@tea-agent/loop-agent 0.26.3 → 0.26.4

package/dist/executors/shell-executor.js

@@ -2,9 +2,10 @@ import { spawn } from "node:child_process";
 import { appendFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { writeDagNodeTextArtifact } from "../infrastructure/harness/artifact-store.js";
+import { writeDagNodeJsonArtifact, writeDagNodeTextArtifact, } from "../infrastructure/harness/artifact-store.js";
+import { captureWorkspaceCheckpoint } from "../workflows/dag/workspace-checkpoint.js";
 import { truncateOutput } from "../shared/output-truncation.js";
-import { processTreeSpawnOptions, terminateProcessTree } from "./process-tree.js";
+import { processTreeSpawnOptions, terminateProcessTree, } from "./process-tree.js";
 import { buildRequirementCoverageGateShellCommand, expandShellPreset, buildVerdictGateShellCommand, } from "./shell-presets.js";
 import { materializeBackendTestAnalysisContract } from "../workflows/dag/backend-test-analysis-contract.js";
 import { extractBackendTestContractEnvelope } from "../workflows/dag/backend-test-contract-envelope.js";
@@ -22,7 +23,7 @@ import { materializeFrontendLintAssessment, materializeFrontendLintBaseline, } f
 import { formatTraceabilityGateStdout, materializeBackendTestCaseManifest, runBackendTestTraceabilityGate, } from "../workflows/dag/backend-test-case-manifest.js";
 import { materializeBackendTestExecutionContract } from "../workflows/dag/backend-test-execution-contract.js";
 import { analyzeBackendTestCaseCoverage, analyzeBackendTestMarkdownPytestCorrespondence, materializeBackendTestCaseManifestFromFacts, } from "../workflows/dag/backend-test-case-coverage-analysis.js";
-import { materializeBackendTestResultFromPytestHtml, materializeBackendTestResultFromRunDir, parsePytestHtmlReport } from "../workflows/dag/backend-test-result-contract.js";
+import { materializeBackendTestResultFromPytestHtml, materializeBackendTestResultFromRunDir, parsePytestHtmlReport, } from "../workflows/dag/backend-test-result-contract.js";
 import { collectBackendTestHumanCaseCatalog, collectBackendTestMappedPytestScripts, collectJacocoCoverage, hasBlockingBackendMarkdownSafetyFindings, inspectBackendTestEnvironment, requiredBackendMarkdownCaseAcIds, renderBackendTestFacts, renderBackendTestHtml, renderBackendTestL5Dashboard, redactBackendTestOutput, validateBackendMarkdownCases, validateBackendMarkdownTraceability, writeRunReport, } from "../workflows/dag/backend-test-markdown-workflow.js";
 import { assessBackendPytestCollection, assertBackendPytestCollectionFresh, buildBackendPytestAssetInventory, materializeEffectiveBackendPytestCollection, readBackendPytestCollectionFacts, writeBackendPytestCollectionArtifacts, } from "../workflows/dag/backend-test-pytest-collection.js";
 import { computeL5ReportMetrics } from "../workflows/dag/l5-report-metrics.js";
@@ -33,6 +34,29 @@ import { buildShellProcessEnv } from "./shell-verification.js";
 import { readRunState } from "../workflows/dag/run-store.js";
 import { readProjectGovernanceContext } from "../workflows/dag/project-governance-context.js";
 import { assertMavenPlanFresh, MavenPlanStaleError, } from "../verification/maven/index.js";
+/** In-memory same-run success cache. Never shared across runIds. */
+const sameRunShellCommandCaches = new Map();
+function shellCommandCacheKey(runId, nodeId) {
+    return `${runId}::${nodeId}`;
+}
+function buildShellCommandContractKey(input) {
+    return JSON.stringify({
+        commands: input.commands,
+        cwd: input.cwd,
+        timeoutMs: input.timeoutMs,
+        envAllowlist: input.envAllowlist ?? [],
+        failFast: input.failFast,
+        nonZeroExitPolicy: input.nonZeroExitPolicy ?? "fail",
+    });
+}
+export function clearSameRunShellCommandCachesForTests() {
+    sameRunShellCommandCaches.clear();
+}
+function shouldReuseSuccessfulShellCommands(shell) {
+    // AC-005 targets supervised hard verify; also allow any shell node that
+    // carries final verifyEvidence so intermediate gates stay fail-closed fresh.
