@tea-agent/loop-agent 0.31.0 → 0.32.0

package/dist/shared/operator/capabilities.js

@@ -1,4 +1,18 @@
+import { createRequire } from "node:module";
 import { OPERATOR_ERROR_CODES_V1, OPERATOR_OUTCOMES_V1 } from "./registry.js";
+import { WORKER_ADAPTER_PROTOCOL_RANGE } from "../../worker/loop-agent/controller-protocol.js";
+const require = createRequire(import.meta.url);
+const PACKAGE_VERSION = require("../../../package.json").version ?? "0.0.0";
+/** Keep aligned with WORKER_CONTROLLER_REQUIREMENTS_V1 in controller-protocol.ts */
+const CONTROLLER_PROTOCOL_CAPABILITIES = [
+    "task-advance-managed-contract-v2",
+    "worker-association-v1",
+    "events-jsonl-v1",
+    "document-index-closure-v1",
+    "worker-attempt-owner-v1",
+    "worker-attempt-revision-v1",
+    "recovery-decision-v2",
+];
 const officialAction = (action, cli, kind, coverage) => ({
     action,
     cli,
@@ -1348,6 +1362,13 @@ export function buildOperatorCapabilitiesDocument() {
             canonicalizerVersion: 1,
             taskConfigSchemaVersion: 1,
         },
+        controllerProtocol: {
+            schemaVersion: 1,
+            controllerProtocolVersion: 1,
+            workerAdapterProtocolRange: WORKER_ADAPTER_PROTOCOL_RANGE,
+            capabilities: CONTROLLER_PROTOCOL_CAPABILITIES,
+            packageVersion: PACKAGE_VERSION,
+        },
         actions,
     };
 }
@@ -2215,7 +2236,7 @@ export const OPERATOR_COMMAND_COVERAGE = Object.freeze([
         coverage: "excluded",
         action: null,
         source: "agent-worker",
-        exclusionReason: "Not exposed to Operator Chat in M5.",
+        exclusionReason: "Removed (Wave 5): OBSERVE_SERVE_REMOVED + exit 2; use agent-worker console + /inspect/.",
     },
     {
         command: "agent-worker observe snapshot",

