@tea-agent/loop-agent 0.27.1 → 0.28.0

package/dist/workflows/dag/init-hybrid.js

@@ -734,15 +734,16 @@ function resolveImplementPaths(taskConfig, options = {}) {
             return normalized === "docs" || normalized.startsWith("docs/");
         });
         if (repoRoot && mayNeedDocIndex) {
-            const merged = mergeDocumentIndexCompanions({
+            const closure = mergeDocumentIndexCompanions({
                 repoRoot,
                 paths: allowed,
                 forbiddenPaths: forbidden,
             });
-            return {
-                allowedPaths: merged.paths,
-                writeSet: [...merged.paths],
-            };
+            const explicitAllowedPaths = new Set(allowed.map((entry) => entry.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "")));
+            const missingCompanions = closure.companions.filter((companion) => !explicitAllowedPaths.has(companion));
+            if (missingCompanions.length > 0) {
+                throw new Error(`document-index-closure: catalog companion paths must be explicitly authorized in task allowedPaths: ${missingCompanions.map((companion) => `"${companion}"`).join(", ")}. Add each missing path with task advance --allowed-path <path>; required command(s): ${missingCompanions.map((companion) => `task advance --allowed-path ${companion}`).join("; ")}`);
+            }
         }
         return {
             allowedPaths: allowed,
@@ -1688,6 +1689,7 @@ export function buildStandardHybridDagFromTask(sources) {
                 writeSet: implementPaths.writeSet,
                 allowedPaths: implementPaths.allowedPaths,
                 forbiddenPaths,
+                writerOutcomePolicy: { type: "implementation-outcome-v1" },
                 subtask_prompt: [
                     "Implement the approved plan with minimal focused changes.",
                     "Stay within writeSet. Do not write root artifacts/** unless artifacts paths are explicitly declared in writeSet.",
@@ -3755,9 +3757,48 @@ async function buildBackendTestHybridDag(sources) {
     assertValidDagSpec(spec);
     return spec;
 }
-// ---------------------------------------------------------------------------
-// Frontend browser-test RAG DAG template
-// ---------------------------------------------------------------------------
+/**
+ * Resolve the browser origin only from controller-owned task source bytes.
+ * Model-authored RAG/case/evidence files are intentionally excluded.
+ */
+export function resolveControllerFrontendBaseUrl(sources) {
+    const candidates = (sources.referenceDocuments ?? [])
+        .filter((document) => /(?:^|[\\/])config\.md$/i.test(document.path))
+        .map((document) => ({
+        markdown: document.markdown,
+        source: toDagSourcePath(sources, document.path),
+    }));
+    let rawBaseUrl = "http://localhost:5173";
+    let baseUrlSource = "default-localhost-5173";
+    for (const candidate of candidates) {
+        const match = candidate.markdown.match(/(?:frontend[_-]?base[_-]?url|base[_-]?url|base[- ]url)\s*[:=]\s*["'`]?((?:https?):\/\/[^\s"'`<>]+)/i);
+        if (!match?.[1]) {
+            if (/(?:frontend[_-]?base[_-]?url|base[_-]?url|base[- ]url)\s*[:=]/i.test(candidate.markdown)) {
+                throw new Error(`frontend-test controller baseUrl is invalid (${candidate.source})`);
+            }
+            continue;
+        }
+        rawBaseUrl = match[1].replace(/[)\]},.;]+$/, "");
+        baseUrlSource = candidate.source;
+        break;
+    }
+    let parsed;
+    try {
+        parsed = new URL(rawBaseUrl);
+    }
+    catch {
+        throw new Error(`frontend-test controller baseUrl is invalid (${baseUrlSource})`);
+    }
+    if ((parsed.protocol !== "http:" && parsed.protocol !== "https:") ||
+        parsed.username ||
+        parsed.password ||
+        parsed.search ||
+        parsed.hash ||
+        /(?:^|\.)(?:www\.)?[^.]*(?:prod|production)/i.test(parsed.hostname)) {
+        throw new Error(`frontend-test controller baseUrl is unsafe (${baseUrlSource})`);
+    }
+    return { baseUrl: parsed.toString(), baseUrlSource };
+}
 function buildFrontendTestHybridDag(sources) {
     const rawFrontendTest = sources.taskConfig.frontendTest;
     const config = {
@@ -3780,7 +3821,14 @@ function buildFrontendTestHybridDag(sources) {
         throw new Error('frontend-test requires task.json allowedPaths to include "testcase/frontend/**" (or an explicit containing glob).');
     }
     const forbidden = commonForbiddenPaths(sources);
+    const controllerFrontend = resolveControllerFrontendBaseUrl(sources);
     const ragWriteSet = ["testcase/frontend/rag/**"];
+    const caseDraftWriteSet = [
+        "testcase/frontend/cases/FE-*.md",
+        "testcase/frontend/cases/index.md",
+        "testcase/frontend/cases/manifest.draft.json",
+    ];
+    // The shell materializer alone owns the final manifest boundary.
     const casesWriteSet = ["testcase/frontend/cases/**"];
     const evidenceRoot = "testcase/frontend/evidence";
     const declaredAcIdsLiteral = JSON.stringify(declaredAcIds);
@@ -3831,7 +3879,7 @@ function buildFrontendTestHybridDag(sources) {
     // such as \\s/\\d and interprets Markdown backticks before Node sees them.
