdout, materializeBackendTestCaseManifest, runBackendTestTraceabilityGate, } from "../workflows/dag/backend-test-case-manifest.js";
 import { materializeBackendTestExecutionContract } from "../workflows/dag/backend-test-execution-contract.js";
-import { materializeBackendTestResultFromPytestHtml, materializeBackendTestResultFromRunDir, parsePytestHtmlReport } from "../workflows/dag/backend-test-result-contract.js";
+import { materializeBackendTestResultFromRunDir, parsePytestHtmlReport } from "../workflows/dag/backend-test-result-contract.js";
 import { collectBackendTestHumanCaseCatalog, collectBackendTestMappedPytestScripts, hasBlockingBackendMarkdownSafetyFindings, inspectBackendTestEnvironment, requiredBackendMarkdownCaseAcIds, renderBackendTestFacts, renderBackendTestHtml, redactBackendTestOutput, validateBackendMarkdownCases, validateBackendMarkdownTraceability, writeRunReport, } from "../workflows/dag/backend-test-markdown-workflow.js";
 import { buildBackendTestCanonicalResultFromInitialShellSnippet, materializeBackendTestClassification, } from "../workflows/dag/backend-test-classification-contract.js";
 import { backendTestSemanticReviewSchema, materializeBackendTestSemanticReview, } from "../workflows/dag/backend-test-semantic-review-contract.js";
@@ -385,101 +385,28 @@ async function executeBackendTestPipeline(input, meta) {
             const mappedScripts = await collectBackendTestMappedPytestScripts(input.cwd);
             const shellQuote = (value) => `'${value.replaceAll("'", `'"'"'`)}'`;
             const pytestTargets = mappedScripts.map(shellQuote).join(" ");
-            const mappedScriptDiagLines = mappedScripts
-                .map((script) => `echo "  - ${script.replaceAll('"', '\\"')}" >> "\${DIAG_FILE}"`)
-                .join("; ");
-            // Diagnostic-first single shell: keep pytest exactly once, but always
-            // emit STEP markers, mapped targets, interpreter identity, exit code
-            // and html presence so empty nonzero-exit failures remain auditable.
             const pytestCommand = [
                 'mkdir -p "${HARNESS_DAG_RUN_DIR}/reports"',
-                'DIAG_FILE="${HARNESS_DAG_RUN_DIR}/reports/backend-test-execute-diagnostics.md"',
-                [
-                    'echo "# Backend Test Execute Diagnostics" > "${DIAG_FILE}"',
-                    'echo >> "${DIAG_FILE}"',
-                    'echo "- startedAt: $(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date)" >> "${DIAG_FILE}"',
-                    'echo "- pwd: $(pwd)" >> "${DIAG_FILE}"',
-                    'echo "- HARNESS_DAG_RUN_DIR: ${HARNESS_DAG_RUN_DIR}" >> "${DIAG_FILE}"',
-                    'echo "- shell: ${BASH:-bash} (${BASH_VERSION:-unknown})" >> "${DIAG_FILE}"',
-                    `echo "- mappedScriptCount: ${mappedScripts.length}" >> "\${DIAG_FILE}"`,
-                    'echo "- mappedScripts:" >> "${DIAG_FILE}"',
-                ].join("; "),
-                mappedScriptDiagLines || 'echo "  - <none>" >> "${DIAG_FILE}"',
-                'echo "STEP=resolve-python"',
                 'PYTHON_BIN="$(command -v python || command -v python3 || true)"',
-                [
-                    'echo "- command_v_python: $(command -v python || true)" >> "${DIAG_FILE}"',
-                    'echo "- command_v_python3: $(command -v python3 || true)" >> "${DIAG_FILE}"',
-                    'echo "- PYTHON_BIN: ${PYTHON_BIN:-<empty>}" >> "${DIAG_FILE}"',
-                ].join("; "),
-                'if [ -z "${PYTHON_BIN}" ]; then echo "python/python3 is required for backend-test execution" | tee -a "${DIAG_FILE}" >&2; exit 127; fi',
-                'echo "STEP=python-identity"',
-                'if ! PYTHONUNBUFFERED=1 "${PYTHON_BIN}" -c "import sys; print(sys.executable); print(sys.version.splitlines()[0])" >> "${DIAG_FILE}" 2>&1; then echo "STEP=python-identity-failed" | tee -a "${DIAG_FILE}" >&2; exit 127; fi',
-                'echo "STEP=pytest-version"',
-                'if ! PYTHONUNBUFFERED=1 "${PYTHON_BIN}" -m pytest --version >> "${DIAG_FILE}" 2>&1; then echo "STEP=pytest-version-failed" | tee -a "${DIAG_FILE}" >&2; exit 127; fi',
-                'echo "STEP=pytest-run"',
-                `echo "- pytestCommand: python -m pytest ${mappedScripts.join(" ")} -v -p no:cacheprovider --html=reports/backend-test.html --self-contained-html" >> "\${DIAG_FILE}"`,
