@tea-agent/loop-agent 0.39.0-beta.7 → 0.39.0-beta.9

package/dist/worker/observe/static/views/task.js

@@ -34,6 +34,7 @@ import {
 	repoBaseName,
 	parseMarkdownBlocks,
 	markdownLinkHref,
+	formatLedgerSummary,
 } from "../format.js";
 import { parseRoute, navigate, buildHashPath } from "../router.js";
 import {
@@ -94,6 +95,7 @@ export async function renderTaskDetail(featureId, taskId) {
 	const linksEl = document.getElementById("task-links");
 	const evidenceEl = document.getElementById("task-evidence");
 	const runsEl = document.getElementById("task-runs");
+	const ledgerEl = document.getElementById("task-ledger");
 	if (!metaEl || !linksEl || !evidenceEl || !runsEl) return false;
 	if (titleEl) titleEl.textContent = displayLabel;
 	mountViewState(metaEl, "loading", "加载 Task…");
@@ -252,9 +254,62 @@ export async function renderTaskDetail(featureId, taskId) {
 	const active = ["running", "pending", "blocked", "stale"].includes(
 		(task.status ?? "").toLowerCase(),
 	);
+	if (ledgerEl) {
+		void renderTaskLedger(ledgerEl, taskId);
+	}
 	return active;
 }
 
+/**
+ * Task 详情页 ledger 安全摘要（AC-009）：从只读 GET /api/tasks/:id/ledger 拉取，
+ * 计数/状态/failure code + 有界排除理由；无 ledger 显示空态，失败安全降级。
+ */
+async function renderTaskLedger(ledgerEl, taskId) {
+	clearNode(ledgerEl);
+	ledgerEl.appendChild(el("h3", "section-heading", "Source fidelity ledger"));
+	mountViewState(ledgerEl, "loading", "加载 ledger…");
+	let body = null;
+	try {
+		body = await fetchJson(`/api/tasks/${encodeURIComponent(taskId)}/ledger`);
+	} catch {
+		body = null;
+	}
+	if (!body) {
+		mountViewState(ledgerEl, "error", "ledger 只读接口失败（安全降级）。");
+		return;
+	}
+	if (body.present !== true) {
+		mountViewState(
+			ledgerEl,
+			body.error ? "error" : "empty",
+			body.error
+				? `ledger 不可用（${body.error}）。`
+				: "无 source fidelity ledger（任务无引用或 ledger 缺失，不伪造计数）。",
+		);
+		return;
+	}
+	const pre = el(
+		"pre",
+		"cmd",
+		formatLedgerSummary({
+			present: true,
+			fragmentCount: body.fragmentCount,
+			canonicalRequirementCount: body.canonicalRequirementCount,
+			contextOnlyCount: body.contextOnlyCount,
+			duplicateCount: body.duplicateCount,
+			unresolvedCount: body.unresolvedCount,
+			conflictCount: body.conflictCount,
+			gateStatus: body.gateStatus,
+			failureCode: body.failureCode,
+			exclusions: body.exclusions ?? [],
+		}),
+	);
+	pre.dataset.testid = "task-ledger-summary";
+	clearNode(ledgerEl);
+	ledgerEl.appendChild(el("h3", "section-heading", "Source fidelity ledger"));
+	ledgerEl.appendChild(pre);
+}
+
 export async function loadOlderTaskRuns(featureId, taskId, before, runsEl) {
 	if (runsEl === undefined) {
 		runsEl = before;

package/dist/workflows/dag/frontend-design-policy.js

@@ -148,9 +148,10 @@ export function checkMockStrategy(contract, allowedMockStrategies) {
     }
     return findings;
 }
-/** 4. Component choice must be precisely spec-referenced: `specified` requires
- * a specReference whose normalized path is a candidate and a non-empty section;
- * `new` must not carry a specReference; `reuse-existing` may omit it. The
+/** 4. Component choice must be precisely evidence-referenced: `specified`
+ * requires a specReference whose normalized path is a candidate and a non-empty
+ * section; `new` requires a task-source reference with a non-empty section;
+ * `reuse-existing` may omit it. The
  * candidate set is the full generation-frozen openspec candidate list (the
  * shell passes openspecCandidatePaths with componentSpecCandidatePaths as the
  * fallback), so directory-organized component libraries are never rejected.
@@ -199,12 +200,21 @@ export function checkComponentChoice(contract, componentSpecCandidatePaths) {
                 });
             }
         }
-        else if (choice.decision === "new" && choice.specReference) {
-            findings.push({
-                code: "component-new-with-spec-reference",
-                message: `new component choice #${index} must not carry a specReference`,
-                path: choice.purpose,
-            });
+        else if (choice.decision === "new") {
+            if (!choice.specReference || !choice.specReference.path) {
+                findings.push({
+                    code: "component-new-source-reference-missing",
+                    message: `new component choice #${index} is missing its task-source specReference`,
+                    path: choice.purpose,
+                });
+            }
+            else if (!choice.specReference.section.trim()) {
+                findings.push({
+                    code: "component-new-source-reference-missing",
+                    message: `new component choice #${index} has an empty task-source reference section`,
+                    path: choice.purpose,
+                });
+            }
         }
     });
     return findings;

