@tea-agent/loop-agent 0.39.0-beta.6 → 0.39.0-beta.8

package/dist/workflows/dag/init-hybrid.js

@@ -2257,6 +2257,83 @@ function frontendMockStrategyMustBeNotNeeded(sources) {
             capabilityStatus === "ambiguous" ||
             !hasDeterministicMockVerification));
 }
+/**
+ * 候选规范懒加载：prompt 只内联与任务相关的候选，不全部塞给模型。
+ *
+ * - mandatory（任务源显式声明/引用）始终保留——模型必须知道它们存在。
+ * - scan-strict 候选按「路径段是否命中任务源关键词」过滤：列表页任务只
+ *   带出列表相关组件/页面规范，创建页规范不进 prompt。
+ * - runtime 的选型/read 门禁仍消费完整 openspecCandidatePaths（prewrite
+ *   gate 用全量）；这里只缩小 prompt 体积，不改变门禁语义。未提及的候选
+ *   由 runtime 默认 irrelevant，模型无需枚举。
+ * - 真正读取发生在 plan 侧：模型对 required 选型调用 read 工具，prewrite
+ *   门禁验证 read 事件——按需读取，不预加载正文。
+ */
+export function filterRelevantOpenspecCandidates(input) {
+    const mandatory = new Set(input.mandatoryPaths);
+    const relevant = [];
+    for (const candidate of input.candidates) {
+        if (mandatory.has(candidate)) {
+            relevant.push(candidate);
+            continue;
+        }
+        if (openspecCandidateMatchesSource(candidate, input.sourceMarkdown)) {
+            relevant.push(candidate);
+        }
+    }
+    // 保持候选发现顺序（确定性）；mandatory 与相关候选都按原始顺序出现。
+    return relevant;
+}
+/**
+ * 候选路径是否与任务源相关：从任务源提取文件名/路径 token（去扩展名、
+ * 去连字符/下划线），若候选的路径段包含任一 token 即视为相关。纯字符串
+ * 判定，无 IO；找不到 token 时保守保留（避免漏掉模型可能需要的规范）。
+ */
+function openspecCandidateMatchesSource(candidate, sourceMarkdown) {
+    const sourceTokens = extractOpenspecSourceTokens(sourceMarkdown);
+    if (sourceTokens.size === 0)
+        return true;
+    const candidateLower = candidate.toLowerCase().replace(/\\/g, "/");
+    const candidateSegments = candidateLower.split("/");
+    const candidateBasename = candidateSegments[candidateSegments.length - 1] ?? "";
+    for (const token of sourceTokens) {
+        if (candidateBasename.includes(token) ||
+            candidateLower.includes(`/${token}/`) ||
+            candidateLower.includes(`${token}.`)) {
+            return true;
+        }
+    }
+    return false;
+}
+/** 从任务源 markdown 提取显著 token：反引号代码段、路径、组件/页面名。 */
+function extractOpenspecSourceTokens(markdown) {
+    const tokens = new Set();
+    const push = (raw) => {
+        const cleaned = raw
+            .trim()
+            .replace(/[.*+?^${}()|[\]\\]/g, "")
+            .toLowerCase();
+        if (cleaned.length >= 2 && cleaned.length <= 40)
+            tokens.add(cleaned);
+    };
+    // 反引号内联代码（文件名/组件名）
+    for (const match of markdown.matchAll(/`([^`\n]+)`/g)) {
+        push(match[1] ?? "");
+    }
+    // markdown 链接文本
+    for (const match of markdown.matchAll(/\[([^\]]+)\]\([^)]+\)/g)) {
+        push(match[1] ?? "");
+    }
+    // 路径 token（openspec/ 或 xxx/xxx.md）
+    for (const match of markdown.matchAll(/(?:[A-Za-z0-9_-]+\/)+[A-Za-z0-9_.-]+/g)) {
+        const segments = (match[0] ?? "").split("/");
+        const basename = segments[segments.length - 1] ?? "";
+        push(basename.replace(/\.[a-z0-9]+$/i, ""));
+        for (const segment of segments)
+            push(segment);
+    }
+    return tokens;
+}
 async function resolveFrontendOpenspecGateConfig(sources) {
     const taskConfig = sources.taskConfig;
     const policy = taskConfig.frontendOpenspec?.policy ?? "cited";
@@ -2870,10 +2947,22 @@ async function buildFrontendHybridDagFromTask(sources) {
     const openspecGate = await resolveFrontendOpenspecGateConfig(sources);
     const requiresOpenspecClassification = openspecGate.openspecPolicy === "cited" &&
         openspecGate.openspecCandidatePaths.length > 0;
+    // Prompt 内联的候选只保留与任务相关的子集：mandatory（任务显式声明/
+    // 引用）始终保留；scan-strict 候选按路径段是否命中任务源关键词过滤。
+    // runtime 的选型/read 门禁仍消费完整 openspecCandidatePaths——这里只
+    // 减小 prompt 体积，不改变门禁语义；未提及的候选 runtime 默认 irrelevant。
+    const promptCandidates = filterRelevantOpenspecCandidates({
+        candidates: openspecGate.openspecCandidatePaths,
+        mandatoryPaths: openspecGate.openspecMandatoryPaths,
+        sourceMarkdown: [
+            sources.requirementMarkdown,
+            sources.constraintMarkdown ?? "",
+        ].join("\n"),
+    });
     const openspecSelectionContext = JSON.stringify({
         schemaVersion: 1,
         schemaId: "frontend-openspec-selection-v1",
-        candidates: openspecGate.openspecCandidatePaths,
+        candidates: promptCandidates,
         mandatoryPaths: openspecGate.openspecMandatoryPaths,
     });
     // Generation-frozen component/theme specification bucket (ADR 0016). Derived
@@ -3295,6 +3384,10 @@ async function buildFrontendHybridDagFromTask(sources) {
         ...(spec.advisories ?? []),
         `frontend-task-shape: ${frontendTaskShape.shape} (${frontendTaskShape.reason})`,
     ];
+    // Freeze the frontend recovery continuation quota from task.json so the
+    // runner can bound M6 auto-recovery without re-reading the task config.
+    const frontendMaxContinuations = sources.taskConfig.frontendRecovery?.maxContinuations ?? 1;
+    spec.frontendRecovery = { maxContinuations: frontendMaxContinuations };
     applyDefaultReadOnlyRetryPolicy(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);