package/dist/shared/operator/command-lifecycle.js

@@ -0,0 +1,94 @@
+/**
+ * Public command lifecycle machine facts (Phase 7 Track B).
+ * Implementation remains in CLI modules; this registry is the shared tombstone /
+ * deprecation source for capabilities, drift checks, and operator envelopes.
+ */
+const COMMAND_LIFECYCLE_REGISTRY = {
+    "agent-worker observe serve": {
+        command: "agent-worker observe serve",
+        product: "agent-worker",
+        lifecycle: "removed",
+        replacement: "agent-worker console",
+        removedVersion: "0.19.0",
+        diagnosticCode: "OBSERVE_SERVE_REMOVED",
+        removedExitCode: 2,
+        docsSummary: "Independent observe HTTP server removed; use unified Operator Console /inspect/.",
+        operatorCategory: "observe",
+    },
+    "agent-worker console": {
+        command: "agent-worker console",
+        product: "agent-worker",
+        lifecycle: "official",
+        introducedVersion: "0.19.0",
+        docsSummary: "Official unified Operator Console (Operate + Inspect on default loopback :8790).",
+        operatorCategory: "console",
+    },
+    "agent-worker feature review": {
+        command: "agent-worker feature review",
+        product: "agent-worker",
+        lifecycle: "official",
+        docsSummary: "Project Feature readiness, acceptance gaps, and next action.",
+        operatorCategory: "feature",
+    },
+    "agent-worker feature advance": {
+        command: "agent-worker feature advance",
+        product: "agent-worker",
+        lifecycle: "official",
+        docsSummary: "ADR 0007 orchestration: verify-final → delivery → closeout.",
+        operatorCategory: "feature",
+    },
+    "agent-worker feature verify-final": {
+        command: "agent-worker feature verify-final",
+        product: "agent-worker",
+        lifecycle: "official",
+        docsSummary: "Canonical Final Verification writer (ADR 0007); only authority for coverage facts.",
+        operatorCategory: "feature",
+    },
+    "agent-worker batch run-ready": {
+        command: "agent-worker batch run-ready",
+        product: "agent-worker",
+        lifecycle: "official",
+        docsSummary: "Execute Ready Feature tasks with Task Pool attempt lease.",
+        operatorCategory: "batch",
+    },
+    "agent-worker task reconcile": {
+        command: "agent-worker task reconcile",
+        product: "agent-worker",
+        lifecycle: "official",
+        docsSummary: "Reconcile partial/orphan Worker attempt facts without deleting evidence.",
+        operatorCategory: "task",
+    },
+    "agent-worker pool doctor": {
+        command: "agent-worker pool doctor",
+        product: "agent-worker",
+        lifecycle: "official",
+        docsSummary: "Diagnose Task Pool / lease / ownership consistency.",
+        operatorCategory: "pool",
+    },
+    "loop-agent operator capabilities": {
+        command: "loop-agent operator capabilities",
+        product: "loop-agent",
+        lifecycle: "official",
+        docsSummary: "Publish operator + controllerProtocol envelope for Console/Worker negotiation.",
+        operatorCategory: "operator",
+    },
+};
+export function listCommandLifecycleEntries() {
+    return Object.values(COMMAND_LIFECYCLE_REGISTRY);
+}
+export function normalizeCommandLifecycleKey(command) {
+    return command.trim().replace(/\s+/g, " ");
+}
+export function resolveCommandLifecycle(command) {
+    const key = normalizeCommandLifecycleKey(command);
+    return COMMAND_LIFECYCLE_REGISTRY[key];
+}
+export function isRemovedCommand(command) {
+    return resolveCommandLifecycle(command)?.lifecycle === "removed";
+}
+export function listOfficialCommands(product) {
+    return listCommandLifecycleEntries()
+        .filter((entry) => entry.lifecycle === "official" &&
+        (product === undefined || entry.product === product))
+        .map((entry) => entry.command);
+}

package/dist/shared/operator/index.js

@@ -2,3 +2,4 @@ export * from "./types.js";
 export * from "./registry.js";
 export * from "./envelope.js";
 export * from "./capabilities.js";
+export * from "./command-lifecycle.js";

package/dist/worker/cli.js

@@ -13,7 +13,6 @@ import { createProgressReporter } from "./progress-reporter.js";
 import { createCompositeProgressReporter } from "./observability/progress-composite.js";
 import { createRoutedWorkerEventStore } from "./observability/event-store.js";
 import { buildGlobalSnapshot } from "./observability/read-model.js";
-import { createObserveServer } from "./observe/server.js";
 import { diagnoseTaskPoolStates, formatDoctorHuman, loadOperatorMapping, } from "./pool/doctor.js";
 import { migrateTaskPoolStates } from "./pool/migrate-state.js";
 import { markTaskPoolFailed, reconcileTaskPoolAbandon, } from "./pool/reconcile.js";
@@ -690,29 +689,16 @@ export function buildAgentWorkerProgram() {
     });
     observe
         .command("serve")
-        .requiredOption("--repo <repo-root>", "Target repo root")
-        .option("--port <port>", "HTTP port", "8787")
-        .option("--host <host>", "Bind host (default 127.0.0.1; use 0.0.0.0 for LAN, no network auth)", "127.0.0.1")
-        .option("--debug", "Log request source/method/path/status to stderr")
-        .description("Start read-only observe HTTP server (compat entry; prefer console serve)")
-        .action(async (options) => {
-        const repoRoot = path.resolve(options.repo);
-        const server = await createObserveServer({
-            repoRoot,
-            host: options.host,
-            port: Number.parseInt(options.port, 10),
-            debug: options.debug === true,
-        });
-        process.stderr.write("[OBSERVE_SERVE_DEPRECATED] agent-worker observe serve 作为独立看板入口将在兼容窗口后下线。\n" +
-            "请改用：agent-worker console serve --repo <repo> --port 8790\n" +
-            "统一 Operator Console 已包含原 Observe 的只读检视能力：http://127.0.0.1:8790/\n");
-        process.stdout.write(`${server.url}\n`);
-        await new Promise((resolve) => {
-            const shutdown = () => resolve();
-            process.once("SIGINT", shutdown);
-            process.once("SIGTERM", shutdown);
-        });
-        await server.close();
+        .option("--repo <repo-root>", "Target repo root (ignored; command removed)")
+        .option("--port <port>", "HTTP port (ignored; command removed)", "8787")
+        .option("--host <host>", "Bind host (ignored; command removed)", "127.0.0.1")
+        .option("--debug", "Ignored; command removed")
+        .description("Removed: independent observe HTTP server (use agent-worker console + /inspect/)")
+        .action(() => {
+        process.stderr.write("[OBSERVE_SERVE_REMOVED] agent-worker observe serve 已下线。\n" +
+            "请改用：agent-worker console --repo <repo> --port 8790\n" +
+            "只读检视：http://127.0.0.1:8790/inspect/\n");
+        process.exitCode = 2;
     });
     observe
         .command("snapshot")

