@tea-agent/loop-agent 0.33.6 → 0.33.7-beta.1

package/dist/workflows/dag/backend-test-case-coverage-analysis.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
 import { access, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
@@ -8,7 +9,15 @@ const CASE_HEADING = /^##\s+(BE-[A-Z0-9_-]+-\d{3})\b.*$/gm;
 const CASE_ID_IN_TEXT = /\bBE-[A-Z0-9_-]+-\d{3}\b/g;
 const NON_CANONICAL_CASE_HEADING = /^##\s+(BE-[A-Z0-9_-]+-(?:\d{2}|\d{2,3}[A-Z]+))\b.*$/gm;
 const AC_ID_IN_TEXT = /\bAC-[A-Z0-9]+(?:-[A-Z0-9]+)*\b/g;
-const RULE_KEY = /^(?:AC|REQ|BR|API|GET|POST|PUT|PATCH|DELETE)-[A-Z0-9]+(?:-[A-Z0-9]+)*$/;
+const SOURCE_RULE_ID_IN_TEXT = /\b(?:AC|REQ|BR)-[A-Z0-9]+(?:-[A-Z0-9]+)*\b/g;
+const SOURCE_ERROR_CODE_IN_TEXT = /\b[A-Z][0-9]{5,}\b/g;
+const JSON_FIELD_IN_TEXT = /["']([A-Za-z][A-Za-z0-9_]*)["']\s*:/g;
+const DTO_FIELD_IN_TEXT = /\b(?:private|public|protected)\s+(?:static\s+)?(?:final\s+)?[A-Za-z_$][A-Za-z0-9_$<>,.?\[\] ]*\s+([a-z][A-Za-z0-9_]*)\s*[;=]/g;
+const NATURAL_BUSINESS_RULE_KEYWORDS = /(?:事务|原子性|回滚|幂等|唯一性|唯一|状态转换|状态流转|权限|角色|租户|跨字段|transaction|atomic|rollback|idempoten|unique|state transition|authorization|permission|tenant|cross-field)/i;
+const NATURAL_BUSINESS_RULE_NORMATIVE = /(?:必须|不得|禁止|仅当|应当|需要|不能|保证|must|shall|required|must not|only when|guarantee)/i;
+// Token form is used for section scanning; anchored form validates full cells.
+const RULE_KEY_TOKEN = /(?:AC|REQ|BR|API|GET|POST|PUT|PATCH|DELETE)-[A-Z0-9]+(?:-[A-Z0-9]+)*|[A-Z][0-9]{5,}/;
+const RULE_KEY = new RegExp(`^(?:${RULE_KEY_TOKEN.source})$`);
 const TEST_POINT = /^TP-[A-Z0-9]+(?:-[A-Z0-9]+)*$/;
 const COVERAGE_HEADERS = [
     "Rule Key",
@@ -87,6 +96,13 @@ const coverageCaseSchema = z.object({
     scenarioTypes: z.array(z.string()),
     declaredScripts: z.array(z.string()),
     declaredPrimarySymbols: z.array(z.string()),
+    payloadContract: z.object({
+        declared: z.boolean(),
+        noPayload: z.boolean(),
+        requiredPaths: z.array(z.string()),
+        allowedPaths: z.array(z.string()),
+        enumValues: z.record(z.string(), z.array(z.string())),
+    }).strict(),
 }).strict();
 const coverageRuleSchema = z.object({
     ruleKey: z.string().min(1),
@@ -102,6 +118,23 @@ const coverageRuleSchema = z.object({
     missingTestPoints: z.array(z.string()),
     status: z.enum(["COVERED", "PARTIAL", "GAP", "CONFLICT"]),
 }).strict();
+const sourceCoverageFactSchema = z.object({
+    kind: z.enum(["requirement-id", "error-code", "dto-field", "business-rule"]),
+    key: z.string().min(1),
+    sourcePath: z.string().min(1),
+    sourceSha256: sha256Schema,
+    lineStart: z.number().int().positive(),
+    lineEnd: z.number().int().positive(),
+    quote: z.string().min(1).max(1000),
+    covered: z.boolean(),
+}).strict();
+const sourceCoverageSchema = z.object({
+    sourceFactCount: z.number().int().min(0),
+    coveredSourceFactCount: z.number().int().min(0),
+    residualSourceFactCount: z.number().int().min(0),
+    facts: z.array(sourceCoverageFactSchema),
+    residual: z.array(sourceCoverageFactSchema),
+}).strict();
 const coverageScopeSchema = z.object({
     changeClassification: z.enum(CHANGE_CLASSIFICATIONS),
     coveragePolicy: z.enum(COVERAGE_POLICIES),
@@ -112,13 +145,14 @@ const coverageScopeSchema = z.object({
     completenessClaim: z.enum(["affected-operations-full", "affected-scope"]),
 }).strict();
 export const backendTestCaseCoverageFactsSchema = z.object({
-    schemaId: z.literal("backend-test-case-coverage-facts-v3"),
-    schemaVersion: z.literal(3),
+    schemaId: z.literal("backend-test-case-coverage-facts-v4"),
+    schemaVersion: z.literal(4),
     taskId: z.string().min(1),
     status: z.enum(["PASS", "FAIL", "UNAVAILABLE"]),
     sourceBinding: sourceBindingSchema,
     inputFiles: z.array(inputFileSchema),
     coverageScope: coverageScopeSchema,
+    sourceCoverage: sourceCoverageSchema,
     summary: z.object({
         explicitAcCount: z.number().int().min(0),
         coveredAcCount: z.number().int().min(0),
@@ -177,12 +211,24 @@ const correspondenceEntrySchema = z.object({
         "CROSS_CUTTING_EVIDENCE_MISSING",
         "TEST_POINT_BINDING_DUPLICATE",
         "TEST_POINT_BINDING_EXTRA",
+        "PAYLOAD_CONTRACT_UNAVAILABLE",
+        "PAYLOAD_SHAPE_MISMATCH",
     ]),
+    payloadAssessment: z.object({
+        status: z.enum(["SAFE", "UNSAFE", "UNAVAILABLE"]),
+        requiredPaths: z.array(z.string()),
+        allowedPaths: z.array(z.string()),
+        observedPaths: z.array(z.string()),
+        missingPaths: z.array(z.string()),
+        unexpectedPaths: z.array(z.string()),
+        enumMismatches: z.array(z.string()),
+    }).strict(),
+    executionSignature: z.string().min(1).optional(),
     findings: z.array(z.string()),
 }).strict();
 export const backendTestMarkdownPytestCorrespondenceFactsSchema = z.object({
