@tea-agent/loop-agent 0.39.0-next.17 → 0.39.0-next.19

package/dist/workflows/dag/frontend-implementation-contract.js

@@ -13,6 +13,7 @@ export const frontendNormalizationActionSchema = z.enum([
     "strip-comments",
     "canonicalize-requirement-ids",
     "canonicalize-verification-alias",
+    "drop-unresolved-verification-symbols",
     "inject-source-binding",
 ]);
 export function sha256Hex(input) {
@@ -102,6 +103,21 @@ async function deriveFrozenCommandLabelsFromRun(runDir) {
     return [...labels];
 }
 export const FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID = "frontend-implementation-contract-v1";
+export const FRONTEND_IMPLEMENTATION_CONTRACT_PLAN_PATCH_SCHEMA_ID = "frontend-implementation-contract-plan-patch-v1";
+/**
+ * Build the deterministic, run-owned portion of the frontend contract. The
+ * planner is allowed to fill semantic fields with an RFC 7386 merge patch but
+ * cannot redefine task identity, risk, or the implementation write boundary.
+ */
+export function buildFrontendImplementationContractSkeleton(input) {
+    return {
+        schemaVersion: 1,
+        sourceBinding: canonicalFrontendContractSourceBinding(input.sourceBinding),
+        riskLevel: input.riskLevel,
+        targets: { files: [...input.targetFiles] },
+        mockApi: { productionDefaultOff: true },
+    };
+}
 /**
  * Load the canonical frontend-implementation-contract-v1 JSON Schema from the
  * installed loop-agent package docs/templates/ path. Package-root discovery
@@ -499,9 +515,9 @@ function isPlainObject(value) {
  * ever materialized, so a patch that removes a required field still fails
  * closed at the gate.
  */
-export function applyFrontendImplementationContractPatch(target, patch) {
+export function applyFrontendContractMergePatch(target, patch) {
     if (!isPlainObject(patch)) {
-        throw new Error("frontend revision patch must be a JSON object");
+        throw new Error("frontend contract patch must be a JSON object");
     }
     const merge = (base, delta) => {
         if (delta === null)
@@ -526,6 +542,9 @@ export function applyFrontendImplementationContractPatch(target, patch) {
     };
     return merge(target, patch);
 }
+export function applyFrontendImplementationContractPatch(target, patch) {
+    return applyFrontendContractMergePatch(target, patch);
+}
 export async function assertFrontendSourceBindingFresh(input) {
     for (const source of input.binding.sources) {
         const absolute = resolveDagTaskSourcePath({
@@ -1608,6 +1627,206 @@ export async function writeFrontendImplementationContractArtifact(input) {
         schemaId: FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID,
     };
 }
+const FRONTEND_PLAN_PATCH_PROTECTED_PATHS = [
+    "/schemaVersion",
+    "/sourceBinding",
+    "/riskLevel",
+    "/targets/files",
+    "/mockApi/productionDefaultOff",
+];
+function frontendPlanPatchProtectedPathViolations(patch) {
+    const record = asRecord(patch);
+    if (!record)
+        return ["/"];
+    const violations = [];
+    for (const key of ["schemaVersion", "sourceBinding", "riskLevel"]) {
+        if (Object.hasOwn(record, key))
+            violations.push(`/${key}`);
+    }
+    const targets = asRecord(record.targets);
+    if (targets && Object.hasOwn(targets, "files"))
+        violations.push("/targets/files");
+    const mockApi = asRecord(record.mockApi);
+    if (mockApi && Object.hasOwn(mockApi, "productionDefaultOff"))
+        violations.push("/mockApi/productionDefaultOff");
+    return violations;
+}
