@tea-agent/loop-agent 0.38.0 → 0.39.0-next.2

package/CHANGELOG.md

@@ -4,6 +4,46 @@
 
 ### 新增
 
+- `frontend-prewrite-gate` 的 OpenSpec 读取校验支持 `task.json.frontendOpenspec` 配置：`policy` 缺省 `cited`（候选 = `requiredReadPaths` ∪ 任务源显式引用的 openspec 路径），`scan-strict` 保留止血任务后的全量必读语义；`requiredReadPaths` 中非 openspec 支持路径在生成期确定性失败
+- 确定性引用块协议：生效 plan 输出在 fenced `json` 契约块后追加 `openspec-citations` fenced 块（每行一个 JSON `{"path","section","line"}`）；gate 解析并与生效 plan/review 节点的成功 read 事件核验，新增 `openspec-citation-block-unparseable` / `openspec-not-cited` / `openspec-citation-not-read` 三个 retryable-invalid failureCode（防捏造、防遗漏）
+- `src/shared/openspec-spec.ts` 新增 `extractTaskSourceOpenspecPaths` 纯函数（反引号内联、markdown 链接目标、裸路径 token → 归一化 → spec 过滤 → 治理子树排除 → 去重排序）
+- 生成期把 `openspecPolicy` 与候选来源元数据（`openspecCandidateSources.declared` / `taskSourceCited` / `scanStrict`）冻结进 prewrite gate 配置；`task advance` 的 advisories 说明当前模式与候选来源
+
+### 文档
+
+- 新增 `docs/decisions/0014-openspec-gate-claim-verification.md`，并同步 `docs/runtime/frontend-implementation-workflow.md`、`docs/templates/frontend-task-constraints.md`、`docs/templates/frontend-design-contract.md`、`skills/frontend-implementation/references/node-contracts.md`
+
+## [0.36.4-beta.0] - 2026-08-16
+
+> 前端 DAG 规范上下文确定性落地（beta，发布到 `beta` dist-tag）。
+
+### 新增
+
+- `discoverFrontendProjectCapability` 产出 `designEvidence.classified` 语义归类：按通用目录约定（`openspec/schemas/**`、`openspec/project-specs/templates/**`、`openspec/project-specs/rules/**`、`openspec/project-specs/ui/**`、`ai_workspace/**`）把规范路径分入稳定键 `schemas` / `codeTemplate` / `rule.*` / `theme` / `component` / `uiOther` / `advisoryOther`，并进入 zod schema 校验（分区恒等式：归类值集合 == `normativePaths` 集合），重复探测稳定，不硬编码具体项目文件名
+- 前端 contract/scout/plan/design-review 节点的 `subtask_prompt` 注入归类后的规范路径（含角色语义）并明确要求报告适用规则、命中路径/章节/行号、冲突与缺失
+
+### 修复
+
+- `frontend-prewrite-gate` 在 `openspecCandidatePaths` 非空时强制生效 plan/review 节点实际读取候选路径：未读 → `retryable-invalid` + 新增 `openspec-not-read` failureCode，错误信息列出未读路径；空候选（greenfield）不阻断。此前读取证据仅记录不阻断（advisory），本次真正 fail-closed
+- OpenSpec 候选发现止血：默认排除治理子树（`harness.json.governanceRoot` → 缺省 `ai_workspace/loop-agent`），移除固定 `slice(0, 40)` 截断，`openspec/**` 排序优先于 `ai_workspace/**`，仅保留 ≥200 的显式安全上限（命中时写入 `DagSpec.advisories`，非静默丢弃）；`openspec-not-read` 失败原因增加实际读取路径/候选总数/排除统计与「重新生成 DAG」归因，生成后已删除/改名的候选改为 `candidate-missing-drift` 诊断而非误报「未读」
+
+### 文档
+
+- `docs/templates/frontend-task-constraints.md` 把裸 `TODO` 改写为「探索协议 + 结果 schema + 缺失/冲突 fail-closed」，不再出现具体业务组件名或项目专属路径/命令
+- `docs/templates/frontend-task-requirement.md` 与 `docs/templates/frontend-design-contract.md` 把裸 `TODO` 改写为「编写协议」三要素（要写什么 / DAG 如何消费 / 缺失/冲突时 fail-closed），并新增 `test/frontend-template-no-todo.test.ts` 扫描三个前端模板断言无裸 `TODO`
+- `docs/runtime/frontend-implementation-workflow.md` 的项目规范归类清单改为通用目录约定 + 归类规则，删除写死的示例项目文件名
+
+## [0.36.3-beta.0] - 2026-08-16
+
+> 前端 DAG Mock 治理收紧（beta，发布到 `beta` dist-tag）。
+
+### 改进
+
+- 前端 DAG 的 Mock 策略约束注入设计评审链：`mockContextBlock`（含冻结 allowlist 的「HARD CONSTRAINT」与修复路径）现在也注入 `frontend-design-review-pi` / `frontend-plan-revision-pi` / `frontend-final-design-review-pi`，消除「design-review 按项目规范要求 native、但生成期 allowlist 冻结为 not-needed、prewrite 硬阻断」的策略断环——评审链会明确提示这是生成期契约缺口（需声明 `frontendMock.verifyCommands` 或 `policy: "required"` 后重新生成 DAG）
+- 前端任务生成期 Mock 预警：新增 `DagSpec.advisories`，任务源提到接口/API/Mock 但 auto 模式把策略收窄为 `not-needed` 时，`task advance` 的 `warnings` 会给出可操作提示（声明 `frontendMock.verifyCommands` 或 `policy: required` 后重新生成 DAG），把契约缺口提前到生成期暴露
+
+### 新增
+
 - 版本发布改为三渠道：main 自动发布 npm `next`（`x.y.0-next.N`）、release 分支自动发布正式 patch 到 `release-x.y`、`latest` 仅由人工 GitHub Actions promotion 移动（支持 dry-run 与 CAS 校验）
 - 新增 `next-release.yml` / `cut-release-line.yml` / `release-line-publish.yml` / `promote-npm-latest.yml`，删除旧每日自动 latest 发布入口
 - 发布策略改为 branch + version + channel 矩阵（`scripts/release-channel-policy.mjs`），fail closed
@@ -49,6 +89,27 @@
 - move interrupt eligibility to observability to honor kernel import boundary
 - retry semantic intake across Pi tiers with 300s timeout
 