package/dist/workflows/dag/frontend-implementation-contract.js

@@ -13,7 +13,9 @@ import { readTypedEventStoreFromJsonl } from "./frontend-typed-event-store.js";
 // only at call time, so the contract module and the policy module can depend
 // on each other without module-init ordering issues.
 import { checkDependencies, checkTargetPaths, checkUiDesignCoverage, checkUiStateAttribution, } from "./frontend-design-policy.js";
+import { isDagSourceBindingV2 } from "./types.js";
 import { canonicalContractRel, classifyStructuredContractFailure, formatStructuredArtifactPointer, persistRuntimeSkeleton, } from "./structured-output-repair.js";
+import { renderFrontendPlanMarkdown } from "./frontend-plan-render.js";
 import { isConfigurationVerificationFile, verificationSymbolMatchesContent, } from "./frontend-verification-trace.js";
 export const frontendNormalizationActionSchema = z.enum([
     "remove-trailing-commas",
@@ -286,13 +288,13 @@ const gap = z
  *   `specReference` is required (path/section/line hit).
  * - `reuse-existing`: reuse an existing repo component/convention not named by
  *   the spec → `specReference` may be null, rationale explains the basis.
- * - `new`: neither spec nor existing code fits → `specReference` must be null,
- *   rationale must declare the deviation (design-review approves it).
+ * - `new`: the task source mandates a component absent from the repository →
+ *   `specReference` is required and points at that task-source declaration;
+ *   rationale explains the bounded addition.
  *
- * `specReference` is nullable + optional because `stripNullValuesDeep` strips
- * null object values before validation, so a `new` choice's `specReference:
- * null` becomes an absent field; the superRefine below treats absent and null
- * identically.
+ * `specReference` is nullable + optional at the wire boundary because
+ * `stripNullValuesDeep` removes model-emitted nulls before validation. The
+ * decision-specific requirements are enforced by the superRefine below.
  */
 const uiComponentSpecReferenceSchema = z
     .object({
@@ -308,7 +310,8 @@ const uiComponentChoiceSchema = z
     decision: z.enum(["specified", "reuse-existing", "new"]),
     specReference: uiComponentSpecReferenceSchema.nullable().optional(),
     // Optional: the decision enum already carries the semantic (specified →
-    // specReference, new → deviation, reuse-existing → no rationale needed).
+    // specReference, new → task-source traceability, reuse-existing → no
+    // rationale needed).
     // Omit for reuse-existing to keep plan output small.
     rationale: z.string().min(1).optional(),
 })
@@ -338,49 +341,12 @@ function stripNullValuesDeep(value) {
     }
     return value;
 }
-/**
- * Normalize a model-emitted `uiComponentChoices` where a `new` choice carries a
- * degenerate empty `specReference` object (`{ path: "", section: "", line:
- * null }`) instead of the required `null`. The model intent is unambiguous
- * (new components must not carry a specReference; the empty object is a format
- * slip, not a real spec hit), so dropping the empty object before validation
- * avoids a full plan retry on an otherwise-correct emission. A `specReference`
- * with a non-empty `path` is preserved (it is a genuine `specified` hit).
- */
-export function normalizeNewComponentSpecReference(value) {
-    if (!Array.isArray(value))
-        return value;
-    return value.map((item) => {
-        if (!item || typeof item !== "object")
-            return item;
-        const record = item;
-        if (record.decision !== "new")
-            return item;
-        const ref = record.specReference;
-        if (!ref || typeof ref !== "object")
-            return item;
-        const refRecord = ref;
-        const path = typeof refRecord.path === "string" ? refRecord.path.trim() : "";
-        if (path.length > 0)
-            return item;
-        // Empty/degenerate specReference on a new choice → absent (null intent).
-        const { specReference: _dropped, ...rest } = record;
-        return rest;
-    });
-}
 export const frontendImplementationContractSchema = z
     .preprocess((value) => {
     const record = asRecord(value);
     if (!record)
         return stripNullValuesDeep(value);
-    return stripNullValuesDeep({
-        ...record,
-        ...(record.uiComponentChoices !== undefined
-            ? {
-                uiComponentChoices: normalizeNewComponentSpecReference(record.uiComponentChoices),
-            }
-            : {}),
-    });
+    return stripNullValuesDeep(record);
 }, z
     .object({