+function workspaceRootFromDagRunDir(runDir) {
+    const absolute = path.resolve(runDir);
+    const segments = absolute.split(path.sep);
+    const harnessIndex = segments.lastIndexOf(".harness");
+    if (harnessIndex < 0 ||
+        segments[harnessIndex + 1] !== "dag-runs" ||
+        harnessIndex + 3 >= segments.length) {
+        return null;
+    }
+    const joined = segments.slice(0, harnessIndex).join(path.sep);
+    return joined || path.parse(absolute).root;
+}
+function verificationSymbolMatchesFile(symbol, content) {
+    if (symbol.trim().toLowerCase() === "all describe blocks")
+        return content.includes("describe(");
+    const symbols = symbol.includes(" / ")
+        ? symbol
+            .split(/[（(]/, 1)[0]
+            .split("/")
+            .map((item) => item.trim())
+            .filter(Boolean)
+        : [symbol];
+    return symbols.every((item) => {
+        const describeTitle = item.match(/^describe\((?:['"])(.+?)(?:['"])/i)?.[1];
+        return [item, describeTitle, describeTitle ? "describe(" : undefined]
+            .filter((candidate) => Boolean(candidate))
+            .some((candidate) => content.includes(candidate));
+    });
+}
+async function dropUnresolvedVerificationSymbols(input) {
+    const workspaceRoot = workspaceRootFromDagRunDir(input.runDir);
+    const targets = asRecord(input.contract)?.verificationTargets;
+    if (!workspaceRoot || !Array.isArray(targets))
+        return false;
+    let changed = false;
+    for (const targetValue of targets) {
+        const target = asRecord(targetValue);
+        const file = asString(target?.file);
+        const symbol = asString(target?.symbol);
+        if (!target || !file || !symbol)
+            continue;
+        const absolute = path.resolve(workspaceRoot, file);
+        const relative = path.relative(workspaceRoot, absolute);
+        if (relative.startsWith("..") ||
+            path.isAbsolute(relative) ||
+            relative.includes("..")) {
+            continue;
+        }
+        let content;
+        try {
+            content = await readFile(absolute, "utf8");
+        }
+        catch {
+            // Missing files remain a trace-time hard failure; do not hide them by
+            // changing the optional symbol during candidate normalization.
+            continue;
+        }
+        if (verificationSymbolMatchesFile(symbol, content))
+            continue;
+        delete target.symbol;
+        changed = true;
+    }
+    return changed;
+}
+function extractSingleOpenspecCitationsBlock(text) {
+    const blocks = text.match(/```openspec-citations[ \t]*\r?\n[\s\S]*?\r?\n```/g) ?? [];
+    if (blocks.length !== 1) {
+        throw new Error(`frontend plan patch output must include exactly one fenced openspec-citations block (found ${blocks.length})`);
+    }
+    return blocks[0];
+}
+async function writeFrontendPlanCandidateRaw(input) {
+    const relativePath = path.posix.join("contracts", "candidates", input.nodeId, `attempt-${input.attempt}.raw.md`);
+    await writeTextArtifactFile(path.join(input.runDir, relativePath), input.text.endsWith("\n") ? input.text : `${input.text}\n`);
+    return relativePath;
+}
+/**
+ * Compile the planner's editable RFC 7386 patch against the deterministic
+ * runtime skeleton. Every attempt is preserved under contracts/candidates so
+ * format/schema failures can be inspected and replayed without trusting model
+ * prose. A successful result returns canonical full-contract text for all
+ * downstream review and prewrite nodes.
