@tea-agent/loop-agent 0.27.1 → 0.28.1-beta.1

package/dist/workflows/dag/init-hybrid.js

@@ -1,6 +1,5 @@
 import { createHash } from "node:crypto";
 import { access, readdir, readFile, realpath } from "node:fs/promises";
-import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
 import { assertValidDagSpec } from "./validate.js";
@@ -734,15 +733,16 @@ function resolveImplementPaths(taskConfig, options = {}) {
             return normalized === "docs" || normalized.startsWith("docs/");
         });
         if (repoRoot && mayNeedDocIndex) {
-            const merged = mergeDocumentIndexCompanions({
+            const closure = mergeDocumentIndexCompanions({
                 repoRoot,
                 paths: allowed,
                 forbiddenPaths: forbidden,
             });
-            return {
-                allowedPaths: merged.paths,
-                writeSet: [...merged.paths],
-            };
+            const explicitAllowedPaths = new Set(allowed.map((entry) => entry.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "")));
+            const missingCompanions = closure.companions.filter((companion) => !explicitAllowedPaths.has(companion));
+            if (missingCompanions.length > 0) {
+                throw new Error(`document-index-closure: catalog companion paths must be explicitly authorized in task allowedPaths: ${missingCompanions.map((companion) => `"${companion}"`).join(", ")}. Add each missing path with task advance --allowed-path <path>; required command(s): ${missingCompanions.map((companion) => `task advance --allowed-path ${companion}`).join("; ")}`);
+            }
         }
         return {
             allowedPaths: allowed,
@@ -1079,40 +1079,14 @@ function isFrontendLintVerifyCommand(command) {
     const text = `${command.label}\n${command.args.join(" ")}`;
     return /\b(?:lint|eslint)\b/i.test(text);
 }
-function isManagedCiWrapperVerifyCommand(command) {
-    const text = `${command.label}\n${command.args.join(" ")}`.replaceAll("\\", "/");
-    return /\bscripts\/ci(?:-tests)?\.sh\b/.test(text);
-}
-function repoHasNpmScript(repoRoot, scriptName) {
-    if (!repoRoot)
-        return false;
-    const packagePath = path.join(repoRoot, "package.json");
-    if (!existsSync(packagePath))
-        return false;
-    try {
-        const decoded = JSON.parse(readFileSync(packagePath, "utf8"));
-        return typeof decoded.scripts?.[scriptName] === "string";
-    }
-    catch {
-        return false;
-    }
-}
 function partitionFrontendStaticVerifyCommands(input) {
     const commands = input.commands ?? [];
-    const lintCommands = commands.filter(isFrontendLintVerifyCommand);
+    // Frontend DAGs deliberately never generate lint verification. Existing
+    // project lint debt is allowed to remain outside this workflow, and an
+    // explicitly mentioned lint command must not reintroduce the lint gate.
     const staticCommands = commands.filter((command) => !isFrontendLintVerifyCommand(command));
-    if (lintCommands.length === 0 &&
-        commands.some(isManagedCiWrapperVerifyCommand) &&
-        repoHasNpmScript(input.repoRoot, "lint")) {
-        lintCommands.push({
-            args: ["npm", "run", "lint"],
-            cwd: input.repoRoot,
-            label: "npm run lint",
-        });
-    }
     return {
         lint: {
-            ...(lintCommands.length > 0 ? { commands: lintCommands } : {}),
             commandSource: input.commandSource,
         },
         static: {
@@ -1211,7 +1185,6 @@ async function discoverFrontendFallbackVerifyCommands(repoRoot) {
     const staticCommands = firstExisting([
         "typecheck",
         "check-types",
-        "lint",
         "check",
         "build",
     ]);
@@ -1688,6 +1661,7 @@ export function buildStandardHybridDagFromTask(sources) {
                 writeSet: implementPaths.writeSet,
                 allowedPaths: implementPaths.allowedPaths,
                 forbiddenPaths,
+                writerOutcomePolicy: { type: "implementation-outcome-v1" },
                 subtask_prompt: [
                     "Implement the approved plan with minimal focused changes.",
                     "Stay within writeSet. Do not write root artifacts/** unless artifacts paths are explicitly declared in writeSet.",
@@ -2455,9 +2429,62 @@ async function buildFrontendHybridDagFromTask(sources) {
                     sourceContext,
                 ].join("\n\n"),
             },
+            {
+                id: "frontend-contract-json-pi",
+                depends_on: [
+                    "frontend-plan-revision-pi",
+                    "frontend-plan-pi",
+                    "frontend-final-design-review-pi",
+                    "frontend-design-review-pi",
+                ],
+                dependsPolicy: "all-or-condition-skip",
+                role: "planner",
+                executor: "pi",
+                complexity: "MED",
+                writePolicy: "read-only",
+                outputMode: "structured-required",
+                retryPolicy: STRUCTURED_REQUIRED_PI_RETRY_POLICY,
+                allowedPaths: readOnlyPaths,
+                forbiddenPaths,
+                skills: FRONTEND_IMPLEMENTATION_SKILLS,
+                outputContract: "Return exactly one JSON object conforming to frontend-implementation-contract-v1. No Markdown, prose, comments, or code fences.",
+                subtask_prompt: [
+                    "Convert the effective reviewed frontend plan into the canonical frontend-implementation-contract-v1 JSON.",
+                    "Use frontend-plan-revision-pi when it is FINISHED; otherwise use frontend-plan-pi. Confirm the effective design review passed before producing the contract.",
+                    "Return only the JSON object. Do not wrap it in Markdown or a code fence. Do not add explanatory text.",
+                    "Preserve all requirement expectedOutcome, interaction trigger/expectedBehavior, target files, verification targets, Mock/API decisions, and Real Integration Gap from the effective plan.",
+                    frontendContractSchemaBlock,
+                    sourceContext,
+                ].join("\n\n"),
+            },
+            {
+                id: "frontend-contract-json-validate-shell",
+                depends_on: ["frontend-contract-json-pi"],
+                role: "verifier",
+                executor: "shell",
+                complexity: "LOW",
+                writePolicy: "read-only",
+                allowedPaths: readOnlyPaths,
+                forbiddenPaths,
+                outputContract: "Validated frontend implementation contract artifact with schema ID and SHA-256.",
+                subtask_prompt: "Materialize and validate the structured frontend contract before prewrite authorization.",
+                shell: {
+                    commands: [],
+                    jsonArtifactGate: {
+                        fromNodeId: "frontend-contract-json-pi",
+                        schemaId: "frontend-implementation-contract-v1",
+                        artifactName: "frontend-implementation-contract.json",
+                        outputDir: "contracts",
+                    },
+                    cwd: ".",
+                    timeoutMs: 60000,
+                },
+            },
             {
                 id: "frontend-prewrite-gate-shell",
                 depends_on: [
+                    "frontend-contract-json-pi",
+                    "frontend-contract-json-validate-shell",
                     "frontend-final-design-review-pi",
                     "frontend-design-review-pi",
                     "frontend-plan-revision-pi",
@@ -2476,8 +2503,8 @@ async function buildFrontendHybridDagFromTask(sources) {
                     commands: [],
                     frontendPrewriteGate: {
                         schemaVersion: 1,
-                        planFromNodeId: "frontend-plan-revision-pi",
-                        planFallbackFromNodeIds: ["frontend-plan-pi"],
+                        planFromNodeId: "frontend-contract-json-pi",
+                        planFallbackFromNodeIds: ["frontend-plan-revision-pi", "frontend-plan-pi"],
                         reviewFromNodeId: "frontend-final-design-review-pi",
                         reviewFallbackFromNodeIds: ["frontend-design-review-pi"],
                         requiredRequirementIds: requirementIds,
@@ -3755,9 +3782,48 @@ async function buildBackendTestHybridDag(sources) {
     assertValidDagSpec(spec);
     return spec;
 }
-// ---------------------------------------------------------------------------
-// Frontend browser-test RAG DAG template
-// ---------------------------------------------------------------------------
+/**
+ * Resolve the browser origin only from controller-owned task source bytes.
