@tea-agent/loop-agent 0.42.0-next.2 → 0.42.0-next.4

package/dist/executors/shell-executor.js

@@ -1,8 +1,9 @@
 import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { writeDagNodeJsonArtifact, writeDagNodeTextArtifact, } from "../infrastructure/harness/artifact-store.js";
+import { writeDagNodeJsonArtifact, writeDagNodeTextArtifact, writeDagRunJsonArtifact, } from "../infrastructure/harness/artifact-store.js";
 import { captureWorkspaceCheckpoint } from "../workflows/dag/workspace-checkpoint.js";
 import { truncateOutput } from "../shared/output-truncation.js";
 import { processTreeSpawnOptions, terminateProcessTree, } from "./process-tree.js";
@@ -14,6 +15,8 @@ import { buildRequirementCoverageGateShellCommand, expandShellPreset, buildVerdi
 import { materializeBackendTestAnalysisContract } from "../workflows/dag/backend-test-analysis-contract.js";
 import { extractBackendTestContractEnvelope } from "../workflows/dag/backend-test-contract-envelope.js";
 import { materializeFrontendImplementationContract } from "../workflows/dag/frontend-implementation-contract.js";
+import { assertFrontendSourceBindingFresh, buildContractFromCommittedFacts, deterministicSha256, frontendImplementationContractSchema, serializeCompactDeterministicJson, sha256Hex, writeFrontendImplementationContractArtifact, } from "../workflows/dag/frontend-implementation-contract.js";
+import { checkFrontendSourceFidelityLedger } from "../workflows/dag/frontend-source-fidelity-ledger.js";
 import { materializeFrontendTestResult, validateFrontendCaseEvidence, } from "../workflows/dag/frontend-test-result-contract.js";
 import { copyFrontendTestStandardScenarios } from "../workflows/dag/frontend-test-standard-scenarios.js";
 import { probeFrontendTestEnvironment } from "../workflows/dag/frontend-test-environment-probe.js";
@@ -22,9 +25,15 @@ import { validateFrontendCaseChecklist } from "../workflows/dag/frontend-test-ca
 import { materializeFrontendTestCaseManifest } from "../workflows/dag/frontend-test-case-manifest.js";
 import { renderFrontendTestHtmlReport } from "../workflows/dag/frontend-test-html-report.js";
 import { formatFrontendVerificationTraceStdout, runFrontendVerificationTraceGate, } from "../workflows/dag/frontend-verification-trace.js";
-import { formatFrontendWorktreeDiffStdout, runFrontendWorktreeDiffGate, } from "../workflows/dag/frontend-worktree-diff.js";
-import { formatFrontendFailureAssessStdout, formatFrontendRepairContractStdout, runFrontendFailureAssessGate, runFrontendRepairContractGate, } from "../workflows/dag/frontend-repair.js";
-import { formatFrontendPrewriteGateStdout, runFrontendPrewriteGate, } from "../workflows/dag/frontend-prewrite-gate.js";
+import { captureFrontendWorktreeBaseline, formatFrontendWorktreeDiffStdout, runFrontendWorktreeDiffGate, } from "../workflows/dag/frontend-worktree-diff.js";
+import { readTypedEventStoreFromJsonl } from "../workflows/dag/frontend-typed-event-store.js";
+import { classifyFrontendFailure, } from "../workflows/dag/frontend-repair.js";
+import { evaluateFrontendDesignPolicy, } from "../workflows/dag/frontend-design-policy.js";
+import { deriveFrontendWriterAdmissionShell, FRONTEND_WRITER_ADMISSION_RESULT_ARTIFACT, frontendWriterAdmissionResultV1Schema, } from "../workflows/dag/frontend-writer-admission.js";
+import { deriveFrontendIntegrationFacts, buildFrontendTestHandoff, frontendCloseoutFactsSchema, renderFrontendCloseout, } from "../workflows/dag/frontend-closeout.js";
+import { buildFrontendHumanDecisionEnvelope, evaluateHighAdmissionReceipt, routeVerificationConfig, } from "../workflows/dag/frontend-human-decision.js";
+import { classifyFailureOwner, classifyIssueCategoryRestartPhase, classifyRestartPhase, } from "../workflows/dag/frontend-recovery-capsule.js";
+import { pathMatchesPattern } from "../shared/git-progress.js";
 import { formatFrontendReviewContextStdout, runFrontendReviewContextGate, } from "../workflows/dag/frontend-review-context.js";
 import { materializeFrontendLintAssessment, materializeFrontendLintBaseline, } from "../workflows/dag/frontend-lint-baseline.js";
 import { formatTraceabilityGateStdout, materializeBackendTestCaseManifest, runBackendTestTraceabilityGate, } from "../workflows/dag/backend-test-case-manifest.js";
@@ -1895,6 +1904,45 @@ async function executePipelineCommands(input, meta, overrideCommands) {
     }
     return results;
 }
+/** A+B (AC-008): derive unresolved verification entrypoints from committed plan
+ * facts. A verification target is unresolved when its commandLabel does not
+ * match any frozen command label from the verify shell evidence bundle.
+ * Returns `{ ref, digest }` entries; a missing/unreadable plan ledger fails
+ * closed to [] so the router restarts the contract instead of inventing refs. */
+async function deriveUnresolvedVerificationEntrypointRefs(runDir, frozenCommandLabels) {
+    try {
+        const { restorePlanPatchFromCommittedFacts } = await import("../workflows/dag/frontend-shadow-dual-write.js");
+        const records = await readTypedEventStoreFromJsonl(path.join(runDir, "frontend-plan-pi", "plan-typed-facts.jsonl"));
+        const patch = restorePlanPatchFromCommittedFacts(records);
+        const targets = patch
+            ?.verificationTargets;
+        if (!Array.isArray(targets))
+            return [];
+        const frozen = new Set(frozenCommandLabels
+            .map((label) => label.trim().toLowerCase())
+            .filter(Boolean));
+        const refs = [];
+        for (const item of targets) {
+            const target = item;
+            const commandLabel = typeof target.commandLabel === "string" ? target.commandLabel : "";
+            if (commandLabel &&
+                frozen.has(commandLabel.trim().toLowerCase())) {
+                continue;
+            }
+            const file = typeof target.file === "string" ? target.file : "";
+            const symbol = typeof target.symbol === "string" ? target.symbol : "";
+            const id = typeof target.id === "string" ? target.id : "";
+            const ref = file || symbol || id;
+            if (!ref)
+                continue;
+            refs.push({ ref, digest: sha256Hex(ref) });
+        }
+        return refs;
+    }
+    catch {
+        return [];
+    }
+}
 async function executeFrontendVerificationBundle(input, meta) {
     const started = Date.now();
     const shell = input.task.shell;
@@ -2049,75 +2097,861 @@ async function executeFrontendVerificationBundle(input, meta) {
     catch (error) {
         traceError = error instanceof Error ? error : new Error(String(error));
     }
-    if (bundle.mode === "repair") {
-        if (firstFailure || lintSyntheticFailure || traceError) {
+    const verifyFailed = firstFailure !== undefined || lintSyntheticFailure !== undefined || traceError !== undefined;
+    if (verifyFailed) {
+        // M8: verify failure is TERMINAL. There is no same-run repair branch and
+        // no frontend-repair-assessment.json; we only materialize failure
+        // ownership facts (frontend-repair classification + recovery capsule
+        // ownership) for the operation controller / recovery run.