+ */
+export async function validateFrontendPlanPatchNodeOutput(input) {
+    const nodeId = input.nodeId ?? "frontend-plan-pi";
+    const attempt = input.attempt ?? 1;
+    const candidateDir = path.posix.join("contracts", "candidates", nodeId);
+    const rawPath = await writeFrontendPlanCandidateRaw({
+        runDir: input.runDir,
+        nodeId,
+        attempt,
+        text: input.text,
+    });
+    const reportBase = {
+        schemaVersion: 1,
+        schemaId: FRONTEND_IMPLEMENTATION_CONTRACT_PLAN_PATCH_SCHEMA_ID,
+        nodeId,
+        attempt,
+        rawPath,
+        protectedPaths: [...FRONTEND_PLAN_PATCH_PROTECTED_PATHS],
+        candidateRawSha256: sha256Hex(input.text),
+    };
+    let extractedPatchPath;
+    let extractedPatchSha256;
+    const writeReport = async (value) => {
+        await writeDeterministicJsonArtifact(input.runDir, path.posix.join(candidateDir, `attempt-${attempt}.validation.json`), {
+            ...reportBase,
+            ...(extractedPatchPath
+                ? { extractedPatchPath, extractedPatchSha256 }
+                : {}),
+            ...value,
+        });
+    };
+    try {
+        if (!input.sourceBinding)
+            throw new Error("frontend plan patch validator requires DAG sourceBinding");
+        const skeleton = input.structuredContractOutput?.skeleton;
+        if (!skeleton)
+            throw new Error("frontend plan patch validator requires a deterministic runtime skeleton");
+        const patch = extractFrontendImplementationJson(input.text);
+        if (!isPlainObject(patch))
+            throw new Error("frontend plan patch must extract to one JSON object");
+        extractedPatchPath = path.posix.join(candidateDir, `attempt-${attempt}.extracted.json`);
+        const extractedArtifact = await writeDeterministicJsonArtifact(input.runDir, extractedPatchPath, patch);
+        extractedPatchSha256 = extractedArtifact.sha256;
+        const citationsBlock = extractSingleOpenspecCitationsBlock(input.text);
+        const protectedViolations = frontendPlanPatchProtectedPathViolations(patch);
+        if (protectedViolations.length > 0)
+            throw new Error(`frontend plan patch must not modify runtime-protected paths: ${protectedViolations.join(", ")}`);
+        const merged = applyFrontendContractMergePatch(skeleton, patch);
+        const droppedUnresolvedSymbols = await dropUnresolvedVerificationSymbols({
+            runDir: input.runDir,
+            contract: merged,
+        });
+        const analysis = await analyzeFrontendImplementationContract({
+            runDir: input.runDir,
+            rawContractText: serializeDeterministicJson(merged),
+            sourceBinding: input.sourceBinding,
+        });
+        const normalizedArtifact = await writeDeterministicJsonArtifact(input.runDir, path.posix.join(candidateDir, `attempt-${attempt}.normalized.json`), analysis.canonical);
+        await writeReport({
+            classification: "accepted-normalized",
+            normalizedContractPath: path.posix.relative(input.runDir.replaceAll(path.sep, "/"), normalizedArtifact.path.replaceAll(path.sep, "/")),
+            normalizedContractSha256: normalizedArtifact.sha256,
+            normalizationActions: [
+                "apply-runtime-skeleton",
+                ...(droppedUnresolvedSymbols
+                    ? ["drop-unresolved-verification-symbols"]
+                    : []),
+                ...analysis.normalizationActions,
+            ],
+            errors: [],
+        });
+        return {
+            ok: true,
+            contract: analysis.canonical,
+            normalizedText: [
+                "Frontend implementation contract compiled from the runtime skeleton.",
+                "",
+                "```json",
+                serializeDeterministicJson(analysis.canonical),
+                "```",
+                citationsBlock,
+            ].join("\n"),
+        };
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        await writeReport({
+            classification: "retryable-invalid",
+            normalizationActions: [],
+            errors: [{ path: "$", code: "invalid-output", message: reason }],
+        });
+        return { ok: false, reason };
+    }
+}
 /**
  * Node-output self-check for plan nodes that produce the implementation
  * contract. Mirrors the prewrite gate validation so schema/typo/null violations
@@ -1635,7 +1854,7 @@ export async function validateFrontendContractNodeOutput(input) {
 /**
  * Node-output self-check for the plan revision node, which emits an RFC 7386
  * merge-patch delta against the original contract instead of a full contract.
- * Deliberately loose and format-level: the output must contain at least one
+ * Deliberately loose and format-level: the output must contain exactly one
  * ```openspec-citations fenced block and must extract (after the citations
  * blocks are stripped) to exactly one JSON object. The delta carries no
  * schemaVersion/targets, so no full-contract schema/semantic checks run here;
@@ -1643,17 +1862,19 @@ export async function validateFrontendContractNodeOutput(input) {
  * the prewrite gate, which remains the only authority.
  */
 export async function validateFrontendRevisionPatchNodeOutput(input) {
-    // Mirror the prewrite gate's block-presence semantics (a fenced
-    // ```openspec-citations block with a newline-terminated body).
