@tea-agent/loop-agent 0.28.8 → 0.28.10

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## [Unreleased]
 
+## [0.28.10] - 2026-08-05
+
+### 重点更新
+
+- 修复 DAG 变更清单 schema 校验误杀合法执行清单的问题，恢复夜间测试成功路径
+
+### 修复
+
+- DAG writer change-manifest 的 schema 校验现可正确接受 Pi 执行器写入的 effectiveWriteSet 与 approval 元数据字段，修复 verify-pi project-governance-integrity 因 ownership/schema 不匹配而误拒合法 implement-pi 清单的问题
+
+## [0.28.9] - 2026-08-05
+
+### 重点更新
+
+- 提升 DAG 执行的可靠性与验证效率
+- 修复初始化时 Pi 模型矩阵的配置问题
+
+### 改进
+
+- 提升 DAG 执行的可靠性与验证效率
+
+### 修复
+
+- 修复初始化时 Pi 模型矩阵的配置问题
+
 ## [0.28.8] - 2026-08-05
 
 ### 重点更新

package/dist/application/task-lifecycle/advance.js

@@ -37,6 +37,13 @@ function hasEngineeringBoundary(input) {
         input.fromText ||
         input.fromDraftPath);
 }
+/** Inputs that must produce a new managed-contract revision when explicit. */
+function hasContractChangingInput(input) {
+    return Boolean(hasEngineeringBoundary(input) ||
+        input.title ||
+        input.taskKind ||
+        input.featureId);
+}
 function uniqueTransitions(existing, extra) {
     const set = new Set(existing);
     for (const item of extra)
@@ -197,6 +204,10 @@ export async function advanceTaskLifecycle(input) {
      * never reaches prepare-contract / gate.
      */
     let importedPrdThisCall = false;
+    /** A managed contract mutation is prepared at most once per invocation. */
+    let preparedContractThisCall = false;
+    /** A successful managed-contract mutation invalidates the prior DAG/gate. */
+    let regenerateDagThisCall = false;
     let snapshot = await observeTaskLifecycle(input.repoRoot, input.taskId);
     let record = (await loadLifecycleRecord(input.repoRoot, input.taskId)) ??
         emptyLifecycleRecord(input.taskId);
@@ -251,6 +262,9 @@ export async function advanceTaskLifecycle(input) {
         verifyCommands: applied.verifyCommands ?? input.verifyCommands,
     };
     const hasBoundary = hasEngineeringBoundary(effectiveInput);
+    let refreshManagedContractThisCall = Boolean(hasContractChangingInput(effectiveInput) &&
+        (snapshot.contract?.effectiveStatus === "managed" ||
+            Boolean(snapshot.contract?.revision && snapshot.contract.revision > 0)));
     if (applied.accepted) {
         warnings.push({
             code: "RECOMMENDATIONS_ACCEPTED",
@@ -341,11 +355,13 @@ export async function advanceTaskLifecycle(input) {
         snapshot: current,
         hasPrdInput: hasPrd && !importedPrdThisCall,
         hasEngineeringBoundary: hasBoundary,
+        refreshManagedContract: refreshManagedContractThisCall,
+        forceDagRefresh: regenerateDagThisCall,
         approveGate: consumeApproveGate || approvedThisCall,
         rejectGate: false,
         dryRun,
         skipFinalize: Boolean(input.skipFinalize),
-        forcePrepareContract: Boolean(input.fromDraftPath),
+        forcePrepareContract: Boolean(input.fromDraftPath) && !preparedContractThisCall,
     });
     if (dryRun) {
         const plan = planOnce(snapshot);
@@ -496,6 +512,12 @@ export async function advanceTaskLifecycle(input) {
                 });
                 break;
             }
+            preparedContractThisCall = true;
+            if (refreshManagedContractThisCall || input.fromDraftPath) {
+                // The old DAG and gate were bound to the pre-mutation contract.
+                refreshManagedContractThisCall = false;
+                regenerateDagThisCall = true;
+            }
             record = appendTransition(record, "contract-managed");
             completed.push("contract-managed");
             await saveLifecycleRecord(input.repoRoot, record);
@@ -540,6 +562,7 @@ export async function advanceTaskLifecycle(input) {
                 });
                 break;
             }
+            regenerateDagThisCall = false;
             record = appendTransition(record, "dag-generated");
             completed.push("dag-generated");
             await saveLifecycleRecord(input.repoRoot, record);