+ * Model-authored RAG/case/evidence files are intentionally excluded.
+ */
+export function resolveControllerFrontendBaseUrl(sources) {
+    const candidates = (sources.referenceDocuments ?? [])
+        .filter((document) => /(?:^|[\\/])config\.md$/i.test(document.path))
+        .map((document) => ({
+        markdown: document.markdown,
+        source: toDagSourcePath(sources, document.path),
+    }));
+    let rawBaseUrl = "http://localhost:5173";
+    let baseUrlSource = "default-localhost-5173";
+    for (const candidate of candidates) {
+        const match = candidate.markdown.match(/(?:frontend[_-]?base[_-]?url|base[_-]?url|base[- ]url)\s*[:=]\s*["'`]?((?:https?):\/\/[^\s"'`<>]+)/i);
+        if (!match?.[1]) {
+            if (/(?:frontend[_-]?base[_-]?url|base[_-]?url|base[- ]url)\s*[:=]/i.test(candidate.markdown)) {
+                throw new Error(`frontend-test controller baseUrl is invalid (${candidate.source})`);
+            }
+            continue;
+        }
+        rawBaseUrl = match[1].replace(/[)\]},.;]+$/, "");
+        baseUrlSource = candidate.source;
+        break;
+    }
+    let parsed;
+    try {
+        parsed = new URL(rawBaseUrl);
+    }
+    catch {
+        throw new Error(`frontend-test controller baseUrl is invalid (${baseUrlSource})`);
+    }
+    if ((parsed.protocol !== "http:" && parsed.protocol !== "https:") ||
+        parsed.username ||
+        parsed.password ||
+        parsed.search ||
+        parsed.hash ||
+        /(?:^|\.)(?:www\.)?[^.]*(?:prod|production)/i.test(parsed.hostname)) {
+        throw new Error(`frontend-test controller baseUrl is unsafe (${baseUrlSource})`);
+    }
+    return { baseUrl: parsed.toString(), baseUrlSource };
+}
 function buildFrontendTestHybridDag(sources) {
     const rawFrontendTest = sources.taskConfig.frontendTest;
     const config = {
@@ -3780,7 +3846,14 @@ function buildFrontendTestHybridDag(sources) {
         throw new Error('frontend-test requires task.json allowedPaths to include "testcase/frontend/**" (or an explicit containing glob).');
     }
     const forbidden = commonForbiddenPaths(sources);
+    const controllerFrontend = resolveControllerFrontendBaseUrl(sources);
     const ragWriteSet = ["testcase/frontend/rag/**"];
+    const caseDraftWriteSet = [
+        "testcase/frontend/cases/FE-*.md",
+        "testcase/frontend/cases/index.md",
+        "testcase/frontend/cases/manifest.draft.json",
+    ];
+    // The shell materializer alone owns the final manifest boundary.
     const casesWriteSet = ["testcase/frontend/cases/**"];
     const evidenceRoot = "testcase/frontend/evidence";
     const declaredAcIdsLiteral = JSON.stringify(declaredAcIds);
@@ -3831,7 +3904,7 @@ function buildFrontendTestHybridDag(sources) {
     // such as \\s/\\d and interprets Markdown backticks before Node sees them.
