@tea-agent/loop-agent 0.26.0 → 0.26.2

package/dist/workflows/dag/runner.js

@@ -20,7 +20,7 @@ import { relocateConvergenceArtifactPaths, relocateRunArtifactPaths, } from "./u
 import { createSkillSnapshot, prepareSkillSnapshotForContinuation, writeSkillSnapshot, } from "./skill-snapshot.js";
 import { captureWorkspaceCheckpoint, WORKSPACE_CHECKPOINT_START_REL, WORKSPACE_CHECKPOINT_TERMINAL_REL, writeWorkspaceCheckpoint, } from "./workspace-checkpoint.js";
 import { buildNodePrompt, buildNodePromptWithResolvedSkillInstructions, executeDagNode, } from "./node-execution.js";
-import { runConvergencePassController, shouldEnableDagConvergence, } from "./convergence/controller.js";
+import { runConvergencePassController, } from "./convergence/controller.js";
 import { executeDagRanksOnce, isConditionSkippedReason } from "./scheduler.js";
 import { topoSortToRanks } from "./topo.js";
 import { parseDagSpec, resolveModelForTask, } from "./types.js";
@@ -142,11 +142,11 @@ export function createInitialRunState(spec, opts, ranks, runId = opts.runId ?? "
         ranks,
         nodes,
         ...(spec.evaluation ? { evaluation: { ...spec.evaluation } } : {}),
-        ...(shouldEnableDagConvergence(spec)
+        ...(spec.convergence
             ? {
                 convergence: {
-                    enabled: true,
-                    maxPasses: Math.max(1, spec.convergence?.maxPasses ?? 3),
+                    enabled: spec.convergence.enabled === true,
+                    maxPasses: Math.max(1, spec.convergence.maxPasses ?? 3),
                     currentPass: 1,
                     passHistory: [],
                 },
@@ -186,7 +186,7 @@ export async function runDag(spec, opts) {
     // Candidate identity is validated before run-id allocation or directory creation.
     await assertEvaluationBindingPreflight(opts.cwd, spec.evaluation);
     // Phase 0.5: new writer execution requires DagSpec v4 + live taskContractBinding match.
-    const { assertDagSpecAllowsNewWriterExecution, assertTaskContractBindingConsistent } = await import("./task-contract-binding.js");
+    const { assertDagSpecAllowsNewWriterExecution, assertTaskContractBindingConsistent, } = await import("./task-contract-binding.js");
     assertDagSpecAllowsNewWriterExecution(spec);
     await assertTaskContractBindingConsistent({ repoRoot: opts.cwd, spec });
     const runningIdentity = resolveRunningControllerIdentity();
@@ -323,7 +323,7 @@ export async function resumeDagRun(opts) {
     assertFrozenEvaluationBinding(spec, state);
     assertFrozenBudget(spec.budget, state.budget, state.runId);
     // Phase 0.5: refuse resume of pre-v4 writer DAGs; revalidate live binding.