package/dist/worker/console/doctor.js

@@ -161,12 +161,19 @@ export async function runConsoleDoctor(options) {
         };
     }
     const inspect = await probeInspect(options.consoleBaseUrl, options.fetchImpl ?? fetch);
-    const observe = options.observeBaseUrl
-        ? await probeObserve(options.observeBaseUrl, fingerprint, options.fetchImpl ?? fetch)
+    // Wave 5: do not probe retired independent observe serve (8787).
+    // Optional observeBaseUrl only accepted when it is the same origin as Console.
+    const consoleOrigin = options.consoleBaseUrl?.replace(/\/+$/, "");
+    const observeOrigin = options.observeBaseUrl?.replace(/\/+$/, "");
+    const observe = observeOrigin &&
+        consoleOrigin &&
+        observeOrigin === consoleOrigin
+        ? await probeObserve(observeOrigin, fingerprint, options.fetchImpl ?? fetch)
         : {
             status: "unavailable",
             url: `${DEFAULT_OBSERVE_BASE_URL}/api/health`,
-            message: "未探测兼容 Observe；统一 Inspect 不依赖 8787",
+            message: "独立 observe serve 已下线；健康以统一 Operator Console / Inspect 为准",
+            startCommand: OBSERVE_START_COMMAND,
         };
     const pi = await probePiReadiness({
         override: options.piReadinessProbe,
@@ -204,7 +211,7 @@ export function formatConsoleDoctorHuman(report) {
     ];
     if (report.observe.status === "unavailable" ||
         report.observe.status === "mismatch") {
-        lines.push(`observe.startCommand: ${report.observe.startCommand ?? OBSERVE_START_COMMAND}`);
+        lines.push(`observe.startCommand: ${report.observe.startCommand ?? OBSERVE_START_COMMAND} (use console + /inspect/)`);
     }
     if (report.siblingLoopAgentBin) {
         lines.push(`siblingLoopAgentBin: ${report.siblingLoopAgentBin}`);