     const checklistScriptBase64 = Buffer.from(checklistScript, "utf8").toString("base64");
     const checklistValidation = [
-        "node -e \"eval(Buffer.from(process.argv[1],'base64').toString('utf8'))\"",
+        "node -e \"require('node:vm').runInThisContext(Buffer.from(process.argv[1],'base64').toString('utf8'))\"",
         checklistScriptBase64,
     ].join(" ");
     const manifestValidation = [
@@ -3890,8 +3963,26 @@ function buildFrontendTestHybridDag(sources) {
     ].join(" ");
     const tasks = [
         {
-            id: "retrieve-frontend-test-context-pi",
+            id: "preflight-frontend-browser-tool-shell",
             depends_on: [],
+            role: "verifier",
+            executor: "shell",
+            complexity: "LOW",
+            writePolicy: "read-only",
+            allowedPaths: [],
+            forbiddenPaths: forbidden,
+            outputContract: "Deterministic browser-tool preflight: SDK-only custom-tool capability + controller verified playwright-cli launcher + --help contract + frozen controller origin. Fail closed with playwright-cli-unavailable | playwright-cli-contract-incompatible | browser-command-capability-unavailable before any frontend-test Pi node.",
+            subtask_prompt: `Verify CODE_AGENT_PI_BACKEND permits SDK, the Pi SDK structured custom-tool surface is available, the controller-resolved playwright-cli launcher and --help list open/close/find/snapshot/click, and the frozen origin is ${controllerFrontend.baseUrl} from ${controllerFrontend.baseUrlSource}. Do not install packages. Do not start a browser session. On failure exit non-zero so retrieve/generate/map never run (zero frontend-test Pi calls).`,
+            shell: {
+                commands: [],
+                frontendBrowserToolPreflight: {},
+                cwd: ".",
+                timeoutMs: 60000,
+            },
+        },
+        {
+            id: "retrieve-frontend-test-context-pi",
+            depends_on: ["preflight-frontend-browser-tool-shell"],
             role: "planner",
             executor: "pi",
             toolProfile: "write",
@@ -3900,12 +3991,12 @@ function buildFrontendTestHybridDag(sources) {
             writeSet: ragWriteSet,
             allowedPaths: [...commonReadOnlyPaths(sources), ...ragWriteSet],
             forbiddenPaths: forbidden,
-            outputContract: "Write short testcase/frontend/rag/context.md and coverage-map.md with machine-readable baseUrl, baseUrlSource, environmentProbe=pending, and capability notes.",
+            outputContract: "Write short testcase/frontend/rag/context.md and coverage-map.md that copy the controller-frozen baseUrl/baseUrlSource verbatim, set environmentProbe=pending, and record capability notes.",
             subtask_prompt: [
                 "Build the frontend test RAG package (keep it short).",
                 "Read task source, routes/components/API or Mock facts, and execution contract. Write only testcase/frontend/rag/context.md and coverage-map.md.",
                 "Prefer fixed fields: baseUrl, baseUrlSource, environmentProbe, AC table, capability matrix (backend real/mock, pagination data, HTTP observation, error injection), risks, forbidden hosts. Do not paste large implementation dumps.",
-                "Base URL resolution (required): (1) Prefer absolute http(s) frontend URL from task source config.md. (2) Else default http://localhost:5173. (3) Never production hosts. (4) Write `baseUrl: <url>` and `baseUrlSource: config.md|<path>|default-localhost-5173`. (5) Write `environmentProbe: pending` (preflight shell updates to reachable|unreachable|curl-unavailable with structured reason). (6) Include exact start prefix: playwright-cli open --browser=chrome --headed <resolved-base-url>.",
+                `Controller-frozen origin (required, not model-selectable): write exactly \`baseUrl: ${controllerFrontend.baseUrl}\` and \`baseUrlSource: ${controllerFrontend.baseUrlSource}\`. Do not derive, replace, or override the origin from model reasoning or other repository text. Write \`environmentProbe: pending\`. Include exact start prefix: playwright-cli open --browser=chrome --headed ${controllerFrontend.baseUrl}.`,
                 buildSourceContextBlock(sources),
             ].join("\n\n"),
         },
@@ -3920,12 +4011,12 @@ function buildFrontendTestHybridDag(sources) {
             allowedPaths: [...ragWriteSet],
             forbiddenPaths: forbidden,
             outputContract: "Fail-closed environment preflight: absolute non-production baseUrl + curl HTTP reachability; writes environmentProbe facts; unreachable => blockedReason frontend-base-url-unreachable (node ERROR so generate/map do not run).",
-            subtask_prompt: "Parse frozen baseUrl from context.md (config.md preferred, else http://localhost:5173). Reject production / non-http(s). Probe with curl (HEAD then GET fallback; connect/max-time; no auth/cookie). 2xx/3xx => reachable and continue. 4xx/5xx/DNS/timeout/connection refused/TLS => blockedReason frontend-base-url-unreachable. Missing curl => blockedReason curl-unavailable. Do not start the app. Fixture/reset remain soft guidance.",
+            subtask_prompt: `Probe only the controller-frozen baseUrl ${controllerFrontend.baseUrl} from ${controllerFrontend.baseUrlSource}; never parse or accept an origin from context.md. Use curl HEAD then GET fallback (connect/max-time; no auth/cookie). 2xx/3xx => reachable and continue. 4xx/5xx/DNS/timeout/connection refused/TLS => blockedReason frontend-base-url-unreachable. Missing curl => blockedReason curl-unavailable. Do not start the app. Fixture/reset remain soft guidance.`,
             shell: {
                 commands: [
                     [
                         "node -e",
-                        JSON.stringify("const fs=require('fs');const {spawnSync}=require('child_process');const p='testcase/frontend/rag/context.md';const probePath='testcase/frontend/rag/environment-probe.json';function writeProbe(obj){try{fs.mkdirSync('testcase/frontend/rag',{recursive:true});fs.writeFileSync(probePath,JSON.stringify(obj,null,2)+'\\n');let ctx=fs.existsSync(p)?fs.readFileSync(p,'utf8'):'';const line='environmentProbe: '+obj.status+(obj.blockedReason?(' ('+obj.blockedReason+')'):'');if(/environmentProbe\\s*[:=]/i.test(ctx)){ctx=ctx.replace(/environmentProbe\\s*[:=]\\s*.