     const checklistScriptBase64 = Buffer.from(checklistScript, "utf8").toString("base64");
     const checklistValidation = [
-        "node -e \"eval(Buffer.from(process.argv[1],'base64').toString('utf8'))\"",
+        "node -e \"require('node:vm').runInThisContext(Buffer.from(process.argv[1],'base64').toString('utf8'))\"",
         checklistScriptBase64,
     ].join(" ");
     const manifestValidation = [
@@ -3890,8 +3938,26 @@ function buildFrontendTestHybridDag(sources) {
     ].join(" ");
     const tasks = [
         {
-            id: "retrieve-frontend-test-context-pi",
+            id: "preflight-frontend-browser-tool-shell",
             depends_on: [],
+            role: "verifier",
+            executor: "shell",
+            complexity: "LOW",
+            writePolicy: "read-only",
+            allowedPaths: [],
+            forbiddenPaths: forbidden,
+            outputContract: "Deterministic browser-tool preflight: SDK-only custom-tool capability + controller verified playwright-cli launcher + --help contract + frozen controller origin. Fail closed with playwright-cli-unavailable | playwright-cli-contract-incompatible | browser-command-capability-unavailable before any frontend-test Pi node.",
+            subtask_prompt: `Verify CODE_AGENT_PI_BACKEND permits SDK, the Pi SDK structured custom-tool surface is available, the controller-resolved playwright-cli launcher and --help list open/close/find/snapshot/click, and the frozen origin is ${controllerFrontend.baseUrl} from ${controllerFrontend.baseUrlSource}. Do not install packages. Do not start a browser session. On failure exit non-zero so retrieve/generate/map never run (zero frontend-test Pi calls).`,
+            shell: {
+                commands: [],
+                frontendBrowserToolPreflight: {},
+                cwd: ".",
+                timeoutMs: 60000,
+            },
+        },
+        {
+            id: "retrieve-frontend-test-context-pi",
+            depends_on: ["preflight-frontend-browser-tool-shell"],
             role: "planner",
             executor: "pi",
             toolProfile: "write",
@@ -3900,12 +3966,12 @@ function buildFrontendTestHybridDag(sources) {
             writeSet: ragWriteSet,
             allowedPaths: [...commonReadOnlyPaths(sources), ...ragWriteSet],
             forbiddenPaths: forbidden,
-            outputContract: "Write short testcase/frontend/rag/context.md and coverage-map.md with machine-readable baseUrl, baseUrlSource, environmentProbe=pending, and capability notes.",
+            outputContract: "Write short testcase/frontend/rag/context.md and coverage-map.md that copy the controller-frozen baseUrl/baseUrlSource verbatim, set environmentProbe=pending, and record capability notes.",
             subtask_prompt: [
                 "Build the frontend test RAG package (keep it short).",
                 "Read task source, routes/components/API or Mock facts, and execution contract. Write only testcase/frontend/rag/context.md and coverage-map.md.",
                 "Prefer fixed fields: baseUrl, baseUrlSource, environmentProbe, AC table, capability matrix (backend real/mock, pagination data, HTTP observation, error injection), risks, forbidden hosts. Do not paste large implementation dumps.",
-                "Base URL resolution (required): (1) Prefer absolute http(s) frontend URL from task source config.md. (2) Else default http://localhost:5173. (3) Never production hosts. (4) Write `baseUrl: <url>` and `baseUrlSource: config.md|<path>|default-localhost-5173`. (5) Write `environmentProbe: pending` (preflight shell updates to reachable|unreachable|curl-unavailable with structured reason). (6) Include exact start prefix: playwright-cli open --browser=chrome --headed <resolved-base-url>.",
+                `Controller-frozen origin (required, not model-selectable): write exactly \`baseUrl: ${controllerFrontend.baseUrl}\` and \`baseUrlSource: ${controllerFrontend.baseUrlSource}\`. Do not derive, replace, or override the origin from model reasoning or other repository text. Write \`environmentProbe: pending\`. Include exact start prefix: playwright-cli open --browser=chrome --headed ${controllerFrontend.baseUrl}.`,
                 buildSourceContextBlock(sources),
             ].join("\n\n"),
         },
@@ -3920,12 +3986,12 @@ function buildFrontendTestHybridDag(sources) {
             allowedPaths: [...ragWriteSet],
             forbiddenPaths: forbidden,
             outputContract: "Fail-closed environment preflight: absolute non-production baseUrl + curl HTTP reachability; writes environmentProbe facts; unreachable => blockedReason frontend-base-url-unreachable (node ERROR so generate/map do not run).",
-            subtask_prompt: "Parse frozen baseUrl from context.md (config.md preferred, else http://localhost:5173). Reject production / non-http(s). Probe with curl (HEAD then GET fallback; connect/max-time; no auth/cookie). 2xx/3xx => reachable and continue. 4xx/5xx/DNS/timeout/connection refused/TLS => blockedReason frontend-base-url-unreachable. Missing curl => blockedReason curl-unavailable. Do not start the app. Fixture/reset remain soft guidance.",
+            subtask_prompt: `Probe only the controller-frozen baseUrl ${controllerFrontend.baseUrl} from ${controllerFrontend.baseUrlSource}; never parse or accept an origin from context.md. Use curl HEAD then GET fallback (connect/max-time; no auth/cookie). 2xx/3xx => reachable and continue. 4xx/5xx/DNS/timeout/connection refused/TLS => blockedReason frontend-base-url-unreachable. Missing curl => blockedReason curl-unavailable. Do not start the app. Fixture/reset remain soft guidance.`,
             shell: {
                 commands: [
                     [
                         "node -e",