package/dist/workflows/dag/node-execution.js

@@ -258,6 +258,12 @@ function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFailureCate
         // only to nodes whose authority is still a text contract artifact.
         if (task.structuredContractOutput.schemaId ===
             "frontend-implementation-contract-plan-patch-v1") {
+            const splitGuidance = /write-set-too-large|split the task/.test(previousProtocolReason ?? "")
+                ? [
+                    "",
+                    "The writeSet is too large for one implement node. Do NOT delete implementation files to squeeze under the limit — that drops required work. Split the task via record_split_proposal (or narrow targets.files to a genuine subset) so each implement node stays bounded; the full file set must remain covered across the split.",
+                ]
+                : [];
             return [
                 basePrompt,
                 "",
@@ -266,6 +272,7 @@ function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFailureCate
                 previousProtocolReason,
                 "Fix the reported violations by re-committing corrected record_* facts and calling finalize_plan exactly once. The committed typed ledger is the only compile authority.",
                 "Do not emit a fenced JSON contract, protected skeleton fields, or an openspec-citations block; narrative JSON is not validated and wastes the output budget.",
+                ...splitGuidance,
                 "</retry_instruction>",
             ].join("\n");
         }

package/dist/workflows/dag/report.js

@@ -125,6 +125,8 @@ const dagNodeArtifactsReportSchema = z
     humanEscalationMd: dagArtifactRefSchema,
     humanApproval: dagArtifactRefSchema,
     humanRejection: dagArtifactRefSchema,
+    changeManifest: dagArtifactRefSchema,
+    changeManifestChangedFiles: z.array(z.string()).optional(),
 })
     .strict();
 const dagNodeReportRowSchema = z
@@ -259,6 +261,20 @@ export async function probeArtifact(filePath) {
 export async function buildNodeArtifactsReport(runDir, nodeId) {
     const nodeDir = path.join(runDir, nodeId);
     const artifact = (name) => probeArtifact(path.join(nodeDir, name));
+    const changeManifestRef = await artifact("change-manifest.json");
+    let changeManifestChangedFiles;
+    if (changeManifestRef.exists) {
+        try {
+            const manifest = JSON.parse(await readFile(path.join(nodeDir, "change-manifest.json"), "utf-8"));
+            changeManifestChangedFiles = Array.isArray(manifest.changedFiles)
+                ? manifest.changedFiles
+                    .filter((item) => typeof item === "string")
+                : undefined;
+        }
+        catch {
+            // unreadable manifest → leave undefined
+        }
+    }
     return {
         resultSummary: await artifact("result.summary.md"),
         promptRedacted: await artifact("prompt.redacted.md"),
@@ -270,6 +286,8 @@ export async function buildNodeArtifactsReport(runDir, nodeId) {
         humanEscalationMd: await artifact("human-escalation.md"),
         humanApproval: await artifact("human-approval.json"),
         humanRejection: await artifact("human-rejection.json"),
+        changeManifest: changeManifestRef,
+        changeManifestChangedFiles,
     };
 }
 function taskById(spec) {
@@ -726,6 +744,12 @@ function formatArtifactFlags(artifacts) {
         flags.push("approval");
     if (artifacts.humanRejection.exists)
         flags.push("rejection");
+    if (artifacts.changeManifest.exists) {
+        const count = artifacts.changeManifestChangedFiles?.length;
+        flags.push(count !== undefined
+            ? `changed:${count}`
+            : "change-manifest");
+    }
     return flags.length > 0 ? flags.join(",") : "-";
 }
 function formatTimestamp(value) {
@@ -749,7 +773,19 @@ function summarizeNodeStatuses(nodes) {
     return `${total} total / ${finished} finished / ${failed} failed / ${skipped} skipped / ${pending} pending`;
 }
 function hasArtifact(artifacts) {
-    return Object.values(artifacts).some((artifact) => artifact.exists);
+    return [
+        artifacts.resultSummary,
+        artifacts.promptRedacted,
+        artifacts.skills,
+        artifacts.nodeRecord,
+        artifacts.decisionEnvelope,
+        artifacts.decisionEnvelopeValidation,
+        artifacts.humanEscalationJson,
+        artifacts.humanEscalationMd,
+        artifacts.humanApproval,
+        artifacts.humanRejection,
+        artifacts.changeManifest,
+    ].some((artifact) => artifact.exists);
 }
 function failureRows(run) {
     return run.nodes.filter((node) => node.status === "ERROR" ||