package/dist/application/task-lifecycle/plan-transitions.js

@@ -53,7 +53,7 @@ export function planTransitions(input) {
     // Prefer prepare once PRDs are on disk; re-import only when caller still
     // signals hasPrdInput (advance.ts latches this after one import per call).
     const shouldImportPrd = input.hasPrdInput;
-    if (input.forcePrepareContract) {
+    if (input.forcePrepareContract || input.refreshManagedContract) {
         if (shouldImportPrd) {
             actions.push({ type: "import-prd" });
             expectedTransitions.push("prd-imported");
@@ -106,11 +106,14 @@ export function planTransitions(input) {
     }
     const dagExists = snapshot.dagDraft?.exists === true;
     const strictValidated = snapshot.dagDraft?.strictValidated === true;
-    if (!dagExists) {
+    const dagRefreshRequired = Boolean(input.forceDagRefresh ||
+        input.refreshManagedContract ||
+        input.forcePrepareContract);
+    if (!dagExists || dagRefreshRequired) {
         actions.push({ type: "generate-dag" });
         expectedTransitions.push("dag-generated");
     }
-    if (!strictValidated) {
+    if (!strictValidated || dagRefreshRequired) {
         actions.push({ type: "strict-validate-dag" });
         expectedTransitions.push("dag-strict-validated");
     }
@@ -127,7 +130,7 @@ export function planTransitions(input) {
         snapshot.lifecycleState === "needs-attention" ||
         snapshot.lifecycleState === "awaiting-decision";
     const approvedForCurrent = postRunState || (input.approveGate && gate !== null);
-    if (!approvedForCurrent && (strictValidated || !dagExists)) {
+    if (!approvedForCurrent && (strictValidated || !dagExists || dagRefreshRequired)) {
         // Gate opens after generate+validate in the advance loop; plan includes open.
         if (!input.approveGate) {
             actions.push({ type: "open-write-set-gate" });

package/dist/cli/program.js

@@ -588,8 +588,8 @@ export function buildLoopAgentProgram(options) {
                 .option("--profile <profile>", "full|minimal", "full")
                 .option("--merge", "merge existing files")
                 .option("--no-merge", "skip existing files")
-                .option("--provider <provider>", "model provider")
-                .option("--model <model>", "model name")
+                .option("--provider <provider>", "provider paired with a bare --model (otherwise use provider/model)")
+                .option("--model <model>", "qualified provider/model, or a bare model paired with --provider")
                 .option("--json", "print JSON")
                 .option("--markdown", "print Markdown")
                 .option("--bootstrap-surface", "write an inferred .harness/init-surface.json baseline")

