@tea-agent/loop-agent 0.41.1-beta.0 → 0.42.0-next.2

package/dist/workflows/dag/types.js

@@ -1,13 +1,8 @@
 import { z } from "zod";
-import { DEFAULT_FRONTEND_SPEC_ROOTS, isFrontendSpecFilePath, isValidFrontendSpecRoot, OPENSPEC_SPEC_EXT_RE, } from "../../shared/openspec-spec.js";
+import { isOpenspecSpecFilePath } from "../../shared/openspec-spec.js";
 import { campaignBudgetSchema, } from "../../application/evaluation/budget.js";
 import { assertDagPromptSourceRule } from "./prompt-source.js";
-// Leaf-module import: dagRetryPolicySchema must be defined by a module that
-// never transitively reaches types.ts during init (retry-policy does, via
-// frontend-recovery-capsule → frontend-recovery-lineage →
-// frontend-implementation-contract), or a run whose entry module initializes
-// retry-policy first reads an undefined schema here.
-import { dagRetryPolicySchema, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, } from "./dag-retry-schema.js";
+import { dagRetryPolicySchema, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, } from "./retry-policy.js";
 import { dagLivenessPolicySchema, } from "./liveness-policy.js";
 import { dagOutputProtocolSchema } from "./output-protocol.js";
 export const dagComplexitySchema = z.enum(["HIGH", "MED", "LOW"]);
@@ -85,7 +80,10 @@ export const dagShellVerifyEvidenceSchema = z.object({
     selectionReasons: z.array(z.string()).default([]),
     /** Non-executing generation-time cwd/local-script validation evidence. */
     preflight: z
-        .array(z.object({ label: z.string(), status: z.enum(["ok", "future-delivery-script"]) }))
+        .array(z.object({
+        label: z.string(),
+        status: z.enum(["ok", "future-delivery-script"]),
+    }))
         .default([]),
     /** Effective timeout applied independently to each shell command. */
     commandTimeoutMs: z.number().int().positive().optional(),
@@ -190,16 +188,7 @@ const dagFrontendNodeIdSchema = z
     .regex(/^[a-z][a-z0-9-]*$/, "frontend node id must be kebab-case");
 const openspecCandidatePathSchema = z
     .string()
-    .refine((candidate) => !candidate.includes("\\") &&
-    !candidate.startsWith("/") &&
-    !candidate.split("/").includes("..") &&
-    OPENSPEC_SPEC_EXT_RE.test(candidate), "openspec candidate must be a repo-relative supported specification file");
-const openspecCandidateSnapshotSchema = z
-    .object({
-    path: openspecCandidatePathSchema,
-    sha256: z.string().regex(/^[a-f0-9]{64}$/),
-})
-    .strict();
+    .refine((candidate) => !candidate.includes("\\") && isOpenspecSpecFilePath(candidate), "openspec candidate must be a repo-relative supported file under openspec/schemas/, openspec/project-specs/, or ai_workspace/");
 export const dagFrontendPrewriteGateSchema = z.object({
     schemaVersion: z.literal(1),
     planFromNodeId: dagFrontendNodeIdSchema,
@@ -218,24 +207,7 @@ export const dagFrontendPrewriteGateSchema = z.object({
     outputDir: z.string().regex(/^[a-z0-9][a-z0-9._-]*$/),
     requireSourceFreshness: z.literal(true),
     implementationWriteSet: z.array(z.string().min(1)).min(1).optional(),
-    /**
-     * Generation-frozen roots that bound custom normative directories. Omitted
-     * legacy DAGs retain the canonical OpenSpec + ai_workspace roots.
-     */
-    openspecSpecRoots: z
-        .array(z.string().refine((root) => isValidFrontendSpecRoot(root), "openspec spec root must be a normalized repo-relative directory"))
-        .optional(),
     openspecCandidatePaths: z.array(openspecCandidatePathSchema).default([]),
-    /** Read-only selector output; omitted for scan-strict and legacy DAGs. */
-    openspecSelectionNodeId: dagFrontendNodeIdSchema.optional(),
-    /** Contract-declared and source-explicit paths that cannot be downgraded. */
-    openspecMandatoryPaths: z.array(openspecCandidatePathSchema).optional(),
-    /**
-     * Content fingerprints frozen with the generation-time OpenSpec scope. New
-     * DAGs use these to reject a plan whose cited specification changed after it
-     * was read; legacy DAGs without the field retain existence-only drift checks.
