@tea-agent/loop-agent 0.28.8 → 0.28.10

package/dist/task/source-prepare/prepare.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
-import { lstat } from "node:fs/promises";
+import { lstat, readFile } from "node:fs/promises";
 import { ContractMutationError, applyTaskContract, logicalRevisionForState, observeTaskContractState, projectConstraintsMarkdown, projectRequirementMarkdown, sha256OfCanonicalJson, validateDraftForTask, } from "../contract/index.js";
+import { TASK_CONTRACT_DRAFT_SCHEMA_VERSION } from "../contract/constants.js";
 import { getTaskContractPaths } from "../contract/paths.js";
 import { loadTaskConfig } from "../runtime.js";
 import { buildPrepareDraft } from "./build-draft.js";
@@ -26,6 +27,84 @@ async function loadExistingTaskConfig(repoRoot, taskId) {
         return null;
     }
 }
+async function loadManagedProjectionDraft(input) {
+    const config = input.existingTaskConfig;
+    if (!config) {
+        return { ok: false, message: "managed task config could not be loaded" };
+    }
+    try {
+        const [requirement, constraints] = await Promise.all([
+            readFile(input.requirementPath, "utf-8"),
+            readFile(input.constraintsPath, "utf-8"),
+        ]);
+        const requirementFacts = extractRequirementFactsFromMarkdown(requirement);
+        const constraintFacts = extractRequirementFactsFromMarkdown(constraints);
+        if (/^##\s+(?:References|Source Resolutions)\s*$/im.test(requirement)) {
+            return {
+                ok: false,
+                message: "managed requirement projection contains unsupported References or Source Resolutions; use loop-agent task advance " +
+                    input.taskId +
+                    " --from-draft <reviewed-draft.json> --json",
+            };
+        }
+        if (!requirementFacts.objective?.trim()) {
+            return {
+                ok: false,
+                message: "managed requirement projection is missing objective",
+            };
+        }
+        if (requirementFacts.acceptanceCriteria.length === 0) {
+            return {
+                ok: false,
+                message: "managed requirement projection is missing acceptance criteria",
+            };
+        }
+        if (!config.allowedPaths.length || !config.forbiddenPaths.length) {
+            return {
+                ok: false,
+                message: "managed task config is missing path boundaries",
+            };
+        }
+        return {
+            ok: true,
+            draft: {
+                schemaVersion: TASK_CONTRACT_DRAFT_SCHEMA_VERSION,
+                taskId: input.taskId,
+                title: config.title,
+                taskKind: config.taskKind,
+                ...(config.featureId ? { featureId: config.featureId } : {}),
+                requirement: {
+                    objective: requirementFacts.objective,
+                    scope: requirementFacts.scope,
+                    nonGoals: requirementFacts.nonGoals,
+                    acceptanceCriteria: requirementFacts.acceptanceCriteria,
+                },
+                constraints: {
+                    invariants: constraintFacts.invariants,
+                    allowedPaths: config.allowedPaths,
+                    forbiddenPaths: config.forbiddenPaths,
+                    ...(config.allowedRoots !== undefined
+                        ? { allowedRoots: config.allowedRoots }
+                        : {}),
+                },
+                verification: { commands: config.verifyCommands },
+                ...(requirementFacts.openQuestions.length > 0
+                    ? { openQuestions: requirementFacts.openQuestions }
+                    : {}),
+                ...(requirementFacts.assumptions.length > 0
+                    ? { assumptions: requirementFacts.assumptions }
+                    : {}),
+                hardConstraints: config.hardConstraints,
+            },
+        };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            message: `managed projection could not be reconstructed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
 function mutationOutcome(code) {