+                'if [ -z "${PYTHON_BIN}" ]; then echo "python/python3 is required for backend-test execution" >&2; exit 127; fi',
                 // Run pytest exactly once and emit the native pytest-html
                 // self-contained report. The HTML/facts renderers read per-case
                 // captured stdout (HTTP_REQUEST/HTTP_RESPONSE) directly from the
                 // pytest-html data-jsonblob island, so a JUnit XML report is no
                 // longer generated.
-                `PYTHONUTF8=1 PYTHONIOENCODING=utf-8 PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 "\${PYTHON_BIN}" -m pytest ${pytestTargets} -v -p no:cacheprovider --html="\${HARNESS_DAG_RUN_DIR}/reports/backend-test.html" --self-contained-html`,
+                `PYTHONUTF8=1 PYTHONIOENCODING=utf-8 PYTHONDONTWRITEBYTECODE=1 "\${PYTHON_BIN}" -m pytest ${pytestTargets} -v -p no:cacheprovider --html="\${HARNESS_DAG_RUN_DIR}/reports/backend-test.html" --self-contained-html`,
                 "STATUS=$?",
                 'printf "%s" "${STATUS}" > "${HARNESS_DAG_RUN_DIR}/reports/backend-test-pytest-exit.txt"',
-                [
-                    'echo "- pytestExitCode: ${STATUS}" >> "${DIAG_FILE}"',
-                    'if [ -f "${HARNESS_DAG_RUN_DIR}/reports/backend-test.html" ]; then echo "- pytestHtml: present ($(wc -c < "${HARNESS_DAG_RUN_DIR}/reports/backend-test.html" | tr -d " ") bytes)" >> "${DIAG_FILE}"; else echo "- pytestHtml: missing" >> "${DIAG_FILE}"; fi',
-                    'echo "- finishedAt: $(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date)" >> "${DIAG_FILE}"',
-                ].join("; "),
-                'echo "STEP=pytest-finished status=${STATUS}"',
                 // exit 0 (all pass) or 1 (assertion failures) with a valid
                 // pytest-html report are reportable; collection errors / crashes
                 // (exit >= 2) or a missing report surface as a pipeline error below.
                 'if { [ "${STATUS}" -eq 0 ] || [ "${STATUS}" -eq 1 ]; } && [ -s "${HARNESS_DAG_RUN_DIR}/reports/backend-test.html" ]; then exit 0; fi',
-                'echo "STEP=pipeline-failed status=${STATUS} html=$([ -s "${HARNESS_DAG_RUN_DIR}/reports/backend-test.html" ] && echo present || echo missing)" >&2',
                 'exit "${STATUS}"',
             ].join("; ");
             const results = await executePipelineCommands(input, meta, [pytestCommand]);
             if (!results.every((result) => result.ok)) {
                 const failure = results.find((result) => !result.ok);
-                const combinedStdout = results.map((result) => result.stdout).join("\n");
-                let diagnosticsText = "";
-                try {
-                    diagnosticsText = await readFile(path.join(meta.runDir, "reports", "backend-test-execute-diagnostics.md"), "utf8");
-                }
-                catch {
-                    diagnosticsText = "";
-                }
-                const stderrSummary = [
-                    "backend-test markdown-execute-html shell failed",
-                    `failureCategory=${failure.failureCategory}`,
-                    `exitCode=${failure.exitCode ?? "null"}`,
-                    `durationMs=${failure.durationMs}`,
-                    `mappedScripts=${mappedScripts.join(",") || "<none>"}`,
-                    `shellStdoutEmpty=${combinedStdout.trim().length === 0}`,
-                    `shellStderrEmpty=${failure.stderr.trim().length === 0}`,
-                    failure.stdoutArtifactPath
-                        ? `commandStdoutArtifact=${failure.stdoutArtifactPath}`
-                        : undefined,
-                    failure.stderrArtifactPath
-                        ? `commandStderrArtifact=${failure.stderrArtifactPath}`
-                        : undefined,
-                    "diagnostics=reports/backend-test-execute-diagnostics.md",
-                    failure.stderr.trim() || "(shell stderr empty)",
-                    diagnosticsText.trim()
-                        ? `--- diagnostics ---\n${diagnosticsText.trim()}`
-                        : "(diagnostics file missing or empty)",
-                ]
-                    .filter((line) => Boolean(line))
-                    .join("\n");
-                return {
-                    ok: false,
-                    stdout: combinedStdout,