+## [0.36.1-beta.0] - 2026-08-16
+
+> 标准 DAG planner 输出超长紧凑重试（beta，发布到 `beta` dist-tag）。
+
+### 改进
+
+- 标准 DAG 的 planner 节点（`contract-pi` / `plan-pi`）输出超长（`output-too-large`）时自动紧凑重试：新增 `PLANNER_OUTPUT_LIMIT_RETRY_POLICY`（默认重试集合 + `output-too-large`），紧凑重试指令按节点类型区分——结构化契约节点只返回单个紧凑 JSON，普通计划节点返回最小计划（有序步骤、writeSet 边界、验证命令），并丢弃上游原文引用与长证据摘录
+
+## [0.35.4-beta.0] - 2026-08-15
+
+> frontend prewrite 阻断误路由修正 + Mock 契约文档落地（beta，发布到 `beta` dist-tag）。
+
+### 改进
+
+- prewrite 阻断导致的 writer `SKIPPED`（`skippedReason=frontend-prewrite-not-authorized`）失败路由从 `DependencyFailure`/`unblock dependency` 修正为 `ContractMismatch`/`fix-frontend-task-contract-and-regenerate-dag`；`dag report` / `dag doctor` 透传 `skippedReason`，对「Mock 策略契约缺陷需改 task.json + 重新生成 DAG」这类场景给出可操作建议，而非误导性的「解除依赖」
+
+### 文档
+
+- `docs/templates/frontend-task-constraints.md` 的 Mock 约束从 TODO 改为可落地契约：要求从项目**探索**实际存在的确定性 Mock 验证命令（不硬编码命令名）并声明到 `task.json.frontendMock.verifyCommands`，说明生成期 `allowedMockStrategies` 来源、`mock-strategy-outside-allowed` 是生成期契约问题（修复 = 补契约 + 重新生成 DAG，plan-revision 无法修复）
+- `docs/runtime/frontend-implementation-workflow.md` 的 task.json 输入标准补充 Mock 契约声明、命令探索与失败恢复指引
+
 ## [0.36.0] - 2026-08-15
 