package/dist/workflows/dag/rerun-feedback.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { parseJsonReviewVerdict } from "./output-protocol.js";
+import { FRONTEND_DESIGN_REVIEW_NODE_ID, FRONTEND_REVIEW_NODE_ID, readCommittedDesignRequestFact, readCommittedReviewRequestFact, } from "./frontend-review-findings.js";
 export const MAX_RERUN_FEEDBACK_CHARS = 12_000;
 const RERUN_FEEDBACK_TRUNCATION_MARKER = "\n\n...[上一轮反馈已按长度上限截断]...\n\n";
 const MAX_EVIDENCE_REFS = 8;
@@ -35,6 +36,44 @@ function requestRevision(text) {
         return (emphasized?.[1] ?? trimmed).trim() === "VERDICT: request-revision";
     });
 }
+/**
+ * Deterministically render a typed `request_review_changes` fact into feedback
+ * text. Unlike the legacy text channel (VERDICT: request-revision), the
+ * frontend review terminal is a committed typed fact; the findings are the
+ * actionable body the next round must consume.
+ */
+export function formatTypedReviewRequestFeedback(fact) {
+    const lines = [];
+    lines.push(`frontend review committed request_review_changes (issueCategory=${typeof fact.issueCategory === "string" ? fact.issueCategory : "unknown"})`);
+    if (Array.isArray(fact.findings) && fact.findings.length > 0) {
+        lines.push("review findings:");
+        for (const finding of fact.findings) {
+            if (!finding || typeof finding !== "object")
+                continue;
+            const record = finding;
+            const severity = typeof record.severity === "string" ? record.severity : "";
+            const issue = typeof record.issue === "string" ? record.issue : "";
+            const location = [
+                typeof record.file === "string" ? record.file : "",
+                typeof record.line === "number" ? String(record.line) : "",
+            ]
+                .filter(Boolean)
+                .join(":");
+            const prefix = location ? `[${location}] ` : "";
+            const requiredChange = typeof record.requiredChange === "string" &&
+                record.requiredChange.length > 0
+                ? ` (requiredChange: ${record.requiredChange})`
+                : "";
+            lines.push(`- ${prefix}${severity}: ${issue}${requiredChange}`);
+        }
+    }
+    if (Array.isArray(fact.evidenceRefs) && fact.evidenceRefs.length > 0) {
+        lines.push(`evidenceRefs: ${fact.evidenceRefs
+            .filter((ref) => typeof ref === "string")
+            .join(", ")}`);
+    }
+    return lines.join("\n");
+}
 function pathInside(root, candidate) {
     const relative = path.relative(root, candidate);
     return (relative === "" ||
@@ -127,6 +166,41 @@ function evidenceRefs(repoRoot, runDir, pass, sourceNodeId) {
     }
     return result;
 }
+/**
+ * Read the committed frontend review request fact (typed terminal channel).
+ * Returns { nodeId, fact } when the review node committed `request_review_changes`.
+ */
+async function readTypedReviewRequestFact(runDir) {
+    const fact = await readCommittedReviewRequestFact({ runDir });
+    if (!fact)
+        return undefined;
+    return {
+        nodeId: FRONTEND_REVIEW_NODE_ID,
+        fact: {
+            issueCategory: fact.issueCategory,
+            evidenceRefs: fact.evidenceRefs,
+            findings: fact.findings,
+        },
+    };
+}
+/**
+ * Read the committed frontend design request fact (typed terminal channel).
+ * Returns { nodeId, fact } when the design review node committed
+ * `request_design_changes` — the design analog of request_review_changes.