package/dist/commands/init.js

@@ -923,15 +923,23 @@ function buildHarness(input) {
         delete pi.requiresApiKey;
         mergedExecutors.pi = pi;
     }
-    // Prefer DAG-facing executors.*.defaultModel over legacy top-level models.*.
-    // --provider/--model still apply as a convenience override for pi defaultModel.
-    if (input.provider || input.model) {
+    // Init always writes a Pi tier matrix. `defaultModel` remains runtime
+    // compatibility for old projects only and is never fresh-init output.
+    if (input.model) {
         const piExisting = isRecord(mergedExecutors.pi) ? mergedExecutors.pi : {};
         mergedExecutors.pi = {
             ...piExisting,
-            ...(input.model ? { defaultModel: input.model } : {}),
+            LOW: input.model,
+            MED: input.model,
+            HIGH: input.model,
         };
     }
+    if (isRecord(mergedExecutors.pi)) {
+        const pi = { ...mergedExecutors.pi };
+        if (hasCompletePiTierMatrix(pi))
+            delete pi.defaultModel;
+        mergedExecutors.pi = pi;
+    }
     const harness = {
         ...input.existing,
         $schema: expectedHarnessSchemaRef(input.governanceRoot),
@@ -977,29 +985,17 @@ function buildHarness(input) {
         }),
         executors: mergedExecutors,
     };
-    // Do not project legacy step-routing models / modelProfiles / modelRouting into
-    // new or refreshed harness.json. Keep them only when the target already has them
-    // so old files remain loadable until the user migrates.
-    if (isRecord(input.existing.models) &&
-        Object.keys(input.existing.models).length > 0) {
-        harness.models = input.existing.models;
-    }
-    else {
-        delete harness.models;
-    }
-    if (isRecord(input.existing.modelProfiles) &&
-        Object.keys(input.existing.modelProfiles).length > 0) {
-        harness.modelProfiles = input.existing.modelProfiles;
-    }
-    else {
-        delete harness.modelProfiles;
-    }
-    if (isRecord(input.existing.modelRouting) &&
-        Object.keys(input.existing.modelRouting).length > 0) {
-        harness.modelRouting = input.existing.modelRouting;
-    }
-    else {
-        delete harness.modelRouting;
+    // Fresh init owns only the current DAG-facing surface. Legacy step routing is
+    // diagnosed by check-update rather than copied into a new harness projection.
+    for (const legacyField of [
+        "model",
+        "models",
+        "modelProfiles",
+        "modelRouting",
+        "verify",
+        "sequentialWorkflowRole",
+    ]) {
+        delete harness[legacyField];
     }
     return harness;
 }
@@ -1133,6 +1129,59 @@ function sha256Buffer(value) {
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/** A complete matrix has three effective values, not just three present keys. */
+function hasCompletePiTierMatrix(pi) {
+    return ["LOW", "MED", "HIGH"].every((tier) => {
+        const value = pi[tier];
+        if (typeof value === "string")
+            return value.length > 0 && value !== "default";
+        if (!isRecord(value))
+            return false;
+        const keys = Object.keys(value);
+        if (!keys.every((key) => key === "model" || key === "thinking"))
+            return false;
+        if (typeof value.model !== "string" || value.model.length === 0)
+            return false;
+        if (value.model === "default")
+            return false;
+        return value.thinking === undefined || typeof value.thinking === "string";
+    });
+}
+/** Resolve init CLI input to one unambiguous Pi `provider/model` reference. */
+export function normalizeInitModelReference(input) {
+    const provider = input.provider?.trim();
+    const model = input.model?.trim();
+    if (input.provider !== undefined && !provider) {
+        throw new Error("init --provider must be a non-empty provider id");
+    }
+    if (input.model !== undefined && !model) {
+        throw new Error("init --model must be a non-empty model reference");
+    }
+    if (provider && !model) {
+        throw new Error("init --provider requires --model");
+    }
+    if (!model)
+        return undefined;
+    const slash = model.indexOf("/");
+    if (slash < 0) {
+        if (!provider) {
+            throw new Error("init --model must be a provider/model reference or be paired with --provider");
+        }
+        if (/\s|\//.test(provider) || /\s/.test(model)) {
+            throw new Error("init provider/model values must not contain whitespace");
+        }
+        return `${provider}/${model}`;
+    }
+    const modelProvider = model.slice(0, slash);
+    const modelId = model.slice(slash + 1);
+    if (!modelProvider || !modelId || /\s/.test(modelProvider) || /\s/.test(modelId)) {
+        throw new Error("init --model must use a non-empty provider/model reference");
+    }
+    if (provider && provider !== modelProvider) {
+        throw new Error("init --provider conflicts with the provider qualified in --model");