-                    stderr: stderrSummary,
-                    failureCategory: failure.failureCategory,
-                    durationMs: Date.now() - started,
-                };
+                return { ok: false, stdout: results.map((result) => result.stdout).join("\n"), stderr: failure.stderr, failureCategory: failure.failureCategory, durationMs: Date.now() - started };
             }
             const reportsDir = path.join(meta.runDir, "reports");
             const pytestHtmlContent = await readFile(path.join(reportsDir, "backend-test.html"), "utf8");
@@ -487,14 +414,6 @@ async function executeBackendTestPipeline(input, meta) {
             if (![0, 1].includes(pytestExitCode))
                 throw new Error(`pytest did not complete with a reportable exit code: ${pytestExitCode}`);
             const parsed = parsePytestHtmlReport(pytestHtmlContent);
-            // Bind Result v1 from the native pytest-html report BEFORE overwriting with the
-            // styled renderer (which drops the data-jsonblob island).
-            const resultArtifact = await materializeBackendTestResultFromPytestHtml({
-                runDir: meta.runDir,
-                htmlRelativePath: "reports/backend-test.html",
-                htmlContent: pytestHtmlContent,
-                pytestExitCode,
-            });
             const cases = await collectBackendTestHumanCaseCatalog(input.cwd);
             const caseValidationSummary = await readRequiredRunReport(reportsDir, "backend-md-case-validation.md");
             const traceabilitySummary = await readRequiredRunReport(reportsDir, "backend-test-traceability.md");
@@ -511,7 +430,7 @@ async function executeBackendTestPipeline(input, meta) {
             const markdownPath = await writeRunReport(meta.runDir, "backend-test.md", facts);
             const factsPath = await writeRunReport(meta.runDir, "backend-test-facts.md", facts);
             const sanitizedOutputs = results.map((result) => redactBackendTestOutput(result.stdout));
-            outputs.push(...sanitizedOutputs, `html=${htmlPath}`, `markdown=${markdownPath}`, `facts=${factsPath}`, `result=${resultArtifact.path}`, facts);
+            outputs.push(...sanitizedOutputs, `html=${htmlPath}`, `markdown=${markdownPath}`, `facts=${factsPath}`, facts);
         }
         else if (pipeline === "contracts") {
             const wrapperPath = path.join(meta.runDir, "analyze-and-discover-backend-test-pi.json");
@@ -970,38 +889,6 @@ async function executeFrontendVerificationBundle(input, meta) {
         };
     }
 }
-async function executeFrontendTestEvidenceValidation(input) {
-    const started = Date.now();
-    try {
-        const result = await validateFrontendCaseEvidence({ workspaceRoot: input.cwd });
-        const output = `frontend case evidence validation cases=${result.cases} findings=${result.issues.length}${result.issues.length ? ` issues=${JSON.stringify(result.issues)}` : ""}`;
-        if (result.hardFail) {
-            return {
-                ok: false,
-                stdout: "",
-                stderr: `frontend-test evidence hard-fail: ${JSON.stringify(result.issues)}`,
-                failureCategory: "nonzero-exit",
-                durationMs: Date.now() - started,
-            };
-        }
-        return {
-            ok: true,
-            stdout: output,
-            stderr: "",
-            failureCategory: "success",
-            durationMs: Date.now() - started,
-        };
-    }
-    catch (error) {
-        return {
-            ok: false,
-            stdout: "",
-            stderr: error instanceof Error ? error.message : String(error),
-            failureCategory: "invalid-output",
-            durationMs: Date.now() - started,
-        };
-    }
-}
 async function executeFrontendLintBaseline(input, meta) {
     const started = Date.now();
     const shell = input.task.shell;
@@ -1102,9 +989,6 @@ export async function executeDagShellNode(input, meta) {
             return { ok: false, stdout: "", stderr: error instanceof Error ? error.message : String(error), failureCategory: "invalid-output", durationMs: Date.now() - started };
         }
     }
-    if (shell?.frontendTestEvidenceValidation) {
-        return executeFrontendTestEvidenceValidation(input);
-    }
     if (shell?.backendTestPipeline) {
         return executeBackendTestPipelineWithWriteGuard(input, meta);
     }