-     */
-    openspecCandidateSnapshots: z.array(openspecCandidateSnapshotSchema).optional(),
     /**
      * Generation-frozen component/theme specification bucket. Derived from
      * `designEvidence.classified.component ∪ theme ∪ rule.components` at DAG
@@ -280,28 +252,14 @@ export const dagFrontendPrewriteGateSchema = z.object({
         scanStrict: z.array(openspecCandidatePathSchema).default([]),
     })
         .optional(),
-}).superRefine((gate, context) => {
-    const roots = gate.openspecSpecRoots ?? DEFAULT_FRONTEND_SPEC_ROOTS;
-    const candidateGroups = [
-        ["openspecCandidatePaths", gate.openspecCandidatePaths],
-        ["openspecMandatoryPaths", gate.openspecMandatoryPaths],
-        ["componentSpecCandidatePaths", gate.componentSpecCandidatePaths],
-        ["openspecCandidateSources.declared", gate.openspecCandidateSources?.declared],
-        ["openspecCandidateSources.taskSourceCited", gate.openspecCandidateSources?.taskSourceCited],
-        ["openspecCandidateSources.scanStrict", gate.openspecCandidateSources?.scanStrict],
-    ];
-    for (const [field, paths] of candidateGroups) {
-        for (const [index, candidate] of (paths ?? []).entries()) {
-            if (!isFrontendSpecFilePath(candidate, roots)) {
-                context.addIssue({
-                    code: z.ZodIssueCode.custom,
-                    path: [...field.split("."), index],
-                    message: "openspec candidate must be a supported file under the generation-frozen openspec spec roots",
-                });
-            }
-        }
-    }
 });
+export const dagFrontendLintBaselineSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    lintCommands: z.array(z.string().min(1)).min(1),
+    lintEvidence: dagShellVerifyEvidenceSchema,
+})
+    .strict();
 export const dagFrontendVerificationBundleSchema = z
     .object({
     schemaVersion: z.literal(1),
@@ -315,10 +273,6 @@ export const dagFrontendVerificationBundleSchema = z
     behaviorEvidence: dagShellVerifyEvidenceSchema,
     lintBaselineNodeId: dagFrontendNodeIdSchema.optional(),
     writerNodeIds: z.array(dagFrontendNodeIdSchema).optional(),
-    /** "initial" = first-pass assess bundle; "repair" = the convergence
-     * loop's post-repair reverify, which re-runs the same frozen commands
-     * and fails on any failure (still no same-run repair branch inside the
-     * node itself). */
     mode: z.enum(["initial", "repair"]),
 })
     .superRefine((bundle, context) => {
@@ -394,135 +348,6 @@ export const dagFrontendReviewContextSchema = z.object({
     schemaVersion: z.literal(1),
     requireBaseline: z.literal(true),
 });
-/**
- * Deterministic frontend contract-import shell (micro topology). Re-validates
- * the generation-frozen managed Contract's source/binding/schema freshness and
- * emits a digest. It never invokes a model and never rewrites requirements —
- * micro requires a pre-validated managed Contract, not natural-language intake.
- */
-export const dagFrontendContractImportSchema = z.object({
-    schemaVersion: z.literal(1),
-    artifactName: z.string().regex(/^[a-z0-9][a-z0-9._-]*\.json$/),
-    outputDir: z.string().regex(/^[a-z0-9][a-z0-9._-]*$/),
-    requireSourceFreshness: z.literal(true),
-});
-/**
- * Deterministic frontend design-policy shell (M8). Materializes the canonical
- * implementation contract from the plan node and evaluates the design policy
- * (Mock strategy, source freshness, component spec candidates, writeSet
- * patterns, allowed dependencies). Runs BEFORE frontend-design-review-pi, so it
- * never consumes a design verdict; the verdict is enforced by the writer
- * admission shell instead. Replaces the prewrite-gate authorization path.
