@tea-agent/loop-agent 0.42.0-next.1 → 0.42.0-next.3

package/dist/workflows/dag/frontend-closeout.js

@@ -0,0 +1,221 @@
+import { z } from "zod";
+export { buildFrontendShapeTransitionCapsule, computeFrontendShapeSourceDigest, evaluateFrontendShapeEscalation, FRONTEND_SHAPE_NODE_COUNTS, frontendShapeTransitionCapsuleSchema, frontendShapeTransitionReshapeCapsuleSchema, frontendShapeTransitionSplitCapsuleSchema, parseFrontendShapeTransitionCapsule, resolveFrontendTaskShape, } from "./frontend-shape.js";
+/**
+ * Deterministic frontend closeout facts + renderer (M7).
+ *
+ * The functions here are pure (no I/O, no model, no side effects). The closeout
+ * renderer reads only committed facts, never model summaries or node prose, so
+ * a weak conclusion (failed / not-run / baseline-debt / mock-backed / pending)
+ * can never be rewritten into a stronger one (passed / real-integrated).
+ *
+ * Canonical shape routing and transition capsules live in `frontend-shape.ts`
+ * and are re-exported here for callers that also consume closeout contracts.
+ */
+export const FRONTEND_CLOSEOUT_FACTS_SCHEMA_ID = "frontend-closeout-facts-v1";
+/* ------------------------------------------------------------------ *
+ * Enums + facts schema                                                 *
+ * ------------------------------------------------------------------ */
+export const frontendCoverageStatusSchema = z.enum([
+    "passed",
+    "failed",
+    "not-run",
+    "blocked",
+    "unavailable",
+]);
+export const frontendLintStatusSchema = z.enum([
+    "passed",
+    "baseline-debt",
+    "failed",
+    "unavailable",
+]);
+export const frontendIntegrationFactsSchema = z.enum([
+    "real-api",
+    "mock-backed",
+    "local-no-remote",
+    "unavailable",
+]);
+export const frontendCloseoutFactsSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    schemaId: z.literal(FRONTEND_CLOSEOUT_FACTS_SCHEMA_ID),
+    coverageMatrix: z.array(z
+        .object({
+        verificationTargetId: z.string().min(1),
+        status: frontendCoverageStatusSchema,
+    })
+        .strict()),
+    lintStatus: frontendLintStatusSchema,
+    integrationFacts: frontendIntegrationFactsSchema,
+    reviewApproval: z
+        .object({
+        typedVerdict: z
+            .enum(["approve_review", "request_review_changes"])
+            .nullable(),
+        legacyVerdict: z.enum(["pass", "request-revision"]).nullable(),
+        match: z.boolean(),
+    })
+        .strict(),
+    cumulativeDiff: z
+        .object({
+        cumulativeDigest: z.string().min(1),
+        empty: z.boolean(),
+    })
+        .strict(),
+    notRun: z
+        .object({
+        browser: z.literal("not-run"),
+        visual: z.literal("not-run"),
+    })
+        .strict(),
+    pendingRealIntegration: z.boolean(),
+    residualRisks: z.array(z.string().min(1)).optional(),
+    evidenceGaps: z.array(z.string().min(1)).optional(),
+})
+    .strict();
+/* ------------------------------------------------------------------ *
+ * FrontendTestHandoff (A+B AC-010)                                   *
+ * ------------------------------------------------------------------ */
+export const FRONTEND_TEST_HANDOFF_SCHEMA_ID = "frontend-test-handoff-v1";
+/**
+ * A+B (AC-010): deterministic frontend-test handoff. Bound to the task id,
+ * source digest, and candidate hash; browser/visual/runtime-a11y are always
+ * `not-run` and the handoff is always `deferred-to-frontend-test`, so a weak
+ * closeout can never block implementation and can never be rewritten as
+ * passed.