-    if (!/```openspec-citations[ \t]*\r?\n[\s\S]*?\r?\n```/.test(input.text)) {
+    let citationsBlock;
+    try {
+        citationsBlock = extractSingleOpenspecCitationsBlock(input.text);
+    }
+    catch (error) {
         return {
             ok: false,
-            reason: "revision patch output must include at least one ```openspec-citations fenced block",
+            reason: error instanceof Error ? error.message : String(error),
         };
     }
     // Strip the citation blocks before extraction: their per-row JSON objects
     // would otherwise count as competing balanced objects in the extractor.
-    const textWithoutCitations = input.text.replace(/```openspec-citations[ \t]*\r?\n[\s\S]*?\r?\n```/g, "");
+    const textWithoutCitations = input.text.replace(citationsBlock, "");
     let patch;
     try {
         patch = extractFrontendImplementationJson(textWithoutCitations);
@@ -1670,6 +1891,13 @@ export async function validateFrontendRevisionPatchNodeOutput(input) {
             reason: "revision patch output must extract to exactly one JSON object (RFC 7386 merge-patch delta)",
         };
     }
+    const protectedViolations = frontendPlanPatchProtectedPathViolations(patch);
+    if (protectedViolations.length > 0) {
+        return {
+            ok: false,
+            reason: `frontend revision patch must not modify runtime-protected paths: ${protectedViolations.join(", ")}`,
+        };
+    }
     return { ok: true, contract: patch };
 }
 export async function materializeFrontendImplementationContract(input) {

package/dist/workflows/dag/frontend-prewrite-gate.js

@@ -8,6 +8,7 @@ import { analyzeFrontendImplementationContract, writeFrontendImplementationContr
 import { renderFrontendPlanMarkdown } from "./frontend-plan-render.js";
 import { captureFrontendWorktreeBaseline } from "./frontend-worktree-diff.js";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
+import { normalizeVerdictCandidateLine } from "./dynamic-runtime/shared.js";
 export const FRONTEND_PREWRITE_RESULT_SCHEMA_ID = "frontend-prewrite-result-v1";
 export const FRONTEND_PREWRITE_RESULT_ARTIFACT_NAME = "frontend-prewrite-result.json";
 /** Canonical contract serialization must stay at or below this byte size. */
@@ -39,6 +40,7 @@ export const frontendPrewriteFailureCodeSchema = z.enum([
     "component-spec-not-cited",
     "component-choices-missing",
     "contract-too-large",
+    "revision-patch-unmergeable",
 ]);
 export const frontendPrewriteResultV1Schema = z
     .object({
@@ -171,16 +173,53 @@ async function readNodeRawText(runDir, nodeId) {
     const record = JSON.parse(await readFile(path.join(runDir, `${nodeId}.json`), "utf8"));
     return record.assistantText ?? record.stdout ?? "";
 }
+/**
+ * Same shape predicate as the internal `isContract` inside
+ * `extractFrontendImplementationJson` (frontend-implementation-contract.ts):
+ * schemaVersion 1 + a plain `targets` object + `requirements` and
+ * `verificationTargets` arrays. A merge-patch delta does not carry these
+ * fields, so this is the deterministic boundary between a full contract and a
+ * patch. Keep the two predicates in sync.
+ */
+function isFullContractShape(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    const record = value;
+    const targets = record.targets;
+    return (record.schemaVersion === 1 &&
+        targets !== null &&
+        typeof targets === "object" &&
+        !Array.isArray(targets) &&
+        Array.isArray(record.requirements) &&
+        Array.isArray(record.verificationTargets));
+}
+/**
+ * Shared merge pipeline for revisionPatch mode and content-driven
+ * compatibility: read the original contract node, extract the original
+ * contract and the effective node's patch, apply the RFC 7386 merge-patch, and
+ * serialize deterministically. Throws on any failure; callers map the error to
+ * their own classification (retryable-invalid for explicit revisionPatch mode,
+ * blocked for content-driven fallback).