+ */
+async function readTypedDesignRequestFact(runDir) {
+    const fact = await readCommittedDesignRequestFact({ runDir });
+    if (!fact)
+        return undefined;
+    return {
+        nodeId: FRONTEND_DESIGN_REVIEW_NODE_ID,
+        fact: {
+            issueCategory: fact.issueCategory,
+            evidenceRefs: fact.evidenceRefs,
+            findings: fact.findings,
+        },
+    };
+}
 /**
  * Derive only the latest unresolved verify/review feedback from canonical
  * parent-run facts. Provider-only failures intentionally return undefined.
@@ -144,8 +218,57 @@ export async function deriveDagRerunFeedback(input) {
             break;
         }
     }
-    if (!sourceNodeId || !sourceNode)
+    if (!sourceNodeId || !sourceNode) {
+        // Typed terminal channel: the frontend review/design review commit their
+        // verdicts as typed facts (request_review_changes / request_design_changes)
+        // instead of VERDICT text, and the frontend DAG has no convergence
+        // passHistory. Fall back to reading the typed event stores so findings
+        // still flow into the next round as unresolved feedback. Prefer review;
+        // if absent, fall through to the design review (a design rejection also
+        // carries actionable findings the next plan round must consume).
+        const typedFact = (await readTypedReviewRequestFact(input.runDir)) ??
+            (await readTypedDesignRequestFact(input.runDir));
+        if (typedFact) {
+            const parentSourceBindingHash = sourceBindingHash(input.spec);
+            return withDigest({
+                schemaVersion: 1,
+                kind: "unresolved-terminal-feedback",
+                parentRunId: input.parentRunId,
+                taskId: input.taskId,
+                sourceNodeId: typedFact.nodeId,
+                verdict: "request-revision",
+                failureCategory: typedFact.nodeId === FRONTEND_REVIEW_NODE_ID
+                    ? "review-request-changes"
+                    : "design-request-changes",
+                feedbackText: scrubAndBoundFeedbackText(formatTypedReviewRequestFeedback(typedFact.fact), input.runDir, input.state.cwd),
+                evidenceRefs: [
+                    {
+                        nodeId: typedFact.nodeId,
+                        preservedNodeRecordPath: `${typedFact.nodeId}.json`,
+                    },
+                ],
+                attemptSummary: {
+                    completedPasses: 1,
+                    maxPasses: 1,
+                    ...(input.state.terminalReason
+                        ? { terminalReason: input.state.terminalReason }
+                        : {}),
+                },
+                binding: {
+                    ...(parentSourceBindingHash
+                        ? { sourceCanonicalHash: parentSourceBindingHash }
+                        : {}),
+                    ...(input.spec.taskContractBinding?.canonicalHash
+                        ? {
+                            taskContractCanonicalHash: input.spec.taskContractBinding.canonicalHash,
+                        }
+                        : {}),
+                    status: "unknown",
+                },
+            });
+        }
         return undefined;
+    }
     const completedPasses = pass?.pass ?? Math.max(1, input.state.convergence?.currentPass ?? 1);
     const maxPasses = Math.max(completedPasses, input.state.convergence?.maxPasses ?? 1);
     const parentSourceBindingHash = sourceBindingHash(input.spec);