+ */
+export const frontendTestHandoffSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    schemaId: z.literal(FRONTEND_TEST_HANDOFF_SCHEMA_ID),
+    taskId: z.string().min(1),
+    sourceDigest: z.string().regex(/^[a-f0-9]{64}$/),
+    candidateHash: z.string().regex(/^[a-f0-9]{64}$/),
+    executionStatus: z.literal("not-run"),
+    handoffStatus: z.literal("deferred-to-frontend-test"),
+    nonBlocking: z.literal(true),
+})
+    .strict();
+export function buildFrontendTestHandoff(input) {
+    return frontendTestHandoffSchema.parse({
+        schemaVersion: 1,
+        schemaId: FRONTEND_TEST_HANDOFF_SCHEMA_ID,
+        taskId: input.taskId,
+        sourceDigest: input.sourceDigest,
+        candidateHash: input.candidateHash,
+        executionStatus: "not-run",
+        handoffStatus: "deferred-to-frontend-test",
+        nonBlocking: true,
+    });
+}
+/**
+ * Deterministic, fail-closed mapping from structured evidence to integration
+ * facts. Never reads model text. `real-api` is the only value that may report
+ * real integration, and it requires both real passed evidence and satisfied
+ * required verification evidence. Anything else downgrades to pending.
+ */
+export function deriveFrontendIntegrationFacts(input) {
+    const requiredEvidenceSatisfied = input.verificationTargets.length > 0 &&
+        input.verificationTargets.every((target) => target.status === "ok");
+    if (input.realApiEvidence.present &&
+        input.realApiEvidence.passed &&
+        requiredEvidenceSatisfied) {
+        return "real-api";
+    }
+    // Required evidence not satisfied → never report real-integrated or
+    // mock/locally-validated; evidence is unavailable.
+    if (!requiredEvidenceSatisfied) {
+        return "unavailable";
+    }
+    if (input.mockStrategy !== "not-needed" && input.mockEvidenceBound) {
+        return "mock-backed";
+    }
+    if (input.mockStrategy === "not-needed" && !input.realApiEvidence.present) {
+        return "local-no-remote";
+    }
+    return "unavailable";
+}
+/* ------------------------------------------------------------------ *
+ * Deterministic closeout renderer                                     *
+ * ------------------------------------------------------------------ */
+function bulletList(items) {
+    if (!items || items.length === 0)
+        return "";
+    return items.map((item) => `- ${item}`).join("\n");
+}
+function coverageLines(facts) {
+    const lines = facts.coverageMatrix.map((entry) => `- ${entry.verificationTargetId}: ${entry.status}`);
+    return lines.length > 0 ? lines.join("\n") : "_(none)_";
+}
+function frontendStatus(facts) {
+    switch (facts.integrationFacts) {
+        case "real-api":
+            return "Frontend status: real-integrated";
+        case "mock-backed":
+            return "Frontend status: mock-validated";
+        case "local-no-remote":
+            return "Frontend status: locally-validated";
+        case "unavailable":
+            return "Frontend status: unverified";
+    }
+}
+function integrationStatus(facts) {
+    return facts.integrationFacts === "real-api"
+        ? "Real integration: validated"
+        : `Real integration: pending (${facts.integrationFacts})`;
+}
+function reviewApprovalLines(facts) {
+    const { typedVerdict, legacyVerdict, match } = facts.reviewApproval;
+    return [
+        `typed: ${typedVerdict ?? "none"}`,
+        `legacy: ${legacyVerdict ?? "none"}`,
+        `match: ${match}`,
+    ].join("\n");
+}
+/**
+ * Render a deterministic closeout Markdown document from committed facts only.
+ * The same facts always render byte-identical output; weak statuses are
+ * emitted verbatim and never promoted to `passed` / real-integrated.