+    }
+    return model;
+}
 function normalizeRelativePath(relativePath) {
     return relativePath.split(path.sep).join("/");
 }
@@ -1506,6 +1555,17 @@ async function writeInitSurfaceState(input) {
             }
         }
     }
+    if (input.acceptCurrentHarnessAsMerge) {
+        const harness = state.files["harness.json"];
+        if (harness?.relationship === "local-existing-unknown" &&
+            harness.currentSha256 !== undefined &&
+            harness.sourceSha256 !== undefined) {
+            harness.acceptedMerge = {
+                currentSha256: harness.currentSha256,
+                desiredSha256: harness.sourceSha256,
+            };
+        }
+    }
     const target = path.join(input.repoRoot, INIT_SURFACE_STATE_PATH);
     await mkdir(path.dirname(target), { recursive: true });
     await writeFile(target, `${JSON.stringify(state, null, 2)}\n`, "utf-8");
@@ -1596,39 +1656,103 @@ function collectSafeRetiredDirectories(paths) {
     }
     return [...dirs].sort((left, right) => right.split("/").length - left.split("/").length);
 }
-function needsHarnessModelMigration(harness) {
-    if ("model" in harness ||
-        "models" in harness ||
-        "modelProfiles" in harness ||
-        "modelRouting" in harness) {
-        return true;
+const PI_MODEL_TIERS = ["LOW", "MED", "HIGH"];
+const LEGACY_MODEL_FIELDS = [
+    "model",
+    "models",
+    "modelProfiles",
+    "modelRouting",
+    "provider",
+    "verify",
+    "sequentialWorkflowRole",
+];
+function isQualifiedModelReference(value) {
+    if (typeof value !== "string" || value.trim() !== value)
+        return false;
+    const slash = value.indexOf("/");
+    return (slash > 0 &&
+        slash < value.length - 1 &&
+        !/\s/.test(value.slice(0, slash)) &&
+        !/\s/.test(value.slice(slash + 1)));
+}
+/**
+ * Only a single, qualified old default can be expanded automatically. All
+ * routing/profile/tier ambiguity remains in the target for a bounded merge.
+ */
+function assessHarnessModelMigration(harness) {
+    const hasLegacyFields = LEGACY_MODEL_FIELDS.some((field) => field in harness);
+    const executors = harness.executors;
+    if (executors !== undefined && !isRecord(executors)) {
+        return hasLegacyFields
+            ? { kind: "ambiguous", reason: "executors is not an object" }
+            : { kind: "none" };
+    }
+    const executorRecord = executors ?? {};
+    if ("cursor" in executorRecord) {
+        return {
+            kind: "ambiguous",
+            reason: "executors.cursor has user-owned runtime semantics",
+        };
     }
-    if (isRecord(harness.executors)) {
-        if ("cursor" in harness.executors)
-            return true;
-        if (isRecord(harness.executors.pi)) {
-            return "requiresApiKey" in harness.executors.pi;
-        }
+    if ("pi" in executorRecord && !isRecord(executorRecord.pi)) {
+        return {
+            kind: "ambiguous",
+            reason: "executors.pi is not an object",
+        };
     }
-    return false;
+    const pi = isRecord(executorRecord.pi) ? executorRecord.pi : {};
+    const hasDefaultModel = "defaultModel" in pi;
+    const hasTier = PI_MODEL_TIERS.some((tier) => tier in pi);
+    if (["requiresApiKey", "provider", "model"].some((field) => field in pi) ||
+        Object.keys(pi).some((field) => !["description", "enabled", "defaultModel", ...PI_MODEL_TIERS].includes(field))) {
+        return {
+            kind: "ambiguous",
+            reason: "executors.pi contains unknown or deprecated model semantics",
+        };
+    }
+    if (hasLegacyFields) {
+        return {
+            kind: "ambiguous",
+            reason: "legacy top-level model or workflow fields cannot be proven equivalent",
+        };
+    }
+    if (!hasDefaultModel)
+        return { kind: "none" };
+    if (hasTier) {
+        return {
+            kind: "ambiguous",
+            reason: "existing LOW/MED/HIGH tier configuration cannot be replaced by defaultModel automatically",
+        };
+    }
+    if (pi.defaultModel === "default")
+        return { kind: "none" };
+    if (!isQualifiedModelReference(pi.defaultModel)) {
+        return {
+            kind: "ambiguous",
+            reason: "defaultModel is not a complete provider/model reference",
+        };
+    }
+    return { kind: "safe", model: pi.defaultModel, removeDefaultModel: true };
+}
+function needsHarnessModelMigration(harness) {
+    return assessHarnessModelMigration(harness).kind === "safe";
 }
 function migrateHarnessModelFields(harness) {
+    const assessment = assessHarnessModelMigration(harness);
+    if (assessment.kind !== "safe") {
+        throw new Error("ambiguous harness model migration must be merged manually");
+    }
     const next = { ...harness };
-    const legacyModel = typeof next.model === "string" ? next.model : undefined;
-    delete next.model;
-    delete next.models;
-    delete next.modelProfiles;
