@tea-agent/loop-agent 0.35.2 → 0.35.4-beta.0

package/dist/workflows/dag/runner.js

@@ -1,4 +1,5 @@
 import { readdir, readFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
 import { hostname } from "node:os";
 import path from "node:path";
@@ -6,7 +7,7 @@ import { isHardBudgetBreached, resolveEffectiveMaxConcurrent, } from "../../appl
 import { readCandidateRecord } from "../../infrastructure/evaluation/candidate-store.js";
 import { CANONICAL_TASK_ID_PATTERN, formatLocalCompactDate, } from "../../task/runtime.js";
 import { assertFrozenBudget, initRunBudgetLedger, preflightBudgetOrBreach, recordFinishedNodeBudget, writeBudgetLedgerArtifacts, } from "./budget-enforcement.js";
-import { getDagRunDir, isTerminalDagRunStatus, locateDagRun, readHumanApprovalArtifact, requireActiveDagRun, } from "./lifecycle.js";
+import { getDagRunDir, isTerminalDagRunStatus, locateDagRun, readDagRunSpec, readDagRunState, readHumanApprovalArtifact, requireActiveDagRun, } from "./lifecycle.js";
 import { moveToCompletedRunDir, moveToPausedRunDir, prepareRunDir, writeRunSpec, writeRunState, } from "./run-store.js";
 import { evaluateNodeLiveness, resolveLivenessPolicy, } from "./liveness-policy.js";
 import { createDagNodeExecutor } from "./executor-registry.js";
@@ -21,8 +22,9 @@ import { createSkillSnapshot, prepareSkillSnapshotForContinuation, writeSkillSna
 import { captureWorkspaceCheckpoint, WORKSPACE_CHECKPOINT_START_REL, WORKSPACE_CHECKPOINT_TERMINAL_REL, writeWorkspaceCheckpoint, } from "./workspace-checkpoint.js";
 import { buildNodePrompt, buildNodePromptWithResolvedSkillInstructions, executeDagNode, } from "./node-execution.js";
 import { runConvergencePassController, } from "./convergence/controller.js";
-import { executeDagRanksOnce, isConditionSkippedReason } from "./scheduler.js";
+import { executeDagRanksOnce, FRONTEND_PREWRITE_RESULT_SOURCE_ARTIFACT, FRONTEND_WRITER_NODE_IDS, isConditionSkippedReason, readFrontendPrewriteResult, } from "./scheduler.js";
 import { topoSortToRanks } from "./topo.js";
+import { isFrontendWriterTransientPartialWrite } from "./frontend-writer-recovery.js";
 import { parseDagSpec, resolveModelForTask, } from "./types.js";
 import { executeDynamicCondition } from "./dynamic-runtime/condition.js";
 import { executeDynamicLoopUntil } from "./dynamic-runtime/loop-until.js";
@@ -448,6 +450,39 @@ async function executeDagCheckpoint(input) {
         void persistState().catch(() => { });
     }, runnerLivenessPolicy.heartbeatIntervalMs);
     heartbeatTimer.unref();
+    // Graceful terminal persistence: an outer SIGTERM/SIGINT (operator hard
+    // timeout, supervision layer, or shell wall-clock) must not leave the run
+    // orphaned in RUNNING with a dead heartbeat. Persist a terminal failed
+    // state with an explicit terminalReason before exiting so downstream
+    // liveness/doctor tooling sees a diagnosable terminal instead of an orphan.
+    let terminalSignal;
+    const shutdownOnSignal = (signal) => {
+        if (terminalSignal)
+            return;
+        terminalSignal = signal;
+        clearInterval(heartbeatTimer);
+        if (state.runner)
+            state.runner.heartbeatAt = new Date().toISOString();
+        state.status = "failed";
+        state.finishedAt = new Date().toISOString();
+        state.terminalReason = `runner terminated by ${signal} before run completion`;
+        console.warn(`[run-dag] received ${signal}; persisting terminal state and exiting`);
+        const exit = () => process.exit(signal === "SIGINT" ? 130 : 143);
+        // Best-effort atomic persist with a hard exit deadline so a stuck write
+        // queue cannot keep the process alive past the supervisor's kill window.