-    schemaId: z.literal("backend-test-markdown-pytest-correspondence-facts-v2"),
-    schemaVersion: z.literal(2),
+    schemaId: z.literal("backend-test-markdown-pytest-correspondence-facts-v3"),
+    schemaVersion: z.literal(3),
     taskId: z.string().min(1),
     status: z.enum(["PASS", "FAIL", "UNAVAILABLE"]),
     inputFiles: z.array(inputFileSchema),
@@ -203,6 +249,10 @@ export const backendTestMarkdownPytestCorrespondenceFactsSchema = z.object({
         crossCuttingTestPointCount: z.number().int().min(0),
         unclassifiedTestPointCount: z.number().int().min(0),
         duplicateBindingTestPointCount: z.number().int().min(0),
+        payloadSafeCount: z.number().int().min(0),
+        payloadUnsafeCount: z.number().int().min(0),
+        payloadUnavailableCount: z.number().int().min(0),
+        duplicateExecutionSignatureCount: z.number().int().min(0),
     }).strict(),
     entries: z.array(correspondenceEntrySchema),
     findings: z.array(z.string()),
@@ -236,6 +286,64 @@ function openApiTestPoints(field, dimension, values = []) {
         return [`${prefix}-VALID-CLASS`, `${prefix}-VALID-MIXED`, `${prefix}-UPPERCASE`, `${prefix}-WHITESPACE`, `${prefix}-PUNCTUATION`, `${prefix}-SLASH`, `${prefix}-EMOJI`, `${prefix}-CONTROL`];
     return [`${prefix}-PRESENT`, `${prefix}-MISSING`, `${prefix}-NULL`, `${prefix}-WRONG-TYPE`];
 }
+async function collectSourceCoverageFacts(input) {
+    const paths = orderedUnique([
+        input.sourceBinding.requirementPath,
+        ...input.sourceBinding.referencePaths,
+    ]);
+    const facts = [];
+    const seen = new Set();
+    for (const sourcePath of paths) {
+        const physicalPath = resolveBoundSourcePath(input.workspaceRoot, input.sourceBinding.taskId, sourcePath);
+        let text;
+        try {
+            text = await readFile(physicalPath, "utf8");
+        }
+        catch {
+            continue;
+        }
+        const sourceSha256 = createHash("sha256").update(await readFile(physicalPath)).digest("hex");
+        const lines = text.split(/\r?\n/);
+        const add = (kind, key, lineIndex, quote) => {
+            const normalizedQuote = quote.trim().slice(0, 1000);
+            if (!normalizedQuote)
+                return;
+            const identity = `${kind}:${key}:${sourcePath}:${lineIndex + 1}`;
+            if (seen.has(identity))
+                return;
+            seen.add(identity);
+            const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            const covered = kind === "business-rule"
+                ? input.generatedMarkdown.includes(normalizedQuote)
+                : new RegExp(`\\b${escaped}\\b`).test(input.generatedMarkdown);
+            facts.push({
+                kind,
+                key,
+                sourcePath,
+                sourceSha256,
+                lineStart: lineIndex + 1,
+                lineEnd: lineIndex + 1,
+                quote: normalizedQuote,
+                covered,
+            });
+        };
+        lines.forEach((line, lineIndex) => {
+            for (const key of line.match(SOURCE_RULE_ID_IN_TEXT) ?? [])
+                add("requirement-id", key, lineIndex, line);
+            for (const key of line.match(SOURCE_ERROR_CODE_IN_TEXT) ?? [])
+                add("error-code", key, lineIndex, line);
+            for (const match of line.matchAll(JSON_FIELD_IN_TEXT))
+                add("dto-field", match[1], lineIndex, line);
+            for (const match of line.matchAll(DTO_FIELD_IN_TEXT))
+                add("dto-field", match[1], lineIndex, line);
+            const trimmed = line.trim();
+            if (trimmed.length >= 8 && trimmed.length <= 1000 && !/^\s*(?:#|\||[-:]{3,})/.test(trimmed) && NATURAL_BUSINESS_RULE_KEYWORDS.test(trimmed) && NATURAL_BUSINESS_RULE_NORMATIVE.test(trimmed)) {
+                add("business-rule", `BR-SOURCE-${sourceSha256.slice(0, 8).toUpperCase()}-L${lineIndex + 1}`, lineIndex, trimmed);
+            }
+        });
+    }
+    return facts.sort((left, right) => left.kind.localeCompare(right.kind) || left.key.localeCompare(right.key) || left.sourcePath.localeCompare(right.sourcePath) || left.lineStart - right.lineStart);
+}
 function resolveBoundSourcePath(workspaceRoot, taskId, sourcePath) {
     if (path.isAbsolute(sourcePath))
         return sourcePath;
@@ -385,8 +493,14 @@ function sectionBody(body, aliases) {
 }
 function listTokens(body, aliases, pattern) {
     const section = sectionBody(body, aliases).replaceAll("`", "");
-    const source = pattern.source.replace(/^\^/, "").replace(/\$$/, "");
-    return orderedUnique(section.match(new RegExp(source, "g")) ?? []);
+    // Prefer dedicated token patterns; never strip ^/$ from alternation-based anchors
+    // (that would turn `^A$|^B$` into `A$|^B` and break scanning).
