@tea-agent/loop-agent 0.26.3 → 0.26.5-beta.0

package/dist/governance/document-index-closure.js

@@ -0,0 +1,164 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { pathMatchesPattern } from "../shared/git-progress.js";
+function normalizePath(value) {
+    return value.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+}
+function isConcreteRepoRelativePath(value) {
+    const normalized = normalizePath(value);
+    if (!normalized)
+        return false;
+    if (normalized === "." ||
+        normalized === "**" ||
+        normalized === "*" ||
+        normalized === "/*") {
+        return false;
+    }
+    if (normalized.includes("**") || normalized.includes("*"))
+        return false;
+    if (path.isAbsolute(normalized) || /^[A-Za-z]:\//.test(normalized))
+        return false;
+    if (normalized.split("/").some((segment) => segment === ".."))
+        return false;
+    return true;
+}
+function assertValidDirectoryIndexRule(rule, indexLabel) {
+    if (!rule || typeof rule !== "object" || Array.isArray(rule)) {
+        throw new Error(`document-index-closure: invalid completeDirectoryIndexes entry at ${indexLabel}`);
+    }
+    const record = rule;
+    if (typeof record.directory !== "string" ||
+        record.directory.trim().length === 0) {
+        throw new Error(`document-index-closure: completeDirectoryIndexes[${indexLabel}].directory must be a non-empty string`);
+    }
+    if (typeof record.index !== "string" || record.index.trim().length === 0) {
+        throw new Error(`document-index-closure: completeDirectoryIndexes[${indexLabel}].index must be a non-empty string`);
+    }
+    const directory = normalizePath(record.directory);
+    const index = normalizePath(record.index);
+    if (!isConcreteRepoRelativePath(directory)) {
+        throw new Error(`document-index-closure: completeDirectoryIndexes[${indexLabel}].directory must be a concrete repo-relative path (got "${record.directory}")`);
+    }
+    if (!isConcreteRepoRelativePath(index)) {
+        throw new Error(`document-index-closure: completeDirectoryIndexes[${indexLabel}].index must be a concrete repo-relative path without globs (got "${record.index}")`);
+    }
+    return { directory, index };
+}
+/**
+ * Load completeDirectoryIndexes from docs/document-catalog.json only.
+ * Does not hard-code a second directory table.
+ */
+export function loadCompleteDirectoryIndexes(repoRoot) {
+    const catalogPath = path.join(repoRoot, "docs", "document-catalog.json");
+    // The catalog is an opt-in governance surface. Projects that have not
+    // initialized it must still be able to generate DAGs for docs paths.
+    if (!existsSync(catalogPath))
+        return [];
+    let raw;
+    try {
+        raw = readFileSync(catalogPath, "utf-8");
+    }
+    catch (error) {
+        throw new Error(`document-index-closure: failed to read docs/document-catalog.json: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new Error(`document-index-closure: docs/document-catalog.json is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("document-index-closure: docs/document-catalog.json root must be an object");
+    }
+    const rulesRaw = parsed
+        .completeDirectoryIndexes;
+    if (rulesRaw === undefined) {
+        return [];
+    }
+    if (!Array.isArray(rulesRaw)) {
+        throw new Error("document-index-closure: completeDirectoryIndexes must be an array when present");
+    }
+    return rulesRaw.map((rule, index) => assertValidDirectoryIndexRule(rule, String(index)));
+}
+function candidateDirectoryPrefixes(candidatePath) {
+    const normalized = normalizePath(candidatePath);
+    if (!normalized)
+        return [];
+    // Treat trailing /** globs as directory roots for prefix matching.