-    delete next.modelRouting;
+    for (const field of LEGACY_MODEL_FIELDS)
+        delete next[field];
     const executors = isRecord(next.executors) ? { ...next.executors } : {};
-    delete executors.cursor;
     const pi = isRecord(executors.pi) ? { ...executors.pi } : {};
-    delete pi.requiresApiKey;
-    if (legacyModel) {
-        for (const level of ["LOW", "MED", "HIGH"]) {
-            if (typeof pi[level] !== "string")
-                pi[level] = legacyModel;
-        }
+    if (assessment.model) {
+        for (const tier of PI_MODEL_TIERS)
+            pi[tier] = assessment.model;
     }
+    if (assessment.removeDefaultModel)
+        delete pi.defaultModel;
     executors.pi = pi;
     next.executors = executors;
     return next;
@@ -2177,6 +2301,14 @@ function buildTargetLoopAgentHarness(input) {
         "",
         "Use `loop-agent task advance` / `loop-agent task status` for non-trivial implementation work; advanced arbitrary DagSpec uses `loop-agent dag execute`.",
         "",
+        "## Pi Model Matrix",
+        "",
+        "New DAG work reads only `harness.json.executors.pi.LOW`, `MED`, and `HIGH`. Each tier must be a model string or `{ model, thinking? }`; use explicit `provider/model` references when choosing a provider. Fresh init does not write `defaultModel`, `models`, `modelProfiles`, or `modelRouting`. `defaultModel` remains a runtime fallback only for compatible older projects.",
+        "",
+        "```json",
+        '{ "executors": { "pi": { "LOW": "provider/low", "MED": "provider/medium", "HIGH": "provider/high" } } }',
+        "```",
+        "",
         "## Adaptive Liveness",
         "",
         "- Healthy Pi nodes are no longer stopped by a fixed 30-minute deadline. The default 4h absolute max is a final safety bound and cannot be extended by synthetic heartbeats.",
@@ -2273,7 +2405,7 @@ export function buildInitInstructions(input) {
         "",
         `- Project name: default \`${projectName}\`.`,
         `- Governance root: default \`${governanceRoot}\`.`,
-        "- Confirm provider/model. Defaults may be used, but the target project may need a different provider/model matrix.",
+        "- Confirm the Pi LOW/MED/HIGH matrix. Explicit input must be `--model provider/model` or a paired `--provider provider --model model`; do not guess a provider for a bare model.",
         "- Default: merge existing AGENTS.md, harness.json, and loop-agent governance docs instead of overwriting user content.",
         "",
         "## Initialization Upgrade Routing",
@@ -2284,7 +2416,7 @@ export function buildInitInstructions(input) {
         "",
         "## Apply Defaults",
         "",
-        '- Use the current loop-agent harness.json as the default template, but write target project name plus `adapter: "loop-agent"`.',
+        '- Use the current loop-agent harness.json as the default template, but write target project name plus `adapter: "loop-agent"` and a Pi-only `executors.pi.LOW/MED/HIGH` matrix. Do not write `defaultModel` when all three tiers exist, and never project `model`, `models`, `modelProfiles`, `modelRouting`, `verify`, or `sequentialWorkflowRole`.',
         `- ${DAG_HARD_GATE_TRIGGER}`,
         "- Generate the target project's loop-agent script matrix from templates: structure check, docs index/link checks, active plan status, exec-plan index sync, harness runtime cleanliness, architecture boundaries, skill entry integrity, governance CI, project-test CI, and full CI.",
         "- Copy or project only stack-agnostic governance scripts. For project-specific verification, packaging, release, or maintenance commands, generate the target-project version from templates plus the target repository's actual files instead of copying loop-agent's own TypeScript-specific scripts.",
@@ -2312,7 +2444,7 @@ export function buildInitInstructions(input) {
         "3. Continue immediately into project inspection and adaptation.",
         "4. Finish by running the init health checks and quick verification.",
         "",
-        "If provider/model is not specified and the existing/default harness values are usable, proceed with those defaults and record the assumption in the handoff. Ask the user only when the choice affects credentials, cost, availability, or an explicitly requested model backend.",
+        "If provider/model is not specified and the existing tier matrix is usable, proceed with it and record the assumption in the handoff. Ask the user only when the choice affects credentials, cost, availability, or an explicitly requested model backend. An ambiguous old model configuration must stay in a bounded harness.json model merge/human decision; never silently reinterpret it.",
         "",
         "## Required Model Adaptation",
         "",
@@ -2345,11 +2477,21 @@ export async function initializeLoopAgentProject(options) {
     const governanceRoot = options.governanceRoot ?? DEFAULT_GOVERNANCE_ROOT;