package/dist/worker/cli.js

@@ -41,8 +41,7 @@ export function buildAgentWorkerProgram() {
         .description("Local product-line worker utilities for TaskSpec validation")
         .version(readPackageVersion(path.dirname(path.dirname(path.dirname(fileURLToPath(import.meta.url))))) ?? "0.0.0", "-V, --version", "display version")
         .showHelpAfterError()
-        .showSuggestionAfterError()
-        .enablePositionalOptions();
+        .showSuggestionAfterError();
     const task = program.command("task").description("TaskSpec utilities");
     const batch = program
         .command("batch")
@@ -593,37 +592,19 @@ export function buildAgentWorkerProgram() {
         });
         process.stdout.write(`${JSON.stringify(snapshot)}\n`);
     });
-    consoleCmd
-        .description("Loop Operator Console (local); bare `agent-worker console` starts it directly (repo defaults to current working directory, port defaults to 8790)")
-        .enablePositionalOptions()
-        .passThroughOptions()
-        .option("--repo <repo-root>", "Target repo root (default: current working directory)", process.cwd())
-        .option("--port <port>", "HTTP port", "8790")
-        .option("--host <host>", "Bind host (default 127.0.0.1; use 0.0.0.0 for LAN, no network auth)", "127.0.0.1")
-        .option("--debug", "Log request source/method/path/status to stderr")
-        .option("--app-data <path>", "Override Console application-data root (Draft/Operation/confirmation)")
-        .action(async (options) => {
-        await runConsoleServe({
-            repoRoot: path.resolve(options.repo),
-            host: options.host,
-            port: Number.parseInt(options.port, 10),
-            debug: options.debug === true,
-            appDataRoot: options.appData
-                ? path.resolve(options.appData)
-                : undefined,
-        });
-    });
     consoleCmd
         .command("serve")
-        .option("--repo <repo-root>", "Target repo root (default: current working directory)", process.cwd())
+        .requiredOption("--repo <repo-root>", "Target repo root")
         .option("--port <port>", "HTTP port", "8790")
         .option("--host <host>", "Bind host (default 127.0.0.1; use 0.0.0.0 for LAN, no network auth)", "127.0.0.1")
         .option("--debug", "Log request source/method/path/status to stderr")
         .option("--app-data <path>", "Override Console application-data root (Draft/Operation/confirmation)")
-        .description("Start Loop Operator Console HTTP server (compat entry; equivalent to bare `agent-worker console`)")
+        .description("Start Loop Operator Console HTTP server (Operate + Inspect; static SPA + Operator API)")
         .action(async (options) => {
-        await runConsoleServe({
-            repoRoot: path.resolve(options.repo),
+        const { createConsoleServer } = await import("./console/server.js");
+        const repoRoot = path.resolve(options.repo);
+        const server = await createConsoleServer({
+            repoRoot,
             host: options.host,
             port: Number.parseInt(options.port, 10),
             debug: options.debug === true,
@@ -631,6 +612,13 @@ export function buildAgentWorkerProgram() {
                 ? path.resolve(options.appData)
                 : undefined,
         });
+        process.stdout.write(`${server.url}\n`);
+        await new Promise((resolve) => {
+            const shutdown = () => resolve();
+            process.once("SIGINT", shutdown);
+            process.once("SIGTERM", shutdown);
+        });
+        await server.close();
     });
     consoleCmd
         .command("doctor")
@@ -705,39 +693,6 @@ export async function main(argv = process.argv) {
 async function readTaskYaml(taskSpecPath) {
     return YAML.parse(await readFile(taskSpecPath, "utf-8"));
 }
-/** Shared console serve entry used by both bare `console` and `console serve`. */
-async function runConsoleServe(options) {
-    const { createConsoleServer } = await import("./console/server.js");
-    try {
-        const server = await createConsoleServer({
-            repoRoot: options.repoRoot,
-            host: options.host,
-            port: options.port,
-            debug: options.debug === true,
-            appDataRoot: options.appDataRoot,
-        });
-        process.stdout.write(`${server.url}\n`);
-        await new Promise((resolve) => {
-            const shutdown = () => resolve();
-            process.once("SIGINT", shutdown);
-            process.once("SIGTERM", shutdown);
-        });
-        await server.close();
-    }
-    catch (error) {
-        const detail = error instanceof Error ? error.message : String(error);
-        const code = error?.code;
-        const isPortInUse = code === "EADDRINUSE" ||
-            /listen EADDRINUSE/i.test(detail) ||
-            /address already in use/i.test(detail);
-        if (isPortInUse) {
-            process.stderr.write(`端口 ${options.port} 已被占用，请使用 --port <port> 指定其它端口后重试。\n`);
-            process.exit(1);
-        }
-        process.stderr.write(`${detail}\n`);
-        process.exit(1);
-    }
-}
 function handlePoolRecoveryCliError(error) {
     const detail = error instanceof Error ? error.message : String(error);
     process.stderr.write(`${detail}\n`);