+    const withoutGlob = normalized
+        .replace(/\/\*\*$/, "")
+        .replace(/\/\*$/, "")
+        .replace(/\*\*$/, "")
+        .replace(/\*$/, "");
+    const base = normalizePath(withoutGlob);
+    if (!base || base === "." || base === "**")
+        return [];
+    const segments = base.split("/").filter(Boolean);
+    const prefixes = [];
+    for (let i = segments.length; i >= 1; i -= 1) {
+        prefixes.push(segments.slice(0, i).join("/"));
+    }
+    return prefixes;
+}
+function longestMatchingRule(candidatePath, rules) {
+    const prefixes = new Set(candidateDirectoryPrefixes(candidatePath));
+    if (prefixes.size === 0)
+        return undefined;
+    let best;
+    for (const rule of rules) {
+        if (!prefixes.has(rule.directory) &&
+            !candidateUnderDirectory(candidatePath, rule.directory)) {
+            continue;
+        }
+        if (!best || rule.directory.length > best.directory.length) {
+            best = rule;
+        }
+    }
+    return best;
+}
+function candidateUnderDirectory(candidatePath, directory) {
+    const normalized = normalizePath(candidatePath)
+        .replace(/\/\*\*$/, "")
+        .replace(/\/\*$/, "");
+    const dir = normalizePath(directory);
+    return normalized === dir || normalized.startsWith(`${dir}/`);
+}
+/**
+ * Derive concrete companion index paths for candidate docs paths using catalog rules.
+ * Longest directory prefix wins. Throws fail-closed on forbidden conflicts.
+ */
+export function resolveDocumentIndexCompanions(input) {
+    const forbidden = input.forbiddenPaths ?? [];
+    const companions = new Set();
+    for (const candidate of input.candidatePaths) {
+        const rule = longestMatchingRule(candidate, input.rules);
+        if (!rule)
+            continue;
+        const indexPath = rule.index;
+        if (forbidden.some((pattern) => pathMatchesPattern(indexPath, pattern))) {
+            throw new Error(`document-index-closure: companion index "${indexPath}" for "${candidate}" conflicts with forbiddenPaths`);
+        }
+        companions.add(indexPath);
+    }
+    return [...companions].sort((a, b) => a.localeCompare(b));
+}
+/**
+ * Convenience: load catalog and merge companion indexes into path lists.
+ */
+export function mergeDocumentIndexCompanions(input) {
+    const rules = loadCompleteDirectoryIndexes(input.repoRoot);
+    const companions = resolveDocumentIndexCompanions({
+        candidatePaths: input.paths,
+        rules,
+        forbiddenPaths: input.forbiddenPaths,
+    });
+    const merged = new Set(input.paths.map(normalizePath));
+    for (const companion of companions) {
+        merged.add(companion);
+    }
+    return {
+        paths: [...merged],
+        companions,
+    };
+}

package/dist/worker/observe/node-input.js

@@ -1,6 +1,6 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { redactSecrets, truncateUtf8Preview, } from "../../shared/preview.js";
+import { redactSecrets, truncateUtf8Preview } from "../../shared/preview.js";
 import { resolveDagNodeSkills } from "../../workflows/dag/skills.js";
 import { resolveDagNodePromptRedacted, resolveDagRunJson, } from "./dag-run-artifacts.js";
 export const NODE_INPUT_SCHEMA_VERSION = 1;
@@ -142,9 +142,7 @@ function projectTask(dagRunId, nodeId, lifecycle, spec, task, fingerprint, warni
         ? spec.defaults
         : undefined;
     const executorDeclared = typeof task.executor === "string";
-    const executor = executorDeclared
-        ? String(task.executor)
-        : "pi";
+    const executor = executorDeclared ? String(task.executor) : "pi";
     const executorSource = executorDeclared
         ? "task"
         : "schema-default";
@@ -190,7 +188,9 @@ function projectTask(dagRunId, nodeId, lifecycle, spec, task, fingerprint, warni
     const shellRaw = task.shell && typeof task.shell === "object" && !Array.isArray(task.shell)
         ? task.shell
         : null;
-    const staticRaw = task.static && typeof task.static === "object" && !Array.isArray(task.static)
+    const staticRaw = task.static &&
+        typeof task.static === "object" &&
+        !Array.isArray(task.static)
         ? task.static
         : null;
     let kind = "unknown";
@@ -206,9 +206,7 @@ function projectTask(dagRunId, nodeId, lifecycle, spec, task, fingerprint, warni
             preset: typeof shellRaw.preset === "string"
                 ? redactSecrets(shellRaw.preset)
