@tea-agent/loop-agent 0.26.0 → 0.26.2

package/dist/workflows/dag/convergence/controller.js

@@ -18,7 +18,14 @@ const DEFAULT_CONVERGENCE_CHAIN_NODE_IDS = [
  */
 const REVIEW_GATE_NODE_ID = "review-gate-shell";
 const REVIEW_VERDICT_NODE_ID = "review-verdict-recovery-pi";
-const CONVERGENCE_NON_RETRY_FAILURES = new Set([
+const INITIAL_REVIEW_NODE_ID = "initial-review-pi";
+const INITIAL_REVIEW_GATE_NODE_ID = "initial-review-gate-shell";
+const INITIAL_REVIEW_PASS_NODE_ID = "initial-review-pass-shell";
+// Automatic code repair is authorized only for an ordinary command/test
+// failure. Unknown, protocol, validation, provider, safety, governance, and
+// human-decision categories all fail closed instead of reaching a writer.
+const HARD_VERIFY_REPAIR_ELIGIBLE_FAILURES = new Set(["nonzero-exit"]);
+const REVIEW_SOURCE_NON_RETRY_FAILURES = new Set([
     "timeout",
     "spawn-error",
     "write-guard",
@@ -26,9 +33,6 @@ const CONVERGENCE_NON_RETRY_FAILURES = new Set([
     "auth",
     "human-rejected",
     "decision-gate-requires-human",
-]);
-const REVIEW_SOURCE_NON_RETRY_FAILURES = new Set([
-    ...CONVERGENCE_NON_RETRY_FAILURES,
     "protocol-invalid",
     "invalid-output",
 ]);
@@ -38,26 +42,61 @@ export function shouldEnableDagConvergence(spec) {
 }
 export async function runConvergencePassController(input) {
     const convergence = input.state.convergence;
-    if (!convergence?.enabled)
+    if (!convergence)
         return { retry: false };
     if (process.env.HARNESS_DAG_CONVERGENCE === "off") {
         convergence.terminalReason = "feature-flag-off";
         return { retry: false };
     }
+    if (!convergence.enabled) {
+        return resolveNoRepairTerminal(input);
+    }
     if (!hasConvergenceChain(input.tasksById, input.spec)) {
         convergence.terminalReason = "unsupported-dag-shape";
         return { retry: false };
     }
     const chain = getConvergenceChain(input.spec);
     const observesReview = chain.includes(REVIEW_GATE_NODE_ID);
+    if (input.tasksById.has(INITIAL_REVIEW_NODE_ID)) {
+        const initialReview = input.state.nodes[INITIAL_REVIEW_NODE_ID];
+        const initialGate = input.state.nodes[INITIAL_REVIEW_GATE_NODE_ID];
+        const initialPass = input.state.nodes[INITIAL_REVIEW_PASS_NODE_ID];
+        if (initialReview?.status === "ERROR" || initialGate?.status === "ERROR") {
+            convergence.terminalReason = "non-retry-failure";
+            return { retry: false };
+        }
+        if (initialPass?.status === "FINISHED" &&
+            parseProcessVerdict(initialReview) === "pass") {
+            convergence.terminalReason = "review-pass";
+            return { retry: false };
+        }
+        const repair = input.state.nodes["repair-pi"];
+        if (convergence.currentPass === 1 &&
+            parseProcessVerdict(initialReview) === "request-revision" &&
+            (repair?.status === "FINISHED" || repair?.status === "ERROR")) {
+            // Pass 1 is the initial review. The first executed repair chain is pass 2,
+            // even though the scheduler completes it before the controller first runs.
+            convergence.currentPass = 2;
+        }
+        if (repair?.status === "ERROR") {
+            convergence.terminalReason = "non-retry-failure";
+            return { retry: false };
+        }
+    }
     const hardVerify = input.state.nodes["hard-verify-shell"];
     if (!hardVerify)
         return { retry: false };
     if (hardVerify.status === "ERROR") {
         return handleHardVerifyFailure(input, hardVerify);
     }
-    if (hardVerify.status !== "FINISHED")
+    if (hardVerify.status !== "FINISHED") {
+        // The scheduler has already settled every ordinary rank before invoking
+        // the controller. PENDING/SKIPPED here therefore means an earlier failure
+        // blocked the convergence chain; record a terminal reason so the deferred
+        // failure-aware closeout remains reachable.