+ */
+async function mergeRevisionPatch(runDir, planText, originalNodeId) {
+    const originalText = await readNodeText(runDir, originalNodeId);
+    const originalValue = extractFrontendImplementationJson(originalText);
+    const patchValue = extractFrontendImplementationJson(planText);
+    const merged = applyFrontendImplementationContractPatch(originalValue, patchValue);
+    return serializeDeterministicJson(merged);
+}
 function firstNonEmptyVerdictLine(text) {
     const lines = text
         .split(/\r?\n/)
         .map((line) => line.trim())
         .filter(Boolean);
-    const normalize = (line) => {
-        const emphasized = line.match(/^(?:`{1,3}|\*{1,3})\s*(VERDICT:[^`*]+?)\s*(?:`{1,3}|\*{1,3})$/);
-        return (emphasized?.[1] ?? line).trim();
-    };
-    const normalizedLines = lines.map(normalize);
+    // Emphasis stripping (backtick + asterisk) is shared with the runIf
+    // selector and node-level output-protocol validation via
+    // normalizeVerdictCandidateLine. The gate keeps its own loose
+    // pass/request-revision normalization below (prefix match + trailing
+    // prose tolerance) for deterministic fail-closed behavior.
+    const normalizedLines = lines.map(normalizeVerdictCandidateLine);
     const first = normalizedLines[0] ?? "";
     // The prompt requires VERDICT to be the first non-empty line, but model
     // output can still prepend a summary. Keep the protocol strict in the
@@ -459,9 +498,8 @@ export async function runFrontendPrewriteGate(input) {
     let effectiveContractText = null;
     if (revisionPatchMode) {
         const originalNodeId = input.config.planFallbackFromNodeIds[0];
-        let originalText;
         try {
-            originalText = await readNodeText(input.runDir, originalNodeId);
+            effectiveContractText = await mergeRevisionPatch(input.runDir, planText, originalNodeId);
         }
         catch (error) {
             return finalizePrewrite(input, {
@@ -472,35 +510,54 @@ export async function runFrontendPrewriteGate(input) {
                 failureCode: "contract-invalid",
             });
         }
-        let originalValue;
-        let patchValue;
+    }
+    else {
+        // Content-driven compatibility (Bug 1): legacy DAGs without
+        // revisionPatch can still receive a merge-patch delta from the revision
+        // node. Detect the output shape instead of trusting the DAG flag alone.
+        // - Full contract shape → keep legacy full-contract semantics unchanged.
+        // - Patch shape with a usable original contract node → auto-merge and
+        //   run the existing analysis/materialization pipeline.
+        // - Patch shape but unmergeable → blocked + revision-patch-unmergeable
+        //   (no retryable loop).
+        let planJsonValue = null;
         try {
-            originalValue = extractFrontendImplementationJson(originalText);
-            patchValue = extractFrontendImplementationJson(planText);
+            planJsonValue = extractFrontendImplementationJson(planText);
         }
-        catch (error) {
-            return finalizePrewrite(input, {
-                ...basePending,
-                verdict,
-                classification: "retryable-invalid",
-                failureReason: `frontend prewrite gate revisionPatch mode failed to parse contract/patch: ${error instanceof Error ? error.message : String(error)}`,
-                failureCode: "contract-invalid",
-            });
+        catch {
+            // Not machine-readable JSON: fall back to the legacy full-contract
+            // path where analyzeFrontendImplementationContract surfaces the
+            // original diagnostic (fail-closed without a new failure mode).