                 : null,
-            cwd: typeof shellRaw.cwd === "string"
-                ? redactSecrets(shellRaw.cwd)
-                : null,
+            cwd: typeof shellRaw.cwd === "string" ? redactSecrets(shellRaw.cwd) : null,
             timeoutMs: typeof shellRaw.timeoutMs === "number" &&
                 Number.isFinite(shellRaw.timeoutMs)
                 ? shellRaw.timeoutMs
@@ -216,6 +214,7 @@ function projectTask(dagRunId, nodeId, lifecycle, spec, task, fingerprint, warni
             nonZeroExitPolicy: typeof shellRaw.nonZeroExitPolicy === "string"
                 ? shellRaw.nonZeroExitPolicy
                 : null,
+            failFast: typeof shellRaw.failFast === "boolean" ? shellRaw.failFast : null,
             gates: shellGateNames(shellRaw),
         }
         : null;
@@ -245,9 +244,7 @@ function projectTask(dagRunId, nodeId, lifecycle, spec, task, fingerprint, warni
             executor: redactString(executor),
             executorSource,
             role: typeof task.role === "string" ? redactSecrets(task.role) : null,
-            complexity: typeof task.complexity === "string"
-                ? task.complexity
-                : null,
+            complexity: typeof task.complexity === "string" ? task.complexity : null,
             writePolicy: writePolicy ? redactSecrets(writePolicy) : null,
             writePolicySource,
             toolProfile: typeof task.toolProfile === "string"

package/dist/workflows/dag/convergence/controller.js

@@ -1,4 +1,4 @@
-import { access, appendFile, cp, mkdir } from "node:fs/promises";
+import { access, appendFile, cp, mkdir, readFile } from "node:fs/promises";
 import path from "node:path";
 import { parseProcessVerdict } from "../node-execution.js";
 import { freshNodeRecord } from "../dynamic-runtime/shared.js";
@@ -120,7 +120,8 @@ export async function runConvergencePassController(input) {
         isLegitimateReviewRequestRevision(input.state)) {
         return handleReviewRequestRevision(input, reviewGate);
     }
-    if (reviewGate.status === "FINISHED") {
+    if (reviewGate.status === "FINISHED" &&
+        isLegitimateReviewPass(input.state)) {
         convergence.terminalReason = "review-pass";
         await appendConvergenceKnowledgePattern({
             cwd: input.cwd,
@@ -128,6 +129,9 @@ export async function runConvergencePassController(input) {
         });
         return { retry: false };
     }
+    if (reviewGate.status === "FINISHED") {
+        return handleReviewRequestRevision(input, reviewGate);
+    }
     // Compatibility: gates without routingAccept still ERROR on revision.
     if (reviewGate.status === "ERROR") {
         return handleReviewRequestRevision(input, reviewGate);
@@ -151,10 +155,14 @@ async function resolveNoRepairTerminal(input) {
             isLegitimateReviewRequestRevision(input.state)) {
             return handleReviewRequestRevision(input, reviewGate);
         }
-        if (reviewGate.status === "FINISHED") {
+        if (reviewGate.status === "FINISHED" &&
+            isLegitimateReviewPass(input.state)) {
             convergence.terminalReason = "review-pass";
             return { retry: false };
         }
+        if (reviewGate.status === "FINISHED") {
+            return handleReviewRequestRevision(input, reviewGate);
+        }
         if (reviewGate.status === "ERROR") {
             return handleReviewRequestRevision(input, reviewGate);
         }
@@ -178,10 +186,61 @@ async function resolveNoRepairTerminal(input) {
  * Hard verification failed. Apply the existing non-retry / regression /
  * max-passes guards, then reset the convergence chain for another pass.
  */
+function repairDispositionOf(artifact) {
+    return artifact?.disposition ?? "repairable";
+}
+function hardVerifyFailureFingerprint(input) {
+    return [
+        input.failureCategory ?? "unknown",
+        input.verifyPhase ?? "",
+        input.verifyQuota ?? "",
+        String(input.verifyCommandCount ?? ""),
+        (input.verifyCommandLabels ?? []).join("\n"),
+        (input.stderrExcerpt ?? "").slice(0, 500),
+    ].join("|");
+}
+function fingerprintFromHardVerify(hardVerify) {
+    const verifyEvidence = hardVerify.verifyEvidence;
+    // Keep fingerprint fields aligned with passHistory so consecutive passes
+    // compare the same identity (category + verifyEvidence command contract).