     switch (code) {
         case "REVISION_CONFLICT":
@@ -69,9 +148,8 @@ function buildNextSteps(input) {
         next.push(`loop-agent task advance ${input.taskId} --profile auto --json`);
         next.push("审查 DAG writeSet 后再 task advance --approve-gate ...");
     }
-    if (input.gaps.some((g) => g.code === "DIRTY_SOURCE")) {
-        next.push("loop-agent task status --json | task advance --from-draft ...");
-        next.push("或显式 --force-overwrite-source 后重跑 prepare");
+    if (input.gaps.some((g) => g.code === "DIRTY_SOURCE" || g.code === "MANAGED_PROJECTION_INCOMPLETE")) {
+        next.push(`loop-agent task advance ${input.taskId} --from-draft <reviewed-draft.json> --json`);
     }
     if (input.gaps.some((g) => g.code === "TRANSACTION_INCOMPLETE")) {
         next.push(`loop-agent task advance ${input.taskId} --json`);
@@ -132,6 +210,24 @@ export async function prepareTaskSource(input) {
         }
     }
     let baseDraft;
+    let managedProjectionError;
+    if ((input.intent.kind === "facts" &&
+        !input.intent.text &&
+        (state.effectiveStatus === "managed" ||
+            Boolean(state.ref && state.ref.revision > 0)))) {
+        const projection = await loadManagedProjectionDraft({
+            taskId,
+            existingTaskConfig,
+            requirementPath: contractPaths.requirementPath,
+            constraintsPath: contractPaths.constraintsPath,
+        });
+        if (projection.ok) {
+            baseDraft = projection.draft;
+        }
+        else {
+            managedProjectionError = projection.message;
+        }
+    }
     let facts;
     let sourceIntegrity = null;
     let hasImportedPrd = false;
@@ -272,6 +368,13 @@ export async function prepareTaskSource(input) {
         sourceFilesPresent,
         forceOverwriteSource: input.forceOverwriteSource,
     });
+    if (managedProjectionError) {
+        gaps.push({
+            code: "MANAGED_PROJECTION_INCOMPLETE",
+            level: "blocking",
+            message: managedProjectionError,
+        });
+    }
     // If --use-imported-prd and no parseable requirement and no AC from flags/text → blocking
     if (input.intent.kind === "facts" &&
         input.intent.useImportedPrd &&

package/dist/workflows/dag/frontend-lint-baseline.js

@@ -292,6 +292,9 @@ const writerChangeManifestSchema = z
     .object({
     schemaVersion: z.literal(1),
     writerNodeId: z.string().min(1),
+    effectiveWriteSet: z.array(z.string()).optional(),
+    approvalSourceNodeId: z.string().min(1).optional(),
+    approvalDigest: z.string().min(1).optional(),
     changedFiles: z.array(relativePathSchema),
     beforeStatusSha256: sha256Schema,
     afterStatusSha256: sha256Schema,

package/dist/workflows/dag/init-hybrid.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { access, readdir, readFile, realpath } from "node:fs/promises";
+import { existsSync } from "node:fs";
 import path from "node:path";
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
 import { assertValidDagSpec } from "./validate.js";
@@ -958,7 +959,6 @@ function verifyCommandKey(command) {
         cwdKey,
         normalizedArgs.join("\0"),
         envKey,
-        command.timeoutMs ?? "",
     ].join("\u0001");
 }
 function normalizeVerifyCommandArgs(args) {
@@ -1028,6 +1028,103 @@ function tokenizeSimpleShellCommand(command) {
         tokens.push(token);
     return tokens.length > 0 ? tokens : undefined;
 }
+function isCheckRepoVerifyCommand(command) {
+    return normalizeVerifyCommandArgs(command.args)
+        .join(" ")
+        .replaceAll("\\", "/")
+        .includes("scripts/check-repo.sh");
+}
+const CHECK_REPO_COVERED_SCRIPTS = new Set([
+    "scripts/check-doc-links.sh",
+    "scripts/check-skill-entry.sh",
+    "scripts/check-init-surface.sh",
+]);
+function localScriptTarget(command) {
+    const args = normalizeVerifyCommandArgs(command.args);
+    const candidate = args.find((arg) => arg.replaceAll("\\", "/").startsWith("scripts/"));
+    return candidate?.replaceAll("\\", "/");
+}
+function isCheckRepoCoveredCommand(command) {
+    const target = localScriptTarget(command);
+    return target ? CHECK_REPO_COVERED_SCRIPTS.has(target) : false;