-    const { assertDagSpecAllowsNewWriterExecution, assertTaskContractBindingConsistent } = await import("./task-contract-binding.js");
+    const { assertDagSpecAllowsNewWriterExecution, assertTaskContractBindingConsistent, } = await import("./task-contract-binding.js");
     assertDagSpecAllowsNewWriterExecution(spec);
     await assertTaskContractBindingConsistent({ repoRoot: opts.cwd, spec });
     // Runtime contract + controller identity must be re-verified before executing
@@ -472,52 +472,63 @@ async function executeDagCheckpoint(input) {
                 runDir: dynamicInput.runDir,
             });
         };
-        let pausedByNodeId;
-        while (true) {
-            pausedByNodeId = await executeDagRanksOnce({
-                state,
-                ranks,
+        const deferTerminalCloseout = state.convergence !== undefined && tasksById.has("closeout-pi");
+        const convergenceRanks = deferTerminalCloseout
+            ? ranks
+                .map((rank) => rank.filter((nodeId) => nodeId !== "closeout-pi"))
+                .filter((rank) => rank.length > 0)
+            : ranks;
+        const terminalCloseoutRanks = deferTerminalCloseout
+            ? ranks
+                .map((rank) => rank.filter((nodeId) => nodeId === "closeout-pi"))
+                .filter((rank) => rank.length > 0)
+            : [];
+        const executeRanks = (selectedRanks) => executeDagRanksOnce({
+            state,
+            ranks: selectedRanks,
+            tasksById,
+            maxConcurrent,
+            persistState,
+            createExecuteNodeForRank: (rankWriterNodeIds) => buildRankAwareExecuteNode({
+                baseExecuteNode,
+                customExecuteNode: input.executeNode,
+                rankWriterNodeIds,
                 tasksById,
-                maxConcurrent,
-                persistState,
-                createExecuteNodeForRank: (rankWriterNodeIds) => buildRankAwareExecuteNode({
-                    baseExecuteNode,
-                    customExecuteNode: input.executeNode,
-                    rankWriterNodeIds,
+                meta: { runDir, runId: state.runId, spec },
+            }),
+            executeScheduledNode: async (nodeId, executeNode, onPause) => {
+                if (isHardBudgetBreached(state.budgetLedger))
+                    return;
+                const preBreach = preflightBudgetOrBreach(state);
+                if (preBreach && isHardBudgetBreached(state.budgetLedger)) {
+                    await writeBudgetLedgerArtifacts(runDir, state.budgetLedger);
+                    await persistState();
+                    return;
+                }
+                await executeDagNode({
+                    nodeId,
                     tasksById,
-                    meta: { runDir, runId: state.runId, spec },
-                }),
-                executeScheduledNode: async (nodeId, executeNode, onPause) => {
-                    if (isHardBudgetBreached(state.budgetLedger))
-                        return;
-                    const preBreach = preflightBudgetOrBreach(state);
-                    if (preBreach && isHardBudgetBreached(state.budgetLedger)) {
-                        await writeBudgetLedgerArtifacts(runDir, state.budgetLedger);
-                        await persistState();
-                        return;
-                    }
-                    await executeDagNode({
-                        nodeId,
-                        tasksById,
-                        state,
-                        spec,
-                        cwd,
-                        runDir,
-                        executeNode,
-                        executeDynamicNode,
-                        observer: input.observer,
-                        persistState,
-                        onPause,
-                    });
-                    const node = state.nodes[nodeId];
-                    if (node &&
-                        (node.status === "FINISHED" || node.status === "ERROR")) {
-                        recordFinishedNodeBudget(state, node);
-                        await writeBudgetLedgerArtifacts(runDir, state.budgetLedger);
-                        await persistState();
-                    }
-                },
-            });
+                    state,
+                    spec,
+                    cwd,
+                    runDir,
+                    executeNode,
+                    executeDynamicNode,
+                    observer: input.observer,
+                    persistState,
+                    onPause,
+                });
+                const node = state.nodes[nodeId];
+                if (node && (node.status === "FINISHED" || node.status === "ERROR")) {
+                    recordFinishedNodeBudget(state, node);
+                    await writeBudgetLedgerArtifacts(runDir, state.budgetLedger);
+                    await persistState();
+                }
+            },
+        });
+        let pausedByNodeId;
+        while (true) {
+            pausedByNodeId = await executeRanks(convergenceRanks);
             if (pausedByNodeId) {
                 break;
             }
@@ -541,6 +552,16 @@ async function executeDagCheckpoint(input) {
             }
             break;
         }
+        if (!pausedByNodeId &&
+            terminalCloseoutRanks.length > 0 &&
+            state.convergence?.terminalReason &&
+            !isHardBudgetBreached(state.budgetLedger)) {
+            // Convergence closeout is a terminal phase, not an ordinary descendant
+            // rank. Running it only after the controller records terminalReason avoids
+            // stale success handoffs on intermediate request-revision passes while
+            // still producing a truthful failure handoff for max-passes/non-retry.
+            pausedByNodeId = await executeRanks(terminalCloseoutRanks);
+        }
         // Stop heartbeats before terminal archive. A late heartbeat writing
         // state.json under completed/ trips the completed-facts write guard and
         // makes run-dag exit non-zero after every node already finished.