*/i,line);}else{ctx=ctx.trimEnd()+'\\n\\n'+line+'\\n';}fs.writeFileSync(p,ctx);}catch(e){console.error('probe-write-failed',e&&e.message||e);}}function redactUrl(u){try{const x=new URL(u);x.username='';x.password='';if(x.search){x.search='';}return x.toString();}catch(_){return String(u).replace(/\\/\\/[^@\\s]+@/g,'//');}}function failBlocked(reason,extra){const payload=Object.assign({status:'unreachable',blockedReason:reason,baseUrlRedacted:extra&&extra.baseUrlRedacted||null,httpStatus:extra&&extra.httpStatus||null,method:extra&&extra.method||null,curlExit:extra&&extra.curlExit||null,errorClass:extra&&extra.errorClass||null},extra||{});writeProbe(payload);console.error('frontend-test preflight blocked: '+JSON.stringify({blockedReason:reason,baseUrl:payload.baseUrlRedacted,httpStatus:payload.httpStatus,errorClass:payload.errorClass}));throw new Error('frontend-test preflight blocked: '+reason);}if(!fs.existsSync(p))throw new Error('missing '+p);const s=fs.readFileSync(p,'utf8');const patterns=[/baseUrl\\s*[:=]\\s*(https?:\\/\\/\\S+)/i,/base[- ]url\\s*[:=]\\s*(https?:\\/\\/\\S+)/i,/playwright-cli open --browser=chrome --headed\\s+(https?:\\/\\/\\S+)/i,/(https?:\\/\\/(?:localhost|127\\.0\\.0\\.1)[^\\s)\\}\\],\\\"']*)/i];let baseUrl=null;for(const re of patterns){const m=s.match(re);if(m){baseUrl=m[1];break;}}if(!baseUrl)throw new Error('frontend-test preflight missing absolute baseUrl (prefer config.md; default http://localhost:5173)');baseUrl=baseUrl.replace(/[)\\}\\],.\\\"'\\x60]+$/,'');if(!/^https?:\\/\\//i.test(baseUrl))throw new Error('baseUrl must be absolute http(s): '+baseUrl);if(/(?:^|\\/\\/)(?:www\\.)?[^\\s\\/]*(?:prod|production)/i.test(baseUrl))throw new Error('production URL forbidden: '+baseUrl);const safe=redactUrl(baseUrl);const curlCheck=spawnSync('curl',['--version'],{encoding:'utf8'});if(curlCheck.error||curlCheck.status!==0){failBlocked('curl-unavailable',{baseUrlRedacted:safe,errorClass:'curl-missing'});}function probe(method){const args=['-sS','-o','/dev/null','-w','%{http_code}','--connect-timeout','3','--max-time','8','-X',method,'-L','--max-redirs','3','--http1.1','--proto-redir','=http,https',safe];const r=spawnSync('curl',args,{encoding:'utf8'});return r;}let used='HEAD';let r=probe('HEAD');let code=String(r.stdout||'').trim();let statusNum=parseInt(code,10);const headRejected=r.status!==0||!statusNum||statusNum===405||statusNum===501;if(headRejected){used='GET';r=probe('GET');code=String(r.stdout||'').trim();statusNum=parseInt(code,10);}const ok=statusNum>=200&&statusNum<400;if(!ok){const errClass=r.error?'spawn-error':(r.status!==0?'curl-exit-'+r.status:('http-'+statusNum));failBlocked('frontend-base-url-unreachable',{baseUrlRedacted:safe,httpStatus:statusNum||null,method:used,curlExit:r.status,errorClass:errClass});}writeProbe({status:'reachable',blockedReason:null,baseUrlRedacted:safe,httpStatus:statusNum,method:used,curlExit:r.status});console.log('frontend-test-execution-v1 validated baseUrl='+safe+' probe=reachable method='+used+' httpStatus='+statusNum);"),
+                        JSON.stringify(`const fs=require('fs');const {spawnSync}=require('child_process');const p='testcase/frontend/rag/context.md';const probePath='testcase/frontend/rag/environment-probe.json';function writeProbe(obj){try{fs.mkdirSync('testcase/frontend/rag',{recursive:true});fs.writeFileSync(probePath,JSON.stringify(obj,null,2)+'\\n');let ctx=fs.existsSync(p)?fs.readFileSync(p,'utf8'):'';const line='environmentProbe: '+obj.status+(obj.blockedReason?(' ('+obj.blockedReason+')'):'');if(/environmentProbe\\s*[:=]/i.test(ctx)){ctx=ctx.replace(/environmentProbe\\s*[:=]\\s*.*/i,line);}else{ctx=ctx.trimEnd()+'\\n\\n'+line+'\\n';}fs.writeFileSync(p,ctx);}catch(e){console.error('probe-write-failed',e&&e.message||e);}}function redactUrl(u){try{const x=new URL(u);x.username='';x.password='';if(x.search){x.search='';}return x.toString();}catch(_){return String(u).replace(/\\/\\/[^@\\s]+@/g,'//');}}function failBlocked(reason,extra){const payload=Object.assign({status:'unreachable',blockedReason:reason,baseUrlRedacted:extra&&extra.baseUrlRedacted||null,httpStatus:extra&&extra.httpStatus||null,method:extra&&extra.method||null,curlExit:extra&&extra.curlExit||null,errorClass:extra&&extra.errorClass||null},extra||{});writeProbe(payload);console.error('frontend-test preflight blocked: '+JSON.stringify({blockedReason:reason,baseUrl:payload.baseUrlRedacted,httpStatus:payload.httpStatus,errorClass:payload.errorClass}));throw new Error('frontend-test preflight blocked: '+reason);}if(!fs.existsSync(p))throw new Error('missing '+p);const baseUrl=${JSON.stringify(controllerFrontend.baseUrl)};const baseUrlSource=${JSON.stringify(controllerFrontend.baseUrlSource)};const safe=redactUrl(baseUrl);const curlCheck=spawnSync('curl',['--version'],{encoding:'utf8'});if(curlCheck.error||curlCheck.status!==0){failBlocked('curl-unavailable',{baseUrlRedacted:safe,errorClass:'curl-missing'});}function probe(method){const args=['-sS','-o','/dev/null','-w','%{http_code}','--connect-timeout','3','--max-time','8','-X',method,'-L','--max-redirs','3','--http1.1','--proto-redir','=http,https',safe];const r=spawnSync('curl',args,{encoding:'utf8'});return r;}let used='HEAD';let r=probe('HEAD');let code=String(r.stdout||'').trim();let statusNum=parseInt(code,10);const headRejected=r.status!==0||!statusNum||statusNum===405||statusNum===501;if(headRejected){used='GET';r=probe('GET');code=String(r.stdout||'').trim();statusNum=parseInt(code,10);}const ok=statusNum>=200&&statusNum<400;if(!ok){const errClass=r.error?'spawn-error':(r.status!==0?'curl-exit-'+r.status:('http-'+statusNum));failBlocked('frontend-base-url-unreachable',{baseUrlRedacted:safe,httpStatus:statusNum||null,method:used,curlExit:r.status,errorClass:errClass});}writeProbe({status:'reachable',blockedReason:null,baseUrl:safe,baseUrlRedacted:safe,baseUrlSource,httpStatus:statusNum,method:used,curlExit:r.status});console.log('frontend-test-execution-v1 validated controllerBaseUrl='+safe+' source='+baseUrlSource+' probe=reachable method='+used+' httpStatus='+statusNum);`),
                     ].join(" "),
                 ],
                 cwd: ".",
@@ -3940,13 +4031,13 @@ function buildFrontendTestHybridDag(sources) {
             toolProfile: "write",
             complexity: "HIGH",
             writePolicy: "exclusive",
-            writeSet: casesWriteSet,
-            allowedPaths: [...ragWriteSet, ...casesWriteSet],
+            writeSet: caseDraftWriteSet,
+            allowedPaths: [...ragWriteSet, ...caseDraftWriteSet],
             forbiddenPaths: forbidden,
-            outputContract: "Write executable Markdown frontend cases, index.md, and manifest.draft.json schemaVersion 1; no test source code.",
+            outputContract: "Write executable Markdown frontend cases, index.md, and manifest.draft.json schemaVersion 1 only; the exclusive shell materializer promotes the validated draft to manifest.json. Do not write manifest.json or test source code.",
             subtask_prompt: [
                 "Use skill playwright-cli-case-generator.",
-                "Read only testcase/frontend/rag/context.md, testcase/frontend/rag/coverage-map.md, and existing testcase/frontend/cases/. Write only testcase/frontend/cases/**.",