+}
+function canonicalizeVerificationCommands(commands) {
+    const byKey = new Map();
+    const merged = new Map();
+    for (const command of commands) {
+        const canonicalKey = verifyCommandKey(command);
+        const retained = byKey.get(canonicalKey);
+        if (!retained) {
+            byKey.set(canonicalKey, { ...command, env: command.env ? { ...command.env } : undefined });
+            merged.set(canonicalKey, {
+                canonicalKey,
+                keptLabel: command.label,
+                mergedLabels: [],
+                effectiveTimeoutMs: command.timeoutMs ?? null,
+            });
+            continue;
+        }
+        const retainedTimeout = retained.timeoutMs ?? 0;
+        const candidateTimeout = command.timeoutMs ?? 0;
+        if (candidateTimeout > retainedTimeout)
+            retained.timeoutMs = command.timeoutMs;
+        const mergedEntry = merged.get(canonicalKey);
+        mergedEntry.effectiveTimeoutMs = retained.timeoutMs ?? null;
+        mergedEntry.mergedLabels.push(command.label);
+    }
+    const retained = [...byKey.values()];
+    const aggregate = retained.find(isCheckRepoVerifyCommand);
+    const covered = [];
+    const commandsAfterCoverage = aggregate
+        ? retained.filter((command) => {
+            if (!isCheckRepoCoveredCommand(command))
+                return true;
+            covered.push({ aggregateLabel: aggregate.label, coveredLabel: command.label });
+            return false;
+        })
+        : retained;
+    return {
+        commands: commandsAfterCoverage,
+        merged: [...merged.values()].filter((entry) => entry.mergedLabels.length > 0),
+        covered,
+    };
+}
+function assertVerificationPlanPreflight(input) {
+    const root = path.resolve(input.repoRoot);
+    for (const command of input.commands) {
+        const cwd = path.resolve(command.cwd);
+        if (!isWithinRepo(root, cwd) || !existsSync(cwd)) {
+            throw new Error(`verification preflight rejected cwd for ${command.label}: ${command.cwd}`);
+        }
+        const script = localScriptTarget(command);
+        if (!script)
+            continue;
+        const scriptPath = path.resolve(cwd, script);
+        if (existsSync(scriptPath))
+            continue;
+        const writerMayCreate = input.taskConfig.allowedPaths.some((allowed) => pathMatchesPattern(script, allowed.replace(/^\.\//, "")));
+        if (!writerMayCreate) {
+            throw new Error(`verification preflight missing local script for ${command.label}: ${script}`);
+        }
+    }
+}
+function isWithinRepo(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+function taskVerifyCommands(repoRoot, taskConfig) {
+    if (!repoRoot)
+        return [];
+    return taskConfig.verifyCommands.map((command) => ({
+        args: ["bash", "-lc", command.command],
+        cwd: repoRoot,
+        label: command.label,
+        timeoutMs: command.timeoutMs,
+    }));
+}
+function verifyQuotaLimit(quota) {
+    return quota === "full" ? undefined : Number.parseInt(quota, 10);
+}
 function isFullSuiteVerifyCommand(command) {
     const args = normalizeVerifyCommandArgs(command.args);
     let index = 0;
@@ -1043,10 +1140,10 @@ function isFullSuiteVerifyCommand(command) {
             (rest.length === 2 && rest[0] === "run" && rest[1] === "test"));
     }
     if (["bash", "sh"].includes(executable) && rest.length === 1) {
-        return /(?:^|\/)scripts\/ci\.sh$/i.test(rest[0].replace(/\\/g, "/"));
+        return /(?:^|\/)scripts\/(?:ci|check-repo)\.sh$/i.test(rest[0].replace(/\\/g, "/"));
     }
     return (rest.length === 0 &&
-        /(?:^|\/)scripts\/ci\.sh$/i.test((args[index] ?? "").replace(/\\/g, "/")));
+        /(?:^|\/)scripts\/(?:ci|check-repo)\.sh$/i.test((args[index] ?? "").replace(/\\/g, "/")));
 }
 function resolveDagVerifyStrategy(taskConfig, defaultIntermediateQuotaWhenFull = "full") {
     const explicitIntermediateQuota = taskConfig.dagVerifyStrategy?.intermediateQuota;
@@ -1070,6 +1167,13 @@ function buildVerifyEvidence(input) {
         commandLabels: selectedCommands?.map((command) => command.label) ??