+    return shell.verifyEvidence?.phase === "final";
+}
 const DEFAULT_SHELL_TIMEOUT_MS = 300_000;
 const SUMMARY_STDOUT_MAX = 4_000;
 const SUMMARY_STDERR_MAX = 2_000;
@@ -394,7 +418,13 @@ async function executeBackendTestPipeline(input, meta) {
             const results = await executePipelineCommands(input, meta);
             if (!results.every((result) => result.ok)) {
                 const failure = results.find((result) => !result.ok);
-                return { ok: false, stdout: results.map((result) => result.stdout).join("\n"), stderr: failure.stderr, failureCategory: failure.failureCategory, durationMs: Date.now() - started };
+                return {
+                    ok: false,
+                    stdout: results.map((result) => result.stdout).join("\n"),
+                    stderr: failure.stderr,
+                    failureCategory: failure.failureCategory,
+                    durationMs: Date.now() - started,
+                };
             }
             const environment = await inspectBackendTestEnvironment({
                 workspaceRoot: input.cwd,
@@ -449,13 +479,20 @@ async function executeBackendTestPipeline(input, meta) {
             }
             const normalizedBinding = {
                 taskId: sourceBinding.taskId,
-                requirementPath: sourceBinding.sources.find((s) => s.kind === "requirement")?.path ?? "source/requirement.md",
-                requirementSha256: sourceBinding.sources.find((s) => s.kind === "requirement")?.sha256 ?? "0".repeat(64),
-                referencePaths: sourceBinding.sources.filter((s) => s.kind === "reference").map((s) => s.path),
+                requirementPath: sourceBinding.sources.find((s) => s.kind === "requirement")?.path ??
+                    "source/requirement.md",
+                requirementSha256: sourceBinding.sources.find((s) => s.kind === "requirement")?.sha256 ??
+                    "0".repeat(64),
+                referencePaths: sourceBinding.sources
+                    .filter((s) => s.kind === "reference")
+                    .map((s) => s.path),
                 requirementIds: sourceBinding.requirementIds,
             };
             try {
-                const coverage = await analyzeBackendTestCaseCoverage({ workspaceRoot: input.cwd, sourceBinding: normalizedBinding });
+                const coverage = await analyzeBackendTestCaseCoverage({
+                    workspaceRoot: input.cwd,
+                    sourceBinding: normalizedBinding,
+                });
                 const coveragePath = await writeRunReport(meta.runDir, "backend-test-case-coverage-analysis.md", coverage.markdown);
                 const contractsDir = path.join(meta.runDir, "contracts");
                 await mkdir(contractsDir, { recursive: true });
@@ -544,7 +581,8 @@ async function executeBackendTestPipeline(input, meta) {
                     return {
                         ok: false,
                         stdout: result.stdout,
-                        stderr: result.stderr || "backend pytest final collection could not start",
+                        stderr: result.stderr ||
+                            "backend pytest final collection could not start",
                         failureCategory: result.failureCategory,
                         durationMs: Date.now() - started,
                     };
@@ -609,7 +647,10 @@ async function executeBackendTestPipeline(input, meta) {
                 };
             }
             try {
-                const correspondence = await analyzeBackendTestMarkdownPytestCorrespondence({ workspaceRoot: input.cwd, taskId: sourceBinding.taskId });
+                const correspondence = await analyzeBackendTestMarkdownPytestCorrespondence({
+                    workspaceRoot: input.cwd,
+                    taskId: sourceBinding.taskId,
+                });
                 const correspondencePath = await writeRunReport(meta.runDir, "backend-test-markdown-pytest-correspondence.md", correspondence.markdown);
                 const contractsDir = path.join(meta.runDir, "contracts");
                 await mkdir(contractsDir, { recursive: true });
@@ -640,9 +681,13 @@ async function executeBackendTestPipeline(input, meta) {
                 workspaceRoot: input.cwd,
                 sourceBinding: {
                     taskId: sourceBinding.taskId,
-                    requirementPath: sourceBinding.sources.find((s) => s.kind === "requirement")?.path ?? "source/requirement.md",
-                    requirementSha256: sourceBinding.sources.find((s) => s.kind === "requirement")?.sha256 ?? "0".repeat(64),
-                    referencePaths: sourceBinding.sources.filter((s) => s.kind === "reference").map((s) => s.path),
+                    requirementPath: sourceBinding.sources.find((s) => s.kind === "requirement")?.path ??