+                "Read only testcase/frontend/rag/context.md, testcase/frontend/rag/coverage-map.md, and the draft case paths testcase/frontend/cases/FE-*.md, testcase/frontend/cases/index.md, and testcase/frontend/cases/manifest.draft.json. Write only those same draft paths. Do not write testcase/frontend/cases/manifest.json.",
                 "Generate Markdown cases, index.md and manifest.draft.json (schemaVersion 1; cases[] with caseId, casePath, dimension, acIds, evidenceDir).",
                 "HARD ID CONTRACT (do not confuse these):",
                 "- caseId / filename MUST be FE-<FEATURE>-<NNN>-<dimension> (example FE-LOGIN-001-core). NEVER use AC-FE-* as caseId or filename.",
@@ -3956,7 +4047,9 @@ function buildFrontendTestHybridDag(sources) {
                 "dimensions: core|boundary|flow|backend only.",
                 "Prefer a small smoke suite (default max roughly 4-8 cases unless task frontendTest.maxCasesPerBatch is higher). Never invent unavailable API fields or credentials. Do not create pytest or Playwright source.",
                 "HARD playwright-cli-only: every browser step must use repo skill playwright-cli declared commands only. Forbidden: bare `playwright`, `npx playwright`, `playwright test`, `@playwright/test`, Node Playwright API, or generating Playwright/Pytest source. No fallback when playwright-cli is unavailable - case must instruct blocked evidence playwright-cli-unavailable.",
-                "Copy the resolved absolute baseUrl from context.md (baseUrl field; resolved from config.md or default http://localhost:5173). Every browser start command must be: playwright-cli open --browser=chrome --headed <resolved-base-url-from-context.md> with that concrete URL - never leave a <base-url> placeholder. Use default browser session only; never write -s=<case-id>.",
+                `Use only the controller-frozen baseUrl ${controllerFrontend.baseUrl} from ${controllerFrontend.baseUrlSource}; context.md may reference it but cannot establish or override it. Every browser start command must be exactly: playwright-cli open --browser=chrome --headed ${controllerFrontend.baseUrl}. Never leave a base-url placeholder. Use default browser session only; never write -s=<case-id>.`,
+                "HARD dynamic refs: executable playwright-cli lines must never contain an angle-bracket token such as <fresh-ref> or descriptive <...> placeholder. Use only shell-safe documentation placeholders `eX`, `eY`, ...; each means the real `eNN` ref parsed from the immediately preceding latest `snapshot`. Write a fresh snapshot before every element reference. eX/eY are never literal structured-tool arguments; a later snapshot invalidates prior refs, so never reuse stale refs.",
+                "HARD file-output argv: use canonical `--filename` only. Screenshot uses `playwright-cli screenshot --filename final.png` (a real ref may precede the flag); PDF uses `playwright-cli pdf --filename final.pdf`; snapshot without filename is response-only and a snapshot file uses `playwright-cli snapshot --filename snapshot.txt`. Never generate `playwright-cli screenshot <path>`, use `--path`, `--output`, or `--file`, or pass an output path as a positional target.",
                 "Each case must be independently reproducible with fixture/reset, UI reset, snapshot-before-ref, evidence write point under testcase/frontend/evidence/<case-id>/. If the isolated environment is unavailable, require writing blocked evidence before any browser command.",
                 "U/D data ownership (required for modify/delete): (1) Only mutate data whose ownership is proven by current login identity + observable UI/API owner fields - never by name/guessed id/list order alone. (2) If current user has no data, create tagged cleanable data in current-user context, then U/D, then cleanup+verify. (3) Else only task-authorized Mock, labeled as Mock (not real backend proof). (4) If ownership unverifiable and create/Mock unavailable: write blocked with blockedReason current-user-data-unavailable | data-ownership-unverifiable | safe-test-data-setup-unavailable - do not risk cross-user data. (5) Never touch other users, shared fixtures, production, or non-cleanable data.",
             ].join("\n\n"),
@@ -3983,11 +4076,11 @@ function buildFrontendTestHybridDag(sources) {
             toolProfile: "write",
             complexity: "HIGH",
             writePolicy: "exclusive",
-            writeSet: casesWriteSet,
-            allowedPaths: [...ragWriteSet, ...casesWriteSet],
+            writeSet: caseDraftWriteSet,
+            allowedPaths: [...ragWriteSet, ...caseDraftWriteSet],
             forbiddenPaths: forbidden,
-            outputContract: "Apply the one permitted frontend case revision under testcase/frontend/cases/** only; no browser execution or evidence writes.",
-            subtask_prompt: "This is the only permitted case revision. Read the first review findings and the RAG package. Revise only testcase/frontend/cases/**, preserve traceable AC mappings, and do not execute a browser or write evidence. HARD: Never delete case files; only edit in place or add missing cases. Preserve the full planned suite, index.md, and manifest.draft.json.",
+            outputContract: "Apply the one permitted frontend case revision to FE-*.md, index.md, and manifest.draft.json only; the exclusive shell materializer remains the sole writer of manifest.json. No browser execution or evidence writes.",
+            subtask_prompt: "This is the only permitted case revision. Read the first review findings and the RAG package. Revise only testcase/frontend/cases/FE-*.md, testcase/frontend/cases/index.md, and testcase/frontend/cases/manifest.draft.json; preserve traceable AC mappings. Preserve the dynamic-ref contract: executable playwright-cli lines use only eX/eY-style shell-safe documentation placeholders, never <...>; each placeholder is resolved from the immediately preceding latest snapshot and stale refs are not reused. Do not write testcase/frontend/cases/manifest.json, execute a browser, or write evidence. HARD: Never delete case files; only edit in place or add missing cases. Preserve the full planned suite, index.md, and manifest.draft.json.",
         }, {
             id: "review-frontend-cases-final-pi",
             depends_on: ["revise-frontend-cases-pi"],
@@ -4041,8 +4134,8 @@ function buildFrontendTestHybridDag(sources) {
         writePolicy: "read-only",
         allowedPaths: [...ragWriteSet, ...casesWriteSet],
         forbiddenPaths: forbidden,
-        outputContract: "Mechanical checklist: manifest/case paths, Case ID, non-production playwright-cli open prefix, and AC mapping; alternative executable tool commands are not inspected or blocked.",
-        subtask_prompt: "Scan generated cases/manifest for structural and safety rules only. Strongly recommend playwright-cli for browser execution, but do not inspect or reject alternative executable tool commands and do not use free-form LLM verdicts.",