+        const failedNodeId = input.task.id;
+        const failureCategory = firstFailure?.failureCategory ??
+            lintSyntheticFailure?.failureCategory ??
+            (traceError ? "invalid-output" : undefined) ??
+            "invalid-output";
+        const failureClass = classifyFrontendFailure({
+            nodeId: failedNodeId,
+            failureCategory,
+            stdout: firstFailure?.stdout,
+            stderr: firstFailure?.stderr ?? traceError?.message,
+        });
+        // A verify failure means the writer's candidate failed verification, so
+        // the recovery ownership maps to the implement phase (frontend-recovery
+        // capsule classification, fail-closed to implement-pi).
+        const classifiedOwner = classifyFailureOwner({
+            failureSource: "frontend-verify-shell",
+            nodeId: failedNodeId,
+            rawFailureCategory: failureCategory,
+        });
+        const failureOwner = classifiedOwner === "unknown" ? "implement-pi" : classifiedOwner;
+        const restartPhase = classifyRestartPhase(failureOwner);
+        // A+B (AC-008): verification-config routing. Produce structured
+        // unresolved entrypoint refs from committed plan facts and the frozen
+        // command labels; a non-empty unresolved set routes to
+        // verification-config-decision and materializes the frozen
+        // verification-config envelope. An empty/untyped signal fails closed to
+        // contract-restart. The decision is recorded so the recovery controller
+        // never re-classifies the same signal twice.
+        let verificationConfigRoute;
+        if (failureOwner === "verification-config") {
+            const frozenCommandLabels = [
+                ...(bundle.staticEvidence.commandLabels ?? []),
+                ...(bundle.behaviorEvidence.commandLabels ?? []),
+                ...(bundle.mockEvidence?.commandLabels ?? []),
+            ];
+            const unresolvedEntrypointRefs = await deriveUnresolvedVerificationEntrypointRefs(meta.runDir, frozenCommandLabels);
+            verificationConfigRoute = routeVerificationConfig({
+                unresolvedEntrypointRefs: unresolvedEntrypointRefs.map((ref) => ref.ref),
+            });
+            const allowlistedResolvers = [
+                ...new Set(frozenCommandLabels
+                    .map((label) => label.trim())
+                    .filter(Boolean)),
+            ].sort();
+            if (verificationConfigRoute.decision ===
+                "verification-config-decision" &&
+                unresolvedEntrypointRefs.length > 0 &&
+                allowlistedResolvers.length > 0) {
+                const envelope = buildFrontendHumanDecisionEnvelope({
+                    operationId: input.task.id,
+                    runId: meta.runId,
+                    operationRevision: 1,
+                    targetDigest: sha256Hex(frozenCommandLabels.slice().sort().join("\n")),
+                    staleOnTargetDigestChange: true,
+                    kind: "verification-config",
+                    resumeAction: "select-verification-config",
+                    payload: {
+                        unresolvedEntrypointRefs,
+                        allowlistedResolvers,
+                    },
+                });
+                await writeDagRunJsonArtifact(meta.runDir, "contracts/frontend-verification-config-envelope.json", envelope);
+            }
+        }
+        const verifyFailure = {
+            schemaVersion: 1,
+            schemaId: "frontend-verify-failure-v1",
+            nodeId: failedNodeId,
+            failureCategory,
+            failureClass,
+            failureOwner,
+            restartPhase,
+            ...(verificationConfigRoute
+                ? { verificationConfigRoute }
+                : {}),
+            commandResults,
+            failedAt: new Date().toISOString(),
+        };
+        await writeDagRunJsonArtifact(meta.runDir, "contracts/frontend-verify-failure.json", verifyFailure);
+        return {
+            ok: false,
+            stdout: summarizeCommandResults(results).stdout,
+            stderr: firstFailure?.stderr ||
+                lintSyntheticFailure?.stderr ||
+                traceError?.message ||
+                "frontend verification failed",
+            failureCategory,
+            durationMs: Date.now() - started,
+            ...{ commandResults },
+        };
+    }
+    // A+B (AC-008): when lint is `require-clean` but the assessment proves
+    // baseline-debt, materialize the frozen `baseline-debt-acceptance` envelope
+    // whose only positive resume is `accept-baseline-debt`. Evidence stays
+    // `baseline-debt` and is never rewritten to `passed`.