         }
-        let merged;
-        try {
-            merged = applyFrontendImplementationContractPatch(originalValue, patchValue);
-        }
-        catch (error) {
-            return finalizePrewrite(input, {
-                ...basePending,
-                verdict,
-                classification: "retryable-invalid",
-                failureReason: `frontend prewrite gate revisionPatch apply failed: ${error instanceof Error ? error.message : String(error)}`,
-                failureCode: "contract-invalid",
-            });
+        if (planJsonValue !== null && !isFullContractShape(planJsonValue)) {
+            const originalNodeId = input.config.planFallbackFromNodeIds[0];
+            if (!originalNodeId || originalNodeId === planNodeId) {
+                return finalizePrewrite(input, {
+                    ...basePending,
+                    verdict,
+                    classification: "blocked",
+                    failureReason: "frontend prewrite gate: the effective plan output is a merge-patch delta but no distinct original contract node is available. Check the DAG revisionPatch/planFallbackFromNodeIds configuration or regenerate the DAG.",
+                    failureCode: "revision-patch-unmergeable",
+                });
+            }
+            try {
+                const originalText = await readNodeText(input.runDir, originalNodeId);
+                const originalValue = extractFrontendImplementationJson(originalText);
+                if (!isFullContractShape(originalValue)) {
+                    throw new Error(`original contract node ${originalNodeId} is not a full frontend implementation contract`);
+                }
+                effectiveContractText = await mergeRevisionPatch(input.runDir, planText, originalNodeId);
+            }
+            catch (error) {
+                return finalizePrewrite(input, {
+                    ...basePending,
+                    verdict,
+                    classification: "blocked",
+                    failureReason: `frontend prewrite gate: the effective plan output is a merge-patch delta but it cannot be merged onto the original contract node ${originalNodeId}: ${error instanceof Error ? error.message : String(error)}. Check the DAG revisionPatch/planFallbackFromNodeIds configuration or regenerate the DAG.`,
+                    failureCode: "revision-patch-unmergeable",
+                });
+            }
         }
-        effectiveContractText = serializeDeterministicJson(merged);
     }
     const requirementIdSearchText = effectiveContractText ?? planText;
     const missingIds = input.config.requiredRequirementIds.filter((id) => !requirementIdSearchText.includes(id));

package/dist/workflows/dag/init-hybrid.js

@@ -33,7 +33,7 @@ import { buildBackendTestIntakeContext } from "./backend-test-intake-context.js"
 import { buildFrontendTestOutcomeGateShellSnippet } from "./frontend-test-result-contract.js";
 import { classifyFrontendRisk, } from "./frontend-risk.js";
 import { discoverFrontendProjectCapability, } from "./frontend-project-capability.js";
-import { FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID, loadFrontendImplementationContractJsonSchema, } from "./frontend-implementation-contract.js";
+import { buildFrontendImplementationContractSkeleton, FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID, FRONTEND_IMPLEMENTATION_CONTRACT_PLAN_PATCH_SCHEMA_ID, loadFrontendImplementationContractJsonSchema, } from "./frontend-implementation-contract.js";
 import { serializeDagTaskSourcePath } from "../../task/dag-source-paths.js";
 const REQUIREMENT_FILE = "需求.md";
 const CONSTRAINT_FILE = "执行约束.md";
@@ -2418,33 +2418,21 @@ async function buildFrontendHybridDagFromTask(sources) {
             complexity: taskConfig.complexity,
         });
     const frontendSourceBinding = buildDagSourceBinding(sources);
+    const frontendContractSkeleton = buildFrontendImplementationContractSkeleton({
+        sourceBinding: frontendSourceBinding,
+        riskLevel: frontendRisk.selectedRisk,
+        targetFiles: implementPaths.writeSet,
+    });
     const frontendContractSchemaBlock = (() => {
         const schema = loadFrontendImplementationContractJsonSchema();
-        const requirement = frontendSourceBinding.sources.find((source) => source.kind === "requirement");
-        if (!requirement) {
-            throw new Error("frontend implementation contract context requires a bound requirement source");
-        }
-        const referencePaths = frontendSourceBinding.sources
-            .filter((s) => s.kind === "reference")
-            .map((s) => s.path);
-        const fixedFields = {
-            schemaVersion: 1,
-            sourceBinding: {
-                taskId: frontendSourceBinding.taskId,
-                requirementPath: requirement.path,
-                requirementSha256: requirement.sha256,
-                referencePaths,
-                requirementIds: frontendSourceBinding.requirementIds,
-            },
-            riskLevel: frontendRisk.selectedRisk,
-            targets: { files: implementPaths.writeSet },
-        };
         return [
-            `## ${FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID} JSON Schema (authoritative; do not guess fields)`,