- */
-export const dagFrontendDesignPolicySchema = z
-    .object({
-    schemaVersion: z.literal(1),
-    planFromNodeId: dagFrontendNodeIdSchema,
-    requiredRequirementIds: z
-        .array(z.string().regex(/^(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*$/))
-        .default([]),
-    allowedMockStrategies: z
-        .array(z.enum(["native", "browser-intercept", "request-adapter", "not-needed"]))
-        .min(1),
-    /** Frozen Mock verification command labels the DAG will actually execute. */
-    mockCommandLabels: z.array(z.string()).default([]),
-    artifactName: z.string().regex(/^[a-z0-9][a-z0-9._-]*\.json$/),
-    outputDir: z.string().regex(/^[a-z0-9][a-z0-9._-]*$/),
-    requireSourceFreshness: z.literal(true),
-    implementationWriteSet: z.array(z.string().min(1)).min(1).optional(),
-    /** Generation-frozen roots that bound custom normative directories. */
-    openspecSpecRoots: z
-        .array(z.string().refine((root) => isValidFrontendSpecRoot(root), "openspec spec root must be a normalized repo-relative directory"))
-        .optional(),
-    openspecCandidatePaths: z.array(openspecCandidatePathSchema).default([]),
-    /** Read-only selector output; omitted for scan-strict and legacy DAGs. */
-    openspecSelectionNodeId: dagFrontendNodeIdSchema.optional(),
-    /** Contract-declared and source-explicit paths that cannot be downgraded. */
-    openspecMandatoryPaths: z.array(openspecCandidatePathSchema).optional(),
-    openspecCandidateSnapshots: z
-        .array(openspecCandidateSnapshotSchema)
-        .optional(),
-    /**
-     * Generation-frozen component/theme specification bucket. Derived from
-     * `designEvidence.classified.component ∪ theme ∪ rule.components` at DAG
-     * generation. When non-empty and the canonical contract has UI-visible
-     * work, the design policy requires a non-empty `uiComponentChoices` and
-     * cross-checks each `specReference.path` against this set + the effective
-     * plan openspec-citations block.
-     */
-    componentSpecCandidatePaths: z.array(openspecCandidatePathSchema).optional(),
-    /** OpenSpec gate policy (cited | scan-strict); generation always writes it. */
-    openspecPolicy: z.enum(["cited", "scan-strict"]).optional(),
-    /** Generation-frozen candidate source metadata (diagnostic). */
-    openspecCandidateSources: z
-        .object({
-        declared: z.array(openspecCandidatePathSchema).default([]),
-        taskSourceCited: z.array(openspecCandidatePathSchema).default([]),
-        scanStrict: z.array(openspecCandidatePathSchema).default([]),
-    })
-        .optional(),
-    /** Dependency identifiers authorized at generation time (empty = none). */
-    allowedDependencies: z.array(z.string()).default([]),
-})
-    .superRefine((gate, context) => {
-    const roots = gate.openspecSpecRoots ?? DEFAULT_FRONTEND_SPEC_ROOTS;
-    const candidateGroups = [
-        ["openspecCandidatePaths", gate.openspecCandidatePaths],
-        ["openspecMandatoryPaths", gate.openspecMandatoryPaths],
-        ["componentSpecCandidatePaths", gate.componentSpecCandidatePaths],
-        ["openspecCandidateSources.declared", gate.openspecCandidateSources?.declared],
-        ["openspecCandidateSources.taskSourceCited", gate.openspecCandidateSources?.taskSourceCited],
-        ["openspecCandidateSources.scanStrict", gate.openspecCandidateSources?.scanStrict],
-    ];
-    for (const [field, paths] of candidateGroups) {
-        for (const [index, candidate] of (paths ?? []).entries()) {
-            if (!isFrontendSpecFilePath(candidate, roots)) {
-                context.addIssue({
-                    code: z.ZodIssueCode.custom,
-                    path: [...field.split("."), index],
-                    message: "openspec candidate must be a supported file under the generation-frozen openspec spec roots",
-                });
-            }
-        }
-    }
-});
-/**
- * Deterministic frontend writer-admission shell (M8). Runs after
- * frontend-design-review-pi: freezes the writer baseline, derives the concrete
- * writeSet, folds the design-policy result + design verdict into admission,
- * and writes contracts/frontend-writer-admission-result.json
- * (schemaId frontend-writer-admission-shell-v1).