+                        "source/requirement.md",
+                    requirementSha256: sourceBinding.sources.find((s) => s.kind === "requirement")
+                        ?.sha256 ?? "0".repeat(64),
+                    referencePaths: sourceBinding.sources
+                        .filter((s) => s.kind === "reference")
+                        .map((s) => s.path),
                     requirementIds: sourceBinding.requirementIds,
                 },
             });
@@ -754,7 +799,9 @@ async function executeBackendTestPipeline(input, meta) {
             if (!results.every((result) => result.ok)) {
                 const failureIndex = results.findIndex((result) => !result.ok);
                 const failure = results[failureIndex];
-                const combinedStdout = results.map((result) => result.stdout).join("\n");
+                const combinedStdout = results
+                    .map((result) => result.stdout)
+                    .join("\n");
                 let diagnosticsText = "";
                 try {
                     diagnosticsText = await readFile(path.join(meta.runDir, "reports", "backend-test-execute-diagnostics.md"), "utf8");
@@ -887,7 +934,12 @@ async function executeBackendTestPipeline(input, meta) {
                 }
             }
             const l5Metrics = computeL5ReportMetrics({
-                result: { passed: parsed.passed, failed: parsed.failed, error: parsed.errors, skipped: parsed.skipped },
+                result: {
+                    passed: parsed.passed,
+                    failed: parsed.failed,
+                    error: parsed.errors,
+                    skipped: parsed.skipped,
+                },
                 manifest: manifestForL5,
                 coverage: coverageContract,
                 criticalRiskCount: parsed.failed + parsed.errors > 0 ? 1 : 0,
@@ -896,7 +948,12 @@ async function executeBackendTestPipeline(input, meta) {
                 .filter((c) => c.status !== "passed")
                 .map((c) => {
                 const id = c.name.match(/BE-[A-Z0-9]+(?:-[A-Z0-9]+)*-\d{3}/)?.[0] ?? c.name;
-                return { caseId: id, title: c.name, message: c.message ?? c.status, script: `${c.classname.split("::")[0] ?? c.classname}` };
+                return {
+                    caseId: id,
+                    title: c.name,
+                    message: c.message ?? c.status,
+                    script: `${c.classname.split("::")[0] ?? c.classname}`,
+                };
             });
             const l5Html = renderBackendTestL5Dashboard({
                 title: meta.spec.title,
@@ -969,7 +1026,7 @@ async function executeBackendTestPipeline(input, meta) {
                 if (!parsed ||
                     typeof parsed !== "object" ||
                     Array.isArray(parsed) ||
-                    !["verdict", "findings", "summary"].every((key) => Object.prototype.hasOwnProperty.call(parsed, key))) {
+                    !["verdict", "findings", "summary"].every((key) => Object.hasOwn(parsed, key))) {
                     return {
                         ok: false,
                         stdout: "",
@@ -1021,13 +1078,25 @@ async function executeBackendTestPipeline(input, meta) {
             });
             outputs.push(`semantic=${review.path}`, formatTraceabilityGateStdout(trace));
             const parsed = JSON.parse(await readFile(review.path, "utf8"));
-            return { ok: true, stdout: JSON.stringify(parsed), stderr: "", failureCategory: "success", durationMs: Date.now() - started };
+            return {
+                ok: true,
+                stdout: JSON.stringify(parsed),
+                stderr: "",
+                failureCategory: "success",
+                durationMs: Date.now() - started,
+            };
         }
         else if (pipeline === "execute-parse-initial") {
             const results = await executePipelineCommands(input, meta);
             if (!results.every((result) => result.ok)) {
                 const failure = results.find((result) => !result.ok);
-                return { ok: false, stdout: results.map((result) => result.stdout).join("\n"), stderr: failure.stderr, failureCategory: failure.failureCategory, durationMs: Date.now() - started };