+        const hardExit = setTimeout(exit, 5000);
+        hardExit.unref();
+        void persistState()
+            .catch(() => { })
+            .finally(() => {
+            clearTimeout(hardExit);
+            exit();
+        });
+    };
+    const onSigTerm = () => shutdownOnSignal("SIGTERM");
+    const onSigInt = () => shutdownOnSignal("SIGINT");
+    process.once("SIGTERM", onSigTerm);
+    process.once("SIGINT", onSigInt);
     try {
         const tasksById = new Map(spec.tasks.map((task) => [task.id, task]));
         const baseExecuteNode = input.executeNode ??
@@ -504,6 +539,7 @@ async function executeDagCheckpoint(input) {
             tasksById,
             maxConcurrent,
             persistState,
+            runDir,
             abortSignal: input.abortSignal,
             createExecuteNodeForRank: (rankWriterNodeIds) => buildRankAwareExecuteNode({
                 baseExecuteNode,
@@ -595,17 +631,54 @@ async function executeDagCheckpoint(input) {
             runDir = await moveToPausedRunDir(runDir, pausedRunDir);
         }
         else {
-            finalizeTerminalRunStatus(state, spec.tasks.length);
+            const { recoveryPending } = await finalizeTerminalRunStatus(state, spec.tasks.length, runDir, cwd);
             await persistState();
-            await notifyRunObserver(input.observer, "onRunFinish", state);
-            try {
-                const terminalCheckpoint = await captureWorkspaceCheckpoint(cwd);
-                await writeWorkspaceCheckpoint(runDir, WORKSPACE_CHECKPOINT_TERMINAL_REL, terminalCheckpoint);
+            if (recoveryPending) {
+                // Recovery coordinator (phase 3c AC-2/AC-3): materialize the reserved
+                // child and run it synchronously. Dynamic import avoids a static
+                // runner ↔ frontend-recovery-run module cycle. stageRecoveryChild
+                // locates the parent via the canonical active/ layout, so recovery
+                // only fires when this run is still the canonical active run dir
+                // (direct runDagContinuation callers using an arbitrary runDir keep
+                // the previous scheduler-layer skip semantics).
+                const canonicalActiveDir = getDagRunDir(cwd, "active", state.runId);
+                if (path.resolve(runDir) === path.resolve(canonicalActiveDir)) {
+                    const { stageRecoveryChild } = await import("./frontend-recovery-run.js");
+                    const staged = await stageRecoveryChild({
+                        cwd,
+                        parentRunId: state.runId,
+                    });
+                    // stageRecoveryChild CAS-advanced the parent's on-disk lineage
+                    // (child-staging → child-running + childRunId). Refresh the in-memory
+                    // copy so the terminal persistState below does not regress the parent
+                    // back to stale child-staging.