+    if (lintAssessment?.status === "baseline-debt") {
+        const baselineEvidenceRefs = (lintAssessment.rawEvidenceRefs ?? [])
+            .filter((ref) => ref?.path && ref?.sha256)
+            .map((ref) => ({ ref: ref.path, digest: ref.sha256 }));
+        if (baselineEvidenceRefs.length > 0) {
+            const envelope = buildFrontendHumanDecisionEnvelope({
+                operationId: input.task.id,
+                runId: meta.runId,
+                operationRevision: 1,
+                targetDigest: lintAssessment.commandIdentity.sha256,
+                staleOnTargetDigestChange: true,
+                kind: "baseline-debt-acceptance",
+                resumeAction: "accept-baseline-debt",
+                payload: {
+                    baselineEvidenceRefs,
+                    candidateDigest: lintAssessment.commandIdentity.sha256,
+                    commandDigest: lintAssessment.commandIdentity.sha256,
+                    resultingPolicy: "allow-non-regression",
+                },
+            });
+            await writeDagRunJsonArtifact(meta.runDir, "contracts/frontend-baseline-debt-acceptance-envelope.json", envelope);
+        }
+    }
+    return {
+        ok: true,
+        stdout: lintAssessment?.status === "baseline-debt"
+            ? "Frontend verification bundle: pass with lint baseline-debt"
+            : "Frontend verification bundle: pass",
+        stderr: "",
+        failureCategory: "success",
+        durationMs: Date.now() - started,
+        ...{ commandResults },
+    };
+}
+/* ------------------------------------------------------------------ *
+ * M8 deterministic frontend shell nodes: design policy, writer       *
+ * admission, closeout. These replace the prewrite-gate authorization  *
+ * path and the Pi closeout node.                                      *
+ * ------------------------------------------------------------------ */
+async function readRunDirJson(runDir, relativePath) {
+    return JSON.parse(await readFile(path.join(runDir, relativePath), "utf8"));
+}
+/** Committed typed review terminal kinds from the review node's typed event
+ * store (AC-003: typed terminal tools are the only authoritative verdict). */
+async function collectReviewTerminalKinds(runDir, reviewNodeId) {
+    try {
+        const records = await readTypedEventStoreFromJsonl(path.join(runDir, reviewNodeId, "review-typed-facts.jsonl"));
+        return records
+            .filter((record) => record.phase === "committed")
+            .map((record) => {
+            const kind = record.fact.kind;
+            return typeof kind === "string" ? kind : "";
+        })
+            .filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+}
+/** Committed typed design terminal kinds from the design review node's typed
+ * event store (M8: the committed approve_design / request_design_changes fact
+ * is the only authoritative verdict; the legacy first-line VERDICT text is
+ * never read for writer admission). Fail-closed on a missing/unreadable store. */
+async function collectDesignTerminalKinds(runDir, designNodeId) {
+    try {
+        const records = await readTypedEventStoreFromJsonl(path.join(runDir, designNodeId, "design-typed-facts.jsonl"));
+        return records
+            .filter((record) => record.phase === "committed")
+            .map((record) => {
+            const kind = record.fact.kind;
+            return typeof kind === "string" ? kind : "";
+        })
+            .filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+}
+/** A+B (AC-009): deterministic §4.10 restart phase for a committed
+ * `request_review_changes` fact. The typed issueCategory is mapped through the
+ * frozen classifier; `unknown` (or an unreadable store) fails closed to
+ * `undefined` so the runtime never trusts an untyped category. */
+async function collectReviewRestartPhase(runDir, reviewNodeId) {
+    try {
+        const records = await readTypedEventStoreFromJsonl(path.join(runDir, reviewNodeId, "review-typed-facts.jsonl"));
+        const request = records.find((record) => record.phase === "committed" &&
+            record.fact.kind === "request_review_changes");
+        const issueCategory = request?.fact
+            ?.issueCategory;
+        return typeof issueCategory === "string"
+            ? (classifyIssueCategoryRestartPhase(issueCategory) ?? undefined)
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A+B (AC-009): deterministic §4.10 restart phase for a committed
+ * `request_design_changes` fact. Mirrors the review collector. */
+/** Number of findings attached to the committed request_design_changes
+ * terminal fact (0 when absent) — used for the admission advisory. */
+async function collectDesignReviewFindingCount(runDir, designNodeId) {
+    try {
+        const records = await readTypedEventStoreFromJsonl(path.join(runDir, designNodeId, "design-typed-facts.jsonl"));
+        const request = records.find((record) => record.phase === "committed" &&
+            record.fact.kind ===
+                "request_design_changes");
+        const findings = (request?.fact).findings;
+        return Array.isArray(findings) ? findings.length : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+async function collectDesignRestartPhase(runDir, designNodeId) {
+    try {
+        const records = await readTypedEventStoreFromJsonl(path.join(runDir, designNodeId, "design-typed-facts.jsonl"));
+        const request = records.find((record) => record.phase === "committed" &&
+            record.fact.kind === "request_design_changes");
+        const issueCategory = request?.fact
+            ?.issueCategory;
+        return typeof issueCategory === "string"
+            ? (classifyIssueCategoryRestartPhase(issueCategory) ?? undefined)
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Resolve the deterministic runtime skeleton for the frontend plan patch from
+ * the DAG spec. The plan task carries it via `structuredContractOutput.skeleton`
+ * (the only schema-recognized persistent channel); absence is a fail-closed
+ * generation/configuration defect, never a reason to fall back to text.
+ */
+function resolveFrontendContractSkeleton(spec, planNodeId) {
+    const planTask = spec.tasks.find((task) => task.id === planNodeId);
+    const skeleton = planTask?.structuredContractOutput?.skeleton;
+    if (!skeleton || Object.keys(skeleton).length === 0) {
+        throw new Error(`frontend design policy blocked: missing runtime contract skeleton for ${planNodeId}`);
+    }
+    return skeleton;
+}
+async function collectFrontendSourceFreshness(input) {
+    const entries = [];
+    for (const source of input.sourceBinding?.sources ?? []) {
+        entries.push({ path: source.path, sha256: source.sha256, fresh: true });
+    }
+    for (const evidencePath of input.contract.designEvidence.paths) {
+        if (entries.some((entry) => entry.path === evidencePath))
+            continue;
+        try {
+            const bytes = await readFile(path.join(input.workspaceRoot, evidencePath));
+            entries.push({
+                path: evidencePath,
+                sha256: createHash("sha256").update(bytes).digest("hex"),
+                fresh: true,
+            });
+        }
+        catch {
+            entries.push({
+                path: evidencePath,
+                sha256: "0".repeat(64),
+                fresh: false,
+            });
+        }
+    }
+    return entries;
+}
+/** R3/R4 openspec invariants: frozen candidates must exist and content
+ * snapshots must not have drifted. Citation is enforced upstream by the
+ * prewrite gate read-event evidence and ledger specReference conformance. */
+async function checkFrontendOpenspecFacts(input) {
+    const frozenCandidatePaths = input.config.openspecCandidatePaths ?? [];
+    const candidateRoot = input.workspaceRoot;
+    const missingCandidates = [];
+    for (const candidate of frozenCandidatePaths) {
+        try {
+            await stat(path.join(candidateRoot, candidate));
+        }
+        catch {
+            missingCandidates.push(candidate);
+        }
+    }
+    if (missingCandidates.length > 0) {
+        throw new Error(`frontend design policy blocked: openspec candidate paths frozen at generation time no longer exist on disk: ${missingCandidates.join(", ")}`);
+    }
+    const snapshots = input.config.openspecCandidateSnapshots;
+    if (snapshots && snapshots.length > 0) {
+        for (const snapshot of snapshots) {
+            try {
+                const bytes = await readFile(path.join(candidateRoot, snapshot.path));
+                const actual = createHash("sha256").update(bytes).digest("hex");
+                if (actual !== snapshot.sha256) {
+                    throw new Error(`frontend design policy blocked: openspec candidate content hash drifted: ${snapshot.path}`);
+                }
+            }
+            catch (error) {
+                if (error instanceof Error &&
+                    error.message.startsWith("frontend design policy blocked")) {
+                    throw error;
+                }
+                throw new Error(`frontend design policy blocked: openspec candidate unreadable: ${snapshot.path}`);
+            }
+        }
+    }
+}
+async function executeFrontendDesignPolicy(input, meta) {
+    const started = Date.now();
+    const shell = input.task.shell;
+    const config = shell.frontendDesignPolicy;
+    try {
+        // 1. Materialize the canonical contract from committed typed facts. After
+        // M9a the plan node's assistantText is a pure Markdown narrative; the
+        // compile authority is the committed plan ledger ⊕ runtime skeleton.