+    const tokenSource = pattern === RULE_KEY
+        ? RULE_KEY_TOKEN.source
+        : pattern === TEST_POINT
+            ? TEST_POINT.source.replace(/^\^/, "").replace(/\$$/, "")
+            : pattern.source.replace(/^\^/, "").replace(/\$$/, "");
+    return orderedUnique(section.match(new RegExp(tokenSource, "g")) ?? []);
 }
 function scenarioTypes(body) {
     return orderedUnique(sectionBody(body, CASE_SECTION_ALIASES.scenarioTypes)
@@ -423,8 +537,40 @@ function testPointBindingFacts(body, testPoints) {
 }
 function declaredPrimarySymbols(body) {
     const value = automationLabelBody(body, ["primary symbol", "Primary Symbol", "主测试符号"]);
+    if (/^(?:none|无|n\/a|not-applicable)$/i.test(value.trim()))
+        return [];
     return orderedUnique(value.match(/\btest_[A-Za-z0-9_]+\b/g) ?? []);
 }
+function isEvidenceOnlyMarkdownCase(testCase) {
+    const hasVariant = testCase.testPointBindings.some((item) => item.mode === "variant");
+    const hasNonVariant = testCase.testPointBindings.some((item) => item.mode === "assertion" || item.mode === "cross-cutting");
+    return (testCase.declaredScripts.length === 0 &&
+        testCase.declaredPrimarySymbols.length === 0 &&
+        !hasVariant &&
+        hasNonVariant);
+}
+function payloadContract(body) {
+    const contractValue = automationLabelBody(body, ["Payload Contract", "载荷合同"]);
+    const requiredValue = automationLabelBody(body, ["Payload Required Paths", "载荷必需路径"]);
+    const allowedValue = automationLabelBody(body, ["Payload Allowed Paths", "载荷允许路径"]);
+    const enumValue = automationLabelBody(body, ["Payload Enum", "载荷枚举"]);
+    const tokens = (value) => orderedUnique(value.split(/[,;，；]/).map((item) => item.trim()).filter((item) => /^[A-Za-z_][A-Za-z0-9_.]*$/.test(item)));
+    const enumValues = {};
+    for (const assignment of enumValue.split(/[,;，；]/).map((item) => item.trim()).filter(Boolean)) {
+        const match = /^([A-Za-z_][A-Za-z0-9_.]*)\s*=\s*(.+)$/.exec(assignment);
+        if (!match)
+            continue;
+        enumValues[match[1]] = orderedUnique(match[2].split(/\||\//).map((item) => item.trim().replace(/^['"]|['"]$/g, "")).filter(Boolean));
+    }
+    const noPayload = /^(?:none|无|not-applicable|n\/a)$/i.test(contractValue);
+    return {
+        declared: noPayload || requiredValue.length > 0 || allowedValue.length > 0 || enumValue.length > 0,
+        noPayload,
+        requiredPaths: tokens(requiredValue),
+        allowedPaths: tokens(allowedValue),
+        enumValues,
+    };
+}
 function cleanTitle(heading, id) {
     return heading.replace(/^##\s+/, "").replace(/^BE-[A-Z0-9_-]+-\d{2,3}\s*(?:[｜|—–-]\s*)?/i, "").trim() || id;
 }
@@ -466,6 +612,7 @@ async function parseMarkdownCases(workspaceRoot) {
                 scenarioTypes: scenarioTypes(body),
                 declaredScripts: declaredScripts(body),
                 declaredPrimarySymbols: declaredPrimarySymbols(body),
+                payloadContract: payloadContract(body),
                 body,
             });
         }
@@ -483,8 +630,17 @@ function parseTableRow(line) {
             index += 1;
         }
         else if (char === "|") {
-            cells.push(current.trim());
-            current = "";
+            const prev = trimmed[index - 1] ?? "";
+            const next = trimmed[index + 1] ?? "";
+            // In-cell enum/value pipes look like ACTIVE|ARCHIVED (alnum on both sides).
+            // Column separators use " | " or touch markdown separator dashes (---|---).
+            if (/[A-Za-z0-9_]/.test(prev) && /[A-Za-z0-9_]/.test(next)) {
+                current += "|";
+            }
+            else {
+                cells.push(current.trim());
+                current = "";
+            }
         }
         else {
             current += char;
@@ -687,7 +843,10 @@ export async function analyzeBackendTestCaseCoverage(input) {
             if (!rowCaseIds.includes(testCase.caseId))
                 findings.push(`${testCase.caseId} references ${ruleKey} but is absent from its Coverage Matrix Case IDs`);
         }
-        let status = declaredStatus;
+        const normalizedDeclaredStatus = /^(?:COVERED|PARTIAL|GAP|CONFLICT)$/.test(declaredStatus)
+            ? declaredStatus
+            : "PARTIAL";
+        let status = normalizedDeclaredStatus;
         if (status === "COVERED" && missingTestPoints.length > 0)
             status = "PARTIAL";
         if (missingTestPoints.length > 0)
@@ -707,7 +866,7 @@ export async function analyzeBackendTestCaseCoverage(input) {
             rule: row.Rule || "unavailable",
             requiredTestPoints,
             caseIds: rowCaseIds,
-            declaredStatus: /^(?:COVERED|PARTIAL|GAP|CONFLICT)$/.test(declaredStatus) ? declaredStatus : "PARTIAL",
+            declaredStatus: normalizedDeclaredStatus,
             coveredTestPoints,
             missingTestPoints,
             status,
@@ -749,8 +908,12 @@ export async function analyzeBackendTestCaseCoverage(input) {
             findings.push(`${testCase.caseId} missing section or entries: 测试点`);
         if (testCase.scenarioTypes.length === 0)
             findings.push(`${testCase.caseId} missing section or entries: 场景类型`);
-        if (testCase.declaredPrimarySymbols.length !== 1)
+        if (isEvidenceOnlyMarkdownCase(testCase)) {
+            // Evidence-only meta cases intentionally declare 脚本/primary symbol as 无 and only keep assertion/cross-cutting TPs.