package/dist/worker/delivery/git-transaction.js

@@ -101,12 +101,11 @@ export async function finalizeGitTask(transaction, outcome) {
     await assertTransactionPosition(transaction.repoRoot, current);
     const currentIgnored = await readIgnoredBaseline(transaction.repoRoot);
     const ignoredBaselineByPath = new Map(current.ignoredBaseline.map((entry) => [entry.path, entry.sha256]));
-    const changedBaselineIgnored = currentIgnored
-        .filter((entry) => ignoredBaselineByPath.has(entry.path) && ignoredBaselineByPath.get(entry.path) !== entry.sha256)
-        .map((entry) => entry.path);
-    const missingBaselineIgnored = current.ignoredBaseline
-        .filter((entry) => !currentIgnored.some((candidate) => candidate.path === entry.path))
-        .map((entry) => entry.path);
+    const changedBaselineIgnored = currentIgnored.filter((entry) => ignoredBaselineByPath.has(entry.path) && ignoredBaselineByPath.get(entry.path) !== entry.sha256).map((entry) => entry.path);
+    const missingBaselineIgnored = current.ignoredBaseline.filter((entry) => !currentIgnored.some((candidate) => candidate.path === entry.path)).map((entry) => entry.path);
+    if (changedBaselineIgnored.length > 0 || missingBaselineIgnored.length > 0) {
+        throw new Error(`pre-existing ignored file changed during Git transaction: ${[...changedBaselineIgnored, ...missingBaselineIgnored].join(", ")}`);
+    }
     const existing = current.checkpoints.find((entry) => entry.workerRunId === outcome.workerRunId);
     if (outcome.status === "reused" || existing) {
         if (!existing)
@@ -124,28 +123,12 @@ export async function finalizeGitTask(transaction, outcome) {
     const newIgnored = currentIgnored.map((entry) => entry.path).filter((entry) => !ignoredBaselineByPath.has(entry));
     if (outcome.status === "succeeded") {
         const allowedPaths = expandAllowedPathsForWorkflow(resolveWorkflow(outcome.taskSpec).workflow, outcome.taskSpec.constraints.allowed_paths);
-        const isAllowedEvidencePath = (entry) => !isSensitivePath(entry) &&
-            !isEphemeralToolCachePath(entry) &&
-            allowedPaths.some((glob) => matchesGlob(entry, glob));
-        // Pre-existing ignored evidence under allowed_paths may be rewritten by
-        // FINAL-VERIFY smoke / verify-final and must force-add into the checkpoint.
-        // Other baseline ignored mutations remain fail-closed (e.g. dist/, secrets).
-        const blockedBaselineChanged = changedBaselineIgnored.filter((entry) => !isAllowedEvidencePath(entry));
-        const blockedBaselineMissing = missingBaselineIgnored.filter((entry) => !isEphemeralToolCachePath(entry) && !isAllowedEvidencePath(entry));
-        if (blockedBaselineChanged.length > 0 || blockedBaselineMissing.length > 0) {
-            throw new Error(`pre-existing ignored file changed during Git transaction: ${[...blockedBaselineChanged, ...blockedBaselineMissing].join(", ")}`);
-        }
         // Evidence under allowed_paths may be gitignored for local convenience (e.g.