+    // stderr is intentionally excluded: pass history does not retain it, and
+    // empty repair manifests already prove no workspace progress.
+    return hardVerifyFailureFingerprint({
+        failureCategory: hardVerify.failureCategory,
+        verifyPhase: verifyEvidence?.phase,
+        verifyQuota: verifyEvidence?.quota,
+        verifyCommandCount: verifyEvidence?.commandCount,
+        verifyCommandLabels: verifyEvidence?.commandLabels,
+    });
+}
+function fingerprintFromPassHistory(pass) {
+    return hardVerifyFailureFingerprint({
+        failureCategory: pass.hardVerifyFailureCategory,
+        verifyPhase: pass.verifyPhase,
+        verifyQuota: pass.verifyQuota,
+        verifyCommandCount: pass.verifyCommandCount,
+        verifyCommandLabels: pass.verifyCommandLabels,
+    });
+}
+async function readRepairChangedFiles(runDir, repairNodeId = "repair-pi") {
+    try {
+        const raw = await readFile(path.join(runDir, repairNodeId, "change-manifest.json"), "utf-8");
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed.changedFiles))
+            return [];
+        return parsed.changedFiles.filter((entry) => typeof entry === "string");
+    }
+    catch {
+        return undefined;
+    }
+}
 async function handleHardVerifyFailure(input, hardVerify) {
     const convergence = input.state.convergence;
     const currentPass = convergence.currentPass || 1;
     const hardFailure = hardVerify.failureCategory ?? "unknown";
+    const processSupervisor = input.state.nodes["process-supervisor-pi"];
+    const repairArtifact = processSupervisor?.repairArtifact;
+    const disposition = repairDispositionOf(repairArtifact);
     const passRecord = await buildConvergencePassRecord({
         pass: currentPass,
         status: "retrying",
@@ -198,6 +257,36 @@ async function handleHardVerifyFailure(input, hardVerify) {
         await input.persistState();
         return { retry: false };
     }
+    // AC-002: blocked-boundary stops re-entry of same-permission repair.
+    if (disposition === "blocked-boundary") {
+        passRecord.status = "terminal";
+        passRecord.reason = "blocked-boundary";
+        convergence.passHistory.push(passRecord);
+        convergence.terminalReason = "blocked-boundary";
+        await input.persistState();
+        return { retry: false };
+    }
+    // AC-003: identical hard-verify failure fingerprint + empty repair
+    // change-manifest => no-progress early stop (does not exhaust maxFixLoops).
+    const currentFingerprint = fingerprintFromHardVerify(hardVerify);
+    const previousFailed = [...convergence.passHistory]
+        .reverse()
+        .find((pass) => pass.hardVerifyStatus === "ERROR");
+    const previousFingerprint = previousFailed
+        ? fingerprintFromPassHistory(previousFailed)
+        : undefined;
+    const changedFiles = await readRepairChangedFiles(input.runDir);
+    if (previousFingerprint !== undefined &&
+        previousFingerprint === currentFingerprint &&
+        changedFiles !== undefined &&
+        changedFiles.length === 0) {
+        passRecord.status = "terminal";
+        passRecord.reason = "no-progress";
+        convergence.passHistory.push(passRecord);
+        convergence.terminalReason = "no-progress";
+        await input.persistState();
+        return { retry: false };
+    }
     if (input.spec.convergence?.pauseOnRegression !== false &&
         detectConvergenceRegression(convergence.passHistory, passRecord)) {
         passRecord.status = "paused";
@@ -239,6 +328,14 @@ function isLegitimateReviewRequestRevision(state) {
         reviewVerdictNode?.status === "FINISHED" &&
         parseProcessVerdict(reviewVerdictNode) === "request-revision");
 }
+function isLegitimateReviewPass(state) {
+    const reviewNode = state.nodes["review-pi"];
+    const reviewVerdictNode = state.nodes[REVIEW_VERDICT_NODE_ID];
+    return (reviewNode?.status === "FINISHED" &&
+        parseProcessVerdict(reviewNode) === "pass" &&
+        reviewVerdictNode?.status === "FINISHED" &&