+            `## Final ${FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID} JSON Schema (authoritative after runtime merge)`,
             schema,
             "",
-            "## Fixed contract fields (deterministic; copy exactly and do not modify)",
-            JSON.stringify(fixedFields),
+            "## Runtime contract skeleton (deterministic and protected)",
+            JSON.stringify(frontendContractSkeleton),
+            "",
+            "The initial planner emits an editable RFC 7386 patch against this skeleton. It MUST omit schemaVersion, sourceBinding, riskLevel, targets.files, and mockApi.productionDefaultOff. The runtime merges and validates the final contract, then replaces the planner output with canonical full-contract JSON for downstream review.",
             "",
             "## Forbidden fields (these are NOT in the schema; do not emit)",
             "- schemaId",
@@ -2796,20 +2784,22 @@ async function buildFrontendHybridDagFromTask(sources) {
                 outputMode: "structured-required",
                 retryPolicy: STRUCTURED_REQUIRED_PI_RETRY_POLICY,
                 structuredContractOutput: {
-                    schemaId: "frontend-implementation-contract-v1",
+                    schemaId: FRONTEND_IMPLEMENTATION_CONTRACT_PLAN_PATCH_SCHEMA_ID,
                     retryOnInvalid: true,
+                    skeleton: frontendContractSkeleton,
                 },
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
                 skills: FRONTEND_IMPLEMENTATION_SKILLS,
-                outputContract: "One-line lead-in, then exactly ONE fenced json object (```json ... ```) conforming to frontend-implementation-contract-v1. This fenced block is the single authoritative implementation contract the prewrite gate materializes; it must appear exactly once. Immediately after it, append exactly one ```openspec-citations``` fenced citation block. Do NOT emit a Markdown plan explanation or any prose after the contract JSON — the output is JSON-only (the gate renders plan.md deterministically). Apart from the contract JSON fenced block and the openspec-citations block, do not emit any other fenced block or raw JSON. No file writes.",
+                outputContract: "JSON-only patch output: one-line lead-in, then exactly ONE fenced json object (```json ... ```) containing only the editable RFC 7386 plan patch for the runtime contract skeleton. Omit protected fields: schemaVersion, sourceBinding, riskLevel, targets.files, and mockApi.productionDefaultOff. Immediately after it, append exactly one ```openspec-citations``` fenced citation block. The runtime applies the patch, validates it, and promotes canonical full-contract JSON for downstream review. Do NOT emit a full contract, Markdown plan explanation, raw JSON, or any other fenced block. No file writes.",
                 subtask_prompt: [
-                    "Based on frontend-contract-pi, frontend-scout-pi, task sources, and the generation-time Mock capability evidence, return a minimal frontend implementation plan.",
-                    "Select the Mock / API strategy inside the plan and structured contract. Carry endpoint/fixture mapping, explicit activation, production-default-off rule, verification commands, and Real Integration Gap into both outputs.",
+                    "Use frontend-contract-pi, frontend-scout-pi, task sources, and the generation-time Mock capability evidence to fill the runtime-owned frontend contract skeleton. Return JSON-only output containing only an editable RFC 7386 plan patch. The runtime already owns schemaVersion, sourceBinding, riskLevel, targets.files, and mockApi.productionDefaultOff; omit those protected paths even when their values look obvious.",
+                    "The patch fields become the complete implementation plan after deterministic merge. Do not produce a separate plan document, prose mirror, or full contract.",
+                    "Select the Mock / API strategy only in the patch. Encode endpoint/fixture mapping, explicit activation, verification commands, and Real Integration Gap in schema-defined editable fields; productionDefaultOff comes from the protected skeleton and there is no second plan output.",
                     "Encode ordered steps (implementationSteps), target files, UI state handling, styling/component strategy (stylingStrategy), interaction notes, Mock/API strategy, dependency policy (dependencyPolicy), deterministic verification entrypoints, Real Integration Gap (realIntegrationGap), and residual risks (residualRisks) into the contract JSON fields. Use only the fixed entrypoints below; implementation may add tests behind them but cannot replace them.",
                     "Every target file and verification target must be selected from the current target workspace and task scope. Do not reuse paths or symbols from examples, prior tasks, or loop-agent itself; if the project uses app/, packages/, spec/, __tests__, or another layout, preserve that layout.",
                     "Consume the Scout TARGET_SURFACE evidence before selecting files. Preserve the discovered existing entrypoint and data source. If implementationPaths or testPaths are outside task allowedPaths, record a blocking scope conflict; do not substitute a new page or silently broaden the writeSet.",