+ */
+export function renderFrontendCloseout(facts) {
+    const lintLine = facts.lintStatus === "baseline-debt"
+        ? `${facts.lintStatus} (explicit debt; not passed)`
+        : facts.lintStatus;
+    return [
+        "# Frontend Closeout",
+        "",
+        "## Coverage Matrix",
+        coverageLines(facts),
+        "",
+        "## Lint Status",
+        lintLine,
+        "",
+        "## Integration Facts",
+        facts.integrationFacts,
+        "",
+        "## Frontend Status",
+        frontendStatus(facts),
+        "",
+        "## Real Integration Status",
+        integrationStatus(facts),
+        "",
+        "## Real Integration Pending",
+        facts.pendingRealIntegration ? "yes" : "no",
+        "",
+        "## Review Approval",
+        reviewApprovalLines(facts),
+        "",
+        "## Cumulative Diff",
+        `digest: ${facts.cumulativeDiff.cumulativeDigest}`,
+        `empty: ${facts.cumulativeDiff.empty}`,
+        "",
+        "## Browser / Visual",
+        `Browser: ${facts.notRun.browser}`,
+        `Visual: ${facts.notRun.visual}`,
+        "",
+        "## Residual Risks",
+        bulletList(facts.residualRisks) || "_(none)_",
+        "",
+        "## Evidence Gaps",
+        bulletList(facts.evidenceGaps) || "_(none)_",
+    ].join("\n") + "\n";
+}

package/dist/workflows/dag/frontend-design-policy.js

@@ -0,0 +1,400 @@
+import { deterministicSha256, } from "./frontend-implementation-contract.js";
+import { pathMatchesPattern } from "../../shared/git-progress.js";
+const SHA256_HEX = /^[a-f0-9]{64}$/;
+const NPM_PACKAGE_NAME = /^(?:@[a-zA-Z0-9_.-]+\/)?[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
+/** Max concrete implementation files a single writeSet may carry before the
+ * plan is asked to split. Kept at 15: beyond this, a single implement node's
+ * read/edit loop inflates provider context toward overflow. */
+const MAX_WRITE_SET_FILES = 15;
+function normalizeRelativePath(value) {
+    return value.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function sortFindings(findings) {
+    return [...findings].sort((a, b) => {
+        if (a.code !== b.code)
+            return a.code < b.code ? -1 : 1;
+        if (a.message !== b.message)
+            return a.message < b.message ? -1 : 1;
+        const pathA = a.path ?? "";
+        const pathB = b.path ?? "";
+        if (pathA !== pathB)
+            return pathA < pathB ? -1 : 1;
+        return 0;
+    });
+}
+/** 1. UI-visible requirements must map to a design decision. Every applicable
+ * UI state and every interaction must be covered by an exact `purpose` match in
+ * `uiComponentChoices`; a present `stylingStrategy` additionally covers the
+ * visual UI-state dimension (it cannot cover behavioural interactions). */
+export function checkUiDesignCoverage(contract) {
+    const findings = [];
+    const purposes = new Set((contract.uiComponentChoices ?? []).map((choice) => choice.purpose));
+    const hasStyling = Boolean(contract.stylingStrategy?.trim());
+    // Reuse of an existing component/pattern covers behavioural interactions
+    // without forcing one uiComponentChoices row per interaction: the model
+    // should not enumerate every click/hover on a reused Button. Only
+    // interactions with no reuse and no explicit purpose are flagged.
+    const hasReuseChoice = (contract.uiComponentChoices ?? []).some((choice) => choice.decision === "reuse-existing");
+    for (const state of contract.uiStates) {
+        if (!state.applicable)
+            continue;
+        const covered = purposes.has(state.name) || hasStyling;
+        if (!covered) {
+            findings.push({
+                code: "ui-design-coverage-missing",
+                message: `applicable UI state "${state.name}" has no matching uiComponentChoices.purpose or stylingStrategy`,
+                path: state.name,
+            });
+        }
+    }
+    for (const interaction of contract.interactions) {
+        if (purposes.has(interaction.name) || hasReuseChoice)
+            continue;
+        findings.push({
+            code: "ui-design-coverage-missing",
+            message: `interaction "${interaction.name}" has no matching uiComponentChoices.purpose and no reuse-existing choice covering it`,
+            path: interaction.name,
+        });
+    }
+    return findings;
+}
+/** 2. Source freshness: every injected entry must be fresh with a valid hash;
+ * every design-evidence path must appear in the freshness set with a single,
+ * self-consistent sha256; any declared conflict is blocking. */
+export function checkSourceFreshness(contract, sourceFreshness) {
+    const findings = [];
+    const hashesByPath = new Map();
+    for (const entry of sourceFreshness) {
+        if (!entry.fresh) {
+            findings.push({
+                code: "source-stale",
+                message: `source is stale: ${entry.path}`,
+                path: entry.path,
+            });
+        }
+        if (!SHA256_HEX.test(entry.sha256)) {
+            findings.push({
+                code: "source-hash-invalid",
+                message: `source sha256 is not a valid 64-hex digest: ${entry.path}`,
+                path: entry.path,
+            });
+        }
+        const hashes = hashesByPath.get(entry.path) ?? [];
+        hashes.push(entry.sha256);
+        hashesByPath.set(entry.path, hashes);
+    }
+    for (const [path, hashes] of hashesByPath) {
+        if (new Set(hashes).size > 1) {
+            findings.push({
+                code: "source-hash-conflict",
+                message: `source freshness entries disagree on sha256: ${path}`,
+                path,
+            });
+        }
+    }
+    for (const evidencePath of contract.designEvidence.paths) {
+        if (!hashesByPath.has(evidencePath)) {
+            findings.push({
+                code: "design-evidence-path-missing-freshness",
+                message: `design evidence path is absent from the freshness set: ${evidencePath}`,
+                path: evidencePath,
+            });
+        }
+    }
+    // `designEvidence.conflicts` is the plan's honest disclosure of design
+    // deviations (e.g. task text demands a test form the frozen constraints
+    // make infeasible). Whether a disclosed conflict is acceptable is decided
+    // by the design reviewer via `approve_design` / `request_design_changes`,
+    // which `checkDesignApproval` enforces separately. Treating any conflict
+    // as blocking here would strand every honest plan that reports one — the
+    // model cannot "fix" a conflict it correctly identified. Conflicts must be
+    // disclosed (schema-required array), never silently dropped, but disclosure
+    // itself is not a policy violation.