package/dist/workflows/dag/retry-policy.js

@@ -40,6 +40,14 @@ export const REVIEW_TERMINAL_MISSING_RETRY_CATEGORY = "review-terminal-missing";
  * reduced-reading instruction.
  */
 export const READ_BURST_RETRY_CATEGORY = "read-burst";
+/**
+ * Provider returned a context-overflow error (400 request-too-large / context
+ * window exceeded). The SDK compacts and auto-retries once internally; when it
+ * still surfaces, the executor classifies this so retry policies and reports
+ * treat it as overflow (not empty-output) and can retry with a compacted
+ * session / fresh context.
+ */
+export const CONTEXT_OVERFLOW_RETRY_CATEGORY = "context-overflow";
 /** Retry only a proven no-op from an explicitly opt-in bounded Pi writer. */
 export const WRITER_EMPTY_DIFF_RETRY_CATEGORY = "writer-empty-diff";
 /** Retry when a backend-test writer finished but Completeness Gate found missing/broken targets. */
@@ -74,6 +82,7 @@ export const ALL_DAG_RETRY_CATEGORIES = [
     WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY,
     REVIEW_TERMINAL_MISSING_RETRY_CATEGORY,
     READ_BURST_RETRY_CATEGORY,
+    CONTEXT_OVERFLOW_RETRY_CATEGORY,
 ];
 const RETRY_SAFE_PI_ROLES = new Set([
     "planner",
@@ -196,7 +205,10 @@ export const WRITER_TRANSPORT_RETRY_POLICY = {
     backoff: "exponential",
     initialDelayMs: 5000,
     maxDelayMs: 30000,
-    retryCategories: [WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY],
+    retryCategories: [
+        WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY,
+        CONTEXT_OVERFLOW_RETRY_CATEGORY,
+    ],
 };
 /**
  * Implicit runtime retry for canonical final verify shells. Not a DagRetryPolicy:
@@ -219,14 +231,20 @@ export const TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE = "standard-reviewed-superv
 /**
  * Target-template exclusive implement-pi transport retry. Same schema category
  * as frontend (`writer-clean-timeout`) so DagSpec validation stays unchanged;
- * only the delay cap is wider. Do not mutate {@link WRITER_TRANSPORT_RETRY_POLICY}.
+ * only the delay cap is wider. Context overflow is added so a writer whose
+ * session hit the context window (compact+retry inside the SDK) can retry once
+ * more at the DAG level with a fresh attempt. Do not mutate
+ * {@link WRITER_TRANSPORT_RETRY_POLICY}.
  */
 export const TARGET_TEMPLATE_WRITER_TRANSPORT_RETRY_POLICY = {
     maxAttempts: 2,
     backoff: "exponential",
     initialDelayMs: 5000,
     maxDelayMs: 60000,
-    retryCategories: [WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY],
+    retryCategories: [
+        WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY,
+        CONTEXT_OVERFLOW_RETRY_CATEGORY,
+    ],
 };
 /**
  * Backend-test generation writers: empty-diff once, plus bounded incomplete-write-set
@@ -518,14 +536,16 @@ function reasonMandatedFrontendPlanRetryStep(reason) {
     }
 }
 /**
- * Opt-in retry policy mounted on the frontend-plan-pi node. maxAttempts=5 is
- * the schema cap, matching the four-rung ladder plus one non-converging stop.
- * `invalid-output` (typed-fact schema violations, e.g. verification targets
- * referencing undeclared UI states) retries at the `normal` rung with the
- * contractCheck reason injected via `<retry_instruction>` (§5.1 ladder).
+ * Opt-in retry policy mounted on the frontend-plan-pi node. maxAttempts=3
+ * bounds plan retry cost: the four-rung ladder is only partially traversable
+ * before the run fails non-converging (rungs: normal → bounded-tool-only →
+ * compact-terminal-first → backup-model). `invalid-output` (typed-fact schema
+ * violations, e.g. verification targets referencing undeclared UI states)
+ * retries at the `normal` rung with the contractCheck reason injected via
+ * `<retry_instruction>` (§5.1 ladder).
  */
 export const FRONTEND_PLAN_LADDER_RETRY_POLICY = {
-    maxAttempts: 5,
+    maxAttempts: 3,
     backoff: "exponential",
     initialDelayMs: 2000,
     maxDelayMs: 30000,