+                    const parentOnDisk = await readDagRunState(runDir);
+                    state.frontendRecoveryState = parentOnDisk.frontendRecoveryState;
+                    const childState = await readDagRunState(staged.childRunDir);
+                    const childSpec = await readDagRunSpec(staged.childRunDir);
+                    await runDagContinuation({
+                        cwd,
+                        spec: childSpec,
+                        state: childState,
+                        runDir: staged.childRunDir,
+                        maxConcurrent,
+                        executeNode: input.executeNode,
+                        observer: input.observer,
+                        abortSignal: input.abortSignal,
+                    });
+                }
             }
-            catch (error) {
-                console.warn(`[run-dag] warning: failed to write workspace terminal checkpoint: ${error instanceof Error ? error.message : String(error)}`);
+            await notifyRunObserver(input.observer, "onRunFinish", state);
+            if (!recoveryPending) {
+                try {
+                    const terminalCheckpoint = await captureWorkspaceCheckpoint(cwd);
+                    await writeWorkspaceCheckpoint(runDir, WORKSPACE_CHECKPOINT_TERMINAL_REL, terminalCheckpoint);
+                }
+                catch (error) {
+                    console.warn(`[run-dag] warning: failed to write workspace terminal checkpoint: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                runDir = await moveToCompletedRunDir(runDir, completedRunDir);
             }
-            runDir = await moveToCompletedRunDir(runDir, completedRunDir);
         }
         await relocateRunArtifactPaths({
             runDir,
@@ -628,6 +701,8 @@ async function executeDagCheckpoint(input) {
     }
     finally {
         clearInterval(heartbeatTimer);
+        process.removeListener("SIGTERM", onSigTerm);
+        process.removeListener("SIGINT", onSigInt);
     }
 }
 async function notifyRunObserver(observer, event, state) {
@@ -695,7 +770,153 @@ function isSuccessfulConvergenceTerminal(state) {
         return true;
     return SUCCESSFUL_CONVERGENCE_TERMINAL_REASONS.has(reason);
 }
-function finalizeTerminalRunStatus(state, taskCount) {
+function buildFrontendRecoveryIntent(state, failureSource) {
+    const existing = state.frontendRecoveryState;
+    const requestId = existing?.requestId ?? randomUUID();
+    return {
+        schemaVersion: 1,
+        phase: "child-staging",
+        requestId,
+        recoveryRootRunId: existing?.recoveryRootRunId ?? state.runId,
+        parentRunId: state.runId,
+        ...(existing?.childRunId ? { childRunId: existing.childRunId } : {}),
+        attemptId: existing?.attemptId ?? `recovery-${requestId}`,
+        attemptIndex: existing?.attemptIndex ?? 0,
+        continuationCount: existing?.continuationCount ?? 0,
+        ...(failureSource ? { failureSource } : {}),
+        revision: (existing?.revision ?? 0) + 1,
+    };
+}
+function buildCandidateContractInvalidResult(state, result, artifactHash) {
+    const recovery = state.frontendRecoveryState;
+    return {
+        schemaVersion: 1,
+        outcome: "candidate-contract-invalid",
+        origin: {
+            kind: "frontend-prewrite-gate",
+            parentRunId: recovery?.parentRunId ?? state.runId,
+            ...(recovery?.childRunId ? { childRunId: recovery.childRunId } : {}),
+            requestId: recovery?.requestId ?? "",
+            failedNodeId: result.selectedPlanNodeId,
+        },
+        failureClass: {
+            code: "candidate-contract-invalid",
+            classification: result.classification,
+            reason: result.failureReason ?? "candidate contract invalid",
+        },
+        evidenceRefs: [
+            {
+                runId: state.runId,
+                relativePath: FRONTEND_PREWRITE_RESULT_SOURCE_ARTIFACT,
+                sha256: artifactHash,
+            },
+        ],
+    };
+}
+function buildWriterPartialWriteBlockedResult(state, failedNodeId, reason) {
+    const recovery = state.frontendRecoveryState;
+    return {
+        schemaVersion: 1,
+        outcome: "auto-recovery-blocked",
+        origin: {
+            kind: "frontend-writer",
+            parentRunId: recovery?.parentRunId ?? state.runId,
+            ...(recovery?.childRunId ? { childRunId: recovery.childRunId } : {}),
+            requestId: recovery?.requestId ?? "",
+            failedNodeId,
+        },
+        failureClass: {
+            code: "writer-transient-partial-write",
+            classification: "transient",
+            reason,
+        },
+        evidenceRefs: [],
+    };
+}
+function settleFrontendRecovery(state, outcome) {
+    const recovery = state.frontendRecoveryState;
+    if (!recovery)
+        return;
+    recovery.phase = "settled";
+    if (!state.frontendRecoveryResult) {
+        state.frontendRecoveryResult = {
+            schemaVersion: 1,
+            outcome,
+            origin: {
+                kind: "frontend-prewrite-gate",
+                parentRunId: recovery.parentRunId,
+                ...(recovery.childRunId ? { childRunId: recovery.childRunId } : {}),
+                requestId: recovery.requestId,
+                failedNodeId: "",
+            },
+            evidenceRefs: [],
+        };
+    }
+}
+export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd) {
+    const repoRoot = cwd ?? path.resolve(runDir, "..", "..", "..", "..");
+    // Terminal override: a denied frontend writer must never surface as a
+    // mechanical partial_failed just because prewrite FINISHED while the writer
+    // was SKIPPED. Fail closed on retryable-invalid/blocked before aggregation.