+        }
+        else if (testCase.declaredPrimarySymbols.length !== 1) {
             findings.push(`${testCase.caseId} must declare exactly one primary symbol`);
+        }
         if (testCase.unclassifiedTestPoints.length > 0)
             findings.push(`${testCase.caseId} has unclassified Test Points: ${testCase.unclassifiedTestPoints.join(", ")}`);
         if (testCase.duplicateBindingTestPoints.length > 0)
@@ -772,8 +935,28 @@ export async function analyzeBackendTestCaseCoverage(input) {
         if (uniqueOwners.length > 1)
             findings.push(`${testPoint} is bound as a non-cross-cutting Test Point by multiple Cases: ${uniqueOwners.join(", ")}`);
     }
-    const explicitAc = input.sourceBinding.requirementIds.filter((id) => id.startsWith("AC-"));
+    const generatedMarkdown = [readme, ...cases.map((item) => item.body)].join("\n\n");
+    const sourceCoverageFacts = await collectSourceCoverageFacts({
+        workspaceRoot: input.workspaceRoot,
+        sourceBinding: input.sourceBinding,
+        generatedMarkdown,
+    });
+    const residualSourceFacts = sourceCoverageFacts.filter((fact) => !fact.covered);
+    for (const fact of residualSourceFacts) {
+        findings.push(`source coverage is missing ${fact.kind} ${fact.key} from ${fact.sourcePath}`);
+    }
+    const sourceRequirementIds = sourceCoverageFacts
+        .filter((fact) => fact.kind === "requirement-id")
+        .map((fact) => fact.key);
+    const explicitAc = orderedUnique([
+        ...input.sourceBinding.requirementIds.filter((id) => id.startsWith("AC-")),
+        ...sourceRequirementIds.filter((id) => id.startsWith("AC-")),
+    ]);
     const coveredAc = new Set(cases.flatMap((item) => item.acIds));
+    for (const acId of explicitAc) {
+        if (!coveredAc.has(acId))
+            findings.push(`explicit source AC is missing from Markdown Cases: ${acId}`);
+    }
     const [enumValueCount, coveredEnumValueCount] = dimensionCounts(rules, /enum/);
     const [boundaryPointCount, coveredBoundaryPointCount] = dimensionCounts(rules, /boundary|length|numeric/);
     const [formatClassCount, coveredFormatClassCount] = dimensionCounts(rules, /format|pattern|charset/);
@@ -782,8 +965,8 @@ export async function analyzeBackendTestCaseCoverage(input) {
     const invalidEquivalenceClassCount = rules.reduce((sum, rule) => sum + rule.requiredTestPoints.filter((point) => invalidPointPattern.test(point)).length, 0);
     const coveredInvalidEquivalenceClassCount = rules.reduce((sum, rule) => sum + rule.coveredTestPoints.filter((point) => invalidPointPattern.test(point)).length, 0);
     const facts = backendTestCaseCoverageFactsSchema.parse({
-        schemaId: "backend-test-case-coverage-facts-v3",
-        schemaVersion: 3,
+        schemaId: "backend-test-case-coverage-facts-v4",
+        schemaVersion: 4,
         taskId: input.sourceBinding.taskId,
         status: findings.length === 0 ? "PASS" : "FAIL",
         sourceBinding: input.sourceBinding,
@@ -796,6 +979,13 @@ export async function analyzeBackendTestCaseCoverage(input) {
             }))).filter(Boolean),
         ]),
         coverageScope: coverageScope.scope,
+        sourceCoverage: {
+            sourceFactCount: sourceCoverageFacts.length,
+            coveredSourceFactCount: sourceCoverageFacts.length - residualSourceFacts.length,
+            residualSourceFactCount: residualSourceFacts.length,
+            facts: sourceCoverageFacts,
+            residual: residualSourceFacts,
+        },
         summary: {
             explicitAcCount: explicitAc.length,
             coveredAcCount: explicitAc.filter((id) => coveredAc.has(id)).length,
@@ -846,6 +1036,22 @@ export async function analyzeBackendTestCaseCoverage(input) {
         `- Scope Evidence: ${facts.coverageScope.scopeEvidence.join(", ") || "Unavailable"}`,
         ...(facts.coverageScope.completenessClaim === "affected-scope" ? ["- Coverage is scoped to affected operations; it is not whole-API completeness."] : ["- Coverage fully evaluates the declared affected operations; it is not whole-API completeness unless every operation is explicitly listed."]),
         "",
+        "## Source Coverage Inventory",
+        "",
+        `- Source facts: ${facts.sourceCoverage.sourceFactCount}`,
+        `- Covered source facts: ${facts.sourceCoverage.coveredSourceFactCount}`,
+        `- Residual source facts: ${facts.sourceCoverage.residualSourceFactCount}`,
+        "",
+        "| Kind | Key | Source Anchor | Source SHA-256 | Exact Quote | Status |",
+        "|---|---|---|---|---|---|",
+        ...facts.sourceCoverage.facts.map((fact) => `| ${fact.kind} | ${fact.key} | ${fact.sourcePath}:L${fact.lineStart} | ${fact.sourceSha256} | ${fact.quote.replaceAll("|", "\\|")} | ${fact.covered ? "COVERED" : "MISSING_AFTER_SYNC"} |`),
+        "",
+        "## Residual Missing Source Scenarios",
+        "",
+        ...(facts.sourceCoverage.residual.length > 0
+            ? facts.sourceCoverage.residual.map((fact) => `- ${fact.kind} \`${fact.key}\` from \`${fact.sourcePath}:L${fact.lineStart}\` (sha256 \`${fact.sourceSha256}\`), quote: “${fact.quote}”: missing after the bounded Markdown synchronization round; no full-coverage claim is allowed.`)