package/dist/worker/console/observe-health-match.js

@@ -1,9 +1,12 @@
 /**
- * Observe health match classification (Phase 3).
- * Fail-closed deep links: only same-repo + schema + required capability.
+ * Observe link capability mapping + retired cross-process health-match stubs.
+ * Wave 5: independent observe serve (8787) is removed; doctor uses Console surface.
+ * capabilityForObserveTarget remains for Inspect deep-links / night-jobs.
  */
-export const OBSERVE_START_COMMAND = "agent-worker observe serve --repo . --port 8787";
-export const DEFAULT_OBSERVE_BASE_URL = "http://127.0.0.1:8787";
+/** @deprecated Wave 5 — observe serve removed; use agent-worker console */
+export const OBSERVE_START_COMMAND = "agent-worker console --repo . --port 8790";
+/** @deprecated Wave 5 — default unified Console origin (not independent Observe) */
+export const DEFAULT_OBSERVE_BASE_URL = "http://127.0.0.1:8790";
 export function capabilityForObserveTarget(target) {
     switch (target.kind) {
         case "dag":
@@ -25,8 +28,8 @@ export function capabilityForObserveTarget(target) {
     }
 }
 /**
- * Classify Observe /api/health body against local repo fingerprint + required capability.
- * Pure function — no I/O.
+ * Classify Console/Inspect /api/health body against local repo fingerprint + capability.
+ * Pure function — no I/O. Prefer unified Console origin (8790), not retired 8787 Observe.
  */
 export function classifyObserveHealth(input) {
     const url = input.healthUrl ?? `${DEFAULT_OBSERVE_BASE_URL}/api/health`;
@@ -36,7 +39,7 @@ export function classifyObserveHealth(input) {
         return {
             status: "unavailable",
             url,
-            message: "Observe health body missing or not JSON object",
+            message: "Operator surface health body missing or not JSON object",
             startCommand,
             body,
             localFingerprint: input.localFingerprint,
@@ -48,7 +51,7 @@ export function classifyObserveHealth(input) {
         return {
             status: "unavailable",
             url,
-            message: "Observe health ok !== true",
+            message: "Operator surface health ok !== true",
             startCommand,
             body,
             localFingerprint: input.localFingerprint,
@@ -60,7 +63,7 @@ export function classifyObserveHealth(input) {
         return {
             status: "mismatch",
             url,
-            message: `Observe schemaVersion mismatch (expected 1, got ${String(health.schemaVersion)})`,
+            message: `Operator surface schemaVersion mismatch (expected 1, got ${String(health.schemaVersion)})`,
             startCommand,
             body,
             localFingerprint: input.localFingerprint,
@@ -75,7 +78,7 @@ export function classifyObserveHealth(input) {
         return {
             status: "mismatch",
             url,
-            message: "Observe repoFingerprint does not match local worktree",
+            message: "Operator surface repoFingerprint does not match local worktree",
             startCommand,
             body,
             localFingerprint: input.localFingerprint,
@@ -91,7 +94,7 @@ export function classifyObserveHealth(input) {
             return {
                 status: "mismatch",
                 url,
-                message: `Observe missing route capability: ${input.requiredCapability}`,
+                message: `Operator surface missing route capability: ${input.requiredCapability}`,
                 startCommand,
                 body,
                 localFingerprint: input.localFingerprint,
@@ -104,7 +107,7 @@ export function classifyObserveHealth(input) {
         return {
             status: "match",
             url,
-            message: "Observe health matches local repo and required capability",
+            message: "Operator surface health matches local repo and required capability",
             startCommand,
             body,
             localFingerprint: input.localFingerprint,
@@ -117,7 +120,7 @@ export function classifyObserveHealth(input) {
     return {
         status: "match",
         url,
-        message: "Observe health matches local repo",
+        message: "Operator surface health matches local repo",
         startCommand,
         body,
         localFingerprint: input.localFingerprint,
@@ -126,8 +129,8 @@ export function classifyObserveHealth(input) {
     };
 }
 /**
- * Probe Observe /api/health and classify against local fingerprint.
- * Network failure → unavailable (non-blocking for Console doctor).
+ * Probe /api/health and classify against local fingerprint.
+ * Network failure → unavailable. Prefer Console origin; independent Observe serve is removed.
  */
 export async function probeAndClassifyObserve(input) {
     const base = input.baseUrl.replace(/\/+$/, "");

package/dist/worker/console/operator-actions.js

@@ -537,7 +537,8 @@ export async function dispatchOperatorAction(ctx, req) {
         }
         case "observeLink": {
             const consoleOrigin = ctx.getConsoleOrigin?.();
-            const baseUrl = ctx.observeBaseUrl ?? consoleOrigin ?? DEFAULT_OBSERVE_BASE_URL;
+            // Wave 5: prefer unified Console origin; do not fall back to retired 8787 Observe.
+            const baseUrl = consoleOrigin ?? ctx.observeBaseUrl ?? DEFAULT_OBSERVE_BASE_URL;
             const dagRunId = str(p.dagRunId);
             const taskId = str(p.taskId);
             const featureId = str(p.featureId);