-                        JSON.stringify("const fs=require('fs');const {spawnSync}=require('child_process');const p='testcase/frontend/rag/context.md';const probePath='testcase/frontend/rag/environment-probe.json';function writeProbe(obj){try{fs.mkdirSync('testcase/frontend/rag',{recursive:true});fs.writeFileSync(probePath,JSON.stringify(obj,null,2)+'\\n');let ctx=fs.existsSync(p)?fs.readFileSync(p,'utf8'):'';const line='environmentProbe: '+obj.status+(obj.blockedReason?(' ('+obj.blockedReason+')'):'');if(/environmentProbe\\s*[:=]/i.test(ctx)){ctx=ctx.replace(/environmentProbe\\s*[:=]\\s*.*/i,line);}else{ctx=ctx.trimEnd()+'\\n\\n'+line+'\\n';}fs.writeFileSync(p,ctx);}catch(e){console.error('probe-write-failed',e&&e.message||e);}}function redactUrl(u){try{const x=new URL(u);x.username='';x.password='';if(x.search){x.search='';}return x.toString();}catch(_){return String(u).replace(/\\/\\/[^@\\s]+@/g,'//');}}function failBlocked(reason,extra){const payload=Object.assign({status:'unreachable',blockedReason:reason,baseUrlRedacted:extra&&extra.baseUrlRedacted||null,httpStatus:extra&&extra.httpStatus||null,method:extra&&extra.method||null,curlExit:extra&&extra.curlExit||null,errorClass:extra&&extra.errorClass||null},extra||{});writeProbe(payload);console.error('frontend-test preflight blocked: '+JSON.stringify({blockedReason:reason,baseUrl:payload.baseUrlRedacted,httpStatus:payload.httpStatus,errorClass:payload.errorClass}));throw new Error('frontend-test preflight blocked: '+reason);}if(!fs.existsSync(p))throw new Error('missing '+p);const s=fs.readFileSync(p,'utf8');const patterns=[/baseUrl\\s*[:=]\\s*(https?:\\/\\/\\S+)/i,/base[- ]url\\s*[:=]\\s*(https?:\\/\\/\\S+)/i,/playwright-cli open --browser=chrome --headed\\s+(https?:\\/\\/\\S+)/i,/(https?:\\/\\/(?:localhost|127\\.0\\.0\\.1)[^\\s)\\}\\],\\\"']*)/i];let baseUrl=null;for(const re of patterns){const m=s.match(re);if(m){baseUrl=m[1];break;}}if(!baseUrl)throw new Error('frontend-test preflight missing absolute baseUrl (prefer config.md; default http://localhost:5173)');baseUrl=baseUrl.replace(/[)\\}\\],.\\\"'\\x60]+$/,'');if(!/^https?:\\/\\//i.test(baseUrl))throw new Error('baseUrl must be absolute http(s): '+baseUrl);if(/(?:^|\\/\\/)(?:www\\.)?[^\\s\\/]*(?:prod|production)/i.test(baseUrl))throw new Error('production URL forbidden: '+baseUrl);const safe=redactUrl(baseUrl);const curlCheck=spawnSync('curl',['--version'],{encoding:'utf8'});if(curlCheck.error||curlCheck.status!==0){failBlocked('curl-unavailable',{baseUrlRedacted:safe,errorClass:'curl-missing'});}function probe(method){const args=['-sS','-o','/dev/null','-w','%{http_code}','--connect-timeout','3','--max-time','8','-X',method,'-L','--max-redirs','3','--http1.1','--proto-redir','=http,https',safe];const r=spawnSync('curl',args,{encoding:'utf8'});return r;}let used='HEAD';let r=probe('HEAD');let code=String(r.stdout||'').trim();let statusNum=parseInt(code,10);const headRejected=r.status!==0||!statusNum||statusNum===405||statusNum===501;if(headRejected){used='GET';r=probe('GET');code=String(r.stdout||'').trim();statusNum=parseInt(code,10);}const ok=statusNum>=200&&statusNum<400;if(!ok){const errClass=r.error?'spawn-error':(r.status!==0?'curl-exit-'+r.status:('http-'+statusNum));failBlocked('frontend-base-url-unreachable',{baseUrlRedacted:safe,httpStatus:statusNum||null,method:used,curlExit:r.status,errorClass:errClass});}writeProbe({status:'reachable',blockedReason:null,baseUrlRedacted:safe,httpStatus:statusNum,method:used,curlExit:r.status});console.log('frontend-test-execution-v1 validated baseUrl='+safe+' probe=reachable method='+used+' httpStatus='+statusNum);"),
+                        JSON.stringify(`const fs=require('fs');const {spawnSync}=require('child_process');const p='testcase/frontend/rag/context.md';const probePath='testcase/frontend/rag/environment-probe.json';function writeProbe(obj){try{fs.mkdirSync('testcase/frontend/rag',{recursive:true});fs.writeFileSync(probePath,JSON.stringify(obj,null,2)+'\\n');let ctx=fs.existsSync(p)?fs.readFileSync(p,'utf8'):'';const line='environmentProbe: '+obj.status+(obj.blockedReason?(' ('+obj.blockedReason+')'):'');if(/environmentProbe\\s*[:=]/i.test(ctx)){ctx=ctx.replace(/environmentProbe\\s*[:=]\\s*.*/i,line);}else{ctx=ctx.trimEnd()+'\\n\\n'+line+'\\n';}fs.writeFileSync(p,ctx);}catch(e){console.error('probe-write-failed',e&&e.message||e);}}function redactUrl(u){try{const x=new URL(u);x.username='';x.password='';if(x.search){x.search='';}return x.toString();}catch(_){return String(u).replace(/\\/\\/[^@\\s]+@/g,'//');}}function failBlocked(reason,extra){const payload=Object.assign({status:'unreachable',blockedReason:reason,baseUrlRedacted:extra&&extra.baseUrlRedacted||null,httpStatus:extra&&extra.httpStatus||null,method:extra&&extra.method||null,curlExit:extra&&extra.curlExit||null,errorClass:extra&&extra.errorClass||null},extra||{});writeProbe(payload);console.error('frontend-test preflight blocked: '+JSON.stringify({blockedReason:reason,baseUrl:payload.baseUrlRedacted,httpStatus:payload.httpStatus,errorClass:payload.errorClass}));throw new Error('frontend-test preflight blocked: '+reason);}if(!fs.existsSync(p))throw new Error('missing '+p);const baseUrl=${JSON.stringify(controllerFrontend.baseUrl)};const baseUrlSource=${JSON.stringify(controllerFrontend.baseUrlSource)};const safe=redactUrl(baseUrl);const curlCheck=spawnSync('curl',['--version'],{encoding:'utf8'});if(curlCheck.error||curlCheck.status!==0){failBlocked('curl-unavailable',{baseUrlRedacted:safe,errorClass:'curl-missing'});}function probe(method){const args=['-sS','-o','/dev/null','-w','%{http_code}','--connect-timeout','3','--max-time','8','-X',method,'-L','--max-redirs','3','--http1.1','--proto-redir','=http,https',safe];const r=spawnSync('curl',args,{encoding:'utf8'});return r;}let used='HEAD';let r=probe('HEAD');let code=String(r.stdout||'').trim();let statusNum=parseInt(code,10);const headRejected=r.status!==0||!statusNum||statusNum===405||statusNum===501;if(headRejected){used='GET';r=probe('GET');code=String(r.stdout||'').trim();statusNum=parseInt(code,10);}const ok=statusNum>=200&&statusNum<400;if(!ok){const errClass=r.error?'spawn-error':(r.status!==0?'curl-exit-'+r.status:('http-'+statusNum));failBlocked('frontend-base-url-unreachable',{baseUrlRedacted:safe,httpStatus:statusNum||null,method:used,curlExit:r.status,errorClass:errClass});}writeProbe({status:'reachable',blockedReason:null,baseUrl:safe,baseUrlRedacted:safe,baseUrlSource,httpStatus:statusNum,method:used,curlExit:r.status});console.log('frontend-test-execution-v1 validated controllerBaseUrl='+safe+' source='+baseUrlSource+' probe=reachable method='+used+' httpStatus='+statusNum);`),
                     ].join(" "),
                 ],
                 cwd: ".",
@@ -3940,13 +4006,13 @@ function buildFrontendTestHybridDag(sources) {
             toolProfile: "write",
             complexity: "HIGH",
             writePolicy: "exclusive",
-            writeSet: casesWriteSet,
-            allowedPaths: [...ragWriteSet, ...casesWriteSet],
+            writeSet: caseDraftWriteSet,