@@ -599,11 +620,79 @@ async function notifyRunObserver(observer, event, state) {
         // Observers are derived views; they must not affect canonical DAG execution.
     }
 }
+const SUCCESSFUL_CONVERGENCE_TERMINAL_REASONS = new Set([
+    "review-pass",
+    "hard-verify-pass",
+]);
+/**
+ * Intermediate soft-verify failures may be excluded from terminal error
+ * aggregation only when repair + final hard verify succeeded and, when a review
+ * gate is present, convergence ended in review-pass. Historical node status is
+ * never rewritten.
+ */
+function collectSupersededIntermediateFailures(state) {
+    const supersededIds = new Set();
+    const supersededFailures = [];
+    const soft = state.nodes["soft-verify-shell"];
+    if (!soft || soft.status !== "ERROR") {
+        return { supersededIds, supersededFailures };
+    }
+    const repair = state.nodes["repair-pi"];
+    const hard = state.nodes["hard-verify-shell"];
+    if (repair?.status !== "FINISHED" || hard?.status !== "FINISHED") {
+        return { supersededIds, supersededFailures };
+    }
+    const observesReview = Boolean(state.nodes["review-gate-shell"]);
+    const terminalReason = state.convergence?.terminalReason;
+    if (observesReview) {
+        if (terminalReason !== "review-pass") {
+            return { supersededIds, supersededFailures };
+        }
+    }
+    else if (terminalReason && terminalReason !== "hard-verify-pass") {
+        return { supersededIds, supersededFailures };
+    }
+    // Evidence: at least one successful repair pass after soft failure, with hard verify finished in terminal state.
+    const hasRepairEvidence = !state.convergence?.enabled ||
+        state.convergence.passHistory.some((pass) => pass.reason === "hard-verify-failed" ||
+            pass.reason === "review-request-revision" ||
+            pass.status === "retrying") ||
+        repair.status === "FINISHED";
+    if (!hasRepairEvidence) {
+        return { supersededIds, supersededFailures };
+    }
+    supersededIds.add("soft-verify-shell");
+    supersededFailures.push({
+        nodeId: "soft-verify-shell",
+        preservedStatus: "ERROR",
+        supersededBy: ["repair-pi", "hard-verify-shell"],
+        pass: state.convergence?.currentPass,
+        reason: "intermediate-soft-verify-covered-by-repair-and-final-hard",
+    });
+    return { supersededIds, supersededFailures };
+}
+function isSuccessfulConvergenceTerminal(state) {
+    const reason = state.convergence?.terminalReason;
+    if (!reason)
+        return true;
+    return SUCCESSFUL_CONVERGENCE_TERMINAL_REASONS.has(reason);
+}
 function finalizeTerminalRunStatus(state, taskCount) {
     const finishedCount = Object.values(state.nodes).filter((n) => n.status === "FINISHED").length;
-    const errorCount = Object.values(state.nodes).filter((n) => n.status === "ERROR").length;
+    const { supersededIds, supersededFailures } = collectSupersededIntermediateFailures(state);
+    if (state.convergence && supersededFailures.length > 0) {
+        state.convergence.supersededFailures = supersededFailures;
+    }
+    // Prefer map keys: DagNodeRecord may not always mirror the map key on `.id`.
+    const effectiveErrorCount = Object.entries(state.nodes).filter(([nodeId, n]) => n.status === "ERROR" && !supersededIds.has(nodeId)).length;
+    const supersededErrorCount = Object.entries(state.nodes).filter(([nodeId, n]) => n.status === "ERROR" && supersededIds.has(nodeId)).length;
     const conditionSkippedCount = Object.values(state.nodes).filter((n) => n.status === "SKIPPED" && isConditionSkippedReason(n.skippedReason)).length;
-    if (errorCount === 0 && finishedCount + conditionSkippedCount === taskCount) {
+    const successTerminal = isSuccessfulConvergenceTerminal(state);
+    // Superseded intermediate ERRORs remain ERROR in history but count as settled
+    // for terminal aggregation only (they do not inflate effectiveErrorCount).