             input.fallbackCommands,
         commandTexts: input.commandTexts ?? [],
+        canonicalKeys: selectedCommands?.map(verifyCommandKey) ?? [],
+        mergedCommands: input.plan?.merged ?? [],
+        coveredCommands: input.plan?.covered ?? [],
+        selectionReasons: selectedCommands?.map((command) => input.phase === "intermediate" && isFullSuiteVerifyCommand(command)
+            ? `${command.label}: deferred-heavy`
+            : `${command.label}: kept`) ?? [],
+        preflight: selectedCommands?.map((command) => ({ label: command.label, status: "ok" })) ?? [],
         commandTimeoutMs: input.commandTimeoutMs,
         totalTimeoutBudgetMs: commandCount * input.commandTimeoutMs,
         finalFullRequired: input.finalFullRequired,
@@ -1388,6 +1492,10 @@ export async function loadTaskHybridSources(repoRoot, taskId) {
     catch {
         throw new Error(`task.json not found for task "${taskId}": expected ${paths.taskConfigPath}`);
     }
+    const taskConfig = await loadTaskConfig(repoRoot, taskId);
+    // Baseline boundaries are independently knowable from task.json and must
+    // not be masked by source or adapter verification loading failures.
+    assertTaskAllowedPathsPreflight(taskConfig);
     let requirementMarkdown;
     try {
         requirementMarkdown = await readFile(requirementPath, "utf-8");
@@ -1402,7 +1510,6 @@ export async function loadTaskHybridSources(repoRoot, taskId) {
     catch {
         // optional
     }
-    const taskConfig = await loadTaskConfig(repoRoot, taskId);
     await materializeTaskReferenceDocs({
         repoRoot,
         taskId,
@@ -1415,19 +1522,40 @@ export async function loadTaskHybridSources(repoRoot, taskId) {
     try {
         const adapter = await resolveAdapter(repoRoot);
         const preset = resolveVerifyPreset(taskConfig.verifyPreset, taskConfig);
+        const adapterIntermediate = adapter.getVerifyCommands(repoRoot, {
+            preset,
+            quota: strategy.intermediateQuota,
+            phase: "intermediate",
+            taskConfig,
+        });
+        const adapterFinal = adapter.getVerifyCommands(repoRoot, {
+            preset,
+            quota: "full",
+            phase: "final",
+            taskConfig,
+        });
+        const intermediatePlan = canonicalizeVerificationCommands([
+            ...taskVerifyCommands(repoRoot, taskConfig),
+            ...adapterIntermediate,
+        ]);
+        const finalPlan = canonicalizeVerificationCommands([
+            ...taskVerifyCommands(repoRoot, taskConfig),
+            ...adapterFinal,
+        ]);
+        assertVerificationPlanPreflight({
+            repoRoot,
+            commands: [...intermediatePlan.commands, ...finalPlan.commands],
+            taskConfig,
+        });
         verifyCommands = {
-            intermediate: adapter.getVerifyCommands(repoRoot, {
-                preset,
-                quota: strategy.intermediateQuota,
-                phase: "intermediate",
-                taskConfig,
-            }),
-            final: mergeFinalVerifyCommands(repoRoot, taskConfig, adapter.getVerifyCommands(repoRoot, {
-                preset,
-                quota: "full",
-                phase: "final",
-                taskConfig,
-            })),
+            intermediate: [
+                ...taskVerifyCommands(repoRoot, taskConfig),
+                ...adapterIntermediate,
+            ],
+            final: [
+                ...taskVerifyCommands(repoRoot, taskConfig),
+                ...adapterFinal,
+            ],
         };
         if (verifyCommands.final.length === 0) {
             throw new Error("adapter returned no final verification commands");
@@ -1491,22 +1619,6 @@ async function prepareFrontendMockSources(sources, discoveredProjectCapability)
         frontendRisk,
     };
 }
-function mergeFinalVerifyCommands(repoRoot, taskConfig, adapterCommands) {
-    const taskCommands = taskConfig.verifyCommands.map((command) => ({
-        args: ["bash", "-lc", command.command],
-        cwd: repoRoot,
-        label: command.label,