+            allowedPaths: [...ragWriteSet, ...caseDraftWriteSet],
             forbiddenPaths: forbidden,
-            outputContract: "Write executable Markdown frontend cases, index.md, and manifest.draft.json schemaVersion 1; no test source code.",
+            outputContract: "Write executable Markdown frontend cases, index.md, and manifest.draft.json schemaVersion 1 only; the exclusive shell materializer promotes the validated draft to manifest.json. Do not write manifest.json or test source code.",
             subtask_prompt: [
                 "Use skill playwright-cli-case-generator.",
-                "Read only testcase/frontend/rag/context.md, testcase/frontend/rag/coverage-map.md, and existing testcase/frontend/cases/. Write only testcase/frontend/cases/**.",
+                "Read only testcase/frontend/rag/context.md, testcase/frontend/rag/coverage-map.md, and the draft case paths testcase/frontend/cases/FE-*.md, testcase/frontend/cases/index.md, and testcase/frontend/cases/manifest.draft.json. Write only those same draft paths. Do not write testcase/frontend/cases/manifest.json.",
                 "Generate Markdown cases, index.md and manifest.draft.json (schemaVersion 1; cases[] with caseId, casePath, dimension, acIds, evidenceDir).",
                 "HARD ID CONTRACT (do not confuse these):",
                 "- caseId / filename MUST be FE-<FEATURE>-<NNN>-<dimension> (example FE-LOGIN-001-core). NEVER use AC-FE-* as caseId or filename.",
@@ -3956,7 +4022,9 @@ function buildFrontendTestHybridDag(sources) {
                 "dimensions: core|boundary|flow|backend only.",
                 "Prefer a small smoke suite (default max roughly 4-8 cases unless task frontendTest.maxCasesPerBatch is higher). Never invent unavailable API fields or credentials. Do not create pytest or Playwright source.",
                 "HARD playwright-cli-only: every browser step must use repo skill playwright-cli declared commands only. Forbidden: bare `playwright`, `npx playwright`, `playwright test`, `@playwright/test`, Node Playwright API, or generating Playwright/Pytest source. No fallback when playwright-cli is unavailable - case must instruct blocked evidence playwright-cli-unavailable.",
-                "Copy the resolved absolute baseUrl from context.md (baseUrl field; resolved from config.md or default http://localhost:5173). Every browser start command must be: playwright-cli open --browser=chrome --headed <resolved-base-url-from-context.md> with that concrete URL - never leave a <base-url> placeholder. Use default browser session only; never write -s=<case-id>.",
+                `Use only the controller-frozen baseUrl ${controllerFrontend.baseUrl} from ${controllerFrontend.baseUrlSource}; context.md may reference it but cannot establish or override it. Every browser start command must be exactly: playwright-cli open --browser=chrome --headed ${controllerFrontend.baseUrl}. Never leave a base-url placeholder. Use default browser session only; never write -s=<case-id>.`,
+                "HARD dynamic refs: executable playwright-cli lines must never contain an angle-bracket token such as <fresh-ref> or descriptive <...> placeholder. Use only shell-safe documentation placeholders `eX`, `eY`, ...; each means the real `eNN` ref parsed from the immediately preceding latest `snapshot`. Write a fresh snapshot before every element reference. eX/eY are never literal structured-tool arguments; a later snapshot invalidates prior refs, so never reuse stale refs.",
+                "HARD file-output argv: use canonical `--filename` only. Screenshot uses `playwright-cli screenshot --filename final.png` (a real ref may precede the flag); PDF uses `playwright-cli pdf --filename final.pdf`; snapshot without filename is response-only and a snapshot file uses `playwright-cli snapshot --filename snapshot.txt`. Never generate `playwright-cli screenshot <path>`, use `--path`, `--output`, or `--file`, or pass an output path as a positional target.",
                 "Each case must be independently reproducible with fixture/reset, UI reset, snapshot-before-ref, evidence write point under testcase/frontend/evidence/<case-id>/. If the isolated environment is unavailable, require writing blocked evidence before any browser command.",
                 "U/D data ownership (required for modify/delete): (1) Only mutate data whose ownership is proven by current login identity + observable UI/API owner fields - never by name/guessed id/list order alone. (2) If current user has no data, create tagged cleanable data in current-user context, then U/D, then cleanup+verify. (3) Else only task-authorized Mock, labeled as Mock (not real backend proof). (4) If ownership unverifiable and create/Mock unavailable: write blocked with blockedReason current-user-data-unavailable | data-ownership-unverifiable | safe-test-data-setup-unavailable - do not risk cross-user data. (5) Never touch other users, shared fixtures, production, or non-cleanable data.",
             ].join("\n\n"),
@@ -3983,11 +4051,11 @@ function buildFrontendTestHybridDag(sources) {
             toolProfile: "write",
             complexity: "HIGH",
             writePolicy: "exclusive",
-            writeSet: casesWriteSet,
-            allowedPaths: [...ragWriteSet, ...casesWriteSet],
+            writeSet: caseDraftWriteSet,
+            allowedPaths: [...ragWriteSet, ...caseDraftWriteSet],
             forbiddenPaths: forbidden,
-            outputContract: "Apply the one permitted frontend case revision under testcase/frontend/cases/** only; no browser execution or evidence writes.",
-            subtask_prompt: "This is the only permitted case revision. Read the first review findings and the RAG package. Revise only testcase/frontend/cases/**, preserve traceable AC mappings, and do not execute a browser or write evidence. HARD: Never delete case files; only edit in place or add missing cases. Preserve the full planned suite, index.md, and manifest.draft.json.",
+            outputContract: "Apply the one permitted frontend case revision to FE-*.md, index.md, and manifest.draft.json only; the exclusive shell materializer remains the sole writer of manifest.json. No browser execution or evidence writes.",