+        // Fail closed on missing committed facts — never fall back to text.
+        const { readCommittedOriginFacts, checkCommittedOriginFacts } = await import("../workflows/dag/frontend-shadow-dual-write.js");
+        // A+B (AC-001/003): fail-closed committed contract/scout typed facts.
+        // Missing/uncommitted facts block here; never fall back to text parsing.
+        const committedContractFacts = await readCommittedOriginFacts(meta.runDir, "frontend-contract-pi", "contract-typed-facts.jsonl");
+        const contractCheck = checkCommittedOriginFacts({
+            records: committedContractFacts,
+            origin: "contract",
+        });
+        if (!contractCheck.ok) {
+            return {
+                ok: false,
+                stdout: "",
+                stderr: `frontend design policy blocked: ${contractCheck.reason}`,
+                failureCategory: "invalid-output",
+                durationMs: Date.now() - started,
+            };
+        }
+        const committedScoutFacts = await readCommittedOriginFacts(meta.runDir, "frontend-scout-pi", "scout-typed-facts.jsonl");
+        const scoutCheck = checkCommittedOriginFacts({
+            records: committedScoutFacts,
+            origin: "scout",
+        });
+        if (!scoutCheck.ok) {
+            return {
+                ok: false,
+                stdout: "",
+                stderr: `frontend design policy blocked: ${scoutCheck.reason}`,
+                failureCategory: "invalid-output",
+                durationMs: Date.now() - started,
+            };
+        }
+        const skeleton = resolveFrontendContractSkeleton(meta.spec, config.planFromNodeId);
+        const assembled = await buildContractFromCommittedFacts({
+            runDir: meta.runDir,
+            planNodeId: config.planFromNodeId,
+            contractNodeId: "frontend-contract-pi",
+            sourceBinding: meta.spec.sourceBinding,
+            skeleton,
+        });
+        if (!assembled.ok) {
+            return {
+                ok: false,
+                stdout: "",
+                stderr: `frontend design policy blocked: ${assembled.reason}`,
+                failureCategory: "invalid-output",
+                durationMs: Date.now() - started,
+            };
+        }
+        const contract = assembled.canonical;
+        // 2. Requirement id retention (R11): search the canonical contract
+        // serialization instead of the plan node narrative.
+        const contractText = serializeCompactDeterministicJson(contract);
+        const missingIds = config.requiredRequirementIds.filter((id) => !contractText.includes(id));
+        if (missingIds.length > 0) {
+            return {
+                ok: false,
+                stdout: "",
+                stderr: `frontend design policy blocked: missing requirement ids: ${missingIds.join(", ")}`,
+                failureCategory: "invalid-output",
+                durationMs: Date.now() - started,
+            };
+        }
+        // 3. Mock strategy allowed + frozen command binding (R1).
+        const mockStrategy = contract.mockApi.strategy;
+        if (!config.allowedMockStrategies.includes(mockStrategy)) {
+            return {
+                ok: false,
+                stdout: "",
+                stderr: `frontend contract mock strategy "${mockStrategy}" is incompatible with the generated allowed strategies [${config.allowedMockStrategies.join(", ")}]`,
+                failureCategory: "invalid-output",
+                durationMs: Date.now() - started,
+            };
+        }
+        if (mockStrategy !== "not-needed" && config.mockCommandLabels.length === 0) {
             return {
                 ok: false,
-                stdout: summarizeCommandResults(results).stdout,
-                stderr: firstFailure?.stderr ||
-                    lintSyntheticFailure?.stderr ||
-                    traceError?.message ||
-                    "frontend reverify failed",
-                failureCategory: firstFailure?.failureCategory ??
-                    lintSyntheticFailure?.failureCategory ??
-                    "invalid-output",
+                stdout: "",
+                stderr: `frontend design policy blocked: contract selected Mock strategy ${mockStrategy} but the DAG has no authorized Mock verification commands`,
+                failureCategory: "invalid-output",
+                durationMs: Date.now() - started,
+            };
+        }
+        // 4. writeSet containment.
+        if (config.implementationWriteSet) {
+            const writeSet = new Set(config.implementationWriteSet);
+            const uncoveredTargets = contract.targets.files.filter((target) => ![...writeSet].some((pattern) => pathMatchesPattern(target, pattern) || target === pattern));
+            if (uncoveredTargets.length > 0) {
+                return {
+                    ok: false,
+                    stdout: "",
+                    stderr: `frontend design policy blocked: contract target is outside implementation writeSet: ${uncoveredTargets.join(", ")}`,
+                    failureCategory: "invalid-output",
+                    durationMs: Date.now() - started,
+                };
+            }
+            const uncoveredVTs = contract.verificationTargets
+                .filter((vt) => vt.type !== "static")
+                .filter((vt) => ![...writeSet].some((pattern) => pathMatchesPattern(vt.file, pattern) || vt.file === pattern));
+            if (uncoveredVTs.length > 0) {
+                return {
+                    ok: false,
+                    stdout: "",
+                    stderr: `frontend design policy blocked: verification target is outside implementation writeSet: ${uncoveredVTs.map((vt) => vt.file).join(", ")}`,
+                    failureCategory: "invalid-output",
+                    durationMs: Date.now() - started,
+                };
+            }
+        }
+        // 5. Source freshness (R4) + freshness entries.
+        if (config.requireSourceFreshness) {
+            if (!meta.spec.sourceBinding) {
+                throw new Error("frontend design policy requires sourceBinding for freshness check");
+            }
+            await assertFrontendSourceBindingFresh({
+                workspaceRoot: input.cwd,
+                binding: meta.spec.sourceBinding,
+            });
+        }
+        // Byte freshness is necessary but not sufficient: require the same ledger
+        // semantic checks as the shadow prewrite gate before production writer
+        // admission can be materialized.
+        if (meta.spec.sourceBinding) {
+            const ledgerCheck = await checkFrontendSourceFidelityLedger({
+                workspaceRoot: input.cwd,
+                binding: meta.spec.sourceBinding,
+                contractRequirements: contract.requirements.map((requirement) => ({
+                    id: requirement.id,
+                    sourceFragmentIds: requirement.sourceFragmentIds,
+                    sourceRefs: requirement.sourceRefs,
+                })),
+            });
+            if (!ledgerCheck.ok) {
+                return {
+                    ok: false,
+                    stdout: "",
+                    stderr: `frontend design policy blocked: ${ledgerCheck.failureReason ?? "source fidelity ledger validation failed"}`,
+                    failureCategory: "invalid-output",
+                    durationMs: Date.now() - started,
+                };
+            }
+        }
+        const sourceFreshness = await collectFrontendSourceFreshness({
+            workspaceRoot: input.cwd,
+            sourceBinding: meta.spec.sourceBinding,
+            contract,
+        });
+        // 6. Openspec invariants (R3): frozen candidates exist and snapshots have
+        // not drifted. Citation is superseded by prewrite-gate read evidence.