+        parseProcessVerdict(reviewVerdictNode) === "pass");
+}
 /**
  * Hard verification passed but the review path produced a legitimate
  * `request-revision`. With routingAccept the review gate finishes as a routing

package/dist/workflows/dag/frontend-implementation-contract.js

@@ -155,7 +155,7 @@ export const frontendImplementationContractSchema = z
             "not-needed",
         ]),
         productionDefaultOff: z.literal(true),
-        activation: z.string().min(1),
+        activation: z.preprocess((value) => (value === "" ? "explicit activation boundary" : value), z.string().min(1)),
         endpoints: z.array(z
             .object({
             method: z.enum([
@@ -168,7 +168,10 @@ export const frontendImplementationContractSchema = z
                 "OPTIONS",
             ]),
             path: z.string().startsWith("/"),
-            fixture: safePath.optional(),
+            // Models occasionally emit an empty fixture when Mock is
+            // intentionally not needed. Treat it like an omitted optional
+            // field; active Mock strategies still fail the refinement below.
+            fixture: z.preprocess((value) => (value === "" ? undefined : value), safePath.optional()),
             consumer: safePath.optional(),
         })
             .strict()),
@@ -187,7 +190,7 @@ export const frontendImplementationContractSchema = z
         type: z.enum(["static", "unit", "component", "integration", "mock"]),
         commandLabel: z.string().min(1),
         file: safePath,
-        symbol: z.string().min(1).optional(),
+        symbol: z.preprocess((value) => (value === "" ? undefined : value), z.string().min(1).optional()),
         requirementIds: z.array(id),
         uiStates: z.array(z.string().min(1)),
     })

package/dist/workflows/dag/frontend-prewrite-gate.js

@@ -46,7 +46,12 @@ function firstNonEmptyVerdictLine(text) {
     // The prompt requires VERDICT to be the first non-empty line, but model
     // output can still prepend a summary. Keep the protocol strict in the
     // prompt while making the deterministic gate resilient to that drift.
-    return normalizedLines.find((line) => /^VERDICT:/.test(line)) ?? first;
+    const verdictLine = normalizedLines.find((line) => /^VERDICT:/.test(line)) ?? first;
+    if (/^VERDICT:\s*pass(?:\s*[.!?。！？]|\s+|$)/i.test(verdictLine))
+        return "VERDICT: pass";
+    if (/^VERDICT:\s*request-revision(?:\s*[.!?。！？]|\s+|$)/i.test(verdictLine))
+        return "VERDICT: request-revision";
+    return verdictLine;
 }
 function eventArgs(event) {
     return event.args ?? event.toolInput ?? event.input ?? {};

package/dist/workflows/dag/init-hybrid.js

@@ -13,6 +13,7 @@ import { DEFAULT_READ_ONLY_PI_RETRY_POLICY, PROTOCOL_AWARE_PI_RETRY_POLICY, STRU
 import { REVIEW_JSON_VERDICT_OUTPUT_PROTOCOL, REVIEW_VERDICT_OUTPUT_PROTOCOL, } from "./output-protocol.js";
 import { resolveAdapter } from "../../adapters/index.js";
 import { loadHarnessManifest } from "../../governance/harness.js";
+import { mergeDocumentIndexCompanions } from "../../governance/document-index-closure.js";
 import { buildAuthoritySurfaceAuditNode, buildAuthoritySurfaceGateNode, resolveAuthoritySurfaceAudit, } from "./authority-surface.js";
 import { applySddEmbeddedEnhancements, probeRepoLocalSddSkills, } from "./sdd-embedded.js";
 import { discoverProjectGovernancePresence } from "./project-governance-context.js";
@@ -721,9 +722,28 @@ function mergeForbiddenPaths(taskConfig) {
     ]);
     return [...merged];
 }
-function resolveImplementPaths(taskConfig) {
+function resolveImplementPaths(taskConfig, options = {}) {
     if (taskConfig.allowedPaths.length > 0) {
         const allowed = [...taskConfig.allowedPaths];
+        const forbidden = mergeForbiddenPaths(taskConfig);
+        const repoRoot = options.repoRoot;
+        // Only consult the catalog when writer paths can touch docs/* so non-docs
+        // temp fixtures without a catalog keep working; docs writers still fail closed.