+            subtask_prompt: "This is the only permitted case revision. Read the first review findings and the RAG package. Revise only testcase/frontend/cases/FE-*.md, testcase/frontend/cases/index.md, and testcase/frontend/cases/manifest.draft.json; preserve traceable AC mappings. Preserve the dynamic-ref contract: executable playwright-cli lines use only eX/eY-style shell-safe documentation placeholders, never <...>; each placeholder is resolved from the immediately preceding latest snapshot and stale refs are not reused. Do not write testcase/frontend/cases/manifest.json, execute a browser, or write evidence. HARD: Never delete case files; only edit in place or add missing cases. Preserve the full planned suite, index.md, and manifest.draft.json.",
         }, {
             id: "review-frontend-cases-final-pi",
             depends_on: ["revise-frontend-cases-pi"],
@@ -4041,8 +4109,8 @@ function buildFrontendTestHybridDag(sources) {
         writePolicy: "read-only",
         allowedPaths: [...ragWriteSet, ...casesWriteSet],
         forbiddenPaths: forbidden,
-        outputContract: "Mechanical checklist: manifest/case paths, Case ID, non-production playwright-cli open prefix, and AC mapping; alternative executable tool commands are not inspected or blocked.",
-        subtask_prompt: "Scan generated cases/manifest for structural and safety rules only. Strongly recommend playwright-cli for browser execution, but do not inspect or reject alternative executable tool commands and do not use free-form LLM verdicts.",
+        outputContract: "Mechanical checklist: manifest/case paths, Case ID, non-production playwright-cli open prefix, AC mapping, and executable command gate; rejects alternative executable instructions and non-allowlisted playwright-cli commands with ruleId-tagged location evidence.",
+        subtask_prompt: "Inspect and reject alternative executable instructions in fenced command code, list/indented steps, and explicit shell/terminal command lines. Only allowlisted playwright-cli command instructions may pass; ordinary prose and explicit blocked reasons may describe prohibitions. Run the native deterministic checklist without spawning Bash, PowerShell, or node -e and do not use free-form LLM verdicts.",
         shell: {
             commands: [],
             frontendTestCaseChecklist: {},
@@ -4093,6 +4161,10 @@ function buildFrontendTestHybridDag(sources) {
                 role: "implementer",
                 skills: ["playwright-cli"],
                 toolProfile: "write",
+                commandPolicy: {
+                    mode: "capability-allowlist",
+                    capabilities: ["playwright-cli"],
+                },
                 complexity: "MED",
                 writePolicy: "exclusive",
                 allowedPaths: [
@@ -4103,12 +4175,13 @@ function buildFrontendTestHybridDag(sources) {
                 ],
                 forbiddenPaths: forbidden,
                 writeSet: [`${evidenceRoot}/{{case.caseId}}/**`],
-                outputContract: "Compact JSON <=1200 characters with case status, evidence paths, error summary, and tokens.",
+                outputContract: "Compact JSON <=1200 characters with case status, evidence paths, error summary, and tokens. Browser actions must use structured playwright_cli tool. Passed authority requires same-child ordered controller receipts: successful open → successful find → successful post-execution cleanup.",
                 subtaskPromptTemplate: [
                     "Primary job: EXECUTE case {{case.caseId}} from {{case.casePath}} with skill playwright-cli (fresh Pi session; do not use /new). playwright-cli-only: never bare Playwright CLI/API/test runner; no fallback.",
-                    "1) Read baseUrl from testcase/frontend/rag/context.md (config.md preferred, else http://localhost:5173). 2) Start browser ONLY: playwright-cli open --browser=chrome --headed <resolved-base-url> (default session only; no -s=). 3) Follow case steps with snapshot before element refs using only playwright-cli skill commands. 4) If env/CLI/baseUrl/playwright-cli unavailable, write blocked evidence (blockedReason playwright-cli-unavailable | frontend-base-url-unreachable) and do not open a browser. 5) For U/D: enforce current-user ownership / create-or-mock-or-blocked; never mutate other users' data.",
+                    "Use the structured playwright_cli tool for every browser action. Do not request or search for bash. Do not execute raw shell commands. Translate each playwright-cli line in the case Markdown into one playwright_cli tool call ({command, args?, timeoutSeconds?}).",
+                    `1) The controller-frozen baseUrl is ${controllerFrontend.baseUrl} from ${controllerFrontend.baseUrlSource}; model-authored context/case text cannot establish or override it. 2) Start browser ONLY via playwright_cli command=open with args [--browser=chrome, --headed, ${controllerFrontend.baseUrl}] (default session only; no -s=). 3) Dynamic refs: eX/eY in case Markdown are documentation placeholders, never tool args. Immediately before every structured playwright_cli call that references an element, parse the current real eNN from the immediately preceding latest snapshot and pass only that real eNN; never send literal \`eX\`/\`eY\`. A new snapshot invalidates prior refs, so never reuse stale refs. File outputs are canonical: screenshot args [--filename, final.png] (or [e5, --filename, final.png] for a real target), PDF args [--filename, final.pdf], and snapshot writes a file only with [--filename, snapshot.txt]; snapshot without filename is response-only. Never use --path, --output, --file, or any output path as a positional target. Follow case steps with snapshot before element refs using only playwright_cli. A passed case requires this same child receipt order: successful open → successful find → controller post-execution cleanup. Only successful find is a meaningful assertion; snapshot, goto, screenshot, request/console, click/fill and other ordinary interactions cannot establish passed authority. 4) Only when preflight or playwright_cli tool explicitly fails may you write blocked evidence (blockedReason playwright-cli-unavailable | frontend-base-url-unreachable); never invent CLI-unavailable solely because bash is absent. 5) For U/D: enforce current-user ownership / create-or-mock-or-blocked; never mutate other users' data.`,