+            : ["- None"]),
+        "",
         "## Coverage Summary",
         "",
         "| Dimension | Total | Covered |",
@@ -909,6 +1115,103 @@ function symbolCaseId(symbol) {
     const match = symbol.match(/^test_(BE(?:_[A-Z0-9]+)+?_\d{2,3})(?:_|$)/i);
     return match ? canonicalCaseId(match[1].replaceAll("_", "-")) : undefined;
 }
+function pythonPayloadShapes(source) {
+    const program = String.raw `
+import ast,json,sys
+source=sys.stdin.buffer.read().decode('utf-8')
+tree=ast.parse(source)
+GLOBAL_PAYLOADS={}
+for top in tree.body:
+    if isinstance(top,ast.Assign):
+        names=[target.id for target in top.targets if isinstance(target,ast.Name)]
+        candidates=[]
+        for node in ast.walk(top.value):
+            if isinstance(node,ast.Call) and isinstance(node.func,ast.Attribute) and node.func.attr == 'param' and node.args and isinstance(node.args[0],ast.Dict): candidates.append(node.args[0])
+        if isinstance(top.value,ast.Dict) and any(name.lower() in {'payload','body','request_body','request_json','dto'} for name in names): candidates.append(top.value)
+        for name in names: GLOBAL_PAYLOADS[name]=candidates
+FUNCTION_PAYLOADS={}
+for top in tree.body:
+    if isinstance(top,(ast.FunctionDef,ast.AsyncFunctionDef)) and not top.name.startswith('test_'):
+        candidates=[]
+        assigned={}
+        for node in ast.walk(top):
+            if isinstance(node,ast.Assign) and isinstance(node.value,ast.Dict):
+                for target in node.targets:
+                    if isinstance(target,ast.Name): assigned[target.id]=node.value
+            if isinstance(node,ast.Return):
+                if isinstance(node.value,ast.Dict): candidates.append(node.value)
+                elif isinstance(node.value,ast.Name) and node.value.id in assigned: candidates.append(assigned[node.value.id])
+        if candidates: FUNCTION_PAYLOADS[top.name]=candidates
+
+def literal(node):
+    if isinstance(node, ast.Constant) and isinstance(node.value, (str,int,float,bool,type(None))):
+        return repr(node.value)
+    return None
+
+def collect_dict(node, prefix, paths, values):
+    if not isinstance(node, ast.Dict): return
+    for key,value in zip(node.keys,node.values):
+        if not isinstance(key, ast.Constant) or not isinstance(key.value,str): continue
+        current = key.value if not prefix else prefix + '.' + key.value
+        paths.add(current)
+        lv=literal(value)
+        if lv is not None: values.setdefault(current,set()).add(lv)
+        if isinstance(value, ast.Dict): collect_dict(value,current,paths,values)
+        elif isinstance(value,(ast.List,ast.Tuple)):
+            for item in value.elts:
+                if isinstance(item,ast.Dict): collect_dict(item,current,paths,values)
+
+def payload_nodes(fn):
+    result=[]
+    for dec in fn.decorator_list:
+        for node in ast.walk(dec):
+            if isinstance(node,ast.Call) and isinstance(node.func,ast.Attribute) and node.func.attr == 'param' and node.args:
+                if isinstance(node.args[0],ast.Dict): result.append(node.args[0])
+            elif isinstance(node,ast.Name) and node.id in GLOBAL_PAYLOADS:
+                result.extend(GLOBAL_PAYLOADS[node.id])
+    for node in ast.walk(fn):
+        if isinstance(node,ast.Assign):
+            names=[target.id for target in node.targets if isinstance(target,ast.Name)]
+            if any(name.lower() in {'payload','body','request_body','request_json','dto'} for name in names) and isinstance(node.value,ast.Dict): result.append(node.value)
+        if isinstance(node,ast.Call):
+            if isinstance(node.func,ast.Name) and node.func.id in FUNCTION_PAYLOADS:
+                result.extend(FUNCTION_PAYLOADS[node.func.id])
+                override_keys=[]; override_values=[]
+                for keyword in node.keywords:
+                    if keyword.arg:
+                        override_keys.append(ast.Constant(keyword.arg)); override_values.append(keyword.value)
+                if override_keys: result.append(ast.Dict(keys=override_keys,values=override_values))
+            for keyword in node.keywords:
+                if keyword.arg in {'json','data','payload','body','request_body'} and isinstance(keyword.value,ast.Dict): result.append(keyword.value)
+    return result
+
+out={}
+for fn in ast.walk(tree):
+    if isinstance(fn,(ast.FunctionDef,ast.AsyncFunctionDef)) and fn.name.startswith('test_'):
+        paths=set(); values={}
+        for node in payload_nodes(fn): collect_dict(node,'',paths,values)
+        out[fn.name]={'paths':sorted(paths),'values':{key:sorted(items) for key,items in sorted(values.items())}}
+print(json.dumps(out,ensure_ascii=True))
+`;
+    // Pass bytes and decode stdin explicitly as UTF-8 in Python. Clean-env
+    // Windows Python may expose stdin as GBK; decoding generated Chinese/emoji
+    // source through that locale can create surrogateescape code points and make
+    // ast.parse fail with "surrogates not allowed".