 ### 新增

package/dist/build-stamp.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "version": "0.38.0",
-  "gitSha": "cc01c2ec09b56080f4c32416bddcc911feaa0e7a",
-  "builtAt": "2026-08-17T01:42:05.218Z"
+  "version": "0.37.0",
+  "gitSha": "4e502c40653f25c38302f1104e367d49bc950791",
+  "builtAt": "2026-08-17T08:09:21.899Z"
 }

package/dist/infrastructure/harness/atomic-write.js

@@ -1,13 +1,14 @@
 import { copyFile, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { assertHarnessWriteAllowed, } from "./completed-facts-guard.js";
+let atomicWriteSequence = 0;
 async function writeAtomic(targetPath, content, options) {
     assertHarnessWriteAllowed(targetPath, options);
     const resolved = options?.repoRoot && !path.isAbsolute(targetPath)
         ? path.resolve(options.repoRoot, targetPath)
         : path.resolve(targetPath);
     await mkdir(path.dirname(resolved), { recursive: true });
-    const tempPath = `${resolved}.${process.pid}.tmp`;
+    const tempPath = `${resolved}.${process.pid}.${(atomicWriteSequence += 1)}.tmp`;
     try {
         await writeFile(tempPath, content, "utf-8");
         try {

package/dist/shared/openspec-spec.js

@@ -14,6 +14,30 @@ export const OPENSPEC_SPEC_DIRS = [
 ];
 /** Allowed spec file extensions (case-insensitive). */
 export const OPENSPEC_SPEC_EXT_RE = /\.(md|mdx|json|yaml|yml)$/i;
+/**
+ * Default governance subtree excluded from candidate discovery. Aligned with
+ * init.ts's DEFAULT_GOVERNANCE_ROOT; discovery derives the real root from
+ * harness.json.governanceRoot and falls back to this value.
+ */
+export const DEFAULT_OPENSPEC_GOVERNANCE_ROOT = "ai_workspace/loop-agent";
+/**
+ * Explicit safety ceiling for auto-discovered openspec candidates (>=200).
+ * Reaching the cap is reported via DagSpec.advisories, never silently dropped.
+ */
+export const MAX_OPENSPEC_CANDIDATE_PATHS = 200;
+/**
+ * Returns `true` when `filePath` is the governance subtree itself or any path
+ * under it. `filePath` must be a repo-relative POSIX path (backslashes are
+ * normalised internally). Comparison is case-sensitive, matching the other
+ * predicates in this module.
+ */
+export function isGovernanceSubtreePath(filePath, governanceRoot) {
+    const normalized = filePath.replaceAll("\\", "/");
+    const root = governanceRoot.replaceAll("\\", "/").replace(/\/+$/, "");
+    if (!root)
+        return false;
+    return normalized === root || normalized.startsWith(root + "/");
+}
 /**
  * Returns `true` when `filePath` is inside one of the canonical frontend spec
  * directories.  `filePath` must be a repo-relative POSIX path (backslashes are
@@ -47,3 +71,55 @@ export function isOpenspecSpecSearchTarget(value) {
     const normalized = value.replaceAll("\\", "/");
     return /(?:^|[^A-Za-z0-9_.-])(?:openspec\/(?:schemas|project-specs)|ai_workspace)(?:\/|$)/.test(normalized);
 }
+/** Normalizes a free-form path token to a repo-relative POSIX path or null. */
+function normalizeCitationToken(raw) {
+    let token = raw.trim();
+    token = token.replace(/^[<"'`(\[\s]+|[>"'`)\]\s]+$/g, "");
+    // Strip trailing punctuation that is not part of a filename.
+    token = token.replace(/[),.;:!?]+$/g, "");
+    const hashIndex = token.indexOf("#");
+    if (hashIndex >= 0)
+        token = token.slice(0, hashIndex);
+    token = token.replace(/\\/g, "/");
+    if (!token)
+        return null;
+    return token;
+}
+/**
+ * Deterministically extracts repo-relative openspec spec paths explicitly cited
+ * in task-source markdown (requirement + execution constraint). Pure function,
+ * no IO.
+ *
+ * Scanned sources, in order:
+ * - backtick inline code spans (`path`)
+ * - markdown link targets ([text](path))
+ * - bare path tokens under openspec/ or ai_workspace/
+ *
+ * Every token is normalized to POSIX, stripped of a trailing `#fragment`,
+ * filtered through `isOpenspecSpecFilePath`, and excluded when it falls inside
+ * the governance subtree (matching `listOpenspecDiscovery`'s exclusion口径).
+ * Results are deduped and sorted.
+ */
+export function extractTaskSourceOpenspecPaths(markdown, governanceRoot = DEFAULT_OPENSPEC_GOVERNANCE_ROOT) {
+    if (!markdown)
+        return [];
+    const raw = new Set();
+    const collect = (token) => {
+        const normalized = normalizeCitationToken(token);
+        if (normalized)
+            raw.add(normalized);
+    };
+    for (const match of markdown.matchAll(/`([^`\n]+)`/g)) {
+        collect(match[1] ?? "");
+    }
+    for (const match of markdown.matchAll(/\[[^\]]*\]\(([^)\s]+)\)/g)) {
+        collect(match[1] ?? "");
+    }
+    for (const match of markdown.matchAll(/(?:^|[\s"'([>])((?:openspec|ai_workspace)\/[A-Za-z0-9._/-]+)/g)) {
+        collect(match[1] ?? "");
+    }
+    return [...raw]
+        .filter((token) => isOpenspecSpecFilePath(token) &&
+        !isGovernanceSubtreePath(token, governanceRoot))
+        .sort();
+}