-                    "Output in this exact order: (1) exactly one fenced json object conforming to frontend-implementation-contract-v1 — this fenced block is the single authoritative contract the prewrite gate materializes; (2) exactly one openspec-citations citation fenced block appended immediately after it. Do NOT emit a Markdown plan explanation or any prose after the contract JSON — the output is JSON-only. Do not emit any raw JSON or JSON objects in prose. Apart from the single contract JSON fenced block and the openspec-citations block, do not emit any other fenced block.",
+                    "Output in this exact order: (1) exactly one fenced json object containing the editable plan patch; (2) exactly one openspec-citations citation fenced block appended immediately after it. Do NOT emit protected skeleton fields, a full contract, Markdown plan explanation, raw JSON, or any other fenced block.",
                     "Each requirement must state its user-observable or logic-observable expectedOutcome. Each interaction must state its trigger and expectedBehavior. IDs plus file paths are not sufficient behavior semantics.",
                     requirementCoverageInstruction,
                     "verificationTargets[].commandLabel MUST be one of the frozen command labels listed above. Any other value will be rejected at contract materialization.",
@@ -2837,7 +2827,7 @@ async function buildFrontendHybridDagFromTask(sources) {
                 outputProtocol: REVIEW_VERDICT_OUTPUT_PROTOCOL,
                 outputContract: "Plain Markdown whose first non-empty line is VERDICT: pass or VERDICT: request-revision, followed by Findings, Required Plan Corrections, and Checked Items. No file writes.",
                 subtask_prompt: [
-                    "Audit the frontend plan before implementation. Consume the contract JSON (the single fenced json block from frontend-plan-pi); there is no separate plan prose.",
+                    "Audit the frontend plan before implementation. frontend-plan-pi is emitted to you as canonical full-contract JSON after the runtime applied and validated the planner's editable patch against its protected skeleton; there is no separate plan prose.",
                     "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.",
                     "Request revision when the Mock strategy is MOCK_STRATEGY: blocked, missing, unsupported by repository evidence, inconsistent with the API contract, outside authorized paths/dependencies, unable to prove production-default-off behavior with the fixed production/default-real-path static check, or missing deterministic behavior verification for a declared behavior target or selected Mock strategy. Mock strategies require Mock-backed evidence. A static-only contract is allowed only when every verification target is static and maps to a declared static entrypoint. not-needed otherwise requires applicable real/no-remote behavior evidence unless auto mode explicitly skipped Mock because no project Mock capability exists; in that case the plan must preserve the real request path and record the Real Integration Gap.",
                     "Also request revision for missing applicable UI states, unsupported dependency additions, design-system drift without reason, weak interaction coverage, broad scope, inline fake data, schema drift, or missing deterministic verification commands.",
@@ -2870,7 +2860,7 @@ async function buildFrontendHybridDagFromTask(sources) {
                 subtask_prompt: [
                     "Consume frontend-plan-pi (original contract JSON) and frontend-design-review-pi (first design review findings).",
                     "This node runs only when frontend-design-review-pi emitted VERDICT: request-revision. Produce an RFC 7386 merge-patch delta against the original contract JSON that addresses every Required Plan Correction from the design findings.",
-                    "The patch delta may update any of these contract fields: requirements, implementationSteps, targets, uiStates, interactions, mockApi, dependencyPolicy, stylingStrategy, uiComponentChoices, verificationTargets, evidenceGaps, residualRisks, realIntegrationGap. Only include fields you change; omit unchanged fields (the gate applies the patch on the original contract). null deletes a key; arrays and scalars replace; plain objects merge recursively.",
+                    "The patch delta may update editable contract fields such as requirements, implementationSteps, targets.routes/publicApiChanges, uiStates, interactions, mockApi.strategy/activation/endpoints, dependencyPolicy, stylingStrategy, uiComponentChoices, verificationTargets, evidenceGaps, residualRisks, and realIntegrationGap. It must not modify protected schemaVersion, sourceBinding, riskLevel, targets.files, or mockApi.productionDefaultOff. Only include fields you change; omit unchanged fields (the gate applies the patch on the original contract). null deletes a key; arrays and scalars replace; plain objects merge recursively.",
                     requirementCoverageInstruction,
                     "Do not turn MOCK_STRATEGY: blocked into an implementable strategy without new repository or contract evidence that resolves every blocker.",
                     "Read-only: do not modify code, docs, artifacts, or repository files. This node revises the plan only.",