package/dist/worker/feature/acceptance-policy.js

@@ -0,0 +1,227 @@
+import { z } from "zod";
+/**
+ * ADR 0007: only `agent-worker feature verify-final` is the canonical writer for
+ * Feature Verification Bundle, QA pass evidence, and Final Verification Record.
+ * Task Pool Done, DAG verify-shell receipts, and packet FINAL-VERIFY-* smoke
+ * nodes are inputs only — they must never be treated as coverage writers.
+ */
+export const CANONICAL_FINAL_VERIFICATION_AUTHORITY = "feature-verify-final";
+export const DEFAULT_VERIFY_FINAL_COMMAND = "agent-worker feature verify-final";
+const deliverySequenceSchema = z.array(z.enum(["verify-final", "delivery", "closeout"]));
+export const acceptancePolicySchema = z
+    .object({
+    schema_version: z.literal(1),
+    authority: z.string().min(1).optional(),
+    independent_qa_required: z.boolean().optional(),
+    coverage_writer: z.string().min(1).optional(),
+    final_verification: z
+        .object({
+        command: z.string().min(1),
+    })
+        .strict()
+        .optional(),
+    delivery_sequence: deliverySequenceSchema.optional(),
+})
+    .strict();
+const DEFAULT_POLICY = {
+    schema_version: 1,
+    authority: CANONICAL_FINAL_VERIFICATION_AUTHORITY,
+    independent_qa_required: true,
+    coverage_writer: CANONICAL_FINAL_VERIFICATION_AUTHORITY,
+    final_verification: {
+        command: DEFAULT_VERIFY_FINAL_COMMAND,
+    },
+    delivery_sequence: ["verify-final", "delivery", "closeout"],
+};
+/**
+ * Parse optional `acceptance_policy` from a Feature Packet object (typically
+ * `feature.yaml`). Unknown fields are rejected; missing fields receive ADR 0007
+ * defaults without inventing covered evidence.
+ */
+export function parseAcceptancePolicy(packet) {
+    if (!packet || typeof packet !== "object")
+        return { ...DEFAULT_POLICY };
+    const raw = packet.acceptance_policy;
+    if (raw === undefined || raw === null)
+        return { ...DEFAULT_POLICY };
+    const parsed = acceptancePolicySchema.safeParse(raw);
+    if (!parsed.success)
+        return { ...DEFAULT_POLICY };
+    return normalizeAcceptancePolicy(parsed.data);
+}
+/** Apply canonical defaults while preserving explicit packet overrides. */
+export function normalizeAcceptancePolicy(policy) {
+    return {
+        schema_version: 1,
+        authority: policy.authority?.trim() || DEFAULT_POLICY.authority,
+        independent_qa_required: policy.independent_qa_required ?? DEFAULT_POLICY.independent_qa_required,
+        coverage_writer: policy.coverage_writer?.trim() || DEFAULT_POLICY.coverage_writer,
+        final_verification: {
+            command: policy.final_verification?.command?.trim() ||
+                DEFAULT_POLICY.final_verification.command,
+        },
+        delivery_sequence: policy.delivery_sequence && policy.delivery_sequence.length > 0
+            ? [...policy.delivery_sequence]
+            : [...DEFAULT_POLICY.delivery_sequence],
+    };
+}
+/** Extract additive policy fields that may exist on raw acceptance YAML items. */
+export function extractAcceptanceItemPolicyFields(rawItem) {
+    if (!rawItem || typeof rawItem !== "object") {
+        return { requiredEvidenceKinds: [], expectedTaskRefs: [] };
+    }
+    const verification = rawItem.verification;
+    if (!verification || typeof verification !== "object") {
+        return { requiredEvidenceKinds: [], expectedTaskRefs: [] };
+    }
+    const record = verification;
+    const authority = typeof record.authority === "string" && record.authority.trim().length > 0
+        ? record.authority.trim()
+        : undefined;
+    const requiredEvidenceKinds = readStringArray(record.required_evidence_kinds ?? record.required_evidence);
+    const expectedTaskRefs = readStringArray(record.expected_task_refs);
+    return { authority, requiredEvidenceKinds, expectedTaskRefs };
+}
+export function indexRawAcceptanceItems(rawAcceptance) {
+    const result = new Map();
+    if (!rawAcceptance || typeof rawAcceptance !== "object")
+        return result;
+    const items = rawAcceptance.acceptance;
+    if (!Array.isArray(items))
+        return result;
+    for (const item of items) {
+        if (!item || typeof item !== "object")
+            continue;
+        const id = item.id;
+        if (typeof id === "string" && id.length > 0)
+            result.set(id, item);
+    }
+    return result;
+}
+export function buildAcceptanceGaps(input) {
+    const gaps = [];
+    const verifyFinalCommand = buildVerifyFinalCommand(input.policy, input.featureDir, input.repoRoot);
+    const allTasksDone = input.tasks.length > 0 &&
+        input.tasks.every((task) => task.status === "Done");
+    for (const item of input.acceptanceItems) {
+        if (item.priority !== "must")
+            continue;