- */
-export const dagFrontendWriterAdmissionShellSchema = z
-    .object({
-    schemaVersion: z.literal(1),
-    /** Design verdict source (frontend-design-review-pi); pass is enforced.
-     * Omitted in small topology, which has no design review node. */
-    designReviewFromNodeId: dagFrontendNodeIdSchema.optional(),
-    /** Frozen command labels the verification bundle will execute. */
-    frozenCommandLabels: z.array(z.string()).default([]),
-    allowedMockStrategies: z
-        .array(z.enum(["native", "browser-intercept", "request-adapter", "not-needed"]))
-        .min(1),
-    /** Writer-preceding lint commands; baseline is materialized here (R5). */
-    lintCommands: z.array(z.string().min(1)).optional(),
-    lintEvidence: dagShellVerifyEvidenceSchema.optional(),
-})
-    .superRefine((admission, context) => {
-    if ((admission.lintCommands?.length ?? 0) > 0 && !admission.lintEvidence) {
-        context.addIssue({
-            code: z.ZodIssueCode.custom,
-            path: ["lintEvidence"],
-            message: "lintEvidence is required when lintCommands are present",
-        });
-    }
-});
-/** Deterministic frontend closeout shell (M8). Renders the closeout from
- * committed facts only (review context + typed review terminal + trace). */
-export const dagFrontendCloseoutSchema = z.object({
-    schemaVersion: z.literal(1),
-    reviewFromNodeId: dagFrontendNodeIdSchema,
-});
 export const ENV_VAR_NAME_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
 export const dagVersionSchema = z
     .union([z.literal(1), z.literal(2), z.literal(3), z.literal(4)])
@@ -570,14 +395,7 @@ export const dagWriteGuardPolicySchema = z.enum(["full", "tools-only", "filesyst
  */
 export const dagWriterOutcomePolicySchema = z
     .object({
-    /**
-     * Protocol face: `implementation-outcome-v1` keeps the legacy
-     * IMPLEMENTATION_OUTCOME first-line protocol (backend/README/module
-     * writers + frontend-repair-pi); `frontend-facts-v1` derives the status
-     * from mechanical facts (write-tool events / run delta / write guard /
-     * requirement coverage / focused-check) and never reads the first line.
-     */
-    type: z.enum(["implementation-outcome-v1", "frontend-facts-v1"]),
+    type: z.literal("implementation-outcome-v1"),
     /** Generation writers may forbid already-satisfied/no-diff completion. */
     requireChangedFiles: z.boolean().optional(),
 })
@@ -710,13 +528,10 @@ export const dagShellConfigSchema = z.object({
         .optional(),
     requirementCoverageGate: dagRequirementCoverageGateSchema.optional(),
     jsonArtifactGate: dagJsonArtifactGateSchema.optional(),
-    frontendDesignPolicy: dagFrontendDesignPolicySchema.optional(),
-    frontendWriterAdmission: dagFrontendWriterAdmissionShellSchema.optional(),
     frontendPrewriteGate: dagFrontendPrewriteGateSchema.optional(),
+    frontendLintBaseline: dagFrontendLintBaselineSchema.optional(),
     frontendVerificationBundle: dagFrontendVerificationBundleSchema.optional(),
     frontendReviewContext: dagFrontendReviewContextSchema.optional(),
-    frontendContractImport: dagFrontendContractImportSchema.optional(),
-    frontendCloseout: dagFrontendCloseoutSchema.optional(),
     frontendTestCaseChecklist: dagFrontendTestCaseChecklistSchema.optional(),
     frontendBrowserToolPreflight: dagFrontendBrowserToolPreflightSchema.optional(),
     frontendTestStandardScenarios: dagFrontendTestStandardScenariosSchema.optional(),
@@ -922,7 +737,58 @@ export const structuredContractOutputSchemaIds = [
     "frontend-implementation-contract-plan-patch-v1",
     "frontend-implementation-contract-revision-patch-v1",
 ];
-export const dagTaskSchema = z.object({ id: z.string().regex(/^[a-z][a-z0-9-]*$/, "task id must be kebab-case"),