+        const mayNeedDocIndex = allowed.some((entry) => {
+            const normalized = entry.replace(/\\/g, "/").replace(/^\.\//, "");
+            return normalized === "docs" || normalized.startsWith("docs/");
+        });
+        if (repoRoot && mayNeedDocIndex) {
+            const merged = mergeDocumentIndexCompanions({
+                repoRoot,
+                paths: allowed,
+                forbiddenPaths: forbidden,
+            });
+            return {
+                allowedPaths: merged.paths,
+                writeSet: [...merged.paths],
+            };
+        }
         return {
             allowedPaths: allowed,
             writeSet: [...allowed],
@@ -786,7 +806,9 @@ function applyMavenVerificationPlanning(input) {
     if (!input.repoRoot || !input.commands || input.commands.length === 0) {
         return { commands: input.commands };
     }
-    const implement = resolveImplementPaths(input.taskConfig);
+    const implement = resolveImplementPaths(input.taskConfig, {
+        repoRoot: input.repoRoot,
+    });
     const planned = planMavenVerification({
         repoRoot: input.repoRoot,
         commands: input.commands,
@@ -1515,7 +1537,9 @@ function mergeFinalVerifyCommands(repoRoot, taskConfig, adapterCommands) {
 export function buildStandardHybridDagFromTask(sources) {
     const { taskConfig } = sources;
     const forbiddenPaths = mergeForbiddenPaths(taskConfig);
-    const implementPaths = resolveImplementPaths(taskConfig);
+    const implementPaths = resolveImplementPaths(taskConfig, {
+        repoRoot: sources.repoRoot,
+    });
     const scoutPaths = deriveParallelScoutPaths(taskConfig);
     const scoutComplexity = mapTaskComplexity(taskConfig.complexity);
     const implementComplexity = resolveWriterComplexity(taskConfig);
@@ -2076,7 +2100,9 @@ async function buildFrontendHybridDagFromTask(sources) {
         frontendMockMode: mockMode,
     };
     const forbiddenPaths = mergeForbiddenPaths(taskConfig);
-    const implementPaths = resolveImplementPaths(taskConfig);
+    const implementPaths = resolveImplementPaths(taskConfig, {
+        repoRoot: sources.repoRoot,
+    });
     const implementId = frontendImplementationNodeId();
     const mockContextBlock = resolveFrontendMockContextBlock(frontendSources);
     const capabilityContextBlock = resolveFrontendCapabilityContextBlock(frontendSources);
@@ -3600,7 +3626,7 @@ async function buildBackendTestHybridDag(sources) {
         outputContract: "Convert every final automatable Markdown case into pytest assets whose actual test function region contains the exact Case ID, preferably in the function name or docstring. Each testcase/md/<module>.md (excluding README.md) maps one-to-one to testcase/test_<module>.py; never merge or split modules. No JSON and no pytest execution.",
         subtask_prompt: [
             "Convert testcase/md/** to pytest using upstream environment and advisory validation evidence plus only bounded pytest config/conftest. A FAIL advisory report does not authorize inventing missing behavior; use the final Markdown facts that are present.",
-            "Ensure every final Markdown Case ID appears in exactly one primary pytest test function or pytest test class method region, using the exact `primary symbol` declared by Markdown. The symbol must start with `test_BE_<MODULE>_<NNN>_` so every parameterized collected item remains associated with its Case. Module-level functions and class-based pytest methods are both supported. Only `变体测试点` may use stable `pytest.param(..., id=\"TP-...\")` IDs, and every atomic variant ID must appear exactly once with a genuine input/state/outcome change. Use `pytest.param(..., id=...)` for every row; do not use decorator-level `ids=[...]`, generated suffixes, or IDs that extend/shorten the exact Markdown TP. Do not parameterize `场景断言测试点` or `横切证据测试点`; execute all assertion checkpoints within the same business journey/item and use shared helpers for cross-cutting evidence. The primary symbol docstring must contain exact metadata lines `Case-ID: BE-...`, `Assertion-Test-Points: TP-...;TP-...` and `Cross-Cutting-Test-Points: TP-...;TP-...` (use `none` when empty). No Test Point may be invented, renamed, omitted or bound in two modes. The generated pytest collection shape must equal the Markdown prediction `sum(max(1, variant count per Case))`; keep it at or below the task's explicit budget by removing duplicate execution, never by collapsing multiple parameter rows under a coarse family TP. Assertions come only from 预期结果 and setup comes only from 前置条件/测试数据/自动化映射.",