+                return {
+                    ok: false,
+                    stdout: results.map((result) => result.stdout).join("\n"),
+                    stderr: failure.stderr,
+                    failureCategory: failure.failureCategory,
+                    durationMs: Date.now() - started,
+                };
             }
             const artifact = await materializeBackendTestResultFromRunDir({
                 runDir: meta.runDir,
@@ -1045,9 +1114,12 @@ async function executeBackendTestPipeline(input, meta) {
                 artifactName: "backend-test-classification.json",
                 outputDir: "contracts",
             });
-            const selected = await executePipelineCommands(input, meta, [buildBackendTestCanonicalResultFromInitialShellSnippet()]);
+            const selected = await executePipelineCommands(input, meta, [
+                buildBackendTestCanonicalResultFromInitialShellSnippet(),
+            ]);
             if (!selected.every((result) => result.ok))
-                throw new Error(selected.find((result) => !result.ok)?.stderr || "canonical result materialization failed");
+                throw new Error(selected.find((result) => !result.ok)?.stderr ||
+                    "canonical result materialization failed");
             const readNodeOutput = async (nodeId) => {
                 const record = JSON.parse(await readFile(path.join(meta.runDir, `${nodeId}.json`), "utf8"));
                 const text = record.assistantText?.trim() || record.stdout?.trim() || "";
@@ -1056,12 +1128,17 @@ async function executeBackendTestPipeline(input, meta) {
                 return text;
             };
             const caseReview = await readNodeOutput("review-backend-cases-pi");
-            const reviewVerdicts = caseReview.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.startsWith("VERDICT:"));
-            if (reviewVerdicts.length !== 1 || !["VERDICT: pass", "VERDICT: request-revision"].includes(reviewVerdicts[0])) {
+            const reviewVerdicts = caseReview
+                .split(/\r?\n/)
+                .map((line) => line.trim())
+                .filter((line) => line.startsWith("VERDICT:"));
+            if (reviewVerdicts.length !== 1 ||
+                !["VERDICT: pass", "VERDICT: request-revision"].includes(reviewVerdicts[0])) {
                 throw new Error("invalid advisory case review evidence: expected exactly one auditable VERDICT line");
             }
             const traceability = await readNodeOutput("backend-test-traceability-gate-shell");
-            if (!traceability.includes("Traceability gate: pass") || !/Matched symbols:\s*\d+/.test(traceability)) {
+            if (!traceability.includes("Traceability gate: pass") ||
+                !/Matched symbols:\s*\d+/.test(traceability)) {
                 throw new Error("invalid traceability evidence: deterministic pass summary is missing");
             }
             const contracts = path.join(meta.runDir, "contracts");
@@ -1070,7 +1147,10 @@ async function executeBackendTestPipeline(input, meta) {
                 result: JSON.parse(await readFile(path.join(contracts, "backend-test-result.json"), "utf8")),
                 manifest: JSON.parse(await readFile(path.join(contracts, "backend-test-case-manifest.json"), "utf8")),
                 classification: JSON.parse(await readFile(path.join(contracts, "backend-test-classification.json"), "utf8")),
-                caseReview: { verdict: reviewVerdicts[0].slice("VERDICT: ".length), evidence: caseReview },
+                caseReview: {
+                    verdict: reviewVerdicts[0].slice("VERDICT: ".length),
+                    evidence: caseReview,
+                },
                 traceability: { status: "pass", evidence: traceability },
             };
             outputs.push(`classification=${classification.path}`, ...selected.map((result) => result.stdout), JSON.stringify(context, null, 2));
@@ -1078,10 +1158,22 @@ async function executeBackendTestPipeline(input, meta) {
         else {
             throw new Error(`unsupported backend-test pipeline: ${pipeline}`);
         }
-        return { ok: true, stdout: outputs.filter(Boolean).join("\n"), stderr: "", failureCategory: "success", durationMs: Date.now() - started };