+    let recoveryPending = false;
+    const hasFrontendWriter = Object.keys(state.nodes).some((id) => FRONTEND_WRITER_NODE_IDS.includes(id));
+    if (hasFrontendWriter) {
+        const admission = await readFrontendPrewriteResult(runDir);
+        if (admission.ok) {
+            if (admission.result.classification === "blocked") {
+                state.status = "failed";
+                return { recoveryPending: false };
+            }
+            if (admission.result.classification === "retryable-invalid") {
+                const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
+                if (continuationCount >= 1) {
+                    // Continuation quota exhausted: a second retryable-invalid candidate
+                    // is authoritative candidate-contract-invalid → forced failed.
+                    state.frontendRecoveryResult = buildCandidateContractInvalidResult(state, admission.result, admission.artifactHash);
+                    state.status = "failed";
+                    return { recoveryPending: false };
+                }
+                // Root continuation still available: record the recovery intent and let
+                // mechanical aggregation settle partial_failed/failed. The parent keeps
+                // phase != settled (recovery in progress) and no final root manifest.
+                state.frontendRecoveryState = buildFrontendRecoveryIntent(state);
+                recoveryPending = true;
+            }
+        }
+    }
+    // Phase 5: writer transient partial write → rollback + recovery intent. Only
+    // for frontend-implementation writers with a remaining root continuation, and
+    // only when the rollback journal (captured before the provider call) restores
+    // cleanly; otherwise the run stays failed with auto-recovery-blocked.
+    if (hasFrontendWriter && !recoveryPending) {
+        const writerNodeId = FRONTEND_WRITER_NODE_IDS.find((id) => {
+            const node = state.nodes[id];
+            return (node &&
+                node.status === "ERROR" &&
+                isFrontendWriterTransientPartialWrite({
+                    failureCategory: node.failureCategory,
+                }));
+        });
+        if (writerNodeId) {
+            const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
+            if (continuationCount < 1) {
+                const { rollbackFrontendWriter } = await import("./frontend-writer-recovery.js");
+                const rollback = await rollbackFrontendWriter({
+                    cwd: repoRoot,
+                    parentRunId: state.runId,
+                });
+                if (rollback.ok) {
+                    state.frontendRecoveryState = buildFrontendRecoveryIntent(state, "frontend-implement-pi");
+                    recoveryPending = true;
+                }
+                else {
+                    state.frontendRecoveryResult = buildWriterPartialWriteBlockedResult(state, writerNodeId, rollback.reason);
+                    state.status = "failed";
+                    return { recoveryPending: false };
+                }
+            }
+        }
+    }
     const finishedCount = Object.values(state.nodes).filter((n) => n.status === "FINISHED").length;
     const { supersededIds, supersededFailures } = collectSupersededIntermediateFailures(state);
     if (state.convergence && supersededFailures.length > 0) {
@@ -719,6 +940,19 @@ function finalizeTerminalRunStatus(state, taskCount) {
     else {
         state.status = "failed";
     }
+    // Terminal recovery bookkeeping for a child attempt: a child that finished
+    // recovered settles its own lineage; any other child terminal settles as
+    // auto-recovery-blocked (phase 3 performs no further recovery).