+            'Ensure every final Markdown Case ID appears in exactly one primary pytest test function or pytest test class method region, using the exact `primary symbol` declared by Markdown. The symbol must start with `test_BE_<MODULE>_<NNN>_` so every parameterized collected item remains associated with its Case. Module-level functions and class-based pytest methods are both supported. Only `变体测试点` may use stable `pytest.param(..., id="TP-...")` IDs, and every atomic variant ID must appear exactly once with a genuine input/state/outcome change. Use `pytest.param(..., id=...)` for every row; do not use decorator-level `ids=[...]`, generated suffixes, or IDs that extend/shorten the exact Markdown TP. Do not parameterize `场景断言测试点` or `横切证据测试点`; execute all assertion checkpoints within the same business journey/item and use shared helpers for cross-cutting evidence. The primary symbol docstring must contain exact metadata lines `Case-ID: BE-...`, `Assertion-Test-Points: TP-...;TP-...` and `Cross-Cutting-Test-Points: TP-...;TP-...` (use `none` when empty). No Test Point may be invented, renamed, omitted or bound in two modes. The generated pytest collection shape must equal the Markdown prediction `sum(max(1, variant count per Case))`; keep it at or below the task\'s explicit budget by removing duplicate execution, never by collapsing multiple parameter rows under a coarse family TP. Assertions come only from 预期结果 and setup comes only from 前置条件/测试数据/自动化映射.',
             "Name each generated pytest file so it corresponds one-to-one with its source Markdown module file: for each `testcase/md/<module>.md` (excluding README.md), emit exactly one `testcase/test_<module>.py`. The <module> stem is the Markdown filename without the `.md` extension, lowercased and with non-alphanumeric characters replaced by underscores. For example, `testcase/md/resource_notes.md` maps to `testcase/test_resource_notes.py`, `testcase/md/health.md` maps to `testcase/test_health.py`, `testcase/md/BE-HEALTH.md` maps to `testcase/test_be_health.py`, and `testcase/md/order-api.md` maps to `testcase/test_order_api.py`. If Markdown automation mapping names a different path than this module stem path, still write the module stem path and do not invent prefixes such as `test_be_*` unless the module filename itself normalizes to that stem. Never merge multiple Markdown modules into one pytest file, never split one module across several files, and never invent pytest filenames unrelated to the Markdown modules.",
             "Generate a reusable HTTP logging helper (or equivalent client wrapper) and call it for every interface request. The request log must include method, URL/path, and request parameters (query plus JSON/body/payload summary). The response log must include status code and response result (JSON/text/body summary), and both records must be visible in pytest stdout/stderr without changing assertions.",
             "HTTP response header names are case-insensitive. If the helper stores a lower-case normalized header map, every Content-Type or other header assertion must query the lower-case key (for example `content-type`) or use an explicitly case-insensitive accessor; never call a case-sensitive plain dict with `Content-Type` when the stored key is lower-case. Preserve the actual media-type assertion rather than dropping it.",
@@ -4139,12 +4165,20 @@ function buildFrontendTestHybridDag(sources) {
         forbiddenPaths: forbidden,
         outputContract: "Deterministic frontend L-5 Markdown and self-contained HTML dashboard derived only from frontend-test-result-v1.",
         subtask_prompt: "Render the authoritative frontend L-5 report from frontend-test-result-v1. Do not use Pi prose or invent code coverage. Missing line/branch coverage remains unavailable and makes L-5 NOT READY.",