+        outputContract: "Mechanical checklist: manifest/case paths, Case ID, non-production playwright-cli open prefix, AC mapping, and executable command gate; rejects alternative executable instructions and non-allowlisted playwright-cli commands with ruleId-tagged location evidence.",
+        subtask_prompt: "Inspect and reject alternative executable instructions in fenced command code, list/indented steps, and explicit shell/terminal command lines. Only allowlisted playwright-cli command instructions may pass; ordinary prose and explicit blocked reasons may describe prohibitions. Run the native deterministic checklist without spawning Bash, PowerShell, or node -e and do not use free-form LLM verdicts.",
         shell: {
             commands: [],
             frontendTestCaseChecklist: {},
@@ -4093,6 +4186,10 @@ function buildFrontendTestHybridDag(sources) {
                 role: "implementer",
                 skills: ["playwright-cli"],
                 toolProfile: "write",
+                commandPolicy: {
+                    mode: "capability-allowlist",
+                    capabilities: ["playwright-cli"],
+                },
                 complexity: "MED",
                 writePolicy: "exclusive",
                 allowedPaths: [
@@ -4103,12 +4200,13 @@ function buildFrontendTestHybridDag(sources) {
                 ],
                 forbiddenPaths: forbidden,
                 writeSet: [`${evidenceRoot}/{{case.caseId}}/**`],
-                outputContract: "Compact JSON <=1200 characters with case status, evidence paths, error summary, and tokens.",
+                outputContract: "Compact JSON <=1200 characters with case status, evidence paths, error summary, and tokens. Browser actions must use structured playwright_cli tool. Passed authority requires same-child ordered controller receipts: successful open → successful find → successful post-execution cleanup.",
                 subtaskPromptTemplate: [
                     "Primary job: EXECUTE case {{case.caseId}} from {{case.casePath}} with skill playwright-cli (fresh Pi session; do not use /new). playwright-cli-only: never bare Playwright CLI/API/test runner; no fallback.",
-                    "1) Read baseUrl from testcase/frontend/rag/context.md (config.md preferred, else http://localhost:5173). 2) Start browser ONLY: playwright-cli open --browser=chrome --headed <resolved-base-url> (default session only; no -s=). 3) Follow case steps with snapshot before element refs using only playwright-cli skill commands. 4) If env/CLI/baseUrl/playwright-cli unavailable, write blocked evidence (blockedReason playwright-cli-unavailable | frontend-base-url-unreachable) and do not open a browser. 5) For U/D: enforce current-user ownership / create-or-mock-or-blocked; never mutate other users' data.",
+                    "Use the structured playwright_cli tool for every browser action. Do not request or search for bash. Do not execute raw shell commands. Translate each playwright-cli line in the case Markdown into one playwright_cli tool call ({command, args?, timeoutSeconds?}).",
+                    `1) The controller-frozen baseUrl is ${controllerFrontend.baseUrl} from ${controllerFrontend.baseUrlSource}; model-authored context/case text cannot establish or override it. 2) Start browser ONLY via playwright_cli command=open with args [--browser=chrome, --headed, ${controllerFrontend.baseUrl}] (default session only; no -s=). 3) Dynamic refs: eX/eY in case Markdown are documentation placeholders, never tool args. Immediately before every structured playwright_cli call that references an element, parse the current real eNN from the immediately preceding latest snapshot and pass only that real eNN; never send literal \`eX\`/\`eY\`. A new snapshot invalidates prior refs, so never reuse stale refs. File outputs are canonical: screenshot args [--filename, final.png] (or [e5, --filename, final.png] for a real target), PDF args [--filename, final.pdf], and snapshot writes a file only with [--filename, snapshot.txt]; snapshot without filename is response-only. Never use --path, --output, --file, or any output path as a positional target. Follow case steps with snapshot before element refs using only playwright_cli. A passed case requires this same child receipt order: successful open → successful find → controller post-execution cleanup. Only successful find is a meaningful assertion; snapshot, goto, screenshot, request/console, click/fill and other ordinary interactions cannot establish passed authority. 4) Only when preflight or playwright_cli tool explicitly fails may you write blocked evidence (blockedReason playwright-cli-unavailable | frontend-base-url-unreachable); never invent CLI-unavailable solely because bash is absent. 5) For U/D: enforce current-user ownership / create-or-mock-or-blocked; never mutate other users' data.`,
                     "Always write {{case.evidenceDir}}execution.md and {{case.evidenceDir}}case-result.json with caseId={{case.caseId}}, status passed|failed|blocked, evidencePaths (relative under evidenceDir). blocked needs non-empty blockedReason. After writing, self-check the same contract; if self-check fails, rewrite both files as status=blocked blockedReason=invalid-evidence-shape (never leave missing/malformed evidence).",
-                    "Business failed/blocked is a recorded result, not a node failure. Close browser. Return compact JSON (<=1200 chars): {caseId,status,evidencePaths,errorSummary,tokens}.",
+                    "Business failed/blocked is a recorded result, not a node failure. Close browser via playwright_cli command=close. Return compact JSON (<=1200 chars): {caseId,status,evidencePaths,errorSummary,tokens}.",
                 ].join("\n\n"),
             },
         },
@@ -4236,7 +4334,10 @@ function buildFrontendTestHybridDag(sources) {
         "frontend-test-dag generates Markdown cases and browser evidence only; it must not generate pytest or Playwright test source code.",
         "Each browser case runs serially in a fresh Pi execution boundary. Persist its evidence before starting the next case.",
         "Use only the declared isolated test environment. Production URLs, real credentials, and unauthorized data are blocked.",
-        "Browser startup for generated cases must be playwright-cli open --browser=chrome --headed <resolved-base-url>; resolve baseUrl from task source config.md when present, otherwise default http://localhost:5173; generated operations stay in the default browser session and must not use unverified named-session flags.",