package/dist/workflows/dag/runner.js

@@ -26,6 +26,7 @@ import { runConvergencePassController, } from "./convergence/controller.js";
 import { executeDagRanksOnce, FRONTEND_PREWRITE_RESULT_SOURCE_ARTIFACT, FRONTEND_WRITER_NODE_IDS, isConditionSkippedReason, readFrontendPrewriteResult, } from "./scheduler.js";
 import { topoSortToRanks } from "./topo.js";
 import { isFrontendWriterTransientPartialWrite } from "./frontend-writer-recovery.js";
+import { classifyReviewIssueCategoryFailureOwner, readCommittedDesignRequestFact, readCommittedReviewRequestFact, writeFrontendReviewFindingsPrd, } from "./frontend-review-findings.js";
 import { bindFrontendShapeStateToRunTopology, commitFrontendShapeTransitionCas, commitRuntimeFrontendShapeFact, isCanonicalFrontendShapeDag, } from "./frontend-shape-facts.js";
 import { assertFrontendTopologyBinding, buildFrontendTopologyBinding, computeFrontendShapeSourceDigest, } from "./frontend-shape.js";
 import { ensureFrontendShapeCapsuleRecord } from "./frontend-shape-capsule-store.js";
@@ -793,7 +794,7 @@ async function executeDagCheckpoint(input) {
             runDir = await moveToPausedRunDir(runDir, pausedRunDir);
         }
         else {
-            const { recoveryPending, recovery: recoveryTrigger } = await finalizeTerminalRunStatus(state, spec.tasks.length, runDir, cwd);
+            const { recoveryPending, recovery: recoveryTrigger } = await finalizeTerminalRunStatus(state, spec.tasks.length, runDir, cwd, spec.frontendRecovery?.maxContinuations ?? 1);
             await finalizeRunOwnedInterrupt({
                 runDir,
                 state,
@@ -1041,7 +1042,7 @@ function buildRecoveryResultForTrigger(state, trigger, outcome) {
         evidenceRefs: [],
     };
 }
-export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd) {
+export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd, frontendRecoveryQuota = 1) {
     const repoRoot = cwd ?? path.resolve(runDir, "..", "..", "..", "..");
     if (state.frontendShapeState?.terminalOutcome &&
         state.frontendShapeState.transitionCapsule) {
@@ -1063,16 +1064,53 @@ export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd) {
             // every other blocked admission is terminal.
             const planContractInvalid = admission.result.classification === "blocked" &&
                 admission.result.failureSource === "frontend-plan-pi";
+            // A blocked admission caused by the design review committing
+            // `request_design_changes` is a definite finding (not a protocol or
+            // environment error): the design was reviewed and rejected. It is the
+            // design-review analog of review-request-changes — not terminal, but
+            // re-enters the next plan round with the committed design findings.
+            // The failureSource may be frontend-writer-admission-shell or
+            // frontend-design-policy-shell; the committed design fact is the
+            // authoritative signal.
+            const designRequestFact = await readCommittedDesignRequestFact({
+                runDir,
+            });
+            const designRejected = admission.result.classification === "blocked" &&
+                designRequestFact !== undefined;
             const terminalAdmissionDenial = (admission.result.classification === "blocked" ||
                 admission.result.classification === "stale") &&
-                !planContractInvalid;
+                !planContractInvalid &&
+                !designRejected;
             if (terminalAdmissionDenial) {
                 state.status = "failed";
                 return { recoveryPending: false };
             }
+            if (designRejected && designRequestFact) {
+                state.terminalReason = "design-request-changes";
+                try {
+                    await writeFrontendReviewFindingsPrd({
+                        runDir,
+                        parentRunId: state.runId,
+                        fact: designRequestFact,
+                    });
+                }
+                catch (error) {
+                    console.warn(`[run-dag] warning: failed to write frontend design findings PRD: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
+                if (continuationCount < frontendRecoveryQuota) {
+                    recoveryTrigger = {
+                        requestId: state.runId,
+                        failureSource: "frontend-design-review-pi",
+                        failureOwner: classifyReviewIssueCategoryFailureOwner(designRequestFact.issueCategory),
+                        protocolFailureReason: `frontend design review request_design_changes (issueCategory=${designRequestFact.issueCategory})`,
+                        recoveryMode: "new-dag",