+        convergence.terminalReason = "non-retry-failure";
         return { retry: false };
+    }
     // Hard verification passed. When the chain observes a review gate, success
     // is gated on the review verdict: a legitimate `request-revision` re-enters
     // the same bounded repair-reverify-review loop (AC3/AC4). Non-supervised
@@ -74,6 +113,13 @@ export async function runConvergencePassController(input) {
     const reviewGate = input.state.nodes[REVIEW_GATE_NODE_ID];
     if (!reviewGate)
         return { retry: false };
+    // Well-formed request-revision is a convergence routing result: the review
+    // gate finishes successfully (routingAccept) rather than shell ERROR.
+    // Still re-enter the bounded repair chain when revision evidence is valid.
+    if (reviewGate.status === "FINISHED" &&
+        isLegitimateReviewRequestRevision(input.state)) {
+        return handleReviewRequestRevision(input, reviewGate);
+    }
     if (reviewGate.status === "FINISHED") {
         convergence.terminalReason = "review-pass";
         await appendConvergenceKnowledgePattern({
@@ -82,10 +128,50 @@ export async function runConvergencePassController(input) {
         });
         return { retry: false };
     }
+    // Compatibility: gates without routingAccept still ERROR on revision.
     if (reviewGate.status === "ERROR") {
         return handleReviewRequestRevision(input, reviewGate);
     }
-    // Review gate still PENDING/SKIPPED mid-rank: wait for the next loop.
+    // The scheduler pass is settled; an unexecuted gate is a terminal upstream
+    // blockage, not a reason to leave closeout permanently pending.
+    convergence.terminalReason = "non-retry-failure";
+    return { retry: false };
+}
+/**
+ * `maxFixLoops=0` disables writer re-entry, not terminal adjudication. Review
+ * and hard-verify evidence still decide whether closeout is a truthful success
+ * or a bounded failure. Existing handlers are safe here because maxPasses=1,
+ * so they record the terminal pass without resetting any writer nodes.
+ */
+async function resolveNoRepairTerminal(input) {
+    const convergence = input.state.convergence;
+    const reviewGate = input.state.nodes[REVIEW_GATE_NODE_ID];
+    if (reviewGate) {
+        if (reviewGate.status === "FINISHED" &&
+            isLegitimateReviewRequestRevision(input.state)) {
+            return handleReviewRequestRevision(input, reviewGate);
+        }
+        if (reviewGate.status === "FINISHED") {
+            convergence.terminalReason = "review-pass";
+            return { retry: false };
+        }
+        if (reviewGate.status === "ERROR") {
+            return handleReviewRequestRevision(input, reviewGate);
+        }
+        convergence.terminalReason = "non-retry-failure";
+        return { retry: false };
+    }
+    const hardVerify = input.state.nodes["hard-verify-shell"];
+    if (hardVerify?.status === "ERROR") {
+        return handleHardVerifyFailure(input, hardVerify);
+    }
+    if (hardVerify?.status === "FINISHED") {
+        convergence.terminalReason = "hard-verify-pass";
+        return { retry: false };
+    }
+    convergence.terminalReason = hardVerify
+        ? "non-retry-failure"
+        : "unsupported-dag-shape";
     return { retry: false };
 }
 /**
@@ -104,7 +190,7 @@ async function handleHardVerifyFailure(input, hardVerify) {
         runDir: input.runDir,
         spec: input.spec,
     });
-    if (CONVERGENCE_NON_RETRY_FAILURES.has(hardFailure)) {
+    if (!HARD_VERIFY_REPAIR_ELIGIBLE_FAILURES.has(hardFailure)) {
         passRecord.status = "terminal";
         passRecord.reason = "non-retry-failure";
         convergence.passHistory.push(passRecord);
@@ -145,29 +231,32 @@ async function handleHardVerifyFailure(input, hardVerify) {
     await input.persistState();
     return { retry: true };
 }
+function isLegitimateReviewRequestRevision(state) {
+    const reviewNode = state.nodes["review-pi"];
+    const reviewVerdictNode = state.nodes[REVIEW_VERDICT_NODE_ID];
+    return (reviewNode?.status === "FINISHED" &&
+        parseProcessVerdict(reviewNode) === "request-revision" &&
+        reviewVerdictNode?.status === "FINISHED" &&
+        parseProcessVerdict(reviewVerdictNode) === "request-revision");
+}
 /**
- * Hard verification passed but the review gate blocked closeout with a
- * legitimate `request-revision` (review-gate-shell ERRORs when the verdict is
- * not `pass`). Re-enter the same bounded recovery chain so repair can address
- * the review findings, then re-verify and re-review. Review protocol-invalid
- * and invalid-output sources, plus safety failures such as auth/write-guard,
- * stay fail-closed and never enter code repair.