         // reports/welcome/** smoke JSON) but must still checkpoint for Task Pool Done.
         // Sensitive / out-of-scope ignored files remain fail-closed; ephemeral tool
         // caches neither block nor force-add.
         const forceAddIgnored = [];
         const blockedIgnored = [];
-        const rewrittenBaselineEvidence = changedBaselineIgnored.filter((entry) => isAllowedEvidencePath(entry));
-        for (const entry of rewrittenBaselineEvidence) {
-            if (!forceAddIgnored.includes(entry))
-                forceAddIgnored.push(entry);
-        }
         for (const entry of newIgnored) {
             if (isEphemeralToolCachePath(entry))
                 continue;
@@ -154,8 +137,7 @@ export async function finalizeGitTask(transaction, outcome) {
                 continue;
             }
             if (allowedPaths.some((glob) => matchesGlob(entry, glob))) {
-                if (!forceAddIgnored.includes(entry))
-                    forceAddIgnored.push(entry);
+                forceAddIgnored.push(entry);
             }
             else {
                 blockedIgnored.push(entry);
@@ -184,10 +166,7 @@ export async function finalizeGitTask(transaction, outcome) {
             await assertTransactionPosition(transaction.repoRoot, { ...current, lastCheckpoint: commit });
             await assertCheckpointMetadata(transaction.repoRoot, commit, outcome.taskSpec, outcome.workerRunId);
             const afterCommitIgnored = await readIgnoredBaseline(transaction.repoRoot);
-            // force-add may promote allowed evidence from ignored → tracked; drop those
-            // paths from the post-commit baseline equality check.
-            const forceAdded = new Set(forceAddIgnored);
-            assertIgnoredBaselineUnchanged(current.ignoredBaseline.filter((entry) => !isEphemeralToolCachePath(entry.path) && !forceAdded.has(entry.path)), afterCommitIgnored.filter((entry) => !isEphemeralToolCachePath(entry.path) && !forceAdded.has(entry.path)));
+            assertIgnoredBaselineUnchanged(current.ignoredBaseline.filter((entry) => !isEphemeralToolCachePath(entry.path)), afterCommitIgnored.filter((entry) => !isEphemeralToolCachePath(entry.path)));
         }
         catch (error) {
             const branch = await git(transaction.repoRoot, ["branch", "--show-current"]).catch(() => "");
@@ -220,10 +199,6 @@ export async function finalizeGitTask(transaction, outcome) {
             changedFiles: checkpointFiles,
         };
     }
-    // Failed / keep-diff paths still fail closed on unexpected baseline ignored mutations.
-    if (changedBaselineIgnored.length > 0 || missingBaselineIgnored.length > 0) {
-        throw new Error(`pre-existing ignored file changed during Git transaction: ${[...changedBaselineIgnored, ...missingBaselineIgnored].join(", ")}`);
-    }
     const artifactDir = path.join(path.dirname(transaction.recordPath), "failures", outcome.workerRunId);
     await captureFailureArtifacts(transaction.repoRoot, artifactDir, changes, newIgnored, outcome);
     if (outcome.keepFailedDiff) {