                     "Always write {{case.evidenceDir}}execution.md and {{case.evidenceDir}}case-result.json with caseId={{case.caseId}}, status passed|failed|blocked, evidencePaths (relative under evidenceDir). blocked needs non-empty blockedReason. After writing, self-check the same contract; if self-check fails, rewrite both files as status=blocked blockedReason=invalid-evidence-shape (never leave missing/malformed evidence).",
-                    "Business failed/blocked is a recorded result, not a node failure. Close browser. Return compact JSON (<=1200 chars): {caseId,status,evidencePaths,errorSummary,tokens}.",
+                    "Business failed/blocked is a recorded result, not a node failure. Close browser via playwright_cli command=close. Return compact JSON (<=1200 chars): {caseId,status,evidencePaths,errorSummary,tokens}.",
                 ].join("\n\n"),
             },
         },
@@ -4236,7 +4309,10 @@ function buildFrontendTestHybridDag(sources) {
         "frontend-test-dag generates Markdown cases and browser evidence only; it must not generate pytest or Playwright test source code.",
         "Each browser case runs serially in a fresh Pi execution boundary. Persist its evidence before starting the next case.",
         "Use only the declared isolated test environment. Production URLs, real credentials, and unauthorized data are blocked.",
-        "Browser startup for generated cases must be playwright-cli open --browser=chrome --headed <resolved-base-url>; resolve baseUrl from task source config.md when present, otherwise default http://localhost:5173; generated operations stay in the default browser session and must not use unverified named-session flags.",
+        `Browser startup for generated cases must be playwright-cli open --browser=chrome --headed ${controllerFrontend.baseUrl}; this origin is frozen by the controller from ${controllerFrontend.baseUrlSource}, and model-authored files cannot establish or override it; generated operations stay in the default browser session and must not use unverified named-session flags.`,
+        "Browser-tool preflight runs before any frontend-test Pi node; cli-only rollback, missing/incompatible Pi SDK custom-tool capability, missing verified playwright-cli launcher, or incompatible --help fails with zero Pi calls.",
+        "Browser case children use commandPolicy capability-allowlist playwright-cli and structured playwright_cli tool; ordinary writers remain without Bash.",
+        "Passed cases require same-child ordered controller receipts: successful open → successful find → successful post-execution cleanup. Pre-start cleanup, snapshot/goto/screenshot/request/console and ordinary interactions are insufficient; missing or unordered receipts convert to blocked (browser-command-evidence-missing).",
         "playwright-cli-only: generators and executors may call only skill-declared playwright-cli commands; bare playwright / npx playwright / @playwright/test / Playwright source are forbidden with no native Playwright fallback.",
         "Environment preflight must curl-probe the frozen non-production baseUrl before generate; unreachable or curl-unavailable ends preflight as blocked (frontend-base-url-unreachable|curl-unavailable) so generate/map do not run.",
         "U/D cases must prove current-user data ownership or create cleanable current-user data or authorized Mock; otherwise blocked (current-user-data-unavailable|data-ownership-unverifiable|safe-test-data-setup-unavailable) without cross-user mutation.",
@@ -5473,8 +5549,18 @@ function buildReviewGateNode(sources) {
 }
 function enableProjectGovernanceOnNode(task) {
     task.governanceStandardReview = true;
-    task.outputProtocol = REVIEW_VERDICT_OUTPUT_PROTOCOL;
     task.retryPolicy = PROTOCOL_AWARE_PI_RETRY_POLICY;
+    if (task.outputProtocol?.type === "json-review-verdict") {
+        const governanceInstruction = 'mandatory governance violations must use verdict "request-revision" with at least one finding; never emit verdict "pass" when any mandatory governance violation or Critical/Important finding remains.';
+        if (!(task.outputContract ?? "").includes("mandatory governance violations")) {
+            task.outputContract = `${task.outputContract ?? ""} Unresolved ${governanceInstruction} No file writes.`;
+        }
+        if (!task.subtask_prompt.includes(governanceInstruction)) {
+            task.subtask_prompt = `${task.subtask_prompt}\n\n${governanceInstruction}`;
+        }
+        return;
+    }
+    task.outputProtocol = REVIEW_VERDICT_OUTPUT_PROTOCOL;
     task.outputContract =
         "Plain Markdown whose first non-empty line is exactly VERDICT: pass or VERDICT: request-revision; unresolved mandatory governance violations force request-revision. No file writes.";
     const protocolInstruction = "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.";

package/dist/workflows/dag/lifecycle.js

@@ -5,13 +5,31 @@ import { writeJsonAtomic, } from "../../infrastructure/harness/atomic-write.js";
 import { parseDagSpec } from "./types.js";
 import { normalizeDagFailureCategory, } from "./failure-category.js";
 import { dagProductLineFailureCategoryValues, routeDagFailure, } from "./failure-routing.js";
-const DAG_LIFECYCLE_SCAN_ORDER = [
+/** Resume/operator scan order for real execution lifecycles. */
+const DAG_EXECUTION_LIFECYCLE_SCAN_ORDER = [
     "paused",
     "active",
     "completed",
 ];
+/** Full disk scan including non-execution audit lifecycles (R-A2). */
+const DAG_LIFECYCLE_SCAN_ORDER = [
+    ...DAG_EXECUTION_LIFECYCLE_SCAN_ORDER,
+    "dry-run",
+    "init-only",
+];
 const PAUSED_APPROVAL_FLOW_HINT = "Use dag approve / dag reject, then dag resume when approved.";
 export const DAG_RUNS_DIR = path.join(".harness", "dag-runs");
+/** Non-execution audit lifecycles (never resume targets). */
+export const DAG_NON_EXECUTION_LIFECYCLES = ["dry-run", "init-only"];
+export function isDagNonExecutionLifecycle(lifecycle) {
+    return (lifecycle === "dry-run" ||
+        lifecycle === "init-only");
+}
+export function isDagExecutionLifecycle(lifecycle) {
+    return (lifecycle === "active" ||
+        lifecycle === "completed" ||
+        lifecycle === "paused");
+}
 export function getDagRunDir(cwd, lifecycle, runId) {
     return path.join(cwd, DAG_RUNS_DIR, lifecycle, runId);
 }
@@ -36,7 +54,8 @@ export async function readDagRunSpec(runDir) {
     return parseDagSpec(raw);
 }
 export async function locateDagRun(cwd, runId) {
-    for (const lifecycle of ["paused", "active", "completed"]) {
+    // Prefer real execution lifecycles for resume/status; audit dirs last.