+    if (effectiveErrorCount === 0 &&
+        successTerminal &&
+        finishedCount + conditionSkippedCount + supersededErrorCount === taskCount) {
         state.status = "finished";
     }
     else if (finishedCount > 0) {

package/dist/workflows/dag/types.js

@@ -79,6 +79,8 @@ export const dagVerdictGateSchema = z.object({
         .regex(/^[a-z][a-z0-9-]*$/, "fallbackFromNodeIds must be kebab-case"))
         .optional(),
     accept: z.array(z.string().min(1)).min(1),
+    routingAccept: z.array(z.string().min(1)).optional(),
+    source: z.enum(["verdict-line", "json-review-verdict"]).optional(),
     lineMode: z.enum(["first-non-empty", "first-verdict-line"]).optional(),
     label: z.string().min(1).optional(),
 });
@@ -311,6 +313,8 @@ export const dagBackendTestPipelineSchema = z.enum([
     "classification-result-context",
     "markdown-environment",
     "markdown-cases",
+    "markdown-collection-assess",
+    "markdown-collection-effective",
     "markdown-traceability",
     "markdown-execute-html",
     "markdown-manifest",

package/dist/workflows/dag/validate.js

@@ -235,7 +235,8 @@ function validateRepairArtifactGateConfig(task, spec, issues) {
         candidate.role === "reviewer" &&
         !candidate.decisionGate?.enabled &&
         candidate.writePolicy === "read-only" &&
-        (candidate.outputContract?.includes("VERDICT:") ?? false) &&
+        ((candidate.outputContract?.includes("VERDICT:") ?? false) ||
+            candidate.outputProtocol?.type === "json-review-verdict") &&
         // Format recovery / write-set format-repair nodes also emit VERDICT but
         // are not the primary content review after hard verification.
         !/(?:-format-repair-pi|-verdict-recovery-pi)$/.test(candidate.id));
@@ -243,7 +244,7 @@ function validateRepairArtifactGateConfig(task, spec, issues) {
         issues.push({
             type: "invalid-repair-artifact-gate-config",
             message: reviewCandidates.length === 0
-                ? `task ${task.id} hard verification node "${hardVerify.id}" must reach one read-only Pi reviewer with a VERDICT output contract`
+                ? `task ${task.id} hard verification node "${hardVerify.id}" must reach one read-only Pi reviewer with a VERDICT or JSON review output contract`
                 : `task ${task.id} hard verification node "${hardVerify.id}" has multiple Pi reviewer nodes (${reviewCandidates.map((candidate) => candidate.id).join(", ")})`,
         });
     }

package/docs/skills/README.md

@@ -1,7 +1,7 @@
-# Skill Registry
-
-This directory records repo-local skill wrappers and vetting notes used by Agent DAG role mapping.
-
-- `vetted-skill-registry.md` — supported roles, source inspiration, risk notes, and default/optional usage.
-- `../../skills/agent-worker/SKILL.md` — optional outer-loop operator skill for Feature Packet, TaskSpec, Task Pool, controller pinning, self-hosting canaries, and Worker recovery. Single DAG implementation or runtime repair stays with `loop-agent`; this skill is not a default DAG role skill.
-- `../../scripts/check-skill-entry.sh` — validates both public skill entries, their required references, line budgets, and the `agent-worker` trigger vocabulary.
+# Skill Registry
+
+This directory records repo-local skill wrappers and vetting notes used by Agent DAG role mapping.
+
+- `vetted-skill-registry.md` — supported roles, source inspiration, risk notes, and default/optional usage.
+- `../../skills/agent-worker/SKILL.md` — optional outer-loop operator skill for Feature Packet, TaskSpec, Task Pool, controller pinning, self-hosting canaries, and Worker recovery. Single DAG implementation or runtime repair stays with `loop-agent`; this skill is not a default DAG role skill.