+        return {
+            ok: true,
+            stdout: outputs.filter(Boolean).join("\n"),
+            stderr: "",
+            failureCategory: "success",
+            durationMs: Date.now() - started,
+        };
     }
     catch (error) {
-        return { ok: false, stdout: "", stderr: error instanceof Error ? error.message : String(error), failureCategory: "invalid-output", durationMs: Date.now() - started };
+        return {
+            ok: false,
+            stdout: "",
+            stderr: error instanceof Error ? error.message : String(error),
+            failureCategory: "invalid-output",
+            durationMs: Date.now() - started,
+        };
     }
 }
 async function executeBackendTestPipelineWithWriteGuard(input, meta) {
@@ -1192,9 +1284,21 @@ async function executeFrontendVerificationBundle(input, meta) {
     const lintBlocked = lintAssessment?.status === "failed" ||
         lintAssessment?.status === "unavailable";
     const groups = [
-        { name: "mock", commands: bundle.mockCommands, labels: bundle.mockEvidence?.commandLabels ?? [] },
-        { name: "static", commands: bundle.staticCommands, labels: bundle.staticEvidence.commandLabels },
-        { name: "behavior", commands: bundle.behaviorCommands, labels: bundle.behaviorEvidence.commandLabels },
+        {
+            name: "mock",
+            commands: bundle.mockCommands,
+            labels: bundle.mockEvidence?.commandLabels ?? [],
+        },
+        {
+            name: "static",
+            commands: bundle.staticCommands,
+            labels: bundle.staticEvidence.commandLabels,
+        },
+        {
+            name: "behavior",
+            commands: bundle.behaviorCommands,
+            labels: bundle.behaviorEvidence.commandLabels,
+        },
     ];
     const successfulLabels = new Map();
     for (const group of lintBlocked ? [] : groups) {
@@ -1316,9 +1420,7 @@ async function executeFrontendVerificationBundle(input, meta) {
     const failureFacts = [];
     if (firstFailure || lintSyntheticFailure) {
         const failureStdout = firstFailure
-            ? [firstFailure.command, firstFailure.stdout]
-                .filter(Boolean)
-                .join("\n")
+            ? [firstFailure.command, firstFailure.stdout].filter(Boolean).join("\n")
             : "";
         failureFacts.push({
             nodeId: input.task.id,
@@ -1374,40 +1476,93 @@ async function executeFrontendTestCaseChecklist(input, meta) {
     const started = Date.now();
     try {
         const declaredAcIds = (meta.spec.sourceBinding?.requirementIds ?? []).filter((id) => /^AC(?:-[A-Z0-9]+)+$/i.test(id));
-        const result = await validateFrontendCaseChecklist({ workspaceRoot: input.cwd, declaredAcIds });
+        const result = await validateFrontendCaseChecklist({
+            workspaceRoot: input.cwd,
+            declaredAcIds,
+        });
         if (result.issues.length) {
-            return { ok: false, stdout: "", stderr: `frontend-test checklist blocked: ${JSON.stringify(result.issues)}`, failureCategory: "invalid-output", durationMs: Date.now() - started };
+            return {
+                ok: false,
+                stdout: "",
+                stderr: `frontend-test checklist blocked: ${JSON.stringify(result.issues)}`,
+                failureCategory: "invalid-output",
+                durationMs: Date.now() - started,
+            };
         }
-        return { ok: true, stdout: `frontend-test checklist ok cases=${result.caseCount} source=${path.basename(result.manifestPath)}`, stderr: "", failureCategory: "success", durationMs: Date.now() - started };
+        return {
+            ok: true,
+            stdout: `frontend-test checklist ok cases=${result.caseCount} source=${path.basename(result.manifestPath)}`,
+            stderr: "",
+            failureCategory: "success",
+            durationMs: Date.now() - started,
+        };
     }
     catch (error) {
-        return { ok: false, stdout: "", stderr: error instanceof Error ? error.message : String(error), failureCategory: "invalid-output", durationMs: Date.now() - started };
+        return {
+            ok: false,
+            stdout: "",