+    const recovery = state.frontendRecoveryState;
+    if (recovery && recovery.attemptIndex >= 1) {
+        if (state.status === "finished") {
+            settleFrontendRecovery(state, "recovered");
+        }
+        else if (!state.frontendRecoveryResult) {
+            settleFrontendRecovery(state, "auto-recovery-blocked");
+        }
+    }
+    return { recoveryPending };
 }
 function concurrentSiblingWriteSetsForNode(rankWriterNodeIds, nodeId, tasksById) {
     if (rankWriterNodeIds.length <= 1)

package/dist/workflows/dag/scheduler.js

@@ -1,5 +1,10 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
 import { isPauseOnHumanDecisionGate } from "./decision-envelope.js";
 import { evaluateConditionExpression } from "./dynamic-runtime/condition.js";
+import { sha256Hex } from "./frontend-implementation-contract.js";
+import { frontendPrewriteResultV1Schema, FRONTEND_PREWRITE_RESULT_ARTIFACT_NAME, } from "./frontend-prewrite-gate.js";
+import { FRONTEND_RECOVERY_IMPORT_MANIFEST_REL_PATH, FRONTEND_RECOVERY_INTENT_REL_DIR, } from "./frontend-recovery-plan.js";
 export function isConditionSkippedReason(reason) {
     return Boolean(reason?.startsWith("condition "));
 }
@@ -104,6 +109,58 @@ async function mapConcurrent(items, limit, fn) {
     }
     await Promise.all(executing);
 }
+export const FRONTEND_WRITER_NODE_IDS = [
+    "frontend-implement-pi",
+    "frontend-repair-pi",
+];
+/** Run-relative artifact location written by the prewrite gate generator. */
+export const FRONTEND_PREWRITE_RESULT_SOURCE_ARTIFACT = path.posix.join("contracts", FRONTEND_PREWRITE_RESULT_ARTIFACT_NAME);
+/**
+ * Read and validate the frontend-prewrite-result-v1 artifact. Fail-closed:
+ * a missing file or invalid payload returns ok:false and never throws.
+ */
+export async function readFrontendPrewriteResult(runDir) {
+    const artifactPath = path.join(runDir, "contracts", FRONTEND_PREWRITE_RESULT_ARTIFACT_NAME);
+    let raw;
+    try {
+        raw = await readFile(artifactPath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return {
+                ok: false,
+                reason: `frontend prewrite result artifact missing: ${artifactPath}`,
+            };
+        }
+        throw error;
+    }
+    const artifactHash = sha256Hex(raw);
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        return {
+            ok: false,
+            reason: `frontend prewrite result artifact is not valid JSON: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    const result = frontendPrewriteResultV1Schema.safeParse(parsed);
+    if (!result.success) {
+        return {
+            ok: false,
+            reason: "frontend prewrite result artifact failed schema validation",
+        };
+    }
+    return { ok: true, result: result.data, artifactHash };
+}
+/** Authorize only accepted / accepted-normalized classifications. */
+export function isFrontendWriterAuthorized(result) {
+    return result.classification === "accepted" ||
+        result.classification === "accepted-normalized"
+        ? "authorized"
+        : "denied";
+}
 /** Fail-closed: leave no PENDING nodes that look "still scheduled" after abort. */
 export function markPendingNodesControllerInterrupted(state, reason = "run aborted by controller (abortSignal)") {
     const affected = [];
@@ -122,8 +179,166 @@ export function markPendingNodesControllerInterrupted(state, reason = "run abort
     }
     return affected;
 }
+/**
+ * True when this run is a candidate-continuation child: it has a recovery
+ * lineage whose attemptIndex is >= 1 and whose recovery root is another run.
+ * The root/parent keeps `recoveryRootRunId === state.runId`.
+ */
+export function isFrontendRecoveryChild(state) {
+    const recovery = state.frontendRecoveryState;
+    return Boolean(recovery &&
+        recovery.attemptIndex >= 1 &&
+        recovery.recoveryRootRunId !== state.runId);
+}
+function isValidFrontendRecoveryActivationMarker(raw) {
+    return (raw.schemaVersion === 1 &&
+        typeof raw.requestId === "string" &&
+        raw.requestId.length > 0 &&
+        typeof raw.parentRunId === "string" &&
+        raw.parentRunId.length > 0 &&
+        typeof raw.recoveryRootRunId === "string" &&
+        raw.recoveryRootRunId.length > 0 &&
+        typeof raw.childRunId === "string" &&
+        raw.childRunId.length > 0 &&
+        typeof raw.importManifestSha256 === "string" &&
+        /^[a-f0-9]{64}$/.test(raw.importManifestSha256));
+}
+/**
+ * Activation marker gate (phase 3c AC-1). Fail-closed: an active child is only
+ * executable when its parent is `child-running`, points at this child, carries
+ * a structurally valid activation marker whose lineage matches, and the marker
+ * hash matches the child's import manifest. Read-only and never throws.