package/dist/task/config-types.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { isOpenspecSpecFilePath } from "../shared/openspec-spec.js";
 export const taskFlowSchema = z.enum([
     "auto",
     "micro",
@@ -65,6 +66,24 @@ export const frontendMockConfigSchema = z.object({
     serviceRoot: z.string().min(1).optional(),
     verifyCommands: z.array(frontendMockVerifyCommandSchema).optional().default([]),
 });
+/** OpenSpec gate policy for frontend prewrite: cited (default) vs scan-strict. */
+export const frontendOpenspecPolicySchema = z.enum(["cited", "scan-strict"]);
+/**
+ * Frontend OpenSpec gate configuration. `cited` (the task-config default) makes
+ * the prewrite gate verify contract-declared requiredReadPaths plus task-source
+ * citations instead of the full generation-time directory snapshot; `scan-strict`
+ * keeps the auto-discovered full-read semantics.
+ */
+export const frontendOpenspecConfigSchema = z.object({
+    policy: frontendOpenspecPolicySchema.optional().default("cited"),
+    requiredReadPaths: z
+        .array(z
+        .string()
+        .refine((candidate) => !candidate.includes("\\") &&
+        isOpenspecSpecFilePath(candidate), "frontendOpenspec.requiredReadPaths entries must be repo-relative supported files under openspec/schemas/, openspec/project-specs/, or ai_workspace/"))
+        .optional()
+        .default([]),
+});
 /** Batch limits and gate profile for the browser-driven frontend test DAG.
  * Token fields are post-case stop thresholds, not model-provider hard caps. */
 export const frontendTestConfigSchema = z.object({
@@ -175,6 +194,8 @@ const taskConfigObjectSchema = z.object({
     frontendMock: frontendMockConfigSchema.optional(),
     /** Frontend browser-test batch and post-case token-stop configuration. */
     frontendTest: frontendTestConfigSchema.optional(),
+    /** Frontend OpenSpec gate policy and contract-declared required read paths. */
+    frontendOpenspec: frontendOpenspecConfigSchema.optional(),
     notes: z.string().optional().default(""),
 });
 export const taskConfigSchema = z.preprocess((raw) => {