+ * Hard verification passed but the review path produced a legitimate
+ * `request-revision`. With routingAccept the review gate finishes as a routing
+ * result (not shell ERROR); older gates may still ERROR. Re-enter the same
+ * bounded recovery chain so repair can address the findings, then re-verify
+ * and re-review. Protocol/safety failures stay fail-closed.
  */
 async function handleReviewRequestRevision(input, reviewGate) {
     const convergence = input.state.convergence;
     const currentPass = convergence.currentPass || 1;
     const reviewNode = input.state.nodes["review-pi"];
     const reviewVerdictNode = input.state.nodes[REVIEW_VERDICT_NODE_ID];
-    // The gate commonly reports only nonzero-exit. Inspect the complete review
-    // chain so recovery output cannot launder provider/safety/protocol failures
-    // into automatic code repair.
+    // Inspect the complete review chain so recovery output cannot launder
+    // provider/safety/protocol failures into automatic code repair.
     const reviewFailure = [reviewGate, reviewVerdictNode, reviewNode]
         .map((node) => node?.failureCategory)
         .find((category) => category && REVIEW_SOURCE_NON_RETRY_FAILURES.has(category));
-    const legitimateRequestRevision = reviewNode?.status === "FINISHED" &&
-        parseProcessVerdict(reviewNode) === "request-revision" &&
-        reviewVerdictNode?.status === "FINISHED" &&
-        parseProcessVerdict(reviewVerdictNode) === "request-revision";
+    const legitimateRequestRevision = isLegitimateReviewRequestRevision(input.state);
     if (reviewFailure || !legitimateRequestRevision) {
         const passRecord = await buildConvergencePassRecord({
             pass: currentPass,

package/dist/workflows/dag/frontend-implementation-contract.js

@@ -84,6 +84,7 @@ export function loadFrontendImplementationContractJsonSchema(startDir = path.dir
     return JSON.stringify(parsed);
 }
 const id = z.string().regex(/^(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*$/);
+const REQUIREMENT_ID_PATTERN = /^(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*$/;
 const safePath = z
     .string()
     .min(1)
@@ -366,7 +367,7 @@ export function canonicalFrontendContractSourceBinding(binding) {
             .filter((source) => source.kind === "reference")
             .map((source) => source.path)
             .sort(),
-        requirementIds: [...binding.requirementIds],
+        requirementIds: binding.requirementIds.map(canonicalizeRequirementId),
     };
 }
 function asRecord(value) {
@@ -384,6 +385,137 @@ function asStringArray(value) {
         .map((item) => asString(item))
         .filter((item) => item.length > 0);
 }
+function isRequirementId(value) {
+    return REQUIREMENT_ID_PATTERN.test(value);
+}
+/** Normalize the compact IDs models commonly emit (for example AC1) before
+ * strict schema validation. This keeps governance strict while making the
+ * boundary tolerant of presentation-only formatting differences. */
+function canonicalizeRequirementId(value) {
+    const trimmed = value.trim().toUpperCase();
+    if (REQUIREMENT_ID_PATTERN.test(trimmed))
+        return trimmed;
+    const compact = /^(REQ|BR|AC)(\d+)$/.exec(trimmed);
+    if (compact)
+        return `${compact[1]}-${compact[2]}`;
+    return value;
+}
+function canonicalizeRequirementIdsInPayload(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalizeRequirementIdsInPayload);
+    if (!value || typeof value !== "object")
+        return value;
+    const record = value;
+    const out = {};
+    for (const [key, child] of Object.entries(record)) {
+        if (key === "id" || key === "requirementId") {
+            out[key] = typeof child === "string" ? canonicalizeRequirementId(child) : child;
+        }
+        else if (key === "requirementIds" && Array.isArray(child)) {
+            out[key] = child.map((item) => typeof item === "string" ? canonicalizeRequirementId(item) : item);
+        }
+        else {
+            out[key] = canonicalizeRequirementIdsInPayload(child);
+        }
+    }
+    return out;
+}
+function canonicalizeVerificationTargetAliases(value) {
+    const record = asRecord(value);
+    if (!record || !Array.isArray(record.verificationTargets))
+        return value;
+    const targets = record.verificationTargets
+        .map((item) => asRecord(item))
+        .filter((item) => Boolean(item));
+    const aliases = new Map();
+    for (const target of targets) {
+        const id = asString(target.id);
+        const label = asString(target.commandLabel).toLowerCase();
+        if (!id)
+            continue;
+        aliases.set(id.toLowerCase(), id);
+        if (label.includes("typecheck"))
+            aliases.set("vt-typecheck", id);