+ */
+export async function checkFrontendRecoveryActivation(state, childRunDir) {
+    if (!isFrontendRecoveryChild(state)) {
+        return { applicable: false };
+    }
+    const recovery = state.frontendRecoveryState;
+    const parentRunId = recovery.parentRunId;
+    const parentRunDir = path.join(path.dirname(childRunDir), parentRunId);
+    let parentState;
+    try {
+        parentState = JSON.parse(await readFile(path.join(parentRunDir, "state.json"), "utf8"));
+    }
+    catch {
+        return { applicable: true, ok: false, reason: "parent state unreadable" };
+    }
+    const parentRecovery = parentState.frontendRecoveryState;
+    if (parentRecovery?.phase !== "child-running") {
+        return {
+            applicable: true,
+            ok: false,
+            reason: "parent phase not child-running",
+        };
+    }
+    if (parentRecovery.childRunId !== state.runId) {
+        return {
+            applicable: true,
+            ok: false,
+            reason: "parent childRunId mismatch",
+        };
+    }
+    const markerPath = path.join(parentRunDir, FRONTEND_RECOVERY_INTENT_REL_DIR, `${recovery.requestId}.json`);
+    let markerRaw;
+    try {
+        markerRaw = JSON.parse(await readFile(markerPath, "utf8"));
+    }
+    catch {
+        return {
+            applicable: true,
+            ok: false,
+            reason: "activation marker missing",
+        };
+    }
+    if (typeof markerRaw !== "object" ||
+        markerRaw === null ||
+        !isValidFrontendRecoveryActivationMarker(markerRaw)) {
+        return {
+            applicable: true,
+            ok: false,
+            reason: "activation marker invalid",
+        };
+    }
+    const marker = markerRaw;
+    if (marker.requestId !== recovery.requestId) {
+        return {
+            applicable: true,
+            ok: false,
+            reason: "marker requestId mismatch",
+        };
+    }
+    if (marker.parentRunId !== parentRunId) {
+        return {
+            applicable: true,
+            ok: false,
+            reason: "marker parentRunId mismatch",
+        };
+    }
+    if (marker.recoveryRootRunId !== recovery.recoveryRootRunId) {
+        return {
+            applicable: true,
+            ok: false,
+            reason: "marker recoveryRootRunId mismatch",
+        };
+    }
+    if (marker.childRunId !== state.runId) {
+        return {
+            applicable: true,
+            ok: false,
+            reason: "marker childRunId mismatch",
+        };
+    }
+    let manifestSha256;
+    try {
+        manifestSha256 = sha256Hex(await readFile(path.join(childRunDir, FRONTEND_RECOVERY_IMPORT_MANIFEST_REL_PATH), "utf8"));
+    }
+    catch {
+        return {
+            applicable: true,
+            ok: false,
+            reason: "import manifest unreadable",
+        };
+    }
+    if (manifestSha256 !== marker.importManifestSha256) {
+        return {
+            applicable: true,
+            ok: false,
+            reason: "import manifest sha256 mismatch",
+        };
+    }
+    return {
+        applicable: true,
+        ok: true,
+        requestId: recovery.requestId,
+        childRunId: state.runId,
+    };
+}
 export async function executeDagRanksOnce(input) {
     let pausedByNodeId;
+    // Activation marker gate (phase 3c AC-1): a recovery child without a valid
+    // activation marker must never be scheduled or executed. Fail-closed before
+    // any executeScheduledNode call, so zero writer/provider invocations happen.