+    for (const lifecycle of DAG_LIFECYCLE_SCAN_ORDER) {
         const runDir = getDagRunDir(cwd, lifecycle, runId);
         if (await dagRunDirExists(runDir)) {
             return { lifecycle, runDir };
@@ -233,6 +252,10 @@ export function deriveDagRunEffectiveStatus(input) {
     if (input.lifecycle === "completed") {
         return mapTerminalDagRunEffectiveStatus(input.state.status);
     }
+    // dry-run / init-only are audit shells; surface pending without pretending execute.
+    if (isDagNonExecutionLifecycle(input.lifecycle)) {
+        return input.state.status === "pending" ? "pending" : "unknown";
+    }
     if (input.state.status === "pending")
         return "pending";
     if (isTerminalDagRunStatus(input.state.status)) {
@@ -254,6 +277,14 @@ export function deriveDagRunEffectiveStatus(input) {
 }
 export function assessDagRunRecoveryEligibility(input) {
     const reasons = [];
+    if (isDagNonExecutionLifecycle(input.lifecycle)) {
+        return {
+            canResume: false,
+            canReconcile: false,
+            allowedActions: [],
+            reasons: ["non-execution-lifecycle"],
+        };
+    }
     const canResume = input.lifecycle === "active" &&
         input.state.status === "running" &&
         Boolean(input.state.humanDecisionNodeId) &&

package/dist/workflows/dag/node-execution.js

@@ -9,7 +9,7 @@ import { buildDagNodePromptEnvelope, formatConvergenceFeedbackBlock, } from "./p
 import { persistLongNodeOutputArtifacts } from "./upstream-artifacts.js";
 import { computeBackoffDelayMs, isRetryablePiFailureCategory, isSafeReadOnlyPiRetryCandidate, } from "./retry-policy.js";
 import { applyNodeActivity, evaluateNodeLiveness, resolveLivenessPolicy, } from "./liveness-policy.js";
-import { buildProtocolRetryInstruction, normalizeReviewVerdictAfterRetries, validateOutputProtocol, } from "./output-protocol.js";
+import { buildProtocolRetryInstruction, normalizeReviewVerdictAfterRetries, parseJsonReviewVerdict, validateOutputProtocol, } from "./output-protocol.js";
 import { writeDagNodeJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
 import { buildProjectGovernanceContext, readCompletedWriterChangeManifests, writeProjectGovernanceContext, } from "./project-governance-context.js";
 import { assertSkillSnapshotCoversSpec, buildNodePromptFromSnapshot, isDagSkillSnapshotIntegrityError, readSkillSnapshot, } from "./skill-snapshot.js";
@@ -83,8 +83,15 @@ export async function buildNodePromptWithResolvedSkillInstructions(spec, task, u
         resolvedSkills: skillInstructionMetadata(resolvedSkillInstructions),
     };
 }
+export function canonicalNodeOutput(node) {
+    const assistantText = node?.assistantText ?? "";
+    return assistantText.trim().length > 0 ? assistantText : (node?.stdout ?? "");
+}
 export function parseProcessVerdict(node) {
-    const text = `${node?.assistantText ?? ""}\n${node?.stdout ?? ""}`;
+    const text = canonicalNodeOutput(node);
+    const jsonVerdict = parseJsonReviewVerdict(text);
+    if (jsonVerdict.ok)
+        return jsonVerdict.verdict;
     for (const line of text.split("\n")) {
         const trimmed = line.trim();
         if (trimmed === "VERDICT: pass")
@@ -138,8 +145,7 @@ function assertRepairArtifactVerdictMatchesSupervisor(input) {
     }
 }
 function parseSupervisorRepairArtifact(node) {
-    const text = `${node?.assistantText ?? ""}\n${node?.stdout ?? ""}`;
-    return parseRepairArtifactFromText(text);
+    return parseRepairArtifactFromText(canonicalNodeOutput(node));
 }
 function validateRepairArtifactGateBeforeShell(input) {
     const gate = input.task.shell?.repairArtifactGate;
@@ -450,7 +456,7 @@ export async function executeDagNode(input) {
         // R0: executor ok=true still fails closed when outputProtocol is violated.
         // Valid semantic results (e.g. VERDICT: request-revision) pass validation.
         if (result.ok && task.outputProtocol) {
-            const protocolText = `${result.assistantText ?? ""}\n${result.stdout ?? ""}`;
+            const protocolText = canonicalNodeOutput(result);
             const protocolCheck = validateOutputProtocol(task.outputProtocol, protocolText);
             if (!protocolCheck.ok) {
                 result = {

package/dist/workflows/dag/output-protocol.js

@@ -62,126 +62,68 @@ export function firstNonEmptyLine(text) {
     }
     return undefined;
 }
-function extractSingleJsonObjectText(text) {
+/**
+ * Parse the JSON-only review verdict protocol. The complete trimmed output
+ * must be exactly one JSON object: fences, prose, partial objects, and
+ * concatenated objects are all rejected before schema validation.