+            stderr: error instanceof Error ? error.message : String(error),
+            failureCategory: "invalid-output",
+            durationMs: Date.now() - started,
+        };
     }
 }
 async function executeFrontendTestL5Report(input, meta) {
     const started = Date.now();
     try {
-        const output = await renderFrontendTestL5Report({ workspaceRoot: input.cwd, runDir: meta.runDir });
-        return { ok: true, stdout: `Frontend L-5 report: ${output.htmlPath}\nMarkdown: ${output.markdownPath}\nStatus: ${output.metrics.status}`, stderr: "", failureCategory: "success", durationMs: Date.now() - started };
+        const output = await renderFrontendTestL5Report({
+            workspaceRoot: input.cwd,
+            runDir: meta.runDir,
+        });
+        return {
+            ok: true,
+            stdout: `Frontend L-5 report: ${output.htmlPath}\nMarkdown: ${output.markdownPath}\nStatus: ${output.metrics.status}`,
+            stderr: "",
+            failureCategory: "success",
+            durationMs: Date.now() - started,
+        };
     }
     catch (error) {
-        return { ok: false, stdout: "", stderr: error instanceof Error ? error.message : String(error), failureCategory: "invalid-output", durationMs: Date.now() - started };
+        return {
+            ok: false,
+            stdout: "",
+            stderr: error instanceof Error ? error.message : String(error),
+            failureCategory: "invalid-output",
+            durationMs: Date.now() - started,
+        };
     }
 }
 async function executeFrontendTestHtmlReport(input, meta) {
     const started = Date.now();
     try {
-        const output = await renderFrontendTestHtmlReport({ workspaceRoot: input.cwd, runDir: meta.runDir });
-        return { ok: true, stdout: `Frontend test report: ${output.htmlPath}\nMarkdown: ${output.markdownPath}\nOutcome: ${output.outcome}\nCases: ${output.caseCount}`, stderr: "", failureCategory: "success", durationMs: Date.now() - started };
+        const output = await renderFrontendTestHtmlReport({
+            workspaceRoot: input.cwd,
+            runDir: meta.runDir,
+        });
+        return {
+            ok: true,
+            stdout: `Frontend test report: ${output.htmlPath}\nMarkdown: ${output.markdownPath}\nOutcome: ${output.outcome}\nCases: ${output.caseCount}`,
+            stderr: "",
+            failureCategory: "success",
+            durationMs: Date.now() - started,
+        };
     }
     catch (error) {
-        return { ok: false, stdout: "", stderr: error instanceof Error ? error.message : String(error), failureCategory: "invalid-output", durationMs: Date.now() - started };
+        return {
+            ok: false,
+            stdout: "",
+            stderr: error instanceof Error ? error.message : String(error),
+            failureCategory: "invalid-output",
+            durationMs: Date.now() - started,
+        };
     }
 }
 async function executeFrontendTestEvidenceValidation(input) {
     const started = Date.now();
     try {
-        const result = await validateFrontendCaseEvidence({ workspaceRoot: input.cwd });
+        const result = await validateFrontendCaseEvidence({
+            workspaceRoot: input.cwd,
+        });
         const output = `frontend case evidence validation cases=${result.cases} findings=${result.issues.length}${result.issues.length ? ` issues=${JSON.stringify(result.issues)}` : ""}`;
         if (result.hardFail) {
             return {
@@ -1510,10 +1665,22 @@ export async function executeDagShellNode(input, meta) {
                 workspaceRoot: input.cwd,
                 repoRoot: input.cwd,
             });
-            return { ok: true, stdout: formatFrontendPrewriteGateStdout(result), stderr: "", failureCategory: "success", durationMs: Date.now() - started };
+            return {
+                ok: true,
+                stdout: formatFrontendPrewriteGateStdout(result),
+                stderr: "",
+                failureCategory: "success",
+                durationMs: Date.now() - started,
+            };
         }
         catch (error) {
-            return { ok: false, stdout: "", stderr: error instanceof Error ? error.message : String(error), failureCategory: "invalid-output", durationMs: Date.now() - started };