+        await checkFrontendOpenspecFacts({
+            workspaceRoot: input.cwd,
+            config,
+        });
+        // 7. Deterministic design policy (M8 D2: designApproval is optional here;
+        // the design verdict is enforced by the writer-admission shell).
+        const policyResult = evaluateFrontendDesignPolicy({
+            contract,
+            allowedMockStrategies: config.allowedMockStrategies,
+            sourceFreshness,
+            componentSpecCandidatePaths: config.openspecCandidatePaths ??
+                config.componentSpecCandidatePaths ??
+                [],
+            allowedDependencies: config.allowedDependencies,
+            writeSetPatterns: config.implementationWriteSet ?? [],
+        });
+        // 8. Write canonical contract + policy result.
+        const contractArtifact = await writeFrontendImplementationContractArtifact({
+            runDir: meta.runDir,
+            outputDir: config.outputDir,
+            artifactName: config.artifactName,
+            canonical: contract,
+        });
+        await writeDagRunJsonArtifact(meta.runDir, "contracts/frontend-design-policy-result.json", policyResult);
+        if (policyResult.classification === "blocked") {
+            return {
+                ok: false,
+                stdout: "",
+                stderr: `frontend design policy blocked: ${policyResult.findings.map((finding) => `${finding.code}: ${finding.message}`).join("; ")}`,
+                failureCategory: "invalid-output",
                 durationMs: Date.now() - started,
-                ...{ commandResults },
             };
         }
         return {
             ok: true,
-            stdout: lintAssessment?.status === "baseline-debt"
-                ? "Frontend reverify bundle: pass with lint baseline-debt"
-                : "Frontend reverify bundle: pass",
+            stdout: [
+                "Frontend design policy: approved findings=0",
+                `Contract: ${contractArtifact.path}`,
+                `Contract index: ${contractArtifact.reviewIndexPath}`,
+                `Capacity diagnostic: ${contractArtifact.capacityDiagnosticPath} (non-blocking)`,
+            ].join("\n"),
             stderr: "",
             failureCategory: "success",
             durationMs: Date.now() - started,
-            ...{ commandResults },
         };
     }
-    const failureFacts = [];
-    if (firstFailure || lintSyntheticFailure) {
-        const failureStdout = firstFailure
-            ? [firstFailure.command, firstFailure.stdout].filter(Boolean).join("\n")
-            : "";
-        failureFacts.push({
-            nodeId: input.task.id,
-            record: {
-                status: "FINISHED",
-                failureCategory: firstFailure?.failureCategory ??
-                    lintSyntheticFailure?.failureCategory,
-                // Keep classification scoped to the failed command. Aggregate
-                // successful output may contain unrelated writeSet-like JSON.
-                stdout: failureStdout,
-                stderr: firstFailure?.stderr ?? lintSyntheticFailure?.stderr,
-                commandResults,
-            },
-        });
+    catch (error) {
+        return {
+            ok: false,
+            stdout: "",
+            stderr: error instanceof Error ? error.message : String(error),
+            failureCategory: "invalid-output",
+            durationMs: Date.now() - started,
+        };
     }
-    if (traceError) {
-        failureFacts.push({
-            nodeId: "frontend-verification-trace-shell",
-            record: {
-                status: "FINISHED",
-                failureCategory: "invalid-output",
-                stderr: traceError.message,
-            },
+}
+async function executeFrontendWriterAdmission(input, meta) {
+    const started = Date.now();
+    const shell = input.task.shell;
+    const config = shell.frontendWriterAdmission;
+    try {
+        // 1. Design verdict handling (r12 policy change). The typed terminal
+        // verdict is read from the committed typed design terminal fact, not
+        // from the legacy first-line VERDICT text protocol (AC-003/AC-004).
+        // A request_design_changes verdict no longer blocks writer admission:
+        // it is downgraded to an advisory that rides along in the admission
+        // receipt (and reaches implement via the review node's upstream
+        // context). Blocking is owned by the deterministic gates (prewrite,
+        // write guard) and the final code review. A missing typed terminal
+        // verdict still fails closed. In small topology the design review node
+        // is absent and the check is vacuous.
+        let verdictPass = true;
+        let designAdvisory;
+        if (config.designReviewFromNodeId) {
+            const designKinds = await collectDesignTerminalKinds(meta.runDir, config.designReviewFromNodeId);
+            if (designKinds.length !== 1) {
+                verdictPass = false;
+            }
+            else if (designKinds[0] !== "approve_design") {
+                designAdvisory = {
+                    verdict: designKinds[0],
+                    restartPhase: await collectDesignRestartPhase(meta.runDir, config.designReviewFromNodeId),
+                    findingCount: await collectDesignReviewFindingCount(meta.runDir, config.designReviewFromNodeId),
+                };
+            }
+        }
+        // 2. Read the canonical contract + design-policy result.
+        const contractRaw = await readRunDirJson(meta.runDir, "contracts/frontend-implementation-contract.json");
+        const contract = frontendImplementationContractSchema.parse(contractRaw);
+        const policyRaw = (await readRunDirJson(meta.runDir, "contracts/frontend-design-policy-result.json"));
+        if (policyRaw.schemaId !== "frontend-design-policy-v1") {
+            throw new Error("frontend writer admission: design policy result artifact invalid");
+        }
+        const designPolicyResult = {
+            schemaId: "frontend-design-policy-v1",
+            classification: policyRaw.classification === "approved" ? "approved" : "blocked",
+            findings: policyRaw.findings ?? [],
+            digest: "",
+        };
+        // 3. Freeze the pre-writer worktree baseline (cumulative diff baseline).
+        await captureFrontendWorktreeBaseline({
+            runDir: meta.runDir,
+            workspaceRoot: input.cwd,
         });
+        const baselineRaw = (await readRunDirJson(meta.runDir, "contracts/frontend-worktree-baseline.json"));
+        const baseline = (baselineRaw.files ?? [])
+            .map((file) => ({
+            path: file,
+            sha256: baselineRaw.hashes?.[file] ?? null,
+        }))
+            .filter((entry) => entry.sha256 !== null);
+        // 4. Writer-preceding lint baseline (R5) when lint is configured.