-        timeoutMs: command.timeoutMs,
-    }));
-    const seen = new Set();
-    return [...taskCommands, ...adapterCommands].filter((command) => {
-        const key = verifyCommandKey(command);
-        if (seen.has(key))
-            return false;
-        seen.add(key);
-        return true;
-    });
-}
 export function buildStandardHybridDagFromTask(sources) {
     const { taskConfig } = sources;
     const forbiddenPaths = mergeForbiddenPaths(taskConfig);
@@ -1518,9 +1630,10 @@ export function buildStandardHybridDagFromTask(sources) {
     const implementComplexity = resolveWriterComplexity(taskConfig);
     const implementId = implementationNodeId();
     const finalVerifyCommands = sources.verifyCommands?.final ?? [];
+    const finalVerifyPlan = canonicalizeVerificationCommands(finalVerifyCommands);
     const plannedFinal = applyMavenVerificationPlanning({
         repoRoot: sources.repoRoot,
-        commands: finalVerifyCommands,
+        commands: finalVerifyPlan.commands,
         taskConfig,
     });
     const verifyShellCommands = buildVerifyShellCommands({
@@ -1553,6 +1666,7 @@ export function buildStandardHybridDagFromTask(sources) {
                         fallbackCommands: [],
                         finalFullRequired: true,
                         commandTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+                        plan: finalVerifyPlan,
                     }),
                     cwd: ".",
                     timeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
@@ -5290,21 +5404,17 @@ export async function requireManagedTaskContractBinding(input) {
         taskId: input.taskId,
     });
     if (state.effectiveStatus !== "managed" || !state.ref) {
-        const expectedRevision = state.ref?.revision ?? 0;
-        const observedCanonicalHash = state.observedCanonicalHash ?? "<observedCanonicalHash-from-show>";
         const recovery = state.effectiveStatus === "transaction-incomplete"
             ? `Recover the unfinished transaction first: loop-agent task advance ${input.taskId} --json`
             : [
-                "After reviewing the show JSON, either adopt the current on-disk facts:",
-                `loop-agent task advance ${input.taskId} --from-draft --expected-revision ${expectedRevision} --expected-observed-hash ${observedCanonicalHash} --request-id <unique-request-id> --request-payload-sha256 <sha256-of-this-adopt-request> --json`,
-                "or apply a reviewed draft:",
-                `loop-agent task advance ${input.taskId} --from-draft --input <reviewed-draft.json> --expected-revision ${expectedRevision} --expected-observed-hash ${observedCanonicalHash} --request-id <unique-request-id> --request-payload-sha256 <sha256-of-input-file> --json`,
+                "Create or review a TaskContractDraftV1 JSON file, then apply it through the public lifecycle command:",
+                `loop-agent task advance ${input.taskId} --from-draft <reviewed-draft.json> --json`,
             ].join(" ");
         const err = new Error([
             `dag generate requires managed Task Contract for task ${input.taskId} (effectiveStatus=${state.effectiveStatus})`,
             `Inspect current state: loop-agent task status ${input.taskId} --json`,
             recovery,
-            "Do not auto-adopt or auto-apply before confirming the Task Contract facts and concurrency fields.",
+            "Do not auto-apply before confirming the Task Contract facts.",
         ].join("; "));
         err.code =
             state.effectiveStatus === "externally-modified"
@@ -5728,11 +5838,12 @@ function buildWriteSetAuditFormatRepairNode(sources, options) {
         writePolicy: "read-only",
         allowedPaths: commonReadOnlyPaths(sources),
         forbiddenPaths: commonForbiddenPaths(sources),
-        outputContract: "Plain Markdown whose first non-empty line is exactly VERDICT: pass or VERDICT: request-revision, followed by the original audit findings without substantive changes. No file writes.",