+            return {
+                ok: false,
+                stdout: "",
+                stderr: error instanceof Error ? error.message : String(error),
+                failureCategory: "invalid-output",
+                durationMs: Date.now() - started,
+            };
         }
     }
     if (shell?.frontendLintBaseline) {
@@ -1530,10 +1697,22 @@ export async function executeDagShellNode(input, meta) {
                 workspaceRoot: input.cwd,
                 requireBaseline: shell.frontendReviewContext.requireBaseline,
             });
-            return { ok: true, stdout: formatFrontendReviewContextStdout(result), stderr: "", failureCategory: "success", durationMs: Date.now() - started };
+            return {
+                ok: true,
+                stdout: formatFrontendReviewContextStdout(result),
+                stderr: "",
+                failureCategory: "success",
+                durationMs: Date.now() - started,
+            };
         }
         catch (error) {
-            return { ok: false, stdout: "", stderr: error instanceof Error ? error.message : String(error), failureCategory: "invalid-output", durationMs: Date.now() - started };
+            return {
+                ok: false,
+                stdout: "",
+                stderr: error instanceof Error ? error.message : String(error),
+                failureCategory: "invalid-output",
+                durationMs: Date.now() - started,
+            };
         }
     }
     if (shell?.frontendTestCaseChecklist) {
@@ -1873,8 +2052,10 @@ export async function executeDagShellNode(input, meta) {
     }
     const cwd = resolveShellCwd(input.cwd, shell.cwd);
     const timeoutMs = shell.timeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS;
+    const failFast = shell.failFast !== false;
     const results = [];
     let beforeStatus;
+    let workspaceFingerprint;
     try {
         beforeStatus = await readGitStatusPorcelain(input.cwd);
     }
@@ -1882,8 +2063,78 @@ export async function executeDagShellNode(input, meta) {
         // Non-git cwd: skip write guard (documented limitation).
         beforeStatus = undefined;
     }
+    const reuseEligible = shouldReuseSuccessfulShellCommands(shell);
+    let commandContractKey;
+    let cache;
+    if (reuseEligible) {
+        try {
+            const governanceTaskId = meta.spec.sourceBinding?.taskId?.trim();
+            const checkpoint = await captureWorkspaceCheckpoint(input.cwd, {
+                ...(governanceTaskId ? { taskId: governanceTaskId } : {}),
+            });
+            workspaceFingerprint = checkpoint.fingerprint;
+        }
+        catch {
+            // Fingerprint unavailable: do not create cache / do not reuse.
+            workspaceFingerprint = undefined;
+        }
+        commandContractKey = buildShellCommandContractKey({
+            commands,
+            cwd,
+            timeoutMs,
+            envAllowlist: shell.envAllowlist,
+            failFast,
+            nonZeroExitPolicy: shell.nonZeroExitPolicy,
+        });
+        const cacheKey = shellCommandCacheKey(meta.runId, input.task.id);
+        const existing = sameRunShellCommandCaches.get(cacheKey);
+        if (existing &&
+            existing.runId === meta.runId &&
+            existing.nodeId === input.task.id &&
+            existing.commandContractKey === commandContractKey &&
+            workspaceFingerprint &&
+            existing.workspaceFingerprint === workspaceFingerprint) {
+            cache = existing;
+        }
+        else {
+            sameRunShellCommandCaches.delete(cacheKey);
+            if (workspaceFingerprint) {
+                cache = {
+                    runId: meta.runId,
+                    nodeId: input.task.id,
+                    commandContractKey,
+                    workspaceFingerprint,
+                    byCommand: new Map(),
+                };
+                sameRunShellCommandCaches.set(cacheKey, cache);
+            }
+        }
+    }
     for (const command of commands) {
         const commandNumber = results.length + 1;
+        // Cache each contractual occurrence independently. A result written for an
+        // earlier duplicate in this round must not satisfy a later occurrence.