+        if (label.includes("unified surface"))
+            aliases.set("vt-unified-surface", id);
+    }
+    const requirements = Array.isArray(record.requirements)
+        ? record.requirements.map((item) => {
+            const requirement = asRecord(item);
+            if (!requirement || !Array.isArray(requirement.verificationTargetIds))
+                return item;
+            return {
+                ...requirement,
+                verificationTargetIds: requirement.verificationTargetIds.map((id) => typeof id === "string" ? aliases.get(id.toLowerCase()) ?? id : id),
+            };
+        })
+        : record.requirements;
+    return { ...record, requirements };
+}
+function assertFrontendContractPathsSafe(value) {
+    const record = asRecord(value);
+    if (!record)
+        return;
+    const pathFields = ["files", "file", "implementationTargets", "fixture", "consumer"];
+    for (const [key, child] of Object.entries(record)) {
+        if (pathFields.includes(key) && Array.isArray(child)) {
+            for (const item of child) {
+                if (typeof item === "string" && (item.startsWith("/") || item.includes("\\") || item.split("/").includes("..")))
+                    throw new Error(`invalid-output: unsafe frontend contract path ${item}`);
+            }
+        }
+        else if (pathFields.includes(key) && typeof child === "string" && (child.startsWith("/") || child.includes("\\") || child.split("/").includes(".."))) {
+            throw new Error(`invalid-output: unsafe frontend contract path ${child}`);
+        }
+        if (Array.isArray(child))
+            child.forEach(assertFrontendContractPathsSafe);
+        else if (child && typeof child === "object")
+            assertFrontendContractPathsSafe(child);
+    }
+}
+function deriveContractRequirementIds(value) {
+    const record = asRecord(value);
+    if (!record)
+        return [];
+    const ids = [];
+    const push = (candidate) => {
+        const value = asString(candidate);
+        const canonical = canonicalizeRequirementId(value);
+        if (!canonical || !isRequirementId(canonical) || ids.includes(canonical))
+            return;
+        ids.push(canonical);
+    };
+    if (Array.isArray(record.requirements)) {
+        for (const item of record.requirements)
+            push(asRecord(item)?.id);
+    }
+    if (Array.isArray(record.requirementCoverage)) {
+        for (const item of record.requirementCoverage)
+            push(asRecord(item)?.id);
+    }
+    const rawVerification = Array.isArray(record.verificationTargets)
+        ? record.verificationTargets
+        : asRecord(record.verificationTargets)
+            ? Object.values(asRecord(record.verificationTargets))
+            : [];
+    for (const item of rawVerification) {
+        for (const requirementId of asStringArray(asRecord(item)?.requirementIds)) {
+            push(requirementId);
+        }
+    }
+    for (const item of Array.isArray(record.evidenceGaps) ? record.evidenceGaps : []) {
+        push(asRecord(item)?.requirementId);
+    }
+    return ids;
+}
+function withDerivedRequirementIdsWhenUnscoped(binding, parsed) {
+    if (binding.requirementIds.length > 0)
+        return binding;
+    const derivedIds = deriveContractRequirementIds(parsed);
+    return derivedIds.length > 0
+        ? { ...binding, requirementIds: derivedIds }
+        : binding;
+}
 function looksLikeStrictFrontendContract(value) {
     const record = asRecord(value);
     if (!record)
@@ -401,6 +533,11 @@ function looksLikeStrictFrontendContract(value) {
  */
 export function coerceFrontendImplementationContractInput(value, canonicalBinding) {
     const rawRecord = asRecord(value);
+    const rawMockApi = asRecord(rawRecord?.mockApi);
+    if (rawMockApi &&
+        typeof rawMockApi.strategy === "string" &&
+        !["native", "browser-intercept", "request-adapter", "not-needed"].includes(rawMockApi.strategy))
+        return value;
     const verificationTargetIds = rawRecord && Array.isArray(rawRecord.verificationTargets)
         ? new Set(rawRecord.verificationTargets
             .map((item) => asString(asRecord(item)?.id))
@@ -414,9 +551,10 @@ export function coerceFrontendImplementationContractInput(value, canonicalBindin
                     const requirement = asRecord(item);
                     if (!requirement || !Array.isArray(requirement.verificationTargetIds))
                         return item;
+                    const filtered = requirement.verificationTargetIds.filter((id) => typeof id === "string" && verificationTargetIds.has(id));
                     return {
                         ...requirement,