+export const dagArtifactIdentitySchema = z
+    .string()
+    .regex(/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/, "artifact id must be stable lower-case dot/kebab syntax");
+const dagArtifactRelativePathSchema = z
+    .string()
+    .min(1)
+    .refine((value) => !value.includes("\0"), "artifact path must not contain NUL")
+    .refine((value) => !value.includes("\\"), "artifact path must use POSIX separators")
+    .refine((value) => !value.startsWith("/") && !/^[A-Za-z]:/.test(value), "artifact path must be run-relative")
+    .refine((value) => value.split("/").every((segment) => segment !== "" && segment !== ".."), "artifact path must not escape the run");
+export const dagProducedArtifactSchema = z
+    .object({
+    artifactId: dagArtifactIdentitySchema,
+    kind: z.enum(["structured", "assistant", "stdout"]),
+    path: dagArtifactRelativePathSchema,
+    mediaType: z.string().min(1),
+    schemaId: z.string().min(1).optional(),
+    revisionPolicy: z.enum(["immutable", "replace-file"]),
+})
+    .strict()
+    .superRefine((value, ctx) => {
+    if (value.kind === "structured" && !value.schemaId) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["schemaId"],
+            message: "structured artifact requires schemaId",
+        });
+    }
+    if (value.kind !== "structured" && value.schemaId) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["schemaId"],
+            message: "only structured artifacts may declare schemaId",
+        });
+    }
+    if (value.revisionPolicy === "replace-file" &&
+        value.kind !== "structured") {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["revisionPolicy"],
+            message: "MVP revisions are limited to structured artifacts",
+        });
+    }
+});
+export const dagConsumedArtifactSchema = z
+    .object({
+    artifactId: dagArtifactIdentitySchema,
+    required: z.boolean().default(true),
+})
+    .strict();
+export const dagTaskSchema = z.object({
+    id: z.string().regex(/^[a-z][a-z0-9-]*$/, "task id must be kebab-case"),
     depends_on: z.array(z.string()).default([]),
     /**
      * How SKIPPED upstreams affect readiness.
@@ -955,19 +821,6 @@ export const dagTaskSchema = z.object({ id: z.string().regex(/^[a-z][a-z0-9-]*$/
     role: dagRoleSchema.optional(),
     skills: z.array(z.string()).optional(),
     toolProfile: dagToolProfileSchema.optional(),
-    /** Bounded read-only discovery budget for nodes that inspect a repository. */
-    readBudget: z
-        .object({
-        maxFiles: z.number().int().positive(),
-        maxBytes: z.number().int().positive(),
-        maxMs: z.number().int().positive().optional(),
-        /** Maximum read/grep/find/ls calls. */
-        maxOperations: z.number().int().positive().optional(),
-        /** On any read budget exhaustion, return concise completion guidance instead of failing the node. */
-        onExhaustion: z.enum(["return-guidance"]).optional(),
-    })
-        .strict()
-        .optional(),
     /**
      * Explicit Pi extension allowlist (backend implementation DAGs only):
      * frozen short ids resolved at run time against the Pi settings package
@@ -998,6 +851,15 @@ export const dagTaskSchema = z.object({ id: z.string().regex(/^[a-z][a-z0-9-]*$/
     shell: dagShellConfigSchema.optional(),
     static: dagStaticConfigSchema.optional(),
     outputContract: z.string().optional(),
+    /**
+     * Frozen producer declarations for run-owned artifacts. These declarations,
+     * together with consumesArtifacts, are the only authority for artifact
+     * lineage and impact analysis. Prompt/outputContract/path heuristics are
+     * intentionally forbidden.