package/dist/task/frontend-project-capability.js

@@ -5,7 +5,73 @@
  */
 import { readFile, readdir, stat } from "node:fs/promises";
 import path from "node:path";
-import { OPENSPEC_SPEC_DIRS, OPENSPEC_SPEC_EXT_RE } from "../shared/openspec-spec.js";
+import { z } from "zod";
+import { DEFAULT_OPENSPEC_GOVERNANCE_ROOT, MAX_OPENSPEC_CANDIDATE_PATHS, OPENSPEC_SPEC_DIRS, OPENSPEC_SPEC_EXT_RE, isGovernanceSubtreePath, isOpenspecSpecFilePath, } from "../shared/openspec-spec.js";
+const classifiedPathSchema = z
+    .string()
+    .refine((candidate) => isOpenspecSpecFilePath(candidate), "classified path must be a repo-relative supported spec file under openspec/schemas/, openspec/project-specs/, or ai_workspace/");
+/**
+ * Stable semantic partition of `designEvidence.normativePaths`. Keys are a
+ * generic directory convention (not project-specific file names); the same
+ * repository therefore yields the same classification on repeated probes.
+ */
+export const frontendDesignClassifiedSchema = z
+    .object({
+    schemas: z.array(classifiedPathSchema),
+    codeTemplate: z.array(classifiedPathSchema),
+    rule: z
+        .object({
+        api: z.array(classifiedPathSchema),
+        mock: z.array(classifiedPathSchema),
+        router: z.array(classifiedPathSchema),
+        hooks: z.array(classifiedPathSchema),
+        utils: z.array(classifiedPathSchema),
+        components: z.array(classifiedPathSchema),
+        other: z.array(classifiedPathSchema),
+    })
+        .strict(),
+    theme: z.array(classifiedPathSchema),
+    component: z.array(classifiedPathSchema),
+    uiOther: z.array(classifiedPathSchema),
+    advisoryOther: z.array(classifiedPathSchema),
+})
+    .strict();
+export const frontendDesignEvidenceSchema = z
+    .object({
+    normativePaths: z.array(z.string()),
+    advisoryPaths: z.array(z.string()),
+    conflicts: z.array(z.string()),
+    classified: frontendDesignClassifiedSchema,
+})
+    .strict()
+    .superRefine((evidence, ctx) => {
+    const classified = [
+        ...evidence.classified.schemas,
+        ...evidence.classified.codeTemplate,
+        ...evidence.classified.rule.api,
+        ...evidence.classified.rule.mock,
+        ...evidence.classified.rule.router,
+        ...evidence.classified.rule.hooks,
+        ...evidence.classified.rule.utils,
+        ...evidence.classified.rule.components,
+        ...evidence.classified.rule.other,
+        ...evidence.classified.theme,
+        ...evidence.classified.component,
+        ...evidence.classified.uiOther,
+        ...evidence.classified.advisoryOther,
+    ];
+    const classifiedSet = new Set(classified);
+    const normativeSet = new Set(evidence.normativePaths);
+    const onlyClassified = [...classifiedSet].filter((candidate) => !normativeSet.has(candidate));
+    const onlyNormative = [...normativeSet].filter((candidate) => !classifiedSet.has(candidate));
+    if (onlyClassified.length > 0 || onlyNormative.length > 0) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `classified must partition normativePaths exactly; extra in classified: ${onlyClassified.join(", ") || "(none)"}; missing from classified: ${onlyNormative.join(", ") || "(none)"}`,
+            path: ["classified"],
+        });
+    }
+});
 async function exists(filePath) {
     try {
         await stat(filePath);
@@ -15,39 +81,68 @@ async function exists(filePath) {
         return false;
     }
 }
-async function readJson(filePath) {
-    try {
-        return JSON.parse(await readFile(filePath, "utf8"));
-    }
-    catch {
-        return null;
+/**
+ * Resolve the governance subtree root from harness.json.governanceRoot.
+ * Falls back to DEFAULT_OPENSPEC_GOVERNANCE_ROOT when the manifest is missing,
+ * unreadable, malformed, or lacks a string governanceRoot. This intentionally
+ * does NOT apply init.ts's "docs" -> default migration (init-only behavior).
+ */
+export async function resolveOpenspecGovernanceRoot(repoRoot) {
+    const manifest = await readJson(path.join(repoRoot, "harness.json"));
+    if (manifest && typeof manifest === "object") {
+        const candidate = manifest.governanceRoot;
+        if (typeof candidate === "string" && candidate.trim()) {
+            return candidate.trim().replace(/\\/g, "/").replace(/\/+$/, "");
+        }
     }
+    return DEFAULT_OPENSPEC_GOVERNANCE_ROOT;
 }
-function allDeps(pkg) {
-    return {
-        ...(pkg.dependencies ?? {}),
-        ...(pkg.devDependencies ?? {}),
-        ...(pkg.peerDependencies ?? {}),
+export async function listOpenspecDiscovery(repoRoot, options = {}) {
+    const governanceRoot = options.governanceRootOverride ??
+        (await resolveOpenspecGovernanceRoot(repoRoot));
+    const extraExcludedPrefixes = (options.extraExcludedPrefixes ?? [])
+        .map((prefix) => prefix.replace(/\\/g, "/").replace(/\/+$/, ""))
+        .filter(Boolean);
+    const collected = [];
+    let excludedGovernanceCount = 0;
+    const isExcluded = (rel) => {
+        if (isGovernanceSubtreePath(rel, governanceRoot))
+            return true;
+        return extraExcludedPrefixes.some((prefix) => rel === prefix || rel.startsWith(prefix + "/"));
     };
-}