     schemaVersion: z.literal(1),
@@ -391,8 +357,33 @@ export const frontendImplementationContractSchema = z
         requirementSha256: z.string().regex(/^[a-f0-9]{64}$/),
         referencePaths: z.array(safePath),
         requirementIds: z.array(id),
+        // Source binding v2 (frontend): bound ledger pointer + fragment map.
+        ledgerPath: safePath.optional(),
+        ledgerSha256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+        inputDigest: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+        requirementToFragments: z
+            .record(z.string(), z.array(z.string()))
+            .optional(),
     })
-        .strict(),
+        .strict()
+        .superRefine((value, ctx) => {
+        // v2 all-or-none：任一 ledger 字段出现则四项必须齐全，防止 v1+optional 冒充 v2。
+        const anyLedgerField = value.ledgerPath !== undefined ||
+            value.ledgerSha256 !== undefined ||
+            value.inputDigest !== undefined ||
+            value.requirementToFragments !== undefined;
+        const allLedgerFields = value.ledgerPath !== undefined &&
+            value.ledgerSha256 !== undefined &&
+            value.inputDigest !== undefined &&
+            value.requirementToFragments !== undefined;
+        if (anyLedgerField && !allLedgerFields) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["sourceBinding"],
+                message: "source binding v2 ledger fields (ledgerPath/ledgerSha256/inputDigest/requirementToFragments) must be provided together; partial or optional v1+ledger bindings are rejected",
+            });
+        }
+    }),
     riskLevel: z.enum(["small", "standard", "high-risk"]),
     targets: z
         .object({
@@ -408,6 +399,10 @@ export const frontendImplementationContractSchema = z
         implementationTargets: z.array(safePath),
         verificationTargetIds: z.array(z.string().min(1)),
         evidenceGap: gap.optional(),
+        // Source fidelity ledger binding (AC-005/AC-006): 每个 requirement
+        // 携带来源 fragment 证据，prewrite 门禁校验其真实性与覆盖。
+        sourceFragmentIds: z.array(z.string().min(1)).optional(),
+        sourceRefs: z.array(safePath).optional(),
     })
         .strict()).min(1),
     uiStates: z.array(z
@@ -544,6 +539,32 @@ export const frontendImplementationContractSchema = z
                     message: `unknown verification target ${targetId}`,
                     path: ["requirements"],
                 });
+        // Source fidelity ledger binding (AC-005/AC-006): 绑定携带
+        // requirementToFragments（ledger v2）时，每个 requirement 必须携带
+        // 非空 sourceFragmentIds，否则 fail closed（防引用伪造/缺失）。
+        // sourceRefs（fragment→path 的派生展示）不设硬门槛：模型从 binding
+        // 只能拿到 fragment id 拿不到权威 path，强制只会诱导编造；防伪造的
+        // 真实性校验由 fidelity gate 按 sourceFragmentIds 执行（存在性 +
+        // 与 ledger boundFragments 一致）。
+        const boundFragments = value.sourceBinding.requirementToFragments?.[requirement.id];
+        if (value.sourceBinding.ledgerPath &&
+            (!requirement.sourceFragmentIds ||
+                requirement.sourceFragmentIds.length === 0)) {
+            ctx.addIssue({
+                code: "custom",
+                message: `requirement ${requirement.id} must carry sourceFragmentIds when a source fidelity ledger is bound`,
+                path: ["requirements", requirement.id, "sourceFragmentIds"],
+            });
+        }
+        else if (boundFragments !== undefined &&
+            (!requirement.sourceFragmentIds ||
+                requirement.sourceFragmentIds.length === 0)) {
+            ctx.addIssue({
+                code: "custom",
+                message: `requirement ${requirement.id} is bound to ledger fragments ${boundFragments.join(", ")} but declares none`,
+                path: ["requirements", requirement.id, "sourceFragmentIds"],
+            });
+        }
     }
     for (const state of value.uiStates) {
         if (state.applicable &&
@@ -573,10 +594,10 @@ export const frontendImplementationContractSchema = z
             }
         }
         else if (choice.decision === "new") {
-            if (choice.specReference) {
+            if (!choice.specReference || !choice.specReference.path) {
                 ctx.addIssue({
                     code: "custom",
-                    message: "new component choice must not carry a specReference",
+                    message: "new component choice requires a task-source specReference.path",
                     path: ["uiComponentChoices", index, "specReference"],
                 });
             }