     const profile = options.profile ?? "full";
     const merge = options.merge ?? true;
+    const model = normalizeInitModelReference(options);
     const written = [];
     const skipped = [];
     const assetRoot = await findPackageRoot();
     const template = await readJsonIfExists(path.join(assetRoot, "harness.json"));
-    const existingHarness = await readJsonIfExists(path.join(repoRoot, "harness.json"));
+    let existingHarness = await readJsonIfExists(path.join(repoRoot, "harness.json"));
+    if (Object.keys(existingHarness).length > 0) {
+        const migration = assessHarnessModelMigration(existingHarness);
+        if (migration.kind === "ambiguous") {
+            throw new Error(`init refuses to overwrite ambiguous legacy model configuration: ${migration.reason}; run init check-update and complete the harness.json model merge`);
+        }
+        if (migration.kind === "safe") {
+            existingHarness = migrateHarnessModelFields(existingHarness);
+        }
+    }
     await mkdir(repoRoot, { recursive: true });
     const readmePath = path.join(repoRoot, "README.md");
     const existingReadme = (await exists(readmePath))
@@ -2371,8 +2513,7 @@ export async function initializeLoopAgentProject(options) {
         template,
         projectName,
         governanceRoot,
-        provider: options.provider,
-        model: options.model,
+        model,
     });
     await writeText({
         repoRoot,
@@ -2515,6 +2656,7 @@ export async function initializeLoopAgentProject(options) {
         projectName,
         governanceRoot,
         stateKind: "recorded",
+        acceptCurrentHarnessAsMerge: model !== undefined,
     });
     written.push(INIT_SURFACE_STATE_PATH);
     return {
@@ -2764,12 +2906,36 @@ export async function checkInitUpdate(input) {
                     reason: `replace the legacy default governanceRoot docs with ${governanceRoot}`,
                 });
             }
-            if (isRecord(harness) && needsHarnessModelMigration(harness)) {
-                deterministicActions.push({
-                    type: "migrate-harness-model-fields",
-                    path: "harness.json",
-                    reason: "harness.json contains legacy model fields or executor fields that can be safely normalized",
-                });
+            if (isRecord(harness)) {
+                const modelMigration = assessHarnessModelMigration(harness);
+                if (modelMigration.kind === "safe") {
+                    deterministicActions.push({
+                        type: "migrate-harness-model-fields",
+                        path: "harness.json",
+                        reason: "expand one proven-equivalent legacy model into the Pi LOW/MED/HIGH matrix",
+                    });
+                }
+                else if (modelMigration.kind === "ambiguous") {
+                    const state = currentState.files["harness.json"];
+                    const mergeTask = modelMergeTaskFor("harness.json", state, allPaths, recordedState);
+                    mergeTask.reason = `legacy model configuration requires a human/model merge: ${modelMigration.reason}`;
+                    mergeTask.mergeRules = [
+                        "Preserve every existing harness.json field unless the user explicitly approves its migration.",
+                        "Map only unambiguous complete provider/model references to executors.pi.LOW, MED, and HIGH.",
+                        "Do not retain defaultModel when all three tiers are present; do not invent a provider for bare model ids.",
+                        "Do not restore models, modelProfiles, modelRouting, cursor, or other legacy routing fields.",
+                    ];
+                    mergeTask.verification = [
+                        "loop-agent init check-update --repo-root . --json",
+                        "loop-agent inspect --repo-root .",
+                        "bash scripts/check-repo.sh",
+                    ];
+                    const existingTask = modelMergeTasks.findIndex((task) => task.path === "harness.json");
+                    if (existingTask >= 0)
+                        modelMergeTasks[existingTask] = mergeTask;
+                    else
+                        modelMergeTasks.push(mergeTask);
+                }
             }
         }
         catch {
@@ -3273,6 +3439,7 @@ function parseInitArgs(repoRoot, args) {
     if (versionChoice && !["current", "upgrade", "cancel", "retry"].includes(versionChoice)) {
         throw new Error("init upgrade --version-choice must be current|upgrade|cancel|retry");
     }
+    const normalizedModel = normalizeInitModelReference({ provider, model });
     return {
         repoRoot,
         projectName,
@@ -3280,7 +3447,7 @@ function parseInitArgs(repoRoot, args) {
         profile,
         merge,
         provider,
-        model,
+        model: normalizedModel,
         clientRecovery,
         subcommand,
         json,