+        const fact = input.coverage.find((entry) => entry.acId === item.id);
+        if (!fact || fact.status === "covered" || fact.status === "waived")
+            continue;
+        const rawItem = input.rawByAcId?.get(item.id);
+        const policyFields = extractAcceptanceItemPolicyFields(rawItem);
+        const authority = resolveItemAuthority(input.policy, policyFields);
+        const blockers = collectBlockers({
+            policy: input.policy,
+            policyFields,
+            item,
+            authority,
+        });
+        const status = normalizeGapStatus(fact.status);
+        const missingEvidenceKinds = resolveMissingEvidenceKinds({
+            policyFields,
+            item,
+            fact,
+            status,
+        });
+        gaps.push({
+            acId: item.id,
+            status,
+            missingEvidenceKinds,
+            expectedTaskRefs: item.verification.expected_task_refs,
+            authority,
+            nextCommand: projectGapNextCommand({
+                status,
+                blockers,
+                allTasksDone,
+                verifyFinalCommand,
+                featureDir: input.featureDir,
+                repoRoot: input.repoRoot,
+                blockedBy: fact.blockedBy,
+            }),
+            blockers,
+        });
+    }
+    return gaps;
+}
+function resolveItemAuthority(policy, policyFields) {
+    return policyFields.authority ?? policy.authority ?? CANONICAL_FINAL_VERIFICATION_AUTHORITY;
+}
+function collectBlockers(input) {
+    const blockers = [];
+    if (!input.policyFields.authority && input.policy.independent_qa_required) {
+        blockers.push("missing authority: required AC has no verification.authority");
+    }
+    if (input.policyFields.expectedTaskRefs.length === 0 &&
+        (input.policyFields.requiredEvidenceKinds.length === 0 &&
+            (input.item.verification.implementation_task_refs?.length ?? 0) === 0 &&
+            (input.item.verification.verification_task_refs?.length ?? 0) === 0)) {
+        blockers.push("missing producer: no expected_task_refs or dual-coverage refs");
+    }
+    if (input.policy.independent_qa_required &&
+        input.policyFields.requiredEvidenceKinds.length === 0 &&
+        (input.item.verification.required_evidence?.length ?? 0) === 0 &&
+        input.authority === CANONICAL_FINAL_VERIFICATION_AUTHORITY) {
+        blockers.push("missing evidence kinds: declare verification.required_evidence_kinds or required_evidence");
+    }
+    if (input.authority !== CANONICAL_FINAL_VERIFICATION_AUTHORITY &&
+        input.policy.coverage_writer === CANONICAL_FINAL_VERIFICATION_AUTHORITY) {
+        blockers.push(`non-canonical authority ${input.authority}; ADR 0007 requires ${CANONICAL_FINAL_VERIFICATION_AUTHORITY}`);
+    }
+    return blockers;
+}
+function resolveMissingEvidenceKinds(input) {
+    if (input.status === "blocked")
+        return [];
+    const declared = [
+        ...input.policyFields.requiredEvidenceKinds,
+        ...(input.item.verification.required_evidence ?? []),
+    ];
+    const unique = [...new Set(declared)];
+    if (unique.length > 0 && input.fact.evidence.length === 0)
+        return unique;
+    if (unique.length === 0 && input.status !== "missing") {
+        return ["canonical-qa-evidence"];
+    }
+    return unique;
+}
+function normalizeGapStatus(status) {
+    if (status === "awaiting-verification")
+        return "awaiting-verification";
+    if (status === "blocked")
+        return "blocked";
+    if (status === "partial")
+        return "partial";
+    return "missing";
+}
+function projectGapNextCommand(input) {
+    if (input.status === "blocked") {
+        if (input.blockedBy.length > 0) {
+            const taskId = input.blockedBy[0];
+            return `agent-worker feature review --feature-dir ${quote(input.featureDir)} --repo ${quote(input.repoRoot)}`;
+        }
+        return undefined;
+    }
+    if (!input.allTasksDone) {
+        return `agent-worker batch run-ready --feature-dir ${quote(input.featureDir)} --repo ${quote(input.repoRoot)}`;
+    }
+    if (input.status === "partial" ||
+        input.status === "awaiting-verification" ||
+        input.status === "missing") {
+        return input.verifyFinalCommand;
+    }
+    return undefined;
+}
+function buildVerifyFinalCommand(policy, featureDir, repoRoot) {
+    const base = policy.final_verification?.command?.trim() || DEFAULT_VERIFY_FINAL_COMMAND;
+    return `${base} --feature-dir ${quote(featureDir)} --repo ${quote(repoRoot)}`;
+}
+function readStringArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((entry) => typeof entry === "string" && entry.length > 0);
+}
+function quote(value) {
+    return JSON.stringify(value);
+}