@@ -680,6 +701,29 @@ export async function assertFrontendSourceBindingFresh(input) {
             throw new Error(`frontend source binding is stale: ${source.path}`);
         }
     }
+    // Source binding v2 ledger 新鲜度（AC-FIDELITY-REPAIR-001/002）：v2 绑定携带的
+    // ledger 文件必须存在且 sha256 与绑定一致，否则 fail closed；v1 绑定无此路径。
+    if (isDagSourceBindingV2(input.binding)) {
+        const absolute = resolveDagTaskSourcePath({
+            workspaceRoot: input.workspaceRoot,
+            taskId: input.binding.taskId,
+            sourcePath: input.binding.ledgerPath,
+        });
+        let content;
+        try {
+            content = await readFile(absolute);
+            const info = await stat(absolute);
+            if (!info.isFile())
+                throw new Error("not a regular file");
+        }
+        catch (error) {
+            throw new Error(`frontend source fidelity ledger unavailable: ${input.binding.ledgerPath}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const actual = createHash("sha256").update(content).digest("hex");
+        if (actual !== input.binding.ledgerSha256) {
+            throw new Error(`frontend source fidelity ledger is stale or tampered: ${input.binding.ledgerPath} (bound ${input.binding.ledgerSha256}, observed ${actual})`);
+        }
+    }
 }
 const SECRET_KEY = /(?:password|passwd|secret|token|api[_-]?key|private[_-]?key|credential|authorization)/i;
 const SECRET_VALUE = /(?:-----BEGIN [A-Z ]*PRIVATE KEY-----|\b(?:sk|ghp|github_pat|xox[baprs]|AKIA)[-_A-Za-z0-9]{12,}\b)/;
@@ -854,7 +898,7 @@ export function canonicalFrontendContractSourceBinding(binding) {
     const requirement = binding.sources.find((source) => source.kind === "requirement");
     if (!requirement)
         throw new Error("frontend implementation contract gate requires a requirement source in DAG sourceBinding");
-    return {
+    const sourceBinding = {
         taskId: binding.taskId,
         requirementPath: requirement.path,
         requirementSha256: requirement.sha256,
@@ -864,6 +908,15 @@ export function canonicalFrontendContractSourceBinding(binding) {
             .sort(),
         requirementIds: binding.requirementIds.map(canonicalizeRequirementId),
     };
+    // Source binding v2（schemaVersion=2 强制字段）：透传 ledger 指针与
+    // requirement→fragment 映射。v1 绑定不得以 optional 字段冒充 v2。
+    if (isDagSourceBindingV2(binding)) {
+        sourceBinding.ledgerPath = binding.ledgerPath;
+        sourceBinding.ledgerSha256 = binding.ledgerSha256;
+        sourceBinding.inputDigest = binding.inputDigest;
+        sourceBinding.requirementToFragments = binding.requirementToFragments;
+    }
+    return sourceBinding;
 }
 function asRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value)
@@ -1436,6 +1489,14 @@ export function coerceFrontendImplementationContractInput(value, canonicalBindin
             verificationTargetIds: verificationTargetIds.length > 0
                 ? verificationTargetIds
                 : defaultVerificationIds,
+            // Source fidelity provenance 透传：兼容分支重建 requirement 时必须
+            // 保留已声明的 sourceFragmentIds/sourceRefs（strict 分支通过
+            // `...requirement` 保留，两边必须一致），否则 ledger-bound 契约在
+            // designEvidence 缺失等情况下走兼容分支时丢失防伪造证据。
+            ...(Array.isArray(req.sourceFragmentIds)
+                ? { sourceFragmentIds: req.sourceFragmentIds }
+                : {}),
+            ...(Array.isArray(req.sourceRefs) ? { sourceRefs: req.sourceRefs } : {}),
         };
         // Do not mark free-form realIntegrationGap as blocking; defer to FE-TEST/FINAL-VERIFY.
         if (gapText) {
@@ -2075,11 +2136,17 @@ export async function validateFrontendPlanPatchNodeOutput(input) {
             sha256: canonicalArtifact.sha256,
             schemaId: FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID,
         };
+        // Human-readable plan summary appended after the artifact pointer. The
+        // pointer remains the machine authority (path/schema/sha256); the
+        // rendered summary is a deterministic view of the canonical contract so
+        // Console/reviewers can read the plan without opening the JSON. It never
+        // participates in downstream validation.
+        const planSummary = renderFrontendPlanMarkdown(analysis.canonical);
         return {
             ok: true,
             contract: analysis.canonical,
             artifact,
-            normalizedText: formatStructuredArtifactPointer(artifact),
+            normalizedText: `${formatStructuredArtifactPointer(artifact)}\n\n${planSummary}`,
         };
     }
     catch (error) {