+     */
+    producesArtifacts: z.array(dagProducedArtifactSchema).optional(),
+    /** Frozen logical artifact inputs consumed by this node. */
+    consumesArtifacts: z.array(dagConsumedArtifactSchema).optional(),
     outputMode: dagOutputModeSchema.optional(),
     firstProtocolLine: z.string().min(1).optional(),
     /**
@@ -1026,8 +888,7 @@ export const dagTaskSchema = z.object({ id: z.string().regex(/^[a-z][a-z0-9-]*$/
     })
         .strict()
         .superRefine((value, ctx) => {
-        if (value.schemaId ===
-            "frontend-implementation-contract-plan-patch-v1" &&
+        if (value.schemaId === "frontend-implementation-contract-plan-patch-v1" &&
             !value.skeleton) {
             ctx.addIssue({
                 code: "custom",
@@ -1082,6 +943,121 @@ export const dagTaskSchema = z.object({ id: z.string().regex(/^[a-z][a-z0-9-]*$/
     dynamicCondition: dagDynamicConditionSchema.optional(),
     dynamicLoopUntil: dagDynamicLoopUntilSchema.optional(),
 });
+function hasTransitiveDependency(tasksById, consumerNodeId, producerNodeId) {
+    const queue = [...(tasksById.get(consumerNodeId)?.depends_on ?? [])];
+    const seen = new Set();
+    while (queue.length > 0) {
+        const nodeId = queue.shift();
+        if (nodeId === producerNodeId)
+            return true;
+        if (seen.has(nodeId))
+            continue;
+        seen.add(nodeId);
+        queue.push(...(tasksById.get(nodeId)?.depends_on ?? []));
+    }
+    return false;
+}
+function validateFrozenArtifactBindings(tasks, ctx) {
+    const tasksById = new Map(tasks.map((task) => [task.id, task]));
+    const producers = new Map();
+    const paths = new Map();
+    for (const [taskIndex, task] of tasks.entries()) {
+        const localIds = new Set();
+        for (const [artifactIndex, artifact] of (task.producesArtifacts ?? []).entries()) {
+            if (localIds.has(artifact.artifactId) ||
+                producers.has(artifact.artifactId)) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path: [
+                        "tasks",
+                        taskIndex,
+                        "producesArtifacts",
+                        artifactIndex,
+                        "artifactId",
+                    ],
+                    message: `artifact ${artifact.artifactId} must have exactly one producer`,
+                });
+            }
+            else {
+                producers.set(artifact.artifactId, {
+                    nodeId: task.id,
+                    taskIndex,
+                    artifactIndex,
+                    path: artifact.path,
+                });
+            }
+            localIds.add(artifact.artifactId);
+            const foldedPath = artifact.path
+                .normalize("NFC")
+                .toLocaleLowerCase("en-US");
+            const existingArtifactId = paths.get(foldedPath);
+            if (existingArtifactId && existingArtifactId !== artifact.artifactId) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path: [
+                        "tasks",
+                        taskIndex,
+                        "producesArtifacts",
+                        artifactIndex,
+                        "path",
+                    ],
+                    message: `artifact path collides with ${existingArtifactId} under case folding`,
+                });
+            }
+            else {
+                paths.set(foldedPath, artifact.artifactId);
+            }
+        }
+    }
+    for (const [taskIndex, task] of tasks.entries()) {
+        const consumed = new Set();
+        for (const [artifactIndex, binding] of (task.consumesArtifacts ?? []).entries()) {
+            if (consumed.has(binding.artifactId)) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path: [
+                        "tasks",
+                        taskIndex,
+                        "consumesArtifacts",
+                        artifactIndex,
+                        "artifactId",
+                    ],
+                    message: `artifact ${binding.artifactId} is consumed more than once by ${task.id}`,
+                });
+            }
+            consumed.add(binding.artifactId);
+            const producer = producers.get(binding.artifactId);
+            if (!producer) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path: [