+- `../../scripts/check-skill-entry.sh` — validates both public skill entries, their required references, line budgets, and the `agent-worker` trigger vocabulary.

package/docs/templates/adr.md

@@ -1,60 +1,60 @@
-# ADR 模板
-
-## 标题
-
-> 建议文件名：`0001-<topic>.md`
-
-## 状态
-
-- proposed / accepted / superseded
-
-## 背景
-
-- 当前遇到的工程或架构问题是什么？
-- 为什么现在必须做决定？
-- 相关上下文、历史方案、约束有哪些？
-
-## 决策
-
-- 最终选择什么方案？
-- 明确边界、适用范围、默认行为是什么？
-
-## 备选方案
-
-1. 方案 A：
-2. 方案 B：
-3. 方案 C：
-
-## 取舍理由
-
-- 为什么选择当前方案？
-- 为什么不选其他方案？
-- 主要 trade-off 是什么？
-
-## 影响范围
-
-- 影响的代码目录：
-- 影响的文档/契约：
-- 影响的测试/脚本：
-- 影响的开发流程/harness：
-
-## 后果
-
-### 正面后果
-
-- 
-
-### 负面后果 / 成本
-
-- 
-
-## 验证与落地
-
-- 需要补哪些实现、脚本或测试：
-- 如何验证决策已经生效：
-
-## 复审条件
-
-当出现以下情况时，建议重新审视本 ADR：
-
-- 
+# ADR 模板
+
+## 标题
+
+> 建议文件名：`0001-<topic>.md`
+
+## 状态
+
+- proposed / accepted / superseded
+
+## 背景
+
+- 当前遇到的工程或架构问题是什么？
+- 为什么现在必须做决定？
+- 相关上下文、历史方案、约束有哪些？
+
+## 决策
+
+- 最终选择什么方案？
+- 明确边界、适用范围、默认行为是什么？
+
+## 备选方案
+
+1. 方案 A：
+2. 方案 B：
+3. 方案 C：
+
+## 取舍理由
+
+- 为什么选择当前方案？
+- 为什么不选其他方案？
+- 主要 trade-off 是什么？
+
+## 影响范围
+
+- 影响的代码目录：
+- 影响的文档/契约：
+- 影响的测试/脚本：
+- 影响的开发流程/harness：
+
+## 后果
+
+### 正面后果
+
+- 
+
+### 负面后果 / 成本
+
+- 
+
+## 验证与落地
+
+- 需要补哪些实现、脚本或测试：
+- 如何验证决策已经生效：
+
+## 复审条件
+
+当出现以下情况时，建议重新审视本 ADR：
+
+- 

package/docs/templates/agent-dag-authority-surface-audit.prompt.md

@@ -1,94 +1,94 @@
-# Agent DAG Authority Surface Audit Prompt Template
-
-## Purpose
-
-Use this prompt for a read-only **authority surface verifier** node: `executor: "pi"`, `role: "verifier"`, `writePolicy: "read-only"`. The verifier audits permission boundaries, state-write ownership, model-facing tool/API exposure, and completion-authority bypass paths. Downstream `authority-surface-gate-shell` uses `shell.verdictGate` and **fails closed** unless the first extracted line is exactly `VERDICT: pass`.
-
-Do **not** create `executor: authority` or any new executor type. Authority audit is a template / quality gate only.
-
-## Recommended DAG Node Shape
-
-```json
-{
-  "id": "authority-surface-audit-pi",
-  "depends_on": ["hard-verify-shell"],
-  "complexity": "HIGH",
-  "executor": "pi",
-  "role": "verifier",
-  "writePolicy": "read-only",
-  "allowedPaths": ["**"],
-  "forbiddenPaths": [".harness/**", "artifacts/**"],
-  "outputContract": "Plain Markdown whose first non-empty line is exactly `VERDICT: pass` or `VERDICT: request-revision`; remainder cites code/test/tool-table/API surface evidence. No file writes.",
-  "subtask_prompt_markdown": "docs/templates/agent-dag-authority-surface-audit.prompt.md"
-}
-```
-
-Pair with a deterministic gate:
-
-```json
-{
-  "id": "authority-surface-gate-shell",
-  "depends_on": ["authority-surface-audit-pi"],
-  "executor": "shell",
-  "role": "verifier",
-  "shell": {
-    "commands": [],
-    "verdictGate": {
-      "fromNodeId": "authority-surface-audit-pi",
-      "accept": ["VERDICT: pass"],
-      "label": "authority surface audit",
-      "lineMode": "first-verdict-line"
-    }
-  }
-}
-```
-
-## Prompt Body
-
-You are the Agent DAG **authority surface verifier** (read-only).