+    const result = spawnSync("python", ["-c", program], { input: Buffer.from(source, "utf8"), encoding: "utf8", maxBuffer: 4 * 1024 * 1024, windowsHide: true });
+    if (result.status !== 0 || !result.stdout.trim())
+        return new Map();
+    try {
+        const parsed = JSON.parse(result.stdout);
+        return new Map(Object.entries(parsed));
+    }
+    catch {
+        return new Map();
+    }
+}
+function metadataCaseIds(region) {
+    return orderedUnique([...region.matchAll(/^\s*Case-ID\s*:\s*(BE-[A-Z0-9]+(?:-[A-Z0-9]+)*)\s*$/gmi)]
+        .map((match) => canonicalCaseId(match[1])));
+}
 function metadataTestPoints(region, label) {
     const escaped = label.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const match = new RegExp(`^\\s*${escaped}\\s*:\\s*(.*)$`, "mi").exec(region);
@@ -928,6 +1231,27 @@ function pytestFunctionRegionStart(source, functionIndex) {
     }
     return regionStart;
 }
+function pytestFunctionBodyEnd(source, signatureEnd, functionIndent) {
+    let cursor = source.indexOf("\n", signatureEnd);
+    if (cursor < 0)
+        return source.length;
+    cursor += 1;
+    const baseIndent = functionIndent.replaceAll("\t", "    ").length;
+    while (cursor < source.length) {
+        const nextLine = source.indexOf("\n", cursor);
+        const lineEnd = nextLine < 0 ? source.length : nextLine;
+        const line = source.slice(cursor, lineEnd).replace(/\r$/, "");
+        if (line.trim()) {
+            const indentation = line.match(/^[ \t]*/)?.[0]?.replaceAll("\t", "    ").length ?? 0;
+            if (indentation <= baseIndent)
+                return cursor;
+        }
+        if (nextLine < 0)
+            return source.length;
+        cursor = nextLine + 1;
+    }
+    return source.length;
+}
 function pytestParameterCollections(source) {
     const collections = new Map();
     for (const match of source.matchAll(/^([A-Z][A-Z0-9_]*)\s*=\s*\[([\s\S]*?)^\]/gm)) {
@@ -939,12 +1263,13 @@ function pytestSymbols(script, source) {
     const matches = [...source.matchAll(/^([ \t]*)(?:async\s+)?def\s+(test_[A-Za-z0-9_]+)\s*\([^)]*\)\s*(?:->\s*[^:\r\n]+)?\s*:/gm)];
     const regionStarts = matches.map((match) => pytestFunctionRegionStart(source, match.index));
     const parameterCollections = pytestParameterCollections(source);
+    const payloadShapes = pythonPayloadShapes(source);
     return matches.map((match, index) => {
         const regionStart = regionStarts[index];
-        const regionEnd = regionStarts[index + 1] ?? source.length;
+        const regionEnd = pytestFunctionBodyEnd(source, match.index + match[0].length, match[1]);
         const region = source.slice(match.index, regionEnd);
         const decorators = source.slice(regionStart, match.index);
-        const ids = caseIds(region);
+        const ids = metadataCaseIds(region);
         const fromSymbol = symbolCaseId(match[2]);
         if (fromSymbol)
             ids.unshift(fromSymbol);
@@ -954,6 +1279,7 @@ function pytestSymbols(script, source) {
         ]);
         const assertionTestPoints = metadataTestPoints(region, "Assertion-Test-Points");
         const crossCuttingTestPoints = metadataTestPoints(region, "Cross-Cutting-Test-Points");
+        const payloadShape = payloadShapes.get(match[2]) ?? { paths: [], values: {} };
         return {
             script,
             symbol: match[2],
@@ -962,9 +1288,51 @@ function pytestSymbols(script, source) {
             parameterIds,
             assertionTestPoints,
             crossCuttingTestPoints,
+            payloadPaths: payloadShape.paths,
+            payloadValues: payloadShape.values,
         };
     });
 }
+function executionSignature(testCase) {
+    const operation = (testCase.body.match(/\b(?:GET|POST|PUT|PATCH|DELETE)\s+\/[^\s`|)]+/i)?.[0] ?? "operation-unavailable").toUpperCase();
+    const inputPartition = [sectionBody(testCase.body, ["测试数据", "Test Data"]), testCase.scenarioTypes.join(" "), testCase.testPoints.join(" ")].join(" ");
+    const precondition = sectionBody(testCase.body, ["前置条件", "Preconditions", "Precondition"]);
+    const expectedOutcome = sectionBody(testCase.body, ["预期结果", "Expected Results", "Expected Result"]);
+    const normalized = [operation, inputPartition, precondition, expectedOutcome]
+        .map((value) => value.replaceAll(/\s+/g, " ").trim().toLowerCase())
+        .join("\n");
+    return createHash("sha256").update(normalized).digest("hex");
+}
+function assessPayloadContract(testCase, refs) {
+    const observedPaths = orderedUnique(refs.flatMap((item) => item.payloadPaths));
+    const requiredPaths = testCase.payloadContract.requiredPaths;
+    const allowedPaths = testCase.payloadContract.allowedPaths;
+    if (!testCase.payloadContract.declared) {
+        return { status: "UNAVAILABLE", requiredPaths, allowedPaths, observedPaths, missingPaths: [], unexpectedPaths: [], enumMismatches: [] };
+    }
+    const missingPaths = requiredPaths.filter((item) => !observedPaths.includes(item));
+    const unexpectedPaths = testCase.payloadContract.noPayload
+        ? observedPaths
+        : allowedPaths.length > 0
+            ? observedPaths.filter((item) => !allowedPaths.includes(item) && !allowedPaths.some((allowed) => item.startsWith(`${allowed}.`)))
+            : [];
+    const enumMismatches = [];
+    for (const [field, allowed] of Object.entries(testCase.payloadContract.enumValues)) {
+        const observed = orderedUnique(refs.flatMap((item) => item.payloadValues[field] ?? []).map((value) => value.replace(/^['"]|['"]$/g, "")));
+        for (const value of observed)
+            if (!allowed.includes(value))
+                enumMismatches.push(`${field}=${value}; allowed=${allowed.join("|")}`);
+    }
+    return {
+        status: missingPaths.length > 0 || unexpectedPaths.length > 0 || enumMismatches.length > 0 ? "UNSAFE" : "SAFE",
+        requiredPaths,