+        `Browser startup for generated cases must be playwright-cli open --browser=chrome --headed ${controllerFrontend.baseUrl}; this origin is frozen by the controller from ${controllerFrontend.baseUrlSource}, and model-authored files cannot establish or override it; generated operations stay in the default browser session and must not use unverified named-session flags.`,
+        "Browser-tool preflight runs before any frontend-test Pi node; cli-only rollback, missing/incompatible Pi SDK custom-tool capability, missing verified playwright-cli launcher, or incompatible --help fails with zero Pi calls.",
+        "Browser case children use commandPolicy capability-allowlist playwright-cli and structured playwright_cli tool; ordinary writers remain without Bash.",
+        "Passed cases require same-child ordered controller receipts: successful open → successful find → successful post-execution cleanup. Pre-start cleanup, snapshot/goto/screenshot/request/console and ordinary interactions are insufficient; missing or unordered receipts convert to blocked (browser-command-evidence-missing).",
         "playwright-cli-only: generators and executors may call only skill-declared playwright-cli commands; bare playwright / npx playwright / @playwright/test / Playwright source are forbidden with no native Playwright fallback.",
         "Environment preflight must curl-probe the frozen non-production baseUrl before generate; unreachable or curl-unavailable ends preflight as blocked (frontend-base-url-unreachable|curl-unavailable) so generate/map do not run.",
         "U/D cases must prove current-user data ownership or create cleanable current-user data or authorized Mock; otherwise blocked (current-user-data-unavailable|data-ownership-unverifiable|safe-test-data-setup-unavailable) without cross-user mutation.",
@@ -5287,7 +5388,7 @@ async function buildHybridDagForTemplate(sources, template) {
         else if (template === "review-gated-dag")
             spec = buildReviewGatedHybridDag(standard, sources);
         else
-            spec = buildSupervisedHybridDag(standard, sources);
+            spec = await buildSupervisedHybridDag(standard, sources);
     }
     applyProjectGovernanceReview(spec, template, sources);
     // New generate path always emits DagSpec v4 + bindings.
@@ -5473,8 +5574,18 @@ function buildReviewGateNode(sources) {
 }
 function enableProjectGovernanceOnNode(task) {
     task.governanceStandardReview = true;
-    task.outputProtocol = REVIEW_VERDICT_OUTPUT_PROTOCOL;
     task.retryPolicy = PROTOCOL_AWARE_PI_RETRY_POLICY;
+    if (task.outputProtocol?.type === "json-review-verdict") {
+        const governanceInstruction = 'mandatory governance violations must use verdict "request-revision" with at least one finding; never emit verdict "pass" when any mandatory governance violation or Critical/Important finding remains.';
+        if (!(task.outputContract ?? "").includes("mandatory governance violations")) {
+            task.outputContract = `${task.outputContract ?? ""} Unresolved ${governanceInstruction} No file writes.`;
+        }
+        if (!task.subtask_prompt.includes(governanceInstruction)) {
+            task.subtask_prompt = `${task.subtask_prompt}\n\n${governanceInstruction}`;
+        }
+        return;
+    }
+    task.outputProtocol = REVIEW_VERDICT_OUTPUT_PROTOCOL;
     task.outputContract =
         "Plain Markdown whose first non-empty line is exactly VERDICT: pass or VERDICT: request-revision; unresolved mandatory governance violations force request-revision. No file writes.";
     const protocolInstruction = "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.";
@@ -5721,10 +5832,12 @@ function buildWriteSetGateNode(sources) {
         },
     };
 }
-function buildSoftVerifyNode(sources) {
+async function buildSoftVerifyNode(sources) {
     const implementId = implementationNodeId();
     const strategy = resolveDagVerifyStrategy(sources.taskConfig, "1");
-    const fallbackCommands = ["npm run typecheck"];
+    const fallbackCommands = sources.repoRoot
+        ? (await discoverFrontendFallbackVerifyCommands(sources.repoRoot)).staticCommands
+        : ["npm run typecheck"];
     const focusedIntermediate = sources.verifyCommands?.intermediate.filter((command) => !isFullSuiteVerifyCommand(command));
     const plannedIntermediate = applyMavenVerificationPlanning({
         repoRoot: sources.repoRoot,
@@ -5966,7 +6079,7 @@ function resolveSupervisedConvergence(taskConfig) {
         chainNodeIds: [...SUPERVISED_CONVERGENCE_CHAIN_NODE_IDS],
     };
 }
-function buildSupervisedHybridDag(standard, sources) {
+async function buildSupervisedHybridDag(standard, sources) {
     const contract = getTaskOrThrow(standard, "contract-pi");
     const scoutSrc = getTaskOrThrow(standard, "scout-src");
     const scoutTests = getTaskOrThrow(standard, "scout-tests");
@@ -6018,7 +6131,7 @@ function buildSupervisedHybridDag(standard, sources) {
                     "final-write-set-audit-format-repair-pi",
                 ],
             }),
-            buildSoftVerifyNode(sources),
+            await buildSoftVerifyNode(sources),
             buildProcessSupervisorNode(sources),
             buildProcessGateNode(sources),
             buildRepairNode(sources),

package/dist/workflows/dag/lifecycle.js

@@ -5,13 +5,31 @@ import { writeJsonAtomic, } from "../../infrastructure/harness/atomic-write.js";
 import { parseDagSpec } from "./types.js";
 import { normalizeDagFailureCategory, } from "./failure-category.js";
 import { dagProductLineFailureCategoryValues, routeDagFailure, } from "./failure-routing.js";
-const DAG_LIFECYCLE_SCAN_ORDER = [
+/** Resume/operator scan order for real execution lifecycles. */
+const DAG_EXECUTION_LIFECYCLE_SCAN_ORDER = [
     "paused",
     "active",
     "completed",
 ];
+/** Full disk scan including non-execution audit lifecycles (R-A2). */
+const DAG_LIFECYCLE_SCAN_ORDER = [
+    ...DAG_EXECUTION_LIFECYCLE_SCAN_ORDER,
+    "dry-run",
+    "init-only",
+];
 const PAUSED_APPROVAL_FLOW_HINT = "Use dag approve / dag reject, then dag resume when approved.";
 export const DAG_RUNS_DIR = path.join(".harness", "dag-runs");
+/** Non-execution audit lifecycles (never resume targets). */
+export const DAG_NON_EXECUTION_LIFECYCLES = ["dry-run", "init-only"];
+export function isDagNonExecutionLifecycle(lifecycle) {
+    return (lifecycle === "dry-run" ||
+        lifecycle === "init-only");
+}
+export function isDagExecutionLifecycle(lifecycle) {
+    return (lifecycle === "active" ||
+        lifecycle === "completed" ||
+        lifecycle === "paused");
+}
 export function getDagRunDir(cwd, lifecycle, runId) {
     return path.join(cwd, DAG_RUNS_DIR, lifecycle, runId);
 }
@@ -36,7 +54,8 @@ export async function readDagRunSpec(runDir) {
     return parseDagSpec(raw);
 }
 export async function locateDagRun(cwd, runId) {
-    for (const lifecycle of ["paused", "active", "completed"]) {
+    // Prefer real execution lifecycles for resume/status; audit dirs last.