-function hasDep(deps, name) {
-    return Object.hasOwn(deps, name);
-}
-async function listOpenspec(repoRoot) {
-    const out = [];
     for (const specDir of OPENSPEC_SPEC_DIRS) {
         const root = path.join(repoRoot, specDir);
         if (!(await exists(root)))
             continue;
         await walk(root, 0);
     }
-    return out.slice(0, 40);
+    // openspec/schemas/** and openspec/project-specs/** sort first; remaining
+    // ai_workspace/** business files follow. Dedupe preserves discovery order.
+    const unique = [...new Set(collected)];
+    const openspecPaths = unique
+        .filter((candidate) => candidate.startsWith("openspec/"))
+        .sort();
+    const aiWorkspacePaths = unique
+        .filter((candidate) => candidate.startsWith("ai_workspace/"))
+        .sort();
+    const deduped = [...openspecPaths, ...aiWorkspacePaths];
+    const truncated = deduped.length > MAX_OPENSPEC_CANDIDATE_PATHS;
+    const paths = truncated
+        ? deduped.slice(0, MAX_OPENSPEC_CANDIDATE_PATHS)
+        : deduped;
+    return {
+        paths,
+        governanceRoot,
+        excludedGovernanceCount,
+        truncated,
+        maxCandidates: MAX_OPENSPEC_CANDIDATE_PATHS,
+    };
     async function walk(dir, depth) {
         if (depth > 4)
             return;
         let entries = [];
         try {
-            entries = await readdir(dir);
+            entries = (await readdir(dir)).sort();
         }
         catch {
             return;
@@ -59,7 +154,13 @@ async function listOpenspec(repoRoot) {
                 if (info.isDirectory())
                     await walk(full, depth + 1);
                 else if (OPENSPEC_SPEC_EXT_RE.test(name)) {
-                    out.push(path.relative(repoRoot, full).replace(/\\/g, "/"));
+                    const rel = path.relative(repoRoot, full).replace(/\\/g, "/");
+                    if (isExcluded(rel)) {
+                        excludedGovernanceCount++;
+                    }
+                    else {
+                        collected.push(rel);
+                    }
                 }
             }
             catch {
@@ -68,6 +169,164 @@ async function listOpenspec(repoRoot) {
         }
     }
 }
+/**
+ * Count spec-extension files under a governance subtree that candidate
+ * discovery would exclude. Bounded, read-only diagnostic helper used by the
+ * prewrite gate to reproduce exclusion stats at runtime.
+ */
+export async function countExcludedGovernanceSpecFiles(repoRoot, governanceRoot) {
+    const root = path.join(repoRoot, governanceRoot);
+    if (!(await exists(root)))
+        return 0;
+    let count = 0;
+    await walkGovernance(root, 0);
+    return count;
+    async function walkGovernance(dir, depth) {
+        if (depth > 4)
+            return;
+        let entries = [];
+        try {
+            entries = (await readdir(dir)).sort();
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            const full = path.join(dir, name);
+            try {
+                const info = await stat(full);
+                if (info.isDirectory())
+                    await walkGovernance(full, depth + 1);
+                else if (OPENSPEC_SPEC_EXT_RE.test(name))
+                    count++;
+            }
+            catch {
+                // skip
+            }
+        }
+    }
+}
+async function readJson(filePath) {
+    try {
+        return JSON.parse(await readFile(filePath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function allDeps(pkg) {
+    return {
+        ...(pkg.dependencies ?? {}),
+        ...(pkg.devDependencies ?? {}),
+        ...(pkg.peerDependencies ?? {}),
+    };
+}
+function hasDep(deps, name) {
+    return Object.hasOwn(deps, name);
+}
+function emptyClassified() {
+    return {
+        schemas: [],
+        codeTemplate: [],
+        rule: { api: [], mock: [], router: [], hooks: [], utils: [], components: [], other: [] },
+        theme: [],
+        component: [],
+        uiOther: [],
+        advisoryOther: [],
+    };
+}
+/**
+ * Classify discovered openspec paths by generic directory convention. Only
+ * `isOpenspecSpecFilePath` paths enter a bucket; the classifier never invents
+ * project-specific file names. Basename stems use word-boundary matching so
+ * e.g. `*api*` (case-insensitive) maps to `rule.api` without hardcoding names.
+ */
+function classifyOpenspecPaths(paths) {
+    const classified = emptyClassified();
+    const ruleStem = (basename) => {
+        const lower = basename.toLowerCase();
+        const stems = [
+            ["api", /\bapi\b/],
+            ["mock", /\bmock\b/],
+            ["router", /\brouter\b/],
+            ["hooks", /\bhooks?\b/],
+            ["utils", /\butils?\b/],
+            ["components", /\bcomponents?\b/],
+        ];
+        for (const [key, re] of stems) {
+            if (re.test(lower))
+                return key;
+        }
+        return "other";
+    };
+    for (const candidate of paths) {
+        if (!isOpenspecSpecFilePath(candidate))
+            continue;
+        const segments = candidate.split("/");
+        const basename = segments[segments.length - 1] ?? "";