+        allowedPaths,
+        observedPaths,
+        missingPaths,
+        unexpectedPaths,
+        enumMismatches,
+    };
+}
 export async function analyzeBackendTestMarkdownPytestCorrespondence(input) {
     const cases = await parseMarkdownCases(input.workspaceRoot);
     const modulePaths = orderedUnique(cases.map((item) => item.markdownPath));
@@ -998,21 +1366,44 @@ export async function analyzeBackendTestMarkdownPytestCorrespondence(input) {
             ...crossCuttingTestPoints.filter((point) => crossCuttingBindings.includes(point)),
         ]);
         const declaredPrimarySymbol = testCase.declaredPrimarySymbols[0];
+        const evidenceOnly = isEvidenceOnlyMarkdownCase(testCase);
         const cardinality = refs.length === 0 ? "1:0" : refs.length === 1 ? "1:1" : "1:N";
-        let status = refs.length === 0 ? "MISSING_PYTEST" : refs.length > 1 ? "MULTIPLE_PYTEST" : "EXACT_1_TO_1";
+        let status = evidenceOnly && refs.length === 0
+            ? "EXACT_1_TO_1"
+            : refs.length === 0
+                ? "MISSING_PYTEST"
+                : refs.length > 1
+                    ? "MULTIPLE_PYTEST"
+                    : "EXACT_1_TO_1";
         const entryFindings = [];
-        if (refs.length === 0)
-            entryFindings.push(`${testCase.caseId} has no pytest symbol`);
-        if (refs.length > 1)
-            entryFindings.push(`${testCase.caseId} maps to multiple pytest symbols: ${symbols.join(", ")}`);
-        if (!declared || declared !== expected || actualScripts.some((script) => script !== expected) || !declaredPrimarySymbol || symbols.some((symbol) => symbol !== declaredPrimarySymbol)) {
-            if (refs.length > 0 && status === "EXACT_1_TO_1")
+        const payloadAssessment = assessPayloadContract(testCase, refs);
+        const signature = executionSignature(testCase);
+        if (evidenceOnly) {
+            if (refs.length > 0) {
                 status = "SCRIPT_MISMATCH";
-            entryFindings.push(`${testCase.caseId} script/primary-symbol mapping mismatch: declaredScript=${declared ?? "none"}, expectedScript=${expected}, actual=${actualScripts.join(", ") || "none"}, declaredPrimarySymbol=${declaredPrimarySymbol ?? "none"}, actualSymbols=${symbols.join(", ") || "none"}`);
+                entryFindings.push(`${testCase.caseId} evidence-only Markdown Case must not materialize a business pytest symbol; actualSymbols=${symbols.join(", ") || "none"}`);
+            }
         }
-        const missingVariant = variantTestPoints.filter((point) => !parameterIds.includes(point));
-        const missingAssertion = assertionTestPoints.filter((point) => !assertionBindings.includes(point));
-        const missingCrossCutting = crossCuttingTestPoints.filter((point) => !crossCuttingBindings.includes(point));
+        else {
+            if (refs.length === 0)
+                entryFindings.push(`${testCase.caseId} has no pytest symbol`);
+            if (refs.length > 1)
+                entryFindings.push(`${testCase.caseId} maps to multiple pytest symbols: ${symbols.join(", ")}`);
+            if (!declared || declared !== expected || actualScripts.some((script) => script !== expected) || !declaredPrimarySymbol || symbols.some((symbol) => symbol !== declaredPrimarySymbol)) {
+                if (refs.length > 0 && status === "EXACT_1_TO_1")
+                    status = "SCRIPT_MISMATCH";
+                entryFindings.push(`${testCase.caseId} script/primary-symbol mapping mismatch: declaredScript=${declared ?? "none"}, expectedScript=${expected}, actual=${actualScripts.join(", ") || "none"}, declaredPrimarySymbol=${declaredPrimarySymbol ?? "none"}, actualSymbols=${symbols.join(", ") || "none"}`);
+            }
+        }
+        const missingVariant = evidenceOnly
+            ? []
+            : variantTestPoints.filter((point) => !parameterIds.includes(point));
+        const missingAssertion = evidenceOnly
+            ? []
+            : assertionTestPoints.filter((point) => !assertionBindings.includes(point));
+        const missingCrossCutting = evidenceOnly
+            ? []
+            : crossCuttingTestPoints.filter((point) => !crossCuttingBindings.includes(point));
         const extraPoints = orderedUnique([...parameterIds, ...assertionBindings, ...crossCuttingBindings]).filter((point) => !testCase.testPoints.includes(point));
         if (testCase.unclassifiedTestPoints.length > 0 || testCase.duplicateBindingTestPoints.length > 0) {
             if (refs.length > 0 && status === "EXACT_1_TO_1")
@@ -1039,6 +1430,16 @@ export async function analyzeBackendTestMarkdownPytestCorrespondence(input) {
                 status = "TEST_POINT_BINDING_EXTRA";
             entryFindings.push(`${testCase.caseId} has extra pytest Test Point bindings: ${extraPoints.join(", ")}`);
         }
+        if (payloadAssessment.status === "UNAVAILABLE") {
+            if (refs.length > 0 && status === "EXACT_1_TO_1")
+                status = "PAYLOAD_CONTRACT_UNAVAILABLE";
+            entryFindings.push(`${testCase.caseId} has no deterministic Payload Contract declaration`);
+        }
+        else if (payloadAssessment.status === "UNSAFE") {
+            if (refs.length > 0 && status === "EXACT_1_TO_1")
+                status = "PAYLOAD_SHAPE_MISMATCH";
+            entryFindings.push(`${testCase.caseId} payload contract mismatch: missing=${payloadAssessment.missingPaths.join(", ") || "none"}; unexpected=${payloadAssessment.unexpectedPaths.join(", ") || "none"}; enum=${payloadAssessment.enumMismatches.join(", ") || "none"}`);
+        }
         findings.push(...entryFindings);
         entries.push({
             markdownModule: testCase.markdownPath,
@@ -1056,6 +1457,8 @@ export async function analyzeBackendTestMarkdownPytestCorrespondence(input) {
             parameterIds,
             cardinality,
             status,