package/dist/executors/dag-pi-executor.js

@@ -311,6 +311,21 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
     const persona = resolveDagPiPersona(input.task);
     const step = resolveDagPiStepName(input.task);
     const isWriteTask = isDagPiWriteTask(input.task);
+    if (isWriteTask && input.task.finalWriteSetApproval) {
+        const binding = input.task.finalWriteSetApproval;
+        const resolved = input.task.resolvedFinalWriteSetApproval;
+        if (!resolved ||
+            resolved.approvalSourceNodeId !== binding.approvalSourceNodeId ||
+            !/^[a-f0-9]{64}$/.test(resolved.approvalDigest)) {
+            return {
+                ok: false,
+                stdout: "",
+                stderr: "final-write-set-approval-invalid: writer authorization was not resolved before Pi execution",
+                failureCategory: "final-write-set-approval-invalid",
+                durationMs: Date.now() - started,
+            };
+        }
+    }
     const allowedSteps = isWriteTask ? PI_WRITE_STEPS : SAFE_PI_STEPS;
     if (!allowedSteps.has(step)) {
         return {
@@ -657,6 +672,9 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             runDir: meta.runDir,
             nodeId: input.task.id,
             writerNodeId: input.task.id,
+            effectiveWriteSet: input.task.writeSet ?? [],
+            approvalSourceNodeId: input.task.resolvedFinalWriteSetApproval?.approvalSourceNodeId,
+            approvalDigest: input.task.resolvedFinalWriteSetApproval?.approvalDigest,
             changedFiles: changeManifestChangedFiles,
             beforeStatus,
             afterStatus: changeManifestAfterStatus ?? "",
@@ -966,6 +984,13 @@ async function persistWriterChangeManifest(input) {
     const manifest = {
         schemaVersion: 1,
         writerNodeId: input.writerNodeId,
+        effectiveWriteSet: [...input.effectiveWriteSet],
+        ...(input.approvalSourceNodeId
+            ? { approvalSourceNodeId: input.approvalSourceNodeId }
+            : {}),
+        ...(input.approvalDigest
+            ? { approvalDigest: input.approvalDigest }
+            : {}),
         changedFiles: input.changedFiles,
         beforeStatusSha256: createHash("sha256")
             .update(input.beforeStatus)