package/dist/workflows/dag/frontend-plan-render.js

@@ -47,6 +47,27 @@ function componentSelection(contract) {
     })
         .join("\n");
 }
+/**
+ * 有界 source fidelity ledger 指针（AC-007 / AC-FIDELITY-007）：长原文不重新
+ * 全量内联到节点提示词；只注入紧凑 canonical contract 与 bound ledger 指针
+ * （路径/哈希/inputDigest），ledger coverage 证明长尾未丢失。
+ */
+function sourceFidelityLedger(contract) {
+    const binding = contract.sourceBinding;
+    if (!binding.ledgerPath)
+        return "_(not bound — v1 source binding)_";
+    const lines = [
+        `- ledger: ${binding.ledgerPath}`,
+        `- ledgerSha256: ${binding.ledgerSha256 ?? "(missing)"}`,
+        `- inputDigest: ${binding.inputDigest ?? "(missing)"}`,
+        "- 语义权威：原始 requirement/acceptance 文档与 requirement-ledger.json；本计划只消费派生摘要与 bound ledger 指针，长原文不内联。",
+    ];
+    const boundCount = Object.keys(binding.requirementToFragments ?? {}).length;
+    if (boundCount > 0) {
+        lines.push(`- requirement→fragment bindings: ${boundCount}`);
+    }
+    return lines.join("\n");
+}
 export function renderFrontendPlanMarkdown(contract) {
     return [
         "# Frontend Implementation Plan",
@@ -54,6 +75,12 @@ export function renderFrontendPlanMarkdown(contract) {
         "## Requirement Coverage",
         requirementsCoverage(contract),
         "",
+        "## Source Fidelity Ledger",
+        sourceFidelityLedger(contract),
+        "",
+        "## Implementation Steps",
+        bulletList(contract.implementationSteps) || "_(not specified)_",
+        "",
         "## Target Files",
         bulletList(contract.targets.files) || "_(none)_",
         "",