-        shell: { frontendTestL5Report: {}, commands: [], cwd: ".", timeoutMs: 120000 },
+        shell: {
+            frontendTestL5Report: {},
+            commands: [],
+            cwd: ".",
+            timeoutMs: 120000,
+        },
     });
     if (strictOutcomeGate) {
         tasks.push({
             id: "frontend-test-result-outcome-gate-shell",
-            depends_on: ["materialize-frontend-test-result-shell", "frontend-test-l5-report-shell"],
+            depends_on: [
+                "materialize-frontend-test-result-shell",
+                "frontend-test-l5-report-shell",
+            ],
             role: "verifier",
             executor: "shell",
             complexity: "LOW",
@@ -4162,7 +4196,10 @@ function buildFrontendTestHybridDag(sources) {
     }
     tasks.push({
         id: "frontend-test-retrospect-pi",
-        depends_on: ["materialize-frontend-test-result-shell", "frontend-test-l5-report-shell"],
+        depends_on: [
+            "materialize-frontend-test-result-shell",
+            "frontend-test-l5-report-shell",
+        ],
         role: "closeout",
         executor: "pi",
         toolProfile: "write",
@@ -5393,7 +5430,7 @@ function buildReviewVerdictRecoveryNode(sources) {
         writePolicy: "read-only",
         allowedPaths: commonReadOnlyPaths(sources),
         forbiddenPaths: commonForbiddenPaths(sources),
-        outputContract: 'Structured JSON review verdict only, preserving the original review conclusion/findings without substantive changes. No file writes.',
+        outputContract: "Structured JSON review verdict only, preserving the original review conclusion/findings without substantive changes. No file writes.",
         outputProtocol: REVIEW_JSON_VERDICT_OUTPUT_PROTOCOL,
         subtask_prompt: [
             "Normalize the output format of review-pi; this is the single read-only format-recovery attempt for the review verdict protocol.",
@@ -5748,8 +5785,9 @@ function buildProcessSupervisorNode(sources) {
             "Supervise the implementation process after soft verification.",
             "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.",
             "Immediately after the verdict, include one fenced block labelled REPAIR_ARTIFACT_JSON with this JSON shape:",
-            '{"schemaVersion":1,"verdict":"pass|request-revision","failureClass":"syntax|runtime|logic|boundary|environment|governance|unknown","rootCause":"one concise reason","fixScope":["path/or/component"],"invariant":"behavior or contract to preserve","evidenceRefs":["relative/path/or/node"],"rawLogFallbackAllowed":false}',
+            '{"schemaVersion":1,"verdict":"pass|request-revision","failureClass":"syntax|runtime|logic|boundary|environment|governance|unknown","rootCause":"one concise reason","fixScope":["path/or/component"],"invariant":"behavior or contract to preserve","evidenceRefs":["relative/path/or/node"],"rawLogFallbackAllowed":false,"disposition":"repairable|blocked-boundary|no-op-pass","requiredScope":["out-of-boundary/path"]}',
             `For request-revision, fixScope must be inside ${repairId} allowedPaths/writeSet. For pass, use an empty fixScope array.`,
+            "disposition defaults to repairable when omitted (backward compatible). Use blocked-boundary when the needed fix is outside repair write authority; put the out-of-boundary paths in requiredScope (report-only, never expands write authority). Use no-op-pass only when no code change is warranted.",
             `Audit boundary drift, verification gaps, and whether ${repairId} should perform bounded fixes. Read-only: do not modify files.`,
             buildSourceContextBlock(sources),
         ].join("\n\n"),
@@ -5785,7 +5823,9 @@ function buildProcessGateNode(sources) {
     };
 }
 function buildRepairNode(sources) {
-    const implement = resolveImplementPaths(sources.taskConfig);
+    const implement = resolveImplementPaths(sources.taskConfig, {
+        repoRoot: sources.repoRoot,
+    });
     return {
         id: repairNodeId(),
         depends_on: ["process-gate-shell", "process-supervisor-pi"],