+        const commandCacheKey = `${commandNumber}:${command}`;
+        const cached = cache?.byCommand.get(commandCacheKey);
+        if (cached) {
+            results.push({
+                command,
+                cwd: cached.cwd,
+                durationMs: cached.durationMs,
+                exitCode: cached.exitCode,
+                failureCategory: cached.failureCategory,
+                ok: true,
+                stderr: cached.stderr,
+                stderrBytes: cached.stderrBytes,
+                stderrTruncated: cached.stderrTruncated,
+                stdout: cached.stdout,
+                stdoutBytes: cached.stdoutBytes,
+                stdoutTruncated: cached.stdoutTruncated,
+                timedOut: cached.timedOut,
+                reused: true,
+            });
+            continue;
+        }
         const result = await executeShellCommand({
             command,
             cwd,
@@ -1896,7 +2147,23 @@ export async function executeDagShellNode(input, meta) {
             },
         });
         results.push(result);
-        if (!result.ok)
+        if (result.ok && cache) {
+            cache.byCommand.set(commandCacheKey, {
+                ok: true,
+                exitCode: result.exitCode,
+                failureCategory: "success",
+                stdout: result.stdout,
+                stderr: result.stderr,
+                stdoutBytes: result.stdoutBytes,
+                stderrBytes: result.stderrBytes,
+                stdoutTruncated: result.stdoutTruncated,
+                stderrTruncated: result.stderrTruncated,
+                timedOut: result.timedOut,
+                durationMs: result.durationMs,
+                cwd: result.cwd,
+            });
+        }
+        if (!result.ok && failFast)
             break;
     }
     let writeGuardViolations = [];
@@ -1918,17 +2185,49 @@ export async function executeDagShellNode(input, meta) {
             ];
         }
     }
+    // Write-guard or workspace mutation invalidates same-run success reuse.
+    if (!writeGuardOk && reuseEligible) {
+        sameRunShellCommandCaches.delete(shellCommandCacheKey(meta.runId, input.task.id));
+    }
     const commandsOk = results.every((result) => result.ok);
     const recordNonZero = shell.nonZeroExitPolicy === "record";
     const ok = (commandsOk || recordNonZero) && writeGuardOk;
     const firstFailure = results.find((result) => !result.ok);
-    await writeDagNodeTextArtifact(meta.runDir, input.task.id, "result.summary.md", buildShellResultSummaryMarkdown({
+    const receipt = {
+        schemaVersion: 1,
+        runId: meta.runId,
+        nodeId: input.task.id,
+        workspaceFingerprint: workspaceFingerprint ?? null,
+        failFast,
+        commands: results.map((result) => ({
+            command: result.command,
+            ok: result.ok,
+            exitCode: result.exitCode,
+            failureCategory: result.failureCategory,
+            reused: result.reused === true,
+        })),
+    };
+    await writeDagNodeJsonArtifact(meta.runDir, input.task.id, "shell-command-receipt.json", receipt);
+    const summaryMarkdown = buildShellResultSummaryMarkdown({
         nodeId: input.task.id,
         runId: meta.runId,
         rootCwd: input.cwd,
         results,
         writeGuardViolations: writeGuardOk ? undefined : writeGuardViolations,
-    }));
+    });
+    const receiptMarkdown = [
+        summaryMarkdown,
+        "",
+        "## Same-run reuse receipt",
+        "",
+        `| workspaceFingerprint | ${workspaceFingerprint ?? "(unavailable)"} |`,
+        `| failFast | ${failFast} |`,
+        "",
+        "| # | ok | exitCode | reused | command |",
+        "|---|----|----------|--------|---------|",
+        ...results.map((result, index) => `| ${index + 1} | ${result.ok} | ${result.exitCode ?? "null"} | ${result.reused === true} | ${result.command.replace(/\|/g, "\\|")} |`),
+    ].join("\n");
+    await writeDagNodeTextArtifact(meta.runDir, input.task.id, "result.summary.md", receiptMarkdown);
     const aggregate = summarizeCommandResults(results);
     const stderrParts = [aggregate.stderr];
     if (!writeGuardOk) {
@@ -1946,13 +2245,17 @@ export async function executeDagShellNode(input, meta) {
         exitCode: result.exitCode,
         failureCategory: result.failureCategory,
         command: result.command,
+        reused: result.reused === true,
     }));
     const recordPrefix = recordNonZero && !commandsOk
         ? `nonZeroExitPolicy=record exitCode=${firstFailure?.exitCode ?? "null"}\n`
         : "";
+    const reuseNote = results.some((result) => result.reused)
+        ? `same-run-reuse workspaceFingerprint=${workspaceFingerprint ?? "unknown"}\n`
+        : "";
     return {
         ok,
-        stdout: `${recordPrefix}${aggregate.stdout}`,
+        stdout: `${recordPrefix}${reuseNote}${aggregate.stdout}`,
         stderr: stderrParts.filter(Boolean).join("\n\n"),
         failureCategory,
         durationMs: Date.now() - started,