+    if (input.runDir) {
+        const hasPending = Object.values(input.state.nodes).some((node) => node.status === "PENDING");
+        if (hasPending) {
+            const activation = await checkFrontendRecoveryActivation(input.state, input.runDir);
+            if (activation.applicable && !activation.ok) {
+                const finishedAt = new Date().toISOString();
+                let affected = 0;
+                for (const node of Object.values(input.state.nodes)) {
+                    if (node.status !== "PENDING")
+                        continue;
+                    node.status = "SKIPPED";
+                    node.skippedReason = "frontend-recovery-child-not-activated";
+                    node.finishedAt = finishedAt;
+                    affected += 1;
+                }
+                if (affected > 0)
+                    await input.persistState();
+                return undefined;
+            }
+        }
+    }
     for (const rank of input.ranks) {
         if (input.abortSignal?.aborted) {
             const marked = markPendingNodesControllerInterrupted(input.state, input.abortSignal.reason
@@ -168,6 +383,45 @@ export async function executeDagRanksOnce(input) {
             await input.persistState();
         const conditionSkippedSet = new Set(conditionSettled);
         const actuallyRunnable = runnable.filter((id) => !conditionSkippedSet.has(id));
+        const frontendAdmissionSettled = [];
+        if (input.runDir) {
+            for (const id of actuallyRunnable) {
+                if (!FRONTEND_WRITER_NODE_IDS.includes(id))
+                    continue;
+                const node = input.state.nodes[id];
+                const checkedAt = new Date().toISOString();
+                const admission = await readFrontendPrewriteResult(input.runDir);
+                if (!admission.ok) {
+                    node.status = "SKIPPED";
+                    node.skippedReason = "frontend-prewrite-not-authorized";
+                    node.finishedAt = checkedAt;
+                    frontendAdmissionSettled.push(id);
+                    continue;
+                }
+                const decision = isFrontendWriterAuthorized(admission.result);
+                node.frontendWriterAdmission = {
+                    schemaVersion: 1,
+                    writerNodeId: id,
+                    decision,
+                    sourceArtifact: FRONTEND_PREWRITE_RESULT_SOURCE_ARTIFACT,
+                    artifactHash: admission.artifactHash,
+                    checkedAt,
+                    reason: decision === "denied"
+                        ? `classification: ${admission.result.classification}`
+                        : null,
+                };
+                if (decision === "denied") {
+                    node.status = "SKIPPED";
+                    node.skippedReason = "frontend-prewrite-not-authorized";
+                    node.finishedAt = checkedAt;
+                    frontendAdmissionSettled.push(id);
+                }
+            }
+            if (frontendAdmissionSettled.length > 0)
+                await input.persistState();
+        }
+        const frontendAdmissionSkippedSet = new Set(frontendAdmissionSettled);
+        const runnableAfterAdmission = actuallyRunnable.filter((id) => !frontendAdmissionSkippedSet.has(id));
         const blocked = pending.filter((id) => {
             const task = input.tasksById.get(id);
             return (dependencyReadiness(task, input.state.nodes, input.tasksById) === "skip");
@@ -182,12 +436,12 @@ export async function executeDagRanksOnce(input) {
         if (blocked.length > 0) {
             await input.persistState();
         }
-        const pauseGateRunnable = actuallyRunnable.filter((id) => {
+        const pauseGateRunnable = runnableAfterAdmission.filter((id) => {
             const task = input.tasksById.get(id);
             return isPauseOnHumanDecisionGate(task);
         });
-        const regularRunnable = actuallyRunnable.filter((id) => !pauseGateRunnable.includes(id));
-        const rankWriterNodeIds = actuallyRunnable.filter((id) => {
+        const regularRunnable = runnableAfterAdmission.filter((id) => !pauseGateRunnable.includes(id));
+        const rankWriterNodeIds = runnableAfterAdmission.filter((id) => {
             const task = input.tasksById.get(id);
             return (task?.executor === "pi" &&
                 task.toolProfile === "write" &&