package/dist/worker/feature/decision-loader.js

@@ -27,7 +27,7 @@ export async function loadFeatureDecisionModels(repoRoot) {
 function degradeExisting(feature, warnings) {
     return { ...feature, status: "needs_action", statusLabel: "需处理", blockingItems: [...warnings.map((warning) => ({ type: "projection_warning", message: warning, evidence: [] })), ...feature.blockingItems], nextAction: { kind: "repair_projection", label: "修复损坏的 Feature / Task Pool facts 后重新审阅" }, projectionWarnings: [...new Set([...feature.projectionWarnings, ...warnings])] };
 }
-function degradedFeature(featureId, warning) { return { schemaVersion: 1, featureId, status: "needs_action", statusLabel: "需处理", summary: { tasksTotal: 0, tasksSucceeded: 0, tasksFailed: 0, tasksReady: 0, tasksBlocked: 0, requiredAcTotal: 0, requiredAcCovered: 0 }, riskSummary: { high: 1, medium: 0, low: 0 }, blockingItems: [{ type: "projection_warning", message: warning, evidence: [] }], followUps: { pending: [], actionCards: [], resolvedFailureTaskIds: [] }, tasks: [], acceptanceCoverage: [], nextAction: { kind: "repair_projection", label: "修复损坏事实后重新审阅" }, alternativeActions: [], evidence: { morningReport: null, observeSnapshot: null, delivery: null, closeout: null }, projectionWarnings: [warning] }; }
+function degradedFeature(featureId, warning) { return { schemaVersion: 1, featureId, status: "needs_action", statusLabel: "需处理", summary: { tasksTotal: 0, tasksSucceeded: 0, tasksFailed: 0, tasksReady: 0, tasksBlocked: 0, requiredAcTotal: 0, requiredAcCovered: 0 }, riskSummary: { high: 1, medium: 0, low: 0 }, blockingItems: [{ type: "projection_warning", message: warning, evidence: [] }], followUps: { pending: [], actionCards: [], resolvedFailureTaskIds: [] }, tasks: [], acceptanceCoverage: [], acceptanceGaps: [], nextAction: { kind: "repair_projection", label: "修复损坏事实后重新审阅" }, alternativeActions: [], evidence: { morningReport: null, observeSnapshot: null, delivery: null, closeout: null }, projectionWarnings: [warning] }; }
 async function auditTaskPoolFacts(repoRoot) {
     const warnings = [];
     try {