+        outputContract: "Plain Markdown whose first non-empty line is exactly VERDICT: pass or VERDICT: request-revision. For a final audit pass, preserve exactly one valid FINAL_WRITE_SET_APPROVAL_JSON from upstream; never infer, create, alter, or broaden approval data. No file writes.",
         subtask_prompt: [
             `Normalize the output format of ${options.auditNodeId}; this is the single read-only format-repair attempt for that audit.`,
             "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.",
             "If the upstream audit already contains a valid verdict, preserve it exactly. If it omitted or malformed the verdict but states an unambiguous audit conclusion, add only the matching canonical verdict and preserve the findings.",
+            "For final-write-set-audit-pi only: a pass requires exactly one upstream FINAL_WRITE_SET_APPROVAL_JSON block. Preserve it unchanged; never infer, synthesize, normalize, remove, alter, or broaden approval data. Otherwise emit VERDICT: request-revision.",
             "Do not add, remove, or reclassify substantive findings. If the upstream conclusion is ambiguous or cannot be preserved safely, emit VERDICT: request-revision and report the format ambiguity.",
             "Do not infer a pass from general prose, expand task allowedPaths, or edit files.",
             buildSourceContextBlock(sources),
@@ -5802,11 +5913,12 @@ function buildFinalWriteSetAuditNode(sources) {
         writePolicy: "read-only",
         allowedPaths: commonReadOnlyPaths(sources),
         forbiddenPaths: commonForbiddenPaths(sources),
-        outputContract: "Plain Markdown whose first non-empty line is VERDICT: pass or VERDICT: request-revision; includes final writeSet coverage findings after the single plan-revision round. No file writes.",
+        outputContract: "Plain Markdown whose first non-empty line is VERDICT: pass or VERDICT: request-revision. A pass MUST include exactly one FINAL_WRITE_SET_APPROVAL_JSON fenced block with schemaVersion, writerNodeId, approvalSourceNodeId, auditedPlanNodeId, approvedWriteSet, taskContractSha256, auditedPlanSha256, and approvalDigest. No file writes.",
         subtask_prompt: [
             "Perform the final write-set audit after the single bounded plan-revision round.",
             "When plan-revision-pi returned PASS_NO_REVISION_NEEDED, audit the original plan-pi output. Otherwise audit the complete revised plan.",
             "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.",
+            "On VERDICT: pass emit exactly one ```FINAL_WRITE_SET_APPROVAL_JSON fenced JSON object containing schemaVersion: 1, writerNodeId: 'implement-pi', approvalSourceNodeId: 'final-write-set-audit-format-repair-pi', auditedPlanNodeId: 'plan-revision-pi', approvedWriteSet, taskContractSha256, auditedPlanSha256, and approvalDigest. approvedWriteSet is ordered, unique, exact, concrete, and never copied or expanded from allowedPaths. approvalDigest is SHA-256 of canonical JSON excluding approvalDigest.",
             "Request revision if required files still lack a single exclusive owner, writeSet is broad/placeholder, forbidden paths overlap, or any initial finding remains unresolved.",
             "Do not expand task allowedPaths or edit files.",
             buildSourceContextBlock(sources),
@@ -5823,10 +5935,11 @@ function buildWriteSetGateNode(sources) {
         writePolicy: "read-only",
         allowedPaths: commonReadOnlyPaths(sources),
         forbiddenPaths: commonForbiddenPaths(sources),
-        outputContract: "Deterministic final write-set audit verdict gate: exit 0 only when final-write-set-audit-format-repair-pi emits VERDICT: pass after the bounded revision round.",
-        subtask_prompt: "Deterministic gate: block the implementation writer unless the normalized final write-set audit emitted VERDICT: pass.",
+        outputContract: "Deterministic final write-set approval gate: exit 0 only when final-write-set-audit-format-repair-pi emits VERDICT: pass with one valid, integrity-bound FINAL_WRITE_SET_APPROVAL_JSON for implement-pi.",