+    for (const lifecycle of DAG_LIFECYCLE_SCAN_ORDER) {
         const runDir = getDagRunDir(cwd, lifecycle, runId);
         if (await dagRunDirExists(runDir)) {
             return { lifecycle, runDir };
@@ -233,6 +252,10 @@ export function deriveDagRunEffectiveStatus(input) {
     if (input.lifecycle === "completed") {
         return mapTerminalDagRunEffectiveStatus(input.state.status);
     }
+    // dry-run / init-only are audit shells; surface pending without pretending execute.
+    if (isDagNonExecutionLifecycle(input.lifecycle)) {
+        return input.state.status === "pending" ? "pending" : "unknown";
+    }
     if (input.state.status === "pending")
         return "pending";
     if (isTerminalDagRunStatus(input.state.status)) {
@@ -254,6 +277,14 @@ export function deriveDagRunEffectiveStatus(input) {
 }
 export function assessDagRunRecoveryEligibility(input) {
     const reasons = [];
+    if (isDagNonExecutionLifecycle(input.lifecycle)) {
+        return {
+            canResume: false,
+            canReconcile: false,
+            allowedActions: [],
+            reasons: ["non-execution-lifecycle"],
+        };
+    }
     const canResume = input.lifecycle === "active" &&
         input.state.status === "running" &&
         Boolean(input.state.humanDecisionNodeId) &&

package/dist/workflows/dag/node-execution.js

@@ -9,7 +9,7 @@ import { buildDagNodePromptEnvelope, formatConvergenceFeedbackBlock, } from "./p
 import { persistLongNodeOutputArtifacts } from "./upstream-artifacts.js";
 import { computeBackoffDelayMs, isRetryablePiFailureCategory, isSafeReadOnlyPiRetryCandidate, } from "./retry-policy.js";
 import { applyNodeActivity, evaluateNodeLiveness, resolveLivenessPolicy, } from "./liveness-policy.js";
-import { buildProtocolRetryInstruction, normalizeReviewVerdictAfterRetries, validateOutputProtocol, } from "./output-protocol.js";
+import { buildProtocolRetryInstruction, normalizeReviewVerdictAfterRetries, parseJsonReviewVerdict, validateOutputProtocol, } from "./output-protocol.js";
 import { writeDagNodeJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
 import { buildProjectGovernanceContext, readCompletedWriterChangeManifests, writeProjectGovernanceContext, } from "./project-governance-context.js";
 import { assertSkillSnapshotCoversSpec, buildNodePromptFromSnapshot, isDagSkillSnapshotIntegrityError, readSkillSnapshot, } from "./skill-snapshot.js";
@@ -83,8 +83,15 @@ export async function buildNodePromptWithResolvedSkillInstructions(spec, task, u
         resolvedSkills: skillInstructionMetadata(resolvedSkillInstructions),
     };
 }
+export function canonicalNodeOutput(node) {
+    const assistantText = node?.assistantText ?? "";
+    return assistantText.trim().length > 0 ? assistantText : (node?.stdout ?? "");
+}
 export function parseProcessVerdict(node) {
-    const text = `${node?.assistantText ?? ""}\n${node?.stdout ?? ""}`;
+    const text = canonicalNodeOutput(node);
+    const jsonVerdict = parseJsonReviewVerdict(text);
+    if (jsonVerdict.ok)
+        return jsonVerdict.verdict;
     for (const line of text.split("\n")) {
         const trimmed = line.trim();
         if (trimmed === "VERDICT: pass")
@@ -138,8 +145,7 @@ function assertRepairArtifactVerdictMatchesSupervisor(input) {
     }
 }
 function parseSupervisorRepairArtifact(node) {
-    const text = `${node?.assistantText ?? ""}\n${node?.stdout ?? ""}`;
-    return parseRepairArtifactFromText(text);
+    return parseRepairArtifactFromText(canonicalNodeOutput(node));
 }
 function validateRepairArtifactGateBeforeShell(input) {
     const gate = input.task.shell?.repairArtifactGate;
@@ -450,7 +456,7 @@ export async function executeDagNode(input) {
         // R0: executor ok=true still fails closed when outputProtocol is violated.
         // Valid semantic results (e.g. VERDICT: request-revision) pass validation.
         if (result.ok && task.outputProtocol) {
-            const protocolText = `${result.assistantText ?? ""}\n${result.stdout ?? ""}`;
+            const protocolText = canonicalNodeOutput(result);
             const protocolCheck = validateOutputProtocol(task.outputProtocol, protocolText);
             if (!protocolCheck.ok) {
                 result = {