+    return findings;
+}
+/** 3. Mock/API strategy must be allowed; non-`not-needed` strategies require
+ * at least one endpoint and every endpoint must carry fixture + consumer. */
+export function checkMockStrategy(contract, allowedMockStrategies) {
+    const findings = [];
+    if (!allowedMockStrategies.includes(contract.mockApi.strategy)) {
+        findings.push({
+            code: "mock-strategy-not-allowed",
+            message: `mockApi.strategy "${contract.mockApi.strategy}" is not in allowedMockStrategies`,
+        });
+    }
+    if (contract.mockApi.strategy !== "not-needed") {
+        if (contract.mockApi.endpoints.length === 0) {
+            findings.push({
+                code: "mock-endpoints-empty",
+                message: `mockApi.strategy "${contract.mockApi.strategy}" requires at least one endpoint`,
+            });
+        }
+        contract.mockApi.endpoints.forEach((endpoint, index) => {
+            if (!endpoint.fixture) {
+                findings.push({
+                    code: "mock-endpoint-missing-fixture",
+                    message: `mock endpoint ${index} is missing a fixture path`,
+                    path: endpoint.path,
+                });
+            }
+            if (!endpoint.consumer) {
+                findings.push({
+                    code: "mock-endpoint-missing-consumer",
+                    message: `mock endpoint ${index} is missing a consumer path`,
+                    path: endpoint.path,
+                });
+            }
+        });
+    }
+    return findings;
+}
+/** 4. Component choice must be precisely evidence-referenced: `specified`
+ * requires a specReference whose normalized path is a candidate and a non-empty
+ * section; `new` requires a task-source reference with a non-empty section;
+ * `reuse-existing` may omit it. The
+ * candidate set is the full generation-frozen openspec candidate list (the
+ * shell passes openspecCandidatePaths with componentSpecCandidatePaths as the
+ * fallback), so directory-organized component libraries are never rejected.
+ * A component specReference must still not point into clearly non-component
+ * spec areas — templates and the ai_workspace governance subtree cannot be the
+ * authoritative component definition. */
+export function checkComponentChoice(contract, componentSpecCandidatePaths) {
+    const findings = [];
+    const candidates = new Set(componentSpecCandidatePaths.map(normalizeRelativePath));
+    const isNonComponentSpecArea = (path) => {
+        const normalized = normalizeRelativePath(path);
+        return (normalized.startsWith("openspec/project-specs/templates/") ||
+            normalized.startsWith("ai_workspace/") ||
+            normalized === "openspec/project-specs/templates");
+    };
+    (contract.uiComponentChoices ?? []).forEach((choice, index) => {
+        if (choice.decision === "specified") {
+            if (!choice.specReference) {
+                findings.push({
+                    code: "component-spec-reference-missing",
+                    message: `specified component choice #${index} is missing specReference`,
+                    path: choice.purpose,
+                });
+                return;
+            }
+            if (!choice.specReference.section.trim()) {
+                findings.push({
+                    code: "component-spec-reference-missing",
+                    message: `specified component choice #${index} has an empty section`,
+                    path: choice.purpose,
+                });
+            }
+            const normalized = normalizeRelativePath(choice.specReference.path);
+            if (!candidates.has(normalized)) {
+                findings.push({
+                    code: "component-spec-reference-path-outside-candidates",
+                    message: `specified component choice #${index} specReference.path "${choice.specReference.path}" is not a candidate spec path`,
+                    path: choice.specReference.path,
+                });
+            }
+            else if (isNonComponentSpecArea(normalized)) {
+                findings.push({
+                    code: "component-spec-reference-path-outside-candidates",
+                    message: `specified component choice #${index} specReference.path "${choice.specReference.path}" is a candidate but lives in a non-component spec area (templates or ai_workspace governance cannot be the authoritative component definition)`,