-                        verificationTargetIds: requirement.verificationTargetIds.filter((id) => typeof id === "string" && verificationTargetIds.has(id)),
+                        verificationTargetIds: filtered.length > 0 ? filtered : requirement.verificationTargetIds,
                     };
                 })
                 : rawRecord.requirements,
@@ -444,8 +582,39 @@ export function coerceFrontendImplementationContractInput(value, canonicalBindin
                 : rawRecord.uiStates,
         }
         : value;
-    if (looksLikeStrictFrontendContract(normalizedValue))
-        return normalizedValue;
+    // A payload can have the strict top-level shape while still containing
+    // empty requirement coverage arrays. Do not trust shape alone: route such
+    // payloads through the compatibility normalizer so targets and verification
+    // references are deterministically filled from the contract context.
+    if (looksLikeStrictFrontendContract(normalizedValue)) {
+        const strictRecord = asRecord(normalizedValue);
+        const strictMockApi = asRecord(strictRecord?.mockApi);
+        if (strictMockApi &&
+            typeof strictMockApi.strategy === "string" &&
+            !["native", "browser-intercept", "request-adapter", "not-needed"].includes(strictMockApi.strategy))
+            return normalizedValue;
+        const targetFiles = asStringArray(asRecord(strictRecord?.targets)?.files);
+        const verificationIds = Array.isArray(strictRecord?.verificationTargets)
+            ? strictRecord.verificationTargets.map((item) => asString(asRecord(item)?.id)).filter(Boolean)
+            : [];
+        if (Array.isArray(strictRecord?.requirements)) {
+            const requirements = strictRecord.requirements.map((item) => {
+                const requirement = asRecord(item);
+                if (!requirement)
+                    return item;
+                return {
+                    ...requirement,
+                    implementationTargets: asStringArray(requirement.implementationTargets).length > 0
+                        ? requirement.implementationTargets
+                        : targetFiles,
+                    verificationTargetIds: asStringArray(requirement.verificationTargetIds).length > 0
+                        ? requirement.verificationTargetIds
+                        : verificationIds,
+                };
+            });
+            return { ...strictRecord, requirements };
+        }
+    }
     const record = asRecord(normalizedValue);
     if (!record)
         return value;
@@ -729,8 +898,15 @@ export async function materializeFrontendImplementationContract(input) {
         throw new Error("frontend implementation contract gate requires DAG sourceBinding");
     const record = JSON.parse(await readFile(path.join(input.runDir, `${input.fromNodeId}.json`), "utf8"));
     let parsed;
+    const rawContractText = record.assistantText?.trim() || record.stdout?.trim() || "";
+    if (rawContractText.includes('"files":["/'))
+        throw new Error("invalid-output: absolute frontend contract path is forbidden");
+    if (/(?:"(?:files|file|implementationTargets|fixture|consumer)"\s*:\s*(?:\[\s*)?)"\//.test(rawContractText))
+        throw new Error("invalid-output: absolute frontend contract path is forbidden");
+    if (/(?:"strategy"\s*:\s*")(?!native\b|browser-intercept\b|request-adapter\b|not-needed\b)[^"]+"/.test(rawContractText))
+        throw new Error("invalid-output: unsupported mock strategy");
     try {
-        parsed = extractFrontendImplementationJson(record.assistantText?.trim() || record.stdout?.trim() || "");
+        parsed = extractFrontendImplementationJson(rawContractText);
     }
     catch (error) {
         throw new Error(`invalid-output: ${error instanceof Error ? error.message : String(error)}`);
@@ -740,21 +916,46 @@ export async function materializeFrontendImplementationContract(input) {
         throw new Error(`invalid-output: ${secrets.join("; ")}`);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
         throw new Error("invalid-output: frontend contract must be a JSON object");
-    const canonicalBinding = canonicalFrontendContractSourceBinding(input.sourceBinding);
+    const parsedTargetObject = parsed.targets;
+    const parsedFiles = parsedTargetObject && typeof parsedTargetObject === "object"
+        ? parsedTargetObject.files
+        : undefined;
+    if (Array.isArray(parsedFiles) && parsedFiles.some((file) => typeof file === "string" && file.startsWith("/")))
+        throw new Error("invalid-output: absolute frontend contract path is forbidden");
+    // Normalize model-emitted compact requirement IDs before deriving the
+    // canonical binding or invoking the strict zod schema.