package/dist/workflows/dag/frontend-prewrite-gate.js

@@ -5,6 +5,7 @@ import { z } from "zod";
 import { OPENSPEC_SPEC_EXT_RE, isOpenspecSpecFilePath } from "../../shared/openspec-spec.js";
 import { writeTextArtifactFile } from "../../infrastructure/harness/artifact-store.js";
 import { countExcludedGovernanceSpecFiles, resolveOpenspecGovernanceRoot, } from "../../task/frontend-project-capability.js";
+import { checkFrontendSourceFidelityLedger, } from "./frontend-source-fidelity-ledger.js";
 import { analyzeFrontendImplementationContract, writeFrontendImplementationContractArtifact, writeDeterministicJsonArtifact, assertFrontendSourceBindingFresh, deterministicSha256, sha256Hex, serializeDeterministicJson, FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID, FrontendContractFailure, frontendNormalizationActionSchema, } from "./frontend-implementation-contract.js";
 import { renderFrontendPlanMarkdown } from "./frontend-plan-render.js";
 import { captureFrontendWorktreeBaseline } from "./frontend-worktree-diff.js";
@@ -42,6 +43,14 @@ export const frontendPrewriteFailureCodeSchema = z.enum([
     "component-choices-missing",
     "contract-too-large",
     "revision-patch-unmergeable",
+    // Source fidelity ledger 类目（SOURCE_FIDELITY_*/source-* 稳定错误码）。
+    "source-fidelity-ledger-missing",
+    "source-fidelity-ledger-stale",
+    "source-fidelity-unresolved",
+    "source-fidelity-conflict",
+    "source-fidelity-high-risk-uncovered",
+    "source-fidelity-requirement-not-covered",
+    "source-fidelity-source-ref-invalid",
 ]);
 export const frontendPrewriteResultV1Schema = z
     .object({
@@ -503,6 +512,7 @@ async function finalizePrewrite(input, pending) {
         openspecPolicy: pending.openspecPolicy,
     };
 }
+export { checkFrontendSourceFidelityLedger } from "./frontend-source-fidelity-ledger.js";
 export async function runFrontendPrewriteGate(input) {
     const workspaceRoot = input.workspaceRoot ?? input.repoRoot;
     // selectNode throws for a scheduling defect (no FINISHED plan/review). That
@@ -647,6 +657,33 @@ export async function runFrontendPrewriteGate(input) {
         }
         throw error;
     }
+    // Source fidelity ledger gate (20260824-frontend-source-fidelity-ledger-v1):
+    // 在 verdict/missing-requirement-ids/source-binding-not-fresh 之后插入 ledger
+    // 检查。缺失即 fail closed 且 writer 不获授权；所有检查通过才继续物化契约。
+    if (input.sourceBinding) {
+        const ledgerCheck = await checkFrontendSourceFidelityLedger({
+            workspaceRoot: workspaceRoot ?? "",
+            binding: input.sourceBinding,
+            contractRequirements: analysis.canonical.requirements.map((requirement) => ({
+                id: requirement.id,
+                sourceFragmentIds: requirement.sourceFragmentIds,
+                sourceRefs: requirement.sourceRefs,
+            })),
+        });
+        if (!ledgerCheck.ok && ledgerCheck.failureCode) {
+            return finalizePrewrite(input, {
+                ...basePending,
+                verdict,
+                candidateJsonSha256: analysis.candidateJsonSha256,
+                normalizationActions: [],
+                mockStrategy: analysis.canonical.mockApi.strategy,
+                classification: "blocked",
+                failureReason: ledgerCheck.failureReason ??
+                    "frontend source fidelity ledger gate failed",
+                failureCode: ledgerCheck.failureCode,
+            });
+        }
+    }
     // Size guard: a canonical contract above 64KB is a retryable-invalid defect
     // (compress the contract) rather than a writer authorization failure.
     const contractSizeBytes = Buffer.byteLength(serializeDeterministicJson(analysis.canonical), "utf8");
@@ -873,13 +910,17 @@ export async function runFrontendPrewriteGate(input) {
             normalizationActions: [],
             mockStrategy,
             classification: "retryable-invalid",
-            failureReason: "frontend prewrite gate: the canonical contract has UI-visible work but uiComponentChoices is missing or empty while the generation-frozen component/theme specification bucket is non-empty. 为每个 UI 用途声明组件选型（decision: specified | reuse-existing | new），specified 必须给 specReference.path/section/line，new 必须给 rationale 声明偏差。",
+            failureReason: "frontend prewrite gate: the canonical contract has UI-visible work but uiComponentChoices is missing or empty while the generation-frozen component/theme specification bucket is non-empty. 为每个 UI 用途声明组件选型（decision: specified | reuse-existing | new）；specified 必须给 OpenSpec specReference.path/section/line，new 必须给任务源 PRD specReference.path/section/line。",
             failureCode: "component-choices-missing",
             openspecReadPaths,
             openspecCandidatePaths: candidatePaths,
         });
     }
+    // Only `specified` choices cite the frozen OpenSpec candidate bucket. A
+    // `new` choice instead cites its task-source/PRD declaration and must not be
+    // rejected merely because that source is outside the OpenSpec roots.
     const componentSpecReferences = componentChoices
+        .filter((choice) => choice.decision === "specified")
         .map((choice) => ({
         raw: choice.specReference?.path ?? "",
         normalized: choice.specReference?.path
@@ -1024,6 +1065,9 @@ export function formatFrontendPrewriteGateStdout(result) {
     }
     lines.push(`Prewrite result: ${result.prewriteResult.path}`);
     lines.push(`Openspec policy: ${result.openspecPolicy}`);
+    if (result.failureCode?.startsWith("source-fidelity-")) {
+        lines.push(`Source fidelity ledger: blocked (${result.failureCode})`);
+    }
     if (result.failureReason)
         lines.push(`Failure reason: ${result.failureReason}`);
     if (result.openspecReadPaths.length > 0) {

package/dist/workflows/dag/frontend-recovery-controller.js

@@ -15,6 +15,7 @@ export function projectLegacyOperationState(state) {
         case "queued":
         case "starting":
         case "running":
+        case "restarting":
             return { operationState: "active" };
         case "succeeded":
             return { operationState: "success", operationTerminal: "success" };