+        if (candidate.startsWith("openspec/schemas/")) {
+            classified.schemas.push(candidate);
+        }
+        else if (candidate.startsWith("openspec/project-specs/templates/")) {
+            classified.codeTemplate.push(candidate);
+        }
+        else if (candidate.startsWith("openspec/project-specs/rules/")) {
+            classified.rule[ruleStem(basename)].push(candidate);
+        }
+        else if (candidate.startsWith("openspec/project-specs/ui/")) {
+            const lower = basename.toLowerCase();
+            if (/\btheme\b/.test(lower))
+                classified.theme.push(candidate);
+            else if (/\bcomponents?\b/.test(lower))
+                classified.component.push(candidate);
+            else
+                classified.uiOther.push(candidate);
+        }
+        else {
+            classified.advisoryOther.push(candidate);
+        }
+    }
+    const sortBucket = (bucket) => bucket.sort();
+    classified.schemas = sortBucket(classified.schemas);
+    classified.codeTemplate = sortBucket(classified.codeTemplate);
+    for (const key of [
+        "api",
+        "mock",
+        "router",
+        "hooks",
+        "utils",
+        "components",
+        "other",
+    ]) {
+        classified.rule[key] = sortBucket(classified.rule[key]);
+    }
+    classified.theme = sortBucket(classified.theme);
+    classified.component = sortBucket(classified.component);
+    classified.uiOther = sortBucket(classified.uiOther);
+    classified.advisoryOther = sortBucket(classified.advisoryOther);
+    return classified;
+}
+function buildDesignEvidence(openspec) {
+    // Preserve discovery priority order (openspec first, then ai_workspace)
+    // instead of re-sorting; the exact-partition schema identity is set-based.
+    const normativePaths = [...new Set(openspec)];
+    return frontendDesignEvidenceSchema.parse({
+        normativePaths,
+        advisoryPaths: [],
+        conflicts: [],
+        classified: classifyOpenspecPaths(normativePaths),
+    });
+}
+function toOpenspecDiscovery(discovery, designEvidence) {
+    return {
+        source: "auto-discovered",
+        governanceRoot: discovery.governanceRoot,
+        candidateCount: designEvidence.normativePaths.length,
+        excludedGovernanceCount: discovery.excludedGovernanceCount,
+        truncated: discovery.truncated,
+        maxCandidates: discovery.maxCandidates,
+    };
+}
 export function buildAdapterGuidance(capability) {
     const lines = [
         "## Frontend project capability (generation-time)",
@@ -108,7 +367,8 @@ export async function discoverFrontendProjectCapability(repoRoot) {
     const pkgPath = path.join(repoRoot, "package.json");
     const pkgRaw = await readJson(pkgPath);
     if (!pkgRaw || typeof pkgRaw !== "object") {
-        const openspec = await listOpenspec(repoRoot);
+        const discovery = await listOpenspecDiscovery(repoRoot);
+        const designEvidence = buildDesignEvidence(discovery.paths);
         const base = {
             schemaVersion: 1,
             framework: "unknown",
@@ -119,16 +379,13 @@ export async function discoverFrontendProjectCapability(repoRoot) {
             testRunner: [],
             mock: [],
             a11y: { status: "unknown", tools: [], evidencePaths: [] },
-            evidencePaths: openspec.slice(0, 5),
+            evidencePaths: discovery.paths.slice(0, 5),
             reasons: ["package.json missing or unreadable"],
-            designEvidence: {
-                normativePaths: openspec,
-                advisoryPaths: [],
-                conflicts: [],
-            },
+            designEvidence,
+            openspecDiscovery: toOpenspecDiscovery(discovery, designEvidence),
         };
-        if (openspec.length) {
-            base.reasons.push(`openspec spec files discovered: ${openspec.slice(0, 5).join(", ")}`);
+        if (discovery.paths.length) {
+            base.reasons.push(`openspec spec files discovered: ${discovery.paths.slice(0, 5).join(", ")}`);
         }
         return { ...base, adapterGuidance: buildAdapterGuidance(base) };
     }
@@ -283,14 +540,10 @@ export async function discoverFrontendProjectCapability(repoRoot) {
         router = router ?? "next-router";
     if (hasDep(deps, "vue-router"))
         router = "vue-router";
-    const openspec = await listOpenspec(repoRoot);
-    const designEvidence = {
-        normativePaths: openspec,
-        advisoryPaths: [],
-        conflicts: [],
-    };
-    if (openspec.length)
-        evidencePaths.push(...openspec.slice(0, 5));
+    const discovery = await listOpenspecDiscovery(repoRoot);
+    const designEvidence = buildDesignEvidence(discovery.paths);
+    if (discovery.paths.length)
+        evidencePaths.push(...discovery.paths.slice(0, 5));
     const base = {
         schemaVersion: 1,
         framework,
@@ -311,6 +564,7 @@ export async function discoverFrontendProjectCapability(repoRoot) {
         evidencePaths: [...new Set(evidencePaths)],
         reasons,
         designEvidence,
+        openspecDiscovery: toOpenspecDiscovery(discovery, designEvidence),
     };
     return { ...base, adapterGuidance: buildAdapterGuidance(base) };
 }