package/dist/worker/feature/next-action.js

@@ -1,3 +1,4 @@
+import { resolveWorkerRecoveryDecision } from "../pool/recovery-decision.js";
 export function projectNextAction(input, status) {
     const featureArgs = `--feature-dir ${quote(input.featureDir)} --repo ${quote(input.repoRoot)}`;
     const resolvedFailures = new Set(input.resolvedFailureTaskIds ?? []);
@@ -31,20 +32,59 @@ export function projectNextAction(input, status) {
     }
     const failed = input.tasks.find((task) => task.status === "Failed" && !resolvedFailures.has(task.taskId));
     if (failed) {
-        if (failed.failureCategory === "EnvFailure") {
+        const decision = resolveWorkerRecoveryDecision({
+            state: {
+                status: failed.status ?? "Failed",
+                ...(failed.workerRunId ? { workerRunId: failed.workerRunId } : {}),
+                ...(failed.failureCategory
+                    ? {
+                        failure: {
+                            category: failed.failureCategory,
+                            recommendedFollowUpKind: "feature-review",
+                            derivedFollowUpTaskId: `${failed.taskId}-review`,
+                            source: "fallback",
+                        },
+                    }
+                    : {}),
+            },
+        });
+        if (decision.recommendedAction === "retry") {
             return {
                 kind: "retry_task",
-                label: `重试环境失败任务 ${failed.taskId}`,
+                label: `重试失败任务 ${failed.taskId}`,
                 command: `agent-worker task retry ${quote(failed.taskId)} --feature-id ${quote(input.featureId)} --repo ${quote(input.repoRoot)}`,
             };
         }
-        return {
-            kind: "handle_failure",
-            label: `根据失败证据处理 ${failed.taskId}；ProductBug 可生成并人工批准 Follow-up`,
-        };
+        if (decision.recommendedAction === "decide") {
+            return {
+                kind: "handle_failure",
+                label: `根据失败证据处理 ${failed.taskId}；ProductBug 可生成并人工批准 Follow-up`,
+            };
+        }
     }
     const blocked = input.tasks.find((task) => ["Blocked", "HumanReview", "Abandoned"].includes(task.status ?? ""));
     if (blocked) {
+        const decision = resolveWorkerRecoveryDecision({
+            state: {
+                status: blocked.status ?? "Blocked",
+                ...(blocked.failureCategory
+                    ? {
+                        failure: {
+                            category: blocked.failureCategory,
+                            recommendedFollowUpKind: "feature-review",
+                            derivedFollowUpTaskId: `${blocked.taskId}-review`,
+                            source: "fallback",
+                        },
+                    }
+                    : {}),
+            },
+        });
+        if (decision.recommendedAction === "revise-contract") {
+            return {
+                kind: "revise_contract",
+                label: `修订 ${blocked.taskId} 的 contract/spec 后再 materialize`,
+            };
+        }
         return {
             kind: "resolve_human_gate",
             label: `处理 ${blocked.taskId} 的人工 Gate 或阻塞原因`,
@@ -65,6 +105,16 @@ export function projectNextAction(input, status) {
             command: `agent-worker batch run-ready ${featureArgs}`,
         };
     }
+    if (status === "awaiting_qa" || status === "deliverable") {
+        const gap = input.acceptanceGaps?.find((entry) => entry.nextCommand);
+        if (gap?.nextCommand) {
+            return {
+                kind: status === "deliverable" ? "advance_delivery" : "complete_qa",
+                label: `补齐 ${gap.acId} 验收缺口（${gap.status}）`,
+                command: gap.nextCommand,
+            };
+        }
+    }
     if (status === "awaiting_qa") {
         const finalish = input.tasks.find((task) => /(final[-_]?(verify|verification))|closeout/i.test(task.taskId));
         if (finalish && (finalish.status === "Done" || finalish.status === "Ready")) {