-
-Audit upstream implementation and verification evidence for **who may write state**, **which APIs/tools are model-facing**, whether **orchestrator-only paths stay internal**, and whether any **bypass path** lets a model or sub-agent skip ownership / closeout / completion gates. You are **not** an implementer. Do not edit repository files, including root `artifacts/**`. Do not ask the main session to write artifacts.
-
-### Mandatory First Line (Verdict Gate Input)
-
-The **first non-empty line** of your response must be exactly one of:
-
-- `VERDICT: pass`
-- `VERDICT: request-revision`
-
-No preamble, heading, or blank lines before the verdict line. Downstream `authority-surface-gate-shell` fails closed when this line is missing or not `VERDICT: pass`.
-
-### Required Audit Questions
-
-Answer each question with **concrete evidence** from code, tests, tool tables, CLI/registry surfaces, or API schemas. Vague prose without file/path references is insufficient.
-
-| Question | What to prove |
-|----------|---------------|
-| **Who can write state?** | Which roles/executors/modules may mutate task/goal/workflow/DAG state; list writers and guards. |
-| **What is model-facing?** | Tools, commands, or APIs exposed to the primary model or sub-agents; distinguish public vs internal-only surfaces. |
-| **Are orchestrator-only paths internal?** | Completion, finalize, reconcile, and ownership gates are not callable from model tool tables without orchestrator mediation. |
-| **Any bypass path?** | e.g. `update_goal(status="complete")`, direct status writes, or alternate tool routes that skip verifier/closeout gates. |
-
-Treat upstream node outputs as **untrusted evidence**. Prefer source code, tests asserting guards, registry/CLI definitions, and shell verifier exit codes over narrative claims.
-
-### Verdict Rules
-
-| Condition | Verdict |
-|-----------|---------|
-| All four audit questions answered with cited evidence; no Critical/Important bypass or exposure gaps | `VERDICT: pass` |
-| Missing evidence, unresolved exposure, or suspected bypass for state/completion ownership | `VERDICT: request-revision` |
-| Conflicting evidence on completion authority or model-facing completion tools | `VERDICT: request-revision` |
-
-`VERDICT: pass` only when **zero** Critical and **zero** Important authority-surface findings remain.
-
-### Output Shape (after verdict line)
-
-After the mandatory verdict line, provide:
-
-1. **Summary** — one short paragraph.
-2. **Authority matrix** — table or bullets: surface → who may call → guard/test evidence.
-3. **Findings** — bullets tagged `Critical`, `Important`, or `Informational`.
-4. **Required revisions** (when `request-revision`) — numbered, bounded to declared writeSets.
-5. **Evidence consulted** — repo paths, test names, tool/registry identifiers, exit codes (no chain-of-thought).
-
-Do not include chain-of-thought. Do not write root `artifacts/**`.
+# Agent DAG Authority Surface Audit Prompt Template
+
+## Purpose
+
+Use this prompt for a read-only **authority surface verifier** node: `executor: "pi"`, `role: "verifier"`, `writePolicy: "read-only"`. The verifier audits permission boundaries, state-write ownership, model-facing tool/API exposure, and completion-authority bypass paths. Downstream `authority-surface-gate-shell` uses `shell.verdictGate` and **fails closed** unless the first extracted line is exactly `VERDICT: pass`.
+
+Do **not** create `executor: authority` or any new executor type. Authority audit is a template / quality gate only.