+        let lintResults = [];
+        if ((config.lintCommands?.length ?? 0) > 0) {
+            for (const command of config.lintCommands) {
+                const commandNumber = lintResults.length + 1;
+                const result = await executeShellCommand({
+                    command,
+                    cwd: input.cwd,
+                    timeoutMs: shell.timeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS,
+                    envAllowlist: shell.envAllowlist,
+                    dagRunMeta: { runDir: meta.runDir, runId: meta.runId },
+                    reportActivity: input.reportActivity,
+                    outputArtifacts: {
+                        stdoutPath: path.join(meta.runDir, input.task.id, "commands", `${commandNumber}.stdout.txt`),
+                        stderrPath: path.join(meta.runDir, input.task.id, "commands", `${commandNumber}.stderr.txt`),
+                    },
+                });
+                lintResults.push(result);
+            }
+            await materializeFrontendLintBaseline({
+                runDir: meta.runDir,
+                workspaceRoot: input.cwd,
+                commands: config.lintCommands,
+                results: lintResults,
+                worktreeChanged: false,
+            });
+        }
+        // 5. Derive admission (writeSet + digests + findings). Glob entries in
+        // the contract targets (e.g. `src/**` inherited from the skeleton) are
+        // expanded against the concrete workspace files so the derived writeSet
+        // contains only real paths the writer can touch.
+        const workspaceFiles = await collectWorkspaceFiles(input.cwd);
+        const admission = deriveFrontendWriterAdmissionShell({
+            contract,
+            designPolicyResult,
+            baseline,
+            frozenCommandLabels: config.frozenCommandLabels,
+            allowedMockStrategies: config.allowedMockStrategies,
+            workspaceFiles,
+        });
+        // 6. Design verdict enforcement: request-revision is a blocked admission.
+        const failureSource = policyRaw.classification === "blocked"
+            ? "frontend-design-policy-shell"
+            : "frontend-writer-admission-shell";
+        const findings = verdictPass
+            ? admission.findings
+            : [
+                ...admission.findings,
+                {
+                    code: "design-approval-missing",
+                    message: "design review typed terminal verdict missing or ambiguous (fail closed)",
+                },
+            ];
+        const classification = findings.length === 0 && admission.classification === "accepted"
+            ? admission.classification
+            : findings.length === 0 &&
+                admission.classification === "requires-human-approval"
+                ? "requires-human-approval"
+                : "blocked";
+        const result = frontendWriterAdmissionResultV1Schema.parse({
+            schemaVersion: 1,
+            schemaId: "frontend-writer-admission-shell-v1",
+            classification,
+            writeSet: admission.writeSet,
+            writeSetDigest: admission.writeSetDigest,
+            baselineDigest: admission.baselineDigest,
+            admissionDigest: admission.admissionDigest,
+            ...(admission.baselineDebtPolicy !== undefined
+                ? { baselineDebtPolicy: admission.baselineDebtPolicy }
+                : {}),
+            findings,
+            ...(designAdvisory ? { designReviewAdvisory: designAdvisory } : {}),
+            failureSource,
+        });
+        await writeDagRunJsonArtifact(meta.runDir, FRONTEND_WRITER_ADMISSION_RESULT_ARTIFACT, result);
+        // A+B (AC-007): High topology materializes a `high-admission-receipt-v1`
+        // catalog whose candidate digest must match the admission digest before
+        // the gate can transition from `requires-human-approval` to `accepted`.
+        // Any digest drift resolves to `stale` (never silently accepted).
+        if (classification === "requires-human-approval") {
+            const receipt = evaluateHighAdmissionReceipt({
+                candidateDigest: result.admissionDigest,
+                admissionDigest: result.admissionDigest,
+            });
+            await writeDagRunJsonArtifact(meta.runDir, "contracts/frontend-high-admission-receipt.json", receipt);
+            if (receipt.status !== "accepted") {
+                return {
+                    ok: false,
+                    stdout: "",
+                    stderr: `frontend writer admission stale: high-admission receipt candidate digest drifted from admission digest`,
+                    failureCategory: "invalid-output",
+                    durationMs: Date.now() - started,
+                };
+            }
+        }
+        if (classification === "blocked") {
+            return {
+                ok: false,
+                stdout: "",
+                stderr: `frontend writer admission ${classification}: ${findings.map((finding) => `${finding.code}: ${finding.message}`).join("; ")}`,
+                failureCategory: "invalid-output",
+                durationMs: Date.now() - started,
+            };
+        }
+        return {
+            ok: true,
+            stdout: `Frontend writer admission: ${classification} writeSet=${result.writeSet.length} writeSetDigest=${result.writeSetDigest}`,
+            stderr: "",
+            failureCategory: "success",
+            durationMs: Date.now() - started,
+        };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            stdout: "",
+            stderr: error instanceof Error ? error.message : String(error),
+            failureCategory: "invalid-output",
+            durationMs: Date.now() - started,
+        };
     }
+}
+async function executeFrontendContractImport(input, meta) {
+    const started = Date.now();
+    const shell = input.task.shell;
+    const config = shell.frontendContractImport;
     try {
-        const assessment = await runFrontendFailureAssessGate({
-            runDir: meta.runDir,
-            failureFacts,
+        const binding = meta.spec.sourceBinding;
+        if (!binding) {
+            throw new Error("frontend contract-import requires a DAG sourceBinding to re-validate freshness");
+        }
+        if (config.requireSourceFreshness) {
+            await assertFrontendSourceBindingFresh({
+                workspaceRoot: input.cwd,
+                binding,
+            });
+        }
+        const digest = createHash("sha256")
+            .update(JSON.stringify({
+            taskId: binding.taskId,
+            sources: binding.sources,
+            artifactName: config.artifactName,
+        }))
+            .digest("hex");
+        const facts = {
+            schemaVersion: 1,
+            schemaId: "frontend-contract-import-v1",
+            artifactName: config.artifactName,
+            sourceBindingTaskId: binding.taskId,
+            sourceCount: binding.sources.length,
+            fresh: true,
+            digest,
+        };
+        return {
+            ok: true,
+            stdout: JSON.stringify(facts, null, 2),
+            stderr: "",
+            failureCategory: "success",
+            durationMs: Date.now() - started,
+        };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            stdout: "",
+            stderr: error instanceof Error ? error.message : String(error),
+            failureCategory: "invalid-output",
+            durationMs: Date.now() - started,
+        };
+    }
+}
+async function executeFrontendCloseout(input, meta) {
+    const started = Date.now();
+    const shell = input.task.shell;
+    const config = shell.frontendCloseout;
+    try {
+        const context = (await readRunDirJson(meta.runDir, "contracts/frontend-review-context.json"));
+        if (context.contractRef?.path !==
+            "contracts/frontend-implementation-contract.json") {
+            throw new Error("frontend closeout missing canonical contract reference");
+        }
+        const contractRaw = await readFile(path.join(meta.runDir, context.contractRef.path), "utf8");
+        const contractSha256 = createHash("sha256")
+            .update(contractRaw)
+            .digest("hex");
+        if (contractSha256 !== context.contractRef.sha256) {
+            throw new Error("frontend closeout canonical contract hash mismatch");
+        }
+        const contract = frontendImplementationContractSchema.parse(JSON.parse(contractRaw));
+        const trace = context.verificationTrace;
+        const verificationTargets = (trace?.targets ?? []).map((target) => ({
+            status: target.status === "ok" ? "ok" : "failed",
+        }));
+        const mockEvidenceBound = contract.mockApi.strategy !== "not-needed" &&
+            typeof trace?.mockCommandNodeId === "string" &&
+            trace.mockCommandNodeId.length > 0 &&
+            Array.isArray(trace?.mockCommandLabels) &&
+            trace.mockCommandLabels.length > 0 &&
+            Array.isArray(trace?.mockCommandTexts) &&
+            trace.mockCommandTexts.length === trace.mockCommandLabels.length;
+        const integrationFacts = deriveFrontendIntegrationFacts({
+            mockStrategy: contract.mockApi.strategy,
+            realApiEvidence: { present: false, passed: false },
+            mockEvidenceBound,
+            verificationTargets,
         });
-        await runFrontendRepairContractGate({ runDir: meta.runDir });
+        // Typed review terminal (AC-003) from the committed typed event store.