+                        "tasks",
+                        taskIndex,
+                        "consumesArtifacts",
+                        artifactIndex,
+                        "artifactId",
+                    ],
+                    message: `artifact ${binding.artifactId} has no declared producer`,
+                });
+                continue;
+            }
+            if (producer.nodeId === task.id ||
+                !hasTransitiveDependency(tasksById, task.id, producer.nodeId)) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    path: [
+                        "tasks",
+                        taskIndex,
+                        "consumesArtifacts",
+                        artifactIndex,
+                        "artifactId",
+                    ],
+                    message: `consumer ${task.id} must be downstream of producer ${producer.nodeId}`,
+                });
+            }
+        }
+    }
+}
 export const dagModelsSchema = z
     .object({
     HIGH: z.string().optional(),
@@ -1111,9 +1087,7 @@ export const dagBudgetSchema = campaignBudgetSchema;
 export const dagSourceBindingSourceSchema = z.object({
     kind: z.enum(["requirement", "constraint", "reference"]),
     path: z.string().min(1),
-    sha256: z
-        .string()
-        .regex(/^[a-f0-9]{64}$/, "sha256 must be lowercase hex"),
+    sha256: z.string().regex(/^[a-f0-9]{64}$/, "sha256 must be lowercase hex"),
 });
 /**
  * DagSourceBinding v1：无 ledger 字段（schemaVersion=1，.strict() 拒绝 ledger
@@ -1215,22 +1189,6 @@ export const dagSpecSchema = z
     taskContractBinding: dagTaskContractBindingSchema.optional(),
     /** Optional unresolved parent-run feedback for a full task rerun. */
     rerunFeedback: dagRerunFeedbackSchema.optional(),
-    /** Frontend recovery continuation quota (frozen at generation time from
-     * task.json frontendRecovery.maxContinuations). Bounds how many times a
-     * failed frontend run may auto-recover via M6 recovery operations before
-     * the run stays failed and needs human intervention. */
-    frontendRecovery: z
-        .object({
-        maxContinuations: z
-            .number()
-            .int()
-            .min(1)
-            .max(5)
-            .optional()
-            .default(1),
-    })
-        .strict()
-        .optional(),
     /** Backend-test-only workspace mutation control; absent means Git. */
     backendTestWorkspaceControl: z.enum(["git", "filesystem-only"]).optional(),
     /** Frozen backend-test artifact layout (plan A); absent = historical default testcase/ layout. */
@@ -1280,6 +1238,7 @@ export const dagSpecSchema = z
 })
     .superRefine((spec, ctx) => {
     const supportsV3Fields = spec.version === 3 || spec.version === 4;
+    validateFrozenArtifactBindings(spec.tasks, ctx);
     if (spec.evaluation && !supportsV3Fields) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
@@ -1356,9 +1315,6 @@ export const FRONTEND_RECOVERY_RESULT_SCHEMA_VERSION = 1;
  * Phase 3a parents converge first, so `rollback-pending` is not produced and
  * was removed by AC-1; the phase starts at `child-staging` and ends at
  * `settled`.
- *
- * @deprecated Read-only compatibility only; the M6 operation controller no
- * longer uses this phase as the authoritative recovery entry point.
  */
 export const frontendRecoveryPhaseSchema = z.enum([
     "child-staging",
@@ -1378,9 +1334,6 @@ export const frontendRecoveryPhaseSchema = z.enum([
  * runner's `(existing?.revision ?? 0) + 1` CAS write (the schema only bounds it
  * non-negative). `childRunId` may be absent through `child-activating` and must
  * be non-empty from `child-running` onward.
- *
- * @deprecated Read-only compatibility only; the runner no longer writes this
- * intent (the M6 operation controller supervises recovery instead).
  */
 export const frontendRecoveryStateSchema = z
     .object({
@@ -1452,10 +1405,6 @@ export const frontendRecoveryEvidenceRefSchema = z
  * stays permissive (failureClass optional, evidenceRefs may be empty) so it
  * accepts the runner's actual phase-3a products, which do not always carry a
  * failure class or evidence reference.
- *
- * @deprecated Read-only compatibility only; the M6 operation controller writes
- * `recovered`/`auto-recovery-blocked` results directly and never uses this
- * schema as the authoritative recovery settlement.