+                    path: choice.specReference.path,
+                });
+            }
+        }
+        else if (choice.decision === "new") {
+            if (!choice.specReference || !choice.specReference.path) {
+                findings.push({
+                    code: "component-new-source-reference-missing",
+                    message: `new component choice #${index} is missing its task-source specReference`,
+                    path: choice.purpose,
+                });
+            }
+            else if (!choice.specReference.section.trim()) {
+                findings.push({
+                    code: "component-new-source-reference-missing",
+                    message: `new component choice #${index} has an empty task-source reference section`,
+                    path: choice.purpose,
+                });
+            }
+        }
+    });
+    return findings;
+}
+/** 5. Every implementation target and every non-static verification target
+ * must fall inside the declared writeSet patterns. */
+export function checkTargetPaths(contract, writeSetPatterns) {
+    const findings = [];
+    // No frozen writeSet patterns (legacy / unconfigured run) → nothing to
+    // check; an empty pattern set must not report every file as out of scope.
+    if (writeSetPatterns.length === 0)
+        return findings;
+    const matches = (file) => writeSetPatterns.some((pattern) => pathMatchesPattern(file, pattern));
+    // A writeSet this large forces a single implement node to read/edit many
+    // files, inflating the provider context until it overflows (400
+    // request-too-large). Flag it so the plan is asked to split (the contract
+    // node already has record_split_proposal) instead of letting the writer
+    // blow up mid-run.
+    if (contract.targets.files.length > MAX_WRITE_SET_FILES) {
+        findings.push({
+            code: "write-set-too-large",
+            message: `implementation writeSet has ${contract.targets.files.length} files (limit ${MAX_WRITE_SET_FILES}); split the task (record_split_proposal) so no single implement node exceeds the bound`,
+        });
+    }
+    for (const file of contract.targets.files) {
+        if (!matches(file)) {
+            findings.push({
+                code: "target-path-outside-write-set",
+                message: `implementation target is outside the writeSet patterns: ${file}`,
+                path: file,
+            });
+        }
+    }
+    for (const target of contract.verificationTargets) {
+        if (target.type === "static")
+            continue;
+        if (!matches(target.file)) {
+            findings.push({
+                code: "target-path-outside-write-set",
+                message: `verification target "${target.id}" file is outside the writeSet patterns: ${target.file}`,
+                path: target.file,
+            });
+        }
+    }
+    return findings;
+}
+/** 6. Any declared dependency identifier must be authorized. A declarative
+ * "no new dependencies" policy declares nothing; package-name-like tokens are
+ * matched exactly against `allowedDependencies`.
+ *
+ * The dependency policy is a natural-language statement, not a machine list.
+ * Three rules keep this check deterministic and aligned with the plan facts:
+ *
+ * 1. An empty allowedDependencies set skips the check entirely — with no
+ *    allowlist there is no ground truth to reject against. The DAG generator
+ *    normally fills this set from the project package.json, so an empty set
+ *    means the manifest could not be read (no authorization is configured).
+ * 2. A declarative "no new dependencies" intent (零新增/不新增/无新增/不引入/
+ *    no new…) satisfies the check: the model explicitly claims it adds
+ *    nothing, so prose mentioning the existing toolchain ("DOM",
+ *    "devDependencies", already-declared deps) must not be misread as new
+ *    dependency claims.
+ * 3. Otherwise, every package-name-like token must match the allowlist —
+ *    an unauthorized new dependency (a library absent from the project
+ *    manifest) still fails closed.
+ */
+export function checkDependencies(contract, allowedDependencies) {
+    const findings = [];
+    const policy = contract.dependencyPolicy?.trim();
+    if (!policy)
+        return findings;
+    // No explicit allowlist: nothing can be judged unauthorized.