+        subtask_prompt: "Deterministic gate: block the implementation writer unless the normalized final audit emitted VERDICT: pass with a valid exact final write-set approval.",
         shell: {
             commands: [],
+            finalWriteSetApprovalGate: { writerNodeId: "implement-pi" },
             verdictGate: {
                 fromNodeId: "final-write-set-audit-format-repair-pi",
                 accept: ["VERDICT: pass"],
@@ -5844,7 +5957,15 @@ async function buildSoftVerifyNode(sources) {
     const fallbackCommands = sources.repoRoot
         ? (await discoverFrontendFallbackVerifyCommands(sources.repoRoot)).staticCommands
         : ["npm run typecheck"];
-    const focusedIntermediate = sources.verifyCommands?.intermediate.filter((command) => !isFullSuiteVerifyCommand(command));
+    const candidatePlan = canonicalizeVerificationCommands([
+        ...taskVerifyCommands(sources.repoRoot, sources.taskConfig),
+        ...(sources.verifyCommands?.intermediate ?? []),
+    ]);
+    const focusedCandidates = candidatePlan.commands.filter((command) => !isFullSuiteVerifyCommand(command));
+    const quota = verifyQuotaLimit(strategy.intermediateQuota ?? "full");
+    const focusedIntermediate = quota
+        ? focusedCandidates.slice(0, quota)
+        : focusedCandidates;
     const plannedIntermediate = applyMavenVerificationPlanning({
         repoRoot: sources.repoRoot,
         commands: focusedIntermediate,
@@ -5876,6 +5997,7 @@ async function buildSoftVerifyNode(sources) {
                 fallbackCommands,
                 commandTexts: commands,
                 commandTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+                plan: candidatePlan,
             }),
             cwd: ".",
             timeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
@@ -5977,9 +6099,13 @@ function buildHardVerifyNode(sources) {
     const fallbackCommands = [
         "HARNESS_ALLOW_ACTIVE_DAG_RUNS=1 bash scripts/check-repo.sh",
     ];
+    const finalPlan = canonicalizeVerificationCommands([
+        ...taskVerifyCommands(sources.repoRoot, sources.taskConfig),
+        ...(sources.verifyCommands?.final ?? []),
+    ]);
     const plannedFinal = applyMavenVerificationPlanning({
         repoRoot: sources.repoRoot,
-        commands: sources.verifyCommands?.final,
+        commands: finalPlan.commands,
         taskConfig: sources.taskConfig,
     });
     const commands = buildVerifyShellCommands({
@@ -6009,6 +6135,7 @@ function buildHardVerifyNode(sources) {
                 commandTexts: commands,
                 finalFullRequired: true,
                 commandTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+                plan: finalPlan,
             }),
             cwd: ".",
             timeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
@@ -6136,6 +6263,12 @@ async function buildSupervisedHybridDag(standard, sources) {
                     "plan-revision-pi",
                     "final-write-set-audit-format-repair-pi",
                 ],
+                finalWriteSetApproval: {
+                    schemaVersion: 1,
+                    writerNodeId: "implement-pi",
+                    approvalSourceNodeId: "final-write-set-audit-format-repair-pi",
+                    auditedPlanNodeId: "plan-revision-pi",
+                },
             }),
             await buildSoftVerifyNode(sources),
             buildProcessSupervisorNode(sources),
@@ -6207,6 +6340,11 @@ export async function writeHybridDagDraft(sources, outputPath, options = {}) {
     };
 }
 export async function initHybridDagFromTask(repoRoot, taskId, options = {}) {
+    // These checks are independently knowable and must win over adapter
+    // verification loading (which can fail for a missing local script).
+    const taskConfig = await loadTaskConfig(repoRoot, taskId);
+    assertTaskAllowedPathsPreflight(taskConfig);
+    await requireManagedTaskContractBinding({ repoRoot, taskId });
     const sources = await loadTaskHybridSources(repoRoot, taskId);
     assertTaskAllowedPathsPreflight(sources.taskConfig);
     const outputPath = options.outputPath ?? getTaskPaths(repoRoot, taskId).dagDraftPath;