+ */
+export function parseJsonReviewVerdict(text) {
     const trimmed = String(text).trim();
     if (!trimmed)
         return { ok: false, reason: "missing JSON output" };
-    const extractBalancedObject = (source) => {
-        for (let start = 0; start < source.length; start += 1) {
-            if (source[start] !== "{")
-                continue;
-            let depth = 0;
-            let inString = false;
-            let escaped = false;
-            for (let index = start; index < source.length; index += 1) {
-                const char = source[index];
-                if (inString) {
-                    if (escaped)
-                        escaped = false;
-                    else if (char === "\\")
-                        escaped = true;
-                    else if (char === '"')
-                        inString = false;
-                    continue;
-                }
-                if (char === '"')
-                    inString = true;
-                else if (char === "{")
-                    depth += 1;
-                else if (char === "}" && --depth === 0) {
-                    const candidate = source.slice(start, index + 1);
-                    try {
-                        const parsed = JSON.parse(candidate);
-                        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
-                            return candidate;
-                    }
-                    catch {
-                        // Continue scanning for the next complete object.
-                    }
-                    break;
-                }
-            }
-        }
-        return undefined;
-    };
-    const direct = extractBalancedObject(trimmed);
-    if (direct)
-        return { ok: true, jsonText: direct };
-    const fencedMatches = Array.from(trimmed.matchAll(/```(?:json)?\s*([\s\S]*?)\s*```/gi));
-    if (fencedMatches.length === 1) {
-        const jsonText = fencedMatches[0][1].trim();
-        const fencedObject = extractBalancedObject(jsonText);
-        if (fencedObject)
-            return { ok: true, jsonText: fencedObject };
-        return {
-            ok: false,
-            reason: "single fenced block is not a JSON object",
-        };
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
     }
-    if (fencedMatches.length > 1) {
+    catch (error) {
         return {
             ok: false,
-            reason: "multiple fenced JSON candidates found; expected exactly one JSON object",
+            reason: `output must be exactly one JSON object: ${error instanceof Error ? error.message : String(error)}`,
         };
     }
-    return {
-        ok: false,
-        reason: "output is not a single JSON object; expected only JSON with no Markdown or prose",
-    };
-}
-function validateJsonReviewVerdict(text) {
-    const extracted = extractSingleJsonObjectText(text);
-    if (!extracted.ok) {
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
         return {
             ok: false,
-            failureCategory: "protocol-invalid",
-            reason: extracted.reason,
-            firstNonEmptyLine: firstNonEmptyLine(text),
-        };
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(extracted.jsonText);
-    }
-    catch (error) {
-        return {
-            ok: false,
-            failureCategory: "protocol-invalid",
-            reason: `invalid JSON: ${error instanceof Error ? error.message : String(error)}`,
-            firstNonEmptyLine: firstNonEmptyLine(text),
+            reason: "output must be exactly one JSON object",
         };
     }
     const checked = reviewJsonVerdictSchema.safeParse(parsed);
     if (!checked.success) {
         return {
             ok: false,
-            failureCategory: "protocol-invalid",
             reason: `JSON review verdict schema violation: ${checked.error.issues
                 .map((issue) => `${issue.path.join(".") || "<root>"} ${issue.message}`)
                 .join("; ")}`,
-            firstNonEmptyLine: firstNonEmptyLine(text),
         };
     }
     const blockingFindings = checked.data.findings.filter((finding) => finding.severity === "Critical" || finding.severity === "Important");
     if (checked.data.verdict === "pass" && blockingFindings.length > 0) {
         return {
             ok: false,
-            failureCategory: "protocol-invalid",
             reason: "JSON review verdict cannot be pass when Critical or Important findings are present",
-            firstNonEmptyLine: firstNonEmptyLine(text),
         };
     }
     if (checked.data.verdict === "request-revision" &&
         checked.data.findings.length === 0) {
         return {
             ok: false,
-            failureCategory: "protocol-invalid",
             reason: "JSON review verdict request-revision requires at least one finding",
-            firstNonEmptyLine: firstNonEmptyLine(text),
         };
     }
     return { ok: true, verdict: checked.data.verdict };
 }
+function validateJsonReviewVerdict(text) {
+    const parsed = parseJsonReviewVerdict(text);
+    if (!parsed.ok) {
+        return {
+            ok: false,
+            failureCategory: "protocol-invalid",
+            reason: parsed.reason,
+            firstNonEmptyLine: firstNonEmptyLine(text),
+        };
+    }
+    return { ok: true, verdict: parsed.verdict };
+}
 /**
  * Validate node output against an explicit outputProtocol.
  * Pure function — does not mutate run facts.

package/dist/workflows/dag/report.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import { resolveCliPath } from "../../shared/path-refs.js";
 import { z } from "zod";
 import { repairArtifactSchema } from "./repair-artifact.js";
-import { dagRunDirExists, getDagRunDir, locateDagRun, readDagRunSpec, readDagRunState, } from "./lifecycle.js";
+import { dagRunDirExists, getDagRunDir, isDagExecutionLifecycle, locateDagRun, readDagRunSpec, readDagRunState, } from "./lifecycle.js";
 export const DAG_CLOSEOUT_DRAFT_DISCLAIMER = "> **Advisory only.** Derived from completed run facts. Canonical source remains `dag report --json` and `.harness/dag-runs/completed/<run-id>/`. Do not treat this draft as authoritative.";
 import { dagNormalizedFailureCategorySchema, normalizeDagFailureCategory, } from "./failure-category.js";
 import { dagProductLineFailureCategoryValues, routeDagFailure, } from "./failure-routing.js";
@@ -659,7 +659,14 @@ async function locateRunForReport(repoRoot, runId, filter) {
         if (!located) {
             throw new Error(`dag run not found: ${runId}`);
         }
-        return { ...located, runId };
+        if (!isDagExecutionLifecycle(located.lifecycle)) {
+            throw new Error(`dag run not found: ${runId}`);
+        }
+        return {
+            lifecycle: located.lifecycle,
+            runDir: located.runDir,
+            runId,
+        };
     }
     const runDir = getDagRunDir(repoRoot, filter, runId);
     if (!(await dagRunDirExists(runDir))) {