+    if (allowedDependencies.length === 0)
+        return findings;
+    // Declarative no-new-dependencies intent: trust the claim, do not parse
+    // prose tokens (they mention the already-declared toolchain). The allowlist
+    // below already passes any already-declared dependency by exact match, so
+    // this exemption is deliberately narrow: only explicit negatives escape the
+    // token scan, never neutral descriptions that could conceal a new dep.
+    if (/零新增|不新增|无新增|不引入|不添加|不依赖|no\s*new\s*deps?|no\s*new\s*dependencies/i.test(policy)) {
+        return findings;
+    }
+    const allowed = new Set(allowedDependencies);
+    const tokens = policy
+        .split(/[,;\s]+/)
+        .filter((token) => token.length > 0);
+    for (const token of tokens) {
+        if (!NPM_PACKAGE_NAME.test(token))
+            continue;
+        // Already-declared dependencies are authorized by definition.
+        if (allowed.has(token))
+            continue;
+        // Versioned/scoped variants: pkg@1.2.3 or @scope/pkg@1 → match bare name.
+        const bareName = token.startsWith("@")
+            ? token.split("@").slice(0, 2).join("@")
+            : token.split("@")[0];
+        if (allowed.has(bareName))
+            continue;
+        findings.push({
+            code: "dependency-not-allowed",
+            message: `declared dependency "${token}" is not in allowedDependencies`,
+            path: token,
+        });
+    }
+    return findings;
+}
+/** 7. Every declared UI state must carry a complete attribution:
+ * applicable → expectedBehavior, non-applicable → notApplicableReason.
+ *
+ * The check validates the states the contract DECLARES, not a hardcoded list
+ * of canonical names: the plan prompts say "Do not invent UI states", so a
+ * contract that reasonably covers loading/empty/error/permission without a
+ * `disabled` entry must not be blocked for missing a state the model had no
+ * reason to declare — the model cannot fix that without inventing one, which
+ * the ladder then retries to exhaustion.
+ *
+ * Pure-logic contracts (no user-visible UI states AND no interactions) are
+ * exempt entirely: the schema and prompts explicitly allow `uiStates: []`.
+ * Once any state or interaction is declared, every declared state must carry
+ * complete attribution.
+ */
+export function checkUiStateAttribution(contract) {
+    if (contract.uiStates.length === 0 && contract.interactions.length === 0)
+        return [];
+    const findings = [];
+    for (const state of contract.uiStates) {
+        if (state.applicable && !state.expectedBehavior) {
+            findings.push({
+                code: "ui-state-attribution-incomplete",
+                message: `applicable UI state "${state.name}" is missing expectedBehavior`,
+                path: state.name,
+            });
+        }
+        if (!state.applicable && !state.notApplicableReason) {
+            findings.push({
+                code: "ui-state-attribution-incomplete",
+                message: `non-applicable UI state "${state.name}" is missing notApplicableReason`,
+                path: state.name,
+            });
+        }
+    }
+    return findings;
+}
+/** Design approval: a `request-revision` verdict from the design reviewer is
+ * blocking. This is injected as structured input, never parsed from model text. */
+export function checkDesignApproval(designApproval) {
+    if (designApproval.verdict === "request-revision") {
+        return [
+            {
+                code: "design-approval-request-revision",
+                message: "design approval verdict is request-revision",
+            },
+        ];
+    }
+    return [];
+}
+/** Aggregate the deterministic design-policy checks into a single
+ * deterministic result. Any finding blocks; an empty finding list approves. */
+export function evaluateFrontendDesignPolicy(input) {
+    const findings = sortFindings([
+        ...(input.designApproval ? checkDesignApproval(input.designApproval) : []),
+        ...checkUiDesignCoverage(input.contract),
+        ...checkSourceFreshness(input.contract, input.sourceFreshness),
+        ...checkMockStrategy(input.contract, input.allowedMockStrategies),
+        ...checkComponentChoice(input.contract, input.componentSpecCandidatePaths),
+        ...checkTargetPaths(input.contract, input.writeSetPatterns),
+        ...checkDependencies(input.contract, input.allowedDependencies),
+        ...checkUiStateAttribution(input.contract),
+    ]);
+    const classification = findings.length > 0 ? "blocked" : "approved";
+    const result = {
+        schemaId: "frontend-design-policy-v1",
+        classification,
+        findings,
+        digest: "",
+    };
+    result.digest = deterministicSha256({
+        schemaId: result.schemaId,
+        classification: result.classification,
+        findings: result.findings,
+    });
+    return result;
+}