+            payloadAssessment,
+            executionSignature: signature,
             findings: entryFindings,
         });
     }
@@ -1082,9 +1485,27 @@ export async function analyzeBackendTestMarkdownPytestCorrespondence(input) {
             parameterIds: symbol.parameterIds,
             cardinality: "0:1",
             status: unknownId ? "EXTRA_PYTEST" : "SYMBOL_MISSING_CASE_ID",
+            payloadAssessment: {
+                status: "UNAVAILABLE",
+                requiredPaths: [],
+                allowedPaths: [],
+                observedPaths: symbol.payloadPaths,
+                missingPaths: [],
+                unexpectedPaths: [],
+                enumMismatches: [],
+            },
             findings: [message],
         });
     }
+    const duplicateSignatures = new Map();
+    for (const entry of entries.filter((item) => item.caseId && item.executionSignature)) {
+        const owners = duplicateSignatures.get(entry.executionSignature) ?? [];
+        owners.push(entry.caseId);
+        duplicateSignatures.set(entry.executionSignature, owners);
+    }
+    const duplicateSignatureGroups = [...duplicateSignatures.entries()].filter(([, owners]) => orderedUnique(owners).length > 1);
+    for (const [signature, owners] of duplicateSignatureGroups)
+        findings.push(`duplicate execution signature ${signature}: ${orderedUnique(owners).join(", ")}`);
     const exactModuleCount = modulePaths.filter((modulePath) => {
         const expected = expectedScript(modulePath);
         const moduleCases = cases.filter((item) => item.markdownPath === modulePath);
@@ -1092,8 +1513,8 @@ export async function analyzeBackendTestMarkdownPytestCorrespondence(input) {
     }).length;
     const caseEntries = entries.filter((entry) => entry.cardinality !== "0:1");
     const facts = backendTestMarkdownPytestCorrespondenceFactsSchema.parse({
-        schemaId: "backend-test-markdown-pytest-correspondence-facts-v2",
-        schemaVersion: 2,
+        schemaId: "backend-test-markdown-pytest-correspondence-facts-v3",
+        schemaVersion: 3,
         taskId: input.taskId,
         status: findings.length === 0 ? "PASS" : "FAIL",
         inputFiles: await inputFileFacts(input.workspaceRoot, [
@@ -1118,6 +1539,10 @@ export async function analyzeBackendTestMarkdownPytestCorrespondence(input) {
             crossCuttingTestPointCount: cases.reduce((sum, item) => sum + item.testPointBindings.filter((binding) => binding.mode === "cross-cutting").length, 0),
             unclassifiedTestPointCount: cases.reduce((sum, item) => sum + item.unclassifiedTestPoints.length, 0),
             duplicateBindingTestPointCount: cases.reduce((sum, item) => sum + item.duplicateBindingTestPoints.length, 0),
+            payloadSafeCount: caseEntries.filter((entry) => entry.payloadAssessment.status === "SAFE").length,
+            payloadUnsafeCount: caseEntries.filter((entry) => entry.payloadAssessment.status === "UNSAFE").length,
+            payloadUnavailableCount: caseEntries.filter((entry) => entry.payloadAssessment.status === "UNAVAILABLE").length,
+            duplicateExecutionSignatureCount: duplicateSignatureGroups.length,
         },
         entries,
         findings: orderedUnique(findings),
@@ -1145,12 +1570,16 @@ export async function analyzeBackendTestMarkdownPytestCorrespondence(input) {
         `- Cross-Cutting Test Points: ${facts.summary.crossCuttingTestPointCount}`,
         `- Unclassified Test Points: ${facts.summary.unclassifiedTestPointCount}`,
         `- Duplicate Test Point Bindings: ${facts.summary.duplicateBindingTestPointCount}`,
+        `- Payload SAFE: ${facts.summary.payloadSafeCount}`,
+        `- Payload UNSAFE: ${facts.summary.payloadUnsafeCount}`,
+        `- Payload UNAVAILABLE: ${facts.summary.payloadUnavailableCount}`,
+        `- Duplicate Execution Signatures: ${facts.summary.duplicateExecutionSignatureCount}`,
         "",
         "## Correspondence Matrix",
         "",
-        "| Markdown Module | Case ID | Variant | Assertion | Cross-Cutting | Mapped | Declared Script | Primary Symbol | Actual Script | Pytest Symbol | Parameter IDs | Cardinality | Status |",
-        "|---|---|---|---|---|---|---|---|---|---|---|---|---|",
-        ...facts.entries.map((entry) => `| ${entry.markdownModule} | ${entry.caseId ?? "—"} | ${entry.variantTestPoints.join(", ") || "—"} | ${entry.assertionTestPoints.join(", ") || "—"} | ${entry.crossCuttingTestPoints.join(", ") || "—"} | ${entry.mappedTestPoints.join(", ") || "—"} | ${entry.declaredScript ?? "—"} | ${entry.declaredPrimarySymbol ?? "—"} | ${entry.actualScripts.join(", ") || "—"} | ${entry.pytestSymbols.join(", ") || "—"} | ${entry.parameterIds.join(", ") || "—"} | ${entry.cardinality} | ${entry.status} |`),
+        "| Markdown Module | Case ID | Variant | Assertion | Cross-Cutting | Mapped | Declared Script | Primary Symbol | Actual Script | Pytest Symbol | Parameter IDs | Payload | Missing Paths | Unexpected Paths | Enum Mismatch | Cardinality | Status |",
+        "|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|",
+        ...facts.entries.map((entry) => `| ${entry.markdownModule} | ${entry.caseId ?? "—"} | ${entry.variantTestPoints.join(", ") || "—"} | ${entry.assertionTestPoints.join(", ") || "—"} | ${entry.crossCuttingTestPoints.join(", ") || "—"} | ${entry.mappedTestPoints.join(", ") || "—"} | ${entry.declaredScript ?? "—"} | ${entry.declaredPrimarySymbol ?? "—"} | ${entry.actualScripts.join(", ") || "—"} | ${entry.pytestSymbols.join(", ") || "—"} | ${entry.parameterIds.join(", ") || "—"} | ${entry.payloadAssessment.status} | ${entry.payloadAssessment.missingPaths.join(", ") || "—"} | ${entry.payloadAssessment.unexpectedPaths.join(", ") || "—"} | ${entry.payloadAssessment.enumMismatches.join(", ") || "—"} | ${entry.cardinality} | ${entry.status} |`),
         "",
         "## Findings",
         "",