+                    };
+                }
+            }
             if (planContractInvalid) {
                 const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
-                if (continuationCount >= 1) {
+                if (continuationCount >= frontendRecoveryQuota) {
                     // Continuation quota exhausted: a second contract-invalid candidate
                     // is authoritative candidate-contract-invalid → forced failed.
                     state.frontendRecoveryResult = buildCandidateContractInvalidResult(state, admission.result, admission.artifactHash);
@@ -1108,7 +1146,7 @@ export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd) {
         });
         if (writerNodeId) {
             const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
-            if (continuationCount < 1) {
+            if (continuationCount < frontendRecoveryQuota) {
                 const { rollbackFrontendWriter } = await import("./frontend-writer-recovery.js");
                 const rollback = await rollbackFrontendWriter({
                     cwd: repoRoot,
@@ -1140,7 +1178,7 @@ export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd) {
         const verifyFailed = state.nodes["frontend-verify-shell"]?.status === "ERROR";
         if (verifyFailed) {
             const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
-            if (continuationCount < 1) {
+            if (continuationCount < frontendRecoveryQuota) {
                 recoveryTrigger = {
                     requestId: state.runId,
                     failureSource: "frontend-verify-shell",
@@ -1151,6 +1189,44 @@ export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd) {
             }
         }
     }
+    // Phase 7: frontend review "request changes" → not passed. When the review
+    // node FINISHED but committed `request_review_changes` (typed terminal
+    // verdict), the implementation was reviewed and rejected. The run must not
+    // surface as finished: terminal aggregation below stays partial_failed, a
+    // terminal reason is recorded, the committed findings are rendered into a
+    // downstream-task PRD draft (run-owned), and a recovery trigger carries the
+    // issueCategory-derived owner so a later DAG round consumes the findings
+    // instead of repeating the previous flow.
+    const reviewRequestFact = await readCommittedReviewRequestFact({
+        runDir,
+    });
+    if (reviewRequestFact) {
+        state.terminalReason = "review-request-changes";
+        try {
+            await writeFrontendReviewFindingsPrd({
+                runDir,
+                parentRunId: state.runId,
+                fact: reviewRequestFact,
+            });
+        }
+        catch (error) {
+            // The PRD draft is additive; a write failure must not mask the
+            // not-passed verdict. The terminal aggregation below still applies.
+            console.warn(`[run-dag] warning: failed to write frontend review findings PRD: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (!recoveryTrigger && !skipFrontendRecovery) {
+            const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
+            if (continuationCount < frontendRecoveryQuota) {
+                recoveryTrigger = {
+                    requestId: state.runId,
+                    failureSource: "frontend-review-pi",
+                    failureOwner: classifyReviewIssueCategoryFailureOwner(reviewRequestFact.issueCategory),
+                    protocolFailureReason: `frontend review request_review_changes (issueCategory=${reviewRequestFact.issueCategory})`,
+                    recoveryMode: "new-dag",
+                };
+            }
+        }
+    }
     const finishedCount = Object.values(state.nodes).filter((n) => n.status === "FINISHED").length;
     const { supersededIds, supersededFailures } = collectSupersededIntermediateFailures(state);
     if (state.convergence && supersededFailures.length > 0) {
@@ -1166,7 +1242,13 @@ export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd) {
     if (effectiveErrorCount === 0 &&
         successTerminal &&
         finishedCount + conditionSkippedCount + supersededErrorCount === taskCount) {
-        state.status = "finished";
+        // Phase 7 guard: a committed `request_review_changes` means the review
+        // rejected the implementation; the run must never surface as finished
+        // even though every node technically FINISHED.
+        state.status =
+            state.terminalReason === "review-request-changes"
+                ? "partial_failed"
+                : "finished";
     }
     else if (finishedCount > 0) {
         state.status = "partial_failed";