+        const typedKinds = await collectReviewTerminalKinds(meta.runDir, config.reviewFromNodeId);
+        const typedVerdict = typedKinds.length === 1 &&
+            (typedKinds[0] === "approve_review" || typedKinds[0] === "request_review_changes")
+            ? typedKinds[0]
+            : null;
+        // A+B (AC-009): request_review_changes issueCategory maps to the
+        // deterministic §4.10 restart phase. Recorded as a run-owned audit
+        // artifact so the frozen closeout schema is never widened; `unknown`
+        // fails closed to no restart phase.
+        const reviewRestartPhase = typedVerdict === "request_review_changes"
+            ? await collectReviewRestartPhase(meta.runDir, config.reviewFromNodeId)
+            : undefined;
+        if (reviewRestartPhase !== undefined) {
+            await writeDagRunJsonArtifact(meta.runDir, "contracts/frontend-review-restart-phase.json", {
+                schemaVersion: 1,
+                nodeId: config.reviewFromNodeId,
+                restartPhase: reviewRestartPhase,
+            });
+        }
+        const facts = frontendCloseoutFactsSchema.parse({
+            schemaVersion: 1,
+            schemaId: "frontend-closeout-facts-v1",
+            coverageMatrix: verificationTargets.map((target, index) => ({
+                verificationTargetId: trace?.targets?.[index]?.id ?? `vt-${index}`,
+                status: target.status === "ok" ? "passed" : "failed",
+            })),
+            lintStatus: "unavailable",
+            integrationFacts,
+            reviewApproval: {
+                typedVerdict,
+                legacyVerdict: null,
+                match: true,
+            },
+            cumulativeDiff: {
+                cumulativeDigest: (typeof context.verificationTrace === "object" &&
+                    context.verificationTrace !== null &&
+                    "schemaId" in context.verificationTrace
+                    ? deterministicSha256({ verificationTrace: context.verificationTrace })
+                    : deterministicSha256({})),
+                empty: false,
+            },
+            notRun: { browser: "not-run", visual: "not-run" },
+            pendingRealIntegration: integrationFacts !== "real-api",
+        });
+        const rendered = renderFrontendCloseout(facts);
+        await writeDagRunJsonArtifact(meta.runDir, "contracts/frontend-closeout-facts.json", facts);
+        // A+B (AC-010): materialize the deterministic frontend-test handoff.
+        // browser/visual/runtime-a11y are always `not-run` and the handoff is
+        // always `deferred-to-frontend-test`, so it never blocks implementation
+        // and can never be rewritten into a passed result.
+        const handoffTaskId = meta.spec.sourceBinding?.taskId ?? input.task.id;
+        const sourceDigest = meta.spec.sourceBinding
+            ? createHash("sha256")
+                .update(JSON.stringify({
+                taskId: meta.spec.sourceBinding.taskId,
+                sources: meta.spec.sourceBinding.sources,
+            }))
+                .digest("hex")
+            : deterministicSha256({});
+        const handoff = buildFrontendTestHandoff({
+            taskId: handoffTaskId,
+            sourceDigest,
+            candidateHash: facts.cumulativeDiff.cumulativeDigest,
+        });
+        await writeDagRunJsonArtifact(meta.runDir, "contracts/frontend-test-handoff.json", handoff);
+        await writeDagNodeTextArtifact(meta.runDir, input.task.id, "frontend-closeout.md", rendered);
         return {
             ok: true,
-            stdout: formatFrontendFailureAssessStdout(assessment),
+            stdout: `Frontend closeout rendered\n${rendered.split("\n").slice(0, 8).join("\n")}`,
             stderr: "",
             failureCategory: "success",
             durationMs: Date.now() - started,
-            ...{ commandResults },
         };
     }
     catch (error) {
@@ -2127,7 +2961,6 @@ async function executeFrontendVerificationBundle(input, meta) {
             stderr: error instanceof Error ? error.message : String(error),
             failureCategory: "invalid-output",
             durationMs: Date.now() - started,
-            ...{ commandResults },
         };
     }
 }
@@ -2452,68 +3285,6 @@ async function executeFrontendTestReports(input, meta) {
         };
     }
 }
-async function executeFrontendLintBaseline(input, meta) {
-    const started = Date.now();
-    const shell = input.task.shell;
-    const baseline = shell.frontendLintBaseline;
-    const cwd = resolveShellCwd(input.cwd, shell.cwd);
-    let beforeStatus;
-    try {
-        beforeStatus = await readGitStatusPorcelain(input.cwd);
-    }
-    catch {
-        beforeStatus = undefined;
-    }
-    const results = [];
-    for (const command of baseline.lintCommands) {
-        const commandNumber = results.length + 1;
-        results.push(await executeShellCommand({
-            command,
-            cwd,
-            timeoutMs: shell.timeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS,
-            envAllowlist: shell.envAllowlist,
-            dagRunMeta: { runDir: meta.runDir, runId: meta.runId },
-            outputArtifacts: {
-                stdoutPath: path.join(meta.runDir, input.task.id, "commands", `${commandNumber}.stdout.txt`),
-                stderrPath: path.join(meta.runDir, input.task.id, "commands", `${commandNumber}.stderr.txt`),
-            },
-        }));
-    }
-    let afterStatus;
-    try {
-        afterStatus = await readGitStatusPorcelain(input.cwd);
-    }
-    catch {
-        afterStatus = undefined;
-    }
-    try {
-        const materialized = await materializeFrontendLintBaseline({
-            runDir: meta.runDir,
-            workspaceRoot: input.cwd,
-            commands: baseline.lintCommands,
-            results,
-            worktreeChanged: beforeStatus === undefined ||
-                afterStatus === undefined ||
-                beforeStatus !== afterStatus,
-        });
-        return {
-            ok: true,
-            stdout: `Frontend lint baseline: ${materialized.artifact.status}\nArtifact: ${materialized.ref.path}\nDiagnostics: ${materialized.artifact.diagnostics.length}`,
-            stderr: materialized.artifact.reason ?? "",
-            failureCategory: "success",
-            durationMs: Date.now() - started,
-        };
-    }
-    catch (error) {
-        return {
-            ok: false,
-            stdout: "",