  */
 export const frontendRecoveryResultSchema = z
     .object({

package/dist/workflows/dag/validate.js

@@ -3,7 +3,7 @@ import { resolveShellCommands } from "../../executors/shell-executor.js";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
 import { resolveRepairTaskForGate } from "./repair-artifact.js";
 import { topoSortToRanks } from "./topo.js";
-import { isSafeReadOnlyPiRetryCandidate, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, CONTEXT_OVERFLOW_RETRY_CATEGORY, } from "./retry-policy.js";
+import { isSafeReadOnlyPiRetryCandidate, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, } from "./retry-policy.js";
 import { isBackendTestCompletenessRetryCandidate } from "./backend-test-writer-completeness.js";
 import { defaultFrontendTestLayout, frontendTestLayoutFromSpec, } from "./frontend-test-layout.js";
 const GOVERNANCE_WARNING_TYPES = new Set([
@@ -464,9 +464,7 @@ function validateShellTaskConfig(task, spec, issues) {
     if (commands.length === 0 &&
         !shell.jsonArtifactGate &&
         !shell.backendTestPipeline &&
-        !shell.frontendDesignPolicy &&
-        !shell.frontendWriterAdmission &&
-        !shell.frontendCloseout &&
+        !shell.frontendPrewriteGate &&
         !shell.frontendBrowserToolPreflight &&
         !shell.frontendTestStandardScenarios &&
         !shell.frontendTestEnvironmentProbe &&
@@ -539,26 +537,18 @@ function validateShellTaskConfig(task, spec, issues) {
             }
         }
     }
-    if (shell.frontendDesignPolicy) {
-        const sourceNodeIds = [shell.frontendDesignPolicy.planFromNodeId];
-        for (const sourceNodeId of new Set(sourceNodeIds)) {
-            if (!task.depends_on.includes(sourceNodeId)) {
-                issues.push({
-                    type: "missing-dependency",
-                    message: `shell task ${task.id} frontendDesignPolicy source ${sourceNodeId} must be a direct dependency`,
-                });
-            }
-        }
-    }
-    if (shell.frontendWriterAdmission) {
-        const sourceNodeIds = shell.frontendWriterAdmission.designReviewFromNodeId
-            ? [shell.frontendWriterAdmission.designReviewFromNodeId]
-            : [];
+    if (shell.frontendPrewriteGate) {
+        const sourceNodeIds = [
+            shell.frontendPrewriteGate.planFromNodeId,
+            ...shell.frontendPrewriteGate.planFallbackFromNodeIds,
+            shell.frontendPrewriteGate.reviewFromNodeId,
+            ...shell.frontendPrewriteGate.reviewFallbackFromNodeIds,
+        ];
         for (const sourceNodeId of new Set(sourceNodeIds)) {
             if (!task.depends_on.includes(sourceNodeId)) {
                 issues.push({
                     type: "missing-dependency",
-                    message: `shell task ${task.id} frontendWriterAdmission source ${sourceNodeId} must be a direct dependency`,
+                    message: `shell task ${task.id} frontendPrewriteGate source ${sourceNodeId} must be a direct dependency`,
                 });
             }
         }
@@ -656,18 +646,12 @@ function validateRetryPolicyTaskConfig(task, issues) {
     }
     if (isWriterTransportCandidate) {
         const categories = new Set(task.retryPolicy.retryCategories);
-        const allowedWriterTransportCategories = new Set([
-            WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY,
-            CONTEXT_OVERFLOW_RETRY_CATEGORY,
-        ]);
-        const allAllowed = [...categories].every((category) => allowedWriterTransportCategories.has(category));
         if (task.retryPolicy.maxAttempts !== 2 ||
-            categories.size === 0 ||
-            !allAllowed ||
+            categories.size !== 1 ||
             !categories.has(WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY)) {
             issues.push({
                 type: "invalid-retry-policy",
-                message: `task ${task.id} writer transport retryPolicy must use exactly two total attempts and only writer-clean-timeout (plus optional context-overflow)`,
+                message: `task ${task.id} writer transport retryPolicy must use exactly two total attempts and only ${WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY}`,
             });
         }
     }