package/dist/workflows/dag/types.js

@@ -1147,6 +1147,22 @@ export const dagSpecSchema = z
     taskContractBinding: dagTaskContractBindingSchema.optional(),
     /** Optional unresolved parent-run feedback for a full task rerun. */
     rerunFeedback: dagRerunFeedbackSchema.optional(),
+    /** Frontend recovery continuation quota (frozen at generation time from
+     * task.json frontendRecovery.maxContinuations). Bounds how many times a
+     * failed frontend run may auto-recover via M6 recovery operations before
+     * the run stays failed and needs human intervention. */
+    frontendRecovery: z
+        .object({
+        maxContinuations: z
+            .number()
+            .int()
+            .min(1)
+            .max(5)
+            .optional()
+            .default(1),
+    })
+        .strict()
+        .optional(),
     /** Frozen backend-test artifact layout (plan A); absent = historical default testcase/ layout. */
     backendTestLayout: z
         .object({

package/dist/workflows/dag/validate.js

@@ -3,7 +3,7 @@ import { resolveShellCommands } from "../../executors/shell-executor.js";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
 import { resolveRepairTaskForGate } from "./repair-artifact.js";
 import { topoSortToRanks } from "./topo.js";
-import { isSafeReadOnlyPiRetryCandidate, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, } from "./retry-policy.js";
+import { isSafeReadOnlyPiRetryCandidate, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, CONTEXT_OVERFLOW_RETRY_CATEGORY, } from "./retry-policy.js";
 import { isBackendTestCompletenessRetryCandidate } from "./backend-test-writer-completeness.js";
 import { defaultFrontendTestLayout, frontendTestLayoutFromSpec, } from "./frontend-test-layout.js";
 const GOVERNANCE_WARNING_TYPES = new Set([
@@ -656,12 +656,18 @@ function validateRetryPolicyTaskConfig(task, issues) {
     }
     if (isWriterTransportCandidate) {
         const categories = new Set(task.retryPolicy.retryCategories);
+        const allowedWriterTransportCategories = new Set([
+            WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY,
+            CONTEXT_OVERFLOW_RETRY_CATEGORY,
+        ]);
+        const allAllowed = [...categories].every((category) => allowedWriterTransportCategories.has(category));
         if (task.retryPolicy.maxAttempts !== 2 ||
-            categories.size !== 1 ||
+            categories.size === 0 ||
+            !allAllowed ||
             !categories.has(WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY)) {
             issues.push({
                 type: "invalid-retry-policy",
-                message: `task ${task.id} writer transport retryPolicy must use exactly two total attempts and only ${WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY}`,
+                message: `task ${task.id} writer transport retryPolicy must use exactly two total attempts and only writer-clean-timeout (plus optional context-overflow)`,
             });
         }
     }