package/dist/worker/delivery/verification-bundle.js

@@ -404,23 +404,7 @@ export async function verifyBundleOutcomes(repoRoot, bundle) {
             return false;
         if (JSON.stringify(verified.artifacts) !== JSON.stringify(outcome.artifacts))
             return false;
-        // Rehash only durable typed evidence. run_record/dag_json may be rewritten
-        // after outcome projection (worker-run-record appends report commands).
-        const evidenceArtifacts = outcome.artifacts.filter((artifact) => {
-            const kind = artifact.kind ?? "";
-            if (kind === "run_record" || kind === "dag_json")
-                return false;
-            if (kind === "backend-test-result" ||
-                kind === "frontend-test-result" ||
-                kind.includes("backend-test-result") ||
-                kind.includes("frontend-test-result")) {
-                return true;
-            }
-            // Unknown kinds: still rehash unless clearly infrastructure paths.
-            return (!artifact.path.includes("worker-run-record") &&
-                !artifact.path.includes("-dag.json"));
-        });
-        if (!await verifyArtifactRefs(repoRoot, evidenceArtifacts))
+        if (!await verifyArtifactRefs(repoRoot, outcome.artifacts))
             return false;
     }
     return true;
@@ -433,12 +417,9 @@ export function verifyBundleTaskSpecBindings(bundle, specs) {
             return false;
         taskIds.add(outcome.taskId);
         const spec = specs.get(outcome.taskId);
-        // Typed verification tasks may be qa-execute (frontend-test) or qa-testcode
-        // (backend-test Markdown-first). Delivery binds on feature_id + workflow.
-        const typedVerificationTypes = new Set(["qa-execute", "qa-testcode"]);
         if (!spec ||
             spec.feature_id !== bundle.featureId ||
-            !typedVerificationTypes.has(spec.type) ||
+            spec.type !== "qa-execute" ||
             spec.execution?.workflow !== outcome.workflow)
             return false;
     }
@@ -479,11 +460,9 @@ async function verifyArtifactRefs(repoRoot, artifacts) {
         return false;
     }
     for (const artifact of artifacts) {
-        // Accept absolute paths only when they resolve inside the repo (legacy
-        // envelopes may store abs paths). Prefer relative for new projections.
-        const lexical = path.isAbsolute(artifact.path)
-            ? path.resolve(artifact.path)
-            : path.resolve(canonicalRepoRoot, artifact.path);
+        if (path.isAbsolute(artifact.path))
+            return false;
+        const lexical = path.resolve(canonicalRepoRoot, artifact.path);
         let resolved;
         let content;
         try {

package/dist/worker/observe/routes.js

@@ -13,7 +13,6 @@ import { dagSourceBindingSchema } from "../../workflows/dag/types.js";
 import { getTaskPoolRoot } from "../pool/run-store.js";
 import { isAllowedArtifactTextPath, resolveArtifactPath, resolveRepoFilePreview, toRepoRelativeArtifactPath, } from "./paths.js";
 import { extractSpecEvidence, extractSpecReadContent, } from "./spec-evidence.js";
-import { buildDagNodeInput } from "./node-input.js";
 import { buildObserveHealthV1 } from "./health.js";
 const ARTIFACT_PREVIEW_MAX_BYTES = 64 * 1024;
 export function createObserveSnapshotCache() {
@@ -87,11 +86,6 @@ export const ROUTES = [
         pattern: /^\/api\/dag-runs\/([^/]+)\/nodes\/([^/]+)\/session-events$/,
         handler: handleDagNodeSessionEvents,
     },
-    {
-        method: "GET",
-        pattern: /^\/api\/dag-runs\/([^/]+)\/nodes\/([^/]+)\/input$/,
-        handler: handleDagNodeInput,
-    },
     {
         method: "GET",
         pattern: /^\/api\/dag-runs\/([^/]+)\/nodes\/([^/]+)\/spec-evidence$/,
@@ -461,17 +455,6 @@ async function handleDagRunById(_req, res, match, ctx) {
     }
     sendJson(res, 200, dagRun);
 }
-async function handleDagNodeInput(_req, res, match, ctx) {
-    const dagRunId = match.params.id;
-    const nodeId = match.params.sub;
-    if (!isSafeObservabilityIdentifier(dagRunId) ||
-        !isSafeObservabilityIdentifier(nodeId)) {
-        sendJson(res, 400, { error: "Invalid dag run or node identifier" });
-        return;
-    }
-    const result = await buildDagNodeInput(ctx.repoRoot, dagRunId, nodeId);
-    sendJson(res, result.status, result.body);
-}
 async function handleDagNodeSessionEvents(_req, res, match, ctx) {
     const dagRunId = match.params.id;
     const nodeId = match.params.sub;