package/dist/workflows/dag/failure-routing.js

@@ -44,7 +44,9 @@ function routeToProductLine(input) {
         case "decision-envelope":
             return "NeedsHuman";
         case "skipped":
-            return "DependencyFailure";
+            return input.skippedReason === "frontend-prewrite-not-authorized"
+                ? "ContractMismatch"
+                : "DependencyFailure";
         case "shell-command":
             if (/\b(ENOENT|PATH|command not found|No such file|not found in PATH|bash: .*: No such file)\b/i.test(raw)) {
                 return "EnvFailure";
@@ -90,9 +92,12 @@ export function routeDagFailure(input) {
     if (!productLineFailureCategory)
         return {};
     const recommendedFollowUp = productLineFailureCategory === "ContractMismatch" &&
-        isFrontendDesignGateNode(input.nodeId ?? "")
-        ? "frontend-plan-revision-and-rerun"
-        : FOLLOW_UP_BY_PRODUCT_LINE[productLineFailureCategory];
+        input.skippedReason === "frontend-prewrite-not-authorized"
+        ? "fix-frontend-task-contract-and-regenerate-dag"
+        : productLineFailureCategory === "ContractMismatch" &&
+            isFrontendDesignGateNode(input.nodeId ?? "")
+            ? "frontend-plan-revision-and-rerun"
+            : FOLLOW_UP_BY_PRODUCT_LINE[productLineFailureCategory];
     return {
         productLineFailureCategory,
         recommendedFollowUp,