+    parsed = canonicalizeRequirementIdsInPayload(parsed);
+    parsed = canonicalizeVerificationTargetAliases(parsed);
+    assertFrontendContractPathsSafe(parsed);
+    const parsedTargets = asRecord(parsed)?.targets;
+    const parsedTargetFiles = asStringArray(asRecord(parsedTargets)?.files);
+    if (parsedTargetFiles.some((file) => file.startsWith("/") || file.includes("\\")))
+        throw new Error("invalid-output: frontend contract target paths must be relative POSIX paths");
+    const parsedStates = asRecord(parsed)?.uiStates;
+    if (Array.isArray(parsedStates) && parsedStates.some((item) => {
+        const state = asRecord(item);
+        return state?.applicable === true &&
+            (!asString(state.expectedBehavior) || asStringArray(state.implementationTargets).length === 0 || asStringArray(state.verificationTargetIds).length === 0);
+    }))
+        throw new Error("invalid-output: applicable UI state requires behavior, implementation, and verification");
+    const parsedMockApi = asRecord(parsed)?.mockApi;
+    if (asRecord(parsedMockApi) &&
+        typeof asRecord(parsedMockApi)?.strategy === "string" &&
+        !["native", "browser-intercept", "request-adapter", "not-needed"].includes(String(asRecord(parsedMockApi)?.strategy)))
+        throw new Error(`invalid-output: unsupported mock strategy ${String(asRecord(parsedMockApi)?.strategy)}`);
+    const baseCanonicalBinding = canonicalFrontendContractSourceBinding(input.sourceBinding);
+    const canonicalBinding = withDerivedRequirementIdsWhenUnscoped(baseCanonicalBinding, parsed);
     // Always inject DAG-owned identity. Model-provided sourceBinding is advisory
     // only and must not fail a otherwise-valid contract (common live failure:
     // wrong requirementPath/sha, extra referencePaths, or omitted binding).
-    const candidates = [
-        {
-            ...parsed,
-            sourceBinding: canonicalBinding,
-        },
-        coerceFrontendImplementationContractInput(parsed, canonicalBinding),
-    ];
-    let result = frontendImplementationContractSchema.safeParse(candidates[0]);
-    if (!result.success) {
-        result = frontendImplementationContractSchema.safeParse(candidates[1]);
-    }
+    const normalizedContract = coerceFrontendImplementationContractInput(parsed, canonicalBinding);
+    // There is exactly one post-security candidate. A fallback candidate would
+    // allow malformed raw fields to bypass the boundary checks above.