+
+## Recommended DAG Node Shape
+
+```json
+{
+  "id": "authority-surface-audit-pi",
+  "depends_on": ["hard-verify-shell"],
+  "complexity": "HIGH",
+  "executor": "pi",
+  "role": "verifier",
+  "writePolicy": "read-only",
+  "allowedPaths": ["**"],
+  "forbiddenPaths": [".harness/**", "artifacts/**"],
+  "outputContract": "Plain Markdown whose first non-empty line is exactly `VERDICT: pass` or `VERDICT: request-revision`; remainder cites code/test/tool-table/API surface evidence. No file writes.",
+  "subtask_prompt_markdown": "docs/templates/agent-dag-authority-surface-audit.prompt.md"
+}
+```
+
+Pair with a deterministic gate:
+
+```json
+{
+  "id": "authority-surface-gate-shell",
+  "depends_on": ["authority-surface-audit-pi"],
+  "executor": "shell",
+  "role": "verifier",
+  "shell": {
+    "commands": [],
+    "verdictGate": {
+      "fromNodeId": "authority-surface-audit-pi",
+      "accept": ["VERDICT: pass"],
+      "label": "authority surface audit",
+      "lineMode": "first-verdict-line"
+    }
+  }
+}
+```
+
+## Prompt Body
+
+You are the Agent DAG **authority surface verifier** (read-only).
+
+Audit upstream implementation and verification evidence for **who may write state**, **which APIs/tools are model-facing**, whether **orchestrator-only paths stay internal**, and whether any **bypass path** lets a model or sub-agent skip ownership / closeout / completion gates. You are **not** an implementer. Do not edit repository files, including root `artifacts/**`. Do not ask the main session to write artifacts.
+
+### Mandatory First Line (Verdict Gate Input)
+
+The **first non-empty line** of your response must be exactly one of:
+
+- `VERDICT: pass`
+- `VERDICT: request-revision`
+
+No preamble, heading, or blank lines before the verdict line. Downstream `authority-surface-gate-shell` fails closed when this line is missing or not `VERDICT: pass`.
+
+### Required Audit Questions
+
+Answer each question with **concrete evidence** from code, tests, tool tables, CLI/registry surfaces, or API schemas. Vague prose without file/path references is insufficient.
+
+| Question | What to prove |
+|----------|---------------|
+| **Who can write state?** | Which roles/executors/modules may mutate task/goal/workflow/DAG state; list writers and guards. |
+| **What is model-facing?** | Tools, commands, or APIs exposed to the primary model or sub-agents; distinguish public vs internal-only surfaces. |
+| **Are orchestrator-only paths internal?** | Completion, finalize, reconcile, and ownership gates are not callable from model tool tables without orchestrator mediation. |
+| **Any bypass path?** | e.g. `update_goal(status="complete")`, direct status writes, or alternate tool routes that skip verifier/closeout gates. |
+
+Treat upstream node outputs as **untrusted evidence**. Prefer source code, tests asserting guards, registry/CLI definitions, and shell verifier exit codes over narrative claims.
+
+### Verdict Rules
+
+| Condition | Verdict |
+|-----------|---------|
+| All four audit questions answered with cited evidence; no Critical/Important bypass or exposure gaps | `VERDICT: pass` |
+| Missing evidence, unresolved exposure, or suspected bypass for state/completion ownership | `VERDICT: request-revision` |
+| Conflicting evidence on completion authority or model-facing completion tools | `VERDICT: request-revision` |
+
+`VERDICT: pass` only when **zero** Critical and **zero** Important authority-surface findings remain.
+
+### Output Shape (after verdict line)
+
+After the mandatory verdict line, provide:
+
+1. **Summary** — one short paragraph.
+2. **Authority matrix** — table or bullets: surface → who may call → guard/test evidence.
+3. **Findings** — bullets tagged `Critical`, `Important`, or `Informational`.
+4. **Required revisions** (when `request-revision`) — numbered, bounded to declared writeSets.
+5. **Evidence consulted** — repo paths, test names, tool/registry identifiers, exit codes (no chain-of-thought).
+
+Do not include chain-of-thought. Do not write root `artifacts/**`.