package/dist/worker/observe/static/api.js

@@ -29,15 +29,6 @@ export async function fetchJsonResult(url) {
 	}
 }
 
-/**
- * Fetch a dag node input projection. Preserves HTTP status so callers can
- * distinguish missing runs, unavailable nodes, and transport errors.
- */
-export async function fetchDagNodeInput(runId, nodeId) {
-	const url = `/api/dag-runs/${encodeURIComponent(runId)}/nodes/${encodeURIComponent(nodeId)}/input`;
-	return fetchJsonResult(url);
-}
-
 /**
  * Fetch a spec-evidence file preview (binding source or successful read).
  * Resolves to the parsed JSON body, or throws an Error carrying the HTTP

package/dist/worker/observe/static/constants.js

@@ -33,15 +33,6 @@ export const UI_TEXT = {
 	noBatches: "暂无 Worker 批次，运行后将出现在这里。",
 	noNodes: "暂无节点。",
 	noOutput: "暂无节点输出。",
-	noInput: "暂无节点输入。",
-	inputLoading: "正在加载节点输入…",
-	inputUnavailable: "未在冻结 DAG tasks[] 中找到该节点输入。",
-	inputDynamicUnsupported:
-		"该节点为运行时动态展开节点，Phase A 暂不提供完整输入。",
-	inputRunSpecUnavailable: "无法读取冻结 DAG 规格（run.json）。",
-	inputError: "加载节点输入失败。",
-	inputFrozenLabel: "冻结 DAG 节点定义",
-	inputFingerprintNote: "仅保存 assembled prompt 指纹，全文未持久化",
 	noSessionEvents: "该节点暂无过程日志",
 	noArtifacts: "暂无产物记录。",
 	noActiveCommand: "当前没有正在执行的命令。",

package/dist/worker/observe/static/state.js

@@ -34,13 +34,6 @@ export const uiState = {
 	// previous node can never mutate the current node's event cache.
 	sessionEventIdentity: null,
 	sessionEventIdentitySeq: 0,
-	/** Node-input request identity ("<dagRunId>:<nodeId>#<seq>"). */
-	dagNodeInputIdentity: null,
-	dagNodeInputRequestSeq: 0,
-	/** Last successful / in-flight node-input payload for the active identity. */
-	dagNodeInputData: null,
-	dagNodeInputError: null,
-	dagNodeInputLoading: false,
 	/** When true,「执行过程」展开 message_start/end 原始协议事件。 */
 	sessionTimelineShowProtocol: false,
 	/** Open <details> keys restored across timeline re-renders. */
@@ -52,7 +45,6 @@ export const uiState = {
 	dagGraphViewportState: null,
 	dagTimelineViewportState: null,
 	dagNodeOutputViewportState: null,
-	dagNodeInputViewportState: null,
 	runOutputViewportState: null,
 	/**
 	 * Spec-evidence file preview drill-down. null = list view; otherwise
@@ -73,12 +65,6 @@ export function makeSessionEventIdentity(dagRunId, nodeId) {
 	return `${dagRunId}:${nodeId}#${uiState.sessionEventIdentitySeq}`;
 }
 
-/** Build a fresh node-input identity token and bump its sequence. */
-export function makeDagNodeInputIdentity(dagRunId, nodeId) {
-	uiState.dagNodeInputRequestSeq += 1;
-	return `${dagRunId}:${nodeId}#${uiState.dagNodeInputRequestSeq}`;
-}
-
 export function isPageVisible() {
 	return (
 		typeof document === "undefined" || document.visibilityState !== "hidden"