+    const candidate = {
+        ...(asRecord(normalizedContract) ?? parsed),
+        sourceBinding: canonicalBinding,
+    };
+    const result = frontendImplementationContractSchema.safeParse(candidate);
     if (!result.success)
         throw new Error(`invalid-output: ${result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`);
     const blockingGaps = [

package/dist/workflows/dag/frontend-review-context.js

@@ -76,8 +76,14 @@ function assertReviewEvidence(input) {
         throw new Error("frontend review context invalid repair assessment");
 }
 export async function runFrontendReviewContextGate(input) {
-    const diff = await runFrontendWorktreeDiffGate(input);
     const contract = await readRequiredJson(input.runDir, "contracts/frontend-implementation-contract.json");
+    const parsedContract = frontendImplementationContractSchema.safeParse(contract);
+    if (!parsedContract.success)
+        throw new Error("frontend review context invalid implementation contract");
+    const diff = await runFrontendWorktreeDiffGate({
+        ...input,
+        authorizedChangedPaths: parsedContract.data.targets.files,
+    });
     const verificationTrace = await readRequiredJson(input.runDir, "contracts/frontend-verification-trace.json");
     const repairAssessment = await readRequiredJson(input.runDir, "contracts/frontend-repair-assessment.json");
     const lintAssessment = await readOptionalLintAssessment(input.runDir);

package/dist/workflows/dag/frontend-verification-trace.js

@@ -30,6 +30,8 @@ function symbolEvidenceCandidates(symbol) {
     const normalized = symbol.trim().toLowerCase();
     if (normalized === "all describe blocks")
         return ["describe("];
+    // A legacy contract may encode several symbols plus prose in one label.
+    // Validate the actual slash-delimited symbols individually.
     const describeTitle = symbol.match(/^describe\((?:['"])(.+?)(?:['"])/i)?.[1];
     if (describeTitle)
         return [symbol, describeTitle, "describe("];
@@ -58,9 +60,18 @@ async function assertFileAndSymbol(input) {
     }
     if (input.symbol) {
         const content = await readFile(absolute, "utf8");
-        const matched = symbolEvidenceCandidates(input.symbol).some((candidate) => content.includes(candidate));
-        if (!matched) {
-            issues.push(`symbol not found: ${input.symbol} in ${input.file}`);
+        const symbols = input.symbol.includes(" / ")
+            ? input.symbol
+                .split(/[（(]/, 1)[0]
+                .split("/")
+                .map((symbol) => symbol.trim())
+                .filter(Boolean)
+            : [input.symbol];
+        for (const symbol of symbols) {
+            const matched = symbolEvidenceCandidates(symbol).some((candidate) => content.includes(candidate));
+            if (!matched) {
+                issues.push(`symbol not found: ${symbol} in ${input.file}`);
+            }
         }
     }
     return issues;

package/dist/workflows/dag/frontend-worktree-diff.js

@@ -3,6 +3,7 @@ import { spawn } from "node:child_process";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { writeDagRunJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
+import { pathMatchesPattern } from "../../shared/git-progress.js";
 export const FRONTEND_WORKTREE_DIFF_SCHEMA_ID = "frontend-worktree-diff-v1";
 export const FRONTEND_WORKTREE_BASELINE_SCHEMA_ID = "frontend-worktree-baseline-v1";
 function runGit(cwd, args) {
@@ -128,17 +129,27 @@ export async function runFrontendWorktreeDiffGate(input) {
     }
     const changedFilesAll = splitLines(nameOnly.stdout).sort();
     const untrackedFilesAll = splitLines(untracked.stdout).sort();
+    const authorizedChangedPaths = input.authorizedChangedPaths ?? [];
     if (baseline) {
         for (const file of baseline.files) {
             const currentHash = await sha256File(path.join(root, file));
-            if (currentHash !== baseline.hashes[file]) {
+            const authorizedOverlap = authorizedChangedPaths.some((pattern) => pathMatchesPattern(file, pattern));
+            if (currentHash !== baseline.hashes[file] && !authorizedOverlap) {
                 throw new Error(`frontend worktree diff overlaps pre-existing change: ${file}`);
             }
         }
     }
     const baselineFiles = new Set(baseline?.files ?? []);
-    const changedFiles = changedFilesAll.filter((file) => !baselineFiles.has(file));
-    const untrackedFiles = untrackedFilesAll.filter((file) => !baselineFiles.has(file));
+    const changedFiles = changedFilesAll.filter((file) => {
+        if (!baselineFiles.has(file))
+            return true;
+        return authorizedChangedPaths.some((pattern) => pathMatchesPattern(file, pattern));
+    });
+    const untrackedFiles = untrackedFilesAll.filter((file) => {
+        if (!baselineFiles.has(file))
+            return true;
+        return authorizedChangedPaths.some((pattern) => pathMatchesPattern(file, pattern));
+    });
     const patchSource = baseline
         ? changedFiles.length > 0
             ? await runGit(root, ["diff", "--binary", "HEAD", "--", ...changedFiles])