-            stderr: error instanceof Error ? error.message : String(error),
-            failureCategory: "invalid-output",
-            durationMs: Date.now() - started,
-        };
-    }
-}
 async function writeShellPresetProcessReceipt(input) {
     await writeDagNodeJsonArtifact(input.runDir, input.nodeId, "process-receipt.json", {
         schemaVersion: 1,
@@ -2766,36 +3537,11 @@ async function executeDagShellNodeInner(input, meta) {
             });
         }
     }
-    if (shell?.frontendPrewriteGate) {
-        const started = Date.now();
-        try {
-            const result = await runFrontendPrewriteGate({
-                runDir: meta.runDir,
-                config: shell.frontendPrewriteGate,
-                sourceBinding: meta.spec.sourceBinding,
-                workspaceRoot: input.cwd,
-                repoRoot: input.cwd,
-            });
-            return {
-                ok: true,
-                stdout: formatFrontendPrewriteGateStdout(result),
-                stderr: "",
-                failureCategory: "success",
-                durationMs: Date.now() - started,
-            };
-        }
-        catch (error) {
-            return {
-                ok: false,
-                stdout: "",
-                stderr: error instanceof Error ? error.message : String(error),
-                failureCategory: "invalid-output",
-                durationMs: Date.now() - started,
-            };
-        }
+    if (shell?.frontendDesignPolicy) {
+        return executeFrontendDesignPolicy(input, meta);
     }
-    if (shell?.frontendLintBaseline) {
-        return executeFrontendLintBaseline(input, meta);
+    if (shell?.frontendWriterAdmission) {
+        return executeFrontendWriterAdmission(input, meta);
     }
     if (shell?.frontendVerificationBundle) {
         return executeFrontendVerificationBundle(input, meta);
@@ -2826,6 +3572,12 @@ async function executeDagShellNodeInner(input, meta) {
             };
         }
     }
+    if (shell?.frontendContractImport) {
+        return executeFrontendContractImport(input, meta);
+    }
+    if (shell?.frontendCloseout) {
+        return executeFrontendCloseout(input, meta);
+    }
     if (shell?.frontendTestCaseChecklist) {
         return executeFrontendTestCaseChecklist(input, meta);
     }
@@ -3048,53 +3800,23 @@ async function executeDagShellNodeInner(input, meta) {
     }
     if (shell?.commands?.length === 1 &&
         shell.commands[0] === "frontend-failure-assess-gate") {
-        const started = Date.now();
-        try {
-            const result = await runFrontendFailureAssessGate({
-                runDir: meta.runDir,
-            });
-            return {
-                ok: true,
-                stdout: formatFrontendFailureAssessStdout(result),
-                stderr: "",
-                failureCategory: "success",
-                durationMs: Date.now() - started,
-            };
-        }
-        catch (error) {
-            return {
-                ok: false,
-                stdout: "",
-                stderr: error instanceof Error ? error.message : String(error),
-                failureCategory: "invalid-output",
-                durationMs: Date.now() - started,
-            };
-        }
+        return {
+            ok: false,
+            stdout: "",
+            stderr: "frontend-failure-assess-gate legacy command removed in M8: verify failure is terminal and materializes failure ownership facts in the verification bundle itself",
+            failureCategory: "invalid-output",
+            durationMs: 0,
+        };
     }
     if (shell?.commands?.length === 1 &&
         shell.commands[0] === "frontend-repair-contract-gate") {
-        const started = Date.now();
-        try {
-            const result = await runFrontendRepairContractGate({
-                runDir: meta.runDir,
-            });
-            return {
-                ok: true,
-                stdout: formatFrontendRepairContractStdout(result.assessment),
-                stderr: "",
-                failureCategory: "success",
-                durationMs: Date.now() - started,
-            };
-        }
-        catch (error) {
-            return {
-                ok: false,
-                stdout: "",
-                stderr: error instanceof Error ? error.message : String(error),
-                failureCategory: "invalid-output",
-                durationMs: Date.now() - started,
-            };
-        }
+        return {
+            ok: false,
+            stdout: "",
+            stderr: "frontend-repair-contract-gate legacy command removed in M8: no same-run repair branch exists in the new topology",
+            failureCategory: "invalid-output",
+            durationMs: 0,
+        };
     }
     if (shell?.projectGovernanceGate) {
         const started = Date.now();
@@ -3421,6 +4143,39 @@ async function executeDagShellNodeInner(input, meta) {
         ...{ commandResults },
     };
 }
+/**
+ * Enumerate the workspace's concrete file paths for glob writeSet expansion.
+ *
+ * Uses `git ls-files -co --exclude-standard` (tracked + untracked, excluding
+ * gitignored) so the expanded writeSet reflects real files the writer can
+ * touch. Falls back to [] when the workspace is not a git repository or git
+ * fails — in that case glob entries fail closed as non-concrete paths.
+ */
+async function collectWorkspaceFiles(workspaceRoot) {
+    try {
+        const files = await new Promise((resolve, reject) => {
+            const child = spawn("git", ["ls-files", "-co", "--exclude-standard", "-z"], { cwd: workspaceRoot, stdio: ["ignore", "pipe", "ignore"] });
+            const chunks = [];
+            child.stdout.on("data", (chunk) => chunks.push(chunk));
+            child.on("error", reject);
+            child.on("close", (code) => {
+                if (code === 0) {
+                    resolve(Buffer.concat(chunks)
+                        .toString("utf8")
+                        .split("\0")
+                        .filter(Boolean));
+                }
+                else {
+                    reject(new Error(`git ls-files exited ${String(code)}`));
+                }
+            });
+        });
+        return files.map((file) => file.replace(/\\/g, "/")).sort();
+    }
+    catch {
+        return [];
+    }
+}
 export async function executeDagShellNode(input, meta) {
     const handler = namedShellHandler(input.task.shell);
     const result = await executeDagShellNodeInner(input, meta);